Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/netinet/ip_fw.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /* 2 * Copyright (c) 1993 Daniel Boulet 3 * Copyright (c) 1994 Ugen J.S.Antsilevich 4 * Copyright (c) 1996 Alex Nash 5 * 6 * Redistribution and use in source forms, with and without modification, 7 * are permitted provided that this entire comment appears intact. 8 * 9 * Redistribution in binary form may occur without any restrictions. 10 * Obviously, it would be nice if you gave credit where credit is due 11 * but requiring it would be too onerous. 12 * 13 * This software is provided ``AS IS'' without any warranties of any kind. 14 * 15 * $FreeBSD: src/sys/netinet/ip_fw.c,v 1.51.2.25 1999/09/05 08:18:28 peter Exp $ 16 */ 17 18 /* 19 * Implement IP packet firewall 20 */ 21 22 #ifndef IPFIREWALL_MODULE 23 #include "opt_ipfw.h" 24 #endif 25 26 #include <sys/param.h> 27 #include <sys/systm.h> 28 #include <sys/malloc.h> 29 #include <sys/mbuf.h> 30 #include <sys/queue.h> 31 #include <sys/kernel.h> 32 #include <sys/socket.h> 33 #include <sys/time.h> 34 #include <sys/sysctl.h> 35 #include <net/if.h> 36 #include <net/route.h> 37 #include <netinet/in.h> 38 #include <netinet/in_systm.h> 39 #include <netinet/ip.h> 40 #include <netinet/ip_var.h> 41 #include <netinet/ip_icmp.h> 42 #include <netinet/ip_fw.h> 43 #ifdef DUMMYNET 44 #include <netinet/ip_dummynet.h> 45 #endif 46 #include <netinet/tcp.h> 47 #include <netinet/tcp_timer.h> 48 #include <netinet/tcp_var.h> 49 #include <netinet/tcpip.h> 50 #include <netinet/udp.h> 51 52 #include <netinet/if_ether.h> /* XXX ethertype_ip */ 53 54 static int fw_debug = 1; 55 #ifdef IPFIREWALL_VERBOSE 56 static int fw_verbose = 1; 57 #else 58 static int fw_verbose = 0; 59 #endif 60 #ifdef IPFIREWALL_VERBOSE_LIMIT 61 static int fw_verbose_limit = IPFIREWALL_VERBOSE_LIMIT; 62 #else 63 static int fw_verbose_limit = 0; 64 #endif 65 static int fw_one_pass = 1; 66 67 LIST_HEAD (ip_fw_head, ip_fw_chain) ip_fw_chain; 68 69 #ifdef SYSCTL_NODE 70 SYSCTL_NODE(_net_inet_ip, OID_AUTO, fw, CTLFLAG_RW, 0, "Firewall"); 71 SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, debug, CTLFLAG_RW, &fw_debug, 0, ""); 72 SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, one_pass, CTLFLAG_RW, &fw_one_pass, 0, ""); 73 SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, verbose, CTLFLAG_RW, &fw_verbose, 0, ""); 74 SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, verbose_limit, CTLFLAG_RW, &fw_verbose_limit, 0, ""); 75 #endif 76 77 #define dprintf(a) if (!fw_debug); else printf a 78 79 #define print_ip(a) printf("%ld.%ld.%ld.%ld",(ntohl(a.s_addr)>>24)&0xFF,\ 80 (ntohl(a.s_addr)>>16)&0xFF,\ 81 (ntohl(a.s_addr)>>8)&0xFF,\ 82 (ntohl(a.s_addr))&0xFF); 83 84 #define dprint_ip(a) if (!fw_debug); else print_ip(a) 85 86 static int add_entry __P((struct ip_fw_head *chainptr, struct ip_fw *frwl)); 87 static int del_entry __P((struct ip_fw_head *chainptr, u_short number)); 88 static int zero_entry __P((struct mbuf *m)); 89 static struct ip_fw *check_ipfw_struct __P((struct ip_fw *m)); 90 static struct ip_fw *check_ipfw_mbuf __P((struct mbuf *fw)); 91 static int ipopts_match __P((struct ip *ip, struct ip_fw *f)); 92 static int port_match __P((u_short *portptr, int nports, u_short port, 93 int range_flag)); 94 static int tcpflg_match __P((struct tcphdr *tcp, struct ip_fw *f)); 95 static int icmptype_match __P((struct icmp * icmp, struct ip_fw * f)); 96 static void ipfw_report __P((struct ip_fw *f, struct ip *ip, 97 struct ifnet *rif, struct ifnet *oif)); 98 99 static void flush_rule_ptrs(void); 100 101 #ifdef IPFIREWALL_MODULE 102 static ip_fw_chk_t *old_chk_ptr; 103 static ip_fw_ctl_t *old_ctl_ptr; 104 #endif 105 106 static int ip_fw_chk __P((struct ip **pip, int hlen, 107 struct ifnet *oif, u_int16_t *cookie, 108 struct mbuf **m, struct ip_fw_chain **)); 109 static int ip_fw_ctl __P((int stage, struct mbuf **mm)); 110 111 static char err_prefix[] = "ip_fw_ctl:"; 112 113 /* 114 * Returns 1 if the port is matched by the vector, 0 otherwise 115 */ 116 static inline int 117 port_match(u_short *portptr, int nports, u_short port, int range_flag) 118 { 119 if (!nports) 120 return 1; 121 if (range_flag) { 122 if (portptr[0] <= port && port <= portptr[1]) { 123 return 1; 124 } 125 nports -= 2; 126 portptr += 2; 127 } 128 while (nports-- > 0) { 129 if (*portptr++ == port) { 130 return 1; 131 } 132 } 133 return 0; 134 } 135 136 static int 137 tcpflg_match(struct tcphdr *tcp, struct ip_fw *f) 138 { 139 u_char flg_set, flg_clr; 140 141 if ((f->fw_tcpf & IP_FW_TCPF_ESTAB) && 142 (tcp->th_flags & (IP_FW_TCPF_RST | IP_FW_TCPF_ACK))) 143 return 1; 144 145 flg_set = tcp->th_flags & f->fw_tcpf; 146 flg_clr = tcp->th_flags & f->fw_tcpnf; 147 148 if (flg_set != f->fw_tcpf) 149 return 0; 150 if (flg_clr) 151 return 0; 152 153 return 1; 154 } 155 156 static int 157 icmptype_match(struct icmp *icmp, struct ip_fw *f) 158 { 159 int type; 160 161 if (!(f->fw_flg & IP_FW_F_ICMPBIT)) 162 return(1); 163 164 type = icmp->icmp_type; 165 166 /* check for matching type in the bitmap */ 167 if (type < IP_FW_ICMPTYPES_DIM * sizeof(unsigned) * 8 && 168 (f->fw_icmptypes[type / (sizeof(unsigned) * 8)] & 169 (1U << (type % (8 * sizeof(unsigned)))))) 170 return(1); 171 172 return(0); /* no match */ 173 } 174 175 static int 176 is_icmp_query(struct ip *ip) 177 { 178 const struct icmp *icmp; 179 int icmp_type; 180 181 icmp = (struct icmp *)((u_long *)ip + ip->ip_hl); 182 icmp_type = icmp->icmp_type; 183 184 if (icmp_type == ICMP_ECHO || icmp_type == ICMP_ROUTERSOLICIT || 185 icmp_type == ICMP_TSTAMP || icmp_type == ICMP_IREQ || 186 icmp_type == ICMP_MASKREQ) 187 return(1); 188 189 return(0); 190 } 191 192 static int 193 ipopts_match(struct ip *ip, struct ip_fw *f) 194 { 195 register u_char *cp; 196 int opt, optlen, cnt; 197 u_char opts, nopts, nopts_sve; 198 199 cp = (u_char *)(ip + 1); 200 cnt = (ip->ip_hl << 2) - sizeof (struct ip); 201 opts = f->fw_ipopt; 202 nopts = nopts_sve = f->fw_ipnopt; 203 204 for (; cnt > 0; cnt -= optlen, cp += optlen) { 205 opt = cp[IPOPT_OPTVAL]; 206 if (opt == IPOPT_EOL) 207 break; 208 if (opt == IPOPT_NOP) 209 optlen = 1; 210 else { 211 optlen = cp[IPOPT_OLEN]; 212 if (optlen <= 0 || optlen > cnt) { 213 return 0; /*XXX*/ 214 } 215 } 216 switch (opt) { 217 218 default: 219 break; 220 221 case IPOPT_LSRR: 222 opts &= ~IP_FW_IPOPT_LSRR; 223 nopts &= ~IP_FW_IPOPT_LSRR; 224 break; 225 226 case IPOPT_SSRR: 227 opts &= ~IP_FW_IPOPT_SSRR; 228 nopts &= ~IP_FW_IPOPT_SSRR; 229 break; 230 231 case IPOPT_RR: 232 opts &= ~IP_FW_IPOPT_RR; 233 nopts &= ~IP_FW_IPOPT_RR; 234 break; 235 case IPOPT_TS: 236 opts &= ~IP_FW_IPOPT_TS; 237 nopts &= ~IP_FW_IPOPT_TS; 238 break; 239 } 240 if (opts == nopts) 241 break; 242 } 243 if (opts == 0 && nopts == nopts_sve) 244 return 1; 245 else 246 return 0; 247 } 248 249 static inline int 250 iface_match(struct ifnet *ifp, union ip_fw_if *ifu, int byname) 251 { 252 /* Check by name or by IP address */ 253 if (byname) { 254 /* Check unit number (-1 is wildcard) */ 255 if (ifu->fu_via_if.unit != -1 256 && ifp->if_unit != ifu->fu_via_if.unit) 257 return(0); 258 /* Check name */ 259 if (strncmp(ifp->if_name, ifu->fu_via_if.name, FW_IFNLEN)) 260 return(0); 261 return(1); 262 } else if (ifu->fu_via_ip.s_addr != 0) { /* Zero == wildcard */ 263 struct ifaddr *ia; 264 265 for (ia = ifp->if_addrlist; ia; ia = ia->ifa_next) { 266 if (ia->ifa_addr == NULL) 267 continue; 268 if (ia->ifa_addr->sa_family != AF_INET) 269 continue; 270 if (ifu->fu_via_ip.s_addr != ((struct sockaddr_in *) 271 (ia->ifa_addr))->sin_addr.s_addr) 272 continue; 273 return(1); 274 } 275 return(0); 276 } 277 return(1); 278 } 279 280 static void 281 ipfw_report(struct ip_fw *f, struct ip *ip, 282 struct ifnet *rif, struct ifnet *oif) 283 { 284 if (ip) { 285 static int counter; 286 struct tcphdr *const tcp = (struct tcphdr *) ((u_long *) ip+ ip->ip_hl); 287 struct udphdr *const udp = (struct udphdr *) ((u_long *) ip+ ip->ip_hl); 288 struct icmp *const icmp = (struct icmp *) ((u_long *) ip + ip->ip_hl); 289 int count; 290 291 count = f ? f->fw_pcnt : ++counter; 292 if (fw_verbose_limit != 0 && count > fw_verbose_limit) 293 return; 294 295 /* Print command name */ 296 printf("ipfw: %d ", f ? f->fw_number : -1); 297 if (!f) 298 printf("Refuse"); 299 else 300 switch (f->fw_flg & IP_FW_F_COMMAND) { 301 case IP_FW_F_DENY: 302 printf("Deny"); 303 break; 304 case IP_FW_F_REJECT: 305 if (f->fw_reject_code == IP_FW_REJECT_RST) 306 printf("Reset"); 307 else 308 printf("Unreach"); 309 break; 310 case IP_FW_F_ACCEPT: 311 printf("Accept"); 312 break; 313 case IP_FW_F_COUNT: 314 printf("Count"); 315 break; 316 case IP_FW_F_DIVERT: 317 printf("Divert %d", f->fw_divert_port); 318 break; 319 case IP_FW_F_TEE: 320 printf("Tee %d", f->fw_divert_port); 321 break; 322 case IP_FW_F_SKIPTO: 323 printf("SkipTo %d", f->fw_skipto_rule); 324 break; 325 case IP_FW_F_PIPE: 326 printf("Pipe %d", f->fw_skipto_rule); 327 break; 328 default: 329 printf("UNKNOWN"); 330 break; 331 } 332 printf(" "); 333 334 switch (ip->ip_p) { 335 case IPPROTO_TCP: 336 printf("TCP "); 337 print_ip(ip->ip_src); 338 if ((ip->ip_off & IP_OFFMASK) == 0) 339 printf(":%d ", ntohs(tcp->th_sport)); 340 else 341 printf(" "); 342 print_ip(ip->ip_dst); 343 if ((ip->ip_off & IP_OFFMASK) == 0) 344 printf(":%d", ntohs(tcp->th_dport)); 345 break; 346 case IPPROTO_UDP: 347 printf("UDP "); 348 print_ip(ip->ip_src); 349 if ((ip->ip_off & IP_OFFMASK) == 0) 350 printf(":%d ", ntohs(udp->uh_sport)); 351 else 352 printf(" "); 353 print_ip(ip->ip_dst); 354 if ((ip->ip_off & IP_OFFMASK) == 0) 355 printf(":%d", ntohs(udp->uh_dport)); 356 break; 357 case IPPROTO_ICMP: 358 if ((ip->ip_off & IP_OFFMASK) == 0) 359 printf("ICMP:%u.%u ", icmp->icmp_type, icmp->icmp_code); 360 else 361 printf("ICMP "); 362 print_ip(ip->ip_src); 363 printf(" "); 364 print_ip(ip->ip_dst); 365 break; 366 default: 367 printf("P:%d ", ip->ip_p); 368 print_ip(ip->ip_src); 369 printf(" "); 370 print_ip(ip->ip_dst); 371 break; 372 } 373 if (oif) 374 printf(" out via %s%d", oif->if_name, oif->if_unit); 375 else if (rif) 376 printf(" in via %s%d", rif->if_name, rif->if_unit); 377 if ((ip->ip_off & IP_OFFMASK)) 378 printf(" Fragment = %d",ip->ip_off & IP_OFFMASK); 379 printf("\n"); 380 if (fw_verbose_limit != 0 && count == fw_verbose_limit) 381 printf("ipfw: limit reached on rule #%d\n", 382 f ? f->fw_number : -1); 383 } 384 } 385 386 /* 387 * given an ip_fw_chain *, lookup_next_rule will return a pointer 388 * of the same type to the next one. This can be either the jump 389 * target (for skipto instructions) or the next one in the chain (in 390 * all other cases including a missing jump target). 391 * Backward jumps are not allowed, so start looking from the next 392 * rule... 393 */ 394 static struct ip_fw_chain * lookup_next_rule(struct ip_fw_chain *me); 395 396 static struct ip_fw_chain * 397 lookup_next_rule(struct ip_fw_chain *me) 398 { 399 struct ip_fw_chain *chain ; 400 int rule = me->rule->fw_skipto_rule ; /* guess... */ 401 402 if ( (me->rule->fw_flg & IP_FW_F_COMMAND) == IP_FW_F_SKIPTO ) 403 for (chain = me->chain.le_next; chain ; chain = chain->chain.le_next ) 404 if (chain->rule->fw_number >= rule) 405 return chain ; 406 /* 407 * note the above matches any rule >= the jump target. I 408 * don't think this is a particularly good idea, but it is 409 * how ipfw always worked. 410 */ 411 return me->chain.le_next ; /* failure or not a skipto */ 412 } 413 414 /* 415 * Parameters: 416 * 417 * pip Pointer to packet header (struct ip **) 418 * bridge_ipfw extension: pip = NULL means a complete ethernet packet 419 * including ethernet header in the mbuf. Other fields 420 * are ignored/invalid. 421 * 422 * hlen Packet header length 423 * oif Outgoing interface, or NULL if packet is incoming 424 * #ifndef IPFW_DIVERT_RESTART 425 * *cookie Ignore all divert/tee rules to this port (if non-zero) 426 * #else 427 * *cookie Skip up to the first rule past this rule number; 428 * #endif 429 * *m The packet; we set to NULL when/if we nuke it. 430 * *flow_id pointer to the last matching rule (in/out) 431 * 432 * Return value: 433 * 434 * 0 The packet is to be accepted and routed normally OR 435 * the packet was denied/rejected and has been dropped; 436 * in the latter case, *m is equal to NULL upon return. 437 * port Divert the packet to port. 438 */ 439 440 static int 441 ip_fw_chk(struct ip **pip, int hlen, 442 struct ifnet *oif, u_int16_t *cookie, struct mbuf **m, 443 struct ip_fw_chain **flow_id) 444 { 445 struct ip_fw_chain *chain; 446 struct ip_fw *rule = NULL; 447 struct ip *ip = NULL ; 448 struct ifnet *const rif = (*m)->m_pkthdr.rcvif; 449 u_short offset = 0 ; 450 u_short src_port, dst_port; 451 #ifdef IPFW_DIVERT_RESTART 452 u_int16_t skipto = *cookie; 453 #else 454 u_int16_t ignport = ntohs(*cookie); 455 #endif 456 457 if (pip) { /* normal ip packet */ 458 ip = *pip; 459 offset = (ip->ip_off & IP_OFFMASK); 460 } else { /* bridged or non-ip packet */ 461 struct ether_header *eh = mtod(*m, struct ether_header *); 462 switch (ntohs(eh->ether_type)) { 463 case ETHERTYPE_IP : 464 if ((*m)->m_len<sizeof(struct ether_header) + sizeof(struct ip)) 465 goto non_ip ; 466 ip = (struct ip *)(eh + 1 ); 467 if (ip->ip_v != IPVERSION) 468 goto non_ip ; 469 hlen = ip->ip_hl << 2; 470 if (hlen < sizeof(struct ip)) /* minimum header length */ 471 goto non_ip ; 472 if ((*m)->m_len < 14 + hlen + 14) { 473 printf("-- m_len %d, need more...\n", (*m)->m_len); 474 goto non_ip ; 475 } 476 offset = (ip->ip_off & IP_OFFMASK); 477 break ; 478 default : 479 non_ip: ip = NULL ; 480 break ; 481 } 482 } 483 484 if (*flow_id) { 485 if (fw_one_pass) 486 return 0 ; /* accept if passed first test */ 487 /* 488 * pkt has already been tagged. Look for the next rule 489 * to restart processing 490 */ 491 if ( (chain = (*flow_id)->rule->next_rule_ptr) == NULL ) 492 chain = (*flow_id)->rule->next_rule_ptr = 493 lookup_next_rule(*flow_id) ; 494 if (!chain) 495 goto dropit; 496 } else { 497 chain=LIST_FIRST(&ip_fw_chain); 498 #ifdef IPFW_DIVERT_RESTART 499 if ( skipto ) { 500 /* 501 * If we've been asked to start at a given rule immediatly, 502 * do so. 503 */ 504 if (skipto >= 65535) 505 goto dropit; 506 while (chain && (chain->rule->fw_number <= skipto)) { 507 chain = LIST_NEXT(chain, chain); 508 } 509 if (! chain) 510 goto dropit; 511 } 512 #endif /* IPFW_DIVERT_RESTART */ 513 } 514 *cookie = 0; 515 for (; chain; chain = LIST_NEXT(chain, chain)) { 516 register struct ip_fw *f; 517 again: 518 f = chain->rule; 519 520 if (oif) { 521 /* Check direction outbound */ 522 if (!(f->fw_flg & IP_FW_F_OUT)) 523 continue; 524 } else { 525 /* Check direction inbound */ 526 if (!(f->fw_flg & IP_FW_F_IN)) 527 continue; 528 } 529 530 if (ip == NULL ) { 531 /* 532 * do relevant checks for non-ip packets: 533 * after this, only goto got_match or continue 534 */ 535 struct ether_header *eh = mtod(*m, struct ether_header *); 536 int i, h, l ; 537 #if 0 538 printf("-- ip_fw: rule %d(%d) for %6D <- %6D type 0x%04x\n", 539 f->fw_number, IP_FW_GETNSRCP(f), 540 eh->ether_dhost, ".", eh->ether_shost, ".", 541 ntohs(eh->ether_type) ); 542 #endif 543 /* 544 * make default rule always match or we have a panic 545 */ 546 if (f->fw_number == 65535) 547 goto got_match ; 548 549 /* 550 * temporary hack: 551 * udp from 0.0.0.0 means this rule applies. 552 * 1 src port is match ether type 553 * 2 src ports (interval) is match ether type 554 * 3 src ports is match ether address 555 */ 556 if (f->fw_src.s_addr != 0 || f->fw_prot != IPPROTO_UDP 557 || f->fw_smsk.s_addr != 0xffffffff ) 558 continue ; 559 switch (IP_FW_GETNSRCP(f)) { 560 case 1: /* match one type */ 561 if ( /* ( (f->fw_flg & IP_FW_F_INVSRC) != 0) ^ */ 562 ( f->fw_pts[0] == ntohs(eh->ether_type) ) ) { 563 goto got_match ; 564 } 565 default: 566 break ; 567 } 568 continue; 569 } 570 /* Fragments */ 571 if ((f->fw_flg & IP_FW_F_FRAG) && offset == 0 ) 572 continue; 573 574 /* If src-addr doesn't match, not this rule. */ 575 if (((f->fw_flg & IP_FW_F_INVSRC) != 0) ^ ((ip->ip_src.s_addr 576 & f->fw_smsk.s_addr) != f->fw_src.s_addr)) 577 continue; 578 579 /* If dest-addr doesn't match, not this rule. */ 580 if (((f->fw_flg & IP_FW_F_INVDST) != 0) ^ ((ip->ip_dst.s_addr 581 & f->fw_dmsk.s_addr) != f->fw_dst.s_addr)) 582 continue; 583 584 /* Interface check */ 585 if ((f->fw_flg & IF_FW_F_VIAHACK) == IF_FW_F_VIAHACK) { 586 struct ifnet *const iface = oif ? oif : rif; 587 588 /* Backwards compatibility hack for "via" */ 589 if (!iface || !iface_match(iface, 590 &f->fw_in_if, f->fw_flg & IP_FW_F_OIFNAME)) 591 continue; 592 } else { 593 /* Check receive interface */ 594 if ((f->fw_flg & IP_FW_F_IIFACE) 595 && (!rif || !iface_match(rif, 596 &f->fw_in_if, f->fw_flg & IP_FW_F_IIFNAME))) 597 continue; 598 /* Check outgoing interface */ 599 if ((f->fw_flg & IP_FW_F_OIFACE) 600 && (!oif || !iface_match(oif, 601 &f->fw_out_if, f->fw_flg & IP_FW_F_OIFNAME))) 602 continue; 603 } 604 605 /* Check IP options */ 606 if (f->fw_ipopt != f->fw_ipnopt && !ipopts_match(ip, f)) 607 continue; 608 609 /* Check protocol; if wildcard, match */ 610 if (f->fw_prot == IPPROTO_IP) 611 goto got_match; 612 613 /* If different, don't match */ 614 if (ip->ip_p != f->fw_prot) 615 continue; 616 617 /* 618 * here, pip==NULL for bridged pkts -- they include the ethernet 619 * header so i have to adjust lengths accordingly 620 */ 621 #define PULLUP_TO(l) do { \ 622 int len = (pip ? l : l + 14 ) ; \ 623 if ((*m)->m_len < (len) ) { \ 624 if ( (*m = m_pullup(*m, (len))) == 0) \ 625 goto bogusfrag; \ 626 ip = mtod(*m, struct ip *); \ 627 if (pip) \ 628 *pip = ip ; \ 629 else \ 630 ip = (struct ip *)((int)ip + 14); \ 631 offset = (ip->ip_off & IP_OFFMASK); \ 632 } \ 633 } while (0) 634 635 /* Protocol specific checks */ 636 switch (ip->ip_p) { 637 case IPPROTO_TCP: 638 { 639 struct tcphdr *tcp; 640 641 if (offset == 1) /* cf. RFC 1858 */ 642 goto bogusfrag; 643 if (offset != 0) { 644 /* 645 * TCP flags and ports aren't available in this 646 * packet -- if this rule specified either one, 647 * we consider the rule a non-match. 648 */ 649 if (f->fw_nports != 0 || 650 f->fw_tcpf != f->fw_tcpnf) 651 continue; 652 653 break; 654 } 655 PULLUP_TO(hlen + 14); 656 tcp = (struct tcphdr *) ((u_long *)ip + ip->ip_hl); 657 if (f->fw_tcpf != f->fw_tcpnf && !tcpflg_match(tcp, f)) 658 continue; 659 src_port = ntohs(tcp->th_sport); 660 dst_port = ntohs(tcp->th_dport); 661 goto check_ports; 662 } 663 664 case IPPROTO_UDP: 665 { 666 struct udphdr *udp; 667 668 if (offset != 0) { 669 /* 670 * Port specification is unavailable -- if this 671 * rule specifies a port, we consider the rule 672 * a non-match. 673 */ 674 if (f->fw_nports != 0) 675 continue; 676 677 break; 678 } 679 PULLUP_TO(hlen + 4); 680 udp = (struct udphdr *) ((u_long *)ip + ip->ip_hl); 681 src_port = ntohs(udp->uh_sport); 682 dst_port = ntohs(udp->uh_dport); 683 check_ports: 684 if (!port_match(&f->fw_pts[0], 685 IP_FW_GETNSRCP(f), src_port, 686 f->fw_flg & IP_FW_F_SRNG)) 687 continue; 688 if (!port_match(&f->fw_pts[IP_FW_GETNSRCP(f)], 689 IP_FW_GETNDSTP(f), dst_port, 690 f->fw_flg & IP_FW_F_DRNG)) 691 continue; 692 break; 693 } 694 695 case IPPROTO_ICMP: 696 { 697 struct icmp *icmp; 698 699 if (offset != 0) /* Type isn't valid */ 700 break; 701 PULLUP_TO(hlen + 2); 702 icmp = (struct icmp *) ((u_long *)ip + ip->ip_hl); 703 if (!icmptype_match(icmp, f)) 704 continue; 705 break; 706 } 707 #undef PULLUP_TO 708 709 bogusfrag: 710 if (fw_verbose) 711 ipfw_report(NULL, ip, rif, oif); 712 goto dropit; 713 } 714 715 got_match: 716 *flow_id = chain ; /* XXX set flow id */ 717 #ifndef IPFW_DIVERT_RESTART 718 /* Ignore divert/tee rule if socket port is "ignport" */ 719 switch (f->fw_flg & IP_FW_F_COMMAND) { 720 case IP_FW_F_DIVERT: 721 case IP_FW_F_TEE: 722 if (f->fw_divert_port == ignport) 723 continue; /* ignore this rule */ 724 break; 725 } 726 727 #endif /* IPFW_DIVERT_RESTART */ 728 /* Update statistics */ 729 f->fw_pcnt += 1; 730 if (ip) 731 f->fw_bcnt += ip->ip_len ; 732 f->timestamp = time.tv_sec; 733 734 /* Log to console if desired */ 735 if ((f->fw_flg & IP_FW_F_PRN) && fw_verbose) 736 ipfw_report(f, ip, rif, oif); 737 738 /* Take appropriate action */ 739 switch (f->fw_flg & IP_FW_F_COMMAND) { 740 case IP_FW_F_ACCEPT: 741 return(0); 742 case IP_FW_F_COUNT: 743 continue; 744 #ifdef IPDIVERT 745 case IP_FW_F_DIVERT: 746 #ifdef IPFW_DIVERT_RESTART 747 *cookie = f->fw_number; 748 #else 749 *cookie = htons(f->fw_divert_port); 750 #endif /* IPFW_DIVERT_RESTART */ 751 return(f->fw_divert_port); 752 #endif 753 case IP_FW_F_TEE: 754 /* 755 * XXX someday tee packet here, but beware that you 756 * can't use m_copym() or m_copypacket() because 757 * the divert input routine modifies the mbuf 758 * (and these routines only increment reference 759 * counts in the case of mbuf clusters), so need 760 * to write custom routine. 761 */ 762 continue; 763 case IP_FW_F_SKIPTO: /* XXX check */ 764 if ( f->next_rule_ptr ) 765 chain = f->next_rule_ptr ; 766 else 767 chain = lookup_next_rule(chain) ; 768 if (!chain) 769 goto dropit; 770 goto again ; 771 #ifdef DUMMYNET 772 case IP_FW_F_PIPE: 773 return(f->fw_pipe_nr | 0x10000 ); 774 #endif 775 } 776 777 /* Deny/reject this packet using this rule */ 778 rule = f; 779 break; 780 } 781 782 #ifdef DIAGNOSTIC 783 /* Rule 65535 should always be there and should always match */ 784 if (!chain) 785 panic("ip_fw: chain"); 786 #endif 787 788 /* 789 * At this point, we're going to drop the packet. 790 * Send a reject notice if all of the following are true: 791 * 792 * - The packet matched a reject rule 793 * - The packet is not an ICMP packet, or is an ICMP query packet 794 * - The packet is not a multicast or broadcast packet 795 */ 796 if ((rule->fw_flg & IP_FW_F_COMMAND) == IP_FW_F_REJECT 797 && ip 798 && (ip->ip_p != IPPROTO_ICMP || is_icmp_query(ip)) 799 && !((*m)->m_flags & (M_BCAST|M_MCAST)) 800 && !IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) { 801 switch (rule->fw_reject_code) { 802 case IP_FW_REJECT_RST: 803 { 804 struct tcphdr *const tcp = 805 (struct tcphdr *) ((u_long *)ip + ip->ip_hl); 806 struct tcpiphdr ti, *const tip = (struct tcpiphdr *) ip; 807 808 if (offset != 0 || (tcp->th_flags & TH_RST)) 809 break; 810 ti.ti_i = *((struct ipovly *) ip); 811 ti.ti_t = *tcp; 812 bcopy(&ti, ip, sizeof(ti)); 813 NTOHL(tip->ti_seq); 814 NTOHL(tip->ti_ack); 815 tip->ti_len = ip->ip_len - hlen - (tip->ti_off << 2); 816 if (tcp->th_flags & TH_ACK) { 817 tcp_respond(NULL, tip, *m, 818 (tcp_seq)0, ntohl(tcp->th_ack), TH_RST); 819 } else { 820 if (tcp->th_flags & TH_SYN) 821 tip->ti_len++; 822 tcp_respond(NULL, tip, *m, tip->ti_seq 823 + tip->ti_len, (tcp_seq)0, TH_RST|TH_ACK); 824 } 825 *m = NULL; 826 break; 827 } 828 default: /* Send an ICMP unreachable using code */ 829 icmp_error(*m, ICMP_UNREACH, 830 rule->fw_reject_code, 0L, 0); 831 *m = NULL; 832 break; 833 } 834 } 835 836 dropit: 837 /* 838 * Finally, drop the packet. 839 */ 840 if (*m) { 841 m_freem(*m); 842 *m = NULL; 843 } 844 return(0); 845 } 846 847 /* 848 * when a rule is added/deleted, zero the direct pointers within 849 * all firewall rules. These will be reconstructed on the fly 850 * as packets are matched. 851 * Must be called at splnet(). 852 */ 853 static void 854 flush_rule_ptrs() 855 { 856 struct ip_fw_chain *fcp ; 857 858 for (fcp = ip_fw_chain.lh_first; fcp; fcp = fcp->chain.le_next) { 859 fcp->rule->next_rule_ptr = NULL ; 860 } 861 } 862 863 static int 864 add_entry(struct ip_fw_head *chainptr, struct ip_fw *frwl) 865 { 866 struct ip_fw *ftmp = 0; 867 struct ip_fw_chain *fwc = 0, *fcp, *fcpl = 0; 868 u_short nbr = 0; 869 int s; 870 871 fwc = malloc(sizeof *fwc, M_IPFW, M_DONTWAIT); 872 ftmp = malloc(sizeof *ftmp, M_IPFW, M_DONTWAIT); 873 if (!fwc || !ftmp) { 874 dprintf(("%s malloc said no\n", err_prefix)); 875 if (fwc) free(fwc, M_IPFW); 876 if (ftmp) free(ftmp, M_IPFW); 877 return (ENOSPC); 878 } 879 880 bcopy(frwl, ftmp, sizeof(struct ip_fw)); 881 ftmp->fw_in_if.fu_via_if.name[FW_IFNLEN - 1] = '\0'; 882 ftmp->fw_pcnt = 0L; 883 ftmp->fw_bcnt = 0L; 884 ftmp->next_rule_ptr = NULL ; 885 ftmp->pipe_ptr = NULL ; 886 fwc->rule = ftmp; 887 888 s = splnet(); 889 890 if (!chainptr->lh_first) { 891 LIST_INSERT_HEAD(chainptr, fwc, chain); 892 splx(s); 893 return(0); 894 } else if (ftmp->fw_number == (u_short)-1) { 895 if (fwc) free(fwc, M_IPFW); 896 if (ftmp) free(ftmp, M_IPFW); 897 splx(s); 898 dprintf(("%s bad rule number\n", err_prefix)); 899 return (EINVAL); 900 } 901 902 /* If entry number is 0, find highest numbered rule and add 100 */ 903 if (ftmp->fw_number == 0) { 904 for (fcp = chainptr->lh_first; fcp; fcp = fcp->chain.le_next) { 905 if (fcp->rule->fw_number != (u_short)-1) 906 nbr = fcp->rule->fw_number; 907 else 908 break; 909 } 910 if (nbr < (u_short)-1 - 100) 911 nbr += 100; 912 ftmp->fw_number = nbr; 913 } 914 915 /* Got a valid number; now insert it, keeping the list ordered */ 916 for (fcp = chainptr->lh_first; fcp; fcp = fcp->chain.le_next) { 917 if (fcp->rule->fw_number > ftmp->fw_number) { 918 if (fcpl) { 919 LIST_INSERT_AFTER(fcpl, fwc, chain); 920 } else { 921 LIST_INSERT_HEAD(chainptr, fwc, chain); 922 } 923 break; 924 } else { 925 fcpl = fcp; 926 } 927 } 928 flush_rule_ptrs(); 929 930 splx(s); 931 return (0); 932 } 933 934 static int 935 del_entry(struct ip_fw_head *chainptr, u_short number) 936 { 937 struct ip_fw_chain *fcp; 938 int s; 939 940 s = splnet(); 941 942 fcp = chainptr->lh_first; 943 if (number != (u_short)-1) { 944 for (; fcp; fcp = fcp->chain.le_next) { 945 if (fcp->rule->fw_number == number) { 946 LIST_REMOVE(fcp, chain); 947 #ifdef DUMMYNET 948 dn_rule_delete(fcp) ; 949 #endif 950 flush_rule_ptrs(); 951 splx(s); 952 free(fcp->rule, M_IPFW); 953 free(fcp, M_IPFW); 954 return 0; 955 } 956 } 957 } 958 959 splx(s); 960 return (EINVAL); 961 } 962 963 static int 964 zero_entry(struct mbuf *m) 965 { 966 struct ip_fw *frwl; 967 struct ip_fw_chain *fcp; 968 int s; 969 970 if (m) { 971 if (m->m_len != sizeof(struct ip_fw)) 972 return(EINVAL); 973 frwl = mtod(m, struct ip_fw *); 974 } 975 else 976 frwl = NULL; 977 978 /* 979 * It's possible to insert multiple chain entries with the 980 * same number, so we don't stop after finding the first 981 * match if zeroing a specific entry. 982 */ 983 s = splnet(); 984 for (fcp = ip_fw_chain.lh_first; fcp; fcp = fcp->chain.le_next) 985 if (!frwl || frwl->fw_number == fcp->rule->fw_number) { 986 fcp->rule->fw_bcnt = fcp->rule->fw_pcnt = 0; 987 fcp->rule->timestamp = 0; 988 } 989 splx(s); 990 991 if (fw_verbose) { 992 if (frwl) 993 printf("ipfw: Entry %d cleared.\n", frwl->fw_number); 994 else 995 printf("ipfw: Accounting cleared.\n"); 996 } 997 998 return(0); 999 } 1000 1001 static struct ip_fw * 1002 check_ipfw_mbuf(struct mbuf *m) 1003 { 1004 /* Check length */ 1005 if (m->m_len != sizeof(struct ip_fw)) { 1006 dprintf(("%s len=%d, want %d\n", err_prefix, m->m_len, 1007 sizeof(struct ip_fw))); 1008 return (NULL); 1009 } 1010 return(check_ipfw_struct(mtod(m, struct ip_fw *))); 1011 } 1012 1013 static struct ip_fw * 1014 check_ipfw_struct(struct ip_fw *frwl) 1015 { 1016 /* Check for invalid flag bits */ 1017 if ((frwl->fw_flg & ~IP_FW_F_MASK) != 0) { 1018 dprintf(("%s undefined flag bits set (flags=%x)\n", 1019 err_prefix, frwl->fw_flg)); 1020 return (NULL); 1021 } 1022 /* Must apply to incoming or outgoing (or both) */ 1023 if (!(frwl->fw_flg & (IP_FW_F_IN | IP_FW_F_OUT))) { 1024 dprintf(("%s neither in nor out\n", err_prefix)); 1025 return (NULL); 1026 } 1027 /* Empty interface name is no good */ 1028 if (((frwl->fw_flg & IP_FW_F_IIFNAME) 1029 && !*frwl->fw_in_if.fu_via_if.name) 1030 || ((frwl->fw_flg & IP_FW_F_OIFNAME) 1031 && !*frwl->fw_out_if.fu_via_if.name)) { 1032 dprintf(("%s empty interface name\n", err_prefix)); 1033 return (NULL); 1034 } 1035 /* Sanity check interface matching */ 1036 if ((frwl->fw_flg & IF_FW_F_VIAHACK) == IF_FW_F_VIAHACK) { 1037 ; /* allow "via" backwards compatibility */ 1038 } else if ((frwl->fw_flg & IP_FW_F_IN) 1039 && (frwl->fw_flg & IP_FW_F_OIFACE)) { 1040 dprintf(("%s outgoing interface check on incoming\n", 1041 err_prefix)); 1042 return (NULL); 1043 } 1044 /* Sanity check port ranges */ 1045 if ((frwl->fw_flg & IP_FW_F_SRNG) && IP_FW_GETNSRCP(frwl) < 2) { 1046 dprintf(("%s src range set but n_src_p=%d\n", 1047 err_prefix, IP_FW_GETNSRCP(frwl))); 1048 return (NULL); 1049 } 1050 if ((frwl->fw_flg & IP_FW_F_DRNG) && IP_FW_GETNDSTP(frwl) < 2) { 1051 dprintf(("%s dst range set but n_dst_p=%d\n", 1052 err_prefix, IP_FW_GETNDSTP(frwl))); 1053 return (NULL); 1054 } 1055 if (IP_FW_GETNSRCP(frwl) + IP_FW_GETNDSTP(frwl) > IP_FW_MAX_PORTS) { 1056 dprintf(("%s too many ports (%d+%d)\n", 1057 err_prefix, IP_FW_GETNSRCP(frwl), IP_FW_GETNDSTP(frwl))); 1058 return (NULL); 1059 } 1060 /* 1061 * Protocols other than TCP/UDP don't use port range 1062 */ 1063 if ((frwl->fw_prot != IPPROTO_TCP) && 1064 (frwl->fw_prot != IPPROTO_UDP) && 1065 (IP_FW_GETNSRCP(frwl) || IP_FW_GETNDSTP(frwl))) { 1066 dprintf(("%s port(s) specified for non TCP/UDP rule\n", 1067 err_prefix)); 1068 return(NULL); 1069 } 1070 1071 /* 1072 * Rather than modify the entry to make such entries work, 1073 * we reject this rule and require user level utilities 1074 * to enforce whatever policy they deem appropriate. 1075 */ 1076 if ((frwl->fw_src.s_addr & (~frwl->fw_smsk.s_addr)) || 1077 (frwl->fw_dst.s_addr & (~frwl->fw_dmsk.s_addr))) { 1078 dprintf(("%s rule never matches\n", err_prefix)); 1079 return(NULL); 1080 } 1081 1082 if ((frwl->fw_flg & IP_FW_F_FRAG) && 1083 (frwl->fw_prot == IPPROTO_UDP || frwl->fw_prot == IPPROTO_TCP)) { 1084 if (frwl->fw_nports) { 1085 dprintf(("%s cannot mix 'frag' and ports\n", err_prefix)); 1086 return(NULL); 1087 } 1088 if (frwl->fw_prot == IPPROTO_TCP && 1089 frwl->fw_tcpf != frwl->fw_tcpnf) { 1090 dprintf(("%s cannot mix 'frag' with TCP flags\n", err_prefix)); 1091 return(NULL); 1092 } 1093 } 1094 1095 /* Check command specific stuff */ 1096 switch (frwl->fw_flg & IP_FW_F_COMMAND) 1097 { 1098 case IP_FW_F_REJECT: 1099 if (frwl->fw_reject_code >= 0x100 1100 && !(frwl->fw_prot == IPPROTO_TCP 1101 && frwl->fw_reject_code == IP_FW_REJECT_RST)) { 1102 dprintf(("%s unknown reject code\n", err_prefix)); 1103 return(NULL); 1104 } 1105 break; 1106 case IP_FW_F_DIVERT: /* Diverting to port zero is invalid */ 1107 case IP_FW_F_PIPE: /* piping through 0 is invalid */ 1108 case IP_FW_F_TEE: 1109 if (frwl->fw_divert_port == 0) { 1110 dprintf(("%s can't divert to port 0\n", err_prefix)); 1111 return (NULL); 1112 } 1113 break; 1114 case IP_FW_F_DENY: 1115 case IP_FW_F_ACCEPT: 1116 case IP_FW_F_COUNT: 1117 case IP_FW_F_SKIPTO: 1118 break; 1119 default: 1120 dprintf(("%s invalid command\n", err_prefix)); 1121 return(NULL); 1122 } 1123 1124 return frwl; 1125 } 1126 1127 static int 1128 ip_fw_ctl(int stage, struct mbuf **mm) 1129 { 1130 int error; 1131 struct mbuf *m; 1132 1133 if (stage == IP_FW_GET) { 1134 struct ip_fw_chain *fcp = ip_fw_chain.lh_first; 1135 *mm = m = m_get(M_WAIT, MT_SOOPTS); 1136 for (; fcp; fcp = fcp->chain.le_next) { 1137 memcpy(m->m_data, fcp->rule, sizeof *(fcp->rule)); 1138 m->m_len = sizeof *(fcp->rule); 1139 m->m_next = m_get(M_WAIT, MT_SOOPTS); 1140 m = m->m_next; 1141 m->m_len = 0; 1142 } 1143 return (0); 1144 } 1145 m = *mm; 1146 /* only allow get calls if secure mode > 2 */ 1147 if (securelevel > 2) { 1148 if (m) (void)m_free(m); 1149 return(EPERM); 1150 } 1151 if (stage == IP_FW_FLUSH) { 1152 while (ip_fw_chain.lh_first != NULL && 1153 ip_fw_chain.lh_first->rule->fw_number != (u_short)-1) { 1154 struct ip_fw_chain *fcp = ip_fw_chain.lh_first; 1155 int s = splnet(); 1156 LIST_REMOVE(ip_fw_chain.lh_first, chain); 1157 #ifdef DUMMYNET 1158 dn_rule_delete(fcp); 1159 #endif 1160 splx(s); 1161 free(fcp->rule, M_IPFW); 1162 free(fcp, M_IPFW); 1163 } 1164 if (m) (void)m_free(m); 1165 return (0); 1166 } 1167 if (stage == IP_FW_ZERO) { 1168 error = zero_entry(m); 1169 if (m) (void)m_free(m); 1170 return (error); 1171 } 1172 if (m == NULL) { 1173 printf("%s NULL mbuf ptr\n", err_prefix); 1174 return (EINVAL); 1175 } 1176 1177 if (stage == IP_FW_ADD) { 1178 struct ip_fw *frwl = check_ipfw_mbuf(m); 1179 1180 if (!frwl) 1181 error = EINVAL; 1182 else 1183 error = add_entry(&ip_fw_chain, frwl); 1184 if (m) (void)m_free(m); 1185 return error; 1186 } 1187 if (stage == IP_FW_DEL) { 1188 if (m->m_len != sizeof(struct ip_fw)) { 1189 dprintf(("%s len=%d, want %d\n", err_prefix, m->m_len, 1190 sizeof(struct ip_fw))); 1191 error = EINVAL; 1192 } else if (mtod(m, struct ip_fw *)->fw_number == (u_short)-1) { 1193 dprintf(("%s can't delete rule 65535\n", err_prefix)); 1194 error = EINVAL; 1195 } else 1196 error = del_entry(&ip_fw_chain, 1197 mtod(m, struct ip_fw *)->fw_number); 1198 if (m) (void)m_free(m); 1199 return error; 1200 } 1201 1202 dprintf(("%s unknown request %d\n", err_prefix, stage)); 1203 if (m) (void)m_free(m); 1204 return (EINVAL); 1205 } 1206 1207 struct ip_fw_chain *ip_fw_default_rule ; 1208 1209 void 1210 ip_fw_init(void) 1211 { 1212 struct ip_fw default_rule; 1213 1214 ip_fw_chk_ptr = ip_fw_chk; 1215 ip_fw_ctl_ptr = ip_fw_ctl; 1216 LIST_INIT(&ip_fw_chain); 1217 1218 bzero(&default_rule, sizeof default_rule); 1219 default_rule.fw_prot = IPPROTO_IP; 1220 default_rule.fw_number = (u_short)-1; 1221 #ifdef IPFIREWALL_DEFAULT_TO_ACCEPT 1222 default_rule.fw_flg |= IP_FW_F_ACCEPT; 1223 #else 1224 default_rule.fw_flg |= IP_FW_F_DENY; 1225 #endif 1226 default_rule.fw_flg |= IP_FW_F_IN | IP_FW_F_OUT; 1227 if (check_ipfw_struct(&default_rule) == NULL || 1228 add_entry(&ip_fw_chain, &default_rule)) 1229 panic(__FUNCTION__); 1230 1231 ip_fw_default_rule = ip_fw_chain.lh_first ; 1232 printf("IP packet filtering initialized, " 1233 #ifdef IPDIVERT 1234 "divert enabled, "); 1235 #else 1236 "divert disabled, "); 1237 #endif 1238 #ifdef IPFIREWALL_DEFAULT_TO_ACCEPT 1239 printf("default to accept, "); 1240 #endif 1241 #ifndef IPFIREWALL_VERBOSE 1242 printf("logging disabled\n"); 1243 #else 1244 if (fw_verbose_limit == 0) 1245 printf("unlimited logging\n"); 1246 else 1247 printf("logging limited to %d packets/entry\n", 1248 fw_verbose_limit); 1249 #endif 1250 } 1251 1252 #ifdef IPFIREWALL_MODULE 1253 1254 #include <sys/exec.h> 1255 #include <sys/sysent.h> 1256 #include <sys/lkm.h> 1257 1258 MOD_MISC(ipfw); 1259 1260 static int 1261 ipfw_load(struct lkm_table *lkmtp, int cmd) 1262 { 1263 int s=splnet(); 1264 1265 old_chk_ptr = ip_fw_chk_ptr; 1266 old_ctl_ptr = ip_fw_ctl_ptr; 1267 1268 ip_fw_init(); 1269 splx(s); 1270 return 0; 1271 } 1272 1273 static int 1274 ipfw_unload(struct lkm_table *lkmtp, int cmd) 1275 { 1276 int s=splnet(); 1277 1278 ip_fw_chk_ptr = old_chk_ptr; 1279 ip_fw_ctl_ptr = old_ctl_ptr; 1280 1281 while (ip_fw_chain.lh_first != NULL) { 1282 struct ip_fw_chain *fcp = ip_fw_chain.lh_first; 1283 LIST_REMOVE(ip_fw_chain.lh_first, chain); 1284 free(fcp->rule, M_IPFW); 1285 free(fcp, M_IPFW); 1286 } 1287 1288 splx(s); 1289 printf("IP firewall unloaded\n"); 1290 return 0; 1291 } 1292 1293 int 1294 ipfw_mod(struct lkm_table *lkmtp, int cmd, int ver) 1295 { 1296 DISPATCH(lkmtp, cmd, ver, ipfw_load, ipfw_unload, lkm_nullcmd); 1297 } 1298 #endif
Cache object: 18208015bec872c7b110a3852d9604b6
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]