sys/contrib/ipfilter/netinet/ip_frag.c

   1 /*      $FreeBSD$       */
   2
   3 /*
   4  * Copyright (C) 2012 by Darren Reed.
   5  *
   6  * See the IPFILTER.LICENCE file for details on licencing.
   7  */
   8 #if defined(KERNEL) || defined(_KERNEL)
   9 # undef KERNEL
  10 # undef _KERNEL
  11 # define        KERNEL  1
  12 # define        _KERNEL 1
  13 #endif
  14 #include <sys/errno.h>
  15 #include <sys/types.h>
  16 #include <sys/param.h>
  17 #include <sys/time.h>
  18 #include <sys/file.h>
  19 #ifdef __hpux
  20 # include <sys/timeout.h>
  21 #endif
  22 #if !defined(_KERNEL)
  23 # include <stdio.h>
  24 # include <string.h>
  25 # include <stdlib.h>
  26 # define _KERNEL
  27 # ifdef __OpenBSD__
  28 struct file;
  29 # endif
  30 # include <sys/uio.h>
  31 # undef _KERNEL
  32 #endif
  33 #if defined(_KERNEL) && \
  34     defined(__FreeBSD_version) && (__FreeBSD_version >= 220000)
  35 # include <sys/filio.h>
  36 # include <sys/fcntl.h>
  37 #else
  38 # include <sys/ioctl.h>
  39 #endif
  40 #if !defined(linux)
  41 # include <sys/protosw.h>
  42 #endif
  43 #include <sys/socket.h>
  44 #if defined(_KERNEL)
  45 # include <sys/systm.h>
  46 # if !defined(__SVR4) && !defined(__svr4__)
  47 #  include <sys/mbuf.h>
  48 # endif
  49 #endif
  50 #if !defined(__SVR4) && !defined(__svr4__)
  51 # if defined(_KERNEL) && !defined(__sgi) && !defined(AIX)
  52 #  include <sys/kernel.h>
  53 # endif
  54 #else
  55 # include <sys/byteorder.h>
  56 # ifdef _KERNEL
  57 #  include <sys/dditypes.h>
  58 # endif
  59 # include <sys/stream.h>
  60 # include <sys/kmem.h>
  61 #endif
  62 #include <net/if.h>
  63 #ifdef sun
  64 # include <net/af.h>
  65 #endif
  66 #include <netinet/in.h>
  67 #include <netinet/in_systm.h>
  68 #include <netinet/ip.h>
  69 #if !defined(linux)
  70 # include <netinet/ip_var.h>
  71 #endif
  72 #include <netinet/tcp.h>
  73 #include <netinet/udp.h>
  74 #include <netinet/ip_icmp.h>
  75 #include "netinet/ip_compat.h"
  76 #include <netinet/tcpip.h>
  77 #include "netinet/ip_fil.h"
  78 #include "netinet/ip_nat.h"
  79 #include "netinet/ip_frag.h"
  80 #include "netinet/ip_state.h"
  81 #include "netinet/ip_auth.h"
  82 #include "netinet/ip_lookup.h"
  83 #include "netinet/ip_proxy.h"
  84 #include "netinet/ip_sync.h"
  85 /* END OF INCLUDES */
  86
  87 #if !defined(lint)
  88 static const char sccsid[] = "@(#)ip_frag.c     1.11 3/24/96 (C) 1993-2000 Darren Reed";
  89 static const char rcsid[] = "@(#)$FreeBSD$";
  90 /* static const char rcsid[] = "@(#)$Id: ip_frag.c,v 2.77.2.12 2007/09/20 12:51:51 darrenr Exp $"; */
  91 #endif
  92
  93
  94 #ifdef USE_MUTEXES
  95 static ipfr_t *ipfr_frag_new __P((ipf_main_softc_t *, ipf_frag_softc_t *,
  96                                   fr_info_t *, u_32_t, ipfr_t **,
  97                                   ipfrwlock_t *));
  98 static ipfr_t *ipf_frag_lookup __P((ipf_main_softc_t *, ipf_frag_softc_t *, fr_info_t *, ipfr_t **, ipfrwlock_t *));
  99 static void ipf_frag_deref __P((void *, ipfr_t **, ipfrwlock_t *));
 100 static int ipf_frag_next __P((ipf_main_softc_t *, ipftoken_t *, ipfgeniter_t *,
 101                               ipfr_t **, ipfrwlock_t *));
 102 #else
 103 static ipfr_t *ipfr_frag_new __P((ipf_main_softc_t *, ipf_frag_softc_t *,
 104                                   fr_info_t *, u_32_t, ipfr_t **));
 105 static ipfr_t *ipf_frag_lookup __P((ipf_main_softc_t *, ipf_frag_softc_t *, fr_info_t *, ipfr_t **));
 106 static void ipf_frag_deref __P((void *, ipfr_t **));
 107 static int ipf_frag_next __P((ipf_main_softc_t *, ipftoken_t *, ipfgeniter_t *,
 108                               ipfr_t **));
 109 #endif
 110 static void ipf_frag_delete __P((ipf_main_softc_t *, ipfr_t *, ipfr_t ***));
 111 static void ipf_frag_free __P((ipf_frag_softc_t *, ipfr_t *));
 112
 113 static frentry_t ipfr_block;
 114
 115 ipftuneable_t ipf_tuneables[] = {
 116         { { (void *)offsetof(ipf_frag_softc_t, ipfr_size) },
 117                 "frag_size",            1,      0x7fffffff,
 118                 stsizeof(ipf_frag_softc_t, ipfr_size),
 119                 IPFT_WRDISABLED,        NULL,   NULL },
 120         { { (void *)offsetof(ipf_frag_softc_t, ipfr_ttl) },
 121                 "frag_ttl",             1,      0x7fffffff,
 122                 stsizeof(ipf_frag_softc_t, ipfr_ttl),
 123                 0,                      NULL,   NULL },
 124         { { NULL },
 125                 NULL,                   0,      0,
 126                 0,
 127                 0,                      NULL,   NULL }
 128 };
 129
 130 #define FBUMP(x)        softf->ipfr_stats.x++
 131 #define FBUMPD(x)       do { softf->ipfr_stats.x++; DT(x); } while (0)
 132
 133
 134 /* ------------------------------------------------------------------------ */
 135 /* Function:    ipf_frag_main_load                                          */
 136 /* Returns:     int - 0 == success, -1 == error                             */
 137 /* Parameters:  Nil                                                         */
 138 /*                                                                          */
 139 /* Initialise the filter rule associted with blocked packets - everyone can */
 140 /* use it.                                                                  */
 141 /* ------------------------------------------------------------------------ */
 142 int
 143 ipf_frag_main_load()
 144 {
 145         bzero((char *)&ipfr_block, sizeof(ipfr_block));
 146         ipfr_block.fr_flags = FR_BLOCK|FR_QUICK;
 147         ipfr_block.fr_ref = 1;
 148
 149         return 0;
 150 }
 151
 152
 153 /* ------------------------------------------------------------------------ */
 154 /* Function:    ipf_frag_main_unload                                        */
 155 /* Returns:     int - 0 == success, -1 == error                             */
 156 /* Parameters:  Nil                                                         */
 157 /*                                                                          */
 158 /* A null-op function that exists as a placeholder so that the flow in      */
 159 /* other functions is obvious.                                              */
 160 /* ------------------------------------------------------------------------ */
 161 int
 162 ipf_frag_main_unload()
 163 {
 164         return 0;
 165 }
 166
 167
 168 /* ------------------------------------------------------------------------ */
 169 /* Function:    ipf_frag_soft_create                                        */
 170 /* Returns:     void *   - NULL = failure, else pointer to local context    */
 171 /* Parameters:  softc(I) - pointer to soft context main structure           */
 172 /*                                                                          */
 173 /* Allocate a new soft context structure to track fragment related info.    */
 174 /* ------------------------------------------------------------------------ */
 175 /*ARGSUSED*/
 176 void *
 177 ipf_frag_soft_create(softc)
 178         ipf_main_softc_t *softc;
 179 {
 180         ipf_frag_softc_t *softf;
 181
 182         KMALLOC(softf, ipf_frag_softc_t *);
 183         if (softf == NULL)
 184                 return NULL;
 185
 186         bzero((char *)softf, sizeof(*softf));
 187
 188         RWLOCK_INIT(&softf->ipfr_ipidfrag, "frag ipid lock");
 189         RWLOCK_INIT(&softf->ipfr_frag, "ipf fragment rwlock");
 190         RWLOCK_INIT(&softf->ipfr_natfrag, "ipf NAT fragment rwlock");
 191
 192         softf->ipfr_size = IPFT_SIZE;
 193         softf->ipfr_ttl = IPF_TTLVAL(60);
 194         softf->ipfr_lock = 1;
 195         softf->ipfr_tail = &softf->ipfr_list;
 196         softf->ipfr_nattail = &softf->ipfr_natlist;
 197         softf->ipfr_ipidtail = &softf->ipfr_ipidlist;
 198
 199         return softf;
 200 }
 201
 202
 203 /* ------------------------------------------------------------------------ */
 204 /* Function:    ipf_frag_soft_destroy                                       */
 205 /* Returns:     Nil                                                         */
 206 /* Parameters:  softc(I) - pointer to soft context main structure           */
 207 /*              arg(I)   - pointer to local context to use                  */
 208 /*                                                                          */
 209 /* Initialise the hash tables for the fragment cache lookups.               */
 210 /* ------------------------------------------------------------------------ */
 211 void
 212 ipf_frag_soft_destroy(softc, arg)
 213         ipf_main_softc_t *softc;
 214         void *arg;
 215 {
 216         ipf_frag_softc_t *softf = arg;
 217
 218         RW_DESTROY(&softf->ipfr_ipidfrag);
 219         RW_DESTROY(&softf->ipfr_frag);
 220         RW_DESTROY(&softf->ipfr_natfrag);
 221
 222         KFREE(softf);
 223 }
 224
 225
 226 /* ------------------------------------------------------------------------ */
 227 /* Function:    ipf_frag_soft_init                                          */
 228 /* Returns:     int      - 0 == success, -1 == error                        */
 229 /* Parameters:  softc(I) - pointer to soft context main structure           */
 230 /*              arg(I)   - pointer to local context to use                  */
 231 /*                                                                          */
 232 /* Initialise the hash tables for the fragment cache lookups.               */
 233 /* ------------------------------------------------------------------------ */
 234 /*ARGSUSED*/
 235 int
 236 ipf_frag_soft_init(softc, arg)
 237         ipf_main_softc_t *softc;
 238         void *arg;
 239 {
 240         ipf_frag_softc_t *softf = arg;
 241
 242         KMALLOCS(softf->ipfr_heads, ipfr_t **,
 243                  softf->ipfr_size * sizeof(ipfr_t *));
 244         if (softf->ipfr_heads == NULL)
 245                 return -1;
 246
 247         bzero((char *)softf->ipfr_heads, softf->ipfr_size * sizeof(ipfr_t *));
 248
 249         KMALLOCS(softf->ipfr_nattab, ipfr_t **,
 250                  softf->ipfr_size * sizeof(ipfr_t *));
 251         if (softf->ipfr_nattab == NULL)
 252                 return -2;
 253
 254         bzero((char *)softf->ipfr_nattab, softf->ipfr_size * sizeof(ipfr_t *));
 255
 256         KMALLOCS(softf->ipfr_ipidtab, ipfr_t **,
 257                  softf->ipfr_size * sizeof(ipfr_t *));
 258         if (softf->ipfr_ipidtab == NULL)
 259                 return -3;
 260
 261         bzero((char *)softf->ipfr_ipidtab,
 262               softf->ipfr_size * sizeof(ipfr_t *));
 263
 264         softf->ipfr_lock = 0;
 265         softf->ipfr_inited = 1;
 266
 267         return 0;
 268 }
 269
 270
 271 /* ------------------------------------------------------------------------ */
 272 /* Function:    ipf_frag_soft_fini                                          */
 273 /* Returns:     int      - 0 == success, -1 == error                        */
 274 /* Parameters:  softc(I) - pointer to soft context main structure           */
 275 /*              arg(I)   - pointer to local context to use                  */
 276 /*                                                                          */
 277 /* Free all memory allocated whilst running and from initialisation.        */
 278 /* ------------------------------------------------------------------------ */
 279 int
 280 ipf_frag_soft_fini(softc, arg)
 281         ipf_main_softc_t *softc;
 282         void *arg;
 283 {
 284         ipf_frag_softc_t *softf = arg;
 285
 286         softf->ipfr_lock = 1;
 287
 288         if (softf->ipfr_inited == 1) {
 289                 ipf_frag_clear(softc);
 290
 291                 softf->ipfr_inited = 0;
 292         }
 293
 294         if (softf->ipfr_heads != NULL)
 295                 KFREES(softf->ipfr_heads,
 296                        softf->ipfr_size * sizeof(ipfr_t *));
 297         softf->ipfr_heads = NULL;
 298
 299         if (softf->ipfr_nattab != NULL)
 300                 KFREES(softf->ipfr_nattab,
 301                        softf->ipfr_size * sizeof(ipfr_t *));
 302         softf->ipfr_nattab = NULL;
 303
 304         if (softf->ipfr_ipidtab != NULL)
 305                 KFREES(softf->ipfr_ipidtab,
 306                        softf->ipfr_size * sizeof(ipfr_t *));
 307         softf->ipfr_ipidtab = NULL;
 308
 309         return 0;
 310 }
 311
 312
 313 /* ------------------------------------------------------------------------ */
 314 /* Function:    ipf_frag_set_lock                                           */
 315 /* Returns:     Nil                                                         */
 316 /* Parameters:  arg(I) - pointer to local context to use                    */
 317 /*              tmp(I) - new value for lock                                 */
 318 /*                                                                          */
 319 /* Stub function that allows for external manipulation of ipfr_lock         */
 320 /* ------------------------------------------------------------------------ */
 321 void
 322 ipf_frag_setlock(arg, tmp)
 323         void *arg;
 324         int tmp;
 325 {
 326         ipf_frag_softc_t *softf = arg;
 327
 328         softf->ipfr_lock = tmp;
 329 }
 330
 331
 332 /* ------------------------------------------------------------------------ */
 333 /* Function:    ipf_frag_stats                                              */
 334 /* Returns:     ipfrstat_t* - pointer to struct with current frag stats     */
 335 /* Parameters:  arg(I) - pointer to local context to use                    */
 336 /*                                                                          */
 337 /* Updates ipfr_stats with current information and returns a pointer to it  */
 338 /* ------------------------------------------------------------------------ */
 339 ipfrstat_t *
 340 ipf_frag_stats(arg)
 341         void *arg;
 342 {
 343         ipf_frag_softc_t *softf = arg;
 344
 345         softf->ipfr_stats.ifs_table = softf->ipfr_heads;
 346         softf->ipfr_stats.ifs_nattab = softf->ipfr_nattab;
 347         return &softf->ipfr_stats;
 348 }
 349
 350
 351 /* ------------------------------------------------------------------------ */
 352 /* Function:    ipfr_frag_new                                               */
 353 /* Returns:     ipfr_t * - pointer to fragment cache state info or NULL     */
 354 /* Parameters:  fin(I)   - pointer to packet information                    */
 355 /*              table(I) - pointer to frag table to add to                  */
 356 /*              lock(I)  - pointer to lock to get a write hold of           */
 357 /*                                                                          */
 358 /* Add a new entry to the fragment cache, registering it as having come     */
 359 /* through this box, with the result of the filter operation.               */
 360 /*                                                                          */
 361 /* If this function succeeds, it returns with a write lock held on "lock".  */
 362 /* If it fails, no lock is held on return.                                  */
 363 /* ------------------------------------------------------------------------ */
 364 static ipfr_t *
 365 ipfr_frag_new(softc, softf, fin, pass, table
 366 #ifdef USE_MUTEXES
 367 , lock
 368 #endif
 369 )
 370         ipf_main_softc_t *softc;
 371         ipf_frag_softc_t *softf;
 372         fr_info_t *fin;
 373         u_32_t pass;
 374         ipfr_t *table[];
 375 #ifdef USE_MUTEXES
 376         ipfrwlock_t *lock;
 377 #endif
 378 {
 379         ipfr_t *fra, frag, *fran;
 380         u_int idx, off;
 381         frentry_t *fr;
 382
 383         if (softf->ipfr_stats.ifs_inuse >= softf->ipfr_size) {
 384                 FBUMPD(ifs_maximum);
 385                 return NULL;
 386         }
 387
 388         if ((fin->fin_flx & (FI_FRAG|FI_BAD)) != FI_FRAG) {
 389                 FBUMPD(ifs_newbad);
 390                 return NULL;
 391         }
 392
 393         if (pass & FR_FRSTRICT) {
 394                 if (fin->fin_off != 0) {
 395                         FBUMPD(ifs_newrestrictnot0);
 396                         return NULL;
 397                 }
 398         }
 399
 400         frag.ipfr_v = fin->fin_v;
 401         idx = fin->fin_v;
 402         frag.ipfr_p = fin->fin_p;
 403         idx += fin->fin_p;
 404         frag.ipfr_id = fin->fin_id;
 405         idx += fin->fin_id;
 406         frag.ipfr_source = fin->fin_fi.fi_src;
 407         idx += frag.ipfr_src.s_addr;
 408         frag.ipfr_dest = fin->fin_fi.fi_dst;
 409         idx += frag.ipfr_dst.s_addr;
 410         frag.ipfr_ifp = fin->fin_ifp;
 411         idx *= 127;
 412         idx %= softf->ipfr_size;
 413
 414         frag.ipfr_optmsk = fin->fin_fi.fi_optmsk & IPF_OPTCOPY;
 415         frag.ipfr_secmsk = fin->fin_fi.fi_secmsk;
 416         frag.ipfr_auth = fin->fin_fi.fi_auth;
 417
 418         off = fin->fin_off >> 3;
 419         if (off == 0) {
 420                 char *ptr;
 421                 int end;
 422
 423 #ifdef USE_INET6
 424                 if (fin->fin_v == 6) {
 425
 426                         ptr = (char *)fin->fin_fraghdr +
 427                               sizeof(struct ip6_frag);
 428                 } else
 429 #endif
 430                 {
 431                         ptr = fin->fin_dp;
 432                 }
 433                 end = fin->fin_plen - (ptr - (char *)fin->fin_ip);
 434                 frag.ipfr_firstend = end >> 3;
 435         } else {
 436                 frag.ipfr_firstend = 0;
 437         }
 438
 439         /*
 440          * allocate some memory, if possible, if not, just record that we
 441          * failed to do so.
 442          */
 443         KMALLOC(fran, ipfr_t *);
 444         if (fran == NULL) {
 445                 FBUMPD(ifs_nomem);
 446                 return NULL;
 447         }
 448
 449         WRITE_ENTER(lock);
 450
 451         /*
 452          * first, make sure it isn't already there...
 453          */
 454         for (fra = table[idx]; (fra != NULL); fra = fra->ipfr_hnext)
 455                 if (!bcmp((char *)&frag.ipfr_ifp, (char *)&fra->ipfr_ifp,
 456                           IPFR_CMPSZ)) {
 457                         RWLOCK_EXIT(lock);
 458                         FBUMPD(ifs_exists);
 459                         KFREE(fra);
 460                         return NULL;
 461                 }
 462
 463         fra = fran;
 464         fran = NULL;
 465         fr = fin->fin_fr;
 466         fra->ipfr_rule = fr;
 467         if (fr != NULL) {
 468                 MUTEX_ENTER(&fr->fr_lock);
 469                 fr->fr_ref++;
 470                 MUTEX_EXIT(&fr->fr_lock);
 471         }
 472
 473         /*
 474          * Insert the fragment into the fragment table, copy the struct used
 475          * in the search using bcopy rather than reassign each field.
 476          * Set the ttl to the default.
 477          */
 478         if ((fra->ipfr_hnext = table[idx]) != NULL)
 479                 table[idx]->ipfr_hprev = &fra->ipfr_hnext;
 480         fra->ipfr_hprev = table + idx;
 481         fra->ipfr_data = NULL;
 482         table[idx] = fra;
 483         bcopy((char *)&frag.ipfr_ifp, (char *)&fra->ipfr_ifp, IPFR_CMPSZ);
 484         fra->ipfr_v = fin->fin_v;
 485         fra->ipfr_ttl = softc->ipf_ticks + softf->ipfr_ttl;
 486         fra->ipfr_firstend = frag.ipfr_firstend;
 487
 488         /*
 489          * Compute the offset of the expected start of the next packet.
 490          */
 491         if (off == 0)
 492                 fra->ipfr_seen0 = 1;
 493         fra->ipfr_off = off + (fin->fin_dlen >> 3);
 494         fra->ipfr_pass = pass;
 495         fra->ipfr_ref = 1;
 496         fra->ipfr_pkts = 1;
 497         fra->ipfr_bytes = fin->fin_plen;
 498         FBUMP(ifs_inuse);
 499         FBUMP(ifs_new);
 500         return fra;
 501 }
 502
 503
 504 /* ------------------------------------------------------------------------ */
 505 /* Function:    ipf_frag_new                                                */
 506 /* Returns:     int - 0 == success, -1 == error                             */
 507 /* Parameters:  fin(I)  - pointer to packet information                     */
 508 /*                                                                          */
 509 /* Add a new entry to the fragment cache table based on the current packet  */
 510 /* ------------------------------------------------------------------------ */
 511 int
 512 ipf_frag_new(softc, fin, pass)
 513         ipf_main_softc_t *softc;
 514         u_32_t pass;
 515         fr_info_t *fin;
 516 {
 517         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
 518         ipfr_t  *fra;
 519
 520         if (softf->ipfr_lock != 0)
 521                 return -1;
 522
 523 #ifdef USE_MUTEXES
 524         fra = ipfr_frag_new(softc, softf, fin, pass, softf->ipfr_heads, &softc->ipf_frag);
 525 #else
 526         fra = ipfr_frag_new(softc, softf, fin, pass, softf->ipfr_heads);
 527 #endif
 528         if (fra != NULL) {
 529                 *softf->ipfr_tail = fra;
 530                 fra->ipfr_prev = softf->ipfr_tail;
 531                 softf->ipfr_tail = &fra->ipfr_next;
 532                 fra->ipfr_next = NULL;
 533                 RWLOCK_EXIT(&softc->ipf_frag);
 534         }
 535         return fra ? 0 : -1;
 536 }
 537
 538
 539 /* ------------------------------------------------------------------------ */
 540 /* Function:    ipf_frag_natnew                                             */
 541 /* Returns:     int - 0 == success, -1 == error                             */
 542 /* Parameters:  fin(I)  - pointer to packet information                     */
 543 /*              nat(I)  - pointer to NAT structure                          */
 544 /*                                                                          */
 545 /* Create a new NAT fragment cache entry based on the current packet and    */
 546 /* the NAT structure for this "session".                                    */
 547 /* ------------------------------------------------------------------------ */
 548 int
 549 ipf_frag_natnew(softc, fin, pass, nat)
 550         ipf_main_softc_t *softc;
 551         fr_info_t *fin;
 552         u_32_t pass;
 553         nat_t *nat;
 554 {
 555         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
 556         ipfr_t  *fra;
 557
 558         if (softf->ipfr_lock != 0)
 559                 return 0;
 560
 561 #ifdef USE_MUTEXES
 562         fra = ipfr_frag_new(softc, softf, fin, pass, softf->ipfr_nattab,
 563                             &softf->ipfr_natfrag);
 564 #else
 565         fra = ipfr_frag_new(softc, softf, fin, pass, softf->ipfr_nattab);
 566 #endif
 567         if (fra != NULL) {
 568                 fra->ipfr_data = nat;
 569                 nat->nat_data = fra;
 570                 *softf->ipfr_nattail = fra;
 571                 fra->ipfr_prev = softf->ipfr_nattail;
 572                 softf->ipfr_nattail = &fra->ipfr_next;
 573                 fra->ipfr_next = NULL;
 574                 RWLOCK_EXIT(&softf->ipfr_natfrag);
 575                 return 0;
 576         }
 577         return -1;
 578 }
 579
 580
 581 /* ------------------------------------------------------------------------ */
 582 /* Function:    ipf_frag_ipidnew                                            */
 583 /* Returns:     int - 0 == success, -1 == error                             */
 584 /* Parameters:  fin(I)  - pointer to packet information                     */
 585 /*              ipid(I) - new IP ID for this fragmented packet              */
 586 /*                                                                          */
 587 /* Create a new fragment cache entry for this packet and store, as a data   */
 588 /* pointer, the new IP ID value.                                            */
 589 /* ------------------------------------------------------------------------ */
 590 int
 591 ipf_frag_ipidnew(fin, ipid)
 592         fr_info_t *fin;
 593         u_32_t ipid;
 594 {
 595         ipf_main_softc_t *softc = fin->fin_main_soft;
 596         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
 597         ipfr_t  *fra;
 598
 599         if (softf->ipfr_lock)
 600                 return 0;
 601
 602 #ifdef USE_MUTEXES
 603         fra = ipfr_frag_new(softc, softf, fin, 0, softf->ipfr_ipidtab, &softf->ipfr_ipidfrag);
 604 #else
 605         fra = ipfr_frag_new(softc, softf, fin, 0, softf->ipfr_ipidtab);
 606 #endif
 607         if (fra != NULL) {
 608                 fra->ipfr_data = (void *)(intptr_t)ipid;
 609                 *softf->ipfr_ipidtail = fra;
 610                 fra->ipfr_prev = softf->ipfr_ipidtail;
 611                 softf->ipfr_ipidtail = &fra->ipfr_next;
 612                 fra->ipfr_next = NULL;
 613                 RWLOCK_EXIT(&softf->ipfr_ipidfrag);
 614         }
 615         return fra ? 0 : -1;
 616 }
 617
 618
 619 /* ------------------------------------------------------------------------ */
 620 /* Function:    ipf_frag_lookup                                             */
 621 /* Returns:     ipfr_t * - pointer to ipfr_t structure if there's a         */
 622 /*                         matching entry in the frag table, else NULL      */
 623 /* Parameters:  fin(I)   - pointer to packet information                    */
 624 /*              table(I) - pointer to fragment cache table to search        */
 625 /*                                                                          */
 626 /* Check the fragment cache to see if there is already a record of this     */
 627 /* packet with its filter result known.                                     */
 628 /*                                                                          */
 629 /* If this function succeeds, it returns with a write lock held on "lock".  */
 630 /* If it fails, no lock is held on return.                                  */
 631 /* ------------------------------------------------------------------------ */
 632 static ipfr_t *
 633 ipf_frag_lookup(softc, softf, fin, table
 634 #ifdef USE_MUTEXES
 635 , lock
 636 #endif
 637 )
 638         ipf_main_softc_t *softc;
 639         ipf_frag_softc_t *softf;
 640         fr_info_t *fin;
 641         ipfr_t *table[];
 642 #ifdef USE_MUTEXES
 643         ipfrwlock_t *lock;
 644 #endif
 645 {
 646         ipfr_t *f, frag;
 647         u_int idx;
 648
 649         /*
 650          * We don't want to let short packets match because they could be
 651          * compromising the security of other rules that want to match on
 652          * layer 4 fields (and can't because they have been fragmented off.)
 653          * Why do this check here?  The counter acts as an indicator of this
 654          * kind of attack, whereas if it was elsewhere, it wouldn't know if
 655          * other matching packets had been seen.
 656          */
 657         if (fin->fin_flx & FI_SHORT) {
 658                 FBUMPD(ifs_short);
 659                 return NULL;
 660         }
 661
 662         if ((fin->fin_flx & FI_BAD) != 0) {
 663                 FBUMPD(ifs_bad);
 664                 return NULL;
 665         }
 666
 667         /*
 668          * For fragments, we record protocol, packet id, TOS and both IP#'s
 669          * (these should all be the same for all fragments of a packet).
 670          *
 671          * build up a hash value to index the table with.
 672          */
 673         frag.ipfr_v = fin->fin_v;
 674         idx = fin->fin_v;
 675         frag.ipfr_p = fin->fin_p;
 676         idx += fin->fin_p;
 677         frag.ipfr_id = fin->fin_id;
 678         idx += fin->fin_id;
 679         frag.ipfr_source = fin->fin_fi.fi_src;
 680         idx += frag.ipfr_src.s_addr;
 681         frag.ipfr_dest = fin->fin_fi.fi_dst;
 682         idx += frag.ipfr_dst.s_addr;
 683         frag.ipfr_ifp = fin->fin_ifp;
 684         idx *= 127;
 685         idx %= softf->ipfr_size;
 686
 687         frag.ipfr_optmsk = fin->fin_fi.fi_optmsk & IPF_OPTCOPY;
 688         frag.ipfr_secmsk = fin->fin_fi.fi_secmsk;
 689         frag.ipfr_auth = fin->fin_fi.fi_auth;
 690
 691         READ_ENTER(lock);
 692
 693         /*
 694          * check the table, careful to only compare the right amount of data
 695          */
 696         for (f = table[idx]; f; f = f->ipfr_hnext) {
 697                 if (!bcmp((char *)&frag.ipfr_ifp, (char *)&f->ipfr_ifp,
 698                           IPFR_CMPSZ)) {
 699                         u_short off;
 700
 701                         /*
 702                          * XXX - We really need to be guarding against the
 703                          * retransmission of (src,dst,id,offset-range) here
 704                          * because a fragmented packet is never resent with
 705                          * the same IP ID# (or shouldn't).
 706                          */
 707                         off = fin->fin_off >> 3;
 708                         if (f->ipfr_seen0) {
 709                                 if (off == 0) {
 710                                         FBUMPD(ifs_retrans0);
 711                                         continue;
 712                                 }
 713
 714                                 /*
 715                                  * Case 3. See comment for frpr_fragment6.
 716                                  */
 717                                 if ((f->ipfr_firstend != 0) &&
 718                                     (off < f->ipfr_firstend)) {
 719                                         FBUMP(ifs_overlap);
 720                                         DT2(ifs_overlap, u_short, off,
 721                                             ipfr_t *, f);
 722                                         fin->fin_flx |= FI_BAD;
 723                                         break;
 724                                 }
 725                         } else if (off == 0)
 726                                 f->ipfr_seen0 = 1;
 727
 728                         if (f != table[idx]) {
 729                                 ipfr_t **fp;
 730
 731                                 /*
 732                                  * Move fragment info. to the top of the list
 733                                  * to speed up searches.  First, delink...
 734                                  */
 735                                 fp = f->ipfr_hprev;
 736                                 (*fp) = f->ipfr_hnext;
 737                                 if (f->ipfr_hnext != NULL)
 738                                         f->ipfr_hnext->ipfr_hprev = fp;
 739                                 /*
 740                                  * Then put back at the top of the chain.
 741                                  */
 742                                 f->ipfr_hnext = table[idx];
 743                                 table[idx]->ipfr_hprev = &f->ipfr_hnext;
 744                                 f->ipfr_hprev = table + idx;
 745                                 table[idx] = f;
 746                         }
 747
 748                         /*
 749                          * If we've follwed the fragments, and this is the
 750                          * last (in order), shrink expiration time.
 751                          */
 752                         if (off == f->ipfr_off) {
 753                                 f->ipfr_off = (fin->fin_dlen >> 3) + off;
 754
 755                                 /*
 756                                  * Well, we could shrink the expiration time
 757                                  * but only if every fragment has been seen
 758                                  * in order upto this, the last. ipfr_badorder
 759                                  * is used here to count those out of order
 760                                  * and if it equals 0 when we get to the last
 761                                  * fragment then we can assume all of the
 762                                  * fragments have been seen and in order.
 763                                  */
 764 #if 0
 765                                 /*
 766                                  * Doing this properly requires moving it to
 767                                  * the head of the list which is infesible.
 768                                  */
 769                                 if ((more == 0) && (f->ipfr_badorder == 0))
 770                                         f->ipfr_ttl = softc->ipf_ticks + 1;
 771 #endif
 772                         } else {
 773                                 f->ipfr_badorder++;
 774                                 FBUMPD(ifs_unordered);
 775                                 if (f->ipfr_pass & FR_FRSTRICT) {
 776                                         FBUMPD(ifs_strict);
 777                                         continue;
 778                                 }
 779                         }
 780                         f->ipfr_pkts++;
 781                         f->ipfr_bytes += fin->fin_plen;
 782                         FBUMP(ifs_hits);
 783                         return f;
 784                 }
 785         }
 786
 787         RWLOCK_EXIT(lock);
 788         FBUMP(ifs_miss);
 789         return NULL;
 790 }
 791
 792
 793 /* ------------------------------------------------------------------------ */
 794 /* Function:    ipf_frag_natknown                                           */
 795 /* Returns:     nat_t* - pointer to 'parent' NAT structure if frag table    */
 796 /*                       match found, else NULL                             */
 797 /* Parameters:  fin(I)  - pointer to packet information                     */
 798 /*                                                                          */
 799 /* Functional interface for NAT lookups of the NAT fragment cache           */
 800 /* ------------------------------------------------------------------------ */
 801 nat_t *
 802 ipf_frag_natknown(fin)
 803         fr_info_t *fin;
 804 {
 805         ipf_main_softc_t *softc = fin->fin_main_soft;
 806         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
 807         nat_t   *nat;
 808         ipfr_t  *ipf;
 809
 810         if ((softf->ipfr_lock) || !softf->ipfr_natlist)
 811                 return NULL;
 812 #ifdef USE_MUTEXES
 813         ipf = ipf_frag_lookup(softc, softf, fin, softf->ipfr_nattab,
 814                               &softf->ipfr_natfrag);
 815 #else
 816         ipf = ipf_frag_lookup(softc, softf, fin, softf->ipfr_nattab);
 817 #endif
 818         if (ipf != NULL) {
 819                 nat = ipf->ipfr_data;
 820                 /*
 821                  * This is the last fragment for this packet.
 822                  */
 823                 if ((ipf->ipfr_ttl == softc->ipf_ticks + 1) && (nat != NULL)) {
 824                         nat->nat_data = NULL;
 825                         ipf->ipfr_data = NULL;
 826                 }
 827                 RWLOCK_EXIT(&softf->ipfr_natfrag);
 828         } else
 829                 nat = NULL;
 830         return nat;
 831 }
 832
 833
 834 /* ------------------------------------------------------------------------ */
 835 /* Function:    ipf_frag_ipidknown                                          */
 836 /* Returns:     u_32_t - IPv4 ID for this packet if match found, else       */
 837 /*                       return 0xfffffff to indicate no match.             */
 838 /* Parameters:  fin(I) - pointer to packet information                      */
 839 /*                                                                          */
 840 /* Functional interface for IP ID lookups of the IP ID fragment cache       */
 841 /* ------------------------------------------------------------------------ */
 842 u_32_t
 843 ipf_frag_ipidknown(fin)
 844         fr_info_t *fin;
 845 {
 846         ipf_main_softc_t *softc = fin->fin_main_soft;
 847         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
 848         ipfr_t  *ipf;
 849         u_32_t  id;
 850
 851         if (softf->ipfr_lock || !softf->ipfr_ipidlist)
 852                 return 0xffffffff;
 853
 854 #ifdef USE_MUTEXES
 855         ipf = ipf_frag_lookup(softc, softf, fin, softf->ipfr_ipidtab,
 856                               &softf->ipfr_ipidfrag);
 857 #else
 858         ipf = ipf_frag_lookup(softc, softf, fin, softf->ipfr_ipidtab);
 859 #endif
 860         if (ipf != NULL) {
 861                 id = (u_32_t)(intptr_t)ipf->ipfr_data;
 862                 RWLOCK_EXIT(&softf->ipfr_ipidfrag);
 863         } else
 864                 id = 0xffffffff;
 865         return id;
 866 }
 867
 868
 869 /* ------------------------------------------------------------------------ */
 870 /* Function:    ipf_frag_known                                              */
 871 /* Returns:     frentry_t* - pointer to filter rule if a match is found in  */
 872 /*                           the frag cache table, else NULL.               */
 873 /* Parameters:  fin(I)   - pointer to packet information                    */
 874 /*              passp(O) - pointer to where to store rule flags resturned   */
 875 /*                                                                          */
 876 /* Functional interface for normal lookups of the fragment cache.  If a     */
 877 /* match is found, return the rule pointer and flags from the rule, except  */
 878 /* that if FR_LOGFIRST is set, reset FR_LOG.                                */
 879 /* ------------------------------------------------------------------------ */
 880 frentry_t *
 881 ipf_frag_known(fin, passp)
 882         fr_info_t *fin;
 883         u_32_t *passp;
 884 {
 885         ipf_main_softc_t *softc = fin->fin_main_soft;
 886         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
 887         frentry_t *fr = NULL;
 888         ipfr_t  *fra;
 889         u_32_t pass;
 890
 891         if ((softf->ipfr_lock) || (softf->ipfr_list == NULL))
 892                 return NULL;
 893
 894 #ifdef USE_MUTEXES
 895         fra = ipf_frag_lookup(softc, softf, fin, softf->ipfr_heads,
 896                               &softc->ipf_frag);
 897 #else
 898         fra = ipf_frag_lookup(softc, softf, fin, softf->ipfr_heads);
 899 #endif
 900         if (fra != NULL) {
 901                 if (fin->fin_flx & FI_BAD) {
 902                         fr = &ipfr_block;
 903                         fin->fin_reason = FRB_BADFRAG;
 904                 } else {
 905                         fr = fra->ipfr_rule;
 906                 }
 907                 fin->fin_fr = fr;
 908                 if (fr != NULL) {
 909                         pass = fr->fr_flags;
 910                         if ((pass & FR_KEEPSTATE) != 0) {
 911                                 fin->fin_flx |= FI_STATE;
 912                                 /*
 913                                  * Reset the keep state flag here so that we
 914                                  * don't try and add a new state entry because
 915                                  * of a match here. That leads to blocking of
 916                                  * the packet later because the add fails.
 917                                  */
 918                                 pass &= ~FR_KEEPSTATE;
 919                         }
 920                         if ((pass & FR_LOGFIRST) != 0)
 921                                 pass &= ~(FR_LOGFIRST|FR_LOG);
 922                         *passp = pass;
 923                 }
 924                 RWLOCK_EXIT(&softc->ipf_frag);
 925         }
 926         return fr;
 927 }
 928
 929
 930 /* ------------------------------------------------------------------------ */
 931 /* Function:    ipf_frag_natforget                                          */
 932 /* Returns:     Nil                                                         */
 933 /* Parameters:  ptr(I) - pointer to data structure                          */
 934 /*                                                                          */
 935 /* Search through all of the fragment cache entries for NAT and wherever a  */
 936 /* pointer  is found to match ptr, reset it to NULL.                        */
 937 /* ------------------------------------------------------------------------ */
 938 void
 939 ipf_frag_natforget(softc, ptr)
 940         ipf_main_softc_t *softc;
 941         void *ptr;
 942 {
 943         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
 944         ipfr_t  *fr;
 945
 946         WRITE_ENTER(&softf->ipfr_natfrag);
 947         for (fr = softf->ipfr_natlist; fr; fr = fr->ipfr_next)
 948                 if (fr->ipfr_data == ptr)
 949                         fr->ipfr_data = NULL;
 950         RWLOCK_EXIT(&softf->ipfr_natfrag);
 951 }
 952
 953
 954 /* ------------------------------------------------------------------------ */
 955 /* Function:    ipf_frag_delete                                             */
 956 /* Returns:     Nil                                                         */
 957 /* Parameters:  fra(I)   - pointer to fragment structure to delete          */
 958 /*              tail(IO) - pointer to the pointer to the tail of the frag   */
 959 /*                         list                                             */
 960 /*                                                                          */
 961 /* Remove a fragment cache table entry from the table & list.  Also free    */
 962 /* the filter rule it is associated with it if it is no longer used as a    */
 963 /* result of decreasing the reference count.                                */
 964 /* ------------------------------------------------------------------------ */
 965 static void
 966 ipf_frag_delete(softc, fra, tail)
 967         ipf_main_softc_t *softc;
 968         ipfr_t *fra, ***tail;
 969 {
 970         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
 971
 972         if (fra->ipfr_next)
 973                 fra->ipfr_next->ipfr_prev = fra->ipfr_prev;
 974         *fra->ipfr_prev = fra->ipfr_next;
 975         if (*tail == &fra->ipfr_next)
 976                 *tail = fra->ipfr_prev;
 977
 978         if (fra->ipfr_hnext)
 979                 fra->ipfr_hnext->ipfr_hprev = fra->ipfr_hprev;
 980         *fra->ipfr_hprev = fra->ipfr_hnext;
 981
 982         if (fra->ipfr_rule != NULL) {
 983                 (void) ipf_derefrule(softc, &fra->ipfr_rule);
 984         }
 985
 986         if (fra->ipfr_ref <= 0)
 987                 ipf_frag_free(softf, fra);
 988 }
 989
 990
 991 /* ------------------------------------------------------------------------ */
 992 /* Function:    ipf_frag_free                                               */
 993 /* Returns:     Nil                                                         */
 994 /*                                                                          */
 995 /* ------------------------------------------------------------------------ */
 996 static void
 997 ipf_frag_free(softf, fra)
 998         ipf_frag_softc_t *softf;
 999         ipfr_t *fra;
1000 {
1001         KFREE(fra);
1002         FBUMP(ifs_expire);
1003         softf->ipfr_stats.ifs_inuse--;
1004 }
1005
1006
1007 /* ------------------------------------------------------------------------ */
1008 /* Function:    ipf_frag_clear                                              */
1009 /* Returns:     Nil                                                         */
1010 /* Parameters:  Nil                                                         */
1011 /*                                                                          */
1012 /* Free memory in use by fragment state information kept.  Do the normal    */
1013 /* fragment state stuff first and then the NAT-fragment table.              */
1014 /* ------------------------------------------------------------------------ */
1015 void
1016 ipf_frag_clear(softc)
1017         ipf_main_softc_t *softc;
1018 {
1019         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
1020         ipfr_t  *fra;
1021         nat_t   *nat;
1022
1023         WRITE_ENTER(&softc->ipf_frag);
1024         while ((fra = softf->ipfr_list) != NULL) {
1025                 fra->ipfr_ref--;
1026                 ipf_frag_delete(softc, fra, &softf->ipfr_tail);
1027         }
1028         softf->ipfr_tail = &softf->ipfr_list;
1029         RWLOCK_EXIT(&softc->ipf_frag);
1030
1031         WRITE_ENTER(&softc->ipf_nat);
1032         WRITE_ENTER(&softf->ipfr_natfrag);
1033         while ((fra = softf->ipfr_natlist) != NULL) {
1034                 nat = fra->ipfr_data;
1035                 if (nat != NULL) {
1036                         if (nat->nat_data == fra)
1037                                 nat->nat_data = NULL;
1038                 }
1039                 fra->ipfr_ref--;
1040                 ipf_frag_delete(softc, fra, &softf->ipfr_nattail);
1041         }
1042         softf->ipfr_nattail = &softf->ipfr_natlist;
1043         RWLOCK_EXIT(&softf->ipfr_natfrag);
1044         RWLOCK_EXIT(&softc->ipf_nat);
1045 }
1046
1047
1048 /* ------------------------------------------------------------------------ */
1049 /* Function:    ipf_frag_expire                                             */
1050 /* Returns:     Nil                                                         */
1051 /* Parameters:  Nil                                                         */
1052 /*                                                                          */
1053 /* Expire entries in the fragment cache table that have been there too long */
1054 /* ------------------------------------------------------------------------ */
1055 void
1056 ipf_frag_expire(softc)
1057         ipf_main_softc_t *softc;
1058 {
1059         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
1060         ipfr_t  **fp, *fra;
1061         nat_t   *nat;
1062         SPL_INT(s);
1063
1064         if (softf->ipfr_lock)
1065                 return;
1066
1067         SPL_NET(s);
1068         WRITE_ENTER(&softc->ipf_frag);
1069         /*
1070          * Go through the entire table, looking for entries to expire,
1071          * which is indicated by the ttl being less than or equal to ipf_ticks.
1072          */
1073         for (fp = &softf->ipfr_list; ((fra = *fp) != NULL); ) {
1074                 if (fra->ipfr_ttl > softc->ipf_ticks)
1075                         break;
1076                 fra->ipfr_ref--;
1077                 ipf_frag_delete(softc, fra, &softf->ipfr_tail);
1078         }
1079         RWLOCK_EXIT(&softc->ipf_frag);
1080
1081         WRITE_ENTER(&softf->ipfr_ipidfrag);
1082         for (fp = &softf->ipfr_ipidlist; ((fra = *fp) != NULL); ) {
1083                 if (fra->ipfr_ttl > softc->ipf_ticks)
1084                         break;
1085                 fra->ipfr_ref--;
1086                 ipf_frag_delete(softc, fra, &softf->ipfr_ipidtail);
1087         }
1088         RWLOCK_EXIT(&softf->ipfr_ipidfrag);
1089
1090         /*
1091          * Same again for the NAT table, except that if the structure also
1092          * still points to a NAT structure, and the NAT structure points back
1093          * at the one to be free'd, NULL the reference from the NAT struct.
1094          * NOTE: We need to grab both mutex's early, and in this order so as
1095          * to prevent a deadlock if both try to expire at the same time.
1096          * The extra if() statement here is because it locks out all NAT
1097          * operations - no need to do that if there are no entries in this
1098          * list, right?
1099          */
1100         if (softf->ipfr_natlist != NULL) {
1101                 WRITE_ENTER(&softc->ipf_nat);
1102                 WRITE_ENTER(&softf->ipfr_natfrag);
1103                 for (fp = &softf->ipfr_natlist; ((fra = *fp) != NULL); ) {
1104                         if (fra->ipfr_ttl > softc->ipf_ticks)
1105                                 break;
1106                         nat = fra->ipfr_data;
1107                         if (nat != NULL) {
1108                                 if (nat->nat_data == fra)
1109                                         nat->nat_data = NULL;
1110                         }
1111                         fra->ipfr_ref--;
1112                         ipf_frag_delete(softc, fra, &softf->ipfr_nattail);
1113                 }
1114                 RWLOCK_EXIT(&softf->ipfr_natfrag);
1115                 RWLOCK_EXIT(&softc->ipf_nat);
1116         }
1117         SPL_X(s);
1118 }
1119
1120
1121 /* ------------------------------------------------------------------------ */
1122 /* Function:    ipf_frag_pkt_next                                           */
1123 /* ------------------------------------------------------------------------ */
1124 int
1125 ipf_frag_pkt_next(softc, token, itp)
1126         ipf_main_softc_t *softc;
1127         ipftoken_t *token;
1128         ipfgeniter_t *itp;
1129 {
1130         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
1131
1132 #ifdef USE_MUTEXES
1133         return ipf_frag_next(softc, token, itp, &softf->ipfr_list,
1134                              &softf->ipfr_frag);
1135 #else
1136         return ipf_frag_next(softc, token, itp, &softf->ipfr_list);
1137 #endif
1138 }
1139
1140
1141 /* ------------------------------------------------------------------------ */
1142 /* Function:    ipf_frag_nat_next                                           */
1143 /* ------------------------------------------------------------------------ */
1144 int
1145 ipf_frag_nat_next(softc, token, itp)
1146         ipf_main_softc_t *softc;
1147         ipftoken_t *token;
1148         ipfgeniter_t *itp;
1149 {
1150         ipf_frag_softc_t *softf = softc->ipf_frag_soft;;
1151
1152 #ifdef USE_MUTEXES
1153         return ipf_frag_next(softc, token, itp, &softf->ipfr_natlist,
1154                              &softf->ipfr_natfrag);
1155 #else
1156         return ipf_frag_next(softc, token, itp, &softf->ipfr_natlist);
1157 #endif
1158 }
1159
1160 /* ------------------------------------------------------------------------ */
1161 /* Function:    ipf_frag_next                                               */
1162 /* Returns:     int      - 0 == success, else error                         */
1163 /* Parameters:  token(I) - pointer to token information for this caller     */
1164 /*              itp(I)   - pointer to generic iterator from caller          */
1165 /*              top(I)   - top of the fragment list                         */
1166 /*              lock(I)  - fragment cache lock                              */
1167 /*                                                                          */
1168 /* This function is used to interate through the list of entries in the     */
1169 /* fragment cache.  It increases the reference count on the one currently   */
1170 /* being returned so that the caller can come back and resume from it later.*/
1171 /*                                                                          */
1172 /* This function is used for both the NAT fragment cache as well as the ipf */
1173 /* fragment cache - hence the reason for passing in top and lock.           */
1174 /* ------------------------------------------------------------------------ */
1175 static int
1176 ipf_frag_next(softc, token, itp, top
1177 #ifdef USE_MUTEXES
1178 , lock
1179 #endif
1180 )
1181         ipf_main_softc_t *softc;
1182         ipftoken_t *token;
1183         ipfgeniter_t *itp;
1184         ipfr_t **top;
1185 #ifdef USE_MUTEXES
1186         ipfrwlock_t *lock;
1187 #endif
1188 {
1189         ipfr_t *frag, *next, zero;
1190         int error = 0;
1191
1192         if (itp->igi_data == NULL) {
1193                 IPFERROR(20001);
1194                 return EFAULT;
1195         }
1196
1197         if (itp->igi_nitems != 1) {
1198                 IPFERROR(20003);
1199                 return EFAULT;
1200         }
1201
1202         frag = token->ipt_data;
1203
1204         READ_ENTER(lock);
1205
1206         if (frag == NULL)
1207                 next = *top;
1208         else
1209                 next = frag->ipfr_next;
1210
1211         if (next != NULL) {
1212                 ATOMIC_INC(next->ipfr_ref);
1213                 token->ipt_data = next;
1214         } else {
1215                 bzero(&zero, sizeof(zero));
1216                 next = &zero;
1217                 token->ipt_data = NULL;
1218         }
1219         if (next->ipfr_next == NULL)
1220                 ipf_token_mark_complete(token);
1221
1222         RWLOCK_EXIT(lock);
1223
1224         error = COPYOUT(next, itp->igi_data, sizeof(*next));
1225         if (error != 0)
1226                 IPFERROR(20002);
1227
1228         if (frag != NULL) {
1229 #ifdef USE_MUTEXES
1230                 ipf_frag_deref(softc, &frag, lock);
1231 #else
1232                 ipf_frag_deref(softc, &frag);
1233 #endif
1234         }
1235         return error;
1236 }
1237
1238
1239 /* ------------------------------------------------------------------------ */
1240 /* Function:    ipf_frag_pkt_deref                                          */
1241 /* Returns:     Nil                                                         */
1242 /*                                                                          */
1243 /* ------------------------------------------------------------------------ */
1244 void
1245 ipf_frag_pkt_deref(softc, data)
1246         ipf_main_softc_t *softc;
1247         void *data;
1248 {
1249         ipfr_t **frp = data;
1250
1251 #ifdef USE_MUTEXES
1252         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
1253
1254         ipf_frag_deref(softc->ipf_frag_soft, frp, &softf->ipfr_frag);
1255 #else
1256         ipf_frag_deref(softc->ipf_frag_soft, frp);
1257 #endif
1258 }
1259
1260
1261 /* ------------------------------------------------------------------------ */
1262 /* Function:    ipf_frag_nat_deref                                          */
1263 /* Returns:     Nil                                                         */
1264 /*                                                                          */
1265 /* ------------------------------------------------------------------------ */
1266 void
1267 ipf_frag_nat_deref(softc, data)
1268         ipf_main_softc_t *softc;
1269         void *data;
1270 {
1271         ipfr_t **frp = data;
1272
1273 #ifdef USE_MUTEXES
1274         ipf_frag_softc_t *softf = softc->ipf_frag_soft;
1275
1276         ipf_frag_deref(softc->ipf_frag_soft, frp, &softf->ipfr_natfrag);
1277 #else
1278         ipf_frag_deref(softc->ipf_frag_soft, frp);
1279 #endif
1280 }
1281
1282
1283 /* ------------------------------------------------------------------------ */
1284 /* Function:    ipf_frag_deref                                              */
1285 /* Returns:     Nil                                                         */
1286 /* Parameters:  frp(IO) - pointer to fragment structure to deference        */
1287 /*              lock(I) - lock associated with the fragment                 */
1288 /*                                                                          */
1289 /* This function dereferences a fragment structure (ipfr_t).  The pointer   */
1290 /* passed in will always be reset back to NULL, even if the structure is    */
1291 /* not freed, to enforce the notion that the caller is no longer entitled   */
1292 /* to use the pointer it is dropping the reference to.                      */
1293 /* ------------------------------------------------------------------------ */
1294 static void
1295 ipf_frag_deref(arg, frp
1296 #ifdef USE_MUTEXES
1297 , lock
1298 #endif
1299 )
1300         void *arg;
1301         ipfr_t **frp;
1302 #ifdef USE_MUTEXES
1303         ipfrwlock_t *lock;
1304 #endif
1305 {
1306         ipf_frag_softc_t *softf = arg;
1307         ipfr_t *fra;
1308
1309         fra = *frp;
1310         *frp = NULL;
1311
1312         WRITE_ENTER(lock);
1313         fra->ipfr_ref--;
1314         if (fra->ipfr_ref <= 0)
1315                 ipf_frag_free(softf, fra);
1316         RWLOCK_EXIT(lock);
1317 }