xref: /netbsd-src/sys/external/bsd/ipf/netinet/ip_frag.c (revision 796c32c94f6e154afc9de0f63da35c91bb739b45)
1 /*	$NetBSD: ip_frag.c,v 1.5 2017/04/23 19:09:29 christos Exp $	*/
2 
3 /*
4  * Copyright (C) 2012 by Darren Reed.
5  *
6  * See the IPFILTER.LICENCE file for details on licencing.
7  */
8 #if defined(KERNEL) || defined(_KERNEL)
9 # undef KERNEL
10 # undef _KERNEL
11 # define        KERNEL	1
12 # define        _KERNEL	1
13 #endif
14 #include <sys/errno.h>
15 #include <sys/types.h>
16 #include <sys/param.h>
17 #include <sys/time.h>
18 #include <sys/file.h>
19 #ifdef __hpux
20 # include <sys/timeout.h>
21 #endif
22 #if !defined(_KERNEL)
23 # include <stdio.h>
24 # include <string.h>
25 # include <stdlib.h>
26 # define _KERNEL
27 # ifdef __OpenBSD__
28 struct file;
29 # endif
30 # include <sys/uio.h>
31 # undef _KERNEL
32 #endif
33 #if defined(_KERNEL) && \
34     defined(__FreeBSD_version) && (__FreeBSD_version >= 220000)
35 # include <sys/filio.h>
36 # include <sys/fcntl.h>
37 #else
38 # include <sys/ioctl.h>
39 #endif
40 #if !defined(linux)
41 # include <sys/protosw.h>
42 #endif
43 #include <sys/socket.h>
44 #if defined(_KERNEL)
45 # include <sys/systm.h>
46 # if !defined(__SVR4) && !defined(__svr4__)
47 #  include <sys/mbuf.h>
48 # endif
49 #endif
50 #if !defined(__SVR4) && !defined(__svr4__)
51 # if defined(_KERNEL) && !defined(__sgi) && !defined(AIX)
52 #  include <sys/kernel.h>
53 # endif
54 #else
55 # include <sys/byteorder.h>
56 # ifdef _KERNEL
57 #  include <sys/dditypes.h>
58 # endif
59 # include <sys/stream.h>
60 # include <sys/kmem.h>
61 #endif
62 #include <net/if.h>
63 #ifdef sun
64 # include <net/af.h>
65 #endif
66 #include <netinet/in.h>
67 #include <netinet/in_systm.h>
68 #include <netinet/ip.h>
69 #if !defined(linux)
70 # include <netinet/ip_var.h>
71 #endif
72 #include <netinet/tcp.h>
73 #include <netinet/udp.h>
74 #include <netinet/ip_icmp.h>
75 #include "netinet/ip_compat.h"
76 #include <netinet/tcpip.h>
77 #include "netinet/ip_fil.h"
78 #include "netinet/ip_nat.h"
79 #include "netinet/ip_frag.h"
80 #include "netinet/ip_state.h"
81 #include "netinet/ip_auth.h"
82 #include "netinet/ip_lookup.h"
83 #include "netinet/ip_proxy.h"
84 #include "netinet/ip_sync.h"
85 /* END OF INCLUDES */
86 
87 #if !defined(lint)
88 #if defined(__NetBSD__)
89 #include <sys/cdefs.h>
90 __KERNEL_RCSID(0, "$NetBSD: ip_frag.c,v 1.5 2017/04/23 19:09:29 christos Exp $");
91 #else
92 static const char sccsid[] = "@(#)ip_frag.c	1.11 3/24/96 (C) 1993-2000 Darren Reed";
93 static const char rcsid[] = "@(#)Id: ip_frag.c,v 1.1.1.2 2012/07/22 13:45:17 darrenr Exp";
94 #endif
95 #endif
96 
97 
98 typedef struct ipf_frag_softc_s  {
99 	ipfrwlock_t	ipfr_ipidfrag;
100 	ipfrwlock_t	ipfr_frag;
101 	ipfrwlock_t	ipfr_natfrag;
102 	int		ipfr_size;
103 	int		ipfr_ttl;
104 	int		ipfr_lock;
105 	int		ipfr_inited;
106 	ipfr_t		*ipfr_list;
107 	ipfr_t		**ipfr_tail;
108 	ipfr_t		*ipfr_natlist;
109 	ipfr_t		**ipfr_nattail;
110 	ipfr_t		*ipfr_ipidlist;
111 	ipfr_t		**ipfr_ipidtail;
112 	ipfr_t		**ipfr_heads;
113 	ipfr_t		**ipfr_nattab;
114 	ipfr_t		**ipfr_ipidtab;
115 	ipfrstat_t	ipfr_stats;
116 } ipf_frag_softc_t;
117 
118 
119 #ifdef USE_MUTEXES
120 static ipfr_t *ipfr_frag_new(ipf_main_softc_t *, ipf_frag_softc_t *,
121 				  fr_info_t *, u_32_t, ipfr_t **,
122 				  ipfrwlock_t *);
123 static ipfr_t *ipf_frag_lookup(ipf_main_softc_t *, ipf_frag_softc_t *, fr_info_t *, ipfr_t **, ipfrwlock_t *);
124 static void ipf_frag_deref(void *, ipfr_t **, ipfrwlock_t *);
125 static int ipf_frag_next(ipf_main_softc_t *, ipftoken_t *, ipfgeniter_t *,
126 			      ipfr_t **, ipfrwlock_t *);
127 #else
128 static ipfr_t *ipfr_frag_new(ipf_main_softc_t *, ipf_frag_softc_t *,
129 				  fr_info_t *, u_32_t, ipfr_t **);
130 static ipfr_t *ipf_frag_lookup(ipf_main_softc_t *, ipf_frag_softc_t *, fr_info_t *, ipfr_t **);
131 static void ipf_frag_deref(void *, ipfr_t **);
132 static int ipf_frag_next(ipf_main_softc_t *, ipftoken_t *, ipfgeniter_t *,
133 			      ipfr_t **);
134 #endif
135 static void ipf_frag_delete(ipf_main_softc_t *, ipfr_t *, ipfr_t ***);
136 static void ipf_frag_free(ipf_frag_softc_t *, ipfr_t *);
137 
138 static frentry_t ipfr_block;
139 
140 ipftuneable_t ipf_tuneables[] = {
141 	{ { (void *)offsetof(ipf_frag_softc_t, ipfr_size) },
142 		"frag_size",		1,	0x7fffffff,
143 		stsizeof(ipf_frag_softc_t, ipfr_size),
144 		IPFT_WRDISABLED,	NULL,	NULL },
145 	{ { (void *)offsetof(ipf_frag_softc_t, ipfr_ttl) },
146 		"frag_ttl",		1,	0x7fffffff,
147 		stsizeof(ipf_frag_softc_t, ipfr_ttl),
148 		0,			NULL,	NULL },
149 	{ { NULL },
150 		NULL,			0,	0,
151 		0,
152 		0,			NULL,	NULL }
153 };
154 
155 #define	FBUMP(x)	softf->ipfr_stats.x++
156 #define	FBUMPD(x)	do { softf->ipfr_stats.x++; DT(x); } while (0)
157 
158 
159 /* ------------------------------------------------------------------------ */
160 /* Function:    ipf_frag_main_load                                          */
161 /* Returns:     int - 0 == success, -1 == error                             */
162 /* Parameters:  Nil                                                         */
163 /*                                                                          */
164 /* Initialise the filter rule associted with blocked packets - everyone can */
165 /* use it.                                                                  */
166 /* ------------------------------------------------------------------------ */
167 int
168 ipf_frag_main_load(void)
169 {
170 	bzero((char *)&ipfr_block, sizeof(ipfr_block));
171 	ipfr_block.fr_flags = FR_BLOCK|FR_QUICK;
172 	ipfr_block.fr_ref = 1;
173 
174 	return 0;
175 }
176 
177 
178 /* ------------------------------------------------------------------------ */
179 /* Function:    ipf_frag_main_unload                                        */
180 /* Returns:     int - 0 == success, -1 == error                             */
181 /* Parameters:  Nil                                                         */
182 /*                                                                          */
183 /* A null-op function that exists as a placeholder so that the flow in      */
184 /* other functions is obvious.                                              */
185 /* ------------------------------------------------------------------------ */
186 int
187 ipf_frag_main_unload(void)
188 {
189 	return 0;
190 }
191 
192 
193 /* ------------------------------------------------------------------------ */
194 /* Function:    ipf_frag_soft_create                                        */
195 /* Returns:     void *   - NULL = failure, else pointer to local context    */
196 /* Parameters:  softc(I) - pointer to soft context main structure           */
197 /*                                                                          */
198 /* Allocate a new soft context structure to track fragment related info.    */
199 /* ------------------------------------------------------------------------ */
200 /*ARGSUSED*/
201 void *
202 ipf_frag_soft_create(ipf_main_softc_t *softc)
203 {
204 	ipf_frag_softc_t *softf;
205 
206 	KMALLOC(softf, ipf_frag_softc_t *);
207 	if (softf == NULL)
208 		return NULL;
209 
210 	bzero((char *)softf, sizeof(*softf));
211 
212 	RWLOCK_INIT(&softf->ipfr_ipidfrag, "frag ipid lock");
213 	RWLOCK_INIT(&softf->ipfr_frag, "ipf fragment rwlock");
214 	RWLOCK_INIT(&softf->ipfr_natfrag, "ipf NAT fragment rwlock");
215 
216 	softf->ipfr_size = IPFT_SIZE;
217 	softf->ipfr_ttl = IPF_TTLVAL(60);
218 	softf->ipfr_lock = 1;
219 	softf->ipfr_tail = &softf->ipfr_list;
220 	softf->ipfr_nattail = &softf->ipfr_natlist;
221 	softf->ipfr_ipidtail = &softf->ipfr_ipidlist;
222 
223 	return softf;
224 }
225 
226 
227 /* ------------------------------------------------------------------------ */
228 /* Function:    ipf_frag_soft_destroy                                       */
229 /* Returns:     Nil                                                         */
230 /* Parameters:  softc(I) - pointer to soft context main structure           */
231 /*              arg(I)   - pointer to local context to use                  */
232 /*                                                                          */
233 /* Initialise the hash tables for the fragment cache lookups.               */
234 /* ------------------------------------------------------------------------ */
235 void
236 ipf_frag_soft_destroy(ipf_main_softc_t *softc, void *arg)
237 {
238 	ipf_frag_softc_t *softf = arg;
239 
240 	RW_DESTROY(&softf->ipfr_ipidfrag);
241 	RW_DESTROY(&softf->ipfr_frag);
242 	RW_DESTROY(&softf->ipfr_natfrag);
243 
244 	KFREE(softf);
245 }
246 
247 
248 /* ------------------------------------------------------------------------ */
249 /* Function:    ipf_frag_soft_init                                          */
250 /* Returns:     int      - 0 == success, -1 == error                        */
251 /* Parameters:  softc(I) - pointer to soft context main structure           */
252 /*              arg(I)   - pointer to local context to use                  */
253 /*                                                                          */
254 /* Initialise the hash tables for the fragment cache lookups.               */
255 /* ------------------------------------------------------------------------ */
256 /*ARGSUSED*/
257 int
258 ipf_frag_soft_init(ipf_main_softc_t *softc, void *arg)
259 {
260 	ipf_frag_softc_t *softf = arg;
261 
262 	KMALLOCS(softf->ipfr_heads, ipfr_t **,
263 		 softf->ipfr_size * sizeof(ipfr_t *));
264 	if (softf->ipfr_heads == NULL)
265 		return -1;
266 
267 	bzero((char *)softf->ipfr_heads, softf->ipfr_size * sizeof(ipfr_t *));
268 
269 	KMALLOCS(softf->ipfr_nattab, ipfr_t **,
270 		 softf->ipfr_size * sizeof(ipfr_t *));
271 	if (softf->ipfr_nattab == NULL)
272 		return -2;
273 
274 	bzero((char *)softf->ipfr_nattab, softf->ipfr_size * sizeof(ipfr_t *));
275 
276 	KMALLOCS(softf->ipfr_ipidtab, ipfr_t **,
277 		 softf->ipfr_size * sizeof(ipfr_t *));
278 	if (softf->ipfr_ipidtab == NULL)
279 		return -3;
280 
281 	bzero((char *)softf->ipfr_ipidtab,
282 	      softf->ipfr_size * sizeof(ipfr_t *));
283 
284 	softf->ipfr_lock = 0;
285 	softf->ipfr_inited = 1;
286 
287 	return 0;
288 }
289 
290 
291 /* ------------------------------------------------------------------------ */
292 /* Function:    ipf_frag_soft_fini                                          */
293 /* Returns:     int      - 0 == success, -1 == error                        */
294 /* Parameters:  softc(I) - pointer to soft context main structure           */
295 /*              arg(I)   - pointer to local context to use                  */
296 /*                                                                          */
297 /* Free all memory allocated whilst running and from initialisation.        */
298 /* ------------------------------------------------------------------------ */
299 int
300 ipf_frag_soft_fini(ipf_main_softc_t *softc, void *arg)
301 {
302 	ipf_frag_softc_t *softf = arg;
303 
304 	softf->ipfr_lock = 1;
305 
306 	if (softf->ipfr_inited == 1) {
307 		ipf_frag_clear(softc);
308 
309 		softf->ipfr_inited = 0;
310 	}
311 
312 	if (softf->ipfr_heads != NULL)
313 		KFREES(softf->ipfr_heads,
314 		       softf->ipfr_size * sizeof(ipfr_t *));
315 	softf->ipfr_heads = NULL;
316 
317 	if (softf->ipfr_nattab != NULL)
318 		KFREES(softf->ipfr_nattab,
319 		       softf->ipfr_size * sizeof(ipfr_t *));
320 	softf->ipfr_nattab = NULL;
321 
322 	if (softf->ipfr_ipidtab != NULL)
323 		KFREES(softf->ipfr_ipidtab,
324 		       softf->ipfr_size * sizeof(ipfr_t *));
325 	softf->ipfr_ipidtab = NULL;
326 
327 	return 0;
328 }
329 
330 
331 /* ------------------------------------------------------------------------ */
332 /* Function:    ipf_frag_set_lock                                           */
333 /* Returns:     Nil                                                         */
334 /* Parameters:  arg(I) - pointer to local context to use                    */
335 /*              tmp(I) - new value for lock                                 */
336 /*                                                                          */
337 /* Stub function that allows for external manipulation of ipfr_lock         */
338 /* ------------------------------------------------------------------------ */
339 void
340 ipf_frag_setlock(void *arg, int tmp)
341 {
342 	ipf_frag_softc_t *softf = arg;
343 
344 	softf->ipfr_lock = tmp;
345 }
346 
347 
348 /* ------------------------------------------------------------------------ */
349 /* Function:    ipf_frag_stats                                              */
350 /* Returns:     ipfrstat_t* - pointer to struct with current frag stats     */
351 /* Parameters:  arg(I) - pointer to local context to use                    */
352 /*                                                                          */
353 /* Updates ipfr_stats with current information and returns a pointer to it  */
354 /* ------------------------------------------------------------------------ */
355 ipfrstat_t *
356 ipf_frag_stats(void *arg)
357 {
358 	ipf_frag_softc_t *softf = arg;
359 
360 	softf->ipfr_stats.ifs_table = softf->ipfr_heads;
361 	softf->ipfr_stats.ifs_nattab = softf->ipfr_nattab;
362 	return &softf->ipfr_stats;
363 }
364 
365 
366 /* ------------------------------------------------------------------------ */
367 /* Function:    ipfr_frag_new                                               */
368 /* Returns:     ipfr_t * - pointer to fragment cache state info or NULL     */
369 /* Parameters:  fin(I)   - pointer to packet information                    */
370 /*              table(I) - pointer to frag table to add to                  */
371 /*              lock(I)  - pointer to lock to get a write hold of           */
372 /*                                                                          */
373 /* Add a new entry to the fragment cache, registering it as having come     */
374 /* through this box, with the result of the filter operation.               */
375 /*                                                                          */
376 /* If this function succeeds, it returns with a write lock held on "lock".  */
377 /* If it fails, no lock is held on return.                                  */
378 /* ------------------------------------------------------------------------ */
379 static ipfr_t *
380 ipfr_frag_new(
381     ipf_main_softc_t *softc,
382     ipf_frag_softc_t *softf,
383     fr_info_t *fin,
384     u_32_t pass,
385     ipfr_t *table[]
386 #ifdef USE_MUTEXES
387     , ipfrwlock_t *lock
388 #endif
389 )
390 {
391 	ipfr_t *fra, frag, *fran;
392 	u_int idx, off;
393 	frentry_t *fr;
394 
395 	if (softf->ipfr_stats.ifs_inuse >= softf->ipfr_size) {
396 		FBUMPD(ifs_maximum);
397 		return NULL;
398 	}
399 
400 	if ((fin->fin_flx & (FI_FRAG|FI_BAD)) != FI_FRAG) {
401 		FBUMPD(ifs_newbad);
402 		return NULL;
403 	}
404 
405 	if (pass & FR_FRSTRICT) {
406 		if (fin->fin_off != 0) {
407 			FBUMPD(ifs_newrestrictnot0);
408 			return NULL;
409 		}
410 	}
411 
412 	frag.ipfr_v = fin->fin_v;
413 	idx = fin->fin_v;
414 	frag.ipfr_p = fin->fin_p;
415 	idx += fin->fin_p;
416 	frag.ipfr_id = fin->fin_id;
417 	idx += fin->fin_id;
418 	frag.ipfr_source = fin->fin_fi.fi_src;
419 	idx += frag.ipfr_src.s_addr;
420 	frag.ipfr_dest = fin->fin_fi.fi_dst;
421 	idx += frag.ipfr_dst.s_addr;
422 	frag.ipfr_ifp = fin->fin_ifp;
423 	idx *= 127;
424 	idx %= softf->ipfr_size;
425 
426 	frag.ipfr_optmsk = fin->fin_fi.fi_optmsk & IPF_OPTCOPY;
427 	frag.ipfr_secmsk = fin->fin_fi.fi_secmsk;
428 	frag.ipfr_auth = fin->fin_fi.fi_auth;
429 
430 	off = fin->fin_off >> 3;
431 	if (off == 0) {
432 		char *ptr;
433 		int end;
434 
435 #ifdef USE_INET6
436 		if (fin->fin_v == 6) {
437 
438 			ptr = (char *)fin->fin_fraghdr +
439 			      sizeof(struct ip6_frag);
440 		} else
441 #endif
442 		{
443 			ptr = fin->fin_dp;
444 		}
445 		end = fin->fin_plen - (ptr - (char *)fin->fin_ip);
446 		frag.ipfr_firstend = end >> 3;
447 	} else {
448 		frag.ipfr_firstend = 0;
449 	}
450 
451 	/*
452 	 * allocate some memory, if possible, if not, just record that we
453 	 * failed to do so.
454 	 */
455 	KMALLOC(fran, ipfr_t *);
456 	if (fran == NULL) {
457 		FBUMPD(ifs_nomem);
458 		return NULL;
459 	}
460 
461 	WRITE_ENTER(lock);
462 
463 	/*
464 	 * first, make sure it isn't already there...
465 	 */
466 	for (fra = table[idx]; (fra != NULL); fra = fra->ipfr_hnext)
467 		if (!bcmp((char *)&frag.ipfr_ifp, (char *)&fra->ipfr_ifp,
468 			  IPFR_CMPSZ)) {
469 			RWLOCK_EXIT(lock);
470 			FBUMPD(ifs_exists);
471 			KFREE(fran);
472 			return NULL;
473 		}
474 
475 	fra = fran;
476 	fran = NULL;
477 	fr = fin->fin_fr;
478 	fra->ipfr_rule = fr;
479 	if (fr != NULL) {
480 		MUTEX_ENTER(&fr->fr_lock);
481 		fr->fr_ref++;
482 		MUTEX_EXIT(&fr->fr_lock);
483 	}
484 
485 	/*
486 	 * Insert the fragment into the fragment table, copy the struct used
487 	 * in the search using bcopy rather than reassign each field.
488 	 * Set the ttl to the default.
489 	 */
490 	if ((fra->ipfr_hnext = table[idx]) != NULL)
491 		table[idx]->ipfr_hprev = &fra->ipfr_hnext;
492 	fra->ipfr_hprev = table + idx;
493 	fra->ipfr_data = NULL;
494 	table[idx] = fra;
495 	bcopy((char *)&frag.ipfr_ifp, (char *)&fra->ipfr_ifp, IPFR_CMPSZ);
496 	fra->ipfr_v = fin->fin_v;
497 	fra->ipfr_ttl = softc->ipf_ticks + softf->ipfr_ttl;
498 	fra->ipfr_firstend = frag.ipfr_firstend;
499 
500 	/*
501 	 * Compute the offset of the expected start of the next packet.
502 	 */
503 	if (off == 0)
504 		fra->ipfr_seen0 = 1;
505 	fra->ipfr_off = off + (fin->fin_dlen >> 3);
506 	fra->ipfr_pass = pass;
507 	fra->ipfr_ref = 1;
508 	fra->ipfr_pkts = 1;
509 	fra->ipfr_bytes = fin->fin_plen;
510 	FBUMP(ifs_inuse);
511 	FBUMP(ifs_new);
512 	return fra;
513 }
514 
515 
516 /* ------------------------------------------------------------------------ */
517 /* Function:    ipf_frag_new                                                */
518 /* Returns:     int - 0 == success, -1 == error                             */
519 /* Parameters:  fin(I)  - pointer to packet information                     */
520 /*                                                                          */
521 /* Add a new entry to the fragment cache table based on the current packet  */
522 /* ------------------------------------------------------------------------ */
523 int
524 ipf_frag_new(ipf_main_softc_t *softc, fr_info_t *fin, u_32_t pass)
525 {
526 	ipf_frag_softc_t *softf = softc->ipf_frag_soft;
527 	ipfr_t	*fra;
528 
529 	if (softf->ipfr_lock != 0)
530 		return -1;
531 
532 #ifdef USE_MUTEXES
533 	fra = ipfr_frag_new(softc, softf, fin, pass, softf->ipfr_heads, &softc->ipf_frag);
534 #else
535 	fra = ipfr_frag_new(softc, softf, fin, pass, softf->ipfr_heads);
536 #endif
537 	if (fra != NULL) {
538 		*softf->ipfr_tail = fra;
539 		fra->ipfr_prev = softf->ipfr_tail;
540 		softf->ipfr_tail = &fra->ipfr_next;
541 		fra->ipfr_next = NULL;
542 		RWLOCK_EXIT(&softc->ipf_frag);
543 	}
544 	return fra ? 0 : -1;
545 }
546 
547 
548 /* ------------------------------------------------------------------------ */
549 /* Function:    ipf_frag_natnew                                             */
550 /* Returns:     int - 0 == success, -1 == error                             */
551 /* Parameters:  fin(I)  - pointer to packet information                     */
552 /*              nat(I)  - pointer to NAT structure                          */
553 /*                                                                          */
554 /* Create a new NAT fragment cache entry based on the current packet and    */
555 /* the NAT structure for this "session".                                    */
556 /* ------------------------------------------------------------------------ */
557 int
558 ipf_frag_natnew(ipf_main_softc_t *softc, fr_info_t *fin, u_32_t pass,
559     nat_t *nat)
560 {
561 	ipf_frag_softc_t *softf = softc->ipf_frag_soft;
562 	ipfr_t	*fra;
563 
564 	if (softf->ipfr_lock != 0)
565 		return 0;
566 
567 #ifdef USE_MUTEXES
568 	fra = ipfr_frag_new(softc, softf, fin, pass, softf->ipfr_nattab,
569 			    &softf->ipfr_natfrag);
570 #else
571 	fra = ipfr_frag_new(softc, softf, fin, pass, softf->ipfr_nattab);
572 #endif
573 	if (fra != NULL) {
574 		fra->ipfr_data = nat;
575 		nat->nat_data = fra;
576 		*softf->ipfr_nattail = fra;
577 		fra->ipfr_prev = softf->ipfr_nattail;
578 		softf->ipfr_nattail = &fra->ipfr_next;
579 		fra->ipfr_next = NULL;
580 		RWLOCK_EXIT(&softf->ipfr_natfrag);
581 		return 0;
582 	}
583 	return -1;
584 }
585 
586 
587 /* ------------------------------------------------------------------------ */
588 /* Function:    ipf_frag_ipidnew                                            */
589 /* Returns:     int - 0 == success, -1 == error                             */
590 /* Parameters:  fin(I)  - pointer to packet information                     */
591 /*              ipid(I) - new IP ID for this fragmented packet              */
592 /*                                                                          */
593 /* Create a new fragment cache entry for this packet and store, as a data   */
594 /* pointer, the new IP ID value.                                            */
595 /* ------------------------------------------------------------------------ */
596 int
597 ipf_frag_ipidnew(fr_info_t *fin, u_32_t ipid)
598 {
599 	ipf_main_softc_t *softc = fin->fin_main_soft;
600 	ipf_frag_softc_t *softf = softc->ipf_frag_soft;
601 	ipfr_t	*fra;
602 
603 	if (softf->ipfr_lock)
604 		return 0;
605 
606 #ifdef USE_MUTEXES
607 	fra = ipfr_frag_new(softc, softf, fin, 0, softf->ipfr_ipidtab, &softf->ipfr_ipidfrag);
608 #else
609 	fra = ipfr_frag_new(softc, softf, fin, 0, softf->ipfr_ipidtab);
610 #endif
611 	if (fra != NULL) {
612 		fra->ipfr_data = (void *)(intptr_t)ipid;
613 		*softf->ipfr_ipidtail = fra;
614 		fra->ipfr_prev = softf->ipfr_ipidtail;
615 		softf->ipfr_ipidtail = &fra->ipfr_next;
616 		fra->ipfr_next = NULL;
617 		RWLOCK_EXIT(&softf->ipfr_ipidfrag);
618 	}
619 	return fra ? 0 : -1;
620 }
621 
622 
623 /* ------------------------------------------------------------------------ */
624 /* Function:    ipf_frag_lookup                                             */
625 /* Returns:     ipfr_t * - pointer to ipfr_t structure if there's a         */
626 /*                         matching entry in the frag table, else NULL      */
627 /* Parameters:  fin(I)   - pointer to packet information                    */
628 /*              table(I) - pointer to fragment cache table to search        */
629 /*                                                                          */
630 /* Check the fragment cache to see if there is already a record of this     */
631 /* packet with its filter result known.                                     */
632 /*                                                                          */
633 /* If this function succeeds, it returns with a write lock held on "lock".  */
634 /* If it fails, no lock is held on return.                                  */
635 /* ------------------------------------------------------------------------ */
636 static ipfr_t *
637 ipf_frag_lookup(
638     ipf_main_softc_t *softc,
639     ipf_frag_softc_t *softf,
640     fr_info_t *fin,
641     ipfr_t *table[]
642 #ifdef USE_MUTEXES
643     , ipfrwlock_t *lock
644 #endif
645 )
646 {
647 	ipfr_t *f, frag;
648 	u_int idx;
649 
650 	/*
651 	 * We don't want to let short packets match because they could be
652 	 * compromising the security of other rules that want to match on
653 	 * layer 4 fields (and can't because they have been fragmented off.)
654 	 * Why do this check here?  The counter acts as an indicator of this
655 	 * kind of attack, whereas if it was elsewhere, it wouldn't know if
656 	 * other matching packets had been seen.
657 	 */
658 	if (fin->fin_flx & FI_SHORT) {
659 		FBUMPD(ifs_short);
660 		return NULL;
661 	}
662 
663 	if ((fin->fin_flx & FI_BAD) != 0) {
664 		FBUMPD(ifs_bad);
665 		return NULL;
666 	}
667 
668 	/*
669 	 * For fragments, we record protocol, packet id, TOS and both IP#'s
670 	 * (these should all be the same for all fragments of a packet).
671 	 *
672 	 * build up a hash value to index the table with.
673 	 */
674 	frag.ipfr_v = fin->fin_v;
675 	idx = fin->fin_v;
676 	frag.ipfr_p = fin->fin_p;
677 	idx += fin->fin_p;
678 	frag.ipfr_id = fin->fin_id;
679 	idx += fin->fin_id;
680 	frag.ipfr_source = fin->fin_fi.fi_src;
681 	idx += frag.ipfr_src.s_addr;
682 	frag.ipfr_dest = fin->fin_fi.fi_dst;
683 	idx += frag.ipfr_dst.s_addr;
684 	frag.ipfr_ifp = fin->fin_ifp;
685 	idx *= 127;
686 	idx %= softf->ipfr_size;
687 
688 	frag.ipfr_optmsk = fin->fin_fi.fi_optmsk & IPF_OPTCOPY;
689 	frag.ipfr_secmsk = fin->fin_fi.fi_secmsk;
690 	frag.ipfr_auth = fin->fin_fi.fi_auth;
691 
692 	READ_ENTER(lock);
693 
694 	/*
695 	 * check the table, careful to only compare the right amount of data
696 	 */
697 	for (f = table[idx]; f; f = f->ipfr_hnext) {
698 		if (!bcmp((char *)&frag.ipfr_ifp, (char *)&f->ipfr_ifp,
699 			  IPFR_CMPSZ)) {
700 			u_short	off;
701 
702 			/*
703 			 * XXX - We really need to be guarding against the
704 			 * retransmission of (src,dst,id,offset-range) here
705 			 * because a fragmented packet is never resent with
706 			 * the same IP ID# (or shouldn't).
707 			 */
708 			off = fin->fin_off >> 3;
709 			if (f->ipfr_seen0) {
710 				if (off == 0) {
711 					FBUMPD(ifs_retrans0);
712 					continue;
713 				}
714 
715 				/*
716 				 * Case 3. See comment for frpr_fragment6.
717 				 */
718 				if ((f->ipfr_firstend != 0) &&
719 				    (off < f->ipfr_firstend)) {
720 					FBUMP(ifs_overlap);
721 					DT2(ifs_overlap, u_short, off,
722 					    ipfr_t *, f);
723 					fin->fin_flx |= FI_BAD;
724 					break;
725 				}
726 			} else if (off == 0)
727 				f->ipfr_seen0 = 1;
728 
729 #if 0
730 			/* We can't do this, since we only have a read lock! */
731 			if (f != table[idx]) {
732 				ipfr_t **fp;
733 
734 				/*
735 				 * Move fragment info. to the top of the list
736 				 * to speed up searches.  First, delink...
737 				 */
738 				fp = f->ipfr_hprev;
739 				(*fp) = f->ipfr_hnext;
740 				if (f->ipfr_hnext != NULL)
741 					f->ipfr_hnext->ipfr_hprev = fp;
742 				/*
743 				 * Then put back at the top of the chain.
744 				 */
745 				f->ipfr_hnext = table[idx];
746 				table[idx]->ipfr_hprev = &f->ipfr_hnext;
747 				f->ipfr_hprev = table + idx;
748 				table[idx] = f;
749 			}
750 #endif
751 
752 			/*
753 			 * If we've followed the fragments, and this is the
754 			 * last (in order), shrink expiration time.
755 			 */
756 			if (off == f->ipfr_off) {
757 				f->ipfr_off = (fin->fin_dlen >> 3) + off;
758 
759 				/*
760 				 * Well, we could shrink the expiration time
761 				 * but only if every fragment has been seen
762 				 * in order upto this, the last. ipfr_badorder
763 				 * is used here to count those out of order
764 				 * and if it equals 0 when we get to the last
765 				 * fragment then we can assume all of the
766 				 * fragments have been seen and in order.
767 				 */
768 #if 0
769 				/*
770 				 * Doing this properly requires moving it to
771 				 * the head of the list which is infesible.
772 				 */
773 				if ((more == 0) && (f->ipfr_badorder == 0))
774 					f->ipfr_ttl = softc->ipf_ticks + 1;
775 #endif
776 			} else {
777 				f->ipfr_badorder++;
778 				FBUMPD(ifs_unordered);
779 				if (f->ipfr_pass & FR_FRSTRICT) {
780 					FBUMPD(ifs_strict);
781 					continue;
782 				}
783 			}
784 			f->ipfr_pkts++;
785 			f->ipfr_bytes += fin->fin_plen;
786 			FBUMP(ifs_hits);
787 			return f;
788 		}
789 	}
790 
791 	RWLOCK_EXIT(lock);
792 	FBUMP(ifs_miss);
793 	return NULL;
794 }
795 
796 
797 /* ------------------------------------------------------------------------ */
798 /* Function:    ipf_frag_natknown                                           */
799 /* Returns:     nat_t* - pointer to 'parent' NAT structure if frag table    */
800 /*                       match found, else NULL                             */
801 /* Parameters:  fin(I)  - pointer to packet information                     */
802 /*                                                                          */
803 /* Functional interface for NAT lookups of the NAT fragment cache           */
804 /* ------------------------------------------------------------------------ */
805 nat_t *
806 ipf_frag_natknown(fr_info_t *fin)
807 {
808 	ipf_main_softc_t *softc = fin->fin_main_soft;
809 	ipf_frag_softc_t *softf = softc->ipf_frag_soft;
810 	nat_t	*nat;
811 	ipfr_t	*ipf;
812 
813 	if ((softf->ipfr_lock) || !softf->ipfr_natlist)
814 		return NULL;
815 #ifdef USE_MUTEXES
816 	ipf = ipf_frag_lookup(softc, softf, fin, softf->ipfr_nattab,
817 			      &softf->ipfr_natfrag);
818 #else
819 	ipf = ipf_frag_lookup(softc, softf, fin, softf->ipfr_nattab);
820 #endif
821 	if (ipf != NULL) {
822 		nat = ipf->ipfr_data;
823 		/*
824 		 * This is the last fragment for this packet.
825 		 */
826 		if ((ipf->ipfr_ttl == softc->ipf_ticks + 1) && (nat != NULL)) {
827 			nat->nat_data = NULL;
828 			ipf->ipfr_data = NULL;
829 		}
830 		RWLOCK_EXIT(&softf->ipfr_natfrag);
831 	} else
832 		nat = NULL;
833 	return nat;
834 }
835 
836 
837 /* ------------------------------------------------------------------------ */
838 /* Function:    ipf_frag_ipidknown                                          */
839 /* Returns:     u_32_t - IPv4 ID for this packet if match found, else       */
840 /*                       return 0xfffffff to indicate no match.             */
841 /* Parameters:  fin(I) - pointer to packet information                      */
842 /*                                                                          */
843 /* Functional interface for IP ID lookups of the IP ID fragment cache       */
844 /* ------------------------------------------------------------------------ */
845 u_32_t
846 ipf_frag_ipidknown(fr_info_t *fin)
847 {
848 	ipf_main_softc_t *softc = fin->fin_main_soft;
849 	ipf_frag_softc_t *softf = softc->ipf_frag_soft;
850 	ipfr_t	*ipf;
851 	u_32_t	id;
852 
853 	if (softf->ipfr_lock || !softf->ipfr_ipidlist)
854 		return 0xffffffff;
855 
856 #ifdef USE_MUTEXES
857 	ipf = ipf_frag_lookup(softc, softf, fin, softf->ipfr_ipidtab,
858 			      &softf->ipfr_ipidfrag);
859 #else
860 	ipf = ipf_frag_lookup(softc, softf, fin, softf->ipfr_ipidtab);
861 #endif
862 	if (ipf != NULL) {
863 		id = (u_32_t)(intptr_t)ipf->ipfr_data;
864 		RWLOCK_EXIT(&softf->ipfr_ipidfrag);
865 	} else
866 		id = 0xffffffff;
867 	return id;
868 }
869 
870 
871 /* ------------------------------------------------------------------------ */
872 /* Function:    ipf_frag_known                                              */
873 /* Returns:     frentry_t* - pointer to filter rule if a match is found in  */
874 /*                           the frag cache table, else NULL.               */
875 /* Parameters:  fin(I)   - pointer to packet information                    */
876 /*              passp(O) - pointer to where to store rule flags resturned   */
877 /*                                                                          */
878 /* Functional interface for normal lookups of the fragment cache.  If a     */
879 /* match is found, return the rule pointer and flags from the rule, except  */
880 /* that if FR_LOGFIRST is set, reset FR_LOG.                                */
881 /* ------------------------------------------------------------------------ */
882 frentry_t *
883 ipf_frag_known(fr_info_t *fin, u_32_t *passp)
884 {
885 	ipf_main_softc_t *softc = fin->fin_main_soft;
886 	ipf_frag_softc_t *softf = softc->ipf_frag_soft;
887 	frentry_t *fr = NULL;
888 	ipfr_t	*fra;
889 	u_32_t pass;
890 
891 	if ((softf->ipfr_lock) || (softf->ipfr_list == NULL))
892 		return NULL;
893 
894 #ifdef USE_MUTEXES
895 	fra = ipf_frag_lookup(softc, softf, fin, softf->ipfr_heads,
896 			      &softc->ipf_frag);
897 #else
898 	fra = ipf_frag_lookup(softc, softf, fin, softf->ipfr_heads);
899 #endif
900 	if (fra != NULL) {
901 		if (fin->fin_flx & FI_BAD) {
902 			fr = &ipfr_block;
903 			fin->fin_reason = FRB_BADFRAG;
904 		} else {
905 			fr = fra->ipfr_rule;
906 		}
907 		fin->fin_fr = fr;
908 		if (fr != NULL) {
909 			pass = fr->fr_flags;
910 			if ((pass & FR_KEEPSTATE) != 0) {
911 				fin->fin_flx |= FI_STATE;
912 				/*
913 				 * Reset the keep state flag here so that we
914 				 * don't try and add a new state entry because
915 				 * of a match here. That leads to blocking of
916 				 * the packet later because the add fails.
917 				 */
918 				pass &= ~FR_KEEPSTATE;
919 			}
920 			if ((pass & FR_LOGFIRST) != 0)
921 				pass &= ~(FR_LOGFIRST|FR_LOG);
922 			*passp = pass;
923 		}
924 		RWLOCK_EXIT(&softc->ipf_frag);
925 	}
926 	return fr;
927 }
928 
929 
930 /* ------------------------------------------------------------------------ */
931 /* Function:    ipf_frag_natforget                                          */
932 /* Returns:     Nil                                                         */
933 /* Parameters:  ptr(I) - pointer to data structure                          */
934 /*                                                                          */
935 /* Search through all of the fragment cache entries for NAT and wherever a  */
936 /* pointer  is found to match ptr, reset it to NULL.                        */
937 /* ------------------------------------------------------------------------ */
938 void
939 ipf_frag_natforget(ipf_main_softc_t *softc, void *ptr)
940 {
941 	ipf_frag_softc_t *softf = softc->ipf_frag_soft;
942 	ipfr_t	*fr;
943 
944 	WRITE_ENTER(&softf->ipfr_natfrag);
945 	for (fr = softf->ipfr_natlist; fr; fr = fr->ipfr_next)
946 		if (fr->ipfr_data == ptr)
947 			fr->ipfr_data = NULL;
948 	RWLOCK_EXIT(&softf->ipfr_natfrag);
949 }
950 
951 
952 /* ------------------------------------------------------------------------ */
953 /* Function:    ipf_frag_delete                                             */
954 /* Returns:     Nil                                                         */
955 /* Parameters:  fra(I)   - pointer to fragment structure to delete          */
956 /*              tail(IO) - pointer to the pointer to the tail of the frag   */
957 /*                         list                                             */
958 /*                                                                          */
959 /* Remove a fragment cache table entry from the table & list.  Also free    */
960 /* the filter rule it is associated with it if it is no longer used as a    */
961 /* result of decreasing the reference count.                                */
962 /* ------------------------------------------------------------------------ */
963 static void
964 ipf_frag_delete(ipf_main_softc_t *softc, ipfr_t *fra, ipfr_t ***tail)
965 {
966 	ipf_frag_softc_t *softf = softc->ipf_frag_soft;
967 
968 	if (fra->ipfr_next)
969 		fra->ipfr_next->ipfr_prev = fra->ipfr_prev;
970 	*fra->ipfr_prev = fra->ipfr_next;
971 	if (*tail == &fra->ipfr_next)
972 		*tail = fra->ipfr_prev;
973 
974 	if (fra->ipfr_hnext)
975 		fra->ipfr_hnext->ipfr_hprev = fra->ipfr_hprev;
976 	*fra->ipfr_hprev = fra->ipfr_hnext;
977 
978 	if (fra->ipfr_rule != NULL) {
979 		(void) ipf_derefrule(softc, &fra->ipfr_rule);
980 	}
981 
982 	if (fra->ipfr_ref <= 0)
983 		ipf_frag_free(softf, fra);
984 }
985 
986 
987 /* ------------------------------------------------------------------------ */
988 /* Function:    ipf_frag_free                                               */
989 /* Returns:     Nil                                                         */
990 /*                                                                          */
991 /* ------------------------------------------------------------------------ */
992 static void
993 ipf_frag_free(ipf_frag_softc_t *softf, ipfr_t *fra)
994 {
995 	KFREE(fra);
996 	FBUMP(ifs_expire);
997 	softf->ipfr_stats.ifs_inuse--;
998 }
999 
1000 
1001 /* ------------------------------------------------------------------------ */
1002 /* Function:    ipf_frag_clear                                              */
1003 /* Returns:     Nil                                                         */
1004 /* Parameters:  Nil                                                         */
1005 /*                                                                          */
1006 /* Free memory in use by fragment state information kept.  Do the normal    */
1007 /* fragment state stuff first and then the NAT-fragment table.              */
1008 /* ------------------------------------------------------------------------ */
1009 void
1010 ipf_frag_clear(ipf_main_softc_t *softc)
1011 {
1012 	ipf_frag_softc_t *softf = softc->ipf_frag_soft;
1013 	ipfr_t	*fra;
1014 	nat_t	*nat;
1015 
1016 	WRITE_ENTER(&softc->ipf_frag);
1017 	while ((fra = softf->ipfr_list) != NULL) {
1018 		fra->ipfr_ref--;
1019 		ipf_frag_delete(softc, fra, &softf->ipfr_tail);
1020 	}
1021 	softf->ipfr_tail = &softf->ipfr_list;
1022 	RWLOCK_EXIT(&softc->ipf_frag);
1023 
1024 	WRITE_ENTER(&softc->ipf_nat);
1025 	WRITE_ENTER(&softf->ipfr_natfrag);
1026 	while ((fra = softf->ipfr_natlist) != NULL) {
1027 		nat = fra->ipfr_data;
1028 		if (nat != NULL) {
1029 			if (nat->nat_data == fra)
1030 				nat->nat_data = NULL;
1031 		}
1032 		fra->ipfr_ref--;
1033 		ipf_frag_delete(softc, fra, &softf->ipfr_nattail);
1034 	}
1035 	softf->ipfr_nattail = &softf->ipfr_natlist;
1036 	RWLOCK_EXIT(&softf->ipfr_natfrag);
1037 	RWLOCK_EXIT(&softc->ipf_nat);
1038 }
1039 
1040 
1041 /* ------------------------------------------------------------------------ */
1042 /* Function:    ipf_frag_expire                                             */
1043 /* Returns:     Nil                                                         */
1044 /* Parameters:  Nil                                                         */
1045 /*                                                                          */
1046 /* Expire entries in the fragment cache table that have been there too long */
1047 /* ------------------------------------------------------------------------ */
1048 void
1049 ipf_frag_expire(ipf_main_softc_t *softc)
1050 {
1051 	ipf_frag_softc_t *softf = softc->ipf_frag_soft;
1052 	ipfr_t	**fp, *fra;
1053 	nat_t	*nat;
1054 	SPL_INT(s);
1055 
1056 	if (softf->ipfr_lock)
1057 		return;
1058 
1059 	SPL_NET(s);
1060 	WRITE_ENTER(&softc->ipf_frag);
1061 	/*
1062 	 * Go through the entire table, looking for entries to expire,
1063 	 * which is indicated by the ttl being less than or equal to ipf_ticks.
1064 	 */
1065 	for (fp = &softf->ipfr_list; ((fra = *fp) != NULL); ) {
1066 		if (fra->ipfr_ttl > softc->ipf_ticks)
1067 			break;
1068 		fra->ipfr_ref--;
1069 		ipf_frag_delete(softc, fra, &softf->ipfr_tail);
1070 	}
1071 	RWLOCK_EXIT(&softc->ipf_frag);
1072 
1073 	WRITE_ENTER(&softf->ipfr_ipidfrag);
1074 	for (fp = &softf->ipfr_ipidlist; ((fra = *fp) != NULL); ) {
1075 		if (fra->ipfr_ttl > softc->ipf_ticks)
1076 			break;
1077 		fra->ipfr_ref--;
1078 		ipf_frag_delete(softc, fra, &softf->ipfr_ipidtail);
1079 	}
1080 	RWLOCK_EXIT(&softf->ipfr_ipidfrag);
1081 
1082 	/*
1083 	 * Same again for the NAT table, except that if the structure also
1084 	 * still points to a NAT structure, and the NAT structure points back
1085 	 * at the one to be free'd, NULL the reference from the NAT struct.
1086 	 * NOTE: We need to grab both mutex's early, and in this order so as
1087 	 * to prevent a deadlock if both try to expire at the same time.
1088 	 * The extra if() statement here is because it locks out all NAT
1089 	 * operations - no need to do that if there are no entries in this
1090 	 * list, right?
1091 	 */
1092 	if (softf->ipfr_natlist != NULL) {
1093 		WRITE_ENTER(&softc->ipf_nat);
1094 		WRITE_ENTER(&softf->ipfr_natfrag);
1095 		for (fp = &softf->ipfr_natlist; ((fra = *fp) != NULL); ) {
1096 			if (fra->ipfr_ttl > softc->ipf_ticks)
1097 				break;
1098 			nat = fra->ipfr_data;
1099 			if (nat != NULL) {
1100 				if (nat->nat_data == fra)
1101 					nat->nat_data = NULL;
1102 			}
1103 			fra->ipfr_ref--;
1104 			ipf_frag_delete(softc, fra, &softf->ipfr_nattail);
1105 		}
1106 		RWLOCK_EXIT(&softf->ipfr_natfrag);
1107 		RWLOCK_EXIT(&softc->ipf_nat);
1108 	}
1109 	SPL_X(s);
1110 }
1111 
1112 
1113 /* ------------------------------------------------------------------------ */
1114 /* Function:    ipf_frag_pkt_next                                           */
1115 /* ------------------------------------------------------------------------ */
1116 int
1117 ipf_frag_pkt_next(ipf_main_softc_t *softc, ipftoken_t *token, ipfgeniter_t *itp)
1118 {
1119 	ipf_frag_softc_t *softf = softc->ipf_frag_soft;
1120 
1121 #ifdef USE_MUTEXES
1122 	return ipf_frag_next(softc, token, itp, &softf->ipfr_list,
1123 			     &softf->ipfr_frag);
1124 #else
1125 	return ipf_frag_next(softc, token, itp, &softf->ipfr_list);
1126 #endif
1127 }
1128 
1129 
1130 /* ------------------------------------------------------------------------ */
1131 /* Function:    ipf_frag_nat_next                                           */
1132 /* ------------------------------------------------------------------------ */
1133 int
1134 ipf_frag_nat_next(ipf_main_softc_t *softc, ipftoken_t *token, ipfgeniter_t *itp)
1135 {
1136 	ipf_frag_softc_t *softf = softc->ipf_frag_soft;;
1137 
1138 #ifdef USE_MUTEXES
1139 	return ipf_frag_next(softc, token, itp, &softf->ipfr_natlist,
1140 			     &softf->ipfr_natfrag);
1141 #else
1142 	return ipf_frag_next(softc, token, itp, &softf->ipfr_natlist);
1143 #endif
1144 }
1145 
1146 /* ------------------------------------------------------------------------ */
1147 /* Function:    ipf_frag_next                                               */
1148 /* Returns:     int      - 0 == success, else error                         */
1149 /* Parameters:  token(I) - pointer to token information for this caller     */
1150 /*              itp(I)   - pointer to generic iterator from caller          */
1151 /*              top(I)   - top of the fragment list                         */
1152 /*              lock(I)  - fragment cache lock                              */
1153 /*                                                                          */
1154 /* This function is used to interate through the list of entries in the     */
1155 /* fragment cache.  It increases the reference count on the one currently   */
1156 /* being returned so that the caller can come back and resume from it later.*/
1157 /*                                                                          */
1158 /* This function is used for both the NAT fragment cache as well as the ipf */
1159 /* fragment cache - hence the reason for passing in top and lock.           */
1160 /* ------------------------------------------------------------------------ */
1161 static int
1162 ipf_frag_next(
1163     ipf_main_softc_t *softc,
1164     ipftoken_t *token,
1165     ipfgeniter_t *itp,
1166     ipfr_t **top
1167 #ifdef USE_MUTEXES
1168     , ipfrwlock_t *lock
1169 #endif
1170 )
1171 {
1172 	ipfr_t *frag, *next, zero;
1173 	int error = 0;
1174 
1175 	if (itp->igi_data == NULL) {
1176 		IPFERROR(20001);
1177 		return EFAULT;
1178 	}
1179 
1180 	if (itp->igi_nitems != 1) {
1181 		IPFERROR(20003);
1182 		return EFAULT;
1183 	}
1184 
1185 	frag = token->ipt_data;
1186 
1187 	READ_ENTER(lock);
1188 
1189 	if (frag == NULL)
1190 		next = *top;
1191 	else
1192 		next = frag->ipfr_next;
1193 
1194 	if (next != NULL) {
1195 		ATOMIC_INC(next->ipfr_ref);
1196 		token->ipt_data = next;
1197 	} else {
1198 		bzero(&zero, sizeof(zero));
1199 		next = &zero;
1200 		token->ipt_data = NULL;
1201 	}
1202 	if (next->ipfr_next == NULL)
1203 		ipf_token_mark_complete(token);
1204 
1205 	RWLOCK_EXIT(lock);
1206 
1207 	error = COPYOUT(next, itp->igi_data, sizeof(*next));
1208 	if (error != 0)
1209 		IPFERROR(20002);
1210 
1211         if (frag != NULL) {
1212 #ifdef USE_MUTEXES
1213 		ipf_frag_deref(softc, &frag, lock);
1214 #else
1215 		ipf_frag_deref(softc, &frag);
1216 #endif
1217         }
1218         return error;
1219 }
1220 
1221 
1222 /* ------------------------------------------------------------------------ */
1223 /* Function:    ipf_frag_pkt_deref                                          */
1224 /* Returns:     Nil                                                         */
1225 /*                                                                          */
1226 /* ------------------------------------------------------------------------ */
1227 void
1228 ipf_frag_pkt_deref(ipf_main_softc_t *softc, void *data)
1229 {
1230 	ipfr_t **frp = data;
1231 
1232 #ifdef USE_MUTEXES
1233 	ipf_frag_softc_t *softf = softc->ipf_frag_soft;
1234 
1235 	ipf_frag_deref(softc->ipf_frag_soft, frp, &softf->ipfr_frag);
1236 #else
1237 	ipf_frag_deref(softc->ipf_frag_soft, frp);
1238 #endif
1239 }
1240 
1241 
1242 /* ------------------------------------------------------------------------ */
1243 /* Function:    ipf_frag_nat_deref                                          */
1244 /* Returns:     Nil                                                         */
1245 /*                                                                          */
1246 /* ------------------------------------------------------------------------ */
1247 void
1248 ipf_frag_nat_deref(ipf_main_softc_t *softc, void *data)
1249 {
1250 	ipfr_t **frp = data;
1251 
1252 #ifdef USE_MUTEXES
1253 	ipf_frag_softc_t *softf = softc->ipf_frag_soft;
1254 
1255 	ipf_frag_deref(softc->ipf_frag_soft, frp, &softf->ipfr_natfrag);
1256 #else
1257 	ipf_frag_deref(softc->ipf_frag_soft, frp);
1258 #endif
1259 }
1260 
1261 
1262 /* ------------------------------------------------------------------------ */
1263 /* Function:    ipf_frag_deref                                              */
1264 /* Returns:     Nil                                                         */
1265 /* Parameters:  frp(IO) - pointer to fragment structure to deference        */
1266 /*              lock(I) - lock associated with the fragment                 */
1267 /*                                                                          */
1268 /* This function dereferences a fragment structure (ipfr_t).  The pointer   */
1269 /* passed in will always be reset back to NULL, even if the structure is    */
1270 /* not freed, to enforce the notion that the caller is no longer entitled   */
1271 /* to use the pointer it is dropping the reference to.                      */
1272 /* ------------------------------------------------------------------------ */
1273 static void
1274 ipf_frag_deref(void *arg, ipfr_t **frp
1275 #ifdef USE_MUTEXES
1276     , ipfrwlock_t *lock
1277 #endif
1278 )
1279 {
1280 	ipf_frag_softc_t *softf = arg;
1281 	ipfr_t *fra;
1282 
1283 	fra = *frp;
1284 	*frp = NULL;
1285 
1286 	WRITE_ENTER(lock);
1287 	fra->ipfr_ref--;
1288 	if (fra->ipfr_ref <= 0)
1289 		ipf_frag_free(softf, fra);
1290 	RWLOCK_EXIT(lock);
1291 }
1292