?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Expand PMF_FN_* macros.
[netbsd-mini2440.git] / dist / ipf / ip_sync.c
blobcb72b30891ea27d86f3a856eebc1e05959a87f42
1 /* $NetBSD$ */
2
3 /*
4 * Copyright (C) 1995-1998 by Darren Reed.
5 *
6 * See the IPFILTER.LICENCE file for details on licencing.
7 */
8 #if defined(KERNEL) || defined(_KERNEL)
9 # undef KERNEL
10 # undef _KERNEL
11 # define KERNEL 1
12 # define _KERNEL 1
13 #endif
14 #include <sys/errno.h>
15 #include <sys/types.h>
16 #include <sys/param.h>
17 #include <sys/file.h>
18 #if !defined(_KERNEL) && !defined(__KERNEL__)
19 # include <stdio.h>
20 # include <stdlib.h>
21 # include <string.h>
22 # define _KERNEL
23 # define KERNEL
24 # ifdef __OpenBSD__
25 struct file;
26 # endif
27 # include <sys/uio.h>
28 # undef _KERNEL
29 # undef KERNEL
30 #else
31 # include <sys/systm.h>
32 # if !defined(__SVR4) && !defined(__svr4__)
33 # include <sys/mbuf.h>
34 # endif
35 # include <sys/select.h>
36 # if __FreeBSD_version >= 500000
37 # include <sys/selinfo.h>
38 # endif
39 #endif
40 #if defined(__NetBSD__) && (__NetBSD_Version__ >= 104000000)
41 # include <sys/proc.h>
42 #endif
43 #if defined(_KERNEL) && (__FreeBSD_version >= 220000)
44 # include <sys/filio.h>
45 # include <sys/fcntl.h>
46 # if (__FreeBSD_version >= 300000) && !defined(IPFILTER_LKM)
47 # include "opt_ipfilter.h"
48 # endif
49 #else
50 # include <sys/ioctl.h>
51 #endif
52 #include <sys/time.h>
53 #if !defined(linux)
54 # include <sys/protosw.h>
55 #endif
56 #include <sys/socket.h>
57 #if defined(__SVR4) || defined(__svr4__)
58 # include <sys/filio.h>
59 # include <sys/byteorder.h>
60 # ifdef _KERNEL
61 # include <sys/dditypes.h>
62 # endif
63 # include <sys/stream.h>
64 # include <sys/kmem.h>
65 #endif
66
67 #include <net/if.h>
68 #ifdef sun
69 # include <net/af.h>
70 #endif
71 #include <netinet/in.h>
72 #include <netinet/in_systm.h>
73 #include <netinet/ip.h>
74 #include <netinet/tcp.h>
75 #if !defined(linux)
76 # include <netinet/ip_var.h>
77 #endif
78 #if !defined(__hpux) && !defined(linux)
79 # include <netinet/tcp_fsm.h>
80 #endif
81 #include <netinet/udp.h>
82 #include <netinet/ip_icmp.h>
83 #include "netinet/ip_compat.h"
84 #include <netinet/tcpip.h>
85 #include "netinet/ip_fil.h"
86 #include "netinet/ip_nat.h"
87 #include "netinet/ip_frag.h"
88 #include "netinet/ip_state.h"
89 #include "netinet/ip_proxy.h"
90 #include "netinet/ip_sync.h"
91 #ifdef USE_INET6
92 #include <netinet/icmp6.h>
93 #endif
94 #if (__FreeBSD_version >= 300000)
95 # include <sys/malloc.h>
96 # if defined(_KERNEL) && !defined(IPFILTER_LKM)
97 # include <sys/libkern.h>
98 # include <sys/systm.h>
99 # endif
100 #endif
101 /* END OF INCLUDES */
102
103 #if !defined(lint)
104 static const char rcsid[] = "@(#)Id: ip_sync.c,v 2.40.2.16 2009/01/27 08:33:23 darrenr Exp";
105 #endif
106
107 #define SYNC_STATETABSZ 256
108 #define SYNC_NATTABSZ 256
109
110 #ifdef IPFILTER_SYNC
111 # if SOLARIS && defined(_KERNEL)
112 extern struct pollhead iplpollhead[IPL_LOGSIZE];
113 # endif
114
115 ipfmutex_t ipf_syncadd, ipsl_mutex;
116 ipfrwlock_t ipf_syncstate, ipf_syncnat;
117 #if SOLARIS && defined(_KERNEL)
118 kcondvar_t ipslwait;
119 #endif
120 synclist_t *syncstatetab[SYNC_STATETABSZ];
121 synclist_t *syncnattab[SYNC_NATTABSZ];
122 synclogent_t synclog[SYNCLOG_SZ];
123 syncupdent_t syncupd[SYNCLOG_SZ];
124 u_int ipf_syncnum = 1;
125 u_int ipf_syncwrap = 0;
126 u_int sl_idx = 0, /* next available sync log entry */
127 su_idx = 0, /* next available sync update entry */
128 sl_tail = 0, /* next sync log entry to read */
129 su_tail = 0; /* next sync update entry to read */
130 int ipf_sync_debug = 0;
131
132
133 # if !defined(sparc) && !defined(__hppa)
134 void ipfsync_tcporder __P((int, struct tcpdata *));
135 void ipfsync_natorder __P((int, struct nat *));
136 void ipfsync_storder __P((int, struct ipstate *));
137 # endif
138
139
140 /* ------------------------------------------------------------------------ */
141 /* Function: ipfsync_init */
142 /* Returns: int - 0 == success, -1 == failure */
143 /* Parameters: Nil */
144 /* */
145 /* Initialise all of the locks required for the sync code and initialise */
146 /* any data structures, as required. */
147 /* ------------------------------------------------------------------------ */
148 int ipfsync_init()
149 {
150 RWLOCK_INIT(&ipf_syncstate, "add things to state sync table");
151 RWLOCK_INIT(&ipf_syncnat, "add things to nat sync table");
152 MUTEX_INIT(&ipf_syncadd, "add things to sync table");
153 MUTEX_INIT(&ipsl_mutex, "add things to sync table");
154 # if SOLARIS && defined(_KERNEL)
155 cv_init(&ipslwait, "ipsl condvar", CV_DRIVER, NULL);
156 # endif
157
158 bzero((char *)syncnattab, sizeof(syncnattab));
159 bzero((char *)syncstatetab, sizeof(syncstatetab));
160
161 return 0;
162 }
163
164
165 # if !defined(sparc) && !defined(__hppa)
166 /* ------------------------------------------------------------------------ */
167 /* Function: ipfsync_tcporder */
168 /* Returns: Nil */
169 /* Parameters: way(I) - direction of byte order conversion. */
170 /* td(IO) - pointer to data to be converted. */
171 /* */
172 /* Do byte swapping on values in the TCP state information structure that */
173 /* need to be used at both ends by the host in their native byte order. */
174 /* ------------------------------------------------------------------------ */
175 void ipfsync_tcporder(way, td)
176 int way;
177 tcpdata_t *td;
178 {
179 if (way) {
180 td->td_maxwin = htons(td->td_maxwin);
181 td->td_end = htonl(td->td_end);
182 td->td_maxend = htonl(td->td_maxend);
183 } else {
184 td->td_maxwin = ntohs(td->td_maxwin);
185 td->td_end = ntohl(td->td_end);
186 td->td_maxend = ntohl(td->td_maxend);
187 }
188 }
189
190
191 /* ------------------------------------------------------------------------ */
192 /* Function: ipfsync_natorder */
193 /* Returns: Nil */
194 /* Parameters: way(I) - direction of byte order conversion. */
195 /* nat(IO) - pointer to data to be converted. */
196 /* */
197 /* Do byte swapping on values in the NAT data structure that need to be */
198 /* used at both ends by the host in their native byte order. */
199 /* ------------------------------------------------------------------------ */
200 void ipfsync_natorder(way, n)
201 int way;
202 nat_t *n;
203 {
204 if (way) {
205 n->nat_age = htonl(n->nat_age);
206 n->nat_flags = htonl(n->nat_flags);
207 n->nat_ipsumd = htonl(n->nat_ipsumd);
208 n->nat_use = htonl(n->nat_use);
209 n->nat_dir = htonl(n->nat_dir);
210 } else {
211 n->nat_age = ntohl(n->nat_age);
212 n->nat_flags = ntohl(n->nat_flags);
213 n->nat_ipsumd = ntohl(n->nat_ipsumd);
214 n->nat_use = ntohl(n->nat_use);
215 n->nat_dir = ntohl(n->nat_dir);
216 }
217 }
218
219
220 /* ------------------------------------------------------------------------ */
221 /* Function: ipfsync_storder */
222 /* Returns: Nil */
223 /* Parameters: way(I) - direction of byte order conversion. */
224 /* ips(IO) - pointer to data to be converted. */
225 /* */
226 /* Do byte swapping on values in the IP state data structure that need to */
227 /* be used at both ends by the host in their native byte order. */
228 /* ------------------------------------------------------------------------ */
229 void ipfsync_storder(way, ips)
230 int way;
231 ipstate_t *ips;
232 {
233 ipfsync_tcporder(way, &ips->is_tcp.ts_data[0]);
234 ipfsync_tcporder(way, &ips->is_tcp.ts_data[1]);
235
236 if (way) {
237 ips->is_hv = htonl(ips->is_hv);
238 ips->is_die = htonl(ips->is_die);
239 ips->is_pass = htonl(ips->is_pass);
240 ips->is_flags = htonl(ips->is_flags);
241 ips->is_opt[0] = htonl(ips->is_opt[0]);
242 ips->is_opt[1] = htonl(ips->is_opt[1]);
243 ips->is_optmsk[0] = htonl(ips->is_optmsk[0]);
244 ips->is_optmsk[1] = htonl(ips->is_optmsk[1]);
245 ips->is_sec = htons(ips->is_sec);
246 ips->is_secmsk = htons(ips->is_secmsk);
247 ips->is_auth = htons(ips->is_auth);
248 ips->is_authmsk = htons(ips->is_authmsk);
249 ips->is_s0[0] = htonl(ips->is_s0[0]);
250 ips->is_s0[1] = htonl(ips->is_s0[1]);
251 ips->is_smsk[0] = htons(ips->is_smsk[0]);
252 ips->is_smsk[1] = htons(ips->is_smsk[1]);
253 } else {
254 ips->is_hv = ntohl(ips->is_hv);
255 ips->is_die = ntohl(ips->is_die);
256 ips->is_pass = ntohl(ips->is_pass);
257 ips->is_flags = ntohl(ips->is_flags);
258 ips->is_opt[0] = ntohl(ips->is_opt[0]);
259 ips->is_opt[1] = ntohl(ips->is_opt[1]);
260 ips->is_optmsk[0] = ntohl(ips->is_optmsk[0]);
261 ips->is_optmsk[1] = ntohl(ips->is_optmsk[1]);
262 ips->is_sec = ntohs(ips->is_sec);
263 ips->is_secmsk = ntohs(ips->is_secmsk);
264 ips->is_auth = ntohs(ips->is_auth);
265 ips->is_authmsk = ntohs(ips->is_authmsk);
266 ips->is_s0[0] = ntohl(ips->is_s0[0]);
267 ips->is_s0[1] = ntohl(ips->is_s0[1]);
268 ips->is_smsk[0] = ntohl(ips->is_smsk[0]);
269 ips->is_smsk[1] = ntohl(ips->is_smsk[1]);
270 }
271 }
272 # else /* !defined(sparc) && !defined(__hppa) */
273 # define ipfsync_tcporder(x,y)
274 # define ipfsync_natorder(x,y)
275 # define ipfsync_storder(x,y)
276 # endif /* !defined(sparc) && !defined(__hppa) */
277
278 /* enable this for debugging */
279
280 # ifdef _KERNEL
281 /* ------------------------------------------------------------------------ */
282 /* Function: ipfsync_write */
283 /* Returns: int - 0 == success, else error value. */
284 /* Parameters: uio(I) - pointer to information about data to write */
285 /* */
286 /* Moves data from user space into the kernel and uses it for updating data */
287 /* structures in the state/NAT tables. */
288 /* ------------------------------------------------------------------------ */
289 int ipfsync_write(uio)
290 struct uio *uio;
291 {
292 synchdr_t sh;
293
294 /*
295 * THIS MUST BE SUFFICIENT LARGE TO STORE
296 * ANY POSSIBLE DATA TYPE
297 */
298 char data[2048];
299
300 int err = 0;
301
302 # if (BSD >= 199306) || defined(__FreeBSD__) || defined(__osf__)
303 uio->uio_rw = UIO_WRITE;
304 # endif
305
306 /* Try to get bytes */
307 while (uio->uio_resid > 0) {
308
309 if (uio->uio_resid >= sizeof(sh)) {
310
311 err = UIOMOVE(&sh, sizeof(sh), UIO_WRITE, uio);
312
313 if (err) {
314 if (ipf_sync_debug > 2)
315 printf("uiomove(header) failed: %d\n",
316 err);
317 return err;
318 }
319
320 /* convert to host order */
321 sh.sm_magic = ntohl(sh.sm_magic);
322 sh.sm_len = ntohl(sh.sm_len);
323 sh.sm_num = ntohl(sh.sm_num);
324
325 if (ipf_sync_debug > 8)
326 printf("[%d] Read v:%d p:%d cmd:%d table:%d rev:%d len:%d magic:%x\n",
327 sh.sm_num, sh.sm_v, sh.sm_p, sh.sm_cmd,
328 sh.sm_table, sh.sm_rev, sh.sm_len,
329 sh.sm_magic);
330
331 if (sh.sm_magic != SYNHDRMAGIC) {
332 if (ipf_sync_debug > 2)
333 printf("uiomove(header) invalud %s\n",
334 "magic");
335 return EINVAL;
336 }
337
338 if (sh.sm_v != 4 && sh.sm_v != 6) {
339 if (ipf_sync_debug > 2)
340 printf("uiomove(header) invalid %s\n",
341 "protocol");
342 return EINVAL;
343 }
344
345 if (sh.sm_cmd > SMC_MAXCMD) {
346 if (ipf_sync_debug > 2)
347 printf("uiomove(header) invalid %s\n",
348 "command");
349 return EINVAL;
350 }
351
352
353 if (sh.sm_table > SMC_MAXTBL) {
354 if (ipf_sync_debug > 2)
355 printf("uiomove(header) invalid %s\n",
356 "table");
357 return EINVAL;
358 }
359
360 } else {
361 /* unsufficient data, wait until next call */
362 if (ipf_sync_debug > 2)
363 printf("uiomove(header) insufficient data");
364 return EAGAIN;
365 }
366
367
368 /*
369 * We have a header, so try to read the amount of data
370 * needed for the request
371 */
372
373 /* not supported */
374 if (sh.sm_len == 0) {
375 if (ipf_sync_debug > 2)
376 printf("uiomove(data zero length %s\n",
377 "not supported");
378 return EINVAL;
379 }
380
381 if (uio->uio_resid >= sh.sm_len) {
382
383 err = UIOMOVE(data, sh.sm_len, UIO_WRITE, uio);
384
385 if (err) {
386 if (ipf_sync_debug > 2)
387 printf("uiomove(data) failed: %d\n",
388 err);
389 return err;
390 }
391
392 if (ipf_sync_debug > 7)
393 printf("uiomove(data) %d bytes read\n",
394 sh.sm_len);
395
396 if (sh.sm_table == SMC_STATE)
397 err = ipfsync_state(&sh, data);
398 else if (sh.sm_table == SMC_NAT)
399 err = ipfsync_nat(&sh, data);
400 if (ipf_sync_debug > 7)
401 printf("[%d] Finished with error %d\n",
402 sh.sm_num, err);
403
404 } else {
405 /* insufficient data, wait until next call */
406 if (ipf_sync_debug > 2)
407 printf("uiomove(data) %s %d bytes, got %d\n",
408 "insufficient data, need",
409 sh.sm_len, uio->uio_resid);
410 return EAGAIN;
411 }
412 }
413
414 /* no more data */
415 return 0;
416 }
417
418
419 /* ------------------------------------------------------------------------ */
420 /* Function: ipfsync_read */
421 /* Returns: int - 0 == success, else error value. */
422 /* Parameters: uio(O) - pointer to information about where to store data */
423 /* */
424 /* This function is called when a user program wants to read some data */
425 /* for pending state/NAT updates. If no data is available, the caller is */
426 /* put to sleep, pending a wakeup from the "lower half" of this code. */
427 /* ------------------------------------------------------------------------ */
428 int ipfsync_read(uio)
429 struct uio *uio;
430 {
431 syncupdent_t *su;
432 synclogent_t *sl;
433 int err = 0;
434
435 if ((uio->uio_resid & 3) || (uio->uio_resid < 8))
436 return EINVAL;
437
438 # if (BSD >= 199306) || defined(__FreeBSD__) || defined(__osf__)
439 uio->uio_rw = UIO_READ;
440 # endif
441
442 MUTEX_ENTER(&ipsl_mutex);
443 while ((sl_tail == sl_idx) && (su_tail == su_idx)) {
444 # if SOLARIS && defined(_KERNEL)
445 if (!cv_wait_sig(&ipslwait, &ipsl_mutex)) {
446 MUTEX_EXIT(&ipsl_mutex);
447 return EINTR;
448 }
449 # else
450 # ifdef __hpux
451 {
452 lock_t *l;
453
454 l = get_sleep_lock(&sl_tail);
455 err = sleep(&sl_tail, PZERO+1);
456 if (err) {
457 MUTEX_EXIT(&ipsl_mutex);
458 return EINTR;
459 }
460 spinunlock(l);
461 }
462 # else /* __hpux */
463 # ifdef __osf__
464 err = mpsleep(&sl_tail, PSUSP|PCATCH, "ipl sleep", 0,
465 &ipsl_mutex, MS_LOCK_SIMPLE);
466 if (err)
467 return EINTR;
468 # else
469 MUTEX_EXIT(&ipsl_mutex);
470 err = SLEEP(&sl_tail, "ipl sleep");
471 if (err)
472 return EINTR;
473 MUTEX_ENTER(&ipsl_mutex);
474 # endif /* __osf__ */
475 # endif /* __hpux */
476 # endif /* SOLARIS */
477 }
478 MUTEX_EXIT(&ipsl_mutex);
479
480 READ_ENTER(&ipf_syncstate);
481 while ((sl_tail < sl_idx) && (uio->uio_resid > sizeof(*sl))) {
482 sl = synclog + sl_tail++;
483 err = UIOMOVE(sl, sizeof(*sl), UIO_READ, uio);
484 if (err != 0)
485 break;
486 }
487
488 while ((su_tail < su_idx) && (uio->uio_resid > sizeof(*su))) {
489 su = syncupd + su_tail;
490 su_tail++;
491 err = UIOMOVE(su, sizeof(*su), UIO_READ, uio);
492 if (err != 0)
493 break;
494 if (su->sup_hdr.sm_sl != NULL)
495 su->sup_hdr.sm_sl->sl_idx = -1;
496 }
497
498 MUTEX_ENTER(&ipf_syncadd);
499 if (su_tail == su_idx)
500 su_tail = su_idx = 0;
501 if (sl_tail == sl_idx)
502 sl_tail = sl_idx = 0;
503 MUTEX_EXIT(&ipf_syncadd);
504 RWLOCK_EXIT(&ipf_syncstate);
505 return err;
506 }
507
508
509 /* ------------------------------------------------------------------------ */
510 /* Function: ipfsync_state */
511 /* Returns: int - 0 == success, else error value. */
512 /* Parameters: sp(I) - pointer to sync packet data header */
513 /* uio(I) - pointer to user data for further information */
514 /* */
515 /* Updates the state table according to information passed in the sync */
516 /* header. As required, more data is fetched from the uio structure but */
517 /* varies depending on the contents of the sync header. This function can */
518 /* create a new state entry or update one. Deletion is left to the state */
519 /* structures being timed out correctly. */
520 /* ------------------------------------------------------------------------ */
521 int ipfsync_state(sp, data)
522 synchdr_t *sp;
523 void *data;
524 {
525 synctcp_update_t su;
526 ipstate_t *is, sn;
527 synclist_t *sl;
528 frentry_t *fr;
529 u_int hv;
530 int err = 0;
531
532 hv = sp->sm_num & (SYNC_STATETABSZ - 1);
533
534 switch (sp->sm_cmd)
535 {
536 case SMC_CREATE :
537
538 bcopy(data, &sn, sizeof(sn));
539 KMALLOC(is, ipstate_t *);
540 if (is == NULL) {
541 err = ENOMEM;
542 break;
543 }
544
545 KMALLOC(sl, synclist_t *);
546 if (sl == NULL) {
547 err = ENOMEM;
548 KFREE(is);
549 break;
550 }
551
552 bzero((char *)is, offsetof(ipstate_t, is_die));
553 bcopy((char *)&sn.is_die, (char *)&is->is_die,
554 sizeof(*is) - offsetof(ipstate_t, is_die));
555 ipfsync_storder(0, is);
556
557 /*
558 * We need to find the same rule on the slave as was used on
559 * the master to create this state entry.
560 */
561 READ_ENTER(&ipf_mutex);
562 fr = fr_getrulen(IPL_LOGIPF, sn.is_group, sn.is_rulen);
563 if (fr != NULL) {
564 MUTEX_ENTER(&fr->fr_lock);
565 fr->fr_ref++;
566 fr->fr_statecnt++;
567 MUTEX_EXIT(&fr->fr_lock);
568 }
569 RWLOCK_EXIT(&ipf_mutex);
570
571 if (ipf_sync_debug > 4)
572 printf("[%d] Filter rules = %p\n", sp->sm_num, fr);
573
574 is->is_rule = fr;
575 is->is_sync = sl;
576
577 sl->sl_idx = -1;
578 sl->sl_ips = is;
579 bcopy(sp, &sl->sl_hdr, sizeof(struct synchdr));
580
581 WRITE_ENTER(&ipf_syncstate);
582 WRITE_ENTER(&ipf_state);
583
584 sl->sl_pnext = syncstatetab + hv;
585 sl->sl_next = syncstatetab[hv];
586 if (syncstatetab[hv] != NULL)
587 syncstatetab[hv]->sl_pnext = &sl->sl_next;
588 syncstatetab[hv] = sl;
589 MUTEX_DOWNGRADE(&ipf_syncstate);
590 fr_stinsert(is, sp->sm_rev);
591 /*
592 * Do not initialise the interface pointers for the state
593 * entry as the full complement of interface names may not
594 * be present.
595 *
596 * Put this state entry on its timeout queue.
597 */
598 /*fr_setstatequeue(is, sp->sm_rev);*/
599 break;
600
601 case SMC_UPDATE :
602 bcopy(data, &su, sizeof(su));
603
604 if (ipf_sync_debug > 4)
605 printf("[%d] Update age %lu state %d/%d \n",
606 sp->sm_num, su.stu_age, su.stu_state[0],
607 su.stu_state[1]);
608
609 READ_ENTER(&ipf_syncstate);
610 for (sl = syncstatetab[hv]; (sl != NULL); sl = sl->sl_next)
611 if (sl->sl_hdr.sm_num == sp->sm_num)
612 break;
613 if (sl == NULL) {
614 if (ipf_sync_debug > 1)
615 printf("[%d] State not found - can't update\n",
616 sp->sm_num);
617 RWLOCK_EXIT(&ipf_syncstate);
618 err = ENOENT;
619 break;
620 }
621
622 READ_ENTER(&ipf_state);
623
624 if (ipf_sync_debug > 6)
625 printf("[%d] Data from state v:%d p:%d cmd:%d table:%d rev:%d\n",
626 sp->sm_num, sl->sl_hdr.sm_v, sl->sl_hdr.sm_p,
627 sl->sl_hdr.sm_cmd, sl->sl_hdr.sm_table,
628 sl->sl_hdr.sm_rev);
629
630 is = sl->sl_ips;
631
632 MUTEX_ENTER(&is->is_lock);
633 switch (sp->sm_p)
634 {
635 case IPPROTO_TCP :
636 /* XXX FV --- shouldn't we do ntohl/htonl???? XXX */
637 is->is_send = su.stu_data[0].td_end;
638 is->is_maxsend = su.stu_data[0].td_maxend;
639 is->is_maxswin = su.stu_data[0].td_maxwin;
640 is->is_state[0] = su.stu_state[0];
641 is->is_dend = su.stu_data[1].td_end;
642 is->is_maxdend = su.stu_data[1].td_maxend;
643 is->is_maxdwin = su.stu_data[1].td_maxwin;
644 is->is_state[1] = su.stu_state[1];
645 break;
646 default :
647 break;
648 }
649
650 if (ipf_sync_debug > 6)
651 printf("[%d] Setting timers for state\n", sp->sm_num);
652
653 fr_setstatequeue(is, sp->sm_rev);
654
655 MUTEX_EXIT(&is->is_lock);
656 break;
657
658 default :
659 err = EINVAL;
660 break;
661 }
662
663 if (err == 0) {
664 RWLOCK_EXIT(&ipf_state);
665 RWLOCK_EXIT(&ipf_syncstate);
666 }
667
668 if (ipf_sync_debug > 6)
669 printf("[%d] Update completed with error %d\n",
670 sp->sm_num, err);
671
672 return err;
673 }
674 # endif /* _KERNEL */
675
676
677 /* ------------------------------------------------------------------------ */
678 /* Function: ipfsync_del */
679 /* Returns: Nil */
680 /* Parameters: sl(I) - pointer to synclist object to delete */
681 /* */
682 /* Deletes an object from the synclist table and free's its memory. */
683 /* ------------------------------------------------------------------------ */
684 void ipfsync_del(sl)
685 synclist_t *sl;
686 {
687 WRITE_ENTER(&ipf_syncstate);
688 *sl->sl_pnext = sl->sl_next;
689 if (sl->sl_next != NULL)
690 sl->sl_next->sl_pnext = sl->sl_pnext;
691 if (sl->sl_idx != -1)
692 syncupd[sl->sl_idx].sup_hdr.sm_sl = NULL;
693 RWLOCK_EXIT(&ipf_syncstate);
694 KFREE(sl);
695 }
696
697
698 /* ------------------------------------------------------------------------ */
699 /* Function: ipfsync_nat */
700 /* Returns: int - 0 == success, else error value. */
701 /* Parameters: sp(I) - pointer to sync packet data header */
702 /* uio(I) - pointer to user data for further information */
703 /* */
704 /* Updates the NAT table according to information passed in the sync */
705 /* header. As required, more data is fetched from the uio structure but */
706 /* varies depending on the contents of the sync header. This function can */
707 /* create a new NAT entry or update one. Deletion is left to the NAT */
708 /* structures being timed out correctly. */
709 /* ------------------------------------------------------------------------ */
710 int ipfsync_nat(sp, data)
711 synchdr_t *sp;
712 void *data;
713 {
714 syncupdent_t su;
715 nat_t *n, *nat;
716 synclist_t *sl;
717 u_int hv = 0;
718 int err;
719
720 READ_ENTER(&ipf_syncnat);
721
722 switch (sp->sm_cmd)
723 {
724 case SMC_CREATE :
725 KMALLOC(n, nat_t *);
726 if (n == NULL) {
727 err = ENOMEM;
728 break;
729 }
730
731 KMALLOC(sl, synclist_t *);
732 if (sl == NULL) {
733 err = ENOMEM;
734 KFREE(n);
735 break;
736 }
737
738 nat = (nat_t *)data;
739 bzero((char *)n, offsetof(nat_t, nat_age));
740 bcopy((char *)&nat->nat_age, (char *)&n->nat_age,
741 sizeof(*n) - offsetof(nat_t, nat_age));
742 ipfsync_natorder(0, n);
743 n->nat_sync = sl;
744
745 sl->sl_idx = -1;
746 sl->sl_ipn = n;
747 sl->sl_num = ntohl(sp->sm_num);
748
749 WRITE_ENTER(&ipf_nat);
750 sl->sl_pnext = syncnattab + hv;
751 sl->sl_next = syncnattab[hv];
752 if (syncnattab[hv] != NULL)
753 syncnattab[hv]->sl_pnext = &sl->sl_next;
754 syncnattab[hv] = sl;
755 nat_insert(n, sl->sl_rev);
756 RWLOCK_EXIT(&ipf_nat);
757 break;
758
759 case SMC_UPDATE :
760 bcopy(data, &su, sizeof(su));
761
762 for (sl = syncnattab[hv]; (sl != NULL); sl = sl->sl_next)
763 if (sl->sl_hdr.sm_num == sp->sm_num)
764 break;
765 if (sl == NULL) {
766 err = ENOENT;
767 break;
768 }
769
770 READ_ENTER(&ipf_nat);
771
772 nat = sl->sl_ipn;
773
774 MUTEX_ENTER(&nat->nat_lock);
775 fr_setnatqueue(nat, sl->sl_rev);
776 MUTEX_EXIT(&nat->nat_lock);
777
778 RWLOCK_EXIT(&ipf_nat);
779
780 break;
781
782 default :
783 err = EINVAL;
784 break;
785 }
786
787 RWLOCK_EXIT(&ipf_syncnat);
788 return 0;
789 }
790
791
792 /* ------------------------------------------------------------------------ */
793 /* Function: ipfsync_new */
794 /* Returns: synclist_t* - NULL == failure, else pointer to new synclist */
795 /* data structure. */
796 /* Parameters: tab(I) - type of synclist_t to create */
797 /* fin(I) - pointer to packet information */
798 /* ptr(I) - pointer to owning object */
799 /* */
800 /* Creates a new sync table entry and notifies any sleepers that it's there */
801 /* waiting to be processed. */
802 /* ------------------------------------------------------------------------ */
803 synclist_t *ipfsync_new(tab, fin, ptr)
804 int tab;
805 fr_info_t *fin;
806 void *ptr;
807 {
808 synclist_t *sl, *ss;
809 synclogent_t *sle;
810 u_int hv, sz;
811
812 if (sl_idx == SYNCLOG_SZ)
813 return NULL;
814 KMALLOC(sl, synclist_t *);
815 if (sl == NULL)
816 return NULL;
817
818 MUTEX_ENTER(&ipf_syncadd);
819 /*
820 * Get a unique number for this synclist_t. The number is only meant
821 * to be unique for the lifetime of the structure and may be reused
822 * later.
823 */
824 ipf_syncnum++;
825 if (ipf_syncnum == 0) {
826 ipf_syncnum = 1;
827 ipf_syncwrap = 1;
828 }
829
830 /*
831 * Use the synch number of the object as the hash key. Should end up
832 * with relatively even distribution over time.
833 * XXX - an attacker could lunch an DoS attack, of sorts, if they are
834 * the only one causing new table entries by only keeping open every
835 * nth connection they make, where n is a value in the interval
836 * [0, SYNC_STATETABSZ-1].
837 */
838 if (tab == SMC_STATE) {
839 hv = ipf_syncnum & (SYNC_STATETABSZ - 1);
840 while (ipf_syncwrap != 0) {
841 for (ss = syncstatetab[hv]; ss; ss = ss->sl_next)
842 if (ss->sl_hdr.sm_num == ipf_syncnum)
843 break;
844 if (ss == NULL)
845 break;
846 ipf_syncnum++;
847 hv = ipf_syncnum & (SYNC_STATETABSZ - 1);
848 }
849 sl->sl_pnext = syncstatetab + hv;
850 sl->sl_next = syncstatetab[hv];
851 syncstatetab[hv] = sl;
852 } else {
853 hv = ipf_syncnum & (SYNC_NATTABSZ - 1);
854 while (ipf_syncwrap != 0) {
855 for (ss = syncnattab[hv]; ss; ss = ss->sl_next)
856 if (ss->sl_hdr.sm_num == ipf_syncnum)
857 break;
858 if (ss == NULL)
859 break;
860 ipf_syncnum++;
861 hv = ipf_syncnum & (SYNC_STATETABSZ - 1);
862 }
863 sl->sl_pnext = syncnattab + hv;
864 sl->sl_next = syncnattab[hv];
865 syncnattab[hv] = sl;
866 }
867 sl->sl_num = ipf_syncnum;
868 MUTEX_EXIT(&ipf_syncadd);
869
870 sl->sl_magic = htonl(SYNHDRMAGIC);
871 sl->sl_v = fin->fin_v;
872 sl->sl_p = fin->fin_p;
873 sl->sl_cmd = SMC_CREATE;
874 sl->sl_idx = -1;
875 sl->sl_table = tab;
876 sl->sl_rev = fin->fin_rev;
877 if (tab == SMC_STATE) {
878 sl->sl_ips = ptr;
879 sz = sizeof(*sl->sl_ips);
880 } else {
881 sl->sl_ipn = ptr;
882 sz = sizeof(*sl->sl_ipn);
883 }
884 sl->sl_len = sz;
885
886 /*
887 * Create the log entry to be read by a user daemon. When it has been
888 * finished and put on the queue, send a signal to wakeup any waiters.
889 */
890 MUTEX_ENTER(&ipf_syncadd);
891 sle = synclog + sl_idx++;
892 bcopy((char *)&sl->sl_hdr, (char *)&sle->sle_hdr,
893 sizeof(sle->sle_hdr));
894 sle->sle_hdr.sm_num = htonl(sle->sle_hdr.sm_num);
895 sle->sle_hdr.sm_len = htonl(sle->sle_hdr.sm_len);
896 if (ptr != NULL) {
897 bcopy((char *)ptr, (char *)&sle->sle_un, sz);
898 if (tab == SMC_STATE) {
899 ipfsync_storder(1, &sle->sle_un.sleu_ips);
900 } else if (tab == SMC_NAT) {
901 ipfsync_natorder(1, &sle->sle_un.sleu_ipn);
902 }
903 }
904 MUTEX_EXIT(&ipf_syncadd);
905
906 MUTEX_ENTER(&ipsl_mutex);
907 # if SOLARIS
908 # ifdef _KERNEL
909 cv_signal(&ipslwait);
910 pollwakeup(&iplpollhead[IPL_LOGSYNC], POLLIN|POLLRDNORM);
911 # endif
912 MUTEX_EXIT(&ipsl_mutex);
913 # else
914 MUTEX_EXIT(&ipsl_mutex);
915 # ifdef _KERNEL
916 WAKEUP(&sl_tail, 0);
917 POLLWAKEUP(IPL_LOGSYNC);
918 # endif
919 # endif
920 return sl;
921 }
922
923
924 /* ------------------------------------------------------------------------ */
925 /* Function: ipfsync_update */
926 /* Returns: Nil */
927 /* Parameters: tab(I) - type of synclist_t to create */
928 /* fin(I) - pointer to packet information */
929 /* sl(I) - pointer to synchronisation object */
930 /* */
931 /* For outbound packets, only, create an sync update record for the user */
932 /* process to read. */
933 /* ------------------------------------------------------------------------ */
934 void ipfsync_update(tab, fin, sl)
935 int tab;
936 fr_info_t *fin;
937 synclist_t *sl;
938 {
939 synctcp_update_t *st;
940 syncupdent_t *slu;
941 ipstate_t *ips;
942 nat_t *nat;
943
944 if (fin->fin_out == 0 || sl == NULL)
945 return;
946
947 WRITE_ENTER(&ipf_syncstate);
948 MUTEX_ENTER(&ipf_syncadd);
949 if (sl->sl_idx == -1) {
950 slu = syncupd + su_idx;
951 sl->sl_idx = su_idx++;
952 bcopy((char *)&sl->sl_hdr, (char *)&slu->sup_hdr,
953 sizeof(slu->sup_hdr));
954 slu->sup_hdr.sm_magic = htonl(SYNHDRMAGIC);
955 slu->sup_hdr.sm_sl = sl;
956 slu->sup_hdr.sm_cmd = SMC_UPDATE;
957 slu->sup_hdr.sm_table = tab;
958 slu->sup_hdr.sm_num = htonl(sl->sl_num);
959 slu->sup_hdr.sm_len = htonl(sizeof(struct synctcp_update));
960 slu->sup_hdr.sm_rev = fin->fin_rev;
961 # if 0
962 if (fin->fin_p == IPPROTO_TCP) {
963 st->stu_len[0] = 0;
964 st->stu_len[1] = 0;
965 }
966 # endif
967 } else
968 slu = syncupd + sl->sl_idx;
969 MUTEX_EXIT(&ipf_syncadd);
970 MUTEX_DOWNGRADE(&ipf_syncstate);
971
972 /*
973 * Only TCP has complex timeouts, others just use default timeouts.
974 * For TCP, we only need to track the connection state and window.
975 */
976 if (fin->fin_p == IPPROTO_TCP) {
977 st = &slu->sup_tcp;
978 if (tab == SMC_STATE) {
979 ips = sl->sl_ips;
980 st->stu_age = htonl(ips->is_die);
981 st->stu_data[0].td_end = ips->is_send;
982 st->stu_data[0].td_maxend = ips->is_maxsend;
983 st->stu_data[0].td_maxwin = ips->is_maxswin;
984 st->stu_state[0] = ips->is_state[0];
985 st->stu_data[1].td_end = ips->is_dend;
986 st->stu_data[1].td_maxend = ips->is_maxdend;
987 st->stu_data[1].td_maxwin = ips->is_maxdwin;
988 st->stu_state[1] = ips->is_state[1];
989 } else if (tab == SMC_NAT) {
990 nat = sl->sl_ipn;
991 st->stu_age = htonl(nat->nat_age);
992 }
993 }
994 RWLOCK_EXIT(&ipf_syncstate);
995
996 MUTEX_ENTER(&ipsl_mutex);
997 # if SOLARIS
998 # ifdef _KERNEL
999 cv_signal(&ipslwait);
1000 pollwakeup(&iplpollhead[IPL_LOGSYNC], POLLIN|POLLRDNORM);
1001 # endif
1002 MUTEX_EXIT(&ipsl_mutex);
1003 # else
1004 MUTEX_EXIT(&ipsl_mutex);
1005 # ifdef _KERNEL
1006 WAKEUP(&sl_tail, 0);
1007 POLLWAKEUP(IPL_LOGSYNC);
1008 # endif
1009 # endif
1010 }
1011
1012
1013 /* ------------------------------------------------------------------------ */
1014 /* Function: fr_sync_ioctl */
1015 /* Returns: int - 0 == success, != 0 == failure */
1016 /* Parameters: data(I) - pointer to ioctl data */
1017 /* cmd(I) - ioctl command integer */
1018 /* mode(I) - file mode bits used with open */
1019 /* */
1020 /* This function currently does not handle any ioctls and so just returns */
1021 /* EINVAL on all occasions. */
1022 /* ------------------------------------------------------------------------ */
1023 int fr_sync_ioctl(data, cmd, mode, uid, ctx)
1024 caddr_t data;
1025 ioctlcmd_t cmd;
1026 int mode, uid;
1027 void *ctx;
1028 {
1029 return EINVAL;
1030 }
1031
1032
1033 int ipfsync_canread()
1034 {
1035 return !((sl_tail == sl_idx) && (su_tail == su_idx));
1036 }
1037
1038
1039 int ipfsync_canwrite()
1040 {
1041 return 1;
1042 }
1043 #endif /* IPFILTER_SYNC */
NetBSD on the FriendlyARM MINI2440