sys/contrib/ipfilter/netinet/ip_frag.c

   1 /*      $FreeBSD$       */
   2
   3 /*
   4  * Copyright (C) 2012 by Darren Reed.
   5  *
   6  * See the IPFILTER.LICENCE file for details on licencing.
   7  */
   8 #if defined(KERNEL) || defined(_KERNEL)
   9 # undef KERNEL
  10 # undef _KERNEL
  11 # define        KERNEL  1
  12 # define        _KERNEL 1
  13 #endif
  14 #include <sys/errno.h>
  15 #include <sys/types.h>
  16 #include <sys/param.h>
  17 #include <sys/time.h>
  18 #include <sys/file.h>
  19 #ifdef __hpux
  20 # include <sys/timeout.h>
  21 #endif
  22 #if !defined(_KERNEL)
  23 # include <stdio.h>
  24 # include <string.h>
  25 # include <stdlib.h>
  26 # define _KERNEL
  27 # ifdef __OpenBSD__
  28 struct file;
  29 # endif
  30 # include <sys/uio.h>
  31 # undef _KERNEL
  32 #endif
  33 #if defined(_KERNEL) && \
  34     defined(__FreeBSD_version) && (__FreeBSD_version >= 220000)
  35 # include <sys/filio.h>
  36 # include <sys/fcntl.h>
  37 #else
  38 # include <sys/ioctl.h>
  39 #endif
  40 #if !defined(linux)
  41 # include <sys/protosw.h>
  42 #endif
  43 #include <sys/socket.h>
  44 #if defined(_KERNEL)
  45 # include <sys/systm.h>
  46 # if !defined(__SVR4) && !defined(__svr4__)
  47 #  include <sys/mbuf.h>
  48 # endif
  49 #endif
  50 #if !defined(__SVR4) && !defined(__svr4__)
  51 # if defined(_KERNEL) && !defined(__sgi) && !defined(AIX)
  52 #  include <sys/kernel.h>
  53 # endif
  54 #else
  55 # include <sys/byteorder.h>
  56 # ifdef _KERNEL
  57 #  include <sys/dditypes.h>
  58 # endif
  59 # include <sys/stream.h>
  60 # include <sys/kmem.h>
  61 #endif
  62 #include <net/if.h>
  63 #ifdef sun
  64 # include <net/af.h>
  65 #endif
  66 #include <netinet/in.h>
  67 #include <netinet/in_systm.h>
  68 #include <netinet/ip.h>
  69 #if !defined(linux)
  70 # include <netinet/ip_var.h>
  71 #endif
  72 #include <netinet/tcp.h>
  73 #include <netinet/udp.h>
  74 #include <netinet/ip_icmp.h>
  75 #include "netinet/ip_compat.h"
  76 #include <netinet/tcpip.h>
  77 #include "netinet/ip_fil.h"
  78 #include "netinet/ip_nat.h"
  79 #include "netinet/ip_frag.h"
  80 #include "netinet/ip_state.h"
  81 #include "netinet/ip_auth.h"
  82 #include "netinet/ip_lookup.h"
  83 #include "netinet/ip_proxy.h"
  84 #include "netinet/ip_sync.h"
  85 /* END OF INCLUDES */
  86
  87 #if !defined(lint)
  88 static const char sccsid[] = "@(#)ip_frag.c     1.11 3/24/96 (C) 1993-2000 Darren Reed";
  89 static const char rcsid[] = "@(#)$FreeBSD$";
  90 /* static const char rcsid[] = "@(#)$Id: ip_frag.c,v 2.77.2.12 2007/09/20 12:51:51 darrenr Exp $"; */
  91 #endif
  92
  93
  94 #ifdef USE_MUTEXES
  95 static ipfr_t *ipfr_frag_new __P((ipf_main_softc_t *, ipf_frag_softc_t *,
  96                                   fr_info_t *, u_32_t, ipfr_t **,
  97                                   ipfrwlock_t *));
  98 static ipfr_t *ipf_frag_lookup __P((ipf_main_softc_t *, ipf_frag_softc_t *, fr_info_t *, ipfr_t **, ipfrwlock_t *));
  99 static void ipf_frag_deref __P((void *, ipfr_t **, ipfrwlock_t *));
 100 static int ipf_frag_next __P((ipf_main_softc_t *, ipftoken_t *, ipfgeniter_t *,
 101                               ipfr_t **, ipfrwlock_t *));
 102 #else
 103 static ipfr_t *ipfr_frag_new __P((ipf_main_softc_t *, ipf_frag_softc_t *,
 104                                   fr_info_t *, u_32_t, ipfr_t **));
 105 static ipfr_t *ipf_frag_lookup __P((ipf_main_softc_t *, ipf_frag_softc_t *, fr_info_t *, ipfr_t **));
 106 static void ipf_frag_deref __P((void *, ipfr_t **));
 107 static int ipf_frag_next __P((ipf_main_softc_t *, ipftoken_t *, ipfgeniter_t *,
 108                               ipfr_t **));
 109 #endif
 110 static void ipf_frag_delete __P((ipf_main_softc_t *, ipfr_t *, ipfr_t ***));
 111 static void ipf_frag_free __P((ipf_frag_softc_t *, ipfr_t *));
 112
 113 static frentry_t ipfr_block;
 114
 115 const ipftuneable_t ipf_tuneables[] = {
 116         { { (void *)offsetof(ipf_frag_softc_t, ipfr_size) },
 117                 "frag_size",            1,      0x7fffffff,
 118                 stsizeof(ipf_frag_softc_t, ipfr_size),
 119                 IPFT_WRDISABLED,        NULL,   NULL },
 120         { { (void *)offsetof(ipf_frag_softc_t, ipfr_ttl) },
 121                 "frag_ttl",             1,      0x7fffffff,
 122                 stsizeof(ipf_frag_softc_t, ipfr_ttl),
 123                 0,                      NULL,   NULL },
 124         { { NULL },
 125                 NULL,                   0,      0,
 126                 0,
 127                 0,                      NULL,   NULL }
 128 };
 129
 130 #define FBUMP(x)        softf->ipfr_stats.x++
 131 #define FBUMPD(x)       do { softf->ipfr_stats.x++; DT(x); } while (0)
 132
 133
 134 /* ------------------------------------------------------------------------ */
 135 /* Function:    ipf_frag_main_load                                          */
 136 /* Returns:     int - 0 == success, -1 == error                             */
 137 /* Parameters:  Nil                                                         */
 138 /*                                                                          */
 139 /* Initialise the filter rule associted with blocked packets - everyone can */
 140 /* use it.                                                                  */
 141 /* ------------------------------------------------------------------------ */
 142 int
 143 ipf_frag_main_load()
 144 {
 145         bzero((char *)&ipfr_block, sizeof(ipfr_block));
 146         ipfr_block.fr_flags = FR_BLOCK|FR_QUICK;
 147         ipfr_block.fr_ref = 1;
 148
 149         return 0;
 150 }
 151
 152
 153 /* ------------------------------------------------------------------------ */
 154 /* Function:    ipf_frag_main_unload                                        */
 155 /* Returns:     int - 0 == success, -1 == error                             */
 156 /* Parameters:  Nil                                                         */
 157 /*                                                                          */
 158 /* A null-op function that exists as a placeholder so that the flow in      */
 159 /* other functions is obvious.                                              */
 160 /* ------------------------------------------------------------------------ */
 161 int
 162 ipf_frag_main_unload()
 163 {
 164         return 0;
 165 }
 166
 167
 168 /* ------------------------------------------------------------------------ */
 169 /* Function:    ipf_frag_soft_create                                        */
 170 /* Returns:     void *   - NULL = failure, else pointer to local context    */
 171 /* Parameters:  softc(I) - pointer to soft context main structure           */
 172 /*                                                                          */
 173 /* Allocate a new soft context structure to track fragment related info.    */
 174 /* ------------------------------------------------------------------------ */
 175 /*ARGSUSED*/
 176 void *
 177 ipf_frag_soft_create(softc)
 178         ipf_main_softc_t *softc;
 179 {
 180         ipf_frag_softc_t *softf;
 181
 182         KMALLOC(softf, ipf_frag_softc_t *);
 183         if (softf == NULL)
 184                 return NULL;
 185
 186         bzero((char *)softf, sizeof(*softf));
 187
 188         RWLOCK_INIT(&softf->ipfr_ipidfrag, "frag ipid lock");
 189         RWLOCK_INIT(&softf->ipfr_frag, "ipf fragment rwlock");
 190         RWLOCK_INIT(&softf->ipfr_natfrag, "ipf NAT fragment rwlock");
 191
 192         softf->ipfr_size = IPFT_SIZE;
 193         softf->ipfr_ttl = IPF_TTLVAL(60);
 194         softf->ipfr_lock = 1;
 195         softf->ipfr_tail = &softf->ipfr_list;
 196         softf->ipfr_nattail = &softf->ipfr_natlist;
 197         softf->ipfr_ipidtail = &softf->ipfr_ipidlist;
 198
 199         return softf;
 200 }
 201
 202
 203 /* ------------------------------------------------------------------------ */
 204 /* Function:    ipf_frag_soft_destroy                                       */
 205 /* Returns:     Nil                                                         */
 206 /* Parameters:  softc(I) - pointer to soft context main structure           */
 207 /*              arg(I)   - pointer to local context to use                  */
 208 /*                                                                          */
 209 /* Initialise the hash tables for the fragment cache lookups.               */
 210 /* ------------------------------------------------------------------------ */
 211 void
 212 ipf_frag_soft_destroy(softc, arg)
 213         ipf_main_softc_t *softc;
 214         void *arg;
 215 {
 216         ipf_frag_softc_t *softf = arg;
 217
 218         RW_DESTROY(&softf->ipfr_ipidfrag);
 219         RW_DESTROY(&softf->ipfr_frag);
 220         RW_DESTROY(&softf->ipfr_natfrag);
 221
 222         KFREE(softf);
 223 }
 224
 225
 226 /* ------------------------------------------------------------------------ */
 227 /* Function:    ipf_frag_soft_init                                          */
 228 /* Returns:     int      - 0 == success, -1 == error                        */
 229 /* Parameters:  softc(I) - pointer to soft context main structure           */
 230 /*              arg(I)   - pointer to local context to use                  */
 231 /*                                                                          */
 232 /* Initialise the hash tables for the fragment cache lookups.               */
 233 /* ------------------------------------------------------------------------ */
 234 /*ARGSUSED*/
 235 int
 236 ipf_frag_soft_init(softc, arg)
 237         ipf_main_softc_t *softc;
 238         void *arg;
 239 {
 240         ipf_frag_softc_t *softf = arg;
 241
 242         KMALLOCS(softf->ipfr_heads, ipfr_t **,
 243                  softf->ipfr_size * sizeof(ipfr_t *));
 244         if (softf->ipfr_heads == NULL)
 245                 return -1;
 246
 247         bzero((char *)softf->ipfr_heads, softf->ipfr_size * sizeof(ipfr_t *));
 248
 249         KMALLOCS(softf->ipfr_nattab, ipfr_t **,
 250                  softf->ipfr_size * sizeof(ipfr_t *));
 251         if (softf->ipfr_nattab == NULL)
 252                 return -2;
 253
 254         bzero((char *)softf->ipfr_nattab, softf->ipfr_size * sizeof(ipfr_t *));
 255
 256         KMALLOCS(softf->ipfr_ipidtab, ipfr_t **,
 257                  softf->ipfr_size * sizeof(ipfr_t *));
 258         if (softf->ipfr_ipidtab == NULL)
 259                 return -3;
 260
 261         bzero((char *)softf->ipfr_ipidtab,
 262               softf->ipfr_size * sizeof(ipfr_t *));
 263
 264         softf->ipfr_lock = 0;
 265         softf->ipfr_inited = 1;
 266
 267         return 0;
 268 }
 269
 270
 271 /* ------------------------------------------------------------------------ */
 272 /* Function:    ipf_frag_soft_fini                                          */
 273 /* Returns:     int      - 0 == success, -1 == error                        */
 274 /* Parameters:  softc(I) - pointer to soft context main structure           */
 275 /*              arg(I)   - pointer to local context to use                  */
 276 /*                                                                          */
 277 /* Free all memory allocated whilst running and from initialisation.        */
 278 /* ------------------------------------------------------------------------ */
 279 int
 280 ipf_frag_soft_fini(softc, arg)
 281         ipf_main_softc_t *softc;
 282         void *arg;
 283 {
 284         ipf_frag_softc_t *softf = arg;
 285
 286         softf->ipfr_lock = 1;
 287
 288         if (softf->ipfr_inited == 1) {
 289                 ipf_frag_clear(softc);
 290
 291                 softf->ipfr_inited = 0;
 292         }
 293
 294         if (softf->ipfr_heads != NULL)
 295                 KFREES(softf->ipfr_heads,
 296                        softf->ipfr_size * sizeof(ipfr_t *));
 297         softf->ipfr_heads = NULL;
 298
 299         if (softf->ipfr_nattab != NULL)
 300                 KFREES(softf->ipfr_nattab,
 301                        softf->ipfr_size * sizeof(ipfr_t *));
 302         softf->ipfr_nattab = NULL;
 303
 304         if (softf->ipfr_ipidtab != NULL)
 305                 KFREES(softf->ipfr_ipidtab,
 306                        softf->ipfr_size * sizeof(ipfr_t *));
 307         softf->ipfr_ipidtab = NULL;
 308
 309         return 0;
 310 }
 311
 312
 313 /* ------------------------------------------------------------------------ */
 314 /* Function:    ipf_frag_set_lock                                           */
 315 /* Returns:     Nil                                                         */
 316 /* Parameters:  arg(I) - pointer to local context to use                    */
 317 /*              tmp(I) - new value for lock                                 */
 318 /*                                                                          */
 319 /* Stub function that allows for external manipulation of ipfr_lock         */
 320 /* ------------------------------------------------------------------------ */
 321 void
 322 ipf_frag_setlock(arg, tmp)
 323         void *arg;
 324         int tmp;
 325 {
 326         ipf_frag_softc_t *softf = arg;
 327
 328         softf->ipfr_lock = tmp;
 329 }
 330
 331
 332 /* ------------------------------------------------------------------------ */
 333 /* Function:    ipf_frag_stats                                              */
 334 /* Returns:     ipfrstat_t* - pointer to struct with current frag stats     */
 335 /* Parameters:  arg(I) - pointer to local context to use                    */
 336 /*                                                                          */
 337 /* Updates ipfr_stats with current information and returns a pointer to it  */
 338 /* ------------------------------------------------------------------------ */
 339 ipfrstat_t *
 340 ipf_frag_stats(arg)
 341         void *arg;
 342 {
 343         ipf_frag_softc_t *softf = arg;
 344
 345         softf->ipfr_stats.ifs_table = softf->ipfr_heads;
 346         softf->ipfr_stats.ifs_nattab = softf->ipfr_nattab;
 347         return &softf->ipfr_stats;
 348 }
 349
 350
 351 /* ------------------------------------------------------------------------ */
 352 /* Function:    ipfr_frag_new                                               */
 353 /* Returns:     ipfr_t * - pointer to fragment cache state info or NULL     */
 354 /* Parameters:  fin(I)   - pointer to packet information                    */
 355 /*              table(I) - pointer to frag table to add to                  */
 356 /*              lock(I)  - pointer to lock to get a write hold of           */
 357 /*                                                                          */
 358 /* Add a new entry to the fragment cache, registering it as having come     */
 359 /* through this box, with the result of the filter operation.               */
 360 /*                                                                          */
 361 /* If this function succeeds, it returns with a write lock held on "lock".  */
 362 /* If it fails, no lock is held on return.                                  */
 363 /* ------------------------------------------------------------------------ */
 364 static ipfr_t *
 365 ipfr_frag_new(softc, softf, fin, pass, table
 366 #ifdef USE_MUTEXES
 367 , lock
 368 #endif
 369 )
 370         ipf_main_softc_t *softc;
 371         ipf_frag_softc_t *softf;
 372         fr_info_t *fin;
 373         u_32_t pass;
 374         ipfr_t *table[];
 375 #ifdef USE_MUTEXES
 376         ipfrwlock_t *lock;
 377 #endif
 378 {
 379         ipfr_t *fra, frag, *fran;
 380         u_int idx, off;
 381         frentry_t *fr;
 382
 383         if (softf->ipfr_stats.ifs_inuse >= softf->ipfr_size) {
 384                 FBUMPD(ifs_maximum);
 385                 return NULL;
 386         }
 387
 388         if ((fin->fin_flx & (FI_FRAG|FI_BAD)) != FI_FRAG) {
 389                 FBUMPD(ifs_newbad);
 390                 return NULL;
 391         }
 392
 393         if (pass & FR_FRSTRICT) {
 394                 if (fin->fin_off != 0) {
 395                         FBUMPD(ifs_newrestrictnot0);
 396                         return NULL;
 397                 }
 398         }
 399
 400         frag.ipfr_v = fin->fin_v;
 401         idx = fin->fin_v;
 402         frag.ipfr_p = fin->fin_p;
 403         idx += fin->fin_p;
 404         frag.ipfr_id = fin->fin_id;
 405         idx += fin->fin_id;
 406         frag.ipfr_source = fin->fin_fi.fi_src;
 407         idx += frag.ipfr_src.s_addr;
 408         frag.ipfr_dest = fin->fin_fi.fi_dst;
 409         idx += frag.ipfr_dst.s_addr;
 410         frag.ipfr_ifp = fin->fin_ifp;
 411         idx *= 127;
 412         idx %= softf->ipfr_size;
 413
 414         frag.ipfr_optmsk = fin->fin_fi.fi_optmsk & IPF_OPTCOPY;
 415         frag.ipfr_secmsk = fin->fin_fi.fi_secmsk;
 416         frag.ipfr_auth = fin->fin_fi.fi_auth;
 417
 418         off = fin->fin_off >> 3;
 419         if (off == 0) {
 420                 char *ptr;
 421                 int end;
 422
 423 #ifdef USE_INET6
 424                 if (fin->fin_v == 6) {
 425
 426                         ptr = (char *)fin->fin_fraghdr +
 427                               sizeof(struct ip6_frag);
 428                 } else
 429 #endif
 430                 {
 431                         ptr = fin->fin_dp;
 432                 }
 433                 end = fin->fin_plen - (ptr - (char *)fin->fin_ip);
 434                 frag.ipfr_firstend = end >> 3;
 435         } else {
 436                 frag.ipfr_firstend = 0;
 437         }
 438
 439         /*
 440          * allocate some memory, if possible, if not, just record that we
 441          * failed to do so.
 442          */
 443         KMALLOC(fran, ipfr_t *);
 444         if (fran == NULL) {
 445                 FBUMPD(ifs_nomem);
 446                 return NULL;
 447         }
 448
 449         WRITE_ENTER(lock);
 450
 451         /*
 452          * first, make sure it isn't already there...
 453          */
 454         for (fra = table[idx]; (fra != NULL); fra = fra->ipfr_hnext)
 455                 if (!bcmp((char *)&frag.ipfr_ifp, (char *)&fra->ipfr_ifp,
 456                           IPFR_CMPSZ)) {
 457                         RWLOCK_EXIT(lock);
 458                         FBUMPD(ifs_exists);
 459                         KFREE(fra);
 460                         return NULL;
 461                 }
 462
 463         fra = fran;
 464         fran = NULL;
 465         fr = fin->fin_fr;
 466         fra->ipfr_rule = fr;
 467         if (fr != NULL) {
 468                 MUTEX_ENTER(&fr->fr_lock);
 469                 fr->fr_ref++;
 470                 MUTEX_EXIT(&fr->fr_lock);
 471         }
 472
 473         /*
 474          * Insert the fragment into the fragment table, copy the struct used
 475          * in the search using bcopy rather than reassign each field.
 476          * Set the ttl to the default.
 477          */
 478         if ((fra->ipfr_hnext = table[idx]) != NULL)
 479                 table[idx]->ipfr_hprev = &fra->ipfr_hnext;
 480         fra->ipfr_hprev = table + idx;
 481         fra->ipfr_data = NULL;
 482         table[idx] = fra;
 483         bcopy((char *)&frag.ipfr_ifp, (char *)&fra->ipfr_ifp, IPFR_CMPSZ);
 484         fra->ipfr_v = fin->fin_v;
 485         fra->ipfr_ttl = softc->ipf_ticks + softf->ipfr_ttl;
 486         fra->ipfr_firstend = frag.ipfr_firstend;
 487
 488         /*
 489          * Compute the offset of the expected start of the next packet.
 490          */
 491         if (off == 0)
 492                 fra->ipfr_seen0 = 1;
 493         fra->ipfr_off = off + (fin->fin_dlen >> 3);
 494         fra->ipfr_pass = pass;
 495         fra->ipfr_ref = 1;
 496         fra->ipfr_pkts = 1;
 497         fra->ipfr_bytes = fin->fin_plen;
 498         FBUMP(ifs_inuse);
 499         FBUMP(ifs_new);
 500         return fra;
 501 }
 502
 503
 504 /* ------------------------------------------------------------------------ */
 505 /* Function:    ipf_frag_new                                                */
 506 /* Returns:     int - 0 == success, -1 == error                             */
 507 /* Parameters:  fin(I)  - pointer to packet information                     */
 508 /*                                                                          */
 509 /* Add a new entry to the fragment cache table based on the current packet  */
 510 /* ------------------------------------------------------------------------ */
 511 int
 512 ipf_frag_new(softc, fin, pass)
 513         ipf_main_softc_t *softc;
 514         u_32_t pass;
 515         fr_info_t *fin;
 516 {
 517         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
 518         ipfr_t  *fra;
 519
 520         if (softf->ipfr_lock != 0)
 521                 return -1;
 522
 523 #ifdef USE_MUTEXES
 524         fra = ipfr_frag_new(softc, softf, fin, pass, softf->ipfr_heads, &softc->ipf_frag);
 525 #else
 526         fra = ipfr_frag_new(softc, softf, fin, pass, softf->ipfr_heads);
 527 #endif
 528         if (fra != NULL) {
 529                 *softf->ipfr_tail = fra;
 530                 fra->ipfr_prev = softf->ipfr_tail;
 531                 softf->ipfr_tail = &fra->ipfr_next;
 532                 fra->ipfr_next = NULL;
 533                 RWLOCK_EXIT(&softc->ipf_frag);
 534         }
 535         return fra ? 0 : -1;
 536 }
 537
 538
 539 /* ------------------------------------------------------------------------ */
 540 /* Function:    ipf_frag_natnew                                             */
 541 /* Returns:     int - 0 == success, -1 == error                             */
 542 /* Parameters:  fin(I)  - pointer to packet information                     */
 543 /*              nat(I)  - pointer to NAT structure                          */
 544 /*                                                                          */
 545 /* Create a new NAT fragment cache entry based on the current packet and    */
 546 /* the NAT structure for this "session".                                    */
 547 /* ------------------------------------------------------------------------ */
 548 int
 549 ipf_frag_natnew(softc, fin, pass, nat)
 550         ipf_main_softc_t *softc;
 551         fr_info_t *fin;
 552         u_32_t pass;
 553         nat_t *nat;
 554 {
 555         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
 556         ipfr_t  *fra;
 557
 558         if (softf->ipfr_lock != 0)
 559                 return 0;
 560
 561 #ifdef USE_MUTEXES
 562         fra = ipfr_frag_new(softc, softf, fin, pass, softf->ipfr_nattab,
 563                             &softf->ipfr_natfrag);
 564 #else
 565         fra = ipfr_frag_new(softc, softf, fin, pass, softf->ipfr_nattab);
 566 #endif
 567         if (fra != NULL) {
 568                 fra->ipfr_data = nat;
 569                 nat->nat_data = fra;
 570                 *softf->ipfr_nattail = fra;
 571                 fra->ipfr_prev = softf->ipfr_nattail;
 572                 softf->ipfr_nattail = &fra->ipfr_next;
 573                 fra->ipfr_next = NULL;
 574                 RWLOCK_EXIT(&softf->ipfr_natfrag);
 575                 return 0;
 576         }
 577         return -1;
 578 }
 579
 580
 581 /* ------------------------------------------------------------------------ */
 582 /* Function:    ipf_frag_ipidnew                                            */
 583 /* Returns:     int - 0 == success, -1 == error                             */
 584 /* Parameters:  fin(I)  - pointer to packet information                     */
 585 /*              ipid(I) - new IP ID for this fragmented packet              */
 586 /*                                                                          */
 587 /* Create a new fragment cache entry for this packet and store, as a data   */
 588 /* pointer, the new IP ID value.                                            */
 589 /* ------------------------------------------------------------------------ */
 590 int
 591 ipf_frag_ipidnew(fin, ipid)
 592         fr_info_t *fin;
 593         u_32_t ipid;
 594 {
 595         ipf_main_softc_t *softc = fin->fin_main_soft;
 596         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
 597         ipfr_t  *fra;
 598
 599         if (softf->ipfr_lock)
 600                 return 0;
 601
 602 #ifdef USE_MUTEXES
 603         fra = ipfr_frag_new(softc, softf, fin, 0, softf->ipfr_ipidtab, &softf->ipfr_ipidfrag);
 604 #else
 605         fra = ipfr_frag_new(softc, softf, fin, 0, softf->ipfr_ipidtab);
 606 #endif
 607         if (fra != NULL) {
 608                 fra->ipfr_data = (void *)(intptr_t)ipid;
 609                 *softf->ipfr_ipidtail = fra;
 610                 fra->ipfr_prev = softf->ipfr_ipidtail;
 611                 softf->ipfr_ipidtail = &fra->ipfr_next;
 612                 fra->ipfr_next = NULL;
 613                 RWLOCK_EXIT(&softf->ipfr_ipidfrag);
 614         }
 615         return fra ? 0 : -1;
 616 }
 617
 618
 619 /* ------------------------------------------------------------------------ */
 620 /* Function:    ipf_frag_lookup                                             */
 621 /* Returns:     ipfr_t * - pointer to ipfr_t structure if there's a         */
 622 /*                         matching entry in the frag table, else NULL      */
 623 /* Parameters:  fin(I)   - pointer to packet information                    */
 624 /*              table(I) - pointer to fragment cache table to search        */
 625 /*                                                                          */
 626 /* Check the fragment cache to see if there is already a record of this     */
 627 /* packet with its filter result known.                                     */
 628 /*                                                                          */
 629 /* If this function succeeds, it returns with a write lock held on "lock".  */
 630 /* If it fails, no lock is held on return.                                  */
 631 /* ------------------------------------------------------------------------ */
 632 static ipfr_t *
 633 ipf_frag_lookup(softc, softf, fin, table
 634 #ifdef USE_MUTEXES
 635 , lock
 636 #endif
 637 )
 638         ipf_main_softc_t *softc;
 639         ipf_frag_softc_t *softf;
 640         fr_info_t *fin;
 641         ipfr_t *table[];
 642 #ifdef USE_MUTEXES
 643         ipfrwlock_t *lock;
 644 #endif
 645 {
 646         ipfr_t *f, frag;
 647         u_int idx;
 648
 649         /*
 650          * We don't want to let short packets match because they could be
 651          * compromising the security of other rules that want to match on
 652          * layer 4 fields (and can't because they have been fragmented off.)
 653          * Why do this check here?  The counter acts as an indicator of this
 654          * kind of attack, whereas if it was elsewhere, it wouldn't know if
 655          * other matching packets had been seen.
 656          */
 657         if (fin->fin_flx & FI_SHORT) {
 658                 FBUMPD(ifs_short);
 659                 return NULL;
 660         }
 661
 662         if ((fin->fin_flx & FI_BAD) != 0) {
 663                 FBUMPD(ifs_bad);
 664                 return NULL;
 665         }
 666
 667         /*
 668          * For fragments, we record protocol, packet id, TOS and both IP#'s
 669          * (these should all be the same for all fragments of a packet).
 670          *
 671          * build up a hash value to index the table with.
 672          */
 673         frag.ipfr_v = fin->fin_v;
 674         idx = fin->fin_v;
 675         frag.ipfr_p = fin->fin_p;
 676         idx += fin->fin_p;
 677         frag.ipfr_id = fin->fin_id;
 678         idx += fin->fin_id;
 679         frag.ipfr_source = fin->fin_fi.fi_src;
 680         idx += frag.ipfr_src.s_addr;
 681         frag.ipfr_dest = fin->fin_fi.fi_dst;
 682         idx += frag.ipfr_dst.s_addr;
 683         frag.ipfr_ifp = fin->fin_ifp;
 684         idx *= 127;
 685         idx %= softf->ipfr_size;
 686
 687         frag.ipfr_optmsk = fin->fin_fi.fi_optmsk & IPF_OPTCOPY;
 688         frag.ipfr_secmsk = fin->fin_fi.fi_secmsk;
 689         frag.ipfr_auth = fin->fin_fi.fi_auth;
 690
 691         READ_ENTER(lock);
 692
 693         /*
 694          * check the table, careful to only compare the right amount of data
 695          */
 696         for (f = table[idx]; f; f = f->ipfr_hnext) {
 697                 if (!bcmp((char *)&frag.ipfr_ifp, (char *)&f->ipfr_ifp,
 698                           IPFR_CMPSZ)) {
 699                         u_short off;
 700
 701                         /*
 702                          * XXX - We really need to be guarding against the
 703                          * retransmission of (src,dst,id,offset-range) here
 704                          * because a fragmented packet is never resent with
 705                          * the same IP ID# (or shouldn't).
 706                          */
 707                         off = fin->fin_off >> 3;
 708                         if (f->ipfr_seen0) {
 709                                 if (off == 0) {
 710                                         FBUMPD(ifs_retrans0);
 711                                         continue;
 712                                 }
 713
 714                                 /*
 715                                  * Case 3. See comment for frpr_fragment6.
 716                                  */
 717                                 if ((f->ipfr_firstend != 0) &&
 718                                     (off < f->ipfr_firstend)) {
 719                                         FBUMP(ifs_overlap);
 720                                         DT2(ifs_overlap, u_short, off,
 721                                             ipfr_t *, f);
 722                                         DT3(ipf_fi_bad_ifs_overlap, fr_info_t *, fin, u_short, off,
 723                                             ipfr_t *, f);
 724                                         fin->fin_flx |= FI_BAD;
 725                                         break;
 726                                 }
 727                         } else if (off == 0)
 728                                 f->ipfr_seen0 = 1;
 729
 730                         if (f != table[idx]) {
 731                                 ipfr_t **fp;
 732
 733                                 /*
 734                                  * Move fragment info. to the top of the list
 735                                  * to speed up searches.  First, delink...
 736                                  */
 737                                 fp = f->ipfr_hprev;
 738                                 (*fp) = f->ipfr_hnext;
 739                                 if (f->ipfr_hnext != NULL)
 740                                         f->ipfr_hnext->ipfr_hprev = fp;
 741                                 /*
 742                                  * Then put back at the top of the chain.
 743                                  */
 744                                 f->ipfr_hnext = table[idx];
 745                                 table[idx]->ipfr_hprev = &f->ipfr_hnext;
 746                                 f->ipfr_hprev = table + idx;
 747                                 table[idx] = f;
 748                         }
 749
 750                         /*
 751                          * If we've follwed the fragments, and this is the
 752                          * last (in order), shrink expiration time.
 753                          */
 754                         if (off == f->ipfr_off) {
 755                                 f->ipfr_off = (fin->fin_dlen >> 3) + off;
 756
 757                                 /*
 758                                  * Well, we could shrink the expiration time
 759                                  * but only if every fragment has been seen
 760                                  * in order upto this, the last. ipfr_badorder
 761                                  * is used here to count those out of order
 762                                  * and if it equals 0 when we get to the last
 763                                  * fragment then we can assume all of the
 764                                  * fragments have been seen and in order.
 765                                  */
 766 #if 0
 767                                 /*
 768                                  * Doing this properly requires moving it to
 769                                  * the head of the list which is infesible.
 770                                  */
 771                                 if ((more == 0) && (f->ipfr_badorder == 0))
 772                                         f->ipfr_ttl = softc->ipf_ticks + 1;
 773 #endif
 774                         } else {
 775                                 f->ipfr_badorder++;
 776                                 FBUMPD(ifs_unordered);
 777                                 if (f->ipfr_pass & FR_FRSTRICT) {
 778                                         FBUMPD(ifs_strict);
 779                                         continue;
 780                                 }
 781                         }
 782                         f->ipfr_pkts++;
 783                         f->ipfr_bytes += fin->fin_plen;
 784                         FBUMP(ifs_hits);
 785                         return f;
 786                 }
 787         }
 788
 789         RWLOCK_EXIT(lock);
 790         FBUMP(ifs_miss);
 791         return NULL;
 792 }
 793
 794
 795 /* ------------------------------------------------------------------------ */
 796 /* Function:    ipf_frag_natknown                                           */
 797 /* Returns:     nat_t* - pointer to 'parent' NAT structure if frag table    */
 798 /*                       match found, else NULL                             */
 799 /* Parameters:  fin(I)  - pointer to packet information                     */
 800 /*                                                                          */
 801 /* Functional interface for NAT lookups of the NAT fragment cache           */
 802 /* ------------------------------------------------------------------------ */
 803 nat_t *
 804 ipf_frag_natknown(fin)
 805         fr_info_t *fin;
 806 {
 807         ipf_main_softc_t *softc = fin->fin_main_soft;
 808         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
 809         nat_t   *nat;
 810         ipfr_t  *ipf;
 811
 812         if ((softf->ipfr_lock) || !softf->ipfr_natlist)
 813                 return NULL;
 814 #ifdef USE_MUTEXES
 815         ipf = ipf_frag_lookup(softc, softf, fin, softf->ipfr_nattab,
 816                               &softf->ipfr_natfrag);
 817 #else
 818         ipf = ipf_frag_lookup(softc, softf, fin, softf->ipfr_nattab);
 819 #endif
 820         if (ipf != NULL) {
 821                 nat = ipf->ipfr_data;
 822                 /*
 823                  * This is the last fragment for this packet.
 824                  */
 825                 if ((ipf->ipfr_ttl == softc->ipf_ticks + 1) && (nat != NULL)) {
 826                         nat->nat_data = NULL;
 827                         ipf->ipfr_data = NULL;
 828                 }
 829                 RWLOCK_EXIT(&softf->ipfr_natfrag);
 830         } else
 831                 nat = NULL;
 832         return nat;
 833 }
 834
 835
 836 /* ------------------------------------------------------------------------ */
 837 /* Function:    ipf_frag_ipidknown                                          */
 838 /* Returns:     u_32_t - IPv4 ID for this packet if match found, else       */
 839 /*                       return 0xfffffff to indicate no match.             */
 840 /* Parameters:  fin(I) - pointer to packet information                      */
 841 /*                                                                          */
 842 /* Functional interface for IP ID lookups of the IP ID fragment cache       */
 843 /* ------------------------------------------------------------------------ */
 844 u_32_t
 845 ipf_frag_ipidknown(fin)
 846         fr_info_t *fin;
 847 {
 848         ipf_main_softc_t *softc = fin->fin_main_soft;
 849         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
 850         ipfr_t  *ipf;
 851         u_32_t  id;
 852
 853         if (softf->ipfr_lock || !softf->ipfr_ipidlist)
 854                 return 0xffffffff;
 855
 856 #ifdef USE_MUTEXES
 857         ipf = ipf_frag_lookup(softc, softf, fin, softf->ipfr_ipidtab,
 858                               &softf->ipfr_ipidfrag);
 859 #else
 860         ipf = ipf_frag_lookup(softc, softf, fin, softf->ipfr_ipidtab);
 861 #endif
 862         if (ipf != NULL) {
 863                 id = (u_32_t)(intptr_t)ipf->ipfr_data;
 864                 RWLOCK_EXIT(&softf->ipfr_ipidfrag);
 865         } else
 866                 id = 0xffffffff;
 867         return id;
 868 }
 869
 870
 871 /* ------------------------------------------------------------------------ */
 872 /* Function:    ipf_frag_known                                              */
 873 /* Returns:     frentry_t* - pointer to filter rule if a match is found in  */
 874 /*                           the frag cache table, else NULL.               */
 875 /* Parameters:  fin(I)   - pointer to packet information                    */
 876 /*              passp(O) - pointer to where to store rule flags resturned   */
 877 /*                                                                          */
 878 /* Functional interface for normal lookups of the fragment cache.  If a     */
 879 /* match is found, return the rule pointer and flags from the rule, except  */
 880 /* that if FR_LOGFIRST is set, reset FR_LOG.                                */
 881 /* ------------------------------------------------------------------------ */
 882 frentry_t *
 883 ipf_frag_known(fin, passp)
 884         fr_info_t *fin;
 885         u_32_t *passp;
 886 {
 887         ipf_main_softc_t *softc = fin->fin_main_soft;
 888         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
 889         frentry_t *fr = NULL;
 890         ipfr_t  *fra;
 891         u_32_t pass;
 892
 893         if ((softf->ipfr_lock) || (softf->ipfr_list == NULL))
 894                 return NULL;
 895
 896 #ifdef USE_MUTEXES
 897         fra = ipf_frag_lookup(softc, softf, fin, softf->ipfr_heads,
 898                               &softc->ipf_frag);
 899 #else
 900         fra = ipf_frag_lookup(softc, softf, fin, softf->ipfr_heads);
 901 #endif
 902         if (fra != NULL) {
 903                 if (fin->fin_flx & FI_BAD) {
 904                         fr = &ipfr_block;
 905                         fin->fin_reason = FRB_BADFRAG;
 906                         DT2(ipf_frb_badfrag, fr_info_t *, fin, uint, fra);
 907                 } else {
 908                         fr = fra->ipfr_rule;
 909                 }
 910                 fin->fin_fr = fr;
 911                 if (fr != NULL) {
 912                         pass = fr->fr_flags;
 913                         if ((pass & FR_KEEPSTATE) != 0) {
 914                                 fin->fin_flx |= FI_STATE;
 915                                 /*
 916                                  * Reset the keep state flag here so that we
 917                                  * don't try and add a new state entry because
 918                                  * of a match here. That leads to blocking of
 919                                  * the packet later because the add fails.
 920                                  */
 921                                 pass &= ~FR_KEEPSTATE;
 922                         }
 923                         if ((pass & FR_LOGFIRST) != 0)
 924                                 pass &= ~(FR_LOGFIRST|FR_LOG);
 925                         *passp = pass;
 926                 }
 927                 RWLOCK_EXIT(&softc->ipf_frag);
 928         }
 929         return fr;
 930 }
 931
 932
 933 /* ------------------------------------------------------------------------ */
 934 /* Function:    ipf_frag_natforget                                          */
 935 /* Returns:     Nil                                                         */
 936 /* Parameters:  softc(I) - pointer to soft context main structure           */
 937 /*              ptr(I) - pointer to data structure                          */
 938 /*                                                                          */
 939 /* Search through all of the fragment cache entries for NAT and wherever a  */
 940 /* pointer  is found to match ptr, reset it to NULL.                        */
 941 /* ------------------------------------------------------------------------ */
 942 void
 943 ipf_frag_natforget(softc, ptr)
 944         ipf_main_softc_t *softc;
 945         void *ptr;
 946 {
 947         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
 948         ipfr_t  *fr;
 949
 950         WRITE_ENTER(&softf->ipfr_natfrag);
 951         for (fr = softf->ipfr_natlist; fr; fr = fr->ipfr_next)
 952                 if (fr->ipfr_data == ptr)
 953                         fr->ipfr_data = NULL;
 954         RWLOCK_EXIT(&softf->ipfr_natfrag);
 955 }
 956
 957
 958 /* ------------------------------------------------------------------------ */
 959 /* Function:    ipf_frag_delete                                             */
 960 /* Returns:     Nil                                                         */
 961 /* Parameters:  softc(I) - pointer to soft context main structure           */
 962 /*              fra(I)   - pointer to fragment structure to delete          */
 963 /*              tail(IO) - pointer to the pointer to the tail of the frag   */
 964 /*                         list                                             */
 965 /*                                                                          */
 966 /* Remove a fragment cache table entry from the table & list.  Also free    */
 967 /* the filter rule it is associated with it if it is no longer used as a    */
 968 /* result of decreasing the reference count.                                */
 969 /* ------------------------------------------------------------------------ */
 970 static void
 971 ipf_frag_delete(softc, fra, tail)
 972         ipf_main_softc_t *softc;
 973         ipfr_t *fra, ***tail;
 974 {
 975         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
 976
 977         if (fra->ipfr_next)
 978                 fra->ipfr_next->ipfr_prev = fra->ipfr_prev;
 979         *fra->ipfr_prev = fra->ipfr_next;
 980         if (*tail == &fra->ipfr_next)
 981                 *tail = fra->ipfr_prev;
 982
 983         if (fra->ipfr_hnext)
 984                 fra->ipfr_hnext->ipfr_hprev = fra->ipfr_hprev;
 985         *fra->ipfr_hprev = fra->ipfr_hnext;
 986
 987         if (fra->ipfr_rule != NULL) {
 988                 (void) ipf_derefrule(softc, &fra->ipfr_rule);
 989         }
 990
 991         if (fra->ipfr_ref <= 0)
 992                 ipf_frag_free(softf, fra);
 993 }
 994
 995
 996 /* ------------------------------------------------------------------------ */
 997 /* Function:    ipf_frag_free                                               */
 998 /* Returns:     Nil                                                         */
 999 /* Parameters:  softf(I) - pointer to fragment context information          */
1000 /*              fra(I)   - pointer to fragment structure to free            */
1001 /*                                                                          */
1002 /* Free up a fragment cache entry and bump relevent statistics.             */
1003 /* ------------------------------------------------------------------------ */
1004 static void
1005 ipf_frag_free(softf, fra)
1006         ipf_frag_softc_t *softf;
1007         ipfr_t *fra;
1008 {
1009         KFREE(fra);
1010         FBUMP(ifs_expire);
1011         softf->ipfr_stats.ifs_inuse--;
1012 }
1013
1014
1015 /* ------------------------------------------------------------------------ */
1016 /* Function:    ipf_frag_clear                                              */
1017 /* Returns:     Nil                                                         */
1018 /* Parameters:  softc(I) - pointer to soft context main structure           */
1019 /*                                                                          */
1020 /* Free memory in use by fragment state information kept.  Do the normal    */
1021 /* fragment state stuff first and then the NAT-fragment table.              */
1022 /* ------------------------------------------------------------------------ */
1023 void
1024 ipf_frag_clear(softc)
1025         ipf_main_softc_t *softc;
1026 {
1027         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
1028         ipfr_t  *fra;
1029         nat_t   *nat;
1030
1031         WRITE_ENTER(&softc->ipf_frag);
1032         while ((fra = softf->ipfr_list) != NULL) {
1033                 fra->ipfr_ref--;
1034                 ipf_frag_delete(softc, fra, &softf->ipfr_tail);
1035         }
1036         softf->ipfr_tail = &softf->ipfr_list;
1037         RWLOCK_EXIT(&softc->ipf_frag);
1038
1039         WRITE_ENTER(&softc->ipf_nat);
1040         WRITE_ENTER(&softf->ipfr_natfrag);
1041         while ((fra = softf->ipfr_natlist) != NULL) {
1042                 nat = fra->ipfr_data;
1043                 if (nat != NULL) {
1044                         if (nat->nat_data == fra)
1045                                 nat->nat_data = NULL;
1046                 }
1047                 fra->ipfr_ref--;
1048                 ipf_frag_delete(softc, fra, &softf->ipfr_nattail);
1049         }
1050         softf->ipfr_nattail = &softf->ipfr_natlist;
1051         RWLOCK_EXIT(&softf->ipfr_natfrag);
1052         RWLOCK_EXIT(&softc->ipf_nat);
1053 }
1054
1055
1056 /* ------------------------------------------------------------------------ */
1057 /* Function:    ipf_frag_expire                                             */
1058 /* Returns:     Nil                                                         */
1059 /* Parameters:  softc(I) - pointer to soft context main structure           */
1060 /*                                                                          */
1061 /* Expire entries in the fragment cache table that have been there too long */
1062 /* ------------------------------------------------------------------------ */
1063 void
1064 ipf_frag_expire(softc)
1065         ipf_main_softc_t *softc;
1066 {
1067         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
1068         ipfr_t  **fp, *fra;
1069         nat_t   *nat;
1070         SPL_INT(s);
1071
1072         if (softf->ipfr_lock)
1073                 return;
1074
1075         SPL_NET(s);
1076         WRITE_ENTER(&softc->ipf_frag);
1077         /*
1078          * Go through the entire table, looking for entries to expire,
1079          * which is indicated by the ttl being less than or equal to ipf_ticks.
1080          */
1081         for (fp = &softf->ipfr_list; ((fra = *fp) != NULL); ) {
1082                 if (fra->ipfr_ttl > softc->ipf_ticks)
1083                         break;
1084                 fra->ipfr_ref--;
1085                 ipf_frag_delete(softc, fra, &softf->ipfr_tail);
1086         }
1087         RWLOCK_EXIT(&softc->ipf_frag);
1088
1089         WRITE_ENTER(&softf->ipfr_ipidfrag);
1090         for (fp = &softf->ipfr_ipidlist; ((fra = *fp) != NULL); ) {
1091                 if (fra->ipfr_ttl > softc->ipf_ticks)
1092                         break;
1093                 fra->ipfr_ref--;
1094                 ipf_frag_delete(softc, fra, &softf->ipfr_ipidtail);
1095         }
1096         RWLOCK_EXIT(&softf->ipfr_ipidfrag);
1097
1098         /*
1099          * Same again for the NAT table, except that if the structure also
1100          * still points to a NAT structure, and the NAT structure points back
1101          * at the one to be free'd, NULL the reference from the NAT struct.
1102          * NOTE: We need to grab both mutex's early, and in this order so as
1103          * to prevent a deadlock if both try to expire at the same time.
1104          * The extra if() statement here is because it locks out all NAT
1105          * operations - no need to do that if there are no entries in this
1106          * list, right?
1107          */
1108         if (softf->ipfr_natlist != NULL) {
1109                 WRITE_ENTER(&softc->ipf_nat);
1110                 WRITE_ENTER(&softf->ipfr_natfrag);
1111                 for (fp = &softf->ipfr_natlist; ((fra = *fp) != NULL); ) {
1112                         if (fra->ipfr_ttl > softc->ipf_ticks)
1113                                 break;
1114                         nat = fra->ipfr_data;
1115                         if (nat != NULL) {
1116                                 if (nat->nat_data == fra)
1117                                         nat->nat_data = NULL;
1118                         }
1119                         fra->ipfr_ref--;
1120                         ipf_frag_delete(softc, fra, &softf->ipfr_nattail);
1121                 }
1122                 RWLOCK_EXIT(&softf->ipfr_natfrag);
1123                 RWLOCK_EXIT(&softc->ipf_nat);
1124         }
1125         SPL_X(s);
1126 }
1127
1128
1129 /* ------------------------------------------------------------------------ */
1130 /* Function:    ipf_frag_pkt_next                                           */
1131 /* Returns:     int      - 0 == success, else error                         */
1132 /* Parameters:  softc(I) - pointer to soft context main structure           */
1133 /*              token(I) - pointer to token information for this caller     */
1134 /*              itp(I)   - pointer to generic iterator from caller          */
1135 /*                                                                          */
1136 /* This function is used to step through the fragment cache list used for   */
1137 /* filter rules. The hard work is done by the more generic ipf_frag_next.   */
1138 /* ------------------------------------------------------------------------ */
1139 int
1140 ipf_frag_pkt_next(softc, token, itp)
1141         ipf_main_softc_t *softc;
1142         ipftoken_t *token;
1143         ipfgeniter_t *itp;
1144 {
1145         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
1146
1147 #ifdef USE_MUTEXES
1148         return ipf_frag_next(softc, token, itp, &softf->ipfr_list,
1149                              &softf->ipfr_frag);
1150 #else
1151         return ipf_frag_next(softc, token, itp, &softf->ipfr_list);
1152 #endif
1153 }
1154
1155
1156 /* ------------------------------------------------------------------------ */
1157 /* Function:    ipf_frag_nat_next                                           */
1158 /* Returns:     int      - 0 == success, else error                         */
1159 /* Parameters:  softc(I) - pointer to soft context main structure           */
1160 /*              token(I) - pointer to token information for this caller     */
1161 /*              itp(I)   - pointer to generic iterator from caller          */
1162 /*                                                                          */
1163 /* This function is used to step through the fragment cache list used for   */
1164 /* NAT. The hard work is done by the more generic ipf_frag_next.            */
1165 /* ------------------------------------------------------------------------ */
1166 int
1167 ipf_frag_nat_next(softc, token, itp)
1168         ipf_main_softc_t *softc;
1169         ipftoken_t *token;
1170         ipfgeniter_t *itp;
1171 {
1172         ipf_frag_softc_t *softf = softc->ipf_frag_soft;;
1173
1174 #ifdef USE_MUTEXES
1175         return ipf_frag_next(softc, token, itp, &softf->ipfr_natlist,
1176                              &softf->ipfr_natfrag);
1177 #else
1178         return ipf_frag_next(softc, token, itp, &softf->ipfr_natlist);
1179 #endif
1180 }
1181
1182 /* ------------------------------------------------------------------------ */
1183 /* Function:    ipf_frag_next                                               */
1184 /* Returns:     int      - 0 == success, else error                         */
1185 /* Parameters:  softc(I) - pointer to soft context main structure           */
1186 /*              token(I) - pointer to token information for this caller     */
1187 /*              itp(I)   - pointer to generic iterator from caller          */
1188 /*              top(I)   - top of the fragment list                         */
1189 /*              lock(I)  - fragment cache lock                              */
1190 /*                                                                          */
1191 /* This function is used to interate through the list of entries in the     */
1192 /* fragment cache.  It increases the reference count on the one currently   */
1193 /* being returned so that the caller can come back and resume from it later.*/
1194 /*                                                                          */
1195 /* This function is used for both the NAT fragment cache as well as the ipf */
1196 /* fragment cache - hence the reason for passing in top and lock.           */
1197 /* ------------------------------------------------------------------------ */
1198 static int
1199 ipf_frag_next(softc, token, itp, top
1200 #ifdef USE_MUTEXES
1201 , lock
1202 #endif
1203 )
1204         ipf_main_softc_t *softc;
1205         ipftoken_t *token;
1206         ipfgeniter_t *itp;
1207         ipfr_t **top;
1208 #ifdef USE_MUTEXES
1209         ipfrwlock_t *lock;
1210 #endif
1211 {
1212         ipfr_t *frag, *next, zero;
1213         int error = 0;
1214
1215         if (itp->igi_data == NULL) {
1216                 IPFERROR(20001);
1217                 return EFAULT;
1218         }
1219
1220         if (itp->igi_nitems != 1) {
1221                 IPFERROR(20003);
1222                 return EFAULT;
1223         }
1224
1225         frag = token->ipt_data;
1226
1227         READ_ENTER(lock);
1228
1229         if (frag == NULL)
1230                 next = *top;
1231         else
1232                 next = frag->ipfr_next;
1233
1234         if (next != NULL) {
1235                 ATOMIC_INC(next->ipfr_ref);
1236                 token->ipt_data = next;
1237         } else {
1238                 bzero(&zero, sizeof(zero));
1239                 next = &zero;
1240                 token->ipt_data = NULL;
1241         }
1242         if (next->ipfr_next == NULL)
1243                 ipf_token_mark_complete(token);
1244
1245         RWLOCK_EXIT(lock);
1246
1247         error = COPYOUT(next, itp->igi_data, sizeof(*next));
1248         if (error != 0)
1249                 IPFERROR(20002);
1250
1251         if (frag != NULL) {
1252 #ifdef USE_MUTEXES
1253                 ipf_frag_deref(softc, &frag, lock);
1254 #else
1255                 ipf_frag_deref(softc, &frag);
1256 #endif
1257         }
1258         return error;
1259 }
1260
1261
1262 /* ------------------------------------------------------------------------ */
1263 /* Function:    ipf_frag_pkt_deref                                          */
1264 /* Returns:     Nil                                                         */
1265 /* Parameters:  softc(I) - pointer to soft context main structure           */
1266 /*              data(I)  - pointer to frag cache pointer                    */
1267 /*                                                                          */
1268 /* This function is the external interface for dropping a reference to a    */
1269 /* fragment cache entry used by filter rules.                               */
1270 /* ------------------------------------------------------------------------ */
1271 void
1272 ipf_frag_pkt_deref(softc, data)
1273         ipf_main_softc_t *softc;
1274         void *data;
1275 {
1276         ipfr_t **frp = data;
1277
1278 #ifdef USE_MUTEXES
1279         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
1280
1281         ipf_frag_deref(softc->ipf_frag_soft, frp, &softf->ipfr_frag);
1282 #else
1283         ipf_frag_deref(softc->ipf_frag_soft, frp);
1284 #endif
1285 }
1286
1287
1288 /* ------------------------------------------------------------------------ */
1289 /* Function:    ipf_frag_nat_deref                                          */
1290 /* Returns:     Nil                                                         */
1291 /* Parameters:  softc(I) - pointer to soft context main structure           */
1292 /*              data(I)  - pointer to frag cache pointer                    */
1293 /*                                                                          */
1294 /* This function is the external interface for dropping a reference to a    */
1295 /* fragment cache entry used by NAT table entries.                          */
1296 /* ------------------------------------------------------------------------ */
1297 void
1298 ipf_frag_nat_deref(softc, data)
1299         ipf_main_softc_t *softc;
1300         void *data;
1301 {
1302         ipfr_t **frp = data;
1303
1304 #ifdef USE_MUTEXES
1305         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
1306
1307         ipf_frag_deref(softc->ipf_frag_soft, frp, &softf->ipfr_natfrag);
1308 #else
1309         ipf_frag_deref(softc->ipf_frag_soft, frp);
1310 #endif
1311 }
1312
1313
1314 /* ------------------------------------------------------------------------ */
1315 /* Function:    ipf_frag_deref                                              */
1316 /* Returns:     Nil                                                         */
1317 /* Parameters:  frp(IO) - pointer to fragment structure to deference        */
1318 /*              lock(I) - lock associated with the fragment                 */
1319 /*                                                                          */
1320 /* This function dereferences a fragment structure (ipfr_t).  The pointer   */
1321 /* passed in will always be reset back to NULL, even if the structure is    */
1322 /* not freed, to enforce the notion that the caller is no longer entitled   */
1323 /* to use the pointer it is dropping the reference to.                      */
1324 /* ------------------------------------------------------------------------ */
1325 static void
1326 ipf_frag_deref(arg, frp
1327 #ifdef USE_MUTEXES
1328 , lock
1329 #endif
1330 )
1331         void *arg;
1332         ipfr_t **frp;
1333 #ifdef USE_MUTEXES
1334         ipfrwlock_t *lock;
1335 #endif
1336 {
1337         ipf_frag_softc_t *softf = arg;
1338         ipfr_t *fra;
1339
1340         fra = *frp;
1341         *frp = NULL;
1342
1343         WRITE_ENTER(lock);
1344         fra->ipfr_ref--;
1345         if (fra->ipfr_ref <= 0)
1346                 ipf_frag_free(softf, fra);
1347         RWLOCK_EXIT(lock);
1348 }