1 /*
   2  * Copyright (C) 1995-2003 by Darren Reed.
   3  *
   4  * See the IPFILTER.LICENCE file for details on licencing.
   5  *
   6  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
   7  *
   8  * Copyright 2019 Joyent, Inc.
   9  */
  10 
  11 #if defined(KERNEL) || defined(_KERNEL)
  12 # undef KERNEL
  13 # undef _KERNEL
  14 # define        KERNEL  1
  15 # define        _KERNEL 1
  16 #endif
  17 #include <sys/errno.h>
  18 #include <sys/types.h>
  19 #include <sys/param.h>
  20 #include <sys/file.h>
  21 #if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \
  22     defined(_KERNEL)
  23 # include "opt_ipfilter_log.h"
  24 #endif
  25 #if defined(_KERNEL) && defined(__FreeBSD_version) && \
  26     (__FreeBSD_version >= 400000) && !defined(KLD_MODULE)
  27 #include "opt_inet6.h"
  28 #endif
  29 #if !defined(_KERNEL) && !defined(__KERNEL__)
  30 # include <stdio.h>
  31 # include <stdlib.h>
  32 # include <string.h>
  33 # define _KERNEL
  34 # ifdef __OpenBSD__
  35 struct file;
  36 # endif
  37 # include <sys/uio.h>
  38 # undef _KERNEL
  39 #endif
  40 #if defined(_KERNEL) && (__FreeBSD_version >= 220000)
  41 # include <sys/filio.h>
  42 # include <sys/fcntl.h>
  43 # if (__FreeBSD_version >= 300000) && !defined(IPFILTER_LKM)
  44 #  include "opt_ipfilter.h"
  45 # endif
  46 #else
  47 # include <sys/ioctl.h>
  48 #endif
  49 #include <sys/time.h>
  50 #if !defined(linux)
  51 # include <sys/protosw.h>
  52 #endif
  53 #include <sys/socket.h>
  54 #if defined(_KERNEL)
  55 # include <sys/systm.h>
  56 # if !defined(__SVR4) && !defined(__svr4__)
  57 #  include <sys/mbuf.h>
  58 # endif
  59 #endif
  60 #if defined(__SVR4) || defined(__svr4__)
  61 # include <sys/filio.h>
  62 # include <sys/byteorder.h>
  63 # ifdef _KERNEL
  64 #  include <sys/dditypes.h>
  65 # endif
  66 # include <sys/stream.h>
  67 # include <sys/kmem.h>
  68 #endif
  69 
  70 #include <net/if.h>
  71 #ifdef sun
  72 # include <net/af.h>
  73 #endif
  74 #include <net/route.h>
  75 #include <netinet/in.h>
  76 #include <netinet/in_systm.h>
  77 #include <netinet/ip.h>
  78 #include <netinet/tcp.h>
  79 #if !defined(linux)
  80 # include <netinet/ip_var.h>
  81 #endif
  82 #if !defined(__hpux) && !defined(linux)
  83 # include <netinet/tcp_fsm.h>
  84 #endif
  85 #include <netinet/udp.h>
  86 #include <netinet/ip_icmp.h>
  87 #include "netinet/ip_compat.h"
  88 #include <netinet/tcpip.h>
  89 #include "netinet/ip_fil.h"
  90 #include "netinet/ip_nat.h"
  91 #include "netinet/ip_frag.h"
  92 #include "netinet/ip_state.h"
  93 #include "netinet/ip_proxy.h"
  94 #include "netinet/ipf_stack.h"
  95 #ifdef  IPFILTER_SYNC
  96 #include "netinet/ip_sync.h"
  97 #endif
  98 #ifdef  IPFILTER_SCAN
  99 #include "netinet/ip_scan.h"
 100 #endif
 101 #ifdef  USE_INET6
 102 #include <netinet/icmp6.h>
 103 #endif
 104 #if (__FreeBSD_version >= 300000)
 105 # include <sys/malloc.h>
 106 # if defined(_KERNEL) && !defined(IPFILTER_LKM)
 107 #  include <sys/libkern.h>
 108 #  include <sys/systm.h>
 109 # endif
 110 #endif
 111 #include <sys/uuid.h>
 112 /* END OF INCLUDES */
 113 
 114 
 115 #if !defined(lint)
 116 static const char sccsid[] = "@(#)ip_state.c    1.8 6/5/96 (C) 1993-2000 Darren Reed";
 117 static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.186.2.36 2005/08/11 19:58:03 darrenr Exp $";
 118 #endif
 119 
 120 #ifdef  USE_INET6
 121 static ipstate_t *fr_checkicmp6matchingstate __P((fr_info_t *));
 122 #endif
 123 static ipstate_t *fr_matchsrcdst __P((fr_info_t *, ipstate_t *, i6addr_t *,
 124                                       i6addr_t *, tcphdr_t *, u_32_t));
 125 static ipstate_t *fr_checkicmpmatchingstate __P((fr_info_t *));
 126 static int fr_state_flush __P((int, int, ipf_stack_t *));
 127 static ips_stat_t *fr_statetstats __P((ipf_stack_t *));
 128 static int fr_state_remove __P((caddr_t, ipf_stack_t *));
 129 static void fr_ipsmove __P((ipstate_t *, u_int, ipf_stack_t *));
 130 static int fr_tcpstate __P((fr_info_t *, tcphdr_t *, ipstate_t *));
 131 static int fr_tcpoptions __P((fr_info_t *, tcphdr_t *, tcpdata_t *));
 132 static ipstate_t *fr_stclone __P((fr_info_t *, tcphdr_t *, ipstate_t *));
 133 static void fr_fixinisn __P((fr_info_t *, ipstate_t *));
 134 static void fr_fixoutisn __P((fr_info_t *, ipstate_t *));
 135 static void fr_checknewisn __P((fr_info_t *, ipstate_t *));
 136 static int fr_stateiter __P((ipftoken_t *, ipfgeniter_t *, ipf_stack_t *));
 137 
 138 int fr_stputent __P((caddr_t, ipf_stack_t *));
 139 int fr_stgetent __P((caddr_t, ipf_stack_t *));
 140 
 141 #define ONE_DAY         IPF_TTLVAL(1 * 86400)   /* 1 day */
 142 #define FIVE_DAYS       (5 * ONE_DAY)
 143 #define DOUBLE_HASH(x, ifs)     \
 144     (((x) + ifs->ifs_ips_seed[(x) % ifs->ifs_fr_statesize]) % ifs->ifs_fr_statesize)
 145 
 146 
 147 /* ------------------------------------------------------------------------ */
 148 /* Function:    fr_stateinit                                                */
 149 /* Returns:     int - 0 == success, -1 == failure                           */
 150 /* Parameters:  ifs - ipf stack instance                                    */
 151 /*                                                                          */
 152 /* Initialise all the global variables used within the state code.          */
 153 /* This action also includes initiailising locks.                           */
 154 /* ------------------------------------------------------------------------ */
 155 int fr_stateinit(ifs)
 156 ipf_stack_t *ifs;
 157 {
 158 #if defined(NEED_LOCAL_RAND) || !defined(_KERNEL)
 159         struct timeval tv;
 160 #endif
 161         int i;
 162 
 163         KMALLOCS(ifs->ifs_ips_table, ipstate_t **, 
 164                  ifs->ifs_fr_statesize * sizeof(ipstate_t *));
 165         if (ifs->ifs_ips_table == NULL)
 166                 return -1;
 167         bzero((char *)ifs->ifs_ips_table, 
 168               ifs->ifs_fr_statesize * sizeof(ipstate_t *));
 169 
 170         KMALLOCS(ifs->ifs_ips_seed, u_long *,
 171                  ifs->ifs_fr_statesize * sizeof(*ifs->ifs_ips_seed));
 172         if (ifs->ifs_ips_seed == NULL)
 173                 return -2;
 174 #if defined(NEED_LOCAL_RAND) || !defined(_KERNEL)
 175         tv.tv_sec = 0;
 176         GETKTIME(&tv);
 177 #endif
 178         for (i = 0; i < ifs->ifs_fr_statesize; i++) {
 179                 /*
 180                  * XXX - ips_seed[X] should be a random number of sorts.
 181                  */
 182 #if !defined(NEED_LOCAL_RAND) && defined(_KERNEL)
 183                 ifs->ifs_ips_seed[i] = ipf_random();
 184 #else
 185                 ifs->ifs_ips_seed[i] = ((u_long)ifs->ifs_ips_seed + i) *
 186                     ifs->ifs_fr_statesize;
 187                 ifs->ifs_ips_seed[i] += tv.tv_sec;
 188                 ifs->ifs_ips_seed[i] *= (u_long)ifs->ifs_ips_seed;
 189                 ifs->ifs_ips_seed[i] ^= 0x5a5aa5a5;
 190                 ifs->ifs_ips_seed[i] *= ifs->ifs_fr_statemax;
 191 #endif
 192         }
 193 
 194         /* fill icmp reply type table */
 195         for (i = 0; i <= ICMP_MAXTYPE; i++)
 196                 icmpreplytype4[i] = -1;
 197         icmpreplytype4[ICMP_ECHO] = ICMP_ECHOREPLY;
 198         icmpreplytype4[ICMP_TSTAMP] = ICMP_TSTAMPREPLY;
 199         icmpreplytype4[ICMP_IREQ] = ICMP_IREQREPLY;
 200         icmpreplytype4[ICMP_MASKREQ] = ICMP_MASKREPLY;
 201 #ifdef  USE_INET6
 202         /* fill icmp reply type table */
 203         for (i = 0; i <= ICMP6_MAXTYPE; i++)
 204                 icmpreplytype6[i] = -1;
 205         icmpreplytype6[ICMP6_ECHO_REQUEST] = ICMP6_ECHO_REPLY;
 206         icmpreplytype6[ICMP6_MEMBERSHIP_QUERY] = ICMP6_MEMBERSHIP_REPORT;
 207         icmpreplytype6[ICMP6_NI_QUERY] = ICMP6_NI_REPLY;
 208         icmpreplytype6[ND_ROUTER_SOLICIT] = ND_ROUTER_ADVERT;
 209         icmpreplytype6[ND_NEIGHBOR_SOLICIT] = ND_NEIGHBOR_ADVERT;
 210 #endif
 211 
 212         KMALLOCS(ifs->ifs_ips_stats.iss_bucketlen, u_long *,
 213                  ifs->ifs_fr_statesize * sizeof(u_long));
 214         if (ifs->ifs_ips_stats.iss_bucketlen == NULL)
 215                 return -1;
 216         bzero((char *)ifs->ifs_ips_stats.iss_bucketlen, 
 217               ifs->ifs_fr_statesize * sizeof(u_long));
 218 
 219         if (ifs->ifs_fr_state_maxbucket == 0) {
 220                 for (i = ifs->ifs_fr_statesize; i > 0; i >>= 1)
 221                         ifs->ifs_fr_state_maxbucket++;
 222                 ifs->ifs_fr_state_maxbucket *= 2;
 223         }
 224 
 225         fr_sttab_init(ifs->ifs_ips_tqtqb, ifs);
 226         ifs->ifs_ips_tqtqb[IPF_TCP_NSTATES - 1].ifq_next = &ifs->ifs_ips_udptq;
 227         ifs->ifs_ips_udptq.ifq_ttl = (u_long)ifs->ifs_fr_udptimeout;
 228         ifs->ifs_ips_udptq.ifq_ref = 1;
 229         ifs->ifs_ips_udptq.ifq_head = NULL;
 230         ifs->ifs_ips_udptq.ifq_tail = &ifs->ifs_ips_udptq.ifq_head;
 231         MUTEX_INIT(&ifs->ifs_ips_udptq.ifq_lock, "ipftq udp tab");
 232         ifs->ifs_ips_udptq.ifq_next = &ifs->ifs_ips_udpacktq;
 233         ifs->ifs_ips_udpacktq.ifq_ttl = (u_long)ifs->ifs_fr_udpacktimeout;
 234         ifs->ifs_ips_udpacktq.ifq_ref = 1;
 235         ifs->ifs_ips_udpacktq.ifq_head = NULL;
 236         ifs->ifs_ips_udpacktq.ifq_tail = &ifs->ifs_ips_udpacktq.ifq_head;
 237         MUTEX_INIT(&ifs->ifs_ips_udpacktq.ifq_lock, "ipftq udpack tab");
 238         ifs->ifs_ips_udpacktq.ifq_next = &ifs->ifs_ips_icmptq;
 239         ifs->ifs_ips_icmptq.ifq_ttl = (u_long)ifs->ifs_fr_icmptimeout;
 240         ifs->ifs_ips_icmptq.ifq_ref = 1;
 241         ifs->ifs_ips_icmptq.ifq_head = NULL;
 242         ifs->ifs_ips_icmptq.ifq_tail = &ifs->ifs_ips_icmptq.ifq_head;
 243         MUTEX_INIT(&ifs->ifs_ips_icmptq.ifq_lock, "ipftq icmp tab");
 244         ifs->ifs_ips_icmptq.ifq_next = &ifs->ifs_ips_icmpacktq;
 245         ifs->ifs_ips_icmpacktq.ifq_ttl = (u_long)ifs->ifs_fr_icmpacktimeout;
 246         ifs->ifs_ips_icmpacktq.ifq_ref = 1;
 247         ifs->ifs_ips_icmpacktq.ifq_head = NULL;
 248         ifs->ifs_ips_icmpacktq.ifq_tail = &ifs->ifs_ips_icmpacktq.ifq_head;
 249         MUTEX_INIT(&ifs->ifs_ips_icmpacktq.ifq_lock, "ipftq icmpack tab");
 250         ifs->ifs_ips_icmpacktq.ifq_next = &ifs->ifs_ips_iptq;
 251         ifs->ifs_ips_iptq.ifq_ttl = (u_long)ifs->ifs_fr_iptimeout;
 252         ifs->ifs_ips_iptq.ifq_ref = 1;
 253         ifs->ifs_ips_iptq.ifq_head = NULL;
 254         ifs->ifs_ips_iptq.ifq_tail = &ifs->ifs_ips_iptq.ifq_head;
 255         MUTEX_INIT(&ifs->ifs_ips_iptq.ifq_lock, "ipftq ip tab");
 256         ifs->ifs_ips_iptq.ifq_next = &ifs->ifs_ips_deletetq;
 257         /* entry's ttl in deletetq is just 1 tick */
 258         ifs->ifs_ips_deletetq.ifq_ttl = (u_long) 1;
 259         ifs->ifs_ips_deletetq.ifq_ref = 1;
 260         ifs->ifs_ips_deletetq.ifq_head = NULL;
 261         ifs->ifs_ips_deletetq.ifq_tail = &ifs->ifs_ips_deletetq.ifq_head;
 262         MUTEX_INIT(&ifs->ifs_ips_deletetq.ifq_lock, "state delete queue");
 263         ifs->ifs_ips_deletetq.ifq_next = NULL;
 264 
 265         RWLOCK_INIT(&ifs->ifs_ipf_state, "ipf IP state rwlock");
 266         MUTEX_INIT(&ifs->ifs_ipf_stinsert, "ipf state insert mutex");
 267         ifs->ifs_fr_state_init = 1;
 268 
 269         ifs->ifs_ips_last_force_flush = ifs->ifs_fr_ticks;
 270         return 0;
 271 }
 272 
 273 
 274 /* ------------------------------------------------------------------------ */
 275 /* Function:    fr_stateunload                                              */
 276 /* Returns:     Nil                                                         */
 277 /* Parameters:  ifs - ipf stack instance                                    */
 278 /*                                                                          */
 279 /* Release and destroy any resources acquired or initialised so that        */
 280 /* IPFilter can be unloaded or re-initialised.                              */
 281 /* ------------------------------------------------------------------------ */
 282 void fr_stateunload(ifs)
 283 ipf_stack_t *ifs;
 284 {
 285         ipftq_t *ifq, *ifqnext;
 286         ipstate_t *is;
 287 
 288         while ((is = ifs->ifs_ips_list) != NULL)
 289             (void) fr_delstate(is, 0, ifs);
 290 
 291         /*
 292          * Proxy timeout queues are not cleaned here because although they
 293          * exist on the state list, appr_unload is called after fr_stateunload
 294          * and the proxies actually are responsible for them being created.
 295          * Should the proxy timeouts have their own list?  There's no real
 296          * justification as this is the only complicationA
 297          */
 298         for (ifq = ifs->ifs_ips_utqe; ifq != NULL; ifq = ifqnext) {
 299                 ifqnext = ifq->ifq_next;
 300                 if (((ifq->ifq_flags & IFQF_PROXY) == 0) &&
 301                     (fr_deletetimeoutqueue(ifq) == 0))
 302                         fr_freetimeoutqueue(ifq, ifs);
 303         }
 304 
 305         ifs->ifs_ips_stats.iss_inuse = 0;
 306         ifs->ifs_ips_num = 0;
 307 
 308         if (ifs->ifs_fr_state_init == 1) {
 309                 fr_sttab_destroy(ifs->ifs_ips_tqtqb);
 310                 MUTEX_DESTROY(&ifs->ifs_ips_udptq.ifq_lock);
 311                 MUTEX_DESTROY(&ifs->ifs_ips_icmptq.ifq_lock);
 312                 MUTEX_DESTROY(&ifs->ifs_ips_udpacktq.ifq_lock);
 313                 MUTEX_DESTROY(&ifs->ifs_ips_icmpacktq.ifq_lock);
 314                 MUTEX_DESTROY(&ifs->ifs_ips_iptq.ifq_lock);
 315                 MUTEX_DESTROY(&ifs->ifs_ips_deletetq.ifq_lock);
 316         }
 317 
 318         if (ifs->ifs_ips_table != NULL) {
 319                 KFREES(ifs->ifs_ips_table, 
 320                        ifs->ifs_fr_statesize * sizeof(*ifs->ifs_ips_table));
 321                 ifs->ifs_ips_table = NULL;
 322         }
 323 
 324         if (ifs->ifs_ips_seed != NULL) {
 325                 KFREES(ifs->ifs_ips_seed, 
 326                        ifs->ifs_fr_statesize * sizeof(*ifs->ifs_ips_seed));
 327                 ifs->ifs_ips_seed = NULL;
 328         }
 329 
 330         if (ifs->ifs_ips_stats.iss_bucketlen != NULL) {
 331                 KFREES(ifs->ifs_ips_stats.iss_bucketlen, 
 332                        ifs->ifs_fr_statesize * sizeof(u_long));
 333                 ifs->ifs_ips_stats.iss_bucketlen = NULL;
 334         }
 335 
 336         if (ifs->ifs_fr_state_maxbucket_reset == 1)
 337                 ifs->ifs_fr_state_maxbucket = 0;
 338 
 339         if (ifs->ifs_fr_state_init == 1) {
 340                 ifs->ifs_fr_state_init = 0;
 341                 RW_DESTROY(&ifs->ifs_ipf_state);
 342                 MUTEX_DESTROY(&ifs->ifs_ipf_stinsert);
 343         }
 344 }
 345 
 346 
 347 /* ------------------------------------------------------------------------ */
 348 /* Function:    fr_statetstats                                              */
 349 /* Returns:     ips_state_t* - pointer to state stats structure             */
 350 /* Parameters:  Nil                                                         */
 351 /*                                                                          */
 352 /* Put all the current numbers and pointers into a single struct and return */
 353 /* a pointer to it.                                                         */
 354 /* ------------------------------------------------------------------------ */
 355 static ips_stat_t *fr_statetstats(ifs)
 356 ipf_stack_t *ifs;
 357 {
 358         ifs->ifs_ips_stats.iss_active = ifs->ifs_ips_num;
 359         ifs->ifs_ips_stats.iss_statesize = ifs->ifs_fr_statesize;
 360         ifs->ifs_ips_stats.iss_statemax = ifs->ifs_fr_statemax;
 361         ifs->ifs_ips_stats.iss_table = ifs->ifs_ips_table;
 362         ifs->ifs_ips_stats.iss_list = ifs->ifs_ips_list;
 363         ifs->ifs_ips_stats.iss_ticks = ifs->ifs_fr_ticks;
 364         return &ifs->ifs_ips_stats;
 365 }
 366 
 367 /* ------------------------------------------------------------------------ */
 368 /* Function:    fr_state_remove                                             */
 369 /* Returns:     int - 0 == success, != 0 == failure                         */
 370 /* Parameters:  data(I) - pointer to state structure to delete from table   */
 371 /*              ifs - ipf stack instance                                    */
 372 /*                                                                          */
 373 /* Search for a state structure that matches the one passed, according to   */
 374 /* the IP addresses and other protocol specific information.                */
 375 /* ------------------------------------------------------------------------ */
 376 static int fr_state_remove(data, ifs)
 377 caddr_t data;
 378 ipf_stack_t *ifs;
 379 {
 380         ipstate_t *sp, st;
 381         int error;
 382 
 383         sp = &st;
 384         error = fr_inobj(data, &st, IPFOBJ_IPSTATE);
 385         if (error)
 386                 return EFAULT;
 387 
 388         WRITE_ENTER(&ifs->ifs_ipf_state);
 389         for (sp = ifs->ifs_ips_list; sp; sp = sp->is_next)
 390                 if ((sp->is_p == st.is_p) && (sp->is_v == st.is_v) &&
 391                     !bcmp((caddr_t)&sp->is_src, (caddr_t)&st.is_src,
 392                           sizeof(st.is_src)) &&
 393                     !bcmp((caddr_t)&sp->is_dst, (caddr_t)&st.is_dst,
 394                           sizeof(st.is_dst)) &&
 395                     !bcmp((caddr_t)&sp->is_ps, (caddr_t)&st.is_ps,
 396                           sizeof(st.is_ps))) {
 397                         (void) fr_delstate(sp, ISL_REMOVE, ifs);
 398                         RWLOCK_EXIT(&ifs->ifs_ipf_state);
 399                         return 0;
 400                 }
 401         RWLOCK_EXIT(&ifs->ifs_ipf_state);
 402         return ESRCH;
 403 }
 404 
 405 
 406 /* ------------------------------------------------------------------------ */
 407 /* Function:    fr_state_ioctl                                              */
 408 /* Returns:     int - 0 == success, != 0 == failure                         */
 409 /* Parameters:  data(I) - pointer to ioctl data                             */
 410 /*              cmd(I)  - ioctl command integer                             */
 411 /*              mode(I) - file mode bits used with open                     */
 412 /*              uid(I)  - uid of caller                                     */
 413 /*              ctx(I)  - pointer to give the uid context                   */
 414 /*              ifs     - ipf stack instance                                */
 415 /*                                                                          */
 416 /* Processes an ioctl call made to operate on the IP Filter state device.   */
 417 /* ------------------------------------------------------------------------ */
 418 int fr_state_ioctl(data, cmd, mode, uid, ctx, ifs)
 419 caddr_t data;
 420 ioctlcmd_t cmd;
 421 int mode, uid;
 422 void *ctx;
 423 ipf_stack_t *ifs;
 424 {
 425         int arg, ret, error = 0;
 426 
 427         switch (cmd)
 428         {
 429         /*
 430          * Delete an entry from the state table.
 431          */
 432         case SIOCDELST :
 433                 error = fr_state_remove(data, ifs);
 434                 break;
 435         /*
 436          * Flush the state table
 437          */
 438         case SIOCIPFFL :
 439                 error = BCOPYIN(data, (char *)&arg, sizeof(arg));
 440                 if (error != 0) {
 441                         error = EFAULT;
 442                 } else {
 443                         if (VALID_TABLE_FLUSH_OPT(arg)) {
 444                                 WRITE_ENTER(&ifs->ifs_ipf_state);
 445                                 ret = fr_state_flush(arg, 4, ifs);
 446                                 RWLOCK_EXIT(&ifs->ifs_ipf_state);
 447                                 error = BCOPYOUT((char *)&ret, data,
 448                                                 sizeof(ret));
 449                                 if (error != 0)
 450                                         return EFAULT;
 451                         } else {
 452                                 error = EINVAL;
 453                         }
 454                 }
 455                 break;
 456 
 457 #ifdef  USE_INET6
 458         case SIOCIPFL6 :
 459                 error = BCOPYIN(data, (char *)&arg, sizeof(arg));
 460                 if (error != 0) {
 461                         error = EFAULT;
 462                 } else {
 463                         if (VALID_TABLE_FLUSH_OPT(arg)) {
 464                                 WRITE_ENTER(&ifs->ifs_ipf_state);
 465                                 ret = fr_state_flush(arg, 6, ifs);
 466                                 RWLOCK_EXIT(&ifs->ifs_ipf_state);
 467                                 error = BCOPYOUT((char *)&ret, data,
 468                                                 sizeof(ret));
 469                                 if (error != 0)
 470                                         return EFAULT;
 471                         } else {
 472                                 error = EINVAL;
 473                         }
 474                 }
 475                 break;
 476 #endif
 477 #ifdef  IPFILTER_LOG
 478         /*
 479          * Flush the state log.
 480          */
 481         case SIOCIPFFB :
 482                 if (!(mode & FWRITE))
 483                         error = EPERM;
 484                 else {
 485                         int tmp;
 486 
 487                         tmp = ipflog_clear(IPL_LOGSTATE, ifs);
 488                         error = BCOPYOUT((char *)&tmp, data, sizeof(tmp));
 489                         if (error != 0)
 490                                 error = EFAULT;
 491                 }
 492                 break;
 493         /*
 494          * Turn logging of state information on/off.
 495          */
 496         case SIOCSETLG :
 497                 if (!(mode & FWRITE)) {
 498                         error = EPERM;
 499                 } else {
 500                         error = BCOPYIN((char *)data,
 501                                         (char *)&ifs->ifs_ipstate_logging,
 502                                         sizeof(ifs->ifs_ipstate_logging));
 503                         if (error != 0)
 504                                 error = EFAULT;
 505                 }
 506                 break;
 507         /*
 508          * Return the current state of logging.
 509          */
 510         case SIOCGETLG :
 511                 error = BCOPYOUT((char *)&ifs->ifs_ipstate_logging,
 512                                 (char *)data,
 513                                 sizeof(ifs->ifs_ipstate_logging));
 514                 if (error != 0)
 515                         error = EFAULT;
 516                 break;
 517         /*
 518          * Return the number of bytes currently waiting to be read.
 519          */
 520         case FIONREAD :
 521                 arg = ifs->ifs_iplused[IPL_LOGSTATE]; /* returned in an int */
 522                 error = BCOPYOUT((char *)&arg, data, sizeof(arg));
 523                 if (error != 0)
 524                         error = EFAULT;
 525                 break;
 526 #endif
 527         /*
 528          * Get the current state statistics.
 529          */
 530         case SIOCGETFS :
 531                 error = fr_outobj(data, fr_statetstats(ifs), IPFOBJ_STATESTAT);
 532                 break;
 533         /*
 534          * Lock/Unlock the state table.  (Locking prevents any changes, which
 535          * means no packets match).
 536          */
 537         case SIOCSTLCK :
 538                 if (!(mode & FWRITE)) {
 539                         error = EPERM;
 540                 } else {
 541                         error = fr_lock(data, &ifs->ifs_fr_state_lock);
 542                 }
 543                 break;
 544         /*
 545          * Add an entry to the current state table.
 546          */
 547         case SIOCSTPUT :
 548                 if (!ifs->ifs_fr_state_lock || !(mode & FWRITE)) {
 549                         error = EACCES;
 550                         break;
 551                 }
 552                 error = fr_stputent(data, ifs);
 553                 break;
 554         /*
 555          * Get a state table entry.
 556          */
 557         case SIOCSTGET :
 558                 if (!ifs->ifs_fr_state_lock) {
 559                         error = EACCES;
 560                         break;
 561                 }
 562                 error = fr_stgetent(data, ifs);
 563                 break;
 564 
 565         case SIOCGENITER :
 566             {
 567                 ipftoken_t *token;
 568                 ipfgeniter_t iter;
 569 
 570                 error = fr_inobj(data, &iter, IPFOBJ_GENITER);
 571                 if (error != 0)
 572                         break;
 573 
 574                 token = ipf_findtoken(IPFGENITER_STATE, uid, ctx, ifs);
 575                 if (token != NULL)
 576                         error = fr_stateiter(token, &iter, ifs);
 577                 else
 578                         error = ESRCH;
 579                 RWLOCK_EXIT(&ifs->ifs_ipf_tokens);
 580                 break;
 581             }
 582 
 583         case SIOCIPFDELTOK :
 584                 error = BCOPYIN(data, (char *)&arg, sizeof(arg));
 585                 if (error != 0) {
 586                         error = EFAULT;
 587                 } else {
 588                         error = ipf_deltoken(arg, uid, ctx, ifs);
 589                 }
 590                 break;
 591 
 592         default :
 593                 error = EINVAL;
 594                 break;
 595         }
 596         return error;
 597 }
 598 
 599 
 600 /* ------------------------------------------------------------------------ */
 601 /* Function:    fr_stgetent                                                 */
 602 /* Returns:     int - 0 == success, != 0 == failure                         */
 603 /* Parameters:  data(I) - pointer to state structure to retrieve from table */
 604 /*                                                                          */
 605 /* Copy out state information from the kernel to a user space process.  If  */
 606 /* there is a filter rule associated with the state entry, copy that out    */
 607 /* as well.  The entry to copy out is taken from the value of "ips_next" in */
 608 /* the struct passed in and if not null and not found in the list of current*/
 609 /* state entries, the retrieval fails.                                      */
 610 /* ------------------------------------------------------------------------ */
 611 int fr_stgetent(data, ifs)
 612 caddr_t data;
 613 ipf_stack_t *ifs;
 614 {
 615         ipstate_t *is, *isn;
 616         ipstate_save_t ips;
 617         int error;
 618 
 619         error = fr_inobj(data, &ips, IPFOBJ_STATESAVE);
 620         if (error)
 621                 return EFAULT;
 622 
 623         isn = ips.ips_next;
 624         if (isn == NULL) {
 625                 isn = ifs->ifs_ips_list;
 626                 if (isn == NULL) {
 627                         if (ips.ips_next == NULL)
 628                                 return ENOENT;
 629                         return 0;
 630                 }
 631         } else {
 632                 /*
 633                  * Make sure the pointer we're copying from exists in the
 634                  * current list of entries.  Security precaution to prevent
 635                  * copying of random kernel data.
 636                  */
 637                 for (is = ifs->ifs_ips_list; is; is = is->is_next)
 638                         if (is == isn)
 639                                 break;
 640                 if (!is)
 641                         return ESRCH;
 642         }
 643         ips.ips_next = isn->is_next;
 644         bcopy((char *)isn, (char *)&ips.ips_is, sizeof(ips.ips_is));
 645         ips.ips_rule = isn->is_rule;
 646         if (isn->is_rule != NULL)
 647                 bcopy((char *)isn->is_rule, (char *)&ips.ips_fr,
 648                       sizeof(ips.ips_fr));
 649         error = fr_outobj(data, &ips, IPFOBJ_STATESAVE);
 650         if (error)
 651                 return EFAULT;
 652         return 0;
 653 }
 654 
 655 
 656 /* ------------------------------------------------------------------------ */
 657 /* Function:    fr_stputent                                                 */
 658 /* Returns:     int - 0 == success, != 0 == failure                         */
 659 /* Parameters:  data(I) - pointer to state information struct               */
 660 /*              ifs     - ipf stack instance                                */
 661 /*                                                                          */
 662 /* This function implements the SIOCSTPUT ioctl: insert a state entry into  */
 663 /* the state table.  If the state info. includes a pointer to a filter rule */
 664 /* then also add in an orphaned rule (will not show up in any "ipfstat -io" */
 665 /* output.                                                                  */
 666 /* ------------------------------------------------------------------------ */
 667 int fr_stputent(data, ifs)
 668 caddr_t data;
 669 ipf_stack_t *ifs;
 670 {
 671         ipstate_t *is, *isn;
 672         ipstate_save_t ips;
 673         int error, i;
 674         frentry_t *fr;
 675         char *name;
 676 
 677         error = fr_inobj(data, &ips, IPFOBJ_STATESAVE);
 678         if (error)
 679                 return EFAULT;
 680 
 681         /*
 682          * Trigger automatic call to fr_state_flush() if the
 683          * table has reached capacity specified by hi watermark.
 684          */
 685         if (ST_TAB_WATER_LEVEL(ifs) > ifs->ifs_state_flush_level_hi)
 686                 ifs->ifs_fr_state_doflush = 1;
 687 
 688         /*
 689          * If automatic flushing did not do its job, and the table
 690          * has filled up, don't try to create a new entry.
 691          */
 692         if (ifs->ifs_ips_num >= ifs->ifs_fr_statemax) {
 693                 ATOMIC_INCL(ifs->ifs_ips_stats.iss_max);
 694                 return ENOMEM;
 695         }
 696 
 697         KMALLOC(isn, ipstate_t *);
 698         if (isn == NULL)
 699                 return ENOMEM;
 700 
 701         bcopy((char *)&ips.ips_is, (char *)isn, sizeof(*isn));
 702         bzero((char *)isn, offsetof(struct ipstate, is_pkts));
 703         isn->is_sti.tqe_pnext = NULL;
 704         isn->is_sti.tqe_next = NULL;
 705         isn->is_sti.tqe_ifq = NULL;
 706         isn->is_sti.tqe_parent = isn;
 707         isn->is_ifp[0] = NULL;
 708         isn->is_ifp[1] = NULL;
 709         isn->is_ifp[2] = NULL;
 710         isn->is_ifp[3] = NULL;
 711         isn->is_sync = NULL;
 712         fr = ips.ips_rule;
 713 
 714         if (fr == NULL) {
 715                 READ_ENTER(&ifs->ifs_ipf_state);
 716                 fr_stinsert(isn, 0, ifs);
 717                 MUTEX_EXIT(&isn->is_lock);
 718                 RWLOCK_EXIT(&ifs->ifs_ipf_state);
 719                 return 0;
 720         }
 721 
 722         if (isn->is_flags & SI_NEWFR) {
 723                 KMALLOC(fr, frentry_t *);
 724                 if (fr == NULL) {
 725                         KFREE(isn);
 726                         return ENOMEM;
 727                 }
 728                 bcopy((char *)&ips.ips_fr, (char *)fr, sizeof(*fr));
 729                 isn->is_rule = fr;
 730                 ips.ips_is.is_rule = fr;
 731                 MUTEX_NUKE(&fr->fr_lock);
 732                 MUTEX_INIT(&fr->fr_lock, "state filter rule lock");
 733 
 734                 /*
 735                  * Look up all the interface names in the rule.
 736                  */
 737                 for (i = 0; i < 4; i++) {
 738                         name = fr->fr_ifnames[i];
 739                         fr->fr_ifas[i] = fr_resolvenic(name, fr->fr_v, ifs);
 740                         name = isn->is_ifname[i];
 741                         isn->is_ifp[i] = fr_resolvenic(name, isn->is_v, ifs);
 742                 }
 743 
 744                 fr->fr_ref = 0;
 745                 fr->fr_dsize = 0;
 746                 fr->fr_data = NULL;
 747                 fr->fr_type = FR_T_NONE;
 748 
 749                 fr_resolvedest(&fr->fr_tif, fr->fr_v, ifs);
 750                 fr_resolvedest(&fr->fr_dif, fr->fr_v, ifs);
 751                 fr_resolvedest(&fr->fr_rif, fr->fr_v, ifs);
 752 
 753                 /*
 754                  * send a copy back to userland of what we ended up
 755                  * to allow for verification.
 756                  */
 757                 error = fr_outobj(data, &ips, IPFOBJ_STATESAVE);
 758                 if (error) {
 759                         KFREE(isn);
 760                         MUTEX_DESTROY(&fr->fr_lock);
 761                         KFREE(fr);
 762                         return EFAULT;
 763                 }
 764                 READ_ENTER(&ifs->ifs_ipf_state);
 765                 fr_stinsert(isn, 0, ifs);
 766                 MUTEX_EXIT(&isn->is_lock);
 767                 RWLOCK_EXIT(&ifs->ifs_ipf_state);
 768 
 769         } else {
 770                 READ_ENTER(&ifs->ifs_ipf_state);
 771                 for (is = ifs->ifs_ips_list; is; is = is->is_next)
 772                         if (is->is_rule == fr) {
 773                                 fr_stinsert(isn, 0, ifs);
 774                                 MUTEX_EXIT(&isn->is_lock);
 775                                 break;
 776                         }
 777 
 778                 if (is == NULL) {
 779                         KFREE(isn);
 780                         isn = NULL;
 781                 }
 782                 RWLOCK_EXIT(&ifs->ifs_ipf_state);
 783 
 784                 return (isn == NULL) ? ESRCH : 0;
 785         }
 786 
 787         return 0;
 788 }
 789 
 790 
 791 /* ------------------------------------------------------------------------ */
 792 /* Function:   fr_stinsert                                                  */
 793 /* Returns:    Nil                                                          */
 794 /* Parameters: is(I)  - pointer to state structure                          */
 795 /*             rev(I) - flag indicating forward/reverse direction of packet */
 796 /*                                                                          */
 797 /* Inserts a state structure into the hash table (for lookups) and the list */
 798 /* of state entries (for enumeration).  Resolves all of the interface names */
 799 /* to pointers and adjusts running stats for the hash table as appropriate. */
 800 /*                                                                          */
 801 /* Locking: it is assumed that some kind of lock on ipf_state is held.      */
 802 /*          Exits with is_lock initialised and held.                        */
 803 /* ------------------------------------------------------------------------ */
 804 void fr_stinsert(is, rev, ifs)
 805 ipstate_t *is;
 806 int rev;
 807 ipf_stack_t *ifs;
 808 {
 809         frentry_t *fr;
 810         u_int hv;
 811         int i;
 812 
 813         MUTEX_INIT(&is->is_lock, "ipf state entry");
 814 
 815         fr = is->is_rule;
 816         if (fr != NULL) {
 817                 MUTEX_ENTER(&fr->fr_lock);
 818                 fr->fr_ref++;
 819                 fr->fr_statecnt++;
 820                 MUTEX_EXIT(&fr->fr_lock);
 821         }
 822 
 823         /*
 824          * Look up all the interface names in the state entry.
 825          */
 826         for (i = 0; i < 4; i++) {
 827                 if (is->is_ifp[i] != NULL)
 828                         continue;
 829                 is->is_ifp[i] = fr_resolvenic(is->is_ifname[i], is->is_v, ifs);
 830         }
 831 
 832         /*
 833          * If we could trust is_hv, then the modulous would not be needed, but
 834          * when running with IPFILTER_SYNC, this stops bad values.
 835          */
 836         hv = is->is_hv % ifs->ifs_fr_statesize;
 837         is->is_hv = hv;
 838 
 839         /*
 840          * We need to get both of these locks...the first because it is
 841          * possible that once the insert is complete another packet might
 842          * come along, match the entry and want to update it.
 843          */
 844         MUTEX_ENTER(&is->is_lock);
 845         MUTEX_ENTER(&ifs->ifs_ipf_stinsert);
 846 
 847         /*
 848          * add into list table.
 849          */
 850         if (ifs->ifs_ips_list != NULL)
 851                 ifs->ifs_ips_list->is_pnext = &is->is_next;
 852         is->is_pnext = &ifs->ifs_ips_list;
 853         is->is_next = ifs->ifs_ips_list;
 854         ifs->ifs_ips_list = is;
 855 
 856         if (ifs->ifs_ips_table[hv] != NULL)
 857                 ifs->ifs_ips_table[hv]->is_phnext = &is->is_hnext;
 858         else
 859                 ifs->ifs_ips_stats.iss_inuse++;
 860         is->is_phnext = ifs->ifs_ips_table + hv;
 861         is->is_hnext = ifs->ifs_ips_table[hv];
 862         ifs->ifs_ips_table[hv] = is;
 863         ifs->ifs_ips_stats.iss_bucketlen[hv]++;
 864         ifs->ifs_ips_num++;
 865         MUTEX_EXIT(&ifs->ifs_ipf_stinsert);
 866 
 867         fr_setstatequeue(is, rev, ifs);
 868 }
 869 
 870 /* ------------------------------------------------------------------------ */
 871 /* Function:    fr_match_ipv4addrs                                          */
 872 /* Returns:     int -   2 strong match (same addresses, same direction)     */
 873 /*                      1 weak match (same address, opposite direction)     */
 874 /*                      0 no match                                          */
 875 /*                                                                          */
 876 /* Function matches IPv4 addresses.                                         */
 877 /* ------------------------------------------------------------------------ */
 878 static int fr_match_ipv4addrs(is1, is2)
 879 ipstate_t *is1;
 880 ipstate_t *is2;
 881 {
 882         int     rv;
 883 
 884         if (is1->is_saddr == is2->is_saddr && is1->is_daddr == is2->is_daddr)
 885                 rv = 2;
 886         else if (is1->is_saddr == is2->is_daddr &&
 887             is1->is_daddr == is2->is_saddr)
 888                 rv = 1;
 889         else
 890                 rv = 0;
 891 
 892         return (rv);
 893 }
 894 
 895 /* ------------------------------------------------------------------------ */
 896 /* Function:    fr_match_ipv6addrs                                          */
 897 /* Returns:     int -   2 strong match (same addresses, same direction)     */
 898 /*                      1 weak match (same addresses, opposite direction)   */
 899 /*                      0 no match                                          */
 900 /*                                                                          */
 901 /* Function matches IPv6 addresses.                                         */
 902 /* ------------------------------------------------------------------------ */
 903 static int fr_match_ipv6addrs(is1, is2)
 904 ipstate_t *is1;
 905 ipstate_t *is2;
 906 {
 907         int     rv;
 908 
 909         if (IP6_EQ(&is1->is_src, &is2->is_src) &&
 910             IP6_EQ(&is1->is_dst, &is2->is_dst))
 911                 rv = 2;
 912         else if (IP6_EQ(&is1->is_src, &is2->is_dst) &&
 913             IP6_EQ(&is1->is_dst, &is2->is_src)) {
 914                 rv = 1;
 915         }
 916         else
 917                 rv = 0;
 918 
 919         return (rv);
 920 }
 921 /* ------------------------------------------------------------------------ */
 922 /* Function:    fr_match_addresses                                          */
 923 /* Returns:     int -   2 strong match (same addresses, same direction)     */
 924 /*                      1 weak match (same address, opposite directions)    */
 925 /*                      0 no match                                          */
 926 /* Parameters:  is1, is2 pointers to states we are checking                 */
 927 /*                                                                          */
 928 /* Matches addresses, function uses fr_match_ipvXaddrs() to deal with IPv4  */
 929 /* and IPv6 address format.                                                 */
 930 /* ------------------------------------------------------------------------ */
 931 static int fr_match_addresses(is1, is2)
 932 ipstate_t *is1;
 933 ipstate_t *is2;
 934 {
 935         int     rv;
 936 
 937         if (is1->is_v == 4) {
 938                 rv = fr_match_ipv4addrs(is1, is2);
 939         } else {
 940                 rv = fr_match_ipv6addrs(is1, is2);
 941         }
 942 
 943         return (rv);
 944 }
 945 
 946 /* ------------------------------------------------------------------------ */
 947 /* Function:    fr_match_ppairs                                             */
 948 /* Returns:     int -   2 strong match (same ports, same direction)         */
 949 /*                      1 weak match (same ports, different direction)      */
 950 /*                      0 no match                                          */
 951 /* Parameters   ppairs1, ppairs - src, dst ports we want to match.          */
 952 /*                                                                          */
 953 /* Matches two port_pair_t types (port pairs). Each port pair contains      */
 954 /* src, dst port, which belong to session (state entry).                    */
 955 /* ------------------------------------------------------------------------ */
 956 static int fr_match_ppairs(ppairs1, ppairs2)
 957 port_pair_t *ppairs1;
 958 port_pair_t *ppairs2;
 959 {
 960         int     rv;
 961 
 962         if (ppairs1->pp_sport == ppairs2->pp_sport &&
 963             ppairs1->pp_dport == ppairs2->pp_dport)
 964                 rv = 2;
 965         else if (ppairs1->pp_sport == ppairs2->pp_dport &&
 966                     ppairs1->pp_dport == ppairs2->pp_sport)
 967                 rv = 1;
 968         else
 969                 rv = 0;
 970 
 971         return (rv);
 972 }
 973 
 974 /* ------------------------------------------------------------------------ */
 975 /* Function:    fr_match_l4_hdr                                             */
 976 /* Returns:     int -   0 no match,                                         */
 977 /*                      1 weak match (same ports, different directions)     */
 978 /*                      2 strong match (same ports, same direction)         */
 979 /* Parameters   is1, is2 - states we want to match                          */
 980 /*                                                                          */
 981 /* Function matches L4 header data (source ports for TCP, UDP, CallIds for  */
 982 /* GRE protocol).                                                           */
 983 /* ------------------------------------------------------------------------ */
 984 static int fr_match_l4_hdr(is1, is2)
 985 ipstate_t *is1;
 986 ipstate_t *is2;
 987 {
 988         int     rv = 0;
 989         port_pair_t     pp1;
 990         port_pair_t     pp2;
 991 
 992         if (is1->is_p != is2->is_p)
 993                 return (0);
 994 
 995         switch (is1->is_p) {
 996                 case    IPPROTO_TCP:
 997                         pp1.pp_sport = is1->is_ps.is_ts.ts_sport;
 998                         pp1.pp_dport = is1->is_ps.is_ts.ts_dport;
 999                         pp2.pp_sport = is2->is_ps.is_ts.ts_sport;
1000                         pp2.pp_dport = is2->is_ps.is_ts.ts_dport;
1001                         rv = fr_match_ppairs(&pp1, &pp2);
1002                         break;
1003                 case    IPPROTO_UDP:
1004                         pp1.pp_sport = is1->is_ps.is_us.us_sport;
1005                         pp1.pp_dport = is1->is_ps.is_us.us_dport;
1006                         pp2.pp_sport = is2->is_ps.is_us.us_sport;
1007                         pp2.pp_dport = is2->is_ps.is_us.us_dport;
1008                         rv = fr_match_ppairs(&pp1, &pp2);
1009                         break;
1010                 case    IPPROTO_GRE:
1011                         /* greinfo_t can be also interprted as port pair */
1012                         pp1.pp_sport = is1->is_ps.is_ug.gs_call[0];
1013                         pp1.pp_dport = is1->is_ps.is_ug.gs_call[1];
1014                         pp2.pp_sport = is2->is_ps.is_ug.gs_call[0];
1015                         pp2.pp_dport = is2->is_ps.is_ug.gs_call[1];
1016                         rv = fr_match_ppairs(&pp1, &pp2);
1017                         break;
1018                 case    IPPROTO_ICMP:
1019                 case    IPPROTO_ICMPV6:
1020                         if (bcmp(&is1->is_ps, &is2->is_ps, sizeof (icmpinfo_t)))
1021                                 rv = 1;
1022                         else
1023                                 rv = 0;
1024                         break;
1025                 default:
1026                         rv = 0;
1027         }
1028 
1029         return (rv);
1030 }
1031 
1032 /* ------------------------------------------------------------------------ */
1033 /* Function:    fr_matchstates                                              */
1034 /* Returns:     int - nonzero match, zero no match                          */
1035 /* Parameters   is1, is2 - states we want to match                          */
1036 /*                                                                          */
1037 /* The state entries are equal (identical match) if they belong to the same */
1038 /* session. Any time new state entry is being added the fr_addstate()       */
1039 /* function creates temporal state entry from the data it gets from IP and  */
1040 /* L4 header. The fr_matchstats() must be also aware of packet direction,   */
1041 /* which is also stored within the state entry. We should keep in mind the  */
1042 /* information about packet direction is spread accross L3 (addresses) and  */
1043 /* L4 (ports). There are three possible relationships betwee is1, is2:      */
1044 /*              - no match (match(is1, is2) == 0))                          */
1045 /*              - weak match same addresses (ports), but different          */
1046 /*                      directions (1)  (fr_match_xxxx(is1, is2) == 1)      */
1047 /*              - strong match same addresses (ports) and same directions   */
1048 /*                       (2) (fr_match_xxxx(is1, is2) == 2)                 */
1049 /*                                                                          */
1050 /* There are functions, which match match addresses (L3 header) in is1, is2 */
1051 /* and functions, which are used to compare ports (L4 header) data. We say  */
1052 /* the is1 and is2 are same (identical) if there is a match                 */
1053 /* (fr_match_l4_hdr(is1, is2) != 0) and matchlevels are same for entries    */
1054 /* (fr_match_l3_hdr(is1, is2) == fr_match_l4_hdr(is1, is2)) for is1, is2.   */
1055 /* Such requirement deals with case as follows:                             */
1056 /*      suppose there are two connections between hosts A, B. Connection 1: */
1057 /*                      a.a.a.a:12345 <=> b.b.b.b:54321                       */
1058 /*              Connection 2:                                               */
1059 /*                      a.a.a.a:54321 <=> b.b.b.b:12345                       */
1060 /* since we've introduced match levels into our fr_matchstates(), we are    */
1061 /* able to identify, which packets belong to connection A and which belong  */
1062 /* to connection B.     Assume there are two entries is1, is2. is1 has been */
1063 /* from con. 1 packet, which travelled from A to B:                         */
1064 /*                      a.a.a.a:12345 -> b.b.b.b:54321                           */
1065 /* while s2, has been created from packet which belongs to con. 2 and is    */
1066 /* also coming from A to B:                                                 */
1067 /*                      a.a.a.a:54321 -> b.b.b.b:12345                           */
1068 /* fr_match_l3_hdr(is1, is2) == 2 -> strong match, while                 */
1069 /* fr_match_l4_hdr(is1, is2) == 1 -> weak match. Since match levels are          */
1070 /* different the state entries are not identical -> no match as a final          */
1071 /* result.                                                                  */
1072 /* ------------------------------------------------------------------------ */
1073 static int fr_matchstates(is1, is2)
1074 ipstate_t *is1;
1075 ipstate_t *is2;
1076 {
1077         int     rv;
1078         int     amatch;
1079         int     pmatch;
1080 
1081         if (bcmp(&is1->is_pass, &is2->is_pass,
1082                 offsetof(struct ipstate, is_ps) -
1083                 offsetof(struct ipstate, is_pass)) == 0) {
1084 
1085                 pmatch = fr_match_l4_hdr(is1, is2);
1086                 amatch = fr_match_addresses(is1, is2);
1087                 /*
1088                  * If addresses match (amatch != 0), then 'match levels'
1089                  * must be same for matching entries. If amatch and pmatch
1090                  * have different values (different match levels), then
1091                  * is1 and is2 belong to different sessions.
1092                  */
1093                 rv = (amatch != 0) && (amatch == pmatch);
1094         }
1095         else
1096                 rv = 0;
1097 
1098         return (rv);
1099 }
1100 
1101 /* ------------------------------------------------------------------------ */
1102 /* Function:    fr_addstate                                                 */
1103 /* Returns:     ipstate_t* - NULL == failure, else pointer to new state     */
1104 /* Parameters:  fin(I)    - pointer to packet information                   */
1105 /*              stsave(O) - pointer to place to save pointer to created     */
1106 /*                          state structure.                                */
1107 /*              flags(I)  - flags to use when creating the structure        */
1108 /*                                                                          */
1109 /* Creates a new IP state structure from the packet information collected.  */
1110 /* Inserts it into the state table and appends to the bottom of the active  */
1111 /* list.  If the capacity of the table has reached the maximum allowed then */
1112 /* the call will fail and a flush is scheduled for the next timeout call.   */
1113 /* ------------------------------------------------------------------------ */
1114 ipstate_t *fr_addstate(fin, stsave, flags)
1115 fr_info_t *fin;
1116 ipstate_t **stsave;
1117 u_int flags;
1118 {
1119         ipstate_t *is, ips;
1120         struct icmp *ic;
1121         u_int pass, hv;
1122         frentry_t *fr;
1123         tcphdr_t *tcp;
1124         grehdr_t *gre;
1125         void *ifp;
1126         int out;
1127         ipf_stack_t *ifs = fin->fin_ifs;
1128 
1129         if (ifs->ifs_fr_state_lock ||
1130             (fin->fin_flx & (FI_SHORT|FI_STATE|FI_FRAGBODY|FI_BAD)))
1131                 return NULL;
1132 
1133         if ((fin->fin_flx & FI_OOW) && !(fin->fin_tcpf & TH_SYN))
1134                 return NULL;
1135 
1136         /*
1137          * Trigger automatic call to fr_state_flush() if the
1138          * table has reached capacity specified by hi watermark.
1139          */
1140         if (ST_TAB_WATER_LEVEL(ifs) > ifs->ifs_state_flush_level_hi)
1141                 ifs->ifs_fr_state_doflush = 1;
1142 
1143         /*
1144          * If the max number of state entries has been reached, and there is no
1145          * limit on the state count for the rule, then do not continue.  In the
1146          * case where a limit exists, it's ok allow the entries to be created as
1147          * long as specified limit itself has not been reached. 
1148          *
1149          * Note that because the lock isn't held on fr, it is possible to exceed
1150          * the specified size of the table.  However, the cost of this is being
1151          * ignored here; as the number by which it can go over is a product of
1152          * the number of simultaneous threads that could be executing in here.
1153          * So, a limit of 100 won't result in 200, but could result in 101 or 102.
1154          *
1155          * Also note that, since the automatic flush should have been triggered
1156          * well before we reach the maximum number of state table entries, the
1157          * likelihood of reaching the max (and thus exceedng it) is minimal.
1158          */ 
1159         fr = fin->fin_fr;
1160         if (fr != NULL) {
1161                 if ((ifs->ifs_ips_num >= ifs->ifs_fr_statemax) &&
1162                     (fr->fr_statemax == 0)) {
1163                         ATOMIC_INCL(ifs->ifs_ips_stats.iss_max);
1164                         return NULL;
1165                 }
1166                 if ((fr->fr_statemax != 0) &&
1167                     (fr->fr_statecnt >= fr->fr_statemax)) {
1168                         ATOMIC_INCL(ifs->ifs_ips_stats.iss_maxref);
1169                         ifs->ifs_fr_state_doflush = 1;
1170                         return NULL;
1171                 }
1172         }
1173 
1174         ic = NULL;
1175         tcp = NULL;
1176         out = fin->fin_out;
1177         is = &ips;
1178         bzero((char *)is, sizeof(*is));
1179 
1180         if (fr == NULL) {
1181                 pass = ifs->ifs_fr_flags;
1182                 is->is_tag = FR_NOLOGTAG;
1183         } else {
1184                 pass = fr->fr_flags;
1185         }
1186 
1187         is->is_die = 1 + ifs->ifs_fr_ticks;
1188         /*
1189          * We want to check everything that is a property of this packet,
1190          * but we don't (automatically) care about it's fragment status as
1191          * this may change.
1192          */
1193         is->is_pass = pass;
1194         is->is_v = fin->fin_v;
1195         is->is_opt[0] = fin->fin_optmsk;
1196         is->is_optmsk[0] = 0xffffffff;
1197         /*
1198          * The reverse direction option mask will be set in fr_matchsrcdst(),
1199          * when we will see the first packet from the peer. We will leave it
1200          * as zero for now.
1201          */
1202         is->is_optmsk[1] = 0x0;
1203 
1204         if (is->is_v == 6) {
1205                 is->is_opt[0] &= ~0x8;
1206                 is->is_optmsk[0] &= ~0x8;
1207         }
1208         is->is_sec = fin->fin_secmsk;
1209         is->is_secmsk = 0xffff;
1210         is->is_auth = fin->fin_auth;
1211         is->is_authmsk = 0xffff;
1212 
1213         /*
1214          * Copy and calculate...
1215          */
1216         hv = (is->is_p = fin->fin_fi.fi_p);
1217         is->is_src = fin->fin_fi.fi_src;
1218         hv += is->is_saddr;
1219         is->is_dst = fin->fin_fi.fi_dst;
1220         hv += is->is_daddr;
1221 #ifdef  USE_INET6
1222         if (fin->fin_v == 6) {
1223                 /*
1224                  * For ICMPv6, we check to see if the destination address is
1225                  * a multicast address.  If it is, do not include it in the
1226                  * calculation of the hash because the correct reply will come
1227                  * back from a real address, not a multicast address.
1228                  */
1229                 if ((is->is_p == IPPROTO_ICMPV6) &&
1230                     IN6_IS_ADDR_MULTICAST(&is->is_dst.in6)) {
1231                         /*
1232                          * So you can do keep state with neighbour discovery.
1233                          *
1234                          * Here we could use the address from the neighbour
1235                          * solicit message to put in the state structure and
1236                          * we could use that without a wildcard flag too...
1237                          */
1238                         is->is_flags |= SI_W_DADDR;
1239                         hv -= is->is_daddr;
1240                 } else {
1241                         hv += is->is_dst.i6[1];
1242                         hv += is->is_dst.i6[2];
1243                         hv += is->is_dst.i6[3];
1244                 }
1245                 hv += is->is_src.i6[1];
1246                 hv += is->is_src.i6[2];
1247                 hv += is->is_src.i6[3];
1248         }
1249 #endif
1250         if ((fin->fin_v == 4) &&
1251             (fin->fin_flx & (FI_MULTICAST|FI_BROADCAST|FI_MBCAST))) {
1252                 if (fin->fin_out == 0) {
1253                         flags |= SI_W_DADDR|SI_CLONE;
1254                         hv -= is->is_daddr;
1255                 } else {
1256                         flags |= SI_W_SADDR|SI_CLONE;
1257                         hv -= is->is_saddr;
1258                 }
1259         }
1260 
1261         switch (is->is_p)
1262         {
1263 #ifdef  USE_INET6
1264         case IPPROTO_ICMPV6 :
1265                 ic = fin->fin_dp;
1266 
1267                 switch (ic->icmp_type)
1268                 {
1269                 case ICMP6_ECHO_REQUEST :
1270                         is->is_icmp.ici_type = ic->icmp_type;
1271                         hv += (is->is_icmp.ici_id = ic->icmp_id);
1272                         break;
1273                 case ICMP6_MEMBERSHIP_QUERY :
1274                 case ND_ROUTER_SOLICIT :
1275                 case ND_NEIGHBOR_SOLICIT :
1276                 case ICMP6_NI_QUERY :
1277                         is->is_icmp.ici_type = ic->icmp_type;
1278                         break;
1279                 default :
1280                         return NULL;
1281                 }
1282                 ATOMIC_INCL(ifs->ifs_ips_stats.iss_icmp);
1283                 break;
1284 #endif
1285         case IPPROTO_ICMP :
1286                 ic = fin->fin_dp;
1287 
1288                 switch (ic->icmp_type)
1289                 {
1290                 case ICMP_ECHO :
1291                 case ICMP_ECHOREPLY :
1292                 case ICMP_TSTAMP :
1293                 case ICMP_IREQ :
1294                 case ICMP_MASKREQ :
1295                         is->is_icmp.ici_type = ic->icmp_type;
1296                         hv += (is->is_icmp.ici_id = ic->icmp_id);
1297                         break;
1298                 default :
1299                         return NULL;
1300                 }
1301                 ATOMIC_INCL(ifs->ifs_ips_stats.iss_icmp);
1302                 break;
1303 
1304         case IPPROTO_GRE :
1305                 gre = fin->fin_dp;
1306 
1307                 is->is_gre.gs_flags = gre->gr_flags;
1308                 is->is_gre.gs_ptype = gre->gr_ptype;
1309                 if (GRE_REV(is->is_gre.gs_flags) == 1) {
1310                         is->is_call[0] = fin->fin_data[0];
1311                         is->is_call[1] = fin->fin_data[1];
1312                 }
1313                 break;
1314 
1315         case IPPROTO_TCP :
1316                 tcp = fin->fin_dp;
1317 
1318                 if (tcp->th_flags & TH_RST)
1319                         return NULL;
1320                 /*
1321                  * The endian of the ports doesn't matter, but the ack and
1322                  * sequence numbers do as we do mathematics on them later.
1323                  */
1324                 is->is_sport = htons(fin->fin_data[0]);
1325                 is->is_dport = htons(fin->fin_data[1]);
1326                 if ((flags & (SI_W_DPORT|SI_W_SPORT)) == 0) {
1327                         hv += is->is_sport;
1328                         hv += is->is_dport;
1329                 }
1330 
1331                 /*
1332                  * If this is a real packet then initialise fields in the
1333                  * state information structure from the TCP header information.
1334                  */
1335 
1336                 is->is_maxdwin = 1;
1337                 is->is_maxswin = ntohs(tcp->th_win);
1338                 if (is->is_maxswin == 0)
1339                         is->is_maxswin = 1;
1340 
1341                 if ((fin->fin_flx & FI_IGNORE) == 0) {
1342                         is->is_send = ntohl(tcp->th_seq) + fin->fin_dlen -
1343                                       (TCP_OFF(tcp) << 2) +
1344                                       ((tcp->th_flags & TH_SYN) ? 1 : 0) +
1345                                       ((tcp->th_flags & TH_FIN) ? 1 : 0);
1346                         is->is_maxsend = is->is_send;
1347 
1348                         /*
1349                          * Window scale option is only present in
1350                          * SYN/SYN-ACK packet.
1351                          */
1352                         if ((tcp->th_flags & ~(TH_FIN|TH_ACK|TH_ECNALL)) ==
1353                             TH_SYN &&
1354                             (TCP_OFF(tcp) > (sizeof(tcphdr_t) >> 2))) {
1355                                 if (fr_tcpoptions(fin, tcp,
1356                                         &is->is_tcp.ts_data[0]) == -1) {
1357                                         fin->fin_flx |= FI_BAD;
1358                                 }
1359                         }
1360 
1361                         if ((fin->fin_out != 0) && (pass & FR_NEWISN) != 0) {
1362                                 fr_checknewisn(fin, is);
1363                                 fr_fixoutisn(fin, is);
1364                         }
1365 
1366                         if ((tcp->th_flags & TH_OPENING) == TH_SYN)
1367                                 flags |= IS_TCPFSM;
1368                         else {
1369                                 is->is_maxdwin = is->is_maxswin * 2;
1370                                 is->is_dend = ntohl(tcp->th_ack);
1371                                 is->is_maxdend = ntohl(tcp->th_ack);
1372                                 is->is_maxdwin *= 2;
1373                         }
1374                 }
1375 
1376                 /*
1377                  * If we're creating state for a starting connection, start the
1378                  * timer on it as we'll never see an error if it fails to
1379                  * connect.
1380                  */
1381                 ATOMIC_INCL(ifs->ifs_ips_stats.iss_tcp);
1382                 break;
1383 
1384         case IPPROTO_UDP :
1385                 tcp = fin->fin_dp;
1386 
1387                 is->is_sport = htons(fin->fin_data[0]);
1388                 is->is_dport = htons(fin->fin_data[1]);
1389                 if ((flags & (SI_W_DPORT|SI_W_SPORT)) == 0) {
1390                         hv += tcp->th_dport;
1391                         hv += tcp->th_sport;
1392                 }
1393                 ATOMIC_INCL(ifs->ifs_ips_stats.iss_udp);
1394                 break;
1395 
1396         default :
1397                 break;
1398         }
1399         hv = DOUBLE_HASH(hv, ifs);
1400         is->is_hv = hv;
1401         is->is_rule = fr;
1402         is->is_flags = flags & IS_INHERITED;
1403 
1404         /*
1405          * Look for identical state.
1406          */
1407         for (is = ifs->ifs_ips_table[is->is_hv % ifs->ifs_fr_statesize];
1408              is != NULL;
1409              is = is->is_hnext) {
1410                 if (fr_matchstates(&ips, is) == 1)
1411                         break;
1412         }
1413 
1414         /*
1415          * we've found a matching state -> state already exists,
1416          * we are not going to add a duplicate record.
1417          */
1418         if (is != NULL)
1419                 return NULL;
1420 
1421         if (ifs->ifs_ips_stats.iss_bucketlen[hv] >= ifs->ifs_fr_state_maxbucket) {
1422                 ATOMIC_INCL(ifs->ifs_ips_stats.iss_bucketfull);
1423                 return NULL;
1424         }
1425         KMALLOC(is, ipstate_t *);
1426         if (is == NULL) {
1427                 ATOMIC_INCL(ifs->ifs_ips_stats.iss_nomem);
1428                 return NULL;
1429         }
1430         bcopy((char *)&ips, (char *)is, sizeof(*is));
1431         /*
1432          * Do not do the modulous here, it is done in fr_stinsert().
1433          */
1434         if (fr != NULL) {
1435                 (void) strncpy(is->is_group, fr->fr_group, FR_GROUPLEN);
1436                 if (fr->fr_age[0] != 0) {
1437                         is->is_tqehead[0] = 
1438                             fr_addtimeoutqueue(&ifs->ifs_ips_utqe,
1439                                                fr->fr_age[0], ifs);
1440                         is->is_sti.tqe_flags |= TQE_RULEBASED;
1441                 }
1442                 if (fr->fr_age[1] != 0) {
1443                         is->is_tqehead[1] = 
1444                             fr_addtimeoutqueue(&ifs->ifs_ips_utqe,
1445                                                fr->fr_age[1], ifs);
1446                         is->is_sti.tqe_flags |= TQE_RULEBASED;
1447                 }
1448                 is->is_tag = fr->fr_logtag;
1449                 memcpy(is->is_uuid, fr->fr_uuid, sizeof (uuid_t));
1450 
1451                 is->is_ifp[(out << 1) + 1] = fr->fr_ifas[1];
1452                 is->is_ifp[(1 - out) << 1] = fr->fr_ifas[2];
1453                 is->is_ifp[((1 - out) << 1) + 1] = fr->fr_ifas[3];
1454 
1455                 if (((ifp = fr->fr_ifas[1]) != NULL) &&
1456                     (ifp != (void *)-1)) {
1457                         COPYIFNAME(ifp, is->is_ifname[(out << 1) + 1], fr->fr_v);
1458                 }
1459                 if (((ifp = fr->fr_ifas[2]) != NULL) &&
1460                     (ifp != (void *)-1)) {
1461                         COPYIFNAME(ifp, is->is_ifname[(1 - out) << 1], fr->fr_v);
1462                 }
1463                 if (((ifp = fr->fr_ifas[3]) != NULL) &&
1464                     (ifp != (void *)-1)) {
1465                         COPYIFNAME(ifp, is->is_ifname[((1 - out) << 1) + 1], fr->fr_v);
1466                 }
1467         }
1468 
1469         is->is_ifp[out << 1] = fin->fin_ifp;
1470         if (fin->fin_ifp != NULL) {
1471                 COPYIFNAME(fin->fin_ifp, is->is_ifname[out << 1], fin->fin_v);
1472         }
1473 
1474         is->is_ref = 1;
1475         is->is_pkts[0] = 0, is->is_bytes[0] = 0;
1476         is->is_pkts[1] = 0, is->is_bytes[1] = 0;
1477         is->is_pkts[2] = 0, is->is_bytes[2] = 0;
1478         is->is_pkts[3] = 0, is->is_bytes[3] = 0;
1479         if ((fin->fin_flx & FI_IGNORE) == 0) {
1480                 is->is_pkts[out] = 1;
1481                 is->is_bytes[out] = fin->fin_plen;
1482                 is->is_flx[out][0] = fin->fin_flx & FI_CMP;
1483                 is->is_flx[out][0] &= ~FI_OOW;
1484         }
1485 
1486         if (pass & FR_STSTRICT)
1487                 is->is_flags |= IS_STRICT;
1488 
1489         if (pass & FR_STATESYNC)
1490                 is->is_flags |= IS_STATESYNC;
1491 
1492         if (flags & (SI_WILDP|SI_WILDA)) {
1493                 ATOMIC_INCL(ifs->ifs_ips_stats.iss_wild);
1494         }
1495         is->is_rulen = fin->fin_rule;
1496 
1497 
1498         if (pass & FR_LOGFIRST)
1499                 is->is_pass &= ~(FR_LOGFIRST|FR_LOG);
1500 
1501         READ_ENTER(&ifs->ifs_ipf_state);
1502         is->is_me = stsave;
1503 
1504         fr_stinsert(is, fin->fin_rev, ifs);
1505 
1506         if (fin->fin_p == IPPROTO_TCP) {
1507                 /*
1508                 * If we're creating state for a starting connection, start the
1509                 * timer on it as we'll never see an error if it fails to
1510                 * connect.
1511                 */
1512                 (void) fr_tcp_age(&is->is_sti, fin, ifs->ifs_ips_tqtqb,
1513                                   is->is_flags);
1514                 MUTEX_EXIT(&is->is_lock);
1515 #ifdef  IPFILTER_SCAN
1516                 if ((is->is_flags & SI_CLONE) == 0)
1517                         (void) ipsc_attachis(is);
1518 #endif
1519         } else {
1520                 MUTEX_EXIT(&is->is_lock);
1521         }
1522 #ifdef  IPFILTER_SYNC
1523         if ((is->is_flags & IS_STATESYNC) && ((is->is_flags & SI_CLONE) == 0))
1524                 is->is_sync = ipfsync_new(SMC_STATE, fin, is);
1525 #endif
1526         if (ifs->ifs_ipstate_logging)
1527                 ipstate_log(is, ISL_NEW, ifs);
1528 
1529         if (IFS_CFWLOG(ifs, is->is_rule))
1530                 ipf_log_cfwlog(is, ISL_NEW, ifs);
1531 
1532         RWLOCK_EXIT(&ifs->ifs_ipf_state);
1533         fin->fin_rev = IP6_NEQ(&is->is_dst, &fin->fin_daddr);
1534         fin->fin_flx |= FI_STATE;
1535         if (fin->fin_flx & FI_FRAG)
1536                 (void) fr_newfrag(fin, pass ^ FR_KEEPSTATE);
1537 
1538         return is;
1539 }
1540 
1541 
1542 /* ------------------------------------------------------------------------ */
1543 /* Function:    fr_tcpoptions                                               */
1544 /* Returns:     int - 1 == packet matches state entry, 0 == it does not     */
1545 /* Parameters:  fin(I) - pointer to packet information                      */
1546 /*              tcp(I) - pointer to TCP packet header                       */
1547 /*              td(I)  - pointer to TCP data held as part of the state      */
1548 /*                                                                          */
1549 /* Look after the TCP header for any options and deal with those that are   */
1550 /* present.  Record details about those that we recogise.                   */
1551 /* ------------------------------------------------------------------------ */
1552 static int fr_tcpoptions(fin, tcp, td)
1553 fr_info_t *fin;
1554 tcphdr_t *tcp;
1555 tcpdata_t *td;
1556 {
1557         int off, mlen, ol, i, len, retval;
1558         char buf[64], *s, opt;
1559         mb_t *m = NULL;
1560 
1561         len = (TCP_OFF(tcp) << 2);
1562         if (fin->fin_dlen < len)
1563                 return 0;
1564         len -= sizeof(*tcp);
1565 
1566         off = fin->fin_plen - fin->fin_dlen + sizeof(*tcp) + fin->fin_ipoff;
1567 
1568         m = fin->fin_m;
1569         mlen = MSGDSIZE(m) - off;
1570         if (len > mlen) {
1571                 len = mlen;
1572                 retval = 0;
1573         } else {
1574                 retval = 1;
1575         }
1576 
1577         COPYDATA(m, off, len, buf);
1578 
1579         for (s = buf; len > 0; ) {
1580                 opt = *s;
1581                 if (opt == TCPOPT_EOL)
1582                         break;
1583                 else if (opt == TCPOPT_NOP)
1584                         ol = 1;
1585                 else {
1586                         if (len < 2)
1587                                 break;
1588                         ol = (int)*(s + 1);
1589                         if (ol < 2 || ol > len)
1590                                 break;
1591 
1592                         /*
1593                          * Extract the TCP options we are interested in out of
1594                          * the header and store them in the the tcpdata struct.
1595                          */
1596                         switch (opt)
1597                         {
1598                         case TCPOPT_WINDOW :
1599                                 if (ol == TCPOLEN_WINDOW) {
1600                                         i = (int)*(s + 2);
1601                                         if (i > TCP_WSCALE_MAX)
1602                                                 i = TCP_WSCALE_MAX;
1603                                         else if (i < 0)
1604                                                 i = 0;
1605                                         td->td_winscale = i;
1606                                         td->td_winflags |= TCP_WSCALE_SEEN |
1607                                                             TCP_WSCALE_FIRST;
1608                                 } else
1609                                         retval = -1;
1610                                 break;
1611                         case TCPOPT_MAXSEG :
1612                                 /*
1613                                  * So, if we wanted to set the TCP MAXSEG,
1614                                  * it should be done here...
1615                                  */
1616                                 if (ol == TCPOLEN_MAXSEG) {
1617                                         i = (int)*(s + 2);
1618                                         i <<= 8;
1619                                         i += (int)*(s + 3);
1620                                         td->td_maxseg = i;
1621                                 } else
1622                                         retval = -1;
1623                                 break;
1624                         case TCPOPT_SACK_PERMITTED :
1625                                 if (ol == TCPOLEN_SACK_PERMITTED)
1626                                         td->td_winflags |= TCP_SACK_PERMIT;
1627                                 else
1628                                         retval = -1;
1629                                 break;
1630                         }
1631                 }
1632                 len -= ol;
1633                 s += ol;
1634         }
1635         return retval;
1636 }
1637 
1638 
1639 /* ------------------------------------------------------------------------ */
1640 /* Function:    fr_tcpstate                                                 */
1641 /* Returns:     int - 1 == packet matches state entry, 0 == it does not     */
1642 /* Parameters:  fin(I)   - pointer to packet information                    */
1643 /*              tcp(I)   - pointer to TCP packet header                     */
1644 /*              is(I)  - pointer to master state structure                  */
1645 /*                                                                          */
1646 /* Check to see if a packet with TCP headers fits within the TCP window.    */
1647 /* Change timeout depending on whether new packet is a SYN-ACK returning    */
1648 /* for a SYN or a RST or FIN which indicate time to close up shop.          */
1649 /* ------------------------------------------------------------------------ */
1650 static int fr_tcpstate(fin, tcp, is)
1651 fr_info_t *fin;
1652 tcphdr_t *tcp;
1653 ipstate_t *is;
1654 {
1655         int source, ret = 0, flags;
1656         tcpdata_t  *fdata, *tdata;
1657         ipf_stack_t *ifs = fin->fin_ifs;
1658 
1659         source = !fin->fin_rev;
1660         if (((is->is_flags & IS_TCPFSM) != 0) && (source == 1) && 
1661             (ntohs(is->is_sport) != fin->fin_data[0]))
1662                 source = 0;
1663         fdata = &is->is_tcp.ts_data[!source];
1664         tdata = &is->is_tcp.ts_data[source];
1665 
1666         MUTEX_ENTER(&is->is_lock);
1667 
1668         /*
1669          * If a SYN packet is received for a connection that is in a half
1670          * closed state, then move its state entry to deletetq. In such case
1671          * the SYN packet will be consequently dropped. This allows new state
1672          * entry to be created with a retransmited SYN packet.
1673          */
1674         if ((tcp->th_flags & TH_OPENING) == TH_SYN) {
1675                 if ((is->is_state[source] > IPF_TCPS_ESTABLISHED) &&
1676                     (is->is_state[!source] > IPF_TCPS_ESTABLISHED)) {
1677                         is->is_state[source] = IPF_TCPS_CLOSED;
1678                         is->is_state[!source] = IPF_TCPS_CLOSED;
1679                         /*
1680                          * Do not update is->is_sti.tqe_die in case state entry
1681                          * is already present in deletetq. It prevents state
1682                          * entry ttl update by retransmitted SYN packets, which
1683                          * may arrive before timer tick kicks off. The SYN
1684                          * packet will be dropped again.
1685                          */
1686                         if (is->is_sti.tqe_ifq != &ifs->ifs_ips_deletetq)
1687                                 fr_movequeue(&is->is_sti, is->is_sti.tqe_ifq,
1688                                         &fin->fin_ifs->ifs_ips_deletetq,
1689                                         fin->fin_ifs);
1690 
1691                         MUTEX_EXIT(&is->is_lock);
1692                         return 0;
1693                 }
1694         }
1695 
1696         if (fr_tcpinwindow(fin, fdata, tdata, tcp, is->is_flags)) {
1697 #ifdef  IPFILTER_SCAN
1698                 if (is->is_flags & (IS_SC_CLIENT|IS_SC_SERVER)) {
1699                         ipsc_packet(fin, is);
1700                         if (FR_ISBLOCK(is->is_pass)) {
1701                                 MUTEX_EXIT(&is->is_lock);
1702                                 return 1;
1703                         }
1704                 }
1705 #endif
1706 
1707                 /*
1708                  * Nearing end of connection, start timeout.
1709                  */
1710                 ret = fr_tcp_age(&is->is_sti, fin, ifs->ifs_ips_tqtqb,
1711                                  is->is_flags);
1712                 if (ret == 0) {
1713                         MUTEX_EXIT(&is->is_lock);
1714                         return 0;
1715                 }
1716 
1717                 /*
1718                  * set s0's as appropriate.  Use syn-ack packet as it
1719                  * contains both pieces of required information.
1720                  */
1721                 /*
1722                  * Window scale option is only present in SYN/SYN-ACK packet.
1723                  * Compare with ~TH_FIN to mask out T/TCP setups.
1724                  */
1725                 flags = tcp->th_flags & ~(TH_FIN|TH_ECNALL);
1726                 if (flags == (TH_SYN|TH_ACK)) {
1727                         is->is_s0[source] = ntohl(tcp->th_ack);
1728                         is->is_s0[!source] = ntohl(tcp->th_seq) + 1;
1729                         if (TCP_OFF(tcp) > (sizeof (tcphdr_t) >> 2)) {
1730                                 (void) fr_tcpoptions(fin, tcp, fdata);
1731                         }
1732                         if ((fin->fin_out != 0) && (is->is_pass & FR_NEWISN))
1733                                 fr_checknewisn(fin, is);
1734                 } else if (flags == TH_SYN) {
1735                         is->is_s0[source] = ntohl(tcp->th_seq) + 1;
1736                         if ((TCP_OFF(tcp) > (sizeof(tcphdr_t) >> 2)))
1737                                 (void) fr_tcpoptions(fin, tcp, fdata);
1738 
1739                         if ((fin->fin_out != 0) && (is->is_pass & FR_NEWISN))
1740                                 fr_checknewisn(fin, is);
1741 
1742                 }
1743                 ret = 1;
1744         } else
1745                 fin->fin_flx |= FI_OOW;
1746         MUTEX_EXIT(&is->is_lock);
1747         return ret;
1748 }
1749 
1750 
1751 /* ------------------------------------------------------------------------ */
1752 /* Function:    fr_checknewisn                                              */
1753 /* Returns:     Nil                                                         */
1754 /* Parameters:  fin(I)   - pointer to packet information                    */
1755 /*              is(I)  - pointer to master state structure                  */
1756 /*                                                                          */
1757 /* Check to see if this TCP connection is expecting and needs a new         */
1758 /* sequence number for a particular direction of the connection.            */
1759 /*                                                                          */
1760 /* NOTE: This does not actually change the sequence numbers, only gets new  */
1761 /* one ready.                                                               */
1762 /* ------------------------------------------------------------------------ */
1763 static void fr_checknewisn(fin, is)
1764 fr_info_t *fin;
1765 ipstate_t *is;
1766 {
1767         u_32_t sumd, old, new;
1768         tcphdr_t *tcp;
1769         int i;
1770 
1771         i = fin->fin_rev;
1772         tcp = fin->fin_dp;
1773 
1774         if (((i == 0) && !(is->is_flags & IS_ISNSYN)) ||
1775             ((i == 1) && !(is->is_flags & IS_ISNACK))) {
1776                 old = ntohl(tcp->th_seq);
1777                 new = fr_newisn(fin);
1778                 is->is_isninc[i] = new - old;
1779                 CALC_SUMD(old, new, sumd);
1780                 is->is_sumd[i] = (sumd & 0xffff) + (sumd >> 16);
1781 
1782                 is->is_flags |= ((i == 0) ? IS_ISNSYN : IS_ISNACK);
1783         }
1784 }
1785 
1786 
1787 /* ------------------------------------------------------------------------ */
1788 /* Function:    fr_tcpinwindow                                              */
1789 /* Returns:     int - 1 == packet inside TCP "window", 0 == not inside.     */
1790 /* Parameters:  fin(I)   - pointer to packet information                    */
1791 /*              fdata(I) - pointer to tcp state informatio (forward)        */
1792 /*              tdata(I) - pointer to tcp state informatio (reverse)        */
1793 /*              tcp(I)   - pointer to TCP packet header                     */
1794 /*                                                                          */
1795 /* Given a packet has matched addresses and ports, check to see if it is    */
1796 /* within the TCP data window.  In a show of generosity, allow packets that */
1797 /* are within the window space behind the current sequence # as well.       */
1798 /* ------------------------------------------------------------------------ */
1799 int fr_tcpinwindow(fin, fdata, tdata, tcp, flags)
1800 fr_info_t *fin;
1801 tcpdata_t  *fdata, *tdata;
1802 tcphdr_t *tcp;
1803 int flags;
1804 {
1805         tcp_seq seq, ack, end;
1806         int ackskew, tcpflags;
1807         u_32_t win, maxwin;
1808         int dsize, inseq;
1809 
1810         /*
1811          * Find difference between last checked packet and this packet.
1812          */
1813         tcpflags = tcp->th_flags;
1814         seq = ntohl(tcp->th_seq);
1815         ack = ntohl(tcp->th_ack);
1816 
1817         if (tcpflags & TH_SYN)
1818                 win = ntohs(tcp->th_win);
1819         else
1820                 win = ntohs(tcp->th_win) << fdata->td_winscale;
1821 
1822         /*
1823          * win 0 means the receiving endpoint has closed the window, because it
1824          * has not enough memory to receive data from sender. In such case we
1825          * are pretending window size to be 1 to let TCP probe data through.
1826          * TCP probe data can be either 0 or 1 octet of data, the RFC does not
1827          * state this accurately, so we have to allow 1 octet (win = 1) even if
1828          * the window is closed (win == 0).
1829          */
1830         if (win == 0)
1831                 win = 1;
1832 
1833         dsize = fin->fin_dlen - (TCP_OFF(tcp) << 2) +
1834                 ((tcpflags & TH_SYN) ? 1 : 0) + ((tcpflags & TH_FIN) ? 1 : 0);
1835 
1836         /*
1837          * if window scaling is present, the scaling is only allowed
1838          * for windows not in the first SYN packet. In that packet the
1839          * window is 65535 to specify the largest window possible
1840          * for receivers not implementing the window scale option.
1841          * Currently, we do not assume TTCP here. That means that
1842          * if we see a second packet from a host (after the initial
1843          * SYN), we can assume that the receiver of the SYN did
1844          * already send back the SYN/ACK (and thus that we know if
1845          * the receiver also does window scaling)
1846          */
1847         if (!(tcpflags & TH_SYN) && (fdata->td_winflags & TCP_WSCALE_FIRST)) {
1848                 fdata->td_winflags &= ~TCP_WSCALE_FIRST;
1849                 fdata->td_maxwin = win;
1850         }
1851 
1852         end = seq + dsize;
1853 
1854         if ((fdata->td_end == 0) &&
1855             (!(flags & IS_TCPFSM) ||
1856              ((tcpflags & TH_OPENING) == TH_OPENING))) {
1857                 /*
1858                  * Must be a (outgoing) SYN-ACK in reply to a SYN.
1859                  */
1860                 fdata->td_end = end - 1;
1861                 fdata->td_maxwin = 1;
1862                 fdata->td_maxend = end + win;
1863         }
1864 
1865         if (!(tcpflags & TH_ACK)) {  /* Pretend an ack was sent */
1866                 ack = tdata->td_end;
1867         } else if (((tcpflags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) &&
1868                    (ack == 0)) {
1869                 /* gross hack to get around certain broken tcp stacks */
1870                 ack = tdata->td_end;
1871         }
1872 
1873         maxwin = tdata->td_maxwin;
1874         ackskew = tdata->td_end - ack;
1875 
1876         /*
1877          * Strict sequencing only allows in-order delivery.
1878          */
1879         if ((flags & IS_STRICT) != 0) {
1880                 if (seq != fdata->td_end) {
1881                         DTRACE_PROBE(strict_check);
1882                         return 0;
1883                 }
1884         }
1885 
1886 #define SEQ_GE(a,b)     ((int)((a) - (b)) >= 0)
1887 #define SEQ_GT(a,b)     ((int)((a) - (b)) > 0)
1888         inseq = 0;
1889         DTRACE_PROBE4(
1890                 dyn_params,
1891                 int, dsize,
1892                 int, ackskew,
1893                 int, maxwin,
1894                 int, win
1895         );
1896         if (
1897 #if defined(_KERNEL)
1898                 /* 
1899                  * end <-> s + n
1900                  * maxend <-> ack + win
1901                  * this is upperbound check
1902                  */
1903             (SEQ_GE(fdata->td_maxend, end)) &&
1904                 /*
1905                  * this is lowerbound check
1906                  */
1907             (SEQ_GE(seq, fdata->td_end - maxwin)) &&
1908 #endif
1909 /* XXX what about big packets */
1910 #define MAXACKWINDOW 66000
1911             (-ackskew <= (MAXACKWINDOW)) &&
1912             ( ackskew <= (MAXACKWINDOW << fdata->td_winscale))) {
1913                 inseq = 1;
1914         /*
1915          * Microsoft Windows will send the next packet to the right of the
1916          * window if SACK is in use.
1917          */
1918         } else if ((seq == fdata->td_maxend) && (ackskew == 0) &&
1919             (fdata->td_winflags & TCP_SACK_PERMIT) &&
1920             (tdata->td_winflags & TCP_SACK_PERMIT)) {
1921                 inseq = 1;
1922         /*
1923          * RST ACK with SEQ equal to 0 is sent by some OSes (i.e. Solaris) as a
1924          * response to initial SYN packet, when  there is no application
1925          * listeing to on a port, where the SYN packet has came to.
1926          */
1927         } else if ((seq == 0) && (tcpflags == (TH_RST|TH_ACK)) &&
1928                         (ackskew >= -1) && (ackskew <= 1)) {
1929                 inseq = 1;
1930         } else if (!(flags & IS_TCPFSM)) {
1931 
1932                 if (!(fdata->td_winflags &
1933                             (TCP_WSCALE_SEEN|TCP_WSCALE_FIRST))) {
1934                         /*
1935                          * No TCPFSM and no window scaling, so make some
1936                          * extra guesses.
1937                          */
1938                         if ((seq == fdata->td_maxend) && (ackskew == 0))
1939                                 inseq = 1;
1940                         else if (SEQ_GE(seq + maxwin, fdata->td_end - maxwin))
1941                                 inseq = 1;
1942                 }
1943         }
1944 
1945         if (inseq) {
1946                 /* if ackskew < 0 then this should be due to fragmented
1947                  * packets. There is no way to know the length of the
1948                  * total packet in advance.
1949                  * We do know the total length from the fragment cache though.
1950                  * Note however that there might be more sessions with
1951                  * exactly the same source and destination parameters in the
1952                  * state cache (and source and destination is the only stuff
1953                  * that is saved in the fragment cache). Note further that
1954                  * some TCP connections in the state cache are hashed with
1955                  * sport and dport as well which makes it not worthwhile to
1956                  * look for them.
1957                  * Thus, when ackskew is negative but still seems to belong
1958                  * to this session, we bump up the destinations end value.
1959                  */
1960                 if (ackskew < 0) {
1961                         DTRACE_PROBE2(end_update_td,
1962                                 int, tdata->td_end,
1963                                 int, ack
1964                         );
1965                         tdata->td_end = ack;
1966                 }
1967 
1968                 /* update max window seen */
1969                 if (fdata->td_maxwin < win) {
1970                         DTRACE_PROBE2(win_update_fd,
1971                                 int, fdata->td_maxwin,
1972                                 int, win
1973                         );
1974                         fdata->td_maxwin = win;
1975                 }
1976 
1977                 if (SEQ_GT(end, fdata->td_end)) {
1978                         DTRACE_PROBE2(end_update_fd,
1979                                 int, fdata->td_end,
1980                                 int, end
1981                         );
1982                         fdata->td_end = end;
1983                 }
1984 
1985                 if (SEQ_GE(ack + win, tdata->td_maxend)) {
1986                         DTRACE_PROBE2(max_end_update_td,
1987                                 int, tdata->td_maxend,
1988                                 int, ack + win
1989                         );
1990                         tdata->td_maxend = ack + win;
1991                 }
1992 
1993                 return 1;
1994         }
1995         fin->fin_flx |= FI_OOW;
1996 
1997 #if defined(_KERNEL)
1998         if (!(SEQ_GE(seq, fdata->td_end - maxwin)))
1999                 fin->fin_flx |= FI_NEG_OOW;
2000 #endif
2001 
2002         return 0;
2003 }
2004 
2005 
2006 /* ------------------------------------------------------------------------ */
2007 /* Function:    fr_stclone                                                  */
2008 /* Returns:     ipstate_t* - NULL == cloning failed,                        */
2009 /*                           else pointer to new state structure            */
2010 /* Parameters:  fin(I) - pointer to packet information                      */
2011 /*              tcp(I) - pointer to TCP/UDP header                          */
2012 /*              is(I)  - pointer to master state structure                  */
2013 /*                                                                          */
2014 /* Create a "duplcate" state table entry from the master.                   */
2015 /* ------------------------------------------------------------------------ */
2016 static ipstate_t *fr_stclone(fin, tcp, is)
2017 fr_info_t *fin;
2018 tcphdr_t *tcp;
2019 ipstate_t *is;
2020 {
2021         ipstate_t *clone;
2022         u_32_t send;
2023         ipf_stack_t *ifs = fin->fin_ifs;
2024 
2025         /*
2026          * Trigger automatic call to fr_state_flush() if the
2027          * table has reached capacity specified by hi watermark.
2028          */
2029         if (ST_TAB_WATER_LEVEL(ifs) > ifs->ifs_state_flush_level_hi)
2030                 ifs->ifs_fr_state_doflush = 1;
2031 
2032         /*
2033          * If automatic flushing did not do its job, and the table
2034          * has filled up, don't try to create a new entry.  A NULL
2035          * return will indicate that the cloning has failed.
2036          */
2037         if (ifs->ifs_ips_num >= ifs->ifs_fr_statemax) {
2038                 ATOMIC_INCL(ifs->ifs_ips_stats.iss_max);
2039                 return NULL;
2040         }
2041 
2042         KMALLOC(clone, ipstate_t *);
2043         if (clone == NULL)
2044                 return NULL;
2045         bcopy((char *)is, (char *)clone, sizeof(*clone));
2046 
2047         MUTEX_NUKE(&clone->is_lock);
2048 
2049         clone->is_die = ONE_DAY + ifs->ifs_fr_ticks;
2050         clone->is_state[0] = 0;
2051         clone->is_state[1] = 0;
2052         send = ntohl(tcp->th_seq) + fin->fin_dlen - (TCP_OFF(tcp) << 2) +
2053                 ((tcp->th_flags & TH_SYN) ? 1 : 0) +
2054                 ((tcp->th_flags & TH_FIN) ? 1 : 0);
2055 
2056         if (fin->fin_rev == 1) {
2057                 clone->is_dend = send;
2058                 clone->is_maxdend = send;
2059                 clone->is_send = 0;
2060                 clone->is_maxswin = 1;
2061                 clone->is_maxdwin = ntohs(tcp->th_win);
2062                 if (clone->is_maxdwin == 0)
2063                         clone->is_maxdwin = 1;
2064         } else {
2065                 clone->is_send = send;
2066                 clone->is_maxsend = send;
2067                 clone->is_dend = 0;
2068                 clone->is_maxdwin = 1;
2069                 clone->is_maxswin = ntohs(tcp->th_win);
2070                 if (clone->is_maxswin == 0)
2071                         clone->is_maxswin = 1;
2072         }
2073 
2074         clone->is_flags &= ~SI_CLONE;
2075         clone->is_flags |= SI_CLONED;
2076         fr_stinsert(clone, fin->fin_rev, ifs);
2077         clone->is_ref = 1;
2078         if (clone->is_p == IPPROTO_TCP) {
2079                 (void) fr_tcp_age(&clone->is_sti, fin, ifs->ifs_ips_tqtqb,
2080                                   clone->is_flags);
2081         }
2082         MUTEX_EXIT(&clone->is_lock);
2083 #ifdef  IPFILTER_SCAN
2084         (void) ipsc_attachis(is);
2085 #endif
2086 #ifdef  IPFILTER_SYNC
2087         if (is->is_flags & IS_STATESYNC)
2088                 clone->is_sync = ipfsync_new(SMC_STATE, fin, clone);
2089 #endif
2090         return clone;
2091 }
2092 
2093 
2094 /* ------------------------------------------------------------------------ */
2095 /* Function:    fr_matchsrcdst                                              */
2096 /* Returns:     Nil                                                         */
2097 /* Parameters:  fin(I) - pointer to packet information                      */
2098 /*              is(I)  - pointer to state structure                         */
2099 /*              src(I) - pointer to source address                          */
2100 /*              dst(I) - pointer to destination address                     */
2101 /*              tcp(I) - pointer to TCP/UDP header                          */
2102 /*                                                                          */
2103 /* Match a state table entry against an IP packet.  The logic below is that */
2104 /* ret gets set to one if the match succeeds, else remains 0.  If it is     */
2105 /* still 0 after the test. no match.                                        */
2106 /* ------------------------------------------------------------------------ */
2107 static ipstate_t *fr_matchsrcdst(fin, is, src, dst, tcp, cmask)
2108 fr_info_t *fin;
2109 ipstate_t *is;
2110 i6addr_t *src, *dst;
2111 tcphdr_t *tcp;
2112 u_32_t cmask;
2113 {
2114         int ret = 0, rev, out, flags, flx = 0, idx;
2115         u_short sp, dp;
2116         u_32_t cflx;
2117         void *ifp;
2118         ipf_stack_t *ifs = fin->fin_ifs;
2119 
2120         rev = IP6_NEQ(&is->is_dst, dst);
2121         ifp = fin->fin_ifp;
2122         out = fin->fin_out;
2123         flags = is->is_flags;
2124         sp = 0;
2125         dp = 0;
2126 
2127         if (tcp != NULL) {
2128                 sp = htons(fin->fin_sport);
2129                 dp = ntohs(fin->fin_dport);
2130         }
2131         if (!rev) {
2132                 if (tcp != NULL) {
2133                         if (!(flags & SI_W_SPORT) && (sp != is->is_sport))
2134                                 rev = 1;
2135                         else if (!(flags & SI_W_DPORT) && (dp != is->is_dport))
2136                                 rev = 1;
2137                 }
2138         }
2139 
2140         idx = (out << 1) + rev;
2141 
2142         /*
2143          * If the interface for this 'direction' is set, make sure it matches.
2144          * An interface name that is not set matches any, as does a name of *.
2145          */
2146         if ((is->is_ifp[idx] == NULL &&
2147             (*is->is_ifname[idx] == '\0' || *is->is_ifname[idx] == '*')) ||
2148             is->is_ifp[idx] == ifp)
2149                 ret = 1;
2150 
2151         if (ret == 0) {
2152                 DTRACE_PROBE(no_match_on_iface);
2153                 return NULL;
2154         }
2155         ret = 0;
2156 
2157         /*
2158          * Match addresses and ports.
2159          */
2160         if (rev == 0) {
2161                 if ((IP6_EQ(&is->is_dst, dst) || (flags & SI_W_DADDR)) &&
2162                     (IP6_EQ(&is->is_src, src) || (flags & SI_W_SADDR))) {
2163                         if (tcp) {
2164                                 if ((sp == is->is_sport || flags & SI_W_SPORT)&&
2165                                     (dp == is->is_dport || flags & SI_W_DPORT))
2166                                         ret = 1;
2167                         } else {
2168                                 ret = 1;
2169                         }
2170                 }
2171         } else {
2172                 if ((IP6_EQ(&is->is_dst, src) || (flags & SI_W_DADDR)) &&
2173                     (IP6_EQ(&is->is_src, dst) || (flags & SI_W_SADDR))) {
2174                         if (tcp) {
2175                                 if ((dp == is->is_sport || flags & SI_W_SPORT)&&
2176                                     (sp == is->is_dport || flags & SI_W_DPORT))
2177                                         ret = 1;
2178                         } else {
2179                                 ret = 1;
2180                         }
2181                 }
2182         }
2183 
2184         if (ret == 0) {
2185                 DTRACE_PROBE(no_match_on_addrs);
2186                 return NULL;
2187         }
2188         /*
2189          * Whether or not this should be here, is questionable, but the aim
2190          * is to get this out of the main line.
2191          */
2192         if (tcp == NULL)
2193                 flags = is->is_flags & ~(SI_WILDP|SI_NEWFR|SI_CLONE|SI_CLONED);
2194 
2195         /*
2196          * Only one of the source or destination address can be flaged as a
2197          * wildcard.  Fill in the missing address, if set.
2198          * For IPv6, if the address being copied in is multicast, then
2199          * don't reset the wild flag - multicast causes it to be set in the
2200          * first place!
2201          */
2202         if ((flags & (SI_W_SADDR|SI_W_DADDR))) {
2203                 fr_ip_t *fi = &fin->fin_fi;
2204 
2205                 if ((flags & SI_W_SADDR) != 0) {
2206                         if (rev == 0) {
2207 #ifdef USE_INET6
2208                                 if (is->is_v == 6 &&
2209                                     IN6_IS_ADDR_MULTICAST(&fi->fi_src.in6))
2210                                         /*EMPTY*/;
2211                                 else
2212 #endif
2213                                 {
2214                                         is->is_src = fi->fi_src;
2215                                         is->is_flags &= ~SI_W_SADDR;
2216                                 }
2217                         } else {
2218 #ifdef USE_INET6
2219                                 if (is->is_v == 6 &&
2220                                     IN6_IS_ADDR_MULTICAST(&fi->fi_dst.in6))
2221                                         /*EMPTY*/;
2222                                 else
2223 #endif
2224                                 {
2225                                         is->is_src = fi->fi_dst;
2226                                         is->is_flags &= ~SI_W_SADDR;
2227                                 }
2228                         }
2229                 } else if ((flags & SI_W_DADDR) != 0) {
2230                         if (rev == 0) {
2231 #ifdef USE_INET6
2232                                 if (is->is_v == 6 &&
2233                                     IN6_IS_ADDR_MULTICAST(&fi->fi_dst.in6))
2234                                         /*EMPTY*/;
2235                                 else
2236 #endif
2237                                 {
2238                                         is->is_dst = fi->fi_dst;
2239                                         is->is_flags &= ~SI_W_DADDR;
2240                                 }
2241                         } else {
2242 #ifdef USE_INET6
2243                                 if (is->is_v == 6 &&
2244                                     IN6_IS_ADDR_MULTICAST(&fi->fi_src.in6))
2245                                         /*EMPTY*/;
2246                                 else
2247 #endif
2248                                 {
2249                                         is->is_dst = fi->fi_src;
2250                                         is->is_flags &= ~SI_W_DADDR;
2251                                 }
2252                         }
2253                 }
2254                 if ((is->is_flags & (SI_WILDA|SI_WILDP)) == 0) {
2255                         ATOMIC_DECL(ifs->ifs_ips_stats.iss_wild);
2256                 }
2257         }
2258 
2259         flx = fin->fin_flx & cmask;
2260         cflx = is->is_flx[out][rev];
2261 
2262         /*
2263          * Match up any flags set from IP options.
2264          */
2265         if ((cflx && (flx != (cflx & cmask))) ||
2266             ((fin->fin_optmsk & is->is_optmsk[rev]) != is->is_opt[rev]) ||
2267             ((fin->fin_secmsk & is->is_secmsk) != is->is_sec) ||
2268             ((fin->fin_auth & is->is_authmsk) != is->is_auth)) {
2269                 DTRACE_PROBE4(no_match_on_flags,
2270                     int, (cflx && (flx != (cflx & cmask))),
2271                     int,
2272                     ((fin->fin_optmsk & is->is_optmsk[rev]) != is->is_opt[rev]),
2273                     int, ((fin->fin_secmsk & is->is_secmsk) != is->is_sec),
2274                     int, ((fin->fin_auth & is->is_authmsk) != is->is_auth)
2275                 );
2276                 return NULL;
2277         }
2278         /*
2279          * Only one of the source or destination port can be flagged as a
2280          * wildcard.  When filling it in, fill in a copy of the matched entry
2281          * if it has the cloning flag set.
2282          */
2283         if ((fin->fin_flx & FI_IGNORE) != 0) {
2284                 fin->fin_rev = rev;
2285                 return is;
2286         }
2287 
2288         if ((flags & (SI_W_SPORT|SI_W_DPORT))) {
2289                 if ((flags & SI_CLONE) != 0) {
2290                         ipstate_t *clone;
2291 
2292                         clone = fr_stclone(fin, tcp, is);
2293                         if (clone == NULL)
2294                                 return NULL;
2295                         is = clone;
2296                 } else {
2297                         ATOMIC_DECL(ifs->ifs_ips_stats.iss_wild);
2298                 }
2299 
2300                 if ((flags & SI_W_SPORT) != 0) {
2301                         if (rev == 0) {
2302                                 is->is_sport = sp;
2303                                 is->is_send = ntohl(tcp->th_seq);
2304                         } else {
2305                                 is->is_sport = dp;
2306                                 is->is_send = ntohl(tcp->th_ack);
2307                         }
2308                         is->is_maxsend = is->is_send + 1;
2309                 } else if ((flags & SI_W_DPORT) != 0) {
2310                         if (rev == 0) {
2311                                 is->is_dport = dp;
2312                                 is->is_dend = ntohl(tcp->th_ack);
2313                         } else {
2314                                 is->is_dport = sp;
2315                                 is->is_dend = ntohl(tcp->th_seq);
2316                         }
2317                         is->is_maxdend = is->is_dend + 1;
2318                 }
2319                 is->is_flags &= ~(SI_W_SPORT|SI_W_DPORT);
2320                 if ((flags & SI_CLONED) && ifs->ifs_ipstate_logging)
2321                         ipstate_log(is, ISL_CLONE, ifs);
2322                 if ((flags & SI_CLONED) && IFS_CFWLOG(ifs, is->is_rule))
2323                         ipf_log_cfwlog(is, ISL_CLONE, ifs);
2324         }
2325 
2326         ret = -1;
2327 
2328         if (is->is_flx[out][rev] == 0) {
2329                 is->is_flx[out][rev] = flx;
2330                 /*
2331                  * If we are dealing with the first packet coming in reverse
2332                  * direction (sent by peer), then we have to set options into
2333                  * state.
2334                  */
2335                 if (rev == 1 && is->is_optmsk[1] == 0x0) {
2336                         is->is_optmsk[1] = 0xffffffff;
2337                         is->is_opt[1] = fin->fin_optmsk;
2338                         DTRACE_PROBE(set_rev_opts);
2339                 }
2340                 if (is->is_v == 6) {
2341                         is->is_opt[rev] &= ~0x8;
2342                         is->is_optmsk[rev] &= ~0x8;
2343                 }
2344         }
2345 
2346         /*
2347          * Check if the interface name for this "direction" is set and if not,
2348          * fill it in.
2349          */
2350         if (is->is_ifp[idx] == NULL &&
2351             (*is->is_ifname[idx] == '\0' || *is->is_ifname[idx] == '*')) {
2352                 is->is_ifp[idx] = ifp;
2353                 COPYIFNAME(ifp, is->is_ifname[idx], fin->fin_v);
2354         }
2355         fin->fin_rev = rev;
2356         return is;
2357 }
2358 
2359 
2360 /* ------------------------------------------------------------------------ */
2361 /* Function:    fr_checkicmpmatchingstate                                   */
2362 /* Returns:     Nil                                                         */
2363 /* Parameters:  fin(I) - pointer to packet information                      */
2364 /*                                                                          */
2365 /* If we've got an ICMP error message, using the information stored in the  */
2366 /* ICMP packet, look for a matching state table entry.                      */
2367 /*                                                                          */
2368 /* If we return NULL then no lock on ipf_state is held.                     */
2369 /* If we return non-null then a read-lock on ipf_state is held.             */
2370 /* ------------------------------------------------------------------------ */
2371 static ipstate_t *fr_checkicmpmatchingstate(fin)
2372 fr_info_t *fin;
2373 {
2374         ipstate_t *is, **isp;
2375         u_short sport, dport;
2376         u_char  pr;
2377         int backward, i, oi;
2378         i6addr_t dst, src;
2379         struct icmp *ic;
2380         u_short savelen;
2381         icmphdr_t *icmp;
2382         fr_info_t ofin;
2383         tcphdr_t *tcp;
2384         int len;
2385         ip_t *oip;
2386         u_int hv;
2387         ipf_stack_t *ifs = fin->fin_ifs;
2388 
2389         /*
2390          * Does it at least have the return (basic) IP header ?
2391          * Is it an actual recognised ICMP error type?
2392          * Only a basic IP header (no options) should be with
2393          * an ICMP error header.
2394          */
2395         if ((fin->fin_v != 4) || (fin->fin_hlen != sizeof(ip_t)) ||
2396             (fin->fin_plen < ICMPERR_MINPKTLEN) ||
2397             !(fin->fin_flx & FI_ICMPERR))
2398                 return NULL;
2399         ic = fin->fin_dp;
2400 
2401         oip = (ip_t *)((char *)ic + ICMPERR_ICMPHLEN);
2402         /*
2403          * Check if the at least the old IP header (with options) and
2404          * 8 bytes of payload is present.
2405          */
2406         if (fin->fin_plen < ICMPERR_MAXPKTLEN + ((IP_HL(oip) - 5) << 2))
2407                 return NULL;
2408 
2409         /*
2410          * Sanity Checks.
2411          */
2412         len = fin->fin_dlen - ICMPERR_ICMPHLEN;
2413         if ((len <= 0) || ((IP_HL(oip) << 2) > len))
2414                 return NULL;
2415 
2416         /*
2417          * Is the buffer big enough for all of it ?  It's the size of the IP
2418          * header claimed in the encapsulated part which is of concern.  It
2419          * may be too big to be in this buffer but not so big that it's
2420          * outside the ICMP packet, leading to TCP deref's causing problems.
2421          * This is possible because we don't know how big oip_hl is when we
2422          * do the pullup early in fr_check() and thus can't guarantee it is
2423          * all here now.
2424          */
2425 #ifdef  _KERNEL
2426         {
2427         mb_t *m;
2428 
2429         m = fin->fin_m;
2430 # if defined(MENTAT)
2431         if ((char *)oip + len > (char *)m->b_wptr)
2432                 return NULL;
2433 # else
2434         if ((char *)oip + len > (char *)fin->fin_ip + m->m_len)
2435                 return NULL;
2436 # endif
2437         }
2438 #endif
2439         bcopy((char *)fin, (char *)&ofin, sizeof(*fin));
2440 
2441         /*
2442          * in the IPv4 case we must zero the i6addr union otherwise
2443          * the IP6_EQ and IP6_NEQ macros produce the wrong results because
2444          * of the 'junk' in the unused part of the union
2445          */
2446         bzero((char *)&src, sizeof(src));
2447         bzero((char *)&dst, sizeof(dst));
2448 
2449         /*
2450          * we make an fin entry to be able to feed it to
2451          * matchsrcdst note that not all fields are encessary
2452          * but this is the cleanest way. Note further we fill
2453          * in fin_mp such that if someone uses it we'll get
2454          * a kernel panic. fr_matchsrcdst does not use this.
2455          *
2456          * watch out here, as ip is in host order and oip in network
2457          * order. Any change we make must be undone afterwards, like
2458          * oip->ip_off - it is still in network byte order so fix it.
2459          */
2460         savelen = oip->ip_len;
2461         oip->ip_len = len;
2462         oip->ip_off = ntohs(oip->ip_off);
2463 
2464         ofin.fin_flx = FI_NOCKSUM;
2465         ofin.fin_v = 4;
2466         ofin.fin_ip = oip;
2467         ofin.fin_m = NULL;      /* if dereferenced, panic XXX */
2468         ofin.fin_mp = NULL;     /* if dereferenced, panic XXX */
2469         ofin.fin_plen = fin->fin_dlen - ICMPERR_ICMPHLEN;
2470         (void) fr_makefrip(IP_HL(oip) << 2, oip, &ofin);
2471         ofin.fin_ifp = fin->fin_ifp;
2472         ofin.fin_out = !fin->fin_out;
2473         /*
2474          * Reset the short and bad flag here because in fr_matchsrcdst()
2475          * the flags for the current packet (fin_flx) are compared against
2476          * those for the existing session.
2477          */
2478         ofin.fin_flx &= ~(FI_BAD|FI_SHORT);
2479 
2480         /*
2481          * Put old values of ip_len and ip_off back as we don't know
2482          * if we have to forward the packet (or process it again.
2483          */
2484         oip->ip_len = savelen;
2485         oip->ip_off = htons(oip->ip_off);
2486 
2487         switch (oip->ip_p)
2488         {
2489         case IPPROTO_ICMP :
2490                 /*
2491                  * an ICMP error can only be generated as a result of an
2492                  * ICMP query, not as the response on an ICMP error
2493                  *
2494                  * XXX theoretically ICMP_ECHOREP and the other reply's are
2495                  * ICMP query's as well, but adding them here seems strange XXX
2496                  */
2497                 if ((ofin.fin_flx & FI_ICMPERR) != 0)
2498                         return NULL;
2499 
2500                 /*
2501                  * perform a lookup of the ICMP packet in the state table
2502                  */
2503                 icmp = (icmphdr_t *)((char *)oip + (IP_HL(oip) << 2));
2504                 hv = (pr = oip->ip_p);
2505                 src.in4 = oip->ip_src;
2506                 hv += src.in4.s_addr;
2507                 dst.in4 = oip->ip_dst;
2508                 hv += dst.in4.s_addr;
2509                 hv += icmp->icmp_id;
2510                 hv = DOUBLE_HASH(hv, ifs);
2511 
2512                 READ_ENTER(&ifs->ifs_ipf_state);
2513                 for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) {
2514                         isp = &is->is_hnext;
2515                         if ((is->is_p != pr) || (is->is_v != 4))
2516                                 continue;
2517                         if (is->is_pass & FR_NOICMPERR)
2518                                 continue;
2519                         is = fr_matchsrcdst(&ofin, is, &src, &dst,
2520                                             NULL, FI_ICMPCMP);
2521                         if (is != NULL) {
2522                                 if ((is->is_pass & FR_NOICMPERR) != 0) {
2523                                         RWLOCK_EXIT(&ifs->ifs_ipf_state);
2524                                         return NULL;
2525                                 }
2526                                 /*
2527                                  * i  : the index of this packet (the icmp
2528                                  *      unreachable)
2529                                  * oi : the index of the original packet found
2530                                  *      in the icmp header (i.e. the packet
2531                                  *      causing this icmp)
2532                                  * backward : original packet was backward
2533                                  *      compared to the state
2534                                  */
2535                                 backward = IP6_NEQ(&is->is_src, &src);
2536                                 fin->fin_rev = !backward;
2537                                 i = (!backward << 1) + fin->fin_out;
2538                                 oi = (backward << 1) + ofin.fin_out;
2539                                 if (is->is_icmppkts[i] > is->is_pkts[oi])
2540                                         continue;
2541                                 ifs->ifs_ips_stats.iss_hits++;
2542                                 is->is_icmppkts[i]++;
2543                                 return is;
2544                         }
2545                 }
2546                 RWLOCK_EXIT(&ifs->ifs_ipf_state);
2547                 return NULL;
2548         case IPPROTO_TCP :
2549         case IPPROTO_UDP :
2550                 break;
2551         default :
2552                 return NULL;
2553         }
2554 
2555         tcp = (tcphdr_t *)((char *)oip + (IP_HL(oip) << 2));
2556         dport = tcp->th_dport;
2557         sport = tcp->th_sport;
2558 
2559         hv = (pr = oip->ip_p);
2560         src.in4 = oip->ip_src;
2561         hv += src.in4.s_addr;
2562         dst.in4 = oip->ip_dst;
2563         hv += dst.in4.s_addr;
2564         hv += dport;
2565         hv += sport;
2566         hv = DOUBLE_HASH(hv, ifs);
2567 
2568         READ_ENTER(&ifs->ifs_ipf_state);
2569         for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) {
2570                 isp = &is->is_hnext;
2571                 /*
2572                  * Only allow this icmp though if the
2573                  * encapsulated packet was allowed through the
2574                  * other way around. Note that the minimal amount
2575                  * of info present does not allow for checking against
2576                  * tcp internals such as seq and ack numbers.   Only the
2577                  * ports are known to be present and can be even if the
2578                  * short flag is set.
2579                  */
2580                 if ((is->is_p == pr) && (is->is_v == 4) &&
2581                     (is = fr_matchsrcdst(&ofin, is, &src, &dst,
2582                                          tcp, FI_ICMPCMP))) {
2583                         /*
2584                          * i  : the index of this packet (the icmp unreachable)
2585                          * oi : the index of the original packet found in the
2586                          *      icmp header (i.e. the packet causing this icmp)
2587                          * backward : original packet was backward compared to
2588                          *            the state
2589                          */
2590                         backward = IP6_NEQ(&is->is_src, &src);
2591                         fin->fin_rev = !backward;
2592                         i = (!backward << 1) + fin->fin_out;
2593                         oi = (backward << 1) + ofin.fin_out;
2594 
2595                         if (((is->is_pass & FR_NOICMPERR) != 0) ||
2596                             (is->is_icmppkts[i] > is->is_pkts[oi]))
2597                                 break;
2598                         ifs->ifs_ips_stats.iss_hits++;
2599                         is->is_icmppkts[i]++;
2600                         /*
2601                          * we deliberately do not touch the timeouts
2602                          * for the accompanying state table entry.
2603                          * It remains to be seen if that is correct. XXX
2604                          */
2605                         return is;
2606                 }
2607         }
2608         RWLOCK_EXIT(&ifs->ifs_ipf_state);
2609         return NULL;
2610 }
2611 
2612 
2613 /* ------------------------------------------------------------------------ */
2614 /* Function:    fr_ipsmove                                                  */
2615 /* Returns:     Nil                                                         */
2616 /* Parameters:  is(I) - pointer to state table entry                        */
2617 /*              hv(I) - new hash value for state table entry                */
2618 /* Write Locks: ipf_state                                                   */
2619 /*                                                                          */
2620 /* Move a state entry from one position in the hash table to another.       */
2621 /* ------------------------------------------------------------------------ */
2622 static void fr_ipsmove(is, hv, ifs)
2623 ipstate_t *is;
2624 u_int hv;
2625 ipf_stack_t *ifs;
2626 {
2627         ipstate_t **isp;
2628         u_int hvm;
2629 
2630         ASSERT(rw_read_locked(&ifs->ifs_ipf_state.ipf_lk) == 0);
2631 
2632         hvm = is->is_hv;
2633         /*
2634          * Remove the hash from the old location...
2635          */
2636         isp = is->is_phnext;
2637         if (is->is_hnext)
2638                 is->is_hnext->is_phnext = isp;
2639         *isp = is->is_hnext;
2640         if (ifs->ifs_ips_table[hvm] == NULL)
2641                 ifs->ifs_ips_stats.iss_inuse--;
2642         ifs->ifs_ips_stats.iss_bucketlen[hvm]--;
2643 
2644         /*
2645          * ...and put the hash in the new one.
2646          */
2647         hvm = DOUBLE_HASH(hv, ifs);
2648         is->is_hv = hvm;
2649         isp = &ifs->ifs_ips_table[hvm];
2650         if (*isp)
2651                 (*isp)->is_phnext = &is->is_hnext;
2652         else
2653                 ifs->ifs_ips_stats.iss_inuse++;
2654         ifs->ifs_ips_stats.iss_bucketlen[hvm]++;
2655         is->is_phnext = isp;
2656         is->is_hnext = *isp;
2657         *isp = is;
2658 }
2659 
2660 
2661 /* ------------------------------------------------------------------------ */
2662 /* Function:    fr_stlookup                                                 */
2663 /* Returns:     ipstate_t* - NULL == no matching state found,               */
2664 /*                           else pointer to state information is returned  */
2665 /* Parameters:  fin(I) - pointer to packet information                      */
2666 /*              tcp(I) - pointer to TCP/UDP header.                         */
2667 /*                                                                          */
2668 /* Search the state table for a matching entry to the packet described by   */
2669 /* the contents of *fin.                                                    */
2670 /*                                                                          */
2671 /* If we return NULL then no lock on ipf_state is held.                     */
2672 /* If we return non-null then a read-lock on ipf_state is held.             */
2673 /* ------------------------------------------------------------------------ */
2674 ipstate_t *fr_stlookup(fin, tcp, ifqp)
2675 fr_info_t *fin;
2676 tcphdr_t *tcp;
2677 ipftq_t **ifqp;
2678 {
2679         u_int hv, hvm, pr, v, tryagain;
2680         ipstate_t *is, **isp;
2681         u_short dport, sport;
2682         i6addr_t src, dst;
2683         struct icmp *ic;
2684         ipftq_t *ifq;
2685         int oow;
2686         ipf_stack_t *ifs = fin->fin_ifs;
2687 
2688         is = NULL;
2689         ifq = NULL;
2690         tcp = fin->fin_dp;
2691         ic = (struct icmp *)tcp;
2692         hv = (pr = fin->fin_fi.fi_p);
2693         src = fin->fin_fi.fi_src;
2694         dst = fin->fin_fi.fi_dst;
2695         hv += src.in4.s_addr;
2696         hv += dst.in4.s_addr;
2697 
2698         v = fin->fin_fi.fi_v;
2699 #ifdef  USE_INET6
2700         if (v == 6) {
2701                 hv  += fin->fin_fi.fi_src.i6[1];
2702                 hv  += fin->fin_fi.fi_src.i6[2];
2703                 hv  += fin->fin_fi.fi_src.i6[3];
2704 
2705                 if ((fin->fin_p == IPPROTO_ICMPV6) &&
2706                     IN6_IS_ADDR_MULTICAST(&fin->fin_fi.fi_dst.in6)) {
2707                         hv -= dst.in4.s_addr;
2708                 } else {
2709                         hv += fin->fin_fi.fi_dst.i6[1];
2710                         hv += fin->fin_fi.fi_dst.i6[2];
2711                         hv += fin->fin_fi.fi_dst.i6[3];
2712                 }
2713         }
2714 #endif
2715         if ((v == 4) &&
2716             (fin->fin_flx & (FI_MULTICAST|FI_BROADCAST|FI_MBCAST))) {
2717                 if (fin->fin_out == 0) {
2718                         hv -= src.in4.s_addr;
2719                 } else {
2720                         hv -= dst.in4.s_addr;
2721                 }
2722         }
2723 
2724         /*
2725          * Search the hash table for matching packet header info.
2726          */
2727         switch (pr)
2728         {
2729 #ifdef  USE_INET6
2730         case IPPROTO_ICMPV6 :
2731                 tryagain = 0;
2732                 if (v == 6) {
2733                         if ((ic->icmp_type == ICMP6_ECHO_REQUEST) ||
2734                             (ic->icmp_type == ICMP6_ECHO_REPLY)) {
2735                                 hv += ic->icmp_id;
2736                         }
2737                 }
2738                 READ_ENTER(&ifs->ifs_ipf_state);
2739 icmp6again:
2740                 hvm = DOUBLE_HASH(hv, ifs);
2741                 for (isp = &ifs->ifs_ips_table[hvm]; ((is = *isp) != NULL); ) {
2742                         isp = &is->is_hnext;
2743                         if ((is->is_p != pr) || (is->is_v != v))
2744                                 continue;
2745                         is = fr_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP);
2746                         if (is != NULL &&
2747                             fr_matchicmpqueryreply(v, &is->is_icmp,
2748                                                    ic, fin->fin_rev)) {
2749                                 if (fin->fin_rev)
2750                                         ifq = &ifs->ifs_ips_icmpacktq;
2751                                 else
2752                                         ifq = &ifs->ifs_ips_icmptq;
2753                                 break;
2754                         }
2755                 }
2756 
2757                 if (is != NULL) {
2758                         if ((tryagain != 0) && !(is->is_flags & SI_W_DADDR)) {
2759                                 hv += fin->fin_fi.fi_src.i6[0];
2760                                 hv += fin->fin_fi.fi_src.i6[1];
2761                                 hv += fin->fin_fi.fi_src.i6[2];
2762                                 hv += fin->fin_fi.fi_src.i6[3];
2763                                 fr_ipsmove(is, hv, ifs);
2764                                 MUTEX_DOWNGRADE(&ifs->ifs_ipf_state);
2765                         }
2766                         break;
2767                 }
2768                 RWLOCK_EXIT(&ifs->ifs_ipf_state);
2769 
2770                 /*
2771                  * No matching icmp state entry. Perhaps this is a
2772                  * response to another state entry.
2773                  *
2774                  * XXX With some ICMP6 packets, the "other" address is already
2775                  * in the packet, after the ICMP6 header, and this could be
2776                  * used in place of the multicast address.  However, taking
2777                  * advantage of this requires some significant code changes
2778                  * to handle the specific types where that is the case.
2779                  */
2780                 if ((ifs->ifs_ips_stats.iss_wild != 0) && (v == 6) && (tryagain == 0) &&
2781                     !IN6_IS_ADDR_MULTICAST(&fin->fin_fi.fi_src.in6)) {
2782                         hv -= fin->fin_fi.fi_src.i6[0];
2783                         hv -= fin->fin_fi.fi_src.i6[1];
2784                         hv -= fin->fin_fi.fi_src.i6[2];
2785                         hv -= fin->fin_fi.fi_src.i6[3];
2786                         tryagain = 1;
2787                         WRITE_ENTER(&ifs->ifs_ipf_state);
2788                         goto icmp6again;
2789                 }
2790 
2791                 is = fr_checkicmp6matchingstate(fin);
2792                 if (is != NULL)
2793                         return is;
2794                 break;
2795 #endif
2796 
2797         case IPPROTO_ICMP :
2798                 if (v == 4) {
2799                         hv += ic->icmp_id;
2800                 }
2801                 hv = DOUBLE_HASH(hv, ifs);
2802                 READ_ENTER(&ifs->ifs_ipf_state);
2803                 for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) {
2804                         isp = &is->is_hnext;
2805                         if ((is->is_p != pr) || (is->is_v != v))
2806                                 continue;
2807                         is = fr_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP);
2808                         if (is != NULL &&
2809                             fr_matchicmpqueryreply(v, &is->is_icmp,
2810                                                    ic, fin->fin_rev)) {
2811                                 if (fin->fin_rev)
2812                                         ifq = &ifs->ifs_ips_icmpacktq;
2813                                 else
2814                                         ifq = &ifs->ifs_ips_icmptq;
2815                                 break;
2816                         }
2817                 }
2818                 if (is == NULL) {
2819                         RWLOCK_EXIT(&ifs->ifs_ipf_state);
2820                 }
2821                 break;
2822 
2823         case IPPROTO_TCP :
2824         case IPPROTO_UDP :
2825                 ifqp = NULL;
2826                 sport = htons(fin->fin_data[0]);
2827                 hv += sport;
2828                 dport = htons(fin->fin_data[1]);
2829                 hv += dport;
2830                 oow = 0;
2831                 tryagain = 0;
2832                 READ_ENTER(&ifs->ifs_ipf_state);
2833 retry_tcpudp:
2834                 hvm = DOUBLE_HASH(hv, ifs);
2835                 for (isp = &ifs->ifs_ips_table[hvm]; ((is = *isp) != NULL); ) {
2836                         isp = &is->is_hnext;
2837                         if ((is->is_p != pr) || (is->is_v != v))
2838                                 continue;
2839                         fin->fin_flx &= ~FI_OOW;
2840                         is = fr_matchsrcdst(fin, is, &src, &dst, tcp, FI_CMP);
2841                         if (is != NULL) {
2842                                 if (pr == IPPROTO_TCP) {
2843                                         if (!fr_tcpstate(fin, tcp, is)) {
2844                                                 oow |= fin->fin_flx & FI_OOW;
2845                                                 continue;
2846                                         }
2847                                 }
2848                                 break;
2849                         }
2850                 }
2851                 if (is != NULL) {
2852                         if (tryagain &&
2853                             !(is->is_flags & (SI_CLONE|SI_WILDP|SI_WILDA))) {
2854                                 hv += dport;
2855                                 hv += sport;
2856                                 fr_ipsmove(is, hv, ifs);
2857                                 MUTEX_DOWNGRADE(&ifs->ifs_ipf_state);
2858                         }
2859                         break;
2860                 }
2861                 RWLOCK_EXIT(&ifs->ifs_ipf_state);
2862 
2863                 if (ifs->ifs_ips_stats.iss_wild) {
2864                         if (tryagain == 0) {
2865                                 hv -= dport;
2866                                 hv -= sport;
2867                         } else if (tryagain == 1) {
2868                                 hv = fin->fin_fi.fi_p;
2869                                 /*
2870                                  * If we try to pretend this is a reply to a
2871                                  * multicast/broadcast packet then we need to
2872                                  * exclude part of the address from the hash
2873                                  * calculation.
2874                                  */
2875                                 if (fin->fin_out == 0) {
2876                                         hv += src.in4.s_addr;
2877                                 } else {
2878                                         hv += dst.in4.s_addr;
2879                                 }
2880                                 hv += dport;
2881                                 hv += sport;
2882                         }
2883                         tryagain++;
2884                         if (tryagain <= 2) {
2885                                 WRITE_ENTER(&ifs->ifs_ipf_state);
2886                                 goto retry_tcpudp;
2887                         }
2888                 }
2889                 fin->fin_flx |= oow;
2890                 break;
2891 
2892 #if 0
2893         case IPPROTO_GRE :
2894                 gre = fin->fin_dp;
2895                 if (GRE_REV(gre->gr_flags) == 1) {
2896                         hv += gre->gr_call;
2897                 }
2898                 /* FALLTHROUGH */
2899 #endif
2900         default :
2901                 ifqp = NULL;
2902                 hvm = DOUBLE_HASH(hv, ifs);
2903                 READ_ENTER(&ifs->ifs_ipf_state);
2904                 for (isp = &ifs->ifs_ips_table[hvm]; ((is = *isp) != NULL); ) {
2905                         isp = &is->is_hnext;
2906                         if ((is->is_p != pr) || (is->is_v != v))
2907                                 continue;
2908                         is = fr_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP);
2909                         if (is != NULL) {
2910                                 ifq = &ifs->ifs_ips_iptq;
2911                                 break;
2912                         }
2913                 }
2914                 if (is == NULL) {
2915                         RWLOCK_EXIT(&ifs->ifs_ipf_state);
2916                 }
2917                 break;
2918         }
2919 
2920         if ((is != NULL) && ((is->is_sti.tqe_flags & TQE_RULEBASED) != 0) &&
2921             (is->is_tqehead[fin->fin_rev] != NULL))
2922                 ifq = is->is_tqehead[fin->fin_rev];
2923         if (ifq != NULL && ifqp != NULL)
2924                 *ifqp = ifq;
2925         return is;
2926 }
2927 
2928 
2929 /* ------------------------------------------------------------------------ */
2930 /* Function:    fr_updatestate                                              */
2931 /* Returns:     Nil                                                         */
2932 /* Parameters:  fin(I) - pointer to packet information                      */
2933 /*              is(I)  - pointer to state table entry                       */
2934 /* Read Locks:  ipf_state                                                   */
2935 /*                                                                          */
2936 /* Updates packet and byte counters for a newly received packet.  Seeds the */
2937 /* fragment cache with a new entry as required.                             */
2938 /* ------------------------------------------------------------------------ */
2939 void fr_updatestate(fin, is, ifq)
2940 fr_info_t *fin;
2941 ipstate_t *is;
2942 ipftq_t *ifq;
2943 {
2944         ipftqent_t *tqe;
2945         int i, pass;
2946         ipf_stack_t *ifs = fin->fin_ifs;
2947 
2948         i = (fin->fin_rev << 1) + fin->fin_out;
2949 
2950         /*
2951          * For TCP packets, ifq == NULL.  For all others, check if this new
2952          * queue is different to the last one it was on and move it if so.
2953          */
2954         tqe = &is->is_sti;
2955         MUTEX_ENTER(&is->is_lock);
2956         if ((tqe->tqe_flags & TQE_RULEBASED) != 0)
2957                 ifq = is->is_tqehead[fin->fin_rev];
2958 
2959         if (ifq != NULL)
2960                 fr_movequeue(tqe, tqe->tqe_ifq, ifq, ifs);
2961 
2962         is->is_pkts[i]++;
2963         fin->fin_pktnum = is->is_pkts[i] + is->is_icmppkts[i];
2964         is->is_bytes[i] += fin->fin_plen;
2965         MUTEX_EXIT(&is->is_lock);
2966 
2967 #ifdef  IPFILTER_SYNC
2968         if (is->is_flags & IS_STATESYNC)
2969                 ipfsync_update(SMC_STATE, fin, is->is_sync);
2970 #endif
2971 
2972         ATOMIC_INCL(ifs->ifs_ips_stats.iss_hits);
2973 
2974         fin->fin_fr = is->is_rule;
2975 
2976         /*
2977          * If this packet is a fragment and the rule says to track fragments,
2978          * then create a new fragment cache entry.
2979          */
2980         pass = is->is_pass;
2981         if ((fin->fin_flx & FI_FRAG) && FR_ISPASS(pass))
2982                 (void) fr_newfrag(fin, pass ^ FR_KEEPSTATE);
2983 }
2984 
2985 
2986 /* ------------------------------------------------------------------------ */
2987 /* Function:    fr_checkstate                                               */
2988 /* Returns:     frentry_t* - NULL == search failed,                         */
2989 /*                           else pointer to rule for matching state        */
2990 /* Parameters:  ifp(I)   - pointer to interface                             */
2991 /*              passp(I) - pointer to filtering result flags                */
2992 /*                                                                          */
2993 /* Check if a packet is associated with an entry in the state table.        */
2994 /* ------------------------------------------------------------------------ */
2995 frentry_t *fr_checkstate(fin, passp)
2996 fr_info_t *fin;
2997 u_32_t *passp;
2998 {
2999         ipstate_t *is;
3000         frentry_t *fr;
3001         tcphdr_t *tcp;
3002         ipftq_t *ifq;
3003         u_int pass;
3004         ipf_stack_t *ifs = fin->fin_ifs;
3005 
3006         if (ifs->ifs_fr_state_lock || (ifs->ifs_ips_list == NULL) ||
3007             (fin->fin_flx & (FI_SHORT|FI_STATE|FI_FRAGBODY|FI_BAD)))
3008                 return NULL;
3009 
3010         is = NULL;
3011         if ((fin->fin_flx & FI_TCPUDP) ||
3012             (fin->fin_fi.fi_p == IPPROTO_ICMP)
3013 #ifdef  USE_INET6
3014             || (fin->fin_fi.fi_p == IPPROTO_ICMPV6)
3015 #endif
3016             )
3017                 tcp = fin->fin_dp;
3018         else
3019                 tcp = NULL;
3020 
3021         /*
3022          * Search the hash table for matching packet header info.
3023          */
3024         ifq = NULL;
3025         is = fr_stlookup(fin, tcp, &ifq);
3026         switch (fin->fin_p)
3027         {
3028 #ifdef  USE_INET6
3029         case IPPROTO_ICMPV6 :
3030                 if (is != NULL)
3031                         break;
3032                 if (fin->fin_v == 6) {
3033                         is = fr_checkicmp6matchingstate(fin);
3034                         if (is != NULL)
3035                                 goto matched;
3036                 }
3037                 break;
3038 #endif
3039         case IPPROTO_ICMP :
3040                 if (is != NULL)
3041                         break;
3042                 /*
3043                  * No matching icmp state entry. Perhaps this is a
3044                  * response to another state entry.
3045                  */
3046                 is = fr_checkicmpmatchingstate(fin);
3047                 if (is != NULL)
3048                         goto matched;
3049                 break;
3050         case IPPROTO_TCP :
3051                 if (is == NULL)
3052                         break;
3053 
3054                 if (is->is_pass & FR_NEWISN) {
3055                         if (fin->fin_out == 0)
3056                                 fr_fixinisn(fin, is);
3057                         else if (fin->fin_out == 1)
3058                                 fr_fixoutisn(fin, is);
3059                 }
3060                 break;
3061         default :
3062                 if (fin->fin_rev)
3063                         ifq = &ifs->ifs_ips_udpacktq;
3064                 else
3065                         ifq = &ifs->ifs_ips_udptq;
3066                 break;
3067         }
3068         if (is == NULL) {
3069                 ATOMIC_INCL(ifs->ifs_ips_stats.iss_miss);
3070                 return NULL;
3071         }
3072 
3073 matched:
3074         fr = is->is_rule;
3075         if (fr != NULL) {
3076                 if ((fin->fin_out == 0) && (fr->fr_nattag.ipt_num[0] != 0)) {
3077                         if (fin->fin_nattag == NULL) {
3078                                 RWLOCK_EXIT(&ifs->ifs_ipf_state);
3079                                 return NULL;
3080                         }
3081                         if (fr_matchtag(&fr->fr_nattag, fin->fin_nattag) != 0) {
3082                                 RWLOCK_EXIT(&ifs->ifs_ipf_state);
3083                                 return NULL;
3084                         }
3085                 }
3086                 (void) strncpy(fin->fin_group, fr->fr_group, FR_GROUPLEN);
3087                 fin->fin_icode = fr->fr_icode;
3088         }
3089 
3090         fin->fin_rule = is->is_rulen;
3091         pass = is->is_pass;
3092         fr_updatestate(fin, is, ifq);
3093 
3094         RWLOCK_EXIT(&ifs->ifs_ipf_state);
3095         fin->fin_flx |= FI_STATE;
3096         if ((pass & FR_LOGFIRST) != 0)
3097                 pass &= ~(FR_LOGFIRST|FR_LOG);
3098         *passp = pass;
3099         return fr;
3100 }
3101 
3102 
3103 /* ------------------------------------------------------------------------ */
3104 /* Function:    fr_fixoutisn                                                */
3105 /* Returns:     Nil                                                         */
3106 /* Parameters:  fin(I)   - pointer to packet information                    */
3107 /*              is(I)  - pointer to master state structure                  */
3108 /*                                                                          */
3109 /* Called only for outbound packets, adjusts the sequence number and the    */
3110 /* TCP checksum to match that change.                                       */
3111 /* ------------------------------------------------------------------------ */
3112 static void fr_fixoutisn(fin, is)
3113 fr_info_t *fin;
3114 ipstate_t *is;
3115 {
3116         tcphdr_t *tcp;
3117         int rev;
3118         u_32_t seq;
3119 
3120         tcp = fin->fin_dp;
3121         rev = fin->fin_rev;
3122         if ((is->is_flags & IS_ISNSYN) != 0) {
3123                 if (rev == 0) {
3124                         seq = ntohl(tcp->th_seq);
3125                         seq += is->is_isninc[0];
3126                         tcp->th_seq = htonl(seq);
3127                         fix_outcksum(&tcp->th_sum, is->is_sumd[0]);
3128                 }
3129         }
3130         if ((is->is_flags & IS_ISNACK) != 0) {
3131                 if (rev == 1) {
3132                         seq = ntohl(tcp->th_seq);
3133                         seq += is->is_isninc[1];
3134                         tcp->th_seq = htonl(seq);
3135                         fix_outcksum(&tcp->th_sum, is->is_sumd[1]);
3136                 }
3137         }
3138 }
3139 
3140 
3141 /* ------------------------------------------------------------------------ */
3142 /* Function:    fr_fixinisn                                                 */
3143 /* Returns:     Nil                                                         */
3144 /* Parameters:  fin(I)   - pointer to packet information                    */
3145 /*              is(I)  - pointer to master state structure                  */
3146 /*                                                                          */
3147 /* Called only for inbound packets, adjusts the acknowledge number and the  */
3148 /* TCP checksum to match that change.                                       */
3149 /* ------------------------------------------------------------------------ */
3150 static void fr_fixinisn(fin, is)
3151 fr_info_t *fin;
3152 ipstate_t *is;
3153 {
3154         tcphdr_t *tcp;
3155         int rev;
3156         u_32_t ack;
3157 
3158         tcp = fin->fin_dp;
3159         rev = fin->fin_rev;
3160         if ((is->is_flags & IS_ISNSYN) != 0) {
3161                 if (rev == 1) {
3162                         ack = ntohl(tcp->th_ack);
3163                         ack -= is->is_isninc[0];
3164                         tcp->th_ack = htonl(ack);
3165                         fix_incksum(&tcp->th_sum, is->is_sumd[0]);
3166                 }
3167         }
3168         if ((is->is_flags & IS_ISNACK) != 0) {
3169                 if (rev == 0) {
3170                         ack = ntohl(tcp->th_ack);
3171                         ack -= is->is_isninc[1];
3172                         tcp->th_ack = htonl(ack);
3173                         fix_incksum(&tcp->th_sum, is->is_sumd[1]);
3174                 }
3175         }
3176 }
3177 
3178 
3179 /* ------------------------------------------------------------------------ */
3180 /* Function:    fr_statesync                                                */
3181 /* Returns:     Nil                                                         */
3182 /* Parameters:  action(I) - type of synchronisation to do                   */
3183 /*              v(I)      - IP version being sync'd (v4 or v6)              */
3184 /*              ifp(I)    - interface identifier associated with action     */
3185 /*              name(I)   - name associated with ifp parameter              */
3186 /*                                                                          */
3187 /* Walk through all state entries and if an interface pointer match is      */
3188 /* found then look it up again, based on its name in case the pointer has   */
3189 /* changed since last time.                                                 */
3190 /*                                                                          */
3191 /* If ifp is passed in as being non-null then we are only doing updates for */
3192 /* existing, matching, uses of it.                                          */
3193 /* ------------------------------------------------------------------------ */
3194 void fr_statesync(action, v, ifp, name, ifs)
3195 int action, v;
3196 void *ifp;
3197 char *name;
3198 ipf_stack_t *ifs;
3199 {
3200         ipstate_t *is;
3201         int i;
3202 
3203         if (ifs->ifs_fr_running <= 0)
3204                 return;
3205 
3206         WRITE_ENTER(&ifs->ifs_ipf_state);
3207 
3208         if (ifs->ifs_fr_running <= 0) {
3209                 RWLOCK_EXIT(&ifs->ifs_ipf_state);
3210                 return;
3211         }
3212 
3213         switch (action)
3214         {
3215         case IPFSYNC_RESYNC :
3216                 for (is = ifs->ifs_ips_list; is; is = is->is_next) {
3217                         if (v != 0 && is->is_v != v)
3218                                 continue;
3219                         /*
3220                          * Look up all the interface names in the state entry.
3221                          */
3222                         for (i = 0; i < 4; i++) {
3223                                 is->is_ifp[i] = fr_resolvenic(is->is_ifname[i],
3224                                                               is->is_v, ifs);
3225                         }
3226                 }
3227                 break;
3228         case IPFSYNC_NEWIFP :
3229                 for (is = ifs->ifs_ips_list; is; is = is->is_next) {
3230                         if (v != 0 && is->is_v != v)
3231                                 continue;
3232                         /*
3233                          * Look up all the interface names in the state entry.
3234                          */
3235                         for (i = 0; i < 4; i++) {
3236                                 if (!strncmp(is->is_ifname[i], name,
3237                                              sizeof(is->is_ifname[i])))
3238                                         is->is_ifp[i] = ifp;
3239                         }
3240                 }
3241                 break;
3242         case IPFSYNC_OLDIFP :
3243                 for (is = ifs->ifs_ips_list; is; is = is->is_next) {
3244                         if (v != 0 && is->is_v != v)
3245                                 continue;
3246                         /*
3247                          * Look up all the interface names in the state entry.
3248                          */
3249                         for (i = 0; i < 4; i++) {
3250                                 if (is->is_ifp[i] == ifp)
3251                                         is->is_ifp[i] = (void *)-1;
3252                         }
3253                 }
3254                 break;
3255         }
3256         RWLOCK_EXIT(&ifs->ifs_ipf_state);
3257 }
3258 
3259 
3260 #if SOLARIS2 >= 10
3261 /* ------------------------------------------------------------------------ */
3262 /* Function:    fr_stateifindexsync                                         */
3263 /* Returns:     void                                                        */
3264 /* Parameters:  ifp     - current network interface descriptor (ifindex)    */
3265 /*              newifp  - new interface descriptor (new ifindex)            */
3266 /*              ifs     - pointer to IPF stack                              */
3267 /*                                                                          */
3268 /* Write Locks: assumes ipf_mutex is locked                                 */
3269 /*                                                                          */
3270 /* Updates all interface indeces matching to ifp with new interface index   */
3271 /* value.                                                                   */
3272 /* ------------------------------------------------------------------------ */
3273 void fr_stateifindexsync(ifp, newifp, ifs)
3274 void *ifp;
3275 void *newifp;
3276 ipf_stack_t *ifs;
3277 {
3278         ipstate_t *is;
3279         int i;
3280 
3281         WRITE_ENTER(&ifs->ifs_ipf_state);
3282 
3283         for (is = ifs->ifs_ips_list; is != NULL; is = is->is_next) {
3284 
3285                 for (i = 0; i < 4; i++) {
3286                         if (is->is_ifp[i] == ifp)
3287                                 is->is_ifp[i] = newifp;
3288                 }
3289         }
3290 
3291         RWLOCK_EXIT(&ifs->ifs_ipf_state);
3292 }
3293 #endif
3294 
3295 /* ------------------------------------------------------------------------ */
3296 /* Function:    fr_delstate                                                 */
3297 /* Returns:     int - 0 = entry deleted, else ref count on entry            */
3298 /* Parameters:  is(I)  - pointer to state structure to delete               */
3299 /*              why(I) - if not 0, log reason why it was deleted            */
3300 /*              ifs    - ipf stack instance                                 */
3301 /* Write Locks: ipf_state/ipf_global                                        */
3302 /*                                                                          */
3303 /* Deletes a state entry from the enumerated list as well as the hash table */
3304 /* and timeout queue lists.  Make adjustments to hash table statistics and  */
3305 /* global counters as required.                                             */
3306 /* ------------------------------------------------------------------------ */
3307 int fr_delstate(is, why, ifs)
3308 ipstate_t *is;
3309 int why;
3310 ipf_stack_t *ifs;
3311 {
3312         int removed = 0;
3313 
3314         ASSERT(rw_write_held(&ifs->ifs_ipf_global.ipf_lk) == 0 ||
3315                 rw_write_held(&ifs->ifs_ipf_state.ipf_lk) == 0);
3316 
3317         /*
3318          * Start by removing the entry from the hash table of state entries
3319          * so it will not be "used" again.
3320          *
3321          * It will remain in the "list" of state entries until all references
3322          * have been accounted for.
3323          */
3324         if (is->is_phnext != NULL) {
3325                 removed = 1;
3326                 *is->is_phnext = is->is_hnext;
3327                 if (is->is_hnext != NULL)
3328                         is->is_hnext->is_phnext = is->is_phnext;
3329                 if (ifs->ifs_ips_table[is->is_hv] == NULL)
3330                         ifs->ifs_ips_stats.iss_inuse--;
3331                 ifs->ifs_ips_stats.iss_bucketlen[is->is_hv]--;
3332 
3333                 is->is_phnext = NULL;
3334                 is->is_hnext = NULL;
3335         }
3336 
3337         /*
3338          * Because ifs->ifs_ips_stats.iss_wild is a count of entries in the state
3339          * table that have wildcard flags set, only decerement it once
3340          * and do it here.
3341          */
3342         if (is->is_flags & (SI_WILDP|SI_WILDA)) {
3343                 if (!(is->is_flags & SI_CLONED)) {
3344                         ATOMIC_DECL(ifs->ifs_ips_stats.iss_wild);
3345                 }
3346                 is->is_flags &= ~(SI_WILDP|SI_WILDA);
3347         }
3348 
3349         /*
3350          * Next, remove it from the timeout queue it is in.
3351          */
3352         fr_deletequeueentry(&is->is_sti);
3353 
3354         is->is_me = NULL;
3355 
3356         /*
3357          * If it is still in use by something else, do not go any further,
3358          * but note that at this point it is now an orphan.
3359          */
3360         MUTEX_ENTER(&is->is_lock);
3361         if (is->is_ref > 1) {
3362                 is->is_ref--;
3363                 MUTEX_EXIT(&is->is_lock);
3364                 if (removed)
3365                         ifs->ifs_ips_stats.iss_orphans++;
3366                 return (is->is_ref);
3367         }
3368         MUTEX_EXIT(&is->is_lock);
3369 
3370         is->is_ref = 0;
3371 
3372         /*
3373          * If entry has already been removed from table,
3374          * it means we're simply cleaning up an orphan.
3375          */
3376         if (!removed)
3377                 ifs->ifs_ips_stats.iss_orphans--;
3378 
3379         if (is->is_tqehead[0] != NULL)
3380                 (void) fr_deletetimeoutqueue(is->is_tqehead[0]);
3381 
3382         if (is->is_tqehead[1] != NULL)
3383                 (void) fr_deletetimeoutqueue(is->is_tqehead[1]);
3384 
3385 #ifdef  IPFILTER_SYNC
3386         if (is->is_sync)
3387                 ipfsync_del(is->is_sync);
3388 #endif
3389 #ifdef  IPFILTER_SCAN
3390         (void) ipsc_detachis(is);
3391 #endif
3392 
3393         /*
3394          * Now remove it from master list of state table entries.
3395          */
3396         if (is->is_pnext != NULL) {
3397                 *is->is_pnext = is->is_next;
3398                 if (is->is_next != NULL) {
3399                         is->is_next->is_pnext = is->is_pnext;
3400                         is->is_next = NULL;
3401                 }
3402                 is->is_pnext = NULL;
3403         }
3404  
3405         if (ifs->ifs_ipstate_logging != 0 && why != 0)
3406                 ipstate_log(is, why, ifs);
3407 #if 0
3408         /*
3409          * For now, ipf_log_cfwlog() copes with all "why" values. Strictly
3410          * speaking, though, they all map to one event (CFWEV_END), which for
3411          * now is not supported, hence the #if 0.
3412          */
3413         if (why != 0 && IFS_CFWLOG(ifs, is->is_rule))
3414                 ipf_log_cfwlog(is, why, ifs);
3415 #endif
3416         if (is->is_rule != NULL) {
3417                 is->is_rule->fr_statecnt--;
3418                 (void)fr_derefrule(&is->is_rule, ifs);
3419         }
3420 
3421         MUTEX_DESTROY(&is->is_lock);
3422         KFREE(is);
3423         ifs->ifs_ips_num--;
3424 
3425         return (0);
3426 }
3427 
3428 
3429 /* ------------------------------------------------------------------------ */
3430 /* Function:    fr_timeoutstate                                             */
3431 /* Returns:     Nil                                                         */
3432 /* Parameters:  ifs - ipf stack instance                                    */
3433 /*                                                                          */
3434 /* Slowly expire held state for thingslike UDP and ICMP.  The algorithm     */
3435 /* used here is to keep the queue sorted with the oldest things at the top  */
3436 /* and the youngest at the bottom.  So if the top one doesn't need to be    */
3437 /* expired then neither will any under it.                                  */
3438 /* ------------------------------------------------------------------------ */
3439 void fr_timeoutstate(ifs)
3440 ipf_stack_t *ifs;
3441 {
3442         ipftq_t *ifq, *ifqnext;
3443         ipftqent_t *tqe, *tqn;
3444         ipstate_t *is;
3445         SPL_INT(s);
3446 
3447         SPL_NET(s);
3448         WRITE_ENTER(&ifs->ifs_ipf_state);
3449         for (ifq = ifs->ifs_ips_tqtqb; ifq != NULL; ifq = ifq->ifq_next)
3450                 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) {
3451                         if (tqe->tqe_die > ifs->ifs_fr_ticks)
3452                                 break;
3453                         tqn = tqe->tqe_next;
3454                         is = tqe->tqe_parent;
3455                         (void) fr_delstate(is, ISL_EXPIRE, ifs);
3456                 }
3457 
3458         for (ifq = ifs->ifs_ips_utqe; ifq != NULL; ifq = ifq->ifq_next) {
3459                 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) {
3460                         if (tqe->tqe_die > ifs->ifs_fr_ticks)
3461                                 break;
3462                         tqn = tqe->tqe_next;
3463                         is = tqe->tqe_parent;
3464                         (void) fr_delstate(is, ISL_EXPIRE, ifs);
3465                 }
3466         }
3467 
3468         for (ifq = ifs->ifs_ips_utqe; ifq != NULL; ifq = ifqnext) {
3469                 ifqnext = ifq->ifq_next;
3470 
3471                 if (((ifq->ifq_flags & IFQF_DELETE) != 0) &&
3472                     (ifq->ifq_ref == 0)) {
3473                         fr_freetimeoutqueue(ifq, ifs);
3474                 }
3475         }
3476 
3477         if (ifs->ifs_fr_state_doflush) {
3478                 (void) fr_state_flush(FLUSH_TABLE_EXTRA, 0, ifs);
3479                 ifs->ifs_fr_state_doflush = 0;
3480         }
3481         RWLOCK_EXIT(&ifs->ifs_ipf_state);
3482         SPL_X(s);
3483 }
3484 
3485 
3486 /* ---------------------------------------------------------------------- */
3487 /* Function:    fr_state_flush                                            */
3488 /* Returns:     int - 0 == success, -1 == failure                         */
3489 /* Parameters:  flush_option - how to flush the active State table        */
3490 /*              proto    - IP version to flush (4, 6, or both)            */
3491 /*              ifs      - ipf stack instance                             */
3492 /* Write Locks: ipf_state                                                 */
3493 /*                                                                        */
3494 /* Flush state tables.  Three possible flush options currently defined:   */
3495 /*                                                                        */
3496 /* FLUSH_TABLE_ALL      : Flush all state table entries                   */
3497 /*                                                                        */
3498 /* FLUSH_TABLE_CLOSING  : Flush entries with TCP connections which        */
3499 /*                        have started to close on both ends using        */
3500 /*                        ipf_flushclosing().                             */
3501 /*                                                                        */
3502 /* FLUSH_TABLE_EXTRA    : First, flush entries which are "almost" closed. */
3503 /*                        Then, if needed, flush entries with TCP         */
3504 /*                        connections which have been idle for a long     */
3505 /*                        time with ipf_extraflush().                     */
3506 /* ---------------------------------------------------------------------- */
3507 static int fr_state_flush(flush_option, proto, ifs)
3508 int flush_option, proto;
3509 ipf_stack_t *ifs;
3510 {
3511         ipstate_t *is, *isn;
3512         int removed;
3513         SPL_INT(s);
3514 
3515         removed = 0;
3516 
3517         SPL_NET(s);
3518         switch (flush_option)
3519         {
3520         case FLUSH_TABLE_ALL:
3521                 isn = ifs->ifs_ips_list;
3522                 while ((is = isn) != NULL) {
3523                         isn = is->is_next;
3524                         if ((proto != 0) && (is->is_v != proto))
3525                                 continue;
3526                         if (fr_delstate(is, ISL_FLUSH, ifs) == 0)
3527                                 removed++;
3528                 }
3529                 break;
3530 
3531         case FLUSH_TABLE_CLOSING:
3532                 removed = ipf_flushclosing(STATE_FLUSH,
3533                                            IPF_TCPS_CLOSE_WAIT,
3534                                            ifs->ifs_ips_tqtqb,
3535                                            ifs->ifs_ips_utqe,
3536                                            ifs);
3537                 break;
3538 
3539         case FLUSH_TABLE_EXTRA:
3540                 removed = ipf_flushclosing(STATE_FLUSH,
3541                                            IPF_TCPS_FIN_WAIT_2,
3542                                            ifs->ifs_ips_tqtqb,
3543                                            ifs->ifs_ips_utqe,
3544                                            ifs);
3545 
3546                 /*
3547                  * Be sure we haven't done this in the last 10 seconds.
3548                  */
3549                 if (ifs->ifs_fr_ticks - ifs->ifs_ips_last_force_flush <
3550                     IPF_TTLVAL(10))
3551                         break;
3552                 ifs->ifs_ips_last_force_flush = ifs->ifs_fr_ticks;
3553                 removed += ipf_extraflush(STATE_FLUSH,
3554                                           &ifs->ifs_ips_tqtqb[IPF_TCPS_ESTABLISHED],
3555                                           ifs->ifs_ips_utqe,
3556                                           ifs);
3557                 break;
3558 
3559         default: /* Flush Nothing */
3560                 break;
3561         }
3562 
3563         SPL_X(s);
3564         return (removed);
3565 }
3566 
3567 
3568 /* ------------------------------------------------------------------------ */
3569 /* Function:    fr_tcp_age                                                  */
3570 /* Returns:     int - 1 == state transition made, 0 == no change (rejected) */
3571 /* Parameters:  tq(I)    - pointer to timeout queue information             */
3572 /*              fin(I)   - pointer to packet information                    */
3573 /*              tqtab(I) - TCP timeout queue table this is in               */
3574 /*              flags(I) - flags from state/NAT entry                       */
3575 /*                                                                          */
3576 /* Rewritten by Arjan de Vet <Arjan.deVet@adv.iae.nl>, 2000-07-29:          */
3577 /*                                                                          */
3578 /* - (try to) base state transitions on real evidence only,                 */
3579 /*   i.e. packets that are sent and have been received by ipfilter;         */
3580 /*   diagram 18.12 of TCP/IP volume 1 by W. Richard Stevens was used.       */
3581 /*                                                                          */
3582 /* - deal with half-closed connections correctly;                           */
3583 /*                                                                          */
3584 /* - store the state of the source in state[0] such that ipfstat            */
3585 /*   displays the state as source/dest instead of dest/source; the calls    */
3586 /*   to fr_tcp_age have been changed accordingly.                           */
3587 /*                                                                          */
3588 /* Internal Parameters:                                                     */
3589 /*                                                                          */
3590 /*    state[0] = state of source (host that initiated connection)           */
3591 /*    state[1] = state of dest   (host that accepted the connection)        */
3592 /*                                                                          */
3593 /*    dir == 0 : a packet from source to dest                               */
3594 /*    dir == 1 : a packet from dest to source                               */
3595 /*                                                                          */
3596 /* Locking: it is assumed that the parent of the tqe structure is locked.   */
3597 /* ------------------------------------------------------------------------ */
3598 int fr_tcp_age(tqe, fin, tqtab, flags)
3599 ipftqent_t *tqe;
3600 fr_info_t *fin;
3601 ipftq_t *tqtab;
3602 int flags;
3603 {
3604         int dlen, ostate, nstate, rval, dir;
3605         u_char tcpflags;
3606         tcphdr_t *tcp;
3607         ipf_stack_t *ifs = fin->fin_ifs;
3608 
3609         tcp = fin->fin_dp;
3610 
3611         rval = 0;
3612         dir = fin->fin_rev;
3613         tcpflags = tcp->th_flags;
3614         dlen = fin->fin_dlen - (TCP_OFF(tcp) << 2);
3615 
3616         ostate = tqe->tqe_state[1 - dir];
3617         nstate = tqe->tqe_state[dir];
3618 
3619         DTRACE_PROBE4(
3620                 indata,
3621                 fr_info_t *, fin,
3622                 int, ostate,
3623                 int, nstate,
3624                 u_char, tcpflags
3625         );
3626 
3627         if (tcpflags & TH_RST) {
3628                 if (!(tcpflags & TH_PUSH) && !dlen)
3629                         nstate = IPF_TCPS_CLOSED;
3630                 else
3631                         nstate = IPF_TCPS_CLOSE_WAIT;
3632 
3633                 /*
3634                  * Once RST is received, we must advance peer's state to
3635                  * CLOSE_WAIT.
3636                  */
3637                 if (ostate <= IPF_TCPS_ESTABLISHED) {
3638                         tqe->tqe_state[1 - dir] = IPF_TCPS_CLOSE_WAIT;
3639                 }
3640                 rval = 1;
3641         } else {
3642 
3643                 switch (nstate)
3644                 {
3645                 case IPF_TCPS_LISTEN: /* 0 */
3646                         if ((tcpflags & TH_OPENING) == TH_OPENING) {
3647                                 /*
3648                                  * 'dir' received an S and sends SA in
3649                                  * response, CLOSED -> SYN_RECEIVED
3650                                  */
3651                                 nstate = IPF_TCPS_SYN_RECEIVED;
3652                                 rval = 1;
3653                         } else if ((tcpflags & TH_OPENING) == TH_SYN) {
3654                                 /* 'dir' sent S, CLOSED -> SYN_SENT */
3655                                 nstate = IPF_TCPS_SYN_SENT;
3656                                 rval = 1;
3657                         }
3658                         /*
3659                          * the next piece of code makes it possible to get
3660                          * already established connections into the state table
3661                          * after a restart or reload of the filter rules; this
3662                          * does not work when a strict 'flags S keep state' is
3663                          * used for tcp connections of course
3664                          */
3665                         if (((flags & IS_TCPFSM) == 0) &&
3666                             ((tcpflags & TH_ACKMASK) == TH_ACK)) {
3667                                 /*
3668                                  * we saw an A, guess 'dir' is in ESTABLISHED
3669                                  * mode
3670                                  */
3671                                 switch (ostate)
3672                                 {
3673                                 case IPF_TCPS_LISTEN :
3674                                 case IPF_TCPS_SYN_RECEIVED :
3675                                         nstate = IPF_TCPS_HALF_ESTAB;
3676                                         rval = 1;
3677                                         break;
3678                                 case IPF_TCPS_HALF_ESTAB :
3679                                 case IPF_TCPS_ESTABLISHED :
3680                                         nstate = IPF_TCPS_ESTABLISHED;
3681                                         rval = 1;
3682                                         break;
3683                                 default :
3684                                         break;
3685                                 }
3686                         }
3687                         /*
3688                          * TODO: besides regular ACK packets we can have other
3689                          * packets as well; it is yet to be determined how we
3690                          * should initialize the states in those cases
3691                          */
3692                         break;
3693 
3694                 case IPF_TCPS_SYN_SENT: /* 1 */
3695                         if ((tcpflags & ~(TH_ECN|TH_CWR)) == TH_SYN) {
3696                                 /*
3697                                  * A retransmitted SYN packet.  We do not reset
3698                                  * the timeout here to fr_tcptimeout because a
3699                                  * connection connect timeout does not renew
3700                                  * after every packet that is sent.  We need to
3701                                  * set rval so as to indicate the packet has
3702                                  * passed the check for its flags being valid
3703                                  * in the TCP FSM.  Setting rval to 2 has the
3704                                  * result of not resetting the timeout.
3705                                  */
3706                                 rval = 2;
3707                         } else if ((tcpflags & (TH_SYN|TH_FIN|TH_ACK)) ==
3708                                    TH_ACK) {
3709                                 /*
3710                                  * we see an A from 'dir' which is in SYN_SENT
3711                                  * state: 'dir' sent an A in response to an SA
3712                                  * which it received, SYN_SENT -> ESTABLISHED
3713                                  */
3714                                 nstate = IPF_TCPS_ESTABLISHED;
3715                                 rval = 1;
3716                         } else if (tcpflags & TH_FIN) {
3717                                 /*
3718                                  * we see an F from 'dir' which is in SYN_SENT
3719                                  * state and wants to close its side of the
3720                                  * connection; SYN_SENT -> FIN_WAIT_1
3721                                  */
3722                                 nstate = IPF_TCPS_FIN_WAIT_1;
3723                                 rval = 1;
3724                         } else if ((tcpflags & TH_OPENING) == TH_OPENING) {
3725                                 /*
3726                                  * we see an SA from 'dir' which is already in
3727                                  * SYN_SENT state, this means we have a
3728                                  * simultaneous open; SYN_SENT -> SYN_RECEIVED
3729                                  */
3730                                 nstate = IPF_TCPS_SYN_RECEIVED;
3731                                 rval = 1;
3732                         }
3733                         break;
3734 
3735                 case IPF_TCPS_SYN_RECEIVED: /* 2 */
3736                         if ((tcpflags & (TH_SYN|TH_FIN|TH_ACK)) == TH_ACK) {
3737                                 /*
3738                                  * we see an A from 'dir' which was in
3739                                  * SYN_RECEIVED state so it must now be in
3740                                  * established state, SYN_RECEIVED ->
3741                                  * ESTABLISHED
3742                                  */
3743                                 nstate = IPF_TCPS_ESTABLISHED;
3744                                 rval = 1;
3745                         } else if ((tcpflags & ~(TH_ECN|TH_CWR)) ==
3746                                    TH_OPENING) {
3747                                 /*
3748                                  * We see an SA from 'dir' which is already in
3749                                  * SYN_RECEIVED state.
3750                                  */
3751                                 rval = 2;
3752                         } else if (tcpflags & TH_FIN) {
3753                                 /*
3754                                  * we see an F from 'dir' which is in
3755                                  * SYN_RECEIVED state and wants to close its
3756                                  * side of the connection; SYN_RECEIVED ->
3757                                  * FIN_WAIT_1
3758                                  */
3759                                 nstate = IPF_TCPS_FIN_WAIT_1;
3760                                 rval = 1;
3761                         }
3762                         break;
3763 
3764                 case IPF_TCPS_HALF_ESTAB: /* 3 */
3765                         if (tcpflags & TH_FIN) {
3766                                 nstate = IPF_TCPS_FIN_WAIT_1;
3767                                 rval = 1;
3768                         } else if ((tcpflags & TH_ACKMASK) == TH_ACK) {
3769                                 /*
3770                                  * If we've picked up a connection in mid
3771                                  * flight, we could be looking at a follow on
3772                                  * packet from the same direction as the one
3773                                  * that created this state.  Recognise it but
3774                                  * do not advance the entire connection's
3775                                  * state.
3776                                  */
3777                                 switch (ostate)
3778                                 {
3779                                 case IPF_TCPS_LISTEN :
3780                                 case IPF_TCPS_SYN_SENT :
3781                                 case IPF_TCPS_SYN_RECEIVED :
3782                                         rval = 1;
3783                                         break;
3784                                 case IPF_TCPS_HALF_ESTAB :
3785                                 case IPF_TCPS_ESTABLISHED :
3786                                         nstate = IPF_TCPS_ESTABLISHED;
3787                                         rval = 1;
3788                                         break;
3789                                 default :
3790                                         break;
3791                                 }
3792                         }
3793                         break;
3794 
3795                 case IPF_TCPS_ESTABLISHED: /* 4 */
3796                         rval = 1;
3797                         if (tcpflags & TH_FIN) {
3798                                 /*
3799                                  * 'dir' closed its side of the connection;
3800                                  * this gives us a half-closed connection;
3801                                  * ESTABLISHED -> FIN_WAIT_1
3802                                  */
3803                                 if (ostate == IPF_TCPS_FIN_WAIT_1) {
3804                                         nstate = IPF_TCPS_CLOSING;
3805                                 } else {
3806                                         nstate = IPF_TCPS_FIN_WAIT_1;
3807                                 }
3808                         } else if (tcpflags & TH_ACK) {
3809                                 /*
3810                                  * an ACK, should we exclude other flags here?
3811                                  */
3812                                 if (ostate == IPF_TCPS_FIN_WAIT_1) {
3813                                         /*
3814                                          * We know the other side did an active
3815                                          * close, so we are ACKing the recvd
3816                                          * FIN packet (does the window matching
3817                                          * code guarantee this?) and go into
3818                                          * CLOSE_WAIT state; this gives us a
3819                                          * half-closed connection
3820                                          */
3821                                         nstate = IPF_TCPS_CLOSE_WAIT;
3822                                 } else if (ostate < IPF_TCPS_CLOSE_WAIT) {
3823                                         /*
3824                                          * still a fully established
3825                                          * connection reset timeout
3826                                          */
3827                                         nstate = IPF_TCPS_ESTABLISHED;
3828                                 }
3829                         }
3830                         break;
3831 
3832                 case IPF_TCPS_CLOSE_WAIT: /* 5 */
3833                         rval = 1;
3834                         if (tcpflags & TH_FIN) {
3835                                 /*
3836                                  * application closed and 'dir' sent a FIN,
3837                                  * we're now going into LAST_ACK state
3838                                  */
3839                                 nstate = IPF_TCPS_LAST_ACK;
3840                         } else {
3841                                 /*
3842                                  * we remain in CLOSE_WAIT because the other
3843                                  * side has closed already and we did not
3844                                  * close our side yet; reset timeout
3845                                  */
3846                                 nstate = IPF_TCPS_CLOSE_WAIT;
3847                         }
3848                         break;
3849 
3850                 case IPF_TCPS_FIN_WAIT_1: /* 6 */
3851                         rval = 1;
3852                         if ((tcpflags & TH_ACK) &&
3853                             ostate > IPF_TCPS_CLOSE_WAIT) {
3854                                 /*
3855                                  * if the other side is not active anymore
3856                                  * it has sent us a FIN packet that we are
3857                                  * ack'ing now with an ACK; this means both
3858                                  * sides have now closed the connection and
3859                                  * we go into LAST_ACK
3860                                  */
3861                                 /*
3862                                  * XXX: how do we know we really are ACKing
3863                                  * the FIN packet here? does the window code
3864                                  * guarantee that?
3865                                  */
3866                                 nstate = IPF_TCPS_LAST_ACK;
3867                         } else {
3868                                 /*
3869                                  * we closed our side of the connection
3870                                  * already but the other side is still active
3871                                  * (ESTABLISHED/CLOSE_WAIT); continue with
3872                                  * this half-closed connection
3873                                  */
3874                                 nstate = IPF_TCPS_FIN_WAIT_1;
3875                         }
3876                         break;
3877 
3878                 case IPF_TCPS_CLOSING: /* 7 */
3879                         if ((tcpflags & (TH_FIN|TH_ACK)) == TH_ACK) {
3880                                 nstate = IPF_TCPS_TIME_WAIT;
3881                         }
3882                         rval = 1;
3883                         break;
3884 
3885                 case IPF_TCPS_LAST_ACK: /* 8 */
3886                         /*
3887                          * We want to reset timer here to keep state in table.
3888                          * If we would allow the state to time out here, while
3889                          * there would still be packets being retransmitted, we
3890                          * would cut off line between the two peers preventing
3891                          * them to close connection properly. 
3892                          */
3893                         rval = 1;
3894                         break;
3895 
3896                 case IPF_TCPS_FIN_WAIT_2: /* 9 */
3897                         /* NOT USED */
3898                         break;
3899 
3900                 case IPF_TCPS_TIME_WAIT: /* 10 */
3901                         /* we're in 2MSL timeout now */
3902                         if (ostate == IPF_TCPS_LAST_ACK) {
3903                                 nstate = IPF_TCPS_CLOSED;
3904                                 rval = 1;
3905                         } else {
3906                                 rval = 2;
3907                         }
3908                         break;
3909 
3910                 case IPF_TCPS_CLOSED: /* 11 */
3911                         rval = 2;
3912                         break;
3913 
3914                 default :
3915 #if defined(_KERNEL)
3916                         ASSERT(nstate >= IPF_TCPS_LISTEN &&
3917                             nstate <= IPF_TCPS_CLOSED);
3918 #else
3919                         abort();
3920 #endif
3921                         break;
3922                 }
3923         }
3924 
3925         /*
3926          * If rval == 2 then do not update the queue position, but treat the
3927          * packet as being ok.
3928          */
3929         if (rval == 2) {
3930                 DTRACE_PROBE1(state_keeping_timer, int, nstate);
3931                 rval = 1;
3932         }
3933         else if (rval == 1) {
3934                 tqe->tqe_state[dir] = nstate;
3935                 /*
3936                  * The nstate can either advance to a new state, or remain
3937                  * unchanged, resetting the timer by moving to the bottom of
3938                  * the queue.
3939                  */
3940                 DTRACE_PROBE1(state_done, int, nstate);
3941 
3942                 if ((tqe->tqe_flags & TQE_RULEBASED) == 0)
3943                         fr_movequeue(tqe, tqe->tqe_ifq, tqtab + nstate, ifs);
3944         }
3945 
3946         return rval;
3947 }
3948 
3949 /* ------------------------------------------------------------------------ */
3950 /* Function:    ipstate_log                                                 */
3951 /* Returns:     Nil                                                         */
3952 /* Parameters:  is(I)   - pointer to state structure                        */
3953 /*              type(I) - type of log entry to create                       */
3954 /*                                                                          */
3955 /* Creates a state table log entry using the state structure and type info. */
3956 /* passed in.  Log packet/byte counts, source/destination address and other */
3957 /* protocol specific information.                                           */
3958 /* ------------------------------------------------------------------------ */
3959 void ipstate_log(is, type, ifs)
3960 struct ipstate *is;
3961 u_int type;
3962 ipf_stack_t *ifs;
3963 {
3964 #ifdef  IPFILTER_LOG
3965         struct  ipslog  ipsl;
3966         size_t sizes[1];
3967         void *items[1];
3968         int types[1];
3969 
3970         /*
3971          * Copy information out of the ipstate_t structure and into the
3972          * structure used for logging.
3973          */
3974         ipsl.isl_type = type;
3975         ipsl.isl_pkts[0] = is->is_pkts[0] + is->is_icmppkts[0];
3976         ipsl.isl_bytes[0] = is->is_bytes[0];
3977         ipsl.isl_pkts[1] = is->is_pkts[1] + is->is_icmppkts[1];
3978         ipsl.isl_bytes[1] = is->is_bytes[1];
3979         ipsl.isl_pkts[2] = is->is_pkts[2] + is->is_icmppkts[2];
3980         ipsl.isl_bytes[2] = is->is_bytes[2];
3981         ipsl.isl_pkts[3] = is->is_pkts[3] + is->is_icmppkts[3];
3982         ipsl.isl_bytes[3] = is->is_bytes[3];
3983         ipsl.isl_src = is->is_src;
3984         ipsl.isl_dst = is->is_dst;
3985         ipsl.isl_p = is->is_p;
3986         ipsl.isl_v = is->is_v;
3987         ipsl.isl_flags = is->is_flags;
3988         ipsl.isl_tag = is->is_tag;
3989         ipsl.isl_rulen = is->is_rulen;
3990         (void) strncpy(ipsl.isl_group, is->is_group, FR_GROUPLEN);
3991 
3992         if (ipsl.isl_p == IPPROTO_TCP || ipsl.isl_p == IPPROTO_UDP) {
3993                 ipsl.isl_sport = is->is_sport;
3994                 ipsl.isl_dport = is->is_dport;
3995                 if (ipsl.isl_p == IPPROTO_TCP) {
3996                         ipsl.isl_state[0] = is->is_state[0];
3997                         ipsl.isl_state[1] = is->is_state[1];
3998                 }
3999         } else if (ipsl.isl_p == IPPROTO_ICMP) {
4000                 ipsl.isl_itype = is->is_icmp.ici_type;
4001         } else if (ipsl.isl_p == IPPROTO_ICMPV6) {
4002                 ipsl.isl_itype = is->is_icmp.ici_type;
4003         } else {
4004                 ipsl.isl_ps.isl_filler[0] = 0;
4005                 ipsl.isl_ps.isl_filler[1] = 0;
4006         }
4007 
4008         items[0] = &ipsl;
4009         sizes[0] = sizeof(ipsl);
4010         types[0] = 0;
4011 
4012         if (ipllog(IPL_LOGSTATE, NULL, items, sizes, types, 1, ifs)) {
4013                 ATOMIC_INCL(ifs->ifs_ips_stats.iss_logged);
4014         } else {
4015                 ATOMIC_INCL(ifs->ifs_ips_stats.iss_logfail);
4016         }
4017 #endif
4018 }
4019 
4020 
4021 #ifdef  USE_INET6
4022 /* ------------------------------------------------------------------------ */
4023 /* Function:    fr_checkicmp6matchingstate                                  */
4024 /* Returns:     ipstate_t* - NULL == no match found,                        */
4025 /*                           else  pointer to matching state entry          */
4026 /* Parameters:  fin(I) - pointer to packet information                      */
4027 /* Locks:       NULL == no locks, else Read Lock on ipf_state               */
4028 /*                                                                          */
4029 /* If we've got an ICMPv6 error message, using the information stored in    */
4030 /* the ICMPv6 packet, look for a matching state table entry.                */
4031 /* ------------------------------------------------------------------------ */
4032 static ipstate_t *fr_checkicmp6matchingstate(fin)
4033 fr_info_t *fin;
4034 {
4035         struct icmp6_hdr *ic6, *oic;
4036         int backward, i;
4037         ipstate_t *is, **isp;
4038         u_short sport, dport;
4039         i6addr_t dst, src;
4040         u_short savelen;
4041         icmpinfo_t *ic;
4042         fr_info_t ofin;
4043         tcphdr_t *tcp;
4044         ip6_t *oip6;
4045         u_char  pr;
4046         u_int hv;
4047         ipf_stack_t *ifs = fin->fin_ifs;
4048 
4049         /*
4050          * Does it at least have the return (basic) IP header ?
4051          * Is it an actual recognised ICMP error type?
4052          * Only a basic IP header (no options) should be with
4053          * an ICMP error header.
4054          */
4055         if ((fin->fin_v != 6) || (fin->fin_plen < ICMP6ERR_MINPKTLEN) ||
4056             !(fin->fin_flx & FI_ICMPERR))
4057                 return NULL;
4058 
4059         ic6 = fin->fin_dp;
4060 
4061         oip6 = (ip6_t *)((char *)ic6 + ICMPERR_ICMPHLEN);
4062         if (fin->fin_plen < sizeof(*oip6))
4063                 return NULL;
4064 
4065         bcopy((char *)fin, (char *)&ofin, sizeof(*fin));
4066         ofin.fin_v = 6;
4067         ofin.fin_ifp = fin->fin_ifp;
4068         ofin.fin_out = !fin->fin_out;
4069         ofin.fin_m = NULL;      /* if dereferenced, panic XXX */
4070         ofin.fin_mp = NULL;     /* if dereferenced, panic XXX */
4071 
4072         /*
4073          * We make a fin entry to be able to feed it to
4074          * matchsrcdst. Note that not all fields are necessary
4075          * but this is the cleanest way. Note further we fill
4076          * in fin_mp such that if someone uses it we'll get
4077          * a kernel panic. fr_matchsrcdst does not use this.
4078          *
4079          * watch out here, as ip is in host order and oip6 in network
4080          * order. Any change we make must be undone afterwards.
4081          */
4082         savelen = oip6->ip6_plen;
4083         oip6->ip6_plen = fin->fin_dlen - ICMPERR_ICMPHLEN;
4084         ofin.fin_flx = FI_NOCKSUM;
4085         ofin.fin_ip = (ip_t *)oip6;
4086         ofin.fin_plen = oip6->ip6_plen;
4087         (void) fr_makefrip(sizeof(*oip6), (ip_t *)oip6, &ofin);
4088         ofin.fin_flx &= ~(FI_BAD|FI_SHORT);
4089         oip6->ip6_plen = savelen;
4090 
4091         if (oip6->ip6_nxt == IPPROTO_ICMPV6) {
4092                 oic = (struct icmp6_hdr *)(oip6 + 1);
4093                 /*
4094                  * an ICMP error can only be generated as a result of an
4095                  * ICMP query, not as the response on an ICMP error
4096                  *
4097                  * XXX theoretically ICMP_ECHOREP and the other reply's are
4098                  * ICMP query's as well, but adding them here seems strange XXX
4099                  */
4100                  if (!(oic->icmp6_type & ICMP6_INFOMSG_MASK))
4101                         return NULL;
4102 
4103                 /*
4104                  * perform a lookup of the ICMP packet in the state table
4105                  */
4106                 hv = (pr = oip6->ip6_nxt);
4107                 src.in6 = oip6->ip6_src;
4108                 hv += src.in4.s_addr;
4109                 dst.in6 = oip6->ip6_dst;
4110                 hv += dst.in4.s_addr;
4111                 hv += oic->icmp6_id;
4112                 hv += oic->icmp6_seq;
4113                 hv = DOUBLE_HASH(hv, ifs);
4114 
4115                 READ_ENTER(&ifs->ifs_ipf_state);
4116                 for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) {
4117                         ic = &is->is_icmp;
4118                         isp = &is->is_hnext;
4119                         if ((is->is_p == pr) &&
4120                             !(is->is_pass & FR_NOICMPERR) &&
4121                             (oic->icmp6_id == ic->ici_id) &&
4122                             (oic->icmp6_seq == ic->ici_seq) &&
4123                             (is = fr_matchsrcdst(&ofin, is, &src,
4124                                                  &dst, NULL, FI_ICMPCMP))) {
4125                                 /*
4126                                  * in the state table ICMP query's are stored
4127                                  * with the type of the corresponding ICMP
4128                                  * response. Correct here
4129                                  */
4130                                 if (((ic->ici_type == ICMP6_ECHO_REPLY) &&
4131                                      (oic->icmp6_type == ICMP6_ECHO_REQUEST)) ||
4132                                      (ic->ici_type - 1 == oic->icmp6_type )) {
4133                                         ifs->ifs_ips_stats.iss_hits++;
4134                                         backward = IP6_NEQ(&is->is_dst, &src);
4135                                         fin->fin_rev = !backward;
4136                                         i = (backward << 1) + fin->fin_out;
4137                                         is->is_icmppkts[i]++;
4138                                         return is;
4139                                 }
4140                         }
4141                 }
4142                 RWLOCK_EXIT(&ifs->ifs_ipf_state);
4143                 return NULL;
4144         }
4145 
4146         hv = (pr = oip6->ip6_nxt);
4147         src.in6 = oip6->ip6_src;
4148         hv += src.i6[0];
4149         hv += src.i6[1];
4150         hv += src.i6[2];
4151         hv += src.i6[3];
4152         dst.in6 = oip6->ip6_dst;
4153         hv += dst.i6[0];
4154         hv += dst.i6[1];
4155         hv += dst.i6[2];
4156         hv += dst.i6[3];
4157 
4158         if ((oip6->ip6_nxt == IPPROTO_TCP) || (oip6->ip6_nxt == IPPROTO_UDP)) {
4159                 tcp = (tcphdr_t *)(oip6 + 1);
4160                 dport = tcp->th_dport;
4161                 sport = tcp->th_sport;
4162                 hv += dport;
4163                 hv += sport;
4164         } else
4165                 tcp = NULL;
4166         hv = DOUBLE_HASH(hv, ifs);
4167 
4168         READ_ENTER(&ifs->ifs_ipf_state);
4169         for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) {
4170                 isp = &is->is_hnext;
4171                 /*
4172                  * Only allow this icmp though if the
4173                  * encapsulated packet was allowed through the
4174                  * other way around. Note that the minimal amount
4175                  * of info present does not allow for checking against
4176                  * tcp internals such as seq and ack numbers.
4177                  */
4178                 if ((is->is_p != pr) || (is->is_v != 6) ||
4179                     (is->is_pass & FR_NOICMPERR))
4180                         continue;
4181                 is = fr_matchsrcdst(&ofin, is, &src, &dst, tcp, FI_ICMPCMP);
4182                 if (is != NULL) {
4183                         ifs->ifs_ips_stats.iss_hits++;
4184                         backward = IP6_NEQ(&is->is_dst, &src);
4185                         fin->fin_rev = !backward;
4186                         i = (backward << 1) + fin->fin_out;
4187                         is->is_icmppkts[i]++;
4188                         /*
4189                          * we deliberately do not touch the timeouts
4190                          * for the accompanying state table entry.
4191                          * It remains to be seen if that is correct. XXX
4192                          */
4193                         return is;
4194                 }
4195         }
4196         RWLOCK_EXIT(&ifs->ifs_ipf_state);
4197         return NULL;
4198 }
4199 #endif
4200 
4201 
4202 /* ------------------------------------------------------------------------ */
4203 /* Function:    fr_sttab_init                                               */
4204 /* Returns:     Nil                                                         */
4205 /* Parameters:  tqp(I) - pointer to an array of timeout queues for TCP      */
4206 /*                                                                          */
4207 /* Initialise the array of timeout queues for TCP.                          */
4208 /* ------------------------------------------------------------------------ */
4209 void fr_sttab_init(tqp, ifs)
4210 ipftq_t *tqp;
4211 ipf_stack_t *ifs;
4212 {
4213         int i;
4214 
4215         for (i = IPF_TCP_NSTATES - 1; i >= 0; i--) {
4216                 tqp[i].ifq_ttl = 0;
4217                 tqp[i].ifq_ref = 1;
4218                 tqp[i].ifq_head = NULL;
4219                 tqp[i].ifq_tail = &tqp[i].ifq_head;
4220                 tqp[i].ifq_next = tqp + i + 1;
4221                 MUTEX_INIT(&tqp[i].ifq_lock, "ipftq tcp tab");
4222         }
4223         tqp[IPF_TCP_NSTATES - 1].ifq_next = NULL;
4224         tqp[IPF_TCPS_CLOSED].ifq_ttl = ifs->ifs_fr_tcpclosed;
4225         tqp[IPF_TCPS_LISTEN].ifq_ttl = ifs->ifs_fr_tcptimeout;
4226         tqp[IPF_TCPS_SYN_SENT].ifq_ttl = ifs->ifs_fr_tcptimeout;
4227         tqp[IPF_TCPS_SYN_RECEIVED].ifq_ttl = ifs->ifs_fr_tcptimeout;
4228         tqp[IPF_TCPS_ESTABLISHED].ifq_ttl = ifs->ifs_fr_tcpidletimeout;
4229         tqp[IPF_TCPS_CLOSE_WAIT].ifq_ttl = ifs->ifs_fr_tcphalfclosed;
4230         tqp[IPF_TCPS_FIN_WAIT_1].ifq_ttl = ifs->ifs_fr_tcphalfclosed;
4231         tqp[IPF_TCPS_CLOSING].ifq_ttl = ifs->ifs_fr_tcptimeout;
4232         tqp[IPF_TCPS_LAST_ACK].ifq_ttl = ifs->ifs_fr_tcplastack;
4233         tqp[IPF_TCPS_FIN_WAIT_2].ifq_ttl = ifs->ifs_fr_tcpclosewait;
4234         tqp[IPF_TCPS_TIME_WAIT].ifq_ttl = ifs->ifs_fr_tcptimeout;
4235         tqp[IPF_TCPS_HALF_ESTAB].ifq_ttl = ifs->ifs_fr_tcptimeout;
4236 }
4237 
4238 
4239 /* ------------------------------------------------------------------------ */
4240 /* Function:    fr_sttab_destroy                                            */
4241 /* Returns:     Nil                                                         */
4242 /* Parameters:  tqp(I) - pointer to an array of timeout queues for TCP      */
4243 /*                                                                          */
4244 /* Do whatever is necessary to "destroy" each of the entries in the array   */
4245 /* of timeout queues for TCP.                                               */
4246 /* ------------------------------------------------------------------------ */
4247 void fr_sttab_destroy(tqp)
4248 ipftq_t *tqp;
4249 {
4250         int i;
4251 
4252         for (i = IPF_TCP_NSTATES - 1; i >= 0; i--)
4253                 MUTEX_DESTROY(&tqp[i].ifq_lock);
4254 }
4255 
4256 
4257 /* ------------------------------------------------------------------------ */
4258 /* Function:    fr_statederef                                               */
4259 /* Returns:     Nil                                                         */
4260 /* Parameters:  isp(I) - pointer to pointer to state table entry            */
4261 /*              ifs - ipf stack instance                                    */
4262 /*                                                                          */
4263 /* Decrement the reference counter for this state table entry and free it   */
4264 /* if there are no more things using it.                                    */
4265 /*                                                                          */
4266 /* Internal parameters:                                                     */
4267 /*    state[0] = state of source (host that initiated connection)           */
4268 /*    state[1] = state of dest   (host that accepted the connection)        */
4269 /* ------------------------------------------------------------------------ */
4270 void fr_statederef(isp, ifs)
4271 ipstate_t **isp;
4272 ipf_stack_t *ifs;
4273 {
4274         ipstate_t *is;
4275 
4276         is = *isp;
4277         *isp = NULL;
4278 
4279         MUTEX_ENTER(&is->is_lock);
4280         if (is->is_ref > 1) {
4281                 is->is_ref--;
4282                 MUTEX_EXIT(&is->is_lock);
4283 #ifndef _KERNEL
4284                 if ((is->is_sti.tqe_state[0] > IPF_TCPS_ESTABLISHED) ||
4285                    (is->is_sti.tqe_state[1] > IPF_TCPS_ESTABLISHED)) {
4286                         (void) fr_delstate(is, ISL_ORPHAN, ifs);
4287                 }
4288 #endif
4289                 return;
4290         }
4291         MUTEX_EXIT(&is->is_lock);
4292 
4293         WRITE_ENTER(&ifs->ifs_ipf_state);
4294         (void) fr_delstate(is, ISL_EXPIRE, ifs);
4295         RWLOCK_EXIT(&ifs->ifs_ipf_state);
4296 }
4297 
4298 
4299 /* ------------------------------------------------------------------------ */
4300 /* Function:    fr_setstatequeue                                            */
4301 /* Returns:     Nil                                                         */
4302 /* Parameters:  is(I) - pointer to state structure                          */
4303 /*              rev(I) - forward(0) or reverse(1) direction                 */
4304 /* Locks:       ipf_state (read or write)                                   */
4305 /*                                                                          */
4306 /* Put the state entry on its default queue entry, using rev as a helped in */
4307 /* determining which queue it should be placed on.                          */
4308 /* ------------------------------------------------------------------------ */
4309 void fr_setstatequeue(is, rev, ifs)
4310 ipstate_t *is;
4311 int rev;
4312 ipf_stack_t *ifs;
4313 {
4314         ipftq_t *oifq, *nifq;
4315 
4316 
4317         if ((is->is_sti.tqe_flags & TQE_RULEBASED) != 0)
4318                 nifq = is->is_tqehead[rev];
4319         else
4320                 nifq = NULL;
4321 
4322         if (nifq == NULL) {
4323                 switch (is->is_p)
4324                 {
4325 #ifdef USE_INET6
4326                 case IPPROTO_ICMPV6 :
4327                         if (rev == 1)
4328                                 nifq = &ifs->ifs_ips_icmpacktq;
4329                         else
4330                                 nifq = &ifs->ifs_ips_icmptq;
4331                         break;
4332 #endif
4333                 case IPPROTO_ICMP :
4334                         if (rev == 1)
4335                                 nifq = &ifs->ifs_ips_icmpacktq;
4336                         else
4337                                 nifq = &ifs->ifs_ips_icmptq;
4338                         break;
4339                 case IPPROTO_TCP :
4340                         nifq = ifs->ifs_ips_tqtqb + is->is_state[rev];
4341                         break;
4342 
4343                 case IPPROTO_UDP :
4344                         if (rev == 1)
4345                                 nifq = &ifs->ifs_ips_udpacktq;
4346                         else
4347                                 nifq = &ifs->ifs_ips_udptq;
4348                         break;
4349 
4350                 default :
4351                         nifq = &ifs->ifs_ips_iptq;
4352                         break;
4353                 }
4354         }
4355 
4356         oifq = is->is_sti.tqe_ifq;
4357         /*
4358          * If it's currently on a timeout queue, move it from one queue to
4359          * another, else put it on the end of the newly determined queue.
4360          */
4361         if (oifq != NULL)
4362                 fr_movequeue(&is->is_sti, oifq, nifq, ifs);
4363         else
4364                 fr_queueappend(&is->is_sti, nifq, is, ifs);
4365         return;
4366 }
4367 
4368 
4369 /* ------------------------------------------------------------------------ */
4370 /* Function:    fr_stateiter                                                */
4371 /* Returns:     int - 0 == success, else error                              */
4372 /* Parameters:  token(I) - pointer to ipftoken structure                    */
4373 /*              itp(I)   - pointer to ipfgeniter structure                  */
4374 /*                                                                          */
4375 /* This function handles the SIOCGENITER ioctl for the state tables and     */
4376 /* walks through the list of entries in the state table list (ips_list.)    */
4377 /* ------------------------------------------------------------------------ */
4378 static int fr_stateiter(token, itp, ifs)
4379 ipftoken_t *token;
4380 ipfgeniter_t *itp;
4381 ipf_stack_t *ifs;
4382 {
4383         ipstate_t *is, *next, zero;
4384         int error, count;
4385         char *dst;
4386 
4387         if (itp->igi_data == NULL)
4388                 return EFAULT;
4389 
4390         if (itp->igi_nitems == 0)
4391                 return EINVAL;
4392 
4393         if (itp->igi_type != IPFGENITER_STATE)
4394                 return EINVAL;
4395 
4396         error = 0;
4397 
4398         READ_ENTER(&ifs->ifs_ipf_state);
4399 
4400         /*
4401          * Get "previous" entry from the token and find the next entry.
4402          */
4403         is = token->ipt_data;
4404         if (is == NULL) {
4405                 next = ifs->ifs_ips_list;
4406         } else {
4407                 next = is->is_next;
4408         }
4409 
4410         dst = itp->igi_data;
4411         for (count = itp->igi_nitems; count > 0; count--) {
4412                 /*
4413                  * If we found an entry, add a reference to it and update the token.
4414                  * Otherwise, zero out data to be returned and NULL out token.
4415                  */
4416                 if (next != NULL) {
4417                         MUTEX_ENTER(&next->is_lock);
4418                         next->is_ref++;
4419                         MUTEX_EXIT(&next->is_lock);
4420                         token->ipt_data = next;
4421                 } else {
4422                         bzero(&zero, sizeof(zero));
4423                         next = &zero;
4424                         token->ipt_data = NULL;
4425                 }
4426 
4427                 /*
4428                  * Safe to release lock now the we have a reference.
4429                  */
4430                 RWLOCK_EXIT(&ifs->ifs_ipf_state);
4431 
4432                 /*
4433                  * Copy out data and clean up references and tokens.
4434                  */
4435                 error = COPYOUT(next, dst, sizeof(*next));
4436                 if (error != 0)
4437                         error = EFAULT;
4438                 if (token->ipt_data == NULL) {
4439                         ipf_freetoken(token, ifs);
4440                         break;
4441                 } else {
4442                         if (is != NULL)
4443                                 fr_statederef(&is, ifs);
4444                         if (next->is_next == NULL) {
4445                                 ipf_freetoken(token, ifs);
4446                                 break;
4447                         }
4448                 }
4449 
4450                 if ((count == 1) || (error != 0))
4451                         break;
4452 
4453                 READ_ENTER(&ifs->ifs_ipf_state);
4454                 dst += sizeof(*next);
4455                 is = next;
4456                 next = is->is_next;
4457         }
4458 
4459         return error;
4460 }