#if defined(KERNEL) || defined(_KERNEL)
# undef KERNEL
# undef _KERNEL
# define KERNEL 1
# define _KERNEL 1
#endif
#include <sys/errno.h>
#include <sys/types.h>
#include <sys/param.h>
#include <sys/file.h>
#if defined(_KERNEL) && defined(__FreeBSD__) && \
!defined(KLD_MODULE)
#include "opt_inet6.h"
#endif
#if !defined(_KERNEL) && !defined(__KERNEL__)
# include <stdio.h>
# include <stdlib.h>
# include <string.h>
# define _KERNEL
# include <sys/uio.h>
# undef _KERNEL
#endif
#if defined(_KERNEL) && defined(__FreeBSD__)
# include <sys/filio.h>
# include <sys/fcntl.h>
#else
# include <sys/ioctl.h>
#endif
#include <sys/time.h>
# include <sys/protosw.h>
#include <sys/socket.h>
#if defined(_KERNEL)
# include <sys/systm.h>
# if !defined(__SVR4)
# include <sys/mbuf.h>
# endif
#endif
#if defined(__SVR4)
# include <sys/filio.h>
# include <sys/byteorder.h>
# ifdef _KERNEL
# include <sys/dditypes.h>
# endif
# include <sys/stream.h>
# include <sys/kmem.h>
#endif
#include <net/if.h>
#ifdef sun
# include <net/af.h>
#endif
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
# include <netinet/tcp_fsm.h>
#include <netinet/udp.h>
#include <netinet/ip_icmp.h>
#if !defined(_KERNEL)
# include "ipf.h"
#endif
#include "netinet/ip_compat.h"
#include "netinet/ip_fil.h"
#include "netinet/ip_nat.h"
#include "netinet/ip_frag.h"
#include "netinet/ip_state.h"
#include "netinet/ip_proxy.h"
#include "netinet/ip_lookup.h"
#include "netinet/ip_dstlist.h"
#include "netinet/ip_sync.h"
#ifdef USE_INET6
#include <netinet/icmp6.h>
#endif
#ifdef __FreeBSD__
# include <sys/malloc.h>
# if defined(_KERNEL) && !defined(IPFILTER_LKM)
# include <sys/libkern.h>
# include <sys/systm.h>
# endif
#endif
static ipftuneable_t ipf_state_tuneables[] = {
{ { (void *)offsetof(ipf_state_softc_t, ipf_state_max) },
"state_max", 1, 0x7fffffff,
stsizeof(ipf_state_softc_t, ipf_state_max),
0, NULL, NULL },
{ { (void *)offsetof(ipf_state_softc_t, ipf_state_size) },
"state_size", 1, 0x7fffffff,
stsizeof(ipf_state_softc_t, ipf_state_size),
0, NULL, ipf_state_rehash },
{ { (void *)offsetof(ipf_state_softc_t, ipf_state_lock) },
"state_lock", 0, 1,
stsizeof(ipf_state_softc_t, ipf_state_lock),
IPFT_RDONLY, NULL, NULL },
{ { (void *)offsetof(ipf_state_softc_t, ipf_state_maxbucket) },
"state_maxbucket", 1, 0x7fffffff,
stsizeof(ipf_state_softc_t, ipf_state_maxbucket),
0, NULL, NULL },
{ { (void *)offsetof(ipf_state_softc_t, ipf_state_logging) },
"state_logging",0, 1,
stsizeof(ipf_state_softc_t, ipf_state_logging),
0, NULL, NULL },
{ { (void *)offsetof(ipf_state_softc_t, ipf_state_wm_high) },
"state_wm_high",2, 100,
stsizeof(ipf_state_softc_t, ipf_state_wm_high),
0, NULL, NULL },
{ { (void *)offsetof(ipf_state_softc_t, ipf_state_wm_low) },
"state_wm_low", 1, 99,
stsizeof(ipf_state_softc_t, ipf_state_wm_low),
0, NULL, NULL },
{ { (void *)offsetof(ipf_state_softc_t, ipf_state_wm_freq) },
"state_wm_freq",2, 999999,
stsizeof(ipf_state_softc_t, ipf_state_wm_freq),
0, NULL, NULL },
{ { NULL },
NULL, 0, 0,
0,
0, NULL, NULL }
};
#define SINCL(x) ATOMIC_INCL(softs->x)
#define SBUMP(x) (softs->x)++
#define SBUMPD(x, y) do { (softs->x.y)++; DT(y); } while (0)
#define SBUMPDX(x, y, z)do { (softs->x.y)++; DT(z); } while (0)
#ifdef USE_INET6
static ipstate_t *ipf_checkicmp6matchingstate(fr_info_t *);
#endif
static int ipf_allowstateicmp(fr_info_t *, ipstate_t *, i6addr_t *);
static ipstate_t *ipf_matchsrcdst(fr_info_t *, ipstate_t *, i6addr_t *,
i6addr_t *, tcphdr_t *, u_32_t);
static ipstate_t *ipf_checkicmpmatchingstate(fr_info_t *);
static int ipf_state_flush_entry(ipf_main_softc_t *, void *);
static ips_stat_t *ipf_state_stats(ipf_main_softc_t *);
static int ipf_state_del(ipf_main_softc_t *, ipstate_t *, int);
static int ipf_state_remove(ipf_main_softc_t *, caddr_t);
static int ipf_state_match(ipstate_t *is1, ipstate_t *is2);
static int ipf_state_matchaddresses(ipstate_t *is1, ipstate_t *is2);
static int ipf_state_matchipv4addrs(ipstate_t *is1, ipstate_t *is2);
static int ipf_state_matchipv6addrs(ipstate_t *is1, ipstate_t *is2);
static int ipf_state_matchisps(ipstate_t *is1, ipstate_t *is2);
static int ipf_state_matchports(udpinfo_t *is1, udpinfo_t *is2);
static int ipf_state_matcharray(ipstate_t *, int *, u_long);
static void ipf_ipsmove(ipf_state_softc_t *, ipstate_t *, u_int);
static int ipf_state_tcp(ipf_main_softc_t *, ipf_state_softc_t *,
fr_info_t *, tcphdr_t *, ipstate_t *);
static int ipf_tcpoptions(ipf_state_softc_t *, fr_info_t *,
tcphdr_t *, tcpdata_t *);
static ipstate_t *ipf_state_clone(fr_info_t *, tcphdr_t *, ipstate_t *);
static void ipf_fixinisn(fr_info_t *, ipstate_t *);
static void ipf_fixoutisn(fr_info_t *, ipstate_t *);
static void ipf_checknewisn(fr_info_t *, ipstate_t *);
static int ipf_state_iter(ipf_main_softc_t *, ipftoken_t *,
ipfgeniter_t *, ipfobj_t *);
static int ipf_state_gettable(ipf_main_softc_t *, ipf_state_softc_t *,
char *);
static int ipf_state_tcpinwindow(struct fr_info *, struct tcpdata *,
struct tcpdata *, tcphdr_t *, int);
static int ipf_state_getent(ipf_main_softc_t *, ipf_state_softc_t *,
caddr_t);
static int ipf_state_putent(ipf_main_softc_t *, ipf_state_softc_t *,
caddr_t);
#define ONE_DAY IPF_TTLVAL(1 * 86400)
#define FIVE_DAYS (5 * ONE_DAY)
#define DOUBLE_HASH(x) (((x) + softs->ipf_state_seed[(x) % \
softs->ipf_state_size]) % softs->ipf_state_size)
int
ipf_state_main_load(void)
{
return (0);
}
int
ipf_state_main_unload(void)
{
return (0);
}
void *
ipf_state_soft_create(ipf_main_softc_t *softc)
{
ipf_state_softc_t *softs;
KMALLOC(softs, ipf_state_softc_t *);
if (softs == NULL)
return (NULL);
bzero((char *)softs, sizeof(*softs));
softs->ipf_state_tune = ipf_tune_array_copy(softs,
sizeof(ipf_state_tuneables),
ipf_state_tuneables);
if (softs->ipf_state_tune == NULL) {
ipf_state_soft_destroy(softc, softs);
return (NULL);
}
if (ipf_tune_array_link(softc, softs->ipf_state_tune) == -1) {
ipf_state_soft_destroy(softc, softs);
return (NULL);
}
#ifdef IPFILTER_LOG
softs->ipf_state_logging = 1;
#else
softs->ipf_state_logging = 0;
#endif
softs->ipf_state_size = IPSTATE_SIZE,
softs->ipf_state_maxbucket = 0;
softs->ipf_state_wm_freq = IPF_TTLVAL(10);
softs->ipf_state_max = IPSTATE_MAX;
softs->ipf_state_wm_last = 0;
softs->ipf_state_wm_high = 99;
softs->ipf_state_wm_low = 90;
softs->ipf_state_inited = 0;
softs->ipf_state_lock = 0;
softs->ipf_state_doflush = 0;
return (softs);
}
void
ipf_state_soft_destroy(ipf_main_softc_t *softc, void *arg)
{
ipf_state_softc_t *softs = arg;
if (softs->ipf_state_tune != NULL) {
ipf_tune_array_unlink(softc, softs->ipf_state_tune);
KFREES(softs->ipf_state_tune, sizeof(ipf_state_tuneables));
softs->ipf_state_tune = NULL;
}
KFREE(softs);
}
static void *
ipf_state_seed_alloc(u_int state_size, u_int state_max)
{
u_int i;
u_long *state_seed;
KMALLOCS(state_seed, u_long *, state_size * sizeof(*state_seed));
if (state_seed == NULL)
return (NULL);
for (i = 0; i < state_size; i++) {
#ifdef __FreeBSD__
state_seed[i] = arc4random();
#else
state_seed[i] = ((u_long)state_seed + i) * state_size;
state_seed[i] ^= 0xa5a55a5a;
state_seed[i] *= (u_long)state_seed;
state_seed[i] ^= 0x5a5aa5a5;
state_seed[i] *= state_max;
#endif
}
return (state_seed);
}
int
ipf_state_soft_init(ipf_main_softc_t *softc, void *arg)
{
ipf_state_softc_t *softs = arg;
int i;
KMALLOCS(softs->ipf_state_table,
ipstate_t **, softs->ipf_state_size * sizeof(ipstate_t *));
if (softs->ipf_state_table == NULL)
return (-1);
bzero((char *)softs->ipf_state_table,
softs->ipf_state_size * sizeof(ipstate_t *));
softs->ipf_state_seed = ipf_state_seed_alloc(softs->ipf_state_size,
softs->ipf_state_max);
if (softs->ipf_state_seed == NULL)
return (-2);
KMALLOCS(softs->ipf_state_stats.iss_bucketlen, u_int *,
softs->ipf_state_size * sizeof(u_int));
if (softs->ipf_state_stats.iss_bucketlen == NULL)
return (-3);
bzero((char *)softs->ipf_state_stats.iss_bucketlen,
softs->ipf_state_size * sizeof(u_int));
if (softs->ipf_state_maxbucket == 0) {
for (i = softs->ipf_state_size; i > 0; i >>= 1)
softs->ipf_state_maxbucket++;
softs->ipf_state_maxbucket *= 2;
}
ipf_sttab_init(softc, softs->ipf_state_tcptq);
softs->ipf_state_stats.iss_tcptab = softs->ipf_state_tcptq;
softs->ipf_state_tcptq[IPF_TCP_NSTATES - 1].ifq_next =
&softs->ipf_state_udptq;
IPFTQ_INIT(&softs->ipf_state_udptq, softc->ipf_udptimeout,
"ipftq udp tab");
softs->ipf_state_udptq.ifq_next = &softs->ipf_state_udpacktq;
IPFTQ_INIT(&softs->ipf_state_udpacktq, softc->ipf_udpacktimeout,
"ipftq udpack tab");
softs->ipf_state_udpacktq.ifq_next = &softs->ipf_state_icmptq;
IPFTQ_INIT(&softs->ipf_state_icmptq, softc->ipf_icmptimeout,
"ipftq icmp tab");
softs->ipf_state_icmptq.ifq_next = &softs->ipf_state_icmpacktq;
IPFTQ_INIT(&softs->ipf_state_icmpacktq, softc->ipf_icmpacktimeout,
"ipftq icmpack tab");
softs->ipf_state_icmpacktq.ifq_next = &softs->ipf_state_iptq;
IPFTQ_INIT(&softs->ipf_state_iptq, softc->ipf_iptimeout,
"ipftq iptimeout tab");
softs->ipf_state_iptq.ifq_next = &softs->ipf_state_pending;
IPFTQ_INIT(&softs->ipf_state_pending, IPF_HZ_DIVIDE, "ipftq pending");
softs->ipf_state_pending.ifq_next = &softs->ipf_state_deletetq;
IPFTQ_INIT(&softs->ipf_state_deletetq, 1, "ipftq delete");
softs->ipf_state_deletetq.ifq_next = NULL;
MUTEX_INIT(&softs->ipf_stinsert, "ipf state insert mutex");
softs->ipf_state_wm_last = softc->ipf_ticks;
softs->ipf_state_inited = 1;
return (0);
}
int
ipf_state_soft_fini(ipf_main_softc_t *softc, void *arg)
{
ipf_state_softc_t *softs = arg;
ipftq_t *ifq, *ifqnext;
ipstate_t *is;
while ((is = softs->ipf_state_list) != NULL)
ipf_state_del(softc, is, ISL_UNLOAD);
for (ifq = softs->ipf_state_usertq; ifq != NULL; ifq = ifqnext) {
ifqnext = ifq->ifq_next;
if (ipf_deletetimeoutqueue(ifq) == 0)
ipf_freetimeoutqueue(softc, ifq);
}
softs->ipf_state_stats.iss_inuse = 0;
softs->ipf_state_stats.iss_active = 0;
if (softs->ipf_state_inited == 1) {
softs->ipf_state_inited = 0;
ipf_sttab_destroy(softs->ipf_state_tcptq);
MUTEX_DESTROY(&softs->ipf_state_udptq.ifq_lock);
MUTEX_DESTROY(&softs->ipf_state_icmptq.ifq_lock);
MUTEX_DESTROY(&softs->ipf_state_udpacktq.ifq_lock);
MUTEX_DESTROY(&softs->ipf_state_icmpacktq.ifq_lock);
MUTEX_DESTROY(&softs->ipf_state_iptq.ifq_lock);
MUTEX_DESTROY(&softs->ipf_state_deletetq.ifq_lock);
MUTEX_DESTROY(&softs->ipf_state_pending.ifq_lock);
MUTEX_DESTROY(&softs->ipf_stinsert);
}
if (softs->ipf_state_table != NULL) {
KFREES(softs->ipf_state_table,
softs->ipf_state_size * sizeof(*softs->ipf_state_table));
softs->ipf_state_table = NULL;
}
if (softs->ipf_state_seed != NULL) {
KFREES(softs->ipf_state_seed,
softs->ipf_state_size * sizeof(*softs->ipf_state_seed));
softs->ipf_state_seed = NULL;
}
if (softs->ipf_state_stats.iss_bucketlen != NULL) {
KFREES(softs->ipf_state_stats.iss_bucketlen,
softs->ipf_state_size * sizeof(u_int));
softs->ipf_state_stats.iss_bucketlen = NULL;
}
return (0);
}
void
ipf_state_setlock(void *arg, int tmp)
{
ipf_state_softc_t *softs = arg;
softs->ipf_state_lock = tmp;
}
static ips_stat_t *
ipf_state_stats(ipf_main_softc_t *softc)
{
ipf_state_softc_t *softs = softc->ipf_state_soft;
ips_stat_t *issp = &softs->ipf_state_stats;
issp->iss_state_size = softs->ipf_state_size;
issp->iss_state_max = softs->ipf_state_max;
issp->iss_table = softs->ipf_state_table;
issp->iss_list = softs->ipf_state_list;
issp->iss_ticks = softc->ipf_ticks;
#ifdef IPFILTER_LOGGING
issp->iss_log_ok = ipf_log_logok(softc, IPF_LOGSTATE);
issp->iss_log_fail = ipf_log_failures(softc, IPF_LOGSTATE);
#else
issp->iss_log_ok = 0;
issp->iss_log_fail = 0;
#endif
return (issp);
}
static int
ipf_state_remove(ipf_main_softc_t *softc, caddr_t data)
{
ipf_state_softc_t *softs = softc->ipf_state_soft;
ipstate_t *sp, st;
int error;
sp = &st;
error = ipf_inobj(softc, data, NULL, &st, IPFOBJ_IPSTATE);
if (error)
return (EFAULT);
WRITE_ENTER(&softc->ipf_state);
for (sp = softs->ipf_state_list; sp; sp = sp->is_next)
if ((sp->is_p == st.is_p) && (sp->is_v == st.is_v) &&
!bcmp((caddr_t)&sp->is_src, (caddr_t)&st.is_src,
sizeof(st.is_src)) &&
!bcmp((caddr_t)&sp->is_dst, (caddr_t)&st.is_dst,
sizeof(st.is_dst)) &&
!bcmp((caddr_t)&sp->is_ps, (caddr_t)&st.is_ps,
sizeof(st.is_ps))) {
ipf_state_del(softc, sp, ISL_REMOVE);
RWLOCK_EXIT(&softc->ipf_state);
return (0);
}
RWLOCK_EXIT(&softc->ipf_state);
IPFERROR(100001);
return (ESRCH);
}
int
ipf_state_ioctl(ipf_main_softc_t *softc, caddr_t data, ioctlcmd_t cmd,
int mode, int uid, void *ctx)
{
ipf_state_softc_t *softs = softc->ipf_state_soft;
int arg, ret, error = 0;
SPL_INT(s);
switch (cmd)
{
case SIOCDELST :
error = ipf_state_remove(softc, data);
break;
case SIOCIPFFL :
error = BCOPYIN(data, &arg, sizeof(arg));
if (error != 0) {
IPFERROR(100002);
error = EFAULT;
} else {
WRITE_ENTER(&softc->ipf_state);
ret = ipf_state_flush(softc, arg, 4);
RWLOCK_EXIT(&softc->ipf_state);
error = BCOPYOUT(&ret, data, sizeof(ret));
if (error != 0) {
IPFERROR(100003);
error = EFAULT;
}
}
break;
#ifdef USE_INET6
case SIOCIPFL6 :
error = BCOPYIN(data, &arg, sizeof(arg));
if (error != 0) {
IPFERROR(100004);
error = EFAULT;
} else {
WRITE_ENTER(&softc->ipf_state);
ret = ipf_state_flush(softc, arg, 6);
RWLOCK_EXIT(&softc->ipf_state);
error = BCOPYOUT(&ret, data, sizeof(ret));
if (error != 0) {
IPFERROR(100005);
error = EFAULT;
}
}
break;
#endif
case SIOCMATCHFLUSH :
WRITE_ENTER(&softc->ipf_state);
error = ipf_state_matchflush(softc, data);
RWLOCK_EXIT(&softc->ipf_state);
break;
#ifdef IPFILTER_LOG
case SIOCIPFFB :
if (!(mode & FWRITE)) {
IPFERROR(100008);
error = EPERM;
} else {
int tmp;
tmp = ipf_log_clear(softc, IPL_LOGSTATE);
error = BCOPYOUT(&tmp, data, sizeof(tmp));
if (error != 0) {
IPFERROR(100009);
error = EFAULT;
}
}
break;
case SIOCSETLG :
if (!(mode & FWRITE)) {
IPFERROR(100010);
error = EPERM;
} else {
error = BCOPYIN(data, &softs->ipf_state_logging,
sizeof(softs->ipf_state_logging));
if (error != 0) {
IPFERROR(100011);
error = EFAULT;
}
}
break;
case SIOCGETLG :
error = BCOPYOUT(&softs->ipf_state_logging, data,
sizeof(softs->ipf_state_logging));
if (error != 0) {
IPFERROR(100012);
error = EFAULT;
}
break;
case FIONREAD :
arg = ipf_log_bytesused(softc, IPL_LOGSTATE);
error = BCOPYOUT(&arg, data, sizeof(arg));
if (error != 0) {
IPFERROR(100013);
error = EFAULT;
}
break;
#endif
case SIOCGETFS :
error = ipf_outobj(softc, data, ipf_state_stats(softc),
IPFOBJ_STATESTAT);
break;
#ifdef IPFILTER_IPFS
case SIOCSTLCK :
if (!(mode & FWRITE)) {
IPFERROR(100014);
error = EPERM;
} else {
error = ipf_lock(data, &softs->ipf_state_lock);
}
break;
case SIOCSTPUT :
if (!softs->ipf_state_lock || !(mode &FWRITE)) {
IPFERROR(100015);
error = EACCES;
break;
}
error = ipf_state_putent(softc, softs, data);
break;
case SIOCSTGET :
if (!softs->ipf_state_lock) {
IPFERROR(100016);
error = EACCES;
break;
}
error = ipf_state_getent(softc, softs, data);
break;
#endif
case SIOCGENITER :
{
ipftoken_t *token;
ipfgeniter_t iter;
ipfobj_t obj;
error = ipf_inobj(softc, data, &obj, &iter, IPFOBJ_GENITER);
if (error != 0)
break;
SPL_SCHED(s);
token = ipf_token_find(softc, IPFGENITER_STATE, uid, ctx);
if (token != NULL) {
error = ipf_state_iter(softc, token, &iter, &obj);
WRITE_ENTER(&softc->ipf_tokens);
ipf_token_deref(softc, token);
RWLOCK_EXIT(&softc->ipf_tokens);
} else {
IPFERROR(100018);
error = ESRCH;
}
SPL_X(s);
break;
}
case SIOCGTABL :
error = ipf_state_gettable(softc, softs, data);
break;
case SIOCIPFDELTOK :
error = BCOPYIN(data, &arg, sizeof(arg));
if (error != 0) {
IPFERROR(100019);
error = EFAULT;
} else {
SPL_SCHED(s);
error = ipf_token_del(softc, arg, uid, ctx);
SPL_X(s);
}
break;
case SIOCGTQTAB :
error = ipf_outobj(softc, data, softs->ipf_state_tcptq,
IPFOBJ_STATETQTAB);
break;
default :
IPFERROR(100020);
error = EINVAL;
break;
}
return (error);
}
#ifdef IPFILTER_IPFS
static int
ipf_state_getent(ipf_main_softc_t *softc, ipf_state_softc_t *softs,
caddr_t data)
{
ipstate_t *is, *isn;
ipstate_save_t ips;
int error;
error = ipf_inobj(softc, data, NULL, &ips, IPFOBJ_STATESAVE);
if (error)
return (EFAULT);
READ_ENTER(&softc->ipf_state);
isn = ips.ips_next;
if (isn == NULL) {
isn = softs->ipf_state_list;
if (isn == NULL) {
if (ips.ips_next == NULL) {
RWLOCK_EXIT(&softc->ipf_state);
IPFERROR(100021);
return (ENOENT);
}
return (0);
}
} else {
for (is = softs->ipf_state_list; is; is = is->is_next)
if (is == isn)
break;
if (!is) {
RWLOCK_EXIT(&softc->ipf_state);
IPFERROR(100022);
return (ESRCH);
}
}
ips.ips_next = isn->is_next;
bcopy((char *)isn, (char *)&ips.ips_is, sizeof(ips.ips_is));
ips.ips_rule = isn->is_rule;
if (isn->is_rule != NULL)
bcopy((char *)isn->is_rule, (char *)&ips.ips_fr,
sizeof(ips.ips_fr));
RWLOCK_EXIT(&softc->ipf_state);
error = ipf_outobj(softc, data, &ips, IPFOBJ_STATESAVE);
return (error);
}
int
ipf_state_putent(ipf_main_softc_t *softc, ipf_state_softc_t *softs,
caddr_t data)
{
ipstate_t *is, *isn;
ipstate_save_t ips;
int error, i;
frentry_t *fr;
char *name;
error = ipf_inobj(softc, data, NULL, &ips, IPFOBJ_STATESAVE);
if (error != 0)
return (error);
KMALLOC(isn, ipstate_t *);
if (isn == NULL) {
IPFERROR(100023);
return (ENOMEM);
}
bcopy((char *)&ips.ips_is, (char *)isn, sizeof(*isn));
bzero((char *)isn, offsetof(struct ipstate, is_pkts));
isn->is_sti.tqe_pnext = NULL;
isn->is_sti.tqe_next = NULL;
isn->is_sti.tqe_ifq = NULL;
isn->is_sti.tqe_parent = isn;
isn->is_ifp[0] = NULL;
isn->is_ifp[1] = NULL;
isn->is_ifp[2] = NULL;
isn->is_ifp[3] = NULL;
isn->is_sync = NULL;
fr = ips.ips_rule;
if (fr == NULL) {
int inserr;
READ_ENTER(&softc->ipf_state);
inserr = ipf_state_insert(softc, isn, 0);
MUTEX_EXIT(&isn->is_lock);
RWLOCK_EXIT(&softc->ipf_state);
return (inserr);
}
if (isn->is_flags & SI_NEWFR) {
KMALLOC(fr, frentry_t *);
if (fr == NULL) {
KFREE(isn);
IPFERROR(100024);
return (ENOMEM);
}
bcopy((char *)&ips.ips_fr, (char *)fr, sizeof(*fr));
isn->is_rule = fr;
ips.ips_is.is_rule = fr;
MUTEX_NUKE(&fr->fr_lock);
MUTEX_INIT(&fr->fr_lock, "state filter rule lock");
for (i = 0; i < FR_NUM(fr->fr_ifnames); i++) {
if (fr->fr_ifnames[i] == -1) {
fr->fr_ifas[i] = NULL;
continue;
}
name = FR_NAME(fr, fr_ifnames[i]);
fr->fr_ifas[i] = ipf_resolvenic(softc, name,
fr->fr_family);
}
for (i = 0; i < FR_NUM(isn->is_ifname); i++) {
name = isn->is_ifname[i];
isn->is_ifp[i] = ipf_resolvenic(softc, name,
isn->is_v);
}
fr->fr_ref = 0;
fr->fr_dsize = 0;
fr->fr_data = NULL;
fr->fr_type = FR_T_NONE;
(void) ipf_resolvedest(softc, fr->fr_names, &fr->fr_tifs[0],
fr->fr_family);
(void) ipf_resolvedest(softc, fr->fr_names, &fr->fr_tifs[1],
fr->fr_family);
(void) ipf_resolvedest(softc, fr->fr_names, &fr->fr_dif,
fr->fr_family);
error = ipf_outobj(softc, data, &ips, IPFOBJ_STATESAVE);
if (error != 0) {
KFREE(isn);
MUTEX_DESTROY(&fr->fr_lock);
KFREE(fr);
IPFERROR(100025);
return (EFAULT);
}
READ_ENTER(&softc->ipf_state);
error = ipf_state_insert(softc, isn, 0);
MUTEX_EXIT(&isn->is_lock);
RWLOCK_EXIT(&softc->ipf_state);
} else {
READ_ENTER(&softc->ipf_state);
for (is = softs->ipf_state_list; is; is = is->is_next)
if (is->is_rule == fr) {
error = ipf_state_insert(softc, isn, 0);
MUTEX_EXIT(&isn->is_lock);
break;
}
if (is == NULL) {
KFREE(isn);
isn = NULL;
}
RWLOCK_EXIT(&softc->ipf_state);
if (isn == NULL) {
IPFERROR(100033);
error = ESRCH;
}
}
return (error);
}
#endif
int
ipf_state_insert(ipf_main_softc_t *softc, ipstate_t *is, int rev)
{
ipf_state_softc_t *softs = softc->ipf_state_soft;
frentry_t *fr;
u_int hv;
int i;
for (i = 0; i < FR_NUM(is->is_ifp); i++) {
if (is->is_ifp[i] != NULL)
continue;
is->is_ifp[i] = ipf_resolvenic(softc, is->is_ifname[i],
is->is_v);
}
hv = is->is_hv % softs->ipf_state_size;
is->is_hv = hv;
MUTEX_INIT(&is->is_lock, "ipf state entry");
MUTEX_ENTER(&is->is_lock);
MUTEX_ENTER(&softs->ipf_stinsert);
fr = is->is_rule;
if (fr != NULL) {
if ((fr->fr_srctrack.ht_max_nodes != 0) &&
(ipf_ht_node_add(softc, &fr->fr_srctrack,
is->is_family, &is->is_src) == -1)) {
SBUMPD(ipf_state_stats, iss_max_track);
MUTEX_EXIT(&softs->ipf_stinsert);
return (-1);
}
MUTEX_ENTER(&fr->fr_lock);
fr->fr_ref++;
MUTEX_EXIT(&fr->fr_lock);
fr->fr_statecnt++;
}
if (is->is_flags & (SI_WILDP|SI_WILDA)) {
DT(iss_wild_plus_one);
SINCL(ipf_state_stats.iss_wild);
}
SBUMP(ipf_state_stats.iss_proto[is->is_p]);
SBUMP(ipf_state_stats.iss_active_proto[is->is_p]);
if (softs->ipf_state_list != NULL)
softs->ipf_state_list->is_pnext = &is->is_next;
is->is_pnext = &softs->ipf_state_list;
is->is_next = softs->ipf_state_list;
softs->ipf_state_list = is;
if (softs->ipf_state_table[hv] != NULL)
softs->ipf_state_table[hv]->is_phnext = &is->is_hnext;
else
softs->ipf_state_stats.iss_inuse++;
is->is_phnext = softs->ipf_state_table + hv;
is->is_hnext = softs->ipf_state_table[hv];
softs->ipf_state_table[hv] = is;
softs->ipf_state_stats.iss_bucketlen[hv]++;
softs->ipf_state_stats.iss_active++;
MUTEX_EXIT(&softs->ipf_stinsert);
ipf_state_setqueue(softc, is, rev);
return (0);
}
static int
ipf_state_matchipv4addrs(ipstate_t *is1, ipstate_t *is2)
{
int rv;
if (is1->is_saddr == is2->is_saddr && is1->is_daddr == is2->is_daddr)
rv = 2;
else if (is1->is_saddr == is2->is_daddr &&
is1->is_daddr == is2->is_saddr) {
rv = (is1->is_p == IPPROTO_ICMP) ? 2 : 1;
}
else
rv = 0;
return (rv);
}
static int
ipf_state_matchipv6addrs(ipstate_t *is1, ipstate_t *is2)
{
int rv;
if (IP6_EQ(&is1->is_src, &is2->is_src) &&
IP6_EQ(&is1->is_dst, &is2->is_dst))
rv = 2;
else if (IP6_EQ(&is1->is_src, &is2->is_dst) &&
IP6_EQ(&is1->is_dst, &is2->is_src)) {
rv = (is1->is_p == IPPROTO_ICMPV6) ? 2 : 1;
}
else
rv = 0;
return (rv);
}
static int
ipf_state_matchaddresses(ipstate_t *is1, ipstate_t *is2)
{
int rv;
if (is1->is_v == 4) {
rv = ipf_state_matchipv4addrs(is1, is2);
}
else {
rv = ipf_state_matchipv6addrs(is1, is2);
}
return (rv);
}
static int
ipf_state_matchports(udpinfo_t *ppairs1, udpinfo_t *ppairs2)
{
int rv;
if (ppairs1->us_sport == ppairs2->us_sport &&
ppairs1->us_dport == ppairs2->us_dport)
rv = 2;
else if (ppairs1->us_sport == ppairs2->us_dport &&
ppairs1->us_dport == ppairs2->us_sport)
rv = 1;
else
rv = 0;
return (rv);
}
static int
ipf_state_matchisps(ipstate_t *is1, ipstate_t *is2)
{
int rv;
if (is1->is_p == is2->is_p) {
switch (is1->is_p)
{
case IPPROTO_TCP :
case IPPROTO_UDP :
case IPPROTO_GRE :
rv = ipf_state_matchports(&is1->is_ps.is_us,
&is2->is_ps.is_us);
break;
case IPPROTO_ICMP :
case IPPROTO_ICMPV6 :
if (bcmp(&is1->is_ps, &is2->is_ps,
sizeof(icmpinfo_t)) == 0) {
rv = 2;
} else {
rv = 0;
}
break;
default:
rv = 0;
}
} else {
rv = 0;
}
return (rv);
}
static int
ipf_state_match(ipstate_t *is1, ipstate_t *is2)
{
int rv;
int amatch;
int pomatch;
if (bcmp(&is1->is_pass, &is2->is_pass,
offsetof(struct ipstate, is_authmsk) -
offsetof(struct ipstate, is_pass)) == 0) {
pomatch = ipf_state_matchisps(is1, is2);
amatch = ipf_state_matchaddresses(is1, is2);
rv = (amatch != 0) && (amatch == pomatch);
} else {
rv = 0;
}
return (rv);
}
int
ipf_state_add(ipf_main_softc_t *softc, fr_info_t *fin, ipstate_t **stsave,
u_int flags)
{
ipf_state_softc_t *softs = softc->ipf_state_soft;
ipstate_t *is, ips;
struct icmp *ic;
u_int pass, hv;
frentry_t *fr;
tcphdr_t *tcp;
frdest_t *fdp;
int out;
if (softs->ipf_state_lock) {
SBUMPD(ipf_state_stats, iss_add_locked);
fin->fin_error = EAGAIN;
return (-1);
}
if (fin->fin_flx & (FI_SHORT|FI_STATE|FI_FRAGBODY|FI_BAD)) {
SBUMPD(ipf_state_stats, iss_add_bad);
return (-1);
}
if ((fin->fin_flx & FI_OOW) && !(fin->fin_tcpf & TH_SYN)) {
SBUMPD(ipf_state_stats, iss_add_oow);
return (-1);
}
if ((softs->ipf_state_stats.iss_active * 100 / softs->ipf_state_max) >
softs->ipf_state_wm_high) {
softs->ipf_state_doflush = 1;
}
fr = fin->fin_fr;
if (fr != NULL) {
if ((softs->ipf_state_stats.iss_active >=
softs->ipf_state_max) && (fr->fr_statemax == 0)) {
SBUMPD(ipf_state_stats, iss_max);
return (1);
}
if ((fr->fr_statemax != 0) &&
(fr->fr_statecnt >= fr->fr_statemax)) {
SBUMPD(ipf_state_stats, iss_max_ref);
return (2);
}
}
is = &ips;
if (fr == NULL) {
pass = softc->ipf_flags;
is->is_tag = FR_NOLOGTAG;
} else {
pass = fr->fr_flags;
}
ic = NULL;
tcp = NULL;
out = fin->fin_out;
bzero((char *)is, sizeof(*is));
is->is_die = 1 + softc->ipf_ticks;
is->is_pass = pass;
is->is_v = fin->fin_v;
is->is_sec = fin->fin_secmsk;
is->is_secmsk = 0xffff;
is->is_auth = fin->fin_auth;
is->is_authmsk = 0xffff;
is->is_family = fin->fin_family;
is->is_opt[0] = fin->fin_optmsk;
is->is_optmsk[0] = 0xffffffff;
if (is->is_v == 6) {
is->is_opt[0] &= ~0x8;
is->is_optmsk[0] &= ~0x8;
}
hv = (is->is_p = fin->fin_fi.fi_p);
is->is_src = fin->fin_fi.fi_src;
hv += is->is_saddr;
is->is_dst = fin->fin_fi.fi_dst;
hv += is->is_daddr;
#ifdef USE_INET6
if (fin->fin_v == 6) {
if ((is->is_p == IPPROTO_ICMPV6) &&
IN6_IS_ADDR_MULTICAST(&is->is_dst.in6)) {
flags |= SI_W_DADDR;
hv -= is->is_daddr;
} else {
hv += is->is_dst.i6[1];
hv += is->is_dst.i6[2];
hv += is->is_dst.i6[3];
}
hv += is->is_src.i6[1];
hv += is->is_src.i6[2];
hv += is->is_src.i6[3];
}
#endif
if ((fin->fin_v == 4) &&
(fin->fin_flx & (FI_MULTICAST|FI_BROADCAST|FI_MBCAST))) {
flags |= SI_W_DADDR;
hv -= is->is_daddr;
}
switch (is->is_p)
{
#ifdef USE_INET6
case IPPROTO_ICMPV6 :
ic = fin->fin_dp;
switch (ic->icmp_type)
{
case ICMP6_ECHO_REQUEST :
hv += (is->is_icmp.ici_id = ic->icmp_id);
case ICMP6_MEMBERSHIP_QUERY :
case ND_ROUTER_SOLICIT :
case ND_NEIGHBOR_SOLICIT :
case ICMP6_NI_QUERY :
is->is_icmp.ici_type = ic->icmp_type;
break;
default :
SBUMPD(ipf_state_stats, iss_icmp6_notquery);
return (-2);
}
break;
#endif
case IPPROTO_ICMP :
ic = fin->fin_dp;
switch (ic->icmp_type)
{
case ICMP_ECHO :
case ICMP_TSTAMP :
case ICMP_IREQ :
case ICMP_MASKREQ :
is->is_icmp.ici_type = ic->icmp_type;
hv += (is->is_icmp.ici_id = ic->icmp_id);
break;
default :
SBUMPD(ipf_state_stats, iss_icmp_notquery);
return (-3);
}
break;
#if 0
case IPPROTO_GRE :
gre = fin->fin_dp;
is->is_gre.gs_flags = gre->gr_flags;
is->is_gre.gs_ptype = gre->gr_ptype;
if (GRE_REV(is->is_gre.gs_flags) == 1) {
is->is_call[0] = fin->fin_data[0];
is->is_call[1] = fin->fin_data[1];
}
break;
#endif
case IPPROTO_TCP :
tcp = fin->fin_dp;
if (tcp_get_flags(tcp) & TH_RST) {
SBUMPD(ipf_state_stats, iss_tcp_rstadd);
return (-4);
}
is->is_sport = htons(fin->fin_data[0]);
is->is_dport = htons(fin->fin_data[1]);
if ((flags & (SI_W_DPORT|SI_W_SPORT)) == 0) {
hv += is->is_sport;
hv += is->is_dport;
}
is->is_maxdwin = 1;
is->is_maxswin = ntohs(tcp->th_win);
if (is->is_maxswin == 0)
is->is_maxswin = 1;
if ((fin->fin_flx & FI_IGNORE) == 0) {
is->is_send = ntohl(tcp->th_seq) + fin->fin_dlen -
(TCP_OFF(tcp) << 2) +
((tcp_get_flags(tcp) & TH_SYN) ? 1 : 0) +
((tcp_get_flags(tcp) & TH_FIN) ? 1 : 0);
is->is_maxsend = is->is_send;
if ((tcp_get_flags(tcp) & ~(TH_FIN|TH_ACK|TH_ECNALL)) ==
TH_SYN &&
(TCP_OFF(tcp) > (sizeof(tcphdr_t) >> 2))) {
if (ipf_tcpoptions(softs, fin, tcp,
&is->is_tcp.ts_data[0]) == -1) {
fin->fin_flx |= FI_BAD;
DT1(ipf_fi_bad_tcpoptions_th_fin_ack_ecnall, fr_info_t *, fin);
}
}
if ((fin->fin_out != 0) && (pass & FR_NEWISN) != 0) {
ipf_checknewisn(fin, is);
ipf_fixoutisn(fin, is);
}
if ((tcp_get_flags(tcp) & TH_OPENING) == TH_SYN)
flags |= IS_TCPFSM;
else {
is->is_maxdwin = is->is_maxswin * 2;
is->is_dend = ntohl(tcp->th_ack);
is->is_maxdend = ntohl(tcp->th_ack);
is->is_maxdwin *= 2;
}
}
break;
case IPPROTO_UDP :
tcp = fin->fin_dp;
is->is_sport = htons(fin->fin_data[0]);
is->is_dport = htons(fin->fin_data[1]);
if ((flags & (SI_W_DPORT|SI_W_SPORT)) == 0) {
hv += tcp->th_dport;
hv += tcp->th_sport;
}
break;
default :
break;
}
hv = DOUBLE_HASH(hv);
is->is_hv = hv;
for (is = softs->ipf_state_table[hv % softs->ipf_state_size];
is != NULL; is = is->is_hnext) {
if (ipf_state_match(&ips, is) == 1)
break;
}
if (is != NULL) {
SBUMPD(ipf_state_stats, iss_add_dup);
return (3);
}
if (softs->ipf_state_stats.iss_bucketlen[hv] >=
softs->ipf_state_maxbucket) {
SBUMPD(ipf_state_stats, iss_bucket_full);
return (4);
}
KMALLOC(is, ipstate_t *);
if (is == NULL) {
SBUMPD(ipf_state_stats, iss_nomem);
return (5);
}
bcopy((char *)&ips, (char *)is, sizeof(*is));
is->is_flags = flags & IS_INHERITED;
is->is_rulen = fin->fin_rule;
is->is_rule = fr;
if (fr != NULL) {
ipftq_t *tq;
(void) strncpy(is->is_group, FR_NAME(fr, fr_group),
FR_GROUPLEN);
if (fr->fr_age[0] != 0) {
tq = ipf_addtimeoutqueue(softc,
&softs->ipf_state_usertq,
fr->fr_age[0]);
is->is_tqehead[0] = tq;
is->is_sti.tqe_flags |= TQE_RULEBASED;
}
if (fr->fr_age[1] != 0) {
tq = ipf_addtimeoutqueue(softc,
&softs->ipf_state_usertq,
fr->fr_age[1]);
is->is_tqehead[1] = tq;
is->is_sti.tqe_flags |= TQE_RULEBASED;
}
is->is_tag = fr->fr_logtag;
}
is->is_me = stsave;
if (stsave != NULL) {
*stsave = is;
is->is_ref = 2;
} else {
is->is_ref = 1;
}
is->is_pkts[0] = 0, is->is_bytes[0] = 0;
is->is_pkts[1] = 0, is->is_bytes[1] = 0;
is->is_pkts[2] = 0, is->is_bytes[2] = 0;
is->is_pkts[3] = 0, is->is_bytes[3] = 0;
if ((fin->fin_flx & FI_IGNORE) == 0) {
is->is_pkts[out] = 1;
fin->fin_pktnum = 1;
is->is_bytes[out] = fin->fin_plen;
is->is_flx[out][0] = fin->fin_flx & FI_CMP;
is->is_flx[out][0] &= ~FI_OOW;
}
if (pass & FR_STLOOSE)
is->is_flags |= IS_LOOSE;
if (pass & FR_STSTRICT)
is->is_flags |= IS_STRICT;
if (pass & FR_STATESYNC)
is->is_flags |= IS_STATESYNC;
if (pass & FR_LOGFIRST)
is->is_pass &= ~(FR_LOGFIRST|FR_LOG);
READ_ENTER(&softc->ipf_state);
if (ipf_state_insert(softc, is, fin->fin_rev) == -1) {
RWLOCK_EXIT(&softc->ipf_state);
MUTEX_EXIT(&is->is_lock);
MUTEX_DESTROY(&is->is_lock);
if (is->is_tqehead[0] != NULL) {
if (ipf_deletetimeoutqueue(is->is_tqehead[0]) == 0)
ipf_freetimeoutqueue(softc, is->is_tqehead[0]);
is->is_tqehead[0] = NULL;
}
if (is->is_tqehead[1] != NULL) {
if (ipf_deletetimeoutqueue(is->is_tqehead[1]) == 0)
ipf_freetimeoutqueue(softc, is->is_tqehead[1]);
is->is_tqehead[1] = NULL;
}
KFREE(is);
return (-1);
}
if (fr != NULL) {
if ((fin->fin_ifp == NULL) ||
(fr->fr_ifnames[out << 1] != -1 &&
fr->fr_names[fr->fr_ifnames[out << 1] + 0] == '-' &&
fr->fr_names[fr->fr_ifnames[out << 1] + 1] == '\0')) {
is->is_ifp[out << 1] = fr->fr_ifas[0];
strncpy(is->is_ifname[out << 1],
FR_NAME(fr, fr_ifnames[0]),
sizeof(fr->fr_ifnames[0]));
} else {
is->is_ifp[out << 1] = fin->fin_ifp;
COPYIFNAME(fin->fin_v, fin->fin_ifp,
is->is_ifname[out << 1]);
}
is->is_ifp[(out << 1) + 1] = fr->fr_ifas[1];
if (fr->fr_ifnames[1] != -1) {
strncpy(is->is_ifname[(out << 1) + 1],
FR_NAME(fr, fr_ifnames[1]),
sizeof(fr->fr_ifnames[1]));
}
is->is_ifp[(1 - out) << 1] = fr->fr_ifas[2];
if (fr->fr_ifnames[2] != -1) {
strncpy(is->is_ifname[((1 - out) << 1)],
FR_NAME(fr, fr_ifnames[2]),
sizeof(fr->fr_ifnames[2]));
}
is->is_ifp[((1 - out) << 1) + 1] = fr->fr_ifas[3];
if (fr->fr_ifnames[3] != -1) {
strncpy(is->is_ifname[((1 - out) << 1) + 1],
FR_NAME(fr, fr_ifnames[3]),
sizeof(fr->fr_ifnames[3]));
}
} else {
if (fin->fin_ifp != NULL) {
is->is_ifp[out << 1] = fin->fin_ifp;
COPYIFNAME(fin->fin_v, fin->fin_ifp,
is->is_ifname[out << 1]);
}
}
if (fin->fin_p == IPPROTO_TCP) {
(void) ipf_tcp_age(&is->is_sti, fin, softs->ipf_state_tcptq,
is->is_flags, 2);
}
MUTEX_EXIT(&is->is_lock);
if ((is->is_flags & IS_STATESYNC) && ((is->is_flags & SI_CLONE) == 0))
is->is_sync = ipf_sync_new(softc, SMC_STATE, fin, is);
if (softs->ipf_state_logging)
ipf_state_log(softc, is, ISL_NEW);
RWLOCK_EXIT(&softc->ipf_state);
fin->fin_flx |= FI_STATE;
if (fin->fin_flx & FI_FRAG)
(void) ipf_frag_new(softc, fin, pass);
fdp = &fr->fr_tifs[0];
if (fdp->fd_type == FRD_DSTLIST) {
ipf_dstlist_select_node(fin, fdp->fd_ptr, NULL,
&is->is_tifs[0]);
} else {
bcopy(fdp, &is->is_tifs[0], sizeof(*fdp));
}
fdp = &fr->fr_tifs[1];
if (fdp->fd_type == FRD_DSTLIST) {
ipf_dstlist_select_node(fin, fdp->fd_ptr, NULL,
&is->is_tifs[1]);
} else {
bcopy(fdp, &is->is_tifs[1], sizeof(*fdp));
}
fin->fin_tif = &is->is_tifs[fin->fin_rev];
fdp = &fr->fr_dif;
if (fdp->fd_type == FRD_DSTLIST) {
ipf_dstlist_select_node(fin, fdp->fd_ptr, NULL,
&is->is_dif);
} else {
bcopy(fdp, &is->is_dif, sizeof(*fdp));
}
fin->fin_dif = &is->is_dif;
return (0);
}
static int
ipf_tcpoptions(ipf_state_softc_t *softs, fr_info_t *fin, tcphdr_t *tcp,
tcpdata_t *td)
{
int off, mlen, ol, i, len, retval;
char buf[64], *s, opt;
mb_t *m = NULL;
len = (TCP_OFF(tcp) << 2);
if (fin->fin_dlen < len) {
SBUMPD(ipf_state_stats, iss_tcp_toosmall);
return (0);
}
len -= sizeof(*tcp);
off = fin->fin_plen - fin->fin_dlen + sizeof(*tcp) + fin->fin_ipoff;
m = fin->fin_m;
mlen = MSGDSIZE(m) - off;
if (len > mlen) {
len = mlen;
retval = 0;
} else {
retval = 1;
}
COPYDATA(m, off, len, buf);
for (s = buf; len > 0; ) {
opt = *s;
if (opt == TCPOPT_EOL)
break;
else if (opt == TCPOPT_NOP)
ol = 1;
else {
if (len < 2)
break;
ol = (int)*(s + 1);
if (ol < 2 || ol > len)
break;
switch (opt)
{
case TCPOPT_WINDOW :
if (ol == TCPOLEN_WINDOW) {
i = (int)*(s + 2);
if (i > TCP_WSCALE_MAX)
i = TCP_WSCALE_MAX;
else if (i < 0)
i = 0;
td->td_winscale = i;
td->td_winflags |= TCP_WSCALE_SEEN|
TCP_WSCALE_FIRST;
} else
retval = -1;
break;
case TCPOPT_MAXSEG :
if (ol == TCPOLEN_MAXSEG) {
i = (int)*(s + 2);
i <<= 8;
i += (int)*(s + 3);
td->td_maxseg = i;
} else
retval = -1;
break;
case TCPOPT_SACK_PERMITTED :
if (ol == TCPOLEN_SACK_PERMITTED)
td->td_winflags |= TCP_SACK_PERMIT;
else
retval = -1;
break;
}
}
len -= ol;
s += ol;
}
if (retval == -1) {
SBUMPD(ipf_state_stats, iss_tcp_badopt);
}
return (retval);
}
static int
ipf_state_tcp(ipf_main_softc_t *softc, ipf_state_softc_t *softs,
fr_info_t *fin, tcphdr_t *tcp, ipstate_t *is)
{
tcpdata_t *fdata, *tdata;
int source, ret, flags;
source = !fin->fin_rev;
if (((is->is_flags & IS_TCPFSM) != 0) && (source == 1) &&
(ntohs(is->is_sport) != fin->fin_data[0]))
source = 0;
fdata = &is->is_tcp.ts_data[!source];
tdata = &is->is_tcp.ts_data[source];
MUTEX_ENTER(&is->is_lock);
if ((tcp_get_flags(tcp) & TH_OPENING) == TH_SYN) {
if ((is->is_state[0] > IPF_TCPS_ESTABLISHED) &&
(is->is_state[1] > IPF_TCPS_ESTABLISHED)) {
is->is_state[!source] = IPF_TCPS_CLOSED;
ipf_movequeue(softc->ipf_ticks, &is->is_sti,
is->is_sti.tqe_ifq,
&softs->ipf_state_deletetq);
MUTEX_EXIT(&is->is_lock);
DT1(iss_tcp_closing, ipstate_t *, is);
SBUMP(ipf_state_stats.iss_tcp_closing);
return (0);
}
}
if (is->is_flags & IS_LOOSE)
ret = 1;
else
ret = ipf_state_tcpinwindow(fin, fdata, tdata, tcp,
is->is_flags);
if (ret > 0) {
ret = ipf_tcp_age(&is->is_sti, fin, softs->ipf_state_tcptq,
is->is_flags, ret);
if (ret == 0) {
MUTEX_EXIT(&is->is_lock);
DT2(iss_tcp_fsm, fr_info_t *, fin, ipstate_t *, is);
SBUMP(ipf_state_stats.iss_tcp_fsm);
return (0);
}
if (softs->ipf_state_logging > 4)
ipf_state_log(softc, is, ISL_STATECHANGE);
flags = tcp_get_flags(tcp) & ~(TH_FIN|TH_ECNALL);
if (flags == (TH_SYN|TH_ACK)) {
is->is_s0[source] = ntohl(tcp->th_ack);
is->is_s0[!source] = ntohl(tcp->th_seq) + 1;
if ((TCP_OFF(tcp) > (sizeof(tcphdr_t) >> 2))) {
if (ipf_tcpoptions(softs, fin, tcp,
fdata) == -1) {
fin->fin_flx |= FI_BAD;
DT1(ipf_fi_bad_winscale_syn_ack, fr_info_t *, fin);
}
}
if ((fin->fin_out != 0) && (is->is_pass & FR_NEWISN))
ipf_checknewisn(fin, is);
} else if (flags == TH_SYN) {
is->is_s0[source] = ntohl(tcp->th_seq) + 1;
if ((TCP_OFF(tcp) > (sizeof(tcphdr_t) >> 2))) {
if (ipf_tcpoptions(softs, fin, tcp,
fdata) == -1) {
fin->fin_flx |= FI_BAD;
DT1(ipf_fi_bad_winscale_syn, fr_info_t *, fin);
}
}
if ((fin->fin_out != 0) && (is->is_pass & FR_NEWISN))
ipf_checknewisn(fin, is);
}
ret = 1;
} else {
DT2(iss_tcp_oow, fr_info_t *, fin, ipstate_t *, is);
SBUMP(ipf_state_stats.iss_tcp_oow);
ret = 0;
}
MUTEX_EXIT(&is->is_lock);
return (ret);
}
static void
ipf_checknewisn(fr_info_t *fin, ipstate_t *is)
{
u_32_t sumd, old, new;
tcphdr_t *tcp;
int i;
i = fin->fin_rev;
tcp = fin->fin_dp;
if (((i == 0) && !(is->is_flags & IS_ISNSYN)) ||
((i == 1) && !(is->is_flags & IS_ISNACK))) {
old = ntohl(tcp->th_seq);
new = ipf_newisn(fin);
is->is_isninc[i] = new - old;
CALC_SUMD(old, new, sumd);
is->is_sumd[i] = (sumd & 0xffff) + (sumd >> 16);
is->is_flags |= ((i == 0) ? IS_ISNSYN : IS_ISNACK);
}
}
static int
ipf_state_tcpinwindow(fr_info_t *fin, tcpdata_t *fdata, tcpdata_t *tdata,
tcphdr_t *tcp, int flags)
{
ipf_main_softc_t *softc = fin->fin_main_soft;
ipf_state_softc_t *softs = softc->ipf_state_soft;
tcp_seq seq, ack, end;
int ackskew, tcpflags;
u_32_t win, maxwin;
int dsize, inseq;
tcpflags = tcp_get_flags(tcp);
seq = ntohl(tcp->th_seq);
ack = ntohl(tcp->th_ack);
if (tcpflags & TH_SYN)
win = ntohs(tcp->th_win);
else
win = ntohs(tcp->th_win) << fdata->td_winscale;
if (win == 0)
win = 1;
dsize = fin->fin_dlen - (TCP_OFF(tcp) << 2) +
((tcpflags & TH_SYN) ? 1 : 0) + ((tcpflags & TH_FIN) ? 1 : 0);
if (!(tcpflags & TH_SYN) && (fdata->td_winflags & TCP_WSCALE_FIRST)) {
fdata->td_winflags &= ~TCP_WSCALE_FIRST;
fdata->td_maxwin = win;
}
end = seq + dsize;
if ((fdata->td_end == 0) &&
(!(flags & IS_TCPFSM) ||
((tcpflags & TH_OPENING) == TH_OPENING))) {
fdata->td_end = end - 1;
fdata->td_maxwin = 1;
fdata->td_maxend = end + win;
}
if (!(tcpflags & TH_ACK)) {
ack = tdata->td_end;
} else if (((tcpflags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) &&
(ack == 0)) {
ack = tdata->td_end;
}
maxwin = tdata->td_maxwin;
ackskew = tdata->td_end - ack;
if ((flags & IS_STRICT) != 0) {
if (seq != fdata->td_end) {
DT2(iss_tcp_struct, tcpdata_t *, fdata, int, seq);
SBUMP(ipf_state_stats.iss_tcp_strict);
fin->fin_flx |= FI_OOW;
return (0);
}
}
#define SEQ_GE(a,b) ((int)((a) - (b)) >= 0)
#define SEQ_GT(a,b) ((int)((a) - (b)) > 0)
inseq = 0;
if ((SEQ_GE(fdata->td_maxend, end)) &&
(SEQ_GE(seq, fdata->td_end - maxwin)) &&
#define MAXACKWINDOW 66000
(-ackskew <= (MAXACKWINDOW)) &&
( ackskew <= (MAXACKWINDOW << fdata->td_winscale))) {
inseq = 1;
} else if ((seq == fdata->td_maxend) && (ackskew == 0) &&
(fdata->td_winflags & TCP_SACK_PERMIT) &&
(tdata->td_winflags & TCP_SACK_PERMIT)) {
DT2(iss_sinsack, tcpdata_t *, fdata, int, seq);
SBUMP(ipf_state_stats.iss_winsack);
inseq = 1;
} else if ((seq == 0) && (tcpflags == (TH_RST|TH_ACK)) &&
(ackskew >= -1) && (ackskew <= 1)) {
inseq = 1;
} else if (!(flags & IS_TCPFSM)) {
if (!(fdata->td_winflags &
(TCP_WSCALE_SEEN|TCP_WSCALE_FIRST))) {
if ((seq == fdata->td_maxend) && (ackskew == 0))
inseq = 1;
else if (SEQ_GE(seq + maxwin, fdata->td_end - maxwin))
inseq = 1;
}
}
if (inseq) {
if (ackskew < 0)
tdata->td_end = ack;
if (fdata->td_maxwin < win)
fdata->td_maxwin = win;
if (SEQ_GT(end, fdata->td_end))
fdata->td_end = end;
if (SEQ_GE(ack + win, tdata->td_maxend))
tdata->td_maxend = ack + win;
return (1);
}
SBUMP(ipf_state_stats.iss_oow);
fin->fin_flx |= FI_OOW;
return (0);
}
static ipstate_t *
ipf_state_clone(fr_info_t *fin, tcphdr_t *tcp, ipstate_t *is)
{
ipf_main_softc_t *softc = fin->fin_main_soft;
ipf_state_softc_t *softs = softc->ipf_state_soft;
ipstate_t *clone;
u_32_t send;
if (softs->ipf_state_stats.iss_active == softs->ipf_state_max) {
SBUMPD(ipf_state_stats, iss_max);
softs->ipf_state_doflush = 1;
return (NULL);
}
KMALLOC(clone, ipstate_t *);
if (clone == NULL) {
SBUMPD(ipf_state_stats, iss_clone_nomem);
return (NULL);
}
bcopy((char *)is, (char *)clone, sizeof(*clone));
MUTEX_NUKE(&clone->is_lock);
clone->is_sti.tqe_pnext = NULL;
clone->is_sti.tqe_next = NULL;
clone->is_sti.tqe_ifq = NULL;
clone->is_sti.tqe_parent = clone;
clone->is_die = ONE_DAY + softc->ipf_ticks;
clone->is_state[0] = 0;
clone->is_state[1] = 0;
send = ntohl(tcp->th_seq) + fin->fin_dlen - (TCP_OFF(tcp) << 2) +
((tcp_get_flags(tcp) & TH_SYN) ? 1 : 0) +
((tcp_get_flags(tcp) & TH_FIN) ? 1 : 0);
if (fin->fin_rev == 1) {
clone->is_dend = send;
clone->is_maxdend = send;
clone->is_send = 0;
clone->is_maxswin = 1;
clone->is_maxdwin = ntohs(tcp->th_win);
if (clone->is_maxdwin == 0)
clone->is_maxdwin = 1;
} else {
clone->is_send = send;
clone->is_maxsend = send;
clone->is_dend = 0;
clone->is_maxdwin = 1;
clone->is_maxswin = ntohs(tcp->th_win);
if (clone->is_maxswin == 0)
clone->is_maxswin = 1;
}
clone->is_flags &= ~SI_CLONE;
clone->is_flags |= SI_CLONED;
if (ipf_state_insert(softc, clone, fin->fin_rev) == -1) {
KFREE(clone);
return (NULL);
}
clone->is_ref = 1;
if (clone->is_p == IPPROTO_TCP) {
(void) ipf_tcp_age(&clone->is_sti, fin, softs->ipf_state_tcptq,
clone->is_flags, 2);
}
MUTEX_EXIT(&clone->is_lock);
if (is->is_flags & IS_STATESYNC)
clone->is_sync = ipf_sync_new(softc, SMC_STATE, fin, clone);
DT2(iss_clone, ipstate_t *, is, ipstate_t *, clone);
SBUMP(ipf_state_stats.iss_cloned);
return (clone);
}
static ipstate_t *
ipf_matchsrcdst(fr_info_t *fin, ipstate_t *is, i6addr_t *src, i6addr_t *dst,
tcphdr_t *tcp, u_32_t cmask)
{
ipf_main_softc_t *softc = fin->fin_main_soft;
ipf_state_softc_t *softs = softc->ipf_state_soft;
int ret = 0, rev, out, flags, flx = 0, idx;
u_short sp, dp;
u_32_t cflx;
void *ifp;
if (is->is_sti.tqe_ifq == &softs->ipf_state_deletetq)
return (NULL);
rev = IP6_NEQ(&is->is_dst, dst);
ifp = fin->fin_ifp;
out = fin->fin_out;
flags = is->is_flags;
sp = 0;
dp = 0;
if (tcp != NULL) {
sp = htons(fin->fin_sport);
dp = ntohs(fin->fin_dport);
}
if (!rev) {
if (tcp != NULL) {
if (!(flags & SI_W_SPORT) && (sp != is->is_sport))
rev = 1;
else if (!(flags & SI_W_DPORT) && (dp != is->is_dport))
rev = 1;
}
}
idx = (out << 1) + rev;
if ((is->is_ifp[idx] == ifp) || (is->is_ifp[idx] == NULL &&
(*is->is_ifname[idx] == '\0' || *is->is_ifname[idx] == '-' ||
*is->is_ifname[idx] == '*')))
ret = 1;
if (ret == 0) {
DT2(iss_lookup_badifp, fr_info_t *, fin, ipstate_t *, is);
SBUMP(ipf_state_stats.iss_lookup_badifp);
return (NULL);
}
ret = 0;
if (rev == 0) {
if ((IP6_EQ(&is->is_dst, dst) || (flags & SI_W_DADDR)) &&
(IP6_EQ(&is->is_src, src) || (flags & SI_W_SADDR))) {
if (tcp) {
if ((sp == is->is_sport || flags & SI_W_SPORT)
&&
(dp == is->is_dport || flags & SI_W_DPORT))
ret = 1;
} else {
ret = 1;
}
}
} else {
if ((IP6_EQ(&is->is_dst, src) || (flags & SI_W_DADDR)) &&
(IP6_EQ(&is->is_src, dst) || (flags & SI_W_SADDR))) {
if (tcp) {
if ((dp == is->is_sport || flags & SI_W_SPORT)
&&
(sp == is->is_dport || flags & SI_W_DPORT))
ret = 1;
} else {
ret = 1;
}
}
}
if (ret == 0) {
SBUMP(ipf_state_stats.iss_lookup_badport);
DT2(iss_lookup_badport, fr_info_t *, fin, ipstate_t *, is);
return (NULL);
}
if (tcp == NULL)
flags = is->is_flags & ~(SI_WILDP|SI_NEWFR|SI_CLONE|SI_CLONED);
if ((flags & (SI_W_SADDR|SI_W_DADDR))) {
fr_ip_t *fi = &fin->fin_fi;
if ((flags & SI_W_SADDR) != 0) {
if (rev == 0) {
is->is_src = fi->fi_src;
is->is_flags &= ~SI_W_SADDR;
} else {
if (!(fin->fin_flx & (FI_MULTICAST|FI_MBCAST))){
is->is_src = fi->fi_dst;
is->is_flags &= ~SI_W_SADDR;
}
}
} else if ((flags & SI_W_DADDR) != 0) {
if (rev == 0) {
if (!(fin->fin_flx & (FI_MULTICAST|FI_MBCAST))){
is->is_dst = fi->fi_dst;
is->is_flags &= ~SI_W_DADDR;
}
} else {
is->is_dst = fi->fi_src;
is->is_flags &= ~SI_W_DADDR;
}
}
if ((is->is_flags & (SI_WILDA|SI_WILDP)) == 0) {
ATOMIC_DECL(softs->ipf_state_stats.iss_wild);
}
}
flx = fin->fin_flx & cmask;
cflx = is->is_flx[out][rev];
if ((cflx && (flx != (cflx & cmask))) ||
((fin->fin_optmsk & is->is_optmsk[rev]) != is->is_opt[rev]) ||
((fin->fin_secmsk & is->is_secmsk) != is->is_sec) ||
((fin->fin_auth & is->is_authmsk) != is->is_auth)) {
SBUMPD(ipf_state_stats, iss_miss_mask);
return (NULL);
}
if ((fin->fin_flx & FI_IGNORE) != 0) {
fin->fin_rev = rev;
return (is);
}
if ((flags & (SI_W_SPORT|SI_W_DPORT))) {
if ((flags & SI_CLONE) != 0) {
ipstate_t *clone;
clone = ipf_state_clone(fin, tcp, is);
if (clone == NULL)
return (NULL);
is = clone;
} else {
ATOMIC_DECL(softs->ipf_state_stats.iss_wild);
}
if ((flags & SI_W_SPORT) != 0) {
if (rev == 0) {
is->is_sport = sp;
is->is_send = ntohl(tcp->th_seq);
} else {
is->is_sport = dp;
is->is_send = ntohl(tcp->th_ack);
}
is->is_maxsend = is->is_send + 1;
} else if ((flags & SI_W_DPORT) != 0) {
if (rev == 0) {
is->is_dport = dp;
is->is_dend = ntohl(tcp->th_ack);
} else {
is->is_dport = sp;
is->is_dend = ntohl(tcp->th_seq);
}
is->is_maxdend = is->is_dend + 1;
}
is->is_flags &= ~(SI_W_SPORT|SI_W_DPORT);
if ((flags & SI_CLONED) && softs->ipf_state_logging)
ipf_state_log(softc, is, ISL_CLONE);
}
ret = -1;
if (is->is_flx[out][rev] == 0) {
is->is_flx[out][rev] = flx;
if (rev == 1 && is->is_optmsk[1] == 0) {
is->is_opt[1] = fin->fin_optmsk;
is->is_optmsk[1] = 0xffffffff;
if (is->is_v == 6) {
is->is_opt[1] &= ~0x8;
is->is_optmsk[1] &= ~0x8;
}
}
}
if (is->is_ifp[idx] == NULL &&
(*is->is_ifname[idx] == '\0' || *is->is_ifname[idx] == '*')) {
is->is_ifp[idx] = ifp;
COPYIFNAME(fin->fin_v, ifp, is->is_ifname[idx]);
}
fin->fin_rev = rev;
return (is);
}
static ipstate_t *
ipf_checkicmpmatchingstate(fr_info_t *fin)
{
ipf_main_softc_t *softc = fin->fin_main_soft;
ipf_state_softc_t *softs = softc->ipf_state_soft;
ipstate_t *is, **isp;
i6addr_t dst, src;
struct icmp *ic;
u_short savelen;
icmphdr_t *icmp;
fr_info_t ofin;
tcphdr_t *tcp;
int len;
u_char pr;
ip_t *oip;
u_int hv;
if ((fin->fin_v != 4) || (fin->fin_hlen != sizeof(ip_t)) ||
(fin->fin_plen < ICMPERR_MINPKTLEN) ||
!(fin->fin_flx & FI_ICMPERR)) {
SBUMPD(ipf_state_stats, iss_icmp_bad);
return (NULL);
}
ic = fin->fin_dp;
oip = (ip_t *)((char *)ic + ICMPERR_ICMPHLEN);
if (fin->fin_plen < ICMPERR_MAXPKTLEN + ((IP_HL(oip) - 5) << 2)) {
SBUMPDX(ipf_state_stats, iss_icmp_short, iss_icmp_short_1);
return (NULL);
}
len = fin->fin_dlen - ICMPERR_ICMPHLEN;
if ((len <= 0) || ((IP_HL(oip) << 2) > len)) {
DT2(iss_icmp_len, fr_info_t *, fin, struct ip*, oip);
SBUMPDX(ipf_state_stats, iss_icmp_short, iss_icmp_short_1);
return (NULL);
}
#ifdef _KERNEL
{
mb_t *m;
m = fin->fin_m;
# if SOLARIS
if ((char *)oip + len > (char *)m->b_wptr) {
SBUMPDX(ipf_state_stats, iss_icmp_short, iss_icmp_short_2);
return (NULL);
}
# else
if ((char *)oip + len > (char *)fin->fin_ip + m->m_len) {
SBUMPDX(ipf_state_stats, iss_icmp_short, iss_icmp_short_3);
return (NULL);
}
# endif
}
#endif
bcopy((char *)fin, (char *)&ofin, sizeof(*fin));
bzero((char *)&src, sizeof(src));
bzero((char *)&dst, sizeof(dst));
savelen = oip->ip_len;
oip->ip_len = htons(len);
ofin.fin_flx = FI_NOCKSUM;
ofin.fin_v = 4;
ofin.fin_ip = oip;
ofin.fin_m = NULL;
ofin.fin_mp = NULL;
(void) ipf_makefrip(IP_HL(oip) << 2, oip, &ofin);
ofin.fin_ifp = fin->fin_ifp;
ofin.fin_out = !fin->fin_out;
hv = (pr = oip->ip_p);
src.in4 = oip->ip_src;
hv += src.in4.s_addr;
dst.in4 = oip->ip_dst;
hv += dst.in4.s_addr;
ofin.fin_flx &= ~(FI_BAD|FI_SHORT);
oip->ip_len = savelen;
switch (oip->ip_p)
{
case IPPROTO_ICMP :
if ((ofin.fin_flx & FI_ICMPERR) != 0) {
DT1(iss_icmp_icmperr, fr_info_t *, &ofin);
SBUMP(ipf_state_stats.iss_icmp_icmperr);
return (NULL);
}
icmp = (icmphdr_t *)((char *)oip + (IP_HL(oip) << 2));
hv += icmp->icmp_id;
hv = DOUBLE_HASH(hv);
READ_ENTER(&softc->ipf_state);
for (isp = &softs->ipf_state_table[hv];
((is = *isp) != NULL); ) {
isp = &is->is_hnext;
if ((is->is_p != pr) || (is->is_v != 4))
continue;
if (is->is_pass & FR_NOICMPERR)
continue;
is = ipf_matchsrcdst(&ofin, is, &src, &dst,
NULL, FI_ICMPCMP);
if ((is != NULL) && !ipf_allowstateicmp(fin, is, &src))
return (is);
}
RWLOCK_EXIT(&softc->ipf_state);
SBUMPDX(ipf_state_stats, iss_icmp_miss, iss_icmp_miss_1);
return (NULL);
case IPPROTO_TCP :
case IPPROTO_UDP :
break;
default :
SBUMPDX(ipf_state_stats, iss_icmp_miss, iss_icmp_miss_2);
return (NULL);
}
tcp = (tcphdr_t *)((char *)oip + (IP_HL(oip) << 2));
hv += tcp->th_dport;
hv += tcp->th_sport;
hv = DOUBLE_HASH(hv);
READ_ENTER(&softc->ipf_state);
for (isp = &softs->ipf_state_table[hv]; ((is = *isp) != NULL); ) {
isp = &is->is_hnext;
if ((is->is_p == pr) && (is->is_v == 4) &&
(is = ipf_matchsrcdst(&ofin, is, &src, &dst,
tcp, FI_ICMPCMP))) {
if (ipf_allowstateicmp(fin, is, &src) == 0)
return (is);
}
}
RWLOCK_EXIT(&softc->ipf_state);
SBUMPDX(ipf_state_stats, iss_icmp_miss, iss_icmp_miss_3);
return (NULL);
}
static int
ipf_allowstateicmp(fr_info_t *fin, ipstate_t *is, i6addr_t *src)
{
ipf_main_softc_t *softc = fin->fin_main_soft;
ipf_state_softc_t *softs = softc->ipf_state_soft;
frentry_t *savefr;
frentry_t *fr;
u_32_t ipass;
int backward;
int oi;
int i;
fr = is->is_rule;
if (fr != NULL && fr->fr_icmpgrp != NULL) {
savefr = fin->fin_fr;
fin->fin_fr = fr->fr_icmpgrp->fg_start;
ipass = ipf_scanlist(fin, softc->ipf_pass);
fin->fin_fr = savefr;
if (FR_ISBLOCK(ipass)) {
SBUMPD(ipf_state_stats, iss_icmp_headblock);
return (1);
}
}
backward = IP6_NEQ(&is->is_src, src);
fin->fin_rev = !backward;
i = (!backward << 1) + fin->fin_out;
oi = (backward << 1) + !fin->fin_out;
if (is->is_pass & FR_NOICMPERR) {
SBUMPD(ipf_state_stats, iss_icmp_banned);
return (1);
}
if (is->is_icmppkts[i] > is->is_pkts[oi]) {
SBUMPD(ipf_state_stats, iss_icmp_toomany);
return (1);
}
DT2(iss_icmp_hits, fr_info_t *, fin, ipstate_t *, is);
SBUMP(ipf_state_stats.iss_icmp_hits);
is->is_icmppkts[i]++;
return (0);
}
static void
ipf_ipsmove(ipf_state_softc_t *softs, ipstate_t *is, u_int hv)
{
ipstate_t **isp;
u_int hvm;
hvm = is->is_hv;
isp = is->is_phnext;
if (is->is_hnext)
is->is_hnext->is_phnext = isp;
*isp = is->is_hnext;
if (softs->ipf_state_table[hvm] == NULL)
softs->ipf_state_stats.iss_inuse--;
softs->ipf_state_stats.iss_bucketlen[hvm]--;
hvm = DOUBLE_HASH(hv);
is->is_hv = hvm;
isp = &softs->ipf_state_table[hvm];
if (*isp)
(*isp)->is_phnext = &is->is_hnext;
else
softs->ipf_state_stats.iss_inuse++;
softs->ipf_state_stats.iss_bucketlen[hvm]++;
is->is_phnext = isp;
is->is_hnext = *isp;
*isp = is;
}
ipstate_t *
ipf_state_lookup(fr_info_t *fin, tcphdr_t *tcp, ipftq_t **ifqp)
{
ipf_main_softc_t *softc = fin->fin_main_soft;
ipf_state_softc_t *softs = softc->ipf_state_soft;
u_int hv, hvm, pr, v, tryagain;
ipstate_t *is, **isp;
u_short dport, sport;
i6addr_t src, dst;
struct icmp *ic;
ipftq_t *ifq;
int oow;
is = NULL;
ifq = NULL;
tcp = fin->fin_dp;
ic = (struct icmp *)tcp;
hv = (pr = fin->fin_fi.fi_p);
src = fin->fin_fi.fi_src;
dst = fin->fin_fi.fi_dst;
hv += src.in4.s_addr;
hv += dst.in4.s_addr;
v = fin->fin_fi.fi_v;
#ifdef USE_INET6
if (v == 6) {
hv += fin->fin_fi.fi_src.i6[1];
hv += fin->fin_fi.fi_src.i6[2];
hv += fin->fin_fi.fi_src.i6[3];
if ((fin->fin_p == IPPROTO_ICMPV6) &&
IN6_IS_ADDR_MULTICAST(&fin->fin_fi.fi_dst.in6)) {
hv -= dst.in4.s_addr;
} else {
hv += fin->fin_fi.fi_dst.i6[1];
hv += fin->fin_fi.fi_dst.i6[2];
hv += fin->fin_fi.fi_dst.i6[3];
}
}
#endif
if ((v == 4) &&
(fin->fin_flx & (FI_MULTICAST|FI_BROADCAST|FI_MBCAST))) {
if (fin->fin_out == 0) {
hv -= src.in4.s_addr;
} else {
hv -= dst.in4.s_addr;
}
}
switch (pr)
{
#ifdef USE_INET6
case IPPROTO_ICMPV6 :
tryagain = 0;
if (v == 6) {
if ((ic->icmp_type == ICMP6_ECHO_REQUEST) ||
(ic->icmp_type == ICMP6_ECHO_REPLY)) {
hv += ic->icmp_id;
}
}
READ_ENTER(&softc->ipf_state);
icmp6again:
hvm = DOUBLE_HASH(hv);
for (isp = &softs->ipf_state_table[hvm];
((is = *isp) != NULL); ) {
isp = &is->is_hnext;
if ((is->is_p != pr) || (is->is_v != v))
continue;
is = ipf_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP);
if (is != NULL &&
ipf_matchicmpqueryreply(v, &is->is_icmp,
ic, fin->fin_rev)) {
if (fin->fin_rev)
ifq = &softs->ipf_state_icmpacktq;
else
ifq = &softs->ipf_state_icmptq;
break;
}
}
if (is != NULL) {
if ((tryagain != 0) && !(is->is_flags & SI_W_DADDR)) {
hv += fin->fin_fi.fi_src.i6[0];
hv += fin->fin_fi.fi_src.i6[1];
hv += fin->fin_fi.fi_src.i6[2];
hv += fin->fin_fi.fi_src.i6[3];
ipf_ipsmove(softs, is, hv);
MUTEX_DOWNGRADE(&softc->ipf_state);
}
break;
}
RWLOCK_EXIT(&softc->ipf_state);
if ((softs->ipf_state_stats.iss_wild != 0) &&
((fin->fin_flx & FI_NOWILD) == 0) &&
(v == 6) && (tryagain == 0)) {
hv -= fin->fin_fi.fi_src.i6[0];
hv -= fin->fin_fi.fi_src.i6[1];
hv -= fin->fin_fi.fi_src.i6[2];
hv -= fin->fin_fi.fi_src.i6[3];
tryagain = 1;
WRITE_ENTER(&softc->ipf_state);
goto icmp6again;
}
is = ipf_checkicmp6matchingstate(fin);
if (is != NULL)
return (is);
break;
#endif
case IPPROTO_ICMP :
if (v == 4) {
hv += ic->icmp_id;
}
hv = DOUBLE_HASH(hv);
READ_ENTER(&softc->ipf_state);
for (isp = &softs->ipf_state_table[hv];
((is = *isp) != NULL); ) {
isp = &is->is_hnext;
if ((is->is_p != pr) || (is->is_v != v))
continue;
is = ipf_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP);
if ((is != NULL) &&
(ic->icmp_id == is->is_icmp.ici_id) &&
ipf_matchicmpqueryreply(v, &is->is_icmp,
ic, fin->fin_rev)) {
if (fin->fin_rev)
ifq = &softs->ipf_state_icmpacktq;
else
ifq = &softs->ipf_state_icmptq;
break;
}
}
if (is == NULL) {
RWLOCK_EXIT(&softc->ipf_state);
}
break;
case IPPROTO_TCP :
case IPPROTO_UDP :
ifqp = NULL;
sport = htons(fin->fin_data[0]);
hv += sport;
dport = htons(fin->fin_data[1]);
hv += dport;
oow = 0;
tryagain = 0;
READ_ENTER(&softc->ipf_state);
retry_tcpudp:
hvm = DOUBLE_HASH(hv);
for (isp = &softs->ipf_state_table[hvm];
((is = *isp) != NULL); ) {
isp = &is->is_hnext;
if ((is->is_p != pr) || (is->is_v != v))
continue;
fin->fin_flx &= ~FI_OOW;
is = ipf_matchsrcdst(fin, is, &src, &dst, tcp, FI_CMP);
if (is != NULL) {
if (pr == IPPROTO_TCP) {
if (!ipf_state_tcp(softc, softs, fin,
tcp, is)) {
oow |= fin->fin_flx & FI_OOW;
continue;
}
}
break;
}
}
if (is != NULL) {
if (tryagain &&
!(is->is_flags & (SI_CLONE|SI_WILDP|SI_WILDA))) {
hv += dport;
hv += sport;
ipf_ipsmove(softs, is, hv);
MUTEX_DOWNGRADE(&softc->ipf_state);
}
break;
}
RWLOCK_EXIT(&softc->ipf_state);
if ((softs->ipf_state_stats.iss_wild != 0) &&
((fin->fin_flx & FI_NOWILD) == 0)) {
if (tryagain == 0) {
hv -= dport;
hv -= sport;
} else if (tryagain == 1) {
hv = fin->fin_fi.fi_p;
if (fin->fin_out == 0) {
hv += src.in4.s_addr;
} else {
hv += dst.in4.s_addr;
}
hv += dport;
hv += sport;
}
tryagain++;
if (tryagain <= 2) {
WRITE_ENTER(&softc->ipf_state);
goto retry_tcpudp;
}
}
fin->fin_flx |= oow;
break;
#if 0
case IPPROTO_GRE :
gre = fin->fin_dp;
if (GRE_REV(gre->gr_flags) == 1) {
hv += gre->gr_call;
}
#endif
default :
ifqp = NULL;
hvm = DOUBLE_HASH(hv);
READ_ENTER(&softc->ipf_state);
for (isp = &softs->ipf_state_table[hvm];
((is = *isp) != NULL); ) {
isp = &is->is_hnext;
if ((is->is_p != pr) || (is->is_v != v))
continue;
is = ipf_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP);
if (is != NULL) {
ifq = &softs->ipf_state_iptq;
break;
}
}
if (is == NULL) {
RWLOCK_EXIT(&softc->ipf_state);
}
break;
}
if (is != NULL) {
if (((is->is_sti.tqe_flags & TQE_RULEBASED) != 0) &&
(is->is_tqehead[fin->fin_rev] != NULL))
ifq = is->is_tqehead[fin->fin_rev];
if (ifq != NULL && ifqp != NULL)
*ifqp = ifq;
} else {
SBUMP(ipf_state_stats.iss_lookup_miss);
}
return (is);
}
frentry_t *
ipf_state_check(fr_info_t *fin, u_32_t *passp)
{
ipf_main_softc_t *softc = fin->fin_main_soft;
ipf_state_softc_t *softs = softc->ipf_state_soft;
ipftqent_t *tqe;
ipstate_t *is;
frentry_t *fr;
tcphdr_t *tcp;
ipftq_t *ifq;
u_int pass;
int inout;
if (softs->ipf_state_lock || (softs->ipf_state_list == NULL))
return (NULL);
if (fin->fin_flx & (FI_SHORT|FI_FRAGBODY|FI_BAD)) {
SBUMPD(ipf_state_stats, iss_check_bad);
return (NULL);
}
if ((fin->fin_flx & FI_TCPUDP) ||
(fin->fin_fi.fi_p == IPPROTO_ICMP)
#ifdef USE_INET6
|| (fin->fin_fi.fi_p == IPPROTO_ICMPV6)
#endif
)
tcp = fin->fin_dp;
else
tcp = NULL;
ifq = NULL;
is = ipf_state_lookup(fin, tcp, &ifq);
switch (fin->fin_p)
{
#ifdef USE_INET6
case IPPROTO_ICMPV6 :
if (is != NULL)
break;
if (fin->fin_v == 6) {
is = ipf_checkicmp6matchingstate(fin);
}
break;
#endif
case IPPROTO_ICMP :
if (is != NULL)
break;
is = ipf_checkicmpmatchingstate(fin);
break;
case IPPROTO_TCP :
if (is == NULL)
break;
if (is->is_pass & FR_NEWISN) {
if (fin->fin_out == 0)
ipf_fixinisn(fin, is);
else if (fin->fin_out == 1)
ipf_fixoutisn(fin, is);
}
break;
default :
if (fin->fin_rev)
ifq = &softs->ipf_state_udpacktq;
else
ifq = &softs->ipf_state_udptq;
break;
}
if (is == NULL) {
SBUMP(ipf_state_stats.iss_check_miss);
return (NULL);
}
fr = is->is_rule;
if (fr != NULL) {
if ((fin->fin_out == 0) && (fr->fr_nattag.ipt_num[0] != 0)) {
if (fin->fin_nattag == NULL) {
RWLOCK_EXIT(&softc->ipf_state);
SBUMPD(ipf_state_stats, iss_check_notag);
return (NULL);
}
if (ipf_matchtag(&fr->fr_nattag, fin->fin_nattag)!=0) {
RWLOCK_EXIT(&softc->ipf_state);
SBUMPD(ipf_state_stats, iss_check_nattag);
return (NULL);
}
}
(void) strncpy(fin->fin_group, FR_NAME(fr, fr_group),
FR_GROUPLEN);
fin->fin_icode = fr->fr_icode;
}
fin->fin_rule = is->is_rulen;
fin->fin_fr = fr;
if (fin->fin_flx & FI_FRAG && FR_ISPASS(is->is_pass) &&
is->is_pass & FR_KEEPFRAG)
(void) ipf_frag_new(softc, fin, is->is_pass);
tqe = &is->is_sti;
if ((tqe->tqe_flags & TQE_RULEBASED) != 0)
ifq = is->is_tqehead[fin->fin_rev];
MUTEX_ENTER(&is->is_lock);
if (ifq != NULL)
ipf_movequeue(softc->ipf_ticks, tqe, tqe->tqe_ifq, ifq);
inout = (fin->fin_rev << 1) + fin->fin_out;
is->is_pkts[inout]++;
is->is_bytes[inout] += fin->fin_plen;
fin->fin_pktnum = is->is_pkts[inout] + is->is_icmppkts[inout];
MUTEX_EXIT(&is->is_lock);
pass = is->is_pass;
if (is->is_flags & IS_STATESYNC)
ipf_sync_update(softc, SMC_STATE, fin, is->is_sync);
RWLOCK_EXIT(&softc->ipf_state);
SBUMP(ipf_state_stats.iss_hits);
fin->fin_dif = &is->is_dif;
fin->fin_tif = &is->is_tifs[fin->fin_rev];
fin->fin_flx |= FI_STATE;
if ((pass & FR_LOGFIRST) != 0)
pass &= ~(FR_LOGFIRST|FR_LOG);
*passp = pass;
return (fr);
}
static void
ipf_fixoutisn(fr_info_t *fin, ipstate_t *is)
{
tcphdr_t *tcp;
int rev;
u_32_t seq;
tcp = fin->fin_dp;
rev = fin->fin_rev;
if ((is->is_flags & IS_ISNSYN) != 0) {
if ((rev == 0) && (fin->fin_cksum < FI_CK_L4PART)) {
seq = ntohl(tcp->th_seq);
seq += is->is_isninc[0];
tcp->th_seq = htonl(seq);
ipf_fix_outcksum(0, &tcp->th_sum, is->is_sumd[0], 0);
}
}
if ((is->is_flags & IS_ISNACK) != 0) {
if ((rev == 1) && (fin->fin_cksum < FI_CK_L4PART)) {
seq = ntohl(tcp->th_seq);
seq += is->is_isninc[1];
tcp->th_seq = htonl(seq);
ipf_fix_outcksum(0, &tcp->th_sum, is->is_sumd[1], 0);
}
}
}
static void
ipf_fixinisn(fr_info_t *fin, ipstate_t *is)
{
tcphdr_t *tcp;
int rev;
u_32_t ack;
tcp = fin->fin_dp;
rev = fin->fin_rev;
if ((is->is_flags & IS_ISNSYN) != 0) {
if ((rev == 1) && (fin->fin_cksum < FI_CK_L4PART)) {
ack = ntohl(tcp->th_ack);
ack -= is->is_isninc[0];
tcp->th_ack = htonl(ack);
ipf_fix_incksum(0, &tcp->th_sum, is->is_sumd[0], 0);
}
}
if ((is->is_flags & IS_ISNACK) != 0) {
if ((rev == 0) && (fin->fin_cksum < FI_CK_L4PART)) {
ack = ntohl(tcp->th_ack);
ack -= is->is_isninc[1];
tcp->th_ack = htonl(ack);
ipf_fix_incksum(0, &tcp->th_sum, is->is_sumd[1], 0);
}
}
}
void
ipf_state_sync(ipf_main_softc_t *softc, void *ifp)
{
ipf_state_softc_t *softs = softc->ipf_state_soft;
ipstate_t *is;
int i;
if (softc->ipf_running <= 0)
return;
WRITE_ENTER(&softc->ipf_state);
if (softc->ipf_running <= 0) {
RWLOCK_EXIT(&softc->ipf_state);
return;
}
for (is = softs->ipf_state_list; is; is = is->is_next) {
for (i = 0; i < FR_NUM(is->is_ifp); i++) {
if (ifp == NULL || ifp == is->is_ifp[i])
is->is_ifp[i] = ipf_resolvenic(softc,
is->is_ifname[i],
is->is_v);
}
}
RWLOCK_EXIT(&softc->ipf_state);
}
static int
ipf_state_del(ipf_main_softc_t *softc, ipstate_t *is, int why)
{
ipf_state_softc_t *softs = softc->ipf_state_soft;
int orphan = 1;
frentry_t *fr;
if (is->is_phnext != NULL) {
*is->is_phnext = is->is_hnext;
if (is->is_hnext != NULL)
is->is_hnext->is_phnext = is->is_phnext;
if (softs->ipf_state_table[is->is_hv] == NULL)
softs->ipf_state_stats.iss_inuse--;
softs->ipf_state_stats.iss_bucketlen[is->is_hv]--;
is->is_phnext = NULL;
is->is_hnext = NULL;
orphan = 0;
}
if (is->is_flags & (SI_WILDP|SI_WILDA)) {
if (!(is->is_flags & SI_CLONED)) {
ATOMIC_DECL(softs->ipf_state_stats.iss_wild);
}
is->is_flags &= ~(SI_WILDP|SI_WILDA);
}
if (is->is_sti.tqe_ifq != NULL)
ipf_deletequeueentry(&is->is_sti);
MUTEX_ENTER(&is->is_lock);
if (is->is_me != NULL) {
*is->is_me = NULL;
is->is_me = NULL;
is->is_ref--;
}
is->is_ref--;
if (is->is_ref > 0) {
int refs;
refs = is->is_ref;
MUTEX_EXIT(&is->is_lock);
if (!orphan)
softs->ipf_state_stats.iss_orphan++;
return (refs);
}
fr = is->is_rule;
is->is_rule = NULL;
if (fr != NULL) {
if (fr->fr_srctrack.ht_max_nodes != 0) {
(void) ipf_ht_node_del(&fr->fr_srctrack,
is->is_family, &is->is_src);
}
}
ASSERT(is->is_ref == 0);
MUTEX_EXIT(&is->is_lock);
if (is->is_tqehead[0] != NULL) {
if (ipf_deletetimeoutqueue(is->is_tqehead[0]) == 0)
ipf_freetimeoutqueue(softc, is->is_tqehead[0]);
}
if (is->is_tqehead[1] != NULL) {
if (ipf_deletetimeoutqueue(is->is_tqehead[1]) == 0)
ipf_freetimeoutqueue(softc, is->is_tqehead[1]);
}
if (is->is_sync)
ipf_sync_del_state(softc->ipf_sync_soft, is->is_sync);
if (is->is_pnext != NULL) {
*is->is_pnext = is->is_next;
if (is->is_next != NULL)
is->is_next->is_pnext = is->is_pnext;
is->is_pnext = NULL;
is->is_next = NULL;
}
if (softs->ipf_state_logging != 0 && why != 0)
ipf_state_log(softc, is, why);
if (is->is_p == IPPROTO_TCP)
softs->ipf_state_stats.iss_fin++;
else
softs->ipf_state_stats.iss_expire++;
if (orphan)
softs->ipf_state_stats.iss_orphan--;
if (fr != NULL) {
fr->fr_statecnt--;
(void) ipf_derefrule(softc, &fr);
}
softs->ipf_state_stats.iss_active_proto[is->is_p]--;
MUTEX_DESTROY(&is->is_lock);
KFREE(is);
softs->ipf_state_stats.iss_active--;
return (0);
}
void
ipf_state_expire(ipf_main_softc_t *softc)
{
ipf_state_softc_t *softs = softc->ipf_state_soft;
ipftq_t *ifq, *ifqnext;
ipftqent_t *tqe, *tqn;
ipstate_t *is;
SPL_INT(s);
SPL_NET(s);
WRITE_ENTER(&softc->ipf_state);
for (ifq = softs->ipf_state_tcptq; ifq != NULL; ifq = ifq->ifq_next)
for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) {
if (tqe->tqe_die > softc->ipf_ticks)
break;
tqn = tqe->tqe_next;
is = tqe->tqe_parent;
ipf_state_del(softc, is, ISL_EXPIRE);
}
for (ifq = softs->ipf_state_usertq; ifq != NULL; ifq = ifqnext) {
ifqnext = ifq->ifq_next;
for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) {
if (tqe->tqe_die > softc->ipf_ticks)
break;
tqn = tqe->tqe_next;
is = tqe->tqe_parent;
ipf_state_del(softc, is, ISL_EXPIRE);
}
}
for (ifq = softs->ipf_state_usertq; ifq != NULL; ifq = ifqnext) {
ifqnext = ifq->ifq_next;
if (((ifq->ifq_flags & IFQF_DELETE) != 0) &&
(ifq->ifq_ref == 0)) {
ipf_freetimeoutqueue(softc, ifq);
}
}
if (softs->ipf_state_doflush) {
(void) ipf_state_flush(softc, 2, 0);
softs->ipf_state_doflush = 0;
softs->ipf_state_wm_last = softc->ipf_ticks;
}
RWLOCK_EXIT(&softc->ipf_state);
SPL_X(s);
}
int
ipf_state_flush(ipf_main_softc_t *softc, int which, int proto)
{
ipf_state_softc_t *softs = softc->ipf_state_soft;
ipftqent_t *tqe, *tqn;
ipstate_t *is, **isp;
ipftq_t *ifq;
int removed;
SPL_INT(s);
removed = 0;
SPL_NET(s);
switch (which)
{
case 0 :
SBUMP(ipf_state_stats.iss_flush_all);
for (isp = &softs->ipf_state_list; ((is = *isp) != NULL); ) {
if ((proto != 0) && (is->is_v != proto)) {
isp = &is->is_next;
continue;
}
if (ipf_state_del(softc, is, ISL_FLUSH) == 0)
removed++;
else
isp = &is->is_next;
}
break;
case 1 :
SBUMP(ipf_state_stats.iss_flush_closing);
for (ifq = softs->ipf_state_tcptq + IPF_TCPS_CLOSE_WAIT;
ifq != NULL; ifq = ifq->ifq_next) {
for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) {
tqn = tqe->tqe_next;
is = tqe->tqe_parent;
if (is->is_p != IPPROTO_TCP)
break;
if (ipf_state_del(softc, is, ISL_FLUSH) == 0)
removed++;
}
}
for (ifq = softs->ipf_state_usertq; ifq != NULL;
ifq = ifq->ifq_next) {
for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) {
tqn = tqe->tqe_next;
is = tqe->tqe_parent;
if (is->is_p != IPPROTO_TCP)
continue;
if ((is->is_state[0] > IPF_TCPS_ESTABLISHED) &&
(is->is_state[1] > IPF_TCPS_ESTABLISHED)) {
if (ipf_state_del(softc, is,
ISL_FLUSH) == 0)
removed++;
}
}
}
break;
case 2 :
break;
case IPF_TCPS_CLOSE_WAIT :
case IPF_TCPS_FIN_WAIT_1 :
case IPF_TCPS_CLOSING :
case IPF_TCPS_LAST_ACK :
case IPF_TCPS_FIN_WAIT_2 :
case IPF_TCPS_TIME_WAIT :
case IPF_TCPS_CLOSED :
SBUMP(ipf_state_stats.iss_flush_queue);
tqn = softs->ipf_state_tcptq[which].ifq_head;
while (tqn != NULL) {
tqe = tqn;
tqn = tqe->tqe_next;
is = tqe->tqe_parent;
if (ipf_state_del(softc, is, ISL_FLUSH) == 0)
removed++;
}
break;
default :
if (which < 30)
break;
SBUMP(ipf_state_stats.iss_flush_state);
which = IPF_TTLVAL(which);
for (isp = &softs->ipf_state_list; ((is = *isp) != NULL); ) {
if ((proto == 0) || (is->is_v == proto)) {
if (softc->ipf_ticks - is->is_touched > which) {
if (ipf_state_del(softc, is,
ISL_FLUSH) == 0) {
removed++;
continue;
}
}
}
isp = &is->is_next;
}
break;
}
if (which != 2) {
SPL_X(s);
return (removed);
}
SBUMP(ipf_state_stats.iss_flush_timeout);
if (softc->ipf_ticks - softs->ipf_state_wm_last >
softs->ipf_state_wm_freq) {
removed = ipf_queueflush(softc, ipf_state_flush_entry,
softs->ipf_state_tcptq,
softs->ipf_state_usertq,
&softs->ipf_state_stats.iss_active,
softs->ipf_state_size,
softs->ipf_state_wm_low);
softs->ipf_state_wm_last = softc->ipf_ticks;
}
SPL_X(s);
return (removed);
}
static int
ipf_state_flush_entry(ipf_main_softc_t *softc, void *entry)
{
return (ipf_state_del(softc, entry, ISL_FLUSH));
}
int
ipf_tcp_age(ipftqent_t *tqe, fr_info_t *fin, ipftq_t *tqtab, int flags, int ok)
{
ipf_main_softc_t *softc = fin->fin_main_soft;
int dlen, ostate, nstate, rval, dir;
u_char tcpflags;
tcphdr_t *tcp;
tcp = fin->fin_dp;
rval = 0;
dir = fin->fin_rev;
tcpflags = tcp_get_flags(tcp);
dlen = fin->fin_dlen - (TCP_OFF(tcp) << 2);
ostate = tqe->tqe_state[1 - dir];
nstate = tqe->tqe_state[dir];
if (tcpflags & TH_RST) {
if (!(tcpflags & TH_PUSH) && !dlen)
nstate = IPF_TCPS_CLOSED;
else
nstate = IPF_TCPS_CLOSE_WAIT;
if (ostate <= IPF_TCPS_ESTABLISHED) {
tqe->tqe_state[1 - dir] = IPF_TCPS_CLOSE_WAIT;
}
rval = 1;
} else {
switch (nstate)
{
case IPF_TCPS_LISTEN:
if ((tcpflags & TH_OPENING) == TH_OPENING) {
nstate = IPF_TCPS_SYN_RECEIVED;
rval = 1;
} else if ((tcpflags & TH_OPENING) == TH_SYN) {
nstate = IPF_TCPS_SYN_SENT;
rval = 1;
}
if (((flags & IS_TCPFSM) == 0) &&
((tcpflags & TH_ACKMASK) == TH_ACK)) {
switch (ostate)
{
case IPF_TCPS_LISTEN :
case IPF_TCPS_SYN_RECEIVED :
nstate = IPF_TCPS_HALF_ESTAB;
rval = 1;
break;
case IPF_TCPS_HALF_ESTAB :
case IPF_TCPS_ESTABLISHED :
nstate = IPF_TCPS_ESTABLISHED;
rval = 1;
break;
default :
break;
}
}
break;
case IPF_TCPS_SYN_SENT:
if ((tcpflags & ~(TH_ECN|TH_CWR)) == TH_SYN) {
rval = 2;
} else if ((tcpflags & (TH_SYN|TH_FIN|TH_ACK)) ==
TH_ACK) {
nstate = IPF_TCPS_ESTABLISHED;
rval = 1;
} else if (tcpflags & TH_FIN) {
nstate = IPF_TCPS_FIN_WAIT_1;
rval = 1;
} else if ((tcpflags & TH_OPENING) == TH_OPENING) {
nstate = IPF_TCPS_SYN_RECEIVED;
rval = 1;
}
break;
case IPF_TCPS_SYN_RECEIVED:
if ((tcpflags & (TH_SYN|TH_FIN|TH_ACK)) == TH_ACK) {
nstate = IPF_TCPS_ESTABLISHED;
rval = 1;
} else if ((tcpflags & ~(TH_ECN|TH_CWR)) ==
TH_OPENING) {
rval = 2;
} else if (tcpflags & TH_FIN) {
nstate = IPF_TCPS_FIN_WAIT_1;
rval = 1;
}
break;
case IPF_TCPS_HALF_ESTAB:
if (tcpflags & TH_FIN) {
nstate = IPF_TCPS_FIN_WAIT_1;
rval = 1;
} else if ((tcpflags & TH_ACKMASK) == TH_ACK) {
switch (ostate)
{
case IPF_TCPS_LISTEN :
case IPF_TCPS_SYN_SENT :
case IPF_TCPS_SYN_RECEIVED :
rval = 1;
break;
case IPF_TCPS_HALF_ESTAB :
case IPF_TCPS_ESTABLISHED :
nstate = IPF_TCPS_ESTABLISHED;
rval = 1;
break;
default :
break;
}
}
break;
case IPF_TCPS_ESTABLISHED:
rval = 1;
if (tcpflags & TH_FIN) {
if (ostate == IPF_TCPS_FIN_WAIT_1) {
nstate = IPF_TCPS_CLOSING;
} else {
nstate = IPF_TCPS_FIN_WAIT_1;
}
} else if (tcpflags & TH_ACK) {
if (ostate == IPF_TCPS_FIN_WAIT_1) {
nstate = IPF_TCPS_CLOSE_WAIT;
} else if (ostate < IPF_TCPS_CLOSE_WAIT) {
nstate = IPF_TCPS_ESTABLISHED;
}
}
break;
case IPF_TCPS_CLOSE_WAIT:
rval = 1;
if (tcpflags & TH_FIN) {
nstate = IPF_TCPS_LAST_ACK;
} else {
nstate = IPF_TCPS_CLOSE_WAIT;
}
break;
case IPF_TCPS_FIN_WAIT_1:
rval = 1;
if ((tcpflags & TH_ACK) &&
ostate > IPF_TCPS_CLOSE_WAIT) {
nstate = IPF_TCPS_LAST_ACK;
} else {
nstate = IPF_TCPS_FIN_WAIT_1;
}
break;
case IPF_TCPS_CLOSING:
if ((tcpflags & (TH_FIN|TH_ACK)) == TH_ACK) {
nstate = IPF_TCPS_TIME_WAIT;
}
rval = 1;
break;
case IPF_TCPS_LAST_ACK:
if (tcpflags & TH_ACK) {
rval = 1;
}
break;
case IPF_TCPS_FIN_WAIT_2:
break;
case IPF_TCPS_TIME_WAIT:
if (ostate == IPF_TCPS_LAST_ACK) {
nstate = IPF_TCPS_CLOSED;
rval = 1;
} else {
rval = 2;
}
break;
case IPF_TCPS_CLOSED:
rval = 2;
break;
default :
#if !defined(_KERNEL)
abort();
#endif
break;
}
}
if (rval == 2)
rval = 1;
else if (rval == 1) {
if (ok)
tqe->tqe_state[dir] = nstate;
if ((tqe->tqe_flags & TQE_RULEBASED) == 0)
ipf_movequeue(softc->ipf_ticks, tqe, tqe->tqe_ifq,
tqtab + nstate);
}
return (rval);
}
void
ipf_state_log(ipf_main_softc_t *softc, struct ipstate *is, u_int type)
{
#ifdef IPFILTER_LOG
struct ipslog ipsl;
size_t sizes[1];
void *items[1];
int types[1];
ipsl.isl_type = type;
ipsl.isl_pkts[0] = is->is_pkts[0] + is->is_icmppkts[0];
ipsl.isl_bytes[0] = is->is_bytes[0];
ipsl.isl_pkts[1] = is->is_pkts[1] + is->is_icmppkts[1];
ipsl.isl_bytes[1] = is->is_bytes[1];
ipsl.isl_pkts[2] = is->is_pkts[2] + is->is_icmppkts[2];
ipsl.isl_bytes[2] = is->is_bytes[2];
ipsl.isl_pkts[3] = is->is_pkts[3] + is->is_icmppkts[3];
ipsl.isl_bytes[3] = is->is_bytes[3];
ipsl.isl_src = is->is_src;
ipsl.isl_dst = is->is_dst;
ipsl.isl_p = is->is_p;
ipsl.isl_v = is->is_v;
ipsl.isl_flags = is->is_flags;
ipsl.isl_tag = is->is_tag;
ipsl.isl_rulen = is->is_rulen;
(void) strncpy(ipsl.isl_group, is->is_group, FR_GROUPLEN);
if (ipsl.isl_p == IPPROTO_TCP || ipsl.isl_p == IPPROTO_UDP) {
ipsl.isl_sport = is->is_sport;
ipsl.isl_dport = is->is_dport;
if (ipsl.isl_p == IPPROTO_TCP) {
ipsl.isl_state[0] = is->is_state[0];
ipsl.isl_state[1] = is->is_state[1];
}
} else if (ipsl.isl_p == IPPROTO_ICMP) {
ipsl.isl_itype = is->is_icmp.ici_type;
} else if (ipsl.isl_p == IPPROTO_ICMPV6) {
ipsl.isl_itype = is->is_icmp.ici_type;
} else {
ipsl.isl_ps.isl_filler[0] = 0;
ipsl.isl_ps.isl_filler[1] = 0;
}
items[0] = &ipsl;
sizes[0] = sizeof(ipsl);
types[0] = 0;
(void) ipf_log_items(softc, IPL_LOGSTATE, NULL, items, sizes, types, 1);
#endif
}
#ifdef USE_INET6
static ipstate_t *
ipf_checkicmp6matchingstate(fr_info_t *fin)
{
ipf_main_softc_t *softc = fin->fin_main_soft;
ipf_state_softc_t *softs = softc->ipf_state_soft;
struct icmp6_hdr *ic6, *oic;
ipstate_t *is, **isp;
u_short sport, dport;
i6addr_t dst, src;
u_short savelen;
icmpinfo_t *ic;
fr_info_t ofin;
tcphdr_t *tcp;
ip6_t *oip6;
u_char pr;
u_int hv;
if ((fin->fin_v != 6) || (fin->fin_plen < ICMP6ERR_MINPKTLEN) ||
!(fin->fin_flx & FI_ICMPERR)) {
SBUMPD(ipf_state_stats, iss_icmp_bad);
return (NULL);
}
ic6 = fin->fin_dp;
oip6 = (ip6_t *)((char *)ic6 + ICMPERR_ICMPHLEN);
if (fin->fin_plen < sizeof(*oip6)) {
SBUMPD(ipf_state_stats, iss_icmp_short);
return (NULL);
}
bcopy((char *)fin, (char *)&ofin, sizeof(*fin));
ofin.fin_v = 6;
ofin.fin_ifp = fin->fin_ifp;
ofin.fin_out = !fin->fin_out;
ofin.fin_m = NULL;
ofin.fin_mp = NULL;
savelen = oip6->ip6_plen;
oip6->ip6_plen = htons(fin->fin_dlen - ICMPERR_ICMPHLEN);
ofin.fin_flx = FI_NOCKSUM;
ofin.fin_ip = (ip_t *)oip6;
(void) ipf_makefrip(sizeof(*oip6), (ip_t *)oip6, &ofin);
ofin.fin_flx &= ~(FI_BAD|FI_SHORT);
oip6->ip6_plen = savelen;
pr = ofin.fin_p;
if (ofin.fin_flx & FI_ICMPERR) {
DT1(iss_icmp6_icmperr, fr_info_t *, &ofin);
SBUMP(ipf_state_stats.iss_icmp6_icmperr);
return (NULL);
}
if (oip6->ip6_nxt == IPPROTO_ICMPV6) {
oic = ofin.fin_dp;
if (!(oic->icmp6_type & ICMP6_INFOMSG_MASK)) {
DT1(iss_icmp6_notinfo, fr_info_t *, &ofin);
SBUMP(ipf_state_stats.iss_icmp6_notinfo);
return (NULL);
}
hv = (pr = oip6->ip6_nxt);
src.in6 = oip6->ip6_src;
hv += src.in4.s_addr;
dst.in6 = oip6->ip6_dst;
hv += dst.in4.s_addr;
hv += oic->icmp6_id;
hv += oic->icmp6_seq;
hv = DOUBLE_HASH(hv);
READ_ENTER(&softc->ipf_state);
for (isp = &softs->ipf_state_table[hv];
((is = *isp) != NULL); ) {
ic = &is->is_icmp;
isp = &is->is_hnext;
if ((is->is_p == pr) &&
!(is->is_pass & FR_NOICMPERR) &&
(oic->icmp6_id == ic->ici_id) &&
(oic->icmp6_seq == ic->ici_seq) &&
(is = ipf_matchsrcdst(&ofin, is, &src,
&dst, NULL, FI_ICMPCMP))) {
if (((ic->ici_type == ICMP6_ECHO_REPLY) &&
(oic->icmp6_type == ICMP6_ECHO_REQUEST)) ||
(ic->ici_type - 1 == oic->icmp6_type )) {
if (!ipf_allowstateicmp(fin, is, &src))
return (is);
}
}
}
RWLOCK_EXIT(&softc->ipf_state);
SBUMPD(ipf_state_stats, iss_icmp6_miss);
return (NULL);
}
hv = (pr = oip6->ip6_nxt);
src.in6 = oip6->ip6_src;
hv += src.i6[0];
hv += src.i6[1];
hv += src.i6[2];
hv += src.i6[3];
dst.in6 = oip6->ip6_dst;
hv += dst.i6[0];
hv += dst.i6[1];
hv += dst.i6[2];
hv += dst.i6[3];
tcp = NULL;
switch (oip6->ip6_nxt)
{
case IPPROTO_TCP :
case IPPROTO_UDP :
tcp = (tcphdr_t *)(oip6 + 1);
dport = tcp->th_dport;
sport = tcp->th_sport;
hv += dport;
hv += sport;
break;
case IPPROTO_ICMPV6 :
oic = (struct icmp6_hdr *)(oip6 + 1);
hv += oic->icmp6_id;
hv += oic->icmp6_seq;
break;
default :
break;
}
hv = DOUBLE_HASH(hv);
READ_ENTER(&softc->ipf_state);
for (isp = &softs->ipf_state_table[hv]; ((is = *isp) != NULL); ) {
isp = &is->is_hnext;
if ((is->is_p != pr) || (is->is_v != 6) ||
(is->is_pass & FR_NOICMPERR))
continue;
is = ipf_matchsrcdst(&ofin, is, &src, &dst, tcp, FI_ICMPCMP);
if ((is != NULL) && (ipf_allowstateicmp(fin, is, &src) == 0))
return (is);
}
RWLOCK_EXIT(&softc->ipf_state);
SBUMPD(ipf_state_stats, iss_icmp_miss);
return (NULL);
}
#endif
void
ipf_sttab_init(ipf_main_softc_t *softc, ipftq_t *tqp)
{
int i;
for (i = IPF_TCP_NSTATES - 1; i >= 0; i--) {
IPFTQ_INIT(&tqp[i], 0, "ipftq tcp tab");
tqp[i].ifq_next = tqp + i + 1;
}
tqp[IPF_TCP_NSTATES - 1].ifq_next = NULL;
tqp[IPF_TCPS_CLOSED].ifq_ttl = softc->ipf_tcpclosed;
tqp[IPF_TCPS_LISTEN].ifq_ttl = softc->ipf_tcptimeout;
tqp[IPF_TCPS_SYN_SENT].ifq_ttl = softc->ipf_tcpsynsent;
tqp[IPF_TCPS_SYN_RECEIVED].ifq_ttl = softc->ipf_tcpsynrecv;
tqp[IPF_TCPS_ESTABLISHED].ifq_ttl = softc->ipf_tcpidletimeout;
tqp[IPF_TCPS_CLOSE_WAIT].ifq_ttl = softc->ipf_tcphalfclosed;
tqp[IPF_TCPS_FIN_WAIT_1].ifq_ttl = softc->ipf_tcphalfclosed;
tqp[IPF_TCPS_CLOSING].ifq_ttl = softc->ipf_tcptimeout;
tqp[IPF_TCPS_LAST_ACK].ifq_ttl = softc->ipf_tcplastack;
tqp[IPF_TCPS_FIN_WAIT_2].ifq_ttl = softc->ipf_tcpclosewait;
tqp[IPF_TCPS_TIME_WAIT].ifq_ttl = softc->ipf_tcptimewait;
tqp[IPF_TCPS_HALF_ESTAB].ifq_ttl = softc->ipf_tcptimeout;
}
void
ipf_sttab_destroy(ipftq_t *tqp)
{
int i;
for (i = IPF_TCP_NSTATES - 1; i >= 0; i--)
MUTEX_DESTROY(&tqp[i].ifq_lock);
}
void
ipf_state_deref(ipf_main_softc_t *softc, ipstate_t **isp)
{
ipstate_t *is = *isp;
is = *isp;
*isp = NULL;
MUTEX_ENTER(&is->is_lock);
if (is->is_ref > 1) {
is->is_ref--;
MUTEX_EXIT(&is->is_lock);
#ifndef _KERNEL
if ((is->is_sti.tqe_state[0] > IPF_TCPS_ESTABLISHED) ||
(is->is_sti.tqe_state[1] > IPF_TCPS_ESTABLISHED)) {
ipf_state_del(softc, is, ISL_EXPIRE);
}
#endif
return;
}
MUTEX_EXIT(&is->is_lock);
WRITE_ENTER(&softc->ipf_state);
ipf_state_del(softc, is, ISL_ORPHAN);
RWLOCK_EXIT(&softc->ipf_state);
}
void
ipf_state_setqueue(ipf_main_softc_t *softc, ipstate_t *is, int rev)
{
ipf_state_softc_t *softs = softc->ipf_state_soft;
ipftq_t *oifq, *nifq;
if ((is->is_sti.tqe_flags & TQE_RULEBASED) != 0)
nifq = is->is_tqehead[rev];
else
nifq = NULL;
if (nifq == NULL) {
switch (is->is_p)
{
#ifdef USE_INET6
case IPPROTO_ICMPV6 :
if (rev == 1)
nifq = &softs->ipf_state_icmpacktq;
else
nifq = &softs->ipf_state_icmptq;
break;
#endif
case IPPROTO_ICMP :
if (rev == 1)
nifq = &softs->ipf_state_icmpacktq;
else
nifq = &softs->ipf_state_icmptq;
break;
case IPPROTO_TCP :
nifq = softs->ipf_state_tcptq + is->is_state[rev];
break;
case IPPROTO_UDP :
if (rev == 1)
nifq = &softs->ipf_state_udpacktq;
else
nifq = &softs->ipf_state_udptq;
break;
default :
nifq = &softs->ipf_state_iptq;
break;
}
}
oifq = is->is_sti.tqe_ifq;
if (oifq != NULL)
ipf_movequeue(softc->ipf_ticks, &is->is_sti, oifq, nifq);
else
ipf_queueappend(softc->ipf_ticks, &is->is_sti, nifq, is);
return;
}
static int
ipf_state_iter(ipf_main_softc_t *softc, ipftoken_t *token, ipfgeniter_t *itp,
ipfobj_t *obj)
{
ipf_state_softc_t *softs = softc->ipf_state_soft;
ipstate_t *is, *next, zero;
int error;
if (itp->igi_data == NULL) {
IPFERROR(100026);
return (EFAULT);
}
if (itp->igi_nitems < 1) {
IPFERROR(100027);
return (ENOSPC);
}
if (itp->igi_type != IPFGENITER_STATE) {
IPFERROR(100028);
return (EINVAL);
}
is = token->ipt_data;
if (is == (void *)-1) {
IPFERROR(100029);
return (ESRCH);
}
error = 0;
obj->ipfo_type = IPFOBJ_IPSTATE;
obj->ipfo_size = sizeof(ipstate_t);
READ_ENTER(&softc->ipf_state);
is = token->ipt_data;
if (is == NULL) {
next = softs->ipf_state_list;
} else {
next = is->is_next;
}
if (next != NULL) {
MUTEX_ENTER(&next->is_lock);
next->is_ref++;
MUTEX_EXIT(&next->is_lock);
token->ipt_data = next;
} else {
bzero(&zero, sizeof(zero));
next = &zero;
token->ipt_data = NULL;
}
if (next->is_next == NULL)
ipf_token_mark_complete(token);
RWLOCK_EXIT(&softc->ipf_state);
obj->ipfo_ptr = itp->igi_data;
error = ipf_outobjk(softc, obj, next);
if (is != NULL)
ipf_state_deref(softc, &is);
return (error);
}
static int
ipf_state_gettable(ipf_main_softc_t *softc, ipf_state_softc_t *softs,
char *data)
{
ipftable_t table;
int error;
error = ipf_inobj(softc, data, NULL, &table, IPFOBJ_GTABLE);
if (error != 0)
return (error);
if (table.ita_type != IPFTABLE_BUCKETS) {
IPFERROR(100031);
return (EINVAL);
}
error = COPYOUT(softs->ipf_state_stats.iss_bucketlen, table.ita_table,
softs->ipf_state_size * sizeof(u_int));
if (error != 0) {
IPFERROR(100032);
error = EFAULT;
}
return (error);
}
void
ipf_state_setpending(ipf_main_softc_t *softc, ipstate_t *is)
{
ipf_state_softc_t *softs = softc->ipf_state_soft;
ipftq_t *oifq;
oifq = is->is_sti.tqe_ifq;
if (oifq != NULL)
ipf_movequeue(softc->ipf_ticks, &is->is_sti, oifq,
&softs->ipf_state_pending);
else
ipf_queueappend(softc->ipf_ticks, &is->is_sti,
&softs->ipf_state_pending, is);
MUTEX_ENTER(&is->is_lock);
if (is->is_me != NULL) {
*is->is_me = NULL;
is->is_me = NULL;
is->is_ref--;
}
MUTEX_EXIT(&is->is_lock);
}
int
ipf_state_matchflush(ipf_main_softc_t *softc, caddr_t data)
{
ipf_state_softc_t *softs = softc->ipf_state_soft;
int *array, flushed, error;
ipstate_t *state, *statenext;
ipfobj_t obj;
error = ipf_matcharray_load(softc, data, &obj, &array);
if (error != 0)
return (error);
flushed = 0;
for (state = softs->ipf_state_list; state != NULL; state = statenext) {
statenext = state->is_next;
if (ipf_state_matcharray(state, array, softc->ipf_ticks) == 0) {
ipf_state_del(softc, state, ISL_FLUSH);
flushed++;
}
}
obj.ipfo_retval = flushed;
error = BCOPYOUT(&obj, data, sizeof(obj));
KFREES(array, array[0] * sizeof(*array));
return (error);
}
static int
ipf_state_matcharray(ipstate_t *state, int *array, u_long ticks)
{
u_int i, n, *x, rv, p;
ipfexp_t *e;
rv = 0;
n = array[0];
x = array + 1;
for (; n > 0; x += 3 + x[3], rv = 0) {
e = (ipfexp_t *)x;
n -= e->ipfe_size;
if (x[0] == IPF_EXP_END)
break;
p = e->ipfe_cmd >> 16;
if ((p != 0) && (p != state->is_p))
break;
switch (e->ipfe_cmd)
{
case IPF_EXP_IP_PR :
for (i = 0; !rv && i < e->ipfe_narg; i++) {
rv |= (state->is_p == e->ipfe_arg0[i]);
}
break;
case IPF_EXP_IP_SRCADDR :
if (state->is_v != 4)
break;
for (i = 0; !rv && i < e->ipfe_narg; i++) {
rv |= ((state->is_saddr &
e->ipfe_arg0[i * 2 + 1]) ==
e->ipfe_arg0[i * 2]);
}
break;
case IPF_EXP_IP_DSTADDR :
if (state->is_v != 4)
break;
for (i = 0; !rv && i < e->ipfe_narg; i++) {
rv |= ((state->is_daddr &
e->ipfe_arg0[i * 2 + 1]) ==
e->ipfe_arg0[i * 2]);
}
break;
case IPF_EXP_IP_ADDR :
if (state->is_v != 4)
break;
for (i = 0; !rv && i < e->ipfe_narg; i++) {
rv |= ((state->is_saddr &
e->ipfe_arg0[i * 2 + 1]) ==
e->ipfe_arg0[i * 2]) ||
((state->is_daddr &
e->ipfe_arg0[i * 2 + 1]) ==
e->ipfe_arg0[i * 2]);
}
break;
#ifdef USE_INET6
case IPF_EXP_IP6_SRCADDR :
if (state->is_v != 6)
break;
for (i = 0; !rv && i < x[3]; i++) {
rv |= IP6_MASKEQ(&state->is_src.in6,
&e->ipfe_arg0[i * 8 + 4],
&e->ipfe_arg0[i * 8]);
}
break;
case IPF_EXP_IP6_DSTADDR :
if (state->is_v != 6)
break;
for (i = 0; !rv && i < x[3]; i++) {
rv |= IP6_MASKEQ(&state->is_dst.in6,
&e->ipfe_arg0[i * 8 + 4],
&e->ipfe_arg0[i * 8]);
}
break;
case IPF_EXP_IP6_ADDR :
if (state->is_v != 6)
break;
for (i = 0; !rv && i < x[3]; i++) {
rv |= IP6_MASKEQ(&state->is_src.in6,
&e->ipfe_arg0[i * 8 + 4],
&e->ipfe_arg0[i * 8]) ||
IP6_MASKEQ(&state->is_dst.in6,
&e->ipfe_arg0[i * 8 + 4],
&e->ipfe_arg0[i * 8]);
}
break;
#endif
case IPF_EXP_UDP_PORT :
case IPF_EXP_TCP_PORT :
for (i = 0; !rv && i < e->ipfe_narg; i++) {
rv |= (state->is_sport == e->ipfe_arg0[i]) ||
(state->is_dport == e->ipfe_arg0[i]);
}
break;
case IPF_EXP_UDP_SPORT :
case IPF_EXP_TCP_SPORT :
for (i = 0; !rv && i < e->ipfe_narg; i++) {
rv |= (state->is_sport == e->ipfe_arg0[i]);
}
break;
case IPF_EXP_UDP_DPORT :
case IPF_EXP_TCP_DPORT :
for (i = 0; !rv && i < e->ipfe_narg; i++) {
rv |= (state->is_dport == e->ipfe_arg0[i]);
}
break;
case IPF_EXP_TCP_STATE :
for (i = 0; !rv && i < e->ipfe_narg; i++) {
rv |= (state->is_state[0] == e->ipfe_arg0[i]) ||
(state->is_state[1] == e->ipfe_arg0[i]);
}
break;
case IPF_EXP_IDLE_GT :
rv |= (ticks - state->is_touched > e->ipfe_arg0[0]);
break;
}
rv ^= e->ipfe_not;
if (rv == 0)
break;
}
return (rv);
}
int
ipf_state_settimeout(struct ipf_main_softc_s *softc, ipftuneable_t *t,
ipftuneval_t *p)
{
ipf_state_softc_t *softs = softc->ipf_state_soft;
if (*t->ipft_pint == p->ipftu_int)
return (0);
if (!strncmp(t->ipft_name, "tcp_", 4))
return (ipf_settimeout_tcp(t, p, softs->ipf_state_tcptq));
if (!strcmp(t->ipft_name, "udp_timeout")) {
ipf_apply_timeout(&softs->ipf_state_udptq, p->ipftu_int);
} else if (!strcmp(t->ipft_name, "udp_ack_timeout")) {
ipf_apply_timeout(&softs->ipf_state_udpacktq, p->ipftu_int);
} else if (!strcmp(t->ipft_name, "icmp_timeout")) {
ipf_apply_timeout(&softs->ipf_state_icmptq, p->ipftu_int);
} else if (!strcmp(t->ipft_name, "icmp_ack_timeout")) {
ipf_apply_timeout(&softs->ipf_state_icmpacktq, p->ipftu_int);
} else if (!strcmp(t->ipft_name, "ip_timeout")) {
ipf_apply_timeout(&softs->ipf_state_iptq, p->ipftu_int);
} else {
IPFERROR(100034);
return (ESRCH);
}
*t->ipft_pint = p->ipftu_int;
return (0);
}
int
ipf_state_rehash(ipf_main_softc_t *softc, ipftuneable_t *t, ipftuneval_t *p)
{
ipf_state_softc_t *softs = softc->ipf_state_soft;
ipstate_t **newtab, *is;
u_long *newseed;
u_int *bucketlens;
u_int maxbucket;
u_int newsize;
u_int hv;
int i;
newsize = p->ipftu_int;
if (newsize == softs->ipf_state_size)
return (0);
KMALLOCS(newtab, ipstate_t **, newsize * sizeof(ipstate_t *));
if (newtab == NULL) {
IPFERROR(100035);
return (ENOMEM);
}
KMALLOCS(bucketlens, u_int *, newsize * sizeof(u_int));
if (bucketlens == NULL) {
KFREES(newtab, newsize * sizeof(*softs->ipf_state_table));
IPFERROR(100036);
return (ENOMEM);
}
newseed = ipf_state_seed_alloc(newsize, softs->ipf_state_max);
if (newseed == NULL) {
KFREES(bucketlens, newsize * sizeof(*bucketlens));
KFREES(newtab, newsize * sizeof(*newtab));
IPFERROR(100037);
return (ENOMEM);
}
for (maxbucket = 0, i = newsize; i > 0; i >>= 1)
maxbucket++;
maxbucket *= 2;
bzero((char *)newtab, newsize * sizeof(ipstate_t *));
bzero((char *)bucketlens, newsize * sizeof(u_int));
WRITE_ENTER(&softc->ipf_state);
if (softs->ipf_state_table != NULL) {
KFREES(softs->ipf_state_table,
softs->ipf_state_size * sizeof(*softs->ipf_state_table));
}
softs->ipf_state_table = newtab;
if (softs->ipf_state_seed != NULL) {
KFREES(softs->ipf_state_seed,
softs->ipf_state_size * sizeof(*softs->ipf_state_seed));
}
softs->ipf_state_seed = newseed;
if (softs->ipf_state_stats.iss_bucketlen != NULL) {
KFREES(softs->ipf_state_stats.iss_bucketlen,
softs->ipf_state_size * sizeof(u_int));
}
softs->ipf_state_stats.iss_bucketlen = bucketlens;
softs->ipf_state_maxbucket = maxbucket;
softs->ipf_state_size = newsize;
softs->ipf_state_stats.iss_inuse = 0;
for (is = softs->ipf_state_list; is != NULL; is = is->is_next) {
is->is_hnext = NULL;
is->is_phnext = NULL;
hv = is->is_hv % softs->ipf_state_size;
if (softs->ipf_state_table[hv] != NULL)
softs->ipf_state_table[hv]->is_phnext = &is->is_hnext;
else
softs->ipf_state_stats.iss_inuse++;
is->is_phnext = softs->ipf_state_table + hv;
is->is_hnext = softs->ipf_state_table[hv];
softs->ipf_state_table[hv] = is;
softs->ipf_state_stats.iss_bucketlen[hv]++;
}
RWLOCK_EXIT(&softc->ipf_state);
return (0);
}
ipftq_t *
ipf_state_add_tq(ipf_main_softc_t *softc, int ttl)
{
ipf_state_softc_t *softs = softc->ipf_state_soft;
return (ipf_addtimeoutqueue(softc, &softs->ipf_state_usertq, ttl));
}
#ifndef _KERNEL
void
ipf_state_dump(ipf_main_softc_t *softc, void *arg)
{
ipf_state_softc_t *softs = arg;
ipstate_t *ips;
printf("List of active state sessions:\n");
for (ips = softs->ipf_state_list; ips != NULL; )
ips = printstate(ips, opts & (OPT_DEBUG|OPT_VERBOSE),
softc->ipf_ticks);
}
#endif
