ip_fil_solaris.c revision 7c478bd95313f5f23a4c958a745db2134aa03244
/*
* Copyright (C) 1999-2001, 2003 by Darren Reed.
*
* See the IPFILTER.LICENCE file for details on licencing.
*
* Copyright 2004 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
#pragma ident "%Z%%M% %I% %E% SMI"
#if !defined(lint)
static const char rcsid[] = "@(#)$Id: ip_fil_solaris.c,v 2.36 2003/07/01 18:30:20 darrenr Exp $";
#endif
#include <sys/dditypes.h>
#include <netinet/in_systm.h>
#include "ip_compat.h"
#ifdef USE_INET6
#endif
#include "ip_fil.h"
#include "ip_nat.h"
#include "ip_frag.h"
#include "ip_state.h"
#include "ip_auth.h"
#include "ip_proxy.h"
#ifdef IPFILTER_LOOKUP
#include "ip_lookup.h"
#endif
#ifdef IPFILTER_COMPILED
#include "ip_rules.h"
#endif
#if SOLARIS2 >= 7
extern timeout_id_t fr_timer_id;
#else
extern int fr_timer_id;
#endif
#if SOLARIS2 < 10
#if SOLARIS2 >= 7
# if SOLARIS2 >= 8
int *ip_forwarding;
# else
# endif
#else
#endif
#endif
int ipf_locks_done = 0;
/* ------------------------------------------------------------------------ */
/* Function: ipldetach */
/* Returns: int - 0 == success, else error. */
/* Parameters: Nil */
/* */
/* This function is responsible for undoing anything that might have been */
/* done in a call to iplattach(). It must be able to clean up from a call */
/* to iplattach() that did not succeed. Why might that happen? Someone */
/* configures a table to be so large that we cannot allocate enough memory */
/* for it. */
/* ------------------------------------------------------------------------ */
int ipldetach()
{
if (fr_refcnt)
return EBUSY;
#if SOLARIS2 < 10
if (fr_control_forwarding & 2) {
*ip_forwarding = 0;
#if SOLARIS2 >= 8
*ip6_forwarding = 0;
#endif
}
#endif
#ifdef IPFDEBUG
#endif
fr_natunload();
appr_unload();
#ifdef IPFILTER_COMPILED
#endif
#ifdef IPFILTER_LOOKUP
#endif
#ifdef IPFILTER_LOG
fr_logunload();
#endif
if (ipf_locks_done == 1) {
ipf_locks_done = 0;
}
return 0;
}
{
#if SOLARIS2 < 10
int i;
#endif
#ifdef IPFDEBUG
#endif
ipf_locks_done = 1;
#ifdef IPFILTER_LOG
if (fr_loginit() == -1)
return -1;
#endif
if (fr_natinit() == -1)
return -1;
if (fr_stateinit() == -1)
return -1;
if (fr_authinit() == -1)
return -1;
if (fr_fraginit() == -1)
return -1;
if (appr_init() == -1)
return -1;
#ifdef IPFILTER_SYNC
ipfsync_init();
#endif
#ifdef IPFILTER_SCAN
isc_init();
#endif
#ifdef IPFILTER_LOOKUP
if (ip_lookup_init() == -1)
return -1;
#endif
/* Do not use private interface ip_params_arr[] in Solaris 10 */
#if SOLARIS2 < 10
#if SOLARIS2 >= 8
#endif
/*
* XXX - There is no terminator for this array, so it is not possible
* to tell if what we are looking for is missing and go off the end
* of the array.
*/
for (i = 0; ; i++) {
"ip_path_mtu_discovery")) {
}
#if SOLARIS2 < 8
"ip_forwarding")) {
}
#else
"ip6_forwarding")) {
}
#endif
#if SOLARIS2 >= 8
ip6_forwarding != NULL &&
#endif
ip_forwarding != NULL)
break;
}
if (fr_control_forwarding & 1) {
*ip_forwarding = 1;
#if SOLARIS2 >= 8
*ip6_forwarding = 1;
#endif
}
#endif
return 0;
}
static int frzerostats(data)
{
int error;
fr_getstat(&fio);
if (error)
return error;
return 0;
}
/*
* Filter ioctl interface.
*/
/*ARGSUSED*/
int cmd;
#if SOLARIS2 >= 7
#else
int *data;
#endif
int mode;
int *rp;
{
#ifdef IPFDEBUG
#endif
if (IPL_LOGMAX < unit)
return ENXIO;
if (fr_running <= 0) {
if (unit != IPL_LOGIPF)
return EIO;
return EIO;
}
if (error != -1) {
return error;
}
error = 0;
switch (cmd)
{
case SIOCFRENB :
else {
sizeof(enable));
if (error != 0) {
break;
}
if (enable) {
if (fr_running > 0)
error = 0;
else
if (error == 0)
fr_running = 1;
else
(void) ipldetach();
} else {
if (error == 0)
fr_running = -1;
}
}
break;
case SIOCIPFSET :
break;
}
/* FALLTHRU */
case SIOCIPFGETNEXT :
case SIOCIPFGET :
break;
case SIOCSETFF :
else {
sizeof(fr_flags));
if (error != 0)
}
break;
case SIOCGETFF :
sizeof(fr_flags));
if (error != 0)
break;
case SIOCFUNCL :
break;
case SIOCINAFR :
case SIOCRMAFR :
case SIOCADAFR :
case SIOCZRLST :
else
fr_active, 1);
break;
case SIOCINIFR :
case SIOCRMIFR :
case SIOCADIFR :
else
break;
case SIOCSWAPA :
else {
sizeof(fr_active));
if (error != 0)
else
}
break;
case SIOCGETFS :
fr_getstat(&fio);
break;
case SIOCFRZST :
else
break;
case SIOCIPFFL :
else {
sizeof(tmp));
if (!error) {
sizeof(tmp));
if (error != 0)
} else
}
break;
case SIOCSTLCK :
if (error == 0) {
fr_state_lock = tmp;
fr_nat_lock = tmp;
fr_frag_lock = tmp;
fr_auth_lock = tmp;
} else
break;
#ifdef IPFILTER_LOG
case SIOCIPFFB :
else {
sizeof(tmp));
if (error)
}
break;
#endif /* IPFILTER_LOG */
case SIOCFRSYN :
else {
}
break;
case SIOCGFRST :
break;
case FIONREAD :
#ifdef IPFILTER_LOG
if (error != 0)
#endif
break;
default :
break;
}
return error;
}
#ifndef IRE_ILL_CN
char *name;
int v;
{
#if SOLARIS2 >= 10
#endif
int sap;
if (v == 4)
sap = 0x0800;
else if (v == 6)
sap = 0x86dd;
else
return NULL;
#if SOLARIS2 >= 10
#else
#endif
return il;
return NULL;
}
#else
char *name;
int v;
{
int sap;
if (v == 4)
sap = 0x0800;
else if (v == 6)
sap = 0x86dd;
else
return NULL;
break;
return il;
}
#endif /* IRE_ILL_CN */
/*
* routines below for saving IP headers to buffer
*/
/*ARGSUSED*/
{
#ifdef IPFDEBUG
#endif
return ENXIO;
return min;
}
/*ARGSUSED*/
{
#ifdef IPFDEBUG
#endif
return min;
}
#ifdef IPFILTER_LOG
/*
* both of these must operate with at least splnet() lest they be
* called during packet processing and cause an inconsistancy to appear in
* the filter lists.
*/
/*ARGSUSED*/
{
# ifdef IPFDEBUG
# endif
# ifdef IPFILTER_SYNC
return ipfsync_read(uio);
# endif
}
#endif /* IPFILTER_LOG */
#ifdef IPFILTER_SYNC
/*
* both of these must operate with at least splnet() lest they be
* called during packet processing and cause an inconsistancy to appear in
* the filter lists.
*/
{
#ifdef IPFDEBUG
#endif
return ENXIO;
return ipfsync_write(uio);
}
#endif /* IPFILTER_SYNC */
/*
* fr_send_reset - this could conceivably be a call to tcp_respond(), but that
* requires a large amount of setting up and isn't any more efficient.
*/
int fr_send_reset(fin)
{
mblk_t *m;
#ifdef USE_INET6
#endif
return -1;
#ifndef IPFILTER_CKSUM
return -1;
#endif
#ifdef USE_INET6
else
#endif
return -1;
m->b_rptr += 64;
} else {
}
/*
* This is to get around a bug in the Solaris 2.4/2.5 TCP checksum
* computation that is done by their put routine.
*/
#ifdef USE_INET6
} else
#endif
{
}
return fr_send_ip(fin, m);
}
static int fr_send_ip(fin, m)
mblk_t *m;
{
int i;
#ifdef USE_INET6
} else
#endif
{
#if SOLARIS2 >= 10
#else
#endif
}
return i;
}
int type;
int dst;
{
#ifdef USE_INET6
#endif
mblk_t *m;
#ifdef icmp_nextmtu
#ifndef IRE_ILL_CN
#else
#endif /* IRE_ILL_CN */
#endif
#ifdef USE_INET6
#endif
#ifdef icmp_nextmtu
/* lint fodder */
#endif
return -1;
#ifdef USE_INET6
return -1;
#endif
#ifndef IPFILTER_CKSUM
return -1;
#endif
#ifdef USE_INET6
if (type == ICMP6_DST_UNREACH)
} else
#endif
{
{
case ICMP_ECHO :
case ICMP_TSTAMP :
case ICMP_IREQ :
case ICMP_MASKREQ :
break;
default :
return 0;
}
}
return -1;
m->b_rptr += 64;
#ifndef IRE_ILL_CN
#ifdef icmp_nextmtu
#endif
#endif /* IRE_ILL_CN */
#ifdef USE_INET6
int csz;
if (dst == 0) {
FREE_MB_T(m);
return -1;
}
} else
} else
#endif
{
if (dst == 0) {
FREE_MB_T(m);
return -1;
}
} else
}
/*
* Need to exit out of these so we don't recursively call rw_enter
* from fr_qout.
*/
return fr_send_ip(fin, m);
}
#ifdef IRE_ILL_CN
#ifndef _KERNEL
#include <stdio.h>
#endif
/*
* Print out warning message at rate-limited speed.
*/
{
char msg_buf[256];
int need_printed = 0;
now = ddi_get_time();
/* make sure, no multiple entries */
need_printed = 1;
}
MUTEX_EXIT(&ipf_rw);
if (need_printed) {
#ifdef _KERNEL
#else
#endif
}
}
#endif
/*
* return the first IP Address associated with an interface
*/
/*ARGSUSED*/
int v, atype;
void *ifptr;
{
#ifdef USE_INET6
#endif
#ifndef IRE_ILL_CN
#else
#endif /* IRE_ILL_CN */
return -1;
#ifdef USE_INET6
if (v == 6) {
#ifndef IRE_ILL_CN
/*
* First is always link local.
*/
if (!IN6_IS_ADDR_LINKLOCAL(inp6) &&
break;
}
return -1;
if (atype == FRI_BROADCAST)
else if (atype == FRI_PEERADDR)
else
#else /* IRE_ILL_CN */
"Check pfild is running: "
"IP#/netmask is 0 on %s.\n"
return -1;
}
if (atype == FRI_BROADCAST)
else if (atype == FRI_PEERADDR)
else
#endif /* IRE_ILL_CN */
}
#endif
#ifndef IRE_ILL_CN
if (atype == FRI_BROADCAST)
#if SOLARIS2 < 7
#else
#endif
else if (atype == FRI_PEERADDR)
else
#if SOLARIS2 < 7
#else
#endif
#else
"Check pfild is running: IP#/netmask is 0 on %s.\n",
return -1;
}
if (atype == FRI_BROADCAST)
else if (atype == FRI_PEERADDR)
else
#endif /* IRE_ILL_CN */
}
#ifdef IRE_ILL_CN
/* ARGSUSED */
#endif
void fr_resolvdest(fdp, v)
int v;
{
#ifndef IRE_ILL_CN
#if SOLARIS2 > 5
#else
#endif
}
#ifdef USE_INET6
}
#endif
}
#else
#endif /*IRE_ILL_CN */
}
{
static int iss_seq_off = 0;
/*
* Compute the base value of the ISS. It is a hash
* of (saddr, sport, daddr, dport, secret).
*/
/*
* Now increment our "timer", and add it in to
* the computed value.
*
* XXX Use `addin'?
* XXX TCP_ISSINCR too large to use?
*/
iss_seq_off += 0x00010000;
newiss += iss_seq_off;
return newiss;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_nextipid */
/* Returns: int - 0 == success, -1 == error (packet should be droppped) */
/* Parameters: fin(I) - pointer to packet information */
/* */
/* Returns the next IPv4 ID to use for this packet. */
/* ------------------------------------------------------------------------ */
{
} else
MUTEX_EXIT(&ipf_rw);
return id;
}
#ifndef IPFILTER_CKSUM
/* ARGSUSED */
#endif
{
#ifdef IPFILTER_CKSUM
#endif
}
#ifdef USE_INET6
{
# ifdef IPFILTER_CKSUM
# endif
}
#endif /* USE_INET6 */