13b3a8eb9SGleb Smirnoff /*- 23b3a8eb9SGleb Smirnoff * Copyright (c) 2004 Ruslan Ermilov and Vsevolod Lobko. 31a33e799SAlexander V. Chernikov * Copyright (c) 2014 Yandex LLC 41a33e799SAlexander V. Chernikov * Copyright (c) 2014 Alexander V. Chernikov 53b3a8eb9SGleb Smirnoff * 63b3a8eb9SGleb Smirnoff * Redistribution and use in source and binary forms, with or without 73b3a8eb9SGleb Smirnoff * modification, are permitted provided that the following conditions 83b3a8eb9SGleb Smirnoff * are met: 93b3a8eb9SGleb Smirnoff * 1. Redistributions of source code must retain the above copyright 103b3a8eb9SGleb Smirnoff * notice, this list of conditions and the following disclaimer. 113b3a8eb9SGleb Smirnoff * 2. Redistributions in binary form must reproduce the above copyright 123b3a8eb9SGleb Smirnoff * notice, this list of conditions and the following disclaimer in the 133b3a8eb9SGleb Smirnoff * documentation and/or other materials provided with the distribution. 143b3a8eb9SGleb Smirnoff * 153b3a8eb9SGleb Smirnoff * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 163b3a8eb9SGleb Smirnoff * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 173b3a8eb9SGleb Smirnoff * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 183b3a8eb9SGleb Smirnoff * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 193b3a8eb9SGleb Smirnoff * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 203b3a8eb9SGleb Smirnoff * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 213b3a8eb9SGleb Smirnoff * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 223b3a8eb9SGleb Smirnoff * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 233b3a8eb9SGleb Smirnoff * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 243b3a8eb9SGleb Smirnoff * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 253b3a8eb9SGleb Smirnoff * SUCH DAMAGE. 263b3a8eb9SGleb Smirnoff */ 273b3a8eb9SGleb Smirnoff 283b3a8eb9SGleb Smirnoff #include <sys/cdefs.h> 293b3a8eb9SGleb Smirnoff __FBSDID("$FreeBSD$"); 303b3a8eb9SGleb Smirnoff 313b3a8eb9SGleb Smirnoff /* 32563b5ab1SAlexander V. Chernikov * Lookup table support for ipfw. 333b3a8eb9SGleb Smirnoff * 34ac35ff17SAlexander V. Chernikov * This file contains handlers for all generic tables' operations: 35563b5ab1SAlexander V. Chernikov * add/del/flush entries, list/dump tables etc.. 363b3a8eb9SGleb Smirnoff * 371a33e799SAlexander V. Chernikov * Table data modification is protected by both UH and runtime lock 38563b5ab1SAlexander V. Chernikov * while reading configuration/data is protected by UH lock. 39563b5ab1SAlexander V. Chernikov * 40563b5ab1SAlexander V. Chernikov * Lookup algorithms for all table types are located in ip_fw_table_algo.c 413b3a8eb9SGleb Smirnoff */ 423b3a8eb9SGleb Smirnoff 433b3a8eb9SGleb Smirnoff #include "opt_ipfw.h" 443b3a8eb9SGleb Smirnoff 453b3a8eb9SGleb Smirnoff #include <sys/param.h> 463b3a8eb9SGleb Smirnoff #include <sys/systm.h> 473b3a8eb9SGleb Smirnoff #include <sys/malloc.h> 483b3a8eb9SGleb Smirnoff #include <sys/kernel.h> 493b3a8eb9SGleb Smirnoff #include <sys/lock.h> 503b3a8eb9SGleb Smirnoff #include <sys/rwlock.h> 51ccba94b8SAlexander V. Chernikov #include <sys/rmlock.h> 523b3a8eb9SGleb Smirnoff #include <sys/socket.h> 53f1220db8SAlexander V. Chernikov #include <sys/socketvar.h> 543b3a8eb9SGleb Smirnoff #include <sys/queue.h> 553b3a8eb9SGleb Smirnoff #include <net/if.h> /* ip_fw.h requires IFNAMSIZ */ 563b3a8eb9SGleb Smirnoff 573b3a8eb9SGleb Smirnoff #include <netinet/in.h> 583b3a8eb9SGleb Smirnoff #include <netinet/ip_var.h> /* struct ipfw_rule_ref */ 593b3a8eb9SGleb Smirnoff #include <netinet/ip_fw.h> 603b3a8eb9SGleb Smirnoff 613b3a8eb9SGleb Smirnoff #include <netpfil/ipfw/ip_fw_private.h> 62ea761a5dSAlexander V. Chernikov #include <netpfil/ipfw/ip_fw_table.h> 633b3a8eb9SGleb Smirnoff 643b3a8eb9SGleb Smirnoff /* 65b074b7bbSAlexander V. Chernikov * Table has the following `type` concepts: 66b074b7bbSAlexander V. Chernikov * 67c21034b7SAlexander V. Chernikov * `no.type` represents lookup key type (addr, ifp, uid, etc..) 680cba2b28SAlexander V. Chernikov * vmask represents bitmask of table values which are present at the moment. 690cba2b28SAlexander V. Chernikov * Special IPFW_VTYPE_LEGACY ( (uint32_t)-1 ) represents old 700cba2b28SAlexander V. Chernikov * single-value-for-all approach. 71b074b7bbSAlexander V. Chernikov */ 72b074b7bbSAlexander V. Chernikov struct table_config { 73b074b7bbSAlexander V. Chernikov struct named_object no; 74914bffb6SAlexander V. Chernikov uint8_t tflags; /* type flags */ 754f43138aSAlexander V. Chernikov uint8_t locked; /* 1 if locked from changes */ 76adf3b2b9SAlexander V. Chernikov uint8_t linked; /* 1 if already linked */ 77adf3b2b9SAlexander V. Chernikov uint8_t ochanged; /* used by set swapping */ 780cba2b28SAlexander V. Chernikov uint8_t vshared; /* 1 if using shared value array */ 790cba2b28SAlexander V. Chernikov uint8_t spare[3]; 800cba2b28SAlexander V. Chernikov uint32_t count; /* Number of records */ 810cba2b28SAlexander V. Chernikov uint32_t limit; /* Max number of records */ 820cba2b28SAlexander V. Chernikov uint32_t vmask; /* bitmask with supported values */ 83a73d728dSAlexander V. Chernikov uint32_t ocount; /* used by set swapping */ 84a73d728dSAlexander V. Chernikov uint64_t gencnt; /* generation count */ 85b074b7bbSAlexander V. Chernikov char tablename[64]; /* table name */ 869f7d47b0SAlexander V. Chernikov struct table_algo *ta; /* Callbacks for given algo */ 879f7d47b0SAlexander V. Chernikov void *astate; /* algorithm state */ 884c060d85SAlexander V. Chernikov struct table_info ti_copy; /* data to put to table_info */ 890cba2b28SAlexander V. Chernikov struct namedobj_instance *vi; 90b074b7bbSAlexander V. Chernikov }; 91b074b7bbSAlexander V. Chernikov 9274b22066SAlexander V. Chernikov static int find_table_err(struct namedobj_instance *ni, struct tid_info *ti, 9374b22066SAlexander V. Chernikov struct table_config **tc); 94b074b7bbSAlexander V. Chernikov static struct table_config *find_table(struct namedobj_instance *ni, 95b074b7bbSAlexander V. Chernikov struct tid_info *ti); 9668394ec8SAlexander V. Chernikov static struct table_config *alloc_table_config(struct ip_fw_chain *ch, 970cba2b28SAlexander V. Chernikov struct tid_info *ti, struct table_algo *ta, char *adata, uint8_t tflags); 98b074b7bbSAlexander V. Chernikov static void free_table_config(struct namedobj_instance *ni, 99b074b7bbSAlexander V. Chernikov struct table_config *tc); 100db785d31SAlexander V. Chernikov static int create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti, 101867708f7SAlexander V. Chernikov char *aname, ipfw_xtable_info *i, uint16_t *pkidx, int ref); 1020468c5baSAlexander V. Chernikov static void link_table(struct ip_fw_chain *ch, struct table_config *tc); 1030468c5baSAlexander V. Chernikov static void unlink_table(struct ip_fw_chain *ch, struct table_config *tc); 1044dff4ae0SAlexander V. Chernikov static int find_ref_table(struct ip_fw_chain *ch, struct tid_info *ti, 105867708f7SAlexander V. Chernikov struct tentry_info *tei, uint32_t count, int op, struct table_config **ptc); 1064dff4ae0SAlexander V. Chernikov #define OP_ADD 1 1074dff4ae0SAlexander V. Chernikov #define OP_DEL 0 1082d99a349SAlexander V. Chernikov static int export_tables(struct ip_fw_chain *ch, ipfw_obj_lheader *olh, 1092d99a349SAlexander V. Chernikov struct sockopt_data *sd); 110ac35ff17SAlexander V. Chernikov static void export_table_info(struct ip_fw_chain *ch, struct table_config *tc, 111ac35ff17SAlexander V. Chernikov ipfw_xtable_info *i); 11281d3153dSAlexander V. Chernikov static int dump_table_tentry(void *e, void *arg); 113f1220db8SAlexander V. Chernikov static int dump_table_xentry(void *e, void *arg); 114b074b7bbSAlexander V. Chernikov 115a73d728dSAlexander V. Chernikov static int swap_tables(struct ip_fw_chain *ch, struct tid_info *a, 11646d52008SAlexander V. Chernikov struct tid_info *b); 117ac35ff17SAlexander V. Chernikov 118f81431ccSAndrey V. Elsukov static int check_table_name(const char *name); 1190cba2b28SAlexander V. Chernikov static int check_table_space(struct ip_fw_chain *ch, struct tableop_state *ts, 1200cba2b28SAlexander V. Chernikov struct table_config *tc, struct table_info *ti, uint32_t count); 121ac35ff17SAlexander V. Chernikov static int destroy_table(struct ip_fw_chain *ch, struct tid_info *ti); 122d3a4f924SAlexander V. Chernikov 1239f7d47b0SAlexander V. Chernikov static struct table_algo *find_table_algo(struct tables_config *tableconf, 1249490a627SAlexander V. Chernikov struct tid_info *ti, char *name); 125b074b7bbSAlexander V. Chernikov 12646d52008SAlexander V. Chernikov static void objheader_to_ti(struct _ipfw_obj_header *oh, struct tid_info *ti); 12746d52008SAlexander V. Chernikov static void ntlv_to_ti(struct _ipfw_obj_ntlv *ntlv, struct tid_info *ti); 12846d52008SAlexander V. Chernikov 129b074b7bbSAlexander V. Chernikov #define CHAIN_TO_NI(chain) (CHAIN_TO_TCFG(chain)->namehash) 1309f7d47b0SAlexander V. Chernikov #define KIDX_TO_TI(ch, k) (&(((struct table_info *)(ch)->tablestate)[k])) 131b074b7bbSAlexander V. Chernikov 132b6ee846eSAlexander V. Chernikov #define TA_BUF_SZ 128 /* On-stack buffer for add/delete state */ 133b6ee846eSAlexander V. Chernikov 1340cba2b28SAlexander V. Chernikov void 1350cba2b28SAlexander V. Chernikov rollback_toperation_state(struct ip_fw_chain *ch, void *object) 1360cba2b28SAlexander V. Chernikov { 1370cba2b28SAlexander V. Chernikov struct tables_config *tcfg; 1380cba2b28SAlexander V. Chernikov struct op_state *os; 1390cba2b28SAlexander V. Chernikov 1400cba2b28SAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 1410cba2b28SAlexander V. Chernikov TAILQ_FOREACH(os, &tcfg->state_list, next) 142fb4b37a3SAlexander V. Chernikov os->func(object, os); 1430cba2b28SAlexander V. Chernikov } 1440cba2b28SAlexander V. Chernikov 1450cba2b28SAlexander V. Chernikov void 1460cba2b28SAlexander V. Chernikov add_toperation_state(struct ip_fw_chain *ch, struct tableop_state *ts) 1470cba2b28SAlexander V. Chernikov { 1480cba2b28SAlexander V. Chernikov struct tables_config *tcfg; 1490cba2b28SAlexander V. Chernikov 1500cba2b28SAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 1510cba2b28SAlexander V. Chernikov TAILQ_INSERT_HEAD(&tcfg->state_list, &ts->opstate, next); 1520cba2b28SAlexander V. Chernikov } 1530cba2b28SAlexander V. Chernikov 1540cba2b28SAlexander V. Chernikov void 1550cba2b28SAlexander V. Chernikov del_toperation_state(struct ip_fw_chain *ch, struct tableop_state *ts) 1560cba2b28SAlexander V. Chernikov { 1570cba2b28SAlexander V. Chernikov struct tables_config *tcfg; 1580cba2b28SAlexander V. Chernikov 1590cba2b28SAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 1600cba2b28SAlexander V. Chernikov TAILQ_REMOVE(&tcfg->state_list, &ts->opstate, next); 1610cba2b28SAlexander V. Chernikov } 1620cba2b28SAlexander V. Chernikov 1630cba2b28SAlexander V. Chernikov void 1640cba2b28SAlexander V. Chernikov tc_ref(struct table_config *tc) 1650cba2b28SAlexander V. Chernikov { 1660cba2b28SAlexander V. Chernikov 1670cba2b28SAlexander V. Chernikov tc->no.refcnt++; 1680cba2b28SAlexander V. Chernikov } 1690cba2b28SAlexander V. Chernikov 1700cba2b28SAlexander V. Chernikov void 1710cba2b28SAlexander V. Chernikov tc_unref(struct table_config *tc) 1720cba2b28SAlexander V. Chernikov { 1730cba2b28SAlexander V. Chernikov 1740cba2b28SAlexander V. Chernikov tc->no.refcnt--; 1750cba2b28SAlexander V. Chernikov } 1760cba2b28SAlexander V. Chernikov 1770cba2b28SAlexander V. Chernikov static struct table_value * 1780cba2b28SAlexander V. Chernikov get_table_value(struct ip_fw_chain *ch, struct table_config *tc, uint32_t kidx) 1790cba2b28SAlexander V. Chernikov { 1800cba2b28SAlexander V. Chernikov struct table_value *pval; 1810cba2b28SAlexander V. Chernikov 1820cba2b28SAlexander V. Chernikov pval = (struct table_value *)ch->valuestate; 1830cba2b28SAlexander V. Chernikov 1840cba2b28SAlexander V. Chernikov return (&pval[kidx]); 1850cba2b28SAlexander V. Chernikov } 1860cba2b28SAlexander V. Chernikov 1870cba2b28SAlexander V. Chernikov 1883a845e10SAlexander V. Chernikov /* 1893a845e10SAlexander V. Chernikov * Checks if we're able to insert/update entry @tei into table 1903a845e10SAlexander V. Chernikov * w.r.t @tc limits. 1913a845e10SAlexander V. Chernikov * May alter @tei to indicate insertion error / insert 1923a845e10SAlexander V. Chernikov * options. 1933a845e10SAlexander V. Chernikov * 1943a845e10SAlexander V. Chernikov * Returns 0 if operation can be performed/ 1953a845e10SAlexander V. Chernikov */ 1963a845e10SAlexander V. Chernikov static int 1973a845e10SAlexander V. Chernikov check_table_limit(struct table_config *tc, struct tentry_info *tei) 1983a845e10SAlexander V. Chernikov { 199b074b7bbSAlexander V. Chernikov 2003a845e10SAlexander V. Chernikov if (tc->limit == 0 || tc->count < tc->limit) 2013a845e10SAlexander V. Chernikov return (0); 2023a845e10SAlexander V. Chernikov 2033a845e10SAlexander V. Chernikov if ((tei->flags & TEI_FLAGS_UPDATE) == 0) { 2043a845e10SAlexander V. Chernikov /* Notify userland on error cause */ 2053a845e10SAlexander V. Chernikov tei->flags |= TEI_FLAGS_LIMIT; 2063a845e10SAlexander V. Chernikov return (EFBIG); 2073a845e10SAlexander V. Chernikov } 2083a845e10SAlexander V. Chernikov 2093a845e10SAlexander V. Chernikov /* 2103a845e10SAlexander V. Chernikov * We have UPDATE flag set. 2113a845e10SAlexander V. Chernikov * Permit updating record (if found), 2123a845e10SAlexander V. Chernikov * but restrict adding new one since we've 2133a845e10SAlexander V. Chernikov * already hit the limit. 2143a845e10SAlexander V. Chernikov */ 2153a845e10SAlexander V. Chernikov tei->flags |= TEI_FLAGS_DONTADD; 2163a845e10SAlexander V. Chernikov 2173a845e10SAlexander V. Chernikov return (0); 2183a845e10SAlexander V. Chernikov } 2193a845e10SAlexander V. Chernikov 2203a845e10SAlexander V. Chernikov /* 2211bc0d457SAlexander V. Chernikov * Convert algorithm callback return code into 2221bc0d457SAlexander V. Chernikov * one of pre-defined states known by userland. 2233a845e10SAlexander V. Chernikov */ 2241bc0d457SAlexander V. Chernikov static void 225867708f7SAlexander V. Chernikov store_tei_result(struct tentry_info *tei, int op, int error, uint32_t num) 2263b3a8eb9SGleb Smirnoff { 2271bc0d457SAlexander V. Chernikov int flag; 2283b3a8eb9SGleb Smirnoff 2291bc0d457SAlexander V. Chernikov flag = 0; 2301bc0d457SAlexander V. Chernikov 2311bc0d457SAlexander V. Chernikov switch (error) { 2321bc0d457SAlexander V. Chernikov case 0: 233867708f7SAlexander V. Chernikov if (op == OP_ADD && num != 0) 2341bc0d457SAlexander V. Chernikov flag = TEI_FLAGS_ADDED; 235867708f7SAlexander V. Chernikov if (op == OP_DEL) 2361bc0d457SAlexander V. Chernikov flag = TEI_FLAGS_DELETED; 2371bc0d457SAlexander V. Chernikov break; 2381bc0d457SAlexander V. Chernikov case ENOENT: 2391bc0d457SAlexander V. Chernikov flag = TEI_FLAGS_NOTFOUND; 2401bc0d457SAlexander V. Chernikov break; 2411bc0d457SAlexander V. Chernikov case EEXIST: 2421bc0d457SAlexander V. Chernikov flag = TEI_FLAGS_EXISTS; 2431bc0d457SAlexander V. Chernikov break; 2441bc0d457SAlexander V. Chernikov default: 2451bc0d457SAlexander V. Chernikov flag = TEI_FLAGS_ERROR; 2461bc0d457SAlexander V. Chernikov } 2471bc0d457SAlexander V. Chernikov 2481bc0d457SAlexander V. Chernikov tei->flags |= flag; 2491bc0d457SAlexander V. Chernikov } 2509f7d47b0SAlexander V. Chernikov 251f99fbf96SAlexander V. Chernikov /* 252f99fbf96SAlexander V. Chernikov * Creates and references table with default parameters. 253f99fbf96SAlexander V. Chernikov * Saves table config, algo and allocated kidx info @ptc, @pta and 254f99fbf96SAlexander V. Chernikov * @pkidx if non-zero. 255f99fbf96SAlexander V. Chernikov * Used for table auto-creation to support old binaries. 256f99fbf96SAlexander V. Chernikov * 257f99fbf96SAlexander V. Chernikov * Returns 0 on success. 258f99fbf96SAlexander V. Chernikov */ 2590468c5baSAlexander V. Chernikov static int 2600468c5baSAlexander V. Chernikov create_table_compat(struct ip_fw_chain *ch, struct tid_info *ti, 261867708f7SAlexander V. Chernikov uint16_t *pkidx) 2620468c5baSAlexander V. Chernikov { 2630468c5baSAlexander V. Chernikov ipfw_xtable_info xi; 2640468c5baSAlexander V. Chernikov int error; 2650468c5baSAlexander V. Chernikov 2660468c5baSAlexander V. Chernikov memset(&xi, 0, sizeof(xi)); 2670cba2b28SAlexander V. Chernikov /* Set default value mask for legacy clients */ 2680cba2b28SAlexander V. Chernikov xi.vmask = IPFW_VTYPE_LEGACY; 2690468c5baSAlexander V. Chernikov 270867708f7SAlexander V. Chernikov error = create_table_internal(ch, ti, NULL, &xi, pkidx, 1); 2710468c5baSAlexander V. Chernikov if (error != 0) 2720468c5baSAlexander V. Chernikov return (error); 2730468c5baSAlexander V. Chernikov 2740468c5baSAlexander V. Chernikov return (0); 2750468c5baSAlexander V. Chernikov } 2760468c5baSAlexander V. Chernikov 2779f7d47b0SAlexander V. Chernikov /* 2781bc0d457SAlexander V. Chernikov * Find and reference existing table optionally 2791bc0d457SAlexander V. Chernikov * creating new one. 2801bc0d457SAlexander V. Chernikov * 281867708f7SAlexander V. Chernikov * Saves found table config into @ptc. 282867708f7SAlexander V. Chernikov * Note function may drop/acquire UH_WLOCK. 2831bc0d457SAlexander V. Chernikov * Returns 0 if table was found/created and referenced 2841bc0d457SAlexander V. Chernikov * or non-zero return code. 2859f7d47b0SAlexander V. Chernikov */ 2861bc0d457SAlexander V. Chernikov static int 2871bc0d457SAlexander V. Chernikov find_ref_table(struct ip_fw_chain *ch, struct tid_info *ti, 2884dff4ae0SAlexander V. Chernikov struct tentry_info *tei, uint32_t count, int op, 289867708f7SAlexander V. Chernikov struct table_config **ptc) 2901bc0d457SAlexander V. Chernikov { 2911bc0d457SAlexander V. Chernikov struct namedobj_instance *ni; 2921bc0d457SAlexander V. Chernikov struct table_config *tc; 293867708f7SAlexander V. Chernikov uint16_t kidx; 2941bc0d457SAlexander V. Chernikov int error; 2951bc0d457SAlexander V. Chernikov 296867708f7SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 2971bc0d457SAlexander V. Chernikov 2981bc0d457SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 2991bc0d457SAlexander V. Chernikov tc = NULL; 3009f7d47b0SAlexander V. Chernikov if ((tc = find_table(ni, ti)) != NULL) { 3019f7d47b0SAlexander V. Chernikov /* check table type */ 30274b22066SAlexander V. Chernikov if (tc->no.subtype != ti->type) 3033b3a8eb9SGleb Smirnoff return (EINVAL); 3043b3a8eb9SGleb Smirnoff 305867708f7SAlexander V. Chernikov if (tc->locked != 0) 3064f43138aSAlexander V. Chernikov return (EACCES); 3074f43138aSAlexander V. Chernikov 3084c0c07a5SAlexander V. Chernikov /* Try to exit early on limit hit */ 3094dff4ae0SAlexander V. Chernikov if (op == OP_ADD && count == 1 && 310867708f7SAlexander V. Chernikov check_table_limit(tc, tei) != 0) 3114c0c07a5SAlexander V. Chernikov return (EFBIG); 3124c0c07a5SAlexander V. Chernikov 313867708f7SAlexander V. Chernikov /* Reference and return */ 3149f7d47b0SAlexander V. Chernikov tc->no.refcnt++; 315867708f7SAlexander V. Chernikov *ptc = tc; 316867708f7SAlexander V. Chernikov return (0); 3179f7d47b0SAlexander V. Chernikov } 3183b3a8eb9SGleb Smirnoff 3194dff4ae0SAlexander V. Chernikov if (op == OP_DEL) 3201bc0d457SAlexander V. Chernikov return (ESRCH); 3211bc0d457SAlexander V. Chernikov 322a4641f4eSPedro F. Giffuni /* Compatibility mode: create new table for old clients */ 323db785d31SAlexander V. Chernikov if ((tei->flags & TEI_FLAGS_COMPAT) == 0) 324db785d31SAlexander V. Chernikov return (ESRCH); 3253b3a8eb9SGleb Smirnoff 326867708f7SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 327867708f7SAlexander V. Chernikov error = create_table_compat(ch, ti, &kidx); 328867708f7SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 329867708f7SAlexander V. Chernikov 330db785d31SAlexander V. Chernikov if (error != 0) 331db785d31SAlexander V. Chernikov return (error); 332db785d31SAlexander V. Chernikov 333867708f7SAlexander V. Chernikov tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, kidx); 334867708f7SAlexander V. Chernikov KASSERT(tc != NULL, ("create_table_compat returned bad idx %d", kidx)); 335db785d31SAlexander V. Chernikov 336867708f7SAlexander V. Chernikov /* OK, now we've got referenced table. */ 3371bc0d457SAlexander V. Chernikov *ptc = tc; 3381bc0d457SAlexander V. Chernikov return (0); 3391bc0d457SAlexander V. Chernikov } 3401bc0d457SAlexander V. Chernikov 3411bc0d457SAlexander V. Chernikov /* 342867708f7SAlexander V. Chernikov * Rolls back already @added to @tc entries using state array @ta_buf_m. 3431bc0d457SAlexander V. Chernikov * Assume the following layout: 3441bc0d457SAlexander V. Chernikov * 1) ADD state (ta_buf_m[0] ... t_buf_m[added - 1]) for handling update cases 3451bc0d457SAlexander V. Chernikov * 2) DEL state (ta_buf_m[count[ ... t_buf_m[count + added - 1]) 3461bc0d457SAlexander V. Chernikov * for storing deleted state 3471bc0d457SAlexander V. Chernikov */ 3481bc0d457SAlexander V. Chernikov static void 3491bc0d457SAlexander V. Chernikov rollback_added_entries(struct ip_fw_chain *ch, struct table_config *tc, 3501bc0d457SAlexander V. Chernikov struct table_info *tinfo, struct tentry_info *tei, caddr_t ta_buf_m, 3511bc0d457SAlexander V. Chernikov uint32_t count, uint32_t added) 3521bc0d457SAlexander V. Chernikov { 3531bc0d457SAlexander V. Chernikov struct table_algo *ta; 3541bc0d457SAlexander V. Chernikov struct tentry_info *ptei; 3551bc0d457SAlexander V. Chernikov caddr_t v, vv; 3561bc0d457SAlexander V. Chernikov size_t ta_buf_sz; 3571bc0d457SAlexander V. Chernikov int error, i; 3581bc0d457SAlexander V. Chernikov uint32_t num; 3591bc0d457SAlexander V. Chernikov 3601bc0d457SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 3611bc0d457SAlexander V. Chernikov 3621bc0d457SAlexander V. Chernikov ta = tc->ta; 3633a845e10SAlexander V. Chernikov ta_buf_sz = ta->ta_buf_size; 3641bc0d457SAlexander V. Chernikov v = ta_buf_m; 3651bc0d457SAlexander V. Chernikov vv = v + count * ta_buf_sz; 3661bc0d457SAlexander V. Chernikov for (i = 0; i < added; i++, v += ta_buf_sz, vv += ta_buf_sz) { 3671bc0d457SAlexander V. Chernikov ptei = &tei[i]; 3681bc0d457SAlexander V. Chernikov if ((ptei->flags & TEI_FLAGS_UPDATED) != 0) { 3691bc0d457SAlexander V. Chernikov 3701bc0d457SAlexander V. Chernikov /* 3711bc0d457SAlexander V. Chernikov * We have old value stored by previous 3721bc0d457SAlexander V. Chernikov * call in @ptei->value. Do add once again 3731bc0d457SAlexander V. Chernikov * to restore it. 3741bc0d457SAlexander V. Chernikov */ 3751bc0d457SAlexander V. Chernikov error = ta->add(tc->astate, tinfo, ptei, v, &num); 3761bc0d457SAlexander V. Chernikov KASSERT(error == 0, ("rollback UPDATE fail")); 3771bc0d457SAlexander V. Chernikov KASSERT(num == 0, ("rollback UPDATE fail2")); 3781bc0d457SAlexander V. Chernikov continue; 3791bc0d457SAlexander V. Chernikov } 3801bc0d457SAlexander V. Chernikov 3811bc0d457SAlexander V. Chernikov error = ta->prepare_del(ch, ptei, vv); 3821bc0d457SAlexander V. Chernikov KASSERT(error == 0, ("pre-rollback INSERT failed")); 3831bc0d457SAlexander V. Chernikov error = ta->del(tc->astate, tinfo, ptei, vv, &num); 3841bc0d457SAlexander V. Chernikov KASSERT(error == 0, ("rollback INSERT failed")); 3851bc0d457SAlexander V. Chernikov tc->count -= num; 3861bc0d457SAlexander V. Chernikov } 3871bc0d457SAlexander V. Chernikov } 3881bc0d457SAlexander V. Chernikov 3891bc0d457SAlexander V. Chernikov /* 3901bc0d457SAlexander V. Chernikov * Prepares add/del state for all @count entries in @tei. 3911bc0d457SAlexander V. Chernikov * Uses either stack buffer (@ta_buf) or allocates a new one. 3921bc0d457SAlexander V. Chernikov * Stores pointer to allocated buffer back to @ta_buf. 3931bc0d457SAlexander V. Chernikov * 3941bc0d457SAlexander V. Chernikov * Returns 0 on success. 3951bc0d457SAlexander V. Chernikov */ 3961bc0d457SAlexander V. Chernikov static int 3971bc0d457SAlexander V. Chernikov prepare_batch_buffer(struct ip_fw_chain *ch, struct table_algo *ta, 3984dff4ae0SAlexander V. Chernikov struct tentry_info *tei, uint32_t count, int op, caddr_t *ta_buf) 3991bc0d457SAlexander V. Chernikov { 4001bc0d457SAlexander V. Chernikov caddr_t ta_buf_m, v; 4011bc0d457SAlexander V. Chernikov size_t ta_buf_sz, sz; 4021bc0d457SAlexander V. Chernikov struct tentry_info *ptei; 4031bc0d457SAlexander V. Chernikov int error, i; 4041bc0d457SAlexander V. Chernikov 4051bc0d457SAlexander V. Chernikov error = 0; 4061bc0d457SAlexander V. Chernikov ta_buf_sz = ta->ta_buf_size; 4073a845e10SAlexander V. Chernikov if (count == 1) { 4081bc0d457SAlexander V. Chernikov /* Sigle add/delete, use on-stack buffer */ 4091bc0d457SAlexander V. Chernikov memset(*ta_buf, 0, TA_BUF_SZ); 4101bc0d457SAlexander V. Chernikov ta_buf_m = *ta_buf; 4113a845e10SAlexander V. Chernikov } else { 4123a845e10SAlexander V. Chernikov 4133a845e10SAlexander V. Chernikov /* 4141bc0d457SAlexander V. Chernikov * Multiple adds/deletes, allocate larger buffer 4151bc0d457SAlexander V. Chernikov * 4161bc0d457SAlexander V. Chernikov * Note we need 2xcount buffer for add case: 4171bc0d457SAlexander V. Chernikov * we have hold both ADD state 4183a845e10SAlexander V. Chernikov * and DELETE state (this may be needed 4193a845e10SAlexander V. Chernikov * if we need to rollback all changes) 4203a845e10SAlexander V. Chernikov */ 4211bc0d457SAlexander V. Chernikov sz = count * ta_buf_sz; 4224dff4ae0SAlexander V. Chernikov ta_buf_m = malloc((op == OP_ADD) ? sz * 2 : sz, M_TEMP, 4233a845e10SAlexander V. Chernikov M_WAITOK | M_ZERO); 4243a845e10SAlexander V. Chernikov } 4251bc0d457SAlexander V. Chernikov 4263a845e10SAlexander V. Chernikov v = ta_buf_m; 4273a845e10SAlexander V. Chernikov for (i = 0; i < count; i++, v += ta_buf_sz) { 4281bc0d457SAlexander V. Chernikov ptei = &tei[i]; 4294dff4ae0SAlexander V. Chernikov error = (op == OP_ADD) ? 4301bc0d457SAlexander V. Chernikov ta->prepare_add(ch, ptei, v) : ta->prepare_del(ch, ptei, v); 4313a845e10SAlexander V. Chernikov 4323a845e10SAlexander V. Chernikov /* 4333a845e10SAlexander V. Chernikov * Some syntax error (incorrect mask, or address, or 4343a845e10SAlexander V. Chernikov * anything). Return error regardless of atomicity 4353a845e10SAlexander V. Chernikov * settings. 4363a845e10SAlexander V. Chernikov */ 437db785d31SAlexander V. Chernikov if (error != 0) 4381bc0d457SAlexander V. Chernikov break; 4393a845e10SAlexander V. Chernikov } 4403b3a8eb9SGleb Smirnoff 4411bc0d457SAlexander V. Chernikov *ta_buf = ta_buf_m; 4421bc0d457SAlexander V. Chernikov return (error); 4431bc0d457SAlexander V. Chernikov } 4441bc0d457SAlexander V. Chernikov 4451bc0d457SAlexander V. Chernikov /* 4461bc0d457SAlexander V. Chernikov * Flushes allocated state for each @count entries in @tei. 4471bc0d457SAlexander V. Chernikov * Frees @ta_buf_m if differs from stack buffer @ta_buf. 4481bc0d457SAlexander V. Chernikov */ 4491bc0d457SAlexander V. Chernikov static void 4501bc0d457SAlexander V. Chernikov flush_batch_buffer(struct ip_fw_chain *ch, struct table_algo *ta, 451867708f7SAlexander V. Chernikov struct tentry_info *tei, uint32_t count, int rollback, 4521bc0d457SAlexander V. Chernikov caddr_t ta_buf_m, caddr_t ta_buf) 4531bc0d457SAlexander V. Chernikov { 4541bc0d457SAlexander V. Chernikov caddr_t v; 4550cba2b28SAlexander V. Chernikov struct tentry_info *ptei; 4561bc0d457SAlexander V. Chernikov size_t ta_buf_sz; 4571bc0d457SAlexander V. Chernikov int i; 4581bc0d457SAlexander V. Chernikov 4591bc0d457SAlexander V. Chernikov ta_buf_sz = ta->ta_buf_size; 4601bc0d457SAlexander V. Chernikov 4611bc0d457SAlexander V. Chernikov /* Run cleaning callback anyway */ 4621bc0d457SAlexander V. Chernikov v = ta_buf_m; 4630cba2b28SAlexander V. Chernikov for (i = 0; i < count; i++, v += ta_buf_sz) { 4640cba2b28SAlexander V. Chernikov ptei = &tei[i]; 4650cba2b28SAlexander V. Chernikov ta->flush_entry(ch, ptei, v); 4660cba2b28SAlexander V. Chernikov if (ptei->ptv != NULL) { 4670cba2b28SAlexander V. Chernikov free(ptei->ptv, M_IPFW); 4680cba2b28SAlexander V. Chernikov ptei->ptv = NULL; 4690cba2b28SAlexander V. Chernikov } 4700cba2b28SAlexander V. Chernikov } 4711bc0d457SAlexander V. Chernikov 4721bc0d457SAlexander V. Chernikov /* Clean up "deleted" state in case of rollback */ 4731bc0d457SAlexander V. Chernikov if (rollback != 0) { 4741bc0d457SAlexander V. Chernikov v = ta_buf_m + count * ta_buf_sz; 4751bc0d457SAlexander V. Chernikov for (i = 0; i < count; i++, v += ta_buf_sz) 4761bc0d457SAlexander V. Chernikov ta->flush_entry(ch, &tei[i], v); 4771bc0d457SAlexander V. Chernikov } 4781bc0d457SAlexander V. Chernikov 4791bc0d457SAlexander V. Chernikov if (ta_buf_m != ta_buf) 4801bc0d457SAlexander V. Chernikov free(ta_buf_m, M_TEMP); 4811bc0d457SAlexander V. Chernikov } 4821bc0d457SAlexander V. Chernikov 48371af39bfSAlexander V. Chernikov 48471af39bfSAlexander V. Chernikov static void 48571af39bfSAlexander V. Chernikov rollback_add_entry(void *object, struct op_state *_state) 48671af39bfSAlexander V. Chernikov { 48771af39bfSAlexander V. Chernikov struct ip_fw_chain *ch; 48871af39bfSAlexander V. Chernikov struct tableop_state *ts; 48971af39bfSAlexander V. Chernikov 49071af39bfSAlexander V. Chernikov ts = (struct tableop_state *)_state; 49171af39bfSAlexander V. Chernikov 49271af39bfSAlexander V. Chernikov if (ts->tc != object && ts->ch != object) 49371af39bfSAlexander V. Chernikov return; 49471af39bfSAlexander V. Chernikov 49571af39bfSAlexander V. Chernikov ch = ts->ch; 49671af39bfSAlexander V. Chernikov 49771af39bfSAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 49871af39bfSAlexander V. Chernikov 49971af39bfSAlexander V. Chernikov /* Call specifid unlockers */ 50071af39bfSAlexander V. Chernikov rollback_table_values(ts); 50171af39bfSAlexander V. Chernikov 50271af39bfSAlexander V. Chernikov /* Indicate we've called */ 50371af39bfSAlexander V. Chernikov ts->modified = 1; 50471af39bfSAlexander V. Chernikov } 50571af39bfSAlexander V. Chernikov 5061bc0d457SAlexander V. Chernikov /* 5071bc0d457SAlexander V. Chernikov * Adds/updates one or more entries in table @ti. 50871af39bfSAlexander V. Chernikov * 50971af39bfSAlexander V. Chernikov * Function may drop/reacquire UH wlock multiple times due to 51071af39bfSAlexander V. Chernikov * items alloc, algorithm callbacks (check_space), value linkage 51171af39bfSAlexander V. Chernikov * (new values, value storage realloc), etc.. 51271af39bfSAlexander V. Chernikov * Other processes like other adds (which may involve storage resize), 51371af39bfSAlexander V. Chernikov * table swaps (which changes table data and may change algo type), 51471af39bfSAlexander V. Chernikov * table modify (which may change value mask) may be executed 51571af39bfSAlexander V. Chernikov * simultaneously so we need to deal with it. 51671af39bfSAlexander V. Chernikov * 51771af39bfSAlexander V. Chernikov * The following approach was implemented: 51871af39bfSAlexander V. Chernikov * we have per-chain linked list, protected with UH lock. 51971af39bfSAlexander V. Chernikov * add_table_entry prepares special on-stack structure wthich is passed 52071af39bfSAlexander V. Chernikov * to its descendants. Users add this structure to this list before unlock. 52171af39bfSAlexander V. Chernikov * After performing needed operations and acquiring UH lock back, each user 52271af39bfSAlexander V. Chernikov * checks if structure has changed. If true, it rolls local state back and 52371af39bfSAlexander V. Chernikov * returns without error to the caller. 52471af39bfSAlexander V. Chernikov * add_table_entry() on its own checks if structure has changed and restarts 52571af39bfSAlexander V. Chernikov * its operation from the beginning (goto restart). 52671af39bfSAlexander V. Chernikov * 52771af39bfSAlexander V. Chernikov * Functions which are modifying fields of interest (currently 52871af39bfSAlexander V. Chernikov * resize_shared_value_storage() and swap_tables() ) 52971af39bfSAlexander V. Chernikov * traverses given list while holding UH lock immediately before 53071af39bfSAlexander V. Chernikov * performing their operations calling function provided be list entry 53171af39bfSAlexander V. Chernikov * ( currently rollback_add_entry ) which performs rollback for all necessary 53271af39bfSAlexander V. Chernikov * state and sets appropriate values in structure indicating rollback 53371af39bfSAlexander V. Chernikov * has happened. 53471af39bfSAlexander V. Chernikov * 53571af39bfSAlexander V. Chernikov * Algo interaction: 5360468c5baSAlexander V. Chernikov * Function references @ti first to ensure table won't 5370468c5baSAlexander V. Chernikov * disappear or change its type. 5380468c5baSAlexander V. Chernikov * After that, prepare_add callback is called for each @tei entry. 5390468c5baSAlexander V. Chernikov * Next, we try to add each entry under UH+WHLOCK 5400468c5baSAlexander V. Chernikov * using add() callback. 5410468c5baSAlexander V. Chernikov * Finally, we free all state by calling flush_entry callback 5420468c5baSAlexander V. Chernikov * for each @tei. 5431bc0d457SAlexander V. Chernikov * 5441bc0d457SAlexander V. Chernikov * Returns 0 on success. 5451bc0d457SAlexander V. Chernikov */ 5461bc0d457SAlexander V. Chernikov int 5471bc0d457SAlexander V. Chernikov add_table_entry(struct ip_fw_chain *ch, struct tid_info *ti, 5481bc0d457SAlexander V. Chernikov struct tentry_info *tei, uint8_t flags, uint32_t count) 5491bc0d457SAlexander V. Chernikov { 5501bc0d457SAlexander V. Chernikov struct table_config *tc; 5511bc0d457SAlexander V. Chernikov struct table_algo *ta; 5521bc0d457SAlexander V. Chernikov uint16_t kidx; 5531bc0d457SAlexander V. Chernikov int error, first_error, i, rollback; 5541bc0d457SAlexander V. Chernikov uint32_t num, numadd; 5551bc0d457SAlexander V. Chernikov struct tentry_info *ptei; 5560cba2b28SAlexander V. Chernikov struct tableop_state ts; 5571bc0d457SAlexander V. Chernikov char ta_buf[TA_BUF_SZ]; 5581bc0d457SAlexander V. Chernikov caddr_t ta_buf_m, v; 5591bc0d457SAlexander V. Chernikov 5600cba2b28SAlexander V. Chernikov memset(&ts, 0, sizeof(ts)); 561d4e1b515SAlexander V. Chernikov ta = NULL; 5620cba2b28SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 5630cba2b28SAlexander V. Chernikov 5641bc0d457SAlexander V. Chernikov /* 5651bc0d457SAlexander V. Chernikov * Find and reference existing table. 5661bc0d457SAlexander V. Chernikov */ 5670cba2b28SAlexander V. Chernikov restart: 5680cba2b28SAlexander V. Chernikov if (ts.modified != 0) { 5698ebca97fSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 5700cba2b28SAlexander V. Chernikov flush_batch_buffer(ch, ta, tei, count, rollback, 5710cba2b28SAlexander V. Chernikov ta_buf_m, ta_buf); 5720cba2b28SAlexander V. Chernikov memset(&ts, 0, sizeof(ts)); 5738ebca97fSAlexander V. Chernikov ta = NULL; 5748ebca97fSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 5750cba2b28SAlexander V. Chernikov } 5768ebca97fSAlexander V. Chernikov 577867708f7SAlexander V. Chernikov error = find_ref_table(ch, ti, tei, count, OP_ADD, &tc); 578867708f7SAlexander V. Chernikov if (error != 0) { 579867708f7SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 5801bc0d457SAlexander V. Chernikov return (error); 581867708f7SAlexander V. Chernikov } 582867708f7SAlexander V. Chernikov ta = tc->ta; 583fb4b37a3SAlexander V. Chernikov 584fb4b37a3SAlexander V. Chernikov /* Fill in tablestate */ 5850cba2b28SAlexander V. Chernikov ts.ch = ch; 58671af39bfSAlexander V. Chernikov ts.opstate.func = rollback_add_entry; 5870cba2b28SAlexander V. Chernikov ts.tc = tc; 5880cba2b28SAlexander V. Chernikov ts.vshared = tc->vshared; 5890cba2b28SAlexander V. Chernikov ts.vmask = tc->vmask; 5900cba2b28SAlexander V. Chernikov ts.ta = ta; 5910cba2b28SAlexander V. Chernikov ts.tei = tei; 5920cba2b28SAlexander V. Chernikov ts.count = count; 5930cba2b28SAlexander V. Chernikov rollback = 0; 5940cba2b28SAlexander V. Chernikov add_toperation_state(ch, &ts); 595867708f7SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 5961bc0d457SAlexander V. Chernikov 5971bc0d457SAlexander V. Chernikov /* Allocate memory and prepare record(s) */ 5981bc0d457SAlexander V. Chernikov /* Pass stack buffer by default */ 5991bc0d457SAlexander V. Chernikov ta_buf_m = ta_buf; 6004dff4ae0SAlexander V. Chernikov error = prepare_batch_buffer(ch, ta, tei, count, OP_ADD, &ta_buf_m); 6011bc0d457SAlexander V. Chernikov 602b074b7bbSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 603b45fa3faSAlexander V. Chernikov del_toperation_state(ch, &ts); 604c8d5d308SAlexander V. Chernikov /* Drop reference we've used in first search */ 605c8d5d308SAlexander V. Chernikov tc->no.refcnt--; 606c8d5d308SAlexander V. Chernikov 607b45fa3faSAlexander V. Chernikov /* Check prepare_batch_buffer() error */ 608b45fa3faSAlexander V. Chernikov if (error != 0) 609b45fa3faSAlexander V. Chernikov goto cleanup; 610b45fa3faSAlexander V. Chernikov 611b6ee846eSAlexander V. Chernikov /* 6120cba2b28SAlexander V. Chernikov * Check if table swap has happened. 6130cba2b28SAlexander V. Chernikov * (so table algo might be changed). 6140cba2b28SAlexander V. Chernikov * Restart operation to achieve consistent behavior. 615b6ee846eSAlexander V. Chernikov */ 6160cba2b28SAlexander V. Chernikov if (ts.modified != 0) 6170cba2b28SAlexander V. Chernikov goto restart; 618b6ee846eSAlexander V. Chernikov 619c8d5d308SAlexander V. Chernikov /* 6200cba2b28SAlexander V. Chernikov * Link all values values to shared/per-table value array. 6210cba2b28SAlexander V. Chernikov * 6220cba2b28SAlexander V. Chernikov * May release/reacquire UH_WLOCK. 623c8d5d308SAlexander V. Chernikov */ 6240cba2b28SAlexander V. Chernikov error = ipfw_link_table_values(ch, &ts); 6250cba2b28SAlexander V. Chernikov if (error != 0) 626c8d5d308SAlexander V. Chernikov goto cleanup; 6270cba2b28SAlexander V. Chernikov if (ts.modified != 0) 6280cba2b28SAlexander V. Chernikov goto restart; 6290cba2b28SAlexander V. Chernikov 6300cba2b28SAlexander V. Chernikov /* 6310cba2b28SAlexander V. Chernikov * Ensure we are able to add all entries without additional 6320cba2b28SAlexander V. Chernikov * memory allocations. May release/reacquire UH_WLOCK. 6330cba2b28SAlexander V. Chernikov */ 6340cba2b28SAlexander V. Chernikov kidx = tc->no.kidx; 6350cba2b28SAlexander V. Chernikov error = check_table_space(ch, &ts, tc, KIDX_TO_TI(ch, kidx), count); 6360cba2b28SAlexander V. Chernikov if (error != 0) 6370cba2b28SAlexander V. Chernikov goto cleanup; 6380cba2b28SAlexander V. Chernikov if (ts.modified != 0) 6390cba2b28SAlexander V. Chernikov goto restart; 640c8d5d308SAlexander V. Chernikov 6413a845e10SAlexander V. Chernikov /* We've got valid table in @tc. Let's try to add data */ 6429f7d47b0SAlexander V. Chernikov kidx = tc->no.kidx; 6439f7d47b0SAlexander V. Chernikov ta = tc->ta; 6443a845e10SAlexander V. Chernikov numadd = 0; 6453a845e10SAlexander V. Chernikov first_error = 0; 6469f7d47b0SAlexander V. Chernikov 647b074b7bbSAlexander V. Chernikov IPFW_WLOCK(ch); 6483a845e10SAlexander V. Chernikov 6493a845e10SAlexander V. Chernikov v = ta_buf_m; 6501bc0d457SAlexander V. Chernikov for (i = 0; i < count; i++, v += ta->ta_buf_size) { 6513a845e10SAlexander V. Chernikov ptei = &tei[i]; 6523a845e10SAlexander V. Chernikov num = 0; 6533a845e10SAlexander V. Chernikov /* check limit before adding */ 6543a845e10SAlexander V. Chernikov if ((error = check_table_limit(tc, ptei)) == 0) { 6553a845e10SAlexander V. Chernikov error = ta->add(tc->astate, KIDX_TO_TI(ch, kidx), 6563a845e10SAlexander V. Chernikov ptei, v, &num); 6573a845e10SAlexander V. Chernikov /* Set status flag to inform userland */ 658867708f7SAlexander V. Chernikov store_tei_result(ptei, OP_ADD, error, num); 6593a845e10SAlexander V. Chernikov } 6603a845e10SAlexander V. Chernikov if (error == 0) { 6613a845e10SAlexander V. Chernikov /* Update number of records to ease limit checking */ 6623a845e10SAlexander V. Chernikov tc->count += num; 6633a845e10SAlexander V. Chernikov numadd += num; 6643a845e10SAlexander V. Chernikov continue; 6653a845e10SAlexander V. Chernikov } 6663a845e10SAlexander V. Chernikov 6673a845e10SAlexander V. Chernikov if (first_error == 0) 6683a845e10SAlexander V. Chernikov first_error = error; 6693a845e10SAlexander V. Chernikov 6703a845e10SAlexander V. Chernikov /* 6713a845e10SAlexander V. Chernikov * Some error have happened. Check our atomicity 6723a845e10SAlexander V. Chernikov * settings: continue if atomicity is not required, 6733a845e10SAlexander V. Chernikov * rollback changes otherwise. 6743a845e10SAlexander V. Chernikov */ 6753a845e10SAlexander V. Chernikov if ((flags & IPFW_CTF_ATOMIC) == 0) 6763a845e10SAlexander V. Chernikov continue; 6773a845e10SAlexander V. Chernikov 6781bc0d457SAlexander V. Chernikov rollback_added_entries(ch, tc, KIDX_TO_TI(ch, kidx), 6791bc0d457SAlexander V. Chernikov tei, ta_buf_m, count, i); 6800cba2b28SAlexander V. Chernikov 6810cba2b28SAlexander V. Chernikov rollback = 1; 6823a845e10SAlexander V. Chernikov break; 6833a845e10SAlexander V. Chernikov } 6843a845e10SAlexander V. Chernikov 6853b3a8eb9SGleb Smirnoff IPFW_WUNLOCK(ch); 6869f7d47b0SAlexander V. Chernikov 68771af39bfSAlexander V. Chernikov ipfw_garbage_table_values(ch, tc, tei, count, rollback); 6880cba2b28SAlexander V. Chernikov 689b6ee846eSAlexander V. Chernikov /* Permit post-add algorithm grow/rehash. */ 6903a845e10SAlexander V. Chernikov if (numadd != 0) 6910cba2b28SAlexander V. Chernikov check_table_space(ch, NULL, tc, KIDX_TO_TI(ch, kidx), 0); 692b074b7bbSAlexander V. Chernikov 6933a845e10SAlexander V. Chernikov /* Return first error to user, if any */ 6943a845e10SAlexander V. Chernikov error = first_error; 6953a845e10SAlexander V. Chernikov 6963a845e10SAlexander V. Chernikov cleanup: 6970cba2b28SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 6980cba2b28SAlexander V. Chernikov 699867708f7SAlexander V. Chernikov flush_batch_buffer(ch, ta, tei, count, rollback, ta_buf_m, ta_buf); 700b074b7bbSAlexander V. Chernikov 7019f7d47b0SAlexander V. Chernikov return (error); 7023b3a8eb9SGleb Smirnoff } 7033b3a8eb9SGleb Smirnoff 7043a845e10SAlexander V. Chernikov /* 7053a845e10SAlexander V. Chernikov * Deletes one or more entries in table @ti. 7063a845e10SAlexander V. Chernikov * 7073a845e10SAlexander V. Chernikov * Returns 0 on success. 7083a845e10SAlexander V. Chernikov */ 7093b3a8eb9SGleb Smirnoff int 7101832a7b3SAlexander V. Chernikov del_table_entry(struct ip_fw_chain *ch, struct tid_info *ti, 7113a845e10SAlexander V. Chernikov struct tentry_info *tei, uint8_t flags, uint32_t count) 7123b3a8eb9SGleb Smirnoff { 713b074b7bbSAlexander V. Chernikov struct table_config *tc; 7149f7d47b0SAlexander V. Chernikov struct table_algo *ta; 7153a845e10SAlexander V. Chernikov struct tentry_info *ptei; 716b074b7bbSAlexander V. Chernikov uint16_t kidx; 7173a845e10SAlexander V. Chernikov int error, first_error, i; 7183a845e10SAlexander V. Chernikov uint32_t num, numdel; 719b6ee846eSAlexander V. Chernikov char ta_buf[TA_BUF_SZ]; 7203a845e10SAlexander V. Chernikov caddr_t ta_buf_m, v; 7213b3a8eb9SGleb Smirnoff 722db785d31SAlexander V. Chernikov /* 7231bc0d457SAlexander V. Chernikov * Find and reference existing table. 724db785d31SAlexander V. Chernikov */ 725867708f7SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 726867708f7SAlexander V. Chernikov error = find_ref_table(ch, ti, tei, count, OP_DEL, &tc); 727867708f7SAlexander V. Chernikov if (error != 0) { 728867708f7SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 729db785d31SAlexander V. Chernikov return (error); 730867708f7SAlexander V. Chernikov } 731867708f7SAlexander V. Chernikov ta = tc->ta; 732867708f7SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 7333a845e10SAlexander V. Chernikov 73435e1bbd0SAlexander V. Chernikov /* Allocate memory and prepare record(s) */ 7351bc0d457SAlexander V. Chernikov /* Pass stack buffer by default */ 7363a845e10SAlexander V. Chernikov ta_buf_m = ta_buf; 7374dff4ae0SAlexander V. Chernikov error = prepare_batch_buffer(ch, ta, tei, count, OP_DEL, &ta_buf_m); 7383a845e10SAlexander V. Chernikov if (error != 0) 7393a845e10SAlexander V. Chernikov goto cleanup; 7409f7d47b0SAlexander V. Chernikov 7413a845e10SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 7423a845e10SAlexander V. Chernikov 7433a845e10SAlexander V. Chernikov /* Drop reference we've used in first search */ 7443a845e10SAlexander V. Chernikov tc->no.refcnt--; 7453a845e10SAlexander V. Chernikov 746c8d5d308SAlexander V. Chernikov /* 747c8d5d308SAlexander V. Chernikov * Check if table algo is still the same. 748c8d5d308SAlexander V. Chernikov * (changed ta may be the result of table swap). 749c8d5d308SAlexander V. Chernikov */ 750c8d5d308SAlexander V. Chernikov if (ta != tc->ta) { 751c8d5d308SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 752c8d5d308SAlexander V. Chernikov error = EINVAL; 753c8d5d308SAlexander V. Chernikov goto cleanup; 754c8d5d308SAlexander V. Chernikov } 755c8d5d308SAlexander V. Chernikov 756b074b7bbSAlexander V. Chernikov kidx = tc->no.kidx; 7573a845e10SAlexander V. Chernikov numdel = 0; 7583a845e10SAlexander V. Chernikov first_error = 0; 759b074b7bbSAlexander V. Chernikov 760b074b7bbSAlexander V. Chernikov IPFW_WLOCK(ch); 7613a845e10SAlexander V. Chernikov v = ta_buf_m; 7621bc0d457SAlexander V. Chernikov for (i = 0; i < count; i++, v += ta->ta_buf_size) { 7633a845e10SAlexander V. Chernikov ptei = &tei[i]; 7643a845e10SAlexander V. Chernikov num = 0; 7653a845e10SAlexander V. Chernikov error = ta->del(tc->astate, KIDX_TO_TI(ch, kidx), ptei, v, 7663a845e10SAlexander V. Chernikov &num); 7673a845e10SAlexander V. Chernikov /* Save state for userland */ 768867708f7SAlexander V. Chernikov store_tei_result(ptei, OP_DEL, error, num); 7693a845e10SAlexander V. Chernikov if (error != 0 && first_error == 0) 7703a845e10SAlexander V. Chernikov first_error = error; 7713a845e10SAlexander V. Chernikov tc->count -= num; 7723a845e10SAlexander V. Chernikov numdel += num; 7733a845e10SAlexander V. Chernikov } 7743b3a8eb9SGleb Smirnoff IPFW_WUNLOCK(ch); 7753b3a8eb9SGleb Smirnoff 7760cba2b28SAlexander V. Chernikov /* Unlink non-used values */ 77771af39bfSAlexander V. Chernikov ipfw_garbage_table_values(ch, tc, tei, count, 0); 7780cba2b28SAlexander V. Chernikov 7793a845e10SAlexander V. Chernikov if (numdel != 0) { 780b6ee846eSAlexander V. Chernikov /* Run post-del hook to permit shrinking */ 7810cba2b28SAlexander V. Chernikov check_table_space(ch, NULL, tc, KIDX_TO_TI(ch, kidx), 0); 782b6ee846eSAlexander V. Chernikov } 783b074b7bbSAlexander V. Chernikov 7849f7d47b0SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 7853b3a8eb9SGleb Smirnoff 7863a845e10SAlexander V. Chernikov /* Return first error to user, if any */ 7873a845e10SAlexander V. Chernikov error = first_error; 7883a845e10SAlexander V. Chernikov 7893a845e10SAlexander V. Chernikov cleanup: 790867708f7SAlexander V. Chernikov flush_batch_buffer(ch, ta, tei, count, 0, ta_buf_m, ta_buf); 791ac35ff17SAlexander V. Chernikov 792ac35ff17SAlexander V. Chernikov return (error); 793ac35ff17SAlexander V. Chernikov } 794ac35ff17SAlexander V. Chernikov 795db785d31SAlexander V. Chernikov /* 796b6ee846eSAlexander V. Chernikov * Ensure that table @tc has enough space to add @count entries without 797b6ee846eSAlexander V. Chernikov * need for reallocation. 798db785d31SAlexander V. Chernikov * 799db785d31SAlexander V. Chernikov * Callbacks order: 800301290bcSAlexander V. Chernikov * 0) need_modify() (UH_WLOCK) - checks if @count items can be added w/o resize. 801b6ee846eSAlexander V. Chernikov * 802db785d31SAlexander V. Chernikov * 1) alloc_modify (no locks, M_WAITOK) - alloc new state based on @pflags. 803db785d31SAlexander V. Chernikov * 2) prepare_modifyt (UH_WLOCK) - copy old data into new storage 804db785d31SAlexander V. Chernikov * 3) modify (UH_WLOCK + WLOCK) - switch pointers 805b6ee846eSAlexander V. Chernikov * 4) flush_modify (UH_WLOCK) - free state, if needed 806b6ee846eSAlexander V. Chernikov * 807b6ee846eSAlexander V. Chernikov * Returns 0 on success. 808db785d31SAlexander V. Chernikov */ 809db785d31SAlexander V. Chernikov static int 8100cba2b28SAlexander V. Chernikov check_table_space(struct ip_fw_chain *ch, struct tableop_state *ts, 8110cba2b28SAlexander V. Chernikov struct table_config *tc, struct table_info *ti, uint32_t count) 812db785d31SAlexander V. Chernikov { 813b6ee846eSAlexander V. Chernikov struct table_algo *ta; 814b6ee846eSAlexander V. Chernikov uint64_t pflags; 815b6ee846eSAlexander V. Chernikov char ta_buf[TA_BUF_SZ]; 816db785d31SAlexander V. Chernikov int error; 817db785d31SAlexander V. Chernikov 818b6ee846eSAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 819db785d31SAlexander V. Chernikov 820b6ee846eSAlexander V. Chernikov error = 0; 821b6ee846eSAlexander V. Chernikov ta = tc->ta; 822fd0869d5SAlexander V. Chernikov if (ta->need_modify == NULL) 823fd0869d5SAlexander V. Chernikov return (0); 824fd0869d5SAlexander V. Chernikov 825b6ee846eSAlexander V. Chernikov /* Acquire reference not to loose @tc between locks/unlocks */ 826b6ee846eSAlexander V. Chernikov tc->no.refcnt++; 827db785d31SAlexander V. Chernikov 828db785d31SAlexander V. Chernikov /* 829b6ee846eSAlexander V. Chernikov * TODO: think about avoiding race between large add/large delete 830b6ee846eSAlexander V. Chernikov * operation on algorithm which implements shrinking along with 831b6ee846eSAlexander V. Chernikov * growing. 832db785d31SAlexander V. Chernikov */ 833b6ee846eSAlexander V. Chernikov while (true) { 834b6ee846eSAlexander V. Chernikov pflags = 0; 835301290bcSAlexander V. Chernikov if (ta->need_modify(tc->astate, ti, count, &pflags) == 0) { 83635e1bbd0SAlexander V. Chernikov error = 0; 83735e1bbd0SAlexander V. Chernikov break; 838b6ee846eSAlexander V. Chernikov } 839db785d31SAlexander V. Chernikov 840b6ee846eSAlexander V. Chernikov /* We have to shrink/grow table */ 8410cba2b28SAlexander V. Chernikov if (ts != NULL) 8420cba2b28SAlexander V. Chernikov add_toperation_state(ch, ts); 843b6ee846eSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 844b6ee846eSAlexander V. Chernikov 845301290bcSAlexander V. Chernikov memset(&ta_buf, 0, sizeof(ta_buf)); 8460cba2b28SAlexander V. Chernikov error = ta->prepare_mod(ta_buf, &pflags); 847b6ee846eSAlexander V. Chernikov 848b6ee846eSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 8490cba2b28SAlexander V. Chernikov if (ts != NULL) 8500cba2b28SAlexander V. Chernikov del_toperation_state(ch, ts); 8510cba2b28SAlexander V. Chernikov 8520cba2b28SAlexander V. Chernikov if (error != 0) 8530cba2b28SAlexander V. Chernikov break; 8540cba2b28SAlexander V. Chernikov 8550cba2b28SAlexander V. Chernikov if (ts != NULL && ts->modified != 0) { 8560cba2b28SAlexander V. Chernikov 8570cba2b28SAlexander V. Chernikov /* 8580cba2b28SAlexander V. Chernikov * Swap operation has happened 8590cba2b28SAlexander V. Chernikov * so we're currently operating on other 8600cba2b28SAlexander V. Chernikov * table data. Stop doing this. 8610cba2b28SAlexander V. Chernikov */ 8620cba2b28SAlexander V. Chernikov ta->flush_mod(ta_buf); 8630cba2b28SAlexander V. Chernikov break; 8640cba2b28SAlexander V. Chernikov } 865b6ee846eSAlexander V. Chernikov 866b6ee846eSAlexander V. Chernikov /* Check if we still need to alter table */ 867b6ee846eSAlexander V. Chernikov ti = KIDX_TO_TI(ch, tc->no.kidx); 868301290bcSAlexander V. Chernikov if (ta->need_modify(tc->astate, ti, count, &pflags) == 0) { 869301290bcSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 870b6ee846eSAlexander V. Chernikov 871b6ee846eSAlexander V. Chernikov /* 87235e1bbd0SAlexander V. Chernikov * Other thread has already performed resize. 87335e1bbd0SAlexander V. Chernikov * Flush our state and return. 874b6ee846eSAlexander V. Chernikov */ 875b6ee846eSAlexander V. Chernikov ta->flush_mod(ta_buf); 876b6ee846eSAlexander V. Chernikov break; 877b6ee846eSAlexander V. Chernikov } 878b6ee846eSAlexander V. Chernikov 879b6ee846eSAlexander V. Chernikov error = ta->fill_mod(tc->astate, ti, ta_buf, &pflags); 880b6ee846eSAlexander V. Chernikov if (error == 0) { 881db785d31SAlexander V. Chernikov /* Do actual modification */ 882db785d31SAlexander V. Chernikov IPFW_WLOCK(ch); 88368394ec8SAlexander V. Chernikov ta->modify(tc->astate, ti, ta_buf, pflags); 884db785d31SAlexander V. Chernikov IPFW_WUNLOCK(ch); 885db785d31SAlexander V. Chernikov } 886db785d31SAlexander V. Chernikov 887b6ee846eSAlexander V. Chernikov /* Anyway, flush data and retry */ 888db785d31SAlexander V. Chernikov ta->flush_mod(ta_buf); 889b6ee846eSAlexander V. Chernikov } 890db785d31SAlexander V. Chernikov 891b6ee846eSAlexander V. Chernikov tc->no.refcnt--; 892db785d31SAlexander V. Chernikov return (error); 893db785d31SAlexander V. Chernikov } 894db785d31SAlexander V. Chernikov 8953a845e10SAlexander V. Chernikov /* 896ac35ff17SAlexander V. Chernikov * Adds or deletes record in table. 897ac35ff17SAlexander V. Chernikov * Data layout (v0): 898ac35ff17SAlexander V. Chernikov * Request: [ ip_fw3_opheader ipfw_table_xentry ] 899ac35ff17SAlexander V. Chernikov * 900ac35ff17SAlexander V. Chernikov * Returns 0 on success 901ac35ff17SAlexander V. Chernikov */ 902ac35ff17SAlexander V. Chernikov static int 9036b988f3aSAlexander V. Chernikov manage_table_ent_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 904ac35ff17SAlexander V. Chernikov struct sockopt_data *sd) 905ac35ff17SAlexander V. Chernikov { 906ac35ff17SAlexander V. Chernikov ipfw_table_xentry *xent; 907ac35ff17SAlexander V. Chernikov struct tentry_info tei; 908ac35ff17SAlexander V. Chernikov struct tid_info ti; 9090cba2b28SAlexander V. Chernikov struct table_value v; 910ac35ff17SAlexander V. Chernikov int error, hdrlen, read; 911ac35ff17SAlexander V. Chernikov 912ac35ff17SAlexander V. Chernikov hdrlen = offsetof(ipfw_table_xentry, k); 913ac35ff17SAlexander V. Chernikov 914ac35ff17SAlexander V. Chernikov /* Check minimum header size */ 915ac35ff17SAlexander V. Chernikov if (sd->valsize < (sizeof(*op3) + hdrlen)) 916ac35ff17SAlexander V. Chernikov return (EINVAL); 917ac35ff17SAlexander V. Chernikov 918ac35ff17SAlexander V. Chernikov read = sizeof(ip_fw3_opheader); 919ac35ff17SAlexander V. Chernikov 920ac35ff17SAlexander V. Chernikov /* Check if xentry len field is valid */ 921ac35ff17SAlexander V. Chernikov xent = (ipfw_table_xentry *)(op3 + 1); 922ac35ff17SAlexander V. Chernikov if (xent->len < hdrlen || xent->len + read > sd->valsize) 923ac35ff17SAlexander V. Chernikov return (EINVAL); 924ac35ff17SAlexander V. Chernikov 925ac35ff17SAlexander V. Chernikov memset(&tei, 0, sizeof(tei)); 926ac35ff17SAlexander V. Chernikov tei.paddr = &xent->k; 927ac35ff17SAlexander V. Chernikov tei.masklen = xent->masklen; 9280cba2b28SAlexander V. Chernikov ipfw_import_table_value_legacy(xent->value, &v); 9290cba2b28SAlexander V. Chernikov tei.pvalue = &v; 930a4641f4eSPedro F. Giffuni /* Old requests compatibility */ 931db785d31SAlexander V. Chernikov tei.flags = TEI_FLAGS_COMPAT; 932c21034b7SAlexander V. Chernikov if (xent->type == IPFW_TABLE_ADDR) { 933ac35ff17SAlexander V. Chernikov if (xent->len - hdrlen == sizeof(in_addr_t)) 934ac35ff17SAlexander V. Chernikov tei.subtype = AF_INET; 935ac35ff17SAlexander V. Chernikov else 936ac35ff17SAlexander V. Chernikov tei.subtype = AF_INET6; 937ac35ff17SAlexander V. Chernikov } 938ac35ff17SAlexander V. Chernikov 939ac35ff17SAlexander V. Chernikov memset(&ti, 0, sizeof(ti)); 940ac35ff17SAlexander V. Chernikov ti.uidx = xent->tbl; 941ac35ff17SAlexander V. Chernikov ti.type = xent->type; 942ac35ff17SAlexander V. Chernikov 943ac35ff17SAlexander V. Chernikov error = (op3->opcode == IP_FW_TABLE_XADD) ? 9443a845e10SAlexander V. Chernikov add_table_entry(ch, &ti, &tei, 0, 1) : 9453a845e10SAlexander V. Chernikov del_table_entry(ch, &ti, &tei, 0, 1); 946ac35ff17SAlexander V. Chernikov 947ac35ff17SAlexander V. Chernikov return (error); 948ac35ff17SAlexander V. Chernikov } 949ac35ff17SAlexander V. Chernikov 950ac35ff17SAlexander V. Chernikov /* 951ac35ff17SAlexander V. Chernikov * Adds or deletes record in table. 952ac35ff17SAlexander V. Chernikov * Data layout (v1)(current): 953db785d31SAlexander V. Chernikov * Request: [ ipfw_obj_header 954db785d31SAlexander V. Chernikov * ipfw_obj_ctlv(IPFW_TLV_TBLENT_LIST) [ ipfw_obj_tentry x N ] 955db785d31SAlexander V. Chernikov * ] 956ac35ff17SAlexander V. Chernikov * 957ac35ff17SAlexander V. Chernikov * Returns 0 on success 958ac35ff17SAlexander V. Chernikov */ 959ac35ff17SAlexander V. Chernikov static int 9606b988f3aSAlexander V. Chernikov manage_table_ent_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 961ac35ff17SAlexander V. Chernikov struct sockopt_data *sd) 962ac35ff17SAlexander V. Chernikov { 9633a845e10SAlexander V. Chernikov ipfw_obj_tentry *tent, *ptent; 964db785d31SAlexander V. Chernikov ipfw_obj_ctlv *ctlv; 965ac35ff17SAlexander V. Chernikov ipfw_obj_header *oh; 9663a845e10SAlexander V. Chernikov struct tentry_info *ptei, tei, *tei_buf; 967ac35ff17SAlexander V. Chernikov struct tid_info ti; 9683a845e10SAlexander V. Chernikov int error, i, kidx, read; 969ac35ff17SAlexander V. Chernikov 970ac35ff17SAlexander V. Chernikov /* Check minimum header size */ 971db785d31SAlexander V. Chernikov if (sd->valsize < (sizeof(*oh) + sizeof(*ctlv))) 972ac35ff17SAlexander V. Chernikov return (EINVAL); 973ac35ff17SAlexander V. Chernikov 974ac35ff17SAlexander V. Chernikov /* Check if passed data is too long */ 975ac35ff17SAlexander V. Chernikov if (sd->valsize != sd->kavail) 976ac35ff17SAlexander V. Chernikov return (EINVAL); 977ac35ff17SAlexander V. Chernikov 978ac35ff17SAlexander V. Chernikov oh = (ipfw_obj_header *)sd->kbuf; 979ac35ff17SAlexander V. Chernikov 980ac35ff17SAlexander V. Chernikov /* Basic length checks for TLVs */ 981ac35ff17SAlexander V. Chernikov if (oh->ntlv.head.length != sizeof(oh->ntlv)) 982ac35ff17SAlexander V. Chernikov return (EINVAL); 983ac35ff17SAlexander V. Chernikov 984ac35ff17SAlexander V. Chernikov read = sizeof(*oh); 985ac35ff17SAlexander V. Chernikov 986db785d31SAlexander V. Chernikov ctlv = (ipfw_obj_ctlv *)(oh + 1); 987db785d31SAlexander V. Chernikov if (ctlv->head.length + read != sd->valsize) 988db785d31SAlexander V. Chernikov return (EINVAL); 989db785d31SAlexander V. Chernikov 990db785d31SAlexander V. Chernikov read += sizeof(*ctlv); 991db785d31SAlexander V. Chernikov tent = (ipfw_obj_tentry *)(ctlv + 1); 9923a845e10SAlexander V. Chernikov if (ctlv->count * sizeof(*tent) + read != sd->valsize) 993ac35ff17SAlexander V. Chernikov return (EINVAL); 994ac35ff17SAlexander V. Chernikov 9953a845e10SAlexander V. Chernikov if (ctlv->count == 0) 9963a845e10SAlexander V. Chernikov return (0); 997ac35ff17SAlexander V. Chernikov 9983a845e10SAlexander V. Chernikov /* 9993a845e10SAlexander V. Chernikov * Mark entire buffer as "read". 100035e1bbd0SAlexander V. Chernikov * This instructs sopt api write it back 10013a845e10SAlexander V. Chernikov * after function return. 10023a845e10SAlexander V. Chernikov */ 10033a845e10SAlexander V. Chernikov ipfw_get_sopt_header(sd, sd->valsize); 10043a845e10SAlexander V. Chernikov 10053a845e10SAlexander V. Chernikov /* Perform basic checks for each entry */ 10063a845e10SAlexander V. Chernikov ptent = tent; 10073a845e10SAlexander V. Chernikov kidx = tent->idx; 10083a845e10SAlexander V. Chernikov for (i = 0; i < ctlv->count; i++, ptent++) { 10093a845e10SAlexander V. Chernikov if (ptent->head.length != sizeof(*ptent)) 10103a845e10SAlexander V. Chernikov return (EINVAL); 10113a845e10SAlexander V. Chernikov if (ptent->idx != kidx) 10123a845e10SAlexander V. Chernikov return (ENOTSUP); 10133a845e10SAlexander V. Chernikov } 10143a845e10SAlexander V. Chernikov 10153a845e10SAlexander V. Chernikov /* Convert data into kernel request objects */ 101681d3153dSAlexander V. Chernikov objheader_to_ti(oh, &ti); 1017ac35ff17SAlexander V. Chernikov ti.type = oh->ntlv.type; 10183a845e10SAlexander V. Chernikov ti.uidx = kidx; 10193a845e10SAlexander V. Chernikov 10203a845e10SAlexander V. Chernikov /* Use on-stack buffer for single add/del */ 10213a845e10SAlexander V. Chernikov if (ctlv->count == 1) { 10223a845e10SAlexander V. Chernikov memset(&tei, 0, sizeof(tei)); 10233a845e10SAlexander V. Chernikov tei_buf = &tei; 10243a845e10SAlexander V. Chernikov } else 10253a845e10SAlexander V. Chernikov tei_buf = malloc(ctlv->count * sizeof(tei), M_TEMP, 10263a845e10SAlexander V. Chernikov M_WAITOK | M_ZERO); 10273a845e10SAlexander V. Chernikov 10283a845e10SAlexander V. Chernikov ptei = tei_buf; 10293a845e10SAlexander V. Chernikov ptent = tent; 10303a845e10SAlexander V. Chernikov for (i = 0; i < ctlv->count; i++, ptent++, ptei++) { 10313a845e10SAlexander V. Chernikov ptei->paddr = &ptent->k; 10323a845e10SAlexander V. Chernikov ptei->subtype = ptent->subtype; 10333a845e10SAlexander V. Chernikov ptei->masklen = ptent->masklen; 10343a845e10SAlexander V. Chernikov if (ptent->head.flags & IPFW_TF_UPDATE) 10353a845e10SAlexander V. Chernikov ptei->flags |= TEI_FLAGS_UPDATE; 10360cba2b28SAlexander V. Chernikov 10370cba2b28SAlexander V. Chernikov ipfw_import_table_value_v1(&ptent->v.value); 10380cba2b28SAlexander V. Chernikov ptei->pvalue = (struct table_value *)&ptent->v.value; 10393a845e10SAlexander V. Chernikov } 1040ac35ff17SAlexander V. Chernikov 1041ac35ff17SAlexander V. Chernikov error = (oh->opheader.opcode == IP_FW_TABLE_XADD) ? 10423a845e10SAlexander V. Chernikov add_table_entry(ch, &ti, tei_buf, ctlv->flags, ctlv->count) : 10433a845e10SAlexander V. Chernikov del_table_entry(ch, &ti, tei_buf, ctlv->flags, ctlv->count); 10443a845e10SAlexander V. Chernikov 10453a845e10SAlexander V. Chernikov /* Translate result back to userland */ 10463a845e10SAlexander V. Chernikov ptei = tei_buf; 10473a845e10SAlexander V. Chernikov ptent = tent; 10483a845e10SAlexander V. Chernikov for (i = 0; i < ctlv->count; i++, ptent++, ptei++) { 10493a845e10SAlexander V. Chernikov if (ptei->flags & TEI_FLAGS_ADDED) 10503a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_ADDED; 10513a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_DELETED) 10523a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_DELETED; 10533a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_UPDATED) 10543a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_UPDATED; 10553a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_LIMIT) 10563a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_LIMIT; 10573a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_ERROR) 10583a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_ERROR; 10593a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_NOTFOUND) 10603a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_NOTFOUND; 10613a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_EXISTS) 10623a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_EXISTS; 10630cba2b28SAlexander V. Chernikov ipfw_export_table_value_v1(ptei->pvalue, &ptent->v.value); 10643a845e10SAlexander V. Chernikov } 10653a845e10SAlexander V. Chernikov 10663a845e10SAlexander V. Chernikov if (tei_buf != &tei) 10673a845e10SAlexander V. Chernikov free(tei_buf, M_TEMP); 1068ac35ff17SAlexander V. Chernikov 1069ac35ff17SAlexander V. Chernikov return (error); 1070ac35ff17SAlexander V. Chernikov } 1071ac35ff17SAlexander V. Chernikov 107281d3153dSAlexander V. Chernikov /* 107381d3153dSAlexander V. Chernikov * Looks up an entry in given table. 107481d3153dSAlexander V. Chernikov * Data layout (v0)(current): 107581d3153dSAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_obj_tentry ] 107681d3153dSAlexander V. Chernikov * Reply: [ ipfw_obj_header ipfw_obj_tentry ] 107781d3153dSAlexander V. Chernikov * 107881d3153dSAlexander V. Chernikov * Returns 0 on success 107981d3153dSAlexander V. Chernikov */ 10806b988f3aSAlexander V. Chernikov static int 10816b988f3aSAlexander V. Chernikov find_table_entry(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 108281d3153dSAlexander V. Chernikov struct sockopt_data *sd) 108381d3153dSAlexander V. Chernikov { 108481d3153dSAlexander V. Chernikov ipfw_obj_tentry *tent; 108581d3153dSAlexander V. Chernikov ipfw_obj_header *oh; 108681d3153dSAlexander V. Chernikov struct tid_info ti; 108781d3153dSAlexander V. Chernikov struct table_config *tc; 108881d3153dSAlexander V. Chernikov struct table_algo *ta; 108981d3153dSAlexander V. Chernikov struct table_info *kti; 109081d3153dSAlexander V. Chernikov struct namedobj_instance *ni; 1091914bffb6SAlexander V. Chernikov int error; 109281d3153dSAlexander V. Chernikov size_t sz; 109381d3153dSAlexander V. Chernikov 109481d3153dSAlexander V. Chernikov /* Check minimum header size */ 109581d3153dSAlexander V. Chernikov sz = sizeof(*oh) + sizeof(*tent); 109681d3153dSAlexander V. Chernikov if (sd->valsize != sz) 109781d3153dSAlexander V. Chernikov return (EINVAL); 109881d3153dSAlexander V. Chernikov 109981d3153dSAlexander V. Chernikov oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 110081d3153dSAlexander V. Chernikov tent = (ipfw_obj_tentry *)(oh + 1); 110181d3153dSAlexander V. Chernikov 110281d3153dSAlexander V. Chernikov /* Basic length checks for TLVs */ 110381d3153dSAlexander V. Chernikov if (oh->ntlv.head.length != sizeof(oh->ntlv)) 110481d3153dSAlexander V. Chernikov return (EINVAL); 110581d3153dSAlexander V. Chernikov 110681d3153dSAlexander V. Chernikov objheader_to_ti(oh, &ti); 110781d3153dSAlexander V. Chernikov ti.type = oh->ntlv.type; 110881d3153dSAlexander V. Chernikov ti.uidx = tent->idx; 110981d3153dSAlexander V. Chernikov 111081d3153dSAlexander V. Chernikov IPFW_UH_RLOCK(ch); 111181d3153dSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 111281d3153dSAlexander V. Chernikov 111381d3153dSAlexander V. Chernikov /* 111481d3153dSAlexander V. Chernikov * Find existing table and check its type . 111581d3153dSAlexander V. Chernikov */ 111681d3153dSAlexander V. Chernikov ta = NULL; 111781d3153dSAlexander V. Chernikov if ((tc = find_table(ni, &ti)) == NULL) { 111881d3153dSAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 111981d3153dSAlexander V. Chernikov return (ESRCH); 112081d3153dSAlexander V. Chernikov } 112181d3153dSAlexander V. Chernikov 112281d3153dSAlexander V. Chernikov /* check table type */ 112374b22066SAlexander V. Chernikov if (tc->no.subtype != ti.type) { 112481d3153dSAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 112581d3153dSAlexander V. Chernikov return (EINVAL); 112681d3153dSAlexander V. Chernikov } 112781d3153dSAlexander V. Chernikov 112881d3153dSAlexander V. Chernikov kti = KIDX_TO_TI(ch, tc->no.kidx); 112981d3153dSAlexander V. Chernikov ta = tc->ta; 113081d3153dSAlexander V. Chernikov 1131914bffb6SAlexander V. Chernikov if (ta->find_tentry == NULL) 1132914bffb6SAlexander V. Chernikov return (ENOTSUP); 1133914bffb6SAlexander V. Chernikov 1134914bffb6SAlexander V. Chernikov error = ta->find_tentry(tc->astate, kti, tent); 113581d3153dSAlexander V. Chernikov 113681d3153dSAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 113781d3153dSAlexander V. Chernikov 113881d3153dSAlexander V. Chernikov return (error); 113981d3153dSAlexander V. Chernikov } 114081d3153dSAlexander V. Chernikov 114146d52008SAlexander V. Chernikov /* 114246d52008SAlexander V. Chernikov * Flushes all entries or destroys given table. 114346d52008SAlexander V. Chernikov * Data layout (v0)(current): 114446d52008SAlexander V. Chernikov * Request: [ ipfw_obj_header ] 114546d52008SAlexander V. Chernikov * 114646d52008SAlexander V. Chernikov * Returns 0 on success 114746d52008SAlexander V. Chernikov */ 11486b988f3aSAlexander V. Chernikov static int 11496b988f3aSAlexander V. Chernikov flush_table_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1150ac35ff17SAlexander V. Chernikov struct sockopt_data *sd) 1151ac35ff17SAlexander V. Chernikov { 1152ac35ff17SAlexander V. Chernikov int error; 1153ac35ff17SAlexander V. Chernikov struct _ipfw_obj_header *oh; 1154ac35ff17SAlexander V. Chernikov struct tid_info ti; 1155ac35ff17SAlexander V. Chernikov 1156ac35ff17SAlexander V. Chernikov if (sd->valsize != sizeof(*oh)) 1157ac35ff17SAlexander V. Chernikov return (EINVAL); 1158ac35ff17SAlexander V. Chernikov 1159ac35ff17SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)op3; 1160ac35ff17SAlexander V. Chernikov objheader_to_ti(oh, &ti); 1161ac35ff17SAlexander V. Chernikov 11621832a7b3SAlexander V. Chernikov if (op3->opcode == IP_FW_TABLE_XDESTROY) 1163ac35ff17SAlexander V. Chernikov error = destroy_table(ch, &ti); 11641832a7b3SAlexander V. Chernikov else if (op3->opcode == IP_FW_TABLE_XFLUSH) 1165ac35ff17SAlexander V. Chernikov error = flush_table(ch, &ti); 1166ac35ff17SAlexander V. Chernikov else 1167ac35ff17SAlexander V. Chernikov return (ENOTSUP); 1168ac35ff17SAlexander V. Chernikov 1169ac35ff17SAlexander V. Chernikov return (error); 11703b3a8eb9SGleb Smirnoff } 11713b3a8eb9SGleb Smirnoff 1172fb4b37a3SAlexander V. Chernikov static void 1173fb4b37a3SAlexander V. Chernikov restart_flush(void *object, struct op_state *_state) 1174fb4b37a3SAlexander V. Chernikov { 1175fb4b37a3SAlexander V. Chernikov struct tableop_state *ts; 1176fb4b37a3SAlexander V. Chernikov 1177fb4b37a3SAlexander V. Chernikov ts = (struct tableop_state *)_state; 1178fb4b37a3SAlexander V. Chernikov 1179fb4b37a3SAlexander V. Chernikov if (ts->tc != object) 1180fb4b37a3SAlexander V. Chernikov return; 1181fb4b37a3SAlexander V. Chernikov 1182fb4b37a3SAlexander V. Chernikov /* Indicate we've called */ 1183fb4b37a3SAlexander V. Chernikov ts->modified = 1; 1184fb4b37a3SAlexander V. Chernikov } 1185fb4b37a3SAlexander V. Chernikov 118635e1bbd0SAlexander V. Chernikov /* 118735e1bbd0SAlexander V. Chernikov * Flushes given table. 118835e1bbd0SAlexander V. Chernikov * 118935e1bbd0SAlexander V. Chernikov * Function create new table instance with the same 119035e1bbd0SAlexander V. Chernikov * parameters, swaps it with old one and 1191fb4b37a3SAlexander V. Chernikov * flushes state without holding runtime WLOCK. 119235e1bbd0SAlexander V. Chernikov * 119335e1bbd0SAlexander V. Chernikov * Returns 0 on success. 119435e1bbd0SAlexander V. Chernikov */ 11951832a7b3SAlexander V. Chernikov int 1196ac35ff17SAlexander V. Chernikov flush_table(struct ip_fw_chain *ch, struct tid_info *ti) 11973b3a8eb9SGleb Smirnoff { 1198b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 1199b074b7bbSAlexander V. Chernikov struct table_config *tc; 12009f7d47b0SAlexander V. Chernikov struct table_algo *ta; 12019f7d47b0SAlexander V. Chernikov struct table_info ti_old, ti_new, *tablestate; 12029f7d47b0SAlexander V. Chernikov void *astate_old, *astate_new; 1203914bffb6SAlexander V. Chernikov char algostate[64], *pstate; 1204fb4b37a3SAlexander V. Chernikov struct tableop_state ts; 12050caab009SAlexander V. Chernikov int error, need_gc; 1206b074b7bbSAlexander V. Chernikov uint16_t kidx; 1207914bffb6SAlexander V. Chernikov uint8_t tflags; 12083b3a8eb9SGleb Smirnoff 12093b3a8eb9SGleb Smirnoff /* 1210a4641f4eSPedro F. Giffuni * Stage 1: save table algorithm. 1211b074b7bbSAlexander V. Chernikov * Reference found table to ensure it won't disappear. 12123b3a8eb9SGleb Smirnoff */ 1213b074b7bbSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1214b074b7bbSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1215b074b7bbSAlexander V. Chernikov if ((tc = find_table(ni, ti)) == NULL) { 1216b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1217b074b7bbSAlexander V. Chernikov return (ESRCH); 1218b074b7bbSAlexander V. Chernikov } 12190caab009SAlexander V. Chernikov need_gc = 0; 12200caab009SAlexander V. Chernikov astate_new = NULL; 12210caab009SAlexander V. Chernikov memset(&ti_new, 0, sizeof(ti_new)); 1222fb4b37a3SAlexander V. Chernikov restart: 1223fb4b37a3SAlexander V. Chernikov /* Set up swap handler */ 1224fb4b37a3SAlexander V. Chernikov memset(&ts, 0, sizeof(ts)); 1225fb4b37a3SAlexander V. Chernikov ts.opstate.func = restart_flush; 1226fb4b37a3SAlexander V. Chernikov ts.tc = tc; 1227fb4b37a3SAlexander V. Chernikov 12289f7d47b0SAlexander V. Chernikov ta = tc->ta; 1229fd0869d5SAlexander V. Chernikov /* Do not flush readonly tables */ 1230fd0869d5SAlexander V. Chernikov if ((ta->flags & TA_FLAG_READONLY) != 0) { 1231fd0869d5SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1232fd0869d5SAlexander V. Chernikov return (EACCES); 1233fd0869d5SAlexander V. Chernikov } 123435e1bbd0SAlexander V. Chernikov /* Save startup algo parameters */ 1235daabb523SAlexander V. Chernikov if (ta->print_config != NULL) { 1236daabb523SAlexander V. Chernikov ta->print_config(tc->astate, KIDX_TO_TI(ch, tc->no.kidx), 1237daabb523SAlexander V. Chernikov algostate, sizeof(algostate)); 1238daabb523SAlexander V. Chernikov pstate = algostate; 1239daabb523SAlexander V. Chernikov } else 1240daabb523SAlexander V. Chernikov pstate = NULL; 1241914bffb6SAlexander V. Chernikov tflags = tc->tflags; 1242fb4b37a3SAlexander V. Chernikov tc->no.refcnt++; 1243fb4b37a3SAlexander V. Chernikov add_toperation_state(ch, &ts); 1244b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 12453b3a8eb9SGleb Smirnoff 1246b074b7bbSAlexander V. Chernikov /* 12470caab009SAlexander V. Chernikov * Stage 1.5: if this is not the first attempt, destroy previous state 12480caab009SAlexander V. Chernikov */ 12490caab009SAlexander V. Chernikov if (need_gc != 0) { 12500caab009SAlexander V. Chernikov ta->destroy(astate_new, &ti_new); 12510caab009SAlexander V. Chernikov need_gc = 0; 12520caab009SAlexander V. Chernikov } 12530caab009SAlexander V. Chernikov 12540caab009SAlexander V. Chernikov /* 12559f7d47b0SAlexander V. Chernikov * Stage 2: allocate new table instance using same algo. 1256b074b7bbSAlexander V. Chernikov */ 12579f7d47b0SAlexander V. Chernikov memset(&ti_new, 0, sizeof(struct table_info)); 1258fb4b37a3SAlexander V. Chernikov error = ta->init(ch, &astate_new, &ti_new, pstate, tflags); 1259b074b7bbSAlexander V. Chernikov 1260b074b7bbSAlexander V. Chernikov /* 1261b074b7bbSAlexander V. Chernikov * Stage 3: swap old state pointers with newly-allocated ones. 1262b074b7bbSAlexander V. Chernikov * Decrease refcount. 1263b074b7bbSAlexander V. Chernikov */ 1264b074b7bbSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1265fb4b37a3SAlexander V. Chernikov tc->no.refcnt--; 1266fb4b37a3SAlexander V. Chernikov del_toperation_state(ch, &ts); 1267fb4b37a3SAlexander V. Chernikov 1268fb4b37a3SAlexander V. Chernikov if (error != 0) { 1269fb4b37a3SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1270fb4b37a3SAlexander V. Chernikov return (error); 1271fb4b37a3SAlexander V. Chernikov } 1272fb4b37a3SAlexander V. Chernikov 1273fb4b37a3SAlexander V. Chernikov /* 1274fb4b37a3SAlexander V. Chernikov * Restart operation if table swap has happened: 1275fb4b37a3SAlexander V. Chernikov * even if algo may be the same, algo init parameters 1276fb4b37a3SAlexander V. Chernikov * may change. Restart operation instead of doing 1277fb4b37a3SAlexander V. Chernikov * complex checks. 1278fb4b37a3SAlexander V. Chernikov */ 1279fb4b37a3SAlexander V. Chernikov if (ts.modified != 0) { 12800caab009SAlexander V. Chernikov /* Delay destroying data since we're holding UH lock */ 12810caab009SAlexander V. Chernikov need_gc = 1; 1282fb4b37a3SAlexander V. Chernikov goto restart; 1283fb4b37a3SAlexander V. Chernikov } 1284b074b7bbSAlexander V. Chernikov 1285b074b7bbSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1286b074b7bbSAlexander V. Chernikov kidx = tc->no.kidx; 12879f7d47b0SAlexander V. Chernikov tablestate = (struct table_info *)ch->tablestate; 1288b074b7bbSAlexander V. Chernikov 12899f7d47b0SAlexander V. Chernikov IPFW_WLOCK(ch); 12909f7d47b0SAlexander V. Chernikov ti_old = tablestate[kidx]; 12919f7d47b0SAlexander V. Chernikov tablestate[kidx] = ti_new; 12929f7d47b0SAlexander V. Chernikov IPFW_WUNLOCK(ch); 1293b074b7bbSAlexander V. Chernikov 12949f7d47b0SAlexander V. Chernikov astate_old = tc->astate; 12959f7d47b0SAlexander V. Chernikov tc->astate = astate_new; 12964c060d85SAlexander V. Chernikov tc->ti_copy = ti_new; 12979f7d47b0SAlexander V. Chernikov tc->count = 0; 1298b074b7bbSAlexander V. Chernikov 129979e86902SAlexander V. Chernikov /* Notify algo on real @ti address */ 130079e86902SAlexander V. Chernikov if (ta->change_ti != NULL) 130179e86902SAlexander V. Chernikov ta->change_ti(tc->astate, &tablestate[kidx]); 130279e86902SAlexander V. Chernikov 13030cba2b28SAlexander V. Chernikov /* 13040cba2b28SAlexander V. Chernikov * Stage 4: unref values. 13050cba2b28SAlexander V. Chernikov */ 13060cba2b28SAlexander V. Chernikov ipfw_unref_table_values(ch, tc, ta, astate_old, &ti_old); 1307b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 13083b3a8eb9SGleb Smirnoff 1309b074b7bbSAlexander V. Chernikov /* 13100cba2b28SAlexander V. Chernikov * Stage 5: perform real flush/destroy. 1311b074b7bbSAlexander V. Chernikov */ 13129f7d47b0SAlexander V. Chernikov ta->destroy(astate_old, &ti_old); 13133b3a8eb9SGleb Smirnoff 13143b3a8eb9SGleb Smirnoff return (0); 13153b3a8eb9SGleb Smirnoff } 13163b3a8eb9SGleb Smirnoff 1317b074b7bbSAlexander V. Chernikov /* 131846d52008SAlexander V. Chernikov * Swaps two tables. 131946d52008SAlexander V. Chernikov * Data layout (v0)(current): 132046d52008SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_obj_ntlv ] 132146d52008SAlexander V. Chernikov * 132246d52008SAlexander V. Chernikov * Returns 0 on success 132346d52008SAlexander V. Chernikov */ 13246b988f3aSAlexander V. Chernikov static int 13256b988f3aSAlexander V. Chernikov swap_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 132646d52008SAlexander V. Chernikov struct sockopt_data *sd) 132746d52008SAlexander V. Chernikov { 132846d52008SAlexander V. Chernikov int error; 132946d52008SAlexander V. Chernikov struct _ipfw_obj_header *oh; 133046d52008SAlexander V. Chernikov struct tid_info ti_a, ti_b; 133146d52008SAlexander V. Chernikov 133246d52008SAlexander V. Chernikov if (sd->valsize != sizeof(*oh) + sizeof(ipfw_obj_ntlv)) 133346d52008SAlexander V. Chernikov return (EINVAL); 133446d52008SAlexander V. Chernikov 133546d52008SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)op3; 133646d52008SAlexander V. Chernikov ntlv_to_ti(&oh->ntlv, &ti_a); 133746d52008SAlexander V. Chernikov ntlv_to_ti((ipfw_obj_ntlv *)(oh + 1), &ti_b); 133846d52008SAlexander V. Chernikov 1339a73d728dSAlexander V. Chernikov error = swap_tables(ch, &ti_a, &ti_b); 134046d52008SAlexander V. Chernikov 134146d52008SAlexander V. Chernikov return (error); 134246d52008SAlexander V. Chernikov } 134346d52008SAlexander V. Chernikov 134435e1bbd0SAlexander V. Chernikov /* 134535e1bbd0SAlexander V. Chernikov * Swaps two tables of the same type/valtype. 134635e1bbd0SAlexander V. Chernikov * 134735e1bbd0SAlexander V. Chernikov * Checks if tables are compatible and limits 1348c8d5d308SAlexander V. Chernikov * permits swap, than actually perform swap. 134935e1bbd0SAlexander V. Chernikov * 1350c8d5d308SAlexander V. Chernikov * Each table consists of 2 different parts: 1351c8d5d308SAlexander V. Chernikov * config: 1352c8d5d308SAlexander V. Chernikov * @tc (with name, set, kidx) and rule bindings, which is "stable". 1353c8d5d308SAlexander V. Chernikov * number of items 1354c8d5d308SAlexander V. Chernikov * table algo 1355c8d5d308SAlexander V. Chernikov * runtime: 1356c8d5d308SAlexander V. Chernikov * runtime data @ti (ch->tablestate) 1357c8d5d308SAlexander V. Chernikov * runtime cache in @tc 1358c8d5d308SAlexander V. Chernikov * algo-specific data (@tc->astate) 1359c8d5d308SAlexander V. Chernikov * 1360c8d5d308SAlexander V. Chernikov * So we switch: 1361c8d5d308SAlexander V. Chernikov * all runtime data 1362c8d5d308SAlexander V. Chernikov * number of items 1363c8d5d308SAlexander V. Chernikov * table algo 1364c8d5d308SAlexander V. Chernikov * 1365c8d5d308SAlexander V. Chernikov * After that we call @ti change handler for each table. 1366c8d5d308SAlexander V. Chernikov * 1367c8d5d308SAlexander V. Chernikov * Note that referencing @tc won't protect tc->ta from change. 1368c8d5d308SAlexander V. Chernikov * XXX: Do we need to restrict swap between locked tables? 1369c8d5d308SAlexander V. Chernikov * XXX: Do we need to exchange ftype? 137035e1bbd0SAlexander V. Chernikov * 137135e1bbd0SAlexander V. Chernikov * Returns 0 on success. 137235e1bbd0SAlexander V. Chernikov */ 137346d52008SAlexander V. Chernikov static int 1374a73d728dSAlexander V. Chernikov swap_tables(struct ip_fw_chain *ch, struct tid_info *a, 137546d52008SAlexander V. Chernikov struct tid_info *b) 137646d52008SAlexander V. Chernikov { 137746d52008SAlexander V. Chernikov struct namedobj_instance *ni; 137846d52008SAlexander V. Chernikov struct table_config *tc_a, *tc_b; 137946d52008SAlexander V. Chernikov struct table_algo *ta; 138046d52008SAlexander V. Chernikov struct table_info ti, *tablestate; 138146d52008SAlexander V. Chernikov void *astate; 138246d52008SAlexander V. Chernikov uint32_t count; 138346d52008SAlexander V. Chernikov 138446d52008SAlexander V. Chernikov /* 138546d52008SAlexander V. Chernikov * Stage 1: find both tables and ensure they are of 138635e1bbd0SAlexander V. Chernikov * the same type. 138746d52008SAlexander V. Chernikov */ 138846d52008SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 138946d52008SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 139046d52008SAlexander V. Chernikov if ((tc_a = find_table(ni, a)) == NULL) { 139146d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 139246d52008SAlexander V. Chernikov return (ESRCH); 139346d52008SAlexander V. Chernikov } 139446d52008SAlexander V. Chernikov if ((tc_b = find_table(ni, b)) == NULL) { 139546d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 139646d52008SAlexander V. Chernikov return (ESRCH); 139746d52008SAlexander V. Chernikov } 139846d52008SAlexander V. Chernikov 139946d52008SAlexander V. Chernikov /* It is very easy to swap between the same table */ 140046d52008SAlexander V. Chernikov if (tc_a == tc_b) { 140146d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 140246d52008SAlexander V. Chernikov return (0); 140346d52008SAlexander V. Chernikov } 140446d52008SAlexander V. Chernikov 140546d52008SAlexander V. Chernikov /* Check type and value are the same */ 140674b22066SAlexander V. Chernikov if (tc_a->no.subtype!=tc_b->no.subtype || tc_a->tflags!=tc_b->tflags) { 140746d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 140846d52008SAlexander V. Chernikov return (EINVAL); 140946d52008SAlexander V. Chernikov } 141046d52008SAlexander V. Chernikov 141146d52008SAlexander V. Chernikov /* Check limits before swap */ 141246d52008SAlexander V. Chernikov if ((tc_a->limit != 0 && tc_b->count > tc_a->limit) || 141346d52008SAlexander V. Chernikov (tc_b->limit != 0 && tc_a->count > tc_b->limit)) { 141446d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 141546d52008SAlexander V. Chernikov return (EFBIG); 141646d52008SAlexander V. Chernikov } 141746d52008SAlexander V. Chernikov 1418fd0869d5SAlexander V. Chernikov /* Check if one of the tables is readonly */ 1419fd0869d5SAlexander V. Chernikov if (((tc_a->ta->flags | tc_b->ta->flags) & TA_FLAG_READONLY) != 0) { 1420fd0869d5SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1421fd0869d5SAlexander V. Chernikov return (EACCES); 1422fd0869d5SAlexander V. Chernikov } 1423fd0869d5SAlexander V. Chernikov 14240cba2b28SAlexander V. Chernikov /* Notify we're going to swap */ 14250cba2b28SAlexander V. Chernikov rollback_toperation_state(ch, tc_a); 14260cba2b28SAlexander V. Chernikov rollback_toperation_state(ch, tc_b); 14270cba2b28SAlexander V. Chernikov 142846d52008SAlexander V. Chernikov /* Everything is fine, prepare to swap */ 142946d52008SAlexander V. Chernikov tablestate = (struct table_info *)ch->tablestate; 143046d52008SAlexander V. Chernikov ti = tablestate[tc_a->no.kidx]; 143146d52008SAlexander V. Chernikov ta = tc_a->ta; 143246d52008SAlexander V. Chernikov astate = tc_a->astate; 143346d52008SAlexander V. Chernikov count = tc_a->count; 143446d52008SAlexander V. Chernikov 143546d52008SAlexander V. Chernikov IPFW_WLOCK(ch); 143646d52008SAlexander V. Chernikov /* a <- b */ 143746d52008SAlexander V. Chernikov tablestate[tc_a->no.kidx] = tablestate[tc_b->no.kidx]; 143846d52008SAlexander V. Chernikov tc_a->ta = tc_b->ta; 143946d52008SAlexander V. Chernikov tc_a->astate = tc_b->astate; 144046d52008SAlexander V. Chernikov tc_a->count = tc_b->count; 144146d52008SAlexander V. Chernikov /* b <- a */ 144246d52008SAlexander V. Chernikov tablestate[tc_b->no.kidx] = ti; 144346d52008SAlexander V. Chernikov tc_b->ta = ta; 144446d52008SAlexander V. Chernikov tc_b->astate = astate; 144546d52008SAlexander V. Chernikov tc_b->count = count; 144646d52008SAlexander V. Chernikov IPFW_WUNLOCK(ch); 144746d52008SAlexander V. Chernikov 144846d52008SAlexander V. Chernikov /* Ensure tc.ti copies are in sync */ 14494c060d85SAlexander V. Chernikov tc_a->ti_copy = tablestate[tc_a->no.kidx]; 14504c060d85SAlexander V. Chernikov tc_b->ti_copy = tablestate[tc_b->no.kidx]; 145146d52008SAlexander V. Chernikov 145246d52008SAlexander V. Chernikov /* Notify both tables on @ti change */ 145346d52008SAlexander V. Chernikov if (tc_a->ta->change_ti != NULL) 145446d52008SAlexander V. Chernikov tc_a->ta->change_ti(tc_a->astate, &tablestate[tc_a->no.kidx]); 145546d52008SAlexander V. Chernikov if (tc_b->ta->change_ti != NULL) 145646d52008SAlexander V. Chernikov tc_b->ta->change_ti(tc_b->astate, &tablestate[tc_b->no.kidx]); 145746d52008SAlexander V. Chernikov 145846d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 145946d52008SAlexander V. Chernikov 146046d52008SAlexander V. Chernikov return (0); 146146d52008SAlexander V. Chernikov } 146246d52008SAlexander V. Chernikov 146346d52008SAlexander V. Chernikov /* 14649f7d47b0SAlexander V. Chernikov * Destroys table specified by @ti. 1465ac35ff17SAlexander V. Chernikov * Data layout (v0)(current): 1466ac35ff17SAlexander V. Chernikov * Request: [ ip_fw3_opheader ] 1467ac35ff17SAlexander V. Chernikov * 1468ac35ff17SAlexander V. Chernikov * Returns 0 on success 1469b074b7bbSAlexander V. Chernikov */ 1470ac35ff17SAlexander V. Chernikov static int 1471ac35ff17SAlexander V. Chernikov destroy_table(struct ip_fw_chain *ch, struct tid_info *ti) 1472b074b7bbSAlexander V. Chernikov { 1473b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 1474b074b7bbSAlexander V. Chernikov struct table_config *tc; 1475b074b7bbSAlexander V. Chernikov 1476b074b7bbSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1477b074b7bbSAlexander V. Chernikov 1478b074b7bbSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1479b074b7bbSAlexander V. Chernikov if ((tc = find_table(ni, ti)) == NULL) { 1480b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1481b074b7bbSAlexander V. Chernikov return (ESRCH); 1482b074b7bbSAlexander V. Chernikov } 1483b074b7bbSAlexander V. Chernikov 14849f7d47b0SAlexander V. Chernikov /* Do not permit destroying referenced tables */ 14859f7d47b0SAlexander V. Chernikov if (tc->no.refcnt > 0) { 1486b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1487b074b7bbSAlexander V. Chernikov return (EBUSY); 1488b074b7bbSAlexander V. Chernikov } 1489b074b7bbSAlexander V. Chernikov 1490b074b7bbSAlexander V. Chernikov IPFW_WLOCK(ch); 1491b074b7bbSAlexander V. Chernikov unlink_table(ch, tc); 1492b074b7bbSAlexander V. Chernikov IPFW_WUNLOCK(ch); 1493b074b7bbSAlexander V. Chernikov 1494b074b7bbSAlexander V. Chernikov /* Free obj index */ 1495ac35ff17SAlexander V. Chernikov if (ipfw_objhash_free_idx(ni, tc->no.kidx) != 0) 1496b074b7bbSAlexander V. Chernikov printf("Error unlinking kidx %d from table %s\n", 1497b074b7bbSAlexander V. Chernikov tc->no.kidx, tc->tablename); 1498b074b7bbSAlexander V. Chernikov 14990cba2b28SAlexander V. Chernikov /* Unref values used in tables while holding UH lock */ 15004c060d85SAlexander V. Chernikov ipfw_unref_table_values(ch, tc, tc->ta, tc->astate, &tc->ti_copy); 1501b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1502b074b7bbSAlexander V. Chernikov 1503b074b7bbSAlexander V. Chernikov free_table_config(ni, tc); 1504b074b7bbSAlexander V. Chernikov 1505b074b7bbSAlexander V. Chernikov return (0); 1506b074b7bbSAlexander V. Chernikov } 1507b074b7bbSAlexander V. Chernikov 15084040f4ecSAlexander V. Chernikov static uint32_t 15094040f4ecSAlexander V. Chernikov roundup2p(uint32_t v) 15104040f4ecSAlexander V. Chernikov { 15114040f4ecSAlexander V. Chernikov 15124040f4ecSAlexander V. Chernikov v--; 15134040f4ecSAlexander V. Chernikov v |= v >> 1; 15144040f4ecSAlexander V. Chernikov v |= v >> 2; 15154040f4ecSAlexander V. Chernikov v |= v >> 4; 15164040f4ecSAlexander V. Chernikov v |= v >> 8; 15174040f4ecSAlexander V. Chernikov v |= v >> 16; 15184040f4ecSAlexander V. Chernikov v++; 15194040f4ecSAlexander V. Chernikov 15204040f4ecSAlexander V. Chernikov return (v); 15214040f4ecSAlexander V. Chernikov } 15224040f4ecSAlexander V. Chernikov 152335e1bbd0SAlexander V. Chernikov /* 152435e1bbd0SAlexander V. Chernikov * Grow tables index. 152535e1bbd0SAlexander V. Chernikov * 152635e1bbd0SAlexander V. Chernikov * Returns 0 on success. 152735e1bbd0SAlexander V. Chernikov */ 15283b3a8eb9SGleb Smirnoff int 15293b3a8eb9SGleb Smirnoff ipfw_resize_tables(struct ip_fw_chain *ch, unsigned int ntables) 15303b3a8eb9SGleb Smirnoff { 15313b3a8eb9SGleb Smirnoff unsigned int ntables_old, tbl; 1532b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 15339f7d47b0SAlexander V. Chernikov void *new_idx, *old_tablestate, *tablestate; 153468394ec8SAlexander V. Chernikov struct table_info *ti; 153568394ec8SAlexander V. Chernikov struct table_config *tc; 153668394ec8SAlexander V. Chernikov int i, new_blocks; 15373b3a8eb9SGleb Smirnoff 15383b3a8eb9SGleb Smirnoff /* Check new value for validity */ 15394040f4ecSAlexander V. Chernikov if (ntables == 0) 15404040f4ecSAlexander V. Chernikov return (EINVAL); 15413b3a8eb9SGleb Smirnoff if (ntables > IPFW_TABLES_MAX) 15423b3a8eb9SGleb Smirnoff ntables = IPFW_TABLES_MAX; 15434040f4ecSAlexander V. Chernikov /* Alight to nearest power of 2 */ 15444040f4ecSAlexander V. Chernikov ntables = (unsigned int)roundup2p(ntables); 15453b3a8eb9SGleb Smirnoff 15463b3a8eb9SGleb Smirnoff /* Allocate new pointers */ 15479f7d47b0SAlexander V. Chernikov tablestate = malloc(ntables * sizeof(struct table_info), 15489f7d47b0SAlexander V. Chernikov M_IPFW, M_WAITOK | M_ZERO); 15499f7d47b0SAlexander V. Chernikov 1550b074b7bbSAlexander V. Chernikov ipfw_objhash_bitmap_alloc(ntables, (void *)&new_idx, &new_blocks); 15513b3a8eb9SGleb Smirnoff 15529f7d47b0SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 15533b3a8eb9SGleb Smirnoff 15543b3a8eb9SGleb Smirnoff tbl = (ntables >= V_fw_tables_max) ? V_fw_tables_max : ntables; 1555b074b7bbSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1556b074b7bbSAlexander V. Chernikov 15579f7d47b0SAlexander V. Chernikov /* Temporary restrict decreasing max_tables */ 15589f7d47b0SAlexander V. Chernikov if (ntables < V_fw_tables_max) { 15599f7d47b0SAlexander V. Chernikov 15609f7d47b0SAlexander V. Chernikov /* 15619f7d47b0SAlexander V. Chernikov * FIXME: Check if we really can shrink 15629f7d47b0SAlexander V. Chernikov */ 15639f7d47b0SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1564b074b7bbSAlexander V. Chernikov return (EINVAL); 1565b074b7bbSAlexander V. Chernikov } 15663b3a8eb9SGleb Smirnoff 15679f7d47b0SAlexander V. Chernikov /* Copy table info/indices */ 15689f7d47b0SAlexander V. Chernikov memcpy(tablestate, ch->tablestate, sizeof(struct table_info) * tbl); 15699f7d47b0SAlexander V. Chernikov ipfw_objhash_bitmap_merge(ni, &new_idx, &new_blocks); 15703b3a8eb9SGleb Smirnoff 15719f7d47b0SAlexander V. Chernikov IPFW_WLOCK(ch); 15729f7d47b0SAlexander V. Chernikov 15739f7d47b0SAlexander V. Chernikov /* Change pointers */ 15749f7d47b0SAlexander V. Chernikov old_tablestate = ch->tablestate; 15759f7d47b0SAlexander V. Chernikov ch->tablestate = tablestate; 15769f7d47b0SAlexander V. Chernikov ipfw_objhash_bitmap_swap(ni, &new_idx, &new_blocks); 15773b3a8eb9SGleb Smirnoff 15783b3a8eb9SGleb Smirnoff ntables_old = V_fw_tables_max; 15793b3a8eb9SGleb Smirnoff V_fw_tables_max = ntables; 15803b3a8eb9SGleb Smirnoff 15813b3a8eb9SGleb Smirnoff IPFW_WUNLOCK(ch); 158268394ec8SAlexander V. Chernikov 158368394ec8SAlexander V. Chernikov /* Notify all consumers that their @ti pointer has changed */ 158468394ec8SAlexander V. Chernikov ti = (struct table_info *)ch->tablestate; 158568394ec8SAlexander V. Chernikov for (i = 0; i < tbl; i++, ti++) { 158668394ec8SAlexander V. Chernikov if (ti->lookup == NULL) 158768394ec8SAlexander V. Chernikov continue; 158868394ec8SAlexander V. Chernikov tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, i); 158968394ec8SAlexander V. Chernikov if (tc == NULL || tc->ta->change_ti == NULL) 159068394ec8SAlexander V. Chernikov continue; 159168394ec8SAlexander V. Chernikov 159268394ec8SAlexander V. Chernikov tc->ta->change_ti(tc->astate, ti); 159368394ec8SAlexander V. Chernikov } 159468394ec8SAlexander V. Chernikov 15959f7d47b0SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 15963b3a8eb9SGleb Smirnoff 15973b3a8eb9SGleb Smirnoff /* Free old pointers */ 15989f7d47b0SAlexander V. Chernikov free(old_tablestate, M_IPFW); 1599b074b7bbSAlexander V. Chernikov ipfw_objhash_bitmap_free(new_idx, new_blocks); 16003b3a8eb9SGleb Smirnoff 16013b3a8eb9SGleb Smirnoff return (0); 16023b3a8eb9SGleb Smirnoff } 16033b3a8eb9SGleb Smirnoff 1604a73d728dSAlexander V. Chernikov /* 1605c8d5d308SAlexander V. Chernikov * Lookup an IP @addr in table @tbl. 1606c8d5d308SAlexander V. Chernikov * Stores found value in @val. 1607c8d5d308SAlexander V. Chernikov * 1608c8d5d308SAlexander V. Chernikov * Returns 1 if @addr was found. 1609c8d5d308SAlexander V. Chernikov */ 16103b3a8eb9SGleb Smirnoff int 16113b3a8eb9SGleb Smirnoff ipfw_lookup_table(struct ip_fw_chain *ch, uint16_t tbl, in_addr_t addr, 16123b3a8eb9SGleb Smirnoff uint32_t *val) 16133b3a8eb9SGleb Smirnoff { 16149f7d47b0SAlexander V. Chernikov struct table_info *ti; 16153b3a8eb9SGleb Smirnoff 1616c8d5d308SAlexander V. Chernikov ti = KIDX_TO_TI(ch, tbl); 16179f7d47b0SAlexander V. Chernikov 16189f7d47b0SAlexander V. Chernikov return (ti->lookup(ti, &addr, sizeof(in_addr_t), val)); 16193b3a8eb9SGleb Smirnoff } 16209f7d47b0SAlexander V. Chernikov 1621c8d5d308SAlexander V. Chernikov /* 1622c8d5d308SAlexander V. Chernikov * Lookup an arbtrary key @paddr of legth @plen in table @tbl. 1623c8d5d308SAlexander V. Chernikov * Stores found value in @val. 1624c8d5d308SAlexander V. Chernikov * 1625c8d5d308SAlexander V. Chernikov * Returns 1 if key was found. 1626c8d5d308SAlexander V. Chernikov */ 16279f7d47b0SAlexander V. Chernikov int 16289f7d47b0SAlexander V. Chernikov ipfw_lookup_table_extended(struct ip_fw_chain *ch, uint16_t tbl, uint16_t plen, 16299f7d47b0SAlexander V. Chernikov void *paddr, uint32_t *val) 16309f7d47b0SAlexander V. Chernikov { 16319f7d47b0SAlexander V. Chernikov struct table_info *ti; 16329f7d47b0SAlexander V. Chernikov 1633c8d5d308SAlexander V. Chernikov ti = KIDX_TO_TI(ch, tbl); 16349f7d47b0SAlexander V. Chernikov 16359f7d47b0SAlexander V. Chernikov return (ti->lookup(ti, paddr, plen, val)); 16369f7d47b0SAlexander V. Chernikov } 16379f7d47b0SAlexander V. Chernikov 16389f7d47b0SAlexander V. Chernikov /* 16399f7d47b0SAlexander V. Chernikov * Info/List/dump support for tables. 16409f7d47b0SAlexander V. Chernikov * 16419f7d47b0SAlexander V. Chernikov */ 16429f7d47b0SAlexander V. Chernikov 1643f1220db8SAlexander V. Chernikov /* 1644d3a4f924SAlexander V. Chernikov * High-level 'get' cmds sysctl handlers 1645d3a4f924SAlexander V. Chernikov */ 1646d3a4f924SAlexander V. Chernikov 1647d3a4f924SAlexander V. Chernikov /* 1648d3a4f924SAlexander V. Chernikov * Lists all tables currently available in kernel. 1649ac35ff17SAlexander V. Chernikov * Data layout (v0)(current): 1650d3a4f924SAlexander V. Chernikov * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size 1651d3a4f924SAlexander V. Chernikov * Reply: [ ipfw_obj_lheader ipfw_xtable_info x N ] 1652d3a4f924SAlexander V. Chernikov * 1653d3a4f924SAlexander V. Chernikov * Returns 0 on success 1654d3a4f924SAlexander V. Chernikov */ 16556b988f3aSAlexander V. Chernikov static int 16566b988f3aSAlexander V. Chernikov list_tables(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1657e822d936SAlexander V. Chernikov struct sockopt_data *sd) 1658f1220db8SAlexander V. Chernikov { 1659f1220db8SAlexander V. Chernikov struct _ipfw_obj_lheader *olh; 1660f1220db8SAlexander V. Chernikov int error; 1661f1220db8SAlexander V. Chernikov 16622d99a349SAlexander V. Chernikov olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh)); 16632d99a349SAlexander V. Chernikov if (olh == NULL) 1664d3a4f924SAlexander V. Chernikov return (EINVAL); 166568394ec8SAlexander V. Chernikov if (sd->valsize < olh->size) 166668394ec8SAlexander V. Chernikov return (EINVAL); 1667d3a4f924SAlexander V. Chernikov 1668f1220db8SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 16692d99a349SAlexander V. Chernikov error = export_tables(ch, olh, sd); 1670f1220db8SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 1671f1220db8SAlexander V. Chernikov 1672f1220db8SAlexander V. Chernikov return (error); 1673f1220db8SAlexander V. Chernikov } 1674f1220db8SAlexander V. Chernikov 1675f1220db8SAlexander V. Chernikov /* 16762d99a349SAlexander V. Chernikov * Store table info to buffer provided by @sd. 1677ac35ff17SAlexander V. Chernikov * Data layout (v0)(current): 1678d3a4f924SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_xtable_info(empty)] 1679d3a4f924SAlexander V. Chernikov * Reply: [ ipfw_obj_header ipfw_xtable_info ] 1680d3a4f924SAlexander V. Chernikov * 1681d3a4f924SAlexander V. Chernikov * Returns 0 on success. 1682d3a4f924SAlexander V. Chernikov */ 16836b988f3aSAlexander V. Chernikov static int 16846b988f3aSAlexander V. Chernikov describe_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1685e822d936SAlexander V. Chernikov struct sockopt_data *sd) 1686d3a4f924SAlexander V. Chernikov { 1687d3a4f924SAlexander V. Chernikov struct _ipfw_obj_header *oh; 1688d3a4f924SAlexander V. Chernikov struct table_config *tc; 1689d3a4f924SAlexander V. Chernikov struct tid_info ti; 1690d3a4f924SAlexander V. Chernikov size_t sz; 1691d3a4f924SAlexander V. Chernikov 1692d3a4f924SAlexander V. Chernikov sz = sizeof(*oh) + sizeof(ipfw_xtable_info); 16932d99a349SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 16942d99a349SAlexander V. Chernikov if (oh == NULL) 1695d3a4f924SAlexander V. Chernikov return (EINVAL); 1696d3a4f924SAlexander V. Chernikov 1697d3a4f924SAlexander V. Chernikov objheader_to_ti(oh, &ti); 1698d3a4f924SAlexander V. Chernikov 1699d3a4f924SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 1700d3a4f924SAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) { 1701d3a4f924SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 1702d3a4f924SAlexander V. Chernikov return (ESRCH); 1703d3a4f924SAlexander V. Chernikov } 1704d3a4f924SAlexander V. Chernikov 1705ac35ff17SAlexander V. Chernikov export_table_info(ch, tc, (ipfw_xtable_info *)(oh + 1)); 1706d3a4f924SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 1707d3a4f924SAlexander V. Chernikov 17082d99a349SAlexander V. Chernikov return (0); 1709d3a4f924SAlexander V. Chernikov } 1710d3a4f924SAlexander V. Chernikov 1711d3a4f924SAlexander V. Chernikov /* 1712adf3b2b9SAlexander V. Chernikov * Modifies existing table. 1713adf3b2b9SAlexander V. Chernikov * Data layout (v0)(current): 1714adf3b2b9SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_xtable_info ] 1715adf3b2b9SAlexander V. Chernikov * 1716adf3b2b9SAlexander V. Chernikov * Returns 0 on success 1717adf3b2b9SAlexander V. Chernikov */ 17186b988f3aSAlexander V. Chernikov static int 17196b988f3aSAlexander V. Chernikov modify_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1720adf3b2b9SAlexander V. Chernikov struct sockopt_data *sd) 1721adf3b2b9SAlexander V. Chernikov { 1722adf3b2b9SAlexander V. Chernikov struct _ipfw_obj_header *oh; 1723adf3b2b9SAlexander V. Chernikov ipfw_xtable_info *i; 1724adf3b2b9SAlexander V. Chernikov char *tname; 1725adf3b2b9SAlexander V. Chernikov struct tid_info ti; 1726adf3b2b9SAlexander V. Chernikov struct namedobj_instance *ni; 1727adf3b2b9SAlexander V. Chernikov struct table_config *tc; 1728adf3b2b9SAlexander V. Chernikov 1729adf3b2b9SAlexander V. Chernikov if (sd->valsize != sizeof(*oh) + sizeof(ipfw_xtable_info)) 1730adf3b2b9SAlexander V. Chernikov return (EINVAL); 1731adf3b2b9SAlexander V. Chernikov 1732adf3b2b9SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)sd->kbuf; 1733adf3b2b9SAlexander V. Chernikov i = (ipfw_xtable_info *)(oh + 1); 1734adf3b2b9SAlexander V. Chernikov 1735adf3b2b9SAlexander V. Chernikov /* 1736adf3b2b9SAlexander V. Chernikov * Verify user-supplied strings. 1737adf3b2b9SAlexander V. Chernikov * Check for null-terminated/zero-length strings/ 1738adf3b2b9SAlexander V. Chernikov */ 1739adf3b2b9SAlexander V. Chernikov tname = oh->ntlv.name; 1740f81431ccSAndrey V. Elsukov if (check_table_name(tname) != 0) 1741adf3b2b9SAlexander V. Chernikov return (EINVAL); 1742adf3b2b9SAlexander V. Chernikov 1743adf3b2b9SAlexander V. Chernikov objheader_to_ti(oh, &ti); 1744adf3b2b9SAlexander V. Chernikov ti.type = i->type; 1745adf3b2b9SAlexander V. Chernikov 1746adf3b2b9SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1747adf3b2b9SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1748adf3b2b9SAlexander V. Chernikov if ((tc = find_table(ni, &ti)) == NULL) { 1749adf3b2b9SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1750adf3b2b9SAlexander V. Chernikov return (ESRCH); 1751adf3b2b9SAlexander V. Chernikov } 1752fd0869d5SAlexander V. Chernikov 1753fd0869d5SAlexander V. Chernikov /* Do not support any modifications for readonly tables */ 1754fd0869d5SAlexander V. Chernikov if ((tc->ta->flags & TA_FLAG_READONLY) != 0) { 1755fd0869d5SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1756fd0869d5SAlexander V. Chernikov return (EACCES); 1757fd0869d5SAlexander V. Chernikov } 1758fd0869d5SAlexander V. Chernikov 1759adf3b2b9SAlexander V. Chernikov if ((i->mflags & IPFW_TMFLAGS_LIMIT) != 0) 1760adf3b2b9SAlexander V. Chernikov tc->limit = i->limit; 17614f43138aSAlexander V. Chernikov if ((i->mflags & IPFW_TMFLAGS_LOCK) != 0) 17624f43138aSAlexander V. Chernikov tc->locked = ((i->flags & IPFW_TGFLAGS_LOCKED) != 0); 1763adf3b2b9SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1764adf3b2b9SAlexander V. Chernikov 1765adf3b2b9SAlexander V. Chernikov return (0); 1766adf3b2b9SAlexander V. Chernikov } 1767adf3b2b9SAlexander V. Chernikov 1768adf3b2b9SAlexander V. Chernikov /* 17699490a627SAlexander V. Chernikov * Creates new table. 1770ac35ff17SAlexander V. Chernikov * Data layout (v0)(current): 17719490a627SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_xtable_info ] 17729490a627SAlexander V. Chernikov * 17739490a627SAlexander V. Chernikov * Returns 0 on success 17749490a627SAlexander V. Chernikov */ 17756b988f3aSAlexander V. Chernikov static int 17766b988f3aSAlexander V. Chernikov create_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1777ac35ff17SAlexander V. Chernikov struct sockopt_data *sd) 17789490a627SAlexander V. Chernikov { 17799490a627SAlexander V. Chernikov struct _ipfw_obj_header *oh; 17809490a627SAlexander V. Chernikov ipfw_xtable_info *i; 17819490a627SAlexander V. Chernikov char *tname, *aname; 17829490a627SAlexander V. Chernikov struct tid_info ti; 17839490a627SAlexander V. Chernikov struct namedobj_instance *ni; 17849490a627SAlexander V. Chernikov 1785ac35ff17SAlexander V. Chernikov if (sd->valsize != sizeof(*oh) + sizeof(ipfw_xtable_info)) 17869490a627SAlexander V. Chernikov return (EINVAL); 17879490a627SAlexander V. Chernikov 1788ac35ff17SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)sd->kbuf; 17899490a627SAlexander V. Chernikov i = (ipfw_xtable_info *)(oh + 1); 17909490a627SAlexander V. Chernikov 17919490a627SAlexander V. Chernikov /* 17929490a627SAlexander V. Chernikov * Verify user-supplied strings. 17932d99a349SAlexander V. Chernikov * Check for null-terminated/zero-length strings/ 17949490a627SAlexander V. Chernikov */ 1795ac35ff17SAlexander V. Chernikov tname = oh->ntlv.name; 17969490a627SAlexander V. Chernikov aname = i->algoname; 1797f81431ccSAndrey V. Elsukov if (check_table_name(tname) != 0 || 17989490a627SAlexander V. Chernikov strnlen(aname, sizeof(i->algoname)) == sizeof(i->algoname)) 17999490a627SAlexander V. Chernikov return (EINVAL); 18009490a627SAlexander V. Chernikov 18019490a627SAlexander V. Chernikov if (aname[0] == '\0') { 18029490a627SAlexander V. Chernikov /* Use default algorithm */ 18039490a627SAlexander V. Chernikov aname = NULL; 18049490a627SAlexander V. Chernikov } 18059490a627SAlexander V. Chernikov 18069490a627SAlexander V. Chernikov objheader_to_ti(oh, &ti); 1807ac35ff17SAlexander V. Chernikov ti.type = i->type; 18089490a627SAlexander V. Chernikov 18099490a627SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 18109490a627SAlexander V. Chernikov 18119490a627SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 1812038263c3SAlexander V. Chernikov if (find_table(ni, &ti) != NULL) { 18139490a627SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 18149490a627SAlexander V. Chernikov return (EEXIST); 18159490a627SAlexander V. Chernikov } 18169490a627SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 18179490a627SAlexander V. Chernikov 1818867708f7SAlexander V. Chernikov return (create_table_internal(ch, &ti, aname, i, NULL, 0)); 1819db785d31SAlexander V. Chernikov } 1820db785d31SAlexander V. Chernikov 1821db785d31SAlexander V. Chernikov /* 1822db785d31SAlexander V. Chernikov * Creates new table based on @ti and @aname. 1823db785d31SAlexander V. Chernikov * 1824db785d31SAlexander V. Chernikov * Assume @aname to be checked and valid. 1825867708f7SAlexander V. Chernikov * Stores allocated table kidx inside @pkidx (if non-NULL). 18260468c5baSAlexander V. Chernikov * Reference created table if @compat is non-zero. 1827db785d31SAlexander V. Chernikov * 1828db785d31SAlexander V. Chernikov * Returns 0 on success. 1829db785d31SAlexander V. Chernikov */ 1830db785d31SAlexander V. Chernikov static int 1831db785d31SAlexander V. Chernikov create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti, 1832867708f7SAlexander V. Chernikov char *aname, ipfw_xtable_info *i, uint16_t *pkidx, int compat) 1833db785d31SAlexander V. Chernikov { 1834db785d31SAlexander V. Chernikov struct namedobj_instance *ni; 1835c8d5d308SAlexander V. Chernikov struct table_config *tc, *tc_new, *tmp; 1836db785d31SAlexander V. Chernikov struct table_algo *ta; 1837db785d31SAlexander V. Chernikov uint16_t kidx; 1838db785d31SAlexander V. Chernikov 1839db785d31SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1840db785d31SAlexander V. Chernikov 1841db785d31SAlexander V. Chernikov ta = find_table_algo(CHAIN_TO_TCFG(ch), ti, aname); 18429490a627SAlexander V. Chernikov if (ta == NULL) 18439490a627SAlexander V. Chernikov return (ENOTSUP); 18449490a627SAlexander V. Chernikov 18450cba2b28SAlexander V. Chernikov tc = alloc_table_config(ch, ti, ta, aname, i->tflags); 18464c0c07a5SAlexander V. Chernikov if (tc == NULL) 18479490a627SAlexander V. Chernikov return (ENOMEM); 18489490a627SAlexander V. Chernikov 18490cba2b28SAlexander V. Chernikov tc->vmask = i->vmask; 18504c0c07a5SAlexander V. Chernikov tc->limit = i->limit; 1851fd0869d5SAlexander V. Chernikov if (ta->flags & TA_FLAG_READONLY) 1852fd0869d5SAlexander V. Chernikov tc->locked = 1; 1853fd0869d5SAlexander V. Chernikov else 18544f43138aSAlexander V. Chernikov tc->locked = (i->flags & IPFW_TGFLAGS_LOCKED) != 0; 18554c0c07a5SAlexander V. Chernikov 18569490a627SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1857db785d31SAlexander V. Chernikov 1858db785d31SAlexander V. Chernikov /* Check if table has been already created */ 18590468c5baSAlexander V. Chernikov tc_new = find_table(ni, ti); 18600468c5baSAlexander V. Chernikov if (tc_new != NULL) { 18610468c5baSAlexander V. Chernikov 18620468c5baSAlexander V. Chernikov /* 18630468c5baSAlexander V. Chernikov * Compat: do not fail if we're 18640468c5baSAlexander V. Chernikov * requesting to create existing table 18650cba2b28SAlexander V. Chernikov * which has the same type 18660468c5baSAlexander V. Chernikov */ 186774b22066SAlexander V. Chernikov if (compat == 0 || tc_new->no.subtype != tc->no.subtype) { 1868db785d31SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1869db785d31SAlexander V. Chernikov free_table_config(ni, tc); 1870db785d31SAlexander V. Chernikov return (EEXIST); 1871db785d31SAlexander V. Chernikov } 1872db785d31SAlexander V. Chernikov 18730468c5baSAlexander V. Chernikov /* Exchange tc and tc_new for proper refcounting & freeing */ 18740468c5baSAlexander V. Chernikov tmp = tc; 18750468c5baSAlexander V. Chernikov tc = tc_new; 18760468c5baSAlexander V. Chernikov tc_new = tmp; 18770468c5baSAlexander V. Chernikov } else { 18780468c5baSAlexander V. Chernikov /* New table */ 1879ac35ff17SAlexander V. Chernikov if (ipfw_objhash_alloc_idx(ni, &kidx) != 0) { 18809490a627SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1881db785d31SAlexander V. Chernikov printf("Unable to allocate table index." 1882db785d31SAlexander V. Chernikov " Consider increasing net.inet.ip.fw.tables_max"); 18839490a627SAlexander V. Chernikov free_table_config(ni, tc); 18849490a627SAlexander V. Chernikov return (EBUSY); 18859490a627SAlexander V. Chernikov } 18869490a627SAlexander V. Chernikov tc->no.kidx = kidx; 188774b22066SAlexander V. Chernikov tc->no.etlv = IPFW_TLV_TBL_NAME; 18889490a627SAlexander V. Chernikov 18899490a627SAlexander V. Chernikov IPFW_WLOCK(ch); 18909490a627SAlexander V. Chernikov link_table(ch, tc); 18919490a627SAlexander V. Chernikov IPFW_WUNLOCK(ch); 18920468c5baSAlexander V. Chernikov } 18930468c5baSAlexander V. Chernikov 18940468c5baSAlexander V. Chernikov if (compat != 0) 18950468c5baSAlexander V. Chernikov tc->no.refcnt++; 18960468c5baSAlexander V. Chernikov if (pkidx != NULL) 18970468c5baSAlexander V. Chernikov *pkidx = tc->no.kidx; 18989490a627SAlexander V. Chernikov 18999490a627SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 19009490a627SAlexander V. Chernikov 19010468c5baSAlexander V. Chernikov if (tc_new != NULL) 19020468c5baSAlexander V. Chernikov free_table_config(ni, tc_new); 19030468c5baSAlexander V. Chernikov 19049490a627SAlexander V. Chernikov return (0); 19059490a627SAlexander V. Chernikov } 19069490a627SAlexander V. Chernikov 190746d52008SAlexander V. Chernikov static void 190846d52008SAlexander V. Chernikov ntlv_to_ti(ipfw_obj_ntlv *ntlv, struct tid_info *ti) 1909d3a4f924SAlexander V. Chernikov { 1910d3a4f924SAlexander V. Chernikov 1911d3a4f924SAlexander V. Chernikov memset(ti, 0, sizeof(struct tid_info)); 191246d52008SAlexander V. Chernikov ti->set = ntlv->set; 191346d52008SAlexander V. Chernikov ti->uidx = ntlv->idx; 191446d52008SAlexander V. Chernikov ti->tlvs = ntlv; 191546d52008SAlexander V. Chernikov ti->tlen = ntlv->head.length; 191646d52008SAlexander V. Chernikov } 191746d52008SAlexander V. Chernikov 191846d52008SAlexander V. Chernikov static void 191946d52008SAlexander V. Chernikov objheader_to_ti(struct _ipfw_obj_header *oh, struct tid_info *ti) 192046d52008SAlexander V. Chernikov { 192146d52008SAlexander V. Chernikov 192246d52008SAlexander V. Chernikov ntlv_to_ti(&oh->ntlv, ti); 1923d3a4f924SAlexander V. Chernikov } 1924d3a4f924SAlexander V. Chernikov 192574b22066SAlexander V. Chernikov struct namedobj_instance * 192674b22066SAlexander V. Chernikov ipfw_get_table_objhash(struct ip_fw_chain *ch) 192774b22066SAlexander V. Chernikov { 192874b22066SAlexander V. Chernikov 192974b22066SAlexander V. Chernikov return (CHAIN_TO_NI(ch)); 193074b22066SAlexander V. Chernikov } 193174b22066SAlexander V. Chernikov 193235e1bbd0SAlexander V. Chernikov /* 193335e1bbd0SAlexander V. Chernikov * Exports basic table info as name TLV. 193435e1bbd0SAlexander V. Chernikov * Used inside dump_static_rules() to provide info 193535e1bbd0SAlexander V. Chernikov * about all tables referenced by current ruleset. 193635e1bbd0SAlexander V. Chernikov * 193735e1bbd0SAlexander V. Chernikov * Returns 0 on success. 193835e1bbd0SAlexander V. Chernikov */ 1939563b5ab1SAlexander V. Chernikov int 1940563b5ab1SAlexander V. Chernikov ipfw_export_table_ntlv(struct ip_fw_chain *ch, uint16_t kidx, 1941563b5ab1SAlexander V. Chernikov struct sockopt_data *sd) 1942563b5ab1SAlexander V. Chernikov { 1943563b5ab1SAlexander V. Chernikov struct namedobj_instance *ni; 1944563b5ab1SAlexander V. Chernikov struct named_object *no; 1945563b5ab1SAlexander V. Chernikov ipfw_obj_ntlv *ntlv; 1946563b5ab1SAlexander V. Chernikov 1947563b5ab1SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1948563b5ab1SAlexander V. Chernikov 1949ac35ff17SAlexander V. Chernikov no = ipfw_objhash_lookup_kidx(ni, kidx); 1950563b5ab1SAlexander V. Chernikov KASSERT(no != NULL, ("invalid table kidx passed")); 1951563b5ab1SAlexander V. Chernikov 1952563b5ab1SAlexander V. Chernikov ntlv = (ipfw_obj_ntlv *)ipfw_get_sopt_space(sd, sizeof(*ntlv)); 1953563b5ab1SAlexander V. Chernikov if (ntlv == NULL) 1954563b5ab1SAlexander V. Chernikov return (ENOMEM); 1955563b5ab1SAlexander V. Chernikov 1956563b5ab1SAlexander V. Chernikov ntlv->head.type = IPFW_TLV_TBL_NAME; 1957563b5ab1SAlexander V. Chernikov ntlv->head.length = sizeof(*ntlv); 1958563b5ab1SAlexander V. Chernikov ntlv->idx = no->kidx; 1959563b5ab1SAlexander V. Chernikov strlcpy(ntlv->name, no->name, sizeof(ntlv->name)); 1960563b5ab1SAlexander V. Chernikov 1961563b5ab1SAlexander V. Chernikov return (0); 1962563b5ab1SAlexander V. Chernikov } 1963563b5ab1SAlexander V. Chernikov 1964d3b00c08SAlexander V. Chernikov struct dump_args { 19650cba2b28SAlexander V. Chernikov struct ip_fw_chain *ch; 1966d3b00c08SAlexander V. Chernikov struct table_info *ti; 1967d3b00c08SAlexander V. Chernikov struct table_config *tc; 1968d3b00c08SAlexander V. Chernikov struct sockopt_data *sd; 1969d3b00c08SAlexander V. Chernikov uint32_t cnt; 1970d3b00c08SAlexander V. Chernikov uint16_t uidx; 1971d3b00c08SAlexander V. Chernikov int error; 1972d3b00c08SAlexander V. Chernikov uint32_t size; 19734dff4ae0SAlexander V. Chernikov ipfw_table_entry *ent; 19744dff4ae0SAlexander V. Chernikov ta_foreach_f *f; 19754dff4ae0SAlexander V. Chernikov void *farg; 1976d3b00c08SAlexander V. Chernikov ipfw_obj_tentry tent; 1977d3b00c08SAlexander V. Chernikov }; 1978d3b00c08SAlexander V. Chernikov 1979d3b00c08SAlexander V. Chernikov static int 1980d3b00c08SAlexander V. Chernikov count_ext_entries(void *e, void *arg) 1981d3b00c08SAlexander V. Chernikov { 1982d3b00c08SAlexander V. Chernikov struct dump_args *da; 1983d3b00c08SAlexander V. Chernikov 1984d3b00c08SAlexander V. Chernikov da = (struct dump_args *)arg; 1985d3b00c08SAlexander V. Chernikov da->cnt++; 1986d3b00c08SAlexander V. Chernikov 1987d3b00c08SAlexander V. Chernikov return (0); 1988d3b00c08SAlexander V. Chernikov } 1989d3b00c08SAlexander V. Chernikov 1990d3b00c08SAlexander V. Chernikov /* 1991d3b00c08SAlexander V. Chernikov * Gets number of items from table either using 1992d3b00c08SAlexander V. Chernikov * internal counter or calling algo callback for 1993d3b00c08SAlexander V. Chernikov * externally-managed tables. 1994d3b00c08SAlexander V. Chernikov * 1995d3b00c08SAlexander V. Chernikov * Returns number of records. 1996d3b00c08SAlexander V. Chernikov */ 1997d3b00c08SAlexander V. Chernikov static uint32_t 1998d3b00c08SAlexander V. Chernikov table_get_count(struct ip_fw_chain *ch, struct table_config *tc) 1999d3b00c08SAlexander V. Chernikov { 2000d3b00c08SAlexander V. Chernikov struct table_info *ti; 2001d3b00c08SAlexander V. Chernikov struct table_algo *ta; 2002d3b00c08SAlexander V. Chernikov struct dump_args da; 2003d3b00c08SAlexander V. Chernikov 2004d3b00c08SAlexander V. Chernikov ti = KIDX_TO_TI(ch, tc->no.kidx); 2005d3b00c08SAlexander V. Chernikov ta = tc->ta; 2006d3b00c08SAlexander V. Chernikov 2007d3b00c08SAlexander V. Chernikov /* Use internal counter for self-managed tables */ 2008d3b00c08SAlexander V. Chernikov if ((ta->flags & TA_FLAG_READONLY) == 0) 2009d3b00c08SAlexander V. Chernikov return (tc->count); 2010d3b00c08SAlexander V. Chernikov 2011d3b00c08SAlexander V. Chernikov /* Use callback to quickly get number of items */ 2012d3b00c08SAlexander V. Chernikov if ((ta->flags & TA_FLAG_EXTCOUNTER) != 0) 2013d3b00c08SAlexander V. Chernikov return (ta->get_count(tc->astate, ti)); 2014d3b00c08SAlexander V. Chernikov 2015d3b00c08SAlexander V. Chernikov /* Count number of iterms ourselves */ 2016d3b00c08SAlexander V. Chernikov memset(&da, 0, sizeof(da)); 2017d3b00c08SAlexander V. Chernikov ta->foreach(tc->astate, ti, count_ext_entries, &da); 2018d3b00c08SAlexander V. Chernikov 2019d3b00c08SAlexander V. Chernikov return (da.cnt); 2020d3b00c08SAlexander V. Chernikov } 2021f99fbf96SAlexander V. Chernikov 2022f99fbf96SAlexander V. Chernikov /* 202335e1bbd0SAlexander V. Chernikov * Exports table @tc info into standard ipfw_xtable_info format. 202435e1bbd0SAlexander V. Chernikov */ 20259f7d47b0SAlexander V. Chernikov static void 2026ac35ff17SAlexander V. Chernikov export_table_info(struct ip_fw_chain *ch, struct table_config *tc, 2027ac35ff17SAlexander V. Chernikov ipfw_xtable_info *i) 20289f7d47b0SAlexander V. Chernikov { 2029ac35ff17SAlexander V. Chernikov struct table_info *ti; 20305f379342SAlexander V. Chernikov struct table_algo *ta; 20319f7d47b0SAlexander V. Chernikov 203274b22066SAlexander V. Chernikov i->type = tc->no.subtype; 2033914bffb6SAlexander V. Chernikov i->tflags = tc->tflags; 20340cba2b28SAlexander V. Chernikov i->vmask = tc->vmask; 20359f7d47b0SAlexander V. Chernikov i->set = tc->no.set; 20369f7d47b0SAlexander V. Chernikov i->kidx = tc->no.kidx; 20379f7d47b0SAlexander V. Chernikov i->refcnt = tc->no.refcnt; 2038d3b00c08SAlexander V. Chernikov i->count = table_get_count(ch, tc); 20394c0c07a5SAlexander V. Chernikov i->limit = tc->limit; 20404f43138aSAlexander V. Chernikov i->flags |= (tc->locked != 0) ? IPFW_TGFLAGS_LOCKED : 0; 204136738284SAlexander V. Chernikov i->size = i->count * sizeof(ipfw_obj_tentry); 2042f1220db8SAlexander V. Chernikov i->size += sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info); 20439f7d47b0SAlexander V. Chernikov strlcpy(i->tablename, tc->tablename, sizeof(i->tablename)); 2044ac35ff17SAlexander V. Chernikov ti = KIDX_TO_TI(ch, tc->no.kidx); 20455f379342SAlexander V. Chernikov ta = tc->ta; 20465f379342SAlexander V. Chernikov if (ta->print_config != NULL) { 20475f379342SAlexander V. Chernikov /* Use algo function to print table config to string */ 20485f379342SAlexander V. Chernikov ta->print_config(tc->astate, ti, i->algoname, 2049ac35ff17SAlexander V. Chernikov sizeof(i->algoname)); 2050ac35ff17SAlexander V. Chernikov } else 20515f379342SAlexander V. Chernikov strlcpy(i->algoname, ta->name, sizeof(i->algoname)); 20525f379342SAlexander V. Chernikov /* Dump algo-specific data, if possible */ 20535f379342SAlexander V. Chernikov if (ta->dump_tinfo != NULL) { 20545f379342SAlexander V. Chernikov ta->dump_tinfo(tc->astate, ti, &i->ta_info); 20555f379342SAlexander V. Chernikov i->ta_info.flags |= IPFW_TATFLAGS_DATA; 20565f379342SAlexander V. Chernikov } 20579f7d47b0SAlexander V. Chernikov } 20589f7d47b0SAlexander V. Chernikov 2059ac35ff17SAlexander V. Chernikov struct dump_table_args { 2060ac35ff17SAlexander V. Chernikov struct ip_fw_chain *ch; 2061ac35ff17SAlexander V. Chernikov struct sockopt_data *sd; 2062ac35ff17SAlexander V. Chernikov }; 2063ac35ff17SAlexander V. Chernikov 2064b309f085SAndrey V. Elsukov static int 20659f7d47b0SAlexander V. Chernikov export_table_internal(struct namedobj_instance *ni, struct named_object *no, 20669f7d47b0SAlexander V. Chernikov void *arg) 20673b3a8eb9SGleb Smirnoff { 20689f7d47b0SAlexander V. Chernikov ipfw_xtable_info *i; 2069ac35ff17SAlexander V. Chernikov struct dump_table_args *dta; 20703b3a8eb9SGleb Smirnoff 2071ac35ff17SAlexander V. Chernikov dta = (struct dump_table_args *)arg; 2072ac35ff17SAlexander V. Chernikov 2073ac35ff17SAlexander V. Chernikov i = (ipfw_xtable_info *)ipfw_get_sopt_space(dta->sd, sizeof(*i)); 20747a6ab8f1SPedro F. Giffuni KASSERT(i != NULL, ("previously checked buffer is not enough")); 20759f7d47b0SAlexander V. Chernikov 2076ac35ff17SAlexander V. Chernikov export_table_info(dta->ch, (struct table_config *)no, i); 2077b309f085SAndrey V. Elsukov return (0); 20789f7d47b0SAlexander V. Chernikov } 20799f7d47b0SAlexander V. Chernikov 2080f1220db8SAlexander V. Chernikov /* 2081f1220db8SAlexander V. Chernikov * Export all tables as ipfw_xtable_info structures to 20822d99a349SAlexander V. Chernikov * storage provided by @sd. 208328ea4fa3SAlexander V. Chernikov * 208428ea4fa3SAlexander V. Chernikov * If supplied buffer is too small, fills in required size 208528ea4fa3SAlexander V. Chernikov * and returns ENOMEM. 2086f1220db8SAlexander V. Chernikov * Returns 0 on success. 2087f1220db8SAlexander V. Chernikov */ 2088f1220db8SAlexander V. Chernikov static int 20892d99a349SAlexander V. Chernikov export_tables(struct ip_fw_chain *ch, ipfw_obj_lheader *olh, 20902d99a349SAlexander V. Chernikov struct sockopt_data *sd) 20919f7d47b0SAlexander V. Chernikov { 20929f7d47b0SAlexander V. Chernikov uint32_t size; 20939f7d47b0SAlexander V. Chernikov uint32_t count; 2094ac35ff17SAlexander V. Chernikov struct dump_table_args dta; 20959f7d47b0SAlexander V. Chernikov 20969f7d47b0SAlexander V. Chernikov count = ipfw_objhash_count(CHAIN_TO_NI(ch)); 20979f7d47b0SAlexander V. Chernikov size = count * sizeof(ipfw_xtable_info) + sizeof(ipfw_obj_lheader); 20982d99a349SAlexander V. Chernikov 20992d99a349SAlexander V. Chernikov /* Fill in header regadless of buffer size */ 2100f1220db8SAlexander V. Chernikov olh->count = count; 2101f1220db8SAlexander V. Chernikov olh->objsize = sizeof(ipfw_xtable_info); 21022d99a349SAlexander V. Chernikov 21032d99a349SAlexander V. Chernikov if (size > olh->size) { 21042d99a349SAlexander V. Chernikov olh->size = size; 21059f7d47b0SAlexander V. Chernikov return (ENOMEM); 2106f1220db8SAlexander V. Chernikov } 210768394ec8SAlexander V. Chernikov 21089f7d47b0SAlexander V. Chernikov olh->size = size; 21092d99a349SAlexander V. Chernikov 2110ac35ff17SAlexander V. Chernikov dta.ch = ch; 2111ac35ff17SAlexander V. Chernikov dta.sd = sd; 2112ac35ff17SAlexander V. Chernikov 2113ac35ff17SAlexander V. Chernikov ipfw_objhash_foreach(CHAIN_TO_NI(ch), export_table_internal, &dta); 21149f7d47b0SAlexander V. Chernikov 21153b3a8eb9SGleb Smirnoff return (0); 21163b3a8eb9SGleb Smirnoff } 21173b3a8eb9SGleb Smirnoff 2118f99fbf96SAlexander V. Chernikov /* 2119f99fbf96SAlexander V. Chernikov * Dumps all table data 2120f99fbf96SAlexander V. Chernikov * Data layout (v1)(current): 2121f99fbf96SAlexander V. Chernikov * Request: [ ipfw_obj_header ], size = ipfw_xtable_info.size 2122f99fbf96SAlexander V. Chernikov * Reply: [ ipfw_obj_header ipfw_xtable_info ipfw_obj_tentry x N ] 2123f99fbf96SAlexander V. Chernikov * 2124f99fbf96SAlexander V. Chernikov * Returns 0 on success 2125f99fbf96SAlexander V. Chernikov */ 2126f99fbf96SAlexander V. Chernikov static int 21276b988f3aSAlexander V. Chernikov dump_table_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 21286b988f3aSAlexander V. Chernikov struct sockopt_data *sd) 2129f99fbf96SAlexander V. Chernikov { 2130f99fbf96SAlexander V. Chernikov struct _ipfw_obj_header *oh; 2131f99fbf96SAlexander V. Chernikov ipfw_xtable_info *i; 2132f99fbf96SAlexander V. Chernikov struct tid_info ti; 2133f99fbf96SAlexander V. Chernikov struct table_config *tc; 2134f99fbf96SAlexander V. Chernikov struct table_algo *ta; 2135f99fbf96SAlexander V. Chernikov struct dump_args da; 2136f99fbf96SAlexander V. Chernikov uint32_t sz; 2137f99fbf96SAlexander V. Chernikov 2138f99fbf96SAlexander V. Chernikov sz = sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info); 2139f99fbf96SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 2140f99fbf96SAlexander V. Chernikov if (oh == NULL) 2141f99fbf96SAlexander V. Chernikov return (EINVAL); 2142f99fbf96SAlexander V. Chernikov 2143f99fbf96SAlexander V. Chernikov i = (ipfw_xtable_info *)(oh + 1); 2144f99fbf96SAlexander V. Chernikov objheader_to_ti(oh, &ti); 2145f99fbf96SAlexander V. Chernikov 2146f99fbf96SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 2147f99fbf96SAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) { 2148f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2149f99fbf96SAlexander V. Chernikov return (ESRCH); 2150f99fbf96SAlexander V. Chernikov } 2151f99fbf96SAlexander V. Chernikov export_table_info(ch, tc, i); 2152f99fbf96SAlexander V. Chernikov 2153f99fbf96SAlexander V. Chernikov if (sd->valsize < i->size) { 2154f99fbf96SAlexander V. Chernikov 2155f99fbf96SAlexander V. Chernikov /* 2156f99fbf96SAlexander V. Chernikov * Submitted buffer size is not enough. 2157f99fbf96SAlexander V. Chernikov * WE've already filled in @i structure with 2158f99fbf96SAlexander V. Chernikov * relevant table info including size, so we 2159f99fbf96SAlexander V. Chernikov * can return. Buffer will be flushed automatically. 2160f99fbf96SAlexander V. Chernikov */ 2161f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2162f99fbf96SAlexander V. Chernikov return (ENOMEM); 2163f99fbf96SAlexander V. Chernikov } 2164f99fbf96SAlexander V. Chernikov 2165f99fbf96SAlexander V. Chernikov /* 2166f99fbf96SAlexander V. Chernikov * Do the actual dump in eXtended format 2167f99fbf96SAlexander V. Chernikov */ 2168f99fbf96SAlexander V. Chernikov memset(&da, 0, sizeof(da)); 21690cba2b28SAlexander V. Chernikov da.ch = ch; 2170f99fbf96SAlexander V. Chernikov da.ti = KIDX_TO_TI(ch, tc->no.kidx); 2171f99fbf96SAlexander V. Chernikov da.tc = tc; 2172f99fbf96SAlexander V. Chernikov da.sd = sd; 2173f99fbf96SAlexander V. Chernikov 2174f99fbf96SAlexander V. Chernikov ta = tc->ta; 2175f99fbf96SAlexander V. Chernikov 2176f99fbf96SAlexander V. Chernikov ta->foreach(tc->astate, da.ti, dump_table_tentry, &da); 2177f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2178f99fbf96SAlexander V. Chernikov 2179f99fbf96SAlexander V. Chernikov return (da.error); 2180f99fbf96SAlexander V. Chernikov } 2181f99fbf96SAlexander V. Chernikov 2182f99fbf96SAlexander V. Chernikov /* 2183f99fbf96SAlexander V. Chernikov * Dumps all table data 2184f99fbf96SAlexander V. Chernikov * Data layout (version 0)(legacy): 2185f99fbf96SAlexander V. Chernikov * Request: [ ipfw_xtable ], size = IP_FW_TABLE_XGETSIZE() 2186f99fbf96SAlexander V. Chernikov * Reply: [ ipfw_xtable ipfw_table_xentry x N ] 2187f99fbf96SAlexander V. Chernikov * 2188f99fbf96SAlexander V. Chernikov * Returns 0 on success 2189f99fbf96SAlexander V. Chernikov */ 2190f99fbf96SAlexander V. Chernikov static int 21916b988f3aSAlexander V. Chernikov dump_table_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 21926b988f3aSAlexander V. Chernikov struct sockopt_data *sd) 2193f99fbf96SAlexander V. Chernikov { 2194f99fbf96SAlexander V. Chernikov ipfw_xtable *xtbl; 2195f99fbf96SAlexander V. Chernikov struct tid_info ti; 2196f99fbf96SAlexander V. Chernikov struct table_config *tc; 2197f99fbf96SAlexander V. Chernikov struct table_algo *ta; 2198f99fbf96SAlexander V. Chernikov struct dump_args da; 2199d3b00c08SAlexander V. Chernikov size_t sz, count; 2200f99fbf96SAlexander V. Chernikov 2201f99fbf96SAlexander V. Chernikov xtbl = (ipfw_xtable *)ipfw_get_sopt_header(sd, sizeof(ipfw_xtable)); 2202f99fbf96SAlexander V. Chernikov if (xtbl == NULL) 2203f99fbf96SAlexander V. Chernikov return (EINVAL); 2204f99fbf96SAlexander V. Chernikov 2205f99fbf96SAlexander V. Chernikov memset(&ti, 0, sizeof(ti)); 2206f99fbf96SAlexander V. Chernikov ti.uidx = xtbl->tbl; 2207f99fbf96SAlexander V. Chernikov 2208f99fbf96SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 2209f99fbf96SAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) { 2210f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2211f99fbf96SAlexander V. Chernikov return (0); 2212f99fbf96SAlexander V. Chernikov } 2213d3b00c08SAlexander V. Chernikov count = table_get_count(ch, tc); 2214d3b00c08SAlexander V. Chernikov sz = count * sizeof(ipfw_table_xentry) + sizeof(ipfw_xtable); 2215f99fbf96SAlexander V. Chernikov 2216d3b00c08SAlexander V. Chernikov xtbl->cnt = count; 2217f99fbf96SAlexander V. Chernikov xtbl->size = sz; 221874b22066SAlexander V. Chernikov xtbl->type = tc->no.subtype; 2219f99fbf96SAlexander V. Chernikov xtbl->tbl = ti.uidx; 2220f99fbf96SAlexander V. Chernikov 2221f99fbf96SAlexander V. Chernikov if (sd->valsize < sz) { 2222f99fbf96SAlexander V. Chernikov 2223f99fbf96SAlexander V. Chernikov /* 2224f99fbf96SAlexander V. Chernikov * Submitted buffer size is not enough. 2225f99fbf96SAlexander V. Chernikov * WE've already filled in @i structure with 2226f99fbf96SAlexander V. Chernikov * relevant table info including size, so we 2227f99fbf96SAlexander V. Chernikov * can return. Buffer will be flushed automatically. 2228f99fbf96SAlexander V. Chernikov */ 2229f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2230f99fbf96SAlexander V. Chernikov return (ENOMEM); 2231f99fbf96SAlexander V. Chernikov } 2232f99fbf96SAlexander V. Chernikov 2233f99fbf96SAlexander V. Chernikov /* Do the actual dump in eXtended format */ 2234f99fbf96SAlexander V. Chernikov memset(&da, 0, sizeof(da)); 22350cba2b28SAlexander V. Chernikov da.ch = ch; 2236f99fbf96SAlexander V. Chernikov da.ti = KIDX_TO_TI(ch, tc->no.kidx); 2237f99fbf96SAlexander V. Chernikov da.tc = tc; 2238f99fbf96SAlexander V. Chernikov da.sd = sd; 2239f99fbf96SAlexander V. Chernikov 2240f99fbf96SAlexander V. Chernikov ta = tc->ta; 2241f99fbf96SAlexander V. Chernikov 2242f99fbf96SAlexander V. Chernikov ta->foreach(tc->astate, da.ti, dump_table_xentry, &da); 2243f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2244f99fbf96SAlexander V. Chernikov 2245f99fbf96SAlexander V. Chernikov return (0); 2246f99fbf96SAlexander V. Chernikov } 2247f99fbf96SAlexander V. Chernikov 224881d3153dSAlexander V. Chernikov /* 2249e822d936SAlexander V. Chernikov * Legacy function to retrieve number of items in table. 2250e822d936SAlexander V. Chernikov */ 22516b988f3aSAlexander V. Chernikov static int 22526b988f3aSAlexander V. Chernikov get_table_size(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 2253e822d936SAlexander V. Chernikov struct sockopt_data *sd) 2254e822d936SAlexander V. Chernikov { 2255e822d936SAlexander V. Chernikov uint32_t *tbl; 2256e822d936SAlexander V. Chernikov struct tid_info ti; 2257e822d936SAlexander V. Chernikov size_t sz; 2258e822d936SAlexander V. Chernikov int error; 2259e822d936SAlexander V. Chernikov 2260e822d936SAlexander V. Chernikov sz = sizeof(*op3) + sizeof(uint32_t); 2261e822d936SAlexander V. Chernikov op3 = (ip_fw3_opheader *)ipfw_get_sopt_header(sd, sz); 2262e822d936SAlexander V. Chernikov if (op3 == NULL) 2263e822d936SAlexander V. Chernikov return (EINVAL); 2264e822d936SAlexander V. Chernikov 2265e822d936SAlexander V. Chernikov tbl = (uint32_t *)(op3 + 1); 2266e822d936SAlexander V. Chernikov memset(&ti, 0, sizeof(ti)); 2267e822d936SAlexander V. Chernikov ti.uidx = *tbl; 2268e822d936SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 2269e822d936SAlexander V. Chernikov error = ipfw_count_xtable(ch, &ti, tbl); 2270e822d936SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2271e822d936SAlexander V. Chernikov return (error); 2272e822d936SAlexander V. Chernikov } 2273e822d936SAlexander V. Chernikov 2274e822d936SAlexander V. Chernikov /* 227581d3153dSAlexander V. Chernikov * Legacy IP_FW_TABLE_GETSIZE handler 227681d3153dSAlexander V. Chernikov */ 22773b3a8eb9SGleb Smirnoff int 2278b074b7bbSAlexander V. Chernikov ipfw_count_table(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt) 22793b3a8eb9SGleb Smirnoff { 2280b074b7bbSAlexander V. Chernikov struct table_config *tc; 22813b3a8eb9SGleb Smirnoff 2282b074b7bbSAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) 2283b074b7bbSAlexander V. Chernikov return (ESRCH); 2284d3b00c08SAlexander V. Chernikov *cnt = table_get_count(ch, tc); 22853b3a8eb9SGleb Smirnoff return (0); 22863b3a8eb9SGleb Smirnoff } 22873b3a8eb9SGleb Smirnoff 228881d3153dSAlexander V. Chernikov /* 228981d3153dSAlexander V. Chernikov * Legacy IP_FW_TABLE_XGETSIZE handler 229081d3153dSAlexander V. Chernikov */ 22919f7d47b0SAlexander V. Chernikov int 22929f7d47b0SAlexander V. Chernikov ipfw_count_xtable(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt) 22933b3a8eb9SGleb Smirnoff { 22949f7d47b0SAlexander V. Chernikov struct table_config *tc; 2295d3b00c08SAlexander V. Chernikov uint32_t count; 22969f7d47b0SAlexander V. Chernikov 2297d3a4f924SAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) { 2298d3a4f924SAlexander V. Chernikov *cnt = 0; 22999f7d47b0SAlexander V. Chernikov return (0); /* 'table all list' requires success */ 2300d3a4f924SAlexander V. Chernikov } 2301d3b00c08SAlexander V. Chernikov 2302d3b00c08SAlexander V. Chernikov count = table_get_count(ch, tc); 2303d3b00c08SAlexander V. Chernikov *cnt = count * sizeof(ipfw_table_xentry); 2304d3b00c08SAlexander V. Chernikov if (count > 0) 23059f7d47b0SAlexander V. Chernikov *cnt += sizeof(ipfw_xtable); 23069f7d47b0SAlexander V. Chernikov return (0); 23079f7d47b0SAlexander V. Chernikov } 23089f7d47b0SAlexander V. Chernikov 23099f7d47b0SAlexander V. Chernikov static int 23109f7d47b0SAlexander V. Chernikov dump_table_entry(void *e, void *arg) 23119f7d47b0SAlexander V. Chernikov { 23129f7d47b0SAlexander V. Chernikov struct dump_args *da; 23139f7d47b0SAlexander V. Chernikov struct table_config *tc; 23149f7d47b0SAlexander V. Chernikov struct table_algo *ta; 23153b3a8eb9SGleb Smirnoff ipfw_table_entry *ent; 23160cba2b28SAlexander V. Chernikov struct table_value *pval; 231781d3153dSAlexander V. Chernikov int error; 23183b3a8eb9SGleb Smirnoff 23199f7d47b0SAlexander V. Chernikov da = (struct dump_args *)arg; 23209f7d47b0SAlexander V. Chernikov 23219f7d47b0SAlexander V. Chernikov tc = da->tc; 23229f7d47b0SAlexander V. Chernikov ta = tc->ta; 23239f7d47b0SAlexander V. Chernikov 23249f7d47b0SAlexander V. Chernikov /* Out of memory, returning */ 2325f1220db8SAlexander V. Chernikov if (da->cnt == da->size) 23263b3a8eb9SGleb Smirnoff return (1); 2327f1220db8SAlexander V. Chernikov ent = da->ent++; 2328f1220db8SAlexander V. Chernikov ent->tbl = da->uidx; 2329f1220db8SAlexander V. Chernikov da->cnt++; 23309f7d47b0SAlexander V. Chernikov 233181d3153dSAlexander V. Chernikov error = ta->dump_tentry(tc->astate, da->ti, e, &da->tent); 233281d3153dSAlexander V. Chernikov if (error != 0) 233381d3153dSAlexander V. Chernikov return (error); 233481d3153dSAlexander V. Chernikov 233581d3153dSAlexander V. Chernikov ent->addr = da->tent.k.addr.s_addr; 233681d3153dSAlexander V. Chernikov ent->masklen = da->tent.masklen; 23370cba2b28SAlexander V. Chernikov pval = get_table_value(da->ch, da->tc, da->tent.v.kidx); 23380cba2b28SAlexander V. Chernikov ent->value = ipfw_export_table_value_legacy(pval); 233981d3153dSAlexander V. Chernikov 234081d3153dSAlexander V. Chernikov return (0); 23413b3a8eb9SGleb Smirnoff } 23423b3a8eb9SGleb Smirnoff 2343f1220db8SAlexander V. Chernikov /* 2344f1220db8SAlexander V. Chernikov * Dumps table in pre-8.1 legacy format. 2345f1220db8SAlexander V. Chernikov */ 23463b3a8eb9SGleb Smirnoff int 2347f1220db8SAlexander V. Chernikov ipfw_dump_table_legacy(struct ip_fw_chain *ch, struct tid_info *ti, 2348f1220db8SAlexander V. Chernikov ipfw_table *tbl) 23493b3a8eb9SGleb Smirnoff { 2350b074b7bbSAlexander V. Chernikov struct table_config *tc; 23519f7d47b0SAlexander V. Chernikov struct table_algo *ta; 23529f7d47b0SAlexander V. Chernikov struct dump_args da; 23533b3a8eb9SGleb Smirnoff 23543b3a8eb9SGleb Smirnoff tbl->cnt = 0; 23553b3a8eb9SGleb Smirnoff 2356b074b7bbSAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) 2357b074b7bbSAlexander V. Chernikov return (0); /* XXX: We should return ESRCH */ 23589f7d47b0SAlexander V. Chernikov 23599f7d47b0SAlexander V. Chernikov ta = tc->ta; 23609f7d47b0SAlexander V. Chernikov 236181d3153dSAlexander V. Chernikov /* This dump format supports IPv4 only */ 236274b22066SAlexander V. Chernikov if (tc->no.subtype != IPFW_TABLE_ADDR) 236381d3153dSAlexander V. Chernikov return (0); 23649f7d47b0SAlexander V. Chernikov 2365d3a4f924SAlexander V. Chernikov memset(&da, 0, sizeof(da)); 23660cba2b28SAlexander V. Chernikov da.ch = ch; 23679f7d47b0SAlexander V. Chernikov da.ti = KIDX_TO_TI(ch, tc->no.kidx); 23689f7d47b0SAlexander V. Chernikov da.tc = tc; 2369f1220db8SAlexander V. Chernikov da.ent = &tbl->ent[0]; 2370f1220db8SAlexander V. Chernikov da.size = tbl->size; 23719f7d47b0SAlexander V. Chernikov 23729f7d47b0SAlexander V. Chernikov tbl->cnt = 0; 23739f7d47b0SAlexander V. Chernikov ta->foreach(tc->astate, da.ti, dump_table_entry, &da); 2374f1220db8SAlexander V. Chernikov tbl->cnt = da.cnt; 23759f7d47b0SAlexander V. Chernikov 23763b3a8eb9SGleb Smirnoff return (0); 23773b3a8eb9SGleb Smirnoff } 23783b3a8eb9SGleb Smirnoff 23799490a627SAlexander V. Chernikov /* 238081d3153dSAlexander V. Chernikov * Dumps table entry in eXtended format (v1)(current). 238181d3153dSAlexander V. Chernikov */ 238281d3153dSAlexander V. Chernikov static int 238381d3153dSAlexander V. Chernikov dump_table_tentry(void *e, void *arg) 238481d3153dSAlexander V. Chernikov { 238581d3153dSAlexander V. Chernikov struct dump_args *da; 238681d3153dSAlexander V. Chernikov struct table_config *tc; 238781d3153dSAlexander V. Chernikov struct table_algo *ta; 23880cba2b28SAlexander V. Chernikov struct table_value *pval; 238981d3153dSAlexander V. Chernikov ipfw_obj_tentry *tent; 23900cba2b28SAlexander V. Chernikov int error; 239181d3153dSAlexander V. Chernikov 239281d3153dSAlexander V. Chernikov da = (struct dump_args *)arg; 239381d3153dSAlexander V. Chernikov 239481d3153dSAlexander V. Chernikov tc = da->tc; 239581d3153dSAlexander V. Chernikov ta = tc->ta; 239681d3153dSAlexander V. Chernikov 239781d3153dSAlexander V. Chernikov tent = (ipfw_obj_tentry *)ipfw_get_sopt_space(da->sd, sizeof(*tent)); 239881d3153dSAlexander V. Chernikov /* Out of memory, returning */ 239981d3153dSAlexander V. Chernikov if (tent == NULL) { 240081d3153dSAlexander V. Chernikov da->error = ENOMEM; 240181d3153dSAlexander V. Chernikov return (1); 240281d3153dSAlexander V. Chernikov } 240381d3153dSAlexander V. Chernikov tent->head.length = sizeof(ipfw_obj_tentry); 240481d3153dSAlexander V. Chernikov tent->idx = da->uidx; 240581d3153dSAlexander V. Chernikov 24060cba2b28SAlexander V. Chernikov error = ta->dump_tentry(tc->astate, da->ti, e, tent); 24070cba2b28SAlexander V. Chernikov if (error != 0) 24080cba2b28SAlexander V. Chernikov return (error); 24090cba2b28SAlexander V. Chernikov 24100cba2b28SAlexander V. Chernikov pval = get_table_value(da->ch, da->tc, tent->v.kidx); 24110cba2b28SAlexander V. Chernikov ipfw_export_table_value_v1(pval, &tent->v.value); 24120cba2b28SAlexander V. Chernikov 24130cba2b28SAlexander V. Chernikov return (0); 241481d3153dSAlexander V. Chernikov } 241581d3153dSAlexander V. Chernikov 241681d3153dSAlexander V. Chernikov /* 241781d3153dSAlexander V. Chernikov * Dumps table entry in eXtended format (v0). 24189490a627SAlexander V. Chernikov */ 24193b3a8eb9SGleb Smirnoff static int 24209f7d47b0SAlexander V. Chernikov dump_table_xentry(void *e, void *arg) 24213b3a8eb9SGleb Smirnoff { 24229f7d47b0SAlexander V. Chernikov struct dump_args *da; 24239f7d47b0SAlexander V. Chernikov struct table_config *tc; 24249f7d47b0SAlexander V. Chernikov struct table_algo *ta; 24253b3a8eb9SGleb Smirnoff ipfw_table_xentry *xent; 242681d3153dSAlexander V. Chernikov ipfw_obj_tentry *tent; 24270cba2b28SAlexander V. Chernikov struct table_value *pval; 242881d3153dSAlexander V. Chernikov int error; 24293b3a8eb9SGleb Smirnoff 24309f7d47b0SAlexander V. Chernikov da = (struct dump_args *)arg; 24319f7d47b0SAlexander V. Chernikov 24329f7d47b0SAlexander V. Chernikov tc = da->tc; 24339f7d47b0SAlexander V. Chernikov ta = tc->ta; 24349f7d47b0SAlexander V. Chernikov 24352d99a349SAlexander V. Chernikov xent = (ipfw_table_xentry *)ipfw_get_sopt_space(da->sd, sizeof(*xent)); 24363b3a8eb9SGleb Smirnoff /* Out of memory, returning */ 24372d99a349SAlexander V. Chernikov if (xent == NULL) 24383b3a8eb9SGleb Smirnoff return (1); 24393b3a8eb9SGleb Smirnoff xent->len = sizeof(ipfw_table_xentry); 2440f1220db8SAlexander V. Chernikov xent->tbl = da->uidx; 24419f7d47b0SAlexander V. Chernikov 244281d3153dSAlexander V. Chernikov memset(&da->tent, 0, sizeof(da->tent)); 244381d3153dSAlexander V. Chernikov tent = &da->tent; 244481d3153dSAlexander V. Chernikov error = ta->dump_tentry(tc->astate, da->ti, e, tent); 244581d3153dSAlexander V. Chernikov if (error != 0) 244681d3153dSAlexander V. Chernikov return (error); 244781d3153dSAlexander V. Chernikov 244881d3153dSAlexander V. Chernikov /* Convert current format to previous one */ 244981d3153dSAlexander V. Chernikov xent->masklen = tent->masklen; 24500cba2b28SAlexander V. Chernikov pval = get_table_value(da->ch, da->tc, da->tent.v.kidx); 24510cba2b28SAlexander V. Chernikov xent->value = ipfw_export_table_value_legacy(pval); 245281d3153dSAlexander V. Chernikov /* Apply some hacks */ 245374b22066SAlexander V. Chernikov if (tc->no.subtype == IPFW_TABLE_ADDR && tent->subtype == AF_INET) { 245481d3153dSAlexander V. Chernikov xent->k.addr6.s6_addr32[3] = tent->k.addr.s_addr; 245581d3153dSAlexander V. Chernikov xent->flags = IPFW_TCF_INET; 245681d3153dSAlexander V. Chernikov } else 245781d3153dSAlexander V. Chernikov memcpy(&xent->k, &tent->k, sizeof(xent->k)); 245881d3153dSAlexander V. Chernikov 245981d3153dSAlexander V. Chernikov return (0); 24609f7d47b0SAlexander V. Chernikov } 24619f7d47b0SAlexander V. Chernikov 24629f7d47b0SAlexander V. Chernikov /* 24634dff4ae0SAlexander V. Chernikov * Helper function to export table algo data 24644dff4ae0SAlexander V. Chernikov * to tentry format before calling user function. 24654dff4ae0SAlexander V. Chernikov * 24664dff4ae0SAlexander V. Chernikov * Returns 0 on success. 24674dff4ae0SAlexander V. Chernikov */ 24684dff4ae0SAlexander V. Chernikov static int 24694dff4ae0SAlexander V. Chernikov prepare_table_tentry(void *e, void *arg) 24704dff4ae0SAlexander V. Chernikov { 24714dff4ae0SAlexander V. Chernikov struct dump_args *da; 24724dff4ae0SAlexander V. Chernikov struct table_config *tc; 24734dff4ae0SAlexander V. Chernikov struct table_algo *ta; 24744dff4ae0SAlexander V. Chernikov int error; 24754dff4ae0SAlexander V. Chernikov 24764dff4ae0SAlexander V. Chernikov da = (struct dump_args *)arg; 24774dff4ae0SAlexander V. Chernikov 24784dff4ae0SAlexander V. Chernikov tc = da->tc; 24794dff4ae0SAlexander V. Chernikov ta = tc->ta; 24804dff4ae0SAlexander V. Chernikov 24814dff4ae0SAlexander V. Chernikov error = ta->dump_tentry(tc->astate, da->ti, e, &da->tent); 24824dff4ae0SAlexander V. Chernikov if (error != 0) 24834dff4ae0SAlexander V. Chernikov return (error); 24844dff4ae0SAlexander V. Chernikov 24854dff4ae0SAlexander V. Chernikov da->f(&da->tent, da->farg); 24864dff4ae0SAlexander V. Chernikov 24874dff4ae0SAlexander V. Chernikov return (0); 24884dff4ae0SAlexander V. Chernikov } 24894dff4ae0SAlexander V. Chernikov 24904dff4ae0SAlexander V. Chernikov /* 24914dff4ae0SAlexander V. Chernikov * Allow external consumers to read table entries in standard format. 24924dff4ae0SAlexander V. Chernikov */ 24934dff4ae0SAlexander V. Chernikov int 24944dff4ae0SAlexander V. Chernikov ipfw_foreach_table_tentry(struct ip_fw_chain *ch, uint16_t kidx, 24954dff4ae0SAlexander V. Chernikov ta_foreach_f *f, void *arg) 24964dff4ae0SAlexander V. Chernikov { 24974dff4ae0SAlexander V. Chernikov struct namedobj_instance *ni; 24984dff4ae0SAlexander V. Chernikov struct table_config *tc; 24994dff4ae0SAlexander V. Chernikov struct table_algo *ta; 25004dff4ae0SAlexander V. Chernikov struct dump_args da; 25014dff4ae0SAlexander V. Chernikov 25024dff4ae0SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 25034dff4ae0SAlexander V. Chernikov 25044dff4ae0SAlexander V. Chernikov tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, kidx); 25054dff4ae0SAlexander V. Chernikov if (tc == NULL) 25064dff4ae0SAlexander V. Chernikov return (ESRCH); 25074dff4ae0SAlexander V. Chernikov 25084dff4ae0SAlexander V. Chernikov ta = tc->ta; 25094dff4ae0SAlexander V. Chernikov 25104dff4ae0SAlexander V. Chernikov memset(&da, 0, sizeof(da)); 25110cba2b28SAlexander V. Chernikov da.ch = ch; 25124dff4ae0SAlexander V. Chernikov da.ti = KIDX_TO_TI(ch, tc->no.kidx); 25134dff4ae0SAlexander V. Chernikov da.tc = tc; 25144dff4ae0SAlexander V. Chernikov da.f = f; 25154dff4ae0SAlexander V. Chernikov da.farg = arg; 25164dff4ae0SAlexander V. Chernikov 25174dff4ae0SAlexander V. Chernikov ta->foreach(tc->astate, da.ti, prepare_table_tentry, &da); 25184dff4ae0SAlexander V. Chernikov 25194dff4ae0SAlexander V. Chernikov return (0); 25204dff4ae0SAlexander V. Chernikov } 25214dff4ae0SAlexander V. Chernikov 25224dff4ae0SAlexander V. Chernikov /* 25239f7d47b0SAlexander V. Chernikov * Table algorithms 25249f7d47b0SAlexander V. Chernikov */ 25253b3a8eb9SGleb Smirnoff 25269f7d47b0SAlexander V. Chernikov /* 2527a4641f4eSPedro F. Giffuni * Finds algorithm by index, table type or supplied name. 252835e1bbd0SAlexander V. Chernikov * 252935e1bbd0SAlexander V. Chernikov * Returns pointer to algo or NULL. 25309f7d47b0SAlexander V. Chernikov */ 25319f7d47b0SAlexander V. Chernikov static struct table_algo * 25329490a627SAlexander V. Chernikov find_table_algo(struct tables_config *tcfg, struct tid_info *ti, char *name) 25339f7d47b0SAlexander V. Chernikov { 25349490a627SAlexander V. Chernikov int i, l; 25359490a627SAlexander V. Chernikov struct table_algo *ta; 25369f7d47b0SAlexander V. Chernikov 253757a1cf95SAlexander V. Chernikov if (ti->type > IPFW_TABLE_MAXTYPE) 253857a1cf95SAlexander V. Chernikov return (NULL); 253957a1cf95SAlexander V. Chernikov 25409f7d47b0SAlexander V. Chernikov /* Search by index */ 25419f7d47b0SAlexander V. Chernikov if (ti->atype != 0) { 25429f7d47b0SAlexander V. Chernikov if (ti->atype > tcfg->algo_count) 25439f7d47b0SAlexander V. Chernikov return (NULL); 25449f7d47b0SAlexander V. Chernikov return (tcfg->algo[ti->atype]); 25459f7d47b0SAlexander V. Chernikov } 25469f7d47b0SAlexander V. Chernikov 2547fd0869d5SAlexander V. Chernikov if (name == NULL) { 2548fd0869d5SAlexander V. Chernikov /* Return default algorithm for given type if set */ 2549fd0869d5SAlexander V. Chernikov return (tcfg->def_algo[ti->type]); 2550fd0869d5SAlexander V. Chernikov } 2551fd0869d5SAlexander V. Chernikov 2552fd0869d5SAlexander V. Chernikov /* Search by name */ 25539490a627SAlexander V. Chernikov /* TODO: better search */ 25549490a627SAlexander V. Chernikov for (i = 1; i <= tcfg->algo_count; i++) { 25559490a627SAlexander V. Chernikov ta = tcfg->algo[i]; 25569490a627SAlexander V. Chernikov 25579490a627SAlexander V. Chernikov /* 25589490a627SAlexander V. Chernikov * One can supply additional algorithm 25599490a627SAlexander V. Chernikov * parameters so we compare only the first word 25609490a627SAlexander V. Chernikov * of supplied name: 2561c21034b7SAlexander V. Chernikov * 'addr:chash hsize=32' 25629490a627SAlexander V. Chernikov * '^^^^^^^^^' 25639490a627SAlexander V. Chernikov * 25649490a627SAlexander V. Chernikov */ 25659490a627SAlexander V. Chernikov l = strlen(ta->name); 2566fd0869d5SAlexander V. Chernikov if (strncmp(name, ta->name, l) != 0) 2567fd0869d5SAlexander V. Chernikov continue; 2568fd0869d5SAlexander V. Chernikov if (name[l] != '\0' && name[l] != ' ') 2569fd0869d5SAlexander V. Chernikov continue; 2570fd0869d5SAlexander V. Chernikov /* Check if we're requesting proper table type */ 2571fd0869d5SAlexander V. Chernikov if (ti->type != 0 && ti->type != ta->type) 2572fd0869d5SAlexander V. Chernikov return (NULL); 25739490a627SAlexander V. Chernikov return (ta); 25749490a627SAlexander V. Chernikov } 25759490a627SAlexander V. Chernikov 25769490a627SAlexander V. Chernikov return (NULL); 25779490a627SAlexander V. Chernikov } 25789490a627SAlexander V. Chernikov 2579b6ee846eSAlexander V. Chernikov /* 2580b6ee846eSAlexander V. Chernikov * Register new table algo @ta. 258135e1bbd0SAlexander V. Chernikov * Stores algo id inside @idx. 2582b6ee846eSAlexander V. Chernikov * 2583b6ee846eSAlexander V. Chernikov * Returns 0 on success. 2584b6ee846eSAlexander V. Chernikov */ 25850b565ac0SAlexander V. Chernikov int 25860b565ac0SAlexander V. Chernikov ipfw_add_table_algo(struct ip_fw_chain *ch, struct table_algo *ta, size_t size, 25870b565ac0SAlexander V. Chernikov int *idx) 25883b3a8eb9SGleb Smirnoff { 25899f7d47b0SAlexander V. Chernikov struct tables_config *tcfg; 25900b565ac0SAlexander V. Chernikov struct table_algo *ta_new; 2591b6ee846eSAlexander V. Chernikov size_t sz; 25920b565ac0SAlexander V. Chernikov 25930b565ac0SAlexander V. Chernikov if (size > sizeof(struct table_algo)) 25940b565ac0SAlexander V. Chernikov return (EINVAL); 25950b565ac0SAlexander V. Chernikov 2596b6ee846eSAlexander V. Chernikov /* Check for the required on-stack size for add/del */ 2597b6ee846eSAlexander V. Chernikov sz = roundup2(ta->ta_buf_size, sizeof(void *)); 2598b6ee846eSAlexander V. Chernikov if (sz > TA_BUF_SZ) 2599b6ee846eSAlexander V. Chernikov return (EINVAL); 2600b6ee846eSAlexander V. Chernikov 2601fddbbf75SAlexander V. Chernikov KASSERT(ta->type <= IPFW_TABLE_MAXTYPE,("Increase IPFW_TABLE_MAXTYPE")); 260257a1cf95SAlexander V. Chernikov 260335e1bbd0SAlexander V. Chernikov /* Copy algorithm data to stable storage. */ 26040b565ac0SAlexander V. Chernikov ta_new = malloc(sizeof(struct table_algo), M_IPFW, M_WAITOK | M_ZERO); 26050b565ac0SAlexander V. Chernikov memcpy(ta_new, ta, size); 26063b3a8eb9SGleb Smirnoff 26079f7d47b0SAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 2608b074b7bbSAlexander V. Chernikov 26099f7d47b0SAlexander V. Chernikov KASSERT(tcfg->algo_count < 255, ("Increase algo array size")); 26109f7d47b0SAlexander V. Chernikov 26110b565ac0SAlexander V. Chernikov tcfg->algo[++tcfg->algo_count] = ta_new; 26120b565ac0SAlexander V. Chernikov ta_new->idx = tcfg->algo_count; 26130b565ac0SAlexander V. Chernikov 261457a1cf95SAlexander V. Chernikov /* Set algorithm as default one for given type */ 261557a1cf95SAlexander V. Chernikov if ((ta_new->flags & TA_FLAG_DEFAULT) != 0 && 261657a1cf95SAlexander V. Chernikov tcfg->def_algo[ta_new->type] == NULL) 261757a1cf95SAlexander V. Chernikov tcfg->def_algo[ta_new->type] = ta_new; 261857a1cf95SAlexander V. Chernikov 26190b565ac0SAlexander V. Chernikov *idx = ta_new->idx; 26200b565ac0SAlexander V. Chernikov 26210b565ac0SAlexander V. Chernikov return (0); 26220b565ac0SAlexander V. Chernikov } 26230b565ac0SAlexander V. Chernikov 2624b6ee846eSAlexander V. Chernikov /* 2625b6ee846eSAlexander V. Chernikov * Unregisters table algo using @idx as id. 2626c8d5d308SAlexander V. Chernikov * XXX: It is NOT safe to call this function in any place 2627c8d5d308SAlexander V. Chernikov * other than ipfw instance destroy handler. 2628b6ee846eSAlexander V. Chernikov */ 26290b565ac0SAlexander V. Chernikov void 26300b565ac0SAlexander V. Chernikov ipfw_del_table_algo(struct ip_fw_chain *ch, int idx) 26310b565ac0SAlexander V. Chernikov { 26320b565ac0SAlexander V. Chernikov struct tables_config *tcfg; 26330b565ac0SAlexander V. Chernikov struct table_algo *ta; 26340b565ac0SAlexander V. Chernikov 26350b565ac0SAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 26360b565ac0SAlexander V. Chernikov 2637b6ee846eSAlexander V. Chernikov KASSERT(idx <= tcfg->algo_count, ("algo idx %d out of range 1..%d", 2638b6ee846eSAlexander V. Chernikov idx, tcfg->algo_count)); 26390b565ac0SAlexander V. Chernikov 26400b565ac0SAlexander V. Chernikov ta = tcfg->algo[idx]; 26410b565ac0SAlexander V. Chernikov KASSERT(ta != NULL, ("algo idx %d is NULL", idx)); 264257a1cf95SAlexander V. Chernikov 264357a1cf95SAlexander V. Chernikov if (tcfg->def_algo[ta->type] == ta) 264457a1cf95SAlexander V. Chernikov tcfg->def_algo[ta->type] = NULL; 264557a1cf95SAlexander V. Chernikov 26460b565ac0SAlexander V. Chernikov free(ta, M_IPFW); 26473b3a8eb9SGleb Smirnoff } 26483b3a8eb9SGleb Smirnoff 26499d099b4fSAlexander V. Chernikov /* 26509d099b4fSAlexander V. Chernikov * Lists all table algorithms currently available. 26519d099b4fSAlexander V. Chernikov * Data layout (v0)(current): 26529d099b4fSAlexander V. Chernikov * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size 26539d099b4fSAlexander V. Chernikov * Reply: [ ipfw_obj_lheader ipfw_ta_info x N ] 26549d099b4fSAlexander V. Chernikov * 26559d099b4fSAlexander V. Chernikov * Returns 0 on success 26569d099b4fSAlexander V. Chernikov */ 26576b988f3aSAlexander V. Chernikov static int 26586b988f3aSAlexander V. Chernikov list_table_algo(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 2659e822d936SAlexander V. Chernikov struct sockopt_data *sd) 26609d099b4fSAlexander V. Chernikov { 26619d099b4fSAlexander V. Chernikov struct _ipfw_obj_lheader *olh; 26629d099b4fSAlexander V. Chernikov struct tables_config *tcfg; 26639d099b4fSAlexander V. Chernikov ipfw_ta_info *i; 26649d099b4fSAlexander V. Chernikov struct table_algo *ta; 26659d099b4fSAlexander V. Chernikov uint32_t count, n, size; 26669d099b4fSAlexander V. Chernikov 26679d099b4fSAlexander V. Chernikov olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh)); 26689d099b4fSAlexander V. Chernikov if (olh == NULL) 26699d099b4fSAlexander V. Chernikov return (EINVAL); 26709d099b4fSAlexander V. Chernikov if (sd->valsize < olh->size) 26719d099b4fSAlexander V. Chernikov return (EINVAL); 26729d099b4fSAlexander V. Chernikov 26739d099b4fSAlexander V. Chernikov IPFW_UH_RLOCK(ch); 26749d099b4fSAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 26759d099b4fSAlexander V. Chernikov count = tcfg->algo_count; 26769d099b4fSAlexander V. Chernikov size = count * sizeof(ipfw_ta_info) + sizeof(ipfw_obj_lheader); 26779d099b4fSAlexander V. Chernikov 26789d099b4fSAlexander V. Chernikov /* Fill in header regadless of buffer size */ 26799d099b4fSAlexander V. Chernikov olh->count = count; 26809d099b4fSAlexander V. Chernikov olh->objsize = sizeof(ipfw_ta_info); 26819d099b4fSAlexander V. Chernikov 26829d099b4fSAlexander V. Chernikov if (size > olh->size) { 26839d099b4fSAlexander V. Chernikov olh->size = size; 26849d099b4fSAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 26859d099b4fSAlexander V. Chernikov return (ENOMEM); 26869d099b4fSAlexander V. Chernikov } 26879d099b4fSAlexander V. Chernikov olh->size = size; 26889d099b4fSAlexander V. Chernikov 26899d099b4fSAlexander V. Chernikov for (n = 1; n <= count; n++) { 26909d099b4fSAlexander V. Chernikov i = (ipfw_ta_info *)ipfw_get_sopt_space(sd, sizeof(*i)); 26917a6ab8f1SPedro F. Giffuni KASSERT(i != NULL, ("previously checked buffer is not enough")); 26929d099b4fSAlexander V. Chernikov ta = tcfg->algo[n]; 26939d099b4fSAlexander V. Chernikov strlcpy(i->algoname, ta->name, sizeof(i->algoname)); 26949d099b4fSAlexander V. Chernikov i->type = ta->type; 26959d099b4fSAlexander V. Chernikov i->refcnt = ta->refcnt; 26969d099b4fSAlexander V. Chernikov } 26979d099b4fSAlexander V. Chernikov 26989d099b4fSAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 26999d099b4fSAlexander V. Chernikov 27009d099b4fSAlexander V. Chernikov return (0); 27019d099b4fSAlexander V. Chernikov } 27029d099b4fSAlexander V. Chernikov 2703b074b7bbSAlexander V. Chernikov static int 270474b22066SAlexander V. Chernikov classify_srcdst(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 2705b074b7bbSAlexander V. Chernikov { 2706b074b7bbSAlexander V. Chernikov /* Basic IPv4/IPv6 or u32 lookups */ 2707b074b7bbSAlexander V. Chernikov *puidx = cmd->arg1; 2708c21034b7SAlexander V. Chernikov /* Assume ADDR by default */ 2709c21034b7SAlexander V. Chernikov *ptype = IPFW_TABLE_ADDR; 271074b22066SAlexander V. Chernikov int v; 2711b074b7bbSAlexander V. Chernikov 2712b074b7bbSAlexander V. Chernikov if (F_LEN(cmd) > F_INSN_SIZE(ipfw_insn_u32)) { 2713b074b7bbSAlexander V. Chernikov /* 2714b074b7bbSAlexander V. Chernikov * generic lookup. The key must be 2715b074b7bbSAlexander V. Chernikov * in 32bit big-endian format. 2716b074b7bbSAlexander V. Chernikov */ 2717b074b7bbSAlexander V. Chernikov v = ((ipfw_insn_u32 *)cmd)->d[1]; 2718b074b7bbSAlexander V. Chernikov switch (v) { 2719b074b7bbSAlexander V. Chernikov case 0: 2720b074b7bbSAlexander V. Chernikov case 1: 2721b074b7bbSAlexander V. Chernikov /* IPv4 src/dst */ 2722b074b7bbSAlexander V. Chernikov break; 2723b074b7bbSAlexander V. Chernikov case 2: 2724b074b7bbSAlexander V. Chernikov case 3: 2725b074b7bbSAlexander V. Chernikov /* src/dst port */ 2726b23d5de9SAlexander V. Chernikov *ptype = IPFW_TABLE_NUMBER; 2727b074b7bbSAlexander V. Chernikov break; 2728b074b7bbSAlexander V. Chernikov case 4: 2729b074b7bbSAlexander V. Chernikov /* uid/gid */ 2730b23d5de9SAlexander V. Chernikov *ptype = IPFW_TABLE_NUMBER; 2731b23d5de9SAlexander V. Chernikov break; 2732b074b7bbSAlexander V. Chernikov case 5: 2733b074b7bbSAlexander V. Chernikov /* jid */ 2734b23d5de9SAlexander V. Chernikov *ptype = IPFW_TABLE_NUMBER; 2735b23d5de9SAlexander V. Chernikov break; 2736b074b7bbSAlexander V. Chernikov case 6: 2737b074b7bbSAlexander V. Chernikov /* dscp */ 2738b23d5de9SAlexander V. Chernikov *ptype = IPFW_TABLE_NUMBER; 2739b074b7bbSAlexander V. Chernikov break; 2740b074b7bbSAlexander V. Chernikov } 2741b074b7bbSAlexander V. Chernikov } 2742b074b7bbSAlexander V. Chernikov 274374b22066SAlexander V. Chernikov return (0); 2744b074b7bbSAlexander V. Chernikov } 2745b074b7bbSAlexander V. Chernikov 274674b22066SAlexander V. Chernikov static int 274774b22066SAlexander V. Chernikov classify_via(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 2748b074b7bbSAlexander V. Chernikov { 2749b074b7bbSAlexander V. Chernikov ipfw_insn_if *cmdif; 2750b074b7bbSAlexander V. Chernikov 2751b074b7bbSAlexander V. Chernikov /* Interface table, possibly */ 2752b074b7bbSAlexander V. Chernikov cmdif = (ipfw_insn_if *)cmd; 275374b22066SAlexander V. Chernikov if (cmdif->name[0] != '\1') 275474b22066SAlexander V. Chernikov return (1); 275574b22066SAlexander V. Chernikov 275674b22066SAlexander V. Chernikov *ptype = IPFW_TABLE_INTERFACE; 275774b22066SAlexander V. Chernikov *puidx = cmdif->p.kidx; 275874b22066SAlexander V. Chernikov 275974b22066SAlexander V. Chernikov return (0); 276074b22066SAlexander V. Chernikov } 276174b22066SAlexander V. Chernikov 276274b22066SAlexander V. Chernikov static int 276374b22066SAlexander V. Chernikov classify_flow(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 276474b22066SAlexander V. Chernikov { 276574b22066SAlexander V. Chernikov 276674b22066SAlexander V. Chernikov *puidx = cmd->arg1; 276774b22066SAlexander V. Chernikov *ptype = IPFW_TABLE_FLOW; 276874b22066SAlexander V. Chernikov 276974b22066SAlexander V. Chernikov return (0); 277074b22066SAlexander V. Chernikov } 277174b22066SAlexander V. Chernikov 277274b22066SAlexander V. Chernikov static void 277374b22066SAlexander V. Chernikov update_arg1(ipfw_insn *cmd, uint16_t idx) 277474b22066SAlexander V. Chernikov { 277574b22066SAlexander V. Chernikov 2776914bffb6SAlexander V. Chernikov cmd->arg1 = idx; 2777b074b7bbSAlexander V. Chernikov } 277874b22066SAlexander V. Chernikov 277974b22066SAlexander V. Chernikov static void 278074b22066SAlexander V. Chernikov update_via(ipfw_insn *cmd, uint16_t idx) 278174b22066SAlexander V. Chernikov { 278274b22066SAlexander V. Chernikov ipfw_insn_if *cmdif; 278374b22066SAlexander V. Chernikov 278474b22066SAlexander V. Chernikov cmdif = (ipfw_insn_if *)cmd; 278574b22066SAlexander V. Chernikov cmdif->p.kidx = idx; 2786b074b7bbSAlexander V. Chernikov } 2787b074b7bbSAlexander V. Chernikov 278874b22066SAlexander V. Chernikov static int 278974b22066SAlexander V. Chernikov table_findbyname(struct ip_fw_chain *ch, struct tid_info *ti, 279074b22066SAlexander V. Chernikov struct named_object **pno) 279174b22066SAlexander V. Chernikov { 279274b22066SAlexander V. Chernikov struct table_config *tc; 279374b22066SAlexander V. Chernikov int error; 279474b22066SAlexander V. Chernikov 279574b22066SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 279674b22066SAlexander V. Chernikov 279774b22066SAlexander V. Chernikov error = find_table_err(CHAIN_TO_NI(ch), ti, &tc); 279874b22066SAlexander V. Chernikov if (error != 0) 279974b22066SAlexander V. Chernikov return (error); 280074b22066SAlexander V. Chernikov 280174b22066SAlexander V. Chernikov *pno = &tc->no; 280274b22066SAlexander V. Chernikov return (0); 280374b22066SAlexander V. Chernikov } 280474b22066SAlexander V. Chernikov 280574b22066SAlexander V. Chernikov /* XXX: sets-sets! */ 280674b22066SAlexander V. Chernikov static struct named_object * 280774b22066SAlexander V. Chernikov table_findbykidx(struct ip_fw_chain *ch, uint16_t idx) 280874b22066SAlexander V. Chernikov { 280974b22066SAlexander V. Chernikov struct namedobj_instance *ni; 281074b22066SAlexander V. Chernikov struct table_config *tc; 281174b22066SAlexander V. Chernikov 281274b22066SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 281374b22066SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 281474b22066SAlexander V. Chernikov tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, idx); 281574b22066SAlexander V. Chernikov KASSERT(tc != NULL, ("Table with index %d not found", idx)); 281674b22066SAlexander V. Chernikov 281774b22066SAlexander V. Chernikov return (&tc->no); 281874b22066SAlexander V. Chernikov } 281974b22066SAlexander V. Chernikov 28202685841bSAndrey V. Elsukov static int 28212685841bSAndrey V. Elsukov table_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set, 28222685841bSAndrey V. Elsukov enum ipfw_sets_cmd cmd) 28232685841bSAndrey V. Elsukov { 28242685841bSAndrey V. Elsukov 28252685841bSAndrey V. Elsukov switch (cmd) { 28262685841bSAndrey V. Elsukov case SWAP_ALL: 28272685841bSAndrey V. Elsukov case TEST_ALL: 28282685841bSAndrey V. Elsukov /* 28292685841bSAndrey V. Elsukov * Return success for TEST_ALL, since nothing prevents 28302685841bSAndrey V. Elsukov * move rules from one set to another. All tables are 28312685841bSAndrey V. Elsukov * accessible from all sets when per-set tables sysctl 28322685841bSAndrey V. Elsukov * is disabled. 28332685841bSAndrey V. Elsukov */ 28342685841bSAndrey V. Elsukov case MOVE_ALL: 28352685841bSAndrey V. Elsukov case TEST_ONE: 28362685841bSAndrey V. Elsukov case MOVE_ONE: 28372685841bSAndrey V. Elsukov /* 28382685841bSAndrey V. Elsukov * NOTE: we need to use ipfw_objhash_del/ipfw_objhash_add 28392685841bSAndrey V. Elsukov * if set number will be used in hash function. Currently 28402685841bSAndrey V. Elsukov * we can just use generic handler that replaces set value. 28412685841bSAndrey V. Elsukov */ 28422685841bSAndrey V. Elsukov if (V_fw_tables_sets == 0) 28432685841bSAndrey V. Elsukov return (0); 28442685841bSAndrey V. Elsukov break; 28452685841bSAndrey V. Elsukov case COUNT_ONE: 28462685841bSAndrey V. Elsukov /* 28472685841bSAndrey V. Elsukov * Return EOPNOTSUPP for COUNT_ONE when per-set sysctl is 28482685841bSAndrey V. Elsukov * disabled. This allow skip table's opcodes from additional 28492685841bSAndrey V. Elsukov * checks when specific rules moved to another set. 28502685841bSAndrey V. Elsukov */ 28512685841bSAndrey V. Elsukov if (V_fw_tables_sets == 0) 28522685841bSAndrey V. Elsukov return (EOPNOTSUPP); 28532685841bSAndrey V. Elsukov } 28542685841bSAndrey V. Elsukov /* Use generic sets handler when per-set sysctl is enabled. */ 28552685841bSAndrey V. Elsukov return (ipfw_obj_manage_sets(CHAIN_TO_NI(ch), IPFW_TLV_TBL_NAME, 28562685841bSAndrey V. Elsukov set, new_set, cmd)); 28572685841bSAndrey V. Elsukov } 28582685841bSAndrey V. Elsukov 285974b22066SAlexander V. Chernikov static struct opcode_obj_rewrite opcodes[] = { 286074b22066SAlexander V. Chernikov { 28612685841bSAndrey V. Elsukov .opcode = O_IP_SRC_LOOKUP, 28622685841bSAndrey V. Elsukov .etlv = IPFW_TLV_TBL_NAME, 28632685841bSAndrey V. Elsukov .classifier = classify_srcdst, 28642685841bSAndrey V. Elsukov .update = update_arg1, 28652685841bSAndrey V. Elsukov .find_byname = table_findbyname, 28662685841bSAndrey V. Elsukov .find_bykidx = table_findbykidx, 28672685841bSAndrey V. Elsukov .create_object = create_table_compat, 28682685841bSAndrey V. Elsukov .manage_sets = table_manage_sets, 286974b22066SAlexander V. Chernikov }, 287074b22066SAlexander V. Chernikov { 28712685841bSAndrey V. Elsukov .opcode = O_IP_DST_LOOKUP, 28722685841bSAndrey V. Elsukov .etlv = IPFW_TLV_TBL_NAME, 28732685841bSAndrey V. Elsukov .classifier = classify_srcdst, 28742685841bSAndrey V. Elsukov .update = update_arg1, 28752685841bSAndrey V. Elsukov .find_byname = table_findbyname, 28762685841bSAndrey V. Elsukov .find_bykidx = table_findbykidx, 28772685841bSAndrey V. Elsukov .create_object = create_table_compat, 28782685841bSAndrey V. Elsukov .manage_sets = table_manage_sets, 287974b22066SAlexander V. Chernikov }, 288074b22066SAlexander V. Chernikov { 28812685841bSAndrey V. Elsukov .opcode = O_IP_FLOW_LOOKUP, 28822685841bSAndrey V. Elsukov .etlv = IPFW_TLV_TBL_NAME, 28832685841bSAndrey V. Elsukov .classifier = classify_flow, 28842685841bSAndrey V. Elsukov .update = update_arg1, 28852685841bSAndrey V. Elsukov .find_byname = table_findbyname, 28862685841bSAndrey V. Elsukov .find_bykidx = table_findbykidx, 28872685841bSAndrey V. Elsukov .create_object = create_table_compat, 28882685841bSAndrey V. Elsukov .manage_sets = table_manage_sets, 288974b22066SAlexander V. Chernikov }, 289074b22066SAlexander V. Chernikov { 28912685841bSAndrey V. Elsukov .opcode = O_XMIT, 28922685841bSAndrey V. Elsukov .etlv = IPFW_TLV_TBL_NAME, 28932685841bSAndrey V. Elsukov .classifier = classify_via, 28942685841bSAndrey V. Elsukov .update = update_via, 28952685841bSAndrey V. Elsukov .find_byname = table_findbyname, 28962685841bSAndrey V. Elsukov .find_bykidx = table_findbykidx, 28972685841bSAndrey V. Elsukov .create_object = create_table_compat, 28982685841bSAndrey V. Elsukov .manage_sets = table_manage_sets, 289974b22066SAlexander V. Chernikov }, 290074b22066SAlexander V. Chernikov { 29012685841bSAndrey V. Elsukov .opcode = O_RECV, 29022685841bSAndrey V. Elsukov .etlv = IPFW_TLV_TBL_NAME, 29032685841bSAndrey V. Elsukov .classifier = classify_via, 29042685841bSAndrey V. Elsukov .update = update_via, 29052685841bSAndrey V. Elsukov .find_byname = table_findbyname, 29062685841bSAndrey V. Elsukov .find_bykidx = table_findbykidx, 29072685841bSAndrey V. Elsukov .create_object = create_table_compat, 29082685841bSAndrey V. Elsukov .manage_sets = table_manage_sets, 290974b22066SAlexander V. Chernikov }, 291074b22066SAlexander V. Chernikov { 29112685841bSAndrey V. Elsukov .opcode = O_VIA, 29122685841bSAndrey V. Elsukov .etlv = IPFW_TLV_TBL_NAME, 29132685841bSAndrey V. Elsukov .classifier = classify_via, 29142685841bSAndrey V. Elsukov .update = update_via, 29152685841bSAndrey V. Elsukov .find_byname = table_findbyname, 29162685841bSAndrey V. Elsukov .find_bykidx = table_findbykidx, 29172685841bSAndrey V. Elsukov .create_object = create_table_compat, 29182685841bSAndrey V. Elsukov .manage_sets = table_manage_sets, 291974b22066SAlexander V. Chernikov }, 292074b22066SAlexander V. Chernikov }; 292174b22066SAlexander V. Chernikov 29222685841bSAndrey V. Elsukov static int 29232685841bSAndrey V. Elsukov test_sets_cb(struct namedobj_instance *ni __unused, struct named_object *no, 29242685841bSAndrey V. Elsukov void *arg __unused) 29252685841bSAndrey V. Elsukov { 29262685841bSAndrey V. Elsukov 29272685841bSAndrey V. Elsukov /* Check that there aren't any tables in not default set */ 29282685841bSAndrey V. Elsukov if (no->set != 0) 29292685841bSAndrey V. Elsukov return (EBUSY); 29302685841bSAndrey V. Elsukov return (0); 29312685841bSAndrey V. Elsukov } 29322685841bSAndrey V. Elsukov 29332685841bSAndrey V. Elsukov /* 29342685841bSAndrey V. Elsukov * Switch between "set 0" and "rule's set" table binding, 29352685841bSAndrey V. Elsukov * Check all ruleset bindings and permits changing 29362685841bSAndrey V. Elsukov * IFF each binding has both rule AND table in default set (set 0). 29372685841bSAndrey V. Elsukov * 29382685841bSAndrey V. Elsukov * Returns 0 on success. 29392685841bSAndrey V. Elsukov */ 29402685841bSAndrey V. Elsukov int 29412685841bSAndrey V. Elsukov ipfw_switch_tables_namespace(struct ip_fw_chain *ch, unsigned int sets) 29422685841bSAndrey V. Elsukov { 29432685841bSAndrey V. Elsukov struct opcode_obj_rewrite *rw; 29442685841bSAndrey V. Elsukov struct namedobj_instance *ni; 29452685841bSAndrey V. Elsukov struct named_object *no; 29462685841bSAndrey V. Elsukov struct ip_fw *rule; 29472685841bSAndrey V. Elsukov ipfw_insn *cmd; 29482685841bSAndrey V. Elsukov int cmdlen, i, l; 29492685841bSAndrey V. Elsukov uint16_t kidx; 29502685841bSAndrey V. Elsukov uint8_t subtype; 29512685841bSAndrey V. Elsukov 29522685841bSAndrey V. Elsukov IPFW_UH_WLOCK(ch); 29532685841bSAndrey V. Elsukov 29542685841bSAndrey V. Elsukov if (V_fw_tables_sets == sets) { 29552685841bSAndrey V. Elsukov IPFW_UH_WUNLOCK(ch); 29562685841bSAndrey V. Elsukov return (0); 29572685841bSAndrey V. Elsukov } 29582685841bSAndrey V. Elsukov ni = CHAIN_TO_NI(ch); 29592685841bSAndrey V. Elsukov if (sets == 0) { 29602685841bSAndrey V. Elsukov /* 29612685841bSAndrey V. Elsukov * Prevent disabling sets support if we have some tables 29622685841bSAndrey V. Elsukov * in not default sets. 29632685841bSAndrey V. Elsukov */ 29642685841bSAndrey V. Elsukov if (ipfw_objhash_foreach_type(ni, test_sets_cb, 29652685841bSAndrey V. Elsukov NULL, IPFW_TLV_TBL_NAME) != 0) { 29662685841bSAndrey V. Elsukov IPFW_UH_WUNLOCK(ch); 29672685841bSAndrey V. Elsukov return (EBUSY); 29682685841bSAndrey V. Elsukov } 29692685841bSAndrey V. Elsukov } 29702685841bSAndrey V. Elsukov /* 29712685841bSAndrey V. Elsukov * Scan all rules and examine tables opcodes. 29722685841bSAndrey V. Elsukov */ 29732685841bSAndrey V. Elsukov for (i = 0; i < ch->n_rules; i++) { 29742685841bSAndrey V. Elsukov rule = ch->map[i]; 29752685841bSAndrey V. Elsukov 29762685841bSAndrey V. Elsukov l = rule->cmd_len; 29772685841bSAndrey V. Elsukov cmd = rule->cmd; 29782685841bSAndrey V. Elsukov cmdlen = 0; 29792685841bSAndrey V. Elsukov for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 29802685841bSAndrey V. Elsukov cmdlen = F_LEN(cmd); 29812685841bSAndrey V. Elsukov /* Check only tables opcodes */ 29822685841bSAndrey V. Elsukov for (kidx = 0, rw = opcodes; 29832685841bSAndrey V. Elsukov rw < opcodes + nitems(opcodes); rw++) { 29842685841bSAndrey V. Elsukov if (rw->opcode != cmd->opcode) 29852685841bSAndrey V. Elsukov continue; 29862685841bSAndrey V. Elsukov if (rw->classifier(cmd, &kidx, &subtype) == 0) 29872685841bSAndrey V. Elsukov break; 29882685841bSAndrey V. Elsukov } 29892685841bSAndrey V. Elsukov if (kidx == 0) 29902685841bSAndrey V. Elsukov continue; 29912685841bSAndrey V. Elsukov no = ipfw_objhash_lookup_kidx(ni, kidx); 29922685841bSAndrey V. Elsukov /* Check if both table object and rule has the set 0 */ 29932685841bSAndrey V. Elsukov if (no->set != 0 || rule->set != 0) { 29942685841bSAndrey V. Elsukov IPFW_UH_WUNLOCK(ch); 29952685841bSAndrey V. Elsukov return (EBUSY); 29962685841bSAndrey V. Elsukov } 29972685841bSAndrey V. Elsukov 29982685841bSAndrey V. Elsukov } 29992685841bSAndrey V. Elsukov } 30002685841bSAndrey V. Elsukov V_fw_tables_sets = sets; 30012685841bSAndrey V. Elsukov IPFW_UH_WUNLOCK(ch); 30022685841bSAndrey V. Elsukov return (0); 30032685841bSAndrey V. Elsukov } 300474b22066SAlexander V. Chernikov 3005ac35ff17SAlexander V. Chernikov /* 3006ac35ff17SAlexander V. Chernikov * Checks table name for validity. 3007ac35ff17SAlexander V. Chernikov * Enforce basic length checks, the rest 3008ac35ff17SAlexander V. Chernikov * should be done in userland. 3009ac35ff17SAlexander V. Chernikov * 3010ac35ff17SAlexander V. Chernikov * Returns 0 if name is considered valid. 3011ac35ff17SAlexander V. Chernikov */ 3012f81431ccSAndrey V. Elsukov static int 3013f81431ccSAndrey V. Elsukov check_table_name(const char *name) 3014ac35ff17SAlexander V. Chernikov { 3015ac35ff17SAlexander V. Chernikov 3016ac35ff17SAlexander V. Chernikov /* 3017ac35ff17SAlexander V. Chernikov * TODO: do some more complicated checks 3018ac35ff17SAlexander V. Chernikov */ 3019f81431ccSAndrey V. Elsukov return (ipfw_check_object_name_generic(name)); 3020ac35ff17SAlexander V. Chernikov } 3021ac35ff17SAlexander V. Chernikov 3022ac35ff17SAlexander V. Chernikov /* 3023ac35ff17SAlexander V. Chernikov * Finds table config based on either legacy index 3024ac35ff17SAlexander V. Chernikov * or name in ntlv. 3025ac35ff17SAlexander V. Chernikov * Note @ti structure contains unchecked data from userland. 3026ac35ff17SAlexander V. Chernikov * 302774b22066SAlexander V. Chernikov * Returns 0 in success and fills in @tc with found config 3028ac35ff17SAlexander V. Chernikov */ 302974b22066SAlexander V. Chernikov static int 303074b22066SAlexander V. Chernikov find_table_err(struct namedobj_instance *ni, struct tid_info *ti, 303174b22066SAlexander V. Chernikov struct table_config **tc) 3032b074b7bbSAlexander V. Chernikov { 3033b074b7bbSAlexander V. Chernikov char *name, bname[16]; 3034b074b7bbSAlexander V. Chernikov struct named_object *no; 3035ac35ff17SAlexander V. Chernikov ipfw_obj_ntlv *ntlv; 3036ac35ff17SAlexander V. Chernikov uint32_t set; 3037b074b7bbSAlexander V. Chernikov 3038b074b7bbSAlexander V. Chernikov if (ti->tlvs != NULL) { 30392df1a11fSAndrey V. Elsukov ntlv = ipfw_find_name_tlv_type(ti->tlvs, ti->tlen, ti->uidx, 30402df1a11fSAndrey V. Elsukov IPFW_TLV_TBL_NAME); 3041ac35ff17SAlexander V. Chernikov if (ntlv == NULL) 304274b22066SAlexander V. Chernikov return (EINVAL); 3043ac35ff17SAlexander V. Chernikov name = ntlv->name; 304440e5f498SAlexander V. Chernikov 304540e5f498SAlexander V. Chernikov /* 304640e5f498SAlexander V. Chernikov * Use set provided by @ti instead of @ntlv one. 304740e5f498SAlexander V. Chernikov * This is needed due to different sets behavior 304840e5f498SAlexander V. Chernikov * controlled by V_fw_tables_sets. 304940e5f498SAlexander V. Chernikov */ 30502685841bSAndrey V. Elsukov set = (V_fw_tables_sets != 0) ? ti->set : 0; 3051b074b7bbSAlexander V. Chernikov } else { 3052b074b7bbSAlexander V. Chernikov snprintf(bname, sizeof(bname), "%d", ti->uidx); 3053b074b7bbSAlexander V. Chernikov name = bname; 3054ac35ff17SAlexander V. Chernikov set = 0; 3055b074b7bbSAlexander V. Chernikov } 3056b074b7bbSAlexander V. Chernikov 3057ac35ff17SAlexander V. Chernikov no = ipfw_objhash_lookup_name(ni, set, name); 305874b22066SAlexander V. Chernikov *tc = (struct table_config *)no; 3059b074b7bbSAlexander V. Chernikov 306074b22066SAlexander V. Chernikov return (0); 306174b22066SAlexander V. Chernikov } 306274b22066SAlexander V. Chernikov 306374b22066SAlexander V. Chernikov /* 306474b22066SAlexander V. Chernikov * Finds table config based on either legacy index 306574b22066SAlexander V. Chernikov * or name in ntlv. 306674b22066SAlexander V. Chernikov * Note @ti structure contains unchecked data from userland. 306774b22066SAlexander V. Chernikov * 306874b22066SAlexander V. Chernikov * Returns pointer to table_config or NULL. 306974b22066SAlexander V. Chernikov */ 307074b22066SAlexander V. Chernikov static struct table_config * 307174b22066SAlexander V. Chernikov find_table(struct namedobj_instance *ni, struct tid_info *ti) 307274b22066SAlexander V. Chernikov { 307374b22066SAlexander V. Chernikov struct table_config *tc; 307474b22066SAlexander V. Chernikov 307574b22066SAlexander V. Chernikov if (find_table_err(ni, ti, &tc) != 0) 307674b22066SAlexander V. Chernikov return (NULL); 307774b22066SAlexander V. Chernikov 307874b22066SAlexander V. Chernikov return (tc); 3079b074b7bbSAlexander V. Chernikov } 3080b074b7bbSAlexander V. Chernikov 308135e1bbd0SAlexander V. Chernikov /* 308235e1bbd0SAlexander V. Chernikov * Allocate new table config structure using 308335e1bbd0SAlexander V. Chernikov * specified @algo and @aname. 308435e1bbd0SAlexander V. Chernikov * 308535e1bbd0SAlexander V. Chernikov * Returns pointer to config or NULL. 308635e1bbd0SAlexander V. Chernikov */ 3087b074b7bbSAlexander V. Chernikov static struct table_config * 308868394ec8SAlexander V. Chernikov alloc_table_config(struct ip_fw_chain *ch, struct tid_info *ti, 30890cba2b28SAlexander V. Chernikov struct table_algo *ta, char *aname, uint8_t tflags) 3090b074b7bbSAlexander V. Chernikov { 3091b074b7bbSAlexander V. Chernikov char *name, bname[16]; 3092b074b7bbSAlexander V. Chernikov struct table_config *tc; 3093b074b7bbSAlexander V. Chernikov int error; 3094ac35ff17SAlexander V. Chernikov ipfw_obj_ntlv *ntlv; 3095ac35ff17SAlexander V. Chernikov uint32_t set; 3096b074b7bbSAlexander V. Chernikov 3097b074b7bbSAlexander V. Chernikov if (ti->tlvs != NULL) { 30982df1a11fSAndrey V. Elsukov ntlv = ipfw_find_name_tlv_type(ti->tlvs, ti->tlen, ti->uidx, 30992df1a11fSAndrey V. Elsukov IPFW_TLV_TBL_NAME); 3100ac35ff17SAlexander V. Chernikov if (ntlv == NULL) 3101b074b7bbSAlexander V. Chernikov return (NULL); 3102ac35ff17SAlexander V. Chernikov name = ntlv->name; 3103ac35ff17SAlexander V. Chernikov set = ntlv->set; 3104b074b7bbSAlexander V. Chernikov } else { 310574b22066SAlexander V. Chernikov /* Compat part: convert number to string representation */ 3106b074b7bbSAlexander V. Chernikov snprintf(bname, sizeof(bname), "%d", ti->uidx); 3107b074b7bbSAlexander V. Chernikov name = bname; 3108ac35ff17SAlexander V. Chernikov set = 0; 3109b074b7bbSAlexander V. Chernikov } 3110b074b7bbSAlexander V. Chernikov 3111b074b7bbSAlexander V. Chernikov tc = malloc(sizeof(struct table_config), M_IPFW, M_WAITOK | M_ZERO); 3112b074b7bbSAlexander V. Chernikov tc->no.name = tc->tablename; 311374b22066SAlexander V. Chernikov tc->no.subtype = ta->type; 3114ac35ff17SAlexander V. Chernikov tc->no.set = set; 3115914bffb6SAlexander V. Chernikov tc->tflags = tflags; 31169f7d47b0SAlexander V. Chernikov tc->ta = ta; 3117b074b7bbSAlexander V. Chernikov strlcpy(tc->tablename, name, sizeof(tc->tablename)); 31180cba2b28SAlexander V. Chernikov /* Set "shared" value type by default */ 31190cba2b28SAlexander V. Chernikov tc->vshared = 1; 3120b074b7bbSAlexander V. Chernikov 3121b074b7bbSAlexander V. Chernikov /* Preallocate data structures for new tables */ 31224c060d85SAlexander V. Chernikov error = ta->init(ch, &tc->astate, &tc->ti_copy, aname, tflags); 3123b074b7bbSAlexander V. Chernikov if (error != 0) { 3124b074b7bbSAlexander V. Chernikov free(tc, M_IPFW); 3125b074b7bbSAlexander V. Chernikov return (NULL); 3126b074b7bbSAlexander V. Chernikov } 3127b074b7bbSAlexander V. Chernikov 3128b074b7bbSAlexander V. Chernikov return (tc); 3129b074b7bbSAlexander V. Chernikov } 3130b074b7bbSAlexander V. Chernikov 313135e1bbd0SAlexander V. Chernikov /* 313235e1bbd0SAlexander V. Chernikov * Destroys table state and config. 313335e1bbd0SAlexander V. Chernikov */ 3134b074b7bbSAlexander V. Chernikov static void 3135b074b7bbSAlexander V. Chernikov free_table_config(struct namedobj_instance *ni, struct table_config *tc) 3136b074b7bbSAlexander V. Chernikov { 3137b074b7bbSAlexander V. Chernikov 313835e1bbd0SAlexander V. Chernikov KASSERT(tc->linked == 0, ("free() on linked config")); 31390caab009SAlexander V. Chernikov /* UH lock MUST NOT be held */ 3140b074b7bbSAlexander V. Chernikov 31410468c5baSAlexander V. Chernikov /* 31420468c5baSAlexander V. Chernikov * We're using ta without any locking/referencing. 31430468c5baSAlexander V. Chernikov * TODO: fix this if we're going to use unloadable algos. 31440468c5baSAlexander V. Chernikov */ 31454c060d85SAlexander V. Chernikov tc->ta->destroy(tc->astate, &tc->ti_copy); 3146b074b7bbSAlexander V. Chernikov free(tc, M_IPFW); 3147b074b7bbSAlexander V. Chernikov } 3148b074b7bbSAlexander V. Chernikov 3149b074b7bbSAlexander V. Chernikov /* 3150b074b7bbSAlexander V. Chernikov * Links @tc to @chain table named instance. 3151b074b7bbSAlexander V. Chernikov * Sets appropriate type/states in @chain table info. 3152b074b7bbSAlexander V. Chernikov */ 3153b074b7bbSAlexander V. Chernikov static void 31549f7d47b0SAlexander V. Chernikov link_table(struct ip_fw_chain *ch, struct table_config *tc) 3155b074b7bbSAlexander V. Chernikov { 3156b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 31579f7d47b0SAlexander V. Chernikov struct table_info *ti; 3158b074b7bbSAlexander V. Chernikov uint16_t kidx; 3159b074b7bbSAlexander V. Chernikov 31609f7d47b0SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 31619f7d47b0SAlexander V. Chernikov IPFW_WLOCK_ASSERT(ch); 3162b074b7bbSAlexander V. Chernikov 31639f7d47b0SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 3164b074b7bbSAlexander V. Chernikov kidx = tc->no.kidx; 3165b074b7bbSAlexander V. Chernikov 3166b074b7bbSAlexander V. Chernikov ipfw_objhash_add(ni, &tc->no); 31679f7d47b0SAlexander V. Chernikov 31689f7d47b0SAlexander V. Chernikov ti = KIDX_TO_TI(ch, kidx); 31694c060d85SAlexander V. Chernikov *ti = tc->ti_copy; 3170b074b7bbSAlexander V. Chernikov 317168394ec8SAlexander V. Chernikov /* Notify algo on real @ti address */ 317268394ec8SAlexander V. Chernikov if (tc->ta->change_ti != NULL) 317368394ec8SAlexander V. Chernikov tc->ta->change_ti(tc->astate, ti); 317468394ec8SAlexander V. Chernikov 3175b074b7bbSAlexander V. Chernikov tc->linked = 1; 31769d099b4fSAlexander V. Chernikov tc->ta->refcnt++; 3177b074b7bbSAlexander V. Chernikov } 3178b074b7bbSAlexander V. Chernikov 3179b074b7bbSAlexander V. Chernikov /* 3180b074b7bbSAlexander V. Chernikov * Unlinks @tc from @chain table named instance. 3181b074b7bbSAlexander V. Chernikov * Zeroes states in @chain and stores them in @tc. 3182b074b7bbSAlexander V. Chernikov */ 3183b074b7bbSAlexander V. Chernikov static void 31849f7d47b0SAlexander V. Chernikov unlink_table(struct ip_fw_chain *ch, struct table_config *tc) 3185b074b7bbSAlexander V. Chernikov { 3186b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 31879f7d47b0SAlexander V. Chernikov struct table_info *ti; 3188b074b7bbSAlexander V. Chernikov uint16_t kidx; 3189b074b7bbSAlexander V. Chernikov 31909f7d47b0SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 31919f7d47b0SAlexander V. Chernikov IPFW_WLOCK_ASSERT(ch); 3192b074b7bbSAlexander V. Chernikov 31939f7d47b0SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 3194b074b7bbSAlexander V. Chernikov kidx = tc->no.kidx; 3195b074b7bbSAlexander V. Chernikov 31969f7d47b0SAlexander V. Chernikov /* Clear state. @ti copy is already saved inside @tc */ 3197b074b7bbSAlexander V. Chernikov ipfw_objhash_del(ni, &tc->no); 31989f7d47b0SAlexander V. Chernikov ti = KIDX_TO_TI(ch, kidx); 31999f7d47b0SAlexander V. Chernikov memset(ti, 0, sizeof(struct table_info)); 3200b074b7bbSAlexander V. Chernikov tc->linked = 0; 32019d099b4fSAlexander V. Chernikov tc->ta->refcnt--; 320268394ec8SAlexander V. Chernikov 320368394ec8SAlexander V. Chernikov /* Notify algo on real @ti address */ 320468394ec8SAlexander V. Chernikov if (tc->ta->change_ti != NULL) 320568394ec8SAlexander V. Chernikov tc->ta->change_ti(tc->astate, NULL); 3206b074b7bbSAlexander V. Chernikov } 3207b074b7bbSAlexander V. Chernikov 32086b988f3aSAlexander V. Chernikov static struct ipfw_sopt_handler scodes[] = { 32096b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XCREATE, 0, HDIR_SET, create_table }, 32106b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XDESTROY, 0, HDIR_SET, flush_table_v0 }, 32116b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XFLUSH, 0, HDIR_SET, flush_table_v0 }, 32126b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XMODIFY, 0, HDIR_BOTH, modify_table }, 32136b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XINFO, 0, HDIR_GET, describe_table }, 32146b988f3aSAlexander V. Chernikov { IP_FW_TABLES_XLIST, 0, HDIR_GET, list_tables }, 32156b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XLIST, 0, HDIR_GET, dump_table_v0 }, 32166b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XLIST, 1, HDIR_GET, dump_table_v1 }, 32176b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XADD, 0, HDIR_BOTH, manage_table_ent_v0 }, 32186b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XADD, 1, HDIR_BOTH, manage_table_ent_v1 }, 32196b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XDEL, 0, HDIR_BOTH, manage_table_ent_v0 }, 32206b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XDEL, 1, HDIR_BOTH, manage_table_ent_v1 }, 32216b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XFIND, 0, HDIR_GET, find_table_entry }, 32226b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XSWAP, 0, HDIR_SET, swap_table }, 32236b988f3aSAlexander V. Chernikov { IP_FW_TABLES_ALIST, 0, HDIR_GET, list_table_algo }, 32246b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XGETSIZE, 0, HDIR_GET, get_table_size }, 32256b988f3aSAlexander V. Chernikov }; 32266b988f3aSAlexander V. Chernikov 3227b309f085SAndrey V. Elsukov static int 32286b988f3aSAlexander V. Chernikov destroy_table_locked(struct namedobj_instance *ni, struct named_object *no, 32296b988f3aSAlexander V. Chernikov void *arg) 32306b988f3aSAlexander V. Chernikov { 32316b988f3aSAlexander V. Chernikov 32326b988f3aSAlexander V. Chernikov unlink_table((struct ip_fw_chain *)arg, (struct table_config *)no); 32336b988f3aSAlexander V. Chernikov if (ipfw_objhash_free_idx(ni, no->kidx) != 0) 32346b988f3aSAlexander V. Chernikov printf("Error unlinking kidx %d from table %s\n", 32356b988f3aSAlexander V. Chernikov no->kidx, no->name); 32366b988f3aSAlexander V. Chernikov free_table_config(ni, (struct table_config *)no); 3237b309f085SAndrey V. Elsukov return (0); 32386b988f3aSAlexander V. Chernikov } 32396b988f3aSAlexander V. Chernikov 32406b988f3aSAlexander V. Chernikov /* 32416b988f3aSAlexander V. Chernikov * Shuts tables module down. 32426b988f3aSAlexander V. Chernikov */ 32436b988f3aSAlexander V. Chernikov void 32446b988f3aSAlexander V. Chernikov ipfw_destroy_tables(struct ip_fw_chain *ch, int last) 32456b988f3aSAlexander V. Chernikov { 32466b988f3aSAlexander V. Chernikov 32476b988f3aSAlexander V. Chernikov IPFW_DEL_SOPT_HANDLER(last, scodes); 324874b22066SAlexander V. Chernikov IPFW_DEL_OBJ_REWRITER(last, opcodes); 32496b988f3aSAlexander V. Chernikov 32506b988f3aSAlexander V. Chernikov /* Remove all tables from working set */ 32516b988f3aSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 32526b988f3aSAlexander V. Chernikov IPFW_WLOCK(ch); 32536b988f3aSAlexander V. Chernikov ipfw_objhash_foreach(CHAIN_TO_NI(ch), destroy_table_locked, ch); 32546b988f3aSAlexander V. Chernikov IPFW_WUNLOCK(ch); 32556b988f3aSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 32566b988f3aSAlexander V. Chernikov 32576b988f3aSAlexander V. Chernikov /* Free pointers itself */ 32586b988f3aSAlexander V. Chernikov free(ch->tablestate, M_IPFW); 32596b988f3aSAlexander V. Chernikov 32606b988f3aSAlexander V. Chernikov ipfw_table_value_destroy(ch, last); 32616b988f3aSAlexander V. Chernikov ipfw_table_algo_destroy(ch); 32626b988f3aSAlexander V. Chernikov 32636b988f3aSAlexander V. Chernikov ipfw_objhash_destroy(CHAIN_TO_NI(ch)); 32646b988f3aSAlexander V. Chernikov free(CHAIN_TO_TCFG(ch), M_IPFW); 32656b988f3aSAlexander V. Chernikov } 32666b988f3aSAlexander V. Chernikov 32676b988f3aSAlexander V. Chernikov /* 32686b988f3aSAlexander V. Chernikov * Starts tables module. 32696b988f3aSAlexander V. Chernikov */ 32706b988f3aSAlexander V. Chernikov int 32716b988f3aSAlexander V. Chernikov ipfw_init_tables(struct ip_fw_chain *ch, int first) 32726b988f3aSAlexander V. Chernikov { 32736b988f3aSAlexander V. Chernikov struct tables_config *tcfg; 32746b988f3aSAlexander V. Chernikov 32756b988f3aSAlexander V. Chernikov /* Allocate pointers */ 32766b988f3aSAlexander V. Chernikov ch->tablestate = malloc(V_fw_tables_max * sizeof(struct table_info), 32776b988f3aSAlexander V. Chernikov M_IPFW, M_WAITOK | M_ZERO); 32786b988f3aSAlexander V. Chernikov 32796b988f3aSAlexander V. Chernikov tcfg = malloc(sizeof(struct tables_config), M_IPFW, M_WAITOK | M_ZERO); 32806b988f3aSAlexander V. Chernikov tcfg->namehash = ipfw_objhash_create(V_fw_tables_max); 32816b988f3aSAlexander V. Chernikov ch->tblcfg = tcfg; 32826b988f3aSAlexander V. Chernikov 32836b988f3aSAlexander V. Chernikov ipfw_table_value_init(ch, first); 32846b988f3aSAlexander V. Chernikov ipfw_table_algo_init(ch); 32856b988f3aSAlexander V. Chernikov 328674b22066SAlexander V. Chernikov IPFW_ADD_OBJ_REWRITER(first, opcodes); 32876b988f3aSAlexander V. Chernikov IPFW_ADD_SOPT_HANDLER(first, scodes); 32886b988f3aSAlexander V. Chernikov return (0); 32896b988f3aSAlexander V. Chernikov } 32906b988f3aSAlexander V. Chernikov 32916b988f3aSAlexander V. Chernikov 32926b988f3aSAlexander V. Chernikov 3293