2 * Copyright (C) 2012 by Darren Reed.
4 * See the IPFILTER.LICENCE file for details on licencing.
6 #if defined(KERNEL) || defined(_KERNEL)
12 #include <sys/param.h>
13 #include <sys/types.h>
15 #include <sys/errno.h>
23 # include <sys/systm.h>
25 # include <sys/mbuf.h>
28 #include <sys/socket.h>
29 # include <sys/ioccom.h>
31 # include <sys/filio.h>
32 # include <sys/malloc.h>
34 # include <sys/ioctl.h>
37 #include <netinet/in.h>
38 #include <netinet/in_systm.h>
39 #include <netinet/ip.h>
40 #include <netinet/tcp.h>
45 #include "netinet/ip_compat.h"
46 #include "netinet/ip_fil.h"
47 #include "netinet/ip_state.h"
48 #include "netinet/ip_scan.h"
52 static const char sccsid[] = "@(#)ip_state.c 1.8 6/5/96 (C) 1993-2000 Darren Reed";
53 static const char rcsid[] = "@(#)$Id$";
56 #ifdef IPFILTER_SCAN /* endif at bottom of file */
59 ipscan_t *ipf_scan_list = NULL,
60 *ipf_scan_tail = NULL;
61 ipscanstat_t ipf_scan_stat;
63 ipfrwlock_t ipf_scan_rwlock;
67 # define isalpha(x) (((x) >= 'A' && 'Z' >= (x)) || \
68 ((x) >= 'a' && 'z' >= (x)))
72 int ipf_scan_add __P((caddr_t));
73 int ipf_scan_remove __P((caddr_t));
74 struct ipscan *ipf_scan_lookup __P((char *));
75 int ipf_scan_matchstr __P((sinfo_t *, char *, int));
76 int ipf_scan_matchisc __P((ipscan_t *, ipstate_t *, int, int, int *));
77 int ipf_scan_match __P((ipstate_t *));
79 static int ipf_scan_inited = 0;
85 RWLOCK_INIT(&ipf_scan_rwlock, "ip scan rwlock");
92 ipf_scan_unload(ipf_main_softc_t *arg)
94 if (ipf_scan_inited == 1) {
95 RW_DESTROY(&ipf_scan_rwlock);
108 KMALLOC(isc, ipscan_t *);
110 ipf_interror = 90001;
114 err = copyinptr(data, isc, sizeof(*isc));
120 WRITE_ENTER(&ipf_scan_rwlock);
122 i = ipf_scan_lookup(isc->ipsc_tag);
124 RWLOCK_EXIT(&ipf_scan_rwlock);
126 ipf_interror = 90002;
131 ipf_scan_tail->ipsc_next = isc;
132 isc->ipsc_pnext = &ipf_scan_tail->ipsc_next;
137 isc->ipsc_pnext = &ipf_scan_list;
139 isc->ipsc_next = NULL;
144 isc->ipsc_active = 0;
146 ipf_scan_stat.iscs_entries++;
147 RWLOCK_EXIT(&ipf_scan_rwlock);
153 ipf_scan_remove(data)
159 err = copyinptr(data, &isc, sizeof(isc));
163 WRITE_ENTER(&ipf_scan_rwlock);
165 i = ipf_scan_lookup(isc.ipsc_tag);
170 RWLOCK_EXIT(&ipf_scan_rwlock);
171 ipf_interror = 90003;
175 *i->ipsc_pnext = i->ipsc_next;
177 i->ipsc_next->ipsc_pnext = i->ipsc_pnext;
179 if (i->ipsc_pnext == &ipf_scan_list)
180 ipf_scan_tail = NULL;
182 ipf_scan_tail = *(*i->ipsc_pnext)->ipsc_pnext;
185 ipf_scan_stat.iscs_entries--;
188 RWLOCK_EXIT(&ipf_scan_rwlock);
199 for (i = ipf_scan_list; i; i = i->ipsc_next)
200 if (!strcmp(i->ipsc_tag, tag))
207 ipf_scan_attachfr(fr)
212 if (fr->fr_isctag != -1) {
213 READ_ENTER(&ipf_scan_rwlock);
214 i = ipf_scan_lookup(fr->fr_isctag + fr->fr_names);
216 ATOMIC_INC32(i->ipsc_fref);
218 RWLOCK_EXIT(&ipf_scan_rwlock);
220 ipf_interror = 90004;
230 ipf_scan_attachis(is)
236 READ_ENTER(&ipf_scan_rwlock);
240 if ((i != NULL) && (i != (ipscan_t *)-1)) {
242 ATOMIC_INC32(i->ipsc_sref);
244 is->is_flags |= IS_SC_CLIENT;
246 is->is_flags |= IS_SC_MATCHC;
248 is->is_flags |= IS_SC_SERVER;
250 is->is_flags |= IS_SC_MATCHS;
253 RWLOCK_EXIT(&ipf_scan_rwlock);
259 ipf_scan_detachfr(fr)
266 ATOMIC_DEC32(i->ipsc_fref);
273 ipf_scan_detachis(is)
278 READ_ENTER(&ipf_scan_rwlock);
279 if ((i = is->is_isc) && (i != (ipscan_t *)-1)) {
280 ATOMIC_DEC32(i->ipsc_sref);
282 is->is_flags &= ~(IS_SC_CLIENT|IS_SC_SERVER);
284 RWLOCK_EXIT(&ipf_scan_rwlock);
290 * 'string' compare for scanning
293 ipf_scan_matchstr(sp, str, n)
305 for (s = sp->s_txt, t = sp->s_msk; i; i--, s++, t++, up++)
313 if (!ISALPHA(*up) || ((*s & 0x5f) != (*up & 0x5f)))
324 * Returns 3 if both server and client match, 2 if just server,
328 ipf_scan_matchisc(isc, is, cl, sl, maxm)
333 int i, j, k, n, ret = 0, flags;
335 flags = is->is_flags;
338 * If we've already matched more than what is on offer, then
339 * assume we have a better match already and forget this one.
342 if (isc->ipsc_clen < maxm[0])
344 if (isc->ipsc_slen < maxm[1])
355 else if (((flags & (IS_SC_MATCHC|IS_SC_CLIENT)) == IS_SC_CLIENT) &&
356 cl && isc->ipsc_clen) {
358 n = MIN(cl, isc->ipsc_clen);
359 if ((n > 0) && (!maxm || (n >= maxm[1]))) {
360 if (!ipf_scan_matchstr(&isc->ipsc_cl,
361 is->is_sbuf[0], n)) {
372 else if (((flags & (IS_SC_MATCHS|IS_SC_SERVER)) == IS_SC_SERVER) &&
373 sl && isc->ipsc_slen) {
375 n = MIN(cl, isc->ipsc_slen);
376 if ((n > 0) && (!maxm || (n >= maxm[1]))) {
377 if (!ipf_scan_matchstr(&isc->ipsc_sl,
378 is->is_sbuf[1], n)) {
387 if (maxm && (ret == 3)) {
399 int i, j, k, n, cl, sl, maxm[2];
403 for (cl = 0, n = is->is_smsk[0]; n & 1; n >>= 1)
405 for (sl = 0, n = is->is_smsk[1]; n & 1; n >>= 1)
412 * Known object to scan for.
414 i = ipf_scan_matchisc(isc, is, cl, sl, NULL);
416 is->is_flags |= IS_SC_MATCHC;
417 is->is_flags &= ~IS_SC_CLIENT;
418 } else if (cl >= isc->ipsc_clen)
419 is->is_flags &= ~IS_SC_CLIENT;
421 is->is_flags |= IS_SC_MATCHS;
422 is->is_flags &= ~IS_SC_SERVER;
423 } else if (sl >= isc->ipsc_slen)
424 is->is_flags &= ~IS_SC_SERVER;
430 for (k = 0, isc = ipf_scan_list; isc; isc = isc->ipsc_next) {
431 i = ipf_scan_matchisc(isc, is, cl, sl, maxm);
434 * We only want to remember the best match
435 * and the number of times we get a best
438 if ((j == 3) && (i < 3))
440 if ((i == 3) && (j != 3))
454 * No matches or partial matches, so reset the respective
458 is->is_flags &= ~IS_SC_CLIENT;
461 is->is_flags &= ~IS_SC_SERVER;
464 * If we found the best match, then set flags appropriately.
466 if ((j == 3) && (k == 1)) {
467 is->is_flags &= ~(IS_SC_SERVER|IS_SC_CLIENT);
468 is->is_flags |= (IS_SC_MATCHS|IS_SC_MATCHC);
473 * If the acknowledged side of a connection has moved past the data in
474 * which we are interested, then reset respective flag.
476 t = &is->is_tcp.ts_data[0];
477 if (t->td_end > is->is_s0[0] + 15)
478 is->is_flags &= ~IS_SC_CLIENT;
480 t = &is->is_tcp.ts_data[1];
481 if (t->td_end > is->is_s0[1] + 15)
482 is->is_flags &= ~IS_SC_SERVER;
485 * Matching complete ?
488 if ((is->is_flags & IS_SC_MATCHALL) == IS_SC_MATCHALL) {
489 j = isc->ipsc_action;
490 ipf_scan_stat.iscs_acted++;
491 } else if ((is->is_isc != NULL) &&
492 ((is->is_flags & IS_SC_MATCHALL) != IS_SC_MATCHALL) &&
493 !(is->is_flags & (IS_SC_CLIENT|IS_SC_SERVER))) {
498 ipf_scan_stat.iscs_else++;
505 * If as a result of a successful match we are to
506 * close a connection, change the "keep state" info.
507 * to block packets and generate TCP RST's.
509 is->is_pass &= ~FR_RETICMP;
510 is->is_pass |= FR_RETRST;
521 * check if a packet matches what we're scanning for
524 ipf_scan_packet(fin, is)
528 int i, j, rv, dlen, off, thoff;
532 rv = !IP6_EQ(&fin->fin_fi.fi_src, &is->is_src);
534 seq = ntohl(tcp->th_seq);
540 * check if this packet has more data that falls within the first
541 * 16 bytes sent in either direction.
545 if ((off > 15) || (off < 0))
547 thoff = TCP_OFF(tcp) << 2;
548 dlen = fin->fin_dlen - thoff;
556 j = 0xffff >> (16 - dlen);
557 i = (0xffff & j) << off;
559 COPYDATA(*(mb_t **)fin->fin_mp, fin->fin_plen - fin->fin_dlen + thoff,
560 dlen, (caddr_t)is->is_sbuf[rv] + off);
562 is->is_smsk[rv] |= i;
563 for (j = 0, i = is->is_smsk[rv]; i & 1; i >>= 1)
568 (void) ipf_scan_match(is);
571 * There is the potential here for plain text passwords to get
572 * buffered and stored for some time...
574 if (!(is->is_flags & IS_SC_CLIENT))
575 bzero(is->is_sbuf[0], sizeof(is->is_sbuf[0]));
576 if (!(is->is_flags & IS_SC_SERVER))
577 bzero(is->is_sbuf[1], sizeof(is->is_sbuf[1]));
584 ipf_scan_ioctl(data, cmd, mode, uid, ctx)
596 err = ipf_scan_add(data);
599 err = ipf_scan_remove(data);
602 bcopy((char *)&ipf_scan_stat, (char *)&ipscs, sizeof(ipscs));
603 ipscs.iscs_list = ipf_scan_list;
604 err = BCOPYOUT(&ipscs, data, sizeof(ipscs));
606 ipf_interror = 90005;
617 #endif /* IPFILTER_SCAN */