aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDarren Reed <darrenr@FreeBSD.org>2002-04-25 03:23:52 +0000
committerDarren Reed <darrenr@FreeBSD.org>2002-04-25 03:23:52 +0000
commit13114a18aca46dd02874c48e043dd8c043b5b8fa (patch)
tree5ececb7c37c22c41bde52ba90505ceb97a1169b3
parent76531d9f8d54be5c8da482dd6dc247802c602ae9 (diff)
downloadsrc-13114a18aca46dd02874c48e043dd8c043b5b8fa.tar.gz
src-13114a18aca46dd02874c48e043dd8c043b5b8fa.zip
Import IPFilter 3.4.26 kernel sources, including H.323 proxy.
Include the licence file for both IPFilter and the H.323 proxy (from QNX), for convienence.
Notes
Notes: svn path=/vendor-sys/ipfilter/dist/; revision=95414
-rw-r--r--sys/contrib/ipfilter/netinet/IPFILTER.LICENCE5
-rw-r--r--sys/contrib/ipfilter/netinet/fil.c9
-rw-r--r--sys/contrib/ipfilter/netinet/ip_auth.c8
-rw-r--r--sys/contrib/ipfilter/netinet/ip_compat.h82
-rw-r--r--sys/contrib/ipfilter/netinet/ip_fil.c11
-rw-r--r--sys/contrib/ipfilter/netinet/ip_fil.h27
-rw-r--r--sys/contrib/ipfilter/netinet/ip_frag.c4
-rw-r--r--sys/contrib/ipfilter/netinet/ip_h323_pxy.c40
-rw-r--r--sys/contrib/ipfilter/netinet/ip_log.c3
-rw-r--r--sys/contrib/ipfilter/netinet/ip_nat.c122
-rw-r--r--sys/contrib/ipfilter/netinet/ip_nat.h4
-rw-r--r--sys/contrib/ipfilter/netinet/ip_state.c218
-rw-r--r--sys/contrib/ipfilter/netinet/ip_state.h27
-rw-r--r--sys/contrib/ipfilter/netinet/ipl.h4
14 files changed, 378 insertions, 186 deletions
diff --git a/sys/contrib/ipfilter/netinet/IPFILTER.LICENCE b/sys/contrib/ipfilter/netinet/IPFILTER.LICENCE
index dfb199c5f962..2b4b67e86fd9 100644
--- a/sys/contrib/ipfilter/netinet/IPFILTER.LICENCE
+++ b/sys/contrib/ipfilter/netinet/IPFILTER.LICENCE
@@ -1,6 +1,4 @@
-Copyright (C) 1993-2001 by Darren Reed.
-
-$FreeBSD$
+Copyright (C) 1993-2002 by Darren Reed.
The author accepts no responsibility for the use of this software and
provides it on an ``as is'' basis without express or implied warranty.
@@ -27,3 +25,4 @@ OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
SUCH DAMAGE.
I hate legalese, don't you ?
+
diff --git a/sys/contrib/ipfilter/netinet/fil.c b/sys/contrib/ipfilter/netinet/fil.c
index 06623c357ebb..3ce8131413cd 100644
--- a/sys/contrib/ipfilter/netinet/fil.c
+++ b/sys/contrib/ipfilter/netinet/fil.c
@@ -97,7 +97,7 @@
#if !defined(lint)
static const char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$Id: fil.c,v 2.35.2.58 2002/03/13 02:23:13 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: fil.c,v 2.35.2.59 2002/03/25 11:07:37 darrenr Exp $";
#endif
#ifndef _KERNEL
@@ -211,9 +211,7 @@ fr_info_t *fin;
fin->fin_data[1] = 0;
fin->fin_rule = -1;
fin->fin_group = -1;
-#ifdef _KERNEL
fin->fin_icode = ipl_unreach;
-#endif
v = fin->fin_v;
fi->fi_v = v;
fin->fin_hlen = hlen;
@@ -263,6 +261,7 @@ fr_info_t *fin;
fin->fin_off = off;
fin->fin_plen = plen;
fin->fin_dp = (char *)tcp;
+ fin->fin_misc = 0;
off <<= 3;
switch (p)
@@ -295,7 +294,7 @@ fr_info_t *fin;
}
}
- if (!(plen >= hlen + minicmpsz))
+ if (!(plen >= minicmpsz))
fi->fi_fl |= FI_SHORT;
break;
@@ -1496,7 +1495,7 @@ nodata:
* SUCH DAMAGE.
*
* @(#)uipc_mbuf.c 8.2 (Berkeley) 1/4/94
- * $Id: fil.c,v 2.35.2.58 2002/03/13 02:23:13 darrenr Exp $
+ * $Id: fil.c,v 2.35.2.59 2002/03/25 11:07:37 darrenr Exp $
*/
/*
* Copy data from an mbuf chain starting "off" bytes from the beginning,
diff --git a/sys/contrib/ipfilter/netinet/ip_auth.c b/sys/contrib/ipfilter/netinet/ip_auth.c
index e4ad347280c7..2a73079d2cb0 100644
--- a/sys/contrib/ipfilter/netinet/ip_auth.c
+++ b/sys/contrib/ipfilter/netinet/ip_auth.c
@@ -104,7 +104,7 @@ extern struct ifqueue ipintrq; /* ip packet input queue */
#endif
#if !defined(lint)
-static const char rcsid[] = "@(#)$Id: ip_auth.c,v 2.11.2.17 2002/03/06 09:44:10 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ip_auth.c,v 2.11.2.19 2002/04/23 14:57:27 darrenr Exp $";
#endif
@@ -405,6 +405,7 @@ fr_authioctlloop:
RWLOCK_EXIT(&ipf_auth);
return 0;
}
+ RWLOCK_EXIT(&ipf_auth);
#ifdef _KERNEL
# if SOLARIS
mutex_enter(&ipf_authmx);
@@ -417,7 +418,6 @@ fr_authioctlloop:
error = SLEEP(&fr_authnext, "fr_authnext");
# endif
#endif
- RWLOCK_EXIT(&ipf_auth);
if (!error)
goto fr_authioctlloop;
break;
@@ -447,7 +447,7 @@ fr_authioctlloop:
#ifdef _KERNEL
if (m && au->fra_info.fin_out) {
# if SOLARIS
- error = fr_qout(fra->fra_q, m);
+ error = (fr_qout(fra->fra_q, m) == 0) ? EINVAL : 0;
# else /* SOLARIS */
struct route ro;
@@ -469,7 +469,7 @@ fr_authioctlloop:
fr_authstats.fas_sendok++;
} else if (m) {
# if SOLARIS
- error = fr_qin(fra->fra_q, m);
+ error = (fr_qin(fra->fra_q, m) == 0) ? EINVAL : 0;
# else /* SOLARIS */
ifq = &ipintrq;
if (IF_QFULL(ifq)) {
diff --git a/sys/contrib/ipfilter/netinet/ip_compat.h b/sys/contrib/ipfilter/netinet/ip_compat.h
index 4eab541231a6..d0dc859aae47 100644
--- a/sys/contrib/ipfilter/netinet/ip_compat.h
+++ b/sys/contrib/ipfilter/netinet/ip_compat.h
@@ -4,7 +4,7 @@
* See the IPFILTER.LICENCE file for details on licencing.
*
* @(#)ip_compat.h 1.8 1/14/96
- * $Id: ip_compat.h,v 2.26.2.39 2002/03/13 03:54:34 darrenr Exp $
+ * $Id: ip_compat.h,v 2.26.2.43 2002/04/23 16:08:50 darrenr Exp $
*/
#ifndef __IP_COMPAT_H__
@@ -103,7 +103,6 @@ struct ether_addr {
# include <sys/sysmacros.h>
#endif
-
/*
* This is a workaround for <sys/uio.h> troubles on FreeBSD and OpenBSD.
*/
@@ -197,10 +196,6 @@ typedef int minor_t;
#endif /* SOLARIS */
#define IPMINLEN(i, h) ((i)->ip_len >= ((i)->ip_hl * 4 + sizeof(struct h)))
-#if defined(__FreeBSD__) && (__FreeBSD__ >= 5) && defined(_KERNEL)
-# include <machine/in_cksum.h>
-#endif
-
#ifndef IP_OFFMASK
#define IP_OFFMASK 0x1fff
#endif
@@ -215,6 +210,30 @@ typedef int minor_t;
#endif /* BSD > 199306 */
+#if defined(__FreeBSD__) && (defined(KERNEL) || defined(_KERNEL))
+# include <sys/param.h>
+# ifndef __FreeBSD_version
+# include <sys/osreldate.h>
+# endif
+# ifdef IPFILTER_LKM
+# define ACTUALLY_LKM_NOT_KERNEL
+# endif
+# if defined(__FreeBSD_version) && (__FreeBSD_version < 300000)
+# include <machine/spl.h>
+# else
+# if (__FreeBSD_version >= 300000) && (__FreeBSD_version < 400000)
+# if defined(IPFILTER_LKM) && !defined(ACTUALLY_LKM_NOT_KERNEL)
+# define ACTUALLY_LKM_NOT_KERNEL
+# endif
+# endif
+# endif
+#endif /* __FreeBSD__ && KERNEL */
+
+#if defined(__FreeBSD_version) && (__FreeBSD_version >= 500000) && \
+ defined(_KERNEL)
+# include <machine/in_cksum.h>
+#endif
+
/*
* These operating systems already take care of the problem for us.
*/
@@ -230,6 +249,13 @@ typedef u_int32_t u_32_t;
# include "opt_inet6.h"
# endif
# ifdef INET6
+# define USE_INET6
+# endif
+# endif
+# if !defined(_KERNEL) && !defined(IPFILTER_LKM)
+# if (defined(__FreeBSD_version) && (__FreeBSD_version >= 400000)) || \
+ (defined(OpenBSD) && (OpenBSD >= 200111)) || \
+ (defined(__NetBSD_Version__) && (__NetBSD_Version__ >= 105000000))
# define USE_INET6
# endif
# endif
@@ -341,40 +367,9 @@ union i6addr {
#define IPOPT_EIP 145 /* EIP */
#define IPOPT_FINN 205 /* FINN */
-
-#if defined(__FreeBSD__) && (defined(KERNEL) || defined(_KERNEL))
-# ifdef IPFILTER_LKM
-# ifndef __FreeBSD_cc_version
-# include <osreldate.h>
-# else
-# if __FreeBSD_cc_version < 430000
-# include <osreldate.h>
-# else
-# include <sys/param.h>
-# endif
-# endif
-# define ACTUALLY_LKM_NOT_KERNEL
-# else
-# ifndef __FreeBSD_cc_version
-# include <sys/osreldate.h>
-# else
-# if __FreeBSD_cc_version < 430000
-# include <sys/osreldate.h>
-# else
-# include <sys/param.h>
-# endif
-# endif
-# endif
-# if __FreeBSD__ < 3
-# include <machine/spl.h>
-# else
-# if __FreeBSD__ == 3
-# if defined(IPFILTER_LKM) && !defined(ACTUALLY_LKM_NOT_KERNEL)
-# define ACTUALLY_LKM_NOT_KERNEL
-# endif
-# endif
-# endif
-#endif /* __FreeBSD__ && KERNEL */
+#ifndef TCPOPT_WSCALE
+# define TCPOPT_WSCALE 3
+#endif
/*
* Build some macros and #defines to enable the same code to compile anywhere
@@ -580,7 +575,8 @@ extern void m_copyback __P((struct mbuf *, int, int, caddr_t));
defined(__FreeBSD__) || defined(__OpenBSD__) || defined(_BSDI_VERSION)
# include <vm/vm.h>
# endif
-# if !defined(__FreeBSD__) || (defined (__FreeBSD__) && __FreeBSD__>=3)
+# if !defined(__FreeBSD__) || (defined (__FreeBSD_version) && \
+ (__FreeBSD_version >= 300000))
# if (defined(__NetBSD_Version__) && (__NetBSD_Version__ >= 105180000)) || \
(defined(OpenBSD) && (OpenBSD >= 200111))
# include <uvm/uvm_extern.h>
@@ -589,9 +585,9 @@ extern void m_copyback __P((struct mbuf *, int, int, caddr_t));
extern vm_map_t kmem_map;
# endif
# include <sys/proc.h>
-# else /* !__FreeBSD__ || (__FreeBSD__ && __FreeBSD__>=3) */
+# else /* !__FreeBSD__ || (__FreeBSD__ && __FreeBSD_version >= 300000) */
# include <vm/vm_kern.h>
-# endif /* !__FreeBSD__ || (__FreeBSD__ && __FreeBSD__>=3) */
+# endif /* !__FreeBSD__ || (__FreeBSD__ && __FreeBSD_version >= 300000) */
# ifdef M_PFIL
# define KMALLOC(a, b) MALLOC((a), b, sizeof(*(a)), M_PFIL, M_NOWAIT)
# define KMALLOCS(a, b, c) MALLOC((a), b, (c), M_PFIL, M_NOWAIT)
diff --git a/sys/contrib/ipfilter/netinet/ip_fil.c b/sys/contrib/ipfilter/netinet/ip_fil.c
index 1cac072015e6..2aeeaf878115 100644
--- a/sys/contrib/ipfilter/netinet/ip_fil.c
+++ b/sys/contrib/ipfilter/netinet/ip_fil.c
@@ -25,6 +25,7 @@
# endif
#endif
#ifdef __sgi
+# define _KMEMUSER
# include <sys/ptimers.h>
#endif
#ifndef _KERNEL
@@ -119,7 +120,7 @@ extern int ip_optcopy __P((struct ip *, struct ip *));
#if !defined(lint)
static const char sccsid[] = "@(#)ip_fil.c 2.41 6/5/96 (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_fil.c,v 2.42.2.53 2002/03/13 02:29:08 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ip_fil.c,v 2.42.2.55 2002/03/26 15:54:39 darrenr Exp $";
#endif
@@ -359,7 +360,7 @@ int iplattach()
}
# ifdef NETBSD_PF
-# if __NetBSD_Version__ >= 104200000
+# if (__NetBSD_Version__ >= 104200000) || (__FreeBSD_version >= 500011)
# if __NetBSD_Version__ >= 105110000
if (
!(ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET))
@@ -526,7 +527,7 @@ int ipldetach()
fr_running = 0;
# ifdef NETBSD_PF
-# if __NetBSD_Version__ >= 104200000
+# if ((__NetBSD_Version__ >= 104200000) || (__FreeBSD_version >= 500011))
# if __NetBSD_Version__ >= 105110000
if (ph_inet != NULL)
error = pfil_remove_hook((void *)fr_check_wrapper, NULL,
@@ -2136,8 +2137,8 @@ struct uio *uio;
num = io->iov_len;
if (num > left)
num = left;
- start = io->iov_base + offset;
- if (start > io->iov_base + io->iov_len) {
+ start = (char *)io->iov_base + offset;
+ if (start > (char *)io->iov_base + io->iov_len) {
offset -= io->iov_len;
ioc++;
continue;
diff --git a/sys/contrib/ipfilter/netinet/ip_fil.h b/sys/contrib/ipfilter/netinet/ip_fil.h
index 96a8f4bb8c6e..82deef5f2cd7 100644
--- a/sys/contrib/ipfilter/netinet/ip_fil.h
+++ b/sys/contrib/ipfilter/netinet/ip_fil.h
@@ -4,7 +4,7 @@
* See the IPFILTER.LICENCE file for details on licencing.
*
* @(#)ip_fil.h 1.35 6/5/96
- * $Id: ip_fil.h,v 2.29.2.29 2002/03/13 03:56:46 darrenr Exp $
+ * $Id: ip_fil.h,v 2.29.2.32 2002/04/10 04:57:14 darrenr Exp $
*/
#ifndef __IP_FIL_H__
@@ -55,8 +55,8 @@
# define SIOCFRSYN _IOW('r', 73, u_int)
# define SIOCFRZST _IOWR('r', 74, struct friostat *)
# define SIOCZRLST _IOWR('r', 75, struct frentry *)
-# define SIOCAUTHW _IOWR('r', 76, struct frauth_t *)
-# define SIOCAUTHR _IOWR('r', 77, struct frauth_t *)
+# define SIOCAUTHW _IOWR('r', 76, struct frauth *)
+# define SIOCAUTHR _IOWR('r', 77, struct frauth *)
# define SIOCATHST _IOWR('r', 78, struct fr_authstat *)
# define SIOCSTLCK _IOWR('r', 79, u_int)
# define SIOCSTPUT _IOWR('r', 80, struct ipstate_save *)
@@ -80,8 +80,8 @@
# define SIOCFRSYN _IOW(r, 73, u_int)
# define SIOCFRZST _IOWR(r, 74, struct friostat *)
# define SIOCZRLST _IOWR(r, 75, struct frentry *)
-# define SIOCAUTHW _IOWR(r, 76, struct frauth_t *)
-# define SIOCAUTHR _IOWR(r, 77, struct frauth_t *)
+# define SIOCAUTHW _IOWR(r, 76, struct frauth *)
+# define SIOCAUTHR _IOWR(r, 77, struct frauth *)
# define SIOCATHST _IOWR(r, 78, struct fr_authstat *)
# define SIOCSTLCK _IOWR(r, 79, u_int)
# define SIOCSTPUT _IOWR(r, 80, struct ipstate_save *)
@@ -135,12 +135,11 @@ typedef struct fr_info {
void *fin_ifp; /* interface packet is `on' */
struct fr_ip fin_fi; /* IP Packet summary */
u_short fin_data[2]; /* TCP/UDP ports, ICMP code/type */
- u_char fin_out; /* in or out ? 1 == out, 0 == in */
- u_char fin_rev; /* state only: 1 = reverse */
+ u_int fin_out; /* in or out ? 1 == out, 0 == in */
u_short fin_hlen; /* length of IP header in bytes */
+ u_char fin_rev; /* state only: 1 = reverse */
u_char fin_tcpf; /* TCP header flags (SYN, ACK, etc) */
- /* From here on is packet specific */
- u_char fin_icode; /* ICMP error to return */
+ u_int fin_icode; /* ICMP error to return */
u_32_t fin_rule; /* rule # last matched */
u_32_t fin_group; /* group number, -1 for none */
struct frentry *fin_fr; /* last matching rule */
@@ -149,6 +148,7 @@ typedef struct fr_info {
u_short fin_off;
u_short fin_dlen; /* length of data portion of packet */
u_short fin_id; /* IP packet id field */
+ u_int fin_misc;
void *fin_mp; /* pointer to pointer to mbuf */
#if SOLARIS
void *fin_qfm; /* pointer to mblk where pkt starts */
@@ -171,6 +171,11 @@ typedef struct fr_info {
#define FI_LCSIZE offsetof(fr_info_t, fin_dp)
/*
+ * For fin_misc
+ */
+#define FM_BADSTATE 0x00000001
+
+/*
* Size for copying cache fr_info structure
*/
#define FI_COPYSIZE offsetof(fr_info_t, fin_dp)
@@ -421,10 +426,10 @@ typedef struct iplog {
typedef struct ipflog {
#if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199603)) || \
(defined(OpenBSD) && (OpenBSD >= 199603))
- u_char fl_ifname[LIFNAMSIZ];
+ char fl_ifname[LIFNAMSIZ];
#else
u_int fl_unit;
- u_char fl_ifname[LIFNAMSIZ];
+ char fl_ifname[LIFNAMSIZ];
#endif
u_char fl_plen; /* extra data after hlen */
u_char fl_hlen; /* length of IP headers saved */
diff --git a/sys/contrib/ipfilter/netinet/ip_frag.c b/sys/contrib/ipfilter/netinet/ip_frag.c
index abc0faa8d72a..f240cd9da4e0 100644
--- a/sys/contrib/ipfilter/netinet/ip_frag.c
+++ b/sys/contrib/ipfilter/netinet/ip_frag.c
@@ -90,7 +90,7 @@ extern struct timeout ipfr_slowtimer_ch;
#if !defined(lint)
static const char sccsid[] = "@(#)ip_frag.c 1.11 3/24/96 (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_frag.c,v 2.10.2.20 2002/03/06 09:44:11 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ip_frag.c,v 2.10.2.21 2002/04/10 04:56:10 darrenr Exp $";
#endif
@@ -584,9 +584,9 @@ void ipfr_slowtimer()
if (fr_running <= 0)
return;
+ READ_ENTER(&ipf_solaris);
#endif
- READ_ENTER(&ipf_solaris);
#if defined(__sgi) && defined(_KERNEL)
ipfilter_sgi_intfsync();
#endif
diff --git a/sys/contrib/ipfilter/netinet/ip_h323_pxy.c b/sys/contrib/ipfilter/netinet/ip_h323_pxy.c
index 14aa47b7d4b3..a61b0402e907 100644
--- a/sys/contrib/ipfilter/netinet/ip_h323_pxy.c
+++ b/sys/contrib/ipfilter/netinet/ip_h323_pxy.c
@@ -52,18 +52,27 @@ unsigned char *data;
int datlen, *off;
unsigned short *port;
{
+ u_32_t addr;
+ u_char *dp;
+ int offset;
+
if (datlen < 6)
return -1;
*port = 0;
- for (*off = 0; *off <= datlen - 6; *off = *off + 1) {
- if (ipaddr == *(int *)(data + *off))
+ offset = *off;
+ dp = (u_char *)data;
+
+ for (offset = 0; offset <= datlen - 6; offset++, dp++) {
+ addr = (dp[0] << 24) | (dp[1] << 16) | (dp[2] << 8) | dp[3];
+ if (ipaddr == addr)
{
- *port = (*(data + *off + 4) << 8) + *(data + *off +5);
+ *port = (*(dp + 4) << 8) | *(dp + 5);
break;
}
}
- return (*off > datlen - 6) ? -1 : 0;
+ *off = offset;
+ return (offset > datlen - 6) ? -1 : 0;
}
/*
@@ -109,11 +118,15 @@ ap_session_t *aps;
* We are lucky here because this function is not
* called with ipf_nat locked.
*/
- if (nat_ioctl((caddr_t)ipn, SIOCRMNAT, FWRITE) == -1) {
+ if (nat_ioctl((caddr_t)ipn, SIOCRMNAT, NAT_SYSSPACE|
+ NAT_LOCKHELD|FWRITE) == -1) {
/* log the error */
}
}
KFREES(aps->aps_data, aps->aps_psiz);
+ /* avoid double free */
+ aps->aps_data = NULL;
+ aps->aps_psiz = 0;
}
return;
}
@@ -144,7 +157,7 @@ nat_t *nat;
ipaddr = ip->ip_src.s_addr;
data = (unsigned char *)tcp + (tcp->th_off << 2);
- datlen = ip->ip_len - (ip->ip_hl << 2) - (tcp->th_off << 2);
+ datlen = fin->fin_dlen - (tcp->th_off << 2);
if (find_port(ipaddr, data, datlen, &off, &port) == 0) {
ipnat_t *ipn;
char *newarray;
@@ -177,13 +190,16 @@ nat_t *nat;
* of calling nat_ioctl(), we add the nat rule ourself.
*/
RWLOCK_EXIT(&ipf_nat);
- if (nat_ioctl((caddr_t)ipn, SIOCADNAT, FWRITE) == -1) {
+ if (nat_ioctl((caddr_t)ipn, SIOCADNAT,
+ NAT_SYSSPACE|FWRITE) == -1) {
READ_ENTER(&ipf_nat);
return -1;
}
READ_ENTER(&ipf_nat);
- bcopy(aps->aps_data, newarray, aps->aps_psiz);
- KFREES(aps->aps_data, aps->aps_psiz);
+ if (aps->aps_data != NULL && aps->aps_psiz > 0) {
+ bcopy(aps->aps_data, newarray, aps->aps_psiz);
+ KFREES(aps->aps_data, aps->aps_psiz);
+ }
aps->aps_data = newarray;
aps->aps_psiz += sizeof(*ipn);
}
@@ -256,8 +272,10 @@ nat_t *nat;
#ifdef IPFILTER_LOG
nat_log(ipn, (u_int)(nat->nat_ptr->in_redir));
#endif
- *(int *)(data + off) = ip->ip_src.s_addr;
- *(short *)(data + off + 4) = ipn->nat_outport;
+ bcopy((u_char*)&ip->ip_src.s_addr,
+ data + off, 4);
+ bcopy((u_char*)&ipn->nat_outport,
+ data + off + 4, 2);
}
}
}
diff --git a/sys/contrib/ipfilter/netinet/ip_log.c b/sys/contrib/ipfilter/netinet/ip_log.c
index e56c60262460..45bc74c7114c 100644
--- a/sys/contrib/ipfilter/netinet/ip_log.c
+++ b/sys/contrib/ipfilter/netinet/ip_log.c
@@ -3,7 +3,7 @@
*
* See the IPFILTER.LICENCE file for details on licencing.
*
- * $Id: ip_log.c,v 2.5.2.17 2002/03/13 03:57:05 darrenr Exp $
+ * $Id: ip_log.c,v 2.5.2.18 2002/03/26 15:54:40 darrenr Exp $
*/
#include <sys/param.h>
#if defined(KERNEL) && !defined(_KERNEL)
@@ -84,6 +84,7 @@
# include <net/route.h>
# include <netinet/in.h>
# ifdef __sgi
+# define _KMEMUSER
# include <sys/ddi.h>
# ifdef IFF_DRVRLOCK /* IRIX6 */
# include <sys/hashing.h>
diff --git a/sys/contrib/ipfilter/netinet/ip_nat.c b/sys/contrib/ipfilter/netinet/ip_nat.c
index 5c10bc4ba3f3..e0d595193460 100644
--- a/sys/contrib/ipfilter/netinet/ip_nat.c
+++ b/sys/contrib/ipfilter/netinet/ip_nat.c
@@ -109,7 +109,7 @@ extern struct ifnet vpnif;
#if !defined(lint)
static const char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.37.2.63 2002/03/06 09:44:11 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.37.2.66 2002/04/23 14:58:27 darrenr Exp $";
#endif
nat_t **nat_table[2] = { NULL, NULL },
@@ -425,7 +425,7 @@ caddr_t data;
int mode;
{
register ipnat_t *nat, *nt, *n = NULL, **np = NULL;
- int error = 0, ret, arg;
+ int error = 0, ret, arg, getlock;
ipnat_t natd;
u_32_t i, j;
@@ -436,9 +436,15 @@ int mode;
nat = NULL; /* XXX gcc -Wuninitialized */
KMALLOC(nt, ipnat_t *);
- if ((cmd == SIOCADNAT) || (cmd == SIOCRMNAT))
- error = IRCOPYPTR(data, (char *)&natd, sizeof(natd));
- else if (cmd == SIOCIPFFL) { /* SIOCFLNAT & SIOCCNATL */
+ getlock = (mode & NAT_LOCKHELD) ? 0 : 1;
+ if ((cmd == SIOCADNAT) || (cmd == SIOCRMNAT)) {
+ if (mode & NAT_SYSSPACE) {
+ bcopy(data, (char *)&natd, sizeof(natd));
+ error = 0;
+ } else {
+ error = IRCOPYPTR(data, (char *)&natd, sizeof(natd));
+ }
+ } else if (cmd == SIOCIPFFL) { /* SIOCFLNAT & SIOCCNATL */
error = IRCOPY(data, (char *)&arg, sizeof(arg));
if (error)
error = EFAULT;
@@ -450,7 +456,8 @@ int mode;
/*
* For add/delete, look to see if the NAT entry is already present
*/
- WRITE_ENTER(&ipf_nat);
+ if (getlock == 1)
+ WRITE_ENTER(&ipf_nat);
if ((cmd == SIOCADNAT) || (cmd == SIOCRMNAT)) {
nat = &natd;
nat->in_flags &= IPN_USERFLAGS;
@@ -715,7 +722,8 @@ int mode;
error = EINVAL;
break;
}
- RWLOCK_EXIT(&ipf_nat); /* READ/WRITE */
+ if (getlock == 1)
+ RWLOCK_EXIT(&ipf_nat); /* READ/WRITE */
done:
if (nt)
KFREE(nt);
@@ -831,7 +839,7 @@ caddr_t data;
return ENOMEM;
bcopy((char *)&ipn, (char *)ipnn, sizeof(ipn));
- bcopy((char *)aps, ipnn->ipn_data, sizeof(*aps));
+ bcopy((char *)aps, (char *)ipnn->ipn_data, sizeof(*aps));
if (aps->aps_data) {
bcopy(aps->aps_data, ipnn->ipn_data + sizeof(*aps),
aps->aps_psiz);
@@ -1650,11 +1658,12 @@ int dir;
{
u_32_t sum1, sum2, sumd, sumd2 = 0;
struct in_addr in;
+ int flags, dlen;
icmphdr_t *icmp;
udphdr_t *udp;
+ tcphdr_t *tcp;
nat_t *nat;
ip_t *oip;
- int flags;
if ((fin->fin_fl & FI_SHORT) || (fin->fin_off != 0))
return NULL;
@@ -1673,6 +1682,13 @@ int dir;
else if (oip->ip_p == IPPROTO_UDP)
flags = IPN_UDP;
udp = (udphdr_t *)((((char *)oip) + (oip->ip_hl << 2)));
+ dlen = ip->ip_len - ((char *)udp - (char *)ip);
+ /*
+ * XXX - what if this is bogus hl and we go off the end ?
+ * In this case, nat_icmplookup() will have returned NULL.
+ */
+ tcp = (tcphdr_t *)udp;
+
/*
* Need to adjust ICMP header to include the real IP#'s and
* port #'s. Only apply a checksum change relative to the
@@ -1695,8 +1711,6 @@ int dir;
* change in the UDP and TCP checksums require yet another
* adjustment of the ICMP checksum of the ICMP error message.
*
- * For the moment we forget about TCP, because that checksum is not
- * in the first 8 bytes, so it will not be available in most cases.
*/
if (oip->ip_dst.s_addr == nat->nat_oip.s_addr) {
@@ -1754,15 +1768,25 @@ int dir;
sumd2 = sumd;
}
-#if 0
+#if 1
/*
* Fix TCP pseudo header checksum to compensate for the
* IP address change. Before we can do the change, we
* must make sure that oip is sufficient large to hold
* the TCP checksum (normally it does not!).
*/
- if (oip->ip_p == IPPROTO_TCP) {
+ if (oip->ip_p == IPPROTO_TCP && dlen >= 18) {
+ sum1 = ntohs(tcp->th_sum);
+ fix_datacksum(&tcp->th_sum, sumd);
+ sum2 = ntohs(tcp->th_sum);
+
+ /*
+ * Fix ICMP checksum to compensate the TCP
+ * checksum adjustment.
+ */
+ CALC_SUMD(sum1, sum2, sumd);
+ sumd2 = sumd;
}
#endif
} else {
@@ -1813,15 +1837,25 @@ int dir;
sumd2 = sumd;
}
-#if 0
+#if 1
/*
* Fix TCP pseudo header checksum to compensate for the
* IP address change. Before we can do the change, we
* must make sure that oip is sufficient large to hold
* the TCP checksum (normally it does not!).
*/
- if (oip->ip_p == IPPROTO_TCP) {
+ if (oip->ip_p == IPPROTO_TCP && dlen >= 18) {
+ sum1 = ntohs(tcp->th_sum);
+ fix_datacksum(&tcp->th_sum, sumd);
+ sum2 = ntohs(tcp->th_sum);
+
+ /*
+ * Fix ICMP checksum to compensate the TCP
+ * checksum adjustment.
+ */
+ CALC_SUMD(sum1, sum2, sumd);
+ sumd2 = sumd;
};
#endif
@@ -1829,14 +1863,6 @@ int dir;
}
if ((flags & IPN_TCPUDP) != 0) {
- tcphdr_t *tcp;
-
- /*
- * XXX - what if this is bogus hl and we go off the end ?
- * In this case, nat_icmpinlookup() will have returned NULL.
- */
- tcp = (tcphdr_t *)udp;
-
/*
* Step 2 :
* For offending TCP/UDP IP packets, translate the ports as
@@ -1852,8 +1878,9 @@ int dir;
*
* To further complicate: the TCP checksum is not in the first
* 8 bytes of the offending ip packet, so it most likely is not
- * available (we might have to fix that if the encounter a
- * device that returns more than 8 data bytes on icmp error)
+ * available. Some OSses like Solaris return enough bytes to
+ * include the TCP checksum. So we have to check if the
+ * ip->ip_len actually holds the TCP checksum of the oip!
*/
if (nat->nat_oport == tcp->th_dport) {
@@ -1891,6 +1918,27 @@ int dir;
CALC_SUMD(sum1, sum2, sumd);
sumd2 += sumd;
}
+
+ /*
+ * Fix tcp checksum (if present) to compensate
+ * port adjustment. NOTE : the offending IP
+ * packet flows the other direction compared to
+ * the ICMP message.
+ */
+ if (oip->ip_p == IPPROTO_TCP && dlen >= 18) {
+
+ sum1 = ntohs(tcp->th_sum);
+ fix_datacksum(&tcp->th_sum, sumd);
+ sum2 = ntohs(tcp->th_sum);
+
+ /*
+ * Fix ICMP checksum to
+ * compensate TCP checksum
+ * adjustment.
+ */
+ CALC_SUMD(sum1, sum2, sumd);
+ sumd2 += sumd;
+ }
}
} else {
if (tcp->th_dport != nat->nat_outport) {
@@ -1926,6 +1974,26 @@ int dir;
CALC_SUMD(sum1, sum2, sumd);
sumd2 += sumd;
}
+
+ /*
+ * Fix tcp checksum (if present) to compensate
+ * port adjustment. NOTE : the offending IP
+ * packet flows the other direction compared to
+ * the ICMP message.
+ */
+ if (oip->ip_p == IPPROTO_TCP && dlen >= 18) {
+
+ sum1 = ntohs(tcp->th_sum);
+ fix_datacksum(&tcp->th_sum, sumd);
+ sum2 = ntohs(tcp->th_sum);
+
+ /*
+ * Fix ICMP checksum to compensate
+ * UDP checksum adjustment.
+ */
+ CALC_SUMD(sum1, sum2, sumd);
+ sumd2 += sumd;
+ }
}
}
if (sumd2) {
@@ -2435,7 +2503,7 @@ maskloop:
csump = &tcp->th_sum;
MUTEX_ENTER(&nat->nat_lock);
fr_tcp_age(&nat->nat_age,
- nat->nat_tcpstate, fin, 1);
+ nat->nat_tcpstate, fin, 1, 0);
if (nat->nat_age < fr_defnaticmpage)
nat->nat_age = fr_defnaticmpage;
#ifdef LARGE_NAT
@@ -2643,7 +2711,7 @@ maskloop:
csump = &tcp->th_sum;
MUTEX_ENTER(&nat->nat_lock);
fr_tcp_age(&nat->nat_age,
- nat->nat_tcpstate, fin, 0);
+ nat->nat_tcpstate, fin, 0, 0);
if (nat->nat_age < fr_defnaticmpage)
nat->nat_age = fr_defnaticmpage;
#ifdef LARGE_NAT
diff --git a/sys/contrib/ipfilter/netinet/ip_nat.h b/sys/contrib/ipfilter/netinet/ip_nat.h
index 4b2acc485283..b3b0b27723f9 100644
--- a/sys/contrib/ipfilter/netinet/ip_nat.h
+++ b/sys/contrib/ipfilter/netinet/ip_nat.h
@@ -4,7 +4,7 @@
* See the IPFILTER.LICENCE file for details on licencing.
*
* @(#)ip_nat.h 1.5 2/4/96
- * $Id: ip_nat.h,v 2.17.2.25 2002/01/01 15:10:49 darrenr Exp $
+ * $Id: ip_nat.h,v 2.17.2.26 2002/04/20 16:42:05 darrenr Exp $
*/
#ifndef __IP_NAT_H__
@@ -276,6 +276,8 @@ typedef struct natlog {
(sd) = (s2) - (s1); \
(sd) = ((sd) & 0xffff) + ((sd) >> 16); }
+#define NAT_SYSSPACE 0x80000000
+#define NAT_LOCKHELD 0x40000000
extern u_int ipf_nattable_sz;
extern u_int ipf_natrules_sz;
diff --git a/sys/contrib/ipfilter/netinet/ip_state.c b/sys/contrib/ipfilter/netinet/ip_state.c
index 255bdad61f75..2e8b8f3f7e1b 100644
--- a/sys/contrib/ipfilter/netinet/ip_state.c
+++ b/sys/contrib/ipfilter/netinet/ip_state.c
@@ -93,7 +93,7 @@
#if !defined(lint)
static const char sccsid[] = "@(#)ip_state.c 1.8 6/5/96 (C) 1993-2000 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.30.2.61 2002/03/06 14:07:36 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.30.2.66 2002/04/15 12:14:03 darrenr Exp $";
#endif
#ifndef MIN
@@ -123,6 +123,7 @@ static ips_stat_t *fr_statetstats __P((void));
static void fr_delstate __P((ipstate_t *));
static int fr_state_remove __P((caddr_t));
static void fr_ipsmove __P((ipstate_t **, ipstate_t *, u_int));
+static int fr_tcpoptions __P((tcphdr_t *));
int fr_stputent __P((caddr_t));
int fr_stgetent __P((caddr_t));
void fr_stinsert __P((ipstate_t *));
@@ -298,7 +299,7 @@ caddr_t data;
if ((sp->is_p == st.is_p) && (sp->is_v == st.is_v) &&
!bcmp((char *)&sp->is_src, (char *)&st.is_src,
sizeof(st.is_src)) &&
- !bcmp((char *)&sp->is_dst, (char *)&st.is_src,
+ !bcmp((char *)&sp->is_dst, (char *)&st.is_dst,
sizeof(st.is_dst)) &&
!bcmp((char *)&sp->is_ps, (char *)&st.is_ps,
sizeof(st.is_ps))) {
@@ -578,7 +579,8 @@ u_int flags;
void *ifp;
int out;
- if (fr_state_lock || (fin->fin_off != 0) || (fin->fin_fl & FI_SHORT))
+ if (fr_state_lock || (fin->fin_off != 0) || (fin->fin_fl & FI_SHORT) ||
+ (fin->fin_misc & FM_BADSTATE))
return NULL;
if (ips_num == fr_statemax) {
ips_stats.iss_max++;
@@ -619,6 +621,8 @@ u_int flags;
switch (is->is_p)
{
+ int off;
+
#ifdef USE_INET6
case IPPROTO_ICMPV6 :
ic = (struct icmp *)fin->fin_dp;
@@ -680,15 +684,22 @@ u_int flags;
hv += is->is_dport;
}
is->is_send = ntohl(tcp->th_seq) + fin->fin_dlen -
- (tcp->th_off << 2) +
+ (off = (tcp->th_off << 2)) +
((tcp->th_flags & TH_SYN) ? 1 : 0) +
((tcp->th_flags & TH_FIN) ? 1 : 0);
is->is_maxsend = is->is_send;
- is->is_dend = 0;
is->is_maxdwin = 1;
is->is_maxswin = ntohs(tcp->th_win);
if (is->is_maxswin == 0)
is->is_maxswin = 1;
+
+ if ((tcp->th_flags & TH_OPENING) == TH_SYN)
+ is->is_fsm = 1;
+
+ if ((tcp->th_flags & TH_SYN) &&
+ ((tcp->th_off << 2) >= (sizeof(*tcp) + 4)))
+ is->is_swscale = fr_tcpoptions(tcp);
+
/*
* If we're creating state for a starting connection, start the
* timer on it as we'll never see an error if it fails to
@@ -785,7 +796,7 @@ u_int flags;
is->is_me = stsave;
if (is->is_p == IPPROTO_TCP) {
fr_tcp_age(&is->is_age, is->is_state, fin,
- 0); /* 0 = packet from the source */
+ 0, is->is_fsm); /* 0 = packet from the source */
}
#ifdef IPFILTER_LOG
ipstate_log(is, ISL_NEW);
@@ -798,6 +809,46 @@ u_int flags;
}
+static int fr_tcpoptions(tcp)
+tcphdr_t *tcp;
+{
+ u_char *opt, *last;
+ int wscale;
+
+ opt = (u_char *) (tcp + 1);
+ last = ((u_char *)tcp) + (tcp->th_off << 2);
+
+ /* If we don't find wscale here, we need to clear it */
+ wscale = -2;
+
+ /* Termination condition picked such that opt[0 .. 2] exist */
+ while ((opt < last - 2) && (*opt != TCPOPT_EOL)) {
+ switch (*opt) {
+ case TCPOPT_NOP:
+ opt++;
+ continue;
+ case TCPOPT_WSCALE:
+ /* Proper length ? */
+ if (opt[1] == 3) {
+ if (opt[2] > 14)
+ wscale = 14;
+ else
+ wscale = opt[2];
+ }
+ break;
+ default:
+ /* Unknown options must be two bytes+ */
+ if (opt[1] < 2)
+ break;
+ opt += opt[1];
+ continue;
+ }
+ break;
+ }
+ return wscale;
+}
+
+
/*
* check to see if a packet with TCP headers fits within the TCP window.
@@ -813,9 +864,10 @@ tcphdr_t *tcp;
register tcp_seq seq, ack, end;
register int ackskew;
tcpdata_t *fdata, *tdata;
- u_short win, maxwin;
- int ret = 0;
+ u_32_t win, maxwin;
+ int ret = 0, off;
int source;
+ int wscale;
/*
* Find difference between last checked packet and this packet.
@@ -825,15 +877,29 @@ tcphdr_t *tcp;
source = 0;
fdata = &is->is_tcp.ts_data[!source];
tdata = &is->is_tcp.ts_data[source];
+ off = tcp->th_off << 2;
seq = ntohl(tcp->th_seq);
ack = ntohl(tcp->th_ack);
win = ntohs(tcp->th_win);
- end = seq + fin->fin_dlen - (tcp->th_off << 2) +
+ end = seq + fin->fin_dlen - off +
((tcp->th_flags & TH_SYN) ? 1 : 0) +
((tcp->th_flags & TH_FIN) ? 1 : 0);
+
+ if ((tcp->th_flags & TH_SYN) && (off >= sizeof(*tcp) + 4))
+ wscale = fr_tcpoptions(tcp);
+ else
+ wscale = -1;
+
MUTEX_ENTER(&is->is_lock);
- if (fdata->td_end == 0) {
+
+ if (wscale >= 0)
+ fdata->td_wscale = wscale;
+ else if (wscale == -2)
+ fdata->td_wscale = tdata->td_wscale = 0;
+
+ if ((fdata->td_end == 0) &&
+ (!is->is_fsm || ((tcp->th_flags & TH_OPENING) == TH_OPENING))) {
/*
* Must be a (outgoing) SYN-ACK in reply to a SYN.
*/
@@ -853,6 +919,7 @@ tcphdr_t *tcp;
if (seq == end)
seq = end = fdata->td_end;
+ win <<= fdata->td_wscale;
maxwin = tdata->td_maxwin;
ackskew = tdata->td_end - ack;
@@ -878,29 +945,33 @@ tcphdr_t *tcp;
* Thus, when ackskew is negative but still seems to belong
* to this session, we bump up the destinations end value.
*/
- if (ackskew < 0)
- tdata->td_end = ack;
-
- /* update max window seen */
- if (fdata->td_maxwin < win)
- fdata->td_maxwin = win;
- if (SEQ_GT(end, fdata->td_end))
- fdata->td_end = end;
- if (SEQ_GE(ack + win, tdata->td_maxend)) {
- tdata->td_maxend = ack + win;
- if (win == 0)
- tdata->td_maxend++;
- }
-
- ATOMIC_INCL(ips_stats.iss_hits);
/*
* Nearing end of connection, start timeout.
*/
/* source ? 0 : 1 -> !source */
- fr_tcp_age(&is->is_age, is->is_state, fin, !source);
- ret = 1;
+ if (fr_tcp_age(&is->is_age, is->is_state, fin, !source,
+ (int)is->is_fsm) == 0) {
+ if (ackskew < 0)
+ tdata->td_end = ack;
+
+ /* update max window seen */
+ if (fdata->td_maxwin < win)
+ fdata->td_maxwin = win;
+ if (SEQ_GT(end, fdata->td_end))
+ fdata->td_end = end;
+ if (SEQ_GE(ack + win, tdata->td_maxend)) {
+ tdata->td_maxend = ack + win;
+ if (win == 0)
+ tdata->td_maxend++;
+ }
+
+ ATOMIC_INCL(ips_stats.iss_hits);
+ ret = 1;
+ }
}
MUTEX_EXIT(&is->is_lock);
+ if ((ret == 0) && (tcp->th_flags != TH_SYN))
+ fin->fin_misc |= FM_BADSTATE;
return ret;
}
@@ -1079,9 +1150,9 @@ fr_info_t *fin;
register ipstate_t *is, **isp;
register u_short sport, dport;
register u_char pr;
+ u_short savelen, ohlen;
union i6addr dst, src;
struct icmp *ic;
- u_short savelen;
icmphdr_t *icmp;
fr_info_t ofin;
int type, len;
@@ -1110,14 +1181,15 @@ fr_info_t *fin;
return NULL;
oip = (ip_t *)((char *)ic + ICMPERR_ICMPHLEN);
- if (fin->fin_plen < ICMPERR_MAXPKTLEN + ((oip->ip_hl - 5) << 2))
+ ohlen = oip->ip_hl << 2;
+ if (fin->fin_plen < ICMPERR_MAXPKTLEN + ohlen - sizeof(*oip))
return NULL;
/*
* Sanity checks.
*/
len = fin->fin_dlen - ICMPERR_ICMPHLEN;
- if ((len <= 0) || ((oip->ip_hl << 2) > len))
+ if ((len <= 0) || (ohlen > len))
return NULL;
/*
@@ -1157,7 +1229,7 @@ fr_info_t *fin;
switch (oip->ip_p)
{
case IPPROTO_ICMP :
- icmp = (icmphdr_t *)((char *)oip + (oip->ip_hl << 2));
+ icmp = (icmphdr_t *)((char *)oip + ohlen);
/*
* a ICMP error can only be generated as a result of an
@@ -1187,7 +1259,7 @@ fr_info_t *fin;
savelen = oip->ip_len;
oip->ip_len = len;
ofin.fin_v = 4;
- fr_makefrip(oip->ip_hl << 2, oip, &ofin);
+ fr_makefrip(ohlen, oip, &ofin);
oip->ip_len = savelen;
ofin.fin_ifp = fin->fin_ifp;
ofin.fin_out = !fin->fin_out;
@@ -1209,12 +1281,14 @@ fr_info_t *fin;
case IPPROTO_TCP :
case IPPROTO_UDP :
+ if (fin->fin_plen < ICMPERR_MAXPKTLEN)
+ return NULL;
break;
default :
return NULL;
}
- tcp = (tcphdr_t *)((char *)oip + (oip->ip_hl << 2));
+ tcp = (tcphdr_t *)((char *)oip + ohlen);
dport = tcp->th_dport;
sport = tcp->th_sport;
@@ -1239,7 +1313,7 @@ fr_info_t *fin;
savelen = oip->ip_len;
oip->ip_len = len;
ofin.fin_v = 4;
- fr_makefrip(oip->ip_hl << 2, oip, &ofin);
+ fr_makefrip(ohlen, oip, &ofin);
oip->ip_len = savelen;
ofin.fin_ifp = fin->fin_ifp;
ofin.fin_out = !fin->fin_out;
@@ -1481,9 +1555,8 @@ retry_tcpudp:
fr_matchsrcdst(is, src, dst, fin, tcp)) {
rev = fin->fin_rev;
if ((pr == IPPROTO_TCP)) {
- if (!fr_tcpstate(is, fin, ip, tcp)) {
- continue;
- }
+ if (!fr_tcpstate(is, fin, ip, tcp))
+ is = NULL;
} else if ((pr == IPPROTO_UDP)) {
if (is->is_frage[rev] != 0)
is->is_age = is->is_frage[rev];
@@ -1504,6 +1577,7 @@ retry_tcpudp:
}
break;
}
+
RWLOCK_EXIT(&ipf_state);
if (!tryagain && ips_wild) {
hv -= dport;
@@ -1703,15 +1777,16 @@ void fr_timeoutstate()
* dir == 1 : a packet from dest to source
*
*/
-void fr_tcp_age(age, state, fin, dir)
+int fr_tcp_age(age, state, fin, dir, fsm)
u_long *age;
u_char *state;
fr_info_t *fin;
-int dir;
+int dir, fsm;
{
tcphdr_t *tcp = (tcphdr_t *)fin->fin_dp;
u_char flags = tcp->th_flags;
int dlen, ostate;
+ u_long newage;
ostate = state[1 - dir];
@@ -1725,10 +1800,10 @@ int dir;
*age = fr_tcpclosewait;
state[dir] = TCPS_CLOSE_WAIT;
}
- return;
+ return 0;
}
- *age = fr_tcptimeout; /* default 4 mins */
+ newage = 0;
switch(state[dir])
{
@@ -1739,11 +1814,11 @@ int dir;
* CLOSED -> SYN_RECEIVED
*/
state[dir] = TCPS_SYN_RECEIVED;
- *age = fr_tcptimeout;
- } else if ((flags & (TH_SYN|TH_ACK)) == TH_SYN) {
+ newage = fr_tcptimeout;
+ } else if ((flags & TH_OPENING) == TH_SYN) {
/* 'dir' sent S, CLOSED -> SYN_SENT */
state[dir] = TCPS_SYN_SENT;
- *age = fr_tcptimeout;
+ newage = fr_tcptimeout;
}
/*
* The next piece of code makes it possible to get
@@ -1752,12 +1827,12 @@ int dir;
* does not work when a strict 'flags S keep state' is
* used for tcp connections of course
*/
- if ((flags & (TH_FIN|TH_SYN|TH_RST|TH_ACK)) == TH_ACK) {
+ if (!fsm && (flags & (TH_FIN|TH_SYN|TH_RST|TH_ACK)) == TH_ACK) {
/* we saw an A, guess 'dir' is in ESTABLISHED mode */
if (state[1 - dir] == TCPS_CLOSED ||
state[1 - dir] == TCPS_ESTABLISHED) {
state[dir] = TCPS_ESTABLISHED;
- *age = fr_tcpidletimeout;
+ newage = fr_tcpidletimeout;
}
}
/*
@@ -1772,14 +1847,24 @@ int dir;
break;
case TCPS_SYN_SENT: /* 2 */
- if ((flags & (TH_SYN|TH_FIN|TH_ACK)) == TH_ACK) {
+ if (flags == TH_SYN) {
+ /*
+ * A retransmitted SYN packet. We do not reset the
+ * timeout here to fr_tcptimeout because a connection
+ * connect timeout does not renew after every packet
+ * that is sent. We need to set newage to something
+ * to indicate the packet has passed the check for its
+ * flags being valid in the TCP FSM.
+ */
+ newage = *age;
+ } else if ((flags & (TH_SYN|TH_FIN|TH_ACK)) == TH_ACK) {
/*
* We see an A from 'dir' which is in SYN_SENT
* state: 'dir' sent an A in response to an SA
* which it received, SYN_SENT -> ESTABLISHED
*/
state[dir] = TCPS_ESTABLISHED;
- *age = fr_tcpidletimeout;
+ newage = fr_tcpidletimeout;
} else if (flags & TH_FIN) {
/*
* We see an F from 'dir' which is in SYN_SENT
@@ -1787,7 +1872,7 @@ int dir;
* connection; SYN_SENT -> FIN_WAIT_1
*/
state[dir] = TCPS_FIN_WAIT_1;
- *age = fr_tcpidletimeout; /* or fr_tcptimeout? */
+ newage = fr_tcpidletimeout; /* or fr_tcptimeout? */
} else if ((flags & TH_OPENING) == TH_OPENING) {
/*
* We see an SA from 'dir' which is already in
@@ -1795,7 +1880,7 @@ int dir;
* simultaneous open; SYN_SENT -> SYN_RECEIVED
*/
state[dir] = TCPS_SYN_RECEIVED;
- *age = fr_tcptimeout;
+ newage = fr_tcptimeout;
}
break;
@@ -1807,7 +1892,7 @@ int dir;
* SYN_RECEIVED -> ESTABLISHED
*/
state[dir] = TCPS_ESTABLISHED;
- *age = fr_tcpidletimeout;
+ newage = fr_tcpidletimeout;
} else if (flags & TH_FIN) {
/*
* We see an F from 'dir' which is in SYN_RECEIVED
@@ -1815,7 +1900,7 @@ int dir;
* SYN_RECEIVED -> FIN_WAIT_1
*/
state[dir] = TCPS_FIN_WAIT_1;
- *age = fr_tcpidletimeout;
+ newage = fr_tcpidletimeout;
}
break;
@@ -1827,7 +1912,7 @@ int dir;
* ESTABLISHED -> FIN_WAIT_1
*/
state[dir] = TCPS_FIN_WAIT_1;
- *age = fr_tcphalfclosed;
+ newage = fr_tcphalfclosed;
} else if (flags & TH_ACK) {
/* an ACK, should we exclude other flags here? */
if (ostate == TCPS_FIN_WAIT_1) {
@@ -1839,13 +1924,13 @@ int dir;
* a half-closed connection
*/
state[dir] = TCPS_CLOSE_WAIT;
- *age = fr_tcphalfclosed;
+ newage = fr_tcphalfclosed;
} else if (ostate < TCPS_CLOSE_WAIT)
/*
* Still a fully established connection,
* reset timeout
*/
- *age = fr_tcpidletimeout;
+ newage = fr_tcpidletimeout;
}
break;
@@ -1855,7 +1940,7 @@ int dir;
* Application closed and 'dir' sent a FIN, we're now
* going into LAST_ACK state
*/
- *age = fr_tcplastack;
+ newage = fr_tcplastack;
state[dir] = TCPS_LAST_ACK;
} else {
/*
@@ -1863,7 +1948,7 @@ int dir;
* closed already and we did not close our side yet;
* reset timeout
*/
- *age = fr_tcphalfclosed;
+ newage = fr_tcphalfclosed;
}
break;
@@ -1880,14 +1965,14 @@ int dir;
* packet here? does the window code guarantee that?
*/
state[dir] = TCPS_TIME_WAIT;
- *age = fr_tcptimeout;
+ newage = fr_tcptimeout;
} else
/*
* We closed our side of the connection already but the
* other side is still active (ESTABLISHED/CLOSE_WAIT);
* continue with this half-closed connection
*/
- *age = fr_tcphalfclosed;
+ newage = fr_tcphalfclosed;
break;
case TCPS_CLOSING: /* 7 */
@@ -1901,7 +1986,7 @@ int dir;
* There is still data to be delivered, reset
* timeout
*/
- *age = fr_tcplastack;
+ newage = fr_tcplastack;
}
/*
* We cannot detect when we go out of LAST_ACK state to CLOSED
@@ -1916,9 +2001,16 @@ int dir;
break;
case TCPS_TIME_WAIT: /* 10 */
+ newage = fr_tcptimeout; /* default 4 mins */
/* we're in 2MSL timeout now */
break;
}
+
+ if (newage != 0) {
+ *age = newage;
+ return 0;
+ }
+ return -1;
}
@@ -2068,8 +2160,14 @@ fr_info_t *fin;
hv = (pr = oip->ip6_nxt);
src.in6 = oip->ip6_src;
hv += src.in4.s_addr;
+ hv += src.i6[1];
+ hv += src.i6[2];
+ hv += src.i6[3];
dst.in6 = oip->ip6_dst;
hv += dst.in4.s_addr;
+ hv += dst.i6[1];
+ hv += dst.i6[2];
+ hv += dst.i6[3];
hv += dport;
hv += sport;
hv %= fr_statesize;
diff --git a/sys/contrib/ipfilter/netinet/ip_state.h b/sys/contrib/ipfilter/netinet/ip_state.h
index fe6a505fe66d..01b12561a7a9 100644
--- a/sys/contrib/ipfilter/netinet/ip_state.h
+++ b/sys/contrib/ipfilter/netinet/ip_state.h
@@ -4,7 +4,7 @@
* See the IPFILTER.LICENCE file for details on licencing.
*
* @(#)ip_state.h 1.3 1/12/96 (C) 1995 Darren Reed
- * $Id: ip_state.h,v 2.13.2.10 2002/03/06 14:07:38 darrenr Exp $
+ * $Id: ip_state.h,v 2.13.2.12 2002/03/25 11:14:55 darrenr Exp $
*/
#ifndef __IP_STATE_H__
#define __IP_STATE_H__
@@ -42,7 +42,8 @@ typedef struct icmpstate {
typedef struct tcpdata {
u_32_t td_end;
u_32_t td_maxend;
- u_short td_maxwin;
+ u_32_t td_maxwin;
+ u_char td_wscale;
} tcpdata_t;
typedef struct tcpstate {
@@ -58,20 +59,22 @@ typedef struct ipstate {
struct ipstate *is_hnext;
struct ipstate **is_phnext;
struct ipstate **is_me;
- u_long is_age;
- u_int is_frage[2]; /* age from filter rule, forward & reverse */
- u_int is_pass;
+ frentry_t *is_rule;
U_QUAD_T is_pkts;
U_QUAD_T is_bytes;
- void *is_ifp[4];
- frentry_t *is_rule;
union i6addr is_src;
union i6addr is_dst;
+ void *is_ifp[4];
+ u_long is_age;
+ u_int is_frage[2]; /* age from filter rule, forward & reverse */
+ u_int is_pass;
u_char is_p; /* Protocol */
- u_char is_v;
- u_int is_hv;
+ u_char is_v; /* IP version */
+ u_char is_fsm; /* 1 = following FSM, 0 = not */
+ u_char is_xxx; /* pad */
+ u_int is_hv; /* hash value for this in the table */
u_32_t is_rulen; /* rule number */
- u_32_t is_flags;
+ u_32_t is_flags; /* flags for this structure */
u_32_t is_opt; /* packet options set */
u_32_t is_optmsk; /* " " mask */
u_short is_sec; /* security options set */
@@ -100,6 +103,8 @@ typedef struct ipstate {
#define is_dend is_tcp.ts_data[1].td_end
#define is_maxswin is_tcp.ts_data[0].td_maxwin
#define is_maxdwin is_tcp.ts_data[1].td_maxwin
+#define is_swscale is_tcp.ts_data[0].td_wscale
+#define is_dwscale is_tcp.ts_data[1].td_wscale
#define is_maxsend is_tcp.ts_data[0].td_maxend
#define is_maxdend is_tcp.ts_data[1].td_maxend
#define is_sport is_tcp.ts_sport
@@ -191,7 +196,7 @@ extern ipstate_t *fr_addstate __P((ip_t *, fr_info_t *, ipstate_t **, u_int));
extern frentry_t *fr_checkstate __P((ip_t *, fr_info_t *));
extern void ip_statesync __P((void *));
extern void fr_timeoutstate __P((void));
-extern void fr_tcp_age __P((u_long *, u_char *, fr_info_t *, int));
+extern int fr_tcp_age __P((u_long *, u_char *, fr_info_t *, int, int));
extern void fr_stateunload __P((void));
extern void ipstate_log __P((struct ipstate *, u_int));
#if defined(__NetBSD__) || defined(__OpenBSD__)
diff --git a/sys/contrib/ipfilter/netinet/ipl.h b/sys/contrib/ipfilter/netinet/ipl.h
index 75f9d67efaf2..2e99b65c0276 100644
--- a/sys/contrib/ipfilter/netinet/ipl.h
+++ b/sys/contrib/ipfilter/netinet/ipl.h
@@ -4,12 +4,12 @@
* See the IPFILTER.LICENCE file for details on licencing.
*
* @(#)ipl.h 1.21 6/5/96
- * $Id: ipl.h,v 2.15.2.31 2002/03/13 03:57:42 darrenr Exp $
+ * $Id: ipl.h,v 2.15.2.32 2002/04/23 14:59:13 darrenr Exp $
*/
#ifndef __IPL_H__
#define __IPL_H__
-#define IPL_VERSION "IP Filter: v3.4.25"
+#define IPL_VERSION "IP Filter: v3.4.26"
#endif