17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * Copyright (C) 1997-2003 by Darren Reed. 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * See the IPFILTER.LICENCE file for details on licencing. 57c478bd9Sstevel@tonic-gate * 6*ab25eeb5Syz * $Id: ip_log.c,v 2.75.2.7 2005/06/11 07:47:44 darrenr Exp $ 77c478bd9Sstevel@tonic-gate * 8*ab25eeb5Syz * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 97c478bd9Sstevel@tonic-gate * Use is subject to license terms. 107c478bd9Sstevel@tonic-gate */ 117c478bd9Sstevel@tonic-gate 127c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 137c478bd9Sstevel@tonic-gate 147c478bd9Sstevel@tonic-gate #include <sys/param.h> 157c478bd9Sstevel@tonic-gate #if defined(KERNEL) || defined(_KERNEL) 167c478bd9Sstevel@tonic-gate # undef KERNEL 177c478bd9Sstevel@tonic-gate # undef _KERNEL 187c478bd9Sstevel@tonic-gate # define KERNEL 1 197c478bd9Sstevel@tonic-gate # define _KERNEL 1 207c478bd9Sstevel@tonic-gate #endif 217c478bd9Sstevel@tonic-gate #if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \ 227c478bd9Sstevel@tonic-gate defined(_KERNEL) 237c478bd9Sstevel@tonic-gate # include "opt_ipfilter_log.h" 247c478bd9Sstevel@tonic-gate #endif 25*ab25eeb5Syz #if defined(__FreeBSD__) && !defined(IPFILTER_LKM) 26*ab25eeb5Syz # if defined(_KERNEL) 27*ab25eeb5Syz # if defined(__FreeBSD_version) && (__FreeBSD_version >= 300000) 28*ab25eeb5Syz # include "opt_ipfilter.h" 297c478bd9Sstevel@tonic-gate # endif 30*ab25eeb5Syz # else 31*ab25eeb5Syz # include <osreldate.h> 327c478bd9Sstevel@tonic-gate # endif 337c478bd9Sstevel@tonic-gate #endif 34*ab25eeb5Syz #ifndef SOLARIS 35*ab25eeb5Syz # define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4))) 36*ab25eeb5Syz #endif 37*ab25eeb5Syz #include <sys/errno.h> 38*ab25eeb5Syz #include <sys/types.h> 39*ab25eeb5Syz #include <sys/file.h> 40*ab25eeb5Syz #ifndef _KERNEL 41*ab25eeb5Syz # include <stdio.h> 42*ab25eeb5Syz # include <string.h> 43*ab25eeb5Syz # include <stdlib.h> 44*ab25eeb5Syz # include <ctype.h> 45*ab25eeb5Syz # define _KERNEL 46*ab25eeb5Syz # define KERNEL 477c478bd9Sstevel@tonic-gate # ifdef __OpenBSD__ 487c478bd9Sstevel@tonic-gate struct file; 497c478bd9Sstevel@tonic-gate # endif 50*ab25eeb5Syz # include <sys/uio.h> 51*ab25eeb5Syz # undef _KERNEL 52*ab25eeb5Syz # undef KERNEL 53*ab25eeb5Syz #endif 54*ab25eeb5Syz #if __FreeBSD_version >= 220000 && defined(_KERNEL) 55*ab25eeb5Syz # include <sys/fcntl.h> 56*ab25eeb5Syz # include <sys/filio.h> 57*ab25eeb5Syz #else 58*ab25eeb5Syz # include <sys/ioctl.h> 59*ab25eeb5Syz #endif 60*ab25eeb5Syz #include <sys/time.h> 61*ab25eeb5Syz #if defined(_KERNEL) 62*ab25eeb5Syz # include <sys/systm.h> 63*ab25eeb5Syz # if defined(NetBSD) && (__NetBSD_Version__ >= 104000000) 64*ab25eeb5Syz # include <sys/proc.h> 657c478bd9Sstevel@tonic-gate # endif 66*ab25eeb5Syz #endif /* _KERNEL */ 67*ab25eeb5Syz #if !SOLARIS && !defined(__hpux) && !defined(linux) 68*ab25eeb5Syz # if (NetBSD > 199609) || (OpenBSD > 199603) || (__FreeBSD_version >= 300000) 69*ab25eeb5Syz # include <sys/dirent.h> 707c478bd9Sstevel@tonic-gate # else 71*ab25eeb5Syz # include <sys/dir.h> 727c478bd9Sstevel@tonic-gate # endif 73*ab25eeb5Syz # include <sys/mbuf.h> 74*ab25eeb5Syz #else 75*ab25eeb5Syz # if !defined(__hpux) && defined(_KERNEL) 76*ab25eeb5Syz # include <sys/filio.h> 77*ab25eeb5Syz # include <sys/cred.h> 78*ab25eeb5Syz # include <sys/ddi.h> 79*ab25eeb5Syz # include <sys/sunddi.h> 80*ab25eeb5Syz # include <sys/ksynch.h> 81*ab25eeb5Syz # include <sys/kmem.h> 82*ab25eeb5Syz # include <sys/mkdev.h> 83*ab25eeb5Syz # include <sys/dditypes.h> 84*ab25eeb5Syz # include <sys/cmn_err.h> 85*ab25eeb5Syz # endif /* !__hpux */ 86*ab25eeb5Syz #endif /* !SOLARIS && !__hpux */ 87*ab25eeb5Syz #if !defined(linux) 887c478bd9Sstevel@tonic-gate # include <sys/protosw.h> 89*ab25eeb5Syz #endif 90*ab25eeb5Syz #include <sys/socket.h> 917c478bd9Sstevel@tonic-gate 92*ab25eeb5Syz #include <net/if.h> 93*ab25eeb5Syz #ifdef sun 94*ab25eeb5Syz # include <net/af.h> 95*ab25eeb5Syz #endif 96*ab25eeb5Syz #if __FreeBSD_version >= 300000 97*ab25eeb5Syz # include <net/if_var.h> 98*ab25eeb5Syz #endif 99*ab25eeb5Syz #include <net/route.h> 100*ab25eeb5Syz #include <netinet/in.h> 101*ab25eeb5Syz #ifdef __sgi 102*ab25eeb5Syz # include <sys/ddi.h> 103*ab25eeb5Syz # ifdef IFF_DRVRLOCK /* IRIX6 */ 104*ab25eeb5Syz # include <sys/hashing.h> 1057c478bd9Sstevel@tonic-gate # endif 106*ab25eeb5Syz #endif 107*ab25eeb5Syz #if !defined(__hpux) && !defined(linux) && \ 108*ab25eeb5Syz !(defined(__sgi) && !defined(IFF_DRVRLOCK)) /*IRIX<6*/ 109*ab25eeb5Syz # include <netinet/in_var.h> 110*ab25eeb5Syz #endif 111*ab25eeb5Syz #include <netinet/in_systm.h> 112*ab25eeb5Syz #include <netinet/ip.h> 113*ab25eeb5Syz #include <netinet/tcp.h> 114*ab25eeb5Syz #include <netinet/udp.h> 115*ab25eeb5Syz #include <netinet/ip_icmp.h> 116*ab25eeb5Syz #ifdef USE_INET6 117*ab25eeb5Syz # include <netinet/icmp6.h> 118*ab25eeb5Syz #endif 119*ab25eeb5Syz #if !defined(linux) 1207c478bd9Sstevel@tonic-gate # include <netinet/ip_var.h> 1217c478bd9Sstevel@tonic-gate #endif 122*ab25eeb5Syz #ifndef _KERNEL 123*ab25eeb5Syz # include <syslog.h> 124*ab25eeb5Syz #endif 125*ab25eeb5Syz #include "netinet/ip_compat.h" 126*ab25eeb5Syz #include <netinet/tcpip.h> 127*ab25eeb5Syz #include "netinet/ip_fil.h" 128*ab25eeb5Syz #include "netinet/ip_nat.h" 129*ab25eeb5Syz #include "netinet/ip_frag.h" 130*ab25eeb5Syz #include "netinet/ip_state.h" 131*ab25eeb5Syz #include "netinet/ip_auth.h" 132*ab25eeb5Syz #if (__FreeBSD_version >= 300000) || defined(__NetBSD__) 133*ab25eeb5Syz # include <sys/malloc.h> 134*ab25eeb5Syz #endif 135*ab25eeb5Syz /* END OF INCLUDES */ 1367c478bd9Sstevel@tonic-gate 137*ab25eeb5Syz #ifdef IPFILTER_LOG 1387c478bd9Sstevel@tonic-gate 1397c478bd9Sstevel@tonic-gate # if defined(IPL_SELECT) 140*ab25eeb5Syz # include <machine/sys/user.h> 141*ab25eeb5Syz # include <sys/kthread_iface.h> 142*ab25eeb5Syz # define READ_COLLISION 0x001 1437c478bd9Sstevel@tonic-gate 144*ab25eeb5Syz iplog_select_t iplog_ss[IPL_LOGMAX+1]; 1457c478bd9Sstevel@tonic-gate 1467c478bd9Sstevel@tonic-gate extern int selwait; 1477c478bd9Sstevel@tonic-gate # endif /* IPL_SELECT */ 1487c478bd9Sstevel@tonic-gate 149*ab25eeb5Syz # if defined(linux) && defined(_KERNEL) 150*ab25eeb5Syz wait_queue_head_t iplh_linux[IPL_LOGSIZE]; 151*ab25eeb5Syz # endif 152*ab25eeb5Syz # if SOLARIS 1537c478bd9Sstevel@tonic-gate extern kcondvar_t iplwait; 1547c478bd9Sstevel@tonic-gate # endif 1557c478bd9Sstevel@tonic-gate 1567c478bd9Sstevel@tonic-gate iplog_t **iplh[IPL_LOGSIZE], *iplt[IPL_LOGSIZE], *ipll[IPL_LOGSIZE]; 1577c478bd9Sstevel@tonic-gate int iplused[IPL_LOGSIZE]; 1587c478bd9Sstevel@tonic-gate static fr_info_t iplcrc[IPL_LOGSIZE]; 1597c478bd9Sstevel@tonic-gate int ipl_suppress = 1; 1607c478bd9Sstevel@tonic-gate int ipl_buffer_sz; 1617c478bd9Sstevel@tonic-gate int ipl_logmax = IPL_LOGMAX; 1627c478bd9Sstevel@tonic-gate int ipl_logall = 0; 1637c478bd9Sstevel@tonic-gate int ipl_log_init = 0; 164*ab25eeb5Syz int ipl_logsize = IPFILTER_LOGSIZE; 165*ab25eeb5Syz int ipl_magic[IPL_LOGSIZE] = { IPL_MAGIC, IPL_MAGIC_NAT, IPL_MAGIC_STATE, 166*ab25eeb5Syz IPL_MAGIC, IPL_MAGIC, IPL_MAGIC, 167*ab25eeb5Syz IPL_MAGIC, IPL_MAGIC }; 1687c478bd9Sstevel@tonic-gate 1697c478bd9Sstevel@tonic-gate 1707c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 1717c478bd9Sstevel@tonic-gate /* Function: fr_loginit */ 1727c478bd9Sstevel@tonic-gate /* Returns: int - 0 == success (always returned) */ 1737c478bd9Sstevel@tonic-gate /* Parameters: Nil */ 1747c478bd9Sstevel@tonic-gate /* */ 1757c478bd9Sstevel@tonic-gate /* Initialise log buffers & pointers. Also iniialised the CRC to a local */ 1767c478bd9Sstevel@tonic-gate /* secret for use in calculating the "last log checksum". */ 1777c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 1787c478bd9Sstevel@tonic-gate int fr_loginit() 1797c478bd9Sstevel@tonic-gate { 1807c478bd9Sstevel@tonic-gate int i; 1817c478bd9Sstevel@tonic-gate 1827c478bd9Sstevel@tonic-gate for (i = IPL_LOGMAX; i >= 0; i--) { 1837c478bd9Sstevel@tonic-gate iplt[i] = NULL; 1847c478bd9Sstevel@tonic-gate ipll[i] = NULL; 1857c478bd9Sstevel@tonic-gate iplh[i] = &iplt[i]; 1867c478bd9Sstevel@tonic-gate iplused[i] = 0; 1877c478bd9Sstevel@tonic-gate bzero((char *)&iplcrc[i], sizeof(iplcrc[i])); 1887c478bd9Sstevel@tonic-gate # ifdef IPL_SELECT 1897c478bd9Sstevel@tonic-gate iplog_ss[i].read_waiter = 0; 1907c478bd9Sstevel@tonic-gate iplog_ss[i].state = 0; 191*ab25eeb5Syz # endif 192*ab25eeb5Syz # if defined(linux) && defined(_KERNEL) 193*ab25eeb5Syz init_waitqueue_head(iplh_linux + i); 1947c478bd9Sstevel@tonic-gate # endif 1957c478bd9Sstevel@tonic-gate } 1967c478bd9Sstevel@tonic-gate 1977c478bd9Sstevel@tonic-gate # if SOLARIS && defined(_KERNEL) 1987c478bd9Sstevel@tonic-gate cv_init(&iplwait, "ipl condvar", CV_DRIVER, NULL); 1997c478bd9Sstevel@tonic-gate # endif 2007c478bd9Sstevel@tonic-gate MUTEX_INIT(&ipl_mutex, "ipf log mutex"); 2017c478bd9Sstevel@tonic-gate 2027c478bd9Sstevel@tonic-gate ipl_log_init = 1; 2037c478bd9Sstevel@tonic-gate 2047c478bd9Sstevel@tonic-gate return 0; 2057c478bd9Sstevel@tonic-gate } 2067c478bd9Sstevel@tonic-gate 2077c478bd9Sstevel@tonic-gate 2087c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 2097c478bd9Sstevel@tonic-gate /* Function: fr_logunload */ 2107c478bd9Sstevel@tonic-gate /* Returns: Nil */ 2117c478bd9Sstevel@tonic-gate /* Parameters: Nil */ 2127c478bd9Sstevel@tonic-gate /* */ 2137c478bd9Sstevel@tonic-gate /* Clean up any log data that has accumulated without being read. */ 2147c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 2157c478bd9Sstevel@tonic-gate void fr_logunload() 2167c478bd9Sstevel@tonic-gate { 2177c478bd9Sstevel@tonic-gate int i; 2187c478bd9Sstevel@tonic-gate 2197c478bd9Sstevel@tonic-gate if (ipl_log_init == 0) 2207c478bd9Sstevel@tonic-gate return; 2217c478bd9Sstevel@tonic-gate 2227c478bd9Sstevel@tonic-gate for (i = IPL_LOGMAX; i >= 0; i--) 2237c478bd9Sstevel@tonic-gate (void) ipflog_clear(i); 2247c478bd9Sstevel@tonic-gate 2257c478bd9Sstevel@tonic-gate # if SOLARIS && defined(_KERNEL) 2267c478bd9Sstevel@tonic-gate cv_destroy(&iplwait); 2277c478bd9Sstevel@tonic-gate # endif 2287c478bd9Sstevel@tonic-gate MUTEX_DESTROY(&ipl_mutex); 2297c478bd9Sstevel@tonic-gate 2307c478bd9Sstevel@tonic-gate ipl_log_init = 0; 2317c478bd9Sstevel@tonic-gate } 2327c478bd9Sstevel@tonic-gate 2337c478bd9Sstevel@tonic-gate 2347c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 2357c478bd9Sstevel@tonic-gate /* Function: ipflog */ 2367c478bd9Sstevel@tonic-gate /* Returns: int - 0 == success, -1 == failure */ 2377c478bd9Sstevel@tonic-gate /* Parameters: fin(I) - pointer to packet information */ 2387c478bd9Sstevel@tonic-gate /* flags(I) - flags from filter rules */ 2397c478bd9Sstevel@tonic-gate /* */ 2407c478bd9Sstevel@tonic-gate /* Create a log record for a packet given that it has been triggered by a */ 2417c478bd9Sstevel@tonic-gate /* rule (or the default setting). Calculate the transport protocol header */ 2427c478bd9Sstevel@tonic-gate /* size using predetermined size of a couple of popular protocols and thus */ 2437c478bd9Sstevel@tonic-gate /* how much data to copy into the log, including part of the data body if */ 2447c478bd9Sstevel@tonic-gate /* requested. */ 2457c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 2467c478bd9Sstevel@tonic-gate int ipflog(fin, flags) 2477c478bd9Sstevel@tonic-gate fr_info_t *fin; 2487c478bd9Sstevel@tonic-gate u_int flags; 2497c478bd9Sstevel@tonic-gate { 2507c478bd9Sstevel@tonic-gate register size_t hlen; 2517c478bd9Sstevel@tonic-gate int types[2], mlen; 2527c478bd9Sstevel@tonic-gate size_t sizes[2]; 2537c478bd9Sstevel@tonic-gate void *ptrs[2]; 2547c478bd9Sstevel@tonic-gate ipflog_t ipfl; 2557c478bd9Sstevel@tonic-gate u_char p; 2567c478bd9Sstevel@tonic-gate mb_t *m; 257*ab25eeb5Syz # if (SOLARIS || defined(__hpux)) && defined(_KERNEL) 2587c478bd9Sstevel@tonic-gate # ifndef IRE_ILL_CN 259*ab25eeb5Syz qif_t *ifp; 2607c478bd9Sstevel@tonic-gate # else 2617c478bd9Sstevel@tonic-gate s_ill_t *ifp; 2627c478bd9Sstevel@tonic-gate # endif /* IRE_ILL_CN */ 2637c478bd9Sstevel@tonic-gate # else 2647c478bd9Sstevel@tonic-gate struct ifnet *ifp; 265*ab25eeb5Syz # endif /* SOLARIS || __hpux */ 2667c478bd9Sstevel@tonic-gate 267*ab25eeb5Syz ipfl.fl_nattag.ipt_num[0] = 0; 2687c478bd9Sstevel@tonic-gate m = fin->fin_m; 2697c478bd9Sstevel@tonic-gate ifp = fin->fin_ifp; 2707c478bd9Sstevel@tonic-gate hlen = fin->fin_hlen; 2717c478bd9Sstevel@tonic-gate /* 2727c478bd9Sstevel@tonic-gate * calculate header size. 2737c478bd9Sstevel@tonic-gate */ 2747c478bd9Sstevel@tonic-gate if (fin->fin_off == 0) { 2757c478bd9Sstevel@tonic-gate p = fin->fin_fi.fi_p; 2767c478bd9Sstevel@tonic-gate if (p == IPPROTO_TCP) 2777c478bd9Sstevel@tonic-gate hlen += MIN(sizeof(tcphdr_t), fin->fin_dlen); 2787c478bd9Sstevel@tonic-gate else if (p == IPPROTO_UDP) 2797c478bd9Sstevel@tonic-gate hlen += MIN(sizeof(udphdr_t), fin->fin_dlen); 2807c478bd9Sstevel@tonic-gate else if (p == IPPROTO_ICMP) { 2817c478bd9Sstevel@tonic-gate struct icmp *icmp; 2827c478bd9Sstevel@tonic-gate 2837c478bd9Sstevel@tonic-gate icmp = (struct icmp *)fin->fin_dp; 284*ab25eeb5Syz 2857c478bd9Sstevel@tonic-gate /* 2867c478bd9Sstevel@tonic-gate * For ICMP, if the packet is an error packet, also 2877c478bd9Sstevel@tonic-gate * include the information about the packet which 2887c478bd9Sstevel@tonic-gate * caused the error. 2897c478bd9Sstevel@tonic-gate */ 2907c478bd9Sstevel@tonic-gate switch (icmp->icmp_type) 2917c478bd9Sstevel@tonic-gate { 2927c478bd9Sstevel@tonic-gate case ICMP_UNREACH : 2937c478bd9Sstevel@tonic-gate case ICMP_SOURCEQUENCH : 2947c478bd9Sstevel@tonic-gate case ICMP_REDIRECT : 2957c478bd9Sstevel@tonic-gate case ICMP_TIMXCEED : 2967c478bd9Sstevel@tonic-gate case ICMP_PARAMPROB : 2977c478bd9Sstevel@tonic-gate hlen += MIN(sizeof(struct icmp) + 8, 2987c478bd9Sstevel@tonic-gate fin->fin_dlen); 2997c478bd9Sstevel@tonic-gate break; 3007c478bd9Sstevel@tonic-gate default : 3017c478bd9Sstevel@tonic-gate hlen += MIN(sizeof(struct icmp), 3027c478bd9Sstevel@tonic-gate fin->fin_dlen); 3037c478bd9Sstevel@tonic-gate break; 3047c478bd9Sstevel@tonic-gate } 3057c478bd9Sstevel@tonic-gate } 3067c478bd9Sstevel@tonic-gate # ifdef USE_INET6 3077c478bd9Sstevel@tonic-gate else if (p == IPPROTO_ICMPV6) { 3087c478bd9Sstevel@tonic-gate struct icmp6_hdr *icmp; 3097c478bd9Sstevel@tonic-gate 3107c478bd9Sstevel@tonic-gate icmp = (struct icmp6_hdr *)fin->fin_dp; 3117c478bd9Sstevel@tonic-gate 3127c478bd9Sstevel@tonic-gate /* 3137c478bd9Sstevel@tonic-gate * For ICMPV6, if the packet is an error packet, also 3147c478bd9Sstevel@tonic-gate * include the information about the packet which 3157c478bd9Sstevel@tonic-gate * caused the error. 3167c478bd9Sstevel@tonic-gate */ 3177c478bd9Sstevel@tonic-gate if (icmp->icmp6_type < 128) { 3187c478bd9Sstevel@tonic-gate hlen += MIN(sizeof(struct icmp6_hdr) + 8, 3197c478bd9Sstevel@tonic-gate fin->fin_dlen); 3207c478bd9Sstevel@tonic-gate } else { 3217c478bd9Sstevel@tonic-gate hlen += MIN(sizeof(struct icmp6_hdr), 3227c478bd9Sstevel@tonic-gate fin->fin_dlen); 3237c478bd9Sstevel@tonic-gate } 3247c478bd9Sstevel@tonic-gate } 3257c478bd9Sstevel@tonic-gate # endif 3267c478bd9Sstevel@tonic-gate } 3277c478bd9Sstevel@tonic-gate /* 3287c478bd9Sstevel@tonic-gate * Get the interface number and name to which this packet is 3297c478bd9Sstevel@tonic-gate * currently associated. 3307c478bd9Sstevel@tonic-gate */ 331*ab25eeb5Syz # if (SOLARIS || defined(__hpux)) && defined(_KERNEL) 332*ab25eeb5Syz ipfl.fl_unit = (u_int)0; 3337c478bd9Sstevel@tonic-gate (void) strncpy(ipfl.fl_ifname, IFNAME(ifp), sizeof(ipfl.fl_ifname)); 3347c478bd9Sstevel@tonic-gate # else 335*ab25eeb5Syz # if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199603)) || \ 336*ab25eeb5Syz (defined(OpenBSD) && (OpenBSD >= 199603)) || defined(linux) || \ 337*ab25eeb5Syz (defined(__FreeBSD__) && (__FreeBSD_version >= 501113)) 338*ab25eeb5Syz COPYIFNAME(ifp, ipfl.fl_ifname); 3397c478bd9Sstevel@tonic-gate # else 340*ab25eeb5Syz ipfl.fl_unit = (u_int)ifp->if_unit; 341*ab25eeb5Syz # if defined(_KERNEL) 3427c478bd9Sstevel@tonic-gate if ((ipfl.fl_ifname[0] = ifp->if_name[0])) 3437c478bd9Sstevel@tonic-gate if ((ipfl.fl_ifname[1] = ifp->if_name[1])) 3447c478bd9Sstevel@tonic-gate if ((ipfl.fl_ifname[2] = ifp->if_name[2])) 3457c478bd9Sstevel@tonic-gate ipfl.fl_ifname[3] = ifp->if_name[3]; 346*ab25eeb5Syz # else 347*ab25eeb5Syz (void) strncpy(ipfl.fl_ifname, IFNAME(ifp), sizeof(ipfl.fl_ifname)); 348*ab25eeb5Syz ipfl.fl_ifname[sizeof(ipfl.fl_ifname) - 1] = '\0'; 3497c478bd9Sstevel@tonic-gate # endif 350*ab25eeb5Syz # endif 351*ab25eeb5Syz # endif /* __hpux || SOLARIS */ 3527c478bd9Sstevel@tonic-gate mlen = fin->fin_plen - hlen; 3537c478bd9Sstevel@tonic-gate if (!ipl_logall) { 3547c478bd9Sstevel@tonic-gate mlen = (flags & FR_LOGBODY) ? MIN(mlen, 128) : 0; 3557c478bd9Sstevel@tonic-gate } else if ((flags & FR_LOGBODY) == 0) { 3567c478bd9Sstevel@tonic-gate mlen = 0; 3577c478bd9Sstevel@tonic-gate } 3587c478bd9Sstevel@tonic-gate if (mlen < 0) 3597c478bd9Sstevel@tonic-gate mlen = 0; 3607c478bd9Sstevel@tonic-gate ipfl.fl_plen = (u_char)mlen; 3617c478bd9Sstevel@tonic-gate ipfl.fl_hlen = (u_char)hlen; 3627c478bd9Sstevel@tonic-gate ipfl.fl_rule = fin->fin_rule; 3637c478bd9Sstevel@tonic-gate (void) strncpy(ipfl.fl_group, fin->fin_group, FR_GROUPLEN); 3647c478bd9Sstevel@tonic-gate if (fin->fin_fr != NULL) { 3657c478bd9Sstevel@tonic-gate ipfl.fl_loglevel = fin->fin_fr->fr_loglevel; 366*ab25eeb5Syz ipfl.fl_logtag = fin->fin_fr->fr_logtag; 3677c478bd9Sstevel@tonic-gate } else { 3687c478bd9Sstevel@tonic-gate ipfl.fl_loglevel = 0xffff; 369*ab25eeb5Syz ipfl.fl_logtag = FR_NOLOGTAG; 3707c478bd9Sstevel@tonic-gate } 371*ab25eeb5Syz if (fin->fin_nattag != NULL) 372*ab25eeb5Syz bcopy(fin->fin_nattag, (void *)&ipfl.fl_nattag, 373*ab25eeb5Syz sizeof(ipfl.fl_nattag)); 3747c478bd9Sstevel@tonic-gate ipfl.fl_flags = flags; 3757c478bd9Sstevel@tonic-gate ipfl.fl_dir = fin->fin_out; 3767c478bd9Sstevel@tonic-gate ipfl.fl_lflags = fin->fin_flx; 3777c478bd9Sstevel@tonic-gate ptrs[0] = (void *)&ipfl; 3787c478bd9Sstevel@tonic-gate sizes[0] = sizeof(ipfl); 3797c478bd9Sstevel@tonic-gate types[0] = 0; 3807c478bd9Sstevel@tonic-gate # if defined(MENTAT) && defined(_KERNEL) 3817c478bd9Sstevel@tonic-gate /* 3827c478bd9Sstevel@tonic-gate * Are we copied from the mblk or an aligned array ? 3837c478bd9Sstevel@tonic-gate */ 3847c478bd9Sstevel@tonic-gate if (fin->fin_ip == (ip_t *)m->b_rptr) { 3857c478bd9Sstevel@tonic-gate ptrs[1] = m; 3867c478bd9Sstevel@tonic-gate sizes[1] = hlen + mlen; 3877c478bd9Sstevel@tonic-gate types[1] = 1; 3887c478bd9Sstevel@tonic-gate } else { 3897c478bd9Sstevel@tonic-gate ptrs[1] = fin->fin_ip; 3907c478bd9Sstevel@tonic-gate sizes[1] = hlen + mlen; 3917c478bd9Sstevel@tonic-gate types[1] = 0; 3927c478bd9Sstevel@tonic-gate } 3937c478bd9Sstevel@tonic-gate # else 3947c478bd9Sstevel@tonic-gate ptrs[1] = m; 3957c478bd9Sstevel@tonic-gate sizes[1] = hlen + mlen; 3967c478bd9Sstevel@tonic-gate types[1] = 1; 3977c478bd9Sstevel@tonic-gate # endif /* MENTAT */ 3987c478bd9Sstevel@tonic-gate return ipllog(IPL_LOGIPF, fin, ptrs, sizes, types, 2); 3997c478bd9Sstevel@tonic-gate } 4007c478bd9Sstevel@tonic-gate 4017c478bd9Sstevel@tonic-gate 4027c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 4037c478bd9Sstevel@tonic-gate /* Function: ipllog */ 4047c478bd9Sstevel@tonic-gate /* Returns: int - 0 == success, -1 == failure */ 4057c478bd9Sstevel@tonic-gate /* Parameters: dev(I) - device that owns this log record */ 4067c478bd9Sstevel@tonic-gate /* fin(I) - pointer to packet information */ 4077c478bd9Sstevel@tonic-gate /* items(I) - array of pointers to log data */ 4087c478bd9Sstevel@tonic-gate /* itemsz(I) - array of size of valid memory pointed to */ 4097c478bd9Sstevel@tonic-gate /* types(I) - type of data pointed to by items pointers */ 4107c478bd9Sstevel@tonic-gate /* cnt(I) - number of elements in arrays items/itemsz/types */ 4117c478bd9Sstevel@tonic-gate /* */ 4127c478bd9Sstevel@tonic-gate /* Takes an array of parameters and constructs one record to include the */ 4137c478bd9Sstevel@tonic-gate /* miscellaneous packet information, as well as packet data, for reading */ 4147c478bd9Sstevel@tonic-gate /* from the log device. */ 4157c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 4167c478bd9Sstevel@tonic-gate int ipllog(dev, fin, items, itemsz, types, cnt) 4177c478bd9Sstevel@tonic-gate int dev; 4187c478bd9Sstevel@tonic-gate fr_info_t *fin; 4197c478bd9Sstevel@tonic-gate void **items; 4207c478bd9Sstevel@tonic-gate size_t *itemsz; 4217c478bd9Sstevel@tonic-gate int *types, cnt; 4227c478bd9Sstevel@tonic-gate { 423*ab25eeb5Syz caddr_t buf, ptr; 4247c478bd9Sstevel@tonic-gate iplog_t *ipl; 4257c478bd9Sstevel@tonic-gate size_t len; 4267c478bd9Sstevel@tonic-gate int i; 427*ab25eeb5Syz SPL_INT(s); 428*ab25eeb5Syz 4297c478bd9Sstevel@tonic-gate /* 4307c478bd9Sstevel@tonic-gate * Check to see if this log record has a CRC which matches the last 4317c478bd9Sstevel@tonic-gate * record logged. If it does, just up the count on the previous one 4327c478bd9Sstevel@tonic-gate * rather than create a new one. 4337c478bd9Sstevel@tonic-gate */ 4347c478bd9Sstevel@tonic-gate if (ipl_suppress) { 4357c478bd9Sstevel@tonic-gate MUTEX_ENTER(&ipl_mutex); 436*ab25eeb5Syz if ((fin != NULL) && (fin->fin_off == 0)) { 4377c478bd9Sstevel@tonic-gate if ((ipll[dev] != NULL) && 4387c478bd9Sstevel@tonic-gate bcmp((char *)fin, (char *)&iplcrc[dev], 4397c478bd9Sstevel@tonic-gate FI_LCSIZE) == 0) { 4407c478bd9Sstevel@tonic-gate ipll[dev]->ipl_count++; 4417c478bd9Sstevel@tonic-gate MUTEX_EXIT(&ipl_mutex); 4427c478bd9Sstevel@tonic-gate return 0; 4437c478bd9Sstevel@tonic-gate } 4447c478bd9Sstevel@tonic-gate bcopy((char *)fin, (char *)&iplcrc[dev], FI_LCSIZE); 4457c478bd9Sstevel@tonic-gate } else 4467c478bd9Sstevel@tonic-gate bzero((char *)&iplcrc[dev], FI_CSIZE); 4477c478bd9Sstevel@tonic-gate MUTEX_EXIT(&ipl_mutex); 4487c478bd9Sstevel@tonic-gate } 4497c478bd9Sstevel@tonic-gate 4507c478bd9Sstevel@tonic-gate /* 4517c478bd9Sstevel@tonic-gate * Get the total amount of data to be logged. 4527c478bd9Sstevel@tonic-gate */ 4537c478bd9Sstevel@tonic-gate for (i = 0, len = sizeof(iplog_t); i < cnt; i++) 4547c478bd9Sstevel@tonic-gate len += itemsz[i]; 4557c478bd9Sstevel@tonic-gate 4567c478bd9Sstevel@tonic-gate /* 4577c478bd9Sstevel@tonic-gate * check that we have space to record this information and can 4587c478bd9Sstevel@tonic-gate * allocate that much. 4597c478bd9Sstevel@tonic-gate */ 460*ab25eeb5Syz KMALLOCS(buf, caddr_t, len); 461*ab25eeb5Syz if (buf == NULL) 462*ab25eeb5Syz return -1; 463*ab25eeb5Syz SPL_NET(s); 4647c478bd9Sstevel@tonic-gate MUTEX_ENTER(&ipl_mutex); 465*ab25eeb5Syz if ((iplused[dev] + len) > ipl_logsize) { 4667c478bd9Sstevel@tonic-gate MUTEX_EXIT(&ipl_mutex); 467*ab25eeb5Syz SPL_X(s); 468*ab25eeb5Syz KFREES(buf, len); 469*ab25eeb5Syz return -1; 4707c478bd9Sstevel@tonic-gate } 4717c478bd9Sstevel@tonic-gate iplused[dev] += len; 4727c478bd9Sstevel@tonic-gate MUTEX_EXIT(&ipl_mutex); 473*ab25eeb5Syz SPL_X(s); 4747c478bd9Sstevel@tonic-gate 4757c478bd9Sstevel@tonic-gate /* 4767c478bd9Sstevel@tonic-gate * advance the log pointer to the next empty record and deduct the 4777c478bd9Sstevel@tonic-gate * amount of space we're going to use. 4787c478bd9Sstevel@tonic-gate */ 4797c478bd9Sstevel@tonic-gate ipl = (iplog_t *)buf; 480*ab25eeb5Syz ipl->ipl_magic = ipl_magic[dev]; 4817c478bd9Sstevel@tonic-gate ipl->ipl_count = 1; 4827c478bd9Sstevel@tonic-gate ipl->ipl_next = NULL; 4837c478bd9Sstevel@tonic-gate ipl->ipl_dsize = len; 4847c478bd9Sstevel@tonic-gate #ifdef _KERNEL 4857c478bd9Sstevel@tonic-gate GETKTIME(&ipl->ipl_sec); 4867c478bd9Sstevel@tonic-gate #else 4877c478bd9Sstevel@tonic-gate ipl->ipl_sec = 0; 4887c478bd9Sstevel@tonic-gate ipl->ipl_usec = 0; 4897c478bd9Sstevel@tonic-gate #endif 4907c478bd9Sstevel@tonic-gate 4917c478bd9Sstevel@tonic-gate /* 4927c478bd9Sstevel@tonic-gate * Loop through all the items to be logged, copying each one to the 4937c478bd9Sstevel@tonic-gate * buffer. Use bcopy for normal data or the mb_t copyout routine. 4947c478bd9Sstevel@tonic-gate */ 495*ab25eeb5Syz for (i = 0, ptr = buf + sizeof(*ipl); i < cnt; i++) { 4967c478bd9Sstevel@tonic-gate if (types[i] == 0) { 497*ab25eeb5Syz bcopy(items[i], ptr, itemsz[i]); 4987c478bd9Sstevel@tonic-gate } else if (types[i] == 1) { 499*ab25eeb5Syz COPYDATA(items[i], 0, itemsz[i], ptr); 5007c478bd9Sstevel@tonic-gate } 501*ab25eeb5Syz ptr += itemsz[i]; 5027c478bd9Sstevel@tonic-gate } 503*ab25eeb5Syz SPL_NET(s); 5047c478bd9Sstevel@tonic-gate MUTEX_ENTER(&ipl_mutex); 5057c478bd9Sstevel@tonic-gate ipll[dev] = ipl; 5067c478bd9Sstevel@tonic-gate *iplh[dev] = ipl; 5077c478bd9Sstevel@tonic-gate iplh[dev] = &ipl->ipl_next; 5087c478bd9Sstevel@tonic-gate 5097c478bd9Sstevel@tonic-gate /* 5107c478bd9Sstevel@tonic-gate * Now that the log record has been completed and added to the queue, 5117c478bd9Sstevel@tonic-gate * wake up any listeners who may want to read it. 5127c478bd9Sstevel@tonic-gate */ 5137c478bd9Sstevel@tonic-gate # if SOLARIS && defined(_KERNEL) 5147c478bd9Sstevel@tonic-gate cv_signal(&iplwait); 5157c478bd9Sstevel@tonic-gate MUTEX_EXIT(&ipl_mutex); 5167c478bd9Sstevel@tonic-gate # else 5177c478bd9Sstevel@tonic-gate MUTEX_EXIT(&ipl_mutex); 518*ab25eeb5Syz WAKEUP(iplh,dev); 5197c478bd9Sstevel@tonic-gate # endif 520*ab25eeb5Syz SPL_X(s); 5217c478bd9Sstevel@tonic-gate # ifdef IPL_SELECT 5227c478bd9Sstevel@tonic-gate iplog_input_ready(dev); 5237c478bd9Sstevel@tonic-gate # endif 524*ab25eeb5Syz return 0; 5257c478bd9Sstevel@tonic-gate } 5267c478bd9Sstevel@tonic-gate 5277c478bd9Sstevel@tonic-gate 5287c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 5297c478bd9Sstevel@tonic-gate /* Function: ipflog_read */ 5307c478bd9Sstevel@tonic-gate /* Returns: int - 0 == success, else error value. */ 5317c478bd9Sstevel@tonic-gate /* Parameters: unit(I) - device we are reading from */ 5327c478bd9Sstevel@tonic-gate /* uio(O) - pointer to information about where to store data */ 5337c478bd9Sstevel@tonic-gate /* */ 5347c478bd9Sstevel@tonic-gate /* Called to handle a read on an IPFilter device. Returns only complete */ 5357c478bd9Sstevel@tonic-gate /* log messages - will not partially copy a log record out to userland. */ 5367c478bd9Sstevel@tonic-gate /* */ 5377c478bd9Sstevel@tonic-gate /* NOTE: This function will block and wait for a signal to return data if */ 5387c478bd9Sstevel@tonic-gate /* there is none present. Asynchronous I/O is not implemented. */ 5397c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 5407c478bd9Sstevel@tonic-gate int ipflog_read(unit, uio) 5417c478bd9Sstevel@tonic-gate minor_t unit; 5427c478bd9Sstevel@tonic-gate struct uio *uio; 5437c478bd9Sstevel@tonic-gate { 5447c478bd9Sstevel@tonic-gate size_t dlen, copied; 5457c478bd9Sstevel@tonic-gate int error = 0; 5467c478bd9Sstevel@tonic-gate iplog_t *ipl; 547*ab25eeb5Syz SPL_INT(s); 5487c478bd9Sstevel@tonic-gate 5497c478bd9Sstevel@tonic-gate /* 5507c478bd9Sstevel@tonic-gate * Sanity checks. Make sure the minor # is valid and we're copying 5517c478bd9Sstevel@tonic-gate * a valid chunk of data. 5527c478bd9Sstevel@tonic-gate */ 5537c478bd9Sstevel@tonic-gate if (IPL_LOGMAX < unit) 5547c478bd9Sstevel@tonic-gate return ENXIO; 5557c478bd9Sstevel@tonic-gate if (uio->uio_resid == 0) 5567c478bd9Sstevel@tonic-gate return 0; 5577c478bd9Sstevel@tonic-gate if ((uio->uio_resid < sizeof(iplog_t)) || 558*ab25eeb5Syz (uio->uio_resid > ipl_logsize)) 5597c478bd9Sstevel@tonic-gate return EINVAL; 560*ab25eeb5Syz 5617c478bd9Sstevel@tonic-gate /* 5627c478bd9Sstevel@tonic-gate * Lock the log so we can snapshot the variables. Wait for a signal 5637c478bd9Sstevel@tonic-gate * if the log is empty. 5647c478bd9Sstevel@tonic-gate */ 5657c478bd9Sstevel@tonic-gate SPL_NET(s); 5667c478bd9Sstevel@tonic-gate MUTEX_ENTER(&ipl_mutex); 5677c478bd9Sstevel@tonic-gate 5687c478bd9Sstevel@tonic-gate while (iplt[unit] == NULL) { 5697c478bd9Sstevel@tonic-gate # if SOLARIS && defined(_KERNEL) 5707c478bd9Sstevel@tonic-gate if (!cv_wait_sig(&iplwait, &ipl_mutex.ipf_lk)) { 5717c478bd9Sstevel@tonic-gate MUTEX_EXIT(&ipl_mutex); 5727c478bd9Sstevel@tonic-gate return EINTR; 5737c478bd9Sstevel@tonic-gate } 5747c478bd9Sstevel@tonic-gate # else 5757c478bd9Sstevel@tonic-gate # if defined(__hpux) && defined(_KERNEL) 5767c478bd9Sstevel@tonic-gate lock_t *l; 5777c478bd9Sstevel@tonic-gate 5787c478bd9Sstevel@tonic-gate # ifdef IPL_SELECT 5797c478bd9Sstevel@tonic-gate if (uio->uio_fpflags & (FNBLOCK|FNDELAY)) { 5807c478bd9Sstevel@tonic-gate /* this is no blocking system call */ 5817c478bd9Sstevel@tonic-gate MUTEX_EXIT(&ipl_mutex); 5827c478bd9Sstevel@tonic-gate return 0; 5837c478bd9Sstevel@tonic-gate } 5847c478bd9Sstevel@tonic-gate # endif 5857c478bd9Sstevel@tonic-gate 5867c478bd9Sstevel@tonic-gate MUTEX_EXIT(&ipl_mutex); 5877c478bd9Sstevel@tonic-gate l = get_sleep_lock(&iplh[unit]); 5887c478bd9Sstevel@tonic-gate error = sleep(&iplh[unit], PZERO+1); 5897c478bd9Sstevel@tonic-gate spinunlock(l); 5907c478bd9Sstevel@tonic-gate # else 5917c478bd9Sstevel@tonic-gate # if defined(__osf__) && defined(_KERNEL) 5927c478bd9Sstevel@tonic-gate error = mpsleep(&iplh[unit], PSUSP|PCATCH, "iplread", 0, 5937c478bd9Sstevel@tonic-gate &ipl_mutex, MS_LOCK_SIMPLE); 5947c478bd9Sstevel@tonic-gate # else 5957c478bd9Sstevel@tonic-gate MUTEX_EXIT(&ipl_mutex); 5967c478bd9Sstevel@tonic-gate SPL_X(s); 597*ab25eeb5Syz error = SLEEP(unit + iplh, "ipl sleep"); 5987c478bd9Sstevel@tonic-gate # endif /* __osf__ */ 5997c478bd9Sstevel@tonic-gate # endif /* __hpux */ 6007c478bd9Sstevel@tonic-gate if (error) 6017c478bd9Sstevel@tonic-gate return error; 6027c478bd9Sstevel@tonic-gate SPL_NET(s); 6037c478bd9Sstevel@tonic-gate MUTEX_ENTER(&ipl_mutex); 6047c478bd9Sstevel@tonic-gate # endif /* SOLARIS */ 6057c478bd9Sstevel@tonic-gate } 6067c478bd9Sstevel@tonic-gate 6077c478bd9Sstevel@tonic-gate # if (BSD >= 199101) || defined(__FreeBSD__) || defined(__osf__) 6087c478bd9Sstevel@tonic-gate uio->uio_rw = UIO_READ; 6097c478bd9Sstevel@tonic-gate # endif 6107c478bd9Sstevel@tonic-gate 611*ab25eeb5Syz for (copied = 0; (ipl = iplt[unit]) != NULL; copied += dlen) { 6127c478bd9Sstevel@tonic-gate dlen = ipl->ipl_dsize; 6137c478bd9Sstevel@tonic-gate if (dlen > uio->uio_resid) 6147c478bd9Sstevel@tonic-gate break; 6157c478bd9Sstevel@tonic-gate /* 6167c478bd9Sstevel@tonic-gate * Don't hold the mutex over the uiomove call. 6177c478bd9Sstevel@tonic-gate */ 6187c478bd9Sstevel@tonic-gate iplt[unit] = ipl->ipl_next; 6197c478bd9Sstevel@tonic-gate iplused[unit] -= dlen; 6207c478bd9Sstevel@tonic-gate MUTEX_EXIT(&ipl_mutex); 6217c478bd9Sstevel@tonic-gate SPL_X(s); 6227c478bd9Sstevel@tonic-gate error = UIOMOVE((caddr_t)ipl, dlen, UIO_READ, uio); 6237c478bd9Sstevel@tonic-gate if (error) { 6247c478bd9Sstevel@tonic-gate SPL_NET(s); 6257c478bd9Sstevel@tonic-gate MUTEX_ENTER(&ipl_mutex); 6267c478bd9Sstevel@tonic-gate ipl->ipl_next = iplt[unit]; 6277c478bd9Sstevel@tonic-gate iplt[unit] = ipl; 628*ab25eeb5Syz iplused[unit] += dlen; 6297c478bd9Sstevel@tonic-gate break; 6307c478bd9Sstevel@tonic-gate } 631*ab25eeb5Syz MUTEX_ENTER(&ipl_mutex); 6327c478bd9Sstevel@tonic-gate KFREES((caddr_t)ipl, dlen); 6337c478bd9Sstevel@tonic-gate SPL_NET(s); 6347c478bd9Sstevel@tonic-gate } 635*ab25eeb5Syz if (!iplt[unit]) { 636*ab25eeb5Syz iplused[unit] = 0; 637*ab25eeb5Syz iplh[unit] = &iplt[unit]; 638*ab25eeb5Syz ipll[unit] = NULL; 639*ab25eeb5Syz } 640*ab25eeb5Syz 6417c478bd9Sstevel@tonic-gate MUTEX_EXIT(&ipl_mutex); 6427c478bd9Sstevel@tonic-gate SPL_X(s); 6437c478bd9Sstevel@tonic-gate return error; 6447c478bd9Sstevel@tonic-gate } 6457c478bd9Sstevel@tonic-gate 6467c478bd9Sstevel@tonic-gate 6477c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 6487c478bd9Sstevel@tonic-gate /* Function: ipflog_clear */ 6497c478bd9Sstevel@tonic-gate /* Returns: int - number of log bytes cleared. */ 6507c478bd9Sstevel@tonic-gate /* Parameters: unit(I) - device we are reading from */ 6517c478bd9Sstevel@tonic-gate /* */ 6527c478bd9Sstevel@tonic-gate /* Deletes all queued up log records for a given output device. */ 6537c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 6547c478bd9Sstevel@tonic-gate int ipflog_clear(unit) 6557c478bd9Sstevel@tonic-gate minor_t unit; 6567c478bd9Sstevel@tonic-gate { 6577c478bd9Sstevel@tonic-gate iplog_t *ipl; 6587c478bd9Sstevel@tonic-gate int used; 659*ab25eeb5Syz SPL_INT(s); 6607c478bd9Sstevel@tonic-gate 661*ab25eeb5Syz SPL_NET(s); 6627c478bd9Sstevel@tonic-gate MUTEX_ENTER(&ipl_mutex); 6637c478bd9Sstevel@tonic-gate while ((ipl = iplt[unit]) != NULL) { 6647c478bd9Sstevel@tonic-gate iplt[unit] = ipl->ipl_next; 6657c478bd9Sstevel@tonic-gate KFREES((caddr_t)ipl, ipl->ipl_dsize); 6667c478bd9Sstevel@tonic-gate } 6677c478bd9Sstevel@tonic-gate iplh[unit] = &iplt[unit]; 6687c478bd9Sstevel@tonic-gate ipll[unit] = NULL; 6697c478bd9Sstevel@tonic-gate used = iplused[unit]; 6707c478bd9Sstevel@tonic-gate iplused[unit] = 0; 6717c478bd9Sstevel@tonic-gate bzero((char *)&iplcrc[unit], FI_CSIZE); 6727c478bd9Sstevel@tonic-gate MUTEX_EXIT(&ipl_mutex); 673*ab25eeb5Syz SPL_X(s); 6747c478bd9Sstevel@tonic-gate return used; 6757c478bd9Sstevel@tonic-gate } 6767c478bd9Sstevel@tonic-gate #endif /* IPFILTER_LOG */ 677