2 * Copyright (C) 1993-2001 by Darren Reed.
4 * See the IPFILTER.LICENCE file for details on licencing.
6 * @(#)ip_frag.c 1.11 3/24/96 (C) 1993-2000 Darren Reed
7 * @(#)$Id: ip_frag.c,v 2.10.2.24 2002/08/28 12:41:04 darrenr Exp $
8 * $FreeBSD: src/sys/contrib/ipfilter/netinet/ip_frag.c,v 1.15.2.7 2004/07/04 09:24:38 darrenr Exp $
9 * $DragonFly: src/sys/contrib/ipfilter/netinet/ip_frag.c,v 1.7 2004/09/16 23:40:24 joerg Exp $
11 #if defined(KERNEL) && !defined(_KERNEL)
15 #if defined(__sgi) && (IRIX > 602)
16 # include <sys/ptimers.h>
18 #include <sys/errno.h>
19 #include <sys/types.h>
20 #include <sys/param.h>
23 #if !defined(_KERNEL) && !defined(KERNEL)
28 #if (defined(KERNEL) || defined(_KERNEL)) && (defined(__DragonFly__) || __FreeBSD_version >= 220000)
29 # include <sys/filio.h>
30 # include <sys/fcntl.h>
32 # include <sys/ioctl.h>
35 # include <sys/protosw.h>
37 #include <sys/socket.h>
38 #if defined(_KERNEL) && !defined(linux)
39 # include <sys/systm.h>
41 #if !defined(__SVR4) && !defined(__svr4__)
42 # if defined(_KERNEL) && !defined(__sgi)
43 # include <sys/kernel.h>
46 # include <sys/mbuf.h>
49 # include <sys/byteorder.h>
51 # include <sys/dditypes.h>
53 # include <sys/stream.h>
54 # include <sys/kmem.h>
60 #include <net/route.h>
61 #include <netinet/in.h>
62 #include <netinet/in_systm.h>
63 #include <netinet/ip.h>
65 # include <netinet/ip_var.h>
67 #include <netinet/tcp.h>
68 #include <netinet/udp.h>
69 #include <netinet/ip_icmp.h>
70 #include "ip_compat.h"
71 #include <netinet/tcpip.h>
77 #if defined(__DragonFly__) || __FreeBSD_version >= 300000
78 # include <sys/malloc.h>
79 # if (defined(KERNEL) || defined(_KERNEL))
81 # include <sys/libkern.h>
82 # include <sys/systm.h>
84 extern struct callout ipfr_slowtimer_ch;
87 #if defined(__NetBSD__) && (__NetBSD_Version__ >= 104230000)
88 # include <sys/callout.h>
89 extern struct callout ipfr_slowtimer_ch;
91 #if defined(__OpenBSD__)
92 # include <sys/timeout.h>
93 extern struct timeout ipfr_slowtimer_ch;
96 static const char sccsid[] = "@(#)ip_frag.c 1.11 3/24/96 (C) 1993-2000 Darren Reed";
98 static ipfr_t *ipfr_heads[IPFT_SIZE];
99 static ipfr_t *ipfr_nattab[IPFT_SIZE];
100 static ipfrstat_t ipfr_stats;
101 static int ipfr_inuse = 0;
103 int fr_ipfrttl = 120; /* 60 seconds */
104 int fr_frag_lock = 0;
108 extern timeout_id_t ipfr_timer_id;
110 extern int ipfr_timer_id;
113 #if (SOLARIS || defined(__sgi)) && defined(_KERNEL)
114 extern KRWLOCK_T ipf_frag, ipf_natfrag, ipf_nat, ipf_mutex;
116 extern KRWLOCK_T ipf_solaris;
118 KRWLOCK_T ipf_solaris;
120 extern kmutex_t ipf_rw;
124 static ipfr_t *ipfr_new (ip_t *, fr_info_t *, ipfr_t **);
125 static ipfr_t *ipfr_lookup (ip_t *, fr_info_t *, ipfr_t **);
126 static void ipfr_delete (ipfr_t *);
129 ipfrstat_t *ipfr_fragstats()
131 ipfr_stats.ifs_table = ipfr_heads;
132 ipfr_stats.ifs_nattab = ipfr_nattab;
133 ipfr_stats.ifs_inuse = ipfr_inuse;
139 * add a new entry to the fragment cache, registering it as having come
140 * through this box, with the result of the filter operation.
142 static ipfr_t *ipfr_new(ip, fin, table)
147 ipfr_t **fp, *fra, frag;
150 if (ipfr_inuse >= IPFT_SIZE)
153 if (!(fin->fin_fi.fi_fl & FI_FRAG))
156 frag.ipfr_p = ip->ip_p;
158 frag.ipfr_id = ip->ip_id;
160 frag.ipfr_tos = ip->ip_tos;
161 frag.ipfr_src.s_addr = ip->ip_src.s_addr;
162 idx += ip->ip_src.s_addr;
163 frag.ipfr_dst.s_addr = ip->ip_dst.s_addr;
164 idx += ip->ip_dst.s_addr;
165 frag.ipfr_ifp = fin->fin_ifp;
169 frag.ipfr_optmsk = fin->fin_fi.fi_optmsk & IPF_OPTCOPY;
170 frag.ipfr_secmsk = fin->fin_fi.fi_secmsk;
171 frag.ipfr_auth = fin->fin_fi.fi_auth;
174 * first, make sure it isn't already there...
176 for (fp = &table[idx]; (fra = *fp); fp = &fra->ipfr_next)
177 if (!bcmp((char *)&frag.ipfr_src, (char *)&fra->ipfr_src,
179 ATOMIC_INCL(ipfr_stats.ifs_exists);
184 * allocate some memory, if possible, if not, just record that we
187 KMALLOC(fra, ipfr_t *);
189 ATOMIC_INCL(ipfr_stats.ifs_nomem);
193 if ((fra->ipfr_rule = fin->fin_fr) != NULL) {
194 ATOMIC_INC32(fin->fin_fr->fr_ref);
199 * Insert the fragment into the fragment table, copy the struct used
200 * in the search using bcopy rather than reassign each field.
201 * Set the ttl to the default.
203 if ((fra->ipfr_next = table[idx]))
204 table[idx]->ipfr_prev = fra;
205 fra->ipfr_prev = NULL;
206 fra->ipfr_data = NULL;
208 bcopy((char *)&frag.ipfr_src, (char *)&fra->ipfr_src, IPFR_CMPSZ);
209 fra->ipfr_ttl = fr_ipfrttl;
211 * Compute the offset of the expected start of the next packet.
213 off = ip->ip_off & IP_OFFMASK;
216 fra->ipfr_off = off + (fin->fin_dlen >> 3);
217 ATOMIC_INCL(ipfr_stats.ifs_new);
218 ATOMIC_INC32(ipfr_inuse);
223 int ipfr_newfrag(ip, fin)
229 if ((ip->ip_v != 4) || (fr_frag_lock))
231 WRITE_ENTER(&ipf_frag);
232 ipf = ipfr_new(ip, fin, ipfr_heads);
233 RWLOCK_EXIT(&ipf_frag);
235 ATOMIC_INCL(frstats[fin->fin_out].fr_bnfr);
238 ATOMIC_INCL(frstats[fin->fin_out].fr_nfr);
243 int ipfr_nat_newfrag(ip, fin, nat)
251 if ((ip->ip_v != 4) || (fr_frag_lock))
256 if ((off + fin->fin_dlen) > 0xffff || (fin->fin_dlen == 0))
259 WRITE_ENTER(&ipf_natfrag);
260 ipf = ipfr_new(ip, fin, ipfr_nattab);
262 ipf->ipfr_data = nat;
265 RWLOCK_EXIT(&ipf_natfrag);
271 * check the fragment cache to see if there is already a record of this packet
272 * with its filter result known.
274 static ipfr_t *ipfr_lookup(ip, fin, table)
283 * For fragments, we record protocol, packet id, TOS and both IP#'s
284 * (these should all be the same for all fragments of a packet).
286 * build up a hash value to index the table with.
288 frag.ipfr_p = ip->ip_p;
290 frag.ipfr_id = ip->ip_id;
292 frag.ipfr_tos = ip->ip_tos;
293 frag.ipfr_src.s_addr = ip->ip_src.s_addr;
294 idx += ip->ip_src.s_addr;
295 frag.ipfr_dst.s_addr = ip->ip_dst.s_addr;
296 idx += ip->ip_dst.s_addr;
297 frag.ipfr_ifp = fin->fin_ifp;
301 frag.ipfr_optmsk = fin->fin_fi.fi_optmsk & IPF_OPTCOPY;
302 frag.ipfr_secmsk = fin->fin_fi.fi_secmsk;
303 frag.ipfr_auth = fin->fin_fi.fi_auth;
306 * check the table, careful to only compare the right amount of data
308 for (f = table[idx]; f; f = f->ipfr_next)
309 if (!bcmp((char *)&frag.ipfr_src, (char *)&f->ipfr_src,
316 * XXX - We really need to be guarding against the
317 * retransmission of (src,dst,id,offset-range) here
318 * because a fragmented packet is never resent with
322 if (!off || (fin->fin_fl & FI_SHORT))
327 if (f != table[idx]) {
329 * move fragment info. to the top of the list
330 * to speed up searches.
332 if ((f->ipfr_prev->ipfr_next = f->ipfr_next))
333 f->ipfr_next->ipfr_prev = f->ipfr_prev;
334 f->ipfr_next = table[idx];
335 table[idx]->ipfr_prev = f;
339 atoff = off + (fin->fin_dlen >> 3);
341 * If we've follwed the fragments, and this is the
342 * last (in order), shrink expiration time.
344 if (off == f->ipfr_off) {
345 if (!(ip->ip_off & IP_MF))
350 ATOMIC_INCL(ipfr_stats.ifs_hits);
358 * functional interface for NAT lookups of the NAT fragment cache
360 nat_t *ipfr_nat_knownfrag(ip, fin)
368 if ((fin->fin_v != 4) || (fr_frag_lock))
373 if ((off + fin->fin_dlen) > 0xffff || (fin->fin_dlen == 0))
376 READ_ENTER(&ipf_natfrag);
377 ipf = ipfr_lookup(ip, fin, ipfr_nattab);
379 nat = ipf->ipfr_data;
381 * This is the last fragment for this packet.
383 if ((ipf->ipfr_ttl == 1) && (nat != NULL)) {
384 nat->nat_data = NULL;
385 ipf->ipfr_data = NULL;
389 RWLOCK_EXIT(&ipf_natfrag);
395 * functional interface for normal lookups of the fragment cache
397 frentry_t *ipfr_knownfrag(ip, fin)
405 if ((fin->fin_v != 4) || (fr_frag_lock))
410 if ((off + fin->fin_dlen) > 0xffff || (fin->fin_dlen == 0))
413 READ_ENTER(&ipf_frag);
414 fra = ipfr_lookup(ip, fin, ipfr_heads);
419 RWLOCK_EXIT(&ipf_frag);
425 * forget any references to this external object.
427 void ipfr_forget(ptr)
433 WRITE_ENTER(&ipf_frag);
434 for (idx = IPFT_SIZE - 1; idx >= 0; idx--)
435 for (fr = ipfr_heads[idx]; fr; fr = fr->ipfr_next)
436 if (fr->ipfr_data == ptr)
437 fr->ipfr_data = NULL;
439 RWLOCK_EXIT(&ipf_frag);
444 * forget any references to this external object.
446 void ipfr_forgetnat(nat)
452 WRITE_ENTER(&ipf_natfrag);
453 for (idx = IPFT_SIZE - 1; idx >= 0; idx--)
454 for (fr = ipfr_nattab[idx]; fr; fr = fr->ipfr_next)
455 if (fr->ipfr_data == nat)
456 fr->ipfr_data = NULL;
458 RWLOCK_EXIT(&ipf_natfrag);
462 static void ipfr_delete(fra)
469 ATOMIC_DEC32(fr->fr_ref);
474 fra->ipfr_prev->ipfr_next = fra->ipfr_next;
476 fra->ipfr_next->ipfr_prev = fra->ipfr_prev;
482 * Free memory in use by fragment state info. kept.
490 WRITE_ENTER(&ipf_frag);
491 for (idx = IPFT_SIZE - 1; idx >= 0; idx--)
492 for (fp = &ipfr_heads[idx]; (fra = *fp); ) {
493 *fp = fra->ipfr_next;
496 RWLOCK_EXIT(&ipf_frag);
498 WRITE_ENTER(&ipf_nat);
499 WRITE_ENTER(&ipf_natfrag);
500 for (idx = IPFT_SIZE - 1; idx >= 0; idx--)
501 for (fp = &ipfr_nattab[idx]; (fra = *fp); ) {
502 *fp = fra->ipfr_next;
503 nat = fra->ipfr_data;
505 if (nat->nat_data == fra)
506 nat->nat_data = NULL;
510 RWLOCK_EXIT(&ipf_natfrag);
511 RWLOCK_EXIT(&ipf_nat);
515 void ipfr_fragexpire()
530 WRITE_ENTER(&ipf_frag);
533 * Go through the entire table, looking for entries to expire,
534 * decreasing the ttl by one for each entry. If it reaches 0,
535 * remove it from the chain and free it.
537 for (idx = IPFT_SIZE - 1; idx >= 0; idx--)
538 for (fp = &ipfr_heads[idx]; (fra = *fp); ) {
540 if (fra->ipfr_ttl == 0) {
541 *fp = fra->ipfr_next;
543 ATOMIC_INCL(ipfr_stats.ifs_expire);
544 ATOMIC_DEC32(ipfr_inuse);
546 fp = &fra->ipfr_next;
548 RWLOCK_EXIT(&ipf_frag);
551 * Same again for the NAT table, except that if the structure also
552 * still points to a NAT structure, and the NAT structure points back
553 * at the one to be free'd, NULL the reference from the NAT struct.
554 * NOTE: We need to grab both mutex's early, and in this order so as
555 * to prevent a deadlock if both try to expire at the same time.
557 WRITE_ENTER(&ipf_nat);
558 WRITE_ENTER(&ipf_natfrag);
559 for (idx = IPFT_SIZE - 1; idx >= 0; idx--)
560 for (fp = &ipfr_nattab[idx]; (fra = *fp); ) {
562 if (fra->ipfr_ttl == 0) {
563 ATOMIC_INCL(ipfr_stats.ifs_expire);
564 ATOMIC_DEC32(ipfr_inuse);
565 nat = fra->ipfr_data;
567 if (nat->nat_data == fra)
568 nat->nat_data = NULL;
570 *fp = fra->ipfr_next;
573 fp = &fra->ipfr_next;
575 RWLOCK_EXIT(&ipf_natfrag);
576 RWLOCK_EXIT(&ipf_nat);
582 * Slowly expire held state for fragments. Timeouts are set * in expectation
583 * of this being called twice per second.
586 # if (BSD >= 199306) || SOLARIS || defined(__sgi)
587 # if defined(SOLARIS2) && (SOLARIS2 < 7)
588 void ipfr_slowtimer()
590 void ipfr_slowtimer (void *ptr)
596 void ipfr_slowtimer()
599 #if defined(_KERNEL) && SOLARIS
600 extern int fr_running;
604 READ_ENTER(&ipf_solaris);
607 #if defined(__sgi) && defined(_KERNEL)
608 ipfilter_sgi_intfsync();
617 ipfr_timer_id = timeout(ipfr_slowtimer, NULL, drv_usectohz(500000));
618 RWLOCK_EXIT(&ipf_solaris);
620 # if defined(__NetBSD__) && (__NetBSD_Version__ >= 104240000)
621 callout_reset(&ipfr_slowtimer_ch, hz / 2, ipfr_slowtimer, NULL);
623 # if defined(__DragonFly__) || __FreeBSD_version >= 300000
624 callout_reset(&ipfr_slowtimer_ch, hz / 2, ipfr_slowtimer, NULL);
626 # if defined(__OpenBSD__)
627 timeout_add(&ipfr_slowtimer_ch, hz/2);
629 timeout(ipfr_slowtimer, NULL, hz/2);
632 # if (BSD < 199306) && !defined(__sgi)
634 # endif /* FreeBSD */
636 # endif /* SOLARIS */
637 #endif /* defined(_KERNEL) */