ip_state.c revision 94bdecd9e84ae1042607002db3e64a6849da5874
/*
* Copyright (C) 1995-2003 by Darren Reed.
*
* See the IPFILTER.LICENCE file for details on licencing.
*
*
* Copyright (c) 2014, Joyent, Inc. All rights reserved.
*/
# define KERNEL 1
# define _KERNEL 1
#endif
defined(_KERNEL)
# include "opt_ipfilter_log.h"
#endif
#if defined(_KERNEL) && defined(__FreeBSD_version) && \
#include "opt_inet6.h"
#endif
#if !defined(_KERNEL) && !defined(__KERNEL__)
# include <stdio.h>
# include <stdlib.h>
# include <string.h>
# define _KERNEL
# ifdef __OpenBSD__
struct file;
# endif
#endif
# include "opt_ipfilter.h"
# endif
#else
#endif
#if !defined(linux)
#endif
#if defined(_KERNEL)
# endif
#endif
# include <sys/byteorder.h>
# ifdef _KERNEL
# include <sys/dditypes.h>
# endif
#endif
#ifdef sun
#endif
#include <netinet/in_systm.h>
#if !defined(linux)
#endif
#endif
#include "netinet/ip_compat.h"
#include "netinet/ip_state.h"
#include "netinet/ip_proxy.h"
#include "netinet/ipf_stack.h"
#ifdef IPFILTER_SYNC
#endif
#ifdef IPFILTER_SCAN
#endif
#ifdef USE_INET6
#endif
#if (__FreeBSD_version >= 300000)
# if defined(_KERNEL) && !defined(IPFILTER_LKM)
# endif
#endif
/* END OF INCLUDES */
#if !defined(lint)
static const char sccsid[] = "@(#)ip_state.c 1.8 6/5/96 (C) 1993-2000 Darren Reed";
static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.186.2.36 2005/08/11 19:58:03 darrenr Exp $";
#endif
#ifdef USE_INET6
#endif
#define DOUBLE_HASH(x, ifs) \
/* ------------------------------------------------------------------------ */
/* Function: fr_stateinit */
/* Returns: int - 0 == success, -1 == failure */
/* Parameters: ifs - ipf stack instance */
/* */
/* Initialise all the global variables used within the state code. */
/* This action also includes initiailising locks. */
/* ------------------------------------------------------------------------ */
int fr_stateinit(ifs)
{
#if defined(NEED_LOCAL_RAND) || !defined(_KERNEL)
#endif
int i;
return -1;
return -2;
#if defined(NEED_LOCAL_RAND) || !defined(_KERNEL)
#endif
for (i = 0; i < ifs->ifs_fr_statesize; i++) {
/*
* XXX - ips_seed[X] should be a random number of sorts.
*/
#if !defined(NEED_LOCAL_RAND) && defined(_KERNEL)
#else
#endif
}
/* fill icmp reply type table */
for (i = 0; i <= ICMP_MAXTYPE; i++)
icmpreplytype4[i] = -1;
#ifdef USE_INET6
/* fill icmp reply type table */
for (i = 0; i <= ICMP6_MAXTYPE; i++)
icmpreplytype6[i] = -1;
#endif
return -1;
if (ifs->ifs_fr_state_maxbucket == 0) {
}
/* entry's ttl in deletetq is just 1 tick */
return 0;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_stateunload */
/* Returns: Nil */
/* Parameters: ifs - ipf stack instance */
/* */
/* Release and destroy any resources acquired or initialised so that */
/* IPFilter can be unloaded or re-initialised. */
/* ------------------------------------------------------------------------ */
void fr_stateunload(ifs)
{
/*
* Proxy timeout queues are not cleaned here because although they
* exist on the state list, appr_unload is called after fr_stateunload
* and the proxies actually are responsible for them being created.
* Should the proxy timeouts have their own list? There's no real
* justification as this is the only complicationA
*/
(fr_deletetimeoutqueue(ifq) == 0))
}
ifs->ifs_ips_num = 0;
}
}
}
}
ifs->ifs_fr_state_maxbucket = 0;
ifs->ifs_fr_state_init = 0;
}
}
/* ------------------------------------------------------------------------ */
/* Function: fr_statetstats */
/* Returns: ips_state_t* - pointer to state stats structure */
/* Parameters: Nil */
/* */
/* Put all the current numbers and pointers into a single struct and return */
/* a pointer to it. */
/* ------------------------------------------------------------------------ */
{
return &ifs->ifs_ips_stats;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_state_remove */
/* Returns: int - 0 == success, != 0 == failure */
/* Parameters: data(I) - pointer to state structure to delete from table */
/* ifs - ipf stack instance */
/* */
/* Search for a state structure that matches the one passed, according to */
/* the IP addresses and other protocol specific information. */
/* ------------------------------------------------------------------------ */
{
int error;
if (error)
return EFAULT;
return 0;
}
return ESRCH;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_state_ioctl */
/* Returns: int - 0 == success, != 0 == failure */
/* Parameters: data(I) - pointer to ioctl data */
/* cmd(I) - ioctl command integer */
/* mode(I) - file mode bits used with open */
/* uid(I) - uid of caller */
/* ctx(I) - pointer to give the uid context */
/* ifs - ipf stack instance */
/* */
/* Processes an ioctl call made to operate on the IP Filter state device. */
/* ------------------------------------------------------------------------ */
void *ctx;
{
switch (cmd)
{
/*
* Delete an entry from the state table.
*/
case SIOCDELST :
break;
/*
* Flush the state table
*/
case SIOCIPFFL :
if (error != 0) {
} else {
if (VALID_TABLE_FLUSH_OPT(arg)) {
sizeof(ret));
if (error != 0)
return EFAULT;
} else {
}
}
break;
#ifdef USE_INET6
case SIOCIPFL6 :
if (error != 0) {
} else {
if (VALID_TABLE_FLUSH_OPT(arg)) {
sizeof(ret));
if (error != 0)
return EFAULT;
} else {
}
}
break;
#endif
#ifdef IPFILTER_LOG
/*
* Flush the state log.
*/
case SIOCIPFFB :
else {
int tmp;
if (error != 0)
}
break;
/*
*/
case SIOCSETLG :
} else {
(char *)&ifs->ifs_ipstate_logging,
sizeof(ifs->ifs_ipstate_logging));
if (error != 0)
}
break;
/*
* Return the current state of logging.
*/
case SIOCGETLG :
(char *)data,
sizeof(ifs->ifs_ipstate_logging));
if (error != 0)
break;
/*
* Return the number of bytes currently waiting to be read.
*/
case FIONREAD :
if (error != 0)
break;
#endif
/*
* Get the current state statistics.
*/
case SIOCGETFS :
break;
/*
* means no packets match).
*/
case SIOCSTLCK :
} else {
}
break;
/*
* Add an entry to the current state table.
*/
case SIOCSTPUT :
break;
}
break;
/*
* Get a state table entry.
*/
case SIOCSTGET :
if (!ifs->ifs_fr_state_lock) {
break;
}
break;
case SIOCGENITER :
{
if (error != 0)
break;
else
break;
}
case SIOCIPFDELTOK :
if (error != 0) {
} else {
}
break;
default :
break;
}
return error;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_stgetent */
/* Returns: int - 0 == success, != 0 == failure */
/* Parameters: data(I) - pointer to state structure to retrieve from table */
/* */
/* Copy out state information from the kernel to a user space process. If */
/* there is a filter rule associated with the state entry, copy that out */
/* as well. The entry to copy out is taken from the value of "ips_next" in */
/* the struct passed in and if not null and not found in the list of current*/
/* state entries, the retrieval fails. */
/* ------------------------------------------------------------------------ */
{
int error;
if (error)
return EFAULT;
return ENOENT;
return 0;
}
} else {
/*
* Make sure the pointer we're copying from exists in the
* current list of entries. Security precaution to prevent
* copying of random kernel data.
*/
break;
if (!is)
return ESRCH;
}
if (error)
return EFAULT;
return 0;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_stputent */
/* Returns: int - 0 == success, != 0 == failure */
/* Parameters: data(I) - pointer to state information struct */
/* ifs - ipf stack instance */
/* */
/* This function implements the SIOCSTPUT ioctl: insert a state entry into */
/* the state table. If the state info. includes a pointer to a filter rule */
/* then also add in an orphaned rule (will not show up in any "ipfstat -io" */
/* output. */
/* ------------------------------------------------------------------------ */
{
int error, i;
char *name;
if (error)
return EFAULT;
/*
* Trigger automatic call to fr_state_flush() if the
* table has reached capacity specified by hi watermark.
*/
/*
* If automatic flushing did not do its job, and the table
* has filled up, don't try to create a new entry.
*/
return ENOMEM;
}
return ENOMEM;
return 0;
}
return ENOMEM;
}
/*
* Look up all the interface names in the rule.
*/
for (i = 0; i < 4; i++) {
}
/*
* send a copy back to userland of what we ended up
* to allow for verification.
*/
if (error) {
return EFAULT;
}
} else {
break;
}
}
}
return 0;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_stinsert */
/* Returns: Nil */
/* Parameters: is(I) - pointer to state structure */
/* */
/* Inserts a state structure into the hash table (for lookups) and the list */
/* of state entries (for enumeration). Resolves all of the interface names */
/* to pointers and adjusts running stats for the hash table as appropriate. */
/* */
/* Locking: it is assumed that some kind of lock on ipf_state is held. */
/* Exits with is_lock initialised and held. */
/* ------------------------------------------------------------------------ */
int rev;
{
int i;
fr->fr_statecnt++;
}
/*
* Look up all the interface names in the state entry.
*/
for (i = 0; i < 4; i++) {
continue;
}
/*
* If we could trust is_hv, then the modulous would not be needed, but
* when running with IPFILTER_SYNC, this stops bad values.
*/
/*
* We need to get both of these locks...the first because it is
* possible that once the insert is complete another packet might
* come along, match the entry and want to update it.
*/
/*
* add into list table.
*/
else
ifs->ifs_ips_num++;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_match_ipv4addrs */
/* Returns: int - 2 strong match (same addresses, same direction) */
/* 1 weak match (same address, opposite direction) */
/* 0 no match */
/* */
/* Function matches IPv4 addresses. */
/* ------------------------------------------------------------------------ */
{
int rv;
rv = 2;
rv = 1;
else
rv = 0;
return (rv);
}
/* ------------------------------------------------------------------------ */
/* Function: fr_match_ipv6addrs */
/* Returns: int - 2 strong match (same addresses, same direction) */
/* 1 weak match (same addresses, opposite direction) */
/* 0 no match */
/* */
/* Function matches IPv6 addresses. */
/* ------------------------------------------------------------------------ */
{
int rv;
rv = 2;
rv = 1;
}
else
rv = 0;
return (rv);
}
/* ------------------------------------------------------------------------ */
/* Function: fr_match_addresses */
/* Returns: int - 2 strong match (same addresses, same direction) */
/* 1 weak match (same address, opposite directions) */
/* 0 no match */
/* Parameters: is1, is2 pointers to states we are checking */
/* */
/* Matches addresses, function uses fr_match_ipvXaddrs() to deal with IPv4 */
/* and IPv6 address format. */
/* ------------------------------------------------------------------------ */
{
int rv;
} else {
}
return (rv);
}
/* ------------------------------------------------------------------------ */
/* Function: fr_match_ppairs */
/* Returns: int - 2 strong match (same ports, same direction) */
/* 1 weak match (same ports, different direction) */
/* 0 no match */
/* Parameters ppairs1, ppairs - src, dst ports we want to match. */
/* */
/* Matches two port_pair_t types (port pairs). Each port pair contains */
/* src, dst port, which belong to session (state entry). */
/* ------------------------------------------------------------------------ */
{
int rv;
rv = 2;
rv = 1;
else
rv = 0;
return (rv);
}
/* ------------------------------------------------------------------------ */
/* Function: fr_match_l4_hdr */
/* Returns: int - 0 no match, */
/* 1 weak match (same ports, different directions) */
/* 2 strong match (same ports, same direction) */
/* Parameters is1, is2 - states we want to match */
/* */
/* Function matches L4 header data (source ports for TCP, UDP, CallIds for */
/* GRE protocol). */
/* ------------------------------------------------------------------------ */
{
int rv = 0;
return (0);
case IPPROTO_TCP:
break;
case IPPROTO_UDP:
break;
case IPPROTO_GRE:
/* greinfo_t can be also interprted as port pair */
break;
case IPPROTO_ICMP:
case IPPROTO_ICMPV6:
rv = 1;
else
rv = 0;
break;
default:
rv = 0;
}
return (rv);
}
/* ------------------------------------------------------------------------ */
/* Function: fr_matchstates */
/* Returns: int - nonzero match, zero no match */
/* Parameters is1, is2 - states we want to match */
/* */
/* The state entries are equal (identical match) if they belong to the same */
/* session. Any time new state entry is being added the fr_addstate() */
/* function creates temporal state entry from the data it gets from IP and */
/* L4 header. The fr_matchstats() must be also aware of packet direction, */
/* which is also stored within the state entry. We should keep in mind the */
/* information about packet direction is spread accross L3 (addresses) and */
/* L4 (ports). There are three possible relationships betwee is1, is2: */
/* - no match (match(is1, is2) == 0)) */
/* - weak match same addresses (ports), but different */
/* directions (1) (fr_match_xxxx(is1, is2) == 1) */
/* - strong match same addresses (ports) and same directions */
/* (2) (fr_match_xxxx(is1, is2) == 2) */
/* */
/* There are functions, which match match addresses (L3 header) in is1, is2 */
/* and functions, which are used to compare ports (L4 header) data. We say */
/* the is1 and is2 are same (identical) if there is a match */
/* (fr_match_l4_hdr(is1, is2) != 0) and matchlevels are same for entries */
/* (fr_match_l3_hdr(is1, is2) == fr_match_l4_hdr(is1, is2)) for is1, is2. */
/* Such requirement deals with case as follows: */
/* suppose there are two connections between hosts A, B. Connection 1: */
/* a.a.a.a:12345 <=> b.b.b.b:54321 */
/* Connection 2: */
/* a.a.a.a:54321 <=> b.b.b.b:12345 */
/* since we've introduced match levels into our fr_matchstates(), we are */
/* able to identify, which packets belong to connection A and which belong */
/* to connection B. Assume there are two entries is1, is2. is1 has been */
/* from con. 1 packet, which travelled from A to B: */
/* a.a.a.a:12345 -> b.b.b.b:54321 */
/* while s2, has been created from packet which belongs to con. 2 and is */
/* also coming from A to B: */
/* a.a.a.a:54321 -> b.b.b.b:12345 */
/* fr_match_l3_hdr(is1, is2) == 2 -> strong match, while */
/* fr_match_l4_hdr(is1, is2) == 1 -> weak match. Since match levels are */
/* different the state entries are not identical -> no match as a final */
/* result. */
/* ------------------------------------------------------------------------ */
{
int rv;
int amatch;
int pmatch;
/*
* If addresses match (amatch != 0), then 'match levels'
* must be same for matching entries. If amatch and pmatch
* have different values (different match levels), then
* is1 and is2 belong to different sessions.
*/
}
else
rv = 0;
return (rv);
}
/* ------------------------------------------------------------------------ */
/* Function: fr_addstate */
/* Returns: ipstate_t* - NULL == failure, else pointer to new state */
/* Parameters: fin(I) - pointer to packet information */
/* stsave(O) - pointer to place to save pointer to created */
/* state structure. */
/* flags(I) - flags to use when creating the structure */
/* */
/* Creates a new IP state structure from the packet information collected. */
/* Inserts it into the state table and appends to the bottom of the active */
/* list. If the capacity of the table has reached the maximum allowed then */
/* the call will fail and a flush is scheduled for the next timeout call. */
/* ------------------------------------------------------------------------ */
{
void *ifp;
int out;
if (ifs->ifs_fr_state_lock ||
return NULL;
return NULL;
/*
* Trigger automatic call to fr_state_flush() if the
* table has reached capacity specified by hi watermark.
*/
/*
* If the max number of state entries has been reached, and there is no
* limit on the state count for the rule, then do not continue. In the
* case where a limit exists, it's ok allow the entries to be created as
* long as specified limit itself has not been reached.
*
* Note that because the lock isn't held on fr, it is possible to exceed
* the specified size of the table. However, the cost of this is being
* ignored here; as the number by which it can go over is a product of
* the number of simultaneous threads that could be executing in here.
* So, a limit of 100 won't result in 200, but could result in 101 or 102.
*
* Also note that, since the automatic flush should have been triggered
* well before we reach the maximum number of state table entries, the
* likelihood of reaching the max (and thus exceedng it) is minimal.
*/
(fr->fr_statemax == 0)) {
return NULL;
}
if ((fr->fr_statemax != 0) &&
return NULL;
}
}
} else {
}
/*
* We want to check everything that is a property of this packet,
* but we don't (automatically) care about it's fragment status as
* this may change.
*/
/*
* The reverse direction option mask will be set in fr_matchsrcdst(),
* when we will see the first packet from the peer. We will leave it
* as zero for now.
*/
}
/*
* Copy and calculate...
*/
#ifdef USE_INET6
/*
* For ICMPv6, we check to see if the destination address is
* a multicast address. If it is, do not include it in the
* calculation of the hash because the correct reply will come
* back from a real address, not a multicast address.
*/
/*
* So you can do keep state with neighbour discovery.
*
* Here we could use the address from the neighbour
* solicit message to put in the state structure and
* we could use that without a wildcard flag too...
*/
} else {
}
}
#endif
} else {
}
}
{
#ifdef USE_INET6
case IPPROTO_ICMPV6 :
{
case ICMP6_ECHO_REQUEST :
break;
case ICMP6_MEMBERSHIP_QUERY :
case ND_ROUTER_SOLICIT :
case ND_NEIGHBOR_SOLICIT :
case ICMP6_NI_QUERY :
break;
default :
return NULL;
}
break;
#endif
case IPPROTO_ICMP :
{
case ICMP_ECHO :
case ICMP_ECHOREPLY :
case ICMP_TSTAMP :
case ICMP_IREQ :
case ICMP_MASKREQ :
break;
default :
return NULL;
}
break;
case IPPROTO_GRE :
}
break;
case IPPROTO_TCP :
return NULL;
/*
* The endian of the ports doesn't matter, but the ack and
* sequence numbers do as we do mathematics on them later.
*/
}
/*
* If this is a real packet then initialise fields in the
* state information structure from the TCP header information.
*/
if (is->is_maxswin == 0)
/*
* Window scale option is only present in
*/
TH_SYN &&
}
}
}
else {
}
}
/*
* If we're creating state for a starting connection, start the
* timer on it as we'll never see an error if it fails to
* connect.
*/
break;
case IPPROTO_UDP :
}
break;
default :
break;
}
/*
* Look for identical state.
*/
break;
}
/*
* we've found a matching state -> state already exists,
* we are not going to add a duplicate record.
*/
return NULL;
return NULL;
}
return NULL;
}
/*
* Do not do the modulous here, it is done in fr_stinsert().
*/
is->is_tqehead[0] =
}
}
(ifp != (void *)-1)) {
}
(ifp != (void *)-1)) {
}
(ifp != (void *)-1)) {
}
}
}
}
if (pass & FR_STSTRICT)
if (pass & FR_STATESYNC)
}
if (pass & FR_LOGFIRST)
/*
* If we're creating state for a starting connection, start the
* timer on it as we'll never see an error if it fails to
* connect.
*/
#ifdef IPFILTER_SCAN
(void) ipsc_attachis(is);
#endif
} else {
}
#ifdef IPFILTER_SYNC
#endif
if (ifs->ifs_ipstate_logging)
return is;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_tcpoptions */
/* Returns: int - 1 == packet matches state entry, 0 == it does not */
/* Parameters: fin(I) - pointer to packet information */
/* tcp(I) - pointer to TCP packet header */
/* td(I) - pointer to TCP data held as part of the state */
/* */
/* Look after the TCP header for any options and deal with those that are */
/* present. Record details about those that we recogise. */
/* ------------------------------------------------------------------------ */
{
return 0;
retval = 0;
} else {
retval = 1;
}
opt = *s;
if (opt == TCPOPT_EOL)
break;
else if (opt == TCPOPT_NOP)
ol = 1;
else {
if (len < 2)
break;
ol = (int)*(s + 1);
break;
/*
* Extract the TCP options we are interested in out of
* the header and store them in the the tcpdata struct.
*/
switch (opt)
{
case TCPOPT_WINDOW :
if (ol == TCPOLEN_WINDOW) {
i = (int)*(s + 2);
if (i > TCP_WSCALE_MAX)
i = TCP_WSCALE_MAX;
else if (i < 0)
i = 0;
td->td_winscale = i;
} else
retval = -1;
break;
case TCPOPT_MAXSEG :
/*
* So, if we wanted to set the TCP MAXSEG,
* it should be done here...
*/
if (ol == TCPOLEN_MAXSEG) {
i = (int)*(s + 2);
i <<= 8;
i += (int)*(s + 3);
} else
retval = -1;
break;
case TCPOPT_SACK_PERMITTED :
if (ol == TCPOLEN_SACK_PERMITTED)
else
retval = -1;
break;
}
}
s += ol;
}
return retval;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_tcpstate */
/* Returns: int - 1 == packet matches state entry, 0 == it does not */
/* Parameters: fin(I) - pointer to packet information */
/* tcp(I) - pointer to TCP packet header */
/* is(I) - pointer to master state structure */
/* */
/* Check to see if a packet with TCP headers fits within the TCP window. */
/* Change timeout depending on whether new packet is a SYN-ACK returning */
/* for a SYN or a RST or FIN which indicate time to close up shop. */
/* ------------------------------------------------------------------------ */
{
source = 0;
/*
* If a SYN packet is received for a connection that is in a half
* closed state, then move its state entry to deletetq. In such case
* the SYN packet will be consequently dropped. This allows new state
* entry to be created with a retransmited SYN packet.
*/
/*
* Do not update is->is_sti.tqe_die in case state entry
* is already present in deletetq. It prevents state
* entry ttl update by retransmitted SYN packets, which
* may arrive before timer tick kicks off. The SYN
* packet will be dropped again.
*/
return 0;
}
}
#ifdef IPFILTER_SCAN
return 1;
}
}
#endif
/*
* Nearing end of connection, start timeout.
*/
if (ret == 0) {
return 0;
}
/*
* set s0's as appropriate. Use syn-ack packet as it
* contains both pieces of required information.
*/
/*
*/
}
}
ret = 1;
} else
return ret;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_checknewisn */
/* Returns: Nil */
/* Parameters: fin(I) - pointer to packet information */
/* is(I) - pointer to master state structure */
/* */
/* Check to see if this TCP connection is expecting and needs a new */
/* sequence number for a particular direction of the connection. */
/* */
/* NOTE: This does not actually change the sequence numbers, only gets new */
/* one ready. */
/* ------------------------------------------------------------------------ */
{
int i;
}
}
/* ------------------------------------------------------------------------ */
/* Function: fr_tcpinwindow */
/* Returns: int - 1 == packet inside TCP "window", 0 == not inside. */
/* Parameters: fin(I) - pointer to packet information */
/* fdata(I) - pointer to tcp state informatio (forward) */
/* tdata(I) - pointer to tcp state informatio (reverse) */
/* tcp(I) - pointer to TCP packet header */
/* */
/* Given a packet has matched addresses and ports, check to see if it is */
/* within the TCP data window. In a show of generosity, allow packets that */
/* are within the window space behind the current sequence # as well. */
/* ------------------------------------------------------------------------ */
int flags;
{
/*
* Find difference between last checked packet and this packet.
*/
else
/*
* win 0 means the receiving endpoint has closed the window, because it
* has not enough memory to receive data from sender. In such case we
* are pretending window size to be 1 to let TCP probe data through.
* TCP probe data can be either 0 or 1 octet of data, the RFC does not
* state this accurately, so we have to allow 1 octet (win = 1) even if
* the window is closed (win == 0).
*/
if (win == 0)
win = 1;
/*
* if window scaling is present, the scaling is only allowed
* for windows not in the first SYN packet. In that packet the
* window is 65535 to specify the largest window possible
* for receivers not implementing the window scale option.
* Currently, we do not assume TTCP here. That means that
* if we see a second packet from a host (after the initial
* SYN), we can assume that the receiver of the SYN did
* the receiver also does window scaling)
*/
}
/*
* Must be a (outgoing) SYN-ACK in reply to a SYN.
*/
}
(ack == 0)) {
/* gross hack to get around certain broken tcp stacks */
}
/*
* Strict sequencing only allows in-order delivery.
*/
return 0;
}
}
#define SEQ_GE(a,b) ((int)((a) - (b)) >= 0)
#define SEQ_GT(a,b) ((int)((a) - (b)) > 0)
inseq = 0;
int, dsize,
int, ackskew,
int, maxwin,
int, win
);
if (
#if defined(_KERNEL)
/*
* end <-> s + n
* maxend <-> ack + win
* this is upperbound check
*/
/*
* this is lowerbound check
*/
#endif
/* XXX what about big packets */
#define MAXACKWINDOW 66000
inseq = 1;
/*
* Microsoft Windows will send the next packet to the right of the
* window if SACK is in use.
*/
inseq = 1;
/*
* RST ACK with SEQ equal to 0 is sent by some OSes (i.e. Solaris) as a
* response to initial SYN packet, when there is no application
* listeing to on a port, where the SYN packet has came to.
*/
inseq = 1;
if (!(fdata->td_winflags &
/*
* No TCPFSM and no window scaling, so make some
* extra guesses.
*/
inseq = 1;
inseq = 1;
}
}
if (inseq) {
/* if ackskew < 0 then this should be due to fragmented
* packets. There is no way to know the length of the
* total packet in advance.
* We do know the total length from the fragment cache though.
* Note however that there might be more sessions with
* exactly the same source and destination parameters in the
* state cache (and source and destination is the only stuff
* that is saved in the fragment cache). Note further that
* some TCP connections in the state cache are hashed with
* sport and dport as well which makes it not worthwhile to
* look for them.
* Thus, when ackskew is negative but still seems to belong
* to this session, we bump up the destinations end value.
*/
if (ackskew < 0) {
int, ack
);
}
/* update max window seen */
int, win
);
}
int, end
);
}
);
}
return 1;
}
#if defined(_KERNEL)
#endif
return 0;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_stclone */
/* Returns: ipstate_t* - NULL == cloning failed, */
/* else pointer to new state structure */
/* Parameters: fin(I) - pointer to packet information */
/* is(I) - pointer to master state structure */
/* */
/* Create a "duplcate" state table entry from the master. */
/* ------------------------------------------------------------------------ */
{
/*
* Trigger automatic call to fr_state_flush() if the
* table has reached capacity specified by hi watermark.
*/
/*
* If automatic flushing did not do its job, and the table
* has filled up, don't try to create a new entry. A NULL
* return will indicate that the cloning has failed.
*/
return NULL;
}
return NULL;
if (clone->is_maxdwin == 0)
} else {
if (clone->is_maxswin == 0)
}
}
#ifdef IPFILTER_SCAN
(void) ipsc_attachis(is);
#endif
#ifdef IPFILTER_SYNC
#endif
return clone;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_matchsrcdst */
/* Returns: Nil */
/* Parameters: fin(I) - pointer to packet information */
/* is(I) - pointer to state structure */
/* src(I) - pointer to source address */
/* dst(I) - pointer to destination address */
/* */
/* Match a state table entry against an IP packet. The logic below is that */
/* ret gets set to one if the match succeeds, else remains 0. If it is */
/* still 0 after the test. no match. */
/* ------------------------------------------------------------------------ */
{
void *ifp;
sp = 0;
dp = 0;
}
if (!rev) {
rev = 1;
rev = 1;
}
}
/*
* If the interface for this 'direction' is set, make sure it matches.
* An interface name that is not set matches any, as does a name of *.
*/
ret = 1;
if (ret == 0) {
return NULL;
}
ret = 0;
/*
* Match addresses and ports.
*/
if (rev == 0) {
if (tcp) {
ret = 1;
} else {
ret = 1;
}
}
} else {
if (tcp) {
ret = 1;
} else {
ret = 1;
}
}
}
if (ret == 0) {
return NULL;
}
/*
* Whether or not this should be here, is questionable, but the aim
* is to get this out of the main line.
*/
/*
* Only one of the source or destination address can be flaged as a
* wildcard. Fill in the missing address, if set.
* For IPv6, if the address being copied in is multicast, then
* don't reset the wild flag - multicast causes it to be set in the
* first place!
*/
if ((flags & SI_W_SADDR) != 0) {
if (rev == 0) {
#ifdef USE_INET6
/*EMPTY*/;
else
#endif
{
}
} else {
#ifdef USE_INET6
/*EMPTY*/;
else
#endif
{
}
}
} else if ((flags & SI_W_DADDR) != 0) {
if (rev == 0) {
#ifdef USE_INET6
/*EMPTY*/;
else
#endif
{
}
} else {
#ifdef USE_INET6
/*EMPTY*/;
else
#endif
{
}
}
}
}
}
/*
* Match up any flags set from IP options.
*/
int,
);
return NULL;
}
/*
* Only one of the source or destination port can be flagged as a
* wildcard. When filling it in, fill in a copy of the matched entry
* if it has the cloning flag set.
*/
return is;
}
return NULL;
} else {
}
if ((flags & SI_W_SPORT) != 0) {
if (rev == 0) {
} else {
}
} else if ((flags & SI_W_DPORT) != 0) {
if (rev == 0) {
} else {
}
}
}
ret = -1;
/*
* If we are dealing with the first packet coming in reverse
* direction (sent by peer), then we have to set options into
* state.
*/
}
}
}
/*
* Check if the interface name for this "direction" is set and if not,
* fill it in.
*/
}
return is;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_checkicmpmatchingstate */
/* Returns: Nil */
/* Parameters: fin(I) - pointer to packet information */
/* */
/* If we've got an ICMP error message, using the information stored in the */
/* ICMP packet, look for a matching state table entry. */
/* */
/* If we return NULL then no lock on ipf_state is held. */
/* If we return non-null then a read-lock on ipf_state is held. */
/* ------------------------------------------------------------------------ */
{
int len;
/*
* Does it at least have the return (basic) IP header ?
* Is it an actual recognised ICMP error type?
* Only a basic IP header (no options) should be with
* an ICMP error header.
*/
return NULL;
/*
* Check if the at least the old IP header (with options) and
* 8 bytes of payload is present.
*/
return NULL;
/*
* Sanity Checks.
*/
return NULL;
/*
* Is the buffer big enough for all of it ? It's the size of the IP
* header claimed in the encapsulated part which is of concern. It
* may be too big to be in this buffer but not so big that it's
* outside the ICMP packet, leading to TCP deref's causing problems.
* This is possible because we don't know how big oip_hl is when we
* do the pullup early in fr_check() and thus can't guarantee it is
* all here now.
*/
#ifdef _KERNEL
{
mb_t *m;
# if defined(MENTAT)
return NULL;
# else
return NULL;
# endif
}
#endif
/*
* in the IPv4 case we must zero the i6addr union otherwise
* the IP6_EQ and IP6_NEQ macros produce the wrong results because
* of the 'junk' in the unused part of the union
*/
/*
* we make an fin entry to be able to feed it to
* matchsrcdst note that not all fields are encessary
* but this is the cleanest way. Note further we fill
* in fin_mp such that if someone uses it we'll get
* a kernel panic. fr_matchsrcdst does not use this.
*
* watch out here, as ip is in host order and oip in network
* order. Any change we make must be undone afterwards, like
* oip->ip_off - it is still in network byte order so fix it.
*/
/*
* Reset the short and bad flag here because in fr_matchsrcdst()
* the flags for the current packet (fin_flx) are compared against
* those for the existing session.
*/
/*
* Put old values of ip_len and ip_off back as we don't know
* if we have to forward the packet (or process it again.
*/
{
case IPPROTO_ICMP :
/*
* an ICMP error can only be generated as a result of an
* ICMP query, not as the response on an ICMP error
*
* XXX theoretically ICMP_ECHOREP and the other reply's are
* ICMP query's as well, but adding them here seems strange XXX
*/
return NULL;
/*
* perform a lookup of the ICMP packet in the state table
*/
continue;
continue;
NULL, FI_ICMPCMP);
return NULL;
}
/*
* i : the index of this packet (the icmp
* unreachable)
* oi : the index of the original packet found
* in the icmp header (i.e. the packet
* causing this icmp)
* backward : original packet was backward
* compared to the state
*/
continue;
is->is_icmppkts[i]++;
return is;
}
}
return NULL;
case IPPROTO_TCP :
case IPPROTO_UDP :
break;
default :
return NULL;
}
/*
* Only allow this icmp though if the
* encapsulated packet was allowed through the
* other way around. Note that the minimal amount
* of info present does not allow for checking against
* tcp internals such as seq and ack numbers. Only the
* ports are known to be present and can be even if the
* short flag is set.
*/
tcp, FI_ICMPCMP))) {
/*
* i : the index of this packet (the icmp unreachable)
* oi : the index of the original packet found in the
* icmp header (i.e. the packet causing this icmp)
* backward : original packet was backward compared to
* the state
*/
break;
is->is_icmppkts[i]++;
/*
* we deliberately do not touch the timeouts
* for the accompanying state table entry.
* It remains to be seen if that is correct. XXX
*/
return is;
}
}
return NULL;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_ipsmove */
/* Returns: Nil */
/* Parameters: is(I) - pointer to state table entry */
/* hv(I) - new hash value for state table entry */
/* Write Locks: ipf_state */
/* */
/* Move a state entry from one position in the hash table to another. */
/* ------------------------------------------------------------------------ */
{
/*
* Remove the hash from the old location...
*/
/*
* ...and put the hash in the new one.
*/
if (*isp)
else
}
/* ------------------------------------------------------------------------ */
/* Function: fr_stlookup */
/* Returns: ipstate_t* - NULL == no matching state found, */
/* else pointer to state information is returned */
/* Parameters: fin(I) - pointer to packet information */
/* */
/* Search the state table for a matching entry to the packet described by */
/* the contents of *fin. */
/* */
/* If we return NULL then no lock on ipf_state is held. */
/* If we return non-null then a read-lock on ipf_state is held. */
/* ------------------------------------------------------------------------ */
{
int oow;
#ifdef USE_INET6
if (v == 6) {
} else {
}
}
#endif
if ((v == 4) &&
} else {
}
}
/*
* Search the hash table for matching packet header info.
*/
switch (pr)
{
#ifdef USE_INET6
case IPPROTO_ICMPV6 :
tryagain = 0;
if (v == 6) {
}
}
continue;
else
break;
}
}
}
break;
}
/*
* No matching icmp state entry. Perhaps this is a
* response to another state entry.
*
* XXX With some ICMP6 packets, the "other" address is already
* in the packet, after the ICMP6 header, and this could be
* used in place of the multicast address. However, taking
* advantage of this requires some significant code changes
* to handle the specific types where that is the case.
*/
tryagain = 1;
goto icmp6again;
}
return is;
break;
#endif
case IPPROTO_ICMP :
if (v == 4) {
}
continue;
else
break;
}
}
}
break;
case IPPROTO_TCP :
case IPPROTO_UDP :
oow = 0;
tryagain = 0;
continue;
if (pr == IPPROTO_TCP) {
continue;
}
}
break;
}
}
if (tryagain &&
}
break;
}
if (tryagain == 0) {
} else if (tryagain == 1) {
/*
* If we try to pretend this is a reply to a
* exclude part of the address from the hash
* calculation.
*/
} else {
}
}
tryagain++;
if (tryagain <= 2) {
goto retry_tcpudp;
}
}
break;
#if 0
case IPPROTO_GRE :
}
/* FALLTHROUGH */
#endif
default :
continue;
break;
}
}
}
break;
}
return is;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_updatestate */
/* Returns: Nil */
/* Parameters: fin(I) - pointer to packet information */
/* is(I) - pointer to state table entry */
/* Read Locks: ipf_state */
/* */
/* Updates packet and byte counters for a newly received packet. Seeds the */
/* fragment cache with a new entry as required. */
/* ------------------------------------------------------------------------ */
{
int i, pass;
/*
* For TCP packets, ifq == NULL. For all others, check if this new
* queue is different to the last one it was on and move it if so.
*/
#ifdef IPFILTER_SYNC
#endif
/*
* If this packet is a fragment and the rule says to track fragments,
* then create a new fragment cache entry.
*/
}
/* ------------------------------------------------------------------------ */
/* Function: fr_checkstate */
/* Returns: frentry_t* - NULL == search failed, */
/* else pointer to rule for matching state */
/* Parameters: ifp(I) - pointer to interface */
/* passp(I) - pointer to filtering result flags */
/* */
/* Check if a packet is associated with an entry in the state table. */
/* ------------------------------------------------------------------------ */
{
return NULL;
#ifdef USE_INET6
#endif
)
else
/*
* Search the hash table for matching packet header info.
*/
{
#ifdef USE_INET6
case IPPROTO_ICMPV6 :
break;
goto matched;
}
break;
#endif
case IPPROTO_ICMP :
break;
/*
* No matching icmp state entry. Perhaps this is a
* response to another state entry.
*/
goto matched;
break;
case IPPROTO_TCP :
break;
}
break;
default :
else
break;
}
return NULL;
}
return NULL;
}
return NULL;
}
}
}
if ((pass & FR_LOGFIRST) != 0)
return fr;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_fixoutisn */
/* Returns: Nil */
/* Parameters: fin(I) - pointer to packet information */
/* is(I) - pointer to master state structure */
/* */
/* Called only for outbound packets, adjusts the sequence number and the */
/* TCP checksum to match that change. */
/* ------------------------------------------------------------------------ */
{
int rev;
if (rev == 0) {
}
}
if (rev == 1) {
}
}
}
/* ------------------------------------------------------------------------ */
/* Function: fr_fixinisn */
/* Returns: Nil */
/* Parameters: fin(I) - pointer to packet information */
/* is(I) - pointer to master state structure */
/* */
/* Called only for inbound packets, adjusts the acknowledge number and the */
/* TCP checksum to match that change. */
/* ------------------------------------------------------------------------ */
{
int rev;
if (rev == 1) {
}
}
if (rev == 0) {
}
}
}
/* ------------------------------------------------------------------------ */
/* Function: fr_statesync */
/* Returns: Nil */
/* Parameters: action(I) - type of synchronisation to do */
/* v(I) - IP version being sync'd (v4 or v6) */
/* ifp(I) - interface identifier associated with action */
/* name(I) - name associated with ifp parameter */
/* */
/* Walk through all state entries and if an interface pointer match is */
/* found then look it up again, based on its name in case the pointer has */
/* changed since last time. */
/* */
/* If ifp is passed in as being non-null then we are only doing updates for */
/* existing, matching, uses of it. */
/* ------------------------------------------------------------------------ */
int action, v;
void *ifp;
char *name;
{
int i;
if (ifs->ifs_fr_running <= 0)
return;
if (ifs->ifs_fr_running <= 0) {
return;
}
switch (action)
{
case IPFSYNC_RESYNC :
continue;
/*
* Look up all the interface names in the state entry.
*/
for (i = 0; i < 4; i++) {
}
}
break;
case IPFSYNC_NEWIFP :
continue;
/*
* Look up all the interface names in the state entry.
*/
for (i = 0; i < 4; i++) {
}
}
break;
case IPFSYNC_OLDIFP :
continue;
/*
* Look up all the interface names in the state entry.
*/
for (i = 0; i < 4; i++) {
}
}
break;
}
}
#if SOLARIS2 >= 10
/* ------------------------------------------------------------------------ */
/* Function: fr_stateifindexsync */
/* Returns: void */
/* Parameters: ifp - current network interface descriptor (ifindex) */
/* newifp - new interface descriptor (new ifindex) */
/* ifs - pointer to IPF stack */
/* */
/* Write Locks: assumes ipf_mutex is locked */
/* */
/* Updates all interface indeces matching to ifp with new interface index */
/* value. */
/* ------------------------------------------------------------------------ */
void *ifp;
void *newifp;
{
int i;
for (i = 0; i < 4; i++) {
}
}
}
#endif
/* ------------------------------------------------------------------------ */
/* Function: fr_delstate */
/* Returns: int - 0 = entry deleted, else ref count on entry */
/* Parameters: is(I) - pointer to state structure to delete */
/* why(I) - if not 0, log reason why it was deleted */
/* ifs - ipf stack instance */
/* Write Locks: ipf_state/ipf_global */
/* */
/* Deletes a state entry from the enumerated list as well as the hash table */
/* and timeout queue lists. Make adjustments to hash table statistics and */
/* global counters as required. */
/* ------------------------------------------------------------------------ */
int why;
{
int removed = 0;
/*
* Start by removing the entry from the hash table of state entries
* so it will not be "used" again.
*
* It will remain in the "list" of state entries until all references
* have been accounted for.
*/
removed = 1;
}
/*
* Because ifs->ifs_ips_stats.iss_wild is a count of entries in the state
* table that have wildcard flags set, only decerement it once
* and do it here.
*/
}
}
/*
* Next, remove it from the timeout queue it is in.
*/
/*
* If it is still in use by something else, do not go any further,
* but note that at this point it is now an orphan.
*/
if (removed)
}
/*
* If entry has already been removed from table,
* it means we're simply cleaning up an orphan.
*/
if (!removed)
#ifdef IPFILTER_SYNC
#endif
#ifdef IPFILTER_SCAN
(void) ipsc_detachis(is);
#endif
/*
* Now remove it from master list of state table entries.
*/
}
}
}
ifs->ifs_ips_num--;
return (0);
}
/* ------------------------------------------------------------------------ */
/* Function: fr_timeoutstate */
/* Returns: Nil */
/* Parameters: ifs - ipf stack instance */
/* */
/* Slowly expire held state for thingslike UDP and ICMP. The algorithm */
/* used here is to keep the queue sorted with the oldest things at the top */
/* and the youngest at the bottom. So if the top one doesn't need to be */
/* expired then neither will any under it. */
/* ------------------------------------------------------------------------ */
void fr_timeoutstate(ifs)
{
SPL_INT(s);
SPL_NET(s);
break;
}
break;
}
}
}
}
if (ifs->ifs_fr_state_doflush) {
ifs->ifs_fr_state_doflush = 0;
}
SPL_X(s);
}
/* ---------------------------------------------------------------------- */
/* Function: fr_state_flush */
/* Returns: int - 0 == success, -1 == failure */
/* Parameters: flush_option - how to flush the active State table */
/* proto - IP version to flush (4, 6, or both) */
/* ifs - ipf stack instance */
/* Write Locks: ipf_state */
/* */
/* Flush state tables. Three possible flush options currently defined: */
/* */
/* FLUSH_TABLE_ALL : Flush all state table entries */
/* */
/* FLUSH_TABLE_CLOSING : Flush entries with TCP connections which */
/* have started to close on both ends using */
/* ipf_flushclosing(). */
/* */
/* FLUSH_TABLE_EXTRA : First, flush entries which are "almost" closed. */
/* Then, if needed, flush entries with TCP */
/* connections which have been idle for a long */
/* time with ipf_extraflush(). */
/* ---------------------------------------------------------------------- */
int flush_option, proto;
{
int removed;
SPL_INT(s);
removed = 0;
SPL_NET(s);
switch (flush_option)
{
case FLUSH_TABLE_ALL:
continue;
removed++;
}
break;
case FLUSH_TABLE_CLOSING:
ifs);
break;
case FLUSH_TABLE_EXTRA:
ifs);
/*
* Be sure we haven't done this in the last 10 seconds.
*/
IPF_TTLVAL(10))
break;
ifs);
break;
default: /* Flush Nothing */
break;
}
SPL_X(s);
return (removed);
}
/* ------------------------------------------------------------------------ */
/* Function: fr_tcp_age */
/* Returns: int - 1 == state transition made, 0 == no change (rejected) */
/* Parameters: tq(I) - pointer to timeout queue information */
/* fin(I) - pointer to packet information */
/* tqtab(I) - TCP timeout queue table this is in */
/* */
/* Rewritten by Arjan de Vet <Arjan.deVet@adv.iae.nl>, 2000-07-29: */
/* */
/* - (try to) base state transitions on real evidence only, */
/* i.e. packets that are sent and have been received by ipfilter; */
/* */
/* - deal with half-closed connections correctly; */
/* */
/* - store the state of the source in state[0] such that ipfstat */
/* to fr_tcp_age have been changed accordingly. */
/* */
/* Internal Parameters: */
/* */
/* state[0] = state of source (host that initiated connection) */
/* state[1] = state of dest (host that accepted the connection) */
/* */
/* dir == 0 : a packet from source to dest */
/* dir == 1 : a packet from dest to source */
/* */
/* Locking: it is assumed that the parent of the tqe structure is locked. */
/* ------------------------------------------------------------------------ */
int flags;
{
rval = 0;
int, ostate,
int, nstate,
);
else
/*
* Once RST is received, we must advance peer's state to
* CLOSE_WAIT.
*/
if (ostate <= IPF_TCPS_ESTABLISHED) {
}
rval = 1;
} else {
switch (nstate)
{
case IPF_TCPS_LISTEN: /* 0 */
/*
* 'dir' received an S and sends SA in
* response, CLOSED -> SYN_RECEIVED
*/
rval = 1;
/* 'dir' sent S, CLOSED -> SYN_SENT */
rval = 1;
}
/*
* the next piece of code makes it possible to get
* already established connections into the state table
* after a restart or reload of the filter rules; this
* does not work when a strict 'flags S keep state' is
* used for tcp connections of course
*/
/*
* we saw an A, guess 'dir' is in ESTABLISHED
* mode
*/
switch (ostate)
{
case IPF_TCPS_LISTEN :
case IPF_TCPS_SYN_RECEIVED :
rval = 1;
break;
case IPF_TCPS_HALF_ESTAB :
case IPF_TCPS_ESTABLISHED :
rval = 1;
break;
default :
break;
}
}
/*
* TODO: besides regular ACK packets we can have other
* packets as well; it is yet to be determined how we
* should initialize the states in those cases
*/
break;
case IPF_TCPS_SYN_SENT: /* 1 */
/*
* A retransmitted SYN packet. We do not reset
* the timeout here to fr_tcptimeout because a
* connection connect timeout does not renew
* after every packet that is sent. We need to
* set rval so as to indicate the packet has
* passed the check for its flags being valid
* in the TCP FSM. Setting rval to 2 has the
* result of not resetting the timeout.
*/
rval = 2;
TH_ACK) {
/*
* we see an A from 'dir' which is in SYN_SENT
* state: 'dir' sent an A in response to an SA
* which it received, SYN_SENT -> ESTABLISHED
*/
rval = 1;
/*
* we see an F from 'dir' which is in SYN_SENT
* state and wants to close its side of the
* connection; SYN_SENT -> FIN_WAIT_1
*/
rval = 1;
/*
* we see an SA from 'dir' which is already in
* SYN_SENT state, this means we have a
* simultaneous open; SYN_SENT -> SYN_RECEIVED
*/
rval = 1;
}
break;
case IPF_TCPS_SYN_RECEIVED: /* 2 */
/*
* we see an A from 'dir' which was in
* SYN_RECEIVED state so it must now be in
* established state, SYN_RECEIVED ->
* ESTABLISHED
*/
rval = 1;
TH_OPENING) {
/*
* We see an SA from 'dir' which is already in
* SYN_RECEIVED state.
*/
rval = 2;
/*
* we see an F from 'dir' which is in
* SYN_RECEIVED state and wants to close its
* side of the connection; SYN_RECEIVED ->
* FIN_WAIT_1
*/
rval = 1;
}
break;
case IPF_TCPS_HALF_ESTAB: /* 3 */
rval = 1;
/*
* If we've picked up a connection in mid
* flight, we could be looking at a follow on
* packet from the same direction as the one
* that created this state. Recognise it but
* do not advance the entire connection's
* state.
*/
switch (ostate)
{
case IPF_TCPS_LISTEN :
case IPF_TCPS_SYN_SENT :
case IPF_TCPS_SYN_RECEIVED :
rval = 1;
break;
case IPF_TCPS_HALF_ESTAB :
case IPF_TCPS_ESTABLISHED :
rval = 1;
break;
default :
break;
}
}
break;
case IPF_TCPS_ESTABLISHED: /* 4 */
rval = 1;
/*
* 'dir' closed its side of the connection;
* this gives us a half-closed connection;
* ESTABLISHED -> FIN_WAIT_1
*/
if (ostate == IPF_TCPS_FIN_WAIT_1) {
} else {
}
/*
* an ACK, should we exclude other flags here?
*/
if (ostate == IPF_TCPS_FIN_WAIT_1) {
/*
* We know the other side did an active
* close, so we are ACKing the recvd
* FIN packet (does the window matching
* code guarantee this?) and go into
* CLOSE_WAIT state; this gives us a
* half-closed connection
*/
} else if (ostate < IPF_TCPS_CLOSE_WAIT) {
/*
* still a fully established
* connection reset timeout
*/
}
}
break;
case IPF_TCPS_CLOSE_WAIT: /* 5 */
rval = 1;
/*
* application closed and 'dir' sent a FIN,
* we're now going into LAST_ACK state
*/
} else {
/*
* we remain in CLOSE_WAIT because the other
* side has closed already and we did not
* close our side yet; reset timeout
*/
}
break;
case IPF_TCPS_FIN_WAIT_1: /* 6 */
rval = 1;
/*
* if the other side is not active anymore
* it has sent us a FIN packet that we are
* ack'ing now with an ACK; this means both
* sides have now closed the connection and
* we go into LAST_ACK
*/
/*
* XXX: how do we know we really are ACKing
* the FIN packet here? does the window code
* guarantee that?
*/
} else {
/*
* we closed our side of the connection
* already but the other side is still active
* (ESTABLISHED/CLOSE_WAIT); continue with
* this half-closed connection
*/
}
break;
case IPF_TCPS_CLOSING: /* 7 */
}
rval = 1;
break;
case IPF_TCPS_LAST_ACK: /* 8 */
/*
* We want to reset timer here to keep state in table.
* If we would allow the state to time out here, while
* there would still be packets being retransmitted, we
* would cut off line between the two peers preventing
* them to close connection properly.
*/
rval = 1;
break;
case IPF_TCPS_FIN_WAIT_2: /* 9 */
/* NOT USED */
break;
case IPF_TCPS_TIME_WAIT: /* 10 */
/* we're in 2MSL timeout now */
if (ostate == IPF_TCPS_LAST_ACK) {
rval = 1;
} else {
rval = 2;
}
break;
case IPF_TCPS_CLOSED: /* 11 */
rval = 2;
break;
default :
#if defined(_KERNEL)
nstate <= IPF_TCPS_CLOSED);
#else
abort();
#endif
break;
}
}
/*
* If rval == 2 then do not update the queue position, but treat the
* packet as being ok.
*/
if (rval == 2) {
rval = 1;
}
else if (rval == 1) {
/*
* The nstate can either advance to a new state, or remain
* unchanged, resetting the timer by moving to the bottom of
* the queue.
*/
}
return rval;
}
/* ------------------------------------------------------------------------ */
/* Function: ipstate_log */
/* Returns: Nil */
/* Parameters: is(I) - pointer to state structure */
/* type(I) - type of log entry to create */
/* */
/* Creates a state table log entry using the state structure and type info. */
/* passed in. Log packet/byte counts, source/destination address and other */
/* protocol specific information. */
/* ------------------------------------------------------------------------ */
{
#ifdef IPFILTER_LOG
void *items[1];
int types[1];
/*
* Copy information out of the ipstate_t structure and into the
* structure used for logging.
*/
}
} else {
}
types[0] = 0;
} else {
}
#endif
}
#ifdef USE_INET6
/* ------------------------------------------------------------------------ */
/* Function: fr_checkicmp6matchingstate */
/* Returns: ipstate_t* - NULL == no match found, */
/* else pointer to matching state entry */
/* Parameters: fin(I) - pointer to packet information */
/* Locks: NULL == no locks, else Read Lock on ipf_state */
/* */
/* If we've got an ICMPv6 error message, using the information stored in */
/* the ICMPv6 packet, look for a matching state table entry. */
/* ------------------------------------------------------------------------ */
{
int backward, i;
icmpinfo_t *ic;
/*
* Does it at least have the return (basic) IP header ?
* Is it an actual recognised ICMP error type?
* Only a basic IP header (no options) should be with
* an ICMP error header.
*/
return NULL;
return NULL;
/*
* We make a fin entry to be able to feed it to
* matchsrcdst. Note that not all fields are necessary
* but this is the cleanest way. Note further we fill
* in fin_mp such that if someone uses it we'll get
* a kernel panic. fr_matchsrcdst does not use this.
*
* watch out here, as ip is in host order and oip6 in network
* order. Any change we make must be undone afterwards.
*/
/*
* an ICMP error can only be generated as a result of an
* ICMP query, not as the response on an ICMP error
*
* XXX theoretically ICMP_ECHOREP and the other reply's are
* ICMP query's as well, but adding them here seems strange XXX
*/
return NULL;
/*
* perform a lookup of the ICMP packet in the state table
*/
/*
* in the state table ICMP query's are stored
* with the type of the corresponding ICMP
* response. Correct here
*/
is->is_icmppkts[i]++;
return is;
}
}
}
return NULL;
}
} else
/*
* Only allow this icmp though if the
* encapsulated packet was allowed through the
* other way around. Note that the minimal amount
* of info present does not allow for checking against
* tcp internals such as seq and ack numbers.
*/
continue;
is->is_icmppkts[i]++;
/*
* we deliberately do not touch the timeouts
* for the accompanying state table entry.
* It remains to be seen if that is correct. XXX
*/
return is;
}
}
return NULL;
}
#endif
/* ------------------------------------------------------------------------ */
/* Function: fr_sttab_init */
/* Returns: Nil */
/* Parameters: tqp(I) - pointer to an array of timeout queues for TCP */
/* */
/* Initialise the array of timeout queues for TCP. */
/* ------------------------------------------------------------------------ */
{
int i;
for (i = IPF_TCP_NSTATES - 1; i >= 0; i--) {
}
}
/* ------------------------------------------------------------------------ */
/* Function: fr_sttab_destroy */
/* Returns: Nil */
/* Parameters: tqp(I) - pointer to an array of timeout queues for TCP */
/* */
/* Do whatever is necessary to "destroy" each of the entries in the array */
/* of timeout queues for TCP. */
/* ------------------------------------------------------------------------ */
void fr_sttab_destroy(tqp)
{
int i;
for (i = IPF_TCP_NSTATES - 1; i >= 0; i--)
}
/* ------------------------------------------------------------------------ */
/* Function: fr_statederef */
/* Returns: Nil */
/* Parameters: isp(I) - pointer to pointer to state table entry */
/* ifs - ipf stack instance */
/* */
/* Decrement the reference counter for this state table entry and free it */
/* if there are no more things using it. */
/* */
/* Internal parameters: */
/* state[0] = state of source (host that initiated connection) */
/* state[1] = state of dest (host that accepted the connection) */
/* ------------------------------------------------------------------------ */
{
#ifndef _KERNEL
}
#endif
return;
}
}
/* ------------------------------------------------------------------------ */
/* Function: fr_setstatequeue */
/* Returns: Nil */
/* Parameters: is(I) - pointer to state structure */
/* rev(I) - forward(0) or reverse(1) direction */
/* Locks: ipf_state (read or write) */
/* */
/* Put the state entry on its default queue entry, using rev as a helped in */
/* determining which queue it should be placed on. */
/* ------------------------------------------------------------------------ */
int rev;
{
else
{
#ifdef USE_INET6
case IPPROTO_ICMPV6 :
if (rev == 1)
else
break;
#endif
case IPPROTO_ICMP :
if (rev == 1)
else
break;
case IPPROTO_TCP :
break;
case IPPROTO_UDP :
if (rev == 1)
else
break;
default :
break;
}
}
/*
* If it's currently on a timeout queue, move it from one queue to
* another, else put it on the end of the newly determined queue.
*/
else
return;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_stateiter */
/* Returns: int - 0 == success, else error */
/* Parameters: token(I) - pointer to ipftoken structure */
/* itp(I) - pointer to ipfgeniter structure */
/* */
/* This function handles the SIOCGENITER ioctl for the state tables and */
/* walks through the list of entries in the state table list (ips_list.) */
/* ------------------------------------------------------------------------ */
{
char *dst;
return EFAULT;
if (itp->igi_nitems == 0)
return EINVAL;
return EINVAL;
error = 0;
/*
* Get "previous" entry from the token and find the next entry.
*/
} else {
}
/*
* If we found an entry, add a reference to it and update the token.
* Otherwise, zero out data to be returned and NULL out token.
*/
} else {
}
/*
* Safe to release lock now the we have a reference.
*/
/*
* Copy out data and clean up references and tokens.
*/
if (error != 0)
break;
} else {
break;
}
}
break;
}
return error;
}