xref: /illumos-gate/usr/src/uts/common/inet/ipf/ip_frag.c (revision af5f29dd)
1 /*
2  * Copyright (C) 1993-2003 by Darren Reed.
3  *
4  * See the IPFILTER.LICENCE file for details on licencing.
5  *
6  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
7  * Use is subject to license terms.
8  */
9 
10 #if defined(KERNEL) || defined(_KERNEL)
11 # undef KERNEL
12 # undef _KERNEL
13 # define        KERNEL	1
14 # define        _KERNEL	1
15 #endif
16 #include <sys/errno.h>
17 #include <sys/types.h>
18 #include <sys/param.h>
19 #include <sys/time.h>
20 #include <sys/file.h>
21 #ifdef __hpux
22 # include <sys/timeout.h>
23 #endif
24 #if !defined(_KERNEL)
25 # include <stdio.h>
26 # include <string.h>
27 # include <stdlib.h>
28 # define _KERNEL
29 # ifdef __OpenBSD__
30 struct file;
31 # endif
32 # include <sys/uio.h>
33 # undef _KERNEL
34 #endif
35 #if defined(_KERNEL) && (__FreeBSD_version >= 220000)
36 # include <sys/filio.h>
37 # include <sys/fcntl.h>
38 #else
39 # include <sys/ioctl.h>
40 #endif
41 #if !defined(linux)
42 # include <sys/protosw.h>
43 #endif
44 #include <sys/socket.h>
45 #if defined(_KERNEL)
46 # include <sys/systm.h>
47 # if !defined(__SVR4) && !defined(__svr4__)
48 #  include <sys/mbuf.h>
49 # endif
50 #endif
51 #if !defined(__SVR4) && !defined(__svr4__)
52 # if defined(_KERNEL) && !defined(__sgi) && !defined(AIX)
53 #  include <sys/kernel.h>
54 # endif
55 #else
56 # include <sys/byteorder.h>
57 # ifdef _KERNEL
58 #  include <sys/dditypes.h>
59 # endif
60 # include <sys/stream.h>
61 # include <sys/kmem.h>
62 #endif
63 #include <net/if.h>
64 #ifdef sun
65 # include <net/af.h>
66 #endif
67 #include <net/route.h>
68 #include <netinet/in.h>
69 #include <netinet/in_systm.h>
70 #include <netinet/ip.h>
71 #if !defined(linux)
72 # include <netinet/ip_var.h>
73 #endif
74 #include <netinet/tcp.h>
75 #include <netinet/udp.h>
76 #include <netinet/ip_icmp.h>
77 #include "netinet/ip_compat.h"
78 #include <netinet/tcpip.h>
79 #include "netinet/ip_fil.h"
80 #include "netinet/ip_nat.h"
81 #include "netinet/ip_frag.h"
82 #include "netinet/ip_state.h"
83 #include "netinet/ip_auth.h"
84 #include "netinet/ipf_stack.h"
85 #if (__FreeBSD_version >= 300000)
86 # include <sys/malloc.h>
87 # if defined(_KERNEL)
88 #  ifndef IPFILTER_LKM
89 #   include <sys/libkern.h>
90 #   include <sys/systm.h>
91 #  endif
92 extern struct callout_handle fr_slowtimer_ch;
93 # endif
94 #endif
95 #if defined(__NetBSD__) && (__NetBSD_Version__ >= 104230000)
96 # include <sys/callout.h>
97 extern struct callout fr_slowtimer_ch;
98 #endif
99 #if defined(__OpenBSD__)
100 # include <sys/timeout.h>
101 extern struct timeout fr_slowtimer_ch;
102 #endif
103 /* END OF INCLUDES */
104 
105 #if !defined(lint)
106 static const char sccsid[] = "@(#)ip_frag.c	1.11 3/24/96 (C) 1993-2000 Darren Reed";
107 static const char rcsid[] = "@(#)$Id: ip_frag.c,v 2.77.2.5 2005/08/11 14:33:10 darrenr Exp $";
108 #endif
109 
110 static INLINE int ipfr_index __P((fr_info_t *, ipfr_t *));
111 static ipfr_t *ipfr_newfrag __P((fr_info_t *, u_32_t, ipfr_t **));
112 static ipfr_t *fr_fraglookup __P((fr_info_t *, ipfr_t **));
113 static void fr_fragdelete __P((ipfr_t *, ipfr_t ***, ipf_stack_t *));
114 
115 /* ------------------------------------------------------------------------ */
116 /* Function:    fr_fraginit                                                 */
117 /* Returns:     int - 0 == success, -1 == error                             */
118 /* Parameters:  Nil                                                         */
119 /*                                                                          */
120 /* Initialise the hash tables for the fragment cache lookups.               */
121 /* ------------------------------------------------------------------------ */
fr_fraginit(ifs)122 int fr_fraginit(ifs)
123 ipf_stack_t *ifs;
124 {
125 	ifs->ifs_ipfr_tail = &ifs->ifs_ipfr_list;
126 	ifs->ifs_ipfr_nattail = &ifs->ifs_ipfr_natlist;
127 	ifs->ifs_ipfr_ipidtail = &ifs->ifs_ipfr_ipidlist;
128 	/* the IP frag related variables are set in ipftuneable_setdefs() to
129 	 * their default values
130 	 */
131 
132 	KMALLOCS(ifs->ifs_ipfr_heads, ipfr_t **,
133 	    ifs->ifs_ipfr_size * sizeof(ipfr_t *));
134 	if (ifs->ifs_ipfr_heads == NULL)
135 		return -1;
136 	bzero((char *)ifs->ifs_ipfr_heads,
137 	    ifs->ifs_ipfr_size * sizeof(ipfr_t *));
138 
139 	KMALLOCS(ifs->ifs_ipfr_nattab, ipfr_t **,
140 	    ifs->ifs_ipfr_size * sizeof(ipfr_t *));
141 	if (ifs->ifs_ipfr_nattab == NULL)
142 		return -1;
143 	bzero((char *)ifs->ifs_ipfr_nattab,
144 	    ifs->ifs_ipfr_size * sizeof(ipfr_t *));
145 
146 	KMALLOCS(ifs->ifs_ipfr_ipidtab, ipfr_t **,
147 	    ifs->ifs_ipfr_size * sizeof(ipfr_t *));
148 	if (ifs->ifs_ipfr_ipidtab == NULL)
149 		return -1;
150 	bzero((char *)ifs->ifs_ipfr_ipidtab,
151 	    ifs->ifs_ipfr_size * sizeof(ipfr_t *));
152 
153 	RWLOCK_INIT(&ifs->ifs_ipf_frag, "ipf fragment rwlock");
154 
155 	/* Initialise frblock with "block in all" */
156 	bzero((char *)&ifs->ifs_frblock, sizeof(ifs->ifs_frblock));
157 	ifs->ifs_frblock.fr_flags = FR_BLOCK|FR_INQUE;	/* block in */
158 	ifs->ifs_frblock.fr_ref = 1;
159 
160 	ifs->ifs_fr_frag_init = 1;
161 
162 	return 0;
163 }
164 
165 
166 /* ------------------------------------------------------------------------ */
167 /* Function:    fr_fragunload                                               */
168 /* Returns:     Nil                                                         */
169 /* Parameters:  Nil                                                         */
170 /*                                                                          */
171 /* Free all memory allocated whilst running and from initialisation.        */
172 /* ------------------------------------------------------------------------ */
fr_fragunload(ifs)173 void fr_fragunload(ifs)
174 ipf_stack_t *ifs;
175 {
176 	if (ifs->ifs_fr_frag_init == 1) {
177 		fr_fragclear(ifs);
178 
179 		RW_DESTROY(&ifs->ifs_ipf_frag);
180 		ifs->ifs_fr_frag_init = 0;
181 	}
182 
183 	if (ifs->ifs_ipfr_heads != NULL) {
184 		KFREES(ifs->ifs_ipfr_heads,
185 		    ifs->ifs_ipfr_size * sizeof(ipfr_t *));
186 	}
187 	ifs->ifs_ipfr_heads = NULL;
188 
189 	if (ifs->ifs_ipfr_nattab != NULL) {
190 		KFREES(ifs->ifs_ipfr_nattab,
191 		    ifs->ifs_ipfr_size * sizeof(ipfr_t *));
192 	}
193 	ifs->ifs_ipfr_nattab = NULL;
194 
195 	if (ifs->ifs_ipfr_ipidtab != NULL) {
196 		KFREES(ifs->ifs_ipfr_ipidtab,
197 		    ifs->ifs_ipfr_size * sizeof(ipfr_t *));
198 	}
199 	ifs->ifs_ipfr_ipidtab = NULL;
200 }
201 
202 
203 /* ------------------------------------------------------------------------ */
204 /* Function:    fr_fragstats                                                */
205 /* Returns:     ipfrstat_t* - pointer to struct with current frag stats     */
206 /* Parameters:  Nil                                                         */
207 /*                                                                          */
208 /* Updates ipfr_stats with current information and returns a pointer to it  */
209 /* ------------------------------------------------------------------------ */
fr_fragstats(ifs)210 ipfrstat_t *fr_fragstats(ifs)
211 ipf_stack_t *ifs;
212 {
213 	ifs->ifs_ipfr_stats.ifs_table = ifs->ifs_ipfr_heads;
214 	ifs->ifs_ipfr_stats.ifs_nattab = ifs->ifs_ipfr_nattab;
215 	ifs->ifs_ipfr_stats.ifs_inuse = ifs->ifs_ipfr_inuse;
216 	return &ifs->ifs_ipfr_stats;
217 }
218 
219 
220 /* ------------------------------------------------------------------------ */
221 /* Function:    ipfr_index                                                  */
222 /* Returns:     int     - index in fragment table for given packet          */
223 /* Parameters:  fin(I)  - pointer to packet information                     */
224 /*              frag(O) - pointer to ipfr_t structure to fill               */
225 /*                                                                          */
226 /* Compute the index in the fragment table while filling the per packet     */
227 /* part of the fragment state.                                              */
228 /* ------------------------------------------------------------------------ */
ipfr_index(fin,frag)229 static INLINE int ipfr_index(fin, frag)
230 fr_info_t *fin;
231 ipfr_t *frag;
232 {
233 	u_int idx;
234 
235 	/*
236 	 * For fragments, we record protocol, packet id, TOS and both IP#'s
237 	 * (these should all be the same for all fragments of a packet).
238 	 *
239 	 * build up a hash value to index the table with.
240 	 */
241 
242 #ifdef	USE_INET6
243 	if (fin->fin_v == 6) {
244 		ip6_t *ip6 = (ip6_t *)fin->fin_ip;
245 
246 		frag->ipfr_p = fin->fin_fi.fi_p;
247 		frag->ipfr_id = fin->fin_id;
248 		frag->ipfr_tos = ip6->ip6_flow & IPV6_FLOWINFO_MASK;
249 		frag->ipfr_src.in6 = ip6->ip6_src;
250 		frag->ipfr_dst.in6 = ip6->ip6_dst;
251 	} else
252 #endif
253 	{
254 		ip_t *ip = fin->fin_ip;
255 
256 		frag->ipfr_p = ip->ip_p;
257 		frag->ipfr_id = ip->ip_id;
258 		frag->ipfr_tos = ip->ip_tos;
259 		frag->ipfr_src.in4.s_addr = ip->ip_src.s_addr;
260 		frag->ipfr_src.i6[1] = 0;
261 		frag->ipfr_src.i6[2] = 0;
262 		frag->ipfr_src.i6[3] = 0;
263 		frag->ipfr_dst.in4.s_addr = ip->ip_dst.s_addr;
264 		frag->ipfr_dst.i6[1] = 0;
265 		frag->ipfr_dst.i6[2] = 0;
266 		frag->ipfr_dst.i6[3] = 0;
267 	}
268 	frag->ipfr_ifp = fin->fin_ifp;
269 	frag->ipfr_optmsk = fin->fin_fi.fi_optmsk & IPF_OPTCOPY;
270 	frag->ipfr_secmsk = fin->fin_fi.fi_secmsk;
271 	frag->ipfr_auth = fin->fin_fi.fi_auth;
272 
273 	idx = frag->ipfr_p;
274 	idx += frag->ipfr_id;
275 	idx += frag->ipfr_src.i6[0];
276 	idx += frag->ipfr_src.i6[1];
277 	idx += frag->ipfr_src.i6[2];
278 	idx += frag->ipfr_src.i6[3];
279 	idx += frag->ipfr_dst.i6[0];
280 	idx += frag->ipfr_dst.i6[1];
281 	idx += frag->ipfr_dst.i6[2];
282 	idx += frag->ipfr_dst.i6[3];
283 	idx *= 127;
284 	idx %= IPFT_SIZE;
285 
286 	return idx;
287 }
288 
289 
290 /* ------------------------------------------------------------------------ */
291 /* Function:    ipfr_newfrag                                                */
292 /* Returns:     ipfr_t * - pointer to fragment cache state info or NULL     */
293 /* Parameters:  fin(I)   - pointer to packet information                    */
294 /*              table(I) - pointer to frag table to add to                  */
295 /*                                                                          */
296 /* Add a new entry to the fragment cache, registering it as having come     */
297 /* through this box, with the result of the filter operation.               */
298 /* ------------------------------------------------------------------------ */
ipfr_newfrag(fin,pass,table)299 static ipfr_t *ipfr_newfrag(fin, pass, table)
300 fr_info_t *fin;
301 u_32_t pass;
302 ipfr_t *table[];
303 {
304 	ipfr_t *fra, frag;
305 	u_int idx, off;
306 	ipf_stack_t *ifs = fin->fin_ifs;
307 
308 	if (ifs->ifs_ipfr_inuse >= ifs->ifs_ipfr_size)
309 		return NULL;
310 
311 	if ((fin->fin_flx & (FI_FRAG|FI_BAD)) != FI_FRAG)
312 		return NULL;
313 
314 	if (pass & FR_FRSTRICT)
315 		if (fin->fin_off != 0)
316 			return NULL;
317 
318 	idx = ipfr_index(fin, &frag);
319 
320 	/*
321 	 * first, make sure it isn't already there...
322 	 */
323 	for (fra = table[idx]; (fra != NULL); fra = fra->ipfr_hnext)
324 		if (!bcmp((char *)&frag.ipfr_ifp, (char *)&fra->ipfr_ifp,
325 			  IPFR_CMPSZ)) {
326 			ifs->ifs_ipfr_stats.ifs_exists++;
327 			return NULL;
328 		}
329 
330 	/*
331 	 * allocate some memory, if possible, if not, just record that we
332 	 * failed to do so.
333 	 */
334 	KMALLOC(fra, ipfr_t *);
335 	if (fra == NULL) {
336 		ifs->ifs_ipfr_stats.ifs_nomem++;
337 		return NULL;
338 	}
339 
340 	fra->ipfr_rule = fin->fin_fr;
341 	if (fra->ipfr_rule != NULL) {
342 
343 		frentry_t *fr;
344 
345 		fr = fin->fin_fr;
346 		MUTEX_ENTER(&fr->fr_lock);
347 		fr->fr_ref++;
348 		MUTEX_EXIT(&fr->fr_lock);
349 	}
350 
351 	/*
352 	 * Insert the fragment into the fragment table, copy the struct used
353 	 * in the search using bcopy rather than reassign each field.
354 	 * Set the ttl to the default.
355 	 */
356 	if ((fra->ipfr_hnext = table[idx]) != NULL)
357 		table[idx]->ipfr_hprev = &fra->ipfr_hnext;
358 	fra->ipfr_hprev = table + idx;
359 	fra->ipfr_data = NULL;
360 	table[idx] = fra;
361 	bcopy((char *)&frag.ipfr_ifp, (char *)&fra->ipfr_ifp, IPFR_CMPSZ);
362 	fra->ipfr_ttl = ifs->ifs_fr_ticks + ifs->ifs_fr_ipfrttl;
363 
364 	/*
365 	 * Compute the offset of the expected start of the next packet.
366 	 */
367 	off = fin->fin_off >> 3;
368 	if (off == 0) {
369 		fra->ipfr_seen0 = 1;
370 	} else {
371 		fra->ipfr_seen0 = 0;
372 	}
373 	fra->ipfr_off = off + fin->fin_dlen;
374 	fra->ipfr_pass = pass;
375 	fra->ipfr_ref = 1;
376 	ifs->ifs_ipfr_stats.ifs_new++;
377 	ifs->ifs_ipfr_inuse++;
378 	return fra;
379 }
380 
381 
382 /* ------------------------------------------------------------------------ */
383 /* Function:    fr_newfrag                                                  */
384 /* Returns:     int - 0 == success, -1 == error                             */
385 /* Parameters:  fin(I)  - pointer to packet information                     */
386 /*                                                                          */
387 /* Add a new entry to the fragment cache table based on the current packet  */
388 /* ------------------------------------------------------------------------ */
fr_newfrag(fin,pass)389 int fr_newfrag(fin, pass)
390 u_32_t pass;
391 fr_info_t *fin;
392 {
393 	ipfr_t	*fra;
394 	ipf_stack_t *ifs = fin->fin_ifs;
395 
396 	if (ifs->ifs_fr_frag_lock != 0)
397 		return -1;
398 
399 	WRITE_ENTER(&ifs->ifs_ipf_frag);
400 	fra = ipfr_newfrag(fin, pass, ifs->ifs_ipfr_heads);
401 	if (fra != NULL) {
402 		*ifs->ifs_ipfr_tail = fra;
403 		fra->ipfr_prev = ifs->ifs_ipfr_tail;
404 		ifs->ifs_ipfr_tail = &fra->ipfr_next;
405 		if (ifs->ifs_ipfr_list == NULL)
406 			ifs->ifs_ipfr_list = fra;
407 		fra->ipfr_next = NULL;
408 	}
409 	RWLOCK_EXIT(&ifs->ifs_ipf_frag);
410 	return fra ? 0 : -1;
411 }
412 
413 
414 /* ------------------------------------------------------------------------ */
415 /* Function:    fr_nat_newfrag                                              */
416 /* Returns:     int - 0 == success, -1 == error                             */
417 /* Parameters:  fin(I)  - pointer to packet information                     */
418 /*              nat(I)  - pointer to NAT structure                          */
419 /*                                                                          */
420 /* Create a new NAT fragment cache entry based on the current packet and    */
421 /* the NAT structure for this "session".                                    */
422 /* ------------------------------------------------------------------------ */
fr_nat_newfrag(fin,pass,nat)423 int fr_nat_newfrag(fin, pass, nat)
424 fr_info_t *fin;
425 u_32_t pass;
426 nat_t *nat;
427 {
428 	ipfr_t	*fra;
429 	ipf_stack_t *ifs = fin->fin_ifs;
430 
431 	if (ifs->ifs_fr_frag_lock != 0)
432 		return 0;
433 
434 	WRITE_ENTER(&ifs->ifs_ipf_natfrag);
435 	fra = ipfr_newfrag(fin, pass, ifs->ifs_ipfr_nattab);
436 	if (fra != NULL) {
437 		fra->ipfr_data = nat;
438 		nat->nat_data = fra;
439 		*ifs->ifs_ipfr_nattail = fra;
440 		fra->ipfr_prev = ifs->ifs_ipfr_nattail;
441 		ifs->ifs_ipfr_nattail = &fra->ipfr_next;
442 		fra->ipfr_next = NULL;
443 	}
444 	RWLOCK_EXIT(&ifs->ifs_ipf_natfrag);
445 	return fra ? 0 : -1;
446 }
447 
448 
449 /* ------------------------------------------------------------------------ */
450 /* Function:    fr_ipid_newfrag                                             */
451 /* Returns:     int - 0 == success, -1 == error                             */
452 /* Parameters:  fin(I)  - pointer to packet information                     */
453 /*              ipid(I) - new IP ID for this fragmented packet              */
454 /*                                                                          */
455 /* Create a new fragment cache entry for this packet and store, as a data   */
456 /* pointer, the new IP ID value.                                            */
457 /* ------------------------------------------------------------------------ */
fr_ipid_newfrag(fin,ipid)458 int fr_ipid_newfrag(fin, ipid)
459 fr_info_t *fin;
460 u_32_t ipid;
461 {
462 	ipfr_t	*fra;
463 	ipf_stack_t *ifs = fin->fin_ifs;
464 
465 	if (ifs->ifs_fr_frag_lock)
466 		return 0;
467 
468 	WRITE_ENTER(&ifs->ifs_ipf_ipidfrag);
469 	fra = ipfr_newfrag(fin, 0, ifs->ifs_ipfr_ipidtab);
470 	if (fra != NULL) {
471 		fra->ipfr_data = (void *)(uintptr_t)ipid;
472 		*ifs->ifs_ipfr_ipidtail = fra;
473 		fra->ipfr_prev = ifs->ifs_ipfr_ipidtail;
474 		ifs->ifs_ipfr_ipidtail = &fra->ipfr_next;
475 		fra->ipfr_next = NULL;
476 	}
477 	RWLOCK_EXIT(&ifs->ifs_ipf_ipidfrag);
478 	return fra ? 0 : -1;
479 }
480 
481 
482 /* ------------------------------------------------------------------------ */
483 /* Function:    fr_fraglookup                                               */
484 /* Returns:     ipfr_t * - pointer to ipfr_t structure if there's a         */
485 /*                         matching entry in the frag table, else NULL      */
486 /* Parameters:  fin(I)   - pointer to packet information                    */
487 /*              table(I) - pointer to fragment cache table to search        */
488 /*                                                                          */
489 /* Check the fragment cache to see if there is already a record of this     */
490 /* packet with its filter result known.                                     */
491 /* ------------------------------------------------------------------------ */
fr_fraglookup(fin,table)492 static ipfr_t *fr_fraglookup(fin, table)
493 fr_info_t *fin;
494 ipfr_t *table[];
495 {
496 	ipfr_t *f, frag;
497 	u_int idx;
498 	ipf_stack_t *ifs = fin->fin_ifs;
499 
500 	if ((fin->fin_flx & (FI_FRAG|FI_BAD)) != FI_FRAG)
501 		return NULL;
502 
503 	/*
504 	 * For fragments, we record protocol, packet id, TOS and both IP#'s
505 	 * (these should all be the same for all fragments of a packet).
506 	 *
507 	 * build up a hash value to index the table with.
508 	 */
509 	idx = ipfr_index(fin, &frag);
510 
511 	/*
512 	 * check the table, careful to only compare the right amount of data
513 	 */
514 	for (f = table[idx]; f; f = f->ipfr_hnext)
515 		if (!bcmp((char *)&frag.ipfr_ifp, (char *)&f->ipfr_ifp,
516 			  IPFR_CMPSZ)) {
517 			u_short	off;
518 
519 			/*
520 			 * We don't want to let short packets match because
521 			 * they could be compromising the security of other
522 			 * rules that want to match on layer 4 fields (and
523 			 * can't because they have been fragmented off.)
524 			 * Why do this check here?  The counter acts as an
525 			 * indicator of this kind of attack, whereas if it was
526 			 * elsewhere, it wouldn't know if other matching
527 			 * packets had been seen.
528 			 */
529 			if (fin->fin_flx & FI_SHORT) {
530 				ATOMIC_INCL(ifs->ifs_ipfr_stats.ifs_short);
531 				continue;
532 			}
533 
534 			/*
535 			 * XXX - We really need to be guarding against the
536 			 * retransmission of (src,dst,id,offset-range) here
537 			 * because a fragmented packet is never resent with
538 			 * the same IP ID# (or shouldn't).
539 			 */
540 			off = fin->fin_off >> 3;
541 			if (f->ipfr_seen0) {
542 				if (off == 0) {
543 					ATOMIC_INCL(ifs->ifs_ipfr_stats.ifs_retrans0);
544 					continue;
545 				}
546 			} else if (off == 0) {
547 				f->ipfr_seen0 = 1;
548 			}
549 
550 			if (f != table[idx]) {
551 				ipfr_t **fp;
552 
553 				/*
554 				 * Move fragment info. to the top of the list
555 				 * to speed up searches.  First, delink...
556 				 */
557 				fp = f->ipfr_hprev;
558 				(*fp) = f->ipfr_hnext;
559 				if (f->ipfr_hnext != NULL)
560 					f->ipfr_hnext->ipfr_hprev = fp;
561 				/*
562 				 * Then put back at the top of the chain.
563 				 */
564 				f->ipfr_hnext = table[idx];
565 				table[idx]->ipfr_hprev = &f->ipfr_hnext;
566 				f->ipfr_hprev = table + idx;
567 				table[idx] = f;
568 			}
569 
570 			/*
571 			 * If we've follwed the fragments, and this is the
572 			 * last (in order), shrink expiration time.
573 			 */
574 			if (off == f->ipfr_off) {
575 				if (!(fin->fin_flx & FI_MOREFRAG))
576 					f->ipfr_ttl = ifs->ifs_fr_ticks + 1;
577 				f->ipfr_off = fin->fin_dlen + off;
578 			} else if (f->ipfr_pass & FR_FRSTRICT)
579 				continue;
580 			ATOMIC_INCL(ifs->ifs_ipfr_stats.ifs_hits);
581 			return f;
582 		}
583 	return NULL;
584 }
585 
586 
587 /* ------------------------------------------------------------------------ */
588 /* Function:    fr_nat_knownfrag                                            */
589 /* Returns:     nat_t* - pointer to 'parent' NAT structure if frag table    */
590 /*                       match found, else NULL                             */
591 /* Parameters:  fin(I)  - pointer to packet information                     */
592 /*                                                                          */
593 /* Functional interface for NAT lookups of the NAT fragment cache           */
594 /* ------------------------------------------------------------------------ */
fr_nat_knownfrag(fin)595 nat_t *fr_nat_knownfrag(fin)
596 fr_info_t *fin;
597 {
598 	nat_t	*nat;
599 	ipfr_t	*ipf;
600 	ipf_stack_t *ifs = fin->fin_ifs;
601 
602 	if (ifs->ifs_fr_frag_lock || !ifs->ifs_ipfr_natlist)
603 		return NULL;
604 	READ_ENTER(&ifs->ifs_ipf_natfrag);
605 	ipf = fr_fraglookup(fin, ifs->ifs_ipfr_nattab);
606 	if (ipf != NULL) {
607 		nat = ipf->ipfr_data;
608 		/*
609 		 * This is the last fragment for this packet.
610 		 */
611 		if ((ipf->ipfr_ttl == ifs->ifs_fr_ticks + 1) && (nat != NULL)) {
612 			nat->nat_data = NULL;
613 			ipf->ipfr_data = NULL;
614 		}
615 	} else
616 		nat = NULL;
617 	RWLOCK_EXIT(&ifs->ifs_ipf_natfrag);
618 	return nat;
619 }
620 
621 
622 /* ------------------------------------------------------------------------ */
623 /* Function:    fr_ipid_knownfrag                                           */
624 /* Returns:     u_32_t - IPv4 ID for this packet if match found, else       */
625 /*                       return 0xfffffff to indicate no match.             */
626 /* Parameters:  fin(I) - pointer to packet information                      */
627 /*                                                                          */
628 /* Functional interface for IP ID lookups of the IP ID fragment cache       */
629 /* ------------------------------------------------------------------------ */
fr_ipid_knownfrag(fin)630 u_32_t fr_ipid_knownfrag(fin)
631 fr_info_t *fin;
632 {
633 	ipfr_t	*ipf;
634 	u_32_t	id;
635 	ipf_stack_t *ifs = fin->fin_ifs;
636 
637 	if (ifs->ifs_fr_frag_lock || !ifs->ifs_ipfr_ipidlist)
638 		return 0xffffffff;
639 
640 	READ_ENTER(&ifs->ifs_ipf_ipidfrag);
641 	ipf = fr_fraglookup(fin, ifs->ifs_ipfr_ipidtab);
642 	if (ipf != NULL)
643 		id = (u_32_t)(uintptr_t)ipf->ipfr_data;
644 	else
645 		id = 0xffffffff;
646 	RWLOCK_EXIT(&ifs->ifs_ipf_ipidfrag);
647 	return id;
648 }
649 
650 
651 /* ------------------------------------------------------------------------ */
652 /* Function:    fr_knownfrag                                                */
653 /* Returns:     frentry_t* - pointer to filter rule if a match is found in  */
654 /*                           the frag cache table, else NULL.               */
655 /* Parameters:  fin(I)   - pointer to packet information                    */
656 /*              passp(O) - pointer to where to store rule flags resturned   */
657 /*                                                                          */
658 /* Functional interface for normal lookups of the fragment cache.  If a     */
659 /* match is found, return the rule pointer and flags from the rule, except  */
660 /* that if FR_LOGFIRST is set, reset FR_LOG.                                */
661 /* ------------------------------------------------------------------------ */
fr_knownfrag(fin,passp)662 frentry_t *fr_knownfrag(fin, passp)
663 fr_info_t *fin;
664 u_32_t *passp;
665 {
666 	frentry_t *fr = NULL;
667 	ipfr_t	*fra;
668 	u_32_t pass, oflx;
669 	ipf_stack_t *ifs = fin->fin_ifs;
670 
671 	if (ifs->ifs_fr_frag_lock || (ifs->ifs_ipfr_list == NULL))
672 		return NULL;
673 
674 	READ_ENTER(&ifs->ifs_ipf_frag);
675 	oflx = fin->fin_flx;
676 	fra = fr_fraglookup(fin, ifs->ifs_ipfr_heads);
677 	if (fra != NULL) {
678 		fr = fra->ipfr_rule;
679 		fin->fin_fr = fr;
680 		if (fr != NULL) {
681 			pass = fr->fr_flags;
682 			if ((pass & FR_LOGFIRST) != 0)
683 				pass &= ~(FR_LOGFIRST|FR_LOG);
684 			*passp = pass;
685 		}
686 	}
687 	if (!(oflx & FI_BAD) && (fin->fin_flx & FI_BAD)) {
688 		*passp &= ~FR_CMDMASK;
689 		*passp |= FR_BLOCK;
690 		fr = &ifs->ifs_frblock;
691 	}
692 	RWLOCK_EXIT(&ifs->ifs_ipf_frag);
693 	return fr;
694 }
695 
696 
697 /* ------------------------------------------------------------------------ */
698 /* Function:    fr_forget                                                   */
699 /* Returns:     Nil                                                         */
700 /* Parameters:  ptr(I) - pointer to data structure                          */
701 /*                                                                          */
702 /* Search through all of the fragment cache entries and wherever a pointer  */
703 /* is found to match ptr, reset it to NULL.                                 */
704 /* ------------------------------------------------------------------------ */
fr_forget(ptr,ifs)705 void fr_forget(ptr, ifs)
706 void *ptr;
707 ipf_stack_t *ifs;
708 {
709 	ipfr_t	*fr;
710 
711 	WRITE_ENTER(&ifs->ifs_ipf_frag);
712 	for (fr = ifs->ifs_ipfr_list; fr; fr = fr->ipfr_next)
713 		if (fr->ipfr_data == ptr)
714 			fr->ipfr_data = NULL;
715 	RWLOCK_EXIT(&ifs->ifs_ipf_frag);
716 }
717 
718 
719 /* ------------------------------------------------------------------------ */
720 /* Function:    fr_forgetnat                                                */
721 /* Returns:     Nil                                                         */
722 /* Parameters:  ptr(I) - pointer to data structure                          */
723 /*                                                                          */
724 /* Search through all of the fragment cache entries for NAT and wherever a  */
725 /* pointer  is found to match ptr, reset it to NULL.                        */
726 /* ------------------------------------------------------------------------ */
fr_forgetnat(ptr,ifs)727 void fr_forgetnat(ptr, ifs)
728 void *ptr;
729 ipf_stack_t *ifs;
730 {
731 	ipfr_t	*fr;
732 
733 	WRITE_ENTER(&ifs->ifs_ipf_natfrag);
734 	for (fr = ifs->ifs_ipfr_natlist; fr; fr = fr->ipfr_next)
735 		if (fr->ipfr_data == ptr)
736 			fr->ipfr_data = NULL;
737 	RWLOCK_EXIT(&ifs->ifs_ipf_natfrag);
738 }
739 
740 
741 /* ------------------------------------------------------------------------ */
742 /* Function:    fr_fragdelete                                               */
743 /* Returns:     Nil                                                         */
744 /* Parameters:  fra(I)   - pointer to fragment structure to delete          */
745 /*              tail(IO) - pointer to the pointer to the tail of the frag   */
746 /*                         list                                             */
747 /*                                                                          */
748 /* Remove a fragment cache table entry from the table & list.  Also free    */
749 /* the filter rule it is associated with it if it is no longer used as a    */
750 /* result of decreasing the reference count.                                */
751 /* ------------------------------------------------------------------------ */
fr_fragdelete(fra,tail,ifs)752 static void fr_fragdelete(fra, tail, ifs)
753 ipfr_t *fra, ***tail;
754 ipf_stack_t *ifs;
755 {
756 	frentry_t *fr;
757 
758 	fr = fra->ipfr_rule;
759 	if (fr != NULL)
760 	    (void)fr_derefrule(&fr, ifs);
761 
762 	if (fra->ipfr_next)
763 		fra->ipfr_next->ipfr_prev = fra->ipfr_prev;
764 	*fra->ipfr_prev = fra->ipfr_next;
765 	if (*tail == &fra->ipfr_next)
766 		*tail = fra->ipfr_prev;
767 
768 	if (fra->ipfr_hnext)
769 		fra->ipfr_hnext->ipfr_hprev = fra->ipfr_hprev;
770 	*fra->ipfr_hprev = fra->ipfr_hnext;
771 
772 	if (fra->ipfr_ref <= 0)
773 		KFREE(fra);
774 }
775 
776 
777 /* ------------------------------------------------------------------------ */
778 /* Function:    fr_fragclear                                                */
779 /* Returns:     Nil                                                         */
780 /* Parameters:  Nil                                                         */
781 /*                                                                          */
782 /* Free memory in use by fragment state information kept.  Do the normal    */
783 /* fragment state stuff first and then the NAT-fragment table.              */
784 /* ------------------------------------------------------------------------ */
fr_fragclear(ifs)785 void fr_fragclear(ifs)
786 ipf_stack_t *ifs;
787 {
788 	ipfr_t	*fra;
789 	nat_t	*nat;
790 
791 	WRITE_ENTER(&ifs->ifs_ipf_frag);
792 	while ((fra = ifs->ifs_ipfr_list) != NULL) {
793 		fra->ipfr_ref--;
794 		fr_fragdelete(fra, &ifs->ifs_ipfr_tail, ifs);
795 	}
796 	ifs->ifs_ipfr_tail = &ifs->ifs_ipfr_list;
797 	RWLOCK_EXIT(&ifs->ifs_ipf_frag);
798 
799 	WRITE_ENTER(&ifs->ifs_ipf_nat);
800 	WRITE_ENTER(&ifs->ifs_ipf_natfrag);
801 	while ((fra = ifs->ifs_ipfr_natlist) != NULL) {
802 		nat = fra->ipfr_data;
803 		if (nat != NULL) {
804 			if (nat->nat_data == fra)
805 				nat->nat_data = NULL;
806 		}
807 		fra->ipfr_ref--;
808 		fr_fragdelete(fra, &ifs->ifs_ipfr_nattail, ifs);
809 	}
810 	ifs->ifs_ipfr_nattail = &ifs->ifs_ipfr_natlist;
811 	RWLOCK_EXIT(&ifs->ifs_ipf_natfrag);
812 	RWLOCK_EXIT(&ifs->ifs_ipf_nat);
813 }
814 
815 
816 /* ------------------------------------------------------------------------ */
817 /* Function:    fr_fragexpire                                               */
818 /* Returns:     Nil                                                         */
819 /* Parameters:  Nil                                                         */
820 /*                                                                          */
821 /* Expire entries in the fragment cache table that have been there too long */
822 /* ------------------------------------------------------------------------ */
fr_fragexpire(ifs)823 void fr_fragexpire(ifs)
824 ipf_stack_t *ifs;
825 {
826 	ipfr_t	**fp, *fra;
827 	nat_t	*nat;
828 	SPL_INT(s);
829 
830 	if (ifs->ifs_fr_frag_lock)
831 		return;
832 
833 	SPL_NET(s);
834 	WRITE_ENTER(&ifs->ifs_ipf_frag);
835 	/*
836 	 * Go through the entire table, looking for entries to expire,
837 	 * which is indicated by the ttl being less than or equal to
838 	 * ifs_fr_ticks.
839 	 */
840 	for (fp = &ifs->ifs_ipfr_list; ((fra = *fp) != NULL); ) {
841 		if (fra->ipfr_ttl > ifs->ifs_fr_ticks)
842 			break;
843 		fra->ipfr_ref--;
844 		fr_fragdelete(fra, &ifs->ifs_ipfr_tail, ifs);
845 		ifs->ifs_ipfr_stats.ifs_expire++;
846 		ifs->ifs_ipfr_inuse--;
847 	}
848 	RWLOCK_EXIT(&ifs->ifs_ipf_frag);
849 
850 	WRITE_ENTER(&ifs->ifs_ipf_ipidfrag);
851 	for (fp = &ifs->ifs_ipfr_ipidlist; ((fra = *fp) != NULL); ) {
852 		if (fra->ipfr_ttl > ifs->ifs_fr_ticks)
853 			break;
854 		fra->ipfr_ref--;
855 		fr_fragdelete(fra, &ifs->ifs_ipfr_ipidtail, ifs);
856 		ifs->ifs_ipfr_stats.ifs_expire++;
857 		ifs->ifs_ipfr_inuse--;
858 	}
859 	RWLOCK_EXIT(&ifs->ifs_ipf_ipidfrag);
860 
861 	/*
862 	 * Same again for the NAT table, except that if the structure also
863 	 * still points to a NAT structure, and the NAT structure points back
864 	 * at the one to be free'd, NULL the reference from the NAT struct.
865 	 * NOTE: We need to grab both mutex's early, and in this order so as
866 	 * to prevent a deadlock if both try to expire at the same time.
867 	 */
868 	WRITE_ENTER(&ifs->ifs_ipf_nat);
869 	WRITE_ENTER(&ifs->ifs_ipf_natfrag);
870 	for (fp = &ifs->ifs_ipfr_natlist; ((fra = *fp) != NULL); ) {
871 		if (fra->ipfr_ttl > ifs->ifs_fr_ticks)
872 			break;
873 		nat = fra->ipfr_data;
874 		if (nat != NULL) {
875 			if (nat->nat_data == fra)
876 				nat->nat_data = NULL;
877 		}
878 		fra->ipfr_ref--;
879 		fr_fragdelete(fra, &ifs->ifs_ipfr_nattail, ifs);
880 		ifs->ifs_ipfr_stats.ifs_expire++;
881 		ifs->ifs_ipfr_inuse--;
882 	}
883 	RWLOCK_EXIT(&ifs->ifs_ipf_natfrag);
884 	RWLOCK_EXIT(&ifs->ifs_ipf_nat);
885 	SPL_X(s);
886 }
887 
888 
889 /* ------------------------------------------------------------------------ */
890 /* Function:    fr_slowtimer                                                */
891 /* Returns:     Nil                                                         */
892 /* Parameters:  Nil                                                         */
893 /*                                                                          */
894 /* Slowly expire held state for fragments.  Timeouts are set * in           */
895 /* expectation of this being called twice per second.                       */
896 /* ------------------------------------------------------------------------ */
897 #if !defined(_KERNEL) || (!defined(SOLARIS) && !defined(__hpux) && \
898 	!defined(__sgi) && !defined(__osf__) && !defined(linux))
899 # if defined(_KERNEL) && ((BSD >= 199103) || defined(__sgi))
fr_slowtimer(void * arg)900 void fr_slowtimer __P((void *arg))
901 # else
902 int fr_slowtimer(void *arg)
903 # endif
904 {
905 	ipf_stack_t *ifs = arg;
906 
907 	READ_ENTER(&ifs->ifs_ipf_global);
908 
909 	fr_fragexpire(ifs);
910 	fr_timeoutstate(ifs);
911 	fr_natexpire(ifs);
912 	fr_authexpire(ifs);
913 	ifs->ifs_fr_ticks++;
914 	if (ifs->ifs_fr_running <= 0)
915 		goto done;
916 # ifdef _KERNEL
917 #  if defined(__NetBSD__) && (__NetBSD_Version__ >= 104240000)
918 	callout_reset(&fr_slowtimer_ch, hz / 2, fr_slowtimer, NULL);
919 #  else
920 #   if defined(__OpenBSD__)
921 	timeout_add(&fr_slowtimer_ch, hz/2);
922 #   else
923 #    if (__FreeBSD_version >= 300000)
924 	fr_slowtimer_ch = timeout(fr_slowtimer, NULL, hz/2);
925 #    else
926 #     ifdef linux
927 	;
928 #     else
929 	timeout(fr_slowtimer, NULL, hz/2);
930 #     endif
931 #    endif /* FreeBSD */
932 #   endif /* OpenBSD */
933 #  endif /* NetBSD */
934 # endif
935 done:
936 	RWLOCK_EXIT(&ifs->ifs_ipf_global);
937 # if (BSD < 199103) || !defined(_KERNEL)
938 	return 0;
939 # endif
940 }
941 #endif /* !SOLARIS && !defined(__hpux) && !defined(__sgi) */
942 
943 /*ARGSUSED*/
fr_nextfrag(token,itp,top,tail,lock,ifs)944 int fr_nextfrag(token, itp, top, tail, lock, ifs)
945 ipftoken_t *token;
946 ipfgeniter_t *itp;
947 ipfr_t **top, ***tail;
948 ipfrwlock_t *lock;
949 ipf_stack_t *ifs;
950 {
951 	ipfr_t *frag, *next, zero;
952 	int error = 0;
953 
954 	READ_ENTER(lock);
955 
956 	/*
957 	 * Retrieve "previous" entry from token and find the next entry.
958 	 */
959 	frag = token->ipt_data;
960 	if (frag == NULL)
961 		next = *top;
962 	else
963 		next = frag->ipfr_next;
964 
965 	/*
966 	 * If we found an entry, add reference to it and update token.
967 	 * Otherwise, zero out data to be returned and NULL out token.
968 	 */
969 	if (next != NULL) {
970 		ATOMIC_INC(next->ipfr_ref);
971 		token->ipt_data = next;
972 	} else {
973 		bzero(&zero, sizeof(zero));
974 		next = &zero;
975 		token->ipt_data = NULL;
976 	}
977 
978 	/*
979 	 * Now that we have ref, it's save to give up lock.
980 	 */
981 	RWLOCK_EXIT(lock);
982 
983 	/*
984 	 * Copy out data and clean up references and token as needed.
985 	 */
986 	error = COPYOUT(next, itp->igi_data, sizeof(*next));
987 	if (error != 0)
988 		error = EFAULT;
989 	if (token->ipt_data == NULL) {
990 		ipf_freetoken(token, ifs);
991 	} else {
992 		if (frag != NULL)
993 			fr_fragderef(&frag, lock, ifs);
994 		if (next->ipfr_next == NULL)
995 			ipf_freetoken(token, ifs);
996 	}
997 	return error;
998 }
999 
1000 
fr_fragderef(frp,lock,ifs)1001 void fr_fragderef(frp, lock, ifs)
1002 ipfr_t **frp;
1003 ipfrwlock_t *lock;
1004 ipf_stack_t *ifs;
1005 {
1006 	ipfr_t *fra;
1007 
1008 	fra = *frp;
1009 	*frp = NULL;
1010 
1011 	WRITE_ENTER(lock);
1012 	fra->ipfr_ref--;
1013 	if (fra->ipfr_ref <= 0) {
1014 		KFREE(fra);
1015 		ifs->ifs_ipfr_stats.ifs_expire++;
1016 		ifs->ifs_ipfr_inuse--;
1017 	}
1018 	RWLOCK_EXIT(lock);
1019 }
1020