ip_fil_solaris.c

/*
 * Copyright (C) 2011 by Darren Reed.
 *
 * See the IPFILTER.LICENCE file for details on licencing.
 */
#if !defined(lint)
static const char sccsid[] = "%W% %G% (C) 1993-2000 Darren Reed";
static const char rcsid[] = "@(#)$Id$";
#endif

#include <sys/types.h>
#include <sys/errno.h>
#include <sys/param.h>
#include <sys/cpuvar.h>
#include <sys/open.h>
#include <sys/ioctl.h>
#include <sys/filio.h>
#include <sys/systm.h>
#if SOLARIS2 >= 10
# include <sys/cred_impl.h>
#else
# include <sys/cred.h>
#endif
#include <sys/ddi.h>
#include <sys/sunddi.h>
#include <sys/ksynch.h>
#include <sys/kmem.h>
#include <sys/mkdev.h>
#include <sys/protosw.h>
#include <sys/socket.h>
#include <sys/dditypes.h>
#include <sys/cmn_err.h>
#include <net/if.h>
#include <net/af.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/ip_var.h>
#include <netinet/tcp.h>
#include <netinet/udp.h>
#include <netinet/tcpip.h>
#include <netinet/ip_icmp.h>
#include "netinet/ip_compat.h"
#ifdef	USE_INET6
# include <netinet/icmp6.h>
#endif
#include "netinet/ip_fil.h"
#include "netinet/ip_nat.h"
#include "netinet/ip_frag.h"
#include "netinet/ip_state.h"
#include "netinet/ip_auth.h"
#include "netinet/ip_proxy.h"
#include "netinet/ip_lookup.h"
#include "netinet/ip_dstlist.h"
#include <inet/ip_ire.h>

#ifdef HAS_SYS_MD5_H
# include <sys/md5.h>
#else
# include "md5.h"
#endif

static	int	ipf_send_ip __P((fr_info_t *fin, mblk_t *m));
static	void	ipf_fixl4sum __P((fr_info_t *));
static	void	*ipf_routeto __P((fr_info_t *, int, void *));
static	int	ipf_sendpkt __P((ipf_main_softc_t *, int, void *, mblk_t *,
				 struct ip *, void *));
static	void	ipf_call_slow_timer __P((ipf_main_softc_t *));
#if (SOLARIS2 < 7)
static	void	ipf_timer_func __P((void));
#else
static	void	ipf_timer_func __P((void *));
#endif

static	u_short	ipid = 0;
#if !defined(FW_HOOKS)
# if SOLARIS2 >= 7
u_int		*ip_ttl_ptr = NULL;
u_int		*ip_mtudisc = NULL;
#  if SOLARIS2 >= 8
int		*ip_forwarding = NULL;
u_int		*ip6_forwarding = NULL;
#  else
u_int		*ip_forwarding = NULL;
# endif
# else
u_long		*ip_ttl_ptr = NULL;
u_long		*ip_mtudisc = NULL;
u_long		*ip_forwarding = NULL;
# endif
extern	ipf_main_softc_t	ipfmain;
#else
extern	void	ipf_attach_hooks __P((ipf_main_softc_t *));
extern	void	ipf_detach_hooks __P((ipf_main_softc_t *));
#endif


/* ------------------------------------------------------------------------ */
/* Function:    ipfdetach                                                   */
/* Returns:     int - 0 == success, else error.                             */
/* Parameters:  Nil                                                         */
/*                                                                          */
/* This function is responsible for undoing anything that might have been   */
/* done in a call to ipfattach().  It must be able to clean up from a call  */
/* to ipfattach() that did not succeed.  Why might that happen?  Someone    */
/* configures a table to be so large that we cannot allocate enough memory  */
/* for it.                                                                  */
/* ------------------------------------------------------------------------ */
int
ipfdetach(softc)
	ipf_main_softc_t *softc;
{

#if !defined(FW_HOOKS)
	if (softc->ipf_control_forwarding & 2) {
		if (ip_forwarding != NULL)
			*ip_forwarding = 0;
# if SOLARIS2 >= 8
		if (ip6_forwarding != NULL)
			*ip6_forwarding = 0;
# endif
	}

	ipf_pfil_hooks_remove();
#else
	ipf_detach_hooks(softc);
#endif

	if (softc->ipf_slow_ch != 0) {
		(void) untimeout(softc->ipf_slow_ch);
		softc->ipf_slow_ch = 0;
	}

#ifdef	IPFDEBUG
	cmn_err(CE_CONT, "ipfdetach()\n");
#endif

        if (ipf_fini_all(softc) < 0)
		return EIO;

	return 0;
}


int
ipfattach(softc)
	ipf_main_softc_t *softc;
{
	int i;

#ifdef	IPFDEBUG
	cmn_err(CE_CONT, "ipfattach()\n");
#endif

#if !defined(FW_HOOKS)
# if SOLARIS2 >= 8
	ip_forwarding = &ip_g_forward;
# endif
	/*
	 * XXX - There is no terminator for this array, so it is not possible
	 * to tell if what we are looking for is missing and go off the end
	 * of the array.
	 */

# if SOLARIS2 <= 8
	for (i = 0; ; i++) {
		if (!strcmp(ip_param_arr[i].ip_param_name, "ip_def_ttl")) {
			ip_ttl_ptr = &ip_param_arr[i].ip_param_value;
		} else if (!strcmp(ip_param_arr[i].ip_param_name,
			    "ip_path_mtu_discovery")) {
			ip_mtudisc = &ip_param_arr[i].ip_param_value;
		}
#  if SOLARIS2 < 8
		else if (!strcmp(ip_param_arr[i].ip_param_name,
			    "ip_forwarding")) {
			ip_forwarding = &ip_param_arr[i].ip_param_value;
		}
#  else
		else if (!strcmp(ip_param_arr[i].ip_param_name,
			    "ip6_forwarding")) {
			ip6_forwarding = &ip_param_arr[i].ip_param_value;
		}
#  endif

		if (ip_mtudisc != NULL && ip_ttl_ptr != NULL &&
#  if SOLARIS2 >= 8
		    ip6_forwarding != NULL &&
#  endif
		    ip_forwarding != NULL)
			break;
	}
# endif

	if (softc->ipf_control_forwarding & 1) {
		if (ip_forwarding != NULL)
			*ip_forwarding = 1;
# if SOLARIS2 >= 8
		if (ip6_forwarding != NULL)
			*ip6_forwarding = 1;
# endif
	}
#endif

        if (ipf_init_all(softc) < 0)
		return EIO;
	softc->ipf_slow_ch = timeout(ipf_timer_func, softc,
				     drv_usectohz(500000));

#if !defined(FW_HOOKS)
	ipf_set_pfil_hooks();
#else
	ipf_attach_hooks(softc);
#endif
	ipid = 0;

	return 0;
}


/*
 * Filter ioctl interface.
 */
/*ARGSUSED*/
int
ipfioctl(dev, cmd, data, mode, cp, rp)
	dev_t dev;
	int cmd;
#if SOLARIS2 >= 7
	intptr_t data;
#else
	int *data;
#endif
	int mode;
	cred_t *cp;
	int *rp;
{
	ipf_main_softc_t *softc;
	int error = 0;
	minor_t unit;

#ifdef	IPFDEBUG
	cmn_err(CE_CONT, "ipfioctl(%x,%x,%x,%d,%x,%d)\n",
		dev, cmd, data, mode, cp, rp);
#endif
	unit = getminor(dev);
	if (IPL_LOGMAX < unit) {
		IPFERROR(130002);
		return ENXIO;
	}

	softc = GET_SOFTC(crgetzoneid(cp));

	if (softc->ipf_running <= 0) {
		if (unit != IPL_LOGIPF && cmd != SIOCIPFINTERROR) {
			IPFERROR(130003);
			return EIO;
		}
		if (cmd != SIOCIPFGETNEXT && cmd != SIOCIPFGET &&
		    cmd != SIOCIPFSET && cmd != SIOCFRENB &&
		    cmd != SIOCGETFS && cmd != SIOCGETFF &&
		    cmd != SIOCIPFINTERROR) {
			IPFERROR(130004);
			return EIO;
		}
	}

	error = ipf_ioctlswitch(softc, unit, (caddr_t)data, cmd, mode,
			       cp->cr_uid, curproc);
	if (error != -1) {
		return error;
	}

	return error;
}


void *
get_unit(soft, name, family)
	void *soft;
	char *name;
	int family;
{
	void *ifp;
#if !defined(FW_HOOKS)
	qif_t *qf;
	int sap;

	if (family == 4)
		sap = 0x0800;
	else if (family == 6)
		sap = 0x86dd;
	else
		return NULL;
	rw_enter(&pfil_rw, RW_READER);
	qf = qif_iflookup(name, sap);
	rw_exit(&pfil_rw);
	return qf;
#else
	ipf_main_softc_t *softc = soft;
	net_handle_t proto;

	if (family == 0) {
		ifp = (void *)net_phylookup(softc->ipf_nd_v4, name);
		if (ifp == NULL)
			ifp = (void *)net_phylookup(softc->ipf_nd_v6, name);
		return ifp;
	}
	if (family == 4)
		proto = softc->ipf_nd_v4;
	else if (family == 6)
		proto = softc->ipf_nd_v6;
	else
		return NULL;
	return (void *)net_phylookup(proto, name);
#endif
}


/*
 * ipf_send_reset - this could conceivably be a call to tcp_respond(), but
 * that requires a large amount of setting up and isn't any more efficient.
 */
int
ipf_send_reset(fr_info_t *fin)
{
	tcphdr_t *tcp, *tcp2;
	int tlen, hlen;
	mblk_t *m;
#ifdef	USE_INET6
	ip6_t *ip6;
#endif
	ip_t *ip;

	tcp = fin->fin_dp;
	if (tcp->th_flags & TH_RST)
		return -1;

	if (ipf_checkl4sum(fin) == -1)
		return -1;

	tlen = (tcp->th_flags & (TH_SYN|TH_FIN)) ? 1 : 0;
#ifdef	USE_INET6
	if (fin->fin_v == 6)
		hlen = sizeof(ip6_t);
	else
#endif
		hlen = sizeof(ip_t);
	hlen += sizeof(*tcp2);
	if ((m = (mblk_t *)allocb(hlen + 64, BPRI_HI)) == NULL)
		return -1;

	m->b_rptr += 64;
	MTYPE(m) = M_DATA;
	m->b_wptr = m->b_rptr + hlen;
	ip = (ip_t *)m->b_rptr;
	bzero((char *)ip, hlen);
	tcp2 = (struct tcphdr *)(m->b_rptr + hlen - sizeof(*tcp2));
	tcp2->th_dport = tcp->th_sport;
	tcp2->th_sport = tcp->th_dport;
	if (tcp->th_flags & TH_ACK) {
		tcp2->th_seq = tcp->th_ack;
		tcp2->th_flags = TH_RST;
	} else {
		tcp2->th_ack = ntohl(tcp->th_seq);
		tcp2->th_ack += tlen;
		tcp2->th_ack = htonl(tcp2->th_ack);
		tcp2->th_flags = TH_RST|TH_ACK;
	}
	tcp2->th_off = sizeof(struct tcphdr) >> 2;

	ip->ip_v = fin->fin_v;
#ifdef	USE_INET6
	if (fin->fin_v == 6) {
		ip6 = (ip6_t *)m->b_rptr;
		ip6->ip6_flow = ((ip6_t *)fin->fin_ip)->ip6_flow;
		ip6->ip6_src = fin->fin_dst6.in6;
		ip6->ip6_dst = fin->fin_src6.in6;
		ip6->ip6_plen = htons(sizeof(*tcp));
		ip6->ip6_nxt = IPPROTO_TCP;
	} else
#endif
	{
		ip->ip_src.s_addr = fin->fin_daddr;
		ip->ip_dst.s_addr = fin->fin_saddr;
		ip->ip_id = ipf_nextipid(fin);
		ip->ip_hl = sizeof(*ip) >> 2;
		ip->ip_p = IPPROTO_TCP;
		ip->ip_len = htons(sizeof(*ip) + sizeof(*tcp));
		ip->ip_tos = fin->fin_ip->ip_tos;
	}
	return ipf_send_ip(fin, m);
}


/*ARGSUSED*/
static int
ipf_send_ip(fr_info_t *fin, mblk_t *m)
{
#if !defined(FW_HOOKS)
	qif_t *qif;
#endif
	qpktinfo_t qpi, *qpip;
	fr_info_t fnew;
	ip_t *ip;
	int i, hlen;

	ip = (ip_t *)m->b_rptr;
	bzero((char *)&fnew, sizeof(fnew));
	fnew.fin_main_soft = fin->fin_main_soft;

#ifdef	USE_INET6
	if (fin->fin_v == 6) {
		ip6_t *ip6;

		ip6 = (ip6_t *)ip;
		ip6->ip6_vfc = 0x60;
		ip6->ip6_hlim = 127;
		fnew.fin_p = ip6->ip6_nxt;
		fnew.fin_v = 6;
		hlen = sizeof(*ip6);
		fnew.fin_plen = ntohs(ip6->ip6_plen) + hlen;
	} else
#endif
	{
		fnew.fin_v = 4;
#if !defined(FW_HOOKS)
		if (ip_ttl_ptr != NULL)
			ip->ip_ttl = (u_char)(*ip_ttl_ptr);
		else
#endif
			ip->ip_ttl = 63;
#if !defined(FW_HOOKS)
		if (ip_mtudisc != NULL)
			ip->ip_off = htons(*ip_mtudisc ? IP_DF : 0);
		else
#endif
			ip->ip_off = htons(IP_DF);
		fnew.fin_p = ip->ip_p;
		fnew.fin_plen = ntohs(ip->ip_len);
		ip->ip_sum = ipf_cksum((u_short *)ip, sizeof(*ip));
		hlen = sizeof(*ip);
	}

	qpip = fin->fin_qpi;
	qpi.qpi_q = qpip->qpi_q;
	qpi.qpi_off = 0;
#if defined(FW_HOOKS)
	qpi.qpi_real = qpip->qpi_real;
	qpi.qpi_ill = qpip->qpi_real;
#else
	qif = qpip->qpi_real;
	qpi.qpi_real = qif;
	qpi.qpi_ill = qif->qf_ill;
	qpi.qpi_flags = qif->qf_flags;
#endif
	qpi.qpi_m = m;
	qpi.qpi_data = ip;
	fnew.fin_qpi = &qpi;
	fnew.fin_ifp = fin->fin_ifp;
	fnew.fin_flx = FI_NOCKSUM;
	fnew.fin_m = m;
	fnew.fin_qfm = m;
	fnew.fin_ip = ip;
	fnew.fin_mp = &m;
	fnew.fin_hlen = hlen;
	fnew.fin_dp = (char *)ip + hlen;
	if (fnew.fin_p == IPPROTO_TCP) {
		tcphdr_t *tcp2 = fnew.fin_dp;
		tcp2->th_sum = fr_cksum(&fnew, ip, IPPROTO_TCP, tcp2);
	}
	if (ipf_makefrip(hlen, ip, &fnew) == -1)
		return -1;

	if (fin->fin_fr != NULL && fin->fin_fr->fr_type == FR_T_IPF) {
		frdest_t *fdp = &fin->fin_fr->fr_rif;

		if ((fdp->fd_ptr != NULL) &&
		    (fdp->fd_ptr != (struct ifnet *)-1))
			return ipf_fastroute(m, &m, &fnew, fdp);
	}

	i = ipf_fastroute(m, &m, &fnew, NULL);
	return i;
}


int
ipf_send_icmp_err(int type, fr_info_t *fin, int dst)
{
	ipf_main_softc_t *softc = fin->fin_main_soft;
	struct in_addr dst4;
	struct icmp *icmp;
	qpktinfo_t *qpi;
	int hlen, code;
	i6addr_t dst6;
	u_short sz;
#ifdef	USE_INET6
	mblk_t *mb;
#endif
	mblk_t *m;
#ifdef	USE_INET6
	ip6_t *ip6;
#endif
	ip_t *ip;

	if ((type < 0) || (type > ICMP_MAXTYPE))
		return -1;

	code = fin->fin_icode;
#ifdef USE_INET6
	if ((code < 0) || (code > sizeof(icmptoicmp6unreach)/sizeof(int)))
		return -1;
#endif

	if (ipf_checkl4sum(fin) == -1)
		return -1;

	qpi = fin->fin_qpi;

#ifdef	USE_INET6
	mb = fin->fin_qfm;

	if (fin->fin_v == 6) {
		sz = sizeof(ip6_t);
		sz += MIN(mb->b_wptr - mb->b_rptr, 512);
		hlen = sizeof(ip6_t);
		type = icmptoicmp6types[type];
		if (type == ICMP6_DST_UNREACH)
			code = icmptoicmp6unreach[code];
	} else
#endif
	{
		if ((fin->fin_p == IPPROTO_ICMP) && !(fin->fin_flx & FI_SHORT))
			switch (ntohs(fin->fin_data[0]) >> 8)
			{
			case ICMP_ECHO :
			case ICMP_TSTAMP :
			case ICMP_IREQ :
			case ICMP_MASKREQ :
				break;
			default :
				return 0;
			}

		sz = sizeof(ip_t) * 2;
		sz += 8;		/* 64 bits of data */
		hlen = sizeof(ip_t);
	}

	sz += offsetof(struct icmp, icmp_ip);
	if ((m = (mblk_t *)allocb((size_t)sz + 64, BPRI_HI)) == NULL)
		return -1;
	MTYPE(m) = M_DATA;
	m->b_rptr += 64;
	m->b_wptr = m->b_rptr + sz;
	bzero((char *)m->b_rptr, (size_t)sz);
	ip = (ip_t *)m->b_rptr;
	ip->ip_v = fin->fin_v;
	icmp = (struct icmp *)(m->b_rptr + hlen);
	icmp->icmp_type = type & 0xff;
	icmp->icmp_code = code & 0xff;
#ifdef	icmp_nextmtu
	if (type == ICMP_UNREACH && fin->fin_icode == ICMP_UNREACH_NEEDFRAG) {
		if (fin->fin_mtu != 0) {
			icmp->icmp_nextmtu = htons(fin->fin_mtu);

		} else if (GETIFMTU_4(qpi->qpi_real) != 0) {
			icmp->icmp_nextmtu = GETIFMTU_4(qpi->qpi_real);

		} else {	/* Make up a number */
			icmp->icmp_nextmtu = htons(fin->fin_plen - 20);
		}
	}
#endif

#ifdef	USE_INET6
	if (fin->fin_v == 6) {
		int csz;

		if (dst == 0) {
			if (ipf_ifpaddr(softc, 6, FRI_NORMAL, qpi->qpi_real,
					&dst6, NULL) == -1) {
				FREE_MB_T(m);
				return -1;
			}
		} else
			dst6 = fin->fin_dst6;

		csz = sz;
		sz -= sizeof(ip6_t);
		ip6 = (ip6_t *)m->b_rptr;
		ip6->ip6_flow = ((ip6_t *)fin->fin_ip)->ip6_flow;
		ip6->ip6_plen = htons((u_short)sz);
		ip6->ip6_nxt = IPPROTO_ICMPV6;
		ip6->ip6_src = dst6.in6;
		ip6->ip6_dst = fin->fin_src6.in6;
		sz -= offsetof(struct icmp, icmp_ip);
		bcopy((char *)mb->b_rptr, (char *)&icmp->icmp_ip, sz);
		icmp->icmp_cksum = csz - sizeof(ip6_t);
	} else
#endif
	{
		ip->ip_hl = sizeof(*ip) >> 2;
		ip->ip_p = IPPROTO_ICMP;
		ip->ip_id = fin->fin_ip->ip_id;
		ip->ip_tos = fin->fin_ip->ip_tos;
		ip->ip_len = (u_short)sz;
		if (dst == 0) {
			if (ipf_ifpaddr(softc, 4, FRI_NORMAL, qpi->qpi_real,
					&dst6, NULL) == -1) {
				FREE_MB_T(m);
				return -1;
			}
			dst4 = dst6.in4;
		} else
			dst4 = fin->fin_dst;
		ip->ip_src = dst4;
		ip->ip_dst = fin->fin_src;
		bcopy((char *)fin->fin_ip, (char *)&icmp->icmp_ip,
		      sizeof(*fin->fin_ip));
		bcopy((char *)fin->fin_ip + fin->fin_hlen,
		      (char *)&icmp->icmp_ip + sizeof(*fin->fin_ip), 8);
		icmp->icmp_cksum = ipf_cksum((u_short *)icmp,
					     sz - sizeof(ip_t));
	}

	/*
	 * Need to exit out of these so we don't recursively call rw_enter
	 * from fr_qout.
	 */
	return ipf_send_ip(fin, m);
}


#if !defined(FW_HOOKS)
/*
 * return the first IP Address associated with an interface
 */
/*ARGSUSED*/
int
ipf_ifpaddr(softc, v, atype, qifptr, inp, inpmask)
	ipf_main_softc_t *softc;
	int v;
	int atype;
	void *qifptr;
	i6addr_t *inp, *inpmask;
{
# ifdef	USE_INET6
	struct sockaddr_in6 sin6, mask6;
# endif
	struct sockaddr_in sin, mask;
	qif_t *qif;

	if ((qifptr == NULL) || (qifptr == (void *)-1))
		return -1;

	qif = qifptr;
	if (qif->qf_ill == NULL)
		return -1;

# ifdef	USE_INET6
	if (v == 6) {
		in6_addr_t *inp6;
		ipif_t *ipif;
		ill_t *ill;

		ill = qif->qf_ill;

		/*
		 * First is always link local.
		 */
		for (ipif = ill->ill_ipif; ipif; ipif = ipif->ipif_next) {
			inp6 = &ipif->ipif_v6lcl_addr;
			if (!IN6_IS_ADDR_LINKLOCAL(inp6) &&
			    !IN6_IS_ADDR_LOOPBACK(inp6))
				break;
		}
		if (ipif == NULL)
			return -1;

		mask6.sin6_addr = ipif->ipif_v6net_mask;
		if (atype == FRI_BROADCAST)
			sin6.sin6_addr = ipif->ipif_v6brd_addr;
		else if (atype == FRI_PEERADDR)
			sin6.sin6_addr = ipif->ipif_v6pp_dst_addr;
		else
			sin6.sin6_addr = *inp6;
		return ipf_ifpfillv6addr(atype, &sin6, &mask6, inp, inpmask);
	}
# endif

	if (((ill_t *)qif->qf_ill)->ill_ipif == NULL)
		return -1;

	switch (atype)
	{
	case FRI_BROADCAST :
		sin.sin_addr.s_addr = QF_V4_BROADCAST(qif);
		break;
	case FRI_PEERADDR :
		sin.sin_addr.s_addr = QF_V4_PEERADDR(qif);
		break;
	default :
		sin.sin_addr.s_addr = QF_V4_ADDR(qif);
		break;
	}
	mask.sin_addr.s_addr = QF_V4_NETMASK(qif);

	return ipf_ifpfillv4addr(atype, &sin, &mask, &inp->in4, &inpmask->in4);
}
#else
/*ARGSUSED*/
int
ipf_ifpaddr(softc, v, atype, qifptr, inp, inpmask)
	ipf_main_softc_t *softc;
	int v;
	int atype;
	void *qifptr;
	i6addr_t *inp, *inpmask;
{
	struct sockaddr_in6 sin6[2];
	struct sockaddr_in sin[2];
	net_ifaddr_t types[2];
	void *array;

	if ((qifptr == NULL) || (qifptr == (void *)-1))
		return -1;

	switch (atype)
	{
	case FRI_BROADCAST :
		types[0] = NA_BROADCAST;
		break;
	case FRI_PEERADDR :
		types[0] = NA_PEER;
		break;
	default :
		types[0] = NA_ADDRESS;
		break;
	}
	types[1] = NA_NETMASK;

	if (v == 4) {
		array = sin;
		net_getlifaddr(softc->ipf_nd_v4, (phy_if_t)qifptr, 0,
			       2, types, sin);
	} else {
		array = sin6;
		net_getlifaddr(softc->ipf_nd_v6, (phy_if_t)qifptr, 0,
			       2, types, sin6);
	}

	if (v == 6)
		return ipf_ifpfillv6addr(atype, &sin6[0], &sin6[1],
					 inp, inpmask);

	return ipf_ifpfillv4addr(atype, &sin[0], &sin[1],
				 &inp->in4, &inpmask->in4);
}
#endif


u_32_t
ipf_newisn(fr_info_t *fin)
{
	static int iss_seq_off = 0;
	ipf_main_softc_t *softc = fin->fin_main_soft;
	u_char hash[16];
	u_32_t newiss;
	MD5_CTX ctx;

	/*
	 * Compute the base value of the ISS.  It is a hash
	 * of (saddr, sport, daddr, dport, secret).
	 */
	MD5Init(&ctx);

	MD5Update(&ctx, (u_char *) &fin->fin_fi.fi_src,
		  sizeof(fin->fin_fi.fi_src));
	MD5Update(&ctx, (u_char *) &fin->fin_fi.fi_dst,
		  sizeof(fin->fin_fi.fi_dst));
	MD5Update(&ctx, (u_char *) &fin->fin_dat, sizeof(fin->fin_dat));

	MD5Update(&ctx, softc->ipf_iss_secret, sizeof(softc->ipf_iss_secret));

	MD5Final(hash, &ctx);

	bcopy(hash, &newiss, sizeof(newiss));

	/*
	 * Now increment our "timer", and add it in to
	 * the computed value.
	 *
	 * XXX Use `addin'?
	 * XXX TCP_ISSINCR too large to use?
	 */
	iss_seq_off += 0x00010000;
	newiss += iss_seq_off;
	return newiss;
}


/* ------------------------------------------------------------------------ */
/* Function:    ipf_nextipid                                                */
/* Returns:     int - 0 == success, -1 == error (packet should be droppped) */
/* Parameters:  fin(I) - pointer to packet information                      */
/*                                                                          */
/* Returns the next IPv4 ID to use for this packet.                         */
/* ------------------------------------------------------------------------ */
u_short
ipf_nextipid(fr_info_t *fin)
{
	ipf_main_softc_t *softc = fin->fin_main_soft;
	ipstate_t *is;
	nat_t *nat;
	u_short id;

	MUTEX_ENTER(&softc->ipf_rw);
	if (fin->fin_pktnum != 0) {
		/*
		 * The -1 is for aligned test results.
		 */
		id = (fin->fin_pktnum - 1) & 0xffff;
		id = ipid++;
	} else {
		id = ipid++;
	}
	MUTEX_EXIT(&softc->ipf_rw);

	return id;
}


INLINE int
ipf_checkv4sum(fr_info_t *fin)
{
#if defined(NET_HCK_L4_FULL)
	ipf_main_softc_t *softc = fin->fin_main_soft;
#endif
	int ckbits;

	if ((fin->fin_flx & FI_NOCKSUM) != 0)
		return 0;

	if ((fin->fin_flx & FI_SHORT) != 0)
		return 1;

	if (fin->fin_cksum != FI_CK_NEEDED)
		return (fin->fin_cksum > FI_CK_NEEDED) ? 0 : -1;

#if defined(NET_HCK_L4_FULL)
	ckbits = net_ispartialchecksum(softc->ipf_nd_v4, fin->fin_m);
	if (ckbits & NET_HCK_L4_FULL) {
		fin->fin_cksum = FI_CK_L4FULL;
		return 0;
	} else if (ckbits & NET_HCK_L4_PART) {
		fin->fin_cksum = FI_CK_L4PART;
		return 0;
	}
#endif
#if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6) && defined(ICK_VALID)
	if (dohwcksum && ((*fin->fin_mp)->b_ick_flag == ICK_VALID)) {
		fin->fin_cksum = FI_CK_SUMOK;
		return 0;
	}
#endif

	if (ipf_checkl4sum(fin) == -1) {
		DT1(bad_l4_sum, fr_info_t *, fin);
		fin->fin_flx |= FI_BAD;
		return -1;
	}
	return 0;
}


#ifdef USE_INET6
INLINE int
ipf_checkv6sum(fr_info_t *fin)
{
#if defined(NET_HCK_L4_FULL)
	ipf_main_softc_t *softc = fin->fin_main_soft;
#endif
	int ckbits;

	if ((fin->fin_flx & FI_NOCKSUM) != 0)
		return 0;

	if ((fin->fin_flx & FI_SHORT) != 0)
		return 1;

	if (fin->fin_cksum != FI_CK_NEEDED)
		return (fin->fin_cksum > FI_CK_NEEDED) ? 0 : -1;

#if defined(NET_HCK_L4_FULL)
	ckbits = net_ispartialchecksum(softc->ipf_nd_v6, fin->fin_m);
	if (ckbits & NET_HCK_L4_FULL) {
		fin->fin_cksum = FI_CK_L4FULL;
		return 0;
	} else if (ckbits & NET_HCK_L4_PART) {
		fin->fin_cksum = FI_CK_L4PART;
		return 0;
	}
#endif

	if (ipf_checkl4sum(fin) == -1) {
		DT1(bad_l4_sum, fr_info_t *, fin);
		fin->fin_flx |= FI_BAD;
		return -1;
	}
	return 0;
}
#endif /* USE_INET6 */


#if !defined(FW_HOOKS)
/*
 * Function:    ipf_verifysrc
 * Returns:     int (really boolean)
 * Parameters:  fin - packet information
 *
 * Check whether the packet has a valid source address for the interface on
 * which the packet arrived, implementing the "ipf_chksrc" feature.
 * Returns true iff the packet's source address is valid.
 * Pre-Solaris 10, we call into the routing code to make the determination.
 * On Solaris 10 and later, we have a valid address set from pfild to check
 * against.
 */
int
ipf_verifysrc(fin)
	fr_info_t *fin;
{
	ire_t *dir;
	int result;

#if SOLARIS2 >= 6
	dir = ire_route_lookup(fin->fin_saddr, 0xffffffff, 0, 0, NULL,
			       NULL, NULL,
# ifdef IP_ULP_OUT_LABELED
			       NULL,
# endif
			       MATCH_IRE_DSTONLY|MATCH_IRE_DEFAULT|
			       MATCH_IRE_RECURSIVE);
#else
	dir = ire_lookup(fin->fin_saddr);
#endif

	if (!dir)
		return 0;
	result = (ire_to_ill(dir) == fin->fin_ifp);
#if SOLARIS2 >= 8
	ire_refrele(dir);
#endif
	return result;
}
#else
int
ipf_verifysrc(fin)
	fr_info_t *fin;
{
	int result;

	result = (ipf_routeto(fin, fin->fin_v, &fin->fin_src) == fin->fin_ifp);
	return result;
}
#endif


#if (SOLARIS2 < 7)
static void
ipf_timer_func()
{
	ipf_call_slow_timer(&ipfmain);
}
#else
void
/*ARGSUSED*/
ipf_timer_func(ptr)
	void *ptr;
{
	ipf_call_slow_timer(ptr);
}
#endif

static void
ipf_call_slow_timer(softc)
	ipf_main_softc_t *softc;
{
	READ_ENTER(&softc->ipf_global);

	if (softc->ipf_running > 0)
		ipf_slowtimer(softc);

	if (softc->ipf_running == -1 || softc->ipf_running == 1)
		softc->ipf_slow_ch = timeout(ipf_timer_func, softc,
					     drv_usectohz(500000));
	else
		softc->ipf_slow_ch = NULL;
	RWLOCK_EXIT(&softc->ipf_global);
}


/*
 * Function:  ipf_fastroute
 * Returns:    0: success;
 *            -1: failed
 * Parameters:
 *    mb: the message block where ip head starts
 *    mpp: the pointer to the pointer of the orignal
 *            packet message
 *    fin: packet information
 *    fdp: destination interface information
 *    if it is NULL, no interface information provided.
 *
 * This function is for fastroute/to/dup-to rules. It calls
 * pfil_make_lay2_packet to search route, make lay-2 header
 * ,and identify output queue for the IP packet.
 * The destination address depends on the following conditions:
 * 1: for fastroute rule, fdp is passed in as NULL, so the
 *    destination address is the IP Packet's destination address
 * 2: for to/dup-to rule, if an ip address is specified after
 *    the interface name, this address is the as destination
 *    address. Otherwise IP Packet's destination address is used
 */
int
ipf_fastroute(mb, mpp, fin, fdp)
	mblk_t *mb, **mpp;
	fr_info_t *fin;
	frdest_t *fdp;
{
	ipf_main_softc_t *softc = fin->fin_main_soft;
	struct in_addr dst;
	qpktinfo_t *qpi;
	frdest_t node;
	frentry_t *fr;
	frdest_t fd;
	void *dstp;
	void *sifp;
	void *ifp;
	ip_t *ip;
#ifndef	sparc
	u_short __iplen, __ipoff;
#endif
#ifdef	USE_INET6
	ip6_t *ip6 = (ip6_t *)fin->fin_ip;
	struct in6_addr dst6;
#endif

	fr = fin->fin_fr;
	ip = fin->fin_ip;
	qpi = fin->fin_qpi;

	if ((fr != NULL) && !(fr->fr_flags & FR_KEEPSTATE) && (fdp != NULL) &&
	    (fdp->fd_type == FRD_DSTLIST)) {
		if (ipf_dstlist_select_node(fin, fdp->fd_ptr, NULL, &node) == 0)
			fdp = &node;
	}

	/*
	 * If this is a duplicate mblk then we want ip to point at that
	 * data, not the original, if and only if it is already pointing at
	 * the current mblk data.
	 */
	if (ip == (ip_t *)qpi->qpi_m->b_rptr && qpi->qpi_m != mb)
		ip = (ip_t *)mb->b_rptr;

	/*
	 * If there is another M_PROTO, we don't want it
	 */
	if (*mpp != mb) {
		mblk_t *mp;

		mp = unlinkb(*mpp);
		freeb(*mpp);
		*mpp = mp;
	}

	/*
	 * If the fdp is NULL then there is no set route for this packet.
	 */
	if (fdp == NULL) {
		ifp = fin->fin_ifp;

		switch (fin->fin_v)
		{
		case 4 :
			fd.fd_ip = ip->ip_dst;
			ifp = ipf_routeto(fin, 4, &ip->ip_dst);
			break;
#ifdef USE_INET6
		case 6 :
			fd.fd_ip6.in6 = ip6->ip6_dst;
			ifp = ipf_routeto(fin, 6, &ip6->ip6_dst);
			break;
#endif
		}
		fdp = &fd;
	} else {
		ifp = fdp->fd_ptr;

		if (ifp == NULL || ifp == (void *)-1)
			goto bad_fastroute;
	}

	/*
	 * In case we're here due to "to <if>" being used with
	 * "keep state", check that we're going in the correct
	 * direction.
	 */
	if ((fr != NULL) && (fin->fin_rev != 0)) {
		if ((ifp != NULL) && (fdp == &fr->fr_tif))
			return -1;
		dst.s_addr = fin->fin_fi.fi_daddr;
	} else {
		if (fin->fin_v == 4) {
			if (fdp->fd_ip.s_addr != 0)
				dst = fdp->fd_ip;
			else
				dst.s_addr = fin->fin_fi.fi_daddr;
			dstp = &dst;
		}
#ifdef USE_INET6
		else if (fin->fin_v == 6) {
			if (IP6_NOTZERO(&fdp->fd_ip))
				dst6 = fdp->fd_ip6.in6;
			else
				dst6 = fin->fin_dst6.in6;
		}
#endif
	}

	/*
	 * For input packets which are being "fastrouted", they won't
	 * go back through output filtering and miss their chance to get
	 * NAT'd and counted.  Duplicated packets aren't considered to be
	 * part of the normal packet stream, so do not NAT them or pass
	 * them through stateful checking, etc.
	 */
	if ((fdp != &fr->fr_dif) && (fin->fin_out == 0)) {
		sifp = fin->fin_ifp;
		fin->fin_ifp = ifp;
		fin->fin_out = 1;
		(void) ipf_acctpkt(fin, NULL);
		fin->fin_fr = NULL;
		if (!fr || !(fr->fr_flags & FR_RETMASK)) {
			u_32_t pass;

			(void) ipf_state_check(fin, &pass);
		}

		switch (ipf_nat_checkout(fin, NULL))
		{
		case 0 :
			break;
		case 1 :
			ip->ip_sum = 0;
			break;
		case -1 :
			goto bad_fastroute;
			break;
		}

		fin->fin_out = 0;
		fin->fin_ifp = sifp;
	} else if (fin->fin_out == 1) {
#if SOLARIS2 >= 6
		/*
		 * We're taking a packet from an interface and putting it on
		 * another interface.  There's no guarantee that the other
		 * interface will have the same capabilities, so disable
		 * any flags that are set and do things manually for both
		 * IP and TCP/UDP
		 */
		if (mb->b_datap->db_struioflag) {
			mb->b_datap->db_struioflag = 0;

			if (fin->fin_v == 4) {
				ip->ip_sum = 0;
				ip->ip_sum = ipf_cksum((u_short *)ip,
						       sizeof(*ip));
			}
			ipf_fixl4sum(fin);
		}
#endif
	}

#ifndef sparc
	if (fin->fin_v == 4) {
		__iplen = (u_short)ip->ip_len,
		__ipoff = (u_short)ip->ip_off;

		ip->ip_len = htons(__iplen);
		ip->ip_off = htons(__ipoff);
	}
#endif
	if (ipf_sendpkt(softc, 4, ifp, mb, ip, dstp) == 0) {
		ATOMIC_INCL(softc->ipf_frouteok[0]);
	} else {
		ATOMIC_INCL(softc->ipf_frouteok[1]);
	}
	return 0;

bad_fastroute:
	ATOMIC_INCL(softc->ipf_frouteok[1]);
	freemsg(mb);
	return -1;
}


/* ------------------------------------------------------------------------ */
/* Function:    ipf_pullup                                                  */
/* Returns:     NULL == pullup failed, else pointer to protocol header      */
/* Parameters:  xmin(I)- pointer to buffer where data packet starts         */
/*              fin(I) - pointer to packet information                      */
/*              len(I) - number of bytes to pullup                          */
/*                                                                          */
/* Attempt to move at least len bytes (from the start of the buffer) into a */
/* single buffer for ease of access.  Operating system native functions are */
/* used to manage buffers - if necessary.  If the entire packet ends up in  */
/* a single buffer, set the FI_COALESCE flag even though ipf_coalesce() has */
/* not been called.  Both fin_ip and fin_dp are updated before exiting _IF_ */
/* and ONLY if the pullup succeeds.                                         */
/*                                                                          */
/* We assume that 'xmin' is a pointer to a buffer that is part of the chain */
/* of buffers that starts at *fin->fin_mp.                                  */
/* ------------------------------------------------------------------------ */
void *
ipf_pullup(mb_t *xmin, fr_info_t *fin, int len)
{
	qpktinfo_t *qpi = fin->fin_qpi;
	int out = fin->fin_out, dpoff;
	char *ip;
	mb_t *m;

	if (xmin == NULL)
		return NULL;

	ip = (char *)fin->fin_ip;
	if ((fin->fin_flx & FI_COALESCE) != 0)
		return ip;

	len += fin->fin_ipoff;

	if (M_LEN(xmin) < len) {
		mblk_t *mnew = msgpullup(xmin, len);

		if (mnew == NULL) {
			FREE_MB_T(*fin->fin_mp);
			*fin->fin_mp = NULL;
			fin->fin_m = NULL;
			fin->fin_ip = NULL;
			fin->fin_dp = NULL;
			qpi->qpi_data = NULL;
			return NULL;
		}

		if (fin->fin_dp != NULL)
			dpoff = (char *)fin->fin_dp - (char *)ip;
		else
			dpoff = 0;

		if (*fin->fin_mp == xmin) {
			dblk_t *dt, *dm;

			/*
			 * These fields are not preserved by msgpullup and as
			 * they are used by hardware checksum code, preserving
			 * them is necessary or else the packet is dropped.
			 * This information is only stored in the first dblk
			 * in an mblk chain and because the change here is to
			 * how much data is in the dblk and not where the data
			 * is relative to the start of the dblk, copying the
			 * values is safe.
			 */
			dt = mnew->b_datap;
			dm = xmin->b_datap;
			dt->db_cksumstart = dm->db_cksumstart;
			dt->db_cksumend = dm->db_cksumend;
			dt->db_cksumstuff = dm->db_cksumstuff;
			dt->db_struioun = dm->db_struioun;
			freemsg(*fin->fin_mp);
			*fin->fin_mp = mnew;
		} else {
			for (m = *fin->fin_mp; m != NULL; m = m->b_cont)
				if (m->b_cont == xmin)
					break;
			freemsg(m->b_cont);
			m->b_cont = mnew;
		}

		fin->fin_qfm = mnew;
		fin->fin_m = mnew;
		ip = MTOD(mnew, char *) + fin->fin_ipoff;
		if (fin->fin_dp != NULL)
			fin->fin_dp = (char *)ip + dpoff;
		if (fin->fin_fraghdr != NULL)
			fin->fin_fraghdr = (char *)ip +
					   ((char *)fin->fin_fraghdr -
					    (char *)fin->fin_ip);
		fin->fin_ip = (ip_t *)ip;
		qpi->qpi_data = ip;
		qpi->qpi_m = mnew;
	}

	if (len == fin->fin_plen)
		fin->fin_flx |= FI_COALESCE;
	return ip;
}


int
ipf_inject(fr_info_t *fin, mb_t *m)
{
#if !defined(FW_HOOKS)
	qifpkt_t *qp;

	qp = kmem_alloc(sizeof(*qp), KM_NOSLEEP);
	if (qp == NULL) {
		freemsg(*fin->fin_mp);
		return ENOMEM;
	}

	qp->qp_mb = *fin->fin_mp;
	if (fin->fin_v == 4)
		qp->qp_sap = 0x800;
	else if (fin->fin_v == 6)
		qp->qp_sap = 0x86dd;
	qp->qp_inout = fin->fin_out;
	strncpy(qp->qp_ifname, fin->fin_ifname, LIFNAMSIZ);
	qif_addinject(qp);
#else
	ipf_main_softc_t *softc = fin->fin_main_soft;
	struct sockaddr_in6 *sin6;
	struct sockaddr_in *sin;
	net_inject_t inject;
	inject.ni_physical = (phy_if_t)fin->fin_ifp;
	inject.ni_packet = *fin->fin_mp;
	if (fin->fin_v == 4) {
		sin = (struct sockaddr_in *)&inject.ni_addr;
		sin->sin_family = AF_INET;
		sin->sin_addr = fin->fin_dst;
		if (fin->fin_out == 0)
			return net_inject(softc->ipf_nd_v4, NI_QUEUE_IN,
					  &inject);
		return net_inject(softc->ipf_nd_v4, NI_QUEUE_OUT, &inject);
	}

	sin6 = (struct sockaddr_in6 *)&inject.ni_addr;
	sin6->sin6_family = AF_INET6;
	memcpy(&sin6->sin6_addr, &fin->fin_dst6, sizeof(fin->fin_dst6));
	if (fin->fin_out == 0)
		return net_inject(softc->ipf_nd_v6, NI_QUEUE_IN, &inject);
	return net_inject(softc->ipf_nd_v6, NI_QUEUE_OUT, &inject);
#endif
}


static int
ipf_sendpkt(softc, v, ifp, mb, ip, dstp)
	ipf_main_softc_t *softc;
	int v;
	void *ifp;
	mblk_t *mb;
	struct ip *ip;
	void *dstp;
{
#if !defined(FW_HOOKS)
        return pfil_sendbuf(ifp, mb, ip, dstp);
#else
	struct sockaddr_in6 *sin6;
	struct sockaddr_in *sin;
	net_inject_t inject;

	inject.ni_physical = (phy_if_t)ifp;
	inject.ni_packet = mb;

	if (v == 4) {
		sin = (struct sockaddr_in *)&inject.ni_addr;
		sin->sin_family = AF_INET;
		memcpy(&sin->sin_addr, dstp, sizeof(sin->sin_addr));
		return net_inject(softc->ipf_nd_v4, NI_DIRECT_OUT, &inject);
	}

	sin6 = (struct sockaddr_in6 *)&inject.ni_addr;
	sin6->sin6_family = AF_INET6;
	memcpy(&sin6->sin6_addr, dstp, sizeof(sin6->sin6_addr));
	return net_inject(softc->ipf_nd_v6, NI_DIRECT_OUT, &inject);
#endif
}


static void
ipf_fixl4sum(fr_info_t *fin)
{
	u_short *csump;
	udphdr_t *udp;

	csump = NULL;

	switch (fin->fin_p)
	{
	case IPPROTO_TCP :
		csump = &((tcphdr_t *)fin->fin_dp)->th_sum;
		break;

	case IPPROTO_UDP :
		udp = fin->fin_dp;
		if (udp->uh_sum != 0)
			csump = &udp->uh_sum;
		break;

	default :
		break;
	}

	if (csump != NULL) {
		*csump = 0;
		*csump = fr_cksum(fin, fin->fin_ip, fin->fin_p, fin->fin_dp);
	}
}


mblk_t *
allocmbt(size_t len)
{
	mblk_t *m;

	/*
	 * +64 is to reverse some token amount of space so that we
	 * might have a good chance of copying over data from the
	 * front of the existing IP packet to this one.
	 */
	m = allocb(len + 128, BPRI_HI);
	if (m != NULL) {
		m->b_rptr += 128;
		m->b_wptr = m->b_rptr + len;
	}
	return m;
}


void
ipf_prependmbt(fr_info_t *fin, mblk_t *m)
{
	mblk_t *o = NULL, *top;
	mblk_t *n = *fin->fin_mp;
	qpktinfo_t *qpi;
	int x;

	qpi = fin->fin_qpi;
	qpi->qpi_m = m;
	qpi->qpi_data = m->b_rptr;

	if (MTYPE(n) == M_DATA) {
		/*
		 * The aim here is to copy x bytes of data from immediately
		 * preceding the IP packet in the original mblk to the new
		 * mblk that now precedes it.  In doing this, b_rptr in the
		 * original packet is moved so that we don't transmit data
		 * that has been moved.
		 */
		x = min(fin->fin_ipoff, m->b_rptr - m->b_datap->db_base);

		if (x > 0) {
			m->b_rptr -= x;
			bcopy(n->b_rptr, m->b_rptr, x);
			n->b_rptr += x;
		}
	} else {
		/*
		 * If there are special mblk's at the start of the current
		 * message, free them so we can put our own there.  It doesn't
		 * matter what they were as we're completely changing the
		 * nature of this packet.
		 */
		for (; n != fin->fin_m; n = o) {
			o = n->b_cont;
			n->b_cont = NULL;
			freemsg(n);
		}
	}

	m->b_cont = n;
	*fin->fin_mp = m;
	fin->fin_m = m;
}


static void *
ipf_routeto(fin, v, dstip)
	fr_info_t *fin;
	int v;
	void *dstip;
{
#if defined(FW_HOOKS)
	ipf_main_softc_t *softc = fin->fin_main_soft;
	struct sockaddr_in6 sin6;
	struct sockaddr_in sin;
	struct sockaddr *sock;
	net_handle_t proto;
	int result;

	switch (fin->fin_v)
	{
	case 4 :
		bzero((char *)&sin, sizeof(sin));
		sin.sin_family = AF_INET;
		sin.sin_addr = fin->fin_src;
		sock = (struct sockaddr *)&sin;
		proto = softc->ipf_nd_v4;
		break;

	case 6 :
		bzero((char *)&sin6, sizeof(sin6));
		sin6.sin6_family = AF_INET;
		sin6.sin6_addr = fin->fin_srcip6;
		proto = softc->ipf_nd_v6;
		break;
	default :
		return NULL;
	}
	return (void *)net_routeto(proto, sock, NULL);
#else
	return qif_illrouteto(v, dstip);
#endif
}


u_int
ipf_pcksum(fin, hlen, sum)
	fr_info_t *fin;
	int hlen;
	u_int sum;
{
	u_int sum2;

	sum2 = ip_cksum(fin->fin_m, fin->fin_ipoff + hlen, sum);
	sum2 = (~sum2 & 0xffff);
	return sum2;
}