1e58c464e62204fa1858e3fb7c4eb52c9eefdc4c
[dragonfly.git] / sys / net / pf / pf.c
1 /*      $FreeBSD: src/sys/contrib/pf/net/pf.c,v 1.19 2004/09/11 11:18:25 mlaier Exp $   */
2 /*      $OpenBSD: pf.c,v 1.433.2.2 2004/07/17 03:22:34 brad Exp $ */
3 /* add  $OpenBSD: pf.c,v 1.448 2004/05/11 07:34:11 dhartmei Exp $ */
4 /*      $DragonFly: src/sys/net/pf/pf.c,v 1.15 2008/04/06 18:58:16 dillon Exp $ */
5
6 /*
7  * Copyright (c) 2004 The DragonFly Project.  All rights reserved.
8  *
9  * Copyright (c) 2001 Daniel Hartmeier
10  * Copyright (c) 2002,2003 Henning Brauer
11  * All rights reserved.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  *
17  *    - Redistributions of source code must retain the above copyright
18  *      notice, this list of conditions and the following disclaimer.
19  *    - Redistributions in binary form must reproduce the above
20  *      copyright notice, this list of conditions and the following
21  *      disclaimer in the documentation and/or other materials provided
22  *      with the distribution.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
25  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
26  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
27  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
28  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
29  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
30  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
31  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
32  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
34  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
35  * POSSIBILITY OF SUCH DAMAGE.
36  *
37  * Effort sponsored in part by the Defense Advanced Research Projects
38  * Agency (DARPA) and Air Force Research Laboratory, Air Force
39  * Materiel Command, USAF, under agreement number F30602-01-2-0537.
40  *
41  */
42
43 #include "opt_inet.h"
44 #include "opt_inet6.h"
45 #include "use_pfsync.h"
46
47 #include <sys/param.h>
48 #include <sys/systm.h>
49 #include <sys/malloc.h>
50 #include <sys/mbuf.h>
51 #include <sys/filio.h>
52 #include <sys/socket.h>
53 #include <sys/socketvar.h>
54 #include <sys/kernel.h>
55 #include <sys/time.h>
56 #include <sys/sysctl.h>
57 #include <sys/endian.h>
58 #include <vm/vm_zone.h>
59
60 #include <machine/inttypes.h>
61
62 #include <net/if.h>
63 #include <net/if_types.h>
64 #include <net/bpf.h>
65 #include <net/netisr.h>
66 #include <net/route.h>
67
68 #include <netinet/in.h>
69 #include <netinet/in_var.h>
70 #include <netinet/in_systm.h>
71 #include <netinet/ip.h>
72 #include <netinet/ip_var.h>
73 #include <netinet/tcp.h>
74 #include <netinet/tcp_seq.h>
75 #include <netinet/udp.h>
76 #include <netinet/ip_icmp.h>
77 #include <netinet/in_pcb.h>
78 #include <netinet/tcp_timer.h>
79 #include <netinet/tcp_var.h>
80 #include <netinet/udp_var.h>
81 #include <netinet/icmp_var.h>
82
83 #include <net/pf/pfvar.h>
84 #include <net/pf/if_pflog.h>
85
86 #if NPFSYNC > 0
87 #include <net/pf/if_pfsync.h>
88 #endif /* NPFSYNC > 0 */
89
90 #ifdef INET6
91 #include <netinet/ip6.h>
92 #include <netinet/in_pcb.h>
93 #include <netinet/icmp6.h>
94 #include <netinet6/nd6.h>
95 #include <netinet6/ip6_var.h>
96 #include <netinet6/in6_pcb.h>
97 #endif /* INET6 */
98
99 #include <sys/in_cksum.h>
100 #include <sys/ucred.h>
101 #include <machine/limits.h>
102 #include <sys/msgport2.h>
103 #include <net/netmsg2.h>
104
105 extern int ip_optcopy(struct ip *, struct ip *);
106
107 #define DPFPRINTF(n, x) if (pf_status.debug >= (n)) kprintf x
108
109 /*
110  * Global variables
111  */
112
113 struct pf_anchorqueue    pf_anchors;
114 struct pf_ruleset        pf_main_ruleset;
115 struct pf_altqqueue      pf_altqs[2];
116 struct pf_palist         pf_pabuf;
117 struct pf_altqqueue     *pf_altqs_active;
118 struct pf_altqqueue     *pf_altqs_inactive;
119 struct pf_status         pf_status;
120
121 u_int32_t                ticket_altqs_active;
122 u_int32_t                ticket_altqs_inactive;
123 int                      altqs_inactive_open;
124 u_int32_t                ticket_pabuf;
125
126 struct callout           pf_expire_to;                  /* expire timeout */
127
128 vm_zone_t                pf_src_tree_pl, pf_rule_pl;
129 vm_zone_t                pf_state_pl, pf_altq_pl, pf_pooladdr_pl;
130
131 void                     pf_print_host(struct pf_addr *, u_int16_t, u_int8_t);
132 void                     pf_print_state(struct pf_state *);
133 void                     pf_print_flags(u_int8_t);
134
135 u_int16_t                pf_cksum_fixup(u_int16_t, u_int16_t, u_int16_t,
136                             u_int8_t);
137 void                     pf_change_ap(struct pf_addr *, u_int16_t *,
138                             u_int16_t *, u_int16_t *, struct pf_addr *,
139                             u_int16_t, u_int8_t, sa_family_t);
140 #ifdef INET6
141 void                     pf_change_a6(struct pf_addr *, u_int16_t *,
142                             struct pf_addr *, u_int8_t);
143 #endif /* INET6 */
144 void                     pf_change_icmp(struct pf_addr *, u_int16_t *,
145                             struct pf_addr *, struct pf_addr *, u_int16_t,
146                             u_int16_t *, u_int16_t *, u_int16_t *,
147                             u_int16_t *, u_int8_t, sa_family_t);
148 void                     pf_send_tcp(const struct pf_rule *, sa_family_t,
149                             const struct pf_addr *, const struct pf_addr *,
150                             u_int16_t, u_int16_t, u_int32_t, u_int32_t,
151                             u_int8_t, u_int16_t, u_int16_t, u_int8_t);
152 void                     pf_send_icmp(struct mbuf *, u_int8_t, u_int8_t,
153                             sa_family_t, struct pf_rule *);
154 struct pf_rule          *pf_match_translation(struct pf_pdesc *, struct mbuf *,
155                             int, int, struct pfi_kif *,
156                             struct pf_addr *, u_int16_t, struct pf_addr *,
157                             u_int16_t, int);
158 struct pf_rule          *pf_get_translation(struct pf_pdesc *, struct mbuf *,
159                             int, int, struct pfi_kif *, struct pf_src_node **,
160                             struct pf_addr *, u_int16_t,
161                             struct pf_addr *, u_int16_t,
162                             struct pf_addr *, u_int16_t *);
163 int                      pf_test_tcp(struct pf_rule **, struct pf_state **,
164                             int, struct pfi_kif *, struct mbuf *, int,
165                             void *, struct pf_pdesc *, struct pf_rule **,
166                             struct pf_ruleset **);
167 int                      pf_test_udp(struct pf_rule **, struct pf_state **,
168                             int, struct pfi_kif *, struct mbuf *, int,
169                             void *, struct pf_pdesc *, struct pf_rule **,
170                             struct pf_ruleset **);
171 int                      pf_test_icmp(struct pf_rule **, struct pf_state **,
172                             int, struct pfi_kif *, struct mbuf *, int,
173                             void *, struct pf_pdesc *, struct pf_rule **,
174                             struct pf_ruleset **);
175 int                      pf_test_other(struct pf_rule **, struct pf_state **,
176                             int, struct pfi_kif *, struct mbuf *, int, void *,
177                             struct pf_pdesc *, struct pf_rule **,
178                             struct pf_ruleset **);
179 int                      pf_test_fragment(struct pf_rule **, int,
180                             struct pfi_kif *, struct mbuf *, void *,
181                             struct pf_pdesc *, struct pf_rule **,
182                             struct pf_ruleset **);
183 int                      pf_test_state_tcp(struct pf_state **, int,
184                             struct pfi_kif *, struct mbuf *, int,
185                             void *, struct pf_pdesc *, u_short *);
186 int                      pf_test_state_udp(struct pf_state **, int,
187                             struct pfi_kif *, struct mbuf *, int,
188                             void *, struct pf_pdesc *);
189 int                      pf_test_state_icmp(struct pf_state **, int,
190                             struct pfi_kif *, struct mbuf *, int,
191                             void *, struct pf_pdesc *);
192 int                      pf_test_state_other(struct pf_state **, int,
193                             struct pfi_kif *, struct pf_pdesc *);
194 static int               pf_match_tag(struct mbuf *, struct pf_rule *,
195                                       struct pf_rule *, int *);
196 void                     pf_hash(struct pf_addr *, struct pf_addr *,
197                             struct pf_poolhashkey *, sa_family_t);
198 int                      pf_map_addr(u_int8_t, struct pf_rule *,
199                             struct pf_addr *, struct pf_addr *,
200                             struct pf_addr *, struct pf_src_node **);
201 int                      pf_get_sport(sa_family_t, u_int8_t, struct pf_rule *,
202                             struct pf_addr *, struct pf_addr *, u_int16_t,
203                             struct pf_addr *, u_int16_t*, u_int16_t, u_int16_t,
204                             struct pf_src_node **);
205 void                     pf_route(struct mbuf **, struct pf_rule *, int,
206                             struct ifnet *, struct pf_state *);
207 void                     pf_route6(struct mbuf **, struct pf_rule *, int,
208                             struct ifnet *, struct pf_state *);
209 int                      pf_socket_lookup(uid_t *, gid_t *,
210                             int, struct pf_pdesc *);
211 u_int8_t                 pf_get_wscale(struct mbuf *, int, u_int16_t,
212                             sa_family_t);
213 u_int16_t                pf_get_mss(struct mbuf *, int, u_int16_t,
214                             sa_family_t);
215 u_int16_t                pf_calc_mss(struct pf_addr *, sa_family_t,
216                                 u_int16_t);
217 void                     pf_set_rt_ifp(struct pf_state *,
218                             struct pf_addr *);
219 int                      pf_check_proto_cksum(struct mbuf *, int, int,
220                             u_int8_t, sa_family_t);
221 int                      pf_addr_wrap_neq(struct pf_addr_wrap *,
222                             struct pf_addr_wrap *);
223 struct pf_state         *pf_find_state_recurse(struct pfi_kif *,
224                             struct pf_state *, u_int8_t);
225
226 struct pf_pool_limit pf_pool_limits[PF_LIMIT_MAX];
227
228 #define STATE_LOOKUP()                                                  \
229         do {                                                            \
230                 if (direction == PF_IN)                                 \
231                         *state = pf_find_state_recurse(         \
232                             kif, &key, PF_EXT_GWY);                     \
233                 else                                                    \
234                         *state = pf_find_state_recurse(         \
235                             kif, &key, PF_LAN_EXT);                     \
236                 if (*state == NULL)                                     \
237                         return (PF_DROP);                               \
238                 if (direction == PF_OUT &&                              \
239                     (((*state)->rule.ptr->rt == PF_ROUTETO &&           \
240                     (*state)->rule.ptr->direction == PF_OUT) ||         \
241                     ((*state)->rule.ptr->rt == PF_REPLYTO &&            \
242                     (*state)->rule.ptr->direction == PF_IN)) &&         \
243                     (*state)->rt_kif != NULL &&                         \
244                     (*state)->rt_kif != kif)                            \
245                         return (PF_PASS);                               \
246         } while (0)
247
248 #define STATE_TRANSLATE(s) \
249         (s)->lan.addr.addr32[0] != (s)->gwy.addr.addr32[0] || \
250         ((s)->af == AF_INET6 && \
251         ((s)->lan.addr.addr32[1] != (s)->gwy.addr.addr32[1] || \
252         (s)->lan.addr.addr32[2] != (s)->gwy.addr.addr32[2] || \
253         (s)->lan.addr.addr32[3] != (s)->gwy.addr.addr32[3])) || \
254         (s)->lan.port != (s)->gwy.port
255
256 #define BOUND_IFACE(r, k) (((r)->rule_flag & PFRULE_IFBOUND) ? (k) :   \
257         ((r)->rule_flag & PFRULE_GRBOUND) ? (k)->pfik_parent :         \
258         (k)->pfik_parent->pfik_parent)
259
260 static int pf_src_compare(struct pf_src_node *, struct pf_src_node *);
261 static int pf_state_compare_lan_ext(struct pf_state *,
262         struct pf_state *);
263 static int pf_state_compare_ext_gwy(struct pf_state *,
264         struct pf_state *);
265 static int pf_state_compare_id(struct pf_state *,
266         struct pf_state *);
267
268 struct pf_src_tree tree_src_tracking;
269
270 struct pf_state_tree_id tree_id;
271 struct pf_state_queue state_updates;
272
273 RB_GENERATE(pf_src_tree, pf_src_node, entry, pf_src_compare);
274 RB_GENERATE(pf_state_tree_lan_ext, pf_state,
275     u.s.entry_lan_ext, pf_state_compare_lan_ext);
276 RB_GENERATE(pf_state_tree_ext_gwy, pf_state,
277     u.s.entry_ext_gwy, pf_state_compare_ext_gwy);
278 RB_GENERATE(pf_state_tree_id, pf_state,
279     u.s.entry_id, pf_state_compare_id);
280
281 static int
282 pf_src_compare(struct pf_src_node *a, struct pf_src_node *b)
283 {
284         int     diff;
285
286         if (a->rule.ptr > b->rule.ptr)
287                 return (1);
288         if (a->rule.ptr < b->rule.ptr)
289                 return (-1);
290         if ((diff = a->af - b->af) != 0)
291                 return (diff);
292         switch (a->af) {
293 #ifdef INET
294         case AF_INET:
295                 if (a->addr.addr32[0] > b->addr.addr32[0])
296                         return (1);
297                 if (a->addr.addr32[0] < b->addr.addr32[0])
298                         return (-1);
299                 break;
300 #endif /* INET */
301 #ifdef INET6
302         case AF_INET6:
303                 if (a->addr.addr32[3] > b->addr.addr32[3])
304                         return (1);
305                 if (a->addr.addr32[3] < b->addr.addr32[3])
306                         return (-1);
307                 if (a->addr.addr32[2] > b->addr.addr32[2])
308                         return (1);
309                 if (a->addr.addr32[2] < b->addr.addr32[2])
310                         return (-1);
311                 if (a->addr.addr32[1] > b->addr.addr32[1])
312                         return (1);
313                 if (a->addr.addr32[1] < b->addr.addr32[1])
314                         return (-1);
315                 if (a->addr.addr32[0] > b->addr.addr32[0])
316                         return (1);
317                 if (a->addr.addr32[0] < b->addr.addr32[0])
318                         return (-1);
319                 break;
320 #endif /* INET6 */
321         }
322         return (0);
323 }
324
325 static
326 int
327 pf_state_hash(struct pf_state *s)
328 {
329         int hv = (intptr_t)s / sizeof(*s);
330
331         hv ^= crc32(&s->lan, sizeof(s->lan));
332         hv ^= crc32(&s->gwy, sizeof(s->gwy));
333         hv ^= crc32(&s->ext, sizeof(s->ext));
334         return(hv);
335 }
336
337 static int
338 pf_state_compare_lan_ext(struct pf_state *a, struct pf_state *b)
339 {
340         int     diff;
341
342         if ((diff = a->proto - b->proto) != 0)
343                 return (diff);
344         if ((diff = a->af - b->af) != 0)
345                 return (diff);
346         switch (a->af) {
347 #ifdef INET
348         case AF_INET:
349                 if (a->lan.addr.addr32[0] > b->lan.addr.addr32[0])
350                         return (1);
351                 if (a->lan.addr.addr32[0] < b->lan.addr.addr32[0])
352                         return (-1);
353                 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0])
354                         return (1);
355                 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0])
356                         return (-1);
357                 break;
358 #endif /* INET */
359 #ifdef INET6
360         case AF_INET6:
361                 if (a->lan.addr.addr32[3] > b->lan.addr.addr32[3])
362                         return (1);
363                 if (a->lan.addr.addr32[3] < b->lan.addr.addr32[3])
364                         return (-1);
365                 if (a->ext.addr.addr32[3] > b->ext.addr.addr32[3])
366                         return (1);
367                 if (a->ext.addr.addr32[3] < b->ext.addr.addr32[3])
368                         return (-1);
369                 if (a->lan.addr.addr32[2] > b->lan.addr.addr32[2])
370                         return (1);
371                 if (a->lan.addr.addr32[2] < b->lan.addr.addr32[2])
372                         return (-1);
373                 if (a->ext.addr.addr32[2] > b->ext.addr.addr32[2])
374                         return (1);
375                 if (a->ext.addr.addr32[2] < b->ext.addr.addr32[2])
376                         return (-1);
377                 if (a->lan.addr.addr32[1] > b->lan.addr.addr32[1])
378                         return (1);
379                 if (a->lan.addr.addr32[1] < b->lan.addr.addr32[1])
380                         return (-1);
381                 if (a->ext.addr.addr32[1] > b->ext.addr.addr32[1])
382                         return (1);
383                 if (a->ext.addr.addr32[1] < b->ext.addr.addr32[1])
384                         return (-1);
385                 if (a->lan.addr.addr32[0] > b->lan.addr.addr32[0])
386                         return (1);
387                 if (a->lan.addr.addr32[0] < b->lan.addr.addr32[0])
388                         return (-1);
389                 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0])
390                         return (1);
391                 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0])
392                         return (-1);
393                 break;
394 #endif /* INET6 */
395         }
396
397         if ((diff = a->lan.port - b->lan.port) != 0)
398                 return (diff);
399         if ((diff = a->ext.port - b->ext.port) != 0)
400                 return (diff);
401
402         return (0);
403 }
404
405 static int
406 pf_state_compare_ext_gwy(struct pf_state *a, struct pf_state *b)
407 {
408         int     diff;
409
410         if ((diff = a->proto - b->proto) != 0)
411                 return (diff);
412         if ((diff = a->af - b->af) != 0)
413                 return (diff);
414         switch (a->af) {
415 #ifdef INET
416         case AF_INET:
417                 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0])
418                         return (1);
419                 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0])
420                         return (-1);
421                 if (a->gwy.addr.addr32[0] > b->gwy.addr.addr32[0])
422                         return (1);
423                 if (a->gwy.addr.addr32[0] < b->gwy.addr.addr32[0])
424                         return (-1);
425                 break;
426 #endif /* INET */
427 #ifdef INET6
428         case AF_INET6:
429                 if (a->ext.addr.addr32[3] > b->ext.addr.addr32[3])
430                         return (1);
431                 if (a->ext.addr.addr32[3] < b->ext.addr.addr32[3])
432                         return (-1);
433                 if (a->gwy.addr.addr32[3] > b->gwy.addr.addr32[3])
434                         return (1);
435                 if (a->gwy.addr.addr32[3] < b->gwy.addr.addr32[3])
436                         return (-1);
437                 if (a->ext.addr.addr32[2] > b->ext.addr.addr32[2])
438                         return (1);
439                 if (a->ext.addr.addr32[2] < b->ext.addr.addr32[2])
440                         return (-1);
441                 if (a->gwy.addr.addr32[2] > b->gwy.addr.addr32[2])
442                         return (1);
443                 if (a->gwy.addr.addr32[2] < b->gwy.addr.addr32[2])
444                         return (-1);
445                 if (a->ext.addr.addr32[1] > b->ext.addr.addr32[1])
446                         return (1);
447                 if (a->ext.addr.addr32[1] < b->ext.addr.addr32[1])
448                         return (-1);
449                 if (a->gwy.addr.addr32[1] > b->gwy.addr.addr32[1])
450                         return (1);
451                 if (a->gwy.addr.addr32[1] < b->gwy.addr.addr32[1])
452                         return (-1);
453                 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0])
454                         return (1);
455                 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0])
456                         return (-1);
457                 if (a->gwy.addr.addr32[0] > b->gwy.addr.addr32[0])
458                         return (1);
459                 if (a->gwy.addr.addr32[0] < b->gwy.addr.addr32[0])
460                         return (-1);
461                 break;
462 #endif /* INET6 */
463         }
464
465         if ((diff = a->ext.port - b->ext.port) != 0)
466                 return (diff);
467         if ((diff = a->gwy.port - b->gwy.port) != 0)
468                 return (diff);
469
470         return (0);
471 }
472
473 static int
474 pf_state_compare_id(struct pf_state *a, struct pf_state *b)
475 {
476         if (a->id > b->id)
477                 return (1);
478         if (a->id < b->id)
479                 return (-1);
480         if (a->creatorid > b->creatorid)
481                 return (1);
482         if (a->creatorid < b->creatorid)
483                 return (-1);
484
485         return (0);
486 }
487
488 #ifdef INET6
489 void
490 pf_addrcpy(struct pf_addr *dst, struct pf_addr *src, sa_family_t af)
491 {
492         switch (af) {
493 #ifdef INET
494         case AF_INET:
495                 dst->addr32[0] = src->addr32[0];
496                 break;
497 #endif /* INET */
498         case AF_INET6:
499                 dst->addr32[0] = src->addr32[0];
500                 dst->addr32[1] = src->addr32[1];
501                 dst->addr32[2] = src->addr32[2];
502                 dst->addr32[3] = src->addr32[3];
503                 break;
504         }
505 }
506 #endif
507
508 struct pf_state *
509 pf_find_state_byid(struct pf_state *key)
510 {
511         pf_status.fcounters[FCNT_STATE_SEARCH]++;
512         return (RB_FIND(pf_state_tree_id, &tree_id, key));
513 }
514
515 struct pf_state *
516 pf_find_state_recurse(struct pfi_kif *kif, struct pf_state *key, u_int8_t tree)
517 {
518         struct pf_state *s;
519
520         pf_status.fcounters[FCNT_STATE_SEARCH]++;
521
522         switch (tree) {
523         case PF_LAN_EXT:
524                 for (; kif != NULL; kif = kif->pfik_parent) {
525                         s = RB_FIND(pf_state_tree_lan_ext,
526                             &kif->pfik_lan_ext, key);
527                         if (s != NULL)
528                                 return (s);
529                 }
530                 return (NULL);
531         case PF_EXT_GWY:
532                 for (; kif != NULL; kif = kif->pfik_parent) {
533                         s = RB_FIND(pf_state_tree_ext_gwy,
534                             &kif->pfik_ext_gwy, key);
535                         if (s != NULL)
536                                 return (s);
537                 }
538                 return (NULL);
539         default:
540                 panic("pf_find_state_recurse");
541         }
542 }
543
544 struct pf_state *
545 pf_find_state_all(struct pf_state *key, u_int8_t tree, int *more)
546 {
547         struct pf_state *s, *ss = NULL;
548         struct pfi_kif  *kif;
549
550         pf_status.fcounters[FCNT_STATE_SEARCH]++;
551
552         switch (tree) {
553         case PF_LAN_EXT:
554                 TAILQ_FOREACH(kif, &pfi_statehead, pfik_w_states) {
555                         s = RB_FIND(pf_state_tree_lan_ext,
556                             &kif->pfik_lan_ext, key);
557                         if (s == NULL)
558                                 continue;
559                         if (more == NULL)
560                                 return (s);
561                         ss = s;
562                         (*more)++;
563                 }
564                 return (ss);
565         case PF_EXT_GWY:
566                 TAILQ_FOREACH(kif, &pfi_statehead, pfik_w_states) {
567                         s = RB_FIND(pf_state_tree_ext_gwy,
568                             &kif->pfik_ext_gwy, key);
569                         if (s == NULL)
570                                 continue;
571                         if (more == NULL)
572                                 return (s);
573                         ss = s;
574                         (*more)++;
575                 }
576                 return (ss);
577         default:
578                 panic("pf_find_state_all");
579         }
580 }
581
582 int
583 pf_insert_src_node(struct pf_src_node **sn, struct pf_rule *rule,
584     struct pf_addr *src, sa_family_t af)
585 {
586         struct pf_src_node      k;
587
588         if (*sn == NULL) {
589                 k.af = af;
590                 PF_ACPY(&k.addr, src, af);
591                 if (rule->rule_flag & PFRULE_RULESRCTRACK ||
592                     rule->rpool.opts & PF_POOL_STICKYADDR)
593                         k.rule.ptr = rule;
594                 else
595                         k.rule.ptr = NULL;
596                 pf_status.scounters[SCNT_SRC_NODE_SEARCH]++;
597                 *sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k);
598         }
599         if (*sn == NULL) {
600                 if (!rule->max_src_nodes ||
601                     rule->src_nodes < rule->max_src_nodes)
602                         (*sn) = pool_get(&pf_src_tree_pl, PR_NOWAIT);
603                 if ((*sn) == NULL)
604                         return (-1);
605                 bzero(*sn, sizeof(struct pf_src_node));
606                 (*sn)->af = af;
607                 if (rule->rule_flag & PFRULE_RULESRCTRACK ||
608                     rule->rpool.opts & PF_POOL_STICKYADDR)
609                         (*sn)->rule.ptr = rule;
610                 else
611                         (*sn)->rule.ptr = NULL;
612                 PF_ACPY(&(*sn)->addr, src, af);
613                 if (RB_INSERT(pf_src_tree,
614                     &tree_src_tracking, *sn) != NULL) {
615                         if (pf_status.debug >= PF_DEBUG_MISC) {
616                                 kprintf("pf: src_tree insert failed: ");
617                                 pf_print_host(&(*sn)->addr, 0, af);
618                                 kprintf("\n");
619                         }
620                         pool_put(&pf_src_tree_pl, *sn);
621                         return (-1);
622                 }
623                 (*sn)->creation = time_second;
624                 (*sn)->ruletype = rule->action;
625                 if ((*sn)->rule.ptr != NULL)
626                         (*sn)->rule.ptr->src_nodes++;
627                 pf_status.scounters[SCNT_SRC_NODE_INSERT]++;
628                 pf_status.src_nodes++;
629         } else {
630                 if (rule->max_src_states &&
631                     (*sn)->states >= rule->max_src_states)
632                         return (-1);
633         }
634         return (0);
635 }
636
637 int
638 pf_insert_state(struct pfi_kif *kif, struct pf_state *state)
639 {
640         /* Thou MUST NOT insert multiple duplicate keys */
641         state->u.s.kif = kif;
642         if (RB_INSERT(pf_state_tree_lan_ext, &kif->pfik_lan_ext, state)) {
643                 if (pf_status.debug >= PF_DEBUG_MISC) {
644                         kprintf("pf: state insert failed: tree_lan_ext");
645                         kprintf(" lan: ");
646                         pf_print_host(&state->lan.addr, state->lan.port,
647                             state->af);
648                         kprintf(" gwy: ");
649                         pf_print_host(&state->gwy.addr, state->gwy.port,
650                             state->af);
651                         kprintf(" ext: ");
652                         pf_print_host(&state->ext.addr, state->ext.port,
653                             state->af);
654                         if (state->sync_flags & PFSTATE_FROMSYNC)
655                                 kprintf(" (from sync)");
656                         kprintf("\n");
657                 }
658                 return (-1);
659         }
660
661         if (RB_INSERT(pf_state_tree_ext_gwy, &kif->pfik_ext_gwy, state)) {
662                 if (pf_status.debug >= PF_DEBUG_MISC) {
663                         kprintf("pf: state insert failed: tree_ext_gwy");
664                         kprintf(" lan: ");
665                         pf_print_host(&state->lan.addr, state->lan.port,
666                             state->af);
667                         kprintf(" gwy: ");
668                         pf_print_host(&state->gwy.addr, state->gwy.port,
669                             state->af);
670                         kprintf(" ext: ");
671                         pf_print_host(&state->ext.addr, state->ext.port,
672                             state->af);
673                         if (state->sync_flags & PFSTATE_FROMSYNC)
674                                 kprintf(" (from sync)");
675                         kprintf("\n");
676                 }
677                 RB_REMOVE(pf_state_tree_lan_ext, &kif->pfik_lan_ext, state);
678                 return (-1);
679         }
680
681         if (state->id == 0 && state->creatorid == 0) {
682                 state->id = htobe64(pf_status.stateid++);
683                 state->creatorid = pf_status.hostid;
684         }
685         if (RB_INSERT(pf_state_tree_id, &tree_id, state) != NULL) {
686                 if (pf_status.debug >= PF_DEBUG_MISC) {
687                         kprintf("pf: state insert failed: "
688                             "id: %016" PRIx64 " creatorid: %08" PRIx32,
689                             be64toh(state->id), ntohl(state->creatorid));
690                         if (state->sync_flags & PFSTATE_FROMSYNC)
691                                 kprintf(" (from sync)");
692                         kprintf("\n");
693                 }
694                 RB_REMOVE(pf_state_tree_lan_ext, &kif->pfik_lan_ext, state);
695                 RB_REMOVE(pf_state_tree_ext_gwy, &kif->pfik_ext_gwy, state);
696                 return (-1);
697         }
698         TAILQ_INSERT_HEAD(&state_updates, state, u.s.entry_updates);
699
700         pf_status.fcounters[FCNT_STATE_INSERT]++;
701         pf_status.states++;
702         pfi_attach_state(kif);
703 #if NPFSYNC
704         pfsync_insert_state(state);
705 #endif
706         return (0);
707 }
708
709 void
710 pf_purge_timeout(void *arg)
711 {
712         struct callout  *to = arg;
713
714         crit_enter();
715         pf_purge_expired_states();
716         pf_purge_expired_fragments();
717         pf_purge_expired_src_nodes();
718         crit_exit();
719
720         callout_reset(to, pf_default_rule.timeout[PFTM_INTERVAL] * hz,
721             pf_purge_timeout, to);
722 }
723
724 u_int32_t
725 pf_state_expires(const struct pf_state *state)
726 {
727         u_int32_t       timeout;
728         u_int32_t       start;
729         u_int32_t       end;
730         u_int32_t       states;
731
732         /* handle all PFTM_* > PFTM_MAX here */
733         if (state->timeout == PFTM_PURGE)
734                 return (time_second);
735         if (state->timeout == PFTM_UNTIL_PACKET)
736                 return (0);
737         KASSERT((state->timeout < PFTM_MAX), 
738             ("pf_state_expires: timeout > PFTM_MAX"));
739         timeout = state->rule.ptr->timeout[state->timeout];
740         if (!timeout)
741                 timeout = pf_default_rule.timeout[state->timeout];
742         start = state->rule.ptr->timeout[PFTM_ADAPTIVE_START];
743         if (start) {
744                 end = state->rule.ptr->timeout[PFTM_ADAPTIVE_END];
745                 states = state->rule.ptr->states;
746         } else {
747                 start = pf_default_rule.timeout[PFTM_ADAPTIVE_START];
748                 end = pf_default_rule.timeout[PFTM_ADAPTIVE_END];
749                 states = pf_status.states;
750         }
751         if (end && states > start && start < end) {
752                 if (states < end)
753                         return (state->expire + timeout * (end - states) /
754                             (end - start));
755                 else
756                         return (time_second);
757         }
758         return (state->expire + timeout);
759 }
760
761 void
762 pf_purge_expired_src_nodes(void)
763 {
764          struct pf_src_node             *cur, *next;
765
766          for (cur = RB_MIN(pf_src_tree, &tree_src_tracking); cur; cur = next) {
767                  next = RB_NEXT(pf_src_tree, &tree_src_tracking, cur);
768
769                  if (cur->states <= 0 && cur->expire <= time_second) {
770                          if (cur->rule.ptr != NULL) {
771                                  cur->rule.ptr->src_nodes--;
772                                  if (cur->rule.ptr->states <= 0 &&
773                                      cur->rule.ptr->max_src_nodes <= 0)
774                                          pf_rm_rule(NULL, cur->rule.ptr);
775                          }
776                          RB_REMOVE(pf_src_tree, &tree_src_tracking, cur);
777                          pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
778                          pf_status.src_nodes--;
779                          pool_put(&pf_src_tree_pl, cur);
780                  }
781          }
782 }
783
784 void
785 pf_src_tree_remove_state(struct pf_state *s)
786 {
787         u_int32_t timeout;
788
789         if (s->src_node != NULL) {
790                 if (--s->src_node->states <= 0) {
791                         timeout = s->rule.ptr->timeout[PFTM_SRC_NODE];
792                         if (!timeout)
793                                 timeout =
794                                     pf_default_rule.timeout[PFTM_SRC_NODE];
795                         s->src_node->expire = time_second + timeout;
796                 }
797         }
798         if (s->nat_src_node != s->src_node && s->nat_src_node != NULL) {
799                 if (--s->nat_src_node->states <= 0) {
800                         timeout = s->rule.ptr->timeout[PFTM_SRC_NODE];
801                         if (!timeout)
802                                 timeout =
803                                     pf_default_rule.timeout[PFTM_SRC_NODE];
804                         s->nat_src_node->expire = time_second + timeout;
805                 }
806         }
807         s->src_node = s->nat_src_node = NULL;
808 }
809
810 static int
811 pf_purge_expired_states_callback(struct pf_state *cur, void *data __unused)
812 {
813         if (pf_state_expires(cur) <= time_second) {
814                 RB_REMOVE(pf_state_tree_ext_gwy,
815                     &cur->u.s.kif->pfik_ext_gwy, cur);
816                 RB_REMOVE(pf_state_tree_lan_ext,
817                     &cur->u.s.kif->pfik_lan_ext, cur);
818                 RB_REMOVE(pf_state_tree_id, &tree_id, cur);
819                 if (cur->src.state == PF_TCPS_PROXY_DST) {
820                         pf_send_tcp(cur->rule.ptr, cur->af,
821                             &cur->ext.addr, &cur->lan.addr,
822                             cur->ext.port, cur->lan.port,
823                             cur->src.seqhi, cur->src.seqlo + 1, 0,
824                             TH_RST|TH_ACK, 0, 0);
825                 }
826 #if NPFSYNC
827                 pfsync_delete_state(cur);
828 #endif
829                 pf_src_tree_remove_state(cur);
830                 if (--cur->rule.ptr->states <= 0 &&
831                     cur->rule.ptr->src_nodes <= 0)
832                         pf_rm_rule(NULL, cur->rule.ptr);
833                 if (cur->nat_rule.ptr != NULL)
834                         if (--cur->nat_rule.ptr->states <= 0 &&
835                                 cur->nat_rule.ptr->src_nodes <= 0)
836                                 pf_rm_rule(NULL, cur->nat_rule.ptr);
837                 if (cur->anchor.ptr != NULL)
838                         if (--cur->anchor.ptr->states <= 0)
839                                 pf_rm_rule(NULL, cur->anchor.ptr);
840                 pf_normalize_tcp_cleanup(cur);
841                 pfi_detach_state(cur->u.s.kif);
842                 TAILQ_REMOVE(&state_updates, cur, u.s.entry_updates);
843                 pool_put(&pf_state_pl, cur);
844                 pf_status.fcounters[FCNT_STATE_REMOVALS]++;
845                 pf_status.states--;
846         }
847         return(0);
848 }
849
850 void
851 pf_purge_expired_states(void)
852 {
853         RB_SCAN(pf_state_tree_id, &tree_id, NULL,
854                 pf_purge_expired_states_callback, NULL);
855 }
856
857
858 int
859 pf_tbladdr_setup(struct pf_ruleset *rs, struct pf_addr_wrap *aw)
860 {
861         if (aw->type != PF_ADDR_TABLE)
862                 return (0);
863         if ((aw->p.tbl = pfr_attach_table(rs, aw->v.tblname)) == NULL)
864                 return (1);
865         return (0);
866 }
867
868 void
869 pf_tbladdr_remove(struct pf_addr_wrap *aw)
870 {
871         if (aw->type != PF_ADDR_TABLE || aw->p.tbl == NULL)
872                 return;
873         pfr_detach_table(aw->p.tbl);
874         aw->p.tbl = NULL;
875 }
876
877 void
878 pf_tbladdr_copyout(struct pf_addr_wrap *aw)
879 {
880         struct pfr_ktable *kt = aw->p.tbl;
881
882         if (aw->type != PF_ADDR_TABLE || kt == NULL)
883                 return;
884         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
885                 kt = kt->pfrkt_root;
886         aw->p.tbl = NULL;
887         aw->p.tblcnt = (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) ?
888                 kt->pfrkt_cnt : -1;
889 }
890
891 void
892 pf_print_host(struct pf_addr *addr, u_int16_t p, sa_family_t af)
893 {
894         switch (af) {
895 #ifdef INET
896         case AF_INET: {
897                 u_int32_t a = ntohl(addr->addr32[0]);
898                 kprintf("%u.%u.%u.%u", (a>>24)&255, (a>>16)&255,
899                     (a>>8)&255, a&255);
900                 if (p) {
901                         p = ntohs(p);
902                         kprintf(":%u", p);
903                 }
904                 break;
905         }
906 #endif /* INET */
907 #ifdef INET6
908         case AF_INET6: {
909                 u_int16_t b;
910                 u_int8_t i, curstart = 255, curend = 0,
911                     maxstart = 0, maxend = 0;
912                 for (i = 0; i < 8; i++) {
913                         if (!addr->addr16[i]) {
914                                 if (curstart == 255)
915                                         curstart = i;
916                                 else
917                                         curend = i;
918                         } else {
919                                 if (curstart) {
920                                         if ((curend - curstart) >
921                                             (maxend - maxstart)) {
922                                                 maxstart = curstart;
923                                                 maxend = curend;
924                                                 curstart = 255;
925                                         }
926                                 }
927                         }
928                 }
929                 for (i = 0; i < 8; i++) {
930                         if (i >= maxstart && i <= maxend) {
931                                 if (maxend != 7) {
932                                         if (i == maxstart)
933                                                 kprintf(":");
934                                 } else {
935                                         if (i == maxend)
936                                                 kprintf(":");
937                                 }
938                         } else {
939                                 b = ntohs(addr->addr16[i]);
940                                 kprintf("%x", b);
941                                 if (i < 7)
942                                         kprintf(":");
943                         }
944                 }
945                 if (p) {
946                         p = ntohs(p);
947                         kprintf("[%u]", p);
948                 }
949                 break;
950         }
951 #endif /* INET6 */
952         }
953 }
954
955 void
956 pf_print_state(struct pf_state *s)
957 {
958         switch (s->proto) {
959         case IPPROTO_TCP:
960                 kprintf("TCP ");
961                 break;
962         case IPPROTO_UDP:
963                 kprintf("UDP ");
964                 break;
965         case IPPROTO_ICMP:
966                 kprintf("ICMP ");
967                 break;
968         case IPPROTO_ICMPV6:
969                 kprintf("ICMPV6 ");
970                 break;
971         default:
972                 kprintf("%u ", s->proto);
973                 break;
974         }
975         pf_print_host(&s->lan.addr, s->lan.port, s->af);
976         kprintf(" ");
977         pf_print_host(&s->gwy.addr, s->gwy.port, s->af);
978         kprintf(" ");
979         pf_print_host(&s->ext.addr, s->ext.port, s->af);
980         kprintf(" [lo=%u high=%u win=%u modulator=%u", s->src.seqlo,
981             s->src.seqhi, s->src.max_win, s->src.seqdiff);
982         if (s->src.wscale && s->dst.wscale)
983                 kprintf(" wscale=%u", s->src.wscale & PF_WSCALE_MASK);
984         kprintf("]");
985         kprintf(" [lo=%u high=%u win=%u modulator=%u", s->dst.seqlo,
986             s->dst.seqhi, s->dst.max_win, s->dst.seqdiff);
987         if (s->src.wscale && s->dst.wscale)
988                 kprintf(" wscale=%u", s->dst.wscale & PF_WSCALE_MASK);
989         kprintf("]");
990         kprintf(" %u:%u", s->src.state, s->dst.state);
991 }
992
993 void
994 pf_print_flags(u_int8_t f)
995 {
996         if (f)
997                 kprintf(" ");
998         if (f & TH_FIN)
999                 kprintf("F");
1000         if (f & TH_SYN)
1001                 kprintf("S");
1002         if (f & TH_RST)
1003                 kprintf("R");
1004         if (f & TH_PUSH)
1005                 kprintf("P");
1006         if (f & TH_ACK)
1007                 kprintf("A");
1008         if (f & TH_URG)
1009                 kprintf("U");
1010         if (f & TH_ECE)
1011                 kprintf("E");
1012         if (f & TH_CWR)
1013                 kprintf("W");
1014 }
1015
1016 #define PF_SET_SKIP_STEPS(i)                                    \
1017         do {                                                    \
1018                 while (head[i] != cur) {                        \
1019                         head[i]->skip[i].ptr = cur;             \
1020                         head[i] = TAILQ_NEXT(head[i], entries); \
1021                 }                                               \
1022         } while (0)
1023
1024 void
1025 pf_calc_skip_steps(struct pf_rulequeue *rules)
1026 {
1027         struct pf_rule *cur, *prev, *head[PF_SKIP_COUNT];
1028         int i;
1029
1030         cur = TAILQ_FIRST(rules);
1031         prev = cur;
1032         for (i = 0; i < PF_SKIP_COUNT; ++i)
1033                 head[i] = cur;
1034         while (cur != NULL) {
1035
1036                 if (cur->kif != prev->kif || cur->ifnot != prev->ifnot)
1037                         PF_SET_SKIP_STEPS(PF_SKIP_IFP);
1038                 if (cur->direction != prev->direction)
1039                         PF_SET_SKIP_STEPS(PF_SKIP_DIR);
1040                 if (cur->af != prev->af)
1041                         PF_SET_SKIP_STEPS(PF_SKIP_AF);
1042                 if (cur->proto != prev->proto)
1043                         PF_SET_SKIP_STEPS(PF_SKIP_PROTO);
1044                 if (cur->src.not != prev->src.not ||
1045                     pf_addr_wrap_neq(&cur->src.addr, &prev->src.addr))
1046                         PF_SET_SKIP_STEPS(PF_SKIP_SRC_ADDR);
1047                 if (cur->src.port[0] != prev->src.port[0] ||
1048                     cur->src.port[1] != prev->src.port[1] ||
1049                     cur->src.port_op != prev->src.port_op)
1050                         PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT);
1051                 if (cur->dst.not != prev->dst.not ||
1052                     pf_addr_wrap_neq(&cur->dst.addr, &prev->dst.addr))
1053                         PF_SET_SKIP_STEPS(PF_SKIP_DST_ADDR);
1054                 if (cur->dst.port[0] != prev->dst.port[0] ||
1055                     cur->dst.port[1] != prev->dst.port[1] ||
1056                     cur->dst.port_op != prev->dst.port_op)
1057                         PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT);
1058
1059                 prev = cur;
1060                 cur = TAILQ_NEXT(cur, entries);
1061         }
1062         for (i = 0; i < PF_SKIP_COUNT; ++i)
1063                 PF_SET_SKIP_STEPS(i);
1064 }
1065
1066 int
1067 pf_addr_wrap_neq(struct pf_addr_wrap *aw1, struct pf_addr_wrap *aw2)
1068 {
1069         if (aw1->type != aw2->type)
1070                 return (1);
1071         switch (aw1->type) {
1072         case PF_ADDR_ADDRMASK:
1073                 if (PF_ANEQ(&aw1->v.a.addr, &aw2->v.a.addr, 0))
1074                         return (1);
1075                 if (PF_ANEQ(&aw1->v.a.mask, &aw2->v.a.mask, 0))
1076                         return (1);
1077                 return (0);
1078         case PF_ADDR_DYNIFTL:
1079                 return (aw1->p.dyn->pfid_kt != aw2->p.dyn->pfid_kt);
1080         case PF_ADDR_NOROUTE:
1081                 return (0);
1082         case PF_ADDR_TABLE:
1083                 return (aw1->p.tbl != aw2->p.tbl);
1084         default:
1085                 kprintf("invalid address type: %d\n", aw1->type);
1086                 return (1);
1087         }
1088 }
1089
1090 void
1091 pf_update_anchor_rules(void)
1092 {
1093         struct pf_rule  *rule;
1094         int              i;
1095
1096         for (i = 0; i < PF_RULESET_MAX; ++i)
1097                 TAILQ_FOREACH(rule, pf_main_ruleset.rules[i].active.ptr,
1098                     entries)
1099                         if (rule->anchorname[0])
1100                                 rule->anchor = pf_find_anchor(rule->anchorname);
1101                         else
1102                                 rule->anchor = NULL;
1103 }
1104
1105 u_int16_t
1106 pf_cksum_fixup(u_int16_t cksum, u_int16_t old, u_int16_t new, u_int8_t udp)
1107 {
1108         u_int32_t       l;
1109
1110         if (udp && !cksum)
1111                 return (0x0000);
1112         l = cksum + old - new;
1113         l = (l >> 16) + (l & 65535);
1114         l = l & 65535;
1115         if (udp && !l)
1116                 return (0xFFFF);
1117         return (l);
1118 }
1119
1120 void
1121 pf_change_ap(struct pf_addr *a, u_int16_t *p, u_int16_t *ic, u_int16_t *pc,
1122     struct pf_addr *an, u_int16_t pn, u_int8_t u, sa_family_t af)
1123 {
1124         struct pf_addr  ao;
1125         u_int16_t       po = *p;
1126
1127         PF_ACPY(&ao, a, af);
1128         PF_ACPY(a, an, af);
1129
1130         *p = pn;
1131
1132         switch (af) {
1133 #ifdef INET
1134         case AF_INET:
1135                 *ic = pf_cksum_fixup(pf_cksum_fixup(*ic,
1136                     ao.addr16[0], an->addr16[0], 0),
1137                     ao.addr16[1], an->addr16[1], 0);
1138                 *p = pn;
1139                 *pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc,
1140                     ao.addr16[0], an->addr16[0], u),
1141                     ao.addr16[1], an->addr16[1], u),
1142                     po, pn, u);
1143                 break;
1144 #endif /* INET */
1145 #ifdef INET6
1146         case AF_INET6:
1147                 *pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1148                     pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1149                     pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc,
1150                     ao.addr16[0], an->addr16[0], u),
1151                     ao.addr16[1], an->addr16[1], u),
1152                     ao.addr16[2], an->addr16[2], u),
1153                     ao.addr16[3], an->addr16[3], u),
1154                     ao.addr16[4], an->addr16[4], u),
1155                     ao.addr16[5], an->addr16[5], u),
1156                     ao.addr16[6], an->addr16[6], u),
1157                     ao.addr16[7], an->addr16[7], u),
1158                     po, pn, u);
1159                 break;
1160 #endif /* INET6 */
1161         }
1162 }
1163
1164
1165 /* Changes a u_int32_t.  Uses a void * so there are no align restrictions */
1166 void
1167 pf_change_a(void *a, u_int16_t *c, u_int32_t an, u_int8_t u)
1168 {
1169         u_int32_t       ao;
1170
1171         memcpy(&ao, a, sizeof(ao));
1172         memcpy(a, &an, sizeof(u_int32_t));
1173         *c = pf_cksum_fixup(pf_cksum_fixup(*c, ao / 65536, an / 65536, u),
1174             ao % 65536, an % 65536, u);
1175 }
1176
1177 #ifdef INET6
1178 void
1179 pf_change_a6(struct pf_addr *a, u_int16_t *c, struct pf_addr *an, u_int8_t u)
1180 {
1181         struct pf_addr  ao;
1182
1183         PF_ACPY(&ao, a, AF_INET6);
1184         PF_ACPY(a, an, AF_INET6);
1185
1186         *c = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1187             pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1188             pf_cksum_fixup(pf_cksum_fixup(*c,
1189             ao.addr16[0], an->addr16[0], u),
1190             ao.addr16[1], an->addr16[1], u),
1191             ao.addr16[2], an->addr16[2], u),
1192             ao.addr16[3], an->addr16[3], u),
1193             ao.addr16[4], an->addr16[4], u),
1194             ao.addr16[5], an->addr16[5], u),
1195             ao.addr16[6], an->addr16[6], u),
1196             ao.addr16[7], an->addr16[7], u);
1197 }
1198 #endif /* INET6 */
1199
1200 void
1201 pf_change_icmp(struct pf_addr *ia, u_int16_t *ip, struct pf_addr *oa,
1202     struct pf_addr *na, u_int16_t np, u_int16_t *pc, u_int16_t *h2c,
1203     u_int16_t *ic, u_int16_t *hc, u_int8_t u, sa_family_t af)
1204 {
1205         struct pf_addr  oia, ooa;
1206
1207         PF_ACPY(&oia, ia, af);
1208         PF_ACPY(&ooa, oa, af);
1209
1210         /* Change inner protocol port, fix inner protocol checksum. */
1211         if (ip != NULL) {
1212                 u_int16_t       oip = *ip;
1213                 u_int32_t       opc = 0;
1214
1215                 if (pc != NULL)
1216                         opc = *pc;
1217                 *ip = np;
1218                 if (pc != NULL)
1219                         *pc = pf_cksum_fixup(*pc, oip, *ip, u);
1220                 *ic = pf_cksum_fixup(*ic, oip, *ip, 0);
1221                 if (pc != NULL)
1222                         *ic = pf_cksum_fixup(*ic, opc, *pc, 0);
1223         }
1224         /* Change inner ip address, fix inner ip and icmp checksums. */
1225         PF_ACPY(ia, na, af);
1226         switch (af) {
1227 #ifdef INET
1228         case AF_INET: {
1229                 u_int32_t        oh2c = *h2c;
1230
1231                 *h2c = pf_cksum_fixup(pf_cksum_fixup(*h2c,
1232                     oia.addr16[0], ia->addr16[0], 0),
1233                     oia.addr16[1], ia->addr16[1], 0);
1234                 *ic = pf_cksum_fixup(pf_cksum_fixup(*ic,
1235                     oia.addr16[0], ia->addr16[0], 0),
1236                     oia.addr16[1], ia->addr16[1], 0);
1237                 *ic = pf_cksum_fixup(*ic, oh2c, *h2c, 0);
1238                 break;
1239         }
1240 #endif /* INET */
1241 #ifdef INET6
1242         case AF_INET6:
1243                 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1244                     pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1245                     pf_cksum_fixup(pf_cksum_fixup(*ic,
1246                     oia.addr16[0], ia->addr16[0], u),
1247                     oia.addr16[1], ia->addr16[1], u),
1248                     oia.addr16[2], ia->addr16[2], u),
1249                     oia.addr16[3], ia->addr16[3], u),
1250                     oia.addr16[4], ia->addr16[4], u),
1251                     oia.addr16[5], ia->addr16[5], u),
1252                     oia.addr16[6], ia->addr16[6], u),
1253                     oia.addr16[7], ia->addr16[7], u);
1254                 break;
1255 #endif /* INET6 */
1256         }
1257         /* Change outer ip address, fix outer ip or icmpv6 checksum. */
1258         PF_ACPY(oa, na, af);
1259         switch (af) {
1260 #ifdef INET
1261         case AF_INET:
1262                 *hc = pf_cksum_fixup(pf_cksum_fixup(*hc,
1263                     ooa.addr16[0], oa->addr16[0], 0),
1264                     ooa.addr16[1], oa->addr16[1], 0);
1265                 break;
1266 #endif /* INET */
1267 #ifdef INET6
1268         case AF_INET6:
1269                 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1270                     pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1271                     pf_cksum_fixup(pf_cksum_fixup(*ic,
1272                     ooa.addr16[0], oa->addr16[0], u),
1273                     ooa.addr16[1], oa->addr16[1], u),
1274                     ooa.addr16[2], oa->addr16[2], u),
1275                     ooa.addr16[3], oa->addr16[3], u),
1276                     ooa.addr16[4], oa->addr16[4], u),
1277                     ooa.addr16[5], oa->addr16[5], u),
1278                     ooa.addr16[6], oa->addr16[6], u),
1279                     ooa.addr16[7], oa->addr16[7], u);
1280                 break;
1281 #endif /* INET6 */
1282         }
1283 }
1284
1285 void
1286 pf_send_tcp(const struct pf_rule *r, sa_family_t af,
1287     const struct pf_addr *saddr, const struct pf_addr *daddr,
1288     u_int16_t sport, u_int16_t dport, u_int32_t seq, u_int32_t ack,
1289     u_int8_t flags, u_int16_t win, u_int16_t mss, u_int8_t ttl)
1290 {
1291         struct mbuf     *m;
1292         int              len = 0, tlen;
1293 #ifdef INET
1294         struct ip       *h = NULL;
1295 #endif /* INET */
1296 #ifdef INET6
1297         struct ip6_hdr  *h6 = NULL;
1298 #endif /* INET6 */
1299         struct tcphdr   *th = NULL;
1300         char *opt;
1301
1302         /* maximum segment size tcp option */
1303         tlen = sizeof(struct tcphdr);
1304         if (mss)
1305                 tlen += 4;
1306
1307         switch (af) {
1308 #ifdef INET
1309         case AF_INET:
1310                 len = sizeof(struct ip) + tlen;
1311                 break;
1312 #endif /* INET */
1313 #ifdef INET6
1314         case AF_INET6:
1315                 len = sizeof(struct ip6_hdr) + tlen;
1316                 break;
1317 #endif /* INET6 */
1318         }
1319
1320         /* create outgoing mbuf */
1321         m = m_gethdr(MB_DONTWAIT, MT_HEADER);
1322         if (m == NULL)
1323                 return;
1324         m->m_pkthdr.fw_flags = PF_MBUF_GENERATED;
1325 #ifdef ALTQ
1326         if (r != NULL && r->qid) {
1327                 m->m_pkthdr.fw_flags |= ALTQ_MBUF_TAGGED;
1328                 m->m_pkthdr.altq_qid = r->qid;
1329                 m->m_pkthdr.ecn_af = af;
1330                 m->m_pkthdr.header = mtod(m, struct ip *);
1331         }
1332 #endif
1333         m->m_data += max_linkhdr;
1334         m->m_pkthdr.len = m->m_len = len;
1335         m->m_pkthdr.rcvif = NULL;
1336         bzero(m->m_data, len);
1337         switch (af) {
1338 #ifdef INET
1339         case AF_INET:
1340                 h = mtod(m, struct ip *);
1341
1342                 /* IP header fields included in the TCP checksum */
1343                 h->ip_p = IPPROTO_TCP;
1344                 h->ip_len = tlen;
1345                 h->ip_src.s_addr = saddr->v4.s_addr;
1346                 h->ip_dst.s_addr = daddr->v4.s_addr;
1347
1348                 th = (struct tcphdr *)((caddr_t)h + sizeof(struct ip));
1349                 break;
1350 #endif /* INET */
1351 #ifdef INET6
1352         case AF_INET6:
1353                 h6 = mtod(m, struct ip6_hdr *);
1354
1355                 /* IP header fields included in the TCP checksum */
1356                 h6->ip6_nxt = IPPROTO_TCP;
1357                 h6->ip6_plen = htons(tlen);
1358                 memcpy(&h6->ip6_src, &saddr->v6, sizeof(struct in6_addr));
1359                 memcpy(&h6->ip6_dst, &daddr->v6, sizeof(struct in6_addr));
1360
1361                 th = (struct tcphdr *)((caddr_t)h6 + sizeof(struct ip6_hdr));
1362                 break;
1363 #endif /* INET6 */
1364         }
1365
1366         /* TCP header */
1367         th->th_sport = sport;
1368         th->th_dport = dport;
1369         th->th_seq = htonl(seq);
1370         th->th_ack = htonl(ack);
1371         th->th_off = tlen >> 2;
1372         th->th_flags = flags;
1373         th->th_win = htons(win);
1374
1375         if (mss) {
1376                 opt = (char *)(th + 1);
1377                 opt[0] = TCPOPT_MAXSEG;
1378                 opt[1] = 4;
1379                 mss = htons(mss);
1380                 bcopy((caddr_t)&mss, (caddr_t)(opt + 2), 2);
1381         }
1382
1383         switch (af) {
1384 #ifdef INET
1385         case AF_INET:
1386                 /* TCP checksum */
1387                 th->th_sum = in_cksum(m, len);
1388
1389                 /* Finish the IP header */
1390                 h->ip_v = 4;
1391                 h->ip_hl = sizeof(*h) >> 2;
1392                 h->ip_tos = IPTOS_LOWDELAY;
1393                 h->ip_len = len;
1394                 h->ip_off = path_mtu_discovery ? IP_DF : 0;
1395                 h->ip_ttl = ttl ? ttl : ip_defttl;
1396                 h->ip_sum = 0;
1397                 ip_output(m, (void *)NULL, (void *)NULL, 0, (void *)NULL,
1398                     (void *)NULL);
1399                 break;
1400 #endif /* INET */
1401 #ifdef INET6
1402         case AF_INET6:
1403                 /* TCP checksum */
1404                 th->th_sum = in6_cksum(m, IPPROTO_TCP,
1405                     sizeof(struct ip6_hdr), tlen);
1406
1407                 h6->ip6_vfc |= IPV6_VERSION;
1408                 h6->ip6_hlim = IPV6_DEFHLIM;
1409
1410                 ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL);
1411                 break;
1412 #endif /* INET6 */
1413         }
1414 }
1415
1416 void
1417 pf_send_icmp(struct mbuf *m, u_int8_t type, u_int8_t code, sa_family_t af,
1418     struct pf_rule *r)
1419 {
1420         struct mbuf     *m0;
1421
1422         m0 = m_copypacket(m, MB_DONTWAIT);
1423         if (m0 == NULL)
1424                 return;
1425         m0->m_pkthdr.fw_flags |= PF_MBUF_GENERATED;
1426
1427 #ifdef ALTQ
1428         if (r->qid) {
1429                 m->m_pkthdr.fw_flags |= ALTQ_MBUF_TAGGED;
1430                 m->m_pkthdr.altq_qid = r->qid;
1431                 m->m_pkthdr.ecn_af = af;
1432                 m->m_pkthdr.header = mtod(m0, struct ip *);
1433         }
1434 #endif
1435
1436         switch (af) {
1437 #ifdef INET
1438         case AF_INET:
1439                 icmp_error(m0, type, code, 0, 0);
1440                 break;
1441 #endif /* INET */
1442 #ifdef INET6
1443         case AF_INET6:
1444                 icmp6_error(m0, type, code, 0);
1445                 break;
1446 #endif /* INET6 */
1447         }
1448 }
1449
1450 /*
1451  * Return 1 if the addresses a and b match (with mask m), otherwise return 0.
1452  * If n is 0, they match if they are equal. If n is != 0, they match if they
1453  * are different.
1454  */
1455 int
1456 pf_match_addr(u_int8_t n, struct pf_addr *a, struct pf_addr *m,
1457     struct pf_addr *b, sa_family_t af)
1458 {
1459         int     match = 0;
1460
1461         switch (af) {
1462 #ifdef INET
1463         case AF_INET:
1464                 if ((a->addr32[0] & m->addr32[0]) ==
1465                     (b->addr32[0] & m->addr32[0]))
1466                         match++;
1467                 break;
1468 #endif /* INET */
1469 #ifdef INET6
1470         case AF_INET6:
1471                 if (((a->addr32[0] & m->addr32[0]) ==
1472                      (b->addr32[0] & m->addr32[0])) &&
1473                     ((a->addr32[1] & m->addr32[1]) ==
1474                      (b->addr32[1] & m->addr32[1])) &&
1475                     ((a->addr32[2] & m->addr32[2]) ==
1476                      (b->addr32[2] & m->addr32[2])) &&
1477                     ((a->addr32[3] & m->addr32[3]) ==
1478                      (b->addr32[3] & m->addr32[3])))
1479                         match++;
1480                 break;
1481 #endif /* INET6 */
1482         }
1483         if (match) {
1484                 if (n)
1485                         return (0);
1486                 else
1487                         return (1);
1488         } else {
1489                 if (n)
1490                         return (1);
1491                 else
1492                         return (0);
1493         }
1494 }
1495
1496 int
1497 pf_match(u_int8_t op, u_int32_t a1, u_int32_t a2, u_int32_t p)
1498 {
1499         switch (op) {
1500         case PF_OP_IRG:
1501                 return ((p > a1) && (p < a2));
1502         case PF_OP_XRG:
1503                 return ((p < a1) || (p > a2));
1504         case PF_OP_RRG:
1505                 return ((p >= a1) && (p <= a2));
1506         case PF_OP_EQ:
1507                 return (p == a1);
1508         case PF_OP_NE:
1509                 return (p != a1);
1510         case PF_OP_LT:
1511                 return (p < a1);
1512         case PF_OP_LE:
1513                 return (p <= a1);
1514         case PF_OP_GT:
1515                 return (p > a1);
1516         case PF_OP_GE:
1517                 return (p >= a1);
1518         }
1519         return (0); /* never reached */
1520 }
1521
1522 int
1523 pf_match_port(u_int8_t op, u_int16_t a1, u_int16_t a2, u_int16_t p)
1524 {
1525         a1 = ntohs(a1);
1526         a2 = ntohs(a2);
1527         p = ntohs(p);
1528         return (pf_match(op, a1, a2, p));
1529 }
1530
1531 int
1532 pf_match_uid(u_int8_t op, uid_t a1, uid_t a2, uid_t u)
1533 {
1534         if (u == UID_MAX && op != PF_OP_EQ && op != PF_OP_NE)
1535                 return (0);
1536         return (pf_match(op, a1, a2, u));
1537 }
1538
1539 int
1540 pf_match_gid(u_int8_t op, gid_t a1, gid_t a2, gid_t g)
1541 {
1542         if (g == GID_MAX && op != PF_OP_EQ && op != PF_OP_NE)
1543                 return (0);
1544         return (pf_match(op, a1, a2, g));
1545 }
1546
1547 static int
1548 pf_match_tag(struct mbuf *m, struct pf_rule *r, struct pf_rule *nat_rule,
1549              int *tag)
1550 {
1551         if (*tag == -1) {       /* find mbuf tag */
1552                 if (nat_rule != NULL && nat_rule->tag)
1553                         *tag = nat_rule->tag;
1554                 else if (m->m_pkthdr.fw_flags & PF_MBUF_TAGGED)
1555                         *tag = m->m_pkthdr.pf_tag;
1556                 else
1557                         *tag = 0;
1558         }
1559
1560         return ((!r->match_tag_not && r->match_tag == *tag) ||
1561             (r->match_tag_not && r->match_tag != *tag));
1562 }
1563
1564 void
1565 pf_tag_packet(struct mbuf *m, int tag)
1566 {
1567         if (tag <= 0)
1568                 return;
1569
1570         m->m_pkthdr.fw_flags |= PF_MBUF_TAGGED;
1571         m->m_pkthdr.pf_tag = tag;
1572 }
1573
1574 #define PF_STEP_INTO_ANCHOR(r, a, s, n)                                 \
1575         do {                                                            \
1576                 if ((r) == NULL || (r)->anchor == NULL ||               \
1577                     (s) != NULL || (a) != NULL)                         \
1578                         panic("PF_STEP_INTO_ANCHOR");                   \
1579                 (a) = (r);                                              \
1580                 (s) = TAILQ_FIRST(&(r)->anchor->rulesets);              \
1581                 (r) = NULL;                                             \
1582                 while ((s) != NULL && ((r) =                            \
1583                     TAILQ_FIRST((s)->rules[n].active.ptr)) == NULL)     \
1584                         (s) = TAILQ_NEXT((s), entries);                 \
1585                 if ((r) == NULL) {                                      \
1586                         (r) = TAILQ_NEXT((a), entries);                 \
1587                         (a) = NULL;                                     \
1588                 }                                                       \
1589         } while (0)
1590
1591 #define PF_STEP_OUT_OF_ANCHOR(r, a, s, n)                               \
1592         do {                                                            \
1593                 if ((r) != NULL || (a) == NULL || (s) == NULL)          \
1594                         panic("PF_STEP_OUT_OF_ANCHOR");                 \
1595                 (s) = TAILQ_NEXT((s), entries);                         \
1596                 while ((s) != NULL && ((r) =                            \
1597                     TAILQ_FIRST((s)->rules[n].active.ptr)) == NULL)     \
1598                         (s) = TAILQ_NEXT((s), entries);                 \
1599                 if ((r) == NULL) {                                      \
1600                         (r) = TAILQ_NEXT((a), entries);                 \
1601                         (a) = NULL;                                     \
1602                 }                                                       \
1603         } while (0)
1604
1605 #ifdef INET6
1606 void
1607 pf_poolmask(struct pf_addr *naddr, struct pf_addr *raddr,
1608     struct pf_addr *rmask, struct pf_addr *saddr, sa_family_t af)
1609 {
1610         switch (af) {
1611 #ifdef INET
1612         case AF_INET:
1613                 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) |
1614                 ((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]);
1615                 break;
1616 #endif /* INET */
1617         case AF_INET6:
1618                 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) |
1619                 ((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]);
1620                 naddr->addr32[1] = (raddr->addr32[1] & rmask->addr32[1]) |
1621                 ((rmask->addr32[1] ^ 0xffffffff ) & saddr->addr32[1]);
1622                 naddr->addr32[2] = (raddr->addr32[2] & rmask->addr32[2]) |
1623                 ((rmask->addr32[2] ^ 0xffffffff ) & saddr->addr32[2]);
1624                 naddr->addr32[3] = (raddr->addr32[3] & rmask->addr32[3]) |
1625                 ((rmask->addr32[3] ^ 0xffffffff ) & saddr->addr32[3]);
1626                 break;
1627         }
1628 }
1629
1630 void
1631 pf_addr_inc(struct pf_addr *addr, sa_family_t af)
1632 {
1633         switch (af) {
1634 #ifdef INET
1635         case AF_INET:
1636                 addr->addr32[0] = htonl(ntohl(addr->addr32[0]) + 1);
1637                 break;
1638 #endif /* INET */
1639         case AF_INET6:
1640                 if (addr->addr32[3] == 0xffffffff) {
1641                         addr->addr32[3] = 0;
1642                         if (addr->addr32[2] == 0xffffffff) {
1643                                 addr->addr32[2] = 0;
1644                                 if (addr->addr32[1] == 0xffffffff) {
1645                                         addr->addr32[1] = 0;
1646                                         addr->addr32[0] =
1647                                             htonl(ntohl(addr->addr32[0]) + 1);
1648                                 } else
1649                                         addr->addr32[1] =
1650                                             htonl(ntohl(addr->addr32[1]) + 1);
1651                         } else
1652                                 addr->addr32[2] =
1653                                     htonl(ntohl(addr->addr32[2]) + 1);
1654                 } else
1655                         addr->addr32[3] =
1656                             htonl(ntohl(addr->addr32[3]) + 1);
1657                 break;
1658         }
1659 }
1660 #endif /* INET6 */
1661
1662 #define mix(a,b,c) \
1663         do {                                    \
1664                 a -= b; a -= c; a ^= (c >> 13); \
1665                 b -= c; b -= a; b ^= (a << 8);  \
1666                 c -= a; c -= b; c ^= (b >> 13); \
1667                 a -= b; a -= c; a ^= (c >> 12); \
1668                 b -= c; b -= a; b ^= (a << 16); \
1669                 c -= a; c -= b; c ^= (b >> 5);  \
1670                 a -= b; a -= c; a ^= (c >> 3);  \
1671                 b -= c; b -= a; b ^= (a << 10); \
1672                 c -= a; c -= b; c ^= (b >> 15); \
1673         } while (0)
1674
1675 /*
1676  * hash function based on bridge_hash in if_bridge.c
1677  */
1678 void
1679 pf_hash(struct pf_addr *inaddr, struct pf_addr *hash,
1680     struct pf_poolhashkey *key, sa_family_t af)
1681 {
1682         u_int32_t       a = 0x9e3779b9, b = 0x9e3779b9, c = key->key32[0];
1683
1684         switch (af) {
1685 #ifdef INET
1686         case AF_INET:
1687                 a += inaddr->addr32[0];
1688                 b += key->key32[1];
1689                 mix(a, b, c);
1690                 hash->addr32[0] = c + key->key32[2];
1691                 break;
1692 #endif /* INET */
1693 #ifdef INET6
1694         case AF_INET6:
1695                 a += inaddr->addr32[0];
1696                 b += inaddr->addr32[2];
1697                 mix(a, b, c);
1698                 hash->addr32[0] = c;
1699                 a += inaddr->addr32[1];
1700                 b += inaddr->addr32[3];
1701                 c += key->key32[1];
1702                 mix(a, b, c);
1703                 hash->addr32[1] = c;
1704                 a += inaddr->addr32[2];
1705                 b += inaddr->addr32[1];
1706                 c += key->key32[2];
1707                 mix(a, b, c);
1708                 hash->addr32[2] = c;
1709                 a += inaddr->addr32[3];
1710                 b += inaddr->addr32[0];
1711                 c += key->key32[3];
1712                 mix(a, b, c);
1713                 hash->addr32[3] = c;
1714                 break;
1715 #endif /* INET6 */
1716         }
1717 }
1718
1719 int
1720 pf_map_addr(sa_family_t af, struct pf_rule *r, struct pf_addr *saddr,
1721     struct pf_addr *naddr, struct pf_addr *init_addr, struct pf_src_node **sn)
1722 {
1723         unsigned char            hash[16];
1724         struct pf_pool          *rpool = &r->rpool;
1725         struct pf_addr          *raddr = &rpool->cur->addr.v.a.addr;
1726         struct pf_addr          *rmask = &rpool->cur->addr.v.a.mask;
1727         struct pf_pooladdr      *acur = rpool->cur;
1728         struct pf_src_node       k;
1729
1730         if (*sn == NULL && r->rpool.opts & PF_POOL_STICKYADDR &&
1731             (r->rpool.opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) {
1732                 k.af = af;
1733                 PF_ACPY(&k.addr, saddr, af);
1734                 if (r->rule_flag & PFRULE_RULESRCTRACK ||
1735                     r->rpool.opts & PF_POOL_STICKYADDR)
1736                         k.rule.ptr = r;
1737                 else
1738                         k.rule.ptr = NULL;
1739                 pf_status.scounters[SCNT_SRC_NODE_SEARCH]++;
1740                 *sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k);
1741                 if (*sn != NULL && !PF_AZERO(&(*sn)->raddr, af)) {
1742                         PF_ACPY(naddr, &(*sn)->raddr, af);
1743                         if (pf_status.debug >= PF_DEBUG_MISC) {
1744                                 kprintf("pf_map_addr: src tracking maps ");
1745                                 pf_print_host(&k.addr, 0, af);
1746                                 kprintf(" to ");
1747                                 pf_print_host(naddr, 0, af);
1748                                 kprintf("\n");
1749                         }
1750                         return (0);
1751                 }
1752         }
1753
1754         if (rpool->cur->addr.type == PF_ADDR_NOROUTE)
1755                 return (1);
1756         if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
1757                 if (af == AF_INET) {
1758                         if (rpool->cur->addr.p.dyn->pfid_acnt4 < 1 &&
1759                             (rpool->opts & PF_POOL_TYPEMASK) !=
1760                             PF_POOL_ROUNDROBIN)
1761                                 return (1);
1762                          raddr = &rpool->cur->addr.p.dyn->pfid_addr4;
1763                          rmask = &rpool->cur->addr.p.dyn->pfid_mask4;
1764                 } else {
1765                         if (rpool->cur->addr.p.dyn->pfid_acnt6 < 1 &&
1766                             (rpool->opts & PF_POOL_TYPEMASK) !=
1767                             PF_POOL_ROUNDROBIN)
1768                                 return (1);
1769                         raddr = &rpool->cur->addr.p.dyn->pfid_addr6;
1770                         rmask = &rpool->cur->addr.p.dyn->pfid_mask6;
1771                 }
1772         } else if (rpool->cur->addr.type == PF_ADDR_TABLE) {
1773                 if ((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN)
1774                         return (1); /* unsupported */
1775         } else {
1776                 raddr = &rpool->cur->addr.v.a.addr;
1777                 rmask = &rpool->cur->addr.v.a.mask;
1778         }
1779
1780         switch (rpool->opts & PF_POOL_TYPEMASK) {
1781         case PF_POOL_NONE:
1782                 PF_ACPY(naddr, raddr, af);
1783                 break;
1784         case PF_POOL_BITMASK:
1785                 PF_POOLMASK(naddr, raddr, rmask, saddr, af);
1786                 break;
1787         case PF_POOL_RANDOM:
1788                 if (init_addr != NULL && PF_AZERO(init_addr, af)) {
1789                         switch (af) {
1790 #ifdef INET
1791                         case AF_INET:
1792                                 rpool->counter.addr32[0] = karc4random();
1793                                 break;
1794 #endif /* INET */
1795 #ifdef INET6
1796                         case AF_INET6:
1797                                 if (rmask->addr32[3] != 0xffffffff)
1798                                         rpool->counter.addr32[3] = karc4random();
1799                                 else
1800                                         break;
1801                                 if (rmask->addr32[2] != 0xffffffff)
1802                                         rpool->counter.addr32[2] = karc4random();
1803                                 else
1804                                         break;
1805                                 if (rmask->addr32[1] != 0xffffffff)
1806                                         rpool->counter.addr32[1] = karc4random();
1807                                 else
1808                                         break;
1809                                 if (rmask->addr32[0] != 0xffffffff)
1810                                         rpool->counter.addr32[0] = karc4random();
1811                                 break;
1812 #endif /* INET6 */
1813                         }
1814                         PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af);
1815                         PF_ACPY(init_addr, naddr, af);
1816
1817                 } else {
1818                         PF_AINC(&rpool->counter, af);
1819                         PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af);
1820                 }
1821                 break;
1822         case PF_POOL_SRCHASH:
1823                 pf_hash(saddr, (struct pf_addr *)&hash, &rpool->key, af);
1824                 PF_POOLMASK(naddr, raddr, rmask, (struct pf_addr *)&hash, af);
1825                 break;
1826         case PF_POOL_ROUNDROBIN:
1827                 if (rpool->cur->addr.type == PF_ADDR_TABLE) {
1828                         if (!pfr_pool_get(rpool->cur->addr.p.tbl,
1829                             &rpool->tblidx, &rpool->counter,
1830                             &raddr, &rmask, af))
1831                                 goto get_addr;
1832                 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
1833                         if (!pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
1834                             &rpool->tblidx, &rpool->counter,
1835                             &raddr, &rmask, af))
1836                                 goto get_addr;
1837                 } else if (pf_match_addr(0, raddr, rmask, &rpool->counter, af))
1838                         goto get_addr;
1839
1840         try_next:
1841                 if ((rpool->cur = TAILQ_NEXT(rpool->cur, entries)) == NULL)
1842                         rpool->cur = TAILQ_FIRST(&rpool->list);
1843                 if (rpool->cur->addr.type == PF_ADDR_TABLE) {
1844                         rpool->tblidx = -1;
1845                         if (pfr_pool_get(rpool->cur->addr.p.tbl,
1846                             &rpool->tblidx, &rpool->counter,
1847                             &raddr, &rmask, af)) {
1848                                 /* table contains no address of type 'af' */
1849                                 if (rpool->cur != acur)
1850                                         goto try_next;
1851                                 return (1);
1852                         }
1853                 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
1854                         rpool->tblidx = -1;
1855                         if (pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
1856                             &rpool->tblidx, &rpool->counter,
1857                             &raddr, &rmask, af)) {
1858                                 /* table contains no address of type 'af' */
1859                                 if (rpool->cur != acur)
1860                                         goto try_next;
1861                                 return (1);
1862                         }
1863                 } else {
1864                         raddr = &rpool->cur->addr.v.a.addr;
1865                         rmask = &rpool->cur->addr.v.a.mask;
1866                         PF_ACPY(&rpool->counter, raddr, af);
1867                 }
1868
1869         get_addr:
1870                 PF_ACPY(naddr, &rpool->counter, af);
1871                 PF_AINC(&rpool->counter, af);
1872                 break;
1873         }
1874         if (*sn != NULL)
1875                 PF_ACPY(&(*sn)->raddr, naddr, af);
1876
1877         if (pf_status.debug >= PF_DEBUG_MISC &&
1878             (rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) {
1879                 kprintf("pf_map_addr: selected address ");
1880                 pf_print_host(naddr, 0, af);
1881                 kprintf("\n");
1882         }
1883
1884         return (0);
1885 }
1886
1887 int
1888 pf_get_sport(sa_family_t af, u_int8_t proto, struct pf_rule *r,
1889     struct pf_addr *saddr, struct pf_addr *daddr, u_int16_t dport,
1890     struct pf_addr *naddr, u_int16_t *nport, u_int16_t low, u_int16_t high,
1891     struct pf_src_node **sn)
1892 {
1893         struct pf_state         key;
1894         struct pf_addr          init_addr;
1895         u_int16_t               cut;
1896
1897         bzero(&init_addr, sizeof(init_addr));
1898         if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn))
1899                 return (1);
1900
1901         do {
1902                 key.af = af;
1903                 key.proto = proto;
1904                 PF_ACPY(&key.ext.addr, daddr, key.af);
1905                 PF_ACPY(&key.gwy.addr, naddr, key.af);
1906                 key.ext.port = dport;
1907
1908                 /*
1909                  * port search; start random, step;
1910                  * similar 2 portloop in in_pcbbind
1911                  */
1912                 if (!(proto == IPPROTO_TCP || proto == IPPROTO_UDP)) {
1913                         key.gwy.port = 0;
1914                         if (pf_find_state_all(&key, PF_EXT_GWY, NULL) == NULL)
1915                                 return (0);
1916                 } else if (low == 0 && high == 0) {
1917                         key.gwy.port = *nport;
1918                         if (pf_find_state_all(&key, PF_EXT_GWY, NULL) == NULL)
1919                                 return (0);
1920                 } else if (low == high) {
1921                         key.gwy.port = htons(low);
1922                         if (pf_find_state_all(&key, PF_EXT_GWY, NULL) == NULL) {
1923                                 *nport = htons(low);
1924                                 return (0);
1925                         }
1926                 } else {
1927                         u_int16_t tmp;
1928
1929                         if (low > high) {
1930                                 tmp = low;
1931                                 low = high;
1932                                 high = tmp;
1933                         }
1934                         /* low < high */
1935                         cut = karc4random() % (1 + high - low) + low;
1936                         /* low <= cut <= high */
1937                         for (tmp = cut; tmp <= high; ++(tmp)) {
1938                                 key.gwy.port = htons(tmp);
1939                                 if (pf_find_state_all(&key, PF_EXT_GWY, NULL) ==
1940                                     NULL) {
1941                                         *nport = htons(tmp);
1942                                         return (0);
1943                                 }
1944                         }
1945                         for (tmp = cut - 1; tmp >= low; --(tmp)) {
1946                                 key.gwy.port = htons(tmp);
1947                                 if (pf_find_state_all(&key, PF_EXT_GWY, NULL) ==
1948                                     NULL) {
1949                                         *nport = htons(tmp);
1950                                         return (0);
1951                                 }
1952                         }
1953                 }
1954
1955                 switch (r->rpool.opts & PF_POOL_TYPEMASK) {
1956                 case PF_POOL_RANDOM:
1957                 case PF_POOL_ROUNDROBIN:
1958                         if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn))
1959                                 return (1);
1960                         break;
1961                 case PF_POOL_NONE:
1962                 case PF_POOL_SRCHASH:
1963                 case PF_POOL_BITMASK:
1964                 default:
1965                         return (1);
1966                 }
1967         } while (! PF_AEQ(&init_addr, naddr, af) );
1968
1969         return (1);                                     /* none available */
1970 }
1971
1972 struct pf_rule *
1973 pf_match_translation(struct pf_pdesc *pd, struct mbuf *m, int off,
1974     int direction, struct pfi_kif *kif, struct pf_addr *saddr, u_int16_t sport,
1975     struct pf_addr *daddr, u_int16_t dport, int rs_num)
1976 {
1977         struct pf_rule          *r, *rm = NULL, *anchorrule = NULL;
1978         struct pf_ruleset       *ruleset = NULL;
1979
1980         r = TAILQ_FIRST(pf_main_ruleset.rules[rs_num].active.ptr);
1981         while (r && rm == NULL) {
1982                 struct pf_rule_addr     *src = NULL, *dst = NULL;
1983                 struct pf_addr_wrap     *xdst = NULL;
1984
1985                 if (r->action == PF_BINAT && direction == PF_IN) {
1986                         src = &r->dst;
1987                         if (r->rpool.cur != NULL)
1988                                 xdst = &r->rpool.cur->addr;
1989                 } else {
1990                         src = &r->src;
1991                         dst = &r->dst;
1992                 }
1993
1994                 r->evaluations++;
1995                 if (r->kif != NULL &&
1996                     (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot)
1997                         r = r->skip[PF_SKIP_IFP].ptr;
1998                 else if (r->direction && r->direction != direction)
1999                         r = r->skip[PF_SKIP_DIR].ptr;
2000                 else if (r->af && r->af != pd->af)
2001                         r = r->skip[PF_SKIP_AF].ptr;
2002                 else if (r->proto && r->proto != pd->proto)
2003                         r = r->skip[PF_SKIP_PROTO].ptr;
2004                 else if (PF_MISMATCHAW(&src->addr, saddr, pd->af, src->not))
2005                         r = r->skip[src == &r->src ? PF_SKIP_SRC_ADDR :
2006                             PF_SKIP_DST_ADDR].ptr;
2007                 else if (src->port_op && !pf_match_port(src->port_op,
2008                     src->port[0], src->port[1], sport))
2009                         r = r->skip[src == &r->src ? PF_SKIP_SRC_PORT :
2010                             PF_SKIP_DST_PORT].ptr;
2011                 else if (dst != NULL &&
2012                     PF_MISMATCHAW(&dst->addr, daddr, pd->af, dst->not))
2013                         r = r->skip[PF_SKIP_DST_ADDR].ptr;
2014                 else if (xdst != NULL && PF_MISMATCHAW(xdst, daddr, pd->af, 0))
2015                         r = TAILQ_NEXT(r, entries);
2016                 else if (dst != NULL && dst->port_op &&
2017                     !pf_match_port(dst->port_op, dst->port[0],
2018                     dst->port[1], dport))
2019                         r = r->skip[PF_SKIP_DST_PORT].ptr;
2020                 else if (r->os_fingerprint != PF_OSFP_ANY && (pd->proto !=
2021                     IPPROTO_TCP || !pf_osfp_match(pf_osfp_fingerprint(pd, m,
2022                     off, pd->hdr.tcp), r->os_fingerprint)))
2023                         r = TAILQ_NEXT(r, entries);
2024                 else if (r->anchorname[0] && r->anchor == NULL)
2025                         r = TAILQ_NEXT(r, entries);
2026                 else if (r->anchor == NULL)
2027                                 rm = r;
2028                 else
2029                         PF_STEP_INTO_ANCHOR(r, anchorrule, ruleset, rs_num);
2030                 if (r == NULL && anchorrule != NULL)
2031                         PF_STEP_OUT_OF_ANCHOR(r, anchorrule, ruleset,
2032                             rs_num);
2033         }
2034         if (rm != NULL && (rm->action == PF_NONAT ||
2035             rm->action == PF_NORDR || rm->action == PF_NOBINAT))
2036                 return (NULL);
2037         return (rm);
2038 }
2039
2040 struct pf_rule *
2041 pf_get_translation(struct pf_pdesc *pd, struct mbuf *m, int off, int direction,
2042     struct pfi_kif *kif, struct pf_src_node **sn,
2043     struct pf_addr *saddr, u_int16_t sport,
2044     struct pf_addr *daddr, u_int16_t dport,
2045     struct pf_addr *naddr, u_int16_t *nport)
2046 {
2047         struct pf_rule  *r = NULL;
2048
2049         if (direction == PF_OUT) {
2050                 r = pf_match_translation(pd, m, off, direction, kif, saddr,
2051                     sport, daddr, dport, PF_RULESET_BINAT);
2052                 if (r == NULL)
2053                         r = pf_match_translation(pd, m, off, direction, kif,
2054                             saddr, sport, daddr, dport, PF_RULESET_NAT);
2055         } else {
2056                 r = pf_match_translation(pd, m, off, direction, kif, saddr,
2057                     sport, daddr, dport, PF_RULESET_RDR);
2058                 if (r == NULL)
2059                         r = pf_match_translation(pd, m, off, direction, kif,
2060                             saddr, sport, daddr, dport, PF_RULESET_BINAT);
2061         }
2062
2063         if (r != NULL) {
2064                 switch (r->action) {
2065                 case PF_NONAT:
2066                 case PF_NOBINAT:
2067                 case PF_NORDR:
2068                         return (NULL);
2069                 case PF_NAT:
2070                         if (pf_get_sport(pd->af, pd->proto, r, saddr,
2071                             daddr, dport, naddr, nport, r->rpool.proxy_port[0],
2072                             r->rpool.proxy_port[1], sn)) {
2073                                 DPFPRINTF(PF_DEBUG_MISC,
2074                                     ("pf: NAT proxy port allocation "
2075                                     "(%u-%u) failed\n",
2076                                     r->rpool.proxy_port[0],
2077                                     r->rpool.proxy_port[1]));
2078                                 return (NULL);
2079                         }
2080                         break;
2081                 case PF_BINAT:
2082                         switch (direction) {
2083                         case PF_OUT:
2084                                 if (r->rpool.cur->addr.type == PF_ADDR_DYNIFTL){
2085                                         if (pd->af == AF_INET) {
2086                                                 if (r->rpool.cur->addr.p.dyn->
2087                                                     pfid_acnt4 < 1)
2088                                                         return (NULL);
2089                                                 PF_POOLMASK(naddr,
2090                                                     &r->rpool.cur->addr.p.dyn->
2091                                                     pfid_addr4,
2092                                                     &r->rpool.cur->addr.p.dyn->
2093                                                     pfid_mask4,
2094                                                     saddr, AF_INET);
2095                                         } else {
2096                                                 if (r->rpool.cur->addr.p.dyn->
2097                                                     pfid_acnt6 < 1)
2098                                                         return (NULL);
2099                                                 PF_POOLMASK(naddr,
2100                                                     &r->rpool.cur->addr.p.dyn->
2101                                                     pfid_addr6,
2102                                                     &r->rpool.cur->addr.p.dyn->
2103                                                     pfid_mask6,
2104                                                     saddr, AF_INET6);
2105                                         }
2106                                 } else
2107                                         PF_POOLMASK(naddr,
2108                                             &r->rpool.cur->addr.v.a.addr,
2109                                             &r->rpool.cur->addr.v.a.mask,
2110                                             saddr, pd->af);
2111                                 break;
2112                         case PF_IN:
2113                                 if (r->src.addr.type == PF_ADDR_DYNIFTL){
2114                                         if (pd->af == AF_INET) {
2115                                                 if (r->src.addr.p.dyn->
2116                                                     pfid_acnt4 < 1)
2117                                                         return (NULL);
2118                                                 PF_POOLMASK(naddr,
2119                                                     &r->src.addr.p.dyn->
2120                                                     pfid_addr4,
2121                                                     &r->src.addr.p.dyn->
2122                                                     pfid_mask4,
2123                                                     daddr, AF_INET);
2124                                         } else {
2125                                                 if (r->src.addr.p.dyn->
2126                                                     pfid_acnt6 < 1)
2127                                                         return (NULL);
2128                                                 PF_POOLMASK(naddr,
2129                                                     &r->src.addr.p.dyn->
2130                                                     pfid_addr6,
2131                                                     &r->src.addr.p.dyn->
2132                                                     pfid_mask6,
2133                                                     daddr, AF_INET6);
2134                                         }
2135                                 } else
2136                                         PF_POOLMASK(naddr,
2137                                             &r->src.addr.v.a.addr,
2138                                             &r->src.addr.v.a.mask, daddr,
2139                                             pd->af);
2140                                 break;
2141                         }
2142                         break;
2143                 case PF_RDR: {
2144                         if (pf_map_addr(r->af, r, saddr, naddr, NULL, sn))
2145                                 return (NULL);
2146
2147                         if (r->rpool.proxy_port[1]) {
2148                                 u_int32_t       tmp_nport;
2149
2150                                 tmp_nport = ((ntohs(dport) -
2151                                     ntohs(r->dst.port[0])) %
2152                                     (r->rpool.proxy_port[1] -
2153                                     r->rpool.proxy_port[0] + 1)) +
2154                                     r->rpool.proxy_port[0];
2155
2156                                 /* wrap around if necessary */
2157                                 if (tmp_nport > 65535)
2158                                         tmp_nport -= 65535;
2159                                 *nport = htons((u_int16_t)tmp_nport);
2160                         } else if (r->rpool.proxy_port[0])
2161                                 *nport = htons(r->rpool.proxy_port[0]);
2162                         break;
2163                 }
2164                 default:
2165                         return (NULL);
2166                 }
2167         }
2168
2169         return (r);
2170 }
2171
2172 #ifdef SMP
2173 struct netmsg_hashlookup {
2174         struct netmsg           nm_netmsg;
2175         struct inpcb            **nm_pinp;
2176         struct inpcbinfo        *nm_pcbinfo;
2177         struct pf_addr          *nm_saddr;
2178         struct pf_addr          *nm_daddr;
2179         uint16_t                nm_sport;
2180         uint16_t                nm_dport;
2181         sa_family_t             nm_af;
2182 };
2183
2184 static void
2185 in_pcblookup_hash_handler(struct netmsg *msg0)
2186 {
2187         struct netmsg_hashlookup *msg = (struct netmsg_hashlookup *)msg0;
2188
2189         if (msg->nm_af == AF_INET)
2190                 *msg->nm_pinp = in_pcblookup_hash(msg->nm_pcbinfo,
2191                     msg->nm_saddr->v4, msg->nm_sport, msg->nm_daddr->v4,
2192                     msg->nm_dport, INPLOOKUP_WILDCARD, NULL);
2193 #ifdef INET6
2194         else
2195                 *msg->nm_pinp = in6_pcblookup_hash(msg->nm_pcbinfo,
2196                     &msg->nm_saddr->v6, msg->nm_sport, &msg->nm_daddr->v6,
2197                     msg->nm_dport, INPLOOKUP_WILDCARD, NULL);
2198 #endif /* INET6 */
2199         lwkt_replymsg(&msg->nm_netmsg.nm_lmsg, 0);
2200 }
2201 #endif /* SMP */
2202
2203 int
2204 pf_socket_lookup(uid_t *uid, gid_t *gid, int direction, struct pf_pdesc *pd)
2205 {
2206         struct pf_addr          *saddr, *daddr;
2207         u_int16_t                sport, dport;
2208         struct inpcbinfo        *pi;
2209         struct inpcb            *inp;
2210 #ifdef SMP
2211         struct netmsg_hashlookup *msg = NULL;
2212 #endif
2213         int                      pi_cpu = 0;
2214
2215         *uid = UID_MAX;
2216         *gid = GID_MAX;
2217         if (direction == PF_IN) {
2218                 saddr = pd->src;
2219                 daddr = pd->dst;
2220         } else {
2221                 saddr = pd->dst;
2222                 daddr = pd->src;
2223         }
2224         switch (pd->proto) {
2225         case IPPROTO_TCP:
2226                 sport = pd->hdr.tcp->th_sport;
2227                 dport = pd->hdr.tcp->th_dport;
2228
2229                 pi_cpu = tcp_addrcpu(saddr->v4.s_addr, sport, daddr->v4.s_addr, dport);
2230                 pi = &tcbinfo[pi_cpu];
2231 #ifdef SMP
2232                 /*
2233                  * Our netstack runs lockless on MP systems
2234                  * (only for TCP connections at the moment).
2235                  * 
2236                  * As we are not allowed to read another CPU's tcbinfo,
2237                  * we have to ask that CPU via remote call to search the
2238                  * table for us.
2239                  * 
2240                  * Prepare a msg iff data belongs to another CPU.
2241                  */
2242                 if (pi_cpu != mycpu->gd_cpuid) {
2243                         msg = kmalloc(sizeof(*msg), M_LWKTMSG, M_INTWAIT);
2244                         netmsg_init(&msg->nm_netmsg, &netisr_afree_rport, 0,
2245                                     in_pcblookup_hash_handler);
2246                         msg->nm_pinp = &inp;
2247                         msg->nm_pcbinfo = pi;
2248                         msg->nm_saddr = saddr;
2249                         msg->nm_sport = sport;
2250                         msg->nm_daddr = daddr;
2251                         msg->nm_dport = dport;
2252                         msg->nm_af = pd->af;
2253                 }
2254 #endif /* SMP */
2255                 break;
2256         case IPPROTO_UDP:
2257                 sport = pd->hdr.udp->uh_sport;
2258                 dport = pd->hdr.udp->uh_dport;
2259                 pi = &udbinfo;
2260                 break;
2261         default:
2262                 return (0);
2263         }
2264         if (direction != PF_IN) {
2265                 u_int16_t       p;
2266
2267                 p = sport;
2268                 sport = dport;
2269                 dport = p;
2270         }
2271         switch (pd->af) {
2272 #ifdef INET6
2273         case AF_INET6:
2274 #ifdef SMP
2275                 /*
2276                  * Query other CPU, second part
2277                  * 
2278                  * msg only gets initialized when:
2279                  * 1) packet is TCP
2280                  * 2) the info belongs to another CPU
2281                  *
2282                  * Use some switch/case magic to avoid code duplication.
2283                  */
2284                 if (msg == NULL)
2285 #endif /* SMP */
2286                 {
2287                         inp = in6_pcblookup_hash(pi, &saddr->v6, sport,
2288                             &daddr->v6, dport, INPLOOKUP_WILDCARD, NULL);
2289
2290                         if (inp == NULL)
2291                                 return (0);
2292                         break;
2293                 }
2294                 /* FALLTHROUGH if SMP and on other CPU */
2295 #endif /* INET6 */
2296         case AF_INET:
2297 #ifdef SMP
2298                 if (msg != NULL) {
2299                         lwkt_sendmsg(tcp_cport(pi_cpu),
2300                                      &msg->nm_netmsg.nm_lmsg);
2301                 } else
2302 #endif /* SMP */
2303                 {
2304                         inp = in_pcblookup_hash(pi, saddr->v4, sport, daddr->v4,
2305                             dport, INPLOOKUP_WILDCARD, NULL);
2306                 }
2307                 if (inp == NULL)
2308                         return (0);
2309                 break;
2310
2311         default:
2312                 return (0);
2313         }
2314         *uid = inp->inp_socket->so_cred->cr_uid;
2315         *gid = inp->inp_socket->so_cred->cr_groups[0];
2316         return (1);
2317 }
2318
2319 u_int8_t
2320 pf_get_wscale(struct mbuf *m, int off, u_int16_t th_off, sa_family_t af)
2321 {
2322         int              hlen;
2323         u_int8_t         hdr[60];
2324         u_int8_t        *opt, optlen;
2325         u_int8_t         wscale = 0;
2326
2327         hlen = th_off << 2;             /* hlen <= sizeof(hdr) */
2328         if (hlen <= sizeof(struct tcphdr))
2329                 return (0);
2330         if (!pf_pull_hdr(m, off, hdr, hlen, NULL, NULL, af))
2331                 return (0);
2332         opt = hdr + sizeof(struct tcphdr);
2333         hlen -= sizeof(struct tcphdr);
2334         while (hlen >= 3) {
2335                 switch (*opt) {
2336                 case TCPOPT_EOL:
2337                 case TCPOPT_NOP:
2338                         ++opt;
2339                         --hlen;
2340                         break;
2341                 case TCPOPT_WINDOW:
2342                         wscale = opt[2];
2343                         if (wscale > TCP_MAX_WINSHIFT)
2344                                 wscale = TCP_MAX_WINSHIFT;
2345                         wscale |= PF_WSCALE_FLAG;
2346                         /* FALLTHROUGH */
2347                 default:
2348                         optlen = opt[1];
2349                         if (optlen < 2)
2350                                 optlen = 2;
2351                         hlen -= optlen;
2352                         opt += optlen;
2353                         break;
2354                 }
2355         }
2356         return (wscale);
2357 }
2358
2359 u_int16_t
2360 pf_get_mss(struct mbuf *m, int off, u_int16_t th_off, sa_family_t af)
2361 {
2362         int              hlen;
2363         u_int8_t         hdr[60];
2364         u_int8_t        *opt, optlen;
2365         u_int16_t        mss = tcp_mssdflt;
2366
2367         hlen = th_off << 2;     /* hlen <= sizeof(hdr) */
2368         if (hlen <= sizeof(struct tcphdr))
2369                 return (0);
2370         if (!pf_pull_hdr(m, off, hdr, hlen, NULL, NULL, af))
2371                 return (0);
2372         opt = hdr + sizeof(struct tcphdr);
2373         hlen -= sizeof(struct tcphdr);
2374         while (hlen >= TCPOLEN_MAXSEG) {
2375                 switch (*opt) {
2376                 case TCPOPT_EOL:
2377                 case TCPOPT_NOP:
2378                         ++opt;
2379                         --hlen;
2380                         break;
2381                 case TCPOPT_MAXSEG:
2382                         bcopy((caddr_t)(opt + 2), (caddr_t)&mss, 2);
2383                         /* FALLTHROUGH */
2384                 default:
2385                         optlen = opt[1];
2386                         if (optlen < 2)
2387                                 optlen = 2;
2388                         hlen -= optlen;
2389                         opt += optlen;
2390                         break;
2391                 }
2392         }
2393         return (mss);
2394 }
2395
2396 u_int16_t
2397 pf_calc_mss(struct pf_addr *addr, sa_family_t af, u_int16_t offer)
2398 {
2399 #ifdef INET
2400         struct sockaddr_in      *dst;
2401         struct route             ro;
2402 #endif /* INET */
2403 #ifdef INET6
2404         struct sockaddr_in6     *dst6;
2405         struct route_in6         ro6;
2406 #endif /* INET6 */
2407         struct rtentry          *rt = NULL;
2408         int                      hlen = 0;
2409         u_int16_t                mss = tcp_mssdflt;
2410
2411         switch (af) {
2412 #ifdef INET
2413         case AF_INET:
2414                 hlen = sizeof(struct ip);
2415                 bzero(&ro, sizeof(ro));
2416                 dst = (struct sockaddr_in *)&ro.ro_dst;
2417                 dst->sin_family = AF_INET;
2418                 dst->sin_len = sizeof(*dst);
2419                 dst->sin_addr = addr->v4;
2420                 rtalloc_ign(&ro, (RTF_CLONING | RTF_PRCLONING));
2421                 rt = ro.ro_rt;
2422                 break;
2423 #endif /* INET */
2424 #ifdef INET6
2425         case AF_INET6:
2426                 hlen = sizeof(struct ip6_hdr);
2427                 bzero(&ro6, sizeof(ro6));
2428                 dst6 = (struct sockaddr_in6 *)&ro6.ro_dst;
2429                 dst6->sin6_family = AF_INET6;
2430                 dst6->sin6_len = sizeof(*dst6);
2431                 dst6->sin6_addr = addr->v6;
2432                 rtalloc_ign((struct route *)&ro6, (RTF_CLONING | RTF_PRCLONING));
2433                 rt = ro6.ro_rt;
2434                 break;
2435 #endif /* INET6 */
2436         }
2437
2438         if (rt && rt->rt_ifp) {
2439                 mss = rt->rt_ifp->if_mtu - hlen - sizeof(struct tcphdr);
2440                 mss = max(tcp_mssdflt, mss);
2441                 RTFREE(rt);
2442         }
2443         mss = min(mss, offer);
2444         mss = max(mss, 64);             /* sanity - at least max opt space */
2445         return (mss);
2446 }
2447
2448 void
2449 pf_set_rt_ifp(struct pf_state *s, struct pf_addr *saddr)
2450 {
2451         struct pf_rule *r = s->rule.ptr;
2452
2453         s->rt_kif = NULL;
2454         if (!r->rt || r->rt == PF_FASTROUTE)
2455                 return;
2456         switch (s->af) {
2457 #ifdef INET
2458         case AF_INET:
2459                 pf_map_addr(AF_INET, r, saddr, &s->rt_addr, NULL,
2460                     &s->nat_src_node);
2461                 s->rt_kif = r->rpool.cur->kif;
2462                 break;
2463 #endif /* INET */
2464 #ifdef INET6
2465         case AF_INET6:
2466                 pf_map_addr(AF_INET6, r, saddr, &s->rt_addr, NULL,
2467                     &s->nat_src_node);
2468                 s->rt_kif = r->rpool.cur->kif;
2469                 break;
2470 #endif /* INET6 */
2471         }
2472 }
2473
2474 int
2475 pf_test_tcp(struct pf_rule **rm, struct pf_state **sm, int direction,
2476     struct pfi_kif *kif, struct mbuf *m, int off, void *h,
2477     struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm)
2478 {
2479         struct pf_rule          *nr = NULL;
2480         struct pf_addr          *saddr = pd->src, *daddr = pd->dst;
2481         struct tcphdr           *th = pd->hdr.tcp;
2482         u_int16_t                bport, nport = 0;
2483         sa_family_t              af = pd->af;
2484         int                      lookup = -1;
2485         uid_t                    uid;
2486         gid_t                    gid;
2487         struct pf_rule          *r, *a = NULL;
2488         struct pf_ruleset       *ruleset = NULL;
2489         struct pf_src_node      *nsn = NULL;
2490         u_short                  reason;
2491         int                      rewrite = 0;
2492         int                      tag = -1;
2493         u_int16_t                mss = tcp_mssdflt;
2494
2495         r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
2496
2497         if (direction == PF_OUT) {
2498                 bport = nport = th->th_sport;
2499                 /* check outgoing packet for BINAT/NAT */
2500                 if ((nr = pf_get_translation(pd, m, off, PF_OUT, kif, &nsn,
2501                     saddr, th->th_sport, daddr, th->th_dport,
2502                     &pd->naddr, &nport)) != NULL) {
2503                         PF_ACPY(&pd->baddr, saddr, af);
2504                         pf_change_ap(saddr, &th->th_sport, pd->ip_sum,
2505                             &th->th_sum, &pd->naddr, nport, 0, af);
2506                         rewrite++;
2507                         if (nr->natpass)
2508                                 r = NULL;
2509                         pd->nat_rule = nr;
2510                 }
2511         } else {
2512                 bport = nport = th->th_dport;
2513                 /* check incoming packet for BINAT/RDR */
2514                 if ((nr = pf_get_translation(pd, m, off, PF_IN, kif, &nsn,
2515                     saddr, th->th_sport, daddr, th->th_dport,
2516                     &pd->naddr, &nport)) != NULL) {
2517                         PF_ACPY(&pd->baddr, daddr, af);
2518                         pf_change_ap(daddr, &th->th_dport, pd->ip_sum,
2519                             &th->th_sum, &pd->naddr, nport, 0, af);
2520                         rewrite++;
2521                         if (nr->natpass)
2522                                 r = NULL;
2523                         pd->nat_rule = nr;
2524                 }
2525         }
2526
2527         while (r != NULL) {
2528                 r->evaluations++;
2529                 if (r->kif != NULL &&
2530                     (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot)
2531                         r = r->skip[PF_SKIP_IFP].ptr;
2532                 else if (r->direction && r->direction != direction)
2533                         r = r->skip[PF_SKIP_DIR].ptr;
2534                 else if (r->af && r->af != af)
2535                         r = r->skip[PF_SKIP_AF].ptr;
2536                 else if (r->proto && r->proto != IPPROTO_TCP)
2537                         r = r->skip[PF_SKIP_PROTO].ptr;
2538                 else if (PF_MISMATCHAW(&r->src.addr, saddr, af, r->src.not))
2539                         r = r->skip[PF_SKIP_SRC_ADDR].ptr;
2540                 else if (r->src.port_op && !pf_match_port(r->src.port_op,
2541                     r->src.port[0], r->src.port[1], th->th_sport))
2542                         r = r->skip[PF_SKIP_SRC_PORT].ptr;
2543                 else if (PF_MISMATCHAW(&r->dst.addr, daddr, af, r->dst.not))
2544                         r = r->skip[PF_SKIP_DST_ADDR].ptr;
2545                 else if (r->dst.port_op && !pf_match_port(r->dst.port_op,
2546                     r->dst.port[0], r->dst.port[1], th->th_dport))
2547                         r = r->skip[PF_SKIP_DST_PORT].ptr;
2548                 else if (r->tos && !(r->tos & pd->tos))
2549                         r = TAILQ_NEXT(r, entries);
2550                 else if (r->rule_flag & PFRULE_FRAGMENT)
2551                         r = TAILQ_NEXT(r, entries);
2552                 else if ((r->flagset & th->th_flags) != r->flags)
2553                         r = TAILQ_NEXT(r, entries);
2554                 else if (r->uid.op && (lookup != -1 || (lookup =
2555                     pf_socket_lookup(&uid, &gid, direction, pd), 1)) &&
2556                     !pf_match_uid(r->uid.op, r->uid.uid[0], r->uid.uid[1],
2557                     uid))
2558                         r = TAILQ_NEXT(r, entries);
2559                 else if (r->gid.op && (lookup != -1 || (lookup =
2560                     pf_socket_lookup(&uid, &gid, direction, pd), 1)) &&
2561                     !pf_match_gid(r->gid.op, r->gid.gid[0], r->gid.gid[1],
2562                     gid))
2563                         r = TAILQ_NEXT(r, entries);
2564                 else if (r->match_tag && !pf_match_tag(m, r, nr, &tag))
2565                         r = TAILQ_NEXT(r, entries);
2566                 else if (r->anchorname[0] && r->anchor == NULL)
2567                         r = TAILQ_NEXT(r, entries);
2568                 else if (r->os_fingerprint != PF_OSFP_ANY && !pf_osfp_match(
2569                     pf_osfp_fingerprint(pd, m, off, th), r->os_fingerprint))
2570                         r = TAILQ_NEXT(r, entries);
2571                 else {
2572                         if (r->tag)
2573                                 tag = r->tag;
2574                         if (r->anchor == NULL) {
2575                                 *rm = r;
2576                                 *am = a;
2577                                 *rsm = ruleset;
2578                                 if ((*rm)->quick)
2579                                         break;
2580                                 r = TAILQ_NEXT(r, entries);
2581                         } else
2582                                 PF_STEP_INTO_ANCHOR(r, a, ruleset,
2583                                     PF_RULESET_FILTER);
2584                 }
2585                 if (r == NULL && a != NULL)
2586                         PF_STEP_OUT_OF_ANCHOR(r, a, ruleset,
2587                             PF_RULESET_FILTER);
2588         }
2589         r = *rm;
2590         a = *am;
2591         ruleset = *rsm;
2592
2593         REASON_SET(&reason, PFRES_MATCH);
2594
2595         if (r->log) {
2596                 if (rewrite)
2597                         m_copyback(m, off, sizeof(*th), (caddr_t)th);
2598                 PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset);
2599         }
2600
2601         if ((r->action == PF_DROP) &&
2602             ((r->rule_flag & PFRULE_RETURNRST) ||
2603             (r->rule_flag & PFRULE_RETURNICMP) ||
2604             (r->rule_flag & PFRULE_RETURN))) {
2605                 /* undo NAT changes, if they have taken place */
2606                 if (nr != NULL) {
2607                         if (direction == PF_OUT) {
2608                                 pf_change_ap(saddr, &th->th_sport, pd->ip_sum,
2609                                     &th->th_sum, &pd->baddr, bport, 0, af);
2610                                 rewrite++;
2611                         } else {
2612                                 pf_change_ap(daddr, &th->th_dport, pd->ip_sum,
2613                                     &th->th_sum, &pd->baddr, bport, 0, af);
2614                                 rewrite++;
2615                         }
2616                 }
2617                 if (((r->rule_flag & PFRULE_RETURNRST) ||
2618                     (r->rule_flag & PFRULE_RETURN)) &&
2619                     !(th->th_flags & TH_RST)) {
2620                         u_int32_t ack = ntohl(th->th_seq) + pd->p_len;
2621
2622                         if (th->th_flags & TH_SYN)
2623                                 ack++;
2624                         if (th->th_flags & TH_FIN)
2625                                 ack++;
2626                         pf_send_tcp(r, af, pd->dst,
2627                             pd->src, th->th_dport, th->th_sport,
2628                             ntohl(th->th_ack), ack, TH_RST|TH_ACK, 0, 0,
2629                             r->return_ttl);
2630                 } else if ((af == AF_INET) && r->return_icmp)
2631                         pf_send_icmp(m, r->return_icmp >> 8,
2632                             r->return_icmp & 255, af, r);
2633                 else if ((af == AF_INET6) && r->return_icmp6)
2634                         pf_send_icmp(m, r->return_icmp6 >> 8,
2635                             r->return_icmp6 & 255, af, r);
2636         }
2637
2638         if (r->action == PF_DROP)
2639                 return (PF_DROP);
2640
2641         pf_tag_packet(m, tag);
2642
2643         if (r->keep_state || nr != NULL ||
2644             (pd->flags & PFDESC_TCP_NORM)) {
2645                 /* create new state */
2646                 u_int16_t        len;
2647                 struct pf_state *s = NULL;
2648                 struct pf_src_node *sn = NULL;
2649
2650                 len = pd->tot_len - off - (th->th_off << 2);
2651
2652                 /* check maximums */
2653                 if (r->max_states && (r->states >= r->max_states))
2654                         goto cleanup;
2655                 /* src node for flter rule */
2656                 if ((r->rule_flag & PFRULE_SRCTRACK ||
2657                     r->rpool.opts & PF_POOL_STICKYADDR) &&
2658                     pf_insert_src_node(&sn, r, saddr, af) != 0)
2659                         goto cleanup;
2660                 /* src node for translation rule */
2661                 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) &&
2662                     ((direction == PF_OUT &&
2663                     pf_insert_src_node(&nsn, nr, &pd->baddr, af) != 0) ||
2664                     (pf_insert_src_node(&nsn, nr, saddr, af) != 0)))
2665                         goto cleanup;
2666                 s = pool_get(&pf_state_pl, PR_NOWAIT);
2667                 if (s == NULL) {
2668 cleanup:
2669                         if (sn != NULL && sn->states == 0 && sn->expire == 0) {
2670                                 RB_REMOVE(pf_src_tree, &tree_src_tracking, sn);
2671                                 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
2672                                 pf_status.src_nodes--;
2673                                 pool_put(&pf_src_tree_pl, sn);
2674                         }
2675                         if (nsn != sn && nsn != NULL && nsn->states == 0 &&
2676                             nsn->expire == 0) {
2677                                 RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn);
2678                                 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
2679                                 pf_status.src_nodes--;
2680                                 pool_put(&pf_src_tree_pl, nsn);
2681                         }
2682                         REASON_SET(&reason, PFRES_MEMORY);
2683                         return (PF_DROP);
2684                 }
2685                 bzero(s, sizeof(*s));
2686                 r->states++;
2687                 if (a != NULL)
2688                         a->states++;
2689                 s->rule.ptr = r;
2690                 s->nat_rule.ptr = nr;
2691                 if (s->nat_rule.ptr != NULL)
2692                         s->nat_rule.ptr->states++;
2693                 s->anchor.ptr = a;
2694                 s->allow_opts = r->allow_opts;
2695                 s->log = r->log & 2;
2696                 s->proto = IPPROTO_TCP;
2697                 s->direction = direction;
2698                 s->af = af;
2699                 if (direction == PF_OUT) {
2700                         PF_ACPY(&s->gwy.addr, saddr, af);
2701                         s->gwy.port = th->th_sport;             /* sport */
2702                         PF_ACPY(&s->ext.addr, daddr, af);
2703                         s->ext.port = th->th_dport;
2704                         if (nr != NULL) {
2705                                 PF_ACPY(&s->lan.addr, &pd->baddr, af);
2706                                 s->lan.port = bport;
2707                         } else {
2708                                 PF_ACPY(&s->lan.addr, &s->gwy.addr, af);
2709                                 s->lan.port = s->gwy.port;
2710                         }
2711                 } else {
2712                         PF_ACPY(&s->lan.addr, daddr, af);
2713                         s->lan.port = th->th_dport;
2714                         PF_ACPY(&s->ext.addr, saddr, af);
2715                         s->ext.port = th->th_sport;
2716                         if (nr != NULL) {
2717                                 PF_ACPY(&s->gwy.addr, &pd->baddr, af);
2718                                 s->gwy.port = bport;
2719                         } else {
2720                                 PF_ACPY(&s->gwy.addr, &s->lan.addr, af);
2721                                 s->gwy.port = s->lan.port;
2722                         }
2723                 }
2724
2725                 s->src.seqlo = ntohl(th->th_seq);
2726                 s->src.seqhi = s->src.seqlo + len + 1;
2727                 if ((th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN &&
2728                     r->keep_state == PF_STATE_MODULATE) {
2729                         /* Generate sequence number modulator */
2730                         while ((s->src.seqdiff = karc4random()) == 0)
2731                                 ;
2732                         pf_change_a(&th->th_seq, &th->th_sum,
2733                             htonl(s->src.seqlo + s->src.seqdiff), 0);
2734                         rewrite = 1;
2735                 } else
2736                         s->src.seqdiff = 0;
2737                 if (th->th_flags & TH_SYN) {
2738                         s->src.seqhi++;
2739                         s->src.wscale = pf_get_wscale(m, off, th->th_off, af);
2740                 }
2741                 s->src.max_win = MAX(ntohs(th->th_win), 1);
2742                 if (s->src.wscale & PF_WSCALE_MASK) {
2743                         /* Remove scale factor from initial window */
2744                         int win = s->src.max_win;
2745                         win += 1 << (s->src.wscale & PF_WSCALE_MASK);
2746                         s->src.max_win = (win - 1) >>
2747                             (s->src.wscale & PF_WSCALE_MASK);
2748                 }
2749                 if (th->th_flags & TH_FIN)
2750                         s->src.seqhi++;
2751                 s->dst.seqhi = 1;
2752                 s->dst.max_win = 1;
2753                 s->src.state = TCPS_SYN_SENT;
2754                 s->dst.state = TCPS_CLOSED;
2755                 s->creation = time_second;
2756                 s->expire = time_second;
2757                 s->timeout = PFTM_TCP_FIRST_PACKET;
2758                 pf_set_rt_ifp(s, saddr);
2759                 if (sn != NULL) {
2760                         s->src_node = sn;
2761                         s->src_node->states++;
2762                 }
2763                 if (nsn != NULL) {
2764                         PF_ACPY(&nsn->raddr, &pd->naddr, af);
2765                         s->nat_src_node = nsn;
2766                         s->nat_src_node->states++;
2767                 }
2768                 if ((pd->flags & PFDESC_TCP_NORM) && pf_normalize_tcp_init(m,
2769                     off, pd, th, &s->src, &s->dst)) {
2770                         REASON_SET(&reason, PFRES_MEMORY);
2771                         pf_src_tree_remove_state(s);
2772                         pool_put(&pf_state_pl, s);
2773                         return (PF_DROP);
2774                 }
2775                 if ((pd->flags & PFDESC_TCP_NORM) && s->src.scrub &&
2776                     pf_normalize_tcp_stateful(m, off, pd, &reason, th, &s->src,
2777                     &s->dst, &rewrite)) {
2778                         pf_normalize_tcp_cleanup(s);
2779                         pf_src_tree_remove_state(s);
2780                         pool_put(&pf_state_pl, s);
2781                         return (PF_DROP);
2782                 }
2783                 if (pf_insert_state(BOUND_IFACE(r, kif), s)) {
2784                         pf_normalize_tcp_cleanup(s);
2785                         REASON_SET(&reason, PFRES_MEMORY);
2786                         pf_src_tree_remove_state(s);
2787                         pool_put(&pf_state_pl, s);
2788                         return (PF_DROP);
2789                 } else
2790                         *sm = s;
2791                 if ((th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN &&
2792                     r->keep_state == PF_STATE_SYNPROXY) {
2793                         s->src.state = PF_TCPS_PROXY_SRC;
2794                         if (nr != NULL) {
2795                                 if (direction == PF_OUT) {
2796                                         pf_change_ap(saddr, &th->th_sport,
2797                                             pd->ip_sum, &th->th_sum, &pd->baddr,
2798                                             bport, 0, af);
2799                                 } else {
2800                                         pf_change_ap(daddr, &th->th_dport,
2801                                             pd->ip_sum, &th->th_sum, &pd->baddr,
2802                                             bport, 0, af);
2803                                 }
2804                         }
2805                         s->src.seqhi = karc4random();
2806                         /* Find mss option */
2807                         mss = pf_get_mss(m, off, th->th_off, af);
2808                         mss = pf_calc_mss(saddr, af, mss);
2809                         mss = pf_calc_mss(daddr, af, mss);
2810                         s->src.mss = mss;
2811                         pf_send_tcp(r, af, daddr, saddr, th->th_dport,
2812                             th->th_sport, s->src.seqhi, ntohl(th->th_seq) + 1,
2813                             TH_SYN|TH_ACK, 0, s->src.mss, 0);
2814                         return (PF_SYNPROXY_DROP);
2815                 }
2816         }
2817
2818         /* copy back packet headers if we performed NAT operations */
2819         if (rewrite)
2820                 m_copyback(m, off, sizeof(*th), (caddr_t)th);
2821
2822         return (PF_PASS);
2823 }
2824
2825 int
2826 pf_test_udp(struct pf_rule **rm, struct pf_state **sm, int direction,
2827     struct pfi_kif *kif, struct mbuf *m, int off, void *h,
2828     struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm)
2829 {
2830         struct pf_rule          *nr = NULL;
2831         struct pf_addr          *saddr = pd->src, *daddr = pd->dst;
2832         struct udphdr           *uh = pd->hdr.udp;
2833         u_int16_t                bport, nport = 0;
2834         sa_family_t              af = pd->af;
2835         int                      lookup = -1;
2836         uid_t                    uid;
2837         gid_t                    gid;
2838         struct pf_rule          *r, *a = NULL;
2839         struct pf_ruleset       *ruleset = NULL;
2840         struct pf_src_node      *nsn = NULL;
2841         u_short                  reason;
2842         int                      rewrite = 0;
2843         int                      tag = -1;
2844
2845         r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
2846
2847         if (direction == PF_OUT) {
2848                 bport = nport = uh->uh_sport;
2849                 /* check outgoing packet for BINAT/NAT */
2850                 if ((nr = pf_get_translation(pd, m, off, PF_OUT, kif, &nsn,
2851                     saddr, uh->uh_sport, daddr, uh->uh_dport,
2852                     &pd->naddr, &nport)) != NULL) {
2853                         PF_ACPY(&pd->baddr, saddr, af);
2854                         pf_change_ap(saddr, &uh->uh_sport, pd->ip_sum,
2855                             &uh->uh_sum, &pd->naddr, nport, 1, af);
2856                         rewrite++;
2857                         if (nr->natpass)
2858                                 r = NULL;
2859                         pd->nat_rule = nr;
2860                 }
2861         } else {
2862                 bport = nport = uh->uh_dport;
2863                 /* check incoming packet for BINAT/RDR */
2864                 if ((nr = pf_get_translation(pd, m, off, PF_IN, kif, &nsn,
2865                     saddr, uh->uh_sport, daddr, uh->uh_dport, &pd->naddr,
2866                     &nport)) != NULL) {
2867                         PF_ACPY(&pd->baddr, daddr, af);
2868                         pf_change_ap(daddr, &uh->uh_dport, pd->ip_sum,
2869                             &uh->uh_sum, &pd->naddr, nport, 1, af);
2870                         rewrite++;
2871                         if (nr->natpass)
2872                                 r = NULL;
2873                         pd->nat_rule = nr;
2874                 }
2875         }
2876
2877         while (r != NULL) {
2878                 r->evaluations++;
2879                 if (r->kif != NULL &&
2880                     (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot)
2881                         r = r->skip[PF_SKIP_IFP].ptr;
2882                 else if (r->direction && r->direction != direction)
2883                         r = r->skip[PF_SKIP_DIR].ptr;
2884                 else if (r->af && r->af != af)
2885                         r = r->skip[PF_SKIP_AF].ptr;
2886                 else if (r->proto && r->proto != IPPROTO_UDP)
2887                         r = r->skip[PF_SKIP_PROTO].ptr;
2888                 else if (PF_MISMATCHAW(&r->src.addr, saddr, af, r->src.not))
2889                         r = r->skip[PF_SKIP_SRC_ADDR].ptr;
2890                 else if (r->src.port_op && !pf_match_port(r->src.port_op,
2891                     r->src.port[0], r->src.port[1], uh->uh_sport))
2892                         r = r->skip[PF_SKIP_SRC_PORT].ptr;
2893                 else if (PF_MISMATCHAW(&r->dst.addr, daddr, af, r->dst.not))
2894                         r = r->skip[PF_SKIP_DST_ADDR].ptr;
2895                 else if (r->dst.port_op && !pf_match_port(r->dst.port_op,
2896                     r->dst.port[0], r->dst.port[1], uh->uh_dport))
2897                         r = r->skip[PF_SKIP_DST_PORT].ptr;
2898                 else if (r->tos && !(r->tos & pd->tos))
2899                         r = TAILQ_NEXT(r, entries);
2900                 else if (r->rule_flag & PFRULE_FRAGMENT)
2901                         r = TAILQ_NEXT(r, entries);
2902                 else if (r->uid.op && (lookup != -1 || (lookup =
2903                     pf_socket_lookup(&uid, &gid, direction, pd), 1)) &&
2904                     !pf_match_uid(r->uid.op, r->uid.uid[0], r->uid.uid[1],
2905                     uid))
2906                         r = TAILQ_NEXT(r, entries);
2907                 else if (r->gid.op && (lookup != -1 || (lookup =
2908                     pf_socket_lookup(&uid, &gid, direction, pd), 1)) &&
2909                     !pf_match_gid(r->gid.op, r->gid.gid[0], r->gid.gid[1],
2910                     gid))
2911                         r = TAILQ_NEXT(r, entries);
2912                 else if (r->match_tag && !pf_match_tag(m, r, nr, &tag))
2913                         r = TAILQ_NEXT(r, entries);
2914                 else if (r->anchorname[0] && r->anchor == NULL)
2915                         r = TAILQ_NEXT(r, entries);
2916                 else if (r->os_fingerprint != PF_OSFP_ANY)
2917                         r = TAILQ_NEXT(r, entries);
2918                 else {
2919                         if (r->tag)
2920                                 tag = r->tag;
2921                         if (r->anchor == NULL) {
2922                                 *rm = r;
2923                                 *am = a;
2924                                 *rsm = ruleset;
2925                                 if ((*rm)->quick)
2926                                         break;
2927                                 r = TAILQ_NEXT(r, entries);
2928                         } else
2929                                 PF_STEP_INTO_ANCHOR(r, a, ruleset,
2930                                     PF_RULESET_FILTER);
2931                 }
2932                 if (r == NULL && a != NULL)
2933                         PF_STEP_OUT_OF_ANCHOR(r, a, ruleset,
2934                             PF_RULESET_FILTER);
2935         }
2936         r = *rm;
2937         a = *am;
2938         ruleset = *rsm;
2939
2940         REASON_SET(&reason, PFRES_MATCH);
2941
2942         if (r->log) {
2943                 if (rewrite)
2944                         m_copyback(m, off, sizeof(*uh), (caddr_t)uh);
2945                 PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset);
2946         }
2947
2948         if ((r->action == PF_DROP) &&
2949             ((r->rule_flag & PFRULE_RETURNICMP) ||
2950             (r->rule_flag & PFRULE_RETURN))) {
2951                 /* undo NAT changes, if they have taken place */
2952                 if (nr != NULL) {
2953                         if (direction == PF_OUT) {
2954                                 pf_change_ap(saddr, &uh->uh_sport, pd->ip_sum,
2955                                     &uh->uh_sum, &pd->baddr, bport, 1, af);
2956                                 rewrite++;
2957                         } else {
2958                                 pf_change_ap(daddr, &uh->uh_dport, pd->ip_sum,
2959                                     &uh->uh_sum, &pd->baddr, bport, 1, af);
2960                                 rewrite++;
2961                         }
2962                 }
2963                 if ((af == AF_INET) && r->return_icmp)
2964                         pf_send_icmp(m, r->return_icmp >> 8,
2965                             r->return_icmp & 255, af, r);
2966                 else if ((af == AF_INET6) && r->return_icmp6)
2967                         pf_send_icmp(m, r->return_icmp6 >> 8,
2968                             r->return_icmp6 & 255, af, r);
2969         }
2970
2971         if (r->action == PF_DROP)
2972                 return (PF_DROP);
2973
2974         pf_tag_packet(m, tag);
2975
2976         if (r->keep_state || nr != NULL) {
2977                 /* create new state */
2978                 struct pf_state *s = NULL;
2979                 struct pf_src_node *sn = NULL;
2980
2981                 /* check maximums */
2982                 if (r->max_states && (r->states >= r->max_states))
2983                         goto cleanup;
2984                 /* src node for flter rule */
2985                 if ((r->rule_flag & PFRULE_SRCTRACK ||
2986                     r->rpool.opts & PF_POOL_STICKYADDR) &&
2987                     pf_insert_src_node(&sn, r, saddr, af) != 0)
2988                         goto cleanup;
2989                 /* src node for translation rule */
2990                 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) &&
2991                     ((direction == PF_OUT &&
2992                     pf_insert_src_node(&nsn, nr, &pd->baddr, af) != 0) ||
2993                     (pf_insert_src_node(&nsn, nr, saddr, af) != 0)))
2994                         goto cleanup;
2995                 s = pool_get(&pf_state_pl, PR_NOWAIT);
2996                 if (s == NULL) {
2997 cleanup:
2998                         if (sn != NULL && sn->states == 0 && sn->expire == 0) {
2999                                 RB_REMOVE(pf_src_tree, &tree_src_tracking, sn);
3000                                 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
3001                                 pf_status.src_nodes--;
3002                                 pool_put(&pf_src_tree_pl, sn);
3003                         }
3004                         if (nsn != sn && nsn != NULL && nsn->states == 0 &&
3005                             nsn->expire == 0) {
3006                                 RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn);
3007                                 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
3008                                 pf_status.src_nodes--;
3009                                 pool_put(&pf_src_tree_pl, nsn);
3010                         }
3011                         REASON_SET(&reason, PFRES_MEMORY);
3012                         return (PF_DROP);
3013                 }
3014                 bzero(s, sizeof(*s));
3015                 r->states++;
3016                 if (a != NULL)
3017                         a->states++;
3018                 s->rule.ptr = r;
3019                 s->nat_rule.ptr = nr;
3020                 if (s->nat_rule.ptr != NULL)
3021                         s->nat_rule.ptr->states++;
3022                 s->anchor.ptr = a;
3023                 s->allow_opts = r->allow_opts;
3024                 s->log = r->log & 2;
3025                 s->proto = IPPROTO_UDP;
3026                 s->direction = direction;
3027                 s->af = af;
3028                 if (direction == PF_OUT) {
3029                         PF_ACPY(&s->gwy.addr, saddr, af);
3030                         s->gwy.port = uh->uh_sport;
3031                         PF_ACPY(&s->ext.addr, daddr, af);
3032                         s->ext.port = uh->uh_dport;
3033                         if (nr != NULL) {
3034                                 PF_ACPY(&s->lan.addr, &pd->baddr, af);
3035                                 s->lan.port = bport;
3036                         } else {
3037                                 PF_ACPY(&s->lan.addr, &s->gwy.addr, af);
3038                                 s->lan.port = s->gwy.port;
3039                         }
3040                 } else {
3041                         PF_ACPY(&s->lan.addr, daddr, af);
3042                         s->lan.port = uh->uh_dport;
3043                         PF_ACPY(&s->ext.addr, saddr, af);
3044                         s->ext.port = uh->uh_sport;
3045                         if (nr != NULL) {
3046                                 PF_ACPY(&s->gwy.addr, &pd->baddr, af);
3047                                 s->gwy.port = bport;
3048                         } else {
3049                                 PF_ACPY(&s->gwy.addr, &s->lan.addr, af);
3050                                 s->gwy.port = s->lan.port;
3051                         }
3052                 }
3053                 s->src.state = PFUDPS_SINGLE;
3054                 s->dst.state = PFUDPS_NO_TRAFFIC;
3055                 s->creation = time_second;
3056                 s->expire = time_second;
3057                 s->timeout = PFTM_UDP_FIRST_PACKET;
3058                 pf_set_rt_ifp(s, saddr);
3059                 if (sn != NULL) {
3060                         s->src_node = sn;
3061                         s->src_node->states++;
3062                 }
3063                 if (nsn != NULL) {
3064                         PF_ACPY(&nsn->raddr, &pd->naddr, af);
3065                         s->nat_src_node = nsn;
3066                         s->nat_src_node->states++;
3067                 }
3068                 if (pf_insert_state(BOUND_IFACE(r, kif), s)) {
3069                         REASON_SET(&reason, PFRES_MEMORY);
3070                         pf_src_tree_remove_state(s);
3071                         pool_put(&pf_state_pl, s);
3072                         return (PF_DROP);
3073                 } else
3074                         *sm = s;
3075         }
3076
3077         /* copy back packet headers if we performed NAT operations */
3078         if (rewrite)
3079                 m_copyback(m, off, sizeof(*uh), (caddr_t)uh);
3080
3081         return (PF_PASS);
3082 }
3083
3084 int
3085 pf_test_icmp(struct pf_rule **rm, struct pf_state **sm, int direction,
3086     struct pfi_kif *kif, struct mbuf *m, int off, void *h,
3087     struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm)
3088 {
3089         struct pf_rule          *nr = NULL;
3090         struct pf_addr          *saddr = pd->src, *daddr = pd->dst;
3091         struct pf_rule          *r, *a = NULL;
3092         struct pf_ruleset       *ruleset = NULL;
3093         struct pf_src_node      *nsn = NULL;
3094         u_short                  reason;
3095         u_int16_t                icmpid = 0;
3096         sa_family_t              af = pd->af;
3097         u_int8_t                 icmptype = 0, icmpcode = 0;
3098         int                      state_icmp = 0;
3099         int                      tag = -1;
3100 #ifdef INET6
3101         int                      rewrite = 0;
3102 #endif /* INET6 */
3103
3104         switch (pd->proto) {
3105 #ifdef INET
3106         case IPPROTO_ICMP:
3107                 icmptype = pd->hdr.icmp->icmp_type;
3108                 icmpcode = pd->hdr.icmp->icmp_code;
3109                 icmpid = pd->hdr.icmp->icmp_id;
3110
3111                 if (icmptype == ICMP_UNREACH ||
3112                     icmptype == ICMP_SOURCEQUENCH ||
3113                     icmptype == ICMP_REDIRECT ||
3114                     icmptype == ICMP_TIMXCEED ||
3115                     icmptype == ICMP_PARAMPROB)
3116                         state_icmp++;
3117                 break;
3118 #endif /* INET */
3119 #ifdef INET6
3120         case IPPROTO_ICMPV6:
3121                 icmptype = pd->hdr.icmp6->icmp6_type;
3122                 icmpcode = pd->hdr.icmp6->icmp6_code;
3123                 icmpid = pd->hdr.icmp6->icmp6_id;
3124
3125                 if (icmptype == ICMP6_DST_UNREACH ||
3126                     icmptype == ICMP6_PACKET_TOO_BIG ||
3127                     icmptype == ICMP6_TIME_EXCEEDED ||
3128                     icmptype == ICMP6_PARAM_PROB)
3129                         state_icmp++;
3130                 break;
3131 #endif /* INET6 */
3132         }
3133
3134         r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
3135
3136         if (direction == PF_OUT) {
3137                 /* check outgoing packet for BINAT/NAT */
3138                 if ((nr = pf_get_translation(pd, m, off, PF_OUT, kif, &nsn,
3139                     saddr, 0, daddr, 0, &pd->naddr, NULL)) != NULL) {
3140                         PF_ACPY(&pd->baddr, saddr, af);
3141                         switch (af) {
3142 #ifdef INET
3143                         case AF_INET:
3144                                 pf_change_a(&saddr->v4.s_addr, pd->ip_sum,
3145                                     pd->naddr.v4.s_addr, 0);
3146                                 break;
3147 #endif /* INET */
3148 #ifdef INET6
3149                         case AF_INET6:
3150                                 pf_change_a6(saddr, &pd->hdr.icmp6->icmp6_cksum,
3151                                     &pd->naddr, 0);
3152                                 rewrite++;
3153                                 break;
3154 #endif /* INET6 */
3155                         }
3156                         if (nr->natpass)
3157                                 r = NULL;
3158                         pd->nat_rule = nr;
3159                 }
3160         } else {
3161                 /* check incoming packet for BINAT/RDR */
3162                 if ((nr = pf_get_translation(pd, m, off, PF_IN, kif, &nsn,
3163                     saddr, 0, daddr, 0, &pd->naddr, NULL)) != NULL) {
3164                         PF_ACPY(&pd->baddr, daddr, af);
3165                         switch (af) {
3166 #ifdef INET
3167                         case AF_INET:
3168                                 pf_change_a(&daddr->v4.s_addr,
3169                                     pd->ip_sum, pd->naddr.v4.s_addr, 0);
3170                                 break;
3171 #endif /* INET */
3172 #ifdef INET6
3173                         case AF_INET6:
3174                                 pf_change_a6(daddr, &pd->hdr.icmp6->icmp6_cksum,
3175                                     &pd->naddr, 0);
3176                                 rewrite++;
3177                                 break;
3178 #endif /* INET6 */
3179                         }
3180                         if (nr->natpass)
3181                                 r = NULL;
3182                         pd->nat_rule = nr;
3183                 }
3184         }
3185
3186         while (r != NULL) {
3187                 r->evaluations++;
3188                 if (r->kif != NULL &&
3189                     (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot)
3190                         r = r->skip[PF_SKIP_IFP].ptr;
3191                 else if (r->direction && r->direction != direction)
3192                         r = r->skip[PF_SKIP_DIR].ptr;
3193                 else if (r->af && r->af != af)
3194                         r = r->skip[PF_SKIP_AF].ptr;
3195                 else if (r->proto && r->proto != pd->proto)
3196                         r = r->skip[PF_SKIP_PROTO].ptr;
3197                 else if (PF_MISMATCHAW(&r->src.addr, saddr, af, r->src.not))
3198                         r = r->skip[PF_SKIP_SRC_ADDR].ptr;
3199                 else if (PF_MISMATCHAW(&r->dst.addr, daddr, af, r->dst.not))
3200                         r = r->skip[PF_SKIP_DST_ADDR].ptr;
3201                 else if (r->type && r->type != icmptype + 1)
3202                         r = TAILQ_NEXT(r, entries);
3203                 else if (r->code && r->code != icmpcode + 1)
3204                         r = TAILQ_NEXT(r, entries);
3205                 else if (r->tos && !(r->tos & pd->tos))
3206                         r = TAILQ_NEXT(r, entries);
3207                 else if (r->rule_flag & PFRULE_FRAGMENT)
3208                         r = TAILQ_NEXT(r, entries);
3209                 else if (r->match_tag && !pf_match_tag(m, r, nr, &tag))
3210                         r = TAILQ_NEXT(r, entries);
3211                 else if (r->anchorname[0] && r->anchor == NULL)
3212                         r = TAILQ_NEXT(r, entries);
3213                 else if (r->os_fingerprint != PF_OSFP_ANY)
3214                         r = TAILQ_NEXT(r, entries);
3215                 else {
3216                         if (r->tag)
3217                                 tag = r->tag;
3218                         if (r->anchor == NULL) {
3219                                 *rm = r;
3220                                 *am = a;
3221                                 *rsm = ruleset;
3222                                 if ((*rm)->quick)
3223                                         break;
3224                                 r = TAILQ_NEXT(r, entries);
3225                         } else
3226                                 PF_STEP_INTO_ANCHOR(r, a, ruleset,
3227                                     PF_RULESET_FILTER);
3228                 }
3229                 if (r == NULL && a != NULL)
3230                         PF_STEP_OUT_OF_ANCHOR(r, a, ruleset,
3231                             PF_RULESET_FILTER);
3232         }
3233         r = *rm;
3234         a = *am;
3235         ruleset = *rsm;
3236
3237         REASON_SET(&reason, PFRES_MATCH);
3238
3239         if (r->log) {
3240 #ifdef INET6
3241                 if (rewrite)
3242                         m_copyback(m, off, sizeof(struct icmp6_hdr),
3243                             (caddr_t)pd->hdr.icmp6);
3244 #endif /* INET6 */
3245                 PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset);
3246         }
3247
3248         if (r->action != PF_PASS)
3249                 return (PF_DROP);
3250
3251         pf_tag_packet(m, tag);
3252
3253         if (!state_icmp && (r->keep_state || nr != NULL)) {
3254                 /* create new state */
3255                 struct pf_state *s = NULL;
3256                 struct pf_src_node *sn = NULL;
3257
3258                 /* check maximums */
3259                 if (r->max_states && (r->states >= r->max_states))
3260                         goto cleanup;
3261                 /* src node for flter rule */
3262                 if ((r->rule_flag & PFRULE_SRCTRACK ||
3263                     r->rpool.opts & PF_POOL_STICKYADDR) &&
3264                     pf_insert_src_node(&sn, r, saddr, af) != 0)
3265                         goto cleanup;
3266                 /* src node for translation rule */
3267                 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) &&
3268                     ((direction == PF_OUT &&
3269                     pf_insert_src_node(&nsn, nr, &pd->baddr, af) != 0) ||
3270                     (pf_insert_src_node(&nsn, nr, saddr, af) != 0)))
3271                         goto cleanup;
3272                 s = pool_get(&pf_state_pl, PR_NOWAIT);
3273                 if (s == NULL) {
3274 cleanup:
3275                         if (sn != NULL && sn->states == 0 && sn->expire == 0) {
3276                                 RB_REMOVE(pf_src_tree, &tree_src_tracking, sn);
3277                                 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
3278                                 pf_status.src_nodes--;
3279                                 pool_put(&pf_src_tree_pl, sn);
3280                         }
3281                         if (nsn != sn && nsn != NULL && nsn->states == 0 &&
3282                             nsn->expire == 0) {
3283                                 RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn);
3284                                 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
3285                                 pf_status.src_nodes--;
3286                                 pool_put(&pf_src_tree_pl, nsn);
3287                         }
3288                         REASON_SET(&reason, PFRES_MEMORY);
3289                         return (PF_DROP);
3290                 }
3291                 bzero(s, sizeof(*s));
3292                 r->states++;
3293                 if (a != NULL)
3294                         a->states++;
3295                 s->rule.ptr = r;
3296                 s->nat_rule.ptr = nr;
3297                 if (s->nat_rule.ptr != NULL)
3298                         s->nat_rule.ptr->states++;
3299                 s->anchor.ptr = a;
3300                 s->allow_opts = r->allow_opts;
3301                 s->log = r->log & 2;
3302                 s->proto = pd->proto;
3303                 s->direction = direction;
3304                 s->af = af;
3305                 if (direction == PF_OUT) {
3306                         PF_ACPY(&s->gwy.addr, saddr, af);
3307                         s->gwy.port = icmpid;
3308                         PF_ACPY(&s->ext.addr, daddr, af);
3309                         s->ext.port = icmpid;
3310                         if (nr != NULL)
3311                                 PF_ACPY(&s->lan.addr, &pd->baddr, af);
3312                         else
3313                                 PF_ACPY(&s->lan.addr, &s->gwy.addr, af);
3314                         s->lan.port = icmpid;
3315                 } else {
3316                         PF_ACPY(&s->lan.addr, daddr, af);
3317                         s->lan.port = icmpid;
3318                         PF_ACPY(&s->ext.addr, saddr, af);
3319                         s->ext.port = icmpid;
3320                         if (nr != NULL)
3321                                 PF_ACPY(&s->gwy.addr, &pd->baddr, af);
3322                         else
3323                                 PF_ACPY(&s->gwy.addr, &s->lan.addr, af);
3324                         s->gwy.port = icmpid;
3325                 }
3326                 s->creation = time_second;
3327                 s->expire = time_second;
3328                 s->timeout = PFTM_ICMP_FIRST_PACKET;
3329                 pf_set_rt_ifp(s, saddr);
3330                 if (sn != NULL) {
3331                         s->src_node = sn;
3332                         s->src_node->states++;
3333                 }
3334                 if (nsn != NULL) {
3335                         PF_ACPY(&nsn->raddr, &pd->naddr, af);
3336                         s->nat_src_node = nsn;
3337                         s->nat_src_node->states++;
3338                 }
3339                 if (pf_insert_state(BOUND_IFACE(r, kif), s)) {
3340                         REASON_SET(&reason, PFRES_MEMORY);
3341                         pf_src_tree_remove_state(s);
3342                         pool_put(&pf_state_pl, s);
3343                         return (PF_DROP);
3344                 } else
3345                         *sm = s;
3346         }
3347
3348 #ifdef INET6
3349         /* copy back packet headers if we performed IPv6 NAT operations */
3350         if (rewrite)
3351                 m_copyback(m, off, sizeof(struct icmp6_hdr),
3352                     (caddr_t)pd->hdr.icmp6);
3353 #endif /* INET6 */
3354
3355         return (PF_PASS);
3356 }
3357
3358 int
3359 pf_test_other(struct pf_rule **rm, struct pf_state **sm, int direction,
3360     struct pfi_kif *kif, struct mbuf *m, int off, void *h, struct pf_pdesc *pd,
3361     struct pf_rule **am, struct pf_ruleset **rsm)
3362 {
3363         struct pf_rule          *nr = NULL;
3364         struct pf_rule          *r, *a = NULL;
3365         struct pf_ruleset       *ruleset = NULL;
3366         struct pf_src_node      *nsn = NULL;
3367         struct pf_addr          *saddr = pd->src, *daddr = pd->dst;
3368         sa_family_t              af = pd->af;
3369         u_short                  reason;
3370         int                      tag = -1;
3371
3372         r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
3373
3374         if (direction == PF_OUT) {
3375                 /* check outgoing packet for BINAT/NAT */
3376                 if ((nr = pf_get_translation(pd, m, off, PF_OUT, kif, &nsn,
3377                     saddr, 0, daddr, 0, &pd->naddr, NULL)) != NULL) {
3378                         PF_ACPY(&pd->baddr, saddr, af);
3379                         switch (af) {
3380 #ifdef INET
3381                         case AF_INET:
3382                                 pf_change_a(&saddr->v4.s_addr, pd->ip_sum,
3383                                     pd->naddr.v4.s_addr, 0);
3384                                 break;
3385 #endif /* INET */
3386 #ifdef INET6
3387                         case AF_INET6:
3388                                 PF_ACPY(saddr, &pd->naddr, af);
3389                                 break;
3390 #endif /* INET6 */
3391                         }
3392                         if (nr->natpass)
3393                                 r = NULL;
3394                         pd->nat_rule = nr;
3395                 }
3396         } else {
3397                 /* check incoming packet for BINAT/RDR */
3398                 if ((nr = pf_get_translation(pd, m, off, PF_IN, kif, &nsn,
3399                     saddr, 0, daddr, 0, &pd->naddr, NULL)) != NULL) {
3400                         PF_ACPY(&pd->baddr, daddr, af);
3401                         switch (af) {
3402 #ifdef INET
3403                         case AF_INET:
3404                                 pf_change_a(&daddr->v4.s_addr,
3405                                     pd->ip_sum, pd->naddr.v4.s_addr, 0);
3406                                 break;
3407 #endif /* INET */
3408 #ifdef INET6
3409                         case AF_INET6:
3410                                 PF_ACPY(daddr, &pd->naddr, af);
3411                                 break;
3412 #endif /* INET6 */
3413                         }
3414                         if (nr->natpass)
3415                                 r = NULL;
3416                         pd->nat_rule = nr;
3417                 }
3418         }
3419
3420         while (r != NULL) {
3421                 r->evaluations++;
3422                 if (r->kif != NULL &&
3423                     (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot)
3424                         r = r->skip[PF_SKIP_IFP].ptr;
3425                 else if (r->direction && r->direction != direction)
3426                         r = r->skip[PF_SKIP_DIR].ptr;
3427                 else if (r->af && r->af != af)
3428                         r = r->skip[PF_SKIP_AF].ptr;
3429                 else if (r->proto && r->proto != pd->proto)
3430                         r = r->skip[PF_SKIP_PROTO].ptr;
3431                 else if (PF_MISMATCHAW(&r->src.addr, pd->src, af, r->src.not))
3432                         r = r->skip[PF_SKIP_SRC_ADDR].ptr;
3433                 else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af, r->dst.not))
3434                         r = r->skip[PF_SKIP_DST_ADDR].ptr;
3435                 else if (r->tos && !(r->tos & pd->tos))
3436                         r = TAILQ_NEXT(r, entries);
3437                 else if (r->rule_flag & PFRULE_FRAGMENT)
3438                         r = TAILQ_NEXT(r, entries);
3439                 else if (r->match_tag && !pf_match_tag(m, r, nr, &tag))
3440                         r = TAILQ_NEXT(r, entries);
3441                 else if (r->anchorname[0] && r->anchor == NULL)
3442                         r = TAILQ_NEXT(r, entries);
3443                 else if (r->os_fingerprint != PF_OSFP_ANY)
3444                         r = TAILQ_NEXT(r, entries);
3445                 else {
3446                         if (r->tag)
3447                                 tag = r->tag;
3448                         if (r->anchor == NULL) {
3449                                 *rm = r;
3450                                 *am = a;
3451                                 *rsm = ruleset;
3452                                 if ((*rm)->quick)
3453                                         break;
3454                                 r = TAILQ_NEXT(r, entries);
3455                         } else
3456                                 PF_STEP_INTO_ANCHOR(r, a, ruleset,
3457                                     PF_RULESET_FILTER);
3458                 }
3459                 if (r == NULL && a != NULL)
3460                         PF_STEP_OUT_OF_ANCHOR(r, a, ruleset,
3461                             PF_RULESET_FILTER);
3462         }
3463         r = *rm;
3464         a = *am;
3465         ruleset = *rsm;
3466
3467         REASON_SET(&reason, PFRES_MATCH);
3468
3469         if (r->log)
3470                 PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset);
3471
3472         if ((r->action == PF_DROP) &&
3473             ((r->rule_flag & PFRULE_RETURNICMP) ||
3474             (r->rule_flag & PFRULE_RETURN))) {
3475                 struct pf_addr *a = NULL;
3476
3477                 if (nr != NULL) {
3478                         if (direction == PF_OUT)
3479                                 a = saddr;
3480                         else
3481                                 a = daddr;
3482                 }
3483                 if (a != NULL) {
3484                         switch (af) {
3485 #ifdef INET
3486                         case AF_INET:
3487                                 pf_change_a(&a->v4.s_addr, pd->ip_sum,
3488                                     pd->baddr.v4.s_addr, 0);
3489                                 break;
3490 #endif /* INET */
3491 #ifdef INET6
3492                         case AF_INET6:
3493                                 PF_ACPY(a, &pd->baddr, af);
3494                                 break;
3495 #endif /* INET6 */
3496                         }
3497                 }
3498                 if ((af == AF_INET) && r->return_icmp)
3499                         pf_send_icmp(m, r->return_icmp >> 8,
3500                             r->return_icmp & 255, af, r);
3501                 else if ((af == AF_INET6) && r->return_icmp6)
3502                         pf_send_icmp(m, r->return_icmp6 >> 8,
3503                             r->return_icmp6 & 255, af, r);
3504         }
3505
3506         if (r->action != PF_PASS)
3507                 return (PF_DROP);
3508
3509         pf_tag_packet(m, tag);
3510
3511         if (r->keep_state || nr != NULL) {
3512                 /* create new state */
3513                 struct pf_state *s = NULL;
3514                 struct pf_src_node *sn = NULL;
3515
3516                 /* check maximums */
3517                 if (r->max_states && (r->states >= r->max_states))
3518                         goto cleanup;
3519                 /* src node for flter rule */
3520                 if ((r->rule_flag & PFRULE_SRCTRACK ||
3521                     r->rpool.opts & PF_POOL_STICKYADDR) &&
3522                     pf_insert_src_node(&sn, r, saddr, af) != 0)
3523                         goto cleanup;
3524                 /* src node for translation rule */
3525                 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) &&
3526                     ((direction == PF_OUT &&
3527                     pf_insert_src_node(&nsn, nr, &pd->baddr, af) != 0) ||
3528                     (pf_insert_src_node(&nsn, nr, saddr, af) != 0)))
3529                         goto cleanup;
3530                 s = pool_get(&pf_state_pl, PR_NOWAIT);
3531                 if (s == NULL) {
3532 cleanup:
3533                         if (sn != NULL && sn->states == 0 && sn->expire == 0) {
3534                                 RB_REMOVE(pf_src_tree, &tree_src_tracking, sn);
3535                                 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
3536                                 pf_status.src_nodes--;
3537                                 pool_put(&pf_src_tree_pl, sn);
3538                         }
3539                         if (nsn != sn && nsn != NULL && nsn->states == 0 &&
3540                             nsn->expire == 0) {
3541                                 RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn);
3542                                 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
3543                                 pf_status.src_nodes--;
3544                                 pool_put(&pf_src_tree_pl, nsn);
3545                         }
3546                         REASON_SET(&reason, PFRES_MEMORY);
3547                         return (PF_DROP);
3548                 }
3549                 bzero(s, sizeof(*s));
3550                 r->states++;
3551                 if (a != NULL)
3552                         a->states++;
3553                 s->rule.ptr = r;
3554                 s->nat_rule.ptr = nr;
3555                 if (s->nat_rule.ptr != NULL)
3556                         s->nat_rule.ptr->states++;
3557                 s->anchor.ptr = a;
3558                 s->allow_opts = r->allow_opts;
3559                 s->log = r->log & 2;
3560                 s->proto = pd->proto;
3561                 s->direction = direction;
3562                 s->af = af;
3563                 if (direction == PF_OUT) {
3564                         PF_ACPY(&s->gwy.addr, saddr, af);
3565                         PF_ACPY(&s->ext.addr, daddr, af);
3566                         if (nr != NULL)
3567                                 PF_ACPY(&s->lan.addr, &pd->baddr, af);
3568                         else
3569                                 PF_ACPY(&s->lan.addr, &s->gwy.addr, af);
3570                 } else {
3571                         PF_ACPY(&s->lan.addr, daddr, af);
3572                         PF_ACPY(&s->ext.addr, saddr, af);
3573                         if (nr != NULL)
3574                                 PF_ACPY(&s->gwy.addr, &pd->baddr, af);
3575                         else
3576                                 PF_ACPY(&s->gwy.addr, &s->lan.addr, af);
3577                 }
3578                 s->src.state = PFOTHERS_SINGLE;
3579                 s->dst.state = PFOTHERS_NO_TRAFFIC;
3580                 s->creation = time_second;
3581                 s->expire = time_second;
3582                 s->timeout = PFTM_OTHER_FIRST_PACKET;
3583                 pf_set_rt_ifp(s, saddr);
3584                 if (sn != NULL) {
3585                         s->src_node = sn;
3586                         s->src_node->states++;
3587                 }
3588                 if (nsn != NULL) {
3589                         PF_ACPY(&nsn->raddr, &pd->naddr, af);
3590                         s->nat_src_node = nsn;
3591                         s->nat_src_node->states++;
3592                 }
3593                 if (pf_insert_state(BOUND_IFACE(r, kif), s)) {
3594                         REASON_SET(&reason, PFRES_MEMORY);
3595                         pf_src_tree_remove_state(s);
3596                         pool_put(&pf_state_pl, s);
3597                         return (PF_DROP);
3598                 } else
3599                         *sm = s;
3600         }
3601
3602         return (PF_PASS);
3603 }
3604
3605 int
3606 pf_test_fragment(struct pf_rule **rm, int direction, struct pfi_kif *kif,
3607     struct mbuf *m, void *h, struct pf_pdesc *pd, struct pf_rule **am,
3608     struct pf_ruleset **rsm)
3609 {
3610         struct pf_rule          *r, *a = NULL;
3611         struct pf_ruleset       *ruleset = NULL;
3612         sa_family_t              af = pd->af;
3613         u_short                  reason;
3614         int                      tag = -1;
3615
3616         r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
3617         while (r != NULL) {
3618                 r->evaluations++;
3619                 if (r->kif != NULL &&
3620                     (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot)
3621                         r = r->skip[PF_SKIP_IFP].ptr;
3622                 else if (r->direction && r->direction != direction)
3623                         r = r->skip[PF_SKIP_DIR].ptr;
3624                 else if (r->af && r->af != af)
3625                         r = r->skip[PF_SKIP_AF].ptr;
3626                 else if (r->proto && r->proto != pd->proto)
3627                         r = r->skip[PF_SKIP_PROTO].ptr;
3628                 else if (PF_MISMATCHAW(&r->src.addr, pd->src, af, r->src.not))
3629                         r = r->skip[PF_SKIP_SRC_ADDR].ptr;
3630                 else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af, r->dst.not))
3631                         r = r->skip[PF_SKIP_DST_ADDR].ptr;
3632                 else if (r->tos && !(r->tos & pd->tos))
3633                         r = TAILQ_NEXT(r, entries);
3634                 else if (r->src.port_op || r->dst.port_op ||
3635                     r->flagset || r->type || r->code ||
3636                     r->os_fingerprint != PF_OSFP_ANY)
3637                         r = TAILQ_NEXT(r, entries);
3638                 else if (r->match_tag && !pf_match_tag(m, r, NULL, &tag))
3639                         r = TAILQ_NEXT(r, entries);
3640                 else if (r->anchorname[0] && r->anchor == NULL)
3641                         r = TAILQ_NEXT(r, entries);
3642                 else {
3643                         if (r->anchor == NULL) {
3644                                 *rm = r;
3645                                 *am = a;
3646                                 *rsm = ruleset;
3647                                 if ((*rm)->quick)
3648                                         break;
3649                                 r = TAILQ_NEXT(r, entries);