contrib/ipfilter/ip_sfil.c

   1 /*
   2  * Copyright (C) 1993-2001 by Darren Reed.
   3  *
   4  * See the IPFILTER.LICENCE file for details on licencing.
   5  *
   6  * I hate legaleese, don't you ?
   7  */
   8 #if !defined(lint)
   9 static const char sccsid[] = "%W% %G% (C) 1993-2000 Darren Reed";
  10 static const char rcsid[] = "@(#)$Id: ip_sfil.c,v 2.23.2.20 2002/08/28 12:42:44 darrenr Exp $";
  11 #endif
  12
  13 #include <sys/types.h>
  14 #include <sys/errno.h>
  15 #include <sys/param.h>
  16 #include <sys/cpuvar.h>
  17 #include <sys/open.h>
  18 #include <sys/ioctl.h>
  19 #include <sys/filio.h>
  20 #include <sys/systm.h>
  21 #include <sys/cred.h>
  22 #include <sys/ddi.h>
  23 #include <sys/sunddi.h>
  24 #include <sys/ksynch.h>
  25 #include <sys/kmem.h>
  26 #include <sys/mkdev.h>
  27 #include <sys/protosw.h>
  28 #include <sys/socket.h>
  29 #include <sys/dditypes.h>
  30 #include <sys/cmn_err.h>
  31 #include <net/if.h>
  32 #include <net/af.h>
  33 #include <net/route.h>
  34 #include <netinet/in.h>
  35 #include <netinet/in_systm.h>
  36 #include <netinet/ip.h>
  37 #include <netinet/ip_var.h>
  38 #include <netinet/tcp.h>
  39 #include <netinet/udp.h>
  40 #include <netinet/tcpip.h>
  41 #include <netinet/ip_icmp.h>
  42 #include "ip_compat.h"
  43 #ifdef  USE_INET6
  44 # include <netinet/icmp6.h>
  45 #endif
  46 #include "ip_fil.h"
  47 #include "ip_state.h"
  48 #include "ip_nat.h"
  49 #include "ip_frag.h"
  50 #include "ip_auth.h"
  51 #include "ip_proxy.h"
  52 #include <inet/ip_ire.h>
  53 #ifndef MIN
  54 #define MIN(a,b)        (((a)<(b))?(a):(b))
  55 #endif
  56
  57
  58 extern  fr_flags, fr_active;
  59
  60 int     fr_running = 0;
  61 int     ipl_unreach = ICMP_UNREACH_HOST;
  62 u_long  ipl_frouteok[2] = {0, 0};
  63 static  int     frzerostats __P((caddr_t));
  64 #if SOLARIS2 >= 7
  65 static  u_int   *ip_ttl_ptr;
  66 static  u_int   *ip_mtudisc;
  67 #else
  68 static  u_long  *ip_ttl_ptr;
  69 static  u_long  *ip_mtudisc;
  70 #endif
  71
  72 static  int     frrequest __P((minor_t, int, caddr_t, int));
  73 static  int     send_ip __P((fr_info_t *fin, mblk_t *m));
  74 kmutex_t        ipl_mutex, ipf_authmx, ipf_rw;
  75 KRWLOCK_T       ipf_mutex, ipfs_mutex, ipf_solaris;
  76 KRWLOCK_T       ipf_frag, ipf_state, ipf_nat, ipf_natfrag, ipf_auth;
  77 kcondvar_t      iplwait, ipfauthwait;
  78
  79
  80 int ipldetach()
  81 {
  82         int     i;
  83
  84 #ifdef  IPFDEBUG
  85         cmn_err(CE_CONT, "ipldetach()\n");
  86 #endif
  87 #ifdef  IPFILTER_LOG
  88         for (i = IPL_LOGMAX; i >= 0; i--)
  89                 ipflog_clear(i);
  90 #endif
  91         i = frflush(IPL_LOGIPF, FR_INQUE|FR_OUTQUE|FR_INACTIVE);
  92         i += frflush(IPL_LOGIPF, FR_INQUE|FR_OUTQUE);
  93         ipfr_unload();
  94         fr_stateunload();
  95         ip_natunload();
  96         cv_destroy(&iplwait);
  97         cv_destroy(&ipfauthwait);
  98         mutex_destroy(&ipf_authmx);
  99         mutex_destroy(&ipl_mutex);
 100         mutex_destroy(&ipf_rw);
 101         RW_DESTROY(&ipf_mutex);
 102         RW_DESTROY(&ipf_frag);
 103         RW_DESTROY(&ipf_state);
 104         RW_DESTROY(&ipf_natfrag);
 105         RW_DESTROY(&ipf_nat);
 106         RW_DESTROY(&ipf_auth);
 107         RW_DESTROY(&ipfs_mutex);
 108         /* NOTE: This lock is acquired in ipf_detach */
 109         RWLOCK_EXIT(&ipf_solaris);
 110         RW_DESTROY(&ipf_solaris);
 111         return 0;
 112 }
 113
 114
 115 int iplattach __P((void))
 116 {
 117         int i;
 118
 119 #ifdef  IPFDEBUG
 120         cmn_err(CE_CONT, "iplattach()\n");
 121 #endif
 122         bzero((char *)frcache, sizeof(frcache));
 123         mutex_init(&ipf_rw, "ipf rw mutex", MUTEX_DRIVER, NULL);
 124         mutex_init(&ipl_mutex, "ipf log mutex", MUTEX_DRIVER, NULL);
 125         mutex_init(&ipf_authmx, "ipf auth log mutex", MUTEX_DRIVER, NULL);
 126         RWLOCK_INIT(&ipf_solaris, "ipf filter load/unload mutex", NULL);
 127         RWLOCK_INIT(&ipf_mutex, "ipf filter rwlock", NULL);
 128         RWLOCK_INIT(&ipfs_mutex, "ipf solaris mutex", NULL);
 129         RWLOCK_INIT(&ipf_frag, "ipf fragment rwlock", NULL);
 130         RWLOCK_INIT(&ipf_state, "ipf IP state rwlock", NULL);
 131         RWLOCK_INIT(&ipf_nat, "ipf IP NAT rwlock", NULL);
 132         RWLOCK_INIT(&ipf_natfrag, "ipf IP NAT-Frag rwlock", NULL);
 133         RWLOCK_INIT(&ipf_auth, "ipf IP User-Auth rwlock", NULL);
 134         cv_init(&iplwait, "ipl condvar", CV_DRIVER, NULL);
 135         cv_init(&ipfauthwait, "ipf auth condvar", CV_DRIVER, NULL);
 136 #ifdef  IPFILTER_LOG
 137         ipflog_init();
 138 #endif
 139         if (nat_init() == -1)
 140                 return -1;
 141         if (fr_stateinit() == -1)
 142                 return -1;
 143         if (appr_init() == -1)
 144                 return -1;
 145
 146         ip_ttl_ptr = NULL;
 147         ip_mtudisc = NULL;
 148         /*
 149          * XXX - There is no terminator for this array, so it is not possible
 150          * to tell if what we are looking for is missing and go off the end
 151          * of the array.
 152          */
 153         for (i = 0; ; i++) {
 154                 if (strcmp(ip_param_arr[i].ip_param_name, "ip_def_ttl") == 0) {
 155                         ip_ttl_ptr = &ip_param_arr[i].ip_param_value;
 156                 } else if (strcmp(ip_param_arr[i].ip_param_name,
 157                                   "ip_path_mtu_discovery") == 0) {
 158                         ip_mtudisc = &ip_param_arr[i].ip_param_value;
 159                 }
 160
 161                 if (ip_mtudisc != NULL && ip_ttl_ptr != NULL)
 162                         break;
 163         }
 164         return 0;
 165 }
 166
 167
 168 static  int     frzerostats(data)
 169 caddr_t data;
 170 {
 171         friostat_t fio;
 172         int error;
 173
 174         fr_getstat(&fio);
 175         error = IWCOPYPTR((caddr_t)&fio, data, sizeof(fio));
 176         if (error)
 177                 return error;
 178
 179         bzero((char *)frstats, sizeof(*frstats) * 2);
 180
 181         return 0;
 182 }
 183
 184
 185 /*
 186  * Filter ioctl interface.
 187  */
 188 int iplioctl(dev, cmd, data, mode, cp, rp)
 189 dev_t dev;
 190 int cmd;
 191 #if SOLARIS2 >= 7
 192 intptr_t data;
 193 #else
 194 int *data;
 195 #endif
 196 int mode;
 197 cred_t *cp;
 198 int *rp;
 199 {
 200         int error = 0, tmp;
 201         minor_t unit;
 202
 203 #ifdef  IPFDEBUG
 204         cmn_err(CE_CONT, "iplioctl(%x,%x,%x,%d,%x,%d)\n",
 205                 dev, cmd, data, mode, cp, rp);
 206 #endif
 207         unit = getminor(dev);
 208         if (IPL_LOGMAX < unit)
 209                 return ENXIO;
 210
 211         if (fr_running == 0 && (cmd != SIOCFRENB || unit != IPL_LOGIPF))
 212                 return ENODEV;
 213
 214         if (fr_running <= 0)
 215                 return 0;
 216
 217         READ_ENTER(&ipf_solaris);
 218         if (unit == IPL_LOGNAT) {
 219                 error = nat_ioctl((caddr_t)data, cmd, mode);
 220                 RWLOCK_EXIT(&ipf_solaris);
 221                 return error;
 222         }
 223         if (unit == IPL_LOGSTATE) {
 224                 error = fr_state_ioctl((caddr_t)data, cmd, mode);
 225                 RWLOCK_EXIT(&ipf_solaris);
 226                 return error;
 227         }
 228         if (unit == IPL_LOGAUTH) {
 229                 error = fr_auth_ioctl((caddr_t)data, mode, cmd, NULL, NULL);
 230                 RWLOCK_EXIT(&ipf_solaris);
 231                 return error;
 232         }
 233
 234         switch (cmd) {
 235         case SIOCFRENB :
 236         {
 237                 u_int   enable;
 238
 239                 if (!(mode & FWRITE))
 240                         error = EPERM;
 241                 else
 242                         error = IRCOPY((caddr_t)data, (caddr_t)&enable,
 243                                        sizeof(enable));
 244                 break;
 245         }
 246         case SIOCSETFF :
 247                 if (!(mode & FWRITE))
 248                         error = EPERM;
 249                 else {
 250                         WRITE_ENTER(&ipf_mutex);
 251                         error = IRCOPY((caddr_t)data, (caddr_t)&fr_flags,
 252                                sizeof(fr_flags));
 253                         RWLOCK_EXIT(&ipf_mutex);
 254                 }
 255                 break;
 256         case SIOCGETFF :
 257                 error = IWCOPY((caddr_t)&fr_flags, (caddr_t)data,
 258                                sizeof(fr_flags));
 259                 if (error)
 260                         error = EFAULT;
 261                 break;
 262         case SIOCINAFR :
 263         case SIOCRMAFR :
 264         case SIOCADAFR :
 265         case SIOCZRLST :
 266                 if (!(mode & FWRITE))
 267                         error = EPERM;
 268                 else
 269                         error = frrequest(unit, cmd, (caddr_t)data, fr_active);
 270                 break;
 271         case SIOCINIFR :
 272         case SIOCRMIFR :
 273         case SIOCADIFR :
 274                 if (!(mode & FWRITE))
 275                         error = EPERM;
 276                 else
 277                         error = frrequest(unit, cmd, (caddr_t)data,
 278                                           1 - fr_active);
 279                 break;
 280         case SIOCSWAPA :
 281                 if (!(mode & FWRITE))
 282                         error = EPERM;
 283                 else {
 284                         WRITE_ENTER(&ipf_mutex);
 285                         bzero((char *)frcache, sizeof(frcache[0]) * 2);
 286                         error = IWCOPY((caddr_t)&fr_active, (caddr_t)data,
 287                                        sizeof(fr_active));
 288                         if (error)
 289                                 error = EFAULT;
 290                         fr_active = 1 - fr_active;
 291                         RWLOCK_EXIT(&ipf_mutex);
 292                 }
 293                 break;
 294         case SIOCGETFS :
 295         {
 296                 friostat_t      fio;
 297
 298                 READ_ENTER(&ipf_mutex);
 299                 fr_getstat(&fio);
 300                 RWLOCK_EXIT(&ipf_mutex);
 301                 error = IWCOPYPTR((caddr_t)&fio, (caddr_t)data, sizeof(fio));
 302                 if (error)
 303                         error = EFAULT;
 304                 break;
 305         }
 306         case SIOCFRZST :
 307                 if (!(mode & FWRITE))
 308                         error = EPERM;
 309                 else
 310                         error = frzerostats((caddr_t)data);
 311                 break;
 312         case    SIOCIPFFL :
 313                 if (!(mode & FWRITE))
 314                         error = EPERM;
 315                 else {
 316                         error = IRCOPY((caddr_t)data, (caddr_t)&tmp,
 317                                        sizeof(tmp));
 318                         if (!error) {
 319                                 tmp = frflush(unit, tmp);
 320                                 error = IWCOPY((caddr_t)&tmp, (caddr_t)data,
 321                                                sizeof(tmp));
 322                                 if (error)
 323                                         error = EFAULT;
 324                         }
 325                 }
 326                 break;
 327         case SIOCSTLCK :
 328                 error = IRCOPY((caddr_t)data, (caddr_t)&tmp, sizeof(tmp));
 329                 if (!error) {
 330                         fr_state_lock = tmp;
 331                         fr_nat_lock = tmp;
 332                         fr_frag_lock = tmp;
 333                         fr_auth_lock = tmp;
 334                 } else
 335                         error = EFAULT;
 336         break;
 337 #ifdef  IPFILTER_LOG
 338         case    SIOCIPFFB :
 339                 if (!(mode & FWRITE))
 340                         error = EPERM;
 341                 else {
 342                         tmp = ipflog_clear(unit);
 343                         error = IWCOPY((caddr_t)&tmp, (caddr_t)data,
 344                                        sizeof(tmp));
 345                         if (error)
 346                                 error = EFAULT;
 347                 }
 348                 break;
 349 #endif /* IPFILTER_LOG */
 350         case SIOCFRSYN :
 351                 if (!(mode & FWRITE))
 352                         error = EPERM;
 353                 else
 354                         error = ipfsync();
 355                 break;
 356         case SIOCGFRST :
 357                 error = IWCOPYPTR((caddr_t)ipfr_fragstats(), (caddr_t)data,
 358                                   sizeof(ipfrstat_t));
 359                 break;
 360         case FIONREAD :
 361         {
 362 #ifdef  IPFILTER_LOG
 363                 int copy = (int)iplused[IPL_LOGIPF];
 364
 365                 error = IWCOPY((caddr_t)&copy, (caddr_t)data, sizeof(copy));
 366                 if (error)
 367                         error = EFAULT;
 368 #endif
 369                 break;
 370         }
 371         default :
 372                 error = EINVAL;
 373                 break;
 374         }
 375         RWLOCK_EXIT(&ipf_solaris);
 376         return error;
 377 }
 378
 379
 380 ill_t   *get_unit(name, v)
 381 char    *name;
 382 int     v;
 383 {
 384         size_t len = strlen(name) + 1;  /* includes \0 */
 385         ill_t *il;
 386         int sap;
 387
 388         if (v == 4)
 389                 sap = 0x0800;
 390         else if (v == 6)
 391                 sap = 0x86dd;
 392         else
 393                 return NULL;
 394         for (il = ill_g_head; il; il = il->ill_next)
 395                 if ((len == il->ill_name_length) && (il->ill_sap == sap) &&
 396                     !strncmp(il->ill_name, name, len))
 397                         return il;
 398         return NULL;
 399 }
 400
 401
 402 static int frrequest(unit, req, data, set)
 403 minor_t unit;
 404 int req, set;
 405 caddr_t data;
 406 {
 407         register frentry_t *fp, *f, **fprev;
 408         register frentry_t **ftail;
 409         frgroup_t *fg = NULL;
 410         int error = 0, in, i;
 411         u_int *p, *pp;
 412         frdest_t *fdp;
 413         frentry_t fr;
 414         u_32_t group;
 415         ipif_t *ipif;
 416         ill_t *ill;
 417         ire_t *ire;
 418
 419         fp = &fr;
 420         error = IRCOPYPTR(data, (caddr_t)fp, sizeof(*fp));
 421         if (error)
 422                 return EFAULT;
 423         fp->fr_ref = 0;
 424 #if SOLARIS2 >= 8
 425         if (fp->fr_v == 4)
 426                 fp->fr_sap = IP_DL_SAP;
 427         else if (fp->fr_v == 6)
 428                 fp->fr_sap = IP6_DL_SAP;
 429         else
 430                 return EINVAL;
 431 #else
 432         fp->fr_sap = 0;
 433 #endif
 434
 435         WRITE_ENTER(&ipf_mutex);
 436         /*
 437          * Check that the group number does exist and that if a head group
 438          * has been specified, doesn't exist.
 439          */
 440         if ((req != SIOCZRLST) && ((req == SIOCINAFR) || (req == SIOCINIFR) ||
 441              (req == SIOCADAFR) || (req == SIOCADIFR)) && fp->fr_grhead &&
 442             fr_findgroup(fp->fr_grhead, fp->fr_flags, unit, set, NULL)) {
 443                 error = EEXIST;
 444                 goto out;
 445         }
 446         if ((req != SIOCZRLST) && fp->fr_group &&
 447             !fr_findgroup(fp->fr_group, fp->fr_flags, unit, set, NULL)) {
 448                 error = ESRCH;
 449                 goto out;
 450         }
 451
 452         in = (fp->fr_flags & FR_INQUE) ? 0 : 1;
 453
 454         if (unit == IPL_LOGAUTH)
 455                 ftail = fprev = &ipauth;
 456         else if ((fp->fr_flags & FR_ACCOUNT) && (fp->fr_v == 4))
 457                 ftail = fprev = &ipacct[in][set];
 458         else if ((fp->fr_flags & (FR_OUTQUE|FR_INQUE)) && (fp->fr_v == 4))
 459                 ftail = fprev = &ipfilter[in][set];
 460 #ifdef  USE_INET6
 461         else if ((fp->fr_flags & FR_ACCOUNT) && (fp->fr_v == 6))
 462                 ftail = fprev = &ipacct6[in][set];
 463         else if ((fp->fr_flags & (FR_OUTQUE|FR_INQUE)) && (fp->fr_v == 6))
 464                 ftail = fprev = &ipfilter6[in][set];
 465 #endif
 466         else {
 467                 error = ESRCH;
 468                 goto out;
 469         }
 470
 471         group = fp->fr_group;
 472         if (group != 0) {
 473                 fg = fr_findgroup(group, fp->fr_flags, unit, set, NULL);
 474                 if (fg == NULL) {
 475                         error = ESRCH;
 476                         goto out;
 477                 }
 478                 ftail = fprev = fg->fg_start;
 479         }
 480
 481         bzero((char *)frcache, sizeof(frcache[0]) * 2);
 482
 483         for (i = 0; i < 4; i++) {
 484                 if ((fp->fr_ifnames[i][1] == '\0') &&
 485                     ((fp->fr_ifnames[i][0] == '-') ||
 486                      (fp->fr_ifnames[i][0] == '*'))) {
 487                         fp->fr_ifas[i] = NULL;
 488                 } else if (*fp->fr_ifnames[i]) {
 489                         fp->fr_ifas[i] = GETUNIT(fp->fr_ifnames[i], fp->fr_v);
 490                         if (!fp->fr_ifas[i])
 491                                 fp->fr_ifas[i] = (void *)-1;
 492                 }
 493         }
 494
 495         fdp = &fp->fr_dif;
 496         fdp->fd_mp = NULL;
 497         fp->fr_flags &= ~FR_DUP;
 498         if (*fdp->fd_ifname) {
 499                 ill = get_unit(fdp->fd_ifname, (int)fp->fr_v);
 500                 if (!ill)
 501                         ire = (ire_t *)-1;
 502                 else if ((ipif = ill->ill_ipif) && (fp->fr_v == 4)) {
 503 #if SOLARIS2 > 5
 504                         ire = ire_ctable_lookup(ipif->ipif_local_addr, 0,
 505                                                 IRE_LOCAL, NULL, NULL,
 506                                                 MATCH_IRE_TYPE);
 507 #else
 508                         ire = ire_lookup_myaddr(ipif->ipif_local_addr);
 509 #endif
 510                         if (!ire)
 511                                 ire = (ire_t *)-1;
 512                         else
 513                                 fp->fr_flags |= FR_DUP;
 514                 }
 515 #ifdef  USE_INET6
 516                 else if ((ipif = ill->ill_ipif) && (fp->fr_v == 6)) {
 517                         ire = ire_ctable_lookup_v6(&ipif->ipif_v6lcl_addr, 0,
 518                                                    IRE_LOCAL, NULL, NULL,
 519                                                    MATCH_IRE_TYPE);
 520                         if (!ire)
 521                                 ire = (ire_t *)-1;
 522                         else
 523                                 fp->fr_flags |= FR_DUP;
 524                 }
 525 #endif
 526                 fdp->fd_ifp = (struct ifnet *)ire;
 527         }
 528
 529         fdp = &fp->fr_tif;
 530         fdp->fd_mp = NULL;
 531         if (*fdp->fd_ifname) {
 532                 ill = get_unit(fdp->fd_ifname, (int)fp->fr_v);
 533                 if (!ill)
 534                         ire = (ire_t *)-1;
 535                 else if ((ipif = ill->ill_ipif) && (fp->fr_v == 4)) {
 536 #if SOLARIS2 > 5
 537                         ire = ire_ctable_lookup(ipif->ipif_local_addr, 0,
 538                                                 IRE_LOCAL, NULL, NULL,
 539                                                 MATCH_IRE_TYPE);
 540 #else
 541                         ire = ire_lookup_myaddr(ipif->ipif_local_addr);
 542 #endif
 543                         if (!ire)
 544                                 ire = (ire_t *)-1;
 545                 }
 546 #ifdef  USE_INET6
 547                 else if ((ipif = ill->ill_ipif) && (fp->fr_v == 6)) {
 548                         ire = ire_ctable_lookup_v6(&ipif->ipif_v6lcl_addr, 0,
 549                                                    IRE_LOCAL, NULL, NULL,
 550                                                    MATCH_IRE_TYPE);
 551                         if (!ire)
 552                                 ire = (ire_t *)-1;
 553                 }
 554 #endif
 555                 fdp->fd_ifp = (struct ifnet *)ire;
 556         }
 557
 558         /*
 559          * Look for a matching filter rule, but don't include the next or
 560          * interface pointer in the comparison (fr_next, fr_ifa).
 561          */
 562         for (fp->fr_cksum = 0, p = (u_int *)&fp->fr_ip, pp = &fp->fr_cksum;
 563              p < pp; p++)
 564                 fp->fr_cksum += *p;
 565
 566         for (; (f = *ftail); ftail = &f->fr_next)
 567                 if ((fp->fr_cksum == f->fr_cksum) &&
 568                     !bcmp((char *)&f->fr_ip, (char *)&fp->fr_ip, FR_CMPSIZ))
 569                         break;
 570
 571         /*
 572          * If zero'ing statistics, copy current to caller and zero.
 573          */
 574         if (req == SIOCZRLST) {
 575                 if (!f) {
 576                         error = ESRCH;
 577                         goto out;
 578                 }
 579                 MUTEX_DOWNGRADE(&ipf_mutex);
 580                 error = IWCOPYPTR((caddr_t)f, data, sizeof(*f));
 581                 if (error)
 582                         goto out;
 583                 f->fr_hits = 0;
 584                 f->fr_bytes = 0;
 585                 goto out;
 586         }
 587
 588         if (!f) {
 589                 if (req != SIOCINAFR && req != SIOCINIFR)
 590                         while ((f = *ftail))
 591                                 ftail = &f->fr_next;
 592                 else {
 593                         if (fp->fr_hits) {
 594                                 ftail = fprev;
 595                                 while (--fp->fr_hits && (f = *ftail))
 596                                         ftail = &f->fr_next;
 597                         }
 598                         f = NULL;
 599                 }
 600         }
 601
 602         if (req == SIOCRMAFR || req == SIOCRMIFR) {
 603                 if (!f)
 604                         error = ESRCH;
 605                 else {
 606                         /*
 607                          * Only return EBUSY if there is a group list, else
 608                          * it's probably just state information referencing
 609                          * the rule.
 610                          */
 611                         if ((f->fr_ref > 1) && f->fr_grp) {
 612                                 error = EBUSY;
 613                                 goto out;
 614                         }
 615                         if (fg && fg->fg_head)
 616                                 fg->fg_head->fr_ref--;
 617                         if (f->fr_grhead)
 618                                 fr_delgroup(f->fr_grhead, fp->fr_flags,
 619                                             unit, set);
 620                         fixskip(fprev, f, -1);
 621                         *ftail = f->fr_next;
 622                         f->fr_next = NULL;
 623                         f->fr_ref--;
 624                         if (f->fr_ref == 0)
 625                                 KFREE(f);
 626                 }
 627         } else {
 628                 if (f) {
 629                         error = EEXIST;
 630                 } else {
 631                         KMALLOC(f, frentry_t *);
 632                         if (f != NULL) {
 633                                 if (fg && fg->fg_head)
 634                                         fg->fg_head->fr_ref++;
 635                                 bcopy((char *)fp, (char *)f, sizeof(*f));
 636                                 f->fr_ref = 1;
 637                                 f->fr_hits = 0;
 638                                 f->fr_next = *ftail;
 639                                 *ftail = f;
 640                                 if (req == SIOCINIFR || req == SIOCINAFR)
 641                                         fixskip(fprev, f, 1);
 642                                 f->fr_grp = NULL;
 643                                 group = f->fr_grhead;
 644                                 if (group != 0)
 645                                         fg = fr_addgroup(group, f, unit, set);
 646                         } else
 647                                 error = ENOMEM;
 648                 }
 649         }
 650 out:
 651         RWLOCK_EXIT(&ipf_mutex);
 652         return (error);
 653 }
 654
 655
 656 /*
 657  * routines below for saving IP headers to buffer
 658  */
 659 int iplopen(devp, flags, otype, cred)
 660 dev_t *devp;
 661 int flags, otype;
 662 cred_t *cred;
 663 {
 664         minor_t min = getminor(*devp);
 665
 666 #ifdef  IPFDEBUG
 667         cmn_err(CE_CONT, "iplopen(%x,%x,%x,%x)\n", devp, flags, otype, cred);
 668 #endif
 669         if ((fr_running <= 0) || !(otype & OTYP_CHR))
 670                 return ENXIO;
 671         min = (IPL_LOGMAX < min) ? ENXIO : 0;
 672         return min;
 673 }
 674
 675
 676 int iplclose(dev, flags, otype, cred)
 677 dev_t dev;
 678 int flags, otype;
 679 cred_t *cred;
 680 {
 681         minor_t min = getminor(dev);
 682
 683 #ifdef  IPFDEBUG
 684         cmn_err(CE_CONT, "iplclose(%x,%x,%x,%x)\n", dev, flags, otype, cred);
 685 #endif
 686         min = (IPL_LOGMAX < min) ? ENXIO : 0;
 687         return min;
 688 }
 689
 690 #ifdef  IPFILTER_LOG
 691 /*
 692  * iplread/ipllog
 693  * both of these must operate with at least splnet() lest they be
 694  * called during packet processing and cause an inconsistancy to appear in
 695  * the filter lists.
 696  */
 697 int iplread(dev, uio, cp)
 698 dev_t dev;
 699 register struct uio *uio;
 700 cred_t *cp;
 701 {
 702 #ifdef  IPFDEBUG
 703         cmn_err(CE_CONT, "iplread(%x,%x,%x)\n", dev, uio, cp);
 704 #endif
 705         return ipflog_read(getminor(dev), uio);
 706 }
 707 #endif /* IPFILTER_LOG */
 708
 709
 710 /*
 711  * send_reset - this could conceivably be a call to tcp_respond(), but that
 712  * requires a large amount of setting up and isn't any more efficient.
 713  */
 714 int send_reset(oip, fin)
 715 ip_t *oip;
 716 fr_info_t *fin;
 717 {
 718         tcphdr_t *tcp, *tcp2;
 719         int tlen, hlen;
 720         mblk_t *m;
 721 #ifdef  USE_INET6
 722         ip6_t *ip6, *oip6 = (ip6_t *)oip;
 723 #endif
 724         ip_t *ip;
 725
 726         tcp = (struct tcphdr *)fin->fin_dp;
 727         if (tcp->th_flags & TH_RST)
 728                 return -1;
 729         tlen = (tcp->th_flags & (TH_SYN|TH_FIN)) ? 1 : 0;
 730 #ifdef  USE_INET6
 731         if (fin->fin_v == 6)
 732                 hlen = sizeof(ip6_t);
 733         else
 734 #endif
 735                 hlen = sizeof(ip_t);
 736         hlen += sizeof(*tcp2);
 737         if ((m = (mblk_t *)allocb(hlen + 16, BPRI_HI)) == NULL)
 738                 return -1;
 739
 740         m->b_rptr += 16;
 741         MTYPE(m) = M_DATA;
 742         m->b_wptr = m->b_rptr + hlen;
 743         bzero((char *)m->b_rptr, hlen);
 744         tcp2 = (struct tcphdr *)(m->b_rptr + hlen - sizeof(*tcp2));
 745         tcp2->th_dport = tcp->th_sport;
 746         tcp2->th_sport = tcp->th_dport;
 747         if (tcp->th_flags & TH_ACK) {
 748                 tcp2->th_seq = tcp->th_ack;
 749                 tcp2->th_flags = TH_RST|TH_ACK;
 750         } else {
 751                 tcp2->th_ack = ntohl(tcp->th_seq);
 752                 tcp2->th_ack += tlen;
 753                 tcp2->th_ack = htonl(tcp2->th_ack);
 754                 tcp2->th_flags = TH_RST;
 755         }
 756         tcp2->th_off = sizeof(struct tcphdr) >> 2;
 757         tcp2->th_flags = TH_RST|TH_ACK;
 758
 759         /*
 760          * This is to get around a bug in the Solaris 2.4/2.5 TCP checksum
 761          * computation that is done by their put routine.
 762          */
 763         tcp2->th_sum = htons(0x14);
 764 #ifdef  USE_INET6
 765         if (fin->fin_v == 6) {
 766                 ip6 = (ip6_t *)m->b_rptr;
 767                 ip6->ip6_src = oip6->ip6_dst;
 768                 ip6->ip6_dst = oip6->ip6_src;
 769                 ip6->ip6_plen = htons(sizeof(*tcp));
 770                 ip6->ip6_nxt = IPPROTO_TCP;
 771         } else
 772 #endif
 773         {
 774                 ip = (ip_t *)m->b_rptr;
 775                 ip->ip_src.s_addr = oip->ip_dst.s_addr;
 776                 ip->ip_dst.s_addr = oip->ip_src.s_addr;
 777                 ip->ip_hl = sizeof(*ip) >> 2;
 778                 ip->ip_p = IPPROTO_TCP;
 779                 ip->ip_len = htons(sizeof(*ip) + sizeof(*tcp));
 780                 ip->ip_tos = oip->ip_tos;
 781         }
 782         return send_ip(fin, m);
 783 }
 784
 785
 786 int static send_ip(fin, m)
 787 fr_info_t *fin;
 788 mblk_t *m;
 789 {
 790         RWLOCK_EXIT(&ipfs_mutex);
 791         RWLOCK_EXIT(&ipf_solaris);
 792 #ifdef  USE_INET6
 793         if (fin->fin_v == 6) {
 794                 extern void ip_wput_v6 __P((queue_t *, mblk_t *));
 795                 ip6_t *ip6;
 796
 797                 ip6 = (ip6_t *)m->b_rptr;
 798                 ip6->ip6_flow = 0;
 799                 ip6->ip6_vfc = 0x60;
 800                 ip6->ip6_hlim = 127;
 801                 ip_wput_v6(((qif_t *)fin->fin_qif)->qf_ill->ill_wq, m);
 802         } else
 803 #endif
 804         {
 805                 ip_t *ip;
 806
 807                 ip = (ip_t *)m->b_rptr;
 808                 ip->ip_v = IPVERSION;
 809                 ip->ip_ttl = (u_char)(*ip_ttl_ptr);
 810                 ip->ip_off = htons(*ip_mtudisc ? IP_DF : 0);
 811                 ip_wput(((qif_t *)fin->fin_qif)->qf_ill->ill_wq, m);
 812         }
 813         READ_ENTER(&ipf_solaris);
 814         READ_ENTER(&ipfs_mutex);
 815         return 0;
 816 }
 817
 818
 819 int send_icmp_err(oip, type, fin, dst)
 820 ip_t *oip;
 821 int type;
 822 fr_info_t *fin;
 823 int dst;
 824 {
 825         struct in_addr dst4;
 826         struct icmp *icmp;
 827         mblk_t *m, *mb;
 828         int hlen, code;
 829         qif_t *qif;
 830         u_short sz;
 831         ill_t *il;
 832 #ifdef  USE_INET6
 833         ip6_t *ip6, *oip6;
 834 #endif
 835         ip_t *ip;
 836
 837         if ((type < 0) || (type > ICMP_MAXTYPE))
 838                 return -1;
 839
 840         code = fin->fin_icode;
 841 #ifdef USE_INET6
 842         if ((code < 0) || (code > sizeof(icmptoicmp6unreach)/sizeof(int)))
 843                 return -1;
 844 #endif
 845
 846         qif = fin->fin_qif;
 847         m = fin->fin_qfm;
 848
 849 #ifdef  USE_INET6
 850         if (oip->ip_v == 6) {
 851                 oip6 = (ip6_t *)oip;
 852                 sz = sizeof(ip6_t);
 853                 sz += MIN(m->b_wptr - m->b_rptr, 512);
 854                 hlen = sizeof(ip6_t);
 855                 type = icmptoicmp6types[type];
 856                 if (type == ICMP6_DST_UNREACH)
 857                         code = icmptoicmp6unreach[code];
 858         } else
 859 #endif
 860         {
 861                 if ((oip->ip_p == IPPROTO_ICMP) &&
 862                     !(fin->fin_fi.fi_fl & FI_SHORT))
 863                         switch (ntohs(fin->fin_data[0]) >> 8)
 864                         {
 865                         case ICMP_ECHO :
 866                         case ICMP_TSTAMP :
 867                         case ICMP_IREQ :
 868                         case ICMP_MASKREQ :
 869                                 break;
 870                         default :
 871                                 return 0;
 872                         }
 873
 874                 sz = sizeof(ip_t) * 2;
 875                 sz += 8;                /* 64 bits of data */
 876                 hlen = sz;
 877         }
 878
 879         sz += offsetof(struct icmp, icmp_ip);
 880         if ((mb = (mblk_t *)allocb((size_t)sz + 16, BPRI_HI)) == NULL)
 881                 return -1;
 882         MTYPE(mb) = M_DATA;
 883         mb->b_rptr += 16;
 884         mb->b_wptr = mb->b_rptr + sz;
 885         bzero((char *)mb->b_rptr, (size_t)sz);
 886         icmp = (struct icmp *)(mb->b_rptr + sizeof(*ip));
 887         icmp->icmp_type = type;
 888         icmp->icmp_code = code;
 889         icmp->icmp_cksum = 0;
 890 #ifdef  icmp_nextmtu
 891         if (type == ICMP_UNREACH && (il = qif->qf_ill) &&
 892             fin->fin_icode == ICMP_UNREACH_NEEDFRAG)
 893                 icmp->icmp_nextmtu = htons(il->ill_max_frag);
 894 #endif
 895
 896 #ifdef  USE_INET6
 897         if (oip->ip_v == 6) {
 898                 struct in6_addr dst6;
 899                 int csz;
 900
 901                 if (dst == 0) {
 902                         if (fr_ifpaddr(6, ((qif_t *)fin->fin_qif)->qf_ill,
 903                                        (struct in_addr *)&dst6) == -1)
 904                                 return -1;
 905                 } else
 906                         dst6 = oip6->ip6_dst;
 907
 908                 csz = sz;
 909                 sz -= sizeof(ip6_t);
 910                 ip6 = (ip6_t *)mb->b_rptr;
 911                 ip6->ip6_flow = 0;
 912                 ip6->ip6_vfc = 0x60;
 913                 ip6->ip6_hlim = 127;
 914                 ip6->ip6_plen = htons(sz);
 915                 ip6->ip6_nxt = IPPROTO_ICMPV6;
 916                 ip6->ip6_src = dst6;
 917                 ip6->ip6_dst = oip6->ip6_src;
 918                 sz -= offsetof(struct icmp, icmp_ip);
 919                 bcopy((char *)m->b_rptr, (char *)&icmp->icmp_ip, sz);
 920                 icmp->icmp_cksum = csz - sizeof(ip6_t);
 921         } else
 922 #endif
 923         {
 924                 ip = (ip_t *)mb->b_rptr;
 925                 ip->ip_v = IPVERSION;
 926                 ip->ip_hl = (sizeof(*ip) >> 2);
 927                 ip->ip_p = IPPROTO_ICMP;
 928                 ip->ip_id = oip->ip_id;
 929                 ip->ip_sum = 0;
 930                 ip->ip_ttl = (u_char)(*ip_ttl_ptr);
 931                 ip->ip_tos = oip->ip_tos;
 932                 ip->ip_len = (u_short)htons(sz);
 933                 if (dst == 0) {
 934                         if (fr_ifpaddr(4, ((qif_t *)fin->fin_qif)->qf_ill,
 935                                        &dst4) == -1)
 936                                 return -1;
 937                 } else
 938                         dst4 = oip->ip_dst;
 939                 ip->ip_src = dst4;
 940                 ip->ip_dst = oip->ip_src;
 941                 bcopy((char *)oip, (char *)&icmp->icmp_ip, sizeof(*oip));
 942                 bcopy((char *)oip + (oip->ip_hl << 2),
 943                       (char *)&icmp->icmp_ip + sizeof(*oip), 8);
 944                 icmp->icmp_cksum = ipf_cksum((u_short *)icmp,
 945                                              sizeof(*icmp) + 8);
 946         }
 947
 948         /*
 949          * Need to exit out of these so we don't recursively call rw_enter
 950          * from fr_qout.
 951          */
 952         return send_ip(fin, mb);
 953 }