17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * Copyright (C) 1997-2003 by Darren Reed. 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * See the IPFILTER.LICENCE file for details on licencing. 57c478bd9Sstevel@tonic-gate * 6ab25eeb5Syz * $Id: ip_log.c,v 2.75.2.7 2005/06/11 07:47:44 darrenr Exp $ 77c478bd9Sstevel@tonic-gate * 8*f4b3ec61Sdh * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 97c478bd9Sstevel@tonic-gate * Use is subject to license terms. 107c478bd9Sstevel@tonic-gate */ 117c478bd9Sstevel@tonic-gate 127c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 137c478bd9Sstevel@tonic-gate 147c478bd9Sstevel@tonic-gate #include <sys/param.h> 157c478bd9Sstevel@tonic-gate #if defined(KERNEL) || defined(_KERNEL) 167c478bd9Sstevel@tonic-gate # undef KERNEL 177c478bd9Sstevel@tonic-gate # undef _KERNEL 187c478bd9Sstevel@tonic-gate # define KERNEL 1 197c478bd9Sstevel@tonic-gate # define _KERNEL 1 207c478bd9Sstevel@tonic-gate #endif 217c478bd9Sstevel@tonic-gate #if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \ 227c478bd9Sstevel@tonic-gate defined(_KERNEL) 237c478bd9Sstevel@tonic-gate # include "opt_ipfilter_log.h" 247c478bd9Sstevel@tonic-gate #endif 25ab25eeb5Syz #if defined(__FreeBSD__) && !defined(IPFILTER_LKM) 26ab25eeb5Syz # if defined(_KERNEL) 27ab25eeb5Syz # if defined(__FreeBSD_version) && (__FreeBSD_version >= 300000) 28ab25eeb5Syz # include "opt_ipfilter.h" 297c478bd9Sstevel@tonic-gate # endif 30ab25eeb5Syz # else 31ab25eeb5Syz # include <osreldate.h> 327c478bd9Sstevel@tonic-gate # endif 337c478bd9Sstevel@tonic-gate #endif 34ab25eeb5Syz #ifndef SOLARIS 35ab25eeb5Syz # define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4))) 36ab25eeb5Syz #endif 37ab25eeb5Syz #include <sys/errno.h> 38ab25eeb5Syz #include <sys/types.h> 39ab25eeb5Syz #include <sys/file.h> 40ab25eeb5Syz #ifndef _KERNEL 41ab25eeb5Syz # include <stdio.h> 42ab25eeb5Syz # include <string.h> 43ab25eeb5Syz # include <stdlib.h> 44ab25eeb5Syz # include <ctype.h> 45ab25eeb5Syz # define _KERNEL 46ab25eeb5Syz # define KERNEL 477c478bd9Sstevel@tonic-gate # ifdef __OpenBSD__ 487c478bd9Sstevel@tonic-gate struct file; 497c478bd9Sstevel@tonic-gate # endif 50ab25eeb5Syz # include <sys/uio.h> 51ab25eeb5Syz # undef _KERNEL 52ab25eeb5Syz # undef KERNEL 53ab25eeb5Syz #endif 54ab25eeb5Syz #if __FreeBSD_version >= 220000 && defined(_KERNEL) 55ab25eeb5Syz # include <sys/fcntl.h> 56ab25eeb5Syz # include <sys/filio.h> 57ab25eeb5Syz #else 58ab25eeb5Syz # include <sys/ioctl.h> 59ab25eeb5Syz #endif 60ab25eeb5Syz #include <sys/time.h> 61ab25eeb5Syz #if defined(_KERNEL) 62ab25eeb5Syz # include <sys/systm.h> 63ab25eeb5Syz # if defined(NetBSD) && (__NetBSD_Version__ >= 104000000) 64ab25eeb5Syz # include <sys/proc.h> 657c478bd9Sstevel@tonic-gate # endif 66ab25eeb5Syz #endif /* _KERNEL */ 67ab25eeb5Syz #if !SOLARIS && !defined(__hpux) && !defined(linux) 68ab25eeb5Syz # if (NetBSD > 199609) || (OpenBSD > 199603) || (__FreeBSD_version >= 300000) 69ab25eeb5Syz # include <sys/dirent.h> 707c478bd9Sstevel@tonic-gate # else 71ab25eeb5Syz # include <sys/dir.h> 727c478bd9Sstevel@tonic-gate # endif 73ab25eeb5Syz # include <sys/mbuf.h> 74ab25eeb5Syz #else 75ab25eeb5Syz # if !defined(__hpux) && defined(_KERNEL) 76ab25eeb5Syz # include <sys/filio.h> 77ab25eeb5Syz # include <sys/cred.h> 78ab25eeb5Syz # include <sys/ddi.h> 79ab25eeb5Syz # include <sys/sunddi.h> 80ab25eeb5Syz # include <sys/ksynch.h> 81ab25eeb5Syz # include <sys/kmem.h> 82ab25eeb5Syz # include <sys/mkdev.h> 83ab25eeb5Syz # include <sys/dditypes.h> 84ab25eeb5Syz # include <sys/cmn_err.h> 85ab25eeb5Syz # endif /* !__hpux */ 86ab25eeb5Syz #endif /* !SOLARIS && !__hpux */ 87ab25eeb5Syz #if !defined(linux) 887c478bd9Sstevel@tonic-gate # include <sys/protosw.h> 89ab25eeb5Syz #endif 90ab25eeb5Syz #include <sys/socket.h> 917c478bd9Sstevel@tonic-gate 92ab25eeb5Syz #include <net/if.h> 93ab25eeb5Syz #ifdef sun 94ab25eeb5Syz # include <net/af.h> 95ab25eeb5Syz #endif 96ab25eeb5Syz #if __FreeBSD_version >= 300000 97ab25eeb5Syz # include <net/if_var.h> 98ab25eeb5Syz #endif 99ab25eeb5Syz #include <net/route.h> 100ab25eeb5Syz #include <netinet/in.h> 101ab25eeb5Syz #ifdef __sgi 102ab25eeb5Syz # include <sys/ddi.h> 103ab25eeb5Syz # ifdef IFF_DRVRLOCK /* IRIX6 */ 104ab25eeb5Syz # include <sys/hashing.h> 1057c478bd9Sstevel@tonic-gate # endif 106ab25eeb5Syz #endif 107ab25eeb5Syz #if !defined(__hpux) && !defined(linux) && \ 108ab25eeb5Syz !(defined(__sgi) && !defined(IFF_DRVRLOCK)) /*IRIX<6*/ 109ab25eeb5Syz # include <netinet/in_var.h> 110ab25eeb5Syz #endif 111ab25eeb5Syz #include <netinet/in_systm.h> 112ab25eeb5Syz #include <netinet/ip.h> 113ab25eeb5Syz #include <netinet/tcp.h> 114ab25eeb5Syz #include <netinet/udp.h> 115ab25eeb5Syz #include <netinet/ip_icmp.h> 116ab25eeb5Syz #ifdef USE_INET6 117ab25eeb5Syz # include <netinet/icmp6.h> 118ab25eeb5Syz #endif 119ab25eeb5Syz #if !defined(linux) 1207c478bd9Sstevel@tonic-gate # include <netinet/ip_var.h> 1217c478bd9Sstevel@tonic-gate #endif 122ab25eeb5Syz #ifndef _KERNEL 123ab25eeb5Syz # include <syslog.h> 124ab25eeb5Syz #endif 125ab25eeb5Syz #include "netinet/ip_compat.h" 126ab25eeb5Syz #include <netinet/tcpip.h> 127ab25eeb5Syz #include "netinet/ip_fil.h" 128ab25eeb5Syz #include "netinet/ip_nat.h" 129ab25eeb5Syz #include "netinet/ip_frag.h" 130ab25eeb5Syz #include "netinet/ip_state.h" 131ab25eeb5Syz #include "netinet/ip_auth.h" 132*f4b3ec61Sdh #include "netinet/ipf_stack.h" 133ab25eeb5Syz #if (__FreeBSD_version >= 300000) || defined(__NetBSD__) 134ab25eeb5Syz # include <sys/malloc.h> 135ab25eeb5Syz #endif 136ab25eeb5Syz /* END OF INCLUDES */ 1377c478bd9Sstevel@tonic-gate 138ab25eeb5Syz #ifdef IPFILTER_LOG 1397c478bd9Sstevel@tonic-gate 1407c478bd9Sstevel@tonic-gate # if defined(IPL_SELECT) 141ab25eeb5Syz # include <machine/sys/user.h> 142ab25eeb5Syz # include <sys/kthread_iface.h> 143ab25eeb5Syz # define READ_COLLISION 0x001 1447c478bd9Sstevel@tonic-gate 145ab25eeb5Syz iplog_select_t iplog_ss[IPL_LOGMAX+1]; 1467c478bd9Sstevel@tonic-gate 1477c478bd9Sstevel@tonic-gate extern int selwait; 1487c478bd9Sstevel@tonic-gate # endif /* IPL_SELECT */ 1497c478bd9Sstevel@tonic-gate 150*f4b3ec61Sdh /* ipl_magic never changes */ 151ab25eeb5Syz int ipl_magic[IPL_LOGSIZE] = { IPL_MAGIC, IPL_MAGIC_NAT, IPL_MAGIC_STATE, 152ab25eeb5Syz IPL_MAGIC, IPL_MAGIC, IPL_MAGIC, 153ab25eeb5Syz IPL_MAGIC, IPL_MAGIC }; 1547c478bd9Sstevel@tonic-gate 1557c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 1567c478bd9Sstevel@tonic-gate /* Function: fr_loginit */ 1577c478bd9Sstevel@tonic-gate /* Returns: int - 0 == success (always returned) */ 1587c478bd9Sstevel@tonic-gate /* Parameters: Nil */ 1597c478bd9Sstevel@tonic-gate /* */ 1607c478bd9Sstevel@tonic-gate /* Initialise log buffers & pointers. Also iniialised the CRC to a local */ 1617c478bd9Sstevel@tonic-gate /* secret for use in calculating the "last log checksum". */ 1627c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 163*f4b3ec61Sdh int fr_loginit(ifs) 164*f4b3ec61Sdh ipf_stack_t *ifs; 1657c478bd9Sstevel@tonic-gate { 1667c478bd9Sstevel@tonic-gate int i; 167*f4b3ec61Sdh 168*f4b3ec61Sdh ifs->ifs_ipl_suppress = 1; 169*f4b3ec61Sdh ifs->ifs_ipl_logmax = IPL_LOGMAX; 170*f4b3ec61Sdh ifs->ifs_ipl_logsize = IPFILTER_LOGSIZE; 1717c478bd9Sstevel@tonic-gate for (i = IPL_LOGMAX; i >= 0; i--) { 172*f4b3ec61Sdh ifs->ifs_iplt[i] = NULL; 173*f4b3ec61Sdh ifs->ifs_ipll[i] = NULL; 174*f4b3ec61Sdh ifs->ifs_iplh[i] = &ifs->ifs_iplt[i]; 175*f4b3ec61Sdh ifs->ifs_iplused[i] = 0; 176*f4b3ec61Sdh bzero((char *)&ifs->ifs_iplcrc[i], sizeof(ifs->ifs_iplcrc[i])); 1777c478bd9Sstevel@tonic-gate # ifdef IPL_SELECT 1787c478bd9Sstevel@tonic-gate iplog_ss[i].read_waiter = 0; 1797c478bd9Sstevel@tonic-gate iplog_ss[i].state = 0; 180ab25eeb5Syz # endif 181ab25eeb5Syz # if defined(linux) && defined(_KERNEL) 182ab25eeb5Syz init_waitqueue_head(iplh_linux + i); 1837c478bd9Sstevel@tonic-gate # endif 1847c478bd9Sstevel@tonic-gate } 1857c478bd9Sstevel@tonic-gate 1867c478bd9Sstevel@tonic-gate # if SOLARIS && defined(_KERNEL) 187*f4b3ec61Sdh cv_init(&ifs->ifs_iplwait, "ipl condvar", CV_DRIVER, NULL); 1887c478bd9Sstevel@tonic-gate # endif 189*f4b3ec61Sdh MUTEX_INIT(&ifs->ifs_ipl_mutex, "ipf log mutex"); 1907c478bd9Sstevel@tonic-gate 191*f4b3ec61Sdh ifs->ifs_ipl_log_init = 1; 1927c478bd9Sstevel@tonic-gate 1937c478bd9Sstevel@tonic-gate return 0; 1947c478bd9Sstevel@tonic-gate } 1957c478bd9Sstevel@tonic-gate 1967c478bd9Sstevel@tonic-gate 1977c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 1987c478bd9Sstevel@tonic-gate /* Function: fr_logunload */ 1997c478bd9Sstevel@tonic-gate /* Returns: Nil */ 2007c478bd9Sstevel@tonic-gate /* Parameters: Nil */ 2017c478bd9Sstevel@tonic-gate /* */ 2027c478bd9Sstevel@tonic-gate /* Clean up any log data that has accumulated without being read. */ 2037c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 204*f4b3ec61Sdh void fr_logunload(ifs) 205*f4b3ec61Sdh ipf_stack_t *ifs; 2067c478bd9Sstevel@tonic-gate { 2077c478bd9Sstevel@tonic-gate int i; 2087c478bd9Sstevel@tonic-gate 209*f4b3ec61Sdh if (ifs->ifs_ipl_log_init == 0) 2107c478bd9Sstevel@tonic-gate return; 2117c478bd9Sstevel@tonic-gate 2127c478bd9Sstevel@tonic-gate for (i = IPL_LOGMAX; i >= 0; i--) 213*f4b3ec61Sdh (void) ipflog_clear(i, ifs); 2147c478bd9Sstevel@tonic-gate 2157c478bd9Sstevel@tonic-gate # if SOLARIS && defined(_KERNEL) 216*f4b3ec61Sdh cv_destroy(&ifs->ifs_iplwait); 2177c478bd9Sstevel@tonic-gate # endif 218*f4b3ec61Sdh MUTEX_DESTROY(&ifs->ifs_ipl_mutex); 2197c478bd9Sstevel@tonic-gate 220*f4b3ec61Sdh ifs->ifs_ipl_log_init = 0; 2217c478bd9Sstevel@tonic-gate } 2227c478bd9Sstevel@tonic-gate 2237c478bd9Sstevel@tonic-gate 2247c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 2257c478bd9Sstevel@tonic-gate /* Function: ipflog */ 2267c478bd9Sstevel@tonic-gate /* Returns: int - 0 == success, -1 == failure */ 2277c478bd9Sstevel@tonic-gate /* Parameters: fin(I) - pointer to packet information */ 2287c478bd9Sstevel@tonic-gate /* flags(I) - flags from filter rules */ 2297c478bd9Sstevel@tonic-gate /* */ 2307c478bd9Sstevel@tonic-gate /* Create a log record for a packet given that it has been triggered by a */ 2317c478bd9Sstevel@tonic-gate /* rule (or the default setting). Calculate the transport protocol header */ 2327c478bd9Sstevel@tonic-gate /* size using predetermined size of a couple of popular protocols and thus */ 2337c478bd9Sstevel@tonic-gate /* how much data to copy into the log, including part of the data body if */ 2347c478bd9Sstevel@tonic-gate /* requested. */ 2357c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 2367c478bd9Sstevel@tonic-gate int ipflog(fin, flags) 2377c478bd9Sstevel@tonic-gate fr_info_t *fin; 2387c478bd9Sstevel@tonic-gate u_int flags; 2397c478bd9Sstevel@tonic-gate { 2407c478bd9Sstevel@tonic-gate register size_t hlen; 2417c478bd9Sstevel@tonic-gate int types[2], mlen; 2427c478bd9Sstevel@tonic-gate size_t sizes[2]; 2437c478bd9Sstevel@tonic-gate void *ptrs[2]; 2447c478bd9Sstevel@tonic-gate ipflog_t ipfl; 2457c478bd9Sstevel@tonic-gate u_char p; 2467c478bd9Sstevel@tonic-gate mb_t *m; 247381a2a9aSdr # if SOLARIS && defined(_KERNEL) 248381a2a9aSdr net_data_t nif; 249381a2a9aSdr void *ifp; 250381a2a9aSdr # else 251381a2a9aSdr # if defined(__hpux) && defined(_KERNEL) 252ab25eeb5Syz qif_t *ifp; 2537c478bd9Sstevel@tonic-gate # else 2547c478bd9Sstevel@tonic-gate struct ifnet *ifp; 255381a2a9aSdr # endif 256381a2a9aSdr # endif /* SOLARIS */ 257*f4b3ec61Sdh ipf_stack_t *ifs = fin->fin_ifs; 2587c478bd9Sstevel@tonic-gate 259ab25eeb5Syz ipfl.fl_nattag.ipt_num[0] = 0; 2607c478bd9Sstevel@tonic-gate m = fin->fin_m; 2617c478bd9Sstevel@tonic-gate ifp = fin->fin_ifp; 2627c478bd9Sstevel@tonic-gate hlen = fin->fin_hlen; 2637c478bd9Sstevel@tonic-gate /* 2647c478bd9Sstevel@tonic-gate * calculate header size. 2657c478bd9Sstevel@tonic-gate */ 2667c478bd9Sstevel@tonic-gate if (fin->fin_off == 0) { 2677c478bd9Sstevel@tonic-gate p = fin->fin_fi.fi_p; 2687c478bd9Sstevel@tonic-gate if (p == IPPROTO_TCP) 2697c478bd9Sstevel@tonic-gate hlen += MIN(sizeof(tcphdr_t), fin->fin_dlen); 2707c478bd9Sstevel@tonic-gate else if (p == IPPROTO_UDP) 2717c478bd9Sstevel@tonic-gate hlen += MIN(sizeof(udphdr_t), fin->fin_dlen); 2727c478bd9Sstevel@tonic-gate else if (p == IPPROTO_ICMP) { 2737c478bd9Sstevel@tonic-gate struct icmp *icmp; 2747c478bd9Sstevel@tonic-gate 2757c478bd9Sstevel@tonic-gate icmp = (struct icmp *)fin->fin_dp; 276ab25eeb5Syz 2777c478bd9Sstevel@tonic-gate /* 2787c478bd9Sstevel@tonic-gate * For ICMP, if the packet is an error packet, also 2797c478bd9Sstevel@tonic-gate * include the information about the packet which 2807c478bd9Sstevel@tonic-gate * caused the error. 2817c478bd9Sstevel@tonic-gate */ 2827c478bd9Sstevel@tonic-gate switch (icmp->icmp_type) 2837c478bd9Sstevel@tonic-gate { 2847c478bd9Sstevel@tonic-gate case ICMP_UNREACH : 2857c478bd9Sstevel@tonic-gate case ICMP_SOURCEQUENCH : 2867c478bd9Sstevel@tonic-gate case ICMP_REDIRECT : 2877c478bd9Sstevel@tonic-gate case ICMP_TIMXCEED : 2887c478bd9Sstevel@tonic-gate case ICMP_PARAMPROB : 2897c478bd9Sstevel@tonic-gate hlen += MIN(sizeof(struct icmp) + 8, 2907c478bd9Sstevel@tonic-gate fin->fin_dlen); 2917c478bd9Sstevel@tonic-gate break; 2927c478bd9Sstevel@tonic-gate default : 2937c478bd9Sstevel@tonic-gate hlen += MIN(sizeof(struct icmp), 2947c478bd9Sstevel@tonic-gate fin->fin_dlen); 2957c478bd9Sstevel@tonic-gate break; 2967c478bd9Sstevel@tonic-gate } 2977c478bd9Sstevel@tonic-gate } 2987c478bd9Sstevel@tonic-gate # ifdef USE_INET6 2997c478bd9Sstevel@tonic-gate else if (p == IPPROTO_ICMPV6) { 3007c478bd9Sstevel@tonic-gate struct icmp6_hdr *icmp; 3017c478bd9Sstevel@tonic-gate 3027c478bd9Sstevel@tonic-gate icmp = (struct icmp6_hdr *)fin->fin_dp; 3037c478bd9Sstevel@tonic-gate 3047c478bd9Sstevel@tonic-gate /* 3057c478bd9Sstevel@tonic-gate * For ICMPV6, if the packet is an error packet, also 3067c478bd9Sstevel@tonic-gate * include the information about the packet which 3077c478bd9Sstevel@tonic-gate * caused the error. 3087c478bd9Sstevel@tonic-gate */ 3097c478bd9Sstevel@tonic-gate if (icmp->icmp6_type < 128) { 3107c478bd9Sstevel@tonic-gate hlen += MIN(sizeof(struct icmp6_hdr) + 8, 3117c478bd9Sstevel@tonic-gate fin->fin_dlen); 3127c478bd9Sstevel@tonic-gate } else { 3137c478bd9Sstevel@tonic-gate hlen += MIN(sizeof(struct icmp6_hdr), 3147c478bd9Sstevel@tonic-gate fin->fin_dlen); 3157c478bd9Sstevel@tonic-gate } 3167c478bd9Sstevel@tonic-gate } 3177c478bd9Sstevel@tonic-gate # endif 3187c478bd9Sstevel@tonic-gate } 3197c478bd9Sstevel@tonic-gate /* 3207c478bd9Sstevel@tonic-gate * Get the interface number and name to which this packet is 3217c478bd9Sstevel@tonic-gate * currently associated. 3227c478bd9Sstevel@tonic-gate */ 323381a2a9aSdr # if SOLARIS && defined(_KERNEL) 324ab25eeb5Syz ipfl.fl_unit = (u_int)0; 325381a2a9aSdr nif = NULL; 326381a2a9aSdr if (fin->fin_fi.fi_v == 4) 327*f4b3ec61Sdh nif = ifs->ifs_ipf_ipv4; 328381a2a9aSdr else if (fin->fin_fi.fi_v == 6) 329*f4b3ec61Sdh nif = ifs->ifs_ipf_ipv6; 330381a2a9aSdr if (nif != NULL) { 331381a2a9aSdr if (net_getifname(nif, (phy_if_t)ifp, 332381a2a9aSdr ipfl.fl_ifname, sizeof(ipfl.fl_ifname)) != 0) 333381a2a9aSdr return (-1); 334381a2a9aSdr } 335381a2a9aSdr 3367c478bd9Sstevel@tonic-gate # else 337381a2a9aSdr # if defined(__hpux) && defined(_KERNEL) 338381a2a9aSdr ipfl.fl_unit = (u_int)0; 339381a2a9aSdr (void) strncpy(ipfl.fl_ifname, IFNAME(ifp), sizeof(ipfl.fl_ifname)); 3407c478bd9Sstevel@tonic-gate # else 341381a2a9aSdr # if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199603)) || \ 342381a2a9aSdr (defined(OpenBSD) && (OpenBSD >= 199603)) || defined(linux) || \ 343381a2a9aSdr (defined(__FreeBSD__) && (__FreeBSD_version >= 501113)) 344381a2a9aSdr COPYIFNAME(ifp, ipfl.fl_ifname); 345381a2a9aSdr # else 346ab25eeb5Syz ipfl.fl_unit = (u_int)ifp->if_unit; 347381a2a9aSdr # if defined(_KERNEL) 3487c478bd9Sstevel@tonic-gate if ((ipfl.fl_ifname[0] = ifp->if_name[0])) 3497c478bd9Sstevel@tonic-gate if ((ipfl.fl_ifname[1] = ifp->if_name[1])) 3507c478bd9Sstevel@tonic-gate if ((ipfl.fl_ifname[2] = ifp->if_name[2])) 3517c478bd9Sstevel@tonic-gate ipfl.fl_ifname[3] = ifp->if_name[3]; 352381a2a9aSdr # else 353ab25eeb5Syz (void) strncpy(ipfl.fl_ifname, IFNAME(ifp), sizeof(ipfl.fl_ifname)); 354ab25eeb5Syz ipfl.fl_ifname[sizeof(ipfl.fl_ifname) - 1] = '\0'; 355381a2a9aSdr # endif 3567c478bd9Sstevel@tonic-gate # endif 357381a2a9aSdr # endif /* __hpux */ 358381a2a9aSdr # endif /* SOLARIS */ 3597c478bd9Sstevel@tonic-gate mlen = fin->fin_plen - hlen; 360*f4b3ec61Sdh if (!ifs->ifs_ipl_logall) { 3617c478bd9Sstevel@tonic-gate mlen = (flags & FR_LOGBODY) ? MIN(mlen, 128) : 0; 3627c478bd9Sstevel@tonic-gate } else if ((flags & FR_LOGBODY) == 0) { 3637c478bd9Sstevel@tonic-gate mlen = 0; 3647c478bd9Sstevel@tonic-gate } 3657c478bd9Sstevel@tonic-gate if (mlen < 0) 3667c478bd9Sstevel@tonic-gate mlen = 0; 3677c478bd9Sstevel@tonic-gate ipfl.fl_plen = (u_char)mlen; 3687c478bd9Sstevel@tonic-gate ipfl.fl_hlen = (u_char)hlen; 3697c478bd9Sstevel@tonic-gate ipfl.fl_rule = fin->fin_rule; 3707c478bd9Sstevel@tonic-gate (void) strncpy(ipfl.fl_group, fin->fin_group, FR_GROUPLEN); 3717c478bd9Sstevel@tonic-gate if (fin->fin_fr != NULL) { 3727c478bd9Sstevel@tonic-gate ipfl.fl_loglevel = fin->fin_fr->fr_loglevel; 373ab25eeb5Syz ipfl.fl_logtag = fin->fin_fr->fr_logtag; 3747c478bd9Sstevel@tonic-gate } else { 3757c478bd9Sstevel@tonic-gate ipfl.fl_loglevel = 0xffff; 376ab25eeb5Syz ipfl.fl_logtag = FR_NOLOGTAG; 3777c478bd9Sstevel@tonic-gate } 378ab25eeb5Syz if (fin->fin_nattag != NULL) 379ab25eeb5Syz bcopy(fin->fin_nattag, (void *)&ipfl.fl_nattag, 380ab25eeb5Syz sizeof(ipfl.fl_nattag)); 3817c478bd9Sstevel@tonic-gate ipfl.fl_flags = flags; 3827c478bd9Sstevel@tonic-gate ipfl.fl_dir = fin->fin_out; 3837c478bd9Sstevel@tonic-gate ipfl.fl_lflags = fin->fin_flx; 3847c478bd9Sstevel@tonic-gate ptrs[0] = (void *)&ipfl; 3857c478bd9Sstevel@tonic-gate sizes[0] = sizeof(ipfl); 3867c478bd9Sstevel@tonic-gate types[0] = 0; 3877c478bd9Sstevel@tonic-gate # if defined(MENTAT) && defined(_KERNEL) 3887c478bd9Sstevel@tonic-gate /* 3897c478bd9Sstevel@tonic-gate * Are we copied from the mblk or an aligned array ? 3907c478bd9Sstevel@tonic-gate */ 3917c478bd9Sstevel@tonic-gate if (fin->fin_ip == (ip_t *)m->b_rptr) { 3927c478bd9Sstevel@tonic-gate ptrs[1] = m; 3937c478bd9Sstevel@tonic-gate sizes[1] = hlen + mlen; 3947c478bd9Sstevel@tonic-gate types[1] = 1; 3957c478bd9Sstevel@tonic-gate } else { 3967c478bd9Sstevel@tonic-gate ptrs[1] = fin->fin_ip; 3977c478bd9Sstevel@tonic-gate sizes[1] = hlen + mlen; 3987c478bd9Sstevel@tonic-gate types[1] = 0; 3997c478bd9Sstevel@tonic-gate } 4007c478bd9Sstevel@tonic-gate # else 4017c478bd9Sstevel@tonic-gate ptrs[1] = m; 4027c478bd9Sstevel@tonic-gate sizes[1] = hlen + mlen; 4037c478bd9Sstevel@tonic-gate types[1] = 1; 4047c478bd9Sstevel@tonic-gate # endif /* MENTAT */ 405*f4b3ec61Sdh return ipllog(IPL_LOGIPF, fin, ptrs, sizes, types, 2, fin->fin_ifs); 4067c478bd9Sstevel@tonic-gate } 4077c478bd9Sstevel@tonic-gate 4087c478bd9Sstevel@tonic-gate 4097c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 4107c478bd9Sstevel@tonic-gate /* Function: ipllog */ 4117c478bd9Sstevel@tonic-gate /* Returns: int - 0 == success, -1 == failure */ 4127c478bd9Sstevel@tonic-gate /* Parameters: dev(I) - device that owns this log record */ 4137c478bd9Sstevel@tonic-gate /* fin(I) - pointer to packet information */ 4147c478bd9Sstevel@tonic-gate /* items(I) - array of pointers to log data */ 4157c478bd9Sstevel@tonic-gate /* itemsz(I) - array of size of valid memory pointed to */ 4167c478bd9Sstevel@tonic-gate /* types(I) - type of data pointed to by items pointers */ 4177c478bd9Sstevel@tonic-gate /* cnt(I) - number of elements in arrays items/itemsz/types */ 4187c478bd9Sstevel@tonic-gate /* */ 4197c478bd9Sstevel@tonic-gate /* Takes an array of parameters and constructs one record to include the */ 4207c478bd9Sstevel@tonic-gate /* miscellaneous packet information, as well as packet data, for reading */ 4217c478bd9Sstevel@tonic-gate /* from the log device. */ 4227c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 423*f4b3ec61Sdh int ipllog(dev, fin, items, itemsz, types, cnt, ifs) 4247c478bd9Sstevel@tonic-gate int dev; 4257c478bd9Sstevel@tonic-gate fr_info_t *fin; 4267c478bd9Sstevel@tonic-gate void **items; 4277c478bd9Sstevel@tonic-gate size_t *itemsz; 4287c478bd9Sstevel@tonic-gate int *types, cnt; 429*f4b3ec61Sdh ipf_stack_t *ifs; 4307c478bd9Sstevel@tonic-gate { 431ab25eeb5Syz caddr_t buf, ptr; 4327c478bd9Sstevel@tonic-gate iplog_t *ipl; 4337c478bd9Sstevel@tonic-gate size_t len; 4347c478bd9Sstevel@tonic-gate int i; 435ab25eeb5Syz SPL_INT(s); 436ab25eeb5Syz 4377c478bd9Sstevel@tonic-gate /* 4387c478bd9Sstevel@tonic-gate * Check to see if this log record has a CRC which matches the last 4397c478bd9Sstevel@tonic-gate * record logged. If it does, just up the count on the previous one 4407c478bd9Sstevel@tonic-gate * rather than create a new one. 4417c478bd9Sstevel@tonic-gate */ 442*f4b3ec61Sdh if (ifs->ifs_ipl_suppress) { 443*f4b3ec61Sdh MUTEX_ENTER(&ifs->ifs_ipl_mutex); 444ab25eeb5Syz if ((fin != NULL) && (fin->fin_off == 0)) { 445*f4b3ec61Sdh if ((ifs->ifs_ipll[dev] != NULL) && 446*f4b3ec61Sdh bcmp((char *)fin, (char *)&ifs->ifs_iplcrc[dev], 4477c478bd9Sstevel@tonic-gate FI_LCSIZE) == 0) { 448*f4b3ec61Sdh ifs->ifs_ipll[dev]->ipl_count++; 449*f4b3ec61Sdh MUTEX_EXIT(&ifs->ifs_ipl_mutex); 4507c478bd9Sstevel@tonic-gate return 0; 4517c478bd9Sstevel@tonic-gate } 452*f4b3ec61Sdh bcopy((char *)fin, (char *)&ifs->ifs_iplcrc[dev], 453*f4b3ec61Sdh FI_LCSIZE); 4547c478bd9Sstevel@tonic-gate } else 455*f4b3ec61Sdh bzero((char *)&ifs->ifs_iplcrc[dev], FI_CSIZE); 456*f4b3ec61Sdh MUTEX_EXIT(&ifs->ifs_ipl_mutex); 4577c478bd9Sstevel@tonic-gate } 4587c478bd9Sstevel@tonic-gate 4597c478bd9Sstevel@tonic-gate /* 4607c478bd9Sstevel@tonic-gate * Get the total amount of data to be logged. 4617c478bd9Sstevel@tonic-gate */ 4627c478bd9Sstevel@tonic-gate for (i = 0, len = sizeof(iplog_t); i < cnt; i++) 4637c478bd9Sstevel@tonic-gate len += itemsz[i]; 4647c478bd9Sstevel@tonic-gate 4657c478bd9Sstevel@tonic-gate /* 4667c478bd9Sstevel@tonic-gate * check that we have space to record this information and can 4677c478bd9Sstevel@tonic-gate * allocate that much. 4687c478bd9Sstevel@tonic-gate */ 469ab25eeb5Syz KMALLOCS(buf, caddr_t, len); 470ab25eeb5Syz if (buf == NULL) 471ab25eeb5Syz return -1; 472ab25eeb5Syz SPL_NET(s); 473*f4b3ec61Sdh MUTEX_ENTER(&ifs->ifs_ipl_mutex); 474*f4b3ec61Sdh if ((ifs->ifs_iplused[dev] + len) > IPFILTER_LOGSIZE) { 475*f4b3ec61Sdh MUTEX_EXIT(&ifs->ifs_ipl_mutex); 476ab25eeb5Syz SPL_X(s); 477ab25eeb5Syz KFREES(buf, len); 478ab25eeb5Syz return -1; 4797c478bd9Sstevel@tonic-gate } 480*f4b3ec61Sdh ifs->ifs_iplused[dev] += len; 481*f4b3ec61Sdh MUTEX_EXIT(&ifs->ifs_ipl_mutex); 482ab25eeb5Syz SPL_X(s); 4837c478bd9Sstevel@tonic-gate 4847c478bd9Sstevel@tonic-gate /* 4857c478bd9Sstevel@tonic-gate * advance the log pointer to the next empty record and deduct the 4867c478bd9Sstevel@tonic-gate * amount of space we're going to use. 4877c478bd9Sstevel@tonic-gate */ 4887c478bd9Sstevel@tonic-gate ipl = (iplog_t *)buf; 489ab25eeb5Syz ipl->ipl_magic = ipl_magic[dev]; 4907c478bd9Sstevel@tonic-gate ipl->ipl_count = 1; 4917c478bd9Sstevel@tonic-gate ipl->ipl_next = NULL; 4927c478bd9Sstevel@tonic-gate ipl->ipl_dsize = len; 4937c478bd9Sstevel@tonic-gate #ifdef _KERNEL 4947c478bd9Sstevel@tonic-gate GETKTIME(&ipl->ipl_sec); 4957c478bd9Sstevel@tonic-gate #else 4967c478bd9Sstevel@tonic-gate ipl->ipl_sec = 0; 4977c478bd9Sstevel@tonic-gate ipl->ipl_usec = 0; 4987c478bd9Sstevel@tonic-gate #endif 4997c478bd9Sstevel@tonic-gate 5007c478bd9Sstevel@tonic-gate /* 5017c478bd9Sstevel@tonic-gate * Loop through all the items to be logged, copying each one to the 5027c478bd9Sstevel@tonic-gate * buffer. Use bcopy for normal data or the mb_t copyout routine. 5037c478bd9Sstevel@tonic-gate */ 504ab25eeb5Syz for (i = 0, ptr = buf + sizeof(*ipl); i < cnt; i++) { 5057c478bd9Sstevel@tonic-gate if (types[i] == 0) { 506ab25eeb5Syz bcopy(items[i], ptr, itemsz[i]); 5077c478bd9Sstevel@tonic-gate } else if (types[i] == 1) { 508ab25eeb5Syz COPYDATA(items[i], 0, itemsz[i], ptr); 5097c478bd9Sstevel@tonic-gate } 510ab25eeb5Syz ptr += itemsz[i]; 5117c478bd9Sstevel@tonic-gate } 512ab25eeb5Syz SPL_NET(s); 513*f4b3ec61Sdh MUTEX_ENTER(&ifs->ifs_ipl_mutex); 514*f4b3ec61Sdh ifs->ifs_ipll[dev] = ipl; 515*f4b3ec61Sdh *ifs->ifs_iplh[dev] = ipl; 516*f4b3ec61Sdh ifs->ifs_iplh[dev] = &ipl->ipl_next; 5177c478bd9Sstevel@tonic-gate 5187c478bd9Sstevel@tonic-gate /* 5197c478bd9Sstevel@tonic-gate * Now that the log record has been completed and added to the queue, 5207c478bd9Sstevel@tonic-gate * wake up any listeners who may want to read it. 5217c478bd9Sstevel@tonic-gate */ 5227c478bd9Sstevel@tonic-gate # if SOLARIS && defined(_KERNEL) 523*f4b3ec61Sdh cv_signal(&ifs->ifs_iplwait); 524*f4b3ec61Sdh MUTEX_EXIT(&ifs->ifs_ipl_mutex); 5257c478bd9Sstevel@tonic-gate # else 526*f4b3ec61Sdh MUTEX_EXIT(&ifs->ifs_ipl_mutex); 527*f4b3ec61Sdh WAKEUP(&ifs->ifs_iplh, dev); 5287c478bd9Sstevel@tonic-gate # endif 529ab25eeb5Syz SPL_X(s); 5307c478bd9Sstevel@tonic-gate # ifdef IPL_SELECT 5317c478bd9Sstevel@tonic-gate iplog_input_ready(dev); 5327c478bd9Sstevel@tonic-gate # endif 533ab25eeb5Syz return 0; 5347c478bd9Sstevel@tonic-gate } 5357c478bd9Sstevel@tonic-gate 5367c478bd9Sstevel@tonic-gate 5377c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 5387c478bd9Sstevel@tonic-gate /* Function: ipflog_read */ 5397c478bd9Sstevel@tonic-gate /* Returns: int - 0 == success, else error value. */ 5407c478bd9Sstevel@tonic-gate /* Parameters: unit(I) - device we are reading from */ 5417c478bd9Sstevel@tonic-gate /* uio(O) - pointer to information about where to store data */ 5427c478bd9Sstevel@tonic-gate /* */ 5437c478bd9Sstevel@tonic-gate /* Called to handle a read on an IPFilter device. Returns only complete */ 5447c478bd9Sstevel@tonic-gate /* log messages - will not partially copy a log record out to userland. */ 5457c478bd9Sstevel@tonic-gate /* */ 5467c478bd9Sstevel@tonic-gate /* NOTE: This function will block and wait for a signal to return data if */ 5477c478bd9Sstevel@tonic-gate /* there is none present. Asynchronous I/O is not implemented. */ 5487c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 549*f4b3ec61Sdh int ipflog_read(unit, uio, ifs) 5507c478bd9Sstevel@tonic-gate minor_t unit; 5517c478bd9Sstevel@tonic-gate struct uio *uio; 552*f4b3ec61Sdh ipf_stack_t *ifs; 5537c478bd9Sstevel@tonic-gate { 5547c478bd9Sstevel@tonic-gate size_t dlen, copied; 5557c478bd9Sstevel@tonic-gate int error = 0; 5567c478bd9Sstevel@tonic-gate iplog_t *ipl; 557ab25eeb5Syz SPL_INT(s); 5587c478bd9Sstevel@tonic-gate 5597c478bd9Sstevel@tonic-gate /* 5607c478bd9Sstevel@tonic-gate * Sanity checks. Make sure the minor # is valid and we're copying 5617c478bd9Sstevel@tonic-gate * a valid chunk of data. 5627c478bd9Sstevel@tonic-gate */ 5637c478bd9Sstevel@tonic-gate if (IPL_LOGMAX < unit) 5647c478bd9Sstevel@tonic-gate return ENXIO; 5657c478bd9Sstevel@tonic-gate if (uio->uio_resid == 0) 5667c478bd9Sstevel@tonic-gate return 0; 5677c478bd9Sstevel@tonic-gate if ((uio->uio_resid < sizeof(iplog_t)) || 568*f4b3ec61Sdh (uio->uio_resid > ifs->ifs_ipl_logsize)) 5697c478bd9Sstevel@tonic-gate return EINVAL; 570ab25eeb5Syz 5717c478bd9Sstevel@tonic-gate /* 5727c478bd9Sstevel@tonic-gate * Lock the log so we can snapshot the variables. Wait for a signal 5737c478bd9Sstevel@tonic-gate * if the log is empty. 5747c478bd9Sstevel@tonic-gate */ 5757c478bd9Sstevel@tonic-gate SPL_NET(s); 576*f4b3ec61Sdh MUTEX_ENTER(&ifs->ifs_ipl_mutex); 5777c478bd9Sstevel@tonic-gate 578*f4b3ec61Sdh while (ifs->ifs_iplt[unit] == NULL) { 5797c478bd9Sstevel@tonic-gate # if SOLARIS && defined(_KERNEL) 580*f4b3ec61Sdh if (!cv_wait_sig(&ifs->ifs_iplwait, &ifs->ifs_ipl_mutex.ipf_lk)) { 581*f4b3ec61Sdh MUTEX_EXIT(&ifs->ifs_ipl_mutex); 5827c478bd9Sstevel@tonic-gate return EINTR; 5837c478bd9Sstevel@tonic-gate } 5847c478bd9Sstevel@tonic-gate # else 5857c478bd9Sstevel@tonic-gate # if defined(__hpux) && defined(_KERNEL) 5867c478bd9Sstevel@tonic-gate lock_t *l; 5877c478bd9Sstevel@tonic-gate 5887c478bd9Sstevel@tonic-gate # ifdef IPL_SELECT 5897c478bd9Sstevel@tonic-gate if (uio->uio_fpflags & (FNBLOCK|FNDELAY)) { 5907c478bd9Sstevel@tonic-gate /* this is no blocking system call */ 591*f4b3ec61Sdh MUTEX_EXIT(&ifs->ifs_ipl_mutex); 5927c478bd9Sstevel@tonic-gate return 0; 5937c478bd9Sstevel@tonic-gate } 5947c478bd9Sstevel@tonic-gate # endif 5957c478bd9Sstevel@tonic-gate 596*f4b3ec61Sdh MUTEX_EXIT(&ifs->ifs_ipl_mutex); 597*f4b3ec61Sdh l = get_sleep_lock(&ifs->ifs_iplh[unit]); 598*f4b3ec61Sdh error = sleep(&ifs->ifs_iplh[unit], PZERO+1); 5997c478bd9Sstevel@tonic-gate spinunlock(l); 6007c478bd9Sstevel@tonic-gate # else 6017c478bd9Sstevel@tonic-gate # if defined(__osf__) && defined(_KERNEL) 602*f4b3ec61Sdh error = mpsleep(&ifs->ifs_iplh[unit], PSUSP|PCATCH, "iplread", 0, 603*f4b3ec61Sdh &ifs->ifs_ipl_mutex, MS_LOCK_SIMPLE); 6047c478bd9Sstevel@tonic-gate # else 605*f4b3ec61Sdh MUTEX_EXIT(&ifs->ifs_ipl_mutex); 6067c478bd9Sstevel@tonic-gate SPL_X(s); 607*f4b3ec61Sdh error = SLEEP(&ifs->ifs_iplh[unit], "ipl sleep"); 6087c478bd9Sstevel@tonic-gate # endif /* __osf__ */ 6097c478bd9Sstevel@tonic-gate # endif /* __hpux */ 6107c478bd9Sstevel@tonic-gate if (error) 6117c478bd9Sstevel@tonic-gate return error; 6127c478bd9Sstevel@tonic-gate SPL_NET(s); 613*f4b3ec61Sdh MUTEX_ENTER(&ifs->ifs_ipl_mutex); 6147c478bd9Sstevel@tonic-gate # endif /* SOLARIS */ 6157c478bd9Sstevel@tonic-gate } 6167c478bd9Sstevel@tonic-gate 6177c478bd9Sstevel@tonic-gate # if (BSD >= 199101) || defined(__FreeBSD__) || defined(__osf__) 6187c478bd9Sstevel@tonic-gate uio->uio_rw = UIO_READ; 6197c478bd9Sstevel@tonic-gate # endif 6207c478bd9Sstevel@tonic-gate 621*f4b3ec61Sdh for (copied = 0; ((ipl = ifs->ifs_iplt[unit]) != NULL); copied += dlen) { 6227c478bd9Sstevel@tonic-gate dlen = ipl->ipl_dsize; 6237c478bd9Sstevel@tonic-gate if (dlen > uio->uio_resid) 6247c478bd9Sstevel@tonic-gate break; 6257c478bd9Sstevel@tonic-gate /* 6267c478bd9Sstevel@tonic-gate * Don't hold the mutex over the uiomove call. 6277c478bd9Sstevel@tonic-gate */ 628*f4b3ec61Sdh ifs->ifs_iplt[unit] = ipl->ipl_next; 629*f4b3ec61Sdh ifs->ifs_iplused[unit] -= dlen; 630*f4b3ec61Sdh if (ifs->ifs_iplt[unit] == NULL) { 631*f4b3ec61Sdh ifs->ifs_iplh[unit] = &ifs->ifs_iplt[unit]; 632*f4b3ec61Sdh ifs->ifs_ipll[unit] = NULL; 633381a2a9aSdr } 634*f4b3ec61Sdh MUTEX_EXIT(&ifs->ifs_ipl_mutex); 6357c478bd9Sstevel@tonic-gate SPL_X(s); 6367c478bd9Sstevel@tonic-gate error = UIOMOVE((caddr_t)ipl, dlen, UIO_READ, uio); 6377c478bd9Sstevel@tonic-gate if (error) { 6387c478bd9Sstevel@tonic-gate SPL_NET(s); 639*f4b3ec61Sdh MUTEX_ENTER(&ifs->ifs_ipl_mutex); 640*f4b3ec61Sdh ifs->ifs_iplused[unit] += dlen; 641*f4b3ec61Sdh ipl->ipl_next = ifs->ifs_iplt[unit]; 642*f4b3ec61Sdh ifs->ifs_iplt[unit] = ipl; 643*f4b3ec61Sdh ifs->ifs_ipll[unit] = ipl; 644*f4b3ec61Sdh if (ifs->ifs_iplh[unit] == &ifs->ifs_iplt[unit]) { 645*f4b3ec61Sdh *ifs->ifs_iplh[unit] = ipl; 646*f4b3ec61Sdh ifs->ifs_iplh[unit] = &ipl->ipl_next; 647381a2a9aSdr } 6487c478bd9Sstevel@tonic-gate break; 6497c478bd9Sstevel@tonic-gate } 650*f4b3ec61Sdh MUTEX_ENTER(&ifs->ifs_ipl_mutex); 6517c478bd9Sstevel@tonic-gate KFREES((caddr_t)ipl, dlen); 6527c478bd9Sstevel@tonic-gate SPL_NET(s); 6537c478bd9Sstevel@tonic-gate } 654ab25eeb5Syz 655*f4b3ec61Sdh MUTEX_EXIT(&ifs->ifs_ipl_mutex); 6567c478bd9Sstevel@tonic-gate SPL_X(s); 6577c478bd9Sstevel@tonic-gate return error; 6587c478bd9Sstevel@tonic-gate } 6597c478bd9Sstevel@tonic-gate 6607c478bd9Sstevel@tonic-gate 6617c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 6627c478bd9Sstevel@tonic-gate /* Function: ipflog_clear */ 6637c478bd9Sstevel@tonic-gate /* Returns: int - number of log bytes cleared. */ 6647c478bd9Sstevel@tonic-gate /* Parameters: unit(I) - device we are reading from */ 6657c478bd9Sstevel@tonic-gate /* */ 6667c478bd9Sstevel@tonic-gate /* Deletes all queued up log records for a given output device. */ 6677c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 668*f4b3ec61Sdh int ipflog_clear(unit, ifs) 6697c478bd9Sstevel@tonic-gate minor_t unit; 670*f4b3ec61Sdh ipf_stack_t *ifs; 6717c478bd9Sstevel@tonic-gate { 6727c478bd9Sstevel@tonic-gate iplog_t *ipl; 6737c478bd9Sstevel@tonic-gate int used; 674ab25eeb5Syz SPL_INT(s); 6757c478bd9Sstevel@tonic-gate 676ab25eeb5Syz SPL_NET(s); 677*f4b3ec61Sdh MUTEX_ENTER(&ifs->ifs_ipl_mutex); 678*f4b3ec61Sdh while ((ipl = ifs->ifs_iplt[unit]) != NULL) { 679*f4b3ec61Sdh ifs->ifs_iplt[unit] = ipl->ipl_next; 6807c478bd9Sstevel@tonic-gate KFREES((caddr_t)ipl, ipl->ipl_dsize); 6817c478bd9Sstevel@tonic-gate } 682*f4b3ec61Sdh ifs->ifs_iplh[unit] = &ifs->ifs_iplt[unit]; 683*f4b3ec61Sdh ifs->ifs_ipll[unit] = NULL; 684*f4b3ec61Sdh used = ifs->ifs_iplused[unit]; 685*f4b3ec61Sdh ifs->ifs_iplused[unit] = 0; 686*f4b3ec61Sdh bzero((char *)&ifs->ifs_iplcrc[unit], FI_CSIZE); 687*f4b3ec61Sdh MUTEX_EXIT(&ifs->ifs_ipl_mutex); 688ab25eeb5Syz SPL_X(s); 6897c478bd9Sstevel@tonic-gate return used; 6907c478bd9Sstevel@tonic-gate } 6917c478bd9Sstevel@tonic-gate #endif /* IPFILTER_LOG */ 692