2 * Copyright (c) 2017-2018 Yandex LLC
3 * Copyright (c) 2017-2018 Andrey V. Elsukov <ae@FreeBSD.org>
4 * Copyright (c) 2002 Luigi Rizzo, Universita` di Pisa
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 #include <sys/cdefs.h>
29 __FBSDID("$FreeBSD$");
32 #include "opt_inet6.h"
35 #error IPFIREWALL requires INET.
38 #include <sys/param.h>
39 #include <sys/systm.h>
42 #include <sys/kernel.h>
45 #include <sys/queue.h>
46 #include <sys/rmlock.h>
48 #include <sys/socket.h>
49 #include <sys/sysctl.h>
50 #include <sys/syslog.h>
51 #include <net/ethernet.h>
53 #include <net/if_var.h>
57 #include <netinet/in.h>
58 #include <netinet/ip.h>
59 #include <netinet/ip_var.h>
60 #include <netinet/ip_fw.h>
61 #include <netinet/tcp_var.h>
62 #include <netinet/udp.h>
64 #include <netinet/ip6.h> /* IN6_ARE_ADDR_EQUAL */
66 #include <netinet6/in6_var.h>
67 #include <netinet6/ip6_var.h>
68 #include <netinet6/scope6_var.h>
71 #include <netpfil/ipfw/ip_fw_private.h>
73 #include <machine/in_cksum.h> /* XXX for in_cksum */
76 #include <security/mac/mac_framework.h>
81 * Description of dynamic states.
83 * Dynamic states are stored in lists accessed through a hash tables
84 * whose size is curr_dyn_buckets. This value can be modified through
85 * the sysctl variable dyn_buckets.
87 * Currently there are four tables: dyn_ipv4, dyn_ipv6, dyn_ipv4_parent,
88 * and dyn_ipv6_parent.
90 * When a packet is received, its address fields hashed, then matched
91 * against the entries in the corresponding list by addr_type.
92 * Dynamic states can be used for different purposes:
94 * + enforcing limits on the number of sessions;
95 * + in-kernel NAT (not implemented yet)
97 * The lifetime of dynamic states is regulated by dyn_*_lifetime,
98 * measured in seconds and depending on the flags.
100 * The total number of dynamic states is equal to UMA zone items count.
101 * The max number of dynamic states is dyn_max. When we reach
102 * the maximum number of rules we do not create anymore. This is
103 * done to avoid consuming too much memory, but also too much
104 * time when searching on each packet (ideally, we should try instead
105 * to put a limit on the length of the list on each bucket...).
107 * Each state holds a pointer to the parent ipfw rule so we know what
108 * action to perform. Dynamic rules are removed when the parent rule is
111 * There are some limitations with dynamic rules -- we do not
112 * obey the 'randomized match', and we do not do multiple
113 * passes through the firewall. XXX check the latter!!!
116 /* By default use jenkins hash function */
117 #define IPFIREWALL_JENKINSHASH
119 #define DYN_COUNTER_INC(d, dir, pktlen) do { \
120 (d)->pcnt_ ## dir++; \
121 (d)->bcnt_ ## dir += pktlen; \
124 #define DYN_REFERENCED 0x01
126 * DYN_REFERENCED flag is used to show that state keeps reference to named
127 * object, and this reference should be released when state becomes expired.
131 void *parent; /* pointer to parent rule */
132 uint32_t chain_id; /* cached ruleset id */
133 uint32_t f_pos; /* cached rule index */
135 uint32_t hashval; /* hash value used for hash resize */
136 uint16_t fibnum; /* fib used to send keepalives */
138 uint8_t flags; /* internal flags */
139 uint16_t rulenum; /* parent rule number */
140 uint32_t ruleid; /* parent rule id */
142 uint32_t state; /* TCP session state and flags */
143 uint32_t ack_fwd; /* most recent ACKs in forward */
144 uint32_t ack_rev; /* and reverse direction (used */
145 /* to generate keepalives) */
146 uint32_t sync; /* synchronization time */
147 uint32_t expire; /* expire time */
149 uint64_t pcnt_fwd; /* bytes counter in forward */
150 uint64_t bcnt_fwd; /* packets counter in forward */
151 uint64_t pcnt_rev; /* bytes counter in reverse */
152 uint64_t bcnt_rev; /* packets counter in reverse */
155 #define DPARENT_COUNT_DEC(p) do { \
156 MPASS(p->count > 0); \
157 ck_pr_dec_32(&(p)->count); \
159 #define DPARENT_COUNT_INC(p) ck_pr_inc_32(&(p)->count)
160 #define DPARENT_COUNT(p) ck_pr_load_32(&(p)->count)
162 void *parent; /* pointer to parent rule */
163 uint32_t count; /* number of linked states */
165 uint16_t rulenum; /* parent rule number */
166 uint32_t ruleid; /* parent rule id */
167 uint32_t hashval; /* hash value used for hash resize */
168 uint32_t expire; /* expire time */
171 struct dyn_ipv4_state {
172 uint8_t type; /* State type */
173 uint8_t proto; /* UL Protocol */
174 uint16_t kidx; /* named object index */
175 uint16_t sport, dport; /* ULP source and destination ports */
176 in_addr_t src, dst; /* IPv4 source and destination */
179 struct dyn_data *data;
180 struct dyn_parent *limit;
182 CK_SLIST_ENTRY(dyn_ipv4_state) entry;
183 SLIST_ENTRY(dyn_ipv4_state) expired;
185 CK_SLIST_HEAD(dyn_ipv4ck_slist, dyn_ipv4_state);
186 static VNET_DEFINE(struct dyn_ipv4ck_slist *, dyn_ipv4);
187 static VNET_DEFINE(struct dyn_ipv4ck_slist *, dyn_ipv4_parent);
189 SLIST_HEAD(dyn_ipv4_slist, dyn_ipv4_state);
190 static VNET_DEFINE(struct dyn_ipv4_slist, dyn_expired_ipv4);
191 #define V_dyn_ipv4 VNET(dyn_ipv4)
192 #define V_dyn_ipv4_parent VNET(dyn_ipv4_parent)
193 #define V_dyn_expired_ipv4 VNET(dyn_expired_ipv4)
196 struct dyn_ipv6_state {
197 uint8_t type; /* State type */
198 uint8_t proto; /* UL Protocol */
199 uint16_t kidx; /* named object index */
200 uint16_t sport, dport; /* ULP source and destination ports */
201 struct in6_addr src, dst; /* IPv6 source and destination */
202 uint32_t zoneid; /* IPv6 scope zone id */
204 struct dyn_data *data;
205 struct dyn_parent *limit;
207 CK_SLIST_ENTRY(dyn_ipv6_state) entry;
208 SLIST_ENTRY(dyn_ipv6_state) expired;
210 CK_SLIST_HEAD(dyn_ipv6ck_slist, dyn_ipv6_state);
211 static VNET_DEFINE(struct dyn_ipv6ck_slist *, dyn_ipv6);
212 static VNET_DEFINE(struct dyn_ipv6ck_slist *, dyn_ipv6_parent);
214 SLIST_HEAD(dyn_ipv6_slist, dyn_ipv6_state);
215 static VNET_DEFINE(struct dyn_ipv6_slist, dyn_expired_ipv6);
216 #define V_dyn_ipv6 VNET(dyn_ipv6)
217 #define V_dyn_ipv6_parent VNET(dyn_ipv6_parent)
218 #define V_dyn_expired_ipv6 VNET(dyn_expired_ipv6)
222 * Per-CPU pointer indicates that specified state is currently in use
223 * and must not be reclaimed by expiration callout.
225 static void **dyn_hp_cache;
226 static DPCPU_DEFINE(void *, dyn_hp);
227 #define DYNSTATE_GET(cpu) ck_pr_load_ptr(DPCPU_ID_PTR((cpu), dyn_hp))
228 #define DYNSTATE_PROTECT(v) ck_pr_store_ptr(DPCPU_PTR(dyn_hp), (v))
229 #define DYNSTATE_RELEASE() DYNSTATE_PROTECT(NULL)
230 #define DYNSTATE_CRITICAL_ENTER() critical_enter()
231 #define DYNSTATE_CRITICAL_EXIT() do { \
232 DYNSTATE_RELEASE(); \
237 * We keep two version numbers, one is updated when new entry added to
238 * the list. Second is updated when an entry deleted from the list.
239 * Versions are updated under bucket lock.
241 * Bucket "add" version number is used to know, that in the time between
242 * state lookup (i.e. ipfw_dyn_lookup_state()) and the followed state
243 * creation (i.e. ipfw_dyn_install_state()) another concurrent thread did
244 * not install some state in this bucket. Using this info we can avoid
245 * additional state lookup, because we are sure that we will not install
248 * Also doing the tracking of bucket "del" version during lookup we can
249 * be sure, that state entry was not unlinked and freed in time between
250 * we read the state pointer and protect it with hazard pointer.
252 * An entry unlinked from CK list keeps unchanged until it is freed.
253 * Unlinked entries are linked into expired lists using "expired" field.
257 * dyn_expire_lock is used to protect access to dyn_expired_xxx lists.
258 * dyn_bucket_lock is used to get write access to lists in specific bucket.
259 * Currently one dyn_bucket_lock is used for all ipv4, ipv4_parent, ipv6,
260 * and ipv6_parent lists.
262 static VNET_DEFINE(struct mtx, dyn_expire_lock);
263 static VNET_DEFINE(struct mtx *, dyn_bucket_lock);
264 #define V_dyn_expire_lock VNET(dyn_expire_lock)
265 #define V_dyn_bucket_lock VNET(dyn_bucket_lock)
268 * Bucket's add/delete generation versions.
270 static VNET_DEFINE(uint32_t *, dyn_ipv4_add);
271 static VNET_DEFINE(uint32_t *, dyn_ipv4_del);
272 static VNET_DEFINE(uint32_t *, dyn_ipv4_parent_add);
273 static VNET_DEFINE(uint32_t *, dyn_ipv4_parent_del);
274 #define V_dyn_ipv4_add VNET(dyn_ipv4_add)
275 #define V_dyn_ipv4_del VNET(dyn_ipv4_del)
276 #define V_dyn_ipv4_parent_add VNET(dyn_ipv4_parent_add)
277 #define V_dyn_ipv4_parent_del VNET(dyn_ipv4_parent_del)
280 static VNET_DEFINE(uint32_t *, dyn_ipv6_add);
281 static VNET_DEFINE(uint32_t *, dyn_ipv6_del);
282 static VNET_DEFINE(uint32_t *, dyn_ipv6_parent_add);
283 static VNET_DEFINE(uint32_t *, dyn_ipv6_parent_del);
284 #define V_dyn_ipv6_add VNET(dyn_ipv6_add)
285 #define V_dyn_ipv6_del VNET(dyn_ipv6_del)
286 #define V_dyn_ipv6_parent_add VNET(dyn_ipv6_parent_add)
287 #define V_dyn_ipv6_parent_del VNET(dyn_ipv6_parent_del)
290 #define DYN_BUCKET(h, b) ((h) & (b - 1))
291 #define DYN_BUCKET_VERSION(b, v) ck_pr_load_32(&V_dyn_ ## v[(b)])
292 #define DYN_BUCKET_VERSION_BUMP(b, v) ck_pr_inc_32(&V_dyn_ ## v[(b)])
294 #define DYN_BUCKET_LOCK_INIT(lock, b) \
295 mtx_init(&lock[(b)], "IPFW dynamic bucket", NULL, MTX_DEF)
296 #define DYN_BUCKET_LOCK_DESTROY(lock, b) mtx_destroy(&lock[(b)])
297 #define DYN_BUCKET_LOCK(b) mtx_lock(&V_dyn_bucket_lock[(b)])
298 #define DYN_BUCKET_UNLOCK(b) mtx_unlock(&V_dyn_bucket_lock[(b)])
299 #define DYN_BUCKET_ASSERT(b) mtx_assert(&V_dyn_bucket_lock[(b)], MA_OWNED)
301 #define DYN_EXPIRED_LOCK_INIT() \
302 mtx_init(&V_dyn_expire_lock, "IPFW expired states list", NULL, MTX_DEF)
303 #define DYN_EXPIRED_LOCK_DESTROY() mtx_destroy(&V_dyn_expire_lock)
304 #define DYN_EXPIRED_LOCK() mtx_lock(&V_dyn_expire_lock)
305 #define DYN_EXPIRED_UNLOCK() mtx_unlock(&V_dyn_expire_lock)
307 static VNET_DEFINE(uint32_t, dyn_buckets_max);
308 static VNET_DEFINE(uint32_t, curr_dyn_buckets);
309 static VNET_DEFINE(struct callout, dyn_timeout);
310 #define V_dyn_buckets_max VNET(dyn_buckets_max)
311 #define V_curr_dyn_buckets VNET(curr_dyn_buckets)
312 #define V_dyn_timeout VNET(dyn_timeout)
314 /* Maximum length of states chain in a bucket */
315 static VNET_DEFINE(uint32_t, curr_max_length);
316 #define V_curr_max_length VNET(curr_max_length)
318 static VNET_DEFINE(uint32_t, dyn_keep_states);
319 #define V_dyn_keep_states VNET(dyn_keep_states)
321 static VNET_DEFINE(uma_zone_t, dyn_data_zone);
322 static VNET_DEFINE(uma_zone_t, dyn_parent_zone);
323 static VNET_DEFINE(uma_zone_t, dyn_ipv4_zone);
325 static VNET_DEFINE(uma_zone_t, dyn_ipv6_zone);
326 #define V_dyn_ipv6_zone VNET(dyn_ipv6_zone)
328 #define V_dyn_data_zone VNET(dyn_data_zone)
329 #define V_dyn_parent_zone VNET(dyn_parent_zone)
330 #define V_dyn_ipv4_zone VNET(dyn_ipv4_zone)
333 * Timeouts for various events in handing dynamic rules.
335 static VNET_DEFINE(uint32_t, dyn_ack_lifetime);
336 static VNET_DEFINE(uint32_t, dyn_syn_lifetime);
337 static VNET_DEFINE(uint32_t, dyn_fin_lifetime);
338 static VNET_DEFINE(uint32_t, dyn_rst_lifetime);
339 static VNET_DEFINE(uint32_t, dyn_udp_lifetime);
340 static VNET_DEFINE(uint32_t, dyn_short_lifetime);
342 #define V_dyn_ack_lifetime VNET(dyn_ack_lifetime)
343 #define V_dyn_syn_lifetime VNET(dyn_syn_lifetime)
344 #define V_dyn_fin_lifetime VNET(dyn_fin_lifetime)
345 #define V_dyn_rst_lifetime VNET(dyn_rst_lifetime)
346 #define V_dyn_udp_lifetime VNET(dyn_udp_lifetime)
347 #define V_dyn_short_lifetime VNET(dyn_short_lifetime)
350 * Keepalives are sent if dyn_keepalive is set. They are sent every
351 * dyn_keepalive_period seconds, in the last dyn_keepalive_interval
352 * seconds of lifetime of a rule.
353 * dyn_rst_lifetime and dyn_fin_lifetime should be strictly lower
354 * than dyn_keepalive_period.
356 static VNET_DEFINE(uint32_t, dyn_keepalive_interval);
357 static VNET_DEFINE(uint32_t, dyn_keepalive_period);
358 static VNET_DEFINE(uint32_t, dyn_keepalive);
359 static VNET_DEFINE(time_t, dyn_keepalive_last);
361 #define V_dyn_keepalive_interval VNET(dyn_keepalive_interval)
362 #define V_dyn_keepalive_period VNET(dyn_keepalive_period)
363 #define V_dyn_keepalive VNET(dyn_keepalive)
364 #define V_dyn_keepalive_last VNET(dyn_keepalive_last)
366 static VNET_DEFINE(uint32_t, dyn_max); /* max # of dynamic states */
367 static VNET_DEFINE(uint32_t, dyn_count); /* number of states */
368 static VNET_DEFINE(uint32_t, dyn_parent_max); /* max # of parent states */
369 static VNET_DEFINE(uint32_t, dyn_parent_count); /* number of parent states */
371 #define V_dyn_max VNET(dyn_max)
372 #define V_dyn_count VNET(dyn_count)
373 #define V_dyn_parent_max VNET(dyn_parent_max)
374 #define V_dyn_parent_count VNET(dyn_parent_count)
376 #define DYN_COUNT_DEC(name) do { \
377 MPASS((V_ ## name) > 0); \
378 ck_pr_dec_32(&(V_ ## name)); \
380 #define DYN_COUNT_INC(name) ck_pr_inc_32(&(V_ ## name))
381 #define DYN_COUNT(name) ck_pr_load_32(&(V_ ## name))
383 static time_t last_log; /* Log ratelimiting */
386 * Get/set maximum number of dynamic states in given VNET instance.
389 sysctl_dyn_max(SYSCTL_HANDLER_ARGS)
395 error = sysctl_handle_32(oidp, &nstates, 0, req);
396 /* Read operation or some error */
397 if ((error != 0) || (req->newptr == NULL))
401 uma_zone_set_max(V_dyn_data_zone, V_dyn_max);
406 sysctl_dyn_parent_max(SYSCTL_HANDLER_ARGS)
411 nstates = V_dyn_parent_max;
412 error = sysctl_handle_32(oidp, &nstates, 0, req);
413 /* Read operation or some error */
414 if ((error != 0) || (req->newptr == NULL))
417 V_dyn_parent_max = nstates;
418 uma_zone_set_max(V_dyn_parent_zone, V_dyn_parent_max);
423 sysctl_dyn_buckets(SYSCTL_HANDLER_ARGS)
428 nbuckets = V_dyn_buckets_max;
429 error = sysctl_handle_32(oidp, &nbuckets, 0, req);
430 /* Read operation or some error */
431 if ((error != 0) || (req->newptr == NULL))
435 V_dyn_buckets_max = 1 << fls(nbuckets - 1);
441 SYSCTL_DECL(_net_inet_ip_fw);
443 SYSCTL_U32(_net_inet_ip_fw, OID_AUTO, dyn_count,
444 CTLFLAG_VNET | CTLFLAG_RD, &VNET_NAME(dyn_count), 0,
445 "Current number of dynamic states.");
446 SYSCTL_U32(_net_inet_ip_fw, OID_AUTO, dyn_parent_count,
447 CTLFLAG_VNET | CTLFLAG_RD, &VNET_NAME(dyn_parent_count), 0,
448 "Current number of parent states. ");
449 SYSCTL_U32(_net_inet_ip_fw, OID_AUTO, curr_dyn_buckets,
450 CTLFLAG_VNET | CTLFLAG_RD, &VNET_NAME(curr_dyn_buckets), 0,
451 "Current number of buckets for states hash table.");
452 SYSCTL_U32(_net_inet_ip_fw, OID_AUTO, curr_max_length,
453 CTLFLAG_VNET | CTLFLAG_RD, &VNET_NAME(curr_max_length), 0,
454 "Current maximum length of states chains in hash buckets.");
455 SYSCTL_PROC(_net_inet_ip_fw, OID_AUTO, dyn_buckets,
456 CTLFLAG_VNET | CTLTYPE_U32 | CTLFLAG_RW, 0, 0, sysctl_dyn_buckets,
457 "IU", "Max number of buckets for dynamic states hash table.");
458 SYSCTL_PROC(_net_inet_ip_fw, OID_AUTO, dyn_max,
459 CTLFLAG_VNET | CTLTYPE_U32 | CTLFLAG_RW, 0, 0, sysctl_dyn_max,
460 "IU", "Max number of dynamic states.");
461 SYSCTL_PROC(_net_inet_ip_fw, OID_AUTO, dyn_parent_max,
462 CTLFLAG_VNET | CTLTYPE_U32 | CTLFLAG_RW, 0, 0, sysctl_dyn_parent_max,
463 "IU", "Max number of parent dynamic states.");
464 SYSCTL_U32(_net_inet_ip_fw, OID_AUTO, dyn_ack_lifetime,
465 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(dyn_ack_lifetime), 0,
466 "Lifetime of dynamic states for TCP ACK.");
467 SYSCTL_U32(_net_inet_ip_fw, OID_AUTO, dyn_syn_lifetime,
468 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(dyn_syn_lifetime), 0,
469 "Lifetime of dynamic states for TCP SYN.");
470 SYSCTL_U32(_net_inet_ip_fw, OID_AUTO, dyn_fin_lifetime,
471 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(dyn_fin_lifetime), 0,
472 "Lifetime of dynamic states for TCP FIN.");
473 SYSCTL_U32(_net_inet_ip_fw, OID_AUTO, dyn_rst_lifetime,
474 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(dyn_rst_lifetime), 0,
475 "Lifetime of dynamic states for TCP RST.");
476 SYSCTL_U32(_net_inet_ip_fw, OID_AUTO, dyn_udp_lifetime,
477 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(dyn_udp_lifetime), 0,
478 "Lifetime of dynamic states for UDP.");
479 SYSCTL_U32(_net_inet_ip_fw, OID_AUTO, dyn_short_lifetime,
480 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(dyn_short_lifetime), 0,
481 "Lifetime of dynamic states for other situations.");
482 SYSCTL_U32(_net_inet_ip_fw, OID_AUTO, dyn_keepalive,
483 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(dyn_keepalive), 0,
484 "Enable keepalives for dynamic states.");
485 SYSCTL_U32(_net_inet_ip_fw, OID_AUTO, dyn_keep_states,
486 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(dyn_keep_states), 0,
487 "Do not flush dynamic states on rule deletion");
490 #ifdef IPFIREWALL_DYNDEBUG
491 #define DYN_DEBUG(fmt, ...) do { \
492 printf("%s: " fmt "\n", __func__, __VA_ARGS__); \
495 #define DYN_DEBUG(fmt, ...)
496 #endif /* !IPFIREWALL_DYNDEBUG */
499 /* Functions to work with IPv6 states */
500 static struct dyn_ipv6_state *dyn_lookup_ipv6_state(
501 const struct ipfw_flow_id *, uint32_t, const void *,
502 struct ipfw_dyn_info *, int);
503 static int dyn_lookup_ipv6_state_locked(const struct ipfw_flow_id *,
504 uint32_t, const void *, int, uint32_t, uint16_t);
505 static struct dyn_ipv6_state *dyn_alloc_ipv6_state(
506 const struct ipfw_flow_id *, uint32_t, uint16_t, uint8_t);
507 static int dyn_add_ipv6_state(void *, uint32_t, uint16_t,
508 const struct ipfw_flow_id *, uint32_t, const void *, int, uint32_t,
509 struct ipfw_dyn_info *, uint16_t, uint16_t, uint8_t);
510 static void dyn_export_ipv6_state(const struct dyn_ipv6_state *,
513 static uint32_t dyn_getscopeid(const struct ip_fw_args *);
514 static void dyn_make_keepalive_ipv6(struct mbuf *, const struct in6_addr *,
515 const struct in6_addr *, uint32_t, uint32_t, uint32_t, uint16_t,
517 static void dyn_enqueue_keepalive_ipv6(struct mbufq *,
518 const struct dyn_ipv6_state *);
519 static void dyn_send_keepalive_ipv6(struct ip_fw_chain *);
521 static struct dyn_ipv6_state *dyn_lookup_ipv6_parent(
522 const struct ipfw_flow_id *, uint32_t, const void *, uint32_t, uint16_t,
524 static struct dyn_ipv6_state *dyn_lookup_ipv6_parent_locked(
525 const struct ipfw_flow_id *, uint32_t, const void *, uint32_t, uint16_t,
527 static struct dyn_ipv6_state *dyn_add_ipv6_parent(void *, uint32_t, uint16_t,
528 const struct ipfw_flow_id *, uint32_t, uint32_t, uint32_t, uint16_t);
531 /* Functions to work with limit states */
532 static void *dyn_get_parent_state(const struct ipfw_flow_id *, uint32_t,
533 struct ip_fw *, uint32_t, uint32_t, uint16_t);
534 static struct dyn_ipv4_state *dyn_lookup_ipv4_parent(
535 const struct ipfw_flow_id *, const void *, uint32_t, uint16_t, uint32_t);
536 static struct dyn_ipv4_state *dyn_lookup_ipv4_parent_locked(
537 const struct ipfw_flow_id *, const void *, uint32_t, uint16_t, uint32_t);
538 static struct dyn_parent *dyn_alloc_parent(void *, uint32_t, uint16_t,
540 static struct dyn_ipv4_state *dyn_add_ipv4_parent(void *, uint32_t, uint16_t,
541 const struct ipfw_flow_id *, uint32_t, uint32_t, uint16_t);
543 static void dyn_tick(void *);
544 static void dyn_expire_states(struct ip_fw_chain *, ipfw_range_tlv *);
545 static void dyn_free_states(struct ip_fw_chain *);
546 static void dyn_export_parent(const struct dyn_parent *, uint16_t, uint8_t,
548 static void dyn_export_data(const struct dyn_data *, uint16_t, uint8_t,
549 uint8_t, ipfw_dyn_rule *);
550 static uint32_t dyn_update_tcp_state(struct dyn_data *,
551 const struct ipfw_flow_id *, const struct tcphdr *, int);
552 static void dyn_update_proto_state(struct dyn_data *,
553 const struct ipfw_flow_id *, const void *, int, int);
555 /* Functions to work with IPv4 states */
556 struct dyn_ipv4_state *dyn_lookup_ipv4_state(const struct ipfw_flow_id *,
557 const void *, struct ipfw_dyn_info *, int);
558 static int dyn_lookup_ipv4_state_locked(const struct ipfw_flow_id *,
559 const void *, int, uint32_t, uint16_t);
560 static struct dyn_ipv4_state *dyn_alloc_ipv4_state(
561 const struct ipfw_flow_id *, uint16_t, uint8_t);
562 static int dyn_add_ipv4_state(void *, uint32_t, uint16_t,
563 const struct ipfw_flow_id *, const void *, int, uint32_t,
564 struct ipfw_dyn_info *, uint16_t, uint16_t, uint8_t);
565 static void dyn_export_ipv4_state(const struct dyn_ipv4_state *,
569 * Named states support.
571 static char *default_state_name = "default";
572 struct dyn_state_obj {
573 struct named_object no;
577 #define DYN_STATE_OBJ(ch, cmd) \
578 ((struct dyn_state_obj *)SRV_OBJECT(ch, (cmd)->arg1))
580 * Classifier callback.
581 * Return 0 if opcode contains object that should be referenced
585 dyn_classify(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
588 DYN_DEBUG("opcode %d, arg1 %d", cmd->opcode, cmd->arg1);
589 /* Don't rewrite "check-state any" */
590 if (cmd->arg1 == 0 &&
591 cmd->opcode == O_CHECK_STATE)
600 dyn_update(ipfw_insn *cmd, uint16_t idx)
604 DYN_DEBUG("opcode %d, arg1 %d", cmd->opcode, cmd->arg1);
608 dyn_findbyname(struct ip_fw_chain *ch, struct tid_info *ti,
609 struct named_object **pno)
614 DYN_DEBUG("uidx %d", ti->uidx);
616 if (ti->tlvs == NULL)
618 /* Search ntlv in the buffer provided by user */
619 ntlv = ipfw_find_name_tlv_type(ti->tlvs, ti->tlen, ti->uidx,
620 IPFW_TLV_STATE_NAME);
625 name = default_state_name;
627 * Search named object with corresponding name.
628 * Since states objects are global - ignore the set value
629 * and use zero instead.
631 *pno = ipfw_objhash_lookup_name_type(CHAIN_TO_SRV(ch), 0,
632 IPFW_TLV_STATE_NAME, name);
634 * We always return success here.
635 * The caller will check *pno and mark object as unresolved,
636 * then it will automatically create "default" object.
641 static struct named_object *
642 dyn_findbykidx(struct ip_fw_chain *ch, uint16_t idx)
645 DYN_DEBUG("kidx %d", idx);
646 return (ipfw_objhash_lookup_kidx(CHAIN_TO_SRV(ch), idx));
650 dyn_create(struct ip_fw_chain *ch, struct tid_info *ti,
653 struct namedobj_instance *ni;
654 struct dyn_state_obj *obj;
655 struct named_object *no;
659 DYN_DEBUG("uidx %d", ti->uidx);
661 if (ti->tlvs == NULL)
663 ntlv = ipfw_find_name_tlv_type(ti->tlvs, ti->tlen, ti->uidx,
664 IPFW_TLV_STATE_NAME);
669 name = default_state_name;
671 ni = CHAIN_TO_SRV(ch);
672 obj = malloc(sizeof(*obj), M_IPFW, M_WAITOK | M_ZERO);
673 obj->no.name = obj->name;
674 obj->no.etlv = IPFW_TLV_STATE_NAME;
675 strlcpy(obj->name, name, sizeof(obj->name));
678 no = ipfw_objhash_lookup_name_type(ni, 0,
679 IPFW_TLV_STATE_NAME, name);
682 * Object is already created.
683 * Just return its kidx and bump refcount.
689 DYN_DEBUG("\tfound kidx %d", *pkidx);
692 if (ipfw_objhash_alloc_idx(ni, &obj->no.kidx) != 0) {
693 DYN_DEBUG("\talloc_idx failed for %s", name);
698 ipfw_objhash_add(ni, &obj->no);
699 SRV_OBJECT(ch, obj->no.kidx) = obj;
701 *pkidx = obj->no.kidx;
703 DYN_DEBUG("\tcreated kidx %d", *pkidx);
708 dyn_destroy(struct ip_fw_chain *ch, struct named_object *no)
710 struct dyn_state_obj *obj;
712 IPFW_UH_WLOCK_ASSERT(ch);
714 KASSERT(no->etlv == IPFW_TLV_STATE_NAME,
715 ("%s: wrong object type %u", __func__, no->etlv));
716 KASSERT(no->refcnt == 1,
717 ("Destroying object '%s' (type %u, idx %u) with refcnt %u",
718 no->name, no->etlv, no->kidx, no->refcnt));
719 DYN_DEBUG("kidx %d", no->kidx);
720 obj = SRV_OBJECT(ch, no->kidx);
721 SRV_OBJECT(ch, no->kidx) = NULL;
722 ipfw_objhash_del(CHAIN_TO_SRV(ch), no);
723 ipfw_objhash_free_idx(CHAIN_TO_SRV(ch), no->kidx);
728 static struct opcode_obj_rewrite dyn_opcodes[] = {
730 O_KEEP_STATE, IPFW_TLV_STATE_NAME,
731 dyn_classify, dyn_update,
732 dyn_findbyname, dyn_findbykidx,
733 dyn_create, dyn_destroy
736 O_CHECK_STATE, IPFW_TLV_STATE_NAME,
737 dyn_classify, dyn_update,
738 dyn_findbyname, dyn_findbykidx,
739 dyn_create, dyn_destroy
742 O_PROBE_STATE, IPFW_TLV_STATE_NAME,
743 dyn_classify, dyn_update,
744 dyn_findbyname, dyn_findbykidx,
745 dyn_create, dyn_destroy
748 O_LIMIT, IPFW_TLV_STATE_NAME,
749 dyn_classify, dyn_update,
750 dyn_findbyname, dyn_findbykidx,
751 dyn_create, dyn_destroy
756 * IMPORTANT: the hash function for dynamic rules must be commutative
757 * in source and destination (ip,port), because rules are bidirectional
758 * and we want to find both in the same bucket.
760 #ifndef IPFIREWALL_JENKINSHASH
761 static __inline uint32_t
762 hash_packet(const struct ipfw_flow_id *id)
767 if (IS_IP6_FLOW_ID(id))
768 i = ntohl((id->dst_ip6.__u6_addr.__u6_addr32[2]) ^
769 (id->dst_ip6.__u6_addr.__u6_addr32[3]) ^
770 (id->src_ip6.__u6_addr.__u6_addr32[2]) ^
771 (id->src_ip6.__u6_addr.__u6_addr32[3]));
774 i = (id->dst_ip) ^ (id->src_ip);
775 i ^= (id->dst_port) ^ (id->src_port);
779 static __inline uint32_t
780 hash_parent(const struct ipfw_flow_id *id, const void *rule)
783 return (hash_packet(id) ^ ((uintptr_t)rule));
786 #else /* IPFIREWALL_JENKINSHASH */
788 static VNET_DEFINE(uint32_t, dyn_hashseed);
789 #define V_dyn_hashseed VNET(dyn_hashseed)
792 addrcmp4(const struct ipfw_flow_id *id)
795 if (id->src_ip < id->dst_ip)
797 if (id->src_ip > id->dst_ip)
799 if (id->src_port <= id->dst_port)
806 addrcmp6(const struct ipfw_flow_id *id)
810 ret = memcmp(&id->src_ip6, &id->dst_ip6, sizeof(struct in6_addr));
815 if (id->src_port <= id->dst_port)
820 static __inline uint32_t
821 hash_packet6(const struct ipfw_flow_id *id)
824 struct in6_addr addr[2];
828 if (addrcmp6(id) == 0) {
829 t6.addr[0] = id->src_ip6;
830 t6.addr[1] = id->dst_ip6;
831 t6.port[0] = id->src_port;
832 t6.port[1] = id->dst_port;
834 t6.addr[0] = id->dst_ip6;
835 t6.addr[1] = id->src_ip6;
836 t6.port[0] = id->dst_port;
837 t6.port[1] = id->src_port;
839 return (jenkins_hash32((const uint32_t *)&t6,
840 sizeof(t6) / sizeof(uint32_t), V_dyn_hashseed));
844 static __inline uint32_t
845 hash_packet(const struct ipfw_flow_id *id)
852 if (IS_IP4_FLOW_ID(id)) {
853 /* All fields are in host byte order */
854 if (addrcmp4(id) == 0) {
855 t4.addr[0] = id->src_ip;
856 t4.addr[1] = id->dst_ip;
857 t4.port[0] = id->src_port;
858 t4.port[1] = id->dst_port;
860 t4.addr[0] = id->dst_ip;
861 t4.addr[1] = id->src_ip;
862 t4.port[0] = id->dst_port;
863 t4.port[1] = id->src_port;
865 return (jenkins_hash32((const uint32_t *)&t4,
866 sizeof(t4) / sizeof(uint32_t), V_dyn_hashseed));
869 if (IS_IP6_FLOW_ID(id))
870 return (hash_packet6(id));
875 static __inline uint32_t
876 hash_parent(const struct ipfw_flow_id *id, const void *rule)
879 return (jenkins_hash32((const uint32_t *)&rule,
880 sizeof(rule) / sizeof(uint32_t), hash_packet(id)));
882 #endif /* IPFIREWALL_JENKINSHASH */
885 * Print customizable flow id description via log(9) facility.
888 print_dyn_rule_flags(const struct ipfw_flow_id *id, int dyn_type,
889 int log_flags, char *prefix, char *postfix)
893 char src[INET6_ADDRSTRLEN], dst[INET6_ADDRSTRLEN];
895 char src[INET_ADDRSTRLEN], dst[INET_ADDRSTRLEN];
899 if (IS_IP6_FLOW_ID(id)) {
900 ip6_sprintf(src, &id->src_ip6);
901 ip6_sprintf(dst, &id->dst_ip6);
905 da.s_addr = htonl(id->src_ip);
906 inet_ntop(AF_INET, &da, src, sizeof(src));
907 da.s_addr = htonl(id->dst_ip);
908 inet_ntop(AF_INET, &da, dst, sizeof(dst));
910 log(log_flags, "ipfw: %s type %d %s %d -> %s %d, %d %s\n",
911 prefix, dyn_type, src, id->src_port, dst,
912 id->dst_port, V_dyn_count, postfix);
915 #define print_dyn_rule(id, dtype, prefix, postfix) \
916 print_dyn_rule_flags(id, dtype, LOG_DEBUG, prefix, postfix)
918 #define TIME_LEQ(a,b) ((int)((a)-(b)) <= 0)
919 #define TIME_LE(a,b) ((int)((a)-(b)) < 0)
920 #define _SEQ_GE(a,b) ((int)((a)-(b)) >= 0)
921 #define BOTH_SYN (TH_SYN | (TH_SYN << 8))
922 #define BOTH_FIN (TH_FIN | (TH_FIN << 8))
923 #define TCP_FLAGS (TH_FLAGS | (TH_FLAGS << 8))
924 #define ACK_FWD 0x00010000 /* fwd ack seen */
925 #define ACK_REV 0x00020000 /* rev ack seen */
926 #define ACK_BOTH (ACK_FWD | ACK_REV)
929 dyn_update_tcp_state(struct dyn_data *data, const struct ipfw_flow_id *pkt,
930 const struct tcphdr *tcp, int dir)
932 uint32_t ack, expire;
936 expire = data->expire;
937 old = state = data->state;
938 th_flags = pkt->_flags & (TH_FIN | TH_SYN | TH_RST);
939 state |= (dir == MATCH_FORWARD) ? th_flags: (th_flags << 8);
940 switch (state & TCP_FLAGS) {
941 case TH_SYN: /* opening */
942 expire = time_uptime + V_dyn_syn_lifetime;
945 case BOTH_SYN: /* move to established */
946 case BOTH_SYN | TH_FIN: /* one side tries to close */
947 case BOTH_SYN | (TH_FIN << 8):
950 ack = ntohl(tcp->th_ack);
951 if (dir == MATCH_FORWARD) {
952 if (data->ack_fwd == 0 ||
953 _SEQ_GE(ack, data->ack_fwd)) {
955 if (data->ack_fwd != ack)
956 ck_pr_store_32(&data->ack_fwd, ack);
959 if (data->ack_rev == 0 ||
960 _SEQ_GE(ack, data->ack_rev)) {
962 if (data->ack_rev != ack)
963 ck_pr_store_32(&data->ack_rev, ack);
966 if ((state & ACK_BOTH) == ACK_BOTH) {
968 * Set expire time to V_dyn_ack_lifetime only if
969 * we got ACKs for both directions.
970 * We use XOR here to avoid possible state
971 * overwriting in concurrent thread.
973 expire = time_uptime + V_dyn_ack_lifetime;
974 ck_pr_xor_32(&data->state, ACK_BOTH);
975 } else if ((data->state & ACK_BOTH) != (state & ACK_BOTH))
976 ck_pr_or_32(&data->state, state & ACK_BOTH);
979 case BOTH_SYN | BOTH_FIN: /* both sides closed */
980 if (V_dyn_fin_lifetime >= V_dyn_keepalive_period)
981 V_dyn_fin_lifetime = V_dyn_keepalive_period - 1;
982 expire = time_uptime + V_dyn_fin_lifetime;
986 if (V_dyn_keepalive != 0 &&
987 V_dyn_rst_lifetime >= V_dyn_keepalive_period)
988 V_dyn_rst_lifetime = V_dyn_keepalive_period - 1;
989 expire = time_uptime + V_dyn_rst_lifetime;
991 /* Save TCP state if it was changed */
992 if ((state & TCP_FLAGS) != (old & TCP_FLAGS))
993 ck_pr_or_32(&data->state, state & TCP_FLAGS);
998 * Update ULP specific state.
999 * For TCP we keep sequence numbers and flags. For other protocols
1000 * currently we update only expire time. Packets and bytes counters
1001 * are also updated here.
1004 dyn_update_proto_state(struct dyn_data *data, const struct ipfw_flow_id *pkt,
1005 const void *ulp, int pktlen, int dir)
1009 /* NOTE: we are in critical section here. */
1010 switch (pkt->proto) {
1012 case IPPROTO_UDPLITE:
1013 expire = time_uptime + V_dyn_udp_lifetime;
1016 expire = dyn_update_tcp_state(data, pkt, ulp, dir);
1019 expire = time_uptime + V_dyn_short_lifetime;
1022 * Expiration timer has the per-second granularity, no need to update
1023 * it every time when state is matched.
1025 if (data->expire != expire)
1026 ck_pr_store_32(&data->expire, expire);
1028 if (dir == MATCH_FORWARD)
1029 DYN_COUNTER_INC(data, fwd, pktlen);
1031 DYN_COUNTER_INC(data, rev, pktlen);
1035 * Lookup IPv4 state.
1036 * Must be called in critical section.
1038 struct dyn_ipv4_state *
1039 dyn_lookup_ipv4_state(const struct ipfw_flow_id *pkt, const void *ulp,
1040 struct ipfw_dyn_info *info, int pktlen)
1042 struct dyn_ipv4_state *s;
1043 uint32_t version, bucket;
1045 bucket = DYN_BUCKET(info->hashval, V_curr_dyn_buckets);
1046 info->version = DYN_BUCKET_VERSION(bucket, ipv4_add);
1048 version = DYN_BUCKET_VERSION(bucket, ipv4_del);
1049 CK_SLIST_FOREACH(s, &V_dyn_ipv4[bucket], entry) {
1050 DYNSTATE_PROTECT(s);
1051 if (version != DYN_BUCKET_VERSION(bucket, ipv4_del))
1053 if (s->proto != pkt->proto)
1055 if (info->kidx != 0 && s->kidx != info->kidx)
1057 if (s->sport == pkt->src_port && s->dport == pkt->dst_port &&
1058 s->src == pkt->src_ip && s->dst == pkt->dst_ip) {
1059 info->direction = MATCH_FORWARD;
1062 if (s->sport == pkt->dst_port && s->dport == pkt->src_port &&
1063 s->src == pkt->dst_ip && s->dst == pkt->src_ip) {
1064 info->direction = MATCH_REVERSE;
1070 dyn_update_proto_state(s->data, pkt, ulp, pktlen,
1076 * Lookup IPv4 state.
1077 * Simplifed version is used to check that matching state doesn't exist.
1080 dyn_lookup_ipv4_state_locked(const struct ipfw_flow_id *pkt,
1081 const void *ulp, int pktlen, uint32_t bucket, uint16_t kidx)
1083 struct dyn_ipv4_state *s;
1087 DYN_BUCKET_ASSERT(bucket);
1088 CK_SLIST_FOREACH(s, &V_dyn_ipv4[bucket], entry) {
1089 if (s->proto != pkt->proto ||
1092 if (s->sport == pkt->src_port &&
1093 s->dport == pkt->dst_port &&
1094 s->src == pkt->src_ip && s->dst == pkt->dst_ip) {
1095 dir = MATCH_FORWARD;
1098 if (s->sport == pkt->dst_port && s->dport == pkt->src_port &&
1099 s->src == pkt->dst_ip && s->dst == pkt->src_ip) {
1100 dir = MATCH_REVERSE;
1105 dyn_update_proto_state(s->data, pkt, ulp, pktlen, dir);
1109 struct dyn_ipv4_state *
1110 dyn_lookup_ipv4_parent(const struct ipfw_flow_id *pkt, const void *rule,
1111 uint32_t ruleid, uint16_t rulenum, uint32_t hashval)
1113 struct dyn_ipv4_state *s;
1114 uint32_t version, bucket;
1116 bucket = DYN_BUCKET(hashval, V_curr_dyn_buckets);
1118 version = DYN_BUCKET_VERSION(bucket, ipv4_parent_del);
1119 CK_SLIST_FOREACH(s, &V_dyn_ipv4_parent[bucket], entry) {
1120 DYNSTATE_PROTECT(s);
1121 if (version != DYN_BUCKET_VERSION(bucket, ipv4_parent_del))
1124 * NOTE: we do not need to check kidx, because parent rule
1125 * can not create states with different kidx.
1126 * And parent rule always created for forward direction.
1128 if (s->limit->parent == rule &&
1129 s->limit->ruleid == ruleid &&
1130 s->limit->rulenum == rulenum &&
1131 s->proto == pkt->proto &&
1132 s->sport == pkt->src_port &&
1133 s->dport == pkt->dst_port &&
1134 s->src == pkt->src_ip && s->dst == pkt->dst_ip) {
1135 if (s->limit->expire != time_uptime +
1136 V_dyn_short_lifetime)
1137 ck_pr_store_32(&s->limit->expire,
1138 time_uptime + V_dyn_short_lifetime);
1145 static struct dyn_ipv4_state *
1146 dyn_lookup_ipv4_parent_locked(const struct ipfw_flow_id *pkt,
1147 const void *rule, uint32_t ruleid, uint16_t rulenum, uint32_t bucket)
1149 struct dyn_ipv4_state *s;
1151 DYN_BUCKET_ASSERT(bucket);
1152 CK_SLIST_FOREACH(s, &V_dyn_ipv4_parent[bucket], entry) {
1153 if (s->limit->parent == rule &&
1154 s->limit->ruleid == ruleid &&
1155 s->limit->rulenum == rulenum &&
1156 s->proto == pkt->proto &&
1157 s->sport == pkt->src_port &&
1158 s->dport == pkt->dst_port &&
1159 s->src == pkt->src_ip && s->dst == pkt->dst_ip)
1168 dyn_getscopeid(const struct ip_fw_args *args)
1172 * If source or destination address is an scopeid address, we need
1173 * determine the scope zone id to resolve address scope ambiguity.
1175 if (IN6_IS_ADDR_LINKLOCAL(&args->f_id.src_ip6) ||
1176 IN6_IS_ADDR_LINKLOCAL(&args->f_id.dst_ip6)) {
1177 MPASS(args->oif != NULL ||
1178 args->m->m_pkthdr.rcvif != NULL);
1179 return (in6_getscopezone(args->oif != NULL ? args->oif:
1180 args->m->m_pkthdr.rcvif, IPV6_ADDR_SCOPE_LINKLOCAL));
1186 * Lookup IPv6 state.
1187 * Must be called in critical section.
1189 static struct dyn_ipv6_state *
1190 dyn_lookup_ipv6_state(const struct ipfw_flow_id *pkt, uint32_t zoneid,
1191 const void *ulp, struct ipfw_dyn_info *info, int pktlen)
1193 struct dyn_ipv6_state *s;
1194 uint32_t version, bucket;
1196 bucket = DYN_BUCKET(info->hashval, V_curr_dyn_buckets);
1197 info->version = DYN_BUCKET_VERSION(bucket, ipv6_add);
1199 version = DYN_BUCKET_VERSION(bucket, ipv6_del);
1200 CK_SLIST_FOREACH(s, &V_dyn_ipv6[bucket], entry) {
1201 DYNSTATE_PROTECT(s);
1202 if (version != DYN_BUCKET_VERSION(bucket, ipv6_del))
1204 if (s->proto != pkt->proto || s->zoneid != zoneid)
1206 if (info->kidx != 0 && s->kidx != info->kidx)
1208 if (s->sport == pkt->src_port && s->dport == pkt->dst_port &&
1209 IN6_ARE_ADDR_EQUAL(&s->src, &pkt->src_ip6) &&
1210 IN6_ARE_ADDR_EQUAL(&s->dst, &pkt->dst_ip6)) {
1211 info->direction = MATCH_FORWARD;
1214 if (s->sport == pkt->dst_port && s->dport == pkt->src_port &&
1215 IN6_ARE_ADDR_EQUAL(&s->src, &pkt->dst_ip6) &&
1216 IN6_ARE_ADDR_EQUAL(&s->dst, &pkt->src_ip6)) {
1217 info->direction = MATCH_REVERSE;
1222 dyn_update_proto_state(s->data, pkt, ulp, pktlen,
1228 * Lookup IPv6 state.
1229 * Simplifed version is used to check that matching state doesn't exist.
1232 dyn_lookup_ipv6_state_locked(const struct ipfw_flow_id *pkt, uint32_t zoneid,
1233 const void *ulp, int pktlen, uint32_t bucket, uint16_t kidx)
1235 struct dyn_ipv6_state *s;
1239 DYN_BUCKET_ASSERT(bucket);
1240 CK_SLIST_FOREACH(s, &V_dyn_ipv6[bucket], entry) {
1241 if (s->proto != pkt->proto || s->kidx != kidx ||
1242 s->zoneid != zoneid)
1244 if (s->sport == pkt->src_port && s->dport == pkt->dst_port &&
1245 IN6_ARE_ADDR_EQUAL(&s->src, &pkt->src_ip6) &&
1246 IN6_ARE_ADDR_EQUAL(&s->dst, &pkt->dst_ip6)) {
1247 dir = MATCH_FORWARD;
1250 if (s->sport == pkt->dst_port && s->dport == pkt->src_port &&
1251 IN6_ARE_ADDR_EQUAL(&s->src, &pkt->dst_ip6) &&
1252 IN6_ARE_ADDR_EQUAL(&s->dst, &pkt->src_ip6)) {
1253 dir = MATCH_REVERSE;
1258 dyn_update_proto_state(s->data, pkt, ulp, pktlen, dir);
1262 static struct dyn_ipv6_state *
1263 dyn_lookup_ipv6_parent(const struct ipfw_flow_id *pkt, uint32_t zoneid,
1264 const void *rule, uint32_t ruleid, uint16_t rulenum, uint32_t hashval)
1266 struct dyn_ipv6_state *s;
1267 uint32_t version, bucket;
1269 bucket = DYN_BUCKET(hashval, V_curr_dyn_buckets);
1271 version = DYN_BUCKET_VERSION(bucket, ipv6_parent_del);
1272 CK_SLIST_FOREACH(s, &V_dyn_ipv6_parent[bucket], entry) {
1273 DYNSTATE_PROTECT(s);
1274 if (version != DYN_BUCKET_VERSION(bucket, ipv6_parent_del))
1277 * NOTE: we do not need to check kidx, because parent rule
1278 * can not create states with different kidx.
1279 * Also parent rule always created for forward direction.
1281 if (s->limit->parent == rule &&
1282 s->limit->ruleid == ruleid &&
1283 s->limit->rulenum == rulenum &&
1284 s->proto == pkt->proto &&
1285 s->sport == pkt->src_port &&
1286 s->dport == pkt->dst_port && s->zoneid == zoneid &&
1287 IN6_ARE_ADDR_EQUAL(&s->src, &pkt->src_ip6) &&
1288 IN6_ARE_ADDR_EQUAL(&s->dst, &pkt->dst_ip6)) {
1289 if (s->limit->expire != time_uptime +
1290 V_dyn_short_lifetime)
1291 ck_pr_store_32(&s->limit->expire,
1292 time_uptime + V_dyn_short_lifetime);
1299 static struct dyn_ipv6_state *
1300 dyn_lookup_ipv6_parent_locked(const struct ipfw_flow_id *pkt, uint32_t zoneid,
1301 const void *rule, uint32_t ruleid, uint16_t rulenum, uint32_t bucket)
1303 struct dyn_ipv6_state *s;
1305 DYN_BUCKET_ASSERT(bucket);
1306 CK_SLIST_FOREACH(s, &V_dyn_ipv6_parent[bucket], entry) {
1307 if (s->limit->parent == rule &&
1308 s->limit->ruleid == ruleid &&
1309 s->limit->rulenum == rulenum &&
1310 s->proto == pkt->proto &&
1311 s->sport == pkt->src_port &&
1312 s->dport == pkt->dst_port && s->zoneid == zoneid &&
1313 IN6_ARE_ADDR_EQUAL(&s->src, &pkt->src_ip6) &&
1314 IN6_ARE_ADDR_EQUAL(&s->dst, &pkt->dst_ip6))
1323 * Lookup dynamic state.
1324 * pkt - filled by ipfw_chk() ipfw_flow_id;
1325 * ulp - determined by ipfw_chk() upper level protocol header;
1326 * dyn_info - info about matched state to return back;
1327 * Returns pointer to state's parent rule and dyn_info. If there is
1328 * no state, NULL is returned.
1329 * On match ipfw_dyn_lookup() updates state's counters.
1332 ipfw_dyn_lookup_state(const struct ip_fw_args *args, const void *ulp,
1333 int pktlen, const ipfw_insn *cmd, struct ipfw_dyn_info *info)
1335 struct dyn_data *data;
1338 IPFW_RLOCK_ASSERT(&V_layer3_chain);
1342 info->kidx = cmd->arg1;
1343 info->direction = MATCH_NONE;
1344 info->hashval = hash_packet(&args->f_id);
1346 DYNSTATE_CRITICAL_ENTER();
1347 if (IS_IP4_FLOW_ID(&args->f_id)) {
1348 struct dyn_ipv4_state *s;
1350 s = dyn_lookup_ipv4_state(&args->f_id, ulp, info, pktlen);
1353 * Dynamic states are created using the same 5-tuple,
1354 * so it is assumed, that parent rule for O_LIMIT
1355 * state has the same address family.
1358 if (s->type == O_LIMIT) {
1360 rule = s->limit->parent;
1362 rule = data->parent;
1366 else if (IS_IP6_FLOW_ID(&args->f_id)) {
1367 struct dyn_ipv6_state *s;
1369 s = dyn_lookup_ipv6_state(&args->f_id, dyn_getscopeid(args),
1373 if (s->type == O_LIMIT) {
1375 rule = s->limit->parent;
1377 rule = data->parent;
1383 * If cached chain id is the same, we can avoid rule index
1384 * lookup. Otherwise do lookup and update chain_id and f_pos.
1385 * It is safe even if there is concurrent thread that want
1386 * update the same state, because chain->id can be changed
1387 * only under IPFW_WLOCK().
1389 if (data->chain_id != V_layer3_chain.id) {
1390 data->f_pos = ipfw_find_rule(&V_layer3_chain,
1391 data->rulenum, data->ruleid);
1393 * Check that found state has not orphaned.
1394 * When chain->id being changed the parent
1395 * rule can be deleted. If found rule doesn't
1396 * match the parent pointer, consider this
1397 * result as MATCH_NONE and return NULL.
1399 * This will lead to creation of new similar state
1400 * that will be added into head of this bucket.
1401 * And the state that we currently have matched
1402 * should be deleted by dyn_expire_states().
1404 * In case when dyn_keep_states is enabled, return
1405 * pointer to deleted rule and f_pos value
1406 * corresponding to penultimate rule.
1407 * When we have enabled V_dyn_keep_states, states
1408 * that become orphaned will get the DYN_REFERENCED
1409 * flag and rule will keep around. So we can return
1410 * it. But since it is not in the rules map, we need
1411 * return such f_pos value, so after the state
1412 * handling if the search will continue, the next rule
1413 * will be the last one - the default rule.
1415 if (V_layer3_chain.map[data->f_pos] == rule) {
1416 data->chain_id = V_layer3_chain.id;
1417 info->f_pos = data->f_pos;
1418 } else if (V_dyn_keep_states != 0) {
1420 * The original rule pointer is still usable.
1421 * So, we return it, but f_pos need to be
1422 * changed to point to the penultimate rule.
1424 MPASS(V_layer3_chain.n_rules > 1);
1425 data->chain_id = V_layer3_chain.id;
1426 data->f_pos = V_layer3_chain.n_rules - 2;
1427 info->f_pos = data->f_pos;
1430 info->direction = MATCH_NONE;
1431 DYN_DEBUG("rule %p [%u, %u] is considered "
1432 "invalid in data %p", rule, data->ruleid,
1433 data->rulenum, data);
1434 /* info->f_pos doesn't matter here. */
1437 info->f_pos = data->f_pos;
1439 DYNSTATE_CRITICAL_EXIT();
1442 * Return MATCH_NONE if parent rule is in disabled set.
1443 * This will lead to creation of new similar state that
1444 * will be added into head of this bucket.
1446 * XXXAE: we need to be able update state's set when parent
1447 * rule set is changed.
1449 if (rule != NULL && (V_set_disable & (1 << rule->set))) {
1451 info->direction = MATCH_NONE;
1457 static struct dyn_parent *
1458 dyn_alloc_parent(void *parent, uint32_t ruleid, uint16_t rulenum,
1461 struct dyn_parent *limit;
1463 limit = uma_zalloc(V_dyn_parent_zone, M_NOWAIT | M_ZERO);
1464 if (limit == NULL) {
1465 if (last_log != time_uptime) {
1466 last_log = time_uptime;
1468 "ipfw: Cannot allocate parent dynamic state, "
1469 "consider increasing "
1470 "net.inet.ip.fw.dyn_parent_max\n");
1475 limit->parent = parent;
1476 limit->ruleid = ruleid;
1477 limit->rulenum = rulenum;
1478 limit->hashval = hashval;
1479 limit->expire = time_uptime + V_dyn_short_lifetime;
1483 static struct dyn_data *
1484 dyn_alloc_dyndata(void *parent, uint32_t ruleid, uint16_t rulenum,
1485 const struct ipfw_flow_id *pkt, const void *ulp, int pktlen,
1486 uint32_t hashval, uint16_t fibnum)
1488 struct dyn_data *data;
1490 data = uma_zalloc(V_dyn_data_zone, M_NOWAIT | M_ZERO);
1492 if (last_log != time_uptime) {
1493 last_log = time_uptime;
1495 "ipfw: Cannot allocate dynamic state, "
1496 "consider increasing net.inet.ip.fw.dyn_max\n");
1501 data->parent = parent;
1502 data->ruleid = ruleid;
1503 data->rulenum = rulenum;
1504 data->fibnum = fibnum;
1505 data->hashval = hashval;
1506 data->expire = time_uptime + V_dyn_syn_lifetime;
1507 dyn_update_proto_state(data, pkt, ulp, pktlen, MATCH_FORWARD);
1511 static struct dyn_ipv4_state *
1512 dyn_alloc_ipv4_state(const struct ipfw_flow_id *pkt, uint16_t kidx,
1515 struct dyn_ipv4_state *s;
1517 s = uma_zalloc(V_dyn_ipv4_zone, M_NOWAIT | M_ZERO);
1523 s->proto = pkt->proto;
1524 s->sport = pkt->src_port;
1525 s->dport = pkt->dst_port;
1526 s->src = pkt->src_ip;
1527 s->dst = pkt->dst_ip;
1532 * Add IPv4 parent state.
1533 * Returns pointer to parent state. When it is not NULL we are in
1534 * critical section and pointer protected by hazard pointer.
1535 * When some error occurs, it returns NULL and exit from critical section
1538 static struct dyn_ipv4_state *
1539 dyn_add_ipv4_parent(void *rule, uint32_t ruleid, uint16_t rulenum,
1540 const struct ipfw_flow_id *pkt, uint32_t hashval, uint32_t version,
1543 struct dyn_ipv4_state *s;
1544 struct dyn_parent *limit;
1547 bucket = DYN_BUCKET(hashval, V_curr_dyn_buckets);
1548 DYN_BUCKET_LOCK(bucket);
1549 if (version != DYN_BUCKET_VERSION(bucket, ipv4_parent_add)) {
1551 * Bucket version has been changed since last lookup,
1552 * do lookup again to be sure that state does not exist.
1554 s = dyn_lookup_ipv4_parent_locked(pkt, rule, ruleid,
1558 * Simultaneous thread has already created this
1559 * state. Just return it.
1561 DYNSTATE_CRITICAL_ENTER();
1562 DYNSTATE_PROTECT(s);
1563 DYN_BUCKET_UNLOCK(bucket);
1568 limit = dyn_alloc_parent(rule, ruleid, rulenum, hashval);
1569 if (limit == NULL) {
1570 DYN_BUCKET_UNLOCK(bucket);
1574 s = dyn_alloc_ipv4_state(pkt, kidx, O_LIMIT_PARENT);
1576 DYN_BUCKET_UNLOCK(bucket);
1577 uma_zfree(V_dyn_parent_zone, limit);
1582 CK_SLIST_INSERT_HEAD(&V_dyn_ipv4_parent[bucket], s, entry);
1583 DYN_COUNT_INC(dyn_parent_count);
1584 DYN_BUCKET_VERSION_BUMP(bucket, ipv4_parent_add);
1585 DYNSTATE_CRITICAL_ENTER();
1586 DYNSTATE_PROTECT(s);
1587 DYN_BUCKET_UNLOCK(bucket);
1592 dyn_add_ipv4_state(void *parent, uint32_t ruleid, uint16_t rulenum,
1593 const struct ipfw_flow_id *pkt, const void *ulp, int pktlen,
1594 uint32_t hashval, struct ipfw_dyn_info *info, uint16_t fibnum,
1595 uint16_t kidx, uint8_t type)
1597 struct dyn_ipv4_state *s;
1601 bucket = DYN_BUCKET(hashval, V_curr_dyn_buckets);
1602 DYN_BUCKET_LOCK(bucket);
1603 if (info->direction == MATCH_UNKNOWN ||
1604 info->kidx != kidx ||
1605 info->hashval != hashval ||
1606 info->version != DYN_BUCKET_VERSION(bucket, ipv4_add)) {
1608 * Bucket version has been changed since last lookup,
1609 * do lookup again to be sure that state does not exist.
1611 if (dyn_lookup_ipv4_state_locked(pkt, ulp, pktlen,
1612 bucket, kidx) != 0) {
1613 DYN_BUCKET_UNLOCK(bucket);
1618 data = dyn_alloc_dyndata(parent, ruleid, rulenum, pkt, ulp,
1619 pktlen, hashval, fibnum);
1621 DYN_BUCKET_UNLOCK(bucket);
1625 s = dyn_alloc_ipv4_state(pkt, kidx, type);
1627 DYN_BUCKET_UNLOCK(bucket);
1628 uma_zfree(V_dyn_data_zone, data);
1633 CK_SLIST_INSERT_HEAD(&V_dyn_ipv4[bucket], s, entry);
1634 DYN_COUNT_INC(dyn_count);
1635 DYN_BUCKET_VERSION_BUMP(bucket, ipv4_add);
1636 DYN_BUCKET_UNLOCK(bucket);
1641 static struct dyn_ipv6_state *
1642 dyn_alloc_ipv6_state(const struct ipfw_flow_id *pkt, uint32_t zoneid,
1643 uint16_t kidx, uint8_t type)
1645 struct dyn_ipv6_state *s;
1647 s = uma_zalloc(V_dyn_ipv6_zone, M_NOWAIT | M_ZERO);
1654 s->proto = pkt->proto;
1655 s->sport = pkt->src_port;
1656 s->dport = pkt->dst_port;
1657 s->src = pkt->src_ip6;
1658 s->dst = pkt->dst_ip6;
1663 * Add IPv6 parent state.
1664 * Returns pointer to parent state. When it is not NULL we are in
1665 * critical section and pointer protected by hazard pointer.
1666 * When some error occurs, it return NULL and exit from critical section
1669 static struct dyn_ipv6_state *
1670 dyn_add_ipv6_parent(void *rule, uint32_t ruleid, uint16_t rulenum,
1671 const struct ipfw_flow_id *pkt, uint32_t zoneid, uint32_t hashval,
1672 uint32_t version, uint16_t kidx)
1674 struct dyn_ipv6_state *s;
1675 struct dyn_parent *limit;
1678 bucket = DYN_BUCKET(hashval, V_curr_dyn_buckets);
1679 DYN_BUCKET_LOCK(bucket);
1680 if (version != DYN_BUCKET_VERSION(bucket, ipv6_parent_add)) {
1682 * Bucket version has been changed since last lookup,
1683 * do lookup again to be sure that state does not exist.
1685 s = dyn_lookup_ipv6_parent_locked(pkt, zoneid, rule, ruleid,
1689 * Simultaneous thread has already created this
1690 * state. Just return it.
1692 DYNSTATE_CRITICAL_ENTER();
1693 DYNSTATE_PROTECT(s);
1694 DYN_BUCKET_UNLOCK(bucket);
1699 limit = dyn_alloc_parent(rule, ruleid, rulenum, hashval);
1700 if (limit == NULL) {
1701 DYN_BUCKET_UNLOCK(bucket);
1705 s = dyn_alloc_ipv6_state(pkt, zoneid, kidx, O_LIMIT_PARENT);
1707 DYN_BUCKET_UNLOCK(bucket);
1708 uma_zfree(V_dyn_parent_zone, limit);
1713 CK_SLIST_INSERT_HEAD(&V_dyn_ipv6_parent[bucket], s, entry);
1714 DYN_COUNT_INC(dyn_parent_count);
1715 DYN_BUCKET_VERSION_BUMP(bucket, ipv6_parent_add);
1716 DYNSTATE_CRITICAL_ENTER();
1717 DYNSTATE_PROTECT(s);
1718 DYN_BUCKET_UNLOCK(bucket);
1723 dyn_add_ipv6_state(void *parent, uint32_t ruleid, uint16_t rulenum,
1724 const struct ipfw_flow_id *pkt, uint32_t zoneid, const void *ulp,
1725 int pktlen, uint32_t hashval, struct ipfw_dyn_info *info,
1726 uint16_t fibnum, uint16_t kidx, uint8_t type)
1728 struct dyn_ipv6_state *s;
1729 struct dyn_data *data;
1732 bucket = DYN_BUCKET(hashval, V_curr_dyn_buckets);
1733 DYN_BUCKET_LOCK(bucket);
1734 if (info->direction == MATCH_UNKNOWN ||
1735 info->kidx != kidx ||
1736 info->hashval != hashval ||
1737 info->version != DYN_BUCKET_VERSION(bucket, ipv6_add)) {
1739 * Bucket version has been changed since last lookup,
1740 * do lookup again to be sure that state does not exist.
1742 if (dyn_lookup_ipv6_state_locked(pkt, zoneid, ulp, pktlen,
1743 bucket, kidx) != 0) {
1744 DYN_BUCKET_UNLOCK(bucket);
1749 data = dyn_alloc_dyndata(parent, ruleid, rulenum, pkt, ulp,
1750 pktlen, hashval, fibnum);
1752 DYN_BUCKET_UNLOCK(bucket);
1756 s = dyn_alloc_ipv6_state(pkt, zoneid, kidx, type);
1758 DYN_BUCKET_UNLOCK(bucket);
1759 uma_zfree(V_dyn_data_zone, data);
1764 CK_SLIST_INSERT_HEAD(&V_dyn_ipv6[bucket], s, entry);
1765 DYN_COUNT_INC(dyn_count);
1766 DYN_BUCKET_VERSION_BUMP(bucket, ipv6_add);
1767 DYN_BUCKET_UNLOCK(bucket);
1773 dyn_get_parent_state(const struct ipfw_flow_id *pkt, uint32_t zoneid,
1774 struct ip_fw *rule, uint32_t hashval, uint32_t limit, uint16_t kidx)
1777 struct dyn_parent *p;
1779 uint32_t bucket, version;
1783 bucket = DYN_BUCKET(hashval, V_curr_dyn_buckets);
1784 DYNSTATE_CRITICAL_ENTER();
1785 if (IS_IP4_FLOW_ID(pkt)) {
1786 struct dyn_ipv4_state *s;
1788 version = DYN_BUCKET_VERSION(bucket, ipv4_parent_add);
1789 s = dyn_lookup_ipv4_parent(pkt, rule, rule->id,
1790 rule->rulenum, bucket);
1793 * Exit from critical section because dyn_add_parent()
1794 * will acquire bucket lock.
1796 DYNSTATE_CRITICAL_EXIT();
1798 s = dyn_add_ipv4_parent(rule, rule->id,
1799 rule->rulenum, pkt, hashval, version, kidx);
1802 /* Now we are in critical section again. */
1808 else if (IS_IP6_FLOW_ID(pkt)) {
1809 struct dyn_ipv6_state *s;
1811 version = DYN_BUCKET_VERSION(bucket, ipv6_parent_add);
1812 s = dyn_lookup_ipv6_parent(pkt, zoneid, rule, rule->id,
1813 rule->rulenum, bucket);
1816 * Exit from critical section because dyn_add_parent()
1817 * can acquire bucket mutex.
1819 DYNSTATE_CRITICAL_EXIT();
1821 s = dyn_add_ipv6_parent(rule, rule->id,
1822 rule->rulenum, pkt, zoneid, hashval, version,
1826 /* Now we are in critical section again. */
1833 DYNSTATE_CRITICAL_EXIT();
1837 /* Check the limit */
1838 if (DPARENT_COUNT(p) >= limit) {
1839 DYNSTATE_CRITICAL_EXIT();
1840 if (V_fw_verbose && last_log != time_uptime) {
1841 last_log = time_uptime;
1842 snprintf(sbuf, sizeof(sbuf), "%u drop session",
1844 print_dyn_rule_flags(pkt, O_LIMIT,
1845 LOG_SECURITY | LOG_DEBUG, sbuf,
1846 "too many entries");
1851 /* Take new session into account. */
1852 DPARENT_COUNT_INC(p);
1854 * We must exit from critical section because the following code
1855 * can acquire bucket mutex.
1856 * We rely on the the 'count' field. The state will not expire
1857 * until it has some child states, i.e. 'count' field is not zero.
1858 * Return state pointer, it will be used by child states as parent.
1860 DYNSTATE_CRITICAL_EXIT();
1865 dyn_install_state(const struct ipfw_flow_id *pkt, uint32_t zoneid,
1866 uint16_t fibnum, const void *ulp, int pktlen, struct ip_fw *rule,
1867 struct ipfw_dyn_info *info, uint32_t limit, uint16_t limit_mask,
1868 uint16_t kidx, uint8_t type)
1870 struct ipfw_flow_id id;
1871 uint32_t hashval, parent_hashval, ruleid, rulenum;
1874 MPASS(type == O_LIMIT || type == O_KEEP_STATE);
1877 rulenum = rule->rulenum;
1878 if (type == O_LIMIT) {
1879 /* Create masked flow id and calculate bucket */
1880 id.addr_type = pkt->addr_type;
1881 id.proto = pkt->proto;
1882 id.fib = fibnum; /* unused */
1883 id.src_port = (limit_mask & DYN_SRC_PORT) ?
1885 id.dst_port = (limit_mask & DYN_DST_PORT) ?
1887 if (IS_IP4_FLOW_ID(pkt)) {
1888 id.src_ip = (limit_mask & DYN_SRC_ADDR) ?
1890 id.dst_ip = (limit_mask & DYN_DST_ADDR) ?
1894 else if (IS_IP6_FLOW_ID(pkt)) {
1895 if (limit_mask & DYN_SRC_ADDR)
1896 id.src_ip6 = pkt->src_ip6;
1898 memset(&id.src_ip6, 0, sizeof(id.src_ip6));
1899 if (limit_mask & DYN_DST_ADDR)
1900 id.dst_ip6 = pkt->dst_ip6;
1902 memset(&id.dst_ip6, 0, sizeof(id.dst_ip6));
1906 return (EAFNOSUPPORT);
1908 parent_hashval = hash_parent(&id, rule);
1909 rule = dyn_get_parent_state(&id, zoneid, rule, parent_hashval,
1913 if (V_fw_verbose && last_log != time_uptime) {
1914 last_log = time_uptime;
1915 snprintf(sbuf, sizeof(sbuf),
1916 "%u drop session", rule->rulenum);
1917 print_dyn_rule_flags(pkt, O_LIMIT,
1918 LOG_SECURITY | LOG_DEBUG, sbuf,
1919 "too many entries");
1925 * Limit is not reached, create new state.
1926 * Now rule points to parent state.
1930 hashval = hash_packet(pkt);
1931 if (IS_IP4_FLOW_ID(pkt))
1932 ret = dyn_add_ipv4_state(rule, ruleid, rulenum, pkt,
1933 ulp, pktlen, hashval, info, fibnum, kidx, type);
1935 else if (IS_IP6_FLOW_ID(pkt))
1936 ret = dyn_add_ipv6_state(rule, ruleid, rulenum, pkt,
1937 zoneid, ulp, pktlen, hashval, info, fibnum, kidx, type);
1942 if (type == O_LIMIT) {
1945 * We failed to create child state for O_LIMIT
1946 * opcode. Since we already counted it in the parent,
1947 * we must revert counter back. The 'rule' points to
1948 * parent state, use it to get dyn_parent.
1950 * XXXAE: it should be safe to use 'rule' pointer
1951 * without extra lookup, parent state is referenced
1952 * and should not be freed.
1954 if (IS_IP4_FLOW_ID(&id))
1956 ((struct dyn_ipv4_state *)rule)->limit);
1958 else if (IS_IP6_FLOW_ID(&id))
1960 ((struct dyn_ipv6_state *)rule)->limit);
1965 * EEXIST means that simultaneous thread has created this
1966 * state. Consider this as success.
1968 * XXXAE: should we invalidate 'info' content here?
1976 * Install dynamic state.
1977 * chain - ipfw's instance;
1978 * rule - the parent rule that installs the state;
1979 * cmd - opcode that installs the state;
1980 * args - ipfw arguments;
1981 * ulp - upper level protocol header;
1982 * pktlen - packet length;
1983 * info - dynamic state lookup info;
1984 * tablearg - tablearg id.
1986 * Returns non-zero value (failure) if state is not installed because
1987 * of errors or because session limitations are enforced.
1990 ipfw_dyn_install_state(struct ip_fw_chain *chain, struct ip_fw *rule,
1991 const ipfw_insn_limit *cmd, const struct ip_fw_args *args,
1992 const void *ulp, int pktlen, struct ipfw_dyn_info *info,
1996 uint16_t limit_mask;
1998 if (cmd->o.opcode == O_LIMIT) {
1999 limit = IP_FW_ARG_TABLEARG(chain, cmd->conn_limit, limit);
2000 limit_mask = cmd->limit_mask;
2005 return (dyn_install_state(&args->f_id,
2007 IS_IP6_FLOW_ID(&args->f_id) ? dyn_getscopeid(args):
2009 0, M_GETFIB(args->m), ulp, pktlen, rule, info, limit,
2010 limit_mask, cmd->o.arg1, cmd->o.opcode));
2014 * Free safe to remove state entries from expired lists.
2017 dyn_free_states(struct ip_fw_chain *chain)
2019 struct dyn_ipv4_state *s4, *s4n;
2021 struct dyn_ipv6_state *s6, *s6n;
2023 int cached_count, i;
2026 * We keep pointers to objects that are in use on each CPU
2027 * in the per-cpu dyn_hp pointer. When object is going to be
2028 * removed, first of it is unlinked from the corresponding
2029 * list. This leads to changing of dyn_bucket_xxx_delver version.
2030 * Unlinked objects is placed into corresponding dyn_expired_xxx
2031 * list. Reader that is going to dereference object pointer checks
2032 * dyn_bucket_xxx_delver version before and after storing pointer
2033 * into dyn_hp. If version is the same, the object is protected
2034 * from freeing and it is safe to dereference. Othervise reader
2035 * tries to iterate list again from the beginning, but this object
2036 * now unlinked and thus will not be accessible.
2038 * Copy dyn_hp pointers for each CPU into dyn_hp_cache array.
2039 * It does not matter that some pointer can be changed in
2040 * time while we are copying. We need to check, that objects
2041 * removed in the previous pass are not in use. And if dyn_hp
2042 * pointer does not contain it in the time when we are copying,
2043 * it will not appear there, because it is already unlinked.
2044 * And for new pointers we will not free objects that will be
2045 * unlinked in this pass.
2049 dyn_hp_cache[cached_count] = DYNSTATE_GET(i);
2050 if (dyn_hp_cache[cached_count] != NULL)
2055 * Free expired states that are safe to free.
2056 * Check each entry from previous pass in the dyn_expired_xxx
2057 * list, if pointer to the object is in the dyn_hp_cache array,
2058 * keep it until next pass. Otherwise it is safe to free the
2061 * XXXAE: optimize this to use SLIST_REMOVE_AFTER.
2063 #define DYN_FREE_STATES(s, next, name) do { \
2064 s = SLIST_FIRST(&V_dyn_expired_ ## name); \
2065 while (s != NULL) { \
2066 next = SLIST_NEXT(s, expired); \
2067 for (i = 0; i < cached_count; i++) \
2068 if (dyn_hp_cache[i] == s) \
2070 if (i == cached_count) { \
2071 if (s->type == O_LIMIT_PARENT && \
2072 s->limit->count != 0) { \
2076 SLIST_REMOVE(&V_dyn_expired_ ## name, \
2077 s, dyn_ ## name ## _state, expired); \
2078 if (s->type == O_LIMIT_PARENT) \
2079 uma_zfree(V_dyn_parent_zone, s->limit); \
2081 uma_zfree(V_dyn_data_zone, s->data); \
2082 uma_zfree(V_dyn_ ## name ## _zone, s); \
2089 * Protect access to expired lists with DYN_EXPIRED_LOCK.
2090 * Userland can invoke ipfw_expire_dyn_states() to delete
2091 * specific states, this will lead to modification of expired
2094 * XXXAE: do we need DYN_EXPIRED_LOCK? We can just use
2095 * IPFW_UH_WLOCK to protect access to these lists.
2098 DYN_FREE_STATES(s4, s4n, ipv4);
2100 DYN_FREE_STATES(s6, s6n, ipv6);
2102 DYN_EXPIRED_UNLOCK();
2103 #undef DYN_FREE_STATES
2108 * 0 when state is not matched by specified range;
2109 * 1 when state is matched by specified range;
2110 * 2 when state is matched by specified range and requested deletion of
2114 dyn_match_range(uint16_t rulenum, uint8_t set, const ipfw_range_tlv *rt)
2118 /* flush all states */
2119 if (rt->flags & IPFW_RCFLAG_ALL) {
2120 if (rt->flags & IPFW_RCFLAG_DYNAMIC)
2121 return (2); /* forced */
2124 if ((rt->flags & IPFW_RCFLAG_SET) != 0 && set != rt->set)
2126 if ((rt->flags & IPFW_RCFLAG_RANGE) != 0 &&
2127 (rulenum < rt->start_rule || rulenum > rt->end_rule))
2129 if (rt->flags & IPFW_RCFLAG_DYNAMIC)
2135 dyn_acquire_rule(struct ip_fw_chain *ch, struct dyn_data *data,
2136 struct ip_fw *rule, uint16_t kidx)
2138 struct dyn_state_obj *obj;
2141 * Do not acquire reference twice.
2142 * This can happen when rule deletion executed for
2143 * the same range, but different ruleset id.
2145 if (data->flags & DYN_REFERENCED)
2148 IPFW_UH_WLOCK_ASSERT(ch);
2151 data->flags |= DYN_REFERENCED;
2152 /* Reference the named object */
2153 obj = SRV_OBJECT(ch, kidx);
2155 MPASS(obj->no.etlv == IPFW_TLV_STATE_NAME);
2157 /* Reference the parent rule */
2162 dyn_release_rule(struct ip_fw_chain *ch, struct dyn_data *data,
2163 struct ip_fw *rule, uint16_t kidx)
2165 struct dyn_state_obj *obj;
2167 IPFW_UH_WLOCK_ASSERT(ch);
2170 obj = SRV_OBJECT(ch, kidx);
2171 if (obj->no.refcnt == 1)
2172 dyn_destroy(ch, &obj->no);
2176 if (--rule->refcnt == 1)
2177 ipfw_free_rule(rule);
2181 * We do not keep O_LIMIT_PARENT states when V_dyn_keep_states is enabled.
2182 * O_LIMIT state is created when new connection is going to be established
2183 * and there is no matching state. So, since the old parent rule was deleted
2184 * we can't create new states with old parent, and thus we can not account
2185 * new connections with already established connections, and can not do
2189 dyn_match_ipv4_state(struct ip_fw_chain *ch, struct dyn_ipv4_state *s,
2190 const ipfw_range_tlv *rt)
2195 if (s->type == O_LIMIT_PARENT) {
2196 rule = s->limit->parent;
2197 return (dyn_match_range(s->limit->rulenum, rule->set, rt));
2200 rule = s->data->parent;
2201 if (s->type == O_LIMIT)
2202 rule = ((struct dyn_ipv4_state *)rule)->limit->parent;
2204 ret = dyn_match_range(s->data->rulenum, rule->set, rt);
2205 if (ret == 0 || V_dyn_keep_states == 0 || ret > 1)
2208 dyn_acquire_rule(ch, s->data, rule, s->kidx);
2214 dyn_match_ipv6_state(struct ip_fw_chain *ch, struct dyn_ipv6_state *s,
2215 const ipfw_range_tlv *rt)
2220 if (s->type == O_LIMIT_PARENT) {
2221 rule = s->limit->parent;
2222 return (dyn_match_range(s->limit->rulenum, rule->set, rt));
2225 rule = s->data->parent;
2226 if (s->type == O_LIMIT)
2227 rule = ((struct dyn_ipv6_state *)rule)->limit->parent;
2229 ret = dyn_match_range(s->data->rulenum, rule->set, rt);
2230 if (ret == 0 || V_dyn_keep_states == 0 || ret > 1)
2233 dyn_acquire_rule(ch, s->data, rule, s->kidx);
2239 * Unlink expired entries from states lists.
2240 * @rt can be used to specify the range of states for deletion.
2243 dyn_expire_states(struct ip_fw_chain *ch, ipfw_range_tlv *rt)
2245 struct dyn_ipv4_slist expired_ipv4;
2247 struct dyn_ipv6_slist expired_ipv6;
2248 struct dyn_ipv6_state *s6, *s6n, *s6p;
2250 struct dyn_ipv4_state *s4, *s4n, *s4p;
2252 int bucket, removed, length, max_length;
2254 IPFW_UH_WLOCK_ASSERT(ch);
2257 * Unlink expired states from each bucket.
2258 * With acquired bucket lock iterate entries of each lists:
2259 * ipv4, ipv4_parent, ipv6, and ipv6_parent. Check expired time
2260 * and unlink entry from the list, link entry into temporary
2261 * expired_xxx lists then bump "del" bucket version.
2263 * When an entry is removed, corresponding states counter is
2264 * decremented. If entry has O_LIMIT type, parent's reference
2265 * counter is decremented.
2267 * NOTE: this function can be called from userspace context
2268 * when user deletes rules. In this case all matched states
2269 * will be forcedly unlinked. O_LIMIT_PARENT states will be kept
2270 * in the expired lists until reference counter become zero.
2272 #define DYN_UNLINK_STATES(s, prev, next, exp, af, name, extra) do { \
2276 s = CK_SLIST_FIRST(&V_dyn_ ## name [bucket]); \
2277 while (s != NULL) { \
2278 next = CK_SLIST_NEXT(s, entry); \
2279 if ((TIME_LEQ((s)->exp, time_uptime) && extra) || \
2281 dyn_match_ ## af ## _state(ch, s, rt))) { \
2283 CK_SLIST_REMOVE_AFTER(prev, entry); \
2285 CK_SLIST_REMOVE_HEAD( \
2286 &V_dyn_ ## name [bucket], entry); \
2288 SLIST_INSERT_HEAD(&expired_ ## af, s, expired); \
2289 if (s->type == O_LIMIT_PARENT) \
2290 DYN_COUNT_DEC(dyn_parent_count); \
2292 DYN_COUNT_DEC(dyn_count); \
2293 if (s->data->flags & DYN_REFERENCED) { \
2294 rule = s->data->parent; \
2295 if (s->type == O_LIMIT) \
2296 rule = ((__typeof(s)) \
2297 rule)->limit->parent;\
2298 dyn_release_rule(ch, s->data, \
2301 if (s->type == O_LIMIT) { \
2302 s = s->data->parent; \
2303 DPARENT_COUNT_DEC(s->limit); \
2313 DYN_BUCKET_VERSION_BUMP(bucket, name ## _del); \
2314 if (length > max_length) \
2315 max_length = length; \
2318 SLIST_INIT(&expired_ipv4);
2320 SLIST_INIT(&expired_ipv6);
2323 for (bucket = 0; bucket < V_curr_dyn_buckets; bucket++) {
2324 DYN_BUCKET_LOCK(bucket);
2325 DYN_UNLINK_STATES(s4, s4p, s4n, data->expire, ipv4, ipv4, 1);
2326 DYN_UNLINK_STATES(s4, s4p, s4n, limit->expire, ipv4,
2327 ipv4_parent, (s4->limit->count == 0));
2329 DYN_UNLINK_STATES(s6, s6p, s6n, data->expire, ipv6, ipv6, 1);
2330 DYN_UNLINK_STATES(s6, s6p, s6n, limit->expire, ipv6,
2331 ipv6_parent, (s6->limit->count == 0));
2333 DYN_BUCKET_UNLOCK(bucket);
2335 /* Update curr_max_length for statistics. */
2336 V_curr_max_length = max_length;
2338 * Concatenate temporary lists with global expired lists.
2341 SLIST_CONCAT(&V_dyn_expired_ipv4, &expired_ipv4,
2342 dyn_ipv4_state, expired);
2344 SLIST_CONCAT(&V_dyn_expired_ipv6, &expired_ipv6,
2345 dyn_ipv6_state, expired);
2347 DYN_EXPIRED_UNLOCK();
2348 #undef DYN_UNLINK_STATES
2349 #undef DYN_UNREF_STATES
2352 static struct mbuf *
2353 dyn_mgethdr(int len, uint16_t fibnum)
2357 m = m_gethdr(M_NOWAIT, MT_DATA);
2361 mac_netinet_firewall_send(m);
2363 M_SETFIB(m, fibnum);
2364 m->m_data += max_linkhdr;
2365 m->m_flags |= M_SKIP_FIREWALL;
2366 m->m_len = m->m_pkthdr.len = len;
2367 bzero(m->m_data, len);
2372 dyn_make_keepalive_ipv4(struct mbuf *m, in_addr_t src, in_addr_t dst,
2373 uint32_t seq, uint32_t ack, uint16_t sport, uint16_t dport)
2378 ip = mtod(m, struct ip *);
2380 ip->ip_hl = sizeof(*ip) >> 2;
2381 ip->ip_tos = IPTOS_LOWDELAY;
2382 ip->ip_len = htons(m->m_len);
2383 ip->ip_off |= htons(IP_DF);
2384 ip->ip_ttl = V_ip_defttl;
2385 ip->ip_p = IPPROTO_TCP;
2386 ip->ip_src.s_addr = htonl(src);
2387 ip->ip_dst.s_addr = htonl(dst);
2389 tcp = mtodo(m, sizeof(struct ip));
2390 tcp->th_sport = htons(sport);
2391 tcp->th_dport = htons(dport);
2392 tcp->th_off = sizeof(struct tcphdr) >> 2;
2393 tcp->th_seq = htonl(seq);
2394 tcp->th_ack = htonl(ack);
2395 tcp->th_flags = TH_ACK;
2396 tcp->th_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr,
2397 htons(sizeof(struct tcphdr) + IPPROTO_TCP));
2399 m->m_pkthdr.csum_data = offsetof(struct tcphdr, th_sum);
2400 m->m_pkthdr.csum_flags = CSUM_TCP;
2404 dyn_enqueue_keepalive_ipv4(struct mbufq *q, const struct dyn_ipv4_state *s)
2408 if ((s->data->state & ACK_FWD) == 0 && s->data->ack_fwd > 0) {
2409 m = dyn_mgethdr(sizeof(struct ip) + sizeof(struct tcphdr),
2412 dyn_make_keepalive_ipv4(m, s->dst, s->src,
2413 s->data->ack_fwd - 1, s->data->ack_rev,
2414 s->dport, s->sport);
2415 if (mbufq_enqueue(q, m)) {
2417 log(LOG_DEBUG, "ipfw: limit for IPv4 "
2418 "keepalive queue is reached.\n");
2424 if ((s->data->state & ACK_REV) == 0 && s->data->ack_rev > 0) {
2425 m = dyn_mgethdr(sizeof(struct ip) + sizeof(struct tcphdr),
2428 dyn_make_keepalive_ipv4(m, s->src, s->dst,
2429 s->data->ack_rev - 1, s->data->ack_fwd,
2430 s->sport, s->dport);
2431 if (mbufq_enqueue(q, m)) {
2433 log(LOG_DEBUG, "ipfw: limit for IPv4 "
2434 "keepalive queue is reached.\n");
2442 * Prepare and send keep-alive packets.
2445 dyn_send_keepalive_ipv4(struct ip_fw_chain *chain)
2449 struct dyn_ipv4_state *s;
2452 mbufq_init(&q, INT_MAX);
2453 IPFW_UH_RLOCK(chain);
2455 * It is safe to not use hazard pointer and just do lockless
2456 * access to the lists, because states entries can not be deleted
2457 * while we hold IPFW_UH_RLOCK.
2459 for (bucket = 0; bucket < V_curr_dyn_buckets; bucket++) {
2460 CK_SLIST_FOREACH(s, &V_dyn_ipv4[bucket], entry) {
2462 * Only established TCP connections that will
2463 * become expired withing dyn_keepalive_interval.
2465 if (s->proto != IPPROTO_TCP ||
2466 (s->data->state & BOTH_SYN) != BOTH_SYN ||
2467 TIME_LEQ(time_uptime + V_dyn_keepalive_interval,
2470 dyn_enqueue_keepalive_ipv4(&q, s);
2473 IPFW_UH_RUNLOCK(chain);
2474 while ((m = mbufq_dequeue(&q)) != NULL)
2475 ip_output(m, NULL, NULL, 0, NULL, NULL);
2480 dyn_make_keepalive_ipv6(struct mbuf *m, const struct in6_addr *src,
2481 const struct in6_addr *dst, uint32_t zoneid, uint32_t seq, uint32_t ack,
2482 uint16_t sport, uint16_t dport)
2485 struct ip6_hdr *ip6;
2487 ip6 = mtod(m, struct ip6_hdr *);
2488 ip6->ip6_vfc |= IPV6_VERSION;
2489 ip6->ip6_plen = htons(sizeof(struct tcphdr));
2490 ip6->ip6_nxt = IPPROTO_TCP;
2491 ip6->ip6_hlim = IPV6_DEFHLIM;
2492 ip6->ip6_src = *src;
2493 if (IN6_IS_ADDR_LINKLOCAL(src))
2494 ip6->ip6_src.s6_addr16[1] = htons(zoneid & 0xffff);
2495 ip6->ip6_dst = *dst;
2496 if (IN6_IS_ADDR_LINKLOCAL(dst))
2497 ip6->ip6_dst.s6_addr16[1] = htons(zoneid & 0xffff);
2499 tcp = mtodo(m, sizeof(struct ip6_hdr));
2500 tcp->th_sport = htons(sport);
2501 tcp->th_dport = htons(dport);
2502 tcp->th_off = sizeof(struct tcphdr) >> 2;
2503 tcp->th_seq = htonl(seq);
2504 tcp->th_ack = htonl(ack);
2505 tcp->th_flags = TH_ACK;
2506 tcp->th_sum = in6_cksum_pseudo(ip6, sizeof(struct tcphdr),
2509 m->m_pkthdr.csum_data = offsetof(struct tcphdr, th_sum);
2510 m->m_pkthdr.csum_flags = CSUM_TCP_IPV6;
2514 dyn_enqueue_keepalive_ipv6(struct mbufq *q, const struct dyn_ipv6_state *s)
2518 if ((s->data->state & ACK_FWD) == 0 && s->data->ack_fwd > 0) {
2519 m = dyn_mgethdr(sizeof(struct ip6_hdr) +
2520 sizeof(struct tcphdr), s->data->fibnum);
2522 dyn_make_keepalive_ipv6(m, &s->dst, &s->src,
2523 s->zoneid, s->data->ack_fwd - 1, s->data->ack_rev,
2524 s->dport, s->sport);
2525 if (mbufq_enqueue(q, m)) {
2527 log(LOG_DEBUG, "ipfw: limit for IPv6 "
2528 "keepalive queue is reached.\n");
2534 if ((s->data->state & ACK_REV) == 0 && s->data->ack_rev > 0) {
2535 m = dyn_mgethdr(sizeof(struct ip6_hdr) +
2536 sizeof(struct tcphdr), s->data->fibnum);
2538 dyn_make_keepalive_ipv6(m, &s->src, &s->dst,
2539 s->zoneid, s->data->ack_rev - 1, s->data->ack_fwd,
2540 s->sport, s->dport);
2541 if (mbufq_enqueue(q, m)) {
2543 log(LOG_DEBUG, "ipfw: limit for IPv6 "
2544 "keepalive queue is reached.\n");
2552 dyn_send_keepalive_ipv6(struct ip_fw_chain *chain)
2556 struct dyn_ipv6_state *s;
2559 mbufq_init(&q, INT_MAX);
2560 IPFW_UH_RLOCK(chain);
2562 * It is safe to not use hazard pointer and just do lockless
2563 * access to the lists, because states entries can not be deleted
2564 * while we hold IPFW_UH_RLOCK.
2566 for (bucket = 0; bucket < V_curr_dyn_buckets; bucket++) {
2567 CK_SLIST_FOREACH(s, &V_dyn_ipv6[bucket], entry) {
2569 * Only established TCP connections that will
2570 * become expired withing dyn_keepalive_interval.
2572 if (s->proto != IPPROTO_TCP ||
2573 (s->data->state & BOTH_SYN) != BOTH_SYN ||
2574 TIME_LEQ(time_uptime + V_dyn_keepalive_interval,
2577 dyn_enqueue_keepalive_ipv6(&q, s);
2580 IPFW_UH_RUNLOCK(chain);
2581 while ((m = mbufq_dequeue(&q)) != NULL)
2582 ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL);
2587 dyn_grow_hashtable(struct ip_fw_chain *chain, uint32_t new)
2590 struct dyn_ipv6ck_slist *ipv6, *ipv6_parent;
2591 uint32_t *ipv6_add, *ipv6_del, *ipv6_parent_add, *ipv6_parent_del;
2592 struct dyn_ipv6_state *s6;
2594 struct dyn_ipv4ck_slist *ipv4, *ipv4_parent;
2595 uint32_t *ipv4_add, *ipv4_del, *ipv4_parent_add, *ipv4_parent_del;
2596 struct dyn_ipv4_state *s4;
2597 struct mtx *bucket_lock;
2601 MPASS(powerof2(new));
2602 DYN_DEBUG("grow hash size %u -> %u", V_curr_dyn_buckets, new);
2604 * Allocate and initialize new lists.
2605 * XXXAE: on memory pressure this can disable callout timer.
2607 bucket_lock = malloc(new * sizeof(struct mtx), M_IPFW,
2609 ipv4 = malloc(new * sizeof(struct dyn_ipv4ck_slist), M_IPFW,
2611 ipv4_parent = malloc(new * sizeof(struct dyn_ipv4ck_slist), M_IPFW,
2613 ipv4_add = malloc(new * sizeof(uint32_t), M_IPFW, M_WAITOK | M_ZERO);
2614 ipv4_del = malloc(new * sizeof(uint32_t), M_IPFW, M_WAITOK | M_ZERO);
2615 ipv4_parent_add = malloc(new * sizeof(uint32_t), M_IPFW,
2617 ipv4_parent_del = malloc(new * sizeof(uint32_t), M_IPFW,
2620 ipv6 = malloc(new * sizeof(struct dyn_ipv6ck_slist), M_IPFW,
2622 ipv6_parent = malloc(new * sizeof(struct dyn_ipv6ck_slist), M_IPFW,
2624 ipv6_add = malloc(new * sizeof(uint32_t), M_IPFW, M_WAITOK | M_ZERO);
2625 ipv6_del = malloc(new * sizeof(uint32_t), M_IPFW, M_WAITOK | M_ZERO);
2626 ipv6_parent_add = malloc(new * sizeof(uint32_t), M_IPFW,
2628 ipv6_parent_del = malloc(new * sizeof(uint32_t), M_IPFW,
2631 for (bucket = 0; bucket < new; bucket++) {
2632 DYN_BUCKET_LOCK_INIT(bucket_lock, bucket);
2633 CK_SLIST_INIT(&ipv4[bucket]);
2634 CK_SLIST_INIT(&ipv4_parent[bucket]);
2636 CK_SLIST_INIT(&ipv6[bucket]);
2637 CK_SLIST_INIT(&ipv6_parent[bucket]);
2641 #define DYN_RELINK_STATES(s, hval, i, head, ohead) do { \
2642 while ((s = CK_SLIST_FIRST(&V_dyn_ ## ohead[i])) != NULL) { \
2643 CK_SLIST_REMOVE_HEAD(&V_dyn_ ## ohead[i], entry); \
2644 CK_SLIST_INSERT_HEAD(&head[DYN_BUCKET(s->hval, new)], \
2649 * Prevent rules changing from userland.
2651 IPFW_UH_WLOCK(chain);
2653 * Hold traffic processing until we finish resize to
2654 * prevent access to states lists.
2657 /* Re-link all dynamic states */
2658 for (bucket = 0; bucket < V_curr_dyn_buckets; bucket++) {
2659 DYN_RELINK_STATES(s4, data->hashval, bucket, ipv4, ipv4);
2660 DYN_RELINK_STATES(s4, limit->hashval, bucket, ipv4_parent,
2663 DYN_RELINK_STATES(s6, data->hashval, bucket, ipv6, ipv6);
2664 DYN_RELINK_STATES(s6, limit->hashval, bucket, ipv6_parent,
2669 #define DYN_SWAP_PTR(old, new, tmp) do { \
2675 DYN_SWAP_PTR(V_dyn_bucket_lock, bucket_lock, tmp);
2676 DYN_SWAP_PTR(V_dyn_ipv4, ipv4, tmp);
2677 DYN_SWAP_PTR(V_dyn_ipv4_parent, ipv4_parent, tmp);
2678 DYN_SWAP_PTR(V_dyn_ipv4_add, ipv4_add, tmp);
2679 DYN_SWAP_PTR(V_dyn_ipv4_parent_add, ipv4_parent_add, tmp);
2680 DYN_SWAP_PTR(V_dyn_ipv4_del, ipv4_del, tmp);
2681 DYN_SWAP_PTR(V_dyn_ipv4_parent_del, ipv4_parent_del, tmp);
2684 DYN_SWAP_PTR(V_dyn_ipv6, ipv6, tmp);
2685 DYN_SWAP_PTR(V_dyn_ipv6_parent, ipv6_parent, tmp);
2686 DYN_SWAP_PTR(V_dyn_ipv6_add, ipv6_add, tmp);
2687 DYN_SWAP_PTR(V_dyn_ipv6_parent_add, ipv6_parent_add, tmp);
2688 DYN_SWAP_PTR(V_dyn_ipv6_del, ipv6_del, tmp);
2689 DYN_SWAP_PTR(V_dyn_ipv6_parent_del, ipv6_parent_del, tmp);
2691 bucket = V_curr_dyn_buckets;
2692 V_curr_dyn_buckets = new;
2694 IPFW_WUNLOCK(chain);
2695 IPFW_UH_WUNLOCK(chain);
2697 /* Release old resources */
2698 while (bucket-- != 0)
2699 DYN_BUCKET_LOCK_DESTROY(bucket_lock, bucket);
2700 free(bucket_lock, M_IPFW);
2702 free(ipv4_parent, M_IPFW);
2703 free(ipv4_add, M_IPFW);
2704 free(ipv4_parent_add, M_IPFW);
2705 free(ipv4_del, M_IPFW);
2706 free(ipv4_parent_del, M_IPFW);
2709 free(ipv6_parent, M_IPFW);
2710 free(ipv6_add, M_IPFW);
2711 free(ipv6_parent_add, M_IPFW);
2712 free(ipv6_del, M_IPFW);
2713 free(ipv6_parent_del, M_IPFW);
2718 * This function is used to perform various maintenance
2719 * on dynamic hash lists. Currently it is called every second.
2722 dyn_tick(void *vnetx)
2726 CURVNET_SET((struct vnet *)vnetx);
2728 * First free states unlinked in previous passes.
2730 dyn_free_states(&V_layer3_chain);
2732 * Now unlink others expired states.
2733 * We use IPFW_UH_WLOCK to avoid concurrent call of
2734 * dyn_expire_states(). It is the only function that does
2735 * deletion of state entries from states lists.
2737 IPFW_UH_WLOCK(&V_layer3_chain);
2738 dyn_expire_states(&V_layer3_chain, NULL);
2739 IPFW_UH_WUNLOCK(&V_layer3_chain);
2741 * Send keepalives if they are enabled and the time has come.
2743 if (V_dyn_keepalive != 0 &&
2744 V_dyn_keepalive_last + V_dyn_keepalive_period <= time_uptime) {
2745 V_dyn_keepalive_last = time_uptime;
2746 dyn_send_keepalive_ipv4(&V_layer3_chain);
2748 dyn_send_keepalive_ipv6(&V_layer3_chain);
2752 * Check if we need to resize the hash:
2753 * if current number of states exceeds number of buckets in hash,
2754 * and dyn_buckets_max permits to grow the number of buckets, then
2755 * do it. Grow hash size to the minimum power of 2 which is bigger
2756 * than current states count.
2758 if (V_curr_dyn_buckets < V_dyn_buckets_max &&
2759 (V_curr_dyn_buckets < V_dyn_count / 2 || (
2760 V_curr_dyn_buckets < V_dyn_count && V_curr_max_length > 8))) {
2761 buckets = 1 << fls(V_dyn_count);
2762 if (buckets > V_dyn_buckets_max)
2763 buckets = V_dyn_buckets_max;
2764 dyn_grow_hashtable(&V_layer3_chain, buckets);
2767 callout_reset_on(&V_dyn_timeout, hz, dyn_tick, vnetx, 0);
2772 ipfw_expire_dyn_states(struct ip_fw_chain *chain, ipfw_range_tlv *rt)
2775 * Do not perform any checks if we currently have no dynamic states
2777 if (V_dyn_count == 0)
2780 IPFW_UH_WLOCK_ASSERT(chain);
2781 dyn_expire_states(chain, rt);
2785 * Pass through all states and reset eaction for orphaned rules.
2788 ipfw_dyn_reset_eaction(struct ip_fw_chain *ch, uint16_t eaction_id,
2789 uint16_t default_id, uint16_t instance_id)
2792 struct dyn_ipv6_state *s6;
2794 struct dyn_ipv4_state *s4;
2798 #define DYN_RESET_EACTION(s, h, b) \
2799 CK_SLIST_FOREACH(s, &V_dyn_ ## h[b], entry) { \
2800 if ((s->data->flags & DYN_REFERENCED) == 0) \
2802 rule = s->data->parent; \
2803 if (s->type == O_LIMIT) \
2804 rule = ((__typeof(s))rule)->limit->parent; \
2805 ipfw_reset_eaction(ch, rule, eaction_id, \
2806 default_id, instance_id); \
2809 IPFW_UH_WLOCK_ASSERT(ch);
2810 if (V_dyn_count == 0)
2812 for (bucket = 0; bucket < V_curr_dyn_buckets; bucket++) {
2813 DYN_RESET_EACTION(s4, ipv4, bucket);
2815 DYN_RESET_EACTION(s6, ipv6, bucket);
2821 * Returns size of dynamic states in legacy format
2827 return ((V_dyn_count + V_dyn_parent_count) * sizeof(ipfw_dyn_rule));
2831 * Returns number of dynamic states.
2832 * Marks every named object index used by dynamic states with bit in @bmask.
2833 * Returns number of named objects accounted in bmask via @nocnt.
2834 * Used by dump format v1 (current).
2837 ipfw_dyn_get_count(uint32_t *bmask, int *nocnt)
2840 struct dyn_ipv6_state *s6;
2842 struct dyn_ipv4_state *s4;
2845 #define DYN_COUNT_OBJECTS(s, h, b) \
2846 CK_SLIST_FOREACH(s, &V_dyn_ ## h[b], entry) { \
2847 MPASS(s->kidx != 0); \
2848 if (ipfw_mark_object_kidx(bmask, IPFW_TLV_STATE_NAME, \
2853 IPFW_UH_RLOCK_ASSERT(&V_layer3_chain);
2855 /* No need to pass through all the buckets. */
2857 if (V_dyn_count + V_dyn_parent_count == 0)
2860 for (bucket = 0; bucket < V_curr_dyn_buckets; bucket++) {
2861 DYN_COUNT_OBJECTS(s4, ipv4, bucket);
2863 DYN_COUNT_OBJECTS(s6, ipv6, bucket);
2867 return (V_dyn_count + V_dyn_parent_count);
2871 * Check if rule contains at least one dynamic opcode.
2873 * Returns 1 if such opcode is found, 0 otherwise.
2876 ipfw_is_dyn_rule(struct ip_fw *rule)
2884 for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) {
2885 cmdlen = F_LEN(cmd);
2887 switch (cmd->opcode) {
2900 dyn_export_parent(const struct dyn_parent *p, uint16_t kidx, uint8_t set,
2904 dst->dyn_type = O_LIMIT_PARENT;
2906 dst->count = (uint16_t)DPARENT_COUNT(p);
2907 dst->expire = TIME_LEQ(p->expire, time_uptime) ? 0:
2908 p->expire - time_uptime;
2910 /* 'rule' is used to pass up the rule number and set */
2911 memcpy(&dst->rule, &p->rulenum, sizeof(p->rulenum));
2913 /* store set number into high word of dst->rule pointer. */
2914 memcpy((char *)&dst->rule + sizeof(p->rulenum), &set, sizeof(set));
2923 dst->bucket = p->hashval;
2925 * The legacy userland code will interpret a NULL here as a marker
2926 * for the last dynamic rule.
2928 dst->next = (ipfw_dyn_rule *)1;
2932 dyn_export_data(const struct dyn_data *data, uint16_t kidx, uint8_t type,
2933 uint8_t set, ipfw_dyn_rule *dst)
2936 dst->dyn_type = type;
2938 dst->pcnt = data->pcnt_fwd + data->pcnt_rev;
2939 dst->bcnt = data->bcnt_fwd + data->bcnt_rev;
2940 dst->expire = TIME_LEQ(data->expire, time_uptime) ? 0:
2941 data->expire - time_uptime;
2943 /* 'rule' is used to pass up the rule number and set */
2944 memcpy(&dst->rule, &data->rulenum, sizeof(data->rulenum));
2946 /* store set number into high word of dst->rule pointer. */
2947 memcpy((char *)&dst->rule + sizeof(data->rulenum), &set, sizeof(set));
2949 dst->state = data->state;
2950 if (data->flags & DYN_REFERENCED)
2951 dst->state |= IPFW_DYN_ORPHANED;
2955 dst->ack_fwd = data->ack_fwd;
2956 dst->ack_rev = data->ack_rev;
2958 dst->bucket = data->hashval;
2960 * The legacy userland code will interpret a NULL here as a marker
2961 * for the last dynamic rule.
2963 dst->next = (ipfw_dyn_rule *)1;
2967 dyn_export_ipv4_state(const struct dyn_ipv4_state *s, ipfw_dyn_rule *dst)
2972 case O_LIMIT_PARENT:
2973 rule = s->limit->parent;
2974 dyn_export_parent(s->limit, s->kidx, rule->set, dst);
2977 rule = s->data->parent;
2978 if (s->type == O_LIMIT)
2979 rule = ((struct dyn_ipv4_state *)rule)->limit->parent;
2980 dyn_export_data(s->data, s->kidx, s->type, rule->set, dst);
2983 dst->id.dst_ip = s->dst;
2984 dst->id.src_ip = s->src;
2985 dst->id.dst_port = s->dport;
2986 dst->id.src_port = s->sport;
2987 dst->id.fib = s->data->fibnum;
2988 dst->id.proto = s->proto;
2990 dst->id.addr_type = 4;
2992 memset(&dst->id.dst_ip6, 0, sizeof(dst->id.dst_ip6));
2993 memset(&dst->id.src_ip6, 0, sizeof(dst->id.src_ip6));
2994 dst->id.flow_id6 = dst->id.extra = 0;
2999 dyn_export_ipv6_state(const struct dyn_ipv6_state *s, ipfw_dyn_rule *dst)
3004 case O_LIMIT_PARENT:
3005 rule = s->limit->parent;
3006 dyn_export_parent(s->limit, s->kidx, rule->set, dst);
3009 rule = s->data->parent;
3010 if (s->type == O_LIMIT)
3011 rule = ((struct dyn_ipv6_state *)rule)->limit->parent;
3012 dyn_export_data(s->data, s->kidx, s->type, rule->set, dst);
3015 dst->id.src_ip6 = s->src;
3016 dst->id.dst_ip6 = s->dst;
3017 dst->id.dst_port = s->dport;
3018 dst->id.src_port = s->sport;
3019 dst->id.fib = s->data->fibnum;
3020 dst->id.proto = s->proto;
3022 dst->id.addr_type = 6;
3024 dst->id.dst_ip = dst->id.src_ip = 0;
3025 dst->id.flow_id6 = dst->id.extra = 0;
3030 * Fills the buffer given by @sd with dynamic states.
3031 * Used by dump format v1 (current).
3033 * Returns 0 on success.
3036 ipfw_dump_states(struct ip_fw_chain *chain, struct sockopt_data *sd)
3039 struct dyn_ipv6_state *s6;
3041 struct dyn_ipv4_state *s4;
3042 ipfw_obj_dyntlv *dst, *last;
3043 ipfw_obj_ctlv *ctlv;
3046 if (V_dyn_count == 0)
3050 * IPFW_UH_RLOCK garantees that another userland request
3051 * and callout thread will not delete entries from states
3054 IPFW_UH_RLOCK_ASSERT(chain);
3056 ctlv = (ipfw_obj_ctlv *)ipfw_get_sopt_space(sd, sizeof(*ctlv));
3059 ctlv->head.type = IPFW_TLV_DYNSTATE_LIST;
3060 ctlv->objsize = sizeof(ipfw_obj_dyntlv);
3063 #define DYN_EXPORT_STATES(s, af, h, b) \
3064 CK_SLIST_FOREACH(s, &V_dyn_ ## h[b], entry) { \
3065 dst = (ipfw_obj_dyntlv *)ipfw_get_sopt_space(sd, \
3066 sizeof(ipfw_obj_dyntlv)); \
3069 dyn_export_ ## af ## _state(s, &dst->state); \
3070 dst->head.length = sizeof(ipfw_obj_dyntlv); \
3071 dst->head.type = IPFW_TLV_DYN_ENT; \
3075 for (bucket = 0; bucket < V_curr_dyn_buckets; bucket++) {
3076 DYN_EXPORT_STATES(s4, ipv4, ipv4_parent, bucket);
3077 DYN_EXPORT_STATES(s4, ipv4, ipv4, bucket);
3079 DYN_EXPORT_STATES(s6, ipv6, ipv6_parent, bucket);
3080 DYN_EXPORT_STATES(s6, ipv6, ipv6, bucket);
3084 /* mark last dynamic rule */
3086 last->head.flags = IPFW_DF_LAST; /* XXX: unused */
3088 #undef DYN_EXPORT_STATES
3092 * Fill given buffer with dynamic states (legacy format).
3093 * IPFW_UH_RLOCK has to be held while calling.
3096 ipfw_get_dynamic(struct ip_fw_chain *chain, char **pbp, const char *ep)
3099 struct dyn_ipv6_state *s6;
3101 struct dyn_ipv4_state *s4;
3102 ipfw_dyn_rule *p, *last = NULL;
3106 if (V_dyn_count == 0)
3110 IPFW_UH_RLOCK_ASSERT(chain);
3112 #define DYN_EXPORT_STATES(s, af, head, b) \
3113 CK_SLIST_FOREACH(s, &V_dyn_ ## head[b], entry) { \
3114 if (bp + sizeof(*p) > ep) \
3116 p = (ipfw_dyn_rule *)bp; \
3117 dyn_export_ ## af ## _state(s, p); \
3122 for (bucket = 0; bucket < V_curr_dyn_buckets; bucket++) {
3123 DYN_EXPORT_STATES(s4, ipv4, ipv4_parent, bucket);
3124 DYN_EXPORT_STATES(s4, ipv4, ipv4, bucket);
3126 DYN_EXPORT_STATES(s6, ipv6, ipv6_parent, bucket);
3127 DYN_EXPORT_STATES(s6, ipv6, ipv6, bucket);
3131 if (last != NULL) /* mark last dynamic rule */
3134 #undef DYN_EXPORT_STATES
3138 ipfw_dyn_init(struct ip_fw_chain *chain)
3141 #ifdef IPFIREWALL_JENKINSHASH
3142 V_dyn_hashseed = arc4random();
3144 V_dyn_max = 16384; /* max # of states */
3145 V_dyn_parent_max = 4096; /* max # of parent states */
3146 V_dyn_buckets_max = 8192; /* must be power of 2 */
3148 V_dyn_ack_lifetime = 300;
3149 V_dyn_syn_lifetime = 20;
3150 V_dyn_fin_lifetime = 1;
3151 V_dyn_rst_lifetime = 1;
3152 V_dyn_udp_lifetime = 10;
3153 V_dyn_short_lifetime = 5;
3155 V_dyn_keepalive_interval = 20;
3156 V_dyn_keepalive_period = 5;
3157 V_dyn_keepalive = 1; /* send keepalives */
3158 V_dyn_keepalive_last = time_uptime;
3160 V_dyn_data_zone = uma_zcreate("IPFW dynamic states data",
3161 sizeof(struct dyn_data), NULL, NULL, NULL, NULL,
3163 uma_zone_set_max(V_dyn_data_zone, V_dyn_max);
3165 V_dyn_parent_zone = uma_zcreate("IPFW parent dynamic states",
3166 sizeof(struct dyn_parent), NULL, NULL, NULL, NULL,
3168 uma_zone_set_max(V_dyn_parent_zone, V_dyn_parent_max);
3170 SLIST_INIT(&V_dyn_expired_ipv4);
3172 V_dyn_ipv4_parent = NULL;
3173 V_dyn_ipv4_zone = uma_zcreate("IPFW IPv4 dynamic states",
3174 sizeof(struct dyn_ipv4_state), NULL, NULL, NULL, NULL,
3178 SLIST_INIT(&V_dyn_expired_ipv6);
3180 V_dyn_ipv6_parent = NULL;
3181 V_dyn_ipv6_zone = uma_zcreate("IPFW IPv6 dynamic states",
3182 sizeof(struct dyn_ipv6_state), NULL, NULL, NULL, NULL,
3186 /* Initialize buckets. */
3187 V_curr_dyn_buckets = 0;
3188 V_dyn_bucket_lock = NULL;
3189 dyn_grow_hashtable(chain, 256);
3191 if (IS_DEFAULT_VNET(curvnet))
3192 dyn_hp_cache = malloc(mp_ncpus * sizeof(void *), M_IPFW,
3195 DYN_EXPIRED_LOCK_INIT();
3196 callout_init(&V_dyn_timeout, 1);
3197 callout_reset(&V_dyn_timeout, hz, dyn_tick, curvnet);
3198 IPFW_ADD_OBJ_REWRITER(IS_DEFAULT_VNET(curvnet), dyn_opcodes);
3202 ipfw_dyn_uninit(int pass)
3205 struct dyn_ipv6_state *s6;
3207 struct dyn_ipv4_state *s4;
3211 callout_drain(&V_dyn_timeout);
3214 IPFW_DEL_OBJ_REWRITER(IS_DEFAULT_VNET(curvnet), dyn_opcodes);
3215 DYN_EXPIRED_LOCK_DESTROY();
3217 #define DYN_FREE_STATES_FORCED(CK, s, af, name, en) do { \
3218 while ((s = CK ## SLIST_FIRST(&V_dyn_ ## name)) != NULL) { \
3219 CK ## SLIST_REMOVE_HEAD(&V_dyn_ ## name, en); \
3220 if (s->type == O_LIMIT_PARENT) \
3221 uma_zfree(V_dyn_parent_zone, s->limit); \
3223 uma_zfree(V_dyn_data_zone, s->data); \
3224 uma_zfree(V_dyn_ ## af ## _zone, s); \
3227 for (bucket = 0; bucket < V_curr_dyn_buckets; bucket++) {
3228 DYN_BUCKET_LOCK_DESTROY(V_dyn_bucket_lock, bucket);
3230 DYN_FREE_STATES_FORCED(CK_, s4, ipv4, ipv4[bucket], entry);
3231 DYN_FREE_STATES_FORCED(CK_, s4, ipv4, ipv4_parent[bucket],
3234 DYN_FREE_STATES_FORCED(CK_, s6, ipv6, ipv6[bucket], entry);
3235 DYN_FREE_STATES_FORCED(CK_, s6, ipv6, ipv6_parent[bucket],
3239 DYN_FREE_STATES_FORCED(, s4, ipv4, expired_ipv4, expired);
3241 DYN_FREE_STATES_FORCED(, s6, ipv6, expired_ipv6, expired);
3243 #undef DYN_FREE_STATES_FORCED
3245 uma_zdestroy(V_dyn_ipv4_zone);
3246 uma_zdestroy(V_dyn_data_zone);
3247 uma_zdestroy(V_dyn_parent_zone);
3249 uma_zdestroy(V_dyn_ipv6_zone);
3250 free(V_dyn_ipv6, M_IPFW);
3251 free(V_dyn_ipv6_parent, M_IPFW);
3252 free(V_dyn_ipv6_add, M_IPFW);
3253 free(V_dyn_ipv6_parent_add, M_IPFW);
3254 free(V_dyn_ipv6_del, M_IPFW);
3255 free(V_dyn_ipv6_parent_del, M_IPFW);
3257 free(V_dyn_bucket_lock, M_IPFW);
3258 free(V_dyn_ipv4, M_IPFW);
3259 free(V_dyn_ipv4_parent, M_IPFW);
3260 free(V_dyn_ipv4_add, M_IPFW);
3261 free(V_dyn_ipv4_parent_add, M_IPFW);
3262 free(V_dyn_ipv4_del, M_IPFW);
3263 free(V_dyn_ipv4_parent_del, M_IPFW);
3264 if (IS_DEFAULT_VNET(curvnet))
3265 free(dyn_hp_cache, M_IPFW);