KekenoBSD/src
3
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

pf: move the mbuf into struct pf_pdesc too

Browse Source 
As requested by henning, move the mbuf pointer into struct pf_pdesc.
Also sort pd to the beginning of the functions' parameter lists for
consistency.
ok henning

Obtained from:	OpenBSD, bluhm <bluhm@openbsd.org>, 776f210a75
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D46941
This commit is contained in:
Kristof Provost
2024-10-03 19:53:09 +02:00
parent 08b53c6efc
commit 9a405864e0
8 changed files with 338 additions and 354 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sys/net/if_pflog.h
+2 -2
View File
@@ -69,9 +69,9 @@ struct pf_ruleset;
struct pfi_kif;
struct pf_pdesc;
#define PFLOG_PACKET(a,b,t,c,d,e,f,g) do { \
#define PFLOG_PACKET(b,t,c,d,e,f,g) do { \
if (pflog_packet_ptr != NULL) \
pflog_packet_ptr(a,b,t,c,d,e,f,g); \
pflog_packet_ptr(b,t,c,d,e,f,g); \
} while (0)
#endif /* _KERNEL */
#endif /* _NET_IF_PFLOG_H_ */
sys/net/pfvar.h
+20 -22
View File
@@ -1249,7 +1249,7 @@ void pf_state_export(struct pf_state_export *,
/* pflog */
struct pf_kruleset;
struct pf_pdesc;
typedef int pflog_packet_t(struct mbuf *, uint8_t, u_int8_t,
typedef int pflog_packet_t(uint8_t, u_int8_t,
struct pf_krule *, struct pf_krule *, struct pf_kruleset *,
struct pf_pdesc *, int);
extern pflog_packet_t *pflog_packet_ptr;
@@ -1598,6 +1598,7 @@ struct pf_pdesc {
} hdr;
struct pfi_kkif *kif; /* incomming interface */
struct mbuf *m;
struct pf_addr *src; /* src address */
struct pf_addr *dst; /* dst address */
@@ -1650,7 +1651,6 @@ struct pf_sctp_multihome_job {
struct pf_pdesc pd;
struct pf_addr src;
struct pf_addr dst;
struct mbuf *m;
int op;
};
@@ -2355,7 +2355,7 @@ extern void pf_addrcpy(struct pf_addr *, struct pf_addr *,
void pf_free_rule(struct pf_krule *);
int pf_test_eth(int, int, struct ifnet *, struct mbuf **, struct inpcb *);
int pf_scan_sctp(struct mbuf *, struct pf_pdesc *);
int pf_scan_sctp(struct pf_pdesc *);
#if defined(INET) || defined(INET6)
int pf_test(sa_family_t, int, int, struct ifnet *, struct mbuf **, struct inpcb *,
struct pf_rule_actions *);
@@ -2375,8 +2375,8 @@ int pf_max_frag_size(struct mbuf *);
int pf_refragment6(struct ifnet *, struct mbuf **, struct m_tag *, bool);
#endif /* INET6 */
int pf_multihome_scan_init(struct mbuf *, int, int, struct pf_pdesc *);
int pf_multihome_scan_asconf(struct mbuf *, int, int, struct pf_pdesc *);
int pf_multihome_scan_init(int, int, struct pf_pdesc *);
int pf_multihome_scan_asconf(int, int, struct pf_pdesc *);
u_int32_t pf_new_isn(struct pf_kstate *);
void *pf_pull_hdr(const struct mbuf *, int, void *, int, u_short *, u_short *,
@@ -2398,23 +2398,23 @@ int pf_match_port(u_int8_t, u_int16_t, u_int16_t, u_int16_t);
void pf_normalize_init(void);
void pf_normalize_cleanup(void);
int pf_normalize_tcp(struct mbuf *, struct pf_pdesc *);
int pf_normalize_tcp(struct pf_pdesc *);
void pf_normalize_tcp_cleanup(struct pf_kstate *);
int pf_normalize_tcp_init(struct mbuf *, struct pf_pdesc *,
int pf_normalize_tcp_init(struct pf_pdesc *,
struct tcphdr *, struct pf_state_peer *, struct pf_state_peer *);
int pf_normalize_tcp_stateful(struct mbuf *, struct pf_pdesc *,
int pf_normalize_tcp_stateful(struct pf_pdesc *,
u_short *, struct tcphdr *, struct pf_kstate *,
struct pf_state_peer *, struct pf_state_peer *, int *);
int pf_normalize_sctp_init(struct mbuf *, struct pf_pdesc *,
int pf_normalize_sctp_init(struct pf_pdesc *,
struct pf_state_peer *, struct pf_state_peer *);
int pf_normalize_sctp(struct mbuf *, struct pf_pdesc *);
int pf_normalize_sctp(struct pf_pdesc *);
u_int32_t
pf_state_expires(const struct pf_kstate *);
void pf_purge_expired_fragments(void);
void pf_purge_fragments(uint32_t);
int pf_routable(struct pf_addr *addr, sa_family_t af, struct pfi_kkif *,
int);
int pf_socket_lookup(struct pf_pdesc *, struct mbuf *);
int pf_socket_lookup(struct pf_pdesc *);
struct pf_state_key *pf_alloc_state_key(int);
void pfr_initialize(void);
void pfr_cleanup(void);
@@ -2482,12 +2482,12 @@ int pfi_set_flags(const char *, int);
int pfi_clear_flags(const char *, int);
int pf_match_tag(struct mbuf *, struct pf_krule *, int *, int);
int pf_tag_packet(struct mbuf *, struct pf_pdesc *, int);
int pf_tag_packet(struct pf_pdesc *, int);
int pf_addr_cmp(struct pf_addr *, struct pf_addr *,
sa_family_t);
u_int16_t pf_get_mss(struct mbuf *, struct pf_pdesc *);
u_int8_t pf_get_wscale(struct mbuf *, struct pf_pdesc *);
u_int16_t pf_get_mss(struct pf_pdesc *);
u_int8_t pf_get_wscale(struct pf_pdesc *);
struct mbuf *pf_build_tcp(const struct pf_krule *, sa_family_t,
const struct pf_addr *, const struct pf_addr *,
u_int16_t, u_int16_t, u_int32_t, u_int32_t,
@@ -2504,8 +2504,7 @@ void pf_syncookies_cleanup(void);
int pf_get_syncookies(struct pfioc_nv *);
int pf_set_syncookies(struct pfioc_nv *);
int pf_synflood_check(struct pf_pdesc *);
void pf_syncookie_send(struct mbuf *m,
struct pf_pdesc *);
void pf_syncookie_send(struct pf_pdesc *);
bool pf_syncookie_check(struct pf_pdesc *);
u_int8_t pf_syncookie_validate(struct pf_pdesc *);
struct mbuf * pf_syncookie_recreate_syn(struct pf_pdesc *);
@@ -2590,8 +2589,7 @@ void pf_addr_copyout(struct pf_addr_wrap *);
int pf_osfp_add(struct pf_osfp_ioctl *);
#ifdef _KERNEL
struct pf_osfp_enlist *
pf_osfp_fingerprint(struct pf_pdesc *, struct mbuf *,
const struct tcphdr *);
pf_osfp_fingerprint(struct pf_pdesc *, const struct tcphdr *);
#endif /* _KERNEL */
void pf_osfp_flush(void);
int pf_osfp_get(struct pf_osfp_ioctl *);
@@ -2622,7 +2620,7 @@ u_short pf_map_addr_sn(u_int8_t, struct pf_krule *,
struct pf_addr *, struct pf_addr *,
struct pfi_kkif **nkif, struct pf_addr *,
struct pf_ksrc_node **);
u_short pf_get_translation(struct pf_pdesc *, struct mbuf *,
u_short pf_get_translation(struct pf_pdesc *,
int, struct pf_ksrc_node **,
struct pf_state_key **, struct pf_state_key **,
struct pf_addr *, struct pf_addr *,
@@ -2630,14 +2628,14 @@ u_short pf_get_translation(struct pf_pdesc *, struct mbuf *,
struct pf_krule **,
struct pf_udp_mapping **udp_mapping);
struct pf_state_key *pf_state_key_setup(struct pf_pdesc *, struct mbuf *,
struct pf_state_key *pf_state_key_setup(struct pf_pdesc *,
struct pf_addr *, struct pf_addr *, u_int16_t, u_int16_t);
struct pf_state_key *pf_state_key_clone(const struct pf_state_key *);
void pf_rule_to_actions(struct pf_krule *,
struct pf_rule_actions *);
int pf_normalize_mss(struct mbuf *m, struct pf_pdesc *pd);
int pf_normalize_mss(struct pf_pdesc *pd);
#if defined(INET) || defined(INET6)
void pf_scrub(struct mbuf *, struct pf_pdesc *);
void pf_scrub(struct pf_pdesc *);
#endif
struct pfi_kkif *pf_kkif_create(int);
sys/netpfil/pf/if_pflog.c
+7 -7
View File
@@ -213,14 +213,14 @@ pflogioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
}
static int
pflog_packet(struct mbuf *m, uint8_t action, u_int8_t reason,
pflog_packet(uint8_t action, u_int8_t reason,
struct pf_krule *rm, struct pf_krule *am,
struct pf_kruleset *ruleset, struct pf_pdesc *pd, int lookupsafe)
{
struct ifnet *ifn;
struct pfloghdr hdr;
if (m == NULL || rm == NULL || pd == NULL)
if (rm == NULL || pd == NULL)
return (1);
ifn = V_pflogifs[rm->logif];
@@ -251,7 +251,7 @@ pflog_packet(struct mbuf *m, uint8_t action, u_int8_t reason,
* These conditions are very very rare, however.
*/
if (rm->log & PF_LOG_SOCKET_LOOKUP && !pd->lookup.done && lookupsafe)
pd->lookup.done = pf_socket_lookup(pd, m);
pd->lookup.done = pf_socket_lookup(pd);
if (pd->lookup.done > 0)
hdr.uid = pd->lookup.uid;
else
@@ -265,15 +265,15 @@ pflog_packet(struct mbuf *m, uint8_t action, u_int8_t reason,
if (pd->af == AF_INET && pd->dir == PF_OUT) {
struct ip *ip;
ip = mtod(m, struct ip *);
ip = mtod(pd->m, struct ip *);
ip->ip_sum = 0;
ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
ip->ip_sum = in_cksum(pd->m, ip->ip_hl << 2);
}
#endif /* INET */
if_inc_counter(ifn, IFCOUNTER_OPACKETS, 1);
if_inc_counter(ifn, IFCOUNTER_OBYTES, m->m_pkthdr.len);
bpf_mtap2(ifn->if_bpf, &hdr, PFLOG_HDRLEN, m);
if_inc_counter(ifn, IFCOUNTER_OBYTES, pd->m->m_pkthdr.len);
bpf_mtap2(ifn->if_bpf, &hdr, PFLOG_HDRLEN, pd->m);
return (0);
}
sys/netpfil/pf/pf.c
+229 -241
View File
File diff suppressed because it is too large Load Diff
sys/netpfil/pf/pf_lb.c
+15 -15
View File
@@ -63,7 +63,7 @@ VNET_DEFINE_STATIC(int, pf_rdr_srcport_rewrite_tries) = 16;
static void pf_hash(struct pf_addr *, struct pf_addr *,
struct pf_poolhashkey *, sa_family_t);
static struct pf_krule *pf_match_translation(struct pf_pdesc *, struct mbuf *,
static struct pf_krule *pf_match_translation(struct pf_pdesc *,
struct pf_addr *, u_int16_t,
struct pf_addr *, uint16_t, int,
struct pf_kanchor_stackframe *);
@@ -131,7 +131,7 @@ pf_hash(struct pf_addr *inaddr, struct pf_addr *hash,
}
static struct pf_krule *
pf_match_translation(struct pf_pdesc *pd, struct mbuf *m,
pf_match_translation(struct pf_pdesc *pd,
struct pf_addr *saddr, u_int16_t sport,
struct pf_addr *daddr, uint16_t dport, int rs_num,
struct pf_kanchor_stackframe *anchor_stack)
@@ -166,7 +166,7 @@ pf_match_translation(struct pf_pdesc *pd, struct mbuf *m,
else if (r->proto && r->proto != pd->proto)
r = r->skip[PF_SKIP_PROTO];
else if (PF_MISMATCHAW(&src->addr, saddr, pd->af,
src->neg, pd->kif, M_GETFIB(m)))
src->neg, pd->kif, M_GETFIB(pd->m)))
r = r->skip[src == &r->src ? PF_SKIP_SRC_ADDR :
PF_SKIP_DST_ADDR];
else if (src->port_op && !pf_match_port(src->port_op,
@@ -175,20 +175,20 @@ pf_match_translation(struct pf_pdesc *pd, struct mbuf *m,
PF_SKIP_DST_PORT];
else if (dst != NULL &&
PF_MISMATCHAW(&dst->addr, daddr, pd->af, dst->neg, NULL,
M_GETFIB(m)))
M_GETFIB(pd->m)))
r = r->skip[PF_SKIP_DST_ADDR];
else if (xdst != NULL && PF_MISMATCHAW(xdst, daddr, pd->af,
0, NULL, M_GETFIB(m)))
0, NULL, M_GETFIB(pd->m)))
r = TAILQ_NEXT(r, entries);
else if (dst != NULL && dst->port_op &&
!pf_match_port(dst->port_op, dst->port[0],
dst->port[1], dport))
r = r->skip[PF_SKIP_DST_PORT];
else if (r->match_tag && !pf_match_tag(m, r, &tag,
else if (r->match_tag && !pf_match_tag(pd->m, r, &tag,
pd->pf_mtag ? pd->pf_mtag->tag : 0))
r = TAILQ_NEXT(r, entries);
else if (r->os_fingerprint != PF_OSFP_ANY && (pd->proto !=
IPPROTO_TCP || !pf_osfp_match(pf_osfp_fingerprint(pd, m,
IPPROTO_TCP || !pf_osfp_match(pf_osfp_fingerprint(pd,
&pd->hdr.tcp), r->os_fingerprint)))
r = TAILQ_NEXT(r, entries);
else {
@@ -213,10 +213,10 @@ pf_match_translation(struct pf_pdesc *pd, struct mbuf *m,
rs_num, &r, NULL, NULL);
}
if (tag > 0 && pf_tag_packet(m, pd, tag))
if (tag > 0 && pf_tag_packet(pd, tag))
return (NULL);
if (rtableid >= 0)
M_SETFIB(m, rtableid);
M_SETFIB(pd->m, rtableid);
return (rm);
}
@@ -696,7 +696,7 @@ pf_map_addr_sn(sa_family_t af, struct pf_krule *r, struct pf_addr *saddr,
}
u_short
pf_get_translation(struct pf_pdesc *pd, struct mbuf *m, int off,
pf_get_translation(struct pf_pdesc *pd, int off,
struct pf_ksrc_node **sn, struct pf_state_key **skp,
struct pf_state_key **nkp, struct pf_addr *saddr, struct pf_addr *daddr,
uint16_t sport, uint16_t dport, struct pf_kanchor_stackframe *anchor_stack,
@@ -716,17 +716,17 @@ pf_get_translation(struct pf_pdesc *pd, struct mbuf *m, int off,
*rp = NULL;
if (pd->dir == PF_OUT) {
r = pf_match_translation(pd, m, saddr,
r = pf_match_translation(pd, saddr,
sport, daddr, dport, PF_RULESET_BINAT, anchor_stack);
if (r == NULL)
r = pf_match_translation(pd, m,
r = pf_match_translation(pd,
saddr, sport, daddr, dport, PF_RULESET_NAT,
anchor_stack);
} else {
r = pf_match_translation(pd, m, saddr,
r = pf_match_translation(pd, saddr,
sport, daddr, dport, PF_RULESET_RDR, anchor_stack);
if (r == NULL)
r = pf_match_translation(pd, m,
r = pf_match_translation(pd,
saddr, sport, daddr, dport, PF_RULESET_BINAT,
anchor_stack);
}
@@ -741,7 +741,7 @@ pf_get_translation(struct pf_pdesc *pd, struct mbuf *m, int off,
return (PFRES_MAX);
}
*skp = pf_state_key_setup(pd, m, saddr, daddr, sport, dport);
*skp = pf_state_key_setup(pd, saddr, daddr, sport, dport);
if (*skp == NULL)
return (PFRES_MEMORY);
*nkp = pf_state_key_clone(*skp);
sys/netpfil/pf/pf_norm.c
+55 -55
View File
@@ -1050,9 +1050,8 @@ int
pf_normalize_ip(struct mbuf **m0, u_short *reason,
struct pf_pdesc *pd)
{
struct mbuf *m = *m0;
struct pf_krule *r;
struct ip *h = mtod(m, struct ip *);
struct ip *h = mtod(*m0, struct ip *);
int mff = (ntohs(h->ip_off) & IP_MF);
int hlen = h->ip_hl << 2;
u_int16_t fragoff = (ntohs(h->ip_off) & IP_OFFMASK) << 3;
@@ -1064,6 +1063,8 @@ pf_normalize_ip(struct mbuf **m0, u_short *reason,
PF_RULES_RASSERT();
MPASS(pd->m == *m0);
r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_SCRUB].active.ptr);
/*
* Check if there are any scrub rules, matching or not.
@@ -1088,13 +1089,13 @@ pf_normalize_ip(struct mbuf **m0, u_short *reason,
r = r->skip[PF_SKIP_PROTO];
else if (PF_MISMATCHAW(&r->src.addr,
(struct pf_addr *)&h->ip_src.s_addr, AF_INET,
r->src.neg, pd->kif, M_GETFIB(m)))
r->src.neg, pd->kif, M_GETFIB(pd->m)))
r = r->skip[PF_SKIP_SRC_ADDR];
else if (PF_MISMATCHAW(&r->dst.addr,
(struct pf_addr *)&h->ip_dst.s_addr, AF_INET,
r->dst.neg, NULL, M_GETFIB(m)))
r->dst.neg, NULL, M_GETFIB(pd->m)))
r = r->skip[PF_SKIP_DST_ADDR];
else if (r->match_tag && !pf_match_tag(m, r, &tag,
else if (r->match_tag && !pf_match_tag(pd->m, r, &tag,
pd->pf_mtag ? pd->pf_mtag->tag : 0))
r = TAILQ_NEXT(r, entries);
else
@@ -1178,11 +1179,11 @@ pf_normalize_ip(struct mbuf **m0, u_short *reason,
if (verdict != PF_PASS)
return (PF_DROP);
m = *m0;
if (m == NULL)
pd->m = *m0;
if (pd->m == NULL)
return (PF_DROP);
h = mtod(m, struct ip *);
h = mtod(pd->m, struct ip *);
no_fragment:
/* At this point, only IP_DF is allowed in ip_off */
@@ -1201,7 +1202,7 @@ pf_normalize_ip(struct mbuf **m0, u_short *reason,
REASON_SET(reason, PFRES_FRAG);
drop:
if (r != NULL && r->log)
PFLOG_PACKET(m, PF_DROP, *reason, r, NULL, NULL, pd, 1);
PFLOG_PACKET(PF_DROP, *reason, r, NULL, NULL, pd, 1);
return (PF_DROP);
}
@@ -1212,14 +1213,13 @@ int
pf_normalize_ip6(struct mbuf **m0, int off, u_short *reason,
struct pf_pdesc *pd)
{
struct mbuf *m;
struct pf_krule *r;
struct ip6_frag frag;
bool scrub_compat;
PF_RULES_RASSERT();
m = *m0;
pd->m = *m0;
r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_SCRUB].active.ptr);
/*
@@ -1243,11 +1243,11 @@ pf_normalize_ip6(struct mbuf **m0, int off, u_short *reason,
r = r->skip[PF_SKIP_PROTO];
else if (PF_MISMATCHAW(&r->src.addr,
(struct pf_addr *)&pd->src, AF_INET6,
r->src.neg, pd->kif, M_GETFIB(m)))
r->src.neg, pd->kif, M_GETFIB(pd->m)))
r = r->skip[PF_SKIP_SRC_ADDR];
else if (PF_MISMATCHAW(&r->dst.addr,
(struct pf_addr *)&pd->dst, AF_INET6,
r->dst.neg, NULL, M_GETFIB(m)))
r->dst.neg, NULL, M_GETFIB(pd->m)))
r = r->skip[PF_SKIP_DST_ADDR];
else
break;
@@ -1266,7 +1266,7 @@ pf_normalize_ip6(struct mbuf **m0, int off, u_short *reason,
pf_rule_to_actions(r, &pd->act);
}
if (!pf_pull_hdr(m, off, &frag, sizeof(frag), NULL, reason, AF_INET6))
if (!pf_pull_hdr(pd->m, off, &frag, sizeof(frag), NULL, reason, AF_INET6))
return (PF_DROP);
/* Offset now points to data portion. */
@@ -1277,8 +1277,8 @@ pf_normalize_ip6(struct mbuf **m0, int off, u_short *reason,
* mbuf. */
if (pf_reassemble6(m0, &frag, off, pd->extoff, reason) != PF_PASS)
return (PF_DROP);
m = *m0;
if (m == NULL)
pd->m = *m0;
if (pd->m == NULL)
return (PF_DROP);
}
@@ -1287,7 +1287,7 @@ pf_normalize_ip6(struct mbuf **m0, int off, u_short *reason,
#endif /* INET6 */
int
pf_normalize_tcp(struct mbuf *m, struct pf_pdesc *pd)
pf_normalize_tcp(struct pf_pdesc *pd)
{
struct pf_krule *r, *rm = NULL;
struct tcphdr *th = &pd->hdr.tcp;
@@ -1314,19 +1314,19 @@ pf_normalize_tcp(struct mbuf *m, struct pf_pdesc *pd)
else if (r->proto && r->proto != pd->proto)
r = r->skip[PF_SKIP_PROTO];
else if (PF_MISMATCHAW(&r->src.addr, pd->src, af,
r->src.neg, pd->kif, M_GETFIB(m)))
r->src.neg, pd->kif, M_GETFIB(pd->m)))
r = r->skip[PF_SKIP_SRC_ADDR];
else if (r->src.port_op && !pf_match_port(r->src.port_op,
r->src.port[0], r->src.port[1], th->th_sport))
r = r->skip[PF_SKIP_SRC_PORT];
else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af,
r->dst.neg, NULL, M_GETFIB(m)))
r->dst.neg, NULL, M_GETFIB(pd->m)))
r = r->skip[PF_SKIP_DST_ADDR];
else if (r->dst.port_op && !pf_match_port(r->dst.port_op,
r->dst.port[0], r->dst.port[1], th->th_dport))
r = r->skip[PF_SKIP_DST_PORT];
else if (r->os_fingerprint != PF_OSFP_ANY && !pf_osfp_match(
pf_osfp_fingerprint(pd, m, th),
pf_osfp_fingerprint(pd, th),
r->os_fingerprint))
r = TAILQ_NEXT(r, entries);
else {
@@ -1385,13 +1385,13 @@ pf_normalize_tcp(struct mbuf *m, struct pf_pdesc *pd)
tcp_set_flags(th, flags);
nv = *(u_int16_t *)(&th->th_ack + 1);
th->th_sum = pf_proto_cksum_fixup(m, th->th_sum, ov, nv, 0);
th->th_sum = pf_proto_cksum_fixup(pd->m, th->th_sum, ov, nv, 0);
rewrite = 1;
}
/* Remove urgent pointer, if TH_URG is not set */
if (!(flags & TH_URG) && th->th_urp) {
th->th_sum = pf_proto_cksum_fixup(m, th->th_sum, th->th_urp,
th->th_sum = pf_proto_cksum_fixup(pd->m, th->th_sum, th->th_urp,
0, 0);
th->th_urp = 0;
rewrite = 1;
@@ -1399,20 +1399,20 @@ pf_normalize_tcp(struct mbuf *m, struct pf_pdesc *pd)
/* copy back packet headers if we sanitized */
if (rewrite)
m_copyback(m, pd->off, sizeof(*th), (caddr_t)th);
m_copyback(pd->m, pd->off, sizeof(*th), (caddr_t)th);
return (PF_PASS);
tcp_drop:
REASON_SET(&reason, PFRES_NORM);
if (rm != NULL && r->log)
PFLOG_PACKET(m, PF_DROP, reason, r, NULL, NULL, pd, 1);
PFLOG_PACKET(PF_DROP, reason, r, NULL, NULL, pd, 1);
return (PF_DROP);
}
int
pf_normalize_tcp_init(struct mbuf *m, struct pf_pdesc *pd,
struct tcphdr *th, struct pf_state_peer *src, struct pf_state_peer *dst)
pf_normalize_tcp_init(struct pf_pdesc *pd, struct tcphdr *th,
struct pf_state_peer *src, struct pf_state_peer *dst)
{
u_int32_t tsval, tsecr;
u_int8_t hdr[60];
@@ -1428,14 +1428,14 @@ pf_normalize_tcp_init(struct mbuf *m, struct pf_pdesc *pd,
switch (pd->af) {
#ifdef INET
case AF_INET: {
struct ip *h = mtod(m, struct ip *);
struct ip *h = mtod(pd->m, struct ip *);
src->scrub->pfss_ttl = h->ip_ttl;
break;
}
#endif /* INET */
#ifdef INET6
case AF_INET6: {
struct ip6_hdr *h = mtod(m, struct ip6_hdr *);
struct ip6_hdr *h = mtod(pd->m, struct ip6_hdr *);
src->scrub->pfss_ttl = h->ip6_hlim;
break;
}
@@ -1450,7 +1450,7 @@ pf_normalize_tcp_init(struct mbuf *m, struct pf_pdesc *pd,
return (0);
if (th->th_off > (sizeof(struct tcphdr) >> 2) && src->scrub &&
pf_pull_hdr(m, pd->off, hdr, th->th_off << 2, NULL, NULL, pd->af)) {
pf_pull_hdr(pd->m, pd->off, hdr, th->th_off << 2, NULL, NULL, pd->af)) {
/* Diddle with TCP options */
int hlen;
opt = hdr + sizeof(struct tcphdr);
@@ -1501,8 +1501,8 @@ pf_normalize_tcp_cleanup(struct pf_kstate *state)
/* Someday... flush the TCP segment reassembly descriptors. */
}
int
pf_normalize_sctp_init(struct mbuf *m, struct pf_pdesc *pd,
struct pf_state_peer *src, struct pf_state_peer *dst)
pf_normalize_sctp_init(struct pf_pdesc *pd, struct pf_state_peer *src,
struct pf_state_peer *dst)
{
src->scrub = uma_zalloc(V_pf_state_scrub_z, M_ZERO | M_NOWAIT);
if (src->scrub == NULL)
@@ -1520,7 +1520,7 @@ pf_normalize_sctp_init(struct mbuf *m, struct pf_pdesc *pd,
}
int
pf_normalize_tcp_stateful(struct mbuf *m, struct pf_pdesc *pd,
pf_normalize_tcp_stateful(struct pf_pdesc *pd,
u_short *reason, struct tcphdr *th, struct pf_kstate *state,
struct pf_state_peer *src, struct pf_state_peer *dst, int *writeback)
{
@@ -1545,7 +1545,7 @@ pf_normalize_tcp_stateful(struct mbuf *m, struct pf_pdesc *pd,
#ifdef INET
case AF_INET: {
if (src->scrub) {
struct ip *h = mtod(m, struct ip *);
struct ip *h = mtod(pd->m, struct ip *);
if (h->ip_ttl > src->scrub->pfss_ttl)
src->scrub->pfss_ttl = h->ip_ttl;
h->ip_ttl = src->scrub->pfss_ttl;
@@ -1556,7 +1556,7 @@ pf_normalize_tcp_stateful(struct mbuf *m, struct pf_pdesc *pd,
#ifdef INET6
case AF_INET6: {
if (src->scrub) {
struct ip6_hdr *h = mtod(m, struct ip6_hdr *);
struct ip6_hdr *h = mtod(pd->m, struct ip6_hdr *);
if (h->ip6_hlim > src->scrub->pfss_ttl)
src->scrub->pfss_ttl = h->ip6_hlim;
h->ip6_hlim = src->scrub->pfss_ttl;
@@ -1569,7 +1569,7 @@ pf_normalize_tcp_stateful(struct mbuf *m, struct pf_pdesc *pd,
if (th->th_off > (sizeof(struct tcphdr) >> 2) &&
((src->scrub && (src->scrub->pfss_flags & PFSS_TIMESTAMP)) ||
(dst->scrub && (dst->scrub->pfss_flags & PFSS_TIMESTAMP))) &&
pf_pull_hdr(m, pd->off, hdr, th->th_off << 2, NULL, NULL, pd->af)) {
pf_pull_hdr(pd->m, pd->off, hdr, th->th_off << 2, NULL, NULL, pd->af)) {
/* Diddle with TCP options */
int hlen;
opt = hdr + sizeof(struct tcphdr);
@@ -1605,7 +1605,7 @@ pf_normalize_tcp_stateful(struct mbuf *m, struct pf_pdesc *pd,
(src->scrub->pfss_flags &
PFSS_TIMESTAMP)) {
tsval = ntohl(tsval);
pf_patch_32_unaligned(m,
pf_patch_32_unaligned(pd->m,
&th->th_sum,
&opt[2],
htonl(tsval +
@@ -1623,7 +1623,7 @@ pf_normalize_tcp_stateful(struct mbuf *m, struct pf_pdesc *pd,
PFSS_TIMESTAMP)) {
tsecr = ntohl(tsecr)
- dst->scrub->pfss_ts_mod;
pf_patch_32_unaligned(m,
pf_patch_32_unaligned(pd->m,
&th->th_sum,
&opt[6],
htonl(tsecr),
@@ -1643,7 +1643,7 @@ pf_normalize_tcp_stateful(struct mbuf *m, struct pf_pdesc *pd,
if (copyback) {
/* Copyback the options, caller copys back header */
*writeback = 1;
m_copyback(m, pd->off + sizeof(struct tcphdr),
m_copyback(pd->m, pd->off + sizeof(struct tcphdr),
(th->th_off << 2) - sizeof(struct tcphdr), hdr +
sizeof(struct tcphdr));
}
@@ -1915,7 +1915,7 @@ pf_normalize_tcp_stateful(struct mbuf *m, struct pf_pdesc *pd,
}
int
pf_normalize_mss(struct mbuf *m, struct pf_pdesc *pd)
pf_normalize_mss(struct pf_pdesc *pd)
{
struct tcphdr *th = &pd->hdr.tcp;
u_int16_t *mss;
@@ -1928,7 +1928,7 @@ pf_normalize_mss(struct mbuf *m, struct pf_pdesc *pd)
thoff = th->th_off << 2;
cnt = thoff - sizeof(struct tcphdr);
if (cnt > 0 && !pf_pull_hdr(m, pd->off + sizeof(*th), opts, cnt,
if (cnt > 0 && !pf_pull_hdr(pd->m, pd->off + sizeof(*th), opts, cnt,
NULL, NULL, pd->af))
return (0);
@@ -1950,14 +1950,14 @@ pf_normalize_mss(struct mbuf *m, struct pf_pdesc *pd)
case TCPOPT_MAXSEG:
mss = (u_int16_t *)(optp + 2);
if ((ntohs(*mss)) > pd->act.max_mss) {
pf_patch_16_unaligned(m,
pf_patch_16_unaligned(pd->m,
&th->th_sum,
mss, htons(pd->act.max_mss),
PF_ALGNMNT(startoff),
0);
m_copyback(m, pd->off + sizeof(*th),
m_copyback(pd->m, pd->off + sizeof(*th),
thoff - sizeof(*th), opts);
m_copyback(m, pd->off, sizeof(*th), (caddr_t)th);
m_copyback(pd->m, pd->off, sizeof(*th), (caddr_t)th);
}
break;
default:
@@ -1969,7 +1969,7 @@ pf_normalize_mss(struct mbuf *m, struct pf_pdesc *pd)
}
int
pf_scan_sctp(struct mbuf *m, struct pf_pdesc *pd)
pf_scan_sctp(struct pf_pdesc *pd)
{
struct sctp_chunkhdr ch = { };
int chunk_off = sizeof(struct sctphdr);
@@ -1977,7 +1977,7 @@ pf_scan_sctp(struct mbuf *m, struct pf_pdesc *pd)
int ret;
while (pd->off + chunk_off < pd->tot_len) {
if (!pf_pull_hdr(m, pd->off + chunk_off, &ch, sizeof(ch), NULL,
if (!pf_pull_hdr(pd->m, pd->off + chunk_off, &ch, sizeof(ch), NULL,
NULL, pd->af))
return (PF_DROP);
@@ -1993,7 +1993,7 @@ pf_scan_sctp(struct mbuf *m, struct pf_pdesc *pd)
case SCTP_INITIATION_ACK: {
struct sctp_init_chunk init;
if (!pf_pull_hdr(m, pd->off + chunk_start, &init,
if (!pf_pull_hdr(pd->m, pd->off + chunk_start, &init,
sizeof(init), NULL, NULL, pd->af))
return (PF_DROP);
@@ -2025,7 +2025,7 @@ pf_scan_sctp(struct mbuf *m, struct pf_pdesc *pd)
else
pd->sctp_flags |= PFDESC_SCTP_INIT_ACK;
ret = pf_multihome_scan_init(m, pd->off + chunk_start,
ret = pf_multihome_scan_init(pd->off + chunk_start,
ntohs(init.ch.chunk_length), pd);
if (ret != PF_PASS)
return (ret);
@@ -2060,7 +2060,7 @@ pf_scan_sctp(struct mbuf *m, struct pf_pdesc *pd)
case SCTP_ASCONF:
pd->sctp_flags |= PFDESC_SCTP_ASCONF;
ret = pf_multihome_scan_asconf(m, pd->off + chunk_start,
ret = pf_multihome_scan_asconf(pd->off + chunk_start,
ntohs(ch.chunk_length), pd);
if (ret != PF_PASS)
return (ret);
@@ -2093,7 +2093,7 @@ pf_scan_sctp(struct mbuf *m, struct pf_pdesc *pd)
}
int
pf_normalize_sctp(struct mbuf *m, struct pf_pdesc *pd)
pf_normalize_sctp(struct pf_pdesc *pd)
{
struct pf_krule *r, *rm = NULL;
struct sctphdr *sh = &pd->hdr.sctp;
@@ -2118,13 +2118,13 @@ pf_normalize_sctp(struct mbuf *m, struct pf_pdesc *pd)
else if (r->proto && r->proto != pd->proto)
r = r->skip[PF_SKIP_PROTO];
else if (PF_MISMATCHAW(&r->src.addr, pd->src, af,
r->src.neg, pd->kif, M_GETFIB(m)))
r->src.neg, pd->kif, M_GETFIB(pd->m)))
r = r->skip[PF_SKIP_SRC_ADDR];
else if (r->src.port_op && !pf_match_port(r->src.port_op,
r->src.port[0], r->src.port[1], sh->src_port))
r = r->skip[PF_SKIP_SRC_PORT];
else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af,
r->dst.neg, NULL, M_GETFIB(m)))
r->dst.neg, NULL, M_GETFIB(pd->m)))
r = r->skip[PF_SKIP_DST_ADDR];
else if (r->dst.port_op && !pf_match_port(r->dst.port_op,
r->dst.port[0], r->dst.port[1], sh->dest_port))
@@ -2161,7 +2161,7 @@ pf_normalize_sctp(struct mbuf *m, struct pf_pdesc *pd)
sctp_drop:
REASON_SET(&reason, PFRES_NORM);
if (rm != NULL && r->log)
PFLOG_PACKET(m, PF_DROP, reason, r, NULL, NULL, pd,
PFLOG_PACKET(PF_DROP, reason, r, NULL, NULL, pd,
1);
return (PF_DROP);
@@ -2169,12 +2169,12 @@ pf_normalize_sctp(struct mbuf *m, struct pf_pdesc *pd)
#if defined(INET) || defined(INET6)
void
pf_scrub(struct mbuf *m, struct pf_pdesc *pd)
pf_scrub(struct pf_pdesc *pd)
{
struct ip *h = mtod(m, struct ip *);
struct ip *h = mtod(pd->m, struct ip *);
#ifdef INET6
struct ip6_hdr *h6 = mtod(m, struct ip6_hdr *);
struct ip6_hdr *h6 = mtod(pd->m, struct ip6_hdr *);
#endif
/* Clear IP_DF if no-df was requested */
sys/netpfil/pf/pf_osfp.c
+4 -5
View File
@@ -67,8 +67,7 @@ static struct pf_os_fingerprint *pf_osfp_validate(void);
* Returns the list of possible OSes.
*/
struct pf_osfp_enlist *
pf_osfp_fingerprint(struct pf_pdesc *pd, struct mbuf *m,
const struct tcphdr *tcp)
pf_osfp_fingerprint(struct pf_pdesc *pd, const struct tcphdr *tcp)
{
struct ip *ip = NULL;
struct ip6_hdr *ip6 = NULL;
@@ -79,14 +78,14 @@ pf_osfp_fingerprint(struct pf_pdesc *pd, struct mbuf *m,
switch (pd->af) {
case AF_INET:
ip = mtod(m, struct ip *);
ip = mtod(pd->m, struct ip *);
ip6 = (struct ip6_hdr *)NULL;
break;
case AF_INET6:
ip6 = mtod(m, struct ip6_hdr *);
ip6 = mtod(pd->m, struct ip6_hdr *);
break;
}
if (!pf_pull_hdr(m, pd->off, hdr, tcp->th_off << 2, NULL, NULL,
if (!pf_pull_hdr(pd->m, pd->off, hdr, tcp->th_off << 2, NULL, NULL,
pd->af)) return (NULL);
return (pf_osfp_fingerprint_hdr(ip, ip6, (struct tcphdr *)hdr));
sys/netpfil/pf/pf_syncookies.c
+6 -7
View File
@@ -119,8 +119,7 @@ void pf_syncookie_rotate(void *);
void pf_syncookie_newkey(void);
uint32_t pf_syncookie_mac(struct pf_pdesc *, union pf_syncookie,
uint32_t);
uint32_t pf_syncookie_generate(struct mbuf *m, struct pf_pdesc *,
uint16_t);
uint32_t pf_syncookie_generate(struct pf_pdesc *, uint16_t);
void
pf_syncookies_init(void)
@@ -290,13 +289,13 @@ pf_synflood_check(struct pf_pdesc *pd)
}
void
pf_syncookie_send(struct mbuf *m, struct pf_pdesc *pd)
pf_syncookie_send(struct pf_pdesc *pd)
{
uint16_t mss;
uint32_t iss;
mss = max(V_tcp_mssdflt, pf_get_mss(m, pd));
iss = pf_syncookie_generate(m, pd, mss);
mss = max(V_tcp_mssdflt, pf_get_mss(pd));
iss = pf_syncookie_generate(pd, mss);
pf_send_tcp(NULL, pd->af, pd->dst, pd->src, *pd->dport, *pd->sport,
iss, ntohl(pd->hdr.tcp.th_seq) + 1, TH_SYN|TH_ACK, 0, mss,
0, true, 0, 0, pd->act.rtableid);
@@ -457,7 +456,7 @@ pf_syncookie_mac(struct pf_pdesc *pd, union pf_syncookie cookie, uint32_t seq)
}
uint32_t
pf_syncookie_generate(struct mbuf *m, struct pf_pdesc *pd, uint16_t mss)
pf_syncookie_generate(struct pf_pdesc *pd, uint16_t mss)
{
uint8_t i, wscale;
uint32_t iss, hash;
@@ -474,7 +473,7 @@ pf_syncookie_generate(struct mbuf *m, struct pf_pdesc *pd, uint16_t mss)
cookie.flags.mss_idx = i;
/* map WSCALE */
wscale = pf_get_wscale(m, pd);
wscale = pf_get_wscale(pd);
for (i = nitems(pf_syncookie_wstab) - 1;
pf_syncookie_wstab[i] > wscale && i > 0; i--)
/* nada */;