contrib/ipfilter/ip_sfil.c

   1 /*
   2  * Copyright (C) 1993-2001 by Darren Reed.
   3  *
   4  * See the IPFILTER.LICENCE file for details on licencing.
   5  *
   6  * I hate legaleese, don't you ?
   7  */
   8 #if !defined(lint)
   9 static const char sccsid[] = "%W% %G% (C) 1993-2000 Darren Reed";
  10 static const char rcsid[] = "@(#)$Id: ip_sfil.c,v 2.23.2.18 2002/06/06 10:47:26 darrenr Exp $";
  11 #endif
  12
  13 #include <sys/types.h>
  14 #include <sys/errno.h>
  15 #include <sys/param.h>
  16 #include <sys/cpuvar.h>
  17 #include <sys/open.h>
  18 #include <sys/ioctl.h>
  19 #include <sys/filio.h>
  20 #include <sys/systm.h>
  21 #include <sys/cred.h>
  22 #include <sys/ddi.h>
  23 #include <sys/sunddi.h>
  24 #include <sys/ksynch.h>
  25 #include <sys/kmem.h>
  26 #include <sys/mkdev.h>
  27 #include <sys/protosw.h>
  28 #include <sys/socket.h>
  29 #include <sys/dditypes.h>
  30 #include <sys/cmn_err.h>
  31 #include <net/if.h>
  32 #include <net/af.h>
  33 #include <net/route.h>
  34 #include <netinet/in.h>
  35 #include <netinet/in_systm.h>
  36 #include <netinet/ip.h>
  37 #include <netinet/ip_var.h>
  38 #include <netinet/tcp.h>
  39 #include <netinet/udp.h>
  40 #include <netinet/tcpip.h>
  41 #include <netinet/ip_icmp.h>
  42 #include "ip_compat.h"
  43 #ifdef  USE_INET6
  44 # include <netinet/icmp6.h>
  45 #endif
  46 #include "ip_fil.h"
  47 #include "ip_state.h"
  48 #include "ip_nat.h"
  49 #include "ip_frag.h"
  50 #include "ip_auth.h"
  51 #include "ip_proxy.h"
  52 #include <inet/ip_ire.h>
  53 #ifndef MIN
  54 #define MIN(a,b)        (((a)<(b))?(a):(b))
  55 #endif
  56
  57
  58 extern  fr_flags, fr_active;
  59
  60 int     fr_running = 0;
  61 int     ipl_unreach = ICMP_UNREACH_HOST;
  62 u_long  ipl_frouteok[2] = {0, 0};
  63 static  int     frzerostats __P((caddr_t));
  64 #if SOLARIS2 >= 7
  65 static  u_int   *ip_ttl_ptr;
  66 #else
  67 static  u_long  *ip_ttl_ptr;
  68 #endif
  69
  70 static  int     frrequest __P((minor_t, int, caddr_t, int));
  71 static  int     send_ip __P((fr_info_t *fin, mblk_t *m));
  72 kmutex_t        ipl_mutex, ipf_authmx, ipf_rw;
  73 KRWLOCK_T       ipf_mutex, ipfs_mutex, ipf_solaris;
  74 KRWLOCK_T       ipf_frag, ipf_state, ipf_nat, ipf_natfrag, ipf_auth;
  75 kcondvar_t      iplwait, ipfauthwait;
  76
  77
  78 int ipldetach()
  79 {
  80         int     i;
  81
  82 #ifdef  IPFDEBUG
  83         cmn_err(CE_CONT, "ipldetach()\n");
  84 #endif
  85 #ifdef  IPFILTER_LOG
  86         for (i = IPL_LOGMAX; i >= 0; i--)
  87                 ipflog_clear(i);
  88 #endif
  89         i = FR_INQUE|FR_OUTQUE;
  90         (void) frflush(IPL_LOGIPF, FR_INQUE|FR_OUTQUE);
  91         ipfr_unload();
  92         fr_stateunload();
  93         ip_natunload();
  94         cv_destroy(&iplwait);
  95         cv_destroy(&ipfauthwait);
  96         mutex_destroy(&ipf_authmx);
  97         mutex_destroy(&ipl_mutex);
  98         mutex_destroy(&ipf_rw);
  99         RW_DESTROY(&ipf_mutex);
 100         RW_DESTROY(&ipf_frag);
 101         RW_DESTROY(&ipf_state);
 102         RW_DESTROY(&ipf_natfrag);
 103         RW_DESTROY(&ipf_nat);
 104         RW_DESTROY(&ipf_auth);
 105         RW_DESTROY(&ipfs_mutex);
 106         /* NOTE: This lock is acquired in ipf_detach */
 107         RWLOCK_EXIT(&ipf_solaris);
 108         RW_DESTROY(&ipf_solaris);
 109         return 0;
 110 }
 111
 112
 113 int iplattach __P((void))
 114 {
 115         int i;
 116
 117 #ifdef  IPFDEBUG
 118         cmn_err(CE_CONT, "iplattach()\n");
 119 #endif
 120         bzero((char *)frcache, sizeof(frcache));
 121         mutex_init(&ipf_rw, "ipf rw mutex", MUTEX_DRIVER, NULL);
 122         mutex_init(&ipl_mutex, "ipf log mutex", MUTEX_DRIVER, NULL);
 123         mutex_init(&ipf_authmx, "ipf auth log mutex", MUTEX_DRIVER, NULL);
 124         RWLOCK_INIT(&ipf_solaris, "ipf filter load/unload mutex", NULL);
 125         RWLOCK_INIT(&ipf_mutex, "ipf filter rwlock", NULL);
 126         RWLOCK_INIT(&ipfs_mutex, "ipf solaris mutex", NULL);
 127         RWLOCK_INIT(&ipf_frag, "ipf fragment rwlock", NULL);
 128         RWLOCK_INIT(&ipf_state, "ipf IP state rwlock", NULL);
 129         RWLOCK_INIT(&ipf_nat, "ipf IP NAT rwlock", NULL);
 130         RWLOCK_INIT(&ipf_natfrag, "ipf IP NAT-Frag rwlock", NULL);
 131         RWLOCK_INIT(&ipf_auth, "ipf IP User-Auth rwlock", NULL);
 132         cv_init(&iplwait, "ipl condvar", CV_DRIVER, NULL);
 133         cv_init(&ipfauthwait, "ipf auth condvar", CV_DRIVER, NULL);
 134 #ifdef  IPFILTER_LOG
 135         ipflog_init();
 136 #endif
 137         if (nat_init() == -1)
 138                 return -1;
 139         if (fr_stateinit() == -1)
 140                 return -1;
 141         if (appr_init() == -1)
 142                 return -1;
 143
 144         ip_ttl_ptr = NULL;
 145         /*
 146          * XXX - There is no terminator for this array, so it is not possible
 147          * to tell if what we are looking for is missing and go off the end
 148          * of the array.
 149          */
 150         for (i = 0; ; i++) {
 151                 if (!strcmp(ip_param_arr[i].ip_param_name, "ip_def_ttl")) {
 152                         ip_ttl_ptr = &ip_param_arr[i].ip_param_value;
 153                         break;
 154                 }
 155         }
 156         return 0;
 157 }
 158
 159
 160 static  int     frzerostats(data)
 161 caddr_t data;
 162 {
 163         friostat_t fio;
 164         int error;
 165
 166         fr_getstat(&fio);
 167         error = IWCOPYPTR((caddr_t)&fio, data, sizeof(fio));
 168         if (error)
 169                 return error;
 170
 171         bzero((char *)frstats, sizeof(*frstats) * 2);
 172
 173         return 0;
 174 }
 175
 176
 177 /*
 178  * Filter ioctl interface.
 179  */
 180 int iplioctl(dev, cmd, data, mode, cp, rp)
 181 dev_t dev;
 182 int cmd;
 183 #if SOLARIS2 >= 7
 184 intptr_t data;
 185 #else
 186 int *data;
 187 #endif
 188 int mode;
 189 cred_t *cp;
 190 int *rp;
 191 {
 192         int error = 0, tmp;
 193         minor_t unit;
 194
 195 #ifdef  IPFDEBUG
 196         cmn_err(CE_CONT, "iplioctl(%x,%x,%x,%d,%x,%d)\n",
 197                 dev, cmd, data, mode, cp, rp);
 198 #endif
 199         unit = getminor(dev);
 200         if (IPL_LOGMAX < unit)
 201                 return ENXIO;
 202
 203         if (fr_running == 0 && (cmd != SIOCFRENB || unit != IPL_LOGIPF))
 204                 return ENODEV;
 205
 206         if (fr_running <= 0)
 207                 return 0;
 208
 209         READ_ENTER(&ipf_solaris);
 210         if (unit == IPL_LOGNAT) {
 211                 error = nat_ioctl((caddr_t)data, cmd, mode);
 212                 RWLOCK_EXIT(&ipf_solaris);
 213                 return error;
 214         }
 215         if (unit == IPL_LOGSTATE) {
 216                 error = fr_state_ioctl((caddr_t)data, cmd, mode);
 217                 RWLOCK_EXIT(&ipf_solaris);
 218                 return error;
 219         }
 220         if (unit == IPL_LOGAUTH) {
 221                 error = fr_auth_ioctl((caddr_t)data, mode, cmd, NULL, NULL);
 222                 RWLOCK_EXIT(&ipf_solaris);
 223                 return error;
 224         }
 225
 226         switch (cmd) {
 227         case SIOCFRENB :
 228         {
 229                 u_int   enable;
 230
 231                 if (!(mode & FWRITE))
 232                         error = EPERM;
 233                 else
 234                         error = IRCOPY((caddr_t)data, (caddr_t)&enable,
 235                                        sizeof(enable));
 236                 break;
 237         }
 238         case SIOCSETFF :
 239                 if (!(mode & FWRITE))
 240                         error = EPERM;
 241                 else {
 242                         WRITE_ENTER(&ipf_mutex);
 243                         error = IRCOPY((caddr_t)data, (caddr_t)&fr_flags,
 244                                sizeof(fr_flags));
 245                         RWLOCK_EXIT(&ipf_mutex);
 246                 }
 247                 break;
 248         case SIOCGETFF :
 249                 error = IWCOPY((caddr_t)&fr_flags, (caddr_t)data,
 250                                sizeof(fr_flags));
 251                 if (error)
 252                         error = EFAULT;
 253                 break;
 254         case SIOCINAFR :
 255         case SIOCRMAFR :
 256         case SIOCADAFR :
 257         case SIOCZRLST :
 258                 if (!(mode & FWRITE))
 259                         error = EPERM;
 260                 else
 261                         error = frrequest(unit, cmd, (caddr_t)data, fr_active);
 262                 break;
 263         case SIOCINIFR :
 264         case SIOCRMIFR :
 265         case SIOCADIFR :
 266                 if (!(mode & FWRITE))
 267                         error = EPERM;
 268                 else
 269                         error = frrequest(unit, cmd, (caddr_t)data,
 270                                           1 - fr_active);
 271                 break;
 272         case SIOCSWAPA :
 273                 if (!(mode & FWRITE))
 274                         error = EPERM;
 275                 else {
 276                         WRITE_ENTER(&ipf_mutex);
 277                         bzero((char *)frcache, sizeof(frcache[0]) * 2);
 278                         error = IWCOPY((caddr_t)&fr_active, (caddr_t)data,
 279                                        sizeof(fr_active));
 280                         if (error)
 281                                 error = EFAULT;
 282                         fr_active = 1 - fr_active;
 283                         RWLOCK_EXIT(&ipf_mutex);
 284                 }
 285                 break;
 286         case SIOCGETFS :
 287         {
 288                 friostat_t      fio;
 289
 290                 READ_ENTER(&ipf_mutex);
 291                 fr_getstat(&fio);
 292                 RWLOCK_EXIT(&ipf_mutex);
 293                 error = IWCOPYPTR((caddr_t)&fio, (caddr_t)data, sizeof(fio));
 294                 if (error)
 295                         error = EFAULT;
 296                 break;
 297         }
 298         case SIOCFRZST :
 299                 if (!(mode & FWRITE))
 300                         error = EPERM;
 301                 else
 302                         error = frzerostats((caddr_t)data);
 303                 break;
 304         case    SIOCIPFFL :
 305                 if (!(mode & FWRITE))
 306                         error = EPERM;
 307                 else {
 308                         error = IRCOPY((caddr_t)data, (caddr_t)&tmp,
 309                                        sizeof(tmp));
 310                         if (!error) {
 311                                 tmp = frflush(unit, tmp);
 312                                 error = IWCOPY((caddr_t)&tmp, (caddr_t)data,
 313                                                sizeof(tmp));
 314                                 if (error)
 315                                         error = EFAULT;
 316                         }
 317                 }
 318                 break;
 319         case SIOCSTLCK :
 320                 error = IRCOPY((caddr_t)data, (caddr_t)&tmp, sizeof(tmp));
 321                 if (!error) {
 322                         fr_state_lock = tmp;
 323                         fr_nat_lock = tmp;
 324                         fr_frag_lock = tmp;
 325                         fr_auth_lock = tmp;
 326                 } else
 327                         error = EFAULT;
 328         break;
 329 #ifdef  IPFILTER_LOG
 330         case    SIOCIPFFB :
 331                 if (!(mode & FWRITE))
 332                         error = EPERM;
 333                 else {
 334                         tmp = ipflog_clear(unit);
 335                         error = IWCOPY((caddr_t)&tmp, (caddr_t)data,
 336                                        sizeof(tmp));
 337                         if (error)
 338                                 error = EFAULT;
 339                 }
 340                 break;
 341 #endif /* IPFILTER_LOG */
 342         case SIOCFRSYN :
 343                 if (!(mode & FWRITE))
 344                         error = EPERM;
 345                 else
 346                         error = ipfsync();
 347                 break;
 348         case SIOCGFRST :
 349                 error = IWCOPYPTR((caddr_t)ipfr_fragstats(), (caddr_t)data,
 350                                   sizeof(ipfrstat_t));
 351                 break;
 352         case FIONREAD :
 353         {
 354 #ifdef  IPFILTER_LOG
 355                 int copy = (int)iplused[IPL_LOGIPF];
 356
 357                 error = IWCOPY((caddr_t)&copy, (caddr_t)data, sizeof(copy));
 358                 if (error)
 359                         error = EFAULT;
 360 #endif
 361                 break;
 362         }
 363         default :
 364                 error = EINVAL;
 365                 break;
 366         }
 367         RWLOCK_EXIT(&ipf_solaris);
 368         return error;
 369 }
 370
 371
 372 ill_t   *get_unit(name, v)
 373 char    *name;
 374 int     v;
 375 {
 376         size_t len = strlen(name) + 1;  /* includes \0 */
 377         ill_t *il;
 378         int sap;
 379
 380         if (v == 4)
 381                 sap = 0x0800;
 382         else if (v == 6)
 383                 sap = 0x86dd;
 384         else
 385                 return NULL;
 386         for (il = ill_g_head; il; il = il->ill_next)
 387                 if ((len == il->ill_name_length) && (il->ill_sap == sap) &&
 388                     !strncmp(il->ill_name, name, len))
 389                         return il;
 390         return NULL;
 391 }
 392
 393
 394 static int frrequest(unit, req, data, set)
 395 minor_t unit;
 396 int req, set;
 397 caddr_t data;
 398 {
 399         register frentry_t *fp, *f, **fprev;
 400         register frentry_t **ftail;
 401         frgroup_t *fg = NULL;
 402         int error = 0, in, i;
 403         u_int *p, *pp;
 404         frdest_t *fdp;
 405         frentry_t fr;
 406         u_32_t group;
 407         ipif_t *ipif;
 408         ill_t *ill;
 409         ire_t *ire;
 410
 411         fp = &fr;
 412         error = IRCOPYPTR(data, (caddr_t)fp, sizeof(*fp));
 413         if (error)
 414                 return EFAULT;
 415         fp->fr_ref = 0;
 416 #if SOLARIS2 >= 8
 417         if (fp->fr_v == 4)
 418                 fp->fr_sap = IP_DL_SAP;
 419         else if (fp->fr_v == 6)
 420                 fp->fr_sap = IP6_DL_SAP;
 421         else
 422                 return EINVAL;
 423 #else
 424         fp->fr_sap = 0;
 425 #endif
 426
 427         WRITE_ENTER(&ipf_mutex);
 428         /*
 429          * Check that the group number does exist and that if a head group
 430          * has been specified, doesn't exist.
 431          */
 432         if ((req != SIOCZRLST) && ((req == SIOCINAFR) || (req == SIOCINIFR) ||
 433              (req == SIOCADAFR) || (req == SIOCADIFR)) && fp->fr_grhead &&
 434             fr_findgroup(fp->fr_grhead, fp->fr_flags, unit, set, NULL)) {
 435                 error = EEXIST;
 436                 goto out;
 437         }
 438         if ((req != SIOCZRLST) && fp->fr_group &&
 439             !fr_findgroup(fp->fr_group, fp->fr_flags, unit, set, NULL)) {
 440                 error = ESRCH;
 441                 goto out;
 442         }
 443
 444         in = (fp->fr_flags & FR_INQUE) ? 0 : 1;
 445
 446         if (unit == IPL_LOGAUTH)
 447                 ftail = fprev = &ipauth;
 448         else if ((fp->fr_flags & FR_ACCOUNT) && (fp->fr_v == 4))
 449                 ftail = fprev = &ipacct[in][set];
 450         else if ((fp->fr_flags & (FR_OUTQUE|FR_INQUE)) && (fp->fr_v == 4))
 451                 ftail = fprev = &ipfilter[in][set];
 452 #ifdef  USE_INET6
 453         else if ((fp->fr_flags & FR_ACCOUNT) && (fp->fr_v == 6))
 454                 ftail = fprev = &ipacct6[in][set];
 455         else if ((fp->fr_flags & (FR_OUTQUE|FR_INQUE)) && (fp->fr_v == 6))
 456                 ftail = fprev = &ipfilter6[in][set];
 457 #endif
 458         else {
 459                 error = ESRCH;
 460                 goto out;
 461         }
 462
 463         group = fp->fr_group;
 464         if (group != 0) {
 465                 fg = fr_findgroup(group, fp->fr_flags, unit, set, NULL);
 466                 if (fg == NULL) {
 467                         error = ESRCH;
 468                         goto out;
 469                 }
 470                 ftail = fprev = fg->fg_start;
 471         }
 472
 473         bzero((char *)frcache, sizeof(frcache[0]) * 2);
 474
 475         for (i = 0; i < 4; i++) {
 476                 if ((fp->fr_ifnames[i][1] == '\0') &&
 477                     ((fp->fr_ifnames[i][0] == '-') ||
 478                      (fp->fr_ifnames[i][0] == '*'))) {
 479                         fp->fr_ifas[i] = NULL;
 480                 } else if (*fp->fr_ifnames[i]) {
 481                         fp->fr_ifas[i] = GETUNIT(fp->fr_ifnames[i], fp->fr_v);
 482                         if (!fp->fr_ifas[i])
 483                                 fp->fr_ifas[i] = (void *)-1;
 484                 }
 485         }
 486
 487         fdp = &fp->fr_dif;
 488         fdp->fd_mp = NULL;
 489         fp->fr_flags &= ~FR_DUP;
 490         if (*fdp->fd_ifname) {
 491                 ill = get_unit(fdp->fd_ifname, (int)fp->fr_v);
 492                 if (!ill)
 493                         ire = (ire_t *)-1;
 494                 else if ((ipif = ill->ill_ipif) && (fp->fr_v == 4)) {
 495 #if SOLARIS2 > 5
 496                         ire = ire_ctable_lookup(ipif->ipif_local_addr, 0,
 497                                                 IRE_LOCAL, NULL, NULL,
 498                                                 MATCH_IRE_TYPE);
 499 #else
 500                         ire = ire_lookup_myaddr(ipif->ipif_local_addr);
 501 #endif
 502                         if (!ire)
 503                                 ire = (ire_t *)-1;
 504                         else
 505                                 fp->fr_flags |= FR_DUP;
 506                 }
 507 #ifdef  USE_INET6
 508                 else if ((ipif = ill->ill_ipif) && (fp->fr_v == 6)) {
 509                         ire = ire_ctable_lookup_v6(&ipif->ipif_v6lcl_addr, 0,
 510                                                    IRE_LOCAL, NULL, NULL,
 511                                                    MATCH_IRE_TYPE);
 512                         if (!ire)
 513                                 ire = (ire_t *)-1;
 514                         else
 515                                 fp->fr_flags |= FR_DUP;
 516                 }
 517 #endif
 518                 fdp->fd_ifp = (struct ifnet *)ire;
 519         }
 520
 521         fdp = &fp->fr_tif;
 522         fdp->fd_mp = NULL;
 523         if (*fdp->fd_ifname) {
 524                 ill = get_unit(fdp->fd_ifname, (int)fp->fr_v);
 525                 if (!ill)
 526                         ire = (ire_t *)-1;
 527                 else if ((ipif = ill->ill_ipif) && (fp->fr_v == 4)) {
 528 #if SOLARIS2 > 5
 529                         ire = ire_ctable_lookup(ipif->ipif_local_addr, 0,
 530                                                 IRE_LOCAL, NULL, NULL,
 531                                                 MATCH_IRE_TYPE);
 532 #else
 533                         ire = ire_lookup_myaddr(ipif->ipif_local_addr);
 534 #endif
 535                         if (!ire)
 536                                 ire = (ire_t *)-1;
 537                 }
 538 #ifdef  USE_INET6
 539                 else if ((ipif = ill->ill_ipif) && (fp->fr_v == 6)) {
 540                         ire = ire_ctable_lookup_v6(&ipif->ipif_v6lcl_addr, 0,
 541                                                    IRE_LOCAL, NULL, NULL,
 542                                                    MATCH_IRE_TYPE);
 543                         if (!ire)
 544                                 ire = (ire_t *)-1;
 545                 }
 546 #endif
 547                 fdp->fd_ifp = (struct ifnet *)ire;
 548         }
 549
 550         /*
 551          * Look for a matching filter rule, but don't include the next or
 552          * interface pointer in the comparison (fr_next, fr_ifa).
 553          */
 554         for (fp->fr_cksum = 0, p = (u_int *)&fp->fr_ip, pp = &fp->fr_cksum;
 555              p < pp; p++)
 556                 fp->fr_cksum += *p;
 557
 558         for (; (f = *ftail); ftail = &f->fr_next)
 559                 if ((fp->fr_cksum == f->fr_cksum) &&
 560                     !bcmp((char *)&f->fr_ip, (char *)&fp->fr_ip, FR_CMPSIZ))
 561                         break;
 562
 563         /*
 564          * If zero'ing statistics, copy current to caller and zero.
 565          */
 566         if (req == SIOCZRLST) {
 567                 if (!f) {
 568                         error = ESRCH;
 569                         goto out;
 570                 }
 571                 MUTEX_DOWNGRADE(&ipf_mutex);
 572                 error = IWCOPYPTR((caddr_t)f, data, sizeof(*f));
 573                 if (error)
 574                         goto out;
 575                 f->fr_hits = 0;
 576                 f->fr_bytes = 0;
 577                 goto out;
 578         }
 579
 580         if (!f) {
 581                 if (req != SIOCINAFR && req != SIOCINIFR)
 582                         while ((f = *ftail))
 583                                 ftail = &f->fr_next;
 584                 else {
 585                         if (fp->fr_hits) {
 586                                 ftail = fprev;
 587                                 while (--fp->fr_hits && (f = *ftail))
 588                                         ftail = &f->fr_next;
 589                         }
 590                         f = NULL;
 591                 }
 592         }
 593
 594         if (req == SIOCRMAFR || req == SIOCRMIFR) {
 595                 if (!f)
 596                         error = ESRCH;
 597                 else {
 598                         /*
 599                          * Only return EBUSY if there is a group list, else
 600                          * it's probably just state information referencing
 601                          * the rule.
 602                          */
 603                         if ((f->fr_ref > 1) && f->fr_grp) {
 604                                 error = EBUSY;
 605                                 goto out;
 606                         }
 607                         if (fg && fg->fg_head)
 608                                 fg->fg_head->fr_ref--;
 609                         if (f->fr_grhead)
 610                                 fr_delgroup(f->fr_grhead, fp->fr_flags,
 611                                             unit, set);
 612                         fixskip(fprev, f, -1);
 613                         *ftail = f->fr_next;
 614                         f->fr_next = NULL;
 615                         f->fr_ref--;
 616                         if (f->fr_ref == 0)
 617                                 KFREE(f);
 618                 }
 619         } else {
 620                 if (f) {
 621                         error = EEXIST;
 622                 } else {
 623                         KMALLOC(f, frentry_t *);
 624                         if (f != NULL) {
 625                                 if (fg && fg->fg_head)
 626                                         fg->fg_head->fr_ref++;
 627                                 bcopy((char *)fp, (char *)f, sizeof(*f));
 628                                 f->fr_ref = 1;
 629                                 f->fr_hits = 0;
 630                                 f->fr_next = *ftail;
 631                                 *ftail = f;
 632                                 if (req == SIOCINIFR || req == SIOCINAFR)
 633                                         fixskip(fprev, f, 1);
 634                                 f->fr_grp = NULL;
 635                                 group = f->fr_grhead;
 636                                 if (group != 0)
 637                                         fg = fr_addgroup(group, f, unit, set);
 638                         } else
 639                                 error = ENOMEM;
 640                 }
 641         }
 642 out:
 643         RWLOCK_EXIT(&ipf_mutex);
 644         return (error);
 645 }
 646
 647
 648 /*
 649  * routines below for saving IP headers to buffer
 650  */
 651 int iplopen(devp, flags, otype, cred)
 652 dev_t *devp;
 653 int flags, otype;
 654 cred_t *cred;
 655 {
 656         minor_t min = getminor(*devp);
 657
 658 #ifdef  IPFDEBUG
 659         cmn_err(CE_CONT, "iplopen(%x,%x,%x,%x)\n", devp, flags, otype, cred);
 660 #endif
 661         if ((fr_running <= 0) || !(otype & OTYP_CHR))
 662                 return ENXIO;
 663         min = (IPL_LOGMAX < min) ? ENXIO : 0;
 664         return min;
 665 }
 666
 667
 668 int iplclose(dev, flags, otype, cred)
 669 dev_t dev;
 670 int flags, otype;
 671 cred_t *cred;
 672 {
 673         minor_t min = getminor(dev);
 674
 675 #ifdef  IPFDEBUG
 676         cmn_err(CE_CONT, "iplclose(%x,%x,%x,%x)\n", dev, flags, otype, cred);
 677 #endif
 678         min = (IPL_LOGMAX < min) ? ENXIO : 0;
 679         return min;
 680 }
 681
 682 #ifdef  IPFILTER_LOG
 683 /*
 684  * iplread/ipllog
 685  * both of these must operate with at least splnet() lest they be
 686  * called during packet processing and cause an inconsistancy to appear in
 687  * the filter lists.
 688  */
 689 int iplread(dev, uio, cp)
 690 dev_t dev;
 691 register struct uio *uio;
 692 cred_t *cp;
 693 {
 694 #ifdef  IPFDEBUG
 695         cmn_err(CE_CONT, "iplread(%x,%x,%x)\n", dev, uio, cp);
 696 #endif
 697         return ipflog_read(getminor(dev), uio);
 698 }
 699 #endif /* IPFILTER_LOG */
 700
 701
 702 /*
 703  * send_reset - this could conceivably be a call to tcp_respond(), but that
 704  * requires a large amount of setting up and isn't any more efficient.
 705  */
 706 int send_reset(oip, fin)
 707 ip_t *oip;
 708 fr_info_t *fin;
 709 {
 710         tcphdr_t *tcp, *tcp2;
 711         int tlen, hlen;
 712         mblk_t *m;
 713 #ifdef  USE_INET6
 714         ip6_t *ip6, *oip6 = (ip6_t *)oip;
 715 #endif
 716         ip_t *ip;
 717
 718         tcp = (struct tcphdr *)fin->fin_dp;
 719         if (tcp->th_flags & TH_RST)
 720                 return -1;
 721         tlen = (tcp->th_flags & (TH_SYN|TH_FIN)) ? 1 : 0;
 722 #ifdef  USE_INET6
 723         if (fin->fin_v == 6)
 724                 hlen = sizeof(ip6_t);
 725         else
 726 #endif
 727                 hlen = sizeof(ip_t);
 728         hlen += sizeof(*tcp2);
 729         if ((m = (mblk_t *)allocb(hlen + 16, BPRI_HI)) == NULL)
 730                 return -1;
 731
 732         m->b_rptr += 16;
 733         MTYPE(m) = M_DATA;
 734         m->b_wptr = m->b_rptr + hlen;
 735         bzero((char *)m->b_rptr, hlen);
 736         tcp2 = (struct tcphdr *)(m->b_rptr + hlen - sizeof(*tcp2));
 737         tcp2->th_dport = tcp->th_sport;
 738         tcp2->th_sport = tcp->th_dport;
 739         if (tcp->th_flags & TH_ACK) {
 740                 tcp2->th_seq = tcp->th_ack;
 741                 tcp2->th_flags = TH_RST|TH_ACK;
 742         } else {
 743                 tcp2->th_ack = ntohl(tcp->th_seq);
 744                 tcp2->th_ack += tlen;
 745                 tcp2->th_ack = htonl(tcp2->th_ack);
 746                 tcp2->th_flags = TH_RST;
 747         }
 748         tcp2->th_off = sizeof(struct tcphdr) >> 2;
 749         tcp2->th_flags = TH_RST|TH_ACK;
 750
 751         /*
 752          * This is to get around a bug in the Solaris 2.4/2.5 TCP checksum
 753          * computation that is done by their put routine.
 754          */
 755         tcp2->th_sum = htons(0x14);
 756 #ifdef  USE_INET6
 757         if (fin->fin_v == 6) {
 758                 ip6 = (ip6_t *)m->b_rptr;
 759                 ip6->ip6_src = oip6->ip6_dst;
 760                 ip6->ip6_dst = oip6->ip6_src;
 761                 ip6->ip6_plen = htons(sizeof(*tcp));
 762                 ip6->ip6_nxt = IPPROTO_TCP;
 763         } else
 764 #endif
 765         {
 766                 ip = (ip_t *)m->b_rptr;
 767                 ip->ip_src.s_addr = oip->ip_dst.s_addr;
 768                 ip->ip_dst.s_addr = oip->ip_src.s_addr;
 769                 ip->ip_hl = sizeof(*ip) >> 2;
 770                 ip->ip_p = IPPROTO_TCP;
 771                 ip->ip_len = htons(sizeof(*ip) + sizeof(*tcp));
 772                 ip->ip_tos = oip->ip_tos;
 773         }
 774         return send_ip(fin, m);
 775 }
 776
 777
 778 int static send_ip(fin, m)
 779 fr_info_t *fin;
 780 mblk_t *m;
 781 {
 782         RWLOCK_EXIT(&ipfs_mutex);
 783         RWLOCK_EXIT(&ipf_solaris);
 784 #ifdef  USE_INET6
 785         if (fin->fin_v == 6) {
 786                 extern void ip_wput_v6 __P((queue_t *, mblk_t *));
 787                 ip6_t *ip6;
 788
 789                 ip6 = (ip6_t *)m->b_rptr;
 790                 ip6->ip6_flow = 0;
 791                 ip6->ip6_vfc = 0x60;
 792                 ip6->ip6_hlim = 127;
 793                 ip_wput_v6(((qif_t *)fin->fin_qif)->qf_ill->ill_wq, m);
 794         } else
 795 #endif
 796         {
 797                 ip_t *ip;
 798
 799                 ip = (ip_t *)m->b_rptr;
 800                 ip->ip_v = IPVERSION;
 801                 ip->ip_ttl = (u_char)(*ip_ttl_ptr);
 802                 ip_wput(((qif_t *)fin->fin_qif)->qf_ill->ill_wq, m);
 803         }
 804         READ_ENTER(&ipf_solaris);
 805         READ_ENTER(&ipfs_mutex);
 806         return 0;
 807 }
 808
 809
 810 int send_icmp_err(oip, type, fin, dst)
 811 ip_t *oip;
 812 int type;
 813 fr_info_t *fin;
 814 int dst;
 815 {
 816         struct in_addr dst4;
 817         struct icmp *icmp;
 818         mblk_t *m, *mb;
 819         int hlen, code;
 820         qif_t *qif;
 821         u_short sz;
 822         ill_t *il;
 823 #ifdef  USE_INET6
 824         ip6_t *ip6, *oip6;
 825 #endif
 826         ip_t *ip;
 827
 828         if ((type < 0) || (type > ICMP_MAXTYPE))
 829                 return -1;
 830
 831         code = fin->fin_icode;
 832 #ifdef USE_INET6
 833         if ((code < 0) || (code > sizeof(icmptoicmp6unreach)/sizeof(int)))
 834                 return -1;
 835 #endif
 836
 837         qif = fin->fin_qif;
 838         m = fin->fin_qfm;
 839
 840 #ifdef  USE_INET6
 841         if (oip->ip_v == 6) {
 842                 oip6 = (ip6_t *)oip;
 843                 sz = sizeof(ip6_t);
 844                 sz += MIN(m->b_wptr - m->b_rptr, 512);
 845                 hlen = sizeof(ip6_t);
 846                 type = icmptoicmp6types[type];
 847                 if (type == ICMP6_DST_UNREACH)
 848                         code = icmptoicmp6unreach[code];
 849         } else
 850 #endif
 851         {
 852                 if ((oip->ip_p == IPPROTO_ICMP) &&
 853                     !(fin->fin_fi.fi_fl & FI_SHORT))
 854                         switch (ntohs(fin->fin_data[0]) >> 8)
 855                         {
 856                         case ICMP_ECHO :
 857                         case ICMP_TSTAMP :
 858                         case ICMP_IREQ :
 859                         case ICMP_MASKREQ :
 860                                 break;
 861                         default :
 862                                 return 0;
 863                         }
 864
 865                 sz = sizeof(ip_t) * 2;
 866                 sz += 8;                /* 64 bits of data */
 867                 hlen = sz;
 868         }
 869
 870         sz += offsetof(struct icmp, icmp_ip);
 871         if ((mb = (mblk_t *)allocb((size_t)sz + 16, BPRI_HI)) == NULL)
 872                 return -1;
 873         MTYPE(mb) = M_DATA;
 874         mb->b_rptr += 16;
 875         mb->b_wptr = mb->b_rptr + sz;
 876         bzero((char *)mb->b_rptr, (size_t)sz);
 877         icmp = (struct icmp *)(mb->b_rptr + sizeof(*ip));
 878         icmp->icmp_type = type;
 879         icmp->icmp_code = code;
 880         icmp->icmp_cksum = 0;
 881 #ifdef  icmp_nextmtu
 882         if (type == ICMP_UNREACH && (il = qif->qf_ill) &&
 883             fin->fin_icode == ICMP_UNREACH_NEEDFRAG)
 884                 icmp->icmp_nextmtu = htons(il->ill_max_frag);
 885 #endif
 886
 887 #ifdef  USE_INET6
 888         if (oip->ip_v == 6) {
 889                 struct in6_addr dst6;
 890                 int csz;
 891
 892                 if (dst == 0) {
 893                         if (fr_ifpaddr(6, ((qif_t *)fin->fin_qif)->qf_ill,
 894                                        (struct in_addr *)&dst6) == -1)
 895                                 return -1;
 896                 } else
 897                         dst6 = oip6->ip6_dst;
 898
 899                 csz = sz;
 900                 sz -= sizeof(ip6_t);
 901                 ip6 = (ip6_t *)mb->b_rptr;
 902                 ip6->ip6_flow = 0;
 903                 ip6->ip6_vfc = 0x60;
 904                 ip6->ip6_hlim = 127;
 905                 ip6->ip6_plen = htons(sz);
 906                 ip6->ip6_nxt = IPPROTO_ICMPV6;
 907                 ip6->ip6_src = dst6;
 908                 ip6->ip6_dst = oip6->ip6_src;
 909                 sz -= offsetof(struct icmp, icmp_ip);
 910                 bcopy((char *)m->b_rptr, (char *)&icmp->icmp_ip, sz);
 911                 icmp->icmp_cksum = csz - sizeof(ip6_t);
 912         } else
 913 #endif
 914         {
 915                 ip = (ip_t *)mb->b_rptr;
 916                 ip->ip_v = IPVERSION;
 917                 ip->ip_hl = (sizeof(*ip) >> 2);
 918                 ip->ip_p = IPPROTO_ICMP;
 919                 ip->ip_id = oip->ip_id;
 920                 ip->ip_sum = 0;
 921                 ip->ip_ttl = (u_char)(*ip_ttl_ptr);
 922                 ip->ip_tos = oip->ip_tos;
 923                 ip->ip_len = (u_short)htons(sz);
 924                 if (dst == 0) {
 925                         if (fr_ifpaddr(4, ((qif_t *)fin->fin_qif)->qf_ill,
 926                                        &dst4) == -1)
 927                                 return -1;
 928                 } else
 929                         dst4 = oip->ip_dst;
 930                 ip->ip_src = dst4;
 931                 ip->ip_dst = oip->ip_src;
 932                 bcopy((char *)oip, (char *)&icmp->icmp_ip, sizeof(*oip));
 933                 bcopy((char *)oip + (oip->ip_hl << 2),
 934                       (char *)&icmp->icmp_ip + sizeof(*oip), 8);
 935                 icmp->icmp_cksum = ipf_cksum((u_short *)icmp,
 936                                              sizeof(*icmp) + 8);
 937         }
 938
 939         /*
 940          * Need to exit out of these so we don't recursively call rw_enter
 941          * from fr_qout.
 942          */
 943         return send_ip(fin, mb);
 944 }