xnu-3789.51.2.tar.gz

[apple/xnu.git] / bsd / netinet6 / ip6_fw.c

diff --git a/bsd/netinet6/ip6_fw.c b/bsd/netinet6/ip6_fw.c
index 0a7943e02a3b322031583de7e6f28b6f2102a04c..dfa12ff11c336aa86d42d9b5b0f169a98d4aca15 100644 (file)
--- a/bsd/netinet6/ip6_fw.c
+++ b/bsd/netinet6/ip6_fw.c
@@ -1,4 +1,62 @@
-/*     $KAME: ip6_fw.c,v 1.11 2000/03/10 04:22:18 k-sugyou Exp $       */
+/*
+ * Copyright (c) 2003-2012 Apple Inc. All rights reserved.
+ *
+ * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
+ * 
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. The rights granted to you under the License
+ * may not be used to create, or enable the creation or redistribution of,
+ * unlawful or unlicensed copies of an Apple operating system, or to
+ * circumvent, violate, or enable the circumvention or violation of, any
+ * terms of an Apple operating system software license agreement.
+ * 
+ * Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this file.
+ * 
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
+ * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
+ * 
+ * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
+ */
+
+/*     $FreeBSD: src/sys/netinet6/ip6_fw.c,v 1.2.2.9 2002/04/28 05:40:27 suz Exp $     */
+/*     $KAME: ip6_fw.c,v 1.21 2001/01/24 01:25:32 itojun Exp $ */
+
+/*
+ * Copyright (C) 1998, 1999, 2000 and 2001 WIDE Project.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the project nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */

 
 /*
  * Copyright (c) 1993 Daniel Boulet
 
 /*
  * Copyright (c) 1993 Daniel Boulet


@@ -13,39 +71,36 @@
  * but requiring it would be too onerous.
  *
  * This software is provided ``AS IS'' without any warranties of any kind.
  * but requiring it would be too onerous.
  *
  * This software is provided ``AS IS'' without any warranties of any kind.

- *
- *     $Id: ip6_fw.c,v 1.3 2001/05/01 21:52:50 lindak Exp $

  */
 
 /*
  * Implement IPv6 packet firewall
  */
 
  */
 
 /*
  * Implement IPv6 packet firewall
  */
 

-#ifdef __FreeBSD__
-#include "opt_ip6fw.h"
-#if __FreeBSD__ >= 3
-#include "opt_inet.h"
-#endif
-#endif

 
 

-#if IP6DIVERT
+#ifdef IP6DIVERT

 #error "NOT SUPPORTED IPV6 DIVERT"
 #endif
 #error "NOT SUPPORTED IPV6 DIVERT"
 #endif

-#if IP6FW_DIVERT_RESTART
+#ifdef IP6FW_DIVERT_RESTART

 #error "NOT SUPPORTED IPV6 DIVERT"
 #endif
 
 #error "NOT SUPPORTED IPV6 DIVERT"
 #endif
 

+#include <string.h>
+#include <machine/spl.h>
+

 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>

-#include <kern/queue.h>
+#include <sys/queue.h>

 #include <sys/kernel.h>
 #include <sys/socket.h>
 #include <sys/kernel.h>
 #include <sys/socket.h>

-#if defined(__FreeBSD__) && __FreeBSD__ >= 3 || defined (__APPLE__)

 #include <sys/socketvar.h>
 #include <sys/socketvar.h>

-#endif
+#include <sys/syslog.h>
+#include <sys/lock.h>

 #include <sys/time.h>
 #include <sys/time.h>

+#include <sys/kern_event.h>
+

 #include <net/if.h>
 #include <net/route.h>
 #include <netinet/in_systm.h>
 #include <net/if.h>
 #include <net/route.h>
 #include <netinet/in_systm.h>


@@ -60,11 +115,6 @@
 #include <netinet/in_pcb.h>
 
 #include <netinet6/ip6_fw.h>
 #include <netinet/in_pcb.h>
 
 #include <netinet6/ip6_fw.h>

-#if TCP6
-#include <netinet6/tcp6.h>
-#include <netinet6/tcp6_timer.h>
-#include <netinet6/tcp6_var.h>
-#endif

 #include <netinet/ip_var.h>
 #include <netinet/tcp.h>
 #include <netinet/tcp_seq.h>
 #include <netinet/ip_var.h>
 #include <netinet/tcp.h>
 #include <netinet/tcp_seq.h>


@@ -72,30 +122,19 @@
 #include <netinet/tcp_var.h>
 #include <netinet/udp.h>
 
 #include <netinet/tcp_var.h>
 #include <netinet/udp.h>
 

-#if defined(__NetBSD__) || defined(__OpenBSD__)
-#include <vm/vm.h>
-#endif
-#if __FreeBSD__ || defined (__APPLE__)

 #include <sys/sysctl.h>
 #include <sys/sysctl.h>

-#endif

 
 #include <net/net_osdep.h>
 
 
 #include <net/net_osdep.h>
 

-#if defined(__FreeBSD__) && __FreeBSD__ >= 3

 MALLOC_DEFINE(M_IP6FW, "Ip6Fw/Ip6Acct", "Ip6Fw/Ip6Acct chain's");
 MALLOC_DEFINE(M_IP6FW, "Ip6Fw/Ip6Acct", "Ip6Fw/Ip6Acct chain's");

-#else
-#ifndef M_IP6FW
-#define M_IP6FW        M_TEMP
-#endif
-#endif

 
 

-static int fw6_debug = 1;
-#if IPV6FIREWALL_VERBOSE
+static int fw6_debug = 0;
+#ifdef IPV6FIREWALL_VERBOSE

 static int fw6_verbose = 1;
 #else
 static int fw6_verbose = 0;
 #endif
 static int fw6_verbose = 1;
 #else
 static int fw6_verbose = 0;
 #endif

-#if IPV6FIREWALL_VERBOSE_LIMIT
+#ifdef IPV6FIREWALL_VERBOSE_LIMIT

 static int fw6_verbose_limit = IPV6FIREWALL_VERBOSE_LIMIT;
 #else
 static int fw6_verbose_limit = 0;
 static int fw6_verbose_limit = IPV6FIREWALL_VERBOSE_LIMIT;
 #else
 static int fw6_verbose_limit = 0;


@@ -103,23 +142,47 @@ static int fw6_verbose_limit = 0;
 
 LIST_HEAD (ip6_fw_head, ip6_fw_chain) ip6_fw_chain;
 
 
 LIST_HEAD (ip6_fw_head, ip6_fw_chain) ip6_fw_chain;
 

+static void ip6fw_kev_post_msg(u_int32_t );
+
+#ifdef SYSCTL_NODE
+static int ip6fw_sysctl SYSCTL_HANDLER_ARGS;
+

 SYSCTL_DECL(_net_inet6_ip6);
 SYSCTL_DECL(_net_inet6_ip6);

-SYSCTL_NODE(_net_inet6_ip6, OID_AUTO, fw, CTLFLAG_RW, 0, "Firewall");
-SYSCTL_INT(_net_inet6_ip6_fw, IP6FWCTL_DEBUG, debug, CTLFLAG_RW, &fw6_debug, 0, "");
-SYSCTL_INT(_net_inet6_ip6_fw, IP6FWCTL_VERBOSE, verbose, CTLFLAG_RW, &fw6_verbose, 0, "");
-SYSCTL_INT(_net_inet6_ip6_fw, IP6FWCTL_VERBLIMIT, verbose_limit, CTLFLAG_RW, &fw6_verbose_limit, 0, "");
+SYSCTL_NODE(_net_inet6_ip6, OID_AUTO, fw, CTLFLAG_RW|CTLFLAG_LOCKED, 0, "Firewall");
+SYSCTL_PROC(_net_inet6_ip6_fw, OID_AUTO, enable, 
+       CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED,
+       &ip6_fw_enable, 0, ip6fw_sysctl, "I", "Enable ip6fw");
+SYSCTL_INT(_net_inet6_ip6_fw, OID_AUTO, debug, CTLFLAG_RW | CTLFLAG_LOCKED, &fw6_debug, 0, "");
+SYSCTL_INT(_net_inet6_ip6_fw, OID_AUTO, verbose, CTLFLAG_RW | CTLFLAG_LOCKED, &fw6_verbose, 0, "");
+SYSCTL_INT(_net_inet6_ip6_fw, OID_AUTO, verbose_limit, CTLFLAG_RW | CTLFLAG_LOCKED, &fw6_verbose_limit, 0, "");

 
 

-#define dprintf(a)     if (!fw6_debug); else printf a
+static int
+ip6fw_sysctl SYSCTL_HANDLER_ARGS
+{
+#pragma unused(arg1, arg2)
+       int error;
+       
+       error = sysctl_handle_int(oidp, oidp->oid_arg1, oidp->oid_arg2, req);
+       if (error || !req->newptr)
+               return (error);
+       
+       ip6fw_kev_post_msg(KEV_IP6FW_ENABLE);
+       
+       return error;
+}

 
 

-#define print_ip6(a)   printf("[%s]", ip6_sprintf(a))
+#endif

 
 

-#define dprint_ip6(a)  if (!fw6_debug); else print_ip6(a)
+#define dprintf(a)     do {                                            \
+                               if (fw6_debug)                          \
+                                       printf a;                       \
+                       } while (0)
+#define SNPARGS(buf, len) buf + len, sizeof(buf) > len ? sizeof(buf) - len : 0

 
 static int     add_entry6 __P((struct ip6_fw_head *chainptr, struct ip6_fw *frwl));
 static int     del_entry6 __P((struct ip6_fw_head *chainptr, u_short number));
 
 static int     add_entry6 __P((struct ip6_fw_head *chainptr, struct ip6_fw *frwl));
 static int     del_entry6 __P((struct ip6_fw_head *chainptr, u_short number));

-static int     zero_entry6 __P((struct mbuf *m));
+static int     zero_entry6 __P((struct ip6_fw *frwl));

 static struct ip6_fw *check_ip6fw_struct __P((struct ip6_fw *m));
 static struct ip6_fw *check_ip6fw_struct __P((struct ip6_fw *m));

-static struct ip6_fw *check_ip6fw_mbuf __P((struct mbuf *fw));

 static int     ip6opts_match __P((struct ip6_hdr **ip6, struct ip6_fw *f,
                                   struct mbuf **m,
                                   int *off, int *nxt, u_short *offset));
 static int     ip6opts_match __P((struct ip6_hdr **ip6, struct ip6_fw *f,
                                   struct mbuf **m,
                                   int *off, int *nxt, u_short *offset));


@@ -132,7 +195,11 @@ static void        ip6fw_report __P((struct ip6_fw *f, struct ip6_hdr *ip6,
 
 static int     ip6_fw_chk __P((struct ip6_hdr **pip6,
                        struct ifnet *oif, u_int16_t *cookie, struct mbuf **m));
 
 static int     ip6_fw_chk __P((struct ip6_hdr **pip6,
                        struct ifnet *oif, u_int16_t *cookie, struct mbuf **m));

-static int     ip6_fw_ctl __P((int stage, struct mbuf **mm));
+static int     ip6_fw_ctl __P((struct sockopt *));
+static void cp_to_user_64( struct ip6_fw_64 *userrule_64, struct ip6_fw *rule);
+static void cp_from_user_64( struct ip6_fw_64 *userrule_64, struct ip6_fw *rule);
+static void cp_to_user_32( struct ip6_fw_32 *userrule_32, struct ip6_fw *rule);
+static void cp_from_user_32( struct ip6_fw_32 *userrule_32, struct ip6_fw *rule);

 
 static char err_prefix[] = "ip6_fw_ctl:";
 
 
 static char err_prefix[] = "ip6_fw_ctl:";
 


@@ -140,12 +207,7 @@ static char err_prefix[] = "ip6_fw_ctl:";
  * Returns 1 if the port is matched by the vector, 0 otherwise
  */
 static
  * Returns 1 if the port is matched by the vector, 0 otherwise
  */
 static

-#if defined(__FreeBSD__) && __FreeBSD__ >= 3
-__inline
-#else
-inline
-#endif
-int
+__inline int

 port_match6(u_short *portptr, int nports, u_short port, int range_flag)
 {
        if (!nports)
 port_match6(u_short *portptr, int nports, u_short port, int range_flag)
 {
        if (!nports)


@@ -170,9 +232,15 @@ tcp6flg_match(struct tcphdr *tcp6, struct ip6_fw *f)
 {
        u_char          flg_set, flg_clr;
        
 {
        u_char          flg_set, flg_clr;
        

-       if ((f->fw_tcpf & IPV6_FW_TCPF_ESTAB) &&
-           (tcp6->th_flags & (IPV6_FW_TCPF_RST | IPV6_FW_TCPF_ACK)))
-               return 1;
+       /*
+        * If an established connection is required, reject packets that
+        * have only SYN of RST|ACK|SYN set.  Otherwise, fall through to
+        * other flag requirements.
+        */
+       if ((f->fw_ipflg & IPV6_FW_IF_TCPEST) &&
+           ((tcp6->th_flags & (IPV6_FW_TCPF_RST | IPV6_FW_TCPF_ACK |
+           IPV6_FW_TCPF_SYN)) == IPV6_FW_TCPF_SYN))
+               return 0;

 
        flg_set = tcp6->th_flags & f->fw_tcpf;
        flg_clr = tcp6->th_flags & f->fw_tcpnf;
 
        flg_set = tcp6->th_flags & f->fw_tcpf;
        flg_clr = tcp6->th_flags & f->fw_tcpnf;


@@ -245,11 +313,11 @@ ip6opts_match(struct ip6_hdr **pip6, struct ip6_fw *f, struct mbuf **m,
 
                switch(*nxt) {
                case IPPROTO_FRAGMENT:
 
                switch(*nxt) {
                case IPPROTO_FRAGMENT:

-                       if ((*m)->m_len < *off + sizeof(struct ip6_frag)) {
+                       if ((*m)->m_len >= *off + sizeof(struct ip6_frag)) {

                                struct ip6_frag *ip6f;
 
                                ip6f = (struct ip6_frag *) ((caddr_t)ip6 + *off);
                                struct ip6_frag *ip6f;
 
                                ip6f = (struct ip6_frag *) ((caddr_t)ip6 + *off);

-                               *offset = ip6f->ip6f_offlg | IP6F_OFF_MASK;
+                               *offset = ip6f->ip6f_offlg & IP6F_OFF_MASK;

                        }
                        opts &= ~IPV6_FW_IP6OPT_FRAG;
                        nopts &= ~IPV6_FW_IP6OPT_FRAG;
                        }
                        opts &= ~IPV6_FW_IP6OPT_FRAG;
                        nopts &= ~IPV6_FW_IP6OPT_FRAG;


@@ -304,54 +372,42 @@ ip6opts_match(struct ip6_hdr **pip6, struct ip6_fw *f, struct mbuf **m,
 }
 
 static
 }
 
 static

-#if defined(__FreeBSD__) && __FreeBSD__ >= 3
-__inline
-#else
-inline
-#endif
-int
+__inline int

 iface_match(struct ifnet *ifp, union ip6_fw_if *ifu, int byname)
 {
        /* Check by name or by IP address */
        if (byname) {
 iface_match(struct ifnet *ifp, union ip6_fw_if *ifu, int byname)
 {
        /* Check by name or by IP address */
        if (byname) {

-#if __NetBSD__
-           {
-               char xname[IFNAMSIZ];
-               snprintf(xname, sizeof(xname), "%s%d", ifu->fu_via_if.name,
-                       ifu->fu_via_if.unit);
-               if (strcmp(ifp->if_xname, xname))
-                       return(0);
-           }
-#else

                /* Check unit number (-1 is wildcard) */
                if (ifu->fu_via_if.unit != -1
                    && ifp->if_unit != ifu->fu_via_if.unit)
                        return(0);
                /* Check name */
                /* Check unit number (-1 is wildcard) */
                if (ifu->fu_via_if.unit != -1
                    && ifp->if_unit != ifu->fu_via_if.unit)
                        return(0);
                /* Check name */

-               if (strncmp(ifp->if_name, ifu->fu_via_if.name, FW_IFNLEN))
+               if (strncmp(ifp->if_name, ifu->fu_via_if.name, IP6FW_IFNLEN))

                        return(0);
                        return(0);

-#endif

                return(1);
        } else if (!IN6_IS_ADDR_UNSPECIFIED(&ifu->fu_via_ip6)) {        /* Zero == wildcard */
                struct ifaddr *ia;
 
                return(1);
        } else if (!IN6_IS_ADDR_UNSPECIFIED(&ifu->fu_via_ip6)) {        /* Zero == wildcard */
                struct ifaddr *ia;
 

-#if defined(__bsdi__) || (defined(__FreeBSD__) && __FreeBSD__ < 3)
-               for (ia = ifp->if_addrlist; ia; ia = ia->ifa_next)
-#else
-               for (ia = ifp->if_addrlist.tqh_first; ia; ia = ia->ifa_list.tqe_next)
-#endif
+               ifnet_lock_shared(ifp);
+               for (ia = ifp->if_addrlist.tqh_first; ia;
+                   ia = ia->ifa_list.tqe_next)

                {
                {

-
-                       if (ia->ifa_addr == NULL)
-                               continue;
-                       if (ia->ifa_addr->sa_family != AF_INET6)
+                       IFA_LOCK_SPIN(ia);
+                       if (ia->ifa_addr->sa_family != AF_INET6) {
+                               IFA_UNLOCK(ia);

                                continue;
                                continue;

+                       }

                        if (!IN6_ARE_ADDR_EQUAL(&ifu->fu_via_ip6,
                            &(((struct sockaddr_in6 *)
                        if (!IN6_ARE_ADDR_EQUAL(&ifu->fu_via_ip6,
                            &(((struct sockaddr_in6 *)

-                           (ia->ifa_addr))->sin6_addr)))
+                           (ia->ifa_addr))->sin6_addr))) {
+                               IFA_UNLOCK(ia);

                                continue;
                                continue;

+                       }
+                       IFA_UNLOCK(ia);
+                       ifnet_lock_done(ifp);

                        return(1);
                }
                        return(1);
                }

+               ifnet_lock_done(ifp);

                return(0);
        }
        return(1);
                return(0);
        }
        return(1);


@@ -366,93 +422,114 @@ ip6fw_report(struct ip6_fw *f, struct ip6_hdr *ip6,
        struct udphdr *const udp = (struct udphdr *) ((caddr_t) ip6+ off);
        struct icmp6_hdr *const icmp6 = (struct icmp6_hdr *) ((caddr_t) ip6+ off);
        int count;
        struct udphdr *const udp = (struct udphdr *) ((caddr_t) ip6+ off);
        struct icmp6_hdr *const icmp6 = (struct icmp6_hdr *) ((caddr_t) ip6+ off);
        int count;

+       const char *action;
+       char action2[32], proto[102], name[18];
+       int len;

 
        count = f ? f->fw_pcnt : ++counter;
        if (fw6_verbose_limit != 0 && count > fw6_verbose_limit)
                return;
 
        /* Print command name */
 
        count = f ? f->fw_pcnt : ++counter;
        if (fw6_verbose_limit != 0 && count > fw6_verbose_limit)
                return;
 
        /* Print command name */

-       printf("ip6fw: %d ", f ? f->fw_number : -1);
+       snprintf(SNPARGS(name, 0), "ip6fw: %d", f ? f->fw_number : -1);
+
+       action = action2;

        if (!f)
        if (!f)

-               printf("Refuse");
-       else
+               action = "Refuse";
+       else {

                switch (f->fw_flg & IPV6_FW_F_COMMAND) {
                case IPV6_FW_F_DENY:
                switch (f->fw_flg & IPV6_FW_F_COMMAND) {
                case IPV6_FW_F_DENY:

-                       printf("Deny");
+                       action = "Deny";

                        break;
                case IPV6_FW_F_REJECT:
                        if (f->fw_reject_code == IPV6_FW_REJECT_RST)
                        break;
                case IPV6_FW_F_REJECT:
                        if (f->fw_reject_code == IPV6_FW_REJECT_RST)

-                               printf("Reset");
+                               action = "Reset";

                        else
                        else

-                               printf("Unreach");
+                               action = "Unreach";

                        break;
                case IPV6_FW_F_ACCEPT:
                        break;
                case IPV6_FW_F_ACCEPT:

-                       printf("Accept");
+                       action = "Accept";

                        break;
                case IPV6_FW_F_COUNT:
                        break;
                case IPV6_FW_F_COUNT:

-                       printf("Count");
+                       action = "Count";

                        break;
                case IPV6_FW_F_DIVERT:
                        break;
                case IPV6_FW_F_DIVERT:

-                       printf("Divert %d", f->fw_divert_port);
+                       snprintf(SNPARGS(action2, 0), "Divert %d",
+                           f->fw_divert_port);

                        break;
                case IPV6_FW_F_TEE:
                        break;
                case IPV6_FW_F_TEE:

-                       printf("Tee %d", f->fw_divert_port);
+                       snprintf(SNPARGS(action2, 0), "Tee %d",
+                           f->fw_divert_port);

                        break;
                case IPV6_FW_F_SKIPTO:
                        break;
                case IPV6_FW_F_SKIPTO:

-                       printf("SkipTo %d", f->fw_skipto_rule);
+                       snprintf(SNPARGS(action2, 0), "SkipTo %d",
+                           f->fw_skipto_rule);

                        break;
                default:        
                        break;
                default:        

-                       printf("UNKNOWN");
+                       action = "UNKNOWN";

                        break;
                }
                        break;
                }

-       printf(" ");
+       }

 
        switch (nxt) {
        case IPPROTO_TCP:
 
        switch (nxt) {
        case IPPROTO_TCP:

-               printf("TCP ");
-               print_ip6(&ip6->ip6_src);
+               len = snprintf(SNPARGS(proto, 0), "TCP [%s]",
+                   ip6_sprintf(&ip6->ip6_src));

                if (off > 0)
                if (off > 0)

-                       printf(":%d ", ntohs(tcp6->th_sport));
+                       len += snprintf(SNPARGS(proto, len), ":%d ",
+                           ntohs(tcp6->th_sport));

                else
                else

-                       printf(" ");
-               print_ip6(&ip6->ip6_dst);
+                       len += snprintf(SNPARGS(proto, len), " ");
+               len += snprintf(SNPARGS(proto, len), "[%s]",
+                   ip6_sprintf(&ip6->ip6_dst));

                if (off > 0)
                if (off > 0)

-                       printf(":%d", ntohs(tcp6->th_dport));
+                       snprintf(SNPARGS(proto, len), ":%d",
+                           ntohs(tcp6->th_dport));

                break;
        case IPPROTO_UDP:
                break;
        case IPPROTO_UDP:

-               printf("UDP ");
-               print_ip6(&ip6->ip6_src);
+               len = snprintf(SNPARGS(proto, 0), "UDP [%s]",
+                   ip6_sprintf(&ip6->ip6_src));

                if (off > 0)
                if (off > 0)

-                       printf(":%d ", ntohs(udp->uh_sport));
+                       len += snprintf(SNPARGS(proto, len), ":%d ",
+                           ntohs(udp->uh_sport));

                else
                else

-                       printf(" ");
-               print_ip6(&ip6->ip6_dst);
+                   len += snprintf(SNPARGS(proto, len), " ");
+               len += snprintf(SNPARGS(proto, len), "[%s]",
+                   ip6_sprintf(&ip6->ip6_dst));

                if (off > 0)
                if (off > 0)

-                       printf(":%d", ntohs(udp->uh_dport));
+                       snprintf(SNPARGS(proto, len), ":%d",
+                           ntohs(udp->uh_dport));

                break;
        case IPPROTO_ICMPV6:
                if (off > 0)
                break;
        case IPPROTO_ICMPV6:
                if (off > 0)

-                       printf("IPV6-ICMP:%u.%u ", icmp6->icmp6_type, icmp6->icmp6_code);
+                       len = snprintf(SNPARGS(proto, 0), "IPV6-ICMP:%u.%u ",
+                           icmp6->icmp6_type, icmp6->icmp6_code);

                else
                else

-                       printf("IPV6-ICMP ");
-               print_ip6(&ip6->ip6_src);
-               printf(" ");
-               print_ip6(&ip6->ip6_dst);
+                       len = snprintf(SNPARGS(proto, 0), "IPV6-ICMP ");
+               len += snprintf(SNPARGS(proto, len), "[%s]",
+                   ip6_sprintf(&ip6->ip6_src));
+               snprintf(SNPARGS(proto, len), " [%s]",
+                   ip6_sprintf(&ip6->ip6_dst));

                break;
        default:
                break;
        default:

-               printf("P:%d ", nxt);
-               print_ip6(&ip6->ip6_src);
-               printf(" ");
-               print_ip6(&ip6->ip6_dst);
+               len = snprintf(SNPARGS(proto, 0), "P:%d [%s]", nxt,
+                   ip6_sprintf(&ip6->ip6_src));
+               snprintf(SNPARGS(proto, len), " [%s]",
+                   ip6_sprintf(&ip6->ip6_dst));

                break;
        }
                break;
        }

+

        if (oif)
        if (oif)

-               printf(" out via %s", if_name(oif));
+               log(LOG_AUTHPRIV | LOG_INFO, "%s %s %s out via %s\n",
+                   name, action, proto, if_name(oif));

        else if (rif)
        else if (rif)

-               printf(" in via %s", if_name(rif));
-       printf("\n");
+               log(LOG_AUTHPRIV | LOG_INFO, "%s %s %s in via %s\n",
+                   name, action, proto, if_name(rif));
+       else
+               log(LOG_AUTHPRIV | LOG_INFO, "%s %s %s",
+                   name, action, proto);

        if (fw6_verbose_limit != 0 && count == fw6_verbose_limit)
        if (fw6_verbose_limit != 0 && count == fw6_verbose_limit)

-               printf("ip6fw: limit reached on rule #%d\n",
+           log(LOG_AUTHPRIV | LOG_INFO, "ip6fw: limit reached on entry %d\n",

                f ? f->fw_number : -1);
 }
 
                f ? f->fw_number : -1);
 }
 


@@ -484,25 +561,29 @@ ip6_fw_chk(struct ip6_hdr **pip6,
        struct ip6_fw_chain *chain;
        struct ip6_fw *rule = NULL;
        struct ip6_hdr *ip6 = *pip6;
        struct ip6_fw_chain *chain;
        struct ip6_fw *rule = NULL;
        struct ip6_hdr *ip6 = *pip6;

-       struct ifnet *const rif = (*m)->m_pkthdr.rcvif;
+       struct ifnet *const rif = ((*m)->m_flags & M_LOOP) ? lo_ifp : (*m)->m_pkthdr.rcvif;

        u_short offset = 0;
        int off = sizeof(struct ip6_hdr), nxt = ip6->ip6_nxt;
        u_short src_port, dst_port;
        u_short offset = 0;
        int off = sizeof(struct ip6_hdr), nxt = ip6->ip6_nxt;
        u_short src_port, dst_port;

-#if    IP6FW_DIVERT_RESTART
+#ifdef IP6FW_DIVERT_RESTART

        u_int16_t skipto = *cookie;
 #else
        u_int16_t ignport = ntohs(*cookie);
 #endif
        u_int16_t skipto = *cookie;
 #else
        u_int16_t ignport = ntohs(*cookie);
 #endif

+       struct timeval timenow;
+       struct tcp_respond_args tra;
+
+       getmicrotime(&timenow);

 
        *cookie = 0;
        /*
         * Go down the chain, looking for enlightment
 
        *cookie = 0;
        /*
         * Go down the chain, looking for enlightment

-        * #if IP6FW_DIVERT_RESTART
+        * #ifdef IP6FW_DIVERT_RESTART

         * If we've been asked to start at a given rule immediatly, do so.
         * #endif
         */
        chain = LIST_FIRST(&ip6_fw_chain);
         * If we've been asked to start at a given rule immediatly, do so.
         * #endif
         */
        chain = LIST_FIRST(&ip6_fw_chain);

-#if IP6FW_DIVERT_RESTART
+#ifdef IP6FW_DIVERT_RESTART

        if (skipto) {
                if (skipto >= 65535)
                        goto dropit;
        if (skipto) {
                if (skipto >= 65535)
                        goto dropit;


@@ -513,7 +594,7 @@ ip6_fw_chk(struct ip6_hdr **pip6,
        }
 #endif /* IP6FW_DIVERT_RESTART */
        for (; chain; chain = LIST_NEXT(chain, chain)) {
        }
 #endif /* IP6FW_DIVERT_RESTART */
        for (; chain; chain = LIST_NEXT(chain, chain)) {

-               register struct ip6_fw *const f = chain->rule;
+               struct ip6_fw *const f = chain->rule;

 
                if (oif) {
                        /* Check direction outbound */
 
                if (oif) {
                        /* Check direction outbound */


@@ -611,7 +692,9 @@ ip6_fw_chk(struct ip6_hdr **pip6,
                        }
                        PULLUP_TO(off + 14);
                        tcp6 = (struct tcphdr *) ((caddr_t)ip6 + off);
                        }
                        PULLUP_TO(off + 14);
                        tcp6 = (struct tcphdr *) ((caddr_t)ip6 + off);

-                       if (f->fw_tcpf != f->fw_tcpnf && !tcp6flg_match(tcp6, f))
+                       if (((f->fw_tcpf != f->fw_tcpnf) ||
+                          (f->fw_ipflg & IPV6_FW_IF_TCPEST))  &&
+                          !tcp6flg_match(tcp6, f))

                                continue;
                        src_port = ntohs(tcp6->th_sport);
                        dst_port = ntohs(tcp6->th_dport);
                                continue;
                        src_port = ntohs(tcp6->th_sport);
                        dst_port = ntohs(tcp6->th_dport);


@@ -684,11 +767,7 @@ got_match:
                /* Update statistics */
                f->fw_pcnt += 1;
                f->fw_bcnt += ntohs(ip6->ip6_plen);
                /* Update statistics */
                f->fw_pcnt += 1;
                f->fw_bcnt += ntohs(ip6->ip6_plen);

-#if defined(__FreeBSD__) && __FreeBSD__ >= 3
-               f->timestamp = time_second;
-#else
-               f->timestamp = time.tv_sec;
-#endif
+               f->timestamp = timenow.tv_sec;

 
                /* Log to console if desired */
                if ((f->fw_flg & IPV6_FW_F_PRN) && fw6_verbose)
 
                /* Log to console if desired */
                if ((f->fw_flg & IPV6_FW_F_PRN) && fw6_verbose)


@@ -701,7 +780,7 @@ got_match:
                case IPV6_FW_F_COUNT:
                        continue;
                case IPV6_FW_F_DIVERT:
                case IPV6_FW_F_COUNT:
                        continue;
                case IPV6_FW_F_DIVERT:

-#if IP6FW_DIVERT_RESTART
+#ifdef IP6FW_DIVERT_RESTART

                        *cookie = f->fw_number;
 #else
                        *cookie = htons(f->fw_divert_port);
                        *cookie = f->fw_number;
 #else
                        *cookie = htons(f->fw_divert_port);


@@ -718,7 +797,7 @@ got_match:
                         */
                        continue;
                case IPV6_FW_F_SKIPTO:
                         */
                        continue;
                case IPV6_FW_F_SKIPTO:

-#if DIAGNOSTIC
+#ifdef DIAGNOSTIC

                        while (chain->chain.le_next
                            && chain->chain.le_next->rule->fw_number
                                < f->fw_skipto_rule)
                        while (chain->chain.le_next
                            && chain->chain.le_next->rule->fw_number
                                < f->fw_skipto_rule)


@@ -735,7 +814,7 @@ got_match:
                break;
        }
 
                break;
        }
 

-#if DIAGNOSTIC
+#ifdef DIAGNOSTIC

        /* Rule 65535 should always be there and should always match */
        if (!chain)
                panic("ip6_fw: chain");
        /* Rule 65535 should always be there and should always match */
        if (!chain)
                panic("ip6_fw: chain");


@@ -755,7 +834,6 @@ got_match:
            && !IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
                switch (rule->fw_reject_code) {
                case IPV6_FW_REJECT_RST:
            && !IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
                switch (rule->fw_reject_code) {
                case IPV6_FW_REJECT_RST:

-#if 1  /*not tested*/

                  {
                        struct tcphdr *const tcp =
                                (struct tcphdr *) ((caddr_t)ip6 + off);
                  {
                        struct tcphdr *const tcp =
                                (struct tcphdr *) ((caddr_t)ip6 + off);


@@ -771,8 +849,8 @@ got_match:
 
                        ti.ip6 = *ip6;
                        ti.th = *tcp;
 
                        ti.ip6 = *ip6;
                        ti.th = *tcp;

-                       NTOHL(ti.th.th_seq);
-                       NTOHL(ti.th.th_ack);
+                       ti.th.th_seq = ntohl(ti.th.th_seq);
+                       ti.th.th_ack = ntohl(ti.th.th_ack);

                        ti.ip6.ip6_nxt = IPPROTO_TCP;
                        if (ti.th.th_flags & TH_ACK) {
                                ack = 0;
                        ti.ip6.ip6_nxt = IPPROTO_TCP;
                        if (ti.th.th_flags & TH_ACK) {
                                ack = 0;


@@ -795,22 +873,14 @@ got_match:
                                flags = TH_RST|TH_ACK;
                        }
                        bcopy(&ti, ip6, sizeof(ti));
                                flags = TH_RST|TH_ACK;
                        }
                        bcopy(&ti, ip6, sizeof(ti));

-#if TCP6
-                       tcp6_respond(NULL, ip6, (struct tcp6hdr *)(ip6 + 1),
-                               *m, ack, seq, flags);
-#elif defined(__NetBSD__)
-                       tcp_respond(NULL, NULL, *m, (struct tcphdr *)(ip6 + 1),
-                               ack, seq, flags);
-#elif defined(__FreeBSD__) && __FreeBSD__ >= 3 || defined (__APPLE__)
+                       bzero(&tra, sizeof(tra));
+                       tra.ifscope = IFSCOPE_NONE;
+                       tra.awdl_unrestricted = 1;

                        tcp_respond(NULL, ip6, (struct tcphdr *)(ip6 + 1),
                        tcp_respond(NULL, ip6, (struct tcphdr *)(ip6 + 1),

-                               *m, ack, seq, flags, 1);
-#else
-                       m_freem(*m);
-#endif
+                               *m, ack, seq, flags, &tra);

                        *m = NULL;
                        break;
                  }
                        *m = NULL;
                        break;
                  }

-#endif

                default:        /* Send an ICMP unreachable using code */
                        if (oif)
                                (*m)->m_pkthdr.rcvif = oif;
                default:        /* Send an ICMP unreachable using code */
                        if (oif)
                                (*m)->m_pkthdr.rcvif = oif;


@@ -840,17 +910,17 @@ add_entry6(struct ip6_fw_head *chainptr, struct ip6_fw *frwl)
        u_short nbr = 0;
        int s;
 
        u_short nbr = 0;
        int s;
 

-       fwc = _MALLOC(sizeof *fwc, M_IP6FW, M_NOWAIT);
-       ftmp = _MALLOC(sizeof *ftmp, M_IP6FW, M_NOWAIT);
+       fwc = _MALLOC(sizeof *fwc, M_IP6FW, M_WAITOK);
+       ftmp = _MALLOC(sizeof *ftmp, M_IP6FW, M_WAITOK);

        if (!fwc || !ftmp) {
                dprintf(("%s malloc said no\n", err_prefix));
        if (!fwc || !ftmp) {
                dprintf(("%s malloc said no\n", err_prefix));

-               if (fwc)  _FREE(fwc, M_IP6FW);
-               if (ftmp) _FREE(ftmp, M_IP6FW);
+               if (fwc)  FREE(fwc, M_IP6FW);
+               if (ftmp) FREE(ftmp, M_IP6FW);

                return (ENOSPC);
        }
 
        bcopy(frwl, ftmp, sizeof(struct ip6_fw));
                return (ENOSPC);
        }
 
        bcopy(frwl, ftmp, sizeof(struct ip6_fw));

-       ftmp->fw_in_if.fu_via_if.name[FW_IFNLEN - 1] = '\0';
+       ftmp->fw_in_if.fu_via_if.name[IP6FW_IFNLEN - 1] = '\0';

        ftmp->fw_pcnt = 0L;
        ftmp->fw_bcnt = 0L;
        fwc->rule = ftmp;
        ftmp->fw_pcnt = 0L;
        ftmp->fw_bcnt = 0L;
        fwc->rule = ftmp;


@@ -862,8 +932,8 @@ add_entry6(struct ip6_fw_head *chainptr, struct ip6_fw *frwl)
                splx(s);
                return(0);
         } else if (ftmp->fw_number == (u_short)-1) {
                splx(s);
                return(0);
         } else if (ftmp->fw_number == (u_short)-1) {

-               if (fwc)  _FREE(fwc, M_IP6FW);
-               if (ftmp) _FREE(ftmp, M_IP6FW);
+               if (fwc)  FREE(fwc, M_IP6FW);
+               if (ftmp) FREE(ftmp, M_IP6FW);

                splx(s);
                dprintf(("%s bad rule number\n", err_prefix));
                return (EINVAL);
                splx(s);
                dprintf(("%s bad rule number\n", err_prefix));
                return (EINVAL);


@@ -896,6 +966,7 @@ add_entry6(struct ip6_fw_head *chainptr, struct ip6_fw *frwl)
                }
        }
 
                }
        }
 

+       bcopy(ftmp, frwl, sizeof(struct ip6_fw));

        splx(s);
        return (0);
 }
        splx(s);
        return (0);
 }


@@ -914,8 +985,8 @@ del_entry6(struct ip6_fw_head *chainptr, u_short number)
                        if (fcp->rule->fw_number == number) {
                                LIST_REMOVE(fcp, chain);
                                splx(s);
                        if (fcp->rule->fw_number == number) {
                                LIST_REMOVE(fcp, chain);
                                splx(s);

-                               _FREE(fcp->rule, M_IP6FW);
-                               _FREE(fcp, M_IP6FW);
+                               FREE(fcp->rule, M_IP6FW);
+                               FREE(fcp, M_IP6FW);

                                return 0;
                        }
                }
                                return 0;
                        }
                }


@@ -926,20 +997,11 @@ del_entry6(struct ip6_fw_head *chainptr, u_short number)
 }
 
 static int
 }
 
 static int

-zero_entry6(struct mbuf *m)
+zero_entry6(struct ip6_fw *frwl)

 {
 {

-       struct ip6_fw *frwl;

        struct ip6_fw_chain *fcp;
        int s;
 
        struct ip6_fw_chain *fcp;
        int s;
 

-       if (m) {
-               if (m->m_len != sizeof(struct ip6_fw))
-                       return(EINVAL);
-               frwl = mtod(m, struct ip6_fw *);
-       }
-       else
-               frwl = NULL;
-

        /*
         *      It's possible to insert multiple chain entries with the
         *      same number, so we don't stop after finding the first
        /*
         *      It's possible to insert multiple chain entries with the
         *      same number, so we don't stop after finding the first


@@ -947,7 +1009,7 @@ zero_entry6(struct mbuf *m)
         */
        s = splnet();
        for (fcp = ip6_fw_chain.lh_first; fcp; fcp = fcp->chain.le_next)
         */
        s = splnet();
        for (fcp = ip6_fw_chain.lh_first; fcp; fcp = fcp->chain.le_next)

-               if (!frwl || frwl->fw_number == fcp->rule->fw_number) {
+               if (!frwl || frwl->fw_number == 0 || frwl->fw_number == fcp->rule->fw_number) {

                        fcp->rule->fw_bcnt = fcp->rule->fw_pcnt = 0;
                        fcp->rule->timestamp = 0;
                }
                        fcp->rule->fw_bcnt = fcp->rule->fw_pcnt = 0;
                        fcp->rule->timestamp = 0;
                }


@@ -955,26 +1017,16 @@ zero_entry6(struct mbuf *m)
 
        if (fw6_verbose) {
                if (frwl)
 
        if (fw6_verbose) {
                if (frwl)

-                       printf("ip6fw: Entry %d cleared.\n", frwl->fw_number);
+                       log(LOG_AUTHPRIV | LOG_NOTICE,
+                           "ip6fw: Entry %d cleared.\n", frwl->fw_number);

                else
                else

-                       printf("ip6fw: Accounting cleared.\n");
+                       log(LOG_AUTHPRIV | LOG_NOTICE,
+                           "ip6fw: Accounting cleared.\n");

        }
 
        return(0);
 }
 
        }
 
        return(0);
 }
 

-static struct ip6_fw *
-check_ip6fw_mbuf(struct mbuf *m)
-{
-       /* Check length */
-       if (m->m_len != sizeof(struct ip6_fw)) {
-               dprintf(("%s len=%d, want %d\n", err_prefix, m->m_len,
-                   sizeof(struct ip6_fw)));
-               return (NULL);
-       }
-       return(check_ip6fw_struct(mtod(m, struct ip6_fw *)));
-}
-

 static struct ip6_fw *
 check_ip6fw_struct(struct ip6_fw *frwl)
 {
 static struct ip6_fw *
 check_ip6fw_struct(struct ip6_fw *frwl)
 {


@@ -1094,127 +1146,297 @@ check_ip6fw_struct(struct ip6_fw *frwl)
        return frwl;
 }
 
        return frwl;
 }
 

+static void
+ip6fw_kev_post_msg(u_int32_t event_code)
+{
+       struct kev_msg          ev_msg;
+
+       bzero(&ev_msg, sizeof(struct kev_msg));
+       
+       ev_msg.vendor_code = KEV_VENDOR_APPLE;
+       ev_msg.kev_class = KEV_FIREWALL_CLASS;
+       ev_msg.kev_subclass = KEV_IP6FW_SUBCLASS;
+       ev_msg.event_code = event_code;
+
+       kev_post_msg(&ev_msg);
+
+}
+
+
+static void
+cp_to_user_64( struct ip6_fw_64 *userrule_64, struct ip6_fw *rule)
+{
+       userrule_64->version = rule->version;
+       userrule_64->context = CAST_USER_ADDR_T(rule->context);
+       userrule_64->fw_pcnt = rule->fw_pcnt;
+       userrule_64->fw_bcnt = rule->fw_bcnt;
+       userrule_64->fw_src = rule->fw_src;
+       userrule_64->fw_dst = rule->fw_dst;
+       userrule_64->fw_smsk = rule->fw_smsk;
+       userrule_64->fw_dmsk = rule->fw_dmsk;
+       userrule_64->fw_number = rule->fw_number;
+       userrule_64->fw_flg = rule->fw_flg;
+       userrule_64->fw_ipflg = rule->fw_ipflg;
+       bcopy( rule->fw_pts, userrule_64->fw_pts, IPV6_FW_MAX_PORTS);
+       userrule_64->fw_ip6opt= rule->fw_ip6opt;
+       userrule_64->fw_ip6nopt = rule->fw_ip6nopt;
+       userrule_64->fw_tcpf = rule->fw_tcpf;
+       userrule_64->fw_tcpnf = rule->fw_tcpnf;
+       bcopy( rule->fw_icmp6types, userrule_64->fw_icmp6types, sizeof(userrule_64->fw_icmp6types));
+       userrule_64->fw_in_if = rule->fw_in_if;
+       userrule_64->fw_out_if = rule->fw_out_if;
+       userrule_64->timestamp = rule->timestamp;
+       userrule_64->fw_un.fu_divert_port = rule->fw_un.fu_divert_port;
+       userrule_64->fw_prot = rule->fw_prot;
+       userrule_64->fw_nports = rule->fw_nports;
+}
+
+
+static void
+cp_from_user_64( struct ip6_fw_64 *userrule_64, struct ip6_fw *rule)
+{
+       rule->version = userrule_64->version;
+       rule->context = CAST_DOWN(void *, userrule_64->context);
+       rule->fw_pcnt = userrule_64->fw_pcnt;
+       rule->fw_bcnt = userrule_64->fw_bcnt;
+       rule->fw_src = userrule_64->fw_src;
+       rule->fw_dst = userrule_64->fw_dst;
+       rule->fw_smsk = userrule_64->fw_smsk;
+       rule->fw_dmsk = userrule_64->fw_dmsk;
+       rule->fw_number = userrule_64->fw_number;
+       rule->fw_flg = userrule_64->fw_flg;
+       rule->fw_ipflg = userrule_64->fw_ipflg;
+       bcopy( userrule_64->fw_pts, rule->fw_pts, IPV6_FW_MAX_PORTS);
+       rule->fw_ip6opt  = userrule_64->fw_ip6opt;
+       rule->fw_ip6nopt = userrule_64->fw_ip6nopt;
+       rule->fw_tcpf = userrule_64->fw_tcpf;
+       rule->fw_tcpnf = userrule_64->fw_tcpnf;
+       bcopy( userrule_64->fw_icmp6types, rule->fw_icmp6types, sizeof(userrule_64->fw_icmp6types));
+       rule->fw_in_if = userrule_64->fw_in_if;
+       rule->fw_out_if = userrule_64->fw_out_if;
+       rule->timestamp = CAST_DOWN( long, userrule_64->timestamp);
+       rule->fw_un.fu_divert_port = userrule_64->fw_un.fu_divert_port;
+       rule->fw_prot = userrule_64->fw_prot;
+       rule->fw_nports = userrule_64->fw_nports;
+}
+
+
+static void
+cp_to_user_32( struct ip6_fw_32 *userrule_32, struct ip6_fw *rule)
+{
+       userrule_32->version = rule->version;
+       userrule_32->context = CAST_DOWN_EXPLICIT( user32_addr_t, rule->context);
+       userrule_32->fw_pcnt = rule->fw_pcnt;
+       userrule_32->fw_bcnt = rule->fw_bcnt;
+       userrule_32->fw_src = rule->fw_src;
+       userrule_32->fw_dst = rule->fw_dst;
+       userrule_32->fw_smsk = rule->fw_smsk;
+       userrule_32->fw_dmsk = rule->fw_dmsk;
+       userrule_32->fw_number = rule->fw_number;
+       userrule_32->fw_flg = rule->fw_flg;
+       userrule_32->fw_ipflg = rule->fw_ipflg;
+       bcopy( rule->fw_pts, userrule_32->fw_pts, IPV6_FW_MAX_PORTS);
+       userrule_32->fw_ip6opt = rule->fw_ip6opt ;
+       userrule_32->fw_ip6nopt = rule->fw_ip6nopt;
+       userrule_32->fw_tcpf = rule->fw_tcpf;
+       userrule_32->fw_tcpnf = rule->fw_tcpnf;
+       bcopy( rule->fw_icmp6types, userrule_32->fw_icmp6types, sizeof(rule->fw_icmp6types));
+       userrule_32->fw_in_if = rule->fw_in_if;
+       userrule_32->fw_out_if = rule->fw_out_if;
+       userrule_32->timestamp = rule->timestamp;
+       userrule_32->fw_un.fu_divert_port = rule->fw_un.fu_divert_port;
+       userrule_32->fw_prot = rule->fw_prot;
+       userrule_32->fw_nports = rule->fw_nports;
+}
+
+
+static void
+cp_from_user_32( struct ip6_fw_32 *userrule_32, struct ip6_fw *rule)
+{
+       rule->version = userrule_32->version;
+       rule->context = CAST_DOWN(void *, userrule_32->context);
+       rule->fw_pcnt = userrule_32->fw_pcnt;
+       rule->fw_bcnt = userrule_32->fw_bcnt;
+       rule->fw_src = userrule_32->fw_src;
+       rule->fw_dst = userrule_32->fw_dst;
+       rule->fw_smsk = userrule_32->fw_smsk;
+       rule->fw_dmsk = userrule_32->fw_dmsk;
+       rule->fw_number = userrule_32->fw_number;
+       rule->fw_flg = userrule_32->fw_flg;
+       rule->fw_ipflg = userrule_32->fw_ipflg;
+       bcopy( userrule_32->fw_pts, rule->fw_pts, IPV6_FW_MAX_PORTS);
+       rule->fw_ip6opt  = userrule_32->fw_ip6opt;
+       rule->fw_ip6nopt = userrule_32->fw_ip6nopt;
+       rule->fw_tcpf = userrule_32->fw_tcpf;
+       rule->fw_tcpnf = userrule_32->fw_tcpnf;
+       bcopy( userrule_32->fw_icmp6types, rule->fw_icmp6types, sizeof(userrule_32->fw_icmp6types));
+       rule->fw_in_if = userrule_32->fw_in_if;
+       rule->fw_out_if = userrule_32->fw_out_if;
+       rule->timestamp = CAST_DOWN(long, userrule_32->timestamp);
+       rule->fw_un.fu_divert_port = userrule_32->fw_un.fu_divert_port;
+       rule->fw_prot = userrule_32->fw_prot;
+       rule->fw_nports = userrule_32->fw_nports;
+}
+

 static int
 static int

-ip6_fw_ctl(int stage, struct mbuf **mm)
+ip6_fw_ctl(struct sockopt *sopt)

 {
 {

-       int error;
-       struct mbuf *m;
+       int error = 0;
+       int spl;
+       int valsize;
+       struct ip6_fw rule;
+       int is64user=0;
+       size_t  userrulesize;
+
+       if (securelevel >= 3 &&
+               (sopt->sopt_dir != SOPT_GET || sopt->sopt_name != IPV6_FW_GET))
+               return (EPERM);
+
+       if ( proc_is64bit(sopt->sopt_p) ){
+               is64user = 1;
+               userrulesize = sizeof( struct ip6_fw_64 );
+       } else
+               userrulesize = sizeof( struct ip6_fw_32 );
+       
+       /* We ALWAYS expect the client to pass in a rule structure so that we can
+        * check the version of the API that they are using.  In the case of a
+        * IPV6_FW_GET operation, the first rule of the output buffer passed to us
+        * must have the version set. */
+       if (!sopt->sopt_val || sopt->sopt_valsize < userrulesize) return EINVAL;
+
+       /* save sopt->sopt_valsize */
+       valsize = sopt->sopt_valsize;
+       
+       if (is64user){
+               struct ip6_fw_64 userrule_64;
+               
+               if ((error = sooptcopyin(sopt, &userrule_64, userrulesize, userrulesize)))
+                       return error;
+               
+               cp_from_user_64( &userrule_64, &rule );
+       }
+       else {
+               struct ip6_fw_32 userrule_32;
+               
+               if ((error = sooptcopyin(sopt, &userrule_32, userrulesize, userrulesize)))
+                       return error;
+               
+               cp_from_user_32( &userrule_32, &rule );
+       }
+       
+       if (rule.version != IPV6_FW_CURRENT_API_VERSION) return EINVAL;
+       rule.version = 0xFFFFFFFF;      /* version is meaningless once rules "make it in the door". */

 
 

-       if (stage == IPV6_FW_GET) {
-               struct ip6_fw_chain *fcp = ip6_fw_chain.lh_first;
-#if defined(__FreeBSD__) && __FreeBSD__ >= 3 || defined (__APPLE__)
-               *mm = m = m_get(M_WAIT, MT_DATA); /* XXX */
-#else
-               *mm = m = m_get(M_WAIT, MT_SOOPTS);
-#endif
-               if (!m)
-                       return(ENOBUFS);
-               if (sizeof *(fcp->rule) > MLEN) {
-                       MCLGET(m, M_WAIT);
-                       if ((m->m_flags & M_EXT) == 0) {
-                               m_free(m);
-                               return(ENOBUFS);
+       switch (sopt->sopt_name)
+       {
+               case IPV6_FW_GET:
+               {
+                       struct ip6_fw_chain *fcp;
+                       struct ip6_fw *buf;
+                       size_t size = 0;
+                       size_t rulesize = 0;
+
+                       spl = splnet();
+                       
+                       if ( is64user )
+                               rulesize = sizeof(struct ip6_fw_64 );
+                       else
+                               rulesize = sizeof(struct ip6_fw_32 );
+                       
+                       LIST_FOREACH(fcp, &ip6_fw_chain, chain)
+                               size += rulesize;
+
+                       buf = _MALLOC(size, M_TEMP, M_WAITOK);
+                       if (!buf) error = ENOBUFS;
+                       else
+                       {
+                               //struct ip6_fw *bp = buf;
+                               caddr_t bp = (caddr_t)buf;
+                               
+                               LIST_FOREACH(fcp, &ip6_fw_chain, chain)
+                               {
+                                       //bcopy(fcp->rule, bp, sizeof *bp);
+                                       if ( is64user ){
+                                               cp_to_user_64( (struct ip6_fw_64*)bp, fcp->rule);
+                                       }
+                                       else {
+                                               cp_to_user_32( (struct ip6_fw_32*)bp, fcp->rule);
+                                       }
+
+                                       ( (struct ip6_fw*)bp)->version = IPV6_FW_CURRENT_API_VERSION;
+                                       //bp++;
+                                       bp += rulesize;
+                               }
+                       }
+
+                       splx(spl);
+                       if (buf)
+                       {
+                               sopt->sopt_valsize = valsize;
+                               error = sooptcopyout(sopt, buf, size);
+                               FREE(buf, M_TEMP);

                        }
                        }

+
+                       break;

                }
                }

-               for (; fcp; fcp = fcp->chain.le_next) {
-                       memcpy(m->m_data, fcp->rule, sizeof *(fcp->rule));
-                       m->m_len = sizeof *(fcp->rule);
-#if defined(__FreeBSD__) && __FreeBSD__ >= 3 || defined (__APPLE__)
-                       m->m_next = m_get(M_WAIT, MT_DATA); /* XXX */
-#else
-                       m->m_next = m_get(M_WAIT, MT_SOOPTS);
-#endif
-                       if (!m->m_next) {
-                               m_freem(*mm);
-                               return(ENOBUFS);
+
+               case IPV6_FW_FLUSH:
+                       spl = splnet();
+                       while (ip6_fw_chain.lh_first &&
+                               ip6_fw_chain.lh_first->rule->fw_number != (u_short)-1)
+                       {
+                               struct ip6_fw_chain *fcp = ip6_fw_chain.lh_first;
+                               LIST_REMOVE(ip6_fw_chain.lh_first, chain);
+                               FREE(fcp->rule, M_IP6FW);
+                               FREE(fcp, M_IP6FW);

                        }
                        }

-                       m = m->m_next;
-                       if (sizeof *(fcp->rule) > MLEN) {
-                               MCLGET(m, M_WAIT);
-                               if ((m->m_flags & M_EXT) == 0) {
-                                       m_freem(*mm);
-                                       return(ENOBUFS);
-                               }
+                       splx(spl);
+                       ip6fw_kev_post_msg(KEV_IP6FW_FLUSH);
+                       break;
+
+               case IPV6_FW_ZERO:
+                       error = zero_entry6(&rule);
+                       break;
+
+               case IPV6_FW_ADD:
+                       if (check_ip6fw_struct(&rule)) {
+                               error = add_entry6(&ip6_fw_chain, &rule);
+
+                               ip6fw_kev_post_msg(KEV_IP6FW_ADD);
+                       } else
+                               error = EINVAL;
+
+                       if (is64user){
+                               struct ip6_fw_64 userrule_64;
+                               cp_to_user_64( &userrule_64, &rule);
+                               error = sooptcopyout(sopt, &userrule_64, userrulesize);

                        }
                        }

-                       m->m_len = 0;
-               }
-               return (0);
-       }
-       m = *mm;
-       /* only allow get calls if secure mode > 2 */
-       if (securelevel > 2) {
-               if (m) {
-                       (void)m_freem(m);
-                       *mm = 0;
-               }
-               return(EPERM);
-       }
-       if (stage == IPV6_FW_FLUSH) {
-               while (ip6_fw_chain.lh_first != NULL && 
-                   ip6_fw_chain.lh_first->rule->fw_number != (u_short)-1) {
-                       struct ip6_fw_chain *fcp = ip6_fw_chain.lh_first;
-                       int s = splnet();
-                       LIST_REMOVE(ip6_fw_chain.lh_first, chain);
-                       splx(s);
-                       _FREE(fcp->rule, M_IP6FW);
-                       _FREE(fcp, M_IP6FW);
-               }
-               if (m) {
-                       (void)m_freem(m);
-                       *mm = 0;
-               }
-               return (0);
-       }
-       if (stage == IPV6_FW_ZERO) {
-               error = zero_entry6(m);
-               if (m) {
-                       (void)m_freem(m);
-                       *mm = 0;
-               }
-               return (error);
-       }
-       if (m == NULL) {
-               printf("%s NULL mbuf ptr\n", err_prefix);
-               return (EINVAL);
-       }
+                       else {
+                               struct ip6_fw_32 userrule_32;
+                               cp_to_user_32( &userrule_32, &rule);
+                               error = sooptcopyout(sopt, &userrule_32, userrulesize);
+                       }
+                       break;

 
 

-       if (stage == IPV6_FW_ADD) {
-               struct ip6_fw *frwl = check_ip6fw_mbuf(m);
+               case IPV6_FW_DEL:
+                       if (rule.fw_number == (u_short)-1)
+                       {
+                               dprintf(("%s can't delete rule 65535\n", err_prefix));
+                               error = EINVAL;
+                       }
+                       else {
+                               error = del_entry6(&ip6_fw_chain, rule.fw_number);

 
 

-               if (!frwl)
-                       error = EINVAL;
-               else
-                       error = add_entry6(&ip6_fw_chain, frwl);
-               if (m) {
-                       (void)m_freem(m);
-                       *mm = 0;
-               }
-               return error;
-       }
-       if (stage == IPV6_FW_DEL) {
-               if (m->m_len != sizeof(struct ip6_fw)) {
-                       dprintf(("%s len=%d, want %d\n", err_prefix, m->m_len,
-                           sizeof(struct ip6_fw)));
-                       error = EINVAL;
-               } else if (mtod(m, struct ip6_fw *)->fw_number == (u_short)-1) {
-                       dprintf(("%s can't delete rule 65535\n", err_prefix));
+                               ip6fw_kev_post_msg(KEV_IP6FW_DEL);
+                       }
+                       break;
+
+               default:
+                       dprintf(("%s invalid option %d\n", err_prefix, sopt->sopt_name));

                        error = EINVAL;
                        error = EINVAL;

-               } else
-                       error = del_entry6(&ip6_fw_chain,
-                           mtod(m, struct ip6_fw *)->fw_number);
-               if (m) {
-                       (void)m_freem(m);
-                       *mm = 0;
-               }
-               return error;

        }
 
        }
 

-       dprintf(("%s unknown request %d\n", err_prefix, stage));
-       if (m) {
-               (void)m_freem(m);
-               *mm = 0;
-       }
-       return (EINVAL);
+       return error;

 }
 
 void
 }
 
 void


@@ -1229,7 +1451,7 @@ ip6_fw_init(void)
        bzero(&default_rule, sizeof default_rule);
        default_rule.fw_prot = IPPROTO_IPV6;
        default_rule.fw_number = (u_short)-1;
        bzero(&default_rule, sizeof default_rule);
        default_rule.fw_prot = IPPROTO_IPV6;
        default_rule.fw_number = (u_short)-1;

-#if IPV6FIREWALL_DEFAULT_TO_ACCEPT
+#ifdef IPV6FIREWALL_DEFAULT_TO_ACCEPT

        default_rule.fw_flg |= IPV6_FW_F_ACCEPT;
 #else
        default_rule.fw_flg |= IPV6_FW_F_DENY;
        default_rule.fw_flg |= IPV6_FW_F_ACCEPT;
 #else
        default_rule.fw_flg |= IPV6_FW_F_DENY;


@@ -1237,19 +1459,10 @@ ip6_fw_init(void)
        default_rule.fw_flg |= IPV6_FW_F_IN | IPV6_FW_F_OUT;
        if (check_ip6fw_struct(&default_rule) == NULL ||
                add_entry6(&ip6_fw_chain, &default_rule))
        default_rule.fw_flg |= IPV6_FW_F_IN | IPV6_FW_F_OUT;
        if (check_ip6fw_struct(&default_rule) == NULL ||
                add_entry6(&ip6_fw_chain, &default_rule))

-               panic(__FUNCTION__);
+               panic("%s", __FUNCTION__);

 
 

-#if 1  /* NOT SUPPORTED IPV6 DIVERT */

        printf("IPv6 packet filtering initialized, ");
        printf("IPv6 packet filtering initialized, ");

-#else
-       printf("IPv6 packet filtering initialized, "
-#if IP6DIVERT
-               "divert enabled, ");
-#else
-               "divert disabled, ");
-#endif
-#endif
-#if IPV6FIREWALL_DEFAULT_TO_ACCEPT
+#ifdef IPV6FIREWALL_DEFAULT_TO_ACCEPT

        printf("default to accept, ");
 #endif
 #ifndef IPV6FIREWALL_VERBOSE
        printf("default to accept, ");
 #endif
 #ifndef IPV6FIREWALL_VERBOSE


@@ -1262,3 +1475,4 @@ ip6_fw_init(void)
                    fw6_verbose_limit);
 #endif
 }
                    fw6_verbose_limit);
 #endif
 }

+