2 * Copyright (C) 1993-2001 by Darren Reed.
4 * See the IPFILTER.LICENCE file for details on licencing.
6 * @(#)ip_frag.c 1.11 3/24/96 (C) 1993-2000 Darren Reed
7 * @(#)$Id: ip_frag.c,v 2.10.2.24 2002/08/28 12:41:04 darrenr Exp $
8 * $FreeBSD: src/sys/contrib/ipfilter/netinet/ip_frag.c,v 1.15.2.6 2003/03/01 03:55:54 darrenr Exp $
9 * $DragonFly: src/sys/contrib/ipfilter/netinet/ip_frag.c,v 1.3 2003/08/07 21:16:48 dillon Exp $
11 #if defined(KERNEL) && !defined(_KERNEL)
15 #if defined(__sgi) && (IRIX > 602)
16 # include <sys/ptimers.h>
18 #include <sys/errno.h>
19 #include <sys/types.h>
20 #include <sys/param.h>
23 #if !defined(_KERNEL) && !defined(KERNEL)
28 #if (defined(KERNEL) || defined(_KERNEL)) && (__FreeBSD_version >= 220000)
29 # include <sys/filio.h>
30 # include <sys/fcntl.h>
32 # include <sys/ioctl.h>
35 # include <sys/protosw.h>
37 #include <sys/socket.h>
38 #if defined(_KERNEL) && !defined(linux)
39 # include <sys/systm.h>
41 #if !defined(__SVR4) && !defined(__svr4__)
42 # if defined(_KERNEL) && !defined(__sgi)
43 # include <sys/kernel.h>
46 # include <sys/mbuf.h>
49 # include <sys/byteorder.h>
51 # include <sys/dditypes.h>
53 # include <sys/stream.h>
54 # include <sys/kmem.h>
60 #include <net/route.h>
61 #include <netinet/in.h>
62 #include <netinet/in_systm.h>
63 #include <netinet/ip.h>
65 # include <netinet/ip_var.h>
67 #include <netinet/tcp.h>
68 #include <netinet/udp.h>
69 #include <netinet/ip_icmp.h>
70 #include "ip_compat.h"
71 #include <netinet/tcpip.h>
77 #if (__FreeBSD_version >= 300000)
78 # include <sys/malloc.h>
79 # if (defined(KERNEL) || defined(_KERNEL))
81 # include <sys/libkern.h>
82 # include <sys/systm.h>
84 extern struct callout_handle ipfr_slowtimer_ch;
87 #if defined(__NetBSD__) && (__NetBSD_Version__ >= 104230000)
88 # include <sys/callout.h>
89 extern struct callout ipfr_slowtimer_ch;
91 #if defined(__OpenBSD__)
92 # include <sys/timeout.h>
93 extern struct timeout ipfr_slowtimer_ch;
96 static const char sccsid[] = "@(#)ip_frag.c 1.11 3/24/96 (C) 1993-2000 Darren Reed";
98 static ipfr_t *ipfr_heads[IPFT_SIZE];
99 static ipfr_t *ipfr_nattab[IPFT_SIZE];
100 static ipfrstat_t ipfr_stats;
101 static int ipfr_inuse = 0;
103 int fr_ipfrttl = 120; /* 60 seconds */
104 int fr_frag_lock = 0;
108 extern timeout_id_t ipfr_timer_id;
110 extern int ipfr_timer_id;
113 #if (SOLARIS || defined(__sgi)) && defined(_KERNEL)
114 extern KRWLOCK_T ipf_frag, ipf_natfrag, ipf_nat, ipf_mutex;
116 extern KRWLOCK_T ipf_solaris;
118 KRWLOCK_T ipf_solaris;
120 extern kmutex_t ipf_rw;
124 static ipfr_t *ipfr_new __P((ip_t *, fr_info_t *, ipfr_t **));
125 static ipfr_t *ipfr_lookup __P((ip_t *, fr_info_t *, ipfr_t **));
126 static void ipfr_delete __P((ipfr_t *));
129 ipfrstat_t *ipfr_fragstats()
131 ipfr_stats.ifs_table = ipfr_heads;
132 ipfr_stats.ifs_nattab = ipfr_nattab;
133 ipfr_stats.ifs_inuse = ipfr_inuse;
139 * add a new entry to the fragment cache, registering it as having come
140 * through this box, with the result of the filter operation.
142 static ipfr_t *ipfr_new(ip, fin, table)
147 ipfr_t **fp, *fra, frag;
150 if (ipfr_inuse >= IPFT_SIZE)
153 if (!(fin->fin_fi.fi_fl & FI_FRAG))
156 frag.ipfr_p = ip->ip_p;
158 frag.ipfr_id = ip->ip_id;
160 frag.ipfr_tos = ip->ip_tos;
161 frag.ipfr_src.s_addr = ip->ip_src.s_addr;
162 idx += ip->ip_src.s_addr;
163 frag.ipfr_dst.s_addr = ip->ip_dst.s_addr;
164 idx += ip->ip_dst.s_addr;
165 frag.ipfr_ifp = fin->fin_ifp;
169 frag.ipfr_optmsk = fin->fin_fi.fi_optmsk & IPF_OPTCOPY;
170 frag.ipfr_secmsk = fin->fin_fi.fi_secmsk;
171 frag.ipfr_auth = fin->fin_fi.fi_auth;
174 * first, make sure it isn't already there...
176 for (fp = &table[idx]; (fra = *fp); fp = &fra->ipfr_next)
177 if (!bcmp((char *)&frag.ipfr_src, (char *)&fra->ipfr_src,
179 ATOMIC_INCL(ipfr_stats.ifs_exists);
184 * allocate some memory, if possible, if not, just record that we
187 KMALLOC(fra, ipfr_t *);
189 ATOMIC_INCL(ipfr_stats.ifs_nomem);
193 if ((fra->ipfr_rule = fin->fin_fr) != NULL) {
194 ATOMIC_INC32(fin->fin_fr->fr_ref);
199 * Instert the fragment into the fragment table, copy the struct used
200 * in the search using bcopy rather than reassign each field.
201 * Set the ttl to the default.
203 if ((fra->ipfr_next = table[idx]))
204 table[idx]->ipfr_prev = fra;
205 fra->ipfr_prev = NULL;
206 fra->ipfr_data = NULL;
208 bcopy((char *)&frag.ipfr_src, (char *)&fra->ipfr_src, IPFR_CMPSZ);
209 fra->ipfr_ttl = fr_ipfrttl;
211 * Compute the offset of the expected start of the next packet.
213 off = ip->ip_off & IP_OFFMASK;
216 fra->ipfr_off = off + (fin->fin_dlen >> 3);
217 ATOMIC_INCL(ipfr_stats.ifs_new);
218 ATOMIC_INC32(ipfr_inuse);
223 int ipfr_newfrag(ip, fin)
229 if ((ip->ip_v != 4) || (fr_frag_lock))
231 WRITE_ENTER(&ipf_frag);
232 ipf = ipfr_new(ip, fin, ipfr_heads);
233 RWLOCK_EXIT(&ipf_frag);
235 ATOMIC_INCL(frstats[fin->fin_out].fr_bnfr);
238 ATOMIC_INCL(frstats[fin->fin_out].fr_nfr);
243 int ipfr_nat_newfrag(ip, fin, nat)
251 if ((ip->ip_v != 4) || (fr_frag_lock))
256 if ((off + fin->fin_dlen) > 0xffff || (fin->fin_dlen == 0))
259 WRITE_ENTER(&ipf_natfrag);
260 ipf = ipfr_new(ip, fin, ipfr_nattab);
262 ipf->ipfr_data = nat;
265 RWLOCK_EXIT(&ipf_natfrag);
271 * check the fragment cache to see if there is already a record of this packet
272 * with its filter result known.
274 static ipfr_t *ipfr_lookup(ip, fin, table)
283 * For fragments, we record protocol, packet id, TOS and both IP#'s
284 * (these should all be the same for all fragments of a packet).
286 * build up a hash value to index the table with.
288 frag.ipfr_p = ip->ip_p;
290 frag.ipfr_id = ip->ip_id;
292 frag.ipfr_tos = ip->ip_tos;
293 frag.ipfr_src.s_addr = ip->ip_src.s_addr;
294 idx += ip->ip_src.s_addr;
295 frag.ipfr_dst.s_addr = ip->ip_dst.s_addr;
296 idx += ip->ip_dst.s_addr;
297 frag.ipfr_ifp = fin->fin_ifp;
301 frag.ipfr_optmsk = fin->fin_fi.fi_optmsk & IPF_OPTCOPY;
302 frag.ipfr_secmsk = fin->fin_fi.fi_secmsk;
303 frag.ipfr_auth = fin->fin_fi.fi_auth;
306 * check the table, careful to only compare the right amount of data
308 for (f = table[idx]; f; f = f->ipfr_next)
309 if (!bcmp((char *)&frag.ipfr_src, (char *)&f->ipfr_src,
316 * XXX - We really need to be guarding against the
317 * retransmission of (src,dst,id,offset-range) here
318 * because a fragmented packet is never resent with
322 if (!off || (fin->fin_fl & FI_SHORT))
327 if (f != table[idx]) {
329 * move fragment info. to the top of the list
330 * to speed up searches.
332 if ((f->ipfr_prev->ipfr_next = f->ipfr_next))
333 f->ipfr_next->ipfr_prev = f->ipfr_prev;
334 f->ipfr_next = table[idx];
335 table[idx]->ipfr_prev = f;
339 atoff = off + (fin->fin_dlen >> 3);
341 * If we've follwed the fragments, and this is the
342 * last (in order), shrink expiration time.
344 if (off == f->ipfr_off) {
345 if (!(ip->ip_off & IP_MF))
350 ATOMIC_INCL(ipfr_stats.ifs_hits);
358 * functional interface for NAT lookups of the NAT fragment cache
360 nat_t *ipfr_nat_knownfrag(ip, fin)
368 if ((fin->fin_v != 4) || (fr_frag_lock))
373 if ((off + fin->fin_dlen) > 0xffff || (fin->fin_dlen == 0))
376 READ_ENTER(&ipf_natfrag);
377 ipf = ipfr_lookup(ip, fin, ipfr_nattab);
379 nat = ipf->ipfr_data;
381 * This is the last fragment for this packet.
383 if ((ipf->ipfr_ttl == 1) && (nat != NULL)) {
384 nat->nat_data = NULL;
385 ipf->ipfr_data = NULL;
389 RWLOCK_EXIT(&ipf_natfrag);
395 * functional interface for normal lookups of the fragment cache
397 frentry_t *ipfr_knownfrag(ip, fin)
405 if ((fin->fin_v != 4) || (fr_frag_lock))
410 if ((off + fin->fin_dlen) > 0xffff || (fin->fin_dlen == 0))
413 READ_ENTER(&ipf_frag);
414 fra = ipfr_lookup(ip, fin, ipfr_heads);
419 RWLOCK_EXIT(&ipf_frag);
425 * forget any references to this external object.
427 void ipfr_forget(nat)
433 WRITE_ENTER(&ipf_natfrag);
434 for (idx = IPFT_SIZE - 1; idx >= 0; idx--)
435 for (fr = ipfr_heads[idx]; fr; fr = fr->ipfr_next)
436 if (fr->ipfr_data == nat)
437 fr->ipfr_data = NULL;
439 RWLOCK_EXIT(&ipf_natfrag);
443 static void ipfr_delete(fra)
450 ATOMIC_DEC32(fr->fr_ref);
455 fra->ipfr_prev->ipfr_next = fra->ipfr_next;
457 fra->ipfr_next->ipfr_prev = fra->ipfr_prev;
463 * Free memory in use by fragment state info. kept.
471 WRITE_ENTER(&ipf_frag);
472 for (idx = IPFT_SIZE - 1; idx >= 0; idx--)
473 for (fp = &ipfr_heads[idx]; (fra = *fp); ) {
474 *fp = fra->ipfr_next;
477 RWLOCK_EXIT(&ipf_frag);
479 WRITE_ENTER(&ipf_nat);
480 WRITE_ENTER(&ipf_natfrag);
481 for (idx = IPFT_SIZE - 1; idx >= 0; idx--)
482 for (fp = &ipfr_nattab[idx]; (fra = *fp); ) {
483 *fp = fra->ipfr_next;
484 nat = fra->ipfr_data;
486 if (nat->nat_data == fra)
487 nat->nat_data = NULL;
491 RWLOCK_EXIT(&ipf_natfrag);
492 RWLOCK_EXIT(&ipf_nat);
496 void ipfr_fragexpire()
511 WRITE_ENTER(&ipf_frag);
514 * Go through the entire table, looking for entries to expire,
515 * decreasing the ttl by one for each entry. If it reaches 0,
516 * remove it from the chain and free it.
518 for (idx = IPFT_SIZE - 1; idx >= 0; idx--)
519 for (fp = &ipfr_heads[idx]; (fra = *fp); ) {
521 if (fra->ipfr_ttl == 0) {
522 *fp = fra->ipfr_next;
524 ATOMIC_INCL(ipfr_stats.ifs_expire);
525 ATOMIC_DEC32(ipfr_inuse);
527 fp = &fra->ipfr_next;
529 RWLOCK_EXIT(&ipf_frag);
532 * Same again for the NAT table, except that if the structure also
533 * still points to a NAT structure, and the NAT structure points back
534 * at the one to be free'd, NULL the reference from the NAT struct.
535 * NOTE: We need to grab both mutex's early, and in this order so as
536 * to prevent a deadlock if both try to expire at the same time.
538 WRITE_ENTER(&ipf_nat);
539 WRITE_ENTER(&ipf_natfrag);
540 for (idx = IPFT_SIZE - 1; idx >= 0; idx--)
541 for (fp = &ipfr_nattab[idx]; (fra = *fp); ) {
543 if (fra->ipfr_ttl == 0) {
544 ATOMIC_INCL(ipfr_stats.ifs_expire);
545 ATOMIC_DEC32(ipfr_inuse);
546 nat = fra->ipfr_data;
548 if (nat->nat_data == fra)
549 nat->nat_data = NULL;
551 *fp = fra->ipfr_next;
554 fp = &fra->ipfr_next;
556 RWLOCK_EXIT(&ipf_natfrag);
557 RWLOCK_EXIT(&ipf_nat);
563 * Slowly expire held state for fragments. Timeouts are set * in expectation
564 * of this being called twice per second.
567 # if (BSD >= 199306) || SOLARIS || defined(__sgi)
568 # if defined(SOLARIS2) && (SOLARIS2 < 7)
569 void ipfr_slowtimer()
571 void ipfr_slowtimer __P((void *ptr))
577 void ipfr_slowtimer()
580 #if defined(_KERNEL) && SOLARIS
581 extern int fr_running;
585 READ_ENTER(&ipf_solaris);
588 #if defined(__sgi) && defined(_KERNEL)
589 ipfilter_sgi_intfsync();
598 ipfr_timer_id = timeout(ipfr_slowtimer, NULL, drv_usectohz(500000));
599 RWLOCK_EXIT(&ipf_solaris);
601 # if defined(__NetBSD__) && (__NetBSD_Version__ >= 104240000)
602 callout_reset(&ipfr_slowtimer_ch, hz / 2, ipfr_slowtimer, NULL);
604 # if (__FreeBSD_version >= 300000)
605 ipfr_slowtimer_ch = timeout(ipfr_slowtimer, NULL, hz/2);
607 # if defined(__OpenBSD__)
608 timeout_add(&ipfr_slowtimer_ch, hz/2);
610 timeout(ipfr_slowtimer, NULL, hz/2);
613 # if (BSD < 199306) && !defined(__sgi)
615 # endif /* FreeBSD */
617 # endif /* SOLARIS */
618 #endif /* defined(_KERNEL) */