| 3960 | } |
| 3961 | |
| 3962 | static int |
| 3963 | pf_test_fragment(struct pf_krule **rm, int direction, struct pfi_kkif *kif, |
| 3964 | struct mbuf *m, void *h, struct pf_pdesc *pd, struct pf_krule **am, |
| 3965 | struct pf_kruleset **rsm) |
| 3966 | { |
| 3967 | struct pf_krule *r, *a = NULL; |
| 3968 | struct pf_kruleset *ruleset = NULL; |
| 3969 | sa_family_t af = pd->af; |
| 3970 | u_short reason; |
| 3971 | int tag = -1; |
| 3972 | int asd = 0; |
| 3973 | int match = 0; |
| 3974 | struct pf_kanchor_stackframe anchor_stack[PF_ANCHOR_STACKSIZE]; |
| 3975 | |
| 3976 | PF_RULES_RASSERT(); |
| 3977 | |
| 3978 | r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); |
| 3979 | while (r != NULL) { |
| 3980 | counter_u64_add(r->evaluations, 1); |
| 3981 | if (pfi_kkif_match(r->kif, kif) == r->ifnot) |
| 3982 | r = r->skip[PF_SKIP_IFP].ptr; |
| 3983 | else if (r->direction && r->direction != direction) |
| 3984 | r = r->skip[PF_SKIP_DIR].ptr; |
| 3985 | else if (r->af && r->af != af) |
| 3986 | r = r->skip[PF_SKIP_AF].ptr; |
| 3987 | else if (r->proto && r->proto != pd->proto) |
| 3988 | r = r->skip[PF_SKIP_PROTO].ptr; |
| 3989 | else if (PF_MISMATCHAW(&r->src.addr, pd->src, af, |
| 3990 | r->src.neg, kif, M_GETFIB(m))) |
| 3991 | r = r->skip[PF_SKIP_SRC_ADDR].ptr; |
| 3992 | else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af, |
| 3993 | r->dst.neg, NULL, M_GETFIB(m))) |
| 3994 | r = r->skip[PF_SKIP_DST_ADDR].ptr; |
| 3995 | else if (r->tos && !(r->tos == pd->tos)) |
| 3996 | r = TAILQ_NEXT(r, entries); |
| 3997 | else if (r->os_fingerprint != PF_OSFP_ANY) |
| 3998 | r = TAILQ_NEXT(r, entries); |
| 3999 | else if (pd->proto == IPPROTO_UDP && |
| 4000 | (r->src.port_op || r->dst.port_op)) |
| 4001 | r = TAILQ_NEXT(r, entries); |
| 4002 | else if (pd->proto == IPPROTO_TCP && |
| 4003 | (r->src.port_op || r->dst.port_op || r->flagset)) |
| 4004 | r = TAILQ_NEXT(r, entries); |
| 4005 | else if ((pd->proto == IPPROTO_ICMP || |
| 4006 | pd->proto == IPPROTO_ICMPV6) && |
| 4007 | (r->type || r->code)) |
| 4008 | r = TAILQ_NEXT(r, entries); |
| 4009 | else if (r->prio && |
| 4010 | !pf_match_ieee8021q_pcp(r->prio, m)) |
| 4011 | r = TAILQ_NEXT(r, entries); |
| 4012 | else if (r->prob && r->prob <= |
| 4013 | (arc4random() % (UINT_MAX - 1) + 1)) |
| 4014 | r = TAILQ_NEXT(r, entries); |
| 4015 | else if (r->match_tag && !pf_match_tag(m, r, &tag, |
| 4016 | pd->pf_mtag ? pd->pf_mtag->tag : 0)) |
| 4017 | r = TAILQ_NEXT(r, entries); |
| 4018 | else { |
| 4019 | if (r->anchor == NULL) { |
no test coverage detected