aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDarren Reed <darrenr@FreeBSD.org>2000-05-24 02:55:58 +0000
committerDarren Reed <darrenr@FreeBSD.org>2000-05-24 02:55:58 +0000
commit41d01fd6fac172fa39e267cf49c9dd291f7ca549 (patch)
tree843267cee6cc56a96a38be5409be12cbf6c409d7
parent58b27d6a322fd149810936210a84a615813963a2 (diff)
downloadsrc-41d01fd6fac172fa39e267cf49c9dd291f7ca549.tar.gz
src-41d01fd6fac172fa39e267cf49c9dd291f7ca549.zip
Import IP Filter 3.4.4 into the kernel
Notes
Notes: svn path=/vendor-sys/ipfilter/dist-old/; revision=60848
-rw-r--r--sys/netinet/fil.c1402
-rw-r--r--sys/netinet/ip_auth.c189
-rw-r--r--sys/netinet/ip_auth.h36
-rw-r--r--sys/netinet/ip_compat.h381
-rw-r--r--sys/netinet/ip_fil.c980
-rw-r--r--sys/netinet/ip_fil.h402
-rw-r--r--sys/netinet/ip_frag.c374
-rw-r--r--sys/netinet/ip_frag.h18
-rw-r--r--sys/netinet/ip_ftp_pxy.c789
-rw-r--r--sys/netinet/ip_log.c206
-rw-r--r--sys/netinet/ip_nat.c2070
-rw-r--r--sys/netinet/ip_nat.h215
-rw-r--r--sys/netinet/ip_proxy.c410
-rw-r--r--sys/netinet/ip_proxy.h106
-rw-r--r--sys/netinet/ip_raudio_pxy.c155
-rw-r--r--sys/netinet/ip_rcmd_pxy.c9
-rw-r--r--sys/netinet/ip_state.c1520
-rw-r--r--sys/netinet/ip_state.h116
-rw-r--r--sys/netinet/ipl.h5
-rw-r--r--sys/netinet/mlfk_ipl.c11
20 files changed, 6875 insertions, 2519 deletions
diff --git a/sys/netinet/fil.c b/sys/netinet/fil.c
index f2b19a58aa92..258f76eacd86 100644
--- a/sys/netinet/fil.c
+++ b/sys/netinet/fil.c
@@ -1,21 +1,35 @@
/*
- * Copyright (C) 1993-1997 by Darren Reed.
+ * Copyright (C) 1993-2000 by Darren Reed.
*
* Redistribution and use in source and binary forms are permitted
* provided that this notice is preserved and due credit is given
* to the original author and the contributors.
*/
#if !defined(lint)
-static const char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-1996 Darren Reed";
-static const char rcsid[] = "@(#)$Id: fil.c,v 2.0.2.41.2.14 1998/05/23 19:20:30 darrenr Exp $";
+static const char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-2000 Darren Reed";
+static const char rcsid[] = "@(#)$Id: fil.c,v 2.35.2.8 2000/05/22 10:26:09 darrenr Exp $";
#endif
+#if defined(_KERNEL) && defined(__FreeBSD_version) && \
+ (__FreeBSD_version >= 400000) && !defined(KLD_MODULE)
+#include "opt_inet6.h"
+#endif
#include <sys/errno.h>
#include <sys/types.h>
#include <sys/param.h>
#include <sys/time.h>
#include <sys/file.h>
-#include <sys/ioctl.h>
+#if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \
+ defined(_KERNEL)
+# include "opt_ipfilter_log.h"
+#endif
+#if (defined(KERNEL) || defined(_KERNEL)) && defined(__FreeBSD_version) && \
+ (__FreeBSD_version >= 220000)
+# include <sys/filio.h>
+# include <sys/fcntl.h>
+#else
+# include <sys/ioctl.h>
+#endif
#if (defined(_KERNEL) || defined(KERNEL)) && !defined(linux)
# include <sys/systm.h>
#else
@@ -30,8 +44,10 @@ static const char rcsid[] = "@(#)$Id: fil.c,v 2.0.2.41.2.14 1998/05/23 19:20:30
# endif
#else
# include <sys/byteorder.h>
-# include <sys/dditypes.h>
-# include <sys/stream.h>
+# if SOLARIS2 < 5
+# include <sys/dditypes.h>
+# endif
+# include <sys/stream.h>
#endif
#ifndef linux
# include <sys/protosw.h>
@@ -48,10 +64,20 @@ static const char rcsid[] = "@(#)$Id: fil.c,v 2.0.2.41.2.14 1998/05/23 19:20:30
#ifndef linux
# include <netinet/ip_var.h>
#endif
+#if defined(__sgi) && defined(IFF_DRVRLOCK) /* IRIX 6 */
+# include <sys/hashing.h>
+# include <netinet/in_var.h>
+#endif
#include <netinet/tcp.h>
#include <netinet/udp.h>
#include <netinet/ip_icmp.h>
#include "netinet/ip_compat.h"
+#ifdef USE_INET6
+# include <netinet/icmp6.h>
+# if !SOLARIS && defined(_KERNEL)
+# include <netinet6/in6_var.h>
+# endif
+#endif
#include <netinet/tcpip.h>
#include "netinet/ip_fil.h"
#include "netinet/ip_proxy.h"
@@ -59,88 +85,68 @@ static const char rcsid[] = "@(#)$Id: fil.c,v 2.0.2.41.2.14 1998/05/23 19:20:30
#include "netinet/ip_frag.h"
#include "netinet/ip_state.h"
#include "netinet/ip_auth.h"
+# if defined(__FreeBSD_version) && (__FreeBSD_version >= 300000)
+# include <sys/malloc.h>
+# if defined(_KERNEL) && !defined(IPFILTER_LKM)
+# include "opt_ipfilter.h"
+# endif
+# endif
#ifndef MIN
-#define MIN(a,b) (((a)<(b))?(a):(b))
+# define MIN(a,b) (((a)<(b))?(a):(b))
#endif
+#include "netinet/ipl.h"
#ifndef _KERNEL
# include "ipf.h"
# include "ipt.h"
extern int opts;
-# define FR_IFVERBOSE(ex,second,verb_pr) if (ex) { verbose verb_pr; \
- second; }
-# define FR_IFDEBUG(ex,second,verb_pr) if (ex) { debug verb_pr; \
- second; }
# define FR_VERBOSE(verb_pr) verbose verb_pr
# define FR_DEBUG(verb_pr) debug verb_pr
-# define SEND_RESET(ip, qif, if, m) send_reset(ip, if)
# define IPLLOG(a, c, d, e) ipllog()
-# define FR_NEWAUTH(m, fi, ip, qif) fr_newauth((mb_t *)m, fi, ip)
-# if SOLARIS
-# define ICMP_ERROR(b, ip, t, c, if, src) icmp_error(ip)
-# else
-# define ICMP_ERROR(b, ip, t, c, if, src) icmp_error(b, ip, if)
-# endif
#else /* #ifndef _KERNEL */
-# define FR_IFVERBOSE(ex,second,verb_pr) ;
-# define FR_IFDEBUG(ex,second,verb_pr) ;
# define FR_VERBOSE(verb_pr)
# define FR_DEBUG(verb_pr)
# define IPLLOG(a, c, d, e) ipflog(a, c, d, e)
# if SOLARIS || defined(__sgi)
-extern kmutex_t ipf_mutex, ipf_auth;
+extern KRWLOCK_T ipf_mutex, ipf_auth, ipf_nat;
+extern kmutex_t ipf_rw;
# endif
# if SOLARIS
# define FR_NEWAUTH(m, fi, ip, qif) fr_newauth((mb_t *)m, fi, \
ip, qif)
-# define SEND_RESET(ip, qif, if) send_reset(ip, qif)
-# define ICMP_ERROR(b, ip, t, c, if, src) \
- icmp_error(ip, t, c, if, src)
+# define SEND_RESET(ip, qif, if, fin) send_reset(fin, ip, qif)
# else /* SOLARIS */
# define FR_NEWAUTH(m, fi, ip, qif) fr_newauth((mb_t *)m, fi, ip)
-# ifdef linux
-# define SEND_RESET(ip, qif, if) send_reset((tcpiphdr_t *)ip,\
- ifp)
-# else
-# define SEND_RESET(ip, qif, if) send_reset((tcpiphdr_t *)ip)
-# endif
-# ifdef __sgi
-# define ICMP_ERROR(b, ip, t, c, if, src) \
- icmp_error(b, t, c, if, src, if)
-# else
-# if BSD < 199103
-# ifdef linux
-# define ICMP_ERROR(b, ip, t, c, if, src) icmp_send(b,t,c,0,if)
-# else
-# define ICMP_ERROR(b, ip, t, c, if, src) \
- icmp_error(mtod(b, ip_t *), t, c, if, src)
-# endif /* linux */
-# else
-# define ICMP_ERROR(b, ip, t, c, if, src) \
- icmp_error(b, t, c, (src).s_addr, if)
-# endif /* BSD < 199103 */
-# endif /* __sgi */
+# define SEND_RESET(ip, qif, if, fin) send_reset(fin, ip)
# endif /* SOLARIS || __sgi */
#endif /* _KERNEL */
struct filterstats frstats[2] = {{0,0,0,0,0},{0,0,0,0,0}};
struct frentry *ipfilter[2][2] = { { NULL, NULL }, { NULL, NULL } },
+#ifdef USE_INET6
+ *ipfilter6[2][2] = { { NULL, NULL }, { NULL, NULL } },
+ *ipacct6[2][2] = { { NULL, NULL }, { NULL, NULL } },
+#endif
*ipacct[2][2] = { { NULL, NULL }, { NULL, NULL } };
struct frgroup *ipfgroups[3][2];
-int fr_flags = IPF_LOGGING, fr_active = 0;
+int fr_flags = IPF_LOGGING;
+int fr_active = 0;
+int fr_chksrc = 0;
#if defined(IPFILTER_DEFAULT_BLOCK)
int fr_pass = FR_NOMATCH|FR_BLOCK;
#else
int fr_pass = (IPF_DEFAULT_PASS|FR_NOMATCH);
#endif
+char ipfilter_version[] = IPL_VERSION;
fr_info_t frcache[2];
-static void fr_makefrip __P((int, ip_t *, fr_info_t *));
-static int fr_tcpudpchk __P((frentry_t *, fr_info_t *));
-static int frflushlist __P((int, int, int *, frentry_t *, frentry_t **));
+static int frflushlist __P((int, minor_t, int *, frentry_t **));
+#ifdef _KERNEL
+static void frsynclist __P((frentry_t *));
+#endif
/*
@@ -188,55 +194,102 @@ struct optlist secopt[8] = {
* compact the IP header into a structure which contains just the info.
* which is useful for comparing IP headers with.
*/
-static void fr_makefrip(hlen, ip, fin)
+void fr_makefrip(hlen, ip, fin)
int hlen;
ip_t *ip;
fr_info_t *fin;
{
- struct optlist *op;
- tcphdr_t *tcp;
- icmphdr_t *icmp;
- fr_ip_t *fi = &fin->fin_fi;
u_short optmsk = 0, secmsk = 0, auth = 0;
- int i, mv, ol, off;
+ int i, mv, ol, off, p, plen, v;
+ fr_ip_t *fi = &fin->fin_fi;
+ struct optlist *op;
u_char *s, opt;
+ tcphdr_t *tcp;
+ fin->fin_rev = 0;
fin->fin_fr = NULL;
fin->fin_tcpf = 0;
fin->fin_data[0] = 0;
fin->fin_data[1] = 0;
fin->fin_rule = -1;
fin->fin_group = -1;
- fin->fin_id = ip->ip_id;
#ifdef _KERNEL
fin->fin_icode = ipl_unreach;
#endif
- fi->fi_v = ip->ip_v;
- fi->fi_tos = ip->ip_tos;
+ v = fin->fin_v;
+ fi->fi_v = v;
fin->fin_hlen = hlen;
- fin->fin_dlen = ip->ip_len - hlen;
- tcp = (tcphdr_t *)((char *)ip + hlen);
- icmp = (icmphdr_t *)tcp;
+ if (v == 4) {
+ fin->fin_id = ip->ip_id;
+ fi->fi_tos = ip->ip_tos;
+ off = (ip->ip_off & IP_OFFMASK) << 3;
+ tcp = (tcphdr_t *)((char *)ip + hlen);
+ (*(((u_short *)fi) + 1)) = (*(((u_short *)ip) + 4));
+ fi->fi_src.i6[1] = 0;
+ fi->fi_src.i6[2] = 0;
+ fi->fi_src.i6[3] = 0;
+ fi->fi_dst.i6[1] = 0;
+ fi->fi_dst.i6[2] = 0;
+ fi->fi_dst.i6[3] = 0;
+ fi->fi_saddr = ip->ip_src.s_addr;
+ fi->fi_daddr = ip->ip_dst.s_addr;
+ p = ip->ip_p;
+ fi->fi_fl = (hlen > sizeof(ip_t)) ? FI_OPTIONS : 0;
+ if (ip->ip_off & 0x3fff)
+ fi->fi_fl |= FI_FRAG;
+ plen = ip->ip_len;
+ fin->fin_dlen = plen - hlen;
+ }
+#ifdef USE_INET6
+ else if (v == 6) {
+ ip6_t *ip6 = (ip6_t *)ip;
+
+ off = 0;
+ p = ip6->ip6_nxt;
+ fi->fi_p = p;
+ fi->fi_ttl = ip6->ip6_hlim;
+ tcp = (tcphdr_t *)(ip6 + 1);
+ fi->fi_src.in6 = ip6->ip6_src;
+ fi->fi_dst.in6 = ip6->ip6_dst;
+ fin->fin_id = (u_short)(ip6->ip6_flow & 0xffff);
+ fi->fi_tos = 0;
+ fi->fi_fl = 0;
+ plen = ntohs(ip6->ip6_plen);
+ fin->fin_dlen = plen;
+ }
+#endif
+ else
+ return;
+
+ fin->fin_off = off;
+ fin->fin_plen = plen;
fin->fin_dp = (void *)tcp;
- (*(((u_short *)fi) + 1)) = (*(((u_short *)ip) + 4));
- (*(((u_32_t *)fi) + 1)) = (*(((u_32_t *)ip) + 3));
- (*(((u_32_t *)fi) + 2)) = (*(((u_32_t *)ip) + 4));
-
- fi->fi_fl = (hlen > sizeof(ip_t)) ? FI_OPTIONS : 0;
- off = (ip->ip_off & 0x1fff) << 3;
- if (ip->ip_off & 0x3fff)
- fi->fi_fl |= FI_FRAG;
- switch (ip->ip_p)
+
+ switch (p)
{
case IPPROTO_ICMP :
{
int minicmpsz = sizeof(struct icmp);
+ icmphdr_t *icmp;
+
+ icmp = (icmphdr_t *)tcp;
- if (!off && ip->ip_len > ICMP_MINLEN + hlen &&
- (icmp->icmp_type == ICMP_ECHOREPLY ||
- icmp->icmp_type == ICMP_UNREACH))
+ if (!off && (icmp->icmp_type == ICMP_ECHOREPLY ||
+ icmp->icmp_type == ICMP_ECHO))
minicmpsz = ICMP_MINLEN;
- if ((!(ip->ip_len >= hlen + minicmpsz) && !off) ||
+
+ /* type(1) + code(1) + cksum(2) + id(2) seq(2) +
+ * 3*timestamp(3*4) */
+ else if (!off && (icmp->icmp_type == ICMP_TSTAMP ||
+ icmp->icmp_type == ICMP_TSTAMPREPLY))
+ minicmpsz = 20;
+
+ /* type(1) + code(1) + cksum(2) + id(2) seq(2) + mask(4) */
+ else if (!off && (icmp->icmp_type == ICMP_MASKREQ ||
+ icmp->icmp_type == ICMP_MASKREPLY))
+ minicmpsz = 12;
+
+ if ((!(plen >= hlen + minicmpsz) && !off) ||
(off && off < sizeof(struct icmp)))
fi->fi_fl |= FI_SHORT;
if (fin->fin_dlen > 1)
@@ -245,17 +298,33 @@ fr_info_t *fin;
}
case IPPROTO_TCP :
fi->fi_fl |= FI_TCPUDP;
- if ((!IPMINLEN(ip, tcphdr) && !off) ||
- (off && off < sizeof(struct tcphdr)))
- fi->fi_fl |= FI_SHORT;
+#ifdef USE_INET6
+ if (v == 6) {
+ if (plen < sizeof(struct tcphdr))
+ fi->fi_fl |= FI_SHORT;
+ } else
+#endif
+ if (v == 4) {
+ if ((!IPMINLEN(ip, tcphdr) && !off) ||
+ (off && off < sizeof(struct tcphdr)))
+ fi->fi_fl |= FI_SHORT;
+ }
if (!(fi->fi_fl & FI_SHORT) && !off)
fin->fin_tcpf = tcp->th_flags;
goto getports;
case IPPROTO_UDP :
fi->fi_fl |= FI_TCPUDP;
- if ((!IPMINLEN(ip, udphdr) && !off) ||
- (off && off < sizeof(struct udphdr)))
- fi->fi_fl |= FI_SHORT;
+#ifdef USE_INET6
+ if (v == 6) {
+ if (plen < sizeof(struct udphdr))
+ fi->fi_fl |= FI_SHORT;
+ } else
+#endif
+ if (v == 4) {
+ if ((!IPMINLEN(ip, udphdr) && !off) ||
+ (off && off < sizeof(struct udphdr)))
+ fi->fi_fl |= FI_SHORT;
+ }
getports:
if (!off && (fin->fin_dlen > 3)) {
fin->fin_data[0] = ntohs(tcp->th_sport);
@@ -266,13 +335,28 @@ getports:
break;
}
+#ifdef USE_INET6
+ if (v == 6) {
+ fi->fi_optmsk = 0;
+ fi->fi_secmsk = 0;
+ fi->fi_auth = 0;
+ return;
+ }
+#endif
- for (s = (u_char *)(ip + 1), hlen -= sizeof(*ip); hlen; ) {
- if (!(opt = *s))
- break;
- ol = (opt == IPOPT_NOP) ? 1 : (int)*(s+1);
- if (opt > 1 && (ol < 2 || ol > hlen))
+ for (s = (u_char *)(ip + 1), hlen -= (int)sizeof(*ip); hlen > 0; ) {
+ opt = *s;
+ if (opt == '\0')
break;
+ else if (opt == IPOPT_NOP)
+ ol = 1;
+ else {
+ if (hlen < 2)
+ break;
+ ol = (int)*(s + 1);
+ if (ol < 2 || ol > hlen)
+ break;
+ }
for (i = 9, mv = 4; mv >= 0; ) {
op = ipopts + i;
if (opt == (u_char)op->ol_val) {
@@ -319,8 +403,8 @@ getports:
/*
* check an IP packet for TCP/UDP characteristics such as ports and flags.
*/
-static int fr_tcpudpchk(fr, fin)
-frentry_t *fr;
+int fr_tcpudpchk(ft, fin)
+frtuc_t *ft;
fr_info_t *fin;
{
register u_short po, tup;
@@ -333,8 +417,8 @@ fr_info_t *fin;
*
* compare destination ports
*/
- if ((i = (int)fr->fr_dcmp)) {
- po = fr->fr_dport;
+ if ((i = (int)ft->ftu_dcmp)) {
+ po = ft->ftu_dport;
tup = fin->fin_data[1];
/*
* Do opposite test to that required and
@@ -353,17 +437,17 @@ fr_info_t *fin;
else if (!--i && tup < po) /* GT or EQ */
err = 0;
else if (!--i && /* Out of range */
- (tup >= po && tup <= fr->fr_dtop))
+ (tup >= po && tup <= ft->ftu_dtop))
err = 0;
else if (!--i && /* In range */
- (tup <= po || tup >= fr->fr_dtop))
+ (tup <= po || tup >= ft->ftu_dtop))
err = 0;
}
/*
* compare source ports
*/
- if (err && (i = (int)fr->fr_scmp)) {
- po = fr->fr_sport;
+ if (err && (i = (int)ft->ftu_scmp)) {
+ po = ft->ftu_sport;
tup = fin->fin_data[0];
if (!--i && tup != po)
err = 0;
@@ -378,10 +462,10 @@ fr_info_t *fin;
else if (!--i && tup < po)
err = 0;
else if (!--i && /* Out of range */
- (tup >= po && tup <= fr->fr_stop))
+ (tup >= po && tup <= ft->ftu_stop))
err = 0;
else if (!--i && /* In range */
- (tup <= po || tup >= fr->fr_stop))
+ (tup <= po || tup >= ft->ftu_stop))
err = 0;
}
@@ -393,14 +477,14 @@ fr_info_t *fin;
*/
if (err && (fin->fin_fi.fi_p == IPPROTO_TCP)) {
if (fin->fin_fi.fi_fl & FI_SHORT)
- return !(fr->fr_tcpf | fr->fr_tcpfm);
+ return !(ft->ftu_tcpf | ft->ftu_tcpfm);
/*
* Match the flags ? If not, abort this match.
*/
- if (fr->fr_tcpf &&
- fr->fr_tcpf != (fin->fin_tcpf & fr->fr_tcpfm)) {
+ if (ft->ftu_tcpfm &&
+ ft->ftu_tcpf != (fin->fin_tcpf & ft->ftu_tcpfm)) {
FR_DEBUG(("f. %#x & %#x != %#x\n", fin->fin_tcpf,
- fr->fr_tcpfm, fr->fr_tcpf));
+ ft->ftu_tcpfm, ft->ftu_tcpf));
err = 0;
}
}
@@ -413,23 +497,27 @@ fr_info_t *fin;
* kernel sauce.
*/
int fr_scanlist(pass, ip, fin, m)
-int pass;
+u_32_t pass;
ip_t *ip;
register fr_info_t *fin;
void *m;
{
register struct frentry *fr;
register fr_ip_t *fi = &fin->fin_fi;
- int rulen, portcmp = 0, off, skip = 0;
+ int rulen, portcmp = 0, off, skip = 0, logged = 0;
+ u_32_t passt;
fr = fin->fin_fr;
fin->fin_fr = NULL;
fin->fin_rule = 0;
fin->fin_group = 0;
- off = ip->ip_off & 0x1fff;
+ if (fin->fin_v == 4)
+ off = ip->ip_off & IP_OFFMASK;
+ else
+ off = 0;
pass |= (fi->fi_fl << 24);
- if ((fi->fi_fl & FI_TCPUDP) && (fin->fin_dlen > 3) && !off)
+ if ((fi->fi_fl & FI_TCPUDP) && (fin->fin_dlen > 3) && !off)
portcmp = 1;
for (rulen = 0; fr; fr = fr->fr_next, rulen++) {
@@ -444,8 +532,16 @@ void *m;
* check that we are working for the right interface
*/
#ifdef _KERNEL
- if (fr->fr_ifa && fr->fr_ifa != fin->fin_ifp)
- continue;
+# if BSD >= 199306
+ if (fin->fin_out != 0) {
+ if ((fr->fr_oifa &&
+ fr->fr_oifa != ((mb_t *)m)->m_pkthdr.rcvif) ||
+ (fr->fr_ifa && fr->fr_ifa != fin->fin_ifp))
+ continue;
+ } else
+# endif
+ if (fr->fr_ifa && fr->fr_ifa != fin->fin_ifp)
+ continue;
#else
if (opts & (OPT_VERBOSE|OPT_DEBUG))
printf("\n");
@@ -462,22 +558,77 @@ void *m;
lip = (u_32_t *)fi;
lm = (u_32_t *)&fr->fr_mip;
ld = (u_32_t *)&fr->fr_ip;
- i = ((lip[0] & lm[0]) != ld[0]);
- FR_IFDEBUG(i,continue,("0. %#08x & %#08x != %#08x\n",
- lip[0], lm[0], ld[0]));
- i |= ((lip[1] & lm[1]) != ld[1]) << 21;
- FR_IFDEBUG(i,continue,("1. %#08x & %#08x != %#08x\n",
- lip[1], lm[1], ld[1]));
- i |= ((lip[2] & lm[2]) != ld[2]) << 22;
- FR_IFDEBUG(i,continue,("2. %#08x & %#08x != %#08x\n",
- lip[2], lm[2], ld[2]));
- i |= ((lip[3] & lm[3]) != ld[3]);
- FR_IFDEBUG(i,continue,("3. %#08x & %#08x != %#08x\n",
- lip[3], lm[3], ld[3]));
- i |= ((lip[4] & lm[4]) != ld[4]);
- FR_IFDEBUG(i,continue,("4. %#08x & %#08x != %#08x\n",
- lip[4], lm[4], ld[4]));
- i ^= (fi->fi_fl & (FR_NOTSRCIP|FR_NOTDSTIP));
+ i = ((*lip & *lm) != *ld);
+ FR_DEBUG(("0. %#08x & %#08x != %#08x\n",
+ *lip, *lm, *ld));
+ if (i)
+ continue;
+ /*
+ * We now know whether the packet version and the
+ * rule version match, along with protocol, ttl and
+ * tos.
+ */
+ lip++, lm++, ld++;
+ /*
+ * Unrolled loops (4 each, for 32 bits).
+ */
+ i |= ((*lip & *lm) != *ld) << 19;
+ FR_DEBUG(("1a. %#08x & %#08x != %#08x\n",
+ *lip, *lm, *ld));
+ if (fi->fi_v == 6) {
+ lip++, lm++, ld++;
+ i |= ((*lip & *lm) != *ld) << 19;
+ FR_DEBUG(("1b. %#08x & %#08x != %#08x\n",
+ *lip, *lm, *ld));
+ lip++, lm++, ld++;
+ i |= ((*lip & *lm) != *ld) << 19;
+ FR_DEBUG(("1c. %#08x & %#08x != %#08x\n",
+ *lip, *lm, *ld));
+ lip++, lm++, ld++;
+ i |= ((*lip & *lm) != *ld) << 19;
+ FR_DEBUG(("1d. %#08x & %#08x != %#08x\n",
+ *lip, *lm, *ld));
+ } else {
+ lip += 3;
+ lm += 3;
+ ld += 3;
+ }
+ i ^= (fr->fr_flags & FR_NOTSRCIP);
+ if (i)
+ continue;
+ lip++, lm++, ld++;
+ i |= ((*lip & *lm) != *ld) << 20;
+ FR_DEBUG(("2a. %#08x & %#08x != %#08x\n",
+ *lip, *lm, *ld));
+ if (fi->fi_v == 6) {
+ lip++, lm++, ld++;
+ i |= ((*lip & *lm) != *ld) << 20;
+ FR_DEBUG(("2b. %#08x & %#08x != %#08x\n",
+ *lip, *lm, *ld));
+ lip++, lm++, ld++;
+ i |= ((*lip & *lm) != *ld) << 20;
+ FR_DEBUG(("2c. %#08x & %#08x != %#08x\n",
+ *lip, *lm, *ld));
+ lip++, lm++, ld++;
+ i |= ((*lip & *lm) != *ld) << 20;
+ FR_DEBUG(("2d. %#08x & %#08x != %#08x\n",
+ *lip, *lm, *ld));
+ } else {
+ lip += 3;
+ lm += 3;
+ ld += 3;
+ }
+ i ^= (fr->fr_flags & FR_NOTDSTIP);
+ if (i)
+ continue;
+ lip++, lm++, ld++;
+ i |= ((*lip & *lm) != *ld);
+ FR_DEBUG(("3. %#08x & %#08x != %#08x\n",
+ *lip, *lm, *ld));
+ lip++, lm++, ld++;
+ i |= ((*lip & *lm) != *ld);
+ FR_DEBUG(("4. %#08x & %#08x != %#08x\n",
+ *lip, *lm, *ld));
if (i)
continue;
}
@@ -490,7 +641,7 @@ void *m;
fr->fr_tcpfm))
continue;
if (fi->fi_fl & FI_TCPUDP) {
- if (!fr_tcpudpchk(fr, fin))
+ if (!fr_tcpudpchk(&fr->fr_tuc, fin))
continue;
} else if (fr->fr_icmpm || fr->fr_icmp) {
if ((fi->fi_p != IPPROTO_ICMP) || off ||
@@ -507,26 +658,31 @@ void *m;
/*
* Just log this packet...
*/
- if (!(skip = fr->fr_skip))
- pass = fr->fr_flags;
- if ((pass & FR_CALLNOW) && fr->fr_func)
- pass = (*fr->fr_func)(pass, ip, fin);
+ passt = fr->fr_flags;
+ if ((passt & FR_CALLNOW) && fr->fr_func)
+ passt = (*fr->fr_func)(passt, ip, fin);
+ fin->fin_fr = fr;
#ifdef IPFILTER_LOG
- if ((pass & FR_LOGMASK) == FR_LOG) {
- if (!IPLLOG(fr->fr_flags, ip, fin, m))
- frstats[fin->fin_out].fr_skip++;
- frstats[fin->fin_out].fr_pkl++;
+ if ((passt & FR_LOGMASK) == FR_LOG) {
+ if (!IPLLOG(passt, ip, fin, m)) {
+ if (passt & FR_LOGORBLOCK)
+ passt |= FR_BLOCK|FR_QUICK;
+ ATOMIC_INCL(frstats[fin->fin_out].fr_skip);
+ }
+ ATOMIC_INCL(frstats[fin->fin_out].fr_pkl);
+ logged = 1;
}
#endif /* IPFILTER_LOG */
+ if (!(skip = fr->fr_skip) && (passt & FR_LOGMASK) != FR_LOG)
+ pass = passt;
FR_DEBUG(("pass %#x\n", pass));
- fr->fr_hits++;
+ ATOMIC_INCL(fr->fr_hits);
if (pass & FR_ACCOUNT)
fr->fr_bytes += (U_QUAD_T)ip->ip_len;
else
fin->fin_icode = fr->fr_icode;
fin->fin_rule = rulen;
fin->fin_group = fr->fr_group;
- fin->fin_fr = fr;
if (fr->fr_grp) {
fin->fin_fr = fr->fr_grp;
pass = fr_scanlist(pass, ip, fin, m);
@@ -535,17 +691,21 @@ void *m;
fin->fin_group = fr->fr_group;
fin->fin_fr = fr;
}
+ if (pass & FR_DONTCACHE)
+ logged = 1;
}
if (pass & FR_QUICK)
break;
}
+ if (logged)
+ pass |= FR_DONTCACHE;
return pass;
}
/*
* frcheck - filter check
- * check using source and destination addresses/pors in a packet whether
+ * check using source and destination addresses/ports in a packet whether
* or not to pass it on or not.
*/
int fr_check(ip, hlen, ifp, out
@@ -566,8 +726,9 @@ int out;
*/
fr_info_t frinfo, *fc;
register fr_info_t *fin = &frinfo;
- frentry_t *fr = NULL;
- int pass, changed, apass, error = EHOSTUNREACH;
+ int changed, error = EHOSTUNREACH, v = ip->ip_v;
+ frentry_t *fr = NULL, *list;
+ u_32_t pass, apass;
#if !SOLARIS || !defined(_KERNEL)
register mb_t *m = *mp;
#endif
@@ -580,71 +741,118 @@ int out;
# endif
int up;
-#ifdef M_CANFASTFWD
+# ifdef M_CANFASTFWD
/*
* XXX For now, IP Filter and fast-forwarding of cached flows
* XXX are mutually exclusive. Eventually, IP Filter should
* XXX get a "can-fast-forward" filter rule.
*/
m->m_flags &= ~M_CANFASTFWD;
-#endif /* M_CANFASTFWD */
+# endif /* M_CANFASTFWD */
+# ifdef CSUM_DELAY_DATA
+ /*
+ * disable delayed checksums.
+ */
+ if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
+ in_delayed_cksum(m);
+ m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
+ }
+# endif /* CSUM_DELAY_DATA */
+
if ((ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP ||
ip->ip_p == IPPROTO_ICMP)) {
int plen = 0;
- switch(ip->ip_p)
- {
- case IPPROTO_TCP:
- plen = sizeof(tcphdr_t);
- break;
- case IPPROTO_UDP:
- plen = sizeof(udphdr_t);
- break;
- case IPPROTO_ICMP:
+ if ((ip->ip_off & IP_OFFMASK) == 0)
+ switch(ip->ip_p)
+ {
+ case IPPROTO_TCP:
+ plen = sizeof(tcphdr_t);
+ break;
+ case IPPROTO_UDP:
+ plen = sizeof(udphdr_t);
+ break;
/* 96 - enough for complete ICMP error IP header */
- plen = sizeof(struct icmp) + sizeof(ip_t) + 8;
- break;
- }
+ case IPPROTO_ICMP:
+ plen = ICMPERR_MAXPKTLEN - sizeof(ip_t);
+ break;
+ }
up = MIN(hlen + plen, ip->ip_len);
if (up > m->m_len) {
-#ifdef __sgi /* Under IRIX, avoid m_pullup as it makes ping <hostname> panic */
+# ifdef __sgi
+ /* Under IRIX, avoid m_pullup as it makes ping <hostname> panic */
if ((up > sizeof(hbuf)) || (m_length(m) < up)) {
- frstats[out].fr_pull[1]++;
+ ATOMIC_INCL(frstats[out].fr_pull[1]);
return -1;
}
m_copydata(m, 0, up, hbuf);
- frstats[out].fr_pull[0]++;
+ ATOMIC_INCL(frstats[out].fr_pull[0]);
ip = (ip_t *)hbuf;
-#else
-# ifndef linux
+# else /* __ sgi */
+# ifndef linux
if ((*mp = m_pullup(m, up)) == 0) {
- frstats[out].fr_pull[1]++;
+ ATOMIC_INCL(frstats[out].fr_pull[1]);
return -1;
} else {
- frstats[out].fr_pull[0]++;
+ ATOMIC_INCL(frstats[out].fr_pull[0]);
m = *mp;
ip = mtod(m, ip_t *);
}
-# endif
-#endif
+# endif /* !linux */
+# endif /* __sgi */
} else
up = 0;
} else
up = 0;
-# endif
+# endif /* !defined(__SVR4) && !defined(__svr4__) */
# if SOLARIS
mb_t *m = qif->qf_m;
+
+ if ((u_int)ip & 0x3)
+ return 2;
+ fin->fin_qfm = m;
+ fin->fin_qif = qif;
# endif
-#endif
- fr_makefrip(hlen, ip, fin);
+# ifdef USE_INET6
+ if (v == 6) {
+ ATOMIC_INCL(frstats[0].fr_ipv6[out]);
+ } else
+# endif
+ if (!out && fr_chksrc && !fr_verifysrc(ip->ip_src, ifp)) {
+ ATOMIC_INCL(frstats[0].fr_badsrc);
+# if !SOLARIS
+ m_freem(m);
+# endif
+ return error;
+ }
+#endif /* _KERNEL */
+
+ /*
+ * Be careful here: ip_id is in network byte order when called
+ * from ip_output()
+ */
+ if ((out) && (v == 4))
+ ip->ip_id = ntohs(ip->ip_id);
+
+ changed = 0;
+ fin->fin_v = v;
fin->fin_ifp = ifp;
fin->fin_out = out;
fin->fin_mp = mp;
+ fr_makefrip(hlen, ip, fin);
+ pass = fr_pass;
- MUTEX_ENTER(&ipf_mutex);
+ if (fin->fin_fi.fi_fl & FI_SHORT) {
+ ATOMIC_INCL(frstats[out].fr_short);
+ }
+
+ READ_ENTER(&ipf_mutex);
+ if (fin->fin_fi.fi_fl & FI_SHORT)
+ ATOMIC_INCL(frstats[out].fr_short);
+
/*
* Check auth now. This, combined with the check below to see if apass
* is 0 is to ensure that we don't count the packet twice, which can
@@ -655,14 +863,21 @@ int out;
apass = fr_checkauth(ip, fin);
if (!out) {
- changed = ip_natin(ip, hlen, fin);
- if (!apass && (fin->fin_fr = ipacct[0][fr_active]) &&
- (FR_SCANLIST(FR_NOMATCH, ip, fin, m) & FR_ACCOUNT))
- frstats[0].fr_acct++;
+#ifdef USE_INET6
+ if (v == 6)
+ list = ipacct6[0][fr_active];
+ else
+#endif
+ list = ipacct[0][fr_active];
+ changed = ip_natin(ip, fin);
+ if (!apass && (fin->fin_fr = list) &&
+ (fr_scanlist(FR_NOMATCH, ip, fin, m) & FR_ACCOUNT)) {
+ ATOMIC_INCL(frstats[0].fr_acct);
+ }
}
- if (apass || (!(pass = ipfr_knownfrag(ip, fin)) &&
- !(pass = fr_checkstate(ip, fin)))) {
+ if (apass || (!(fr = ipfr_knownfrag(ip, fin)) &&
+ !(fr = fr_checkstate(ip, fin)))) {
/*
* If a packet is found in the auth table, then skip checking
* the access lists for permission but we do need to consider
@@ -676,19 +891,26 @@ int out;
* earlier.
*/
bcopy((char *)fc, (char *)fin, FI_COPYSIZE);
- frstats[out].fr_chit++;
+ ATOMIC_INCL(frstats[out].fr_chit);
if ((fr = fin->fin_fr)) {
- fr->fr_hits++;
+ ATOMIC_INCL(fr->fr_hits);
pass = fr->fr_flags;
- } else
- pass = fr_pass;
+ }
} else {
- pass = fr_pass;
- if ((fin->fin_fr = ipfilter[out][fr_active]))
- pass = FR_SCANLIST(fr_pass, ip, fin, m);
- bcopy((char *)fin, (char *)fc, FI_COPYSIZE);
- if (pass & FR_NOMATCH)
- frstats[out].fr_nom++;
+#ifdef USE_INET6
+ if (v == 6)
+ list = ipfilter6[out][fr_active];
+ else
+#endif
+ list = ipfilter[out][fr_active];
+ if ((fin->fin_fr = list))
+ pass = fr_scanlist(fr_pass, ip, fin, m);
+ if (!(pass & (FR_KEEPSTATE|FR_DONTCACHE)))
+ bcopy((char *)fin, (char *)fc,
+ FI_COPYSIZE);
+ if (pass & FR_NOMATCH) {
+ ATOMIC_INCL(frstats[out].fr_nom);
+ }
}
fr = fin->fin_fr;
} else
@@ -700,7 +922,7 @@ int out;
* then pretend we've dropped it already.
*/
if ((pass & FR_AUTH))
- if (FR_NEWAUTH(m, fin, ip, qif) != 0)
+ if (fr_newauth((mb_t *)m, fin, ip) != 0)
#ifdef _KERNEL
m = *mp = NULL;
#else
@@ -708,30 +930,39 @@ int out;
#endif
if (pass & FR_PREAUTH) {
- MUTEX_ENTER(&ipf_auth);
+ READ_ENTER(&ipf_auth);
if ((fin->fin_fr = ipauth) &&
- (pass = FR_SCANLIST(0, ip, fin, m)))
- fr_authstats.fas_hits++;
- else
- fr_authstats.fas_miss++;
- MUTEX_EXIT(&ipf_auth);
+ (pass = fr_scanlist(0, ip, fin, m))) {
+ ATOMIC_INCL(fr_authstats.fas_hits);
+ } else {
+ ATOMIC_INCL(fr_authstats.fas_miss);
+ }
+ RWLOCK_EXIT(&ipf_auth);
}
- if (pass & FR_KEEPFRAG) {
+ fin->fin_fr = fr;
+ if ((pass & (FR_KEEPFRAG|FR_KEEPSTATE)) == FR_KEEPFRAG) {
if (fin->fin_fi.fi_fl & FI_FRAG) {
- if (ipfr_newfrag(ip, fin, pass) == -1)
- frstats[out].fr_bnfr++;
- else
- frstats[out].fr_nfr++;
- } else
- frstats[out].fr_cfr++;
+ if (ipfr_newfrag(ip, fin, pass) == -1) {
+ ATOMIC_INCL(frstats[out].fr_bnfr);
+ } else {
+ ATOMIC_INCL(frstats[out].fr_nfr);
+ }
+ } else {
+ ATOMIC_INCL(frstats[out].fr_cfr);
+ }
}
if (pass & FR_KEEPSTATE) {
- if (fr_addstate(ip, fin, pass) == -1)
- frstats[out].fr_bads++;
- else
- frstats[out].fr_ads++;
+ if (fr_addstate(ip, fin, 0) == NULL) {
+ ATOMIC_INCL(frstats[out].fr_bads);
+ } else {
+ ATOMIC_INCL(frstats[out].fr_ads);
+ }
}
+ } else if (fr != NULL) {
+ pass = fr->fr_flags;
+ if (pass & FR_LOGFIRST)
+ pass &= ~(FR_LOGFIRST|FR_LOG);
}
if (fr && fr->fr_func && !(pass & FR_CALLNOW))
@@ -742,35 +973,42 @@ int out;
* interface.
*/
if (out && (pass & FR_PASS)) {
- if ((fin->fin_fr = ipacct[1][fr_active]) &&
- (FR_SCANLIST(FR_NOMATCH, ip, fin, m) & FR_ACCOUNT))
- frstats[1].fr_acct++;
- fin->fin_fr = NULL;
- changed = ip_natout(ip, hlen, fin);
- }
- fin->fin_fr = fr;
- MUTEX_EXIT(&ipf_mutex);
+#ifdef USE_INET6
+ if (v == 6)
+ list = ipacct6[0][fr_active];
+ else
+#endif
+ list = ipacct[0][fr_active];
+ if ((fin->fin_fr = list) &&
+ (fr_scanlist(FR_NOMATCH, ip, fin, m) & FR_ACCOUNT)) {
+ ATOMIC_INCL(frstats[1].fr_acct);
+ }
+ fin->fin_fr = fr;
+ changed = ip_natout(ip, fin);
+ } else
+ fin->fin_fr = fr;
+ RWLOCK_EXIT(&ipf_mutex);
#ifdef IPFILTER_LOG
if ((fr_flags & FF_LOGGING) || (pass & FR_LOGMASK)) {
if ((fr_flags & FF_LOGNOMATCH) && (pass & FR_NOMATCH)) {
pass |= FF_LOGNOMATCH;
- frstats[out].fr_npkl++;
+ ATOMIC_INCL(frstats[out].fr_npkl);
goto logit;
} else if (((pass & FR_LOGMASK) == FR_LOGP) ||
((pass & FR_PASS) && (fr_flags & FF_LOGPASS))) {
if ((pass & FR_LOGMASK) != FR_LOGP)
pass |= FF_LOGPASS;
- frstats[out].fr_ppkl++;
+ ATOMIC_INCL(frstats[out].fr_ppkl);
goto logit;
} else if (((pass & FR_LOGMASK) == FR_LOGB) ||
((pass & FR_BLOCK) && (fr_flags & FF_LOGBLOCK))) {
if ((pass & FR_LOGMASK) != FR_LOGB)
pass |= FF_LOGBLOCK;
- frstats[out].fr_bpkl++;
+ ATOMIC_INCL(frstats[out].fr_bpkl);
logit:
if (!IPLLOG(pass, ip, fin, m)) {
- frstats[out].fr_skip++;
+ ATOMIC_INCL(frstats[out].fr_skip);
if ((pass & (FR_PASS|FR_LOGORBLOCK)) ==
(FR_PASS|FR_LOGORBLOCK))
pass ^= FR_PASS|FR_BLOCK;
@@ -778,6 +1016,10 @@ logit:
}
}
#endif /* IPFILTER_LOG */
+
+ if ((out) && (v == 4))
+ ip->ip_id = htons(ip->ip_id);
+
#ifdef _KERNEL
/*
* Only allow FR_DUP to work if a rule matched - it makes no sense to
@@ -795,10 +1037,10 @@ logit:
# endif
# endif
#endif
- if (pass & FR_PASS)
- frstats[out].fr_pass++;
- else if (pass & FR_BLOCK) {
- frstats[out].fr_block++;
+ if (pass & FR_PASS) {
+ ATOMIC_INCL(frstats[out].fr_pass);
+ } else if (pass & FR_BLOCK) {
+ ATOMIC_INCL(frstats[out].fr_block);
/*
* Should we return an ICMP packet to indicate error
* status passing through the packet filter ?
@@ -810,29 +1052,31 @@ logit:
if (!out) {
#ifdef _KERNEL
if (pass & FR_RETICMP) {
-# if SOLARIS
- ICMP_ERROR(q, ip, ICMP_UNREACH, fin->fin_icode,
- qif, ip->ip_src);
-# else
- ICMP_ERROR(m, ip, ICMP_UNREACH, fin->fin_icode,
- ifp, ip->ip_src);
- m = *mp = NULL; /* freed by icmp_error() */
-# endif
+ int dst;
- frstats[0].fr_ret++;
- } else if ((pass & FR_RETRST) &&
+ if ((pass & FR_RETMASK) == FR_FAKEICMP)
+ dst = 1;
+ else
+ dst = 0;
+ send_icmp_err(ip, ICMP_UNREACH, fin, dst);
+ ATOMIC_INCL(frstats[0].fr_ret);
+ } else if (((pass & FR_RETMASK) == FR_RETRST) &&
!(fin->fin_fi.fi_fl & FI_SHORT)) {
- if (SEND_RESET(ip, qif, ifp) == 0)
- frstats[1].fr_ret++;
+ if (send_reset(ip, fin) == 0) {
+ ATOMIC_INCL(frstats[1].fr_ret);
+ }
}
#else
- if (pass & FR_RETICMP) {
+ if ((pass & FR_RETMASK) == FR_RETICMP) {
verbose("- ICMP unreachable sent\n");
- frstats[0].fr_ret++;
- } else if ((pass & FR_RETRST) &&
+ ATOMIC_INCL(frstats[0].fr_ret);
+ } else if ((pass & FR_RETMASK) == FR_FAKEICMP) {
+ verbose("- forged ICMP unreachable sent\n");
+ ATOMIC_INCL(frstats[0].fr_ret);
+ } else if (((pass & FR_RETMASK) == FR_RETRST) &&
!(fin->fin_fi.fi_fl & FI_SHORT)) {
verbose("- TCP RST sent\n");
- frstats[1].fr_ret++;
+ ATOMIC_INCL(frstats[1].fr_ret);
}
#endif
} else {
@@ -848,16 +1092,20 @@ logit:
* Once we're finished return to our caller, freeing the packet if
* we are dropping it (* BSD ONLY *).
*/
+ if ((changed == -1) && (pass & FR_PASS)) {
+ pass &= ~FR_PASS;
+ pass |= FR_BLOCK;
+ }
#if defined(_KERNEL)
# if !SOLARIS
# if !defined(linux)
if (fr) {
frdest_t *fdp = &fr->fr_tif;
- if ((pass & FR_FASTROUTE) ||
+ if (((pass & FR_FASTROUTE) && !out) ||
(fdp->fd_ifp && fdp->fd_ifp != (struct ifnet *)-1)) {
- ipfr_fastroute(m, fin, fdp);
- m = *mp = NULL;
+ if (ipfr_fastroute(m, fin, fdp) == 0)
+ m = *mp = NULL;
}
if (mc)
ipfr_fastroute(mc, fin, &fr->fr_dif);
@@ -869,21 +1117,20 @@ logit:
m_copyback(m, 0, up, hbuf);
# endif
# endif /* !linux */
- return (pass & FR_PASS) ? 0 : error;
# else /* !SOLARIS */
if (fr) {
frdest_t *fdp = &fr->fr_tif;
- if ((pass & FR_FASTROUTE) ||
+ if (((pass & FR_FASTROUTE) && !out) ||
(fdp->fd_ifp && fdp->fd_ifp != (struct ifnet *)-1)) {
- ipfr_fastroute(qif, ip, m, mp, fin, fdp);
- m = *mp = NULL;
+ if (ipfr_fastroute(qif, ip, m, mp, fin, fdp) == 0)
+ m = *mp = NULL;
}
if (mc)
ipfr_fastroute(qif, ip, mc, mp, fin, &fr->fr_dif);
}
- return (pass & FR_PASS) ? changed : error;
# endif /* !SOLARIS */
+ return (pass & FR_PASS) ? 0 : error;
#else /* _KERNEL */
if (pass & FR_NOMATCH)
return 1;
@@ -928,76 +1175,92 @@ register int len;
* and the TCP header. We also assume that data blocks aren't allocated in
* odd sizes.
*/
-u_short fr_tcpsum(m, ip, tcp, len)
+u_short fr_tcpsum(m, ip, tcp)
mb_t *m;
ip_t *ip;
tcphdr_t *tcp;
-int len;
+{
+ u_short *sp, slen, ts;
+ u_int sum, sum2;
+ int hlen;
+
+ /*
+ * Add up IP Header portion
+ */
+ hlen = ip->ip_hl << 2;
+ slen = ip->ip_len - hlen;
+ sum = htons((u_short)ip->ip_p);
+ sum += htons(slen);
+ sp = (u_short *)&ip->ip_src;
+ sum += *sp++; /* ip_src */
+ sum += *sp++;
+ sum += *sp++; /* ip_dst */
+ sum += *sp++;
+ ts = tcp->th_sum;
+ tcp->th_sum = 0;
+#ifdef KERNEL
+# if SOLARIS
+ sum2 = ip_cksum(m, hlen, sum); /* hlen == offset */
+ sum2 = (sum2 & 0xffff) + (sum2 >> 16);
+ sum2 = ~sum2 & 0xffff;
+# else /* SOLARIS */
+# if defined(BSD) || defined(sun)
+# if BSD >= 199306
+ m->m_data += hlen;
+# else
+ m->m_off += hlen;
+# endif
+ m->m_len -= hlen;
+ sum2 = in_cksum(m, slen);
+ m->m_len += hlen;
+# if BSD >= 199306
+ m->m_data -= hlen;
+# else
+ m->m_off -= hlen;
+# endif
+ /*
+ * Both sum and sum2 are partial sums, so combine them together.
+ */
+ sum = (sum & 0xffff) + (sum >> 16);
+ sum = ~sum & 0xffff;
+ sum2 += sum;
+ sum2 = (sum2 & 0xffff) + (sum2 >> 16);
+# else /* defined(BSD) || defined(sun) */
{
union {
u_char c[2];
u_short s;
} bytes;
- u_32_t sum;
- u_short *sp;
-# if SOLARIS || defined(__sgi)
- int add, hlen;
-# endif
-
-# if SOLARIS
- /* skip any leading M_PROTOs */
- while(m && (MTYPE(m) != M_DATA))
- m = m->b_cont;
- PANIC((!m),("fr_tcpsum: no M_DATA"));
+ u_short len = ip->ip_len;
+# if defined(__sgi)
+ int add;
# endif
/*
* Add up IP Header portion
*/
- bytes.c[0] = 0;
- bytes.c[1] = IPPROTO_TCP;
- len -= (ip->ip_hl << 2);
- sum = bytes.s;
- sum += htons((u_short)len);
sp = (u_short *)&ip->ip_src;
+ len -= (ip->ip_hl << 2);
+ sum = ntohs(IPPROTO_TCP);
+ sum += htons(len);
+ sum += *sp++; /* ip_src */
sum += *sp++;
- sum += *sp++;
- sum += *sp++;
+ sum += *sp++; /* ip_dst */
sum += *sp++;
if (sp != (u_short *)tcp)
sp = (u_short *)tcp;
+ sum += *sp++; /* sport */
+ sum += *sp++; /* dport */
+ sum += *sp++; /* seq */
sum += *sp++;
+ sum += *sp++; /* ack */
sum += *sp++;
- sum += *sp++;
- sum += *sp++;
- sum += *sp++;
- sum += *sp++;
- sum += *sp++;
- sum += *sp;
- sp += 2; /* Skip over checksum */
- sum += *sp++;
+ sum += *sp++; /* off */
+ sum += *sp++; /* win */
+ sum += *sp++; /* Skip over checksum */
+ sum += *sp++; /* urp */
-#if SOLARIS
- /*
- * In case we had to copy the IP & TCP header out of mblks,
- * skip over the mblk bits which are the header
- */
- if ((caddr_t)ip != (caddr_t)m->b_rptr) {
- hlen = (caddr_t)sp - (caddr_t)ip;
- while (hlen) {
- add = MIN(hlen, m->b_wptr - m->b_rptr);
- sp = (u_short *)((caddr_t)m->b_rptr + add);
- hlen -= add;
- if ((caddr_t)sp >= (caddr_t)m->b_wptr) {
- m = m->b_cont;
- PANIC((!m),("fr_tcpsum: not enough data"));
- if (!hlen)
- sp = (u_short *)m->b_rptr;
- }
- }
- }
-#endif
-#ifdef __sgi
+# ifdef __sgi
/*
* In case we had to copy the IP & TCP header out of mbufs,
* skip over the mbuf bits which are the header
@@ -1008,52 +1271,57 @@ int len;
add = MIN(hlen, m->m_len);
sp = (u_short *)(mtod(m, caddr_t) + add);
hlen -= add;
- if (add >= m->m_len) {
+ if (add == m->m_len) {
m = m->m_next;
- PANIC((!m),("fr_tcpsum: not enough data"));
- if (!hlen)
+ if (!hlen) {
+ if (!m)
+ break;
sp = mtod(m, u_short *);
+ }
+ PANIC((!m),("fr_tcpsum(1): not enough data"));
}
}
}
-#endif
+# endif
if (!(len -= sizeof(*tcp)))
goto nodata;
- while (len > 0) {
-#if SOLARIS
- while ((caddr_t)sp >= (caddr_t)m->b_wptr) {
- m = m->b_cont;
- PANIC((!m),("fr_tcpsum: not enough data"));
- sp = (u_short *)m->b_rptr;
+ while (len > 1) {
+ if (((caddr_t)sp - mtod(m, caddr_t)) >= m->m_len) {
+ m = m->m_next;
+ PANIC((!m),("fr_tcpsum(2): not enough data"));
+ sp = mtod(m, u_short *);
}
-#else
- while (((caddr_t)sp - mtod(m, caddr_t)) >= m->m_len)
- {
+ if (((caddr_t)(sp + 1) - mtod(m, caddr_t)) > m->m_len) {
+ bytes.c[0] = *(u_char *)sp;
m = m->m_next;
- PANIC((!m),("fr_tcpsum: not enough data"));
+ PANIC((!m),("fr_tcpsum(3): not enough data"));
sp = mtod(m, u_short *);
+ bytes.c[1] = *(u_char *)sp;
+ sum += bytes.s;
+ sp = (u_short *)((u_char *)sp + 1);
}
-#endif /* SOLARIS */
- if (len < 2)
- break;
- if((u_32_t)sp & 1) {
+ if ((u_long)sp & 1) {
bcopy((char *)sp++, (char *)&bytes.s, sizeof(bytes.s));
sum += bytes.s;
} else
sum += *sp++;
len -= 2;
}
- if (len) {
- bytes.c[1] = 0;
- bytes.c[0] = *(u_char *)sp;
- sum += bytes.s;
- }
+ if (len)
+ sum += ntohs(*(u_char *)sp << 8);
nodata:
- sum = (sum >> 16) + (sum & 0xffff);
- sum += (sum >> 16);
- sum = (u_short)((~sum) & 0xffff);
- return sum;
+ while (sum > 0xffff)
+ sum = (sum & 0xffff) + (sum >> 16);
+ sum2 = (u_short)(~sum & 0xffff);
+}
+# endif /* defined(BSD) || defined(sun) */
+# endif /* SOLARIS */
+#else /* KERNEL */
+ sum2 = 0;
+#endif /* KERNEL */
+ tcp->th_sum = ts;
+ return sum2;
}
@@ -1091,7 +1359,7 @@ nodata:
* SUCH DAMAGE.
*
* @(#)uipc_mbuf.c 8.2 (Berkeley) 1/4/94
- * $Id: fil.c,v 2.0.2.41.2.14 1998/05/23 19:20:30 darrenr Exp $
+ * $Id: fil.c,v 2.35.2.8 2000/05/22 10:26:09 darrenr Exp $
*/
/*
* Copy data from an mbuf chain starting "off" bytes from the beginning,
@@ -1191,9 +1459,9 @@ out:
frgroup_t *fr_findgroup(num, flags, which, set, fgpp)
-u_short num;
-u_32_t flags;
-int which, set;
+u_32_t num, flags;
+minor_t which;
+int set;
frgroup_t ***fgpp;
{
frgroup_t *fg, **fgp;
@@ -1206,6 +1474,7 @@ frgroup_t ***fgpp;
fgp = &ipfgroups[0][set];
else
return NULL;
+ num &= 0xffff;
while ((fg = *fgp))
if (fg->fg_num == num)
@@ -1219,16 +1488,17 @@ frgroup_t ***fgpp;
frgroup_t *fr_addgroup(num, fp, which, set)
-u_short num;
+u_32_t num;
frentry_t *fp;
-int which, set;
+minor_t which;
+int set;
{
frgroup_t *fg, **fgp;
if ((fg = fr_findgroup(num, fp->fr_flags, which, set, &fgp)))
return fg;
- KMALLOC(fg, frgroup_t *, sizeof(*fg));
+ KMALLOC(fg, frgroup_t *);
if (fg) {
fg->fg_num = num;
fg->fg_next = *fgp;
@@ -1241,9 +1511,9 @@ int which, set;
void fr_delgroup(num, flags, which, set)
-u_short num;
-u_32_t flags;
-int which, set;
+u_32_t num, flags;
+minor_t which;
+int set;
{
frgroup_t *fg, **fgp;
@@ -1261,62 +1531,480 @@ int which, set;
* encountered. if a rule is the head of a group and it has lost all its
* group members, then also delete the group reference.
*/
-static int frflushlist(set, unit, nfreedp, list, listp)
-int set, unit, *nfreedp;
-frentry_t *list, **listp;
+static int frflushlist(set, unit, nfreedp, listp)
+int set;
+minor_t unit;
+int *nfreedp;
+frentry_t **listp;
{
- register frentry_t *fp = list, *fpn;
- register int freed = 0;
+ register int freed = 0, i;
+ register frentry_t *fp;
- while (fp) {
- fpn = fp->fr_next;
+ while ((fp = *listp)) {
+ *listp = fp->fr_next;
if (fp->fr_grp) {
- fp->fr_ref -= frflushlist(set, unit, nfreedp,
- fp->fr_grp, &fp->fr_grp);
+ i = frflushlist(set, unit, nfreedp, &fp->fr_grp);
+ MUTEX_ENTER(&ipf_rw);
+ fp->fr_ref -= i;
+ MUTEX_EXIT(&ipf_rw);
}
- if (fp->fr_ref == 1) {
- if (fp->fr_grhead)
- fr_delgroup(fp->fr_grhead, fp->fr_flags, unit,
- set);
+ ATOMIC_DEC32(fp->fr_ref);
+ if (fp->fr_grhead) {
+ fr_delgroup(fp->fr_grhead, fp->fr_flags,
+ unit, set);
+ fp->fr_grhead = 0;
+ }
+ if (fp->fr_ref == 0) {
KFREE(fp);
- *listp = fpn;
freed++;
- }
- fp = fpn;
+ } else
+ fp->fr_next = NULL;
}
*nfreedp += freed;
return freed;
}
-void frflush(unit, result)
-int unit;
-int *result;
+int frflush(unit, flags)
+minor_t unit;
+int flags;
{
- int flags = *result, flushed = 0, set = fr_active;
+ int flushed = 0, set;
+ if (unit != IPL_LOGIPF)
+ return 0;
+ WRITE_ENTER(&ipf_mutex);
bzero((char *)frcache, sizeof(frcache[0]) * 2);
+ set = fr_active;
if (flags & FR_INACTIVE)
set = 1 - set;
- if (unit == IPL_LOGIPF) {
- if (flags & FR_OUTQUE) {
- (void) frflushlist(set, unit, &flushed,
- ipfilter[1][set],
- &ipfilter[1][set]);
- (void) frflushlist(set, unit, &flushed,
- ipacct[1][set], &ipacct[1][set]);
+ if (flags & FR_OUTQUE) {
+#ifdef USE_INET6
+ (void) frflushlist(set, unit, &flushed, &ipfilter6[1][set]);
+ (void) frflushlist(set, unit, &flushed, &ipacct6[1][set]);
+#endif
+ (void) frflushlist(set, unit, &flushed, &ipfilter[1][set]);
+ (void) frflushlist(set, unit, &flushed, &ipacct[1][set]);
+ }
+ if (flags & FR_INQUE) {
+#ifdef USE_INET6
+ (void) frflushlist(set, unit, &flushed, &ipfilter6[0][set]);
+ (void) frflushlist(set, unit, &flushed, &ipacct6[0][set]);
+#endif
+ (void) frflushlist(set, unit, &flushed, &ipfilter[0][set]);
+ (void) frflushlist(set, unit, &flushed, &ipacct[0][set]);
+ }
+ RWLOCK_EXIT(&ipf_mutex);
+ return flushed;
+}
+
+
+char *memstr(src, dst, slen, dlen)
+char *src, *dst;
+int slen, dlen;
+{
+ char *s = NULL;
+
+ while (dlen >= slen) {
+ if (bcmp(src, dst, slen) == 0) {
+ s = dst;
+ break;
+ }
+ dst++;
+ dlen--;
+ }
+ return s;
+}
+
+
+void fixskip(listp, rp, addremove)
+frentry_t **listp, *rp;
+int addremove;
+{
+ frentry_t *fp;
+ int rules = 0, rn = 0;
+
+ for (fp = *listp; fp && (fp != rp); fp = fp->fr_next, rules++)
+ ;
+
+ if (!fp)
+ return;
+
+ for (fp = *listp; fp && (fp != rp); fp = fp->fr_next, rn++)
+ if (fp->fr_skip && (rn + fp->fr_skip >= rules))
+ fp->fr_skip += addremove;
+}
+
+
+#ifdef _KERNEL
+/*
+ * count consecutive 1's in bit mask. If the mask generated by counting
+ * consecutive 1's is different to that passed, return -1, else return #
+ * of bits.
+ */
+int countbits(ip)
+u_32_t ip;
+{
+ u_32_t ipn;
+ int cnt = 0, i, j;
+
+ ip = ipn = ntohl(ip);
+ for (i = 32; i; i--, ipn *= 2)
+ if (ipn & 0x80000000)
+ cnt++;
+ else
+ break;
+ ipn = 0;
+ for (i = 32, j = cnt; i; i--, j--) {
+ ipn *= 2;
+ if (j > 0)
+ ipn++;
+ }
+ if (ipn == ip)
+ return cnt;
+ return -1;
+}
+
+
+/*
+ * return the first IP Address associated with an interface
+ */
+int fr_ifpaddr(v, ifptr, inp)
+int v;
+void *ifptr;
+struct in_addr *inp;
+{
+# ifdef USE_INET6
+ struct in6_addr *inp6 = NULL;
+# endif
+# if SOLARIS
+ ill_t *ill = ifptr;
+# else
+ struct ifnet *ifp = ifptr;
+# endif
+ struct in_addr in;
+
+# if SOLARIS
+# ifdef USE_INET6
+ if (v == 6) {
+ struct in6_addr in6;
+
+ /*
+ * First is always link local.
+ */
+ if (ill->ill_ipif->ipif_next)
+ in6 = ill->ill_ipif->ipif_next->ipif_v6lcl_addr;
+ else
+ bzero((char *)&in6, sizeof(in6));
+ bcopy((char *)&in6, (char *)inp, sizeof(in6));
+ } else
+# endif
+ {
+ in.s_addr = ill->ill_ipif->ipif_local_addr;
+ *inp = in;
+ }
+# else /* SOLARIS */
+# if linux
+ ;
+# else /* linux */
+ struct sockaddr_in *sin;
+ struct ifaddr *ifa;
+
+# if (__FreeBSD_version >= 300000)
+ ifa = TAILQ_FIRST(&ifp->if_addrhead);
+# else
+# if defined(__NetBSD__) || defined(__OpenBSD__)
+ ifa = ifp->if_addrlist.tqh_first;
+# else
+# if defined(__sgi) && defined(IFF_DRVRLOCK) /* IRIX 6 */
+ ifa = &((struct in_ifaddr *)ifp->in_ifaddr)->ia_ifa;
+# else
+ ifa = ifp->if_addrlist;
+# endif
+# endif /* __NetBSD__ || __OpenBSD__ */
+# endif /* __FreeBSD_version >= 300000 */
+# if (BSD < 199306) && !(/*IRIX6*/defined(__sgi) && defined(IFF_DRVRLOCK))
+ sin = (struct sockaddr_in *)&ifa->ifa_addr;
+# else
+ sin = (struct sockaddr_in *)ifa->ifa_addr;
+ while (sin && ifa) {
+ if ((v == 4) && (sin->sin_family == AF_INET))
+ break;
+# ifdef USE_INET6
+ if ((v == 6) && (sin->sin_family == AF_INET6)) {
+ inp6 = &((struct sockaddr_in6 *)sin)->sin6_addr;
+ if (!IN6_IS_ADDR_LINKLOCAL(inp6) &&
+ !IN6_IS_ADDR_LOOPBACK(inp6))
+ break;
}
- if (flags & FR_INQUE) {
- (void) frflushlist(set, unit, &flushed,
- ipfilter[0][set],
- &ipfilter[0][set]);
- (void) frflushlist(set, unit, &flushed,
- ipacct[0][set], &ipacct[0][set]);
+# endif
+# if (__FreeBSD_version >= 300000)
+ ifa = TAILQ_NEXT(ifa, ifa_link);
+# else
+# if defined(__NetBSD__) || defined(__OpenBSD__)
+ ifa = ifa->ifa_list.tqe_next;
+# else
+ ifa = ifa->ifa_next;
+# endif
+# endif /* __FreeBSD_version >= 300000 */
+ if (ifa)
+ sin = (struct sockaddr_in *)ifa->ifa_addr;
+ }
+ if (ifa == NULL)
+ sin = NULL;
+ if (sin == NULL)
+ return -1;
+# endif /* (BSD < 199306) && (!__sgi && IFF_DRVLOCK) */
+# ifdef USE_INET6
+ if (v == 6)
+ bcopy((char *)inp6, (char *)inp, sizeof(*inp6));
+ else
+# endif
+ {
+ in = sin->sin_addr;
+ *inp = in;
+ }
+# endif /* linux */
+# endif /* SOLARIS */
+ return 0;
+}
+
+
+static void frsynclist(fr)
+register frentry_t *fr;
+{
+ for (; fr; fr = fr->fr_next) {
+ if (fr->fr_ifa != NULL) {
+ fr->fr_ifa = GETUNIT(fr->fr_ifname, fr->fr_ip.fi_v);
+ if (fr->fr_ifa == NULL)
+ fr->fr_ifa = (void *)-1;
}
+ if (fr->fr_grp)
+ frsynclist(fr->fr_grp);
+ }
+}
+
+
+void frsync()
+{
+# if !SOLARIS
+ register struct ifnet *ifp;
+
+# if defined(__OpenBSD__) || ((NetBSD >= 199511) && (NetBSD < 1991011)) || \
+ (defined(__FreeBSD_version) && (__FreeBSD_version >= 300000))
+# if (NetBSD >= 199905) || defined(__OpenBSD__)
+ for (ifp = ifnet.tqh_first; ifp; ifp = ifp->if_list.tqe_next)
+# else
+ for (ifp = ifnet.tqh_first; ifp; ifp = ifp->if_link.tqe_next)
+# endif
+# else
+ for (ifp = ifnet; ifp; ifp = ifp->if_next)
+# endif
+ {
+ ip_natsync(ifp);
+ ip_statesync(ifp);
+ }
+# endif
+
+ WRITE_ENTER(&ipf_mutex);
+ frsynclist(ipacct[0][fr_active]);
+ frsynclist(ipacct[1][fr_active]);
+ frsynclist(ipfilter[0][fr_active]);
+ frsynclist(ipfilter[1][fr_active]);
+#ifdef USE_INET6
+ frsynclist(ipacct6[0][fr_active]);
+ frsynclist(ipacct6[1][fr_active]);
+ frsynclist(ipfilter6[0][fr_active]);
+ frsynclist(ipfilter6[1][fr_active]);
+#endif
+ RWLOCK_EXIT(&ipf_mutex);
+}
+
+
+/*
+ * In the functions below, bcopy() is called because the pointer being
+ * copied _from_ in this instance is a pointer to a char buf (which could
+ * end up being unaligned) and on the kernel's local stack.
+ */
+int ircopyptr(a, b, c)
+void *a, *b;
+size_t c;
+{
+ caddr_t ca;
+ int err;
+
+#if SOLARIS
+ copyin(a, &ca, sizeof(ca));
+#else
+ bcopy(a, &ca, sizeof(ca));
+#endif
+ err = copyin(ca, b, c);
+ return err;
+}
+
+
+int iwcopyptr(a, b, c)
+void *a, *b;
+size_t c;
+{
+ caddr_t ca;
+ int err;
+
+#if SOLARIS
+ copyin(b, &ca, sizeof(ca));
+#else
+ bcopy(b, &ca, sizeof(ca));
+#endif
+ err = copyout(a, ca, c);
+ return err;
+}
+
+#else /* _KERNEL */
+
+
+/*
+ * return the first IP Address associated with an interface
+ */
+int fr_ifpaddr(v, ifptr, inp)
+int v;
+void *ifptr;
+struct in_addr *inp;
+{
+ return 0;
+}
+
+
+int ircopyptr(a, b, c)
+void *a, *b;
+size_t c;
+{
+ caddr_t ca;
+
+ bcopy(a, &ca, sizeof(ca));
+ bcopy(ca, b, c);
+ return 0;
+}
+
+
+int iwcopyptr(a, b, c)
+void *a, *b;
+size_t c;
+{
+ caddr_t ca;
+
+ bcopy(b, &ca, sizeof(ca));
+ bcopy(a, ca, c);
+ return 0;
+}
+
+
+#endif
+
+
+int fr_lock(data, lockp)
+caddr_t data;
+int *lockp;
+{
+ int arg, error;
+
+ error = IRCOPY(data, (caddr_t)&arg, sizeof(arg));
+ if (!error) {
+ error = IWCOPY((caddr_t)lockp, data, sizeof(*lockp));
+ if (!error)
+ *lockp = arg;
}
+ return error;
+}
- *result = flushed;
+
+void fr_getstat(fiop)
+friostat_t *fiop;
+{
+ bcopy((char *)frstats, (char *)fiop->f_st, sizeof(filterstats_t) * 2);
+ fiop->f_locks[0] = fr_state_lock;
+ fiop->f_locks[1] = fr_nat_lock;
+ fiop->f_locks[2] = fr_frag_lock;
+ fiop->f_locks[3] = fr_auth_lock;
+ fiop->f_fin[0] = ipfilter[0][0];
+ fiop->f_fin[1] = ipfilter[0][1];
+ fiop->f_fout[0] = ipfilter[1][0];
+ fiop->f_fout[1] = ipfilter[1][1];
+ fiop->f_acctin[0] = ipacct[0][0];
+ fiop->f_acctin[1] = ipacct[0][1];
+ fiop->f_acctout[0] = ipacct[1][0];
+ fiop->f_acctout[1] = ipacct[1][1];
+#ifdef USE_INET6
+ fiop->f_fin6[0] = ipfilter6[0][0];
+ fiop->f_fin6[1] = ipfilter6[0][1];
+ fiop->f_fout6[0] = ipfilter6[1][0];
+ fiop->f_fout6[1] = ipfilter6[1][1];
+ fiop->f_acctin6[0] = ipacct6[0][0];
+ fiop->f_acctin6[1] = ipacct6[0][1];
+ fiop->f_acctout6[0] = ipacct6[1][0];
+ fiop->f_acctout6[1] = ipacct6[1][1];
+#endif
+ fiop->f_active = fr_active;
+ fiop->f_froute[0] = ipl_frouteok[0];
+ fiop->f_froute[1] = ipl_frouteok[1];
+
+ fiop->f_running = fr_running;
+ fiop->f_groups[0][0] = ipfgroups[0][0];
+ fiop->f_groups[0][1] = ipfgroups[0][1];
+ fiop->f_groups[1][0] = ipfgroups[1][0];
+ fiop->f_groups[1][1] = ipfgroups[1][1];
+ fiop->f_groups[2][0] = ipfgroups[2][0];
+ fiop->f_groups[2][1] = ipfgroups[2][1];
+#ifdef IPFILTER_LOG
+ fiop->f_logging = 1;
+#else
+ fiop->f_logging = 0;
+#endif
+ fiop->f_defpass = fr_pass;
+ strncpy(fiop->f_version, ipfilter_version, sizeof(fiop->f_version));
}
+
+
+#ifdef USE_INET6
+int icmptoicmp6types[ICMP_MAXTYPE+1] = {
+ ICMP6_ECHO_REPLY, /* 0: ICMP_ECHOREPLY */
+ -1, /* 1: UNUSED */
+ -1, /* 2: UNUSED */
+ ICMP6_DST_UNREACH, /* 3: ICMP_UNREACH */
+ -1, /* 4: ICMP_SOURCEQUENCH */
+ ND_REDIRECT, /* 5: ICMP_REDIRECT */
+ -1, /* 6: UNUSED */
+ -1, /* 7: UNUSED */
+ ICMP6_ECHO_REQUEST, /* 8: ICMP_ECHO */
+ -1, /* 9: UNUSED */
+ -1, /* 10: UNUSED */
+ ICMP6_TIME_EXCEEDED, /* 11: ICMP_TIMXCEED */
+ ICMP6_PARAM_PROB, /* 12: ICMP_PARAMPROB */
+ -1, /* 13: ICMP_TSTAMP */
+ -1, /* 14: ICMP_TSTAMPREPLY */
+ -1, /* 15: ICMP_IREQ */
+ -1, /* 16: ICMP_IREQREPLY */
+ -1, /* 17: ICMP_MASKREQ */
+ -1, /* 18: ICMP_MASKREPLY */
+};
+
+
+int icmptoicmp6unreach[ICMP_MAX_UNREACH] = {
+ ICMP6_DST_UNREACH_ADDR, /* 0: ICMP_UNREACH_NET */
+ ICMP6_DST_UNREACH_ADDR, /* 1: ICMP_UNREACH_HOST */
+ -1, /* 2: ICMP_UNREACH_PROTOCOL */
+ ICMP6_DST_UNREACH_NOPORT, /* 3: ICMP_UNREACH_PORT */
+ -1, /* 4: ICMP_UNREACH_NEEDFRAG */
+ ICMP6_DST_UNREACH_NOTNEIGHBOR, /* 5: ICMP_UNREACH_SRCFAIL */
+ ICMP6_DST_UNREACH_ADDR, /* 6: ICMP_UNREACH_NET_UNKNOWN */
+ ICMP6_DST_UNREACH_ADDR, /* 7: ICMP_UNREACH_HOST_UNKNOWN */
+ -1, /* 8: ICMP_UNREACH_ISOLATED */
+ ICMP6_DST_UNREACH_ADMIN, /* 9: ICMP_UNREACH_NET_PROHIB */
+ ICMP6_DST_UNREACH_ADMIN, /* 10: ICMP_UNREACH_HOST_PROHIB */
+ -1, /* 11: ICMP_UNREACH_TOSNET */
+ -1, /* 12: ICMP_UNREACH_TOSHOST */
+ ICMP6_DST_UNREACH_ADMIN, /* 13: ICMP_UNREACH_ADMIN_PROHIBIT */
+};
+#endif
diff --git a/sys/netinet/ip_auth.c b/sys/netinet/ip_auth.c
index bdb3114f88bf..78aff43e3faf 100644
--- a/sys/netinet/ip_auth.c
+++ b/sys/netinet/ip_auth.c
@@ -1,24 +1,25 @@
/*
- * Copyright (C) 1997 by Darren Reed & Guido van Rooij.
+ * Copyright (C) 1998-2000 by Darren Reed & Guido van Rooij.
*
* Redistribution and use in source and binary forms are permitted
* provided that this notice is preserved and due credit is given
* to the original author and the contributors.
*/
#if !defined(lint)
-static const char rcsid[] = "@(#)$Id: ip_auth.c,v 2.0.2.21.2.3 1998/04/08 13:43:29 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ip_auth.c,v 2.11.2.2 2000/05/22 10:26:11 darrenr Exp $";
#endif
-#if !defined(_KERNEL) && !defined(KERNEL)
-# include <stdlib.h>
-# include <string.h>
-#endif
#include <sys/errno.h>
#include <sys/types.h>
#include <sys/param.h>
#include <sys/time.h>
#include <sys/file.h>
-#if defined(KERNEL) && (__FreeBSD_version >= 220000)
+#if !defined(_KERNEL) && !defined(KERNEL)
+# include <stdio.h>
+# include <stdlib.h>
+# include <string.h>
+#endif
+#if (defined(KERNEL) || defined(_KERNEL)) && (__FreeBSD_version >= 220000)
# include <sys/filio.h>
# include <sys/fcntl.h>
#else
@@ -29,7 +30,7 @@ static const char rcsid[] = "@(#)$Id: ip_auth.c,v 2.0.2.21.2.3 1998/04/08 13:43:
# include <sys/protosw.h>
#endif
#include <sys/socket.h>
-#if defined(_KERNEL) && !defined(linux)
+#if (defined(_KERNEL) || defined(KERNEL)) && !defined(linux)
# include <sys/systm.h>
#endif
#if !defined(__SVR4) && !defined(__svr4__)
@@ -39,34 +40,39 @@ static const char rcsid[] = "@(#)$Id: ip_auth.c,v 2.0.2.21.2.3 1998/04/08 13:43:
#else
# include <sys/filio.h>
# include <sys/byteorder.h>
-# include <sys/dditypes.h>
+# ifdef _KERNEL
+# include <sys/dditypes.h>
+# endif
# include <sys/stream.h>
# include <sys/kmem.h>
#endif
+#if _BSDI_VERSION >= 199802
+# include <sys/queue.h>
+#endif
#if defined(__NetBSD__) || defined(__OpenBSD__) || defined(bsdi)
# include <machine/cpu.h>
#endif
#include <net/if.h>
#ifdef sun
-#include <net/af.h>
+# include <net/af.h>
#endif
#include <net/route.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#ifndef KERNEL
-#define KERNEL
-#define NOT_KERNEL
+# define KERNEL
+# define NOT_KERNEL
#endif
#ifndef linux
# include <netinet/ip_var.h>
#endif
#ifdef NOT_KERNEL
-#undef KERNEL
+# undef KERNEL
#endif
#ifdef __sgi
# ifdef IFF_DRVRLOCK /* IRIX6 */
-#include <sys/hashing.h>
+# include <sys/hashing.h>
# endif
#endif
#include <netinet/tcp.h>
@@ -74,6 +80,9 @@ static const char rcsid[] = "@(#)$Id: ip_auth.c,v 2.0.2.21.2.3 1998/04/08 13:43:
extern struct ifqueue ipintrq; /* ip packet input queue */
#else
# ifndef linux
+# if __FreeBSD_version >= 300000
+# include <net/if_var.h>
+# endif
# include <netinet/in_var.h>
# include <netinet/tcp_fsm.h>
# endif
@@ -90,10 +99,19 @@ extern struct ifqueue ipintrq; /* ip packet input queue */
# include <machine/cpufunc.h>
# endif
#endif
+#if (__FreeBSD_version >= 300000)
+# include <sys/malloc.h>
+# if (defined(_KERNEL) || defined(KERNEL)) && !defined(IPFILTER_LKM)
+# include <sys/libkern.h>
+# include <sys/systm.h>
+# endif
+#endif
+
#if (SOLARIS || defined(__sgi)) && defined(_KERNEL)
-extern kmutex_t ipf_auth;
+extern KRWLOCK_T ipf_auth;
+extern kmutex_t ipf_authmx;
# if SOLARIS
extern kcondvar_t ipfauthwait;
# endif
@@ -105,11 +123,12 @@ static struct wait_queue *ipfauthwait = NULL;
int fr_authsize = FR_NUMAUTH;
int fr_authused = 0;
int fr_defaultauthage = 600;
+int fr_auth_lock = 0;
fr_authstat_t fr_authstats;
-frauth_t fr_auth[FR_NUMAUTH];
+static frauth_t fr_auth[FR_NUMAUTH];
mb_t *fr_authpkts[FR_NUMAUTH];
-int fr_authstart = 0, fr_authend = 0, fr_authnext = 0;
-frauthent_t *fae_list = NULL;
+static int fr_authstart = 0, fr_authend = 0, fr_authnext = 0;
+static frauthent_t *fae_list = NULL;
frentry_t *ipauth = NULL;
@@ -118,7 +137,7 @@ frentry_t *ipauth = NULL;
* authorization result and that would result in a feedback loop (i.e. it
* will end up returning FR_AUTH) then return FR_BLOCK instead.
*/
-int fr_checkauth(ip, fin)
+u_32_t fr_checkauth(ip, fin)
ip_t *ip;
fr_info_t *fin;
{
@@ -126,7 +145,10 @@ fr_info_t *fin;
u_32_t pass;
int i;
- MUTEX_ENTER(&ipf_auth);
+ if (fr_auth_lock)
+ return 0;
+
+ READ_ENTER(&ipf_auth);
for (i = fr_authstart; i != fr_authend; ) {
/*
* index becomes -2 only after an SIOCAUTHW. Check this in
@@ -141,6 +163,8 @@ fr_info_t *fin;
*/
if (!(pass = fr_auth[i].fra_pass) || (pass & FR_AUTH))
pass = FR_BLOCK;
+ RWLOCK_EXIT(&ipf_auth);
+ WRITE_ENTER(&ipf_auth);
fr_authstats.fas_hits++;
fr_auth[i].fra_index = -1;
fr_authused--;
@@ -158,7 +182,7 @@ fr_info_t *fin;
fr_authstart = fr_authend = 0;
}
}
- MUTEX_EXIT(&ipf_auth);
+ RWLOCK_EXIT(&ipf_auth);
return pass;
}
i++;
@@ -166,7 +190,7 @@ fr_info_t *fin;
i = 0;
}
fr_authstats.fas_miss++;
- MUTEX_EXIT(&ipf_auth);
+ RWLOCK_EXIT(&ipf_auth);
return 0;
}
@@ -176,29 +200,30 @@ fr_info_t *fin;
* If we do, store it and wake up any user programs which are waiting to
* hear about these events.
*/
-int fr_newauth(m, fin, ip
-#if defined(_KERNEL) && SOLARIS
-, qif)
-qif_t *qif;
-#else
-)
-#endif
+int fr_newauth(m, fin, ip)
mb_t *m;
fr_info_t *fin;
ip_t *ip;
{
+#if defined(_KERNEL) && SOLARIS
+ qif_t *qif = fin->fin_qif;
+#endif
int i;
- MUTEX_ENTER(&ipf_auth);
- if ((fr_authstart > fr_authend) && (fr_authstart - fr_authend == -1)) {
- fr_authstats.fas_nospace++;
- MUTEX_EXIT(&ipf_auth);
+ if (fr_auth_lock)
return 0;
- }
- if (fr_authend - fr_authstart == FR_NUMAUTH - 1) {
+
+ WRITE_ENTER(&ipf_auth);
+ if (fr_authstart > fr_authend) {
fr_authstats.fas_nospace++;
- MUTEX_EXIT(&ipf_auth);
+ RWLOCK_EXIT(&ipf_auth);
return 0;
+ } else {
+ if ((fr_authstart == 0) && (fr_authend == FR_NUMAUTH - 1)) {
+ fr_authstats.fas_nospace++;
+ RWLOCK_EXIT(&ipf_auth);
+ return 0;
+ }
}
fr_authstats.fas_added++;
@@ -206,7 +231,7 @@ ip_t *ip;
i = fr_authend++;
if (fr_authend == FR_NUMAUTH)
fr_authend = 0;
- MUTEX_EXIT(&ipf_auth);
+ RWLOCK_EXIT(&ipf_auth);
fr_auth[i].fra_index = i;
fr_auth[i].fra_pass = 0;
fr_auth[i].fra_age = fr_defaultauthage;
@@ -217,14 +242,15 @@ ip_t *ip;
* them.
*/
# if SOLARIS && defined(_KERNEL)
- if (ip == (ip_t *)m->b_rptr)
+ if ((ip == (ip_t *)m->b_rptr) && (ip->ip_v == 4))
# endif
{
register u_short bo;
bo = ip->ip_len;
ip->ip_len = htons(bo);
-# if !SOLARIS /* 4.4BSD converts this ip_input.c, but I don't in solaris.c */
+# if !SOLARIS && !defined(__NetBSD__)
+ /* 4.4BSD converts this ip_input.c, but I don't in solaris.c */
bo = ip->ip_id;
ip->ip_id = htons(bo);
# endif
@@ -251,7 +277,7 @@ ip_t *ip;
int fr_auth_ioctl(data, cmd, fr, frptr)
caddr_t data;
-#if defined(__NetBSD__) || defined(__OpenBSD__)
+#if defined(__NetBSD__) || defined(__OpenBSD__) || (FreeBSD_version >= 300003)
u_long cmd;
#else
int cmd;
@@ -259,11 +285,8 @@ int cmd;
frentry_t *fr, **frptr;
{
mb_t *m;
-#if defined(_KERNEL)
-# if !SOLARIS
+#if defined(_KERNEL) && !SOLARIS
struct ifqueue *ifq;
- int s;
-# endif
#endif
frauth_t auth, *au = &auth;
frauthent_t *fae, **faep;
@@ -271,12 +294,17 @@ frentry_t *fr, **frptr;
switch (cmd)
{
+ case SIOCSTLCK :
+ error = fr_lock(data, &fr_auth_lock);
+ break;
case SIOCINIFR :
case SIOCRMIFR :
case SIOCADIFR :
error = EINVAL;
break;
case SIOCINAFR :
+ error = EINVAL;
+ break;
case SIOCRMAFR :
case SIOCADAFR :
for (faep = &fae_list; (fae = *faep); )
@@ -288,46 +316,61 @@ frentry_t *fr, **frptr;
if (!fae)
error = ESRCH;
else {
+ WRITE_ENTER(&ipf_auth);
*faep = fae->fae_next;
*frptr = fr->fr_next;
+ RWLOCK_EXIT(&ipf_auth);
KFREE(fae);
}
} else {
- KMALLOC(fae, frauthent_t *, sizeof(*fae));
+ KMALLOC(fae, frauthent_t *);
if (fae != NULL) {
- IRCOPY((char *)data, (char *)&fae->fae_fr,
- sizeof(fae->fae_fr));
- if (!fae->fae_age)
- fae->fae_age = fr_defaultauthage;
+ bcopy((char *)fr, (char *)&fae->fae_fr,
+ sizeof(*fr));
+ WRITE_ENTER(&ipf_auth);
+ fae->fae_age = fr_defaultauthage;
fae->fae_fr.fr_hits = 0;
fae->fae_fr.fr_next = *frptr;
*frptr = &fae->fae_fr;
fae->fae_next = *faep;
*faep = fae;
+ ipauth = &fae_list->fae_fr;
+ RWLOCK_EXIT(&ipf_auth);
} else
error = ENOMEM;
}
break;
case SIOCATHST:
- IWCOPY((char *)&fr_authstats, data, sizeof(fr_authstats));
+ READ_ENTER(&ipf_auth);
+ fr_authstats.fas_faelist = fae_list;
+ RWLOCK_EXIT(&ipf_auth);
+ error = IWCOPYPTR((char *)&fr_authstats, data,
+ sizeof(fr_authstats));
break;
case SIOCAUTHW:
fr_authioctlloop:
- MUTEX_ENTER(&ipf_auth);
+ READ_ENTER(&ipf_auth);
if ((fr_authnext != fr_authend) && fr_authpkts[fr_authnext]) {
- IWCOPY((char *)&fr_auth[fr_authnext++], data,
- sizeof(fr_info_t));
+ error = IWCOPYPTR((char *)&fr_auth[fr_authnext], data,
+ sizeof(fr_info_t));
+ RWLOCK_EXIT(&ipf_auth);
+ if (error)
+ break;
+ WRITE_ENTER(&ipf_auth);
+ fr_authnext++;
if (fr_authnext == FR_NUMAUTH)
fr_authnext = 0;
- MUTEX_EXIT(&ipf_auth);
+ RWLOCK_EXIT(&ipf_auth);
return 0;
}
#ifdef _KERNEL
# if SOLARIS
- if (!cv_wait_sig(&ipfauthwait, &ipf_auth)) {
- mutex_exit(&ipf_auth);
+ mutex_enter(&ipf_authmx);
+ if (!cv_wait_sig(&ipfauthwait, &ipf_authmx)) {
+ mutex_exit(&ipf_authmx);
return EINTR;
}
+ mutex_exit(&ipf_authmx);
# else
# ifdef linux
interruptible_sleep_on(&ipfauthwait);
@@ -338,17 +381,19 @@ fr_authioctlloop:
# endif
# endif
#endif
- MUTEX_EXIT(&ipf_auth);
+ RWLOCK_EXIT(&ipf_auth);
if (!error)
goto fr_authioctlloop;
break;
case SIOCAUTHR:
- IRCOPY(data, (caddr_t)&auth, sizeof(auth));
- MUTEX_ENTER(&ipf_auth);
+ error = IRCOPYPTR(data, (caddr_t)&auth, sizeof(auth));
+ if (error)
+ return error;
+ WRITE_ENTER(&ipf_auth);
i = au->fra_index;
if ((i < 0) || (i > FR_NUMAUTH) ||
(fr_auth[i].fra_info.fin_id != au->fra_info.fin_id)) {
- MUTEX_EXIT(&ipf_auth);
+ RWLOCK_EXIT(&ipf_auth);
return EINVAL;
}
m = fr_authpkts[i];
@@ -356,14 +401,18 @@ fr_authioctlloop:
fr_auth[i].fra_pass = au->fra_pass;
fr_authpkts[i] = NULL;
#ifdef _KERNEL
- MUTEX_EXIT(&ipf_auth);
- SPL_NET(s);
+ RWLOCK_EXIT(&ipf_auth);
# ifndef linux
if (m && au->fra_info.fin_out) {
# if SOLARIS
error = fr_qout(fr_auth[i].fra_q, m);
# else /* SOLARIS */
+# if (_BSDI_VERSION >= 199802) || defined(__OpenBSD__)
+ error = ip_output(m, NULL, NULL, IP_FORWARDING, NULL,
+ NULL);
+# else
error = ip_output(m, NULL, NULL, IP_FORWARDING, NULL);
+# endif
# endif /* SOLARIS */
if (error)
fr_authstats.fas_sendfail++;
@@ -418,7 +467,6 @@ fr_authioctlloop:
}
}
# endif
- SPL_X(s);
#endif /* _KERNEL */
break;
default :
@@ -439,7 +487,7 @@ void fr_authunload()
register frauthent_t *fae, **faep;
mb_t *m;
- MUTEX_ENTER(&ipf_auth);
+ WRITE_ENTER(&ipf_auth);
for (i = 0; i < FR_NUMAUTH; i++) {
if ((m = fr_authpkts[i])) {
FREE_MB_T(m);
@@ -453,7 +501,8 @@ void fr_authunload()
*faep = fae->fae_next;
KFREE(fae);
}
- MUTEX_EXIT(&ipf_auth);
+ ipauth = NULL;
+ RWLOCK_EXIT(&ipf_auth);
}
@@ -471,8 +520,11 @@ void fr_authexpire()
int s;
#endif
+ if (fr_auth_lock)
+ return;
+
SPL_NET(s);
- MUTEX_ENTER(&ipf_auth);
+ WRITE_ENTER(&ipf_auth);
for (i = 0, fra = fr_auth; i < FR_NUMAUTH; i++, fra++) {
if ((!--fra->fra_age) && (m = fr_authpkts[i])) {
FREE_MB_T(m);
@@ -484,14 +536,15 @@ void fr_authexpire()
}
for (faep = &fae_list; (fae = *faep); ) {
- if (!--fra->fra_age) {
+ if (!--fae->fae_age) {
*faep = fae->fae_next;
KFREE(fae);
fr_authstats.fas_expire++;
} else
faep = &fae->fae_next;
}
- MUTEX_EXIT(&ipf_auth);
+ ipauth = &fae_list->fae_fr;
+ RWLOCK_EXIT(&ipf_auth);
SPL_X(s);
}
#endif
diff --git a/sys/netinet/ip_auth.h b/sys/netinet/ip_auth.h
index 06f7cf6f00ec..b54331887e3f 100644
--- a/sys/netinet/ip_auth.h
+++ b/sys/netinet/ip_auth.h
@@ -1,11 +1,11 @@
/*
- * Copyright (C) 1997 by Darren Reed & Guido Van Rooij.
+ * Copyright (C) 1997-2000 by Darren Reed & Guido Van Rooij.
*
* Redistribution and use in source and binary forms are permitted
* provided that this notice is preserved and due credit is given
* to the original author and the contributors.
*
- * $Id: ip_auth.h,v 2.0.2.10 1997/10/29 12:14:07 darrenr Exp $
+ * $Id: ip_auth.h,v 2.3.2.1 2000/05/22 10:26:11 darrenr Exp $
*
*/
#ifndef __IP_AUTH_H__
@@ -13,18 +13,6 @@
#define FR_NUMAUTH 32
-typedef struct fr_authstat {
- U_QUAD_T fas_hits;
- U_QUAD_T fas_miss;
- u_long fas_nospace;
- u_long fas_added;
- u_long fas_sendfail;
- u_long fas_sendok;
- u_long fas_queok;
- u_long fas_quefail;
- u_long fas_expire;
-} fr_authstat_t;
-
typedef struct frauth {
int fra_age;
int fra_index;
@@ -41,6 +29,19 @@ typedef struct frauthent {
u_long fae_age;
} frauthent_t;
+typedef struct fr_authstat {
+ U_QUAD_T fas_hits;
+ U_QUAD_T fas_miss;
+ u_long fas_nospace;
+ u_long fas_added;
+ u_long fas_sendfail;
+ u_long fas_sendok;
+ u_long fas_queok;
+ u_long fas_quefail;
+ u_long fas_expire;
+ frauthent_t *fas_faelist;
+} fr_authstat_t;
+
extern frentry_t *ipauth;
extern struct fr_authstat fr_authstats;
@@ -49,15 +50,12 @@ extern int fr_authstart;
extern int fr_authend;
extern int fr_authsize;
extern int fr_authused;
-extern int fr_checkauth __P((ip_t *, fr_info_t *));
+extern int fr_auth_lock;
+extern u_32_t fr_checkauth __P((ip_t *, fr_info_t *));
extern void fr_authexpire __P((void));
extern void fr_authunload __P((void));
extern mb_t *fr_authpkts[];
-#if defined(_KERNEL) && SOLARIS
-extern int fr_newauth __P((mb_t *, fr_info_t *, ip_t *, qif_t *));
-#else
extern int fr_newauth __P((mb_t *, fr_info_t *, ip_t *));
-#endif
#if defined(__NetBSD__) || defined(__OpenBSD__)
extern int fr_auth_ioctl __P((caddr_t, u_long, frentry_t *, frentry_t **));
#else
diff --git a/sys/netinet/ip_compat.h b/sys/netinet/ip_compat.h
index 1f91cf3c949b..9b7cddfaf4bd 100644
--- a/sys/netinet/ip_compat.h
+++ b/sys/netinet/ip_compat.h
@@ -1,12 +1,12 @@
/*
- * Copyright (C) 1993-1997 by Darren Reed.
+ * Copyright (C) 1993-2000 by Darren Reed.
*
* Redistribution and use in source and binary forms are permitted
* provided that this notice is preserved and due credit is given
* to the original author and the contributors.
*
* @(#)ip_compat.h 1.8 1/14/96
- * $Id: ip_compat.h,v 2.0.2.31.2.11 1998/05/23 14:29:36 darrenr Exp $
+ * $Id: ip_compat.h,v 2.26.2.3 2000/04/28 14:56:49 darrenr Exp $
*/
#ifndef __IP_COMPAT_H__
@@ -17,33 +17,44 @@
# define __P(x) x
# else
# define __P(x) ()
-# define const
# endif
#endif
+#ifndef __STDC__
+# undef const
+# define const
+#endif
#ifndef SOLARIS
#define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4)))
#endif
+#if SOLARIS2 >= 8
+# ifndef USE_INET6
+# define USE_INET6
+# endif
+#endif
-#if defined(_KERNEL) && !defined(KERNEL)
+#if defined(_KERNEL) || defined(KERNEL) || defined(__KERNEL__)
+# undef KERNEL
+# undef _KERNEL
+# undef __KERNEL__
# define KERNEL
-#endif
-#if defined(KERNEL) && !defined(_KERNEL)
# define _KERNEL
-#endif
-#if!defined(__KERNEL__) && defined(KERNEL)
# define __KERNEL__
#endif
#if defined(__SVR4) || defined(__svr4__) || defined(__sgi)
#define index strchr
-# if !defined(_KERNEL)
+# if !defined(KERNEL)
# define bzero(a,b) memset(a,0,b)
# define bcmp memcmp
# define bcopy(a,b,c) memmove(b,a,c)
# endif
#endif
+#ifndef offsetof
+#define offsetof(t,m) (int)((&((t *)0L)->m))
+#endif
+
#if defined(__sgi) || defined(bsdi)
struct ether_addr {
u_char ether_addr_octet[6];
@@ -69,6 +80,7 @@ struct ether_addr {
#endif
#if SOLARIS
# define MTYPE(m) ((m)->b_datap->db_type)
+# include <sys/isa_defs.h>
# include <sys/ioccom.h>
# include <sys/sysmacros.h>
# include <sys/kmem.h>
@@ -80,18 +92,37 @@ struct ether_addr {
# undef IPOPT_LSRR
# undef IPOPT_RR
# undef IPOPT_SSRR
-# ifndef _KERNEL
+# ifndef KERNEL
# define _KERNEL
# undef RES_INIT
+# if SOLARIS2 >= 8
+# include <netinet/ip6.h>
+# endif
# include <inet/common.h>
# include <inet/ip.h>
# include <inet/ip_ire.h>
# undef _KERNEL
# else /* _KERNEL */
+# if SOLARIS2 >= 8
+# include <netinet/ip6.h>
+# endif
# include <inet/common.h>
# include <inet/ip.h>
# include <inet/ip_ire.h>
# endif /* _KERNEL */
+# if SOLARIS2 >= 8
+# include <inet/ip_if.h>
+# include <netinet/ip6.h>
+# define ipif_local_addr ipif_lcl_addr
+/* Only defined in private include file */
+# ifndef V4_PART_OF_V6
+# define V4_PART_OF_V6(v6) v6.s6_addr32[3]
+# endif
+# endif
+#else
+# if !defined(__sgi)
+typedef int minor_t;
+#endif
#endif /* SOLARIS */
#define IPMINLEN(i, h) ((i)->ip_len >= ((i)->ip_hl * 4 + sizeof(struct h)))
@@ -108,23 +139,64 @@ struct ether_addr {
# define QUAD_T long
#endif /* BSD > 199306 */
+
/*
* These operating systems already take care of the problem for us.
*/
#if defined(__NetBSD__) || defined(__OpenBSD__) || defined(__FreeBSD__) || \
defined(__sgi)
typedef u_int32_t u_32_t;
+# if defined(_KERNEL) && !defined(IPFILTER_LKM)
+# if defined(__NetBSD_Version__) && (__NetBSD_Version__ >= 104110000)
+# include "opt_inet.h"
+# endif
+# if defined(__FreeBSD_version) && (__FreeBSD_version >= 400000) && \
+ !defined(KLD_MODULE)
+# include "opt_inet6.h"
+# endif
+# ifdef INET6
+# define USE_INET6
+# endif
+# endif
#else
/*
* Really, any arch where sizeof(long) != sizeof(int).
*/
-# if defined(__alpha__) || defined(__alpha)
+# if defined(__alpha__) || defined(__alpha) || defined(_LP64)
typedef unsigned int u_32_t;
# else
-typedef unsigned long u_32_t;
+# if SOLARIS2 >= 6
+typedef uint32_t u_32_t;
+# else
+typedef unsigned int u_32_t;
+# endif
# endif
#endif /* __NetBSD__ || __OpenBSD__ || __FreeBSD__ || __sgi */
+#ifdef USE_INET6
+# if defined(__NetBSD__) || defined(__OpenBSD__) || defined(__FreeBSD__)
+# include <netinet/ip6.h>
+# ifdef _KERNEL
+# include <netinet6/ip6_var.h>
+# endif
+typedef struct ip6_hdr ip6_t;
+# endif
+union i6addr {
+ u_32_t i6[4];
+ struct in_addr in4;
+ struct in6_addr in6;
+};
+#else
+union i6addr {
+ u_32_t i6[4];
+ struct in_addr in4;
+};
+#endif
+
+#define IP6CMP(a,b) bcmp((char *)&(a), (char *)&(b), sizeof(a))
+#define IP6EQ(a,b) (bcmp((char *)&(a), (char *)&(b), sizeof(a)) == 0)
+#define IP6NEQ(a,b) (bcmp((char *)&(a), (char *)&(b), sizeof(a)) != 0)
+
#ifndef MAX
#define MAX(a,b) (((a) > (b)) ? (a) : (b))
#endif
@@ -186,12 +258,15 @@ typedef unsigned long u_32_t;
#define IPOPT_FINN 205 /* FINN */
-#if defined(__FreeBSD__) && defined(KERNEL)
+#if defined(__FreeBSD__) && (defined(KERNEL) || defined(_KERNEL))
# if __FreeBSD__ < 3
# include <machine/spl.h>
-# endif
-# if defined(IPFILTER_LKM) && !defined(ACTUALLY_LKM_NOT_KERNEL)
-# define ACTUALLY_LKM_NOT_KERNEL
+# else
+# if __FreeBSD__ == 3
+# if defined(IPFILTER_LKM) && !defined(ACTUALLY_LKM_NOT_KERNEL)
+# define ACTUALLY_LKM_NOT_KERNEL
+# endif
+# endif
# endif
#endif /* __FreeBSD__ && KERNEL */
@@ -199,13 +274,69 @@ typedef unsigned long u_32_t;
* Build some macros and #defines to enable the same code to compile anywhere
* Well, that's the idea, anyway :-)
*/
+#if !SOLARIS || (SOLARIS2 < 6) || !defined(KERNEL)
+# define ATOMIC_INCL ATOMIC_INC
+# define ATOMIC_INC64 ATOMIC_INC
+# define ATOMIC_INC32 ATOMIC_INC
+# define ATOMIC_INC16 ATOMIC_INC
+# define ATOMIC_DECL ATOMIC_DEC
+# define ATOMIC_DEC64 ATOMIC_DEC
+# define ATOMIC_DEC32 ATOMIC_DEC
+# define ATOMIC_DEC16 ATOMIC_DEC
+#endif
#ifdef KERNEL
# if SOLARIS
-# define MUTEX_ENTER(x) mutex_enter(x)
+# if SOLARIS2 >= 6
+# include <sys/atomic.h>
+# if SOLARIS2 == 6
+# define ATOMIC_INCL(x) atomic_add_long((uint32_t*)&(x), 1)
+# define ATOMIC_DECL(x) atomic_add_long((uint32_t*)&(x), -1)
+# else
+# define ATOMIC_INCL(x) atomic_add_long(&(x), 1)
+# define ATOMIC_DECL(x) atomic_add_long(&(x), -1)
+# endif
+# define ATOMIC_INC64(x) atomic_add_64((uint64_t*)&(x), 1)
+# define ATOMIC_INC32(x) atomic_add_32((uint32_t*)&(x), 1)
+# define ATOMIC_INC16(x) atomic_add_16((uint16_t*)&(x), 1)
+# define ATOMIC_DEC64(x) atomic_add_64((uint64_t*)&(x), -1)
+# define ATOMIC_DEC32(x) atomic_add_32((uint32_t*)&(x), -1)
+# define ATOMIC_DEC16(x) atomic_add_16((uint16_t*)&(x), -1)
+# else
+# define ATOMIC_INC(x) { mutex_enter(&ipf_rw); (x)++; \
+ mutex_exit(&ipf_rw); }
+# define ATOMIC_DEC(x) { mutex_enter(&ipf_rw); (x)--; \
+ mutex_exit(&ipf_rw); }
+# endif
+# define MUTEX_ENTER(x) mutex_enter(x)
+# if 1
+# define KRWLOCK_T krwlock_t
+# define READ_ENTER(x) rw_enter(x, RW_READER)
+# define WRITE_ENTER(x) rw_enter(x, RW_WRITER)
+# define RW_UPGRADE(x) { if (rw_tryupgrade(x) == 0) { \
+ rw_exit(x); \
+ rw_enter(x, RW_WRITER); } \
+ }
+# define MUTEX_DOWNGRADE(x) rw_downgrade(x)
+# define RWLOCK_INIT(x, y, z) rw_init((x), (y), RW_DRIVER, (z))
+# define RWLOCK_EXIT(x) rw_exit(x)
+# define RW_DESTROY(x) rw_destroy(x)
+# else
+# define KRWLOCK_T kmutex_t
+# define READ_ENTER(x) mutex_enter(x)
+# define WRITE_ENTER(x) mutex_enter(x)
+# define MUTEX_DOWNGRADE(x) ;
+# define RWLOCK_INIT(x, y, z) mutex_init((x), (y), MUTEX_DRIVER, (z))
+# define RWLOCK_EXIT(x) mutex_exit(x)
+# define RW_DESTROY(x) mutex_destroy(x)
+# endif
+# define MUTEX_INIT(x, y, z) mutex_init((x), (y), MUTEX_DRIVER, (z))
+# define MUTEX_DESTROY(x) mutex_destroy(x)
# define MUTEX_EXIT(x) mutex_exit(x)
# define MTOD(m,t) (t)((m)->b_rptr)
# define IRCOPY(a,b,c) copyin((a), (b), (c))
# define IWCOPY(a,b,c) copyout((a), (b), (c))
+# define IRCOPYPTR ircopyptr
+# define IWCOPYPTR iwcopyptr
# define FREE_MB_T(m) freemsg(m)
# define SPL_NET(x) ;
# define SPL_IMP(x) ;
@@ -217,7 +348,8 @@ typedef unsigned long u_32_t;
# define htons(x) (x)
# define htonl(x) (x)
# endif /* sparc */
-# define KMALLOC(a,b,c) (a) = (b)kmem_alloc((c), KM_NOSLEEP)
+# define KMALLOC(a,b) (a) = (b)kmem_alloc(sizeof(*(a)), KM_NOSLEEP)
+# define KMALLOCS(a,b,c) (a) = (b)kmem_alloc((c), KM_NOSLEEP)
# define GET_MINOR(x) getminor(x)
typedef struct qif {
struct qif *qf_next;
@@ -233,18 +365,21 @@ typedef struct qif {
struct qinit qf_rqinit;
mblk_t *qf_m; /* These three fields are for passing data up from */
queue_t *qf_q; /* fr_qin and fr_qout to the packet processing. */
- int qf_off;
- int qf_len; /* this field is used for in ipfr_fastroute */
+ size_t qf_off;
+ size_t qf_len; /* this field is used for in ipfr_fastroute */
char qf_name[8];
/*
* in case the ILL has disappeared...
*/
- int qf_hl; /* header length */
+ size_t qf_hl; /* header length */
+ int qf_sap;
} qif_t;
-extern ill_t *get_unit __P((char *));
-# define GETUNIT(n) get_unit((n))
+extern ill_t *get_unit __P((char *, int));
+# define GETUNIT(n, v) get_unit(n, v)
+# define IFNAME(x) ((ill_t *)x)->ill_name
# else /* SOLARIS */
# if defined(__sgi)
+# define hz HZ
# include <sys/ksynch.h>
# define IPF_LOCK_PL plhi
# include <sys/sema.h>
@@ -253,28 +388,58 @@ typedef struct {
lock_t *l;
int pl;
} kmutex_t;
-# define MUTEX_ENTER(x) (x)->pl = LOCK((x)->l, IPF_LOCK_PL);
-# define MUTEX_EXIT(x) UNLOCK((x)->l, (x)->pl);
+# define ATOMIC_INC(x) { MUTEX_ENTER(&ipf_rw); \
+ (x)++; MUTEX_EXIT(&ipf_rw); }
+# define ATOMIC_DEC(x) { MUTEX_ENTER(&ipf_rw); \
+ (x)--; MUTEX_EXIT(&ipf_rw); }
+# define MUTEX_ENTER(x) (x)->pl = LOCK((x)->l, IPF_LOCK_PL);
+# define KRWLOCK_T kmutex_t
+# define READ_ENTER(x) MUTEX_ENTER(x)
+# define WRITE_ENTER(x) MUTEX_ENTER(x)
+# define RW_UPGRADE(x) ;
+# define MUTEX_DOWNGRADE(x) ;
+# define RWLOCK_EXIT(x) MUTEX_EXIT(x)
+# define MUTEX_EXIT(x) UNLOCK((x)->l, (x)->pl);
+# define MUTEX_INIT(x,y,z) (x).l = LOCK_ALLOC((uchar_t)-1, IPF_LOCK_PL, (lkinfo_t *)-1, KM_NOSLEEP)
+# define MUTEX_DESTROY(x) LOCK_DEALLOC((x).l)
# else /* __sgi */
-# define MUTEX_ENTER(x) ;
-# define MUTEX_EXIT(x) ;
+# define ATOMIC_INC(x) (x)++
+# define ATOMIC_DEC(x) (x)--
+# define MUTEX_ENTER(x) ;
+# define READ_ENTER(x) ;
+# define WRITE_ENTER(x) ;
+# define RW_UPGRADE(x) ;
+# define MUTEX_DOWNGRADE(x) ;
+# define RWLOCK_EXIT(x) ;
+# define MUTEX_EXIT(x) ;
+# define MUTEX_INIT(x,y,z) ;
+# define MUTEX_DESTROY(x) ;
# endif /* __sgi */
# ifndef linux
# define FREE_MB_T(m) m_freem(m)
# define MTOD(m,t) mtod(m,t)
-# define IRCOPY(a,b,c) bcopy((a), (b), (c))
-# define IWCOPY(a,b,c) bcopy((a), (b), (c))
+# define IRCOPY(a,b,c) (bcopy((a), (b), (c)), 0)
+# define IWCOPY(a,b,c) (bcopy((a), (b), (c)), 0)
+# define IRCOPYPTR ircopyptr
+# define IWCOPYPTR iwcopyptr
# endif /* !linux */
# endif /* SOLARIS */
# ifdef sun
# if !SOLARIS
# include <sys/kmem_alloc.h>
-# define GETUNIT(n) ifunit((n), IFNAMSIZ)
+# define GETUNIT(n, v) ifunit(n, IFNAMSIZ)
+# define IFNAME(x) ((struct ifnet *)x)->if_name
# endif
# else
# ifndef linux
-# define GETUNIT(n) ifunit((n))
+# define GETUNIT(n, v) ifunit(n)
+# if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199606)) || \
+ (defined(OpenBSD) && (OpenBSD >= 199603))
+# define IFNAME(x) ((struct ifnet *)x)->if_xname
+# else
+# define IFNAME(x) ((struct ifnet *)x)->if_name
+# endif
# endif
# endif /* sun */
@@ -291,11 +456,14 @@ extern void m_copyback __P((struct mbuf *, int, int, caddr_t));
# ifdef __sgi
# include <sys/kmem.h>
# include <sys/ddi.h>
-# define KMALLOC(a,b,c) (a) = (b)kmem_alloc((c), KM_NOSLEEP)
+# define KMALLOC(a,b) (a) = (b)kmem_alloc(sizeof(*(a)), KM_NOSLEEP)
+# define KMALLOCS(a,b,c) (a) = (b)kmem_alloc((c), KM_NOSLEEP)
# define GET_MINOR(x) getminor(x)
# else
# if !SOLARIS
-# define KMALLOC(a,b,c) (a) = (b)new_kmem_alloc((c), KMEM_NOSLEEP)
+# define KMALLOC(a,b) (a) = (b)new_kmem_alloc(sizeof(*(a)), \
+ KMEM_NOSLEEP)
+# define KMALLOCS(a,b,c) (a) = (b)new_kmem_alloc((c), KMEM_NOSLEEP)
# endif /* SOLARIS */
# endif /* __sgi */
# endif /* sun && !linux */
@@ -312,11 +480,13 @@ extern vm_map_t kmem_map;
# include <vm/vm_kern.h>
# endif /* !__FreeBSD__ || (__FreeBSD__ && __FreeBSD__>=3) */
# ifdef M_PFIL
-# define KMALLOC(a, b, c) MALLOC((a), b, (c), M_PFIL, M_NOWAIT)
+# define KMALLOC(a, b) MALLOC((a), b, sizeof(*(a)), M_PFIL, M_NOWAIT)
+# define KMALLOCS(a, b, c) MALLOC((a), b, (c), M_PFIL, M_NOWAIT)
# define KFREE(x) FREE((x), M_PFIL)
# define KFREES(x,s) FREE((x), M_PFIL)
# else
-# define KMALLOC(a, b, c) MALLOC((a), b, (c), M_TEMP, M_NOWAIT)
+# define KMALLOC(a, b) MALLOC((a), b, sizeof(*(a)), M_TEMP, M_NOWAIT)
+# define KMALLOCS(a, b, c) MALLOC((a), b, (c), M_TEMP, M_NOWAIT)
# define KFREE(x) FREE((x), M_TEMP)
# define KFREES(x,s) FREE((x), M_TEMP)
# endif /* M_PFIL */
@@ -339,25 +509,54 @@ extern vm_map_t kmem_map;
# define SLEEP(x,y) ;
# define WAKEUP(x) ;
# define PANIC(x,y) ;
+# define ATOMIC_INC(x) (x)++
+# define ATOMIC_DEC(x) (x)--
# define MUTEX_ENTER(x) ;
+# define READ_ENTER(x) ;
+# define MUTEX_INIT(x,y,z) ;
+# define MUTEX_DESTROY(x) ;
+# define WRITE_ENTER(x) ;
+# define RW_UPGRADE(x) ;
+# define MUTEX_DOWNGRADE(x) ;
+# define RWLOCK_EXIT(x) ;
# define MUTEX_EXIT(x) ;
# define SPL_NET(x) ;
# define SPL_IMP(x) ;
# undef SPL_X
# define SPL_X(x) ;
-# define KMALLOC(a,b,c) (a) = (b)malloc(c)
+# define KMALLOC(a,b) (a) = (b)malloc(sizeof(*a))
+# define KMALLOCS(a,b,c) (a) = (b)malloc(c)
# define KFREE(x) free(x)
# define KFREES(x,s) free(x)
-# define GETUNIT(x) get_unit(x)
-# define IRCOPY(a,b,c) bcopy((a), (b), (c))
-# define IWCOPY(a,b,c) bcopy((a), (b), (c))
+# define GETUNIT(x, v) get_unit(x,v)
+# define IRCOPY(a,b,c) (bcopy((a), (b), (c)), 0)
+# define IWCOPY(a,b,c) (bcopy((a), (b), (c)), 0)
+# define IRCOPYPTR ircopyptr
+# define IWCOPYPTR iwcopyptr
#endif /* KERNEL */
#if SOLARIS
typedef mblk_t mb_t;
+# if SOLARIS2 >= 7
+# ifdef lint
+# define ALIGN32(ptr) (ptr ? 0L : 0L)
+# define ALIGN16(ptr) (ptr ? 0L : 0L)
+# else
+# define ALIGN32(ptr) (ptr)
+# define ALIGN16(ptr) (ptr)
+# endif
+# endif
#else
# ifdef linux
+# ifndef kernel
+typedef struct mb {
+ struct mb *next;
+ u_int len;
+ u_char *data;
+} mb_t;
+# else
typedef struct sk_buff mb_t;
+# endif
# else
typedef struct mbuf mb_t;
# endif
@@ -492,6 +691,7 @@ typedef struct mbuf mb_t;
#endif /* linux || __sgi */
#ifdef linux
+#include <linux/in_systm.h>
/*
* TCP States
*/
@@ -513,8 +713,13 @@ typedef struct mbuf mb_t;
/*
* file flags.
*/
+#ifdef WRITE
#define FWRITE WRITE
#define FREAD READ
+#else
+#define FWRITE _IOC_WRITE
+#define FREAD _IOC_READ
+#endif
/*
* mbuf related problems.
*/
@@ -522,7 +727,10 @@ typedef struct mbuf mb_t;
#define m_len len
#define m_next next
-#define IP_DF 0x8000
+#ifdef IP_DF
+#undef IP_DF
+#endif
+#define IP_DF 0x4000
typedef struct {
__u16 th_sport;
@@ -556,8 +764,8 @@ typedef struct {
__u8 ip_hl:4;
__u8 ip_v:4;
# else
- __u8 ip_hl:4;
__u8 ip_v:4;
+ __u8 ip_hl:4;
# endif
__u8 ip_tos;
__u16 ip_len;
@@ -574,15 +782,15 @@ typedef struct {
* Structure of an icmp header.
*/
typedef struct icmp {
- u_char icmp_type; /* type of message, see below */
- u_char icmp_code; /* type sub code */
- u_short icmp_cksum; /* ones complement cksum of struct */
+ __u8 icmp_type; /* type of message, see below */
+ __u8 icmp_code; /* type sub code */
+ __u16 icmp_cksum; /* ones complement cksum of struct */
union {
- u_char ih_pptr; /* ICMP_PARAMPROB */
- struct in_addr ih_gwaddr; /* ICMP_REDIRECT */
- struct ih_idseq {
- n_short icd_id;
- n_short icd_seq;
+ __u8 ih_pptr; /* ICMP_PARAMPROB */
+ struct in_addr ih_gwaddr; /* ICMP_REDIRECT */
+ struct ih_idseq {
+ __u16 icd_id;
+ __u16 icd_seq;
} ih_idseq;
int ih_void;
} icmp_hun;
@@ -646,7 +854,7 @@ typedef struct uio {
# define if_name name
# ifdef KERNEL
-# define GETUNIT(x) dev_get(x)
+# define GETUNIT(x, v) dev_get(x)
# define FREE_MB_T(m) kfree_skb(m, FREE_WRITE)
# define uniqtime do_gettimeofday
# undef INT_MAX
@@ -664,19 +872,54 @@ typedef struct uio {
# define UNITNAME(n) dev_get((n))
-# define KMALLOC(a,b,c) (a) = (b)kmalloc((c), GFP_ATOMIC)
+# define KMALLOC(a,b) (a) = (b)kmalloc(sizeof(*(a)), GFP_ATOMIC)
+# define KMALLOCS(a,b,c) (a) = (b)kmalloc((c), GFP_ATOMIC)
# define KFREE(x) kfree_s((x), sizeof(*(x)))
# define KFREES(x,s) kfree_s((x), (s))
-# define IRCOPY(a,b,c) { \
- error = verify_area(VERIFY_READ, (a) ,(c)); \
- if (!error) \
- memcpy_fromfs((b), (a), (c)); \
- }
-# define IWCOPY(a,b,c) { \
- error = verify_area(VERIFY_WRITE, (b), (c)); \
- if (!error) \
- memcpy_tofs((b), (a), (c)); \
- }
+#define IRCOPY(const void *a, void *b, size_t c) { \
+ int error; \
+
+ error = verify_area(VERIFY_READ, a ,c); \
+ if (!error) \
+ memcpy_fromfs(b, a, c); \
+ return error; \
+}
+static inline int IWCOPY(const void *a, void *b, size_t c)
+{
+ int error;
+
+ error = verify_area(VERIFY_WRITE, b, c);
+ if (!error)
+ memcpy_tofs(b, a, c);
+ return error;
+}
+static inline int IRCOPYPTR(const void *a, void *b, size_t c) {
+ caddr_t ca;
+ int error;
+
+ error = verify_area(VERIFY_READ, a ,sizeof(ca));
+ if (!error) {
+ memcpy_fromfs(ca, a, sizeof(ca));
+ error = verify_area(VERIFY_READ, ca , c);
+ if (!error)
+ memcpy_fromfs(b, ca, c);
+ }
+ return error;
+}
+static inline int IWCOPYPTR(const void *a, void *b, size_t c) {
+ caddr_t ca;
+ int error;
+
+
+ error = verify_area(VERIFY_READ, b ,sizeof(ca));
+ if (!error) {
+ memcpy_fromfs(ca, b, sizeof(ca));
+ error = verify_area(VERIFY_WRITE, ca, c);
+ if (!error)
+ memcpy_tofs(ca, a, c);
+ }
+ return error;
+}
# else
# define __KERNEL__
# undef INT_MAX
@@ -717,11 +960,27 @@ struct ether_addr {
#define A_A &
#endif
+#define TCPF_ALL (TH_FIN|TH_SYN|TH_RST|TH_PUSH|TH_ACK|TH_URG)
+
#ifndef ICMP_ROUTERADVERT
# define ICMP_ROUTERADVERT 9
#endif
#ifndef ICMP_ROUTERSOLICIT
# define ICMP_ROUTERSOLICIT 10
#endif
+#undef ICMP_MAX_UNREACH
+#define ICMP_MAX_UNREACH 14
+#undef ICMP_MAXTYPE
+#define ICMP_MAXTYPE 18
+/*
+ * ICMP error replies have an IP header (20 bytes), 8 bytes of ICMP data,
+ * another IP header and then 64 bits of data, totalling 56. Of course,
+ * the last 64 bits is dependant on that being available.
+ */
+#define ICMPERR_ICMPHLEN 8
+#define ICMPERR_IPICMPHLEN (20 + 8)
+#define ICMPERR_MINPKTLEN (20 + 8 + 20)
+#define ICMPERR_MAXPKTLEN (20 + 8 + 20 + 8)
+#define ICMP6ERR_MINPKTLEN (20 + 8)
#endif /* __IP_COMPAT_H__ */
diff --git a/sys/netinet/ip_fil.c b/sys/netinet/ip_fil.c
index 09c4b6efacd9..9216b3c439f4 100644
--- a/sys/netinet/ip_fil.c
+++ b/sys/netinet/ip_fil.c
@@ -1,13 +1,13 @@
/*
- * Copyright (C) 1993-1997 by Darren Reed.
+ * Copyright (C) 1993-2000 by Darren Reed.
*
* Redistribution and use in source and binary forms are permitted
* provided that this notice is preserved and due credit is given
* to the original author and the contributors.
*/
#if !defined(lint)
-static const char sccsid[] = "@(#)ip_fil.c 2.41 6/5/96 (C) 1993-1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_fil.c,v 2.0.2.44.2.7 1998/05/03 10:55:49 darrenr Exp $";
+static const char sccsid[] = "@(#)ip_fil.c 2.41 6/5/96 (C) 1993-2000 Darren Reed";
+static const char rcsid[] = "@(#)$Id: ip_fil.c,v 2.42.2.9 2000/05/22 12:48:28 darrenr Exp $";
#endif
#ifndef SOLARIS
@@ -17,10 +17,17 @@ static const char rcsid[] = "@(#)$Id: ip_fil.c,v 2.0.2.44.2.7 1998/05/03 10:55:4
#if defined(KERNEL) && !defined(_KERNEL)
# define _KERNEL
#endif
-#ifdef __FreeBSD__
-# if defined(_KERNEL) && !defined(IPFILTER_LKM)
-# include <sys/osreldate.h>
-# else
+#if defined(_KERNEL) && defined(__FreeBSD_version) && \
+ (__FreeBSD_version >= 400000) && !defined(KLD_MODULE)
+#include "opt_inet6.h"
+#endif
+#include <sys/param.h>
+#if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \
+ defined(_KERNEL)
+# include "opt_ipfilter_log.h"
+#endif
+#if defined(__FreeBSD__) && !defined(__FreeBSD_version)
+# if !defined(_KERNEL) || defined(IPFILTER_LKM)
# include <osreldate.h>
# endif
#endif
@@ -29,10 +36,10 @@ static const char rcsid[] = "@(#)$Id: ip_fil.c,v 2.0.2.44.2.7 1998/05/03 10:55:4
# include <string.h>
# include <stdlib.h>
# include <ctype.h>
+# include <fcntl.h>
#endif
#include <sys/errno.h>
#include <sys/types.h>
-#include <sys/param.h>
#include <sys/file.h>
#if __FreeBSD_version >= 220000 && defined(_KERNEL)
# include <sys/fcntl.h>
@@ -46,7 +53,7 @@ static const char rcsid[] = "@(#)$Id: ip_fil.c,v 2.0.2.44.2.7 1998/05/03 10:55:4
#endif
#include <sys/uio.h>
#if !SOLARIS
-# if (NetBSD > 199609) || (OpenBSD > 199603)
+# if (NetBSD > 199609) || (OpenBSD > 199603) || (__FreeBSD_version >= 300000)
# include <sys/dirent.h>
# else
# include <sys/dir.h>
@@ -64,6 +71,9 @@ static const char rcsid[] = "@(#)$Id: ip_fil.c,v 2.0.2.44.2.7 1998/05/03 10:55:4
#endif
#if __FreeBSD_version >= 300000
# include <net/if_var.h>
+# if defined(_KERNEL) && !defined(IPFILTER_LKM)
+# include "opt_ipfilter.h"
+# endif
#endif
#ifdef __sgi
#include <sys/debug.h>
@@ -74,7 +84,7 @@ static const char rcsid[] = "@(#)$Id: ip_fil.c,v 2.0.2.44.2.7 1998/05/03 10:55:4
#include <net/route.h>
#include <netinet/in.h>
#if !(defined(__sgi) && !defined(IFF_DRVRLOCK)) /* IRIX < 6 */
-#include <netinet/in_var.h>
+# include <netinet/in_var.h>
#endif
#include <netinet/in_systm.h>
#include <netinet/ip.h>
@@ -84,19 +94,27 @@ static const char rcsid[] = "@(#)$Id: ip_fil.c,v 2.0.2.44.2.7 1998/05/03 10:55:4
#include <netinet/tcpip.h>
#include <netinet/ip_icmp.h>
#ifndef _KERNEL
+# include <unistd.h>
# include <syslog.h>
#endif
#include "netinet/ip_compat.h"
+#ifdef USE_INET6
+# include <netinet/icmp6.h>
+#endif
#include "netinet/ip_fil.h"
#include "netinet/ip_proxy.h"
#include "netinet/ip_nat.h"
#include "netinet/ip_frag.h"
#include "netinet/ip_state.h"
#include "netinet/ip_auth.h"
+#if defined(__FreeBSD_version) && (__FreeBSD_version >= 300000)
+# include <sys/malloc.h>
+#endif
#ifndef MIN
-#define MIN(a,b) (((a)<(b))?(a):(b))
+# define MIN(a,b) (((a)<(b))?(a):(b))
#endif
-#if !SOLARIS && defined(_KERNEL)
+#if !SOLARIS && defined(_KERNEL) && !defined(__sgi)
+# include <sys/kernel.h>
extern int ip_optcopy __P((struct ip *, struct ip *));
#endif
@@ -108,30 +126,27 @@ extern struct protosw inetsw[];
static struct ifnet **ifneta = NULL;
static int nifs = 0;
#else
-# if (BSD < 199306) && !defined(__sgi)
-static int (*fr_saveslowtimo) __P((void));
-# else
-static void (*fr_saveslowtimo) __P((void));
-# endif
# if (BSD < 199306) || defined(__sgi)
extern int tcp_ttl;
# endif
#endif
-int ipl_inited = 0;
int ipl_unreach = ICMP_UNREACH_FILTER;
u_long ipl_frouteok[2] = {0, 0};
-static void fixskip __P((frentry_t **, frentry_t *, int));
-static void frzerostats __P((caddr_t));
-static void frsync __P((void));
-#if defined(__NetBSD__) || defined(__OpenBSD__)
+static int frzerostats __P((caddr_t));
+#if defined(__NetBSD__) || defined(__OpenBSD__) || (__FreeBSD_version >= 300003)
static int frrequest __P((int, u_long, caddr_t, int));
#else
static int frrequest __P((int, int, caddr_t, int));
#endif
#ifdef _KERNEL
static int (*fr_savep) __P((ip_t *, int, void *, int, struct mbuf **));
+static int send_ip __P((ip_t *, fr_info_t *, struct mbuf *));
+# ifdef __sgi
+extern kmutex_t ipf_rw;
+extern KRWLOCK_T ipf_mutex;
+# endif
#else
int ipllog __P((void));
void init_ifp __P((void));
@@ -147,6 +162,15 @@ static int write_output __P((struct ifnet *, struct mbuf *,
struct sockaddr *, struct rtentry *));
# endif
#endif
+int fr_running = 0;
+
+#if (__FreeBSD_version >= 300000) && defined(_KERNEL)
+struct callout_handle ipfr_slowtimer_ch;
+#endif
+#if defined(__NetBSD__) && (__NetBSD_Version__ >= 104230000)
+# include <sys/callout.h>
+struct callout ipfr_slowtimer_ch;
+#endif
#if (_BSDI_VERSION >= 199510) && defined(_KERNEL)
# include <sys/device.h>
@@ -195,7 +219,8 @@ void
ipfilterattach(count)
int count;
{
- iplattach();
+ if (iplattach() != 0)
+ printf("IP Filter failed to attach\n");
}
# endif
@@ -204,40 +229,75 @@ int iplattach()
{
char *defpass;
int s;
-# ifdef __sgi
- int error;
+# if defined(__sgi) || (defined(NETBSD_PF) && (__NetBSD_Version__ >= 104200000))
+ int error = 0;
# endif
SPL_NET(s);
- if (ipl_inited || (fr_checkp == fr_check)) {
+ if (fr_running || (fr_checkp == fr_check)) {
printf("IP Filter: already initialized\n");
SPL_X(s);
return EBUSY;
}
+# ifdef IPFILTER_LOG
+ ipflog_init();
+# endif
+ if (nat_init() == -1)
+ return -1;
+ if (fr_stateinit() == -1)
+ return -1;
+ if (appr_init() == -1)
+ return -1;
+
# ifdef NETBSD_PF
+# if __NetBSD_Version__ >= 104200000
+ error = pfil_add_hook((void *)fr_check, PFIL_IN|PFIL_OUT,
+ &inetsw[ip_protox[IPPROTO_IP]].pr_pfh);
+ if (error) {
+# ifdef USE_INET6
+ goto pfil_error;
+# else
+ appr_unload();
+ ip_natunload();
+ fr_stateunload();
+ return error;
+# endif
+ }
+# else
pfil_add_hook((void *)fr_check, PFIL_IN|PFIL_OUT);
+# endif
+# ifdef USE_INET6
+ error = pfil_add_hook((void *)fr_check, PFIL_IN|PFIL_OUT,
+ &inetsw[ip_protox[IPPROTO_IPV6]].pr_pfh);
+ if (error) {
+ pfil_remove_hook((void *)fr_check, PFIL_IN|PFIL_OUT,
+ &inetsw[ip_protox[IPPROTO_IP]].pr_pfh);
+pfil_error:
+ appr_unload();
+ ip_natunload();
+ fr_stateunload();
+ return error;
+ }
+# endif
# endif
# ifdef __sgi
error = ipfilter_sgi_attach();
if (error) {
SPL_X(s);
+ appr_unload();
+ ip_natunload();
+ fr_stateunload();
return error;
}
# endif
- ipl_inited = 1;
bzero((char *)frcache, sizeof(frcache));
- bzero((char *)nat_table, sizeof(nat_table));
fr_savep = fr_checkp;
fr_checkp = fr_check;
- fr_saveslowtimo = inetsw[0].pr_slowtimo;
- inetsw[0].pr_slowtimo = ipfr_slowtimer;
+ fr_running = 1;
-# ifdef IPFILTER_LOG
- ipflog_init();
-# endif
SPL_X(s);
if (fr_pass & FR_PASS)
defpass = "pass";
@@ -246,13 +306,25 @@ int iplattach()
else
defpass = "no-match -> block";
- printf("IP Filter: initialized. Default = %s all, Logging = %s\n",
- defpass,
+ printf("%s initialized. Default = %s all, Logging = %s\n",
+ ipfilter_version, defpass,
# ifdef IPFILTER_LOG
"enabled");
# else
"disabled");
# endif
+#ifdef _KERNEL
+# if defined(__NetBSD__) && (__NetBSD_Version__ >= 104230000)
+ callout_init(&ipfr_slowtimer_ch);
+ callout_reset(&ipfr_slowtimer_ch, hz / 2, ipfr_slowtimer, NULL);
+# else
+# if (__FreeBSD_version >= 300000) && defined(_KERNEL)
+ ipfr_slowtimer_ch = timeout(ipfr_slowtimer, NULL, hz/2);
+# else
+ timeout(ipfr_slowtimer, NULL, hz/2);
+# endif
+# endif
+#endif
return 0;
}
@@ -264,28 +336,61 @@ int iplattach()
int ipldetach()
{
int s, i = FR_INQUE|FR_OUTQUE;
+#if defined(NETBSD_PF) && (__NetBSD_Version__ >= 104200000)
+ int error = 0;
+#endif
+#ifdef _KERNEL
+# if defined(__NetBSD__) && (__NetBSD_Version__ >= 104230000)
+ callout_stop(&ipfr_slowtimer_ch);
+# else
+# if (__FreeBSD_version >= 300000)
+ untimeout(ipfr_slowtimer, NULL, ipfr_slowtimer_ch);
+# else
+# ifdef __sgi
+ untimeout(ipfr_slowtimer);
+# else
+ untimeout(ipfr_slowtimer, NULL);
+# endif
+# endif /* FreeBSD */
+# endif /* NetBSD */
+#endif
SPL_NET(s);
- if (!ipl_inited)
+ if (!fr_running)
{
printf("IP Filter: not initialized\n");
SPL_X(s);
return 0;
}
+ printf("%s unloaded\n", ipfilter_version);
+
fr_checkp = fr_savep;
- inetsw[0].pr_slowtimo = fr_saveslowtimo;
- frflush(IPL_LOGIPF, &i);
- ipl_inited = 0;
+ i = frflush(IPL_LOGIPF, i);
+ fr_running = 0;
# ifdef NETBSD_PF
+# if __NetBSD_Version__ >= 104200000
+ error = pfil_remove_hook((void *)fr_check, PFIL_IN|PFIL_OUT,
+ &inetsw[ip_protox[IPPROTO_IP]].pr_pfh);
+ if (error)
+ return error;
+# else
pfil_remove_hook((void *)fr_check, PFIL_IN|PFIL_OUT);
+# endif
+# ifdef USE_INET6
+ error = pfil_remove_hook((void *)fr_check, PFIL_IN|PFIL_OUT,
+ &inetsw[ip_protox[IPPROTO_IPV6]].pr_pfh);
+ if (error)
+ return error;
+# endif
# endif
# ifdef __sgi
ipfilter_sgi_detach();
# endif
+ appr_unload();
ipfr_unload();
ip_natunload();
fr_stateunload();
@@ -297,26 +402,20 @@ int ipldetach()
#endif /* _KERNEL */
-static void frzerostats(data)
+static int frzerostats(data)
caddr_t data;
{
- struct friostat fio;
-
- bcopy((char *)frstats, (char *)fio.f_st,
- sizeof(struct filterstats) * 2);
- fio.f_fin[0] = ipfilter[0][0];
- fio.f_fin[1] = ipfilter[0][1];
- fio.f_fout[0] = ipfilter[1][0];
- fio.f_fout[1] = ipfilter[1][1];
- fio.f_acctin[0] = ipacct[0][0];
- fio.f_acctin[1] = ipacct[0][1];
- fio.f_acctout[0] = ipacct[1][0];
- fio.f_acctout[1] = ipacct[1][1];
- fio.f_active = fr_active;
- fio.f_froute[0] = ipl_frouteok[0];
- fio.f_froute[1] = ipl_frouteok[1];
- IWCOPY((caddr_t)&fio, data, sizeof(fio));
+ friostat_t fio;
+ int error;
+
+ fr_getstat(&fio);
+ error = IWCOPYPTR((caddr_t)&fio, data, sizeof(fio));
+ if (error)
+ return EFAULT;
+
bzero((char *)frstats, sizeof(*frstats) * 2);
+
+ return 0;
}
@@ -331,19 +430,21 @@ int IPL_EXTERN(ioctl)(dev_t dev, int cmd, caddr_t data, int mode
)
#else
int IPL_EXTERN(ioctl)(dev, cmd, data, mode
-#if ((_BSDI_VERSION >= 199510) || (BSD >= 199506) || (NetBSD >= 199511) || \
- (__FreeBSD_version >= 220000)) && defined(_KERNEL)
+# if (defined(_KERNEL) && ((_BSDI_VERSION >= 199510) || (BSD >= 199506) || \
+ (NetBSD >= 199511) || (__FreeBSD_version >= 220000) || \
+ defined(__OpenBSD__)))
, p)
struct proc *p;
-#else
+# else
)
-#endif
+# endif
dev_t dev;
-#if defined(__NetBSD__) || defined(__OpenBSD__) || (_BSDI_VERSION >= 199701)
+# if defined(__NetBSD__) || defined(__OpenBSD__) || \
+ (_BSDI_VERSION >= 199701) || (__FreeBSD_version >= 300000)
u_long cmd;
-#else
+# else
int cmd;
-#endif
+# endif
caddr_t data;
int mode;
#endif /* __sgi */
@@ -353,29 +454,49 @@ int mode;
#endif
int error = 0, unit = 0, tmp;
+#if (BSD >= 199306) && defined(_KERNEL)
+ if ((securelevel >= 2) && (mode & FWRITE))
+ return EPERM;
+#endif
#ifdef _KERNEL
unit = GET_MINOR(dev);
if ((IPL_LOGMAX < unit) || (unit < 0))
return ENXIO;
+#else
+ unit = dev;
#endif
SPL_NET(s);
if (unit == IPL_LOGNAT) {
- error = nat_ioctl(data, cmd, mode);
+ if (fr_running)
+ error = nat_ioctl(data, cmd, mode);
+ else
+ error = EIO;
SPL_X(s);
return error;
}
if (unit == IPL_LOGSTATE) {
- error = fr_state_ioctl(data, cmd, mode);
+ if (fr_running)
+ error = fr_state_ioctl(data, cmd, mode);
+ else
+ error = EIO;
+ SPL_X(s);
+ return error;
+ }
+ if (unit == IPL_LOGAUTH) {
+ if (!fr_running)
+ return EIO;
+ error = fr_auth_ioctl(data, cmd, NULL, NULL);
SPL_X(s);
return error;
}
+
switch (cmd) {
case FIONREAD :
#ifdef IPFILTER_LOG
- IWCOPY((caddr_t)&iplused[IPL_LOGIPF], (caddr_t)data,
- sizeof(iplused[IPL_LOGIPF]));
+ error = IWCOPY((caddr_t)&iplused[IPL_LOGIPF], (caddr_t)data,
+ sizeof(iplused[IPL_LOGIPF]));
#endif
break;
#if !defined(IPFILTER_LKM) && defined(_KERNEL)
@@ -386,7 +507,9 @@ int mode;
if (!(mode & FWRITE))
error = EPERM;
else {
- IRCOPY(data, (caddr_t)&enable, sizeof(enable));
+ error = IRCOPY(data, (caddr_t)&enable, sizeof(enable));
+ if (error)
+ break;
if (enable)
error = iplattach();
else
@@ -399,10 +522,11 @@ int mode;
if (!(mode & FWRITE))
error = EPERM;
else
- IRCOPY(data, (caddr_t)&fr_flags, sizeof(fr_flags));
+ error = IRCOPY(data, (caddr_t)&fr_flags,
+ sizeof(fr_flags));
break;
case SIOCGETFF :
- IWCOPY((caddr_t)&fr_flags, data, sizeof(fr_flags));
+ error = IWCOPY((caddr_t)&fr_flags, data, sizeof(fr_flags));
break;
case SIOCINAFR :
case SIOCRMAFR :
@@ -432,40 +556,42 @@ int mode;
break;
case SIOCGETFS :
{
- struct friostat fio;
-
- bcopy((char *)frstats, (char *)fio.f_st,
- sizeof(struct filterstats) * 2);
- fio.f_fin[0] = ipfilter[0][0];
- fio.f_fin[1] = ipfilter[0][1];
- fio.f_fout[0] = ipfilter[1][0];
- fio.f_fout[1] = ipfilter[1][1];
- fio.f_acctin[0] = ipacct[0][0];
- fio.f_acctin[1] = ipacct[0][1];
- fio.f_acctout[0] = ipacct[1][0];
- fio.f_acctout[1] = ipacct[1][1];
- fio.f_auth = ipauth;
- fio.f_active = fr_active;
- fio.f_froute[0] = ipl_frouteok[0];
- fio.f_froute[1] = ipl_frouteok[1];
- IWCOPY((caddr_t)&fio, data, sizeof(fio));
+ friostat_t fio;
+
+ fr_getstat(&fio);
+ error = IWCOPYPTR((caddr_t)&fio, data, sizeof(fio));
+ if (error)
+ return EFAULT;
break;
}
case SIOCFRZST :
if (!(mode & FWRITE))
error = EPERM;
else
- frzerostats(data);
+ error = frzerostats(data);
break;
case SIOCIPFFL :
if (!(mode & FWRITE))
error = EPERM;
else {
- IRCOPY(data, (caddr_t)&tmp, sizeof(tmp));
- frflush(unit, &tmp);
- IWCOPY((caddr_t)&tmp, data, sizeof(tmp));
+ error = IRCOPY(data, (caddr_t)&tmp, sizeof(tmp));
+ if (!error) {
+ tmp = frflush(unit, tmp);
+ error = IWCOPY((caddr_t)&tmp, data,
+ sizeof(tmp));
+ }
}
break;
+ case SIOCSTLCK :
+ error = IRCOPY(data, (caddr_t)&tmp, sizeof(tmp));
+ if (!error) {
+ fr_state_lock = tmp;
+ fr_nat_lock = tmp;
+ fr_frag_lock = tmp;
+ fr_auth_lock = tmp;
+ } else
+ error = EFAULT;
+ break;
#ifdef IPFILTER_LOG
case SIOCIPFFB :
if (!(mode & FWRITE))
@@ -475,7 +601,10 @@ int mode;
break;
#endif /* IPFILTER_LOG */
case SIOCGFRST :
- IWCOPY((caddr_t)ipfr_fragstats(), data, sizeof(ipfrstat_t));
+ error = IWCOPYPTR((caddr_t)ipfr_fragstats(), data,
+ sizeof(ipfrstat_t));
+ if (error)
+ return EFAULT;
break;
case SIOCAUTHW :
case SIOCAUTHR :
@@ -483,9 +612,6 @@ int mode;
error = EPERM;
break;
}
- case SIOCATHST :
- error = fr_auth_ioctl(data, cmd, NULL, NULL);
- break;
case SIOCFRSYN :
if (!(mode & FWRITE))
error = EPERM;
@@ -505,43 +631,46 @@ int mode;
}
-static void frsync()
+void fr_forgetifp(ifp)
+void *ifp;
{
-#ifdef _KERNEL
- struct ifnet *ifp;
-
-# if defined(__OpenBSD__) || (NetBSD >= 199511)
- for (ifp = ifnet.tqh_first; ifp; ifp = ifp->if_list.tqe_next)
-# else
- for (ifp = ifnet; ifp; ifp = ifp->if_next)
-# endif
- ip_natsync(ifp);
+ register frentry_t *f;
+
+ WRITE_ENTER(&ipf_mutex);
+ for (f = ipacct[0][fr_active]; (f != NULL); f = f->fr_next)
+ if (f->fr_ifa == ifp)
+ f->fr_ifa = (void *)-1;
+ for (f = ipacct[1][fr_active]; (f != NULL); f = f->fr_next)
+ if (f->fr_ifa == ifp)
+ f->fr_ifa = (void *)-1;
+ for (f = ipfilter[0][fr_active]; (f != NULL); f = f->fr_next)
+ if (f->fr_ifa == ifp)
+ f->fr_ifa = (void *)-1;
+ for (f = ipfilter[1][fr_active]; (f != NULL); f = f->fr_next)
+ if (f->fr_ifa == ifp)
+ f->fr_ifa = (void *)-1;
+#ifdef USE_INET6
+ for (f = ipacct6[0][fr_active]; (f != NULL); f = f->fr_next)
+ if (f->fr_ifa == ifp)
+ f->fr_ifa = (void *)-1;
+ for (f = ipacct6[1][fr_active]; (f != NULL); f = f->fr_next)
+ if (f->fr_ifa == ifp)
+ f->fr_ifa = (void *)-1;
+ for (f = ipfilter6[0][fr_active]; (f != NULL); f = f->fr_next)
+ if (f->fr_ifa == ifp)
+ f->fr_ifa = (void *)-1;
+ for (f = ipfilter6[1][fr_active]; (f != NULL); f = f->fr_next)
+ if (f->fr_ifa == ifp)
+ f->fr_ifa = (void *)-1;
#endif
-}
-
-
-static void fixskip(listp, rp, addremove)
-frentry_t **listp, *rp;
-int addremove;
-{
- frentry_t *fp;
- int rules = 0, rn = 0;
-
- for (fp = *listp; fp && (fp != rp); fp = fp->fr_next, rules++)
- ;
-
- if (!fp)
- return;
-
- for (fp = *listp; fp && (fp != rp); fp = fp->fr_next, rn++)
- if (fp->fr_skip && (rn + fp->fr_skip >= rules))
- fp->fr_skip += addremove;
+ RWLOCK_EXIT(&ipf_mutex);
+ ip_natsync(ifp);
}
static int frrequest(unit, req, data, set)
int unit;
-#if defined(__NetBSD__) || defined(__OpenBSD__)
+#if defined(__NetBSD__) || defined(__OpenBSD__) || (__FreeBSD_version >= 300003)
u_long req;
#else
int req;
@@ -554,30 +683,41 @@ caddr_t data;
frentry_t frd;
frdest_t *fdp;
frgroup_t *fg = NULL;
- int error = 0, in, group;
+ u_int *p, *pp;
+ int error = 0, in;
+ u_int group;
fp = &frd;
- IRCOPY(data, (caddr_t)fp, sizeof(*fp));
+ error = IRCOPYPTR(data, (caddr_t)fp, sizeof(*fp));
+ if (error)
+ return EFAULT;
+ fp->fr_ref = 0;
/*
* Check that the group number does exist and that if a head group
* has been specified, doesn't exist.
*/
- if (fp->fr_grhead &&
- fr_findgroup(fp->fr_grhead, fp->fr_flags, unit, set, NULL))
+ if ((req != SIOCZRLST) && fp->fr_grhead &&
+ fr_findgroup((u_int)fp->fr_grhead, fp->fr_flags, unit, set, NULL))
return EEXIST;
- if (fp->fr_group &&
- !fr_findgroup(fp->fr_group, fp->fr_flags, unit, set, NULL))
+ if ((req != SIOCZRLST) && fp->fr_group &&
+ !fr_findgroup((u_int)fp->fr_group, fp->fr_flags, unit, set, NULL))
return ESRCH;
in = (fp->fr_flags & FR_INQUE) ? 0 : 1;
if (unit == IPL_LOGAUTH)
ftail = fprev = &ipauth;
- else if (fp->fr_flags & FR_ACCOUNT)
+ else if ((fp->fr_flags & FR_ACCOUNT) && (fp->fr_v == 4))
ftail = fprev = &ipacct[in][set];
- else if (fp->fr_flags & (FR_OUTQUE|FR_INQUE))
+ else if ((fp->fr_flags & (FR_OUTQUE|FR_INQUE)) && (fp->fr_v == 4))
ftail = fprev = &ipfilter[in][set];
+#ifdef USE_INET6
+ else if ((fp->fr_flags & FR_ACCOUNT) && (fp->fr_v == 6))
+ ftail = fprev = &ipacct6[in][set];
+ else if ((fp->fr_flags & (FR_OUTQUE|FR_INQUE)) && (fp->fr_v == 6))
+ ftail = fprev = &ipfilter6[in][set];
+#endif
else
return ESRCH;
@@ -590,15 +730,22 @@ caddr_t data;
bzero((char *)frcache, sizeof(frcache[0]) * 2);
if (*fp->fr_ifname) {
- fp->fr_ifa = GETUNIT(fp->fr_ifname);
+ fp->fr_ifa = GETUNIT(fp->fr_ifname, fp->fr_v);
if (!fp->fr_ifa)
fp->fr_ifa = (void *)-1;
}
+#if BSD >= 199306
+ if (*fp->fr_oifname) {
+ fp->fr_oifa = GETUNIT(fp->fr_oifname, fp->fr_v);
+ if (!fp->fr_oifa)
+ fp->fr_oifa = (void *)-1;
+ }
+#endif
fdp = &fp->fr_dif;
fp->fr_flags &= ~FR_DUP;
if (*fdp->fd_ifname) {
- fdp->fd_ifp = GETUNIT(fdp->fd_ifname);
+ fdp->fd_ifp = GETUNIT(fdp->fd_ifname, fp->fr_v);
if (!fdp->fd_ifp)
fdp->fd_ifp = (struct ifnet *)-1;
else
@@ -607,7 +754,7 @@ caddr_t data;
fdp = &fp->fr_tif;
if (*fdp->fd_ifname) {
- fdp->fd_ifp = GETUNIT(fdp->fd_ifname);
+ fdp->fd_ifp = GETUNIT(fdp->fd_ifname, fp->fr_v);
if (!fdp->fd_ifp)
fdp->fd_ifp = (struct ifnet *)-1;
}
@@ -616,9 +763,13 @@ caddr_t data;
* Look for a matching filter rule, but don't include the next or
* interface pointer in the comparison (fr_next, fr_ifa).
*/
+ for (fp->fr_cksum = 0, p = (u_int *)&fp->fr_ip, pp = &fp->fr_cksum;
+ p != pp; p++)
+ fp->fr_cksum += *p;
+
for (; (f = *ftail); ftail = &f->fr_next)
- if (bcmp((char *)&f->fr_ip, (char *)&fp->fr_ip,
- FR_CMPSIZ) == 0)
+ if ((fp->fr_cksum == f->fr_cksum) &&
+ !bcmp((char *)&f->fr_ip, (char *)&fp->fr_ip, FR_CMPSIZ))
break;
/*
@@ -627,47 +778,59 @@ caddr_t data;
if (req == SIOCZRLST) {
if (!f)
return ESRCH;
- IWCOPY((caddr_t)f, data, sizeof(*f));
+ error = IWCOPYPTR((caddr_t)f, data, sizeof(*f));
+ if (error)
+ return EFAULT;
f->fr_hits = 0;
f->fr_bytes = 0;
return 0;
}
if (!f) {
- ftail = fprev;
if (req != SIOCINAFR && req != SIOCINIFR)
while ((f = *ftail))
ftail = &f->fr_next;
- else if (fp->fr_hits)
- while (--fp->fr_hits && (f = *ftail))
- ftail = &f->fr_next;
- f = NULL;
+ else {
+ if (fp->fr_hits) {
+ ftail = fprev;
+ while (--fp->fr_hits && (f = *ftail))
+ ftail = &f->fr_next;
+ }
+ f = NULL;
+ }
}
- if (req == SIOCDELFR || req == SIOCRMIFR) {
+ if (req == SIOCRMAFR || req == SIOCRMIFR) {
if (!f)
error = ESRCH;
else {
- if (f->fr_ref > 1)
+ /*
+ * Only return EBUSY if there is a group list, else
+ * it's probably just state information referencing
+ * the rule.
+ */
+ if ((f->fr_ref > 1) && f->fr_grp)
return EBUSY;
if (fg && fg->fg_head)
fg->fg_head->fr_ref--;
if (unit == IPL_LOGAUTH)
return fr_auth_ioctl(data, req, f, ftail);
if (f->fr_grhead)
- fr_delgroup(f->fr_grhead, fp->fr_flags, unit,
- set);
+ fr_delgroup((u_int)f->fr_grhead, fp->fr_flags,
+ unit, set);
fixskip(fprev, f, -1);
*ftail = f->fr_next;
- KFREE(f);
+ f->fr_next = NULL;
+ if (f->fr_ref == 0)
+ KFREE(f);
}
} else {
if (f)
error = EEXIST;
else {
if (unit == IPL_LOGAUTH)
- return fr_auth_ioctl(data, req, f, ftail);
- KMALLOC(f, frentry_t *, sizeof(*f));
+ return fr_auth_ioctl(data, req, fp, ftail);
+ KMALLOC(f, frentry_t *);
if (f != NULL) {
if (fg && fg->fg_head)
fg->fg_head->fr_ref++;
@@ -693,33 +856,33 @@ caddr_t data;
/*
* routines below for saving IP headers to buffer
*/
-#ifdef __sgi
-# ifdef _KERNEL
+# ifdef __sgi
+# ifdef _KERNEL
int IPL_EXTERN(open)(dev_t *pdev, int flags, int devtype, cred_t *cp)
-# else
+# else
int IPL_EXTERN(open)(dev_t dev, int flags)
-# endif
-#else
+# endif
+# else
int IPL_EXTERN(open)(dev, flags
-# if ((_BSDI_VERSION >= 199510) || (BSD >= 199506) || (NetBSD >= 199511) || \
- (__FreeBSD_version >= 220000)) && defined(_KERNEL)
+# if ((_BSDI_VERSION >= 199510) || (BSD >= 199506) || (NetBSD >= 199511) || \
+ (__FreeBSD_version >= 220000) || defined(__OpenBSD__)) && defined(_KERNEL)
, devtype, p)
int devtype;
struct proc *p;
-# else
+# else
)
-# endif
+# endif
dev_t dev;
int flags;
-#endif /* __sgi */
+# endif /* __sgi */
{
-#if defined(__sgi) && defined(_KERNEL)
+# if defined(__sgi) && defined(_KERNEL)
u_int min = geteminor(*pdev);
-#else
+# else
u_int min = GET_MINOR(dev);
-#endif
+# endif
- if (2 < min)
+ if (IPL_LOGMAX < min)
min = ENXIO;
else
min = 0;
@@ -727,25 +890,25 @@ int flags;
}
-#ifdef __sgi
+# ifdef __sgi
int IPL_EXTERN(close)(dev_t dev, int flags, int devtype, cred_t *cp)
#else
int IPL_EXTERN(close)(dev, flags
-# if ((_BSDI_VERSION >= 199510) || (BSD >= 199506) || (NetBSD >= 199511) || \
- (__FreeBSD_version >= 220000)) && defined(_KERNEL)
+# if ((_BSDI_VERSION >= 199510) || (BSD >= 199506) || (NetBSD >= 199511) || \
+ (__FreeBSD_version >= 220000) || defined(__OpenBSD__)) && defined(_KERNEL)
, devtype, p)
int devtype;
struct proc *p;
-# else
+# else
)
-# endif
+# endif
dev_t dev;
int flags;
-#endif /* __sgi */
+# endif /* __sgi */
{
u_int min = GET_MINOR(dev);
- if (2 < min)
+ if (IPL_LOGMAX < min)
min = ENXIO;
else
min = 0;
@@ -758,9 +921,9 @@ int flags;
* called during packet processing and cause an inconsistancy to appear in
* the filter lists.
*/
-#ifdef __sgi
+# ifdef __sgi
int IPL_EXTERN(read)(dev_t dev, uio_t *uio, cred_t *crp)
-#else
+# else
# if BSD >= 199306
int IPL_EXTERN(read)(dev, uio, ioflag)
int ioflag;
@@ -769,13 +932,13 @@ int IPL_EXTERN(read)(dev, uio)
# endif
dev_t dev;
register struct uio *uio;
-#endif /* __sgi */
+# endif /* __sgi */
{
-# ifdef IPFILTER_LOG
+# ifdef IPFILTER_LOG
return ipflog_read(GET_MINOR(dev), uio);
-# else
+# else
return ENXIO;
-# endif
+# endif
}
@@ -783,72 +946,254 @@ register struct uio *uio;
* send_reset - this could conceivably be a call to tcp_respond(), but that
* requires a large amount of setting up and isn't any more efficient.
*/
-int send_reset(ti)
-struct tcpiphdr *ti;
+int send_reset(oip, fin)
+struct ip *oip;
+fr_info_t *fin;
{
- struct tcpiphdr *tp;
- struct tcphdr *tcp;
+ struct tcphdr *tcp, *tcp2;
+ int tlen = 0, hlen;
struct mbuf *m;
- int tlen = 0, err;
+#ifdef USE_INET6
+ ip6_t *ip6, *oip6 = (ip6_t *)oip;
+#endif
ip_t *ip;
-# if defined(__FreeBSD_version) && (__FreeBSD_version >= 220000)
- struct route ro;
-# endif
- if (ti->ti_flags & TH_RST)
+ tcp = (struct tcphdr *)fin->fin_dp;
+ if (tcp->th_flags & TH_RST)
return -1; /* feedback loop */
# if (BSD < 199306) || defined(__sgi)
m = m_get(M_DONTWAIT, MT_HEADER);
# else
m = m_gethdr(M_DONTWAIT, MT_HEADER);
- m->m_data += max_linkhdr;
# endif
if (m == NULL)
+ return ENOBUFS;
+ if (m == NULL)
return -1;
- if (ti->ti_flags & TH_SYN)
+ if (tcp->th_flags & TH_SYN)
tlen = 1;
- m->m_len = sizeof (struct tcpiphdr);
+#ifdef USE_INET6
+ hlen = (fin->fin_v == 6) ? sizeof(ip6_t) : sizeof(ip_t);
+#else
+ hlen = sizeof(ip_t);
+#endif
+ m->m_len = sizeof(*tcp2) + hlen;
# if BSD >= 199306
- m->m_pkthdr.len = sizeof (struct tcpiphdr);
+ m->m_data += max_linkhdr;
+ m->m_pkthdr.len = m->m_len;
m->m_pkthdr.rcvif = (struct ifnet *)0;
# endif
- bzero(mtod(m, char *), sizeof(struct tcpiphdr));
ip = mtod(m, struct ip *);
- tp = mtod(m, struct tcpiphdr *);
- tcp = (struct tcphdr *)((char *)ip + sizeof(struct ip));
-
- ip->ip_src.s_addr = ti->ti_dst.s_addr;
- ip->ip_dst.s_addr = ti->ti_src.s_addr;
- tcp->th_dport = ti->ti_sport;
- tcp->th_sport = ti->ti_dport;
- tcp->th_ack = htonl(ntohl(ti->ti_seq) + tlen);
- tcp->th_off = sizeof(struct tcphdr) >> 2;
- tcp->th_flags = TH_RST|TH_ACK;
- tp->ti_pr = ((struct ip *)ti)->ip_p;
- tp->ti_len = htons(sizeof(struct tcphdr));
- tcp->th_sum = in_cksum(m, sizeof(struct tcpiphdr));
-
- ip->ip_tos = ((struct ip *)ti)->ip_tos;
- ip->ip_p = ((struct ip *)ti)->ip_p;
- ip->ip_len = sizeof (struct tcpiphdr);
+# ifdef USE_INET6
+ ip6 = (ip6_t *)ip;
+# endif
+ bzero((char *)ip, sizeof(*tcp2) + hlen);
+ tcp2 = (struct tcphdr *)((char *)ip + hlen);
+
+ tcp2->th_sport = tcp->th_dport;
+ tcp2->th_dport = tcp->th_sport;
+ tcp2->th_ack = ntohl(tcp->th_seq);
+ tcp2->th_ack += tlen;
+ tcp2->th_ack = htonl(tcp2->th_ack);
+ tcp2->th_off = sizeof(*tcp2) >> 2;
+ tcp2->th_flags = TH_RST|TH_ACK;
+# ifdef USE_INET6
+ if (fin->fin_v == 6) {
+ ip6->ip6_plen = htons(sizeof(struct tcphdr));
+ ip6->ip6_nxt = IPPROTO_TCP;
+ ip6->ip6_src = oip6->ip6_dst;
+ ip6->ip6_dst = oip6->ip6_src;
+ tcp2->th_sum = in6_cksum(m, IPPROTO_TCP,
+ sizeof(*ip6), sizeof(*tcp2));
+ return send_ip(oip, fin, m);
+ }
+# endif
+ ip->ip_p = IPPROTO_TCP;
+ ip->ip_len = htons(sizeof(struct tcphdr));
+ ip->ip_src.s_addr = oip->ip_dst.s_addr;
+ ip->ip_dst.s_addr = oip->ip_src.s_addr;
+ tcp2->th_sum = in_cksum(m, hlen + sizeof(*tcp2));
+ ip->ip_len = hlen + sizeof(*tcp2);
+ return send_ip(oip, fin, m);
+}
+
+
+static int send_ip(oip, fin, m)
+ip_t *oip;
+fr_info_t *fin;
+struct mbuf *m;
+{
+ ip_t *ip;
+
+ ip = mtod(m, ip_t *);
+
+ ip->ip_v = fin->fin_v;
+ if (ip->ip_v == 4) {
+ ip->ip_hl = (sizeof(*oip) >> 2);
+ ip->ip_v = IPVERSION;
+ ip->ip_tos = oip->ip_tos;
+ ip->ip_id = oip->ip_id;
+ ip->ip_off = 0;
# if (BSD < 199306) || defined(__sgi)
- ip->ip_ttl = tcp_ttl;
+ ip->ip_ttl = tcp_ttl;
# else
- ip->ip_ttl = ip_defttl;
+ ip->ip_ttl = ip_defttl;
+# endif
+ ip->ip_sum = 0;
+ }
+# ifdef USE_INET6
+ else if (ip->ip_v == 6) {
+ ip6_t *ip6 = (ip6_t *)ip;
+
+ ip6->ip6_hlim = 127;
+
+ return ip6_output(m, NULL, NULL, 0, NULL, NULL);
+ }
# endif
+# ifdef IPSEC
+ m->m_pkthdr.rcvif = NULL;
+# endif
+ return ipfr_fastroute(m, fin, NULL);
+}
-# if defined(__FreeBSD_version) && (__FreeBSD_version >= 220000)
- bzero((char *)&ro, sizeof(ro));
- err = ip_output(m, (struct mbuf *)0, &ro, 0, 0);
- if (ro.ro_rt)
- RTFREE(ro.ro_rt);
+
+int send_icmp_err(oip, type, fin, dst)
+ip_t *oip;
+int type;
+fr_info_t *fin;
+int dst;
+{
+ int err, hlen = 0, xtra = 0, iclen, ohlen = 0, avail, code;
+ struct in_addr dst4;
+ struct icmp *icmp;
+ struct mbuf *m;
+ void *ifp;
+#ifdef USE_INET6
+ ip6_t *ip6, *oip6 = (ip6_t *)oip;
+ struct in6_addr dst6;
+#endif
+ ip_t *ip;
+
+ if ((type < 0) || (type > ICMP_MAXTYPE))
+ return -1;
+
+ code = fin->fin_icode;
+#ifdef USE_INET6
+ if ((code < 0) || (code > sizeof(icmptoicmp6unreach)/sizeof(int)))
+ return -1;
+#endif
+
+ avail = 0;
+ m = NULL;
+ ifp = fin->fin_ifp;
+ if (fin->fin_v == 4) {
+# if (BSD < 199306) || defined(__sgi)
+ avail = MLEN;
+ m = m_get(M_DONTWAIT, MT_HEADER);
# else
- /*
- * extra 0 in case of multicast
- */
- err = ip_output(m, (struct mbuf *)0, 0, 0, 0);
+ avail = MHLEN;
+ m = m_gethdr(M_DONTWAIT, MT_HEADER);
# endif
+ if (m == NULL)
+ return ENOBUFS;
+
+ if (dst == 0) {
+ if (fr_ifpaddr(4, ifp, &dst4) == -1)
+ return -1;
+ } else
+ dst4.s_addr = oip->ip_dst.s_addr;
+
+ hlen = sizeof(ip_t);
+ ohlen = oip->ip_hl << 2;
+ xtra = 8;
+ }
+
+#ifdef USE_INET6
+ else if (fin->fin_v == 6) {
+ hlen = sizeof(ip6_t);
+ ohlen = sizeof(ip6_t);
+ type = icmptoicmp6types[type];
+ if (type == ICMP6_DST_UNREACH)
+ code = icmptoicmp6unreach[code];
+
+ MGETHDR(m, M_DONTWAIT, MT_HEADER);
+ if (!m)
+ return ENOBUFS;
+
+ MCLGET(m, M_DONTWAIT);
+ if (!m)
+ return ENOBUFS;
+ avail = (m->m_flags & M_EXT) ? MCLBYTES : MHLEN;
+ xtra = MIN(ntohs(oip6->ip6_plen) + sizeof(ip6_t),
+ avail - hlen - sizeof(*icmp) - max_linkhdr);
+ if (dst == 0) {
+ if (fr_ifpaddr(6, ifp, (struct in_addr *)&dst6) == -1)
+ return -1;
+ } else
+ dst6 = oip6->ip6_dst;
+ }
+#endif
+
+ iclen = hlen + sizeof(*icmp);
+# if BSD >= 199306
+ avail -= (max_linkhdr + iclen);
+ m->m_data += max_linkhdr;
+ m->m_pkthdr.rcvif = (struct ifnet *)0;
+ if (xtra > avail)
+ xtra = avail;
+ iclen += xtra;
+ m->m_pkthdr.len = iclen;
+#else
+ avail -= (m->m_off + iclen);
+ if (xtra > avail)
+ xtra = avail;
+ iclen += xtra;
+#endif
+ m->m_len = iclen;
+ ip = mtod(m, ip_t *);
+ icmp = (struct icmp *)((char *)ip + hlen);
+ bzero((char *)ip, iclen);
+
+ icmp->icmp_type = type;
+ icmp->icmp_code = fin->fin_icode;
+ icmp->icmp_cksum = 0;
+ if (avail) {
+ bcopy((char *)oip, (char *)&icmp->icmp_ip, MIN(ohlen, avail));
+ avail -= MIN(ohlen, avail);
+ }
+
+#ifdef USE_INET6
+ ip6 = (ip6_t *)ip;
+ if (fin->fin_v == 6) {
+ ip6->ip6_flow = 0;
+ ip6->ip6_plen = htons(iclen - hlen);
+ ip6->ip6_nxt = IPPROTO_ICMPV6;
+ ip6->ip6_hlim = 0;
+ ip6->ip6_src = dst6;
+ ip6->ip6_dst = oip6->ip6_src;
+ if (avail)
+ bcopy((char *)oip + ohlen,
+ (char *)&icmp->icmp_ip + ohlen, avail);
+ icmp->icmp_cksum = in6_cksum(m, IPPROTO_ICMPV6,
+ sizeof(*ip6), iclen - hlen);
+ } else
+#endif
+ {
+ ip->ip_src.s_addr = dst4.s_addr;
+ ip->ip_dst.s_addr = oip->ip_src.s_addr;
+
+ if (avail > 8)
+ avail = 8;
+ if (avail)
+ bcopy((char *)oip + ohlen,
+ (char *)&icmp->icmp_ip + ohlen, avail);
+ icmp->icmp_cksum = ipf_cksum((u_short *)icmp,
+ sizeof(*icmp) + 8);
+ ip->ip_len = iclen;
+ ip->ip_p = IPPROTO_ICMP;
+ }
+ err = send_ip(oip, fin, m);
return err;
}
@@ -865,7 +1210,8 @@ void
# endif
iplinit()
{
- (void) iplattach();
+ if (iplattach() != 0)
+ printf("IP Filter failed to attach\n");
ip_init();
}
# endif /* ! __NetBSD__ */
@@ -882,7 +1228,7 @@ register struct mbuf *m0;
}
-void ipfr_fastroute(m0, fin, fdp)
+int ipfr_fastroute(m0, fin, fdp)
struct mbuf *m0;
fr_info_t *fin;
frdest_t *fdp;
@@ -890,13 +1236,24 @@ frdest_t *fdp;
register struct ip *ip, *mhip;
register struct mbuf *m = m0;
register struct route *ro;
- struct ifnet *ifp = fdp->fd_ifp;
- int len, off, error = 0;
- int hlen = fin->fin_hlen;
- struct route iproute;
+ int len, off, error = 0, hlen, code;
+ struct ifnet *ifp, *sifp;
struct sockaddr_in *dst;
+ struct route iproute;
+ frentry_t *fr;
+ hlen = fin->fin_hlen;
ip = mtod(m0, struct ip *);
+
+#ifdef USE_INET6
+ if (ip->ip_v == 6) {
+ /*
+ * currently "to <if>" and "to <if>:ip#" are not supported
+ * for IPv6
+ */
+ return ip6_output(m0, NULL, NULL, 0, NULL, NULL);
+ }
+#endif
/*
* Route packet.
*/
@@ -904,13 +1261,32 @@ frdest_t *fdp;
bzero((caddr_t)ro, sizeof (*ro));
dst = (struct sockaddr_in *)&ro->ro_dst;
dst->sin_family = AF_INET;
- dst->sin_addr = fdp->fd_ip.s_addr ? fdp->fd_ip : ip->ip_dst;
-# ifdef __bsdi__
+
+ fr = fin->fin_fr;
+ if (fdp)
+ ifp = fdp->fd_ifp;
+ else {
+ ifp = fin->fin_ifp;
+ dst->sin_addr = ip->ip_dst;
+ }
+
+ /*
+ * In case we're here due to "to <if>" being used with "keep state",
+ * check that we're going in the correct direction.
+ */
+ if ((fr != NULL) && (fin->fin_rev != 0)) {
+ if ((ifp != NULL) && (fdp == &fr->fr_tif))
+ return -1;
+ dst->sin_addr = ip->ip_dst;
+ } else if (fdp)
+ dst->sin_addr = fdp->fd_ip.s_addr ? fdp->fd_ip : ip->ip_dst;
+
+# if BSD >= 199306
dst->sin_len = sizeof(*dst);
# endif
# if (BSD >= 199306) && !defined(__NetBSD__) && !defined(__bsdi__) && \
!defined(__OpenBSD__)
-# ifdef RTF_CLONING
+# ifdef RTF_CLONING
rtalloc_ign(ro, RTF_CLONING);
# else
rtalloc_ign(ro, RTF_PRCLONING);
@@ -919,7 +1295,7 @@ frdest_t *fdp;
rtalloc(ro);
# endif
if (!ifp) {
- if (!(fin->fin_fr->fr_flags & FR_FASTROUTE)) {
+ if (!fr || !(fr->fr_flags & FR_FASTROUTE)) {
error = -2;
goto bad;
}
@@ -939,15 +1315,36 @@ frdest_t *fdp;
/*
* For input packets which are being "fastrouted", they won't
* go back through output filtering and miss their chance to get
- * NAT'd.
+ * NAT'd and counted.
*/
- (void) ip_natout(ip, hlen, fin);
- if (fin->fin_out)
+ fin->fin_ifp = ifp;
+ if (fin->fin_out == 0) {
+ fin->fin_out = 1;
+ if ((fin->fin_fr = ipacct[1][fr_active]) &&
+ (fr_scanlist(FR_NOMATCH, ip, fin, m) & FR_ACCOUNT)) {
+ ATOMIC_INCL(frstats[1].fr_acct);
+ }
+ fin->fin_fr = NULL;
+ if (!fr || !(fr->fr_flags & FR_RETMASK)) {
+ (void) fr_checkstate(ip, fin);
+ (void) ip_natout(ip, fin);
+ }
+ } else
ip->ip_sum = 0;
/*
* If small enough for interface, can just send directly.
*/
if (ip->ip_len <= ifp->if_mtu) {
+# if BSD >= 199306
+ int i = 0;
+
+# ifdef MCLISREFERENCED
+ if ((m->m_flags & M_EXT) && MCLISREFERENCED(m))
+# else
+ if (m->m_flags & M_EXT)
+# endif
+ i = 1;
+# endif
# ifndef sparc
ip->ip_id = htons(ip->ip_id);
ip->ip_len = htons(ip->ip_len);
@@ -958,6 +1355,11 @@ frdest_t *fdp;
# if BSD >= 199306
error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst,
ro->ro_rt);
+ if (i) {
+ ip->ip_id = ntohs(ip->ip_id);
+ ip->ip_len = ntohs(ip->ip_len);
+ ip->ip_off = ntohs(ip->ip_off);
+ }
# else
error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst);
# endif
@@ -988,7 +1390,11 @@ frdest_t *fdp;
m0 = m;
mhlen = sizeof (struct ip);
for (off = hlen + len; off < ip->ip_len; off += len) {
+# ifdef MGETHDR
+ MGETHDR(m, M_DONTWAIT, MT_HEADER);
+# else
MGET(m, M_DONTWAIT, MT_HEADER);
+# endif
if (m == 0) {
error = ENOBUFS;
goto bad;
@@ -1018,6 +1424,10 @@ frdest_t *fdp;
error = ENOBUFS; /* ??? */
goto sendorfree;
}
+# if BSD >= 199306
+ m->m_pkthdr.len = mhlen + len;
+ m->m_pkthdr.rcvif = NULL;
+# endif
# ifndef sparc
mhip->ip_off = htons((u_short)mhip->ip_off);
# endif
@@ -1057,70 +1467,104 @@ done:
else
ipl_frouteok[1]++;
- if (ro->ro_rt) {
+ if (ro->ro_rt)
RTFREE(ro->ro_rt);
- }
- return;
+ return 0;
bad:
+ if (error == EMSGSIZE) {
+ sifp = fin->fin_ifp;
+ code = fin->fin_icode;
+ fin->fin_icode = ICMP_UNREACH_NEEDFRAG;
+ fin->fin_ifp = ifp;
+ (void) send_icmp_err(ip, ICMP_UNREACH, fin, 1);
+ fin->fin_ifp = sifp;
+ fin->fin_icode = code;
+ }
m_freem(m);
goto done;
}
+
+
+int fr_verifysrc(ipa, ifp)
+struct in_addr ipa;
+void *ifp;
+{
+ struct sockaddr_in *dst;
+ struct route iproute;
+
+ bzero((char *)&iproute, sizeof(iproute));
+ dst = (struct sockaddr_in *)&iproute.ro_dst;
+ dst->sin_family = AF_INET;
+ dst->sin_addr = ipa;
+# if (BSD >= 199306) && !defined(__NetBSD__) && !defined(__bsdi__) && \
+ !defined(__OpenBSD__)
+# ifdef RTF_CLONING
+ rtalloc_ign(&iproute, RTF_CLONING);
+# else
+ rtalloc_ign(&iproute, RTF_PRCLONING);
+# endif
+# else
+ rtalloc(&iproute);
+# endif
+ if (iproute.ro_rt == NULL)
+ return 0;
+ return (ifp == iproute.ro_rt->rt_ifp);
+}
+
#else /* #ifdef _KERNEL */
-#ifdef __sgi
+# ifdef __sgi
static int no_output __P((struct ifnet *ifp, struct mbuf *m,
struct sockaddr *s))
-#else
+# else
static int no_output __P((struct ifnet *ifp, struct mbuf *m,
struct sockaddr *s, struct rtentry *rt))
-#endif
+# endif
{
return 0;
}
# ifdef __STDC__
-#ifdef __sgi
+# ifdef __sgi
static int write_output __P((struct ifnet *ifp, struct mbuf *m,
struct sockaddr *s))
-#else
+# else
static int write_output __P((struct ifnet *ifp, struct mbuf *m,
struct sockaddr *s, struct rtentry *rt))
-#endif
+# endif
{
-# if !(defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199606)) || \
- (defined(OpenBSD) && (OpenBSD >= 199603))
ip_t *ip = (ip_t *)m;
-# endif
# else
static int write_output(ifp, ip)
struct ifnet *ifp;
ip_t *ip;
{
# endif
- FILE *fp;
char fname[32];
+ int fd;
# if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199606)) || \
(defined(OpenBSD) && (OpenBSD >= 199603))
sprintf(fname, "/tmp/%s", ifp->if_xname);
- if ((fp = fopen(fname, "a"))) {
- fclose(fp);
- }
# else
sprintf(fname, "/tmp/%s%d", ifp->if_name, ifp->if_unit);
- if ((fp = fopen(fname, "a"))) {
- fwrite((char *)ip, ntohs(ip->ip_len), 1, fp);
- fclose(fp);
- }
# endif
+ fd = open(fname, O_WRONLY|O_APPEND);
+ if (fd == -1) {
+ perror("open");
+ return -1;
+ }
+ write(fd, (char *)ip, ntohs(ip->ip_len));
+ close(fd);
return 0;
}
-struct ifnet *get_unit(name)
+struct ifnet *get_unit(name, v)
char *name;
+int v;
{
struct ifnet *ifp, **ifa;
# if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199606)) || \
@@ -1177,30 +1621,37 @@ char *name;
void init_ifp()
{
- FILE *fp;
struct ifnet *ifp, **ifa;
char fname[32];
+ int fd;
+
# if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199606)) || \
(defined(OpenBSD) && (OpenBSD >= 199603))
for (ifa = ifneta; ifa && (ifp = *ifa); ifa++) {
ifp->if_output = write_output;
sprintf(fname, "/tmp/%s", ifp->if_xname);
- if ((fp = fopen(fname, "w")))
- fclose(fp);
+ fd = open(fname, O_WRONLY|O_CREAT|O_EXCL|O_TRUNC, 0600);
+ if (fd == -1)
+ perror("open");
+ else
+ close(fd);
}
# else
for (ifa = ifneta; ifa && (ifp = *ifa); ifa++) {
ifp->if_output = write_output;
sprintf(fname, "/tmp/%s%d", ifp->if_name, ifp->if_unit);
- if ((fp = fopen(fname, "w")))
- fclose(fp);
+ fd = open(fname, O_WRONLY|O_CREAT|O_EXCL|O_TRUNC, 0600);
+ if (fd == -1)
+ perror("open");
+ else
+ close(fd);
}
# endif
}
-void ipfr_fastroute(ip, fin, fdp)
+int ipfr_fastroute(ip, fin, fdp)
ip_t *ip;
fr_info_t *fin;
frdest_t *fdp;
@@ -1208,7 +1659,7 @@ frdest_t *fdp;
struct ifnet *ifp = fdp->fd_ifp;
if (!ifp)
- return; /* no routing table out here */
+ return 0; /* no routing table out here */
ip->ip_len = htons((u_short)ip->ip_len);
ip->ip_off = htons((u_short)(ip->ip_off | IP_MF));
@@ -1218,6 +1669,7 @@ frdest_t *fdp;
#else
(*ifp->if_output)(ifp, (void *)ip, NULL, 0);
#endif
+ return 0;
}
@@ -1244,4 +1696,10 @@ struct ifnet *ifp;
verbose("- TCP RST sent\n");
return 0;
}
+
+
+void frsync()
+{
+ return;
+}
#endif /* _KERNEL */
diff --git a/sys/netinet/ip_fil.h b/sys/netinet/ip_fil.h
index edbd68556016..14f486167488 100644
--- a/sys/netinet/ip_fil.h
+++ b/sys/netinet/ip_fil.h
@@ -1,12 +1,12 @@
/*
- * Copyright (C) 1993-1997 by Darren Reed.
+ * Copyright (C) 1993-2000 by Darren Reed.
*
* Redistribution and use in source and binary forms are permitted
* provided that this notice is preserved and due credit is given
* to the original author and the contributors.
*
* @(#)ip_fil.h 1.35 6/5/96
- * $Id: ip_fil.h,v 2.0.2.39.2.11 1998/05/23 14:29:37 darrenr Exp $
+ * $Id: ip_fil.h,v 2.29.2.2 2000/05/22 10:26:13 darrenr Exp $
*/
#ifndef __IP_FIL_H__
@@ -21,11 +21,11 @@
#define IPAUTH_NAME "/dev/ipauth"
#ifndef SOLARIS
-#define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4)))
+# define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4)))
#endif
#if defined(KERNEL) && !defined(_KERNEL)
-#define _KERNEL
+# define _KERNEL
#endif
#ifndef __P
@@ -37,94 +37,132 @@
#endif
#if defined(__STDC__) || defined(__GNUC__)
-#define SIOCADAFR _IOW('r', 60, struct frentry)
-#define SIOCRMAFR _IOW('r', 61, struct frentry)
-#define SIOCSETFF _IOW('r', 62, u_int)
-#define SIOCGETFF _IOR('r', 63, u_int)
-#define SIOCGETFS _IOR('r', 64, struct friostat)
-#define SIOCIPFFL _IOWR('r', 65, int)
-#define SIOCIPFFB _IOR('r', 66, int)
-#define SIOCADIFR _IOW('r', 67, struct frentry)
-#define SIOCRMIFR _IOW('r', 68, struct frentry)
-#define SIOCSWAPA _IOR('r', 69, u_int)
-#define SIOCINAFR _IOW('r', 70, struct frentry)
-#define SIOCINIFR _IOW('r', 71, struct frentry)
-#define SIOCFRENB _IOW('r', 72, u_int)
-#define SIOCFRSYN _IOW('r', 73, u_int)
-#define SIOCFRZST _IOWR('r', 74, struct friostat)
-#define SIOCZRLST _IOWR('r', 75, struct frentry)
-#define SIOCAUTHW _IOWR('r', 76, struct fr_info)
-#define SIOCAUTHR _IOWR('r', 77, struct fr_info)
-#define SIOCATHST _IOWR('r', 78, struct fr_authstat)
+# define SIOCADAFR _IOW('r', 60, struct frentry *)
+# define SIOCRMAFR _IOW('r', 61, struct frentry *)
+# define SIOCSETFF _IOW('r', 62, u_int)
+# define SIOCGETFF _IOR('r', 63, u_int)
+# define SIOCGETFS _IOWR('r', 64, struct friostat *)
+# define SIOCIPFFL _IOWR('r', 65, int)
+# define SIOCIPFFB _IOR('r', 66, int)
+# define SIOCADIFR _IOW('r', 67, struct frentry *)
+# define SIOCRMIFR _IOW('r', 68, struct frentry *)
+# define SIOCSWAPA _IOR('r', 69, u_int)
+# define SIOCINAFR _IOW('r', 70, struct frentry *)
+# define SIOCINIFR _IOW('r', 71, struct frentry *)
+# define SIOCFRENB _IOW('r', 72, u_int)
+# define SIOCFRSYN _IOW('r', 73, u_int)
+# define SIOCFRZST _IOWR('r', 74, struct friostat *)
+# define SIOCZRLST _IOWR('r', 75, struct frentry *)
+# define SIOCAUTHW _IOWR('r', 76, struct fr_info *)
+# define SIOCAUTHR _IOWR('r', 77, struct fr_info *)
+# define SIOCATHST _IOWR('r', 78, struct fr_authstat *)
+# define SIOCSTLCK _IOWR('r', 79, u_int)
+# define SIOCSTPUT _IOWR('r', 80, struct ipstate_save *)
+# define SIOCSTGET _IOWR('r', 81, struct ipstate_save *)
+# define SIOCSTGSZ _IOWR('r', 82, struct natget *)
+# define SIOCGFRST _IOWR('r', 83, struct ipfrstat *)
#else
-#define SIOCADAFR _IOW(r, 60, struct frentry)
-#define SIOCRMAFR _IOW(r, 61, struct frentry)
-#define SIOCSETFF _IOW(r, 62, u_int)
-#define SIOCGETFF _IOR(r, 63, u_int)
-#define SIOCGETFS _IOR(r, 64, struct friostat)
-#define SIOCIPFFL _IOWR(r, 65, int)
-#define SIOCIPFFB _IOR(r, 66, int)
-#define SIOCADIFR _IOW(r, 67, struct frentry)
-#define SIOCRMIFR _IOW(r, 68, struct frentry)
-#define SIOCSWAPA _IOR(r, 69, u_int)
-#define SIOCINAFR _IOW(r, 70, struct frentry)
-#define SIOCINIFR _IOW(r, 71, struct frentry)
-#define SIOCFRENB _IOW(r, 72, u_int)
-#define SIOCFRSYN _IOW(r, 73, u_int)
-#define SIOCFRZST _IOWR(r, 74, struct friostat)
-#define SIOCZRLST _IOWR(r, 75, struct frentry)
-#define SIOCAUTHW _IOWR(r, 76, struct fr_info)
-#define SIOCAUTHR _IOWR(r, 77, struct fr_info)
-#define SIOCATHST _IOWR(r, 78, struct fr_authstat)
+# define SIOCADAFR _IOW(r, 60, struct frentry *)
+# define SIOCRMAFR _IOW(r, 61, struct frentry *)
+# define SIOCSETFF _IOW(r, 62, u_int)
+# define SIOCGETFF _IOR(r, 63, u_int)
+# define SIOCGETFS _IOWR(r, 64, struct friostat *)
+# define SIOCIPFFL _IOWR(r, 65, int)
+# define SIOCIPFFB _IOR(r, 66, int)
+# define SIOCADIFR _IOW(r, 67, struct frentry *)
+# define SIOCRMIFR _IOW(r, 68, struct frentry *)
+# define SIOCSWAPA _IOR(r, 69, u_int)
+# define SIOCINAFR _IOW(r, 70, struct frentry *)
+# define SIOCINIFR _IOW(r, 71, struct frentry *)
+# define SIOCFRENB _IOW(r, 72, u_int)
+# define SIOCFRSYN _IOW(r, 73, u_int)
+# define SIOCFRZST _IOWR(r, 74, struct friostat *)
+# define SIOCZRLST _IOWR(r, 75, struct frentry *)
+# define SIOCAUTHW _IOWR(r, 76, struct fr_info *)
+# define SIOCAUTHR _IOWR(r, 77, struct fr_info *)
+# define SIOCATHST _IOWR(r, 78, struct fr_authstat *)
+# define SIOCSTLCK _IOWR(r, 79, u_int)
+# define SIOCSTPUT _IOWR(r, 80, struct ipstate_save *)
+# define SIOCSTGET _IOWR(r, 81, struct ipstate_save *)
+# define SIOCSTGSZ _IOWR(r, 82, struct natget *)
+# define SIOCGFRST _IOWR(r, 83, struct ipfrstat *)
#endif
#define SIOCADDFR SIOCADAFR
#define SIOCDELFR SIOCRMAFR
#define SIOCINSFR SIOCINAFR
+
typedef struct fr_ip {
- u_char fi_v:4; /* IP version */
- u_char fi_fl:4; /* packet flags */
- u_char fi_tos;
- u_char fi_ttl;
- u_char fi_p;
- struct in_addr fi_src;
- struct in_addr fi_dst;
+ u_32_t fi_v:4; /* IP version */
+ u_32_t fi_fl:4; /* packet flags */
+ u_32_t fi_tos:8; /* IP packet TOS */
+ u_32_t fi_ttl:8; /* IP packet TTL */
+ u_32_t fi_p:8; /* IP packet protocol */
+ union i6addr fi_src; /* source address from packet */
+ union i6addr fi_dst; /* destination address from packet */
u_32_t fi_optmsk; /* bitmask composed from IP options */
u_short fi_secmsk; /* bitmask composed from IP security options */
- u_short fi_auth;
+ u_short fi_auth; /* authentication code from IP sec. options */
} fr_ip_t;
#define FI_OPTIONS (FF_OPTIONS >> 24)
#define FI_TCPUDP (FF_TCPUDP >> 24) /* TCP/UCP implied comparison*/
#define FI_FRAG (FF_FRAG >> 24)
#define FI_SHORT (FF_SHORT >> 24)
+#define FI_CMP (FI_OPTIONS|FI_TCPUDP|FI_SHORT)
+
+#define fi_saddr fi_src.in4.s_addr
+#define fi_daddr fi_dst.in4.s_addr
+
+
+/*
+ * These are both used by the state and NAT code to indicate that one port or
+ * the other should be treated as a wildcard.
+ */
+#define FI_W_SPORT 0x00000100
+#define FI_W_DPORT 0x00000200
+#define FI_WILDP (FI_W_SPORT|FI_W_DPORT)
+#define FI_W_SADDR 0x00000400
+#define FI_W_DADDR 0x00000800
+#define FI_WILDA (FI_W_SADDR|FI_W_DADDR)
+#define FI_NEWFR 0x00001000
typedef struct fr_info {
- struct fr_ip fin_fi;
- u_short fin_data[2];
- u_short fin_out;
- u_short fin_hlen;
- u_char fin_tcpf;
- u_char fin_icode; /* From here on is packet specific */
- u_short fin_rule;
- u_short fin_group;
- u_short fin_dlen;
- u_short fin_id;
- void *fin_ifp;
- struct frentry *fin_fr;
+ void *fin_ifp; /* interface packet is `on' */
+ struct fr_ip fin_fi; /* IP Packet summary */
+ u_short fin_data[2]; /* TCP/UDP ports, ICMP code/type */
+ u_char fin_out; /* in or out ? 1 == out, 0 == in */
+ u_char fin_rev; /* state only: 1 = reverse */
+ u_short fin_hlen; /* length of IP header in bytes */
+ u_char fin_tcpf; /* TCP header flags (SYN, ACK, etc) */
+ /* From here on is packet specific */
+ u_char fin_icode; /* ICMP error to return */
+ u_short fin_rule; /* rule # last matched */
+ u_32_t fin_group; /* group number, -1 for none */
+ struct frentry *fin_fr; /* last matching rule */
char *fin_dp; /* start of data past IP header */
- void *fin_mp;
+ u_short fin_dlen; /* length of data portion of packet */
+ u_short fin_id; /* IP packet id field */
+ void *fin_mp; /* pointer to pointer to mbuf */
+#if SOLARIS
+ void *fin_qfm; /* pointer to mblk where pkt starts */
+ void *fin_qif;
+#endif
+ u_short fin_plen;
+ u_short fin_off;
} fr_info_t;
+#define fin_v fin_fi.fi_v
+
/*
* Size for compares on fr_info structures
*/
-#define FI_CSIZE (sizeof(struct fr_ip) + sizeof(u_short) * 4 + \
- sizeof(u_char))
+#define FI_CSIZE offsetof(fr_info_t, fin_icode)
+
/*
* Size for copying cache fr_info structure
*/
-#define FI_COPYSIZE (sizeof(fr_info_t) - sizeof(void *) * 2)
+#define FI_COPYSIZE offsetof(fr_info_t, fin_dp)
typedef struct frdest {
void *fd_ifp;
@@ -132,13 +170,36 @@ typedef struct frdest {
char fd_ifname[IFNAMSIZ];
} frdest_t;
+typedef struct frpcmp {
+ int frp_cmp; /* data for port comparisons */
+ u_short frp_port; /* top port for <> and >< */
+ u_short frp_top; /* top port for <> and >< */
+} frpcmp_t;
+
+typedef struct frtuc {
+ u_char ftu_tcpfm; /* tcp flags mask */
+ u_char ftu_tcpf; /* tcp flags */
+ frpcmp_t ftu_src;
+ frpcmp_t ftu_dst;
+} frtuc_t;
+
+#define ftu_scmp ftu_src.frp_cmp
+#define ftu_dcmp ftu_dst.frp_cmp
+#define ftu_sport ftu_src.frp_port
+#define ftu_dport ftu_dst.frp_port
+#define ftu_stop ftu_src.frp_top
+#define ftu_dtop ftu_dst.frp_top
+
typedef struct frentry {
struct frentry *fr_next;
- u_short fr_group; /* group to which this rule belongs */
- u_short fr_grhead; /* group # which this rule starts */
+ u_32_t fr_group; /* group to which this rule belongs */
+ u_32_t fr_grhead; /* group # which this rule starts */
struct frentry *fr_grp;
int fr_ref; /* reference count - for grouping */
void *fr_ifa;
+#if BSD >= 199306
+ void *fr_oifa;
+#endif
/*
* These are only incremented when a packet matches this rule and
* it is the last match
@@ -151,34 +212,42 @@ typedef struct frentry {
struct fr_ip fr_ip;
struct fr_ip fr_mip; /* mask structure */
- u_char fr_tcpfm; /* tcp flags mask */
- u_char fr_tcpf; /* tcp flags */
u_short fr_icmpm; /* data for ICMP packets (mask) */
u_short fr_icmp;
- u_char fr_scmp; /* data for port comparisons */
- u_char fr_dcmp;
- u_short fr_dport;
- u_short fr_sport;
- u_short fr_stop; /* top port for <> and >< */
- u_short fr_dtop; /* top port for <> and >< */
+ frtuc_t fr_tuc;
u_32_t fr_flags; /* per-rule flags && options (see below) */
- int fr_skip; /* # of rules to skip */
+ u_int fr_skip; /* # of rules to skip */
+ u_int fr_loglevel; /* syslog log facility + priority */
int (*fr_func) __P((int, ip_t *, fr_info_t *)); /* call this function */
- char fr_icode; /* return ICMP code */
+ int fr_sap; /* For solaris only */
+ u_char fr_icode; /* return ICMP code */
char fr_ifname[IFNAMSIZ];
+#if BSD >= 199306
+ char fr_oifname[IFNAMSIZ];
+#endif
struct frdest fr_tif; /* "to" interface */
struct frdest fr_dif; /* duplicate packet interfaces */
+ u_int fr_cksum; /* checksum on filter rules for performance */
} frentry_t;
+#define fr_v fr_ip.fi_v
#define fr_proto fr_ip.fi_p
#define fr_ttl fr_ip.fi_ttl
#define fr_tos fr_ip.fi_tos
-#define fr_dst fr_ip.fi_dst
-#define fr_src fr_ip.fi_src
-#define fr_dmsk fr_mip.fi_dst
-#define fr_smsk fr_mip.fi_src
+#define fr_tcpfm fr_tuc.ftu_tcpfm
+#define fr_tcpf fr_tuc.ftu_tcpf
+#define fr_scmp fr_tuc.ftu_scmp
+#define fr_dcmp fr_tuc.ftu_dcmp
+#define fr_dport fr_tuc.ftu_dport
+#define fr_sport fr_tuc.ftu_sport
+#define fr_stop fr_tuc.ftu_stop
+#define fr_dtop fr_tuc.ftu_dtop
+#define fr_dst fr_ip.fi_dst.in4
+#define fr_src fr_ip.fi_src.in4
+#define fr_dmsk fr_mip.fi_dst.in4
+#define fr_smsk fr_mip.fi_src.in4
#ifndef offsetof
#define offsetof(t,m) (int)((&((t *)0L)->m))
@@ -199,6 +268,7 @@ typedef struct frentry {
#define FR_LOGFIRST 0x00040 /* Log the first byte if state held */
#define FR_RETRST 0x00080 /* Return TCP RST packet - reset connection */
#define FR_RETICMP 0x00100 /* Return ICMP unreachable packet */
+#define FR_FAKEICMP 0x00180 /* Return ICMP unreachable with fake source */
#define FR_NOMATCH 0x00200 /* no match occured */
#define FR_ACCOUNT 0x00400 /* count packet bytes */
#define FR_KEEPFRAG 0x00800 /* keep fragment information */
@@ -213,8 +283,10 @@ typedef struct frentry {
#define FR_NOTDSTIP 0x100000 /* not the dst IP# */
#define FR_AUTH 0x200000 /* use authentication */
#define FR_PREAUTH 0x400000 /* require preauthentication */
+#define FR_DONTCACHE 0x800000 /* don't cache the result */
#define FR_LOGMASK (FR_LOG|FR_LOGP|FR_LOGB)
+#define FR_RETMASK (FR_RETICMP|FR_RETRST|FR_FAKEICMP)
/*
* These correspond to #define's for FI_* and are stored in fr_flags
@@ -246,6 +318,7 @@ typedef struct filterstats {
u_long fr_pass; /* packets allowed */
u_long fr_block; /* packets denied */
u_long fr_nom; /* packets which don't match any rule */
+ u_long fr_short; /* packets which are short */
u_long fr_ppkl; /* packets allowed and logged */
u_long fr_bpkl; /* packets denied and logged */
u_long fr_npkl; /* packets unmatched and logged */
@@ -261,11 +334,16 @@ typedef struct filterstats {
u_long fr_chit; /* cached hit */
u_long fr_tcpbad; /* TCP checksum check failures */
u_long fr_pull[2]; /* good and bad pullup attempts */
+ u_long fr_badsrc; /* source received doesn't match route */
#if SOLARIS
+ u_long fr_notdata; /* PROTO/PCPROTO that have no data */
+ u_long fr_nodata; /* mblks that have no data */
u_long fr_bad; /* bad IP packets to the filter */
u_long fr_notip; /* packets passed through no on ip queue */
u_long fr_drop; /* packets dropped - no info for them! */
+ u_long fr_copy; /* messages copied due to db_ref > 1 */
#endif
+ u_long fr_ipv6[2]; /* IPv6 packets in/out */
} filterstats_t;
/*
@@ -277,9 +355,19 @@ typedef struct friostat {
struct frentry *f_fout[2];
struct frentry *f_acctin[2];
struct frentry *f_acctout[2];
+ struct frentry *f_fin6[2];
+ struct frentry *f_fout6[2];
+ struct frentry *f_acctin6[2];
+ struct frentry *f_acctout6[2];
struct frentry *f_auth;
+ struct frgroup *f_groups[3][2];
u_long f_froute[2];
- int f_active;
+ int f_defpass; /* default pass - from fr_pass */
+ char f_active; /* 1 or 0 - active rule set */
+ char f_running; /* 1 if running, else 0 */
+ char f_logging; /* 1 if enabled, else 0 */
+ char f_version[32]; /* version string */
+ int f_locks[4];
} friostat_t;
typedef struct optlist {
@@ -292,7 +380,7 @@ typedef struct optlist {
* Group list structure.
*/
typedef struct frgroup {
- u_short fg_num;
+ u_32_t fg_num;
struct frgroup *fg_next;
struct frentry *fg_head;
struct frentry **fg_start;
@@ -305,11 +393,10 @@ typedef struct frgroup {
* structure which is then followed by any packet data.
*/
typedef struct iplog {
- u_long ipl_magic;
+ u_32_t ipl_magic;
+ u_int ipl_count;
u_long ipl_sec;
u_long ipl_usec;
- u_int ipl_len;
- u_int ipl_count;
size_t ipl_dsize;
struct iplog *ipl_next;
} iplog_t;
@@ -326,21 +413,23 @@ typedef struct ipflog {
#endif
u_char fl_plen; /* extra data after hlen */
u_char fl_hlen; /* length of IP headers saved */
- u_short fl_rule; /* assume never more than 64k rules, total */
- u_short fl_group;
+ u_short fl_loglevel; /* syslog log level */
+ u_32_t fl_rule;
+ u_32_t fl_group;
u_32_t fl_flags;
+ u_32_t fl_lflags;
} ipflog_t;
#ifndef ICMP_UNREACH_FILTER
-#define ICMP_UNREACH_FILTER 13
+# define ICMP_UNREACH_FILTER 13
#endif
#ifndef IPF_LOGGING
-#define IPF_LOGGING 0
+# define IPF_LOGGING 0
#endif
#ifndef IPF_DEFAULT_PASS
-#define IPF_DEFAULT_PASS FR_PASS
+# define IPF_DEFAULT_PASS FR_PASS
#endif
#define IPMINLEN(i, h) ((i)->ip_len >= ((i)->ip_hl * 4 + sizeof(struct h)))
@@ -372,16 +461,32 @@ typedef struct ipflog {
# define CDEV_MAJOR 79
#endif
+/*
+ * Post NetBSD 1.2 has the PFIL interface for packet filters. This turns
+ * on those hooks. We don't need any special mods in non-IP Filter code
+ * with this!
+ */
+#if (defined(NetBSD) && (NetBSD > 199609) && (NetBSD <= 1991011)) || \
+ (defined(NetBSD1_2) && NetBSD1_2 > 1)
+# if (NetBSD >= 199905)
+# define PFIL_HOOKS
+# endif
+# ifdef PFIL_HOOKS
+# define NETBSD_PF
+# endif
+#endif
+
+
#ifndef _KERNEL
extern int fr_check __P((ip_t *, int, void *, int, mb_t **));
extern int (*fr_checkp) __P((ip_t *, int, void *, int, mb_t **));
extern int send_reset __P((ip_t *, struct ifnet *));
extern int icmp_error __P((ip_t *, struct ifnet *));
extern int ipf_log __P((void));
-extern void ipfr_fastroute __P((ip_t *, fr_info_t *, frdest_t *));
-extern struct ifnet *get_unit __P((char *));
-# define FR_SCANLIST(p, ip, fi, m) fr_scanlist(p, ip, fi, m)
-# if defined(__NetBSD__) || defined(__OpenBSD__) || (_BSDI_VERSION >= 199701)
+extern int ipfr_fastroute __P((ip_t *, fr_info_t *, frdest_t *));
+extern struct ifnet *get_unit __P((char *, int));
+# if defined(__NetBSD__) || defined(__OpenBSD__) || \
+ (_BSDI_VERSION >= 199701) || (__FreeBSD_version >= 300000)
extern int iplioctl __P((dev_t, u_long, caddr_t, int));
# else
extern int iplioctl __P((dev_t, int, caddr_t, int));
@@ -390,45 +495,43 @@ extern int iplopen __P((dev_t, int));
extern int iplclose __P((dev_t, int));
#else /* #ifndef _KERNEL */
# if defined(__NetBSD__) && defined(PFIL_HOOKS)
-extern int ipfilterattach __P((int));
+extern void ipfilterattach __P((int));
# endif
extern int iplattach __P((void));
extern int ipl_enable __P((void));
extern int ipl_disable __P((void));
extern void ipflog_init __P((void));
-extern int ipflog_clear __P((int));
-extern int ipflog_read __P((int, struct uio *));
+extern int ipflog_clear __P((minor_t));
+extern int ipflog_read __P((minor_t, struct uio *));
extern int ipflog __P((u_int, ip_t *, fr_info_t *, mb_t *));
-extern int ipllog __P((int, u_long, void **, size_t *, int *, int));
+extern int ipllog __P((int, fr_info_t *, void **, size_t *, int *, int));
+extern int send_icmp_err __P((ip_t *, int, fr_info_t *, int));
+extern int send_reset __P((ip_t *, fr_info_t *));
# if SOLARIS
extern int fr_check __P((ip_t *, int, void *, int, qif_t *, mb_t **));
extern int (*fr_checkp) __P((ip_t *, int, void *,
int, qif_t *, mb_t **));
-extern int icmp_error __P((ip_t *, int, int, qif_t *,
- struct in_addr));
-extern int iplioctl __P((dev_t, int, int, int, cred_t *, int *));
+# if SOLARIS2 >= 7
+extern int iplioctl __P((dev_t, int, intptr_t, int, cred_t *, int *));
+# else
+extern int iplioctl __P((dev_t, int, int *, int, cred_t *, int *));
+# endif
extern int iplopen __P((dev_t *, int, int, cred_t *));
extern int iplclose __P((dev_t, int, int, cred_t *));
extern int ipfsync __P((void));
-extern int send_reset __P((ip_t *, qif_t *));
extern int ipfr_fastroute __P((qif_t *, ip_t *, mblk_t *, mblk_t **,
fr_info_t *, frdest_t *));
-extern void copyin_mblk __P((mblk_t *, int, int, char *));
-extern void copyout_mblk __P((mblk_t *, int, int, char *));
+extern void copyin_mblk __P((mblk_t *, size_t, size_t, char *));
+extern void copyout_mblk __P((mblk_t *, size_t, size_t, char *));
extern int fr_qin __P((queue_t *, mblk_t *));
extern int fr_qout __P((queue_t *, mblk_t *));
-# ifdef IPFILTER_LOG
extern int iplread __P((dev_t, struct uio *, cred_t *));
-# endif
# else /* SOLARIS */
extern int fr_check __P((ip_t *, int, void *, int, mb_t **));
extern int (*fr_checkp) __P((ip_t *, int, void *, int, mb_t **));
-# ifdef linux
-extern int send_reset __P((tcpiphdr_t *, struct ifnet *));
-# else
-extern int send_reset __P((tcpiphdr_t *));
-# endif
-extern void ipfr_fastroute __P((mb_t *, fr_info_t *, frdest_t *));
+extern int send_reset __P((struct ip *, fr_info_t *));
+extern int send_icmp_err __P((ip_t *, int, fr_info_t *, int));
+extern int ipfr_fastroute __P((mb_t *, fr_info_t *, frdest_t *));
extern size_t mbufchainlen __P((mb_t *));
# ifdef __sgi
# include <sys/cred.h>
@@ -445,8 +548,9 @@ extern void ipfilter_sgi_intfsync __P((void));
extern int iplidentify __P((char *));
# endif
# if (_BSDI_VERSION >= 199510) || (__FreeBSD_version >= 220000) || \
- (NetBSD >= 199511)
-# if defined(__NetBSD__) || (_BSDI_VERSION >= 199701)
+ (NetBSD >= 199511) || defined(__OpenBSD__)
+# if defined(__NetBSD__) || (_BSDI_VERSION >= 199701) || \
+ defined(__OpenBSD__) || (__FreeBSD_version >= 300000)
extern int iplioctl __P((dev_t, u_long, caddr_t, int, struct proc *));
# else
extern int iplioctl __P((dev_t, int, caddr_t, int, struct proc *));
@@ -454,19 +558,12 @@ extern int iplioctl __P((dev_t, int, caddr_t, int, struct proc *));
extern int iplopen __P((dev_t, int, int, struct proc *));
extern int iplclose __P((dev_t, int, int, struct proc *));
# else
-# if defined(__OpenBSD__)
-extern int iplioctl __P((dev_t, u_long, caddr_t, int));
-# else /* __OpenBSD__ */
-# ifndef linux
-extern int iplioctl __P((dev_t, int, caddr_t, int));
-# else
-extern int iplioctl(struct inode *, struct file *, u_int, u_long);
-# endif
-# endif /* __OpenBSD__ */
-# ifndef linux
+# ifndef linux
extern int iplopen __P((dev_t, int));
extern int iplclose __P((dev_t, int));
+extern int iplioctl __P((dev_t, int, caddr_t, int));
# else
+extern int iplioctl(struct inode *, struct file *, u_int, u_long);
extern int iplopen __P((struct inode *, struct file *));
extern void iplclose __P((struct inode *, struct file *));
# endif /* !linux */
@@ -484,38 +581,49 @@ extern int iplread(struct inode *, struct file *, char *, int);
# endif /* SOLARIS */
#endif /* #ifndef _KERNEL */
-/*
- * Post NetBSD 1.2 has the PFIL interface for packet filters. This turns
- * on those hooks. We don't need any special mods in non-IP Filter code
- * with this!
- */
-#if (defined(NetBSD) && (NetBSD > 199609) && (NetBSD <= 1991011)) || \
- (defined(NetBSD1_2) && NetBSD1_2 > 1)
-# define NETBSD_PF
-#endif
-
+extern char *memstr __P((char *, char *, int, int));
+extern void fixskip __P((frentry_t **, frentry_t *, int));
+extern int countbits __P((u_32_t));
extern int ipldetach __P((void));
-extern u_short fr_tcpsum __P((mb_t *, ip_t *, tcphdr_t *, int));
-#define FR_SCANLIST(p, ip, fi, m) fr_scanlist(p, ip, fi, m)
-extern int fr_scanlist __P((int, ip_t *, fr_info_t *, void *));
extern u_short ipf_cksum __P((u_short *, int));
+extern int ircopyptr __P((void *, void *, size_t));
+extern int iwcopyptr __P((void *, void *, size_t));
+
+extern int frflush __P((minor_t, int));
+extern void frsync __P((void));
+extern frgroup_t *fr_addgroup __P((u_32_t, frentry_t *, minor_t, int));
+extern void fr_delgroup __P((u_32_t, u_32_t, minor_t, int));
+extern frgroup_t *fr_findgroup __P((u_32_t, u_32_t, minor_t, int,
+ frgroup_t ***));
+
extern int fr_copytolog __P((int, char *, int));
-extern void frflush __P((int, int *));
-extern frgroup_t *fr_addgroup __P((u_short, frentry_t *, int, int));
-extern frgroup_t *fr_findgroup __P((u_short, u_32_t, int, int, frgroup_t ***));
-extern void fr_delgroup __P((u_short, u_32_t, int, int));
+extern void fr_forgetifp __P((void *));
+extern void fr_getstat __P((struct friostat *));
+extern int fr_ifpaddr __P((int, void *, struct in_addr *));
+extern int fr_lock __P((caddr_t, int *));
+extern void fr_makefrip __P((int, ip_t *, fr_info_t *));
+extern u_short fr_tcpsum __P((mb_t *, ip_t *, tcphdr_t *));
+extern int fr_scanlist __P((u_32_t, ip_t *, fr_info_t *, void *));
+extern int fr_tcpudpchk __P((frtuc_t *, fr_info_t *));
+extern int fr_verifysrc __P((struct in_addr, void *));
+
extern int ipl_unreach;
-extern int ipl_inited;
+extern int fr_running;
extern u_long ipl_frouteok[2];
extern int fr_pass;
extern int fr_flags;
extern int fr_active;
+extern int fr_chksrc;
extern fr_info_t frcache[2];
-#ifdef IPFILTER_LOG
+extern char ipfilter_version[];
extern iplog_t **iplh[IPL_LOGMAX+1], *iplt[IPL_LOGMAX+1];
-extern int iplused[IPL_LOGMAX + 1];
-#endif
+extern size_t iplused[IPL_LOGMAX + 1];
extern struct frentry *ipfilter[2][2], *ipacct[2][2];
+#ifdef USE_INET6
+extern struct frentry *ipfilter6[2][2], *ipacct6[2][2];
+extern int icmptoicmp6types[ICMP_MAXTYPE+1];
+extern int icmptoicmp6unreach[ICMP_MAX_UNREACH];
+#endif
extern struct frgroup *ipfgroups[3][2];
extern struct filterstats frstats[];
diff --git a/sys/netinet/ip_frag.c b/sys/netinet/ip_frag.c
index 923f68522261..3e0a7f392e56 100644
--- a/sys/netinet/ip_frag.c
+++ b/sys/netinet/ip_frag.c
@@ -1,59 +1,68 @@
/*
- * Copyright (C) 1993-1997 by Darren Reed.
+ * Copyright (C) 1993-2000 by Darren Reed.
*
* Redistribution and use in source and binary forms are permitted
* provided that this notice is preserved and due credit is given
* to the original author and the contributors.
*/
#if !defined(lint)
-static const char sccsid[] = "@(#)ip_frag.c 1.11 3/24/96 (C) 1993-1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_frag.c,v 2.0.2.19.2.1 1997/11/12 10:50:21 darrenr Exp $";
+static const char sccsid[] = "@(#)ip_frag.c 1.11 3/24/96 (C) 1993-2000 Darren Reed";
+static const char rcsid[] = "@(#)$Id: ip_frag.c,v 2.10.2.3 2000/05/05 15:10:23 darrenr Exp $";
#endif
-#if !defined(_KERNEL) && !defined(KERNEL)
-# include <string.h>
-# include <stdlib.h>
+#if defined(KERNEL) && !defined(_KERNEL)
+# define _KERNEL
#endif
+
#include <sys/errno.h>
#include <sys/types.h>
#include <sys/param.h>
#include <sys/time.h>
#include <sys/file.h>
-#if defined(KERNEL) && (__FreeBSD_version >= 220000)
-#include <sys/filio.h>
-#include <sys/fcntl.h>
+#if !defined(_KERNEL) && !defined(KERNEL)
+# include <stdio.h>
+# include <string.h>
+# include <stdlib.h>
+#endif
+#if (defined(KERNEL) || defined(_KERNEL)) && (__FreeBSD_version >= 220000)
+# include <sys/filio.h>
+# include <sys/fcntl.h>
#else
-#include <sys/ioctl.h>
+# include <sys/ioctl.h>
#endif
#include <sys/uio.h>
#ifndef linux
-#include <sys/protosw.h>
+# include <sys/protosw.h>
#endif
#include <sys/socket.h>
#if defined(_KERNEL) && !defined(linux)
# include <sys/systm.h>
#endif
#if !defined(__SVR4) && !defined(__svr4__)
+# if defined(_KERNEL) && !defined(__sgi)
+# include <sys/kernel.h>
+# endif
# ifndef linux
# include <sys/mbuf.h>
# endif
#else
# include <sys/byteorder.h>
-# include <sys/dditypes.h>
+# ifdef _KERNEL
+# include <sys/dditypes.h>
+# endif
# include <sys/stream.h>
# include <sys/kmem.h>
#endif
-
#include <net/if.h>
#ifdef sun
-#include <net/af.h>
+# include <net/af.h>
#endif
#include <net/route.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#ifndef linux
-#include <netinet/ip_var.h>
+# include <netinet/ip_var.h>
#endif
#include <netinet/tcp.h>
#include <netinet/udp.h>
@@ -66,24 +75,51 @@ static const char rcsid[] = "@(#)$Id: ip_frag.c,v 2.0.2.19.2.1 1997/11/12 10:50:
#include "netinet/ip_frag.h"
#include "netinet/ip_state.h"
#include "netinet/ip_auth.h"
+#if (__FreeBSD_version >= 300000)
+# include <sys/malloc.h>
+# if (defined(KERNEL) || defined(_KERNEL))
+# ifndef IPFILTER_LKM
+# include <sys/libkern.h>
+# include <sys/systm.h>
+# endif
+extern struct callout_handle ipfr_slowtimer_ch;
+# endif
+#endif
+#if defined(__NetBSD__) && (__NetBSD_Version__ >= 104230000)
+# include <sys/callout.h>
+extern struct callout ipfr_slowtimer_ch;
+#endif
+
+
+static ipfr_t *ipfr_heads[IPFT_SIZE];
+static ipfr_t *ipfr_nattab[IPFT_SIZE];
+static ipfrstat_t ipfr_stats;
+static int ipfr_inuse = 0;
+
+int fr_ipfrttl = 120; /* 60 seconds */
+int fr_frag_lock = 0;
-ipfr_t *ipfr_heads[IPFT_SIZE];
-ipfr_t *ipfr_nattab[IPFT_SIZE];
-ipfrstat_t ipfr_stats;
-int ipfr_inuse = 0,
- fr_ipfrttl = 120; /* 60 seconds */
#ifdef _KERNEL
+# if SOLARIS2 >= 7
+extern timeout_id_t ipfr_timer_id;
+# else
extern int ipfr_timer_id;
+# endif
#endif
#if (SOLARIS || defined(__sgi)) && defined(_KERNEL)
-extern kmutex_t ipf_frag;
-extern kmutex_t ipf_natfrag;
-extern kmutex_t ipf_nat;
+extern KRWLOCK_T ipf_frag, ipf_natfrag, ipf_nat, ipf_mutex;
+# if SOLARIS
+extern KRWLOCK_T ipf_solaris;
+# else
+KRWLOCK_T ipf_solaris;
+# endif
+extern kmutex_t ipf_rw;
#endif
-static ipfr_t *ipfr_new __P((ip_t *, fr_info_t *, int, ipfr_t **));
+static ipfr_t *ipfr_new __P((ip_t *, fr_info_t *, u_int, ipfr_t **));
static ipfr_t *ipfr_lookup __P((ip_t *, fr_info_t *, ipfr_t **));
+static void ipfr_delete __P((ipfr_t *));
ipfrstat_t *ipfr_fragstats()
@@ -102,10 +138,10 @@ ipfrstat_t *ipfr_fragstats()
static ipfr_t *ipfr_new(ip, fin, pass, table)
ip_t *ip;
fr_info_t *fin;
-int pass;
+u_int pass;
ipfr_t *table[];
{
- ipfr_t **fp, *fr, frag;
+ ipfr_t **fp, *fra, frag;
u_int idx;
frag.ipfr_p = ip->ip_p;
@@ -123,10 +159,10 @@ ipfr_t *table[];
/*
* first, make sure it isn't already there...
*/
- for (fp = &table[idx]; (fr = *fp); fp = &fr->ipfr_next)
- if (!bcmp((char *)&frag.ipfr_src, (char *)&fr->ipfr_src,
+ for (fp = &table[idx]; (fra = *fp); fp = &fra->ipfr_next)
+ if (!bcmp((char *)&frag.ipfr_src, (char *)&fra->ipfr_src,
IPFR_CMPSZ)) {
- ipfr_stats.ifs_exists++;
+ ATOMIC_INCL(ipfr_stats.ifs_exists);
return NULL;
}
@@ -134,45 +170,51 @@ ipfr_t *table[];
* allocate some memory, if possible, if not, just record that we
* failed to do so.
*/
- KMALLOC(fr, ipfr_t *, sizeof(*fr));
- if (fr == NULL) {
- ipfr_stats.ifs_nomem++;
+ KMALLOC(fra, ipfr_t *);
+ if (fra == NULL) {
+ ATOMIC_INCL(ipfr_stats.ifs_nomem);
return NULL;
}
+ if ((fra->ipfr_rule = fin->fin_fr) != NULL) {
+ ATOMIC_INC32(fin->fin_fr->fr_ref);
+ }
+
+
/*
* Instert the fragment into the fragment table, copy the struct used
* in the search using bcopy rather than reassign each field.
* Set the ttl to the default and mask out logging from "pass"
*/
- if ((fr->ipfr_next = table[idx]))
- table[idx]->ipfr_prev = fr;
- fr->ipfr_prev = NULL;
- fr->ipfr_data = NULL;
- table[idx] = fr;
- bcopy((char *)&frag.ipfr_src, (char *)&fr->ipfr_src, IPFR_CMPSZ);
- fr->ipfr_ttl = fr_ipfrttl;
- fr->ipfr_pass = pass & ~(FR_LOGFIRST|FR_LOG);
+ if ((fra->ipfr_next = table[idx]))
+ table[idx]->ipfr_prev = fra;
+ fra->ipfr_prev = NULL;
+ fra->ipfr_data = NULL;
+ table[idx] = fra;
+ bcopy((char *)&frag.ipfr_src, (char *)&fra->ipfr_src, IPFR_CMPSZ);
+ fra->ipfr_ttl = fr_ipfrttl;
/*
* Compute the offset of the expected start of the next packet.
*/
- fr->ipfr_off = (ip->ip_off & 0x1fff) + (fin->fin_dlen >> 3);
- ipfr_stats.ifs_new++;
- ipfr_inuse++;
- return fr;
+ fra->ipfr_off = (ip->ip_off & IP_OFFMASK) + (fin->fin_dlen >> 3);
+ ATOMIC_INCL(ipfr_stats.ifs_new);
+ ATOMIC_INC32(ipfr_inuse);
+ return fra;
}
int ipfr_newfrag(ip, fin, pass)
ip_t *ip;
fr_info_t *fin;
-int pass;
+u_int pass;
{
ipfr_t *ipf;
- MUTEX_ENTER(&ipf_frag);
+ if ((ip->ip_v != 4) || (fr_frag_lock))
+ return NULL;
+ WRITE_ENTER(&ipf_frag);
ipf = ipfr_new(ip, fin, pass, ipfr_heads);
- MUTEX_EXIT(&ipf_frag);
+ RWLOCK_EXIT(&ipf_frag);
return ipf ? 0 : -1;
}
@@ -180,17 +222,20 @@ int pass;
int ipfr_nat_newfrag(ip, fin, pass, nat)
ip_t *ip;
fr_info_t *fin;
-int pass;
+u_int pass;
nat_t *nat;
{
ipfr_t *ipf;
- MUTEX_ENTER(&ipf_natfrag);
- if ((ipf = ipfr_new(ip, fin, pass, ipfr_nattab))) {
+ if ((ip->ip_v != 4) || (fr_frag_lock))
+ return NULL;
+ WRITE_ENTER(&ipf_natfrag);
+ ipf = ipfr_new(ip, fin, pass, ipfr_nattab);
+ if (ipf != NULL) {
ipf->ipfr_data = nat;
nat->nat_data = ipf;
}
- MUTEX_EXIT(&ipf_natfrag);
+ RWLOCK_EXIT(&ipf_natfrag);
return ipf ? 0 : -1;
}
@@ -245,19 +290,19 @@ ipfr_t *table[];
f->ipfr_prev = NULL;
table[idx] = f;
}
- off = ip->ip_off;
+ off = ip->ip_off & IP_OFFMASK;
atoff = off + (fin->fin_dlen >> 3);
/*
* If we've follwed the fragments, and this is the
* last (in order), shrink expiration time.
*/
- if ((off & 0x1fff) == f->ipfr_off) {
- if (!(off & IP_MF))
+ if (off == f->ipfr_off) {
+ if (!(ip->ip_off & IP_MF))
f->ipfr_ttl = 1;
else
f->ipfr_off = atoff;
}
- ipfr_stats.ifs_hits++;
+ ATOMIC_INCL(ipfr_stats.ifs_hits);
return f;
}
return NULL;
@@ -274,20 +319,22 @@ fr_info_t *fin;
nat_t *nat;
ipfr_t *ipf;
- MUTEX_ENTER(&ipf_natfrag);
+ if ((ip->ip_v != 4) || (fr_frag_lock))
+ return NULL;
+ READ_ENTER(&ipf_natfrag);
ipf = ipfr_lookup(ip, fin, ipfr_nattab);
- if (ipf) {
+ if (ipf != NULL) {
nat = ipf->ipfr_data;
/*
* This is the last fragment for this packet.
*/
- if (ipf->ipfr_ttl == 1) {
+ if ((ipf->ipfr_ttl == 1) && (nat != NULL)) {
nat->nat_data = NULL;
ipf->ipfr_data = NULL;
}
} else
nat = NULL;
- MUTEX_EXIT(&ipf_natfrag);
+ RWLOCK_EXIT(&ipf_natfrag);
return nat;
}
@@ -295,18 +342,21 @@ fr_info_t *fin;
/*
* functional interface for normal lookups of the fragment cache
*/
-int ipfr_knownfrag(ip, fin)
+frentry_t *ipfr_knownfrag(ip, fin)
ip_t *ip;
fr_info_t *fin;
{
- int ret;
- ipfr_t *ipf;
+ frentry_t *fr = NULL;
+ ipfr_t *fra;
- MUTEX_ENTER(&ipf_frag);
- ipf = ipfr_lookup(ip, fin, ipfr_heads);
- ret = ipf ? ipf->ipfr_pass : 0;
- MUTEX_EXIT(&ipf_frag);
- return ret;
+ if ((ip->ip_v != 4) || (fr_frag_lock))
+ return NULL;
+ READ_ENTER(&ipf_frag);
+ fra = ipfr_lookup(ip, fin, ipfr_heads);
+ if (fra != NULL)
+ fr = fra->ipfr_rule;
+ RWLOCK_EXIT(&ipf_frag);
+ return fr;
}
@@ -319,13 +369,32 @@ void *nat;
ipfr_t *fr;
int idx;
- MUTEX_ENTER(&ipf_natfrag);
+ WRITE_ENTER(&ipf_natfrag);
for (idx = IPFT_SIZE - 1; idx >= 0; idx--)
for (fr = ipfr_heads[idx]; fr; fr = fr->ipfr_next)
if (fr->ipfr_data == nat)
fr->ipfr_data = NULL;
- MUTEX_EXIT(&ipf_natfrag);
+ RWLOCK_EXIT(&ipf_natfrag);
+}
+
+
+static void ipfr_delete(fra)
+ipfr_t *fra;
+{
+ frentry_t *fr;
+
+ fr = fra->ipfr_rule;
+ if (fr != NULL) {
+ ATOMIC_DEC32(fr->fr_ref);
+ if (fr->fr_ref == 0)
+ KFREE(fr);
+ }
+ if (fra->ipfr_prev)
+ fra->ipfr_prev->ipfr_next = fra->ipfr_next;
+ if (fra->ipfr_next)
+ fra->ipfr_next->ipfr_prev = fra->ipfr_prev;
+ KFREE(fra);
}
@@ -334,55 +403,52 @@ void *nat;
*/
void ipfr_unload()
{
- ipfr_t **fp, *fr;
+ ipfr_t **fp, *fra;
nat_t *nat;
int idx;
- MUTEX_ENTER(&ipf_frag);
+ WRITE_ENTER(&ipf_frag);
for (idx = IPFT_SIZE - 1; idx >= 0; idx--)
- for (fp = &ipfr_heads[idx]; (fr = *fp); ) {
- *fp = fr->ipfr_next;
- KFREE(fr);
+ for (fp = &ipfr_heads[idx]; (fra = *fp); ) {
+ *fp = fra->ipfr_next;
+ ipfr_delete(fra);
}
- MUTEX_EXIT(&ipf_frag);
+ RWLOCK_EXIT(&ipf_frag);
- MUTEX_ENTER(&ipf_nat);
- MUTEX_ENTER(&ipf_natfrag);
+ WRITE_ENTER(&ipf_nat);
+ WRITE_ENTER(&ipf_natfrag);
for (idx = IPFT_SIZE - 1; idx >= 0; idx--)
- for (fp = &ipfr_nattab[idx]; (fr = *fp); ) {
- *fp = fr->ipfr_next;
- if ((nat = (nat_t *)fr->ipfr_data)) {
- if (nat->nat_data == fr)
+ for (fp = &ipfr_nattab[idx]; (fra = *fp); ) {
+ *fp = fra->ipfr_next;
+ nat = fra->ipfr_data;
+ if (nat != NULL) {
+ if (nat->nat_data == fra)
nat->nat_data = NULL;
}
- KFREE(fr);
+ ipfr_delete(fra);
}
- MUTEX_EXIT(&ipf_natfrag);
- MUTEX_EXIT(&ipf_nat);
+ RWLOCK_EXIT(&ipf_natfrag);
+ RWLOCK_EXIT(&ipf_nat);
}
#ifdef _KERNEL
-/*
- * Slowly expire held state for fragments. Timeouts are set * in expectation
- * of this being called twice per second.
- */
-# if (BSD >= 199306) || SOLARIS || defined(__sgi)
-void ipfr_slowtimer()
-# else
-int ipfr_slowtimer()
-# endif
+void ipfr_fragexpire()
{
- ipfr_t **fp, *fr;
+ ipfr_t **fp, *fra;
nat_t *nat;
- int s, idx;
-
-#ifdef __sgi
- ipfilter_sgi_intfsync();
+ int idx;
+#if defined(_KERNEL)
+# if !SOLARIS
+ int s;
+# endif
#endif
+ if (fr_frag_lock)
+ return;
+
SPL_NET(s);
- MUTEX_ENTER(&ipf_frag);
+ WRITE_ENTER(&ipf_frag);
/*
* Go through the entire table, looking for entries to expire,
@@ -390,23 +456,17 @@ int ipfr_slowtimer()
* remove it from the chain and free it.
*/
for (idx = IPFT_SIZE - 1; idx >= 0; idx--)
- for (fp = &ipfr_heads[idx]; (fr = *fp); ) {
- --fr->ipfr_ttl;
- if (fr->ipfr_ttl == 0) {
- if (fr->ipfr_prev)
- fr->ipfr_prev->ipfr_next =
- fr->ipfr_next;
- if (fr->ipfr_next)
- fr->ipfr_next->ipfr_prev =
- fr->ipfr_prev;
- *fp = fr->ipfr_next;
- ipfr_stats.ifs_expire++;
- ipfr_inuse--;
- KFREE(fr);
+ for (fp = &ipfr_heads[idx]; (fra = *fp); ) {
+ --fra->ipfr_ttl;
+ if (fra->ipfr_ttl == 0) {
+ *fp = fra->ipfr_next;
+ ipfr_delete(fra);
+ ATOMIC_INCL(ipfr_stats.ifs_expire);
+ ATOMIC_DEC32(ipfr_inuse);
} else
- fp = &fr->ipfr_next;
+ fp = &fra->ipfr_next;
}
- MUTEX_EXIT(&ipf_frag);
+ RWLOCK_EXIT(&ipf_frag);
/*
* Same again for the NAT table, except that if the structure also
@@ -415,44 +475,76 @@ int ipfr_slowtimer()
* NOTE: We need to grab both mutex's early, and in this order so as
* to prevent a deadlock if both try to expire at the same time.
*/
- MUTEX_ENTER(&ipf_nat);
- MUTEX_ENTER(&ipf_natfrag);
+ WRITE_ENTER(&ipf_nat);
+ WRITE_ENTER(&ipf_natfrag);
for (idx = IPFT_SIZE - 1; idx >= 0; idx--)
- for (fp = &ipfr_nattab[idx]; (fr = *fp); ) {
- --fr->ipfr_ttl;
- if (fr->ipfr_ttl == 0) {
- if (fr->ipfr_prev)
- fr->ipfr_prev->ipfr_next =
- fr->ipfr_next;
- if (fr->ipfr_next)
- fr->ipfr_next->ipfr_prev =
- fr->ipfr_prev;
- *fp = fr->ipfr_next;
- ipfr_stats.ifs_expire++;
- ipfr_inuse--;
- if ((nat = (nat_t *)fr->ipfr_data)) {
- if (nat->nat_data == fr)
+ for (fp = &ipfr_nattab[idx]; (fra = *fp); ) {
+ --fra->ipfr_ttl;
+ if (fra->ipfr_ttl == 0) {
+ ATOMIC_INCL(ipfr_stats.ifs_expire);
+ ATOMIC_DEC32(ipfr_inuse);
+ nat = fra->ipfr_data;
+ if (nat != NULL) {
+ if (nat->nat_data == fra)
nat->nat_data = NULL;
}
- KFREE(fr);
+ *fp = fra->ipfr_next;
+ ipfr_delete(fra);
} else
- fp = &fr->ipfr_next;
+ fp = &fra->ipfr_next;
}
- MUTEX_EXIT(&ipf_natfrag);
- MUTEX_EXIT(&ipf_nat);
+ RWLOCK_EXIT(&ipf_natfrag);
+ RWLOCK_EXIT(&ipf_nat);
SPL_X(s);
+}
+
+
+/*
+ * Slowly expire held state for fragments. Timeouts are set * in expectation
+ * of this being called twice per second.
+ */
+# if (BSD >= 199306) || SOLARIS || defined(__sgi)
+# if defined(SOLARIS2) && (SOLARIS2 < 7)
+void ipfr_slowtimer()
+# else
+void ipfr_slowtimer __P((void *ptr))
+# endif
+# else
+int ipfr_slowtimer()
+# endif
+{
+#if defined(_KERNEL) && SOLARIS
+ extern int fr_running;
+
+ if (fr_running <= 0)
+ return;
+#endif
+
+ READ_ENTER(&ipf_solaris);
+#ifdef __sgi
+ ipfilter_sgi_intfsync();
+#endif
+
+ ipfr_fragexpire();
fr_timeoutstate();
ip_natexpire();
fr_authexpire();
-# if SOLARIS
+# if SOLARIS
ipfr_timer_id = timeout(ipfr_slowtimer, NULL, drv_usectohz(500000));
+ RWLOCK_EXIT(&ipf_solaris);
# else
-# ifndef linux
- ip_slowtimo();
-# endif
-# if (BSD < 199306) && !defined(__sgi)
+# if defined(__NetBSD__) && (__NetBSD_Version__ >= 104240000)
+ callout_reset(&ipfr_slowtimer_ch, hz / 2, ipfr_slowtimer, NULL);
+# else
+# if (__FreeBSD_version >= 300000)
+ ipfr_slowtimer_ch = timeout(ipfr_slowtimer, NULL, hz/2);
+# else
+ timeout(ipfr_slowtimer, NULL, hz/2);
+# endif
+# if (BSD < 199306) && !defined(__sgi)
return 0;
-# endif
-# endif
+# endif /* FreeBSD */
+# endif /* NetBSD */
+# endif /* SOLARIS */
}
#endif /* defined(_KERNEL) */
diff --git a/sys/netinet/ip_frag.h b/sys/netinet/ip_frag.h
index 9122f17a5115..6a3bd2caf79b 100644
--- a/sys/netinet/ip_frag.h
+++ b/sys/netinet/ip_frag.h
@@ -1,12 +1,12 @@
/*
- * Copyright (C) 1993-1997 by Darren Reed.
+ * Copyright (C) 1993-2000 by Darren Reed.
*
* Redistribution and use in source and binary forms are permitted
* provided that this notice is preserved and due credit is given
* to the original author and the contributors.
*
* @(#)ip_frag.h 1.5 3/24/96
- * $Id: ip_frag.h,v 2.0.2.12.2.1 1998/05/23 14:29:39 darrenr Exp $
+ * $Id: ip_frag.h,v 2.4 2000/03/13 22:10:21 darrenr Exp $
*/
#ifndef __IP_FRAG_H__
@@ -24,7 +24,7 @@ typedef struct ipfr {
u_char ipfr_tos;
u_short ipfr_off;
u_short ipfr_ttl;
- u_char ipfr_pass;
+ frentry_t *ipfr_rule;
} ipfr_t;
@@ -42,16 +42,22 @@ typedef struct ipfrstat {
#define IPFR_CMPSZ (4 + 4 + 2 + 1 + 1)
extern int fr_ipfrttl;
+extern int fr_frag_lock;
extern ipfrstat_t *ipfr_fragstats __P((void));
-extern int ipfr_newfrag __P((ip_t *, fr_info_t *, int));
-extern int ipfr_nat_newfrag __P((ip_t *, fr_info_t *, int, struct nat *));
+extern int ipfr_newfrag __P((ip_t *, fr_info_t *, u_int));
+extern int ipfr_nat_newfrag __P((ip_t *, fr_info_t *, u_int, struct nat *));
extern nat_t *ipfr_nat_knownfrag __P((ip_t *, fr_info_t *));
-extern int ipfr_knownfrag __P((ip_t *, fr_info_t *));
+extern frentry_t *ipfr_knownfrag __P((ip_t *, fr_info_t *));
extern void ipfr_forget __P((void *));
extern void ipfr_unload __P((void));
+extern void ipfr_fragexpire __P((void));
#if (BSD >= 199306) || SOLARIS || defined(__sgi)
+# if defined(SOLARIS2) && (SOLARIS2 < 7)
extern void ipfr_slowtimer __P((void));
+# else
+extern void ipfr_slowtimer __P((void *));
+# endif
#else
extern int ipfr_slowtimer __P((void));
#endif
diff --git a/sys/netinet/ip_ftp_pxy.c b/sys/netinet/ip_ftp_pxy.c
index 7ff8adb50e78..691e0ad05daa 100644
--- a/sys/netinet/ip_ftp_pxy.c
+++ b/sys/netinet/ip_ftp_pxy.c
@@ -1,214 +1,433 @@
/*
* Simple FTP transparent proxy for in-kernel use. For use with the NAT
* code.
+ *
+ * $Id: ip_ftp_pxy.c,v 2.7.2.7 2000/05/13 14:28:14 darrenr Exp $
*/
+#if SOLARIS && defined(_KERNEL)
+extern kmutex_t ipf_rw;
+#endif
#define isdigit(x) ((x) >= '0' && (x) <= '9')
+#define isupper(x) ((unsigned)((x) - 'A') <= 'Z' - 'A')
#define IPF_FTP_PROXY
#define IPF_MINPORTLEN 18
#define IPF_MAXPORTLEN 30
+#define IPF_MIN227LEN 39
+#define IPF_MAX227LEN 51
+#define IPF_FTPBUFSZ 96 /* This *MUST* be >= 53! */
-int ippr_ftp_init __P((fr_info_t *, ip_t *, tcphdr_t *,
- ap_session_t *, nat_t *));
-int ippr_ftp_in __P((fr_info_t *, ip_t *, tcphdr_t *,
- ap_session_t *, nat_t *));
-int ippr_ftp_out __P((fr_info_t *, ip_t *, tcphdr_t *,
- ap_session_t *, nat_t *));
-u_short ipf_ftp_atoi __P((char **));
-
-
-int ippr_ftp_init __P((fr_info_t *, ip_t *, tcphdr_t *, ap_session_t *,
- nat_t *));
-int ippr_ftp_in __P((fr_info_t *, ip_t *, tcphdr_t *, ap_session_t *,
- nat_t *));
-int ippr_ftp_out __P((fr_info_t *, ip_t *, tcphdr_t *, ap_session_t *,
- nat_t *));
-
-u_short ipf_ftp_atoi __P((char **));
+int ippr_ftp_client __P((fr_info_t *, ip_t *, nat_t *, ftpinfo_t *, int));
+int ippr_ftp_complete __P((char *, size_t));
+int ippr_ftp_in __P((fr_info_t *, ip_t *, ap_session_t *, nat_t *));
+int ippr_ftp_init __P((void));
+int ippr_ftp_new __P((fr_info_t *, ip_t *, ap_session_t *, nat_t *));
+int ippr_ftp_out __P((fr_info_t *, ip_t *, ap_session_t *, nat_t *));
+int ippr_ftp_pasv __P((fr_info_t *, ip_t *, nat_t *, ftpside_t *, int));
+int ippr_ftp_port __P((fr_info_t *, ip_t *, nat_t *, ftpside_t *, int));
+int ippr_ftp_process __P((fr_info_t *, ip_t *, nat_t *, ftpinfo_t *, int));
+int ippr_ftp_server __P((fr_info_t *, ip_t *, nat_t *, ftpinfo_t *, int));
+int ippr_ftp_valid __P((char *, size_t));
+u_short ippr_ftp_atoi __P((char **));
+static frentry_t natfr;
+int ippr_ftp_pasvonly = 0;
/*
- * FTP application proxy initialization.
+ * Initialize local structures.
*/
-int ippr_ftp_init(fin, ip, tcp, aps, nat)
+int ippr_ftp_init()
+{
+ bzero((char *)&natfr, sizeof(natfr));
+ natfr.fr_ref = 1;
+ natfr.fr_flags = FR_INQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE;
+ return 0;
+}
+
+
+int ippr_ftp_new(fin, ip, aps, nat)
fr_info_t *fin;
ip_t *ip;
-tcphdr_t *tcp;
ap_session_t *aps;
nat_t *nat;
{
- aps->aps_sport = tcp->th_sport;
- aps->aps_dport = tcp->th_dport;
+ ftpinfo_t *ftp;
+ ftpside_t *f;
+
+ KMALLOC(ftp, ftpinfo_t *);
+ if (ftp == NULL)
+ return -1;
+ aps->aps_data = ftp;
+ aps->aps_psiz = sizeof(ftpinfo_t);
+
+ bzero((char *)ftp, sizeof(*ftp));
+ f = &ftp->ftp_side[0];
+ f->ftps_rptr = f->ftps_buf;
+ f->ftps_wptr = f->ftps_buf;
+ f = &ftp->ftp_side[1];
+ f->ftps_rptr = f->ftps_buf;
+ f->ftps_wptr = f->ftps_buf;
return 0;
}
-int ippr_ftp_in(fin, ip, tcp, aps, nat)
+int ippr_ftp_port(fin, ip, nat, f, dlen)
fr_info_t *fin;
ip_t *ip;
-tcphdr_t *tcp;
-ap_session_t *aps;
nat_t *nat;
+ftpside_t *f;
+int dlen;
{
- u_32_t sum1, sum2;
- short sel;
-
- if (tcp->th_sport == aps->aps_dport) {
- sum2 = (u_32_t)ntohl(tcp->th_ack);
- sel = aps->aps_sel;
- if ((aps->aps_after[!sel] > aps->aps_after[sel]) &&
- (sum2 > aps->aps_after[!sel])) {
- sel = aps->aps_sel = !sel; /* switch to other set */
- }
- if (aps->aps_seqoff[sel] && (sum2 > aps->aps_after[sel])) {
- sum1 = (u_32_t)aps->aps_seqoff[sel];
- tcp->th_ack = htonl(sum2 - sum1);
- return 2;
- }
+ tcphdr_t *tcp, tcph, *tcp2 = &tcph;
+ char newbuf[IPF_FTPBUFSZ], *s;
+ u_short a5, a6, sp, dp;
+ u_int a1, a2, a3, a4;
+ struct in_addr swip;
+ size_t nlen, olen;
+ fr_info_t fi;
+ int inc, off;
+ nat_t *ipn;
+ mb_t *m;
+#if SOLARIS
+ mb_t *m1;
+#endif
+
+ tcp = (tcphdr_t *)fin->fin_dp;
+ off = f->ftps_seq - ntohl(tcp->th_seq);
+ if (off < 0)
+ return 0;
+ /*
+ * Check for client sending out PORT message.
+ */
+ if (dlen < IPF_MINPORTLEN)
+ return 0;
+ /*
+ * Count the number of bytes in the PORT message is.
+ */
+ if (off < 0)
+ return 0;
+
+ off += fin->fin_hlen + (tcp->th_off << 2);
+ /*
+ * Skip the PORT command + space
+ */
+ s = f->ftps_rptr + 5;
+ /*
+ * Pick out the address components, two at a time.
+ */
+ a1 = ippr_ftp_atoi(&s);
+ if (!s)
+ return 0;
+ a2 = ippr_ftp_atoi(&s);
+ if (!s)
+ return 0;
+ /*
+ * check that IP address in the PORT/PASV reply is the same as the
+ * sender of the command - prevents using PORT for port scanning.
+ */
+ a1 <<= 16;
+ a1 |= a2;
+ if (a1 != ntohl(nat->nat_inip.s_addr))
+ return 0;
+
+ a5 = ippr_ftp_atoi(&s);
+ if (!s)
+ return 0;
+ if (*s == ')')
+ s++;
+
+ /*
+ * check for CR-LF at the end.
+ */
+ if (*s == '\n')
+ s--;
+ if ((*s == '\r') && (*(s + 1) == '\n')) {
+ s += 2;
+ a6 = a5 & 0xff;
+ } else
+ return 0;
+ a5 >>= 8;
+ /*
+ * Calculate new address parts for PORT command
+ */
+ a1 = ntohl(ip->ip_src.s_addr);
+ a2 = (a1 >> 16) & 0xff;
+ a3 = (a1 >> 8) & 0xff;
+ a4 = a1 & 0xff;
+ a1 >>= 24;
+ olen = s - f->ftps_rptr;
+ /* DO NOT change this to sprintf! */
+ (void) sprintf(newbuf, "%s %u,%u,%u,%u,%u,%u\r\n",
+ "PORT", a1, a2, a3, a4, a5, a6);
+
+ nlen = strlen(newbuf);
+ inc = nlen - olen;
+ if ((inc + ip->ip_len) > 65535)
+ return 0;
+
+#if SOLARIS
+ m = fin->fin_qfm;
+ for (m1 = m; m1->b_cont; m1 = m1->b_cont)
+ ;
+ if ((inc > 0) && (m1->b_datap->db_lim - m1->b_wptr < inc)) {
+ mblk_t *nm;
+
+ /* alloc enough to keep same trailer space for lower driver */
+ nm = allocb(nlen, BPRI_MED);
+ PANIC((!nm),("ippr_ftp_out: allocb failed"));
+
+ nm->b_band = m1->b_band;
+ nm->b_wptr += nlen;
+
+ m1->b_wptr -= olen;
+ PANIC((m1->b_wptr < m1->b_rptr),
+ ("ippr_ftp_out: cannot handle fragmented data block"));
+
+ linkb(m1, nm);
+ } else {
+ if (m1->b_datap->db_struiolim == m1->b_wptr)
+ m1->b_datap->db_struiolim += inc;
+ m1->b_datap->db_struioflag &= ~STRUIO_IP;
+ m1->b_wptr += inc;
}
- return 0;
-}
+ copyin_mblk(m, off, nlen, newbuf);
+#else
+ m = *((mb_t **)fin->fin_mp);
+ if (inc < 0)
+ m_adj(m, inc);
+ /* the mbuf chain will be extended if necessary by m_copyback() */
+ m_copyback(m, off, nlen, newbuf);
+#endif
+ if (inc != 0) {
+#if SOLARIS || defined(__sgi)
+ register u_32_t sum1, sum2;
+ sum1 = ip->ip_len;
+ sum2 = ip->ip_len + inc;
-/*
- * ipf_ftp_atoi - implement a version of atoi which processes numbers in
- * pairs separated by commas (which are expected to be in the range 0 - 255),
- * returning a 16 bit number combining either side of the , as the MSB and
- * LSB.
- */
-u_short ipf_ftp_atoi(ptr)
-char **ptr;
-{
- register char *s = *ptr, c;
- register u_char i = 0, j = 0;
+ /* Because ~1 == -2, We really need ~1 == -1 */
+ if (sum1 > sum2)
+ sum2--;
+ sum2 -= sum1;
+ sum2 = (sum2 & 0xffff) + (sum2 >> 16);
- while ((c = *s++) && isdigit(c)) {
- i *= 10;
- i += c - '0';
+ fix_outcksum(&ip->ip_sum, sum2, 0);
+#endif
+ ip->ip_len += inc;
}
- if (c != ',') {
- *ptr = NULL;
+
+ /*
+ * Add skeleton NAT entry for connection which will come back the
+ * other way.
+ */
+ sp = htons(a5 << 8 | a6);
+ /*
+ * Don't allow the PORT command to specify a port < 1024 due to
+ * security crap.
+ */
+ if (ntohs(sp) < 1024)
return 0;
+ /*
+ * The server may not make the connection back from port 20, but
+ * it is the most likely so use it here to check for a conflicting
+ * mapping.
+ */
+ dp = htons(fin->fin_data[1] - 1);
+ ipn = nat_outlookup(fin->fin_ifp, IPN_TCP, nat->nat_p, nat->nat_inip,
+ ip->ip_dst, (dp << 16) | sp);
+ if (ipn == NULL) {
+ int slen;
+
+ slen = ip->ip_len;
+ ip->ip_len = fin->fin_hlen + sizeof(*tcp2);
+ bcopy((char *)fin, (char *)&fi, sizeof(fi));
+ bzero((char *)tcp2, sizeof(*tcp2));
+ tcp2->th_win = htons(8192);
+ tcp2->th_sport = sp;
+ tcp2->th_off = 5;
+ tcp2->th_dport = 0; /* XXX - don't specify remote port */
+ fi.fin_data[0] = ntohs(sp);
+ fi.fin_data[1] = 0;
+ fi.fin_dp = (char *)tcp2;
+ swip = ip->ip_src;
+ ip->ip_src = nat->nat_inip;
+ ipn = nat_new(nat->nat_ptr, ip, &fi, IPN_TCP|FI_W_DPORT,
+ NAT_OUTBOUND);
+ if (ipn != NULL) {
+ ipn->nat_age = fr_defnatage;
+ (void) fr_addstate(ip, &fi, FI_W_DPORT);
+ }
+ ip->ip_len = slen;
+ ip->ip_src = swip;
}
- while ((c = *s++) && isdigit(c)) {
- j *= 10;
- j += c - '0';
- }
- *ptr = s;
- return (i << 8) | j;
+ return inc;
}
-int ippr_ftp_out(fin, ip, tcp, aps, nat)
+int ippr_ftp_client(fin, ip, nat, ftp, dlen)
fr_info_t *fin;
-ip_t *ip;
-tcphdr_t *tcp;
-ap_session_t *aps;
nat_t *nat;
+ftpinfo_t *ftp;
+ip_t *ip;
+int dlen;
{
- register u_32_t sum1, sum2;
- char newbuf[IPF_MAXPORTLEN+1];
- char portbuf[IPF_MAXPORTLEN+1], *s;
- int ch = 0, off = (ip->ip_hl << 2) + (tcp->th_off << 2);
- u_int a1, a2, a3, a4;
- u_short a5, a6;
- int olen, dlen, nlen = 0, inc = 0;
- tcphdr_t tcph, *tcp2 = &tcph;
- void *savep;
- nat_t *ipn;
- struct in_addr swip;
- mb_t *m = *(mb_t **)fin->fin_mp;
+ char *rptr, *wptr;
+ ftpside_t *f;
+ int inc;
+
+ inc = 0;
+ f = &ftp->ftp_side[0];
+ rptr = f->ftps_rptr;
+ wptr = f->ftps_wptr;
+
+ if ((ftp->ftp_passok == 0) && !strncmp(rptr, "USER ", 5))
+ ftp->ftp_passok = 1;
+ else if ((ftp->ftp_passok == 2) && !strncmp(rptr, "PASS ", 5))
+ ftp->ftp_passok = 3;
+ else if ((ftp->ftp_passok == 4) && !ippr_ftp_pasvonly &&
+ !strncmp(rptr, "PORT ", 5)) {
+ inc = ippr_ftp_port(fin, ip, nat, f, dlen);
+ }
-#if SOLARIS
- mb_t *m1;
+ while ((*rptr++ != '\n') && (rptr < wptr))
+ ;
+ f->ftps_seq += rptr - f->ftps_rptr;
+ f->ftps_rptr = rptr;
+ return inc;
+}
- /* skip any leading M_PROTOs */
- while(m && (MTYPE(m) != M_DATA))
- m = m->b_cont;
- PANIC((!m),("ippr_ftp_out: no M_DATA"));
- dlen = msgdsize(m) - off;
- bzero(portbuf, sizeof(portbuf));
- copyout_mblk(m, off, MIN(sizeof(portbuf), dlen), portbuf);
-#else
- dlen = mbufchainlen(m) - off;
- bzero(portbuf, sizeof(portbuf));
- m_copydata(m, off, MIN(sizeof(portbuf), dlen), portbuf);
-#endif
- portbuf[IPF_MAXPORTLEN] = '\0';
+int ippr_ftp_pasv(fin, ip, nat, f, dlen)
+fr_info_t *fin;
+ip_t *ip;
+nat_t *nat;
+ftpside_t *f;
+int dlen;
+{
+ tcphdr_t *tcp, tcph, *tcp2 = &tcph;
+ struct in_addr swip, swip2;
+ u_short a5, a6, sp, dp;
+ u_int a1, a2, a3, a4;
+ fr_info_t fi;
+ int inc, off;
+ nat_t *ipn;
+ char *s;
- if ((dlen < IPF_MINPORTLEN) || strncmp(portbuf, "PORT ", 5))
- goto adjust_seqack;
+ /*
+ * Check for PASV reply message.
+ */
+ if (dlen < IPF_MIN227LEN)
+ return 0;
+ else if (strncmp(f->ftps_rptr, "227 Entering Passive Mode", 25))
+ return 0;
+
+ /*
+ * Count the number of bytes in the 227 reply is.
+ */
+ tcp = (tcphdr_t *)fin->fin_dp;
+ off = f->ftps_seq - ntohl(tcp->th_seq);
+ if (off < 0)
+ return 0;
+ off += fin->fin_hlen + (tcp->th_off << 2);
/*
* Skip the PORT command + space
*/
- s = portbuf + 5;
+ s = f->ftps_rptr + 25;
+ while (*s && !isdigit(*s))
+ s++;
/*
* Pick out the address components, two at a time.
*/
- (void) ipf_ftp_atoi(&s);
+ a1 = ippr_ftp_atoi(&s);
if (!s)
- goto adjust_seqack;
- (void) ipf_ftp_atoi(&s);
+ return 0;
+ a2 = ippr_ftp_atoi(&s);
if (!s)
- goto adjust_seqack;
- a5 = ipf_ftp_atoi(&s);
+ return 0;
+
+ /*
+ * check that IP address in the PORT/PASV reply is the same as the
+ * sender of the command - prevents using PORT for port scanning.
+ */
+ a1 <<= 16;
+ a1 |= a2;
+ if (a1 != ntohl(nat->nat_oip.s_addr))
+ return 0;
+
+ a5 = ippr_ftp_atoi(&s);
if (!s)
- goto adjust_seqack;
+ return 0;
+
+ if (*s == ')')
+ s++;
+ if (*s == '\n')
+ s--;
/*
* check for CR-LF at the end.
*/
- if (*s != '\n' || *(s - 1) != '\r')
- goto adjust_seqack;
- a6 = a5 & 0xff;
+ if ((*s == '\r') && (*(s + 1) == '\n')) {
+ s += 2;
+ a6 = a5 & 0xff;
+ } else
+ return 0;
a5 >>= 8;
/*
- * Calculate new address parts for PORT command
+ * Calculate new address parts for 227 reply
*/
a1 = ntohl(ip->ip_src.s_addr);
a2 = (a1 >> 16) & 0xff;
a3 = (a1 >> 8) & 0xff;
a4 = a1 & 0xff;
a1 >>= 24;
- olen = s - portbuf + 1;
- (void) sprintf(newbuf, "PORT %d,%d,%d,%d,%d,%d\r\n",
- a1, a2, a3, a4, a5, a6);
+ inc = 0;
+#if 0
+ olen = s - f->ftps_rptr;
+ (void) sprintf(newbuf, "%s %u,%u,%u,%u,%u,%u\r\n",
+ "227 Entering Passive Mode", a1, a2, a3, a4, a5, a6);
nlen = strlen(newbuf);
inc = nlen - olen;
+ if ((inc + ip->ip_len) > 65535)
+ return 0;
+
#if SOLARIS
+ m = fin->fin_qfm;
for (m1 = m; m1->b_cont; m1 = m1->b_cont)
;
- if (inc > 0) {
+ if ((inc > 0) && (m1->b_datap->db_lim - m1->b_wptr < inc)) {
mblk_t *nm;
/* alloc enough to keep same trailer space for lower driver */
- nm = allocb(nlen + m1->b_datap->db_lim - m1->b_wptr, BPRI_MED);
+ nm = allocb(nlen, BPRI_MED);
PANIC((!nm),("ippr_ftp_out: allocb failed"));
nm->b_band = m1->b_band;
nm->b_wptr += nlen;
m1->b_wptr -= olen;
- PANIC((m1->b_wptr < m1->b_rptr),("ippr_ftp_out: cannot handle fragmented data block"));
+ PANIC((m1->b_wptr < m1->b_rptr),
+ ("ippr_ftp_out: cannot handle fragmented data block"));
linkb(m1, nm);
} else {
m1->b_wptr += inc;
}
- copyin_mblk(m, off, nlen, newbuf);
+ /*copyin_mblk(m, off, nlen, newbuf);*/
#else
+ m = *((mb_t **)fin->fin_mp);
if (inc < 0)
m_adj(m, inc);
/* the mbuf chain will be extended if necessary by m_copyback() */
- m_copyback(m, off, nlen, newbuf);
+ /*m_copyback(m, off, nlen, newbuf);*/
#endif
- if (inc) {
+ if (inc != 0) {
#if SOLARIS || defined(__sgi)
+ register u_32_t sum1, sum2;
+
sum1 = ip->ip_len;
sum2 = ip->ip_len + inc;
@@ -218,52 +437,320 @@ nat_t *nat;
sum2 -= sum1;
sum2 = (sum2 & 0xffff) + (sum2 >> 16);
- fix_outcksum(&ip->ip_sum, sum2);
+ fix_outcksum(&ip->ip_sum, sum2, 0);
#endif
ip->ip_len += inc;
}
- ch = 1;
+#endif
/*
* Add skeleton NAT entry for connection which will come back the
* other way.
*/
- savep = fin->fin_dp;
- fin->fin_dp = (char *)tcp2;
- bzero((char *)tcp2, sizeof(*tcp2));
- tcp2->th_sport = htons(a5 << 8 | a6);
- tcp2->th_dport = htons(20);
- swip = ip->ip_src;
- ip->ip_src = nat->nat_inip;
- if ((ipn = nat_new(nat->nat_ptr, ip, fin, IPN_TCP, NAT_OUTBOUND)))
- ipn->nat_age = fr_defnatage;
- (void) fr_addstate(ip, fin, FR_INQUE|FR_PASS|FR_QUICK|FR_KEEPSTATE);
- ip->ip_src = swip;
- fin->fin_dp = (char *)savep;
-
-adjust_seqack:
- if (tcp->th_dport == aps->aps_dport) {
- sum2 = (u_32_t)ntohl(tcp->th_seq);
- off = aps->aps_sel;
- if ((aps->aps_after[!off] > aps->aps_after[off]) &&
- (sum2 > aps->aps_after[!off])) {
- off = aps->aps_sel = !off; /* switch to other set */
+ sp = 0;
+ dp = htons(fin->fin_data[1] - 1);
+ ipn = nat_outlookup(fin->fin_ifp, IPN_TCP, nat->nat_p, nat->nat_inip,
+ ip->ip_dst, (dp << 16) | sp);
+ if (ipn == NULL) {
+ int slen;
+
+ slen = ip->ip_len;
+ ip->ip_len = fin->fin_hlen + sizeof(*tcp2);
+ bcopy((char *)fin, (char *)&fi, sizeof(fi));
+ bzero((char *)tcp2, sizeof(*tcp2));
+ tcp2->th_win = htons(8192);
+ tcp2->th_sport = 0; /* XXX - fake it for nat_new */
+ tcp2->th_off = 5;
+ fi.fin_data[0] = a5 << 8 | a6;
+ tcp2->th_dport = htons(fi.fin_data[0]);
+ fi.fin_data[1] = 0;
+ fi.fin_dp = (char *)tcp2;
+ swip = ip->ip_src;
+ swip2 = ip->ip_dst;
+ ip->ip_dst = ip->ip_src;
+ ip->ip_src = nat->nat_inip;
+ ipn = nat_new(nat->nat_ptr, ip, &fi, IPN_TCP|FI_W_SPORT,
+ NAT_OUTBOUND);
+ if (ipn != NULL) {
+ ipn->nat_age = fr_defnatage;
+ (void) fr_addstate(ip, &fi, FI_W_SPORT);
+ }
+ ip->ip_len = slen;
+ ip->ip_src = swip;
+ ip->ip_dst = swip2;
+ }
+ return inc;
+}
+
+
+int ippr_ftp_server(fin, ip, nat, ftp, dlen)
+fr_info_t *fin;
+ip_t *ip;
+nat_t *nat;
+ftpinfo_t *ftp;
+int dlen;
+{
+ char *rptr, *wptr;
+ ftpside_t *f;
+ int inc;
+
+ inc = 0;
+ f = &ftp->ftp_side[1];
+ rptr = f->ftps_rptr;
+ wptr = f->ftps_wptr;
+
+ if ((ftp->ftp_passok == 1) && !strncmp(rptr, "331", 3))
+ ftp->ftp_passok = 2;
+ else if ((ftp->ftp_passok == 3) && !strncmp(rptr, "230", 3))
+ ftp->ftp_passok = 4;
+ else if ((ftp->ftp_passok == 3) && !strncmp(rptr, "530", 3))
+ ftp->ftp_passok = 0;
+ else if ((ftp->ftp_passok == 4) && !strncmp(rptr, "227 ", 4)) {
+ inc = ippr_ftp_pasv(fin, ip, nat, f, dlen);
+ }
+ while ((*rptr++ != '\n') && (rptr < wptr))
+ ;
+ f->ftps_seq += rptr - f->ftps_rptr;
+ f->ftps_rptr = rptr;
+ return inc;
+}
+
+
+/*
+ * Look to see if the buffer starts with something which we recognise as
+ * being the correct syntax for the FTP protocol.
+ */
+int ippr_ftp_valid(buf, len)
+char *buf;
+size_t len;
+{
+ register char *s, c;
+ register size_t i = len;
+
+ if (i < 5)
+ return 2;
+ s = buf;
+ c = *s++;
+ i--;
+
+ if (isdigit(c)) {
+ c = *s++;
+ i--;
+ if (isdigit(c)) {
+ c = *s++;
+ i--;
+ if (isdigit(c)) {
+ c = *s++;
+ i--;
+ if ((c != '-') && (c != ' '))
+ return 1;
+ } else
+ return 1;
+ } else
+ return 1;
+ } else if (isupper(c)) {
+ c = *s++;
+ i--;
+ if (isupper(c)) {
+ c = *s++;
+ i--;
+ if (isupper(c)) {
+ c = *s++;
+ i--;
+ if (isupper(c)) {
+ c = *s++;
+ i--;
+ if ((c != ' ') && (c != '\r'))
+ return 1;
+ } else if ((c != ' ') && (c != '\r'))
+ return 1;
+ } else
+ return 1;
+ } else
+ return 1;
+ } else
+ return 1;
+ for (; i; i--) {
+ c = *s++;
+ if (c == '\n')
+ return 0;
+ }
+ return 2;
+}
+
+
+int ippr_ftp_process(fin, ip, nat, ftp, rv)
+fr_info_t *fin;
+ip_t *ip;
+nat_t *nat;
+ftpinfo_t *ftp;
+int rv;
+{
+ int mlen, len, off, inc, i;
+ char *rptr, *wptr;
+ tcphdr_t *tcp;
+ ftpside_t *f;
+ mb_t *m;
+
+ tcp = (tcphdr_t *)fin->fin_dp;
+ off = fin->fin_hlen + (tcp->th_off << 2);
+
+#if SOLARIS
+ m = fin->fin_qfm;
+#else
+ m = *((mb_t **)fin->fin_mp);
+#endif
+
+#if SOLARIS
+ mlen = msgdsize(m) - off;
+#else
+ mlen = mbufchainlen(m) - off;
+#endif
+ if (!mlen)
+ return 0;
+
+ inc = 0;
+ f = &ftp->ftp_side[rv];
+ rptr = f->ftps_rptr;
+ wptr = f->ftps_wptr;
+ if ((wptr == f->ftps_buf) && (f->ftps_seq <= ntohl(tcp->th_seq)))
+ f->ftps_seq = ntohl(tcp->th_seq);
+
+ /*
+ * XXX - Ideally, this packet should get dropped because we now know
+ * that it is out of order (and there is no real danger in doing so
+ * apart from causing packets to go through here ordered).
+ */
+ if (ntohl(tcp->th_seq) != f->ftps_seq + (wptr - rptr)) {
+ return APR_ERR(0);
+ }
+
+ while (mlen > 0) {
+ len = MIN(mlen, FTP_BUFSZ / 2);
+
+#if SOLARIS
+ copyout_mblk(m, off, len, wptr);
+#else
+ m_copydata(m, off, len, wptr);
+#endif
+ mlen -= len;
+ off += len;
+ wptr += len;
+ f->ftps_wptr = wptr;
+ if (f->ftps_junk == 2)
+ f->ftps_junk = ippr_ftp_valid(rptr, wptr - rptr);
+
+ while ((f->ftps_junk == 0) && (wptr > rptr)) {
+ f->ftps_junk = ippr_ftp_valid(rptr, wptr - rptr);
+ if (f->ftps_junk == 0) {
+ len = wptr - rptr;
+ f->ftps_rptr = rptr;
+ if (rv)
+ inc += ippr_ftp_server(fin, ip, nat,
+ ftp, len);
+ else
+ inc += ippr_ftp_client(fin, ip, nat,
+ ftp, len);
+ rptr = f->ftps_rptr;
+ }
}
- if (aps->aps_seqoff[off]) {
- sum1 = (u_32_t)aps->aps_after[off] -
- aps->aps_seqoff[off];
- if (sum2 > sum1) {
- sum1 = (u_32_t)aps->aps_seqoff[off];
- sum2 += sum1;
- tcp->th_seq = htonl(sum2);
- ch = 1;
+
+ while ((f->ftps_junk == 1) && (rptr < wptr)) {
+ while ((rptr < wptr) && (*rptr != '\r'))
+ rptr++;
+
+ if ((*rptr == '\r') && (rptr + 1 < wptr)) {
+ if (*(rptr + 1) == '\n') {
+ rptr += 2;
+ f->ftps_junk = 0;
+ } else
+ rptr++;
}
+ f->ftps_seq += rptr - f->ftps_rptr;
+ f->ftps_rptr = rptr;
}
- if (inc && (sum2 > aps->aps_after[!off])) {
- aps->aps_after[!off] = sum2 + nlen - 1;
- aps->aps_seqoff[!off] = aps->aps_seqoff[off] + inc;
+ if (rptr == wptr) {
+ rptr = wptr = f->ftps_buf;
+ } else {
+ if ((wptr > f->ftps_buf + FTP_BUFSZ / 2)) {
+ i = wptr - rptr;
+ if ((rptr == f->ftps_buf) ||
+ (wptr - rptr > FTP_BUFSZ / 2)) {
+ f->ftps_seq += i;
+ f->ftps_junk = 1;
+ rptr = wptr = f->ftps_buf;
+ } else {
+ bcopy(rptr, f->ftps_buf, i);
+ wptr = f->ftps_buf + i;
+ rptr = f->ftps_buf;
+ }
+ }
+ f->ftps_rptr = rptr;
+ f->ftps_wptr = wptr;
}
}
- return ch ? 2 : 0;
+
+ f->ftps_rptr = rptr;
+ f->ftps_wptr = wptr;
+ return inc;
+}
+
+
+int ippr_ftp_out(fin, ip, aps, nat)
+fr_info_t *fin;
+ip_t *ip;
+ap_session_t *aps;
+nat_t *nat;
+{
+ ftpinfo_t *ftp;
+
+ ftp = aps->aps_data;
+ if (ftp == NULL)
+ return 0;
+ return ippr_ftp_process(fin, ip, nat, ftp, 0);
+}
+
+
+int ippr_ftp_in(fin, ip, aps, nat)
+fr_info_t *fin;
+ip_t *ip;
+ap_session_t *aps;
+nat_t *nat;
+{
+ ftpinfo_t *ftp;
+
+ ftp = aps->aps_data;
+ if (ftp == NULL)
+ return 0;
+ return ippr_ftp_process(fin, ip, nat, ftp, 1);
+}
+
+
+/*
+ * ippr_ftp_atoi - implement a version of atoi which processes numbers in
+ * pairs separated by commas (which are expected to be in the range 0 - 255),
+ * returning a 16 bit number combining either side of the , as the MSB and
+ * LSB.
+ */
+u_short ippr_ftp_atoi(ptr)
+char **ptr;
+{
+ register char *s = *ptr, c;
+ register u_char i = 0, j = 0;
+
+ while ((c = *s++) && isdigit(c)) {
+ i *= 10;
+ i += c - '0';
+ }
+ if (c != ',') {
+ *ptr = NULL;
+ return 0;
+ }
+ while ((c = *s++) && isdigit(c)) {
+ j *= 10;
+ j += c - '0';
+ }
+ *ptr = s;
+ return (i << 8) | j;
}
diff --git a/sys/netinet/ip_log.c b/sys/netinet/ip_log.c
index 81e89e5c022b..ef1af7ff512a 100644
--- a/sys/netinet/ip_log.c
+++ b/sys/netinet/ip_log.c
@@ -1,27 +1,32 @@
/*
- * Copyright (C) 1997 by Darren Reed.
+ * Copyright (C) 1997-2000 by Darren Reed.
*
* Redistribution and use in source and binary forms are permitted
* provided that this notice is preserved and due credit is given
* to the original author and the contributors.
*
- * $Id: ip_log.c,v 2.0.2.13.2.3 1997/11/20 12:41:40 darrenr Exp $
+ * $Id: ip_log.c,v 2.5 2000/03/13 22:10:21 darrenr Exp $
*/
+#include <sys/param.h>
+#if defined(KERNEL) && !defined(_KERNEL)
+# define _KERNEL
+#endif
+#if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM)
+# include "opt_ipfilter_log.h"
+#endif
+#ifdef __FreeBSD__
+# if defined(_KERNEL) && !defined(IPFILTER_LKM)
+# if defined(__FreeBSD_version) && (__FreeBSD_version >= 300000)
+# include "opt_ipfilter.h"
+# endif
+# else
+# include <osreldate.h>
+# endif
+#endif
#ifdef IPFILTER_LOG
# ifndef SOLARIS
# define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4)))
# endif
-
-# if defined(KERNEL) && !defined(_KERNEL)
-# define _KERNEL
-# endif
-# ifdef __FreeBSD__
-# if defined(_KERNEL) && !defined(IPFILTER_LKM)
-# include <sys/osreldate.h>
-# else
-# include <osreldate.h>
-# endif
-# endif
# ifndef _KERNEL
# include <stdio.h>
# include <string.h>
@@ -30,7 +35,6 @@
# endif
# include <sys/errno.h>
# include <sys/types.h>
-# include <sys/param.h>
# include <sys/file.h>
# if __FreeBSD_version >= 220000 && defined(_KERNEL)
# include <sys/fcntl.h>
@@ -44,7 +48,7 @@
# endif
# include <sys/uio.h>
# if !SOLARIS
-# if (NetBSD > 199609) || (OpenBSD > 199603)
+# if (NetBSD > 199609) || (OpenBSD > 199603) || (__FreeBSD_version >= 300000)
# include <sys/dirent.h>
# else
# include <sys/dir.h>
@@ -105,6 +109,10 @@
# include "netinet/ip_frag.h"
# include "netinet/ip_state.h"
# include "netinet/ip_auth.h"
+# if (__FreeBSD_version >= 300000)
+# include <sys/malloc.h>
+# endif
+
# ifndef MIN
# define MIN(a,b) (((a)<(b))?(a):(b))
# endif
@@ -117,13 +125,12 @@ extern kcondvar_t iplwait;
# endif
# endif
-iplog_t **iplh[IPL_LOGMAX+1], *iplt[IPL_LOGMAX+1];
-int iplused[IPL_LOGMAX+1];
-u_long iplcrc[IPL_LOGMAX+1];
-u_long iplcrcinit;
-#ifdef linux
+iplog_t **iplh[IPL_LOGMAX+1], *iplt[IPL_LOGMAX+1], *ipll[IPL_LOGMAX+1];
+size_t iplused[IPL_LOGMAX+1];
+static fr_info_t iplcrc[IPL_LOGMAX+1];
+# ifdef linux
static struct wait_queue *iplwait[IPL_LOGMAX+1];
-#endif
+# endif
/*
@@ -132,20 +139,15 @@ static struct wait_queue *iplwait[IPL_LOGMAX+1];
*/
void ipflog_init()
{
- struct timeval tv;
int i;
for (i = IPL_LOGMAX; i >= 0; i--) {
iplt[i] = NULL;
+ ipll[i] = NULL;
iplh[i] = &iplt[i];
iplused[i] = 0;
+ bzero((char *)&iplcrc[i], sizeof(iplcrc[i]));
}
-# if BSD >= 199306 || defined(__FreeBSD__) || defined(__sgi)
- microtime(&tv);
-# else
- uniqtime(&tv);
-# endif
- iplcrcinit = tv.tv_sec ^ (tv.tv_usec << 8) ^ tv.tv_usec;
}
@@ -164,11 +166,11 @@ fr_info_t *fin;
mb_t *m;
{
ipflog_t ipfl;
- register int mlen, hlen;
- u_long crc;
+ register size_t mlen, hlen;
size_t sizes[2];
void *ptrs[2];
int types[2];
+ u_char p;
# if SOLARIS
ill_t *ifp = fin->fin_ifp;
# else
@@ -179,29 +181,37 @@ mb_t *m;
* calculate header size.
*/
hlen = fin->fin_hlen;
- if (ip->ip_p == IPPROTO_TCP)
- hlen += MIN(sizeof(tcphdr_t), fin->fin_dlen);
- else if (ip->ip_p == IPPROTO_UDP)
- hlen += MIN(sizeof(udphdr_t), fin->fin_dlen);
- else if (ip->ip_p == IPPROTO_ICMP) {
- struct icmp *icmp = (struct icmp *)((char *)ip + hlen);
-
- /*
- * For ICMP, if the packet is an error packet, also include
- * the information about the packet which caused the error.
- */
- switch (icmp->icmp_type)
- {
- case ICMP_UNREACH :
- case ICMP_SOURCEQUENCH :
- case ICMP_REDIRECT :
- case ICMP_TIMXCEED :
- case ICMP_PARAMPROB :
- hlen += MIN(sizeof(struct icmp) + 8, fin->fin_dlen);
- break;
- default :
- hlen += MIN(sizeof(struct icmp), fin->fin_dlen);
- break;
+ if (fin->fin_off == 0) {
+ p = fin->fin_fi.fi_p;
+ if (p == IPPROTO_TCP)
+ hlen += MIN(sizeof(tcphdr_t), fin->fin_dlen);
+ else if (p == IPPROTO_UDP)
+ hlen += MIN(sizeof(udphdr_t), fin->fin_dlen);
+ else if (p == IPPROTO_ICMP) {
+ struct icmp *icmp;
+
+ icmp = (struct icmp *)fin->fin_dp;
+
+ /*
+ * For ICMP, if the packet is an error packet, also
+ * include the information about the packet which
+ * caused the error.
+ */
+ switch (icmp->icmp_type)
+ {
+ case ICMP_UNREACH :
+ case ICMP_SOURCEQUENCH :
+ case ICMP_REDIRECT :
+ case ICMP_TIMXCEED :
+ case ICMP_PARAMPROB :
+ hlen += MIN(sizeof(struct icmp) + 8,
+ fin->fin_dlen);
+ break;
+ default :
+ hlen += MIN(sizeof(struct icmp),
+ fin->fin_dlen);
+ break;
+ }
}
}
/*
@@ -225,17 +235,21 @@ mb_t *m;
if ((ipfl.fl_ifname[2] = ifp->if_name[2]))
ipfl.fl_ifname[3] = ifp->if_name[3];
# endif
- mlen = (flags & FR_LOGBODY) ? MIN(ip->ip_len - hlen, 128) : 0;
+ mlen = (flags & FR_LOGBODY) ? MIN(fin->fin_plen - hlen, 128) : 0;
# endif
ipfl.fl_plen = (u_char)mlen;
ipfl.fl_hlen = (u_char)hlen;
ipfl.fl_rule = fin->fin_rule;
ipfl.fl_group = fin->fin_group;
+ if (fin->fin_fr != NULL)
+ ipfl.fl_loglevel = fin->fin_fr->fr_loglevel;
+ else
+ ipfl.fl_loglevel = 0xffff;
ipfl.fl_flags = flags;
ptrs[0] = (void *)&ipfl;
sizes[0] = sizeof(ipfl);
types[0] = 0;
-#if SOLARIS
+# if SOLARIS
/*
* Are we copied from the mblk or an aligned array ?
*/
@@ -248,45 +262,47 @@ mb_t *m;
sizes[1] = hlen + mlen;
types[1] = 0;
}
-#else
+# else
ptrs[1] = m;
sizes[1] = hlen + mlen;
types[1] = 1;
-#endif
- crc = (ipf_cksum((u_short *)fin, FI_CSIZE) << 8) + iplcrcinit;
- return ipllog(IPL_LOGIPF, crc, ptrs, sizes, types, 2);
+# endif
+ return ipllog(IPL_LOGIPF, fin, ptrs, sizes, types, 2);
}
/*
* ipllog
*/
-int ipllog(dev, crc, items, itemsz, types, cnt)
+int ipllog(dev, fin, items, itemsz, types, cnt)
int dev;
-u_long crc;
+fr_info_t *fin;
void **items;
size_t *itemsz;
int *types, cnt;
{
- iplog_t *ipl;
caddr_t buf, s;
- int len, i;
+ iplog_t *ipl;
+ size_t len;
+ int i;
/*
* Check to see if this log record has a CRC which matches the last
* record logged. If it does, just up the count on the previous one
* rather than create a new one.
*/
- if (crc) {
- MUTEX_ENTER(&ipl_mutex);
- if ((iplcrc[dev] == crc) && *iplh[dev]) {
- (*iplh[dev])->ipl_count++;
+ MUTEX_ENTER(&ipl_mutex);
+ if (fin != NULL) {
+ if ((ipll[dev] != NULL) &&
+ bcmp((char *)fin, (char *)&iplcrc[dev], FI_CSIZE) == 0) {
+ ipll[dev]->ipl_count++;
MUTEX_EXIT(&ipl_mutex);
return 1;
}
- iplcrc[dev] = crc;
- MUTEX_EXIT(&ipl_mutex);
- }
+ bcopy((char *)fin, (char *)&iplcrc[dev], FI_CSIZE);
+ } else
+ bzero((char *)&iplcrc[dev], FI_CSIZE);
+ MUTEX_EXIT(&ipl_mutex);
/*
* Get the total amount of data to be logged.
@@ -298,7 +314,7 @@ int *types, cnt;
* check that we have space to record this information and can
* allocate that much.
*/
- KMALLOC(buf, caddr_t, len);
+ KMALLOCS(buf, caddr_t, len);
if (!buf)
return 0;
MUTEX_ENTER(&ipl_mutex);
@@ -344,6 +360,7 @@ int *types, cnt;
s += itemsz[i];
}
MUTEX_ENTER(&ipl_mutex);
+ ipll[dev] = ipl;
*iplh[dev] = ipl;
iplh[dev] = &ipl->ipl_next;
# if SOLARIS
@@ -362,11 +379,12 @@ int *types, cnt;
int ipflog_read(unit, uio)
-int unit;
+minor_t unit;
struct uio *uio;
{
+ size_t dlen, copied;
+ int error = 0;
iplog_t *ipl;
- int error = 0, dlen, copied;
# if defined(_KERNEL) && !SOLARIS
int s;
# endif
@@ -375,7 +393,7 @@ struct uio *uio;
* Sanity checks. Make sure the minor # is valid and we're copying
* a valid chunk of data.
*/
- if ((IPL_LOGMAX < unit) || (unit < 0))
+ if (IPL_LOGMAX < unit)
return ENXIO;
if (!uio->uio_resid)
return 0;
@@ -419,55 +437,63 @@ struct uio *uio;
for (copied = 0; (ipl = iplt[unit]); copied += dlen) {
dlen = ipl->ipl_dsize;
- if (dlen + sizeof(iplog_t) > uio->uio_resid)
+ if (dlen > uio->uio_resid)
break;
/*
* Don't hold the mutex over the uiomove call.
*/
iplt[unit] = ipl->ipl_next;
+ iplused[unit] -= dlen;
MUTEX_EXIT(&ipl_mutex);
SPL_X(s);
- error = UIOMOVE((caddr_t)ipl, ipl->ipl_dsize, UIO_READ, uio);
- KFREES((caddr_t)ipl, ipl->ipl_dsize);
- if (error)
+ error = UIOMOVE((caddr_t)ipl, dlen, UIO_READ, uio);
+ if (error) {
+ SPL_NET(s);
+ MUTEX_ENTER(&ipl_mutex);
+ ipl->ipl_next = iplt[unit];
+ iplt[unit] = ipl;
+ iplused[unit] += dlen;
break;
+ }
+ KFREES((caddr_t)ipl, dlen);
SPL_NET(s);
MUTEX_ENTER(&ipl_mutex);
- iplused[unit] -= dlen;
}
- if (!ipl) {
+ if (!iplt[unit]) {
iplused[unit] = 0;
iplh[unit] = &iplt[unit];
+ ipll[unit] = NULL;
}
- if (!error) {
- MUTEX_EXIT(&ipl_mutex);
- SPL_X(s);
- }
-#ifdef linux
+ MUTEX_EXIT(&ipl_mutex);
+ SPL_X(s);
+# ifdef linux
if (!error)
- return copied;
+ return (int)copied;
return -error;
-#else
+# else
return error;
-#endif
+# endif
}
int ipflog_clear(unit)
-int unit;
+minor_t unit;
{
iplog_t *ipl;
int used;
+ MUTEX_ENTER(&ipl_mutex);
while ((ipl = iplt[unit])) {
iplt[unit] = ipl->ipl_next;
KFREES((caddr_t)ipl, ipl->ipl_dsize);
}
iplh[unit] = &iplt[unit];
+ ipll[unit] = NULL;
used = iplused[unit];
iplused[unit] = 0;
- iplcrc[unit] = 0;
+ bzero((char *)&iplcrc[unit], FI_CSIZE);
+ MUTEX_EXIT(&ipl_mutex);
return used;
}
#endif /* IPFILTER_LOG */
diff --git a/sys/netinet/ip_nat.c b/sys/netinet/ip_nat.c
index 102d57f32ab9..64f50b683ea7 100644
--- a/sys/netinet/ip_nat.c
+++ b/sys/netinet/ip_nat.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 1995-1997 by Darren Reed.
+ * Copyright (C) 1995-2000 by Darren Reed.
*
* Redistribution and use in source and binary forms are permitted
* provided that this notice is preserved and due credit is given
@@ -9,24 +9,28 @@
*/
#if !defined(lint)
static const char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.0.2.44.2.10 1998/05/23 19:05:29 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.37.2.10 2000/05/19 15:54:44 darrenr Exp $";
#endif
#if defined(__FreeBSD__) && defined(KERNEL) && !defined(_KERNEL)
#define _KERNEL
#endif
-#if !defined(_KERNEL) && !defined(KERNEL)
-# include <stdio.h>
-# include <string.h>
-# include <stdlib.h>
-#endif
#include <sys/errno.h>
#include <sys/types.h>
#include <sys/param.h>
#include <sys/time.h>
#include <sys/file.h>
-#if defined(KERNEL) && (__FreeBSD_version >= 220000)
+#if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \
+ defined(_KERNEL)
+# include "opt_ipfilter_log.h"
+#endif
+#if !defined(_KERNEL) && !defined(KERNEL)
+# include <stdio.h>
+# include <string.h>
+# include <stdlib.h>
+#endif
+#if (defined(KERNEL) || defined(_KERNEL)) && (__FreeBSD_version >= 220000)
# include <sys/filio.h>
# include <sys/fcntl.h>
#else
@@ -48,7 +52,9 @@ static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.0.2.44.2.10 1998/05/23 19:05:
#else
# include <sys/filio.h>
# include <sys/byteorder.h>
-# include <sys/dditypes.h>
+# ifdef _KERNEL
+# include <sys/dditypes.h>
+# endif
# include <sys/stream.h>
# include <sys/kmem.h>
#endif
@@ -58,9 +64,12 @@ static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.0.2.44.2.10 1998/05/23 19:05:
#include <net/if.h>
#if __FreeBSD_version >= 300000
# include <net/if_var.h>
+# if defined(_KERNEL) && !defined(IPFILTER_LKM)
+# include "opt_ipfilter.h"
+# endif
#endif
#ifdef sun
-#include <net/af.h>
+# include <net/af.h>
#endif
#include <net/route.h>
#include <netinet/in.h>
@@ -75,8 +84,8 @@ static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.0.2.44.2.10 1998/05/23 19:05:
#endif
#ifdef RFC1825
-#include <vpn/md5.h>
-#include <vpn/ipsec.h>
+# include <vpn/md5.h>
+# include <vpn/ipsec.h>
extern struct ifnet vpnif;
#endif
@@ -93,50 +102,220 @@ extern struct ifnet vpnif;
#include "netinet/ip_nat.h"
#include "netinet/ip_frag.h"
#include "netinet/ip_state.h"
+#if (__FreeBSD_version >= 300000)
+# include <sys/malloc.h>
+#endif
#ifndef MIN
-#define MIN(a,b) (((a)<(b))?(a):(b))
+# define MIN(a,b) (((a)<(b))?(a):(b))
#endif
#undef SOCKADDR_IN
#define SOCKADDR_IN struct sockaddr_in
-nat_t *nat_table[2][NAT_SIZE], *nat_instances = NULL;
+nat_t **nat_table[2] = { NULL, NULL },
+ *nat_instances = NULL;
ipnat_t *nat_list = NULL;
-u_long fr_defnatage = 1200, /* 10 minutes (600 seconds) */
- fr_defnaticmpage = 6; /* 3 seconds */
-natstat_t nat_stats;
+u_int ipf_nattable_sz = NAT_TABLE_SZ;
+u_int ipf_natrules_sz = NAT_SIZE;
+u_int ipf_rdrrules_sz = RDR_SIZE;
+u_int ipf_hostmap_sz = HOSTMAP_SIZE;
+u_32_t nat_masks = 0;
+u_32_t rdr_masks = 0;
+ipnat_t **nat_rules = NULL;
+ipnat_t **rdr_rules = NULL;
+hostmap_t **maptable = NULL;
+
+u_long fr_defnatage = DEF_NAT_AGE,
+ fr_defnaticmpage = 6; /* 3 seconds */
+static natstat_t nat_stats;
+int fr_nat_lock = 0;
#if (SOLARIS || defined(__sgi)) && defined(_KERNEL)
-extern kmutex_t ipf_nat;
+extern kmutex_t ipf_rw, ipf_hostmap;
+extern KRWLOCK_T ipf_nat;
#endif
static int nat_flushtable __P((void));
static int nat_clearlist __P((void));
+static void nat_addnat __P((struct ipnat *));
+static void nat_addrdr __P((struct ipnat *));
static void nat_delete __P((struct nat *));
-static int nat_ifpaddr __P((nat_t *, void *, struct in_addr *));
+static void nat_delrdr __P((struct ipnat *));
+static void nat_delnat __P((struct ipnat *));
+static int fr_natgetent __P((caddr_t));
+static int fr_natgetsz __P((caddr_t));
+static int fr_natputent __P((caddr_t));
+static int nat_match __P((fr_info_t *, ipnat_t *, ip_t *));
+static hostmap_t *nat_hostmap __P((ipnat_t *, struct in_addr,
+ struct in_addr));
+static void nat_hostmapdel __P((struct hostmap *));
+
+
+int nat_init()
+{
+ KMALLOCS(nat_table[0], nat_t **, sizeof(nat_t *) * ipf_nattable_sz);
+ if (nat_table[0] != NULL)
+ bzero((char *)nat_table[0], ipf_nattable_sz * sizeof(nat_t *));
+ else
+ return -1;
+
+ KMALLOCS(nat_table[1], nat_t **, sizeof(nat_t *) * ipf_nattable_sz);
+ if (nat_table[1] != NULL)
+ bzero((char *)nat_table[1], ipf_nattable_sz * sizeof(nat_t *));
+ else
+ return -1;
+
+ KMALLOCS(nat_rules, ipnat_t **, sizeof(ipnat_t *) * ipf_natrules_sz);
+ if (nat_rules != NULL)
+ bzero((char *)nat_rules, ipf_natrules_sz * sizeof(ipnat_t *));
+ else
+ return -1;
+
+ KMALLOCS(rdr_rules, ipnat_t **, sizeof(ipnat_t *) * ipf_rdrrules_sz);
+ if (rdr_rules != NULL)
+ bzero((char *)rdr_rules, ipf_rdrrules_sz * sizeof(ipnat_t *));
+ else
+ return -1;
+
+ KMALLOCS(maptable, hostmap_t **, sizeof(hostmap_t *) * ipf_hostmap_sz);
+ if (maptable != NULL)
+ bzero((char *)maptable, sizeof(hostmap_t *) * ipf_hostmap_sz);
+ else
+ return -1;
+ return 0;
+}
-#define LONG_SUM(in) (((in) & 0xffff) + ((in) >> 16))
+static void nat_addrdr(n)
+ipnat_t *n;
+{
+ ipnat_t **np;
+ u_32_t j;
+ u_int hv;
+ int k;
+
+ k = countbits(n->in_outmsk);
+ if ((k >= 0) && (k != 32))
+ rdr_masks |= 1 << k;
+ j = (n->in_outip & n->in_outmsk);
+ hv = NAT_HASH_FN(j, 0, ipf_rdrrules_sz);
+ np = rdr_rules + hv;
+ while (*np != NULL)
+ np = &(*np)->in_rnext;
+ n->in_rnext = NULL;
+ n->in_prnext = np;
+ *np = n;
+}
+
+
+static void nat_addnat(n)
+ipnat_t *n;
+{
+ ipnat_t **np;
+ u_32_t j;
+ u_int hv;
+ int k;
+
+ k = countbits(n->in_inmsk);
+ if ((k >= 0) && (k != 32))
+ nat_masks |= 1 << k;
+ j = (n->in_inip & n->in_inmsk);
+ hv = NAT_HASH_FN(j, 0, ipf_natrules_sz);
+ np = nat_rules + hv;
+ while (*np != NULL)
+ np = &(*np)->in_mnext;
+ n->in_mnext = NULL;
+ n->in_pmnext = np;
+ *np = n;
+}
+
+
+static void nat_delrdr(n)
+ipnat_t *n;
+{
+ if (n->in_rnext)
+ n->in_rnext->in_prnext = n->in_prnext;
+ *n->in_prnext = n->in_rnext;
+}
+
+
+static void nat_delnat(n)
+ipnat_t *n;
+{
+ if (n->in_mnext)
+ n->in_mnext->in_pmnext = n->in_pmnext;
+ *n->in_pmnext = n->in_mnext;
+}
-#define CALC_SUMD(s1, s2, sd) { \
- /* Do it twice */ \
- (s1) = ((s1) & 0xffff) + ((s1) >> 16); \
- (s1) = ((s1) & 0xffff) + ((s1) >> 16); \
- /* Do it twice */ \
- (s2) = ((s2) & 0xffff) + ((s2) >> 16); \
- (s2) = ((s2) & 0xffff) + ((s2) >> 16); \
- /* Because ~1 == -2, We really need ~1 == -1 */ \
- if ((s1) > (s2)) (s2)--; \
- (sd) = (s2) - (s1); \
- (sd) = ((sd) & 0xffff) + ((sd) >> 16); }
-void fix_outcksum(sp, n)
+/*
+ * check if an ip address has already been allocated for a given mapping that
+ * is not doing port based translation.
+ */
+static struct hostmap *nat_hostmap(np, real, map)
+ipnat_t *np;
+struct in_addr real;
+struct in_addr map;
+{
+ hostmap_t *hm;
+ u_int hv;
+
+ MUTEX_ENTER(&ipf_hostmap);
+ hv = real.s_addr % HOSTMAP_SIZE;
+ for (hm = maptable[hv]; hm; hm = hm->hm_next)
+ if ((hm->hm_realip.s_addr == real.s_addr) &&
+ (np == hm->hm_ipnat)) {
+ hm->hm_ref++;
+ MUTEX_EXIT(&ipf_hostmap);
+ return hm;
+ }
+
+ KMALLOC(hm, hostmap_t *);
+ if (hm) {
+ hm->hm_next = maptable[hv];
+ hm->hm_pnext = maptable + hv;
+ if (maptable[hv])
+ maptable[hv]->hm_pnext = &hm->hm_next;
+ maptable[hv] = hm;
+ hm->hm_ipnat = np;
+ hm->hm_realip = real;
+ hm->hm_mapip = map;
+ hm->hm_ref = 1;
+ }
+ MUTEX_EXIT(&ipf_hostmap);
+ return hm;
+}
+
+
+static void nat_hostmapdel(hm)
+struct hostmap *hm;
+{
+ MUTEX_ENTER(&ipf_hostmap);
+ ATOMIC_DEC32(hm->hm_ref);
+ if (hm->hm_ref == 0) {
+ if (hm->hm_next)
+ hm->hm_next->hm_pnext = hm->hm_pnext;
+ *hm->hm_pnext = hm->hm_next;
+ KFREE(hm);
+ }
+ MUTEX_EXIT(&ipf_hostmap);
+}
+
+
+void fix_outcksum(sp, n , len)
u_short *sp;
u_32_t n;
+int len;
{
register u_short sumshort;
register u_32_t sum1;
if (!n)
return;
+#if SOLARIS2 >= 6
+ else if (n & NAT_HW_CKSUM) {
+ *sp = n & 0xffff;
+ return;
+ }
+#endif
sum1 = (~ntohs(*sp)) & 0xffff;
sum1 += (n);
sum1 = (sum1 >> 16) + (sum1 & 0xffff);
@@ -147,15 +326,22 @@ u_32_t n;
}
-void fix_incksum(sp, n)
+void fix_incksum(sp, n , len)
u_short *sp;
u_32_t n;
+int len;
{
register u_short sumshort;
register u_32_t sum1;
if (!n)
return;
+#if SOLARIS2 >= 6
+ else if (n & NAT_HW_CKSUM) {
+ *sp = n & 0xffff;
+ return;
+ }
+#endif
#ifdef sparc
sum1 = (~(*sp)) & 0xffff;
#else
@@ -195,7 +381,7 @@ u_32_t n;
* Handle ioctls which manipulate the NAT.
*/
int nat_ioctl(data, cmd, mode)
-#if defined(__NetBSD__) || defined(__OpenBSD__)
+#if defined(__NetBSD__) || defined(__OpenBSD__) || (__FreeBSD_version >= 300003)
u_long cmd;
#else
int cmd;
@@ -203,25 +389,39 @@ int cmd;
caddr_t data;
int mode;
{
- register ipnat_t *nat, *n = NULL, **np = NULL;
+ register ipnat_t *nat, *nt, *n = NULL, **np = NULL;
+ int error = 0, ret, arg;
ipnat_t natd;
- int error = 0, ret;
-#if defined(_KERNEL) && !SOLARIS
- int s;
+ u_32_t i, j;
+
+#if (BSD >= 199306) && defined(_KERNEL)
+ if ((securelevel >= 2) && (mode & FWRITE))
+ return EPERM;
#endif
nat = NULL; /* XXX gcc -Wuninitialized */
+ KMALLOC(nt, ipnat_t *);
+ if ((cmd == SIOCADNAT) || (cmd == SIOCRMNAT))
+ error = IRCOPYPTR(data, (char *)&natd, sizeof(natd));
+ else if (cmd == SIOCIPFFL) /* SIOCFLNAT & SIOCCNATL */
+ error = IRCOPY(data, (char *)&arg, sizeof(arg));
+
+ if (error)
+ goto done;
/*
* For add/delete, look to see if the NAT entry is already present
*/
- SPL_NET(s);
- MUTEX_ENTER(&ipf_nat);
+ WRITE_ENTER(&ipf_nat);
if ((cmd == SIOCADNAT) || (cmd == SIOCRMNAT)) {
- IRCOPY(data, (char *)&natd, sizeof(natd));
nat = &natd;
- nat->in_inip &= nat->in_inmsk;
- nat->in_outip &= nat->in_outmsk;
+ nat->in_flags &= IPN_USERFLAGS;
+ if ((nat->in_redir & NAT_MAPBLK) == 0) {
+ if ((nat->in_flags & IPN_SPLIT) == 0)
+ nat->in_inip &= nat->in_inmsk;
+ if ((nat->in_flags & IPN_IPRANGE) == 0)
+ nat->in_outip &= nat->in_outmsk;
+ }
for (np = &nat_list; (n = *np); np = &n->in_next)
if (!bcmp((char *)&nat->in_flags, (char *)&n->in_flags,
IPN_CMPSIZ))
@@ -230,6 +430,20 @@ int mode;
switch (cmd)
{
+#ifdef IPFILTER_LOG
+ case SIOCIPFFB :
+ {
+ int tmp;
+
+ if (!(mode & FWRITE))
+ error = EPERM;
+ else {
+ tmp = ipflog_clear(IPL_LOGNAT);
+ IWCOPY((char *)&tmp, (char *)data, sizeof(tmp));
+ }
+ break;
+ }
+#endif
case SIOCADNAT :
if (!(mode & FWRITE)) {
error = EPERM;
@@ -239,25 +453,64 @@ int mode;
error = EEXIST;
break;
}
- KMALLOC(n, ipnat_t *, sizeof(*n));
- if (n == NULL) {
+ if (nt == NULL) {
error = ENOMEM;
break;
}
+ n = nt;
+ nt = NULL;
bcopy((char *)nat, (char *)n, sizeof(*n));
- n->in_ifp = (void *)GETUNIT(n->in_ifname);
+ n->in_ifp = (void *)GETUNIT(n->in_ifname, 4);
if (!n->in_ifp)
n->in_ifp = (void *)-1;
- n->in_apr = ap_match(n->in_p, n->in_plabel);
- n->in_next = *np;
+ if (n->in_plabel[0] != '\0') {
+ n->in_apr = appr_match(n->in_p, n->in_plabel);
+ if (!n->in_apr) {
+ error = ENOENT;
+ break;
+ }
+ }
+ n->in_next = NULL;
+ *np = n;
+
+ if (n->in_redir & NAT_REDIRECT)
+ nat_addrdr(n);
+ if (n->in_redir & (NAT_MAP|NAT_MAPBLK))
+ nat_addnat(n);
+
n->in_use = 0;
- n->in_space = ~(0xffffffff & ntohl(n->in_outmsk));
- if (n->in_space) /* lose 2: broadcast + network address */
- n->in_space -= 2;
+ if (n->in_redir & NAT_MAPBLK)
+ n->in_space = USABLE_PORTS * ~ntohl(n->in_outmsk);
+ else if (n->in_flags & IPN_AUTOPORTMAP)
+ n->in_space = USABLE_PORTS * ~ntohl(n->in_inmsk);
+ else if (n->in_flags & IPN_IPRANGE)
+ n->in_space = ntohl(n->in_outmsk) - ntohl(n->in_outip);
+ else if (n->in_flags & IPN_SPLIT)
+ n->in_space = 2;
else
- n->in_space = 1; /* single IP# mapping */
- if ((n->in_outmsk != 0xffffffff) && n->in_outmsk)
+ n->in_space = ~ntohl(n->in_outmsk);
+ /*
+ * Calculate the number of valid IP addresses in the output
+ * mapping range. In all cases, the range is inclusive of
+ * the start and ending IP addresses.
+ * If to a CIDR address, lose 2: broadcast + network address
+ * (so subtract 1)
+ * If to a range, add one.
+ * If to a single IP address, set to 1.
+ */
+ if (n->in_space) {
+ if ((n->in_flags & IPN_IPRANGE) != 0)
+ n->in_space += 1;
+ else
+ n->in_space -= 1;
+ } else
+ n->in_space = 1;
+ if ((n->in_outmsk != 0xffffffff) && (n->in_outmsk != 0) &&
+ ((n->in_flags & (IPN_IPRANGE|IPN_SPLIT)) == 0))
n->in_nip = ntohl(n->in_outip) + 1;
+ else if ((n->in_flags & IPN_SPLIT) &&
+ (n->in_redir & NAT_REDIRECT))
+ n->in_nip = ntohl(n->in_inip);
else
n->in_nip = ntohl(n->in_outip);
if (n->in_redir & NAT_MAP) {
@@ -265,78 +518,432 @@ int mode;
/*
* Multiply by the number of ports made available.
*/
- if (ntohs(n->in_pmax) > ntohs(n->in_pmin))
+ if (ntohs(n->in_pmax) >= ntohs(n->in_pmin)) {
n->in_space *= (ntohs(n->in_pmax) -
- ntohs(n->in_pmin));
+ ntohs(n->in_pmin) + 1);
+ /*
+ * Because two different sources can map to
+ * different destinations but use the same
+ * local IP#/port #.
+ * If the result is smaller than in_space, then
+ * we may have wrapped around 32bits.
+ */
+ i = n->in_inmsk;
+ if ((i != 0) && (i != 0xffffffff)) {
+ j = n->in_space * (~ntohl(i) + 1);
+ if (j >= n->in_space)
+ n->in_space = j;
+ else
+ n->in_space = 0xffffffff;
+ }
+ }
+ /*
+ * If no protocol is specified, multiple by 256.
+ */
+ if ((n->in_flags & IPN_TCPUDP) == 0) {
+ j = n->in_space * 256;
+ if (j >= n->in_space)
+ n->in_space = j;
+ else
+ n->in_space = 0xffffffff;
+ }
}
/* Otherwise, these fields are preset */
- *np = n;
+ n = NULL;
nat_stats.ns_rules++;
break;
case SIOCRMNAT :
if (!(mode & FWRITE)) {
error = EPERM;
+ n = NULL;
break;
}
if (!n) {
error = ESRCH;
break;
}
+ if (n->in_redir & NAT_REDIRECT)
+ nat_delrdr(n);
+ if (n->in_redir & (NAT_MAPBLK|NAT_MAP))
+ nat_delnat(n);
+ if (nat_list == NULL) {
+ nat_masks = 0;
+ rdr_masks = 0;
+ }
*np = n->in_next;
if (!n->in_use) {
if (n->in_apr)
- ap_free(n->in_apr);
+ appr_free(n->in_apr);
KFREE(n);
nat_stats.ns_rules--;
} else {
n->in_flags |= IPN_DELETE;
n->in_next = NULL;
}
+ n = NULL;
break;
case SIOCGNATS :
+ MUTEX_DOWNGRADE(&ipf_nat);
nat_stats.ns_table[0] = nat_table[0];
nat_stats.ns_table[1] = nat_table[1];
nat_stats.ns_list = nat_list;
- IWCOPY((char *)&nat_stats, (char *)data, sizeof(nat_stats));
+ nat_stats.ns_nattab_sz = ipf_nattable_sz;
+ nat_stats.ns_rultab_sz = ipf_natrules_sz;
+ nat_stats.ns_rdrtab_sz = ipf_rdrrules_sz;
+ nat_stats.ns_instances = nat_instances;
+ nat_stats.ns_apslist = ap_sess_list;
+ error = IWCOPYPTR((char *)&nat_stats, (char *)data,
+ sizeof(nat_stats));
break;
case SIOCGNATL :
{
natlookup_t nl;
- IRCOPY((char *)data, (char *)&nl, sizeof(nl));
+ MUTEX_DOWNGRADE(&ipf_nat);
+ error = IRCOPYPTR((char *)data, (char *)&nl, sizeof(nl));
+ if (error)
+ break;
if (nat_lookupredir(&nl)) {
- IWCOPY((char *)&nl, (char *)data, sizeof(nl));
+ error = IWCOPYPTR((char *)&nl, (char *)data,
+ sizeof(nl));
} else
error = ESRCH;
break;
}
- case SIOCFLNAT :
+ case SIOCIPFFL : /* old SIOCFLNAT & SIOCCNATL */
if (!(mode & FWRITE)) {
error = EPERM;
break;
}
- ret = nat_flushtable();
- (void) ap_unload();
- IWCOPY((caddr_t)&ret, data, sizeof(ret));
+ error = 0;
+ if (arg == 0)
+ ret = nat_flushtable();
+ else if (arg == 1)
+ ret = nat_clearlist();
+ else
+ error = EINVAL;
+ MUTEX_DOWNGRADE(&ipf_nat);
+ if (!error) {
+ error = IWCOPY((caddr_t)&ret, data, sizeof(ret));
+ if (error)
+ error = EFAULT;
+ }
break;
- case SIOCCNATL :
- if (!(mode & FWRITE)) {
- error = EPERM;
- break;
+ case SIOCSTLCK :
+ error = IRCOPY(data, (caddr_t)&arg, sizeof(arg));
+ if (!error) {
+ error = IWCOPY((caddr_t)&fr_nat_lock, data,
+ sizeof(fr_nat_lock));
+ if (!error)
+ fr_nat_lock = arg;
}
- ret = nat_clearlist();
- IWCOPY((caddr_t)&ret, data, sizeof(ret));
+ break;
+ case SIOCSTPUT :
+ if (fr_nat_lock)
+ error = fr_natputent(data);
+ else
+ error = EACCES;
+ break;
+ case SIOCSTGSZ :
+ if (fr_nat_lock)
+ error = fr_natgetsz(data);
+ else
+ error = EACCES;
+ break;
+ case SIOCSTGET :
+ if (fr_nat_lock)
+ error = fr_natgetent(data);
+ else
+ error = EACCES;
break;
case FIONREAD :
#ifdef IPFILTER_LOG
- IWCOPY((caddr_t)&iplused[IPL_LOGNAT], (caddr_t)data,
- sizeof(iplused[IPL_LOGNAT]));
+ MUTEX_DOWNGRADE(&ipf_nat);
+ error = IWCOPY((caddr_t)&iplused[IPL_LOGNAT], (caddr_t)data,
+ sizeof(iplused[IPL_LOGNAT]));
#endif
break;
+ default :
+ error = EINVAL;
+ break;
}
- MUTEX_EXIT(&ipf_nat);
- SPL_X(s);
+ RWLOCK_EXIT(&ipf_nat); /* READ/WRITE */
+done:
+ if (nt)
+ KFREE(nt);
+ return error;
+}
+
+
+static int fr_natgetsz(data)
+caddr_t data;
+{
+ ap_session_t *aps;
+ nat_t *nat, *n;
+ int error = 0;
+ natget_t ng;
+
+ error = IRCOPY(data, (caddr_t)&ng, sizeof(ng));
+ if (error)
+ return EFAULT;
+
+ nat = ng.ng_ptr;
+ if (!nat) {
+ nat = nat_instances;
+ ng.ng_sz = 0;
+ if (nat == NULL) {
+ error = IWCOPY((caddr_t)&ng, data, sizeof(ng));
+ if (error)
+ error = EFAULT;
+ return error;
+ }
+ } else {
+ /*
+ * Make sure the pointer we're copying from exists in the
+ * current list of entries. Security precaution to prevent
+ * copying of random kernel data.
+ */
+ for (n = nat_instances; n; n = n->nat_next)
+ if (n == nat)
+ break;
+ if (!n)
+ return ESRCH;
+ }
+
+ ng.ng_sz = sizeof(nat_save_t);
+ aps = nat->nat_aps;
+ if ((aps != NULL) && (aps->aps_data != 0)) {
+ ng.ng_sz += sizeof(ap_session_t);
+ ng.ng_sz += aps->aps_psiz;
+ }
+
+ error = IWCOPY((caddr_t)&ng, data, sizeof(ng));
+ if (error)
+ error = EFAULT;
+ return error;
+}
+
+
+static int fr_natgetent(data)
+caddr_t data;
+{
+ nat_save_t ipn, *ipnp, *ipnn;
+ register nat_t *n, *nat;
+ ap_session_t *aps;
+ int error;
+
+ error = IRCOPY(data, (caddr_t)&ipnp, sizeof(ipnp));
+ if (error)
+ return EFAULT;
+ error = IRCOPY((caddr_t)ipnp, (caddr_t)&ipn, sizeof(ipn));
+ if (error)
+ return EFAULT;
+
+ nat = ipn.ipn_next;
+ if (!nat) {
+ nat = nat_instances;
+ if (nat == NULL) {
+ if (nat_instances == NULL)
+ return ENOENT;
+ return 0;
+ }
+ } else {
+ /*
+ * Make sure the pointer we're copying from exists in the
+ * current list of entries. Security precaution to prevent
+ * copying of random kernel data.
+ */
+ for (n = nat_instances; n; n = n->nat_next)
+ if (n == nat)
+ break;
+ if (!n)
+ return ESRCH;
+ }
+
+ ipn.ipn_next = nat->nat_next;
+ ipn.ipn_dsize = 0;
+ bcopy((char *)nat, (char *)&ipn.ipn_nat, sizeof(ipn.ipn_nat));
+ ipn.ipn_nat.nat_data = NULL;
+
+ if (nat->nat_ptr) {
+ bcopy((char *)nat->nat_ptr, (char *)&ipn.ipn_ipnat,
+ sizeof(ipn.ipn_ipnat));
+ }
+
+ if (nat->nat_fr)
+ bcopy((char *)nat->nat_fr, (char *)&ipn.ipn_rule,
+ sizeof(ipn.ipn_rule));
+
+ if ((aps = nat->nat_aps)) {
+ ipn.ipn_dsize = sizeof(*aps);
+ if (aps->aps_data)
+ ipn.ipn_dsize += aps->aps_psiz;
+ KMALLOCS(ipnn, nat_save_t *, sizeof(*ipnn) + ipn.ipn_dsize);
+ if (ipnn == NULL)
+ return NULL;
+ bcopy((char *)&ipn, (char *)ipnn, sizeof(ipn));
+
+ bcopy((char *)aps, ipn.ipn_data, sizeof(*aps));
+ if (aps->aps_data) {
+ bcopy(aps->aps_data, ipn.ipn_data + sizeof(*aps),
+ aps->aps_psiz);
+ ipn.ipn_dsize += aps->aps_psiz;
+ }
+ error = IWCOPY((caddr_t)ipnn, ipnp,
+ sizeof(ipn) + ipn.ipn_dsize);
+ if (error)
+ return EFAULT;
+ KFREES(ipnn, sizeof(*ipnn) + ipn.ipn_dsize);
+ } else {
+ error = IWCOPY((caddr_t)&ipn, ipnp, sizeof(ipn));
+ if (error)
+ return EFAULT;
+ }
+ return 0;
+}
+
+
+static int fr_natputent(data)
+caddr_t data;
+{
+ nat_save_t ipn, *ipnp, *ipnn;
+ register nat_t *n, *nat;
+ ap_session_t *aps;
+ frentry_t *fr;
+ ipnat_t *in;
+
+ int error;
+
+ error = IRCOPY(data, (caddr_t)&ipnp, sizeof(ipnp));
+ if (error)
+ return EFAULT;
+ error = IRCOPY((caddr_t)ipnp, (caddr_t)&ipn, sizeof(ipn));
+ if (error)
+ return EFAULT;
+ if (ipn.ipn_dsize) {
+ KMALLOCS(ipnn, nat_save_t *, sizeof(ipn) + ipn.ipn_dsize);
+ if (ipnn == NULL)
+ return ENOMEM;
+ bcopy((char *)&ipn, (char *)ipnn, sizeof(ipn));
+ error = IRCOPY((caddr_t)ipnp, (caddr_t)ipn.ipn_data,
+ ipn.ipn_dsize);
+ if (error)
+ return EFAULT;
+ } else
+ ipnn = NULL;
+
+ KMALLOC(nat, nat_t *);
+ if (nat == NULL)
+ return ENOMEM;
+
+ bcopy((char *)&ipn.ipn_nat, (char *)nat, sizeof(*nat));
+ /*
+ * Initialize all these so that nat_delete() doesn't cause a crash.
+ */
+ nat->nat_hstart[0] = NULL;
+ nat->nat_hstart[1] = NULL;
+ fr = nat->nat_fr;
+ nat->nat_fr = NULL;
+ aps = nat->nat_aps;
+ nat->nat_aps = NULL;
+ in = nat->nat_ptr;
+ nat->nat_ptr = NULL;
+ nat->nat_data = NULL;
+
+ /*
+ * Restore the rule associated with this nat session
+ */
+ if (in) {
+ KMALLOC(in, ipnat_t *);
+ if (in == NULL) {
+ error = ENOMEM;
+ goto junkput;
+ }
+ nat->nat_ptr = in;
+ bcopy((char *)&ipn.ipn_ipnat, (char *)in, sizeof(*in));
+ in->in_use = 1;
+ in->in_flags |= IPN_DELETE;
+ in->in_next = NULL;
+ in->in_rnext = NULL;
+ in->in_prnext = NULL;
+ in->in_mnext = NULL;
+ in->in_pmnext = NULL;
+ in->in_ifp = GETUNIT(in->in_ifname, 4);
+ if (in->in_plabel[0] != '\0') {
+ in->in_apr = appr_match(in->in_p, in->in_plabel);
+ }
+ }
+
+ /*
+ * Restore ap_session_t structure. Include the private data allocated
+ * if it was there.
+ */
+ if (aps) {
+ KMALLOC(aps, ap_session_t *);
+ if (aps == NULL) {
+ error = ENOMEM;
+ goto junkput;
+ }
+ nat->nat_aps = aps;
+ aps->aps_next = ap_sess_list;
+ ap_sess_list = aps;
+ bcopy(ipnn->ipn_data, (char *)aps, sizeof(*aps));
+ if (in)
+ aps->aps_apr = in->in_apr;
+ if (aps->aps_psiz) {
+ KMALLOCS(aps->aps_data, void *, aps->aps_psiz);
+ if (aps->aps_data == NULL) {
+ error = ENOMEM;
+ goto junkput;
+ }
+ bcopy(ipnn->ipn_data + sizeof(*aps), aps->aps_data,
+ aps->aps_psiz);
+ } else {
+ aps->aps_psiz = 0;
+ aps->aps_data = NULL;
+ }
+ }
+
+ /*
+ * If there was a filtering rule associated with this entry then
+ * build up a new one.
+ */
+ if (fr != NULL) {
+ if (nat->nat_flags & FI_NEWFR) {
+ KMALLOC(fr, frentry_t *);
+ nat->nat_fr = fr;
+ if (fr == NULL) {
+ error = ENOMEM;
+ goto junkput;
+ }
+ bcopy((char *)&ipn.ipn_fr, (char *)fr, sizeof(*fr));
+ ipn.ipn_nat.nat_fr = fr;
+ error = IWCOPY((caddr_t)&ipn, ipnp, sizeof(ipn));
+ if (error) {
+ error = EFAULT;
+ goto junkput;
+ }
+ } else {
+ for (n = nat_instances; n; n = n->nat_next)
+ if (n->nat_fr == fr)
+ break;
+ if (!n) {
+ error = ESRCH;
+ goto junkput;
+ }
+ }
+ }
+
+ if (ipnn)
+ KFREES(ipnn, sizeof(ipn) + ipn.ipn_dsize);
+ nat_insert(nat);
+ return 0;
+junkput:
+ if (ipnn)
+ KFREES(ipnn, sizeof(ipn) + ipn.ipn_dsize);
+ if (nat)
+ nat_delete(nat);
return error;
}
@@ -350,41 +957,52 @@ struct nat *natd;
register struct nat **natp, *nat;
struct ipnat *ipn;
- for (natp = natd->nat_hstart[0]; (nat = *natp);
+ for (natp = natd->nat_hstart[0]; natp && (nat = *natp);
natp = &nat->nat_hnext[0])
if (nat == natd) {
*natp = nat->nat_hnext[0];
break;
}
- for (natp = natd->nat_hstart[1]; (nat = *natp);
+ for (natp = natd->nat_hstart[1]; natp && (nat = *natp);
natp = &nat->nat_hnext[1])
if (nat == natd) {
*natp = nat->nat_hnext[1];
break;
}
+ if (natd->nat_fr != NULL) {
+ ATOMIC_DEC32(natd->nat_fr->fr_ref);
+ }
+
+ if (natd->nat_hm != NULL)
+ nat_hostmapdel(natd->nat_hm);
+
/*
* If there is an active reference from the nat entry to its parent
* rule, decrement the rule's reference count and free it too if no
* longer being used.
*/
- if ((ipn = natd->nat_ptr)) {
+ ipn = natd->nat_ptr;
+ if (ipn != NULL) {
ipn->in_space++;
ipn->in_use--;
if (!ipn->in_use && (ipn->in_flags & IPN_DELETE)) {
if (ipn->in_apr)
- ap_free(ipn->in_apr);
+ appr_free(ipn->in_apr);
KFREE(ipn);
nat_stats.ns_rules--;
}
}
+ MUTEX_DESTROY(&natd->nat_lock);
/*
* If there's a fragment table entry too for this nat entry, then
* dereference that as well.
*/
ipfr_forget((void *)natd);
+ aps_free(natd->nat_aps);
+ nat_stats.ns_inuse--;
KFREE(natd);
}
@@ -398,135 +1016,79 @@ static int nat_flushtable()
register int j = 0;
/*
- * Everything will be deleted, so lets just make it the deletions
+ * ALL NAT mappings deleted, so lets just make the deletions
* quicker.
*/
- bzero((char *)nat_table[0], sizeof(nat_table[0]));
- bzero((char *)nat_table[1], sizeof(nat_table[1]));
+ if (nat_table[0] != NULL)
+ bzero((char *)nat_table[0],
+ sizeof(nat_table[0]) * ipf_nattable_sz);
+ if (nat_table[1] != NULL)
+ bzero((char *)nat_table[1],
+ sizeof(nat_table[1]) * ipf_nattable_sz);
for (natp = &nat_instances; (nat = *natp); ) {
*natp = nat->nat_next;
nat_delete(nat);
j++;
}
-
+ nat_stats.ns_inuse = 0;
return j;
}
/*
- * nat_clearlist - delete all entries in the active NAT mapping list.
+ * nat_clearlist - delete all rules in the active NAT mapping list.
*/
static int nat_clearlist()
{
register ipnat_t *n, **np = &nat_list;
int i = 0;
+ if (nat_rules != NULL)
+ bzero((char *)nat_rules, sizeof(*nat_rules) * ipf_natrules_sz);
+ if (rdr_rules != NULL)
+ bzero((char *)rdr_rules, sizeof(*rdr_rules) * ipf_rdrrules_sz);
+
while ((n = *np)) {
*np = n->in_next;
if (!n->in_use) {
if (n->in_apr)
- ap_free(n->in_apr);
+ appr_free(n->in_apr);
KFREE(n);
nat_stats.ns_rules--;
- i++;
} else {
n->in_flags |= IPN_DELETE;
n->in_next = NULL;
}
+ i++;
}
- nat_stats.ns_inuse = 0;
+ nat_masks = 0;
+ rdr_masks = 0;
return i;
}
/*
- * return the first IP Address associated with an interface
- */
-static int nat_ifpaddr(nat, ifptr, inp)
-nat_t *nat;
-void *ifptr;
-struct in_addr *inp;
-{
-#if SOLARIS
- ill_t *ill = ifptr;
-#else
- struct ifnet *ifp = ifptr;
-#endif
- struct in_addr in;
-
-#if SOLARIS
- in.s_addr = ntohl(ill->ill_ipif->ipif_local_addr);
-#else /* SOLARIS */
-# if linux
- ;
-# else /* linux */
- struct ifaddr *ifa;
- struct sockaddr_in *sin;
-
-# if (__FreeBSD_version >= 300000)
- ifa = TAILQ_FIRST(&ifp->if_addrhead);
-# else
-# if defined(__NetBSD__) || defined(__OpenBSD__)
- ifa = ifp->if_addrlist.tqh_first;
-# else
-# if defined(__sgi) && defined(IFF_DRVRLOCK) /* IRIX 6 */
- ifa = &((struct in_ifaddr *)ifp->in_ifaddr)->ia_ifa;
-# else
- ifa = ifp->if_addrlist;
-# endif
-# endif /* __NetBSD__ || __OpenBSD__ */
-# endif /* __FreeBSD_version >= 300000 */
-# if (BSD < 199306) && !(/*IRIX6*/defined(__sgi) && defined(IFF_DRVRLOCK))
- sin = (SOCKADDR_IN *)&ifa->ifa_addr;
-# else
- sin = (SOCKADDR_IN *)ifa->ifa_addr;
- while (sin && ifa &&
- sin->sin_family != AF_INET) {
-# if (__FreeBSD_version >= 300000)
- ifa = TAILQ_NEXT(ifa, ifa_link);
-# else
-# if defined(__NetBSD__) || defined(__OpenBSD__)
- ifa = ifa->ifa_list.tqe_next;
-# else
- ifa = ifa->ifa_next;
-# endif
-# endif /* __FreeBSD_version >= 300000 */
- if (ifa)
- sin = (SOCKADDR_IN *)ifa->ifa_addr;
- }
- if (!ifa)
- sin = NULL;
- if (!sin) {
- KFREE(nat);
- return -1;
- }
-# endif /* (BSD < 199306) && (!__sgi && IFF_DRVLOCK) */
- in = sin->sin_addr;
- in.s_addr = ntohl(in.s_addr);
-# endif /* linux */
-#endif /* SOLARIS */
- *inp = in;
- return 0;
-}
-
-
-/*
* Create a new NAT table entry.
+ * NOTE: assumes write lock on ipf_nat has been obtained already.
*/
nat_t *nat_new(np, ip, fin, flags, direction)
ipnat_t *np;
ip_t *ip;
fr_info_t *fin;
-u_short flags;
+u_int flags;
int direction;
{
register u_32_t sum1, sum2, sumd, l;
u_short port = 0, sport = 0, dport = 0, nport = 0;
- struct in_addr in;
+ struct in_addr in, inb;
tcphdr_t *tcp = NULL;
- nat_t *nat, **natp;
+ hostmap_t *hm = NULL;
+ nat_t *nat, *natl;
u_short nflags;
+#if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
+ qif_t *qf = fin->fin_qif;
+#endif
nflags = flags & np->in_flags;
if (flags & IPN_TCPUDP) {
@@ -536,96 +1098,247 @@ int direction;
}
/* Give me a new nat */
- KMALLOC(nat, nat_t *, sizeof(*nat));
- if (nat == NULL)
+ KMALLOC(nat, nat_t *);
+ if (nat == NULL) {
+ nat_stats.ns_memfail++;
return NULL;
+ }
bzero((char *)nat, sizeof(*nat));
nat->nat_flags = flags;
-
/*
* Search the current table for a match.
*/
if (direction == NAT_OUTBOUND) {
/*
+ * Values at which the search for a free resouce starts.
+ */
+ u_32_t st_ip;
+ u_short st_port;
+
+ /*
* If it's an outbound packet which doesn't match any existing
* record, then create a new port
*/
l = 0;
+ st_ip = np->in_nip;
+ st_port = np->in_pnext;
+
do {
- l++;
port = 0;
- in.s_addr = np->in_nip;
- if (!in.s_addr && (np->in_outmsk == 0xffffffff)) {
- if ((l > 1) ||
- nat_ifpaddr(nat, fin->fin_ifp, &in) == -1) {
- KFREE(nat);
- return NULL;
- }
- } else if (!in.s_addr && !np->in_outmsk) {
- if (l > 1) {
- KFREE(nat);
- return NULL;
+ in.s_addr = htonl(np->in_nip);
+ if (l == 0) {
+ /*
+ * Check to see if there is an existing NAT
+ * setup for this IP address pair.
+ */
+ hm = nat_hostmap(np, ip->ip_src, in);
+ if (hm != NULL)
+ in.s_addr = hm->hm_mapip.s_addr;
+ } else if ((l == 1) && (hm != NULL)) {
+ nat_hostmapdel(hm);
+ hm = NULL;
+ }
+ in.s_addr = ntohl(in.s_addr);
+
+ nat->nat_hm = hm;
+
+ if ((np->in_outmsk == 0xffffffff) &&
+ (np->in_pnext == 0)) {
+ if (l > 0)
+ goto badnat;
+ }
+
+ if (np->in_redir & NAT_MAPBLK) {
+ if ((l >= np->in_ppip) || ((l > 0) &&
+ !(flags & IPN_TCPUDP)))
+ goto badnat;
+ /*
+ * map-block - Calculate destination address.
+ */
+ in.s_addr = ntohl(ip->ip_src.s_addr);
+ in.s_addr &= ntohl(~np->in_inmsk);
+ inb.s_addr = in.s_addr;
+ in.s_addr /= np->in_ippip;
+ in.s_addr &= ntohl(~np->in_outmsk);
+ in.s_addr += ntohl(np->in_outip);
+ /*
+ * Calculate destination port.
+ */
+ if ((flags & IPN_TCPUDP) &&
+ (np->in_ppip != 0)) {
+ port = ntohs(sport) + l;
+ port %= np->in_ppip;
+ port += np->in_ppip *
+ (inb.s_addr % np->in_ippip);
+ port += MAPBLK_MINPORT;
+ port = htons(port);
}
+ } else if (!np->in_outip &&
+ (np->in_outmsk == 0xffffffff)) {
+ /*
+ * 0/32 - use the interface's IP address.
+ */
+ if ((l > 0) ||
+ fr_ifpaddr(4, fin->fin_ifp, &in) == -1)
+ goto badnat;
+ in.s_addr = ntohl(in.s_addr);
+ } else if (!np->in_outip && !np->in_outmsk) {
+ /*
+ * 0/0 - use the original source address/port.
+ */
+ if (l > 0)
+ goto badnat;
in.s_addr = ntohl(ip->ip_src.s_addr);
- if (nflags & IPN_TCPUDP)
- port = sport;
- } else if (nflags & IPN_TCPUDP) {
+ } else if ((np->in_outmsk != 0xffffffff) &&
+ (np->in_pnext == 0) &&
+ ((l > 0) || (hm == NULL)))
+ np->in_nip++;
+ natl = NULL;
+
+ if ((nflags & IPN_TCPUDP) &&
+ ((np->in_redir & NAT_MAPBLK) == 0) &&
+ (np->in_flags & IPN_AUTOPORTMAP)) {
+ if ((l > 0) && (l % np->in_ppip == 0)) {
+ if (l > np->in_space) {
+ goto badnat;
+ } else if ((l > np->in_ppip) &&
+ np->in_outmsk != 0xffffffff)
+ np->in_nip++;
+ }
+ if (np->in_ppip != 0) {
+ port = ntohs(sport);
+ port += (l % np->in_ppip);
+ port %= np->in_ppip;
+ port += np->in_ppip *
+ (ntohl(ip->ip_src.s_addr) %
+ np->in_ippip);
+ port += MAPBLK_MINPORT;
+ port = htons(port);
+ }
+ } else if (((np->in_redir & NAT_MAPBLK) == 0) &&
+ (nflags & IPN_TCPUDP) &&
+ (np->in_pnext != 0)) {
port = htons(np->in_pnext++);
- if (np->in_pnext >= ntohs(np->in_pmax)) {
+ if (np->in_pnext > ntohs(np->in_pmax)) {
np->in_pnext = ntohs(np->in_pmin);
- np->in_space--;
if (np->in_outmsk != 0xffffffff)
np->in_nip++;
}
- } else if (np->in_outmsk != 0xffffffff) {
- np->in_space--;
- np->in_nip++;
+ }
+
+ if (np->in_flags & IPN_IPRANGE) {
+ if (np->in_nip > ntohl(np->in_outmsk))
+ np->in_nip = ntohl(np->in_outip);
+ } else {
+ if ((np->in_outmsk != 0xffffffff) &&
+ ((np->in_nip + 1) & ntohl(np->in_outmsk)) >
+ ntohl(np->in_outip))
+ np->in_nip = ntohl(np->in_outip) + 1;
}
if (!port && (flags & IPN_TCPUDP))
port = sport;
- if ((np->in_nip & ntohl(np->in_outmsk)) >
- ntohl(np->in_outip))
- np->in_nip = ntohl(np->in_outip) + 1;
- } while (nat_inlookup(fin->fin_ifp, flags, ip->ip_dst,
- dport, in, port));
+
+ /*
+ * Here we do a lookup of the connection as seen from
+ * the outside. If an IP# pair already exists, try
+ * again. So if you have A->B becomes C->B, you can
+ * also have D->E become C->E but not D->B causing
+ * another C->B. Also take protocol and ports into
+ * account when determining whether a pre-existing
+ * NAT setup will cause an external conflict where
+ * this is appropriate.
+ */
+ inb.s_addr = htonl(in.s_addr);
+ natl = nat_inlookup(fin->fin_ifp, flags & ~FI_WILDP,
+ (u_int)ip->ip_p, ip->ip_dst, inb,
+ (port << 16) | dport);
+
+ /*
+ * Has the search wrapped around and come back to the
+ * start ?
+ */
+ if ((natl != NULL) &&
+ (np->in_pnext != 0) && (st_port == np->in_pnext) &&
+ (np->in_nip != 0) && (st_ip == np->in_nip))
+ goto badnat;
+ l++;
+ } while (natl != NULL);
+
+ if (np->in_space > 0)
+ np->in_space--;
/* Setup the NAT table */
nat->nat_inip = ip->ip_src;
nat->nat_outip.s_addr = htonl(in.s_addr);
nat->nat_oip = ip->ip_dst;
+ if (nat->nat_hm == NULL)
+ nat->nat_hm = nat_hostmap(np, ip->ip_src,
+ nat->nat_outip);
- sum1 = (ntohl(ip->ip_src.s_addr) & 0xffff) +
- (ntohl(ip->ip_src.s_addr) >> 16) + ntohs(sport);
-
- sum2 = (in.s_addr & 0xffff) + (in.s_addr >> 16) + ntohs(port);
+ sum1 = LONG_SUM(ntohl(ip->ip_src.s_addr)) + ntohs(sport);
+ sum2 = LONG_SUM(in.s_addr) + ntohs(port);
if (flags & IPN_TCPUDP) {
nat->nat_inport = sport;
- nat->nat_outport = port;
+ nat->nat_outport = port; /* sport */
nat->nat_oport = dport;
}
} else {
-
/*
* Otherwise, it's an inbound packet. Most likely, we don't
* want to rewrite source ports and source addresses. Instead,
* we want to rewrite to a fixed internal address and fixed
* internal port.
*/
- in.s_addr = ntohl(np->in_inip);
- if (!(nport = np->in_pnext))
+ if (np->in_flags & IPN_SPLIT) {
+ in.s_addr = np->in_nip;
+ if (np->in_inip == htonl(in.s_addr))
+ np->in_nip = ntohl(np->in_inmsk);
+ else {
+ np->in_nip = ntohl(np->in_inip);
+ if (np->in_flags & IPN_ROUNDR) {
+ nat_delrdr(np);
+ nat_addrdr(np);
+ }
+ }
+ } else {
+ in.s_addr = ntohl(np->in_inip);
+ if (np->in_flags & IPN_ROUNDR) {
+ nat_delrdr(np);
+ nat_addrdr(np);
+ }
+ }
+ if (!np->in_pnext)
nport = dport;
+ else {
+ /*
+ * Whilst not optimized for the case where
+ * pmin == pmax, the gain is not significant.
+ */
+ nport = ntohs(dport) - ntohs(np->in_pmin) +
+ ntohs(np->in_pnext);
+ nport = htons(nport);
+ }
+
+ /*
+ * When the redirect-to address is set to 0.0.0.0, just
+ * assume a blank `forwarding' of the packet. We don't
+ * setup any translation for this either.
+ */
+ if (in.s_addr == 0) {
+ if (nport == dport)
+ goto badnat;
+ in.s_addr = ntohl(ip->ip_dst.s_addr);
+ }
nat->nat_inip.s_addr = htonl(in.s_addr);
nat->nat_outip = ip->ip_dst;
nat->nat_oip = ip->ip_src;
- sum1 = (ntohl(ip->ip_dst.s_addr) & 0xffff) +
- (ntohl(ip->ip_dst.s_addr) >> 16) + ntohs(dport);
-
- sum2 = (in.s_addr & 0xffff) + (in.s_addr >> 16) + ntohs(nport);
+ sum1 = LONG_SUM(ntohl(ip->ip_dst.s_addr)) + ntohs(dport);
+ sum2 = LONG_SUM(in.s_addr) + ntohs(nport);
if (flags & IPN_TCPUDP) {
nat->nat_inport = nport;
@@ -634,62 +1347,53 @@ int direction;
}
}
- /* Do it twice */
- sum1 = (sum1 & 0xffff) + (sum1 >> 16);
- sum1 = (sum1 & 0xffff) + (sum1 >> 16);
-
- /* Do it twice */
- sum2 = (sum2 & 0xffff) + (sum2 >> 16);
- sum2 = (sum2 & 0xffff) + (sum2 >> 16);
-
- if (sum1 > sum2)
- sum2--; /* Because ~1 == -2, We really need ~1 == -1 */
- sumd = sum2 - sum1;
- sumd = (sumd & 0xffff) + (sumd >> 16);
- nat->nat_sumd = (sumd & 0xffff) + (sumd >> 16);
+ CALC_SUMD(sum1, sum2, sumd);
+ nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
+#if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
+ if ((flags == IPN_TCP) && dohwcksum &&
+ (qf->qf_ill->ill_ick.ick_magic == ICK_M_CTL_MAGIC)) {
+ if (direction == NAT_OUTBOUND)
+ sum1 = LONG_SUM(ntohl(in.s_addr));
+ else
+ sum1 = LONG_SUM(ntohl(ip->ip_src.s_addr));
+ sum1 += LONG_SUM(ntohl(ip->ip_dst.s_addr));
+ sum1 += 30;
+ sum1 = (sum1 & 0xffff) + (sum1 >> 16);
+ nat->nat_sumd[1] = NAT_HW_CKSUM|(sum1 & 0xffff);
+ } else
+#endif
+ nat->nat_sumd[1] = nat->nat_sumd[0];
if ((flags & IPN_TCPUDP) && ((sport != port) || (dport != nport))) {
if (direction == NAT_OUTBOUND)
- sum1 = (ntohl(ip->ip_src.s_addr) & 0xffff) +
- (ntohl(ip->ip_src.s_addr) >> 16);
+ sum1 = LONG_SUM(ntohl(ip->ip_src.s_addr));
else
- sum1 = (ntohl(ip->ip_dst.s_addr) & 0xffff) +
- (ntohl(ip->ip_dst.s_addr) >> 16);
-
- sum2 = (in.s_addr & 0xffff) + (in.s_addr >> 16);
-
- /* Do it twice */
- sum1 = (sum1 & 0xffff) + (sum1 >> 16);
- sum1 = (sum1 & 0xffff) + (sum1 >> 16);
+ sum1 = LONG_SUM(ntohl(ip->ip_dst.s_addr));
- /* Do it twice */
- sum2 = (sum2 & 0xffff) + (sum2 >> 16);
- sum2 = (sum2 & 0xffff) + (sum2 >> 16);
+ sum2 = LONG_SUM(in.s_addr);
- if (sum1 > sum2)
- sum2--; /* Because ~1 == -2, We really need ~1 == -1 */
- sumd = sum2 - sum1;
- sumd = (sumd & 0xffff) + (sumd >> 16);
+ CALC_SUMD(sum1, sum2, sumd);
nat->nat_ipsumd = (sumd & 0xffff) + (sumd >> 16);
} else
- nat->nat_ipsumd = nat->nat_sumd;
+ nat->nat_ipsumd = nat->nat_sumd[0];
in.s_addr = htonl(in.s_addr);
- nat->nat_next = nat_instances;
- nat_instances = nat;
- natp = &nat_table[0][nat->nat_inip.s_addr % NAT_SIZE];
- nat->nat_hstart[0] = natp;
- nat->nat_hnext[0] = *natp;
- *natp = nat;
- natp = &nat_table[1][nat->nat_outip.s_addr % NAT_SIZE];
- nat->nat_hstart[1] = natp;
- nat->nat_hnext[1] = *natp;
- *natp = nat;
+
+#ifdef _KERNEL
+ strncpy(nat->nat_ifname, IFNAME(fin->fin_ifp), IFNAMSIZ);
+#endif
+ nat_insert(nat);
+
+ nat->nat_dir = direction;
+ nat->nat_ifp = fin->fin_ifp;
nat->nat_ptr = np;
+ nat->nat_p = ip->ip_p;
nat->nat_bytes = 0;
nat->nat_pkts = 0;
- nat->nat_ifp = fin->fin_ifp;
- nat->nat_dir = direction;
+ nat->nat_fr = fin->fin_fr;
+ if (nat->nat_fr != NULL) {
+ ATOMIC_INC32(nat->nat_fr->fr_ref);
+ }
if (direction == NAT_OUTBOUND) {
if (flags & IPN_TCPUDP)
tcp->th_sport = port;
@@ -697,16 +1401,55 @@ int direction;
if (flags & IPN_TCPUDP)
tcp->th_dport = nport;
}
- nat_stats.ns_added++;
- nat_stats.ns_inuse++;
np->in_use++;
return nat;
+badnat:
+ nat_stats.ns_badnat++;
+ if ((hm = nat->nat_hm) != NULL)
+ nat_hostmapdel(hm);
+ KFREE(nat);
+ return NULL;
+}
+
+
+void nat_insert(nat)
+nat_t *nat;
+{
+ nat_t **natp;
+ u_int hv;
+
+ MUTEX_INIT(&nat->nat_lock, "nat entry lock", NULL);
+
+ nat->nat_age = fr_defnatage;
+ nat->nat_ifname[sizeof(nat->nat_ifname) - 1] = '\0';
+ if (nat->nat_ifname[0] !='\0') {
+ nat->nat_ifp = GETUNIT(nat->nat_ifname, 4);
+ }
+
+ nat->nat_next = nat_instances;
+ nat_instances = nat;
+ hv = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport,
+ ipf_nattable_sz);
+ natp = &nat_table[0][hv];
+ nat->nat_hstart[0] = natp;
+ nat->nat_hnext[0] = *natp;
+ *natp = nat;
+ hv = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport,
+ ipf_nattable_sz);
+ natp = &nat_table[1][hv];
+ nat->nat_hstart[1] = natp;
+ nat->nat_hnext[1] = *natp;
+ *natp = nat;
+
+ nat_stats.ns_added++;
+ nat_stats.ns_inuse++;
}
-nat_t *nat_icmpinlookup(ip, fin)
+nat_t *nat_icmplookup(ip, fin, dir)
ip_t *ip;
fr_info_t *fin;
+int dir;
{
icmphdr_t *icmp;
tcphdr_t *tcp = NULL;
@@ -719,7 +1462,7 @@ fr_info_t *fin;
* Only a basic IP header (no options) should be with an ICMP error
* header.
*/
- if ((ip->ip_hl != 5) || (ip->ip_len < sizeof(*icmp) + sizeof(ip_t)))
+ if ((ip->ip_hl != 5) || (ip->ip_len < ICMPERR_MINPKTLEN))
return NULL;
type = icmp->icmp_type;
/*
@@ -731,16 +1474,29 @@ fr_info_t *fin;
return NULL;
oip = (ip_t *)((char *)fin->fin_dp + 8);
+ if (ip->ip_len < ICMPERR_MAXPKTLEN + ((oip->ip_hl - 5) << 2))
+ return NULL;
if (oip->ip_p == IPPROTO_TCP)
flags = IPN_TCP;
else if (oip->ip_p == IPPROTO_UDP)
flags = IPN_UDP;
if (flags & IPN_TCPUDP) {
tcp = (tcphdr_t *)((char *)oip + (oip->ip_hl << 2));
- return nat_inlookup(fin->fin_ifp, flags, oip->ip_dst,
- tcp->th_dport, oip->ip_src, tcp->th_sport);
+ if (dir == NAT_INBOUND)
+ return nat_inlookup(fin->fin_ifp, flags,
+ (u_int)oip->ip_p, oip->ip_dst, oip->ip_src,
+ (tcp->th_sport << 16) | tcp->th_dport);
+ else
+ return nat_outlookup(fin->fin_ifp, flags,
+ (u_int)oip->ip_p, oip->ip_dst, oip->ip_src,
+ (tcp->th_sport << 16) | tcp->th_dport);
}
- return nat_inlookup(fin->fin_ifp, 0, oip->ip_src, 0, oip->ip_dst, 0);
+ if (dir == NAT_INBOUND)
+ return nat_inlookup(fin->fin_ifp, 0, (u_int)oip->ip_p,
+ oip->ip_dst, oip->ip_src, 0);
+ else
+ return nat_outlookup(fin->fin_ifp, 0, (u_int)oip->ip_p,
+ oip->ip_dst, oip->ip_src, 0);
}
@@ -748,22 +1504,24 @@ fr_info_t *fin;
* This should *ONLY* be used for incoming packets to make sure a NAT'd ICMP
* packet gets correctly recognised.
*/
-nat_t *nat_icmpin(ip, fin, nflags)
+nat_t *nat_icmp(ip, fin, nflags, dir)
ip_t *ip;
fr_info_t *fin;
-int *nflags;
+u_int *nflags;
+int dir;
{
+ u_32_t sum1, sum2, sumd;
+ struct in_addr in;
icmphdr_t *icmp;
nat_t *nat;
ip_t *oip;
int flags = 0;
- if (!(nat = nat_icmpinlookup(ip, fin)))
+ if ((ip->ip_v != 4) || !(nat = nat_icmplookup(ip, fin, dir)))
return NULL;
-
*nflags = IPN_ICMPERR;
icmp = (icmphdr_t *)fin->fin_dp;
- oip = (ip_t *)((char *)icmp + 8);
+ oip = (ip_t *)&icmp->icmp_ip;
if (oip->ip_p == IPPROTO_TCP)
flags = IPN_TCP;
else if (oip->ip_p == IPPROTO_UDP)
@@ -777,54 +1535,62 @@ int *nflags;
* to only modify the checksum once for the port # and twice
* for the IP#.
*/
- if (flags & IPN_TCPUDP) {
- tcphdr_t *tcp = (tcphdr_t *)(oip + 1);
- u_32_t sum1, sum2, sumd;
- struct in_addr in;
- if (nat->nat_dir == NAT_OUTBOUND) {
- sum1 = LONG_SUM(ntohl(oip->ip_src.s_addr));
- in = nat->nat_outip;
- oip->ip_src = in;
- tcp->th_sport = nat->nat_outport;
- } else {
- sum1 = LONG_SUM(ntohl(oip->ip_dst.s_addr));
- in = nat->nat_inip;
- oip->ip_dst = in;
- tcp->th_dport = nat->nat_inport;
- }
+ if (nat->nat_dir == NAT_OUTBOUND) {
+ sum1 = LONG_SUM(ntohl(oip->ip_src.s_addr));
+ in = nat->nat_inip;
+ oip->ip_src = in;
+ } else {
+ sum1 = LONG_SUM(ntohl(oip->ip_dst.s_addr));
+ in = nat->nat_outip;
+ oip->ip_dst = in;
+ }
- sum2 = LONG_SUM(in.s_addr);
+ sum2 = LONG_SUM(ntohl(in.s_addr));
- CALC_SUMD(sum1, sum2, sumd);
- sumd = (sumd & 0xffff) + (sumd >> 16);
+ CALC_SUMD(sum1, sum2, sumd);
- if (nat->nat_dir == NAT_OUTBOUND) {
- fix_incksum(&oip->ip_sum, sumd);
- fix_incksum(&icmp->icmp_cksum, sumd);
- } else {
- fix_outcksum(&oip->ip_sum, sumd);
- fix_outcksum(&icmp->icmp_cksum, sumd);
- }
+ if (nat->nat_dir == NAT_OUTBOUND) {
+ fix_incksum(&oip->ip_sum, sumd, 0);
- /*
- * TCP checksum doesn't make it into the 1st eight
- * bytes but UDP does.
- */
- if (ip->ip_p == IPPROTO_UDP) {
- udphdr_t *udp = (udphdr_t *)tcp;
+ sumd += (sumd & 0xffff);
+ while (sumd > 0xffff)
+ sumd = (sumd & 0xffff) + (sumd >> 16);
+ fix_outcksum(&icmp->icmp_cksum, sumd, 0);
+ } else {
+ fix_outcksum(&oip->ip_sum, sumd, 0);
- if (udp->uh_sum) {
- if (nat->nat_dir == NAT_OUTBOUND)
- fix_incksum(&udp->uh_sum,
- nat->nat_sumd);
- else
- fix_outcksum(&udp->uh_sum,
- nat->nat_sumd);
+ sumd += (sumd & 0xffff);
+ while (sumd > 0xffff)
+ sumd = (sumd & 0xffff) + (sumd >> 16);
+/* fix_incksum(&icmp->icmp_cksum, sumd, 0); */
+ }
+
+
+ if ((flags & IPN_TCPUDP) != 0) {
+ tcphdr_t *tcp;
+
+ /* XXX - what if this is bogus hl and we go off the end ? */
+ tcp = (tcphdr_t *)((((char *)oip) + (oip->ip_hl << 2)));
+
+ if (nat->nat_dir == NAT_OUTBOUND) {
+ if (tcp->th_sport != nat->nat_inport) {
+ sum1 = ntohs(tcp->th_sport);
+ sum2 = ntohs(nat->nat_inport);
+ CALC_SUMD(sum1, sum2, sumd);
+ tcp->th_sport = nat->nat_inport;
+ fix_outcksum(&icmp->icmp_cksum, sumd, 0);
+ }
+ } else {
+ if (tcp->th_dport != nat->nat_outport) {
+ sum1 = ntohs(tcp->th_dport);
+ sum2 = ntohs(nat->nat_outport);
+ CALC_SUMD(sum1, sum2, sumd);
+ tcp->th_dport = nat->nat_outport;
+ fix_incksum(&icmp->icmp_cksum, sumd, 0);
}
}
- } else
- ip->ip_dst = nat->nat_outip;
+ }
nat->nat_age = fr_defnaticmpage;
return nat;
}
@@ -840,29 +1606,35 @@ int *nflags;
* we're looking for a table entry, based on the destination address.
* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY.
*/
-#ifdef __STDC__
-nat_t *nat_inlookup(void *ifp, int flags, struct in_addr src, u_short sport, struct in_addr mapdst, u_short mapdport)
-#else
-nat_t *nat_inlookup(ifp, flags, src, sport, mapdst, mapdport)
+nat_t *nat_inlookup(ifp, flags, p, src, mapdst, ports)
void *ifp;
-register int flags;
+register u_int flags, p;
struct in_addr src , mapdst;
-u_short sport, mapdport;
-#endif
+u_32_t ports;
{
+ register u_short sport, mapdport;
register nat_t *nat;
+ register int nflags;
+ u_int hv;
+ mapdport = ports >> 16;
+ sport = ports & 0xffff;
flags &= IPN_TCPUDP;
- nat = nat_table[1][mapdst.s_addr % NAT_SIZE];
- for (; nat; nat = nat->nat_hnext[1])
+ hv = NAT_HASH_FN(mapdst.s_addr, mapdport, ipf_nattable_sz);
+ nat = nat_table[1][hv];
+ for (; nat; nat = nat->nat_hnext[1]) {
+ nflags = nat->nat_flags;
if ((!ifp || ifp == nat->nat_ifp) &&
nat->nat_oip.s_addr == src.s_addr &&
nat->nat_outip.s_addr == mapdst.s_addr &&
- flags == nat->nat_flags && (!flags ||
- (nat->nat_oport == sport &&
- nat->nat_outport == mapdport)))
+ (((p == 0) && (flags == (nat->nat_flags & IPN_TCPUDP)))
+ || (p == nat->nat_p)) && (!flags ||
+ (((nat->nat_oport == sport) || (nflags & FI_W_DPORT)) &&
+ ((nat->nat_outport == mapdport) ||
+ (nflags & FI_W_SPORT)))))
return nat;
+ }
return NULL;
}
@@ -873,27 +1645,33 @@ u_short sport, mapdport;
* we're looking for a table entry, based on the source address.
* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY.
*/
-#ifdef __STDC__
-nat_t *nat_outlookup(void *ifp, int flags, struct in_addr src, u_short sport, struct in_addr dst, u_short dport)
-#else
-nat_t *nat_outlookup(ifp, flags, src, sport, dst, dport)
+nat_t *nat_outlookup(ifp, flags, p, src, dst, ports)
void *ifp;
-register int flags;
+register u_int flags, p;
struct in_addr src , dst;
-u_short sport, dport;
-#endif
+u_32_t ports;
{
+ register u_short sport, dport;
register nat_t *nat;
+ register int nflags;
+ u_int hv;
+ sport = ports & 0xffff;
+ dport = ports >> 16;
flags &= IPN_TCPUDP;
- nat = nat_table[0][src.s_addr % NAT_SIZE];
+ hv = NAT_HASH_FN(src.s_addr, sport, ipf_nattable_sz);
+ nat = nat_table[0][hv];
for (; nat; nat = nat->nat_hnext[0]) {
+ nflags = nat->nat_flags;
+
if ((!ifp || ifp == nat->nat_ifp) &&
nat->nat_inip.s_addr == src.s_addr &&
nat->nat_oip.s_addr == dst.s_addr &&
- flags == nat->nat_flags && (!flags ||
- (nat->nat_inport == sport && nat->nat_oport == dport)))
+ (((p == 0) && (flags == (nat->nat_flags & IPN_TCPUDP)))
+ || (p == nat->nat_p)) && (!flags ||
+ ((nat->nat_inport == sport || nflags & FI_W_SPORT) &&
+ (nat->nat_oport == dport || nflags & FI_W_DPORT))))
return nat;
}
return NULL;
@@ -901,52 +1679,21 @@ u_short sport, dport;
/*
- * Lookup a nat entry based on the mapped source ip address/port and
- * real destination address/port. We use this lookup when sending a packet
- * out, we're looking for a table entry, based on the source address.
- */
-#ifdef __STDC__
-nat_t *nat_lookupmapip(void *ifp, int flags, struct in_addr mapsrc, u_short mapsport, struct in_addr dst, u_short dport)
-#else
-nat_t *nat_lookupmapip(ifp, flags, mapsrc, mapsport, dst, dport)
-void *ifp;
-register int flags;
-struct in_addr mapsrc , dst;
-u_short mapsport, dport;
-#endif
-{
- register nat_t *nat;
-
- flags &= IPN_TCPUDP;
-
- nat = nat_table[1][mapsrc.s_addr % NAT_SIZE];
- for (; nat; nat = nat->nat_hnext[0])
- if ((!ifp || ifp == nat->nat_ifp) &&
- nat->nat_oip.s_addr == dst.s_addr &&
- nat->nat_outip.s_addr == mapsrc.s_addr &&
- flags == nat->nat_flags && (!flags ||
- (nat->nat_outport == mapsport &&
- nat->nat_oport == dport)))
- return nat;
- return NULL;
-}
-
-
-/*
* Lookup the NAT tables to search for a matching redirect
*/
nat_t *nat_lookupredir(np)
register natlookup_t *np;
{
+ u_32_t ports;
nat_t *nat;
+ ports = (np->nl_outport << 16) | np->nl_inport;
/*
* If nl_inip is non null, this is a lookup based on the real
* ip address. Else, we use the fake.
*/
- if ((nat = nat_outlookup(NULL, np->nl_flags, np->nl_inip,
- np->nl_inport, np->nl_outip,
- np->nl_outport))) {
+ if ((nat = nat_outlookup(NULL, np->nl_flags, 0, np->nl_inip,
+ np->nl_outip, ports))) {
np->nl_realip = nat->nat_outip;
np->nl_realport = nat->nat_outport;
}
@@ -954,23 +1701,63 @@ register natlookup_t *np;
}
+static int nat_match(fin, np, ip)
+fr_info_t *fin;
+ipnat_t *np;
+ip_t *ip;
+{
+ frtuc_t *ft;
+
+ if (ip->ip_v != 4)
+ return 0;
+
+ if (np->in_p && ip->ip_p != np->in_p)
+ return 0;
+ if (fin->fin_out) {
+ if (!(np->in_redir && (NAT_MAP|NAT_MAPBLK)))
+ return 0;
+ if ((fin->fin_fi.fi_saddr & np->in_inmsk) != np->in_inip)
+ return 0;
+ if ((fin->fin_fi.fi_daddr & np->in_srcmsk) != np->in_srcip)
+ return 0;
+ } else {
+ if (!(np->in_redir && NAT_REDIRECT))
+ return 0;
+ }
+
+ ft = &np->in_tuc;
+ if (!(fin->fin_fi.fi_fl & FI_TCPUDP)) {
+ if (ft->ftu_scmp || ft->ftu_dcmp)
+ return 0;
+ return 1;
+ }
+
+ return fr_tcpudpchk(ft, fin);
+}
+
+
/*
* Packets going out on the external interface go through this.
* Here, the source address requires alteration, if anything.
*/
-int ip_natout(ip, hlen, fin)
+int ip_natout(ip, fin)
ip_t *ip;
-int hlen;
fr_info_t *fin;
{
- register ipnat_t *np;
+ register ipnat_t *np = NULL;
register u_32_t ipa;
tcphdr_t *tcp = NULL;
- u_short nflags = 0, sport = 0, dport = 0, *csump = NULL;
+ u_short sport = 0, dport = 0, *csump = NULL;
struct ifnet *ifp;
+ int natadd = 1;
frentry_t *fr;
+ u_int nflags = 0, hv, msk;
+ u_32_t iph;
nat_t *nat;
- int natadd = 1;
+ int i;
+
+ if (nat_list == NULL || (fr_nat_lock))
+ return 0;
if ((fr = fin->fin_fr) && !(fr->fr_flags & FR_DUP) &&
fr->fr_tif.fd_ifp && fr->fr_tif.fd_ifp != (void *)-1)
@@ -978,12 +1765,12 @@ fr_info_t *fin;
else
ifp = fin->fin_ifp;
- if (!(ip->ip_off & 0x1fff) && !(fin->fin_fi.fi_fl & FI_SHORT)) {
+ if (!(ip->ip_off & IP_OFFMASK) && !(fin->fin_fi.fi_fl & FI_SHORT)) {
if (ip->ip_p == IPPROTO_TCP)
nflags = IPN_TCP;
else if (ip->ip_p == IPPROTO_UDP)
nflags = IPN_UDP;
- if (nflags) {
+ if ((nflags & IPN_TCPUDP)) {
tcp = (tcphdr_t *)fin->fin_dp;
sport = tcp->th_sport;
dport = tcp->th_dport;
@@ -992,25 +1779,56 @@ fr_info_t *fin;
ipa = ip->ip_src.s_addr;
- MUTEX_ENTER(&ipf_nat);
- if ((ip->ip_off & (IP_OFFMASK|IP_MF)) &&
- (nat = ipfr_nat_knownfrag(ip, fin)))
- natadd = 0;
- else if ((nat = nat_outlookup(ifp, nflags, ip->ip_src, sport,
- ip->ip_dst, dport)))
+ READ_ENTER(&ipf_nat);
+
+ if ((ip->ip_p == IPPROTO_ICMP) &&
+ (nat = nat_icmp(ip, fin, &nflags, NAT_OUTBOUND)))
;
- else
+ else if ((ip->ip_off & (IP_OFFMASK|IP_MF)) &&
+ (nat = ipfr_nat_knownfrag(ip, fin)))
+ natadd = 0;
+ else if ((nat = nat_outlookup(ifp, nflags, (u_int)ip->ip_p, ip->ip_src,
+ ip->ip_dst, (dport << 16) | sport))) {
+ nflags = nat->nat_flags;
+ if ((nflags & (FI_W_SPORT|FI_W_DPORT)) != 0) {
+ if ((nflags & FI_W_SPORT) &&
+ (nat->nat_inport != sport))
+ nat->nat_inport = sport;
+ else if ((nflags & FI_W_DPORT) &&
+ (nat->nat_oport != dport))
+ nat->nat_oport = dport;
+ if (nat->nat_outport == 0)
+ nat->nat_outport = sport;
+ nat->nat_flags &= ~(FI_W_DPORT|FI_W_SPORT);
+ nflags = nat->nat_flags;
+ }
+ } else {
+ RWLOCK_EXIT(&ipf_nat);
+ WRITE_ENTER(&ipf_nat);
/*
* If there is no current entry in the nat table for this IP#,
* create one for it (if there is a matching rule).
*/
- for (np = nat_list; np; np = np->in_next)
- if ((np->in_ifp == ifp) && np->in_space &&
- (!np->in_flags || (np->in_flags & nflags)) &&
- ((ipa & np->in_inmsk) == np->in_inip) &&
- ((np->in_redir & NAT_MAP) ||
- (np->in_pnext == sport))) {
- if (*np->in_plabel && !ap_ok(ip, tcp, np))
+ msk = 0xffffffff;
+ i = 32;
+maskloop:
+ iph = ipa & htonl(msk);
+ hv = NAT_HASH_FN(iph, 0, ipf_natrules_sz);
+ for (np = nat_rules[hv]; np; np = np->in_mnext)
+ {
+ if ((np->in_ifp && (np->in_ifp != ifp)) ||
+ !np->in_space)
+ continue;
+ if ((np->in_flags & IPN_RF) &&
+ !(np->in_flags & nflags))
+ continue;
+ if (np->in_flags & IPN_FILTER) {
+ if (!nat_match(fin, np, ip))
+ continue;
+ } else if ((ipa & np->in_inmsk) != np->in_inip)
+ continue;
+ if (np->in_redir & (NAT_MAP|NAT_MAPBLK)) {
+ if (*np->in_plabel && !appr_ok(ip, tcp, np))
continue;
/*
* If it's a redirection, then we don't want to
@@ -1018,80 +1836,109 @@ fr_info_t *fin;
* Redirections are only for incoming
* connections.
*/
- if (!(np->in_redir & NAT_MAP))
+ if (!(np->in_redir & (NAT_MAP|NAT_MAPBLK)))
continue;
- if ((nat = nat_new(np, ip, fin, nflags,
- NAT_OUTBOUND)))
+ if ((nat = nat_new(np, ip, fin, (u_int)nflags,
+ NAT_OUTBOUND))) {
+ np->in_hits++;
#ifdef IPFILTER_LOG
- nat_log(nat, (u_short)np->in_redir);
-#else
- ;
+ nat_log(nat, (u_int)np->in_redir);
#endif
- break;
+ break;
+ }
}
+ }
+ if ((np == NULL) && (i > 0)) {
+ do {
+ i--;
+ msk <<= 1;
+ } while ((i >= 0) && ((nat_masks & (1 << i)) == 0));
+ if (i >= 0)
+ goto maskloop;
+ }
+ MUTEX_DOWNGRADE(&ipf_nat);
+ }
if (nat) {
- if (natadd && fin->fin_fi.fi_fl & FI_FRAG)
- ipfr_nat_newfrag(ip, fin, 0, nat);
- nat->nat_age = fr_defnatage;
- ip->ip_src = nat->nat_outip;
- nat->nat_bytes += ip->ip_len;
- nat->nat_pkts++;
+ np = nat->nat_ptr;
+ if (natadd && fin->fin_fi.fi_fl & FI_FRAG)
+ ipfr_nat_newfrag(ip, fin, 0, nat);
+ ip->ip_src = nat->nat_outip;
+ MUTEX_ENTER(&nat->nat_lock);
+ nat->nat_age = fr_defnatage;
+ nat->nat_bytes += ip->ip_len;
+ nat->nat_pkts++;
+ MUTEX_EXIT(&nat->nat_lock);
- /*
- * Fix up checksums, not by recalculating them, but
- * simply computing adjustments.
- */
+ /*
+ * Fix up checksums, not by recalculating them, but
+ * simply computing adjustments.
+ */
#if SOLARIS || defined(__sgi)
- if (nat->nat_dir == NAT_OUTBOUND)
- fix_outcksum(&ip->ip_sum, nat->nat_ipsumd);
- else
- fix_incksum(&ip->ip_sum, nat->nat_ipsumd);
+ if (nat->nat_dir == NAT_OUTBOUND)
+ fix_outcksum(&ip->ip_sum, nat->nat_ipsumd, 0);
+ else
+ fix_incksum(&ip->ip_sum, nat->nat_ipsumd, 0);
#endif
- if (nflags && !(ip->ip_off & 0x1fff) &&
- !(fin->fin_fi.fi_fl & FI_SHORT)) {
-
- if (nat->nat_outport)
- tcp->th_sport = nat->nat_outport;
-
- if (ip->ip_p == IPPROTO_TCP) {
- csump = &tcp->th_sum;
- fr_tcp_age(&nat->nat_age,
- nat->nat_state, ip, fin,1);
- /*
- * Increase this because we may have
- * "keep state" following this too and
- * packet storms can occur if this is
- * removed too quickly.
- */
- if (nat->nat_age == fr_tcpclosed)
- nat->nat_age = fr_tcplastack;
- } else if (ip->ip_p == IPPROTO_UDP) {
- udphdr_t *udp = (udphdr_t *)tcp;
-
- if (udp->uh_sum)
- csump = &udp->uh_sum;
- } else if (ip->ip_p == IPPROTO_ICMP) {
- icmphdr_t *ic = (icmphdr_t *)tcp;
-
- csump = &ic->icmp_cksum;
- }
- if (csump) {
- if (nat->nat_dir == NAT_OUTBOUND)
- fix_outcksum(csump,
- nat->nat_sumd);
- else
- fix_incksum(csump,
- nat->nat_sumd);
- }
+ if (!(ip->ip_off & IP_OFFMASK) &&
+ !(fin->fin_fi.fi_fl & FI_SHORT)) {
+
+ if ((nat->nat_outport != 0) && (nflags & IPN_TCPUDP)) {
+ tcp->th_sport = nat->nat_outport;
+ fin->fin_data[0] = ntohs(tcp->th_sport);
+ }
+
+ if (ip->ip_p == IPPROTO_TCP) {
+ csump = &tcp->th_sum;
+ MUTEX_ENTER(&nat->nat_lock);
+ fr_tcp_age(&nat->nat_age,
+ nat->nat_tcpstate, fin, 1);
+ if (nat->nat_age < fr_defnaticmpage)
+ nat->nat_age = fr_defnaticmpage;
+#ifdef LARGE_NAT
+ else if (nat->nat_age > fr_defnatage)
+ nat->nat_age = fr_defnatage;
+#endif
+ /*
+ * Increase this because we may have
+ * "keep state" following this too and
+ * packet storms can occur if this is
+ * removed too quickly.
+ */
+ if (nat->nat_age == fr_tcpclosed)
+ nat->nat_age = fr_tcplastack;
+ MUTEX_EXIT(&nat->nat_lock);
+ } else if (ip->ip_p == IPPROTO_UDP) {
+ udphdr_t *udp = (udphdr_t *)tcp;
+
+ if (udp->uh_sum)
+ csump = &udp->uh_sum;
+ } else if (ip->ip_p == IPPROTO_ICMP) {
+ nat->nat_age = fr_defnaticmpage;
+ }
+ if (csump) {
+ if (nat->nat_dir == NAT_OUTBOUND)
+ fix_outcksum(csump, nat->nat_sumd[1],
+ ip->ip_len);
+ else
+ fix_incksum(csump, nat->nat_sumd[1],
+ ip->ip_len);
}
- (void) ap_check(ip, tcp, fin, nat);
- nat_stats.ns_mapped[1]++;
- MUTEX_EXIT(&ipf_nat);
- return -2;
}
- MUTEX_EXIT(&ipf_nat);
+
+ if ((np->in_apr != NULL) && (np->in_dport == 0 ||
+ (tcp != NULL && dport == np->in_dport))) {
+ i = appr_check(ip, fin, nat);
+ if (i == 0)
+ i = 1;
+ } else
+ i = 1;
+ ATOMIC_INCL(nat_stats.ns_mapped[1]);
+ RWLOCK_EXIT(&ipf_nat); /* READ */
+ return i;
+ }
+ RWLOCK_EXIT(&ipf_nat); /* READ/WRITE */
return 0;
}
@@ -1100,127 +1947,191 @@ fr_info_t *fin;
* Packets coming in from the external interface go through this.
* Here, the destination address requires alteration, if anything.
*/
-int ip_natin(ip, hlen, fin)
+int ip_natin(ip, fin)
ip_t *ip;
-int hlen;
fr_info_t *fin;
{
- register ipnat_t *np;
+ register struct in_addr src;
register struct in_addr in;
+ register ipnat_t *np;
+ u_int nflags = 0, natadd = 1, hv, msk;
struct ifnet *ifp = fin->fin_ifp;
tcphdr_t *tcp = NULL;
u_short sport = 0, dport = 0, *csump = NULL;
nat_t *nat;
- int nflags = 0, natadd = 1;
+ u_32_t iph;
+ int i;
+
+ if ((nat_list == NULL) || (ip->ip_v != 4) || (fr_nat_lock))
+ return 0;
- if (!(ip->ip_off & 0x1fff) && !(fin->fin_fi.fi_fl & FI_SHORT)) {
+ if (!(ip->ip_off & IP_OFFMASK) && !(fin->fin_fi.fi_fl & FI_SHORT)) {
if (ip->ip_p == IPPROTO_TCP)
nflags = IPN_TCP;
else if (ip->ip_p == IPPROTO_UDP)
nflags = IPN_UDP;
- if (nflags) {
- tcp = (tcphdr_t *)((char *)ip + hlen);
+ if ((nflags & IPN_TCPUDP)) {
+ tcp = (tcphdr_t *)fin->fin_dp;
dport = tcp->th_dport;
sport = tcp->th_sport;
}
}
in = ip->ip_dst;
+ /* make sure the source address is to be redirected */
+ src = ip->ip_src;
- MUTEX_ENTER(&ipf_nat);
+ READ_ENTER(&ipf_nat);
- if ((ip->ip_p == IPPROTO_ICMP) && (nat = nat_icmpin(ip, fin, &nflags)))
+ if ((ip->ip_p == IPPROTO_ICMP) &&
+ (nat = nat_icmp(ip, fin, &nflags, NAT_INBOUND)))
;
else if ((ip->ip_off & IP_OFFMASK) &&
(nat = ipfr_nat_knownfrag(ip, fin)))
natadd = 0;
- else if ((nat = nat_inlookup(fin->fin_ifp, nflags, ip->ip_src, sport,
- ip->ip_dst, dport)))
- ;
- else
+ else if ((nat = nat_inlookup(fin->fin_ifp, nflags, (u_int)ip->ip_p,
+ ip->ip_src, in, (dport << 16) | sport))) {
+ nflags = nat->nat_flags;
+ if ((nflags & (FI_W_SPORT|FI_W_DPORT)) != 0) {
+ if ((nat->nat_oport != sport) && (nflags & FI_W_DPORT))
+ nat->nat_oport = sport;
+ else if ((nat->nat_outport != dport) &&
+ (nflags & FI_W_SPORT))
+ nat->nat_outport = dport;
+ nat->nat_flags &= ~(FI_W_SPORT|FI_W_DPORT);
+ nflags = nat->nat_flags;
+ }
+ } else {
+ RWLOCK_EXIT(&ipf_nat);
+ WRITE_ENTER(&ipf_nat);
/*
* If there is no current entry in the nat table for this IP#,
* create one for it (if there is a matching rule).
*/
- for (np = nat_list; np; np = np->in_next)
- if ((np->in_ifp == ifp) &&
- (!np->in_flags || (nflags & np->in_flags)) &&
- ((in.s_addr & np->in_outmsk) == np->in_outip) &&
- (np->in_redir & NAT_REDIRECT) &&
- (!np->in_pmin || np->in_pmin == dport)) {
+ msk = 0xffffffff;
+ i = 32;
+maskloop:
+ iph = in.s_addr & htonl(msk);
+ hv = NAT_HASH_FN(iph, 0, ipf_rdrrules_sz);
+ for (np = rdr_rules[hv]; np; np = np->in_rnext) {
+ if ((np->in_ifp && (np->in_ifp != ifp)) ||
+ (np->in_p && (np->in_p != ip->ip_p)) ||
+ (np->in_flags && !(nflags & np->in_flags)))
+ continue;
+ if (np->in_flags & IPN_FILTER) {
+ if (!nat_match(fin, np, ip))
+ continue;
+ } else if ((in.s_addr & np->in_outmsk) != np->in_outip)
+ continue;
+ if ((np->in_redir & NAT_REDIRECT) &&
+ (!np->in_pmin ||
+ ((ntohs(np->in_pmax) >= ntohs(dport)) &&
+ (ntohs(dport) >= ntohs(np->in_pmin)))))
if ((nat = nat_new(np, ip, fin, nflags,
- NAT_INBOUND)))
+ NAT_INBOUND))) {
+ np->in_hits++;
#ifdef IPFILTER_LOG
- nat_log(nat, (u_short)np->in_redir);
-#else
- ;
+ nat_log(nat, (u_int)np->in_redir);
#endif
- break;
- }
+ break;
+ }
+ }
+
+ if ((np == NULL) && (i > 0)) {
+ do {
+ i--;
+ msk <<= 1;
+ } while ((i >= 0) && ((rdr_masks & (1 << i)) == 0));
+ if (i >= 0)
+ goto maskloop;
+ }
+ MUTEX_DOWNGRADE(&ipf_nat);
+ }
if (nat) {
- if (natadd && fin->fin_fi.fi_fl & FI_FRAG)
- ipfr_nat_newfrag(ip, fin, 0, nat);
- (void) ap_check(ip, tcp, fin, nat);
+ np = nat->nat_ptr;
+ fin->fin_fr = nat->nat_fr;
+ if (natadd && fin->fin_fi.fi_fl & FI_FRAG)
+ ipfr_nat_newfrag(ip, fin, 0, nat);
+ if ((np->in_apr != NULL) && (np->in_dport == 0 ||
+ (tcp != NULL && sport == np->in_dport))) {
+ i = appr_check(ip, fin, nat);
+ if (i == -1) {
+ RWLOCK_EXIT(&ipf_nat);
+ return i;
+ }
+ }
- if (nflags != IPN_ICMPERR)
- nat->nat_age = fr_defnatage;
+ MUTEX_ENTER(&nat->nat_lock);
+ if (nflags != IPN_ICMPERR)
+ nat->nat_age = fr_defnatage;
- ip->ip_dst = nat->nat_inip;
- nat->nat_bytes += ip->ip_len;
- nat->nat_pkts++;
+ nat->nat_bytes += ip->ip_len;
+ nat->nat_pkts++;
+ MUTEX_EXIT(&nat->nat_lock);
+ ip->ip_dst = nat->nat_inip;
+ fin->fin_fi.fi_daddr = nat->nat_inip.s_addr;
- /*
- * Fix up checksums, not by recalculating them, but
- * simply computing adjustments.
- */
+ /*
+ * Fix up checksums, not by recalculating them, but
+ * simply computing adjustments.
+ */
#if SOLARIS || defined(__sgi)
- if (nat->nat_dir == NAT_OUTBOUND)
- fix_incksum(&ip->ip_sum, nat->nat_ipsumd);
- else
- fix_outcksum(&ip->ip_sum, nat->nat_ipsumd);
+ if (nat->nat_dir == NAT_OUTBOUND)
+ fix_incksum(&ip->ip_sum, nat->nat_ipsumd, 0);
+ else
+ fix_outcksum(&ip->ip_sum, nat->nat_ipsumd, 0);
#endif
- if ((nflags & IPN_TCPUDP) && !(ip->ip_off & 0x1fff) &&
- !(fin->fin_fi.fi_fl & FI_SHORT)) {
-
- if (nat->nat_inport)
- tcp->th_dport = nat->nat_inport;
-
- if (ip->ip_p == IPPROTO_TCP) {
- csump = &tcp->th_sum;
- fr_tcp_age(&nat->nat_age,
- nat->nat_state, ip, fin,0);
- /*
- * Increase this because we may have
- * "keep state" following this too and
- * packet storms can occur if this is
- * removed too quickly.
- */
- if (nat->nat_age == fr_tcpclosed)
- nat->nat_age = fr_tcplastack;
- } else if (ip->ip_p == IPPROTO_UDP) {
- udphdr_t *udp = (udphdr_t *)tcp;
-
- if (udp->uh_sum)
- csump = &udp->uh_sum;
- } else if (ip->ip_p == IPPROTO_ICMP) {
- icmphdr_t *ic = (icmphdr_t *)tcp;
-
- csump = &ic->icmp_cksum;
- }
- if (csump) {
- if (nat->nat_dir == NAT_OUTBOUND)
- fix_incksum(csump,
- nat->nat_sumd);
- else
- fix_outcksum(csump,
- nat->nat_sumd);
- }
+ if (!(ip->ip_off & IP_OFFMASK) &&
+ !(fin->fin_fi.fi_fl & FI_SHORT)) {
+
+ if ((nat->nat_inport != 0) && (nflags & IPN_TCPUDP)) {
+ tcp->th_dport = nat->nat_inport;
+ fin->fin_data[1] = ntohs(tcp->th_dport);
+ }
+
+ if (ip->ip_p == IPPROTO_TCP) {
+ csump = &tcp->th_sum;
+ MUTEX_ENTER(&nat->nat_lock);
+ fr_tcp_age(&nat->nat_age,
+ nat->nat_tcpstate, fin, 0);
+ if (nat->nat_age < fr_defnaticmpage)
+ nat->nat_age = fr_defnaticmpage;
+#ifdef LARGE_NAT
+ else if (nat->nat_age > fr_defnatage)
+ nat->nat_age = fr_defnatage;
+#endif
+ /*
+ * Increase this because we may have
+ * "keep state" following this too and
+ * packet storms can occur if this is
+ * removed too quickly.
+ */
+ if (nat->nat_age == fr_tcpclosed)
+ nat->nat_age = fr_tcplastack;
+ MUTEX_EXIT(&nat->nat_lock);
+ } else if (ip->ip_p == IPPROTO_UDP) {
+ udphdr_t *udp = (udphdr_t *)tcp;
+
+ if (udp->uh_sum)
+ csump = &udp->uh_sum;
+ } else if (ip->ip_p == IPPROTO_ICMP) {
+ nat->nat_age = fr_defnaticmpage;
+ }
+
+ if (csump) {
+ if (nat->nat_dir == NAT_OUTBOUND)
+ fix_incksum(csump, nat->nat_sumd[0],
+ 0);
+ else
+ fix_outcksum(csump, nat->nat_sumd[0],
+ 0);
}
- nat_stats.ns_mapped[0]++;
- MUTEX_EXIT(&ipf_nat);
- return -2;
}
- MUTEX_EXIT(&ipf_nat);
+ ATOMIC_INCL(nat_stats.ns_mapped[0]);
+ RWLOCK_EXIT(&ipf_nat); /* READ */
+ return 1;
+ }
+ RWLOCK_EXIT(&ipf_nat); /* READ/WRITE */
return 0;
}
@@ -1230,11 +2141,31 @@ fr_info_t *fin;
*/
void ip_natunload()
{
- MUTEX_ENTER(&ipf_nat);
+ WRITE_ENTER(&ipf_nat);
(void) nat_clearlist();
(void) nat_flushtable();
- (void) ap_unload();
- MUTEX_EXIT(&ipf_nat);
+ RWLOCK_EXIT(&ipf_nat);
+
+ if (nat_table[0] != NULL) {
+ KFREES(nat_table[0], sizeof(nat_t *) * ipf_nattable_sz);
+ nat_table[0] = NULL;
+ }
+ if (nat_table[1] != NULL) {
+ KFREES(nat_table[1], sizeof(nat_t *) * ipf_nattable_sz);
+ nat_table[1] = NULL;
+ }
+ if (nat_rules != NULL) {
+ KFREES(nat_rules, sizeof(ipnat_t *) * ipf_natrules_sz);
+ nat_rules = NULL;
+ }
+ if (rdr_rules != NULL) {
+ KFREES(rdr_rules, sizeof(ipnat_t *) * ipf_rdrrules_sz);
+ rdr_rules = NULL;
+ }
+ if (maptable != NULL) {
+ KFREES(maptable, sizeof(hostmap_t *) * ipf_hostmap_sz);
+ maptable = NULL;
+ }
}
@@ -1250,9 +2181,10 @@ void ip_natexpire()
#endif
SPL_NET(s);
- MUTEX_ENTER(&ipf_nat);
+ WRITE_ENTER(&ipf_nat);
for (natp = &nat_instances; (nat = *natp); ) {
- if (--nat->nat_age) {
+ nat->nat_age--;
+ if (nat->nat_age) {
natp = &nat->nat_next;
continue;
}
@@ -1263,79 +2195,76 @@ void ip_natexpire()
nat_delete(nat);
nat_stats.ns_expire++;
}
-
- ap_expire();
-
- MUTEX_EXIT(&ipf_nat);
+ RWLOCK_EXIT(&ipf_nat);
SPL_X(s);
}
/*
*/
-#ifdef __STDC__
-void ip_natsync(void *ifp)
-#else
void ip_natsync(ifp)
void *ifp;
-#endif
{
+ register ipnat_t *n;
register nat_t *nat;
register u_32_t sum1, sum2, sumd;
struct in_addr in;
ipnat_t *np;
+ void *ifp2;
#if defined(_KERNEL) && !SOLARIS
int s;
#endif
+ /*
+ * Change IP addresses for NAT sessions for any protocol except TCP
+ * since it will break the TCP connection anyway.
+ */
SPL_NET(s);
- MUTEX_ENTER(&ipf_nat);
+ WRITE_ENTER(&ipf_nat);
for (nat = nat_instances; nat; nat = nat->nat_next)
- if ((ifp == nat->nat_ifp) && (np = nat->nat_ptr))
- if ((np->in_outmsk == 0xffffffff) && !np->in_nip) {
- /*
- * Change the map-to address to be the same
- * as the new one.
- */
- sum1 = nat->nat_outip.s_addr;
- if (nat_ifpaddr(nat, ifp, &in) == -1)
- nat->nat_outip.s_addr = htonl(in.s_addr);
- sum2 = nat->nat_outip.s_addr;
+ if (((ifp == NULL) || (ifp == nat->nat_ifp)) &&
+ !(nat->nat_flags & IPN_TCP) && (np = nat->nat_ptr) &&
+ (np->in_outmsk == 0xffffffff) && !np->in_nip) {
+ ifp2 = nat->nat_ifp;
+ /*
+ * Change the map-to address to be the same as the
+ * new one.
+ */
+ sum1 = nat->nat_outip.s_addr;
+ if (fr_ifpaddr(4, ifp2, &in) != -1)
+ nat->nat_outip = in;
+ sum2 = nat->nat_outip.s_addr;
- /*
- * Readjust the checksum adjustment to take
- * into account the new IP#.
- *
- * Do it twice
- */
- sum1 = (sum1 & 0xffff) + (sum1 >> 16);
- sum1 = (sum1 & 0xffff) + (sum1 >> 16);
-
- /* Do it twice */
- sum2 = (sum2 & 0xffff) + (sum2 >> 16);
- sum2 = (sum2 & 0xffff) + (sum2 >> 16);
-
- /* Because ~1 == -2, We really need ~1 == -1 */
- if (sum1 > sum2)
- sum2--;
- sumd = sum2 - sum1;
- sumd = (sumd & 0xffff) + (sumd >> 16);
- sumd += nat->nat_sumd;
- nat->nat_sumd = (sumd & 0xffff) + (sumd >> 16);
- }
- MUTEX_EXIT(&ipf_nat);
+ if (sum1 == sum2)
+ continue;
+ /*
+ * Readjust the checksum adjustment to take into
+ * account the new IP#.
+ */
+ CALC_SUMD(sum1, sum2, sumd);
+ /* XXX - dont change for TCP when solaris does
+ * hardware checksumming.
+ */
+ sumd += nat->nat_sumd[0];
+ nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
+ nat->nat_sumd[1] = nat->nat_sumd[0];
+ }
+
+ for (n = nat_list; (n != NULL); n = n->in_next)
+ if (n->in_ifp == ifp) {
+ n->in_ifp = (void *)GETUNIT(n->in_ifname, 4);
+ if (!n->in_ifp)
+ n->in_ifp = (void *)-1;
+ }
+ RWLOCK_EXIT(&ipf_nat);
SPL_X(s);
}
#ifdef IPFILTER_LOG
-# ifdef __STDC__
-void nat_log(struct nat *nat, u_short type)
-# else
void nat_log(nat, type)
struct nat *nat;
-u_short type;
-# endif
+u_int type;
{
struct ipnat *np;
struct natlog natl;
@@ -1351,19 +2280,22 @@ u_short type;
natl.nl_origport = nat->nat_oport;
natl.nl_inport = nat->nat_inport;
natl.nl_outport = nat->nat_outport;
+ natl.nl_p = nat->nat_p;
natl.nl_type = type;
natl.nl_rule = -1;
- if (nat->nat_ptr) {
+#ifndef LARGE_NAT
+ if (nat->nat_ptr != NULL) {
for (rulen = 0, np = nat_list; np; np = np->in_next, rulen++)
if (np == nat->nat_ptr) {
natl.nl_rule = rulen;
break;
}
}
+#endif
items[0] = &natl;
sizes[0] = sizeof(natl);
types[0] = 0;
- (void) ipllog(IPL_LOGNAT, 0, items, sizes, types, 1);
+ (void) ipllog(IPL_LOGNAT, NULL, items, sizes, types, 1);
}
#endif
diff --git a/sys/netinet/ip_nat.h b/sys/netinet/ip_nat.h
index 49f5d509d777..f1a339f2d62a 100644
--- a/sys/netinet/ip_nat.h
+++ b/sys/netinet/ip_nat.h
@@ -1,12 +1,12 @@
/*
- * Copyright (C) 1995-1997 by Darren Reed.
+ * Copyright (C) 1995-2000 by Darren Reed.
*
* Redistribution and use in source and binary forms are permitted
* provided that this notice is preserved and due credit is given
* to the original author and the contributors.
*
* @(#)ip_nat.h 1.5 2/4/96
- * $Id: ip_nat.h,v 2.0.2.23.2.3 1998/05/23 18:52:44 darrenr Exp $
+ * $Id: ip_nat.h,v 2.17.2.1 2000/05/15 06:50:14 darrenr Exp $
*/
#ifndef __IP_NAT_H__
@@ -17,71 +17,104 @@
#endif
#if defined(__STDC__) || defined(__GNUC__)
-#define SIOCADNAT _IOW('r', 80, struct ipnat)
-#define SIOCRMNAT _IOW('r', 81, struct ipnat)
-#define SIOCGNATS _IOR('r', 82, struct natstat)
-#define SIOCGNATL _IOWR('r', 83, struct natlookup)
-#define SIOCGFRST _IOR('r', 84, struct ipfrstat)
-#define SIOCGIPST _IOR('r', 85, struct ips_stat)
-#define SIOCFLNAT _IOWR('r', 86, int)
-#define SIOCCNATL _IOWR('r', 87, int)
+#define SIOCADNAT _IOW('r', 60, struct ipnat *)
+#define SIOCRMNAT _IOW('r', 61, struct ipnat *)
+#define SIOCGNATS _IOWR('r', 62, struct natstat *)
+#define SIOCGNATL _IOWR('r', 63, struct natlookup *)
#else
-#define SIOCADNAT _IOW(r, 80, struct ipnat)
-#define SIOCRMNAT _IOW(r, 81, struct ipnat)
-#define SIOCGNATS _IOR(r, 82, struct natstat)
-#define SIOCGNATL _IOWR(r, 83, struct natlookup)
-#define SIOCGFRST _IOR(r, 84, struct ipfrstat)
-#define SIOCGIPST _IOR(r, 85, struct ips_stat)
-#define SIOCFLNAT _IOWR(r, 86, int)
-#define SIOCCNATL _IOWR(r, 87, int)
+#define SIOCADNAT _IOW(r, 60, struct ipnat *)
+#define SIOCRMNAT _IOW(r, 61, struct ipnat *)
+#define SIOCGNATS _IOWR(r, 62, struct natstat *)
+#define SIOCGNATL _IOWR(r, 63, struct natlookup *)
#endif
-#define NAT_SIZE 367
+#undef LARGE_NAT /* define this if you're setting up a system to NAT
+ * LARGE numbers of networks/hosts - i.e. in the
+ * hundreds or thousands. In such a case, you should
+ * also change the RDR_SIZE and NAT_SIZE below to more
+ * appropriate sizes. The figures below were used for
+ * a setup with 1000-2000 networks to NAT.
+ */
+#define NAT_SIZE 127
+#define RDR_SIZE 127
+#define HOSTMAP_SIZE 127
+#define NAT_TABLE_SZ 127
+#ifdef LARGE_NAT
+#undef NAT_SIZE
+#undef RDR_SIZE
+#undef NAT_TABLE_SZ
+#undef HOSTMAP_SIZE 127
+#define NAT_SIZE 2047
+#define RDR_SIZE 2047
+#define NAT_TABLE_SZ 16383
+#define HOSTMAP_SIZE 8191
+#endif
#ifndef APR_LABELLEN
#define APR_LABELLEN 16
#endif
+#define NAT_HW_CKSUM 0x80000000
+
+#define DEF_NAT_AGE 1200 /* 10 minutes (600 seconds) */
+
+struct ap_session;
typedef struct nat {
u_long nat_age;
int nat_flags;
- u_32_t nat_sumd;
+ u_32_t nat_sumd[2];
u_32_t nat_ipsumd;
void *nat_data;
+ struct ap_session *nat_aps; /* proxy session */
+ struct frentry *nat_fr; /* filter rule ptr if appropriate */
struct in_addr nat_inip;
struct in_addr nat_outip;
struct in_addr nat_oip; /* other ip */
U_QUAD_T nat_pkts;
U_QUAD_T nat_bytes;
- u_short nat_oport; /* other port */
+ u_short nat_oport; /* other port */
u_short nat_inport;
u_short nat_outport;
u_short nat_use;
- u_char nat_state[2];
- struct ipnat *nat_ptr;
+ u_char nat_tcpstate[2];
+ u_char nat_p; /* protocol for NAT */
+ struct ipnat *nat_ptr; /* pointer back to the rule */
+ struct hostmap *nat_hm;
struct nat *nat_next;
struct nat *nat_hnext[2];
struct nat **nat_hstart[2];
void *nat_ifp;
int nat_dir;
+ char nat_ifname[IFNAMSIZ];
+#if SOLARIS || defined(_sgi)
+ kmutex_t nat_lock;
+#endif
} nat_t;
typedef struct ipnat {
struct ipnat *in_next;
+ struct ipnat *in_rnext;
+ struct ipnat **in_prnext;
+ struct ipnat *in_mnext;
+ struct ipnat **in_pmnext;
void *in_ifp;
void *in_apr;
- u_int in_space;
+ u_long in_space;
u_int in_use;
+ u_int in_hits;
struct in_addr in_nextip;
u_short in_pnext;
- u_short in_flags;
- u_short in_port[2];
+ u_short in_ppip; /* ports per IP */
+ u_short in_ippip; /* IP #'s per IP# */
+ u_short in_flags; /* From here to in_dport must be reflected */
+ u_short in_port[2]; /* correctly in IPN_CMPSIZ */
struct in_addr in_in[2];
struct in_addr in_out[2];
+ struct in_addr in_src[2];
+ struct frtuc in_tuc;
int in_redir; /* 0 if it's a mapping, 1 if it's a hard redir */
char in_ifname[IFNAMSIZ];
char in_plabel[APR_LABELLEN]; /* proxy label */
char in_p; /* protocol */
- u_short in_dport;
} ipnat_t;
#define in_pmin in_port[0] /* Also holds static redir port */
@@ -91,6 +124,14 @@ typedef struct ipnat {
#define in_inmsk in_in[1].s_addr
#define in_outip in_out[0].s_addr
#define in_outmsk in_out[1].s_addr
+#define in_srcip in_src[0].s_addr
+#define in_srcmsk in_src[1].s_addr
+#define in_scmp in_tuc.ftu_scmp
+#define in_dcmp in_tuc.ftu_dcmp
+#define in_stop in_tuc.ftu_stop
+#define in_dtop in_tuc.ftu_dtop
+#define in_sport in_tuc.ftu_sport
+#define in_dport in_tuc.ftu_dport
#define NAT_OUTBOUND 0
#define NAT_INBOUND 1
@@ -98,9 +139,12 @@ typedef struct ipnat {
#define NAT_MAP 0x01
#define NAT_REDIRECT 0x02
#define NAT_BIMAP (NAT_MAP|NAT_REDIRECT)
+#define NAT_MAPBLK 0x04
-#define IPN_CMPSIZ (sizeof(struct in_addr) * 4 + sizeof(u_short) * 3 + \
- sizeof(int) + IFNAMSIZ + APR_LABELLEN + sizeof(char))
+#define MAPBLK_MINPORT 1024 /* don't use reserved ports for src port */
+#define USABLE_PORTS (65536 - MAPBLK_MINPORT)
+
+#define IPN_CMPSIZ (sizeof(ipnat_t) - offsetof(ipnat_t, in_flags))
typedef struct natlookup {
struct in_addr nl_inip;
@@ -112,6 +156,34 @@ typedef struct natlookup {
u_short nl_realport;
} natlookup_t;
+
+typedef struct nat_save {
+ void *ipn_next;
+ struct nat ipn_nat;
+ struct ipnat ipn_ipnat;
+ struct frentry ipn_fr;
+ int ipn_dsize;
+ char ipn_data[4];
+} nat_save_t;
+
+#define ipn_rule ipn_nat.nat_fr
+
+typedef struct natget {
+ void *ng_ptr;
+ int ng_sz;
+} natget_t;
+
+
+typedef struct hostmap {
+ struct hostmap *hm_next;
+ struct hostmap **hm_pnext;
+ struct ipnat *hm_ipnat;
+ struct in_addr hm_realip;
+ struct in_addr hm_mapip;
+ int hm_ref;
+} hostmap_t;
+
+
typedef struct natstat {
u_long ns_mapped[2];
u_long ns_rules;
@@ -120,16 +192,31 @@ typedef struct natstat {
u_long ns_inuse;
u_long ns_logged;
u_long ns_logfail;
+ u_long ns_memfail;
+ u_long ns_badnat;
nat_t **ns_table[2];
ipnat_t *ns_list;
+ void *ns_apslist;
+ u_int ns_nattab_sz;
+ u_int ns_rultab_sz;
+ u_int ns_rdrtab_sz;
+ nat_t *ns_instances;
} natstat_t;
-#define IPN_ANY 0x00
-#define IPN_TCP 0x01
-#define IPN_UDP 0x02
-#define IPN_TCPUDP 0x03
-#define IPN_DELETE 0x04
-#define IPN_ICMPERR 0x08
+#define IPN_ANY 0x000
+#define IPN_TCP 0x001
+#define IPN_UDP 0x002
+#define IPN_TCPUDP (IPN_TCP|IPN_UDP)
+#define IPN_DELETE 0x004
+#define IPN_ICMPERR 0x008
+#define IPN_RF (IPN_TCPUDP|IPN_DELETE|IPN_ICMPERR)
+#define IPN_AUTOPORTMAP 0x010
+#define IPN_IPRANGE 0x020
+#define IPN_USERFLAGS (IPN_TCPUDP|IPN_AUTOPORTMAP|IPN_IPRANGE|\
+ IPN_SPLIT|IPN_ROUNDR|IPN_FILTER)
+#define IPN_FILTER 0x040
+#define IPN_SPLIT 0x080
+#define IPN_ROUNDR 0x100
typedef struct natlog {
@@ -143,6 +230,7 @@ typedef struct natlog {
int nl_rule;
U_QUAD_T nl_pkts;
U_QUAD_T nl_bytes;
+ u_char nl_p;
} natlog_t;
@@ -150,32 +238,57 @@ typedef struct natlog {
#define NL_NEWRDR NAT_REDIRECT
#define NL_EXPIRE 0xffff
+#define NAT_HASH_FN(k,l,m) (((k) + ((k) >> 12) + l) % (m))
+
+#define LONG_SUM(in) (((in) & 0xffff) + ((in) >> 16))
+
+#define CALC_SUMD(s1, s2, sd) { \
+ (s1) = ((s1) & 0xffff) + ((s1) >> 16); \
+ (s2) = ((s2) & 0xffff) + ((s2) >> 16); \
+ /* Do it twice */ \
+ (s1) = ((s1) & 0xffff) + ((s1) >> 16); \
+ (s2) = ((s2) & 0xffff) + ((s2) >> 16); \
+ /* Because ~1 == -2, We really need ~1 == -1 */ \
+ if ((s1) > (s2)) (s2)--; \
+ (sd) = (s2) - (s1); \
+ (sd) = ((sd) & 0xffff) + ((sd) >> 16); }
+
+extern u_int ipf_nattable_sz;
+extern u_int ipf_natrules_sz;
+extern u_int ipf_rdrrules_sz;
+extern int fr_nat_lock;
extern void ip_natsync __P((void *));
extern u_long fr_defnatage;
extern u_long fr_defnaticmpage;
-extern nat_t *nat_table[2][NAT_SIZE];
-#if defined(__NetBSD__) || defined(__OpenBSD__)
+extern nat_t **nat_table[2];
+extern nat_t *nat_instances;
+extern ipnat_t **nat_rules;
+extern ipnat_t **rdr_rules;
+extern natstat_t nat_stats;
+#if defined(__NetBSD__) || defined(__OpenBSD__) || (__FreeBSD_version >= 300003)
extern int nat_ioctl __P((caddr_t, u_long, int));
#else
extern int nat_ioctl __P((caddr_t, int, int));
#endif
-extern nat_t *nat_new __P((ipnat_t *, ip_t *, fr_info_t *, u_short, int));
-extern nat_t *nat_outlookup __P((void *, int, struct in_addr, u_short,
- struct in_addr, u_short));
-extern nat_t *nat_inlookup __P((void *, int, struct in_addr, u_short,
- struct in_addr, u_short));
+extern int nat_init __P((void));
+extern nat_t *nat_new __P((ipnat_t *, ip_t *, fr_info_t *, u_int, int));
+extern nat_t *nat_outlookup __P((void *, u_int, u_int, struct in_addr,
+ struct in_addr, u_32_t));
+extern nat_t *nat_inlookup __P((void *, u_int, u_int, struct in_addr,
+ struct in_addr, u_32_t));
+extern nat_t *nat_maplookup __P((void *, u_int, struct in_addr,
+ struct in_addr));
extern nat_t *nat_lookupredir __P((natlookup_t *));
-extern nat_t *nat_lookupmapip __P((void *, int, struct in_addr, u_short,
- struct in_addr, u_short));
-extern nat_t *nat_icmpinlookup __P((ip_t *, fr_info_t *));
-extern nat_t *nat_icmpin __P((ip_t *, fr_info_t *, int *));
+extern nat_t *nat_icmplookup __P((ip_t *, fr_info_t *, int));
+extern nat_t *nat_icmp __P((ip_t *, fr_info_t *, u_int *, int));
+extern void nat_insert __P((nat_t *));
-extern int ip_natout __P((ip_t *, int, fr_info_t *));
-extern int ip_natin __P((ip_t *, int, fr_info_t *));
+extern int ip_natout __P((ip_t *, fr_info_t *));
+extern int ip_natin __P((ip_t *, fr_info_t *));
extern void ip_natunload __P((void)), ip_natexpire __P((void));
-extern void nat_log __P((struct nat *, u_short));
-extern void fix_incksum __P((u_short *, u_32_t));
-extern void fix_outcksum __P((u_short *, u_32_t));
+extern void nat_log __P((struct nat *, u_int));
+extern void fix_incksum __P((u_short *, u_32_t, int));
+extern void fix_outcksum __P((u_short *, u_32_t, int));
#endif /* __IP_NAT_H__ */
diff --git a/sys/netinet/ip_proxy.c b/sys/netinet/ip_proxy.c
index 0fb7e95e1bb2..e1e55f11acde 100644
--- a/sys/netinet/ip_proxy.c
+++ b/sys/netinet/ip_proxy.c
@@ -1,31 +1,33 @@
/*
- * Copyright (C) 1997 by Darren Reed.
+ * Copyright (C) 1997-2000 by Darren Reed.
*
* Redistribution and use in source and binary forms are permitted
* provided that this notice is preserved and due credit is given
* to the original author and the contributors.
*/
#if !defined(lint)
-static const char rcsid[] = "@(#)$Id: ip_proxy.c,v 2.0.2.11.2.7 1998/05/18 11:15:22 darrenr Exp $";
+static const char rcsid[] = "@(#)$Id: ip_proxy.c,v 2.9.2.1 2000/05/06 12:30:50 darrenr Exp $";
#endif
#if defined(__FreeBSD__) && defined(KERNEL) && !defined(_KERNEL)
# define _KERNEL
#endif
-#if !defined(_KERNEL) && !defined(KERNEL)
-# include <stdio.h>
-# include <string.h>
-# include <stdlib.h>
-#endif
#include <sys/errno.h>
#include <sys/types.h>
#include <sys/param.h>
#include <sys/time.h>
#include <sys/file.h>
-#include <sys/ioctl.h>
+#if !defined(__FreeBSD_version)
+# include <sys/ioctl.h>
+#endif
#include <sys/fcntl.h>
#include <sys/uio.h>
+#if !defined(_KERNEL) && !defined(KERNEL)
+# include <stdio.h>
+# include <string.h>
+# include <stdlib.h>
+#endif
#ifndef linux
# include <sys/protosw.h>
#endif
@@ -43,7 +45,9 @@ static const char rcsid[] = "@(#)$Id: ip_proxy.c,v 2.0.2.11.2.7 1998/05/18 11:15
# endif
#else
# include <sys/byteorder.h>
-# include <sys/dditypes.h>
+# ifdef _KERNEL
+# include <sys/dditypes.h>
+# endif
# include <sys/stream.h>
# include <sys/kmem.h>
#endif
@@ -70,97 +74,100 @@ static const char rcsid[] = "@(#)$Id: ip_proxy.c,v 2.0.2.11.2.7 1998/05/18 11:15
#include "netinet/ip_proxy.h"
#include "netinet/ip_nat.h"
#include "netinet/ip_state.h"
+#if (__FreeBSD_version >= 300000)
+# include <sys/malloc.h>
+#endif
+
#ifndef MIN
#define MIN(a,b) (((a)<(b))?(a):(b))
#endif
-static ap_session_t *ap_find __P((ip_t *, tcphdr_t *));
-static ap_session_t *ap_new_session __P((aproxy_t *, ip_t *, tcphdr_t *,
- fr_info_t *, nat_t *));
+static ap_session_t *appr_new_session __P((aproxy_t *, ip_t *,
+ fr_info_t *, nat_t *));
+static int appr_fixseqack __P((fr_info_t *, ip_t *, ap_session_t *, int ));
+
#define AP_SESS_SIZE 53
#if defined(_KERNEL) && !defined(linux)
#include "netinet/ip_ftp_pxy.c"
+#include "netinet/ip_rcmd_pxy.c"
+#include "netinet/ip_raudio_pxy.c"
#endif
ap_session_t *ap_sess_tab[AP_SESS_SIZE];
+ap_session_t *ap_sess_list = NULL;
+aproxy_t *ap_proxylist = NULL;
aproxy_t ap_proxies[] = {
#ifdef IPF_FTP_PROXY
- { "ftp", (char)IPPROTO_TCP, 0, 0, ippr_ftp_init, ippr_ftp_in, ippr_ftp_out },
+ { NULL, "ftp", (char)IPPROTO_TCP, 0, 0, ippr_ftp_init, NULL,
+ ippr_ftp_new, ippr_ftp_in, ippr_ftp_out },
+#endif
+#ifdef IPF_RCMD_PROXY
+ { NULL, "rcmd", (char)IPPROTO_TCP, 0, 0, ippr_rcmd_init, NULL,
+ ippr_rcmd_new, NULL, ippr_rcmd_out },
#endif
- { "", '\0', 0, 0, NULL, NULL }
+#ifdef IPF_RAUDIO_PROXY
+ { NULL, "raudio", (char)IPPROTO_TCP, 0, 0, ippr_raudio_init, NULL,
+ ippr_raudio_new, ippr_raudio_in, ippr_raudio_out },
+#endif
+ { NULL, "", '\0', 0, 0, NULL, NULL }
};
-int ap_ok(ip, tcp, nat)
-ip_t *ip;
-tcphdr_t *tcp;
-ipnat_t *nat;
+int appr_add(ap)
+aproxy_t *ap;
{
- aproxy_t *apr = nat->in_apr;
- u_short dport = nat->in_dport;
-
- if (!apr || (apr && (apr->apr_flags & APR_DELETE)) ||
- (ip->ip_p != apr->apr_p))
- return 0;
- if ((tcp && (tcp->th_dport != dport)) || (!tcp && dport))
- return 0;
- return 1;
+ aproxy_t *a;
+
+ for (a = ap_proxies; a->apr_p; a++)
+ if ((a->apr_p == ap->apr_p) &&
+ !strncmp(a->apr_label, ap->apr_label,
+ sizeof(ap->apr_label)))
+ return -1;
+
+ for (a = ap_proxylist; a->apr_p; a = a->apr_next)
+ if ((a->apr_p == ap->apr_p) &&
+ !strncmp(a->apr_label, ap->apr_label,
+ sizeof(ap->apr_label)))
+ return -1;
+ ap->apr_next = ap_proxylist;
+ ap_proxylist = ap;
+ return (*ap->apr_init)();
}
-static int
-ap_matchsrcdst(aps, src, dst, tcp, sport, dport)
-ap_session_t *aps;
-struct in_addr src, dst;
-void *tcp;
-u_short sport, dport;
+int appr_del(ap)
+aproxy_t *ap;
{
- if (aps->aps_dst.s_addr == dst.s_addr) {
- if ((aps->aps_src.s_addr == src.s_addr) &&
- (!tcp || (sport == aps->aps_sport) &&
- (dport == aps->aps_dport)))
- return 1;
- } else if (aps->aps_dst.s_addr == src.s_addr) {
- if ((aps->aps_src.s_addr == dst.s_addr) &&
- (!tcp || (sport == aps->aps_dport) &&
- (dport == aps->aps_sport)))
- return 1;
- }
- return 0;
+ aproxy_t *a, **app;
+
+ for (app = &ap_proxylist; (a = *app); app = &a->apr_next)
+ if (a == ap) {
+ if (ap->apr_ref != 0)
+ return 1;
+ *app = a->apr_next;
+ return 0;
+ }
+ return -1;
}
-static ap_session_t *ap_find(ip, tcp)
+int appr_ok(ip, tcp, nat)
ip_t *ip;
tcphdr_t *tcp;
+ipnat_t *nat;
{
- register u_char p = ip->ip_p;
- register ap_session_t *aps;
- register u_short sp, dp;
- register u_long hv;
- struct in_addr src, dst;
-
- src = ip->ip_src, dst = ip->ip_dst;
- sp = dp = 0; /* XXX gcc -Wunitialized */
-
- hv = ip->ip_src.s_addr ^ ip->ip_dst.s_addr;
- hv *= 651733;
- if (tcp) {
- sp = tcp->th_sport;
- dp = tcp->th_dport;
- hv ^= (sp + dp);
- hv *= 5;
- }
- hv %= AP_SESS_SIZE;
+ aproxy_t *apr = nat->in_apr;
+ u_short dport = nat->in_dport;
- for (aps = ap_sess_tab[hv]; aps; aps = aps->aps_next)
- if ((aps->aps_p == p) &&
- ap_matchsrcdst(aps, src, dst, tcp, sp, dp))
- break;
- return aps;
+ if (!apr || (apr->apr_flags & APR_DELETE) ||
+ (ip->ip_p != apr->apr_p))
+ return 0;
+ if ((tcp && (tcp->th_dport != dport)) || (!tcp && dport))
+ return 0;
+ return 1;
}
@@ -169,50 +176,33 @@ tcphdr_t *tcp;
* relevant details. call the init function once complete, prior to
* returning.
*/
-static ap_session_t *ap_new_session(apr, ip, tcp, fin, nat)
+static ap_session_t *appr_new_session(apr, ip, fin, nat)
aproxy_t *apr;
ip_t *ip;
-tcphdr_t *tcp;
fr_info_t *fin;
nat_t *nat;
{
register ap_session_t *aps;
- u_short dport;
- u_long hv;
- if (!apr || (apr && (apr->apr_flags & APR_DELETE)) ||
- (ip->ip_p != apr->apr_p))
+ if (!apr || (apr->apr_flags & APR_DELETE) || (ip->ip_p != apr->apr_p))
return NULL;
- dport = nat->nat_ptr->in_dport;
- if ((tcp && (tcp->th_dport != dport)) || (!tcp && dport))
- return NULL;
-
- hv = ip->ip_src.s_addr ^ ip->ip_dst.s_addr;
- hv *= 651733;
- if (tcp) {
- hv ^= (tcp->th_sport + tcp->th_dport);
- hv *= 5;
- }
- hv %= AP_SESS_SIZE;
- KMALLOC(aps, ap_session_t *, sizeof(*aps));
+ KMALLOC(aps, ap_session_t *);
if (!aps)
return NULL;
bzero((char *)aps, sizeof(*aps));
- aps->aps_apr = apr;
- aps->aps_src = ip->ip_src;
- aps->aps_dst = ip->ip_dst;
aps->aps_p = ip->ip_p;
- aps->aps_tout = 1200; /* XXX */
- if (tcp) {
- aps->aps_sport = tcp->th_sport;
- aps->aps_dport = tcp->th_dport;
- }
aps->aps_data = NULL;
+ aps->aps_apr = apr;
aps->aps_psiz = 0;
- aps->aps_next = ap_sess_tab[hv];
- ap_sess_tab[hv] = aps;
- (void) (*apr->apr_init)(fin, ip, tcp, aps, nat);
+ if (apr->apr_new != NULL)
+ if ((*apr->apr_new)(fin, ip, aps, nat) == -1) {
+ KFREE(aps);
+ return NULL;
+ }
+ aps->aps_nat = nat;
+ aps->aps_next = ap_sess_list;
+ ap_sess_list = aps;
return aps;
}
@@ -221,59 +211,72 @@ nat_t *nat;
* check to see if a packet should be passed through an active proxy routine
* if one has been setup for it.
*/
-int ap_check(ip, tcp, fin, nat)
+int appr_check(ip, fin, nat)
ip_t *ip;
-tcphdr_t *tcp;
fr_info_t *fin;
nat_t *nat;
{
ap_session_t *aps;
aproxy_t *apr;
+ tcphdr_t *tcp = NULL;
+ u_32_t sum;
+ short rv;
int err;
- if (!(fin->fin_fi.fi_fl & FI_TCPUDP))
- tcp = NULL;
-
- if ((aps = ap_find(ip, tcp)) ||
- (aps = ap_new_session(nat->nat_ptr->in_apr, ip, tcp, fin, nat))) {
+ if (nat->nat_aps == NULL)
+ nat->nat_aps = appr_new_session(nat->nat_ptr->in_apr, ip,
+ fin, nat);
+ aps = nat->nat_aps;
+ if ((aps != NULL) && (aps->aps_p == ip->ip_p)) {
if (ip->ip_p == IPPROTO_TCP) {
+ tcp = (tcphdr_t *)fin->fin_dp;
/*
* verify that the checksum is correct. If not, then
* don't do anything with this packet.
*/
- if (tcp->th_sum != fr_tcpsum(*(mb_t **)fin->fin_mp,
- ip, tcp, ip->ip_len)) {
+#if SOLARIS && defined(_KERNEL)
+ sum = fr_tcpsum(fin->fin_qfm, ip, tcp);
+#else
+ sum = fr_tcpsum(*(mb_t **)fin->fin_mp, ip, tcp);
+#endif
+ if (sum != tcp->th_sum) {
frstats[fin->fin_out].fr_tcpbad++;
return -1;
}
- fr_tcp_age(&aps->aps_tout, aps->aps_state, ip, fin,
- tcp->th_sport == aps->aps_sport);
}
apr = aps->aps_apr;
err = 0;
- if (fin->fin_out) {
- if (apr->apr_outpkt)
- err = (*apr->apr_outpkt)(fin, ip, tcp,
- aps, nat);
+ if (fin->fin_out != 0) {
+ if (apr->apr_outpkt != NULL)
+ err = (*apr->apr_outpkt)(fin, ip, aps, nat);
} else {
- if (apr->apr_inpkt)
- err = (*apr->apr_inpkt)(fin, ip, tcp,
- aps, nat);
+ if (apr->apr_inpkt != NULL)
+ err = (*apr->apr_inpkt)(fin, ip, aps, nat);
}
- if (err == 2) {
- tcp->th_sum = fr_tcpsum(*(mb_t **)fin->fin_mp, ip,
- tcp, ip->ip_len);
- err = 0;
+
+ rv = APR_EXIT(err);
+ if (rv == -1)
+ return rv;
+
+ if (tcp != NULL) {
+ err = appr_fixseqack(fin, ip, aps, APR_INC(err));
+#if SOLARIS && defined(_KERNEL)
+ tcp->th_sum = fr_tcpsum(fin->fin_qfm, ip, tcp);
+#else
+ tcp->th_sum = fr_tcpsum(*(mb_t **)fin->fin_mp, ip, tcp);
+#endif
}
- return err;
+ aps->aps_bytes += ip->ip_len;
+ aps->aps_pkts++;
+ return 1;
}
- return -1;
+ return 0;
}
-aproxy_t *ap_match(pr, name)
-u_char pr;
+aproxy_t *appr_match(pr, name)
+u_int pr;
char *name;
{
aproxy_t *ap;
@@ -284,11 +287,18 @@ char *name;
ap->apr_ref++;
return ap;
}
+
+ for (ap = ap_proxylist; ap; ap = ap->apr_next)
+ if ((ap->apr_p == pr) &&
+ !strncmp(name, ap->apr_label, sizeof(ap->apr_label))) {
+ ap->apr_ref++;
+ return ap;
+ }
return NULL;
}
-void ap_free(ap)
+void appr_free(ap)
aproxy_t *ap;
{
ap->apr_ref--;
@@ -298,38 +308,144 @@ aproxy_t *ap;
void aps_free(aps)
ap_session_t *aps;
{
- if (aps->aps_data && aps->aps_psiz)
+ ap_session_t *a, **ap;
+
+ if (!aps)
+ return;
+
+ for (ap = &ap_sess_list; (a = *ap); ap = &a->aps_next)
+ if (a == aps) {
+ *ap = a->aps_next;
+ break;
+ }
+
+ if ((aps->aps_data != NULL) && (aps->aps_psiz != 0))
KFREES(aps->aps_data, aps->aps_psiz);
KFREE(aps);
}
-void ap_unload()
+static int appr_fixseqack(fin, ip, aps, inc)
+fr_info_t *fin;
+ip_t *ip;
+ap_session_t *aps;
+int inc;
{
- ap_session_t *aps;
- int i;
+ int sel, ch = 0, out, nlen;
+ u_32_t seq1, seq2;
+ tcphdr_t *tcp;
+
+ tcp = (tcphdr_t *)fin->fin_dp;
+ out = fin->fin_out;
+ nlen = ip->ip_len;
+ nlen -= (ip->ip_hl << 2) + (tcp->th_off << 2);
+
+ if (out != 0) {
+ seq1 = (u_32_t)ntohl(tcp->th_seq);
+ sel = aps->aps_sel[out];
+
+ /* switch to other set ? */
+ if ((aps->aps_seqmin[!sel] > aps->aps_seqmin[sel]) &&
+ (seq1 > aps->aps_seqmin[!sel]))
+ sel = aps->aps_sel[out] = !sel;
+
+ if (aps->aps_seqoff[sel]) {
+ seq2 = aps->aps_seqmin[sel] - aps->aps_seqoff[sel];
+ if (seq1 > seq2) {
+ seq2 = aps->aps_seqoff[sel];
+ seq1 += seq2;
+ tcp->th_seq = htonl(seq1);
+ ch = 1;
+ }
+ }
+
+ if (inc && (seq1 > aps->aps_seqmin[!sel])) {
+ aps->aps_seqmin[!sel] = seq1 + nlen - 1;
+ aps->aps_seqoff[!sel] = aps->aps_seqoff[sel] + inc;
+ }
+
+ /***/
+
+ seq1 = ntohl(tcp->th_ack);
+ sel = aps->aps_sel[1 - out];
+
+ /* switch to other set ? */
+ if ((aps->aps_ackmin[!sel] > aps->aps_ackmin[sel]) &&
+ (seq1 > aps->aps_ackmin[!sel]))
+ sel = aps->aps_sel[1 - out] = !sel;
+
+ if (aps->aps_ackoff[sel] && (seq1 > aps->aps_ackmin[sel])) {
+ seq2 = aps->aps_ackoff[sel];
+ tcp->th_ack = htonl(seq1 - seq2);
+ ch = 1;
+ }
+ } else {
+ seq1 = ntohl(tcp->th_seq);
+ sel = aps->aps_sel[out];
+
+ /* switch to other set ? */
+ if ((aps->aps_ackmin[!sel] > aps->aps_ackmin[sel]) &&
+ (seq1 > aps->aps_ackmin[!sel]))
+ sel = aps->aps_sel[out] = !sel;
+
+ if (aps->aps_ackoff[sel]) {
+ seq2 = aps->aps_ackmin[sel] -
+ aps->aps_ackoff[sel];
+ if (seq1 > seq2) {
+ seq2 = aps->aps_ackoff[sel];
+ seq1 += seq2;
+ tcp->th_seq = htonl(seq1);
+ ch = 1;
+ }
+ }
+
+ if (inc && (seq1 > aps->aps_ackmin[!sel])) {
+ aps->aps_ackmin[!sel] = seq1 + nlen - 1;
+ aps->aps_ackoff[!sel] = aps->aps_ackoff[sel] + inc;
+ }
+
+ /***/
+
+ seq1 = ntohl(tcp->th_ack);
+ sel = aps->aps_sel[1 - out];
- for (i = 0; i < AP_SESS_SIZE; i++)
- while ((aps = ap_sess_tab[i])) {
- ap_sess_tab[i] = aps->aps_next;
- aps_free(aps);
+ /* switch to other set ? */
+ if ((aps->aps_seqmin[!sel] > aps->aps_seqmin[sel]) &&
+ (seq1 > aps->aps_seqmin[!sel]))
+ sel = aps->aps_sel[1 - out] = !sel;
+
+ if (aps->aps_seqoff[sel] && (seq1 > aps->aps_seqmin[sel])) {
+ seq2 = aps->aps_seqoff[sel];
+ tcp->th_ack = htonl(seq1 - seq2);
+ ch = 1;
}
+ }
+ return ch ? 2 : 0;
}
-void ap_expire()
+int appr_init()
{
- ap_session_t *aps, **apsp;
- int i;
-
- for (i = 0; i < AP_SESS_SIZE; i++)
- for (apsp = &ap_sess_tab[i]; (aps = *apsp); ) {
- aps->aps_tout--;
- if (!aps->aps_tout) {
- ap_sess_tab[i] = aps->aps_next;
- aps_free(aps);
- *apsp = aps->aps_next;
- } else
- apsp = &aps->aps_next;
- }
+ aproxy_t *ap;
+ int err = 0;
+
+ for (ap = ap_proxies; ap->apr_p; ap++) {
+ err = (*ap->apr_init)();
+ if (err != 0)
+ break;
+ }
+ return err;
+}
+
+
+void appr_unload()
+{
+ aproxy_t *ap;
+
+ for (ap = ap_proxies; ap->apr_p; ap++)
+ if (ap->apr_fini)
+ (*ap->apr_fini)();
+ for (ap = ap_proxylist; ap; ap = ap->apr_next)
+ if (ap->apr_fini)
+ (*ap->apr_fini)();
}
diff --git a/sys/netinet/ip_proxy.h b/sys/netinet/ip_proxy.h
index a361e9368ada..933d79d6bd07 100644
--- a/sys/netinet/ip_proxy.h
+++ b/sys/netinet/ip_proxy.h
@@ -1,11 +1,11 @@
/*
- * Copyright (C) 1997 by Darren Reed.
+ * Copyright (C) 1997-2000 by Darren Reed.
*
* Redistribution and use in source and binary forms are permitted
* provided that this notice is preserved and due credit is given
* to the original author and the contributors.
*
- * $Id: ip_proxy.h,v 2.0.2.10.2.1 1997/11/27 09:33:27 darrenr Exp $
+ * $Id: ip_proxy.h,v 2.8.2.3 2000/05/06 12:32:43 darrenr Exp $
*/
#ifndef __IP_PROXY_H__
@@ -26,9 +26,11 @@ struct ipnat;
typedef struct ap_tcp {
u_short apt_sport; /* source port */
u_short apt_dport; /* destination port */
- short apt_sel; /* seqoff/after set selector */
+ short apt_sel[2]; /* {seq,ack}{off,min} set selector */
short apt_seqoff[2]; /* sequence # difference */
- tcp_seq apt_after[2]; /* don't change seq-off until after this */
+ tcp_seq apt_seqmin[2]; /* don't change seq-off until after this */
+ short apt_ackoff[2]; /* sequence # difference */
+ tcp_seq apt_ackmin[2]; /* don't change seq-off until after this */
u_char apt_state[2]; /* connection state */
} ap_tcp_t;
@@ -39,55 +41,115 @@ typedef struct ap_udp {
typedef struct ap_session {
struct aproxy *aps_apr;
- struct in_addr aps_src; /* source IP# */
- struct in_addr aps_dst; /* destination IP# */
- u_char aps_p; /* protocol */
union {
struct ap_tcp apu_tcp;
struct ap_udp apu_udp;
} aps_un;
u_int aps_flags;
- QUAD_T aps_bytes; /* bytes sent */
- QUAD_T aps_pkts; /* packets sent */
- u_long aps_tout; /* time left before expiring */
+ U_QUAD_T aps_bytes; /* bytes sent */
+ U_QUAD_T aps_pkts; /* packets sent */
+ void *aps_nat; /* pointer back to nat struct */
void *aps_data; /* private data */
+ int aps_p; /* protocol */
int aps_psiz; /* size of private data */
+ struct ap_session *aps_hnext;
struct ap_session *aps_next;
-} ap_session_t ;
+} ap_session_t;
#define aps_sport aps_un.apu_tcp.apt_sport
#define aps_dport aps_un.apu_tcp.apt_dport
#define aps_sel aps_un.apu_tcp.apt_sel
#define aps_seqoff aps_un.apu_tcp.apt_seqoff
-#define aps_after aps_un.apu_tcp.apt_after
+#define aps_seqmin aps_un.apu_tcp.apt_seqmin
#define aps_state aps_un.apu_tcp.apt_state
+#define aps_ackoff aps_un.apu_tcp.apt_ackoff
+#define aps_ackmin aps_un.apu_tcp.apt_ackmin
typedef struct aproxy {
+ struct aproxy *apr_next;
char apr_label[APR_LABELLEN]; /* Proxy label # */
u_char apr_p; /* protocol */
int apr_ref; /* +1 per rule referencing it */
int apr_flags;
- int (* apr_init) __P((fr_info_t *, ip_t *, tcphdr_t *,
+ int (* apr_init) __P((void));
+ void (* apr_fini) __P((void));
+ int (* apr_new) __P((fr_info_t *, ip_t *,
+ ap_session_t *, struct nat *));
+ int (* apr_inpkt) __P((fr_info_t *, ip_t *,
ap_session_t *, struct nat *));
- int (* apr_inpkt) __P((fr_info_t *, ip_t *, tcphdr_t *,
- ap_session_t *, struct nat *));
- int (* apr_outpkt) __P((fr_info_t *, ip_t *, tcphdr_t *,
+ int (* apr_outpkt) __P((fr_info_t *, ip_t *,
ap_session_t *, struct nat *));
} aproxy_t;
#define APR_DELETE 1
+#define APR_ERR(x) (((x) & 0xffff) << 16)
+#define APR_EXIT(x) (((x) >> 16) & 0xffff)
+#define APR_INC(x) ((x) & 0xffff)
+
+#define FTP_BUFSZ 160
+/*
+ * For the ftp proxy.
+ */
+typedef struct ftpside {
+ char *ftps_rptr;
+ char *ftps_wptr;
+ u_32_t ftps_seq;
+ int ftps_junk;
+ char ftps_buf[FTP_BUFSZ];
+} ftpside_t;
+
+typedef struct ftpinfo {
+ u_int ftp_passok;
+ ftpside_t ftp_side[2];
+} ftpinfo_t;
+
+/*
+ * Real audio proxy structure and #defines
+ */
+typedef struct {
+ int rap_seenpna;
+ int rap_seenver;
+ int rap_version;
+ int rap_eos; /* End Of Startup */
+ int rap_gotid;
+ int rap_gotlen;
+ int rap_mode;
+ int rap_sdone;
+ u_short rap_plport;
+ u_short rap_prport;
+ u_short rap_srport;
+ char rap_svr[19];
+ u_32_t rap_sbf; /* flag to indicate which of the 19 bytes have
+ * been filled
+ */
+ tcp_seq rap_sseq;
+} raudio_t;
+
+#define RA_ID_END 0
+#define RA_ID_UDP 1
+#define RA_ID_ROBUST 7
+
+#define RAP_M_UDP 1
+#define RAP_M_ROBUST 2
+#define RAP_M_TCP 4
+#define RAP_M_UDP_ROBUST (RAP_M_UDP|RAP_M_ROBUST)
+
extern ap_session_t *ap_sess_tab[AP_SESS_SIZE];
+extern ap_session_t *ap_sess_list;
extern aproxy_t ap_proxies[];
+extern int ippr_ftp_pasvonly;
-extern int ap_ok __P((ip_t *, tcphdr_t *, struct ipnat *));
-extern void ap_unload __P((void));
-extern void ap_free __P((aproxy_t *));
+extern int appr_add __P((aproxy_t *));
+extern int appr_del __P((aproxy_t *));
+extern int appr_init __P((void));
+extern void appr_unload __P((void));
+extern int appr_ok __P((ip_t *, tcphdr_t *, struct ipnat *));
+extern void appr_free __P((aproxy_t *));
extern void aps_free __P((ap_session_t *));
-extern int ap_check __P((ip_t *, tcphdr_t *, fr_info_t *, struct nat *));
-extern aproxy_t *ap_match __P((u_char, char *));
-extern void ap_expire __P((void));
+extern int appr_check __P((ip_t *, fr_info_t *, struct nat *));
+extern aproxy_t *appr_match __P((u_int, char *));
#endif /* __IP_PROXY_H__ */
diff --git a/sys/netinet/ip_raudio_pxy.c b/sys/netinet/ip_raudio_pxy.c
index b76eea52aae0..18ca474230d2 100644
--- a/sys/netinet/ip_raudio_pxy.c
+++ b/sys/netinet/ip_raudio_pxy.c
@@ -1,6 +1,5 @@
/*
- * $Id$
- * $FreeBSD$
+ * $Id: ip_raudio_pxy.c,v 1.7.2.1 2000/05/06 11:19:33 darrenr Exp $
*/
#if SOLARIS && defined(_KERNEL)
extern kmutex_t ipf_rw;
@@ -42,12 +41,13 @@ nat_t *nat;
KMALLOCS(aps->aps_data, void *, sizeof(raudio_t));
- if (aps->aps_data != NULL) {
- bzero(aps->aps_data, sizeof(raudio_t));
- rap = aps->aps_data;
- aps->aps_psiz = sizeof(raudio_t);
- rap->rap_mode = RAP_M_TCP; /* default is for TCP */
- }
+ if (aps->aps_data == NULL)
+ return -1;
+
+ bzero(aps->aps_data, sizeof(raudio_t));
+ rap = aps->aps_data;
+ aps->aps_psiz = sizeof(raudio_t);
+ rap->rap_mode = RAP_M_TCP; /* default is for TCP */
return 0;
}
@@ -59,15 +59,12 @@ ip_t *ip;
ap_session_t *aps;
nat_t *nat;
{
- char membuf[512 + 1], *s;
- int off, dlen, inc = 0;
- tcphdr_t *tcp, tcph, *tcp2 = &tcph;
raudio_t *rap = aps->aps_data;
- u_short sp, dp, id = 0;
- struct in_addr swip;
- fr_info_t fi;
+ unsigned char membuf[512 + 1], *s;
+ u_short id = 0;
+ tcphdr_t *tcp;
+ int off, dlen;
int len = 0;
- nat_t *ipn;
mb_t *m;
#if SOLARIS
mb_t *m1;
@@ -89,14 +86,14 @@ nat_t *nat;
dlen = msgdsize(m) - off;
if (dlen <= 0)
return 0;
- copyout_mblk(m, off, MIN(sizeof(membuf), dlen), membuf);
+ copyout_mblk(m, off, MIN(sizeof(membuf), dlen), (char *)membuf);
#else
m = *(mb_t **)fin->fin_mp;
dlen = mbufchainlen(m) - off;
if (dlen <= 0)
return 0;
- m_copydata(m, off, MIN(sizeof(membuf), dlen), membuf);
+ m_copydata(m, off, MIN(sizeof(membuf), dlen), (char *)membuf);
#endif
/*
* In all the startup parsing, ensure that we don't go outside
@@ -106,7 +103,7 @@ nat_t *nat;
* Look for the start of connection "PNA" string if not seen yet.
*/
if (rap->rap_seenpna == 0) {
- s = memstr("PNA", membuf, 3, dlen);
+ s = (u_char *)memstr("PNA", (char *)membuf, 3, dlen);
if (s == NULL)
return 0;
s += 3;
@@ -160,38 +157,7 @@ nat_t *nat;
rap->rap_gotid = 0;
}
}
-
- /*
- * Wait until we've seen the end of the start messages and even then
- * only proceed further if we're using UDP.
- */
- if ((rap->rap_eos == 0) || ((rap->rap_mode & RAP_M_UDP) != RAP_M_UDP))
- return 0;
- sp = rap->rap_plport;
- dp = 0;
-
- bcopy((char *)fin, (char *)&fi, sizeof(fi));
- bzero((char *)tcp2, sizeof(*tcp2));
- tcp2->th_sport = htons(sp);
- tcp2->th_dport = 0; /* XXX - don't specify remote port */
- tcp2->th_win = htons(8192);
- fi.fin_dp = (char *)tcp2;
- fi.fin_data[0] = sp;
- fi.fin_data[1] = 0;
- fi.fin_fr = &raudiofr;
- swip = ip->ip_src;
- ip->ip_src = nat->nat_inip;
- ipn = nat_new(nat->nat_ptr, ip, &fi, IPN_TCP|FI_W_DPORT, NAT_OUTBOUND);
- if (ipn != NULL) {
- ipn->nat_age = fr_defnatage;
- (void) fr_addstate(ip, &fi, FI_W_DPORT);
- }
- ip->ip_src = swip;
-
- if ((rap->rap_mode & RAP_M_UDP_ROBUST) == RAP_M_UDP_ROBUST) {
- sp = rap->rap_prport;
- }
- return inc;
+ return 0;
}
@@ -201,19 +167,28 @@ ip_t *ip;
ap_session_t *aps;
nat_t *nat;
{
- char membuf[IPF_MAXPORTLEN + 1], *s;
- int off, dlen;
+ unsigned char membuf[IPF_MAXPORTLEN + 1], *s;
+ tcphdr_t *tcp, tcph, *tcp2 = &tcph;
raudio_t *rap = aps->aps_data;
+ struct in_addr swa, swb;
u_int a1, a2, a3, a4;
- tcphdr_t *tcp;
+ int off, dlen, slen;
+ u_short sp, dp;
+ fr_info_t fi;
tcp_seq seq;
+ nat_t *ipn;
+ u_char swp;
mb_t *m;
#if SOLARIS
mb_t *m1;
#endif
- if ((rap->rap_sdone != 0) ||
- ((rap->rap_mode & RAP_M_UDP_ROBUST) != RAP_M_UDP_ROBUST))
+ /*
+ * Wait until we've seen the end of the start messages and even then
+ * only proceed further if we're using UDP. If they want to use TCP
+ * then data is sent back on the same channel that is already open.
+ */
+ if (rap->rap_sdone != 0)
return 0;
tcp = (tcphdr_t *)fin->fin_dp;
@@ -227,13 +202,13 @@ nat_t *nat;
if (dlen <= 0)
return 0;
bzero(membuf, sizeof(membuf));
- copyout_mblk(m, off, MIN(sizeof(membuf), dlen), membuf);
+ copyout_mblk(m, off, MIN(sizeof(membuf), dlen), (char *)membuf);
#else
dlen = mbufchainlen(m) - off;
if (dlen <= 0)
return 0;
bzero(membuf, sizeof(membuf));
- m_copydata(m, off, MIN(sizeof(membuf), dlen), membuf);
+ m_copydata(m, off, MIN(sizeof(membuf), dlen), (char *)membuf);
#endif
seq = ntohl(tcp->th_seq);
@@ -242,7 +217,7 @@ nat_t *nat;
* We only care for the first 19 bytes coming back from the server.
*/
if (rap->rap_sseq == 0) {
- s = memstr("PNA", membuf, 3, dlen);
+ s = (u_char *)memstr("PNA", (char *)membuf, 3, dlen);
if (s == NULL)
return 0;
a1 = s - membuf;
@@ -262,13 +237,71 @@ nat_t *nat;
} else
return 0;
- for (a3 = a1, a4 = a2; a4 > 0; a4--, a3++) {
+ for (a3 = a1, a4 = a2; (a4 > 0) && (a3 < 19) && (a3 >= 0); a4--,a3++) {
rap->rap_sbf |= (1 << a3);
rap->rap_svr[a3] = *s++;
}
- if (rap->rap_sbf == 0x7ffff) { /* 19 bits */
- s = rap->rap_svr + 13;
+
+ if ((rap->rap_sbf != 0x7ffff) || (!rap->rap_eos)) /* 19 bits */
+ return 0;
+ rap->rap_sdone = 1;
+
+ s = (u_char *)rap->rap_svr + 11;
+ if (((*s << 8) | *(s + 1)) == RA_ID_ROBUST) {
+ s += 2;
rap->rap_srport = (*s << 8) | *(s + 1);
}
+
+ swp = ip->ip_p;
+ swa = ip->ip_src;
+ swb = ip->ip_dst;
+
+ ip->ip_p = IPPROTO_UDP;
+ ip->ip_src = nat->nat_inip;
+ ip->ip_dst = nat->nat_oip;
+
+ bcopy((char *)fin, (char *)&fi, sizeof(fi));
+ bzero((char *)tcp2, sizeof(*tcp2));
+ tcp2->th_off = 5;
+ fi.fin_dp = (char *)tcp2;
+ fi.fin_fr = &raudiofr;
+ tcp2->th_win = htons(8192);
+ slen = ip->ip_len;
+ ip->ip_len = fin->fin_hlen + sizeof(*tcp);
+
+ if (((rap->rap_mode & RAP_M_UDP_ROBUST) == RAP_M_UDP_ROBUST) &&
+ (rap->rap_srport != 0)) {
+ dp = rap->rap_srport;
+ sp = rap->rap_prport;
+ tcp2->th_sport = htons(sp);
+ tcp2->th_dport = htons(dp);
+ fi.fin_data[0] = dp;
+ fi.fin_data[1] = sp;
+ ipn = nat_new(nat->nat_ptr, ip, &fi,
+ IPN_UDP | (sp ? 0 : FI_W_SPORT), NAT_OUTBOUND);
+ if (ipn != NULL) {
+ ipn->nat_age = fr_defnatage;
+ (void) fr_addstate(ip, &fi, sp ? 0 : FI_W_SPORT);
+ }
+ }
+
+ if ((rap->rap_mode & RAP_M_UDP) == RAP_M_UDP) {
+ sp = rap->rap_plport;
+ tcp2->th_sport = htons(sp);
+ tcp2->th_dport = 0; /* XXX - don't specify remote port */
+ fi.fin_data[0] = sp;
+ fi.fin_data[1] = 0;
+ ipn = nat_new(nat->nat_ptr, ip, &fi, IPN_UDP|FI_W_DPORT,
+ NAT_OUTBOUND);
+ if (ipn != NULL) {
+ ipn->nat_age = fr_defnatage;
+ (void) fr_addstate(ip, &fi, FI_W_DPORT);
+ }
+ }
+
+ ip->ip_p = swp;
+ ip->ip_len = slen;
+ ip->ip_src = swa;
+ ip->ip_dst = swb;
return 0;
}
diff --git a/sys/netinet/ip_rcmd_pxy.c b/sys/netinet/ip_rcmd_pxy.c
index f9dc5b36db0f..daea94fdbec7 100644
--- a/sys/netinet/ip_rcmd_pxy.c
+++ b/sys/netinet/ip_rcmd_pxy.c
@@ -1,6 +1,5 @@
/*
- * $Id$
- * $FreeBSD$
+ * $Id: ip_rcmd_pxy.c,v 1.4.2.1 2000/05/06 11:19:34 darrenr Exp $
*/
/*
* Simple RCMD transparent proxy for in-kernel use. For use with the NAT
@@ -127,11 +126,16 @@ nat_t *nat;
ipn = nat_outlookup(fin->fin_ifp, IPN_TCP, nat->nat_p, nat->nat_inip,
ip->ip_dst, (dp << 16) | sp);
if (ipn == NULL) {
+ int slen;
+
+ slen = ip->ip_len;
+ ip->ip_len = fin->fin_hlen + sizeof(*tcp);
bcopy((char *)fin, (char *)&fi, sizeof(fi));
bzero((char *)tcp2, sizeof(*tcp2));
tcp2->th_win = htons(8192);
tcp2->th_sport = sp;
tcp2->th_dport = 0; /* XXX - don't specify remote port */
+ tcp2->th_off = 5;
fi.fin_data[0] = ntohs(sp);
fi.fin_data[1] = 0;
fi.fin_dp = (char *)tcp2;
@@ -144,6 +148,7 @@ nat_t *nat;
fi.fin_fr = &rcmdfr;
(void) fr_addstate(ip, &fi, FI_W_DPORT);
}
+ ip->ip_len = slen;
ip->ip_src = swip;
}
return 0;
diff --git a/sys/netinet/ip_state.c b/sys/netinet/ip_state.c
index 89a2c3bf358a..c9a28af05654 100644
--- a/sys/netinet/ip_state.c
+++ b/sys/netinet/ip_state.c
@@ -1,16 +1,29 @@
/*
- * Copyright (C) 1995-1997 by Darren Reed.
+ * Copyright (C) 1995-2000 by Darren Reed.
*
* Redistribution and use in source and binary forms are permitted
* provided that this notice is preserved and due credit is given
* to the original author and the contributors.
*/
#if !defined(lint)
-static const char sccsid[] = "@(#)ip_state.c 1.8 6/5/96 (C) 1993-1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.0.2.24.2.14 1998/05/24 03:53:04 darrenr Exp $";
+static const char sccsid[] = "@(#)ip_state.c 1.8 6/5/96 (C) 1993-2000 Darren Reed";
+static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.30.2.9 2000/05/22 10:26:15 darrenr Exp $";
#endif
+#include <sys/errno.h>
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/file.h>
+#if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \
+ defined(_KERNEL)
+# include "opt_ipfilter_log.h"
+#endif
+#if defined(_KERNEL) && defined(__FreeBSD_version) && \
+ (__FreeBSD_version >= 400000) && !defined(KLD_MODULE)
+#include "opt_inet6.h"
+#endif
#if !defined(_KERNEL) && !defined(KERNEL) && !defined(__KERNEL__)
+# include <stdio.h>
# include <stdlib.h>
# include <string.h>
#else
@@ -19,23 +32,22 @@ static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.0.2.24.2.14 1998/05/24 03:5
# include <linux/module.h>
# endif
#endif
-#include <sys/errno.h>
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/file.h>
-#if defined(KERNEL) && (__FreeBSD_version >= 220000)
+#if (defined(KERNEL) || defined(_KERNEL)) && (__FreeBSD_version >= 220000)
# include <sys/filio.h>
# include <sys/fcntl.h>
+# if (__FreeBSD_version >= 300000) && !defined(IPFILTER_LKM)
+# include "opt_ipfilter.h"
+# endif
#else
# include <sys/ioctl.h>
#endif
#include <sys/time.h>
#include <sys/uio.h>
#ifndef linux
-#include <sys/protosw.h>
+# include <sys/protosw.h>
#endif
#include <sys/socket.h>
-#if defined(_KERNEL) && !defined(linux)
+#if (defined(_KERNEL) || defined(KERNEL)) && !defined(linux)
# include <sys/systm.h>
#endif
#if !defined(__SVR4) && !defined(__svr4__)
@@ -45,14 +57,16 @@ static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.0.2.24.2.14 1998/05/24 03:5
#else
# include <sys/filio.h>
# include <sys/byteorder.h>
-# include <sys/dditypes.h>
+# ifdef _KERNEL
+# include <sys/dditypes.h>
+# endif
# include <sys/stream.h>
# include <sys/kmem.h>
#endif
#include <net/if.h>
#ifdef sun
-#include <net/af.h>
+# include <net/af.h>
#endif
#include <net/route.h>
#include <netinet/in.h>
@@ -72,40 +86,92 @@ static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.0.2.24.2.14 1998/05/24 03:5
#include "netinet/ip_frag.h"
#include "netinet/ip_proxy.h"
#include "netinet/ip_state.h"
+#ifdef USE_INET6
+#include <netinet/icmp6.h>
+#endif
+#if (__FreeBSD_version >= 300000)
+# include <sys/malloc.h>
+# if (defined(_KERNEL) || defined(KERNEL)) && !defined(IPFILTER_LKM)
+# include <sys/libkern.h>
+# include <sys/systm.h>
+# endif
+#endif
+
#ifndef MIN
-#define MIN(a,b) (((a)<(b))?(a):(b))
+# define MIN(a,b) (((a)<(b))?(a):(b))
#endif
#define TCP_CLOSE (TH_FIN|TH_RST)
-ipstate_t *ips_table[IPSTATE_SIZE];
-int ips_num = 0;
-ips_stat_t ips_stats;
+static ipstate_t **ips_table = NULL;
+static ipstate_t *ips_list = NULL;
+static int ips_num = 0;
+static ips_stat_t ips_stats;
#if (SOLARIS || defined(__sgi)) && defined(_KERNEL)
-extern kmutex_t ipf_state;
+extern KRWLOCK_T ipf_state, ipf_mutex;
+extern kmutex_t ipf_rw;
#endif
-static int fr_matchsrcdst __P((ipstate_t *, struct in_addr, struct in_addr,
- fr_info_t *, void *, u_short, u_short));
+#ifdef USE_INET6
+static frentry_t *fr_checkicmp6matchingstate __P((ip6_t *, fr_info_t *));
+#endif
+static int fr_matchsrcdst __P((ipstate_t *, union i6addr, union i6addr,
+ fr_info_t *, tcphdr_t *));
+static frentry_t *fr_checkicmpmatchingstate __P((ip_t *, fr_info_t *));
+static int fr_matchicmpqueryreply __P((int, ipstate_t *, icmphdr_t *));
static int fr_state_flush __P((int));
static ips_stat_t *fr_statetstats __P((void));
+static void fr_delstate __P((ipstate_t *));
+static int fr_state_remove __P((caddr_t));
+int fr_stputent __P((caddr_t));
+int fr_stgetent __P((caddr_t));
+void fr_stinsert __P((ipstate_t *));
#define FIVE_DAYS (2 * 5 * 86400) /* 5 days: half closed session */
+#define TCP_MSL 240 /* 2 minutes */
u_long fr_tcpidletimeout = FIVE_DAYS,
- fr_tcpclosewait = 60,
- fr_tcplastack = 20,
- fr_tcptimeout = 120,
+ fr_tcpclosewait = 2 * TCP_MSL,
+ fr_tcplastack = 2 * TCP_MSL,
+ fr_tcptimeout = 2 * TCP_MSL,
fr_tcpclosed = 1,
- fr_udptimeout = 120,
+ fr_udptimeout = 240,
fr_icmptimeout = 120;
+int fr_statemax = IPSTATE_MAX,
+ fr_statesize = IPSTATE_SIZE;
+int fr_state_doflush = 0,
+ fr_state_lock = 0;
+
+static int icmpreplytype4[ICMP_MAXTYPE + 1];
+
+int fr_stateinit()
+{
+ int i;
+
+ KMALLOCS(ips_table, ipstate_t **, fr_statesize * sizeof(ipstate_t *));
+ if (ips_table != NULL)
+ bzero((char *)ips_table, fr_statesize * sizeof(ipstate_t *));
+ else
+ return -1;
+
+ /* fill icmp reply type table */
+ for (i = 0; i <= ICMP_MAXTYPE; i++)
+ icmpreplytype4[i] = -1;
+ icmpreplytype4[ICMP_ECHO] = ICMP_ECHOREPLY;
+ icmpreplytype4[ICMP_TSTAMP] = ICMP_TSTAMPREPLY;
+ icmpreplytype4[ICMP_IREQ] = ICMP_IREQREPLY;
+ icmpreplytype4[ICMP_MASKREQ] = ICMP_MASKREPLY;
+
+ return 0;
+}
static ips_stat_t *fr_statetstats()
{
ips_stats.iss_active = ips_num;
ips_stats.iss_table = ips_table;
+ ips_stats.iss_list = ips_list;
return &ips_stats;
}
@@ -119,7 +185,6 @@ static ips_stat_t *fr_statetstats()
static int fr_state_flush(which)
int which;
{
- register int i;
register ipstate_t *is, **isp;
#if defined(_KERNEL) && !SOLARIS
int s;
@@ -127,47 +192,69 @@ int which;
int delete, removed = 0;
SPL_NET(s);
- MUTEX_ENTER(&ipf_state);
- for (i = 0; i < IPSTATE_SIZE; i++)
- for (isp = &ips_table[i]; (is = *isp); ) {
- delete = 0;
-
- switch (which)
- {
- case 0 :
- delete = 1;
- break;
- case 1 :
- if ((is->is_p == IPPROTO_TCP) &&
- (((is->is_state[0] <= TCPS_ESTABLISHED) &&
- (is->is_state[1] > TCPS_ESTABLISHED)) ||
- ((is->is_state[1] <= TCPS_ESTABLISHED) &&
- (is->is_state[0] > TCPS_ESTABLISHED))))
- delete = 1;
+ for (isp = &ips_list; (is = *isp); ) {
+ delete = 0;
+
+ switch (which)
+ {
+ case 0 :
+ delete = 1;
+ break;
+ case 1 :
+ if (is->is_p != IPPROTO_TCP)
break;
- }
+ if ((is->is_state[0] != TCPS_ESTABLISHED) ||
+ (is->is_state[1] != TCPS_ESTABLISHED))
+ delete = 1;
+ break;
+ }
- if (delete) {
- *isp = is->is_next;
- if (is->is_p == IPPROTO_TCP)
- ips_stats.iss_fin++;
- else
- ips_stats.iss_expire++;
+ if (delete) {
+ if (is->is_p == IPPROTO_TCP)
+ ips_stats.iss_fin++;
+ else
+ ips_stats.iss_expire++;
#ifdef IPFILTER_LOG
- ipstate_log(is, ISL_FLUSH);
+ ipstate_log(is, ISL_FLUSH);
#endif
- KFREE(is);
- ips_num--;
- removed++;
- } else
- isp = &is->is_next;
- }
- MUTEX_EXIT(&ipf_state);
+ fr_delstate(is);
+ removed++;
+ } else
+ isp = &is->is_next;
+ }
SPL_X(s);
return removed;
}
+static int fr_state_remove(data)
+caddr_t data;
+{
+ ipstate_t *sp, st;
+ int error;
+
+ sp = &st;
+ error = IRCOPYPTR(data, (caddr_t)&st, sizeof(st));
+ if (error)
+ return EFAULT;
+
+ for (sp = ips_list; sp; sp = sp->is_next)
+ if ((sp->is_p == st.is_p) && (sp->is_v == st.is_v) &&
+ !bcmp(&sp->is_src, &st.is_src, sizeof(st.is_src)) &&
+ !bcmp(&sp->is_dst, &st.is_src, sizeof(st.is_dst)) &&
+ !bcmp(&sp->is_ps, &st.is_ps, sizeof(st.is_ps))) {
+ WRITE_ENTER(&ipf_state);
+#ifdef IPFILTER_LOG
+ ipstate_log(sp, ISL_REMOVE);
+#endif
+ fr_delstate(sp);
+ RWLOCK_EXIT(&ipf_state);
+ return 0;
+ }
+ return ESRCH;
+}
+
+
int fr_state_ioctl(data, cmd, mode)
caddr_t data;
#if defined(__NetBSD__) || defined(__OpenBSD__)
@@ -177,175 +264,412 @@ int cmd;
#endif
int mode;
{
- int arg, ret, error = 0;
+ int arg, ret, error = 0;
switch (cmd)
{
+ case SIOCDELST :
+ error = fr_state_remove(data);
+ break;
case SIOCIPFFL :
- IRCOPY(data, (caddr_t)&arg, sizeof(arg));
+ error = IRCOPY(data, (caddr_t)&arg, sizeof(arg));
+ if (error)
+ break;
if (arg == 0 || arg == 1) {
+ WRITE_ENTER(&ipf_state);
ret = fr_state_flush(arg);
- IWCOPY((caddr_t)&ret, data, sizeof(ret));
+ RWLOCK_EXIT(&ipf_state);
+ error = IWCOPY((caddr_t)&ret, data, sizeof(ret));
} else
error = EINVAL;
break;
- case SIOCGIPST :
- IWCOPY((caddr_t)fr_statetstats(), data, sizeof(ips_stat_t));
+#ifdef IPFILTER_LOG
+ case SIOCIPFFB :
+ if (!(mode & FWRITE))
+ error = EPERM;
+ else {
+ int tmp;
+
+ tmp = ipflog_clear(IPL_LOGSTATE);
+ IWCOPY((char *)&tmp, data, sizeof(tmp));
+ }
+ break;
+#endif
+ case SIOCGETFS :
+ error = IWCOPYPTR((caddr_t)fr_statetstats(), data,
+ sizeof(ips_stat_t));
break;
case FIONREAD :
#ifdef IPFILTER_LOG
- IWCOPY((caddr_t)&iplused[IPL_LOGSTATE], (caddr_t)data,
- sizeof(iplused[IPL_LOGSTATE]));
+ error = IWCOPY((caddr_t)&iplused[IPL_LOGSTATE], (caddr_t)data,
+ sizeof(iplused[IPL_LOGSTATE]));
#endif
break;
+ case SIOCSTLCK :
+ error = fr_lock(data, &fr_state_lock);
+ break;
+ case SIOCSTPUT :
+ if (!fr_state_lock) {
+ error = EACCES;
+ break;
+ }
+ error = fr_stputent(data);
+ break;
+ case SIOCSTGET :
+ if (!fr_state_lock) {
+ error = EACCES;
+ break;
+ }
+ error = fr_stgetent(data);
+ break;
default :
- return EINVAL;
+ error = EINVAL;
+ break;
}
return error;
}
+int fr_stgetent(data)
+caddr_t data;
+{
+ register ipstate_t *is, *isn;
+ ipstate_save_t ips, *ipsp;
+ int error;
+
+ error = IRCOPY(data, (caddr_t)&ipsp, sizeof(ipsp));
+ if (error)
+ return EFAULT;
+ error = IRCOPY((caddr_t)ipsp, (caddr_t)&ips, sizeof(ips));
+ if (error)
+ return EFAULT;
+
+ isn = ips.ips_next;
+ if (!isn) {
+ isn = ips_list;
+ if (isn == NULL) {
+ if (ips.ips_next == NULL)
+ return ENOENT;
+ return 0;
+ }
+ } else {
+ /*
+ * Make sure the pointer we're copying from exists in the
+ * current list of entries. Security precaution to prevent
+ * copying of random kernel data.
+ */
+ for (is = ips_list; is; is = is->is_next)
+ if (is == isn)
+ break;
+ if (!is)
+ return ESRCH;
+ }
+ ips.ips_next = isn->is_next;
+ bcopy((char *)isn, (char *)&ips.ips_is, sizeof(ips.ips_is));
+ if (isn->is_rule)
+ bcopy((char *)isn->is_rule, (char *)&ips.ips_fr,
+ sizeof(ips.ips_fr));
+ error = IWCOPY((caddr_t)&ips, ipsp, sizeof(ips));
+ if (error)
+ return EFAULT;
+ return 0;
+}
+
+
+int fr_stputent(data)
+caddr_t data;
+{
+ register ipstate_t *is, *isn;
+ ipstate_save_t ips, *ipsp;
+ frentry_t *fr;
+ int error;
+
+ error = IRCOPY(data, (caddr_t)&ipsp, sizeof(ipsp));
+ if (error)
+ return EFAULT;
+ error = IRCOPY((caddr_t)ipsp, (caddr_t)&ips, sizeof(ips));
+ if (error)
+ return EFAULT;
+
+ KMALLOC(isn, ipstate_t *);
+ if (isn == NULL)
+ return ENOMEM;
+
+ bcopy((char *)&ips.ips_is, (char *)isn, sizeof(*isn));
+ fr = isn->is_rule;
+ if (fr != NULL) {
+ if (isn->is_flags & FI_NEWFR) {
+ KMALLOC(fr, frentry_t *);
+ if (fr == NULL) {
+ KFREE(isn);
+ return ENOMEM;
+ }
+ bcopy((char *)&ips.ips_fr, (char *)fr, sizeof(*fr));
+ isn->is_rule = fr;
+ ips.ips_is.is_rule = fr;
+ error = IWCOPY((caddr_t)&ips, ipsp, sizeof(ips));
+ if (error) {
+ KFREE(isn);
+ KFREE(fr);
+ return EFAULT;
+ }
+ } else {
+ for (is = ips_list; is; is = is->is_next)
+ if (is->is_rule == fr)
+ break;
+ if (!is) {
+ KFREE(isn);
+ return ESRCH;
+ }
+ }
+ }
+ fr_stinsert(isn);
+ return 0;
+}
+
+
+void fr_stinsert(is)
+register ipstate_t *is;
+{
+ register u_int hv = is->is_hv;
+
+ MUTEX_INIT(&is->is_lock, "ipf state entry", NULL);
+
+ is->is_ifname[0][sizeof(is->is_ifname[0]) - 1] = '\0';
+ if (is->is_ifname[0][0] != '\0') {
+ is->is_ifp[0] = GETUNIT(is->is_ifname[0], is->is_v);
+ }
+ is->is_ifname[1][sizeof(is->is_ifname[0]) - 1] = '\0';
+ if (is->is_ifname[1][0] != '\0') {
+ is->is_ifp[1] = GETUNIT(is->is_ifname[1], is->is_v);
+ }
+
+ /*
+ * add into list table.
+ */
+ if (ips_list)
+ ips_list->is_pnext = &is->is_next;
+ is->is_pnext = &ips_list;
+ is->is_next = ips_list;
+ ips_list = is;
+ if (ips_table[hv])
+ ips_table[hv]->is_phnext = &is->is_hnext;
+ else
+ ips_stats.iss_inuse++;
+ is->is_phnext = ips_table + hv;
+ is->is_hnext = ips_table[hv];
+ ips_table[hv] = is;
+}
+
+
/*
* Create a new ipstate structure and hang it off the hash table.
*/
-int fr_addstate(ip, fin, pass)
+ipstate_t *fr_addstate(ip, fin, flags)
ip_t *ip;
fr_info_t *fin;
-u_int pass;
+u_int flags;
{
- ipstate_t ips;
- register ipstate_t *is = &ips;
+ register tcphdr_t *tcp = NULL;
+ register ipstate_t *is;
register u_int hv;
+ ipstate_t ips;
+ u_int pass;
+ int out;
- if ((ip->ip_off & 0x1fff) || (fin->fin_fi.fi_fl & FI_SHORT))
- return -1;
- if (ips_num == IPSTATE_MAX) {
+ if (fr_state_lock || (fin->fin_off & IP_OFFMASK) ||
+ (fin->fin_fi.fi_fl & FI_SHORT))
+ return NULL;
+ if (ips_num == fr_statemax) {
ips_stats.iss_max++;
- return -1;
+ fr_state_doflush = 1;
+ return NULL;
}
+ out = fin->fin_out;
+ is = &ips;
+ bzero((char *)is, sizeof(*is));
ips.is_age = 1;
ips.is_state[0] = 0;
ips.is_state[1] = 0;
/*
* Copy and calculate...
*/
- hv = (is->is_p = ip->ip_p);
- hv += (is->is_src.s_addr = ip->ip_src.s_addr);
- hv += (is->is_dst.s_addr = ip->ip_dst.s_addr);
+ hv = (is->is_p = fin->fin_fi.fi_p);
+ is->is_src = fin->fin_fi.fi_src;
+ hv += is->is_saddr;
+ is->is_dst = fin->fin_fi.fi_dst;
+ hv += is->is_daddr;
+#ifdef USE_INET6
+ if (fin->fin_v == 6) {
+ if (is->is_p == IPPROTO_ICMPV6) {
+ if (IN6_IS_ADDR_MULTICAST(&is->is_dst.in6))
+ flags |= FI_W_DADDR;
+ if (out)
+ hv -= is->is_daddr;
+ else
+ hv -= is->is_saddr;
+ }
+ }
+#endif
- switch (ip->ip_p)
+ switch (is->is_p)
{
+#ifdef USE_INET6
+ case IPPROTO_ICMPV6 :
+#endif
case IPPROTO_ICMP :
{
struct icmp *ic = (struct icmp *)fin->fin_dp;
+#ifdef USE_INET6
+ if ((is->is_p == IPPROTO_ICMPV6) &&
+ ((ic->icmp_type & ICMP6_INFOMSG_MASK) == 0))
+ return NULL;
+#endif
switch (ic->icmp_type)
{
- case ICMP_ECHO :
- is->is_icmp.ics_type = ICMP_ECHOREPLY; /* XXX */
+#ifdef USE_INET6
+ case ICMP6_ECHO_REQUEST :
+ is->is_icmp.ics_type = ICMP6_ECHO_REPLY;
hv += (is->is_icmp.ics_id = ic->icmp_id);
hv += (is->is_icmp.ics_seq = ic->icmp_seq);
break;
+ case ICMP6_MEMBERSHIP_QUERY :
+ case ND_ROUTER_SOLICIT :
+ case ND_NEIGHBOR_SOLICIT :
+ is->is_icmp.ics_type = ic->icmp_type + 1;
+ break;
+ break;
+#endif
+ case ICMP_ECHO :
case ICMP_TSTAMP :
case ICMP_IREQ :
case ICMP_MASKREQ :
- is->is_icmp.ics_type = ic->icmp_type + 1;
+ is->is_icmp.ics_type = ic->icmp_type;
+ hv += (is->is_icmp.ics_id = ic->icmp_id);
+ hv += (is->is_icmp.ics_seq = ic->icmp_seq);
break;
default :
- return -1;
+ return NULL;
}
- ips_stats.iss_icmp++;
+ ATOMIC_INCL(ips_stats.iss_icmp);
is->is_age = fr_icmptimeout;
break;
}
case IPPROTO_TCP :
{
- register tcphdr_t *tcp = (tcphdr_t *)fin->fin_dp;
+ tcp = (tcphdr_t *)fin->fin_dp;
+ if (tcp->th_flags & TH_RST)
+ return NULL;
/*
* The endian of the ports doesn't matter, but the ack and
* sequence numbers do as we do mathematics on them later.
*/
- hv += (is->is_dport = tcp->th_dport);
- hv += (is->is_sport = tcp->th_sport);
- is->is_seq = ntohl(tcp->th_seq);
- is->is_ack = ntohl(tcp->th_ack);
- is->is_swin = ntohs(tcp->th_win);
- is->is_dwin = is->is_swin; /* start them the same */
- ips_stats.iss_tcp++;
+ is->is_dport = tcp->th_dport;
+ is->is_sport = tcp->th_sport;
+ if ((flags & (FI_W_DPORT|FI_W_SPORT)) == 0) {
+ hv += tcp->th_dport;
+ hv += tcp->th_sport;
+ }
+ is->is_send = ntohl(tcp->th_seq) + ip->ip_len -
+ fin->fin_hlen - (tcp->th_off << 2) +
+ ((tcp->th_flags & TH_SYN) ? 1 : 0) +
+ ((tcp->th_flags & TH_FIN) ? 1 : 0);
+ is->is_maxsend = is->is_send;
+ is->is_dend = 0;
+ is->is_maxdwin = 1;
+ is->is_maxswin = ntohs(tcp->th_win);
+ if (is->is_maxswin == 0)
+ is->is_maxswin = 1;
/*
* If we're creating state for a starting connection, start the
* timer on it as we'll never see an error if it fails to
* connect.
*/
- if ((tcp->th_flags & (TH_SYN|TH_ACK)) == TH_SYN)
- is->is_ack = 0; /* Trumpet WinSock 'ism */
- fr_tcp_age(&is->is_age, is->is_state, ip, fin,
- tcp->th_sport == is->is_sport);
+ ATOMIC_INCL(ips_stats.iss_tcp);
break;
}
case IPPROTO_UDP :
{
- register tcphdr_t *tcp = (tcphdr_t *)fin->fin_dp;
+ tcp = (tcphdr_t *)fin->fin_dp;
- hv += (is->is_dport = tcp->th_dport);
- hv += (is->is_sport = tcp->th_sport);
- ips_stats.iss_udp++;
+ is->is_dport = tcp->th_dport;
+ is->is_sport = tcp->th_sport;
+ if ((flags & (FI_W_DPORT|FI_W_SPORT)) == 0) {
+ hv += tcp->th_dport;
+ hv += tcp->th_sport;
+ }
+ ATOMIC_INCL(ips_stats.iss_udp);
is->is_age = fr_udptimeout;
break;
}
default :
- return -1;
+ return NULL;
}
- KMALLOC(is, ipstate_t *, sizeof(*is));
+ KMALLOC(is, ipstate_t *);
if (is == NULL) {
- ips_stats.iss_nomem++;
- return -1;
+ ATOMIC_INCL(ips_stats.iss_nomem);
+ return NULL;
}
bcopy((char *)&ips, (char *)is, sizeof(*is));
- hv %= IPSTATE_SIZE;
- MUTEX_ENTER(&ipf_state);
+ hv %= fr_statesize;
+ is->is_hv = hv;
+ is->is_rule = fin->fin_fr;
+ if (is->is_rule != NULL) {
+ ATOMIC_INC32(is->is_rule->fr_ref);
+ pass = is->is_rule->fr_flags;
+ } else
+ pass = fr_flags;
+ WRITE_ENTER(&ipf_state);
is->is_pass = pass;
is->is_pkts = 1;
- is->is_bytes = ip->ip_len;
- /*
- * Copy these from the rule itself.
- */
- is->is_opt = fin->fin_fr->fr_ip.fi_optmsk;
- is->is_optmsk = fin->fin_fr->fr_mip.fi_optmsk;
- is->is_sec = fin->fin_fr->fr_ip.fi_secmsk;
- is->is_secmsk = fin->fin_fr->fr_mip.fi_secmsk;
- is->is_auth = fin->fin_fr->fr_ip.fi_auth;
- is->is_authmsk = fin->fin_fr->fr_mip.fi_auth;
- is->is_flags = fin->fin_fr->fr_ip.fi_fl;
- is->is_flags |= fin->fin_fr->fr_mip.fi_fl << 4;
+ is->is_bytes = fin->fin_dlen + fin->fin_hlen;
/*
- * add into table.
+ * We want to check everything that is a property of this packet,
+ * but we don't (automatically) care about it's fragment status as
+ * this may change.
*/
- is->is_next = ips_table[hv];
- ips_table[hv] = is;
- if (fin->fin_out) {
- is->is_ifpin = NULL;
- is->is_ifpout = fin->fin_ifp;
- } else {
- is->is_ifpin = fin->fin_ifp;
- is->is_ifpout = NULL;
- }
+ is->is_v = fin->fin_fi.fi_v;
+ is->is_opt = fin->fin_fi.fi_optmsk;
+ is->is_optmsk = 0xffffffff;
+ is->is_sec = fin->fin_fi.fi_secmsk;
+ is->is_secmsk = 0xffff;
+ is->is_auth = fin->fin_fi.fi_auth;
+ is->is_authmsk = 0xffff;
+ is->is_flags = fin->fin_fi.fi_fl & FI_CMP;
+ is->is_flags |= FI_CMP << 4;
+ is->is_flags |= flags & (FI_WILDP|FI_WILDA);
+ is->is_ifp[1 - out] = NULL;
+ is->is_ifp[out] = fin->fin_ifp;
+#ifdef _KERNEL
+ strncpy(is->is_ifname[out], IFNAME(fin->fin_ifp), IFNAMSIZ);
+#endif
+ is->is_ifname[1 - out][0] = '\0';
if (pass & FR_LOGFIRST)
is->is_pass &= ~(FR_LOGFIRST|FR_LOG);
+ fr_stinsert(is);
ips_num++;
+ if (is->is_p == IPPROTO_TCP) {
+ MUTEX_ENTER(&is->is_lock);
+ fr_tcp_age(&is->is_age, is->is_state, fin,
+ tcp->th_sport == is->is_sport);
+ MUTEX_EXIT(&is->is_lock);
+ }
#ifdef IPFILTER_LOG
ipstate_log(is, ISL_NEW);
#endif
- MUTEX_EXIT(&ipf_state);
+ RWLOCK_EXIT(&ipf_state);
+ fin->fin_rev = IP6NEQ(is->is_dst, fin->fin_fi.fi_dst);
if (fin->fin_fi.fi_fl & FI_FRAG)
ipfr_newfrag(ip, fin, pass ^ FR_KEEPSTATE);
- return 0;
+ return is;
}
+
/*
* check to see if a packet with TCP headers fits within the TCP window.
* change timeout depending on whether new packet is a SYN-ACK returning for a
@@ -357,263 +681,633 @@ fr_info_t *fin;
ip_t *ip;
tcphdr_t *tcp;
{
- register int seqskew, ackskew;
- register u_short swin, dwin;
- register tcp_seq seq, ack;
+ register tcp_seq seq, ack, end;
+ register int ackskew;
+ tcpdata_t *fdata, *tdata;
+ u_short win, maxwin;
+ int ret = 0;
int source;
/*
* Find difference between last checked packet and this packet.
*/
+ source = IP6EQ(fin->fin_fi.fi_src, is->is_src);
+ fdata = &is->is_tcp.ts_data[!source];
+ tdata = &is->is_tcp.ts_data[source];
seq = ntohl(tcp->th_seq);
ack = ntohl(tcp->th_ack);
- source = (ip->ip_src.s_addr == is->is_src.s_addr);
-
- if (!(tcp->th_flags & TH_ACK)) /* Pretend an ack was sent */
- ack = source ? is->is_ack : is->is_seq;
+ win = ntohs(tcp->th_win);
+ end = seq + fin->fin_dlen - (tcp->th_off << 2) +
+ ((tcp->th_flags & TH_SYN) ? 1 : 0) +
+ ((tcp->th_flags & TH_FIN) ? 1 : 0);
- if (source) {
- if (!is->is_seq)
- /*
- * Must be an outgoing SYN-ACK in reply to a SYN.
- */
- is->is_seq = seq;
- seqskew = seq - is->is_seq;
- ackskew = ack - is->is_ack;
- } else {
- if (!is->is_ack)
- /*
- * Must be a SYN-ACK in reply to a SYN.
- */
- is->is_ack = seq;
- ackskew = seq - is->is_ack;
- seqskew = ack - is->is_seq;
+ if (fdata->td_end == 0) {
+ /*
+ * Must be a (outgoing) SYN-ACK in reply to a SYN.
+ */
+ fdata->td_end = end;
+ fdata->td_maxwin = 1;
+ fdata->td_maxend = end + 1;
}
- /*
- * Make skew values absolute
- */
- if (seqskew < 0)
- seqskew = -seqskew;
- if (ackskew < 0)
- ackskew = -ackskew;
-
- /*
- * If the difference in sequence and ack numbers is within the
- * window size of the connection, store these values and match
- * the packet.
- */
- if (source) {
- swin = is->is_swin;
- dwin = is->is_dwin;
- } else {
- dwin = is->is_swin;
- swin = is->is_dwin;
+ if (!(tcp->th_flags & TH_ACK)) { /* Pretend an ack was sent */
+ ack = tdata->td_end;
+ } else if (((tcp->th_flags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) &&
+ (ack == 0)) {
+ /* gross hack to get around certain broken tcp stacks */
+ ack = tdata->td_end;
}
- if ((seqskew <= dwin) && (ackskew <= swin)) {
- if (source) {
- is->is_seq = seq;
- is->is_ack = ack;
- is->is_swin = ntohs(tcp->th_win);
- } else {
- is->is_seq = ack;
- is->is_ack = seq;
- is->is_dwin = ntohs(tcp->th_win);
+ if (seq == end)
+ seq = end = fdata->td_end;
+
+ maxwin = tdata->td_maxwin;
+ ackskew = tdata->td_end - ack;
+
+#define SEQ_GE(a,b) ((int)((a) - (b)) >= 0)
+#define SEQ_GT(a,b) ((int)((a) - (b)) > 0)
+ if ((SEQ_GE(fdata->td_maxend, end)) &&
+ (SEQ_GE(seq, fdata->td_end - maxwin)) &&
+/* XXX what about big packets */
+#define MAXACKWINDOW 66000
+ (ackskew >= -MAXACKWINDOW) &&
+ (ackskew <= MAXACKWINDOW)) {
+ /* if ackskew < 0 then this should be due to fragented
+ * packets. There is no way to know the length of the
+ * total packet in advance.
+ * We do know the total length from the fragment cache though.
+ * Note however that there might be more sessions with
+ * exactly the same source and destination paramters in the
+ * state cache (and source and destination is the only stuff
+ * that is saved in the fragment cache). Note further that
+ * some TCP connections in the state cache are hashed with
+ * sport and dport as well which makes it not worthwhile to
+ * look for them.
+ * Thus, when ackskew is negative but still seems to belong
+ * to this session, we bump up the destinations end value.
+ */
+ if (ackskew < 0)
+ tdata->td_end = ack;
+
+ /* update max window seen */
+ if (fdata->td_maxwin < win)
+ fdata->td_maxwin = win;
+ if (SEQ_GT(end, fdata->td_end))
+ fdata->td_end = end;
+ if (SEQ_GE(ack + win, tdata->td_maxend)) {
+ tdata->td_maxend = ack + win;
+ if (win == 0)
+ tdata->td_maxend++;
}
- ips_stats.iss_hits++;
+
+ ATOMIC_INCL(ips_stats.iss_hits);
is->is_pkts++;
- is->is_bytes += ip->ip_len;
+ is->is_bytes += fin->fin_dlen + fin->fin_hlen;
/*
* Nearing end of connection, start timeout.
*/
- fr_tcp_age(&is->is_age, is->is_state, ip, fin, source);
- return 1;
+ MUTEX_ENTER(&is->is_lock);
+ fr_tcp_age(&is->is_age, is->is_state, fin, source);
+ MUTEX_EXIT(&is->is_lock);
+ ret = 1;
}
- return 0;
+ return ret;
}
-static int fr_matchsrcdst(is, src, dst, fin, tcp, sp, dp)
+static int fr_matchsrcdst(is, src, dst, fin, tcp)
ipstate_t *is;
-struct in_addr src, dst;
+union i6addr src, dst;
fr_info_t *fin;
-void *tcp;
-u_short sp, dp;
+tcphdr_t *tcp;
{
- int ret = 0, rev, out;
+ int ret = 0, rev, out, flags;
+ u_short sp, dp;
void *ifp;
- rev = (is->is_dst.s_addr != dst.s_addr);
+ rev = fin->fin_rev = IP6NEQ(is->is_dst, dst);
ifp = fin->fin_ifp;
out = fin->fin_out;
- if (!rev) {
- if (out) {
- if (!is->is_ifpout)
- is->is_ifpout = ifp;
+ if (tcp != NULL) {
+ flags = is->is_flags;
+ sp = tcp->th_sport;
+ dp = tcp->th_dport;
+ } else {
+ flags = is->is_flags & FI_WILDA;
+ sp = 0;
+ dp = 0;
+ }
+
+ if (rev == 0) {
+ if (!out) {
+ if (is->is_ifpin == NULL || is->is_ifpin == ifp)
+ ret = 1;
} else {
- if (!is->is_ifpin)
- is->is_ifpin = ifp;
+ if (is->is_ifpout == NULL || is->is_ifpout == ifp)
+ ret = 1;
}
} else {
if (out) {
- if (!is->is_ifpin)
- is->is_ifpin = ifp;
+ if (is->is_ifpin == NULL || is->is_ifpin == ifp)
+ ret = 1;
} else {
- if (!is->is_ifpout)
- is->is_ifpout = ifp;
+ if (is->is_ifpout == NULL || is->is_ifpout == ifp)
+ ret = 1;
}
}
-
- if (!rev) {
- if (((out && is->is_ifpout == ifp) ||
- (!out && is->is_ifpin == ifp)) &&
- (is->is_dst.s_addr == dst.s_addr) &&
- (is->is_src.s_addr == src.s_addr) &&
- (!tcp || (sp == is->is_sport) &&
- (dp == is->is_dport))) {
+ if (ret == 0)
+ return 0;
+ ret = 0;
+
+ if (rev == 0) {
+ if (
+ (IP6EQ(is->is_dst, dst) || (flags & FI_W_DADDR)) &&
+ (IP6EQ(is->is_src, src) || (flags & FI_W_SADDR)) &&
+ (!tcp || ((sp == is->is_sport || flags & FI_W_SPORT) &&
+ (dp == is->is_dport || flags & FI_W_DPORT)))) {
ret = 1;
}
} else {
- if (((out && is->is_ifpin == ifp) ||
- (!out && is->is_ifpout == ifp)) &&
- (is->is_dst.s_addr == src.s_addr) &&
- (is->is_src.s_addr == dst.s_addr) &&
- (!tcp || (sp == is->is_dport) &&
- (dp == is->is_sport))) {
+ if (
+ (IP6EQ(is->is_dst, src) || (flags & FI_W_DADDR)) &&
+ (IP6EQ(is->is_src, dst) || (flags & FI_W_SADDR)) &&
+ (!tcp || ((sp == is->is_dport || flags & FI_W_DPORT) &&
+ (dp == is->is_sport || flags & FI_W_SPORT)))) {
ret = 1;
}
}
+ if (ret == 0)
+ return 0;
/*
* Whether or not this should be here, is questionable, but the aim
* is to get this out of the main line.
*/
- if (ret) {
- if (((fin->fin_fi.fi_optmsk & is->is_optmsk) != is->is_opt) ||
- ((fin->fin_fi.fi_secmsk & is->is_secmsk) != is->is_sec) ||
- ((fin->fin_fi.fi_auth & is->is_authmsk) != is->is_auth) ||
- ((fin->fin_fi.fi_fl & (is->is_flags >> 4)) !=
- (is->is_flags & 0xf)))
- ret = 0;
+ if (tcp == NULL)
+ flags = is->is_flags & (FI_CMP|(FI_CMP<<4));
+
+ if (((fin->fin_fi.fi_fl & (flags >> 4)) != (flags & FI_CMP)) ||
+ ((fin->fin_fi.fi_optmsk & is->is_optmsk) != is->is_opt) ||
+ ((fin->fin_fi.fi_secmsk & is->is_secmsk) != is->is_sec) ||
+ ((fin->fin_fi.fi_auth & is->is_authmsk) != is->is_auth))
+ return 0;
+
+ if ((flags & (FI_W_SPORT|FI_W_DPORT))) {
+ if ((flags & FI_W_SPORT) != 0) {
+ if (rev == 0) {
+ is->is_sport = sp;
+ is->is_send = htonl(tcp->th_seq);
+ } else {
+ is->is_sport = dp;
+ is->is_send = htonl(tcp->th_ack);
+ }
+ is->is_maxsend = is->is_send + 1;
+ } else if ((flags & FI_W_DPORT) != 0) {
+ if (rev == 0) {
+ is->is_dport = dp;
+ is->is_dend = htonl(tcp->th_ack);
+ } else {
+ is->is_dport = sp;
+ is->is_dend = htonl(tcp->th_seq);
+ }
+ is->is_maxdend = is->is_dend + 1;
+ }
+ is->is_flags &= ~(FI_W_SPORT|FI_W_DPORT);
}
- return ret;
+
+ ret = -1;
+
+ if (!rev) {
+ if (out) {
+ if (!is->is_ifpout)
+ ret = 1;
+ } else {
+ if (!is->is_ifpin)
+ ret = 0;
+ }
+ } else {
+ if (out) {
+ if (!is->is_ifpin)
+ ret = 0;
+ } else {
+ if (!is->is_ifpout)
+ ret = 1;
+ }
+ }
+
+ if (ret >= 0) {
+ is->is_ifp[ret] = ifp;
+#ifdef _KERNEL
+ strncpy(is->is_ifname[out], IFNAME(fin->fin_ifp),
+ sizeof(is->is_ifname[1]));
+#endif
+ }
+#ifdef _KERNEL
+ if (ret >= 0) {
+ strncpy(is->is_ifname[out], IFNAME(fin->fin_ifp),
+ sizeof(is->is_ifname[1]));
+ }
+#endif
+ return 1;
}
+static int fr_matchicmpqueryreply(v, is, icmp)
+int v;
+ipstate_t *is;
+icmphdr_t *icmp;
+{
+ if (v == 4) {
+ /*
+ * If we matched its type on the way in, then when going out
+ * it will still be the same type.
+ */
+ if (((icmp->icmp_type == is->is_type) ||
+ (icmpreplytype4[is->is_type] == icmp->icmp_type)) &&
+ (icmp->icmp_id == is->is_icmp.ics_id) &&
+ (icmp->icmp_seq == is->is_icmp.ics_seq)) {
+ return 1;
+ };
+ }
+#ifdef USE_INET6
+ else if (is->is_v == 6) {
+ if ((is->is_type == ICMP6_ECHO_REPLY) &&
+ (icmp->icmp_type == ICMP6_ECHO_REQUEST) &&
+ (icmp->icmp_id == is->is_icmp.ics_id) &&
+ (icmp->icmp_seq == is->is_icmp.ics_seq)) {
+ return 1;
+ };
+ }
+#endif
+ return 0;
+}
+
+static frentry_t *fr_checkicmpmatchingstate(ip, fin)
+ip_t *ip;
+fr_info_t *fin;
+{
+ register ipstate_t *is, **isp;
+ register u_short sport, dport;
+ register u_char pr;
+ union i6addr dst, src;
+ struct icmp *ic;
+ u_short savelen;
+ fr_info_t ofin;
+ tcphdr_t *tcp;
+ icmphdr_t *icmp;
+ frentry_t *fr;
+ ip_t *oip;
+ int type;
+ u_int hv;
+
+ /*
+ * Does it at least have the return (basic) IP header ?
+ * Only a basic IP header (no options) should be with
+ * an ICMP error header.
+ */
+ if (((ip->ip_v != 4) && (ip->ip_hl != 5)) ||
+ (fin->fin_plen < ICMPERR_MINPKTLEN))
+ return NULL;
+ ic = (struct icmp *)fin->fin_dp;
+ type = ic->icmp_type;
+ /*
+ * If it's not an error type, then return
+ */
+ if ((type != ICMP_UNREACH) && (type != ICMP_SOURCEQUENCH) &&
+ (type != ICMP_REDIRECT) && (type != ICMP_TIMXCEED) &&
+ (type != ICMP_PARAMPROB))
+ return NULL;
+
+ oip = (ip_t *)((char *)ic + ICMPERR_ICMPHLEN);
+ if (fin->fin_plen < ICMPERR_MAXPKTLEN + ((oip->ip_hl - 5) << 2))
+ return NULL;
+
+ if (oip->ip_p == IPPROTO_ICMP) {
+ icmp = (icmphdr_t *)((char *)oip + (oip->ip_hl << 2));
+
+ /*
+ * a ICMP error can only be generated as a result of an
+ * ICMP query, not as the response on an ICMP error
+ *
+ * XXX theoretically ICMP_ECHOREP and the other reply's are
+ * ICMP query's as well, but adding them here seems strange XXX
+ */
+ if ((icmp->icmp_type != ICMP_ECHO) &&
+ (icmp->icmp_type != ICMP_TSTAMP) &&
+ (icmp->icmp_type != ICMP_IREQ) &&
+ (icmp->icmp_type != ICMP_MASKREQ))
+ return NULL;
+
+ /*
+ * perform a lookup of the ICMP packet in the state table
+ */
+ hv = (pr = oip->ip_p);
+ src.in4 = oip->ip_src;
+ hv += src.in4.s_addr;
+ dst.in4 = oip->ip_dst;
+ hv += dst.in4.s_addr;
+ hv += icmp->icmp_id;
+ hv += icmp->icmp_seq;
+ hv %= fr_statesize;
+
+ oip->ip_len = ntohs(oip->ip_len);
+ fr_makefrip(oip->ip_hl << 2, oip, &ofin);
+ oip->ip_len = htons(oip->ip_len);
+ ofin.fin_ifp = fin->fin_ifp;
+ ofin.fin_out = !fin->fin_out;
+ ofin.fin_mp = NULL; /* if dereferenced, panic XXX */
+
+ READ_ENTER(&ipf_state);
+ for (isp = &ips_table[hv]; (is = *isp); isp = &is->is_hnext)
+ if ((is->is_p == pr) && (is->is_v == 4) &&
+ fr_matchsrcdst(is, src, dst, &ofin, NULL) &&
+ fr_matchicmpqueryreply(is->is_v, is, icmp)) {
+ ips_stats.iss_hits++;
+ is->is_pkts++;
+ is->is_bytes += ip->ip_len;
+ fr = is->is_rule;
+ RWLOCK_EXIT(&ipf_state);
+ return fr;
+ }
+ RWLOCK_EXIT(&ipf_state);
+ return NULL;
+ };
+
+ if ((oip->ip_p != IPPROTO_TCP) && (oip->ip_p != IPPROTO_UDP))
+ return NULL;
+
+ tcp = (tcphdr_t *)((char *)oip + (oip->ip_hl << 2));
+ dport = tcp->th_dport;
+ sport = tcp->th_sport;
+
+ hv = (pr = oip->ip_p);
+ src.in4 = oip->ip_src;
+ hv += src.in4.s_addr;
+ dst.in4 = oip->ip_dst;
+ hv += dst.in4.s_addr;
+ hv += dport;
+ hv += sport;
+ hv %= fr_statesize;
+ /*
+ * we make an fin entry to be able to feed it to
+ * matchsrcdst note that not all fields are encessary
+ * but this is the cleanest way. Note further we fill
+ * in fin_mp such that if someone uses it we'll get
+ * a kernel panic. fr_matchsrcdst does not use this.
+ *
+ * watch out here, as ip is in host order and oip in network
+ * order. Any change we make must be undone afterwards.
+ */
+ savelen = oip->ip_len;
+ oip->ip_len = ip->ip_len - (ip->ip_hl << 2) - ICMPERR_ICMPHLEN;
+ fr_makefrip(oip->ip_hl << 2, oip, &ofin);
+ oip->ip_len = savelen;
+ ofin.fin_ifp = fin->fin_ifp;
+ ofin.fin_out = !fin->fin_out;
+ ofin.fin_mp = NULL; /* if dereferenced, panic XXX */
+ READ_ENTER(&ipf_state);
+ for (isp = &ips_table[hv]; (is = *isp); isp = &is->is_hnext) {
+ /*
+ * Only allow this icmp though if the
+ * encapsulated packet was allowed through the
+ * other way around. Note that the minimal amount
+ * of info present does not allow for checking against
+ * tcp internals such as seq and ack numbers.
+ */
+ if ((is->is_p == pr) && (is->is_v == 4) &&
+ fr_matchsrcdst(is, src, dst, &ofin, tcp)) {
+ fr = is->is_rule;
+ ips_stats.iss_hits++;
+ /*
+ * we must swap src and dst here because the icmp
+ * comes the other way around
+ */
+ is->is_pkts++;
+ is->is_bytes += fin->fin_plen;
+ /*
+ * we deliberately do not touch the timeouts
+ * for the accompanying state table entry.
+ * It remains to be seen if that is correct. XXX
+ */
+ RWLOCK_EXIT(&ipf_state);
+ return fr;
+ }
+ }
+ RWLOCK_EXIT(&ipf_state);
+ return NULL;
+}
/*
* Check if a packet has a registered state.
*/
-int fr_checkstate(ip, fin)
+frentry_t *fr_checkstate(ip, fin)
ip_t *ip;
fr_info_t *fin;
{
- register struct in_addr dst, src;
+ union i6addr dst, src;
register ipstate_t *is, **isp;
register u_char pr;
+ u_int hv, hvm, hlen, tryagain, pass, v;
struct icmp *ic;
+ frentry_t *fr;
tcphdr_t *tcp;
- u_int hv, hlen, pass;
- if ((ip->ip_off & 0x1fff) || (fin->fin_fi.fi_fl & FI_SHORT))
- return 0;
+ if (fr_state_lock || (fin->fin_off & IP_OFFMASK) ||
+ (fin->fin_fi.fi_fl & FI_SHORT))
+ return NULL;
+ is = NULL;
hlen = fin->fin_hlen;
tcp = (tcphdr_t *)((char *)ip + hlen);
ic = (struct icmp *)tcp;
- hv = (pr = ip->ip_p);
- hv += (src.s_addr = ip->ip_src.s_addr);
- hv += (dst.s_addr = ip->ip_dst.s_addr);
+ hv = (pr = fin->fin_fi.fi_p);
+ src = fin->fin_fi.fi_src;
+ dst = fin->fin_fi.fi_dst;
+ hv += src.in4.s_addr;
+ hv += dst.in4.s_addr;
/*
* Search the hash table for matching packet header info.
*/
- switch (ip->ip_p)
+ v = fin->fin_fi.fi_v;
+ switch (fin->fin_fi.fi_p)
{
+#ifdef USE_INET6
+ case IPPROTO_ICMPV6 :
+ if (v == 6) {
+ if (fin->fin_out)
+ hv -= dst.in4.s_addr;
+ else
+ hv -= src.in4.s_addr;
+ if ((ic->icmp_type == ICMP6_ECHO_REQUEST) ||
+ (ic->icmp_type == ICMP6_ECHO_REPLY)) {
+ hv += ic->icmp_id;
+ hv += ic->icmp_seq;
+ }
+ }
+#endif
case IPPROTO_ICMP :
- hv += ic->icmp_id;
- hv += ic->icmp_seq;
- hv %= IPSTATE_SIZE;
- MUTEX_ENTER(&ipf_state);
- for (isp = &ips_table[hv]; (is = *isp); isp = &is->is_next)
- if ((is->is_p == pr) &&
- (ic->icmp_id == is->is_icmp.ics_id) &&
- (ic->icmp_seq == is->is_icmp.ics_seq) &&
- fr_matchsrcdst(is, src, dst, fin, NULL, 0, 0)) {
- if (is->is_icmp.ics_type != ic->icmp_type)
- continue;
+ if (v == 4) {
+ hv += ic->icmp_id;
+ hv += ic->icmp_seq;
+ }
+ hv %= fr_statesize;
+ READ_ENTER(&ipf_state);
+ for (isp = &ips_table[hv]; (is = *isp); isp = &is->is_hnext) {
+ if ((is->is_p == pr) && (is->is_v == v) &&
+ fr_matchsrcdst(is, src, dst, fin, NULL) &&
+ fr_matchicmpqueryreply(v, is, ic)) {
is->is_age = fr_icmptimeout;
- is->is_pkts++;
- is->is_bytes += ip->ip_len;
- ips_stats.iss_hits++;
- pass = is->is_pass;
- MUTEX_EXIT(&ipf_state);
- return pass;
+ break;
}
- MUTEX_EXIT(&ipf_state);
+ }
+ if (is != NULL)
+ break;
+ RWLOCK_EXIT(&ipf_state);
+ /*
+ * No matching icmp state entry. Perhaps this is a
+ * response to another state entry.
+ */
+#ifdef USE_INET6
+ if (v == 6)
+ fr = fr_checkicmp6matchingstate((ip6_t *)ip, fin);
+ else
+#endif
+ fr = fr_checkicmpmatchingstate(ip, fin);
+ if (fr)
+ return fr;
break;
case IPPROTO_TCP :
{
register u_short dport = tcp->th_dport, sport = tcp->th_sport;
- hv += dport;
- hv += sport;
- hv %= IPSTATE_SIZE;
- MUTEX_ENTER(&ipf_state);
- for (isp = &ips_table[hv]; (is = *isp); isp = &is->is_next)
- if ((is->is_p == pr) &&
- fr_matchsrcdst(is, src, dst, fin, tcp,
- sport, dport)) {
- if (fr_tcpstate(is, fin, ip, tcp)) {
- pass = is->is_pass;
-#ifdef _KERNEL
- MUTEX_EXIT(&ipf_state);
-#else
+ tryagain = 0;
+retry_tcp:
+ hvm = hv % fr_statesize;
+ WRITE_ENTER(&ipf_state);
+ for (isp = &ips_table[hvm]; (is = *isp);
+ isp = &is->is_hnext)
- if (tcp->th_flags & TCP_CLOSE) {
- *isp = is->is_next;
- isp = &ips_table[hv];
- KFREE(is);
- }
-#endif
- return pass;
- }
+
+ if ((is->is_p == pr) && (is->is_v == v) &&
+ fr_matchsrcdst(is, src, dst, fin, tcp)) {
+ if (fr_tcpstate(is, fin, ip, tcp))
+ break;
+ is = NULL;
+ break;
}
- MUTEX_EXIT(&ipf_state);
+ if (is != NULL)
+ break;
+ RWLOCK_EXIT(&ipf_state);
+ hv += dport;
+ hv += sport;
+ if (tryagain == 0) {
+ tryagain = 1;
+ goto retry_tcp;
+ }
break;
}
case IPPROTO_UDP :
{
register u_short dport = tcp->th_dport, sport = tcp->th_sport;
- hv += dport;
- hv += sport;
- hv %= IPSTATE_SIZE;
+ tryagain = 0;
+retry_udp:
+ hvm = hv % fr_statesize;
/*
* Nothing else to match on but ports. and IP#'s
*/
- MUTEX_ENTER(&ipf_state);
- for (is = ips_table[hv]; is; is = is->is_next)
- if ((is->is_p == pr) &&
- fr_matchsrcdst(is, src, dst, fin,
- tcp, sport, dport)) {
- ips_stats.iss_hits++;
- is->is_pkts++;
- is->is_bytes += ip->ip_len;
+ READ_ENTER(&ipf_state);
+ for (is = ips_table[hvm]; is; is = is->is_hnext)
+ if ((is->is_p == pr) && (is->is_v == v) &&
+ fr_matchsrcdst(is, src, dst, fin, tcp)) {
is->is_age = fr_udptimeout;
- pass = is->is_pass;
- MUTEX_EXIT(&ipf_state);
- return pass;
+ break;
}
- MUTEX_EXIT(&ipf_state);
+ if (is != NULL)
+ break;
+ RWLOCK_EXIT(&ipf_state);
+ hv += dport;
+ hv += sport;
+ if (tryagain == 0) {
+ tryagain = 1;
+ goto retry_udp;
+ }
break;
}
default :
break;
}
- ips_stats.iss_miss++;
- return 0;
+ if (is == NULL) {
+ ATOMIC_INCL(ips_stats.iss_miss);
+ return NULL;
+ }
+ MUTEX_ENTER(&is->is_lock);
+ is->is_bytes += fin->fin_plen;
+ ips_stats.iss_hits++;
+ is->is_pkts++;
+ MUTEX_EXIT(&is->is_lock);
+ fr = is->is_rule;
+ fin->fin_fr = fr;
+ pass = is->is_pass;
+#ifndef _KERNEL
+ if (tcp->th_flags & TCP_CLOSE)
+ fr_delstate(is);
+#endif
+ RWLOCK_EXIT(&ipf_state);
+ if (fin->fin_fi.fi_fl & FI_FRAG)
+ ipfr_newfrag(ip, fin, pass ^ FR_KEEPSTATE);
+ return fr;
+}
+
+
+void ip_statesync(ifp)
+void *ifp;
+{
+ register ipstate_t *is;
+
+ WRITE_ENTER(&ipf_state);
+ for (is = ips_list; is; is = is->is_next) {
+ if (is->is_ifpin == ifp) {
+ is->is_ifpin = GETUNIT(is->is_ifname[0], is->is_v);
+ if (!is->is_ifpin)
+ is->is_ifpin = (void *)-1;
+ }
+ if (is->is_ifpout == ifp) {
+ is->is_ifpout = GETUNIT(is->is_ifname[1], is->is_v);
+ if (!is->is_ifpout)
+ is->is_ifpout = (void *)-1;
+ }
+ }
+ RWLOCK_EXIT(&ipf_state);
+}
+
+
+static void fr_delstate(is)
+ipstate_t *is;
+{
+ frentry_t *fr;
+
+ if (is->is_next)
+ is->is_next->is_pnext = is->is_pnext;
+ *is->is_pnext = is->is_next;
+ if (is->is_hnext)
+ is->is_hnext->is_phnext = is->is_phnext;
+ *is->is_phnext = is->is_hnext;
+ if (ips_table[is->is_hv] == NULL)
+ ips_stats.iss_inuse--;
+
+ fr = is->is_rule;
+ if (fr != NULL) {
+ ATOMIC_DEC32(fr->fr_ref);
+ if (fr->fr_ref == 0)
+ KFREE(fr);
+ }
+#ifdef _KERNEL
+ MUTEX_DESTROY(&is->is_lock);
+#endif
+ KFREE(is);
+ ips_num--;
}
@@ -622,16 +1316,16 @@ fr_info_t *fin;
*/
void fr_stateunload()
{
- register int i;
- register ipstate_t *is, **isp;
-
- MUTEX_ENTER(&ipf_state);
- for (i = 0; i < IPSTATE_SIZE; i++)
- for (isp = &ips_table[i]; (is = *isp); ) {
- *isp = is->is_next;
- KFREE(is);
- }
- MUTEX_EXIT(&ipf_state);
+ register ipstate_t *is;
+
+ WRITE_ENTER(&ipf_state);
+ while ((is = ips_list))
+ fr_delstate(is);
+ ips_stats.iss_inuse = 0;
+ ips_num = 0;
+ RWLOCK_EXIT(&ipf_state);
+ KFREES(ips_table, fr_statesize * sizeof(ipstate_t *));
+ ips_table = NULL;
}
@@ -641,31 +1335,31 @@ void fr_stateunload()
*/
void fr_timeoutstate()
{
- register int i;
register ipstate_t *is, **isp;
#if defined(_KERNEL) && !SOLARIS
int s;
#endif
SPL_NET(s);
- MUTEX_ENTER(&ipf_state);
- for (i = 0; i < IPSTATE_SIZE; i++)
- for (isp = &ips_table[i]; (is = *isp); )
- if (is->is_age && !--is->is_age) {
- *isp = is->is_next;
- if (is->is_p == IPPROTO_TCP)
- ips_stats.iss_fin++;
- else
- ips_stats.iss_expire++;
+ WRITE_ENTER(&ipf_state);
+ for (isp = &ips_list; (is = *isp); )
+ if (is->is_age && !--is->is_age) {
+ if (is->is_p == IPPROTO_TCP)
+ ips_stats.iss_fin++;
+ else
+ ips_stats.iss_expire++;
#ifdef IPFILTER_LOG
- ipstate_log(is, ISL_EXPIRE);
+ ipstate_log(is, ISL_EXPIRE);
#endif
- KFREE(is);
- ips_num--;
- } else
- isp = &is->is_next;
- MUTEX_EXIT(&ipf_state);
+ fr_delstate(is);
+ } else
+ isp = &is->is_next;
+ RWLOCK_EXIT(&ipf_state);
SPL_X(s);
+ if (fr_state_doflush) {
+ (void) fr_state_flush(1);
+ fr_state_doflush = 0;
+ }
}
@@ -673,10 +1367,9 @@ void fr_timeoutstate()
* Original idea freom Pradeep Krishnan for use primarily with NAT code.
* (pkrishna@netcom.com)
*/
-void fr_tcp_age(age, state, ip, fin, dir)
+void fr_tcp_age(age, state, fin, dir)
u_long *age;
u_char *state;
-ip_t *ip;
fr_info_t *fin;
int dir;
{
@@ -686,7 +1379,7 @@ int dir;
ostate = state[1 - dir];
- dlen = ip->ip_len - fin->fin_hlen - (tcp->th_off << 2);
+ dlen = fin->fin_plen - fin->fin_hlen - (tcp->th_off << 2);
if (flags & TH_RST) {
if (!(tcp->th_flags & TH_PUSH) && !dlen) {
@@ -703,23 +1396,29 @@ int dir;
switch(state[dir])
{
- case TCPS_FIN_WAIT_2:
case TCPS_CLOSED:
+ if ((flags & (TH_FIN|TH_SYN|TH_RST|TH_ACK)) == TH_ACK) {
+ state[dir] = TCPS_ESTABLISHED;
+ *age = fr_tcpidletimeout;
+ }
+ case TCPS_FIN_WAIT_2:
if ((flags & TH_OPENING) == TH_OPENING)
state[dir] = TCPS_SYN_RECEIVED;
else if (flags & TH_SYN)
state[dir] = TCPS_SYN_SENT;
break;
case TCPS_SYN_RECEIVED:
- if ((flags & (TH_FIN|TH_ACK)) == TH_ACK) {
- state[dir] = TCPS_ESTABLISHED;
- *age = fr_tcpidletimeout;
- }
- break;
case TCPS_SYN_SENT:
if ((flags & (TH_FIN|TH_ACK)) == TH_ACK) {
state[dir] = TCPS_ESTABLISHED;
*age = fr_tcpidletimeout;
+ } else if ((flags & (TH_FIN|TH_ACK)) == (TH_FIN|TH_ACK)) {
+ state[dir] = TCPS_CLOSE_WAIT;
+ if (!(flags & TH_PUSH) && !dlen &&
+ ostate > TCPS_ESTABLISHED)
+ *age = fr_tcplastack;
+ else
+ *age = fr_tcpclosewait;
}
break;
case TCPS_ESTABLISHED:
@@ -730,8 +1429,10 @@ int dir;
*age = fr_tcplastack;
else
*age = fr_tcpclosewait;
- } else
- *age = fr_tcpidletimeout;
+ } else {
+ if (ostate < TCPS_CLOSE_WAIT)
+ *age = fr_tcpidletimeout;
+ }
break;
case TCPS_CLOSE_WAIT:
if ((flags & TH_FIN) && !(flags & TH_PUSH) && !dlen &&
@@ -760,23 +1461,28 @@ int dir;
#ifdef IPFILTER_LOG
void ipstate_log(is, type)
struct ipstate *is;
-u_short type;
+u_int type;
{
struct ipslog ipsl;
void *items[1];
size_t sizes[1];
int types[1];
+ ipsl.isl_type = type;
ipsl.isl_pkts = is->is_pkts;
ipsl.isl_bytes = is->is_bytes;
ipsl.isl_src = is->is_src;
ipsl.isl_dst = is->is_dst;
ipsl.isl_p = is->is_p;
+ ipsl.isl_v = is->is_v;
ipsl.isl_flags = is->is_flags;
- ipsl.isl_type = type;
if (ipsl.isl_p == IPPROTO_TCP || ipsl.isl_p == IPPROTO_UDP) {
ipsl.isl_sport = is->is_sport;
ipsl.isl_dport = is->is_dport;
+ if (ipsl.isl_p == IPPROTO_TCP) {
+ ipsl.isl_state[0] = is->is_state[0];
+ ipsl.isl_state[1] = is->is_state[1];
+ }
} else if (ipsl.isl_p == IPPROTO_ICMP)
ipsl.isl_itype = is->is_icmp.ics_type;
else {
@@ -787,6 +1493,166 @@ u_short type;
sizes[0] = sizeof(ipsl);
types[0] = 0;
- (void) ipllog(IPL_LOGSTATE, 0, items, sizes, types, 1);
+ (void) ipllog(IPL_LOGSTATE, NULL, items, sizes, types, 1);
+}
+#endif
+
+
+#ifdef USE_INET6
+frentry_t *fr_checkicmp6matchingstate(ip, fin)
+ip6_t *ip;
+fr_info_t *fin;
+{
+ register ipstate_t *is, **isp;
+ register u_short sport, dport;
+ register u_char pr;
+ struct icmp6_hdr *ic, *oic;
+ union i6addr dst, src;
+ u_short savelen;
+ fr_info_t ofin;
+ tcphdr_t *tcp;
+ frentry_t *fr;
+ ip6_t *oip;
+ int type;
+ u_int hv;
+
+ /*
+ * Does it at least have the return (basic) IP header ?
+ * Only a basic IP header (no options) should be with
+ * an ICMP error header.
+ */
+ if ((fin->fin_v != 6) || (fin->fin_plen < ICMP6ERR_MINPKTLEN))
+ return NULL;
+ ic = (struct icmp6_hdr *)fin->fin_dp;
+ type = ic->icmp6_type;
+ /*
+ * If it's not an error type, then return
+ */
+ if ((type != ICMP6_DST_UNREACH) && (type != ICMP6_PACKET_TOO_BIG) &&
+ (type != ICMP6_TIME_EXCEEDED) && (type != ICMP6_PARAM_PROB))
+ return NULL;
+
+ oip = (ip6_t *)((char *)ic + ICMPERR_ICMPHLEN);
+ if (fin->fin_plen < sizeof(*oip))
+ return NULL;
+
+ if (oip->ip6_nxt == IPPROTO_ICMPV6) {
+ oic = (struct icmp6_hdr *)(oip + 1);
+ /*
+ * a ICMP error can only be generated as a result of an
+ * ICMP query, not as the response on an ICMP error
+ *
+ * XXX theoretically ICMP_ECHOREP and the other reply's are
+ * ICMP query's as well, but adding them here seems strange XXX
+ */
+ if (!(oic->icmp6_type & ICMP6_INFOMSG_MASK))
+ return NULL;
+
+ /*
+ * perform a lookup of the ICMP packet in the state table
+ */
+ hv = (pr = oip->ip6_nxt);
+ src.in6 = oip->ip6_src;
+ hv += src.in4.s_addr;
+ dst.in6 = oip->ip6_dst;
+ hv += dst.in4.s_addr;
+ hv += oic->icmp6_id;
+ hv += oic->icmp6_seq;
+ hv %= fr_statesize;
+
+ oip->ip6_plen = ntohs(oip->ip6_plen);
+ fr_makefrip(sizeof(*oip), (ip_t *)oip, &ofin);
+ oip->ip6_plen = htons(oip->ip6_plen);
+ ofin.fin_ifp = fin->fin_ifp;
+ ofin.fin_out = !fin->fin_out;
+ ofin.fin_mp = NULL; /* if dereferenced, panic XXX */
+
+ READ_ENTER(&ipf_state);
+ for (isp = &ips_table[hv]; (is = *isp); isp = &is->is_hnext)
+ if ((is->is_p == pr) &&
+ (oic->icmp6_id == is->is_icmp.ics_id) &&
+ (oic->icmp6_seq == is->is_icmp.ics_seq) &&
+ fr_matchsrcdst(is, src, dst, &ofin, NULL)) {
+ /*
+ * in the state table ICMP query's are stored
+ * with the type of the corresponding ICMP
+ * response. Correct here
+ */
+ if (((is->is_type == ICMP6_ECHO_REPLY) &&
+ (oic->icmp6_type == ICMP6_ECHO_REQUEST)) ||
+ (is->is_type - 1 == oic->icmp6_type )) {
+ ips_stats.iss_hits++;
+ is->is_pkts++;
+ is->is_bytes += fin->fin_plen;
+ return is->is_rule;
+ }
+ }
+ RWLOCK_EXIT(&ipf_state);
+
+ return NULL;
+ };
+
+ if ((oip->ip6_nxt != IPPROTO_TCP) && (oip->ip6_nxt != IPPROTO_UDP))
+ return NULL;
+ tcp = (tcphdr_t *)(oip + 1);
+ dport = tcp->th_dport;
+ sport = tcp->th_sport;
+
+ hv = (pr = oip->ip6_nxt);
+ src.in6 = oip->ip6_src;
+ hv += src.in4.s_addr;
+ dst.in6 = oip->ip6_dst;
+ hv += dst.in4.s_addr;
+ hv += dport;
+ hv += sport;
+ hv %= fr_statesize;
+ /*
+ * we make an fin entry to be able to feed it to
+ * matchsrcdst note that not all fields are encessary
+ * but this is the cleanest way. Note further we fill
+ * in fin_mp such that if someone uses it we'll get
+ * a kernel panic. fr_matchsrcdst does not use this.
+ *
+ * watch out here, as ip is in host order and oip in network
+ * order. Any change we make must be undone afterwards.
+ */
+ savelen = oip->ip6_plen;
+ oip->ip6_plen = ip->ip6_plen - sizeof(*ip) - ICMPERR_ICMPHLEN;
+ ofin.fin_v = 6;
+ fr_makefrip(sizeof(*oip), (ip_t *)oip, &ofin);
+ oip->ip6_plen = savelen;
+ ofin.fin_ifp = fin->fin_ifp;
+ ofin.fin_out = !fin->fin_out;
+ ofin.fin_mp = NULL; /* if dereferenced, panic XXX */
+ READ_ENTER(&ipf_state);
+ for (isp = &ips_table[hv]; (is = *isp); isp = &is->is_hnext) {
+ /*
+ * Only allow this icmp though if the
+ * encapsulated packet was allowed through the
+ * other way around. Note that the minimal amount
+ * of info present does not allow for checking against
+ * tcp internals such as seq and ack numbers.
+ */
+ if ((is->is_p == pr) && (is->is_v == 6) &&
+ fr_matchsrcdst(is, src, dst, &ofin, tcp)) {
+ fr = is->is_rule;
+ ips_stats.iss_hits++;
+ /*
+ * we must swap src and dst here because the icmp
+ * comes the other way around
+ */
+ is->is_pkts++;
+ is->is_bytes += fin->fin_plen;
+ /*
+ * we deliberately do not touch the timeouts
+ * for the accompanying state table entry.
+ * It remains to be seen if that is correct. XXX
+ */
+ RWLOCK_EXIT(&ipf_state);
+ return fr;
+ }
+ }
+ RWLOCK_EXIT(&ipf_state);
+ return NULL;
}
#endif
diff --git a/sys/netinet/ip_state.h b/sys/netinet/ip_state.h
index f2ae94bb7020..01c26a07ca8a 100644
--- a/sys/netinet/ip_state.h
+++ b/sys/netinet/ip_state.h
@@ -1,16 +1,22 @@
/*
- * Copyright (C) 1995-1997 by Darren Reed.
+ * Copyright (C) 1995-2000 by Darren Reed.
*
* Redistribution and use in source and binary forms are permitted
* provided that this notice is preserved and due credit is given
* to the original author and the contributors.
*
* @(#)ip_state.h 1.3 1/12/96 (C) 1995 Darren Reed
- * $Id: ip_state.h,v 2.0.2.14.2.6 1998/05/24 05:18:04 darrenr Exp $
+ * $Id: ip_state.h,v 2.13 2000/03/13 22:10:23 darrenr Exp $
*/
#ifndef __IP_STATE_H__
#define __IP_STATE_H__
+#if defined(__STDC__) || defined(__GNUC__)
+# define SIOCDELST _IOW('r', 61, struct ipstate *)
+#else
+# define SIOCDELST _IOW(r, 61, struct ipstate *)
+#endif
+
#define IPSTATE_SIZE 257
#define IPSTATE_MAX 2048 /* Maximum number of states held */
@@ -31,68 +37,106 @@ typedef struct icmpstate {
u_char ics_type;
} icmpstate_t;
+typedef struct tcpdata {
+ u_32_t td_end;
+ u_32_t td_maxend;
+ u_short td_maxwin;
+} tcpdata_t;
+
typedef struct tcpstate {
u_short ts_sport;
u_short ts_dport;
- u_long ts_seq;
- u_long ts_ack;
- u_short ts_swin;
- u_short ts_dwin;
+ tcpdata_t ts_data[2];
u_char ts_state[2];
} tcpstate_t;
typedef struct ipstate {
struct ipstate *is_next;
+ struct ipstate **is_pnext;
+ struct ipstate *is_hnext;
+ struct ipstate **is_phnext;
u_long is_age;
u_int is_pass;
U_QUAD_T is_pkts;
U_QUAD_T is_bytes;
- void *is_ifpin;
- void *is_ifpout;
- struct in_addr is_src;
- struct in_addr is_dst;
- u_char is_p;
- u_char is_flags;
- u_32_t is_opt;
- u_32_t is_optmsk;
- u_short is_sec;
- u_short is_secmsk;
- u_short is_auth;
- u_short is_authmsk;
+ void *is_ifp[2];
+ frentry_t *is_rule;
+ union i6addr is_src;
+ union i6addr is_dst;
+ u_char is_p; /* Protocol */
+ u_char is_v;
+ u_int is_hv;
+ u_32_t is_flags;
+ u_32_t is_opt; /* packet options set */
+ u_32_t is_optmsk; /* " " mask */
+ u_short is_sec; /* security options set */
+ u_short is_secmsk; /* " " mask */
+ u_short is_auth; /* authentication options set */
+ u_short is_authmsk; /* " " mask */
union {
icmpstate_t is_ics;
tcpstate_t is_ts;
udpstate_t is_us;
} is_ps;
+ char is_ifname[2][IFNAMSIZ];
+#if SOLARIS || defined(__sgi)
+ kmutex_t is_lock;
+#endif
} ipstate_t;
-#define is_icmp is_ps.is_ics
-#define is_tcp is_ps.is_ts
-#define is_udp is_ps.is_us
-#define is_seq is_tcp.ts_seq
-#define is_ack is_tcp.ts_ack
-#define is_dwin is_tcp.ts_dwin
-#define is_swin is_tcp.ts_swin
+#define is_saddr is_src.in4.s_addr
+#define is_daddr is_dst.in4.s_addr
+#define is_icmp is_ps.is_ics
+#define is_type is_icmp.ics_type
+#define is_code is_icmp.ics_code
+#define is_tcp is_ps.is_ts
+#define is_udp is_ps.is_us
+#define is_send is_tcp.ts_data[0].td_end
+#define is_dend is_tcp.ts_data[1].td_end
+#define is_maxswin is_tcp.ts_data[0].td_maxwin
+#define is_maxdwin is_tcp.ts_data[1].td_maxwin
+#define is_maxsend is_tcp.ts_data[0].td_maxend
+#define is_maxdend is_tcp.ts_data[1].td_maxend
#define is_sport is_tcp.ts_sport
#define is_dport is_tcp.ts_dport
#define is_state is_tcp.ts_state
+#define is_ifpin is_ifp[0]
+#define is_ifpout is_ifp[1]
#define TH_OPENING (TH_SYN|TH_ACK)
+/*
+ * is_flags:
+ * Bits 0 - 3 are use as a mask with the current packet's bits to check for
+ * whether it is short, tcp/udp, a fragment or the presence of IP options.
+ * Bits 4 - 7 are set from the initial packet and contain what the packet
+ * anded with bits 0-3 must match.
+ * Bits 8,9 are used to indicate wildcard source/destination port matching.
+ */
+
+typedef struct ipstate_save {
+ void *ips_next;
+ struct ipstate ips_is;
+ struct frentry ips_fr;
+} ipstate_save_t;
+
+#define ips_rule ips_is.is_rule
typedef struct ipslog {
U_QUAD_T isl_pkts;
U_QUAD_T isl_bytes;
- struct in_addr isl_src;
- struct in_addr isl_dst;
- u_char isl_p;
- u_char isl_flags;
+ union i6addr isl_src;
+ union i6addr isl_dst;
u_short isl_type;
union {
u_short isl_filler[2];
u_short isl_ports[2];
u_short isl_icmp;
} isl_ps;
+ u_char isl_v;
+ u_char isl_p;
+ u_char isl_flags;
+ u_char isl_state[2];
} ipslog_t;
#define isl_sport isl_ps.isl_ports[0]
@@ -102,6 +146,7 @@ typedef struct ipslog {
#define ISL_NEW 0
#define ISL_EXPIRE 0xffff
#define ISL_FLUSH 0xfffe
+#define ISL_REMOVE 0xfffd
typedef struct ips_stat {
@@ -117,7 +162,9 @@ typedef struct ips_stat {
u_long iss_active;
u_long iss_logged;
u_long iss_logfail;
+ u_long iss_inuse;
ipstate_t **iss_table;
+ ipstate_t *iss_list;
} ips_stat_t;
@@ -128,13 +175,16 @@ extern u_long fr_tcptimeout;
extern u_long fr_tcpclosed;
extern u_long fr_udptimeout;
extern u_long fr_icmptimeout;
+extern int fr_state_lock;
+extern int fr_stateinit __P((void));
extern int fr_tcpstate __P((ipstate_t *, fr_info_t *, ip_t *, tcphdr_t *));
-extern int fr_addstate __P((ip_t *, fr_info_t *, u_int));
-extern int fr_checkstate __P((ip_t *, fr_info_t *));
+extern ipstate_t *fr_addstate __P((ip_t *, fr_info_t *, u_int));
+extern frentry_t *fr_checkstate __P((ip_t *, fr_info_t *));
+extern void ip_statesync __P((void *));
extern void fr_timeoutstate __P((void));
-extern void fr_tcp_age __P((u_long *, u_char *, ip_t *, fr_info_t *, int));
+extern void fr_tcp_age __P((u_long *, u_char *, fr_info_t *, int));
extern void fr_stateunload __P((void));
-extern void ipstate_log __P((struct ipstate *, u_short));
+extern void ipstate_log __P((struct ipstate *, u_int));
#if defined(__NetBSD__) || defined(__OpenBSD__)
extern int fr_state_ioctl __P((caddr_t, u_long, int));
#else
diff --git a/sys/netinet/ipl.h b/sys/netinet/ipl.h
index d92ec79542ff..12d866cc5ad8 100644
--- a/sys/netinet/ipl.h
+++ b/sys/netinet/ipl.h
@@ -1,16 +1,17 @@
/*
- * Copyright (C) 1993-1997 by Darren Reed.
+ * Copyright (C) 1993-2000 by Darren Reed.
*
* Redistribution and use in source and binary forms are permitted
* provided that this notice is preserved and due credit is given
* to the original author and the contributors.
*
* @(#)ipl.h 1.21 6/5/96
+ * $Id: ipl.h,v 2.15.2.5 2000/05/22 10:26:16 darrenr Exp $
*/
#ifndef __IPL_H__
#define __IPL_H__
-#define IPL_VERSION "IP Filter v3.2.7"
+#define IPL_VERSION "IP Filter: v3.4.4"
#endif
diff --git a/sys/netinet/mlfk_ipl.c b/sys/netinet/mlfk_ipl.c
index 28e7c5d4287c..4412960e7b52 100644
--- a/sys/netinet/mlfk_ipl.c
+++ b/sys/netinet/mlfk_ipl.c
@@ -23,9 +23,10 @@
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
- * $FreeBSD$
+ * $Id: mlfk_ipl.c,v 2.1.2.1 2000/04/26 12:17:24 darrenr Exp $
*/
+
#include <sys/param.h>
#include <sys/systm.h>
#include <sys/kernel.h>
@@ -73,8 +74,8 @@ SYSCTL_INT(_net_inet_ipf, OID_AUTO, fr_ipfrttl, CTLFLAG_RW,
&fr_ipfrttl, 0, "");
SYSCTL_INT(_net_inet_ipf, OID_AUTO, ipl_unreach, CTLFLAG_RW,
&ipl_unreach, 0, "");
-SYSCTL_INT(_net_inet_ipf, OID_AUTO, ipl_inited, CTLFLAG_RD,
- &ipl_inited, 0, "");
+SYSCTL_INT(_net_inet_ipf, OID_AUTO, fr_running, CTLFLAG_RD,
+ &fr_running, 0, "");
SYSCTL_INT(_net_inet_ipf, OID_AUTO, fr_authsize, CTLFLAG_RD,
&fr_authsize, 0, "");
SYSCTL_INT(_net_inet_ipf, OID_AUTO, fr_authused, CTLFLAG_RD,
@@ -108,7 +109,10 @@ ipfilter_modevent(module_t mod, int type, void *unused)
switch (type) {
case MOD_LOAD :
+
error = iplattach();
+ if (error)
+ break;
c = NULL;
for(i=strlen(IPL_NAME); i>0; i--)
@@ -160,7 +164,6 @@ ipfilter_modevent(module_t mod, int type, void *unused)
destroy_dev(ipf_devs[IPL_LOGNAT]);
destroy_dev(ipf_devs[IPL_LOGSTATE]);
destroy_dev(ipf_devs[IPL_LOGAUTH]);
- cdevsw_remove(&ipl_cdevsw);
error = ipldetach();
break;
default: