src/usermgmt.c

   1 /*
   2  * netsniff-ng - the packet sniffing beast
   3  * By Daniel Borkmann <daniel@netsniff-ng.org>
   4  * Copyright 2011 Daniel Borkmann.
   5  * Subject to the GPL, version 2.
   6  */
   7
   8 #include <stdio.h>
   9 #include <stdint.h>
  10 #include <stdlib.h>
  11 #include <unistd.h>
  12 #include <fcntl.h>
  13 #include <string.h>
  14 #include <syslog.h>
  15 #include <limits.h>
  16 #include <arpa/inet.h>
  17
  18 #include "die.h"
  19 #include "usermgmt.h"
  20 #include "locking.h"
  21 #include "xmalloc.h"
  22 #include "xio.h"
  23 #include "curvetun.h"
  24 #include "xstring.h"
  25 #include "curve.h"
  26 #include "hash.h"
  27 #include "crypto_verify_32.h"
  28 #include "crypto_hash_sha512.h"
  29 #include "crypto_box_curve25519xsalsa20poly1305.h"
  30 #include "crypto_auth_hmacsha512256.h"
  31
  32 #define crypto_box_pub_key_size crypto_box_curve25519xsalsa20poly1305_PUBLICKEYBYTES
  33
  34 /* Config line format: username;pubkey\n */
  35
  36 struct user_store {
  37         char username[256];
  38         unsigned char publickey[crypto_box_pub_key_size];
  39         struct curve25519_proto proto_inf;
  40         struct user_store *next;
  41 };
  42
  43 struct sock_map_entry {
  44         int fd;
  45         struct curve25519_proto *proto;
  46         struct sock_map_entry *next;
  47 };
  48
  49 struct sockaddr_map_entry {
  50         struct sockaddr_storage *sa;
  51         size_t sa_len;
  52         struct curve25519_proto *proto;
  53         struct sockaddr_map_entry *next;
  54 };
  55
  56 static struct user_store *store = NULL;
  57 static struct rwlock store_lock;
  58
  59 static struct hash_table sock_mapper;
  60 static struct rwlock sock_map_lock;
  61
  62 static struct hash_table sockaddr_mapper;
  63 static struct rwlock sockaddr_map_lock;
  64
  65 static unsigned char token[crypto_auth_hmacsha512256_KEYBYTES];
  66
  67 static void init_sock_mapper(void)
  68 {
  69         rwlock_init(&sock_map_lock);
  70         rwlock_wr_lock(&sock_map_lock);
  71         memset(&sock_mapper, 0, sizeof(sock_mapper));
  72         init_hash(&sock_mapper);
  73         rwlock_unlock(&sock_map_lock);
  74 }
  75
  76 static void init_sockaddr_mapper(void)
  77 {
  78         rwlock_init(&sockaddr_map_lock);
  79         rwlock_wr_lock(&sockaddr_map_lock);
  80         memset(&sockaddr_mapper, 0, sizeof(sockaddr_mapper));
  81         init_hash(&sockaddr_mapper);
  82         rwlock_unlock(&sockaddr_map_lock);
  83 }
  84
  85 static int cleanup_batch_sock_mapper(void *ptr)
  86 {
  87         struct sock_map_entry *next;
  88         struct sock_map_entry *e = ptr;
  89
  90         if (!e)
  91                 return 0;
  92         while ((next = e->next)) {
  93                 e->next = NULL;
  94                 xfree(e);
  95                 e = next;
  96         }
  97         xfree(e);
  98         return 0;
  99 }
 100
 101 static void destroy_sock_mapper(void)
 102 {
 103         rwlock_wr_lock(&sock_map_lock);
 104         for_each_hash(&sock_mapper, cleanup_batch_sock_mapper);
 105         free_hash(&sock_mapper);
 106         rwlock_unlock(&sock_map_lock);
 107         rwlock_destroy(&sock_map_lock);
 108 }
 109
 110 static int cleanup_batch_sockaddr_mapper(void *ptr)
 111 {
 112         struct sockaddr_map_entry *next;
 113         struct sockaddr_map_entry *e = ptr;
 114
 115         if (!e)
 116                 return 0;
 117         while ((next = e->next)) {
 118                 e->next = NULL;
 119                 xfree(e);
 120                 e = next;
 121         }
 122         xfree(e);
 123         return 0;
 124 }
 125
 126 static void destroy_sockaddr_mapper(void)
 127 {
 128         rwlock_wr_lock(&sockaddr_map_lock);
 129         for_each_hash(&sockaddr_mapper, cleanup_batch_sockaddr_mapper);
 130         free_hash(&sockaddr_mapper);
 131         rwlock_unlock(&sockaddr_map_lock);
 132         rwlock_destroy(&sockaddr_map_lock);
 133 }
 134
 135 static struct user_store *user_store_alloc(void)
 136 {
 137         return xzmalloc(sizeof(struct user_store));
 138 }
 139
 140 static void user_store_free(struct user_store *us)
 141 {
 142         if (!us)
 143                 return;
 144         memset(us, 0, sizeof(struct user_store));
 145         xfree(us);
 146 }
 147
 148 /* already in lock */
 149 static int __check_duplicate_username(char *username, size_t len)
 150 {
 151         int duplicate = 0;
 152         struct user_store *elem = store;
 153         while (elem) {
 154                 if (!memcmp(elem->username, username,
 155                             strlen(elem->username) + 1)) {
 156                         duplicate = 1;
 157                         break;
 158                 }
 159                 elem = elem->next;
 160         }
 161         return duplicate;
 162 }
 163
 164 /* already in lock */
 165 static int __check_duplicate_pubkey(unsigned char *pubkey, size_t len)
 166 {
 167         int duplicate = 0;
 168         struct user_store *elem = store;
 169         while (elem) {
 170                 if (!memcmp(elem->publickey, pubkey,
 171                             sizeof(elem->publickey))) {
 172                         duplicate = 1;
 173                         break;
 174                 }
 175                 elem = elem->next;
 176         }
 177         return duplicate;
 178 }
 179
 180 void parse_userfile_and_generate_user_store_or_die(char *homedir)
 181 {
 182         FILE *fp;
 183         char path[PATH_MAX], buff[512], *username, *key;
 184         unsigned char pkey[crypto_box_pub_key_size];
 185         int line = 1, ret, fd;
 186         struct user_store *elem;
 187
 188         memset(path, 0, sizeof(path));
 189         slprintf(path, sizeof(path), "%s/%s", homedir, FILE_CLIENTS);
 190
 191         rwlock_init(&store_lock);
 192         rwlock_wr_lock(&store_lock);
 193
 194         fp = fopen(path, "r");
 195         if (!fp)
 196                 panic("Cannot open client file!\n");
 197         memset(buff, 0, sizeof(buff));
 198
 199         while (fgets(buff, sizeof(buff), fp) != NULL) {
 200                 buff[sizeof(buff) - 1] = 0;
 201                 /* A comment. Skip this line */
 202                 if (buff[0] == '#' || buff[0] == '\n') {
 203                         memset(buff, 0, sizeof(buff));
 204                         line++;
 205                         continue;
 206                 }
 207                 username = skips(buff);
 208                 key = username;
 209                 while (*key != ';' &&
 210                        *key != '\0' &&
 211                        *key != ' ' &&
 212                        *key != '\t')
 213                         key++;
 214                 if (*key != ';')
 215                         panic("Parse error! No key found in l.%d!\n", line);
 216                 *key = '\0';
 217                 key++;
 218                 if (*key == '\n')
 219                         panic("Parse error! No key found in l.%d!\n", line);
 220                 key = strtrim_right(key, '\n');
 221                 memset(pkey, 0, sizeof(pkey));
 222                 if (!curve25519_pubkey_hexparse_32(pkey, sizeof(pkey),
 223                                                    key, strlen(key)))
 224                         panic("Parse error! No key found in l.%d!\n", line);
 225                 if (strlen(username) + 1 > sizeof(elem->username))
 226                         panic("Username too long in l.%d!\n", line);
 227                 if (__check_duplicate_username(username, strlen(username) + 1))
 228                         panic("Duplicate username in l.%d!\n", line);
 229                 if (__check_duplicate_pubkey(pkey, sizeof(pkey)))
 230                         panic("Duplicate publickey in l.%d!\n", line);
 231                 if (strstr(username, " "))
 232                         panic("Username consists of whitespace in l.%d!\n", line);
 233                 if (strstr(username, "\t"))
 234                         panic("Username consists of whitespace in l.%d!\n", line);
 235                 elem = user_store_alloc();
 236                 elem->next = store;
 237                 strlcpy(elem->username, username, sizeof(elem->username));
 238                 memcpy(elem->publickey, pkey, sizeof(elem->publickey));
 239                 ret = curve25519_proto_init(&elem->proto_inf,
 240                                             elem->publickey,
 241                                             sizeof(elem->publickey),
 242                                             homedir, 1);
 243                 if (ret)
 244                         panic("Cannot init curve25519 proto on user!\n");
 245                 store = elem;
 246                 memset(buff, 0, sizeof(buff));
 247                 line++;
 248         }
 249
 250         fclose(fp);
 251         if (store == NULL)
 252                 panic("No registered clients found!\n");
 253         rwlock_unlock(&store_lock);
 254
 255         init_sock_mapper();
 256         init_sockaddr_mapper();
 257
 258         /*
 259          * Pubkey is also used as a hmac of the initial packet to check
 260          * the integrity of the packet, so that we know if it's just random
 261          * garbage or a 'valid' packet. Again, just for the integrity!
 262          */
 263
 264         memset(path, 0, sizeof(path));
 265         slprintf(path, sizeof(path), "%s/%s", homedir, FILE_PUBKEY);
 266
 267         fd = open_or_die(path, O_RDONLY);
 268         ret = read(fd, token, sizeof(token));
 269         if (ret != crypto_auth_hmacsha512256_KEYBYTES)
 270                 panic("Cannot read public key!\n");
 271         close(fd);
 272 }
 273
 274 void dump_user_store(void)
 275 {
 276         int i;
 277         struct user_store *elem;
 278
 279         rwlock_rd_lock(&store_lock);
 280         elem = store;
 281         while (elem) {
 282                 printf("%s -> ", elem->username);
 283                 for (i = 0; i < sizeof(elem->publickey); ++i)
 284                         if (i == (sizeof(elem->publickey) - 1))
 285                                 printf("%02x\n", (unsigned char)
 286                                        elem->publickey[i]);
 287                         else
 288                                 printf("%02x:", (unsigned char)
 289                                        elem->publickey[i]);
 290                 elem = elem->next;
 291         }
 292         rwlock_unlock(&store_lock);
 293 }
 294
 295 void destroy_user_store(void)
 296 {
 297         struct user_store *elem, *nelem = NULL;
 298
 299         rwlock_wr_lock(&store_lock);
 300         elem = store;
 301         while (elem) {
 302                 nelem = elem->next;
 303                 elem->next = NULL;
 304                 user_store_free(elem);
 305                 elem = nelem;
 306         }
 307         rwlock_unlock(&store_lock);
 308         rwlock_destroy(&store_lock);
 309
 310         destroy_sock_mapper();
 311         destroy_sockaddr_mapper();
 312 }
 313
 314 int username_msg(char *username, size_t len, char *dst, size_t dlen)
 315 {
 316         int fd;
 317         ssize_t ret;
 318         uint32_t salt;
 319         unsigned char h[crypto_hash_sha512_BYTES];
 320         struct username_struct *us = (struct username_struct *) dst;
 321         char *uname;
 322         size_t uname_len;
 323
 324         if (dlen < sizeof(struct username_struct))
 325                 return -ENOMEM;
 326
 327         uname_len = 512;
 328         uname = xzmalloc(uname_len);
 329
 330         fd = open_or_die("/dev/random", O_RDONLY);
 331         ret = read_exact(fd, &salt, sizeof(salt), 0);
 332         if (ret != sizeof(salt))
 333                 panic("Cannot read from /dev/random!\n");
 334         close(fd);
 335
 336         slprintf(uname, uname_len, "%s%u", username, salt);
 337         crypto_hash_sha512(h, (unsigned char *) uname, strlen(uname));
 338
 339         us->salt = htonl(salt);
 340         memcpy(us->hash, h, sizeof(us->hash));
 341
 342         xfree(uname);
 343         return 0;
 344 }
 345
 346 enum is_user_enum username_msg_is_user(char *src, size_t slen, char *username,
 347                                        size_t len)
 348 {
 349         char *uname;
 350         size_t uname_len;
 351         uint32_t salt;
 352         struct username_struct *us = (struct username_struct *) src;
 353         unsigned char h[crypto_hash_sha512_BYTES];
 354
 355         if (slen < sizeof(struct username_struct)) {
 356                 errno = ENOMEM;
 357                 return USERNAMES_ERR;
 358         }
 359
 360         uname_len = 512;
 361         uname = xzmalloc(uname_len);
 362
 363         salt = ntohl(us->salt);
 364
 365         slprintf(uname, uname_len, "%s%u", username, salt);
 366         crypto_hash_sha512(h, (unsigned char *) uname, strlen(uname));
 367         xfree(uname);
 368
 369         if (!crypto_verify_32(&h[0], &us->hash[0]) &&
 370             !crypto_verify_32(&h[32], &us->hash[32]))
 371                 return USERNAMES_OK;
 372         else
 373                 return USERNAMES_NE;
 374 }
 375
 376 static int register_user_by_socket(int fd, struct curve25519_proto *proto)
 377 {
 378         void **pos;
 379         struct sock_map_entry *entry;
 380
 381         rwlock_wr_lock(&sock_map_lock);
 382         entry = xzmalloc(sizeof(*entry));
 383         entry->fd = fd;
 384         entry->proto = proto;
 385         pos = insert_hash(entry->fd, entry, &sock_mapper);
 386         if (pos) {
 387                 entry->next = (*pos);
 388                 (*pos) = entry;
 389         }
 390         rwlock_unlock(&sock_map_lock);
 391
 392         return 0;
 393 }
 394
 395 static int register_user_by_sockaddr(struct sockaddr_storage *sa,
 396                                      size_t sa_len,
 397                                      struct curve25519_proto *proto)
 398 {
 399         void **pos;
 400         struct sockaddr_map_entry *entry;
 401         unsigned int hash = hash_name((char *) sa, sa_len);
 402
 403         rwlock_wr_lock(&sockaddr_map_lock);
 404         entry = xzmalloc(sizeof(*entry));
 405         entry->sa = xmemdupz(sa, sa_len);
 406         entry->sa_len = sa_len;
 407         entry->proto = proto;
 408         pos = insert_hash(hash, entry, &sockaddr_mapper);
 409         if (pos) {
 410                 entry->next = (*pos);
 411                 (*pos) = entry;
 412         }
 413         rwlock_unlock(&sockaddr_map_lock);
 414
 415         return 0;
 416 }
 417
 418 int try_register_user_by_socket(struct curve25519_struct *c,
 419                                 char *src, size_t slen, int sock, int log)
 420 {
 421         int ret = -1;
 422         char *cbuff = NULL;
 423         size_t real_len = 132;
 424         ssize_t clen;
 425         struct user_store *elem;
 426         enum is_user_enum err;
 427         unsigned char auth[crypto_auth_hmacsha512256_BYTES];
 428         struct taia arrival_taia;
 429
 430         /* assert(132 == clen + sizeof(auth)); */
 431         /*
 432          * Check hmac first, if malicious, drop immediately before we
 433          * investigate more efforts.
 434          */
 435         if (slen < real_len)
 436                 return -1;
 437
 438         taia_now(&arrival_taia);
 439         memcpy(auth, src, sizeof(auth));
 440         src += sizeof(auth);
 441         real_len -= sizeof(auth);
 442         if (crypto_auth_hmacsha512256_verify(auth, (unsigned char *) src,
 443                                              real_len, token)) {
 444                 syslog(LOG_ERR, "Bad packet hmac for id %d! Dropping!\n", sock);
 445                 return -1;
 446         } else {
 447                 if (log)
 448                         syslog(LOG_INFO, "Good packet hmac for id %d!\n", sock);
 449         }
 450
 451         rwlock_rd_lock(&store_lock);
 452         elem = store;
 453         while (elem) {
 454                 clen = curve25519_decode(c, &elem->proto_inf,
 455                                          (unsigned char *) src, real_len,
 456                                          (unsigned char **) &cbuff,
 457                                          &arrival_taia);
 458                 if (clen <= 0) {
 459                         elem = elem->next;
 460                         continue;
 461                 }
 462
 463                 cbuff += crypto_box_zerobytes;
 464                 clen -= crypto_box_zerobytes;
 465
 466                 if (log)
 467                         syslog(LOG_INFO, "Packet decoded sucessfully for id %d!\n", sock);
 468
 469                 err = username_msg_is_user(cbuff, clen, elem->username,
 470                                            strlen(elem->username) + 1);
 471                 if (err == USERNAMES_OK) {
 472                         if (log)
 473                                 syslog(LOG_INFO, "Found user %s for id %d! Registering ...\n",
 474                                        elem->username, sock);
 475                         ret = register_user_by_socket(sock, &elem->proto_inf);
 476                         break;
 477                 }
 478                 elem = elem->next;
 479         }
 480         rwlock_unlock(&store_lock);
 481
 482         if (ret == -1)
 483                 syslog(LOG_ERR, "User not found! Dropping connection!\n");
 484         return ret;
 485 }
 486
 487 int try_register_user_by_sockaddr(struct curve25519_struct *c,
 488                                   char *src, size_t slen,
 489                                   struct sockaddr_storage *sa,
 490                                   size_t sa_len, int log)
 491 {
 492         int ret = -1;
 493         char *cbuff = NULL;
 494         struct user_store *elem;
 495         ssize_t clen;
 496         size_t real_len = 132;
 497         enum is_user_enum err;
 498         unsigned char auth[crypto_auth_hmacsha512256_BYTES];
 499         struct taia arrival_taia;
 500
 501         /* assert(132 == clen + sizeof(auth)); */
 502         /*
 503          * Check hmac first, if malicious, drop immediately before we
 504          * investigate more efforts.
 505          */
 506         if (slen < real_len)
 507                 return -1;
 508
 509         taia_now(&arrival_taia);
 510         memcpy(auth, src, sizeof(auth));
 511         src += sizeof(auth);
 512         real_len -= sizeof(auth);
 513         if (crypto_auth_hmacsha512256_verify(auth, (unsigned char *) src,
 514                                              real_len, token)) {
 515                 syslog(LOG_ERR, "Got bad packet hmac! Dropping!\n");
 516                 return -1;
 517         } else {
 518                 if (log)
 519                         syslog(LOG_INFO, "Got good packet hmac!\n");
 520         }
 521
 522         rwlock_rd_lock(&store_lock);
 523         elem = store;
 524         while (elem) {
 525                 clen = curve25519_decode(c, &elem->proto_inf,
 526                                          (unsigned char *) src, real_len,
 527                                          (unsigned char **) &cbuff,
 528                                          &arrival_taia);
 529                 if (clen <= 0) {
 530                         elem = elem->next;
 531                         continue;
 532                 }
 533
 534                 cbuff += crypto_box_zerobytes;
 535                 clen -= crypto_box_zerobytes;
 536
 537                 if (log)
 538                         syslog(LOG_INFO, "Packet decoded sucessfully!\n");
 539
 540                 err = username_msg_is_user(cbuff, clen, elem->username,
 541                                            strlen(elem->username) + 1);
 542                 if (err == USERNAMES_OK) {
 543                         if (log)
 544                                 syslog(LOG_INFO, "Found user %s! Registering ...\n",
 545                                        elem->username);
 546                         ret = register_user_by_sockaddr(sa, sa_len,
 547                                                         &elem->proto_inf);
 548                         break;
 549                 }
 550                 elem = elem->next;
 551         }
 552         rwlock_unlock(&store_lock);
 553
 554         if (ret == -1)
 555                 syslog(LOG_ERR, "User not found! Dropping connection!\n");
 556         return ret;
 557 }
 558
 559 int get_user_by_socket(int fd, struct curve25519_proto **proto)
 560 {
 561         int ret = -1;
 562         struct sock_map_entry *entry;
 563
 564         errno = 0;
 565         rwlock_rd_lock(&sock_map_lock);
 566         entry = lookup_hash(fd, &sock_mapper);
 567         while (entry && fd != entry->fd)
 568                 entry = entry->next;
 569         if (entry && fd == entry->fd) {
 570                 (*proto) = entry->proto;
 571                 ret = 0;
 572         } else {
 573                 (*proto) = NULL;
 574                 errno = ENOENT;
 575         }
 576         rwlock_unlock(&sock_map_lock);
 577
 578         return ret;
 579 }
 580
 581 int get_user_by_sockaddr(struct sockaddr_storage *sa, size_t sa_len,
 582                          struct curve25519_proto **proto)
 583 {
 584         int ret = -1;
 585         struct sockaddr_map_entry *entry;
 586         unsigned int hash = hash_name((char *) sa, sa_len);
 587
 588         errno = 0;
 589         rwlock_rd_lock(&sockaddr_map_lock);
 590         entry = lookup_hash(hash, &sockaddr_mapper);
 591         while (entry && entry->sa_len == sa_len &&
 592                memcmp(sa, entry->sa, entry->sa_len))
 593                 entry = entry->next;
 594         if (entry && entry->sa_len == sa_len &&
 595             !memcmp(sa, entry->sa, entry->sa_len)) {
 596                 (*proto) = entry->proto;
 597                 ret = 0;
 598         } else {
 599                 (*proto) = NULL;
 600                 errno = ENOENT;
 601         }
 602         rwlock_unlock(&sockaddr_map_lock);
 603
 604         return ret;
 605 }
 606
 607 static struct sock_map_entry *socket_to_sock_map_entry(int fd)
 608 {
 609         struct sock_map_entry *entry, *ret = NULL;
 610
 611         errno = 0;
 612         rwlock_rd_lock(&sock_map_lock);
 613         entry = lookup_hash(fd, &sock_mapper);
 614         while (entry && fd != entry->fd)
 615                 entry = entry->next;
 616         if (entry && fd == entry->fd)
 617                 ret = entry;
 618         else
 619                 errno = ENOENT;
 620         rwlock_unlock(&sock_map_lock);
 621
 622         return ret;
 623 }
 624
 625 void remove_user_by_socket(int fd)
 626 {
 627         struct sock_map_entry *pos;
 628         struct sock_map_entry *entry = socket_to_sock_map_entry(fd);
 629         if (!entry)
 630                 return;
 631         rwlock_wr_lock(&sock_map_lock);
 632         pos = remove_hash(entry->fd, entry, entry->next, &sock_mapper);
 633         while (pos && pos->next && pos->next != entry)
 634                 pos = pos->next;
 635         if (pos && pos->next && pos->next == entry)
 636                 pos->next = entry->next;
 637         memset(entry->proto->enonce, 0, sizeof(entry->proto->enonce));
 638         memset(entry->proto->dnonce, 0, sizeof(entry->proto->dnonce));
 639         entry->proto = NULL;
 640         entry->next = NULL;
 641         xfree(entry);
 642         rwlock_unlock(&sock_map_lock);
 643 }
 644
 645 static struct sockaddr_map_entry *
 646 sockaddr_to_sockaddr_map_entry(struct sockaddr_storage *sa, size_t sa_len)
 647 {
 648         struct sockaddr_map_entry *entry, *ret = NULL;
 649         unsigned int hash = hash_name((char *) sa, sa_len);
 650
 651         errno = 0;
 652         rwlock_rd_lock(&sockaddr_map_lock);
 653         entry = lookup_hash(hash, &sockaddr_mapper);
 654         while (entry && entry->sa_len == sa_len &&
 655                memcmp(sa, entry->sa, entry->sa_len))
 656                 entry = entry->next;
 657         if (entry && entry->sa_len == sa_len &&
 658             !memcmp(sa, entry->sa, entry->sa_len))
 659                 ret = entry;
 660         else
 661                 errno = ENOENT;
 662         rwlock_unlock(&sockaddr_map_lock);
 663
 664         return ret;
 665 }
 666
 667 void remove_user_by_sockaddr(struct sockaddr_storage *sa, size_t sa_len)
 668 {
 669         struct sockaddr_map_entry *pos;
 670         struct sockaddr_map_entry *entry;
 671         unsigned int hash = hash_name((char *) sa, sa_len);
 672         entry = sockaddr_to_sockaddr_map_entry(sa, sa_len);
 673         if (!entry)
 674                 return;
 675         rwlock_wr_lock(&sockaddr_map_lock);
 676         pos = remove_hash(hash, entry, entry->next, &sockaddr_mapper);
 677         while (pos && pos->next && pos->next != entry)
 678                 pos = pos->next;
 679         if (pos && pos->next && pos->next == entry)
 680                 pos->next = entry->next;
 681         memset(entry->proto->enonce, 0, sizeof(entry->proto->enonce));
 682         memset(entry->proto->dnonce, 0, sizeof(entry->proto->dnonce));
 683         entry->proto = NULL;
 684         entry->next = NULL;
 685         xfree(entry->sa);
 686         xfree(entry);
 687         rwlock_unlock(&sockaddr_map_lock);
 688 }
 689