sys/contrib/ipfilter/netinet/fil.c

   1 /*
   2  * Copyright (C) 1993-2001 by Darren Reed.
   3  *
   4  * See the IPFILTER.LICENCE file for details on licencing.
   5  */
   6 #if defined(__sgi) && (IRIX > 602)
   7 # include <sys/ptimers.h>
   8 #endif
   9 #include <sys/errno.h>
  10 #include <sys/types.h>
  11 #include <sys/param.h>
  12 #include <sys/time.h>
  13 #include <sys/file.h>
  14 #if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \
  15     defined(_KERNEL)
  16 # include "opt_ipfilter_log.h"
  17 #endif
  18 #if (defined(KERNEL) || defined(_KERNEL)) && defined(__FreeBSD_version) && \
  19     (__FreeBSD_version >= 220000)
  20 # if (__FreeBSD_version >= 400000)
  21 #  ifndef KLD_MODULE
  22 #   include "opt_inet6.h"
  23 #  endif
  24 #  if (__FreeBSD_version == 400019)
  25 #   define CSUM_DELAY_DATA
  26 #  endif
  27 # endif
  28 # include <sys/filio.h>
  29 # include <sys/fcntl.h>
  30 #else
  31 # include <sys/ioctl.h>
  32 #endif
  33 #if (defined(_KERNEL) || defined(KERNEL)) && !defined(linux)
  34 # include <sys/systm.h>
  35 #else
  36 # include <stdio.h>
  37 # include <string.h>
  38 # include <stdlib.h>
  39 #endif
  40 #if !defined(__SVR4) && !defined(__svr4__)
  41 # ifndef linux
  42 #  include <sys/mbuf.h>
  43 # endif
  44 #else
  45 # include <sys/byteorder.h>
  46 # if SOLARIS2 < 5
  47 #  include <sys/dditypes.h>
  48 # endif
  49 #  include <sys/stream.h>
  50 #endif
  51 #ifndef linux
  52 # include <sys/protosw.h>
  53 # include <sys/socket.h>
  54 #endif
  55 #include <net/if.h>
  56 #ifdef sun
  57 # include <net/af.h>
  58 #endif
  59 #include <net/route.h>
  60 #include <netinet/in.h>
  61 #include <netinet/in_systm.h>
  62 #include <netinet/ip.h>
  63 #ifndef linux
  64 # include <netinet/ip_var.h>
  65 #endif
  66 #if defined(__sgi) && defined(IFF_DRVRLOCK) /* IRIX 6 */
  67 # include <sys/hashing.h>
  68 # include <netinet/in_var.h>
  69 #endif
  70 #include <netinet/tcp.h>
  71 #include <netinet/udp.h>
  72 #include <netinet/ip_icmp.h>
  73 #include "netinet/ip_compat.h"
  74 #ifdef  USE_INET6
  75 # include <netinet/icmp6.h>
  76 # if !SOLARIS && defined(_KERNEL)
  77 #  include <netinet6/in6_var.h>
  78 # endif
  79 #endif
  80 #include <netinet/tcpip.h>
  81 #include "netinet/ip_fil.h"
  82 #include "netinet/ip_nat.h"
  83 #include "netinet/ip_frag.h"
  84 #include "netinet/ip_state.h"
  85 #include "netinet/ip_proxy.h"
  86 #include "netinet/ip_auth.h"
  87 # if defined(__FreeBSD_version) && (__FreeBSD_version >= 300000)
  88 #  include <sys/malloc.h>
  89 #  if defined(_KERNEL) && !defined(IPFILTER_LKM)
  90 #   include "opt_ipfilter.h"
  91 #  endif
  92 # endif
  93 #ifndef MIN
  94 # define        MIN(a,b)        (((a)<(b))?(a):(b))
  95 #endif
  96 #include "netinet/ipl.h"
  97
  98 #include <machine/in_cksum.h>
  99
 100 #if !defined(lint)
 101 static const char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-2000 Darren Reed";
 102 static const char rcsid[] = "@(#)$FreeBSD: src/sys/contrib/ipfilter/netinet/fil.c,v 1.23.2.6 2003/03/01 03:55:54 darrenr Exp $";
 103 #endif
 104
 105 #ifndef _KERNEL
 106 # include "ipf.h"
 107 # include "ipt.h"
 108 extern  int     opts;
 109
 110 # define        FR_VERBOSE(verb_pr)                     verbose verb_pr
 111 # define        FR_DEBUG(verb_pr)                       debug verb_pr
 112 # define        IPLLOG(a, c, d, e)              ipflog(a, c, d, e)
 113 #else /* #ifndef _KERNEL */
 114 # define        FR_VERBOSE(verb_pr)
 115 # define        FR_DEBUG(verb_pr)
 116 # define        IPLLOG(a, c, d, e)              ipflog(a, c, d, e)
 117 # if SOLARIS || defined(__sgi)
 118 extern  KRWLOCK_T       ipf_mutex, ipf_auth, ipf_nat;
 119 extern  kmutex_t        ipf_rw;
 120 # endif /* SOLARIS || __sgi */
 121 #endif /* _KERNEL */
 122
 123
 124 struct  filterstats frstats[2] = {{0,0,0,0,0},{0,0,0,0,0}};
 125 struct  frentry *ipfilter[2][2] = { { NULL, NULL }, { NULL, NULL } },
 126 #ifdef  USE_INET6
 127                 *ipfilter6[2][2] = { { NULL, NULL }, { NULL, NULL } },
 128                 *ipacct6[2][2] = { { NULL, NULL }, { NULL, NULL } },
 129 #endif
 130                 *ipacct[2][2] = { { NULL, NULL }, { NULL, NULL } };
 131 struct  frgroup *ipfgroups[3][2];
 132 int     fr_flags = IPF_LOGGING;
 133 int     fr_active = 0;
 134 int     fr_chksrc = 0;
 135 int     fr_minttl = 3;
 136 int     fr_minttllog = 1;
 137 #if defined(IPFILTER_DEFAULT_BLOCK)
 138 int     fr_pass = FR_NOMATCH|FR_BLOCK;
 139 #else
 140 int     fr_pass = (IPF_DEFAULT_PASS|FR_NOMATCH);
 141 #endif
 142 char    ipfilter_version[] = IPL_VERSION;
 143
 144 fr_info_t       frcache[2];
 145
 146 static  int     frflushlist __P((int, minor_t, int *, frentry_t **));
 147 #ifdef  _KERNEL
 148 static  void    frsynclist __P((frentry_t *));
 149 #endif
 150
 151
 152 /*
 153  * bit values for identifying presence of individual IP options
 154  */
 155 struct  optlist ipopts[20] = {
 156         { IPOPT_NOP,    0x000001 },
 157         { IPOPT_RR,     0x000002 },
 158         { IPOPT_ZSU,    0x000004 },
 159         { IPOPT_MTUP,   0x000008 },
 160         { IPOPT_MTUR,   0x000010 },
 161         { IPOPT_ENCODE, 0x000020 },
 162         { IPOPT_TS,     0x000040 },
 163         { IPOPT_TR,     0x000080 },
 164         { IPOPT_SECURITY, 0x000100 },
 165         { IPOPT_LSRR,   0x000200 },
 166         { IPOPT_E_SEC,  0x000400 },
 167         { IPOPT_CIPSO,  0x000800 },
 168         { IPOPT_SATID,  0x001000 },
 169         { IPOPT_SSRR,   0x002000 },
 170         { IPOPT_ADDEXT, 0x004000 },
 171         { IPOPT_VISA,   0x008000 },
 172         { IPOPT_IMITD,  0x010000 },
 173         { IPOPT_EIP,    0x020000 },
 174         { IPOPT_FINN,   0x040000 },
 175         { 0,            0x000000 }
 176 };
 177
 178 /*
 179  * bit values for identifying presence of individual IP security options
 180  */
 181 struct  optlist secopt[8] = {
 182         { IPSO_CLASS_RES4,      0x01 },
 183         { IPSO_CLASS_TOPS,      0x02 },
 184         { IPSO_CLASS_SECR,      0x04 },
 185         { IPSO_CLASS_RES3,      0x08 },
 186         { IPSO_CLASS_CONF,      0x10 },
 187         { IPSO_CLASS_UNCL,      0x20 },
 188         { IPSO_CLASS_RES2,      0x40 },
 189         { IPSO_CLASS_RES1,      0x80 }
 190 };
 191
 192
 193 /*
 194  * compact the IP header into a structure which contains just the info.
 195  * which is useful for comparing IP headers with.
 196  */
 197 void    fr_makefrip(hlen, ip, fin)
 198 int hlen;
 199 ip_t *ip;
 200 fr_info_t *fin;
 201 {
 202         u_short optmsk = 0, secmsk = 0, auth = 0;
 203         int i, mv, ol, off, p, plen, v;
 204         fr_ip_t *fi = &fin->fin_fi;
 205         struct optlist *op;
 206         u_char *s, opt;
 207         tcphdr_t *tcp;
 208
 209         fin->fin_rev = 0;
 210         fin->fin_fr = NULL;
 211         fin->fin_tcpf = 0;
 212         fin->fin_data[0] = 0;
 213         fin->fin_data[1] = 0;
 214         fin->fin_rule = -1;
 215         fin->fin_group = -1;
 216         fin->fin_icode = ipl_unreach;
 217         v = fin->fin_v;
 218         fi->fi_v = v;
 219         fin->fin_hlen = hlen;
 220         if (v == 4) {
 221                 fin->fin_id = ip->ip_id;
 222                 fi->fi_tos = ip->ip_tos;
 223                 off = (ip->ip_off & IP_OFFMASK);
 224                 tcp = (tcphdr_t *)((char *)ip + hlen);
 225                 (*(((u_short *)fi) + 1)) = (*(((u_short *)ip) + 4));
 226                 fi->fi_src.i6[1] = 0;
 227                 fi->fi_src.i6[2] = 0;
 228                 fi->fi_src.i6[3] = 0;
 229                 fi->fi_dst.i6[1] = 0;
 230                 fi->fi_dst.i6[2] = 0;
 231                 fi->fi_dst.i6[3] = 0;
 232                 fi->fi_saddr = ip->ip_src.s_addr;
 233                 fi->fi_daddr = ip->ip_dst.s_addr;
 234                 p = ip->ip_p;
 235                 fi->fi_fl = (hlen > sizeof(ip_t)) ? FI_OPTIONS : 0;
 236                 if (ip->ip_off & (IP_MF|IP_OFFMASK))
 237                         fi->fi_fl |= FI_FRAG;
 238                 plen = ip->ip_len;
 239                 fin->fin_dlen = plen - hlen;
 240         }
 241 #ifdef  USE_INET6
 242         else if (v == 6) {
 243                 ip6_t *ip6 = (ip6_t *)ip;
 244
 245                 off = 0;
 246                 p = ip6->ip6_nxt;
 247                 fi->fi_p = p;
 248                 fi->fi_ttl = ip6->ip6_hlim;
 249                 tcp = (tcphdr_t *)(ip6 + 1);
 250                 fi->fi_src.in6 = ip6->ip6_src;
 251                 fi->fi_dst.in6 = ip6->ip6_dst;
 252                 fin->fin_id = (u_short)(ip6->ip6_flow & 0xffff);
 253                 fi->fi_tos = 0;
 254                 fi->fi_fl = 0;
 255                 plen = ntohs(ip6->ip6_plen);
 256                 fin->fin_dlen = plen;
 257                 plen += sizeof(*ip6);
 258         }
 259 #endif
 260         else
 261                 return;
 262
 263         fin->fin_off = off;
 264         fin->fin_plen = plen;
 265         fin->fin_dp = (char *)tcp;
 266         fin->fin_misc = 0;
 267         off <<= 3;
 268
 269         switch (p)
 270         {
 271 #ifdef USE_INET6
 272         case IPPROTO_ICMPV6 :
 273         {
 274                 int minicmpsz = sizeof(struct icmp6_hdr);
 275                 struct icmp6_hdr *icmp6;
 276
 277                 if (fin->fin_dlen > 1) {
 278                         fin->fin_data[0] = *(u_short *)tcp;
 279
 280                         icmp6 = (struct icmp6_hdr *)tcp;
 281
 282                         switch (icmp6->icmp6_type)
 283                         {
 284                         case ICMP6_ECHO_REPLY :
 285                         case ICMP6_ECHO_REQUEST :
 286                                 minicmpsz = ICMP6_MINLEN;
 287                                 break;
 288                         case ICMP6_DST_UNREACH :
 289                         case ICMP6_PACKET_TOO_BIG :
 290                         case ICMP6_TIME_EXCEEDED :
 291                         case ICMP6_PARAM_PROB :
 292                                 minicmpsz = ICMP6ERR_IPICMPHLEN;
 293                                 break;
 294                         default :
 295                                 break;
 296                         }
 297                 }
 298
 299                 if (!(plen >= minicmpsz))
 300                         fi->fi_fl |= FI_SHORT;
 301
 302                 break;
 303         }
 304 #endif
 305         case IPPROTO_ICMP :
 306         {
 307                 int minicmpsz = sizeof(struct icmp);
 308                 icmphdr_t *icmp;
 309
 310                 if (!off && (fin->fin_dlen > 1)) {
 311                         fin->fin_data[0] = *(u_short *)tcp;
 312
 313                         icmp = (icmphdr_t *)tcp;
 314
 315                         switch (icmp->icmp_type)
 316                         {
 317                         case ICMP_ECHOREPLY :
 318                         case ICMP_ECHO :
 319                         /* Router discovery messages - RFC 1256 */
 320                         case ICMP_ROUTERADVERT :
 321                         case ICMP_ROUTERSOLICIT :
 322                                 minicmpsz = ICMP_MINLEN;
 323                                 break;
 324                         /*
 325                          * type(1) + code(1) + cksum(2) + id(2) seq(2) +
 326                          * 3*timestamp(3*4)
 327                          */
 328                         case ICMP_TSTAMP :
 329                         case ICMP_TSTAMPREPLY :
 330                                 minicmpsz = 20;
 331                                 break;
 332                         /*
 333                          * type(1) + code(1) + cksum(2) + id(2) seq(2) +
 334                          * mask(4)
 335                          */
 336                         case ICMP_MASKREQ :
 337                         case ICMP_MASKREPLY :
 338                                 minicmpsz = 12;
 339                                 break;
 340                         default :
 341                                 break;
 342                         }
 343                 }
 344
 345                 if ((!(plen >= hlen + minicmpsz) && !off) ||
 346                     (off && off < sizeof(struct icmp)))
 347                         fi->fi_fl |= FI_SHORT;
 348
 349                 break;
 350         }
 351         case IPPROTO_TCP :
 352                 fi->fi_fl |= FI_TCPUDP;
 353 #ifdef  USE_INET6
 354                 if (v == 6) {
 355                         if (plen < sizeof(struct tcphdr))
 356                                 fi->fi_fl |= FI_SHORT;
 357                 } else
 358 #endif
 359                 if (v == 4) {
 360                         if ((!IPMINLEN(ip, tcphdr) && !off) ||
 361                              (off && off < sizeof(struct tcphdr)))
 362                                 fi->fi_fl |= FI_SHORT;
 363                 }
 364                 if (!(fi->fi_fl & FI_SHORT) && !off)
 365                         fin->fin_tcpf = tcp->th_flags;
 366                 goto getports;
 367         case IPPROTO_UDP :
 368                 fi->fi_fl |= FI_TCPUDP;
 369 #ifdef  USE_INET6
 370                 if (v == 6) {
 371                         if (plen < sizeof(struct udphdr))
 372                                 fi->fi_fl |= FI_SHORT;
 373                 } else
 374 #endif
 375                 if (v == 4) {
 376                         if ((!IPMINLEN(ip, udphdr) && !off) ||
 377                             (off && off < sizeof(struct udphdr)))
 378                                 fi->fi_fl |= FI_SHORT;
 379                 }
 380 getports:
 381                 if (!off && (fin->fin_dlen > 3)) {
 382                         fin->fin_data[0] = ntohs(tcp->th_sport);
 383                         fin->fin_data[1] = ntohs(tcp->th_dport);
 384                 }
 385                 break;
 386         case IPPROTO_ESP :
 387 #ifdef  USE_INET6
 388                 if (v == 6) {
 389                         if (plen < 8)
 390                                 fi->fi_fl |= FI_SHORT;
 391                 } else
 392 #endif
 393                 if (v == 4) {
 394                         if (((ip->ip_len < hlen + 8) && !off) ||
 395                             (off && off < 8))
 396                                 fi->fi_fl |= FI_SHORT;
 397                 }
 398                 break;
 399         default :
 400                 break;
 401         }
 402
 403 #ifdef  USE_INET6
 404         if (v == 6) {
 405                 fi->fi_optmsk = 0;
 406                 fi->fi_secmsk = 0;
 407                 fi->fi_auth = 0;
 408                 return;
 409         }
 410 #endif
 411
 412         for (s = (u_char *)(ip + 1), hlen -= (int)sizeof(*ip); hlen > 0; ) {
 413                 opt = *s;
 414                 if (opt == '\0')
 415                         break;
 416                 else if (opt == IPOPT_NOP)
 417                         ol = 1;
 418                 else {
 419                         if (hlen < 2)
 420                                 break;
 421                         ol = (int)*(s + 1);
 422                         if (ol < 2 || ol > hlen)
 423                                 break;
 424                 }
 425                 for (i = 9, mv = 4; mv >= 0; ) {
 426                         op = ipopts + i;
 427                         if (opt == (u_char)op->ol_val) {
 428                                 optmsk |= op->ol_bit;
 429                                 if (opt == IPOPT_SECURITY) {
 430                                         struct optlist *sp;
 431                                         u_char  sec;
 432                                         int j, m;
 433
 434                                         sec = *(s + 2); /* classification */
 435                                         for (j = 3, m = 2; m >= 0; ) {
 436                                                 sp = secopt + j;
 437                                                 if (sec == sp->ol_val) {
 438                                                         secmsk |= sp->ol_bit;
 439                                                         auth = *(s + 3);
 440                                                         auth *= 256;
 441                                                         auth += *(s + 4);
 442                                                         break;
 443                                                 }
 444                                                 if (sec < sp->ol_val)
 445                                                         j -= m--;
 446                                                 else
 447                                                         j += m--;
 448                                         }
 449                                 }
 450                                 break;
 451                         }
 452                         if (opt < op->ol_val)
 453                                 i -= mv--;
 454                         else
 455                                 i += mv--;
 456                 }
 457                 hlen -= ol;
 458                 s += ol;
 459         }
 460         if (auth && !(auth & 0x0100))
 461                 auth &= 0xff00;
 462         fi->fi_optmsk = optmsk;
 463         fi->fi_secmsk = secmsk;
 464         fi->fi_auth = auth;
 465 }
 466
 467
 468 /*
 469  * check an IP packet for TCP/UDP characteristics such as ports and flags.
 470  */
 471 int fr_tcpudpchk(ft, fin)
 472 frtuc_t *ft;
 473 fr_info_t *fin;
 474 {
 475         register u_short po, tup;
 476         register char i;
 477         register int err = 1;
 478
 479         /*
 480          * Both ports should *always* be in the first fragment.
 481          * So far, I cannot find any cases where they can not be.
 482          *
 483          * compare destination ports
 484          */
 485         if ((i = (int)ft->ftu_dcmp)) {
 486                 po = ft->ftu_dport;
 487                 tup = fin->fin_data[1];
 488                 /*
 489                  * Do opposite test to that required and
 490                  * continue if that succeeds.
 491                  */
 492                 if (!--i && tup != po) /* EQUAL */
 493                         err = 0;
 494                 else if (!--i && tup == po) /* NOTEQUAL */
 495                         err = 0;
 496                 else if (!--i && tup >= po) /* LESSTHAN */
 497                         err = 0;
 498                 else if (!--i && tup <= po) /* GREATERTHAN */
 499                         err = 0;
 500                 else if (!--i && tup > po) /* LT or EQ */
 501                         err = 0;
 502                 else if (!--i && tup < po) /* GT or EQ */
 503                         err = 0;
 504                 else if (!--i &&           /* Out of range */
 505                          (tup >= po && tup <= ft->ftu_dtop))
 506                         err = 0;
 507                 else if (!--i &&           /* In range */
 508                          (tup <= po || tup >= ft->ftu_dtop))
 509                         err = 0;
 510         }
 511         /*
 512          * compare source ports
 513          */
 514         if (err && (i = (int)ft->ftu_scmp)) {
 515                 po = ft->ftu_sport;
 516                 tup = fin->fin_data[0];
 517                 if (!--i && tup != po)
 518                         err = 0;
 519                 else if (!--i && tup == po)
 520                         err = 0;
 521                 else if (!--i && tup >= po)
 522                         err = 0;
 523                 else if (!--i && tup <= po)
 524                         err = 0;
 525                 else if (!--i && tup > po)
 526                         err = 0;
 527                 else if (!--i && tup < po)
 528                         err = 0;
 529                 else if (!--i &&           /* Out of range */
 530                          (tup >= po && tup <= ft->ftu_stop))
 531                         err = 0;
 532                 else if (!--i &&           /* In range */
 533                          (tup <= po || tup >= ft->ftu_stop))
 534                         err = 0;
 535         }
 536
 537         /*
 538          * If we don't have all the TCP/UDP header, then how can we
 539          * expect to do any sort of match on it ?  If we were looking for
 540          * TCP flags, then NO match.  If not, then match (which should
 541          * satisfy the "short" class too).
 542          */
 543         if (err && (fin->fin_fi.fi_p == IPPROTO_TCP)) {
 544                 if (fin->fin_fl & FI_SHORT)
 545                         return !(ft->ftu_tcpf | ft->ftu_tcpfm);
 546                 /*
 547                  * Match the flags ?  If not, abort this match.
 548                  */
 549                 if (ft->ftu_tcpfm &&
 550                     ft->ftu_tcpf != (fin->fin_tcpf & ft->ftu_tcpfm)) {
 551                         FR_DEBUG(("f. %#x & %#x != %#x\n", fin->fin_tcpf,
 552                                  ft->ftu_tcpfm, ft->ftu_tcpf));
 553                         err = 0;
 554                 }
 555         }
 556         return err;
 557 }
 558
 559 /*
 560  * Check the input/output list of rules for a match and result.
 561  * Could be per interface, but this gets real nasty when you don't have
 562  * kernel sauce.
 563  */
 564 int fr_scanlist(passin, ip, fin, m)
 565 u_32_t passin;
 566 ip_t *ip;
 567 register fr_info_t *fin;
 568 void *m;
 569 {
 570         register struct frentry *fr;
 571         register fr_ip_t *fi = &fin->fin_fi;
 572         int rulen, portcmp = 0, off, skip = 0, logged = 0;
 573         u_32_t pass, passt, passl;
 574         frentry_t *frl;
 575
 576         frl = NULL;
 577         pass = passin;
 578         fr = fin->fin_fr;
 579         fin->fin_fr = NULL;
 580         off = fin->fin_off;
 581
 582         if ((fi->fi_fl & FI_TCPUDP) && (fin->fin_dlen > 3) && !off)
 583                 portcmp = 1;
 584
 585         for (rulen = 0; fr; fr = fr->fr_next, rulen++) {
 586                 if (skip) {
 587                         FR_VERBOSE(("%d (%#x)\n", skip, fr->fr_flags));
 588                         skip--;
 589                         continue;
 590                 }
 591                 /*
 592                  * In all checks below, a null (zero) value in the
 593                  * filter struture is taken to mean a wildcard.
 594                  *
 595                  * check that we are working for the right interface
 596                  */
 597 #ifdef  _KERNEL
 598 # if    (BSD >= 199306)
 599                 if (fin->fin_out != 0) {
 600                         if ((fr->fr_oifa &&
 601                              (fr->fr_oifa != ((mb_t *)m)->m_pkthdr.rcvif)))
 602                                 continue;
 603                 }
 604 # endif
 605 #else
 606                 if (opts & (OPT_VERBOSE|OPT_DEBUG))
 607                         printf("\n");
 608 #endif
 609
 610                 FR_VERBOSE(("%c", fr->fr_skip ? 's' :
 611                                   (pass & FR_PASS) ? 'p' :
 612                                   (pass & FR_AUTH) ? 'a' :
 613                                   (pass & FR_ACCOUNT) ? 'A' :
 614                                   (pass & FR_NOMATCH) ? 'n' : 'b'));
 615
 616                 if (fr->fr_ifa && fr->fr_ifa != fin->fin_ifp)
 617                         continue;
 618
 619                 FR_VERBOSE((":i"));
 620                 {
 621                         register u_32_t *ld, *lm, *lip;
 622                         register int i;
 623
 624                         lip = (u_32_t *)fi;
 625                         lm = (u_32_t *)&fr->fr_mip;
 626                         ld = (u_32_t *)&fr->fr_ip;
 627                         i = ((*lip & *lm) != *ld);
 628                         FR_DEBUG(("0. %#08x & %#08x != %#08x\n",
 629                                    *lip, *lm, *ld));
 630                         if (i)
 631                                 continue;
 632                         /*
 633                          * We now know whether the packet version and the
 634                          * rule version match, along with protocol, ttl and
 635                          * tos.
 636                          */
 637                         lip++, lm++, ld++;
 638                         /*
 639                          * Unrolled loops (4 each, for 32 bits).
 640                          */
 641                         FR_DEBUG(("1a. %#08x & %#08x != %#08x\n",
 642                                    *lip, *lm, *ld));
 643                         i |= ((*lip++ & *lm++) != *ld++) << 5;
 644                         if (fi->fi_v == 6) {
 645                                 FR_DEBUG(("1b. %#08x & %#08x != %#08x\n",
 646                                            *lip, *lm, *ld));
 647                                 i |= ((*lip++ & *lm++) != *ld++) << 5;
 648                                 FR_DEBUG(("1c. %#08x & %#08x != %#08x\n",
 649                                            *lip, *lm, *ld));
 650                                 i |= ((*lip++ & *lm++) != *ld++) << 5;
 651                                 FR_DEBUG(("1d. %#08x & %#08x != %#08x\n",
 652                                            *lip, *lm, *ld));
 653                                 i |= ((*lip++ & *lm++) != *ld++) << 5;
 654                         } else {
 655                                 lip += 3;
 656                                 lm += 3;
 657                                 ld += 3;
 658                         }
 659                         i ^= (fr->fr_flags & FR_NOTSRCIP);
 660                         if (i)
 661                                 continue;
 662                         FR_DEBUG(("2a. %#08x & %#08x != %#08x\n",
 663                                    *lip, *lm, *ld));
 664                         i |= ((*lip++ & *lm++) != *ld++) << 6;
 665                         if (fi->fi_v == 6) {
 666                                 FR_DEBUG(("2b. %#08x & %#08x != %#08x\n",
 667                                            *lip, *lm, *ld));
 668                                 i |= ((*lip++ & *lm++) != *ld++) << 6;
 669                                 FR_DEBUG(("2c. %#08x & %#08x != %#08x\n",
 670                                            *lip, *lm, *ld));
 671                                 i |= ((*lip++ & *lm++) != *ld++) << 6;
 672                                 FR_DEBUG(("2d. %#08x & %#08x != %#08x\n",
 673                                            *lip, *lm, *ld));
 674                                 i |= ((*lip++ & *lm++) != *ld++) << 6;
 675                         } else {
 676                                 lip += 3;
 677                                 lm += 3;
 678                                 ld += 3;
 679                         }
 680                         i ^= (fr->fr_flags & FR_NOTDSTIP);
 681                         if (i)
 682                                 continue;
 683                         FR_DEBUG(("3. %#08x & %#08x != %#08x\n",
 684                                    *lip, *lm, *ld));
 685                         i |= ((*lip++ & *lm++) != *ld++);
 686                         FR_DEBUG(("4. %#08x & %#08x != %#08x\n",
 687                                    *lip, *lm, *ld));
 688                         i |= ((*lip & *lm) != *ld);
 689                         if (i)
 690                                 continue;
 691                 }
 692
 693                 /*
 694                  * If a fragment, then only the first has what we're looking
 695                  * for here...
 696                  */
 697                 if (!portcmp && (fr->fr_dcmp || fr->fr_scmp || fr->fr_tcpf ||
 698                                  fr->fr_tcpfm))
 699                         continue;
 700                 if (fi->fi_fl & FI_TCPUDP) {
 701                         if (!fr_tcpudpchk(&fr->fr_tuc, fin))
 702                                 continue;
 703                 } else if (fr->fr_icmpm || fr->fr_icmp) {
 704                         if (((fi->fi_p != IPPROTO_ICMP) &&
 705                             (fi->fi_p != IPPROTO_ICMPV6)) || off ||
 706                             (fin->fin_dlen < 2))
 707                                 continue;
 708                         if ((fin->fin_data[0] & fr->fr_icmpm) != fr->fr_icmp) {
 709                                 FR_DEBUG(("i. %#x & %#x != %#x\n",
 710                                          fin->fin_data[0], fr->fr_icmpm,
 711                                          fr->fr_icmp));
 712                                 continue;
 713                         }
 714                 }
 715                 FR_VERBOSE(("*"));
 716
 717                 if (fr->fr_flags & FR_NOMATCH) {
 718                         passt = passl;
 719                         passl = passin;
 720                         fin->fin_fr = frl;
 721                         frl = NULL;
 722                         if (fr->fr_flags & FR_QUICK)
 723                                 break;
 724                         continue;
 725                 }
 726
 727                 passl = passt;
 728                 passt = fr->fr_flags;
 729                 frl = fin->fin_fr;
 730                 fin->fin_fr = fr;
 731 #if (BSD >= 199306) && (defined(_KERNEL) || defined(KERNEL))
 732                 if (securelevel <= 0)
 733 #endif
 734                         if ((passt & FR_CALLNOW) && fr->fr_func)
 735                                 passt = (*fr->fr_func)(passt, ip, fin);
 736 #ifdef  IPFILTER_LOG
 737                 /*
 738                  * Just log this packet...
 739                  */
 740                 if ((passt & FR_LOGMASK) == FR_LOG) {
 741                         if (!IPLLOG(passt, ip, fin, m)) {
 742                                 if (passt & FR_LOGORBLOCK)
 743                                         passt |= FR_BLOCK|FR_QUICK;
 744                                 ATOMIC_INCL(frstats[fin->fin_out].fr_skip);
 745                         }
 746                         ATOMIC_INCL(frstats[fin->fin_out].fr_pkl);
 747                         logged = 1;
 748                 }
 749 #endif /* IPFILTER_LOG */
 750                 ATOMIC_INCL(fr->fr_hits);
 751                 if (passt & FR_ACCOUNT)
 752                         fr->fr_bytes += (U_QUAD_T)ip->ip_len;
 753                 else
 754                         fin->fin_icode = fr->fr_icode;
 755                 fin->fin_rule = rulen;
 756                 fin->fin_group = fr->fr_group;
 757                 if (fr->fr_grp != NULL) {
 758                         fin->fin_fr = fr->fr_grp;
 759                         passt = fr_scanlist(passt, ip, fin, m);
 760                         if (fin->fin_fr == NULL) {
 761                                 fin->fin_rule = rulen;
 762                                 fin->fin_group = fr->fr_group;
 763                                 fin->fin_fr = fr;
 764                         }
 765                         if (passt & FR_DONTCACHE)
 766                                 logged = 1;
 767                 }
 768                 if (!(skip = fr->fr_skip) && (passt & FR_LOGMASK) != FR_LOG)
 769                         pass = passt;
 770                 FR_DEBUG(("pass %#x\n", pass));
 771                 if (passt & FR_QUICK)
 772                         break;
 773         }
 774         if (logged)
 775                 pass |= FR_DONTCACHE;
 776         pass |= (fi->fi_fl << 24);
 777         return pass;
 778 }
 779
 780
 781 /*
 782  * frcheck - filter check
 783  * check using source and destination addresses/ports in a packet whether
 784  * or not to pass it on or not.
 785  */
 786 int fr_check(ip, hlen, ifp, out
 787 #if defined(_KERNEL) && SOLARIS
 788 , qif, mp)
 789 qif_t *qif;
 790 #else
 791 , mp)
 792 #endif
 793 mb_t **mp;
 794 ip_t *ip;
 795 int hlen;
 796 void *ifp;
 797 int out;
 798 {
 799         /*
 800          * The above really sucks, but short of writing a diff
 801          */
 802         fr_info_t frinfo, *fc;
 803         register fr_info_t *fin = &frinfo;
 804         int changed, error = EHOSTUNREACH, v = ip->ip_v;
 805         frentry_t *fr = NULL, *list;
 806         u_32_t pass, apass;
 807 #if !SOLARIS || !defined(_KERNEL)
 808         register mb_t *m = *mp;
 809 #endif
 810
 811 #ifdef  _KERNEL
 812         int p, len, drop = 0, logit = 0;
 813         mb_t *mc = NULL;
 814 # if !defined(__SVR4) && !defined(__svr4__)
 815 #  ifdef __sgi
 816         char hbuf[128];
 817 #  endif
 818         int up;
 819
 820 #  if !SOLARIS && !defined(NETBSD_PF) && \
 821       ((defined(__FreeBSD__) && (__FreeBSD_version < 500011)) || \
 822        defined(__OpenBSD__) || defined(_BSDI_VERSION))
 823         if (fr_checkp != fr_check && fr_running > 0) {
 824                 static int counter = 0;
 825
 826                 if (counter == 0) {
 827                         printf("WARNING: fr_checkp corrupt: value %lx\n",
 828                                 (u_long)fr_checkp);
 829                         printf("WARNING: fr_checkp should be %lx\n",
 830                                 (u_long)fr_check);
 831                         printf("WARNING: fixing fr_checkp\n");
 832                 }
 833                 fr_checkp = fr_check;
 834                 counter++;
 835                 if (counter == 10000)
 836                         counter = 0;
 837         }
 838 #  endif
 839
 840 #  ifdef M_CANFASTFWD
 841         /*
 842          * XXX For now, IP Filter and fast-forwarding of cached flows
 843          * XXX are mutually exclusive.  Eventually, IP Filter should
 844          * XXX get a "can-fast-forward" filter rule.
 845          */
 846         m->m_flags &= ~M_CANFASTFWD;
 847 #  endif /* M_CANFASTFWD */
 848 #  ifdef CSUM_DELAY_DATA
 849         /*
 850          * disable delayed checksums.
 851          */
 852         if ((out != 0) && (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA)) {
 853                 in_delayed_cksum(m);
 854                 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
 855         }
 856 #  endif /* CSUM_DELAY_DATA */
 857
 858 # ifdef USE_INET6
 859         if (v == 6) {
 860                 len = ntohs(((ip6_t*)ip)->ip6_plen);
 861                 if (!len)
 862                         return -1;      /* potential jumbo gram */
 863                 len += sizeof(ip6_t);
 864                 p = ((ip6_t *)ip)->ip6_nxt;
 865         } else
 866 # endif
 867         {
 868                 p = ip->ip_p;
 869                 len = ip->ip_len;
 870         }
 871
 872         if ((p == IPPROTO_TCP || p == IPPROTO_UDP ||
 873             (v == 4 && p == IPPROTO_ICMP)
 874 # ifdef USE_INET6
 875             || (v == 6 && p == IPPROTO_ICMPV6)
 876 # endif
 877            )) {
 878                 int plen = 0;
 879
 880                 if ((v == 6) || (ip->ip_off & IP_OFFMASK) == 0)
 881                         switch(p)
 882                         {
 883                         case IPPROTO_TCP:
 884                                 plen = sizeof(tcphdr_t);
 885                                 break;
 886                         case IPPROTO_UDP:
 887                                 plen = sizeof(udphdr_t);
 888                                 break;
 889                         /* 96 - enough for complete ICMP error IP header */
 890                         case IPPROTO_ICMP:
 891                                 plen = ICMPERR_MAXPKTLEN - sizeof(ip_t);
 892                                 break;
 893                         case IPPROTO_ESP:
 894                                 plen = 8;
 895                                 break;
 896 # ifdef USE_INET6
 897                         case IPPROTO_ICMPV6 :
 898                                 /*
 899                                  * XXX does not take intermediate header
 900                                  * into account
 901                                  */
 902                                 plen = ICMP6ERR_MINPKTLEN + 8 - sizeof(ip6_t);
 903                                 break;
 904 # endif
 905                         }
 906                 up = MIN(hlen + plen, len);
 907
 908                 if (up > m->m_len) {
 909 #  ifdef __sgi
 910         /* Under IRIX, avoid m_pullup as it makes ping <hostname> panic */
 911                         if ((up > sizeof(hbuf)) || (m_length(m) < up)) {
 912                                 ATOMIC_INCL(frstats[out].fr_pull[1]);
 913                                 return -1;
 914                         }
 915                         m_copydata(m, 0, up, hbuf);
 916                         ATOMIC_INCL(frstats[out].fr_pull[0]);
 917                         ip = (ip_t *)hbuf;
 918 #  else /* __ sgi */
 919 #   ifndef linux
 920                         if ((*mp = m_pullup(m, up)) == 0) {
 921                                 ATOMIC_INCL(frstats[out].fr_pull[1]);
 922                                 return -1;
 923                         } else {
 924                                 ATOMIC_INCL(frstats[out].fr_pull[0]);
 925                                 m = *mp;
 926                                 ip = mtod(m, ip_t *);
 927                         }
 928 #   endif /* !linux */
 929 #  endif /* __sgi */
 930                 } else
 931                         up = 0;
 932         } else
 933                 up = 0;
 934 # endif /* !defined(__SVR4) && !defined(__svr4__) */
 935 # if SOLARIS
 936         mb_t *m = qif->qf_m;
 937
 938         if ((u_int)ip & 0x3)
 939                 return 2;
 940         fin->fin_qfm = m;
 941         fin->fin_qif = qif;
 942 # endif
 943 #endif /* _KERNEL */
 944
 945         changed = 0;
 946         fin->fin_ifp = ifp;
 947         fin->fin_v = v;
 948         fin->fin_out = out;
 949         fin->fin_mp = mp;
 950         fr_makefrip(hlen, ip, fin);
 951
 952 #ifdef _KERNEL
 953 # ifdef USE_INET6
 954         if (v == 6) {
 955                 ATOMIC_INCL(frstats[0].fr_ipv6[out]);
 956                 if (((ip6_t *)ip)->ip6_hlim < fr_minttl) {
 957                         ATOMIC_INCL(frstats[0].fr_badttl);
 958                         if (fr_minttllog & 1)
 959                                 logit = -3;
 960                         if (fr_minttllog & 2)
 961                                 drop = 1;
 962                 }
 963         } else
 964 # endif
 965         if (!out) {
 966                 if (fr_chksrc && !fr_verifysrc(ip->ip_src, ifp)) {
 967                         ATOMIC_INCL(frstats[0].fr_badsrc);
 968                         if (fr_chksrc & 1)
 969                                 drop = 1;
 970                         if (fr_chksrc & 2)
 971                                 logit = -2;
 972                 } else if (ip->ip_ttl < fr_minttl) {
 973                         ATOMIC_INCL(frstats[0].fr_badttl);
 974                         if (fr_minttllog & 1)
 975                                 logit = -3;
 976                         if (fr_minttllog & 2)
 977                                 drop = 1;
 978                 }
 979         }
 980         if (drop) {
 981 # ifdef IPFILTER_LOG
 982                 if (logit) {
 983                         fin->fin_group = logit;
 984                         pass = FR_INQUE|FR_NOMATCH|FR_LOGB;
 985                         (void) IPLLOG(pass, ip, fin, m);
 986                 }
 987 # endif
 988 # if !SOLARIS
 989                 m_freem(m);
 990 # endif
 991                 return error;
 992         }
 993 #endif
 994         pass = fr_pass;
 995         if (fin->fin_fl & FI_SHORT) {
 996                 ATOMIC_INCL(frstats[out].fr_short);
 997         }
 998
 999         READ_ENTER(&ipf_mutex);
1000
1001         /*
1002          * Check auth now.  This, combined with the check below to see if apass
1003          * is 0 is to ensure that we don't count the packet twice, which can
1004          * otherwise occur when we reprocess it.  As it is, we only count it
1005          * after it has no auth. table matchup.  This also stops NAT from
1006          * occuring until after the packet has been auth'd.
1007          */
1008         apass = fr_checkauth(ip, fin);
1009
1010         if (!out) {
1011 #ifdef  USE_INET6
1012                 if (v == 6)
1013                         list = ipacct6[0][fr_active];
1014                 else
1015 #endif
1016                         list = ipacct[0][fr_active];
1017                 changed = ip_natin(ip, fin);
1018                 if (!apass && (fin->fin_fr = list) &&
1019                     (fr_scanlist(FR_NOMATCH, ip, fin, m) & FR_ACCOUNT)) {
1020                         ATOMIC_INCL(frstats[0].fr_acct);
1021                 }
1022         }
1023
1024         if (!apass) {
1025                 if ((fin->fin_fl & FI_FRAG) == FI_FRAG)
1026                         fr = ipfr_knownfrag(ip, fin);
1027                 if (!fr && !(fin->fin_fl & FI_SHORT))
1028                         fr = fr_checkstate(ip, fin);
1029                 if (fr != NULL)
1030                         pass = fr->fr_flags;
1031                 if (fr && (pass & FR_LOGFIRST))
1032                         pass &= ~(FR_LOGFIRST|FR_LOG);
1033         }
1034
1035         if (apass || !fr) {
1036                 /*
1037                  * If a packet is found in the auth table, then skip checking
1038                  * the access lists for permission but we do need to consider
1039                  * the result as if it were from the ACL's.
1040                  */
1041                 if (!apass) {
1042                         fc = frcache + out;
1043                         if (!bcmp((char *)fin, (char *)fc, FI_CSIZE)) {
1044                                 /*
1045                                  * copy cached data so we can unlock the mutex
1046                                  * earlier.
1047                                  */
1048                                 bcopy((char *)fc, (char *)fin, FI_COPYSIZE);
1049                                 ATOMIC_INCL(frstats[out].fr_chit);
1050                                 if ((fr = fin->fin_fr)) {
1051                                         ATOMIC_INCL(fr->fr_hits);
1052                                         pass = fr->fr_flags;
1053                                 }
1054                         } else {
1055 #ifdef  USE_INET6
1056                                 if (v == 6)
1057                                         list = ipfilter6[out][fr_active];
1058                                 else
1059 #endif
1060                                         list = ipfilter[out][fr_active];
1061                                 if ((fin->fin_fr = list))
1062                                         pass = fr_scanlist(fr_pass, ip, fin, m);
1063                                 if (!(pass & (FR_KEEPSTATE|FR_DONTCACHE)))
1064                                         bcopy((char *)fin, (char *)fc,
1065                                               FI_COPYSIZE);
1066                                 if (pass & FR_NOMATCH) {
1067                                         ATOMIC_INCL(frstats[out].fr_nom);
1068                                         fin->fin_fr = NULL;
1069                                 }
1070                         }
1071                 } else
1072                         pass = apass;
1073                 fr = fin->fin_fr;
1074
1075                 /*
1076                  * If we fail to add a packet to the authorization queue,
1077                  * then we drop the packet later.  However, if it was added
1078                  * then pretend we've dropped it already.
1079                  */
1080                 if ((pass & FR_AUTH)) {
1081                         if (fr_newauth((mb_t *)m, fin, ip) != 0) {
1082                                 m = *mp = NULL;
1083                                 error = 0;
1084                         } else
1085                                 error = ENOSPC;
1086                 }
1087
1088                 if (pass & FR_PREAUTH) {
1089                         READ_ENTER(&ipf_auth);
1090                         if ((fin->fin_fr = ipauth) &&
1091                             (pass = fr_scanlist(0, ip, fin, m))) {
1092                                 ATOMIC_INCL(fr_authstats.fas_hits);
1093                         } else {
1094                                 ATOMIC_INCL(fr_authstats.fas_miss);
1095                         }
1096                         RWLOCK_EXIT(&ipf_auth);
1097                 }
1098
1099                 fin->fin_fr = fr;
1100                 if ((pass & (FR_KEEPFRAG|FR_KEEPSTATE)) == FR_KEEPFRAG) {
1101                         if (fin->fin_fl & FI_FRAG) {
1102                                 if (ipfr_newfrag(ip, fin) == -1) {
1103                                         ATOMIC_INCL(frstats[out].fr_bnfr);
1104                                 } else {
1105                                         ATOMIC_INCL(frstats[out].fr_nfr);
1106                                 }
1107                         } else {
1108                                 ATOMIC_INCL(frstats[out].fr_cfr);
1109                         }
1110                 }
1111                 if (pass & FR_KEEPSTATE) {
1112                         if (fr_addstate(ip, fin, NULL, 0) == NULL) {
1113                                 ATOMIC_INCL(frstats[out].fr_bads);
1114                         } else {
1115                                 ATOMIC_INCL(frstats[out].fr_ads);
1116                         }
1117                 }
1118         } else if (fr != NULL) {
1119                 pass = fr->fr_flags;
1120                 if (pass & FR_LOGFIRST)
1121                         pass &= ~(FR_LOGFIRST|FR_LOG);
1122         }
1123
1124 #if (BSD >= 199306) && (defined(_KERNEL) || defined(KERNEL))
1125         if (securelevel <= 0)
1126 #endif
1127                 if (fr && fr->fr_func && !(pass & FR_CALLNOW))
1128                         pass = (*fr->fr_func)(pass, ip, fin);
1129
1130         /*
1131          * Only count/translate packets which will be passed on, out the
1132          * interface.
1133          */
1134         if (out && (pass & FR_PASS)) {
1135 #ifdef  USE_INET6
1136                 if (v == 6)
1137                         list = ipacct6[1][fr_active];
1138                 else
1139 #endif
1140                         list = ipacct[1][fr_active];
1141                 if (list != NULL) {
1142                         u_32_t sg, sr;
1143
1144                         fin->fin_fr = list;
1145                         sg = fin->fin_group;
1146                         sr = fin->fin_rule;
1147                         if (fr_scanlist(FR_NOMATCH, ip, fin, m) & FR_ACCOUNT) {
1148                                 ATOMIC_INCL(frstats[1].fr_acct);
1149                         }
1150                         fin->fin_group = sg;
1151                         fin->fin_rule = sr;
1152                         fin->fin_fr = fr;
1153                 }
1154                 changed = ip_natout(ip, fin);
1155         } else
1156                 fin->fin_fr = fr;
1157         RWLOCK_EXIT(&ipf_mutex);
1158
1159 #ifdef  IPFILTER_LOG
1160         if ((fr_flags & FF_LOGGING) || (pass & FR_LOGMASK)) {
1161                 if ((fr_flags & FF_LOGNOMATCH) && (pass & FR_NOMATCH)) {
1162                         pass |= FF_LOGNOMATCH;
1163                         ATOMIC_INCL(frstats[out].fr_npkl);
1164                         goto logit;
1165                 } else if (((pass & FR_LOGMASK) == FR_LOGP) ||
1166                     ((pass & FR_PASS) && (fr_flags & FF_LOGPASS))) {
1167                         if ((pass & FR_LOGMASK) != FR_LOGP)
1168                                 pass |= FF_LOGPASS;
1169                         ATOMIC_INCL(frstats[out].fr_ppkl);
1170                         goto logit;
1171                 } else if (((pass & FR_LOGMASK) == FR_LOGB) ||
1172                            ((pass & FR_BLOCK) && (fr_flags & FF_LOGBLOCK))) {
1173                         if ((pass & FR_LOGMASK) != FR_LOGB)
1174                                 pass |= FF_LOGBLOCK;
1175                         ATOMIC_INCL(frstats[out].fr_bpkl);
1176 logit:
1177                         if (!IPLLOG(pass, ip, fin, m)) {
1178                                 ATOMIC_INCL(frstats[out].fr_skip);
1179                                 if ((pass & (FR_PASS|FR_LOGORBLOCK)) ==
1180                                     (FR_PASS|FR_LOGORBLOCK))
1181                                         pass ^= FR_PASS|FR_BLOCK;
1182                         }
1183                 }
1184         }
1185 #endif /* IPFILTER_LOG */
1186
1187 #ifdef  _KERNEL
1188         /*
1189          * Only allow FR_DUP to work if a rule matched - it makes no sense to
1190          * set FR_DUP as a "default" as there are no instructions about where
1191          * to send the packet.
1192          */
1193         if (fr && (pass & FR_DUP))
1194 # if    SOLARIS
1195                 mc = dupmsg(m);
1196 # else
1197 #  if defined(__OpenBSD__) && (OpenBSD >= 199905)
1198                 mc = m_copym2(m, 0, M_COPYALL, M_DONTWAIT);
1199 #  else
1200                 mc = m_copy(m, 0, M_COPYALL);
1201 #  endif
1202 # endif
1203 #endif
1204         if (pass & FR_PASS) {
1205                 ATOMIC_INCL(frstats[out].fr_pass);
1206         } else if (pass & FR_BLOCK) {
1207                 ATOMIC_INCL(frstats[out].fr_block);
1208                 /*
1209                  * Should we return an ICMP packet to indicate error
1210                  * status passing through the packet filter ?
1211                  * WARNING: ICMP error packets AND TCP RST packets should
1212                  * ONLY be sent in repsonse to incoming packets.  Sending them
1213                  * in response to outbound packets can result in a panic on
1214                  * some operating systems.
1215                  */
1216                 if (!out) {
1217                         if (changed == -1)
1218                                 /*
1219                                  * If a packet results in a NAT error, do not
1220                                  * send a reset or ICMP error as it may disrupt
1221                                  * an existing flow.  This is the proxy saying
1222                                  * the content is bad so just drop the packet
1223                                  * silently.
1224                                  */
1225                                 ;
1226                         else if (pass & FR_RETICMP) {
1227                                 int dst;
1228
1229                                 if ((pass & FR_RETMASK) == FR_FAKEICMP)
1230                                         dst = 1;
1231                                 else
1232                                         dst = 0;
1233                                 send_icmp_err(ip, ICMP_UNREACH, fin, dst);
1234                                 ATOMIC_INCL(frstats[0].fr_ret);
1235                         } else if (((pass & FR_RETMASK) == FR_RETRST) &&
1236                                    !(fin->fin_fl & FI_SHORT)) {
1237                                 if (send_reset(ip, fin) == 0) {
1238                                         ATOMIC_INCL(frstats[1].fr_ret);
1239                                 }
1240                         }
1241                 } else {
1242                         if (pass & FR_RETRST)
1243                                 error = ECONNRESET;
1244                 }
1245         }
1246
1247         /*
1248          * If we didn't drop off the bottom of the list of rules (and thus
1249          * the 'current' rule fr is not NULL), then we may have some extra
1250          * instructions about what to do with a packet.
1251          * Once we're finished return to our caller, freeing the packet if
1252          * we are dropping it (* BSD ONLY *).
1253          */
1254         if ((changed == -1) && (pass & FR_PASS)) {
1255                 pass &= ~FR_PASS;
1256                 pass |= FR_BLOCK;
1257         }
1258 #if defined(_KERNEL)
1259 # if !SOLARIS
1260 #  if !defined(linux)
1261         if (fr) {
1262                 frdest_t *fdp = &fr->fr_tif;
1263
1264                 if (((pass & FR_FASTROUTE) && !out) ||
1265                     (fdp->fd_ifp && fdp->fd_ifp != (struct ifnet *)-1)) {
1266                         (void) ipfr_fastroute(m, mp, fin, fdp);
1267                         m = *mp;
1268                 }
1269
1270                 if (mc != NULL)
1271                         (void) ipfr_fastroute(mc, &mc, fin, &fr->fr_dif);
1272         }
1273
1274         if (!(pass & FR_PASS) && m) {
1275                 m_freem(m);
1276                 m = *mp = NULL;
1277         }
1278 #   ifdef __sgi
1279         else if (changed && up && m)
1280                 m_copyback(m, 0, up, hbuf);
1281 #   endif
1282 #  endif /* !linux */
1283 # else /* !SOLARIS */
1284         if (fr) {
1285                 frdest_t *fdp = &fr->fr_tif;
1286
1287                 if (((pass & FR_FASTROUTE) && !out) ||
1288                     (fdp->fd_ifp && fdp->fd_ifp != (struct ifnet *)-1))
1289                         (void) ipfr_fastroute(ip, m, mp, fin, fdp);
1290
1291                 if (mc != NULL)
1292                         (void) ipfr_fastroute(ip, mc, &mc, fin, &fr->fr_dif);
1293         }
1294 # endif /* !SOLARIS */
1295         return (pass & FR_PASS) ? 0 : error;
1296 #else /* _KERNEL */
1297         if (pass & FR_NOMATCH)
1298                 return 1;
1299         if (pass & FR_PASS)
1300                 return 0;
1301         if (pass & FR_AUTH)
1302                 return -2;
1303         if ((pass & FR_RETMASK) == FR_RETRST)
1304                 return -3;
1305         if ((pass & FR_RETMASK) == FR_RETICMP)
1306                 return -4;
1307         if ((pass & FR_RETMASK) == FR_FAKEICMP)
1308                 return -5;
1309         return -1;
1310 #endif /* _KERNEL */
1311 }
1312
1313
1314 /*
1315  * ipf_cksum
1316  * addr should be 16bit aligned and len is in bytes.
1317  * length is in bytes
1318  */
1319 u_short ipf_cksum(addr, len)
1320 register u_short *addr;
1321 register int len;
1322 {
1323         register u_32_t sum = 0;
1324
1325         for (sum = 0; len > 1; len -= 2)
1326                 sum += *addr++;
1327
1328         /* mop up an odd byte, if necessary */
1329         if (len == 1)
1330                 sum += *(u_char *)addr;
1331
1332         /*
1333          * add back carry outs from top 16 bits to low 16 bits
1334          */
1335         sum = (sum >> 16) + (sum & 0xffff);     /* add hi 16 to low 16 */
1336         sum += (sum >> 16);                     /* add carry */
1337         return (u_short)(~sum);
1338 }
1339
1340
1341 /*
1342  * NB: This function assumes we've pullup'd enough for all of the IP header
1343  * and the TCP header.  We also assume that data blocks aren't allocated in
1344  * odd sizes.
1345  */
1346 u_short fr_tcpsum(m, ip, tcp)
1347 mb_t *m;
1348 ip_t *ip;
1349 tcphdr_t *tcp;
1350 {
1351         u_short *sp, slen, ts;
1352         u_int sum, sum2;
1353         int hlen;
1354
1355         /*
1356          * Add up IP Header portion
1357          */
1358         hlen = ip->ip_hl << 2;
1359         slen = ip->ip_len - hlen;
1360         sum = htons((u_short)ip->ip_p);
1361         sum += htons(slen);
1362         sp = (u_short *)&ip->ip_src;
1363         sum += *sp++;   /* ip_src */
1364         sum += *sp++;
1365         sum += *sp++;   /* ip_dst */
1366         sum += *sp++;
1367         ts = tcp->th_sum;
1368         tcp->th_sum = 0;
1369 #ifdef  KERNEL
1370 # if SOLARIS
1371         sum2 = ip_cksum(m, hlen, sum);  /* hlen == offset */
1372         sum2 = (sum2 & 0xffff) + (sum2 >> 16);
1373         sum2 = ~sum2 & 0xffff;
1374 # else /* SOLARIS */
1375 #  if defined(BSD) || defined(sun)
1376 #   if BSD >= 199306
1377         m->m_data += hlen;
1378 #   else
1379         m->m_off += hlen;
1380 #   endif
1381         m->m_len -= hlen;
1382         sum2 = in_cksum(m, slen);
1383         m->m_len += hlen;
1384 #   if BSD >= 199306
1385         m->m_data -= hlen;
1386 #   else
1387         m->m_off -= hlen;
1388 #   endif
1389         /*
1390          * Both sum and sum2 are partial sums, so combine them together.
1391          */
1392         sum = (sum & 0xffff) + (sum >> 16);
1393         sum = ~sum & 0xffff;
1394         sum2 += sum;
1395         sum2 = (sum2 & 0xffff) + (sum2 >> 16);
1396 #  else /* defined(BSD) || defined(sun) */
1397 {
1398         union {
1399                 u_char  c[2];
1400                 u_short s;
1401         } bytes;
1402         u_short len = ip->ip_len;
1403 # if defined(__sgi)
1404         int add;
1405 # endif
1406
1407         /*
1408          * Add up IP Header portion
1409          */
1410         sp = (u_short *)&ip->ip_src;
1411         len -= (ip->ip_hl << 2);
1412         sum = ntohs(IPPROTO_TCP);
1413         sum += htons(len);
1414         sum += *sp++;   /* ip_src */
1415         sum += *sp++;
1416         sum += *sp++;   /* ip_dst */
1417         sum += *sp++;
1418         if (sp != (u_short *)tcp)
1419                 sp = (u_short *)tcp;
1420         sum += *sp++;   /* sport */
1421         sum += *sp++;   /* dport */
1422         sum += *sp++;   /* seq */
1423         sum += *sp++;
1424         sum += *sp++;   /* ack */
1425         sum += *sp++;
1426         sum += *sp++;   /* off */
1427         sum += *sp++;   /* win */
1428         sum += *sp++;   /* Skip over checksum */
1429         sum += *sp++;   /* urp */
1430
1431 # ifdef __sgi
1432         /*
1433          * In case we had to copy the IP & TCP header out of mbufs,
1434          * skip over the mbuf bits which are the header
1435          */
1436         if ((caddr_t)ip != mtod(m, caddr_t)) {
1437                 hlen = (caddr_t)sp - (caddr_t)ip;
1438                 while (hlen) {
1439                         add = MIN(hlen, m->m_len);
1440                         sp = (u_short *)(mtod(m, caddr_t) + add);
1441                         hlen -= add;
1442                         if (add == m->m_len) {
1443                                 m = m->m_next;
1444                                 if (!hlen) {
1445                                         if (!m)
1446                                                 break;
1447                                         sp = mtod(m, u_short *);
1448                                 }
1449                                 PANIC((!m),("fr_tcpsum(1): not enough data"));
1450                         }
1451                 }
1452         }
1453 # endif
1454
1455         if (!(len -= sizeof(*tcp)))
1456                 goto nodata;
1457         while (len > 1) {
1458                 if (((caddr_t)sp - mtod(m, caddr_t)) >= m->m_len) {
1459                         m = m->m_next;
1460                         PANIC((!m),("fr_tcpsum(2): not enough data"));
1461                         sp = mtod(m, u_short *);
1462                 }
1463                 if (((caddr_t)(sp + 1) - mtod(m, caddr_t)) > m->m_len) {
1464                         bytes.c[0] = *(u_char *)sp;
1465                         m = m->m_next;
1466                         PANIC((!m),("fr_tcpsum(3): not enough data"));
1467                         sp = mtod(m, u_short *);
1468                         bytes.c[1] = *(u_char *)sp;
1469                         sum += bytes.s;
1470                         sp = (u_short *)((u_char *)sp + 1);
1471                 }
1472                 if ((u_long)sp & 1) {
1473                         bcopy((char *)sp++, (char *)&bytes.s, sizeof(bytes.s));
1474                         sum += bytes.s;
1475                 } else
1476                         sum += *sp++;
1477                 len -= 2;
1478         }
1479         if (len)
1480                 sum += ntohs(*(u_char *)sp << 8);
1481 nodata:
1482         while (sum > 0xffff)
1483                 sum = (sum & 0xffff) + (sum >> 16);
1484         sum2 = (u_short)(~sum & 0xffff);
1485 }
1486 #  endif /*  defined(BSD) || defined(sun) */
1487 # endif /* SOLARIS */
1488 #else /* KERNEL */
1489         for (; slen > 1; slen -= 2)
1490                 sum += *sp++;
1491         if (slen)
1492                 sum += ntohs(*(u_char *)sp << 8);
1493         while (sum > 0xffff)
1494                 sum = (sum & 0xffff) + (sum >> 16);
1495         sum2 = (u_short)(~sum & 0xffff);
1496 #endif /* KERNEL */
1497         tcp->th_sum = ts;
1498         return sum2;
1499 }
1500
1501
1502 #if defined(_KERNEL) && ( ((BSD < 199306) && !SOLARIS) || defined(__sgi) )
1503 /*
1504  * Copyright (c) 1982, 1986, 1988, 1991, 1993
1505  *      The Regents of the University of California.  All rights reserved.
1506  *
1507  * Redistribution and use in source and binary forms, with or without
1508  * modification, are permitted provided that the following conditions
1509  * are met:
1510  * 1. Redistributions of source code must retain the above copyright
1511  *    notice, this list of conditions and the following disclaimer.
1512  * 2. Redistributions in binary form must reproduce the above copyright
1513  *    notice, this list of conditions and the following disclaimer in the
1514  *    documentation and/or other materials provided with the distribution.
1515  * 3. All advertising materials mentioning features or use of this software
1516  *    must display the following acknowledgement:
1517  *      This product includes software developed by the University of
1518  *      California, Berkeley and its contributors.
1519  * 4. Neither the name of the University nor the names of its contributors
1520  *    may be used to endorse or promote products derived from this software
1521  *    without specific prior written permission.
1522  *
1523  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
1524  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
1525  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
1526  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
1527  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
1528  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
1529  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
1530  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
1531  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
1532  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
1533  * SUCH DAMAGE.
1534  *
1535  *      @(#)uipc_mbuf.c 8.2 (Berkeley) 1/4/94
1536  * $Id: fil.c,v 2.35.2.67 2002/12/06 13:28:05 darrenr Exp $
1537  */
1538 /*
1539  * Copy data from an mbuf chain starting "off" bytes from the beginning,
1540  * continuing for "len" bytes, into the indicated buffer.
1541  */
1542 void
1543 m_copydata(m, off, len, cp)
1544         register mb_t *m;
1545         register int off;
1546         register int len;
1547         caddr_t cp;
1548 {
1549         register unsigned count;
1550
1551         if (off < 0 || len < 0)
1552                 panic("m_copydata");
1553         while (off > 0) {
1554                 if (m == 0)
1555                         panic("m_copydata");
1556                 if (off < m->m_len)
1557                         break;
1558                 off -= m->m_len;
1559                 m = m->m_next;
1560         }
1561         while (len > 0) {
1562                 if (m == 0)
1563                         panic("m_copydata");
1564                 count = MIN(m->m_len - off, len);
1565                 bcopy(mtod(m, caddr_t) + off, cp, count);
1566                 len -= count;
1567                 cp += count;
1568                 off = 0;
1569                 m = m->m_next;
1570         }
1571 }
1572
1573
1574 # ifndef linux
1575 /*
1576  * Copy data from a buffer back into the indicated mbuf chain,
1577  * starting "off" bytes from the beginning, extending the mbuf
1578  * chain if necessary.
1579  */
1580 void
1581 m_copyback(m0, off, len, cp)
1582         struct  mbuf *m0;
1583         register int off;
1584         register int len;
1585         caddr_t cp;
1586 {
1587         register int mlen;
1588         register struct mbuf *m = m0, *n;
1589         int totlen = 0;
1590
1591         if (m0 == 0)
1592                 return;
1593         while (off > (mlen = m->m_len)) {
1594                 off -= mlen;
1595                 totlen += mlen;
1596                 if (m->m_next == 0) {
1597                         n = m_getclr(M_DONTWAIT, m->m_type);
1598                         if (n == 0)
1599                                 goto out;
1600                         n->m_len = min(MLEN, len + off);
1601                         m->m_next = n;
1602                 }
1603                 m = m->m_next;
1604         }
1605         while (len > 0) {
1606                 mlen = min (m->m_len - off, len);
1607                 bcopy(cp, off + mtod(m, caddr_t), (unsigned)mlen);
1608                 cp += mlen;
1609                 len -= mlen;
1610                 mlen += off;
1611                 off = 0;
1612                 totlen += mlen;
1613                 if (len == 0)
1614                         break;
1615                 if (m->m_next == 0) {
1616                         n = m_get(M_DONTWAIT, m->m_type);
1617                         if (n == 0)
1618                                 break;
1619                         n->m_len = min(MLEN, len);
1620                         m->m_next = n;
1621                 }
1622                 m = m->m_next;
1623         }
1624 out:
1625 #if 0
1626         if (((m = m0)->m_flags & M_PKTHDR) && (m->m_pkthdr.len < totlen))
1627                 m->m_pkthdr.len = totlen;
1628 #endif
1629         return;
1630 }
1631 # endif /* linux */
1632 #endif /* (_KERNEL) && ( ((BSD < 199306) && !SOLARIS) || __sgi) */
1633
1634
1635 frgroup_t *fr_findgroup(num, flags, which, set, fgpp)
1636 u_32_t num, flags;
1637 minor_t which;
1638 int set;
1639 frgroup_t ***fgpp;
1640 {
1641         frgroup_t *fg, **fgp;
1642
1643         if (which == IPL_LOGAUTH)
1644                 fgp = &ipfgroups[2][set];
1645         else if (flags & FR_ACCOUNT)
1646                 fgp = &ipfgroups[1][set];
1647         else if (flags & (FR_OUTQUE|FR_INQUE))
1648                 fgp = &ipfgroups[0][set];
1649         else
1650                 return NULL;
1651
1652         while ((fg = *fgp))
1653                 if (fg->fg_num == num)
1654                         break;
1655                 else
1656                         fgp = &fg->fg_next;
1657         if (fgpp)
1658                 *fgpp = fgp;
1659         return fg;
1660 }
1661
1662
1663 frgroup_t *fr_addgroup(num, fp, which, set)
1664 u_32_t num;
1665 frentry_t *fp;
1666 minor_t which;
1667 int set;
1668 {
1669         frgroup_t *fg, **fgp;
1670
1671         if ((fg = fr_findgroup(num, fp->fr_flags, which, set, &fgp)))
1672                 return fg;
1673
1674         KMALLOC(fg, frgroup_t *);
1675         if (fg) {
1676                 fg->fg_num = num;
1677                 fg->fg_next = *fgp;
1678                 fg->fg_head = fp;
1679                 fg->fg_start = &fp->fr_grp;
1680                 *fgp = fg;
1681         }
1682         return fg;
1683 }
1684
1685
1686 void fr_delgroup(num, flags, which, set)
1687 u_32_t num, flags;
1688 minor_t which;
1689 int set;
1690 {
1691         frgroup_t *fg, **fgp;
1692
1693         if (!(fg = fr_findgroup(num, flags, which, set, &fgp)))
1694                 return;
1695
1696         *fgp = fg->fg_next;
1697         KFREE(fg);
1698 }
1699
1700
1701
1702 /*
1703  * recursively flush rules from the list, descending groups as they are
1704  * encountered.  if a rule is the head of a group and it has lost all its
1705  * group members, then also delete the group reference.
1706  */
1707 static int frflushlist(set, unit, nfreedp, listp)
1708 int set;
1709 minor_t unit;
1710 int *nfreedp;
1711 frentry_t **listp;
1712 {
1713         register int freed = 0, i;
1714         register frentry_t *fp;
1715
1716         while ((fp = *listp)) {
1717                 *listp = fp->fr_next;
1718                 if (fp->fr_grp) {
1719                         i = frflushlist(set, unit, nfreedp, &fp->fr_grp);
1720                         MUTEX_ENTER(&ipf_rw);
1721                         fp->fr_ref -= i;
1722                         MUTEX_EXIT(&ipf_rw);
1723                 }
1724
1725                 ATOMIC_DEC32(fp->fr_ref);
1726                 if (fp->fr_grhead) {
1727                         fr_delgroup(fp->fr_grhead, fp->fr_flags,
1728                                     unit, set);
1729                         fp->fr_grhead = 0;
1730                 }
1731                 if (fp->fr_ref == 0) {
1732                         KFREE(fp);
1733                         freed++;
1734                 } else
1735                         fp->fr_next = NULL;
1736         }
1737         *nfreedp += freed;
1738         return freed;
1739 }
1740
1741
1742 int frflush(unit, proto, flags)
1743 minor_t unit;
1744 int proto, flags;
1745 {
1746         int flushed = 0, set;
1747
1748         if (unit != IPL_LOGIPF)
1749                 return 0;
1750         WRITE_ENTER(&ipf_mutex);
1751         bzero((char *)frcache, sizeof(frcache[0]) * 2);
1752
1753         set = fr_active;
1754         if (flags & FR_INACTIVE)
1755                 set = 1 - set;
1756
1757         if (flags & FR_OUTQUE) {
1758 #ifdef  USE_INET6
1759                 if (proto == 0 || proto == 6) {
1760                         (void) frflushlist(set, unit,
1761                                            &flushed, &ipfilter6[1][set]);
1762                         (void) frflushlist(set, unit,
1763                                            &flushed, &ipacct6[1][set]);
1764                 }
1765 #endif
1766                 if (proto == 0 || proto == 4) {
1767                         (void) frflushlist(set, unit,
1768                                            &flushed, &ipfilter[1][set]);
1769                         (void) frflushlist(set, unit,
1770                                            &flushed, &ipacct[1][set]);
1771                 }
1772         }
1773         if (flags & FR_INQUE) {
1774 #ifdef  USE_INET6
1775                 if (proto == 0 || proto == 6) {
1776                         (void) frflushlist(set, unit,
1777                                             &flushed, &ipfilter6[0][set]);
1778                         (void) frflushlist(set, unit,
1779                                            &flushed, &ipacct6[0][set]);
1780                 }
1781 #endif
1782                 if (proto == 0 || proto == 4) {
1783                         (void) frflushlist(set, unit,
1784                                            &flushed, &ipfilter[0][set]);
1785                         (void) frflushlist(set, unit,
1786                                            &flushed, &ipacct[0][set]);
1787                 }
1788         }
1789         RWLOCK_EXIT(&ipf_mutex);
1790         return flushed;
1791 }
1792
1793
1794 char *memstr(src, dst, slen, dlen)
1795 char *src, *dst;
1796 int slen, dlen;
1797 {
1798         char *s = NULL;
1799
1800         while (dlen >= slen) {
1801                 if (bcmp(src, dst, slen) == 0) {
1802                         s = dst;
1803                         break;
1804                 }
1805                 dst++;
1806                 dlen--;
1807         }
1808         return s;
1809 }
1810
1811
1812 void fixskip(listp, rp, addremove)
1813 frentry_t **listp, *rp;
1814 int addremove;
1815 {
1816         frentry_t *fp;
1817         int rules = 0, rn = 0;
1818
1819         for (fp = *listp; fp && (fp != rp); fp = fp->fr_next, rules++)
1820                 ;
1821
1822         if (!fp)
1823                 return;
1824
1825         for (fp = *listp; fp && (fp != rp); fp = fp->fr_next, rn++)
1826                 if (fp->fr_skip && (rn + fp->fr_skip >= rules))
1827                         fp->fr_skip += addremove;
1828 }
1829
1830
1831 #ifdef  _KERNEL
1832 /*
1833  * count consecutive 1's in bit mask.  If the mask generated by counting
1834  * consecutive 1's is different to that passed, return -1, else return #
1835  * of bits.
1836  */
1837 int     countbits(ip)
1838 u_32_t  ip;
1839 {
1840         u_32_t  ipn;
1841         int     cnt = 0, i, j;
1842
1843         ip = ipn = ntohl(ip);
1844         for (i = 32; i; i--, ipn *= 2)
1845                 if (ipn & 0x80000000)
1846                         cnt++;
1847                 else
1848                         break;
1849         ipn = 0;
1850         for (i = 32, j = cnt; i; i--, j--) {
1851                 ipn *= 2;
1852                 if (j > 0)
1853                         ipn++;
1854         }
1855         if (ipn == ip)
1856                 return cnt;
1857         return -1;
1858 }
1859
1860
1861 /*
1862  * return the first IP Address associated with an interface
1863  */
1864 int fr_ifpaddr(v, ifptr, inp)
1865 int v;
1866 void *ifptr;
1867 struct in_addr *inp;
1868 {
1869 # ifdef USE_INET6
1870         struct in6_addr *inp6 = NULL;
1871 # endif
1872 # if SOLARIS
1873         ill_t *ill = ifptr;
1874 # else
1875         struct ifnet *ifp = ifptr;
1876 # endif
1877         struct in_addr in;
1878
1879 # if SOLARIS
1880 #  ifdef        USE_INET6
1881         if (v == 6) {
1882                 struct in6_addr in6;
1883
1884                 /*
1885                  * First is always link local.
1886                  */
1887                 if (ill->ill_ipif->ipif_next)
1888                         in6 = ill->ill_ipif->ipif_next->ipif_v6lcl_addr;
1889                 else
1890                         bzero((char *)&in6, sizeof(in6));
1891                 bcopy((char *)&in6, (char *)inp, sizeof(in6));
1892         } else
1893 #  endif
1894         {
1895                 in.s_addr = ill->ill_ipif->ipif_local_addr;
1896                 *inp = in;
1897         }
1898 # else /* SOLARIS */
1899 #  if linux
1900         ;
1901 #  else /* linux */
1902         struct sockaddr_in *sin;
1903         struct ifaddr *ifa;
1904
1905 #   if  (__FreeBSD_version >= 300000)
1906         ifa = TAILQ_FIRST(&ifp->if_addrhead);
1907 #   else
1908 #    if defined(__NetBSD__) || defined(__OpenBSD__)
1909         ifa = ifp->if_addrlist.tqh_first;
1910 #    else
1911 #     if defined(__sgi) && defined(IFF_DRVRLOCK) /* IRIX 6 */
1912         ifa = &((struct in_ifaddr *)ifp->in_ifaddr)->ia_ifa;
1913 #     else
1914         ifa = ifp->if_addrlist;
1915 #     endif
1916 #    endif /* __NetBSD__ || __OpenBSD__ */
1917 #   endif /* __FreeBSD_version >= 300000 */
1918 #   if (BSD < 199306) && !(/*IRIX6*/defined(__sgi) && defined(IFF_DRVRLOCK))
1919         sin = (struct sockaddr_in *)&ifa->ifa_addr;
1920 #   else
1921         sin = (struct sockaddr_in *)ifa->ifa_addr;
1922         while (sin && ifa) {
1923                 if ((v == 4) && (sin->sin_family == AF_INET))
1924                         break;
1925 #    ifdef USE_INET6
1926                 if ((v == 6) && (sin->sin_family == AF_INET6)) {
1927                         inp6 = &((struct sockaddr_in6 *)sin)->sin6_addr;
1928                         if (!IN6_IS_ADDR_LINKLOCAL(inp6) &&
1929                             !IN6_IS_ADDR_LOOPBACK(inp6))
1930                                 break;
1931                 }
1932 #    endif
1933 #    if (__FreeBSD_version >= 300000)
1934                 ifa = TAILQ_NEXT(ifa, ifa_link);
1935 #    else
1936 #     if defined(__NetBSD__) || defined(__OpenBSD__)
1937                 ifa = ifa->ifa_list.tqe_next;
1938 #     else
1939                 ifa = ifa->ifa_next;
1940 #     endif
1941 #    endif /* __FreeBSD_version >= 300000 */
1942                 if (ifa)
1943                         sin = (struct sockaddr_in *)ifa->ifa_addr;
1944         }
1945         if (ifa == NULL)
1946                 sin = NULL;
1947         if (sin == NULL)
1948                 return -1;
1949 #   endif /* (BSD < 199306) && (!__sgi && IFF_DRVLOCK) */
1950 #    ifdef      USE_INET6
1951         if (v == 6)
1952                 bcopy((char *)inp6, (char *)inp, sizeof(*inp6));
1953         else
1954 #    endif
1955         {
1956                 in = sin->sin_addr;
1957                 *inp = in;
1958         }
1959 #  endif /* linux */
1960 # endif /* SOLARIS */
1961         return 0;
1962 }
1963
1964
1965 static void frsynclist(fr)
1966 register frentry_t *fr;
1967 {
1968         for (; fr; fr = fr->fr_next) {
1969                 if (fr->fr_ifa != NULL) {
1970                         fr->fr_ifa = GETUNIT(fr->fr_ifname, fr->fr_ip.fi_v);
1971                         if (fr->fr_ifa == NULL)
1972                                 fr->fr_ifa = (void *)-1;
1973                 }
1974                 if (fr->fr_grp)
1975                         frsynclist(fr->fr_grp);
1976         }
1977 }
1978
1979
1980 void frsync()
1981 {
1982 # if !SOLARIS
1983         register struct ifnet *ifp;
1984
1985 #  if defined(__OpenBSD__) || ((NetBSD >= 199511) && (NetBSD < 1991011)) || \
1986      (defined(__FreeBSD_version) && (__FreeBSD_version >= 300000))
1987 #   if (NetBSD >= 199905) || defined(__OpenBSD__)
1988         for (ifp = ifnet.tqh_first; ifp; ifp = ifp->if_list.tqe_next)
1989 #   else
1990         for (ifp = ifnet.tqh_first; ifp; ifp = ifp->if_link.tqe_next)
1991 #   endif
1992 #  else
1993         for (ifp = ifnet; ifp; ifp = ifp->if_next)
1994 #  endif
1995         {
1996                 ip_natsync(ifp);
1997                 ip_statesync(ifp);
1998         }
1999         ip_natsync((struct ifnet *)-1);
2000 # endif /* !SOLARIS */
2001
2002         WRITE_ENTER(&ipf_mutex);
2003         frsynclist(ipacct[0][fr_active]);
2004         frsynclist(ipacct[1][fr_active]);
2005         frsynclist(ipfilter[0][fr_active]);
2006         frsynclist(ipfilter[1][fr_active]);
2007 #ifdef  USE_INET6
2008         frsynclist(ipacct6[0][fr_active]);
2009         frsynclist(ipacct6[1][fr_active]);
2010         frsynclist(ipfilter6[0][fr_active]);
2011         frsynclist(ipfilter6[1][fr_active]);
2012 #endif
2013         RWLOCK_EXIT(&ipf_mutex);
2014 }
2015
2016
2017 /*
2018  * In the functions below, bcopy() is called because the pointer being
2019  * copied _from_ in this instance is a pointer to a char buf (which could
2020  * end up being unaligned) and on the kernel's local stack.
2021  */
2022 int ircopyptr(a, b, c)
2023 void *a, *b;
2024 size_t c;
2025 {
2026         caddr_t ca;
2027         int err;
2028
2029 #if SOLARIS
2030         if (copyin(a, (char *)&ca, sizeof(ca)))
2031                 return EFAULT;
2032 #else
2033         bcopy(a, &ca, sizeof(ca));
2034 #endif
2035         err = copyin(ca, b, c);
2036         if (err)
2037                 err = EFAULT;
2038         return err;
2039 }
2040
2041
2042 int iwcopyptr(a, b, c)
2043 void *a, *b;
2044 size_t c;
2045 {
2046         caddr_t ca;
2047         int err;
2048
2049 #if SOLARIS
2050         if (copyin(b, (char *)&ca, sizeof(ca)))
2051                 return EFAULT;
2052 #else
2053         bcopy(b, &ca, sizeof(ca));
2054 #endif
2055         err = copyout(a, ca, c);
2056         if (err)
2057                 err = EFAULT;
2058         return err;
2059 }
2060
2061 #else /* _KERNEL */
2062
2063
2064 /*
2065  * return the first IP Address associated with an interface
2066  */
2067 int fr_ifpaddr(v, ifptr, inp)
2068 int v;
2069 void *ifptr;
2070 struct in_addr *inp;
2071 {
2072         return 0;
2073 }
2074
2075
2076 int ircopyptr(a, b, c)
2077 void *a, *b;
2078 size_t c;
2079 {
2080         caddr_t ca;
2081
2082         bcopy(a, &ca, sizeof(ca));
2083         bcopy(ca, b, c);
2084         return 0;
2085 }
2086
2087
2088 int iwcopyptr(a, b, c)
2089 void *a, *b;
2090 size_t c;
2091 {
2092         caddr_t ca;
2093
2094         bcopy(b, &ca, sizeof(ca));
2095         bcopy(a, ca, c);
2096         return 0;
2097 }
2098
2099
2100 #endif
2101
2102
2103 int fr_lock(data, lockp)
2104 caddr_t data;
2105 int *lockp;
2106 {
2107         int arg, error;
2108
2109         error = IRCOPY(data, (caddr_t)&arg, sizeof(arg));
2110         if (!error) {
2111                 error = IWCOPY((caddr_t)lockp, data, sizeof(*lockp));
2112                 if (!error)
2113                         *lockp = arg;
2114         }
2115         return error;
2116 }
2117
2118
2119 void fr_getstat(fiop)
2120 friostat_t *fiop;
2121 {
2122         bcopy((char *)frstats, (char *)fiop->f_st, sizeof(filterstats_t) * 2);
2123         fiop->f_locks[0] = fr_state_lock;
2124         fiop->f_locks[1] = fr_nat_lock;
2125         fiop->f_locks[2] = fr_frag_lock;
2126         fiop->f_locks[3] = fr_auth_lock;
2127         fiop->f_fin[0] = ipfilter[0][0];
2128         fiop->f_fin[1] = ipfilter[0][1];
2129         fiop->f_fout[0] = ipfilter[1][0];
2130         fiop->f_fout[1] = ipfilter[1][1];
2131         fiop->f_acctin[0] = ipacct[0][0];
2132         fiop->f_acctin[1] = ipacct[0][1];
2133         fiop->f_acctout[0] = ipacct[1][0];
2134         fiop->f_acctout[1] = ipacct[1][1];
2135 #ifdef  USE_INET6
2136         fiop->f_fin6[0] = ipfilter6[0][0];
2137         fiop->f_fin6[1] = ipfilter6[0][1];
2138         fiop->f_fout6[0] = ipfilter6[1][0];
2139         fiop->f_fout6[1] = ipfilter6[1][1];
2140         fiop->f_acctin6[0] = ipacct6[0][0];
2141         fiop->f_acctin6[1] = ipacct6[0][1];
2142         fiop->f_acctout6[0] = ipacct6[1][0];
2143         fiop->f_acctout6[1] = ipacct6[1][1];
2144 #else
2145         fiop->f_fin6[0] = NULL;
2146         fiop->f_fin6[1] = NULL;
2147         fiop->f_fout6[0] = NULL;
2148         fiop->f_fout6[1] = NULL;
2149         fiop->f_acctin6[0] = NULL;
2150         fiop->f_acctin6[1] = NULL;
2151         fiop->f_acctout6[0] = NULL;
2152         fiop->f_acctout6[1] = NULL;
2153 #endif
2154         fiop->f_active = fr_active;
2155         fiop->f_froute[0] = ipl_frouteok[0];
2156         fiop->f_froute[1] = ipl_frouteok[1];
2157
2158         fiop->f_running = fr_running;
2159         fiop->f_groups[0][0] = ipfgroups[0][0];
2160         fiop->f_groups[0][1] = ipfgroups[0][1];
2161         fiop->f_groups[1][0] = ipfgroups[1][0];
2162         fiop->f_groups[1][1] = ipfgroups[1][1];
2163         fiop->f_groups[2][0] = ipfgroups[2][0];
2164         fiop->f_groups[2][1] = ipfgroups[2][1];
2165 #ifdef  IPFILTER_LOG
2166         fiop->f_logging = 1;
2167 #else
2168         fiop->f_logging = 0;
2169 #endif
2170         fiop->f_defpass = fr_pass;
2171         strncpy(fiop->f_version, ipfilter_version, sizeof(fiop->f_version));
2172 }
2173
2174
2175 #ifdef  USE_INET6
2176 int icmptoicmp6types[ICMP_MAXTYPE+1] = {
2177         ICMP6_ECHO_REPLY,       /* 0: ICMP_ECHOREPLY */
2178         -1,                     /* 1: UNUSED */
2179         -1,                     /* 2: UNUSED */
2180         ICMP6_DST_UNREACH,      /* 3: ICMP_UNREACH */
2181         -1,                     /* 4: ICMP_SOURCEQUENCH */
2182         ND_REDIRECT,            /* 5: ICMP_REDIRECT */
2183         -1,                     /* 6: UNUSED */
2184         -1,                     /* 7: UNUSED */
2185         ICMP6_ECHO_REQUEST,     /* 8: ICMP_ECHO */
2186         -1,                     /* 9: UNUSED */
2187         -1,                     /* 10: UNUSED */
2188         ICMP6_TIME_EXCEEDED,    /* 11: ICMP_TIMXCEED */
2189         ICMP6_PARAM_PROB,       /* 12: ICMP_PARAMPROB */
2190         -1,                     /* 13: ICMP_TSTAMP */
2191         -1,                     /* 14: ICMP_TSTAMPREPLY */
2192         -1,                     /* 15: ICMP_IREQ */
2193         -1,                     /* 16: ICMP_IREQREPLY */
2194         -1,                     /* 17: ICMP_MASKREQ */
2195         -1,                     /* 18: ICMP_MASKREPLY */
2196 };
2197
2198
2199 int     icmptoicmp6unreach[ICMP_MAX_UNREACH] = {
2200         ICMP6_DST_UNREACH_ADDR,         /* 0: ICMP_UNREACH_NET */
2201         ICMP6_DST_UNREACH_ADDR,         /* 1: ICMP_UNREACH_HOST */
2202         -1,                             /* 2: ICMP_UNREACH_PROTOCOL */
2203         ICMP6_DST_UNREACH_NOPORT,       /* 3: ICMP_UNREACH_PORT */
2204         -1,                             /* 4: ICMP_UNREACH_NEEDFRAG */
2205         ICMP6_DST_UNREACH_NOTNEIGHBOR,  /* 5: ICMP_UNREACH_SRCFAIL */
2206         ICMP6_DST_UNREACH_ADDR,         /* 6: ICMP_UNREACH_NET_UNKNOWN */
2207         ICMP6_DST_UNREACH_ADDR,         /* 7: ICMP_UNREACH_HOST_UNKNOWN */
2208         -1,                             /* 8: ICMP_UNREACH_ISOLATED */
2209         ICMP6_DST_UNREACH_ADMIN,        /* 9: ICMP_UNREACH_NET_PROHIB */
2210         ICMP6_DST_UNREACH_ADMIN,        /* 10: ICMP_UNREACH_HOST_PROHIB */
2211         -1,                             /* 11: ICMP_UNREACH_TOSNET */
2212         -1,                             /* 12: ICMP_UNREACH_TOSHOST */
2213         ICMP6_DST_UNREACH_ADMIN,        /* 13: ICMP_UNREACH_ADMIN_PROHIBIT */
2214 };
2215 #endif
2216
2217
2218 #ifndef _KERNEL
2219 int mbuflen(buf)
2220 mb_t *buf;
2221 {
2222         ip_t *ip;
2223
2224         ip = (ip_t *)buf;
2225         return ip->ip_len;
2226 }
2227 #endif