summaryrefslogtreecommitdiff
path: root/sys
diff options
context:
space:
mode:
Diffstat (limited to 'sys')
-rw-r--r--sys/netinet/fil.c226
-rw-r--r--sys/netinet/ip_fil.c127
-rw-r--r--sys/netinet/ip_fil.h373
-rw-r--r--sys/netinet/ip_frag.c251
-rw-r--r--sys/netinet/ip_frag.h50
-rw-r--r--sys/netinet/ip_input.c19
-rw-r--r--sys/netinet/ip_nat.c497
-rw-r--r--sys/netinet/ip_nat.h81
-rw-r--r--sys/netinet/ip_output.c11
-rw-r--r--sys/netinet/ip_state.c393
-rw-r--r--sys/netinet/ip_state.h84
11 files changed, 1830 insertions, 282 deletions
diff --git a/sys/netinet/fil.c b/sys/netinet/fil.c
index b485678d5a7..60a392119ed 100644
--- a/sys/netinet/fil.c
+++ b/sys/netinet/fil.c
@@ -6,7 +6,7 @@
* to the original author and the contributors.
*/
#ifndef lint
-static char sccsid[] = "@(#)fil.c 1.18 10/24/95 (C) 1993-1995 Darren Reed";
+static char sccsid[] = "@(#)fil.c 1.26 1/14/96 (C) 1993-1996 Darren Reed";
#endif
#ifndef linux
@@ -17,6 +17,8 @@ static char sccsid[] = "@(#)fil.c 1.18 10/24/95 (C) 1993-1995 Darren Reed";
# include <sys/ioctl.h>
# if defined(_KERNEL) || defined(KERNEL)
# include <sys/systm.h>
+# else
+# include <string.h>
# endif
# include <sys/uio.h>
# if !defined(__SVR4) && !defined(__svr4__)
@@ -43,7 +45,10 @@ static char sccsid[] = "@(#)fil.c 1.18 10/24/95 (C) 1993-1995 Darren Reed";
# include <netinet/tcpip.h>
# include <netinet/ip_icmp.h>
#endif
-#include <netinet/ip_fil.h>
+#include "ip_fil.h"
+#include "ip_nat.h"
+#include "ip_frag.h"
+#include "ip_state.h"
#ifndef MIN
#define MIN(a,b) (((a)<(b))?(a):(b))
#endif
@@ -57,20 +62,48 @@ extern void debug(), verbose();
#define FR_IFDEBUG(ex,second,verb_pr) if (ex) { debug verb_pr; second; }
#define FR_VERBOSE(verb_pr) verbose verb_pr
#define FR_DEBUG(verb_pr) debug verb_pr
+#define FR_SCANLIST(p, ip, if, fi, m) fr_scanlist(p, ip, ifp, fi)
#else
#define FR_IFVERBOSE(ex,second,verb_pr) ;
#define FR_IFDEBUG(ex,second,verb_pr) ;
#define FR_VERBOSE(verb_pr)
#define FR_DEBUG(verb_pr)
-
+extern int send_reset();
+# if SOLARIS
+extern int icmp_error();
+extern kmutex_t ipf_mutex;
+# define FR_SCANLIST(p, ip, if, fi, m) fr_scanlist(p, ip, ifp, fi)
+# else
+# define FR_SCANLIST(p, ip, if, fi, m) fr_scanlist(p, ip, ifp, fi, m)
+# endif
extern int ipl_unreach, ipllog();
#endif
+#if SOLARIS
+# define IPLLOG(fl, ip, if, fi, m) ipllog(fl, ip, if, fi)
+# define SEND_RESET(ip, if, q) send_reset(ip, qif, q)
+# define ICMP_ERROR(b, ip, t, c, if, src) \
+ icmp_error(b, ip, t, c, if, src)
+#else
+#ifdef _KERNEL
+# define IPLLOG(fl, ip, if, fi, m) ipllog(fl, ip, if, fi, m)
+#else
+# define IPLLOG(fl, ip, if, fi, m) ipllog()
+#endif
+# define SEND_RESET(ip, if, q) send_reset(ip)
+# if BSD < 199103
+# define ICMP_ERROR(b, ip, t, c, if, src) \
+ icmp_error(mtod(b, ip_t *), t, c, if, src)
+# else
+# define ICMP_ERROR(b, ip, t, c, if, src) \
+ icmp_error(b, t, c, (src).s_addr, if)
+# endif
+#endif
+
struct filterstats frstats[2] = {{0,0,0,0,0},{0,0,0,0,0}};
-struct frentry *filterin[2] = { NULL, NULL },
- *filterout[2] = { NULL, NULL };
+struct frentry *ipfilter[2][2] = { { NULL, NULL }, { NULL, NULL } },
+ *ipacct[2][2] = { { NULL, NULL }, { NULL, NULL } };
int fr_flags = 0, fr_active = 0;
-int fr_check();
/*
@@ -128,18 +161,28 @@ ip_t *ip;
int i, mv, ol, off;
u_char *s, opt;
+#ifdef _KERNEL
+ fi.fi_icode = ipl_unreach;
+#endif
fi.fi_fl = 0;
fi.fi_v = ip->ip_v;
fi.fi_tos = ip->ip_tos;
+ fi.fi_hlen = hlen;
(*(((u_short *)&fi) + 1)) = (*(((u_short *)ip) + 4));
(*(((u_long *)&fi) + 1)) = (*(((u_long *)ip) + 3));
(*(((u_long *)&fi) + 2)) = (*(((u_long *)ip) + 4));
if (hlen > sizeof(struct ip))
fi.fi_fl |= FI_OPTIONS;
+#if SOLARIS
+ off = (ntohs(ip->ip_off) & 0x1fff) << 3;
+ if (ntohs(ip->ip_off) & 0x3fff)
+ fi.fi_fl |= FI_FRAG;
+#else
off = (ip->ip_off & 0x1fff) << 3;
if (ip->ip_off & 0x3fff)
fi.fi_fl |= FI_FRAG;
+#endif
switch (ip->ip_p)
{
case IPPROTO_ICMP :
@@ -314,24 +357,22 @@ struct frentry *fr;
* Could be per interface, but this gets real nasty when you don't have
* kernel sauce.
*/
-int fr_scanlist(pass, ip, hlen, ifp, out, rule)
+int fr_scanlist(pass, ip, ifp, fi, m)
int pass;
ip_t *ip;
-int hlen, out;
struct ifnet *ifp;
-u_short *rule;
+register struct fr_ip *fi;
+void *m;
{
register struct frentry *fr;
- register struct fr_ip *fi;
tcphdr_t *tcp;
int rulen;
- *rule = 1;
- tcp = (tcphdr_t *)((char *)ip + hlen);
- fr = (out) ? filterout[fr_active] : filterin[fr_active];
- fi = fr_makefrip(hlen, ip);
+ fi->fi_rule = 0;
+ tcp = (tcphdr_t *)((char *)ip + fi->fi_hlen);
+ pass |= (fi->fi_fl << 20);
- for (rulen = 0; fr; fr = fr->fr_next, rulen++) {
+ for (rulen = 0, fr = fi->fi_fr; fr; fr = fr->fr_next, rulen++) {
/*
* In all checks below, a null (zero) value in the
* filter struture is taken to mean a wildcard.
@@ -345,7 +386,7 @@ u_short *rule;
if (opts & (OPT_VERBOSE|OPT_DEBUG))
printf("\n");
FR_VERBOSE(("%c", (pass & FR_PASS) ? 'p' : 'b'));
- if (ifp && *fr->fr_ifname && strcasecmp(ifp->if_name,
+ if (ifp && *fr->fr_ifname && strcasecmp((char *)ifp,
fr->fr_ifname))
continue;
FR_VERBOSE((":i"));
@@ -380,15 +421,15 @@ u_short *rule;
* If a fragment, then only the first has what we're looking
* for here...
*/
- if (!(ip->ip_off & 0x1fff)) {
+ if (!(ntohs(ip->ip_off) & 0x1fff)) {
if ((fi->fi_fl & FI_TCPUDP) &&
!fr_tcpudpchk(ip, tcp, fr))
continue;
else if (ip->ip_p == IPPROTO_ICMP &&
- (*(u_short *)((char *)ip + hlen) &
+ (*(u_short *)((char *)ip + fi->fi_hlen) &
fr->fr_icmpm) != fr->fr_icmp) {
FR_DEBUG(("i. %#x & %#x != %#x\n",
- *(u_short *)((char *)ip + hlen),
+ *(u_short *)((char *)ip + fi->fi_hlen),
fr->fr_icmpm, fr->fr_icmp));
continue;
}
@@ -401,15 +442,22 @@ u_short *rule;
*/
if (fr->fr_flags & FR_LOG) {
#ifdef IPFILTER_LOG
- if (!ipllog(hlen, fr->fr_flags, ip, ifp, *rule))
- frstats[out].fr_skip++;
- frstats[out].fr_pkl++;
+ if (!IPLLOG(fr->fr_flags, ip, ifp, fi, m))
+ frstats[fi->fi_out].fr_skip++;
+ frstats[fi->fi_out].fr_pkl++;
#endif /* IPFILTER_LOG */
} else
pass = fr->fr_flags;
FR_DEBUG(("pass %#x\n", pass));
fr->fr_hits++;
- *rule = rulen;
+ fi->fi_rule = rulen;
+ fi->fi_icode = fr->fr_icode;
+ if (pass & FR_ACCOUNT)
+ fr->fr_bytes += ip->ip_len;
+ else {
+ fi->fi_rule = rulen;
+ fi->fi_icode = fr->fr_icode;
+ }
if (pass & FR_QUICK)
break;
}
@@ -423,10 +471,15 @@ u_short *rule;
* or not to pass it on or not.
*/
int fr_check(ip, hlen, ifp, out
-#if SOLARIS && defined(_KERNEL)
+#ifdef _KERNEL
+# if SOLARIS
, qif, q)
qif_t *qif;
queue_t *q;
+# else
+, mp)
+struct mbuf **mp;
+# endif
#else
)
#endif
@@ -435,38 +488,98 @@ int hlen;
struct ifnet *ifp;
int out;
{
- int pass = FR_NOMATCH;
- int sl;
- u_short rule;
+ /*
+ * The above really sucks, but short of writing a diff
+ */
+ register struct fr_ip *fi;
+ int pass;
+
+#if !defined(__SVR4) && !defined(__svr4__) && defined(_KERNEL)
+ register struct mbuf *m = *mp;
+
+ if (!out && (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP ||
+ ip->ip_p == IPPROTO_ICMP)) {
+ register int up = MIN(hlen + 8, ip->ip_len);
+
+ if ((up > m->m_len)) {
+ if ((*mp = m_pullup(m, up)) == 0)
+ return -1;
+ else {
+ m = *mp;
+ ip = mtod(m, struct ip *);
+ }
+ }
+ }
+#endif
+ fi = fr_makefrip(hlen, ip);
+ fi->fi_out = out;
- SPLNET(sl);
+ MUTEX_ENTER(&ipf_mutex);
+ if (!out) {
+ ip_natin(ifp, ip, hlen);
+ if ((fi->fi_fr = ipacct[0][fr_active]) &&
+ (FR_SCANLIST(FR_NOMATCH, ip, ifp, fi, m) & FR_ACCOUNT))
+ frstats[0].fr_acct++;
+ }
- pass = fr_scanlist(pass, ip, hlen, ifp, out, &rule);
- if (pass == FR_NOMATCH) {
- frstats[out].fr_nom++;
+ if (!(pass = ipfr_knownfrag(ip)) &&
+ !(pass = fr_checkstate(ip, hlen))) {
+ pass = FR_NOMATCH;
+ if ((fi->fi_fr = ipfilter[out][fr_active]))
+ pass = FR_SCANLIST(FR_NOMATCH, ip, ifp, fi, m);
+ if (pass & FR_NOMATCH) {
+ frstats[out].fr_nom++;
#ifdef NOMATCH
- pass |= NOMATCH;
+ pass |= NOMATCH;
#endif
+ }
+ if (pass & FR_KEEPFRAG) {
+ if (ipfr_newfrag(ip, pass) == -1)
+ frstats[out].fr_bnfr++;
+ else
+ frstats[out].fr_nfr++;
+ }
+ if (pass & FR_KEEPSTATE) {
+ if (fr_addstate(ip, hlen, pass) == -1)
+ frstats[out].fr_bads++;
+ else
+ frstats[out].fr_ads++;
+ }
+ } else if (pass & FR_LOGFIRST)
+ pass &= ~(FR_LOGFIRST|FR_LOG);
+
+
+ if (out) {
+ if ((fi->fi_fr = ipacct[1][fr_active]) &&
+ (FR_SCANLIST(FR_NOMATCH, ip, ifp, fi, m) & FR_ACCOUNT))
+ frstats[1].fr_acct++;
+ ip_natout(ifp, ip, hlen);
}
+ MUTEX_EXIT(&ipf_mutex);
#ifdef IPFILTER_LOG
- if ((pass & FR_LOGP) ||
+ if ((fr_flags & FF_LOGNOMATCH) && (pass & FR_NOMATCH)) {
+ pass |= FF_LOGNOMATCH;
+ if (!IPLLOG(pass, ip, ifp, fi, m))
+ frstats[out].fr_skip++;
+ frstats[out].fr_npkl++;
+ } else if (((pass & FR_LOGP) == FR_LOGP) ||
((pass & FR_PASS) && (fr_flags & FF_LOGPASS))) {
- if (!(pass & FR_LOGP))
- pass |= FF_LOGPASS << 8;
- if (!ipllog(hlen, pass, ip, ifp, rule))
+ if ((pass & FR_LOGP) != FR_LOGP)
+ pass |= FF_LOGPASS;
+ if (!IPLLOG(pass, ip, ifp, fi, m))
frstats[out].fr_skip++;
frstats[out].fr_ppkl++;
- } else if ((pass & FR_LOGB) ||
+ } else if (((pass & FR_LOGB) == FR_LOGB) ||
((pass & FR_BLOCK) && (fr_flags & FF_LOGBLOCK))) {
- if (!(pass & FR_LOGB))
- pass |= FF_LOGBLOCK << 8;
- if (!ipllog(hlen, pass, ip, ifp, rule))
+ if ((pass & FR_LOGB) != FR_LOGB)
+ pass |= FF_LOGBLOCK;
+ if (!IPLLOG(pass, ip, ifp, fi, m))
frstats[out].fr_skip++;
frstats[out].fr_bpkl++;
}
#endif /* IPFILTER_LOG */
- SPLX(sl);
+
if (pass & FR_PASS)
frstats[out].fr_pass++;
else if (pass & FR_BLOCK) {
@@ -474,33 +587,21 @@ int out;
/*
* Should we return an ICMP packet to indicate error
* status passing through the packet filter ?
- * XXX - copy mbuf as icmp_error() calls mfree() - fix this
- * later, but preserve backward compatibility for now.
*/
#ifdef _KERNEL
if (pass & FR_RETICMP) {
# if SOLARIS
- icmp_error(q, ip, ICMP_UNREACH, ipl_unreach, qif,
- ip->ip_src);
+ ICMP_ERROR(q, ip, ICMP_UNREACH, fi->fi_icode,
+ qif, ip->ip_src);
# else
- struct mbuf *copy;
-
- copy = m_copy(dtom(ip), 0, imin((int)ip->ip_len, 64));
-# if BSD < 199103
- icmp_error(mtod(copy, struct ip *),
- ICMP_UNREACH, ipl_unreach, ifp, ip->ip_src);
-# else
- icmp_error(copy, ICMP_UNREACH, ipl_unreach,
- ip->ip_src.s_addr, ifp);
-# endif
+ ICMP_ERROR(m, ip, ICMP_UNREACH, fi->fi_icode,
+ ifp, ip->ip_src);
+ m = NULL; /* freed by icmp_error() */
# endif
+
frstats[0].fr_ret++;
} else if (pass & FR_RETRST && IPMINLEN(ip, tcphdr)) {
-# if SOLARIS
- if (send_reset(ip, qif, q) == 0)
-# else
- if (send_reset(ip) == 0)
-# endif
+ if (SEND_RESET(ip, qif, q) == 0)
frstats[1].fr_ret++;
}
#else
@@ -514,6 +615,10 @@ int out;
#endif
}
#ifdef _KERNEL
+# if !SOLARIS
+ if (!(pass & FR_PASS) && m)
+ m_freem(m);
+# endif
return (pass & FR_PASS) ? 0 : -1;
#else
if (pass & FR_NOMATCH)
@@ -529,6 +634,5 @@ int out;
int ipllog()
{
verbose("l");
- return 1;
}
#endif
diff --git a/sys/netinet/ip_fil.c b/sys/netinet/ip_fil.c
index f234291a923..24ab8a5deaa 100644
--- a/sys/netinet/ip_fil.c
+++ b/sys/netinet/ip_fil.c
@@ -6,7 +6,7 @@
* to the original author and the contributors.
*/
#ifndef lint
-static char sccsid[] = "@(#)ip_fil.c 2.26 11/8/95 (C) 1993-1995 Darren Reed";
+static char sccsid[] = "@(#)ip_fil.c 2.31 1/14/96 (C) 1993-1995 Darren Reed";
#endif
#ifndef linux
@@ -38,16 +38,23 @@ static char sccsid[] = "@(#)ip_fil.c 2.26 11/8/95 (C) 1993-1995 Darren Reed";
#include <syslog.h>
#endif
#include "ip_fil.h"
+#include "ip_frag.h"
+#include "ip_nat.h"
+#include "ip_state.h"
#ifndef MIN
#define MIN(a,b) (((a)<(b))?(a):(b))
#endif
extern fr_flags, fr_active;
-extern int fr_check(), (*fr_checkp)();
+extern struct protosw inetsw[];
+extern int (*fr_checkp)();
#if BSD < 199306
+extern int ipfr_slowtimer();
+static int (*fr_saveslowtimo)();
extern int tcp_ttl;
#else
-extern int ip_defttl;
+extern void ipfr_slowtimer();
+static void (*fr_saveslowtimo)();
#endif
int ipl_inited = 0;
@@ -75,6 +82,7 @@ char *s;
return 1;
return 0;
}
+#endif /* IPFILTER_LKM */
int iplattach()
@@ -90,7 +98,13 @@ int iplattach()
ipl_inited = 1;
fr_savep = fr_checkp;
fr_checkp = fr_check;
-
+#if BSD >= 199306
+ fr_saveslowtimo = inetsw[0].pr_slowtimo;
+ inetsw[0].pr_slowtimo = ipfr_slowtimer;
+#else
+ fr_saveslowtimo = inetsw[0].pr_slowtimo;
+ inetsw[0].pr_slowtimo = ipfr_slowtimer;
+#endif
SPLX(s);
return 0;
}
@@ -113,13 +127,17 @@ int ipldetach()
}
fr_checkp = fr_savep;
+ inetsw[0].pr_slowtimo = fr_saveslowtimo;
frflush((caddr_t)&i);
ipl_inited = 0;
+ ipfr_unload();
+ ip_natunload();
+ fr_stateunload();
+
SPLX(s);
return 0;
}
-#endif /* IPFILTER_LKM */
static void frzerostats(data)
@@ -129,10 +147,14 @@ caddr_t data;
bcopy((char *)frstats, (char *)fio.f_st,
sizeof(struct filterstats) * 2);
- fio.f_fin[0] = filterin[0];
- fio.f_fin[1] = filterin[1];
- fio.f_fout[0] = filterout[0];
- fio.f_fout[1] = filterout[1];
+ fio.f_fin[0] = ipfilter[0][0];
+ fio.f_fin[1] = ipfilter[0][1];
+ fio.f_fout[0] = ipfilter[1][0];
+ fio.f_fout[1] = ipfilter[1][1];
+ fio.f_acctin[0] = ipacct[0][0];
+ fio.f_acctin[1] = ipacct[0][1];
+ fio.f_acctout[0] = ipacct[1][0];
+ fio.f_acctout[1] = ipacct[1][1];
fio.f_active = fr_active;
IWCOPY((caddr_t)&fio, data, sizeof(fio));
bzero((char *)frstats, sizeof(*frstats));
@@ -143,22 +165,34 @@ static void frflush(data)
caddr_t data;
{
struct frentry *f, **fp;
- int flags = *(int *)data, flushed = 0, set = fr_active;
+ int flags = *(int *)data, flushed = 0, set = fr_active, in;
if (flags & FR_INACTIVE)
set = 1 - set;
- if (flags & FR_OUTQUE)
- for (fp = &filterout[set]; (f = *fp); ) {
+ if (flags & FR_OUTQUE) {
+ for (fp = &ipfilter[1][set]; (f = *fp); ) {
*fp = f->fr_next;
KFREE(f);
flushed++;
}
- if (flags & FR_INQUE)
- for (fp = &filterin[set]; (f = *fp); ) {
+ for (fp = &ipacct[1][set]; (f = *fp); ) {
+ *fp = f->fr_next;
+ KFREE(f);
+ flushed++;
+ }
+ }
+ if (flags & FR_INQUE) {
+ for (fp = &ipfilter[0][set]; (f = *fp); ) {
*fp = f->fr_next;
KFREE(f);
flushed++;
}
+ for (fp = &ipacct[0][set]; (f = *fp); ) {
+ *fp = f->fr_next;
+ KFREE(f);
+ flushed++;
+ }
+ }
*(int *)data = flushed;
}
@@ -187,13 +221,10 @@ int mode;
u_int enable;
IRCOPY(data, (caddr_t)&enable, sizeof(enable));
- if (enable) {
- if (fr_checkp != fr_check) {
- fr_savep = fr_checkp;
- fr_checkp = fr_check;
- }
- } else
- fr_checkp = fr_savep;
+ if (enable)
+ error = iplattach();
+ else
+ error = ipldetach();
break;
}
#endif
@@ -223,10 +254,14 @@ int mode;
bcopy((char *)frstats, (char *)fio.f_st,
sizeof(struct filterstats) * 2);
- fio.f_fin[0] = filterin[0];
- fio.f_fin[1] = filterin[1];
- fio.f_fout[0] = filterout[0];
- fio.f_fout[1] = filterout[1];
+ fio.f_fin[0] = ipfilter[0][0];
+ fio.f_fin[1] = ipfilter[0][1];
+ fio.f_fout[0] = ipfilter[1][0];
+ fio.f_fout[1] = ipfilter[1][1];
+ fio.f_acctin[0] = ipacct[0][0];
+ fio.f_acctin[1] = ipacct[0][1];
+ fio.f_acctout[0] = ipacct[1][0];
+ fio.f_acctout[1] = ipacct[1][1];
fio.f_active = fr_active;
IWCOPY((caddr_t)&fio, data, sizeof(fio));
break;
@@ -244,6 +279,17 @@ int mode;
iplused = 0;
break;
#endif /* IPFILTER_LOG */
+ case SIOCADNAT :
+ case SIOCRMNAT :
+ case SIOCGNATS :
+ error = nat_ioctl(data, cmd);
+ break;
+ case SIOCGFRST :
+ IWCOPY((caddr_t)ipfr_fragstats(), data, sizeof(ipfrstat_t));
+ break;
+ case SIOCGIPST :
+ IWCOPY((caddr_t)fr_statetstats(), data, sizeof(ips_stat_t));
+ break;
default :
error = -EINVAL;
break;
@@ -260,12 +306,13 @@ register struct frentry *fp;
register struct frentry *f, **fprev;
register struct frentry **ftail;
struct frentry frd;
- int error = 0;
+ int error = 0, in;
- if (fp->fr_flags & FR_OUTQUE)
- ftail = fprev = &filterout[set];
- else if (fp->fr_flags & FR_INQUE)
- ftail = fprev = &filterin[set];
+ in = (fp->fr_flags & FR_INQUE) ? 0 : 1;
+ if (fp->fr_flags & FR_ACCOUNT) {
+ ftail = fprev = &ipacct[in][set];
+ } else if (fp->fr_flags & (FR_OUTQUE|FR_INQUE))
+ ftail = fprev = &ipfilter[in][set];
else
return ESRCH;
@@ -411,20 +458,20 @@ register struct uio *uio;
#ifdef IPFILTER_LOG
-int ipllog(hlen, flags, ip, ifp, rule)
-register int hlen;
+int ipllog(flags, ip, ifp, fi, m)
u_int flags;
ip_t *ip;
struct ifnet *ifp;
-u_short rule;
+register struct fr_ip *fi;
+struct mbuf *m;
{
struct ipl_ci iplci;
register size_t tail = 0;
- register int len, mlen;
- register struct mbuf *m = dtom(ip);
+ register int len, mlen, hlen;
+ hlen = fi->fi_hlen;
if (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP)
- hlen += sizeof(tcphdr_t);
+ hlen += MIN(sizeof(tcphdr_t), ip->ip_len - hlen);
else if (ip->ip_p == IPPROTO_ICMP) {
struct icmp *icmp = (struct icmp *)((char *)ip + hlen);
@@ -434,9 +481,11 @@ u_short rule;
case ICMP_REDIRECT :
case ICMP_TIMXCEED :
case ICMP_PARAMPROB :
- hlen += 8;
+ hlen += MIN(sizeof(struct icmp) + 8, ip->ip_len - hlen);
+ break;
default :
- hlen += sizeof(struct icmp);
+ hlen += MIN(sizeof(struct icmp), ip->ip_len - hlen);
+ break;
}
}
@@ -455,7 +504,7 @@ u_short rule;
iplci.flags = flags;
iplci.hlen = (u_char)hlen;
iplci.plen = (flags & FR_LOGBODY) ? (u_char)mlen : 0 ;
- iplci.rule = rule;
+ iplci.rule = fi->fi_rule;
iplci.unit = (u_char)ifp->if_unit;
iplci.ifname[0] = ifp->if_name[0];
iplci.ifname[1] = ifp->if_name[1];
diff --git a/sys/netinet/ip_fil.h b/sys/netinet/ip_fil.h
index 8d4380dd4cc..67e985af645 100644
--- a/sys/netinet/ip_fil.h
+++ b/sys/netinet/ip_fil.h
@@ -5,17 +5,20 @@
* provided that this notice is preserved and due credit is given
* to the original author and the contributors.
*
- * @(#)ip_fil.h 1.23 11/11/95
+ * @(#)ip_fil.h 1.29 1/12/96
*/
#ifndef __IP_FIL_H_
#define __IP_FIL_H__
#ifndef IPFILTER_LOG
-#define IPFILTER_LOG 1
+#define IPFILTER_LOG
#endif
+#ifndef SOLARIS
#define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4)))
+#endif
+
#if defined(KERNEL) && !defined(_KERNEL)
#define _KERNEL
#endif
@@ -84,18 +87,24 @@ typedef struct fr_ip {
u_long fi_optmsk;
u_short fi_secmsk;
u_short fi_auth;
+ u_short fi_out;
+ u_short fi_rule;
+ u_short fi_hlen;
+ u_char fi_icode;
+ struct frentry *fi_fr;
} fr_ip_t;
-#define FI_SHORT 0x01
-#define FI_OPTIONS 0x02
+#define FI_OPTIONS 0x01
+#define FI_TCPUDP 0x02 /* TCP/UCP implied comparison involved */
#define FI_FRAG 0x04
-#define FI_TCPUDP 0x08 /* TCP/UCP implied comparison involved */
+#define FI_SHORT 0x08
typedef struct frentry {
struct frentry *fr_next;
struct ifnet *fr_ifa;
- u_int fr_hits;
-
+ u_long fr_hits;
+ u_long fr_bytes; /* this is only incremented when a packet */
+ /* stops matching on this rule */
/*
* Fields after this may not change whilst in the kernel.
*/
@@ -114,7 +123,8 @@ typedef struct frentry {
u_short fr_sport;
u_short fr_stop; /* top port for <> and >< */
u_short fr_dtop; /* top port for <> and >< */
- u_short fr_flags; /* per-rule flags && options (see below) */
+ u_long fr_flags; /* per-rule flags && options (see below) */
+ char fr_icode; /* return ICMP code */
char fr_ifname[IFNAMSIZ];
} frentry_t;
@@ -133,20 +143,30 @@ typedef struct frentry {
/*
* fr_flags
- */
+*/
#define FR_BLOCK 0x0001
#define FR_PASS 0x0002
#define FR_OUTQUE 0x0004
#define FR_INQUE 0x0008
-#define FR_LOGP 0x0010 /* Log-pass */
-#define FR_LOGB 0x0020 /* Log-fail */
-#define FR_LOG 0x0040 /* Log */
-#define FR_LOGBODY 0x0080 /* Log the body */
-#define FR_QUICK 0x0100
-#define FR_RETRST 0x0200
-#define FR_RETICMP 0x0400
-#define FR_INACTIVE 0x0800
-#define FR_NOMATCH 0x1000
+#define FR_LOG 0x0010 /* Log */
+#define FR_LOGB 0x0021 /* Log-fail */
+#define FR_LOGP 0x0022 /* Log-pass */
+#define FR_LOGBODY 0x0040 /* Log the body */
+#define FR_LOGFIRST 0x0080
+#define FR_RETRST 0x0100
+#define FR_RETICMP 0x0200
+#define FR_NOMATCH 0x0400
+#define FR_ACCOUNT 0x0800 /* count packet bytes */
+#define FR_KEEPFRAG 0x1000
+#define FR_KEEPSTATE 0x2000
+#define FR_INACTIVE 0x4000
+#define FR_QUICK 0x8000
+/*
+ * recognized flags for SIOCGETFF and SIOCSETFF
+ */
+#define FF_LOGPASS 0x100000
+#define FF_LOGBLOCK 0x200000
+#define FF_LOGNOMATCH 0x400000
#define FR_NONE 0
#define FR_EQUAL 1
@@ -164,9 +184,15 @@ typedef struct filterstats {
u_long fr_nom; /* packets which don't match any rule */
u_long fr_ppkl; /* packets allowed and logged */
u_long fr_bpkl; /* packets denied and logged */
+ u_long fr_npkl; /* packets unmatched and logged */
u_long fr_pkl; /* packets logged */
u_long fr_skip; /* packets to be logged but buffer full */
u_long fr_ret; /* packets for which a return is sent */
+ u_long fr_acct; /* packets for which counting was performed */
+ u_long fr_bnfr; /* bad attempts to allocate fragment state */
+ u_long fr_nfr; /* new fragment state kept */
+ u_long fr_bads; /* bad attempts to allocate packet state */
+ u_long fr_ads; /* new packet state kept */
#if SOLARIS
u_long fr_bad; /* bad IP packets to the filter */
u_long fr_notip; /* packets passed through no on ip queue */
@@ -175,18 +201,14 @@ typedef struct filterstats {
} filterstats_t;
/*
- * recognized flags for SIOCGETFF and SIOCSETFF
- */
-#define FF_LOGPASS 1
-#define FF_LOGBLOCK 2
-
-/*
* For SIOCGETFS
*/
typedef struct friostat {
struct filterstats f_st[2];
struct frentry *f_fin[2];
struct frentry *f_fout[2];
+ struct frentry *f_acctin[2];
+ struct frentry *f_acctout[2];
int f_active;
} friostat_t;
@@ -195,11 +217,6 @@ typedef struct optlist {
int ol_bit;
} optlist_t;
-#ifdef _KERNEL
-extern struct frentry *filterin[], *filterout[];
-extern struct filterstats frstats[];
-#endif
-
typedef struct ipl_ci {
u_long sec;
u_long usec;
@@ -211,26 +228,143 @@ typedef struct ipl_ci {
u_char ifname[4];
} ipl_ci_t;
-#ifdef _KERNEL
-typedef struct ipfr {
- struct ipfr *ipfr_next, *ipfr_prev;
- struct in_addr ipfr_src;
- struct in_addr ipfr_dst;
- u_short ipfr_id;
- u_short ipfr_age;
- u_char ipfr_p;
- u_char ipfr_tos;
- u_char ipfr_pass;
-} ipfr_t;
+#ifndef ICMP_UNREACH_FILTER
+#define ICMP_UNREACH_FILTER 13
+#endif
+/*
+ * Security Options for Intenet Protocol (IPSO) as defined in RFC 1108.
+ *
+ * Basic Option
+ *
+ * 00000001 - (Reserved 4)
+ * 00111101 - Top Secret
+ * 01011010 - Secret
+ * 10010110 - Confidential
+ * 01100110 - (Reserved 3)
+ * 11001100 - (Reserved 2)
+ * 10101011 - Unclassified
+ * 11110001 - (Reserved 1)
+ */
+#define IPSO_CLASS_RES4 0x01
+#define IPSO_CLASS_TOPS 0x3d
+#define IPSO_CLASS_SECR 0x5a
+#define IPSO_CLASS_CONF 0x96
+#define IPSO_CLASS_RES3 0x66
+#define IPSO_CLASS_RES2 0xcc
+#define IPSO_CLASS_UNCL 0xab
+#define IPSO_CLASS_RES1 0xf1
+
+#define IPSO_AUTH_GENSER 0x80
+#define IPSO_AUTH_ESI 0x40
+#define IPSO_AUTH_SCI 0x20
+#define IPSO_AUTH_NSA 0x10
+#define IPSO_AUTH_DOE 0x08
+#define IPSO_AUTH_UN 0x06
+#define IPSO_AUTH_FTE 0x01
+
+/*#define IPOPT_RR 7 */
+#define IPOPT_ZSU 10 /* ZSU */
+#define IPOPT_MTUP 11 /* MTUP */
+#define IPOPT_MTUR 12 /* MTUR */
+#define IPOPT_ENCODE 15 /* ENCODE */
+/*#define IPOPT_TS 68 */
+#define IPOPT_TR 82 /* TR */
+/*#define IPOPT_SECURITY 130 */
+/*#define IPOPT_LSRR 131 */
+#define IPOPT_E_SEC 133 /* E-SEC */
+#define IPOPT_CIPSO 134 /* CIPSO */
+/*#define IPOPT_SATID 136 */
+#ifndef IPOPT_SID
+# define IPOPT_SID IPOPT_SATID
+#endif
+/*#define IPOPT_SSRR 137 */
+#define IPOPT_ADDEXT 147 /* ADDEXT */
+#define IPOPT_VISA 142 /* VISA */
+#define IPOPT_IMITD 144 /* IMITD */
+#define IPOPT_EIP 145 /* EIP */
+#define IPOPT_FINN 205 /* FINN */
+
+#define IPMINLEN(i, h) ((i)->ip_len >= ((i)->ip_hl * 4 + sizeof(struct h)))
+
+extern int fr_check();
+
+#ifdef _KERNEL
+
+extern struct frentry *ipfilter[2][2], *ipacct[2][2];
+extern struct filterstats frstats[];
+# if SOLARIS
+extern int ipfsync();
+# endif
+#endif /* _KERNEL */
+
+#ifndef SOLARIS
+#define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4)))
+#endif
+#define IPMINLEN(i, h) ((i)->ip_len >= ((i)->ip_hl * 4 + sizeof(struct h)))
-#define IPFR_CMPSZ (4 + 4 + 2 + 1 + 1)
+#ifndef IP_OFFMASK
+#define IP_OFFMASK 0x1fff
+#endif
-# if defined(sun) && !defined(linux)
+#ifndef MAX
+#define MAX(a,b) (((a) > (b)) ? (a) : (b))
+#endif
+
+#ifdef _KERNEL
+# if SOLARIS
+# define MUTEX_ENTER(x) mutex_enter(x)
+# define MUTEX_EXIT(x) mutex_exit(x)
+# define MTOD(m,t) (t)((m)->b_rptr)
+# define IRCOPY(a,b,c) copyin((a), (b), (c))
+# define IWCOPY(a,b,c) copyout((a), (b), (c))
+# else
+# define MUTEX_ENTER(x) ;
+# define MUTEX_EXIT(x) ;
+# ifndef linux
+# define MTOD(m,t) mtod(m,t)
+# define IRCOPY(a,b,c) bcopy((a), (b), (c))
+# define IWCOPY(a,b,c) bcopy((a), (b), (c))
+# endif
+# endif /* SOLARIS */
+
+# ifdef sun
+# if defined(__svr4__) || defined(__SVR4)
+# define GETUNIT(n) get_unit((n))
+# else
+# include <sys/kmem_alloc.h>
+# define GETUNIT(n) ifunit((n), IFNAMSIZ)
+# endif
+# else
+# define GETUNIT(n) ifunit((n))
+# endif /* sun */
+
+# if defined(sun) && !defined(linux) && !defined(__NetBSD__) && !defined (__OpenBSD__)
# define UIOMOVE(a,b,c,d) uiomove(a,b,c,d)
# define SLEEP(id, n) sleep((id), PZERO+1)
# define KFREE(x) kmem_free((char *)(x), sizeof(*(x)))
# if SOLARIS
+typedef struct qif {
+ struct qif *qf_next;
+ ill_t *qf_ill;
+ kmutex_t qf_lock;
+ void *qf_iptr;
+ void *qf_optr;
+ queue_t *qf_in;
+ queue_t *qf_out;
+ void *qf_wqinfo;
+ void *qf_rqinfo;
+ char qf_name[8];
+ int (*qf_inp)();
+ int (*qf_outp)();
+ /*
+ * in case the ILL has disappeared...
+ */
+ int qf_hl; /* header length */
+} qif_t;
+# define SPLNET(x) ;
+# undef SPLX
+# define SPLX(x) ;
# ifdef sparc
# define ntohs(x) (x)
# define ntohl(x) (x)
@@ -242,7 +376,7 @@ typedef struct ipfr {
# else
# define KMALLOC(x) new_kmem_alloc((x), KMEM_SLEEP)
# endif /* __svr4__ */
-# endif /* sun && !linux */
+# endif /* sun && !linux && !__NetBSD__ && !__OpenBSD__*/
# ifndef GET_MINOR
# define GET_MINOR(x) minor(x)
# endif
@@ -260,9 +394,26 @@ extern vm_map_t kmem_map;
sizeof(*(x)))
# define UIOMOVE(a,b,c,d) uiomove(a,b,d)
# define SLEEP(id, n) tsleep((id), PPAUSE|PCATCH, n, 0)
-# else
# endif /* BSD */
-#endif /* _KERNEL */
+# if defined(NetBSD1_0) && (NetBSD1_0 > 1)
+# define SPLNET(x) x = splsoftnet()
+# else
+# if !SOLARIS
+# define SPLNET(x) x = splnet()
+# define SPLX(x) (void) splx(x)
+# endif
+# endif
+#else
+# define MUTEX_ENTER(x) ;
+# define MUTEX_EXIT(x) ;
+# define SPLNET(x) ;
+# define SPLX(x) ;
+# define KMALLOC(x) malloc(x)
+# define KFREE(x) free(x)
+# define GETUNIT(x) (x)
+# define IRCOPY(a,b,c) bcopy((a), (b), (c))
+# define IWCOPY(a,b,c) bcopy((a), (b), (c))
+#endif /* KERNEL */
#ifdef linux
# define ICMP_UNREACH ICMP_DEST_UNREACH
@@ -293,6 +444,13 @@ typedef struct {
} tcphdr_t;
typedef struct {
+ __u16 uh_sport;
+ __u16 uh_dport;
+ __u16 uh_ulen;
+ __u16 uh_sun;
+} udphdr_t;
+
+typedef struct {
# if defined(__i386__) || defined(__MIPSEL__) || defined(__alpha__) ||\
defined(vax)
__u8 ip_hl:4;
@@ -312,8 +470,8 @@ typedef struct {
__u32 ip_dst;
} ip_t;
-# define SPLX(x) ;
-# define SPLNET(x) ;
+# define SPLX(x) (void)
+# define SPLNET(x) (void)
# define bcopy(a,b,c) memmove(b,a,c)
# define bcmp(a,b,c) memcmp(a,b,c)
@@ -336,128 +494,9 @@ typedef struct {
memcpy_tofs((b), (a), (c)); \
}
#else
-
typedef struct tcphdr tcphdr_t;
+typedef struct udphdr udphdr_t;
typedef struct ip ip_t;
-
-# if SOLARIS
-# define MTOD(m,t) (t)((m)->b_rptr)
-# define IRCOPY(a,b,c) copyin((a), (b), (c))
-# define IWCOPY(a,b,c) copyout((a), (b), (c))
-# ifdef _KERNEL
-typedef struct qif {
- struct qif *qf_next;
- ill_t *qf_ill;
- kmutex_t qf_lock;
- void *qf_iptr;
- void *qf_optr;
- queue_t *qf_in;
- queue_t *qf_out;
- void *qf_wqinfo;
- void *qf_rqinfo;
- char qf_name[8];
- int (*qf_inp)();
- int (*qf_outp)();
- /*
- * in case the ILL has disappeared...
- */
- int qf_hl; /* header length */
-} qif_t;
-# endif /* _KERNEL */
-# else
-# define MTOD(m,t) mtod(m,t)
-# define IRCOPY(a,b,c) bcopy((a), (b), (c))
-# define IWCOPY(a,b,c) bcopy((a), (b), (c))
-# endif /* SOLARIS */
-# ifdef _KERNEL
-# if defined(NetBSD1_0) && (NetBSD1_0 > 1)
-# define SPLNET(x) x = splsoftnet()
-# else
-# if SOLARIS
-# define SPLNET(x) ;
-# else
-# define SPLNET(x) x = splnet()
-# endif
-# endif
-# ifdef SPLX
-# undef SPLX
-# endif
-# if SOLARIS
-# define SPLX(x) ;
-# else
-# define SPLX(x) (void) splx(x)
-# endif
-# else
-# define SPLNET(x) ;
-# define SPLX(x) ;
-# endif /* KERNEL */
-
-# ifdef sun
-# if !defined(__sysv__) && !defined(__SVR4)
-# define GETUNIT(n) ifunit((n), IFNAMSIZ)
-# endif
-# else
-# define GETUNIT(n) ifunit((n))
-# endif /* sun */
-extern struct ifnet *ifunit();
#endif /* linux */
-#define IPMINLEN(i, h) ((i)->ip_len >= ((i)->ip_hl * 4 + sizeof(struct h)))
-
-/*#define IPOPT_RR 7 */
-#define IPOPT_ZSU 10 /* ZSU */
-#define IPOPT_MTUP 11 /* MTUP */
-#define IPOPT_MTUR 12 /* MTUR */
-#define IPOPT_ENCODE 15 /* ENCODE */
-/*#define IPOPT_TS 68 */
-#define IPOPT_TR 82 /* TR */
-/*#define IPOPT_SECURITY 130 */
-/*#define IPOPT_LSRR 131 */
-#define IPOPT_E_SEC 133 /* E-SEC */
-#define IPOPT_CIPSO 134 /* CIPSO */
-/*#define IPOPT_SATID 136 */
-#ifndef IPOPT_SID
-# define IPOPT_SID IPOPT_SATID
-#endif
-/*#define IPOPT_SSRR 137 */
-#define IPOPT_ADDEXT 147 /* ADDEXT */
-#define IPOPT_VISA 142 /* VISA */
-#define IPOPT_IMITD 144 /* IMITD */
-#define IPOPT_EIP 145 /* EIP */
-#define IPOPT_FINN 205 /* FINN */
-
-#ifndef ICMP_UNREACH_FILTER
-#define ICMP_UNREACH_FILTER 13
-#endif
-/*
- * Security Options for Intenet Protocol (IPSO) as defined in RFC 1108.
- *
- * Basic Option
- *
- * 00000001 - (Reserved 4)
- * 00111101 - Top Secret
- * 01011010 - Secret
- * 10010110 - Confidential
- * 01100110 - (Reserved 3)
- * 11001100 - (Reserved 2)
- * 10101011 - Unclassified
- * 11110001 - (Reserved 1)
- */
-#define IPSO_CLASS_RES4 0x01
-#define IPSO_CLASS_TOPS 0x3d
-#define IPSO_CLASS_SECR 0x5a
-#define IPSO_CLASS_CONF 0x96
-#define IPSO_CLASS_RES3 0x66
-#define IPSO_CLASS_RES2 0xcc
-#define IPSO_CLASS_UNCL 0xab
-#define IPSO_CLASS_RES1 0xf1
-
-#define IPSO_AUTH_GENSER 0x80
-#define IPSO_AUTH_ESI 0x40
-#define IPSO_AUTH_SCI 0x20
-#define IPSO_AUTH_NSA 0x10
-#define IPSO_AUTH_DOE 0x08
-#define IPSO_AUTH_UN 0x06
-#define IPSO_AUTH_FTE 0x01
-
#endif /* __IP_FIL_H__ */
diff --git a/sys/netinet/ip_frag.c b/sys/netinet/ip_frag.c
new file mode 100644
index 00000000000..344423b0d71
--- /dev/null
+++ b/sys/netinet/ip_frag.c
@@ -0,0 +1,251 @@
+/*
+ * (C)opyright 1993,1994,1995 by Darren Reed.
+ *
+ * Redistribution and use in source and binary forms are permitted
+ * provided that this notice is preserved and due credit is given
+ * to the original author and the contributors.
+ */
+#ifndef lint
+static char sccsid[] = "@(#)ip_frag.c 1.5 1/14/96 (C) 1993-1995 Darren Reed";
+#endif
+
+#include <string.h>
+#include <sys/errno.h>
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/file.h>
+#include <sys/ioctl.h>
+#include <sys/uio.h>
+#include <sys/protosw.h>
+#include <sys/socket.h>
+#if !defined(__SVR4) && !defined(__svr4__)
+# include <sys/dir.h>
+# include <sys/mbuf.h>
+#else
+# include <sys/byteorder.h>
+# include <sys/dditypes.h>
+# include <sys/stream.h>
+# include <sys/kmem.h>
+#endif
+
+#include <net/if.h>
+#ifdef sun
+#include <net/af.h>
+#endif
+#include <net/route.h>
+#include <netinet/in.h>
+#include <netinet/in_systm.h>
+#include <netinet/ip.h>
+#include <netinet/ip_var.h>
+#include <netinet/tcp.h>
+#include <netinet/udp.h>
+#include <netinet/tcpip.h>
+#include <netinet/ip_icmp.h>
+#include <syslog.h>
+#include "ip_fil.h"
+#include "ip_frag.h"
+#include "ip_nat.h"
+#include "ip_state.h"
+
+ipfr_t *ipfr_heads[IPFT_SIZE];
+ipfrstat_t ipfr_stats;
+u_long ipfr_inuse = 0;
+#ifdef _KERNEL
+extern int ipfr_timer_id;
+#endif
+#if SOLARIS
+# ifdef _KERNEL
+extern kmutex_t ipf_frag;
+# else
+#define bcmp(a,b,c) memcmp(a,b,c)
+#define bcopy(a,b,c) memmove(b,a,c)
+# endif
+#endif
+
+
+ipfrstat_t *ipfr_fragstats()
+{
+ ipfr_stats.ifs_table = ipfr_heads;
+ ipfr_stats.ifs_inuse = ipfr_inuse;
+ return &ipfr_stats;
+}
+
+
+/*
+ * add a new entry to the fragment cache, registering it as having come
+ * through this box, with the result of the filter operation.
+ */
+int ipfr_newfrag(ip, pass)
+ip_t *ip;
+int pass;
+{
+ ipfr_t **fp, *fr, frag;
+ u_int idx;
+
+ frag.ipfr_p = ip->ip_p;
+ idx = ip->ip_p;
+ frag.ipfr_id = ip->ip_id;
+ idx += ip->ip_id;
+ frag.ipfr_tos = ip->ip_tos;
+ frag.ipfr_src.s_addr = ip->ip_src.s_addr;
+ idx += ip->ip_src.s_addr;
+ frag.ipfr_dst.s_addr = ip->ip_dst.s_addr;
+ idx += ip->ip_dst.s_addr;
+ idx *= 127;
+ idx %= IPFT_SIZE;
+
+ /*
+ * first, make sure it isn't already there...
+ */
+ MUTEX_ENTER(&ipf_frag);
+ for (fp = &ipfr_heads[idx]; (fr = *fp); fp = &fr->ipfr_next)
+ if (!bcmp((char *)&frag.ipfr_src, (char *)&fr->ipfr_src,
+ IPFR_CMPSZ)) {
+ ipfr_stats.ifs_exists++;
+ MUTEX_EXIT(&ipf_frag);
+ return -1;
+ }
+
+ if (!(fr = (ipfr_t *)KMALLOC(sizeof(*fr)))) {
+ ipfr_stats.ifs_nomem++;
+ MUTEX_EXIT(&ipf_frag);
+ return -1;
+ }
+ if ((fr->ipfr_next = ipfr_heads[idx]))
+ ipfr_heads[idx]->ipfr_prev = fr;
+ fr->ipfr_prev = NULL;
+ ipfr_heads[idx] = fr;
+ bcopy((char *)&frag.ipfr_src, (char *)&fr->ipfr_src, IPFR_CMPSZ);
+ fr->ipfr_ttl = 120; /* 60 seconds */
+ fr->ipfr_pass = pass;
+ *fp = fr;
+ ipfr_stats.ifs_new++;
+ ipfr_inuse++;
+ MUTEX_EXIT(&ipf_frag);
+ return 0;
+}
+
+
+/*
+ * check the fragment cache to see if there is already a record of this packet
+ * with its filter result known.
+ */
+int ipfr_knownfrag(ip)
+ip_t *ip;
+{
+ ipfr_t *f, frag;
+ u_int idx;
+
+ /*
+ * For fragments, we record protocol, packet id, TOS and both IP#'s
+ * (these should all be the same for all fragments of a packet).
+ */
+ frag.ipfr_p = ip->ip_p;
+ idx = ip->ip_p;
+ frag.ipfr_id = ip->ip_id;
+ idx += ip->ip_id;
+ frag.ipfr_tos = ip->ip_tos;
+ frag.ipfr_src.s_addr = ip->ip_src.s_addr;
+ idx += ip->ip_src.s_addr;
+ frag.ipfr_dst.s_addr = ip->ip_dst.s_addr;
+ idx += ip->ip_dst.s_addr;
+ idx *= 127;
+ idx %= IPFT_SIZE;
+
+ MUTEX_ENTER(&ipf_frag);
+ for (f = ipfr_heads[idx]; f; f = f->ipfr_next)
+ if (!bcmp((char *)&frag.ipfr_src, (char *)&f->ipfr_src,
+ IPFR_CMPSZ)) {
+ if (f != ipfr_heads[idx]) {
+ /*
+ * move fragment info. to the top of the list
+ * to speed up searches.
+ */
+ if ((f->ipfr_prev->ipfr_next = f->ipfr_next))
+ f->ipfr_next->ipfr_prev = f->ipfr_prev;
+ f->ipfr_next = ipfr_heads[idx];
+ ipfr_heads[idx]->ipfr_prev = f;
+ f->ipfr_prev = NULL;
+ ipfr_heads[idx] = f;
+ }
+ ipfr_stats.ifs_hits++;
+ return f->ipfr_pass;
+ }
+ MUTEX_EXIT(&ipf_frag);
+ return 0;
+}
+
+
+/*
+ * Free memory in use by fragment state info. kept.
+ */
+void ipfr_unload()
+{
+ ipfr_t **fp, *fr;
+ int idx;
+#if !SOLARIS
+ int s;
+#endif
+
+ MUTEX_ENTER(&ipf_frag);
+ SPLNET(s);
+ for (idx = IPFT_SIZE - 1; idx >= 0; idx--)
+ for (fp = &ipfr_heads[idx]; (fr = *fp); ) {
+ *fp = fr->ipfr_next;
+ KFREE(fp);
+ }
+ SPLX(s);
+ MUTEX_EXIT(&ipf_frag);
+}
+
+
+#ifdef _KERNEL
+/*
+ * Slowly expire held state for fragments. Timeouts are set * in expectation
+ * of this being called twice per second.
+ */
+# if BSD < 199306
+int ipfr_slowtimer()
+#else
+void ipfr_slowtimer()
+#endif
+{
+ ipfr_t **fp, *fr;
+ int s, idx;
+
+ MUTEX_ENTER(&ipf_frag);
+ SPLNET(s);
+
+ for (idx = IPFT_SIZE - 1; idx >= 0; idx--)
+ for (fp = &ipfr_heads[idx]; (fr = *fp); ) {
+ --fr->ipfr_ttl;
+ if (fr->ipfr_ttl == 0) {
+ if (fr->ipfr_prev)
+ fr->ipfr_prev->ipfr_next =
+ fr->ipfr_next;
+ if (fr->ipfr_next)
+ fr->ipfr_next->ipfr_prev =
+ fr->ipfr_prev;
+ *fp = fr->ipfr_next;
+ ipfr_stats.ifs_expire++;
+ ipfr_inuse--;
+ KFREE(fp);
+ } else
+ fp = &fr->ipfr_next;
+ }
+ SPLX(s);
+#if SOLARIS
+ MUTEX_EXIT(&ipf_frag);
+ fr_timeoutstate();
+ ip_natexpire();
+ ipfr_timer_id = timeout(ipfr_slowtimer, NULL, HZ/2);
+#else
+ fr_timeoutstate();
+ ip_natexpire();
+ ip_slowtimo();
+#endif
+# if BSD < 199306
+ return 0;
+# endif
+}
+#endif /* defined(_KERNEL) */
diff --git a/sys/netinet/ip_frag.h b/sys/netinet/ip_frag.h
new file mode 100644
index 00000000000..438c8392d73
--- /dev/null
+++ b/sys/netinet/ip_frag.h
@@ -0,0 +1,50 @@
+/*
+ * (C)opyright 1993, 1994, 1995 by Darren Reed.
+ *
+ * Redistribution and use in source and binary forms are permitted
+ * provided that this notice is preserved and due credit is given
+ * to the original author and the contributors.
+ *
+ * @(#)ip_frag.h 1.3 1/12/96
+ */
+
+#ifndef __IP_FRAG_H_
+#define __IP_FRAG_H__
+
+#define IPFT_SIZE 257
+
+typedef struct ipfr {
+ struct ipfr *ipfr_next, *ipfr_prev;
+ struct in_addr ipfr_src;
+ struct in_addr ipfr_dst;
+ u_short ipfr_id;
+ u_short ipfr_ttl;
+ u_char ipfr_p;
+ u_char ipfr_tos;
+ u_char ipfr_pass;
+} ipfr_t;
+
+#if defined(__STDC__) || defined(__GNUC__)
+#define SIOCGFRST _IOR('r', 76, struct ipfrstat)
+#else
+#define SIOCGFRST _IOR(r, 76, struct ipfrstat)
+#endif
+
+typedef struct ipfrstat {
+ u_long ifs_exists; /* add & already exists */
+ u_long ifs_nomem;
+ u_long ifs_new;
+ u_long ifs_hits;
+ u_long ifs_expire;
+ u_long ifs_inuse;
+ struct ipfr **ifs_table;
+} ipfrstat_t;
+
+#define IPFR_CMPSZ (4 + 4 + 2 + 1 + 1)
+
+extern ipfrstat_t *ipfr_fragstats();
+extern int ipfr_newfrag(), ipfr_knownfrag();
+# ifdef _KERNEL
+extern void ipfr_unload();
+# endif
+#endif /* __IP_FIL_H__ */
diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c
index 897583fcfb4..6b446c2780f 100644
--- a/sys/netinet/ip_input.c
+++ b/sys/netinet/ip_input.c
@@ -83,8 +83,7 @@ int ipqmaxlen = IFQ_MAXLEN;
struct in_ifaddrhead in_ifaddr;
struct ifqueue ipintrq;
#if defined(IPFILTER) || defined(IPFILTER_LKM)
-int fr_nullcheck();
-int (*fr_checkp) __P((struct ip *, int, struct ifnet *, int)) = fr_nullcheck;
+int (*fr_checkp) __P((struct ip *, int, struct ifnet *, int, struct mbuf **));
#endif
char *
@@ -240,8 +239,13 @@ next:
* Check if we want to allow this packet to be processed.
* Consider it to be bad if not.
*/
- if ((*fr_checkp)(ip, hlen, m->m_pkthdr.rcvif, 0))
- goto bad;
+ {
+ struct mbuf *m0 = m;
+ if (fr_checkp && (*fr_checkp)(ip, hlen, m->m_pkthdr.rcvif, 0, &m0))
+ goto next;
+ else
+ ip = mtod(m = m0, struct ip *);
+ }
#endif
/*
* Process options and, if not destined for us,
@@ -1185,10 +1189,3 @@ ip_sysctl(name, namelen, oldp, oldlenp, newp, newlen)
}
/* NOTREACHED */
}
-
-#if defined(IPFILTER) || defined(IPFILTER_LKM)
-int fr_nullcheck()
-{
- return 0;
-}
-#endif
diff --git a/sys/netinet/ip_nat.c b/sys/netinet/ip_nat.c
new file mode 100644
index 00000000000..52bd755a1d7
--- /dev/null
+++ b/sys/netinet/ip_nat.c
@@ -0,0 +1,497 @@
+/*
+ * (C)opyright 1995 by Darren Reed.
+ *
+ * Redistribution and use in source and binary forms are permitted
+ * provided that this notice is preserved and due credit is given
+ * to the original author and the contributors.
+ */
+#ifndef lint
+static char sccsid[] = "@(#)ip_nat.c 1.3 1/12/96 (C) 1995 Darren Reed";
+#endif
+
+#include <stdio.h>
+#include <string.h>
+#include <sys/errno.h>
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/file.h>
+#include <sys/ioctl.h>
+#include <sys/uio.h>
+#include <sys/protosw.h>
+#include <sys/socket.h>
+#if !defined(__SVR4) && !defined(__svr4__)
+# include <sys/dir.h>
+# include <sys/mbuf.h>
+#else
+# include <sys/byteorder.h>
+# include <sys/dditypes.h>
+# include <sys/stream.h>
+# include <sys/kmem.h>
+#endif
+
+#include <net/if.h>
+#ifdef sun
+#include <net/af.h>
+#endif
+#include <net/route.h>
+#include <netinet/in.h>
+#include <netinet/in_systm.h>
+#include <netinet/ip.h>
+#include <netinet/ip_var.h>
+#include <netinet/tcp.h>
+#include <netinet/udp.h>
+#include <netinet/tcpip.h>
+#include <netinet/ip_icmp.h>
+#include <syslog.h>
+#include "ip_fil.h"
+#include "ip_nat.h"
+#ifndef MIN
+#define MIN(a,b) (((a)<(b))?(a):(b))
+#endif
+
+nat_t *nat_table[2][NAT_SIZE];
+ipnat_t *nat_list = NULL;
+u_long nat_inuse = 0;
+natstat_t nat_stats;
+#if SOLARIS
+# ifndef _KERNEL
+#define bcmp(a,b,c) memcpy(a,b,c)
+#define bcopy(a,b,c) memmove(b,a,c)
+# else
+extern kmutex_t ipf_nat;
+# endif
+#endif
+
+
+/*
+ * How the NAT is organised and works.
+ *
+ * Inside (interface y) NAT Outside (interface x)
+ * -------------------- -+- -------------------------------------
+ * Packet going | out, processsed by ip_natout() for x
+ * ------------> | ------------>
+ * src=10.1.1.1 | src=192.1.1.1
+ * |
+ * | in, processed by ip_natin() for x
+ * <------------ | <------------
+ * dst=10.1.1.1 | dst=192.1.1.1
+ * -------------------- -+- -------------------------------------
+ * ip_natout() - changes ip_src and if required, sport
+ * - creates a new mapping, if required.
+ * ip_natin() - changes ip_dst and if required, dport
+ *
+ * In the NAT table, internal source is recorded as "in" and externally
+ * seen as "out".
+ */
+
+/*
+ * Handle ioctls which manipulate the NAT.
+ */
+int nat_ioctl(data, cmd)
+caddr_t data;
+int cmd;
+{
+ register ipnat_t *nat, *n, **np;
+
+ /*
+ * For add/delete, look to see if the NAT entry is already present
+ */
+ MUTEX_ENTER(&ipf_nat);
+ if ((cmd == SIOCADNAT) || (cmd == SIOCRMNAT)) {
+ nat = (ipnat_t *)data;
+ for (np = &nat_list; (n = *np); np = &n->in_next)
+ if (!bcmp((char *)&nat->in_port, (char *)&n->in_port,
+ IPN_CMPSIZ))
+ break;
+ }
+
+ switch (cmd)
+ {
+ case SIOCADNAT :
+ if (n) {
+ MUTEX_EXIT(&ipf_nat);
+ return EEXIST;
+ }
+ if (!(n = (ipnat_t *)KMALLOC(sizeof(*n)))) {
+ MUTEX_EXIT(&ipf_nat);
+ return ENOMEM;
+ }
+ IRCOPY((char *)data, (char *)np, sizeof(*np));
+ bcopy((char *)nat, (char *)n, sizeof(*n));
+ n->in_ifp = (void *)GETUNIT(n->in_ifname);
+ n->in_next = *np;
+ n->in_space = ~(0xffffffff & ntohl(n->in_outmsk));
+ n->in_space--; /* lose 1 for broadcast address */
+ n->in_nip = ntohl(n->in_outip) + 1;
+ n->in_pnext = ntohs(n->in_pmin);
+ *np = n;
+ break;
+ case SIOCRMNAT :
+ if (!n) {
+ MUTEX_EXIT(&ipf_nat);
+ return ESRCH;
+ }
+ *np = n->in_next;
+ KFREE(n);
+ break;
+ case SIOCGNATS :
+ nat_stats.ns_table = (nat_t ***)nat_table;
+ nat_stats.ns_list = nat_list;
+ nat_stats.ns_inuse = nat_inuse;
+ IWCOPY((char *)&nat_stats, (char *)data, sizeof(nat_stats));
+ break;
+ }
+ MUTEX_EXIT(&ipf_nat);
+ return 0;
+}
+
+
+/*
+ * Create a new NAT table entry.
+ */
+nat_t *nat_new(ip, hlen, flags)
+ip_t *ip;
+int hlen;
+u_short flags;
+{
+ u_short port = 0, sport = 0;
+ struct in_addr in;
+ tcphdr_t *tcp;
+ ipnat_t *np;
+ nat_t *nat, **natp;
+
+ if (flags) {
+ tcp = (tcphdr_t *)((char *)ip + hlen);
+ sport = tcp->th_sport;
+ }
+
+ MUTEX_ENTER(&ipf_nat);
+ /*
+ * Search the current table for a match.
+ */
+ do {
+ in.s_addr = np->in_nip;
+ if (np->in_flags & IPN_TCPUDP) {
+ port = htons(np->in_pnext++);
+ if (np->in_pnext >= ntohs(np->in_pmax)) {
+ np->in_pnext = ntohs(np->in_pmin);
+ np->in_nip++;
+ np->in_space--;
+ }
+ } else {
+ np->in_space--;
+ np->in_nip++;
+ }
+ if ((np->in_nip & ntohl(np->in_outmsk)) > ntohl(np->in_outip))
+ np->in_nip = ntohl(np->in_outip) + 1;
+ } while (nat_lookupinip(in, sport));
+
+ if (!(nat = (nat_t *)KMALLOC(sizeof(*nat)))) {
+ MUTEX_EXIT(&ipf_nat);
+ return NULL;
+ }
+ nat->nat_use = 0;
+ in.s_addr = htonl(in.s_addr);
+ nat->nat_inip = ip->ip_src;
+ nat->nat_outip = in;
+ nat->nat_sumd = (ntohl(ip->ip_src.s_addr) & 0xffff) +
+ (ntohl(ip->ip_src.s_addr) >> 16);
+ nat->nat_sumd -= ((ntohl(in.s_addr) & 0xffff) +
+ (ntohl(in.s_addr) >> 16));
+ if (sport) {
+ nat->nat_inport = sport;
+ nat->nat_outport = port;
+ nat->nat_sumd += (ntohs(sport) - ntohs(port));
+ } else {
+ nat->nat_inport = 0;
+ nat->nat_outport = 0;
+ }
+ natp = &nat_table[0][nat->nat_inip.s_addr % NAT_SIZE];
+ nat->nat_next = *natp;
+ *natp = nat;
+ nat->nat_use++;
+ natp = &nat_table[1][nat->nat_outip.s_addr % NAT_SIZE];
+ nat->nat_next = *natp;
+ *natp = nat;
+ nat->nat_use++;
+ ip->ip_src = in;
+ if (flags)
+ tcp->th_sport = htons(port);
+ nat_stats.ns_added++;
+ nat_inuse++;
+ MUTEX_EXIT(&ipf_nat);
+ return nat;
+}
+
+
+nat_t *nat_lookupoutip(ipaddr, sport)
+struct in_addr ipaddr;
+u_short sport;
+{
+ nat_t *nat;
+
+ nat = nat_table[1][ipaddr.s_addr % NAT_SIZE];
+
+ MUTEX_ENTER(&ipf_nat);
+ for (; nat; nat = nat->nat_next)
+ if (nat->nat_outip.s_addr == ipaddr.s_addr) {
+ if (nat->nat_outport && (sport != nat->nat_outport))
+ continue;
+ return nat;
+ }
+ MUTEX_EXIT(&ipf_nat);
+ return NULL;
+}
+
+
+/*
+ * Packets going out on the external interface go through this.
+ * Here, the source address requires alteration, if anything.
+ */
+void ip_natout(ifp, ip, hlen)
+struct ifnet *ifp;
+ip_t *ip;
+int hlen;
+{
+ register ipnat_t *np;
+ register u_long ipa;
+ register u_long sum1, sum2;
+ tcphdr_t *tcp;
+ nat_t *nat;
+ u_short nflags = 0, sport = 0;
+
+ if (ip->ip_p == IPPROTO_TCP)
+ nflags = IPN_TCP;
+ else if (ip->ip_p == IPPROTO_UDP)
+ nflags = IPN_UDP;
+ if (nflags) {
+ tcp = (tcphdr_t *)((char *)ip + hlen);
+ sport = tcp->th_sport;
+ }
+
+ ipa = ip->ip_src.s_addr;
+
+ MUTEX_ENTER(&ipf_nat);
+ for (np = nat_list; np; np = np->in_next)
+ if ((np->in_ifp == ifp) && np->in_space &&
+ (!np->in_flags || (np->in_flags & nflags)) &&
+ ((ipa & np->in_inmsk) == np->in_inip)) {
+ /*
+ * If there is no current entry in the nat table for
+ * this IP#, create one for it.
+ */
+ if (!(nat = nat_lookupinip(ip->ip_src, sport))) {
+ if (!(nat = nat_new(ip, hlen,
+ nflags & np->in_flags))) {
+ MUTEX_EXIT(&ipf_nat);
+ return;
+ }
+ } else
+ ip->ip_src = nat->nat_outip;
+
+ nat->nat_age = 1200; /* 5 mins */
+
+ /*
+ * Fix up checksums, not by recalculating them, but
+ * simply computing adjustments.
+ */
+ if (nflags) {
+ if (nat->nat_outport) {
+ sum1 += sport;
+ tcp->th_sport = nat->nat_outport;
+ sum2 += tcp->th_sport;
+ }
+
+ sum2 = nat->nat_sumd;
+
+ if (ip->ip_p == IPPROTO_TCP) {
+ sum2 += ntohs(tcp->th_sum);
+ sum2 = (sum2 >> 16) + (sum2 & 0xffff);
+ sum2 += (sum2 >> 16);
+ tcp->th_sum = htons(sum2);
+ } else if (ip->ip_p == IPPROTO_UDP) {
+ udphdr_t *udp = (udphdr_t *)tcp;
+
+ udp->uh_sum = 0;
+ }
+ }
+ nat_stats.ns_mapped[1]++;
+ MUTEX_EXIT(&ipf_nat);
+ return;
+ }
+ MUTEX_EXIT(&ipf_nat);
+ return;
+}
+
+nat_t *nat_lookupinip(ipaddr, sport)
+struct in_addr ipaddr;
+u_short sport;
+{
+ nat_t *nat;
+
+ nat = nat_table[0][ipaddr.s_addr % NAT_SIZE];
+
+ MUTEX_ENTER(&ipf_nat);
+ for (; nat; nat = nat->nat_next)
+ if (nat->nat_inip.s_addr == ipaddr.s_addr) {
+ if (nat->nat_inport && (sport != nat->nat_inport))
+ continue;
+ return nat;
+ }
+ MUTEX_EXIT(&ipf_nat);
+ return NULL;
+}
+
+
+/*
+ * Packets coming in from the external interface go through this.
+ * Here, the destination address requires alteration, if anything.
+ */
+void ip_natin(ifp, ip, hlen)
+struct ifnet *ifp;
+ip_t *ip;
+int hlen;
+{
+ register ipnat_t *np;
+ register struct in_addr in;
+ register u_long sum1, sum2;
+ tcphdr_t *tcp;
+ u_short port = 0, nflags;
+ nat_t *nat;
+
+ if (ip->ip_p == IPPROTO_TCP)
+ nflags = IPN_TCP;
+ else if (ip->ip_p == IPPROTO_UDP)
+ nflags = IPN_UDP;
+ if (nflags) {
+ tcp = (tcphdr_t *)((char *)ip + hlen);
+ port = tcp->th_dport;
+ }
+
+ in = ip->ip_dst;
+
+ MUTEX_ENTER(&ipf_nat);
+ for (np = nat_list; np; np = np->in_next)
+ if ((np->in_ifp == ifp) &&
+ (!np->in_flags || (nflags & np->in_flags)) &&
+ ((in.s_addr & np->in_outmsk) == np->in_outip)) {
+ if (!(nat = nat_lookupoutip(in, port)))
+ continue;
+ nat->nat_age = 1200;
+ ip->ip_dst = nat->nat_inip;
+
+ /*
+ * Fix up checksums, not by recalculating them, but
+ * simply computing adjustments.
+ */
+
+ if (nflags) {
+ u_short *sp = NULL;
+
+ if (nat->nat_inport) {
+ sum1 += port;
+ tcp->th_dport = nat->nat_inport;
+ sum2 += tcp->th_dport;
+ }
+
+ sum2 = nat->nat_sumd;
+
+ if (ip->ip_p == IPPROTO_TCP) {
+ sp = &tcp->th_sum;
+ if (ntohs(*sp) > sum2)
+ sum2--;
+ sum2 -= ntohs(*sp);
+ sum2 = (sum2 >> 16) + (sum2 & 0xffff);
+ sum2 += (sum2 >> 16);
+ *sp = htons(~sum2);
+ } else if (ip->ip_p == IPPROTO_UDP) {
+ udphdr_t *udp = (udphdr_t *)tcp;
+
+ udp->uh_sum = 0;
+ }
+ }
+ nat_stats.ns_mapped[0]++;
+ MUTEX_EXIT(&ipf_nat);
+ return;
+ }
+ MUTEX_EXIT(&ipf_nat);
+ return;
+}
+
+
+/*
+ * Free all memory used by NAT structures allocated at runtime.
+ */
+void ip_natunload()
+{
+ register struct nat *nat, **natp;
+ register struct ipnat *ipn, **ipnp;
+ register int i;
+
+ MUTEX_ENTER(&ipf_nat);
+ for (i = 0; i < NAT_SIZE; i++)
+ for (natp = &nat_table[0][i]; (nat = *natp); ) {
+ *natp = nat->nat_next;
+ if (!--nat->nat_use)
+ KFREE(nat);
+ }
+ for (i = 0; i < NAT_SIZE; i++)
+ for (natp = &nat_table[1][i]; (nat = *natp); ) {
+ *natp = nat->nat_next;
+ if (!--nat->nat_use)
+ KFREE(nat);
+ }
+
+ for (ipnp = &nat_list; (ipn = *ipnp); ) {
+ *ipnp = ipn->in_next;
+ KFREE(ipn);
+ }
+ MUTEX_EXIT(&ipf_nat);
+}
+
+
+/*
+ * Slowly expire held state for NAT entries. Timeouts are set in
+ * expectation of this being called twice per second.
+ */
+void ip_natexpire()
+{
+ register struct nat *nat, **natp;
+ register int i;
+
+ MUTEX_ENTER(&ipf_nat);
+ for (i = 0; i < NAT_SIZE; i++)
+ for (natp = &nat_table[0][i]; (nat = *natp); ) {
+ if (nat->nat_age > 0)
+ nat->nat_age--;
+ if (!nat->nat_use || !nat->nat_age) {
+ *natp = nat->nat_next;
+ if (nat->nat_use)
+ nat->nat_use--;
+ if (!nat->nat_use) {
+ KFREE(nat);
+ nat_stats.ns_expire++;
+ nat_inuse--;
+ }
+ } else
+ natp = &nat->nat_next;
+ }
+
+ for (i = 0; i < NAT_SIZE; i++)
+ for (natp = &nat_table[1][i]; (nat = *natp); ) {
+ if (nat->nat_age > 0)
+ nat->nat_age--;
+ if (!nat->nat_use || !nat->nat_age) {
+ *natp = nat->nat_next;
+ if (nat->nat_use)
+ nat->nat_use--;
+ if (!nat->nat_use) {
+ KFREE(nat);
+ nat_stats.ns_expire++;
+ nat_inuse--;
+ }
+ } else
+ natp = &nat->nat_next;
+ }
+ MUTEX_EXIT(&ipf_nat);
+}
diff --git a/sys/netinet/ip_nat.h b/sys/netinet/ip_nat.h
new file mode 100644
index 00000000000..be38821806e
--- /dev/null
+++ b/sys/netinet/ip_nat.h
@@ -0,0 +1,81 @@
+/*
+ * (C)opyright 1995 by Darren Reed.
+ *
+ * Redistribution and use in source and binary forms are permitted
+ * provided that this notice is preserved and due credit is given
+ * to the original author and the contributors.
+ *
+ * @(#)ip_nat.h 1.3 1/12/96
+ */
+
+#ifndef __IP_NAT_H_
+#define __IP_NAT_H__
+
+#ifndef SOLARIS
+#define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4)))
+#endif
+
+#if defined(__STDC__) || defined(__GNUC__)
+#define SIOCADNAT _IOW('r', 80, struct ipnat)
+#define SIOCRMNAT _IOW('r', 81, struct ipnat)
+#define SIOCGNATS _IOR('r', 82, struct natstat)
+#else
+#define SIOCADNAT _IOW(r, 80, struct ipnat)
+#define SIOCRMNAT _IOW(r, 81, struct ipnat)
+#define SIOCGNATS _IOR(r, 82, struct natstat)
+#endif
+
+#define NAT_SIZE 367
+
+typedef struct nat {
+ struct nat *nat_next;
+ u_short nat_use;
+ short nat_age;
+ u_long nat_sumd;
+ struct in_addr nat_inip;
+ struct in_addr nat_outip;
+ u_short nat_inport;
+ u_short nat_outport;
+} nat_t;
+
+typedef struct ipnat {
+ struct ipnat *in_next;
+ void *in_ifp;
+ u_short in_flags;
+ u_short in_pnext;
+ u_short in_port[2];
+ struct in_addr in_in[2];
+ struct in_addr in_out[2];
+ struct in_addr in_nextip;
+ int in_space;
+ char in_ifname[IFNAMSIZ];
+} ipnat_t;
+
+#define in_pmin in_port[0]
+#define in_pmax in_port[1]
+#define in_nip in_nextip.s_addr
+#define in_inip in_in[0].s_addr
+#define in_inmsk in_in[1].s_addr
+#define in_outip in_out[0].s_addr
+#define in_outmsk in_out[1].s_addr
+
+#define IPN_CMPSIZ (sizeof(struct in_addr) * 4 + sizeof(u_short) * 2)
+
+typedef struct natstat {
+ u_long ns_mapped[2];
+ u_long ns_added;
+ u_long ns_expire;
+ u_long ns_inuse;
+ nat_t ***ns_table;
+ ipnat_t *ns_list;
+} natstat_t;
+
+#define IPN_ANY 0
+#define IPN_TCP 1
+#define IPN_UDP 2
+#define IPN_TCPUDP 3
+
+extern int nat_ioctl();
+extern nat_t *nat_lookupoutip(), *nat_lookupinip();
+extern void ip_natout(), ip_natin(), ip_natunload(), ip_natexpire();
+#endif /* __IP_NAT_H__ */
diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c
index 7e7d7097b37..cb399c1cfff 100644
--- a/sys/netinet/ip_output.c
+++ b/sys/netinet/ip_output.c
@@ -61,7 +61,7 @@ static struct mbuf *ip_insertoptions __P((struct mbuf *, struct mbuf *, int *));
static void ip_mloopback
__P((struct ifnet *, struct mbuf *, struct sockaddr_in *));
#if defined(IPFILTER) || defined(IPFILTER_LKM)
-extern int (*fr_checkp) __P((struct ip *, int, struct ifnet *, int));
+extern int (*fr_checkp) __P((struct ip *, int, struct ifnet *, int, struct mbuf **));
#endif
/*
@@ -283,10 +283,13 @@ ip_output(m0, opt, ro, flags, imo)
/*
* looks like most checking has been done now...do a filter check
*/
- if ((*fr_checkp)(ip, hlen, ifp, 1))
{
- error = EHOSTUNREACH;
- goto bad;
+ struct mbuf *m0 = m;
+ if (fr_checkp && (*fr_checkp)(ip, hlen, ifp, 1, &m0)) {
+ error = EHOSTUNREACH;
+ goto done;
+ } else
+ ip = mtod(m = m0, struct ip *);
}
#endif
sendit:
diff --git a/sys/netinet/ip_state.c b/sys/netinet/ip_state.c
new file mode 100644
index 00000000000..69491a9844f
--- /dev/null
+++ b/sys/netinet/ip_state.c
@@ -0,0 +1,393 @@
+/*
+ * (C)opyright 1995 by Darren Reed.
+ *
+ * Redistribution and use in source and binary forms are permitted
+ * provided that this notice is preserved and due credit is given
+ * to the original author and the contributors.
+ */
+#ifndef lint
+static char sccsid[] = "@(#)ip_state.c 1.3 1/12/96 (C) 1993-1995 Darren Reed";
+#endif
+
+#include <string.h>
+#ifndef linux
+#include <sys/errno.h>
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/file.h>
+#include <sys/ioctl.h>
+#include <sys/uio.h>
+#include <sys/protosw.h>
+#include <sys/socket.h>
+#if !defined(__SVR4) && !defined(__svr4__)
+# include <sys/dir.h>
+# include <sys/mbuf.h>
+#else
+# include <sys/byteorder.h>
+# include <sys/dditypes.h>
+# include <sys/stream.h>
+# include <sys/kmem.h>
+#endif
+
+#include <net/if.h>
+#ifdef sun
+#include <net/af.h>
+#endif
+#include <net/route.h>
+#include <netinet/in.h>
+#include <netinet/in_systm.h>
+#include <netinet/ip.h>
+#include <netinet/ip_var.h>
+#include <netinet/tcp.h>
+#include <netinet/udp.h>
+#include <netinet/tcpip.h>
+#include <netinet/ip_icmp.h>
+#include <syslog.h>
+#endif
+#include "ip_fil.h"
+#include "ip_state.h"
+#ifndef MIN
+#define MIN(a,b) (((a)<(b))?(a):(b))
+#endif
+
+#define TCP_CLOSE (TH_FIN|TH_RST)
+
+ipstate_t *ips_table[IPSTATE_SIZE];
+int ips_num = 0;
+ips_stat_t ips_stats;
+#if SOLARIS
+extern kmutex_t ipf_state;
+# if !defined(_KERNEL)
+#define bcopy(a,b,c) memmove(b,a,c)
+# endif
+#endif
+
+
+ips_stat_t *fr_statetstats()
+{
+ ips_stats.iss_active = ips_num;
+ ips_stats.iss_table = ips_table;
+ return &ips_stats;
+}
+
+
+#define PAIRS(s1,d1,s2,d2) ((((s1) == (s2)) && ((d1) == (d2))) ||\
+ (((s1) == (d2)) && ((d1) == (s2))))
+#define IPPAIR(s1,d1,s2,d2) PAIRS((s1).s_addr, (d1).s_addr, \
+ (s2).s_addr, (d2).s_addr)
+
+/*
+ * Create a new ipstate structure and hang it off the hash table.
+ */
+int fr_addstate(ip, hlen, pass)
+ip_t *ip;
+int hlen;
+u_int pass;
+{
+ ipstate_t ips;
+ register ipstate_t *is = &ips;
+ register u_int hv;
+
+ if (ips_num == IPSTATE_MAX) {
+ ips_stats.iss_max++;
+ return -1;
+ }
+ /*
+ * Copy and calculate...
+ */
+ hv = (is->is_p = ip->ip_p);
+ hv += (is->is_src.s_addr = ip->ip_src.s_addr);
+ hv += (is->is_dst.s_addr = ip->ip_dst.s_addr);
+
+ switch (ip->ip_p)
+ {
+ case IPPROTO_ICMP :
+ {
+ struct icmp *ic = (struct icmp *)((char *)ip + hlen);
+
+ switch (ic->icmp_type)
+ {
+ case ICMP_ECHO :
+ is->is_icmp.ics_type = 0;
+ hv += (is->is_icmp.ics_id = ic->icmp_id);
+ hv += (is->is_icmp.ics_seq = ic->icmp_seq);
+ break;
+ case ICMP_TSTAMP :
+ case ICMP_IREQ :
+ case ICMP_MASKREQ :
+ is->is_icmp.ics_type = ic->icmp_type + 1;
+ break;
+ default :
+ return -1;
+ }
+ ips_stats.iss_icmp++;
+ is->is_age = 120;
+ break;
+ }
+ case IPPROTO_TCP :
+ {
+ register tcphdr_t *tcp = (tcphdr_t *)((char *)ip + hlen);
+
+ /*
+ * The endian of the ports doesn't matter, but the ack and
+ * sequence numbers do as we do mathematics on them later.
+ */
+ hv += (is->is_dport = tcp->th_dport);
+ hv += (is->is_sport = tcp->th_sport);
+ is->is_seq = ntohl(tcp->th_seq);
+ is->is_ack = ntohl(tcp->th_ack);
+ is->is_win = ntohs(tcp->th_win);
+ ips_stats.iss_tcp++;
+ /*
+ * If we're creating state for a starting connectoin, start the
+ * timer on it as we'll never see an error if it fails to
+ * connect.
+ */
+ if ((tcp->th_flags & (TH_SYN|TH_ACK)) == TH_SYN)
+ is->is_age = 120;
+ else
+ is->is_age = 0;
+ break;
+ }
+ case IPPROTO_UDP :
+ {
+ register tcphdr_t *tcp = (tcphdr_t *)((char *)ip + hlen);
+
+ hv += (is->is_dport = tcp->th_dport);
+ hv += (is->is_sport = tcp->th_sport);
+ ips_stats.iss_udp++;
+ is->is_age = 120;
+ break;
+ }
+ default :
+ return -1;
+ }
+
+ if (!(is = (ipstate_t *)KMALLOC(sizeof(*is)))) {
+ ips_stats.iss_nomem++;
+ return -1;
+ }
+ bcopy((char *)&ips, (char *)is, sizeof(*is));
+ hv %= IPSTATE_SIZE;
+ MUTEX_ENTER(&ipf_state);
+ is->is_next = ips_table[hv];
+ ips_table[hv] = is;
+ is->is_pass = pass;
+ ips_num++;
+ MUTEX_EXIT(&ipf_state);
+ return 0;
+}
+
+
+/*
+ * Check if a packet has a registered state.
+ */
+int fr_checkstate(ip, hlen)
+ip_t *ip;
+int hlen;
+{
+ register struct in_addr dst, src;
+ register ipstate_t *is, **isp;
+ register u_char pr;
+ struct icmp *ic;
+ tcphdr_t *tcp;
+ u_int hv;
+
+ tcp = (tcphdr_t *)((char *)ip + hlen);
+ ic = (struct icmp *)tcp;
+ hv = (pr = ip->ip_p);
+ hv += (src.s_addr = ip->ip_src.s_addr);
+ hv += (dst.s_addr = ip->ip_dst.s_addr);
+
+ /*
+ * Search the hash table for matching packet header info.
+ */
+ switch (ip->ip_p)
+ {
+ case IPPROTO_ICMP :
+ hv += ic->icmp_id;
+ hv += ic->icmp_seq;
+ hv %= IPSTATE_SIZE;
+ MUTEX_ENTER(&ipf_state);
+ for (isp = &ips_table[hv]; (is = *isp); isp = &is->is_next)
+ if ((is->is_p == pr) &&
+ (ic->icmp_id == is->is_icmp.ics_id) &&
+ (ic->icmp_seq == is->is_icmp.ics_seq) &&
+ IPPAIR(src, dst, is->is_src, is->is_dst)) {
+ /*
+ * If we have type 0 stored, allow any icmp
+ * replies through.
+ */
+ if (is->is_icmp.ics_type &&
+ is->is_icmp.ics_type != ic->icmp_type)
+ continue;
+ is->is_age = 120;
+ ips_stats.iss_hits++;
+ MUTEX_EXIT(&ipf_state);
+ return is->is_pass;
+ }
+ MUTEX_EXIT(&ipf_state);
+ break;
+ case IPPROTO_TCP :
+ {
+ register u_short dport = tcp->th_dport, sport = tcp->th_sport;
+ register u_short win = ntohs(tcp->th_win);
+ tcp_seq seq, ack;
+
+ hv += dport;
+ hv += sport;
+ hv %= IPSTATE_SIZE;
+ MUTEX_ENTER(&ipf_state);
+ for (isp = &ips_table[hv]; (is = *isp); isp = &is->is_next) {
+ register int dl, seqskew, ackskew;
+
+ if ((is->is_p == pr) &&
+ PAIRS(sport, dport, is->is_sport, is->is_dport) &&
+ IPPAIR(src, dst, is->is_src, is->is_dst)) {
+ dl = ip->ip_len - hlen - sizeof(tcphdr_t);
+ /*
+ * Find difference between last checked packet
+ * and this packet.
+ */
+ seq = ntohl(tcp->th_seq);
+ ack = ntohl(tcp->th_ack);
+ if (sport == is->is_sport) {
+ seqskew = seq - is->is_seq;
+ ackskew = ack - is->is_ack;
+ } else {
+ seqskew = ack - is->is_seq;
+ if (!is->is_ack) {
+ /*
+ * Must be a SYN-ACK in reply
+ * to a SYN. Set age timeout
+ * to 0 to stop deletion.
+ */
+ is->is_ack = seq;
+ is->is_age = 0;
+ }
+ ackskew = seq - is->is_ack;
+ }
+
+ /*
+ * Make skew values absolute
+ */
+ if (seqskew < 0)
+ seqskew = -seqskew;
+ if (ackskew < 0)
+ ackskew = -ackskew;
+ /*
+ * If the difference in sequence and ack
+ * numbers is within the window size of the
+ * connection, store these values and match
+ * the packet.
+ */
+ if ((seqskew <= win) && (ackskew <= win)) {
+ is->is_win = win;
+ if (sport == is->is_sport) {
+ is->is_seq = seq;
+ is->is_ack = ack;
+ } else {
+ is->is_seq = ack;
+ is->is_ack = seq;
+ }
+ ips_stats.iss_hits++;
+ /*
+ * Nearing end of connection, start
+ * timeout.
+ */
+#ifdef _KERNEL
+ if ((tcp->th_flags & TCP_CLOSE) &&
+ !is->is_age)
+ is->is_age = 120;
+ MUTEX_EXIT(&ipf_state);
+ return is->is_pass;
+#else
+ if (tcp->th_flags & TCP_CLOSE) {
+ int pass = is->is_pass;
+
+ *isp = is->is_next;
+ isp = &ips_table[hv];
+ KFREE(is);
+ return pass;
+ }
+ return is->is_pass;
+#endif
+ }
+ }
+ }
+ MUTEX_EXIT(&ipf_state);
+ break;
+ }
+ case IPPROTO_UDP :
+ {
+ register u_short dport = tcp->th_dport, sport = tcp->th_sport;
+
+ hv += dport;
+ hv += sport;
+ hv %= IPSTATE_SIZE;
+ /*
+ * Nothing else to match on but ports. and IP#'s
+ */
+ MUTEX_ENTER(&ipf_state);
+ for (is = ips_table[hv]; is; is = is->is_next)
+ if ((is->is_p == pr) &&
+ PAIRS(sport, dport, is->is_sport, is->is_dport) &&
+ IPPAIR(src, dst, is->is_src, is->is_dst)) {
+ ips_stats.iss_hits++;
+ is->is_age = 120;
+ MUTEX_EXIT(&ipf_state);
+ return is->is_pass;
+ }
+ MUTEX_EXIT(&ipf_state);
+ break;
+ }
+ default :
+ break;
+ }
+ ips_stats.iss_miss++;
+ return 0;
+}
+
+
+/*
+ * Free memory in use by all state info. kept.
+ */
+void fr_stateunload()
+{
+ register int i;
+ register ipstate_t *is, **isp;
+
+ MUTEX_ENTER(&ipf_state);
+ for (i = 0; i < IPSTATE_SIZE; i++)
+ for (isp = &ips_table[i]; (is = *isp); ) {
+ *isp = is->is_next;
+ KFREE(is);
+ }
+ MUTEX_EXIT(&ipf_state);
+}
+
+
+/*
+ * Slowly expire held state for thingslike UDP and ICMP. Timeouts are set
+ * in expectation of this being called twice per second.
+ */
+void fr_timeoutstate()
+{
+ register int i;
+ register ipstate_t *is, **isp;
+
+ MUTEX_ENTER(&ipf_state);
+ for (i = 0; i < IPSTATE_SIZE; i++)
+ for (isp = &ips_table[i]; (is = *isp); )
+ if (is->is_age && !--is->is_age) {
+ *isp = is->is_next;
+ if (is->is_p == IPPROTO_TCP)
+ ips_stats.iss_fin++;
+ else
+ ips_stats.iss_expire++;
+ KFREE(is);
+ ips_num--;
+ } else
+ isp = &is->is_next;
+ MUTEX_EXIT(&ipf_state);
+}
diff --git a/sys/netinet/ip_state.h b/sys/netinet/ip_state.h
new file mode 100644
index 00000000000..d22c930504d
--- /dev/null
+++ b/sys/netinet/ip_state.h
@@ -0,0 +1,84 @@
+/*
+ * (C)opyright 1995 by Darren Reed.
+ *
+ * Redistribution and use in source and binary forms are permitted
+ * provided that this notice is preserved and due credit is given
+ * to the original author and the contributors.
+ *
+ * @(#)ip_state.h 1.3 1/12/96 (C) 1995 Darren Reed
+ */
+#ifndef __IP_STATE_H__
+#define __IP_STATE_H__
+
+#define IPSTATE_SIZE 257
+#define IPSTATE_MAX 2048 /* Maximum number of states held */
+
+typedef struct udpstate {
+ u_short us_sport;
+ u_short us_dport;
+} udpstate_t;
+
+typedef struct icmpstate {
+ u_short ics_id;
+ u_short ics_seq;
+ u_char ics_type;
+} icmpstate_t;
+
+typedef struct tcpstate {
+ u_short ts_sport;
+ u_short ts_dport;
+ u_long ts_seq;
+ u_long ts_ack;
+ u_short ts_win;
+} tcpstate_t;
+
+typedef struct ipstate {
+ struct ipstate *is_next;
+ int is_age;
+ u_int is_pass;
+ struct in_addr is_src;
+ struct in_addr is_dst;
+ u_char is_p;
+ union {
+ icmpstate_t is_ics;
+ tcpstate_t is_ts;
+ udpstate_t is_us;
+ } is_ps;
+} ipstate_t;
+
+#define is_icmp is_ps.is_ics
+#define is_tcp is_ps.is_ts
+#define is_udp is_ps.is_us
+#define is_seq is_tcp.ts_seq
+#define is_ack is_tcp.ts_ack
+#define is_win is_tcp.ts_win
+#define is_sport is_tcp.ts_sport
+#define is_dport is_tcp.ts_dport
+
+#if defined(__STDC__) || defined(__GNUC__)
+#define SIOCGIPST _IOR('r', 75, struct ips_stat)
+#else
+#define SIOCGIPST _IOR(r, 75, struct ips_stat)
+#endif
+
+typedef struct ips_stat {
+ u_long iss_hits;
+ u_long iss_miss;
+ u_long iss_max;
+ u_long iss_tcp;
+ u_long iss_udp;
+ u_long iss_icmp;
+ u_long iss_nomem;
+ u_long iss_expire;
+ u_long iss_fin;
+ u_long iss_active;
+ ipstate_t **iss_table;
+} ips_stat_t;
+
+extern ips_stat_t *fr_statetstats();
+extern int fr_addstate(), fr_checkstate();
+extern void fr_timeoutstate();
+# ifdef _KERNEL
+extern void fr_stateunload();
+# endif
+#endif /* __IP_STATE_H__ */
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-30 04:29:28 +0000