sys/contrib/ipfilter/netinet/fil.c

   1 /*      $FreeBSD$       */
   2
   3 /*
   4  * Copyright (C) 2012 by Darren Reed.
   5  *
   6  * See the IPFILTER.LICENCE file for details on licencing.
   7  *
   8  * Copyright 2008 Sun Microsystems.
   9  *
  10  * $Id$
  11  *
  12  */
  13 #if defined(KERNEL) || defined(_KERNEL)
  14 # undef KERNEL
  15 # undef _KERNEL
  16 # define        KERNEL  1
  17 # define        _KERNEL 1
  18 #endif
  19 #include <sys/errno.h>
  20 #include <sys/types.h>
  21 #include <sys/param.h>
  22 #include <sys/time.h>
  23 #if defined(_KERNEL) && defined(__FreeBSD_version) && \
  24     (__FreeBSD_version >= 220000)
  25 # if (__FreeBSD_version >= 400000)
  26 #  if !defined(IPFILTER_LKM)
  27 #   include "opt_inet6.h"
  28 #  endif
  29 #  if (__FreeBSD_version == 400019)
  30 #   define CSUM_DELAY_DATA
  31 #  endif
  32 # endif
  33 # include <sys/filio.h>
  34 #else
  35 # include <sys/ioctl.h>
  36 #endif
  37 #if (defined(__SVR4) || defined(__svr4__)) && defined(sun)
  38 # include <sys/filio.h>
  39 #endif
  40 #if !defined(_AIX51)
  41 # include <sys/fcntl.h>
  42 #endif
  43 #if defined(_KERNEL)
  44 # include <sys/systm.h>
  45 # include <sys/file.h>
  46 #else
  47 # include <stdio.h>
  48 # include <string.h>
  49 # include <stdlib.h>
  50 # include <stddef.h>
  51 # include <sys/file.h>
  52 # define _KERNEL
  53 # ifdef __OpenBSD__
  54 struct file;
  55 # endif
  56 # include <sys/uio.h>
  57 # undef _KERNEL
  58 #endif
  59 #if !defined(__SVR4) && !defined(__svr4__) && !defined(__hpux) && \
  60     !defined(linux)
  61 # include <sys/mbuf.h>
  62 #else
  63 # if !defined(linux)
  64 #  include <sys/byteorder.h>
  65 # endif
  66 # if (SOLARIS2 < 5) && defined(sun)
  67 #  include <sys/dditypes.h>
  68 # endif
  69 #endif
  70 #ifdef __hpux
  71 # define _NET_ROUTE_INCLUDED
  72 #endif
  73 #if !defined(linux)
  74 # include <sys/protosw.h>
  75 #endif
  76 #include <sys/socket.h>
  77 #include <net/if.h>
  78 #ifdef sun
  79 # include <net/af.h>
  80 #endif
  81 #include <netinet/in.h>
  82 #include <netinet/in_systm.h>
  83 #include <netinet/ip.h>
  84 #if defined(__sgi) && defined(IFF_DRVRLOCK) /* IRIX 6 */
  85 # include <sys/hashing.h>
  86 # include <netinet/in_var.h>
  87 #endif
  88 #include <netinet/tcp.h>
  89 #if (!defined(__sgi) && !defined(AIX)) || defined(_KERNEL)
  90 # include <netinet/udp.h>
  91 # include <netinet/ip_icmp.h>
  92 #endif
  93 #ifdef __hpux
  94 # undef _NET_ROUTE_INCLUDED
  95 #endif
  96 #ifdef __osf__
  97 # undef _RADIX_H_
  98 #endif
  99 #include "netinet/ip_compat.h"
 100 #ifdef  USE_INET6
 101 # include <netinet/icmp6.h>
 102 # if !SOLARIS && defined(_KERNEL) && !defined(__osf__) && !defined(__hpux)
 103 #  include <netinet6/in6_var.h>
 104 # endif
 105 #endif
 106 #include "netinet/ip_fil.h"
 107 #include "netinet/ip_nat.h"
 108 #include "netinet/ip_frag.h"
 109 #include "netinet/ip_state.h"
 110 #include "netinet/ip_proxy.h"
 111 #include "netinet/ip_auth.h"
 112 #ifdef IPFILTER_SCAN
 113 # include "netinet/ip_scan.h"
 114 #endif
 115 #include "netinet/ip_sync.h"
 116 #include "netinet/ip_lookup.h"
 117 #include "netinet/ip_pool.h"
 118 #include "netinet/ip_htable.h"
 119 #ifdef IPFILTER_COMPILED
 120 # include "netinet/ip_rules.h"
 121 #endif
 122 #if defined(IPFILTER_BPF) && defined(_KERNEL)
 123 # include <net/bpf.h>
 124 #endif
 125 #if defined(__FreeBSD_version) && (__FreeBSD_version >= 300000)
 126 # include <sys/malloc.h>
 127 #endif
 128 #include "netinet/ipl.h"
 129
 130 #if defined(__NetBSD__) && (__NetBSD_Version__ >= 104230000)
 131 # include <sys/callout.h>
 132 extern struct callout ipf_slowtimer_ch;
 133 #endif
 134 #if defined(__OpenBSD__)
 135 # include <sys/timeout.h>
 136 extern struct timeout ipf_slowtimer_ch;
 137 #endif
 138 /* END OF INCLUDES */
 139
 140 #if !defined(lint)
 141 static const char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-2000 Darren Reed";
 142 static const char rcsid[] = "@(#)$FreeBSD$";
 143 /* static const char rcsid[] = "@(#)$Id: fil.c,v 2.243.2.125 2007/10/10 09:27:20 darrenr Exp $"; */
 144 #endif
 145
 146 #ifndef _KERNEL
 147 # include "ipf.h"
 148 # include "ipt.h"
 149 extern  int     opts;
 150 extern  int     blockreason;
 151 #endif /* _KERNEL */
 152
 153 #define LBUMP(x)        softc->x++
 154 #define LBUMPD(x, y)    do { softc->x.y++; DT(y); } while (0)
 155
 156 static  INLINE int      ipf_check_ipf __P((fr_info_t *, frentry_t *, int));
 157 static  u_32_t          ipf_checkcipso __P((fr_info_t *, u_char *, int));
 158 static  u_32_t          ipf_checkripso __P((u_char *));
 159 static  u_32_t          ipf_decaps __P((fr_info_t *, u_32_t, int));
 160 #ifdef IPFILTER_LOG
 161 static  frentry_t       *ipf_dolog __P((fr_info_t *, u_32_t *));
 162 #endif
 163 static  int             ipf_flushlist __P((ipf_main_softc_t *, int *,
 164                                            frentry_t **));
 165 static  int             ipf_flush_groups __P((ipf_main_softc_t *, frgroup_t **,
 166                                               int));
 167 static  ipfunc_t        ipf_findfunc __P((ipfunc_t));
 168 static  void            *ipf_findlookup __P((ipf_main_softc_t *, int,
 169                                              frentry_t *,
 170                                              i6addr_t *, i6addr_t *));
 171 static  frentry_t       *ipf_firewall __P((fr_info_t *, u_32_t *));
 172 static  int             ipf_fr_matcharray __P((fr_info_t *, int *));
 173 static  int             ipf_frruleiter __P((ipf_main_softc_t *, void *, int,
 174                                             void *));
 175 static  void            ipf_funcfini __P((ipf_main_softc_t *, frentry_t *));
 176 static  int             ipf_funcinit __P((ipf_main_softc_t *, frentry_t *));
 177 static  int             ipf_geniter __P((ipf_main_softc_t *, ipftoken_t *,
 178                                          ipfgeniter_t *));
 179 static  void            ipf_getstat __P((ipf_main_softc_t *,
 180                                          struct friostat *, int));
 181 static  int             ipf_group_flush __P((ipf_main_softc_t *, frgroup_t *));
 182 static  void            ipf_group_free __P((frgroup_t *));
 183 static  int             ipf_grpmapfini __P((struct ipf_main_softc_s *,
 184                                             frentry_t *));
 185 static  int             ipf_grpmapinit __P((struct ipf_main_softc_s *,
 186                                             frentry_t *));
 187 static  frentry_t       *ipf_nextrule __P((ipf_main_softc_t *, int, int,
 188                                            frentry_t *, int));
 189 static  int             ipf_portcheck __P((frpcmp_t *, u_32_t));
 190 static  INLINE int      ipf_pr_ah __P((fr_info_t *));
 191 static  INLINE void     ipf_pr_esp __P((fr_info_t *));
 192 static  INLINE void     ipf_pr_gre __P((fr_info_t *));
 193 static  INLINE void     ipf_pr_udp __P((fr_info_t *));
 194 static  INLINE void     ipf_pr_tcp __P((fr_info_t *));
 195 static  INLINE void     ipf_pr_icmp __P((fr_info_t *));
 196 static  INLINE void     ipf_pr_ipv4hdr __P((fr_info_t *));
 197 static  INLINE void     ipf_pr_short __P((fr_info_t *, int));
 198 static  INLINE int      ipf_pr_tcpcommon __P((fr_info_t *));
 199 static  INLINE int      ipf_pr_udpcommon __P((fr_info_t *));
 200 static  void            ipf_rule_delete __P((ipf_main_softc_t *, frentry_t *f,
 201                                              int, int));
 202 static  void            ipf_rule_expire_insert __P((ipf_main_softc_t *,
 203                                                     frentry_t *, int));
 204 static  int             ipf_synclist __P((ipf_main_softc_t *, frentry_t *,
 205                                           void *));
 206 static  void            ipf_token_flush __P((ipf_main_softc_t *));
 207 static  void            ipf_token_unlink __P((ipf_main_softc_t *,
 208                                               ipftoken_t *));
 209 static  ipftuneable_t   *ipf_tune_findbyname __P((ipftuneable_t *,
 210                                                   const char *));
 211 static  ipftuneable_t   *ipf_tune_findbycookie __P((ipftuneable_t **, void *,
 212                                                     void **));
 213 static  int             ipf_updateipid __P((fr_info_t *));
 214 static  int             ipf_settimeout __P((struct ipf_main_softc_s *,
 215                                             struct ipftuneable *,
 216                                             ipftuneval_t *));
 217 #if !defined(_KERNEL) || (!defined(__NetBSD__) && !defined(__OpenBSD__) && \
 218      !defined(__FreeBSD__)) || \
 219     FREEBSD_LT_REV(501000) || NETBSD_LT_REV(105000000) || \
 220     OPENBSD_LT_REV(200006)
 221 static  int             ppsratecheck(struct timeval *, int *, int);
 222 #endif
 223
 224
 225 /*
 226  * bit values for identifying presence of individual IP options
 227  * All of these tables should be ordered by increasing key value on the left
 228  * hand side to allow for binary searching of the array and include a trailer
 229  * with a 0 for the bitmask for linear searches to easily find the end with.
 230  */
 231 static const    struct  optlist ipopts[20] = {
 232         { IPOPT_NOP,    0x000001 },
 233         { IPOPT_RR,     0x000002 },
 234         { IPOPT_ZSU,    0x000004 },
 235         { IPOPT_MTUP,   0x000008 },
 236         { IPOPT_MTUR,   0x000010 },
 237         { IPOPT_ENCODE, 0x000020 },
 238         { IPOPT_TS,     0x000040 },
 239         { IPOPT_TR,     0x000080 },
 240         { IPOPT_SECURITY, 0x000100 },
 241         { IPOPT_LSRR,   0x000200 },
 242         { IPOPT_E_SEC,  0x000400 },
 243         { IPOPT_CIPSO,  0x000800 },
 244         { IPOPT_SATID,  0x001000 },
 245         { IPOPT_SSRR,   0x002000 },
 246         { IPOPT_ADDEXT, 0x004000 },
 247         { IPOPT_VISA,   0x008000 },
 248         { IPOPT_IMITD,  0x010000 },
 249         { IPOPT_EIP,    0x020000 },
 250         { IPOPT_FINN,   0x040000 },
 251         { 0,            0x000000 }
 252 };
 253
 254 #ifdef USE_INET6
 255 static const struct optlist ip6exthdr[] = {
 256         { IPPROTO_HOPOPTS,              0x000001 },
 257         { IPPROTO_IPV6,                 0x000002 },
 258         { IPPROTO_ROUTING,              0x000004 },
 259         { IPPROTO_FRAGMENT,             0x000008 },
 260         { IPPROTO_ESP,                  0x000010 },
 261         { IPPROTO_AH,                   0x000020 },
 262         { IPPROTO_NONE,                 0x000040 },
 263         { IPPROTO_DSTOPTS,              0x000080 },
 264         { IPPROTO_MOBILITY,             0x000100 },
 265         { 0,                            0 }
 266 };
 267 #endif
 268
 269 /*
 270  * bit values for identifying presence of individual IP security options
 271  */
 272 static const    struct  optlist secopt[8] = {
 273         { IPSO_CLASS_RES4,      0x01 },
 274         { IPSO_CLASS_TOPS,      0x02 },
 275         { IPSO_CLASS_SECR,      0x04 },
 276         { IPSO_CLASS_RES3,      0x08 },
 277         { IPSO_CLASS_CONF,      0x10 },
 278         { IPSO_CLASS_UNCL,      0x20 },
 279         { IPSO_CLASS_RES2,      0x40 },
 280         { IPSO_CLASS_RES1,      0x80 }
 281 };
 282
 283 char    ipfilter_version[] = IPL_VERSION;
 284
 285 int     ipf_features = 0
 286 #ifdef  IPFILTER_LKM
 287                 | IPF_FEAT_LKM
 288 #endif
 289 #ifdef  IPFILTER_LOG
 290                 | IPF_FEAT_LOG
 291 #endif
 292                 | IPF_FEAT_LOOKUP
 293 #ifdef  IPFILTER_BPF
 294                 | IPF_FEAT_BPF
 295 #endif
 296 #ifdef  IPFILTER_COMPILED
 297                 | IPF_FEAT_COMPILED
 298 #endif
 299 #ifdef  IPFILTER_CKSUM
 300                 | IPF_FEAT_CKSUM
 301 #endif
 302                 | IPF_FEAT_SYNC
 303 #ifdef  IPFILTER_SCAN
 304                 | IPF_FEAT_SCAN
 305 #endif
 306 #ifdef  USE_INET6
 307                 | IPF_FEAT_IPV6
 308 #endif
 309         ;
 310
 311
 312 /*
 313  * Table of functions available for use with call rules.
 314  */
 315 static ipfunc_resolve_t ipf_availfuncs[] = {
 316         { "srcgrpmap", ipf_srcgrpmap, ipf_grpmapinit, ipf_grpmapfini },
 317         { "dstgrpmap", ipf_dstgrpmap, ipf_grpmapinit, ipf_grpmapfini },
 318         { "",         NULL,           NULL,           NULL }
 319 };
 320
 321 static ipftuneable_t ipf_main_tuneables[] = {
 322         { { (void *)offsetof(struct ipf_main_softc_s, ipf_flags) },
 323                 "ipf_flags",            0,      0xffffffff,
 324                 stsizeof(ipf_main_softc_t, ipf_flags),
 325                 0,                      NULL,   NULL },
 326         { { (void *)offsetof(struct ipf_main_softc_s, ipf_active) },
 327                 "active",               0,      0,
 328                 stsizeof(ipf_main_softc_t, ipf_active),
 329                 IPFT_RDONLY,            NULL,   NULL },
 330         { { (void *)offsetof(ipf_main_softc_t, ipf_control_forwarding) },
 331                 "control_forwarding",   0, 1,
 332                 stsizeof(ipf_main_softc_t, ipf_control_forwarding),
 333                 0,                      NULL,   NULL },
 334         { { (void *)offsetof(ipf_main_softc_t, ipf_update_ipid) },
 335                 "update_ipid",          0,      1,
 336                 stsizeof(ipf_main_softc_t, ipf_update_ipid),
 337                 0,                      NULL,   NULL },
 338         { { (void *)offsetof(ipf_main_softc_t, ipf_chksrc) },
 339                 "chksrc",               0,      1,
 340                 stsizeof(ipf_main_softc_t, ipf_chksrc),
 341                 0,                      NULL,   NULL },
 342         { { (void *)offsetof(ipf_main_softc_t, ipf_minttl) },
 343                 "min_ttl",              0,      1,
 344                 stsizeof(ipf_main_softc_t, ipf_minttl),
 345                 0,                      NULL,   NULL },
 346         { { (void *)offsetof(ipf_main_softc_t, ipf_icmpminfragmtu) },
 347                 "icmp_minfragmtu",      0,      1,
 348                 stsizeof(ipf_main_softc_t, ipf_icmpminfragmtu),
 349                 0,                      NULL,   NULL },
 350         { { (void *)offsetof(ipf_main_softc_t, ipf_pass) },
 351                 "default_pass",         0,      0xffffffff,
 352                 stsizeof(ipf_main_softc_t, ipf_pass),
 353                 0,                      NULL,   NULL },
 354         { { (void *)offsetof(ipf_main_softc_t, ipf_tcpidletimeout) },
 355                 "tcp_idle_timeout",     1,      0x7fffffff,
 356                 stsizeof(ipf_main_softc_t, ipf_tcpidletimeout),
 357                 0,                      NULL,   ipf_settimeout },
 358         { { (void *)offsetof(ipf_main_softc_t, ipf_tcpclosewait) },
 359                 "tcp_close_wait",       1,      0x7fffffff,
 360                 stsizeof(ipf_main_softc_t, ipf_tcpclosewait),
 361                 0,                      NULL,   ipf_settimeout },
 362         { { (void *)offsetof(ipf_main_softc_t, ipf_tcplastack) },
 363                 "tcp_last_ack",         1,      0x7fffffff,
 364                 stsizeof(ipf_main_softc_t, ipf_tcplastack),
 365                 0,                      NULL,   ipf_settimeout },
 366         { { (void *)offsetof(ipf_main_softc_t, ipf_tcptimeout) },
 367                 "tcp_timeout",          1,      0x7fffffff,
 368                 stsizeof(ipf_main_softc_t, ipf_tcptimeout),
 369                 0,                      NULL,   ipf_settimeout },
 370         { { (void *)offsetof(ipf_main_softc_t, ipf_tcpsynsent) },
 371                 "tcp_syn_sent",         1,      0x7fffffff,
 372                 stsizeof(ipf_main_softc_t, ipf_tcpsynsent),
 373                 0,                      NULL,   ipf_settimeout },
 374         { { (void *)offsetof(ipf_main_softc_t, ipf_tcpsynrecv) },
 375                 "tcp_syn_received",     1,      0x7fffffff,
 376                 stsizeof(ipf_main_softc_t, ipf_tcpsynrecv),
 377                 0,                      NULL,   ipf_settimeout },
 378         { { (void *)offsetof(ipf_main_softc_t, ipf_tcpclosed) },
 379                 "tcp_closed",           1,      0x7fffffff,
 380                 stsizeof(ipf_main_softc_t, ipf_tcpclosed),
 381                 0,                      NULL,   ipf_settimeout },
 382         { { (void *)offsetof(ipf_main_softc_t, ipf_tcphalfclosed) },
 383                 "tcp_half_closed",      1,      0x7fffffff,
 384                 stsizeof(ipf_main_softc_t, ipf_tcphalfclosed),
 385                 0,                      NULL,   ipf_settimeout },
 386         { { (void *)offsetof(ipf_main_softc_t, ipf_tcptimewait) },
 387                 "tcp_time_wait",        1,      0x7fffffff,
 388                 stsizeof(ipf_main_softc_t, ipf_tcptimewait),
 389                 0,                      NULL,   ipf_settimeout },
 390         { { (void *)offsetof(ipf_main_softc_t, ipf_udptimeout) },
 391                 "udp_timeout",          1,      0x7fffffff,
 392                 stsizeof(ipf_main_softc_t, ipf_udptimeout),
 393                 0,                      NULL,   ipf_settimeout },
 394         { { (void *)offsetof(ipf_main_softc_t, ipf_udpacktimeout) },
 395                 "udp_ack_timeout",      1,      0x7fffffff,
 396                 stsizeof(ipf_main_softc_t, ipf_udpacktimeout),
 397                 0,                      NULL,   ipf_settimeout },
 398         { { (void *)offsetof(ipf_main_softc_t, ipf_icmptimeout) },
 399                 "icmp_timeout",         1,      0x7fffffff,
 400                 stsizeof(ipf_main_softc_t, ipf_icmptimeout),
 401                 0,                      NULL,   ipf_settimeout },
 402         { { (void *)offsetof(ipf_main_softc_t, ipf_icmpacktimeout) },
 403                 "icmp_ack_timeout",     1,      0x7fffffff,
 404                 stsizeof(ipf_main_softc_t, ipf_icmpacktimeout),
 405                 0,                      NULL,   ipf_settimeout },
 406         { { (void *)offsetof(ipf_main_softc_t, ipf_iptimeout) },
 407                 "ip_timeout",           1,      0x7fffffff,
 408                 stsizeof(ipf_main_softc_t, ipf_iptimeout),
 409                 0,                      NULL,   ipf_settimeout },
 410 #if defined(INSTANCES) && defined(_KERNEL)
 411         { { (void *)offsetof(ipf_main_softc_t, ipf_get_loopback) },
 412                 "intercept_loopback",   0,      1,
 413                 stsizeof(ipf_main_softc_t, ipf_get_loopback),
 414                 0,                      NULL,   ipf_set_loopback },
 415 #endif
 416         { { 0 },
 417                 NULL,                   0,      0,
 418                 0,
 419                 0,                      NULL,   NULL }
 420 };
 421
 422
 423 /*
 424  * The next section of code is a a collection of small routines that set
 425  * fields in the fr_info_t structure passed based on properties of the
 426  * current packet.  There are different routines for the same protocol
 427  * for each of IPv4 and IPv6.  Adding a new protocol, for which there
 428  * will "special" inspection for setup, is now more easily done by adding
 429  * a new routine and expanding the ipf_pr_ipinit*() function rather than by
 430  * adding more code to a growing switch statement.
 431  */
 432 #ifdef USE_INET6
 433 static  INLINE int      ipf_pr_ah6 __P((fr_info_t *));
 434 static  INLINE void     ipf_pr_esp6 __P((fr_info_t *));
 435 static  INLINE void     ipf_pr_gre6 __P((fr_info_t *));
 436 static  INLINE void     ipf_pr_udp6 __P((fr_info_t *));
 437 static  INLINE void     ipf_pr_tcp6 __P((fr_info_t *));
 438 static  INLINE void     ipf_pr_icmp6 __P((fr_info_t *));
 439 static  INLINE void     ipf_pr_ipv6hdr __P((fr_info_t *));
 440 static  INLINE void     ipf_pr_short6 __P((fr_info_t *, int));
 441 static  INLINE int      ipf_pr_hopopts6 __P((fr_info_t *));
 442 static  INLINE int      ipf_pr_mobility6 __P((fr_info_t *));
 443 static  INLINE int      ipf_pr_routing6 __P((fr_info_t *));
 444 static  INLINE int      ipf_pr_dstopts6 __P((fr_info_t *));
 445 static  INLINE int      ipf_pr_fragment6 __P((fr_info_t *));
 446 static  INLINE struct ip6_ext *ipf_pr_ipv6exthdr __P((fr_info_t *, int, int));
 447
 448
 449 /* ------------------------------------------------------------------------ */
 450 /* Function:    ipf_pr_short6                                               */
 451 /* Returns:     void                                                        */
 452 /* Parameters:  fin(I)  - pointer to packet information                     */
 453 /*              xmin(I) - minimum header size                               */
 454 /*                                                                          */
 455 /* IPv6 Only                                                                */
 456 /* This is function enforces the 'is a packet too short to be legit' rule   */
 457 /* for IPv6 and marks the packet with FI_SHORT if so.  See function comment */
 458 /* for ipf_pr_short() for more details.                                     */
 459 /* ------------------------------------------------------------------------ */
 460 static INLINE void
 461 ipf_pr_short6(fin, xmin)
 462         fr_info_t *fin;
 463         int xmin;
 464 {
 465
 466         if (fin->fin_dlen < xmin)
 467                 fin->fin_flx |= FI_SHORT;
 468 }
 469
 470
 471 /* ------------------------------------------------------------------------ */
 472 /* Function:    ipf_pr_ipv6hdr                                              */
 473 /* Returns:     void                                                        */
 474 /* Parameters:  fin(I) - pointer to packet information                      */
 475 /*                                                                          */
 476 /* IPv6 Only                                                                */
 477 /* Copy values from the IPv6 header into the fr_info_t struct and call the  */
 478 /* per-protocol analyzer if it exists.  In validating the packet, a protocol*/
 479 /* analyzer may pullup or free the packet itself so we need to be vigiliant */
 480 /* of that possibility arising.                                             */
 481 /* ------------------------------------------------------------------------ */
 482 static INLINE void
 483 ipf_pr_ipv6hdr(fin)
 484         fr_info_t *fin;
 485 {
 486         ip6_t *ip6 = (ip6_t *)fin->fin_ip;
 487         int p, go = 1, i, hdrcount;
 488         fr_ip_t *fi = &fin->fin_fi;
 489
 490         fin->fin_off = 0;
 491
 492         fi->fi_tos = 0;
 493         fi->fi_optmsk = 0;
 494         fi->fi_secmsk = 0;
 495         fi->fi_auth = 0;
 496
 497         p = ip6->ip6_nxt;
 498         fin->fin_crc = p;
 499         fi->fi_ttl = ip6->ip6_hlim;
 500         fi->fi_src.in6 = ip6->ip6_src;
 501         fin->fin_crc += fi->fi_src.i6[0];
 502         fin->fin_crc += fi->fi_src.i6[1];
 503         fin->fin_crc += fi->fi_src.i6[2];
 504         fin->fin_crc += fi->fi_src.i6[3];
 505         fi->fi_dst.in6 = ip6->ip6_dst;
 506         fin->fin_crc += fi->fi_dst.i6[0];
 507         fin->fin_crc += fi->fi_dst.i6[1];
 508         fin->fin_crc += fi->fi_dst.i6[2];
 509         fin->fin_crc += fi->fi_dst.i6[3];
 510         fin->fin_id = 0;
 511         if (IN6_IS_ADDR_MULTICAST(&fi->fi_dst.in6))
 512                 fin->fin_flx |= FI_MULTICAST|FI_MBCAST;
 513
 514         hdrcount = 0;
 515         while (go && !(fin->fin_flx & FI_SHORT)) {
 516                 switch (p)
 517                 {
 518                 case IPPROTO_UDP :
 519                         ipf_pr_udp6(fin);
 520                         go = 0;
 521                         break;
 522
 523                 case IPPROTO_TCP :
 524                         ipf_pr_tcp6(fin);
 525                         go = 0;
 526                         break;
 527
 528                 case IPPROTO_ICMPV6 :
 529                         ipf_pr_icmp6(fin);
 530                         go = 0;
 531                         break;
 532
 533                 case IPPROTO_GRE :
 534                         ipf_pr_gre6(fin);
 535                         go = 0;
 536                         break;
 537
 538                 case IPPROTO_HOPOPTS :
 539                         p = ipf_pr_hopopts6(fin);
 540                         break;
 541
 542                 case IPPROTO_MOBILITY :
 543                         p = ipf_pr_mobility6(fin);
 544                         break;
 545
 546                 case IPPROTO_DSTOPTS :
 547                         p = ipf_pr_dstopts6(fin);
 548                         break;
 549
 550                 case IPPROTO_ROUTING :
 551                         p = ipf_pr_routing6(fin);
 552                         break;
 553
 554                 case IPPROTO_AH :
 555                         p = ipf_pr_ah6(fin);
 556                         break;
 557
 558                 case IPPROTO_ESP :
 559                         ipf_pr_esp6(fin);
 560                         go = 0;
 561                         break;
 562
 563                 case IPPROTO_IPV6 :
 564                         for (i = 0; ip6exthdr[i].ol_bit != 0; i++)
 565                                 if (ip6exthdr[i].ol_val == p) {
 566                                         fin->fin_flx |= ip6exthdr[i].ol_bit;
 567                                         break;
 568                                 }
 569                         go = 0;
 570                         break;
 571
 572                 case IPPROTO_NONE :
 573                         go = 0;
 574                         break;
 575
 576                 case IPPROTO_FRAGMENT :
 577                         p = ipf_pr_fragment6(fin);
 578                         /*
 579                          * Given that the only fragments we want to let through
 580                          * (where fin_off != 0) are those where the non-first
 581                          * fragments only have data, we can safely stop looking
 582                          * at headers if this is a non-leading fragment.
 583                          */
 584                         if (fin->fin_off != 0)
 585                                 go = 0;
 586                         break;
 587
 588                 default :
 589                         go = 0;
 590                         break;
 591                 }
 592                 hdrcount++;
 593
 594                 /*
 595                  * It is important to note that at this point, for the
 596                  * extension headers (go != 0), the entire header may not have
 597                  * been pulled up when the code gets to this point.  This is
 598                  * only done for "go != 0" because the other header handlers
 599                  * will all pullup their complete header.  The other indicator
 600                  * of an incomplete packet is that this was just an extension
 601                  * header.
 602                  */
 603                 if ((go != 0) && (p != IPPROTO_NONE) &&
 604                     (ipf_pr_pullup(fin, 0) == -1)) {
 605                         p = IPPROTO_NONE;
 606                         break;
 607                 }
 608         }
 609
 610         /*
 611          * Some of the above functions, like ipf_pr_esp6(), can call ipf_pullup
 612          * and destroy whatever packet was here.  The caller of this function
 613          * expects us to return if there is a problem with ipf_pullup.
 614          */
 615         if (fin->fin_m == NULL) {
 616                 ipf_main_softc_t *softc = fin->fin_main_soft;
 617
 618                 LBUMPD(ipf_stats[fin->fin_out], fr_v6_bad);
 619                 return;
 620         }
 621
 622         fi->fi_p = p;
 623
 624         /*
 625          * IPv6 fragment case 1 - see comment for ipf_pr_fragment6().
 626          * "go != 0" imples the above loop hasn't arrived at a layer 4 header.
 627          */
 628         if ((go != 0) && (fin->fin_flx & FI_FRAG) && (fin->fin_off == 0)) {
 629                 ipf_main_softc_t *softc = fin->fin_main_soft;
 630
 631                 fin->fin_flx |= FI_BAD;
 632                 DT2(ipf_fi_bad_ipv6_frag_1, fr_info_t *, fin, int, go);
 633                 LBUMPD(ipf_stats[fin->fin_out], fr_v6_badfrag);
 634                 LBUMP(ipf_stats[fin->fin_out].fr_v6_bad);
 635         }
 636 }
 637
 638
 639 /* ------------------------------------------------------------------------ */
 640 /* Function:    ipf_pr_ipv6exthdr                                           */
 641 /* Returns:     struct ip6_ext * - pointer to the start of the next header  */
 642 /*                                 or NULL if there is a prolblem.          */
 643 /* Parameters:  fin(I)      - pointer to packet information                 */
 644 /*              multiple(I) - flag indicating yes/no if multiple occurances */
 645 /*                            of this extension header are allowed.         */
 646 /*              proto(I)    - protocol number for this extension header     */
 647 /*                                                                          */
 648 /* IPv6 Only                                                                */
 649 /* This function embodies a number of common checks that all IPv6 extension */
 650 /* headers must be subjected to.  For example, making sure the packet is    */
 651 /* big enough for it to be in, checking if it is repeated and setting a     */
 652 /* flag to indicate its presence.                                           */
 653 /* ------------------------------------------------------------------------ */
 654 static INLINE struct ip6_ext *
 655 ipf_pr_ipv6exthdr(fin, multiple, proto)
 656         fr_info_t *fin;
 657         int multiple, proto;
 658 {
 659         ipf_main_softc_t *softc = fin->fin_main_soft;
 660         struct ip6_ext *hdr;
 661         u_short shift;
 662         int i;
 663
 664         fin->fin_flx |= FI_V6EXTHDR;
 665
 666                                 /* 8 is default length of extension hdr */
 667         if ((fin->fin_dlen - 8) < 0) {
 668                 fin->fin_flx |= FI_SHORT;
 669                 LBUMPD(ipf_stats[fin->fin_out], fr_v6_ext_short);
 670                 return NULL;
 671         }
 672
 673         if (ipf_pr_pullup(fin, 8) == -1) {
 674                 LBUMPD(ipf_stats[fin->fin_out], fr_v6_ext_pullup);
 675                 return NULL;
 676         }
 677
 678         hdr = fin->fin_dp;
 679         switch (proto)
 680         {
 681         case IPPROTO_FRAGMENT :
 682                 shift = 8;
 683                 break;
 684         default :
 685                 shift = 8 + (hdr->ip6e_len << 3);
 686                 break;
 687         }
 688
 689         if (shift > fin->fin_dlen) {    /* Nasty extension header length? */
 690                 fin->fin_flx |= FI_BAD;
 691                 DT3(ipf_fi_bad_pr_ipv6exthdr_len, fr_info_t *, fin, u_short, shift, u_short, fin->fin_dlen);
 692                 LBUMPD(ipf_stats[fin->fin_out], fr_v6_ext_hlen);
 693                 return NULL;
 694         }
 695
 696         fin->fin_dp = (char *)fin->fin_dp + shift;
 697         fin->fin_dlen -= shift;
 698
 699         /*
 700          * If we have seen a fragment header, do not set any flags to indicate
 701          * the presence of this extension header as it has no impact on the
 702          * end result until after it has been defragmented.
 703          */
 704         if (fin->fin_flx & FI_FRAG)
 705                 return hdr;
 706
 707         for (i = 0; ip6exthdr[i].ol_bit != 0; i++)
 708                 if (ip6exthdr[i].ol_val == proto) {
 709                         /*
 710                          * Most IPv6 extension headers are only allowed once.
 711                          */
 712                         if ((multiple == 0) &&
 713                             ((fin->fin_optmsk & ip6exthdr[i].ol_bit) != 0)) {
 714                                 fin->fin_flx |= FI_BAD;
 715                                 DT2(ipf_fi_bad_ipv6exthdr_once, fr_info_t *, fin, u_int, (fin->fin_optmsk & ip6exthdr[i].ol_bit));
 716                         } else
 717                                 fin->fin_optmsk |= ip6exthdr[i].ol_bit;
 718                         break;
 719                 }
 720
 721         return hdr;
 722 }
 723
 724
 725 /* ------------------------------------------------------------------------ */
 726 /* Function:    ipf_pr_hopopts6                                             */
 727 /* Returns:     int    - value of the next header or IPPROTO_NONE if error  */
 728 /* Parameters:  fin(I) - pointer to packet information                      */
 729 /*                                                                          */
 730 /* IPv6 Only                                                                */
 731 /* This is function checks pending hop by hop options extension header      */
 732 /* ------------------------------------------------------------------------ */
 733 static INLINE int
 734 ipf_pr_hopopts6(fin)
 735         fr_info_t *fin;
 736 {
 737         struct ip6_ext *hdr;
 738
 739         hdr = ipf_pr_ipv6exthdr(fin, 0, IPPROTO_HOPOPTS);
 740         if (hdr == NULL)
 741                 return IPPROTO_NONE;
 742         return hdr->ip6e_nxt;
 743 }
 744
 745
 746 /* ------------------------------------------------------------------------ */
 747 /* Function:    ipf_pr_mobility6                                            */
 748 /* Returns:     int    - value of the next header or IPPROTO_NONE if error  */
 749 /* Parameters:  fin(I) - pointer to packet information                      */
 750 /*                                                                          */
 751 /* IPv6 Only                                                                */
 752 /* This is function checks the IPv6 mobility extension header               */
 753 /* ------------------------------------------------------------------------ */
 754 static INLINE int
 755 ipf_pr_mobility6(fin)
 756         fr_info_t *fin;
 757 {
 758         struct ip6_ext *hdr;
 759
 760         hdr = ipf_pr_ipv6exthdr(fin, 0, IPPROTO_MOBILITY);
 761         if (hdr == NULL)
 762                 return IPPROTO_NONE;
 763         return hdr->ip6e_nxt;
 764 }
 765
 766
 767 /* ------------------------------------------------------------------------ */
 768 /* Function:    ipf_pr_routing6                                             */
 769 /* Returns:     int    - value of the next header or IPPROTO_NONE if error  */
 770 /* Parameters:  fin(I) - pointer to packet information                      */
 771 /*                                                                          */
 772 /* IPv6 Only                                                                */
 773 /* This is function checks pending routing extension header                 */
 774 /* ------------------------------------------------------------------------ */
 775 static INLINE int
 776 ipf_pr_routing6(fin)
 777         fr_info_t *fin;
 778 {
 779         struct ip6_routing *hdr;
 780
 781         hdr = (struct ip6_routing *)ipf_pr_ipv6exthdr(fin, 0, IPPROTO_ROUTING);
 782         if (hdr == NULL)
 783                 return IPPROTO_NONE;
 784
 785         switch (hdr->ip6r_type)
 786         {
 787         case 0 :
 788                 /*
 789                  * Nasty extension header length?
 790                  */
 791                 if (((hdr->ip6r_len >> 1) < hdr->ip6r_segleft) ||
 792                     (hdr->ip6r_segleft && (hdr->ip6r_len & 1))) {
 793                         ipf_main_softc_t *softc = fin->fin_main_soft;
 794
 795                         fin->fin_flx |= FI_BAD;
 796                         DT1(ipf_fi_bad_routing6, fr_info_t *, fin);
 797                         LBUMPD(ipf_stats[fin->fin_out], fr_v6_rh_bad);
 798                         return IPPROTO_NONE;
 799                 }
 800                 break;
 801
 802         default :
 803                 break;
 804         }
 805
 806         return hdr->ip6r_nxt;
 807 }
 808
 809
 810 /* ------------------------------------------------------------------------ */
 811 /* Function:    ipf_pr_fragment6                                            */
 812 /* Returns:     int    - value of the next header or IPPROTO_NONE if error  */
 813 /* Parameters:  fin(I) - pointer to packet information                      */
 814 /*                                                                          */
 815 /* IPv6 Only                                                                */
 816 /* Examine the IPv6 fragment header and extract fragment offset information.*/
 817 /*                                                                          */
 818 /* Fragments in IPv6 are extraordinarily difficult to deal with - much more */
 819 /* so than in IPv4.  There are 5 cases of fragments with IPv6 that all      */
 820 /* packets with a fragment header can fit into.  They are as follows:       */
 821 /*                                                                          */
 822 /* 1.  [IPv6][0-n EH][FH][0-n EH] (no L4HDR present)                        */
 823 /* 2.  [IPV6][0-n EH][FH][0-n EH][L4HDR part] (short)                       */
 824 /* 3.  [IPV6][0-n EH][FH][L4HDR part][0-n data] (short)                     */
 825 /* 4.  [IPV6][0-n EH][FH][0-n EH][L4HDR][0-n data]                          */
 826 /* 5.  [IPV6][0-n EH][FH][data]                                             */
 827 /*                                                                          */
 828 /* IPV6 = IPv6 header, FH = Fragment Header,                                */
 829 /* 0-n EH = 0 or more extension headers, 0-n data = 0 or more bytes of data */
 830 /*                                                                          */
 831 /* Packets that match 1, 2, 3 will be dropped as the only reasonable        */
 832 /* scenario in which they happen is in extreme circumstances that are most  */
 833 /* likely to be an indication of an attack rather than normal traffic.      */
 834 /* A type 3 packet may be sent by an attacked after a type 4 packet.  There */
 835 /* are two rules that can be used to guard against type 3 packets: L4       */
 836 /* headers must always be in a packet that has the offset field set to 0    */
 837 /* and no packet is allowed to overlay that where offset = 0.               */
 838 /* ------------------------------------------------------------------------ */
 839 static INLINE int
 840 ipf_pr_fragment6(fin)
 841         fr_info_t *fin;
 842 {
 843         ipf_main_softc_t *softc = fin->fin_main_soft;
 844         struct ip6_frag *frag;
 845
 846         fin->fin_flx |= FI_FRAG;
 847
 848         frag = (struct ip6_frag *)ipf_pr_ipv6exthdr(fin, 0, IPPROTO_FRAGMENT);
 849         if (frag == NULL) {
 850                 LBUMPD(ipf_stats[fin->fin_out], fr_v6_frag_bad);
 851                 return IPPROTO_NONE;
 852         }
 853
 854         if ((frag->ip6f_offlg & IP6F_MORE_FRAG) != 0) {
 855                 /*
 856                  * Any fragment that isn't the last fragment must have its
 857                  * length as a multiple of 8.
 858                  */
 859                 if ((fin->fin_plen & 7) != 0) {
 860                         fin->fin_flx |= FI_BAD;
 861                         DT2(ipf_fi_bad_frag_not_8, fr_info_t *, fin, u_int, (fin->fin_plen & 7));
 862                 }
 863         }
 864
 865         fin->fin_fraghdr = frag;
 866         fin->fin_id = frag->ip6f_ident;
 867         fin->fin_off = ntohs(frag->ip6f_offlg & IP6F_OFF_MASK);
 868         if (fin->fin_off != 0)
 869                 fin->fin_flx |= FI_FRAGBODY;
 870
 871         /*
 872          * Jumbograms aren't handled, so the max. length is 64k
 873          */
 874         if ((fin->fin_off << 3) + fin->fin_dlen > 65535) {
 875                   fin->fin_flx |= FI_BAD;
 876                   DT2(ipf_fi_bad_jumbogram, fr_info_t *, fin, u_int, ((fin->fin_off << 3) + fin->fin_dlen));
 877         }
 878
 879         /*
 880          * We don't know where the transport layer header (or whatever is next
 881          * is), as it could be behind destination options (amongst others) so
 882          * return the fragment header as the type of packet this is.  Note that
 883          * this effectively disables the fragment cache for > 1 protocol at a
 884          * time.
 885          */
 886         return frag->ip6f_nxt;
 887 }
 888
 889
 890 /* ------------------------------------------------------------------------ */
 891 /* Function:    ipf_pr_dstopts6                                             */
 892 /* Returns:     int    - value of the next header or IPPROTO_NONE if error  */
 893 /* Parameters:  fin(I) - pointer to packet information                      */
 894 /*                                                                          */
 895 /* IPv6 Only                                                                */
 896 /* This is function checks pending destination options extension header     */
 897 /* ------------------------------------------------------------------------ */
 898 static INLINE int
 899 ipf_pr_dstopts6(fin)
 900         fr_info_t *fin;
 901 {
 902         ipf_main_softc_t *softc = fin->fin_main_soft;
 903         struct ip6_ext *hdr;
 904
 905         hdr = ipf_pr_ipv6exthdr(fin, 0, IPPROTO_DSTOPTS);
 906         if (hdr == NULL) {
 907                 LBUMPD(ipf_stats[fin->fin_out], fr_v6_dst_bad);
 908                 return IPPROTO_NONE;
 909         }
 910         return hdr->ip6e_nxt;
 911 }
 912
 913
 914 /* ------------------------------------------------------------------------ */
 915 /* Function:    ipf_pr_icmp6                                                */
 916 /* Returns:     void                                                        */
 917 /* Parameters:  fin(I) - pointer to packet information                      */
 918 /*                                                                          */
 919 /* IPv6 Only                                                                */
 920 /* This routine is mainly concerned with determining the minimum valid size */
 921 /* for an ICMPv6 packet.                                                    */
 922 /* ------------------------------------------------------------------------ */
 923 static INLINE void
 924 ipf_pr_icmp6(fin)
 925         fr_info_t *fin;
 926 {
 927         int minicmpsz = sizeof(struct icmp6_hdr);
 928         struct icmp6_hdr *icmp6;
 929
 930         if (ipf_pr_pullup(fin, ICMP6ERR_MINPKTLEN - sizeof(ip6_t)) == -1) {
 931                 ipf_main_softc_t *softc = fin->fin_main_soft;
 932
 933                 LBUMPD(ipf_stats[fin->fin_out], fr_v6_icmp6_pullup);
 934                 return;
 935         }
 936
 937         if (fin->fin_dlen > 1) {
 938                 ip6_t *ip6;
 939
 940                 icmp6 = fin->fin_dp;
 941
 942                 fin->fin_data[0] = *(u_short *)icmp6;
 943
 944                 if ((icmp6->icmp6_type & ICMP6_INFOMSG_MASK) != 0)
 945                         fin->fin_flx |= FI_ICMPQUERY;
 946
 947                 switch (icmp6->icmp6_type)
 948                 {
 949                 case ICMP6_ECHO_REPLY :
 950                 case ICMP6_ECHO_REQUEST :
 951                         if (fin->fin_dlen >= 6)
 952                                 fin->fin_data[1] = icmp6->icmp6_id;
 953                         minicmpsz = ICMP6ERR_MINPKTLEN - sizeof(ip6_t);
 954                         break;
 955
 956                 case ICMP6_DST_UNREACH :
 957                 case ICMP6_PACKET_TOO_BIG :
 958                 case ICMP6_TIME_EXCEEDED :
 959                 case ICMP6_PARAM_PROB :
 960                         fin->fin_flx |= FI_ICMPERR;
 961                         minicmpsz = ICMP6ERR_IPICMPHLEN - sizeof(ip6_t);
 962                         if (fin->fin_plen < ICMP6ERR_IPICMPHLEN)
 963                                 break;
 964
 965                         if (M_LEN(fin->fin_m) < fin->fin_plen) {
 966                                 if (ipf_coalesce(fin) != 1)
 967                                         return;
 968                         }
 969
 970                         if (ipf_pr_pullup(fin, ICMP6ERR_MINPKTLEN) == -1)
 971                                 return;
 972
 973                         /*
 974                          * If the destination of this packet doesn't match the
 975                          * source of the original packet then this packet is
 976                          * not correct.
 977                          */
 978                         icmp6 = fin->fin_dp;
 979                         ip6 = (ip6_t *)((char *)icmp6 + ICMPERR_ICMPHLEN);
 980                         if (IP6_NEQ(&fin->fin_fi.fi_dst,
 981                                     (i6addr_t *)&ip6->ip6_src)) {
 982                                 fin->fin_flx |= FI_BAD;
 983                                 DT1(ipf_fi_bad_icmp6, fr_info_t *, fin);
 984                         }
 985                         break;
 986                 default :
 987                         break;
 988                 }
 989         }
 990
 991         ipf_pr_short6(fin, minicmpsz);
 992         if ((fin->fin_flx & (FI_SHORT|FI_BAD)) == 0) {
 993                 u_char p = fin->fin_p;
 994
 995                 fin->fin_p = IPPROTO_ICMPV6;
 996                 ipf_checkv6sum(fin);
 997                 fin->fin_p = p;
 998         }
 999 }
1000
1001
1002 /* ------------------------------------------------------------------------ */
1003 /* Function:    ipf_pr_udp6                                                 */
1004 /* Returns:     void                                                        */
1005 /* Parameters:  fin(I) - pointer to packet information                      */
1006 /*                                                                          */
1007 /* IPv6 Only                                                                */
1008 /* Analyse the packet for IPv6/UDP properties.                              */
1009 /* Is not expected to be called for fragmented packets.                     */
1010 /* ------------------------------------------------------------------------ */
1011 static INLINE void
1012 ipf_pr_udp6(fin)
1013         fr_info_t *fin;
1014 {
1015
1016         if (ipf_pr_udpcommon(fin) == 0) {
1017                 u_char p = fin->fin_p;
1018
1019                 fin->fin_p = IPPROTO_UDP;
1020                 ipf_checkv6sum(fin);
1021                 fin->fin_p = p;
1022         }
1023 }
1024
1025
1026 /* ------------------------------------------------------------------------ */
1027 /* Function:    ipf_pr_tcp6                                                 */
1028 /* Returns:     void                                                        */
1029 /* Parameters:  fin(I) - pointer to packet information                      */
1030 /*                                                                          */
1031 /* IPv6 Only                                                                */
1032 /* Analyse the packet for IPv6/TCP properties.                              */
1033 /* Is not expected to be called for fragmented packets.                     */
1034 /* ------------------------------------------------------------------------ */
1035 static INLINE void
1036 ipf_pr_tcp6(fin)
1037         fr_info_t *fin;
1038 {
1039
1040         if (ipf_pr_tcpcommon(fin) == 0) {
1041                 u_char p = fin->fin_p;
1042
1043                 fin->fin_p = IPPROTO_TCP;
1044                 ipf_checkv6sum(fin);
1045                 fin->fin_p = p;
1046         }
1047 }
1048
1049
1050 /* ------------------------------------------------------------------------ */
1051 /* Function:    ipf_pr_esp6                                                 */
1052 /* Returns:     void                                                        */
1053 /* Parameters:  fin(I) - pointer to packet information                      */
1054 /*                                                                          */
1055 /* IPv6 Only                                                                */
1056 /* Analyse the packet for ESP properties.                                   */
1057 /* The minimum length is taken to be the SPI (32bits) plus a tail (32bits)  */
1058 /* even though the newer ESP packets must also have a sequence number that  */
1059 /* is 32bits as well, it is not possible(?) to determine the version from a */
1060 /* simple packet header.                                                    */
1061 /* ------------------------------------------------------------------------ */
1062 static INLINE void
1063 ipf_pr_esp6(fin)
1064         fr_info_t *fin;
1065 {
1066
1067         if ((fin->fin_off == 0) && (ipf_pr_pullup(fin, 8) == -1)) {
1068                 ipf_main_softc_t *softc = fin->fin_main_soft;
1069
1070                 LBUMPD(ipf_stats[fin->fin_out], fr_v6_esp_pullup);
1071                 return;
1072         }
1073 }
1074
1075
1076 /* ------------------------------------------------------------------------ */
1077 /* Function:    ipf_pr_ah6                                                  */
1078 /* Returns:     int    - value of the next header or IPPROTO_NONE if error  */
1079 /* Parameters:  fin(I) - pointer to packet information                      */
1080 /*                                                                          */
1081 /* IPv6 Only                                                                */
1082 /* Analyse the packet for AH properties.                                    */
1083 /* The minimum length is taken to be the combination of all fields in the   */
1084 /* header being present and no authentication data (null algorithm used.)   */
1085 /* ------------------------------------------------------------------------ */
1086 static INLINE int
1087 ipf_pr_ah6(fin)
1088         fr_info_t *fin;
1089 {
1090         authhdr_t *ah;
1091
1092         fin->fin_flx |= FI_AH;
1093
1094         ah = (authhdr_t *)ipf_pr_ipv6exthdr(fin, 0, IPPROTO_HOPOPTS);
1095         if (ah == NULL) {
1096                 ipf_main_softc_t *softc = fin->fin_main_soft;
1097
1098                 LBUMPD(ipf_stats[fin->fin_out], fr_v6_ah_bad);
1099                 return IPPROTO_NONE;
1100         }
1101
1102         ipf_pr_short6(fin, sizeof(*ah));
1103
1104         /*
1105          * No need for another pullup, ipf_pr_ipv6exthdr() will pullup
1106          * enough data to satisfy ah_next (the very first one.)
1107          */
1108         return ah->ah_next;
1109 }
1110
1111
1112 /* ------------------------------------------------------------------------ */
1113 /* Function:    ipf_pr_gre6                                                 */
1114 /* Returns:     void                                                        */
1115 /* Parameters:  fin(I) - pointer to packet information                      */
1116 /*                                                                          */
1117 /* Analyse the packet for GRE properties.                                   */
1118 /* ------------------------------------------------------------------------ */
1119 static INLINE void
1120 ipf_pr_gre6(fin)
1121         fr_info_t *fin;
1122 {
1123         grehdr_t *gre;
1124
1125         if (ipf_pr_pullup(fin, sizeof(grehdr_t)) == -1) {
1126                 ipf_main_softc_t *softc = fin->fin_main_soft;
1127
1128                 LBUMPD(ipf_stats[fin->fin_out], fr_v6_gre_pullup);
1129                 return;
1130         }
1131
1132         gre = fin->fin_dp;
1133         if (GRE_REV(gre->gr_flags) == 1)
1134                 fin->fin_data[0] = gre->gr_call;
1135 }
1136 #endif  /* USE_INET6 */
1137
1138
1139 /* ------------------------------------------------------------------------ */
1140 /* Function:    ipf_pr_pullup                                               */
1141 /* Returns:     int     - 0 == pullup succeeded, -1 == failure              */
1142 /* Parameters:  fin(I)  - pointer to packet information                     */
1143 /*              plen(I) - length (excluding L3 header) to pullup            */
1144 /*                                                                          */
1145 /* Short inline function to cut down on code duplication to perform a call  */
1146 /* to ipf_pullup to ensure there is the required amount of data,            */
1147 /* consecutively in the packet buffer.                                      */
1148 /*                                                                          */
1149 /* This function pulls up 'extra' data at the location of fin_dp.  fin_dp   */
1150 /* points to the first byte after the complete layer 3 header, which will   */
1151 /* include all of the known extension headers for IPv6 or options for IPv4. */
1152 /*                                                                          */
1153 /* Since fr_pullup() expects the total length of bytes to be pulled up, it  */
1154 /* is necessary to add those we can already assume to be pulled up (fin_dp  */
1155 /* - fin_ip) to what is passed through.                                     */
1156 /* ------------------------------------------------------------------------ */
1157 int
1158 ipf_pr_pullup(fin, plen)
1159         fr_info_t *fin;
1160         int plen;
1161 {
1162         ipf_main_softc_t *softc = fin->fin_main_soft;
1163
1164         if (fin->fin_m != NULL) {
1165                 if (fin->fin_dp != NULL)
1166                         plen += (char *)fin->fin_dp -
1167                                 ((char *)fin->fin_ip + fin->fin_hlen);
1168                 plen += fin->fin_hlen;
1169                 if (M_LEN(fin->fin_m) < plen + fin->fin_ipoff) {
1170 #if defined(_KERNEL)
1171                         if (ipf_pullup(fin->fin_m, fin, plen) == NULL) {
1172                                 DT(ipf_pullup_fail);
1173                                 LBUMP(ipf_stats[fin->fin_out].fr_pull[1]);
1174                                 return -1;
1175                         }
1176                         LBUMP(ipf_stats[fin->fin_out].fr_pull[0]);
1177 #else
1178                         LBUMP(ipf_stats[fin->fin_out].fr_pull[1]);
1179                         /*
1180                          * Fake ipf_pullup failing
1181                          */
1182                         fin->fin_reason = FRB_PULLUP;
1183                         *fin->fin_mp = NULL;
1184                         fin->fin_m = NULL;
1185                         fin->fin_ip = NULL;
1186                         return -1;
1187 #endif
1188                 }
1189         }
1190         return 0;
1191 }
1192
1193
1194 /* ------------------------------------------------------------------------ */
1195 /* Function:    ipf_pr_short                                                */
1196 /* Returns:     void                                                        */
1197 /* Parameters:  fin(I)  - pointer to packet information                     */
1198 /*              xmin(I) - minimum header size                               */
1199 /*                                                                          */
1200 /* Check if a packet is "short" as defined by xmin.  The rule we are        */
1201 /* applying here is that the packet must not be fragmented within the layer */
1202 /* 4 header.  That is, it must not be a fragment that has its offset set to */
1203 /* start within the layer 4 header (hdrmin) or if it is at offset 0, the    */
1204 /* entire layer 4 header must be present (min).                             */
1205 /* ------------------------------------------------------------------------ */
1206 static INLINE void
1207 ipf_pr_short(fin, xmin)
1208         fr_info_t *fin;
1209         int xmin;
1210 {
1211
1212         if (fin->fin_off == 0) {
1213                 if (fin->fin_dlen < xmin)
1214                         fin->fin_flx |= FI_SHORT;
1215         } else if (fin->fin_off < xmin) {
1216                 fin->fin_flx |= FI_SHORT;
1217         }
1218 }
1219
1220
1221 /* ------------------------------------------------------------------------ */
1222 /* Function:    ipf_pr_icmp                                                 */
1223 /* Returns:     void                                                        */
1224 /* Parameters:  fin(I) - pointer to packet information                      */
1225 /*                                                                          */
1226 /* IPv4 Only                                                                */
1227 /* Do a sanity check on the packet for ICMP (v4).  In nearly all cases,     */
1228 /* except extrememly bad packets, both type and code will be present.       */
1229 /* The expected minimum size of an ICMP packet is very much dependent on    */
1230 /* the type of it.                                                          */
1231 /*                                                                          */
1232 /* XXX - other ICMP sanity checks?                                          */
1233 /* ------------------------------------------------------------------------ */
1234 static INLINE void
1235 ipf_pr_icmp(fin)
1236         fr_info_t *fin;
1237 {
1238         ipf_main_softc_t *softc = fin->fin_main_soft;
1239         int minicmpsz = sizeof(struct icmp);
1240         icmphdr_t *icmp;
1241         ip_t *oip;
1242
1243         ipf_pr_short(fin, ICMPERR_ICMPHLEN);
1244
1245         if (fin->fin_off != 0) {
1246                 LBUMPD(ipf_stats[fin->fin_out], fr_v4_icmp_frag);
1247                 return;
1248         }
1249
1250         if (ipf_pr_pullup(fin, ICMPERR_ICMPHLEN) == -1) {
1251                 LBUMPD(ipf_stats[fin->fin_out], fr_v4_icmp_pullup);
1252                 return;
1253         }
1254
1255         icmp = fin->fin_dp;
1256
1257         fin->fin_data[0] = *(u_short *)icmp;
1258         fin->fin_data[1] = icmp->icmp_id;
1259
1260         switch (icmp->icmp_type)
1261         {
1262         case ICMP_ECHOREPLY :
1263         case ICMP_ECHO :
1264         /* Router discovery messaes - RFC 1256 */
1265         case ICMP_ROUTERADVERT :
1266         case ICMP_ROUTERSOLICIT :
1267                 fin->fin_flx |= FI_ICMPQUERY;
1268                 minicmpsz = ICMP_MINLEN;
1269                 break;
1270         /*
1271          * type(1) + code(1) + cksum(2) + id(2) seq(2) +
1272          * 3 * timestamp(3 * 4)
1273          */
1274         case ICMP_TSTAMP :
1275         case ICMP_TSTAMPREPLY :
1276                 fin->fin_flx |= FI_ICMPQUERY;
1277                 minicmpsz = 20;
1278                 break;
1279         /*
1280          * type(1) + code(1) + cksum(2) + id(2) seq(2) +
1281          * mask(4)
1282          */
1283         case ICMP_IREQ :
1284         case ICMP_IREQREPLY :
1285         case ICMP_MASKREQ :
1286         case ICMP_MASKREPLY :
1287                 fin->fin_flx |= FI_ICMPQUERY;
1288                 minicmpsz = 12;
1289                 break;
1290         /*
1291          * type(1) + code(1) + cksum(2) + id(2) seq(2) + ip(20+)
1292          */
1293         case ICMP_UNREACH :
1294 #ifdef icmp_nextmtu
1295                 if (icmp->icmp_code == ICMP_UNREACH_NEEDFRAG) {
1296                         if (icmp->icmp_nextmtu < softc->ipf_icmpminfragmtu) {
1297                                 fin->fin_flx |= FI_BAD;
1298                                 DT3(ipf_fi_bad_icmp_nextmtu, fr_info_t *, fin, u_int, icmp->icmp_nextmtu, u_int, softc->ipf_icmpminfragmtu);
1299                         }
1300                 }
1301 #endif
1302         case ICMP_SOURCEQUENCH :
1303         case ICMP_REDIRECT :
1304         case ICMP_TIMXCEED :
1305         case ICMP_PARAMPROB :
1306                 fin->fin_flx |= FI_ICMPERR;
1307                 if (ipf_coalesce(fin) != 1) {
1308                         LBUMPD(ipf_stats[fin->fin_out], fr_icmp_coalesce);
1309                         return;
1310                 }
1311
1312                 /*
1313                  * ICMP error packets should not be generated for IP
1314                  * packets that are a fragment that isn't the first
1315                  * fragment.
1316                  */
1317                 oip = (ip_t *)((char *)fin->fin_dp + ICMPERR_ICMPHLEN);
1318                 if ((ntohs(oip->ip_off) & IP_OFFMASK) != 0) {
1319                         fin->fin_flx |= FI_BAD;
1320                         DT2(ipf_fi_bad_icmp_err, fr_info_t, fin, u_int, (ntohs(oip->ip_off) & IP_OFFMASK));
1321                 }
1322
1323                 /*
1324                  * If the destination of this packet doesn't match the
1325                  * source of the original packet then this packet is
1326                  * not correct.
1327                  */
1328                 if (oip->ip_src.s_addr != fin->fin_daddr) {
1329                         fin->fin_flx |= FI_BAD;
1330                         DT1(ipf_fi_bad_src_ne_dst, fr_info_t *, fin);
1331                 }
1332                 break;
1333         default :
1334                 break;
1335         }
1336
1337         ipf_pr_short(fin, minicmpsz);
1338
1339         ipf_checkv4sum(fin);
1340 }
1341
1342
1343 /* ------------------------------------------------------------------------ */
1344 /* Function:    ipf_pr_tcpcommon                                            */
1345 /* Returns:     int    - 0 = header ok, 1 = bad packet, -1 = buffer error   */
1346 /* Parameters:  fin(I) - pointer to packet information                      */
1347 /*                                                                          */
1348 /* TCP header sanity checking.  Look for bad combinations of TCP flags,     */
1349 /* and make some checks with how they interact with other fields.           */
1350 /* If compiled with IPFILTER_CKSUM, check to see if the TCP checksum is     */
1351 /* valid and mark the packet as bad if not.                                 */
1352 /* ------------------------------------------------------------------------ */
1353 static INLINE int
1354 ipf_pr_tcpcommon(fin)
1355         fr_info_t *fin;
1356 {
1357         ipf_main_softc_t *softc = fin->fin_main_soft;
1358         int flags, tlen;
1359         tcphdr_t *tcp;
1360
1361         fin->fin_flx |= FI_TCPUDP;
1362         if (fin->fin_off != 0) {
1363                 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_frag);
1364                 return 0;
1365         }
1366
1367         if (ipf_pr_pullup(fin, sizeof(*tcp)) == -1) {
1368                 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_pullup);
1369                 return -1;
1370         }
1371
1372         tcp = fin->fin_dp;
1373         if (fin->fin_dlen > 3) {
1374                 fin->fin_sport = ntohs(tcp->th_sport);
1375                 fin->fin_dport = ntohs(tcp->th_dport);
1376         }
1377
1378         if ((fin->fin_flx & FI_SHORT) != 0) {
1379                 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_short);
1380                 return 1;
1381         }
1382
1383         /*
1384          * Use of the TCP data offset *must* result in a value that is at
1385          * least the same size as the TCP header.
1386          */
1387         tlen = TCP_OFF(tcp) << 2;
1388         if (tlen < sizeof(tcphdr_t)) {
1389                 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_small);
1390                 fin->fin_flx |= FI_BAD;
1391                 DT3(ipf_fi_bad_tlen, fr_info_t, fin, u_int, tlen, u_int, sizeof(tcphdr_t));
1392                 return 1;
1393         }
1394
1395         flags = tcp->th_flags;
1396         fin->fin_tcpf = tcp->th_flags;
1397
1398         /*
1399          * If the urgent flag is set, then the urgent pointer must
1400          * also be set and vice versa.  Good TCP packets do not have
1401          * just one of these set.
1402          */
1403         if ((flags & TH_URG) != 0 && (tcp->th_urp == 0)) {
1404                 fin->fin_flx |= FI_BAD;
1405                 DT3(ipf_fi_bad_th_urg, fr_info_t*, fin, u_int, (flags & TH_URG), u_int, tcp->th_urp);
1406 #if 0
1407         } else if ((flags & TH_URG) == 0 && (tcp->th_urp != 0)) {
1408                 /*
1409                  * Ignore this case (#if 0) as it shows up in "real"
1410                  * traffic with bogus values in the urgent pointer field.
1411                  */
1412                 fin->fin_flx |= FI_BAD;
1413                 DT3(ipf_fi_bad_th_urg0, fr_info_t *, fin, u_int, (flags & TH_URG), u_int, tcp->th_urp);
1414 #endif
1415         } else if (((flags & (TH_SYN|TH_FIN)) != 0) &&
1416                    ((flags & (TH_RST|TH_ACK)) == TH_RST)) {
1417                 /* TH_FIN|TH_RST|TH_ACK seems to appear "naturally" */
1418                 fin->fin_flx |= FI_BAD;
1419                 DT1(ipf_fi_bad_th_fin_rst_ack, fr_info_t, fin);
1420 #if 1
1421         } else if (((flags & TH_SYN) != 0) &&
1422                    ((flags & (TH_URG|TH_PUSH)) != 0)) {
1423                 /*
1424                  * SYN with URG and PUSH set is not for normal TCP but it is
1425                  * possible(?) with T/TCP...but who uses T/TCP?
1426                  */
1427                 fin->fin_flx |= FI_BAD;
1428                 DT1(ipf_fi_bad_th_syn_urg_psh, fr_info_t *, fin);
1429 #endif
1430         } else if (!(flags & TH_ACK)) {
1431                 /*
1432                  * If the ack bit isn't set, then either the SYN or
1433                  * RST bit must be set.  If the SYN bit is set, then
1434                  * we expect the ACK field to be 0.  If the ACK is
1435                  * not set and if URG, PSH or FIN are set, consdier
1436                  * that to indicate a bad TCP packet.
1437                  */
1438                 if ((flags == TH_SYN) && (tcp->th_ack != 0)) {
1439                         /*
1440                          * Cisco PIX sets the ACK field to a random value.
1441                          * In light of this, do not set FI_BAD until a patch
1442                          * is available from Cisco to ensure that
1443                          * interoperability between existing systems is
1444                          * achieved.
1445                          */
1446                         /*fin->fin_flx |= FI_BAD*/;
1447                         /*DT1(ipf_fi_bad_th_syn_ack, fr_info_t *, fin);*/
1448                 } else if (!(flags & (TH_RST|TH_SYN))) {
1449                         fin->fin_flx |= FI_BAD;
1450                         DT1(ipf_fi_bad_th_rst_syn, fr_info_t *, fin);
1451                 } else if ((flags & (TH_URG|TH_PUSH|TH_FIN)) != 0) {
1452                         fin->fin_flx |= FI_BAD;
1453                         DT1(ipf_fi_bad_th_urg_push_fin, fr_info_t *, fin);
1454                 }
1455         }
1456         if (fin->fin_flx & FI_BAD) {
1457                 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_bad_flags);
1458                 return 1;
1459         }
1460
1461         /*
1462          * At this point, it's not exactly clear what is to be gained by
1463          * marking up which TCP options are and are not present.  The one we
1464          * are most interested in is the TCP window scale.  This is only in
1465          * a SYN packet [RFC1323] so we don't need this here...?
1466          * Now if we were to analyse the header for passive fingerprinting,
1467          * then that might add some weight to adding this...
1468          */
1469         if (tlen == sizeof(tcphdr_t)) {
1470                 return 0;
1471         }
1472
1473         if (ipf_pr_pullup(fin, tlen) == -1) {
1474                 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_pullup);
1475                 return -1;
1476         }
1477
1478 #if 0
1479         tcp = fin->fin_dp;
1480         ip = fin->fin_ip;
1481         s = (u_char *)(tcp + 1);
1482         off = IP_HL(ip) << 2;
1483 # ifdef _KERNEL
1484         if (fin->fin_mp != NULL) {
1485                 mb_t *m = *fin->fin_mp;
1486
1487                 if (off + tlen > M_LEN(m))
1488                         return;
1489         }
1490 # endif
1491         for (tlen -= (int)sizeof(*tcp); tlen > 0; ) {
1492                 opt = *s;
1493                 if (opt == '\0')
1494                         break;
1495                 else if (opt == TCPOPT_NOP)
1496                         ol = 1;
1497                 else {
1498                         if (tlen < 2)
1499                                 break;
1500                         ol = (int)*(s + 1);
1501                         if (ol < 2 || ol > tlen)
1502                                 break;
1503                 }
1504
1505                 for (i = 9, mv = 4; mv >= 0; ) {
1506                         op = ipopts + i;
1507                         if (opt == (u_char)op->ol_val) {
1508                                 optmsk |= op->ol_bit;
1509                                 break;
1510                         }
1511                 }
1512                 tlen -= ol;
1513                 s += ol;
1514         }
1515 #endif /* 0 */
1516
1517         return 0;
1518 }
1519
1520
1521
1522 /* ------------------------------------------------------------------------ */
1523 /* Function:    ipf_pr_udpcommon                                            */
1524 /* Returns:     int    - 0 = header ok, 1 = bad packet                      */
1525 /* Parameters:  fin(I) - pointer to packet information                      */
1526 /*                                                                          */
1527 /* Extract the UDP source and destination ports, if present.  If compiled   */
1528 /* with IPFILTER_CKSUM, check to see if the UDP checksum is valid.          */
1529 /* ------------------------------------------------------------------------ */
1530 static INLINE int
1531 ipf_pr_udpcommon(fin)
1532         fr_info_t *fin;
1533 {
1534         udphdr_t *udp;
1535
1536         fin->fin_flx |= FI_TCPUDP;
1537
1538         if (!fin->fin_off && (fin->fin_dlen > 3)) {
1539                 if (ipf_pr_pullup(fin, sizeof(*udp)) == -1) {
1540                         ipf_main_softc_t *softc = fin->fin_main_soft;
1541
1542                         fin->fin_flx |= FI_SHORT;
1543                         LBUMPD(ipf_stats[fin->fin_out], fr_udp_pullup);
1544                         return 1;
1545                 }
1546
1547                 udp = fin->fin_dp;
1548
1549                 fin->fin_sport = ntohs(udp->uh_sport);
1550                 fin->fin_dport = ntohs(udp->uh_dport);
1551         }
1552
1553         return 0;
1554 }
1555
1556
1557 /* ------------------------------------------------------------------------ */
1558 /* Function:    ipf_pr_tcp                                                  */
1559 /* Returns:     void                                                        */
1560 /* Parameters:  fin(I) - pointer to packet information                      */
1561 /*                                                                          */
1562 /* IPv4 Only                                                                */
1563 /* Analyse the packet for IPv4/TCP properties.                              */
1564 /* ------------------------------------------------------------------------ */
1565 static INLINE void
1566 ipf_pr_tcp(fin)
1567         fr_info_t *fin;
1568 {
1569
1570         ipf_pr_short(fin, sizeof(tcphdr_t));
1571
1572         if (ipf_pr_tcpcommon(fin) == 0)
1573                 ipf_checkv4sum(fin);
1574 }
1575
1576
1577 /* ------------------------------------------------------------------------ */
1578 /* Function:    ipf_pr_udp                                                  */
1579 /* Returns:     void                                                        */
1580 /* Parameters:  fin(I) - pointer to packet information                      */
1581 /*                                                                          */
1582 /* IPv4 Only                                                                */
1583 /* Analyse the packet for IPv4/UDP properties.                              */
1584 /* ------------------------------------------------------------------------ */
1585 static INLINE void
1586 ipf_pr_udp(fin)
1587         fr_info_t *fin;
1588 {
1589
1590         ipf_pr_short(fin, sizeof(udphdr_t));
1591
1592         if (ipf_pr_udpcommon(fin) == 0)
1593                 ipf_checkv4sum(fin);
1594 }
1595
1596
1597 /* ------------------------------------------------------------------------ */
1598 /* Function:    ipf_pr_esp                                                  */
1599 /* Returns:     void                                                        */
1600 /* Parameters:  fin(I) - pointer to packet information                      */
1601 /*                                                                          */
1602 /* Analyse the packet for ESP properties.                                   */
1603 /* The minimum length is taken to be the SPI (32bits) plus a tail (32bits)  */
1604 /* even though the newer ESP packets must also have a sequence number that  */
1605 /* is 32bits as well, it is not possible(?) to determine the version from a */
1606 /* simple packet header.                                                    */
1607 /* ------------------------------------------------------------------------ */
1608 static INLINE void
1609 ipf_pr_esp(fin)
1610         fr_info_t *fin;
1611 {
1612
1613         if (fin->fin_off == 0) {
1614                 ipf_pr_short(fin, 8);
1615                 if (ipf_pr_pullup(fin, 8) == -1) {
1616                         ipf_main_softc_t *softc = fin->fin_main_soft;
1617
1618                         LBUMPD(ipf_stats[fin->fin_out], fr_v4_esp_pullup);
1619                 }
1620         }
1621 }
1622
1623
1624 /* ------------------------------------------------------------------------ */
1625 /* Function:    ipf_pr_ah                                                   */
1626 /* Returns:     int    - value of the next header or IPPROTO_NONE if error  */
1627 /* Parameters:  fin(I) - pointer to packet information                      */
1628 /*                                                                          */
1629 /* Analyse the packet for AH properties.                                    */
1630 /* The minimum length is taken to be the combination of all fields in the   */
1631 /* header being present and no authentication data (null algorithm used.)   */
1632 /* ------------------------------------------------------------------------ */
1633 static INLINE int
1634 ipf_pr_ah(fin)
1635         fr_info_t *fin;
1636 {
1637         ipf_main_softc_t *softc = fin->fin_main_soft;
1638         authhdr_t *ah;
1639         int len;
1640
1641         fin->fin_flx |= FI_AH;
1642         ipf_pr_short(fin, sizeof(*ah));
1643
1644         if (((fin->fin_flx & FI_SHORT) != 0) || (fin->fin_off != 0)) {
1645                 LBUMPD(ipf_stats[fin->fin_out], fr_v4_ah_bad);
1646                 return IPPROTO_NONE;
1647         }
1648
1649         if (ipf_pr_pullup(fin, sizeof(*ah)) == -1) {
1650                 DT(fr_v4_ah_pullup_1);
1651                 LBUMP(ipf_stats[fin->fin_out].fr_v4_ah_pullup);
1652                 return IPPROTO_NONE;
1653         }
1654
1655         ah = (authhdr_t *)fin->fin_dp;
1656
1657         len = (ah->ah_plen + 2) << 2;
1658         ipf_pr_short(fin, len);
1659         if (ipf_pr_pullup(fin, len) == -1) {
1660                 DT(fr_v4_ah_pullup_2);
1661                 LBUMP(ipf_stats[fin->fin_out].fr_v4_ah_pullup);
1662                 return IPPROTO_NONE;
1663         }
1664
1665         /*
1666          * Adjust fin_dp and fin_dlen for skipping over the authentication
1667          * header.
1668          */
1669         fin->fin_dp = (char *)fin->fin_dp + len;
1670         fin->fin_dlen -= len;
1671         return ah->ah_next;
1672 }
1673
1674
1675 /* ------------------------------------------------------------------------ */
1676 /* Function:    ipf_pr_gre                                                  */
1677 /* Returns:     void                                                        */
1678 /* Parameters:  fin(I) - pointer to packet information                      */
1679 /*                                                                          */
1680 /* Analyse the packet for GRE properties.                                   */
1681 /* ------------------------------------------------------------------------ */
1682 static INLINE void
1683 ipf_pr_gre(fin)
1684         fr_info_t *fin;
1685 {
1686         ipf_main_softc_t *softc = fin->fin_main_soft;
1687         grehdr_t *gre;
1688
1689         ipf_pr_short(fin, sizeof(grehdr_t));
1690
1691         if (fin->fin_off != 0) {
1692                 LBUMPD(ipf_stats[fin->fin_out], fr_v4_gre_frag);
1693                 return;
1694         }
1695
1696         if (ipf_pr_pullup(fin, sizeof(grehdr_t)) == -1) {
1697                 LBUMPD(ipf_stats[fin->fin_out], fr_v4_gre_pullup);
1698                 return;
1699         }
1700
1701         gre = fin->fin_dp;
1702         if (GRE_REV(gre->gr_flags) == 1)
1703                 fin->fin_data[0] = gre->gr_call;
1704 }
1705
1706
1707 /* ------------------------------------------------------------------------ */
1708 /* Function:    ipf_pr_ipv4hdr                                              */
1709 /* Returns:     void                                                        */
1710 /* Parameters:  fin(I) - pointer to packet information                      */
1711 /*                                                                          */
1712 /* IPv4 Only                                                                */
1713 /* Analyze the IPv4 header and set fields in the fr_info_t structure.       */
1714 /* Check all options present and flag their presence if any exist.          */
1715 /* ------------------------------------------------------------------------ */
1716 static INLINE void
1717 ipf_pr_ipv4hdr(fin)
1718         fr_info_t *fin;
1719 {
1720         u_short optmsk = 0, secmsk = 0, auth = 0;
1721         int hlen, ol, mv, p, i;
1722         const struct optlist *op;
1723         u_char *s, opt;
1724         u_short off;
1725         fr_ip_t *fi;
1726         ip_t *ip;
1727
1728         fi = &fin->fin_fi;
1729         hlen = fin->fin_hlen;
1730
1731         ip = fin->fin_ip;
1732         p = ip->ip_p;
1733         fi->fi_p = p;
1734         fin->fin_crc = p;
1735         fi->fi_tos = ip->ip_tos;
1736         fin->fin_id = ip->ip_id;
1737         off = ntohs(ip->ip_off);
1738
1739         /* Get both TTL and protocol */
1740         fi->fi_p = ip->ip_p;
1741         fi->fi_ttl = ip->ip_ttl;
1742
1743         /* Zero out bits not used in IPv6 address */
1744         fi->fi_src.i6[1] = 0;
1745         fi->fi_src.i6[2] = 0;
1746         fi->fi_src.i6[3] = 0;
1747         fi->fi_dst.i6[1] = 0;
1748         fi->fi_dst.i6[2] = 0;
1749         fi->fi_dst.i6[3] = 0;
1750
1751         fi->fi_saddr = ip->ip_src.s_addr;
1752         fin->fin_crc += fi->fi_saddr;
1753         fi->fi_daddr = ip->ip_dst.s_addr;
1754         fin->fin_crc += fi->fi_daddr;
1755         if (IN_CLASSD(ntohl(fi->fi_daddr)))
1756                 fin->fin_flx |= FI_MULTICAST|FI_MBCAST;
1757
1758         /*
1759          * set packet attribute flags based on the offset and
1760          * calculate the byte offset that it represents.
1761          */
1762         off &= IP_MF|IP_OFFMASK;
1763         if (off != 0) {
1764                 int morefrag = off & IP_MF;
1765
1766                 fi->fi_flx |= FI_FRAG;
1767                 off &= IP_OFFMASK;
1768                 if (off != 0) {
1769                         fin->fin_flx |= FI_FRAGBODY;
1770                         off <<= 3;
1771                         if ((off + fin->fin_dlen > 65535) ||
1772                             (fin->fin_dlen == 0) ||
1773                             ((morefrag != 0) && ((fin->fin_dlen & 7) != 0))) {
1774                                 /*
1775                                  * The length of the packet, starting at its
1776                                  * offset cannot exceed 65535 (0xffff) as the
1777                                  * length of an IP packet is only 16 bits.
1778                                  *
1779                                  * Any fragment that isn't the last fragment
1780                                  * must have a length greater than 0 and it
1781                                  * must be an even multiple of 8.
1782                                  */
1783                                 fi->fi_flx |= FI_BAD;
1784                                 DT1(ipf_fi_bad_fragbody_gt_65535, fr_info_t *, fin);
1785                         }
1786                 }
1787         }
1788         fin->fin_off = off;
1789
1790         /*
1791          * Call per-protocol setup and checking
1792          */
1793         if (p == IPPROTO_AH) {
1794                 /*
1795                  * Treat AH differently because we expect there to be another
1796                  * layer 4 header after it.
1797                  */
1798                 p = ipf_pr_ah(fin);
1799         }
1800
1801         switch (p)
1802         {
1803         case IPPROTO_UDP :
1804                 ipf_pr_udp(fin);
1805                 break;
1806         case IPPROTO_TCP :
1807                 ipf_pr_tcp(fin);
1808                 break;
1809         case IPPROTO_ICMP :
1810                 ipf_pr_icmp(fin);
1811                 break;
1812         case IPPROTO_ESP :
1813                 ipf_pr_esp(fin);
1814                 break;
1815         case IPPROTO_GRE :
1816                 ipf_pr_gre(fin);
1817                 break;
1818         }
1819
1820         ip = fin->fin_ip;
1821         if (ip == NULL)
1822                 return;
1823
1824         /*
1825          * If it is a standard IP header (no options), set the flag fields
1826          * which relate to options to 0.
1827          */
1828         if (hlen == sizeof(*ip)) {
1829                 fi->fi_optmsk = 0;
1830                 fi->fi_secmsk = 0;
1831                 fi->fi_auth = 0;
1832                 return;
1833         }
1834
1835         /*
1836          * So the IP header has some IP options attached.  Walk the entire
1837          * list of options present with this packet and set flags to indicate
1838          * which ones are here and which ones are not.  For the somewhat out
1839          * of date and obscure security classification options, set a flag to
1840          * represent which classification is present.
1841          */
1842         fi->fi_flx |= FI_OPTIONS;
1843
1844         for (s = (u_char *)(ip + 1), hlen -= (int)sizeof(*ip); hlen > 0; ) {
1845                 opt = *s;
1846                 if (opt == '\0')
1847                         break;
1848                 else if (opt == IPOPT_NOP)
1849                         ol = 1;
1850                 else {
1851                         if (hlen < 2)
1852                                 break;
1853                         ol = (int)*(s + 1);
1854                         if (ol < 2 || ol > hlen)
1855                                 break;
1856                 }
1857                 for (i = 9, mv = 4; mv >= 0; ) {
1858                         op = ipopts + i;
1859
1860                         if ((opt == (u_char)op->ol_val) && (ol > 4)) {
1861                                 u_32_t doi;
1862
1863                                 switch (opt)
1864                                 {
1865                                 case IPOPT_SECURITY :
1866                                         if (optmsk & op->ol_bit) {
1867                                                 fin->fin_flx |= FI_BAD;
1868                                                 DT2(ipf_fi_bad_ipopt_security, fr_info_t *, fin, u_short, (optmsk & op->ol_bit));
1869                                         } else {
1870                                                 doi = ipf_checkripso(s);
1871                                                 secmsk = doi >> 16;
1872                                                 auth = doi & 0xffff;
1873                                         }
1874                                         break;
1875
1876                                 case IPOPT_CIPSO :
1877
1878                                         if (optmsk & op->ol_bit) {
1879                                                 fin->fin_flx |= FI_BAD;
1880                                                 DT2(ipf_fi_bad_ipopt_cipso, fr_info_t *, fin, u_short, (optmsk & op->ol_bit));
1881                                         } else {
1882                                                 doi = ipf_checkcipso(fin,
1883                                                                      s, ol);
1884                                                 secmsk = doi >> 16;
1885                                                 auth = doi & 0xffff;
1886                                         }
1887                                         break;
1888                                 }
1889                                 optmsk |= op->ol_bit;
1890                         }
1891
1892                         if (opt < op->ol_val)
1893                                 i -= mv;
1894                         else
1895                                 i += mv;
1896                         mv--;
1897                 }
1898                 hlen -= ol;
1899                 s += ol;
1900         }
1901
1902         /*
1903          *
1904          */
1905         if (auth && !(auth & 0x0100))
1906                 auth &= 0xff00;
1907         fi->fi_optmsk = optmsk;
1908         fi->fi_secmsk = secmsk;
1909         fi->fi_auth = auth;
1910 }
1911
1912
1913 /* ------------------------------------------------------------------------ */
1914 /* Function:    ipf_checkripso                                              */
1915 /* Returns:     void                                                        */
1916 /* Parameters:  s(I)   - pointer to start of RIPSO option                   */
1917 /*                                                                          */
1918 /* ------------------------------------------------------------------------ */
1919 static u_32_t
1920 ipf_checkripso(s)
1921         u_char *s;
1922 {
1923         const struct optlist *sp;
1924         u_short secmsk = 0, auth = 0;
1925         u_char sec;
1926         int j, m;
1927
1928         sec = *(s + 2); /* classification */
1929         for (j = 3, m = 2; m >= 0; ) {
1930                 sp = secopt + j;
1931                 if (sec == sp->ol_val) {
1932                         secmsk |= sp->ol_bit;
1933                         auth = *(s + 3);
1934                         auth *= 256;
1935                         auth += *(s + 4);
1936                         break;
1937                 }
1938                 if (sec < sp->ol_val)
1939                         j -= m;
1940                 else
1941                         j += m;
1942                 m--;
1943         }
1944
1945         return (secmsk << 16) | auth;
1946 }
1947
1948
1949 /* ------------------------------------------------------------------------ */
1950 /* Function:    ipf_checkcipso                                              */
1951 /* Returns:     u_32_t  - 0 = failure, else the doi from the header         */
1952 /* Parameters:  fin(IO) - pointer to packet information                     */
1953 /*              s(I)    - pointer to start of CIPSO option                  */
1954 /*              ol(I)   - length of CIPSO option field                      */
1955 /*                                                                          */
1956 /* This function returns the domain of integrity (DOI) field from the CIPSO */
1957 /* header and returns that whilst also storing the highest sensitivity      */
1958 /* value found in the fr_info_t structure.                                  */
1959 /*                                                                          */
1960 /* No attempt is made to extract the category bitmaps as these are defined  */
1961 /* by the user (rather than the protocol) and can be rather numerous on the */
1962 /* end nodes.                                                               */
1963 /* ------------------------------------------------------------------------ */
1964 static u_32_t
1965 ipf_checkcipso(fin, s, ol)
1966         fr_info_t *fin;
1967         u_char *s;
1968         int ol;
1969 {
1970         ipf_main_softc_t *softc = fin->fin_main_soft;
1971         fr_ip_t *fi;
1972         u_32_t doi;
1973         u_char *t, tag, tlen, sensitivity;
1974         int len;
1975
1976         if (ol < 6 || ol > 40) {
1977                 LBUMPD(ipf_stats[fin->fin_out], fr_v4_cipso_bad);
1978                 fin->fin_flx |= FI_BAD;
1979                 DT2(ipf_fi_bad_checkcipso_ol, fr_info_t *, fin, u_int, ol);
1980                 return 0;
1981         }
1982
1983         fi = &fin->fin_fi;
1984         fi->fi_sensitivity = 0;
1985         /*
1986          * The DOI field MUST be there.
1987          */
1988         bcopy(s + 2, &doi, sizeof(doi));
1989
1990         t = (u_char *)s + 6;
1991         for (len = ol - 6; len >= 2; len -= tlen, t+= tlen) {
1992                 tag = *t;
1993                 tlen = *(t + 1);
1994                 if (tlen > len || tlen < 4 || tlen > 34) {
1995                         LBUMPD(ipf_stats[fin->fin_out], fr_v4_cipso_tlen);
1996                         fin->fin_flx |= FI_BAD;
1997                         DT2(ipf_fi_bad_checkcipso_tlen, fr_info_t *, fin, u_int, tlen);
1998                         return 0;
1999                 }
2000
2001                 sensitivity = 0;
2002                 /*
2003                  * Tag numbers 0, 1, 2, 5 are laid out in the CIPSO Internet
2004                  * draft (16 July 1992) that has expired.
2005                  */
2006                 if (tag == 0) {
2007                         fin->fin_flx |= FI_BAD;
2008                         DT2(ipf_fi_bad_checkcipso_tag, fr_info_t *, fin, u_int, tag);
2009                         continue;
2010                 } else if (tag == 1) {
2011                         if (*(t + 2) != 0) {
2012                                 fin->fin_flx |= FI_BAD;
2013                                 DT2(ipf_fi_bad_checkcipso_tag1_t2, fr_info_t *, fin, u_int, (*t + 2));
2014                                 continue;
2015                         }
2016                         sensitivity = *(t + 3);
2017                         /* Category bitmap for categories 0-239 */
2018
2019                 } else if (tag == 4) {
2020                         if (*(t + 2) != 0) {
2021                                 fin->fin_flx |= FI_BAD;
2022                                 DT2(ipf_fi_bad_checkcipso_tag4_t2, fr_info_t *, fin, u_int, (*t + 2));
2023                                 continue;
2024                         }
2025                         sensitivity = *(t + 3);
2026                         /* Enumerated categories, 16bits each, upto 15 */
2027
2028                 } else if (tag == 5) {
2029                         if (*(t + 2) != 0) {
2030                                 fin->fin_flx |= FI_BAD;
2031                                 DT2(ipf_fi_bad_checkcipso_tag5_t2, fr_info_t *, fin, u_int, (*t + 2));
2032                                 continue;
2033                         }
2034                         sensitivity = *(t + 3);
2035                         /* Range of categories (2*16bits), up to 7 pairs */
2036
2037                 } else if (tag > 127) {
2038                         /* Custom defined DOI */
2039                         ;
2040                 } else {
2041                         fin->fin_flx |= FI_BAD;
2042                         DT2(ipf_fi_bad_checkcipso_tag127, fr_info_t *, fin, u_int, tag);
2043                         continue;
2044                 }
2045
2046                 if (sensitivity > fi->fi_sensitivity)
2047                         fi->fi_sensitivity = sensitivity;
2048         }
2049
2050         return doi;
2051 }
2052
2053
2054 /* ------------------------------------------------------------------------ */
2055 /* Function:    ipf_makefrip                                                */
2056 /* Returns:     int     - 0 == packet ok, -1 == packet freed                */
2057 /* Parameters:  hlen(I) - length of IP packet header                        */
2058 /*              ip(I)   - pointer to the IP header                          */
2059 /*              fin(IO) - pointer to packet information                     */
2060 /*                                                                          */
2061 /* Compact the IP header into a structure which contains just the info.     */
2062 /* which is useful for comparing IP headers with and store this information */
2063 /* in the fr_info_t structure pointer to by fin.  At present, it is assumed */
2064 /* this function will be called with either an IPv4 or IPv6 packet.         */
2065 /* ------------------------------------------------------------------------ */
2066 int
2067 ipf_makefrip(hlen, ip, fin)
2068         int hlen;
2069         ip_t *ip;
2070         fr_info_t *fin;
2071 {
2072         ipf_main_softc_t *softc = fin->fin_main_soft;
2073         int v;
2074
2075         fin->fin_depth = 0;
2076         fin->fin_hlen = (u_short)hlen;
2077         fin->fin_ip = ip;
2078         fin->fin_rule = 0xffffffff;
2079         fin->fin_group[0] = -1;
2080         fin->fin_group[1] = '\0';
2081         fin->fin_dp = (char *)ip + hlen;
2082
2083         v = fin->fin_v;
2084         if (v == 4) {
2085                 fin->fin_plen = ntohs(ip->ip_len);
2086                 fin->fin_dlen = fin->fin_plen - hlen;
2087                 ipf_pr_ipv4hdr(fin);
2088 #ifdef  USE_INET6
2089         } else if (v == 6) {
2090                 fin->fin_plen = ntohs(((ip6_t *)ip)->ip6_plen);
2091                 fin->fin_dlen = fin->fin_plen;
2092                 fin->fin_plen += hlen;
2093
2094                 ipf_pr_ipv6hdr(fin);
2095 #endif
2096         }
2097         if (fin->fin_ip == NULL) {
2098                 LBUMP(ipf_stats[fin->fin_out].fr_ip_freed);
2099                 return -1;
2100         }
2101         return 0;
2102 }
2103
2104
2105 /* ------------------------------------------------------------------------ */
2106 /* Function:    ipf_portcheck                                               */
2107 /* Returns:     int - 1 == port matched, 0 == port match failed             */
2108 /* Parameters:  frp(I) - pointer to port check `expression'                 */
2109 /*              pop(I) - port number to evaluate                            */
2110 /*                                                                          */
2111 /* Perform a comparison of a port number against some other(s), using a     */
2112 /* structure with compare information stored in it.                         */
2113 /* ------------------------------------------------------------------------ */
2114 static INLINE int
2115 ipf_portcheck(frp, pop)
2116         frpcmp_t *frp;
2117         u_32_t pop;
2118 {
2119         int err = 1;
2120         u_32_t po;
2121
2122         po = frp->frp_port;
2123
2124         /*
2125          * Do opposite test to that required and continue if that succeeds.
2126          */
2127         switch (frp->frp_cmp)
2128         {
2129         case FR_EQUAL :
2130                 if (pop != po) /* EQUAL */
2131                         err = 0;
2132                 break;
2133         case FR_NEQUAL :
2134                 if (pop == po) /* NOTEQUAL */
2135                         err = 0;
2136                 break;
2137         case FR_LESST :
2138                 if (pop >= po) /* LESSTHAN */
2139                         err = 0;
2140                 break;
2141         case FR_GREATERT :
2142                 if (pop <= po) /* GREATERTHAN */
2143                         err = 0;
2144                 break;
2145         case FR_LESSTE :
2146                 if (pop > po) /* LT or EQ */
2147                         err = 0;
2148                 break;
2149         case FR_GREATERTE :
2150                 if (pop < po) /* GT or EQ */
2151                         err = 0;
2152                 break;
2153         case FR_OUTRANGE :
2154                 if (pop >= po && pop <= frp->frp_top) /* Out of range */
2155                         err = 0;
2156                 break;
2157         case FR_INRANGE :
2158                 if (pop <= po || pop >= frp->frp_top) /* In range */
2159                         err = 0;
2160                 break;
2161         case FR_INCRANGE :
2162                 if (pop < po || pop > frp->frp_top) /* Inclusive range */
2163                         err = 0;
2164                 break;
2165         default :
2166                 break;
2167         }
2168         return err;
2169 }
2170
2171
2172 /* ------------------------------------------------------------------------ */
2173 /* Function:    ipf_tcpudpchk                                               */
2174 /* Returns:     int - 1 == protocol matched, 0 == check failed              */
2175 /* Parameters:  fda(I) - pointer to packet information                      */
2176 /*              ft(I)  - pointer to structure with comparison data          */
2177 /*                                                                          */
2178 /* Compares the current pcket (assuming it is TCP/UDP) information with a   */
2179 /* structure containing information that we want to match against.          */
2180 /* ------------------------------------------------------------------------ */
2181 int
2182 ipf_tcpudpchk(fi, ft)
2183         fr_ip_t *fi;
2184         frtuc_t *ft;
2185 {
2186         int err = 1;
2187
2188         /*
2189          * Both ports should *always* be in the first fragment.
2190          * So far, I cannot find any cases where they can not be.
2191          *
2192          * compare destination ports
2193          */
2194         if (ft->ftu_dcmp)
2195                 err = ipf_portcheck(&ft->ftu_dst, fi->fi_ports[1]);
2196
2197         /*
2198          * compare source ports
2199          */
2200         if (err && ft->ftu_scmp)
2201                 err = ipf_portcheck(&ft->ftu_src, fi->fi_ports[0]);
2202
2203         /*
2204          * If we don't have all the TCP/UDP header, then how can we
2205          * expect to do any sort of match on it ?  If we were looking for
2206          * TCP flags, then NO match.  If not, then match (which should
2207          * satisfy the "short" class too).
2208          */
2209         if (err && (fi->fi_p == IPPROTO_TCP)) {
2210                 if (fi->fi_flx & FI_SHORT)
2211                         return !(ft->ftu_tcpf | ft->ftu_tcpfm);
2212                 /*
2213                  * Match the flags ?  If not, abort this match.
2214                  */
2215                 if (ft->ftu_tcpfm &&
2216                     ft->ftu_tcpf != (fi->fi_tcpf & ft->ftu_tcpfm)) {
2217                         FR_DEBUG(("f. %#x & %#x != %#x\n", fi->fi_tcpf,
2218                                  ft->ftu_tcpfm, ft->ftu_tcpf));
2219                         err = 0;
2220                 }
2221         }
2222         return err;
2223 }
2224
2225
2226 /* ------------------------------------------------------------------------ */
2227 /* Function:    ipf_check_ipf                                               */
2228 /* Returns:     int - 0 == match, else no match                             */
2229 /* Parameters:  fin(I)     - pointer to packet information                  */
2230 /*              fr(I)      - pointer to filter rule                         */
2231 /*              portcmp(I) - flag indicating whether to attempt matching on */
2232 /*                           TCP/UDP port data.                             */
2233 /*                                                                          */
2234 /* Check to see if a packet matches an IPFilter rule.  Checks of addresses, */
2235 /* port numbers, etc, for "standard" IPFilter rules are all orchestrated in */
2236 /* this function.                                                           */
2237 /* ------------------------------------------------------------------------ */
2238 static INLINE int
2239 ipf_check_ipf(fin, fr, portcmp)
2240         fr_info_t *fin;
2241         frentry_t *fr;
2242         int portcmp;
2243 {
2244         u_32_t  *ld, *lm, *lip;
2245         fripf_t *fri;
2246         fr_ip_t *fi;
2247         int i;
2248
2249         fi = &fin->fin_fi;
2250         fri = fr->fr_ipf;
2251         lip = (u_32_t *)fi;
2252         lm = (u_32_t *)&fri->fri_mip;
2253         ld = (u_32_t *)&fri->fri_ip;
2254
2255         /*
2256          * first 32 bits to check coversion:
2257          * IP version, TOS, TTL, protocol
2258          */
2259         i = ((*lip & *lm) != *ld);
2260         FR_DEBUG(("0. %#08x & %#08x != %#08x\n",
2261                    ntohl(*lip), ntohl(*lm), ntohl(*ld)));
2262         if (i)
2263                 return 1;
2264
2265         /*
2266          * Next 32 bits is a constructed bitmask indicating which IP options
2267          * are present (if any) in this packet.
2268          */
2269         lip++, lm++, ld++;
2270         i = ((*lip & *lm) != *ld);
2271         FR_DEBUG(("1. %#08x & %#08x != %#08x\n",
2272                    ntohl(*lip), ntohl(*lm), ntohl(*ld)));
2273         if (i != 0)
2274                 return 1;
2275
2276         lip++, lm++, ld++;
2277         /*
2278          * Unrolled loops (4 each, for 32 bits) for address checks.
2279          */
2280         /*
2281          * Check the source address.
2282          */
2283         if (fr->fr_satype == FRI_LOOKUP) {
2284                 i = (*fr->fr_srcfunc)(fin->fin_main_soft, fr->fr_srcptr,
2285                                       fi->fi_v, lip, fin->fin_plen);
2286                 if (i == -1)
2287                         return 1;
2288                 lip += 3;
2289                 lm += 3;
2290                 ld += 3;
2291         } else {
2292                 i = ((*lip & *lm) != *ld);
2293                 FR_DEBUG(("2a. %#08x & %#08x != %#08x\n",
2294                            ntohl(*lip), ntohl(*lm), ntohl(*ld)));
2295                 if (fi->fi_v == 6) {
2296                         lip++, lm++, ld++;
2297                         i |= ((*lip & *lm) != *ld);
2298                         FR_DEBUG(("2b. %#08x & %#08x != %#08x\n",
2299                                    ntohl(*lip), ntohl(*lm), ntohl(*ld)));
2300                         lip++, lm++, ld++;
2301                         i |= ((*lip & *lm) != *ld);
2302                         FR_DEBUG(("2c. %#08x & %#08x != %#08x\n",
2303                                    ntohl(*lip), ntohl(*lm), ntohl(*ld)));
2304                         lip++, lm++, ld++;
2305                         i |= ((*lip & *lm) != *ld);
2306                         FR_DEBUG(("2d. %#08x & %#08x != %#08x\n",
2307                                    ntohl(*lip), ntohl(*lm), ntohl(*ld)));
2308                 } else {
2309                         lip += 3;
2310                         lm += 3;
2311                         ld += 3;
2312                 }
2313         }
2314         i ^= (fr->fr_flags & FR_NOTSRCIP) >> 6;
2315         if (i != 0)
2316                 return 1;
2317
2318         /*
2319          * Check the destination address.
2320          */
2321         lip++, lm++, ld++;
2322         if (fr->fr_datype == FRI_LOOKUP) {
2323                 i = (*fr->fr_dstfunc)(fin->fin_main_soft, fr->fr_dstptr,
2324                                       fi->fi_v, lip, fin->fin_plen);
2325                 if (i == -1)
2326                         return 1;
2327                 lip += 3;
2328                 lm += 3;
2329                 ld += 3;
2330         } else {
2331                 i = ((*lip & *lm) != *ld);
2332                 FR_DEBUG(("3a. %#08x & %#08x != %#08x\n",
2333                            ntohl(*lip), ntohl(*lm), ntohl(*ld)));
2334                 if (fi->fi_v == 6) {
2335                         lip++, lm++, ld++;
2336                         i |= ((*lip & *lm) != *ld);
2337                         FR_DEBUG(("3b. %#08x & %#08x != %#08x\n",
2338                                    ntohl(*lip), ntohl(*lm), ntohl(*ld)));
2339                         lip++, lm++, ld++;
2340                         i |= ((*lip & *lm) != *ld);
2341                         FR_DEBUG(("3c. %#08x & %#08x != %#08x\n",
2342                                    ntohl(*lip), ntohl(*lm), ntohl(*ld)));
2343                         lip++, lm++, ld++;
2344                         i |= ((*lip & *lm) != *ld);
2345                         FR_DEBUG(("3d. %#08x & %#08x != %#08x\n",
2346                                    ntohl(*lip), ntohl(*lm), ntohl(*ld)));
2347                 } else {
2348                         lip += 3;
2349                         lm += 3;
2350                         ld += 3;
2351                 }
2352         }
2353         i ^= (fr->fr_flags & FR_NOTDSTIP) >> 7;
2354         if (i != 0)
2355                 return 1;
2356         /*
2357          * IP addresses matched.  The next 32bits contains:
2358          * mast of old IP header security & authentication bits.
2359          */
2360         lip++, lm++, ld++;
2361         i = (*ld - (*lip & *lm));
2362         FR_DEBUG(("4. %#08x & %#08x != %#08x\n", *lip, *lm, *ld));
2363
2364         /*
2365          * Next we have 32 bits of packet flags.
2366          */
2367         lip++, lm++, ld++;
2368         i |= (*ld - (*lip & *lm));
2369         FR_DEBUG(("5. %#08x & %#08x != %#08x\n", *lip, *lm, *ld));
2370
2371         if (i == 0) {
2372                 /*
2373                  * If a fragment, then only the first has what we're
2374                  * looking for here...
2375                  */
2376                 if (portcmp) {
2377                         if (!ipf_tcpudpchk(&fin->fin_fi, &fr->fr_tuc))
2378                                 i = 1;
2379                 } else {
2380                         if (fr->fr_dcmp || fr->fr_scmp ||
2381                             fr->fr_tcpf || fr->fr_tcpfm)
2382                                 i = 1;
2383                         if (fr->fr_icmpm || fr->fr_icmp) {
2384                                 if (((fi->fi_p != IPPROTO_ICMP) &&
2385                                      (fi->fi_p != IPPROTO_ICMPV6)) ||
2386                                     fin->fin_off || (fin->fin_dlen < 2))
2387                                         i = 1;
2388                                 else if ((fin->fin_data[0] & fr->fr_icmpm) !=
2389                                          fr->fr_icmp) {
2390                                         FR_DEBUG(("i. %#x & %#x != %#x\n",
2391                                                  fin->fin_data[0],
2392                                                  fr->fr_icmpm, fr->fr_icmp));
2393                                         i = 1;
2394                                 }
2395                         }
2396                 }
2397         }
2398         return i;
2399 }
2400
2401
2402 /* ------------------------------------------------------------------------ */
2403 /* Function:    ipf_scanlist                                                */
2404 /* Returns:     int - result flags of scanning filter list                  */
2405 /* Parameters:  fin(I) - pointer to packet information                      */
2406 /*              pass(I) - default result to return for filtering            */
2407 /*                                                                          */
2408 /* Check the input/output list of rules for a match to the current packet.  */
2409 /* If a match is found, the value of fr_flags from the rule becomes the     */
2410 /* return value and fin->fin_fr points to the matched rule.                 */
2411 /*                                                                          */
2412 /* This function may be called recusively upto 16 times (limit inbuilt.)    */
2413 /* When unwinding, it should finish up with fin_depth as 0.                 */
2414 /*                                                                          */
2415 /* Could be per interface, but this gets real nasty when you don't have,    */
2416 /* or can't easily change, the kernel source code to .                      */
2417 /* ------------------------------------------------------------------------ */
2418 int
2419 ipf_scanlist(fin, pass)
2420         fr_info_t *fin;
2421         u_32_t pass;
2422 {
2423         ipf_main_softc_t *softc = fin->fin_main_soft;
2424         int rulen, portcmp, off, skip;
2425         struct frentry *fr, *fnext;
2426         u_32_t passt, passo;
2427
2428         /*
2429          * Do not allow nesting deeper than 16 levels.
2430          */
2431         if (fin->fin_depth >= 16)
2432                 return pass;
2433
2434         fr = fin->fin_fr;
2435
2436         /*
2437          * If there are no rules in this list, return now.
2438          */
2439         if (fr == NULL)
2440                 return pass;
2441
2442         skip = 0;
2443         portcmp = 0;
2444         fin->fin_depth++;
2445         fin->fin_fr = NULL;
2446         off = fin->fin_off;
2447
2448         if ((fin->fin_flx & FI_TCPUDP) && (fin->fin_dlen > 3) && !off)
2449                 portcmp = 1;
2450
2451         for (rulen = 0; fr; fr = fnext, rulen++) {
2452                 fnext = fr->fr_next;
2453                 if (skip != 0) {
2454                         FR_VERBOSE(("SKIP %d (%#x)\n", skip, fr->fr_flags));
2455                         skip--;
2456                         continue;
2457                 }
2458
2459                 /*
2460                  * In all checks below, a null (zero) value in the
2461                  * filter struture is taken to mean a wildcard.
2462                  *
2463                  * check that we are working for the right interface
2464                  */
2465 #ifdef  _KERNEL
2466                 if (fr->fr_ifa && fr->fr_ifa != fin->fin_ifp)
2467                         continue;
2468 #else
2469                 if (opts & (OPT_VERBOSE|OPT_DEBUG))
2470                         printf("\n");
2471                 FR_VERBOSE(("%c", FR_ISSKIP(pass) ? 's' :
2472                                   FR_ISPASS(pass) ? 'p' :
2473                                   FR_ISACCOUNT(pass) ? 'A' :
2474                                   FR_ISAUTH(pass) ? 'a' :
2475                                   (pass & FR_NOMATCH) ? 'n' :'b'));
2476                 if (fr->fr_ifa && fr->fr_ifa != fin->fin_ifp)
2477                         continue;
2478                 FR_VERBOSE((":i"));
2479 #endif
2480
2481                 switch (fr->fr_type)
2482                 {
2483                 case FR_T_IPF :
2484                 case FR_T_IPF_BUILTIN :
2485                         if (ipf_check_ipf(fin, fr, portcmp))
2486                                 continue;
2487                         break;
2488 #if defined(IPFILTER_BPF)
2489                 case FR_T_BPFOPC :
2490                 case FR_T_BPFOPC_BUILTIN :
2491                     {
2492                         u_char *mc;
2493                         int wlen;
2494
2495                         if (*fin->fin_mp == NULL)
2496                                 continue;
2497                         if (fin->fin_family != fr->fr_family)
2498                                 continue;
2499                         mc = (u_char *)fin->fin_m;
2500                         wlen = fin->fin_dlen + fin->fin_hlen;
2501                         if (!bpf_filter(fr->fr_data, mc, wlen, 0))
2502                                 continue;
2503                         break;
2504                     }
2505 #endif
2506                 case FR_T_CALLFUNC_BUILTIN :
2507                     {
2508                         frentry_t *f;
2509
2510                         f = (*fr->fr_func)(fin, &pass);
2511                         if (f != NULL)
2512                                 fr = f;
2513                         else
2514                                 continue;
2515                         break;
2516                     }
2517
2518                 case FR_T_IPFEXPR :
2519                 case FR_T_IPFEXPR_BUILTIN :
2520                         if (fin->fin_family != fr->fr_family)
2521                                 continue;
2522                         if (ipf_fr_matcharray(fin, fr->fr_data) == 0)
2523                                 continue;
2524                         break;
2525
2526                 default :
2527                         break;
2528                 }
2529
2530                 if ((fin->fin_out == 0) && (fr->fr_nattag.ipt_num[0] != 0)) {
2531                         if (fin->fin_nattag == NULL)
2532                                 continue;
2533                         if (ipf_matchtag(&fr->fr_nattag, fin->fin_nattag) == 0)
2534                                 continue;
2535                 }
2536                 FR_VERBOSE(("=%d/%d.%d *", fr->fr_grhead, fr->fr_group, rulen));
2537
2538                 passt = fr->fr_flags;
2539
2540                 /*
2541                  * If the rule is a "call now" rule, then call the function
2542                  * in the rule, if it exists and use the results from that.
2543                  * If the function pointer is bad, just make like we ignore
2544                  * it, except for increasing the hit counter.
2545                  */
2546                 if ((passt & FR_CALLNOW) != 0) {
2547                         frentry_t *frs;
2548
2549                         ATOMIC_INC64(fr->fr_hits);
2550                         if ((fr->fr_func == NULL) ||
2551                             (fr->fr_func == (ipfunc_t)-1))
2552                                 continue;
2553
2554                         frs = fin->fin_fr;
2555                         fin->fin_fr = fr;
2556                         fr = (*fr->fr_func)(fin, &passt);
2557                         if (fr == NULL) {
2558                                 fin->fin_fr = frs;
2559                                 continue;
2560                         }
2561                         passt = fr->fr_flags;
2562                 }
2563                 fin->fin_fr = fr;
2564
2565 #ifdef  IPFILTER_LOG
2566                 /*
2567                  * Just log this packet...
2568                  */
2569                 if ((passt & FR_LOGMASK) == FR_LOG) {
2570                         if (ipf_log_pkt(fin, passt) == -1) {
2571                                 if (passt & FR_LOGORBLOCK) {
2572                                         DT(frb_logfail);
2573                                         passt &= ~FR_CMDMASK;
2574                                         passt |= FR_BLOCK|FR_QUICK;
2575                                         fin->fin_reason = FRB_LOGFAIL;
2576                                 }
2577                         }
2578                 }
2579 #endif /* IPFILTER_LOG */
2580
2581                 MUTEX_ENTER(&fr->fr_lock);
2582                 fr->fr_bytes += (U_QUAD_T)fin->fin_plen;
2583                 fr->fr_hits++;
2584                 MUTEX_EXIT(&fr->fr_lock);
2585                 fin->fin_rule = rulen;
2586
2587                 passo = pass;
2588                 if (FR_ISSKIP(passt)) {
2589                         skip = fr->fr_arg;
2590                         continue;
2591                 } else if (((passt & FR_LOGMASK) != FR_LOG) &&
2592                            ((passt & FR_LOGMASK) != FR_DECAPSULATE)) {
2593                         pass = passt;
2594                 }
2595
2596                 if (passt & (FR_RETICMP|FR_FAKEICMP))
2597                         fin->fin_icode = fr->fr_icode;
2598
2599                 if (fr->fr_group != -1) {
2600                         (void) strncpy(fin->fin_group,
2601                                        FR_NAME(fr, fr_group),
2602                                        strlen(FR_NAME(fr, fr_group)));
2603                 } else {
2604                         fin->fin_group[0] = '\0';
2605                 }
2606
2607                 FR_DEBUG(("pass %#x/%#x/%x\n", passo, pass, passt));
2608
2609                 if (fr->fr_grphead != NULL) {
2610                         fin->fin_fr = fr->fr_grphead->fg_start;
2611                         FR_VERBOSE(("group %s\n", FR_NAME(fr, fr_grhead)));
2612
2613                         if (FR_ISDECAPS(passt))
2614                                 passt = ipf_decaps(fin, pass, fr->fr_icode);
2615                         else
2616                                 passt = ipf_scanlist(fin, pass);
2617
2618                         if (fin->fin_fr == NULL) {
2619                                 fin->fin_rule = rulen;
2620                                 if (fr->fr_group != -1)
2621                                         (void) strncpy(fin->fin_group,
2622                                                        fr->fr_names +
2623                                                        fr->fr_group,
2624                                                        strlen(fr->fr_names +
2625                                                               fr->fr_group));
2626                                 fin->fin_fr = fr;
2627                                 passt = pass;
2628                         }
2629                         pass = passt;
2630                 }
2631
2632                 if (pass & FR_QUICK) {
2633                         /*
2634                          * Finally, if we've asked to track state for this
2635                          * packet, set it up.  Add state for "quick" rules
2636                          * here so that if the action fails we can consider
2637                          * the rule to "not match" and keep on processing
2638                          * filter rules.
2639                          */
2640                         if ((pass & FR_KEEPSTATE) && !FR_ISAUTH(pass) &&
2641                             !(fin->fin_flx & FI_STATE)) {
2642                                 int out = fin->fin_out;
2643
2644                                 fin->fin_fr = fr;
2645                                 if (ipf_state_add(softc, fin, NULL, 0) == 0) {
2646                                         LBUMPD(ipf_stats[out], fr_ads);
2647                                 } else {
2648                                         LBUMPD(ipf_stats[out], fr_bads);
2649                                         pass = passo;
2650                                         continue;
2651                                 }
2652                         }
2653                         break;
2654                 }
2655         }
2656         fin->fin_depth--;
2657         return pass;
2658 }
2659
2660
2661 /* ------------------------------------------------------------------------ */
2662 /* Function:    ipf_acctpkt                                                 */
2663 /* Returns:     frentry_t* - always returns NULL                            */
2664 /* Parameters:  fin(I) - pointer to packet information                      */
2665 /*              passp(IO) - pointer to current/new filter decision (unused) */
2666 /*                                                                          */
2667 /* Checks a packet against accounting rules, if there are any for the given */
2668 /* IP protocol version.                                                     */
2669 /*                                                                          */
2670 /* N.B.: this function returns NULL to match the prototype used by other    */
2671 /* functions called from the IPFilter "mainline" in ipf_check().            */
2672 /* ------------------------------------------------------------------------ */
2673 frentry_t *
2674 ipf_acctpkt(fin, passp)
2675         fr_info_t *fin;
2676         u_32_t *passp;
2677 {
2678         ipf_main_softc_t *softc = fin->fin_main_soft;
2679         char group[FR_GROUPLEN];
2680         frentry_t *fr, *frsave;
2681         u_32_t pass, rulen;
2682
2683         passp = passp;
2684         fr = softc->ipf_acct[fin->fin_out][softc->ipf_active];
2685
2686         if (fr != NULL) {
2687                 frsave = fin->fin_fr;
2688                 bcopy(fin->fin_group, group, FR_GROUPLEN);
2689                 rulen = fin->fin_rule;
2690                 fin->fin_fr = fr;
2691                 pass = ipf_scanlist(fin, FR_NOMATCH);
2692                 if (FR_ISACCOUNT(pass)) {
2693                         LBUMPD(ipf_stats[0], fr_acct);
2694                 }
2695                 fin->fin_fr = frsave;
2696                 bcopy(group, fin->fin_group, FR_GROUPLEN);
2697                 fin->fin_rule = rulen;
2698         }
2699         return NULL;
2700 }
2701
2702
2703 /* ------------------------------------------------------------------------ */
2704 /* Function:    ipf_firewall                                                */
2705 /* Returns:     frentry_t* - returns pointer to matched rule, if no matches */
2706 /*                           were found, returns NULL.                      */
2707 /* Parameters:  fin(I) - pointer to packet information                      */
2708 /*              passp(IO) - pointer to current/new filter decision (unused) */
2709 /*                                                                          */
2710 /* Applies an appropriate set of firewall rules to the packet, to see if    */
2711 /* there are any matches.  The first check is to see if a match can be seen */
2712 /* in the cache.  If not, then search an appropriate list of rules.  Once a */
2713 /* matching rule is found, take any appropriate actions as defined by the   */
2714 /* rule - except logging.                                                   */
2715 /* ------------------------------------------------------------------------ */
2716 static frentry_t *
2717 ipf_firewall(fin, passp)
2718         fr_info_t *fin;
2719         u_32_t *passp;
2720 {
2721         ipf_main_softc_t *softc = fin->fin_main_soft;
2722         frentry_t *fr;
2723         u_32_t pass;
2724         int out;
2725
2726         out = fin->fin_out;
2727         pass = *passp;
2728
2729         /*
2730          * This rule cache will only affect packets that are not being
2731          * statefully filtered.
2732          */
2733         fin->fin_fr = softc->ipf_rules[out][softc->ipf_active];
2734         if (fin->fin_fr != NULL)
2735                 pass = ipf_scanlist(fin, softc->ipf_pass);
2736
2737         if ((pass & FR_NOMATCH)) {
2738                 LBUMPD(ipf_stats[out], fr_nom);
2739         }
2740         fr = fin->fin_fr;
2741
2742         /*
2743          * Apply packets per second rate-limiting to a rule as required.
2744          */
2745         if ((fr != NULL) && (fr->fr_pps != 0) &&
2746             !ppsratecheck(&fr->fr_lastpkt, &fr->fr_curpps, fr->fr_pps)) {
2747                 DT2(frb_ppsrate, fr_info_t *, fin, frentry_t *, fr);
2748                 pass &= ~(FR_CMDMASK|FR_RETICMP|FR_RETRST);
2749                 pass |= FR_BLOCK;
2750                 LBUMPD(ipf_stats[out], fr_ppshit);
2751                 fin->fin_reason = FRB_PPSRATE;
2752         }
2753
2754         /*
2755          * If we fail to add a packet to the authorization queue, then we
2756          * drop the packet later.  However, if it was added then pretend
2757          * we've dropped it already.
2758          */
2759         if (FR_ISAUTH(pass)) {
2760                 if (ipf_auth_new(fin->fin_m, fin) != 0) {
2761                         DT1(frb_authnew, fr_info_t *, fin);
2762                         fin->fin_m = *fin->fin_mp = NULL;
2763                         fin->fin_reason = FRB_AUTHNEW;
2764                         fin->fin_error = 0;
2765                 } else {
2766                         IPFERROR(1);
2767                         fin->fin_error = ENOSPC;
2768                 }
2769         }
2770
2771         if ((fr != NULL) && (fr->fr_func != NULL) &&
2772             (fr->fr_func != (ipfunc_t)-1) && !(pass & FR_CALLNOW))
2773                 (void) (*fr->fr_func)(fin, &pass);
2774
2775         /*
2776          * If a rule is a pre-auth rule, check again in the list of rules
2777          * loaded for authenticated use.  It does not particulary matter
2778          * if this search fails because a "preauth" result, from a rule,
2779          * is treated as "not a pass", hence the packet is blocked.
2780          */
2781         if (FR_ISPREAUTH(pass)) {
2782                 pass = ipf_auth_pre_scanlist(softc, fin, pass);
2783         }
2784
2785         /*
2786          * If the rule has "keep frag" and the packet is actually a fragment,
2787          * then create a fragment state entry.
2788          */
2789         if ((pass & (FR_KEEPFRAG|FR_KEEPSTATE)) == FR_KEEPFRAG) {
2790                 if (fin->fin_flx & FI_FRAG) {
2791                         if (ipf_frag_new(softc, fin, pass) == -1) {
2792                                 LBUMP(ipf_stats[out].fr_bnfr);
2793                         } else {
2794                                 LBUMP(ipf_stats[out].fr_nfr);
2795                         }
2796                 } else {
2797                         LBUMP(ipf_stats[out].fr_cfr);
2798                 }
2799         }
2800
2801         fr = fin->fin_fr;
2802         *passp = pass;
2803
2804         return fr;
2805 }
2806
2807
2808 /* ------------------------------------------------------------------------ */
2809 /* Function:    ipf_check                                                   */
2810 /* Returns:     int -  0 == packet allowed through,                         */
2811 /*              User space:                                                 */
2812 /*                    -1 == packet blocked                                  */
2813 /*                     1 == packet not matched                              */
2814 /*                    -2 == requires authentication                         */
2815 /*              Kernel:                                                     */
2816 /*                   > 0 == filter error # for packet                       */
2817 /* Parameters: ip(I)   - pointer to start of IPv4/6 packet                  */
2818 /*             hlen(I) - length of header                                   */
2819 /*             ifp(I)  - pointer to interface this packet is on             */
2820 /*             out(I)  - 0 == packet going in, 1 == packet going out        */
2821 /*             mp(IO)  - pointer to caller's buffer pointer that holds this */
2822 /*                       IP packet.                                         */
2823 /* Solaris & HP-UX ONLY :                                                   */
2824 /*             qpi(I)  - pointer to STREAMS queue information for this      */
2825 /*                       interface & direction.                             */
2826 /*                                                                          */
2827 /* ipf_check() is the master function for all IPFilter packet processing.   */
2828 /* It orchestrates: Network Address Translation (NAT), checking for packet  */
2829 /* authorisation (or pre-authorisation), presence of related state info.,   */
2830 /* generating log entries, IP packet accounting, routing of packets as      */
2831 /* directed by firewall rules and of course whether or not to allow the     */
2832 /* packet to be further processed by the kernel.                            */
2833 /*                                                                          */
2834 /* For packets blocked, the contents of "mp" will be NULL'd and the buffer  */
2835 /* freed.  Packets passed may be returned with the pointer pointed to by    */
2836 /* by "mp" changed to a new buffer.                                         */
2837 /* ------------------------------------------------------------------------ */
2838 int
2839 ipf_check(ctx, ip, hlen, ifp, out
2840 #if defined(_KERNEL) && defined(MENTAT)
2841         , qif, mp)
2842         void *qif;
2843 #else
2844         , mp)
2845 #endif
2846         mb_t **mp;
2847         ip_t *ip;
2848         int hlen;
2849         void *ifp;
2850         int out;
2851         void *ctx;
2852 {
2853         /*
2854          * The above really sucks, but short of writing a diff
2855          */
2856         ipf_main_softc_t *softc = ctx;
2857         fr_info_t frinfo;
2858         fr_info_t *fin = &frinfo;
2859         u_32_t pass = softc->ipf_pass;
2860         frentry_t *fr = NULL;
2861         int v = IP_V(ip);
2862         mb_t *mc = NULL;
2863         mb_t *m;
2864         /*
2865          * The first part of ipf_check() deals with making sure that what goes
2866          * into the filtering engine makes some sense.  Information about the
2867          * the packet is distilled, collected into a fr_info_t structure and
2868          * the an attempt to ensure the buffer the packet is in is big enough
2869          * to hold all the required packet headers.
2870          */
2871 #ifdef  _KERNEL
2872 # ifdef MENTAT
2873         qpktinfo_t *qpi = qif;
2874
2875 #  ifdef __sparc
2876         if ((u_int)ip & 0x3)
2877                 return 2;
2878 #  endif
2879 # else
2880         SPL_INT(s);
2881 # endif
2882
2883         if (softc->ipf_running <= 0) {
2884                 return 0;
2885         }
2886
2887         bzero((char *)fin, sizeof(*fin));
2888
2889 # ifdef MENTAT
2890         if (qpi->qpi_flags & QF_BROADCAST)
2891                 fin->fin_flx |= FI_MBCAST|FI_BROADCAST;
2892         if (qpi->qpi_flags & QF_MULTICAST)
2893                 fin->fin_flx |= FI_MBCAST|FI_MULTICAST;
2894         m = qpi->qpi_m;
2895         fin->fin_qfm = m;
2896         fin->fin_qpi = qpi;
2897 # else /* MENTAT */
2898
2899         m = *mp;
2900
2901 #  if defined(M_MCAST)
2902         if ((m->m_flags & M_MCAST) != 0)
2903                 fin->fin_flx |= FI_MBCAST|FI_MULTICAST;
2904 #  endif
2905 #  if defined(M_MLOOP)
2906         if ((m->m_flags & M_MLOOP) != 0)
2907                 fin->fin_flx |= FI_MBCAST|FI_MULTICAST;
2908 #  endif
2909 #  if defined(M_BCAST)
2910         if ((m->m_flags & M_BCAST) != 0)
2911                 fin->fin_flx |= FI_MBCAST|FI_BROADCAST;
2912 #  endif
2913 #  ifdef M_CANFASTFWD
2914         /*
2915          * XXX For now, IP Filter and fast-forwarding of cached flows
2916          * XXX are mutually exclusive.  Eventually, IP Filter should
2917          * XXX get a "can-fast-forward" filter rule.
2918          */
2919         m->m_flags &= ~M_CANFASTFWD;
2920 #  endif /* M_CANFASTFWD */
2921 #  if defined(CSUM_DELAY_DATA) && (!defined(__FreeBSD_version) || \
2922                                    (__FreeBSD_version < 501108))
2923         /*
2924          * disable delayed checksums.
2925          */
2926         if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
2927                 in_delayed_cksum(m);
2928                 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
2929         }
2930 #  endif /* CSUM_DELAY_DATA */
2931 # endif /* MENTAT */
2932 #else
2933         bzero((char *)fin, sizeof(*fin));
2934         m = *mp;
2935 # if defined(M_MCAST)
2936         if ((m->m_flags & M_MCAST) != 0)
2937                 fin->fin_flx |= FI_MBCAST|FI_MULTICAST;
2938 # endif
2939 # if defined(M_MLOOP)
2940         if ((m->m_flags & M_MLOOP) != 0)
2941                 fin->fin_flx |= FI_MBCAST|FI_MULTICAST;
2942 # endif
2943 # if defined(M_BCAST)
2944         if ((m->m_flags & M_BCAST) != 0)
2945                 fin->fin_flx |= FI_MBCAST|FI_BROADCAST;
2946 # endif
2947 #endif /* _KERNEL */
2948
2949         fin->fin_v = v;
2950         fin->fin_m = m;
2951         fin->fin_ip = ip;
2952         fin->fin_mp = mp;
2953         fin->fin_out = out;
2954         fin->fin_ifp = ifp;
2955         fin->fin_error = ENETUNREACH;
2956         fin->fin_hlen = (u_short)hlen;
2957         fin->fin_dp = (char *)ip + hlen;
2958         fin->fin_main_soft = softc;
2959
2960         fin->fin_ipoff = (char *)ip - MTOD(m, char *);
2961
2962         SPL_NET(s);
2963
2964 #ifdef  USE_INET6
2965         if (v == 6) {
2966                 LBUMP(ipf_stats[out].fr_ipv6);
2967                 /*
2968                  * Jumbo grams are quite likely too big for internal buffer
2969                  * structures to handle comfortably, for now, so just drop
2970                  * them.
2971                  */
2972                 if (((ip6_t *)ip)->ip6_plen == 0) {
2973                         DT1(frb_jumbo, ip6_t *, (ip6_t *)ip);
2974                         pass = FR_BLOCK|FR_NOMATCH;
2975                         fin->fin_reason = FRB_JUMBO;
2976                         goto finished;
2977                 }
2978                 fin->fin_family = AF_INET6;
2979         } else
2980 #endif
2981         {
2982                 fin->fin_family = AF_INET;
2983         }
2984
2985         if (ipf_makefrip(hlen, ip, fin) == -1) {
2986                 DT1(frb_makefrip, fr_info_t *, fin);
2987                 pass = FR_BLOCK|FR_NOMATCH;
2988                 fin->fin_reason = FRB_MAKEFRIP;
2989                 goto finished;
2990         }
2991
2992         /*
2993          * For at least IPv6 packets, if a m_pullup() fails then this pointer
2994          * becomes NULL and so we have no packet to free.
2995          */
2996         if (*fin->fin_mp == NULL)
2997                 goto finished;
2998
2999         if (!out) {
3000                 if (v == 4) {
3001                         if (softc->ipf_chksrc && !ipf_verifysrc(fin)) {
3002                                 LBUMPD(ipf_stats[0], fr_v4_badsrc);
3003                                 fin->fin_flx |= FI_BADSRC;
3004                         }
3005                         if (fin->fin_ip->ip_ttl < softc->ipf_minttl) {
3006                                 LBUMPD(ipf_stats[0], fr_v4_badttl);
3007                                 fin->fin_flx |= FI_LOWTTL;
3008                         }
3009                 }
3010 #ifdef USE_INET6
3011                 else  if (v == 6) {
3012                         if (((ip6_t *)ip)->ip6_hlim < softc->ipf_minttl) {
3013                                 LBUMPD(ipf_stats[0], fr_v6_badttl);
3014                                 fin->fin_flx |= FI_LOWTTL;
3015                         }
3016                 }
3017 #endif
3018         }
3019
3020         if (fin->fin_flx & FI_SHORT) {
3021                 LBUMPD(ipf_stats[out], fr_short);
3022         }
3023
3024         READ_ENTER(&softc->ipf_mutex);
3025
3026         if (!out) {
3027                 switch (fin->fin_v)
3028                 {
3029                 case 4 :
3030                         if (ipf_nat_checkin(fin, &pass) == -1) {
3031                                 goto filterdone;
3032                         }
3033                         break;
3034 #ifdef USE_INET6
3035                 case 6 :
3036                         if (ipf_nat6_checkin(fin, &pass) == -1) {
3037                                 goto filterdone;
3038                         }
3039                         break;
3040 #endif
3041                 default :
3042                         break;
3043                 }
3044         }
3045         /*
3046          * Check auth now.
3047          * If a packet is found in the auth table, then skip checking
3048          * the access lists for permission but we do need to consider
3049          * the result as if it were from the ACL's.  In addition, being
3050          * found in the auth table means it has been seen before, so do
3051          * not pass it through accounting (again), lest it be counted twice.
3052          */
3053         fr = ipf_auth_check(fin, &pass);
3054         if (!out && (fr == NULL))
3055                 (void) ipf_acctpkt(fin, NULL);
3056
3057         if (fr == NULL) {
3058                 if ((fin->fin_flx & FI_FRAG) != 0)
3059                         fr = ipf_frag_known(fin, &pass);
3060
3061                 if (fr == NULL)
3062                         fr = ipf_state_check(fin, &pass);
3063         }
3064
3065         if ((pass & FR_NOMATCH) || (fr == NULL))
3066                 fr = ipf_firewall(fin, &pass);
3067
3068         /*
3069          * If we've asked to track state for this packet, set it up.
3070          * Here rather than ipf_firewall because ipf_checkauth may decide
3071          * to return a packet for "keep state"
3072          */
3073         if ((pass & FR_KEEPSTATE) && (fin->fin_m != NULL) &&
3074             !(fin->fin_flx & FI_STATE)) {
3075                 if (ipf_state_add(softc, fin, NULL, 0) == 0) {
3076                         LBUMP(ipf_stats[out].fr_ads);
3077                 } else {
3078                         LBUMP(ipf_stats[out].fr_bads);
3079                         if (FR_ISPASS(pass)) {
3080                                 DT(frb_stateadd);
3081                                 pass &= ~FR_CMDMASK;
3082                                 pass |= FR_BLOCK;
3083                                 fin->fin_reason = FRB_STATEADD;
3084                         }
3085                 }
3086         }
3087
3088         fin->fin_fr = fr;
3089         if ((fr != NULL) && !(fin->fin_flx & FI_STATE)) {
3090                 fin->fin_dif = &fr->fr_dif;
3091                 fin->fin_tif = &fr->fr_tifs[fin->fin_rev];
3092         }
3093
3094         /*
3095          * Only count/translate packets which will be passed on, out the
3096          * interface.
3097          */
3098         if (out && FR_ISPASS(pass)) {
3099                 (void) ipf_acctpkt(fin, NULL);
3100
3101                 switch (fin->fin_v)
3102                 {
3103                 case 4 :
3104                         if (ipf_nat_checkout(fin, &pass) == -1) {
3105                                 ;
3106                         } else if ((softc->ipf_update_ipid != 0) && (v == 4)) {
3107                                 if (ipf_updateipid(fin) == -1) {
3108                                         DT(frb_updateipid);
3109                                         LBUMP(ipf_stats[1].fr_ipud);
3110                                         pass &= ~FR_CMDMASK;
3111                                         pass |= FR_BLOCK;
3112                                         fin->fin_reason = FRB_UPDATEIPID;
3113                                 } else {
3114                                         LBUMP(ipf_stats[0].fr_ipud);
3115                                 }
3116                         }
3117                         break;
3118 #ifdef USE_INET6
3119                 case 6 :
3120                         (void) ipf_nat6_checkout(fin, &pass);
3121                         break;
3122 #endif
3123                 default :
3124                         break;
3125                 }
3126         }
3127
3128 filterdone:
3129 #ifdef  IPFILTER_LOG
3130         if ((softc->ipf_flags & FF_LOGGING) || (pass & FR_LOGMASK)) {
3131                 (void) ipf_dolog(fin, &pass);
3132         }
3133 #endif
3134
3135         /*
3136          * The FI_STATE flag is cleared here so that calling ipf_state_check
3137          * will work when called from inside of fr_fastroute.  Although
3138          * there is a similar flag, FI_NATED, for NAT, it does have the same
3139          * impact on code execution.
3140          */
3141         fin->fin_flx &= ~FI_STATE;
3142
3143 #if defined(FASTROUTE_RECURSION)
3144         /*
3145          * Up the reference on fr_lock and exit ipf_mutex. The generation of
3146          * a packet below can sometimes cause a recursive call into IPFilter.
3147          * On those platforms where that does happen, we need to hang onto
3148          * the filter rule just in case someone decides to remove or flush it
3149          * in the meantime.
3150          */
3151         if (fr != NULL) {
3152                 MUTEX_ENTER(&fr->fr_lock);
3153                 fr->fr_ref++;
3154                 MUTEX_EXIT(&fr->fr_lock);
3155         }
3156
3157         RWLOCK_EXIT(&softc->ipf_mutex);
3158 #endif
3159
3160         if ((pass & FR_RETMASK) != 0) {
3161                 /*
3162                  * Should we return an ICMP packet to indicate error
3163                  * status passing through the packet filter ?
3164                  * WARNING: ICMP error packets AND TCP RST packets should
3165                  * ONLY be sent in repsonse to incoming packets.  Sending
3166                  * them in response to outbound packets can result in a
3167                  * panic on some operating systems.
3168                  */
3169                 if (!out) {
3170                         if (pass & FR_RETICMP) {
3171                                 int dst;
3172
3173                                 if ((pass & FR_RETMASK) == FR_FAKEICMP)
3174                                         dst = 1;
3175                                 else
3176                                         dst = 0;
3177                                 (void) ipf_send_icmp_err(ICMP_UNREACH, fin,
3178                                                          dst);
3179                                 LBUMP(ipf_stats[0].fr_ret);
3180                         } else if (((pass & FR_RETMASK) == FR_RETRST) &&
3181                                    !(fin->fin_flx & FI_SHORT)) {
3182                                 if (((fin->fin_flx & FI_OOW) != 0) ||
3183                                     (ipf_send_reset(fin) == 0)) {
3184                                         LBUMP(ipf_stats[1].fr_ret);
3185                                 }
3186                         }
3187
3188                         /*
3189                          * When using return-* with auth rules, the auth code
3190                          * takes over disposing of this packet.
3191                          */
3192                         if (FR_ISAUTH(pass) && (fin->fin_m != NULL)) {
3193                                 DT1(frb_authcapture, fr_info_t *, fin);
3194                                 fin->fin_m = *fin->fin_mp = NULL;
3195                                 fin->fin_reason = FRB_AUTHCAPTURE;
3196                                 m = NULL;
3197                         }
3198                 } else {
3199                         if (pass & FR_RETRST) {
3200                                 fin->fin_error = ECONNRESET;
3201                         }
3202                 }
3203         }
3204
3205         /*
3206          * After the above so that ICMP unreachables and TCP RSTs get
3207          * created properly.
3208          */
3209         if (FR_ISBLOCK(pass) && (fin->fin_flx & FI_NEWNAT))
3210                 ipf_nat_uncreate(fin);
3211
3212         /*
3213          * If we didn't drop off the bottom of the list of rules (and thus
3214          * the 'current' rule fr is not NULL), then we may have some extra
3215          * instructions about what to do with a packet.
3216          * Once we're finished return to our caller, freeing the packet if
3217          * we are dropping it.
3218          */
3219         if (fr != NULL) {
3220                 frdest_t *fdp;
3221
3222                 /*
3223                  * Generate a duplicated packet first because ipf_fastroute
3224                  * can lead to fin_m being free'd... not good.
3225                  */
3226                 fdp = fin->fin_dif;
3227                 if ((fdp != NULL) && (fdp->fd_ptr != NULL) &&
3228                     (fdp->fd_ptr != (void *)-1)) {
3229                         mc = M_COPY(fin->fin_m);
3230                         if (mc != NULL)
3231                                 ipf_fastroute(mc, &mc, fin, fdp);
3232                 }
3233
3234                 fdp = fin->fin_tif;
3235                 if (!out && (pass & FR_FASTROUTE)) {
3236                         /*
3237                          * For fastroute rule, no destination interface defined
3238                          * so pass NULL as the frdest_t parameter
3239                          */
3240                         (void) ipf_fastroute(fin->fin_m, mp, fin, NULL);
3241                         m = *mp = NULL;
3242                 } else if ((fdp != NULL) && (fdp->fd_ptr != NULL) &&
3243                            (fdp->fd_ptr != (struct ifnet *)-1)) {
3244                         /* this is for to rules: */
3245                         ipf_fastroute(fin->fin_m, mp, fin, fdp);
3246                         m = *mp = NULL;
3247                 }
3248
3249 #if defined(FASTROUTE_RECURSION)
3250                 (void) ipf_derefrule(softc, &fr);
3251 #endif
3252         }
3253 #if !defined(FASTROUTE_RECURSION)
3254         RWLOCK_EXIT(&softc->ipf_mutex);
3255 #endif
3256
3257 finished:
3258         if (!FR_ISPASS(pass)) {
3259                 LBUMP(ipf_stats[out].fr_block);
3260                 if (*mp != NULL) {
3261 #ifdef _KERNEL
3262                         FREE_MB_T(*mp);
3263 #endif
3264                         m = *mp = NULL;
3265                 }
3266         } else {
3267                 LBUMP(ipf_stats[out].fr_pass);
3268 #if defined(_KERNEL) && defined(__sgi)
3269                 if ((fin->fin_hbuf != NULL) &&
3270                     (mtod(fin->fin_m, struct ip *) != fin->fin_ip)) {
3271                         COPYBACK(fin->fin_m, 0, fin->fin_plen, fin->fin_hbuf);
3272                 }
3273 #endif
3274         }
3275
3276         SPL_X(s);
3277
3278 #ifdef _KERNEL
3279         if (FR_ISPASS(pass))
3280                 return 0;
3281         LBUMP(ipf_stats[out].fr_blocked[fin->fin_reason]);
3282         return fin->fin_error;
3283 #else /* _KERNEL */
3284         if (*mp != NULL)
3285                 (*mp)->mb_ifp = fin->fin_ifp;
3286         blockreason = fin->fin_reason;
3287         FR_VERBOSE(("fin_flx %#x pass %#x ", fin->fin_flx, pass));
3288         /*if ((pass & FR_CMDMASK) == (softc->ipf_pass & FR_CMDMASK))*/
3289                 if ((pass & FR_NOMATCH) != 0)
3290                         return 1;
3291
3292         if ((pass & FR_RETMASK) != 0)
3293                 switch (pass & FR_RETMASK)
3294                 {
3295                 case FR_RETRST :
3296                         return 3;
3297                 case FR_RETICMP :
3298                         return 4;
3299                 case FR_FAKEICMP :
3300                         return 5;
3301                 }
3302
3303         switch (pass & FR_CMDMASK)
3304         {
3305         case FR_PASS :
3306                 return 0;
3307         case FR_BLOCK :
3308                 return -1;
3309         case FR_AUTH :
3310                 return -2;
3311         case FR_ACCOUNT :
3312                 return -3;
3313         case FR_PREAUTH :
3314                 return -4;
3315         }
3316         return 2;
3317 #endif /* _KERNEL */
3318 }
3319
3320
3321 #ifdef  IPFILTER_LOG
3322 /* ------------------------------------------------------------------------ */
3323 /* Function:    ipf_dolog                                                   */
3324 /* Returns:     frentry_t* - returns contents of fin_fr (no change made)    */
3325 /* Parameters:  fin(I) - pointer to packet information                      */
3326 /*              passp(IO) - pointer to current/new filter decision (unused) */
3327 /*                                                                          */
3328 /* Checks flags set to see how a packet should be logged, if it is to be    */
3329 /* logged.  Adjust statistics based on its success or not.                  */
3330 /* ------------------------------------------------------------------------ */
3331 frentry_t *
3332 ipf_dolog(fin, passp)
3333         fr_info_t *fin;
3334         u_32_t *passp;
3335 {
3336         ipf_main_softc_t *softc = fin->fin_main_soft;
3337         u_32_t pass;
3338         int out;
3339
3340         out = fin->fin_out;
3341         pass = *passp;
3342
3343         if ((softc->ipf_flags & FF_LOGNOMATCH) && (pass & FR_NOMATCH)) {
3344                 pass |= FF_LOGNOMATCH;
3345                 LBUMPD(ipf_stats[out], fr_npkl);
3346                 goto logit;
3347
3348         } else if (((pass & FR_LOGMASK) == FR_LOGP) ||
3349             (FR_ISPASS(pass) && (softc->ipf_flags & FF_LOGPASS))) {
3350                 if ((pass & FR_LOGMASK) != FR_LOGP)
3351                         pass |= FF_LOGPASS;
3352                 LBUMPD(ipf_stats[out], fr_ppkl);
3353                 goto logit;
3354
3355         } else if (((pass & FR_LOGMASK) == FR_LOGB) ||
3356                    (FR_ISBLOCK(pass) && (softc->ipf_flags & FF_LOGBLOCK))) {
3357                 if ((pass & FR_LOGMASK) != FR_LOGB)
3358                         pass |= FF_LOGBLOCK;
3359                 LBUMPD(ipf_stats[out], fr_bpkl);
3360
3361 logit:
3362                 if (ipf_log_pkt(fin, pass) == -1) {
3363                         /*
3364                          * If the "or-block" option has been used then
3365                          * block the packet if we failed to log it.
3366                          */
3367                         if ((pass & FR_LOGORBLOCK) && FR_ISPASS(pass)) {
3368                                 DT1(frb_logfail2, u_int, pass);
3369                                 pass &= ~FR_CMDMASK;
3370                                 pass |= FR_BLOCK;
3371                                 fin->fin_reason = FRB_LOGFAIL2;
3372                         }
3373                 }
3374                 *passp = pass;
3375         }
3376
3377         return fin->fin_fr;
3378 }
3379 #endif /* IPFILTER_LOG */
3380
3381
3382 /* ------------------------------------------------------------------------ */
3383 /* Function:    ipf_cksum                                                   */
3384 /* Returns:     u_short - IP header checksum                                */
3385 /* Parameters:  addr(I) - pointer to start of buffer to checksum            */
3386 /*              len(I)  - length of buffer in bytes                         */
3387 /*                                                                          */
3388 /* Calculate the two's complement 16 bit checksum of the buffer passed.     */
3389 /*                                                                          */
3390 /* N.B.: addr should be 16bit aligned.                                      */
3391 /* ------------------------------------------------------------------------ */
3392 u_short
3393 ipf_cksum(addr, len)
3394         u_short *addr;
3395         int len;
3396 {
3397         u_32_t sum = 0;
3398
3399         for (sum = 0; len > 1; len -= 2)
3400                 sum += *addr++;
3401
3402         /* mop up an odd byte, if necessary */
3403         if (len == 1)
3404                 sum += *(u_char *)addr;
3405
3406         /*
3407          * add back carry outs from top 16 bits to low 16 bits
3408          */
3409         sum = (sum >> 16) + (sum & 0xffff);     /* add hi 16 to low 16 */
3410         sum += (sum >> 16);                     /* add carry */
3411         return (u_short)(~sum);
3412 }
3413
3414
3415 /* ------------------------------------------------------------------------ */
3416 /* Function:    fr_cksum                                                    */
3417 /* Returns:     u_short - layer 4 checksum                                  */
3418 /* Parameters:  fin(I)     - pointer to packet information                  */
3419 /*              ip(I)      - pointer to IP header                           */
3420 /*              l4proto(I) - protocol to caclulate checksum for             */
3421 /*              l4hdr(I)   - pointer to layer 4 header                      */
3422 /*                                                                          */
3423 /* Calculates the TCP checksum for the packet held in "m", using the data   */
3424 /* in the IP header "ip" to seed it.                                        */
3425 /*                                                                          */
3426 /* NB: This function assumes we've pullup'd enough for all of the IP header */
3427 /* and the TCP header.  We also assume that data blocks aren't allocated in */
3428 /* odd sizes.                                                               */
3429 /*                                                                          */
3430 /* Expects ip_len and ip_off to be in network byte order when called.       */
3431 /* ------------------------------------------------------------------------ */
3432 u_short
3433 fr_cksum(fin, ip, l4proto, l4hdr)
3434         fr_info_t *fin;
3435         ip_t *ip;
3436         int l4proto;
3437         void *l4hdr;
3438 {
3439         u_short *sp, slen, sumsave, *csump;
3440         u_int sum, sum2;
3441         int hlen;
3442         int off;
3443 #ifdef  USE_INET6
3444         ip6_t *ip6;
3445 #endif
3446
3447         csump = NULL;
3448         sumsave = 0;
3449         sp = NULL;
3450         slen = 0;
3451         hlen = 0;
3452         sum = 0;
3453
3454         sum = htons((u_short)l4proto);
3455         /*
3456          * Add up IP Header portion
3457          */
3458 #ifdef  USE_INET6
3459         if (IP_V(ip) == 4) {
3460 #endif
3461                 hlen = IP_HL(ip) << 2;
3462                 off = hlen;
3463                 sp = (u_short *)&ip->ip_src;
3464                 sum += *sp++;   /* ip_src */
3465                 sum += *sp++;
3466                 sum += *sp++;   /* ip_dst */
3467                 sum += *sp++;
3468 #ifdef  USE_INET6
3469         } else if (IP_V(ip) == 6) {
3470                 ip6 = (ip6_t *)ip;
3471                 hlen = sizeof(*ip6);
3472                 off = ((char *)fin->fin_dp - (char *)fin->fin_ip);
3473                 sp = (u_short *)&ip6->ip6_src;
3474                 sum += *sp++;   /* ip6_src */
3475                 sum += *sp++;
3476                 sum += *sp++;
3477                 sum += *sp++;
3478                 sum += *sp++;
3479                 sum += *sp++;
3480                 sum += *sp++;
3481                 sum += *sp++;
3482                 /* This needs to be routing header aware. */
3483                 sum += *sp++;   /* ip6_dst */
3484                 sum += *sp++;
3485                 sum += *sp++;
3486                 sum += *sp++;
3487                 sum += *sp++;
3488                 sum += *sp++;
3489                 sum += *sp++;
3490                 sum += *sp++;
3491         } else {
3492                 return 0xffff;
3493         }
3494 #endif
3495         slen = fin->fin_plen - off;
3496         sum += htons(slen);
3497
3498         switch (l4proto)
3499         {
3500         case IPPROTO_UDP :
3501                 csump = &((udphdr_t *)l4hdr)->uh_sum;
3502                 break;
3503
3504         case IPPROTO_TCP :
3505                 csump = &((tcphdr_t *)l4hdr)->th_sum;
3506                 break;
3507         case IPPROTO_ICMP :
3508                 csump = &((icmphdr_t *)l4hdr)->icmp_cksum;
3509                 sum = 0;        /* Pseudo-checksum is not included */
3510                 break;
3511 #ifdef USE_INET6
3512         case IPPROTO_ICMPV6 :
3513                 csump = &((struct icmp6_hdr *)l4hdr)->icmp6_cksum;
3514                 break;
3515 #endif
3516         default :
3517                 break;
3518         }
3519
3520         if (csump != NULL) {
3521                 sumsave = *csump;
3522                 *csump = 0;
3523         }
3524
3525         sum2 = ipf_pcksum(fin, off, sum);
3526         if (csump != NULL)
3527                 *csump = sumsave;
3528         return sum2;
3529 }
3530
3531
3532 /* ------------------------------------------------------------------------ */
3533 /* Function:    ipf_findgroup                                               */
3534 /* Returns:     frgroup_t * - NULL = group not found, else pointer to group */
3535 /* Parameters:  softc(I) - pointer to soft context main structure           */
3536 /*              group(I) - group name to search for                         */
3537 /*              unit(I)  - device to which this group belongs               */
3538 /*              set(I)   - which set of rules (inactive/inactive) this is   */
3539 /*              fgpp(O)  - pointer to place to store pointer to the pointer */
3540 /*                         to where to add the next (last) group or where   */
3541 /*                         to delete group from.                            */
3542 /*                                                                          */
3543 /* Search amongst the defined groups for a particular group number.         */
3544 /* ------------------------------------------------------------------------ */
3545 frgroup_t *
3546 ipf_findgroup(softc, group, unit, set, fgpp)
3547         ipf_main_softc_t *softc;
3548         char *group;
3549         minor_t unit;
3550         int set;
3551         frgroup_t ***fgpp;
3552 {
3553         frgroup_t *fg, **fgp;
3554
3555         /*
3556          * Which list of groups to search in is dependent on which list of
3557          * rules are being operated on.
3558          */
3559         fgp = &softc->ipf_groups[unit][set];
3560
3561         while ((fg = *fgp) != NULL) {
3562                 if (strncmp(group, fg->fg_name, FR_GROUPLEN) == 0)
3563                         break;
3564                 else
3565                         fgp = &fg->fg_next;
3566         }
3567         if (fgpp != NULL)
3568                 *fgpp = fgp;
3569         return fg;
3570 }
3571
3572
3573 /* ------------------------------------------------------------------------ */
3574 /* Function:    ipf_group_add                                               */
3575 /* Returns:     frgroup_t * - NULL == did not create group,                 */
3576 /*                            != NULL == pointer to the group               */
3577 /* Parameters:  softc(I) - pointer to soft context main structure           */
3578 /*              num(I)   - group number to add                              */
3579 /*              head(I)  - rule pointer that is using this as the head      */
3580 /*              flags(I) - rule flags which describe the type of rule it is */
3581 /*              unit(I)  - device to which this group will belong to        */
3582 /*              set(I)   - which set of rules (inactive/inactive) this is   */
3583 /* Write Locks: ipf_mutex                                                   */
3584 /*                                                                          */
3585 /* Add a new group head, or if it already exists, increase the reference    */
3586 /* count to it.                                                             */
3587 /* ------------------------------------------------------------------------ */
3588 frgroup_t *
3589 ipf_group_add(softc, group, head, flags, unit, set)
3590         ipf_main_softc_t *softc;
3591         char *group;
3592         void *head;
3593         u_32_t flags;
3594         minor_t unit;
3595         int set;
3596 {
3597         frgroup_t *fg, **fgp;
3598         u_32_t gflags;
3599
3600         if (group == NULL)
3601                 return NULL;
3602
3603         if (unit == IPL_LOGIPF && *group == '\0')
3604                 return NULL;
3605
3606         fgp = NULL;
3607         gflags = flags & FR_INOUT;
3608
3609         fg = ipf_findgroup(softc, group, unit, set, &fgp);
3610         if (fg != NULL) {
3611                 if (fg->fg_head == NULL && head != NULL)
3612                         fg->fg_head = head;
3613                 if (fg->fg_flags == 0)
3614                         fg->fg_flags = gflags;
3615                 else if (gflags != fg->fg_flags)
3616                         return NULL;
3617                 fg->fg_ref++;
3618                 return fg;
3619         }
3620
3621         KMALLOC(fg, frgroup_t *);
3622         if (fg != NULL) {
3623                 fg->fg_head = head;
3624                 fg->fg_start = NULL;
3625                 fg->fg_next = *fgp;
3626                 bcopy(group, fg->fg_name, strlen(group) + 1);
3627                 fg->fg_flags = gflags;
3628                 fg->fg_ref = 1;
3629                 fg->fg_set = &softc->ipf_groups[unit][set];
3630                 *fgp = fg;
3631         }
3632         return fg;
3633 }
3634
3635
3636 /* ------------------------------------------------------------------------ */
3637 /* Function:    ipf_group_del                                               */
3638 /* Returns:     int      - number of rules deleted                          */
3639 /* Parameters:  softc(I) - pointer to soft context main structure           */
3640 /*              group(I) - group name to delete                             */
3641 /*              fr(I)    - filter rule from which group is referenced       */
3642 /* Write Locks: ipf_mutex                                                   */
3643 /*                                                                          */
3644 /* This function is called whenever a reference to a group is to be dropped */
3645 /* and thus its reference count needs to be lowered and the group free'd if */
3646 /* the reference count reaches zero. Passing in fr is really for the sole   */
3647 /* purpose of knowing when the head rule is being deleted.                  */
3648 /* ------------------------------------------------------------------------ */
3649 void
3650 ipf_group_del(softc, group, fr)
3651         ipf_main_softc_t *softc;
3652         frgroup_t *group;
3653         frentry_t *fr;
3654 {
3655
3656         if (group->fg_head == fr)
3657                 group->fg_head = NULL;
3658
3659         group->fg_ref--;
3660         if ((group->fg_ref == 0) && (group->fg_start == NULL))
3661                 ipf_group_free(group);
3662 }
3663
3664
3665 /* ------------------------------------------------------------------------ */
3666 /* Function:    ipf_group_free                                              */
3667 /* Returns:     Nil                                                         */
3668 /* Parameters:  group(I) - pointer to filter rule group                     */
3669 /*                                                                          */
3670 /* Remove the group from the list of groups and free it.                    */
3671 /* ------------------------------------------------------------------------ */
3672 static void
3673 ipf_group_free(group)
3674         frgroup_t *group;
3675 {
3676         frgroup_t **gp;
3677
3678         for (gp = group->fg_set; *gp != NULL; gp = &(*gp)->fg_next) {
3679                 if (*gp == group) {
3680                         *gp = group->fg_next;
3681                         break;
3682                 }
3683         }
3684         KFREE(group);
3685 }
3686
3687
3688 /* ------------------------------------------------------------------------ */
3689 /* Function:    ipf_group_flush                                             */
3690 /* Returns:     int      - number of rules flush from group                 */
3691 /* Parameters:  softc(I) - pointer to soft context main structure           */
3692 /* Parameters:  group(I) - pointer to filter rule group                     */
3693 /*                                                                          */
3694 /* Remove all of the rules that currently are listed under the given group. */
3695 /* ------------------------------------------------------------------------ */
3696 static int
3697 ipf_group_flush(softc, group)
3698         ipf_main_softc_t *softc;
3699         frgroup_t *group;
3700 {
3701         int gone = 0;
3702
3703         (void) ipf_flushlist(softc, &gone, &group->fg_start);
3704
3705         return gone;
3706 }
3707
3708
3709 /* ------------------------------------------------------------------------ */
3710 /* Function:    ipf_getrulen                                                */
3711 /* Returns:     frentry_t * - NULL == not found, else pointer to rule n     */
3712 /* Parameters:  softc(I) - pointer to soft context main structure           */
3713 /* Parameters:  unit(I)  - device for which to count the rule's number      */
3714 /*              flags(I) - which set of rules to find the rule in           */
3715 /*              group(I) - group name                                       */
3716 /*              n(I)     - rule number to find                              */
3717 /*                                                                          */
3718 /* Find rule # n in group # g and return a pointer to it.  Return NULl if   */
3719 /* group # g doesn't exist or there are less than n rules in the group.     */
3720 /* ------------------------------------------------------------------------ */
3721 frentry_t *
3722 ipf_getrulen(softc, unit, group, n)
3723         ipf_main_softc_t *softc;
3724         int unit;
3725         char *group;
3726         u_32_t n;
3727 {
3728         frentry_t *fr;
3729         frgroup_t *fg;
3730
3731         fg = ipf_findgroup(softc, group, unit, softc->ipf_active, NULL);
3732         if (fg == NULL)
3733                 return NULL;
3734         for (fr = fg->fg_start; fr && n; fr = fr->fr_next, n--)
3735                 ;
3736         if (n != 0)
3737                 return NULL;
3738         return fr;
3739 }
3740
3741
3742 /* ------------------------------------------------------------------------ */
3743 /* Function:    ipf_flushlist                                               */
3744 /* Returns:     int - >= 0 - number of flushed rules                        */
3745 /* Parameters:  softc(I)   - pointer to soft context main structure         */
3746 /*              nfreedp(O) - pointer to int where flush count is stored     */
3747 /*              listp(I)   - pointer to list to flush pointer               */
3748 /* Write Locks: ipf_mutex                                                   */
3749 /*                                                                          */
3750 /* Recursively flush rules from the list, descending groups as they are     */
3751 /* encountered.  if a rule is the head of a group and it has lost all its   */
3752 /* group members, then also delete the group reference.  nfreedp is needed  */
3753 /* to store the accumulating count of rules removed, whereas the returned   */
3754 /* value is just the number removed from the current list.  The latter is   */
3755 /* needed to correctly adjust reference counts on rules that define groups. */
3756 /*                                                                          */
3757 /* NOTE: Rules not loaded from user space cannot be flushed.                */
3758 /* ------------------------------------------------------------------------ */
3759 static int
3760 ipf_flushlist(softc, nfreedp, listp)
3761         ipf_main_softc_t *softc;
3762         int *nfreedp;
3763         frentry_t **listp;
3764 {
3765         int freed = 0;
3766         frentry_t *fp;
3767
3768         while ((fp = *listp) != NULL) {
3769                 if ((fp->fr_type & FR_T_BUILTIN) ||
3770                     !(fp->fr_flags & FR_COPIED)) {
3771                         listp = &fp->fr_next;
3772                         continue;
3773                 }
3774                 *listp = fp->fr_next;
3775                 if (fp->fr_next != NULL)
3776                         fp->fr_next->fr_pnext = fp->fr_pnext;
3777                 fp->fr_pnext = NULL;
3778
3779                 if (fp->fr_grphead != NULL) {
3780                         freed += ipf_group_flush(softc, fp->fr_grphead);
3781                         fp->fr_names[fp->fr_grhead] = '\0';
3782                 }
3783
3784                 if (fp->fr_icmpgrp != NULL) {
3785                         freed += ipf_group_flush(softc, fp->fr_icmpgrp);
3786                         fp->fr_names[fp->fr_icmphead] = '\0';
3787                 }
3788
3789                 if (fp->fr_srctrack.ht_max_nodes)
3790                         ipf_rb_ht_flush(&fp->fr_srctrack);
3791
3792                 fp->fr_next = NULL;
3793
3794                 ASSERT(fp->fr_ref > 0);
3795                 if (ipf_derefrule(softc, &fp) == 0)
3796                         freed++;
3797         }
3798         *nfreedp += freed;
3799         return freed;
3800 }
3801
3802
3803 /* ------------------------------------------------------------------------ */
3804 /* Function:    ipf_flush                                                   */
3805 /* Returns:     int - >= 0 - number of flushed rules                        */
3806 /* Parameters:  softc(I) - pointer to soft context main structure           */
3807 /*              unit(I)  - device for which to flush rules                  */
3808 /*              flags(I) - which set of rules to flush                      */
3809 /*                                                                          */
3810 /* Calls flushlist() for all filter rules (accounting, firewall - both IPv4 */
3811 /* and IPv6) as defined by the value of flags.                              */
3812 /* ------------------------------------------------------------------------ */
3813 int
3814 ipf_flush(softc, unit, flags)
3815         ipf_main_softc_t *softc;
3816         minor_t unit;
3817         int flags;
3818 {
3819         int flushed = 0, set;
3820
3821         WRITE_ENTER(&softc->ipf_mutex);
3822
3823         set = softc->ipf_active;
3824         if ((flags & FR_INACTIVE) == FR_INACTIVE)
3825                 set = 1 - set;
3826
3827         if (flags & FR_OUTQUE) {
3828                 ipf_flushlist(softc, &flushed, &softc->ipf_rules[1][set]);
3829                 ipf_flushlist(softc, &flushed, &softc->ipf_acct[1][set]);
3830         }
3831         if (flags & FR_INQUE) {
3832                 ipf_flushlist(softc, &flushed, &softc->ipf_rules[0][set]);
3833                 ipf_flushlist(softc, &flushed, &softc->ipf_acct[0][set]);
3834         }
3835
3836         flushed += ipf_flush_groups(softc, &softc->ipf_groups[unit][set],
3837                                     flags & (FR_INQUE|FR_OUTQUE));
3838
3839         RWLOCK_EXIT(&softc->ipf_mutex);
3840
3841         if (unit == IPL_LOGIPF) {
3842                 int tmp;
3843
3844                 tmp = ipf_flush(softc, IPL_LOGCOUNT, flags);
3845                 if (tmp >= 0)
3846                         flushed += tmp;
3847         }
3848         return flushed;
3849 }
3850
3851
3852 /* ------------------------------------------------------------------------ */
3853 /* Function:    ipf_flush_groups                                            */
3854 /* Returns:     int - >= 0 - number of flushed rules                        */
3855 /* Parameters:  softc(I)  - soft context pointerto work with                */
3856 /*              grhead(I) - pointer to the start of the group list to flush */
3857 /*              flags(I)  - which set of rules to flush                     */
3858 /*                                                                          */
3859 /* Walk through all of the groups under the given group head and remove all */
3860 /* of those that match the flags passed in. The for loop here is bit more   */
3861 /* complicated than usual because the removal of a rule with ipf_derefrule  */
3862 /* may end up removing not only the structure pointed to by "fg" but also   */
3863 /* what is fg_next and fg_next after that. So if a filter rule is actually  */
3864 /* removed from the group then it is necessary to start again.              */
3865 /* ------------------------------------------------------------------------ */
3866 static int
3867 ipf_flush_groups(softc, grhead, flags)
3868         ipf_main_softc_t *softc;
3869         frgroup_t **grhead;
3870         int flags;
3871 {
3872         frentry_t *fr, **frp;
3873         frgroup_t *fg, **fgp;
3874         int flushed = 0;
3875         int removed = 0;
3876
3877         for (fgp = grhead; (fg = *fgp) != NULL; ) {
3878                 while ((fg != NULL) && ((fg->fg_flags & flags) == 0))
3879                         fg = fg->fg_next;
3880                 if (fg == NULL)
3881                         break;
3882                 removed = 0;
3883                 frp = &fg->fg_start;
3884                 while ((removed == 0) && ((fr = *frp) != NULL)) {
3885                         if ((fr->fr_flags & flags) == 0) {
3886                                 frp = &fr->fr_next;
3887                         } else {
3888                                 if (fr->fr_next != NULL)
3889                                         fr->fr_next->fr_pnext = fr->fr_pnext;
3890                                 *frp = fr->fr_next;
3891                                 fr->fr_pnext = NULL;
3892                                 fr->fr_next = NULL;
3893                                 (void) ipf_derefrule(softc, &fr);
3894                                 flushed++;
3895                                 removed++;
3896                         }
3897                 }
3898                 if (removed == 0)
3899                         fgp = &fg->fg_next;
3900         }
3901         return flushed;
3902 }
3903
3904
3905 /* ------------------------------------------------------------------------ */
3906 /* Function:    memstr                                                      */
3907 /* Returns:     char *  - NULL if failed, != NULL pointer to matching bytes */
3908 /* Parameters:  src(I)  - pointer to byte sequence to match                 */
3909 /*              dst(I)  - pointer to byte sequence to search                */
3910 /*              slen(I) - match length                                      */
3911 /*              dlen(I) - length available to search in                     */
3912 /*                                                                          */
3913 /* Search dst for a sequence of bytes matching those at src and extend for  */
3914 /* slen bytes.                                                              */
3915 /* ------------------------------------------------------------------------ */
3916 char *
3917 memstr(src, dst, slen, dlen)
3918         const char *src;
3919         char *dst;
3920         size_t slen, dlen;
3921 {
3922         char *s = NULL;
3923
3924         while (dlen >= slen) {
3925                 if (bcmp(src, dst, slen) == 0) {
3926                         s = dst;
3927                         break;
3928                 }
3929                 dst++;
3930                 dlen--;
3931         }
3932         return s;
3933 }
3934 /* ------------------------------------------------------------------------ */
3935 /* Function:    ipf_fixskip                                                 */
3936 /* Returns:     Nil                                                         */
3937 /* Parameters:  listp(IO)    - pointer to start of list with skip rule      */
3938 /*              rp(I)        - rule added/removed with skip in it.          */
3939 /*              addremove(I) - adjustment (-1/+1) to make to skip count,    */
3940 /*                             depending on whether a rule was just added   */
3941 /*                             or removed.                                  */
3942 /*                                                                          */
3943 /* Adjust all the rules in a list which would have skip'd past the position */
3944 /* where we are inserting to skip to the right place given the change.      */
3945 /* ------------------------------------------------------------------------ */
3946 void
3947 ipf_fixskip(listp, rp, addremove)
3948         frentry_t **listp, *rp;
3949         int addremove;
3950 {
3951         int rules, rn;
3952         frentry_t *fp;
3953
3954         rules = 0;
3955         for (fp = *listp; (fp != NULL) && (fp != rp); fp = fp->fr_next)
3956                 rules++;
3957
3958         if (!fp)
3959                 return;
3960
3961         for (rn = 0, fp = *listp; fp && (fp != rp); fp = fp->fr_next, rn++)
3962                 if (FR_ISSKIP(fp->fr_flags) && (rn + fp->fr_arg >= rules))
3963                         fp->fr_arg += addremove;
3964 }
3965
3966
3967 #ifdef  _KERNEL
3968 /* ------------------------------------------------------------------------ */
3969 /* Function:    count4bits                                                  */
3970 /* Returns:     int - >= 0 - number of consecutive bits in input            */
3971 /* Parameters:  ip(I) - 32bit IP address                                    */
3972 /*                                                                          */
3973 /* IPv4 ONLY                                                                */
3974 /* count consecutive 1's in bit mask.  If the mask generated by counting    */
3975 /* consecutive 1's is different to that passed, return -1, else return #    */
3976 /* of bits.                                                                 */
3977 /* ------------------------------------------------------------------------ */
3978 int
3979 count4bits(ip)
3980         u_32_t  ip;
3981 {
3982         u_32_t  ipn;
3983         int     cnt = 0, i, j;
3984
3985         ip = ipn = ntohl(ip);
3986         for (i = 32; i; i--, ipn *= 2)
3987                 if (ipn & 0x80000000)
3988                         cnt++;
3989                 else
3990                         break;
3991         ipn = 0;
3992         for (i = 32, j = cnt; i; i--, j--) {
3993                 ipn *= 2;
3994                 if (j > 0)
3995                         ipn++;
3996         }
3997         if (ipn == ip)
3998                 return cnt;
3999         return -1;
4000 }
4001
4002
4003 /* ------------------------------------------------------------------------ */
4004 /* Function:    count6bits                                                  */
4005 /* Returns:     int - >= 0 - number of consecutive bits in input            */
4006 /* Parameters:  msk(I) - pointer to start of IPv6 bitmask                   */
4007 /*                                                                          */
4008 /* IPv6 ONLY                                                                */
4009 /* count consecutive 1's in bit mask.                                       */
4010 /* ------------------------------------------------------------------------ */
4011 # ifdef USE_INET6
4012 int
4013 count6bits(msk)
4014         u_32_t *msk;
4015 {
4016         int i = 0, k;
4017         u_32_t j;
4018
4019         for (k = 3; k >= 0; k--)
4020                 if (msk[k] == 0xffffffff)
4021                         i += 32;
4022                 else {
4023                         for (j = msk[k]; j; j <<= 1)
4024                                 if (j & 0x80000000)
4025                                         i++;
4026                 }
4027         return i;
4028 }
4029 # endif
4030 #endif /* _KERNEL */
4031
4032
4033 /* ------------------------------------------------------------------------ */
4034 /* Function:    ipf_synclist                                                */
4035 /* Returns:     int    - 0 = no failures, else indication of first failure  */
4036 /* Parameters:  fr(I)  - start of filter list to sync interface names for   */
4037 /*              ifp(I) - interface pointer for limiting sync lookups        */
4038 /* Write Locks: ipf_mutex                                                   */
4039 /*                                                                          */
4040 /* Walk through a list of filter rules and resolve any interface names into */
4041 /* pointers.  Where dynamic addresses are used, also update the IP address  */
4042 /* used in the rule.  The interface pointer is used to limit the lookups to */
4043 /* a specific set of matching names if it is non-NULL.                      */
4044 /* Errors can occur when resolving the destination name of to/dup-to fields */
4045 /* when the name points to a pool and that pool doest not exist. If this    */
4046 /* does happen then it is necessary to check if there are any lookup refs   */
4047 /* that need to be dropped before returning with an error.                  */
4048 /* ------------------------------------------------------------------------ */
4049 static int
4050 ipf_synclist(softc, fr, ifp)
4051         ipf_main_softc_t *softc;
4052         frentry_t *fr;
4053         void *ifp;
4054 {
4055         frentry_t *frt, *start = fr;
4056         frdest_t *fdp;
4057         char *name;
4058         int error;
4059         void *ifa;
4060         int v, i;
4061
4062         error = 0;
4063
4064         for (; fr; fr = fr->fr_next) {
4065                 if (fr->fr_family == AF_INET)
4066                         v = 4;
4067                 else if (fr->fr_family == AF_INET6)
4068                         v = 6;
4069                 else
4070                         v = 0;
4071
4072                 /*
4073                  * Lookup all the interface names that are part of the rule.
4074                  */
4075                 for (i = 0; i < 4; i++) {
4076                         if ((ifp != NULL) && (fr->fr_ifas[i] != ifp))
4077                                 continue;
4078                         if (fr->fr_ifnames[i] == -1)
4079                                 continue;
4080                         name = FR_NAME(fr, fr_ifnames[i]);
4081                         fr->fr_ifas[i] = ipf_resolvenic(softc, name, v);
4082                 }
4083
4084                 if ((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) {
4085                         if (fr->fr_satype != FRI_NORMAL &&
4086                             fr->fr_satype != FRI_LOOKUP) {
4087                                 ifa = ipf_resolvenic(softc, fr->fr_names +
4088                                                      fr->fr_sifpidx, v);
4089                                 ipf_ifpaddr(softc, v, fr->fr_satype, ifa,
4090                                             &fr->fr_src6, &fr->fr_smsk6);
4091                         }
4092                         if (fr->fr_datype != FRI_NORMAL &&
4093                             fr->fr_datype != FRI_LOOKUP) {
4094                                 ifa = ipf_resolvenic(softc, fr->fr_names +
4095                                                      fr->fr_sifpidx, v);
4096                                 ipf_ifpaddr(softc, v, fr->fr_datype, ifa,
4097                                             &fr->fr_dst6, &fr->fr_dmsk6);
4098                         }
4099                 }
4100
4101                 fdp = &fr->fr_tifs[0];
4102                 if ((ifp == NULL) || (fdp->fd_ptr == ifp)) {
4103                         error = ipf_resolvedest(softc, fr->fr_names, fdp, v);
4104                         if (error != 0)
4105                                 goto unwind;
4106                 }
4107
4108                 fdp = &fr->fr_tifs[1];
4109                 if ((ifp == NULL) || (fdp->fd_ptr == ifp)) {
4110                         error = ipf_resolvedest(softc, fr->fr_names, fdp, v);
4111                         if (error != 0)
4112                                 goto unwind;
4113                 }
4114
4115                 fdp = &fr->fr_dif;
4116                 if ((ifp == NULL) || (fdp->fd_ptr == ifp)) {
4117                         error = ipf_resolvedest(softc, fr->fr_names, fdp, v);
4118                         if (error != 0)
4119                                 goto unwind;
4120                 }
4121
4122                 if (((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) &&
4123                     (fr->fr_satype == FRI_LOOKUP) && (fr->fr_srcptr == NULL)) {
4124                         fr->fr_srcptr = ipf_lookup_res_num(softc,
4125                                                            fr->fr_srctype,
4126                                                            IPL_LOGIPF,
4127                                                            fr->fr_srcnum,
4128                                                            &fr->fr_srcfunc);
4129                 }
4130                 if (((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) &&
4131                     (fr->fr_datype == FRI_LOOKUP) && (fr->fr_dstptr == NULL)) {
4132                         fr->fr_dstptr = ipf_lookup_res_num(softc,
4133                                                            fr->fr_dsttype,
4134                                                            IPL_LOGIPF,
4135                                                            fr->fr_dstnum,
4136                                                            &fr->fr_dstfunc);
4137                 }
4138         }
4139         return 0;
4140
4141 unwind:
4142         for (frt = start; frt != fr; fr = fr->fr_next) {
4143                 if (((frt->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) &&
4144                     (frt->fr_satype == FRI_LOOKUP) && (frt->fr_srcptr != NULL))
4145                                 ipf_lookup_deref(softc, frt->fr_srctype,
4146                                                  frt->fr_srcptr);
4147                 if (((frt->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) &&
4148                     (frt->fr_datype == FRI_LOOKUP) && (frt->fr_dstptr != NULL))
4149                                 ipf_lookup_deref(softc, frt->fr_dsttype,
4150                                                  frt->fr_dstptr);
4151         }
4152         return error;
4153 }
4154
4155
4156 /* ------------------------------------------------------------------------ */
4157 /* Function:    ipf_sync                                                    */
4158 /* Returns:     void                                                        */
4159 /* Parameters:  Nil                                                         */
4160 /*                                                                          */
4161 /* ipf_sync() is called when we suspect that the interface list or          */
4162 /* information about interfaces (like IP#) has changed.  Go through all     */
4163 /* filter rules, NAT entries and the state table and check if anything      */
4164 /* needs to be changed/updated.                                             */
4165 /* ------------------------------------------------------------------------ */
4166 int
4167 ipf_sync(softc, ifp)
4168         ipf_main_softc_t *softc;
4169         void *ifp;
4170 {
4171         int i;
4172
4173 # if !SOLARIS
4174         ipf_nat_sync(softc, ifp);
4175         ipf_state_sync(softc, ifp);
4176         ipf_lookup_sync(softc, ifp);
4177 # endif
4178
4179         WRITE_ENTER(&softc->ipf_mutex);
4180         (void) ipf_synclist(softc, softc->ipf_acct[0][softc->ipf_active], ifp);
4181         (void) ipf_synclist(softc, softc->ipf_acct[1][softc->ipf_active], ifp);
4182         (void) ipf_synclist(softc, softc->ipf_rules[0][softc->ipf_active], ifp);
4183         (void) ipf_synclist(softc, softc->ipf_rules[1][softc->ipf_active], ifp);
4184
4185         for (i = 0; i < IPL_LOGSIZE; i++) {
4186                 frgroup_t *g;
4187
4188                 for (g = softc->ipf_groups[i][0]; g != NULL; g = g->fg_next)
4189                         (void) ipf_synclist(softc, g->fg_start, ifp);
4190                 for (g = softc->ipf_groups[i][1]; g != NULL; g = g->fg_next)
4191                         (void) ipf_synclist(softc, g->fg_start, ifp);
4192         }
4193         RWLOCK_EXIT(&softc->ipf_mutex);
4194
4195         return 0;
4196 }
4197
4198
4199 /*
4200  * In the functions below, bcopy() is called because the pointer being
4201  * copied _from_ in this instance is a pointer to a char buf (which could
4202  * end up being unaligned) and on the kernel's local stack.
4203  */
4204 /* ------------------------------------------------------------------------ */
4205 /* Function:    copyinptr                                                   */
4206 /* Returns:     int - 0 = success, else failure                             */
4207 /* Parameters:  src(I)  - pointer to the source address                     */
4208 /*              dst(I)  - destination address                               */
4209 /*              size(I) - number of bytes to copy                           */
4210 /*                                                                          */
4211 /* Copy a block of data in from user space, given a pointer to the pointer  */
4212 /* to start copying from (src) and a pointer to where to store it (dst).    */
4213 /* NB: src - pointer to user space pointer, dst - kernel space pointer      */
4214 /* ------------------------------------------------------------------------ */
4215 int
4216 copyinptr(softc, src, dst, size)
4217         ipf_main_softc_t *softc;
4218         void *src, *dst;
4219         size_t size;
4220 {
4221         caddr_t ca;
4222         int error;
4223
4224 # if SOLARIS
4225         error = COPYIN(src, &ca, sizeof(ca));
4226         if (error != 0)
4227                 return error;
4228 # else
4229         bcopy(src, (caddr_t)&ca, sizeof(ca));
4230 # endif
4231         error = COPYIN(ca, dst, size);
4232         if (error != 0) {
4233                 IPFERROR(3);
4234                 error = EFAULT;
4235         }
4236         return error;
4237 }
4238
4239
4240 /* ------------------------------------------------------------------------ */
4241 /* Function:    copyoutptr                                                  */
4242 /* Returns:     int - 0 = success, else failure                             */
4243 /* Parameters:  src(I)  - pointer to the source address                     */
4244 /*              dst(I)  - destination address                               */
4245 /*              size(I) - number of bytes to copy                           */
4246 /*                                                                          */
4247 /* Copy a block of data out to user space, given a pointer to the pointer   */
4248 /* to start copying from (src) and a pointer to where to store it (dst).    */
4249 /* NB: src - kernel space pointer, dst - pointer to user space pointer.     */
4250 /* ------------------------------------------------------------------------ */
4251 int
4252 copyoutptr(softc, src, dst, size)
4253         ipf_main_softc_t *softc;
4254         void *src, *dst;
4255         size_t size;
4256 {
4257         caddr_t ca;
4258         int error;
4259
4260         bcopy(dst, (caddr_t)&ca, sizeof(ca));
4261         error = COPYOUT(src, ca, size);
4262         if (error != 0) {
4263                 IPFERROR(4);
4264                 error = EFAULT;
4265         }
4266         return error;
4267 }
4268 #ifdef  _KERNEL
4269 #endif
4270
4271
4272 /* ------------------------------------------------------------------------ */
4273 /* Function:    ipf_lock                                                    */
4274 /* Returns:     int      - 0 = success, else error                          */
4275 /* Parameters:  data(I)  - pointer to lock value to set                     */
4276 /*              lockp(O) - pointer to location to store old lock value      */
4277 /*                                                                          */
4278 /* Get the new value for the lock integer, set it and return the old value  */
4279 /* in *lockp.                                                               */
4280 /* ------------------------------------------------------------------------ */
4281 int
4282 ipf_lock(data, lockp)
4283         caddr_t data;
4284         int *lockp;
4285 {
4286         int arg, err;
4287
4288         err = BCOPYIN(data, &arg, sizeof(arg));
4289         if (err != 0)
4290                 return EFAULT;
4291         err = BCOPYOUT(lockp, data, sizeof(*lockp));
4292         if (err != 0)
4293                 return EFAULT;
4294         *lockp = arg;
4295         return 0;
4296 }
4297
4298
4299 /* ------------------------------------------------------------------------ */
4300 /* Function:    ipf_getstat                                                 */
4301 /* Returns:     Nil                                                         */
4302 /* Parameters:  softc(I) - pointer to soft context main structure           */
4303 /*              fiop(I)  - pointer to ipfilter stats structure              */
4304 /*              rev(I)   - version claim by program doing ioctl             */
4305 /*                                                                          */
4306 /* Stores a copy of current pointers, counters, etc, in the friostat        */
4307 /* structure.                                                               */
4308 /* If IPFILTER_COMPAT is compiled, we pretend to be whatever version the    */
4309 /* program is looking for. This ensure that validation of the version it    */
4310 /* expects will always succeed. Thus kernels with IPFILTER_COMPAT will      */
4311 /* allow older binaries to work but kernels without it will not.            */
4312 /* ------------------------------------------------------------------------ */
4313 /*ARGSUSED*/
4314 static void
4315 ipf_getstat(softc, fiop, rev)
4316         ipf_main_softc_t *softc;
4317         friostat_t *fiop;
4318         int rev;
4319 {
4320         int i;
4321
4322         bcopy((char *)softc->ipf_stats, (char *)fiop->f_st,
4323               sizeof(ipf_statistics_t) * 2);
4324         fiop->f_locks[IPL_LOGSTATE] = -1;
4325         fiop->f_locks[IPL_LOGNAT] = -1;
4326         fiop->f_locks[IPL_LOGIPF] = -1;
4327         fiop->f_locks[IPL_LOGAUTH] = -1;
4328
4329         fiop->f_ipf[0][0] = softc->ipf_rules[0][0];
4330         fiop->f_acct[0][0] = softc->ipf_acct[0][0];
4331         fiop->f_ipf[0][1] = softc->ipf_rules[0][1];
4332         fiop->f_acct[0][1] = softc->ipf_acct[0][1];
4333         fiop->f_ipf[1][0] = softc->ipf_rules[1][0];
4334         fiop->f_acct[1][0] = softc->ipf_acct[1][0];
4335         fiop->f_ipf[1][1] = softc->ipf_rules[1][1];
4336         fiop->f_acct[1][1] = softc->ipf_acct[1][1];
4337
4338         fiop->f_ticks = softc->ipf_ticks;
4339         fiop->f_active = softc->ipf_active;
4340         fiop->f_froute[0] = softc->ipf_frouteok[0];
4341         fiop->f_froute[1] = softc->ipf_frouteok[1];
4342         fiop->f_rb_no_mem = softc->ipf_rb_no_mem;
4343         fiop->f_rb_node_max = softc->ipf_rb_node_max;
4344
4345         fiop->f_running = softc->ipf_running;
4346         for (i = 0; i < IPL_LOGSIZE; i++) {
4347                 fiop->f_groups[i][0] = softc->ipf_groups[i][0];
4348                 fiop->f_groups[i][1] = softc->ipf_groups[i][1];
4349         }
4350 #ifdef  IPFILTER_LOG
4351         fiop->f_log_ok = ipf_log_logok(softc, IPL_LOGIPF);
4352         fiop->f_log_fail = ipf_log_failures(softc, IPL_LOGIPF);
4353         fiop->f_logging = 1;
4354 #else
4355         fiop->f_log_ok = 0;
4356         fiop->f_log_fail = 0;
4357         fiop->f_logging = 0;
4358 #endif
4359         fiop->f_defpass = softc->ipf_pass;
4360         fiop->f_features = ipf_features;
4361
4362 #ifdef IPFILTER_COMPAT
4363         sprintf(fiop->f_version, "IP Filter: v%d.%d.%d",
4364                 (rev / 1000000) % 100,
4365                 (rev / 10000) % 100,
4366                 (rev / 100) % 100);
4367 #else
4368         rev = rev;
4369         (void) strncpy(fiop->f_version, ipfilter_version,
4370                        sizeof(fiop->f_version));
4371 #endif
4372 }
4373
4374
4375 #ifdef  USE_INET6
4376 int icmptoicmp6types[ICMP_MAXTYPE+1] = {
4377         ICMP6_ECHO_REPLY,       /* 0: ICMP_ECHOREPLY */
4378         -1,                     /* 1: UNUSED */
4379         -1,                     /* 2: UNUSED */
4380         ICMP6_DST_UNREACH,      /* 3: ICMP_UNREACH */
4381         -1,                     /* 4: ICMP_SOURCEQUENCH */
4382         ND_REDIRECT,            /* 5: ICMP_REDIRECT */
4383         -1,                     /* 6: UNUSED */
4384         -1,                     /* 7: UNUSED */
4385         ICMP6_ECHO_REQUEST,     /* 8: ICMP_ECHO */
4386         -1,                     /* 9: UNUSED */
4387         -1,                     /* 10: UNUSED */
4388         ICMP6_TIME_EXCEEDED,    /* 11: ICMP_TIMXCEED */
4389         ICMP6_PARAM_PROB,       /* 12: ICMP_PARAMPROB */
4390         -1,                     /* 13: ICMP_TSTAMP */
4391         -1,                     /* 14: ICMP_TSTAMPREPLY */
4392         -1,                     /* 15: ICMP_IREQ */
4393         -1,                     /* 16: ICMP_IREQREPLY */
4394         -1,                     /* 17: ICMP_MASKREQ */
4395         -1,                     /* 18: ICMP_MASKREPLY */
4396 };
4397
4398
4399 int     icmptoicmp6unreach[ICMP_MAX_UNREACH] = {
4400         ICMP6_DST_UNREACH_ADDR,         /* 0: ICMP_UNREACH_NET */
4401         ICMP6_DST_UNREACH_ADDR,         /* 1: ICMP_UNREACH_HOST */
4402         -1,                             /* 2: ICMP_UNREACH_PROTOCOL */
4403         ICMP6_DST_UNREACH_NOPORT,       /* 3: ICMP_UNREACH_PORT */
4404         -1,                             /* 4: ICMP_UNREACH_NEEDFRAG */
4405         ICMP6_DST_UNREACH_NOTNEIGHBOR,  /* 5: ICMP_UNREACH_SRCFAIL */
4406         ICMP6_DST_UNREACH_ADDR,         /* 6: ICMP_UNREACH_NET_UNKNOWN */
4407         ICMP6_DST_UNREACH_ADDR,         /* 7: ICMP_UNREACH_HOST_UNKNOWN */
4408         -1,                             /* 8: ICMP_UNREACH_ISOLATED */
4409         ICMP6_DST_UNREACH_ADMIN,        /* 9: ICMP_UNREACH_NET_PROHIB */
4410         ICMP6_DST_UNREACH_ADMIN,        /* 10: ICMP_UNREACH_HOST_PROHIB */
4411         -1,                             /* 11: ICMP_UNREACH_TOSNET */
4412         -1,                             /* 12: ICMP_UNREACH_TOSHOST */
4413         ICMP6_DST_UNREACH_ADMIN,        /* 13: ICMP_UNREACH_ADMIN_PROHIBIT */
4414 };
4415 int     icmpreplytype6[ICMP6_MAXTYPE + 1];
4416 #endif
4417
4418 int     icmpreplytype4[ICMP_MAXTYPE + 1];
4419
4420
4421 /* ------------------------------------------------------------------------ */
4422 /* Function:    ipf_matchicmpqueryreply                                     */
4423 /* Returns:     int - 1 if "icmp" is a valid reply to "ic" else 0.          */
4424 /* Parameters:  v(I)    - IP protocol version (4 or 6)                      */
4425 /*              ic(I)   - ICMP information                                  */
4426 /*              icmp(I) - ICMP packet header                                */
4427 /*              rev(I)  - direction (0 = forward/1 = reverse) of packet     */
4428 /*                                                                          */
4429 /* Check if the ICMP packet defined by the header pointed to by icmp is a   */
4430 /* reply to one as described by what's in ic.  If it is a match, return 1,  */
4431 /* else return 0 for no match.                                              */
4432 /* ------------------------------------------------------------------------ */
4433 int
4434 ipf_matchicmpqueryreply(v, ic, icmp, rev)
4435         int v;
4436         icmpinfo_t *ic;
4437         icmphdr_t *icmp;
4438         int rev;
4439 {
4440         int ictype;
4441
4442         ictype = ic->ici_type;
4443
4444         if (v == 4) {
4445                 /*
4446                  * If we matched its type on the way in, then when going out
4447                  * it will still be the same type.
4448                  */
4449                 if ((!rev && (icmp->icmp_type == ictype)) ||
4450                     (rev && (icmpreplytype4[ictype] == icmp->icmp_type))) {
4451                         if (icmp->icmp_type != ICMP_ECHOREPLY)
4452                                 return 1;
4453                         if (icmp->icmp_id == ic->ici_id)
4454                                 return 1;
4455                 }
4456         }
4457 #ifdef  USE_INET6
4458         else if (v == 6) {
4459                 if ((!rev && (icmp->icmp_type == ictype)) ||
4460                     (rev && (icmpreplytype6[ictype] == icmp->icmp_type))) {
4461                         if (icmp->icmp_type != ICMP6_ECHO_REPLY)
4462                                 return 1;
4463                         if (icmp->icmp_id == ic->ici_id)
4464                                 return 1;
4465                 }
4466         }
4467 #endif
4468         return 0;
4469 }
4470
4471
4472 /* ------------------------------------------------------------------------ */
4473 /* Function:    ipf_rule_compare                                            */
4474 /* Parameters:  fr1(I) - first rule structure to compare                    */
4475 /*              fr2(I) - second rule structure to compare                   */
4476 /* Returns:     int    - 0 == rules are the same, else mismatch             */
4477 /*                                                                          */
4478 /* Compare two rules and return 0 if they match or a number indicating      */
4479 /* which of the individual checks failed.                                   */
4480 /* ------------------------------------------------------------------------ */
4481 static int
4482 ipf_rule_compare(frentry_t *fr1, frentry_t *fr2)
4483 {
4484         if (fr1->fr_cksum != fr2->fr_cksum)
4485                 return 1;
4486         if (fr1->fr_size != fr2->fr_size)
4487                 return 2;
4488         if (fr1->fr_dsize != fr2->fr_dsize)
4489                 return 3;
4490         if (bcmp((char *)&fr1->fr_func, (char *)&fr2->fr_func,
4491                  fr1->fr_size - offsetof(struct frentry, fr_func)) != 0)
4492                 return 4;
4493         if (fr1->fr_data && !fr2->fr_data)
4494                 return 5;
4495         if (!fr1->fr_data && fr2->fr_data)
4496                 return 6;
4497         if (fr1->fr_data) {
4498                 if (bcmp(fr1->fr_caddr, fr2->fr_caddr, fr1->fr_dsize))
4499                         return 7;
4500         }
4501         return 0;
4502 }
4503
4504
4505 /* ------------------------------------------------------------------------ */
4506 /* Function:    frrequest                                                   */
4507 /* Returns:     int - 0 == success, > 0 == errno value                      */
4508 /* Parameters:  unit(I)     - device for which this is for                  */
4509 /*              req(I)      - ioctl command (SIOC*)                         */
4510 /*              data(I)     - pointr to ioctl data                          */
4511 /*              set(I)      - 1 or 0 (filter set)                           */
4512 /*              makecopy(I) - flag indicating whether data points to a rule */
4513 /*                            in kernel space & hence doesn't need copying. */
4514 /*                                                                          */
4515 /* This function handles all the requests which operate on the list of      */
4516 /* filter rules.  This includes adding, deleting, insertion.  It is also    */
4517 /* responsible for creating groups when a "head" rule is loaded.  Interface */
4518 /* names are resolved here and other sanity checks are made on the content  */
4519 /* of the rule structure being loaded.  If a rule has user defined timeouts */
4520 /* then make sure they are created and initialised before exiting.          */
4521 /* ------------------------------------------------------------------------ */
4522 int
4523 frrequest(softc, unit, req, data, set, makecopy)
4524         ipf_main_softc_t *softc;
4525         int unit;
4526         ioctlcmd_t req;
4527         int set, makecopy;
4528         caddr_t data;
4529 {
4530         int error = 0, in, family, addrem, need_free = 0;
4531         frentry_t frd, *fp, *f, **fprev, **ftail;
4532         void *ptr, *uptr, *cptr;
4533         u_int *p, *pp;
4534         frgroup_t *fg;
4535         char *group;
4536
4537         ptr = NULL;
4538         cptr = NULL;
4539         fg = NULL;
4540         fp = &frd;
4541         if (makecopy != 0) {
4542                 bzero(fp, sizeof(frd));
4543                 error = ipf_inobj(softc, data, NULL, fp, IPFOBJ_FRENTRY);
4544                 if (error) {
4545                         return error;
4546                 }
4547                 if ((fp->fr_type & FR_T_BUILTIN) != 0) {
4548                         IPFERROR(6);
4549                         return EINVAL;
4550                 }
4551                 KMALLOCS(f, frentry_t *, fp->fr_size);
4552                 if (f == NULL) {
4553                         IPFERROR(131);
4554                         return ENOMEM;
4555                 }
4556                 bzero(f, fp->fr_size);
4557                 error = ipf_inobjsz(softc, data, f, IPFOBJ_FRENTRY,
4558                                     fp->fr_size);
4559                 if (error) {
4560                         KFREES(f, fp->fr_size);
4561                         return error;
4562                 }
4563
4564                 fp = f;
4565                 f = NULL;
4566                 fp->fr_next = NULL;
4567                 fp->fr_dnext = NULL;
4568                 fp->fr_pnext = NULL;
4569                 fp->fr_pdnext = NULL;
4570                 fp->fr_grp = NULL;
4571                 fp->fr_grphead = NULL;
4572                 fp->fr_icmpgrp = NULL;
4573                 fp->fr_isc = (void *)-1;
4574                 fp->fr_ptr = NULL;
4575                 fp->fr_ref = 0;
4576                 fp->fr_flags |= FR_COPIED;
4577         } else {
4578                 fp = (frentry_t *)data;
4579                 if ((fp->fr_type & FR_T_BUILTIN) == 0) {
4580                         IPFERROR(7);
4581                         return EINVAL;
4582                 }
4583                 fp->fr_flags &= ~FR_COPIED;
4584         }
4585
4586         if (((fp->fr_dsize == 0) && (fp->fr_data != NULL)) ||
4587             ((fp->fr_dsize != 0) && (fp->fr_data == NULL))) {
4588                 IPFERROR(8);
4589                 error = EINVAL;
4590                 goto donenolock;
4591         }
4592
4593         family = fp->fr_family;
4594         uptr = fp->fr_data;
4595
4596         if (req == (ioctlcmd_t)SIOCINAFR || req == (ioctlcmd_t)SIOCINIFR ||
4597             req == (ioctlcmd_t)SIOCADAFR || req == (ioctlcmd_t)SIOCADIFR)
4598                 addrem = 0;
4599         else if (req == (ioctlcmd_t)SIOCRMAFR || req == (ioctlcmd_t)SIOCRMIFR)
4600                 addrem = 1;
4601         else if (req == (ioctlcmd_t)SIOCZRLST)
4602                 addrem = 2;
4603         else {
4604                 IPFERROR(9);
4605                 error = EINVAL;
4606                 goto donenolock;
4607         }
4608
4609         /*
4610          * Only filter rules for IPv4 or IPv6 are accepted.
4611          */
4612         if (family == AF_INET) {
4613                 /*EMPTY*/;
4614 #ifdef  USE_INET6
4615         } else if (family == AF_INET6) {
4616                 /*EMPTY*/;
4617 #endif
4618         } else if (family != 0) {
4619                 IPFERROR(10);
4620                 error = EINVAL;
4621                 goto donenolock;
4622         }
4623
4624         /*
4625          * If the rule is being loaded from user space, i.e. we had to copy it
4626          * into kernel space, then do not trust the function pointer in the
4627          * rule.
4628          */
4629         if ((makecopy == 1) && (fp->fr_func != NULL)) {
4630                 if (ipf_findfunc(fp->fr_func) == NULL) {
4631                         IPFERROR(11);
4632                         error = ESRCH;
4633                         goto donenolock;
4634                 }
4635
4636                 if (addrem == 0) {
4637                         error = ipf_funcinit(softc, fp);
4638                         if (error != 0)
4639                                 goto donenolock;
4640                 }
4641         }
4642         if ((fp->fr_flags & FR_CALLNOW) &&
4643             ((fp->fr_func == NULL) || (fp->fr_func == (ipfunc_t)-1))) {
4644                 IPFERROR(142);
4645                 error = ESRCH;
4646                 goto donenolock;
4647         }
4648         if (((fp->fr_flags & FR_CMDMASK) == FR_CALL) &&
4649             ((fp->fr_func == NULL) || (fp->fr_func == (ipfunc_t)-1))) {
4650                 IPFERROR(143);
4651                 error = ESRCH;
4652                 goto donenolock;
4653         }
4654
4655         ptr = NULL;
4656         cptr = NULL;
4657
4658         if (FR_ISACCOUNT(fp->fr_flags))
4659                 unit = IPL_LOGCOUNT;
4660
4661         /*
4662          * Check that each group name in the rule has a start index that
4663          * is valid.
4664          */
4665         if (fp->fr_icmphead != -1) {
4666                 if ((fp->fr_icmphead < 0) ||
4667                     (fp->fr_icmphead >= fp->fr_namelen)) {
4668                         IPFERROR(136);
4669                         error = EINVAL;
4670                         goto donenolock;
4671                 }
4672                 if (!strcmp(FR_NAME(fp, fr_icmphead), "0"))
4673                         fp->fr_names[fp->fr_icmphead] = '\0';
4674         }
4675
4676         if (fp->fr_grhead != -1) {
4677                 if ((fp->fr_grhead < 0) ||
4678                     (fp->fr_grhead >= fp->fr_namelen)) {
4679                         IPFERROR(137);
4680                         error = EINVAL;
4681                         goto donenolock;
4682                 }
4683                 if (!strcmp(FR_NAME(fp, fr_grhead), "0"))
4684                         fp->fr_names[fp->fr_grhead] = '\0';
4685         }
4686
4687         if (fp->fr_group != -1) {
4688                 if ((fp->fr_group < 0) ||
4689                     (fp->fr_group >= fp->fr_namelen)) {
4690                         IPFERROR(138);
4691                         error = EINVAL;
4692                         goto donenolock;
4693                 }
4694                 if ((req != (int)SIOCZRLST) && (fp->fr_group != -1)) {
4695                         /*
4696                          * Allow loading rules that are in groups to cause
4697                          * them to be created if they don't already exit.
4698                          */
4699                         group = FR_NAME(fp, fr_group);
4700                         if (addrem == 0) {
4701                                 fg = ipf_group_add(softc, group, NULL,
4702                                                    fp->fr_flags, unit, set);
4703                                 fp->fr_grp = fg;
4704                         } else {
4705                                 fg = ipf_findgroup(softc, group, unit,
4706                                                    set, NULL);
4707                                 if (fg == NULL) {
4708                                         IPFERROR(12);
4709                                         error = ESRCH;
4710                                         goto donenolock;
4711                                 }
4712                         }
4713
4714                         if (fg->fg_flags == 0) {
4715                                 fg->fg_flags = fp->fr_flags & FR_INOUT;
4716                         } else if (fg->fg_flags != (fp->fr_flags & FR_INOUT)) {
4717                                 IPFERROR(13);
4718                                 error = ESRCH;
4719                                 goto donenolock;
4720                         }
4721                 }
4722         } else {
4723                 /*
4724                  * If a rule is going to be part of a group then it does
4725                  * not matter whether it is an in or out rule, but if it
4726                  * isn't in a group, then it does...
4727                  */
4728                 if ((fp->fr_flags & (FR_INQUE|FR_OUTQUE)) == 0) {
4729                         IPFERROR(14);
4730                         error = EINVAL;
4731                         goto donenolock;
4732                 }
4733         }
4734         in = (fp->fr_flags & FR_INQUE) ? 0 : 1;
4735
4736         /*
4737          * Work out which rule list this change is being applied to.
4738          */
4739         ftail = NULL;
4740         fprev = NULL;
4741         if (unit == IPL_LOGAUTH) {
4742                 if ((fp->fr_tifs[0].fd_ptr != NULL) ||
4743                     (fp->fr_tifs[1].fd_ptr != NULL) ||
4744                     (fp->fr_dif.fd_ptr != NULL) ||
4745                     (fp->fr_flags & FR_FASTROUTE)) {
4746                         softc->ipf_interror = 145;
4747                         error = EINVAL;
4748                         goto donenolock;
4749                 }
4750                 fprev = ipf_auth_rulehead(softc);
4751         } else {
4752                 if (FR_ISACCOUNT(fp->fr_flags))
4753                         fprev = &softc->ipf_acct[in][set];
4754                 else if ((fp->fr_flags & (FR_OUTQUE|FR_INQUE)) != 0)
4755                         fprev = &softc->ipf_rules[in][set];
4756         }
4757         if (fprev == NULL) {
4758                 IPFERROR(15);
4759                 error = ESRCH;
4760                 goto donenolock;
4761         }
4762
4763         if (fg != NULL)
4764                 fprev = &fg->fg_start;
4765
4766         /*
4767          * Copy in extra data for the rule.
4768          */
4769         if (fp->fr_dsize != 0) {
4770                 if (makecopy != 0) {
4771                         KMALLOCS(ptr, void *, fp->fr_dsize);
4772                         if (ptr == NULL) {
4773                                 IPFERROR(16);
4774                                 error = ENOMEM;
4775                                 goto donenolock;
4776                         }
4777
4778                         /*
4779                          * The bcopy case is for when the data is appended
4780                          * to the rule by ipf_in_compat().
4781                          */
4782                         if (uptr >= (void *)fp &&
4783                             uptr < (void *)((char *)fp + fp->fr_size)) {
4784                                 bcopy(uptr, ptr, fp->fr_dsize);
4785                                 error = 0;
4786                         } else {
4787                                 error = COPYIN(uptr, ptr, fp->fr_dsize);
4788                                 if (error != 0) {
4789                                         IPFERROR(17);
4790                                         error = EFAULT;
4791                                         goto donenolock;
4792                                 }
4793                         }
4794                 } else {
4795                         ptr = uptr;
4796                 }
4797                 fp->fr_data = ptr;
4798         } else {
4799                 fp->fr_data = NULL;
4800         }
4801
4802         /*
4803          * Perform per-rule type sanity checks of their members.
4804          * All code after this needs to be aware that allocated memory
4805          * may need to be free'd before exiting.
4806          */
4807         switch (fp->fr_type & ~FR_T_BUILTIN)
4808         {
4809 #if defined(IPFILTER_BPF)
4810         case FR_T_BPFOPC :
4811                 if (fp->fr_dsize == 0) {
4812                         IPFERROR(19);
4813                         error = EINVAL;
4814                         break;
4815                 }
4816                 if (!bpf_validate(ptr, fp->fr_dsize/sizeof(struct bpf_insn))) {
4817                         IPFERROR(20);
4818                         error = EINVAL;
4819                         break;
4820                 }
4821                 break;
4822 #endif
4823         case FR_T_IPF :
4824                 /*
4825                  * Preparation for error case at the bottom of this function.
4826                  */
4827                 if (fp->fr_datype == FRI_LOOKUP)
4828                         fp->fr_dstptr = NULL;
4829                 if (fp->fr_satype == FRI_LOOKUP)
4830                         fp->fr_srcptr = NULL;
4831
4832                 if (fp->fr_dsize != sizeof(fripf_t)) {
4833                         IPFERROR(21);
4834                         error = EINVAL;
4835                         break;
4836                 }
4837
4838                 /*
4839                  * Allowing a rule with both "keep state" and "with oow" is
4840                  * pointless because adding a state entry to the table will
4841                  * fail with the out of window (oow) flag set.
4842                  */
4843                 if ((fp->fr_flags & FR_KEEPSTATE) && (fp->fr_flx & FI_OOW)) {
4844                         IPFERROR(22);
4845                         error = EINVAL;
4846                         break;
4847                 }
4848
4849                 switch (fp->fr_satype)
4850                 {
4851                 case FRI_BROADCAST :
4852                 case FRI_DYNAMIC :
4853                 case FRI_NETWORK :
4854                 case FRI_NETMASKED :
4855                 case FRI_PEERADDR :
4856                         if (fp->fr_sifpidx < 0) {
4857                                 IPFERROR(23);
4858                                 error = EINVAL;
4859                         }
4860                         break;
4861                 case FRI_LOOKUP :
4862                         fp->fr_srcptr = ipf_findlookup(softc, unit, fp,
4863                                                        &fp->fr_src6,
4864                                                        &fp->fr_smsk6);
4865                         if (fp->fr_srcfunc == NULL) {
4866                                 IPFERROR(132);
4867                                 error = ESRCH;
4868                                 break;
4869                         }
4870                         break;
4871                 case FRI_NORMAL :
4872                         break;
4873                 default :
4874                         IPFERROR(133);
4875                         error = EINVAL;
4876                         break;
4877                 }
4878                 if (error != 0)
4879                         break;
4880
4881                 switch (fp->fr_datype)
4882                 {
4883                 case FRI_BROADCAST :
4884                 case FRI_DYNAMIC :
4885                 case FRI_NETWORK :
4886                 case FRI_NETMASKED :
4887                 case FRI_PEERADDR :
4888                         if (fp->fr_difpidx < 0) {
4889                                 IPFERROR(24);
4890                                 error = EINVAL;
4891                         }
4892                         break;
4893                 case FRI_LOOKUP :
4894                         fp->fr_dstptr = ipf_findlookup(softc, unit, fp,
4895                                                        &fp->fr_dst6,
4896                                                        &fp->fr_dmsk6);
4897                         if (fp->fr_dstfunc == NULL) {
4898                                 IPFERROR(134);
4899                                 error = ESRCH;
4900                         }
4901                         break;
4902                 case FRI_NORMAL :
4903                         break;
4904                 default :
4905                         IPFERROR(135);
4906                         error = EINVAL;
4907                 }
4908                 break;
4909
4910         case FR_T_NONE :
4911         case FR_T_CALLFUNC :
4912         case FR_T_COMPIPF :
4913                 break;
4914
4915         case FR_T_IPFEXPR :
4916                 if (ipf_matcharray_verify(fp->fr_data, fp->fr_dsize) == -1) {
4917                         IPFERROR(25);
4918                         error = EINVAL;
4919                 }
4920                 break;
4921
4922         default :
4923                 IPFERROR(26);
4924                 error = EINVAL;
4925                 break;
4926         }
4927         if (error != 0)
4928                 goto donenolock;
4929
4930         if (fp->fr_tif.fd_name != -1) {
4931                 if ((fp->fr_tif.fd_name < 0) ||
4932                     (fp->fr_tif.fd_name >= fp->fr_namelen)) {
4933                         IPFERROR(139);
4934                         error = EINVAL;
4935                         goto donenolock;
4936                 }
4937         }
4938
4939         if (fp->fr_dif.fd_name != -1) {
4940                 if ((fp->fr_dif.fd_name < 0) ||
4941                     (fp->fr_dif.fd_name >= fp->fr_namelen)) {
4942                         IPFERROR(140);
4943                         error = EINVAL;
4944                         goto donenolock;
4945                 }
4946         }
4947
4948         if (fp->fr_rif.fd_name != -1) {
4949                 if ((fp->fr_rif.fd_name < 0) ||
4950                     (fp->fr_rif.fd_name >= fp->fr_namelen)) {
4951                         IPFERROR(141);
4952                         error = EINVAL;
4953                         goto donenolock;
4954                 }
4955         }
4956
4957         /*
4958          * Lookup all the interface names that are part of the rule.
4959          */
4960         error = ipf_synclist(softc, fp, NULL);
4961         if (error != 0)
4962                 goto donenolock;
4963         fp->fr_statecnt = 0;
4964         if (fp->fr_srctrack.ht_max_nodes != 0)
4965                 ipf_rb_ht_init(&fp->fr_srctrack);
4966
4967         /*
4968          * Look for an existing matching filter rule, but don't include the
4969          * next or interface pointer in the comparison (fr_next, fr_ifa).
4970          * This elminates rules which are indentical being loaded.  Checksum
4971          * the constant part of the filter rule to make comparisons quicker
4972          * (this meaning no pointers are included).
4973          */
4974         for (fp->fr_cksum = 0, p = (u_int *)&fp->fr_func, pp = &fp->fr_cksum;
4975              p < pp; p++)
4976                 fp->fr_cksum += *p;
4977         pp = (u_int *)(fp->fr_caddr + fp->fr_dsize);
4978         for (p = (u_int *)fp->fr_data; p < pp; p++)
4979                 fp->fr_cksum += *p;
4980
4981         WRITE_ENTER(&softc->ipf_mutex);
4982
4983         /*
4984          * Now that the filter rule lists are locked, we can walk the
4985          * chain of them without fear.
4986          */
4987         ftail = fprev;
4988         for (f = *ftail; (f = *ftail) != NULL; ftail = &f->fr_next) {
4989                 if (fp->fr_collect <= f->fr_collect) {
4990                         ftail = fprev;
4991                         f = NULL;
4992                         break;
4993                 }
4994                 fprev = ftail;
4995         }
4996
4997         for (; (f = *ftail) != NULL; ftail = &f->fr_next) {
4998                 if (ipf_rule_compare(fp, f) == 0)
4999                         break;
5000         }
5001
5002         /*
5003          * If zero'ing statistics, copy current to caller and zero.
5004          */
5005         if (addrem == 2) {
5006                 if (f == NULL) {
5007                         IPFERROR(27);
5008                         error = ESRCH;
5009                 } else {
5010                         /*
5011                          * Copy and reduce lock because of impending copyout.
5012                          * Well we should, but if we do then the atomicity of
5013                          * this call and the correctness of fr_hits and
5014                          * fr_bytes cannot be guaranteed.  As it is, this code
5015                          * only resets them to 0 if they are successfully
5016                          * copied out into user space.
5017                          */
5018                         bcopy((char *)f, (char *)fp, f->fr_size);
5019                         /* MUTEX_DOWNGRADE(&softc->ipf_mutex); */
5020
5021                         /*
5022                          * When we copy this rule back out, set the data
5023                          * pointer to be what it was in user space.
5024                          */
5025                         fp->fr_data = uptr;
5026                         error = ipf_outobj(softc, data, fp, IPFOBJ_FRENTRY);
5027
5028                         if (error == 0) {
5029                                 if ((f->fr_dsize != 0) && (uptr != NULL))
5030                                         error = COPYOUT(f->fr_data, uptr,
5031                                                         f->fr_dsize);
5032                                         if (error != 0) {
5033                                                 IPFERROR(28);
5034                                                 error = EFAULT;
5035                                         }
5036                                 if (error == 0) {
5037                                         f->fr_hits = 0;
5038                                         f->fr_bytes = 0;
5039                                 }
5040                         }
5041                 }
5042
5043                 if (makecopy != 0) {
5044                         if (ptr != NULL) {
5045                                 KFREES(ptr, fp->fr_dsize);
5046                         }
5047                         KFREES(fp, fp->fr_size);
5048                 }
5049                 RWLOCK_EXIT(&softc->ipf_mutex);
5050                 return error;
5051         }
5052
5053         if (!f) {
5054                 /*
5055                  * At the end of this, ftail must point to the place where the
5056                  * new rule is to be saved/inserted/added.
5057                  * For SIOCAD*FR, this should be the last rule in the group of
5058                  * rules that have equal fr_collect fields.
5059                  * For SIOCIN*FR, ...
5060                  */
5061                 if (req == (ioctlcmd_t)SIOCADAFR ||
5062                     req == (ioctlcmd_t)SIOCADIFR) {
5063
5064                         for (ftail = fprev; (f = *ftail) != NULL; ) {
5065                                 if (f->fr_collect > fp->fr_collect)
5066                                         break;
5067                                 ftail = &f->fr_next;
5068                                 fprev = ftail;
5069                         }
5070                         ftail = fprev;
5071                         f = NULL;
5072                         ptr = NULL;
5073                 } else if (req == (ioctlcmd_t)SIOCINAFR ||
5074                            req == (ioctlcmd_t)SIOCINIFR) {
5075                         while ((f = *fprev) != NULL) {
5076                                 if (f->fr_collect >= fp->fr_collect)
5077                                         break;
5078                                 fprev = &f->fr_next;
5079                         }
5080                         ftail = fprev;
5081                         if (fp->fr_hits != 0) {
5082                                 while (fp->fr_hits && (f = *ftail)) {
5083                                         if (f->fr_collect != fp->fr_collect)
5084                                                 break;
5085                                         fprev = ftail;
5086                                         ftail = &f->fr_next;
5087                                         fp->fr_hits--;
5088                                 }
5089                         }
5090                         f = NULL;
5091                         ptr = NULL;
5092                 }
5093         }
5094
5095         /*
5096          * Request to remove a rule.
5097          */
5098         if (addrem == 1) {
5099                 if (!f) {
5100                         IPFERROR(29);
5101                         error = ESRCH;
5102                 } else {
5103                         /*
5104                          * Do not allow activity from user space to interfere
5105                          * with rules not loaded that way.
5106                          */
5107                         if ((makecopy == 1) && !(f->fr_flags & FR_COPIED)) {
5108                                 IPFERROR(30);
5109                                 error = EPERM;
5110                                 goto done;
5111                         }
5112
5113                         /*
5114                          * Return EBUSY if the rule is being reference by
5115                          * something else (eg state information.)
5116                          */
5117                         if (f->fr_ref > 1) {
5118                                 IPFERROR(31);
5119                                 error = EBUSY;
5120                                 goto done;
5121                         }
5122 #ifdef  IPFILTER_SCAN
5123                         if (f->fr_isctag != -1 &&
5124                             (f->fr_isc != (struct ipscan *)-1))
5125                                 ipf_scan_detachfr(f);
5126 #endif
5127
5128                         if (unit == IPL_LOGAUTH) {
5129                                 error = ipf_auth_precmd(softc, req, f, ftail);
5130                                 goto done;
5131                         }
5132
5133                         ipf_rule_delete(softc, f, unit, set);
5134
5135                         need_free = makecopy;
5136                 }
5137         } else {
5138                 /*
5139                  * Not removing, so we must be adding/inserting a rule.
5140                  */
5141                 if (f != NULL) {
5142                         IPFERROR(32);
5143                         error = EEXIST;
5144                         goto done;
5145                 }
5146                 if (unit == IPL_LOGAUTH) {
5147                         error = ipf_auth_precmd(softc, req, fp, ftail);
5148                         goto done;
5149                 }
5150
5151                 MUTEX_NUKE(&fp->fr_lock);
5152                 MUTEX_INIT(&fp->fr_lock, "filter rule lock");
5153                 if (fp->fr_die != 0)
5154                         ipf_rule_expire_insert(softc, fp, set);
5155
5156                 fp->fr_hits = 0;
5157                 if (makecopy != 0)
5158                         fp->fr_ref = 1;
5159                 fp->fr_pnext = ftail;
5160                 fp->fr_next = *ftail;
5161                 if (fp->fr_next != NULL)
5162                         fp->fr_next->fr_pnext = &fp->fr_next;
5163                 *ftail = fp;
5164                 if (addrem == 0)
5165                         ipf_fixskip(ftail, fp, 1);
5166
5167                 fp->fr_icmpgrp = NULL;
5168                 if (fp->fr_icmphead != -1) {
5169                         group = FR_NAME(fp, fr_icmphead);
5170                         fg = ipf_group_add(softc, group, fp, 0, unit, set);
5171                         fp->fr_icmpgrp = fg;
5172                 }
5173
5174                 fp->fr_grphead = NULL;
5175                 if (fp->fr_grhead != -1) {
5176                         group = FR_NAME(fp, fr_grhead);
5177                         fg = ipf_group_add(softc, group, fp, fp->fr_flags,
5178                                            unit, set);
5179                         fp->fr_grphead = fg;
5180                 }
5181         }
5182 done:
5183         RWLOCK_EXIT(&softc->ipf_mutex);
5184 donenolock:
5185         if (need_free || (error != 0)) {
5186                 if ((fp->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) {
5187                         if ((fp->fr_satype == FRI_LOOKUP) &&
5188                             (fp->fr_srcptr != NULL))
5189                                 ipf_lookup_deref(softc, fp->fr_srctype,
5190                                                  fp->fr_srcptr);
5191                         if ((fp->fr_datype == FRI_LOOKUP) &&
5192                             (fp->fr_dstptr != NULL))
5193                                 ipf_lookup_deref(softc, fp->fr_dsttype,
5194                                                  fp->fr_dstptr);
5195                 }
5196                 if (fp->fr_grp != NULL) {
5197                         WRITE_ENTER(&softc->ipf_mutex);
5198                         ipf_group_del(softc, fp->fr_grp, fp);
5199                         RWLOCK_EXIT(&softc->ipf_mutex);
5200                 }
5201                 if ((ptr != NULL) && (makecopy != 0)) {
5202                         KFREES(ptr, fp->fr_dsize);
5203                 }
5204                 KFREES(fp, fp->fr_size);
5205         }
5206         return (error);
5207 }
5208
5209
5210 /* ------------------------------------------------------------------------ */
5211 /* Function:   ipf_rule_delete                                              */
5212 /* Returns:    Nil                                                          */
5213 /* Parameters: softc(I) - pointer to soft context main structure            */
5214 /*             f(I)     - pointer to the rule being deleted                 */
5215 /*             ftail(I) - pointer to the pointer to f                       */
5216 /*             unit(I)  - device for which this is for                      */
5217 /*             set(I)   - 1 or 0 (filter set)                               */
5218 /*                                                                          */
5219 /* This function attempts to do what it can to delete a filter rule: remove */
5220 /* it from any linked lists and remove any groups it is responsible for.    */
5221 /* But in the end, removing a rule can only drop the reference count - we   */
5222 /* must use that as the guide for whether or not it can be freed.           */
5223 /* ------------------------------------------------------------------------ */
5224 static void
5225 ipf_rule_delete(softc, f, unit, set)
5226         ipf_main_softc_t *softc;
5227         frentry_t *f;
5228         int unit, set;
5229 {
5230
5231         /*
5232          * If fr_pdnext is set, then the rule is on the expire list, so
5233          * remove it from there.
5234          */
5235         if (f->fr_pdnext != NULL) {
5236                 *f->fr_pdnext = f->fr_dnext;
5237                 if (f->fr_dnext != NULL)
5238                         f->fr_dnext->fr_pdnext = f->fr_pdnext;
5239                 f->fr_pdnext = NULL;
5240                 f->fr_dnext = NULL;
5241         }
5242
5243         ipf_fixskip(f->fr_pnext, f, -1);
5244         if (f->fr_pnext != NULL)
5245                 *f->fr_pnext = f->fr_next;
5246         if (f->fr_next != NULL)
5247                 f->fr_next->fr_pnext = f->fr_pnext;
5248         f->fr_pnext = NULL;
5249         f->fr_next = NULL;
5250
5251         (void) ipf_derefrule(softc, &f);
5252 }
5253
5254 /* ------------------------------------------------------------------------ */
5255 /* Function:   ipf_rule_expire_insert                                       */
5256 /* Returns:    Nil                                                          */
5257 /* Parameters: softc(I) - pointer to soft context main structure            */
5258 /*             f(I)     - pointer to rule to be added to expire list        */
5259 /*             set(I)   - 1 or 0 (filter set)                               */
5260 /*                                                                          */
5261 /* If the new rule has a given expiration time, insert it into the list of  */
5262 /* expiring rules with the ones to be removed first added to the front of   */
5263 /* the list. The insertion is O(n) but it is kept sorted for quick scans at */
5264 /* expiration interval checks.                                              */
5265 /* ------------------------------------------------------------------------ */
5266 static void
5267 ipf_rule_expire_insert(softc, f, set)
5268         ipf_main_softc_t *softc;
5269         frentry_t *f;
5270         int set;
5271 {
5272         frentry_t *fr;
5273
5274         /*
5275          */
5276
5277         f->fr_die = softc->ipf_ticks + IPF_TTLVAL(f->fr_die);
5278         for (fr = softc->ipf_rule_explist[set]; fr != NULL;
5279              fr = fr->fr_dnext) {
5280                 if (f->fr_die < fr->fr_die)
5281                         break;
5282                 if (fr->fr_dnext == NULL) {
5283                         /*
5284                          * We've got to the last rule and everything
5285                          * wanted to be expired before this new node,
5286                          * so we have to tack it on the end...
5287                          */
5288                         fr->fr_dnext = f;
5289                         f->fr_pdnext = &fr->fr_dnext;
5290                         fr = NULL;
5291                         break;
5292                 }
5293         }
5294
5295         if (softc->ipf_rule_explist[set] == NULL) {
5296                 softc->ipf_rule_explist[set] = f;
5297                 f->fr_pdnext = &softc->ipf_rule_explist[set];
5298         } else if (fr != NULL) {
5299                 f->fr_dnext = fr;
5300                 f->fr_pdnext = fr->fr_pdnext;
5301                 fr->fr_pdnext = &f->fr_dnext;
5302         }
5303 }
5304
5305
5306 /* ------------------------------------------------------------------------ */
5307 /* Function:   ipf_findlookup                                               */
5308 /* Returns:    NULL = failure, else success                                 */
5309 /* Parameters: softc(I) - pointer to soft context main structure            */
5310 /*             unit(I)  - ipf device we want to find match for              */
5311 /*             fp(I)    - rule for which lookup is for                      */
5312 /*             addrp(I) - pointer to lookup information in address struct   */
5313 /*             maskp(O) - pointer to lookup information for storage         */
5314 /*                                                                          */
5315 /* When using pools and hash tables to store addresses for matching in      */
5316 /* rules, it is necessary to resolve both the object referred to by the     */
5317 /* name or address (and return that pointer) and also provide the means by  */
5318 /* which to determine if an address belongs to that object to make the      */
5319 /* packet matching quicker.                                                 */
5320 /* ------------------------------------------------------------------------ */
5321 static void *
5322 ipf_findlookup(softc, unit, fr, addrp, maskp)
5323         ipf_main_softc_t *softc;
5324         int unit;
5325         frentry_t *fr;
5326         i6addr_t *addrp, *maskp;
5327 {
5328         void *ptr = NULL;
5329
5330         switch (addrp->iplookupsubtype)
5331         {
5332         case 0 :
5333                 ptr = ipf_lookup_res_num(softc, unit, addrp->iplookuptype,
5334                                          addrp->iplookupnum,
5335                                          &maskp->iplookupfunc);
5336                 break;
5337         case 1 :
5338                 if (addrp->iplookupname < 0)
5339                         break;
5340                 if (addrp->iplookupname >= fr->fr_namelen)
5341                         break;
5342                 ptr = ipf_lookup_res_name(softc, unit, addrp->iplookuptype,
5343                                           fr->fr_names + addrp->iplookupname,
5344                                           &maskp->iplookupfunc);
5345                 break;
5346         default :
5347                 break;
5348         }
5349
5350         return ptr;
5351 }
5352
5353
5354 /* ------------------------------------------------------------------------ */
5355 /* Function:    ipf_funcinit                                                */
5356 /* Returns:     int - 0 == success, else ESRCH: cannot resolve rule details */
5357 /* Parameters:  softc(I) - pointer to soft context main structure           */
5358 /*              fr(I)    - pointer to filter rule                           */
5359 /*                                                                          */
5360 /* If a rule is a call rule, then check if the function it points to needs  */
5361 /* an init function to be called now the rule has been loaded.              */
5362 /* ------------------------------------------------------------------------ */
5363 static int
5364 ipf_funcinit(softc, fr)
5365         ipf_main_softc_t *softc;
5366         frentry_t *fr;
5367 {
5368         ipfunc_resolve_t *ft;
5369         int err;
5370
5371         IPFERROR(34);
5372         err = ESRCH;
5373
5374         for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++)
5375                 if (ft->ipfu_addr == fr->fr_func) {
5376                         err = 0;
5377                         if (ft->ipfu_init != NULL)
5378                                 err = (*ft->ipfu_init)(softc, fr);
5379                         break;
5380                 }
5381         return err;
5382 }
5383
5384
5385 /* ------------------------------------------------------------------------ */
5386 /* Function:    ipf_funcfini                                                */
5387 /* Returns:     Nil                                                         */
5388 /* Parameters:  softc(I) - pointer to soft context main structure           */
5389 /*              fr(I)    - pointer to filter rule                           */
5390 /*                                                                          */
5391 /* For a given filter rule, call the matching "fini" function if the rule   */
5392 /* is using a known function that would have resulted in the "init" being   */
5393 /* called for ealier.                                                       */
5394 /* ------------------------------------------------------------------------ */
5395 static void
5396 ipf_funcfini(softc, fr)
5397         ipf_main_softc_t *softc;
5398         frentry_t *fr;
5399 {
5400         ipfunc_resolve_t *ft;
5401
5402         for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++)
5403                 if (ft->ipfu_addr == fr->fr_func) {
5404                         if (ft->ipfu_fini != NULL)
5405                                 (void) (*ft->ipfu_fini)(softc, fr);
5406                         break;
5407                 }
5408 }
5409
5410
5411 /* ------------------------------------------------------------------------ */
5412 /* Function:    ipf_findfunc                                                */
5413 /* Returns:     ipfunc_t - pointer to function if found, else NULL          */
5414 /* Parameters:  funcptr(I) - function pointer to lookup                     */
5415 /*                                                                          */
5416 /* Look for a function in the table of known functions.                     */
5417 /* ------------------------------------------------------------------------ */
5418 static ipfunc_t
5419 ipf_findfunc(funcptr)
5420         ipfunc_t funcptr;
5421 {
5422         ipfunc_resolve_t *ft;
5423
5424         for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++)
5425                 if (ft->ipfu_addr == funcptr)
5426                         return funcptr;
5427         return NULL;
5428 }
5429
5430
5431 /* ------------------------------------------------------------------------ */
5432 /* Function:    ipf_resolvefunc                                             */
5433 /* Returns:     int - 0 == success, else error                              */
5434 /* Parameters:  data(IO) - ioctl data pointer to ipfunc_resolve_t struct    */
5435 /*                                                                          */
5436 /* Copy in a ipfunc_resolve_t structure and then fill in the missing field. */
5437 /* This will either be the function name (if the pointer is set) or the     */
5438 /* function pointer if the name is set.  When found, fill in the other one  */
5439 /* so that the entire, complete, structure can be copied back to user space.*/
5440 /* ------------------------------------------------------------------------ */
5441 int
5442 ipf_resolvefunc(softc, data)
5443         ipf_main_softc_t *softc;
5444         void *data;
5445 {
5446         ipfunc_resolve_t res, *ft;
5447         int error;
5448
5449         error = BCOPYIN(data, &res, sizeof(res));
5450         if (error != 0) {
5451                 IPFERROR(123);
5452                 return EFAULT;
5453         }
5454
5455         if (res.ipfu_addr == NULL && res.ipfu_name[0] != '\0') {
5456                 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++)
5457                         if (strncmp(res.ipfu_name, ft->ipfu_name,
5458                                     sizeof(res.ipfu_name)) == 0) {
5459                                 res.ipfu_addr = ft->ipfu_addr;
5460                                 res.ipfu_init = ft->ipfu_init;
5461                                 if (COPYOUT(&res, data, sizeof(res)) != 0) {
5462                                         IPFERROR(35);
5463                                         return EFAULT;
5464                                 }
5465                                 return 0;
5466                         }
5467         }
5468         if (res.ipfu_addr != NULL && res.ipfu_name[0] == '\0') {
5469                 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++)
5470                         if (ft->ipfu_addr == res.ipfu_addr) {
5471                                 (void) strncpy(res.ipfu_name, ft->ipfu_name,
5472                                                sizeof(res.ipfu_name));
5473                                 res.ipfu_init = ft->ipfu_init;
5474                                 if (COPYOUT(&res, data, sizeof(res)) != 0) {
5475                                         IPFERROR(36);
5476                                         return EFAULT;
5477                                 }
5478                                 return 0;
5479                         }
5480         }
5481         IPFERROR(37);
5482         return ESRCH;
5483 }
5484
5485
5486 #if !defined(_KERNEL) || (!defined(__NetBSD__) && !defined(__OpenBSD__) && \
5487      !defined(__FreeBSD__)) || \
5488     FREEBSD_LT_REV(501000) || NETBSD_LT_REV(105000000) || \
5489     OPENBSD_LT_REV(200006)
5490 /*
5491  * From: NetBSD
5492  * ppsratecheck(): packets (or events) per second limitation.
5493  */
5494 int
5495 ppsratecheck(lasttime, curpps, maxpps)
5496         struct timeval *lasttime;
5497         int *curpps;
5498         int maxpps;     /* maximum pps allowed */
5499 {
5500         struct timeval tv, delta;
5501         int rv;
5502
5503         GETKTIME(&tv);
5504
5505         delta.tv_sec = tv.tv_sec - lasttime->tv_sec;
5506         delta.tv_usec = tv.tv_usec - lasttime->tv_usec;
5507         if (delta.tv_usec < 0) {
5508                 delta.tv_sec--;
5509                 delta.tv_usec += 1000000;
5510         }
5511
5512         /*
5513          * check for 0,0 is so that the message will be seen at least once.
5514          * if more than one second have passed since the last update of
5515          * lasttime, reset the counter.
5516          *
5517          * we do increment *curpps even in *curpps < maxpps case, as some may
5518          * try to use *curpps for stat purposes as well.
5519          */
5520         if ((lasttime->tv_sec == 0 && lasttime->tv_usec == 0) ||
5521             delta.tv_sec >= 1) {
5522                 *lasttime = tv;
5523                 *curpps = 0;
5524                 rv = 1;
5525         } else if (maxpps < 0)
5526                 rv = 1;
5527         else if (*curpps < maxpps)
5528                 rv = 1;
5529         else
5530                 rv = 0;
5531         *curpps = *curpps + 1;
5532
5533         return (rv);
5534 }
5535 #endif
5536
5537
5538 /* ------------------------------------------------------------------------ */
5539 /* Function:    ipf_derefrule                                               */
5540 /* Returns:     int   - 0 == rule freed up, else rule not freed             */
5541 /* Parameters:  fr(I) - pointer to filter rule                              */
5542 /*                                                                          */
5543 /* Decrement the reference counter to a rule by one.  If it reaches zero,   */
5544 /* free it and any associated storage space being used by it.               */
5545 /* ------------------------------------------------------------------------ */
5546 int
5547 ipf_derefrule(softc, frp)
5548         ipf_main_softc_t *softc;
5549         frentry_t **frp;
5550 {
5551         frentry_t *fr;
5552         frdest_t *fdp;
5553
5554         fr = *frp;
5555         *frp = NULL;
5556
5557         MUTEX_ENTER(&fr->fr_lock);
5558         fr->fr_ref--;
5559         if (fr->fr_ref == 0) {
5560                 MUTEX_EXIT(&fr->fr_lock);
5561                 MUTEX_DESTROY(&fr->fr_lock);
5562
5563                 ipf_funcfini(softc, fr);
5564
5565                 fdp = &fr->fr_tif;
5566                 if (fdp->fd_type == FRD_DSTLIST)
5567                         ipf_lookup_deref(softc, IPLT_DSTLIST, fdp->fd_ptr);
5568
5569                 fdp = &fr->fr_rif;
5570                 if (fdp->fd_type == FRD_DSTLIST)
5571                         ipf_lookup_deref(softc, IPLT_DSTLIST, fdp->fd_ptr);
5572
5573                 fdp = &fr->fr_dif;
5574                 if (fdp->fd_type == FRD_DSTLIST)
5575                         ipf_lookup_deref(softc, IPLT_DSTLIST, fdp->fd_ptr);
5576
5577                 if ((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF &&
5578                     fr->fr_satype == FRI_LOOKUP)
5579                         ipf_lookup_deref(softc, fr->fr_srctype, fr->fr_srcptr);
5580                 if ((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF &&
5581                     fr->fr_datype == FRI_LOOKUP)
5582                         ipf_lookup_deref(softc, fr->fr_dsttype, fr->fr_dstptr);
5583
5584                 if (fr->fr_grp != NULL)
5585                         ipf_group_del(softc, fr->fr_grp, fr);
5586
5587                 if (fr->fr_grphead != NULL)
5588                         ipf_group_del(softc, fr->fr_grphead, fr);
5589
5590                 if (fr->fr_icmpgrp != NULL)
5591                         ipf_group_del(softc, fr->fr_icmpgrp, fr);
5592
5593                 if ((fr->fr_flags & FR_COPIED) != 0) {
5594                         if (fr->fr_dsize) {
5595                                 KFREES(fr->fr_data, fr->fr_dsize);
5596                         }
5597                         KFREES(fr, fr->fr_size);
5598                         return 0;
5599                 }
5600                 return 1;
5601         } else {
5602                 MUTEX_EXIT(&fr->fr_lock);
5603         }
5604         return -1;
5605 }
5606
5607
5608 /* ------------------------------------------------------------------------ */
5609 /* Function:    ipf_grpmapinit                                              */
5610 /* Returns:     int - 0 == success, else ESRCH because table entry not found*/
5611 /* Parameters:  fr(I) - pointer to rule to find hash table for              */
5612 /*                                                                          */
5613 /* Looks for group hash table fr_arg and stores a pointer to it in fr_ptr.  */
5614 /* fr_ptr is later used by ipf_srcgrpmap and ipf_dstgrpmap.                 */
5615 /* ------------------------------------------------------------------------ */
5616 static int
5617 ipf_grpmapinit(softc, fr)
5618         ipf_main_softc_t *softc;
5619         frentry_t *fr;
5620 {
5621         char name[FR_GROUPLEN];
5622         iphtable_t *iph;
5623
5624 #if defined(SNPRINTF) && defined(_KERNEL)
5625         SNPRINTF(name, sizeof(name), "%d", fr->fr_arg);
5626 #else
5627         (void) sprintf(name, "%d", fr->fr_arg);
5628 #endif
5629         iph = ipf_lookup_find_htable(softc, IPL_LOGIPF, name);
5630         if (iph == NULL) {
5631                 IPFERROR(38);
5632                 return ESRCH;
5633         }
5634         if ((iph->iph_flags & FR_INOUT) != (fr->fr_flags & FR_INOUT)) {
5635                 IPFERROR(39);
5636                 return ESRCH;
5637         }
5638         iph->iph_ref++;
5639         fr->fr_ptr = iph;
5640         return 0;
5641 }
5642
5643
5644 /* ------------------------------------------------------------------------ */
5645 /* Function:    ipf_grpmapfini                                              */
5646 /* Returns:     int - 0 == success, else ESRCH because table entry not found*/
5647 /* Parameters:  softc(I) - pointer to soft context main structure           */
5648 /*              fr(I)    - pointer to rule to release hash table for        */
5649 /*                                                                          */
5650 /* For rules that have had ipf_grpmapinit called, ipf_lookup_deref needs to */
5651 /* be called to undo what ipf_grpmapinit caused to be done.                 */
5652 /* ------------------------------------------------------------------------ */
5653 static int
5654 ipf_grpmapfini(softc, fr)
5655         ipf_main_softc_t *softc;
5656         frentry_t *fr;
5657 {
5658         iphtable_t *iph;
5659         iph = fr->fr_ptr;
5660         if (iph != NULL)
5661                 ipf_lookup_deref(softc, IPLT_HASH, iph);
5662         return 0;
5663 }
5664
5665
5666 /* ------------------------------------------------------------------------ */
5667 /* Function:    ipf_srcgrpmap                                               */
5668 /* Returns:     frentry_t * - pointer to "new last matching" rule or NULL   */
5669 /* Parameters:  fin(I)    - pointer to packet information                   */
5670 /*              passp(IO) - pointer to current/new filter decision (unused) */
5671 /*                                                                          */
5672 /* Look for a rule group head in a hash table, using the source address as  */
5673 /* the key, and descend into that group and continue matching rules against */
5674 /* the packet.                                                              */
5675 /* ------------------------------------------------------------------------ */
5676 frentry_t *
5677 ipf_srcgrpmap(fin, passp)
5678         fr_info_t *fin;
5679         u_32_t *passp;
5680 {
5681         frgroup_t *fg;
5682         void *rval;
5683
5684         rval = ipf_iphmfindgroup(fin->fin_main_soft, fin->fin_fr->fr_ptr,
5685                                  &fin->fin_src);
5686         if (rval == NULL)
5687                 return NULL;
5688
5689         fg = rval;
5690         fin->fin_fr = fg->fg_start;
5691         (void) ipf_scanlist(fin, *passp);
5692         return fin->fin_fr;
5693 }
5694
5695
5696 /* ------------------------------------------------------------------------ */
5697 /* Function:    ipf_dstgrpmap                                               */
5698 /* Returns:     frentry_t * - pointer to "new last matching" rule or NULL   */
5699 /* Parameters:  fin(I)    - pointer to packet information                   */
5700 /*              passp(IO) - pointer to current/new filter decision (unused) */
5701 /*                                                                          */
5702 /* Look for a rule group head in a hash table, using the destination        */
5703 /* address as the key, and descend into that group and continue matching    */
5704 /* rules against  the packet.                                               */
5705 /* ------------------------------------------------------------------------ */
5706 frentry_t *
5707 ipf_dstgrpmap(fin, passp)
5708         fr_info_t *fin;
5709         u_32_t *passp;
5710 {
5711         frgroup_t *fg;
5712         void *rval;
5713
5714         rval = ipf_iphmfindgroup(fin->fin_main_soft, fin->fin_fr->fr_ptr,
5715                                  &fin->fin_dst);
5716         if (rval == NULL)
5717                 return NULL;
5718
5719         fg = rval;
5720         fin->fin_fr = fg->fg_start;
5721         (void) ipf_scanlist(fin, *passp);
5722         return fin->fin_fr;
5723 }
5724
5725 /*
5726  * Queue functions
5727  * ===============
5728  * These functions manage objects on queues for efficient timeouts.  There
5729  * are a number of system defined queues as well as user defined timeouts.
5730  * It is expected that a lock is held in the domain in which the queue
5731  * belongs (i.e. either state or NAT) when calling any of these functions
5732  * that prevents ipf_freetimeoutqueue() from being called at the same time
5733  * as any other.
5734  */
5735
5736
5737 /* ------------------------------------------------------------------------ */
5738 /* Function:    ipf_addtimeoutqueue                                         */
5739 /* Returns:     struct ifqtq * - NULL if malloc fails, else pointer to      */
5740 /*                               timeout queue with given interval.         */
5741 /* Parameters:  parent(I)  - pointer to pointer to parent node of this list */
5742 /*                           of interface queues.                           */
5743 /*              seconds(I) - timeout value in seconds for this queue.       */
5744 /*                                                                          */
5745 /* This routine first looks for a timeout queue that matches the interval   */
5746 /* being requested.  If it finds one, increments the reference counter and  */
5747 /* returns a pointer to it.  If none are found, it allocates a new one and  */
5748 /* inserts it at the top of the list.                                       */
5749 /*                                                                          */
5750 /* Locking.                                                                 */
5751 /* It is assumed that the caller of this function has an appropriate lock   */
5752 /* held (exclusively) in the domain that encompases 'parent'.               */
5753 /* ------------------------------------------------------------------------ */
5754 ipftq_t *
5755 ipf_addtimeoutqueue(softc, parent, seconds)
5756         ipf_main_softc_t *softc;
5757         ipftq_t **parent;
5758         u_int seconds;
5759 {
5760         ipftq_t *ifq;
5761         u_int period;
5762
5763         period = seconds * IPF_HZ_DIVIDE;
5764
5765         MUTEX_ENTER(&softc->ipf_timeoutlock);
5766         for (ifq = *parent; ifq != NULL; ifq = ifq->ifq_next) {
5767                 if (ifq->ifq_ttl == period) {
5768                         /*
5769                          * Reset the delete flag, if set, so the structure
5770                          * gets reused rather than freed and reallocated.
5771                          */
5772                         MUTEX_ENTER(&ifq->ifq_lock);
5773                         ifq->ifq_flags &= ~IFQF_DELETE;
5774                         ifq->ifq_ref++;
5775                         MUTEX_EXIT(&ifq->ifq_lock);
5776                         MUTEX_EXIT(&softc->ipf_timeoutlock);
5777
5778                         return ifq;
5779                 }
5780         }
5781
5782         KMALLOC(ifq, ipftq_t *);
5783         if (ifq != NULL) {
5784                 MUTEX_NUKE(&ifq->ifq_lock);
5785                 IPFTQ_INIT(ifq, period, "ipftq mutex");
5786                 ifq->ifq_next = *parent;
5787                 ifq->ifq_pnext = parent;
5788                 ifq->ifq_flags = IFQF_USER;
5789                 ifq->ifq_ref++;
5790                 *parent = ifq;
5791                 softc->ipf_userifqs++;
5792         }
5793         MUTEX_EXIT(&softc->ipf_timeoutlock);
5794         return ifq;
5795 }
5796
5797
5798 /* ------------------------------------------------------------------------ */
5799 /* Function:    ipf_deletetimeoutqueue                                      */
5800 /* Returns:     int    - new reference count value of the timeout queue     */
5801 /* Parameters:  ifq(I) - timeout queue which is losing a reference.         */
5802 /* Locks:       ifq->ifq_lock                                               */
5803 /*                                                                          */
5804 /* This routine must be called when we're discarding a pointer to a timeout */
5805 /* queue object, taking care of the reference counter.                      */
5806 /*                                                                          */
5807 /* Now that this just sets a DELETE flag, it requires the expire code to    */
5808 /* check the list of user defined timeout queues and call the free function */
5809 /* below (currently commented out) to stop memory leaking.  It is done this */
5810 /* way because the locking may not be sufficient to safely do a free when   */
5811 /* this function is called.                                                 */
5812 /* ------------------------------------------------------------------------ */
5813 int
5814 ipf_deletetimeoutqueue(ifq)
5815         ipftq_t *ifq;
5816 {
5817
5818         ifq->ifq_ref--;
5819         if ((ifq->ifq_ref == 0) && ((ifq->ifq_flags & IFQF_USER) != 0)) {
5820                 ifq->ifq_flags |= IFQF_DELETE;
5821         }
5822
5823         return ifq->ifq_ref;
5824 }
5825
5826
5827 /* ------------------------------------------------------------------------ */
5828 /* Function:    ipf_freetimeoutqueue                                        */
5829 /* Parameters:  ifq(I) - timeout queue which is losing a reference.         */
5830 /* Returns:     Nil                                                         */
5831 /*                                                                          */
5832 /* Locking:                                                                 */
5833 /* It is assumed that the caller of this function has an appropriate lock   */
5834 /* held (exclusively) in the domain that encompases the callers "domain".   */
5835 /* The ifq_lock for this structure should not be held.                      */
5836 /*                                                                          */
5837 /* Remove a user defined timeout queue from the list of queues it is in and */
5838 /* tidy up after this is done.                                              */
5839 /* ------------------------------------------------------------------------ */
5840 void
5841 ipf_freetimeoutqueue(softc, ifq)
5842         ipf_main_softc_t *softc;
5843         ipftq_t *ifq;
5844 {
5845
5846         if (((ifq->ifq_flags & IFQF_DELETE) == 0) || (ifq->ifq_ref != 0) ||
5847             ((ifq->ifq_flags & IFQF_USER) == 0)) {
5848                 printf("ipf_freetimeoutqueue(%lx) flags 0x%x ttl %d ref %d\n",
5849                        (u_long)ifq, ifq->ifq_flags, ifq->ifq_ttl,
5850                        ifq->ifq_ref);
5851                 return;
5852         }
5853
5854         /*
5855          * Remove from its position in the list.
5856          */
5857         *ifq->ifq_pnext = ifq->ifq_next;
5858         if (ifq->ifq_next != NULL)
5859                 ifq->ifq_next->ifq_pnext = ifq->ifq_pnext;
5860         ifq->ifq_next = NULL;
5861         ifq->ifq_pnext = NULL;
5862
5863         MUTEX_DESTROY(&ifq->ifq_lock);
5864         ATOMIC_DEC(softc->ipf_userifqs);
5865         KFREE(ifq);
5866 }
5867
5868
5869 /* ------------------------------------------------------------------------ */
5870 /* Function:    ipf_deletequeueentry                                        */
5871 /* Returns:     Nil                                                         */
5872 /* Parameters:  tqe(I) - timeout queue entry to delete                      */
5873 /*                                                                          */
5874 /* Remove a tail queue entry from its queue and make it an orphan.          */
5875 /* ipf_deletetimeoutqueue is called to make sure the reference count on the */
5876 /* queue is correct.  We can't, however, call ipf_freetimeoutqueue because  */
5877 /* the correct lock(s) may not be held that would make it safe to do so.    */
5878 /* ------------------------------------------------------------------------ */
5879 void
5880 ipf_deletequeueentry(tqe)
5881         ipftqent_t *tqe;
5882 {
5883         ipftq_t *ifq;
5884
5885         ifq = tqe->tqe_ifq;
5886
5887         MUTEX_ENTER(&ifq->ifq_lock);
5888
5889         if (tqe->tqe_pnext != NULL) {
5890                 *tqe->tqe_pnext = tqe->tqe_next;
5891                 if (tqe->tqe_next != NULL)
5892                         tqe->tqe_next->tqe_pnext = tqe->tqe_pnext;
5893                 else    /* we must be the tail anyway */
5894                         ifq->ifq_tail = tqe->tqe_pnext;
5895
5896                 tqe->tqe_pnext = NULL;
5897                 tqe->tqe_ifq = NULL;
5898         }
5899
5900         (void) ipf_deletetimeoutqueue(ifq);
5901         ASSERT(ifq->ifq_ref > 0);
5902
5903         MUTEX_EXIT(&ifq->ifq_lock);
5904 }
5905
5906
5907 /* ------------------------------------------------------------------------ */
5908 /* Function:    ipf_queuefront                                              */
5909 /* Returns:     Nil                                                         */
5910 /* Parameters:  tqe(I) - pointer to timeout queue entry                     */
5911 /*                                                                          */
5912 /* Move a queue entry to the front of the queue, if it isn't already there. */
5913 /* ------------------------------------------------------------------------ */
5914 void
5915 ipf_queuefront(tqe)
5916         ipftqent_t *tqe;
5917 {
5918         ipftq_t *ifq;
5919
5920         ifq = tqe->tqe_ifq;
5921         if (ifq == NULL)
5922                 return;
5923
5924         MUTEX_ENTER(&ifq->ifq_lock);
5925         if (ifq->ifq_head != tqe) {
5926                 *tqe->tqe_pnext = tqe->tqe_next;
5927                 if (tqe->tqe_next)
5928                         tqe->tqe_next->tqe_pnext = tqe->tqe_pnext;
5929                 else
5930                         ifq->ifq_tail = tqe->tqe_pnext;
5931
5932                 tqe->tqe_next = ifq->ifq_head;
5933                 ifq->ifq_head->tqe_pnext = &tqe->tqe_next;
5934                 ifq->ifq_head = tqe;
5935                 tqe->tqe_pnext = &ifq->ifq_head;
5936         }
5937         MUTEX_EXIT(&ifq->ifq_lock);
5938 }
5939
5940
5941 /* ------------------------------------------------------------------------ */
5942 /* Function:    ipf_queueback                                               */
5943 /* Returns:     Nil                                                         */
5944 /* Parameters:  ticks(I) - ipf tick time to use with this call              */
5945 /*              tqe(I)   - pointer to timeout queue entry                   */
5946 /*                                                                          */
5947 /* Move a queue entry to the back of the queue, if it isn't already there.  */
5948 /* We use use ticks to calculate the expiration and mark for when we last   */
5949 /* touched the structure.                                                   */
5950 /* ------------------------------------------------------------------------ */
5951 void
5952 ipf_queueback(ticks, tqe)
5953         u_long ticks;
5954         ipftqent_t *tqe;
5955 {
5956         ipftq_t *ifq;
5957
5958         ifq = tqe->tqe_ifq;
5959         if (ifq == NULL)
5960                 return;
5961         tqe->tqe_die = ticks + ifq->ifq_ttl;
5962         tqe->tqe_touched = ticks;
5963
5964         MUTEX_ENTER(&ifq->ifq_lock);
5965         if (tqe->tqe_next != NULL) {            /* at the end already ? */
5966                 /*
5967                  * Remove from list
5968                  */
5969                 *tqe->tqe_pnext = tqe->tqe_next;
5970                 tqe->tqe_next->tqe_pnext = tqe->tqe_pnext;
5971
5972                 /*
5973                  * Make it the last entry.
5974                  */
5975                 tqe->tqe_next = NULL;
5976                 tqe->tqe_pnext = ifq->ifq_tail;
5977                 *ifq->ifq_tail = tqe;
5978                 ifq->ifq_tail = &tqe->tqe_next;
5979         }
5980         MUTEX_EXIT(&ifq->ifq_lock);
5981 }
5982
5983
5984 /* ------------------------------------------------------------------------ */
5985 /* Function:    ipf_queueappend                                             */
5986 /* Returns:     Nil                                                         */
5987 /* Parameters:  ticks(I)  - ipf tick time to use with this call             */
5988 /*              tqe(I)    - pointer to timeout queue entry                  */
5989 /*              ifq(I)    - pointer to timeout queue                        */
5990 /*              parent(I) - owing object pointer                            */
5991 /*                                                                          */
5992 /* Add a new item to this queue and put it on the very end.                 */
5993 /* We use use ticks to calculate the expiration and mark for when we last   */
5994 /* touched the structure.                                                   */
5995 /* ------------------------------------------------------------------------ */
5996 void
5997 ipf_queueappend(ticks, tqe, ifq, parent)
5998         u_long ticks;
5999         ipftqent_t *tqe;
6000         ipftq_t *ifq;
6001         void *parent;
6002 {
6003
6004         MUTEX_ENTER(&ifq->ifq_lock);
6005         tqe->tqe_parent = parent;
6006         tqe->tqe_pnext = ifq->ifq_tail;
6007         *ifq->ifq_tail = tqe;
6008         ifq->ifq_tail = &tqe->tqe_next;
6009         tqe->tqe_next = NULL;
6010         tqe->tqe_ifq = ifq;
6011         tqe->tqe_die = ticks + ifq->ifq_ttl;
6012         tqe->tqe_touched = ticks;
6013         ifq->ifq_ref++;
6014         MUTEX_EXIT(&ifq->ifq_lock);
6015 }
6016
6017
6018 /* ------------------------------------------------------------------------ */
6019 /* Function:    ipf_movequeue                                               */
6020 /* Returns:     Nil                                                         */
6021 /* Parameters:  tq(I)   - pointer to timeout queue information              */
6022 /*              oifp(I) - old timeout queue entry was on                    */
6023 /*              nifp(I) - new timeout queue to put entry on                 */
6024 /*                                                                          */
6025 /* Move a queue entry from one timeout queue to another timeout queue.      */
6026 /* If it notices that the current entry is already last and does not need   */
6027 /* to move queue, the return.                                               */
6028 /* ------------------------------------------------------------------------ */
6029 void
6030 ipf_movequeue(ticks, tqe, oifq, nifq)
6031         u_long ticks;
6032         ipftqent_t *tqe;
6033         ipftq_t *oifq, *nifq;
6034 {
6035
6036         /*
6037          * If the queue hasn't changed and we last touched this entry at the
6038          * same ipf time, then we're not going to achieve anything by either
6039          * changing the ttl or moving it on the queue.
6040          */
6041         if (oifq == nifq && tqe->tqe_touched == ticks)
6042                 return;
6043
6044         /*
6045          * For any of this to be outside the lock, there is a risk that two
6046          * packets entering simultaneously, with one changing to a different
6047          * queue and one not, could end up with things in a bizarre state.
6048          */
6049         MUTEX_ENTER(&oifq->ifq_lock);
6050
6051         tqe->tqe_touched = ticks;
6052         tqe->tqe_die = ticks + nifq->ifq_ttl;
6053         /*
6054          * Is the operation here going to be a no-op ?
6055          */
6056         if (oifq == nifq) {
6057                 if ((tqe->tqe_next == NULL) ||
6058                     (tqe->tqe_next->tqe_die == tqe->tqe_die)) {
6059                         MUTEX_EXIT(&oifq->ifq_lock);
6060                         return;
6061                 }
6062         }
6063
6064         /*
6065          * Remove from the old queue
6066          */
6067         *tqe->tqe_pnext = tqe->tqe_next;
6068         if (tqe->tqe_next)
6069                 tqe->tqe_next->tqe_pnext = tqe->tqe_pnext;
6070         else
6071                 oifq->ifq_tail = tqe->tqe_pnext;
6072         tqe->tqe_next = NULL;
6073
6074         /*
6075          * If we're moving from one queue to another, release the
6076          * lock on the old queue and get a lock on the new queue.
6077          * For user defined queues, if we're moving off it, call
6078          * delete in case it can now be freed.
6079          */
6080         if (oifq != nifq) {
6081                 tqe->tqe_ifq = NULL;
6082
6083                 (void) ipf_deletetimeoutqueue(oifq);
6084
6085                 MUTEX_EXIT(&oifq->ifq_lock);
6086
6087                 MUTEX_ENTER(&nifq->ifq_lock);
6088
6089                 tqe->tqe_ifq = nifq;
6090                 nifq->ifq_ref++;
6091         }
6092
6093         /*
6094          * Add to the bottom of the new queue
6095          */
6096         tqe->tqe_pnext = nifq->ifq_tail;
6097         *nifq->ifq_tail = tqe;
6098         nifq->ifq_tail = &tqe->tqe_next;
6099         MUTEX_EXIT(&nifq->ifq_lock);
6100 }
6101
6102
6103 /* ------------------------------------------------------------------------ */
6104 /* Function:    ipf_updateipid                                              */
6105 /* Returns:     int - 0 == success, -1 == error (packet should be droppped) */
6106 /* Parameters:  fin(I) - pointer to packet information                      */
6107 /*                                                                          */
6108 /* When we are doing NAT, change the IP of every packet to represent a      */
6109 /* single sequence of packets coming from the host, hiding any host         */
6110 /* specific sequencing that might otherwise be revealed.  If the packet is  */
6111 /* a fragment, then store the 'new' IPid in the fragment cache and look up  */
6112 /* the fragment cache for non-leading fragments.  If a non-leading fragment */
6113 /* has no match in the cache, return an error.                              */
6114 /* ------------------------------------------------------------------------ */
6115 static int
6116 ipf_updateipid(fin)
6117         fr_info_t *fin;
6118 {
6119         u_short id, ido, sums;
6120         u_32_t sumd, sum;
6121         ip_t *ip;
6122
6123         ip = fin->fin_ip;
6124         ido = ntohs(ip->ip_id);
6125         if (fin->fin_off != 0) {
6126                 sum = ipf_frag_ipidknown(fin);
6127                 if (sum == 0xffffffff)
6128                         return -1;
6129                 sum &= 0xffff;
6130                 id = (u_short)sum;
6131                 ip->ip_id = htons(id);
6132         } else {
6133                 ip_fillid(ip);
6134                 id = ntohs(ip->ip_id);
6135                 if ((fin->fin_flx & FI_FRAG) != 0)
6136                         (void) ipf_frag_ipidnew(fin, (u_32_t)id);
6137         }
6138
6139         if (id == ido)
6140                 return 0;
6141         CALC_SUMD(ido, id, sumd);       /* DESTRUCTIVE MACRO! id,ido change */
6142         sum = (~ntohs(ip->ip_sum)) & 0xffff;
6143         sum += sumd;
6144         sum = (sum >> 16) + (sum & 0xffff);
6145         sum = (sum >> 16) + (sum & 0xffff);
6146         sums = ~(u_short)sum;
6147         ip->ip_sum = htons(sums);
6148         return 0;
6149 }
6150
6151
6152 #ifdef  NEED_FRGETIFNAME
6153 /* ------------------------------------------------------------------------ */
6154 /* Function:    ipf_getifname                                               */
6155 /* Returns:     char *    - pointer to interface name                       */
6156 /* Parameters:  ifp(I)    - pointer to network interface                    */
6157 /*              buffer(O) - pointer to where to store interface name        */
6158 /*                                                                          */
6159 /* Constructs an interface name in the buffer passed.  The buffer passed is */
6160 /* expected to be at least LIFNAMSIZ in bytes big.  If buffer is passed in  */
6161 /* as a NULL pointer then return a pointer to a static array.               */
6162 /* ------------------------------------------------------------------------ */
6163 char *
6164 ipf_getifname(ifp, buffer)
6165         struct ifnet *ifp;
6166         char *buffer;
6167 {
6168         static char namebuf[LIFNAMSIZ];
6169 # if defined(MENTAT) || defined(__FreeBSD__) || defined(__osf__) || \
6170      defined(__sgi) || defined(linux) || defined(_AIX51) || \
6171      (defined(sun) && !defined(__SVR4) && !defined(__svr4__))
6172         int unit, space;
6173         char temp[20];
6174         char *s;
6175 # endif
6176
6177         if (buffer == NULL)
6178                 buffer = namebuf;
6179         (void) strncpy(buffer, ifp->if_name, LIFNAMSIZ);
6180         buffer[LIFNAMSIZ - 1] = '\0';
6181 # if defined(MENTAT) || defined(__FreeBSD__) || defined(__osf__) || \
6182      defined(__sgi) || defined(_AIX51) || \
6183      (defined(sun) && !defined(__SVR4) && !defined(__svr4__))
6184         for (s = buffer; *s; s++)
6185                 ;
6186         unit = ifp->if_unit;
6187         space = LIFNAMSIZ - (s - buffer);
6188         if ((space > 0) && (unit >= 0)) {
6189 #  if defined(SNPRINTF) && defined(_KERNEL)
6190                 SNPRINTF(temp, sizeof(temp), "%d", unit);
6191 #  else
6192                 (void) sprintf(temp, "%d", unit);
6193 #  endif
6194                 (void) strncpy(s, temp, space);
6195         }
6196 # endif
6197         return buffer;
6198 }
6199 #endif
6200
6201
6202 /* ------------------------------------------------------------------------ */
6203 /* Function:    ipf_ioctlswitch                                             */
6204 /* Returns:     int     - -1 continue processing, else ioctl return value   */
6205 /* Parameters:  unit(I) - device unit opened                                */
6206 /*              data(I) - pointer to ioctl data                             */
6207 /*              cmd(I)  - ioctl command                                     */
6208 /*              mode(I) - mode value                                        */
6209 /*              uid(I)  - uid making the ioctl call                         */
6210 /*              ctx(I)  - pointer to context data                           */
6211 /*                                                                          */
6212 /* Based on the value of unit, call the appropriate ioctl handler or return */
6213 /* EIO if ipfilter is not running.   Also checks if write perms are req'd   */
6214 /* for the device in order to execute the ioctl.  A special case is made    */
6215 /* SIOCIPFINTERROR so that the same code isn't required in every handler.   */
6216 /* The context data pointer is passed through as this is used as the key    */
6217 /* for locating a matching token for continued access for walking lists,    */
6218 /* etc.                                                                     */
6219 /* ------------------------------------------------------------------------ */
6220 int
6221 ipf_ioctlswitch(softc, unit, data, cmd, mode, uid, ctx)
6222         ipf_main_softc_t *softc;
6223         int unit, mode, uid;
6224         ioctlcmd_t cmd;
6225         void *data, *ctx;
6226 {
6227         int error = 0;
6228
6229         switch (cmd)
6230         {
6231         case SIOCIPFINTERROR :
6232                 error = BCOPYOUT(&softc->ipf_interror, data,
6233                                  sizeof(softc->ipf_interror));
6234                 if (error != 0) {
6235                         IPFERROR(40);
6236                         error = EFAULT;
6237                 }
6238                 return error;
6239         default :
6240                 break;
6241         }
6242
6243         switch (unit)
6244         {
6245         case IPL_LOGIPF :
6246                 error = ipf_ipf_ioctl(softc, data, cmd, mode, uid, ctx);
6247                 break;
6248         case IPL_LOGNAT :
6249                 if (softc->ipf_running > 0) {
6250                         error = ipf_nat_ioctl(softc, data, cmd, mode,
6251                                               uid, ctx);
6252                 } else {
6253                         IPFERROR(42);
6254                         error = EIO;
6255                 }
6256                 break;
6257         case IPL_LOGSTATE :
6258                 if (softc->ipf_running > 0) {
6259                         error = ipf_state_ioctl(softc, data, cmd, mode,
6260                                                 uid, ctx);
6261                 } else {
6262                         IPFERROR(43);
6263                         error = EIO;
6264                 }
6265                 break;
6266         case IPL_LOGAUTH :
6267                 if (softc->ipf_running > 0) {
6268                         error = ipf_auth_ioctl(softc, data, cmd, mode,
6269                                                uid, ctx);
6270                 } else {
6271                         IPFERROR(44);
6272                         error = EIO;
6273                 }
6274                 break;
6275         case IPL_LOGSYNC :
6276                 if (softc->ipf_running > 0) {
6277                         error = ipf_sync_ioctl(softc, data, cmd, mode,
6278                                                uid, ctx);
6279                 } else {
6280                         error = EIO;
6281                         IPFERROR(45);
6282                 }
6283                 break;
6284         case IPL_LOGSCAN :
6285 #ifdef IPFILTER_SCAN
6286                 if (softc->ipf_running > 0)
6287                         error = ipf_scan_ioctl(softc, data, cmd, mode,
6288                                                uid, ctx);
6289                 else
6290 #endif
6291                 {
6292                         error = EIO;
6293                         IPFERROR(46);
6294                 }
6295                 break;
6296         case IPL_LOGLOOKUP :
6297                 if (softc->ipf_running > 0) {
6298                         error = ipf_lookup_ioctl(softc, data, cmd, mode,
6299                                                  uid, ctx);
6300                 } else {
6301                         error = EIO;
6302                         IPFERROR(47);
6303                 }
6304                 break;
6305         default :
6306                 IPFERROR(48);
6307                 error = EIO;
6308                 break;
6309         }
6310
6311         return error;
6312 }
6313
6314
6315 /*
6316  * This array defines the expected size of objects coming into the kernel
6317  * for the various recognised object types. The first column is flags (see
6318  * below), 2nd column is current size, 3rd column is the version number of
6319  * when the current size became current.
6320  * Flags:
6321  * 1 = minimum size, not absolute size
6322  */
6323 static  int     ipf_objbytes[IPFOBJ_COUNT][3] = {
6324         { 1,    sizeof(struct frentry),         5010000 },      /* 0 */
6325         { 1,    sizeof(struct friostat),        5010000 },
6326         { 0,    sizeof(struct fr_info),         5010000 },
6327         { 0,    sizeof(struct ipf_authstat),    4010100 },
6328         { 0,    sizeof(struct ipfrstat),        5010000 },
6329         { 1,    sizeof(struct ipnat),           5010000 },      /* 5 */
6330         { 0,    sizeof(struct natstat),         5010000 },
6331         { 0,    sizeof(struct ipstate_save),    5010000 },
6332         { 1,    sizeof(struct nat_save),        5010000 },
6333         { 0,    sizeof(struct natlookup),       5010000 },
6334         { 1,    sizeof(struct ipstate),         5010000 },      /* 10 */
6335         { 0,    sizeof(struct ips_stat),        5010000 },
6336         { 0,    sizeof(struct frauth),          5010000 },
6337         { 0,    sizeof(struct ipftune),         4010100 },
6338         { 0,    sizeof(struct nat),             5010000 },
6339         { 0,    sizeof(struct ipfruleiter),     4011400 },      /* 15 */
6340         { 0,    sizeof(struct ipfgeniter),      4011400 },
6341         { 0,    sizeof(struct ipftable),        4011400 },
6342         { 0,    sizeof(struct ipflookupiter),   4011400 },
6343         { 0,    sizeof(struct ipftq) * IPF_TCP_NSTATES },
6344         { 1,    0,                              0       }, /* IPFEXPR */
6345         { 0,    0,                              0       }, /* PROXYCTL */
6346         { 0,    sizeof (struct fripf),          5010000 }
6347 };
6348
6349
6350 /* ------------------------------------------------------------------------ */
6351 /* Function:    ipf_inobj                                                   */
6352 /* Returns:     int     - 0 = success, else failure                         */
6353 /* Parameters:  softc(I) - soft context pointerto work with                 */
6354 /*              data(I)  - pointer to ioctl data                            */
6355 /*              objp(O)  - where to store ipfobj structure                  */
6356 /*              ptr(I)   - pointer to data to copy out                      */
6357 /*              type(I)  - type of structure being moved                    */
6358 /*                                                                          */
6359 /* Copy in the contents of what the ipfobj_t points to.  In future, we      */
6360 /* add things to check for version numbers, sizes, etc, to make it backward */
6361 /* compatible at the ABI for user land.                                     */
6362 /* If objp is not NULL then we assume that the caller wants to see what is  */
6363 /* in the ipfobj_t structure being copied in. As an example, this can tell  */
6364 /* the caller what version of ipfilter the ioctl program was written to.    */
6365 /* ------------------------------------------------------------------------ */
6366 int
6367 ipf_inobj(softc, data, objp, ptr, type)
6368         ipf_main_softc_t *softc;
6369         void *data;
6370         ipfobj_t *objp;
6371         void *ptr;
6372         int type;
6373 {
6374         ipfobj_t obj;
6375         int error;
6376         int size;
6377
6378         if ((type < 0) || (type >= IPFOBJ_COUNT)) {
6379                 IPFERROR(49);
6380                 return EINVAL;
6381         }
6382
6383         if (objp == NULL)
6384                 objp = &obj;
6385         error = BCOPYIN(data, objp, sizeof(*objp));
6386         if (error != 0) {
6387                 IPFERROR(124);
6388                 return EFAULT;
6389         }
6390
6391         if (objp->ipfo_type != type) {
6392                 IPFERROR(50);
6393                 return EINVAL;
6394         }
6395
6396         if (objp->ipfo_rev >= ipf_objbytes[type][2]) {
6397                 if ((ipf_objbytes[type][0] & 1) != 0) {
6398                         if (objp->ipfo_size < ipf_objbytes[type][1]) {
6399                                 IPFERROR(51);
6400                                 return EINVAL;
6401                         }
6402                         size =  ipf_objbytes[type][1];
6403                 } else if (objp->ipfo_size == ipf_objbytes[type][1]) {
6404                         size =  objp->ipfo_size;
6405                 } else {
6406                         IPFERROR(52);
6407                         return EINVAL;
6408                 }
6409                 error = COPYIN(objp->ipfo_ptr, ptr, size);
6410                 if (error != 0) {
6411                         IPFERROR(55);
6412                         error = EFAULT;
6413                 }
6414         } else {
6415 #ifdef  IPFILTER_COMPAT
6416                 error = ipf_in_compat(softc, objp, ptr, 0);
6417 #else
6418                 IPFERROR(54);
6419                 error = EINVAL;
6420 #endif
6421         }
6422         return error;
6423 }
6424
6425
6426 /* ------------------------------------------------------------------------ */
6427 /* Function:    ipf_inobjsz                                                 */
6428 /* Returns:     int     - 0 = success, else failure                         */
6429 /* Parameters:  softc(I) - soft context pointerto work with                 */
6430 /*              data(I)  - pointer to ioctl data                            */
6431 /*              ptr(I)   - pointer to store real data in                    */
6432 /*              type(I)  - type of structure being moved                    */
6433 /*              sz(I)    - size of data to copy                             */
6434 /*                                                                          */
6435 /* As per ipf_inobj, except the size of the object to copy in is passed in  */
6436 /* but it must not be smaller than the size defined for the type and the    */
6437 /* type must allow for varied sized objects.  The extra requirement here is */
6438 /* that sz must match the size of the object being passed in - this is not  */
6439 /* not possible nor required in ipf_inobj().                                */
6440 /* ------------------------------------------------------------------------ */
6441 int
6442 ipf_inobjsz(softc, data, ptr, type, sz)
6443         ipf_main_softc_t *softc;
6444         void *data;
6445         void *ptr;
6446         int type, sz;
6447 {
6448         ipfobj_t obj;
6449         int error;
6450
6451         if ((type < 0) || (type >= IPFOBJ_COUNT)) {
6452                 IPFERROR(56);
6453                 return EINVAL;
6454         }
6455
6456         error = BCOPYIN(data, &obj, sizeof(obj));
6457         if (error != 0) {
6458                 IPFERROR(125);
6459                 return EFAULT;
6460         }
6461
6462         if (obj.ipfo_type != type) {
6463                 IPFERROR(58);
6464                 return EINVAL;
6465         }
6466
6467         if (obj.ipfo_rev >= ipf_objbytes[type][2]) {
6468                 if (((ipf_objbytes[type][0] & 1) == 0) ||
6469                     (sz < ipf_objbytes[type][1])) {
6470                         IPFERROR(57);
6471                         return EINVAL;
6472                 }
6473                 error = COPYIN(obj.ipfo_ptr, ptr, sz);
6474                 if (error != 0) {
6475                         IPFERROR(61);
6476                         error = EFAULT;
6477                 }
6478         } else {
6479 #ifdef  IPFILTER_COMPAT
6480                 error = ipf_in_compat(softc, &obj, ptr, sz);
6481 #else
6482                 IPFERROR(60);
6483                 error = EINVAL;
6484 #endif
6485         }
6486         return error;
6487 }
6488
6489
6490 /* ------------------------------------------------------------------------ */
6491 /* Function:    ipf_outobjsz                                                */
6492 /* Returns:     int     - 0 = success, else failure                         */
6493 /* Parameters:  data(I) - pointer to ioctl data                             */
6494 /*              ptr(I)  - pointer to store real data in                     */
6495 /*              type(I) - type of structure being moved                     */
6496 /*              sz(I)   - size of data to copy                              */
6497 /*                                                                          */
6498 /* As per ipf_outobj, except the size of the object to copy out is passed in*/
6499 /* but it must not be smaller than the size defined for the type and the    */
6500 /* type must allow for varied sized objects.  The extra requirement here is */
6501 /* that sz must match the size of the object being passed in - this is not  */
6502 /* not possible nor required in ipf_outobj().                               */
6503 /* ------------------------------------------------------------------------ */
6504 int
6505 ipf_outobjsz(softc, data, ptr, type, sz)
6506         ipf_main_softc_t *softc;
6507         void *data;
6508         void *ptr;
6509         int type, sz;
6510 {
6511         ipfobj_t obj;
6512         int error;
6513
6514         if ((type < 0) || (type >= IPFOBJ_COUNT)) {
6515                 IPFERROR(62);
6516                 return EINVAL;
6517         }
6518
6519         error = BCOPYIN(data, &obj, sizeof(obj));
6520         if (error != 0) {
6521                 IPFERROR(127);
6522                 return EFAULT;
6523         }
6524
6525         if (obj.ipfo_type != type) {
6526                 IPFERROR(63);
6527                 return EINVAL;
6528         }
6529
6530         if (obj.ipfo_rev >= ipf_objbytes[type][2]) {
6531                 if (((ipf_objbytes[type][0] & 1) == 0) ||
6532                     (sz < ipf_objbytes[type][1])) {
6533                         IPFERROR(146);
6534                         return EINVAL;
6535                 }
6536                 error = COPYOUT(ptr, obj.ipfo_ptr, sz);
6537                 if (error != 0) {
6538                         IPFERROR(66);
6539                         error = EFAULT;
6540                 }
6541         } else {
6542 #ifdef  IPFILTER_COMPAT
6543                 error = ipf_out_compat(softc, &obj, ptr);
6544 #else
6545                 IPFERROR(65);
6546                 error = EINVAL;
6547 #endif
6548         }
6549         return error;
6550 }
6551
6552
6553 /* ------------------------------------------------------------------------ */
6554 /* Function:    ipf_outobj                                                  */
6555 /* Returns:     int     - 0 = success, else failure                         */
6556 /* Parameters:  data(I) - pointer to ioctl data                             */
6557 /*              ptr(I)  - pointer to store real data in                     */
6558 /*              type(I) - type of structure being moved                     */
6559 /*                                                                          */
6560 /* Copy out the contents of what ptr is to where ipfobj points to.  In      */
6561 /* future, we add things to check for version numbers, sizes, etc, to make  */
6562 /* it backward  compatible at the ABI for user land.                        */
6563 /* ------------------------------------------------------------------------ */
6564 int
6565 ipf_outobj(softc, data, ptr, type)
6566         ipf_main_softc_t *softc;
6567         void *data;
6568         void *ptr;
6569         int type;
6570 {
6571         ipfobj_t obj;
6572         int error;
6573
6574         if ((type < 0) || (type >= IPFOBJ_COUNT)) {
6575                 IPFERROR(67);
6576                 return EINVAL;
6577         }
6578
6579         error = BCOPYIN(data, &obj, sizeof(obj));
6580         if (error != 0) {
6581                 IPFERROR(126);
6582                 return EFAULT;
6583         }
6584
6585         if (obj.ipfo_type != type) {
6586                 IPFERROR(68);
6587                 return EINVAL;
6588         }
6589
6590         if (obj.ipfo_rev >= ipf_objbytes[type][2]) {
6591                 if ((ipf_objbytes[type][0] & 1) != 0) {
6592                         if (obj.ipfo_size < ipf_objbytes[type][1]) {
6593                                 IPFERROR(69);
6594                                 return EINVAL;
6595                         }
6596                 } else if (obj.ipfo_size != ipf_objbytes[type][1]) {
6597                         IPFERROR(70);
6598                         return EINVAL;
6599                 }
6600
6601                 error = COPYOUT(ptr, obj.ipfo_ptr, obj.ipfo_size);
6602                 if (error != 0) {
6603                         IPFERROR(73);
6604                         error = EFAULT;
6605                 }
6606         } else {
6607 #ifdef  IPFILTER_COMPAT
6608                 error = ipf_out_compat(softc, &obj, ptr);
6609 #else
6610                 IPFERROR(72);
6611                 error = EINVAL;
6612 #endif
6613         }
6614         return error;
6615 }
6616
6617
6618 /* ------------------------------------------------------------------------ */
6619 /* Function:    ipf_outobjk                                                 */
6620 /* Returns:     int     - 0 = success, else failure                         */
6621 /* Parameters:  obj(I)  - pointer to data description structure             */
6622 /*              ptr(I)  - pointer to kernel data to copy out                */
6623 /*                                                                          */
6624 /* In the above functions, the ipfobj_t structure is copied into the kernel,*/
6625 /* telling ipfilter how to copy out data. In this instance, the ipfobj_t is */
6626 /* already populated with information and now we just need to use it.       */
6627 /* There is no need for this function to have a "type" parameter as there   */
6628 /* is no point in validating information that comes from the kernel with    */
6629 /* itself.                                                                  */
6630 /* ------------------------------------------------------------------------ */
6631 int
6632 ipf_outobjk(softc, obj, ptr)
6633         ipf_main_softc_t *softc;
6634         ipfobj_t *obj;
6635         void *ptr;
6636 {
6637         int type = obj->ipfo_type;
6638         int error;
6639
6640         if ((type < 0) || (type >= IPFOBJ_COUNT)) {
6641                 IPFERROR(147);
6642                 return EINVAL;
6643         }
6644
6645         if (obj->ipfo_rev >= ipf_objbytes[type][2]) {
6646                 if ((ipf_objbytes[type][0] & 1) != 0) {
6647                         if (obj->ipfo_size < ipf_objbytes[type][1]) {
6648                                 IPFERROR(148);
6649                                 return EINVAL;
6650                         }
6651
6652                 } else if (obj->ipfo_size != ipf_objbytes[type][1]) {
6653                         IPFERROR(149);
6654                         return EINVAL;
6655                 }
6656
6657                 error = COPYOUT(ptr, obj->ipfo_ptr, obj->ipfo_size);
6658                 if (error != 0) {
6659                         IPFERROR(150);
6660                         error = EFAULT;
6661                 }
6662         } else {
6663 #ifdef  IPFILTER_COMPAT
6664                 error = ipf_out_compat(softc, obj, ptr);
6665 #else
6666                 IPFERROR(151);
6667                 error = EINVAL;
6668 #endif
6669         }
6670         return error;
6671 }
6672
6673
6674 /* ------------------------------------------------------------------------ */
6675 /* Function:    ipf_checkl4sum                                              */
6676 /* Returns:     int     - 0 = good, -1 = bad, 1 = cannot check              */
6677 /* Parameters:  fin(I) - pointer to packet information                      */
6678 /*                                                                          */
6679 /* If possible, calculate the layer 4 checksum for the packet.  If this is  */
6680 /* not possible, return without indicating a failure or success but in a    */
6681 /* way that is ditinguishable. This function should only be called by the   */
6682 /* ipf_checkv6sum() for each platform.                                      */
6683 /* ------------------------------------------------------------------------ */
6684 INLINE int
6685 ipf_checkl4sum(fin)
6686         fr_info_t *fin;
6687 {
6688         u_short sum, hdrsum, *csump;
6689         udphdr_t *udp;
6690         int dosum;
6691
6692         /*
6693          * If the TCP packet isn't a fragment, isn't too short and otherwise
6694          * isn't already considered "bad", then validate the checksum.  If
6695          * this check fails then considered the packet to be "bad".
6696          */
6697         if ((fin->fin_flx & (FI_FRAG|FI_SHORT|FI_BAD)) != 0)
6698                 return 1;
6699
6700         csump = NULL;
6701         hdrsum = 0;
6702         dosum = 0;
6703         sum = 0;
6704
6705         switch (fin->fin_p)
6706         {
6707         case IPPROTO_TCP :
6708                 csump = &((tcphdr_t *)fin->fin_dp)->th_sum;
6709                 dosum = 1;
6710                 break;
6711
6712         case IPPROTO_UDP :
6713                 udp = fin->fin_dp;
6714                 if (udp->uh_sum != 0) {
6715                         csump = &udp->uh_sum;
6716                         dosum = 1;
6717                 }
6718                 break;
6719
6720 #ifdef USE_INET6
6721         case IPPROTO_ICMPV6 :
6722                 csump = &((struct icmp6_hdr *)fin->fin_dp)->icmp6_cksum;
6723                 dosum = 1;
6724                 break;
6725 #endif
6726
6727         case IPPROTO_ICMP :
6728                 csump = &((struct icmp *)fin->fin_dp)->icmp_cksum;
6729                 dosum = 1;
6730                 break;
6731
6732         default :
6733                 return 1;
6734                 /*NOTREACHED*/
6735         }
6736
6737         if (csump != NULL)
6738                 hdrsum = *csump;
6739
6740         if (dosum) {
6741                 sum = fr_cksum(fin, fin->fin_ip, fin->fin_p, fin->fin_dp);
6742         }
6743 #if !defined(_KERNEL)
6744         if (sum == hdrsum) {
6745                 FR_DEBUG(("checkl4sum: %hx == %hx\n", sum, hdrsum));
6746         } else {
6747                 FR_DEBUG(("checkl4sum: %hx != %hx\n", sum, hdrsum));
6748         }
6749 #endif
6750         DT2(l4sums, u_short, hdrsum, u_short, sum);
6751         if (hdrsum == sum) {
6752                 fin->fin_cksum = FI_CK_SUMOK;
6753                 return 0;
6754         }
6755         fin->fin_cksum = FI_CK_BAD;
6756         return -1;
6757 }
6758
6759
6760 /* ------------------------------------------------------------------------ */
6761 /* Function:    ipf_ifpfillv4addr                                           */
6762 /* Returns:     int     - 0 = address update, -1 = address not updated      */
6763 /* Parameters:  atype(I)   - type of network address update to perform      */
6764 /*              sin(I)     - pointer to source of address information       */
6765 /*              mask(I)    - pointer to source of netmask information       */
6766 /*              inp(I)     - pointer to destination address store           */
6767 /*              inpmask(I) - pointer to destination netmask store           */
6768 /*                                                                          */
6769 /* Given a type of network address update (atype) to perform, copy          */
6770 /* information from sin/mask into inp/inpmask.  If ipnmask is NULL then no  */
6771 /* netmask update is performed unless FRI_NETMASKED is passed as atype, in  */
6772 /* which case the operation fails.  For all values of atype other than      */
6773 /* FRI_NETMASKED, if inpmask is non-NULL then the mask is set to an all 1s  */
6774 /* value.                                                                   */
6775 /* ------------------------------------------------------------------------ */
6776 int
6777 ipf_ifpfillv4addr(atype, sin, mask, inp, inpmask)
6778         int atype;
6779         struct sockaddr_in *sin, *mask;
6780         struct in_addr *inp, *inpmask;
6781 {
6782         if (inpmask != NULL && atype != FRI_NETMASKED)
6783                 inpmask->s_addr = 0xffffffff;
6784
6785         if (atype == FRI_NETWORK || atype == FRI_NETMASKED) {
6786                 if (atype == FRI_NETMASKED) {
6787                         if (inpmask == NULL)
6788                                 return -1;
6789                         inpmask->s_addr = mask->sin_addr.s_addr;
6790                 }
6791                 inp->s_addr = sin->sin_addr.s_addr & mask->sin_addr.s_addr;
6792         } else {
6793                 inp->s_addr = sin->sin_addr.s_addr;
6794         }
6795         return 0;
6796 }
6797
6798
6799 #ifdef  USE_INET6
6800 /* ------------------------------------------------------------------------ */
6801 /* Function:    ipf_ifpfillv6addr                                           */
6802 /* Returns:     int     - 0 = address update, -1 = address not updated      */
6803 /* Parameters:  atype(I)   - type of network address update to perform      */
6804 /*              sin(I)     - pointer to source of address information       */
6805 /*              mask(I)    - pointer to source of netmask information       */
6806 /*              inp(I)     - pointer to destination address store           */
6807 /*              inpmask(I) - pointer to destination netmask store           */
6808 /*                                                                          */
6809 /* Given a type of network address update (atype) to perform, copy          */
6810 /* information from sin/mask into inp/inpmask.  If ipnmask is NULL then no  */
6811 /* netmask update is performed unless FRI_NETMASKED is passed as atype, in  */
6812 /* which case the operation fails.  For all values of atype other than      */
6813 /* FRI_NETMASKED, if inpmask is non-NULL then the mask is set to an all 1s  */
6814 /* value.                                                                   */
6815 /* ------------------------------------------------------------------------ */
6816 int
6817 ipf_ifpfillv6addr(atype, sin, mask, inp, inpmask)
6818         int atype;
6819         struct sockaddr_in6 *sin, *mask;
6820         i6addr_t *inp, *inpmask;
6821 {
6822         i6addr_t *src, *and;
6823
6824         src = (i6addr_t *)&sin->sin6_addr;
6825         and = (i6addr_t *)&mask->sin6_addr;
6826
6827         if (inpmask != NULL && atype != FRI_NETMASKED) {
6828                 inpmask->i6[0] = 0xffffffff;
6829                 inpmask->i6[1] = 0xffffffff;
6830                 inpmask->i6[2] = 0xffffffff;
6831                 inpmask->i6[3] = 0xffffffff;
6832         }
6833
6834         if (atype == FRI_NETWORK || atype == FRI_NETMASKED) {
6835                 if (atype == FRI_NETMASKED) {
6836                         if (inpmask == NULL)
6837                                 return -1;
6838                         inpmask->i6[0] = and->i6[0];
6839                         inpmask->i6[1] = and->i6[1];
6840                         inpmask->i6[2] = and->i6[2];
6841                         inpmask->i6[3] = and->i6[3];
6842                 }
6843
6844                 inp->i6[0] = src->i6[0] & and->i6[0];
6845                 inp->i6[1] = src->i6[1] & and->i6[1];
6846                 inp->i6[2] = src->i6[2] & and->i6[2];
6847                 inp->i6[3] = src->i6[3] & and->i6[3];
6848         } else {
6849                 inp->i6[0] = src->i6[0];
6850                 inp->i6[1] = src->i6[1];
6851                 inp->i6[2] = src->i6[2];
6852                 inp->i6[3] = src->i6[3];
6853         }
6854         return 0;
6855 }
6856 #endif
6857
6858
6859 /* ------------------------------------------------------------------------ */
6860 /* Function:    ipf_matchtag                                                */
6861 /* Returns:     0 == mismatch, 1 == match.                                  */
6862 /* Parameters:  tag1(I) - pointer to first tag to compare                   */
6863 /*              tag2(I) - pointer to second tag to compare                  */
6864 /*                                                                          */
6865 /* Returns true (non-zero) or false(0) if the two tag structures can be     */
6866 /* considered to be a match or not match, respectively.  The tag is 16      */
6867 /* bytes long (16 characters) but that is overlayed with 4 32bit ints so    */
6868 /* compare the ints instead, for speed. tag1 is the master of the           */
6869 /* comparison.  This function should only be called with both tag1 and tag2 */
6870 /* as non-NULL pointers.                                                    */
6871 /* ------------------------------------------------------------------------ */
6872 int
6873 ipf_matchtag(tag1, tag2)
6874         ipftag_t *tag1, *tag2;
6875 {
6876         if (tag1 == tag2)
6877                 return 1;
6878
6879         if ((tag1->ipt_num[0] == 0) && (tag2->ipt_num[0] == 0))
6880                 return 1;
6881
6882         if ((tag1->ipt_num[0] == tag2->ipt_num[0]) &&
6883             (tag1->ipt_num[1] == tag2->ipt_num[1]) &&
6884             (tag1->ipt_num[2] == tag2->ipt_num[2]) &&
6885             (tag1->ipt_num[3] == tag2->ipt_num[3]))
6886                 return 1;
6887         return 0;
6888 }
6889
6890
6891 /* ------------------------------------------------------------------------ */
6892 /* Function:    ipf_coalesce                                                */
6893 /* Returns:     1 == success, -1 == failure, 0 == no change                 */
6894 /* Parameters:  fin(I) - pointer to packet information                      */
6895 /*                                                                          */
6896 /* Attempt to get all of the packet data into a single, contiguous buffer.  */
6897 /* If this call returns a failure then the buffers have also been freed.    */
6898 /* ------------------------------------------------------------------------ */
6899 int
6900 ipf_coalesce(fin)
6901         fr_info_t *fin;
6902 {
6903
6904         if ((fin->fin_flx & FI_COALESCE) != 0)
6905                 return 1;
6906
6907         /*
6908          * If the mbuf pointers indicate that there is no mbuf to work with,
6909          * return but do not indicate success or failure.
6910          */
6911         if (fin->fin_m == NULL || fin->fin_mp == NULL)
6912                 return 0;
6913
6914 #if defined(_KERNEL)
6915         if (ipf_pullup(fin->fin_m, fin, fin->fin_plen) == NULL) {
6916                 ipf_main_softc_t *softc = fin->fin_main_soft;
6917
6918                 DT1(frb_coalesce, fr_info_t *, fin);
6919                 LBUMP(ipf_stats[fin->fin_out].fr_badcoalesces);
6920 # ifdef MENTAT
6921                 FREE_MB_T(*fin->fin_mp);
6922 # endif
6923                 fin->fin_reason = FRB_COALESCE;
6924                 *fin->fin_mp = NULL;
6925                 fin->fin_m = NULL;
6926                 return -1;
6927         }
6928 #else
6929         fin = fin;      /* LINT */
6930 #endif
6931         return 1;
6932 }
6933
6934
6935 /*
6936  * The following table lists all of the tunable variables that can be
6937  * accessed via SIOCIPFGET/SIOCIPFSET/SIOCIPFGETNEXt.  The format of each row
6938  * in the table below is as follows:
6939  *
6940  * pointer to value, name of value, minimum, maximum, size of the value's
6941  *     container, value attribute flags
6942  *
6943  * For convienience, IPFT_RDONLY means the value is read-only, IPFT_WRDISABLED
6944  * means the value can only be written to when IPFilter is loaded but disabled.
6945  * The obvious implication is if neither of these are set then the value can be
6946  * changed at any time without harm.
6947  */
6948
6949
6950 /* ------------------------------------------------------------------------ */
6951 /* Function:    ipf_tune_findbycookie                                       */
6952 /* Returns:     NULL = search failed, else pointer to tune struct           */
6953 /* Parameters:  cookie(I) - cookie value to search for amongst tuneables    */
6954 /*              next(O)   - pointer to place to store the cookie for the    */
6955 /*                          "next" tuneable, if it is desired.              */
6956 /*                                                                          */
6957 /* This function is used to walk through all of the existing tunables with  */
6958 /* successive calls.  It searches the known tunables for the one which has  */
6959 /* a matching value for "cookie" - ie its address.  When returning a match, */
6960 /* the next one to be found may be returned inside next.                    */
6961 /* ------------------------------------------------------------------------ */
6962 static ipftuneable_t *
6963 ipf_tune_findbycookie(ptop, cookie, next)
6964         ipftuneable_t **ptop;
6965         void *cookie, **next;
6966 {
6967         ipftuneable_t *ta, **tap;
6968
6969         for (ta = *ptop; ta->ipft_name != NULL; ta++)
6970                 if (ta == cookie) {
6971                         if (next != NULL) {
6972                                 /*
6973                                  * If the next entry in the array has a name
6974                                  * present, then return a pointer to it for
6975                                  * where to go next, else return a pointer to
6976                                  * the dynaminc list as a key to search there
6977                                  * next.  This facilitates a weak linking of
6978                                  * the two "lists" together.
6979                                  */
6980                                 if ((ta + 1)->ipft_name != NULL)
6981                                         *next = ta + 1;
6982                                 else
6983                                         *next = ptop;
6984                         }
6985                         return ta;
6986                 }
6987
6988         for (tap = ptop; (ta = *tap) != NULL; tap = &ta->ipft_next)
6989                 if (tap == cookie) {
6990                         if (next != NULL)
6991                                 *next = &ta->ipft_next;
6992                         return ta;
6993                 }
6994
6995         if (next != NULL)
6996                 *next = NULL;
6997         return NULL;
6998 }
6999
7000
7001 /* ------------------------------------------------------------------------ */
7002 /* Function:    ipf_tune_findbyname                                         */
7003 /* Returns:     NULL = search failed, else pointer to tune struct           */
7004 /* Parameters:  name(I) - name of the tuneable entry to find.               */
7005 /*                                                                          */
7006 /* Search the static array of tuneables and the list of dynamic tuneables   */
7007 /* for an entry with a matching name.  If we can find one, return a pointer */
7008 /* to the matching structure.                                               */
7009 /* ------------------------------------------------------------------------ */
7010 static ipftuneable_t *
7011 ipf_tune_findbyname(top, name)
7012         ipftuneable_t *top;
7013         const char *name;
7014 {
7015         ipftuneable_t *ta;
7016
7017         for (ta = top; ta != NULL; ta = ta->ipft_next)
7018                 if (!strcmp(ta->ipft_name, name)) {
7019                         return ta;
7020                 }
7021
7022         return NULL;
7023 }
7024
7025
7026 /* ------------------------------------------------------------------------ */
7027 /* Function:    ipf_tune_add_array                                          */
7028 /* Returns:     int - 0 == success, else failure                            */
7029 /* Parameters:  newtune - pointer to new tune array to add to tuneables     */
7030 /*                                                                          */
7031 /* Appends tune structures from the array passed in (newtune) to the end of */
7032 /* the current list of "dynamic" tuneable parameters.                       */
7033 /* If any entry to be added is already present (by name) then the operation */
7034 /* is aborted - entries that have been added are removed before returning.  */
7035 /* An entry with no name (NULL) is used as the indication that the end of   */
7036 /* the array has been reached.                                              */
7037 /* ------------------------------------------------------------------------ */
7038 int
7039 ipf_tune_add_array(softc, newtune)
7040         ipf_main_softc_t *softc;
7041         ipftuneable_t *newtune;
7042 {
7043         ipftuneable_t *nt, *dt;
7044         int error = 0;
7045
7046         for (nt = newtune; nt->ipft_name != NULL; nt++) {
7047                 error = ipf_tune_add(softc, nt);
7048                 if (error != 0) {
7049                         for (dt = newtune; dt != nt; dt++) {
7050                                 (void) ipf_tune_del(softc, dt);
7051                         }
7052                 }
7053         }
7054
7055         return error;
7056 }
7057
7058
7059 /* ------------------------------------------------------------------------ */
7060 /* Function:    ipf_tune_array_link                                         */
7061 /* Returns:     0 == success, -1 == failure                                 */
7062 /* Parameters:  softc(I) - soft context pointerto work with                 */
7063 /*              array(I) - pointer to an array of tuneables                 */
7064 /*                                                                          */
7065 /* Given an array of tunables (array), append them to the current list of   */
7066 /* tuneables for this context (softc->ipf_tuners.) To properly prepare the  */
7067 /* the array for being appended to the list, initialise all of the next     */
7068 /* pointers so we don't need to walk parts of it with ++ and others with    */
7069 /* next. The array is expected to have an entry with a NULL name as the     */
7070 /* terminator. Trying to add an array with no non-NULL names will return as */
7071 /* a failure.                                                               */
7072 /* ------------------------------------------------------------------------ */
7073 int
7074 ipf_tune_array_link(softc, array)
7075         ipf_main_softc_t *softc;
7076         ipftuneable_t *array;
7077 {
7078         ipftuneable_t *t, **p;
7079
7080         t = array;
7081         if (t->ipft_name == NULL)
7082                 return -1;
7083
7084         for (; t[1].ipft_name != NULL; t++)
7085                 t[0].ipft_next = &t[1];
7086         t->ipft_next = NULL;
7087
7088         /*
7089          * Since a pointer to the last entry isn't kept, we need to find it
7090          * each time we want to add new variables to the list.
7091          */
7092         for (p = &softc->ipf_tuners; (t = *p) != NULL; p = &t->ipft_next)
7093                 if (t->ipft_name == NULL)
7094                         break;
7095         *p = array;
7096
7097         return 0;
7098 }
7099
7100
7101 /* ------------------------------------------------------------------------ */
7102 /* Function:    ipf_tune_array_unlink                                       */
7103 /* Returns:     0 == success, -1 == failure                                 */
7104 /* Parameters:  softc(I) - soft context pointerto work with                 */
7105 /*              array(I) - pointer to an array of tuneables                 */
7106 /*                                                                          */
7107 /* ------------------------------------------------------------------------ */
7108 int
7109 ipf_tune_array_unlink(softc, array)
7110         ipf_main_softc_t *softc;
7111         ipftuneable_t *array;
7112 {
7113         ipftuneable_t *t, **p;
7114
7115         for (p = &softc->ipf_tuners; (t = *p) != NULL; p = &t->ipft_next)
7116                 if (t == array)
7117                         break;
7118         if (t == NULL)
7119                 return -1;
7120
7121         for (; t[1].ipft_name != NULL; t++)
7122                 ;
7123
7124         *p = t->ipft_next;
7125
7126         return 0;
7127 }
7128
7129
7130 /* ------------------------------------------------------------------------ */
7131 /* Function:   ipf_tune_array_copy                                          */
7132 /* Returns:    NULL = failure, else pointer to new array                    */
7133 /* Parameters: base(I)     - pointer to structure base                      */
7134 /*             size(I)     - size of the array at template                  */
7135 /*             template(I) - original array to copy                         */
7136 /*                                                                          */
7137 /* Allocate memory for a new set of tuneable values and copy everything     */
7138 /* from template into the new region of memory.  The new region is full of  */
7139 /* uninitialised pointers (ipft_next) so set them up.  Now, ipftp_offset... */
7140 /*                                                                          */
7141 /* NOTE: the following assumes that sizeof(long) == sizeof(void *)          */
7142 /* In the array template, ipftp_offset is the offset (in bytes) of the      */
7143 /* location of the tuneable value inside the structure pointed to by base.  */
7144 /* As ipftp_offset is a union over the pointers to the tuneable values, if  */
7145 /* we add base to the copy's ipftp_offset, copy ends up with a pointer in   */
7146 /* ipftp_void that points to the stored value.                              */
7147 /* ------------------------------------------------------------------------ */
7148 ipftuneable_t *
7149 ipf_tune_array_copy(base, size, template)
7150         void *base;
7151         size_t size;
7152         ipftuneable_t *template;
7153 {
7154         ipftuneable_t *copy;
7155         int i;
7156
7157
7158         KMALLOCS(copy, ipftuneable_t *, size);
7159         if (copy == NULL) {
7160                 return NULL;
7161         }
7162         bcopy(template, copy, size);
7163
7164         for (i = 0; copy[i].ipft_name; i++) {
7165                 copy[i].ipft_una.ipftp_offset += (u_long)base;
7166                 copy[i].ipft_next = copy + i + 1;
7167         }
7168
7169         return copy;
7170 }
7171
7172
7173 /* ------------------------------------------------------------------------ */
7174 /* Function:    ipf_tune_add                                                */
7175 /* Returns:     int - 0 == success, else failure                            */
7176 /* Parameters:  newtune - pointer to new tune entry to add to tuneables     */
7177 /*                                                                          */
7178 /* Appends tune structures from the array passed in (newtune) to the end of */
7179 /* the current list of "dynamic" tuneable parameters.  Once added, the      */
7180 /* owner of the object is not expected to ever change "ipft_next".          */
7181 /* ------------------------------------------------------------------------ */
7182 int
7183 ipf_tune_add(softc, newtune)
7184         ipf_main_softc_t *softc;
7185         ipftuneable_t *newtune;
7186 {
7187         ipftuneable_t *ta, **tap;
7188
7189         ta = ipf_tune_findbyname(softc->ipf_tuners, newtune->ipft_name);
7190         if (ta != NULL) {
7191                 IPFERROR(74);
7192                 return EEXIST;
7193         }
7194
7195         for (tap = &softc->ipf_tuners; *tap != NULL; tap = &(*tap)->ipft_next)
7196                 ;
7197
7198         newtune->ipft_next = NULL;
7199         *tap = newtune;
7200         return 0;
7201 }
7202
7203
7204 /* ------------------------------------------------------------------------ */
7205 /* Function:    ipf_tune_del                                                */
7206 /* Returns:     int - 0 == success, else failure                            */
7207 /* Parameters:  oldtune - pointer to tune entry to remove from the list of  */
7208 /*                        current dynamic tuneables                         */
7209 /*                                                                          */
7210 /* Search for the tune structure, by pointer, in the list of those that are */
7211 /* dynamically added at run time.  If found, adjust the list so that this   */
7212 /* structure is no longer part of it.                                       */
7213 /* ------------------------------------------------------------------------ */
7214 int
7215 ipf_tune_del(softc, oldtune)
7216         ipf_main_softc_t *softc;
7217         ipftuneable_t *oldtune;
7218 {
7219         ipftuneable_t *ta, **tap;
7220         int error = 0;
7221
7222         for (tap = &softc->ipf_tuners; (ta = *tap) != NULL;
7223              tap = &ta->ipft_next) {
7224                 if (ta == oldtune) {
7225                         *tap = oldtune->ipft_next;
7226                         oldtune->ipft_next = NULL;
7227                         break;
7228                 }
7229         }
7230
7231         if (ta == NULL) {
7232                 error = ESRCH;
7233                 IPFERROR(75);
7234         }
7235         return error;
7236 }
7237
7238
7239 /* ------------------------------------------------------------------------ */
7240 /* Function:    ipf_tune_del_array                                          */
7241 /* Returns:     int - 0 == success, else failure                            */
7242 /* Parameters:  oldtune - pointer to tuneables array                        */
7243 /*                                                                          */
7244 /* Remove each tuneable entry in the array from the list of "dynamic"       */
7245 /* tunables.  If one entry should fail to be found, an error will be        */
7246 /* returned and no further ones removed.                                    */
7247 /* An entry with a NULL name is used as the indicator of the last entry in  */
7248 /* the array.                                                               */
7249 /* ------------------------------------------------------------------------ */
7250 int
7251 ipf_tune_del_array(softc, oldtune)
7252         ipf_main_softc_t *softc;
7253         ipftuneable_t *oldtune;
7254 {
7255         ipftuneable_t *ot;
7256         int error = 0;
7257
7258         for (ot = oldtune; ot->ipft_name != NULL; ot++) {
7259                 error = ipf_tune_del(softc, ot);
7260                 if (error != 0)
7261                         break;
7262         }
7263
7264         return error;
7265
7266 }
7267
7268
7269 /* ------------------------------------------------------------------------ */
7270 /* Function:    ipf_tune                                                    */
7271 /* Returns:     int - 0 == success, else failure                            */
7272 /* Parameters:  cmd(I)  - ioctl command number                              */
7273 /*              data(I) - pointer to ioctl data structure                   */
7274 /*                                                                          */
7275 /* Implement handling of SIOCIPFGETNEXT, SIOCIPFGET and SIOCIPFSET.  These  */
7276 /* three ioctls provide the means to access and control global variables    */
7277 /* within IPFilter, allowing (for example) timeouts and table sizes to be   */
7278 /* changed without rebooting, reloading or recompiling.  The initialisation */
7279 /* and 'destruction' routines of the various components of ipfilter are all */
7280 /* each responsible for handling their own values being too big.            */
7281 /* ------------------------------------------------------------------------ */
7282 int
7283 ipf_ipftune(softc, cmd, data)
7284         ipf_main_softc_t *softc;
7285         ioctlcmd_t cmd;
7286         void *data;
7287 {
7288         ipftuneable_t *ta;
7289         ipftune_t tu;
7290         void *cookie;
7291         int error;
7292
7293         error = ipf_inobj(softc, data, NULL, &tu, IPFOBJ_TUNEABLE);
7294         if (error != 0)
7295                 return error;
7296
7297         tu.ipft_name[sizeof(tu.ipft_name) - 1] = '\0';
7298         cookie = tu.ipft_cookie;
7299         ta = NULL;
7300
7301         switch (cmd)
7302         {
7303         case SIOCIPFGETNEXT :
7304                 /*
7305                  * If cookie is non-NULL, assume it to be a pointer to the last
7306                  * entry we looked at, so find it (if possible) and return a
7307                  * pointer to the next one after it.  The last entry in the
7308                  * the table is a NULL entry, so when we get to it, set cookie
7309                  * to NULL and return that, indicating end of list, erstwhile
7310                  * if we come in with cookie set to NULL, we are starting anew
7311                  * at the front of the list.
7312                  */
7313                 if (cookie != NULL) {
7314                         ta = ipf_tune_findbycookie(&softc->ipf_tuners,
7315                                                    cookie, &tu.ipft_cookie);
7316                 } else {
7317                         ta = softc->ipf_tuners;
7318                         tu.ipft_cookie = ta + 1;
7319                 }
7320                 if (ta != NULL) {
7321                         /*
7322                          * Entry found, but does the data pointed to by that
7323                          * row fit in what we can return?
7324                          */
7325                         if (ta->ipft_sz > sizeof(tu.ipft_un)) {
7326                                 IPFERROR(76);
7327                                 return EINVAL;
7328                         }
7329
7330                         tu.ipft_vlong = 0;
7331                         if (ta->ipft_sz == sizeof(u_long))
7332                                 tu.ipft_vlong = *ta->ipft_plong;
7333                         else if (ta->ipft_sz == sizeof(u_int))
7334                                 tu.ipft_vint = *ta->ipft_pint;
7335                         else if (ta->ipft_sz == sizeof(u_short))
7336                                 tu.ipft_vshort = *ta->ipft_pshort;
7337                         else if (ta->ipft_sz == sizeof(u_char))
7338                                 tu.ipft_vchar = *ta->ipft_pchar;
7339
7340                         tu.ipft_sz = ta->ipft_sz;
7341                         tu.ipft_min = ta->ipft_min;
7342                         tu.ipft_max = ta->ipft_max;
7343                         tu.ipft_flags = ta->ipft_flags;
7344                         bcopy(ta->ipft_name, tu.ipft_name,
7345                               MIN(sizeof(tu.ipft_name),
7346                                   strlen(ta->ipft_name) + 1));
7347                 }
7348                 error = ipf_outobj(softc, data, &tu, IPFOBJ_TUNEABLE);
7349                 break;
7350
7351         case SIOCIPFGET :
7352         case SIOCIPFSET :
7353                 /*
7354                  * Search by name or by cookie value for a particular entry
7355                  * in the tuning paramter table.
7356                  */
7357                 IPFERROR(77);
7358                 error = ESRCH;
7359                 if (cookie != NULL) {
7360                         ta = ipf_tune_findbycookie(&softc->ipf_tuners,
7361                                                    cookie, NULL);
7362                         if (ta != NULL)
7363                                 error = 0;
7364                 } else if (tu.ipft_name[0] != '\0') {
7365                         ta = ipf_tune_findbyname(softc->ipf_tuners,
7366                                                  tu.ipft_name);
7367                         if (ta != NULL)
7368                                 error = 0;
7369                 }
7370                 if (error != 0)
7371                         break;
7372
7373                 if (cmd == (ioctlcmd_t)SIOCIPFGET) {
7374                         /*
7375                          * Fetch the tuning parameters for a particular value
7376                          */
7377                         tu.ipft_vlong = 0;
7378                         if (ta->ipft_sz == sizeof(u_long))
7379                                 tu.ipft_vlong = *ta->ipft_plong;
7380                         else if (ta->ipft_sz == sizeof(u_int))
7381                                 tu.ipft_vint = *ta->ipft_pint;
7382                         else if (ta->ipft_sz == sizeof(u_short))
7383                                 tu.ipft_vshort = *ta->ipft_pshort;
7384                         else if (ta->ipft_sz == sizeof(u_char))
7385                                 tu.ipft_vchar = *ta->ipft_pchar;
7386                         tu.ipft_cookie = ta;
7387                         tu.ipft_sz = ta->ipft_sz;
7388                         tu.ipft_min = ta->ipft_min;
7389                         tu.ipft_max = ta->ipft_max;
7390                         tu.ipft_flags = ta->ipft_flags;
7391                         error = ipf_outobj(softc, data, &tu, IPFOBJ_TUNEABLE);
7392
7393                 } else if (cmd == (ioctlcmd_t)SIOCIPFSET) {
7394                         /*
7395                          * Set an internal parameter.  The hard part here is
7396                          * getting the new value safely and correctly out of
7397                          * the kernel (given we only know its size, not type.)
7398                          */
7399                         u_long in;
7400
7401                         if (((ta->ipft_flags & IPFT_WRDISABLED) != 0) &&
7402                             (softc->ipf_running > 0)) {
7403                                 IPFERROR(78);
7404                                 error = EBUSY;
7405                                 break;
7406                         }
7407
7408                         in = tu.ipft_vlong;
7409                         if (in < ta->ipft_min || in > ta->ipft_max) {
7410                                 IPFERROR(79);
7411                                 error = EINVAL;
7412                                 break;
7413                         }
7414
7415                         if (ta->ipft_func != NULL) {
7416                                 SPL_INT(s);
7417
7418                                 SPL_NET(s);
7419                                 error = (*ta->ipft_func)(softc, ta,
7420                                                          &tu.ipft_un);
7421                                 SPL_X(s);
7422
7423                         } else if (ta->ipft_sz == sizeof(u_long)) {
7424                                 tu.ipft_vlong = *ta->ipft_plong;
7425                                 *ta->ipft_plong = in;
7426
7427                         } else if (ta->ipft_sz == sizeof(u_int)) {
7428                                 tu.ipft_vint = *ta->ipft_pint;
7429                                 *ta->ipft_pint = (u_int)(in & 0xffffffff);
7430
7431                         } else if (ta->ipft_sz == sizeof(u_short)) {
7432                                 tu.ipft_vshort = *ta->ipft_pshort;
7433                                 *ta->ipft_pshort = (u_short)(in & 0xffff);
7434
7435                         } else if (ta->ipft_sz == sizeof(u_char)) {
7436                                 tu.ipft_vchar = *ta->ipft_pchar;
7437                                 *ta->ipft_pchar = (u_char)(in & 0xff);
7438                         }
7439                         error = ipf_outobj(softc, data, &tu, IPFOBJ_TUNEABLE);
7440                 }
7441                 break;
7442
7443         default :
7444                 IPFERROR(80);
7445                 error = EINVAL;
7446                 break;
7447         }
7448
7449         return error;
7450 }
7451
7452
7453 /* ------------------------------------------------------------------------ */
7454 /* Function:    ipf_zerostats                                               */
7455 /* Returns:     int - 0 = success, else failure                             */
7456 /* Parameters:  data(O) - pointer to pointer for copying data back to       */
7457 /*                                                                          */
7458 /* Copies the current statistics out to userspace and then zero's the       */
7459 /* current ones in the kernel. The lock is only held across the bzero() as  */
7460 /* the copyout may result in paging (ie network activity.)                  */
7461 /* ------------------------------------------------------------------------ */
7462 int
7463 ipf_zerostats(softc, data)
7464         ipf_main_softc_t *softc;
7465         caddr_t data;
7466 {
7467         friostat_t fio;
7468         ipfobj_t obj;
7469         int error;
7470
7471         error = ipf_inobj(softc, data, &obj, &fio, IPFOBJ_IPFSTAT);
7472         if (error != 0)
7473                 return error;
7474         ipf_getstat(softc, &fio, obj.ipfo_rev);
7475         error = ipf_outobj(softc, data, &fio, IPFOBJ_IPFSTAT);
7476         if (error != 0)
7477                 return error;
7478
7479         WRITE_ENTER(&softc->ipf_mutex);
7480         bzero(&softc->ipf_stats, sizeof(softc->ipf_stats));
7481         RWLOCK_EXIT(&softc->ipf_mutex);
7482
7483         return 0;
7484 }
7485
7486
7487 /* ------------------------------------------------------------------------ */
7488 /* Function:    ipf_resolvedest                                             */
7489 /* Returns:     Nil                                                         */
7490 /* Parameters:  softc(I) - pointer to soft context main structure           */
7491 /*              base(I)  - where strings are stored                         */
7492 /*              fdp(IO)  - pointer to destination information to resolve    */
7493 /*              v(I)     - IP protocol version to match                     */
7494 /*                                                                          */
7495 /* Looks up an interface name in the frdest structure pointed to by fdp and */
7496 /* if a matching name can be found for the particular IP protocol version   */
7497 /* then store the interface pointer in the frdest struct.  If no match is   */
7498 /* found, then set the interface pointer to be -1 as NULL is considered to  */
7499 /* indicate there is no information at all in the structure.                */
7500 /* ------------------------------------------------------------------------ */
7501 int
7502 ipf_resolvedest(softc, base, fdp, v)
7503         ipf_main_softc_t *softc;
7504         char *base;
7505         frdest_t *fdp;
7506         int v;
7507 {
7508         int errval = 0;
7509         void *ifp;
7510
7511         ifp = NULL;
7512
7513         if (fdp->fd_name != -1) {
7514                 if (fdp->fd_type == FRD_DSTLIST) {
7515                         ifp = ipf_lookup_res_name(softc, IPL_LOGIPF,
7516                                                   IPLT_DSTLIST,
7517                                                   base + fdp->fd_name,
7518                                                   NULL);
7519                         if (ifp == NULL) {
7520                                 IPFERROR(144);
7521                                 errval = ESRCH;
7522                         }
7523                 } else {
7524                         ifp = GETIFP(base + fdp->fd_name, v);
7525                         if (ifp == NULL)
7526                                 ifp = (void *)-1;
7527                 }
7528         }
7529         fdp->fd_ptr = ifp;
7530
7531         if ((ifp != NULL) && (ifp != (void *)-1)) {
7532                 fdp->fd_local = ipf_deliverlocal(softc, v, ifp, &fdp->fd_ip6);
7533         }
7534
7535         return errval;
7536 }
7537
7538
7539 /* ------------------------------------------------------------------------ */
7540 /* Function:    ipf_resolvenic                                              */
7541 /* Returns:     void* - NULL = wildcard name, -1 = failed to find NIC, else */
7542 /*                      pointer to interface structure for NIC              */
7543 /* Parameters:  softc(I)- pointer to soft context main structure            */
7544 /*              name(I) - complete interface name                           */
7545 /*              v(I)    - IP protocol version                               */
7546 /*                                                                          */
7547 /* Look for a network interface structure that firstly has a matching name  */
7548 /* to that passed in and that is also being used for that IP protocol       */
7549 /* version (necessary on some platforms where there are separate listings   */
7550 /* for both IPv4 and IPv6 on the same physical NIC.                         */
7551 /* ------------------------------------------------------------------------ */
7552 void *
7553 ipf_resolvenic(softc, name, v)
7554         ipf_main_softc_t *softc;
7555         char *name;
7556         int v;
7557 {
7558         void *nic;
7559
7560         softc = softc;  /* gcc -Wextra */
7561         if (name[0] == '\0')
7562                 return NULL;
7563
7564         if ((name[1] == '\0') && ((name[0] == '-') || (name[0] == '*'))) {
7565                 return NULL;
7566         }
7567
7568         nic = GETIFP(name, v);
7569         if (nic == NULL)
7570                 nic = (void *)-1;
7571         return nic;
7572 }
7573
7574
7575 /* ------------------------------------------------------------------------ */
7576 /* Function:    ipf_token_expire                                            */
7577 /* Returns:     None.                                                       */
7578 /* Parameters:  softc(I) - pointer to soft context main structure           */
7579 /*                                                                          */
7580 /* This function is run every ipf tick to see if there are any tokens that  */
7581 /* have been held for too long and need to be freed up.                     */
7582 /* ------------------------------------------------------------------------ */
7583 void
7584 ipf_token_expire(softc)
7585         ipf_main_softc_t *softc;
7586 {
7587         ipftoken_t *it;
7588
7589         WRITE_ENTER(&softc->ipf_tokens);
7590         while ((it = softc->ipf_token_head) != NULL) {
7591                 if (it->ipt_die > softc->ipf_ticks)
7592                         break;
7593
7594                 ipf_token_deref(softc, it);
7595         }
7596         RWLOCK_EXIT(&softc->ipf_tokens);
7597 }
7598
7599
7600 /* ------------------------------------------------------------------------ */
7601 /* Function:    ipf_token_flush                                             */
7602 /* Returns:     None.                                                       */
7603 /* Parameters:  softc(I) - pointer to soft context main structure           */
7604 /*                                                                          */
7605 /* Loop through all of the existing tokens and call deref to see if they    */
7606 /* can be freed. Normally a function like this might just loop on           */
7607 /* ipf_token_head but there is a chance that a token might have a ref count */
7608 /* of greater than one and in that case the the reference would drop twice  */
7609 /* by code that is only entitled to drop it once.                           */
7610 /* ------------------------------------------------------------------------ */
7611 static void
7612 ipf_token_flush(softc)
7613         ipf_main_softc_t *softc;
7614 {
7615         ipftoken_t *it, *next;
7616
7617         WRITE_ENTER(&softc->ipf_tokens);
7618         for (it = softc->ipf_token_head; it != NULL; it = next) {
7619                 next = it->ipt_next;
7620                 (void) ipf_token_deref(softc, it);
7621         }
7622         RWLOCK_EXIT(&softc->ipf_tokens);
7623 }
7624
7625
7626 /* ------------------------------------------------------------------------ */
7627 /* Function:    ipf_token_del                                               */
7628 /* Returns:     int     - 0 = success, else error                           */
7629 /* Parameters:  softc(I)- pointer to soft context main structure            */
7630 /*              type(I) - the token type to match                           */
7631 /*              uid(I)  - uid owning the token                              */
7632 /*              ptr(I)  - context pointer for the token                     */
7633 /*                                                                          */
7634 /* This function looks for a a token in the current list that matches up    */
7635 /* the fields (type, uid, ptr).  If none is found, ESRCH is returned, else  */
7636 /* call ipf_token_dewref() to remove it from the list. In the event that    */
7637 /* the token has a reference held elsewhere, setting ipt_complete to 2      */
7638 /* enables debugging to distinguish between the two paths that ultimately   */
7639 /* lead to a token to be deleted.                                           */
7640 /* ------------------------------------------------------------------------ */
7641 int
7642 ipf_token_del(softc, type, uid, ptr)
7643         ipf_main_softc_t *softc;
7644         int type, uid;
7645         void *ptr;
7646 {
7647         ipftoken_t *it;
7648         int error;
7649
7650         IPFERROR(82);
7651         error = ESRCH;
7652
7653         WRITE_ENTER(&softc->ipf_tokens);
7654         for (it = softc->ipf_token_head; it != NULL; it = it->ipt_next) {
7655                 if (ptr == it->ipt_ctx && type == it->ipt_type &&
7656                     uid == it->ipt_uid) {
7657                         it->ipt_complete = 2;
7658                         ipf_token_deref(softc, it);
7659                         error = 0;
7660                         break;
7661                 }
7662         }
7663         RWLOCK_EXIT(&softc->ipf_tokens);
7664
7665         return error;
7666 }
7667
7668
7669 /* ------------------------------------------------------------------------ */
7670 /* Function:    ipf_token_mark_complete                                     */
7671 /* Returns:     None.                                                       */
7672 /* Parameters:  token(I) - pointer to token structure                       */
7673 /*                                                                          */
7674 /* Mark a token as being ineligable for being found with ipf_token_find.    */
7675 /* ------------------------------------------------------------------------ */
7676 void
7677 ipf_token_mark_complete(token)
7678         ipftoken_t *token;
7679 {
7680         if (token->ipt_complete == 0)
7681                 token->ipt_complete = 1;
7682 }
7683
7684
7685 /* ------------------------------------------------------------------------ */
7686 /* Function:    ipf_token_find                                               */
7687 /* Returns:     ipftoken_t * - NULL if no memory, else pointer to token     */
7688 /* Parameters:  softc(I)- pointer to soft context main structure            */
7689 /*              type(I) - the token type to match                           */
7690 /*              uid(I)  - uid owning the token                              */
7691 /*              ptr(I)  - context pointer for the token                     */
7692 /*                                                                          */
7693 /* This function looks for a live token in the list of current tokens that  */
7694 /* matches the tuple (type, uid, ptr).  If one cannot be found then one is  */
7695 /* allocated.  If one is found then it is moved to the top of the list of   */
7696 /* currently active tokens.                                                 */
7697 /* ------------------------------------------------------------------------ */
7698 ipftoken_t *
7699 ipf_token_find(softc, type, uid, ptr)
7700         ipf_main_softc_t *softc;
7701         int type, uid;
7702         void *ptr;
7703 {
7704         ipftoken_t *it, *new;
7705
7706         KMALLOC(new, ipftoken_t *);
7707         if (new != NULL)
7708                 bzero((char *)new, sizeof(*new));
7709
7710         WRITE_ENTER(&softc->ipf_tokens);
7711         for (it = softc->ipf_token_head; it != NULL; it = it->ipt_next) {
7712                 if ((ptr == it->ipt_ctx) && (type == it->ipt_type) &&
7713                     (uid == it->ipt_uid) && (it->ipt_complete < 2))
7714                         break;
7715         }
7716
7717         if (it == NULL) {
7718                 it = new;
7719                 new = NULL;
7720                 if (it == NULL) {
7721                         RWLOCK_EXIT(&softc->ipf_tokens);
7722                         return NULL;
7723                 }
7724                 it->ipt_ctx = ptr;
7725                 it->ipt_uid = uid;
7726                 it->ipt_type = type;
7727                 it->ipt_ref = 1;
7728         } else {
7729                 if (new != NULL) {
7730                         KFREE(new);
7731                         new = NULL;
7732                 }
7733
7734                 if (it->ipt_complete > 0)
7735                         it = NULL;
7736                 else
7737                         ipf_token_unlink(softc, it);
7738         }
7739
7740         if (it != NULL) {
7741                 it->ipt_pnext = softc->ipf_token_tail;
7742                 *softc->ipf_token_tail = it;
7743                 softc->ipf_token_tail = &it->ipt_next;
7744                 it->ipt_next = NULL;
7745                 it->ipt_ref++;
7746
7747                 it->ipt_die = softc->ipf_ticks + 20;
7748         }
7749
7750         RWLOCK_EXIT(&softc->ipf_tokens);
7751
7752         return it;
7753 }
7754
7755
7756 /* ------------------------------------------------------------------------ */
7757 /* Function:    ipf_token_unlink                                            */
7758 /* Returns:     None.                                                       */
7759 /* Parameters:  softc(I) - pointer to soft context main structure           */
7760 /*              token(I) - pointer to token structure                       */
7761 /* Write Locks: ipf_tokens                                                  */
7762 /*                                                                          */
7763 /* This function unlinks a token structure from the linked list of tokens   */
7764 /* that "own" it.  The head pointer never needs to be explicitly adjusted   */
7765 /* but the tail does due to the linked list implementation.                 */
7766 /* ------------------------------------------------------------------------ */
7767 static void
7768 ipf_token_unlink(softc, token)
7769         ipf_main_softc_t *softc;
7770         ipftoken_t *token;
7771 {
7772
7773         if (softc->ipf_token_tail == &token->ipt_next)
7774                 softc->ipf_token_tail = token->ipt_pnext;
7775
7776         *token->ipt_pnext = token->ipt_next;
7777         if (token->ipt_next != NULL)
7778                 token->ipt_next->ipt_pnext = token->ipt_pnext;
7779         token->ipt_next = NULL;
7780         token->ipt_pnext = NULL;
7781 }
7782
7783
7784 /* ------------------------------------------------------------------------ */
7785 /* Function:    ipf_token_deref                                             */
7786 /* Returns:     int      - 0 == token freed, else reference count           */
7787 /* Parameters:  softc(I) - pointer to soft context main structure           */
7788 /*              token(I) - pointer to token structure                       */
7789 /* Write Locks: ipf_tokens                                                  */
7790 /*                                                                          */
7791 /* Drop the reference count on the token structure and if it drops to zero, */
7792 /* call the dereference function for the token type because it is then      */
7793 /* possible to free the token data structure.                               */
7794 /* ------------------------------------------------------------------------ */
7795 int
7796 ipf_token_deref(softc, token)
7797         ipf_main_softc_t *softc;
7798         ipftoken_t *token;
7799 {
7800         void *data, **datap;
7801
7802         ASSERT(token->ipt_ref > 0);
7803         token->ipt_ref--;
7804         if (token->ipt_ref > 0)
7805                 return token->ipt_ref;
7806
7807         data = token->ipt_data;
7808         datap = &data;
7809
7810         if ((data != NULL) && (data != (void *)-1)) {
7811                 switch (token->ipt_type)
7812                 {
7813                 case IPFGENITER_IPF :
7814                         (void) ipf_derefrule(softc, (frentry_t **)datap);
7815                         break;
7816                 case IPFGENITER_IPNAT :
7817                         WRITE_ENTER(&softc->ipf_nat);
7818                         ipf_nat_rule_deref(softc, (ipnat_t **)datap);
7819                         RWLOCK_EXIT(&softc->ipf_nat);
7820                         break;
7821                 case IPFGENITER_NAT :
7822                         ipf_nat_deref(softc, (nat_t **)datap);
7823                         break;
7824                 case IPFGENITER_STATE :
7825                         ipf_state_deref(softc, (ipstate_t **)datap);
7826                         break;
7827                 case IPFGENITER_FRAG :
7828                         ipf_frag_pkt_deref(softc, (ipfr_t **)datap);
7829                         break;
7830                 case IPFGENITER_NATFRAG :
7831                         ipf_frag_nat_deref(softc, (ipfr_t **)datap);
7832                         break;
7833                 case IPFGENITER_HOSTMAP :
7834                         WRITE_ENTER(&softc->ipf_nat);
7835                         ipf_nat_hostmapdel(softc, (hostmap_t **)datap);
7836                         RWLOCK_EXIT(&softc->ipf_nat);
7837                         break;
7838                 default :
7839                         ipf_lookup_iterderef(softc, token->ipt_type, data);
7840                         break;
7841                 }
7842         }
7843
7844         ipf_token_unlink(softc, token);
7845         KFREE(token);
7846         return 0;
7847 }
7848
7849
7850 /* ------------------------------------------------------------------------ */
7851 /* Function:    ipf_nextrule                                                */
7852 /* Returns:     frentry_t * - NULL == no more rules, else pointer to next   */
7853 /* Parameters:  softc(I)    - pointer to soft context main structure        */
7854 /*              fr(I)       - pointer to filter rule                        */
7855 /*              out(I)      - 1 == out rules, 0 == input rules              */
7856 /*                                                                          */
7857 /* Starting with "fr", find the next rule to visit. This includes visiting  */
7858 /* the list of rule groups if either fr is NULL (empty list) or it is the   */
7859 /* last rule in the list. When walking rule lists, it is either input or    */
7860 /* output rules that are returned, never both.                              */
7861 /* ------------------------------------------------------------------------ */
7862 static frentry_t *
7863 ipf_nextrule(softc, active, unit, fr, out)
7864         ipf_main_softc_t *softc;
7865         int active, unit;
7866         frentry_t *fr;
7867         int out;
7868 {
7869         frentry_t *next;
7870         frgroup_t *fg;
7871
7872         if (fr != NULL && fr->fr_group != -1) {
7873                 fg = ipf_findgroup(softc, fr->fr_names + fr->fr_group,
7874                                    unit, active, NULL);
7875                 if (fg != NULL)
7876                         fg = fg->fg_next;
7877         } else {
7878                 fg = softc->ipf_groups[unit][active];
7879         }
7880
7881         while (fg != NULL) {
7882                 next = fg->fg_start;
7883                 while (next != NULL) {
7884                         if (out) {
7885                                 if (next->fr_flags & FR_OUTQUE)
7886                                         return next;
7887                         } else if (next->fr_flags & FR_INQUE) {
7888                                 return next;
7889                         }
7890                         next = next->fr_next;
7891                 }
7892                 if (next == NULL)
7893                         fg = fg->fg_next;
7894         }
7895
7896         return NULL;
7897 }
7898
7899 /* ------------------------------------------------------------------------ */
7900 /* Function:    ipf_getnextrule                                             */
7901 /* Returns:     int - 0 = success, else error                               */
7902 /* Parameters:  softc(I)- pointer to soft context main structure            */
7903 /*              t(I)   - pointer to destination information to resolve      */
7904 /*              ptr(I) - pointer to ipfobj_t to copyin from user space      */
7905 /*                                                                          */
7906 /* This function's first job is to bring in the ipfruleiter_t structure via */
7907 /* the ipfobj_t structure to determine what should be the next rule to      */
7908 /* return. Once the ipfruleiter_t has been brought in, it then tries to     */
7909 /* find the 'next rule'.  This may include searching rule group lists or    */
7910 /* just be as simple as looking at the 'next' field in the rule structure.  */
7911 /* When we have found the rule to return, increase its reference count and  */
7912 /* if we used an existing rule to get here, decrease its reference count.   */
7913 /* ------------------------------------------------------------------------ */
7914 int
7915 ipf_getnextrule(softc, t, ptr)
7916         ipf_main_softc_t *softc;
7917         ipftoken_t *t;
7918         void *ptr;
7919 {
7920         frentry_t *fr, *next, zero;
7921         ipfruleiter_t it;
7922         int error, out;
7923         frgroup_t *fg;
7924         ipfobj_t obj;
7925         int predict;
7926         char *dst;
7927         int unit;
7928
7929         if (t == NULL || ptr == NULL) {
7930                 IPFERROR(84);
7931                 return EFAULT;
7932         }
7933
7934         error = ipf_inobj(softc, ptr, &obj, &it, IPFOBJ_IPFITER);
7935         if (error != 0)
7936                 return error;
7937
7938         if ((it.iri_inout < 0) || (it.iri_inout > 3)) {
7939                 IPFERROR(85);
7940                 return EINVAL;
7941         }
7942         if ((it.iri_active != 0) && (it.iri_active != 1)) {
7943                 IPFERROR(86);
7944                 return EINVAL;
7945         }
7946         if (it.iri_nrules == 0) {
7947                 IPFERROR(87);
7948                 return ENOSPC;
7949         }
7950         if (it.iri_rule == NULL) {
7951                 IPFERROR(88);
7952                 return EFAULT;
7953         }
7954
7955         fg = NULL;
7956         fr = t->ipt_data;
7957         if ((it.iri_inout & F_OUT) != 0)
7958                 out = 1;
7959         else
7960                 out = 0;
7961         if ((it.iri_inout & F_ACIN) != 0)
7962                 unit = IPL_LOGCOUNT;
7963         else
7964                 unit = IPL_LOGIPF;
7965
7966         READ_ENTER(&softc->ipf_mutex);
7967         if (fr == NULL) {
7968                 if (*it.iri_group == '\0') {
7969                         if (unit == IPL_LOGCOUNT) {
7970                                 next = softc->ipf_acct[out][it.iri_active];
7971                         } else {
7972                                 next = softc->ipf_rules[out][it.iri_active];
7973                         }
7974                         if (next == NULL)
7975                                 next = ipf_nextrule(softc, it.iri_active,
7976                                                     unit, NULL, out);
7977                 } else {
7978                         fg = ipf_findgroup(softc, it.iri_group, unit,
7979                                            it.iri_active, NULL);
7980                         if (fg != NULL)
7981                                 next = fg->fg_start;
7982                         else
7983                                 next = NULL;
7984                 }
7985         } else {
7986                 next = fr->fr_next;
7987                 if (next == NULL)
7988                         next = ipf_nextrule(softc, it.iri_active, unit,
7989                                             fr, out);
7990         }
7991
7992         if (next != NULL && next->fr_next != NULL)
7993                 predict = 1;
7994         else if (ipf_nextrule(softc, it.iri_active, unit, next, out) != NULL)
7995                 predict = 1;
7996         else
7997                 predict = 0;
7998
7999         if (fr != NULL)
8000                 (void) ipf_derefrule(softc, &fr);
8001
8002         obj.ipfo_type = IPFOBJ_FRENTRY;
8003         dst = (char *)it.iri_rule;
8004
8005         if (next != NULL) {
8006                 obj.ipfo_size = next->fr_size;
8007                 MUTEX_ENTER(&next->fr_lock);
8008                 next->fr_ref++;
8009                 MUTEX_EXIT(&next->fr_lock);
8010                 t->ipt_data = next;
8011         } else {
8012                 obj.ipfo_size = sizeof(frentry_t);
8013                 bzero(&zero, sizeof(zero));
8014                 next = &zero;
8015                 t->ipt_data = NULL;
8016         }
8017         it.iri_rule = predict ? next : NULL;
8018         if (predict == 0)
8019                 ipf_token_mark_complete(t);
8020
8021         RWLOCK_EXIT(&softc->ipf_mutex);
8022
8023         obj.ipfo_ptr = dst;
8024         error = ipf_outobjk(softc, &obj, next);
8025         if (error == 0 && t->ipt_data != NULL) {
8026                 dst += obj.ipfo_size;
8027                 if (next->fr_data != NULL) {
8028                         ipfobj_t dobj;
8029
8030                         if (next->fr_type == FR_T_IPFEXPR)
8031                                 dobj.ipfo_type = IPFOBJ_IPFEXPR;
8032                         else
8033                                 dobj.ipfo_type = IPFOBJ_FRIPF;
8034                         dobj.ipfo_size = next->fr_dsize;
8035                         dobj.ipfo_rev = obj.ipfo_rev;
8036                         dobj.ipfo_ptr = dst;
8037                         error = ipf_outobjk(softc, &dobj, next->fr_data);
8038                 }
8039         }
8040
8041         if ((fr != NULL) && (next == &zero))
8042                 (void) ipf_derefrule(softc, &fr);
8043
8044         return error;
8045 }
8046
8047
8048 /* ------------------------------------------------------------------------ */
8049 /* Function:    ipf_frruleiter                                              */
8050 /* Returns:     int - 0 = success, else error                               */
8051 /* Parameters:  softc(I)- pointer to soft context main structure            */
8052 /*              data(I) - the token type to match                           */
8053 /*              uid(I)  - uid owning the token                              */
8054 /*              ptr(I)  - context pointer for the token                     */
8055 /*                                                                          */
8056 /* This function serves as a stepping stone between ipf_ipf_ioctl and       */
8057 /* ipf_getnextrule.  It's role is to find the right token in the kernel for */
8058 /* the process doing the ioctl and use that to ask for the next rule.       */
8059 /* ------------------------------------------------------------------------ */
8060 static int
8061 ipf_frruleiter(softc, data, uid, ctx)
8062         ipf_main_softc_t *softc;
8063         void *data, *ctx;
8064         int uid;
8065 {
8066         ipftoken_t *token;
8067         ipfruleiter_t it;
8068         ipfobj_t obj;
8069         int error;
8070
8071         token = ipf_token_find(softc, IPFGENITER_IPF, uid, ctx);
8072         if (token != NULL) {
8073                 error = ipf_getnextrule(softc, token, data);
8074                 WRITE_ENTER(&softc->ipf_tokens);
8075                 ipf_token_deref(softc, token);
8076                 RWLOCK_EXIT(&softc->ipf_tokens);
8077         } else {
8078                 error = ipf_inobj(softc, data, &obj, &it, IPFOBJ_IPFITER);
8079                 if (error != 0)
8080                         return error;
8081                 it.iri_rule = NULL;
8082                 error = ipf_outobj(softc, data, &it, IPFOBJ_IPFITER);
8083         }
8084
8085         return error;
8086 }
8087
8088
8089 /* ------------------------------------------------------------------------ */
8090 /* Function:    ipf_geniter                                                 */
8091 /* Returns:     int - 0 = success, else error                               */
8092 /* Parameters:  softc(I) - pointer to soft context main structure           */
8093 /*              token(I) - pointer to ipftoken_t structure                  */
8094 /*              itp(I)   - pointer to iterator data                         */
8095 /*                                                                          */
8096 /* Decide which iterator function to call using information passed through  */
8097 /* the ipfgeniter_t structure at itp.                                       */
8098 /* ------------------------------------------------------------------------ */
8099 static int
8100 ipf_geniter(softc, token, itp)
8101         ipf_main_softc_t *softc;
8102         ipftoken_t *token;
8103         ipfgeniter_t *itp;
8104 {
8105         int error;
8106
8107         switch (itp->igi_type)
8108         {
8109         case IPFGENITER_FRAG :
8110                 error = ipf_frag_pkt_next(softc, token, itp);
8111                 break;
8112         default :
8113                 IPFERROR(92);
8114                 error = EINVAL;
8115                 break;
8116         }
8117
8118         return error;
8119 }
8120
8121
8122 /* ------------------------------------------------------------------------ */
8123 /* Function:    ipf_genericiter                                             */
8124 /* Returns:     int - 0 = success, else error                               */
8125 /* Parameters:  softc(I)- pointer to soft context main structure            */
8126 /*              data(I) - the token type to match                           */
8127 /*              uid(I)  - uid owning the token                              */
8128 /*              ptr(I)  - context pointer for the token                     */
8129 /*                                                                          */
8130 /* Handle the SIOCGENITER ioctl for the ipfilter device. The primary role   */
8131 /* ------------------------------------------------------------------------ */
8132 int
8133 ipf_genericiter(softc, data, uid, ctx)
8134         ipf_main_softc_t *softc;
8135         void *data, *ctx;
8136         int uid;
8137 {
8138         ipftoken_t *token;
8139         ipfgeniter_t iter;
8140         int error;
8141
8142         error = ipf_inobj(softc, data, NULL, &iter, IPFOBJ_GENITER);
8143         if (error != 0)
8144                 return error;
8145
8146         token = ipf_token_find(softc, iter.igi_type, uid, ctx);
8147         if (token != NULL) {
8148                 token->ipt_subtype = iter.igi_type;
8149                 error = ipf_geniter(softc, token, &iter);
8150                 WRITE_ENTER(&softc->ipf_tokens);
8151                 ipf_token_deref(softc, token);
8152                 RWLOCK_EXIT(&softc->ipf_tokens);
8153         } else {
8154                 IPFERROR(93);
8155                 error = 0;
8156         }
8157
8158         return error;
8159 }
8160
8161
8162 /* ------------------------------------------------------------------------ */
8163 /* Function:    ipf_ipf_ioctl                                               */
8164 /* Returns:     int - 0 = success, else error                               */
8165 /* Parameters:  softc(I)- pointer to soft context main structure           */
8166 /*              data(I) - the token type to match                           */
8167 /*              cmd(I)  - the ioctl command number                          */
8168 /*              mode(I) - mode flags for the ioctl                          */
8169 /*              uid(I)  - uid owning the token                              */
8170 /*              ptr(I)  - context pointer for the token                     */
8171 /*                                                                          */
8172 /* This function handles all of the ioctl command that are actually isssued */
8173 /* to the /dev/ipl device.                                                  */
8174 /* ------------------------------------------------------------------------ */
8175 int
8176 ipf_ipf_ioctl(softc, data, cmd, mode, uid, ctx)
8177         ipf_main_softc_t *softc;
8178         caddr_t data;
8179         ioctlcmd_t cmd;
8180         int mode, uid;
8181         void *ctx;
8182 {
8183         friostat_t fio;
8184         int error, tmp;
8185         ipfobj_t obj;
8186         SPL_INT(s);
8187
8188         switch (cmd)
8189         {
8190         case SIOCFRENB :
8191                 if (!(mode & FWRITE)) {
8192                         IPFERROR(94);
8193                         error = EPERM;
8194                 } else {
8195                         error = BCOPYIN(data, &tmp, sizeof(tmp));
8196                         if (error != 0) {
8197                                 IPFERROR(95);
8198                                 error = EFAULT;
8199                                 break;
8200                         }
8201
8202                         WRITE_ENTER(&softc->ipf_global);
8203                         if (tmp) {
8204                                 if (softc->ipf_running > 0)
8205                                         error = 0;
8206                                 else
8207                                         error = ipfattach(softc);
8208                                 if (error == 0)
8209                                         softc->ipf_running = 1;
8210                                 else
8211                                         (void) ipfdetach(softc);
8212                         } else {
8213                                 if (softc->ipf_running == 1)
8214                                         error = ipfdetach(softc);
8215                                 else
8216                                         error = 0;
8217                                 if (error == 0)
8218                                         softc->ipf_running = -1;
8219                         }
8220                         RWLOCK_EXIT(&softc->ipf_global);
8221                 }
8222                 break;
8223
8224         case SIOCIPFSET :
8225                 if (!(mode & FWRITE)) {
8226                         IPFERROR(96);
8227                         error = EPERM;
8228                         break;
8229                 }
8230                 /* FALLTHRU */
8231         case SIOCIPFGETNEXT :
8232         case SIOCIPFGET :
8233                 error = ipf_ipftune(softc, cmd, (void *)data);
8234                 break;
8235
8236         case SIOCSETFF :
8237                 if (!(mode & FWRITE)) {
8238                         IPFERROR(97);
8239                         error = EPERM;
8240                 } else {
8241                         error = BCOPYIN(data, &softc->ipf_flags,
8242                                         sizeof(softc->ipf_flags));
8243                         if (error != 0) {
8244                                 IPFERROR(98);
8245                                 error = EFAULT;
8246                         }
8247                 }
8248                 break;
8249
8250         case SIOCGETFF :
8251                 error = BCOPYOUT(&softc->ipf_flags, data,
8252                                  sizeof(softc->ipf_flags));
8253                 if (error != 0) {
8254                         IPFERROR(99);
8255                         error = EFAULT;
8256                 }
8257                 break;
8258
8259         case SIOCFUNCL :
8260                 error = ipf_resolvefunc(softc, (void *)data);
8261                 break;
8262
8263         case SIOCINAFR :
8264         case SIOCRMAFR :
8265         case SIOCADAFR :
8266         case SIOCZRLST :
8267                 if (!(mode & FWRITE)) {
8268                         IPFERROR(100);
8269                         error = EPERM;
8270                 } else {
8271                         error = frrequest(softc, IPL_LOGIPF, cmd, (caddr_t)data,
8272                                           softc->ipf_active, 1);
8273                 }
8274                 break;
8275
8276         case SIOCINIFR :
8277         case SIOCRMIFR :
8278         case SIOCADIFR :
8279                 if (!(mode & FWRITE)) {
8280                         IPFERROR(101);
8281                         error = EPERM;
8282                 } else {
8283                         error = frrequest(softc, IPL_LOGIPF, cmd, (caddr_t)data,
8284                                           1 - softc->ipf_active, 1);
8285                 }
8286                 break;
8287
8288         case SIOCSWAPA :
8289                 if (!(mode & FWRITE)) {
8290                         IPFERROR(102);
8291                         error = EPERM;
8292                 } else {
8293                         WRITE_ENTER(&softc->ipf_mutex);
8294                         error = BCOPYOUT(&softc->ipf_active, data,
8295                                          sizeof(softc->ipf_active));
8296                         if (error != 0) {
8297                                 IPFERROR(103);
8298                                 error = EFAULT;
8299                         } else {
8300                                 softc->ipf_active = 1 - softc->ipf_active;
8301                         }
8302                         RWLOCK_EXIT(&softc->ipf_mutex);
8303                 }
8304                 break;
8305
8306         case SIOCGETFS :
8307                 error = ipf_inobj(softc, (void *)data, &obj, &fio,
8308                                   IPFOBJ_IPFSTAT);
8309                 if (error != 0)
8310                         break;
8311                 ipf_getstat(softc, &fio, obj.ipfo_rev);
8312                 error = ipf_outobj(softc, (void *)data, &fio, IPFOBJ_IPFSTAT);
8313                 break;
8314
8315         case SIOCFRZST :
8316                 if (!(mode & FWRITE)) {
8317                         IPFERROR(104);
8318                         error = EPERM;
8319                 } else
8320                         error = ipf_zerostats(softc, (caddr_t)data);
8321                 break;
8322
8323         case SIOCIPFFL :
8324                 if (!(mode & FWRITE)) {
8325                         IPFERROR(105);
8326                         error = EPERM;
8327                 } else {
8328                         error = BCOPYIN(data, &tmp, sizeof(tmp));
8329                         if (!error) {
8330                                 tmp = ipf_flush(softc, IPL_LOGIPF, tmp);
8331                                 error = BCOPYOUT(&tmp, data, sizeof(tmp));
8332                                 if (error != 0) {
8333                                         IPFERROR(106);
8334                                         error = EFAULT;
8335                                 }
8336                         } else {
8337                                 IPFERROR(107);
8338                                 error = EFAULT;
8339                         }
8340                 }
8341                 break;
8342
8343 #ifdef USE_INET6
8344         case SIOCIPFL6 :
8345                 if (!(mode & FWRITE)) {
8346                         IPFERROR(108);
8347                         error = EPERM;
8348                 } else {
8349                         error = BCOPYIN(data, &tmp, sizeof(tmp));
8350                         if (!error) {
8351                                 tmp = ipf_flush(softc, IPL_LOGIPF, tmp);
8352                                 error = BCOPYOUT(&tmp, data, sizeof(tmp));
8353                                 if (error != 0) {
8354                                         IPFERROR(109);
8355                                         error = EFAULT;
8356                                 }
8357                         } else {
8358                                 IPFERROR(110);
8359                                 error = EFAULT;
8360                         }
8361                 }
8362                 break;
8363 #endif
8364
8365         case SIOCSTLCK :
8366                 if (!(mode & FWRITE)) {
8367                         IPFERROR(122);
8368                         error = EPERM;
8369                 } else {
8370                         error = BCOPYIN(data, &tmp, sizeof(tmp));
8371                         if (error == 0) {
8372                                 ipf_state_setlock(softc->ipf_state_soft, tmp);
8373                                 ipf_nat_setlock(softc->ipf_nat_soft, tmp);
8374                                 ipf_frag_setlock(softc->ipf_frag_soft, tmp);
8375                                 ipf_auth_setlock(softc->ipf_auth_soft, tmp);
8376                         } else {
8377                                 IPFERROR(111);
8378                                 error = EFAULT;
8379                         }
8380                 }
8381                 break;
8382
8383 #ifdef  IPFILTER_LOG
8384         case SIOCIPFFB :
8385                 if (!(mode & FWRITE)) {
8386                         IPFERROR(112);
8387                         error = EPERM;
8388                 } else {
8389                         tmp = ipf_log_clear(softc, IPL_LOGIPF);
8390                         error = BCOPYOUT(&tmp, data, sizeof(tmp));
8391                         if (error) {
8392                                 IPFERROR(113);
8393                                 error = EFAULT;
8394                         }
8395                 }
8396                 break;
8397 #endif /* IPFILTER_LOG */
8398
8399         case SIOCFRSYN :
8400                 if (!(mode & FWRITE)) {
8401                         IPFERROR(114);
8402                         error = EPERM;
8403                 } else {
8404                         WRITE_ENTER(&softc->ipf_global);
8405 #if (defined(MENTAT) && defined(_KERNEL)) && !defined(INSTANCES)
8406                         error = ipfsync();
8407 #else
8408                         ipf_sync(softc, NULL);
8409                         error = 0;
8410 #endif
8411                         RWLOCK_EXIT(&softc->ipf_global);
8412
8413                 }
8414                 break;
8415
8416         case SIOCGFRST :
8417                 error = ipf_outobj(softc, (void *)data,
8418                                    ipf_frag_stats(softc->ipf_frag_soft),
8419                                    IPFOBJ_FRAGSTAT);
8420                 break;
8421
8422 #ifdef  IPFILTER_LOG
8423         case FIONREAD :
8424                 tmp = ipf_log_bytesused(softc, IPL_LOGIPF);
8425                 error = BCOPYOUT(&tmp, data, sizeof(tmp));
8426                 break;
8427 #endif
8428
8429         case SIOCIPFITER :
8430                 SPL_SCHED(s);
8431                 error = ipf_frruleiter(softc, data, uid, ctx);
8432                 SPL_X(s);
8433                 break;
8434
8435         case SIOCGENITER :
8436                 SPL_SCHED(s);
8437                 error = ipf_genericiter(softc, data, uid, ctx);
8438                 SPL_X(s);
8439                 break;
8440
8441         case SIOCIPFDELTOK :
8442                 error = BCOPYIN(data, &tmp, sizeof(tmp));
8443                 if (error == 0) {
8444                         SPL_SCHED(s);
8445                         error = ipf_token_del(softc, tmp, uid, ctx);
8446                         SPL_X(s);
8447                 }
8448                 break;
8449
8450         default :
8451                 IPFERROR(115);
8452                 error = EINVAL;
8453                 break;
8454         }
8455
8456         return error;
8457 }
8458
8459
8460 /* ------------------------------------------------------------------------ */
8461 /* Function:    ipf_decaps                                                  */
8462 /* Returns:     int        - -1 == decapsulation failed, else bit mask of   */
8463 /*                           flags indicating packet filtering decision.    */
8464 /* Parameters:  fin(I)     - pointer to packet information                  */
8465 /*              pass(I)    - IP protocol version to match                   */
8466 /*              l5proto(I) - layer 5 protocol to decode UDP data as.        */
8467 /*                                                                          */
8468 /* This function is called for packets that are wrapt up in other packets,  */
8469 /* for example, an IP packet that is the entire data segment for another IP */
8470 /* packet.  If the basic constraints for this are satisfied, change the     */
8471 /* buffer to point to the start of the inner packet and start processing    */
8472 /* rules belonging to the head group this rule specifies.                   */
8473 /* ------------------------------------------------------------------------ */
8474 u_32_t
8475 ipf_decaps(fin, pass, l5proto)
8476         fr_info_t *fin;
8477         u_32_t pass;
8478         int l5proto;
8479 {
8480         fr_info_t fin2, *fino = NULL;
8481         int elen, hlen, nh;
8482         grehdr_t gre;
8483         ip_t *ip;
8484         mb_t *m;
8485
8486         if ((fin->fin_flx & FI_COALESCE) == 0)
8487                 if (ipf_coalesce(fin) == -1)
8488                         goto cantdecaps;
8489
8490         m = fin->fin_m;
8491         hlen = fin->fin_hlen;
8492
8493         switch (fin->fin_p)
8494         {
8495         case IPPROTO_UDP :
8496                 /*
8497                  * In this case, the specific protocol being decapsulated
8498                  * inside UDP frames comes from the rule.
8499                  */
8500                 nh = fin->fin_fr->fr_icode;
8501                 break;
8502
8503         case IPPROTO_GRE :      /* 47 */
8504                 bcopy(fin->fin_dp, (char *)&gre, sizeof(gre));
8505                 hlen += sizeof(grehdr_t);
8506                 if (gre.gr_R|gre.gr_s)
8507                         goto cantdecaps;
8508                 if (gre.gr_C)
8509                         hlen += 4;
8510                 if (gre.gr_K)
8511                         hlen += 4;
8512                 if (gre.gr_S)
8513                         hlen += 4;
8514
8515                 nh = IPPROTO_IP;
8516
8517                 /*
8518                  * If the routing options flag is set, validate that it is
8519                  * there and bounce over it.
8520                  */
8521 #if 0
8522                 /* This is really heavy weight and lots of room for error, */
8523                 /* so for now, put it off and get the simple stuff right.  */
8524                 if (gre.gr_R) {
8525                         u_char off, len, *s;
8526                         u_short af;
8527                         int end;
8528
8529                         end = 0;
8530                         s = fin->fin_dp;
8531                         s += hlen;
8532                         aplen = fin->fin_plen - hlen;
8533                         while (aplen > 3) {
8534                                 af = (s[0] << 8) | s[1];
8535                                 off = s[2];
8536                                 len = s[3];
8537                                 aplen -= 4;
8538                                 s += 4;
8539                                 if (af == 0 && len == 0) {
8540                                         end = 1;
8541                                         break;
8542                                 }
8543                                 if (aplen < len)
8544                                         break;
8545                                 s += len;
8546                                 aplen -= len;
8547                         }
8548                         if (end != 1)
8549                                 goto cantdecaps;
8550                         hlen = s - (u_char *)fin->fin_dp;
8551                 }
8552 #endif
8553                 break;
8554
8555 #ifdef IPPROTO_IPIP
8556         case IPPROTO_IPIP :     /* 4 */
8557 #endif
8558                 nh = IPPROTO_IP;
8559                 break;
8560
8561         default :       /* Includes ESP, AH is special for IPv4 */
8562                 goto cantdecaps;
8563         }
8564
8565         switch (nh)
8566         {
8567         case IPPROTO_IP :
8568         case IPPROTO_IPV6 :
8569                 break;
8570         default :
8571                 goto cantdecaps;
8572         }
8573
8574         bcopy((char *)fin, (char *)&fin2, sizeof(fin2));
8575         fino = fin;
8576         fin = &fin2;
8577         elen = hlen;
8578 #if defined(MENTAT) && defined(_KERNEL)
8579         m->b_rptr += elen;
8580 #else
8581         m->m_data += elen;
8582         m->m_len -= elen;
8583 #endif
8584         fin->fin_plen -= elen;
8585
8586         ip = (ip_t *)((char *)fin->fin_ip + elen);
8587
8588         /*
8589          * Make sure we have at least enough data for the network layer
8590          * header.
8591          */
8592         if (IP_V(ip) == 4)
8593                 hlen = IP_HL(ip) << 2;
8594 #ifdef USE_INET6
8595         else if (IP_V(ip) == 6)
8596                 hlen = sizeof(ip6_t);
8597 #endif
8598         else
8599                 goto cantdecaps2;
8600
8601         if (fin->fin_plen < hlen)
8602                 goto cantdecaps2;
8603
8604         fin->fin_dp = (char *)ip + hlen;
8605
8606         if (IP_V(ip) == 4) {
8607                 /*
8608                  * Perform IPv4 header checksum validation.
8609                  */
8610                 if (ipf_cksum((u_short *)ip, hlen))
8611                         goto cantdecaps2;
8612         }
8613
8614         if (ipf_makefrip(hlen, ip, fin) == -1) {
8615 cantdecaps2:
8616                 if (m != NULL) {
8617 #if defined(MENTAT) && defined(_KERNEL)
8618                         m->b_rptr -= elen;
8619 #else
8620                         m->m_data -= elen;
8621                         m->m_len += elen;
8622 #endif
8623                 }
8624 cantdecaps:
8625                 DT1(frb_decapfrip, fr_info_t *, fin);
8626                 pass &= ~FR_CMDMASK;
8627                 pass |= FR_BLOCK|FR_QUICK;
8628                 fin->fin_reason = FRB_DECAPFRIP;
8629                 return -1;
8630         }
8631
8632         pass = ipf_scanlist(fin, pass);
8633
8634         /*
8635          * Copy the packet filter "result" fields out of the fr_info_t struct
8636          * that is local to the decapsulation processing and back into the
8637          * one we were called with.
8638          */
8639         fino->fin_flx = fin->fin_flx;
8640         fino->fin_rev = fin->fin_rev;
8641         fino->fin_icode = fin->fin_icode;
8642         fino->fin_rule = fin->fin_rule;
8643         (void) strncpy(fino->fin_group, fin->fin_group, FR_GROUPLEN);
8644         fino->fin_fr = fin->fin_fr;
8645         fino->fin_error = fin->fin_error;
8646         fino->fin_mp = fin->fin_mp;
8647         fino->fin_m = fin->fin_m;
8648         m = fin->fin_m;
8649         if (m != NULL) {
8650 #if defined(MENTAT) && defined(_KERNEL)
8651                 m->b_rptr -= elen;
8652 #else
8653                 m->m_data -= elen;
8654                 m->m_len += elen;
8655 #endif
8656         }
8657         return pass;
8658 }
8659
8660
8661 /* ------------------------------------------------------------------------ */
8662 /* Function:    ipf_matcharray_load                                         */
8663 /* Returns:     int         - 0 = success, else error                       */
8664 /* Parameters:  softc(I)    - pointer to soft context main structure        */
8665 /*              data(I)     - pointer to ioctl data                         */
8666 /*              objp(I)     - ipfobj_t structure to load data into          */
8667 /*              arrayptr(I) - pointer to location to store array pointer    */
8668 /*                                                                          */
8669 /* This function loads in a mathing array through the ipfobj_t struct that  */
8670 /* describes it.  Sanity checking and array size limitations are enforced   */
8671 /* in this function to prevent userspace from trying to load in something   */
8672 /* that is insanely big.  Once the size of the array is known, the memory   */
8673 /* required is malloc'd and returned through changing *arrayptr.  The       */
8674 /* contents of the array are verified before returning.  Only in the event  */
8675 /* of a successful call is the caller required to free up the malloc area.  */
8676 /* ------------------------------------------------------------------------ */
8677 int
8678 ipf_matcharray_load(softc, data, objp, arrayptr)
8679         ipf_main_softc_t *softc;
8680         caddr_t data;
8681         ipfobj_t *objp;
8682         int **arrayptr;
8683 {
8684         int arraysize, *array, error;
8685
8686         *arrayptr = NULL;
8687
8688         error = BCOPYIN(data, objp, sizeof(*objp));
8689         if (error != 0) {
8690                 IPFERROR(116);
8691                 return EFAULT;
8692         }
8693
8694         if (objp->ipfo_type != IPFOBJ_IPFEXPR) {
8695                 IPFERROR(117);
8696                 return EINVAL;
8697         }
8698
8699         if (((objp->ipfo_size & 3) != 0) || (objp->ipfo_size == 0) ||
8700             (objp->ipfo_size > 1024)) {
8701                 IPFERROR(118);
8702                 return EINVAL;
8703         }
8704
8705         arraysize = objp->ipfo_size * sizeof(*array);
8706         KMALLOCS(array, int *, arraysize);
8707         if (array == NULL) {
8708                 IPFERROR(119);
8709                 return ENOMEM;
8710         }
8711
8712         error = COPYIN(objp->ipfo_ptr, array, arraysize);
8713         if (error != 0) {
8714                 KFREES(array, arraysize);
8715                 IPFERROR(120);
8716                 return EFAULT;
8717         }
8718
8719         if (ipf_matcharray_verify(array, arraysize) != 0) {
8720                 KFREES(array, arraysize);
8721                 IPFERROR(121);
8722                 return EINVAL;
8723         }
8724
8725         *arrayptr = array;
8726         return 0;
8727 }
8728
8729
8730 /* ------------------------------------------------------------------------ */
8731 /* Function:    ipf_matcharray_verify                                       */
8732 /* Returns:     Nil                                                         */
8733 /* Parameters:  array(I)     - pointer to matching array                    */
8734 /*              arraysize(I) - number of elements in the array              */
8735 /*                                                                          */
8736 /* Verify the contents of a matching array by stepping through each element */
8737 /* in it.  The actual commands in the array are not verified for            */
8738 /* correctness, only that all of the sizes are correctly within limits.     */
8739 /* ------------------------------------------------------------------------ */
8740 int
8741 ipf_matcharray_verify(array, arraysize)
8742         int *array, arraysize;
8743 {
8744         int i, nelem, maxidx;
8745         ipfexp_t *e;
8746
8747         nelem = arraysize / sizeof(*array);
8748
8749         /*
8750          * Currently, it makes no sense to have an array less than 6
8751          * elements long - the initial size at the from, a single operation
8752          * (minimum 4 in length) and a trailer, for a total of 6.
8753          */
8754         if ((array[0] < 6) || (arraysize < 24) || (arraysize > 4096)) {
8755                 return -1;
8756         }
8757
8758         /*
8759          * Verify the size of data pointed to by array with how long
8760          * the array claims to be itself.
8761          */
8762         if (array[0] * sizeof(*array) != arraysize) {
8763                 return -1;
8764         }
8765
8766         maxidx = nelem - 1;
8767         /*
8768          * The last opcode in this array should be an IPF_EXP_END.
8769          */
8770         if (array[maxidx] != IPF_EXP_END) {
8771                 return -1;
8772         }
8773
8774         for (i = 1; i < maxidx; ) {
8775                 e = (ipfexp_t *)(array + i);
8776
8777                 /*
8778                  * The length of the bits to check must be at least 1
8779                  * (or else there is nothing to comapre with!) and it
8780                  * cannot exceed the length of the data present.
8781                  */
8782                 if ((e->ipfe_size < 1 ) ||
8783                     (e->ipfe_size + i > maxidx)) {
8784                         return -1;
8785                 }
8786                 i += e->ipfe_size;
8787         }
8788         return 0;
8789 }
8790
8791
8792 /* ------------------------------------------------------------------------ */
8793 /* Function:    ipf_fr_matcharray                                           */
8794 /* Returns:     int      - 0 = match failed, else positive match            */
8795 /* Parameters:  fin(I)   - pointer to packet information                    */
8796 /*              array(I) - pointer to matching array                        */
8797 /*                                                                          */
8798 /* This function is used to apply a matching array against a packet and     */
8799 /* return an indication of whether or not the packet successfully matches   */
8800 /* all of the commands in it.                                               */
8801 /* ------------------------------------------------------------------------ */
8802 static int
8803 ipf_fr_matcharray(fin, array)
8804         fr_info_t *fin;
8805         int *array;
8806 {
8807         int i, n, *x, rv, p;
8808         ipfexp_t *e;
8809
8810         rv = 0;
8811         n = array[0];
8812         x = array + 1;
8813
8814         for (; n > 0; x += 3 + x[3], rv = 0) {
8815                 e = (ipfexp_t *)x;
8816                 if (e->ipfe_cmd == IPF_EXP_END)
8817                         break;
8818                 n -= e->ipfe_size;
8819
8820                 /*
8821                  * The upper 16 bits currently store the protocol value.
8822                  * This is currently used with TCP and UDP port compares and
8823                  * allows "tcp.port = 80" without requiring an explicit
8824                  " "ip.pr = tcp" first.
8825                  */
8826                 p = e->ipfe_cmd >> 16;
8827                 if ((p != 0) && (p != fin->fin_p))
8828                         break;
8829
8830                 switch (e->ipfe_cmd)
8831                 {
8832                 case IPF_EXP_IP_PR :
8833                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
8834                                 rv |= (fin->fin_p == e->ipfe_arg0[i]);
8835                         }
8836                         break;
8837
8838                 case IPF_EXP_IP_SRCADDR :
8839                         if (fin->fin_v != 4)
8840                                 break;
8841                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
8842                                 rv |= ((fin->fin_saddr &
8843                                         e->ipfe_arg0[i * 2 + 1]) ==
8844                                        e->ipfe_arg0[i * 2]);
8845                         }
8846                         break;
8847
8848                 case IPF_EXP_IP_DSTADDR :
8849                         if (fin->fin_v != 4)
8850                                 break;
8851                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
8852                                 rv |= ((fin->fin_daddr &
8853                                         e->ipfe_arg0[i * 2 + 1]) ==
8854                                        e->ipfe_arg0[i * 2]);
8855                         }
8856                         break;
8857
8858                 case IPF_EXP_IP_ADDR :
8859                         if (fin->fin_v != 4)
8860                                 break;
8861                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
8862                                 rv |= ((fin->fin_saddr &
8863                                         e->ipfe_arg0[i * 2 + 1]) ==
8864                                        e->ipfe_arg0[i * 2]) ||
8865                                       ((fin->fin_daddr &
8866                                         e->ipfe_arg0[i * 2 + 1]) ==
8867                                        e->ipfe_arg0[i * 2]);
8868                         }
8869                         break;
8870
8871 #ifdef USE_INET6
8872                 case IPF_EXP_IP6_SRCADDR :
8873                         if (fin->fin_v != 6)
8874                                 break;
8875                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
8876                                 rv |= IP6_MASKEQ(&fin->fin_src6,
8877                                                  &e->ipfe_arg0[i * 8 + 4],
8878                                                  &e->ipfe_arg0[i * 8]);
8879                         }
8880                         break;
8881
8882                 case IPF_EXP_IP6_DSTADDR :
8883                         if (fin->fin_v != 6)
8884                                 break;
8885                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
8886                                 rv |= IP6_MASKEQ(&fin->fin_dst6,
8887                                                  &e->ipfe_arg0[i * 8 + 4],
8888                                                  &e->ipfe_arg0[i * 8]);
8889                         }
8890                         break;
8891
8892                 case IPF_EXP_IP6_ADDR :
8893                         if (fin->fin_v != 6)
8894                                 break;
8895                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
8896                                 rv |= IP6_MASKEQ(&fin->fin_src6,
8897                                                  &e->ipfe_arg0[i * 8 + 4],
8898                                                  &e->ipfe_arg0[i * 8]) ||
8899                                       IP6_MASKEQ(&fin->fin_dst6,
8900                                                  &e->ipfe_arg0[i * 8 + 4],
8901                                                  &e->ipfe_arg0[i * 8]);
8902                         }
8903                         break;
8904 #endif
8905
8906                 case IPF_EXP_UDP_PORT :
8907                 case IPF_EXP_TCP_PORT :
8908                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
8909                                 rv |= (fin->fin_sport == e->ipfe_arg0[i]) ||
8910                                       (fin->fin_dport == e->ipfe_arg0[i]);
8911                         }
8912                         break;
8913
8914                 case IPF_EXP_UDP_SPORT :
8915                 case IPF_EXP_TCP_SPORT :
8916                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
8917                                 rv |= (fin->fin_sport == e->ipfe_arg0[i]);
8918                         }
8919                         break;
8920
8921                 case IPF_EXP_UDP_DPORT :
8922                 case IPF_EXP_TCP_DPORT :
8923                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
8924                                 rv |= (fin->fin_dport == e->ipfe_arg0[i]);
8925                         }
8926                         break;
8927
8928                 case IPF_EXP_TCP_FLAGS :
8929                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
8930                                 rv |= ((fin->fin_tcpf &
8931                                         e->ipfe_arg0[i * 2 + 1]) ==
8932                                        e->ipfe_arg0[i * 2]);
8933                         }
8934                         break;
8935                 }
8936                 rv ^= e->ipfe_not;
8937
8938                 if (rv == 0)
8939                         break;
8940         }
8941
8942         return rv;
8943 }
8944
8945
8946 /* ------------------------------------------------------------------------ */
8947 /* Function:    ipf_queueflush                                              */
8948 /* Returns:     int - number of entries flushed (0 = none)                  */
8949 /* Parameters:  softc(I)    - pointer to soft context main structure        */
8950 /*              deletefn(I) - function to call to delete entry              */
8951 /*              ipfqs(I)    - top of the list of ipf internal queues        */
8952 /*              userqs(I)   - top of the list of user defined timeouts      */
8953 /*                                                                          */
8954 /* This fucntion gets called when the state/NAT hash tables fill up and we  */
8955 /* need to try a bit harder to free up some space.  The algorithm used here */
8956 /* split into two parts but both halves have the same goal: to reduce the   */
8957 /* number of connections considered to be "active" to the low watermark.    */
8958 /* There are two steps in doing this:                                       */
8959 /* 1) Remove any TCP connections that are already considered to be "closed" */
8960 /*    but have not yet been removed from the state table.  The two states   */
8961 /*    TCPS_TIME_WAIT and TCPS_CLOSED are considered to be the perfect       */
8962 /*    candidates for this style of removal.  If freeing up entries in       */
8963 /*    CLOSED or both CLOSED and TIME_WAIT brings us to the low watermark,   */
8964 /*    we do not go on to step 2.                                            */
8965 /*                                                                          */
8966 /* 2) Look for the oldest entries on each timeout queue and free them if    */
8967 /*    they are within the given window we are considering.  Where the       */
8968 /*    window starts and the steps taken to increase its size depend upon    */
8969 /*    how long ipf has been running (ipf_ticks.)  Anything modified in the  */
8970 /*    last 30 seconds is not touched.                                       */
8971 /*                                              touched                     */
8972 /*         die     ipf_ticks  30*1.5    1800*1.5   |  43200*1.5             */
8973 /*           |          |        |           |     |     |                  */
8974 /* future <--+----------+--------+-----------+-----+-----+-----------> past */
8975 /*                     now        \_int=30s_/ \_int=1hr_/ \_int=12hr        */
8976 /*                                                                          */
8977 /* Points to note:                                                          */
8978 /* - tqe_die is the time, in the future, when entries die.                  */
8979 /* - tqe_die - ipf_ticks is how long left the connection has to live in ipf */
8980 /*   ticks.                                                                 */
8981 /* - tqe_touched is when the entry was last used by NAT/state               */
8982 /* - the closer tqe_touched is to ipf_ticks, the further tqe_die will be    */
8983 /*   ipf_ticks any given timeout queue and vice versa.                      */
8984 /* - both tqe_die and tqe_touched increase over time                        */
8985 /* - timeout queues are sorted with the highest value of tqe_die at the     */
8986 /*   bottom and therefore the smallest values of each are at the top        */
8987 /* - the pointer passed in as ipfqs should point to an array of timeout     */
8988 /*   queues representing each of the TCP states                             */
8989 /*                                                                          */
8990 /* We start by setting up a maximum range to scan for things to move of     */
8991 /* iend (newest) to istart (oldest) in chunks of "interval".  If nothing is */
8992 /* found in that range, "interval" is adjusted (so long as it isn't 30) and */
8993 /* we start again with a new value for "iend" and "istart".  This is        */
8994 /* continued until we either finish the scan of 30 second intervals or the  */
8995 /* low water mark is reached.                                               */
8996 /* ------------------------------------------------------------------------ */
8997 int
8998 ipf_queueflush(softc, deletefn, ipfqs, userqs, activep, size, low)
8999         ipf_main_softc_t *softc;
9000         ipftq_delete_fn_t deletefn;
9001         ipftq_t *ipfqs, *userqs;
9002         u_int *activep;
9003         int size, low;
9004 {
9005         u_long interval, istart, iend;
9006         ipftq_t *ifq, *ifqnext;
9007         ipftqent_t *tqe, *tqn;
9008         int removed = 0;
9009
9010         for (tqn = ipfqs[IPF_TCPS_CLOSED].ifq_head; ((tqe = tqn) != NULL); ) {
9011                 tqn = tqe->tqe_next;
9012                 if ((*deletefn)(softc, tqe->tqe_parent) == 0)
9013                         removed++;
9014         }
9015         if ((*activep * 100 / size) > low) {
9016                 for (tqn = ipfqs[IPF_TCPS_TIME_WAIT].ifq_head;
9017                      ((tqe = tqn) != NULL); ) {
9018                         tqn = tqe->tqe_next;
9019                         if ((*deletefn)(softc, tqe->tqe_parent) == 0)
9020                                 removed++;
9021                 }
9022         }
9023
9024         if ((*activep * 100 / size) <= low) {
9025                 return removed;
9026         }
9027
9028         /*
9029          * NOTE: Use of "* 15 / 10" is required here because if "* 1.5" is
9030          *       used then the operations are upgraded to floating point
9031          *       and kernels don't like floating point...
9032          */
9033         if (softc->ipf_ticks > IPF_TTLVAL(43200 * 15 / 10)) {
9034                 istart = IPF_TTLVAL(86400 * 4);
9035                 interval = IPF_TTLVAL(43200);
9036         } else if (softc->ipf_ticks > IPF_TTLVAL(1800 * 15 / 10)) {
9037                 istart = IPF_TTLVAL(43200);
9038                 interval = IPF_TTLVAL(1800);
9039         } else if (softc->ipf_ticks > IPF_TTLVAL(30 * 15 / 10)) {
9040                 istart = IPF_TTLVAL(1800);
9041                 interval = IPF_TTLVAL(30);
9042         } else {
9043                 return 0;
9044         }
9045         if (istart > softc->ipf_ticks) {
9046                 if (softc->ipf_ticks - interval < interval)
9047                         istart = interval;
9048                 else
9049                         istart = (softc->ipf_ticks / interval) * interval;
9050         }
9051
9052         iend = softc->ipf_ticks - interval;
9053
9054         while ((*activep * 100 / size) > low) {
9055                 u_long try;
9056
9057                 try = softc->ipf_ticks - istart;
9058
9059                 for (ifq = ipfqs; ifq != NULL; ifq = ifq->ifq_next) {
9060                         for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) {
9061                                 if (try < tqe->tqe_touched)
9062                                         break;
9063                                 tqn = tqe->tqe_next;
9064                                 if ((*deletefn)(softc, tqe->tqe_parent) == 0)
9065                                         removed++;
9066                         }
9067                 }
9068
9069                 for (ifq = userqs; ifq != NULL; ifq = ifqnext) {
9070                         ifqnext = ifq->ifq_next;
9071
9072                         for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) {
9073                                 if (try < tqe->tqe_touched)
9074                                         break;
9075                                 tqn = tqe->tqe_next;
9076                                 if ((*deletefn)(softc, tqe->tqe_parent) == 0)
9077                                         removed++;
9078                         }
9079                 }
9080
9081                 if (try >= iend) {
9082                         if (interval == IPF_TTLVAL(43200)) {
9083                                 interval = IPF_TTLVAL(1800);
9084                         } else if (interval == IPF_TTLVAL(1800)) {
9085                                 interval = IPF_TTLVAL(30);
9086                         } else {
9087                                 break;
9088                         }
9089                         if (interval >= softc->ipf_ticks)
9090                                 break;
9091
9092                         iend = softc->ipf_ticks - interval;
9093                 }
9094                 istart -= interval;
9095         }
9096
9097         return removed;
9098 }
9099
9100
9101 /* ------------------------------------------------------------------------ */
9102 /* Function:    ipf_deliverlocal                                            */
9103 /* Returns:     int - 1 = local address, 0 = non-local address              */
9104 /* Parameters:  softc(I)     - pointer to soft context main structure       */
9105 /*              ipversion(I) - IP protocol version (4 or 6)                 */
9106 /*              ifp(I)       - network interface pointer                    */
9107 /*              ipaddr(I)    - IPv4/6 destination address                   */
9108 /*                                                                          */
9109 /* This fucntion is used to determine in the address "ipaddr" belongs to    */
9110 /* the network interface represented by ifp.                                */
9111 /* ------------------------------------------------------------------------ */
9112 int
9113 ipf_deliverlocal(softc, ipversion, ifp, ipaddr)
9114         ipf_main_softc_t *softc;
9115         int ipversion;
9116         void *ifp;
9117         i6addr_t *ipaddr;
9118 {
9119         i6addr_t addr;
9120         int islocal = 0;
9121
9122         if (ipversion == 4) {
9123                 if (ipf_ifpaddr(softc, 4, FRI_NORMAL, ifp, &addr, NULL) == 0) {
9124                         if (addr.in4.s_addr == ipaddr->in4.s_addr)
9125                                 islocal = 1;
9126                 }
9127
9128 #ifdef USE_INET6
9129         } else if (ipversion == 6) {
9130                 if (ipf_ifpaddr(softc, 6, FRI_NORMAL, ifp, &addr, NULL) == 0) {
9131                         if (IP6_EQ(&addr, ipaddr))
9132                                 islocal = 1;
9133                 }
9134 #endif
9135         }
9136
9137         return islocal;
9138 }
9139
9140
9141 /* ------------------------------------------------------------------------ */
9142 /* Function:    ipf_settimeout                                              */
9143 /* Returns:     int - 0 = success, -1 = failure                             */
9144 /* Parameters:  softc(I) - pointer to soft context main structure           */
9145 /*              t(I)     - pointer to tuneable array entry                  */
9146 /*              p(I)     - pointer to values passed in to apply             */
9147 /*                                                                          */
9148 /* This function is called to set the timeout values for each distinct      */
9149 /* queue timeout that is available.  When called, it calls into both the    */
9150 /* state and NAT code, telling them to update their timeout queues.         */
9151 /* ------------------------------------------------------------------------ */
9152 static int
9153 ipf_settimeout(softc, t, p)
9154         struct ipf_main_softc_s *softc;
9155         ipftuneable_t *t;
9156         ipftuneval_t *p;
9157 {
9158
9159         /*
9160          * ipf_interror should be set by the functions called here, not
9161          * by this function - it's just a middle man.
9162          */
9163         if (ipf_state_settimeout(softc, t, p) == -1)
9164                 return -1;
9165         if (ipf_nat_settimeout(softc, t, p) == -1)
9166                 return -1;
9167         return 0;
9168 }
9169
9170
9171 /* ------------------------------------------------------------------------ */
9172 /* Function:    ipf_apply_timeout                                           */
9173 /* Returns:     int - 0 = success, -1 = failure                             */
9174 /* Parameters:  head(I)    - pointer to tuneable array entry                */
9175 /*              seconds(I) - pointer to values passed in to apply           */
9176 /*                                                                          */
9177 /* This function applies a timeout of "seconds" to the timeout queue that   */
9178 /* is pointed to by "head".  All entries on this list have an expiration    */
9179 /* set to be the current tick value of ipf plus the ttl.  Given that this   */
9180 /* function should only be called when the delta is non-zero, the task is   */
9181 /* to walk the entire list and apply the change.  The sort order will not   */
9182 /* change.  The only catch is that this is O(n) across the list, so if the  */
9183 /* queue has lots of entries (10s of thousands or 100s of thousands), it    */
9184 /* could take a relatively long time to work through them all.              */
9185 /* ------------------------------------------------------------------------ */
9186 void
9187 ipf_apply_timeout(head, seconds)
9188         ipftq_t *head;
9189         u_int seconds;
9190 {
9191         u_int oldtimeout, newtimeout;
9192         ipftqent_t *tqe;
9193         int delta;
9194
9195         MUTEX_ENTER(&head->ifq_lock);
9196         oldtimeout = head->ifq_ttl;
9197         newtimeout = IPF_TTLVAL(seconds);
9198         delta = oldtimeout - newtimeout;
9199
9200         head->ifq_ttl = newtimeout;
9201
9202         for (tqe = head->ifq_head; tqe != NULL; tqe = tqe->tqe_next) {
9203                 tqe->tqe_die += delta;
9204         }
9205         MUTEX_EXIT(&head->ifq_lock);
9206 }
9207
9208
9209 /* ------------------------------------------------------------------------ */
9210 /* Function:   ipf_settimeout_tcp                                           */
9211 /* Returns:    int - 0 = successfully applied, -1 = failed                  */
9212 /* Parameters: t(I)   - pointer to tuneable to change                       */
9213 /*             p(I)   - pointer to new timeout information                  */
9214 /*             tab(I) - pointer to table of TCP queues                      */
9215 /*                                                                          */
9216 /* This function applies the new timeout (p) to the TCP tunable (t) and     */
9217 /* updates all of the entries on the relevant timeout queue by calling      */
9218 /* ipf_apply_timeout().                                                     */
9219 /* ------------------------------------------------------------------------ */
9220 int
9221 ipf_settimeout_tcp(t, p, tab)
9222         ipftuneable_t *t;
9223         ipftuneval_t *p;
9224         ipftq_t *tab;
9225 {
9226         if (!strcmp(t->ipft_name, "tcp_idle_timeout") ||
9227             !strcmp(t->ipft_name, "tcp_established")) {
9228                 ipf_apply_timeout(&tab[IPF_TCPS_ESTABLISHED], p->ipftu_int);
9229         } else if (!strcmp(t->ipft_name, "tcp_close_wait")) {
9230                 ipf_apply_timeout(&tab[IPF_TCPS_CLOSE_WAIT], p->ipftu_int);
9231         } else if (!strcmp(t->ipft_name, "tcp_last_ack")) {
9232                 ipf_apply_timeout(&tab[IPF_TCPS_LAST_ACK], p->ipftu_int);
9233         } else if (!strcmp(t->ipft_name, "tcp_timeout")) {
9234                 ipf_apply_timeout(&tab[IPF_TCPS_LISTEN], p->ipftu_int);
9235                 ipf_apply_timeout(&tab[IPF_TCPS_HALF_ESTAB], p->ipftu_int);
9236                 ipf_apply_timeout(&tab[IPF_TCPS_CLOSING], p->ipftu_int);
9237         } else if (!strcmp(t->ipft_name, "tcp_listen")) {
9238                 ipf_apply_timeout(&tab[IPF_TCPS_LISTEN], p->ipftu_int);
9239         } else if (!strcmp(t->ipft_name, "tcp_half_established")) {
9240                 ipf_apply_timeout(&tab[IPF_TCPS_HALF_ESTAB], p->ipftu_int);
9241         } else if (!strcmp(t->ipft_name, "tcp_closing")) {
9242                 ipf_apply_timeout(&tab[IPF_TCPS_CLOSING], p->ipftu_int);
9243         } else if (!strcmp(t->ipft_name, "tcp_syn_received")) {
9244                 ipf_apply_timeout(&tab[IPF_TCPS_SYN_RECEIVED], p->ipftu_int);
9245         } else if (!strcmp(t->ipft_name, "tcp_syn_sent")) {
9246                 ipf_apply_timeout(&tab[IPF_TCPS_SYN_SENT], p->ipftu_int);
9247         } else if (!strcmp(t->ipft_name, "tcp_closed")) {
9248                 ipf_apply_timeout(&tab[IPF_TCPS_CLOSED], p->ipftu_int);
9249         } else if (!strcmp(t->ipft_name, "tcp_half_closed")) {
9250                 ipf_apply_timeout(&tab[IPF_TCPS_CLOSED], p->ipftu_int);
9251         } else if (!strcmp(t->ipft_name, "tcp_time_wait")) {
9252                 ipf_apply_timeout(&tab[IPF_TCPS_TIME_WAIT], p->ipftu_int);
9253         } else {
9254                 /*
9255                  * ipf_interror isn't set here because it should be set
9256                  * by whatever called this function.
9257                  */
9258                 return -1;
9259         }
9260         return 0;
9261 }
9262
9263
9264 /* ------------------------------------------------------------------------ */
9265 /* Function:   ipf_main_soft_create                                         */
9266 /* Returns:    NULL = failure, else success                                 */
9267 /* Parameters: arg(I) - pointer to soft context structure if already allocd */
9268 /*                                                                          */
9269 /* Create the foundation soft context structure. In circumstances where it  */
9270 /* is not required to dynamically allocate the context, a pointer can be    */
9271 /* passed in (rather than NULL) to a structure to be initialised.           */
9272 /* The main thing of interest is that a number of locks are initialised     */
9273 /* here instead of in the where might be expected - in the relevant create  */
9274 /* function elsewhere.  This is done because the current locking design has */
9275 /* some areas where these locks are used outside of their module.           */
9276 /* Possibly the most important exercise that is done here is setting of all */
9277 /* the timeout values, allowing them to be changed before init().           */
9278 /* ------------------------------------------------------------------------ */
9279 void *
9280 ipf_main_soft_create(arg)
9281         void *arg;
9282 {
9283         ipf_main_softc_t *softc;
9284
9285         if (arg == NULL) {
9286                 KMALLOC(softc, ipf_main_softc_t *);
9287                 if (softc == NULL)
9288                         return NULL;
9289         } else {
9290                 softc = arg;
9291         }
9292
9293         bzero((char *)softc, sizeof(*softc));
9294
9295         /*
9296          * This serves as a flag as to whether or not the softc should be
9297          * free'd when _destroy is called.
9298          */
9299         softc->ipf_dynamic_softc = (arg == NULL) ? 1 : 0;
9300
9301         softc->ipf_tuners = ipf_tune_array_copy(softc,
9302                                                 sizeof(ipf_main_tuneables),
9303                                                 ipf_main_tuneables);
9304         if (softc->ipf_tuners == NULL) {
9305                 ipf_main_soft_destroy(softc);
9306                 return NULL;
9307         }
9308
9309         MUTEX_INIT(&softc->ipf_rw, "ipf rw mutex");
9310         MUTEX_INIT(&softc->ipf_timeoutlock, "ipf timeout lock");
9311         RWLOCK_INIT(&softc->ipf_global, "ipf filter load/unload mutex");
9312         RWLOCK_INIT(&softc->ipf_mutex, "ipf filter rwlock");
9313         RWLOCK_INIT(&softc->ipf_tokens, "ipf token rwlock");
9314         RWLOCK_INIT(&softc->ipf_state, "ipf state rwlock");
9315         RWLOCK_INIT(&softc->ipf_nat, "ipf IP NAT rwlock");
9316         RWLOCK_INIT(&softc->ipf_poolrw, "ipf pool rwlock");
9317         RWLOCK_INIT(&softc->ipf_frag, "ipf frag rwlock");
9318
9319         softc->ipf_token_head = NULL;
9320         softc->ipf_token_tail = &softc->ipf_token_head;
9321
9322         softc->ipf_tcpidletimeout = FIVE_DAYS;
9323         softc->ipf_tcpclosewait = IPF_TTLVAL(2 * TCP_MSL);
9324         softc->ipf_tcplastack = IPF_TTLVAL(30);
9325         softc->ipf_tcptimewait = IPF_TTLVAL(2 * TCP_MSL);
9326         softc->ipf_tcptimeout = IPF_TTLVAL(2 * TCP_MSL);
9327         softc->ipf_tcpsynsent = IPF_TTLVAL(2 * TCP_MSL);
9328         softc->ipf_tcpsynrecv = IPF_TTLVAL(2 * TCP_MSL);
9329         softc->ipf_tcpclosed = IPF_TTLVAL(30);
9330         softc->ipf_tcphalfclosed = IPF_TTLVAL(2 * 3600);
9331         softc->ipf_udptimeout = IPF_TTLVAL(120);
9332         softc->ipf_udpacktimeout = IPF_TTLVAL(12);
9333         softc->ipf_icmptimeout = IPF_TTLVAL(60);
9334         softc->ipf_icmpacktimeout = IPF_TTLVAL(6);
9335         softc->ipf_iptimeout = IPF_TTLVAL(60);
9336
9337 #if defined(IPFILTER_DEFAULT_BLOCK)
9338         softc->ipf_pass = FR_BLOCK|FR_NOMATCH;
9339 #else
9340         softc->ipf_pass = (IPF_DEFAULT_PASS)|FR_NOMATCH;
9341 #endif
9342         softc->ipf_minttl = 4;
9343         softc->ipf_icmpminfragmtu = 68;
9344         softc->ipf_flags = IPF_LOGGING;
9345
9346         return softc;
9347 }
9348
9349 /* ------------------------------------------------------------------------ */
9350 /* Function:   ipf_main_soft_init                                           */
9351 /* Returns:    0 = success, -1 = failure                                    */
9352 /* Parameters: softc(I) - pointer to soft context main structure            */
9353 /*                                                                          */
9354 /* A null-op function that exists as a placeholder so that the flow in      */
9355 /* other functions is obvious.                                              */
9356 /* ------------------------------------------------------------------------ */
9357 /*ARGSUSED*/
9358 int
9359 ipf_main_soft_init(softc)
9360         ipf_main_softc_t *softc;
9361 {
9362         return 0;
9363 }
9364
9365
9366 /* ------------------------------------------------------------------------ */
9367 /* Function:   ipf_main_soft_destroy                                        */
9368 /* Returns:    void                                                         */
9369 /* Parameters: softc(I) - pointer to soft context main structure            */
9370 /*                                                                          */
9371 /* Undo everything that we did in ipf_main_soft_create.                     */
9372 /*                                                                          */
9373 /* The most important check that needs to be made here is whether or not    */
9374 /* the structure was allocated by ipf_main_soft_create() by checking what   */
9375 /* value is stored in ipf_dynamic_main.                                     */
9376 /* ------------------------------------------------------------------------ */
9377 /*ARGSUSED*/
9378 void
9379 ipf_main_soft_destroy(softc)
9380         ipf_main_softc_t *softc;
9381 {
9382
9383         RW_DESTROY(&softc->ipf_frag);
9384         RW_DESTROY(&softc->ipf_poolrw);
9385         RW_DESTROY(&softc->ipf_nat);
9386         RW_DESTROY(&softc->ipf_state);
9387         RW_DESTROY(&softc->ipf_tokens);
9388         RW_DESTROY(&softc->ipf_mutex);
9389         RW_DESTROY(&softc->ipf_global);
9390         MUTEX_DESTROY(&softc->ipf_timeoutlock);
9391         MUTEX_DESTROY(&softc->ipf_rw);
9392
9393         if (softc->ipf_tuners != NULL) {
9394                 KFREES(softc->ipf_tuners, sizeof(ipf_main_tuneables));
9395         }
9396         if (softc->ipf_dynamic_softc == 1) {
9397                 KFREE(softc);
9398         }
9399 }
9400
9401
9402 /* ------------------------------------------------------------------------ */
9403 /* Function:   ipf_main_soft_fini                                           */
9404 /* Returns:    0 = success, -1 = failure                                    */
9405 /* Parameters: softc(I) - pointer to soft context main structure            */
9406 /*                                                                          */
9407 /* Clean out the rules which have been added since _init was last called,   */
9408 /* the only dynamic part of the mainline.                                   */
9409 /* ------------------------------------------------------------------------ */
9410 int
9411 ipf_main_soft_fini(softc)
9412         ipf_main_softc_t *softc;
9413 {
9414         (void) ipf_flush(softc, IPL_LOGIPF, FR_INQUE|FR_OUTQUE|FR_INACTIVE);
9415         (void) ipf_flush(softc, IPL_LOGIPF, FR_INQUE|FR_OUTQUE);
9416         (void) ipf_flush(softc, IPL_LOGCOUNT, FR_INQUE|FR_OUTQUE|FR_INACTIVE);
9417         (void) ipf_flush(softc, IPL_LOGCOUNT, FR_INQUE|FR_OUTQUE);
9418
9419         return 0;
9420 }
9421
9422
9423 /* ------------------------------------------------------------------------ */
9424 /* Function:   ipf_main_load                                                */
9425 /* Returns:    0 = success, -1 = failure                                    */
9426 /* Parameters: none                                                         */
9427 /*                                                                          */
9428 /* Handle global initialisation that needs to be done for the base part of  */
9429 /* IPFilter. At present this just amounts to initialising some ICMP lookup  */
9430 /* arrays that get used by the state/NAT code.                              */
9431 /* ------------------------------------------------------------------------ */
9432 int
9433 ipf_main_load()
9434 {
9435         int i;
9436
9437         /* fill icmp reply type table */
9438         for (i = 0; i <= ICMP_MAXTYPE; i++)
9439                 icmpreplytype4[i] = -1;
9440         icmpreplytype4[ICMP_ECHO] = ICMP_ECHOREPLY;
9441         icmpreplytype4[ICMP_TSTAMP] = ICMP_TSTAMPREPLY;
9442         icmpreplytype4[ICMP_IREQ] = ICMP_IREQREPLY;
9443         icmpreplytype4[ICMP_MASKREQ] = ICMP_MASKREPLY;
9444
9445 #ifdef  USE_INET6
9446         /* fill icmp reply type table */
9447         for (i = 0; i <= ICMP6_MAXTYPE; i++)
9448                 icmpreplytype6[i] = -1;
9449         icmpreplytype6[ICMP6_ECHO_REQUEST] = ICMP6_ECHO_REPLY;
9450         icmpreplytype6[ICMP6_MEMBERSHIP_QUERY] = ICMP6_MEMBERSHIP_REPORT;
9451         icmpreplytype6[ICMP6_NI_QUERY] = ICMP6_NI_REPLY;
9452         icmpreplytype6[ND_ROUTER_SOLICIT] = ND_ROUTER_ADVERT;
9453         icmpreplytype6[ND_NEIGHBOR_SOLICIT] = ND_NEIGHBOR_ADVERT;
9454 #endif
9455
9456         return 0;
9457 }
9458
9459
9460 /* ------------------------------------------------------------------------ */
9461 /* Function:   ipf_main_unload                                              */
9462 /* Returns:    0 = success, -1 = failure                                    */
9463 /* Parameters: none                                                         */
9464 /*                                                                          */
9465 /* A null-op function that exists as a placeholder so that the flow in      */
9466 /* other functions is obvious.                                              */
9467 /* ------------------------------------------------------------------------ */
9468 int
9469 ipf_main_unload()
9470 {
9471         return 0;
9472 }
9473
9474
9475 /* ------------------------------------------------------------------------ */
9476 /* Function:   ipf_load_all                                                 */
9477 /* Returns:    0 = success, -1 = failure                                    */
9478 /* Parameters: none                                                         */
9479 /*                                                                          */
9480 /* Work through all of the subsystems inside IPFilter and call the load     */
9481 /* function for each in an order that won't lead to a crash :)              */
9482 /* ------------------------------------------------------------------------ */
9483 int
9484 ipf_load_all()
9485 {
9486         if (ipf_main_load() == -1)
9487                 return -1;
9488
9489         if (ipf_state_main_load() == -1)
9490                 return -1;
9491
9492         if (ipf_nat_main_load() == -1)
9493                 return -1;
9494
9495         if (ipf_frag_main_load() == -1)
9496                 return -1;
9497
9498         if (ipf_auth_main_load() == -1)
9499                 return -1;
9500
9501         if (ipf_proxy_main_load() == -1)
9502                 return -1;
9503
9504         return 0;
9505 }
9506
9507
9508 /* ------------------------------------------------------------------------ */
9509 /* Function:   ipf_unload_all                                               */
9510 /* Returns:    0 = success, -1 = failure                                    */
9511 /* Parameters: none                                                         */
9512 /*                                                                          */
9513 /* Work through all of the subsystems inside IPFilter and call the unload   */
9514 /* function for each in an order that won't lead to a crash :)              */
9515 /* ------------------------------------------------------------------------ */
9516 int
9517 ipf_unload_all()
9518 {
9519         if (ipf_proxy_main_unload() == -1)
9520                 return -1;
9521
9522         if (ipf_auth_main_unload() == -1)
9523                 return -1;
9524
9525         if (ipf_frag_main_unload() == -1)
9526                 return -1;
9527
9528         if (ipf_nat_main_unload() == -1)
9529                 return -1;
9530
9531         if (ipf_state_main_unload() == -1)
9532                 return -1;
9533
9534         if (ipf_main_unload() == -1)
9535                 return -1;
9536
9537         return 0;
9538 }
9539
9540
9541 /* ------------------------------------------------------------------------ */
9542 /* Function:   ipf_create_all                                               */
9543 /* Returns:    NULL = failure, else success                                 */
9544 /* Parameters: arg(I) - pointer to soft context main structure              */
9545 /*                                                                          */
9546 /* Work through all of the subsystems inside IPFilter and call the create   */
9547 /* function for each in an order that won't lead to a crash :)              */
9548 /* ------------------------------------------------------------------------ */
9549 ipf_main_softc_t *
9550 ipf_create_all(arg)
9551         void *arg;
9552 {
9553         ipf_main_softc_t *softc;
9554
9555         softc = ipf_main_soft_create(arg);
9556         if (softc == NULL)
9557                 return NULL;
9558
9559 #ifdef IPFILTER_LOG
9560         softc->ipf_log_soft = ipf_log_soft_create(softc);
9561         if (softc->ipf_log_soft == NULL) {
9562                 ipf_destroy_all(softc);
9563                 return NULL;
9564         }
9565 #endif
9566
9567         softc->ipf_lookup_soft = ipf_lookup_soft_create(softc);
9568         if (softc->ipf_lookup_soft == NULL) {
9569                 ipf_destroy_all(softc);
9570                 return NULL;
9571         }
9572
9573         softc->ipf_sync_soft = ipf_sync_soft_create(softc);
9574         if (softc->ipf_sync_soft == NULL) {
9575                 ipf_destroy_all(softc);
9576                 return NULL;
9577         }
9578
9579         softc->ipf_state_soft = ipf_state_soft_create(softc);
9580         if (softc->ipf_state_soft == NULL) {
9581                 ipf_destroy_all(softc);
9582                 return NULL;
9583         }
9584
9585         softc->ipf_nat_soft = ipf_nat_soft_create(softc);
9586         if (softc->ipf_nat_soft == NULL) {
9587                 ipf_destroy_all(softc);
9588                 return NULL;
9589         }
9590
9591         softc->ipf_frag_soft = ipf_frag_soft_create(softc);
9592         if (softc->ipf_frag_soft == NULL) {
9593                 ipf_destroy_all(softc);
9594                 return NULL;
9595         }
9596
9597         softc->ipf_auth_soft = ipf_auth_soft_create(softc);
9598         if (softc->ipf_auth_soft == NULL) {
9599                 ipf_destroy_all(softc);
9600                 return NULL;
9601         }
9602
9603         softc->ipf_proxy_soft = ipf_proxy_soft_create(softc);
9604         if (softc->ipf_proxy_soft == NULL) {
9605                 ipf_destroy_all(softc);
9606                 return NULL;
9607         }
9608
9609         return softc;
9610 }
9611
9612
9613 /* ------------------------------------------------------------------------ */
9614 /* Function:   ipf_destroy_all                                              */
9615 /* Returns:    void                                                         */
9616 /* Parameters: softc(I) - pointer to soft context main structure            */
9617 /*                                                                          */
9618 /* Work through all of the subsystems inside IPFilter and call the destroy  */
9619 /* function for each in an order that won't lead to a crash :)              */
9620 /*                                                                          */
9621 /* Every one of these functions is expected to succeed, so there is no      */
9622 /* checking of return values.                                               */
9623 /* ------------------------------------------------------------------------ */
9624 void
9625 ipf_destroy_all(softc)
9626         ipf_main_softc_t *softc;
9627 {
9628
9629         if (softc->ipf_state_soft != NULL) {
9630                 ipf_state_soft_destroy(softc, softc->ipf_state_soft);
9631                 softc->ipf_state_soft = NULL;
9632         }
9633
9634         if (softc->ipf_nat_soft != NULL) {
9635                 ipf_nat_soft_destroy(softc, softc->ipf_nat_soft);
9636                 softc->ipf_nat_soft = NULL;
9637         }
9638
9639         if (softc->ipf_frag_soft != NULL) {
9640                 ipf_frag_soft_destroy(softc, softc->ipf_frag_soft);
9641                 softc->ipf_frag_soft = NULL;
9642         }
9643
9644         if (softc->ipf_auth_soft != NULL) {
9645                 ipf_auth_soft_destroy(softc, softc->ipf_auth_soft);
9646                 softc->ipf_auth_soft = NULL;
9647         }
9648
9649         if (softc->ipf_proxy_soft != NULL) {
9650                 ipf_proxy_soft_destroy(softc, softc->ipf_proxy_soft);
9651                 softc->ipf_proxy_soft = NULL;
9652         }
9653
9654         if (softc->ipf_sync_soft != NULL) {
9655                 ipf_sync_soft_destroy(softc, softc->ipf_sync_soft);
9656                 softc->ipf_sync_soft = NULL;
9657         }
9658
9659         if (softc->ipf_lookup_soft != NULL) {
9660                 ipf_lookup_soft_destroy(softc, softc->ipf_lookup_soft);
9661                 softc->ipf_lookup_soft = NULL;
9662         }
9663
9664 #ifdef IPFILTER_LOG
9665         if (softc->ipf_log_soft != NULL) {
9666                 ipf_log_soft_destroy(softc, softc->ipf_log_soft);
9667                 softc->ipf_log_soft = NULL;
9668         }
9669 #endif
9670
9671         ipf_main_soft_destroy(softc);
9672 }
9673
9674
9675 /* ------------------------------------------------------------------------ */
9676 /* Function:   ipf_init_all                                                 */
9677 /* Returns:    0 = success, -1 = failure                                    */
9678 /* Parameters: softc(I) - pointer to soft context main structure            */
9679 /*                                                                          */
9680 /* Work through all of the subsystems inside IPFilter and call the init     */
9681 /* function for each in an order that won't lead to a crash :)              */
9682 /* ------------------------------------------------------------------------ */
9683 int
9684 ipf_init_all(softc)
9685         ipf_main_softc_t *softc;
9686 {
9687
9688         if (ipf_main_soft_init(softc) == -1)
9689                 return -1;
9690
9691 #ifdef IPFILTER_LOG
9692         if (ipf_log_soft_init(softc, softc->ipf_log_soft) == -1)
9693                 return -1;
9694 #endif
9695
9696         if (ipf_lookup_soft_init(softc, softc->ipf_lookup_soft) == -1)
9697                 return -1;
9698
9699         if (ipf_sync_soft_init(softc, softc->ipf_sync_soft) == -1)
9700                 return -1;
9701
9702         if (ipf_state_soft_init(softc, softc->ipf_state_soft) == -1)
9703                 return -1;
9704
9705         if (ipf_nat_soft_init(softc, softc->ipf_nat_soft) == -1)
9706                 return -1;
9707
9708         if (ipf_frag_soft_init(softc, softc->ipf_frag_soft) == -1)
9709                 return -1;
9710
9711         if (ipf_auth_soft_init(softc, softc->ipf_auth_soft) == -1)
9712                 return -1;
9713
9714         if (ipf_proxy_soft_init(softc, softc->ipf_proxy_soft) == -1)
9715                 return -1;
9716
9717         return 0;
9718 }
9719
9720
9721 /* ------------------------------------------------------------------------ */
9722 /* Function:   ipf_fini_all                                                 */
9723 /* Returns:    0 = success, -1 = failure                                    */
9724 /* Parameters: softc(I) - pointer to soft context main structure            */
9725 /*                                                                          */
9726 /* Work through all of the subsystems inside IPFilter and call the fini     */
9727 /* function for each in an order that won't lead to a crash :)              */
9728 /* ------------------------------------------------------------------------ */
9729 int
9730 ipf_fini_all(softc)
9731         ipf_main_softc_t *softc;
9732 {
9733
9734         ipf_token_flush(softc);
9735
9736         if (ipf_proxy_soft_fini(softc, softc->ipf_proxy_soft) == -1)
9737                 return -1;
9738
9739         if (ipf_auth_soft_fini(softc, softc->ipf_auth_soft) == -1)
9740                 return -1;
9741
9742         if (ipf_frag_soft_fini(softc, softc->ipf_frag_soft) == -1)
9743                 return -1;
9744
9745         if (ipf_nat_soft_fini(softc, softc->ipf_nat_soft) == -1)
9746                 return -1;
9747
9748         if (ipf_state_soft_fini(softc, softc->ipf_state_soft) == -1)
9749                 return -1;
9750
9751         if (ipf_sync_soft_fini(softc, softc->ipf_sync_soft) == -1)
9752                 return -1;
9753
9754         if (ipf_lookup_soft_fini(softc, softc->ipf_lookup_soft) == -1)
9755                 return -1;
9756
9757 #ifdef IPFILTER_LOG
9758         if (ipf_log_soft_fini(softc, softc->ipf_log_soft) == -1)
9759                 return -1;
9760 #endif
9761
9762         if (ipf_main_soft_fini(softc) == -1)
9763                 return -1;
9764
9765         return 0;
9766 }
9767
9768
9769 /* ------------------------------------------------------------------------ */
9770 /* Function:    ipf_rule_expire                                             */
9771 /* Returns:     Nil                                                         */
9772 /* Parameters:  softc(I) - pointer to soft context main structure           */
9773 /*                                                                          */
9774 /* At present this function exists just to support temporary addition of    */
9775 /* firewall rules. Both inactive and active lists are scanned for items to  */
9776 /* purge, as by rights, the expiration is computed as soon as the rule is   */
9777 /* loaded in.                                                               */
9778 /* ------------------------------------------------------------------------ */
9779 void
9780 ipf_rule_expire(softc)
9781         ipf_main_softc_t *softc;
9782 {
9783         frentry_t *fr;
9784
9785         if ((softc->ipf_rule_explist[0] == NULL) &&
9786             (softc->ipf_rule_explist[1] == NULL))
9787                 return;
9788
9789         WRITE_ENTER(&softc->ipf_mutex);
9790
9791         while ((fr = softc->ipf_rule_explist[0]) != NULL) {
9792                 /*
9793                  * Because the list is kept sorted on insertion, the fist
9794                  * one that dies in the future means no more work to do.
9795                  */
9796                 if (fr->fr_die > softc->ipf_ticks)
9797                         break;
9798                 ipf_rule_delete(softc, fr, IPL_LOGIPF, 0);
9799         }
9800
9801         while ((fr = softc->ipf_rule_explist[1]) != NULL) {
9802                 /*
9803                  * Because the list is kept sorted on insertion, the fist
9804                  * one that dies in the future means no more work to do.
9805                  */
9806                 if (fr->fr_die > softc->ipf_ticks)
9807                         break;
9808                 ipf_rule_delete(softc, fr, IPL_LOGIPF, 1);
9809         }
9810
9811         RWLOCK_EXIT(&softc->ipf_mutex);
9812 }
9813
9814
9815 static int ipf_ht_node_cmp __P((struct host_node_s *, struct host_node_s *));
9816 static void ipf_ht_node_make_key __P((host_track_t *, host_node_t *, int,
9817                                       i6addr_t *));
9818
9819 host_node_t RBI_ZERO(ipf_rb);
9820 RBI_CODE(ipf_rb, host_node_t, hn_entry, ipf_ht_node_cmp)
9821
9822
9823 /* ------------------------------------------------------------------------ */
9824 /* Function:    ipf_ht_node_cmp                                             */
9825 /* Returns:     int   - 0 == nodes are the same, ..                         */
9826 /* Parameters:  k1(I) - pointer to first key to compare                     */
9827 /*              k2(I) - pointer to second key to compare                    */
9828 /*                                                                          */
9829 /* The "key" for the node is a combination of two fields: the address       */
9830 /* family and the address itself.                                           */
9831 /*                                                                          */
9832 /* Because we're not actually interpreting the address data, it isn't       */
9833 /* necessary to convert them to/from network/host byte order. The mask is   */
9834 /* just used to remove bits that aren't significant - it doesn't matter     */
9835 /* where they are, as long as they're always in the same place.             */
9836 /*                                                                          */
9837 /* As with IP6_EQ, comparing IPv6 addresses starts at the bottom because    */
9838 /* this is where individual ones will differ the most - but not true for    */
9839 /* for /48's, etc.                                                          */
9840 /* ------------------------------------------------------------------------ */
9841 static int
9842 ipf_ht_node_cmp(k1, k2)
9843         struct host_node_s *k1, *k2;
9844 {
9845         int i;
9846
9847         i = (k2->hn_addr.adf_family - k1->hn_addr.adf_family);
9848         if (i != 0)
9849                 return i;
9850
9851         if (k1->hn_addr.adf_family == AF_INET)
9852                 return (k2->hn_addr.adf_addr.in4.s_addr -
9853                         k1->hn_addr.adf_addr.in4.s_addr);
9854
9855         i = k2->hn_addr.adf_addr.i6[3] - k1->hn_addr.adf_addr.i6[3];
9856         if (i != 0)
9857                 return i;
9858         i = k2->hn_addr.adf_addr.i6[2] - k1->hn_addr.adf_addr.i6[2];
9859         if (i != 0)
9860                 return i;
9861         i = k2->hn_addr.adf_addr.i6[1] - k1->hn_addr.adf_addr.i6[1];
9862         if (i != 0)
9863                 return i;
9864         i = k2->hn_addr.adf_addr.i6[0] - k1->hn_addr.adf_addr.i6[0];
9865         return i;
9866 }
9867
9868
9869 /* ------------------------------------------------------------------------ */
9870 /* Function:    ipf_ht_node_make_key                                        */
9871 /* Returns:     Nil                                                         */
9872 /* parameters:  htp(I)    - pointer to address tracking structure           */
9873 /*              key(I)    - where to store masked address for lookup        */
9874 /*              family(I) - protocol family of address                      */
9875 /*              addr(I)   - pointer to network address                      */
9876 /*                                                                          */
9877 /* Using the "netmask" (number of bits) stored parent host tracking struct, */
9878 /* copy the address passed in into the key structure whilst masking out the */
9879 /* bits that we don't want.                                                 */
9880 /*                                                                          */
9881 /* Because the parser will set ht_netmask to 128 if there is no protocol    */
9882 /* specified (the parser doesn't know if it should be a v4 or v6 rule), we  */
9883 /* have to be wary of that and not allow 32-128 to happen.                  */
9884 /* ------------------------------------------------------------------------ */
9885 static void
9886 ipf_ht_node_make_key(htp, key, family, addr)
9887         host_track_t *htp;
9888         host_node_t *key;
9889         int family;
9890         i6addr_t *addr;
9891 {
9892         key->hn_addr.adf_family = family;
9893         if (family == AF_INET) {
9894                 u_32_t mask;
9895                 int bits;
9896
9897                 key->hn_addr.adf_len = sizeof(key->hn_addr.adf_addr.in4);
9898                 bits = htp->ht_netmask;
9899                 if (bits >= 32) {
9900                         mask = 0xffffffff;
9901                 } else {
9902                         mask = htonl(0xffffffff << (32 - bits));
9903                 }
9904                 key->hn_addr.adf_addr.in4.s_addr = addr->in4.s_addr & mask;
9905 #ifdef USE_INET6
9906         } else {
9907                 int bits = htp->ht_netmask;
9908
9909                 key->hn_addr.adf_len = sizeof(key->hn_addr.adf_addr.in6);
9910                 if (bits > 96) {
9911                         key->hn_addr.adf_addr.i6[3] = addr->i6[3] &
9912                                              htonl(0xffffffff << (128 - bits));
9913                         key->hn_addr.adf_addr.i6[2] = addr->i6[2];
9914                         key->hn_addr.adf_addr.i6[1] = addr->i6[2];
9915                         key->hn_addr.adf_addr.i6[0] = addr->i6[2];
9916                 } else if (bits > 64) {
9917                         key->hn_addr.adf_addr.i6[3] = 0;
9918                         key->hn_addr.adf_addr.i6[2] = addr->i6[2] &
9919                                              htonl(0xffffffff << (96 - bits));
9920                         key->hn_addr.adf_addr.i6[1] = addr->i6[1];
9921                         key->hn_addr.adf_addr.i6[0] = addr->i6[0];
9922                 } else if (bits > 32) {
9923                         key->hn_addr.adf_addr.i6[3] = 0;
9924                         key->hn_addr.adf_addr.i6[2] = 0;
9925                         key->hn_addr.adf_addr.i6[1] = addr->i6[1] &
9926                                              htonl(0xffffffff << (64 - bits));
9927                         key->hn_addr.adf_addr.i6[0] = addr->i6[0];
9928                 } else {
9929                         key->hn_addr.adf_addr.i6[3] = 0;
9930                         key->hn_addr.adf_addr.i6[2] = 0;
9931                         key->hn_addr.adf_addr.i6[1] = 0;
9932                         key->hn_addr.adf_addr.i6[0] = addr->i6[0] &
9933                                              htonl(0xffffffff << (32 - bits));
9934                 }
9935 #endif
9936         }
9937 }
9938
9939
9940 /* ------------------------------------------------------------------------ */
9941 /* Function:    ipf_ht_node_add                                             */
9942 /* Returns:     int       - 0 == success,  -1 == failure                    */
9943 /* Parameters:  softc(I)  - pointer to soft context main structure          */
9944 /*              htp(I)    - pointer to address tracking structure           */
9945 /*              family(I) - protocol family of address                      */
9946 /*              addr(I)   - pointer to network address                      */
9947 /*                                                                          */
9948 /* NOTE: THIS FUNCTION MUST BE CALLED WITH AN EXCLUSIVE LOCK THAT PREVENTS  */
9949 /*       ipf_ht_node_del FROM RUNNING CONCURRENTLY ON THE SAME htp.         */
9950 /*                                                                          */
9951 /* After preparing the key with the address information to find, look in    */
9952 /* the red-black tree to see if the address is known. A successful call to  */
9953 /* this function can mean one of two things: a new node was added to the    */
9954 /* tree or a matching node exists and we're able to bump up its activity.   */
9955 /* ------------------------------------------------------------------------ */
9956 int
9957 ipf_ht_node_add(softc, htp, family, addr)
9958         ipf_main_softc_t *softc;
9959         host_track_t *htp;
9960         int family;
9961         i6addr_t *addr;
9962 {
9963         host_node_t *h;
9964         host_node_t k;
9965
9966         ipf_ht_node_make_key(htp, &k, family, addr);
9967
9968         h = RBI_SEARCH(ipf_rb, &htp->ht_root, &k);
9969         if (h == NULL) {
9970                 if (htp->ht_cur_nodes >= htp->ht_max_nodes)
9971                         return -1;
9972                 KMALLOC(h, host_node_t *);
9973                 if (h == NULL) {
9974                         DT(ipf_rb_no_mem);
9975                         LBUMP(ipf_rb_no_mem);
9976                         return -1;
9977                 }
9978
9979                 /*
9980                  * If there was a macro to initialise the RB node then that
9981                  * would get used here, but there isn't...
9982                  */
9983                 bzero((char *)h, sizeof(*h));
9984                 h->hn_addr = k.hn_addr;
9985                 h->hn_addr.adf_family = k.hn_addr.adf_family;
9986                 RBI_INSERT(ipf_rb, &htp->ht_root, h);
9987                 htp->ht_cur_nodes++;
9988         } else {
9989                 if ((htp->ht_max_per_node != 0) &&
9990                     (h->hn_active >= htp->ht_max_per_node)) {
9991                         DT(ipf_rb_node_max);
9992                         LBUMP(ipf_rb_node_max);
9993                         return -1;
9994                 }
9995         }
9996
9997         h->hn_active++;
9998
9999         return 0;
10000 }
10001
10002
10003 /* ------------------------------------------------------------------------ */
10004 /* Function:    ipf_ht_node_del                                             */
10005 /* Returns:     int       - 0 == success,  -1 == failure                    */
10006 /* parameters:  htp(I)    - pointer to address tracking structure           */
10007 /*              family(I) - protocol family of address                      */
10008 /*              addr(I)   - pointer to network address                      */
10009 /*                                                                          */
10010 /* NOTE: THIS FUNCTION MUST BE CALLED WITH AN EXCLUSIVE LOCK THAT PREVENTS  */
10011 /*       ipf_ht_node_add FROM RUNNING CONCURRENTLY ON THE SAME htp.         */
10012 /*                                                                          */
10013 /* Try and find the address passed in amongst the leavese on this tree to   */
10014 /* be friend. If found then drop the active account for that node drops by  */
10015 /* one. If that count reaches 0, it is time to free it all up.              */
10016 /* ------------------------------------------------------------------------ */
10017 int
10018 ipf_ht_node_del(htp, family, addr)
10019         host_track_t *htp;
10020         int family;
10021         i6addr_t *addr;
10022 {
10023         host_node_t *h;
10024         host_node_t k;
10025
10026         ipf_ht_node_make_key(htp, &k, family, addr);
10027
10028         h = RBI_SEARCH(ipf_rb, &htp->ht_root, &k);
10029         if (h == NULL) {
10030                 return -1;
10031         } else {
10032                 h->hn_active--;
10033                 if (h->hn_active == 0) {
10034                         (void) RBI_DELETE(ipf_rb, &htp->ht_root, h);
10035                         htp->ht_cur_nodes--;
10036                         KFREE(h);
10037                 }
10038         }
10039
10040         return 0;
10041 }
10042
10043
10044 /* ------------------------------------------------------------------------ */
10045 /* Function:    ipf_rb_ht_init                                              */
10046 /* Returns:     Nil                                                         */
10047 /* Parameters:  head(I) - pointer to host tracking structure                */
10048 /*                                                                          */
10049 /* Initialise the host tracking structure to be ready for use above.        */
10050 /* ------------------------------------------------------------------------ */
10051 void
10052 ipf_rb_ht_init(head)
10053         host_track_t *head;
10054 {
10055         RBI_INIT(ipf_rb, &head->ht_root);
10056 }
10057
10058
10059 /* ------------------------------------------------------------------------ */
10060 /* Function:    ipf_rb_ht_freenode                                          */
10061 /* Returns:     Nil                                                         */
10062 /* Parameters:  head(I) - pointer to host tracking structure                */
10063 /*              arg(I)  - additional argument from walk caller              */
10064 /*                                                                          */
10065 /* Free an actual host_node_t structure.                                    */
10066 /* ------------------------------------------------------------------------ */
10067 void
10068 ipf_rb_ht_freenode(node, arg)
10069         host_node_t *node;
10070         void *arg;
10071 {
10072         KFREE(node);
10073 }
10074
10075
10076 /* ------------------------------------------------------------------------ */
10077 /* Function:    ipf_rb_ht_flush                                             */
10078 /* Returns:     Nil                                                         */
10079 /* Parameters:  head(I) - pointer to host tracking structure                */
10080 /*                                                                          */
10081 /* Remove all of the nodes in the tree tracking hosts by calling a walker   */
10082 /* and free'ing each one.                                                   */
10083 /* ------------------------------------------------------------------------ */
10084 void
10085 ipf_rb_ht_flush(head)
10086         host_track_t *head;
10087 {
10088         RBI_WALK(ipf_rb, &head->ht_root, ipf_rb_ht_freenode, NULL);
10089 }
10090
10091
10092 /* ------------------------------------------------------------------------ */
10093 /* Function:    ipf_slowtimer                                               */
10094 /* Returns:     Nil                                                         */
10095 /* Parameters:  ptr(I) - pointer to main ipf soft context structure         */
10096 /*                                                                          */
10097 /* Slowly expire held state for fragments.  Timeouts are set * in           */
10098 /* expectation of this being called twice per second.                       */
10099 /* ------------------------------------------------------------------------ */
10100 void
10101 ipf_slowtimer(softc)
10102         ipf_main_softc_t *softc;
10103 {
10104
10105         ipf_token_expire(softc);
10106         ipf_frag_expire(softc);
10107         ipf_state_expire(softc);
10108         ipf_nat_expire(softc);
10109         ipf_auth_expire(softc);
10110         ipf_lookup_expire(softc);
10111         ipf_rule_expire(softc);
10112         ipf_sync_expire(softc);
10113         softc->ipf_ticks++;
10114 #   if defined(__OpenBSD__)
10115         timeout_add(&ipf_slowtimer_ch, hz/2);
10116 #   endif
10117 }
10118
10119
10120 /* ------------------------------------------------------------------------ */
10121 /* Function:    ipf_inet_mask_add                                           */
10122 /* Returns:     Nil                                                         */
10123 /* Parameters:  bits(I) - pointer to nat context information                */
10124 /*              mtab(I) - pointer to mask hash table structure              */
10125 /*                                                                          */
10126 /* When called, bits represents the mask of a new NAT rule that has just    */
10127 /* been added. This function inserts a bitmask into the array of masks to   */
10128 /* search when searching for a matching NAT rule for a packet.              */
10129 /* Prevention of duplicate masks is achieved by checking the use count for  */
10130 /* a given netmask.                                                         */
10131 /* ------------------------------------------------------------------------ */
10132 void
10133 ipf_inet_mask_add(bits, mtab)
10134         int bits;
10135         ipf_v4_masktab_t *mtab;
10136 {
10137         u_32_t mask;
10138         int i, j;
10139
10140         mtab->imt4_masks[bits]++;
10141         if (mtab->imt4_masks[bits] > 1)
10142                 return;
10143
10144         if (bits == 0)
10145                 mask = 0;
10146         else
10147                 mask = 0xffffffff << (32 - bits);
10148
10149         for (i = 0; i < 33; i++) {
10150                 if (ntohl(mtab->imt4_active[i]) < mask) {
10151                         for (j = 32; j > i; j--)
10152                                 mtab->imt4_active[j] = mtab->imt4_active[j - 1];
10153                         mtab->imt4_active[i] = htonl(mask);
10154                         break;
10155                 }
10156         }
10157         mtab->imt4_max++;
10158 }
10159
10160
10161 /* ------------------------------------------------------------------------ */
10162 /* Function:    ipf_inet_mask_del                                           */
10163 /* Returns:     Nil                                                         */
10164 /* Parameters:  bits(I) - number of bits set in the netmask                 */
10165 /*              mtab(I) - pointer to mask hash table structure              */
10166 /*                                                                          */
10167 /* Remove the 32bit bitmask represented by "bits" from the collection of    */
10168 /* netmasks stored inside of mtab.                                          */
10169 /* ------------------------------------------------------------------------ */
10170 void
10171 ipf_inet_mask_del(bits, mtab)
10172         int bits;
10173         ipf_v4_masktab_t *mtab;
10174 {
10175         u_32_t mask;
10176         int i, j;
10177
10178         mtab->imt4_masks[bits]--;
10179         if (mtab->imt4_masks[bits] > 0)
10180                 return;
10181
10182         mask = htonl(0xffffffff << (32 - bits));
10183         for (i = 0; i < 33; i++) {
10184                 if (mtab->imt4_active[i] == mask) {
10185                         for (j = i + 1; j < 33; j++)
10186                                 mtab->imt4_active[j - 1] = mtab->imt4_active[j];
10187                         break;
10188                 }
10189         }
10190         mtab->imt4_max--;
10191         ASSERT(mtab->imt4_max >= 0);
10192 }
10193
10194
10195 #ifdef USE_INET6
10196 /* ------------------------------------------------------------------------ */
10197 /* Function:    ipf_inet6_mask_add                                          */
10198 /* Returns:     Nil                                                         */
10199 /* Parameters:  bits(I) - number of bits set in mask                        */
10200 /*              mask(I) - pointer to mask to add                            */
10201 /*              mtab(I) - pointer to mask hash table structure              */
10202 /*                                                                          */
10203 /* When called, bitcount represents the mask of a IPv6 NAT map rule that    */
10204 /* has just been added. This function inserts a bitmask into the array of   */
10205 /* masks to search when searching for a matching NAT rule for a packet.     */
10206 /* Prevention of duplicate masks is achieved by checking the use count for  */
10207 /* a given netmask.                                                         */
10208 /* ------------------------------------------------------------------------ */
10209 void
10210 ipf_inet6_mask_add(bits, mask, mtab)
10211         int bits;
10212         i6addr_t *mask;
10213         ipf_v6_masktab_t *mtab;
10214 {
10215         i6addr_t zero;
10216         int i, j;
10217
10218         mtab->imt6_masks[bits]++;
10219         if (mtab->imt6_masks[bits] > 1)
10220                 return;
10221
10222         if (bits == 0) {
10223                 mask = &zero;
10224                 zero.i6[0] = 0;
10225                 zero.i6[1] = 0;
10226                 zero.i6[2] = 0;
10227                 zero.i6[3] = 0;
10228         }
10229
10230         for (i = 0; i < 129; i++) {
10231                 if (IP6_LT(&mtab->imt6_active[i], mask)) {
10232                         for (j = 128; j > i; j--)
10233                                 mtab->imt6_active[j] = mtab->imt6_active[j - 1];
10234                         mtab->imt6_active[i] = *mask;
10235                         break;
10236                 }
10237         }
10238         mtab->imt6_max++;
10239 }
10240
10241
10242 /* ------------------------------------------------------------------------ */
10243 /* Function:    ipf_inet6_mask_del                                          */
10244 /* Returns:     Nil                                                         */
10245 /* Parameters:  bits(I) - number of bits set in mask                        */
10246 /*              mask(I) - pointer to mask to remove                         */
10247 /*              mtab(I) - pointer to mask hash table structure              */
10248 /*                                                                          */
10249 /* Remove the 128bit bitmask represented by "bits" from the collection of   */
10250 /* netmasks stored inside of mtab.                                          */
10251 /* ------------------------------------------------------------------------ */
10252 void
10253 ipf_inet6_mask_del(bits, mask, mtab)
10254         int bits;
10255         i6addr_t *mask;
10256         ipf_v6_masktab_t *mtab;
10257 {
10258         i6addr_t zero;
10259         int i, j;
10260
10261         mtab->imt6_masks[bits]--;
10262         if (mtab->imt6_masks[bits] > 0)
10263                 return;
10264
10265         if (bits == 0)
10266                 mask = &zero;
10267         zero.i6[0] = 0;
10268         zero.i6[1] = 0;
10269         zero.i6[2] = 0;
10270         zero.i6[3] = 0;
10271
10272         for (i = 0; i < 129; i++) {
10273                 if (IP6_EQ(&mtab->imt6_active[i], mask)) {
10274                         for (j = i + 1; j < 129; j++) {
10275                                 mtab->imt6_active[j - 1] = mtab->imt6_active[j];
10276                                 if (IP6_EQ(&mtab->imt6_active[j - 1], &zero))
10277                                         break;
10278                         }
10279                         break;
10280                 }
10281         }
10282         mtab->imt6_max--;
10283         ASSERT(mtab->imt6_max >= 0);
10284 }
10285 #endif