ipfilter/netinet/ip_state.c

924 	frentry_t *fr;
948 	fr = ips.ips_rule;
950 	if (fr == NULL) {
962 		KMALLOC(fr, frentry_t *);
963 		if (fr == NULL) {
968 		bcopy((char *)&ips.ips_fr, (char *)fr, sizeof(*fr));
969 		out = fr->fr_flags & FR_OUTQUE ? 1 : 0;
970 		isn->is_rule = fr;
971 		ips.ips_is.is_rule = fr;
972 		MUTEX_NUKE(&fr->fr_lock);
973 		MUTEX_INIT(&fr->fr_lock, "state filter rule lock");
978 		for (i = 0; i < FR_NUM(fr->fr_ifnames); i++) {
979 			if (fr->fr_ifnames[i] == -1) {
980 				fr->fr_ifas[i] = NULL;
983 			name = FR_NAME(fr, fr_ifnames[i]);
984 			fr->fr_ifas[i] = ipf_resolvenic(softc, name,
985 							fr->fr_family);
994 		fr->fr_ref = 0;
995 		fr->fr_dsize = 0;
996 		fr->fr_data = NULL;
997 		fr->fr_type = FR_T_NONE;
999 		(void) ipf_resolvedest(softc, fr->fr_names, &fr->fr_tifs[0],
1000 				fr->fr_family);
1001 		(void) ipf_resolvedest(softc, fr->fr_names, &fr->fr_tifs[1],
1002 				fr->fr_family);
1003 		(void) ipf_resolvedest(softc, fr->fr_names, &fr->fr_dif,
1004 				fr->fr_family);
1013 			MUTEX_DESTROY(&fr->fr_lock);
1014 			KFREE(fr);
1026 			if (is->is_rule == fr) {
1072 	frentry_t *fr;
1103 	fr = is->is_rule;
1104 	if (fr != NULL) {
1105 		if ((fr->fr_srctrack.ht_max_nodes != 0) &&
1106 		    (ipf_ht_node_add(softc, &fr->fr_srctrack,
1113 		MUTEX_ENTER(&fr->fr_lock);
1114 		fr->fr_ref++;
1115 		MUTEX_EXIT(&fr->fr_lock);
1116 		fr->fr_statecnt++;
1383 	frentry_t *fr;
1420 	 * fr it is possible that we could overflow.  The cost of overflowing
1426 	fr = fin->fin_fr;
1427 	if (fr != NULL) {
1429 		     softs->ipf_state_max) && (fr->fr_statemax == 0)) {
1433 		if ((fr->fr_statemax != 0) &&
1434 		    (fr->fr_statecnt >= fr->fr_statemax)) {
1441 	if (fr == NULL) {
1445 		pass = fr->fr_flags;
1692 	is->is_rule = fr;
1697 	if (fr != NULL) {
1700 		(void) strncpy(is->is_group, FR_NAME(fr, fr_group),
1702 		if (fr->fr_age[0] != 0) {
1705 						 fr->fr_age[0]);
1709 		if (fr->fr_age[1] != 0) {
1712 						 fr->fr_age[1]);
1717 		is->is_tag = fr->fr_logtag;
1785 	if (fr != NULL) {
1792 		    (fr->fr_ifnames[out << 1] != -1 &&
1793 		     fr->fr_names[fr->fr_ifnames[out << 1] + 0] == '-' &&
1794 		     fr->fr_names[fr->fr_ifnames[out << 1] + 1] == '\0')) {
1795 			is->is_ifp[out << 1] = fr->fr_ifas[0];
1797 				FR_NAME(fr, fr_ifnames[0]),
1798 				sizeof(fr->fr_ifnames[0]));
1805 		is->is_ifp[(out << 1) + 1] = fr->fr_ifas[1];
1806 		if (fr->fr_ifnames[1] != -1) {
1808 				FR_NAME(fr, fr_ifnames[1]),
1809 				sizeof(fr->fr_ifnames[1]));
1812 		is->is_ifp[(1 - out) << 1] = fr->fr_ifas[2];
1813 		if (fr->fr_ifnames[2] != -1) {
1815 				FR_NAME(fr, fr_ifnames[2]),
1816 				sizeof(fr->fr_ifnames[2]));
1819 		is->is_ifp[((1 - out) << 1) + 1] = fr->fr_ifas[3];
1820 		if (fr->fr_ifnames[3] != -1) {
1822 				FR_NAME(fr, fr_ifnames[3]),
1823 				sizeof(fr->fr_ifnames[3]));
1854 	fdp = &fr->fr_tifs[0];
1862 	fdp = &fr->fr_tifs[1];
1871 	fdp = &fr->fr_dif;
2907 	frentry_t *fr;
2913 	fr = is->is_rule;
2914 	if (fr != NULL && fr->fr_icmpgrp != NULL) {
2916 		fin->fin_fr = fr->fr_icmpgrp->fg_start;
3320 	frentry_t *fr;
3394 	fr = is->is_rule;
3395 	if (fr != NULL) {
3396 		if ((fin->fin_out == 0) && (fr->fr_nattag.ipt_num[0] != 0)) {
3402 			if (ipf_matchtag(&fr->fr_nattag, fin->fin_nattag)!=0) {
3408 		(void) strncpy(fin->fin_group, FR_NAME(fr, fr_group),
3410 		fin->fin_icode = fr->fr_icode;
3414 	fin->fin_fr = fr;
3459 	return fr;
3608 	frentry_t *fr;
3670 	fr = is->is_rule;
3672 	if (fr != NULL) {
3673 		if (fr->fr_srctrack.ht_max_nodes != 0) {
3674 			(void) ipf_ht_node_del(&fr->fr_srctrack,
3717 	if (fr != NULL) {
3718 		fr->fr_statecnt--;
3719 		(void) ipf_derefrule(softc, &fr);