The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/netinet6/ip6_fw.c

Version: -  FREEBSD  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-2  -  FREEBSD-11-1  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-4  -  FREEBSD-10-3  -  FREEBSD-10-2  -  FREEBSD-10-1  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-3  -  FREEBSD-9-2  -  FREEBSD-9-1  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-4  -  FREEBSD-8-3  -  FREEBSD-8-2  -  FREEBSD-8-1  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-4  -  FREEBSD-7-3  -  FREEBSD-7-2  -  FREEBSD-7-1  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-4  -  FREEBSD-6-3  -  FREEBSD-6-2  -  FREEBSD-6-1  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-5  -  FREEBSD-5-4  -  FREEBSD-5-3  -  FREEBSD-5-2  -  FREEBSD-5-1  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  linux-2.6  -  linux-2.4.22  -  MK83  -  MK84  -  PLAN9  -  DFBSD  -  NETBSD  -  NETBSD5  -  NETBSD4  -  NETBSD3  -  NETBSD20  -  OPENBSD  -  xnu-517  -  xnu-792  -  xnu-792.6.70  -  xnu-1228  -  xnu-1456.1.26  -  xnu-1699.24.8  -  xnu-2050.18.24  -  OPENSOLARIS  -  minix-3-1-1 
SearchContext: -  none  -  3  -  10 

    1 /*      $FreeBSD: releng/6.1/sys/netinet6/ip6_fw.c 158179 2006-04-30 16:44:43Z cvs2svn $        */
    2 /*      $KAME: ip6_fw.c,v 1.21 2001/01/24 01:25:32 itojun Exp $ */
    3 
    4 /*-
    5  * Copyright (C) 1998, 1999, 2000 and 2001 WIDE Project.
    6  * All rights reserved.
    7  *
    8  * Redistribution and use in source and binary forms, with or without
    9  * modification, are permitted provided that the following conditions
   10  * are met:
   11  * 1. Redistributions of source code must retain the above copyright
   12  *    notice, this list of conditions and the following disclaimer.
   13  * 2. Redistributions in binary form must reproduce the above copyright
   14  *    notice, this list of conditions and the following disclaimer in the
   15  *    documentation and/or other materials provided with the distribution.
   16  * 3. Neither the name of the project nor the names of its contributors
   17  *    may be used to endorse or promote products derived from this software
   18  *    without specific prior written permission.
   19  *
   20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
   21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
   24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   30  * SUCH DAMAGE.
   31  */
   32 
   33 /*-
   34  * Copyright (c) 1993 Daniel Boulet
   35  * Copyright (c) 1994 Ugen J.S.Antsilevich
   36  * Copyright (c) 1996 Alex Nash
   37  *
   38  * Redistribution and use in source forms, with and without modification,
   39  * are permitted provided that this entire comment appears intact.
   40  *
   41  * Redistribution in binary form may occur without any restrictions.
   42  * Obviously, it would be nice if you gave credit where credit is due
   43  * but requiring it would be too onerous.
   44  *
   45  * This software is provided ``AS IS'' without any warranties of any kind.
   46  */
   47 
   48 /*
   49  * Implement IPv6 packet firewall
   50  */
   51 
   52 #if !defined(KLD_MODULE)
   53 #include "opt_ip6fw.h"
   54 #include "opt_inet.h"
   55 #include "opt_inet6.h"
   56 #endif
   57 
   58 #ifdef IP6DIVERT
   59 #error "NOT SUPPORTED IPV6 DIVERT"
   60 #endif
   61 #ifdef IP6FW_DIVERT_RESTART
   62 #error "NOT SUPPORTED IPV6 DIVERT"
   63 #endif
   64 
   65 #include <sys/param.h>
   66 #include <sys/systm.h>
   67 #include <sys/malloc.h>
   68 #include <sys/mbuf.h>
   69 #include <sys/queue.h>
   70 #include <sys/kernel.h>
   71 #include <sys/module.h>
   72 #include <sys/socket.h>
   73 #include <sys/socketvar.h>
   74 #include <sys/syslog.h>
   75 #include <sys/time.h>
   76 #include <net/if.h>
   77 #include <net/route.h>
   78 #include <netinet/in_systm.h>
   79 #include <netinet/in.h>
   80 #include <netinet/ip.h>
   81 
   82 #include <netinet/ip6.h>
   83 #include <netinet6/ip6_var.h>
   84 #include <netinet6/in6_var.h>
   85 #include <netinet/icmp6.h>
   86 
   87 #include <netinet/in_pcb.h>
   88 
   89 #include <netinet6/ip6_fw.h>
   90 #include <netinet/ip_var.h>
   91 #include <netinet/tcp.h>
   92 #include <netinet/tcp_seq.h>
   93 #include <netinet/tcp_timer.h>
   94 #include <netinet/tcp_var.h>
   95 #include <netinet/udp.h>
   96 
   97 #include <sys/sysctl.h>
   98 
   99 #include <net/net_osdep.h>
  100 
  101 MALLOC_DEFINE(M_IP6FW, "Ip6Fw/Ip6Acct", "Ip6Fw/Ip6Acct chain's");
  102 
  103 static int fw6_debug = 1;
  104 #ifdef IPV6FIREWALL_VERBOSE
  105 static int fw6_verbose = 1;
  106 #else
  107 static int fw6_verbose = 0;
  108 #endif
  109 #ifdef IPV6FIREWALL_VERBOSE_LIMIT
  110 static int fw6_verbose_limit = IPV6FIREWALL_VERBOSE_LIMIT;
  111 #else
  112 static int fw6_verbose_limit = 0;
  113 #endif
  114 
  115 static LIST_HEAD (ip6_fw_head, ip6_fw_chain) ip6_fw_chain;
  116 
  117 SYSCTL_DECL(_net_inet6_ip6);
  118 static struct sysctl_ctx_list   ip6_fw_sysctl_ctx;
  119 static struct sysctl_oid        *ip6_fw_sysctl_tree;
  120 
  121 #define dprintf(a)      do {                                            \
  122                                 if (fw6_debug)                          \
  123                                         printf a;                       \
  124                         } while (/*CONSTCOND*/ 0)
  125 #define SNPARGS(buf, len) buf + len, sizeof(buf) > len ? sizeof(buf) - len : 0
  126 
  127 static int      add_entry6 __P((struct ip6_fw_head *chainptr, struct ip6_fw *frwl));
  128 static int      del_entry6 __P((struct ip6_fw_head *chainptr, u_short number));
  129 static int      zero_entry6 __P((struct mbuf *m));
  130 static struct ip6_fw *check_ip6fw_struct __P((struct ip6_fw *m));
  131 static struct ip6_fw *check_ip6fw_mbuf __P((struct mbuf *fw));
  132 static int      ip6opts_match __P((struct ip6_hdr **ip6, struct ip6_fw *f,
  133                                    struct mbuf **m,
  134                                    int *off, int *nxt, u_short *offset));
  135 static int      port_match6 __P((u_short *portptr, int nports, u_short port,
  136                                 int range_flag));
  137 static int      tcp6flg_match __P((struct tcphdr *tcp6, struct ip6_fw *f));
  138 static int      icmp6type_match __P((struct icmp6_hdr *  icmp, struct ip6_fw * f));
  139 static void     ip6fw_report __P((struct ip6_fw *f, struct ip6_hdr *ip6,
  140                                 struct ifnet *rif, struct ifnet *oif, int off, int nxt));
  141 
  142 static int      ip6_fw_chk __P((struct ip6_hdr **pip6,
  143                         struct ifnet *oif, u_int16_t *cookie, struct mbuf **m));
  144 static int      ip6_fw_ctl __P((int stage, struct mbuf **mm));
  145 
  146 static char err_prefix[] = "ip6_fw_ctl:";
  147 
  148 /*
  149  * Returns 1 if the port is matched by the vector, 0 otherwise
  150  */
  151 static
  152 __inline
  153 int
  154 port_match6(u_short *portptr, int nports, u_short port, int range_flag)
  155 {
  156         if (!nports)
  157                 return 1;
  158         if (range_flag) {
  159                 if (portptr[0] <= port && port <= portptr[1]) {
  160                         return 1;
  161                 }
  162                 nports -= 2;
  163                 portptr += 2;
  164         }
  165         while (nports-- > 0) {
  166                 if (*portptr++ == port) {
  167                         return 1;
  168                 }
  169         }
  170         return 0;
  171 }
  172 
  173 static int
  174 tcp6flg_match(struct tcphdr *tcp6, struct ip6_fw *f)
  175 {
  176         u_char          flg_set, flg_clr;
  177 
  178         /*
  179          * If an established connection is required, reject packets that
  180          * have only SYN of RST|ACK|SYN set.  Otherwise, fall through to
  181          * other flag requirements.
  182          */
  183         if ((f->fw_ipflg & IPV6_FW_IF_TCPEST) &&
  184             ((tcp6->th_flags & (IPV6_FW_TCPF_RST | IPV6_FW_TCPF_ACK |
  185             IPV6_FW_TCPF_SYN)) == IPV6_FW_TCPF_SYN))
  186                 return 0;
  187 
  188         flg_set = tcp6->th_flags & f->fw_tcpf;
  189         flg_clr = tcp6->th_flags & f->fw_tcpnf;
  190 
  191         if (flg_set != f->fw_tcpf)
  192                 return 0;
  193         if (flg_clr)
  194                 return 0;
  195 
  196         return 1;
  197 }
  198 
  199 static int
  200 icmp6type_match(struct icmp6_hdr *icmp6, struct ip6_fw *f)
  201 {
  202         int type;
  203 
  204         if (!(f->fw_flg & IPV6_FW_F_ICMPBIT))
  205                 return (1);
  206 
  207         type = icmp6->icmp6_type;
  208 
  209         /* check for matching type in the bitmap */
  210         if (type < IPV6_FW_ICMPTYPES_DIM * sizeof(unsigned) * 8 &&
  211                 (f->fw_icmp6types[type / (sizeof(unsigned) * 8)] &
  212                 (1U << (type % (8 * sizeof(unsigned))))))
  213                 return (1);
  214 
  215         return (0); /* no match */
  216 }
  217 
  218 static int
  219 is_icmp6_query(struct ip6_hdr *ip6, int off)
  220 {
  221         const struct icmp6_hdr *icmp6;
  222         int icmp6_type;
  223 
  224         icmp6 = (struct icmp6_hdr *)((caddr_t)ip6 + off);
  225         icmp6_type = icmp6->icmp6_type;
  226 
  227         if (icmp6_type == ICMP6_ECHO_REQUEST ||
  228             icmp6_type == ICMP6_MEMBERSHIP_QUERY ||
  229             icmp6_type == ICMP6_WRUREQUEST ||
  230             icmp6_type == ICMP6_FQDN_QUERY ||
  231             icmp6_type == ICMP6_NI_QUERY)
  232                 return (1);
  233 
  234         return (0);
  235 }
  236 
  237 static int
  238 ip6opts_match(struct ip6_hdr **pip6, struct ip6_fw *f, struct mbuf **m,
  239               int *off, int *nxt, u_short *offset)
  240 {
  241         int len;
  242         struct ip6_hdr *ip6 = *pip6;
  243         struct ip6_ext *ip6e;
  244         u_char  opts, nopts, nopts_sve;
  245 
  246         opts = f->fw_ip6opt;
  247         nopts = nopts_sve = f->fw_ip6nopt;
  248 
  249         *nxt = ip6->ip6_nxt;
  250         *off = sizeof(struct ip6_hdr);
  251         len = ntohs(ip6->ip6_plen) + sizeof(struct ip6_hdr);
  252         while (*off < len) {
  253                 ip6e = (struct ip6_ext *)((caddr_t) ip6 + *off);
  254                 if ((*m)->m_len < *off + sizeof(*ip6e))
  255                         goto opts_check;        /* XXX */
  256 
  257                 switch (*nxt) {
  258                 case IPPROTO_FRAGMENT:
  259                         if ((*m)->m_len >= *off + sizeof(struct ip6_frag)) {
  260                                 struct ip6_frag *ip6f;
  261 
  262                                 ip6f = (struct ip6_frag *) ((caddr_t)ip6 + *off);
  263                                 *offset = ip6f->ip6f_offlg & IP6F_OFF_MASK;
  264                         }
  265                         opts &= ~IPV6_FW_IP6OPT_FRAG;
  266                         nopts &= ~IPV6_FW_IP6OPT_FRAG;
  267                         *off += sizeof(struct ip6_frag);
  268                         break;
  269                 case IPPROTO_AH:
  270                         opts &= ~IPV6_FW_IP6OPT_AH;
  271                         nopts &= ~IPV6_FW_IP6OPT_AH;
  272                         *off += (ip6e->ip6e_len + 2) << 2;
  273                         break;
  274                 default:
  275                         switch (*nxt) {
  276                         case IPPROTO_HOPOPTS:
  277                                 opts &= ~IPV6_FW_IP6OPT_HOPOPT;
  278                                 nopts &= ~IPV6_FW_IP6OPT_HOPOPT;
  279                                 break;
  280                         case IPPROTO_ROUTING:
  281                                 opts &= ~IPV6_FW_IP6OPT_ROUTE;
  282                                 nopts &= ~IPV6_FW_IP6OPT_ROUTE;
  283                                 break;
  284                         case IPPROTO_ESP:
  285                                 opts &= ~IPV6_FW_IP6OPT_ESP;
  286                                 nopts &= ~IPV6_FW_IP6OPT_ESP;
  287                                 goto opts_check;
  288                         case IPPROTO_NONE:
  289                                 opts &= ~IPV6_FW_IP6OPT_NONXT;
  290                                 nopts &= ~IPV6_FW_IP6OPT_NONXT;
  291                                 goto opts_check;
  292                         case IPPROTO_DSTOPTS:
  293                                 opts &= ~IPV6_FW_IP6OPT_OPTS;
  294                                 nopts &= ~IPV6_FW_IP6OPT_OPTS;
  295                                 break;
  296                         default:
  297                                 goto opts_check;
  298                         }
  299                         *off += (ip6e->ip6e_len + 1) << 3;
  300                         break;
  301                 }
  302                 *nxt = ip6e->ip6e_nxt;
  303 
  304         }
  305  opts_check:
  306         if (f->fw_ip6opt == f->fw_ip6nopt)      /* XXX */
  307                 return 1;
  308 
  309         if (opts == 0 && nopts == nopts_sve)
  310                 return 1;
  311         else
  312                 return 0;
  313 }
  314 
  315 static
  316 __inline
  317 int
  318 iface_match(struct ifnet *ifp, union ip6_fw_if *ifu, int byname)
  319 {
  320         /* Check by name or by IP address */
  321         if (byname) {
  322                 /* Check name */
  323                 if (ifu->fu_via_if.glob) {
  324                         if (fnmatch(ifu->fu_via_if.name, ifp->if_xname, 0)
  325                             == FNM_NOMATCH)
  326                                 return(0);
  327                 } else {
  328                         if (strncmp(ifp->if_xname, ifu->fu_via_if.name,
  329                             IP6FW_IFNLEN) != 0)
  330                                 return(0);
  331                 }
  332                 return(1);
  333         } else if (!IN6_IS_ADDR_UNSPECIFIED(&ifu->fu_via_ip6)) {        /* Zero == wildcard */
  334                 struct ifaddr *ia;
  335 
  336                 for (ia = ifp->if_addrlist.tqh_first; ia; ia = ia->ifa_list.tqe_next) {
  337 
  338                         if (ia->ifa_addr == NULL)
  339                                 continue;
  340                         if (ia->ifa_addr->sa_family != AF_INET6)
  341                                 continue;
  342                         if (!IN6_ARE_ADDR_EQUAL(&ifu->fu_via_ip6,
  343                             &(((struct sockaddr_in6 *)
  344                             (ia->ifa_addr))->sin6_addr)))
  345                                 continue;
  346                         return (1);
  347                 }
  348                 return (0);
  349         }
  350         return (1);
  351 }
  352 
  353 static void
  354 ip6fw_report(struct ip6_fw *f, struct ip6_hdr *ip6,
  355         struct ifnet *rif, struct ifnet *oif, int off, int nxt)
  356 {
  357         static int counter;
  358         struct tcphdr *const tcp6 = (struct tcphdr *) ((caddr_t) ip6+ off);
  359         struct udphdr *const udp = (struct udphdr *) ((caddr_t) ip6+ off);
  360         struct icmp6_hdr *const icmp6 = (struct icmp6_hdr *) ((caddr_t) ip6+ off);
  361         int count;
  362         char *action;
  363         char action2[32], proto[102], name[18];
  364         int len;
  365 
  366         count = f ? f->fw_pcnt : ++counter;
  367         if (fw6_verbose_limit != 0 && count > fw6_verbose_limit)
  368                 return;
  369 
  370         /* Print command name */
  371         snprintf(SNPARGS(name, 0), "ip6fw: %d", f ? f->fw_number : -1);
  372 
  373         action = action2;
  374         if (!f)
  375                 action = "Refuse";
  376         else {
  377                 switch (f->fw_flg & IPV6_FW_F_COMMAND) {
  378                 case IPV6_FW_F_DENY:
  379                         action = "Deny";
  380                         break;
  381                 case IPV6_FW_F_REJECT:
  382                         if (f->fw_reject_code == IPV6_FW_REJECT_RST)
  383                                 action = "Reset";
  384                         else
  385                                 action = "Unreach";
  386                         break;
  387                 case IPV6_FW_F_ACCEPT:
  388                         action = "Accept";
  389                         break;
  390                 case IPV6_FW_F_COUNT:
  391                         action = "Count";
  392                         break;
  393                 case IPV6_FW_F_DIVERT:
  394                         snprintf(SNPARGS(action2, 0), "Divert %d",
  395                             f->fw_divert_port);
  396                         break;
  397                 case IPV6_FW_F_TEE:
  398                         snprintf(SNPARGS(action2, 0), "Tee %d",
  399                             f->fw_divert_port);
  400                         break;
  401                 case IPV6_FW_F_SKIPTO:
  402                         snprintf(SNPARGS(action2, 0), "SkipTo %d",
  403                             f->fw_skipto_rule);
  404                         break;
  405                 default:
  406                         action = "UNKNOWN";
  407                         break;
  408                 }
  409         }
  410 
  411         switch (nxt) {
  412         case IPPROTO_TCP:
  413                 len = snprintf(SNPARGS(proto, 0), "TCP [%s]",
  414                     ip6_sprintf(&ip6->ip6_src));
  415                 if (off > 0)
  416                         len += snprintf(SNPARGS(proto, len), ":%d ",
  417                             ntohs(tcp6->th_sport));
  418                 else
  419                         len += snprintf(SNPARGS(proto, len), " ");
  420                 len += snprintf(SNPARGS(proto, len), "[%s]",
  421                     ip6_sprintf(&ip6->ip6_dst));
  422                 if (off > 0)
  423                         snprintf(SNPARGS(proto, len), ":%d",
  424                             ntohs(tcp6->th_dport));
  425                 break;
  426         case IPPROTO_UDP:
  427                 len = snprintf(SNPARGS(proto, 0), "UDP [%s]",
  428                     ip6_sprintf(&ip6->ip6_src));
  429                 if (off > 0)
  430                         len += snprintf(SNPARGS(proto, len), ":%d ",
  431                             ntohs(udp->uh_sport));
  432                 else
  433                     len += snprintf(SNPARGS(proto, len), " ");
  434                 len += snprintf(SNPARGS(proto, len), "[%s]",
  435                     ip6_sprintf(&ip6->ip6_dst));
  436                 if (off > 0)
  437                         snprintf(SNPARGS(proto, len), ":%d",
  438                             ntohs(udp->uh_dport));
  439                 break;
  440         case IPPROTO_ICMPV6:
  441                 if (off > 0)
  442                         len = snprintf(SNPARGS(proto, 0), "IPV6-ICMP:%u.%u ",
  443                             icmp6->icmp6_type, icmp6->icmp6_code);
  444                 else
  445                         len = snprintf(SNPARGS(proto, 0), "IPV6-ICMP ");
  446                 len += snprintf(SNPARGS(proto, len), "[%s]",
  447                     ip6_sprintf(&ip6->ip6_src));
  448                 snprintf(SNPARGS(proto, len), " [%s]",
  449                     ip6_sprintf(&ip6->ip6_dst));
  450                 break;
  451         default:
  452                 len = snprintf(SNPARGS(proto, 0), "P:%d [%s]", nxt,
  453                     ip6_sprintf(&ip6->ip6_src));
  454                 snprintf(SNPARGS(proto, len), " [%s]",
  455                     ip6_sprintf(&ip6->ip6_dst));
  456                 break;
  457         }
  458 
  459         if (oif)
  460                 log(LOG_SECURITY | LOG_INFO, "%s %s %s out via %s\n",
  461                     name, action, proto, if_name(oif));
  462         else if (rif)
  463                 log(LOG_SECURITY | LOG_INFO, "%s %s %s in via %s\n",
  464                     name, action, proto, if_name(rif));
  465         else
  466                 log(LOG_SECURITY | LOG_INFO, "%s %s %s",
  467                     name, action, proto);
  468         if (fw6_verbose_limit != 0 && count == fw6_verbose_limit)
  469             log(LOG_SECURITY | LOG_INFO, "ip6fw: limit reached on entry %d\n",
  470                 f ? f->fw_number : -1);
  471 }
  472 
  473 /*
  474  * Parameters:
  475  *
  476  *      ip      Pointer to packet header (struct ip6_hdr *)
  477  *      hlen    Packet header length
  478  *      oif     Outgoing interface, or NULL if packet is incoming
  479  * #ifndef IP6FW_DIVERT_RESTART
  480  *      *cookie Ignore all divert/tee rules to this port (if non-zero)
  481  * #else
  482  *      *cookie Skip up to the first rule past this rule number;
  483  * #endif
  484  *      *m      The packet; we set to NULL when/if we nuke it.
  485  *
  486  * Return value:
  487  *
  488  *      0       The packet is to be accepted and routed normally OR
  489  *              the packet was denied/rejected and has been dropped;
  490  *              in the latter case, *m is equal to NULL upon return.
  491  *      port    Divert the packet to port.
  492  */
  493 
  494 static int
  495 ip6_fw_chk(struct ip6_hdr **pip6,
  496         struct ifnet *oif, u_int16_t *cookie, struct mbuf **m)
  497 {
  498         struct ip6_fw_chain *chain;
  499         struct ip6_fw *rule = NULL;
  500         struct ip6_hdr *ip6 = *pip6;
  501         struct ifnet *const rif = (*m)->m_pkthdr.rcvif;
  502         u_short offset = 0;
  503         int off = sizeof(struct ip6_hdr), nxt = ip6->ip6_nxt;
  504         u_short src_port, dst_port;
  505 #ifdef  IP6FW_DIVERT_RESTART
  506         u_int16_t skipto = *cookie;
  507 #else
  508         u_int16_t ignport = ntohs(*cookie);
  509 #endif
  510 
  511         *cookie = 0;
  512         /*
  513          * Go down the chain, looking for enlightment
  514          * #ifdef IP6FW_DIVERT_RESTART
  515          * If we've been asked to start at a given rule immediatly, do so.
  516          * #endif
  517          */
  518         chain = LIST_FIRST(&ip6_fw_chain);
  519 #ifdef IP6FW_DIVERT_RESTART
  520         if (skipto) {
  521                 if (skipto >= 65535)
  522                         goto dropit;
  523                 while (chain && (chain->rule->fw_number <= skipto)) {
  524                         chain = LIST_NEXT(chain, chain);
  525                 }
  526                 if (! chain) goto dropit;
  527         }
  528 #endif /* IP6FW_DIVERT_RESTART */
  529         for (; chain; chain = LIST_NEXT(chain, chain)) {
  530                 struct ip6_fw *const f = chain->rule;
  531 
  532                 if (oif) {
  533                         /* Check direction outbound */
  534                         if (!(f->fw_flg & IPV6_FW_F_OUT))
  535                                 continue;
  536                 } else {
  537                         /* Check direction inbound */
  538                         if (!(f->fw_flg & IPV6_FW_F_IN))
  539                                 continue;
  540                 }
  541 
  542 #define IN6_ARE_ADDR_MASKEQUAL(x,y,z) (\
  543         (((x)->s6_addr32[0] & (y)->s6_addr32[0]) == (z)->s6_addr32[0]) && \
  544         (((x)->s6_addr32[1] & (y)->s6_addr32[1]) == (z)->s6_addr32[1]) && \
  545         (((x)->s6_addr32[2] & (y)->s6_addr32[2]) == (z)->s6_addr32[2]) && \
  546         (((x)->s6_addr32[3] & (y)->s6_addr32[3]) == (z)->s6_addr32[3]))
  547 
  548                 /* If src-addr doesn't match, not this rule. */
  549                 if (((f->fw_flg & IPV6_FW_F_INVSRC) != 0) ^
  550                         (!IN6_ARE_ADDR_MASKEQUAL(&ip6->ip6_src,&f->fw_smsk,&f->fw_src)))
  551                         continue;
  552 
  553                 /* If dest-addr doesn't match, not this rule. */
  554                 if (((f->fw_flg & IPV6_FW_F_INVDST) != 0) ^
  555                         (!IN6_ARE_ADDR_MASKEQUAL(&ip6->ip6_dst,&f->fw_dmsk,&f->fw_dst)))
  556                         continue;
  557 
  558 #undef IN6_ARE_ADDR_MASKEQUAL
  559                 /* Interface check */
  560                 if ((f->fw_flg & IF6_FW_F_VIAHACK) == IF6_FW_F_VIAHACK) {
  561                         struct ifnet *const iface = oif ? oif : rif;
  562 
  563                         /* Backwards compatibility hack for "via" */
  564                         if (!iface || !iface_match(iface,
  565                             &f->fw_in_if, f->fw_flg & IPV6_FW_F_OIFNAME))
  566                                 continue;
  567                 } else {
  568                         /* Check receive interface */
  569                         if ((f->fw_flg & IPV6_FW_F_IIFACE)
  570                             && (!rif || !iface_match(rif,
  571                               &f->fw_in_if, f->fw_flg & IPV6_FW_F_IIFNAME)))
  572                                 continue;
  573                         /* Check outgoing interface */
  574                         if ((f->fw_flg & IPV6_FW_F_OIFACE)
  575                             && (!oif || !iface_match(oif,
  576                               &f->fw_out_if, f->fw_flg & IPV6_FW_F_OIFNAME)))
  577                                 continue;
  578                 }
  579 
  580                 /* Check IP options */
  581                 if (!ip6opts_match(&ip6, f, m, &off, &nxt, &offset))
  582                         continue;
  583 
  584                 /* Fragments */
  585                 if ((f->fw_flg & IPV6_FW_F_FRAG) && !offset)
  586                         continue;
  587 
  588                 /* Check protocol; if wildcard, match */
  589                 if (f->fw_prot == IPPROTO_IPV6)
  590                         goto got_match;
  591 
  592                 /* If different, don't match */
  593                 if (nxt != f->fw_prot)
  594                         continue;
  595 
  596 #define PULLUP_TO(len)  do {                                            \
  597                             if ((*m)->m_len < (len)                     \
  598                                 && (*m = m_pullup(*m, (len))) == 0) {   \
  599                                     goto dropit;                        \
  600                             }                                           \
  601                             *pip6 = ip6 = mtod(*m, struct ip6_hdr *);   \
  602                         } while (/*CONSTCOND*/ 0)
  603 
  604                 /* Protocol specific checks */
  605                 switch (nxt) {
  606                 case IPPROTO_TCP:
  607                     {
  608                         struct tcphdr *tcp6;
  609 
  610                         if (offset == 1) {      /* cf. RFC 1858 */
  611                                 PULLUP_TO(off + 4); /* XXX ? */
  612                                 goto bogusfrag;
  613                         }
  614                         if (offset != 0) {
  615                                 /*
  616                                  * TCP flags and ports aren't available in this
  617                                  * packet -- if this rule specified either one,
  618                                  * we consider the rule a non-match.
  619                                  */
  620                                 if (f->fw_nports != 0 ||
  621                                     f->fw_tcpf != f->fw_tcpnf)
  622                                         continue;
  623 
  624                                 break;
  625                         }
  626                         PULLUP_TO(off + 14);
  627                         tcp6 = (struct tcphdr *) ((caddr_t)ip6 + off);
  628                         if (((f->fw_tcpf != f->fw_tcpnf) ||
  629                            (f->fw_ipflg & IPV6_FW_IF_TCPEST))  &&
  630                            !tcp6flg_match(tcp6, f))
  631                                 continue;
  632                         src_port = ntohs(tcp6->th_sport);
  633                         dst_port = ntohs(tcp6->th_dport);
  634                         goto check_ports;
  635                     }
  636 
  637                 case IPPROTO_UDP:
  638                     {
  639                         struct udphdr *udp;
  640 
  641                         if (offset != 0) {
  642                                 /*
  643                                  * Port specification is unavailable -- if this
  644                                  * rule specifies a port, we consider the rule
  645                                  * a non-match.
  646                                  */
  647                                 if (f->fw_nports != 0)
  648                                         continue;
  649 
  650                                 break;
  651                         }
  652                         PULLUP_TO(off + 4);
  653                         udp = (struct udphdr *) ((caddr_t)ip6 + off);
  654                         src_port = ntohs(udp->uh_sport);
  655                         dst_port = ntohs(udp->uh_dport);
  656 check_ports:
  657                         if (!port_match6(&f->fw_pts[0],
  658                             IPV6_FW_GETNSRCP(f), src_port,
  659                             f->fw_flg & IPV6_FW_F_SRNG))
  660                                 continue;
  661                         if (!port_match6(&f->fw_pts[IPV6_FW_GETNSRCP(f)],
  662                             IPV6_FW_GETNDSTP(f), dst_port,
  663                             f->fw_flg & IPV6_FW_F_DRNG))
  664                                 continue;
  665                         break;
  666                     }
  667 
  668                 case IPPROTO_ICMPV6:
  669                     {
  670                         struct icmp6_hdr *icmp;
  671 
  672                         if (offset != 0)        /* Type isn't valid */
  673                                 break;
  674                         PULLUP_TO(off + 2);
  675                         icmp = (struct icmp6_hdr *) ((caddr_t)ip6 + off);
  676                         if (!icmp6type_match(icmp, f))
  677                                 continue;
  678                         break;
  679                     }
  680 #undef PULLUP_TO
  681 
  682 bogusfrag:
  683                         if (fw6_verbose)
  684                                 ip6fw_report(NULL, ip6, rif, oif, off, nxt);
  685                         goto dropit;
  686                 }
  687 
  688 got_match:
  689 #ifndef IP6FW_DIVERT_RESTART
  690                 /* Ignore divert/tee rule if socket port is "ignport" */
  691                 switch (f->fw_flg & IPV6_FW_F_COMMAND) {
  692                 case IPV6_FW_F_DIVERT:
  693                 case IPV6_FW_F_TEE:
  694                         if (f->fw_divert_port == ignport)
  695                                 continue;       /* ignore this rule */
  696                         break;
  697                 }
  698 
  699 #endif /* IP6FW_DIVERT_RESTART */
  700                 /* Update statistics */
  701                 f->fw_pcnt += 1;
  702                 f->fw_bcnt += ntohs(ip6->ip6_plen);
  703                 f->timestamp = time_second;
  704 
  705                 /* Log to console if desired */
  706                 if ((f->fw_flg & IPV6_FW_F_PRN) && fw6_verbose)
  707                         ip6fw_report(f, ip6, rif, oif, off, nxt);
  708 
  709                 /* Take appropriate action */
  710                 switch (f->fw_flg & IPV6_FW_F_COMMAND) {
  711                 case IPV6_FW_F_ACCEPT:
  712                         return (0);
  713                 case IPV6_FW_F_COUNT:
  714                         continue;
  715                 case IPV6_FW_F_DIVERT:
  716 #ifdef IP6FW_DIVERT_RESTART
  717                         *cookie = f->fw_number;
  718 #else
  719                         *cookie = htons(f->fw_divert_port);
  720 #endif /* IP6FW_DIVERT_RESTART */
  721                         return (f->fw_divert_port);
  722                 case IPV6_FW_F_TEE:
  723                         /*
  724                          * XXX someday tee packet here, but beware that you
  725                          * can't use m_copym() or m_copypacket() because
  726                          * the divert input routine modifies the mbuf
  727                          * (and these routines only increment reference
  728                          * counts in the case of mbuf clusters), so need
  729                          * to write custom routine.
  730                          */
  731                         continue;
  732                 case IPV6_FW_F_SKIPTO:
  733 #ifdef DIAGNOSTIC
  734                         while (chain->chain.le_next
  735                             && chain->chain.le_next->rule->fw_number
  736                                 < f->fw_skipto_rule)
  737 #else
  738                         while (chain->chain.le_next->rule->fw_number
  739                             < f->fw_skipto_rule)
  740 #endif
  741                                 chain = chain->chain.le_next;
  742                         continue;
  743                 }
  744 
  745                 /* Deny/reject this packet using this rule */
  746                 rule = f;
  747                 break;
  748         }
  749 
  750 #ifdef DIAGNOSTIC
  751         /* Rule 65535 should always be there and should always match */
  752         if (!chain)
  753                 panic("ip6_fw: chain");
  754 #endif
  755 
  756         /*
  757          * At this point, we're going to drop the packet.
  758          * Send a reject notice if all of the following are true:
  759          *
  760          * - The packet matched a reject rule
  761          * - The packet is not an ICMP packet, or is an ICMP query packet
  762          * - The packet is not a multicast or broadcast packet
  763          */
  764         if (rule && (rule->fw_flg & IPV6_FW_F_COMMAND) == IPV6_FW_F_REJECT
  765             && (nxt != IPPROTO_ICMPV6 || is_icmp6_query(ip6, off))
  766             && !((*m)->m_flags & (M_BCAST|M_MCAST))
  767             && !IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
  768                 switch (rule->fw_reject_code) {
  769                 case IPV6_FW_REJECT_RST:
  770 #if 1   /* not tested */
  771                   {
  772                         struct tcphdr *const tcp =
  773                                 (struct tcphdr *) ((caddr_t)ip6 + off);
  774                         struct {
  775                                 struct ip6_hdr ip6;
  776                                 struct tcphdr th;
  777                         } ti;
  778                         tcp_seq ack, seq;
  779                         int flags;
  780 
  781                         if (offset != 0 || (tcp->th_flags & TH_RST))
  782                                 break;
  783 
  784                         ti.ip6 = *ip6;
  785                         ti.th = *tcp;
  786                         ti.th.th_seq = ntohl(ti.th.th_seq);
  787                         ti.th.th_ack = ntohl(ti.th.th_ack);
  788                         ti.ip6.ip6_nxt = IPPROTO_TCP;
  789                         if (ti.th.th_flags & TH_ACK) {
  790                                 ack = 0;
  791                                 seq = ti.th.th_ack;
  792                                 flags = TH_RST;
  793                         } else {
  794                                 ack = ti.th.th_seq;
  795                                 if (((*m)->m_flags & M_PKTHDR) != 0) {
  796                                         ack += (*m)->m_pkthdr.len - off
  797                                                 - (ti.th.th_off << 2);
  798                                 } else if (ip6->ip6_plen) {
  799                                         ack += ntohs(ip6->ip6_plen) + sizeof(*ip6)
  800                                                 - off - (ti.th.th_off << 2);
  801                                 } else {
  802                                         m_freem(*m);
  803                                         *m = 0;
  804                                         break;
  805                                 }
  806                                 if (tcp->th_flags & TH_SYN)
  807                                         ack++;
  808                                 seq = 0;
  809                                 flags = TH_RST|TH_ACK;
  810                         }
  811                         bcopy(&ti, ip6, sizeof(ti));
  812                         tcp_respond(NULL, ip6, (struct tcphdr *)(ip6 + 1),
  813                                 *m, ack, seq, flags);
  814                         *m = NULL;
  815                         break;
  816                   }
  817 #endif
  818                 default:        /* Send an ICMP unreachable using code */
  819                         if (oif)
  820                                 (*m)->m_pkthdr.rcvif = oif;
  821                         icmp6_error(*m, ICMP6_DST_UNREACH,
  822                             rule->fw_reject_code, 0);
  823                         *m = NULL;
  824                         break;
  825                 }
  826         }
  827 
  828 dropit:
  829         /*
  830          * Finally, drop the packet.
  831          */
  832         if (*m) {
  833                 m_freem(*m);
  834                 *m = NULL;
  835         }
  836         return (0);
  837 }
  838 
  839 static int
  840 add_entry6(struct ip6_fw_head *chainptr, struct ip6_fw *frwl)
  841 {
  842         struct ip6_fw *ftmp = 0;
  843         struct ip6_fw_chain *fwc = 0, *fcp, *fcpl = 0;
  844         u_short nbr = 0;
  845         int s;
  846 
  847         fwc = malloc(sizeof *fwc, M_IP6FW, M_NOWAIT);
  848         ftmp = malloc(sizeof *ftmp, M_IP6FW, M_NOWAIT);
  849         if (!fwc || !ftmp) {
  850                 dprintf(("%s malloc said no\n", err_prefix));
  851                 if (fwc)  free(fwc, M_IP6FW);
  852                 if (ftmp) free(ftmp, M_IP6FW);
  853                 return (ENOSPC);
  854         }
  855 
  856         bcopy(frwl, ftmp, sizeof(struct ip6_fw));
  857         ftmp->fw_in_if.fu_via_if.name[IP6FW_IFNLEN - 1] = '\0';
  858         ftmp->fw_pcnt = 0L;
  859         ftmp->fw_bcnt = 0L;
  860         fwc->rule = ftmp;
  861 
  862         s = splnet();
  863 
  864         if (!chainptr->lh_first) {
  865                 LIST_INSERT_HEAD(chainptr, fwc, chain);
  866                 splx(s);
  867                 return (0);
  868         } else if (ftmp->fw_number == (u_short)-1) {
  869                 if (fwc)  free(fwc, M_IP6FW);
  870                 if (ftmp) free(ftmp, M_IP6FW);
  871                 splx(s);
  872                 dprintf(("%s bad rule number\n", err_prefix));
  873                 return (EINVAL);
  874         }
  875 
  876         /* If entry number is 0, find highest numbered rule and add 100 */
  877         if (ftmp->fw_number == 0) {
  878                 for (fcp = chainptr->lh_first; fcp; fcp = fcp->chain.le_next) {
  879                         if (fcp->rule->fw_number != (u_short)-1)
  880                                 nbr = fcp->rule->fw_number;
  881                         else
  882                                 break;
  883                 }
  884                 if (nbr < (u_short)-1 - 100)
  885                         nbr += 100;
  886                 ftmp->fw_number = nbr;
  887         }
  888 
  889         /* Got a valid number; now insert it, keeping the list ordered */
  890         for (fcp = chainptr->lh_first; fcp; fcp = fcp->chain.le_next) {
  891                 if (fcp->rule->fw_number > ftmp->fw_number) {
  892                         if (fcpl) {
  893                                 LIST_INSERT_AFTER(fcpl, fwc, chain);
  894                         } else {
  895                                 LIST_INSERT_HEAD(chainptr, fwc, chain);
  896                         }
  897                         break;
  898                 } else {
  899                         fcpl = fcp;
  900                 }
  901         }
  902 
  903         splx(s);
  904         return (0);
  905 }
  906 
  907 static int
  908 del_entry6(struct ip6_fw_head *chainptr, u_short number)
  909 {
  910         struct ip6_fw_chain *fcp;
  911         int s;
  912 
  913         s = splnet();
  914 
  915         fcp = chainptr->lh_first;
  916         if (number != (u_short)-1) {
  917                 for (; fcp; fcp = fcp->chain.le_next) {
  918                         if (fcp->rule->fw_number == number) {
  919                                 LIST_REMOVE(fcp, chain);
  920                                 splx(s);
  921                                 free(fcp->rule, M_IP6FW);
  922                                 free(fcp, M_IP6FW);
  923                                 return 0;
  924                         }
  925                 }
  926         }
  927 
  928         splx(s);
  929         return (EINVAL);
  930 }
  931 
  932 static int
  933 zero_entry6(struct mbuf *m)
  934 {
  935         struct ip6_fw *frwl;
  936         struct ip6_fw_chain *fcp;
  937         int s;
  938 
  939         if (m && m->m_len != 0) {
  940                 if (m->m_len != sizeof(struct ip6_fw))
  941                         return (EINVAL);
  942                 frwl = mtod(m, struct ip6_fw *);
  943         }
  944         else
  945                 frwl = NULL;
  946 
  947         /*
  948          *      It's possible to insert multiple chain entries with the
  949          *      same number, so we don't stop after finding the first
  950          *      match if zeroing a specific entry.
  951          */
  952         s = splnet();
  953         for (fcp = ip6_fw_chain.lh_first; fcp; fcp = fcp->chain.le_next)
  954                 if (!frwl || frwl->fw_number == fcp->rule->fw_number) {
  955                         fcp->rule->fw_bcnt = fcp->rule->fw_pcnt = 0;
  956                         fcp->rule->timestamp = 0;
  957                 }
  958         splx(s);
  959 
  960         if (fw6_verbose) {
  961                 if (frwl)
  962                         log(LOG_SECURITY | LOG_NOTICE,
  963                             "ip6fw: Entry %d cleared.\n", frwl->fw_number);
  964                 else
  965                         log(LOG_SECURITY | LOG_NOTICE,
  966                             "ip6fw: Accounting cleared.\n");
  967         }
  968 
  969         return (0);
  970 }
  971 
  972 static struct ip6_fw *
  973 check_ip6fw_mbuf(struct mbuf *m)
  974 {
  975         /* Check length */
  976         if (m->m_len != sizeof(struct ip6_fw)) {
  977                 dprintf(("%s len=%d, want %zu\n", err_prefix, m->m_len,
  978                     sizeof(struct ip6_fw)));
  979                 return (NULL);
  980         }
  981         return (check_ip6fw_struct(mtod(m, struct ip6_fw *)));
  982 }
  983 
  984 static struct ip6_fw *
  985 check_ip6fw_struct(struct ip6_fw *frwl)
  986 {
  987         /* Check for invalid flag bits */
  988         if ((frwl->fw_flg & ~IPV6_FW_F_MASK) != 0) {
  989                 dprintf(("%s undefined flag bits set (flags=%x)\n",
  990                     err_prefix, frwl->fw_flg));
  991                 return (NULL);
  992         }
  993         /* Must apply to incoming or outgoing (or both) */
  994         if (!(frwl->fw_flg & (IPV6_FW_F_IN | IPV6_FW_F_OUT))) {
  995                 dprintf(("%s neither in nor out\n", err_prefix));
  996                 return (NULL);
  997         }
  998         /* Empty interface name is no good */
  999         if (((frwl->fw_flg & IPV6_FW_F_IIFNAME)
 1000               && !*frwl->fw_in_if.fu_via_if.name)
 1001             || ((frwl->fw_flg & IPV6_FW_F_OIFNAME)
 1002               && !*frwl->fw_out_if.fu_via_if.name)) {
 1003                 dprintf(("%s empty interface name\n", err_prefix));
 1004                 return (NULL);
 1005         }
 1006         /* Sanity check interface matching */
 1007         if ((frwl->fw_flg & IF6_FW_F_VIAHACK) == IF6_FW_F_VIAHACK) {
 1008                 ;               /* allow "via" backwards compatibility */
 1009         } else if ((frwl->fw_flg & IPV6_FW_F_IN)
 1010             && (frwl->fw_flg & IPV6_FW_F_OIFACE)) {
 1011                 dprintf(("%s outgoing interface check on incoming\n",
 1012                     err_prefix));
 1013                 return (NULL);
 1014         }
 1015         /* Sanity check port ranges */
 1016         if ((frwl->fw_flg & IPV6_FW_F_SRNG) && IPV6_FW_GETNSRCP(frwl) < 2) {
 1017                 dprintf(("%s src range set but n_src_p=%d\n",
 1018                     err_prefix, IPV6_FW_GETNSRCP(frwl)));
 1019                 return (NULL);
 1020         }
 1021         if ((frwl->fw_flg & IPV6_FW_F_DRNG) && IPV6_FW_GETNDSTP(frwl) < 2) {
 1022                 dprintf(("%s dst range set but n_dst_p=%d\n",
 1023                     err_prefix, IPV6_FW_GETNDSTP(frwl)));
 1024                 return (NULL);
 1025         }
 1026         if (IPV6_FW_GETNSRCP(frwl) + IPV6_FW_GETNDSTP(frwl) > IPV6_FW_MAX_PORTS) {
 1027                 dprintf(("%s too many ports (%d+%d)\n",
 1028                     err_prefix, IPV6_FW_GETNSRCP(frwl), IPV6_FW_GETNDSTP(frwl)));
 1029                 return (NULL);
 1030         }
 1031         /*
 1032          *      Protocols other than TCP/UDP don't use port range
 1033          */
 1034         if ((frwl->fw_prot != IPPROTO_TCP) &&
 1035             (frwl->fw_prot != IPPROTO_UDP) &&
 1036             (IPV6_FW_GETNSRCP(frwl) || IPV6_FW_GETNDSTP(frwl))) {
 1037                 dprintf(("%s port(s) specified for non TCP/UDP rule\n",
 1038                     err_prefix));
 1039                 return (NULL);
 1040         }
 1041 
 1042         /*
 1043          *      Rather than modify the entry to make such entries work,
 1044          *      we reject this rule and require user level utilities
 1045          *      to enforce whatever policy they deem appropriate.
 1046          */
 1047         if ((frwl->fw_src.s6_addr32[0] & (~frwl->fw_smsk.s6_addr32[0])) ||
 1048                 (frwl->fw_src.s6_addr32[1] & (~frwl->fw_smsk.s6_addr32[1])) ||
 1049                 (frwl->fw_src.s6_addr32[2] & (~frwl->fw_smsk.s6_addr32[2])) ||
 1050                 (frwl->fw_src.s6_addr32[3] & (~frwl->fw_smsk.s6_addr32[3])) ||
 1051                 (frwl->fw_dst.s6_addr32[0] & (~frwl->fw_dmsk.s6_addr32[0])) ||
 1052                 (frwl->fw_dst.s6_addr32[1] & (~frwl->fw_dmsk.s6_addr32[1])) ||
 1053                 (frwl->fw_dst.s6_addr32[2] & (~frwl->fw_dmsk.s6_addr32[2])) ||
 1054                 (frwl->fw_dst.s6_addr32[3] & (~frwl->fw_dmsk.s6_addr32[3]))) {
 1055                 dprintf(("%s rule never matches\n", err_prefix));
 1056                 return (NULL);
 1057         }
 1058 
 1059         if ((frwl->fw_flg & IPV6_FW_F_FRAG) &&
 1060                 (frwl->fw_prot == IPPROTO_UDP || frwl->fw_prot == IPPROTO_TCP)) {
 1061                 if (frwl->fw_nports) {
 1062                         dprintf(("%s cannot mix 'frag' and ports\n", err_prefix));
 1063                         return (NULL);
 1064                 }
 1065                 if (frwl->fw_prot == IPPROTO_TCP &&
 1066                         frwl->fw_tcpf != frwl->fw_tcpnf) {
 1067                         dprintf(("%s cannot mix 'frag' with TCP flags\n", err_prefix));
 1068                         return (NULL);
 1069                 }
 1070         }
 1071 
 1072         /* Check command specific stuff */
 1073         switch (frwl->fw_flg & IPV6_FW_F_COMMAND)
 1074         {
 1075         case IPV6_FW_F_REJECT:
 1076                 if (frwl->fw_reject_code >= 0x100
 1077                     && !(frwl->fw_prot == IPPROTO_TCP
 1078                       && frwl->fw_reject_code == IPV6_FW_REJECT_RST)) {
 1079                         dprintf(("%s unknown reject code\n", err_prefix));
 1080                         return (NULL);
 1081                 }
 1082                 break;
 1083         case IPV6_FW_F_DIVERT:          /* Diverting to port zero is invalid */
 1084         case IPV6_FW_F_TEE:
 1085                 if (frwl->fw_divert_port == 0) {
 1086                         dprintf(("%s can't divert to port 0\n", err_prefix));
 1087                         return (NULL);
 1088                 }
 1089                 break;
 1090         case IPV6_FW_F_DENY:
 1091         case IPV6_FW_F_ACCEPT:
 1092         case IPV6_FW_F_COUNT:
 1093         case IPV6_FW_F_SKIPTO:
 1094                 break;
 1095         default:
 1096                 dprintf(("%s invalid command\n", err_prefix));
 1097                 return (NULL);
 1098         }
 1099 
 1100         return frwl;
 1101 }
 1102 
 1103 static int
 1104 ip6_fw_ctl(int stage, struct mbuf **mm)
 1105 {
 1106         int error;
 1107         struct mbuf *m;
 1108 
 1109         if (stage == IPV6_FW_GET) {
 1110                 struct ip6_fw_chain *fcp = ip6_fw_chain.lh_first;
 1111                 *mm = m = m_get(M_TRYWAIT, MT_DATA); /* XXX */
 1112                 if (!m)
 1113                         return (ENOBUFS);
 1114                 if (sizeof *(fcp->rule) > MLEN) {
 1115                         MCLGET(m, M_TRYWAIT);
 1116                         if ((m->m_flags & M_EXT) == 0) {
 1117                                 m_free(m);
 1118                                 return (ENOBUFS);
 1119                         }
 1120                 }
 1121                 for (; fcp; fcp = fcp->chain.le_next) {
 1122                         bcopy(fcp->rule, m->m_data, sizeof *(fcp->rule));
 1123                         m->m_len = sizeof *(fcp->rule);
 1124                         m->m_next = m_get(M_TRYWAIT, MT_DATA); /* XXX */
 1125                         if (!m->m_next) {
 1126                                 m_freem(*mm);
 1127                                 return (ENOBUFS);
 1128                         }
 1129                         m = m->m_next;
 1130                         if (sizeof *(fcp->rule) > MLEN) {
 1131                                 MCLGET(m, M_TRYWAIT);
 1132                                 if ((m->m_flags & M_EXT) == 0) {
 1133                                         m_freem(*mm);
 1134                                         return (ENOBUFS);
 1135                                 }
 1136                         }
 1137                         m->m_len = 0;
 1138                 }
 1139                 return (0);
 1140         }
 1141         m = *mm;
 1142         /* only allow get calls if secure mode > 2 */
 1143         if (securelevel > 2) {
 1144                 if (m) {
 1145                         (void)m_freem(m);
 1146                         *mm = 0;
 1147                 }
 1148                 return (EPERM);
 1149         }
 1150         if (stage == IPV6_FW_FLUSH) {
 1151                 while (ip6_fw_chain.lh_first != NULL &&
 1152                     ip6_fw_chain.lh_first->rule->fw_number != (u_short)-1) {
 1153                         struct ip6_fw_chain *fcp = ip6_fw_chain.lh_first;
 1154                         int s = splnet();
 1155                         LIST_REMOVE(ip6_fw_chain.lh_first, chain);
 1156                         splx(s);
 1157                         free(fcp->rule, M_IP6FW);
 1158                         free(fcp, M_IP6FW);
 1159                 }
 1160                 if (m) {
 1161                         (void)m_freem(m);
 1162                         *mm = 0;
 1163                 }
 1164                 return (0);
 1165         }
 1166         if (stage == IPV6_FW_ZERO) {
 1167                 error = zero_entry6(m);
 1168                 if (m) {
 1169                         (void)m_freem(m);
 1170                         *mm = 0;
 1171                 }
 1172                 return (error);
 1173         }
 1174         if (m == NULL) {
 1175                 printf("%s NULL mbuf ptr\n", err_prefix);
 1176                 return (EINVAL);
 1177         }
 1178 
 1179         if (stage == IPV6_FW_ADD) {
 1180                 struct ip6_fw *frwl = check_ip6fw_mbuf(m);
 1181 
 1182                 if (!frwl)
 1183                         error = EINVAL;
 1184                 else
 1185                         error = add_entry6(&ip6_fw_chain, frwl);
 1186                 if (m) {
 1187                         (void)m_freem(m);
 1188                         *mm = 0;
 1189                 }
 1190                 return error;
 1191         }
 1192         if (stage == IPV6_FW_DEL) {
 1193                 if (m->m_len != sizeof(struct ip6_fw)) {
 1194                         dprintf(("%s len=%d, want %zu\n", err_prefix, m->m_len,
 1195                             sizeof(struct ip6_fw)));
 1196                         error = EINVAL;
 1197                 } else if (mtod(m, struct ip6_fw *)->fw_number == (u_short)-1) {
 1198                         dprintf(("%s can't delete rule 65535\n", err_prefix));
 1199                         error = EINVAL;
 1200                 } else
 1201                         error = del_entry6(&ip6_fw_chain,
 1202                             mtod(m, struct ip6_fw *)->fw_number);
 1203                 if (m) {
 1204                         (void)m_freem(m);
 1205                         *mm = 0;
 1206                 }
 1207                 return error;
 1208         }
 1209 
 1210         dprintf(("%s unknown request %d\n", err_prefix, stage));
 1211         if (m) {
 1212                 (void)m_freem(m);
 1213                 *mm = 0;
 1214         }
 1215         return (EINVAL);
 1216 }
 1217 
 1218 void
 1219 ip6_fw_init(void)
 1220 {
 1221         struct ip6_fw default_rule;
 1222 
 1223         ip6_fw_chk_ptr = ip6_fw_chk;
 1224         ip6_fw_ctl_ptr = ip6_fw_ctl;
 1225         LIST_INIT(&ip6_fw_chain);
 1226 
 1227         bzero(&default_rule, sizeof default_rule);
 1228         default_rule.fw_prot = IPPROTO_IPV6;
 1229         default_rule.fw_number = (u_short)-1;
 1230 #ifdef IPV6FIREWALL_DEFAULT_TO_ACCEPT
 1231         default_rule.fw_flg |= IPV6_FW_F_ACCEPT;
 1232 #else
 1233         default_rule.fw_flg |= IPV6_FW_F_DENY;
 1234 #endif
 1235         default_rule.fw_flg |= IPV6_FW_F_IN | IPV6_FW_F_OUT;
 1236         if (check_ip6fw_struct(&default_rule) == NULL ||
 1237                 add_entry6(&ip6_fw_chain, &default_rule))
 1238                 panic(__func__);
 1239 
 1240         /* Setup our sysctl tree */
 1241         sysctl_ctx_init(&ip6_fw_sysctl_ctx);
 1242         ip6_fw_sysctl_tree = SYSCTL_ADD_NODE(&ip6_fw_sysctl_ctx,
 1243             SYSCTL_STATIC_CHILDREN(_net_inet6_ip6), OID_AUTO, "fw",
 1244             CTLFLAG_RW | CTLFLAG_SECURE, 0, "Firewall");
 1245         SYSCTL_ADD_INT(&ip6_fw_sysctl_ctx, SYSCTL_CHILDREN(ip6_fw_sysctl_tree),
 1246             OID_AUTO, "enable", CTLFLAG_RW | CTLFLAG_SECURE, &ip6_fw_enable, 0,
 1247             "Enable ip6fw");
 1248         SYSCTL_ADD_INT(&ip6_fw_sysctl_ctx, SYSCTL_CHILDREN(ip6_fw_sysctl_tree),
 1249             OID_AUTO, "debug", CTLFLAG_RW, &fw6_debug, 0, "");
 1250         SYSCTL_ADD_INT(&ip6_fw_sysctl_ctx, SYSCTL_CHILDREN(ip6_fw_sysctl_tree),
 1251             OID_AUTO, "verbose", CTLFLAG_RW | CTLFLAG_SECURE, &fw6_verbose, 0,
 1252             "");
 1253         SYSCTL_ADD_INT(&ip6_fw_sysctl_ctx, SYSCTL_CHILDREN(ip6_fw_sysctl_tree),
 1254             OID_AUTO, "verbose_limit", CTLFLAG_RW, &fw6_verbose_limit, 0, "");
 1255 
 1256         printf("IPv6 packet filtering initialized, ");
 1257 #ifdef IPV6FIREWALL_DEFAULT_TO_ACCEPT
 1258         printf("default to accept, ");
 1259 #endif
 1260 #ifndef IPV6FIREWALL_VERBOSE
 1261         printf("logging disabled\n");
 1262 #else
 1263         if (fw6_verbose_limit == 0)
 1264                 printf("unlimited logging\n");
 1265         else
 1266                 printf("logging limited to %d packets/entry\n",
 1267                     fw6_verbose_limit);
 1268 #endif
 1269 }
 1270 
 1271 static ip6_fw_chk_t *old_chk_ptr;
 1272 static ip6_fw_ctl_t *old_ctl_ptr;
 1273 
 1274 static int
 1275 ip6fw_modevent(module_t mod, int type, void *unused)
 1276 {
 1277         int s;
 1278 
 1279         switch (type) {
 1280         case MOD_LOAD:
 1281                 s = splnet();
 1282 
 1283                 old_chk_ptr = ip6_fw_chk_ptr;
 1284                 old_ctl_ptr = ip6_fw_ctl_ptr;
 1285 
 1286                 ip6_fw_init();
 1287                 splx(s);
 1288                 return 0;
 1289         case MOD_UNLOAD:
 1290                 s = splnet();
 1291                 ip6_fw_chk_ptr =  old_chk_ptr;
 1292                 ip6_fw_ctl_ptr =  old_ctl_ptr;
 1293                 while (LIST_FIRST(&ip6_fw_chain) != NULL) {
 1294                         struct ip6_fw_chain *fcp = LIST_FIRST(&ip6_fw_chain);
 1295                         LIST_REMOVE(LIST_FIRST(&ip6_fw_chain), chain);
 1296                         free(fcp->rule, M_IP6FW);
 1297                         free(fcp, M_IP6FW);
 1298                 }
 1299 
 1300                 /* Free sysctl tree */
 1301                 sysctl_ctx_free(&ip6_fw_sysctl_ctx);
 1302 
 1303                 splx(s);
 1304                 printf("IPv6 firewall unloaded\n");
 1305                 return 0;
 1306         default:
 1307                 return EOPNOTSUPP;
 1308                 break;
 1309         }
 1310         return 0;
 1311 }
 1312 
 1313 static moduledata_t ip6fwmod = {
 1314         "ip6fw",
 1315         ip6fw_modevent,
 1316         0
 1317 };
 1318 DECLARE_MODULE(ip6fw, ip6fwmod, SI_SUB_PSEUDO, SI_ORDER_ANY);

Cache object: 1dd2568d2d61e1d01e12fb9428b3fc6a


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.