summaryrefslogtreecommitdiff
path: root/sys/net
diff options
context:
space:
mode:
Diffstat (limited to 'sys/net')
-rw-r--r--sys/net/pf.c532
1 files changed, 254 insertions, 278 deletions
diff --git a/sys/net/pf.c b/sys/net/pf.c
index 1475cb6733c..fc7b9c230c1 100644
--- a/sys/net/pf.c
+++ b/sys/net/pf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pf.c,v 1.101 2001/07/06 21:19:55 chris Exp $ */
+/* $OpenBSD: pf.c,v 1.102 2001/07/06 22:09:00 dhartmei Exp $ */
/*
* Copyright (c) 2001, Daniel Hartmeier
@@ -187,12 +187,15 @@ int pf_test_icmp(int, struct ifnet *, struct mbuf *,
int, int, struct ip *, struct icmp *);
int pf_test_other(int, struct ifnet *, struct mbuf *,
struct ip *);
-struct pf_state *pf_test_state_tcp(int, struct ifnet *, struct mbuf *,
- int, int, struct ip *, struct tcphdr *);
-struct pf_state *pf_test_state_udp(int, struct ifnet *, struct mbuf *,
- int, int, struct ip *, struct udphdr *);
-struct pf_state *pf_test_state_icmp(int, struct ifnet *, struct mbuf *,
- int, int, struct ip *, struct icmp *);
+int pf_test_state_tcp(struct pf_state **, int,
+ struct ifnet *, struct mbuf *, int, int,
+ struct ip *, struct tcphdr *);
+int pf_test_state_udp(struct pf_state **, int,
+ struct ifnet *, struct mbuf *, int, int,
+ struct ip *, struct udphdr *);
+int pf_test_state_icmp(struct pf_state **, int,
+ struct ifnet *, struct mbuf *, int, int,
+ struct ip *, struct icmp *);
void *pf_pull_hdr(struct ifnet *, struct mbuf *, int, int,
void *, int, struct ip *, u_short *, u_short *);
int pflog_packet(struct mbuf *, int, u_short, u_short,
@@ -1563,6 +1566,7 @@ pf_test_tcp(int direction, struct ifnet *ifp, struct mbuf *m,
/* copy back packet headers if we performed NAT operations */
if (rewrite)
m_copyback(m, off, sizeof(*th), (caddr_t)th);
+
return (PF_PASS);
}
@@ -1720,7 +1724,6 @@ pf_test_icmp(int direction, struct ifnet *ifp, struct mbuf *m,
u_int32_t baddr;
struct pf_rule *r, *rm = NULL;
u_short reason;
- int rewrite = 0;
if (direction == PF_OUT) {
/* check outgoing packet for NAT */
@@ -1728,7 +1731,6 @@ pf_test_icmp(int direction, struct ifnet *ifp, struct mbuf *m,
NULL) {
baddr = h->ip_src.s_addr;
pf_change_a(&h->ip_src.s_addr, &h->ip_sum, nat->daddr);
- rewrite++;
}
}
@@ -1832,13 +1834,18 @@ pf_test_other(int direction, struct ifnet *ifp, struct mbuf *m, struct ip *h)
return (PF_PASS);
}
-struct pf_state *
-pf_test_state_tcp(int direction, struct ifnet *ifp, struct mbuf *m,
- int ipoff, int off, struct ip *h, struct tcphdr *th)
+int
+pf_test_state_tcp(struct pf_state **state, int direction, struct ifnet *ifp,
+ struct mbuf *m, int ipoff, int off, struct ip *h, struct tcphdr *th)
{
- struct pf_state *s;
struct pf_tree_key key;
- int rewrite = 0;
+ u_int16_t len = h->ip_len - off - (th->th_off << 2);
+ u_int16_t win = ntohs(th->th_win);
+ u_int32_t seq = ntohl(th->th_seq), ack = ntohl(th->th_ack);
+ u_int32_t end = seq + len + ((th->th_flags & TH_SYN) ? 1 : 0) +
+ ((th->th_flags & TH_FIN) ? 1 : 0);
+ int ackskew;
+ struct pf_state_peer *src, *dst;
key.proto = IPPROTO_TCP;
key.addr[0] = h->ip_src;
@@ -1846,157 +1853,146 @@ pf_test_state_tcp(int direction, struct ifnet *ifp, struct mbuf *m,
key.addr[1] = h->ip_dst;
key.port[1] = th->th_dport;
- s = pf_find_state((direction == PF_IN) ? tree_ext_gwy : tree_lan_ext,
- &key);
- if (s != NULL) {
- u_int16_t len = h->ip_len - off - (th->th_off << 2);
- u_int16_t win = ntohs(th->th_win);
- u_int32_t seq = ntohl(th->th_seq), ack = ntohl(th->th_ack);
- u_int32_t end = seq + len + ((th->th_flags & TH_SYN) ? 1 : 0) +
- ((th->th_flags & TH_FIN) ? 1 : 0);
- int ackskew;
- struct pf_state_peer *src, *dst;
+ *state = pf_find_state((direction == PF_IN) ? tree_ext_gwy :
+ tree_lan_ext, &key);
+ if (*state == NULL)
+ return (PF_DROP);
- if (direction == s->direction) {
- src = &s->src;
- dst = &s->dst;
- } else {
- src = &s->dst;
- dst = &s->src;
- }
+ if (direction == (*state)->direction) {
+ src = &(*state)->src;
+ dst = &(*state)->dst;
+ } else {
+ src = &(*state)->dst;
+ dst = &(*state)->src;
+ }
- if (src->seqlo == 0) {
- /* First packet from this end. Set its state */
- src->seqlo = end;
- src->seqhi = end + 1;
- src->max_win = 1;
- }
+ if (src->seqlo == 0) {
+ /* First packet from this end. Set its state */
+ src->seqlo = end;
+ src->seqhi = end + 1;
+ src->max_win = 1;
+ }
- if ((th->th_flags & TH_ACK) == 0) {
- /* Let it pass through the ack skew check */
- ack = dst->seqlo;
- } else if (ack == 0 &&
- (th->th_flags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) {
- /* broken tcp stacks do not set ack */
- ack = dst->seqlo;
- }
+ if ((th->th_flags & TH_ACK) == 0) {
+ /* Let it pass through the ack skew check */
+ ack = dst->seqlo;
+ } else if (ack == 0 &&
+ (th->th_flags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) {
+ /* broken tcp stacks do not set ack */
+ ack = dst->seqlo;
+ }
- if (seq == end) {
- /* Ease sequencing restrictions on no data packets */
- seq = src->seqlo;
- end = seq;
- }
+ if (seq == end) {
+ /* Ease sequencing restrictions on no data packets */
+ seq = src->seqlo;
+ end = seq;
+ }
- ackskew = dst->seqlo - ack;
+ ackskew = dst->seqlo - ack;
#define MAXACKWINDOW (0xffff + 1500)
- if (SEQ_GEQ(src->seqhi, end) &&
- /* Last octet inside other's window space */
- SEQ_GEQ(seq, src->seqlo - dst->max_win) &&
- /* Retrans: not more than one window back */
- (ackskew >= -MAXACKWINDOW) &&
- /* Acking not more than one window back */
- (ackskew <= MAXACKWINDOW)) {
- /* Acking not more than one window forward */
-
- if (ackskew < 0) {
- /* The sequencing algorithm is exteremely lossy
- * when there is fragmentation since the full
- * packet length can not be determined. So we
- * deduce how much data passed by what the
- * other endpoint ACKs. Thanks Guido!
- * (Why MAXACKWINDOW is used)
- */
- dst->seqlo = ack;
- }
+ if (SEQ_GEQ(src->seqhi, end) &&
+ /* Last octet inside other's window space */
+ SEQ_GEQ(seq, src->seqlo - dst->max_win) &&
+ /* Retrans: not more than one window back */
+ (ackskew >= -MAXACKWINDOW) &&
+ /* Acking not more than one window back */
+ (ackskew <= MAXACKWINDOW)) {
+ /* Acking not more than one window forward */
+
+ if (ackskew < 0) {
+ /* The sequencing algorithm is exteremely lossy
+ * when there is fragmentation since the full
+ * packet length can not be determined. So we
+ * deduce how much data passed by what the
+ * other endpoint ACKs. Thanks Guido!
+ * (Why MAXACKWINDOW is used)
+ */
+ dst->seqlo = ack;
+ }
- s->packets++;
- s->bytes += len;
-
- /* update max window */
- if (src->max_win < win)
- src->max_win = win;
- /* syncronize sequencing */
- if (SEQ_GT(end, src->seqlo))
- src->seqlo = end;
- /* slide the window of what the other end can send */
- if (SEQ_GEQ(ack + win, dst->seqhi))
- dst->seqhi = ack + MAX(win, 1);
-
-
- /* update states */
- if (th->th_flags & TH_SYN)
- if (src->state < 1)
- src->state = 1;
- if (th->th_flags & TH_FIN)
- if (src->state < 3)
- src->state = 3;
- if (th->th_flags & TH_ACK) {
- if (dst->state == 1)
- dst->state = 2;
- else if (dst->state == 3)
- dst->state = 4;
- }
- if (th->th_flags & TH_RST)
- src->state = dst->state = 5;
-
- /* update expire time */
- if (src->state >= 4 && dst->state >= 4)
- s->expire = pftv.tv_sec + 5;
- else if (src->state >= 3 || dst->state >= 3)
- s->expire = pftv.tv_sec + 300;
- else if (src->state < 2 || dst->state < 2)
- s->expire = pftv.tv_sec + 30;
- else
- s->expire = pftv.tv_sec + 24*60*60;
-
- /* translate source/destination address, if needed */
- if (s->lan.addr != s->gwy.addr ||
- s->lan.port != s->gwy.port) {
- if (direction == PF_OUT)
- pf_change_ap(&h->ip_src.s_addr,
- &th->th_sport, &h->ip_sum,
- &th->th_sum, s->gwy.addr,
- s->gwy.port);
- else
- pf_change_ap(&h->ip_dst.s_addr,
- &th->th_dport, &h->ip_sum,
- &th->th_sum, s->lan.addr,
- s->lan.port);
- rewrite++;
- }
+ (*state)->packets++;
+ (*state)->bytes += len;
- } else {
- /* XXX Remove these printfs before release */
- printf("pf: BAD state: ");
- pf_print_state(direction, s);
- pf_print_flags(th->th_flags);
- printf(" seq=%lu ack=%lu len=%u ", seq, ack, len);
- printf("\n");
- printf("State failure: %c %c %c %c\n",
- SEQ_GEQ(src->seqhi, end) ? ' ' : '1',
- SEQ_GEQ(seq, src->seqlo - dst->max_win) ? ' ': '2',
- (ackskew >= -MAXACKWINDOW) ? ' ' : '3',
- (ackskew <= MAXACKWINDOW) ? ' ' : '4');
- s = NULL;
- }
-
- /* copy back packet headers if we performed NAT operations */
- if (rewrite)
+ /* update max window */
+ if (src->max_win < win)
+ src->max_win = win;
+ /* syncronize sequencing */
+ if (SEQ_GT(end, src->seqlo))
+ src->seqlo = end;
+ /* slide the window of what the other end can send */
+ if (SEQ_GEQ(ack + win, dst->seqhi))
+ dst->seqhi = ack + MAX(win, 1);
+
+
+ /* update states */
+ if (th->th_flags & TH_SYN)
+ if (src->state < 1)
+ src->state = 1;
+ if (th->th_flags & TH_FIN)
+ if (src->state < 3)
+ src->state = 3;
+ if (th->th_flags & TH_ACK) {
+ if (dst->state == 1)
+ dst->state = 2;
+ else if (dst->state == 3)
+ dst->state = 4;
+ }
+ if (th->th_flags & TH_RST)
+ src->state = dst->state = 5;
+
+ /* update expire time */
+ if (src->state >= 4 && dst->state >= 4)
+ (*state)->expire = pftv.tv_sec + 5;
+ else if (src->state >= 3 && dst->state >= 3)
+ (*state)->expire = pftv.tv_sec + 300;
+ else if (src->state < 2 || dst->state < 2)
+ (*state)->expire = pftv.tv_sec + 30;
+ else
+ (*state)->expire = pftv.tv_sec + 24*60*60;
+
+ /* translate source/destination address, if needed */
+ if ((*state)->lan.addr != (*state)->gwy.addr ||
+ (*state)->lan.port != (*state)->gwy.port) {
+ if (direction == PF_OUT)
+ pf_change_ap(&h->ip_src.s_addr,
+ &th->th_sport, &h->ip_sum,
+ &th->th_sum, (*state)->gwy.addr,
+ (*state)->gwy.port);
+ else
+ pf_change_ap(&h->ip_dst.s_addr,
+ &th->th_dport, &h->ip_sum,
+ &th->th_sum, (*state)->lan.addr,
+ (*state)->lan.port);
m_copyback(m, off, sizeof(*th), (caddr_t)th);
+ }
+
+ return (PF_PASS);
- return (s);
+ } else {
+ /* XXX Remove these printfs before release */
+ printf("pf: BAD state: ");
+ pf_print_state(direction, *state);
+ pf_print_flags(th->th_flags);
+ printf(" seq=%lu ack=%lu len=%u ", seq, ack, len);
+ printf("\n");
+ printf("State failure: %c %c %c %c\n",
+ SEQ_GEQ(src->seqhi, end) ? ' ' : '1',
+ SEQ_GEQ(seq, src->seqlo - dst->max_win) ? ' ': '2',
+ (ackskew >= -MAXACKWINDOW) ? ' ' : '3',
+ (ackskew <= MAXACKWINDOW) ? ' ' : '4');
+
+ return (PF_DROP);
}
- return (NULL);
}
-struct pf_state *
-pf_test_state_udp(int direction, struct ifnet *ifp, struct mbuf *m,
- int ipoff, int off, struct ip *h, struct udphdr *uh)
+int
+pf_test_state_udp(struct pf_state **state, int direction, struct ifnet *ifp,
+ struct mbuf *m, int ipoff, int off, struct ip *h, struct udphdr *uh)
{
- struct pf_state *s;
+ u_int16_t len = h->ip_len - off - sizeof(*uh);
+ struct pf_state_peer *src, *dst;
struct pf_tree_key key;
- int rewrite = 0;
key.proto = IPPROTO_UDP;
key.addr[0] = h->ip_src;
@@ -2004,64 +2000,56 @@ pf_test_state_udp(int direction, struct ifnet *ifp, struct mbuf *m,
key.addr[1] = h->ip_dst;
key.port[1] = uh->uh_dport;
- s = pf_find_state((direction == PF_IN) ? tree_ext_gwy : tree_lan_ext,
- &key);
- if (s != NULL) {
- u_int16_t len = h->ip_len - off - sizeof(*uh);
-
- struct pf_state_peer *src, *dst;
- if (direction == s->direction) {
- src = &s->src;
- dst = &s->dst;
- } else {
- src = &s->dst;
- dst = &s->src;
- }
-
- s->packets++;
- s->bytes += len;
+ (*state) = pf_find_state((direction == PF_IN) ? tree_ext_gwy :
+ tree_lan_ext, &key);
+ if (*state == NULL)
+ return (PF_DROP);
- /* update states */
- if (src->state < 1)
- src->state = 1;
- if (dst->state == 1)
- dst->state = 2;
+ if (direction == (*state)->direction) {
+ src = &(*state)->src;
+ dst = &(*state)->dst;
+ } else {
+ src = &(*state)->dst;
+ dst = &(*state)->src;
+ }
- /* update expire time */
- if (src->state == 2 && dst->state == 2)
- s->expire = pftv.tv_sec + 60;
- else
- s->expire = pftv.tv_sec + 20;
+ (*state)->packets++;
+ (*state)->bytes += len;
- /* translate source/destination address, if necessary */
- if (s->lan.addr != s->gwy.addr ||
- s->lan.port != s->gwy.port) {
- if (direction == PF_OUT)
- pf_change_ap(&h->ip_src.s_addr, &uh->uh_sport,
- &h->ip_sum, &uh->uh_sum,
- s->gwy.addr, s->gwy.port);
- else
- pf_change_ap(&h->ip_dst.s_addr, &uh->uh_dport,
- &h->ip_sum, &uh->uh_sum,
- s->lan.addr, s->lan.port);
- rewrite++;
- }
+ /* update states */
+ if (src->state < 1)
+ src->state = 1;
+ if (dst->state == 1)
+ dst->state = 2;
- /* copy back packet headers if we performed NAT operations */
- if (rewrite)
- m_copyback(m, off, sizeof(*uh), (caddr_t)uh);
+ /* update expire time */
+ if (src->state == 2 && dst->state == 2)
+ (*state)->expire = pftv.tv_sec + 60;
+ else
+ (*state)->expire = pftv.tv_sec + 20;
- return (s);
+ /* translate source/destination address, if necessary */
+ if ((*state)->lan.addr != (*state)->gwy.addr ||
+ (*state)->lan.port != (*state)->gwy.port) {
+ if (direction == PF_OUT)
+ pf_change_ap(&h->ip_src.s_addr, &uh->uh_sport,
+ &h->ip_sum, &uh->uh_sum,
+ (*state)->gwy.addr, (*state)->gwy.port);
+ else
+ pf_change_ap(&h->ip_dst.s_addr, &uh->uh_dport,
+ &h->ip_sum, &uh->uh_sum,
+ (*state)->lan.addr, (*state)->lan.port);
+ m_copyback(m, off, sizeof(*uh), (caddr_t)uh);
}
- return (NULL);
+
+ return (PF_PASS);
}
-struct pf_state *
-pf_test_state_icmp(int direction, struct ifnet *ifp, struct mbuf *m,
- int ipoff, int off, struct ip *h, struct icmp *ih)
+int
+pf_test_state_icmp(struct pf_state **state, int direction, struct ifnet *ifp,
+ struct mbuf *m, int ipoff, int off, struct ip *h, struct icmp *ih)
{
u_int16_t len = h->ip_len - off - sizeof(*ih);
- int rewrite = 0;
if (ih->icmp_type != ICMP_UNREACH &&
ih->icmp_type != ICMP_SOURCEQUENCH &&
@@ -2073,7 +2061,6 @@ pf_test_state_icmp(int direction, struct ifnet *ifp, struct mbuf *m,
* ICMP query/reply message not related to a TCP/UDP packet.
* Search for an ICMP state.
*/
- struct pf_state *s;
struct pf_tree_key key;
key.proto = IPPROTO_ICMP;
@@ -2082,26 +2069,26 @@ pf_test_state_icmp(int direction, struct ifnet *ifp, struct mbuf *m,
key.addr[1] = h->ip_dst;
key.port[1] = ih->icmp_id;
- s = pf_find_state((direction == PF_IN) ? tree_ext_gwy :
+ *state = pf_find_state((direction == PF_IN) ? tree_ext_gwy :
tree_lan_ext, &key);
- if (s != NULL) {
- s->packets++;
- s->bytes += len;
- s->expire = pftv.tv_sec + 10;
-
- /* translate source/destination address, if needed */
- if (s->lan.addr != s->gwy.addr) {
- if (direction == PF_OUT)
- pf_change_a(&h->ip_src.s_addr,
- &h->ip_sum, s->gwy.addr);
- else
- pf_change_a(&h->ip_dst.s_addr,
- &h->ip_sum, s->lan.addr);
- }
+ if (*state == NULL)
+ return (PF_DROP);
+
+ (*state)->packets++;
+ (*state)->bytes += len;
+ (*state)->expire = pftv.tv_sec + 10;
- return (s);
+ /* translate source/destination address, if needed */
+ if ((*state)->lan.addr != (*state)->gwy.addr) {
+ if (direction == PF_OUT)
+ pf_change_a(&h->ip_src.s_addr,
+ &h->ip_sum, (*state)->gwy.addr);
+ else
+ pf_change_a(&h->ip_dst.s_addr,
+ &h->ip_sum, (*state)->lan.addr);
}
- return (NULL);
+
+ return (PF_PASS);
} else {
@@ -2118,7 +2105,7 @@ pf_test_state_icmp(int direction, struct ifnet *ifp, struct mbuf *m,
if (!pf_pull_hdr(ifp, m, 0, ipoff2, &h2, sizeof(h2), h,
NULL, NULL)) {
printf("pf: ICMP error message too short (ip)\n");
- return (NULL);
+ return (PF_DROP);
}
/* offset of protocol header that follows h2 */
@@ -2128,7 +2115,6 @@ pf_test_state_icmp(int direction, struct ifnet *ifp, struct mbuf *m,
case IPPROTO_TCP: {
struct tcphdr th;
u_int32_t seq;
- struct pf_state *s;
struct pf_tree_key key;
struct pf_state_peer *src, *dst;
@@ -2141,7 +2127,7 @@ pf_test_state_icmp(int direction, struct ifnet *ifp, struct mbuf *m,
&h2, NULL, NULL)) {
printf("pf: "
"ICMP error message too short (tcp)\n");
- return (NULL);
+ return (PF_DROP);
}
seq = ntohl(th.th_seq);
@@ -2151,64 +2137,60 @@ pf_test_state_icmp(int direction, struct ifnet *ifp, struct mbuf *m,
key.addr[1] = h2.ip_src;
key.port[1] = th.th_sport;
- s = pf_find_state((direction == PF_IN) ? tree_ext_gwy :
- tree_lan_ext, &key);
- if (s == NULL)
- return (NULL);
+ *state = pf_find_state((direction == PF_IN) ?
+ tree_ext_gwy : tree_lan_ext, &key);
+ if (*state == NULL)
+ return (PF_DROP);
- src = (direction == s->direction) ? &s->dst : &s->src;
- dst = (direction == s->direction) ? &s->src : &s->dst;
+ src = (direction == (*state)->direction) ?
+ &(*state)->dst : &(*state)->src;
+ dst = (direction == (*state)->direction) ?
+ &(*state)->src : &(*state)->dst;
if (!SEQ_GEQ(src->seqhi, seq) ||
!SEQ_GEQ(seq, src->seqlo - dst->max_win)) {
printf("pf: BAD ICMP state: ");
- pf_print_state(direction, s);
+ pf_print_state(direction, *state);
printf(" seq=%lu\n", seq);
- return (NULL);
+ return (PF_DROP);
}
- if (s->lan.addr != s->gwy.addr ||
- s->lan.port != s->gwy.port) {
+ if ((*state)->lan.addr != (*state)->gwy.addr ||
+ (*state)->lan.port != (*state)->gwy.port) {
if (direction == PF_IN) {
pf_change_icmp(&h2.ip_src.s_addr,
&th.th_sport, &h->ip_dst.s_addr,
- s->lan.addr, s->lan.port,
- NULL, &h2.ip_sum,
- &ih->icmp_cksum, &h->ip_sum);
+ (*state)->lan.addr,
+ (*state)->lan.port, NULL,
+ &h2.ip_sum, &ih->icmp_cksum,
+ &h->ip_sum);
} else {
pf_change_icmp(&h2.ip_dst.s_addr,
&th.th_dport, &h->ip_src.s_addr,
- s->gwy.addr, s->gwy.port,
- NULL, &h2.ip_sum,
- &ih->icmp_cksum, &h->ip_sum);
+ (*state)->gwy.addr,
+ (*state)->gwy.port, NULL,
+ &h2.ip_sum, &ih->icmp_cksum,
+ &h->ip_sum);
}
- rewrite++;
- }
-
- /*
- * copy back packet headers if we performed NAT
- * operations
- */
- if (rewrite) {
+ m_copyback(m, off, ICMP_MINLEN, (caddr_t)ih);
m_copyback(m, ipoff2, sizeof(h2),
(caddr_t)&h2);
m_copyback(m, off2, 8,
(caddr_t)&th);
}
- return (s);
+ return (PF_PASS);
break;
}
case IPPROTO_UDP: {
struct udphdr uh;
- struct pf_state *s;
struct pf_tree_key key;
if (!pf_pull_hdr(ifp, m, ipoff2, off2, &uh, sizeof(uh),
&h2, NULL, NULL)) {
printf("pf: ICMP error message too short (udp)\n");
- return (NULL);
+ return (PF_DROP);
}
key.proto = IPPROTO_UDP;
@@ -2217,48 +2199,42 @@ pf_test_state_icmp(int direction, struct ifnet *ifp, struct mbuf *m,
key.addr[1] = h2.ip_src;
key.port[1] = uh.uh_sport;
- s = pf_find_state(direction == PF_IN ? tree_ext_gwy :
- tree_lan_ext, &key);
- if (s == NULL)
- return (NULL);
+ *state = pf_find_state(direction == PF_IN ?
+ tree_ext_gwy : tree_lan_ext, &key);
+ if (*state == NULL)
+ return (PF_DROP);
- if (s->lan.addr != s->gwy.addr ||
- s->lan.port != s->gwy.port) {
+ if ((*state)->lan.addr != (*state)->gwy.addr ||
+ (*state)->lan.port != (*state)->gwy.port) {
if (direction == PF_IN) {
pf_change_icmp(&h2.ip_src.s_addr,
&uh.uh_sport, &h->ip_dst.s_addr,
- s->lan.addr, s->lan.port,
- &uh.uh_sum, &h2.ip_sum,
- &ih->icmp_cksum, &h->ip_sum);
+ (*state)->lan.addr,
+ (*state)->lan.port, &uh.uh_sum,
+ &h2.ip_sum, &ih->icmp_cksum,
+ &h->ip_sum);
} else {
pf_change_icmp(&h2.ip_dst.s_addr,
&uh.uh_dport, &h->ip_src.s_addr,
- s->gwy.addr, s->gwy.port,
- &uh.uh_sum, &h2.ip_sum,
- &ih->icmp_cksum, &h->ip_sum);
+ (*state)->gwy.addr,
+ (*state)->gwy.port, &uh.uh_sum,
+ &h2.ip_sum, &ih->icmp_cksum,
+ &h->ip_sum);
}
- rewrite++;
- }
-
- /*
- * copy back packet headers if we performed NAT
- * operations
- */
- if (rewrite) {
+ m_copyback(m, off, ICMP_MINLEN, (caddr_t)ih);
m_copyback(m, ipoff2, sizeof(h2),
(caddr_t)&h2);
m_copyback(m, off2, sizeof(uh),
(caddr_t)&uh);
}
- return (s);
+ return (PF_PASS);
break;
}
default:
printf("pf: ICMP error message for bad proto\n");
- return (NULL);
+ return (PF_DROP);
}
- return (NULL);
}
}
@@ -2762,12 +2738,12 @@ pf_test(int dir, struct ifnet *ifp, struct mbuf **m0)
log = action != PF_PASS;
goto done;
}
- if ((s = pf_test_state_tcp(dir, ifp, m, 0, off, h, &th))) {
- action = PF_PASS;
+ action = pf_test_state_tcp(&s, dir, ifp, m, 0, off, h , &th);
+ if (action == PF_PASS) {
r = s->rule;
log = s->log;
- } else
- action = pf_test_tcp(dir, ifp, m, 0, off, h, &th);
+ } else if (s == NULL)
+ action = pf_test_tcp(dir, ifp, m, 0, off, h , &th);
break;
}
@@ -2779,11 +2755,11 @@ pf_test(int dir, struct ifnet *ifp, struct mbuf **m0)
log = action != PF_PASS;
goto done;
}
- if ((s = pf_test_state_udp(dir, ifp, m, 0, off, h, &uh))) {
- action = PF_PASS;
+ action = pf_test_state_udp(&s, dir, ifp, m, 0, off, h, &uh);
+ if (action == PF_PASS) {
r = s->rule;
log = s->log;
- } else
+ } else if (s == NULL)
action = pf_test_udp(dir, ifp, m, 0, off, h, &uh);
break;
}
@@ -2796,11 +2772,11 @@ pf_test(int dir, struct ifnet *ifp, struct mbuf **m0)
log = action != PF_PASS;
goto done;
}
- if ((s = pf_test_state_icmp(dir, ifp, m, 0, off, h, &ih))) {
- action = PF_PASS;
+ action = pf_test_state_icmp(&s, dir, ifp, m, 0, off, h, &ih);
+ if (action == PF_PASS) {
r = s->rule;
log = s->log;
- } else
+ } else if (s == NULL)
action = pf_test_icmp(dir, ifp, m, 0, off, h, &ih);
break;
}
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-15 01:48:36 +0000