4 * Copyright (C) 1993-2003 by Darren Reed.
6 * See the IPFILTER.LICENCE file for details on licencing.
8 #if defined(KERNEL) || defined(_KERNEL)
14 #include <sys/errno.h>
15 #include <sys/types.h>
16 #include <sys/param.h>
20 # include <sys/timeout.h>
33 #if defined(_KERNEL) && (__FreeBSD_version >= 220000)
34 # include <sys/filio.h>
35 # include <sys/fcntl.h>
37 # include <sys/ioctl.h>
40 # include <sys/protosw.h>
42 #include <sys/socket.h>
44 # include <sys/systm.h>
45 # if !defined(__SVR4) && !defined(__svr4__)
46 # include <sys/mbuf.h>
49 #if !defined(__SVR4) && !defined(__svr4__)
50 # if defined(_KERNEL) && !defined(__sgi) && !defined(AIX)
51 # include <sys/kernel.h>
54 # include <sys/byteorder.h>
56 # include <sys/dditypes.h>
58 # include <sys/stream.h>
59 # include <sys/kmem.h>
65 #include <net/route.h>
66 #include <netinet/in.h>
67 #include <netinet/in_systm.h>
68 #include <netinet/ip.h>
70 # include <netinet/ip_var.h>
72 #include <netinet/tcp.h>
73 #include <netinet/udp.h>
74 #include <netinet/ip_icmp.h>
75 #include "netinet/ip_compat.h"
76 #include <netinet/tcpip.h>
77 #include "netinet/ip_fil.h"
78 #include "netinet/ip_nat.h"
79 #include "netinet/ip_frag.h"
80 #include "netinet/ip_state.h"
81 #include "netinet/ip_auth.h"
82 #include "netinet/ip_proxy.h"
83 #if (__FreeBSD_version >= 300000)
84 # include <sys/malloc.h>
87 # include <sys/libkern.h>
88 # include <sys/systm.h>
90 extern struct callout_handle fr_slowtimer_ch;
93 #if defined(__NetBSD__) && (__NetBSD_Version__ >= 104230000)
94 # include <sys/callout.h>
95 extern struct callout fr_slowtimer_ch;
97 #if defined(__OpenBSD__)
98 # include <sys/timeout.h>
99 extern struct timeout fr_slowtimer_ch;
101 /* END OF INCLUDES */
104 static const char sccsid[] = "@(#)ip_frag.c 1.11 3/24/96 (C) 1993-2000 Darren Reed";
105 static const char rcsid[] = "@(#)$FreeBSD$";
106 /* static const char rcsid[] = "@(#)$Id: ip_frag.c,v 2.77.2.12 2007/09/20 12:51:51 darrenr Exp $"; */
110 ipfr_t *ipfr_list = NULL;
111 ipfr_t **ipfr_tail = &ipfr_list;
113 ipfr_t *ipfr_natlist = NULL;
114 ipfr_t **ipfr_nattail = &ipfr_natlist;
116 ipfr_t *ipfr_ipidlist = NULL;
117 ipfr_t **ipfr_ipidtail = &ipfr_ipidlist;
119 static ipfr_t **ipfr_heads;
120 static ipfr_t **ipfr_nattab;
121 static ipfr_t **ipfr_ipidtab;
123 static ipfrstat_t ipfr_stats;
124 static int ipfr_inuse = 0;
125 int ipfr_size = IPFT_SIZE;
127 int fr_ipfrttl = 120; /* 60 seconds */
128 int fr_frag_lock = 0;
129 int fr_frag_init = 0;
133 static ipfr_t *ipfr_newfrag __P((fr_info_t *, u_32_t, ipfr_t **));
134 static ipfr_t *fr_fraglookup __P((fr_info_t *, ipfr_t **));
135 static void fr_fragdelete __P((ipfr_t *, ipfr_t ***));
136 static void fr_fragfree __P((ipfr_t *));
139 /* ------------------------------------------------------------------------ */
140 /* Function: fr_fraginit */
141 /* Returns: int - 0 == success, -1 == error */
142 /* Parameters: Nil */
144 /* Initialise the hash tables for the fragment cache lookups. */
145 /* ------------------------------------------------------------------------ */
148 KMALLOCS(ipfr_heads, ipfr_t **, ipfr_size * sizeof(ipfr_t *));
149 if (ipfr_heads == NULL)
151 bzero((char *)ipfr_heads, ipfr_size * sizeof(ipfr_t *));
153 KMALLOCS(ipfr_nattab, ipfr_t **, ipfr_size * sizeof(ipfr_t *));
154 if (ipfr_nattab == NULL)
156 bzero((char *)ipfr_nattab, ipfr_size * sizeof(ipfr_t *));
158 KMALLOCS(ipfr_ipidtab, ipfr_t **, ipfr_size * sizeof(ipfr_t *));
159 if (ipfr_ipidtab == NULL)
161 bzero((char *)ipfr_ipidtab, ipfr_size * sizeof(ipfr_t *));
163 RWLOCK_INIT(&ipf_frag, "ipf fragment rwlock");
170 /* ------------------------------------------------------------------------ */
171 /* Function: fr_fragunload */
173 /* Parameters: Nil */
175 /* Free all memory allocated whilst running and from initialisation. */
176 /* ------------------------------------------------------------------------ */
179 if (fr_frag_init == 1) {
182 RW_DESTROY(&ipf_frag);
186 if (ipfr_heads != NULL)
187 KFREES(ipfr_heads, ipfr_size * sizeof(ipfr_t *));
190 if (ipfr_nattab != NULL)
191 KFREES(ipfr_nattab, ipfr_size * sizeof(ipfr_t *));
194 if (ipfr_ipidtab != NULL)
195 KFREES(ipfr_ipidtab, ipfr_size * sizeof(ipfr_t *));
200 /* ------------------------------------------------------------------------ */
201 /* Function: fr_fragstats */
202 /* Returns: ipfrstat_t* - pointer to struct with current frag stats */
203 /* Parameters: Nil */
205 /* Updates ipfr_stats with current information and returns a pointer to it */
206 /* ------------------------------------------------------------------------ */
207 ipfrstat_t *fr_fragstats()
209 ipfr_stats.ifs_table = ipfr_heads;
210 ipfr_stats.ifs_nattab = ipfr_nattab;
211 ipfr_stats.ifs_inuse = ipfr_inuse;
216 /* ------------------------------------------------------------------------ */
217 /* Function: ipfr_newfrag */
218 /* Returns: ipfr_t * - pointer to fragment cache state info or NULL */
219 /* Parameters: fin(I) - pointer to packet information */
220 /* table(I) - pointer to frag table to add to */
222 /* Add a new entry to the fragment cache, registering it as having come */
223 /* through this box, with the result of the filter operation. */
224 /* ------------------------------------------------------------------------ */
225 static ipfr_t *ipfr_newfrag(fin, pass, table)
235 if (ipfr_inuse >= IPFT_SIZE)
238 if ((fin->fin_flx & (FI_FRAG|FI_BAD)) != FI_FRAG)
243 if (pass & FR_FRSTRICT)
244 if (fin->fin_off != 0)
247 frag.ipfr_p = ip->ip_p;
249 frag.ipfr_id = ip->ip_id;
251 frag.ipfr_tos = ip->ip_tos;
252 frag.ipfr_src.s_addr = ip->ip_src.s_addr;
253 idx += ip->ip_src.s_addr;
254 frag.ipfr_dst.s_addr = ip->ip_dst.s_addr;
255 idx += ip->ip_dst.s_addr;
256 frag.ipfr_ifp = fin->fin_ifp;
260 frag.ipfr_optmsk = fin->fin_fi.fi_optmsk & IPF_OPTCOPY;
261 frag.ipfr_secmsk = fin->fin_fi.fi_secmsk;
262 frag.ipfr_auth = fin->fin_fi.fi_auth;
265 * first, make sure it isn't already there...
267 for (fra = table[idx]; (fra != NULL); fra = fra->ipfr_hnext)
268 if (!bcmp((char *)&frag.ipfr_ifp, (char *)&fra->ipfr_ifp,
270 ipfr_stats.ifs_exists++;
275 * allocate some memory, if possible, if not, just record that we
278 KMALLOC(fra, ipfr_t *);
280 ipfr_stats.ifs_nomem++;
287 MUTEX_ENTER(&fr->fr_lock);
289 MUTEX_EXIT(&fr->fr_lock);
293 * Insert the fragment into the fragment table, copy the struct used
294 * in the search using bcopy rather than reassign each field.
295 * Set the ttl to the default.
297 if ((fra->ipfr_hnext = table[idx]) != NULL)
298 table[idx]->ipfr_hprev = &fra->ipfr_hnext;
299 fra->ipfr_hprev = table + idx;
300 fra->ipfr_data = NULL;
302 bcopy((char *)&frag.ipfr_ifp, (char *)&fra->ipfr_ifp, IPFR_CMPSZ);
303 fra->ipfr_ttl = fr_ticks + fr_ipfrttl;
306 * Compute the offset of the expected start of the next packet.
308 off = ip->ip_off & IP_OFFMASK;
311 fra->ipfr_off = off + (fin->fin_dlen >> 3);
312 fra->ipfr_pass = pass;
314 ipfr_stats.ifs_new++;
320 /* ------------------------------------------------------------------------ */
321 /* Function: fr_newfrag */
322 /* Returns: int - 0 == success, -1 == error */
323 /* Parameters: fin(I) - pointer to packet information */
325 /* Add a new entry to the fragment cache table based on the current packet */
326 /* ------------------------------------------------------------------------ */
327 int fr_newfrag(fin, pass)
333 if ((fin->fin_v != 4) || (fr_frag_lock != 0))
336 WRITE_ENTER(&ipf_frag);
337 fra = ipfr_newfrag(fin, pass, ipfr_heads);
340 fra->ipfr_prev = ipfr_tail;
341 ipfr_tail = &fra->ipfr_next;
342 if (ipfr_list == NULL)
344 fra->ipfr_next = NULL;
346 RWLOCK_EXIT(&ipf_frag);
351 /* ------------------------------------------------------------------------ */
352 /* Function: fr_nat_newfrag */
353 /* Returns: int - 0 == success, -1 == error */
354 /* Parameters: fin(I) - pointer to packet information */
355 /* nat(I) - pointer to NAT structure */
357 /* Create a new NAT fragment cache entry based on the current packet and */
358 /* the NAT structure for this "session". */
359 /* ------------------------------------------------------------------------ */
360 int fr_nat_newfrag(fin, pass, nat)
367 if ((fin->fin_v != 4) || (fr_frag_lock != 0))
370 WRITE_ENTER(&ipf_natfrag);
371 fra = ipfr_newfrag(fin, pass, ipfr_nattab);
373 fra->ipfr_data = nat;
376 fra->ipfr_prev = ipfr_nattail;
377 ipfr_nattail = &fra->ipfr_next;
378 fra->ipfr_next = NULL;
380 RWLOCK_EXIT(&ipf_natfrag);
385 /* ------------------------------------------------------------------------ */
386 /* Function: fr_ipid_newfrag */
387 /* Returns: int - 0 == success, -1 == error */
388 /* Parameters: fin(I) - pointer to packet information */
389 /* ipid(I) - new IP ID for this fragmented packet */
391 /* Create a new fragment cache entry for this packet and store, as a data */
392 /* pointer, the new IP ID value. */
393 /* ------------------------------------------------------------------------ */
394 int fr_ipid_newfrag(fin, ipid)
400 if ((fin->fin_v != 4) || (fr_frag_lock))
403 WRITE_ENTER(&ipf_ipidfrag);
404 fra = ipfr_newfrag(fin, 0, ipfr_ipidtab);
406 fra->ipfr_data = (void *)(uintptr_t)ipid;
407 *ipfr_ipidtail = fra;
408 fra->ipfr_prev = ipfr_ipidtail;
409 ipfr_ipidtail = &fra->ipfr_next;
410 fra->ipfr_next = NULL;
412 RWLOCK_EXIT(&ipf_ipidfrag);
417 /* ------------------------------------------------------------------------ */
418 /* Function: fr_fraglookup */
419 /* Returns: ipfr_t * - pointer to ipfr_t structure if there's a */
420 /* matching entry in the frag table, else NULL */
421 /* Parameters: fin(I) - pointer to packet information */
422 /* table(I) - pointer to fragment cache table to search */
424 /* Check the fragment cache to see if there is already a record of this */
425 /* packet with its filter result known. */
426 /* ------------------------------------------------------------------------ */
427 static ipfr_t *fr_fraglookup(fin, table)
435 if ((fin->fin_flx & (FI_FRAG|FI_BAD)) != FI_FRAG)
439 * For fragments, we record protocol, packet id, TOS and both IP#'s
440 * (these should all be the same for all fragments of a packet).
442 * build up a hash value to index the table with.
445 frag.ipfr_p = ip->ip_p;
447 frag.ipfr_id = ip->ip_id;
449 frag.ipfr_tos = ip->ip_tos;
450 frag.ipfr_src.s_addr = ip->ip_src.s_addr;
451 idx += ip->ip_src.s_addr;
452 frag.ipfr_dst.s_addr = ip->ip_dst.s_addr;
453 idx += ip->ip_dst.s_addr;
454 frag.ipfr_ifp = fin->fin_ifp;
458 frag.ipfr_optmsk = fin->fin_fi.fi_optmsk & IPF_OPTCOPY;
459 frag.ipfr_secmsk = fin->fin_fi.fi_secmsk;
460 frag.ipfr_auth = fin->fin_fi.fi_auth;
463 * check the table, careful to only compare the right amount of data
465 for (f = table[idx]; f; f = f->ipfr_hnext)
466 if (!bcmp((char *)&frag.ipfr_ifp, (char *)&f->ipfr_ifp,
471 * We don't want to let short packets match because
472 * they could be compromising the security of other
473 * rules that want to match on layer 4 fields (and
474 * can't because they have been fragmented off.)
475 * Why do this check here? The counter acts as an
476 * indicator of this kind of attack, whereas if it was
477 * elsewhere, it wouldn't know if other matching
478 * packets had been seen.
480 if (fin->fin_flx & FI_SHORT) {
481 ATOMIC_INCL(ipfr_stats.ifs_short);
486 * XXX - We really need to be guarding against the
487 * retransmission of (src,dst,id,offset-range) here
488 * because a fragmented packet is never resent with
489 * the same IP ID# (or shouldn't).
491 off = ip->ip_off & IP_OFFMASK;
494 ATOMIC_INCL(ipfr_stats.ifs_retrans0);
500 if (f != table[idx]) {
504 * Move fragment info. to the top of the list
505 * to speed up searches. First, delink...
508 (*fp) = f->ipfr_hnext;
509 if (f->ipfr_hnext != NULL)
510 f->ipfr_hnext->ipfr_hprev = fp;
512 * Then put back at the top of the chain.
514 f->ipfr_hnext = table[idx];
515 table[idx]->ipfr_hprev = &f->ipfr_hnext;
516 f->ipfr_hprev = table + idx;
521 * If we've follwed the fragments, and this is the
522 * last (in order), shrink expiration time.
524 if (off == f->ipfr_off) {
525 if (!(ip->ip_off & IP_MF))
526 f->ipfr_ttl = fr_ticks + 1;
527 f->ipfr_off = (fin->fin_dlen >> 3) + off;
528 } else if (f->ipfr_pass & FR_FRSTRICT)
530 ATOMIC_INCL(ipfr_stats.ifs_hits);
537 /* ------------------------------------------------------------------------ */
538 /* Function: fr_nat_knownfrag */
539 /* Returns: nat_t* - pointer to 'parent' NAT structure if frag table */
540 /* match found, else NULL */
541 /* Parameters: fin(I) - pointer to packet information */
543 /* Functional interface for NAT lookups of the NAT fragment cache */
544 /* ------------------------------------------------------------------------ */
545 nat_t *fr_nat_knownfrag(fin)
551 if ((fin->fin_v != 4) || (fr_frag_lock) || !ipfr_natlist)
553 READ_ENTER(&ipf_natfrag);
554 ipf = fr_fraglookup(fin, ipfr_nattab);
556 nat = ipf->ipfr_data;
558 * This is the last fragment for this packet.
560 if ((ipf->ipfr_ttl == fr_ticks + 1) && (nat != NULL)) {
561 nat->nat_data = NULL;
562 ipf->ipfr_data = NULL;
566 RWLOCK_EXIT(&ipf_natfrag);
571 /* ------------------------------------------------------------------------ */
572 /* Function: fr_ipid_knownfrag */
573 /* Returns: u_32_t - IPv4 ID for this packet if match found, else */
574 /* return 0xfffffff to indicate no match. */
575 /* Parameters: fin(I) - pointer to packet information */
577 /* Functional interface for IP ID lookups of the IP ID fragment cache */
578 /* ------------------------------------------------------------------------ */
579 u_32_t fr_ipid_knownfrag(fin)
585 if ((fin->fin_v != 4) || (fr_frag_lock) || !ipfr_ipidlist)
588 READ_ENTER(&ipf_ipidfrag);
589 ipf = fr_fraglookup(fin, ipfr_ipidtab);
591 id = (u_32_t)(uintptr_t)ipf->ipfr_data;
594 RWLOCK_EXIT(&ipf_ipidfrag);
599 /* ------------------------------------------------------------------------ */
600 /* Function: fr_knownfrag */
601 /* Returns: frentry_t* - pointer to filter rule if a match is found in */
602 /* the frag cache table, else NULL. */
603 /* Parameters: fin(I) - pointer to packet information */
604 /* passp(O) - pointer to where to store rule flags resturned */
606 /* Functional interface for normal lookups of the fragment cache. If a */
607 /* match is found, return the rule pointer and flags from the rule, except */
608 /* that if FR_LOGFIRST is set, reset FR_LOG. */
609 /* ------------------------------------------------------------------------ */
610 frentry_t *fr_knownfrag(fin, passp)
614 frentry_t *fr = NULL;
618 if ((fin->fin_v != 4) || (fr_frag_lock) || (ipfr_list == NULL))
621 READ_ENTER(&ipf_frag);
622 fra = fr_fraglookup(fin, ipfr_heads);
628 if ((pass & FR_LOGFIRST) != 0)
629 pass &= ~(FR_LOGFIRST|FR_LOG);
633 RWLOCK_EXIT(&ipf_frag);
638 /* ------------------------------------------------------------------------ */
639 /* Function: fr_forget */
641 /* Parameters: ptr(I) - pointer to data structure */
643 /* Search through all of the fragment cache entries and wherever a pointer */
644 /* is found to match ptr, reset it to NULL. */
645 /* ------------------------------------------------------------------------ */
651 WRITE_ENTER(&ipf_frag);
652 for (fr = ipfr_list; fr; fr = fr->ipfr_next)
653 if (fr->ipfr_data == ptr)
654 fr->ipfr_data = NULL;
655 RWLOCK_EXIT(&ipf_frag);
659 /* ------------------------------------------------------------------------ */
660 /* Function: fr_forgetnat */
662 /* Parameters: ptr(I) - pointer to data structure */
664 /* Search through all of the fragment cache entries for NAT and wherever a */
665 /* pointer is found to match ptr, reset it to NULL. */
666 /* ------------------------------------------------------------------------ */
667 void fr_forgetnat(ptr)
672 WRITE_ENTER(&ipf_natfrag);
673 for (fr = ipfr_natlist; fr; fr = fr->ipfr_next)
674 if (fr->ipfr_data == ptr)
675 fr->ipfr_data = NULL;
676 RWLOCK_EXIT(&ipf_natfrag);
680 /* ------------------------------------------------------------------------ */
681 /* Function: fr_fragdelete */
683 /* Parameters: fra(I) - pointer to fragment structure to delete */
684 /* tail(IO) - pointer to the pointer to the tail of the frag */
687 /* Remove a fragment cache table entry from the table & list. Also free */
688 /* the filter rule it is associated with it if it is no longer used as a */
689 /* result of decreasing the reference count. */
690 /* ------------------------------------------------------------------------ */
691 static void fr_fragdelete(fra, tail)
692 ipfr_t *fra, ***tail;
696 fra->ipfr_next->ipfr_prev = fra->ipfr_prev;
697 *fra->ipfr_prev = fra->ipfr_next;
698 if (*tail == &fra->ipfr_next)
699 *tail = fra->ipfr_prev;
702 fra->ipfr_hnext->ipfr_hprev = fra->ipfr_hprev;
703 *fra->ipfr_hprev = fra->ipfr_hnext;
705 if (fra->ipfr_rule != NULL) {
706 (void) fr_derefrule(&fra->ipfr_rule);
709 if (fra->ipfr_ref <= 0)
714 /* ------------------------------------------------------------------------ */
715 /* Function: fr_fragfree */
717 /* Parameters: fra - pointer to frag structure to free */
719 /* Take care of the details associated with deleting an entry from the frag */
720 /* cache. Currently this just means bumping stats correctly after freeing */
721 /* ------------------------------------------------------------------------ */
722 static void fr_fragfree(fra)
726 ipfr_stats.ifs_expire++;
731 /* ------------------------------------------------------------------------ */
732 /* Function: fr_fragclear */
734 /* Parameters: Nil */
736 /* Free memory in use by fragment state information kept. Do the normal */
737 /* fragment state stuff first and then the NAT-fragment table. */
738 /* ------------------------------------------------------------------------ */
744 WRITE_ENTER(&ipf_frag);
745 while ((fra = ipfr_list) != NULL) {
747 fr_fragdelete(fra, &ipfr_tail);
749 ipfr_tail = &ipfr_list;
750 RWLOCK_EXIT(&ipf_frag);
752 WRITE_ENTER(&ipf_nat);
753 WRITE_ENTER(&ipf_natfrag);
754 while ((fra = ipfr_natlist) != NULL) {
755 nat = fra->ipfr_data;
757 if (nat->nat_data == fra)
758 nat->nat_data = NULL;
761 fr_fragdelete(fra, &ipfr_nattail);
763 ipfr_nattail = &ipfr_natlist;
764 RWLOCK_EXIT(&ipf_natfrag);
765 RWLOCK_EXIT(&ipf_nat);
769 /* ------------------------------------------------------------------------ */
770 /* Function: fr_fragexpire */
772 /* Parameters: Nil */
774 /* Expire entries in the fragment cache table that have been there too long */
775 /* ------------------------------------------------------------------------ */
786 WRITE_ENTER(&ipf_frag);
788 * Go through the entire table, looking for entries to expire,
789 * which is indicated by the ttl being less than or equal to fr_ticks.
791 for (fp = &ipfr_list; ((fra = *fp) != NULL); ) {
792 if (fra->ipfr_ttl > fr_ticks)
795 fr_fragdelete(fra, &ipfr_tail);
797 RWLOCK_EXIT(&ipf_frag);
799 WRITE_ENTER(&ipf_ipidfrag);
800 for (fp = &ipfr_ipidlist; ((fra = *fp) != NULL); ) {
801 if (fra->ipfr_ttl > fr_ticks)
804 fr_fragdelete(fra, &ipfr_ipidtail);
806 RWLOCK_EXIT(&ipf_ipidfrag);
809 * Same again for the NAT table, except that if the structure also
810 * still points to a NAT structure, and the NAT structure points back
811 * at the one to be free'd, NULL the reference from the NAT struct.
812 * NOTE: We need to grab both mutex's early, and in this order so as
813 * to prevent a deadlock if both try to expire at the same time.
814 * The extra if() statement here is because it locks out all NAT
815 * operations - no need to do that if there are no entries in this
818 if (ipfr_natlist != NULL) {
819 WRITE_ENTER(&ipf_nat);
820 WRITE_ENTER(&ipf_natfrag);
821 for (fp = &ipfr_natlist; ((fra = *fp) != NULL); ) {
822 if (fra->ipfr_ttl > fr_ticks)
824 nat = fra->ipfr_data;
826 if (nat->nat_data == fra)
827 nat->nat_data = NULL;
830 fr_fragdelete(fra, &ipfr_nattail);
832 RWLOCK_EXIT(&ipf_natfrag);
833 RWLOCK_EXIT(&ipf_nat);
839 /* ------------------------------------------------------------------------ */
840 /* Function: fr_slowtimer */
842 /* Parameters: Nil */
844 /* Slowly expire held state for fragments. Timeouts are set * in */
845 /* expectation of this being called twice per second. */
846 /* ------------------------------------------------------------------------ */
847 #if !defined(_KERNEL) || (!SOLARIS && !defined(__hpux) && !defined(__sgi) && \
848 !defined(__osf__) && !defined(linux))
849 # if defined(_KERNEL) && ((BSD >= 199103) || defined(__sgi))
850 void fr_slowtimer __P((void *ptr))
855 READ_ENTER(&ipf_global);
866 # if defined(__NetBSD__) && (__NetBSD_Version__ >= 104240000)
867 callout_reset(&fr_slowtimer_ch, hz / 2, fr_slowtimer, NULL);
869 # if defined(__OpenBSD__)
870 timeout_add(&fr_slowtimer_ch, hz/2);
872 # if (__FreeBSD_version >= 300000)
873 fr_slowtimer_ch = timeout(fr_slowtimer, NULL, hz/2);
878 timeout(fr_slowtimer, NULL, hz/2);
880 # endif /* FreeBSD */
881 # endif /* OpenBSD */
885 RWLOCK_EXIT(&ipf_global);
886 # if (BSD < 199103) || !defined(_KERNEL)
890 #endif /* !SOLARIS && !defined(__hpux) && !defined(__sgi) */
893 /* ------------------------------------------------------------------------ */
894 /* Function: fr_nextfrag */
895 /* Returns: int - 0 == success, else error */
896 /* Parameters: token(I) - pointer to token information for this caller */
897 /* itp(I) - pointer to generic iterator from caller */
898 /* top(I) - top of the fragment list */
899 /* tail(I) - tail of the fragment list */
900 /* lock(I) - fragment cache lock */
902 /* This function is used to interate through the list of entries in the */
903 /* fragment cache. It increases the reference count on the one currently */
904 /* being returned so that the caller can come back and resume from it later.*/
906 /* This function is used for both the NAT fragment cache as well as the ipf */
907 /* fragment cache - hence the reason for passing in top, tail and lock. */
908 /* ------------------------------------------------------------------------ */
909 int fr_nextfrag(token, itp, top, tail
916 ipfr_t **top, ***tail;
921 ipfr_t *frag, *next, zero;
924 frag = token->ipt_data;
925 if (frag == (ipfr_t *)-1) {
926 ipf_freetoken(token);
934 next = frag->ipfr_next;
937 ATOMIC_INC(next->ipfr_ref);
938 token->ipt_data = next;
940 bzero(&zero, sizeof(zero));
942 token->ipt_data = NULL;
948 fr_fragderef(&frag, lock);
954 error = COPYOUT(next, itp->igi_data, sizeof(*next));
962 /* ------------------------------------------------------------------------ */
963 /* Function: fr_fragderef */
965 /* Parameters: frp(IO) - pointer to fragment structure to deference */
966 /* lock(I) - lock associated with the fragment */
968 /* This function dereferences a fragment structure (ipfr_t). The pointer */
969 /* passed in will always be reset back to NULL, even if the structure is */
970 /* not freed, to enforce the notion that the caller is no longer entitled */
971 /* to use the pointer it is dropping the reference to. */
972 /* ------------------------------------------------------------------------ */
973 void fr_fragderef(frp
990 if (fra->ipfr_ref <= 0)