sys/net/pf_norm.c

84 	u_int8_t	fn_proto;	/* protocol for fragments in fn_tree */
90 	struct pf_frag_tree fn_tree;	/* matching fragments, lookup by id */
106 	struct pf_frnode *fr_node;	/* ip src/dst/proto/af for fragments */
227  * Try to flush old fragments to make space for new ones
235 	goal = pf_status.fragments * 9 / 10;
237 	    pf_status.fragments - goal);
238 	while (goal < pf_status.fragments) {
272 		pf_status.fragments--;
294 	 * Limit the number of fragments we accept for each (proto,src,dst,af)
296 	 * of fragments.  Problem analysis is in RFC 4963.
298 	 * lookup discard 'stale' fragments (pf_fragment, based on the fr_gen
300 	 * timeout in multiples of 200 fragments.  This way the default of 60s
331 	pf_status.fragments++;
374 	 * 65535 octet IP packet can have 8192 fragments.  So the queue
394 	 * spawns 4096 octets.  We limit these to 64 fragments each, which
473 	 * If there are no fragments after frag, take the final one.  Assume
529 	/* No empty fragments */
535 	/* All fragments are 8 byte aligned */
553 	/* Fully buffer all of the fragments in this fragment queue */
617 	/* Non terminal fragments must have more fragments flag */
694 					pf_status.fragments--;
708 		pf_status.fragments--;
724 	 * or more its constituent fragments is determined to be an overlapping
725 	 * fragment, the entire datagram (and any constituent fragments) MUST
728 	DPFPRINTF(LOG_NOTICE, "flush overlapping fragments");
735 	pf_status.fragments--;
758 	pf_status.fragments--;
770 		pf_status.fragments--;
1053 	/* We're dealing with a fragment now. Don't allow fragments
1726 	/* random-id, but not for fragments */