D46649.diff
No OneTemporary
Actions

Size

23 KB

Referenced Files

None

Subscribers

None

D46649.diff
View Options

	diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h
	--- a/sys/net/pfvar.h
	+++ b/sys/net/pfvar.h
	@@ -2361,16 +2361,16 @@

	int pf_test_eth(int, int, struct ifnet , struct mbuf , struct inpcb );
	int pf_scan_sctp(struct mbuf , int, struct pf_pdesc , struct pfi_kkif *);
	-#ifdef INET
	-int pf_test(int, int, struct ifnet , struct mbuf , struct inpcb ,
	+#if defined(INET) \|\| defined(INET6)
	+int pf_test(sa_family_t, int, int, struct ifnet , struct mbuf , struct inpcb ,
	struct pf_rule_actions *);
	+#endif
	+#ifdef INET
	int pf_normalize_ip(struct mbuf *, struct pfi_kkif , u_short *,
	struct pf_pdesc *);
	#endif /* INET */

	#ifdef INET6
	-int pf_test6(int, int, struct ifnet , struct mbuf , struct inpcb ,
	- struct pf_rule_actions *);
	int pf_normalize_ip6(struct mbuf *, struct pfi_kkif , u_short *,
	struct pf_pdesc *);
	void pf_poolmask(struct pf_addr , struct pf_addr,
	diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
	--- a/sys/netpfil/pf/pf.c
	+++ b/sys/netpfil/pf/pf.c
	@@ -121,8 +121,6 @@
	SDT_PROVIDER_DEFINE(pf);
	SDT_PROBE_DEFINE4(pf, ip, test, done, "int", "int", "struct pf_krule *",
	"struct pf_kstate *");
	-SDT_PROBE_DEFINE4(pf, ip, test6, done, "int", "int", "struct pf_krule *",
	- "struct pf_kstate *");
	SDT_PROBE_DEFINE5(pf, ip, state, lookup, "struct pfi_kkif *",
	"struct pf_state_key_cmp ", "int", "struct pf_pdesc ",
	"struct pf_kstate *");
	@@ -585,6 +583,19 @@
	return (0);
	}

	+static bool
	+pf_is_loopback(sa_family_t af, struct pf_addr *addr)
	+{
	+ switch (af) {
	+ case AF_INET:
	+ return IN_LOOPBACK(ntohl(addr->v4.s_addr));
	+ case AF_INET6:
	+ return IN6_IS_ADDR_LOOPBACK(&addr->v6);
	+ default:
	+ panic("Unknown af %d", af);
	+ }
	+}
	+
	static void
	pf_packet_rework_nat(struct mbuf m, struct pf_pdesc pd, int off,
	struct pf_state_key *nk)
	@@ -7906,7 +7917,8 @@
	goto bad;

	if (pd->dir == PF_IN) {
	- if (pf_test(PF_OUT, PFIL_FWD, ifp, &m0, inp, &pd->act) != PF_PASS)
	+ if (pf_test(AF_INET, PF_OUT, PFIL_FWD, ifp, &m0, inp,
	+ &pd->act) != PF_PASS)
	goto bad;
	else if (m0 == NULL)
	goto done;
	@@ -8156,7 +8168,8 @@
	goto bad;

	if (pd->dir == PF_IN) {
	- if (pf_test6(PF_OUT, PFIL_FWD, ifp, &m0, inp, &pd->act) != PF_PASS)
	+ if (pf_test(AF_INET6, PF_OUT, PFIL_FWD, ifp, &m0, inp,
	+ &pd->act) != PF_PASS)
	goto bad;
	else if (m0 == NULL)
	goto done;
	@@ -8586,6 +8599,9 @@
	pd->tot_len = ntohs(h->ip_len);
	pd->act.rtableid = -1;

	+ if (h->ip_hl > 5) /* has options */
	+ pd->rh_cnt++;
	+
	/* fragments not reassembled handled later */
	if (h->ip_off & htons(IP_MF \| IP_OFFMASK))
	return (0);
	@@ -8756,6 +8772,7 @@
	*hdrlen = ICMP_MINLEN;
	break;
	}
	+#ifdef INET6
	case IPPROTO_ICMPV6: {
	size_t icmp_hlen = sizeof(struct icmp6_hdr);

	@@ -8786,6 +8803,7 @@
	*hdrlen = icmp_hlen;
	break;
	}
	+#endif
	}
	return (0);
	}
	@@ -8869,15 +8887,16 @@
	pf_counter_u64_critical_exit();
	}

	-#ifdef INET
	+#if defined(INET) \|\| defined(INET6)
	int
	-pf_test(int dir, int pflags, struct ifnet ifp, struct mbuf *m0,
	+pf_test(sa_family_t af, int dir, int pflags, struct ifnet ifp, struct mbuf *m0,
	struct inpcb inp, struct pf_rule_actions default_actions)
	{
	struct pfi_kkif *kif;
	u_short action, reason = 0;
	struct mbuf m = m0;
	struct ip *h = NULL;
	+ struct ip6_hdr *h6 = NULL;
	struct m_tag *mtag;
	struct pf_krule a = NULL, r = &V_pf_default_rule;
	struct pf_kstate *s = NULL;
	@@ -8886,6 +8905,7 @@
	int off, hdrlen, use_2nd_queue = 0;
	uint16_t tag;
	uint8_t rt;
	+ uint8_t ttl;

	PF_RULES_RLOCK_TRACKER;
	KASSERT(dir == PF_IN \|\| dir == PF_OUT, ("%s: bad direction %d\n", __func__, dir));
	@@ -8920,26 +8940,68 @@
	return (PF_DROP);
	}

	- if (__predict_false(m->m_len < sizeof(struct ip)) &&
	- (m = m0 = m_pullup(m0, sizeof(struct ip))) == NULL) {
	- DPFPRINTF(PF_DEBUG_URGENT,
	- ("pf_test: m_len < sizeof(struct ip), pullup failed\n"));
	- PF_RULES_RUNLOCK();
	- return (PF_DROP);
	- }
	-
	memset(&pd, 0, sizeof(pd));
	pd.dir = dir;

	- if (pf_normalize_ip(m0, kif, &reason, &pd) != PF_PASS) {
	+ switch (af) {
	+#ifdef INET
	+ case AF_INET:
	+ if (__predict_false(m->m_len < sizeof(struct ip)) &&
	+ (m = m0 = m_pullup(m0, sizeof(struct ip))) == NULL) {
	+ DPFPRINTF(PF_DEBUG_URGENT,
	+ ("pf_test: m_len < sizeof(struct ip), pullup failed\n"));
	+ PF_RULES_RUNLOCK();
	+ return (PF_DROP);
	+ }
	+
	+ if (pf_normalize_ip(m0, kif, &reason, &pd) != PF_PASS) {
	+ /* We do IP header normalization and packet reassembly here */
	+ action = PF_DROP;
	+ goto done;
	+ }
	+ m = m0; / pf_normalize messes with m0 */
	+ h = mtod(m, struct ip *);
	+ ttl = h->ip_ttl;
	+ break;
	+#endif
	+#ifdef INET6
	+ case AF_INET6:
	+ /*
	+ * If we end up changing IP addresses (e.g. binat) the stack may get
	+ * confused and fail to send the icmp6 packet too big error. Just send
	+ * it here, before we do any NAT.
	+ */
	+ if (dir == PF_OUT && pflags & PFIL_FWD && IN6_LINKMTU(ifp) < pf_max_frag_size(m)) {
	+ PF_RULES_RUNLOCK();
	+ *m0 = NULL;
	+ icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, IN6_LINKMTU(ifp));
	+ return (PF_DROP);
	+ }
	+
	+ if (__predict_false(m->m_len < sizeof(struct ip6_hdr)) &&
	+ (m = m0 = m_pullup(m0, sizeof(struct ip6_hdr))) == NULL) {
	+ DPFPRINTF(PF_DEBUG_URGENT,
	+ ("pf_test6: m_len < sizeof(struct ip6_hdr)"
	+ ", pullup failed\n"));
	+ PF_RULES_RUNLOCK();
	+ return (PF_DROP);
	+ }
	+
	/* We do IP header normalization and packet reassembly here */
	- action = PF_DROP;
	- goto done;
	+ if (pf_normalize_ip6(m0, kif, &reason, &pd) != PF_PASS) {
	+ action = PF_DROP;
	+ goto done;
	+ }
	+ m = m0; / pf_normalize messes with m0 */
	+ h6 = mtod(m, struct ip6_hdr *);
	+ ttl = h6->ip6_hlim;
	+ break;
	+#endif
	+ default:
	+ panic("Unknown af %d", af);
	}
	- m = m0; / pf_normalize messes with m0 */
	- h = mtod(m, struct ip *);

	- if (pf_setup_pdesc(AF_INET, dir, &pd, m, &action, &reason, kif, &a, &r,
	+ if (pf_setup_pdesc(af, dir, &pd, m, &action, &reason, kif, &a, &r,
	&ruleset, &off, &hdrlen, default_actions) == -1) {
	if (action != PF_PASS)
	pd.act.log \|= PF_LOG_FORCE;
	@@ -9000,15 +9062,35 @@
	m_tag_delete(m, mtag);
	}

	- /* handle fragments that didn't get reassembled by normalization */
	- if (h->ip_off & htons(IP_MF \| IP_OFFMASK)) {
	- action = pf_test_fragment(&r, kif, m, &pd, &a, &ruleset);
	- goto done;
	+ switch (af) {
	+#ifdef INET
	+ case AF_INET:
	+ /* handle fragments that didn't get reassembled by normalization */
	+ if (h->ip_off & htons(IP_MF \| IP_OFFMASK)) {
	+ action = pf_test_fragment(&r, kif, m, &pd, &a, &ruleset);
	+ goto done;
	+ }
	+ break;
	+#endif
	+#ifdef INET6
	+ case AF_INET6:
	+ /*
	+ * we do not support jumbogram. if we keep going, zero ip6_plen
	+ * will do something bad, so drop the packet for now.
	+ */
	+ if (htons(h6->ip6_plen) == 0) {
	+ action = PF_DROP;
	+ REASON_SET(&reason, PFRES_NORM); /XXX/
	+ goto done;
	+ }
	+ break;
	+#endif
	+ default:
	+ panic("Unknown af %d", af);
	}

	- switch (h->ip_p) {
	+ switch (pd.proto) {
	case IPPROTO_TCP: {
	-
	/* Respond to SYN with a syncookie. */
	if ((pd.hdr.tcp.th_flags & (TH_SYN\|TH_ACK\|TH_RST)) == TH_SYN &&
	pd.dir == PF_IN && pf_synflood_check(&pd)) {
	@@ -9036,14 +9118,14 @@
	pd.dir == PF_IN) {
	struct mbuf *msyn;

	- msyn = pf_syncookie_recreate_syn(h->ip_ttl, off,
	+ msyn = pf_syncookie_recreate_syn(ttl, off,
	&pd);
	if (msyn == NULL) {
	action = PF_DROP;
	break;
	}

	- action = pf_test(dir, pflags, ifp, &msyn, inp,
	+ action = pf_test(af, dir, pflags, ifp, &msyn, inp,
	&pd.act);
	m_freem(msyn);
	if (action != PF_PASS)
	@@ -9101,6 +9183,12 @@
	}

	case IPPROTO_ICMP: {
	+ if (af != AF_INET) {
	+ action = PF_DROP;
	+ DPFPRINTF(PF_DEBUG_MISC,
	+ ("dropping IPv6 packet with ICMPv4 payload"));
	+ goto done;
	+ }
	action = pf_test_state_icmp(&s, kif, m, off, &pd, &reason);
	if (action == PF_PASS) {
	if (V_pfsync_update_state_ptr != NULL)
	@@ -9114,10 +9202,22 @@
	}

	case IPPROTO_ICMPV6: {
	- action = PF_DROP;
	- DPFPRINTF(PF_DEBUG_MISC,
	- ("pf: dropping IPv4 packet with ICMPv6 payload\n"));
	- goto done;
	+ if (af != AF_INET6) {
	+ action = PF_DROP;
	+ DPFPRINTF(PF_DEBUG_MISC,
	+ ("pf: dropping IPv4 packet with ICMPv6 payload\n"));
	+ goto done;
	+ }
	+ action = pf_test_state_icmp(&s, kif, m, off, &pd, &reason);
	+ if (action == PF_PASS) {
	+ if (V_pfsync_update_state_ptr != NULL)
	+ V_pfsync_update_state_ptr(s);
	+ r = s->rule.ptr;
	+ a = s->anchor.ptr;
	+ } else if (s == NULL)
	+ action = pf_test_rule(&r, &s, kif, m, off, &pd,
	+ &a, &ruleset, inp, hdrlen);
	+ break;
	}

	default:
	@@ -9135,13 +9235,14 @@

	done:
	PF_RULES_RUNLOCK();
	- if (action == PF_PASS && h->ip_hl > 5 &&
	+
	+ if (action == PF_PASS && pd.rh_cnt &&
	!((s && s->state_flags & PFSTATE_ALLOWOPTS) \|\| r->allow_opts)) {
	action = PF_DROP;
	REASON_SET(&reason, PFRES_IPOPTIONS);
	pd.act.log = PF_LOG_FORCE;
	DPFPRINTF(PF_DEBUG_MISC,
	- ("pf: dropping packet with ip options\n"));
	+ ("pf: dropping packet with dangerous headers\n"));
	}

	if (s) {
	@@ -9193,7 +9294,10 @@
	else
	pd.pf_mtag->qid = pd.act.qid;
	/* Add hints for ecn. */
	- pd.pf_mtag->hdr = h;
	+ if (af == AF_INET)
	+ pd.pf_mtag->hdr = h;
	+ else
	+ pd.pf_mtag->hdr = h6;
	}
	}
	#endif /* ALTQ */
	@@ -9207,11 +9311,11 @@
	pd.proto == IPPROTO_UDP) && s != NULL && s->nat_rule.ptr != NULL &&
	(s->nat_rule.ptr->action == PF_RDR \|\|
	s->nat_rule.ptr->action == PF_BINAT) &&
	- IN_LOOPBACK(ntohl(pd.dst->v4.s_addr)))
	+ pf_is_loopback(af, pd.dst))
	m->m_flags \|= M_SKIP_FIREWALL;

	- if (__predict_false(ip_divert_ptr != NULL) && action == PF_PASS &&
	- r->divert.port && !PACKET_LOOPED(&pd)) {
	+ if (af == AF_INET && __predict_false(ip_divert_ptr != NULL) &&
	+ action == PF_PASS && r->divert.port && !PACKET_LOOPED(&pd)) {
	mtag = m_tag_alloc(MTAG_PF_DIVERT, 0,
	sizeof(struct pf_divert_mtag), M_NOWAIT \| M_ZERO);
	if (mtag != NULL) {
	@@ -9252,6 +9356,10 @@
	("pf: failed to allocate divert tag\n"));
	}
	}
	+ /* XXX: Anybody working on it?! */
	+ if (af == AF_INET6 && r->divert.port)
	+ printf("pf: divert(9) is not supported for IPv6\n");
	+
	/* this flag will need revising if the pkt is forwarded */
	if (pd.pf_mtag)
	pd.pf_mtag->flags &= ~PF_MTAG_FLAG_PACKET_LOOPED;
	@@ -9291,417 +9399,23 @@
	*m0 = NULL;
	break;
	default:
	- /* pf_route() returns unlocked. */
	if (rt) {
	- pf_route(m0, r, kif->pfik_ifp, s, &pd, inp);
	- goto out;
	- }
	- if (pf_dummynet(&pd, s, r, m0) != 0) {
	- action = PF_DROP;
	- REASON_SET(&reason, PFRES_MEMORY);
	- }
	- break;
	- }
	-
	- SDT_PROBE4(pf, ip, test, done, action, reason, r, s);
	-
	- if (s && action != PF_DROP) {
	- if (!s->if_index_in && dir == PF_IN)
	- s->if_index_in = ifp->if_index;
	- else if (!s->if_index_out && dir == PF_OUT)
	- s->if_index_out = ifp->if_index;
	- }
	-
	- if (s)
	- PF_STATE_UNLOCK(s);
	-
	-out:
	- pf_sctp_multihome_delayed(&pd, off, kif, s, action);
	-
	- return (action);
	-}
	-#endif /* INET */
	-
	+ switch (af) {
	+#ifdef INET
	+ case AF_INET:
	+ /* pf_route() returns unlocked. */
	+ pf_route(m0, r, kif->pfik_ifp, s, &pd, inp);
	+ break;
	+#endif
	#ifdef INET6
	-int
	-pf_test6(int dir, int pflags, struct ifnet ifp, struct mbuf m0, struct inpcb inp,
	- struct pf_rule_actions *default_actions)
	-{
	- struct pfi_kkif *kif;
	- u_short action, reason = 0;
	- struct mbuf m = m0, *n = NULL;
	- struct m_tag *mtag;
	- struct ip6_hdr *h = NULL;
	- struct pf_krule a = NULL, r = &V_pf_default_rule;
	- struct pf_kstate *s = NULL;
	- struct pf_kruleset *ruleset = NULL;
	- struct pf_pdesc pd;
	- int off, hdrlen, use_2nd_queue = 0;
	- uint16_t tag;
	- uint8_t rt;
	-
	- PF_RULES_RLOCK_TRACKER;
	- KASSERT(dir == PF_IN \|\| dir == PF_OUT, ("%s: bad direction %d\n", __func__, dir));
	- M_ASSERTPKTHDR(m);
	-
	- if (!V_pf_status.running)
	- return (PF_PASS);
	-
	- PF_RULES_RLOCK();
	-
	- kif = (struct pfi_kkif *)ifp->if_pf_kif;
	- if (__predict_false(kif == NULL)) {
	- DPFPRINTF(PF_DEBUG_URGENT,
	- ("pf_test6: kif == NULL, if_xname %s\n", ifp->if_xname));
	- PF_RULES_RUNLOCK();
	- return (PF_DROP);
	- }
	- if (kif->pfik_flags & PFI_IFLAG_SKIP) {
	- PF_RULES_RUNLOCK();
	- return (PF_PASS);
	- }
	-
	- if (m->m_flags & M_SKIP_FIREWALL) {
	- PF_RULES_RUNLOCK();
	- return (PF_PASS);
	- }
	-
	- /*
	- * If we end up changing IP addresses (e.g. binat) the stack may get
	- * confused and fail to send the icmp6 packet too big error. Just send
	- * it here, before we do any NAT.
	- */
	- if (dir == PF_OUT && pflags & PFIL_FWD && IN6_LINKMTU(ifp) < pf_max_frag_size(m)) {
	- PF_RULES_RUNLOCK();
	- *m0 = NULL;
	- icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, IN6_LINKMTU(ifp));
	- return (PF_DROP);
	- }
	-
	- if (__predict_false(! M_WRITABLE(*m0))) {
	- m = m0 = m_unshare(m0, M_NOWAIT);
	- if (*m0 == NULL)
	- return (PF_DROP);
	- }
	-
	- if (__predict_false(m->m_len < sizeof(struct ip6_hdr)) &&
	- (m = m0 = m_pullup(m0, sizeof(struct ip6_hdr))) == NULL) {
	- DPFPRINTF(PF_DEBUG_URGENT,
	- ("pf_test6: m_len < sizeof(struct ip6_hdr)"
	- ", pullup failed\n"));
	- PF_RULES_RUNLOCK();
	- return (PF_DROP);
	- }
	-
	- memset(&pd, 0, sizeof(pd));
	- pd.dir = dir;
	-
	- /* We do IP header normalization and packet reassembly here */
	- if (pf_normalize_ip6(m0, kif, &reason, &pd) != PF_PASS) {
	- action = PF_DROP;
	- goto done;
	- }
	- m = m0; / pf_normalize messes with m0 */
	- h = mtod(m, struct ip6_hdr *);
	- off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
	-
	- if (pf_setup_pdesc(AF_INET6, dir, &pd, m, &action, &reason, kif, &a, &r,
	- &ruleset, &off, &hdrlen, default_actions) == -1) {
	- if (action != PF_PASS)
	- pd.act.log \|= PF_LOG_FORCE;
	- goto done;
	- }
	-
	- if (pd.pf_mtag != NULL && (pd.pf_mtag->flags & PF_MTAG_FLAG_ROUTE_TO)) {
	- pd.pf_mtag->flags &= ~PF_MTAG_FLAG_ROUTE_TO;
	-
	- ifp = ifnet_byindexgen(pd.pf_mtag->if_index,
	- pd.pf_mtag->if_idxgen);
	- if (ifp == NULL \|\| ifp->if_flags & IFF_DYING) {
	- PF_RULES_RUNLOCK();
	- m_freem(*m0);
	- *m0 = NULL;
	- return (PF_PASS);
	- }
	- PF_RULES_RUNLOCK();
	- nd6_output_ifp(ifp, ifp, m,
	- (struct sockaddr_in6 *)&pd.pf_mtag->dst, NULL);
	- *m0 = NULL;
	- return (PF_PASS);
	- }
	-
	- if (ip_dn_io_ptr != NULL && pd.pf_mtag != NULL &&
	- pd.pf_mtag->flags & PF_MTAG_FLAG_DUMMYNET) {
	- pf_dummynet_flag_remove(m, pd.pf_mtag);
	- /* Dummynet re-injects packets after they've
	- * completed their delay. We've already
	- * processed them, so pass unconditionally. */
	- PF_RULES_RUNLOCK();
	- return (PF_PASS);
	- }
	-
	- /*
	- * we do not support jumbogram. if we keep going, zero ip6_plen
	- * will do something bad, so drop the packet for now.
	- */
	- if (htons(h->ip6_plen) == 0) {
	- action = PF_DROP;
	- REASON_SET(&reason, PFRES_NORM); /XXX/
	- goto done;
	- }
	-
	- /* if there's no routing header, use unmodified mbuf for checksumming */
	- if (!n)
	- n = m;
	-
	- switch (pd.proto) {
	- case IPPROTO_TCP: {
	- /* Respond to SYN with a syncookie. */
	- if ((pd.hdr.tcp.th_flags & (TH_SYN\|TH_ACK\|TH_RST)) == TH_SYN &&
	- pd.dir == PF_IN && pf_synflood_check(&pd)) {
	- pf_syncookie_send(m, off, &pd);
	- action = PF_DROP;
	- break;
	- }
	-
	- if ((pd.hdr.tcp.th_flags & TH_ACK) && pd.p_len == 0)
	- use_2nd_queue = 1;
	-
	- action = pf_normalize_tcp(kif, m, 0, off, &pd);
	- if (action == PF_DROP)
	- goto done;
	- action = pf_test_state_tcp(&s, kif, m, off, &pd, &reason);
	- if (action == PF_PASS) {
	- if (V_pfsync_update_state_ptr != NULL)
	- V_pfsync_update_state_ptr(s);
	- r = s->rule.ptr;
	- a = s->anchor.ptr;
	- } else if (s == NULL) {
	- /* Validate remote SYN\|ACK, re-create original SYN if
	- * valid. */
	- if ((pd.hdr.tcp.th_flags & (TH_SYN\|TH_ACK\|TH_RST)) ==
	- TH_ACK && pf_syncookie_validate(&pd) &&
	- pd.dir == PF_IN) {
	- struct mbuf *msyn;
	-
	- msyn = pf_syncookie_recreate_syn(h->ip6_hlim,
	- off, &pd);
	- if (msyn == NULL) {
	- action = PF_DROP;
	- break;
	- }
	-
	- action = pf_test6(dir, pflags, ifp, &msyn, inp,
	- &pd.act);
	- m_freem(msyn);
	- if (action != PF_PASS)
	- break;
	-
	- action = pf_test_state_tcp(&s, kif, m, off,
	- &pd, &reason);
	- if (action != PF_PASS \|\| s == NULL) {
	- action = PF_DROP;
	- break;
	- }
	-
	- s->src.seqhi = ntohl(pd.hdr.tcp.th_ack) - 1;
	- s->src.seqlo = ntohl(pd.hdr.tcp.th_seq) - 1;
	- pf_set_protostate(s, PF_PEER_SRC, PF_TCPS_PROXY_DST);
	-
	- action = pf_synproxy(&pd, &s, &reason);
	+ case AF_INET6:
	+ /* pf_route6() returns unlocked. */
	+ pf_route6(m0, r, kif->pfik_ifp, s, &pd, inp);
	break;
	- } else {
	- action = pf_test_rule(&r, &s, kif, m, off, &pd,
	- &a, &ruleset, inp, hdrlen);
	+#endif
	+ default:
	+ panic("Unknown af %d", af);
	}
	- }
	- break;
	- }
	-
	- case IPPROTO_UDP: {
	- action = pf_test_state_udp(&s, kif, m, off, &pd);
	- if (action == PF_PASS) {
	- if (V_pfsync_update_state_ptr != NULL)
	- V_pfsync_update_state_ptr(s);
	- r = s->rule.ptr;
	- a = s->anchor.ptr;
	- } else if (s == NULL)
	- action = pf_test_rule(&r, &s, kif, m, off, &pd,
	- &a, &ruleset, inp, hdrlen);
	- break;
	- }
	-
	- case IPPROTO_SCTP: {
	- action = pf_normalize_sctp(dir, kif, m, 0, off, &pd);
	- if (action == PF_DROP)
	- goto done;
	- action = pf_test_state_sctp(&s, kif, m, off, &pd,
	- &reason);
	- if (action == PF_PASS) {
	- if (V_pfsync_update_state_ptr != NULL)
	- V_pfsync_update_state_ptr(s);
	- r = s->rule.ptr;
	- a = s->anchor.ptr;
	- } else if (s == NULL) {
	- action = pf_test_rule(&r, &s, kif, m, off,
	- &pd, &a, &ruleset, inp, hdrlen);
	- }
	- break;
	- }
	-
	- case IPPROTO_ICMP: {
	- action = PF_DROP;
	- DPFPRINTF(PF_DEBUG_MISC,
	- ("pf: dropping IPv6 packet with ICMPv4 payload\n"));
	- goto done;
	- }
	-
	- case IPPROTO_ICMPV6: {
	- action = pf_test_state_icmp(&s, kif, m, off, &pd, &reason);
	- if (action == PF_PASS) {
	- if (V_pfsync_update_state_ptr != NULL)
	- V_pfsync_update_state_ptr(s);
	- r = s->rule.ptr;
	- a = s->anchor.ptr;
	- } else if (s == NULL)
	- action = pf_test_rule(&r, &s, kif, m, off, &pd,
	- &a, &ruleset, inp, hdrlen);
	- break;
	- }
	-
	- default:
	- action = pf_test_state_other(&s, kif, m, &pd);
	- if (action == PF_PASS) {
	- if (V_pfsync_update_state_ptr != NULL)
	- V_pfsync_update_state_ptr(s);
	- r = s->rule.ptr;
	- a = s->anchor.ptr;
	- } else if (s == NULL)
	- action = pf_test_rule(&r, &s, kif, m, off, &pd,
	- &a, &ruleset, inp, hdrlen);
	- break;
	- }
	-
	-done:
	- PF_RULES_RUNLOCK();
	- if (n != m) {
	- m_freem(n);
	- n = NULL;
	- }
	-
	- /* handle dangerous IPv6 extension headers. */
	- if (action == PF_PASS && pd.rh_cnt &&
	- !((s && s->state_flags & PFSTATE_ALLOWOPTS) \|\| r->allow_opts)) {
	- action = PF_DROP;
	- REASON_SET(&reason, PFRES_IPOPTIONS);
	- pd.act.log = r->log;
	- DPFPRINTF(PF_DEBUG_MISC,
	- ("pf: dropping packet with dangerous v6 headers\n"));
	- }
	-
	- if (s) {
	- uint8_t log = pd.act.log;
	- memcpy(&pd.act, &s->act, sizeof(struct pf_rule_actions));
	- pd.act.log \|= log;
	- tag = s->tag;
	- rt = s->rt;
	- } else {
	- tag = r->tag;
	- rt = r->rt;
	- }
	-
	- if (tag > 0 && pf_tag_packet(m, &pd, tag)) {
	- action = PF_DROP;
	- REASON_SET(&reason, PFRES_MEMORY);
	- }
	-
	- pf_scrub(m, &pd);
	- if (pd.proto == IPPROTO_TCP && pd.act.max_mss)
	- pf_normalize_mss(m, off, &pd);
	-
	- if (pd.act.rtableid >= 0)
	- M_SETFIB(m, pd.act.rtableid);
	-
	- if (pd.act.flags & PFSTATE_SETPRIO) {
	- if (pd.tos & IPTOS_LOWDELAY)
	- use_2nd_queue = 1;
	- if (vlan_set_pcp(m, pd.act.set_prio[use_2nd_queue])) {
	- action = PF_DROP;
	- REASON_SET(&reason, PFRES_MEMORY);
	- pd.act.log = PF_LOG_FORCE;
	- DPFPRINTF(PF_DEBUG_MISC,
	- ("pf: failed to allocate 802.1q mtag\n"));
	- }
	- }
	-
	-#ifdef ALTQ
	- if (action == PF_PASS && pd.act.qid) {
	- if (pd.pf_mtag == NULL &&
	- ((pd.pf_mtag = pf_get_mtag(m)) == NULL)) {
	- action = PF_DROP;
	- REASON_SET(&reason, PFRES_MEMORY);
	- } else {
	- if (s != NULL)
	- pd.pf_mtag->qid_hash = pf_state_hash(s);
	- if (use_2nd_queue \|\| (pd.tos & IPTOS_LOWDELAY))
	- pd.pf_mtag->qid = pd.act.pqid;
	- else
	- pd.pf_mtag->qid = pd.act.qid;
	- /* Add hints for ecn. */
	- pd.pf_mtag->hdr = h;
	- }
	- }
	-#endif /* ALTQ */
	-
	- if (dir == PF_IN && action == PF_PASS && (pd.proto == IPPROTO_TCP \|\|
	- pd.proto == IPPROTO_UDP) && s != NULL && s->nat_rule.ptr != NULL &&
	- (s->nat_rule.ptr->action == PF_RDR \|\|
	- s->nat_rule.ptr->action == PF_BINAT) &&
	- IN6_IS_ADDR_LOOPBACK(&pd.dst->v6))
	- m->m_flags \|= M_SKIP_FIREWALL;
	-
	- /* XXX: Anybody working on it?! */
	- if (r->divert.port)
	- printf("pf: divert(9) is not supported for IPv6\n");
	-
	- if (pd.act.log) {
	- struct pf_krule *lr;
	- struct pf_krule_item *ri;
	-
	- if (s != NULL && s->nat_rule.ptr != NULL &&
	- s->nat_rule.ptr->log & PF_LOG_ALL)
	- lr = s->nat_rule.ptr;
	- else
	- lr = r;
	-
	- if (pd.act.log & PF_LOG_FORCE \|\| lr->log & PF_LOG_ALL)
	- PFLOG_PACKET(kif, m, action, reason, lr, a, ruleset,
	- &pd, (s == NULL));
	- if (s) {
	- SLIST_FOREACH(ri, &s->match_rules, entry)
	- if (ri->r->log & PF_LOG_ALL)
	- PFLOG_PACKET(kif, m, action, reason,
	- ri->r, a, ruleset, &pd, 0);
	- }
	- }
	-
	- pf_counters_inc(action, &pd, kif, s, r, a);
	-
	- switch (action) {
	- case PF_SYNPROXY_DROP:
	- m_freem(*m0);
	- case PF_DEFER:
	- *m0 = NULL;
	- action = PF_PASS;
	- break;
	- case PF_DROP:
	- m_freem(*m0);
	- *m0 = NULL;
	- break;
	- default:
	- /* pf_route6() returns unlocked. */
	- if (rt) {
	- pf_route6(m0, r, kif->pfik_ifp, s, &pd, inp);
	goto out;
	}
	if (pf_dummynet(&pd, s, r, m0) != 0) {
	@@ -9711,6 +9425,8 @@
	break;
	}

	+ SDT_PROBE4(pf, ip, test, done, action, reason, r, s);
	+
	if (s && action != PF_DROP) {
	if (!s->if_index_in && dir == PF_IN)
	s->if_index_in = ifp->if_index;
	@@ -9721,16 +9437,16 @@
	if (s)
	PF_STATE_UNLOCK(s);

	+#ifdef INET6
	/* If reassembled packet passed, create new fragments. */
	- if (action == PF_PASS && *m0 && dir == PF_OUT &&
	+ if (af == AF_INET6 && action == PF_PASS && *m0 && dir == PF_OUT &&
	(mtag = m_tag_find(m, PACKET_TAG_PF_REASSEMBLED, NULL)) != NULL)
	action = pf_refragment6(ifp, m0, mtag, pflags & PFIL_FWD);
	+#endif

	out:
	- SDT_PROBE4(pf, ip, test6, done, action, reason, r, s);
	-
	pf_sctp_multihome_delayed(&pd, off, kif, s, action);

	return (action);
	}
	-#endif /* INET6 */
	+#endif /* INET \|\| INET6 */
	diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c
	--- a/sys/netpfil/pf/pf_ioctl.c
	+++ b/sys/netpfil/pf/pf_ioctl.c
	@@ -6471,7 +6471,7 @@

	CURVNET_ASSERT_SET();

	- chk = pf_test(PF_IN, flags, ifp, m, inp, NULL);
	+ chk = pf_test(AF_INET, PF_IN, flags, ifp, m, inp, NULL);

	return (pf_check_return(chk, m));
	}
	@@ -6484,7 +6484,7 @@

	CURVNET_ASSERT_SET();

	- chk = pf_test(PF_OUT, flags, ifp, m, inp, NULL);
	+ chk = pf_test(AF_INET, PF_OUT, flags, ifp, m, inp, NULL);

	return (pf_check_return(chk, m));
	}
	@@ -6504,7 +6504,7 @@
	* order to support scoped addresses. In order to support stateful
	* filtering we have change this to lo0 as it is the case in IPv4.
	*/
	- chk = pf_test6(PF_IN, flags, (*m)->m_flags & M_LOOP ? V_loif : ifp,
	+ chk = pf_test(AF_INET6, PF_IN, flags, (*m)->m_flags & M_LOOP ? V_loif : ifp,
	m, inp, NULL);

	return (pf_check_return(chk, m));
	@@ -6518,7 +6518,7 @@

	CURVNET_ASSERT_SET();

	- chk = pf_test6(PF_OUT, flags, ifp, m, inp, NULL);
	+ chk = pf_test(AF_INET6, PF_OUT, flags, ifp, m, inp, NULL);

	return (pf_check_return(chk, m));
	}

File Metadata

Mime Type: text/plain
Expires: Mon, Sep 23, 12:52 PM (6 h, 13 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 12541434
Default Alt Text: D46649.diff (23 KB)

D46649.diffNo OneTemporaryActions

D46649.diffView Options

File Metadata

Event Timeline

D46649.diff
No OneTemporary
Actions

D46649.diff
View Options