sys/net/pf/pf.c

   1 /*      $FreeBSD: src/sys/contrib/pf/net/pf.c,v 1.19 2004/09/11 11:18:25 mlaier Exp $   */
   2 /*      $OpenBSD: pf.c,v 1.433.2.2 2004/07/17 03:22:34 brad Exp $ */
   3 /* add  $OpenBSD: pf.c,v 1.448 2004/05/11 07:34:11 dhartmei Exp $ */
   4 /*      $DragonFly: src/sys/net/pf/pf.c,v 1.20 2008/06/05 18:06:32 swildner Exp $ */
   5 /*      $OpenBSD: pf.c,v 1.527 2007/02/22 15:23:23 pyr Exp $ */
   6
   7 /*
   8  * Copyright (c) 2004 The DragonFly Project.  All rights reserved.
   9  *
  10  * Copyright (c) 2001 Daniel Hartmeier
  11  * Copyright (c) 2002,2003 Henning Brauer
  12  * All rights reserved.
  13  *
  14  * Redistribution and use in source and binary forms, with or without
  15  * modification, are permitted provided that the following conditions
  16  * are met:
  17  *
  18  *    - Redistributions of source code must retain the above copyright
  19  *      notice, this list of conditions and the following disclaimer.
  20  *    - Redistributions in binary form must reproduce the above
  21  *      copyright notice, this list of conditions and the following
  22  *      disclaimer in the documentation and/or other materials provided
  23  *      with the distribution.
  24  *
  25  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  26  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  27  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  28  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  29  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  30  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  31  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  32  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  33  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  35  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  36  * POSSIBILITY OF SUCH DAMAGE.
  37  *
  38  * Effort sponsored in part by the Defense Advanced Research Projects
  39  * Agency (DARPA) and Air Force Research Laboratory, Air Force
  40  * Materiel Command, USAF, under agreement number F30602-01-2-0537.
  41  *
  42  */
  43
  44 #include "opt_inet.h"
  45 #include "opt_inet6.h"
  46 #include "use_pfsync.h"
  47
  48 #include <sys/param.h>
  49 #include <sys/systm.h>
  50 #include <sys/malloc.h>
  51 #include <sys/mbuf.h>
  52 #include <sys/filio.h>
  53 #include <sys/socket.h>
  54 #include <sys/socketvar.h>
  55 #include <sys/kernel.h>
  56 #include <sys/time.h>
  57 #include <sys/sysctl.h>
  58 #include <sys/endian.h>
  59 #include <vm/vm_zone.h>
  60 #include <sys/proc.h>
  61 #include <sys/kthread.h>
  62
  63 #include <machine/inttypes.h>
  64
  65 #include <net/if.h>
  66 #include <net/if_types.h>
  67 #include <net/bpf.h>
  68 #include <net/netisr.h>
  69 #include <net/route.h>
  70
  71 #include <netinet/in.h>
  72 #include <netinet/in_var.h>
  73 #include <netinet/in_systm.h>
  74 #include <netinet/ip.h>
  75 #include <netinet/ip_var.h>
  76 #include <netinet/tcp.h>
  77 #include <netinet/tcp_seq.h>
  78 #include <netinet/udp.h>
  79 #include <netinet/ip_icmp.h>
  80 #include <netinet/in_pcb.h>
  81 #include <netinet/tcp_timer.h>
  82 #include <netinet/tcp_var.h>
  83 #include <netinet/udp_var.h>
  84 #include <netinet/icmp_var.h>
  85 #include <netinet/if_ether.h>
  86
  87 #include <net/pf/pfvar.h>
  88 #include <net/pf/if_pflog.h>
  89
  90 #if NPFSYNC > 0
  91 #include <net/pf/if_pfsync.h>
  92 #endif /* NPFSYNC > 0 */
  93
  94 #ifdef INET6
  95 #include <netinet/ip6.h>
  96 #include <netinet/in_pcb.h>
  97 #include <netinet/icmp6.h>
  98 #include <netinet6/nd6.h>
  99 #include <netinet6/ip6_var.h>
 100 #include <netinet6/in6_pcb.h>
 101 #endif /* INET6 */
 102
 103 #include <sys/in_cksum.h>
 104 #include <sys/ucred.h>
 105 #include <machine/limits.h>
 106 #include <sys/msgport2.h>
 107 #include <net/netmsg2.h>
 108
 109 extern int ip_optcopy(struct ip *, struct ip *);
 110 extern int debug_pfugidhack;
 111
 112 #define DPFPRINTF(n, x) if (pf_status.debug >= (n)) kprintf x
 113
 114 /*
 115  * Global variables
 116  */
 117
 118 struct pf_altqqueue      pf_altqs[2];
 119 struct pf_palist         pf_pabuf;
 120 struct pf_altqqueue     *pf_altqs_active;
 121 struct pf_altqqueue     *pf_altqs_inactive;
 122 struct pf_status         pf_status;
 123
 124 u_int32_t                ticket_altqs_active;
 125 u_int32_t                ticket_altqs_inactive;
 126 int                      altqs_inactive_open;
 127 u_int32_t                ticket_pabuf;
 128
 129 struct pf_anchor_stackframe {
 130         struct pf_ruleset                       *rs;
 131         struct pf_rule                          *r;
 132         struct pf_anchor_node                   *parent;
 133         struct pf_anchor                        *child;
 134 } pf_anchor_stack[64];
 135
 136 vm_zone_t                pf_src_tree_pl, pf_rule_pl;
 137 vm_zone_t                pf_state_pl, pf_altq_pl, pf_pooladdr_pl;
 138
 139 void                     pf_print_host(struct pf_addr *, u_int16_t, u_int8_t);
 140
 141 void                     pf_init_threshold(struct pf_threshold *, u_int32_t,
 142                             u_int32_t);
 143 void                     pf_add_threshold(struct pf_threshold *);
 144 int                      pf_check_threshold(struct pf_threshold *);
 145
 146 void                     pf_change_ap(struct pf_addr *, u_int16_t *,
 147                             u_int16_t *, u_int16_t *, struct pf_addr *,
 148                             u_int16_t, u_int8_t, sa_family_t);
 149 int                      pf_modulate_sack(struct mbuf *, int, struct pf_pdesc *,
 150                             struct tcphdr *, struct pf_state_peer *);
 151 #ifdef INET6
 152 void                     pf_change_a6(struct pf_addr *, u_int16_t *,
 153                             struct pf_addr *, u_int8_t);
 154 #endif /* INET6 */
 155 void                     pf_change_icmp(struct pf_addr *, u_int16_t *,
 156                             struct pf_addr *, struct pf_addr *, u_int16_t,
 157                             u_int16_t *, u_int16_t *, u_int16_t *,
 158                             u_int16_t *, u_int8_t, sa_family_t);
 159 void                     pf_send_tcp(const struct pf_rule *, sa_family_t,
 160                             const struct pf_addr *, const struct pf_addr *,
 161                             u_int16_t, u_int16_t, u_int32_t, u_int32_t,
 162                             u_int8_t, u_int16_t, u_int16_t, u_int8_t, int,
 163                             u_int16_t, struct ether_header *, struct ifnet *);
 164 void                     pf_send_icmp(struct mbuf *, u_int8_t, u_int8_t,
 165                             sa_family_t, struct pf_rule *);
 166 struct pf_rule          *pf_match_translation(struct pf_pdesc *, struct mbuf *,
 167                             int, int, struct pfi_kif *,
 168                             struct pf_addr *, u_int16_t, struct pf_addr *,
 169                             u_int16_t, int);
 170 struct pf_rule          *pf_get_translation(struct pf_pdesc *, struct mbuf *,
 171                             int, int, struct pfi_kif *, struct pf_src_node **,
 172                             struct pf_addr *, u_int16_t,
 173                             struct pf_addr *, u_int16_t,
 174                             struct pf_addr *, u_int16_t *);
 175 int                      pf_test_tcp(struct pf_rule **, struct pf_state **,
 176                             int, struct pfi_kif *, struct mbuf *, int,
 177                             void *, struct pf_pdesc *, struct pf_rule **,
 178                             struct pf_ruleset **, struct ifqueue *, struct inpcb *);
 179 int                      pf_test_udp(struct pf_rule **, struct pf_state **,
 180                             int, struct pfi_kif *, struct mbuf *, int,
 181                             void *, struct pf_pdesc *, struct pf_rule **,
 182                             struct pf_ruleset **, struct ifqueue *, struct inpcb *);
 183 int                      pf_test_icmp(struct pf_rule **, struct pf_state **,
 184                             int, struct pfi_kif *, struct mbuf *, int,
 185                             void *, struct pf_pdesc *, struct pf_rule **,
 186                             struct pf_ruleset **, struct ifqueue *);
 187 int                      pf_test_other(struct pf_rule **, struct pf_state **,
 188                             int, struct pfi_kif *, struct mbuf *, int, void *,
 189                             struct pf_pdesc *, struct pf_rule **,
 190                             struct pf_ruleset **, struct ifqueue *);
 191 int                      pf_test_fragment(struct pf_rule **, int,
 192                             struct pfi_kif *, struct mbuf *, void *,
 193                             struct pf_pdesc *, struct pf_rule **,
 194                             struct pf_ruleset **);
 195 int                      pf_test_state_tcp(struct pf_state **, int,
 196                             struct pfi_kif *, struct mbuf *, int,
 197                             void *, struct pf_pdesc *, u_short *);
 198 int                      pf_test_state_udp(struct pf_state **, int,
 199                             struct pfi_kif *, struct mbuf *, int,
 200                             void *, struct pf_pdesc *);
 201 int                      pf_test_state_icmp(struct pf_state **, int,
 202                             struct pfi_kif *, struct mbuf *, int,
 203                             void *, struct pf_pdesc *, u_short *);
 204 int                      pf_test_state_other(struct pf_state **, int,
 205                             struct pfi_kif *, struct pf_pdesc *);
 206 int                      pf_match_tag(struct mbuf *, struct pf_rule *,
 207                              struct pf_mtag *, int *);
 208 int                      pf_step_out_of_anchor(int *, struct pf_ruleset **,
 209                              int, struct pf_rule **, struct pf_rule **,
 210                              int *);
 211 void                     pf_hash(struct pf_addr *, struct pf_addr *,
 212                             struct pf_poolhashkey *, sa_family_t);
 213 int                      pf_map_addr(u_int8_t, struct pf_rule *,
 214                             struct pf_addr *, struct pf_addr *,
 215                             struct pf_addr *, struct pf_src_node **);
 216 int                      pf_get_sport(sa_family_t, u_int8_t, struct pf_rule *,
 217                             struct pf_addr *, struct pf_addr *, u_int16_t,
 218                             struct pf_addr *, u_int16_t*, u_int16_t, u_int16_t,
 219                             struct pf_src_node **);
 220 void                     pf_route(struct mbuf **, struct pf_rule *, int,
 221                             struct ifnet *, struct pf_state *,
 222                             struct pf_pdesc *);
 223 void                     pf_route6(struct mbuf **, struct pf_rule *, int,
 224                             struct ifnet *, struct pf_state *,
 225                             struct pf_pdesc *);
 226 u_int8_t                 pf_get_wscale(struct mbuf *, int, u_int16_t,
 227                             sa_family_t);
 228 u_int16_t                pf_get_mss(struct mbuf *, int, u_int16_t,
 229                             sa_family_t);
 230 u_int16_t                pf_calc_mss(struct pf_addr *, sa_family_t,
 231                                 u_int16_t);
 232 void                     pf_set_rt_ifp(struct pf_state *,
 233                             struct pf_addr *);
 234 int                      pf_check_proto_cksum(struct mbuf *, int, int,
 235                             u_int8_t, sa_family_t);
 236 int                      pf_addr_wrap_neq(struct pf_addr_wrap *,
 237                             struct pf_addr_wrap *);
 238 struct pf_state         *pf_find_state_recurse(struct pfi_kif *,
 239                             struct pf_state_cmp *, u_int8_t);
 240 int                      pf_src_connlimit(struct pf_state **);
 241 int                      pf_check_congestion(struct ifqueue *);
 242
 243 extern int pf_end_threads;
 244
 245 struct pf_pool_limit pf_pool_limits[PF_LIMIT_MAX] = {
 246         { &pf_state_pl, PFSTATE_HIWAT },
 247         { &pf_src_tree_pl, PFSNODE_HIWAT },
 248         { &pf_frent_pl, PFFRAG_FRENT_HIWAT },
 249         { &pfr_ktable_pl, PFR_KTABLE_HIWAT },
 250         { &pfr_kentry_pl, PFR_KENTRY_HIWAT }
 251 };
 252
 253 #define STATE_LOOKUP()                                                  \
 254         do {                                                            \
 255                 if (direction == PF_IN)                                 \
 256                         *state = pf_find_state_recurse(                 \
 257                             kif, &key, PF_EXT_GWY);                     \
 258                 else                                                    \
 259                         *state = pf_find_state_recurse(         \
 260                             kif, &key, PF_LAN_EXT);                     \
 261                 if (*state == NULL || (*state)->timeout == PFTM_PURGE)  \
 262                         return (PF_DROP);                               \
 263                 if (direction == PF_OUT &&                              \
 264                     (((*state)->rule.ptr->rt == PF_ROUTETO &&           \
 265                     (*state)->rule.ptr->direction == PF_OUT) ||         \
 266                     ((*state)->rule.ptr->rt == PF_REPLYTO &&            \
 267                     (*state)->rule.ptr->direction == PF_IN)) &&         \
 268                     (*state)->rt_kif != NULL &&                         \
 269                     (*state)->rt_kif != kif)                            \
 270                         return (PF_PASS);                               \
 271         } while (0)
 272
 273 #define STATE_TRANSLATE(s) \
 274         (s)->lan.addr.addr32[0] != (s)->gwy.addr.addr32[0] || \
 275         ((s)->af == AF_INET6 && \
 276         ((s)->lan.addr.addr32[1] != (s)->gwy.addr.addr32[1] || \
 277         (s)->lan.addr.addr32[2] != (s)->gwy.addr.addr32[2] || \
 278         (s)->lan.addr.addr32[3] != (s)->gwy.addr.addr32[3])) || \
 279         (s)->lan.port != (s)->gwy.port
 280
 281 #define BOUND_IFACE(r, k) \
 282         ((r)->rule_flag & PFRULE_IFBOUND) ? (k) : pfi_all
 283
 284 #define STATE_INC_COUNTERS(s)                           \
 285         do {                                            \
 286                 s->rule.ptr->states++;                  \
 287                 if (s->anchor.ptr != NULL)              \
 288                         s->anchor.ptr->states++;        \
 289                 if (s->nat_rule.ptr != NULL)            \
 290                         s->nat_rule.ptr->states++;      \
 291         } while (0)
 292
 293 #define STATE_DEC_COUNTERS(s)                           \
 294         do {                                            \
 295                 if (s->nat_rule.ptr != NULL)            \
 296                         s->nat_rule.ptr->states--;      \
 297                 if (s->anchor.ptr != NULL)              \
 298                         s->anchor.ptr->states--;        \
 299                 s->rule.ptr->states--;                  \
 300         } while (0)
 301
 302 static __inline int pf_src_compare(struct pf_src_node *, struct pf_src_node *);
 303 static __inline int pf_state_compare_lan_ext(struct pf_state *,
 304         struct pf_state *);
 305 static __inline int pf_state_compare_ext_gwy(struct pf_state *,
 306         struct pf_state *);
 307 static __inline int pf_state_compare_id(struct pf_state *,
 308         struct pf_state *);
 309
 310 struct pf_src_tree tree_src_tracking;
 311
 312 struct pf_state_tree_id tree_id;
 313 struct pf_state_queue state_list;
 314
 315 RB_GENERATE(pf_src_tree, pf_src_node, entry, pf_src_compare);
 316 RB_GENERATE(pf_state_tree_lan_ext, pf_state,
 317     u.s.entry_lan_ext, pf_state_compare_lan_ext);
 318 RB_GENERATE(pf_state_tree_ext_gwy, pf_state,
 319     u.s.entry_ext_gwy, pf_state_compare_ext_gwy);
 320 RB_GENERATE(pf_state_tree_id, pf_state,
 321     u.s.entry_id, pf_state_compare_id);
 322
 323 static __inline int
 324 pf_src_compare(struct pf_src_node *a, struct pf_src_node *b)
 325 {
 326         int     diff;
 327
 328         if (a->rule.ptr > b->rule.ptr)
 329                 return (1);
 330         if (a->rule.ptr < b->rule.ptr)
 331                 return (-1);
 332         if ((diff = a->af - b->af) != 0)
 333                 return (diff);
 334         switch (a->af) {
 335 #ifdef INET
 336         case AF_INET:
 337                 if (a->addr.addr32[0] > b->addr.addr32[0])
 338                         return (1);
 339                 if (a->addr.addr32[0] < b->addr.addr32[0])
 340                         return (-1);
 341                 break;
 342 #endif /* INET */
 343 #ifdef INET6
 344         case AF_INET6:
 345                 if (a->addr.addr32[3] > b->addr.addr32[3])
 346                         return (1);
 347                 if (a->addr.addr32[3] < b->addr.addr32[3])
 348                         return (-1);
 349                 if (a->addr.addr32[2] > b->addr.addr32[2])
 350                         return (1);
 351                 if (a->addr.addr32[2] < b->addr.addr32[2])
 352                         return (-1);
 353                 if (a->addr.addr32[1] > b->addr.addr32[1])
 354                         return (1);
 355                 if (a->addr.addr32[1] < b->addr.addr32[1])
 356                         return (-1);
 357                 if (a->addr.addr32[0] > b->addr.addr32[0])
 358                         return (1);
 359                 if (a->addr.addr32[0] < b->addr.addr32[0])
 360                         return (-1);
 361                 break;
 362 #endif /* INET6 */
 363         }
 364         return (0);
 365 }
 366
 367 u_int32_t
 368 pf_state_hash(struct pf_state *s)
 369 {
 370         u_int32_t hv = (intptr_t)s / sizeof(*s);
 371
 372         hv ^= crc32(&s->lan, sizeof(s->lan));
 373         hv ^= crc32(&s->gwy, sizeof(s->gwy));
 374         hv ^= crc32(&s->ext, sizeof(s->ext));
 375         if (hv == 0)    /* disallow 0 */
 376                 hv = 1;
 377         return(hv);
 378 }
 379
 380 static __inline int
 381 pf_state_compare_lan_ext(struct pf_state *a, struct pf_state *b)
 382 {
 383         int     diff;
 384
 385         if ((diff = a->proto - b->proto) != 0)
 386                 return (diff);
 387         if ((diff = a->af - b->af) != 0)
 388                 return (diff);
 389         switch (a->af) {
 390 #ifdef INET
 391         case AF_INET:
 392                 if (a->lan.addr.addr32[0] > b->lan.addr.addr32[0])
 393                         return (1);
 394                 if (a->lan.addr.addr32[0] < b->lan.addr.addr32[0])
 395                         return (-1);
 396                 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0])
 397                         return (1);
 398                 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0])
 399                         return (-1);
 400                 break;
 401 #endif /* INET */
 402 #ifdef INET6
 403         case AF_INET6:
 404                 if (a->lan.addr.addr32[3] > b->lan.addr.addr32[3])
 405                         return (1);
 406                 if (a->lan.addr.addr32[3] < b->lan.addr.addr32[3])
 407                         return (-1);
 408                 if (a->ext.addr.addr32[3] > b->ext.addr.addr32[3])
 409                         return (1);
 410                 if (a->ext.addr.addr32[3] < b->ext.addr.addr32[3])
 411                         return (-1);
 412                 if (a->lan.addr.addr32[2] > b->lan.addr.addr32[2])
 413                         return (1);
 414                 if (a->lan.addr.addr32[2] < b->lan.addr.addr32[2])
 415                         return (-1);
 416                 if (a->ext.addr.addr32[2] > b->ext.addr.addr32[2])
 417                         return (1);
 418                 if (a->ext.addr.addr32[2] < b->ext.addr.addr32[2])
 419                         return (-1);
 420                 if (a->lan.addr.addr32[1] > b->lan.addr.addr32[1])
 421                         return (1);
 422                 if (a->lan.addr.addr32[1] < b->lan.addr.addr32[1])
 423                         return (-1);
 424                 if (a->ext.addr.addr32[1] > b->ext.addr.addr32[1])
 425                         return (1);
 426                 if (a->ext.addr.addr32[1] < b->ext.addr.addr32[1])
 427                         return (-1);
 428                 if (a->lan.addr.addr32[0] > b->lan.addr.addr32[0])
 429                         return (1);
 430                 if (a->lan.addr.addr32[0] < b->lan.addr.addr32[0])
 431                         return (-1);
 432                 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0])
 433                         return (1);
 434                 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0])
 435                         return (-1);
 436                 break;
 437 #endif /* INET6 */
 438         }
 439
 440         if ((diff = a->lan.port - b->lan.port) != 0)
 441                 return (diff);
 442         if ((diff = a->ext.port - b->ext.port) != 0)
 443                 return (diff);
 444
 445         return (0);
 446 }
 447
 448 static __inline int
 449 pf_state_compare_ext_gwy(struct pf_state *a, struct pf_state *b)
 450 {
 451         int     diff;
 452
 453         if ((diff = a->proto - b->proto) != 0)
 454                 return (diff);
 455         if ((diff = a->af - b->af) != 0)
 456                 return (diff);
 457         switch (a->af) {
 458 #ifdef INET
 459         case AF_INET:
 460                 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0])
 461                         return (1);
 462                 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0])
 463                         return (-1);
 464                 if (a->gwy.addr.addr32[0] > b->gwy.addr.addr32[0])
 465                         return (1);
 466                 if (a->gwy.addr.addr32[0] < b->gwy.addr.addr32[0])
 467                         return (-1);
 468                 break;
 469 #endif /* INET */
 470 #ifdef INET6
 471         case AF_INET6:
 472                 if (a->ext.addr.addr32[3] > b->ext.addr.addr32[3])
 473                         return (1);
 474                 if (a->ext.addr.addr32[3] < b->ext.addr.addr32[3])
 475                         return (-1);
 476                 if (a->gwy.addr.addr32[3] > b->gwy.addr.addr32[3])
 477                         return (1);
 478                 if (a->gwy.addr.addr32[3] < b->gwy.addr.addr32[3])
 479                         return (-1);
 480                 if (a->ext.addr.addr32[2] > b->ext.addr.addr32[2])
 481                         return (1);
 482                 if (a->ext.addr.addr32[2] < b->ext.addr.addr32[2])
 483                         return (-1);
 484                 if (a->gwy.addr.addr32[2] > b->gwy.addr.addr32[2])
 485                         return (1);
 486                 if (a->gwy.addr.addr32[2] < b->gwy.addr.addr32[2])
 487                         return (-1);
 488                 if (a->ext.addr.addr32[1] > b->ext.addr.addr32[1])
 489                         return (1);
 490                 if (a->ext.addr.addr32[1] < b->ext.addr.addr32[1])
 491                         return (-1);
 492                 if (a->gwy.addr.addr32[1] > b->gwy.addr.addr32[1])
 493                         return (1);
 494                 if (a->gwy.addr.addr32[1] < b->gwy.addr.addr32[1])
 495                         return (-1);
 496                 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0])
 497                         return (1);
 498                 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0])
 499                         return (-1);
 500                 if (a->gwy.addr.addr32[0] > b->gwy.addr.addr32[0])
 501                         return (1);
 502                 if (a->gwy.addr.addr32[0] < b->gwy.addr.addr32[0])
 503                         return (-1);
 504                 break;
 505 #endif /* INET6 */
 506         }
 507
 508         if ((diff = a->ext.port - b->ext.port) != 0)
 509                 return (diff);
 510         if ((diff = a->gwy.port - b->gwy.port) != 0)
 511                 return (diff);
 512
 513         return (0);
 514 }
 515
 516 static __inline int
 517 pf_state_compare_id(struct pf_state *a, struct pf_state *b)
 518 {
 519         if (a->id > b->id)
 520                 return (1);
 521         if (a->id < b->id)
 522                 return (-1);
 523         if (a->creatorid > b->creatorid)
 524                 return (1);
 525         if (a->creatorid < b->creatorid)
 526                 return (-1);
 527
 528         return (0);
 529 }
 530
 531 #ifdef INET6
 532 void
 533 pf_addrcpy(struct pf_addr *dst, struct pf_addr *src, sa_family_t af)
 534 {
 535         switch (af) {
 536 #ifdef INET
 537         case AF_INET:
 538                 dst->addr32[0] = src->addr32[0];
 539                 break;
 540 #endif /* INET */
 541         case AF_INET6:
 542                 dst->addr32[0] = src->addr32[0];
 543                 dst->addr32[1] = src->addr32[1];
 544                 dst->addr32[2] = src->addr32[2];
 545                 dst->addr32[3] = src->addr32[3];
 546                 break;
 547         }
 548 }
 549 #endif /* INET6 */
 550
 551 struct pf_state *
 552 pf_find_state_byid(struct pf_state_cmp *key)
 553 {
 554         pf_status.fcounters[FCNT_STATE_SEARCH]++;
 555         return (RB_FIND(pf_state_tree_id, &tree_id, (struct pf_state *)key));
 556 }
 557
 558 struct pf_state *
 559 pf_find_state_recurse(struct pfi_kif *kif, struct pf_state_cmp *key, u_int8_t tree)
 560 {
 561         struct pf_state *s;
 562
 563         pf_status.fcounters[FCNT_STATE_SEARCH]++;
 564
 565         switch (tree) {
 566         case PF_LAN_EXT:
 567                 if ((s = RB_FIND(pf_state_tree_lan_ext, &kif->pfik_lan_ext,
 568                     (struct pf_state *)key)) != NULL)
 569                         return (s);
 570                 if ((s = RB_FIND(pf_state_tree_lan_ext, &pfi_all->pfik_lan_ext,
 571                     (struct pf_state *)key)) != NULL)
 572                         return (s);
 573                 return (NULL);
 574         case PF_EXT_GWY:
 575                 if ((s = RB_FIND(pf_state_tree_ext_gwy, &kif->pfik_ext_gwy,
 576                     (struct pf_state *)key)) != NULL)
 577                         return (s);
 578                 if ((s = RB_FIND(pf_state_tree_ext_gwy, &pfi_all->pfik_ext_gwy,
 579                     (struct pf_state *)key)) != NULL)
 580                         return (s);
 581                 return (NULL);
 582         default:
 583                 panic("pf_find_state_recurse");
 584         }
 585 }
 586
 587 struct pf_state *
 588 pf_find_state_all(struct pf_state_cmp *key, u_int8_t tree, int *more)
 589 {
 590         struct pf_state *s, *ss = NULL;
 591         struct pfi_kif  *kif;
 592
 593         pf_status.fcounters[FCNT_STATE_SEARCH]++;
 594
 595         switch (tree) {
 596         case PF_LAN_EXT:
 597                 TAILQ_FOREACH(kif, &pfi_statehead, pfik_w_states) {
 598                         s = RB_FIND(pf_state_tree_lan_ext,
 599                             &kif->pfik_lan_ext, (struct pf_state *)key);
 600                         if (s == NULL)
 601                                 continue;
 602                         if (more == NULL)
 603                                 return (s);
 604                         ss = s;
 605                         (*more)++;
 606                 }
 607                 return (ss);
 608         case PF_EXT_GWY:
 609                 TAILQ_FOREACH(kif, &pfi_statehead, pfik_w_states) {
 610                         s = RB_FIND(pf_state_tree_ext_gwy,
 611                             &kif->pfik_ext_gwy, (struct pf_state *)key);
 612                         if (s == NULL)
 613                                 continue;
 614                         if (more == NULL)
 615                                 return (s);
 616                         ss = s;
 617                         (*more)++;
 618                 }
 619                 return (ss);
 620         default:
 621                 panic("pf_find_state_all");
 622         }
 623 }
 624
 625 void
 626 pf_init_threshold(struct pf_threshold *threshold,
 627     u_int32_t limit, u_int32_t seconds)
 628 {
 629         threshold->limit = limit * PF_THRESHOLD_MULT;
 630         threshold->seconds = seconds;
 631         threshold->count = 0;
 632         threshold->last = time_second;
 633 }
 634
 635 void
 636 pf_add_threshold(struct pf_threshold *threshold)
 637 {
 638         u_int32_t t = time_second, diff = t - threshold->last;
 639
 640         if (diff >= threshold->seconds)
 641                 threshold->count = 0;
 642         else
 643                 threshold->count -= threshold->count * diff /
 644                     threshold->seconds;
 645         threshold->count += PF_THRESHOLD_MULT;
 646         threshold->last = t;
 647 }
 648
 649 int
 650 pf_check_threshold(struct pf_threshold *threshold)
 651 {
 652         return (threshold->count > threshold->limit);
 653 }
 654
 655 int
 656 pf_src_connlimit(struct pf_state **state)
 657 {
 658         struct pf_state *s;
 659         int bad = 0;
 660
 661         (*state)->src_node->conn++;
 662         (*state)->src.tcp_est = 1;
 663         pf_add_threshold(&(*state)->src_node->conn_rate);
 664
 665         if ((*state)->rule.ptr->max_src_conn &&
 666             (*state)->rule.ptr->max_src_conn <
 667             (*state)->src_node->conn) {
 668                 pf_status.lcounters[LCNT_SRCCONN]++;
 669                 bad++;
 670         }
 671
 672         if ((*state)->rule.ptr->max_src_conn_rate.limit &&
 673             pf_check_threshold(&(*state)->src_node->conn_rate)) {
 674                 pf_status.lcounters[LCNT_SRCCONNRATE]++;
 675                 bad++;
 676         }
 677
 678         if (!bad)
 679                 return (0);
 680
 681         if ((*state)->rule.ptr->overload_tbl) {
 682                 struct pfr_addr p;
 683                 u_int32_t       killed = 0;
 684
 685                 pf_status.lcounters[LCNT_OVERLOAD_TABLE]++;
 686                 if (pf_status.debug >= PF_DEBUG_MISC) {
 687                         kprintf("pf_src_connlimit: blocking address ");
 688                         pf_print_host(&(*state)->src_node->addr, 0,
 689                             (*state)->af);
 690                 }
 691
 692                 bzero(&p, sizeof(p));
 693                 p.pfra_af = (*state)->af;
 694                 switch ((*state)->af) {
 695 #ifdef INET
 696                 case AF_INET:
 697                         p.pfra_net = 32;
 698                         p.pfra_ip4addr = (*state)->src_node->addr.v4;
 699                         break;
 700 #endif /* INET */
 701 #ifdef INET6
 702                 case AF_INET6:
 703                         p.pfra_net = 128;
 704                         p.pfra_ip6addr = (*state)->src_node->addr.v6;
 705                         break;
 706 #endif /* INET6 */
 707                 }
 708
 709                 pfr_insert_kentry((*state)->rule.ptr->overload_tbl,
 710                     &p, time_second);
 711
 712                 /* kill existing states if that's required. */
 713                 if ((*state)->rule.ptr->flush) {
 714                         pf_status.lcounters[LCNT_OVERLOAD_FLUSH]++;
 715
 716                         RB_FOREACH(s, pf_state_tree_id, &tree_id) {
 717                                 /*
 718                                  * Kill states from this source.  (Only those
 719                                  * from the same rule if PF_FLUSH_GLOBAL is not
 720                                  * set)
 721                                  */
 722                                 if (s->af == (*state)->af &&
 723                                     (((*state)->direction == PF_OUT &&
 724                                     PF_AEQ(&(*state)->src_node->addr,
 725                                     &s->lan.addr, s->af)) ||
 726                                     ((*state)->direction == PF_IN &&
 727                                     PF_AEQ(&(*state)->src_node->addr,
 728                                     &s->ext.addr, s->af))) &&
 729                                     ((*state)->rule.ptr->flush &
 730                                     PF_FLUSH_GLOBAL ||
 731                                     (*state)->rule.ptr == s->rule.ptr)) {
 732                                         s->timeout = PFTM_PURGE;
 733                                         s->src.state = s->dst.state =
 734                                             TCPS_CLOSED;
 735                                         killed++;
 736                                 }
 737                         }
 738                         if (pf_status.debug >= PF_DEBUG_MISC)
 739                                 kprintf(", %u states killed", killed);
 740                 }
 741                 if (pf_status.debug >= PF_DEBUG_MISC)
 742                         kprintf("\n");
 743         }
 744
 745         /* kill this state */
 746         (*state)->timeout = PFTM_PURGE;
 747         (*state)->src.state = (*state)->dst.state = TCPS_CLOSED;
 748         return (1);
 749 }
 750
 751 int
 752 pf_insert_src_node(struct pf_src_node **sn, struct pf_rule *rule,
 753     struct pf_addr *src, sa_family_t af)
 754 {
 755         struct pf_src_node      k;
 756
 757         if (*sn == NULL) {
 758                 k.af = af;
 759                 PF_ACPY(&k.addr, src, af);
 760                 if (rule->rule_flag & PFRULE_RULESRCTRACK ||
 761                     rule->rpool.opts & PF_POOL_STICKYADDR)
 762                         k.rule.ptr = rule;
 763                 else
 764                         k.rule.ptr = NULL;
 765                 pf_status.scounters[SCNT_SRC_NODE_SEARCH]++;
 766                 *sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k);
 767         }
 768         if (*sn == NULL) {
 769                 if (!rule->max_src_nodes ||
 770                     rule->src_nodes < rule->max_src_nodes)
 771                         (*sn) = pool_get(&pf_src_tree_pl, PR_NOWAIT);
 772                 else
 773                         pf_status.lcounters[LCNT_SRCNODES]++;
 774                 if ((*sn) == NULL)
 775                         return (-1);
 776                 bzero(*sn, sizeof(struct pf_src_node));
 777
 778                 pf_init_threshold(&(*sn)->conn_rate,
 779                     rule->max_src_conn_rate.limit,
 780                     rule->max_src_conn_rate.seconds);
 781
 782                 (*sn)->af = af;
 783                 if (rule->rule_flag & PFRULE_RULESRCTRACK ||
 784                     rule->rpool.opts & PF_POOL_STICKYADDR)
 785                         (*sn)->rule.ptr = rule;
 786                 else
 787                         (*sn)->rule.ptr = NULL;
 788                 PF_ACPY(&(*sn)->addr, src, af);
 789                 if (RB_INSERT(pf_src_tree,
 790                     &tree_src_tracking, *sn) != NULL) {
 791                         if (pf_status.debug >= PF_DEBUG_MISC) {
 792                                 kprintf("pf: src_tree insert failed: ");
 793                                 pf_print_host(&(*sn)->addr, 0, af);
 794                                 kprintf("\n");
 795                         }
 796                         pool_put(&pf_src_tree_pl, *sn);
 797                         return (-1);
 798                 }
 799                 (*sn)->creation = time_second;
 800                 (*sn)->ruletype = rule->action;
 801                 if ((*sn)->rule.ptr != NULL)
 802                         (*sn)->rule.ptr->src_nodes++;
 803                 pf_status.scounters[SCNT_SRC_NODE_INSERT]++;
 804                 pf_status.src_nodes++;
 805         } else {
 806                 if (rule->max_src_states &&
 807                     (*sn)->states >= rule->max_src_states) {
 808                         pf_status.lcounters[LCNT_SRCSTATES]++;
 809                         return (-1);
 810                 }
 811         }
 812         return (0);
 813 }
 814
 815 int
 816 pf_insert_state(struct pfi_kif *kif, struct pf_state *state)
 817 {
 818         /* Thou MUST NOT insert multiple duplicate keys */
 819         state->u.s.kif = kif;
 820         if (RB_INSERT(pf_state_tree_lan_ext, &kif->pfik_lan_ext, state)) {
 821                 if (pf_status.debug >= PF_DEBUG_MISC) {
 822                         kprintf("pf: state insert failed: tree_lan_ext");
 823                         kprintf(" lan: ");
 824                         pf_print_host(&state->lan.addr, state->lan.port,
 825                             state->af);
 826                         kprintf(" gwy: ");
 827                         pf_print_host(&state->gwy.addr, state->gwy.port,
 828                             state->af);
 829                         kprintf(" ext: ");
 830                         pf_print_host(&state->ext.addr, state->ext.port,
 831                             state->af);
 832                         if (state->sync_flags & PFSTATE_FROMSYNC)
 833                                 kprintf(" (from sync)");
 834                         kprintf("\n");
 835                 }
 836                 return (-1);
 837         }
 838
 839         if (RB_INSERT(pf_state_tree_ext_gwy, &kif->pfik_ext_gwy, state)) {
 840                 if (pf_status.debug >= PF_DEBUG_MISC) {
 841                         kprintf("pf: state insert failed: tree_ext_gwy");
 842                         kprintf(" lan: ");
 843                         pf_print_host(&state->lan.addr, state->lan.port,
 844                             state->af);
 845                         kprintf(" gwy: ");
 846                         pf_print_host(&state->gwy.addr, state->gwy.port,
 847                             state->af);
 848                         kprintf(" ext: ");
 849                         pf_print_host(&state->ext.addr, state->ext.port,
 850                             state->af);
 851                         if (state->sync_flags & PFSTATE_FROMSYNC)
 852                                 kprintf(" (from sync)");
 853                         kprintf("\n");
 854                 }
 855                 RB_REMOVE(pf_state_tree_lan_ext, &kif->pfik_lan_ext, state);
 856                 return (-1);
 857         }
 858
 859         if (state->id == 0 && state->creatorid == 0) {
 860                 state->id = htobe64(pf_status.stateid++);
 861                 state->creatorid = pf_status.hostid;
 862         }
 863         if (RB_INSERT(pf_state_tree_id, &tree_id, state) != NULL) {
 864                 if (pf_status.debug >= PF_DEBUG_MISC) {
 865                         kprintf("pf: state insert failed: "
 866                             "id: %016" PRIx64 " creatorid: %08" PRIx32,
 867                             be64toh(state->id), ntohl(state->creatorid));
 868                         if (state->sync_flags & PFSTATE_FROMSYNC)
 869                                 kprintf(" (from sync)");
 870                         kprintf("\n");
 871                 }
 872                 RB_REMOVE(pf_state_tree_lan_ext, &kif->pfik_lan_ext, state);
 873                 RB_REMOVE(pf_state_tree_ext_gwy, &kif->pfik_ext_gwy, state);
 874                 return (-1);
 875         }
 876         TAILQ_INSERT_TAIL(&state_list, state, u.s.entry_list);
 877         pf_status.fcounters[FCNT_STATE_INSERT]++;
 878         pf_status.states++;
 879         pfi_kif_ref(kif, PFI_KIF_REF_STATE);
 880 #if NPFSYNC
 881         pfsync_insert_state(state);
 882 #endif
 883         return (0);
 884 }
 885
 886 void
 887 pf_purge_thread(void *v)
 888 {
 889         int nloops = 0;
 890         int locked = 0;
 891
 892         for (;;) {
 893                 tsleep(pf_purge_thread, PWAIT, "pftm", 1 * hz);
 894
 895                 lockmgr(&pf_consistency_lock, LK_EXCLUSIVE);
 896
 897                 if (pf_end_threads) {
 898                         pf_purge_expired_states(pf_status.states, 1);
 899                         pf_purge_expired_fragments();
 900                         pf_purge_expired_src_nodes(1);
 901                         pf_end_threads++;
 902
 903                         lockmgr(&pf_consistency_lock, LK_RELEASE);
 904                         wakeup(pf_purge_thread);
 905                         kthread_exit();
 906                 }
 907                 crit_enter();
 908
 909                 /* process a fraction of the state table every second */
 910                 if(!pf_purge_expired_states(1 + (pf_status.states
 911                     / pf_default_rule.timeout[PFTM_INTERVAL]), 0)) {
 912
 913                         pf_purge_expired_states(1 + (pf_status.states
 914                             / pf_default_rule.timeout[PFTM_INTERVAL]), 1);
 915                 }
 916
 917                 /* purge other expired types every PFTM_INTERVAL seconds */
 918                 if (++nloops >= pf_default_rule.timeout[PFTM_INTERVAL]) {
 919                         pf_purge_expired_fragments();
 920                         if (!pf_purge_expired_src_nodes(locked)) {
 921                                 pf_purge_expired_src_nodes(1);
 922                         }
 923                         nloops = 0;
 924                 }
 925                 crit_exit();
 926                 lockmgr(&pf_consistency_lock, LK_RELEASE);
 927         }
 928 }
 929
 930 u_int32_t
 931 pf_state_expires(const struct pf_state *state)
 932 {
 933         u_int32_t       timeout;
 934         u_int32_t       start;
 935         u_int32_t       end;
 936         u_int32_t       states;
 937
 938         /* handle all PFTM_* > PFTM_MAX here */
 939         if (state->timeout == PFTM_PURGE)
 940                 return (time_second);
 941         if (state->timeout == PFTM_UNTIL_PACKET)
 942                 return (0);
 943         KKASSERT(state->timeout != PFTM_UNLINKED);
 944         KASSERT((state->timeout < PFTM_MAX),
 945                 ("pf_state_expires: timeout > PFTM_MAX"));
 946         timeout = state->rule.ptr->timeout[state->timeout];
 947         if (!timeout)
 948                 timeout = pf_default_rule.timeout[state->timeout];
 949         start = state->rule.ptr->timeout[PFTM_ADAPTIVE_START];
 950         if (start) {
 951                 end = state->rule.ptr->timeout[PFTM_ADAPTIVE_END];
 952                 states = state->rule.ptr->states;
 953         } else {
 954                 start = pf_default_rule.timeout[PFTM_ADAPTIVE_START];
 955                 end = pf_default_rule.timeout[PFTM_ADAPTIVE_END];
 956                 states = pf_status.states;
 957         }
 958         if (end && states > start && start < end) {
 959                 if (states < end)
 960                         return (state->expire + timeout * (end - states) /
 961                             (end - start));
 962                 else
 963                         return (time_second);
 964         }
 965         return (state->expire + timeout);
 966 }
 967
 968 int
 969 pf_purge_expired_src_nodes(int waslocked)
 970 {
 971          struct pf_src_node             *cur, *next;
 972          int                             locked = waslocked;
 973
 974          for (cur = RB_MIN(pf_src_tree, &tree_src_tracking); cur; cur = next) {
 975                  next = RB_NEXT(pf_src_tree, &tree_src_tracking, cur);
 976
 977                  if (cur->states <= 0 && cur->expire <= time_second) {
 978                          if (! locked) {
 979                                  lockmgr(&pf_consistency_lock, LK_EXCLUSIVE);
 980                                  next = RB_NEXT(pf_src_tree,
 981                                      &tree_src_tracking, cur);
 982                                  locked = 1;
 983                          }
 984                          if (cur->rule.ptr != NULL) {
 985                                  cur->rule.ptr->src_nodes--;
 986                                  if (cur->rule.ptr->states <= 0 &&
 987                                      cur->rule.ptr->max_src_nodes <= 0)
 988                                          pf_rm_rule(NULL, cur->rule.ptr);
 989                          }
 990                          RB_REMOVE(pf_src_tree, &tree_src_tracking, cur);
 991                          pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
 992                          pf_status.src_nodes--;
 993                          pool_put(&pf_src_tree_pl, cur);
 994                  }
 995          }
 996
 997          if (locked && !waslocked)
 998                 lockmgr(&pf_consistency_lock, LK_RELEASE);
 999         return(1);
1000 }
1001
1002 void
1003 pf_src_tree_remove_state(struct pf_state *s)
1004 {
1005         u_int32_t timeout;
1006
1007         if (s->src_node != NULL) {
1008                 if (s->proto == IPPROTO_TCP) {
1009                         if (s->src.tcp_est)
1010                                 --s->src_node->conn;
1011                 }
1012                 if (--s->src_node->states <= 0) {
1013                         timeout = s->rule.ptr->timeout[PFTM_SRC_NODE];
1014                         if (!timeout)
1015                                 timeout =
1016                                     pf_default_rule.timeout[PFTM_SRC_NODE];
1017                         s->src_node->expire = time_second + timeout;
1018                 }
1019         }
1020         if (s->nat_src_node != s->src_node && s->nat_src_node != NULL) {
1021                 if (--s->nat_src_node->states <= 0) {
1022                         timeout = s->rule.ptr->timeout[PFTM_SRC_NODE];
1023                         if (!timeout)
1024                                 timeout =
1025                                     pf_default_rule.timeout[PFTM_SRC_NODE];
1026                         s->nat_src_node->expire = time_second + timeout;
1027                 }
1028         }
1029         s->src_node = s->nat_src_node = NULL;
1030 }
1031
1032 /* callers should be at crit_enter() */
1033 void
1034 pf_unlink_state(struct pf_state *cur)
1035 {
1036         if (cur->src.state == PF_TCPS_PROXY_DST) {
1037                 pf_send_tcp(cur->rule.ptr, cur->af,
1038                     &cur->ext.addr, &cur->lan.addr,
1039                     cur->ext.port, cur->lan.port,
1040                     cur->src.seqhi, cur->src.seqlo + 1,
1041                     TH_RST|TH_ACK, 0, 0, 0, 1, cur->tag, NULL, NULL);
1042         }
1043         RB_REMOVE(pf_state_tree_ext_gwy,
1044             &cur->u.s.kif->pfik_ext_gwy, cur);
1045         RB_REMOVE(pf_state_tree_lan_ext,
1046             &cur->u.s.kif->pfik_lan_ext, cur);
1047         RB_REMOVE(pf_state_tree_id, &tree_id, cur);
1048 #if NPFSYNC
1049         if (cur->creatorid == pf_status.hostid)
1050                 pfsync_delete_state(cur);
1051 #endif
1052         cur->timeout = PFTM_UNLINKED;
1053         pf_src_tree_remove_state(cur);
1054 }
1055
1056 /* callers should be at crit_enter() and hold the
1057  * write_lock on pf_consistency_lock */
1058 void
1059 pf_free_state(struct pf_state *cur)
1060 {
1061 #if NPFSYNC
1062         if (pfsyncif != NULL &&
1063             (pfsyncif->sc_bulk_send_next == cur ||
1064             pfsyncif->sc_bulk_terminator == cur))
1065                 return;
1066 #endif
1067         KKASSERT(cur->timeout == PFTM_UNLINKED);
1068         if (--cur->rule.ptr->states <= 0 &&
1069             cur->rule.ptr->src_nodes <= 0)
1070                 pf_rm_rule(NULL, cur->rule.ptr);
1071         if (cur->nat_rule.ptr != NULL)
1072                 if (--cur->nat_rule.ptr->states <= 0 &&
1073                         cur->nat_rule.ptr->src_nodes <= 0)
1074                         pf_rm_rule(NULL, cur->nat_rule.ptr);
1075         if (cur->anchor.ptr != NULL)
1076                 if (--cur->anchor.ptr->states <= 0)
1077                         pf_rm_rule(NULL, cur->anchor.ptr);
1078         pf_normalize_tcp_cleanup(cur);
1079         pfi_kif_unref(cur->u.s.kif, PFI_KIF_REF_STATE);
1080         TAILQ_REMOVE(&state_list, cur, u.s.entry_list);
1081         if (cur->tag)
1082                 pf_tag_unref(cur->tag);
1083         pool_put(&pf_state_pl, cur);
1084         pf_status.fcounters[FCNT_STATE_REMOVALS]++;
1085         pf_status.states--;
1086 }
1087
1088 int
1089 pf_purge_expired_states(u_int32_t maxcheck, int waslocked)
1090 {
1091         static struct pf_state  *cur = NULL;
1092         struct pf_state         *next;
1093         int                      locked = waslocked;
1094
1095         while (maxcheck--) {
1096                 /* wrap to start of list when we hit the end */
1097                 if (cur == NULL) {
1098                         cur = TAILQ_FIRST(&state_list);
1099                         if (cur == NULL)
1100                                 break;  /* list empty */
1101                 }
1102
1103                 /* get next state, as cur may get deleted */
1104                 next = TAILQ_NEXT(cur, u.s.entry_list);
1105
1106                 if (cur->timeout == PFTM_UNLINKED) {
1107                         /* free unlinked state */
1108                         if (! locked) {
1109                                 lockmgr(&pf_consistency_lock, LK_EXCLUSIVE);
1110                                 locked = 1;
1111                         }
1112                         pf_free_state(cur);
1113                 } else if (pf_state_expires(cur) <= time_second) {
1114                         /* unlink and free expired state */
1115                         pf_unlink_state(cur);
1116                         if (! locked) {
1117                                 if (!lockmgr(&pf_consistency_lock, LK_EXCLUSIVE))
1118                                         return (0);
1119                                 locked = 1;
1120                         }
1121                         pf_free_state(cur);
1122                 }
1123                 cur = next;
1124         }
1125
1126         if (locked)
1127                 lockmgr(&pf_consistency_lock, LK_RELEASE);
1128         return (1);
1129 }
1130
1131 int
1132 pf_tbladdr_setup(struct pf_ruleset *rs, struct pf_addr_wrap *aw)
1133 {
1134         if (aw->type != PF_ADDR_TABLE)
1135                 return (0);
1136         if ((aw->p.tbl = pfr_attach_table(rs, aw->v.tblname)) == NULL)
1137                 return (1);
1138         return (0);
1139 }
1140
1141 void
1142 pf_tbladdr_remove(struct pf_addr_wrap *aw)
1143 {
1144         if (aw->type != PF_ADDR_TABLE || aw->p.tbl == NULL)
1145                 return;
1146         pfr_detach_table(aw->p.tbl);
1147         aw->p.tbl = NULL;
1148 }
1149
1150 void
1151 pf_tbladdr_copyout(struct pf_addr_wrap *aw)
1152 {
1153         struct pfr_ktable *kt = aw->p.tbl;
1154
1155         if (aw->type != PF_ADDR_TABLE || kt == NULL)
1156                 return;
1157         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
1158                 kt = kt->pfrkt_root;
1159         aw->p.tbl = NULL;
1160         aw->p.tblcnt = (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) ?
1161                 kt->pfrkt_cnt : -1;
1162 }
1163
1164 void
1165 pf_print_host(struct pf_addr *addr, u_int16_t p, sa_family_t af)
1166 {
1167         switch (af) {
1168 #ifdef INET
1169         case AF_INET: {
1170                 u_int32_t a = ntohl(addr->addr32[0]);
1171                 kprintf("%u.%u.%u.%u", (a>>24)&255, (a>>16)&255,
1172                     (a>>8)&255, a&255);
1173                 if (p) {
1174                         p = ntohs(p);
1175                         kprintf(":%u", p);
1176                 }
1177                 break;
1178         }
1179 #endif /* INET */
1180 #ifdef INET6
1181         case AF_INET6: {
1182                 u_int16_t b;
1183                 u_int8_t i, curstart = 255, curend = 0,
1184                     maxstart = 0, maxend = 0;
1185                 for (i = 0; i < 8; i++) {
1186                         if (!addr->addr16[i]) {
1187                                 if (curstart == 255)
1188                                         curstart = i;
1189                                 else
1190                                         curend = i;
1191                         } else {
1192                                 if (curstart) {
1193                                         if ((curend - curstart) >
1194                                             (maxend - maxstart)) {
1195                                                 maxstart = curstart;
1196                                                 maxend = curend;
1197                                                 curstart = 255;
1198                                         }
1199                                 }
1200                         }
1201                 }
1202                 for (i = 0; i < 8; i++) {
1203                         if (i >= maxstart && i <= maxend) {
1204                                 if (maxend != 7) {
1205                                         if (i == maxstart)
1206                                                 kprintf(":");
1207                                 } else {
1208                                         if (i == maxend)
1209                                                 kprintf(":");
1210                                 }
1211                         } else {
1212                                 b = ntohs(addr->addr16[i]);
1213                                 kprintf("%x", b);
1214                                 if (i < 7)
1215                                         kprintf(":");
1216                         }
1217                 }
1218                 if (p) {
1219                         p = ntohs(p);
1220                         kprintf("[%u]", p);
1221                 }
1222                 break;
1223         }
1224 #endif /* INET6 */
1225         }
1226 }
1227
1228 void
1229 pf_print_state(struct pf_state *s)
1230 {
1231         switch (s->proto) {
1232         case IPPROTO_TCP:
1233                 kprintf("TCP ");
1234                 break;
1235         case IPPROTO_UDP:
1236                 kprintf("UDP ");
1237                 break;
1238         case IPPROTO_ICMP:
1239                 kprintf("ICMP ");
1240                 break;
1241         case IPPROTO_ICMPV6:
1242                 kprintf("ICMPV6 ");
1243                 break;
1244         default:
1245                 kprintf("%u ", s->proto);
1246                 break;
1247         }
1248         pf_print_host(&s->lan.addr, s->lan.port, s->af);
1249         kprintf(" ");
1250         pf_print_host(&s->gwy.addr, s->gwy.port, s->af);
1251         kprintf(" ");
1252         pf_print_host(&s->ext.addr, s->ext.port, s->af);
1253         kprintf(" [lo=%u high=%u win=%u modulator=%u", s->src.seqlo,
1254             s->src.seqhi, s->src.max_win, s->src.seqdiff);
1255         if (s->src.wscale && s->dst.wscale)
1256                 kprintf(" wscale=%u", s->src.wscale & PF_WSCALE_MASK);
1257         kprintf("]");
1258         kprintf(" [lo=%u high=%u win=%u modulator=%u", s->dst.seqlo,
1259             s->dst.seqhi, s->dst.max_win, s->dst.seqdiff);
1260         if (s->src.wscale && s->dst.wscale)
1261                 kprintf(" wscale=%u", s->dst.wscale & PF_WSCALE_MASK);
1262         kprintf("]");
1263         kprintf(" %u:%u", s->src.state, s->dst.state);
1264 }
1265
1266 void
1267 pf_print_flags(u_int8_t f)
1268 {
1269         if (f)
1270                 kprintf(" ");
1271         if (f & TH_FIN)
1272                 kprintf("F");
1273         if (f & TH_SYN)
1274                 kprintf("S");
1275         if (f & TH_RST)
1276                 kprintf("R");
1277         if (f & TH_PUSH)
1278                 kprintf("P");
1279         if (f & TH_ACK)
1280                 kprintf("A");
1281         if (f & TH_URG)
1282                 kprintf("U");
1283         if (f & TH_ECE)
1284                 kprintf("E");
1285         if (f & TH_CWR)
1286                 kprintf("W");
1287 }
1288
1289 #define PF_SET_SKIP_STEPS(i)                                    \
1290         do {                                                    \
1291                 while (head[i] != cur) {                        \
1292                         head[i]->skip[i].ptr = cur;             \
1293                         head[i] = TAILQ_NEXT(head[i], entries); \
1294                 }                                               \
1295         } while (0)
1296
1297 void
1298 pf_calc_skip_steps(struct pf_rulequeue *rules)
1299 {
1300         struct pf_rule *cur, *prev, *head[PF_SKIP_COUNT];
1301         int i;
1302
1303         cur = TAILQ_FIRST(rules);
1304         prev = cur;
1305         for (i = 0; i < PF_SKIP_COUNT; ++i)
1306                 head[i] = cur;
1307         while (cur != NULL) {
1308
1309                 if (cur->kif != prev->kif || cur->ifnot != prev->ifnot)
1310                         PF_SET_SKIP_STEPS(PF_SKIP_IFP);
1311                 if (cur->direction != prev->direction)
1312                         PF_SET_SKIP_STEPS(PF_SKIP_DIR);
1313                 if (cur->af != prev->af)
1314                         PF_SET_SKIP_STEPS(PF_SKIP_AF);
1315                 if (cur->proto != prev->proto)
1316                         PF_SET_SKIP_STEPS(PF_SKIP_PROTO);
1317                 if (cur->src.neg != prev->src.neg ||
1318                     pf_addr_wrap_neq(&cur->src.addr, &prev->src.addr))
1319                         PF_SET_SKIP_STEPS(PF_SKIP_SRC_ADDR);
1320                 if (cur->src.port[0] != prev->src.port[0] ||
1321                     cur->src.port[1] != prev->src.port[1] ||
1322                     cur->src.port_op != prev->src.port_op)
1323                         PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT);
1324                 if (cur->dst.neg != prev->dst.neg ||
1325                     pf_addr_wrap_neq(&cur->dst.addr, &prev->dst.addr))
1326                         PF_SET_SKIP_STEPS(PF_SKIP_DST_ADDR);
1327                 if (cur->dst.port[0] != prev->dst.port[0] ||
1328                     cur->dst.port[1] != prev->dst.port[1] ||
1329                     cur->dst.port_op != prev->dst.port_op)
1330                         PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT);
1331
1332                 prev = cur;
1333                 cur = TAILQ_NEXT(cur, entries);
1334         }
1335         for (i = 0; i < PF_SKIP_COUNT; ++i)
1336                 PF_SET_SKIP_STEPS(i);
1337 }
1338
1339 int
1340 pf_addr_wrap_neq(struct pf_addr_wrap *aw1, struct pf_addr_wrap *aw2)
1341 {
1342         if (aw1->type != aw2->type)
1343                 return (1);
1344         switch (aw1->type) {
1345         case PF_ADDR_ADDRMASK:
1346                 if (PF_ANEQ(&aw1->v.a.addr, &aw2->v.a.addr, 0))
1347                         return (1);
1348                 if (PF_ANEQ(&aw1->v.a.mask, &aw2->v.a.mask, 0))
1349                         return (1);
1350                 return (0);
1351         case PF_ADDR_DYNIFTL:
1352                 return (aw1->p.dyn->pfid_kt != aw2->p.dyn->pfid_kt);
1353         case PF_ADDR_NOROUTE:
1354         case PF_ADDR_URPFFAILED:
1355                 return (0);
1356         case PF_ADDR_TABLE:
1357                 return (aw1->p.tbl != aw2->p.tbl);
1358         case PF_ADDR_RTLABEL:
1359                 return (aw1->v.rtlabel != aw2->v.rtlabel);
1360         default:
1361                 kprintf("invalid address type: %d\n", aw1->type);
1362                 return (1);
1363         }
1364 }
1365
1366 u_int16_t
1367 pf_cksum_fixup(u_int16_t cksum, u_int16_t old, u_int16_t new, u_int8_t udp)
1368 {
1369         u_int32_t       l;
1370
1371         if (udp && !cksum)
1372                 return (0x0000);
1373         l = cksum + old - new;
1374         l = (l >> 16) + (l & 65535);
1375         l = l & 65535;
1376         if (udp && !l)
1377                 return (0xFFFF);
1378         return (l);
1379 }
1380
1381 void
1382 pf_change_ap(struct pf_addr *a, u_int16_t *p, u_int16_t *ic, u_int16_t *pc,
1383     struct pf_addr *an, u_int16_t pn, u_int8_t u, sa_family_t af)
1384 {
1385         struct pf_addr  ao;
1386         u_int16_t       po = *p;
1387
1388         PF_ACPY(&ao, a, af);
1389         PF_ACPY(a, an, af);
1390
1391         *p = pn;
1392
1393         switch (af) {
1394 #ifdef INET
1395         case AF_INET:
1396                 *ic = pf_cksum_fixup(pf_cksum_fixup(*ic,
1397                     ao.addr16[0], an->addr16[0], 0),
1398                     ao.addr16[1], an->addr16[1], 0);
1399                 *p = pn;
1400                 *pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc,
1401                     ao.addr16[0], an->addr16[0], u),
1402                     ao.addr16[1], an->addr16[1], u),
1403                     po, pn, u);
1404                 break;
1405 #endif /* INET */
1406 #ifdef INET6
1407         case AF_INET6:
1408                 *pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1409                     pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1410                     pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc,
1411                     ao.addr16[0], an->addr16[0], u),
1412                     ao.addr16[1], an->addr16[1], u),
1413                     ao.addr16[2], an->addr16[2], u),
1414                     ao.addr16[3], an->addr16[3], u),
1415                     ao.addr16[4], an->addr16[4], u),
1416                     ao.addr16[5], an->addr16[5], u),
1417                     ao.addr16[6], an->addr16[6], u),
1418                     ao.addr16[7], an->addr16[7], u),
1419                     po, pn, u);
1420                 break;
1421 #endif /* INET6 */
1422         }
1423 }
1424
1425
1426 /* Changes a u_int32_t.  Uses a void * so there are no align restrictions */
1427 void
1428 pf_change_a(void *a, u_int16_t *c, u_int32_t an, u_int8_t u)
1429 {
1430         u_int32_t       ao;
1431
1432         memcpy(&ao, a, sizeof(ao));
1433         memcpy(a, &an, sizeof(u_int32_t));
1434         *c = pf_cksum_fixup(pf_cksum_fixup(*c, ao / 65536, an / 65536, u),
1435             ao % 65536, an % 65536, u);
1436 }
1437
1438 #ifdef INET6
1439 void
1440 pf_change_a6(struct pf_addr *a, u_int16_t *c, struct pf_addr *an, u_int8_t u)
1441 {
1442         struct pf_addr  ao;
1443
1444         PF_ACPY(&ao, a, AF_INET6);
1445         PF_ACPY(a, an, AF_INET6);
1446
1447         *c = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1448             pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1449             pf_cksum_fixup(pf_cksum_fixup(*c,
1450             ao.addr16[0], an->addr16[0], u),
1451             ao.addr16[1], an->addr16[1], u),
1452             ao.addr16[2], an->addr16[2], u),
1453             ao.addr16[3], an->addr16[3], u),
1454             ao.addr16[4], an->addr16[4], u),
1455             ao.addr16[5], an->addr16[5], u),
1456             ao.addr16[6], an->addr16[6], u),
1457             ao.addr16[7], an->addr16[7], u);
1458 }
1459 #endif /* INET6 */
1460
1461 void
1462 pf_change_icmp(struct pf_addr *ia, u_int16_t *ip, struct pf_addr *oa,
1463     struct pf_addr *na, u_int16_t np, u_int16_t *pc, u_int16_t *h2c,
1464     u_int16_t *ic, u_int16_t *hc, u_int8_t u, sa_family_t af)
1465 {
1466         struct pf_addr  oia, ooa;
1467
1468         PF_ACPY(&oia, ia, af);
1469         PF_ACPY(&ooa, oa, af);
1470
1471         /* Change inner protocol port, fix inner protocol checksum. */
1472         if (ip != NULL) {
1473                 u_int16_t       oip = *ip;
1474                 u_int32_t       opc = 0;
1475
1476                 if (pc != NULL)
1477                         opc = *pc;
1478                 *ip = np;
1479                 if (pc != NULL)
1480                         *pc = pf_cksum_fixup(*pc, oip, *ip, u);
1481                 *ic = pf_cksum_fixup(*ic, oip, *ip, 0);
1482                 if (pc != NULL)
1483                         *ic = pf_cksum_fixup(*ic, opc, *pc, 0);
1484         }
1485         /* Change inner ip address, fix inner ip and icmp checksums. */
1486         PF_ACPY(ia, na, af);
1487         switch (af) {
1488 #ifdef INET
1489         case AF_INET: {
1490                 u_int32_t        oh2c = *h2c;
1491
1492                 *h2c = pf_cksum_fixup(pf_cksum_fixup(*h2c,
1493                     oia.addr16[0], ia->addr16[0], 0),
1494                     oia.addr16[1], ia->addr16[1], 0);
1495                 *ic = pf_cksum_fixup(pf_cksum_fixup(*ic,
1496                     oia.addr16[0], ia->addr16[0], 0),
1497                     oia.addr16[1], ia->addr16[1], 0);
1498                 *ic = pf_cksum_fixup(*ic, oh2c, *h2c, 0);
1499                 break;
1500         }
1501 #endif /* INET */
1502 #ifdef INET6
1503         case AF_INET6:
1504                 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1505                     pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1506                     pf_cksum_fixup(pf_cksum_fixup(*ic,
1507                     oia.addr16[0], ia->addr16[0], u),
1508                     oia.addr16[1], ia->addr16[1], u),
1509                     oia.addr16[2], ia->addr16[2], u),
1510                     oia.addr16[3], ia->addr16[3], u),
1511                     oia.addr16[4], ia->addr16[4], u),
1512                     oia.addr16[5], ia->addr16[5], u),
1513                     oia.addr16[6], ia->addr16[6], u),
1514                     oia.addr16[7], ia->addr16[7], u);
1515                 break;
1516 #endif /* INET6 */
1517         }
1518         /* Change outer ip address, fix outer ip or icmpv6 checksum. */
1519         PF_ACPY(oa, na, af);
1520         switch (af) {
1521 #ifdef INET
1522         case AF_INET:
1523                 *hc = pf_cksum_fixup(pf_cksum_fixup(*hc,
1524                     ooa.addr16[0], oa->addr16[0], 0),
1525                     ooa.addr16[1], oa->addr16[1], 0);
1526                 break;
1527 #endif /* INET */
1528 #ifdef INET6
1529         case AF_INET6:
1530                 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1531                     pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1532                     pf_cksum_fixup(pf_cksum_fixup(*ic,
1533                     ooa.addr16[0], oa->addr16[0], u),
1534                     ooa.addr16[1], oa->addr16[1], u),
1535                     ooa.addr16[2], oa->addr16[2], u),
1536                     ooa.addr16[3], oa->addr16[3], u),
1537                     ooa.addr16[4], oa->addr16[4], u),
1538                     ooa.addr16[5], oa->addr16[5], u),
1539                     ooa.addr16[6], oa->addr16[6], u),
1540                     ooa.addr16[7], oa->addr16[7], u);
1541                 break;
1542 #endif /* INET6 */
1543         }
1544 }
1545
1546
1547 /*
1548  * Need to modulate the sequence numbers in the TCP SACK option
1549  * (credits to Krzysztof Pfaff for report and patch)
1550  */
1551 int
1552 pf_modulate_sack(struct mbuf *m, int off, struct pf_pdesc *pd,
1553     struct tcphdr *th, struct pf_state_peer *dst)
1554 {
1555         int hlen = (th->th_off << 2) - sizeof(*th), thoptlen = hlen;
1556         u_int8_t opts[TCP_MAXOLEN], *opt = opts;
1557         int copyback = 0, i, olen;
1558         struct raw_sackblock sack;
1559
1560 #define TCPOLEN_SACKLEN (TCPOLEN_SACK + 2)
1561         if (hlen < TCPOLEN_SACKLEN ||
1562             !pf_pull_hdr(m, off + sizeof(*th), opts, hlen, NULL, NULL, pd->af))
1563                 return 0;
1564
1565         while (hlen >= TCPOLEN_SACKLEN) {
1566                 olen = opt[1];
1567                 switch (*opt) {
1568                 case TCPOPT_EOL:        /* FALLTHROUGH */
1569                 case TCPOPT_NOP:
1570                         opt++;
1571                         hlen--;
1572                         break;
1573                 case TCPOPT_SACK:
1574                         if (olen > hlen)
1575                                 olen = hlen;
1576                         if (olen >= TCPOLEN_SACKLEN) {
1577                                 for (i = 2; i + TCPOLEN_SACK <= olen;
1578                                     i += TCPOLEN_SACK) {
1579                                         memcpy(&sack, &opt[i], sizeof(sack));
1580                                         pf_change_a(&sack.rblk_start, &th->th_sum,
1581                                             htonl(ntohl(sack.rblk_start) -
1582                                             dst->seqdiff), 0);
1583                                         pf_change_a(&sack.rblk_end, &th->th_sum,
1584                                             htonl(ntohl(sack.rblk_end) -
1585                                             dst->seqdiff), 0);
1586                                         memcpy(&opt[i], &sack, sizeof(sack));
1587                                 }
1588                                 copyback = 1;
1589                         }
1590                         /* FALLTHROUGH */
1591                 default:
1592                         if (olen < 2)
1593                                 olen = 2;
1594                         hlen -= olen;
1595                         opt += olen;
1596                 }
1597         }
1598
1599         if (copyback)
1600                 m_copyback(m, off + sizeof(*th), thoptlen, opts);
1601         return (copyback);
1602 }
1603
1604 void
1605 pf_send_tcp(const struct pf_rule *r, sa_family_t af,
1606     const struct pf_addr *saddr, const struct pf_addr *daddr,
1607     u_int16_t sport, u_int16_t dport, u_int32_t seq, u_int32_t ack,
1608     u_int8_t flags, u_int16_t win, u_int16_t mss, u_int8_t ttl, int tag,
1609     u_int16_t rtag, struct ether_header *eh, struct ifnet *ifp)
1610 {
1611         struct mbuf     *m;
1612         int              len = 0, tlen;
1613 #ifdef INET
1614         struct ip       *h = NULL;
1615 #endif /* INET */
1616 #ifdef INET6
1617         struct ip6_hdr  *h6 = NULL;
1618 #endif /* INET6 */
1619         struct tcphdr   *th = NULL;
1620         char            *opt;
1621         struct pf_mtag  *pf_mtag;
1622
1623         /* maximum segment size tcp option */
1624         tlen = sizeof(struct tcphdr);
1625         if (mss)
1626                 tlen += 4;
1627
1628         switch (af) {
1629 #ifdef INET
1630         case AF_INET:
1631                 len = sizeof(struct ip) + tlen;
1632                 break;
1633 #endif /* INET */
1634 #ifdef INET6
1635         case AF_INET6:
1636                 len = sizeof(struct ip6_hdr) + tlen;
1637                 break;
1638 #endif /* INET6 */
1639         }
1640
1641         /* create outgoing mbuf */
1642         m = m_gethdr(MB_DONTWAIT, MT_HEADER);
1643         if (m == NULL)
1644                 return;
1645         if ((pf_mtag = pf_get_mtag(m)) == NULL) {
1646                 m_freem(m);
1647                 return;
1648         }
1649         if (tag)
1650                 pf_mtag->flags |= PF_TAG_GENERATED;
1651
1652         pf_mtag->tag = rtag;
1653
1654         if (r != NULL && r->rtableid >= 0)
1655                 pf_mtag->rtableid = r->rtableid;
1656
1657 #ifdef ALTQ
1658         if (r != NULL && r->qid) {
1659                 pf_mtag->qid = r->qid;
1660                 /* add hints for ecn */
1661                 pf_mtag->af = af;
1662                 pf_mtag->hdr = mtod(m, struct ip *);
1663         }
1664 #endif /* ALTQ */
1665         m->m_data += max_linkhdr;
1666         m->m_pkthdr.len = m->m_len = len;
1667         m->m_pkthdr.rcvif = NULL;
1668         bzero(m->m_data, len);
1669         switch (af) {
1670 #ifdef INET
1671         case AF_INET:
1672                 h = mtod(m, struct ip *);
1673
1674                 /* IP header fields included in the TCP checksum */
1675                 h->ip_p = IPPROTO_TCP;
1676                 h->ip_len = tlen;
1677                 h->ip_src.s_addr = saddr->v4.s_addr;
1678                 h->ip_dst.s_addr = daddr->v4.s_addr;
1679
1680                 th = (struct tcphdr *)((caddr_t)h + sizeof(struct ip));
1681                 break;
1682 #endif /* INET */
1683 #ifdef INET6
1684         case AF_INET6:
1685                 h6 = mtod(m, struct ip6_hdr *);
1686
1687                 /* IP header fields included in the TCP checksum */
1688                 h6->ip6_nxt = IPPROTO_TCP;
1689                 h6->ip6_plen = htons(tlen);
1690                 memcpy(&h6->ip6_src, &saddr->v6, sizeof(struct in6_addr));
1691                 memcpy(&h6->ip6_dst, &daddr->v6, sizeof(struct in6_addr));
1692
1693                 th = (struct tcphdr *)((caddr_t)h6 + sizeof(struct ip6_hdr));
1694                 break;
1695 #endif /* INET6 */
1696         }
1697
1698         /* TCP header */
1699         th->th_sport = sport;
1700         th->th_dport = dport;
1701         th->th_seq = htonl(seq);
1702         th->th_ack = htonl(ack);
1703         th->th_off = tlen >> 2;
1704         th->th_flags = flags;
1705         th->th_win = htons(win);
1706
1707         if (mss) {
1708                 opt = (char *)(th + 1);
1709                 opt[0] = TCPOPT_MAXSEG;
1710                 opt[1] = 4;
1711                 mss = htons(mss);
1712                 bcopy((caddr_t)&mss, (caddr_t)(opt + 2), 2);
1713         }
1714
1715         switch (af) {
1716 #ifdef INET
1717         case AF_INET:
1718                 /* TCP checksum */
1719                 th->th_sum = in_cksum(m, len);
1720
1721                 /* Finish the IP header */
1722                 h->ip_v = 4;
1723                 h->ip_hl = sizeof(*h) >> 2;
1724                 h->ip_tos = IPTOS_LOWDELAY;
1725                 h->ip_len = len;
1726                 h->ip_off = path_mtu_discovery ? IP_DF : 0;
1727                 h->ip_ttl = ttl ? ttl : ip_defttl;
1728                 h->ip_sum = 0;
1729                 if (eh == NULL) {
1730                         ip_output(m, NULL, NULL, 0, NULL, NULL);
1731                 } else {
1732                         struct route             ro;
1733                         struct rtentry           rt;
1734                         struct ether_header     *e = (void *)ro.ro_dst.sa_data;
1735
1736                         if (ifp == NULL) {
1737                                 m_freem(m);
1738                                 return;
1739                         }
1740                         rt.rt_ifp = ifp;
1741                         ro.ro_rt = &rt;
1742                         ro.ro_dst.sa_len = sizeof(ro.ro_dst);
1743                         ro.ro_dst.sa_family = pseudo_AF_HDRCMPLT;
1744                         bcopy(eh->ether_dhost, e->ether_shost, ETHER_ADDR_LEN);
1745                         bcopy(eh->ether_shost, e->ether_dhost, ETHER_ADDR_LEN);
1746                         e->ether_type = eh->ether_type;
1747                         /* XXX_IMPORT: later */
1748                         ip_output(m, (void *)NULL, &ro, 0,
1749                             (void *)NULL, (void *)NULL);
1750                 }
1751                 break;
1752 #endif /* INET */
1753 #ifdef INET6
1754         case AF_INET6:
1755                 /* TCP checksum */
1756                 th->th_sum = in6_cksum(m, IPPROTO_TCP,
1757                     sizeof(struct ip6_hdr), tlen);
1758
1759                 h6->ip6_vfc |= IPV6_VERSION;
1760                 h6->ip6_hlim = IPV6_DEFHLIM;
1761
1762                 ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL);
1763                 break;
1764 #endif /* INET6 */
1765         }
1766 }
1767
1768 void
1769 pf_send_icmp(struct mbuf *m, u_int8_t type, u_int8_t code, sa_family_t af,
1770     struct pf_rule *r)
1771 {
1772         struct pf_mtag  *pf_mtag;
1773         struct mbuf     *m0;
1774
1775         m0 = m_copy(m, 0, M_COPYALL);
1776
1777         if ((pf_mtag = pf_get_mtag(m0)) == NULL)
1778                 return;
1779         pf_mtag->flags |= PF_TAG_GENERATED;
1780
1781         if (r->rtableid >= 0)
1782                 pf_mtag->rtableid = r->rtableid;
1783
1784 #ifdef ALTQ
1785         if (r->qid) {
1786                 pf_mtag->qid = r->qid;
1787                 /* add hints for ecn */
1788                 pf_mtag->af = af;
1789                 pf_mtag->hdr = mtod(m0, struct ip *);
1790         }
1791 #endif /* ALTQ */
1792
1793         switch (af) {
1794 #ifdef INET
1795         case AF_INET:
1796                 icmp_error(m0, type, code, 0, 0);
1797                 break;
1798 #endif /* INET */
1799 #ifdef INET6
1800         case AF_INET6:
1801                 icmp6_error(m0, type, code, 0);
1802                 break;
1803 #endif /* INET6 */
1804         }
1805 }
1806
1807 /*
1808  * Return 1 if the addresses a and b match (with mask m), otherwise return 0.
1809  * If n is 0, they match if they are equal. If n is != 0, they match if they
1810  * are different.
1811  */
1812 int
1813 pf_match_addr(u_int8_t n, struct pf_addr *a, struct pf_addr *m,
1814     struct pf_addr *b, sa_family_t af)
1815 {
1816         int     match = 0;
1817
1818         switch (af) {
1819 #ifdef INET
1820         case AF_INET:
1821                 if ((a->addr32[0] & m->addr32[0]) ==
1822                     (b->addr32[0] & m->addr32[0]))
1823                         match++;
1824                 break;
1825 #endif /* INET */
1826 #ifdef INET6
1827         case AF_INET6:
1828                 if (((a->addr32[0] & m->addr32[0]) ==
1829                      (b->addr32[0] & m->addr32[0])) &&
1830                     ((a->addr32[1] & m->addr32[1]) ==
1831                      (b->addr32[1] & m->addr32[1])) &&
1832                     ((a->addr32[2] & m->addr32[2]) ==
1833                      (b->addr32[2] & m->addr32[2])) &&
1834                     ((a->addr32[3] & m->addr32[3]) ==
1835                      (b->addr32[3] & m->addr32[3])))
1836                         match++;
1837                 break;
1838 #endif /* INET6 */
1839         }
1840         if (match) {
1841                 if (n)
1842                         return (0);
1843                 else
1844                         return (1);
1845         } else {
1846                 if (n)
1847                         return (1);
1848                 else
1849                         return (0);
1850         }
1851 }
1852
1853 int
1854 pf_match(u_int8_t op, u_int32_t a1, u_int32_t a2, u_int32_t p)
1855 {
1856         switch (op) {
1857         case PF_OP_IRG:
1858                 return ((p > a1) && (p < a2));
1859         case PF_OP_XRG:
1860                 return ((p < a1) || (p > a2));
1861         case PF_OP_RRG:
1862                 return ((p >= a1) && (p <= a2));
1863         case PF_OP_EQ:
1864                 return (p == a1);
1865         case PF_OP_NE:
1866                 return (p != a1);
1867         case PF_OP_LT:
1868                 return (p < a1);
1869         case PF_OP_LE:
1870                 return (p <= a1);
1871         case PF_OP_GT:
1872                 return (p > a1);
1873         case PF_OP_GE:
1874                 return (p >= a1);
1875         }
1876         return (0); /* never reached */
1877 }
1878
1879 int
1880 pf_match_port(u_int8_t op, u_int16_t a1, u_int16_t a2, u_int16_t p)
1881 {
1882         a1 = ntohs(a1);
1883         a2 = ntohs(a2);
1884         p = ntohs(p);
1885         return (pf_match(op, a1, a2, p));
1886 }
1887
1888 int
1889 pf_match_uid(u_int8_t op, uid_t a1, uid_t a2, uid_t u)
1890 {
1891         if (u == UID_MAX && op != PF_OP_EQ && op != PF_OP_NE)
1892                 return (0);
1893         return (pf_match(op, a1, a2, u));
1894 }
1895
1896 int
1897 pf_match_gid(u_int8_t op, gid_t a1, gid_t a2, gid_t g)
1898 {
1899         if (g == GID_MAX && op != PF_OP_EQ && op != PF_OP_NE)
1900                 return (0);
1901         return (pf_match(op, a1, a2, g));
1902 }
1903
1904 struct pf_mtag *
1905 pf_find_mtag(struct mbuf *m)
1906 {
1907         struct m_tag    *mtag;
1908
1909         if ((mtag = m_tag_find(m, PF_MBUF_TAGGED, NULL)) == NULL)
1910                 return (NULL);
1911
1912         return ((struct pf_mtag *)(mtag + 1));
1913 }
1914
1915 struct pf_mtag *
1916 pf_get_mtag(struct mbuf *m)
1917 {
1918         struct m_tag    *mtag;
1919
1920         if ((mtag = m_tag_find(m, PF_MBUF_TAGGED, NULL)) == NULL) {
1921                 mtag = m_tag_get(PF_MBUF_TAGGED, sizeof(struct pf_mtag),
1922                     M_NOWAIT);
1923                 if (mtag == NULL)
1924                         return (NULL);
1925                 bzero(mtag + 1, sizeof(struct pf_mtag));
1926                 m_tag_prepend(m, mtag);
1927         }
1928
1929         return ((struct pf_mtag *)(mtag + 1));
1930 }
1931
1932 int
1933 pf_match_tag(struct mbuf *m, struct pf_rule *r, struct pf_mtag *pf_mtag,
1934     int *tag)
1935 {
1936         if (*tag == -1)
1937                 *tag = pf_mtag->tag;
1938
1939         return ((!r->match_tag_not && r->match_tag == *tag) ||
1940             (r->match_tag_not && r->match_tag != *tag));
1941 }
1942
1943 int
1944 pf_tag_packet(struct mbuf *m, struct pf_mtag *pf_mtag, int tag, int rtableid)
1945 {
1946         if (tag <= 0 && rtableid < 0)
1947                 return (0);
1948
1949         if (pf_mtag == NULL)
1950                 if ((pf_mtag = pf_get_mtag(m)) == NULL)
1951                         return (1);
1952         if (tag > 0)
1953                 pf_mtag->tag = tag;
1954         if (rtableid >= 0)
1955                 pf_mtag->rtableid = rtableid;
1956
1957         return (0);
1958 }
1959
1960 static void
1961 pf_step_into_anchor(int *depth, struct pf_ruleset **rs, int n,
1962     struct pf_rule **r, struct pf_rule **a,  int *match)
1963 {
1964         struct pf_anchor_stackframe     *f;
1965
1966         (*r)->anchor->match = 0;
1967         if (match)
1968                 *match = 0;
1969         if (*depth >= sizeof(pf_anchor_stack) /
1970             sizeof(pf_anchor_stack[0])) {
1971                 kprintf("pf_step_into_anchor: stack overflow\n");
1972                 *r = TAILQ_NEXT(*r, entries);
1973                 return;
1974         } else if (*depth == 0 && a != NULL)
1975                 *a = *r;
1976         f = pf_anchor_stack + (*depth)++;
1977         f->rs = *rs;
1978         f->r = *r;
1979         if ((*r)->anchor_wildcard) {
1980                 f->parent = &(*r)->anchor->children;
1981                 if ((f->child = RB_MIN(pf_anchor_node, f->parent)) ==
1982                     NULL) {
1983                         *r = NULL;
1984                         return;
1985                 }
1986                 *rs = &f->child->ruleset;
1987         } else {
1988                 f->parent = NULL;
1989                 f->child = NULL;
1990                 *rs = &(*r)->anchor->ruleset;
1991         }
1992         *r = TAILQ_FIRST((*rs)->rules[n].active.ptr);
1993 }
1994
1995 int
1996 pf_step_out_of_anchor(int *depth, struct pf_ruleset **rs, int n,
1997     struct pf_rule **r, struct pf_rule **a, int *match)
1998 {
1999         struct pf_anchor_stackframe     *f;
2000         int quick = 0;
2001
2002         do {
2003                 if (*depth <= 0)
2004                         break;
2005                 f = pf_anchor_stack + *depth - 1;
2006                 if (f->parent != NULL && f->child != NULL) {
2007                         if (f->child->match ||
2008                             (match != NULL && *match)) {
2009                                 f->r->anchor->match = 1;
2010                                 *match = 0;
2011                         }
2012                         f->child = RB_NEXT(pf_anchor_node, f->parent, f->child);
2013                         if (f->child != NULL) {
2014                                 *rs = &f->child->ruleset;
2015                                 *r = TAILQ_FIRST((*rs)->rules[n].active.ptr);
2016                                 if (*r == NULL)
2017                                         continue;
2018                                 else
2019                                         break;
2020                         }
2021                 }
2022                 (*depth)--;
2023                 if (*depth == 0 && a != NULL)
2024                         *a = NULL;
2025                 *rs = f->rs;
2026                 if (f->r->anchor->match || (match  != NULL && *match))
2027                         quick = f->r->quick;
2028                 *r = TAILQ_NEXT(f->r, entries);
2029         } while (*r == NULL);
2030
2031         return (quick);
2032 }
2033
2034 #ifdef INET6
2035 void
2036 pf_poolmask(struct pf_addr *naddr, struct pf_addr *raddr,
2037     struct pf_addr *rmask, struct pf_addr *saddr, sa_family_t af)
2038 {
2039         switch (af) {
2040 #ifdef INET
2041         case AF_INET:
2042                 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) |
2043                 ((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]);
2044                 break;
2045 #endif /* INET */
2046         case AF_INET6:
2047                 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) |
2048                 ((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]);
2049                 naddr->addr32[1] = (raddr->addr32[1] & rmask->addr32[1]) |
2050                 ((rmask->addr32[1] ^ 0xffffffff ) & saddr->addr32[1]);
2051                 naddr->addr32[2] = (raddr->addr32[2] & rmask->addr32[2]) |
2052                 ((rmask->addr32[2] ^ 0xffffffff ) & saddr->addr32[2]);
2053                 naddr->addr32[3] = (raddr->addr32[3] & rmask->addr32[3]) |
2054                 ((rmask->addr32[3] ^ 0xffffffff ) & saddr->addr32[3]);
2055                 break;
2056         }
2057 }
2058
2059 void
2060 pf_addr_inc(struct pf_addr *addr, sa_family_t af)
2061 {
2062         switch (af) {
2063 #ifdef INET
2064         case AF_INET:
2065                 addr->addr32[0] = htonl(ntohl(addr->addr32[0]) + 1);
2066                 break;
2067 #endif /* INET */
2068         case AF_INET6:
2069                 if (addr->addr32[3] == 0xffffffff) {
2070                         addr->addr32[3] = 0;
2071                         if (addr->addr32[2] == 0xffffffff) {
2072                                 addr->addr32[2] = 0;
2073                                 if (addr->addr32[1] == 0xffffffff) {
2074                                         addr->addr32[1] = 0;
2075                                         addr->addr32[0] =
2076                                             htonl(ntohl(addr->addr32[0]) + 1);
2077                                 } else
2078                                         addr->addr32[1] =
2079                                             htonl(ntohl(addr->addr32[1]) + 1);
2080                         } else
2081                                 addr->addr32[2] =
2082                                     htonl(ntohl(addr->addr32[2]) + 1);
2083                 } else
2084                         addr->addr32[3] =
2085                             htonl(ntohl(addr->addr32[3]) + 1);
2086                 break;
2087         }
2088 }
2089 #endif /* INET6 */
2090
2091 #define mix(a,b,c) \
2092         do {                                    \
2093                 a -= b; a -= c; a ^= (c >> 13); \
2094                 b -= c; b -= a; b ^= (a << 8);  \
2095                 c -= a; c -= b; c ^= (b >> 13); \
2096                 a -= b; a -= c; a ^= (c >> 12); \
2097                 b -= c; b -= a; b ^= (a << 16); \
2098                 c -= a; c -= b; c ^= (b >> 5);  \
2099                 a -= b; a -= c; a ^= (c >> 3);  \
2100                 b -= c; b -= a; b ^= (a << 10); \
2101                 c -= a; c -= b; c ^= (b >> 15); \
2102         } while (0)
2103
2104 /*
2105  * hash function based on bridge_hash in if_bridge.c
2106  */
2107 void
2108 pf_hash(struct pf_addr *inaddr, struct pf_addr *hash,
2109     struct pf_poolhashkey *key, sa_family_t af)
2110 {
2111         u_int32_t       a = 0x9e3779b9, b = 0x9e3779b9, c = key->key32[0];
2112
2113         switch (af) {
2114 #ifdef INET
2115         case AF_INET:
2116                 a += inaddr->addr32[0];
2117                 b += key->key32[1];
2118                 mix(a, b, c);
2119                 hash->addr32[0] = c + key->key32[2];
2120                 break;
2121 #endif /* INET */
2122 #ifdef INET6
2123         case AF_INET6:
2124                 a += inaddr->addr32[0];
2125                 b += inaddr->addr32[2];
2126                 mix(a, b, c);
2127                 hash->addr32[0] = c;
2128                 a += inaddr->addr32[1];
2129                 b += inaddr->addr32[3];
2130                 c += key->key32[1];
2131                 mix(a, b, c);
2132                 hash->addr32[1] = c;
2133                 a += inaddr->addr32[2];
2134                 b += inaddr->addr32[1];
2135                 c += key->key32[2];
2136                 mix(a, b, c);
2137                 hash->addr32[2] = c;
2138                 a += inaddr->addr32[3];
2139                 b += inaddr->addr32[0];
2140                 c += key->key32[3];
2141                 mix(a, b, c);
2142                 hash->addr32[3] = c;
2143                 break;
2144 #endif /* INET6 */
2145         }
2146 }
2147
2148 int
2149 pf_map_addr(sa_family_t af, struct pf_rule *r, struct pf_addr *saddr,
2150     struct pf_addr *naddr, struct pf_addr *init_addr, struct pf_src_node **sn)
2151 {
2152         unsigned char            hash[16];
2153         struct pf_pool          *rpool = &r->rpool;
2154         struct pf_addr          *raddr = &rpool->cur->addr.v.a.addr;
2155         struct pf_addr          *rmask = &rpool->cur->addr.v.a.mask;
2156         struct pf_pooladdr      *acur = rpool->cur;
2157         struct pf_src_node       k;
2158
2159         if (*sn == NULL && r->rpool.opts & PF_POOL_STICKYADDR &&
2160             (r->rpool.opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) {
2161                 k.af = af;
2162                 PF_ACPY(&k.addr, saddr, af);
2163                 if (r->rule_flag & PFRULE_RULESRCTRACK ||
2164                     r->rpool.opts & PF_POOL_STICKYADDR)
2165                         k.rule.ptr = r;
2166                 else
2167                         k.rule.ptr = NULL;
2168                 pf_status.scounters[SCNT_SRC_NODE_SEARCH]++;
2169                 *sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k);
2170                 if (*sn != NULL && !PF_AZERO(&(*sn)->raddr, af)) {
2171                         PF_ACPY(naddr, &(*sn)->raddr, af);
2172                         if (pf_status.debug >= PF_DEBUG_MISC) {
2173                                 kprintf("pf_map_addr: src tracking maps ");
2174                                 pf_print_host(&k.addr, 0, af);
2175                                 kprintf(" to ");
2176                                 pf_print_host(naddr, 0, af);
2177                                 kprintf("\n");
2178                         }
2179                         return (0);
2180                 }
2181         }
2182
2183         if (rpool->cur->addr.type == PF_ADDR_NOROUTE)
2184                 return (1);
2185         if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
2186                 switch (af) {
2187 #ifdef INET
2188                 case AF_INET:
2189                         if (rpool->cur->addr.p.dyn->pfid_acnt4 < 1 &&
2190                             (rpool->opts & PF_POOL_TYPEMASK) !=
2191                             PF_POOL_ROUNDROBIN)
2192                                 return (1);
2193                          raddr = &rpool->cur->addr.p.dyn->pfid_addr4;
2194                          rmask = &rpool->cur->addr.p.dyn->pfid_mask4;
2195                         break;
2196 #endif /* INET */
2197 #ifdef INET6
2198                 case AF_INET6:
2199                         if (rpool->cur->addr.p.dyn->pfid_acnt6 < 1 &&
2200                             (rpool->opts & PF_POOL_TYPEMASK) !=
2201                             PF_POOL_ROUNDROBIN)
2202                                 return (1);
2203                         raddr = &rpool->cur->addr.p.dyn->pfid_addr6;
2204                         rmask = &rpool->cur->addr.p.dyn->pfid_mask6;
2205                         break;
2206 #endif /* INET6 */
2207                 }
2208         } else if (rpool->cur->addr.type == PF_ADDR_TABLE) {
2209                 if ((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN)
2210                         return (1); /* unsupported */
2211         } else {
2212                 raddr = &rpool->cur->addr.v.a.addr;
2213                 rmask = &rpool->cur->addr.v.a.mask;
2214         }
2215
2216         switch (rpool->opts & PF_POOL_TYPEMASK) {
2217         case PF_POOL_NONE:
2218                 PF_ACPY(naddr, raddr, af);
2219                 break;
2220         case PF_POOL_BITMASK:
2221                 PF_POOLMASK(naddr, raddr, rmask, saddr, af);
2222                 break;
2223         case PF_POOL_RANDOM:
2224                 if (init_addr != NULL && PF_AZERO(init_addr, af)) {
2225                         switch (af) {
2226 #ifdef INET
2227                         case AF_INET:
2228                                 rpool->counter.addr32[0] = htonl(karc4random());
2229                                 break;
2230 #endif /* INET */
2231 #ifdef INET6
2232                         case AF_INET6:
2233                                 if (rmask->addr32[3] != 0xffffffff)
2234                                         rpool->counter.addr32[3] =
2235                                             htonl(karc4random());
2236                                 else
2237                                         break;
2238                                 if (rmask->addr32[2] != 0xffffffff)
2239                                         rpool->counter.addr32[2] =
2240                                             htonl(karc4random());
2241                                 else
2242                                         break;
2243                                 if (rmask->addr32[1] != 0xffffffff)
2244                                         rpool->counter.addr32[1] =
2245                                             htonl(karc4random());
2246                                 else
2247                                         break;
2248                                 if (rmask->addr32[0] != 0xffffffff)
2249                                         rpool->counter.addr32[0] =
2250                                             htonl(karc4random());
2251                                 break;
2252 #endif /* INET6 */
2253                         }
2254                         PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af);
2255                         PF_ACPY(init_addr, naddr, af);
2256
2257                 } else {
2258                         PF_AINC(&rpool->counter, af);
2259                         PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af);
2260                 }
2261                 break;
2262         case PF_POOL_SRCHASH:
2263                 pf_hash(saddr, (struct pf_addr *)&hash, &rpool->key, af);
2264                 PF_POOLMASK(naddr, raddr, rmask, (struct pf_addr *)&hash, af);
2265                 break;
2266         case PF_POOL_ROUNDROBIN:
2267                 if (rpool->cur->addr.type == PF_ADDR_TABLE) {
2268                         if (!pfr_pool_get(rpool->cur->addr.p.tbl,
2269                             &rpool->tblidx, &rpool->counter,
2270                             &raddr, &rmask, af))
2271                                 goto get_addr;
2272                 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
2273                         if (!pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
2274                             &rpool->tblidx, &rpool->counter,
2275                             &raddr, &rmask, af))
2276                                 goto get_addr;
2277                 } else if (pf_match_addr(0, raddr, rmask, &rpool->counter, af))
2278                         goto get_addr;
2279
2280         try_next:
2281                 if ((rpool->cur = TAILQ_NEXT(rpool->cur, entries)) == NULL)
2282                         rpool->cur = TAILQ_FIRST(&rpool->list);
2283                 if (rpool->cur->addr.type == PF_ADDR_TABLE) {
2284                         rpool->tblidx = -1;
2285                         if (pfr_pool_get(rpool->cur->addr.p.tbl,
2286                             &rpool->tblidx, &rpool->counter,
2287                             &raddr, &rmask, af)) {
2288                                 /* table contains no address of type 'af' */
2289                                 if (rpool->cur != acur)
2290                                         goto try_next;
2291                                 return (1);
2292                         }
2293                 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
2294                         rpool->tblidx = -1;
2295                         if (pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
2296                             &rpool->tblidx, &rpool->counter,
2297                             &raddr, &rmask, af)) {
2298                                 /* table contains no address of type 'af' */
2299                                 if (rpool->cur != acur)
2300                                         goto try_next;
2301                                 return (1);
2302                         }
2303                 } else {
2304                         raddr = &rpool->cur->addr.v.a.addr;
2305                         rmask = &rpool->cur->addr.v.a.mask;
2306                         PF_ACPY(&rpool->counter, raddr, af);
2307                 }
2308
2309         get_addr:
2310                 PF_ACPY(naddr, &rpool->counter, af);
2311                 if (init_addr != NULL && PF_AZERO(init_addr, af))
2312                         PF_ACPY(init_addr, naddr, af);
2313                 PF_AINC(&rpool->counter, af);
2314                 break;
2315         }
2316         if (*sn != NULL)
2317                 PF_ACPY(&(*sn)->raddr, naddr, af);
2318
2319         if (pf_status.debug >= PF_DEBUG_MISC &&
2320             (rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) {
2321                 kprintf("pf_map_addr: selected address ");
2322                 pf_print_host(naddr, 0, af);
2323                 kprintf("\n");
2324         }
2325
2326         return (0);
2327 }
2328
2329 int
2330 pf_get_sport(sa_family_t af, u_int8_t proto, struct pf_rule *r,
2331     struct pf_addr *saddr, struct pf_addr *daddr, u_int16_t dport,
2332     struct pf_addr *naddr, u_int16_t *nport, u_int16_t low, u_int16_t high,
2333     struct pf_src_node **sn)
2334 {
2335         struct pf_state_cmp     key;
2336         struct pf_addr          init_addr;
2337         u_int16_t               cut;
2338
2339         bzero(&init_addr, sizeof(init_addr));
2340         if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn))
2341                 return (1);
2342
2343         if (proto == IPPROTO_ICMP) {
2344                 low = 1;
2345                 high = 65535;
2346         }
2347
2348         do {
2349                 key.af = af;
2350                 key.proto = proto;
2351                 PF_ACPY(&key.ext.addr, daddr, key.af);
2352                 PF_ACPY(&key.gwy.addr, naddr, key.af);
2353                 key.ext.port = dport;
2354
2355                 /*
2356                  * port search; start random, step;
2357                  * similar 2 portloop in in_pcbbind
2358                  */
2359                 if (!(proto == IPPROTO_TCP || proto == IPPROTO_UDP ||
2360                     proto == IPPROTO_ICMP)) {
2361                         key.gwy.port = dport;
2362                         if (pf_find_state_all(&key, PF_EXT_GWY, NULL) == NULL)
2363                                 return (0);
2364                 } else if (low == 0 && high == 0) {
2365                         key.gwy.port = *nport;
2366                         if (pf_find_state_all(&key, PF_EXT_GWY, NULL) == NULL)
2367                                 return (0);
2368                 } else if (low == high) {
2369                         key.gwy.port = htons(low);
2370                         if (pf_find_state_all(&key, PF_EXT_GWY, NULL) == NULL) {
2371                                 *nport = htons(low);
2372                                 return (0);
2373                         }
2374                 } else {
2375                         u_int16_t tmp;
2376
2377                         if (low > high) {
2378                                 tmp = low;
2379                                 low = high;
2380                                 high = tmp;
2381                         }
2382                         /* low < high */
2383                         cut = htonl(karc4random()) % (1 + high - low) + low;
2384                         /* low <= cut <= high */
2385                         for (tmp = cut; tmp <= high; ++(tmp)) {
2386                                 key.gwy.port = htons(tmp);
2387                                 if (pf_find_state_all(&key, PF_EXT_GWY, NULL) ==
2388                                     NULL) {
2389                                         *nport = htons(tmp);
2390                                         return (0);
2391                                 }
2392                         }
2393                         for (tmp = cut - 1; tmp >= low; --(tmp)) {
2394                                 key.gwy.port = htons(tmp);
2395                                 if (pf_find_state_all(&key, PF_EXT_GWY, NULL) ==
2396                                     NULL) {
2397                                         *nport = htons(tmp);
2398                                         return (0);
2399                                 }
2400                         }
2401                 }
2402
2403                 switch (r->rpool.opts & PF_POOL_TYPEMASK) {
2404                 case PF_POOL_RANDOM:
2405                 case PF_POOL_ROUNDROBIN:
2406                         if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn))
2407                                 return (1);
2408                         break;
2409                 case PF_POOL_NONE:
2410                 case PF_POOL_SRCHASH:
2411                 case PF_POOL_BITMASK:
2412                 default:
2413                         return (1);
2414                 }
2415         } while (! PF_AEQ(&init_addr, naddr, af) );
2416
2417         return (1);                                     /* none available */
2418 }
2419
2420 struct pf_rule *
2421 pf_match_translation(struct pf_pdesc *pd, struct mbuf *m, int off,
2422     int direction, struct pfi_kif *kif, struct pf_addr *saddr, u_int16_t sport,
2423     struct pf_addr *daddr, u_int16_t dport, int rs_num)
2424 {
2425         struct pf_rule          *r, *rm = NULL;
2426         struct pf_ruleset       *ruleset = NULL;
2427         int                      tag = -1;
2428         int                      rtableid = -1;
2429         int                      asd = 0;
2430
2431         r = TAILQ_FIRST(pf_main_ruleset.rules[rs_num].active.ptr);
2432         while (r && rm == NULL) {
2433                 struct pf_rule_addr     *src = NULL, *dst = NULL;
2434                 struct pf_addr_wrap     *xdst = NULL;
2435
2436                 if (r->action == PF_BINAT && direction == PF_IN) {
2437                         src = &r->dst;
2438                         if (r->rpool.cur != NULL)
2439                                 xdst = &r->rpool.cur->addr;
2440                 } else {
2441                         src = &r->src;
2442                         dst = &r->dst;
2443                 }
2444
2445                 r->evaluations++;
2446                 if (pfi_kif_match(r->kif, kif) == r->ifnot)
2447                         r = r->skip[PF_SKIP_IFP].ptr;
2448                 else if (r->direction && r->direction != direction)
2449                         r = r->skip[PF_SKIP_DIR].ptr;
2450                 else if (r->af && r->af != pd->af)
2451                         r = r->skip[PF_SKIP_AF].ptr;
2452                 else if (r->proto && r->proto != pd->proto)
2453                         r = r->skip[PF_SKIP_PROTO].ptr;
2454                 else if (PF_MISMATCHAW(&src->addr, saddr, pd->af,
2455                     src->neg, kif))
2456                         r = r->skip[src == &r->src ? PF_SKIP_SRC_ADDR :
2457                             PF_SKIP_DST_ADDR].ptr;
2458                 else if (src->port_op && !pf_match_port(src->port_op,
2459                     src->port[0], src->port[1], sport))
2460                         r = r->skip[src == &r->src ? PF_SKIP_SRC_PORT :
2461                             PF_SKIP_DST_PORT].ptr;
2462                 else if (dst != NULL &&
2463                     PF_MISMATCHAW(&dst->addr, daddr, pd->af, dst->neg, NULL))
2464                         r = r->skip[PF_SKIP_DST_ADDR].ptr;
2465                 else if (xdst != NULL && PF_MISMATCHAW(xdst, daddr, pd->af,
2466                     0, NULL))
2467                         r = TAILQ_NEXT(r, entries);
2468                 else if (dst != NULL && dst->port_op &&
2469                     !pf_match_port(dst->port_op, dst->port[0],
2470                     dst->port[1], dport))
2471                         r = r->skip[PF_SKIP_DST_PORT].ptr;
2472                 else if (r->match_tag && !pf_match_tag(m, r, pd->pf_mtag, &tag))
2473                         r = TAILQ_NEXT(r, entries);
2474                 else if (r->os_fingerprint != PF_OSFP_ANY && (pd->proto !=
2475                     IPPROTO_TCP || !pf_osfp_match(pf_osfp_fingerprint(pd, m,
2476                     off, pd->hdr.tcp), r->os_fingerprint)))
2477                         r = TAILQ_NEXT(r, entries);
2478                 else {
2479                         if (r->tag)
2480                                 tag = r->tag;
2481                         if (r->rtableid >= 0)
2482                                 rtableid = r->rtableid;
2483                         if (r->anchor == NULL) {
2484                                 rm = r;
2485                         } else
2486                                 pf_step_into_anchor(&asd, &ruleset, rs_num,
2487                                     &r, NULL, NULL);
2488                 }
2489                 if (r == NULL)
2490                         pf_step_out_of_anchor(&asd, &ruleset, rs_num, &r,
2491                             NULL, NULL);
2492         }
2493         if (pf_tag_packet(m, pd->pf_mtag, tag, rtableid))
2494                 return (NULL);
2495         if (rm != NULL && (rm->action == PF_NONAT ||
2496             rm->action == PF_NORDR || rm->action == PF_NOBINAT))
2497                 return (NULL);
2498         return (rm);
2499 }
2500
2501 struct pf_rule *
2502 pf_get_translation(struct pf_pdesc *pd, struct mbuf *m, int off, int direction,
2503     struct pfi_kif *kif, struct pf_src_node **sn,
2504     struct pf_addr *saddr, u_int16_t sport,
2505     struct pf_addr *daddr, u_int16_t dport,
2506     struct pf_addr *naddr, u_int16_t *nport)
2507 {
2508         struct pf_rule  *r = NULL;
2509
2510         if (direction == PF_OUT) {
2511                 r = pf_match_translation(pd, m, off, direction, kif, saddr,
2512                     sport, daddr, dport, PF_RULESET_BINAT);
2513                 if (r == NULL)
2514                         r = pf_match_translation(pd, m, off, direction, kif,
2515                             saddr, sport, daddr, dport, PF_RULESET_NAT);
2516         } else {
2517                 r = pf_match_translation(pd, m, off, direction, kif, saddr,
2518                     sport, daddr, dport, PF_RULESET_RDR);
2519                 if (r == NULL)
2520                         r = pf_match_translation(pd, m, off, direction, kif,
2521                             saddr, sport, daddr, dport, PF_RULESET_BINAT);
2522         }
2523
2524         if (r != NULL) {
2525                 switch (r->action) {
2526                 case PF_NONAT:
2527                 case PF_NOBINAT:
2528                 case PF_NORDR:
2529                         return (NULL);
2530                 case PF_NAT:
2531                         if (pf_get_sport(pd->af, pd->proto, r, saddr,
2532                             daddr, dport, naddr, nport, r->rpool.proxy_port[0],
2533                             r->rpool.proxy_port[1], sn)) {
2534                                 DPFPRINTF(PF_DEBUG_MISC,
2535                                     ("pf: NAT proxy port allocation "
2536                                     "(%u-%u) failed\n",
2537                                     r->rpool.proxy_port[0],
2538                                     r->rpool.proxy_port[1]));
2539                                 return (NULL);
2540                         }
2541                         break;
2542                 case PF_BINAT:
2543                         switch (direction) {
2544                         case PF_OUT:
2545                                 if (r->rpool.cur->addr.type == PF_ADDR_DYNIFTL){
2546                                         switch (pd->af) {
2547 #ifdef INET
2548                                         case AF_INET:
2549                                                 if (r->rpool.cur->addr.p.dyn->
2550                                                     pfid_acnt4 < 1)
2551                                                         return (NULL);
2552                                                 PF_POOLMASK(naddr,
2553                                                     &r->rpool.cur->addr.p.dyn->
2554                                                     pfid_addr4,
2555                                                     &r->rpool.cur->addr.p.dyn->
2556                                                     pfid_mask4,
2557                                                     saddr, AF_INET);
2558                                                 break;
2559 #endif /* INET */
2560 #ifdef INET6
2561                                         case AF_INET6:
2562                                                 if (r->rpool.cur->addr.p.dyn->
2563                                                     pfid_acnt6 < 1)
2564                                                         return (NULL);
2565                                                 PF_POOLMASK(naddr,
2566                                                     &r->rpool.cur->addr.p.dyn->
2567                                                     pfid_addr6,
2568                                                     &r->rpool.cur->addr.p.dyn->
2569                                                     pfid_mask6,
2570                                                     saddr, AF_INET6);
2571                                                 break;
2572 #endif /* INET6 */
2573                                         }
2574                                 } else
2575                                         PF_POOLMASK(naddr,
2576                                             &r->rpool.cur->addr.v.a.addr,
2577                                             &r->rpool.cur->addr.v.a.mask,
2578                                             saddr, pd->af);
2579                                 break;
2580                         case PF_IN:
2581                                 if (r->src.addr.type == PF_ADDR_DYNIFTL) {
2582                                         switch (pd->af) {
2583 #ifdef INET
2584                                         case AF_INET:
2585                                                 if (r->src.addr.p.dyn->
2586                                                     pfid_acnt4 < 1)
2587                                                         return (NULL);
2588                                                 PF_POOLMASK(naddr,
2589                                                     &r->src.addr.p.dyn->
2590                                                     pfid_addr4,
2591                                                     &r->src.addr.p.dyn->
2592                                                     pfid_mask4,
2593                                                     daddr, AF_INET);
2594                                                 break;
2595 #endif /* INET */
2596 #ifdef INET6
2597                                         case AF_INET6:
2598                                                 if (r->src.addr.p.dyn->
2599                                                     pfid_acnt6 < 1)
2600                                                         return (NULL);
2601                                                 PF_POOLMASK(naddr,
2602                                                     &r->src.addr.p.dyn->
2603                                                     pfid_addr6,
2604                                                     &r->src.addr.p.dyn->
2605                                                     pfid_mask6,
2606                                                     daddr, AF_INET6);
2607                                                 break;
2608 #endif /* INET6 */
2609                                         }
2610                                 } else
2611                                         PF_POOLMASK(naddr,
2612                                             &r->src.addr.v.a.addr,
2613                                             &r->src.addr.v.a.mask, daddr,
2614                                             pd->af);
2615                                 break;
2616                         }
2617                         break;
2618                 case PF_RDR: {
2619                         if (pf_map_addr(pd->af, r, saddr, naddr, NULL, sn))
2620                                 return (NULL);
2621                         if ((r->rpool.opts & PF_POOL_TYPEMASK) ==
2622                             PF_POOL_BITMASK)
2623                                 PF_POOLMASK(naddr, naddr,
2624                                     &r->rpool.cur->addr.v.a.mask, daddr,
2625                                     pd->af);
2626                         if (r->rpool.proxy_port[1]) {
2627                                 u_int32_t       tmp_nport;
2628
2629                                 tmp_nport = ((ntohs(dport) -
2630                                     ntohs(r->dst.port[0])) %
2631                                     (r->rpool.proxy_port[1] -
2632                                     r->rpool.proxy_port[0] + 1)) +
2633                                     r->rpool.proxy_port[0];
2634
2635                                 /* wrap around if necessary */
2636                                 if (tmp_nport > 65535)
2637                                         tmp_nport -= 65535;
2638                                 *nport = htons((u_int16_t)tmp_nport);
2639                         } else if (r->rpool.proxy_port[0])
2640                                 *nport = htons(r->rpool.proxy_port[0]);
2641                         break;
2642                 }
2643                 default:
2644                         return (NULL);
2645                 }
2646         }
2647
2648         return (r);
2649 }
2650
2651 #ifdef SMP
2652 struct netmsg_hashlookup {
2653         struct netmsg           nm_netmsg;
2654         struct inpcb            **nm_pinp;
2655         struct inpcbinfo        *nm_pcbinfo;
2656         struct pf_addr          *nm_saddr;
2657         struct pf_addr          *nm_daddr;
2658         uint16_t                nm_sport;
2659         uint16_t                nm_dport;
2660         sa_family_t             nm_af;
2661 };
2662
2663 static void
2664 in_pcblookup_hash_handler(struct netmsg *msg0)
2665 {
2666         struct netmsg_hashlookup *msg = (struct netmsg_hashlookup *)msg0;
2667
2668         if (msg->nm_af == AF_INET)
2669                 *msg->nm_pinp = in_pcblookup_hash(msg->nm_pcbinfo,
2670                     msg->nm_saddr->v4, msg->nm_sport, msg->nm_daddr->v4,
2671                     msg->nm_dport, INPLOOKUP_WILDCARD, NULL);
2672 #ifdef INET6
2673         else
2674                 *msg->nm_pinp = in6_pcblookup_hash(msg->nm_pcbinfo,
2675                     &msg->nm_saddr->v6, msg->nm_sport, &msg->nm_daddr->v6,
2676                     msg->nm_dport, INPLOOKUP_WILDCARD, NULL);
2677 #endif /* INET6 */
2678         lwkt_replymsg(&msg->nm_netmsg.nm_lmsg, 0);
2679 }
2680 #endif /* SMP */
2681
2682 int
2683 pf_socket_lookup(int direction, struct pf_pdesc *pd, struct inpcb *inp_arg)
2684 {
2685         struct pf_addr          *saddr, *daddr;
2686         u_int16_t                sport, dport;
2687         struct inpcbinfo        *pi;
2688         struct inpcb            *inp;
2689 #ifdef SMP
2690         struct netmsg_hashlookup *msg = NULL;
2691 #endif
2692         int                      pi_cpu = 0;
2693
2694         if (pd == NULL)
2695                 return (-1);
2696         pd->lookup.uid = UID_MAX;
2697         pd->lookup.gid = GID_MAX;
2698         pd->lookup.pid = NO_PID;
2699         if (direction == PF_IN) {
2700                 saddr = pd->src;
2701                 daddr = pd->dst;
2702         } else {
2703                 saddr = pd->dst;
2704                 daddr = pd->src;
2705         }
2706         switch (pd->proto) {
2707         case IPPROTO_TCP:
2708                 sport = pd->hdr.tcp->th_sport;
2709                 dport = pd->hdr.tcp->th_dport;
2710
2711                 pi_cpu = tcp_addrcpu(saddr->v4.s_addr, sport, daddr->v4.s_addr, dport);
2712                 pi = &tcbinfo[pi_cpu];
2713 #ifdef SMP
2714                 /*
2715                  * Our netstack runs lockless on MP systems
2716                  * (only for TCP connections at the moment).
2717                  *
2718                  * As we are not allowed to read another CPU's tcbinfo,
2719                  * we have to ask that CPU via remote call to search the
2720                  * table for us.
2721                  *
2722                  * Prepare a msg iff data belongs to another CPU.
2723                  */
2724                 if (pi_cpu != mycpu->gd_cpuid) {
2725                         msg = kmalloc(sizeof(*msg), M_LWKTMSG, M_INTWAIT);
2726                         netmsg_init(&msg->nm_netmsg, NULL, &netisr_afree_rport,
2727                                     0, in_pcblookup_hash_handler);
2728                         msg->nm_pinp = &inp;
2729                         msg->nm_pcbinfo = pi;
2730                         msg->nm_saddr = saddr;
2731                         msg->nm_sport = sport;
2732                         msg->nm_daddr = daddr;
2733                         msg->nm_dport = dport;
2734                         msg->nm_af = pd->af;
2735                 }
2736 #endif /* SMP */
2737                 break;
2738         case IPPROTO_UDP:
2739                 sport = pd->hdr.udp->uh_sport;
2740                 dport = pd->hdr.udp->uh_dport;
2741                 pi = &udbinfo;
2742                 break;
2743         default:
2744                 return (0);
2745         }
2746         if (direction != PF_IN) {
2747                 u_int16_t       p;
2748
2749                 p = sport;
2750                 sport = dport;
2751                 dport = p;
2752         }
2753         switch (pd->af) {
2754 #ifdef INET6
2755         case AF_INET6:
2756 #ifdef SMP
2757                 /*
2758                  * Query other CPU, second part
2759                  *
2760                  * msg only gets initialized when:
2761                  * 1) packet is TCP
2762                  * 2) the info belongs to another CPU
2763                  *
2764                  * Use some switch/case magic to avoid code duplication.
2765                  */
2766                 if (msg == NULL)
2767 #endif /* SMP */
2768                 {
2769                         inp = in6_pcblookup_hash(pi, &saddr->v6, sport,
2770                             &daddr->v6, dport, INPLOOKUP_WILDCARD, NULL);
2771
2772                         if (inp == NULL)
2773                                 return (-1);
2774                         break;
2775                 }
2776                 /* FALLTHROUGH if SMP and on other CPU */
2777 #endif /* INET6 */
2778         case AF_INET:
2779 #ifdef SMP
2780                 if (msg != NULL) {
2781                         lwkt_sendmsg(tcp_cport(pi_cpu),
2782                                      &msg->nm_netmsg.nm_lmsg);
2783                 } else
2784 #endif /* SMP */
2785                 {
2786                         inp = in_pcblookup_hash(pi, saddr->v4, sport, daddr->v4,
2787                             dport, INPLOOKUP_WILDCARD, NULL);
2788                 }
2789                 if (inp == NULL)
2790                         return (0);
2791                 break;
2792
2793         default:
2794                 return (-1);
2795         }
2796         pd->lookup.uid = inp->inp_socket->so_cred->cr_uid;
2797         pd->lookup.gid = inp->inp_socket->so_cred->cr_groups[0];
2798         return (1);
2799 }
2800
2801 u_int8_t
2802 pf_get_wscale(struct mbuf *m, int off, u_int16_t th_off, sa_family_t af)
2803 {
2804         int              hlen;
2805         u_int8_t         hdr[60];
2806         u_int8_t        *opt, optlen;
2807         u_int8_t         wscale = 0;
2808
2809         hlen = th_off << 2;             /* hlen <= sizeof(hdr) */
2810         if (hlen <= sizeof(struct tcphdr))
2811                 return (0);
2812         if (!pf_pull_hdr(m, off, hdr, hlen, NULL, NULL, af))
2813                 return (0);
2814         opt = hdr + sizeof(struct tcphdr);
2815         hlen -= sizeof(struct tcphdr);
2816         while (hlen >= 3) {
2817                 switch (*opt) {
2818                 case TCPOPT_EOL:
2819                 case TCPOPT_NOP:
2820                         ++opt;
2821                         --hlen;
2822                         break;
2823                 case TCPOPT_WINDOW:
2824                         wscale = opt[2];
2825                         if (wscale > TCP_MAX_WINSHIFT)
2826                                 wscale = TCP_MAX_WINSHIFT;
2827                         wscale |= PF_WSCALE_FLAG;
2828                         /* FALLTHROUGH */
2829                 default:
2830                         optlen = opt[1];
2831                         if (optlen < 2)
2832                                 optlen = 2;
2833                         hlen -= optlen;
2834                         opt += optlen;
2835                         break;
2836                 }
2837         }
2838         return (wscale);
2839 }
2840
2841 u_int16_t
2842 pf_get_mss(struct mbuf *m, int off, u_int16_t th_off, sa_family_t af)
2843 {
2844         int              hlen;
2845         u_int8_t         hdr[60];
2846         u_int8_t        *opt, optlen;
2847         u_int16_t        mss = tcp_mssdflt;
2848
2849         hlen = th_off << 2;     /* hlen <= sizeof(hdr) */
2850         if (hlen <= sizeof(struct tcphdr))
2851                 return (0);
2852         if (!pf_pull_hdr(m, off, hdr, hlen, NULL, NULL, af))
2853                 return (0);
2854         opt = hdr + sizeof(struct tcphdr);
2855         hlen -= sizeof(struct tcphdr);
2856         while (hlen >= TCPOLEN_MAXSEG) {
2857                 switch (*opt) {
2858                 case TCPOPT_EOL:
2859                 case TCPOPT_NOP:
2860                         ++opt;
2861                         --hlen;
2862                         break;
2863                 case TCPOPT_MAXSEG:
2864                         bcopy((caddr_t)(opt + 2), (caddr_t)&mss, 2);
2865                         NTOHS(mss);
2866                         /* FALLTHROUGH */
2867                 default:
2868                         optlen = opt[1];
2869                         if (optlen < 2)
2870                                 optlen = 2;
2871                         hlen -= optlen;
2872                         opt += optlen;
2873                         break;
2874                 }
2875         }
2876         return (mss);
2877 }
2878
2879 u_int16_t
2880 pf_calc_mss(struct pf_addr *addr, sa_family_t af, u_int16_t offer)
2881 {
2882 #ifdef INET
2883         struct sockaddr_in      *dst;
2884         struct route             ro;
2885 #endif /* INET */
2886 #ifdef INET6
2887         struct sockaddr_in6     *dst6;
2888         struct route_in6         ro6;
2889 #endif /* INET6 */
2890         struct rtentry          *rt = NULL;
2891         int                      hlen = 0;
2892         u_int16_t                mss = tcp_mssdflt;
2893
2894         switch (af) {
2895 #ifdef INET
2896         case AF_INET:
2897                 hlen = sizeof(struct ip);
2898                 bzero(&ro, sizeof(ro));
2899                 dst = (struct sockaddr_in *)&ro.ro_dst;
2900                 dst->sin_family = AF_INET;
2901                 dst->sin_len = sizeof(*dst);
2902                 dst->sin_addr = addr->v4;
2903                 rtalloc_ign(&ro, (RTF_CLONING | RTF_PRCLONING));
2904                 rt = ro.ro_rt;
2905                 break;
2906 #endif /* INET */
2907 #ifdef INET6
2908         case AF_INET6:
2909                 hlen = sizeof(struct ip6_hdr);
2910                 bzero(&ro6, sizeof(ro6));
2911                 dst6 = (struct sockaddr_in6 *)&ro6.ro_dst;
2912                 dst6->sin6_family = AF_INET6;
2913                 dst6->sin6_len = sizeof(*dst6);
2914                 dst6->sin6_addr = addr->v6;
2915                 rtalloc_ign((struct route *)&ro6, (RTF_CLONING | RTF_PRCLONING));
2916                 rt = ro6.ro_rt;
2917                 break;
2918 #endif /* INET6 */
2919         }
2920
2921         if (rt && rt->rt_ifp) {
2922                 mss = rt->rt_ifp->if_mtu - hlen - sizeof(struct tcphdr);
2923                 mss = max(tcp_mssdflt, mss);
2924                 RTFREE(rt);
2925         }
2926         mss = min(mss, offer);
2927         mss = max(mss, 64);             /* sanity - at least max opt space */
2928         return (mss);
2929 }
2930
2931 void
2932 pf_set_rt_ifp(struct pf_state *s, struct pf_addr *saddr)
2933 {
2934         struct pf_rule *r = s->rule.ptr;
2935
2936         s->rt_kif = NULL;
2937         if (!r->rt || r->rt == PF_FASTROUTE)
2938                 return;
2939         switch (s->af) {
2940 #ifdef INET
2941         case AF_INET:
2942                 pf_map_addr(AF_INET, r, saddr, &s->rt_addr, NULL,
2943                     &s->nat_src_node);
2944                 s->rt_kif = r->rpool.cur->kif;
2945                 break;
2946 #endif /* INET */
2947 #ifdef INET6
2948         case AF_INET6:
2949                 pf_map_addr(AF_INET6, r, saddr, &s->rt_addr, NULL,
2950                     &s->nat_src_node);
2951                 s->rt_kif = r->rpool.cur->kif;
2952                 break;
2953 #endif /* INET6 */
2954         }
2955 }
2956
2957 int
2958 pf_test_tcp(struct pf_rule **rm, struct pf_state **sm, int direction,
2959     struct pfi_kif *kif, struct mbuf *m, int off, void *h,
2960     struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm,
2961     struct ifqueue *ifq, struct inpcb *inp)
2962 {
2963         struct pf_rule          *nr = NULL;
2964         struct pf_addr          *saddr = pd->src, *daddr = pd->dst;
2965         struct tcphdr           *th = pd->hdr.tcp;
2966         u_int16_t                bport, nport = 0;
2967         sa_family_t              af = pd->af;
2968         struct pf_rule          *r, *a = NULL;
2969         struct pf_ruleset       *ruleset = NULL;
2970         struct pf_src_node      *nsn = NULL;
2971         u_short                  reason;
2972         int                      rewrite = 0;
2973         int                      tag = -1, rtableid = -1;
2974         u_int16_t                mss = tcp_mssdflt;
2975         int                      asd = 0;
2976         int                      match = 0;
2977
2978         if (pf_check_congestion(ifq)) {
2979                 REASON_SET(&reason, PFRES_CONGEST);
2980                 return (PF_DROP);
2981         }
2982
2983         if (inp != NULL)
2984                 pd->lookup.done = pf_socket_lookup(direction, pd, inp);
2985         else if (debug_pfugidhack) {
2986                 crit_exit();
2987                 DPFPRINTF(PF_DEBUG_MISC, ("pf: unlocked lookup\n"));
2988                 pd->lookup.done = pf_socket_lookup(direction, pd, inp);
2989                 crit_enter();
2990         }
2991
2992
2993         r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
2994
2995         if (direction == PF_OUT) {
2996                 bport = nport = th->th_sport;
2997                 /* check outgoing packet for BINAT/NAT */
2998                 if ((nr = pf_get_translation(pd, m, off, PF_OUT, kif, &nsn,
2999                     saddr, th->th_sport, daddr, th->th_dport,
3000                     &pd->naddr, &nport)) != NULL) {
3001                         PF_ACPY(&pd->baddr, saddr, af);
3002                         pf_change_ap(saddr, &th->th_sport, pd->ip_sum,
3003                             &th->th_sum, &pd->naddr, nport, 0, af);
3004                         rewrite++;
3005                         if (nr->natpass)
3006                                 r = NULL;
3007                         pd->nat_rule = nr;
3008                 }
3009         } else {
3010                 bport = nport = th->th_dport;
3011                 /* check incoming packet for BINAT/RDR */
3012                 if ((nr = pf_get_translation(pd, m, off, PF_IN, kif, &nsn,
3013                     saddr, th->th_sport, daddr, th->th_dport,
3014                     &pd->naddr, &nport)) != NULL) {
3015                         PF_ACPY(&pd->baddr, daddr, af);
3016                         pf_change_ap(daddr, &th->th_dport, pd->ip_sum,
3017                             &th->th_sum, &pd->naddr, nport, 0, af);
3018                         rewrite++;
3019                         if (nr->natpass)
3020                                 r = NULL;
3021                         pd->nat_rule = nr;
3022                 }
3023         }
3024
3025         while (r != NULL) {
3026                 r->evaluations++;
3027                 if (pfi_kif_match(r->kif, kif) == r->ifnot)
3028                         r = r->skip[PF_SKIP_IFP].ptr;
3029                 else if (r->direction && r->direction != direction)
3030                         r = r->skip[PF_SKIP_DIR].ptr;
3031                 else if (r->af && r->af != af)
3032                         r = r->skip[PF_SKIP_AF].ptr;
3033                 else if (r->proto && r->proto != IPPROTO_TCP)
3034                         r = r->skip[PF_SKIP_PROTO].ptr;
3035                 else if (PF_MISMATCHAW(&r->src.addr, saddr, af,
3036                     r->src.neg, kif))
3037                         r = r->skip[PF_SKIP_SRC_ADDR].ptr;
3038                 else if (r->src.port_op && !pf_match_port(r->src.port_op,
3039                     r->src.port[0], r->src.port[1], th->th_sport))
3040                         r = r->skip[PF_SKIP_SRC_PORT].ptr;
3041                 else if (PF_MISMATCHAW(&r->dst.addr, daddr, af,
3042                     r->dst.neg, NULL))
3043                         r = r->skip[PF_SKIP_DST_ADDR].ptr;
3044                 else if (r->dst.port_op && !pf_match_port(r->dst.port_op,
3045                     r->dst.port[0], r->dst.port[1], th->th_dport))
3046                         r = r->skip[PF_SKIP_DST_PORT].ptr;
3047                 else if (r->tos && !(r->tos == pd->tos))
3048                         r = TAILQ_NEXT(r, entries);
3049                 else if (r->rule_flag & PFRULE_FRAGMENT)
3050                         r = TAILQ_NEXT(r, entries);
3051                 else if ((r->flagset & th->th_flags) != r->flags)
3052                         r = TAILQ_NEXT(r, entries);
3053                 else if (r->uid.op && (pd->lookup.done || (pd->lookup.done =
3054                     pf_socket_lookup(direction, pd, inp), 1)) &&
3055                     !pf_match_uid(r->uid.op, r->uid.uid[0], r->uid.uid[1],
3056                     pd->lookup.uid))
3057                         r = TAILQ_NEXT(r, entries);
3058                 else if (r->gid.op && (pd->lookup.done || (pd->lookup.done =
3059                     pf_socket_lookup(direction, pd, inp), 1)) &&
3060                     !pf_match_gid(r->gid.op, r->gid.gid[0], r->gid.gid[1],
3061                     pd->lookup.gid))
3062                         r = TAILQ_NEXT(r, entries);
3063                 else if (r->prob && r->prob <= karc4random())
3064                         r = TAILQ_NEXT(r, entries);
3065                 else if (r->match_tag && !pf_match_tag(m, r, pd->pf_mtag, &tag))
3066                         r = TAILQ_NEXT(r, entries);
3067                 else if (r->os_fingerprint != PF_OSFP_ANY && !pf_osfp_match(
3068                     pf_osfp_fingerprint(pd, m, off, th), r->os_fingerprint))
3069                         r = TAILQ_NEXT(r, entries);
3070                 else {
3071                         if (r->tag)
3072                                 tag = r->tag;
3073                         if (r->rtableid >= 0)
3074                                 rtableid = r->rtableid;
3075                         if (r->anchor == NULL) {
3076                                 match = 1;
3077                                 *rm = r;
3078                                 *am = a;
3079                                 *rsm = ruleset;
3080                                 if ((*rm)->quick)
3081                                         break;
3082                                 r = TAILQ_NEXT(r, entries);
3083                         } else
3084                                 pf_step_into_anchor(&asd, &ruleset,
3085                                     PF_RULESET_FILTER, &r, &a, &match);
3086                 }
3087                 if (r == NULL && pf_step_out_of_anchor(&asd, &ruleset,
3088                     PF_RULESET_FILTER, &r, &a, &match))
3089                         break;
3090         }
3091         r = *rm;
3092         a = *am;
3093         ruleset = *rsm;
3094
3095         REASON_SET(&reason, PFRES_MATCH);
3096
3097         if (r->log || (nr != NULL && nr->natpass && nr->log)) {
3098                 if (rewrite)
3099                         m_copyback(m, off, sizeof(*th), (caddr_t)th);
3100                 PFLOG_PACKET(kif, h, m, af, direction, reason, r->log ? r : nr,
3101                     a, ruleset, pd);
3102         }
3103
3104         if ((r->action == PF_DROP) &&
3105             ((r->rule_flag & PFRULE_RETURNRST) ||
3106             (r->rule_flag & PFRULE_RETURNICMP) ||
3107             (r->rule_flag & PFRULE_RETURN))) {
3108                 /* undo NAT changes, if they have taken place */
3109                 if (nr != NULL) {
3110                         if (direction == PF_OUT) {
3111                                 pf_change_ap(saddr, &th->th_sport, pd->ip_sum,
3112                                     &th->th_sum, &pd->baddr, bport, 0, af);
3113                                 rewrite++;
3114                         } else {
3115                                 pf_change_ap(daddr, &th->th_dport, pd->ip_sum,
3116                                     &th->th_sum, &pd->baddr, bport, 0, af);
3117                                 rewrite++;
3118                         }
3119                 }
3120                 if (((r->rule_flag & PFRULE_RETURNRST) ||
3121                     (r->rule_flag & PFRULE_RETURN)) &&
3122                     !(th->th_flags & TH_RST)) {
3123                         u_int32_t ack = ntohl(th->th_seq) + pd->p_len;
3124
3125                         if (th->th_flags & TH_SYN)
3126                                 ack++;
3127                         if (th->th_flags & TH_FIN)
3128                                 ack++;
3129                         pf_send_tcp(r, af, pd->dst,
3130                             pd->src, th->th_dport, th->th_sport,
3131                             ntohl(th->th_ack), ack, TH_RST|TH_ACK, 0, 0,
3132                             r->return_ttl, 1, 0, pd->eh, kif->pfik_ifp);
3133                 } else if ((af == AF_INET) && r->return_icmp)
3134                         pf_send_icmp(m, r->return_icmp >> 8,
3135                             r->return_icmp & 255, af, r);
3136                 else if ((af == AF_INET6) && r->return_icmp6)
3137                         pf_send_icmp(m, r->return_icmp6 >> 8,
3138                             r->return_icmp6 & 255, af, r);
3139         }
3140
3141         if (r->action == PF_DROP) {
3142                 return (PF_DROP);
3143         }
3144
3145         if (pf_tag_packet(m, pd->pf_mtag, tag, rtableid)) {
3146                 REASON_SET(&reason, PFRES_MEMORY);
3147                 return (PF_DROP);
3148         }
3149
3150         if (r->keep_state || nr != NULL ||
3151             (pd->flags & PFDESC_TCP_NORM)) {
3152                 /* create new state */
3153                 u_int16_t        len;
3154                 struct pf_state *s = NULL;
3155                 struct pf_src_node *sn = NULL;
3156
3157                 len = pd->tot_len - off - (th->th_off << 2);
3158
3159                 /* check maximums */
3160                 if (r->max_states && (r->states >= r->max_states)) {
3161                         pf_status.lcounters[LCNT_STATES]++;
3162                         REASON_SET(&reason, PFRES_MAXSTATES);
3163                         goto cleanup;
3164                 }
3165                 /* src node for filter rule */
3166                 if ((r->rule_flag & PFRULE_SRCTRACK ||
3167                     r->rpool.opts & PF_POOL_STICKYADDR) &&
3168                     pf_insert_src_node(&sn, r, saddr, af) != 0) {
3169                         REASON_SET(&reason, PFRES_SRCLIMIT);
3170                         goto cleanup;
3171                 }
3172                 /* src node for translation rule */
3173                 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) &&
3174                     ((direction == PF_OUT &&
3175                     pf_insert_src_node(&nsn, nr, &pd->baddr, af) != 0) ||
3176                     (pf_insert_src_node(&nsn, nr, saddr, af) != 0))) {
3177                         REASON_SET(&reason, PFRES_SRCLIMIT);
3178                         goto cleanup;
3179                 }
3180                 s = pool_get(&pf_state_pl, PR_NOWAIT);
3181                 if (s == NULL) {
3182                         REASON_SET(&reason, PFRES_MEMORY);
3183 cleanup:
3184                         if (sn != NULL && sn->states == 0 && sn->expire == 0) {
3185                                 RB_REMOVE(pf_src_tree, &tree_src_tracking, sn);
3186                                 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
3187                                 pf_status.src_nodes--;
3188                                 pool_put(&pf_src_tree_pl, sn);
3189                         }
3190                         if (nsn != sn && nsn != NULL && nsn->states == 0 &&
3191                             nsn->expire == 0) {
3192                                 RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn);
3193                                 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
3194                                 pf_status.src_nodes--;
3195                                 pool_put(&pf_src_tree_pl, nsn);
3196                         }
3197                         return (PF_DROP);
3198                 }
3199                 bzero(s, sizeof(*s));
3200                 s->rule.ptr = r;
3201                 s->nat_rule.ptr = nr;
3202                 s->anchor.ptr = a;
3203                 STATE_INC_COUNTERS(s);
3204                 s->allow_opts = r->allow_opts;
3205                 s->log = r->log & PF_LOG_ALL;
3206                 if (nr != NULL)
3207                         s->log |= nr->log & PF_LOG_ALL;
3208                 s->proto = IPPROTO_TCP;
3209                 s->direction = direction;
3210                 s->af = af;
3211                 if (direction == PF_OUT) {
3212                         PF_ACPY(&s->gwy.addr, saddr, af);
3213                         s->gwy.port = th->th_sport;             /* sport */
3214                         PF_ACPY(&s->ext.addr, daddr, af);
3215                         s->ext.port = th->th_dport;
3216                         if (nr != NULL) {
3217                                 PF_ACPY(&s->lan.addr, &pd->baddr, af);
3218                                 s->lan.port = bport;
3219                         } else {
3220                                 PF_ACPY(&s->lan.addr, &s->gwy.addr, af);
3221                                 s->lan.port = s->gwy.port;
3222                         }
3223                 } else {
3224                         PF_ACPY(&s->lan.addr, daddr, af);
3225                         s->lan.port = th->th_dport;
3226                         PF_ACPY(&s->ext.addr, saddr, af);
3227                         s->ext.port = th->th_sport;
3228                         if (nr != NULL) {
3229                                 PF_ACPY(&s->gwy.addr, &pd->baddr, af);
3230                                 s->gwy.port = bport;
3231                         } else {
3232                                 PF_ACPY(&s->gwy.addr, &s->lan.addr, af);
3233                                 s->gwy.port = s->lan.port;
3234                         }
3235                 }
3236
3237                 s->hash = pf_state_hash(s);
3238                 s->src.seqlo = ntohl(th->th_seq);
3239                 s->src.seqhi = s->src.seqlo + len + 1;
3240                 s->pickup_mode = r->pickup_mode;
3241
3242                 if ((th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN &&
3243                     r->keep_state == PF_STATE_MODULATE) {
3244                         /* Generate sequence number modulator */
3245                         while ((s->src.seqdiff =
3246                             pf_new_isn(s) - s->src.seqlo) == 0)
3247                                 ;
3248                         pf_change_a(&th->th_seq, &th->th_sum,
3249                             htonl(s->src.seqlo + s->src.seqdiff), 0);
3250                         rewrite = 1;
3251                 } else
3252                         s->src.seqdiff = 0;
3253                 if (th->th_flags & TH_SYN) {
3254                         s->src.seqhi++;
3255                         s->src.wscale = pf_get_wscale(m, off, th->th_off, af);
3256                         s->sync_flags |= PFSTATE_GOT_SYN1;
3257                 }
3258                 s->src.max_win = MAX(ntohs(th->th_win), 1);
3259                 if (s->src.wscale & PF_WSCALE_MASK) {
3260                         /* Remove scale factor from initial window */
3261                         u_int win = s->src.max_win;
3262                         win += 1 << (s->src.wscale & PF_WSCALE_MASK);
3263                         s->src.max_win = (win - 1) >>
3264                             (s->src.wscale & PF_WSCALE_MASK);
3265                 }
3266                 if (th->th_flags & TH_FIN)
3267                         s->src.seqhi++;
3268                 s->dst.seqhi = 1;
3269                 s->dst.max_win = 1;
3270                 s->src.state = TCPS_SYN_SENT;
3271                 s->dst.state = TCPS_CLOSED;
3272                 s->creation = time_second;
3273                 s->expire = time_second;
3274                 s->timeout = PFTM_TCP_FIRST_PACKET;
3275                 pf_set_rt_ifp(s, saddr);
3276                 if (sn != NULL) {
3277                         s->src_node = sn;
3278                         s->src_node->states++;
3279                 }
3280                 if (nsn != NULL) {
3281                         PF_ACPY(&nsn->raddr, &pd->naddr, af);
3282                         s->nat_src_node = nsn;
3283                         s->nat_src_node->states++;
3284                 }
3285                 if ((pd->flags & PFDESC_TCP_NORM) && pf_normalize_tcp_init(m,
3286                     off, pd, th, &s->src, &s->dst)) {
3287                         REASON_SET(&reason, PFRES_MEMORY);
3288                         pf_src_tree_remove_state(s);
3289                         STATE_DEC_COUNTERS(s);
3290                         pool_put(&pf_state_pl, s);
3291                         return (PF_DROP);
3292                 }
3293                 if ((pd->flags & PFDESC_TCP_NORM) && s->src.scrub &&
3294                     pf_normalize_tcp_stateful(m, off, pd, &reason, th, s,
3295                     &s->src, &s->dst, &rewrite)) {
3296                         /* This really shouldn't happen!!! */
3297                         DPFPRINTF(PF_DEBUG_URGENT,
3298                             ("pf_normalize_tcp_stateful failed on first pkt"));
3299                         pf_normalize_tcp_cleanup(s);
3300                         pf_src_tree_remove_state(s);
3301                         STATE_DEC_COUNTERS(s);
3302                         pool_put(&pf_state_pl, s);
3303                         return (PF_DROP);
3304                 }
3305                 if (pf_insert_state(BOUND_IFACE(r, kif), s)) {
3306                         pf_normalize_tcp_cleanup(s);
3307                         REASON_SET(&reason, PFRES_STATEINS);
3308                         pf_src_tree_remove_state(s);
3309                         STATE_DEC_COUNTERS(s);
3310                         pool_put(&pf_state_pl, s);
3311                         return (PF_DROP);
3312                 } else
3313                         *sm = s;
3314                 if (tag > 0) {
3315                         pf_tag_ref(tag);
3316                         s->tag = tag;
3317                 }
3318                 if ((th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN &&
3319                     r->keep_state == PF_STATE_SYNPROXY) {
3320                         s->src.state = PF_TCPS_PROXY_SRC;
3321                         if (nr != NULL) {
3322                                 if (direction == PF_OUT) {
3323                                         pf_change_ap(saddr, &th->th_sport,
3324                                             pd->ip_sum, &th->th_sum, &pd->baddr,
3325                                             bport, 0, af);
3326                                 } else {
3327                                         pf_change_ap(daddr, &th->th_dport,
3328                                             pd->ip_sum, &th->th_sum, &pd->baddr,
3329                                             bport, 0, af);
3330                                 }
3331                         }
3332                         s->src.seqhi = htonl(karc4random());
3333                         /* Find mss option */
3334                         mss = pf_get_mss(m, off, th->th_off, af);
3335                         mss = pf_calc_mss(saddr, af, mss);
3336                         mss = pf_calc_mss(daddr, af, mss);
3337                         s->src.mss = mss;
3338                         pf_send_tcp(r, af, daddr, saddr, th->th_dport,
3339                             th->th_sport, s->src.seqhi, ntohl(th->th_seq) + 1,
3340                             TH_SYN|TH_ACK, 0, s->src.mss, 0, 1, 0, NULL, NULL);
3341                         REASON_SET(&reason, PFRES_SYNPROXY);
3342                         return (PF_SYNPROXY_DROP);
3343                 }
3344         }
3345
3346         /* copy back packet headers if we performed NAT operations */
3347         if (rewrite)
3348                 m_copyback(m, off, sizeof(*th), (caddr_t)th);
3349
3350         return (PF_PASS);
3351 }
3352
3353 int
3354 pf_test_udp(struct pf_rule **rm, struct pf_state **sm, int direction,
3355     struct pfi_kif *kif, struct mbuf *m, int off, void *h,
3356     struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm,
3357     struct ifqueue *ifq, struct inpcb *inp)
3358 {
3359         struct pf_rule          *nr = NULL;
3360         struct pf_addr          *saddr = pd->src, *daddr = pd->dst;
3361         struct udphdr           *uh = pd->hdr.udp;
3362         u_int16_t                bport, nport = 0;
3363         sa_family_t              af = pd->af;
3364         struct pf_rule          *r, *a = NULL;
3365         struct pf_ruleset       *ruleset = NULL;
3366         struct pf_src_node      *nsn = NULL;
3367         u_short                  reason;
3368         int                      rewrite = 0;
3369         int                      tag = -1, rtableid = -1;
3370         int                      asd = 0;
3371         int                      match = 0;
3372
3373         if (pf_check_congestion(ifq)) {
3374                 REASON_SET(&reason, PFRES_CONGEST);
3375                 return (PF_DROP);
3376         }
3377
3378         r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
3379
3380         if (direction == PF_OUT) {
3381                 bport = nport = uh->uh_sport;
3382                 /* check outgoing packet for BINAT/NAT */
3383                 if ((nr = pf_get_translation(pd, m, off, PF_OUT, kif, &nsn,
3384                     saddr, uh->uh_sport, daddr, uh->uh_dport,
3385                     &pd->naddr, &nport)) != NULL) {
3386                         PF_ACPY(&pd->baddr, saddr, af);
3387                         pf_change_ap(saddr, &uh->uh_sport, pd->ip_sum,
3388                             &uh->uh_sum, &pd->naddr, nport, 1, af);
3389                         rewrite++;
3390                         if (nr->natpass)
3391                                 r = NULL;
3392                         pd->nat_rule = nr;
3393                 }
3394         } else {
3395                 bport = nport = uh->uh_dport;
3396                 /* check incoming packet for BINAT/RDR */
3397                 if ((nr = pf_get_translation(pd, m, off, PF_IN, kif, &nsn,
3398                     saddr, uh->uh_sport, daddr, uh->uh_dport, &pd->naddr,
3399                     &nport)) != NULL) {
3400                         PF_ACPY(&pd->baddr, daddr, af);
3401                         pf_change_ap(daddr, &uh->uh_dport, pd->ip_sum,
3402                             &uh->uh_sum, &pd->naddr, nport, 1, af);
3403                         rewrite++;
3404                         if (nr->natpass)
3405                                 r = NULL;
3406                         pd->nat_rule = nr;
3407                 }
3408         }
3409
3410         while (r != NULL) {
3411                 r->evaluations++;
3412                 if (pfi_kif_match(r->kif, kif) == r->ifnot)
3413                         r = r->skip[PF_SKIP_IFP].ptr;
3414                 else if (r->direction && r->direction != direction)
3415                         r = r->skip[PF_SKIP_DIR].ptr;
3416                 else if (r->af && r->af != af)
3417                         r = r->skip[PF_SKIP_AF].ptr;
3418                 else if (r->proto && r->proto != IPPROTO_UDP)
3419                         r = r->skip[PF_SKIP_PROTO].ptr;
3420                 else if (PF_MISMATCHAW(&r->src.addr, saddr, af,
3421                     r->src.neg, kif))
3422                         r = r->skip[PF_SKIP_SRC_ADDR].ptr;
3423                 else if (r->src.port_op && !pf_match_port(r->src.port_op,
3424                     r->src.port[0], r->src.port[1], uh->uh_sport))
3425                         r = r->skip[PF_SKIP_SRC_PORT].ptr;
3426                 else if (PF_MISMATCHAW(&r->dst.addr, daddr, af,
3427                     r->dst.neg, NULL))
3428                         r = r->skip[PF_SKIP_DST_ADDR].ptr;
3429                 else if (r->dst.port_op && !pf_match_port(r->dst.port_op,
3430                     r->dst.port[0], r->dst.port[1], uh->uh_dport))
3431                         r = r->skip[PF_SKIP_DST_PORT].ptr;
3432                 else if (r->tos && !(r->tos == pd->tos))
3433                         r = TAILQ_NEXT(r, entries);
3434                 else if (r->rule_flag & PFRULE_FRAGMENT)
3435                         r = TAILQ_NEXT(r, entries);
3436                 else if (r->uid.op && (pd->lookup.done || (pd->lookup.done =
3437                     pf_socket_lookup(direction, pd, inp), 1)) &&
3438                     !pf_match_uid(r->uid.op, r->uid.uid[0], r->uid.uid[1],
3439                     pd->lookup.uid))
3440                         r = TAILQ_NEXT(r, entries);
3441                 else if (r->gid.op && (pd->lookup.done || (pd->lookup.done =
3442                     pf_socket_lookup(direction, pd, inp), 1)) &&
3443                     !pf_match_gid(r->gid.op, r->gid.gid[0], r->gid.gid[1],
3444                     pd->lookup.gid))
3445                         r = TAILQ_NEXT(r, entries);
3446                 else if (r->prob && r->prob <= karc4random())
3447                         r = TAILQ_NEXT(r, entries);
3448                 else if (r->match_tag && !pf_match_tag(m, r, pd->pf_mtag, &tag))
3449                         r = TAILQ_NEXT(r, entries);
3450                 else if (r->os_fingerprint != PF_OSFP_ANY)
3451                         r = TAILQ_NEXT(r, entries);
3452                 else {
3453                         if (r->tag)
3454                                 tag = r->tag;
3455                         if (r->rtableid >= 0)
3456                                 rtableid = r->rtableid;
3457                         if (r->anchor == NULL) {
3458                                 match = 1;
3459                                 *rm = r;
3460                                 *am = a;
3461                                 *rsm = ruleset;
3462                                 if ((*rm)->quick)
3463                                         break;
3464                                 r = TAILQ_NEXT(r, entries);
3465                         } else
3466                                 pf_step_into_anchor(&asd, &ruleset,
3467                                     PF_RULESET_FILTER, &r, &a, &match);
3468                 }
3469                 if (r == NULL && pf_step_out_of_anchor(&asd, &ruleset,
3470                     PF_RULESET_FILTER, &r, &a, &match))
3471                         break;
3472         }
3473         r = *rm;
3474         a = *am;
3475         ruleset = *rsm;
3476
3477         REASON_SET(&reason, PFRES_MATCH);
3478
3479         if (r->log || (nr != NULL && nr->natpass && nr->log)) {
3480                 if (rewrite)
3481                         m_copyback(m, off, sizeof(*uh), (caddr_t)uh);
3482                 PFLOG_PACKET(kif, h, m, af, direction, reason, r->log ? r : nr,
3483                     a, ruleset, pd);
3484         }
3485
3486         if ((r->action == PF_DROP) &&
3487             ((r->rule_flag & PFRULE_RETURNICMP) ||
3488             (r->rule_flag & PFRULE_RETURN))) {
3489                 /* undo NAT changes, if they have taken place */
3490                 if (nr != NULL) {
3491                         if (direction == PF_OUT) {
3492                                 pf_change_ap(saddr, &uh->uh_sport, pd->ip_sum,
3493                                     &uh->uh_sum, &pd->baddr, bport, 1, af);
3494                                 rewrite++;
3495                         } else {
3496                                 pf_change_ap(daddr, &uh->uh_dport, pd->ip_sum,
3497                                     &uh->uh_sum, &pd->baddr, bport, 1, af);
3498                                 rewrite++;
3499                         }
3500                 }
3501                 if ((af == AF_INET) && r->return_icmp)
3502                         pf_send_icmp(m, r->return_icmp >> 8,
3503                             r->return_icmp & 255, af, r);
3504                 else if ((af == AF_INET6) && r->return_icmp6)
3505                         pf_send_icmp(m, r->return_icmp6 >> 8,
3506                             r->return_icmp6 & 255, af, r);
3507         }
3508
3509         if (r->action == PF_DROP)
3510                 return (PF_DROP);
3511
3512         if (pf_tag_packet(m, pd->pf_mtag, tag, rtableid)) {
3513                 REASON_SET(&reason, PFRES_MEMORY);
3514                 return (PF_DROP);
3515         }
3516
3517         if (r->keep_state || nr != NULL) {
3518                 /* create new state */
3519                 struct pf_state *s = NULL;
3520                 struct pf_src_node *sn = NULL;
3521
3522                 /* check maximums */
3523                 if (r->max_states && (r->states >= r->max_states)) {
3524                         pf_status.lcounters[LCNT_STATES]++;
3525                         REASON_SET(&reason, PFRES_MAXSTATES);
3526                         goto cleanup;
3527                 }
3528                 /* src node for filter rule */
3529                 if ((r->rule_flag & PFRULE_SRCTRACK ||
3530                     r->rpool.opts & PF_POOL_STICKYADDR) &&
3531                     pf_insert_src_node(&sn, r, saddr, af) != 0) {
3532                         REASON_SET(&reason, PFRES_SRCLIMIT);
3533                         goto cleanup;
3534                 }
3535                 /* src node for translation rule */
3536                 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) &&
3537                     ((direction == PF_OUT &&
3538                     pf_insert_src_node(&nsn, nr, &pd->baddr, af) != 0) ||
3539                     (pf_insert_src_node(&nsn, nr, saddr, af) != 0))) {
3540                         REASON_SET(&reason, PFRES_SRCLIMIT);
3541                         goto cleanup;
3542                 }
3543                 s = pool_get(&pf_state_pl, PR_NOWAIT);
3544                 if (s == NULL) {
3545                         REASON_SET(&reason, PFRES_MEMORY);
3546 cleanup:
3547                         if (sn != NULL && sn->states == 0 && sn->expire == 0) {
3548                                 RB_REMOVE(pf_src_tree, &tree_src_tracking, sn);
3549                                 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
3550                                 pf_status.src_nodes--;
3551                                 pool_put(&pf_src_tree_pl, sn);
3552                         }
3553                         if (nsn != sn && nsn != NULL && nsn->states == 0 &&
3554                             nsn->expire == 0) {
3555                                 RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn);
3556                                 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
3557                                 pf_status.src_nodes--;
3558                                 pool_put(&pf_src_tree_pl, nsn);
3559                         }
3560                         return (PF_DROP);
3561                 }
3562                 bzero(s, sizeof(*s));
3563                 s->rule.ptr = r;
3564                 s->nat_rule.ptr = nr;
3565                 s->anchor.ptr = a;
3566                 STATE_INC_COUNTERS(s);
3567                 s->allow_opts = r->allow_opts;
3568                 s->log = r->log & PF_LOG_ALL;
3569                 if (nr != NULL)
3570                         s->log |= nr->log & PF_LOG_ALL;
3571                 s->proto = IPPROTO_UDP;
3572                 s->direction = direction;
3573                 s->af = af;
3574                 if (direction == PF_OUT) {
3575                         PF_ACPY(&s->gwy.addr, saddr, af);
3576                         s->gwy.port = uh->uh_sport;
3577                         PF_ACPY(&s->ext.addr, daddr, af);
3578                         s->ext.port = uh->uh_dport;
3579                         if (nr != NULL) {
3580                                 PF_ACPY(&s->lan.addr, &pd->baddr, af);
3581                                 s->lan.port = bport;
3582                         } else {
3583                                 PF_ACPY(&s->lan.addr, &s->gwy.addr, af);
3584                                 s->lan.port = s->gwy.port;
3585                         }
3586                 } else {
3587                         PF_ACPY(&s->lan.addr, daddr, af);
3588                         s->lan.port = uh->uh_dport;
3589                         PF_ACPY(&s->ext.addr, saddr, af);
3590                         s->ext.port = uh->uh_sport;
3591                         if (nr != NULL) {
3592                                 PF_ACPY(&s->gwy.addr, &pd->baddr, af);
3593                                 s->gwy.port = bport;
3594                         } else {
3595                                 PF_ACPY(&s->gwy.addr, &s->lan.addr, af);
3596                                 s->gwy.port = s->lan.port;
3597                         }
3598                 }
3599                 s->hash = pf_state_hash(s);
3600                 s->src.state = PFUDPS_SINGLE;
3601                 s->dst.state = PFUDPS_NO_TRAFFIC;
3602                 s->creation = time_second;
3603                 s->expire = time_second;
3604                 s->timeout = PFTM_UDP_FIRST_PACKET;
3605                 pf_set_rt_ifp(s, saddr);
3606                 if (sn != NULL) {
3607                         s->src_node = sn;
3608                         s->src_node->states++;
3609                 }
3610                 if (nsn != NULL) {
3611                         PF_ACPY(&nsn->raddr, &pd->naddr, af);
3612                         s->nat_src_node = nsn;
3613                         s->nat_src_node->states++;
3614                 }
3615                 if (pf_insert_state(BOUND_IFACE(r, kif), s)) {
3616                         REASON_SET(&reason, PFRES_STATEINS);
3617                         pf_src_tree_remove_state(s);
3618                         STATE_DEC_COUNTERS(s);
3619                         pool_put(&pf_state_pl, s);
3620                         return (PF_DROP);
3621                 } else
3622                         *sm = s;
3623                 if (tag > 0) {
3624                         pf_tag_ref(tag);
3625                         s->tag = tag;
3626                 }
3627         }
3628
3629         /* copy back packet headers if we performed NAT operations */
3630         if (rewrite)
3631                 m_copyback(m, off, sizeof(*uh), (caddr_t)uh);
3632
3633         return (PF_PASS);
3634 }
3635
3636 int
3637 pf_test_icmp(struct pf_rule **rm, struct pf_state **sm, int direction,
3638     struct pfi_kif *kif, struct mbuf *m, int off, void *h,
3639     struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm,
3640     struct ifqueue *ifq)
3641 {
3642         struct pf_rule          *nr = NULL;
3643         struct pf_addr          *saddr = pd->src, *daddr = pd->dst;
3644         struct pf_rule          *r, *a = NULL;
3645         struct pf_ruleset       *ruleset = NULL;
3646         struct pf_src_node      *nsn = NULL;
3647         u_short                  reason;
3648         u_int16_t                icmpid = 0, bport, nport = 0;
3649         sa_family_t              af = pd->af;
3650         u_int8_t                 icmptype = 0, icmpcode = 0;
3651         int                      state_icmp = 0;
3652         int                      tag = -1, rtableid = -1;
3653 #ifdef INET6
3654         int                      rewrite = 0;
3655 #endif /* INET6 */
3656         int                      asd = 0;
3657         int                      match = 0;
3658
3659         if (pf_check_congestion(ifq)) {
3660                 REASON_SET(&reason, PFRES_CONGEST);
3661                 return (PF_DROP);
3662         }
3663
3664         switch (pd->proto) {
3665 #ifdef INET
3666         case IPPROTO_ICMP:
3667                 icmptype = pd->hdr.icmp->icmp_type;
3668                 icmpcode = pd->hdr.icmp->icmp_code;
3669                 icmpid = pd->hdr.icmp->icmp_id;
3670
3671                 if (icmptype == ICMP_UNREACH ||
3672                     icmptype == ICMP_SOURCEQUENCH ||
3673                     icmptype == ICMP_REDIRECT ||
3674                     icmptype == ICMP_TIMXCEED ||
3675                     icmptype == ICMP_PARAMPROB)
3676                         state_icmp++;
3677                 break;
3678 #endif /* INET */
3679 #ifdef INET6
3680         case IPPROTO_ICMPV6:
3681                 icmptype = pd->hdr.icmp6->icmp6_type;
3682                 icmpcode = pd->hdr.icmp6->icmp6_code;
3683                 icmpid = pd->hdr.icmp6->icmp6_id;
3684
3685                 if (icmptype == ICMP6_DST_UNREACH ||
3686                     icmptype == ICMP6_PACKET_TOO_BIG ||
3687                     icmptype == ICMP6_TIME_EXCEEDED ||
3688                     icmptype == ICMP6_PARAM_PROB)
3689                         state_icmp++;
3690                 break;
3691 #endif /* INET6 */
3692         }
3693
3694         r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
3695
3696         if (direction == PF_OUT) {
3697                 bport = nport = icmpid;
3698                 /* check outgoing packet for BINAT/NAT */
3699                 if ((nr = pf_get_translation(pd, m, off, PF_OUT, kif, &nsn,
3700                     saddr, icmpid, daddr, icmpid, &pd->naddr, &nport)) !=
3701                     NULL) {
3702                         PF_ACPY(&pd->baddr, saddr, af);
3703                         switch (af) {
3704 #ifdef INET
3705                         case AF_INET:
3706                                 pf_change_a(&saddr->v4.s_addr, pd->ip_sum,
3707                                     pd->naddr.v4.s_addr, 0);
3708                                 pd->hdr.icmp->icmp_cksum = pf_cksum_fixup(
3709                                     pd->hdr.icmp->icmp_cksum, icmpid, nport, 0);
3710                                 pd->hdr.icmp->icmp_id = nport;
3711                                 m_copyback(m, off, ICMP_MINLEN, (caddr_t)pd->hdr.icmp);
3712                                 break;
3713 #endif /* INET */
3714 #ifdef INET6
3715                         case AF_INET6:
3716                                 pf_change_a6(saddr, &pd->hdr.icmp6->icmp6_cksum,
3717                                     &pd->naddr, 0);
3718                                 rewrite++;
3719                                 break;
3720 #endif /* INET6 */
3721                         }
3722                         if (nr->natpass)
3723                                 r = NULL;
3724                         pd->nat_rule = nr;
3725                 }
3726         } else {
3727                 bport = nport = icmpid;
3728                 /* check incoming packet for BINAT/RDR */
3729                 if ((nr = pf_get_translation(pd, m, off, PF_IN, kif, &nsn,
3730                     saddr, icmpid, daddr, icmpid, &pd->naddr, &nport)) !=
3731                     NULL) {
3732                         PF_ACPY(&pd->baddr, daddr, af);
3733                         switch (af) {
3734 #ifdef INET
3735                         case AF_INET:
3736                                 pf_change_a(&daddr->v4.s_addr,
3737                                     pd->ip_sum, pd->naddr.v4.s_addr, 0);
3738                                 break;
3739 #endif /* INET */
3740 #ifdef INET6
3741                         case AF_INET6:
3742                                 pf_change_a6(daddr, &pd->hdr.icmp6->icmp6_cksum,
3743                                     &pd->naddr, 0);
3744                                 rewrite++;
3745                                 break;
3746 #endif /* INET6 */
3747                         }
3748                         if (nr->natpass)
3749                                 r = NULL;
3750                         pd->nat_rule = nr;
3751                 }
3752         }
3753
3754         while (r != NULL) {
3755                 r->evaluations++;
3756                 if (pfi_kif_match(r->kif, kif) == r->ifnot)
3757                         r = r->skip[PF_SKIP_IFP].ptr;
3758                 else if (r->direction && r->direction != direction)
3759                         r = r->skip[PF_SKIP_DIR].ptr;
3760                 else if (r->af && r->af != af)
3761                         r = r->skip[PF_SKIP_AF].ptr;
3762                 else if (r->proto && r->proto != pd->proto)
3763                         r = r->skip[PF_SKIP_PROTO].ptr;
3764                 else if (PF_MISMATCHAW(&r->src.addr, saddr, af,
3765                     r->src.neg, kif))
3766                         r = r->skip[PF_SKIP_SRC_ADDR].ptr;
3767                 else if (PF_MISMATCHAW(&r->dst.addr, daddr, af,
3768                     r->dst.neg, NULL))
3769                         r = r->skip[PF_SKIP_DST_ADDR].ptr;
3770                 else if (r->type && r->type != icmptype + 1)
3771                         r = TAILQ_NEXT(r, entries);
3772                 else if (r->code && r->code != icmpcode + 1)
3773                         r = TAILQ_NEXT(r, entries);
3774                 else if (r->tos && !(r->tos == pd->tos))
3775                         r = TAILQ_NEXT(r, entries);
3776                 else if (r->rule_flag & PFRULE_FRAGMENT)
3777                         r = TAILQ_NEXT(r, entries);
3778                 else if (r->prob && r->prob <= karc4random())
3779                         r = TAILQ_NEXT(r, entries);
3780                 else if (r->match_tag && !pf_match_tag(m, r, pd->pf_mtag, &tag))
3781                         r = TAILQ_NEXT(r, entries);
3782                 else if (r->os_fingerprint != PF_OSFP_ANY)
3783                         r = TAILQ_NEXT(r, entries);
3784                 else {
3785                         if (r->tag)
3786                                 tag = r->tag;
3787                         if (r->rtableid >= 0)
3788                                 rtableid = r->rtableid;
3789                         if (r->anchor == NULL) {
3790                                 match = 1;
3791                                 *rm = r;
3792                                 *am = a;
3793                                 *rsm = ruleset;
3794                                 if ((*rm)->quick)
3795                                         break;
3796                                 r = TAILQ_NEXT(r, entries);
3797                         } else
3798                                 pf_step_into_anchor(&asd, &ruleset,
3799                                     PF_RULESET_FILTER, &r, &a, &match);
3800                 }
3801                 if (r == NULL && pf_step_out_of_anchor(&asd, &ruleset,
3802                     PF_RULESET_FILTER, &r, &a, &match))
3803                         break;
3804         }
3805         r = *rm;
3806         a = *am;
3807         ruleset = *rsm;
3808
3809         REASON_SET(&reason, PFRES_MATCH);
3810
3811         if (r->log || (nr != NULL && nr->natpass && nr->log)) {
3812 #ifdef INET6
3813                 if (rewrite)
3814                         m_copyback(m, off, sizeof(struct icmp6_hdr),
3815                             (caddr_t)pd->hdr.icmp6);
3816 #endif /* INET6 */
3817                 PFLOG_PACKET(kif, h, m, af, direction, reason, r->log ? r : nr,
3818                     a, ruleset, pd);
3819         }
3820
3821         if (r->action != PF_PASS)
3822                 return (PF_DROP);
3823
3824         if (pf_tag_packet(m, pd->pf_mtag, tag, rtableid)) {
3825                 REASON_SET(&reason, PFRES_MEMORY);
3826                 return (PF_DROP);
3827         }
3828
3829         if (!state_icmp && (r->keep_state || nr != NULL)) {
3830                 /* create new state */
3831                 struct pf_state *s = NULL;
3832                 struct pf_src_node *sn = NULL;
3833
3834                 /* check maximums */
3835                 if (r->max_states && (r->states >= r->max_states)) {
3836                         pf_status.lcounters[LCNT_STATES]++;
3837                         REASON_SET(&reason, PFRES_MAXSTATES);
3838                         goto cleanup;
3839                 }
3840                 /* src node for filter rule */
3841                 if ((r->rule_flag & PFRULE_SRCTRACK ||
3842                     r->rpool.opts & PF_POOL_STICKYADDR) &&
3843                     pf_insert_src_node(&sn, r, saddr, af) != 0) {
3844                         REASON_SET(&reason, PFRES_SRCLIMIT);
3845                         goto cleanup;
3846                 }
3847                 /* src node for translation rule */
3848                 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) &&
3849                     ((direction == PF_OUT &&
3850                     pf_insert_src_node(&nsn, nr, &pd->baddr, af) != 0) ||
3851                     (pf_insert_src_node(&nsn, nr, saddr, af) != 0))) {
3852                         REASON_SET(&reason, PFRES_SRCLIMIT);
3853                         goto cleanup;
3854                 }
3855                 s = pool_get(&pf_state_pl, PR_NOWAIT);
3856                 if (s == NULL) {
3857                         REASON_SET(&reason, PFRES_MEMORY);
3858 cleanup:
3859                         if (sn != NULL && sn->states == 0 && sn->expire == 0) {
3860                                 RB_REMOVE(pf_src_tree, &tree_src_tracking, sn);
3861                                 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
3862                                 pf_status.src_nodes--;
3863                                 pool_put(&pf_src_tree_pl, sn);
3864                         }
3865                         if (nsn != sn && nsn != NULL && nsn->states == 0 &&
3866                             nsn->expire == 0) {
3867                                 RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn);
3868                                 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
3869                                 pf_status.src_nodes--;
3870                                 pool_put(&pf_src_tree_pl, nsn);
3871                         }
3872                         return (PF_DROP);
3873                 }
3874                 bzero(s, sizeof(*s));
3875                 s->rule.ptr = r;
3876                 s->nat_rule.ptr = nr;
3877                 s->anchor.ptr = a;
3878                 STATE_INC_COUNTERS(s);
3879                 s->allow_opts = r->allow_opts;
3880                 s->log = r->log & PF_LOG_ALL;
3881                 if (nr != NULL)
3882                         s->log |= nr->log & PF_LOG_ALL;
3883                 s->proto = pd->proto;
3884                 s->direction = direction;
3885                 s->af = af;
3886                 if (direction == PF_OUT) {
3887                         PF_ACPY(&s->gwy.addr, saddr, af);
3888                         s->gwy.port = nport;
3889                         PF_ACPY(&s->ext.addr, daddr, af);
3890                         s->ext.port = 0;
3891                         if (nr != NULL) {
3892                                 PF_ACPY(&s->lan.addr, &pd->baddr, af);
3893                                 s->lan.port = bport;
3894                         } else {
3895                                 PF_ACPY(&s->lan.addr, &s->gwy.addr, af);
3896                                 s->lan.port = s->gwy.port;
3897                         }
3898                 } else {
3899                         PF_ACPY(&s->lan.addr, daddr, af);
3900                         s->lan.port = nport;
3901                         PF_ACPY(&s->ext.addr, saddr, af);
3902                         s->ext.port = 0;
3903                         if (nr != NULL) {
3904                                 PF_ACPY(&s->gwy.addr, &pd->baddr, af);
3905                                 s->gwy.port = bport;
3906                         } else {
3907                                 PF_ACPY(&s->gwy.addr, &s->lan.addr, af);
3908                                 s->gwy.port = s->lan.port;
3909                         }
3910                 }
3911                 s->hash = pf_state_hash(s);
3912                 s->creation = time_second;
3913                 s->expire = time_second;
3914                 s->timeout = PFTM_ICMP_FIRST_PACKET;
3915                 pf_set_rt_ifp(s, saddr);
3916                 if (sn != NULL) {
3917                         s->src_node = sn;
3918                         s->src_node->states++;
3919                 }
3920                 if (nsn != NULL) {
3921                         PF_ACPY(&nsn->raddr, &pd->naddr, af);
3922                         s->nat_src_node = nsn;
3923                         s->nat_src_node->states++;
3924                 }
3925                 if (pf_insert_state(BOUND_IFACE(r, kif), s)) {
3926                         REASON_SET(&reason, PFRES_STATEINS);
3927                         pf_src_tree_remove_state(s);
3928                         STATE_DEC_COUNTERS(s);
3929                         pool_put(&pf_state_pl, s);
3930                         return (PF_DROP);
3931                 } else
3932                         *sm = s;
3933                 if (tag > 0) {
3934                         pf_tag_ref(tag);
3935                         s->tag = tag;
3936                 }
3937         }
3938
3939 #ifdef INET6
3940         /* copy back packet headers if we performed IPv6 NAT operations */
3941         if (rewrite)
3942                 m_copyback(m, off, sizeof(struct icmp6_hdr),
3943                     (caddr_t)pd->hdr.icmp6);
3944 #endif /* INET6 */
3945
3946         return (PF_PASS);
3947 }
3948
3949 int
3950 pf_test_other(struct pf_rule **rm, struct pf_state **sm, int direction,
3951     struct pfi_kif *kif, struct mbuf *m, int off, void *h, struct pf_pdesc *pd,
3952     struct pf_rule **am, struct pf_ruleset **rsm, struct ifqueue *ifq)
3953 {
3954         struct pf_rule          *nr = NULL;
3955         struct pf_rule          *r, *a = NULL;
3956         struct pf_ruleset       *ruleset = NULL;
3957         struct pf_src_node      *nsn = NULL;
3958         struct pf_addr          *saddr = pd->src, *daddr = pd->dst;
3959         sa_family_t              af = pd->af;
3960         u_short                  reason;
3961         int                      tag = -1, rtableid = -1;
3962         int                      asd = 0;
3963         int                      match = 0;
3964
3965         if (pf_check_congestion(ifq)) {
3966                 REASON_SET(&reason, PFRES_CONGEST);
3967                 return (PF_DROP);
3968         }
3969
3970         r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
3971
3972         if (direction == PF_OUT) {
3973                 /* check outgoing packet for BINAT/NAT */
3974                 if ((nr = pf_get_translation(pd, m, off, PF_OUT, kif, &nsn,
3975                     saddr, 0, daddr, 0, &pd->naddr, NULL)) != NULL) {
3976                         PF_ACPY(&pd->baddr, saddr, af);
3977                         switch (af) {
3978 #ifdef INET
3979                         case AF_INET:
3980                                 pf_change_a(&saddr->v4.s_addr, pd->ip_sum,
3981                                     pd->naddr.v4.s_addr, 0);
3982                                 break;
3983 #endif /* INET */
3984 #ifdef INET6
3985                         case AF_INET6:
3986                                 PF_ACPY(saddr, &pd->naddr, af);
3987                                 break;
3988 #endif /* INET6 */
3989                         }
3990                         if (nr->natpass)
3991                                 r = NULL;
3992                         pd->nat_rule = nr;
3993                 }
3994         } else {
3995                 /* check incoming packet for BINAT/RDR */
3996                 if ((nr = pf_get_translation(pd, m, off, PF_IN, kif, &nsn,
3997                     saddr, 0, daddr, 0, &pd->naddr, NULL)) != NULL) {
3998                         PF_ACPY(&pd->baddr, daddr, af);
3999                         switch (af) {
4000 #ifdef INET
4001                         case AF_INET:
4002                                 pf_change_a(&daddr->v4.s_addr,
4003                                     pd->ip_sum, pd->naddr.v4.s_addr, 0);
4004                                 break;
4005 #endif /* INET */
4006 #ifdef INET6
4007                         case AF_INET6:
4008                                 PF_ACPY(daddr, &pd->naddr, af);
4009                                 break;
4010 #endif /* INET6 */
4011                         }
4012                         if (nr->natpass)
4013                                 r = NULL;
4014                         pd->nat_rule = nr;
4015                 }
4016         }
4017
4018         while (r != NULL) {
4019                 r->evaluations++;
4020                 if (pfi_kif_match(r->kif, kif) == r->ifnot)
4021                         r = r->skip[PF_SKIP_IFP].ptr;
4022                 else if (r->direction && r->direction != direction)
4023                         r = r->skip[PF_SKIP_DIR].ptr;
4024                 else if (r->af && r->af != af)
4025                         r = r->skip[PF_SKIP_AF].ptr;
4026                 else if (r->proto && r->proto != pd->proto)
4027                         r = r->skip[PF_SKIP_PROTO].ptr;
4028                 else if (PF_MISMATCHAW(&r->src.addr, pd->src, af,
4029                     r->src.neg, kif))
4030                         r = r->skip[PF_SKIP_SRC_ADDR].ptr;
4031                 else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af,
4032                     r->dst.neg, NULL))
4033                         r = r->skip[PF_SKIP_DST_ADDR].ptr;
4034                 else if (r->tos && !(r->tos == pd->tos))
4035                         r = TAILQ_NEXT(r, entries);
4036                 else if (r->rule_flag & PFRULE_FRAGMENT)
4037                         r = TAILQ_NEXT(r, entries);
4038                 else if (r->prob && r->prob <= karc4random())
4039                         r = TAILQ_NEXT(r, entries);
4040                 else if (r->match_tag && !pf_match_tag(m, r, pd->pf_mtag, &tag))
4041                         r = TAILQ_NEXT(r, entries);
4042                 else if (r->os_fingerprint != PF_OSFP_ANY)
4043                         r = TAILQ_NEXT(r, entries);
4044                 else {
4045                         if (r->tag)
4046                                 tag = r->tag;
4047                         if (r->rtableid >= 0)
4048                                 rtableid = r->rtableid;
4049                         if (r->anchor == NULL) {
4050                                 match = 1;
4051                                 *rm = r;
4052                                 *am = a;
4053                                 *rsm = ruleset;
4054                                 if ((*rm)->quick)
4055                                         break;
4056                                 r = TAILQ_NEXT(r, entries);
4057                         } else
4058                                 pf_step_into_anchor(&asd, &ruleset,
4059                                     PF_RULESET_FILTER, &r, &a, &match);
4060                 }
4061                 if (r == NULL && pf_step_out_of_anchor(&asd, &ruleset,
4062                     PF_RULESET_FILTER, &r, &a, &match))
4063                         break;
4064         }
4065         r = *rm;
4066         a = *am;
4067         ruleset = *rsm;
4068
4069         REASON_SET(&reason, PFRES_MATCH);
4070
4071         if (r->log || (nr != NULL && nr->natpass && nr->log))
4072                 PFLOG_PACKET(kif, h, m, af, direction, reason, r->log ? r : nr,
4073                     a, ruleset, pd);
4074
4075         if ((r->action == PF_DROP) &&
4076             ((r->rule_flag & PFRULE_RETURNICMP) ||
4077             (r->rule_flag & PFRULE_RETURN))) {
4078                 struct pf_addr *a = NULL;
4079
4080                 if (nr != NULL) {
4081                         if (direction == PF_OUT)
4082                                 a = saddr;
4083                         else
4084                                 a = daddr;
4085                 }
4086                 if (a != NULL) {
4087                         switch (af) {
4088 #ifdef INET
4089                         case AF_INET:
4090                                 pf_change_a(&a->v4.s_addr, pd->ip_sum,
4091                                     pd->baddr.v4.s_addr, 0);
4092                                 break;
4093 #endif /* INET */
4094 #ifdef INET6
4095                         case AF_INET6:
4096                                 PF_ACPY(a, &pd->baddr, af);
4097                                 break;
4098 #endif /* INET6 */
4099                         }
4100                 }
4101                 if ((af == AF_INET) && r->return_icmp)
4102                         pf_send_icmp(m, r->return_icmp >> 8,
4103                             r->return_icmp & 255, af, r);
4104                 else if ((af == AF_INET6) && r->return_icmp6)
4105                         pf_send_icmp(m, r->return_icmp6 >> 8,
4106                             r->return_icmp6 & 255, af, r);
4107         }
4108
4109         if (r->action != PF_PASS)
4110                 return (PF_DROP);
4111
4112         if (pf_tag_packet(m, pd->pf_mtag, tag, rtableid)) {
4113                 REASON_SET(&reason, PFRES_MEMORY);
4114                 return (PF_DROP);
4115         }
4116
4117         if (r->keep_state || nr != NULL) {
4118                 /* create new state */
4119                 struct pf_state *s = NULL;
4120                 struct pf_src_node *sn = NULL;
4121
4122                 /* check maximums */
4123                 if (r->max_states && (r->states >= r->max_states)) {
4124                         pf_status.lcounters[LCNT_STATES]++;
4125                         REASON_SET(&reason, PFRES_MAXSTATES);
4126                         goto cleanup;
4127                 }
4128                 /* src node for filter rule */
4129                 if ((r->rule_flag & PFRULE_SRCTRACK ||
4130                     r->rpool.opts & PF_POOL_STICKYADDR) &&
4131                     pf_insert_src_node(&sn, r, saddr, af) != 0) {
4132                         REASON_SET(&reason, PFRES_SRCLIMIT);
4133                         goto cleanup;
4134                 }
4135                 /* src node for translation rule */
4136                 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) &&
4137                     ((direction == PF_OUT &&
4138                     pf_insert_src_node(&nsn, nr, &pd->baddr, af) != 0) ||
4139                     (pf_insert_src_node(&nsn, nr, saddr, af) != 0))) {
4140                         REASON_SET(&reason, PFRES_SRCLIMIT);
4141                         goto cleanup;
4142                 }
4143                 s = pool_get(&pf_state_pl, PR_NOWAIT);
4144                 if (s == NULL) {
4145                         REASON_SET(&reason, PFRES_MEMORY);
4146 cleanup:
4147                         if (sn != NULL && sn->states == 0 && sn->expire == 0) {
4148                                 RB_REMOVE(pf_src_tree, &tree_src_tracking, sn);
4149                                 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
4150                                 pf_status.src_nodes--;
4151                                 pool_put(&pf_src_tree_pl, sn);
4152                         }
4153                         if (nsn != sn && nsn != NULL && nsn->states == 0 &&
4154                             nsn->expire == 0) {
4155                                 RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn);
4156                                 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
4157                                 pf_status.src_nodes--;
4158                                 pool_put(&pf_src_tree_pl, nsn);
4159                         }
4160                         return (PF_DROP);
4161                 }
4162                 bzero(s, sizeof(*s));
4163                 s->rule.ptr = r;
4164                 s->nat_rule.ptr = nr;
4165                 s->anchor.ptr = a;
4166                 STATE_INC_COUNTERS(s);
4167                 s->allow_opts = r->allow_opts;
4168                 s->log = r->log & PF_LOG_ALL;
4169                 if (nr != NULL)
4170                         s->log |= nr->log & PF_LOG_ALL;
4171                 s->proto = pd->proto;
4172                 s->direction = direction;
4173                 s->af = af;
4174                 if (direction == PF_OUT) {
4175                         PF_ACPY(&s->gwy.addr, saddr, af);
4176                         PF_ACPY(&s->ext.addr, daddr, af);
4177                         if (nr != NULL)
4178                                 PF_ACPY(&s->lan.addr, &pd->baddr, af);
4179                         else
4180                                 PF_ACPY(&s->lan.addr, &s->gwy.addr, af);
4181                 } else {
4182                         PF_ACPY(&s->lan.addr, daddr, af);
4183                         PF_ACPY(&s->ext.addr, saddr, af);
4184                         if (nr != NULL)
4185                                 PF_ACPY(&s->gwy.addr, &pd->baddr, af);
4186                         else
4187                                 PF_ACPY(&s->gwy.addr, &s->lan.addr, af);
4188                 }
4189                 s->hash = pf_state_hash(s);
4190                 s->src.state = PFOTHERS_SINGLE;
4191                 s->dst.state = PFOTHERS_NO_TRAFFIC;
4192                 s->creation = time_second;
4193                 s->expire = time_second;
4194                 s->timeout = PFTM_OTHER_FIRST_PACKET;
4195                 pf_set_rt_ifp(s, saddr);
4196                 if (sn != NULL) {
4197                         s->src_node = sn;
4198                         s->src_node->states++;
4199                 }
4200                 if (nsn != NULL) {
4201                         PF_ACPY(&nsn->raddr, &pd->naddr, af);
4202                         s->nat_src_node = nsn;
4203                         s->nat_src_node->states++;
4204                 }
4205                 if (pf_insert_state(BOUND_IFACE(r, kif), s)) {
4206                         REASON_SET(&reason, PFRES_STATEINS);
4207                         pf_src_tree_remove_state(s);
4208                         STATE_DEC_COUNTERS(s);
4209                         pool_put(&pf_state_pl, s);
4210                         return (PF_DROP);
4211                 } else
4212                         *sm = s;
4213                 if (tag > 0) {
4214                         pf_tag_ref(tag);
4215                         s->tag = tag;
4216                 }
4217         }
4218
4219         return (PF_PASS);
4220 }
4221
4222 int
4223 pf_test_fragment(struct pf_rule **rm, int direction, struct pfi_kif *kif,
4224     struct mbuf *m, void *h, struct pf_pdesc *pd, struct pf_rule **am,
4225     struct pf_ruleset **rsm)
4226 {
4227         struct pf_rule          *r, *a = NULL;
4228         struct pf_ruleset       *ruleset = NULL;
4229         sa_family_t              af = pd->af;
4230         u_short                  reason;
4231         int                      tag = -1;
4232         int                      asd = 0;
4233         int                      match = 0;
4234
4235         r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
4236         while (r != NULL) {
4237                 r->evaluations++;
4238                 if (pfi_kif_match(r->kif, kif) == r->ifnot)
4239                         r = r->skip[PF_SKIP_IFP].ptr;
4240                 else if (r->direction && r->direction != direction)
4241                         r = r->skip[PF_SKIP_DIR].ptr;
4242                 else if (r->af && r->af != af)
4243                         r = r->skip[PF_SKIP_AF].ptr;
4244                 else if (r->proto && r->proto != pd->proto)
4245                         r = r->skip[PF_SKIP_PROTO].ptr;
4246                 else if (PF_MISMATCHAW(&r->src.addr, pd->src, af,
4247                     r->src.neg, kif))
4248                         r = r->skip[PF_SKIP_SRC_ADDR].ptr;
4249                 else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af,
4250                     r->dst.neg, NULL))
4251                         r = r->skip[PF_SKIP_DST_ADDR].ptr;
4252                 else if (r->tos && !(r->tos == pd->tos))
4253                         r = TAILQ_NEXT(r, entries);
4254                 else if (r->os_fingerprint != PF_OSFP_ANY)
4255                         r = TAILQ_NEXT(r, entries);
4256                 else if (pd->proto == IPPROTO_UDP &&
4257                     (r->src.port_op || r->dst.port_op))
4258                         r = TAILQ_NEXT(r, entries);
4259                 else if (pd->proto == IPPROTO_TCP &&
4260                     (r->src.port_op || r->dst.port_op || r->flagset))
4261                         r = TAILQ_NEXT(r, entries);
4262                 else if ((pd->proto == IPPROTO_ICMP ||
4263                     pd->proto == IPPROTO_ICMPV6) &&
4264                     (r->type || r->code))
4265                         r = TAILQ_NEXT(r, entries);
4266                 else if (r->prob && r->prob <= karc4random())
4267                         r = TAILQ_NEXT(r, entries);
4268                 else if (r->match_tag && !pf_match_tag(m, r, NULL, &tag))
4269                         r = TAILQ_NEXT(r, entries);
4270                 else {
4271                         if (r->anchor == NULL) {
4272                                 match = 1;
4273                                 *rm = r;
4274                                 *am = a;
4275                                 *rsm = ruleset;
4276                                 if ((*rm)->quick)
4277                                         break;
4278                                 r = TAILQ_NEXT(r, entries);
4279                         } else
4280                                 pf_step_into_anchor(&asd, &ruleset,
4281                                     PF_RULESET_FILTER, &r, &a, &match);
4282                 }
4283                 if (r == NULL && pf_step_out_of_anchor(&asd, &ruleset,
4284                     PF_RULESET_FILTER, &r, &a, &match))
4285                         break;
4286         }
4287         r = *rm;
4288         a = *am;
4289         ruleset = *rsm;
4290
4291         REASON_SET(&reason, PFRES_MATCH);
4292
4293         if (r->log)
4294                 PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset,
4295                     pd);
4296
4297         if (r->action != PF_PASS)
4298                 return (PF_DROP);
4299
4300         if (pf_tag_packet(m, pd->pf_mtag, tag, -1)) {
4301                 REASON_SET(&reason, PFRES_MEMORY);
4302                 return (PF_DROP);
4303         }
4304
4305         return (PF_PASS);
4306 }
4307
4308 int
4309 pf_test_state_tcp(struct pf_state **state, int direction, struct pfi_kif *kif,
4310     struct mbuf *m, int off, void *h, struct pf_pdesc *pd,
4311     u_short *reason)
4312 {
4313         struct pf_state_cmp      key;
4314         struct tcphdr           *th = pd->hdr.tcp;
4315         u_int16_t                win = ntohs(th->th_win);
4316         u_int32_t                ack, end, seq, orig_seq;
4317         u_int8_t                 sws, dws;
4318         int                      ackskew;
4319         int                      copyback = 0;
4320         struct pf_state_peer    *src, *dst;
4321
4322         key.af = pd->af;
4323         key.proto = IPPROTO_TCP;
4324         if (direction == PF_IN) {
4325                 PF_ACPY(&key.ext.addr, pd->src, key.af);
4326                 PF_ACPY(&key.gwy.addr, pd->dst, key.af);
4327                 key.ext.port = th->th_sport;
4328                 key.gwy.port = th->th_dport;
4329         } else {
4330                 PF_ACPY(&key.lan.addr, pd->src, key.af);
4331                 PF_ACPY(&key.ext.addr, pd->dst, key.af);
4332                 key.lan.port = th->th_sport;
4333                 key.ext.port = th->th_dport;
4334         }
4335
4336         STATE_LOOKUP();
4337
4338         if (direction == (*state)->direction) {
4339                 src = &(*state)->src;
4340                 dst = &(*state)->dst;
4341         } else {
4342                 src = &(*state)->dst;
4343                 dst = &(*state)->src;
4344         }
4345
4346         if ((*state)->src.state == PF_TCPS_PROXY_SRC) {
4347                 if (direction != (*state)->direction) {
4348                         REASON_SET(reason, PFRES_SYNPROXY);
4349                         return (PF_SYNPROXY_DROP);
4350                 }
4351                 if (th->th_flags & TH_SYN) {
4352                         if (ntohl(th->th_seq) != (*state)->src.seqlo) {
4353                                 REASON_SET(reason, PFRES_SYNPROXY);
4354                                 return (PF_DROP);
4355                         }
4356                         pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst,
4357                             pd->src, th->th_dport, th->th_sport,
4358                             (*state)->src.seqhi, ntohl(th->th_seq) + 1,
4359                             TH_SYN|TH_ACK, 0, (*state)->src.mss, 0, 1,
4360                             0, NULL, NULL);
4361                         REASON_SET(reason, PFRES_SYNPROXY);
4362                         return (PF_SYNPROXY_DROP);
4363                 } else if (!(th->th_flags & TH_ACK) ||
4364                     (ntohl(th->th_ack) != (*state)->src.seqhi + 1) ||
4365                     (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) {
4366                         REASON_SET(reason, PFRES_SYNPROXY);
4367                         return (PF_DROP);
4368                 } else if ((*state)->src_node != NULL &&
4369                     pf_src_connlimit(state)) {
4370                         REASON_SET(reason, PFRES_SRCLIMIT);
4371                         return (PF_DROP);
4372                 } else
4373                         (*state)->src.state = PF_TCPS_PROXY_DST;
4374         }
4375         if ((*state)->src.state == PF_TCPS_PROXY_DST) {
4376                 struct pf_state_host *src, *dst;
4377
4378                 if (direction == PF_OUT) {
4379                         src = &(*state)->gwy;
4380                         dst = &(*state)->ext;
4381                 } else {
4382                         src = &(*state)->ext;
4383                         dst = &(*state)->lan;
4384                 }
4385                 if (direction == (*state)->direction) {
4386                         if (((th->th_flags & (TH_SYN|TH_ACK)) != TH_ACK) ||
4387                             (ntohl(th->th_ack) != (*state)->src.seqhi + 1) ||
4388                             (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) {
4389                                 REASON_SET(reason, PFRES_SYNPROXY);
4390                                 return (PF_DROP);
4391                         }
4392                         (*state)->src.max_win = MAX(ntohs(th->th_win), 1);
4393                         if ((*state)->dst.seqhi == 1)
4394                                 (*state)->dst.seqhi = htonl(karc4random());
4395                         pf_send_tcp((*state)->rule.ptr, pd->af, &src->addr,
4396                             &dst->addr, src->port, dst->port,
4397                             (*state)->dst.seqhi, 0, TH_SYN, 0,
4398                             (*state)->src.mss, 0, 0, (*state)->tag, NULL, NULL);
4399                         REASON_SET(reason, PFRES_SYNPROXY);
4400                         return (PF_SYNPROXY_DROP);
4401                 } else if (((th->th_flags & (TH_SYN|TH_ACK)) !=
4402                     (TH_SYN|TH_ACK)) ||
4403                     (ntohl(th->th_ack) != (*state)->dst.seqhi + 1)) {
4404                         REASON_SET(reason, PFRES_SYNPROXY);
4405                         return (PF_DROP);
4406                 } else {
4407                         (*state)->dst.max_win = MAX(ntohs(th->th_win), 1);
4408                         (*state)->dst.seqlo = ntohl(th->th_seq);
4409                         pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst,
4410                             pd->src, th->th_dport, th->th_sport,
4411                             ntohl(th->th_ack), ntohl(th->th_seq) + 1,
4412                             TH_ACK, (*state)->src.max_win, 0, 0, 0,
4413                             (*state)->tag, NULL, NULL);
4414                         pf_send_tcp((*state)->rule.ptr, pd->af, &src->addr,
4415                             &dst->addr, src->port, dst->port,
4416                             (*state)->src.seqhi + 1, (*state)->src.seqlo + 1,
4417                             TH_ACK, (*state)->dst.max_win, 0, 0, 1,
4418                             0, NULL, NULL);
4419                         (*state)->src.seqdiff = (*state)->dst.seqhi -
4420                             (*state)->src.seqlo;
4421                         (*state)->dst.seqdiff = (*state)->src.seqhi -
4422                             (*state)->dst.seqlo;
4423                         (*state)->src.seqhi = (*state)->src.seqlo +
4424                             (*state)->dst.max_win;
4425                         (*state)->dst.seqhi = (*state)->dst.seqlo +
4426                             (*state)->src.max_win;
4427                         (*state)->src.wscale = (*state)->dst.wscale = 0;
4428                         (*state)->src.state = (*state)->dst.state =
4429                             TCPS_ESTABLISHED;
4430                         REASON_SET(reason, PFRES_SYNPROXY);
4431                         return (PF_SYNPROXY_DROP);
4432                 }
4433         }
4434
4435         if (src->wscale && dst->wscale && !(th->th_flags & TH_SYN)) {
4436                 sws = src->wscale & PF_WSCALE_MASK;
4437                 dws = dst->wscale & PF_WSCALE_MASK;
4438         } else
4439                 sws = dws = 0;
4440
4441         /*
4442          * Sequence tracking algorithm from Guido van Rooij's paper:
4443          *   http://www.madison-gurkha.com/publications/tcp_filtering/
4444          *      tcp_filtering.ps
4445          */
4446
4447         orig_seq = seq = ntohl(th->th_seq);
4448         if (src->seqlo == 0) {
4449                 /* First packet from this end. Set its state */
4450
4451                 if ((pd->flags & PFDESC_TCP_NORM || dst->scrub) &&
4452                     src->scrub == NULL) {
4453                         if (pf_normalize_tcp_init(m, off, pd, th, src, dst)) {
4454                                 REASON_SET(reason, PFRES_MEMORY);
4455                                 return (PF_DROP);
4456                         }
4457                 }
4458
4459                 /* Deferred generation of sequence number modulator */
4460                 if (dst->seqdiff && !src->seqdiff) {
4461                         while ((src->seqdiff = pf_new_isn(*state) - seq) == 0)
4462                                 ;
4463                         ack = ntohl(th->th_ack) - dst->seqdiff;
4464                         pf_change_a(&th->th_seq, &th->th_sum, htonl(seq +
4465                             src->seqdiff), 0);
4466                         pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0);
4467                         copyback = 1;
4468                 } else {
4469                         ack = ntohl(th->th_ack);
4470                 }
4471
4472                 end = seq + pd->p_len;
4473                 if (th->th_flags & TH_SYN) {
4474                         end++;
4475                         (*state)->sync_flags |= PFSTATE_GOT_SYN2;
4476                         if (dst->wscale & PF_WSCALE_FLAG) {
4477                                 src->wscale = pf_get_wscale(m, off, th->th_off,
4478                                     pd->af);
4479                                 if (src->wscale & PF_WSCALE_FLAG) {
4480                                         /* Remove scale factor from initial
4481                                          * window */
4482                                         sws = src->wscale & PF_WSCALE_MASK;
4483                                         win = ((u_int32_t)win + (1 << sws) - 1)
4484                                             >> sws;
4485                                         dws = dst->wscale & PF_WSCALE_MASK;
4486                                 } else {
4487                                         /* fixup other window */
4488                                         dst->max_win <<= dst->wscale &
4489                                             PF_WSCALE_MASK;
4490                                         /* in case of a retrans SYN|ACK */
4491                                         dst->wscale = 0;
4492                                 }
4493                         }
4494                 }
4495                 if (th->th_flags & TH_FIN)
4496                         end++;
4497
4498                 src->seqlo = seq;
4499                 if (src->state < TCPS_SYN_SENT)
4500                         src->state = TCPS_SYN_SENT;
4501
4502                 /*
4503                  * May need to slide the window (seqhi may have been set by
4504                  * the crappy stack check or if we picked up the connection
4505                  * after establishment)
4506                  */
4507                 if (src->seqhi == 1 ||
4508                     SEQ_GEQ(end + MAX(1, dst->max_win << dws), src->seqhi))
4509                         src->seqhi = end + MAX(1, dst->max_win << dws);
4510                 if (win > src->max_win)
4511                         src->max_win = win;
4512
4513         } else {
4514                 ack = ntohl(th->th_ack) - dst->seqdiff;
4515                 if (src->seqdiff) {
4516                         /* Modulate sequence numbers */
4517                         pf_change_a(&th->th_seq, &th->th_sum, htonl(seq +
4518                             src->seqdiff), 0);
4519                         pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0);
4520                         copyback = 1;
4521                 }
4522                 end = seq + pd->p_len;
4523                 if (th->th_flags & TH_SYN)
4524                         end++;
4525                 if (th->th_flags & TH_FIN)
4526                         end++;
4527         }
4528
4529         if ((th->th_flags & TH_ACK) == 0) {
4530                 /* Let it pass through the ack skew check */
4531                 ack = dst->seqlo;
4532         } else if ((ack == 0 &&
4533             (th->th_flags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) ||
4534             /* broken tcp stacks do not set ack */
4535             (dst->state < TCPS_SYN_SENT)) {
4536                 /*
4537                  * Many stacks (ours included) will set the ACK number in an
4538                  * FIN|ACK if the SYN times out -- no sequence to ACK.
4539                  */
4540                 ack = dst->seqlo;
4541         }
4542
4543         if (seq == end) {
4544                 /* Ease sequencing restrictions on no data packets */
4545                 seq = src->seqlo;
4546                 end = seq;
4547         }
4548
4549         ackskew = dst->seqlo - ack;
4550
4551
4552         /*
4553          * Need to demodulate the sequence numbers in any TCP SACK options
4554          * (Selective ACK). We could optionally validate the SACK values
4555          * against the current ACK window, either forwards or backwards, but
4556          * I'm not confident that SACK has been implemented properly
4557          * everywhere. It wouldn't surprise me if several stacks accidently
4558          * SACK too far backwards of previously ACKed data. There really aren't
4559          * any security implications of bad SACKing unless the target stack
4560          * doesn't validate the option length correctly. Someone trying to
4561          * spoof into a TCP connection won't bother blindly sending SACK
4562          * options anyway.
4563          */
4564         if (dst->seqdiff && (th->th_off << 2) > sizeof(struct tcphdr)) {
4565                 if (pf_modulate_sack(m, off, pd, th, dst))
4566                         copyback = 1;
4567         }
4568
4569
4570 #define MAXACKWINDOW (0xffff + 1500)    /* 1500 is an arbitrary fudge factor */
4571         if (SEQ_GEQ(src->seqhi, end) &&
4572             /* Last octet inside other's window space */
4573             SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) &&
4574             /* Retrans: not more than one window back */
4575             (ackskew >= -MAXACKWINDOW) &&
4576             /* Acking not more than one reassembled fragment backwards */
4577             (ackskew <= (MAXACKWINDOW << sws)) &&
4578             /* Acking not more than one window forward */
4579             ((th->th_flags & TH_RST) == 0 || orig_seq == src->seqlo ||
4580             (orig_seq == src->seqlo + 1) || (pd->flags & PFDESC_IP_REAS) == 0)) {
4581             /* Require an exact/+1 sequence match on resets when possible */
4582
4583                 if (dst->scrub || src->scrub) {
4584                         if (pf_normalize_tcp_stateful(m, off, pd, reason, th,
4585                             *state, src, dst, &copyback))
4586                                 return (PF_DROP);
4587                 }
4588
4589                 /* update max window */
4590                 if (src->max_win < win)
4591                         src->max_win = win;
4592                 /* synchronize sequencing */
4593                 if (SEQ_GT(end, src->seqlo))
4594                         src->seqlo = end;
4595                 /* slide the window of what the other end can send */
4596                 if (SEQ_GEQ(ack + (win << sws), dst->seqhi))
4597                         dst->seqhi = ack + MAX((win << sws), 1);
4598
4599
4600                 /* update states */
4601                 if (th->th_flags & TH_SYN)
4602                         if (src->state < TCPS_SYN_SENT)
4603                                 src->state = TCPS_SYN_SENT;
4604                 if (th->th_flags & TH_FIN)
4605                         if (src->state < TCPS_CLOSING)
4606                                 src->state = TCPS_CLOSING;
4607                 if (th->th_flags & TH_ACK) {
4608                         if (dst->state == TCPS_SYN_SENT) {
4609                                 dst->state = TCPS_ESTABLISHED;
4610                                 if (src->state == TCPS_ESTABLISHED &&
4611                                     (*state)->src_node != NULL &&
4612                                     pf_src_connlimit(state)) {
4613                                         REASON_SET(reason, PFRES_SRCLIMIT);
4614                                         return (PF_DROP);
4615                                 }
4616                         } else if (dst->state == TCPS_CLOSING)
4617                                 dst->state = TCPS_FIN_WAIT_2;
4618                 }
4619                 if (th->th_flags & TH_RST)
4620                         src->state = dst->state = TCPS_TIME_WAIT;
4621
4622                 /* update expire time */
4623                 (*state)->expire = time_second;
4624                 if (src->state >= TCPS_FIN_WAIT_2 &&
4625                     dst->state >= TCPS_FIN_WAIT_2)
4626                         (*state)->timeout = PFTM_TCP_CLOSED;
4627                 else if (src->state >= TCPS_CLOSING &&
4628                     dst->state >= TCPS_CLOSING)
4629                         (*state)->timeout = PFTM_TCP_FIN_WAIT;
4630                 else if (src->state < TCPS_ESTABLISHED ||
4631                     dst->state < TCPS_ESTABLISHED)
4632                         (*state)->timeout = PFTM_TCP_OPENING;
4633                 else if (src->state >= TCPS_CLOSING ||
4634                     dst->state >= TCPS_CLOSING)
4635                         (*state)->timeout = PFTM_TCP_CLOSING;
4636                 else
4637                         (*state)->timeout = PFTM_TCP_ESTABLISHED;
4638
4639                 /* Fall through to PASS packet */
4640
4641         } else if ((dst->state < TCPS_SYN_SENT ||
4642                 dst->state >= TCPS_FIN_WAIT_2 ||
4643                 src->state >= TCPS_FIN_WAIT_2) &&
4644             SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) &&
4645             /* Within a window forward of the originating packet */
4646             SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW)) {
4647             /* Within a window backward of the originating packet */
4648
4649                 /*
4650                  * This currently handles three situations:
4651                  *  1) Stupid stacks will shotgun SYNs before their peer
4652                  *     replies.
4653                  *  2) When PF catches an already established stream (the
4654                  *     firewall rebooted, the state table was flushed, routes
4655                  *     changed...)
4656                  *  3) Packets get funky immediately after the connection
4657                  *     closes (this should catch Solaris spurious ACK|FINs
4658                  *     that web servers like to spew after a close)
4659                  *
4660                  * This must be a little more careful than the above code
4661                  * since packet floods will also be caught here. We don't
4662                  * update the TTL here to mitigate the damage of a packet
4663                  * flood and so the same code can handle awkward establishment
4664                  * and a loosened connection close.
4665                  * In the establishment case, a correct peer response will
4666                  * validate the connection, go through the normal state code
4667                  * and keep updating the state TTL.
4668                  */
4669
4670                 if (pf_status.debug >= PF_DEBUG_MISC) {
4671                         kprintf("pf: loose state match: ");
4672                         pf_print_state(*state);
4673                         pf_print_flags(th->th_flags);
4674                         kprintf(" seq=%u (%u) ack=%u len=%u ackskew=%d "
4675                             "pkts=%llu:%llu\n", seq, orig_seq, ack, pd->p_len,
4676                             ackskew, (unsigned long long)(*state)->packets[0],
4677                             (unsigned long long)(*state)->packets[1]);
4678                 }
4679
4680                 if (dst->scrub || src->scrub) {
4681                         if (pf_normalize_tcp_stateful(m, off, pd, reason, th,
4682                             *state, src, dst, &copyback))
4683                                 return (PF_DROP);
4684                 }
4685
4686                 /* update max window */
4687                 if (src->max_win < win)
4688                         src->max_win = win;
4689                 /* synchronize sequencing */
4690                 if (SEQ_GT(end, src->seqlo))
4691                         src->seqlo = end;
4692                 /* slide the window of what the other end can send */
4693                 if (SEQ_GEQ(ack + (win << sws), dst->seqhi))
4694                         dst->seqhi = ack + MAX((win << sws), 1);
4695
4696                 /*
4697                  * Cannot set dst->seqhi here since this could be a shotgunned
4698                  * SYN and not an already established connection.
4699                  */
4700
4701                 if (th->th_flags & TH_FIN)
4702                         if (src->state < TCPS_CLOSING)
4703                                 src->state = TCPS_CLOSING;
4704                 if (th->th_flags & TH_RST)
4705                         src->state = dst->state = TCPS_TIME_WAIT;
4706
4707                 /* Fall through to PASS packet */
4708
4709         } else if ((*state)->pickup_mode == PF_PICKUPS_HASHONLY ||
4710                     ((*state)->pickup_mode == PF_PICKUPS_ENABLED &&
4711                      ((*state)->sync_flags & PFSTATE_GOT_SYN_MASK) !=
4712                       PFSTATE_GOT_SYN_MASK)) {
4713                 /*
4714                  * If pickup mode is hash only, do not fail on sequence checks.
4715                  *
4716                  * If pickup mode is enabled and we did not see the SYN in
4717                  * both direction, do not fail on sequence checks because
4718                  * we do not have complete information on window scale.
4719                  *
4720                  * Adjust expiration and fall through to PASS packet.
4721                  * XXX Add a FIN check to reduce timeout?
4722                  */
4723                 (*state)->expire = time_second;
4724         } else  {
4725                 /*
4726                  * Failure processing
4727                  */
4728                 if ((*state)->dst.state == TCPS_SYN_SENT &&
4729                     (*state)->src.state == TCPS_SYN_SENT) {
4730                         /* Send RST for state mismatches during handshake */
4731                         if (!(th->th_flags & TH_RST))
4732                                 pf_send_tcp((*state)->rule.ptr, pd->af,
4733                                     pd->dst, pd->src, th->th_dport,
4734                                     th->th_sport, ntohl(th->th_ack), 0,
4735                                     TH_RST, 0, 0,
4736                                     (*state)->rule.ptr->return_ttl, 1, 0,
4737                                     pd->eh, kif->pfik_ifp);
4738                         src->seqlo = 0;
4739                         src->seqhi = 1;
4740                         src->max_win = 1;
4741                 } else if (pf_status.debug >= PF_DEBUG_MISC) {
4742                         kprintf("pf: BAD state: ");
4743                         pf_print_state(*state);
4744                         pf_print_flags(th->th_flags);
4745                         kprintf(" seq=%u (%u) ack=%u len=%u ackskew=%d "
4746                             "pkts=%llu:%llu dir=%s,%s\n",
4747                             seq, orig_seq, ack, pd->p_len, ackskew,
4748                             (unsigned long long)(*state)->packets[0],
4749                                 (unsigned long long)(*state)->packets[1],
4750                             direction == PF_IN ? "in" : "out",
4751                             direction == (*state)->direction ? "fwd" : "rev");
4752                         kprintf("pf: State failure on: %c %c %c %c | %c %c\n",
4753                             SEQ_GEQ(src->seqhi, end) ? ' ' : '1',
4754                             SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) ?
4755                             ' ': '2',
4756                             (ackskew >= -MAXACKWINDOW) ? ' ' : '3',
4757                             (ackskew <= (MAXACKWINDOW << sws)) ? ' ' : '4',
4758                             SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) ?' ' :'5',
4759                             SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW) ?' ' :'6');
4760                 }
4761                 REASON_SET(reason, PFRES_BADSTATE);
4762                 return (PF_DROP);
4763         }
4764
4765         /* Any packets which have gotten here are to be passed */
4766
4767         /* translate source/destination address, if necessary */
4768         if (STATE_TRANSLATE(*state)) {
4769                 if (direction == PF_OUT) {
4770                         pf_change_ap(pd->src, &th->th_sport, pd->ip_sum,
4771                             &th->th_sum, &(*state)->gwy.addr,
4772                             (*state)->gwy.port, 0, pd->af);
4773                 } else {
4774                         /*
4775                          * If we don't redispatch the packet will go into
4776                          * the protocol stack on the wrong cpu for the
4777                          * post-translated address.
4778                          */
4779                         m->m_pkthdr.fw_flags |= FW_MBUF_REDISPATCH;
4780                         pf_change_ap(pd->dst, &th->th_dport, pd->ip_sum,
4781                             &th->th_sum, &(*state)->lan.addr,
4782                             (*state)->lan.port, 0, pd->af);
4783                 }
4784                 m_copyback(m, off, sizeof(*th), (caddr_t)th);
4785         } else if (copyback) {
4786                 /* Copyback sequence modulation or stateful scrub changes */
4787                 m_copyback(m, off, sizeof(*th), (caddr_t)th);
4788         }
4789
4790         return (PF_PASS);
4791 }
4792
4793 int
4794 pf_test_state_udp(struct pf_state **state, int direction, struct pfi_kif *kif,
4795     struct mbuf *m, int off, void *h, struct pf_pdesc *pd)
4796 {
4797         struct pf_state_peer    *src, *dst;
4798         struct pf_state_cmp      key;
4799         struct udphdr           *uh = pd->hdr.udp;
4800
4801         key.af = pd->af;
4802         key.proto = IPPROTO_UDP;
4803         if (direction == PF_IN) {
4804                 PF_ACPY(&key.ext.addr, pd->src, key.af);
4805                 PF_ACPY(&key.gwy.addr, pd->dst, key.af);
4806                 key.ext.port = uh->uh_sport;
4807                 key.gwy.port = uh->uh_dport;
4808         } else {
4809                 PF_ACPY(&key.lan.addr, pd->src, key.af);
4810                 PF_ACPY(&key.ext.addr, pd->dst, key.af);
4811                 key.lan.port = uh->uh_sport;
4812                 key.ext.port = uh->uh_dport;
4813         }
4814
4815         STATE_LOOKUP();
4816
4817         if (direction == (*state)->direction) {
4818                 src = &(*state)->src;
4819                 dst = &(*state)->dst;
4820         } else {
4821                 src = &(*state)->dst;
4822                 dst = &(*state)->src;
4823         }
4824
4825         /* update states */
4826         if (src->state < PFUDPS_SINGLE)
4827                 src->state = PFUDPS_SINGLE;
4828         if (dst->state == PFUDPS_SINGLE)
4829                 dst->state = PFUDPS_MULTIPLE;
4830
4831         /* update expire time */
4832         (*state)->expire = time_second;
4833         if (src->state == PFUDPS_MULTIPLE && dst->state == PFUDPS_MULTIPLE)
4834                 (*state)->timeout = PFTM_UDP_MULTIPLE;
4835         else
4836                 (*state)->timeout = PFTM_UDP_SINGLE;
4837
4838         /* translate source/destination address, if necessary */
4839         if (STATE_TRANSLATE(*state)) {
4840                 if (direction == PF_OUT) {
4841                         pf_change_ap(pd->src, &uh->uh_sport, pd->ip_sum,
4842                             &uh->uh_sum, &(*state)->gwy.addr,
4843                             (*state)->gwy.port, 1, pd->af);
4844                 } else {
4845                         /*
4846                          * If we don't redispatch the packet will go into
4847                          * the protocol stack on the wrong cpu for the
4848                          * post-translated address.
4849                          */
4850                         m->m_pkthdr.fw_flags |= FW_MBUF_REDISPATCH;
4851                         pf_change_ap(pd->dst, &uh->uh_dport, pd->ip_sum,
4852                             &uh->uh_sum, &(*state)->lan.addr,
4853                             (*state)->lan.port, 1, pd->af);
4854                 }
4855                 m_copyback(m, off, sizeof(*uh), (caddr_t)uh);
4856         }
4857
4858         return (PF_PASS);
4859 }
4860
4861 int
4862 pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif,
4863     struct mbuf *m, int off, void *h, struct pf_pdesc *pd, u_short *reason)
4864 {
4865         struct pf_addr  *saddr = pd->src, *daddr = pd->dst;
4866         u_int16_t        icmpid = 0, *icmpsum;
4867         u_int8_t         icmptype;
4868         int              state_icmp = 0;
4869         struct pf_state_cmp key;
4870
4871         switch (pd->proto) {
4872 #ifdef INET
4873         case IPPROTO_ICMP:
4874                 icmptype = pd->hdr.icmp->icmp_type;
4875                 icmpid = pd->hdr.icmp->icmp_id;
4876                 icmpsum = &pd->hdr.icmp->icmp_cksum;
4877
4878                 if (icmptype == ICMP_UNREACH ||
4879                     icmptype == ICMP_SOURCEQUENCH ||
4880                     icmptype == ICMP_REDIRECT ||
4881                     icmptype == ICMP_TIMXCEED ||
4882                     icmptype == ICMP_PARAMPROB)
4883                         state_icmp++;
4884                 break;
4885 #endif /* INET */
4886 #ifdef INET6
4887         case IPPROTO_ICMPV6:
4888                 icmptype = pd->hdr.icmp6->icmp6_type;
4889                 icmpid = pd->hdr.icmp6->icmp6_id;
4890                 icmpsum = &pd->hdr.icmp6->icmp6_cksum;
4891
4892                 if (icmptype == ICMP6_DST_UNREACH ||
4893                     icmptype == ICMP6_PACKET_TOO_BIG ||
4894                     icmptype == ICMP6_TIME_EXCEEDED ||
4895                     icmptype == ICMP6_PARAM_PROB)
4896                         state_icmp++;
4897                 break;
4898 #endif /* INET6 */
4899         }
4900
4901         if (!state_icmp) {
4902
4903                 /*
4904                  * ICMP query/reply message not related to a TCP/UDP packet.
4905                  * Search for an ICMP state.
4906                  */
4907                 key.af = pd->af;
4908                 key.proto = pd->proto;
4909                 if (direction == PF_IN) {
4910                         PF_ACPY(&key.ext.addr, pd->src, key.af);
4911                         PF_ACPY(&key.gwy.addr, pd->dst, key.af);
4912                         key.ext.port = 0;
4913                         key.gwy.port = icmpid;
4914                 } else {
4915                         PF_ACPY(&key.lan.addr, pd->src, key.af);
4916                         PF_ACPY(&key.ext.addr, pd->dst, key.af);
4917                         key.lan.port = icmpid;
4918                         key.ext.port = 0;
4919                 }
4920
4921                 STATE_LOOKUP();
4922
4923                 (*state)->expire = time_second;
4924                 (*state)->timeout = PFTM_ICMP_ERROR_REPLY;
4925
4926                 /* translate source/destination address, if necessary */
4927                 if (STATE_TRANSLATE(*state)) {
4928                         if (direction == PF_OUT) {
4929                                 switch (pd->af) {
4930 #ifdef INET
4931                                 case AF_INET:
4932                                         pf_change_a(&saddr->v4.s_addr,
4933                                             pd->ip_sum,
4934                                             (*state)->gwy.addr.v4.s_addr, 0);
4935                                         pd->hdr.icmp->icmp_cksum =
4936                                             pf_cksum_fixup(
4937                                             pd->hdr.icmp->icmp_cksum, icmpid,
4938                                             (*state)->gwy.port, 0);
4939                                         pd->hdr.icmp->icmp_id =
4940                                             (*state)->gwy.port;
4941                                         m_copyback(m, off, ICMP_MINLEN,
4942                                             (caddr_t)pd->hdr.icmp);
4943                                         break;
4944 #endif /* INET */
4945 #ifdef INET6
4946                                 case AF_INET6:
4947                                         pf_change_a6(saddr,
4948                                             &pd->hdr.icmp6->icmp6_cksum,
4949                                             &(*state)->gwy.addr, 0);
4950                                         m_copyback(m, off,
4951                                             sizeof(struct icmp6_hdr),
4952                                             (caddr_t)pd->hdr.icmp6);
4953                                         break;
4954 #endif /* INET6 */
4955                                 }
4956                         } else {
4957                                 switch (pd->af) {
4958 #ifdef INET
4959                                 case AF_INET:
4960                                         pf_change_a(&daddr->v4.s_addr,
4961                                             pd->ip_sum,
4962                                             (*state)->lan.addr.v4.s_addr, 0);
4963                                         pd->hdr.icmp->icmp_cksum =
4964                                             pf_cksum_fixup(
4965                                             pd->hdr.icmp->icmp_cksum, icmpid,
4966                                             (*state)->lan.port, 0);
4967                                         pd->hdr.icmp->icmp_id =
4968                                             (*state)->lan.port;
4969                                         m_copyback(m, off, ICMP_MINLEN,
4970                                             (caddr_t)pd->hdr.icmp);
4971                                         break;
4972 #endif /* INET */
4973 #ifdef INET6
4974                                 case AF_INET6:
4975                                         pf_change_a6(daddr,
4976                                             &pd->hdr.icmp6->icmp6_cksum,
4977                                             &(*state)->lan.addr, 0);
4978                                         m_copyback(m, off,
4979                                             sizeof(struct icmp6_hdr),
4980                                             (caddr_t)pd->hdr.icmp6);
4981                                         break;
4982 #endif /* INET6 */
4983                                 }
4984                         }
4985                 }
4986
4987                 return (PF_PASS);
4988
4989         } else {
4990                 /*
4991                  * ICMP error message in response to a TCP/UDP packet.
4992                  * Extract the inner TCP/UDP header and search for that state.
4993                  */
4994
4995                 struct pf_pdesc pd2;
4996 #ifdef INET
4997                 struct ip       h2;
4998 #endif /* INET */
4999 #ifdef INET6
5000                 struct ip6_hdr  h2_6;
5001                 int             terminal = 0;
5002 #endif /* INET6 */
5003                 int             ipoff2;
5004                 int             off2;
5005
5006                 pd2.af = pd->af;
5007                 switch (pd->af) {
5008 #ifdef INET
5009                 case AF_INET:
5010                         /* offset of h2 in mbuf chain */
5011                         ipoff2 = off + ICMP_MINLEN;
5012
5013                         if (!pf_pull_hdr(m, ipoff2, &h2, sizeof(h2),
5014                             NULL, reason, pd2.af)) {
5015                                 DPFPRINTF(PF_DEBUG_MISC,
5016                                     ("pf: ICMP error message too short "
5017                                     "(ip)\n"));
5018                                 return (PF_DROP);
5019                         }
5020                         /*
5021                          * ICMP error messages don't refer to non-first
5022                          * fragments
5023                          */
5024                         if (h2.ip_off & htons(IP_OFFMASK)) {
5025                                 REASON_SET(reason, PFRES_FRAG);
5026                                 return (PF_DROP);
5027                         }
5028
5029                         /* offset of protocol header that follows h2 */
5030                         off2 = ipoff2 + (h2.ip_hl << 2);
5031
5032                         pd2.proto = h2.ip_p;
5033                         pd2.src = (struct pf_addr *)&h2.ip_src;
5034                         pd2.dst = (struct pf_addr *)&h2.ip_dst;
5035                         pd2.ip_sum = &h2.ip_sum;
5036                         break;
5037 #endif /* INET */
5038 #ifdef INET6
5039                 case AF_INET6:
5040                         ipoff2 = off + sizeof(struct icmp6_hdr);
5041
5042                         if (!pf_pull_hdr(m, ipoff2, &h2_6, sizeof(h2_6),
5043                             NULL, reason, pd2.af)) {
5044                                 DPFPRINTF(PF_DEBUG_MISC,
5045                                     ("pf: ICMP error message too short "
5046                                     "(ip6)\n"));
5047                                 return (PF_DROP);
5048                         }
5049                         pd2.proto = h2_6.ip6_nxt;
5050                         pd2.src = (struct pf_addr *)&h2_6.ip6_src;
5051                         pd2.dst = (struct pf_addr *)&h2_6.ip6_dst;
5052                         pd2.ip_sum = NULL;
5053                         off2 = ipoff2 + sizeof(h2_6);
5054                         do {
5055                                 switch (pd2.proto) {
5056                                 case IPPROTO_FRAGMENT:
5057                                         /*
5058                                          * ICMPv6 error messages for
5059                                          * non-first fragments
5060                                          */
5061                                         REASON_SET(reason, PFRES_FRAG);
5062                                         return (PF_DROP);
5063                                 case IPPROTO_AH:
5064                                 case IPPROTO_HOPOPTS:
5065                                 case IPPROTO_ROUTING:
5066                                 case IPPROTO_DSTOPTS: {
5067                                         /* get next header and header length */
5068                                         struct ip6_ext opt6;
5069
5070                                         if (!pf_pull_hdr(m, off2, &opt6,
5071                                             sizeof(opt6), NULL, reason,
5072                                             pd2.af)) {
5073                                                 DPFPRINTF(PF_DEBUG_MISC,
5074                                                     ("pf: ICMPv6 short opt\n"));
5075                                                 return (PF_DROP);
5076                                         }
5077                                         if (pd2.proto == IPPROTO_AH)
5078                                                 off2 += (opt6.ip6e_len + 2) * 4;
5079                                         else
5080                                                 off2 += (opt6.ip6e_len + 1) * 8;
5081                                         pd2.proto = opt6.ip6e_nxt;
5082                                         /* goto the next header */
5083                                         break;
5084                                 }
5085                                 default:
5086                                         terminal++;
5087                                         break;
5088                                 }
5089                         } while (!terminal);
5090                         break;
5091 #endif /* INET6 */
5092                 default:
5093                         DPFPRINTF(PF_DEBUG_MISC,
5094                             ("pf: ICMP AF %d unknown (ip6)\n", pd->af));
5095                         return (PF_DROP);
5096                         break;
5097                 }
5098
5099                 switch (pd2.proto) {
5100                 case IPPROTO_TCP: {
5101                         struct tcphdr            th;
5102                         u_int32_t                seq;
5103                         struct pf_state_cmp              key;
5104                         struct pf_state_peer    *src, *dst;
5105                         u_int8_t                 dws;
5106                         int                      copyback = 0;
5107
5108                         /*
5109                          * Only the first 8 bytes of the TCP header can be
5110                          * expected. Don't access any TCP header fields after
5111                          * th_seq, an ackskew test is not possible.
5112                          */
5113                         if (!pf_pull_hdr(m, off2, &th, 8, NULL, reason,
5114                             pd2.af)) {
5115                                 DPFPRINTF(PF_DEBUG_MISC,
5116                                     ("pf: ICMP error message too short "
5117                                     "(tcp)\n"));
5118                                 return (PF_DROP);
5119                         }
5120
5121                         key.af = pd2.af;
5122                         key.proto = IPPROTO_TCP;
5123                         if (direction == PF_IN) {
5124                                 PF_ACPY(&key.ext.addr, pd2.dst, key.af);
5125                                 PF_ACPY(&key.gwy.addr, pd2.src, key.af);
5126                                 key.ext.port = th.th_dport;
5127                                 key.gwy.port = th.th_sport;
5128                         } else {
5129                                 PF_ACPY(&key.lan.addr, pd2.dst, key.af);
5130                                 PF_ACPY(&key.ext.addr, pd2.src, key.af);
5131                                 key.lan.port = th.th_dport;
5132                                 key.ext.port = th.th_sport;
5133                         }
5134
5135                         STATE_LOOKUP();
5136
5137                         if (direction == (*state)->direction) {
5138                                 src = &(*state)->dst;
5139                                 dst = &(*state)->src;
5140                         } else {
5141                                 src = &(*state)->src;
5142                                 dst = &(*state)->dst;
5143                         }
5144
5145                         if (src->wscale && dst->wscale &&
5146                             !(th.th_flags & TH_SYN))
5147                                 dws = dst->wscale & PF_WSCALE_MASK;
5148                         else
5149                                 dws = 0;
5150
5151                         /* Demodulate sequence number */
5152                         seq = ntohl(th.th_seq) - src->seqdiff;
5153                         if (src->seqdiff) {
5154                                 pf_change_a(&th.th_seq, icmpsum,
5155                                     htonl(seq), 0);
5156                                 copyback = 1;
5157                         }
5158
5159                         if (!SEQ_GEQ(src->seqhi, seq) ||
5160                             !SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws))) {
5161                                 if (pf_status.debug >= PF_DEBUG_MISC) {
5162                                         kprintf("pf: BAD ICMP %d:%d ",
5163                                             icmptype, pd->hdr.icmp->icmp_code);
5164                                         pf_print_host(pd->src, 0, pd->af);
5165                                         kprintf(" -> ");
5166                                         pf_print_host(pd->dst, 0, pd->af);
5167                                         kprintf(" state: ");
5168                                         pf_print_state(*state);
5169                                         kprintf(" seq=%u\n", seq);
5170                                 }
5171                                 REASON_SET(reason, PFRES_BADSTATE);
5172                                 return (PF_DROP);
5173                         }
5174
5175                         if (STATE_TRANSLATE(*state)) {
5176                                 if (direction == PF_IN) {
5177                                         pf_change_icmp(pd2.src, &th.th_sport,
5178                                             daddr, &(*state)->lan.addr,
5179                                             (*state)->lan.port, NULL,
5180                                             pd2.ip_sum, icmpsum,
5181                                             pd->ip_sum, 0, pd2.af);
5182                                 } else {
5183                                         pf_change_icmp(pd2.dst, &th.th_dport,
5184                                             saddr, &(*state)->gwy.addr,
5185                                             (*state)->gwy.port, NULL,
5186                                             pd2.ip_sum, icmpsum,
5187                                             pd->ip_sum, 0, pd2.af);
5188                                 }
5189                                 copyback = 1;
5190                         }
5191
5192                         if (copyback) {
5193                                 switch (pd2.af) {
5194 #ifdef INET
5195                                 case AF_INET:
5196                                         m_copyback(m, off, ICMP_MINLEN,
5197                                             (caddr_t)pd->hdr.icmp);
5198                                         m_copyback(m, ipoff2, sizeof(h2),
5199                                             (caddr_t)&h2);
5200                                         break;
5201 #endif /* INET */
5202 #ifdef INET6
5203                                 case AF_INET6:
5204                                         m_copyback(m, off,
5205                                             sizeof(struct icmp6_hdr),
5206                                             (caddr_t)pd->hdr.icmp6);
5207                                         m_copyback(m, ipoff2, sizeof(h2_6),
5208                                             (caddr_t)&h2_6);
5209                                         break;
5210 #endif /* INET6 */
5211                                 }
5212                                 m_copyback(m, off2, 8, (caddr_t)&th);
5213                         }
5214
5215                         return (PF_PASS);
5216                         break;
5217                 }
5218                 case IPPROTO_UDP: {
5219                         struct udphdr           uh;
5220
5221                         if (!pf_pull_hdr(m, off2, &uh, sizeof(uh),
5222                             NULL, reason, pd2.af)) {
5223                                 DPFPRINTF(PF_DEBUG_MISC,
5224                                     ("pf: ICMP error message too short "
5225                                     "(udp)\n"));
5226                                 return (PF_DROP);
5227                         }
5228
5229                         key.af = pd2.af;
5230                         key.proto = IPPROTO_UDP;
5231                         if (direction == PF_IN) {
5232                                 PF_ACPY(&key.ext.addr, pd2.dst, key.af);
5233                                 PF_ACPY(&key.gwy.addr, pd2.src, key.af);
5234                                 key.ext.port = uh.uh_dport;
5235                                 key.gwy.port = uh.uh_sport;
5236                         } else {
5237                                 PF_ACPY(&key.lan.addr, pd2.dst, key.af);
5238                                 PF_ACPY(&key.ext.addr, pd2.src, key.af);
5239                                 key.lan.port = uh.uh_dport;
5240                                 key.ext.port = uh.uh_sport;
5241                         }
5242
5243                         STATE_LOOKUP();
5244
5245                         if (STATE_TRANSLATE(*state)) {
5246                                 if (direction == PF_IN) {
5247                                         pf_change_icmp(pd2.src, &uh.uh_sport,
5248                                             daddr, &(*state)->lan.addr,
5249                                             (*state)->lan.port, &uh.uh_sum,
5250                                             pd2.ip_sum, icmpsum,
5251                                             pd->ip_sum, 1, pd2.af);
5252                                 } else {
5253                                         pf_change_icmp(pd2.dst, &uh.uh_dport,
5254                                             saddr, &(*state)->gwy.addr,
5255                                             (*state)->gwy.port, &uh.uh_sum,
5256                                             pd2.ip_sum, icmpsum,
5257                                             pd->ip_sum, 1, pd2.af);
5258                                 }
5259                                 switch (pd2.af) {
5260 #ifdef INET
5261                                 case AF_INET:
5262                                         m_copyback(m, off, ICMP_MINLEN,
5263                                             (caddr_t)pd->hdr.icmp);
5264                                         m_copyback(m, ipoff2, sizeof(h2), (caddr_t)&h2);
5265                                         break;
5266 #endif /* INET */
5267 #ifdef INET6
5268                                 case AF_INET6:
5269                                         m_copyback(m, off,
5270                                             sizeof(struct icmp6_hdr),
5271                                             (caddr_t)pd->hdr.icmp6);
5272                                         m_copyback(m, ipoff2, sizeof(h2_6),
5273                                             (caddr_t)&h2_6);
5274                                         break;
5275 #endif /* INET6 */
5276                                 }
5277                                 m_copyback(m, off2, sizeof(uh), (caddr_t)&uh);
5278                         }
5279
5280                         return (PF_PASS);
5281                         break;
5282                 }
5283 #ifdef INET
5284                 case IPPROTO_ICMP: {
5285                         struct icmp             iih;
5286
5287                         if (!pf_pull_hdr(m, off2, &iih, ICMP_MINLEN,
5288                             NULL, reason, pd2.af)) {
5289                                 DPFPRINTF(PF_DEBUG_MISC,
5290                                     ("pf: ICMP error message too short i"
5291                                     "(icmp)\n"));
5292                                 return (PF_DROP);
5293                         }
5294
5295                         key.af = pd2.af;
5296                         key.proto = IPPROTO_ICMP;
5297                         if (direction == PF_IN) {
5298                                 PF_ACPY(&key.ext.addr, pd2.dst, key.af);
5299                                 PF_ACPY(&key.gwy.addr, pd2.src, key.af);
5300                                 key.ext.port = 0;
5301                                 key.gwy.port = iih.icmp_id;
5302                         } else {
5303                                 PF_ACPY(&key.lan.addr, pd2.dst, key.af);
5304                                 PF_ACPY(&key.ext.addr, pd2.src, key.af);
5305                                 key.lan.port = iih.icmp_id;
5306                                 key.ext.port = 0;
5307                         }
5308
5309                         STATE_LOOKUP();
5310
5311                         if (STATE_TRANSLATE(*state)) {
5312                                 if (direction == PF_IN) {
5313                                         pf_change_icmp(pd2.src, &iih.icmp_id,
5314                                             daddr, &(*state)->lan.addr,
5315                                             (*state)->lan.port, NULL,
5316                                             pd2.ip_sum, icmpsum,
5317                                             pd->ip_sum, 0, AF_INET);
5318                                 } else {
5319                                         pf_change_icmp(pd2.dst, &iih.icmp_id,
5320                                             saddr, &(*state)->gwy.addr,
5321                                             (*state)->gwy.port, NULL,
5322                                             pd2.ip_sum, icmpsum,
5323                                             pd->ip_sum, 0, AF_INET);
5324                                 }
5325                                 m_copyback(m, off, ICMP_MINLEN, (caddr_t)pd->hdr.icmp);
5326                                 m_copyback(m, ipoff2, sizeof(h2), (caddr_t)&h2);
5327                                 m_copyback(m, off2, ICMP_MINLEN, (caddr_t)&iih);
5328                         }
5329
5330                         return (PF_PASS);
5331                         break;
5332                 }
5333 #endif /* INET */
5334 #ifdef INET6
5335                 case IPPROTO_ICMPV6: {
5336                         struct icmp6_hdr        iih;
5337
5338                         if (!pf_pull_hdr(m, off2, &iih,
5339                             sizeof(struct icmp6_hdr), NULL, reason, pd2.af)) {
5340                                 DPFPRINTF(PF_DEBUG_MISC,
5341                                     ("pf: ICMP error message too short "
5342                                     "(icmp6)\n"));
5343                                 return (PF_DROP);
5344                         }
5345
5346                         key.af = pd2.af;
5347                         key.proto = IPPROTO_ICMPV6;
5348                         if (direction == PF_IN) {
5349                                 PF_ACPY(&key.ext.addr, pd2.dst, key.af);
5350                                 PF_ACPY(&key.gwy.addr, pd2.src, key.af);
5351                                 key.ext.port = 0;
5352                                 key.gwy.port = iih.icmp6_id;
5353                         } else {
5354                                 PF_ACPY(&key.lan.addr, pd2.dst, key.af);
5355                                 PF_ACPY(&key.ext.addr, pd2.src, key.af);
5356                                 key.lan.port = iih.icmp6_id;
5357                                 key.ext.port = 0;
5358                         }
5359
5360                         STATE_LOOKUP();
5361
5362                         if (STATE_TRANSLATE(*state)) {
5363                                 if (direction == PF_IN) {
5364                                         pf_change_icmp(pd2.src, &iih.icmp6_id,
5365                                             daddr, &(*state)->lan.addr,
5366                                             (*state)->lan.port, NULL,
5367                                             pd2.ip_sum, icmpsum,
5368                                             pd->ip_sum, 0, AF_INET6);
5369                                 } else {
5370                                         pf_change_icmp(pd2.dst, &iih.icmp6_id,
5371                                             saddr, &(*state)->gwy.addr,
5372                                             (*state)->gwy.port, NULL,
5373                                             pd2.ip_sum, icmpsum,
5374                                             pd->ip_sum, 0, AF_INET6);
5375                                 }
5376                                 m_copyback(m, off, sizeof(struct icmp6_hdr),
5377                                     (caddr_t)pd->hdr.icmp6);
5378                                 m_copyback(m, ipoff2, sizeof(h2_6), (caddr_t)&h2_6);
5379                                 m_copyback(m, off2, sizeof(struct icmp6_hdr),
5380                                     (caddr_t)&iih);
5381                         }
5382
5383                         return (PF_PASS);
5384                         break;
5385                 }
5386 #endif /* INET6 */
5387                 default: {
5388                         key.af = pd2.af;
5389                         key.proto = pd2.proto;
5390                         if (direction == PF_IN) {
5391                                 PF_ACPY(&key.ext.addr, pd2.dst, key.af);
5392                                 PF_ACPY(&key.gwy.addr, pd2.src, key.af);
5393                                 key.ext.port = 0;
5394                                 key.gwy.port = 0;
5395                         } else {
5396                                 PF_ACPY(&key.lan.addr, pd2.dst, key.af);
5397                                 PF_ACPY(&key.ext.addr, pd2.src, key.af);
5398                                 key.lan.port = 0;
5399                                 key.ext.port = 0;
5400                         }
5401
5402                         STATE_LOOKUP();
5403
5404                         if (STATE_TRANSLATE(*state)) {
5405                                 if (direction == PF_IN) {
5406                                         pf_change_icmp(pd2.src, NULL,
5407                                             daddr, &(*state)->lan.addr,
5408                                             0, NULL,
5409                                             pd2.ip_sum, icmpsum,
5410                                             pd->ip_sum, 0, pd2.af);
5411                                 } else {
5412                                         pf_change_icmp(pd2.dst, NULL,
5413                                             saddr, &(*state)->gwy.addr,
5414                                             0, NULL,
5415                                             pd2.ip_sum, icmpsum,
5416                                             pd->ip_sum, 0, pd2.af);
5417                                 }
5418                                 switch (pd2.af) {
5419 #ifdef INET
5420                                 case AF_INET:
5421                                         m_copyback(m, off, ICMP_MINLEN,
5422                                             (caddr_t)pd->hdr.icmp);
5423                                         m_copyback(m, ipoff2, sizeof(h2), (caddr_t)&h2);
5424                                         break;
5425 #endif /* INET */
5426 #ifdef INET6
5427                                 case AF_INET6:
5428                                         m_copyback(m, off,
5429                                             sizeof(struct icmp6_hdr),
5430                                             (caddr_t)pd->hdr.icmp6);
5431                                         m_copyback(m, ipoff2, sizeof(h2_6),
5432                                             (caddr_t)&h2_6);
5433                                         break;
5434 #endif /* INET6 */
5435                                 }
5436                         }
5437
5438                         return (PF_PASS);
5439                         break;
5440                 }
5441                 }
5442         }
5443 }
5444
5445 int
5446 pf_test_state_other(struct pf_state **state, int direction, struct pfi_kif *kif,
5447     struct pf_pdesc *pd)
5448 {
5449         struct pf_state_peer    *src, *dst;
5450         struct pf_state_cmp      key;
5451
5452         key.af = pd->af;
5453         key.proto = pd->proto;
5454         if (direction == PF_IN) {
5455                 PF_ACPY(&key.ext.addr, pd->src, key.af);
5456                 PF_ACPY(&key.gwy.addr, pd->dst, key.af);
5457                 key.ext.port = 0;
5458                 key.gwy.port = 0;
5459         } else {
5460                 PF_ACPY(&key.lan.addr, pd->src, key.af);
5461                 PF_ACPY(&key.ext.addr, pd->dst, key.af);
5462                 key.lan.port = 0;
5463                 key.ext.port = 0;
5464         }
5465
5466         STATE_LOOKUP();
5467
5468         if (direction == (*state)->direction) {
5469                 src = &(*state)->src;
5470                 dst = &(*state)->dst;
5471         } else {
5472                 src = &(*state)->dst;
5473                 dst = &(*state)->src;
5474         }
5475
5476         /* update states */
5477         if (src->state < PFOTHERS_SINGLE)
5478                 src->state = PFOTHERS_SINGLE;
5479         if (dst->state == PFOTHERS_SINGLE)
5480                 dst->state = PFOTHERS_MULTIPLE;
5481
5482         /* update expire time */
5483         (*state)->expire = time_second;
5484         if (src->state == PFOTHERS_MULTIPLE && dst->state == PFOTHERS_MULTIPLE)
5485                 (*state)->timeout = PFTM_OTHER_MULTIPLE;
5486         else
5487                 (*state)->timeout = PFTM_OTHER_SINGLE;
5488
5489         /* translate source/destination address, if necessary */
5490         if (STATE_TRANSLATE(*state)) {
5491                 if (direction == PF_OUT)
5492                         switch (pd->af) {
5493 #ifdef INET
5494                         case AF_INET:
5495                                 pf_change_a(&pd->src->v4.s_addr,
5496                                     pd->ip_sum, (*state)->gwy.addr.v4.s_addr,
5497                                     0);
5498                                 break;
5499 #endif /* INET */
5500 #ifdef INET6
5501                         case AF_INET6:
5502                                 PF_ACPY(pd->src, &(*state)->gwy.addr, pd->af);
5503                                 break;
5504 #endif /* INET6 */
5505                         }
5506                 else
5507                         switch (pd->af) {
5508 #ifdef INET
5509                         case AF_INET:
5510                                 pf_change_a(&pd->dst->v4.s_addr,
5511                                     pd->ip_sum, (*state)->lan.addr.v4.s_addr,
5512                                     0);
5513                                 break;
5514 #endif /* INET */
5515 #ifdef INET6
5516                         case AF_INET6:
5517                                 PF_ACPY(pd->dst, &(*state)->lan.addr, pd->af);
5518                                 break;
5519 #endif /* INET6 */
5520                         }
5521         }
5522
5523         return (PF_PASS);
5524 }
5525
5526 /*
5527  * ipoff and off are measured from the start of the mbuf chain.
5528  * h must be at "ipoff" on the mbuf chain.
5529  */
5530 void *
5531 pf_pull_hdr(struct mbuf *m, int off, void *p, int len,
5532     u_short *actionp, u_short *reasonp, sa_family_t af)
5533 {
5534         switch (af) {
5535 #ifdef INET
5536         case AF_INET: {
5537                 struct ip       *h = mtod(m, struct ip *);
5538                 u_int16_t        fragoff = (h->ip_off & IP_OFFMASK) << 3;
5539
5540                 if (fragoff) {
5541                         if (fragoff >= len)
5542                                 ACTION_SET(actionp, PF_PASS);
5543                         else {
5544                                 ACTION_SET(actionp, PF_DROP);
5545                                 REASON_SET(reasonp, PFRES_FRAG);
5546                         }
5547                         return (NULL);
5548                 }
5549                 if (m->m_pkthdr.len < off + len ||
5550                     h->ip_len < off + len) {
5551                         ACTION_SET(actionp, PF_DROP);
5552                         REASON_SET(reasonp, PFRES_SHORT);
5553                         return (NULL);
5554                 }
5555                 break;
5556         }
5557 #endif /* INET */
5558 #ifdef INET6
5559         case AF_INET6: {
5560                 struct ip6_hdr  *h = mtod(m, struct ip6_hdr *);
5561
5562                 if (m->m_pkthdr.len < off + len ||
5563                     (ntohs(h->ip6_plen) + sizeof(struct ip6_hdr)) <
5564                     (unsigned)(off + len)) {
5565                         ACTION_SET(actionp, PF_DROP);
5566                         REASON_SET(reasonp, PFRES_SHORT);
5567                         return (NULL);
5568                 }
5569                 break;
5570         }
5571 #endif /* INET6 */
5572         }
5573         m_copydata(m, off, len, p);
5574         return (p);
5575 }
5576
5577 int
5578 pf_routable(struct pf_addr *addr, sa_family_t af, struct pfi_kif *kif)
5579 {
5580         struct sockaddr_in      *dst;
5581         int                      ret = 1;
5582         int                      check_mpath;
5583 #ifdef INET6
5584         struct sockaddr_in6     *dst6;
5585         struct route_in6         ro;
5586 #else
5587         struct route             ro;
5588 #endif
5589         struct radix_node       *rn;
5590         struct rtentry          *rt;
5591         struct ifnet            *ifp;
5592
5593         check_mpath = 0;
5594         bzero(&ro, sizeof(ro));
5595         switch (af) {
5596         case AF_INET:
5597                 dst = satosin(&ro.ro_dst);
5598                 dst->sin_family = AF_INET;
5599                 dst->sin_len = sizeof(*dst);
5600                 dst->sin_addr = addr->v4;
5601                 break;
5602 #ifdef INET6
5603         case AF_INET6:
5604                 dst6 = (struct sockaddr_in6 *)&ro.ro_dst;
5605                 dst6->sin6_family = AF_INET6;
5606                 dst6->sin6_len = sizeof(*dst6);
5607                 dst6->sin6_addr = addr->v6;
5608                 break;
5609 #endif /* INET6 */
5610         default:
5611                 return (0);
5612         }
5613
5614         /* Skip checks for ipsec interfaces */
5615         if (kif != NULL && kif->pfik_ifp->if_type == IFT_ENC)
5616                 goto out;
5617
5618         rtalloc_ign((struct route *)&ro, 0);
5619
5620         if (ro.ro_rt != NULL) {
5621                 /* No interface given, this is a no-route check */
5622                 if (kif == NULL)
5623                         goto out;
5624
5625                 if (kif->pfik_ifp == NULL) {
5626                         ret = 0;
5627                         goto out;
5628                 }
5629
5630                 /* Perform uRPF check if passed input interface */
5631                 ret = 0;
5632                 rn = (struct radix_node *)ro.ro_rt;
5633                 do {
5634                         rt = (struct rtentry *)rn;
5635                         ifp = rt->rt_ifp;
5636
5637                         if (kif->pfik_ifp == ifp)
5638                                 ret = 1;
5639                         rn = NULL;
5640                 } while (check_mpath == 1 && rn != NULL && ret == 0);
5641         } else
5642                 ret = 0;
5643 out:
5644         if (ro.ro_rt != NULL)
5645                 RTFREE(ro.ro_rt);
5646         return (ret);
5647 }
5648
5649 int
5650 pf_rtlabel_match(struct pf_addr *addr, sa_family_t af, struct pf_addr_wrap *aw)
5651 {
5652         struct sockaddr_in      *dst;
5653 #ifdef INET6
5654         struct sockaddr_in6     *dst6;
5655         struct route_in6         ro;
5656 #else
5657         struct route             ro;
5658 #endif
5659         int                      ret = 0;
5660
5661         bzero(&ro, sizeof(ro));
5662         switch (af) {
5663         case AF_INET:
5664                 dst = satosin(&ro.ro_dst);
5665                 dst->sin_family = AF_INET;
5666                 dst->sin_len = sizeof(*dst);
5667                 dst->sin_addr = addr->v4;
5668                 break;
5669 #ifdef INET6
5670         case AF_INET6:
5671                 dst6 = (struct sockaddr_in6 *)&ro.ro_dst;
5672                 dst6->sin6_family = AF_INET6;
5673                 dst6->sin6_len = sizeof(*dst6);
5674                 dst6->sin6_addr = addr->v6;
5675                 break;
5676 #endif /* INET6 */
5677         default:
5678                 return (0);
5679         }
5680
5681 rtalloc_ign((struct route *)&ro, (RTF_CLONING | RTF_PRCLONING));
5682
5683         if (ro.ro_rt != NULL) {
5684                 RTFREE(ro.ro_rt);
5685         }
5686
5687         return (ret);
5688 }
5689
5690 #ifdef INET
5691 void
5692 pf_route(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp,
5693     struct pf_state *s, struct pf_pdesc *pd)
5694 {
5695         struct mbuf             *m0, *m1;
5696         struct route             iproute;
5697         struct route            *ro = NULL;
5698         struct sockaddr_in      *dst;
5699         struct ip               *ip;
5700         struct ifnet            *ifp = NULL;
5701         struct pf_addr           naddr;
5702         struct pf_src_node      *sn = NULL;
5703         int                      error = 0;
5704         int sw_csum;
5705 #ifdef IPSEC
5706         struct m_tag            *mtag;
5707 #endif /* IPSEC */
5708
5709         if (m == NULL || *m == NULL || r == NULL ||
5710             (dir != PF_IN && dir != PF_OUT) || oifp == NULL)
5711                 panic("pf_route: invalid parameters");
5712
5713         if (((*m)->m_pkthdr.fw_flags & PF_MBUF_ROUTED) == 0) {
5714                 (*m)->m_pkthdr.fw_flags |= PF_MBUF_ROUTED;
5715                 (*m)->m_pkthdr.pf_routed = 1;
5716         } else {
5717                 if ((*m)->m_pkthdr.pf_routed > 3) {
5718                         m0 = *m;
5719                         *m = NULL;
5720                         goto bad;
5721                 }
5722                 (*m)->m_pkthdr.pf_routed++;
5723         }
5724
5725         if (r->rt == PF_DUPTO) {
5726                 if ((m0 = m_dup(*m, MB_DONTWAIT)) == NULL)
5727                         return;
5728         } else {
5729                 if ((r->rt == PF_REPLYTO) == (r->direction == dir))
5730                         return;
5731                 m0 = *m;
5732         }
5733
5734         if (m0->m_len < sizeof(struct ip)) {
5735                 DPFPRINTF(PF_DEBUG_URGENT,
5736                     ("pf_route: m0->m_len < sizeof(struct ip)\n"));
5737                 goto bad;
5738         }
5739
5740         ip = mtod(m0, struct ip *);
5741
5742         ro = &iproute;
5743         bzero((caddr_t)ro, sizeof(*ro));
5744         dst = satosin(&ro->ro_dst);
5745         dst->sin_family = AF_INET;
5746         dst->sin_len = sizeof(*dst);
5747         dst->sin_addr = ip->ip_dst;
5748
5749         if (r->rt == PF_FASTROUTE) {
5750                 rtalloc(ro);
5751                 if (ro->ro_rt == 0) {
5752                         ipstat.ips_noroute++;
5753                         goto bad;
5754                 }
5755
5756                 ifp = ro->ro_rt->rt_ifp;
5757                 ro->ro_rt->rt_use++;
5758
5759                 if (ro->ro_rt->rt_flags & RTF_GATEWAY)
5760                         dst = satosin(ro->ro_rt->rt_gateway);
5761         } else {
5762                 if (TAILQ_EMPTY(&r->rpool.list)) {
5763                         DPFPRINTF(PF_DEBUG_URGENT,
5764                             ("pf_route: TAILQ_EMPTY(&r->rpool.list)\n"));
5765                         goto bad;
5766                 }
5767                 if (s == NULL) {
5768                         pf_map_addr(AF_INET, r, (struct pf_addr *)&ip->ip_src,
5769                             &naddr, NULL, &sn);
5770                         if (!PF_AZERO(&naddr, AF_INET))
5771                                 dst->sin_addr.s_addr = naddr.v4.s_addr;
5772                         ifp = r->rpool.cur->kif ?
5773                             r->rpool.cur->kif->pfik_ifp : NULL;
5774                 } else {
5775                         if (!PF_AZERO(&s->rt_addr, AF_INET))
5776                                 dst->sin_addr.s_addr =
5777                                     s->rt_addr.v4.s_addr;
5778                         ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL;
5779                 }
5780         }
5781         if (ifp == NULL)
5782                 goto bad;
5783
5784         if (oifp != ifp) {
5785                 crit_exit();
5786                 if (pf_test(PF_OUT, ifp, &m0, NULL, NULL) != PF_PASS) {
5787                         crit_enter();
5788                         goto bad;
5789                 } else if (m0 == NULL) {
5790                         crit_enter();
5791                         goto done;
5792                 }
5793                 crit_enter();
5794                 if (m0->m_len < sizeof(struct ip)) {
5795                         DPFPRINTF(PF_DEBUG_URGENT,
5796                             ("pf_route: m0->m_len < sizeof(struct ip)\n"));
5797                         goto bad;
5798                 }
5799                 ip = mtod(m0, struct ip *);
5800         }
5801
5802         /* Copied from FreeBSD 5.1-CURRENT ip_output. */
5803         m0->m_pkthdr.csum_flags |= CSUM_IP;
5804         sw_csum = m0->m_pkthdr.csum_flags & ~ifp->if_hwassist;
5805         if (sw_csum & CSUM_DELAY_DATA) {
5806                 /*
5807                  * XXX: in_delayed_cksum assumes HBO for ip->ip_len (at least)
5808                  */
5809                 NTOHS(ip->ip_len);
5810                 NTOHS(ip->ip_off);       /* XXX: needed? */
5811                 in_delayed_cksum(m0);
5812                 HTONS(ip->ip_len);
5813                 HTONS(ip->ip_off);
5814                 sw_csum &= ~CSUM_DELAY_DATA;
5815         }
5816         m0->m_pkthdr.csum_flags &= ifp->if_hwassist;
5817
5818         if (ntohs(ip->ip_len) <= ifp->if_mtu ||
5819             (ifp->if_hwassist & CSUM_FRAGMENT &&
5820                 ((ip->ip_off & htons(IP_DF)) == 0))) {
5821                 /*
5822                  * ip->ip_len = htons(ip->ip_len);
5823                  * ip->ip_off = htons(ip->ip_off);
5824                  */
5825                 ip->ip_sum = 0;
5826                 if (sw_csum & CSUM_DELAY_IP) {
5827                         /* From KAME */
5828                         if (ip->ip_v == IPVERSION &&
5829                             (ip->ip_hl << 2) == sizeof(*ip)) {
5830                                 ip->ip_sum = in_cksum_hdr(ip);
5831                         } else {
5832                                 ip->ip_sum = in_cksum(m0, ip->ip_hl << 2);
5833                         }
5834                 }
5835                 crit_exit();
5836                 error = (*ifp->if_output)(ifp, m0, sintosa(dst), ro->ro_rt);
5837                 crit_enter();
5838                 goto done;
5839         }
5840
5841         /*
5842          * Too large for interface; fragment if possible.
5843          * Must be able to put at least 8 bytes per fragment.
5844          */
5845         if (ip->ip_off & htons(IP_DF)) {
5846                 ipstat.ips_cantfrag++;
5847                 if (r->rt != PF_DUPTO) {
5848                         /* icmp_error() expects host byte ordering */
5849                         NTOHS(ip->ip_len);
5850                         NTOHS(ip->ip_off);
5851                         crit_exit();
5852                         icmp_error(m0, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG, 0,
5853                             ifp->if_mtu);
5854                         crit_enter();
5855                         goto done;
5856                 } else
5857                         goto bad;
5858         }
5859
5860         m1 = m0;
5861         /*
5862          * XXX: is cheaper + less error prone than own function
5863          */
5864         NTOHS(ip->ip_len);
5865         NTOHS(ip->ip_off);
5866         error = ip_fragment(ip, &m0, ifp->if_mtu, ifp->if_hwassist, sw_csum);
5867         if (error) {
5868                 goto bad;
5869         }
5870
5871         for (m0 = m1; m0; m0 = m1) {
5872                 m1 = m0->m_nextpkt;
5873                 m0->m_nextpkt = 0;
5874                 if (error == 0) {
5875                         crit_exit();
5876                         error = (*ifp->if_output)(ifp, m0, sintosa(dst),
5877                             NULL);
5878                         crit_enter();
5879                 } else
5880                         m_freem(m0);
5881         }
5882
5883         if (error == 0)
5884                 ipstat.ips_fragmented++;
5885
5886 done:
5887         if (r->rt != PF_DUPTO)
5888                 *m = NULL;
5889         if (ro == &iproute && ro->ro_rt)
5890                 RTFREE(ro->ro_rt);
5891         return;
5892
5893 bad:
5894         m_freem(m0);
5895         goto done;
5896 }
5897 #endif /* INET */
5898
5899 #ifdef INET6
5900 void
5901 pf_route6(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp,
5902     struct pf_state *s, struct pf_pdesc *pd)
5903 {
5904         struct mbuf             *m0;
5905         struct route_in6         ip6route;
5906         struct route_in6        *ro;
5907         struct sockaddr_in6     *dst;
5908         struct ip6_hdr          *ip6;
5909         struct ifnet            *ifp = NULL;
5910         struct pf_addr           naddr;
5911         struct pf_src_node      *sn = NULL;
5912         int                      error = 0;
5913
5914         if (m == NULL || *m == NULL || r == NULL ||
5915             (dir != PF_IN && dir != PF_OUT) || oifp == NULL)
5916                 panic("pf_route6: invalid parameters");
5917
5918         if (((*m)->m_pkthdr.fw_flags & PF_MBUF_ROUTED) == 0) {
5919                 (*m)->m_pkthdr.fw_flags |= PF_MBUF_ROUTED;
5920                 (*m)->m_pkthdr.pf_routed = 1;
5921         } else {
5922                 if ((*m)->m_pkthdr.pf_routed > 3) {
5923                         m0 = *m;
5924                         *m = NULL;
5925                         goto bad;
5926                 }
5927                 (*m)->m_pkthdr.pf_routed++;
5928         }
5929
5930         if (r->rt == PF_DUPTO) {
5931                 if ((m0 = m_dup(*m, MB_DONTWAIT)) == NULL)
5932                         return;
5933         } else {
5934                 if ((r->rt == PF_REPLYTO) == (r->direction == dir))
5935                         return;
5936                 m0 = *m;
5937         }
5938
5939         if (m0->m_len < sizeof(struct ip6_hdr)) {
5940                 DPFPRINTF(PF_DEBUG_URGENT,
5941                     ("pf_route6: m0->m_len < sizeof(struct ip6_hdr)\n"));
5942                 goto bad;
5943         }
5944         ip6 = mtod(m0, struct ip6_hdr *);
5945
5946         ro = &ip6route;
5947         bzero((caddr_t)ro, sizeof(*ro));
5948         dst = (struct sockaddr_in6 *)&ro->ro_dst;
5949         dst->sin6_family = AF_INET6;
5950         dst->sin6_len = sizeof(*dst);
5951         dst->sin6_addr = ip6->ip6_dst;
5952
5953         /* Cheat. XXX why only in the v6 case??? */
5954         if (r->rt == PF_FASTROUTE) {
5955                 pd->pf_mtag->flags |= PF_TAG_GENERATED;
5956                 crit_exit();
5957                 ip6_output(m0, NULL, NULL, 0, NULL, NULL, NULL);
5958                 crit_enter();
5959                 return;
5960         }
5961
5962         if (TAILQ_EMPTY(&r->rpool.list)) {
5963                 DPFPRINTF(PF_DEBUG_URGENT,
5964                     ("pf_route6: TAILQ_EMPTY(&r->rpool.list)\n"));
5965                 goto bad;
5966         }
5967         if (s == NULL) {
5968                 pf_map_addr(AF_INET6, r, (struct pf_addr *)&ip6->ip6_src,
5969                     &naddr, NULL, &sn);
5970                 if (!PF_AZERO(&naddr, AF_INET6))
5971                         PF_ACPY((struct pf_addr *)&dst->sin6_addr,
5972                             &naddr, AF_INET6);
5973                 ifp = r->rpool.cur->kif ? r->rpool.cur->kif->pfik_ifp : NULL;
5974         } else {
5975                 if (!PF_AZERO(&s->rt_addr, AF_INET6))
5976                         PF_ACPY((struct pf_addr *)&dst->sin6_addr,
5977                             &s->rt_addr, AF_INET6);
5978                 ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL;
5979         }
5980         if (ifp == NULL)
5981                 goto bad;
5982
5983         if (oifp != ifp) {
5984                 crit_exit();
5985                 if (pf_test6(PF_OUT, ifp, &m0, NULL, NULL) != PF_PASS) {
5986                         crit_enter();
5987                         goto bad;
5988                 } else if (m0 == NULL) {
5989                         crit_enter();
5990                         goto done;
5991                 }
5992                 crit_enter();
5993                 if (m0->m_len < sizeof(struct ip6_hdr)) {
5994                         DPFPRINTF(PF_DEBUG_URGENT,
5995                             ("pf_route6: m0->m_len < sizeof(struct ip6_hdr)\n"));
5996                         goto bad;
5997                 }
5998                 ip6 = mtod(m0, struct ip6_hdr *);
5999         }
6000
6001         /*
6002          * If the packet is too large for the outgoing interface,
6003          * send back an icmp6 error.
6004          */
6005         if (IN6_IS_ADDR_LINKLOCAL(&dst->sin6_addr))
6006                 dst->sin6_addr.s6_addr16[1] = htons(ifp->if_index);
6007         if ((u_long)m0->m_pkthdr.len <= ifp->if_mtu) {
6008                 crit_exit();
6009                 error = nd6_output(ifp, ifp, m0, dst, NULL);
6010                 crit_enter();
6011         } else {
6012                 in6_ifstat_inc(ifp, ifs6_in_toobig);
6013                 if (r->rt != PF_DUPTO) {
6014                         crit_exit();
6015                         icmp6_error(m0, ICMP6_PACKET_TOO_BIG, 0, ifp->if_mtu);
6016                         crit_enter();
6017                  } else
6018                         goto bad;
6019         }
6020
6021 done:
6022         if (r->rt != PF_DUPTO)
6023                 *m = NULL;
6024         return;
6025
6026 bad:
6027         m_freem(m0);
6028         goto done;
6029 }
6030
6031 #endif /* INET6 */
6032
6033
6034 /*
6035  * check protocol (tcp/udp/icmp/icmp6) checksum and set mbuf flag
6036  *   off is the offset where the protocol header starts
6037  *   len is the total length of protocol header plus payload
6038  * returns 0 when the checksum is valid, otherwise returns 1.
6039  */
6040 /*
6041  * XXX
6042  * FreeBSD supports cksum offload for the following drivers.
6043  * em(4), gx(4), lge(4), nge(4), ti(4), xl(4)
6044  * If we can make full use of it we would outperform ipfw/ipfilter in
6045  * very heavy traffic.
6046  * I have not tested 'cause I don't have NICs that supports cksum offload.
6047  * (There might be problems. Typical phenomena would be
6048  *   1. No route message for UDP packet.
6049  *   2. No connection acceptance from external hosts regardless of rule set.)
6050  */
6051 int
6052 pf_check_proto_cksum(struct mbuf *m, int off, int len, u_int8_t p,
6053     sa_family_t af)
6054 {
6055         u_int16_t sum = 0;
6056         int hw_assist = 0;
6057         struct ip *ip;
6058
6059         if (off < sizeof(struct ip) || len < sizeof(struct udphdr))
6060                 return (1);
6061         if (m->m_pkthdr.len < off + len)
6062                 return (1);
6063
6064         switch (p) {
6065         case IPPROTO_TCP:
6066         case IPPROTO_UDP:
6067                 if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
6068                         if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) {
6069                                 sum = m->m_pkthdr.csum_data;
6070                         } else {
6071                                 ip = mtod(m, struct ip *);
6072                                 sum = in_pseudo(ip->ip_src.s_addr,
6073                                         ip->ip_dst.s_addr, htonl((u_short)len +
6074                                         m->m_pkthdr.csum_data + p));
6075                         }
6076                         sum ^= 0xffff;
6077                         ++hw_assist;
6078                 }
6079                 break;
6080         case IPPROTO_ICMP:
6081 #ifdef INET6
6082         case IPPROTO_ICMPV6:
6083 #endif /* INET6 */
6084                 break;
6085         default:
6086                 return (1);
6087         }
6088
6089         if (!hw_assist) {
6090                 switch (af) {
6091                 case AF_INET:
6092                         if (p == IPPROTO_ICMP) {
6093                                 if (m->m_len < off)
6094                                         return (1);
6095                                 m->m_data += off;
6096                                 m->m_len -= off;
6097                                 sum = in_cksum(m, len);
6098                                 m->m_data -= off;
6099                                 m->m_len += off;
6100                         } else {
6101                                 if (m->m_len < sizeof(struct ip))
6102                                         return (1);
6103                                 sum = in_cksum_range(m, p, off, len);
6104                                 if (sum == 0) {
6105                                         m->m_pkthdr.csum_flags |=
6106                                             (CSUM_DATA_VALID |
6107                                              CSUM_PSEUDO_HDR);
6108                                         m->m_pkthdr.csum_data = 0xffff;
6109                                 }
6110                         }
6111                         break;
6112 #ifdef INET6
6113                 case AF_INET6:
6114                         if (m->m_len < sizeof(struct ip6_hdr))
6115                                 return (1);
6116                         sum = in6_cksum(m, p, off, len);
6117                         /*
6118                          * XXX
6119                          * IPv6 H/W cksum off-load not supported yet!
6120                          *
6121                          * if (sum == 0) {
6122                          *      m->m_pkthdr.csum_flags |=
6123                          *          (CSUM_DATA_VALID|CSUM_PSEUDO_HDR);
6124                          *      m->m_pkthdr.csum_data = 0xffff;
6125                          *}
6126                          */
6127                         break;
6128 #endif /* INET6 */
6129                 default:
6130                         return (1);
6131                 }
6132         }
6133         if (sum) {
6134                 switch (p) {
6135                 case IPPROTO_TCP:
6136                         tcpstat.tcps_rcvbadsum++;
6137                         break;
6138                 case IPPROTO_UDP:
6139                         udpstat.udps_badsum++;
6140                         break;
6141                 case IPPROTO_ICMP:
6142                         icmpstat.icps_checksum++;
6143                         break;
6144 #ifdef INET6
6145                 case IPPROTO_ICMPV6:
6146                         icmp6stat.icp6s_checksum++;
6147                         break;
6148 #endif /* INET6 */
6149                 }
6150                 return (1);
6151         }
6152         return (0);
6153 }
6154
6155 #ifdef INET
6156 int
6157 pf_test(int dir, struct ifnet *ifp, struct mbuf **m0,
6158     struct ether_header *eh, struct inpcb *inp)
6159 {
6160         struct pfi_kif          *kif;
6161         u_short                  action, reason = 0, log = 0;
6162         struct mbuf             *m = *m0;
6163         struct ip               *h = NULL;
6164         struct pf_rule          *a = NULL, *r = &pf_default_rule, *tr, *nr;
6165         struct pf_state         *s = NULL;
6166         struct pf_ruleset       *ruleset = NULL;
6167         struct pf_pdesc          pd;
6168         int                      off, dirndx, pqid = 0;
6169
6170         if (!pf_status.running)
6171                 return (PF_PASS);
6172
6173         memset(&pd, 0, sizeof(pd));
6174         if ((pd.pf_mtag = pf_get_mtag(m)) == NULL) {
6175                 DPFPRINTF(PF_DEBUG_URGENT,
6176                     ("pf_test: pf_get_mtag returned NULL\n"));
6177                 return (PF_DROP);
6178         }
6179         if (pd.pf_mtag->flags & PF_TAG_GENERATED)
6180                 return (PF_PASS);
6181         kif = (struct pfi_kif *)ifp->if_pf_kif;
6182         if (kif == NULL) {
6183                 DPFPRINTF(PF_DEBUG_URGENT,
6184                     ("pf_test: kif == NULL, if_xname %s\n", ifp->if_xname));
6185                 return (PF_DROP);
6186         }
6187         if (kif->pfik_flags & PFI_IFLAG_SKIP)
6188                 return (PF_PASS);
6189
6190 #ifdef DIAGNOSTIC
6191         if ((m->m_flags & M_PKTHDR) == 0)
6192                 panic("non-M_PKTHDR is passed to pf_test");
6193 #endif /* DIAGNOSTIC */
6194
6195         if (m->m_pkthdr.len < (int)sizeof(*h)) {
6196                 action = PF_DROP;
6197                 REASON_SET(&reason, PFRES_SHORT);
6198                 log = 1;
6199                 panic("debug");
6200                 goto done;
6201         }
6202
6203         /* We do IP header normalization and packet reassembly here */
6204         if (pf_normalize_ip(m0, dir, kif, &reason, &pd) != PF_PASS) {
6205                 action = PF_DROP;
6206                 goto done;
6207         }
6208         m = *m0;
6209         h = mtod(m, struct ip *);
6210
6211         off = h->ip_hl << 2;
6212         if (off < (int)sizeof(*h)) {
6213                 action = PF_DROP;
6214                 REASON_SET(&reason, PFRES_SHORT);
6215                 log = 1;
6216                 panic("debug");
6217                 goto done;
6218         }
6219
6220         pd.src = (struct pf_addr *)&h->ip_src;
6221         pd.dst = (struct pf_addr *)&h->ip_dst;
6222         PF_ACPY(&pd.baddr, dir == PF_OUT ? pd.src : pd.dst, AF_INET);
6223         pd.ip_sum = &h->ip_sum;
6224         pd.proto = h->ip_p;
6225         pd.af = AF_INET;
6226         pd.tos = h->ip_tos;
6227         pd.tot_len = h->ip_len;
6228         pd.eh = eh;
6229
6230         /* handle fragments that didn't get reassembled by normalization */
6231         if (h->ip_off & (IP_MF | IP_OFFMASK)) {
6232                 action = pf_test_fragment(&r, dir, kif, m, h,
6233                     &pd, &a, &ruleset);
6234                 goto done;
6235         }
6236         switch (h->ip_p) {
6237
6238         case IPPROTO_TCP: {
6239                 struct tcphdr   th;
6240
6241                 pd.hdr.tcp = &th;
6242                 if (!pf_pull_hdr(m, off, &th, sizeof(th),
6243                     &action, &reason, AF_INET)) {
6244                         log = action != PF_PASS;
6245                         goto done;
6246                 }
6247                 if (dir == PF_IN && pf_check_proto_cksum(m, off,
6248                     h->ip_len - off, IPPROTO_TCP, AF_INET)) {
6249                         REASON_SET(&reason, PFRES_PROTCKSUM);
6250                         action = PF_DROP;
6251                         goto done;
6252                 }
6253                 pd.p_len = pd.tot_len - off - (th.th_off << 2);
6254                 if ((th.th_flags & TH_ACK) && pd.p_len == 0)
6255                         pqid = 1;
6256                 action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd);
6257                 if (action == PF_DROP)
6258                         goto done;
6259                 action = pf_test_state_tcp(&s, dir, kif, m, off, h, &pd,
6260                     &reason);
6261                 if (action == PF_PASS) {
6262 #if NPFSYNC
6263                         pfsync_update_state(s);
6264 #endif /* NPFSYNC */
6265                         r = s->rule.ptr;
6266                         a = s->anchor.ptr;
6267                         log = s->log;
6268                 } else if (s == NULL) {
6269                         action = pf_test_tcp(&r, &s, dir, kif,
6270                             m, off, h, &pd, &a, &ruleset, NULL, inp);
6271                         }
6272                 break;
6273         }
6274
6275         case IPPROTO_UDP: {
6276                 struct udphdr   uh;
6277
6278                 pd.hdr.udp = &uh;
6279                 if (!pf_pull_hdr(m, off, &uh, sizeof(uh),
6280                     &action, &reason, AF_INET)) {
6281                         log = action != PF_PASS;
6282                         goto done;
6283                 }
6284                 if (dir == PF_IN && uh.uh_sum && pf_check_proto_cksum(m,
6285                     off, h->ip_len - off, IPPROTO_UDP, AF_INET)) {
6286                         action = PF_DROP;
6287                         REASON_SET(&reason, PFRES_PROTCKSUM);
6288                         goto done;
6289                 }
6290                 if (uh.uh_dport == 0 ||
6291                     ntohs(uh.uh_ulen) > m->m_pkthdr.len - off ||
6292                     ntohs(uh.uh_ulen) < sizeof(struct udphdr)) {
6293                         action = PF_DROP;
6294                         REASON_SET(&reason, PFRES_SHORT);
6295                         goto done;
6296                 }
6297                 action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd);
6298                 if (action == PF_PASS) {
6299 #if NPFSYNC
6300                         pfsync_update_state(s);
6301 #endif /* NPFSYNC */
6302                         r = s->rule.ptr;
6303                         a = s->anchor.ptr;
6304                         log = s->log;
6305                 } else if (s == NULL)
6306                         action = pf_test_udp(&r, &s, dir, kif,
6307                             m, off, h, &pd, &a, &ruleset, NULL, inp);
6308                 break;
6309         }
6310
6311         case IPPROTO_ICMP: {
6312                 struct icmp     ih;
6313
6314                 pd.hdr.icmp = &ih;
6315                 if (!pf_pull_hdr(m, off, &ih, ICMP_MINLEN,
6316                     &action, &reason, AF_INET)) {
6317                         log = action != PF_PASS;
6318                         goto done;
6319                 }
6320                 if (dir == PF_IN && pf_check_proto_cksum(m, off,
6321                     h->ip_len - off, IPPROTO_ICMP, AF_INET)) {
6322                         action = PF_DROP;
6323                         REASON_SET(&reason, PFRES_PROTCKSUM);
6324                         goto done;
6325                 }
6326                 action = pf_test_state_icmp(&s, dir, kif, m, off, h, &pd,
6327                     &reason);
6328                 if (action == PF_PASS) {
6329 #if NPFSYNC
6330                         pfsync_update_state(s);
6331 #endif /* NPFSYNC */
6332                         r = s->rule.ptr;
6333                         a = s->anchor.ptr;
6334                         log = s->log;
6335                 } else if (s == NULL)
6336                         action = pf_test_icmp(&r, &s, dir, kif,
6337                             m, off, h, &pd, &a, &ruleset, NULL);
6338                 break;
6339         }
6340
6341         default:
6342                 action = pf_test_state_other(&s, dir, kif, &pd);
6343                 if (action == PF_PASS) {
6344 #if NPFSYNC
6345                         pfsync_update_state(s);
6346 #endif /* NPFSYNC */
6347                         r = s->rule.ptr;
6348                         a = s->anchor.ptr;
6349                         log = s->log;
6350                 } else if (s == NULL)
6351                         action = pf_test_other(&r, &s, dir, kif, m, off, h,
6352                             &pd, &a, &ruleset, NULL);
6353                 break;
6354         }
6355
6356 done:
6357         if (action == PF_PASS && h->ip_hl > 5 &&
6358             !((s && s->allow_opts) || r->allow_opts)) {
6359                 action = PF_DROP;
6360                 REASON_SET(&reason, PFRES_IPOPTIONS);
6361                 log = 1;
6362                 DPFPRINTF(PF_DEBUG_MISC,
6363                     ("pf: dropping packet with ip options\n"));
6364         }
6365
6366         if ((s && s->tag) || r->rtableid)
6367                 pf_tag_packet(m, pd.pf_mtag, s ? s->tag : 0, r->rtableid);
6368
6369 #ifdef ALTQ
6370         if (action == PF_PASS && r->qid) {
6371                 if (pqid || (pd.tos & IPTOS_LOWDELAY))
6372                         pd.pf_mtag->qid = r->pqid;
6373                 else
6374                         pd.pf_mtag->qid = r->qid;
6375                 /* add hints for ecn */
6376                 pd.pf_mtag->af = AF_INET;
6377                 pd.pf_mtag->hdr = h;
6378                 /* add connection hash for fairq */
6379                 if (s) {
6380                         KKASSERT(s->hash != 0);
6381                         pd.pf_mtag->flags |= PF_TAG_STATE_HASHED;
6382                         pd.pf_mtag->state_hash = s->hash;
6383                 }
6384         }
6385 #endif /* ALTQ */
6386
6387         /*
6388          * connections redirected to loopback should not match sockets
6389          * bound specifically to loopback due to security implications,
6390          * see tcp_input() and in_pcblookup_listen().
6391          */
6392         if (dir == PF_IN && action == PF_PASS && (pd.proto == IPPROTO_TCP ||
6393             pd.proto == IPPROTO_UDP) && s != NULL && s->nat_rule.ptr != NULL &&
6394             (s->nat_rule.ptr->action == PF_RDR ||
6395             s->nat_rule.ptr->action == PF_BINAT) &&
6396             (ntohl(pd.dst->v4.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET)
6397                 pd.pf_mtag->flags |= PF_TAG_TRANSLATE_LOCALHOST;
6398
6399         if (log) {
6400                 struct pf_rule *lr;
6401
6402                 if (s != NULL && s->nat_rule.ptr != NULL &&
6403                     s->nat_rule.ptr->log & PF_LOG_ALL)
6404                         lr = s->nat_rule.ptr;
6405                 else
6406                         lr = r;
6407                 PFLOG_PACKET(kif, h, m, AF_INET, dir, reason, lr, a, ruleset,
6408                     &pd);
6409         }
6410
6411         kif->pfik_bytes[0][dir == PF_OUT][action != PF_PASS] += pd.tot_len;
6412         kif->pfik_packets[0][dir == PF_OUT][action != PF_PASS]++;
6413
6414         if (action == PF_PASS || r->action == PF_DROP) {
6415                 dirndx = (dir == PF_OUT);
6416                 r->packets[dirndx]++;
6417                 r->bytes[dirndx] += pd.tot_len;
6418                 if (a != NULL) {
6419                         a->packets[dirndx]++;
6420                         a->bytes[dirndx] += pd.tot_len;
6421                 }
6422                 if (s != NULL) {
6423                         if (s->nat_rule.ptr != NULL) {
6424                                 s->nat_rule.ptr->packets[dirndx]++;
6425                                 s->nat_rule.ptr->bytes[dirndx] += pd.tot_len;
6426                         }
6427                         if (s->src_node != NULL) {
6428                                 s->src_node->packets[dirndx]++;
6429                                 s->src_node->bytes[dirndx] += pd.tot_len;
6430                         }
6431                         if (s->nat_src_node != NULL) {
6432                                 s->nat_src_node->packets[dirndx]++;
6433                                 s->nat_src_node->bytes[dirndx] += pd.tot_len;
6434                         }
6435                         dirndx = (dir == s->direction) ? 0 : 1;
6436                         s->packets[dirndx]++;
6437                         s->bytes[dirndx] += pd.tot_len;
6438                 }
6439                 tr = r;
6440                 nr = (s != NULL) ? s->nat_rule.ptr : pd.nat_rule;
6441                 if (nr != NULL) {
6442                         struct pf_addr *x;
6443                         /*
6444                          * XXX: we need to make sure that the addresses
6445                          * passed to pfr_update_stats() are the same than
6446                          * the addresses used during matching (pfr_match)
6447                          */
6448                         if (r == &pf_default_rule) {
6449                                 tr = nr;
6450                                 x = (s == NULL || s->direction == dir) ?
6451                                     &pd.baddr : &pd.naddr;
6452                         } else
6453                                 x = (s == NULL || s->direction == dir) ?
6454                                     &pd.naddr : &pd.baddr;
6455                         if (x == &pd.baddr || s == NULL) {
6456                                 /* we need to change the address */
6457                                 if (dir == PF_OUT)
6458                                         pd.src = x;
6459                                 else
6460                                         pd.dst = x;
6461                         }
6462                 }
6463                 if (tr->src.addr.type == PF_ADDR_TABLE)
6464                         pfr_update_stats(tr->src.addr.p.tbl, (s == NULL ||
6465                             s->direction == dir) ? pd.src : pd.dst, pd.af,
6466                             pd.tot_len, dir == PF_OUT, r->action == PF_PASS,
6467                             tr->src.neg);
6468                 if (tr->dst.addr.type == PF_ADDR_TABLE)
6469                         pfr_update_stats(tr->dst.addr.p.tbl, (s == NULL ||
6470                             s->direction == dir) ? pd.dst : pd.src, pd.af,
6471                             pd.tot_len, dir == PF_OUT, r->action == PF_PASS,
6472                             tr->dst.neg);
6473         }
6474
6475
6476         if (action == PF_SYNPROXY_DROP) {
6477                 m_freem(*m0);
6478                 *m0 = NULL;
6479                 action = PF_PASS;
6480         } else if (r->rt)
6481                 /* pf_route can free the mbuf causing *m0 to become NULL */
6482                 pf_route(m0, r, dir, ifp, s, &pd);
6483         return (action);
6484 }
6485 #endif /* INET */
6486
6487 #ifdef INET6
6488 int
6489 pf_test6(int dir, struct ifnet *ifp, struct mbuf **m0,
6490     struct ether_header *eh, struct inpcb *inp)
6491 {
6492         struct pfi_kif          *kif;
6493         u_short                  action, reason = 0, log = 0;
6494         struct mbuf             *m = *m0, *n = NULL;
6495         struct ip6_hdr          *h = NULL;
6496         struct pf_rule          *a = NULL, *r = &pf_default_rule, *tr, *nr;
6497         struct pf_state         *s = NULL;
6498         struct pf_ruleset       *ruleset = NULL;
6499         struct pf_pdesc          pd;
6500         int                      off, terminal = 0, dirndx;
6501
6502         if (!pf_status.running)
6503                 return (PF_PASS);
6504
6505         memset(&pd, 0, sizeof(pd));
6506         if ((pd.pf_mtag = pf_get_mtag(m)) == NULL) {
6507                 DPFPRINTF(PF_DEBUG_URGENT,
6508                     ("pf_test6: pf_get_mtag returned NULL\n"));
6509                 return (PF_DROP);
6510         }
6511         if (pd.pf_mtag->flags & PF_TAG_GENERATED)
6512                 return (PF_PASS);
6513
6514         kif = (struct pfi_kif *)ifp->if_pf_kif;
6515         if (kif == NULL) {
6516                 DPFPRINTF(PF_DEBUG_URGENT,
6517                     ("pf_test6: kif == NULL, if_xname %s\n", ifp->if_xname));
6518                 return (PF_DROP);
6519         }
6520         if (kif->pfik_flags & PFI_IFLAG_SKIP)
6521                 return (PF_PASS);
6522
6523 #ifdef DIAGNOSTIC
6524         if ((m->m_flags & M_PKTHDR) == 0)
6525                 panic("non-M_PKTHDR is passed to pf_test6");
6526 #endif /* DIAGNOSTIC */
6527
6528         if (m->m_pkthdr.len < (int)sizeof(*h)) {
6529                 action = PF_DROP;
6530                 REASON_SET(&reason, PFRES_SHORT);
6531                 log = 1;
6532                 goto done;
6533         }
6534
6535         /* We do IP header normalization and packet reassembly here */
6536         if (pf_normalize_ip6(m0, dir, kif, &reason, &pd) != PF_PASS) {
6537                 action = PF_DROP;
6538                 goto done;
6539         }
6540         m = *m0;
6541         h = mtod(m, struct ip6_hdr *);
6542
6543 #if 1
6544         /*
6545          * we do not support jumbogram yet.  if we keep going, zero ip6_plen
6546          * will do something bad, so drop the packet for now.
6547          */
6548         if (htons(h->ip6_plen) == 0) {
6549                 action = PF_DROP;
6550                 REASON_SET(&reason, PFRES_NORM);        /*XXX*/
6551                 goto done;
6552         }
6553 #endif
6554
6555         pd.src = (struct pf_addr *)&h->ip6_src;
6556         pd.dst = (struct pf_addr *)&h->ip6_dst;
6557         PF_ACPY(&pd.baddr, dir == PF_OUT ? pd.src : pd.dst, AF_INET6);
6558         pd.ip_sum = NULL;
6559         pd.af = AF_INET6;
6560         pd.tos = 0;
6561         pd.tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr);
6562         pd.eh = eh;
6563
6564         off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
6565         pd.proto = h->ip6_nxt;
6566         do {
6567                 switch (pd.proto) {
6568                 case IPPROTO_FRAGMENT:
6569                         action = pf_test_fragment(&r, dir, kif, m, h,
6570                             &pd, &a, &ruleset);
6571                         if (action == PF_DROP)
6572                                 REASON_SET(&reason, PFRES_FRAG);
6573                         goto done;
6574                 case IPPROTO_ROUTING: {
6575                         struct ip6_rthdr rthdr;
6576
6577                         if (!pf_pull_hdr(m, off, &rthdr, sizeof(rthdr), NULL,
6578                             &reason, pd.af)) {
6579                                 DPFPRINTF(PF_DEBUG_MISC,
6580                                     ("pf: IPv6 short rthdr\n"));
6581                                 action = PF_DROP;
6582                                 log = 1;
6583                                 goto done;
6584                         }
6585                         if (rthdr.ip6r_type == IPV6_RTHDR_TYPE_0) {
6586                                 DPFPRINTF(PF_DEBUG_MISC,
6587                                     ("pf: IPv6 rthdr0\n"));
6588                                 action = PF_DROP;
6589                                 REASON_SET(&reason, PFRES_IPOPTIONS);
6590                                 log = 1;
6591                                 goto done;
6592                         }
6593                         /* FALLTHROUGH */
6594                 }
6595                 case IPPROTO_AH:
6596                 case IPPROTO_HOPOPTS:
6597                 case IPPROTO_DSTOPTS: {
6598                         /* get next header and header length */
6599                         struct ip6_ext  opt6;
6600
6601                         if (!pf_pull_hdr(m, off, &opt6, sizeof(opt6),
6602                             NULL, &reason, pd.af)) {
6603                                 DPFPRINTF(PF_DEBUG_MISC,
6604                                     ("pf: IPv6 short opt\n"));
6605                                 action = PF_DROP;
6606                                 log = 1;
6607                                 goto done;
6608                         }
6609                         if (pd.proto == IPPROTO_AH)
6610                                 off += (opt6.ip6e_len + 2) * 4;
6611                         else
6612                                 off += (opt6.ip6e_len + 1) * 8;
6613                         pd.proto = opt6.ip6e_nxt;
6614                         /* goto the next header */
6615                         break;
6616                 }
6617                 default:
6618                         terminal++;
6619                         break;
6620                 }
6621         } while (!terminal);
6622
6623         /* if there's no routing header, use unmodified mbuf for checksumming */
6624         if (!n)
6625                 n = m;
6626
6627         switch (pd.proto) {
6628
6629         case IPPROTO_TCP: {
6630                 struct tcphdr   th;
6631
6632                 pd.hdr.tcp = &th;
6633                 if (!pf_pull_hdr(m, off, &th, sizeof(th),
6634                     &action, &reason, AF_INET6)) {
6635                         log = action != PF_PASS;
6636                         goto done;
6637                 }
6638                 if (dir == PF_IN && pf_check_proto_cksum(n, off,
6639                     ntohs(h->ip6_plen) - (off - sizeof(struct ip6_hdr)),
6640                     IPPROTO_TCP, AF_INET6)) {
6641                         action = PF_DROP;
6642                         REASON_SET(&reason, PFRES_PROTCKSUM);
6643                         goto done;
6644                 }
6645                 pd.p_len = pd.tot_len - off - (th.th_off << 2);
6646                 action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd);
6647                 if (action == PF_DROP)
6648                         goto done;
6649                 action = pf_test_state_tcp(&s, dir, kif, m, off, h, &pd,
6650                     &reason);
6651                 if (action == PF_PASS) {
6652 #if NPFSYNC
6653                         pfsync_update_state(s);
6654 #endif /* NPFSYNC */
6655                         r = s->rule.ptr;
6656                         a = s->anchor.ptr;
6657                         log = s->log;
6658                 } else if (s == NULL)
6659                         action = pf_test_tcp(&r, &s, dir, kif,
6660                             m, off, h, &pd, &a, &ruleset, NULL, inp);
6661                 break;
6662         }
6663
6664         case IPPROTO_UDP: {
6665                 struct udphdr   uh;
6666
6667                 pd.hdr.udp = &uh;
6668                 if (!pf_pull_hdr(m, off, &uh, sizeof(uh),
6669                     &action, &reason, AF_INET6)) {
6670                         log = action != PF_PASS;
6671                         goto done;
6672                 }
6673                 if (dir == PF_IN && uh.uh_sum && pf_check_proto_cksum(n,
6674                     off, ntohs(h->ip6_plen) - (off - sizeof(struct ip6_hdr)),
6675                     IPPROTO_UDP, AF_INET6)) {
6676                         action = PF_DROP;
6677                         REASON_SET(&reason, PFRES_PROTCKSUM);
6678                         goto done;
6679                 }
6680                 if (uh.uh_dport == 0 ||
6681                     ntohs(uh.uh_ulen) > m->m_pkthdr.len - off ||
6682                     ntohs(uh.uh_ulen) < sizeof(struct udphdr)) {
6683                         action = PF_DROP;
6684                         REASON_SET(&reason, PFRES_SHORT);
6685                         goto done;
6686                 }
6687                 action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd);
6688                 if (action == PF_PASS) {
6689 #if NPFSYNC
6690                         pfsync_update_state(s);
6691 #endif /* NPFSYNC */
6692                         r = s->rule.ptr;
6693                         a = s->anchor.ptr;
6694                         log = s->log;
6695                 } else if (s == NULL)
6696                         action = pf_test_udp(&r, &s, dir, kif,
6697                             m, off, h, &pd, &a, &ruleset, NULL, inp);
6698                 break;
6699         }
6700
6701         case IPPROTO_ICMPV6: {
6702                 struct icmp6_hdr        ih;
6703
6704                 pd.hdr.icmp6 = &ih;
6705                 if (!pf_pull_hdr(m, off, &ih, sizeof(ih),
6706                     &action, &reason, AF_INET6)) {
6707                         log = action != PF_PASS;
6708                         goto done;
6709                 }
6710                 if (dir == PF_IN && pf_check_proto_cksum(n, off,
6711                     ntohs(h->ip6_plen) - (off - sizeof(struct ip6_hdr)),
6712                     IPPROTO_ICMPV6, AF_INET6)) {
6713                         action = PF_DROP;
6714                         REASON_SET(&reason, PFRES_PROTCKSUM);
6715                         goto done;
6716                 }
6717                 action = pf_test_state_icmp(&s, dir, kif,
6718                     m, off, h, &pd, &reason);
6719                 if (action == PF_PASS) {
6720 #if NPFSYNC
6721                         pfsync_update_state(s);
6722 #endif /* NPFSYNC */
6723                         r = s->rule.ptr;
6724                         a = s->anchor.ptr;
6725                         log = s->log;
6726                 } else if (s == NULL)
6727                         action = pf_test_icmp(&r, &s, dir, kif,
6728                             m, off, h, &pd, &a, &ruleset, NULL);
6729                 break;
6730         }
6731
6732         default:
6733                 action = pf_test_state_other(&s, dir, kif, &pd);
6734                 if (action == PF_PASS) {
6735 #if NPFSYNC
6736                         pfsync_update_state(s);
6737 #endif /* NPFSYNC */
6738                         r = s->rule.ptr;
6739                         a = s->anchor.ptr;
6740                         log = s->log;
6741                 } else if (s == NULL)
6742                         action = pf_test_other(&r, &s, dir, kif, m, off, h,
6743                             &pd, &a, &ruleset, NULL);
6744                 break;
6745         }
6746
6747 done:
6748         if (n != m) {
6749                 m_freem(n);
6750                 n = NULL;
6751         }
6752
6753         /* XXX handle IPv6 options, if not allowed.  not implemented. */
6754
6755         if ((s && s->tag) || r->rtableid)
6756                 pf_tag_packet(m, pd.pf_mtag, s ? s->tag : 0, r->rtableid);
6757
6758 #ifdef ALTQ
6759         if (action == PF_PASS && r->qid) {
6760                 if (pd.tos & IPTOS_LOWDELAY)
6761                         pd.pf_mtag->qid = r->pqid;
6762                 else
6763                         pd.pf_mtag->qid = r->qid;
6764                 /* add hints for ecn */
6765                 pd.pf_mtag->af = AF_INET6;
6766                 pd.pf_mtag->hdr = h;
6767                 /* add connection hash for fairq */
6768                 if (s) {
6769                         KKASSERT(s->hash != 0);
6770                         pd.pf_mtag->flags |= PF_TAG_STATE_HASHED;
6771                         pd.pf_mtag->state_hash = s->hash;
6772                 }
6773         }
6774 #endif /* ALTQ */
6775
6776         if (dir == PF_IN && action == PF_PASS && (pd.proto == IPPROTO_TCP ||
6777             pd.proto == IPPROTO_UDP) && s != NULL && s->nat_rule.ptr != NULL &&
6778             (s->nat_rule.ptr->action == PF_RDR ||
6779             s->nat_rule.ptr->action == PF_BINAT) &&
6780             IN6_IS_ADDR_LOOPBACK(&pd.dst->v6))
6781                 pd.pf_mtag->flags |= PF_TAG_TRANSLATE_LOCALHOST;
6782
6783         if (log) {
6784                 struct pf_rule *lr;
6785
6786                 if (s != NULL && s->nat_rule.ptr != NULL &&
6787                     s->nat_rule.ptr->log & PF_LOG_ALL)
6788                         lr = s->nat_rule.ptr;
6789                 else
6790                         lr = r;
6791                 PFLOG_PACKET(kif, h, m, AF_INET6, dir, reason, lr, a, ruleset,
6792                     &pd);
6793         }
6794
6795         kif->pfik_bytes[1][dir == PF_OUT][action != PF_PASS] += pd.tot_len;
6796         kif->pfik_packets[1][dir == PF_OUT][action != PF_PASS]++;
6797
6798         if (action == PF_PASS || r->action == PF_DROP) {
6799                 dirndx = (dir == PF_OUT);
6800                 r->packets[dirndx]++;
6801                 r->bytes[dirndx] += pd.tot_len;
6802                 if (a != NULL) {
6803                         a->packets[dirndx]++;
6804                         a->bytes[dirndx] += pd.tot_len;
6805                 }
6806                 if (s != NULL) {
6807                         if (s->nat_rule.ptr != NULL) {
6808                                 s->nat_rule.ptr->packets[dirndx]++;
6809                                 s->nat_rule.ptr->bytes[dirndx] += pd.tot_len;
6810                         }
6811                         if (s->src_node != NULL) {
6812                                 s->src_node->packets[dirndx]++;
6813                                 s->src_node->bytes[dirndx] += pd.tot_len;
6814                         }
6815                         if (s->nat_src_node != NULL) {
6816                                 s->nat_src_node->packets[dirndx]++;
6817                                 s->nat_src_node->bytes[dirndx] += pd.tot_len;
6818                         }
6819                         dirndx = (dir == s->direction) ? 0 : 1;
6820                         s->packets[dirndx]++;
6821                         s->bytes[dirndx] += pd.tot_len;
6822                 }
6823                 tr = r;
6824                 nr = (s != NULL) ? s->nat_rule.ptr : pd.nat_rule;
6825                 if (nr != NULL) {
6826                         struct pf_addr *x;
6827                         /*
6828                          * XXX: we need to make sure that the addresses
6829                          * passed to pfr_update_stats() are the same than
6830                          * the addresses used during matching (pfr_match)
6831                          */
6832                         if (r == &pf_default_rule) {
6833                                 tr = nr;
6834                                 x = (s == NULL || s->direction == dir) ?
6835                                     &pd.baddr : &pd.naddr;
6836                         } else {
6837                                 x = (s == NULL || s->direction == dir) ?
6838                                     &pd.naddr : &pd.baddr;
6839                         }
6840                         if (x == &pd.baddr || s == NULL) {
6841                                 if (dir == PF_OUT)
6842                                         pd.src = x;
6843                                 else
6844                                         pd.dst = x;
6845                         }
6846                 }
6847                 if (tr->src.addr.type == PF_ADDR_TABLE)
6848                         pfr_update_stats(tr->src.addr.p.tbl, (s == NULL ||
6849                             s->direction == dir) ? pd.src : pd.dst, pd.af,
6850                             pd.tot_len, dir == PF_OUT, r->action == PF_PASS,
6851                             tr->src.neg);
6852                 if (tr->dst.addr.type == PF_ADDR_TABLE)
6853                         pfr_update_stats(tr->dst.addr.p.tbl, (s == NULL ||
6854                             s->direction == dir) ? pd.dst : pd.src, pd.af,
6855                             pd.tot_len, dir == PF_OUT, r->action == PF_PASS,
6856                             tr->dst.neg);
6857         }
6858
6859
6860         if (action == PF_SYNPROXY_DROP) {
6861                 m_freem(*m0);
6862                 *m0 = NULL;
6863                 action = PF_PASS;
6864         } else if (r->rt)
6865                 /* pf_route6 can free the mbuf causing *m0 to become NULL */
6866                 pf_route6(m0, r, dir, ifp, s, &pd);
6867
6868         return (action);
6869 }
6870 #endif /* INET6 */
6871
6872 int
6873 pf_check_congestion(struct ifqueue *ifq)
6874 {
6875                 return (0);
6876 }