ip_frag.c revision 1.1
1 /* $NetBSD: ip_frag.c,v 1.1 2012/03/23 20:36:56 christos Exp $ */ 2 3 /* 4 * Copyright (C) 2012 by Darren Reed. 5 * 6 * See the IPFILTER.LICENCE file for details on licencing. 7 */ 8 #if defined(KERNEL) || defined(_KERNEL) 9 # undef KERNEL 10 # undef _KERNEL 11 # define KERNEL 1 12 # define _KERNEL 1 13 #endif 14 #include <sys/errno.h> 15 #include <sys/types.h> 16 #include <sys/param.h> 17 #include <sys/time.h> 18 #include <sys/file.h> 19 #ifdef __hpux 20 # include <sys/timeout.h> 21 #endif 22 #if !defined(_KERNEL) 23 # include <stdio.h> 24 # include <string.h> 25 # include <stdlib.h> 26 # define _KERNEL 27 # ifdef __OpenBSD__ 28 struct file; 29 # endif 30 # include <sys/uio.h> 31 # undef _KERNEL 32 #endif 33 #if defined(_KERNEL) && \ 34 defined(__FreeBSD_version) && (__FreeBSD_version >= 220000) 35 # include <sys/filio.h> 36 # include <sys/fcntl.h> 37 #else 38 # include <sys/ioctl.h> 39 #endif 40 #if !defined(linux) 41 # include <sys/protosw.h> 42 #endif 43 #include <sys/socket.h> 44 #if defined(_KERNEL) 45 # include <sys/systm.h> 46 # if !defined(__SVR4) && !defined(__svr4__) 47 # include <sys/mbuf.h> 48 # endif 49 #endif 50 #if !defined(__SVR4) && !defined(__svr4__) 51 # if defined(_KERNEL) && !defined(__sgi) && !defined(AIX) 52 # include <sys/kernel.h> 53 # endif 54 #else 55 # include <sys/byteorder.h> 56 # ifdef _KERNEL 57 # include <sys/dditypes.h> 58 # endif 59 # include <sys/stream.h> 60 # include <sys/kmem.h> 61 #endif 62 #include <net/if.h> 63 #ifdef sun 64 # include <net/af.h> 65 #endif 66 #include <netinet/in.h> 67 #include <netinet/in_systm.h> 68 #include <netinet/ip.h> 69 #if !defined(linux) 70 # include <netinet/ip_var.h> 71 #endif 72 #include <netinet/tcp.h> 73 #include <netinet/udp.h> 74 #include <netinet/ip_icmp.h> 75 #include "netinet/ip_compat.h" 76 #include <netinet/tcpip.h> 77 #include "netinet/ip_fil.h" 78 #include "netinet/ip_nat.h" 79 #include "netinet/ip_frag.h" 80 #include "netinet/ip_state.h" 81 #include "netinet/ip_auth.h" 82 #include "netinet/ip_lookup.h" 83 #include "netinet/ip_proxy.h" 84 #include "netinet/ip_sync.h" 85 /* END OF INCLUDES */ 86 87 #if !defined(lint) 88 static const char sccsid[] = "@(#)ip_frag.c 1.11 3/24/96 (C) 1993-2000 Darren Reed"; 89 static const char rcsid[] = "@(#)Id"; 90 #endif 91 92 93 typedef struct ipf_frag_softc_s { 94 ipfrwlock_t ipfr_ipidfrag; 95 ipfrwlock_t ipfr_frag; 96 ipfrwlock_t ipfr_natfrag; 97 int ipfr_size; 98 int ipfr_ttl; 99 int ipfr_lock; 100 int ipfr_inited; 101 ipfr_t *ipfr_list; 102 ipfr_t **ipfr_tail; 103 ipfr_t *ipfr_natlist; 104 ipfr_t **ipfr_nattail; 105 ipfr_t *ipfr_ipidlist; 106 ipfr_t **ipfr_ipidtail; 107 ipfr_t **ipfr_heads; 108 ipfr_t **ipfr_nattab; 109 ipfr_t **ipfr_ipidtab; 110 ipfrstat_t ipfr_stats; 111 } ipf_frag_softc_t; 112 113 114 #ifdef USE_MUTEXES 115 static ipfr_t *ipfr_frag_new __P((ipf_main_softc_t *, ipf_frag_softc_t *, 116 fr_info_t *, u_32_t, ipfr_t **, 117 ipfrwlock_t *)); 118 static ipfr_t *ipf_frag_lookup __P((ipf_main_softc_t *, ipf_frag_softc_t *, fr_info_t *, ipfr_t **, ipfrwlock_t *)); 119 static void ipf_frag_deref __P((void *, ipfr_t **, ipfrwlock_t *)); 120 static int ipf_frag_next __P((ipf_main_softc_t *, ipftoken_t *, ipfgeniter_t *, 121 ipfr_t **, ipfrwlock_t *)); 122 #else 123 static ipfr_t *ipfr_frag_new __P((ipf_main_softc_t *, ipf_frag_softc_t *, 124 fr_info_t *, u_32_t, ipfr_t **)); 125 static ipfr_t *ipf_frag_lookup __P((ipf_main_softc_t *, ipf_frag_softc_t *, fr_info_t *, ipfr_t **)); 126 static void ipf_frag_deref __P((void *, ipfr_t **)); 127 static int ipf_frag_next __P((ipf_main_softc_t *, ipftoken_t *, ipfgeniter_t *, 128 ipfr_t **)); 129 #endif 130 static void ipf_frag_delete __P((ipf_main_softc_t *, ipfr_t *, ipfr_t ***)); 131 static void ipf_frag_free __P((ipf_frag_softc_t *, ipfr_t *)); 132 133 static frentry_t ipfr_block; 134 135 ipftuneable_t ipf_tuneables[] = { 136 { { (void *)offsetof(ipf_frag_softc_t, ipfr_size) }, 137 "frag_size", 1, 0x7fffffff, 138 stsizeof(ipf_frag_softc_t, ipfr_size), 139 IPFT_WRDISABLED, NULL, NULL }, 140 { { (void *)offsetof(ipf_frag_softc_t, ipfr_ttl) }, 141 "frag_ttl", 1, 0x7fffffff, 142 stsizeof(ipf_frag_softc_t, ipfr_ttl), 143 0, NULL, NULL }, 144 { { NULL }, 145 NULL, 0, 0, 146 0, 147 0, NULL, NULL } 148 }; 149 150 #define FBUMP(x) softf->ipfr_stats.x++ 151 #define FBUMPD(x) do { softf->ipfr_stats.x++; DT(x); } while (0) 152 153 154 /* ------------------------------------------------------------------------ */ 155 /* Function: ipf_frag_main_load */ 156 /* Returns: int - 0 == success, -1 == error */ 157 /* Parameters: Nil */ 158 /* */ 159 /* Initialise the filter rule associted with blocked packets - everyone can */ 160 /* use it. */ 161 /* ------------------------------------------------------------------------ */ 162 int 163 ipf_frag_main_load() 164 { 165 bzero((char *)&ipfr_block, sizeof(ipfr_block)); 166 ipfr_block.fr_flags = FR_BLOCK|FR_QUICK; 167 ipfr_block.fr_ref = 1; 168 169 return 0; 170 } 171 172 173 /* ------------------------------------------------------------------------ */ 174 /* Function: ipf_frag_main_unload */ 175 /* Returns: int - 0 == success, -1 == error */ 176 /* Parameters: Nil */ 177 /* */ 178 /* A null-op function that exists as a placeholder so that the flow in */ 179 /* other functions is obvious. */ 180 /* ------------------------------------------------------------------------ */ 181 int 182 ipf_frag_main_unload() 183 { 184 return 0; 185 } 186 187 188 /* ------------------------------------------------------------------------ */ 189 /* Function: ipf_frag_soft_create */ 190 /* Returns: void * - NULL = failure, else pointer to local context */ 191 /* Parameters: softc(I) - pointer to soft context main structure */ 192 /* */ 193 /* Allocate a new soft context structure to track fragment related info. */ 194 /* ------------------------------------------------------------------------ */ 195 /*ARGSUSED*/ 196 void * 197 ipf_frag_soft_create(softc) 198 ipf_main_softc_t *softc; 199 { 200 ipf_frag_softc_t *softf; 201 202 KMALLOC(softf, ipf_frag_softc_t *); 203 if (softf == NULL) 204 return NULL; 205 206 bzero((char *)softf, sizeof(*softf)); 207 208 RWLOCK_INIT(&softf->ipfr_ipidfrag, "frag ipid lock"); 209 RWLOCK_INIT(&softf->ipfr_frag, "ipf fragment rwlock"); 210 RWLOCK_INIT(&softf->ipfr_natfrag, "ipf NAT fragment rwlock"); 211 212 softf->ipfr_size = IPFT_SIZE; 213 softf->ipfr_ttl = IPF_TTLVAL(60); 214 softf->ipfr_lock = 1; 215 softf->ipfr_tail = &softf->ipfr_list; 216 softf->ipfr_nattail = &softf->ipfr_natlist; 217 softf->ipfr_ipidtail = &softf->ipfr_ipidlist; 218 219 return softf; 220 } 221 222 223 /* ------------------------------------------------------------------------ */ 224 /* Function: ipf_frag_soft_destroy */ 225 /* Returns: Nil */ 226 /* Parameters: softc(I) - pointer to soft context main structure */ 227 /* arg(I) - pointer to local context to use */ 228 /* */ 229 /* Initialise the hash tables for the fragment cache lookups. */ 230 /* ------------------------------------------------------------------------ */ 231 void 232 ipf_frag_soft_destroy(softc, arg) 233 ipf_main_softc_t *softc; 234 void *arg; 235 { 236 ipf_frag_softc_t *softf = arg; 237 238 RW_DESTROY(&softf->ipfr_ipidfrag); 239 RW_DESTROY(&softf->ipfr_frag); 240 RW_DESTROY(&softf->ipfr_natfrag); 241 242 KFREE(softf); 243 } 244 245 246 /* ------------------------------------------------------------------------ */ 247 /* Function: ipf_frag_soft_init */ 248 /* Returns: int - 0 == success, -1 == error */ 249 /* Parameters: softc(I) - pointer to soft context main structure */ 250 /* arg(I) - pointer to local context to use */ 251 /* */ 252 /* Initialise the hash tables for the fragment cache lookups. */ 253 /* ------------------------------------------------------------------------ */ 254 /*ARGSUSED*/ 255 int 256 ipf_frag_soft_init(softc, arg) 257 ipf_main_softc_t *softc; 258 void *arg; 259 { 260 ipf_frag_softc_t *softf = arg; 261 262 KMALLOCS(softf->ipfr_heads, ipfr_t **, 263 softf->ipfr_size * sizeof(ipfr_t *)); 264 if (softf->ipfr_heads == NULL) 265 return -1; 266 267 bzero((char *)softf->ipfr_heads, softf->ipfr_size * sizeof(ipfr_t *)); 268 269 KMALLOCS(softf->ipfr_nattab, ipfr_t **, 270 softf->ipfr_size * sizeof(ipfr_t *)); 271 if (softf->ipfr_nattab == NULL) 272 return -2; 273 274 bzero((char *)softf->ipfr_nattab, softf->ipfr_size * sizeof(ipfr_t *)); 275 276 KMALLOCS(softf->ipfr_ipidtab, ipfr_t **, 277 softf->ipfr_size * sizeof(ipfr_t *)); 278 if (softf->ipfr_ipidtab == NULL) 279 return -3; 280 281 bzero((char *)softf->ipfr_ipidtab, 282 softf->ipfr_size * sizeof(ipfr_t *)); 283 284 softf->ipfr_lock = 0; 285 softf->ipfr_inited = 1; 286 287 return 0; 288 } 289 290 291 /* ------------------------------------------------------------------------ */ 292 /* Function: ipf_frag_soft_fini */ 293 /* Returns: int - 0 == success, -1 == error */ 294 /* Parameters: softc(I) - pointer to soft context main structure */ 295 /* arg(I) - pointer to local context to use */ 296 /* */ 297 /* Free all memory allocated whilst running and from initialisation. */ 298 /* ------------------------------------------------------------------------ */ 299 int 300 ipf_frag_soft_fini(softc, arg) 301 ipf_main_softc_t *softc; 302 void *arg; 303 { 304 ipf_frag_softc_t *softf = arg; 305 306 softf->ipfr_lock = 1; 307 308 if (softf->ipfr_inited == 1) { 309 ipf_frag_clear(softc); 310 311 softf->ipfr_inited = 0; 312 } 313 314 if (softf->ipfr_heads != NULL) 315 KFREES(softf->ipfr_heads, 316 softf->ipfr_size * sizeof(ipfr_t *)); 317 softf->ipfr_heads = NULL; 318 319 if (softf->ipfr_nattab != NULL) 320 KFREES(softf->ipfr_nattab, 321 softf->ipfr_size * sizeof(ipfr_t *)); 322 softf->ipfr_nattab = NULL; 323 324 if (softf->ipfr_ipidtab != NULL) 325 KFREES(softf->ipfr_ipidtab, 326 softf->ipfr_size * sizeof(ipfr_t *)); 327 softf->ipfr_ipidtab = NULL; 328 329 return 0; 330 } 331 332 333 /* ------------------------------------------------------------------------ */ 334 /* Function: ipf_frag_set_lock */ 335 /* Returns: Nil */ 336 /* Parameters: arg(I) - pointer to local context to use */ 337 /* tmp(I) - new value for lock */ 338 /* */ 339 /* Stub function that allows for external manipulation of ipfr_lock */ 340 /* ------------------------------------------------------------------------ */ 341 void 342 ipf_frag_setlock(arg, tmp) 343 void *arg; 344 int tmp; 345 { 346 ipf_frag_softc_t *softf = arg; 347 348 softf->ipfr_lock = tmp; 349 } 350 351 352 /* ------------------------------------------------------------------------ */ 353 /* Function: ipf_frag_stats */ 354 /* Returns: ipfrstat_t* - pointer to struct with current frag stats */ 355 /* Parameters: arg(I) - pointer to local context to use */ 356 /* */ 357 /* Updates ipfr_stats with current information and returns a pointer to it */ 358 /* ------------------------------------------------------------------------ */ 359 ipfrstat_t * 360 ipf_frag_stats(arg) 361 void *arg; 362 { 363 ipf_frag_softc_t *softf = arg; 364 365 softf->ipfr_stats.ifs_table = softf->ipfr_heads; 366 softf->ipfr_stats.ifs_nattab = softf->ipfr_nattab; 367 return &softf->ipfr_stats; 368 } 369 370 371 /* ------------------------------------------------------------------------ */ 372 /* Function: ipfr_frag_new */ 373 /* Returns: ipfr_t * - pointer to fragment cache state info or NULL */ 374 /* Parameters: fin(I) - pointer to packet information */ 375 /* table(I) - pointer to frag table to add to */ 376 /* lock(I) - pointer to lock to get a write hold of */ 377 /* */ 378 /* Add a new entry to the fragment cache, registering it as having come */ 379 /* through this box, with the result of the filter operation. */ 380 /* */ 381 /* If this function succeeds, it returns with a write lock held on "lock". */ 382 /* If it fails, no lock is held on return. */ 383 /* ------------------------------------------------------------------------ */ 384 static ipfr_t * 385 ipfr_frag_new(softc, softf, fin, pass, table 386 #ifdef USE_MUTEXES 387 , lock 388 #endif 389 ) 390 ipf_main_softc_t *softc; 391 ipf_frag_softc_t *softf; 392 fr_info_t *fin; 393 u_32_t pass; 394 ipfr_t *table[]; 395 #ifdef USE_MUTEXES 396 ipfrwlock_t *lock; 397 #endif 398 { 399 ipfr_t *fra, frag, *fran; 400 u_int idx, off; 401 frentry_t *fr; 402 403 if (softf->ipfr_stats.ifs_inuse >= softf->ipfr_size) { 404 FBUMPD(ifs_maximum); 405 return NULL; 406 } 407 408 if ((fin->fin_flx & (FI_FRAG|FI_BAD)) != FI_FRAG) { 409 FBUMPD(ifs_newbad); 410 return NULL; 411 } 412 413 if (pass & FR_FRSTRICT) { 414 if (fin->fin_off != 0) { 415 FBUMPD(ifs_newrestrictnot0); 416 return NULL; 417 } 418 } 419 420 frag.ipfr_v = fin->fin_v; 421 idx = fin->fin_v; 422 frag.ipfr_p = fin->fin_p; 423 idx += fin->fin_p; 424 frag.ipfr_id = fin->fin_id; 425 idx += fin->fin_id; 426 frag.ipfr_source = fin->fin_fi.fi_src; 427 idx += frag.ipfr_src.s_addr; 428 frag.ipfr_dest = fin->fin_fi.fi_dst; 429 idx += frag.ipfr_dst.s_addr; 430 frag.ipfr_ifp = fin->fin_ifp; 431 idx *= 127; 432 idx %= softf->ipfr_size; 433 434 frag.ipfr_optmsk = fin->fin_fi.fi_optmsk & IPF_OPTCOPY; 435 frag.ipfr_secmsk = fin->fin_fi.fi_secmsk; 436 frag.ipfr_auth = fin->fin_fi.fi_auth; 437 438 off = fin->fin_off >> 3; 439 #ifdef USE_INET6 440 if ((off == 0) && (fin->fin_v == 6)) { 441 char *ptr; 442 int end; 443 444 ptr = (char *)fin->fin_fraghdr + sizeof(struct ip6_frag); 445 end = fin->fin_plen - (ptr - (char *)fin->fin_ip); 446 frag.ipfr_firstend = end >> 3; 447 } else 448 #endif 449 frag.ipfr_firstend = 0; 450 451 /* 452 * allocate some memory, if possible, if not, just record that we 453 * failed to do so. 454 */ 455 KMALLOC(fran, ipfr_t *); 456 if (fran == NULL) { 457 FBUMPD(ifs_nomem); 458 return NULL; 459 } 460 461 WRITE_ENTER(lock); 462 463 /* 464 * first, make sure it isn't already there... 465 */ 466 for (fra = table[idx]; (fra != NULL); fra = fra->ipfr_hnext) 467 if (!bcmp((char *)&frag.ipfr_ifp, (char *)&fra->ipfr_ifp, 468 IPFR_CMPSZ)) { 469 RWLOCK_EXIT(lock); 470 FBUMPD(ifs_exists); 471 KFREE(fra); 472 return NULL; 473 } 474 475 fra = fran; 476 fran = NULL; 477 fr = fin->fin_fr; 478 fra->ipfr_rule = fr; 479 if (fr != NULL) { 480 MUTEX_ENTER(&fr->fr_lock); 481 fr->fr_ref++; 482 MUTEX_EXIT(&fr->fr_lock); 483 } 484 485 /* 486 * Insert the fragment into the fragment table, copy the struct used 487 * in the search using bcopy rather than reassign each field. 488 * Set the ttl to the default. 489 */ 490 if ((fra->ipfr_hnext = table[idx]) != NULL) 491 table[idx]->ipfr_hprev = &fra->ipfr_hnext; 492 fra->ipfr_hprev = table + idx; 493 fra->ipfr_data = NULL; 494 table[idx] = fra; 495 bcopy((char *)&frag.ipfr_ifp, (char *)&fra->ipfr_ifp, IPFR_CMPSZ); 496 fra->ipfr_v = fin->fin_v; 497 fra->ipfr_ttl = softc->ipf_ticks + softf->ipfr_ttl; 498 fra->ipfr_firstend = frag.ipfr_firstend; 499 500 /* 501 * Compute the offset of the expected start of the next packet. 502 */ 503 if (off == 0) 504 fra->ipfr_seen0 = 1; 505 fra->ipfr_off = off + (fin->fin_dlen >> 3); 506 fra->ipfr_pass = pass; 507 fra->ipfr_ref = 1; 508 fra->ipfr_pkts = 1; 509 fra->ipfr_bytes = fin->fin_plen; 510 FBUMP(ifs_inuse); 511 FBUMP(ifs_new); 512 return fra; 513 } 514 515 516 /* ------------------------------------------------------------------------ */ 517 /* Function: ipf_frag_new */ 518 /* Returns: int - 0 == success, -1 == error */ 519 /* Parameters: fin(I) - pointer to packet information */ 520 /* */ 521 /* Add a new entry to the fragment cache table based on the current packet */ 522 /* ------------------------------------------------------------------------ */ 523 int 524 ipf_frag_new(softc, fin, pass) 525 ipf_main_softc_t *softc; 526 u_32_t pass; 527 fr_info_t *fin; 528 { 529 ipf_frag_softc_t *softf = softc->ipf_frag_soft; 530 ipfr_t *fra; 531 532 if (softf->ipfr_lock != 0) 533 return -1; 534 535 #ifdef USE_MUTEXES 536 fra = ipfr_frag_new(softc, softf, fin, pass, softf->ipfr_heads, &softc->ipf_frag); 537 #else 538 fra = ipfr_frag_new(softc, softf, fin, pass, softf->ipfr_heads); 539 #endif 540 if (fra != NULL) { 541 *softf->ipfr_tail = fra; 542 fra->ipfr_prev = softf->ipfr_tail; 543 softf->ipfr_tail = &fra->ipfr_next; 544 fra->ipfr_next = NULL; 545 RWLOCK_EXIT(&softc->ipf_frag); 546 } 547 return fra ? 0 : -1; 548 } 549 550 551 /* ------------------------------------------------------------------------ */ 552 /* Function: ipf_frag_natnew */ 553 /* Returns: int - 0 == success, -1 == error */ 554 /* Parameters: fin(I) - pointer to packet information */ 555 /* nat(I) - pointer to NAT structure */ 556 /* */ 557 /* Create a new NAT fragment cache entry based on the current packet and */ 558 /* the NAT structure for this "session". */ 559 /* ------------------------------------------------------------------------ */ 560 int 561 ipf_frag_natnew(softc, fin, pass, nat) 562 ipf_main_softc_t *softc; 563 fr_info_t *fin; 564 u_32_t pass; 565 nat_t *nat; 566 { 567 ipf_frag_softc_t *softf = softc->ipf_frag_soft; 568 ipfr_t *fra; 569 570 if ((fin->fin_v != 4) || (softf->ipfr_lock != 0)) 571 return 0; 572 573 #ifdef USE_MUTEXES 574 fra = ipfr_frag_new(softc, softf, fin, pass, softf->ipfr_nattab, 575 &softf->ipfr_natfrag); 576 #else 577 fra = ipfr_frag_new(softc, softf, fin, pass, softf->ipfr_nattab); 578 #endif 579 if (fra != NULL) { 580 fra->ipfr_data = nat; 581 nat->nat_data = fra; 582 *softf->ipfr_nattail = fra; 583 fra->ipfr_prev = softf->ipfr_nattail; 584 softf->ipfr_nattail = &fra->ipfr_next; 585 fra->ipfr_next = NULL; 586 RWLOCK_EXIT(&softf->ipfr_natfrag); 587 } 588 return fra ? 0 : -1; 589 } 590 591 592 /* ------------------------------------------------------------------------ */ 593 /* Function: ipf_frag_ipidnew */ 594 /* Returns: int - 0 == success, -1 == error */ 595 /* Parameters: fin(I) - pointer to packet information */ 596 /* ipid(I) - new IP ID for this fragmented packet */ 597 /* */ 598 /* Create a new fragment cache entry for this packet and store, as a data */ 599 /* pointer, the new IP ID value. */ 600 /* ------------------------------------------------------------------------ */ 601 int 602 ipf_frag_ipidnew(fin, ipid) 603 fr_info_t *fin; 604 u_32_t ipid; 605 { 606 ipf_main_softc_t *softc = fin->fin_main_soft; 607 ipf_frag_softc_t *softf = softc->ipf_frag_soft; 608 ipfr_t *fra; 609 610 if (softf->ipfr_lock) 611 return 0; 612 613 #ifdef USE_MUTEXES 614 fra = ipfr_frag_new(softc, softf, fin, 0, softf->ipfr_ipidtab, &softf->ipfr_ipidfrag); 615 #else 616 fra = ipfr_frag_new(softc, softf, fin, 0, softf->ipfr_ipidtab); 617 #endif 618 if (fra != NULL) { 619 fra->ipfr_data = (void *)(intptr_t)ipid; 620 *softf->ipfr_ipidtail = fra; 621 fra->ipfr_prev = softf->ipfr_ipidtail; 622 softf->ipfr_ipidtail = &fra->ipfr_next; 623 fra->ipfr_next = NULL; 624 RWLOCK_EXIT(&softf->ipfr_ipidfrag); 625 } 626 return fra ? 0 : -1; 627 } 628 629 630 /* ------------------------------------------------------------------------ */ 631 /* Function: ipf_frag_lookup */ 632 /* Returns: ipfr_t * - pointer to ipfr_t structure if there's a */ 633 /* matching entry in the frag table, else NULL */ 634 /* Parameters: fin(I) - pointer to packet information */ 635 /* table(I) - pointer to fragment cache table to search */ 636 /* */ 637 /* Check the fragment cache to see if there is already a record of this */ 638 /* packet with its filter result known. */ 639 /* */ 640 /* If this function succeeds, it returns with a write lock held on "lock". */ 641 /* If it fails, no lock is held on return. */ 642 /* ------------------------------------------------------------------------ */ 643 static ipfr_t * 644 ipf_frag_lookup(softc, softf, fin, table 645 #ifdef USE_MUTEXES 646 , lock 647 #endif 648 ) 649 ipf_main_softc_t *softc; 650 ipf_frag_softc_t *softf; 651 fr_info_t *fin; 652 ipfr_t *table[]; 653 #ifdef USE_MUTEXES 654 ipfrwlock_t *lock; 655 #endif 656 { 657 ipfr_t *f, frag; 658 u_int idx; 659 660 /* 661 * We don't want to let short packets match because they could be 662 * compromising the security of other rules that want to match on 663 * layer 4 fields (and can't because they have been fragmented off.) 664 * Why do this check here? The counter acts as an indicator of this 665 * kind of attack, whereas if it was elsewhere, it wouldn't know if 666 * other matching packets had been seen. 667 */ 668 if (fin->fin_flx & FI_SHORT) { 669 FBUMPD(ifs_short); 670 return NULL; 671 } 672 673 if ((fin->fin_flx & FI_BAD) != 0) { 674 FBUMPD(ifs_bad); 675 return NULL; 676 } 677 678 /* 679 * For fragments, we record protocol, packet id, TOS and both IP#'s 680 * (these should all be the same for all fragments of a packet). 681 * 682 * build up a hash value to index the table with. 683 */ 684 frag.ipfr_v = fin->fin_v; 685 idx = fin->fin_v; 686 frag.ipfr_p = fin->fin_p; 687 idx += fin->fin_p; 688 frag.ipfr_id = fin->fin_id; 689 idx += fin->fin_id; 690 frag.ipfr_source = fin->fin_fi.fi_src; 691 idx += frag.ipfr_src.s_addr; 692 frag.ipfr_dest = fin->fin_fi.fi_dst; 693 idx += frag.ipfr_dst.s_addr; 694 frag.ipfr_ifp = fin->fin_ifp; 695 idx *= 127; 696 idx %= softf->ipfr_size; 697 698 frag.ipfr_optmsk = fin->fin_fi.fi_optmsk & IPF_OPTCOPY; 699 frag.ipfr_secmsk = fin->fin_fi.fi_secmsk; 700 frag.ipfr_auth = fin->fin_fi.fi_auth; 701 702 READ_ENTER(lock); 703 704 /* 705 * check the table, careful to only compare the right amount of data 706 */ 707 for (f = table[idx]; f; f = f->ipfr_hnext) { 708 if (!bcmp((char *)&frag.ipfr_ifp, (char *)&f->ipfr_ifp, 709 IPFR_CMPSZ)) { 710 u_short off; 711 712 /* 713 * XXX - We really need to be guarding against the 714 * retransmission of (src,dst,id,offset-range) here 715 * because a fragmented packet is never resent with 716 * the same IP ID# (or shouldn't). 717 */ 718 off = fin->fin_off >> 3; 719 if (f->ipfr_seen0) { 720 if (off == 0) { 721 FBUMPD(ifs_retrans0); 722 continue; 723 } 724 725 /* 726 * Case 3. See comment for frpr_fragment6. 727 */ 728 if ((f->ipfr_firstend != 0) && 729 (off < f->ipfr_firstend)) { 730 FBUMPD(ifs_overlap); 731 fin->fin_flx |= FI_BAD; 732 break; 733 } 734 } else if (off == 0) 735 f->ipfr_seen0 = 1; 736 737 if (f != table[idx]) { 738 ipfr_t **fp; 739 740 /* 741 * Move fragment info. to the top of the list 742 * to speed up searches. First, delink... 743 */ 744 fp = f->ipfr_hprev; 745 (*fp) = f->ipfr_hnext; 746 if (f->ipfr_hnext != NULL) 747 f->ipfr_hnext->ipfr_hprev = fp; 748 /* 749 * Then put back at the top of the chain. 750 */ 751 f->ipfr_hnext = table[idx]; 752 table[idx]->ipfr_hprev = &f->ipfr_hnext; 753 f->ipfr_hprev = table + idx; 754 table[idx] = f; 755 } 756 757 /* 758 * If we've follwed the fragments, and this is the 759 * last (in order), shrink expiration time. 760 */ 761 if (off == f->ipfr_off) { 762 f->ipfr_off = (fin->fin_dlen >> 3) + off; 763 764 /* 765 * Well, we could shrink the expiration time 766 * but only if every fragment has been seen 767 * in order upto this, the last. ipfr_badorder 768 * is used here to count those out of order 769 * and if it equals 0 when we get to the last 770 * fragment then we can assume all of the 771 * fragments have been seen and in order. 772 */ 773 #if 0 774 /* 775 * Doing this properly requires moving it to 776 * the head of the list which is infesible. 777 */ 778 if ((more == 0) && (f->ipfr_badorder == 0)) 779 f->ipfr_ttl = softc->ipf_ticks + 1; 780 #endif 781 } else { 782 f->ipfr_badorder++; 783 FBUMPD(ifs_unordered); 784 if (f->ipfr_pass & FR_FRSTRICT) { 785 FBUMPD(ifs_strict); 786 continue; 787 } 788 } 789 f->ipfr_pkts++; 790 f->ipfr_bytes += fin->fin_plen; 791 FBUMP(ifs_hits); 792 return f; 793 } 794 } 795 796 RWLOCK_EXIT(lock); 797 FBUMP(ifs_miss); 798 return NULL; 799 } 800 801 802 /* ------------------------------------------------------------------------ */ 803 /* Function: ipf_frag_natknown */ 804 /* Returns: nat_t* - pointer to 'parent' NAT structure if frag table */ 805 /* match found, else NULL */ 806 /* Parameters: fin(I) - pointer to packet information */ 807 /* */ 808 /* Functional interface for NAT lookups of the NAT fragment cache */ 809 /* ------------------------------------------------------------------------ */ 810 nat_t * 811 ipf_frag_natknown(fin) 812 fr_info_t *fin; 813 { 814 ipf_main_softc_t *softc = fin->fin_main_soft; 815 ipf_frag_softc_t *softf = softc->ipf_frag_soft; 816 nat_t *nat; 817 ipfr_t *ipf; 818 819 if ((softf->ipfr_lock) || !softf->ipfr_natlist) 820 return NULL; 821 #ifdef USE_MUTEXES 822 ipf = ipf_frag_lookup(softc, softf, fin, softf->ipfr_nattab, 823 &softf->ipfr_natfrag); 824 #else 825 ipf = ipf_frag_lookup(softc, softf, fin, softf->ipfr_nattab); 826 #endif 827 if (ipf != NULL) { 828 nat = ipf->ipfr_data; 829 /* 830 * This is the last fragment for this packet. 831 */ 832 if ((ipf->ipfr_ttl == softc->ipf_ticks + 1) && (nat != NULL)) { 833 nat->nat_data = NULL; 834 ipf->ipfr_data = NULL; 835 } 836 RWLOCK_EXIT(&softf->ipfr_natfrag); 837 } else 838 nat = NULL; 839 return nat; 840 } 841 842 843 /* ------------------------------------------------------------------------ */ 844 /* Function: ipf_frag_ipidknown */ 845 /* Returns: u_32_t - IPv4 ID for this packet if match found, else */ 846 /* return 0xfffffff to indicate no match. */ 847 /* Parameters: fin(I) - pointer to packet information */ 848 /* */ 849 /* Functional interface for IP ID lookups of the IP ID fragment cache */ 850 /* ------------------------------------------------------------------------ */ 851 u_32_t 852 ipf_frag_ipidknown(fin) 853 fr_info_t *fin; 854 { 855 ipf_main_softc_t *softc = fin->fin_main_soft; 856 ipf_frag_softc_t *softf = softc->ipf_frag_soft; 857 ipfr_t *ipf; 858 u_32_t id; 859 860 if ((fin->fin_v != 4) || (softf->ipfr_lock) || 861 !softf->ipfr_ipidlist) 862 return 0xffffffff; 863 864 #ifdef USE_MUTEXES 865 ipf = ipf_frag_lookup(softc, softf, fin, softf->ipfr_ipidtab, 866 &softf->ipfr_ipidfrag); 867 #else 868 ipf = ipf_frag_lookup(softc, softf, fin, softf->ipfr_ipidtab); 869 #endif 870 if (ipf != NULL) { 871 id = (u_32_t)(intptr_t)ipf->ipfr_data; 872 RWLOCK_EXIT(&softf->ipfr_ipidfrag); 873 } else 874 id = 0xffffffff; 875 return id; 876 } 877 878 879 /* ------------------------------------------------------------------------ */ 880 /* Function: ipf_frag_known */ 881 /* Returns: frentry_t* - pointer to filter rule if a match is found in */ 882 /* the frag cache table, else NULL. */ 883 /* Parameters: fin(I) - pointer to packet information */ 884 /* passp(O) - pointer to where to store rule flags resturned */ 885 /* */ 886 /* Functional interface for normal lookups of the fragment cache. If a */ 887 /* match is found, return the rule pointer and flags from the rule, except */ 888 /* that if FR_LOGFIRST is set, reset FR_LOG. */ 889 /* ------------------------------------------------------------------------ */ 890 frentry_t * 891 ipf_frag_known(fin, passp) 892 fr_info_t *fin; 893 u_32_t *passp; 894 { 895 ipf_main_softc_t *softc = fin->fin_main_soft; 896 ipf_frag_softc_t *softf = softc->ipf_frag_soft; 897 frentry_t *fr = NULL; 898 ipfr_t *fra; 899 u_32_t pass; 900 901 if ((softf->ipfr_lock) || (softf->ipfr_list == NULL)) 902 return NULL; 903 904 #ifdef USE_MUTEXES 905 fra = ipf_frag_lookup(softc, softf, fin, softf->ipfr_heads, 906 &softc->ipf_frag); 907 #else 908 fra = ipf_frag_lookup(softc, softf, fin, softf->ipfr_heads); 909 #endif 910 if (fra != NULL) { 911 if (fin->fin_flx & FI_BAD) { 912 fr = &ipfr_block; 913 fin->fin_reason = FRB_BADFRAG; 914 } else { 915 fr = fra->ipfr_rule; 916 } 917 fin->fin_fr = fr; 918 if (fr != NULL) { 919 pass = fr->fr_flags; 920 if ((pass & FR_KEEPSTATE) != 0) { 921 fin->fin_flx |= FI_STATE; 922 /* 923 * Reset the keep state flag here so that we 924 * don't try and add a new state entry because 925 * of a match here. That leads to blocking of 926 * the packet later because the add fails. 927 */ 928 pass &= ~FR_KEEPSTATE; 929 } 930 if ((pass & FR_LOGFIRST) != 0) 931 pass &= ~(FR_LOGFIRST|FR_LOG); 932 *passp = pass; 933 } 934 RWLOCK_EXIT(&softc->ipf_frag); 935 } 936 return fr; 937 } 938 939 940 /* ------------------------------------------------------------------------ */ 941 /* Function: ipf_frag_natforget */ 942 /* Returns: Nil */ 943 /* Parameters: ptr(I) - pointer to data structure */ 944 /* */ 945 /* Search through all of the fragment cache entries for NAT and wherever a */ 946 /* pointer is found to match ptr, reset it to NULL. */ 947 /* ------------------------------------------------------------------------ */ 948 void 949 ipf_frag_natforget(softc, ptr) 950 ipf_main_softc_t *softc; 951 void *ptr; 952 { 953 ipf_frag_softc_t *softf = softc->ipf_frag_soft; 954 ipfr_t *fr; 955 956 WRITE_ENTER(&softf->ipfr_natfrag); 957 for (fr = softf->ipfr_natlist; fr; fr = fr->ipfr_next) 958 if (fr->ipfr_data == ptr) 959 fr->ipfr_data = NULL; 960 RWLOCK_EXIT(&softf->ipfr_natfrag); 961 } 962 963 964 /* ------------------------------------------------------------------------ */ 965 /* Function: ipf_frag_delete */ 966 /* Returns: Nil */ 967 /* Parameters: fra(I) - pointer to fragment structure to delete */ 968 /* tail(IO) - pointer to the pointer to the tail of the frag */ 969 /* list */ 970 /* */ 971 /* Remove a fragment cache table entry from the table & list. Also free */ 972 /* the filter rule it is associated with it if it is no longer used as a */ 973 /* result of decreasing the reference count. */ 974 /* ------------------------------------------------------------------------ */ 975 static void 976 ipf_frag_delete(softc, fra, tail) 977 ipf_main_softc_t *softc; 978 ipfr_t *fra, ***tail; 979 { 980 ipf_frag_softc_t *softf = softc->ipf_frag_soft; 981 982 if (fra->ipfr_next) 983 fra->ipfr_next->ipfr_prev = fra->ipfr_prev; 984 *fra->ipfr_prev = fra->ipfr_next; 985 if (*tail == &fra->ipfr_next) 986 *tail = fra->ipfr_prev; 987 988 if (fra->ipfr_hnext) 989 fra->ipfr_hnext->ipfr_hprev = fra->ipfr_hprev; 990 *fra->ipfr_hprev = fra->ipfr_hnext; 991 992 if (fra->ipfr_rule != NULL) { 993 (void) ipf_derefrule(softc, &fra->ipfr_rule); 994 } 995 996 if (fra->ipfr_ref <= 0) 997 ipf_frag_free(softf, fra); 998 } 999 1000 1001 /* ------------------------------------------------------------------------ */ 1002 /* Function: ipf_frag_free */ 1003 /* Returns: Nil */ 1004 /* */ 1005 /* ------------------------------------------------------------------------ */ 1006 static void 1007 ipf_frag_free(softf, fra) 1008 ipf_frag_softc_t *softf; 1009 ipfr_t *fra; 1010 { 1011 KFREE(fra); 1012 FBUMP(ifs_expire); 1013 softf->ipfr_stats.ifs_inuse--; 1014 } 1015 1016 1017 /* ------------------------------------------------------------------------ */ 1018 /* Function: ipf_frag_clear */ 1019 /* Returns: Nil */ 1020 /* Parameters: Nil */ 1021 /* */ 1022 /* Free memory in use by fragment state information kept. Do the normal */ 1023 /* fragment state stuff first and then the NAT-fragment table. */ 1024 /* ------------------------------------------------------------------------ */ 1025 void 1026 ipf_frag_clear(softc) 1027 ipf_main_softc_t *softc; 1028 { 1029 ipf_frag_softc_t *softf = softc->ipf_frag_soft; 1030 ipfr_t *fra; 1031 nat_t *nat; 1032 1033 WRITE_ENTER(&softc->ipf_frag); 1034 while ((fra = softf->ipfr_list) != NULL) { 1035 fra->ipfr_ref--; 1036 ipf_frag_delete(softc, fra, &softf->ipfr_tail); 1037 } 1038 softf->ipfr_tail = &softf->ipfr_list; 1039 RWLOCK_EXIT(&softc->ipf_frag); 1040 1041 WRITE_ENTER(&softc->ipf_nat); 1042 WRITE_ENTER(&softf->ipfr_natfrag); 1043 while ((fra = softf->ipfr_natlist) != NULL) { 1044 nat = fra->ipfr_data; 1045 if (nat != NULL) { 1046 if (nat->nat_data == fra) 1047 nat->nat_data = NULL; 1048 } 1049 fra->ipfr_ref--; 1050 ipf_frag_delete(softc, fra, &softf->ipfr_nattail); 1051 } 1052 softf->ipfr_nattail = &softf->ipfr_natlist; 1053 RWLOCK_EXIT(&softf->ipfr_natfrag); 1054 RWLOCK_EXIT(&softc->ipf_nat); 1055 } 1056 1057 1058 /* ------------------------------------------------------------------------ */ 1059 /* Function: ipf_frag_expire */ 1060 /* Returns: Nil */ 1061 /* Parameters: Nil */ 1062 /* */ 1063 /* Expire entries in the fragment cache table that have been there too long */ 1064 /* ------------------------------------------------------------------------ */ 1065 void 1066 ipf_frag_expire(softc) 1067 ipf_main_softc_t *softc; 1068 { 1069 ipf_frag_softc_t *softf = softc->ipf_frag_soft; 1070 ipfr_t **fp, *fra; 1071 nat_t *nat; 1072 SPL_INT(s); 1073 1074 if (softf->ipfr_lock) 1075 return; 1076 1077 SPL_NET(s); 1078 WRITE_ENTER(&softc->ipf_frag); 1079 /* 1080 * Go through the entire table, looking for entries to expire, 1081 * which is indicated by the ttl being less than or equal to ipf_ticks. 1082 */ 1083 for (fp = &softf->ipfr_list; ((fra = *fp) != NULL); ) { 1084 if (fra->ipfr_ttl > softc->ipf_ticks) 1085 break; 1086 fra->ipfr_ref--; 1087 ipf_frag_delete(softc, fra, &softf->ipfr_tail); 1088 } 1089 RWLOCK_EXIT(&softc->ipf_frag); 1090 1091 WRITE_ENTER(&softf->ipfr_ipidfrag); 1092 for (fp = &softf->ipfr_ipidlist; ((fra = *fp) != NULL); ) { 1093 if (fra->ipfr_ttl > softc->ipf_ticks) 1094 break; 1095 fra->ipfr_ref--; 1096 ipf_frag_delete(softc, fra, &softf->ipfr_ipidtail); 1097 } 1098 RWLOCK_EXIT(&softf->ipfr_ipidfrag); 1099 1100 /* 1101 * Same again for the NAT table, except that if the structure also 1102 * still points to a NAT structure, and the NAT structure points back 1103 * at the one to be free'd, NULL the reference from the NAT struct. 1104 * NOTE: We need to grab both mutex's early, and in this order so as 1105 * to prevent a deadlock if both try to expire at the same time. 1106 * The extra if() statement here is because it locks out all NAT 1107 * operations - no need to do that if there are no entries in this 1108 * list, right? 1109 */ 1110 if (softf->ipfr_natlist != NULL) { 1111 WRITE_ENTER(&softc->ipf_nat); 1112 WRITE_ENTER(&softf->ipfr_natfrag); 1113 for (fp = &softf->ipfr_natlist; ((fra = *fp) != NULL); ) { 1114 if (fra->ipfr_ttl > softc->ipf_ticks) 1115 break; 1116 nat = fra->ipfr_data; 1117 if (nat != NULL) { 1118 if (nat->nat_data == fra) 1119 nat->nat_data = NULL; 1120 } 1121 fra->ipfr_ref--; 1122 ipf_frag_delete(softc, fra, &softf->ipfr_nattail); 1123 } 1124 RWLOCK_EXIT(&softf->ipfr_natfrag); 1125 RWLOCK_EXIT(&softc->ipf_nat); 1126 } 1127 SPL_X(s); 1128 } 1129 1130 1131 /* ------------------------------------------------------------------------ */ 1132 /* Function: ipf_frag_pkt_next */ 1133 /* ------------------------------------------------------------------------ */ 1134 int 1135 ipf_frag_pkt_next(softc, token, itp) 1136 ipf_main_softc_t *softc; 1137 ipftoken_t *token; 1138 ipfgeniter_t *itp; 1139 { 1140 ipf_frag_softc_t *softf = softc->ipf_frag_soft; 1141 1142 #ifdef USE_MUTEXES 1143 return ipf_frag_next(softc, token, itp, &softf->ipfr_list, 1144 &softf->ipfr_frag); 1145 #else 1146 return ipf_frag_next(softc, token, itp, &softf->ipfr_list); 1147 #endif 1148 } 1149 1150 1151 /* ------------------------------------------------------------------------ */ 1152 /* Function: ipf_frag_nat_next */ 1153 /* ------------------------------------------------------------------------ */ 1154 int 1155 ipf_frag_nat_next(softc, token, itp) 1156 ipf_main_softc_t *softc; 1157 ipftoken_t *token; 1158 ipfgeniter_t *itp; 1159 { 1160 ipf_frag_softc_t *softf = softc->ipf_frag_soft;; 1161 1162 #ifdef USE_MUTEXES 1163 return ipf_frag_next(softc, token, itp, &softf->ipfr_natlist, 1164 &softf->ipfr_natfrag); 1165 #else 1166 return ipf_frag_next(softc, token, itp, &softf->ipfr_natlist); 1167 #endif 1168 } 1169 1170 /* ------------------------------------------------------------------------ */ 1171 /* Function: ipf_frag_next */ 1172 /* Returns: int - 0 == success, else error */ 1173 /* Parameters: token(I) - pointer to token information for this caller */ 1174 /* itp(I) - pointer to generic iterator from caller */ 1175 /* top(I) - top of the fragment list */ 1176 /* lock(I) - fragment cache lock */ 1177 /* */ 1178 /* This function is used to interate through the list of entries in the */ 1179 /* fragment cache. It increases the reference count on the one currently */ 1180 /* being returned so that the caller can come back and resume from it later.*/ 1181 /* */ 1182 /* This function is used for both the NAT fragment cache as well as the ipf */ 1183 /* fragment cache - hence the reason for passing in top and lock. */ 1184 /* ------------------------------------------------------------------------ */ 1185 static int 1186 ipf_frag_next(softc, token, itp, top 1187 #ifdef USE_MUTEXES 1188 , lock 1189 #endif 1190 ) 1191 ipf_main_softc_t *softc; 1192 ipftoken_t *token; 1193 ipfgeniter_t *itp; 1194 ipfr_t **top; 1195 #ifdef USE_MUTEXES 1196 ipfrwlock_t *lock; 1197 #endif 1198 { 1199 ipfr_t *frag, *next, zero; 1200 int error = 0; 1201 1202 if (itp->igi_data == NULL) { 1203 IPFERROR(20001); 1204 return EFAULT; 1205 } 1206 1207 if (itp->igi_nitems != 1) { 1208 IPFERROR(20003); 1209 return EFAULT; 1210 } 1211 1212 frag = token->ipt_data; 1213 1214 READ_ENTER(lock); 1215 1216 if (frag == NULL) 1217 next = *top; 1218 else 1219 next = frag->ipfr_next; 1220 1221 if (next != NULL) { 1222 ATOMIC_INC(next->ipfr_ref); 1223 token->ipt_data = next; 1224 } else { 1225 bzero(&zero, sizeof(zero)); 1226 next = &zero; 1227 token->ipt_data = NULL; 1228 } 1229 if (next->ipfr_next == NULL) 1230 ipf_token_mark_complete(token); 1231 1232 RWLOCK_EXIT(lock); 1233 1234 error = COPYOUT(next, itp->igi_data, sizeof(*next)); 1235 if (error != 0) 1236 IPFERROR(20002); 1237 1238 if (frag != NULL) { 1239 #ifdef USE_MUTEXES 1240 ipf_frag_deref(softc, &frag, lock); 1241 #else 1242 ipf_frag_deref(softc, &frag); 1243 #endif 1244 } 1245 return error; 1246 } 1247 1248 1249 /* ------------------------------------------------------------------------ */ 1250 /* Function: ipf_frag_pkt_deref */ 1251 /* Returns: Nil */ 1252 /* */ 1253 /* ------------------------------------------------------------------------ */ 1254 void 1255 ipf_frag_pkt_deref(softc, data) 1256 ipf_main_softc_t *softc; 1257 void *data; 1258 { 1259 ipfr_t **frp = data; 1260 1261 #ifdef USE_MUTEXES 1262 ipf_frag_softc_t *softf = softc->ipf_frag_soft; 1263 1264 ipf_frag_deref(softc->ipf_frag_soft, frp, &softf->ipfr_frag); 1265 #else 1266 ipf_frag_deref(softc->ipf_frag_soft, frp); 1267 #endif 1268 } 1269 1270 1271 /* ------------------------------------------------------------------------ */ 1272 /* Function: ipf_frag_nat_deref */ 1273 /* Returns: Nil */ 1274 /* */ 1275 /* ------------------------------------------------------------------------ */ 1276 void 1277 ipf_frag_nat_deref(softc, data) 1278 ipf_main_softc_t *softc; 1279 void *data; 1280 { 1281 ipfr_t **frp = data; 1282 1283 #ifdef USE_MUTEXES 1284 ipf_frag_softc_t *softf = softc->ipf_frag_soft; 1285 1286 ipf_frag_deref(softc->ipf_frag_soft, frp, &softf->ipfr_natfrag); 1287 #else 1288 ipf_frag_deref(softc->ipf_frag_soft, frp); 1289 #endif 1290 } 1291 1292 1293 /* ------------------------------------------------------------------------ */ 1294 /* Function: ipf_frag_deref */ 1295 /* Returns: Nil */ 1296 /* Parameters: frp(IO) - pointer to fragment structure to deference */ 1297 /* lock(I) - lock associated with the fragment */ 1298 /* */ 1299 /* This function dereferences a fragment structure (ipfr_t). The pointer */ 1300 /* passed in will always be reset back to NULL, even if the structure is */ 1301 /* not freed, to enforce the notion that the caller is no longer entitled */ 1302 /* to use the pointer it is dropping the reference to. */ 1303 /* ------------------------------------------------------------------------ */ 1304 static void 1305 ipf_frag_deref(arg, frp 1306 #ifdef USE_MUTEXES 1307 , lock 1308 #endif 1309 ) 1310 void *arg; 1311 ipfr_t **frp; 1312 #ifdef USE_MUTEXES 1313 ipfrwlock_t *lock; 1314 #endif 1315 { 1316 ipf_frag_softc_t *softf = arg; 1317 ipfr_t *fra; 1318 1319 fra = *frp; 1320 *frp = NULL; 1321 1322 WRITE_ENTER(lock); 1323 fra->ipfr_ref--; 1324 if (fra->ipfr_ref <= 0) 1325 ipf_frag_free(softf, fra); 1326 RWLOCK_EXIT(lock); 1327 } 1328
Indexes created Wed Sep 24 02:09:48 GMT 2025