diff options
Diffstat (limited to 'sys/contrib/pf/net/pf_subr.c')
| -rw-r--r-- | sys/contrib/pf/net/pf_subr.c | 197 |
1 files changed, 119 insertions, 78 deletions
diff --git a/sys/contrib/pf/net/pf_subr.c b/sys/contrib/pf/net/pf_subr.c index 3de2924..f8930b8 100644 --- a/sys/contrib/pf/net/pf_subr.c +++ b/sys/contrib/pf/net/pf_subr.c @@ -1,15 +1,6 @@ -/* $FreeBSD$ */ -/* from $OpenBSD: kern_subr.c,v 1.26 2003/10/31 11:10:41 markus Exp $ */ -/* $NetBSD: kern_subr.c,v 1.15 1996/04/09 17:21:56 ragge Exp $ */ - -/* - * Copyright (c) 1982, 1986, 1991, 1993 +/*- + * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995 * The Regents of the University of California. All rights reserved. - * (c) UNIX System Laboratories, Inc. - * All or some portions of this file are derived from material licensed - * to the University of California by American Telephone and Telegraph - * Co. or Unix System Laboratories, Inc. and are reproduced herein with - * the permission of UNIX System Laboratories, Inc. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions @@ -19,7 +10,7 @@ * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. - * 3. Neither the name of the University nor the names of its contributors + * 4. Neither the name of the University nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. * @@ -35,93 +26,143 @@ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * - * @(#)kern_subr.c 8.3 (Berkeley) 1/21/94 */ +#include "opt_inet.h" +#include "opt_inet6.h" + +#include <sys/cdefs.h> +__FBSDID("$FreeBSD$"); + #include <sys/param.h> -#include <sys/systm.h> +#include <sys/kernel.h> +#include <sys/libkern.h> +#include <sys/mbuf.h> +#include <sys/md5.h> +#include <sys/time.h> +#include <sys/random.h> #include <sys/socket.h> #include <sys/socketvar.h> -#include <sys/proc.h> -#include <sys/malloc.h> -#include <sys/queue.h> -#include <sys/kernel.h> -#include <sys/resourcevar.h> +#include <sys/systm.h> +#include <sys/time.h> #include <net/if.h> +#include <net/if_types.h> +#include <net/bpf.h> +#include <net/route.h> #include <netinet/in.h> #include <netinet/in_var.h> - +#include <netinet/in_systm.h> +#include <netinet/ip.h> +#include <netinet/ip_var.h> +#include <netinet/tcp.h> +#include <netinet/tcp_seq.h> +#include <netinet/udp.h> +#include <netinet/ip_icmp.h> +#include <netinet/in_pcb.h> +#include <netinet/tcp_timer.h> +#include <netinet/tcp_var.h> +#include <netinet/if_ether.h> #include <net/pfvar.h> /* - * This implements additional functions used by pf which can not be ported - * easyly. At this point it boils down to mostly the Net/OpenBSD hook - * implementation. + * Following is where TCP initial sequence number generation occurs. + * + * There are two places where we must use initial sequence numbers: + * 1. In SYN-ACK packets. + * 2. In SYN packets. + * + * All ISNs for SYN-ACK packets are generated by the syncache. See + * tcp_syncache.c for details. + * + * The ISNs in SYN packets must be monotonic; TIME_WAIT recycling + * depends on this property. In addition, these ISNs should be + * unguessable so as to prevent connection hijacking. To satisfy + * the requirements of this situation, the algorithm outlined in + * RFC 1948 is used, with only small modifications. + * + * Implementation details: + * + * Time is based off the system timer, and is corrected so that it + * increases by one megabyte per second. This allows for proper + * recycling on high speed LANs while still leaving over an hour + * before rollover. + * + * As reading the *exact* system time is too expensive to be done + * whenever setting up a TCP connection, we increment the time + * offset in two ways. First, a small random positive increment + * is added to isn_offset for each connection that is set up. + * Second, the function tcp_isn_tick fires once per clock tick + * and increments isn_offset as necessary so that sequence numbers + * are incremented at approximately ISN_BYTES_PER_SECOND. The + * random positive increments serve only to ensure that the same + * exact sequence number is never sent out twice (as could otherwise + * happen when a port is recycled in less than the system tick + * interval.) * - * BEWARE: this is not locked! Required locking is done by the caller. + * net.inet.tcp.isn_reseed_interval controls the number of seconds + * between seeding of isn_secret. This is normally set to zero, + * as reseeding should not be necessary. + * + * Locking of the global variables isn_secret, isn_last_reseed, isn_offset, + * isn_offset_old, and isn_ctx is performed using the TCP pcbinfo lock. In + * general, this means holding an exclusive (write) lock. */ -void * -hook_establish(struct hook_desc_head *head, int tail, void (*fn)(void *), - void *arg) -{ - struct hook_desc *hdp; - - hdp = (struct hook_desc *)malloc(sizeof (*hdp), M_DEVBUF, M_NOWAIT); - if (hdp == NULL) - return (NULL); - - hdp->hd_fn = fn; - hdp->hd_arg = arg; - if (tail) - TAILQ_INSERT_TAIL(head, hdp, hd_list); - else - TAILQ_INSERT_HEAD(head, hdp, hd_list); +#define ISN_BYTES_PER_SECOND 1048576 +#define ISN_STATIC_INCREMENT 4096 +#define ISN_RANDOM_INCREMENT (4096 - 1) - return (hdp); -} +static u_char isn_secret[32]; +static int isn_last_reseed; +static u_int32_t isn_offset, isn_offset_old; +static MD5_CTX isn_ctx; -void -hook_disestablish(struct hook_desc_head *head, void *vhook) +u_int32_t +pf_new_isn(struct pf_state *s) { - struct hook_desc *hdp; - -#ifdef DIAGNOSTIC - for (hdp = TAILQ_FIRST(head); hdp != NULL; - hdp = TAILQ_NEXT(hdp, hd_list)) - if (hdp == vhook) - break; - if (hdp == NULL) - panic("hook_disestablish: hook not established"); -#endif - hdp = vhook; - TAILQ_REMOVE(head, hdp, hd_list); - free(hdp, M_DEVBUF); -} + u_int32_t md5_buffer[4]; + u_int32_t new_isn; + struct pf_state_host *src, *dst; -/* - * Run hooks. Startup hooks are invoked right after scheduler_start but - * before root is mounted. Shutdown hooks are invoked immediately before the - * system is halted or rebooted, i.e. after file systems unmounted, - * after crash dump done, etc. - */ -void -dohooks(struct hook_desc_head *head, int flags) -{ - struct hook_desc *hdp; + /* Seed if this is the first use, reseed if requested. */ + if (isn_last_reseed == 0) { + read_random(&isn_secret, sizeof(isn_secret)); + isn_last_reseed = ticks; + } - if ((flags & HOOK_REMOVE) == 0) { - TAILQ_FOREACH(hdp, head, hd_list) { - (*hdp->hd_fn)(hdp->hd_arg); - } + if (s->direction == PF_IN) { + src = &s->ext; + dst = &s->gwy; } else { - while ((hdp = TAILQ_FIRST(head)) != NULL) { - TAILQ_REMOVE(head, hdp, hd_list); - (*hdp->hd_fn)(hdp->hd_arg); - if ((flags & HOOK_FREE) != 0) - free(hdp, M_DEVBUF); - } + src = &s->lan; + dst = &s->ext; + } + + /* Compute the md5 hash and return the ISN. */ + MD5Init(&isn_ctx); + MD5Update(&isn_ctx, (u_char *) &dst->port, sizeof(u_short)); + MD5Update(&isn_ctx, (u_char *) &src->port, sizeof(u_short)); +#ifdef INET6 + if (s->af == AF_INET6) { + MD5Update(&isn_ctx, (u_char *) &dst->addr, + sizeof(struct in6_addr)); + MD5Update(&isn_ctx, (u_char *) &src->addr, + sizeof(struct in6_addr)); + } else +#endif + { + MD5Update(&isn_ctx, (u_char *) &dst->addr, + sizeof(struct in_addr)); + MD5Update(&isn_ctx, (u_char *) &src->addr, + sizeof(struct in_addr)); } + MD5Update(&isn_ctx, (u_char *) &isn_secret, sizeof(isn_secret)); + MD5Final((u_char *) &md5_buffer, &isn_ctx); + new_isn = (tcp_seq) md5_buffer[0]; + isn_offset += ISN_STATIC_INCREMENT + + (arc4random() & ISN_RANDOM_INCREMENT); + new_isn += isn_offset; + return (new_isn); } |
