13b3a8eb9SGleb Smirnoff /*- 23b3a8eb9SGleb Smirnoff * Copyright (c) 2004 Ruslan Ermilov and Vsevolod Lobko. 31a33e799SAlexander V. Chernikov * Copyright (c) 2014 Yandex LLC 41a33e799SAlexander V. Chernikov * Copyright (c) 2014 Alexander V. Chernikov 53b3a8eb9SGleb Smirnoff * 63b3a8eb9SGleb Smirnoff * Redistribution and use in source and binary forms, with or without 73b3a8eb9SGleb Smirnoff * modification, are permitted provided that the following conditions 83b3a8eb9SGleb Smirnoff * are met: 93b3a8eb9SGleb Smirnoff * 1. Redistributions of source code must retain the above copyright 103b3a8eb9SGleb Smirnoff * notice, this list of conditions and the following disclaimer. 113b3a8eb9SGleb Smirnoff * 2. Redistributions in binary form must reproduce the above copyright 123b3a8eb9SGleb Smirnoff * notice, this list of conditions and the following disclaimer in the 133b3a8eb9SGleb Smirnoff * documentation and/or other materials provided with the distribution. 143b3a8eb9SGleb Smirnoff * 153b3a8eb9SGleb Smirnoff * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 163b3a8eb9SGleb Smirnoff * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 173b3a8eb9SGleb Smirnoff * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 183b3a8eb9SGleb Smirnoff * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 193b3a8eb9SGleb Smirnoff * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 203b3a8eb9SGleb Smirnoff * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 213b3a8eb9SGleb Smirnoff * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 223b3a8eb9SGleb Smirnoff * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 233b3a8eb9SGleb Smirnoff * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 243b3a8eb9SGleb Smirnoff * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 253b3a8eb9SGleb Smirnoff * SUCH DAMAGE. 263b3a8eb9SGleb Smirnoff */ 273b3a8eb9SGleb Smirnoff 283b3a8eb9SGleb Smirnoff #include <sys/cdefs.h> 293b3a8eb9SGleb Smirnoff __FBSDID("$FreeBSD$"); 303b3a8eb9SGleb Smirnoff 313b3a8eb9SGleb Smirnoff /* 32563b5ab1SAlexander V. Chernikov * Lookup table support for ipfw. 333b3a8eb9SGleb Smirnoff * 34ac35ff17SAlexander V. Chernikov * This file contains handlers for all generic tables' operations: 35563b5ab1SAlexander V. Chernikov * add/del/flush entries, list/dump tables etc.. 363b3a8eb9SGleb Smirnoff * 371a33e799SAlexander V. Chernikov * Table data modification is protected by both UH and runtime lock 38563b5ab1SAlexander V. Chernikov * while reading configuration/data is protected by UH lock. 39563b5ab1SAlexander V. Chernikov * 40563b5ab1SAlexander V. Chernikov * Lookup algorithms for all table types are located in ip_fw_table_algo.c 413b3a8eb9SGleb Smirnoff */ 423b3a8eb9SGleb Smirnoff 433b3a8eb9SGleb Smirnoff #include "opt_ipfw.h" 443b3a8eb9SGleb Smirnoff 453b3a8eb9SGleb Smirnoff #include <sys/param.h> 463b3a8eb9SGleb Smirnoff #include <sys/systm.h> 473b3a8eb9SGleb Smirnoff #include <sys/malloc.h> 483b3a8eb9SGleb Smirnoff #include <sys/kernel.h> 493b3a8eb9SGleb Smirnoff #include <sys/lock.h> 503b3a8eb9SGleb Smirnoff #include <sys/rwlock.h> 51ccba94b8SAlexander V. Chernikov #include <sys/rmlock.h> 523b3a8eb9SGleb Smirnoff #include <sys/socket.h> 53f1220db8SAlexander V. Chernikov #include <sys/socketvar.h> 543b3a8eb9SGleb Smirnoff #include <sys/queue.h> 553b3a8eb9SGleb Smirnoff #include <net/if.h> /* ip_fw.h requires IFNAMSIZ */ 563b3a8eb9SGleb Smirnoff 573b3a8eb9SGleb Smirnoff #include <netinet/in.h> 583b3a8eb9SGleb Smirnoff #include <netinet/ip_var.h> /* struct ipfw_rule_ref */ 593b3a8eb9SGleb Smirnoff #include <netinet/ip_fw.h> 603b3a8eb9SGleb Smirnoff 613b3a8eb9SGleb Smirnoff #include <netpfil/ipfw/ip_fw_private.h> 62ea761a5dSAlexander V. Chernikov #include <netpfil/ipfw/ip_fw_table.h> 633b3a8eb9SGleb Smirnoff 643b3a8eb9SGleb Smirnoff /* 65b074b7bbSAlexander V. Chernikov * Table has the following `type` concepts: 66b074b7bbSAlexander V. Chernikov * 67c21034b7SAlexander V. Chernikov * `no.type` represents lookup key type (addr, ifp, uid, etc..) 680cba2b28SAlexander V. Chernikov * vmask represents bitmask of table values which are present at the moment. 690cba2b28SAlexander V. Chernikov * Special IPFW_VTYPE_LEGACY ( (uint32_t)-1 ) represents old 700cba2b28SAlexander V. Chernikov * single-value-for-all approach. 71b074b7bbSAlexander V. Chernikov */ 72b074b7bbSAlexander V. Chernikov struct table_config { 73b074b7bbSAlexander V. Chernikov struct named_object no; 74914bffb6SAlexander V. Chernikov uint8_t tflags; /* type flags */ 754f43138aSAlexander V. Chernikov uint8_t locked; /* 1 if locked from changes */ 76adf3b2b9SAlexander V. Chernikov uint8_t linked; /* 1 if already linked */ 77adf3b2b9SAlexander V. Chernikov uint8_t ochanged; /* used by set swapping */ 780cba2b28SAlexander V. Chernikov uint8_t vshared; /* 1 if using shared value array */ 790cba2b28SAlexander V. Chernikov uint8_t spare[3]; 800cba2b28SAlexander V. Chernikov uint32_t count; /* Number of records */ 810cba2b28SAlexander V. Chernikov uint32_t limit; /* Max number of records */ 820cba2b28SAlexander V. Chernikov uint32_t vmask; /* bitmask with supported values */ 83a73d728dSAlexander V. Chernikov uint32_t ocount; /* used by set swapping */ 84a73d728dSAlexander V. Chernikov uint64_t gencnt; /* generation count */ 85b074b7bbSAlexander V. Chernikov char tablename[64]; /* table name */ 869f7d47b0SAlexander V. Chernikov struct table_algo *ta; /* Callbacks for given algo */ 879f7d47b0SAlexander V. Chernikov void *astate; /* algorithm state */ 889f7d47b0SAlexander V. Chernikov struct table_info ti; /* data to put to table_info */ 890cba2b28SAlexander V. Chernikov struct namedobj_instance *vi; 90b074b7bbSAlexander V. Chernikov }; 91b074b7bbSAlexander V. Chernikov 92b074b7bbSAlexander V. Chernikov static struct table_config *find_table(struct namedobj_instance *ni, 93b074b7bbSAlexander V. Chernikov struct tid_info *ti); 9468394ec8SAlexander V. Chernikov static struct table_config *alloc_table_config(struct ip_fw_chain *ch, 950cba2b28SAlexander V. Chernikov struct tid_info *ti, struct table_algo *ta, char *adata, uint8_t tflags); 96b074b7bbSAlexander V. Chernikov static void free_table_config(struct namedobj_instance *ni, 97b074b7bbSAlexander V. Chernikov struct table_config *tc); 98db785d31SAlexander V. Chernikov static int create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti, 99867708f7SAlexander V. Chernikov char *aname, ipfw_xtable_info *i, uint16_t *pkidx, int ref); 1000468c5baSAlexander V. Chernikov static void link_table(struct ip_fw_chain *ch, struct table_config *tc); 1010468c5baSAlexander V. Chernikov static void unlink_table(struct ip_fw_chain *ch, struct table_config *tc); 1024dff4ae0SAlexander V. Chernikov static int find_ref_table(struct ip_fw_chain *ch, struct tid_info *ti, 103867708f7SAlexander V. Chernikov struct tentry_info *tei, uint32_t count, int op, struct table_config **ptc); 1044dff4ae0SAlexander V. Chernikov #define OP_ADD 1 1054dff4ae0SAlexander V. Chernikov #define OP_DEL 0 1062d99a349SAlexander V. Chernikov static int export_tables(struct ip_fw_chain *ch, ipfw_obj_lheader *olh, 1072d99a349SAlexander V. Chernikov struct sockopt_data *sd); 108ac35ff17SAlexander V. Chernikov static void export_table_info(struct ip_fw_chain *ch, struct table_config *tc, 109ac35ff17SAlexander V. Chernikov ipfw_xtable_info *i); 11081d3153dSAlexander V. Chernikov static int dump_table_tentry(void *e, void *arg); 111f1220db8SAlexander V. Chernikov static int dump_table_xentry(void *e, void *arg); 112b074b7bbSAlexander V. Chernikov 113a73d728dSAlexander V. Chernikov static int swap_tables(struct ip_fw_chain *ch, struct tid_info *a, 11446d52008SAlexander V. Chernikov struct tid_info *b); 115ac35ff17SAlexander V. Chernikov 1160cba2b28SAlexander V. Chernikov static int check_table_space(struct ip_fw_chain *ch, struct tableop_state *ts, 1170cba2b28SAlexander V. Chernikov struct table_config *tc, struct table_info *ti, uint32_t count); 118ac35ff17SAlexander V. Chernikov static int destroy_table(struct ip_fw_chain *ch, struct tid_info *ti); 119d3a4f924SAlexander V. Chernikov 1209f7d47b0SAlexander V. Chernikov static struct table_algo *find_table_algo(struct tables_config *tableconf, 1219490a627SAlexander V. Chernikov struct tid_info *ti, char *name); 122b074b7bbSAlexander V. Chernikov 12346d52008SAlexander V. Chernikov static void objheader_to_ti(struct _ipfw_obj_header *oh, struct tid_info *ti); 12446d52008SAlexander V. Chernikov static void ntlv_to_ti(struct _ipfw_obj_ntlv *ntlv, struct tid_info *ti); 125a73d728dSAlexander V. Chernikov static int classify_table_opcode(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype); 12646d52008SAlexander V. Chernikov 127b074b7bbSAlexander V. Chernikov #define CHAIN_TO_NI(chain) (CHAIN_TO_TCFG(chain)->namehash) 1289f7d47b0SAlexander V. Chernikov #define KIDX_TO_TI(ch, k) (&(((struct table_info *)(ch)->tablestate)[k])) 129b074b7bbSAlexander V. Chernikov 130b6ee846eSAlexander V. Chernikov #define TA_BUF_SZ 128 /* On-stack buffer for add/delete state */ 131b6ee846eSAlexander V. Chernikov 1320cba2b28SAlexander V. Chernikov void 1330cba2b28SAlexander V. Chernikov rollback_toperation_state(struct ip_fw_chain *ch, void *object) 1340cba2b28SAlexander V. Chernikov { 1350cba2b28SAlexander V. Chernikov struct tables_config *tcfg; 1360cba2b28SAlexander V. Chernikov struct op_state *os; 1370cba2b28SAlexander V. Chernikov 1380cba2b28SAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 1390cba2b28SAlexander V. Chernikov TAILQ_FOREACH(os, &tcfg->state_list, next) 140fb4b37a3SAlexander V. Chernikov os->func(object, os); 1410cba2b28SAlexander V. Chernikov } 1420cba2b28SAlexander V. Chernikov 1430cba2b28SAlexander V. Chernikov void 1440cba2b28SAlexander V. Chernikov add_toperation_state(struct ip_fw_chain *ch, struct tableop_state *ts) 1450cba2b28SAlexander V. Chernikov { 1460cba2b28SAlexander V. Chernikov struct tables_config *tcfg; 1470cba2b28SAlexander V. Chernikov 1480cba2b28SAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 1490cba2b28SAlexander V. Chernikov TAILQ_INSERT_HEAD(&tcfg->state_list, &ts->opstate, next); 1500cba2b28SAlexander V. Chernikov } 1510cba2b28SAlexander V. Chernikov 1520cba2b28SAlexander V. Chernikov void 1530cba2b28SAlexander V. Chernikov del_toperation_state(struct ip_fw_chain *ch, struct tableop_state *ts) 1540cba2b28SAlexander V. Chernikov { 1550cba2b28SAlexander V. Chernikov struct tables_config *tcfg; 1560cba2b28SAlexander V. Chernikov 1570cba2b28SAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 1580cba2b28SAlexander V. Chernikov TAILQ_REMOVE(&tcfg->state_list, &ts->opstate, next); 1590cba2b28SAlexander V. Chernikov } 1600cba2b28SAlexander V. Chernikov 1610cba2b28SAlexander V. Chernikov void 1620cba2b28SAlexander V. Chernikov tc_ref(struct table_config *tc) 1630cba2b28SAlexander V. Chernikov { 1640cba2b28SAlexander V. Chernikov 1650cba2b28SAlexander V. Chernikov tc->no.refcnt++; 1660cba2b28SAlexander V. Chernikov } 1670cba2b28SAlexander V. Chernikov 1680cba2b28SAlexander V. Chernikov void 1690cba2b28SAlexander V. Chernikov tc_unref(struct table_config *tc) 1700cba2b28SAlexander V. Chernikov { 1710cba2b28SAlexander V. Chernikov 1720cba2b28SAlexander V. Chernikov tc->no.refcnt--; 1730cba2b28SAlexander V. Chernikov } 1740cba2b28SAlexander V. Chernikov 1750cba2b28SAlexander V. Chernikov static struct table_value * 1760cba2b28SAlexander V. Chernikov get_table_value(struct ip_fw_chain *ch, struct table_config *tc, uint32_t kidx) 1770cba2b28SAlexander V. Chernikov { 1780cba2b28SAlexander V. Chernikov struct table_value *pval; 1790cba2b28SAlexander V. Chernikov 1800cba2b28SAlexander V. Chernikov pval = (struct table_value *)ch->valuestate; 1810cba2b28SAlexander V. Chernikov 1820cba2b28SAlexander V. Chernikov return (&pval[kidx]); 1830cba2b28SAlexander V. Chernikov } 1840cba2b28SAlexander V. Chernikov 1850cba2b28SAlexander V. Chernikov 1863a845e10SAlexander V. Chernikov /* 1873a845e10SAlexander V. Chernikov * Checks if we're able to insert/update entry @tei into table 1883a845e10SAlexander V. Chernikov * w.r.t @tc limits. 1893a845e10SAlexander V. Chernikov * May alter @tei to indicate insertion error / insert 1903a845e10SAlexander V. Chernikov * options. 1913a845e10SAlexander V. Chernikov * 1923a845e10SAlexander V. Chernikov * Returns 0 if operation can be performed/ 1933a845e10SAlexander V. Chernikov */ 1943a845e10SAlexander V. Chernikov static int 1953a845e10SAlexander V. Chernikov check_table_limit(struct table_config *tc, struct tentry_info *tei) 1963a845e10SAlexander V. Chernikov { 197b074b7bbSAlexander V. Chernikov 1983a845e10SAlexander V. Chernikov if (tc->limit == 0 || tc->count < tc->limit) 1993a845e10SAlexander V. Chernikov return (0); 2003a845e10SAlexander V. Chernikov 2013a845e10SAlexander V. Chernikov if ((tei->flags & TEI_FLAGS_UPDATE) == 0) { 2023a845e10SAlexander V. Chernikov /* Notify userland on error cause */ 2033a845e10SAlexander V. Chernikov tei->flags |= TEI_FLAGS_LIMIT; 2043a845e10SAlexander V. Chernikov return (EFBIG); 2053a845e10SAlexander V. Chernikov } 2063a845e10SAlexander V. Chernikov 2073a845e10SAlexander V. Chernikov /* 2083a845e10SAlexander V. Chernikov * We have UPDATE flag set. 2093a845e10SAlexander V. Chernikov * Permit updating record (if found), 2103a845e10SAlexander V. Chernikov * but restrict adding new one since we've 2113a845e10SAlexander V. Chernikov * already hit the limit. 2123a845e10SAlexander V. Chernikov */ 2133a845e10SAlexander V. Chernikov tei->flags |= TEI_FLAGS_DONTADD; 2143a845e10SAlexander V. Chernikov 2153a845e10SAlexander V. Chernikov return (0); 2163a845e10SAlexander V. Chernikov } 2173a845e10SAlexander V. Chernikov 2183a845e10SAlexander V. Chernikov /* 2191bc0d457SAlexander V. Chernikov * Convert algorithm callback return code into 2201bc0d457SAlexander V. Chernikov * one of pre-defined states known by userland. 2213a845e10SAlexander V. Chernikov */ 2221bc0d457SAlexander V. Chernikov static void 223867708f7SAlexander V. Chernikov store_tei_result(struct tentry_info *tei, int op, int error, uint32_t num) 2243b3a8eb9SGleb Smirnoff { 2251bc0d457SAlexander V. Chernikov int flag; 2263b3a8eb9SGleb Smirnoff 2271bc0d457SAlexander V. Chernikov flag = 0; 2281bc0d457SAlexander V. Chernikov 2291bc0d457SAlexander V. Chernikov switch (error) { 2301bc0d457SAlexander V. Chernikov case 0: 231867708f7SAlexander V. Chernikov if (op == OP_ADD && num != 0) 2321bc0d457SAlexander V. Chernikov flag = TEI_FLAGS_ADDED; 233867708f7SAlexander V. Chernikov if (op == OP_DEL) 2341bc0d457SAlexander V. Chernikov flag = TEI_FLAGS_DELETED; 2351bc0d457SAlexander V. Chernikov break; 2361bc0d457SAlexander V. Chernikov case ENOENT: 2371bc0d457SAlexander V. Chernikov flag = TEI_FLAGS_NOTFOUND; 2381bc0d457SAlexander V. Chernikov break; 2391bc0d457SAlexander V. Chernikov case EEXIST: 2401bc0d457SAlexander V. Chernikov flag = TEI_FLAGS_EXISTS; 2411bc0d457SAlexander V. Chernikov break; 2421bc0d457SAlexander V. Chernikov default: 2431bc0d457SAlexander V. Chernikov flag = TEI_FLAGS_ERROR; 2441bc0d457SAlexander V. Chernikov } 2451bc0d457SAlexander V. Chernikov 2461bc0d457SAlexander V. Chernikov tei->flags |= flag; 2471bc0d457SAlexander V. Chernikov } 2489f7d47b0SAlexander V. Chernikov 249f99fbf96SAlexander V. Chernikov /* 250f99fbf96SAlexander V. Chernikov * Creates and references table with default parameters. 251f99fbf96SAlexander V. Chernikov * Saves table config, algo and allocated kidx info @ptc, @pta and 252f99fbf96SAlexander V. Chernikov * @pkidx if non-zero. 253f99fbf96SAlexander V. Chernikov * Used for table auto-creation to support old binaries. 254f99fbf96SAlexander V. Chernikov * 255f99fbf96SAlexander V. Chernikov * Returns 0 on success. 256f99fbf96SAlexander V. Chernikov */ 2570468c5baSAlexander V. Chernikov static int 2580468c5baSAlexander V. Chernikov create_table_compat(struct ip_fw_chain *ch, struct tid_info *ti, 259867708f7SAlexander V. Chernikov uint16_t *pkidx) 2600468c5baSAlexander V. Chernikov { 2610468c5baSAlexander V. Chernikov ipfw_xtable_info xi; 2620468c5baSAlexander V. Chernikov int error; 2630468c5baSAlexander V. Chernikov 2640468c5baSAlexander V. Chernikov memset(&xi, 0, sizeof(xi)); 2650cba2b28SAlexander V. Chernikov /* Set default value mask for legacy clients */ 2660cba2b28SAlexander V. Chernikov xi.vmask = IPFW_VTYPE_LEGACY; 2670468c5baSAlexander V. Chernikov 268867708f7SAlexander V. Chernikov error = create_table_internal(ch, ti, NULL, &xi, pkidx, 1); 2690468c5baSAlexander V. Chernikov if (error != 0) 2700468c5baSAlexander V. Chernikov return (error); 2710468c5baSAlexander V. Chernikov 2720468c5baSAlexander V. Chernikov return (0); 2730468c5baSAlexander V. Chernikov } 2740468c5baSAlexander V. Chernikov 2759f7d47b0SAlexander V. Chernikov /* 2761bc0d457SAlexander V. Chernikov * Find and reference existing table optionally 2771bc0d457SAlexander V. Chernikov * creating new one. 2781bc0d457SAlexander V. Chernikov * 279867708f7SAlexander V. Chernikov * Saves found table config into @ptc. 280867708f7SAlexander V. Chernikov * Note function may drop/acquire UH_WLOCK. 2811bc0d457SAlexander V. Chernikov * Returns 0 if table was found/created and referenced 2821bc0d457SAlexander V. Chernikov * or non-zero return code. 2839f7d47b0SAlexander V. Chernikov */ 2841bc0d457SAlexander V. Chernikov static int 2851bc0d457SAlexander V. Chernikov find_ref_table(struct ip_fw_chain *ch, struct tid_info *ti, 2864dff4ae0SAlexander V. Chernikov struct tentry_info *tei, uint32_t count, int op, 287867708f7SAlexander V. Chernikov struct table_config **ptc) 2881bc0d457SAlexander V. Chernikov { 2891bc0d457SAlexander V. Chernikov struct namedobj_instance *ni; 2901bc0d457SAlexander V. Chernikov struct table_config *tc; 291867708f7SAlexander V. Chernikov uint16_t kidx; 2921bc0d457SAlexander V. Chernikov int error; 2931bc0d457SAlexander V. Chernikov 294867708f7SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 2951bc0d457SAlexander V. Chernikov 2961bc0d457SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 2971bc0d457SAlexander V. Chernikov tc = NULL; 2989f7d47b0SAlexander V. Chernikov if ((tc = find_table(ni, ti)) != NULL) { 2999f7d47b0SAlexander V. Chernikov /* check table type */ 300867708f7SAlexander V. Chernikov if (tc->no.type != ti->type) 3013b3a8eb9SGleb Smirnoff return (EINVAL); 3023b3a8eb9SGleb Smirnoff 303867708f7SAlexander V. Chernikov if (tc->locked != 0) 3044f43138aSAlexander V. Chernikov return (EACCES); 3054f43138aSAlexander V. Chernikov 3064c0c07a5SAlexander V. Chernikov /* Try to exit early on limit hit */ 3074dff4ae0SAlexander V. Chernikov if (op == OP_ADD && count == 1 && 308867708f7SAlexander V. Chernikov check_table_limit(tc, tei) != 0) 3094c0c07a5SAlexander V. Chernikov return (EFBIG); 3104c0c07a5SAlexander V. Chernikov 311867708f7SAlexander V. Chernikov /* Reference and return */ 3129f7d47b0SAlexander V. Chernikov tc->no.refcnt++; 313867708f7SAlexander V. Chernikov *ptc = tc; 314867708f7SAlexander V. Chernikov return (0); 3159f7d47b0SAlexander V. Chernikov } 3163b3a8eb9SGleb Smirnoff 3174dff4ae0SAlexander V. Chernikov if (op == OP_DEL) 3181bc0d457SAlexander V. Chernikov return (ESRCH); 3191bc0d457SAlexander V. Chernikov 320db785d31SAlexander V. Chernikov /* Compability mode: create new table for old clients */ 321db785d31SAlexander V. Chernikov if ((tei->flags & TEI_FLAGS_COMPAT) == 0) 322db785d31SAlexander V. Chernikov return (ESRCH); 3233b3a8eb9SGleb Smirnoff 324867708f7SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 325867708f7SAlexander V. Chernikov error = create_table_compat(ch, ti, &kidx); 326867708f7SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 327867708f7SAlexander V. Chernikov 328db785d31SAlexander V. Chernikov if (error != 0) 329db785d31SAlexander V. Chernikov return (error); 330db785d31SAlexander V. Chernikov 331867708f7SAlexander V. Chernikov tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, kidx); 332867708f7SAlexander V. Chernikov KASSERT(tc != NULL, ("create_table_compat returned bad idx %d", kidx)); 333db785d31SAlexander V. Chernikov 334867708f7SAlexander V. Chernikov /* OK, now we've got referenced table. */ 3351bc0d457SAlexander V. Chernikov *ptc = tc; 3361bc0d457SAlexander V. Chernikov return (0); 3371bc0d457SAlexander V. Chernikov } 3381bc0d457SAlexander V. Chernikov 3391bc0d457SAlexander V. Chernikov /* 340867708f7SAlexander V. Chernikov * Rolls back already @added to @tc entries using state array @ta_buf_m. 3411bc0d457SAlexander V. Chernikov * Assume the following layout: 3421bc0d457SAlexander V. Chernikov * 1) ADD state (ta_buf_m[0] ... t_buf_m[added - 1]) for handling update cases 3431bc0d457SAlexander V. Chernikov * 2) DEL state (ta_buf_m[count[ ... t_buf_m[count + added - 1]) 3441bc0d457SAlexander V. Chernikov * for storing deleted state 3451bc0d457SAlexander V. Chernikov */ 3461bc0d457SAlexander V. Chernikov static void 3471bc0d457SAlexander V. Chernikov rollback_added_entries(struct ip_fw_chain *ch, struct table_config *tc, 3481bc0d457SAlexander V. Chernikov struct table_info *tinfo, struct tentry_info *tei, caddr_t ta_buf_m, 3491bc0d457SAlexander V. Chernikov uint32_t count, uint32_t added) 3501bc0d457SAlexander V. Chernikov { 3511bc0d457SAlexander V. Chernikov struct table_algo *ta; 3521bc0d457SAlexander V. Chernikov struct tentry_info *ptei; 3531bc0d457SAlexander V. Chernikov caddr_t v, vv; 3541bc0d457SAlexander V. Chernikov size_t ta_buf_sz; 3551bc0d457SAlexander V. Chernikov int error, i; 3561bc0d457SAlexander V. Chernikov uint32_t num; 3571bc0d457SAlexander V. Chernikov 3581bc0d457SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 3591bc0d457SAlexander V. Chernikov 3601bc0d457SAlexander V. Chernikov ta = tc->ta; 3613a845e10SAlexander V. Chernikov ta_buf_sz = ta->ta_buf_size; 3621bc0d457SAlexander V. Chernikov v = ta_buf_m; 3631bc0d457SAlexander V. Chernikov vv = v + count * ta_buf_sz; 3641bc0d457SAlexander V. Chernikov for (i = 0; i < added; i++, v += ta_buf_sz, vv += ta_buf_sz) { 3651bc0d457SAlexander V. Chernikov ptei = &tei[i]; 3661bc0d457SAlexander V. Chernikov if ((ptei->flags & TEI_FLAGS_UPDATED) != 0) { 3671bc0d457SAlexander V. Chernikov 3681bc0d457SAlexander V. Chernikov /* 3691bc0d457SAlexander V. Chernikov * We have old value stored by previous 3701bc0d457SAlexander V. Chernikov * call in @ptei->value. Do add once again 3711bc0d457SAlexander V. Chernikov * to restore it. 3721bc0d457SAlexander V. Chernikov */ 3731bc0d457SAlexander V. Chernikov error = ta->add(tc->astate, tinfo, ptei, v, &num); 3741bc0d457SAlexander V. Chernikov KASSERT(error == 0, ("rollback UPDATE fail")); 3751bc0d457SAlexander V. Chernikov KASSERT(num == 0, ("rollback UPDATE fail2")); 3761bc0d457SAlexander V. Chernikov continue; 3771bc0d457SAlexander V. Chernikov } 3781bc0d457SAlexander V. Chernikov 3791bc0d457SAlexander V. Chernikov error = ta->prepare_del(ch, ptei, vv); 3801bc0d457SAlexander V. Chernikov KASSERT(error == 0, ("pre-rollback INSERT failed")); 3811bc0d457SAlexander V. Chernikov error = ta->del(tc->astate, tinfo, ptei, vv, &num); 3821bc0d457SAlexander V. Chernikov KASSERT(error == 0, ("rollback INSERT failed")); 3831bc0d457SAlexander V. Chernikov tc->count -= num; 3841bc0d457SAlexander V. Chernikov } 3851bc0d457SAlexander V. Chernikov } 3861bc0d457SAlexander V. Chernikov 3871bc0d457SAlexander V. Chernikov /* 3881bc0d457SAlexander V. Chernikov * Prepares add/del state for all @count entries in @tei. 3891bc0d457SAlexander V. Chernikov * Uses either stack buffer (@ta_buf) or allocates a new one. 3901bc0d457SAlexander V. Chernikov * Stores pointer to allocated buffer back to @ta_buf. 3911bc0d457SAlexander V. Chernikov * 3921bc0d457SAlexander V. Chernikov * Returns 0 on success. 3931bc0d457SAlexander V. Chernikov */ 3941bc0d457SAlexander V. Chernikov static int 3951bc0d457SAlexander V. Chernikov prepare_batch_buffer(struct ip_fw_chain *ch, struct table_algo *ta, 3964dff4ae0SAlexander V. Chernikov struct tentry_info *tei, uint32_t count, int op, caddr_t *ta_buf) 3971bc0d457SAlexander V. Chernikov { 3981bc0d457SAlexander V. Chernikov caddr_t ta_buf_m, v; 3991bc0d457SAlexander V. Chernikov size_t ta_buf_sz, sz; 4001bc0d457SAlexander V. Chernikov struct tentry_info *ptei; 4011bc0d457SAlexander V. Chernikov int error, i; 4021bc0d457SAlexander V. Chernikov 4031bc0d457SAlexander V. Chernikov error = 0; 4041bc0d457SAlexander V. Chernikov ta_buf_sz = ta->ta_buf_size; 4053a845e10SAlexander V. Chernikov if (count == 1) { 4061bc0d457SAlexander V. Chernikov /* Sigle add/delete, use on-stack buffer */ 4071bc0d457SAlexander V. Chernikov memset(*ta_buf, 0, TA_BUF_SZ); 4081bc0d457SAlexander V. Chernikov ta_buf_m = *ta_buf; 4093a845e10SAlexander V. Chernikov } else { 4103a845e10SAlexander V. Chernikov 4113a845e10SAlexander V. Chernikov /* 4121bc0d457SAlexander V. Chernikov * Multiple adds/deletes, allocate larger buffer 4131bc0d457SAlexander V. Chernikov * 4141bc0d457SAlexander V. Chernikov * Note we need 2xcount buffer for add case: 4151bc0d457SAlexander V. Chernikov * we have hold both ADD state 4163a845e10SAlexander V. Chernikov * and DELETE state (this may be needed 4173a845e10SAlexander V. Chernikov * if we need to rollback all changes) 4183a845e10SAlexander V. Chernikov */ 4191bc0d457SAlexander V. Chernikov sz = count * ta_buf_sz; 4204dff4ae0SAlexander V. Chernikov ta_buf_m = malloc((op == OP_ADD) ? sz * 2 : sz, M_TEMP, 4213a845e10SAlexander V. Chernikov M_WAITOK | M_ZERO); 4223a845e10SAlexander V. Chernikov } 4231bc0d457SAlexander V. Chernikov 4243a845e10SAlexander V. Chernikov v = ta_buf_m; 4253a845e10SAlexander V. Chernikov for (i = 0; i < count; i++, v += ta_buf_sz) { 4261bc0d457SAlexander V. Chernikov ptei = &tei[i]; 4274dff4ae0SAlexander V. Chernikov error = (op == OP_ADD) ? 4281bc0d457SAlexander V. Chernikov ta->prepare_add(ch, ptei, v) : ta->prepare_del(ch, ptei, v); 4293a845e10SAlexander V. Chernikov 4303a845e10SAlexander V. Chernikov /* 4313a845e10SAlexander V. Chernikov * Some syntax error (incorrect mask, or address, or 4323a845e10SAlexander V. Chernikov * anything). Return error regardless of atomicity 4333a845e10SAlexander V. Chernikov * settings. 4343a845e10SAlexander V. Chernikov */ 435db785d31SAlexander V. Chernikov if (error != 0) 4361bc0d457SAlexander V. Chernikov break; 4373a845e10SAlexander V. Chernikov } 4383b3a8eb9SGleb Smirnoff 4391bc0d457SAlexander V. Chernikov *ta_buf = ta_buf_m; 4401bc0d457SAlexander V. Chernikov return (error); 4411bc0d457SAlexander V. Chernikov } 4421bc0d457SAlexander V. Chernikov 4431bc0d457SAlexander V. Chernikov /* 4441bc0d457SAlexander V. Chernikov * Flushes allocated state for each @count entries in @tei. 4451bc0d457SAlexander V. Chernikov * Frees @ta_buf_m if differs from stack buffer @ta_buf. 4461bc0d457SAlexander V. Chernikov */ 4471bc0d457SAlexander V. Chernikov static void 4481bc0d457SAlexander V. Chernikov flush_batch_buffer(struct ip_fw_chain *ch, struct table_algo *ta, 449867708f7SAlexander V. Chernikov struct tentry_info *tei, uint32_t count, int rollback, 4501bc0d457SAlexander V. Chernikov caddr_t ta_buf_m, caddr_t ta_buf) 4511bc0d457SAlexander V. Chernikov { 4521bc0d457SAlexander V. Chernikov caddr_t v; 4530cba2b28SAlexander V. Chernikov struct tentry_info *ptei; 4541bc0d457SAlexander V. Chernikov size_t ta_buf_sz; 4551bc0d457SAlexander V. Chernikov int i; 4561bc0d457SAlexander V. Chernikov 4571bc0d457SAlexander V. Chernikov ta_buf_sz = ta->ta_buf_size; 4581bc0d457SAlexander V. Chernikov 4591bc0d457SAlexander V. Chernikov /* Run cleaning callback anyway */ 4601bc0d457SAlexander V. Chernikov v = ta_buf_m; 4610cba2b28SAlexander V. Chernikov for (i = 0; i < count; i++, v += ta_buf_sz) { 4620cba2b28SAlexander V. Chernikov ptei = &tei[i]; 4630cba2b28SAlexander V. Chernikov ta->flush_entry(ch, ptei, v); 4640cba2b28SAlexander V. Chernikov if (ptei->ptv != NULL) { 4650cba2b28SAlexander V. Chernikov free(ptei->ptv, M_IPFW); 4660cba2b28SAlexander V. Chernikov ptei->ptv = NULL; 4670cba2b28SAlexander V. Chernikov } 4680cba2b28SAlexander V. Chernikov } 4691bc0d457SAlexander V. Chernikov 4701bc0d457SAlexander V. Chernikov /* Clean up "deleted" state in case of rollback */ 4711bc0d457SAlexander V. Chernikov if (rollback != 0) { 4721bc0d457SAlexander V. Chernikov v = ta_buf_m + count * ta_buf_sz; 4731bc0d457SAlexander V. Chernikov for (i = 0; i < count; i++, v += ta_buf_sz) 4741bc0d457SAlexander V. Chernikov ta->flush_entry(ch, &tei[i], v); 4751bc0d457SAlexander V. Chernikov } 4761bc0d457SAlexander V. Chernikov 4771bc0d457SAlexander V. Chernikov if (ta_buf_m != ta_buf) 4781bc0d457SAlexander V. Chernikov free(ta_buf_m, M_TEMP); 4791bc0d457SAlexander V. Chernikov } 4801bc0d457SAlexander V. Chernikov 48171af39bfSAlexander V. Chernikov 48271af39bfSAlexander V. Chernikov static void 48371af39bfSAlexander V. Chernikov rollback_add_entry(void *object, struct op_state *_state) 48471af39bfSAlexander V. Chernikov { 48571af39bfSAlexander V. Chernikov struct ip_fw_chain *ch; 48671af39bfSAlexander V. Chernikov struct tableop_state *ts; 48771af39bfSAlexander V. Chernikov 48871af39bfSAlexander V. Chernikov ts = (struct tableop_state *)_state; 48971af39bfSAlexander V. Chernikov 49071af39bfSAlexander V. Chernikov if (ts->tc != object && ts->ch != object) 49171af39bfSAlexander V. Chernikov return; 49271af39bfSAlexander V. Chernikov 49371af39bfSAlexander V. Chernikov ch = ts->ch; 49471af39bfSAlexander V. Chernikov 49571af39bfSAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 49671af39bfSAlexander V. Chernikov 49771af39bfSAlexander V. Chernikov /* Call specifid unlockers */ 49871af39bfSAlexander V. Chernikov rollback_table_values(ts); 49971af39bfSAlexander V. Chernikov 50071af39bfSAlexander V. Chernikov /* Indicate we've called */ 50171af39bfSAlexander V. Chernikov ts->modified = 1; 50271af39bfSAlexander V. Chernikov } 50371af39bfSAlexander V. Chernikov 5041bc0d457SAlexander V. Chernikov /* 5051bc0d457SAlexander V. Chernikov * Adds/updates one or more entries in table @ti. 50671af39bfSAlexander V. Chernikov * 50771af39bfSAlexander V. Chernikov * Function may drop/reacquire UH wlock multiple times due to 50871af39bfSAlexander V. Chernikov * items alloc, algorithm callbacks (check_space), value linkage 50971af39bfSAlexander V. Chernikov * (new values, value storage realloc), etc.. 51071af39bfSAlexander V. Chernikov * Other processes like other adds (which may involve storage resize), 51171af39bfSAlexander V. Chernikov * table swaps (which changes table data and may change algo type), 51271af39bfSAlexander V. Chernikov * table modify (which may change value mask) may be executed 51371af39bfSAlexander V. Chernikov * simultaneously so we need to deal with it. 51471af39bfSAlexander V. Chernikov * 51571af39bfSAlexander V. Chernikov * The following approach was implemented: 51671af39bfSAlexander V. Chernikov * we have per-chain linked list, protected with UH lock. 51771af39bfSAlexander V. Chernikov * add_table_entry prepares special on-stack structure wthich is passed 51871af39bfSAlexander V. Chernikov * to its descendants. Users add this structure to this list before unlock. 51971af39bfSAlexander V. Chernikov * After performing needed operations and acquiring UH lock back, each user 52071af39bfSAlexander V. Chernikov * checks if structure has changed. If true, it rolls local state back and 52171af39bfSAlexander V. Chernikov * returns without error to the caller. 52271af39bfSAlexander V. Chernikov * add_table_entry() on its own checks if structure has changed and restarts 52371af39bfSAlexander V. Chernikov * its operation from the beginning (goto restart). 52471af39bfSAlexander V. Chernikov * 52571af39bfSAlexander V. Chernikov * Functions which are modifying fields of interest (currently 52671af39bfSAlexander V. Chernikov * resize_shared_value_storage() and swap_tables() ) 52771af39bfSAlexander V. Chernikov * traverses given list while holding UH lock immediately before 52871af39bfSAlexander V. Chernikov * performing their operations calling function provided be list entry 52971af39bfSAlexander V. Chernikov * ( currently rollback_add_entry ) which performs rollback for all necessary 53071af39bfSAlexander V. Chernikov * state and sets appropriate values in structure indicating rollback 53171af39bfSAlexander V. Chernikov * has happened. 53271af39bfSAlexander V. Chernikov * 53371af39bfSAlexander V. Chernikov * Algo interaction: 5340468c5baSAlexander V. Chernikov * Function references @ti first to ensure table won't 5350468c5baSAlexander V. Chernikov * disappear or change its type. 5360468c5baSAlexander V. Chernikov * After that, prepare_add callback is called for each @tei entry. 5370468c5baSAlexander V. Chernikov * Next, we try to add each entry under UH+WHLOCK 5380468c5baSAlexander V. Chernikov * using add() callback. 5390468c5baSAlexander V. Chernikov * Finally, we free all state by calling flush_entry callback 5400468c5baSAlexander V. Chernikov * for each @tei. 5411bc0d457SAlexander V. Chernikov * 5421bc0d457SAlexander V. Chernikov * Returns 0 on success. 5431bc0d457SAlexander V. Chernikov */ 5441bc0d457SAlexander V. Chernikov int 5451bc0d457SAlexander V. Chernikov add_table_entry(struct ip_fw_chain *ch, struct tid_info *ti, 5461bc0d457SAlexander V. Chernikov struct tentry_info *tei, uint8_t flags, uint32_t count) 5471bc0d457SAlexander V. Chernikov { 5481bc0d457SAlexander V. Chernikov struct table_config *tc; 5491bc0d457SAlexander V. Chernikov struct table_algo *ta; 5501bc0d457SAlexander V. Chernikov uint16_t kidx; 5511bc0d457SAlexander V. Chernikov int error, first_error, i, rollback; 5521bc0d457SAlexander V. Chernikov uint32_t num, numadd; 5531bc0d457SAlexander V. Chernikov struct tentry_info *ptei; 5540cba2b28SAlexander V. Chernikov struct tableop_state ts; 5551bc0d457SAlexander V. Chernikov char ta_buf[TA_BUF_SZ]; 5561bc0d457SAlexander V. Chernikov caddr_t ta_buf_m, v; 5571bc0d457SAlexander V. Chernikov 5580cba2b28SAlexander V. Chernikov memset(&ts, 0, sizeof(ts)); 559d4e1b515SAlexander V. Chernikov ta = NULL; 5600cba2b28SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 5610cba2b28SAlexander V. Chernikov 5621bc0d457SAlexander V. Chernikov /* 5631bc0d457SAlexander V. Chernikov * Find and reference existing table. 5641bc0d457SAlexander V. Chernikov */ 5650cba2b28SAlexander V. Chernikov restart: 5660cba2b28SAlexander V. Chernikov if (ts.modified != 0) { 5678ebca97fSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 5680cba2b28SAlexander V. Chernikov flush_batch_buffer(ch, ta, tei, count, rollback, 5690cba2b28SAlexander V. Chernikov ta_buf_m, ta_buf); 5700cba2b28SAlexander V. Chernikov memset(&ts, 0, sizeof(ts)); 5718ebca97fSAlexander V. Chernikov ta = NULL; 5728ebca97fSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 5730cba2b28SAlexander V. Chernikov } 5748ebca97fSAlexander V. Chernikov 575867708f7SAlexander V. Chernikov error = find_ref_table(ch, ti, tei, count, OP_ADD, &tc); 576867708f7SAlexander V. Chernikov if (error != 0) { 577867708f7SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 5781bc0d457SAlexander V. Chernikov return (error); 579867708f7SAlexander V. Chernikov } 580867708f7SAlexander V. Chernikov ta = tc->ta; 581fb4b37a3SAlexander V. Chernikov 582fb4b37a3SAlexander V. Chernikov /* Fill in tablestate */ 5830cba2b28SAlexander V. Chernikov ts.ch = ch; 58471af39bfSAlexander V. Chernikov ts.opstate.func = rollback_add_entry; 5850cba2b28SAlexander V. Chernikov ts.tc = tc; 5860cba2b28SAlexander V. Chernikov ts.vshared = tc->vshared; 5870cba2b28SAlexander V. Chernikov ts.vmask = tc->vmask; 5880cba2b28SAlexander V. Chernikov ts.ta = ta; 5890cba2b28SAlexander V. Chernikov ts.tei = tei; 5900cba2b28SAlexander V. Chernikov ts.count = count; 5910cba2b28SAlexander V. Chernikov rollback = 0; 5920cba2b28SAlexander V. Chernikov add_toperation_state(ch, &ts); 593867708f7SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 5941bc0d457SAlexander V. Chernikov 5951bc0d457SAlexander V. Chernikov /* Allocate memory and prepare record(s) */ 5961bc0d457SAlexander V. Chernikov /* Pass stack buffer by default */ 5971bc0d457SAlexander V. Chernikov ta_buf_m = ta_buf; 5984dff4ae0SAlexander V. Chernikov error = prepare_batch_buffer(ch, ta, tei, count, OP_ADD, &ta_buf_m); 5991bc0d457SAlexander V. Chernikov if (error != 0) 6001bc0d457SAlexander V. Chernikov goto cleanup; 6011bc0d457SAlexander V. Chernikov 602b074b7bbSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 603c8d5d308SAlexander V. Chernikov /* Drop reference we've used in first search */ 604c8d5d308SAlexander V. Chernikov tc->no.refcnt--; 605c8d5d308SAlexander V. Chernikov 606b6ee846eSAlexander V. Chernikov /* 6070cba2b28SAlexander V. Chernikov * Check if table swap has happened. 6080cba2b28SAlexander V. Chernikov * (so table algo might be changed). 6090cba2b28SAlexander V. Chernikov * Restart operation to achieve consistent behavior. 610b6ee846eSAlexander V. Chernikov */ 6110cba2b28SAlexander V. Chernikov del_toperation_state(ch, &ts); 6120cba2b28SAlexander V. Chernikov if (ts.modified != 0) 6130cba2b28SAlexander V. Chernikov goto restart; 614b6ee846eSAlexander V. Chernikov 615c8d5d308SAlexander V. Chernikov /* 6160cba2b28SAlexander V. Chernikov * Link all values values to shared/per-table value array. 6170cba2b28SAlexander V. Chernikov * 6180cba2b28SAlexander V. Chernikov * May release/reacquire UH_WLOCK. 619c8d5d308SAlexander V. Chernikov */ 6200cba2b28SAlexander V. Chernikov error = ipfw_link_table_values(ch, &ts); 6210cba2b28SAlexander V. Chernikov if (error != 0) 622c8d5d308SAlexander V. Chernikov goto cleanup; 6230cba2b28SAlexander V. Chernikov if (ts.modified != 0) 6240cba2b28SAlexander V. Chernikov goto restart; 6250cba2b28SAlexander V. Chernikov 6260cba2b28SAlexander V. Chernikov /* 6270cba2b28SAlexander V. Chernikov * Ensure we are able to add all entries without additional 6280cba2b28SAlexander V. Chernikov * memory allocations. May release/reacquire UH_WLOCK. 6290cba2b28SAlexander V. Chernikov */ 6300cba2b28SAlexander V. Chernikov kidx = tc->no.kidx; 6310cba2b28SAlexander V. Chernikov error = check_table_space(ch, &ts, tc, KIDX_TO_TI(ch, kidx), count); 6320cba2b28SAlexander V. Chernikov if (error != 0) 6330cba2b28SAlexander V. Chernikov goto cleanup; 6340cba2b28SAlexander V. Chernikov if (ts.modified != 0) 6350cba2b28SAlexander V. Chernikov goto restart; 636c8d5d308SAlexander V. Chernikov 6373a845e10SAlexander V. Chernikov /* We've got valid table in @tc. Let's try to add data */ 6389f7d47b0SAlexander V. Chernikov kidx = tc->no.kidx; 6399f7d47b0SAlexander V. Chernikov ta = tc->ta; 6403a845e10SAlexander V. Chernikov numadd = 0; 6413a845e10SAlexander V. Chernikov first_error = 0; 6429f7d47b0SAlexander V. Chernikov 643b074b7bbSAlexander V. Chernikov IPFW_WLOCK(ch); 6443a845e10SAlexander V. Chernikov 6453a845e10SAlexander V. Chernikov v = ta_buf_m; 6461bc0d457SAlexander V. Chernikov for (i = 0; i < count; i++, v += ta->ta_buf_size) { 6473a845e10SAlexander V. Chernikov ptei = &tei[i]; 6483a845e10SAlexander V. Chernikov num = 0; 6493a845e10SAlexander V. Chernikov /* check limit before adding */ 6503a845e10SAlexander V. Chernikov if ((error = check_table_limit(tc, ptei)) == 0) { 6513a845e10SAlexander V. Chernikov error = ta->add(tc->astate, KIDX_TO_TI(ch, kidx), 6523a845e10SAlexander V. Chernikov ptei, v, &num); 6533a845e10SAlexander V. Chernikov /* Set status flag to inform userland */ 654867708f7SAlexander V. Chernikov store_tei_result(ptei, OP_ADD, error, num); 6553a845e10SAlexander V. Chernikov } 6563a845e10SAlexander V. Chernikov if (error == 0) { 6573a845e10SAlexander V. Chernikov /* Update number of records to ease limit checking */ 6583a845e10SAlexander V. Chernikov tc->count += num; 6593a845e10SAlexander V. Chernikov numadd += num; 6603a845e10SAlexander V. Chernikov continue; 6613a845e10SAlexander V. Chernikov } 6623a845e10SAlexander V. Chernikov 6633a845e10SAlexander V. Chernikov if (first_error == 0) 6643a845e10SAlexander V. Chernikov first_error = error; 6653a845e10SAlexander V. Chernikov 6663a845e10SAlexander V. Chernikov /* 6673a845e10SAlexander V. Chernikov * Some error have happened. Check our atomicity 6683a845e10SAlexander V. Chernikov * settings: continue if atomicity is not required, 6693a845e10SAlexander V. Chernikov * rollback changes otherwise. 6703a845e10SAlexander V. Chernikov */ 6713a845e10SAlexander V. Chernikov if ((flags & IPFW_CTF_ATOMIC) == 0) 6723a845e10SAlexander V. Chernikov continue; 6733a845e10SAlexander V. Chernikov 6741bc0d457SAlexander V. Chernikov rollback_added_entries(ch, tc, KIDX_TO_TI(ch, kidx), 6751bc0d457SAlexander V. Chernikov tei, ta_buf_m, count, i); 6760cba2b28SAlexander V. Chernikov 6770cba2b28SAlexander V. Chernikov rollback = 1; 6783a845e10SAlexander V. Chernikov break; 6793a845e10SAlexander V. Chernikov } 6803a845e10SAlexander V. Chernikov 6813b3a8eb9SGleb Smirnoff IPFW_WUNLOCK(ch); 6829f7d47b0SAlexander V. Chernikov 68371af39bfSAlexander V. Chernikov ipfw_garbage_table_values(ch, tc, tei, count, rollback); 6840cba2b28SAlexander V. Chernikov 685b6ee846eSAlexander V. Chernikov /* Permit post-add algorithm grow/rehash. */ 6863a845e10SAlexander V. Chernikov if (numadd != 0) 6870cba2b28SAlexander V. Chernikov check_table_space(ch, NULL, tc, KIDX_TO_TI(ch, kidx), 0); 688b074b7bbSAlexander V. Chernikov 6893a845e10SAlexander V. Chernikov /* Return first error to user, if any */ 6903a845e10SAlexander V. Chernikov error = first_error; 6913a845e10SAlexander V. Chernikov 6923a845e10SAlexander V. Chernikov cleanup: 6930cba2b28SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 6940cba2b28SAlexander V. Chernikov 695867708f7SAlexander V. Chernikov flush_batch_buffer(ch, ta, tei, count, rollback, ta_buf_m, ta_buf); 696b074b7bbSAlexander V. Chernikov 6979f7d47b0SAlexander V. Chernikov return (error); 6983b3a8eb9SGleb Smirnoff } 6993b3a8eb9SGleb Smirnoff 7003a845e10SAlexander V. Chernikov /* 7013a845e10SAlexander V. Chernikov * Deletes one or more entries in table @ti. 7023a845e10SAlexander V. Chernikov * 7033a845e10SAlexander V. Chernikov * Returns 0 on success. 7043a845e10SAlexander V. Chernikov */ 7053b3a8eb9SGleb Smirnoff int 7061832a7b3SAlexander V. Chernikov del_table_entry(struct ip_fw_chain *ch, struct tid_info *ti, 7073a845e10SAlexander V. Chernikov struct tentry_info *tei, uint8_t flags, uint32_t count) 7083b3a8eb9SGleb Smirnoff { 709b074b7bbSAlexander V. Chernikov struct table_config *tc; 7109f7d47b0SAlexander V. Chernikov struct table_algo *ta; 7113a845e10SAlexander V. Chernikov struct tentry_info *ptei; 712b074b7bbSAlexander V. Chernikov uint16_t kidx; 7133a845e10SAlexander V. Chernikov int error, first_error, i; 7143a845e10SAlexander V. Chernikov uint32_t num, numdel; 715b6ee846eSAlexander V. Chernikov char ta_buf[TA_BUF_SZ]; 7163a845e10SAlexander V. Chernikov caddr_t ta_buf_m, v; 7173b3a8eb9SGleb Smirnoff 718db785d31SAlexander V. Chernikov /* 7191bc0d457SAlexander V. Chernikov * Find and reference existing table. 720db785d31SAlexander V. Chernikov */ 721867708f7SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 722867708f7SAlexander V. Chernikov error = find_ref_table(ch, ti, tei, count, OP_DEL, &tc); 723867708f7SAlexander V. Chernikov if (error != 0) { 724867708f7SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 725db785d31SAlexander V. Chernikov return (error); 726867708f7SAlexander V. Chernikov } 727867708f7SAlexander V. Chernikov ta = tc->ta; 728867708f7SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 7293a845e10SAlexander V. Chernikov 73035e1bbd0SAlexander V. Chernikov /* Allocate memory and prepare record(s) */ 7311bc0d457SAlexander V. Chernikov /* Pass stack buffer by default */ 7323a845e10SAlexander V. Chernikov ta_buf_m = ta_buf; 7334dff4ae0SAlexander V. Chernikov error = prepare_batch_buffer(ch, ta, tei, count, OP_DEL, &ta_buf_m); 7343a845e10SAlexander V. Chernikov if (error != 0) 7353a845e10SAlexander V. Chernikov goto cleanup; 7369f7d47b0SAlexander V. Chernikov 7373a845e10SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 7383a845e10SAlexander V. Chernikov 7393a845e10SAlexander V. Chernikov /* Drop reference we've used in first search */ 7403a845e10SAlexander V. Chernikov tc->no.refcnt--; 7413a845e10SAlexander V. Chernikov 742c8d5d308SAlexander V. Chernikov /* 743c8d5d308SAlexander V. Chernikov * Check if table algo is still the same. 744c8d5d308SAlexander V. Chernikov * (changed ta may be the result of table swap). 745c8d5d308SAlexander V. Chernikov */ 746c8d5d308SAlexander V. Chernikov if (ta != tc->ta) { 747c8d5d308SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 748c8d5d308SAlexander V. Chernikov error = EINVAL; 749c8d5d308SAlexander V. Chernikov goto cleanup; 750c8d5d308SAlexander V. Chernikov } 751c8d5d308SAlexander V. Chernikov 752b074b7bbSAlexander V. Chernikov kidx = tc->no.kidx; 7533a845e10SAlexander V. Chernikov numdel = 0; 7543a845e10SAlexander V. Chernikov first_error = 0; 755b074b7bbSAlexander V. Chernikov 756b074b7bbSAlexander V. Chernikov IPFW_WLOCK(ch); 7573a845e10SAlexander V. Chernikov v = ta_buf_m; 7581bc0d457SAlexander V. Chernikov for (i = 0; i < count; i++, v += ta->ta_buf_size) { 7593a845e10SAlexander V. Chernikov ptei = &tei[i]; 7603a845e10SAlexander V. Chernikov num = 0; 7613a845e10SAlexander V. Chernikov error = ta->del(tc->astate, KIDX_TO_TI(ch, kidx), ptei, v, 7623a845e10SAlexander V. Chernikov &num); 7633a845e10SAlexander V. Chernikov /* Save state for userland */ 764867708f7SAlexander V. Chernikov store_tei_result(ptei, OP_DEL, error, num); 7653a845e10SAlexander V. Chernikov if (error != 0 && first_error == 0) 7663a845e10SAlexander V. Chernikov first_error = error; 7673a845e10SAlexander V. Chernikov tc->count -= num; 7683a845e10SAlexander V. Chernikov numdel += num; 7693a845e10SAlexander V. Chernikov } 7703b3a8eb9SGleb Smirnoff IPFW_WUNLOCK(ch); 7713b3a8eb9SGleb Smirnoff 7720cba2b28SAlexander V. Chernikov /* Unlink non-used values */ 77371af39bfSAlexander V. Chernikov ipfw_garbage_table_values(ch, tc, tei, count, 0); 7740cba2b28SAlexander V. Chernikov 7753a845e10SAlexander V. Chernikov if (numdel != 0) { 776b6ee846eSAlexander V. Chernikov /* Run post-del hook to permit shrinking */ 7770cba2b28SAlexander V. Chernikov check_table_space(ch, NULL, tc, KIDX_TO_TI(ch, kidx), 0); 778b6ee846eSAlexander V. Chernikov } 779b074b7bbSAlexander V. Chernikov 7809f7d47b0SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 7813b3a8eb9SGleb Smirnoff 7823a845e10SAlexander V. Chernikov /* Return first error to user, if any */ 7833a845e10SAlexander V. Chernikov error = first_error; 7843a845e10SAlexander V. Chernikov 7853a845e10SAlexander V. Chernikov cleanup: 786867708f7SAlexander V. Chernikov flush_batch_buffer(ch, ta, tei, count, 0, ta_buf_m, ta_buf); 787ac35ff17SAlexander V. Chernikov 788ac35ff17SAlexander V. Chernikov return (error); 789ac35ff17SAlexander V. Chernikov } 790ac35ff17SAlexander V. Chernikov 791db785d31SAlexander V. Chernikov /* 792b6ee846eSAlexander V. Chernikov * Ensure that table @tc has enough space to add @count entries without 793b6ee846eSAlexander V. Chernikov * need for reallocation. 794db785d31SAlexander V. Chernikov * 795db785d31SAlexander V. Chernikov * Callbacks order: 796301290bcSAlexander V. Chernikov * 0) need_modify() (UH_WLOCK) - checks if @count items can be added w/o resize. 797b6ee846eSAlexander V. Chernikov * 798db785d31SAlexander V. Chernikov * 1) alloc_modify (no locks, M_WAITOK) - alloc new state based on @pflags. 799db785d31SAlexander V. Chernikov * 2) prepare_modifyt (UH_WLOCK) - copy old data into new storage 800db785d31SAlexander V. Chernikov * 3) modify (UH_WLOCK + WLOCK) - switch pointers 801b6ee846eSAlexander V. Chernikov * 4) flush_modify (UH_WLOCK) - free state, if needed 802b6ee846eSAlexander V. Chernikov * 803b6ee846eSAlexander V. Chernikov * Returns 0 on success. 804db785d31SAlexander V. Chernikov */ 805db785d31SAlexander V. Chernikov static int 8060cba2b28SAlexander V. Chernikov check_table_space(struct ip_fw_chain *ch, struct tableop_state *ts, 8070cba2b28SAlexander V. Chernikov struct table_config *tc, struct table_info *ti, uint32_t count) 808db785d31SAlexander V. Chernikov { 809b6ee846eSAlexander V. Chernikov struct table_algo *ta; 810b6ee846eSAlexander V. Chernikov uint64_t pflags; 811b6ee846eSAlexander V. Chernikov char ta_buf[TA_BUF_SZ]; 812db785d31SAlexander V. Chernikov int error; 813db785d31SAlexander V. Chernikov 814b6ee846eSAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 815db785d31SAlexander V. Chernikov 816b6ee846eSAlexander V. Chernikov error = 0; 817b6ee846eSAlexander V. Chernikov ta = tc->ta; 818fd0869d5SAlexander V. Chernikov if (ta->need_modify == NULL) 819fd0869d5SAlexander V. Chernikov return (0); 820fd0869d5SAlexander V. Chernikov 821b6ee846eSAlexander V. Chernikov /* Acquire reference not to loose @tc between locks/unlocks */ 822b6ee846eSAlexander V. Chernikov tc->no.refcnt++; 823db785d31SAlexander V. Chernikov 824db785d31SAlexander V. Chernikov /* 825b6ee846eSAlexander V. Chernikov * TODO: think about avoiding race between large add/large delete 826b6ee846eSAlexander V. Chernikov * operation on algorithm which implements shrinking along with 827b6ee846eSAlexander V. Chernikov * growing. 828db785d31SAlexander V. Chernikov */ 829b6ee846eSAlexander V. Chernikov while (true) { 830b6ee846eSAlexander V. Chernikov pflags = 0; 831301290bcSAlexander V. Chernikov if (ta->need_modify(tc->astate, ti, count, &pflags) == 0) { 83235e1bbd0SAlexander V. Chernikov error = 0; 83335e1bbd0SAlexander V. Chernikov break; 834b6ee846eSAlexander V. Chernikov } 835db785d31SAlexander V. Chernikov 836b6ee846eSAlexander V. Chernikov /* We have to shrink/grow table */ 8370cba2b28SAlexander V. Chernikov if (ts != NULL) 8380cba2b28SAlexander V. Chernikov add_toperation_state(ch, ts); 839b6ee846eSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 840b6ee846eSAlexander V. Chernikov 841301290bcSAlexander V. Chernikov memset(&ta_buf, 0, sizeof(ta_buf)); 8420cba2b28SAlexander V. Chernikov error = ta->prepare_mod(ta_buf, &pflags); 843b6ee846eSAlexander V. Chernikov 844b6ee846eSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 8450cba2b28SAlexander V. Chernikov if (ts != NULL) 8460cba2b28SAlexander V. Chernikov del_toperation_state(ch, ts); 8470cba2b28SAlexander V. Chernikov 8480cba2b28SAlexander V. Chernikov if (error != 0) 8490cba2b28SAlexander V. Chernikov break; 8500cba2b28SAlexander V. Chernikov 8510cba2b28SAlexander V. Chernikov if (ts != NULL && ts->modified != 0) { 8520cba2b28SAlexander V. Chernikov 8530cba2b28SAlexander V. Chernikov /* 8540cba2b28SAlexander V. Chernikov * Swap operation has happened 8550cba2b28SAlexander V. Chernikov * so we're currently operating on other 8560cba2b28SAlexander V. Chernikov * table data. Stop doing this. 8570cba2b28SAlexander V. Chernikov */ 8580cba2b28SAlexander V. Chernikov ta->flush_mod(ta_buf); 8590cba2b28SAlexander V. Chernikov break; 8600cba2b28SAlexander V. Chernikov } 861b6ee846eSAlexander V. Chernikov 862b6ee846eSAlexander V. Chernikov /* Check if we still need to alter table */ 863b6ee846eSAlexander V. Chernikov ti = KIDX_TO_TI(ch, tc->no.kidx); 864301290bcSAlexander V. Chernikov if (ta->need_modify(tc->astate, ti, count, &pflags) == 0) { 865301290bcSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 866b6ee846eSAlexander V. Chernikov 867b6ee846eSAlexander V. Chernikov /* 86835e1bbd0SAlexander V. Chernikov * Other thread has already performed resize. 86935e1bbd0SAlexander V. Chernikov * Flush our state and return. 870b6ee846eSAlexander V. Chernikov */ 871b6ee846eSAlexander V. Chernikov ta->flush_mod(ta_buf); 872b6ee846eSAlexander V. Chernikov break; 873b6ee846eSAlexander V. Chernikov } 874b6ee846eSAlexander V. Chernikov 875b6ee846eSAlexander V. Chernikov error = ta->fill_mod(tc->astate, ti, ta_buf, &pflags); 876b6ee846eSAlexander V. Chernikov if (error == 0) { 877db785d31SAlexander V. Chernikov /* Do actual modification */ 878db785d31SAlexander V. Chernikov IPFW_WLOCK(ch); 87968394ec8SAlexander V. Chernikov ta->modify(tc->astate, ti, ta_buf, pflags); 880db785d31SAlexander V. Chernikov IPFW_WUNLOCK(ch); 881db785d31SAlexander V. Chernikov } 882db785d31SAlexander V. Chernikov 883b6ee846eSAlexander V. Chernikov /* Anyway, flush data and retry */ 884db785d31SAlexander V. Chernikov ta->flush_mod(ta_buf); 885b6ee846eSAlexander V. Chernikov } 886db785d31SAlexander V. Chernikov 887b6ee846eSAlexander V. Chernikov tc->no.refcnt--; 888db785d31SAlexander V. Chernikov return (error); 889db785d31SAlexander V. Chernikov } 890db785d31SAlexander V. Chernikov 8913a845e10SAlexander V. Chernikov /* 892ac35ff17SAlexander V. Chernikov * Adds or deletes record in table. 893ac35ff17SAlexander V. Chernikov * Data layout (v0): 894ac35ff17SAlexander V. Chernikov * Request: [ ip_fw3_opheader ipfw_table_xentry ] 895ac35ff17SAlexander V. Chernikov * 896ac35ff17SAlexander V. Chernikov * Returns 0 on success 897ac35ff17SAlexander V. Chernikov */ 898ac35ff17SAlexander V. Chernikov static int 8996b988f3aSAlexander V. Chernikov manage_table_ent_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 900ac35ff17SAlexander V. Chernikov struct sockopt_data *sd) 901ac35ff17SAlexander V. Chernikov { 902ac35ff17SAlexander V. Chernikov ipfw_table_xentry *xent; 903ac35ff17SAlexander V. Chernikov struct tentry_info tei; 904ac35ff17SAlexander V. Chernikov struct tid_info ti; 9050cba2b28SAlexander V. Chernikov struct table_value v; 906ac35ff17SAlexander V. Chernikov int error, hdrlen, read; 907ac35ff17SAlexander V. Chernikov 908ac35ff17SAlexander V. Chernikov hdrlen = offsetof(ipfw_table_xentry, k); 909ac35ff17SAlexander V. Chernikov 910ac35ff17SAlexander V. Chernikov /* Check minimum header size */ 911ac35ff17SAlexander V. Chernikov if (sd->valsize < (sizeof(*op3) + hdrlen)) 912ac35ff17SAlexander V. Chernikov return (EINVAL); 913ac35ff17SAlexander V. Chernikov 914ac35ff17SAlexander V. Chernikov read = sizeof(ip_fw3_opheader); 915ac35ff17SAlexander V. Chernikov 916ac35ff17SAlexander V. Chernikov /* Check if xentry len field is valid */ 917ac35ff17SAlexander V. Chernikov xent = (ipfw_table_xentry *)(op3 + 1); 918ac35ff17SAlexander V. Chernikov if (xent->len < hdrlen || xent->len + read > sd->valsize) 919ac35ff17SAlexander V. Chernikov return (EINVAL); 920ac35ff17SAlexander V. Chernikov 921ac35ff17SAlexander V. Chernikov memset(&tei, 0, sizeof(tei)); 922ac35ff17SAlexander V. Chernikov tei.paddr = &xent->k; 923ac35ff17SAlexander V. Chernikov tei.masklen = xent->masklen; 9240cba2b28SAlexander V. Chernikov ipfw_import_table_value_legacy(xent->value, &v); 9250cba2b28SAlexander V. Chernikov tei.pvalue = &v; 926ac35ff17SAlexander V. Chernikov /* Old requests compability */ 927db785d31SAlexander V. Chernikov tei.flags = TEI_FLAGS_COMPAT; 928c21034b7SAlexander V. Chernikov if (xent->type == IPFW_TABLE_ADDR) { 929ac35ff17SAlexander V. Chernikov if (xent->len - hdrlen == sizeof(in_addr_t)) 930ac35ff17SAlexander V. Chernikov tei.subtype = AF_INET; 931ac35ff17SAlexander V. Chernikov else 932ac35ff17SAlexander V. Chernikov tei.subtype = AF_INET6; 933ac35ff17SAlexander V. Chernikov } 934ac35ff17SAlexander V. Chernikov 935ac35ff17SAlexander V. Chernikov memset(&ti, 0, sizeof(ti)); 936ac35ff17SAlexander V. Chernikov ti.uidx = xent->tbl; 937ac35ff17SAlexander V. Chernikov ti.type = xent->type; 938ac35ff17SAlexander V. Chernikov 939ac35ff17SAlexander V. Chernikov error = (op3->opcode == IP_FW_TABLE_XADD) ? 9403a845e10SAlexander V. Chernikov add_table_entry(ch, &ti, &tei, 0, 1) : 9413a845e10SAlexander V. Chernikov del_table_entry(ch, &ti, &tei, 0, 1); 942ac35ff17SAlexander V. Chernikov 943ac35ff17SAlexander V. Chernikov return (error); 944ac35ff17SAlexander V. Chernikov } 945ac35ff17SAlexander V. Chernikov 946ac35ff17SAlexander V. Chernikov /* 947ac35ff17SAlexander V. Chernikov * Adds or deletes record in table. 948ac35ff17SAlexander V. Chernikov * Data layout (v1)(current): 949db785d31SAlexander V. Chernikov * Request: [ ipfw_obj_header 950db785d31SAlexander V. Chernikov * ipfw_obj_ctlv(IPFW_TLV_TBLENT_LIST) [ ipfw_obj_tentry x N ] 951db785d31SAlexander V. Chernikov * ] 952ac35ff17SAlexander V. Chernikov * 953ac35ff17SAlexander V. Chernikov * Returns 0 on success 954ac35ff17SAlexander V. Chernikov */ 955ac35ff17SAlexander V. Chernikov static int 9566b988f3aSAlexander V. Chernikov manage_table_ent_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 957ac35ff17SAlexander V. Chernikov struct sockopt_data *sd) 958ac35ff17SAlexander V. Chernikov { 9593a845e10SAlexander V. Chernikov ipfw_obj_tentry *tent, *ptent; 960db785d31SAlexander V. Chernikov ipfw_obj_ctlv *ctlv; 961ac35ff17SAlexander V. Chernikov ipfw_obj_header *oh; 9623a845e10SAlexander V. Chernikov struct tentry_info *ptei, tei, *tei_buf; 963ac35ff17SAlexander V. Chernikov struct tid_info ti; 9643a845e10SAlexander V. Chernikov int error, i, kidx, read; 965ac35ff17SAlexander V. Chernikov 966ac35ff17SAlexander V. Chernikov /* Check minimum header size */ 967db785d31SAlexander V. Chernikov if (sd->valsize < (sizeof(*oh) + sizeof(*ctlv))) 968ac35ff17SAlexander V. Chernikov return (EINVAL); 969ac35ff17SAlexander V. Chernikov 970ac35ff17SAlexander V. Chernikov /* Check if passed data is too long */ 971ac35ff17SAlexander V. Chernikov if (sd->valsize != sd->kavail) 972ac35ff17SAlexander V. Chernikov return (EINVAL); 973ac35ff17SAlexander V. Chernikov 974ac35ff17SAlexander V. Chernikov oh = (ipfw_obj_header *)sd->kbuf; 975ac35ff17SAlexander V. Chernikov 976ac35ff17SAlexander V. Chernikov /* Basic length checks for TLVs */ 977ac35ff17SAlexander V. Chernikov if (oh->ntlv.head.length != sizeof(oh->ntlv)) 978ac35ff17SAlexander V. Chernikov return (EINVAL); 979ac35ff17SAlexander V. Chernikov 980ac35ff17SAlexander V. Chernikov read = sizeof(*oh); 981ac35ff17SAlexander V. Chernikov 982db785d31SAlexander V. Chernikov ctlv = (ipfw_obj_ctlv *)(oh + 1); 983db785d31SAlexander V. Chernikov if (ctlv->head.length + read != sd->valsize) 984db785d31SAlexander V. Chernikov return (EINVAL); 985db785d31SAlexander V. Chernikov 986db785d31SAlexander V. Chernikov read += sizeof(*ctlv); 987db785d31SAlexander V. Chernikov tent = (ipfw_obj_tentry *)(ctlv + 1); 9883a845e10SAlexander V. Chernikov if (ctlv->count * sizeof(*tent) + read != sd->valsize) 989ac35ff17SAlexander V. Chernikov return (EINVAL); 990ac35ff17SAlexander V. Chernikov 9913a845e10SAlexander V. Chernikov if (ctlv->count == 0) 9923a845e10SAlexander V. Chernikov return (0); 993ac35ff17SAlexander V. Chernikov 9943a845e10SAlexander V. Chernikov /* 9953a845e10SAlexander V. Chernikov * Mark entire buffer as "read". 99635e1bbd0SAlexander V. Chernikov * This instructs sopt api write it back 9973a845e10SAlexander V. Chernikov * after function return. 9983a845e10SAlexander V. Chernikov */ 9993a845e10SAlexander V. Chernikov ipfw_get_sopt_header(sd, sd->valsize); 10003a845e10SAlexander V. Chernikov 10013a845e10SAlexander V. Chernikov /* Perform basic checks for each entry */ 10023a845e10SAlexander V. Chernikov ptent = tent; 10033a845e10SAlexander V. Chernikov kidx = tent->idx; 10043a845e10SAlexander V. Chernikov for (i = 0; i < ctlv->count; i++, ptent++) { 10053a845e10SAlexander V. Chernikov if (ptent->head.length != sizeof(*ptent)) 10063a845e10SAlexander V. Chernikov return (EINVAL); 10073a845e10SAlexander V. Chernikov if (ptent->idx != kidx) 10083a845e10SAlexander V. Chernikov return (ENOTSUP); 10093a845e10SAlexander V. Chernikov } 10103a845e10SAlexander V. Chernikov 10113a845e10SAlexander V. Chernikov /* Convert data into kernel request objects */ 101281d3153dSAlexander V. Chernikov objheader_to_ti(oh, &ti); 1013ac35ff17SAlexander V. Chernikov ti.type = oh->ntlv.type; 10143a845e10SAlexander V. Chernikov ti.uidx = kidx; 10153a845e10SAlexander V. Chernikov 10163a845e10SAlexander V. Chernikov /* Use on-stack buffer for single add/del */ 10173a845e10SAlexander V. Chernikov if (ctlv->count == 1) { 10183a845e10SAlexander V. Chernikov memset(&tei, 0, sizeof(tei)); 10193a845e10SAlexander V. Chernikov tei_buf = &tei; 10203a845e10SAlexander V. Chernikov } else 10213a845e10SAlexander V. Chernikov tei_buf = malloc(ctlv->count * sizeof(tei), M_TEMP, 10223a845e10SAlexander V. Chernikov M_WAITOK | M_ZERO); 10233a845e10SAlexander V. Chernikov 10243a845e10SAlexander V. Chernikov ptei = tei_buf; 10253a845e10SAlexander V. Chernikov ptent = tent; 10263a845e10SAlexander V. Chernikov for (i = 0; i < ctlv->count; i++, ptent++, ptei++) { 10273a845e10SAlexander V. Chernikov ptei->paddr = &ptent->k; 10283a845e10SAlexander V. Chernikov ptei->subtype = ptent->subtype; 10293a845e10SAlexander V. Chernikov ptei->masklen = ptent->masklen; 10303a845e10SAlexander V. Chernikov if (ptent->head.flags & IPFW_TF_UPDATE) 10313a845e10SAlexander V. Chernikov ptei->flags |= TEI_FLAGS_UPDATE; 10320cba2b28SAlexander V. Chernikov 10330cba2b28SAlexander V. Chernikov ipfw_import_table_value_v1(&ptent->v.value); 10340cba2b28SAlexander V. Chernikov ptei->pvalue = (struct table_value *)&ptent->v.value; 10353a845e10SAlexander V. Chernikov } 1036ac35ff17SAlexander V. Chernikov 1037ac35ff17SAlexander V. Chernikov error = (oh->opheader.opcode == IP_FW_TABLE_XADD) ? 10383a845e10SAlexander V. Chernikov add_table_entry(ch, &ti, tei_buf, ctlv->flags, ctlv->count) : 10393a845e10SAlexander V. Chernikov del_table_entry(ch, &ti, tei_buf, ctlv->flags, ctlv->count); 10403a845e10SAlexander V. Chernikov 10413a845e10SAlexander V. Chernikov /* Translate result back to userland */ 10423a845e10SAlexander V. Chernikov ptei = tei_buf; 10433a845e10SAlexander V. Chernikov ptent = tent; 10443a845e10SAlexander V. Chernikov for (i = 0; i < ctlv->count; i++, ptent++, ptei++) { 10453a845e10SAlexander V. Chernikov if (ptei->flags & TEI_FLAGS_ADDED) 10463a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_ADDED; 10473a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_DELETED) 10483a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_DELETED; 10493a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_UPDATED) 10503a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_UPDATED; 10513a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_LIMIT) 10523a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_LIMIT; 10533a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_ERROR) 10543a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_ERROR; 10553a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_NOTFOUND) 10563a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_NOTFOUND; 10573a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_EXISTS) 10583a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_EXISTS; 10590cba2b28SAlexander V. Chernikov ipfw_export_table_value_v1(ptei->pvalue, &ptent->v.value); 10603a845e10SAlexander V. Chernikov } 10613a845e10SAlexander V. Chernikov 10623a845e10SAlexander V. Chernikov if (tei_buf != &tei) 10633a845e10SAlexander V. Chernikov free(tei_buf, M_TEMP); 1064ac35ff17SAlexander V. Chernikov 1065ac35ff17SAlexander V. Chernikov return (error); 1066ac35ff17SAlexander V. Chernikov } 1067ac35ff17SAlexander V. Chernikov 106881d3153dSAlexander V. Chernikov /* 106981d3153dSAlexander V. Chernikov * Looks up an entry in given table. 107081d3153dSAlexander V. Chernikov * Data layout (v0)(current): 107181d3153dSAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_obj_tentry ] 107281d3153dSAlexander V. Chernikov * Reply: [ ipfw_obj_header ipfw_obj_tentry ] 107381d3153dSAlexander V. Chernikov * 107481d3153dSAlexander V. Chernikov * Returns 0 on success 107581d3153dSAlexander V. Chernikov */ 10766b988f3aSAlexander V. Chernikov static int 10776b988f3aSAlexander V. Chernikov find_table_entry(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 107881d3153dSAlexander V. Chernikov struct sockopt_data *sd) 107981d3153dSAlexander V. Chernikov { 108081d3153dSAlexander V. Chernikov ipfw_obj_tentry *tent; 108181d3153dSAlexander V. Chernikov ipfw_obj_header *oh; 108281d3153dSAlexander V. Chernikov struct tid_info ti; 108381d3153dSAlexander V. Chernikov struct table_config *tc; 108481d3153dSAlexander V. Chernikov struct table_algo *ta; 108581d3153dSAlexander V. Chernikov struct table_info *kti; 108681d3153dSAlexander V. Chernikov struct namedobj_instance *ni; 1087914bffb6SAlexander V. Chernikov int error; 108881d3153dSAlexander V. Chernikov size_t sz; 108981d3153dSAlexander V. Chernikov 109081d3153dSAlexander V. Chernikov /* Check minimum header size */ 109181d3153dSAlexander V. Chernikov sz = sizeof(*oh) + sizeof(*tent); 109281d3153dSAlexander V. Chernikov if (sd->valsize != sz) 109381d3153dSAlexander V. Chernikov return (EINVAL); 109481d3153dSAlexander V. Chernikov 109581d3153dSAlexander V. Chernikov oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 109681d3153dSAlexander V. Chernikov tent = (ipfw_obj_tentry *)(oh + 1); 109781d3153dSAlexander V. Chernikov 109881d3153dSAlexander V. Chernikov /* Basic length checks for TLVs */ 109981d3153dSAlexander V. Chernikov if (oh->ntlv.head.length != sizeof(oh->ntlv)) 110081d3153dSAlexander V. Chernikov return (EINVAL); 110181d3153dSAlexander V. Chernikov 110281d3153dSAlexander V. Chernikov objheader_to_ti(oh, &ti); 110381d3153dSAlexander V. Chernikov ti.type = oh->ntlv.type; 110481d3153dSAlexander V. Chernikov ti.uidx = tent->idx; 110581d3153dSAlexander V. Chernikov 110681d3153dSAlexander V. Chernikov IPFW_UH_RLOCK(ch); 110781d3153dSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 110881d3153dSAlexander V. Chernikov 110981d3153dSAlexander V. Chernikov /* 111081d3153dSAlexander V. Chernikov * Find existing table and check its type . 111181d3153dSAlexander V. Chernikov */ 111281d3153dSAlexander V. Chernikov ta = NULL; 111381d3153dSAlexander V. Chernikov if ((tc = find_table(ni, &ti)) == NULL) { 111481d3153dSAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 111581d3153dSAlexander V. Chernikov return (ESRCH); 111681d3153dSAlexander V. Chernikov } 111781d3153dSAlexander V. Chernikov 111881d3153dSAlexander V. Chernikov /* check table type */ 111981d3153dSAlexander V. Chernikov if (tc->no.type != ti.type) { 112081d3153dSAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 112181d3153dSAlexander V. Chernikov return (EINVAL); 112281d3153dSAlexander V. Chernikov } 112381d3153dSAlexander V. Chernikov 112481d3153dSAlexander V. Chernikov kti = KIDX_TO_TI(ch, tc->no.kidx); 112581d3153dSAlexander V. Chernikov ta = tc->ta; 112681d3153dSAlexander V. Chernikov 1127914bffb6SAlexander V. Chernikov if (ta->find_tentry == NULL) 1128914bffb6SAlexander V. Chernikov return (ENOTSUP); 1129914bffb6SAlexander V. Chernikov 1130914bffb6SAlexander V. Chernikov error = ta->find_tentry(tc->astate, kti, tent); 113181d3153dSAlexander V. Chernikov 113281d3153dSAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 113381d3153dSAlexander V. Chernikov 113481d3153dSAlexander V. Chernikov return (error); 113581d3153dSAlexander V. Chernikov } 113681d3153dSAlexander V. Chernikov 113746d52008SAlexander V. Chernikov /* 113846d52008SAlexander V. Chernikov * Flushes all entries or destroys given table. 113946d52008SAlexander V. Chernikov * Data layout (v0)(current): 114046d52008SAlexander V. Chernikov * Request: [ ipfw_obj_header ] 114146d52008SAlexander V. Chernikov * 114246d52008SAlexander V. Chernikov * Returns 0 on success 114346d52008SAlexander V. Chernikov */ 11446b988f3aSAlexander V. Chernikov static int 11456b988f3aSAlexander V. Chernikov flush_table_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1146ac35ff17SAlexander V. Chernikov struct sockopt_data *sd) 1147ac35ff17SAlexander V. Chernikov { 1148ac35ff17SAlexander V. Chernikov int error; 1149ac35ff17SAlexander V. Chernikov struct _ipfw_obj_header *oh; 1150ac35ff17SAlexander V. Chernikov struct tid_info ti; 1151ac35ff17SAlexander V. Chernikov 1152ac35ff17SAlexander V. Chernikov if (sd->valsize != sizeof(*oh)) 1153ac35ff17SAlexander V. Chernikov return (EINVAL); 1154ac35ff17SAlexander V. Chernikov 1155ac35ff17SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)op3; 1156ac35ff17SAlexander V. Chernikov objheader_to_ti(oh, &ti); 1157ac35ff17SAlexander V. Chernikov 11581832a7b3SAlexander V. Chernikov if (op3->opcode == IP_FW_TABLE_XDESTROY) 1159ac35ff17SAlexander V. Chernikov error = destroy_table(ch, &ti); 11601832a7b3SAlexander V. Chernikov else if (op3->opcode == IP_FW_TABLE_XFLUSH) 1161ac35ff17SAlexander V. Chernikov error = flush_table(ch, &ti); 1162ac35ff17SAlexander V. Chernikov else 1163ac35ff17SAlexander V. Chernikov return (ENOTSUP); 1164ac35ff17SAlexander V. Chernikov 1165ac35ff17SAlexander V. Chernikov return (error); 11663b3a8eb9SGleb Smirnoff } 11673b3a8eb9SGleb Smirnoff 1168fb4b37a3SAlexander V. Chernikov static void 1169fb4b37a3SAlexander V. Chernikov restart_flush(void *object, struct op_state *_state) 1170fb4b37a3SAlexander V. Chernikov { 1171fb4b37a3SAlexander V. Chernikov struct tableop_state *ts; 1172fb4b37a3SAlexander V. Chernikov 1173fb4b37a3SAlexander V. Chernikov ts = (struct tableop_state *)_state; 1174fb4b37a3SAlexander V. Chernikov 1175fb4b37a3SAlexander V. Chernikov if (ts->tc != object) 1176fb4b37a3SAlexander V. Chernikov return; 1177fb4b37a3SAlexander V. Chernikov 1178fb4b37a3SAlexander V. Chernikov /* Indicate we've called */ 1179fb4b37a3SAlexander V. Chernikov ts->modified = 1; 1180fb4b37a3SAlexander V. Chernikov } 1181fb4b37a3SAlexander V. Chernikov 118235e1bbd0SAlexander V. Chernikov /* 118335e1bbd0SAlexander V. Chernikov * Flushes given table. 118435e1bbd0SAlexander V. Chernikov * 118535e1bbd0SAlexander V. Chernikov * Function create new table instance with the same 118635e1bbd0SAlexander V. Chernikov * parameters, swaps it with old one and 1187fb4b37a3SAlexander V. Chernikov * flushes state without holding runtime WLOCK. 118835e1bbd0SAlexander V. Chernikov * 118935e1bbd0SAlexander V. Chernikov * Returns 0 on success. 119035e1bbd0SAlexander V. Chernikov */ 11911832a7b3SAlexander V. Chernikov int 1192ac35ff17SAlexander V. Chernikov flush_table(struct ip_fw_chain *ch, struct tid_info *ti) 11933b3a8eb9SGleb Smirnoff { 1194b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 1195b074b7bbSAlexander V. Chernikov struct table_config *tc; 11969f7d47b0SAlexander V. Chernikov struct table_algo *ta; 11979f7d47b0SAlexander V. Chernikov struct table_info ti_old, ti_new, *tablestate; 11989f7d47b0SAlexander V. Chernikov void *astate_old, *astate_new; 1199914bffb6SAlexander V. Chernikov char algostate[64], *pstate; 1200fb4b37a3SAlexander V. Chernikov struct tableop_state ts; 1201b074b7bbSAlexander V. Chernikov int error; 1202b074b7bbSAlexander V. Chernikov uint16_t kidx; 1203914bffb6SAlexander V. Chernikov uint8_t tflags; 12043b3a8eb9SGleb Smirnoff 12053b3a8eb9SGleb Smirnoff /* 12069f7d47b0SAlexander V. Chernikov * Stage 1: save table algoritm. 1207b074b7bbSAlexander V. Chernikov * Reference found table to ensure it won't disappear. 12083b3a8eb9SGleb Smirnoff */ 1209b074b7bbSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1210b074b7bbSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1211b074b7bbSAlexander V. Chernikov if ((tc = find_table(ni, ti)) == NULL) { 1212b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1213b074b7bbSAlexander V. Chernikov return (ESRCH); 1214b074b7bbSAlexander V. Chernikov } 1215fb4b37a3SAlexander V. Chernikov restart: 1216fb4b37a3SAlexander V. Chernikov /* Set up swap handler */ 1217fb4b37a3SAlexander V. Chernikov memset(&ts, 0, sizeof(ts)); 1218fb4b37a3SAlexander V. Chernikov ts.opstate.func = restart_flush; 1219fb4b37a3SAlexander V. Chernikov ts.tc = tc; 1220fb4b37a3SAlexander V. Chernikov 12219f7d47b0SAlexander V. Chernikov ta = tc->ta; 1222fd0869d5SAlexander V. Chernikov /* Do not flush readonly tables */ 1223fd0869d5SAlexander V. Chernikov if ((ta->flags & TA_FLAG_READONLY) != 0) { 1224fd0869d5SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1225fd0869d5SAlexander V. Chernikov return (EACCES); 1226fd0869d5SAlexander V. Chernikov } 122735e1bbd0SAlexander V. Chernikov /* Save startup algo parameters */ 1228daabb523SAlexander V. Chernikov if (ta->print_config != NULL) { 1229daabb523SAlexander V. Chernikov ta->print_config(tc->astate, KIDX_TO_TI(ch, tc->no.kidx), 1230daabb523SAlexander V. Chernikov algostate, sizeof(algostate)); 1231daabb523SAlexander V. Chernikov pstate = algostate; 1232daabb523SAlexander V. Chernikov } else 1233daabb523SAlexander V. Chernikov pstate = NULL; 1234914bffb6SAlexander V. Chernikov tflags = tc->tflags; 1235fb4b37a3SAlexander V. Chernikov tc->no.refcnt++; 1236fb4b37a3SAlexander V. Chernikov add_toperation_state(ch, &ts); 1237b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 12383b3a8eb9SGleb Smirnoff 1239b074b7bbSAlexander V. Chernikov /* 12409f7d47b0SAlexander V. Chernikov * Stage 2: allocate new table instance using same algo. 1241b074b7bbSAlexander V. Chernikov */ 12429f7d47b0SAlexander V. Chernikov memset(&ti_new, 0, sizeof(struct table_info)); 1243fb4b37a3SAlexander V. Chernikov error = ta->init(ch, &astate_new, &ti_new, pstate, tflags); 1244b074b7bbSAlexander V. Chernikov 1245b074b7bbSAlexander V. Chernikov /* 1246b074b7bbSAlexander V. Chernikov * Stage 3: swap old state pointers with newly-allocated ones. 1247b074b7bbSAlexander V. Chernikov * Decrease refcount. 1248b074b7bbSAlexander V. Chernikov */ 1249b074b7bbSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1250fb4b37a3SAlexander V. Chernikov tc->no.refcnt--; 1251fb4b37a3SAlexander V. Chernikov del_toperation_state(ch, &ts); 1252fb4b37a3SAlexander V. Chernikov 1253fb4b37a3SAlexander V. Chernikov if (error != 0) { 1254fb4b37a3SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1255fb4b37a3SAlexander V. Chernikov return (error); 1256fb4b37a3SAlexander V. Chernikov } 1257fb4b37a3SAlexander V. Chernikov 1258fb4b37a3SAlexander V. Chernikov /* 1259fb4b37a3SAlexander V. Chernikov * Restart operation if table swap has happened: 1260fb4b37a3SAlexander V. Chernikov * even if algo may be the same, algo init parameters 1261fb4b37a3SAlexander V. Chernikov * may change. Restart operation instead of doing 1262fb4b37a3SAlexander V. Chernikov * complex checks. 1263fb4b37a3SAlexander V. Chernikov */ 1264fb4b37a3SAlexander V. Chernikov if (ts.modified != 0) { 1265fb4b37a3SAlexander V. Chernikov ta->destroy(astate_new, &ti_new); 1266fb4b37a3SAlexander V. Chernikov goto restart; 1267fb4b37a3SAlexander V. Chernikov } 1268b074b7bbSAlexander V. Chernikov 1269b074b7bbSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1270b074b7bbSAlexander V. Chernikov kidx = tc->no.kidx; 12719f7d47b0SAlexander V. Chernikov tablestate = (struct table_info *)ch->tablestate; 1272b074b7bbSAlexander V. Chernikov 12739f7d47b0SAlexander V. Chernikov IPFW_WLOCK(ch); 12749f7d47b0SAlexander V. Chernikov ti_old = tablestate[kidx]; 12759f7d47b0SAlexander V. Chernikov tablestate[kidx] = ti_new; 12769f7d47b0SAlexander V. Chernikov IPFW_WUNLOCK(ch); 1277b074b7bbSAlexander V. Chernikov 12789f7d47b0SAlexander V. Chernikov astate_old = tc->astate; 12799f7d47b0SAlexander V. Chernikov tc->astate = astate_new; 12809f7d47b0SAlexander V. Chernikov tc->ti = ti_new; 12819f7d47b0SAlexander V. Chernikov tc->count = 0; 1282b074b7bbSAlexander V. Chernikov 12830cba2b28SAlexander V. Chernikov /* 12840cba2b28SAlexander V. Chernikov * Stage 4: unref values. 12850cba2b28SAlexander V. Chernikov */ 12860cba2b28SAlexander V. Chernikov ipfw_unref_table_values(ch, tc, ta, astate_old, &ti_old); 1287b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 12883b3a8eb9SGleb Smirnoff 1289b074b7bbSAlexander V. Chernikov /* 12900cba2b28SAlexander V. Chernikov * Stage 5: perform real flush/destroy. 1291b074b7bbSAlexander V. Chernikov */ 12929f7d47b0SAlexander V. Chernikov ta->destroy(astate_old, &ti_old); 12933b3a8eb9SGleb Smirnoff 12943b3a8eb9SGleb Smirnoff return (0); 12953b3a8eb9SGleb Smirnoff } 12963b3a8eb9SGleb Smirnoff 1297b074b7bbSAlexander V. Chernikov /* 129846d52008SAlexander V. Chernikov * Swaps two tables. 129946d52008SAlexander V. Chernikov * Data layout (v0)(current): 130046d52008SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_obj_ntlv ] 130146d52008SAlexander V. Chernikov * 130246d52008SAlexander V. Chernikov * Returns 0 on success 130346d52008SAlexander V. Chernikov */ 13046b988f3aSAlexander V. Chernikov static int 13056b988f3aSAlexander V. Chernikov swap_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 130646d52008SAlexander V. Chernikov struct sockopt_data *sd) 130746d52008SAlexander V. Chernikov { 130846d52008SAlexander V. Chernikov int error; 130946d52008SAlexander V. Chernikov struct _ipfw_obj_header *oh; 131046d52008SAlexander V. Chernikov struct tid_info ti_a, ti_b; 131146d52008SAlexander V. Chernikov 131246d52008SAlexander V. Chernikov if (sd->valsize != sizeof(*oh) + sizeof(ipfw_obj_ntlv)) 131346d52008SAlexander V. Chernikov return (EINVAL); 131446d52008SAlexander V. Chernikov 131546d52008SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)op3; 131646d52008SAlexander V. Chernikov ntlv_to_ti(&oh->ntlv, &ti_a); 131746d52008SAlexander V. Chernikov ntlv_to_ti((ipfw_obj_ntlv *)(oh + 1), &ti_b); 131846d52008SAlexander V. Chernikov 1319a73d728dSAlexander V. Chernikov error = swap_tables(ch, &ti_a, &ti_b); 132046d52008SAlexander V. Chernikov 132146d52008SAlexander V. Chernikov return (error); 132246d52008SAlexander V. Chernikov } 132346d52008SAlexander V. Chernikov 132435e1bbd0SAlexander V. Chernikov /* 132535e1bbd0SAlexander V. Chernikov * Swaps two tables of the same type/valtype. 132635e1bbd0SAlexander V. Chernikov * 132735e1bbd0SAlexander V. Chernikov * Checks if tables are compatible and limits 1328c8d5d308SAlexander V. Chernikov * permits swap, than actually perform swap. 132935e1bbd0SAlexander V. Chernikov * 1330c8d5d308SAlexander V. Chernikov * Each table consists of 2 different parts: 1331c8d5d308SAlexander V. Chernikov * config: 1332c8d5d308SAlexander V. Chernikov * @tc (with name, set, kidx) and rule bindings, which is "stable". 1333c8d5d308SAlexander V. Chernikov * number of items 1334c8d5d308SAlexander V. Chernikov * table algo 1335c8d5d308SAlexander V. Chernikov * runtime: 1336c8d5d308SAlexander V. Chernikov * runtime data @ti (ch->tablestate) 1337c8d5d308SAlexander V. Chernikov * runtime cache in @tc 1338c8d5d308SAlexander V. Chernikov * algo-specific data (@tc->astate) 1339c8d5d308SAlexander V. Chernikov * 1340c8d5d308SAlexander V. Chernikov * So we switch: 1341c8d5d308SAlexander V. Chernikov * all runtime data 1342c8d5d308SAlexander V. Chernikov * number of items 1343c8d5d308SAlexander V. Chernikov * table algo 1344c8d5d308SAlexander V. Chernikov * 1345c8d5d308SAlexander V. Chernikov * After that we call @ti change handler for each table. 1346c8d5d308SAlexander V. Chernikov * 1347c8d5d308SAlexander V. Chernikov * Note that referencing @tc won't protect tc->ta from change. 1348c8d5d308SAlexander V. Chernikov * XXX: Do we need to restrict swap between locked tables? 1349c8d5d308SAlexander V. Chernikov * XXX: Do we need to exchange ftype? 135035e1bbd0SAlexander V. Chernikov * 135135e1bbd0SAlexander V. Chernikov * Returns 0 on success. 135235e1bbd0SAlexander V. Chernikov */ 135346d52008SAlexander V. Chernikov static int 1354a73d728dSAlexander V. Chernikov swap_tables(struct ip_fw_chain *ch, struct tid_info *a, 135546d52008SAlexander V. Chernikov struct tid_info *b) 135646d52008SAlexander V. Chernikov { 135746d52008SAlexander V. Chernikov struct namedobj_instance *ni; 135846d52008SAlexander V. Chernikov struct table_config *tc_a, *tc_b; 135946d52008SAlexander V. Chernikov struct table_algo *ta; 136046d52008SAlexander V. Chernikov struct table_info ti, *tablestate; 136146d52008SAlexander V. Chernikov void *astate; 136246d52008SAlexander V. Chernikov uint32_t count; 136346d52008SAlexander V. Chernikov 136446d52008SAlexander V. Chernikov /* 136546d52008SAlexander V. Chernikov * Stage 1: find both tables and ensure they are of 136635e1bbd0SAlexander V. Chernikov * the same type. 136746d52008SAlexander V. Chernikov */ 136846d52008SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 136946d52008SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 137046d52008SAlexander V. Chernikov if ((tc_a = find_table(ni, a)) == NULL) { 137146d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 137246d52008SAlexander V. Chernikov return (ESRCH); 137346d52008SAlexander V. Chernikov } 137446d52008SAlexander V. Chernikov if ((tc_b = find_table(ni, b)) == NULL) { 137546d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 137646d52008SAlexander V. Chernikov return (ESRCH); 137746d52008SAlexander V. Chernikov } 137846d52008SAlexander V. Chernikov 137946d52008SAlexander V. Chernikov /* It is very easy to swap between the same table */ 138046d52008SAlexander V. Chernikov if (tc_a == tc_b) { 138146d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 138246d52008SAlexander V. Chernikov return (0); 138346d52008SAlexander V. Chernikov } 138446d52008SAlexander V. Chernikov 138546d52008SAlexander V. Chernikov /* Check type and value are the same */ 13860cba2b28SAlexander V. Chernikov if (tc_a->no.type != tc_b->no.type || tc_a->tflags != tc_b->tflags) { 138746d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 138846d52008SAlexander V. Chernikov return (EINVAL); 138946d52008SAlexander V. Chernikov } 139046d52008SAlexander V. Chernikov 139146d52008SAlexander V. Chernikov /* Check limits before swap */ 139246d52008SAlexander V. Chernikov if ((tc_a->limit != 0 && tc_b->count > tc_a->limit) || 139346d52008SAlexander V. Chernikov (tc_b->limit != 0 && tc_a->count > tc_b->limit)) { 139446d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 139546d52008SAlexander V. Chernikov return (EFBIG); 139646d52008SAlexander V. Chernikov } 139746d52008SAlexander V. Chernikov 1398fd0869d5SAlexander V. Chernikov /* Check if one of the tables is readonly */ 1399fd0869d5SAlexander V. Chernikov if (((tc_a->ta->flags | tc_b->ta->flags) & TA_FLAG_READONLY) != 0) { 1400fd0869d5SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1401fd0869d5SAlexander V. Chernikov return (EACCES); 1402fd0869d5SAlexander V. Chernikov } 1403fd0869d5SAlexander V. Chernikov 14040cba2b28SAlexander V. Chernikov /* Notify we're going to swap */ 14050cba2b28SAlexander V. Chernikov rollback_toperation_state(ch, tc_a); 14060cba2b28SAlexander V. Chernikov rollback_toperation_state(ch, tc_b); 14070cba2b28SAlexander V. Chernikov 140846d52008SAlexander V. Chernikov /* Everything is fine, prepare to swap */ 140946d52008SAlexander V. Chernikov tablestate = (struct table_info *)ch->tablestate; 141046d52008SAlexander V. Chernikov ti = tablestate[tc_a->no.kidx]; 141146d52008SAlexander V. Chernikov ta = tc_a->ta; 141246d52008SAlexander V. Chernikov astate = tc_a->astate; 141346d52008SAlexander V. Chernikov count = tc_a->count; 141446d52008SAlexander V. Chernikov 141546d52008SAlexander V. Chernikov IPFW_WLOCK(ch); 141646d52008SAlexander V. Chernikov /* a <- b */ 141746d52008SAlexander V. Chernikov tablestate[tc_a->no.kidx] = tablestate[tc_b->no.kidx]; 141846d52008SAlexander V. Chernikov tc_a->ta = tc_b->ta; 141946d52008SAlexander V. Chernikov tc_a->astate = tc_b->astate; 142046d52008SAlexander V. Chernikov tc_a->count = tc_b->count; 142146d52008SAlexander V. Chernikov /* b <- a */ 142246d52008SAlexander V. Chernikov tablestate[tc_b->no.kidx] = ti; 142346d52008SAlexander V. Chernikov tc_b->ta = ta; 142446d52008SAlexander V. Chernikov tc_b->astate = astate; 142546d52008SAlexander V. Chernikov tc_b->count = count; 142646d52008SAlexander V. Chernikov IPFW_WUNLOCK(ch); 142746d52008SAlexander V. Chernikov 142846d52008SAlexander V. Chernikov /* Ensure tc.ti copies are in sync */ 142946d52008SAlexander V. Chernikov tc_a->ti = tablestate[tc_a->no.kidx]; 143046d52008SAlexander V. Chernikov tc_b->ti = tablestate[tc_b->no.kidx]; 143146d52008SAlexander V. Chernikov 143246d52008SAlexander V. Chernikov /* Notify both tables on @ti change */ 143346d52008SAlexander V. Chernikov if (tc_a->ta->change_ti != NULL) 143446d52008SAlexander V. Chernikov tc_a->ta->change_ti(tc_a->astate, &tablestate[tc_a->no.kidx]); 143546d52008SAlexander V. Chernikov if (tc_b->ta->change_ti != NULL) 143646d52008SAlexander V. Chernikov tc_b->ta->change_ti(tc_b->astate, &tablestate[tc_b->no.kidx]); 143746d52008SAlexander V. Chernikov 143846d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 143946d52008SAlexander V. Chernikov 144046d52008SAlexander V. Chernikov return (0); 144146d52008SAlexander V. Chernikov } 144246d52008SAlexander V. Chernikov 144346d52008SAlexander V. Chernikov /* 14449f7d47b0SAlexander V. Chernikov * Destroys table specified by @ti. 1445ac35ff17SAlexander V. Chernikov * Data layout (v0)(current): 1446ac35ff17SAlexander V. Chernikov * Request: [ ip_fw3_opheader ] 1447ac35ff17SAlexander V. Chernikov * 1448ac35ff17SAlexander V. Chernikov * Returns 0 on success 1449b074b7bbSAlexander V. Chernikov */ 1450ac35ff17SAlexander V. Chernikov static int 1451ac35ff17SAlexander V. Chernikov destroy_table(struct ip_fw_chain *ch, struct tid_info *ti) 1452b074b7bbSAlexander V. Chernikov { 1453b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 1454b074b7bbSAlexander V. Chernikov struct table_config *tc; 1455b074b7bbSAlexander V. Chernikov 1456b074b7bbSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1457b074b7bbSAlexander V. Chernikov 1458b074b7bbSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1459b074b7bbSAlexander V. Chernikov if ((tc = find_table(ni, ti)) == NULL) { 1460b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1461b074b7bbSAlexander V. Chernikov return (ESRCH); 1462b074b7bbSAlexander V. Chernikov } 1463b074b7bbSAlexander V. Chernikov 14649f7d47b0SAlexander V. Chernikov /* Do not permit destroying referenced tables */ 14659f7d47b0SAlexander V. Chernikov if (tc->no.refcnt > 0) { 1466b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1467b074b7bbSAlexander V. Chernikov return (EBUSY); 1468b074b7bbSAlexander V. Chernikov } 1469b074b7bbSAlexander V. Chernikov 1470b074b7bbSAlexander V. Chernikov IPFW_WLOCK(ch); 1471b074b7bbSAlexander V. Chernikov unlink_table(ch, tc); 1472b074b7bbSAlexander V. Chernikov IPFW_WUNLOCK(ch); 1473b074b7bbSAlexander V. Chernikov 1474b074b7bbSAlexander V. Chernikov /* Free obj index */ 1475ac35ff17SAlexander V. Chernikov if (ipfw_objhash_free_idx(ni, tc->no.kidx) != 0) 1476b074b7bbSAlexander V. Chernikov printf("Error unlinking kidx %d from table %s\n", 1477b074b7bbSAlexander V. Chernikov tc->no.kidx, tc->tablename); 1478b074b7bbSAlexander V. Chernikov 14790cba2b28SAlexander V. Chernikov /* Unref values used in tables while holding UH lock */ 14800cba2b28SAlexander V. Chernikov ipfw_unref_table_values(ch, tc, tc->ta, tc->astate, 14810cba2b28SAlexander V. Chernikov &((struct table_info *)ch->tablestate)[tc->no.kidx]); 1482b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1483b074b7bbSAlexander V. Chernikov 1484b074b7bbSAlexander V. Chernikov free_table_config(ni, tc); 1485b074b7bbSAlexander V. Chernikov 1486b074b7bbSAlexander V. Chernikov return (0); 1487b074b7bbSAlexander V. Chernikov } 1488b074b7bbSAlexander V. Chernikov 148935e1bbd0SAlexander V. Chernikov /* 149035e1bbd0SAlexander V. Chernikov * Grow tables index. 149135e1bbd0SAlexander V. Chernikov * 149235e1bbd0SAlexander V. Chernikov * Returns 0 on success. 149335e1bbd0SAlexander V. Chernikov */ 14943b3a8eb9SGleb Smirnoff int 14953b3a8eb9SGleb Smirnoff ipfw_resize_tables(struct ip_fw_chain *ch, unsigned int ntables) 14963b3a8eb9SGleb Smirnoff { 14973b3a8eb9SGleb Smirnoff unsigned int ntables_old, tbl; 1498b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 14999f7d47b0SAlexander V. Chernikov void *new_idx, *old_tablestate, *tablestate; 150068394ec8SAlexander V. Chernikov struct table_info *ti; 150168394ec8SAlexander V. Chernikov struct table_config *tc; 150268394ec8SAlexander V. Chernikov int i, new_blocks; 15033b3a8eb9SGleb Smirnoff 15043b3a8eb9SGleb Smirnoff /* Check new value for validity */ 15053b3a8eb9SGleb Smirnoff if (ntables > IPFW_TABLES_MAX) 15063b3a8eb9SGleb Smirnoff ntables = IPFW_TABLES_MAX; 15073b3a8eb9SGleb Smirnoff 15083b3a8eb9SGleb Smirnoff /* Allocate new pointers */ 15099f7d47b0SAlexander V. Chernikov tablestate = malloc(ntables * sizeof(struct table_info), 15109f7d47b0SAlexander V. Chernikov M_IPFW, M_WAITOK | M_ZERO); 15119f7d47b0SAlexander V. Chernikov 1512b074b7bbSAlexander V. Chernikov ipfw_objhash_bitmap_alloc(ntables, (void *)&new_idx, &new_blocks); 15133b3a8eb9SGleb Smirnoff 15149f7d47b0SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 15153b3a8eb9SGleb Smirnoff 15163b3a8eb9SGleb Smirnoff tbl = (ntables >= V_fw_tables_max) ? V_fw_tables_max : ntables; 1517b074b7bbSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1518b074b7bbSAlexander V. Chernikov 15199f7d47b0SAlexander V. Chernikov /* Temporary restrict decreasing max_tables */ 15209f7d47b0SAlexander V. Chernikov if (ntables < V_fw_tables_max) { 15219f7d47b0SAlexander V. Chernikov 15229f7d47b0SAlexander V. Chernikov /* 15239f7d47b0SAlexander V. Chernikov * FIXME: Check if we really can shrink 15249f7d47b0SAlexander V. Chernikov */ 15259f7d47b0SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1526b074b7bbSAlexander V. Chernikov return (EINVAL); 1527b074b7bbSAlexander V. Chernikov } 15283b3a8eb9SGleb Smirnoff 15299f7d47b0SAlexander V. Chernikov /* Copy table info/indices */ 15309f7d47b0SAlexander V. Chernikov memcpy(tablestate, ch->tablestate, sizeof(struct table_info) * tbl); 15319f7d47b0SAlexander V. Chernikov ipfw_objhash_bitmap_merge(ni, &new_idx, &new_blocks); 15323b3a8eb9SGleb Smirnoff 15339f7d47b0SAlexander V. Chernikov IPFW_WLOCK(ch); 15349f7d47b0SAlexander V. Chernikov 15359f7d47b0SAlexander V. Chernikov /* Change pointers */ 15369f7d47b0SAlexander V. Chernikov old_tablestate = ch->tablestate; 15379f7d47b0SAlexander V. Chernikov ch->tablestate = tablestate; 15389f7d47b0SAlexander V. Chernikov ipfw_objhash_bitmap_swap(ni, &new_idx, &new_blocks); 15393b3a8eb9SGleb Smirnoff 15403b3a8eb9SGleb Smirnoff ntables_old = V_fw_tables_max; 15413b3a8eb9SGleb Smirnoff V_fw_tables_max = ntables; 15423b3a8eb9SGleb Smirnoff 15433b3a8eb9SGleb Smirnoff IPFW_WUNLOCK(ch); 154468394ec8SAlexander V. Chernikov 154568394ec8SAlexander V. Chernikov /* Notify all consumers that their @ti pointer has changed */ 154668394ec8SAlexander V. Chernikov ti = (struct table_info *)ch->tablestate; 154768394ec8SAlexander V. Chernikov for (i = 0; i < tbl; i++, ti++) { 154868394ec8SAlexander V. Chernikov if (ti->lookup == NULL) 154968394ec8SAlexander V. Chernikov continue; 155068394ec8SAlexander V. Chernikov tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, i); 155168394ec8SAlexander V. Chernikov if (tc == NULL || tc->ta->change_ti == NULL) 155268394ec8SAlexander V. Chernikov continue; 155368394ec8SAlexander V. Chernikov 155468394ec8SAlexander V. Chernikov tc->ta->change_ti(tc->astate, ti); 155568394ec8SAlexander V. Chernikov } 155668394ec8SAlexander V. Chernikov 15579f7d47b0SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 15583b3a8eb9SGleb Smirnoff 15593b3a8eb9SGleb Smirnoff /* Free old pointers */ 15609f7d47b0SAlexander V. Chernikov free(old_tablestate, M_IPFW); 1561b074b7bbSAlexander V. Chernikov ipfw_objhash_bitmap_free(new_idx, new_blocks); 15623b3a8eb9SGleb Smirnoff 15633b3a8eb9SGleb Smirnoff return (0); 15643b3a8eb9SGleb Smirnoff } 15653b3a8eb9SGleb Smirnoff 1566a73d728dSAlexander V. Chernikov /* 156735e1bbd0SAlexander V. Chernikov * Switch between "set 0" and "rule's set" table binding, 1568a73d728dSAlexander V. Chernikov * Check all ruleset bindings and permits changing 1569a73d728dSAlexander V. Chernikov * IFF each binding has both rule AND table in default set (set 0). 1570a73d728dSAlexander V. Chernikov * 1571a73d728dSAlexander V. Chernikov * Returns 0 on success. 1572a73d728dSAlexander V. Chernikov */ 1573a73d728dSAlexander V. Chernikov int 1574a73d728dSAlexander V. Chernikov ipfw_switch_tables_namespace(struct ip_fw_chain *ch, unsigned int sets) 1575a73d728dSAlexander V. Chernikov { 1576a73d728dSAlexander V. Chernikov struct namedobj_instance *ni; 1577a73d728dSAlexander V. Chernikov struct named_object *no; 1578a73d728dSAlexander V. Chernikov struct ip_fw *rule; 1579a73d728dSAlexander V. Chernikov ipfw_insn *cmd; 1580a73d728dSAlexander V. Chernikov int cmdlen, i, l; 1581a73d728dSAlexander V. Chernikov uint16_t kidx; 1582a73d728dSAlexander V. Chernikov uint8_t type; 1583a73d728dSAlexander V. Chernikov 1584a73d728dSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1585a73d728dSAlexander V. Chernikov 1586a73d728dSAlexander V. Chernikov if (V_fw_tables_sets == sets) { 1587a73d728dSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1588a73d728dSAlexander V. Chernikov return (0); 1589a73d728dSAlexander V. Chernikov } 1590a73d728dSAlexander V. Chernikov 1591a73d728dSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1592a73d728dSAlexander V. Chernikov 159335e1bbd0SAlexander V. Chernikov /* 159435e1bbd0SAlexander V. Chernikov * Scan all rules and examine tables opcodes. 159535e1bbd0SAlexander V. Chernikov */ 1596a73d728dSAlexander V. Chernikov for (i = 0; i < ch->n_rules; i++) { 1597a73d728dSAlexander V. Chernikov rule = ch->map[i]; 1598a73d728dSAlexander V. Chernikov 1599a73d728dSAlexander V. Chernikov l = rule->cmd_len; 1600a73d728dSAlexander V. Chernikov cmd = rule->cmd; 1601a73d728dSAlexander V. Chernikov cmdlen = 0; 1602a73d728dSAlexander V. Chernikov for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 1603a73d728dSAlexander V. Chernikov cmdlen = F_LEN(cmd); 1604a73d728dSAlexander V. Chernikov 1605a73d728dSAlexander V. Chernikov if (classify_table_opcode(cmd, &kidx, &type) != 0) 1606a73d728dSAlexander V. Chernikov continue; 1607a73d728dSAlexander V. Chernikov 1608a73d728dSAlexander V. Chernikov no = ipfw_objhash_lookup_kidx(ni, kidx); 1609a73d728dSAlexander V. Chernikov 161035e1bbd0SAlexander V. Chernikov /* Check if both table object and rule has the set 0 */ 1611a73d728dSAlexander V. Chernikov if (no->set != 0 || rule->set != 0) { 1612a73d728dSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1613a73d728dSAlexander V. Chernikov return (EBUSY); 1614a73d728dSAlexander V. Chernikov } 1615a73d728dSAlexander V. Chernikov 1616a73d728dSAlexander V. Chernikov } 1617a73d728dSAlexander V. Chernikov } 1618a73d728dSAlexander V. Chernikov V_fw_tables_sets = sets; 1619a73d728dSAlexander V. Chernikov 1620a73d728dSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1621a73d728dSAlexander V. Chernikov 1622a73d728dSAlexander V. Chernikov return (0); 1623a73d728dSAlexander V. Chernikov } 1624a73d728dSAlexander V. Chernikov 1625c8d5d308SAlexander V. Chernikov /* 1626c8d5d308SAlexander V. Chernikov * Lookup an IP @addr in table @tbl. 1627c8d5d308SAlexander V. Chernikov * Stores found value in @val. 1628c8d5d308SAlexander V. Chernikov * 1629c8d5d308SAlexander V. Chernikov * Returns 1 if @addr was found. 1630c8d5d308SAlexander V. Chernikov */ 16313b3a8eb9SGleb Smirnoff int 16323b3a8eb9SGleb Smirnoff ipfw_lookup_table(struct ip_fw_chain *ch, uint16_t tbl, in_addr_t addr, 16333b3a8eb9SGleb Smirnoff uint32_t *val) 16343b3a8eb9SGleb Smirnoff { 16359f7d47b0SAlexander V. Chernikov struct table_info *ti; 16363b3a8eb9SGleb Smirnoff 1637c8d5d308SAlexander V. Chernikov ti = KIDX_TO_TI(ch, tbl); 16389f7d47b0SAlexander V. Chernikov 16399f7d47b0SAlexander V. Chernikov return (ti->lookup(ti, &addr, sizeof(in_addr_t), val)); 16403b3a8eb9SGleb Smirnoff } 16419f7d47b0SAlexander V. Chernikov 1642c8d5d308SAlexander V. Chernikov /* 1643c8d5d308SAlexander V. Chernikov * Lookup an arbtrary key @paddr of legth @plen in table @tbl. 1644c8d5d308SAlexander V. Chernikov * Stores found value in @val. 1645c8d5d308SAlexander V. Chernikov * 1646c8d5d308SAlexander V. Chernikov * Returns 1 if key was found. 1647c8d5d308SAlexander V. Chernikov */ 16489f7d47b0SAlexander V. Chernikov int 16499f7d47b0SAlexander V. Chernikov ipfw_lookup_table_extended(struct ip_fw_chain *ch, uint16_t tbl, uint16_t plen, 16509f7d47b0SAlexander V. Chernikov void *paddr, uint32_t *val) 16519f7d47b0SAlexander V. Chernikov { 16529f7d47b0SAlexander V. Chernikov struct table_info *ti; 16539f7d47b0SAlexander V. Chernikov 1654c8d5d308SAlexander V. Chernikov ti = KIDX_TO_TI(ch, tbl); 16559f7d47b0SAlexander V. Chernikov 16569f7d47b0SAlexander V. Chernikov return (ti->lookup(ti, paddr, plen, val)); 16579f7d47b0SAlexander V. Chernikov } 16589f7d47b0SAlexander V. Chernikov 16599f7d47b0SAlexander V. Chernikov /* 16609f7d47b0SAlexander V. Chernikov * Info/List/dump support for tables. 16619f7d47b0SAlexander V. Chernikov * 16629f7d47b0SAlexander V. Chernikov */ 16639f7d47b0SAlexander V. Chernikov 1664f1220db8SAlexander V. Chernikov /* 1665d3a4f924SAlexander V. Chernikov * High-level 'get' cmds sysctl handlers 1666d3a4f924SAlexander V. Chernikov */ 1667d3a4f924SAlexander V. Chernikov 1668d3a4f924SAlexander V. Chernikov /* 1669d3a4f924SAlexander V. Chernikov * Lists all tables currently available in kernel. 1670ac35ff17SAlexander V. Chernikov * Data layout (v0)(current): 1671d3a4f924SAlexander V. Chernikov * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size 1672d3a4f924SAlexander V. Chernikov * Reply: [ ipfw_obj_lheader ipfw_xtable_info x N ] 1673d3a4f924SAlexander V. Chernikov * 1674d3a4f924SAlexander V. Chernikov * Returns 0 on success 1675d3a4f924SAlexander V. Chernikov */ 16766b988f3aSAlexander V. Chernikov static int 16776b988f3aSAlexander V. Chernikov list_tables(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1678e822d936SAlexander V. Chernikov struct sockopt_data *sd) 1679f1220db8SAlexander V. Chernikov { 1680f1220db8SAlexander V. Chernikov struct _ipfw_obj_lheader *olh; 1681f1220db8SAlexander V. Chernikov int error; 1682f1220db8SAlexander V. Chernikov 16832d99a349SAlexander V. Chernikov olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh)); 16842d99a349SAlexander V. Chernikov if (olh == NULL) 1685d3a4f924SAlexander V. Chernikov return (EINVAL); 168668394ec8SAlexander V. Chernikov if (sd->valsize < olh->size) 168768394ec8SAlexander V. Chernikov return (EINVAL); 1688d3a4f924SAlexander V. Chernikov 1689f1220db8SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 16902d99a349SAlexander V. Chernikov error = export_tables(ch, olh, sd); 1691f1220db8SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 1692f1220db8SAlexander V. Chernikov 1693f1220db8SAlexander V. Chernikov return (error); 1694f1220db8SAlexander V. Chernikov } 1695f1220db8SAlexander V. Chernikov 1696f1220db8SAlexander V. Chernikov /* 16972d99a349SAlexander V. Chernikov * Store table info to buffer provided by @sd. 1698ac35ff17SAlexander V. Chernikov * Data layout (v0)(current): 1699d3a4f924SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_xtable_info(empty)] 1700d3a4f924SAlexander V. Chernikov * Reply: [ ipfw_obj_header ipfw_xtable_info ] 1701d3a4f924SAlexander V. Chernikov * 1702d3a4f924SAlexander V. Chernikov * Returns 0 on success. 1703d3a4f924SAlexander V. Chernikov */ 17046b988f3aSAlexander V. Chernikov static int 17056b988f3aSAlexander V. Chernikov describe_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1706e822d936SAlexander V. Chernikov struct sockopt_data *sd) 1707d3a4f924SAlexander V. Chernikov { 1708d3a4f924SAlexander V. Chernikov struct _ipfw_obj_header *oh; 1709d3a4f924SAlexander V. Chernikov struct table_config *tc; 1710d3a4f924SAlexander V. Chernikov struct tid_info ti; 1711d3a4f924SAlexander V. Chernikov size_t sz; 1712d3a4f924SAlexander V. Chernikov 1713d3a4f924SAlexander V. Chernikov sz = sizeof(*oh) + sizeof(ipfw_xtable_info); 17142d99a349SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 17152d99a349SAlexander V. Chernikov if (oh == NULL) 1716d3a4f924SAlexander V. Chernikov return (EINVAL); 1717d3a4f924SAlexander V. Chernikov 1718d3a4f924SAlexander V. Chernikov objheader_to_ti(oh, &ti); 1719d3a4f924SAlexander V. Chernikov 1720d3a4f924SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 1721d3a4f924SAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) { 1722d3a4f924SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 1723d3a4f924SAlexander V. Chernikov return (ESRCH); 1724d3a4f924SAlexander V. Chernikov } 1725d3a4f924SAlexander V. Chernikov 1726ac35ff17SAlexander V. Chernikov export_table_info(ch, tc, (ipfw_xtable_info *)(oh + 1)); 1727d3a4f924SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 1728d3a4f924SAlexander V. Chernikov 17292d99a349SAlexander V. Chernikov return (0); 1730d3a4f924SAlexander V. Chernikov } 1731d3a4f924SAlexander V. Chernikov 1732d3a4f924SAlexander V. Chernikov /* 1733adf3b2b9SAlexander V. Chernikov * Modifies existing table. 1734adf3b2b9SAlexander V. Chernikov * Data layout (v0)(current): 1735adf3b2b9SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_xtable_info ] 1736adf3b2b9SAlexander V. Chernikov * 1737adf3b2b9SAlexander V. Chernikov * Returns 0 on success 1738adf3b2b9SAlexander V. Chernikov */ 17396b988f3aSAlexander V. Chernikov static int 17406b988f3aSAlexander V. Chernikov modify_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1741adf3b2b9SAlexander V. Chernikov struct sockopt_data *sd) 1742adf3b2b9SAlexander V. Chernikov { 1743adf3b2b9SAlexander V. Chernikov struct _ipfw_obj_header *oh; 1744adf3b2b9SAlexander V. Chernikov ipfw_xtable_info *i; 1745adf3b2b9SAlexander V. Chernikov char *tname; 1746adf3b2b9SAlexander V. Chernikov struct tid_info ti; 1747adf3b2b9SAlexander V. Chernikov struct namedobj_instance *ni; 1748adf3b2b9SAlexander V. Chernikov struct table_config *tc; 1749adf3b2b9SAlexander V. Chernikov 1750adf3b2b9SAlexander V. Chernikov if (sd->valsize != sizeof(*oh) + sizeof(ipfw_xtable_info)) 1751adf3b2b9SAlexander V. Chernikov return (EINVAL); 1752adf3b2b9SAlexander V. Chernikov 1753adf3b2b9SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)sd->kbuf; 1754adf3b2b9SAlexander V. Chernikov i = (ipfw_xtable_info *)(oh + 1); 1755adf3b2b9SAlexander V. Chernikov 1756adf3b2b9SAlexander V. Chernikov /* 1757adf3b2b9SAlexander V. Chernikov * Verify user-supplied strings. 1758adf3b2b9SAlexander V. Chernikov * Check for null-terminated/zero-length strings/ 1759adf3b2b9SAlexander V. Chernikov */ 1760adf3b2b9SAlexander V. Chernikov tname = oh->ntlv.name; 1761adf3b2b9SAlexander V. Chernikov if (ipfw_check_table_name(tname) != 0) 1762adf3b2b9SAlexander V. Chernikov return (EINVAL); 1763adf3b2b9SAlexander V. Chernikov 1764adf3b2b9SAlexander V. Chernikov objheader_to_ti(oh, &ti); 1765adf3b2b9SAlexander V. Chernikov ti.type = i->type; 1766adf3b2b9SAlexander V. Chernikov 1767adf3b2b9SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1768adf3b2b9SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1769adf3b2b9SAlexander V. Chernikov if ((tc = find_table(ni, &ti)) == NULL) { 1770adf3b2b9SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1771adf3b2b9SAlexander V. Chernikov return (ESRCH); 1772adf3b2b9SAlexander V. Chernikov } 1773fd0869d5SAlexander V. Chernikov 1774fd0869d5SAlexander V. Chernikov /* Do not support any modifications for readonly tables */ 1775fd0869d5SAlexander V. Chernikov if ((tc->ta->flags & TA_FLAG_READONLY) != 0) { 1776fd0869d5SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1777fd0869d5SAlexander V. Chernikov return (EACCES); 1778fd0869d5SAlexander V. Chernikov } 1779fd0869d5SAlexander V. Chernikov 1780adf3b2b9SAlexander V. Chernikov if ((i->mflags & IPFW_TMFLAGS_LIMIT) != 0) 1781adf3b2b9SAlexander V. Chernikov tc->limit = i->limit; 17824f43138aSAlexander V. Chernikov if ((i->mflags & IPFW_TMFLAGS_LOCK) != 0) 17834f43138aSAlexander V. Chernikov tc->locked = ((i->flags & IPFW_TGFLAGS_LOCKED) != 0); 1784adf3b2b9SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1785adf3b2b9SAlexander V. Chernikov 1786adf3b2b9SAlexander V. Chernikov return (0); 1787adf3b2b9SAlexander V. Chernikov } 1788adf3b2b9SAlexander V. Chernikov 1789adf3b2b9SAlexander V. Chernikov /* 17909490a627SAlexander V. Chernikov * Creates new table. 1791ac35ff17SAlexander V. Chernikov * Data layout (v0)(current): 17929490a627SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_xtable_info ] 17939490a627SAlexander V. Chernikov * 17949490a627SAlexander V. Chernikov * Returns 0 on success 17959490a627SAlexander V. Chernikov */ 17966b988f3aSAlexander V. Chernikov static int 17976b988f3aSAlexander V. Chernikov create_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1798ac35ff17SAlexander V. Chernikov struct sockopt_data *sd) 17999490a627SAlexander V. Chernikov { 18009490a627SAlexander V. Chernikov struct _ipfw_obj_header *oh; 18019490a627SAlexander V. Chernikov ipfw_xtable_info *i; 18029490a627SAlexander V. Chernikov char *tname, *aname; 18039490a627SAlexander V. Chernikov struct tid_info ti; 18049490a627SAlexander V. Chernikov struct namedobj_instance *ni; 18059490a627SAlexander V. Chernikov struct table_config *tc; 18069490a627SAlexander V. Chernikov 1807ac35ff17SAlexander V. Chernikov if (sd->valsize != sizeof(*oh) + sizeof(ipfw_xtable_info)) 18089490a627SAlexander V. Chernikov return (EINVAL); 18099490a627SAlexander V. Chernikov 1810ac35ff17SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)sd->kbuf; 18119490a627SAlexander V. Chernikov i = (ipfw_xtable_info *)(oh + 1); 18129490a627SAlexander V. Chernikov 18139490a627SAlexander V. Chernikov /* 18149490a627SAlexander V. Chernikov * Verify user-supplied strings. 18152d99a349SAlexander V. Chernikov * Check for null-terminated/zero-length strings/ 18169490a627SAlexander V. Chernikov */ 1817ac35ff17SAlexander V. Chernikov tname = oh->ntlv.name; 18189490a627SAlexander V. Chernikov aname = i->algoname; 1819ac35ff17SAlexander V. Chernikov if (ipfw_check_table_name(tname) != 0 || 18209490a627SAlexander V. Chernikov strnlen(aname, sizeof(i->algoname)) == sizeof(i->algoname)) 18219490a627SAlexander V. Chernikov return (EINVAL); 18229490a627SAlexander V. Chernikov 18239490a627SAlexander V. Chernikov if (aname[0] == '\0') { 18249490a627SAlexander V. Chernikov /* Use default algorithm */ 18259490a627SAlexander V. Chernikov aname = NULL; 18269490a627SAlexander V. Chernikov } 18279490a627SAlexander V. Chernikov 18289490a627SAlexander V. Chernikov objheader_to_ti(oh, &ti); 1829ac35ff17SAlexander V. Chernikov ti.type = i->type; 18309490a627SAlexander V. Chernikov 18319490a627SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 18329490a627SAlexander V. Chernikov 18339490a627SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 18349490a627SAlexander V. Chernikov if ((tc = find_table(ni, &ti)) != NULL) { 18359490a627SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 18369490a627SAlexander V. Chernikov return (EEXIST); 18379490a627SAlexander V. Chernikov } 18389490a627SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 18399490a627SAlexander V. Chernikov 1840867708f7SAlexander V. Chernikov return (create_table_internal(ch, &ti, aname, i, NULL, 0)); 1841db785d31SAlexander V. Chernikov } 1842db785d31SAlexander V. Chernikov 1843db785d31SAlexander V. Chernikov /* 1844db785d31SAlexander V. Chernikov * Creates new table based on @ti and @aname. 1845db785d31SAlexander V. Chernikov * 1846db785d31SAlexander V. Chernikov * Relies on table name checking inside find_name_tlv() 1847db785d31SAlexander V. Chernikov * Assume @aname to be checked and valid. 1848867708f7SAlexander V. Chernikov * Stores allocated table kidx inside @pkidx (if non-NULL). 18490468c5baSAlexander V. Chernikov * Reference created table if @compat is non-zero. 1850db785d31SAlexander V. Chernikov * 1851db785d31SAlexander V. Chernikov * Returns 0 on success. 1852db785d31SAlexander V. Chernikov */ 1853db785d31SAlexander V. Chernikov static int 1854db785d31SAlexander V. Chernikov create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti, 1855867708f7SAlexander V. Chernikov char *aname, ipfw_xtable_info *i, uint16_t *pkidx, int compat) 1856db785d31SAlexander V. Chernikov { 1857db785d31SAlexander V. Chernikov struct namedobj_instance *ni; 1858c8d5d308SAlexander V. Chernikov struct table_config *tc, *tc_new, *tmp; 1859db785d31SAlexander V. Chernikov struct table_algo *ta; 1860db785d31SAlexander V. Chernikov uint16_t kidx; 1861db785d31SAlexander V. Chernikov 1862db785d31SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1863db785d31SAlexander V. Chernikov 1864db785d31SAlexander V. Chernikov ta = find_table_algo(CHAIN_TO_TCFG(ch), ti, aname); 18659490a627SAlexander V. Chernikov if (ta == NULL) 18669490a627SAlexander V. Chernikov return (ENOTSUP); 18679490a627SAlexander V. Chernikov 18680cba2b28SAlexander V. Chernikov tc = alloc_table_config(ch, ti, ta, aname, i->tflags); 18694c0c07a5SAlexander V. Chernikov if (tc == NULL) 18709490a627SAlexander V. Chernikov return (ENOMEM); 18719490a627SAlexander V. Chernikov 18720cba2b28SAlexander V. Chernikov tc->vmask = i->vmask; 18734c0c07a5SAlexander V. Chernikov tc->limit = i->limit; 1874fd0869d5SAlexander V. Chernikov if (ta->flags & TA_FLAG_READONLY) 1875fd0869d5SAlexander V. Chernikov tc->locked = 1; 1876fd0869d5SAlexander V. Chernikov else 18774f43138aSAlexander V. Chernikov tc->locked = (i->flags & IPFW_TGFLAGS_LOCKED) != 0; 18784c0c07a5SAlexander V. Chernikov 18799490a627SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1880db785d31SAlexander V. Chernikov 1881db785d31SAlexander V. Chernikov /* Check if table has been already created */ 18820468c5baSAlexander V. Chernikov tc_new = find_table(ni, ti); 18830468c5baSAlexander V. Chernikov if (tc_new != NULL) { 18840468c5baSAlexander V. Chernikov 18850468c5baSAlexander V. Chernikov /* 18860468c5baSAlexander V. Chernikov * Compat: do not fail if we're 18870468c5baSAlexander V. Chernikov * requesting to create existing table 18880cba2b28SAlexander V. Chernikov * which has the same type 18890468c5baSAlexander V. Chernikov */ 18900cba2b28SAlexander V. Chernikov if (compat == 0 || tc_new->no.type != tc->no.type) { 1891db785d31SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1892db785d31SAlexander V. Chernikov free_table_config(ni, tc); 1893db785d31SAlexander V. Chernikov return (EEXIST); 1894db785d31SAlexander V. Chernikov } 1895db785d31SAlexander V. Chernikov 18960468c5baSAlexander V. Chernikov /* Exchange tc and tc_new for proper refcounting & freeing */ 18970468c5baSAlexander V. Chernikov tmp = tc; 18980468c5baSAlexander V. Chernikov tc = tc_new; 18990468c5baSAlexander V. Chernikov tc_new = tmp; 19000468c5baSAlexander V. Chernikov } else { 19010468c5baSAlexander V. Chernikov /* New table */ 1902ac35ff17SAlexander V. Chernikov if (ipfw_objhash_alloc_idx(ni, &kidx) != 0) { 19039490a627SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1904db785d31SAlexander V. Chernikov printf("Unable to allocate table index." 1905db785d31SAlexander V. Chernikov " Consider increasing net.inet.ip.fw.tables_max"); 19069490a627SAlexander V. Chernikov free_table_config(ni, tc); 19079490a627SAlexander V. Chernikov return (EBUSY); 19089490a627SAlexander V. Chernikov } 19099490a627SAlexander V. Chernikov tc->no.kidx = kidx; 19109490a627SAlexander V. Chernikov 19119490a627SAlexander V. Chernikov IPFW_WLOCK(ch); 19129490a627SAlexander V. Chernikov link_table(ch, tc); 19139490a627SAlexander V. Chernikov IPFW_WUNLOCK(ch); 19140468c5baSAlexander V. Chernikov } 19150468c5baSAlexander V. Chernikov 19160468c5baSAlexander V. Chernikov if (compat != 0) 19170468c5baSAlexander V. Chernikov tc->no.refcnt++; 19180468c5baSAlexander V. Chernikov if (pkidx != NULL) 19190468c5baSAlexander V. Chernikov *pkidx = tc->no.kidx; 19209490a627SAlexander V. Chernikov 19219490a627SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 19229490a627SAlexander V. Chernikov 19230468c5baSAlexander V. Chernikov if (tc_new != NULL) 19240468c5baSAlexander V. Chernikov free_table_config(ni, tc_new); 19250468c5baSAlexander V. Chernikov 19269490a627SAlexander V. Chernikov return (0); 19279490a627SAlexander V. Chernikov } 19289490a627SAlexander V. Chernikov 192946d52008SAlexander V. Chernikov static void 193046d52008SAlexander V. Chernikov ntlv_to_ti(ipfw_obj_ntlv *ntlv, struct tid_info *ti) 1931d3a4f924SAlexander V. Chernikov { 1932d3a4f924SAlexander V. Chernikov 1933d3a4f924SAlexander V. Chernikov memset(ti, 0, sizeof(struct tid_info)); 193446d52008SAlexander V. Chernikov ti->set = ntlv->set; 193546d52008SAlexander V. Chernikov ti->uidx = ntlv->idx; 193646d52008SAlexander V. Chernikov ti->tlvs = ntlv; 193746d52008SAlexander V. Chernikov ti->tlen = ntlv->head.length; 193846d52008SAlexander V. Chernikov } 193946d52008SAlexander V. Chernikov 194046d52008SAlexander V. Chernikov static void 194146d52008SAlexander V. Chernikov objheader_to_ti(struct _ipfw_obj_header *oh, struct tid_info *ti) 194246d52008SAlexander V. Chernikov { 194346d52008SAlexander V. Chernikov 194446d52008SAlexander V. Chernikov ntlv_to_ti(&oh->ntlv, ti); 1945d3a4f924SAlexander V. Chernikov } 1946d3a4f924SAlexander V. Chernikov 194735e1bbd0SAlexander V. Chernikov /* 194835e1bbd0SAlexander V. Chernikov * Exports basic table info as name TLV. 194935e1bbd0SAlexander V. Chernikov * Used inside dump_static_rules() to provide info 195035e1bbd0SAlexander V. Chernikov * about all tables referenced by current ruleset. 195135e1bbd0SAlexander V. Chernikov * 195235e1bbd0SAlexander V. Chernikov * Returns 0 on success. 195335e1bbd0SAlexander V. Chernikov */ 1954563b5ab1SAlexander V. Chernikov int 1955563b5ab1SAlexander V. Chernikov ipfw_export_table_ntlv(struct ip_fw_chain *ch, uint16_t kidx, 1956563b5ab1SAlexander V. Chernikov struct sockopt_data *sd) 1957563b5ab1SAlexander V. Chernikov { 1958563b5ab1SAlexander V. Chernikov struct namedobj_instance *ni; 1959563b5ab1SAlexander V. Chernikov struct named_object *no; 1960563b5ab1SAlexander V. Chernikov ipfw_obj_ntlv *ntlv; 1961563b5ab1SAlexander V. Chernikov 1962563b5ab1SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1963563b5ab1SAlexander V. Chernikov 1964ac35ff17SAlexander V. Chernikov no = ipfw_objhash_lookup_kidx(ni, kidx); 1965563b5ab1SAlexander V. Chernikov KASSERT(no != NULL, ("invalid table kidx passed")); 1966563b5ab1SAlexander V. Chernikov 1967563b5ab1SAlexander V. Chernikov ntlv = (ipfw_obj_ntlv *)ipfw_get_sopt_space(sd, sizeof(*ntlv)); 1968563b5ab1SAlexander V. Chernikov if (ntlv == NULL) 1969563b5ab1SAlexander V. Chernikov return (ENOMEM); 1970563b5ab1SAlexander V. Chernikov 1971563b5ab1SAlexander V. Chernikov ntlv->head.type = IPFW_TLV_TBL_NAME; 1972563b5ab1SAlexander V. Chernikov ntlv->head.length = sizeof(*ntlv); 1973563b5ab1SAlexander V. Chernikov ntlv->idx = no->kidx; 1974563b5ab1SAlexander V. Chernikov strlcpy(ntlv->name, no->name, sizeof(ntlv->name)); 1975563b5ab1SAlexander V. Chernikov 1976563b5ab1SAlexander V. Chernikov return (0); 1977563b5ab1SAlexander V. Chernikov } 1978563b5ab1SAlexander V. Chernikov 197935e1bbd0SAlexander V. Chernikov /* 1980f99fbf96SAlexander V. Chernikov * Marks every table kidx used in @rule with bit in @bmask. 1981f99fbf96SAlexander V. Chernikov * Used to generate bitmask of referenced tables for given ruleset. 1982f99fbf96SAlexander V. Chernikov * 1983f99fbf96SAlexander V. Chernikov * Returns number of newly-referenced tables. 1984f99fbf96SAlexander V. Chernikov */ 1985f99fbf96SAlexander V. Chernikov int 1986f99fbf96SAlexander V. Chernikov ipfw_mark_table_kidx(struct ip_fw_chain *chain, struct ip_fw *rule, 1987f99fbf96SAlexander V. Chernikov uint32_t *bmask) 1988f99fbf96SAlexander V. Chernikov { 1989f99fbf96SAlexander V. Chernikov int cmdlen, l, count; 1990f99fbf96SAlexander V. Chernikov ipfw_insn *cmd; 1991f99fbf96SAlexander V. Chernikov uint16_t kidx; 1992f99fbf96SAlexander V. Chernikov uint8_t type; 1993f99fbf96SAlexander V. Chernikov 1994f99fbf96SAlexander V. Chernikov l = rule->cmd_len; 1995f99fbf96SAlexander V. Chernikov cmd = rule->cmd; 1996f99fbf96SAlexander V. Chernikov cmdlen = 0; 1997f99fbf96SAlexander V. Chernikov count = 0; 1998f99fbf96SAlexander V. Chernikov for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 1999f99fbf96SAlexander V. Chernikov cmdlen = F_LEN(cmd); 2000f99fbf96SAlexander V. Chernikov 2001f99fbf96SAlexander V. Chernikov if (classify_table_opcode(cmd, &kidx, &type) != 0) 2002f99fbf96SAlexander V. Chernikov continue; 2003f99fbf96SAlexander V. Chernikov 2004f99fbf96SAlexander V. Chernikov if ((bmask[kidx / 32] & (1 << (kidx % 32))) == 0) 2005f99fbf96SAlexander V. Chernikov count++; 2006f99fbf96SAlexander V. Chernikov 2007f99fbf96SAlexander V. Chernikov bmask[kidx / 32] |= 1 << (kidx % 32); 2008f99fbf96SAlexander V. Chernikov } 2009f99fbf96SAlexander V. Chernikov 2010f99fbf96SAlexander V. Chernikov return (count); 2011f99fbf96SAlexander V. Chernikov } 2012f99fbf96SAlexander V. Chernikov 2013d3b00c08SAlexander V. Chernikov struct dump_args { 20140cba2b28SAlexander V. Chernikov struct ip_fw_chain *ch; 2015d3b00c08SAlexander V. Chernikov struct table_info *ti; 2016d3b00c08SAlexander V. Chernikov struct table_config *tc; 2017d3b00c08SAlexander V. Chernikov struct sockopt_data *sd; 2018d3b00c08SAlexander V. Chernikov uint32_t cnt; 2019d3b00c08SAlexander V. Chernikov uint16_t uidx; 2020d3b00c08SAlexander V. Chernikov int error; 2021d3b00c08SAlexander V. Chernikov uint32_t size; 20224dff4ae0SAlexander V. Chernikov ipfw_table_entry *ent; 20234dff4ae0SAlexander V. Chernikov ta_foreach_f *f; 20244dff4ae0SAlexander V. Chernikov void *farg; 2025d3b00c08SAlexander V. Chernikov ipfw_obj_tentry tent; 2026d3b00c08SAlexander V. Chernikov }; 2027d3b00c08SAlexander V. Chernikov 2028d3b00c08SAlexander V. Chernikov static int 2029d3b00c08SAlexander V. Chernikov count_ext_entries(void *e, void *arg) 2030d3b00c08SAlexander V. Chernikov { 2031d3b00c08SAlexander V. Chernikov struct dump_args *da; 2032d3b00c08SAlexander V. Chernikov 2033d3b00c08SAlexander V. Chernikov da = (struct dump_args *)arg; 2034d3b00c08SAlexander V. Chernikov da->cnt++; 2035d3b00c08SAlexander V. Chernikov 2036d3b00c08SAlexander V. Chernikov return (0); 2037d3b00c08SAlexander V. Chernikov } 2038d3b00c08SAlexander V. Chernikov 2039d3b00c08SAlexander V. Chernikov /* 2040d3b00c08SAlexander V. Chernikov * Gets number of items from table either using 2041d3b00c08SAlexander V. Chernikov * internal counter or calling algo callback for 2042d3b00c08SAlexander V. Chernikov * externally-managed tables. 2043d3b00c08SAlexander V. Chernikov * 2044d3b00c08SAlexander V. Chernikov * Returns number of records. 2045d3b00c08SAlexander V. Chernikov */ 2046d3b00c08SAlexander V. Chernikov static uint32_t 2047d3b00c08SAlexander V. Chernikov table_get_count(struct ip_fw_chain *ch, struct table_config *tc) 2048d3b00c08SAlexander V. Chernikov { 2049d3b00c08SAlexander V. Chernikov struct table_info *ti; 2050d3b00c08SAlexander V. Chernikov struct table_algo *ta; 2051d3b00c08SAlexander V. Chernikov struct dump_args da; 2052d3b00c08SAlexander V. Chernikov 2053d3b00c08SAlexander V. Chernikov ti = KIDX_TO_TI(ch, tc->no.kidx); 2054d3b00c08SAlexander V. Chernikov ta = tc->ta; 2055d3b00c08SAlexander V. Chernikov 2056d3b00c08SAlexander V. Chernikov /* Use internal counter for self-managed tables */ 2057d3b00c08SAlexander V. Chernikov if ((ta->flags & TA_FLAG_READONLY) == 0) 2058d3b00c08SAlexander V. Chernikov return (tc->count); 2059d3b00c08SAlexander V. Chernikov 2060d3b00c08SAlexander V. Chernikov /* Use callback to quickly get number of items */ 2061d3b00c08SAlexander V. Chernikov if ((ta->flags & TA_FLAG_EXTCOUNTER) != 0) 2062d3b00c08SAlexander V. Chernikov return (ta->get_count(tc->astate, ti)); 2063d3b00c08SAlexander V. Chernikov 2064d3b00c08SAlexander V. Chernikov /* Count number of iterms ourselves */ 2065d3b00c08SAlexander V. Chernikov memset(&da, 0, sizeof(da)); 2066d3b00c08SAlexander V. Chernikov ta->foreach(tc->astate, ti, count_ext_entries, &da); 2067d3b00c08SAlexander V. Chernikov 2068d3b00c08SAlexander V. Chernikov return (da.cnt); 2069d3b00c08SAlexander V. Chernikov } 2070f99fbf96SAlexander V. Chernikov 2071f99fbf96SAlexander V. Chernikov /* 207235e1bbd0SAlexander V. Chernikov * Exports table @tc info into standard ipfw_xtable_info format. 207335e1bbd0SAlexander V. Chernikov */ 20749f7d47b0SAlexander V. Chernikov static void 2075ac35ff17SAlexander V. Chernikov export_table_info(struct ip_fw_chain *ch, struct table_config *tc, 2076ac35ff17SAlexander V. Chernikov ipfw_xtable_info *i) 20779f7d47b0SAlexander V. Chernikov { 2078ac35ff17SAlexander V. Chernikov struct table_info *ti; 20795f379342SAlexander V. Chernikov struct table_algo *ta; 20809f7d47b0SAlexander V. Chernikov 20819f7d47b0SAlexander V. Chernikov i->type = tc->no.type; 2082914bffb6SAlexander V. Chernikov i->tflags = tc->tflags; 20830cba2b28SAlexander V. Chernikov i->vmask = tc->vmask; 20849f7d47b0SAlexander V. Chernikov i->set = tc->no.set; 20859f7d47b0SAlexander V. Chernikov i->kidx = tc->no.kidx; 20869f7d47b0SAlexander V. Chernikov i->refcnt = tc->no.refcnt; 2087d3b00c08SAlexander V. Chernikov i->count = table_get_count(ch, tc); 20884c0c07a5SAlexander V. Chernikov i->limit = tc->limit; 20894f43138aSAlexander V. Chernikov i->flags |= (tc->locked != 0) ? IPFW_TGFLAGS_LOCKED : 0; 209081d3153dSAlexander V. Chernikov i->size = tc->count * sizeof(ipfw_obj_tentry); 2091f1220db8SAlexander V. Chernikov i->size += sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info); 20929f7d47b0SAlexander V. Chernikov strlcpy(i->tablename, tc->tablename, sizeof(i->tablename)); 2093ac35ff17SAlexander V. Chernikov ti = KIDX_TO_TI(ch, tc->no.kidx); 20945f379342SAlexander V. Chernikov ta = tc->ta; 20955f379342SAlexander V. Chernikov if (ta->print_config != NULL) { 20965f379342SAlexander V. Chernikov /* Use algo function to print table config to string */ 20975f379342SAlexander V. Chernikov ta->print_config(tc->astate, ti, i->algoname, 2098ac35ff17SAlexander V. Chernikov sizeof(i->algoname)); 2099ac35ff17SAlexander V. Chernikov } else 21005f379342SAlexander V. Chernikov strlcpy(i->algoname, ta->name, sizeof(i->algoname)); 21015f379342SAlexander V. Chernikov /* Dump algo-specific data, if possible */ 21025f379342SAlexander V. Chernikov if (ta->dump_tinfo != NULL) { 21035f379342SAlexander V. Chernikov ta->dump_tinfo(tc->astate, ti, &i->ta_info); 21045f379342SAlexander V. Chernikov i->ta_info.flags |= IPFW_TATFLAGS_DATA; 21055f379342SAlexander V. Chernikov } 21069f7d47b0SAlexander V. Chernikov } 21079f7d47b0SAlexander V. Chernikov 2108ac35ff17SAlexander V. Chernikov struct dump_table_args { 2109ac35ff17SAlexander V. Chernikov struct ip_fw_chain *ch; 2110ac35ff17SAlexander V. Chernikov struct sockopt_data *sd; 2111ac35ff17SAlexander V. Chernikov }; 2112ac35ff17SAlexander V. Chernikov 21139f7d47b0SAlexander V. Chernikov static void 21149f7d47b0SAlexander V. Chernikov export_table_internal(struct namedobj_instance *ni, struct named_object *no, 21159f7d47b0SAlexander V. Chernikov void *arg) 21163b3a8eb9SGleb Smirnoff { 21179f7d47b0SAlexander V. Chernikov ipfw_xtable_info *i; 2118ac35ff17SAlexander V. Chernikov struct dump_table_args *dta; 21193b3a8eb9SGleb Smirnoff 2120ac35ff17SAlexander V. Chernikov dta = (struct dump_table_args *)arg; 2121ac35ff17SAlexander V. Chernikov 2122ac35ff17SAlexander V. Chernikov i = (ipfw_xtable_info *)ipfw_get_sopt_space(dta->sd, sizeof(*i)); 212368394ec8SAlexander V. Chernikov KASSERT(i != 0, ("previously checked buffer is not enough")); 21249f7d47b0SAlexander V. Chernikov 2125ac35ff17SAlexander V. Chernikov export_table_info(dta->ch, (struct table_config *)no, i); 21269f7d47b0SAlexander V. Chernikov } 21279f7d47b0SAlexander V. Chernikov 2128f1220db8SAlexander V. Chernikov /* 2129f1220db8SAlexander V. Chernikov * Export all tables as ipfw_xtable_info structures to 21302d99a349SAlexander V. Chernikov * storage provided by @sd. 213128ea4fa3SAlexander V. Chernikov * 213228ea4fa3SAlexander V. Chernikov * If supplied buffer is too small, fills in required size 213328ea4fa3SAlexander V. Chernikov * and returns ENOMEM. 2134f1220db8SAlexander V. Chernikov * Returns 0 on success. 2135f1220db8SAlexander V. Chernikov */ 2136f1220db8SAlexander V. Chernikov static int 21372d99a349SAlexander V. Chernikov export_tables(struct ip_fw_chain *ch, ipfw_obj_lheader *olh, 21382d99a349SAlexander V. Chernikov struct sockopt_data *sd) 21399f7d47b0SAlexander V. Chernikov { 21409f7d47b0SAlexander V. Chernikov uint32_t size; 21419f7d47b0SAlexander V. Chernikov uint32_t count; 2142ac35ff17SAlexander V. Chernikov struct dump_table_args dta; 21439f7d47b0SAlexander V. Chernikov 21449f7d47b0SAlexander V. Chernikov count = ipfw_objhash_count(CHAIN_TO_NI(ch)); 21459f7d47b0SAlexander V. Chernikov size = count * sizeof(ipfw_xtable_info) + sizeof(ipfw_obj_lheader); 21462d99a349SAlexander V. Chernikov 21472d99a349SAlexander V. Chernikov /* Fill in header regadless of buffer size */ 2148f1220db8SAlexander V. Chernikov olh->count = count; 2149f1220db8SAlexander V. Chernikov olh->objsize = sizeof(ipfw_xtable_info); 21502d99a349SAlexander V. Chernikov 21512d99a349SAlexander V. Chernikov if (size > olh->size) { 21522d99a349SAlexander V. Chernikov olh->size = size; 21539f7d47b0SAlexander V. Chernikov return (ENOMEM); 2154f1220db8SAlexander V. Chernikov } 215568394ec8SAlexander V. Chernikov 21569f7d47b0SAlexander V. Chernikov olh->size = size; 21572d99a349SAlexander V. Chernikov 2158ac35ff17SAlexander V. Chernikov dta.ch = ch; 2159ac35ff17SAlexander V. Chernikov dta.sd = sd; 2160ac35ff17SAlexander V. Chernikov 2161ac35ff17SAlexander V. Chernikov ipfw_objhash_foreach(CHAIN_TO_NI(ch), export_table_internal, &dta); 21629f7d47b0SAlexander V. Chernikov 21633b3a8eb9SGleb Smirnoff return (0); 21643b3a8eb9SGleb Smirnoff } 21653b3a8eb9SGleb Smirnoff 2166f99fbf96SAlexander V. Chernikov /* 2167f99fbf96SAlexander V. Chernikov * Dumps all table data 2168f99fbf96SAlexander V. Chernikov * Data layout (v1)(current): 2169f99fbf96SAlexander V. Chernikov * Request: [ ipfw_obj_header ], size = ipfw_xtable_info.size 2170f99fbf96SAlexander V. Chernikov * Reply: [ ipfw_obj_header ipfw_xtable_info ipfw_obj_tentry x N ] 2171f99fbf96SAlexander V. Chernikov * 2172f99fbf96SAlexander V. Chernikov * Returns 0 on success 2173f99fbf96SAlexander V. Chernikov */ 2174f99fbf96SAlexander V. Chernikov static int 21756b988f3aSAlexander V. Chernikov dump_table_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 21766b988f3aSAlexander V. Chernikov struct sockopt_data *sd) 2177f99fbf96SAlexander V. Chernikov { 2178f99fbf96SAlexander V. Chernikov struct _ipfw_obj_header *oh; 2179f99fbf96SAlexander V. Chernikov ipfw_xtable_info *i; 2180f99fbf96SAlexander V. Chernikov struct tid_info ti; 2181f99fbf96SAlexander V. Chernikov struct table_config *tc; 2182f99fbf96SAlexander V. Chernikov struct table_algo *ta; 2183f99fbf96SAlexander V. Chernikov struct dump_args da; 2184f99fbf96SAlexander V. Chernikov uint32_t sz; 2185f99fbf96SAlexander V. Chernikov 2186f99fbf96SAlexander V. Chernikov sz = sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info); 2187f99fbf96SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 2188f99fbf96SAlexander V. Chernikov if (oh == NULL) 2189f99fbf96SAlexander V. Chernikov return (EINVAL); 2190f99fbf96SAlexander V. Chernikov 2191f99fbf96SAlexander V. Chernikov i = (ipfw_xtable_info *)(oh + 1); 2192f99fbf96SAlexander V. Chernikov objheader_to_ti(oh, &ti); 2193f99fbf96SAlexander V. Chernikov 2194f99fbf96SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 2195f99fbf96SAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) { 2196f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2197f99fbf96SAlexander V. Chernikov return (ESRCH); 2198f99fbf96SAlexander V. Chernikov } 2199f99fbf96SAlexander V. Chernikov export_table_info(ch, tc, i); 2200f99fbf96SAlexander V. Chernikov 2201f99fbf96SAlexander V. Chernikov if (sd->valsize < i->size) { 2202f99fbf96SAlexander V. Chernikov 2203f99fbf96SAlexander V. Chernikov /* 2204f99fbf96SAlexander V. Chernikov * Submitted buffer size is not enough. 2205f99fbf96SAlexander V. Chernikov * WE've already filled in @i structure with 2206f99fbf96SAlexander V. Chernikov * relevant table info including size, so we 2207f99fbf96SAlexander V. Chernikov * can return. Buffer will be flushed automatically. 2208f99fbf96SAlexander V. Chernikov */ 2209f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2210f99fbf96SAlexander V. Chernikov return (ENOMEM); 2211f99fbf96SAlexander V. Chernikov } 2212f99fbf96SAlexander V. Chernikov 2213f99fbf96SAlexander V. Chernikov /* 2214f99fbf96SAlexander V. Chernikov * Do the actual dump in eXtended format 2215f99fbf96SAlexander V. Chernikov */ 2216f99fbf96SAlexander V. Chernikov memset(&da, 0, sizeof(da)); 22170cba2b28SAlexander V. Chernikov da.ch = ch; 2218f99fbf96SAlexander V. Chernikov da.ti = KIDX_TO_TI(ch, tc->no.kidx); 2219f99fbf96SAlexander V. Chernikov da.tc = tc; 2220f99fbf96SAlexander V. Chernikov da.sd = sd; 2221f99fbf96SAlexander V. Chernikov 2222f99fbf96SAlexander V. Chernikov ta = tc->ta; 2223f99fbf96SAlexander V. Chernikov 2224f99fbf96SAlexander V. Chernikov ta->foreach(tc->astate, da.ti, dump_table_tentry, &da); 2225f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2226f99fbf96SAlexander V. Chernikov 2227f99fbf96SAlexander V. Chernikov return (da.error); 2228f99fbf96SAlexander V. Chernikov } 2229f99fbf96SAlexander V. Chernikov 2230f99fbf96SAlexander V. Chernikov /* 2231f99fbf96SAlexander V. Chernikov * Dumps all table data 2232f99fbf96SAlexander V. Chernikov * Data layout (version 0)(legacy): 2233f99fbf96SAlexander V. Chernikov * Request: [ ipfw_xtable ], size = IP_FW_TABLE_XGETSIZE() 2234f99fbf96SAlexander V. Chernikov * Reply: [ ipfw_xtable ipfw_table_xentry x N ] 2235f99fbf96SAlexander V. Chernikov * 2236f99fbf96SAlexander V. Chernikov * Returns 0 on success 2237f99fbf96SAlexander V. Chernikov */ 2238f99fbf96SAlexander V. Chernikov static int 22396b988f3aSAlexander V. Chernikov dump_table_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 22406b988f3aSAlexander V. Chernikov struct sockopt_data *sd) 2241f99fbf96SAlexander V. Chernikov { 2242f99fbf96SAlexander V. Chernikov ipfw_xtable *xtbl; 2243f99fbf96SAlexander V. Chernikov struct tid_info ti; 2244f99fbf96SAlexander V. Chernikov struct table_config *tc; 2245f99fbf96SAlexander V. Chernikov struct table_algo *ta; 2246f99fbf96SAlexander V. Chernikov struct dump_args da; 2247d3b00c08SAlexander V. Chernikov size_t sz, count; 2248f99fbf96SAlexander V. Chernikov 2249f99fbf96SAlexander V. Chernikov xtbl = (ipfw_xtable *)ipfw_get_sopt_header(sd, sizeof(ipfw_xtable)); 2250f99fbf96SAlexander V. Chernikov if (xtbl == NULL) 2251f99fbf96SAlexander V. Chernikov return (EINVAL); 2252f99fbf96SAlexander V. Chernikov 2253f99fbf96SAlexander V. Chernikov memset(&ti, 0, sizeof(ti)); 2254f99fbf96SAlexander V. Chernikov ti.uidx = xtbl->tbl; 2255f99fbf96SAlexander V. Chernikov 2256f99fbf96SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 2257f99fbf96SAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) { 2258f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2259f99fbf96SAlexander V. Chernikov return (0); 2260f99fbf96SAlexander V. Chernikov } 2261d3b00c08SAlexander V. Chernikov count = table_get_count(ch, tc); 2262d3b00c08SAlexander V. Chernikov sz = count * sizeof(ipfw_table_xentry) + sizeof(ipfw_xtable); 2263f99fbf96SAlexander V. Chernikov 2264d3b00c08SAlexander V. Chernikov xtbl->cnt = count; 2265f99fbf96SAlexander V. Chernikov xtbl->size = sz; 2266f99fbf96SAlexander V. Chernikov xtbl->type = tc->no.type; 2267f99fbf96SAlexander V. Chernikov xtbl->tbl = ti.uidx; 2268f99fbf96SAlexander V. Chernikov 2269f99fbf96SAlexander V. Chernikov if (sd->valsize < sz) { 2270f99fbf96SAlexander V. Chernikov 2271f99fbf96SAlexander V. Chernikov /* 2272f99fbf96SAlexander V. Chernikov * Submitted buffer size is not enough. 2273f99fbf96SAlexander V. Chernikov * WE've already filled in @i structure with 2274f99fbf96SAlexander V. Chernikov * relevant table info including size, so we 2275f99fbf96SAlexander V. Chernikov * can return. Buffer will be flushed automatically. 2276f99fbf96SAlexander V. Chernikov */ 2277f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2278f99fbf96SAlexander V. Chernikov return (ENOMEM); 2279f99fbf96SAlexander V. Chernikov } 2280f99fbf96SAlexander V. Chernikov 2281f99fbf96SAlexander V. Chernikov /* Do the actual dump in eXtended format */ 2282f99fbf96SAlexander V. Chernikov memset(&da, 0, sizeof(da)); 22830cba2b28SAlexander V. Chernikov da.ch = ch; 2284f99fbf96SAlexander V. Chernikov da.ti = KIDX_TO_TI(ch, tc->no.kidx); 2285f99fbf96SAlexander V. Chernikov da.tc = tc; 2286f99fbf96SAlexander V. Chernikov da.sd = sd; 2287f99fbf96SAlexander V. Chernikov 2288f99fbf96SAlexander V. Chernikov ta = tc->ta; 2289f99fbf96SAlexander V. Chernikov 2290f99fbf96SAlexander V. Chernikov ta->foreach(tc->astate, da.ti, dump_table_xentry, &da); 2291f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2292f99fbf96SAlexander V. Chernikov 2293f99fbf96SAlexander V. Chernikov return (0); 2294f99fbf96SAlexander V. Chernikov } 2295f99fbf96SAlexander V. Chernikov 229681d3153dSAlexander V. Chernikov /* 2297e822d936SAlexander V. Chernikov * Legacy function to retrieve number of items in table. 2298e822d936SAlexander V. Chernikov */ 22996b988f3aSAlexander V. Chernikov static int 23006b988f3aSAlexander V. Chernikov get_table_size(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 2301e822d936SAlexander V. Chernikov struct sockopt_data *sd) 2302e822d936SAlexander V. Chernikov { 2303e822d936SAlexander V. Chernikov uint32_t *tbl; 2304e822d936SAlexander V. Chernikov struct tid_info ti; 2305e822d936SAlexander V. Chernikov size_t sz; 2306e822d936SAlexander V. Chernikov int error; 2307e822d936SAlexander V. Chernikov 2308e822d936SAlexander V. Chernikov sz = sizeof(*op3) + sizeof(uint32_t); 2309e822d936SAlexander V. Chernikov op3 = (ip_fw3_opheader *)ipfw_get_sopt_header(sd, sz); 2310e822d936SAlexander V. Chernikov if (op3 == NULL) 2311e822d936SAlexander V. Chernikov return (EINVAL); 2312e822d936SAlexander V. Chernikov 2313e822d936SAlexander V. Chernikov tbl = (uint32_t *)(op3 + 1); 2314e822d936SAlexander V. Chernikov memset(&ti, 0, sizeof(ti)); 2315e822d936SAlexander V. Chernikov ti.uidx = *tbl; 2316e822d936SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 2317e822d936SAlexander V. Chernikov error = ipfw_count_xtable(ch, &ti, tbl); 2318e822d936SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2319e822d936SAlexander V. Chernikov return (error); 2320e822d936SAlexander V. Chernikov } 2321e822d936SAlexander V. Chernikov 2322e822d936SAlexander V. Chernikov /* 232381d3153dSAlexander V. Chernikov * Legacy IP_FW_TABLE_GETSIZE handler 232481d3153dSAlexander V. Chernikov */ 23253b3a8eb9SGleb Smirnoff int 2326b074b7bbSAlexander V. Chernikov ipfw_count_table(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt) 23273b3a8eb9SGleb Smirnoff { 2328b074b7bbSAlexander V. Chernikov struct table_config *tc; 23293b3a8eb9SGleb Smirnoff 2330b074b7bbSAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) 2331b074b7bbSAlexander V. Chernikov return (ESRCH); 2332d3b00c08SAlexander V. Chernikov *cnt = table_get_count(ch, tc); 23333b3a8eb9SGleb Smirnoff return (0); 23343b3a8eb9SGleb Smirnoff } 23353b3a8eb9SGleb Smirnoff 233681d3153dSAlexander V. Chernikov /* 233781d3153dSAlexander V. Chernikov * Legacy IP_FW_TABLE_XGETSIZE handler 233881d3153dSAlexander V. Chernikov */ 23399f7d47b0SAlexander V. Chernikov int 23409f7d47b0SAlexander V. Chernikov ipfw_count_xtable(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt) 23413b3a8eb9SGleb Smirnoff { 23429f7d47b0SAlexander V. Chernikov struct table_config *tc; 2343d3b00c08SAlexander V. Chernikov uint32_t count; 23449f7d47b0SAlexander V. Chernikov 2345d3a4f924SAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) { 2346d3a4f924SAlexander V. Chernikov *cnt = 0; 23479f7d47b0SAlexander V. Chernikov return (0); /* 'table all list' requires success */ 2348d3a4f924SAlexander V. Chernikov } 2349d3b00c08SAlexander V. Chernikov 2350d3b00c08SAlexander V. Chernikov count = table_get_count(ch, tc); 2351d3b00c08SAlexander V. Chernikov *cnt = count * sizeof(ipfw_table_xentry); 2352d3b00c08SAlexander V. Chernikov if (count > 0) 23539f7d47b0SAlexander V. Chernikov *cnt += sizeof(ipfw_xtable); 23549f7d47b0SAlexander V. Chernikov return (0); 23559f7d47b0SAlexander V. Chernikov } 23569f7d47b0SAlexander V. Chernikov 23579f7d47b0SAlexander V. Chernikov static int 23589f7d47b0SAlexander V. Chernikov dump_table_entry(void *e, void *arg) 23599f7d47b0SAlexander V. Chernikov { 23609f7d47b0SAlexander V. Chernikov struct dump_args *da; 23619f7d47b0SAlexander V. Chernikov struct table_config *tc; 23629f7d47b0SAlexander V. Chernikov struct table_algo *ta; 23633b3a8eb9SGleb Smirnoff ipfw_table_entry *ent; 23640cba2b28SAlexander V. Chernikov struct table_value *pval; 236581d3153dSAlexander V. Chernikov int error; 23663b3a8eb9SGleb Smirnoff 23679f7d47b0SAlexander V. Chernikov da = (struct dump_args *)arg; 23689f7d47b0SAlexander V. Chernikov 23699f7d47b0SAlexander V. Chernikov tc = da->tc; 23709f7d47b0SAlexander V. Chernikov ta = tc->ta; 23719f7d47b0SAlexander V. Chernikov 23729f7d47b0SAlexander V. Chernikov /* Out of memory, returning */ 2373f1220db8SAlexander V. Chernikov if (da->cnt == da->size) 23743b3a8eb9SGleb Smirnoff return (1); 2375f1220db8SAlexander V. Chernikov ent = da->ent++; 2376f1220db8SAlexander V. Chernikov ent->tbl = da->uidx; 2377f1220db8SAlexander V. Chernikov da->cnt++; 23789f7d47b0SAlexander V. Chernikov 237981d3153dSAlexander V. Chernikov error = ta->dump_tentry(tc->astate, da->ti, e, &da->tent); 238081d3153dSAlexander V. Chernikov if (error != 0) 238181d3153dSAlexander V. Chernikov return (error); 238281d3153dSAlexander V. Chernikov 238381d3153dSAlexander V. Chernikov ent->addr = da->tent.k.addr.s_addr; 238481d3153dSAlexander V. Chernikov ent->masklen = da->tent.masklen; 23850cba2b28SAlexander V. Chernikov pval = get_table_value(da->ch, da->tc, da->tent.v.kidx); 23860cba2b28SAlexander V. Chernikov ent->value = ipfw_export_table_value_legacy(pval); 238781d3153dSAlexander V. Chernikov 238881d3153dSAlexander V. Chernikov return (0); 23893b3a8eb9SGleb Smirnoff } 23903b3a8eb9SGleb Smirnoff 2391f1220db8SAlexander V. Chernikov /* 2392f1220db8SAlexander V. Chernikov * Dumps table in pre-8.1 legacy format. 2393f1220db8SAlexander V. Chernikov */ 23943b3a8eb9SGleb Smirnoff int 2395f1220db8SAlexander V. Chernikov ipfw_dump_table_legacy(struct ip_fw_chain *ch, struct tid_info *ti, 2396f1220db8SAlexander V. Chernikov ipfw_table *tbl) 23973b3a8eb9SGleb Smirnoff { 2398b074b7bbSAlexander V. Chernikov struct table_config *tc; 23999f7d47b0SAlexander V. Chernikov struct table_algo *ta; 24009f7d47b0SAlexander V. Chernikov struct dump_args da; 24013b3a8eb9SGleb Smirnoff 24023b3a8eb9SGleb Smirnoff tbl->cnt = 0; 24033b3a8eb9SGleb Smirnoff 2404b074b7bbSAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) 2405b074b7bbSAlexander V. Chernikov return (0); /* XXX: We should return ESRCH */ 24069f7d47b0SAlexander V. Chernikov 24079f7d47b0SAlexander V. Chernikov ta = tc->ta; 24089f7d47b0SAlexander V. Chernikov 240981d3153dSAlexander V. Chernikov /* This dump format supports IPv4 only */ 2410c21034b7SAlexander V. Chernikov if (tc->no.type != IPFW_TABLE_ADDR) 241181d3153dSAlexander V. Chernikov return (0); 24129f7d47b0SAlexander V. Chernikov 2413d3a4f924SAlexander V. Chernikov memset(&da, 0, sizeof(da)); 24140cba2b28SAlexander V. Chernikov da.ch = ch; 24159f7d47b0SAlexander V. Chernikov da.ti = KIDX_TO_TI(ch, tc->no.kidx); 24169f7d47b0SAlexander V. Chernikov da.tc = tc; 2417f1220db8SAlexander V. Chernikov da.ent = &tbl->ent[0]; 2418f1220db8SAlexander V. Chernikov da.size = tbl->size; 24199f7d47b0SAlexander V. Chernikov 24209f7d47b0SAlexander V. Chernikov tbl->cnt = 0; 24219f7d47b0SAlexander V. Chernikov ta->foreach(tc->astate, da.ti, dump_table_entry, &da); 2422f1220db8SAlexander V. Chernikov tbl->cnt = da.cnt; 24239f7d47b0SAlexander V. Chernikov 24243b3a8eb9SGleb Smirnoff return (0); 24253b3a8eb9SGleb Smirnoff } 24263b3a8eb9SGleb Smirnoff 24279490a627SAlexander V. Chernikov /* 242881d3153dSAlexander V. Chernikov * Dumps table entry in eXtended format (v1)(current). 242981d3153dSAlexander V. Chernikov */ 243081d3153dSAlexander V. Chernikov static int 243181d3153dSAlexander V. Chernikov dump_table_tentry(void *e, void *arg) 243281d3153dSAlexander V. Chernikov { 243381d3153dSAlexander V. Chernikov struct dump_args *da; 243481d3153dSAlexander V. Chernikov struct table_config *tc; 243581d3153dSAlexander V. Chernikov struct table_algo *ta; 24360cba2b28SAlexander V. Chernikov struct table_value *pval; 243781d3153dSAlexander V. Chernikov ipfw_obj_tentry *tent; 24380cba2b28SAlexander V. Chernikov int error; 243981d3153dSAlexander V. Chernikov 244081d3153dSAlexander V. Chernikov da = (struct dump_args *)arg; 244181d3153dSAlexander V. Chernikov 244281d3153dSAlexander V. Chernikov tc = da->tc; 244381d3153dSAlexander V. Chernikov ta = tc->ta; 244481d3153dSAlexander V. Chernikov 244581d3153dSAlexander V. Chernikov tent = (ipfw_obj_tentry *)ipfw_get_sopt_space(da->sd, sizeof(*tent)); 244681d3153dSAlexander V. Chernikov /* Out of memory, returning */ 244781d3153dSAlexander V. Chernikov if (tent == NULL) { 244881d3153dSAlexander V. Chernikov da->error = ENOMEM; 244981d3153dSAlexander V. Chernikov return (1); 245081d3153dSAlexander V. Chernikov } 245181d3153dSAlexander V. Chernikov tent->head.length = sizeof(ipfw_obj_tentry); 245281d3153dSAlexander V. Chernikov tent->idx = da->uidx; 245381d3153dSAlexander V. Chernikov 24540cba2b28SAlexander V. Chernikov error = ta->dump_tentry(tc->astate, da->ti, e, tent); 24550cba2b28SAlexander V. Chernikov if (error != 0) 24560cba2b28SAlexander V. Chernikov return (error); 24570cba2b28SAlexander V. Chernikov 24580cba2b28SAlexander V. Chernikov pval = get_table_value(da->ch, da->tc, tent->v.kidx); 24590cba2b28SAlexander V. Chernikov ipfw_export_table_value_v1(pval, &tent->v.value); 24600cba2b28SAlexander V. Chernikov 24610cba2b28SAlexander V. Chernikov return (0); 246281d3153dSAlexander V. Chernikov } 246381d3153dSAlexander V. Chernikov 246481d3153dSAlexander V. Chernikov /* 246581d3153dSAlexander V. Chernikov * Dumps table entry in eXtended format (v0). 24669490a627SAlexander V. Chernikov */ 24673b3a8eb9SGleb Smirnoff static int 24689f7d47b0SAlexander V. Chernikov dump_table_xentry(void *e, void *arg) 24693b3a8eb9SGleb Smirnoff { 24709f7d47b0SAlexander V. Chernikov struct dump_args *da; 24719f7d47b0SAlexander V. Chernikov struct table_config *tc; 24729f7d47b0SAlexander V. Chernikov struct table_algo *ta; 24733b3a8eb9SGleb Smirnoff ipfw_table_xentry *xent; 247481d3153dSAlexander V. Chernikov ipfw_obj_tentry *tent; 24750cba2b28SAlexander V. Chernikov struct table_value *pval; 247681d3153dSAlexander V. Chernikov int error; 24773b3a8eb9SGleb Smirnoff 24789f7d47b0SAlexander V. Chernikov da = (struct dump_args *)arg; 24799f7d47b0SAlexander V. Chernikov 24809f7d47b0SAlexander V. Chernikov tc = da->tc; 24819f7d47b0SAlexander V. Chernikov ta = tc->ta; 24829f7d47b0SAlexander V. Chernikov 24832d99a349SAlexander V. Chernikov xent = (ipfw_table_xentry *)ipfw_get_sopt_space(da->sd, sizeof(*xent)); 24843b3a8eb9SGleb Smirnoff /* Out of memory, returning */ 24852d99a349SAlexander V. Chernikov if (xent == NULL) 24863b3a8eb9SGleb Smirnoff return (1); 24873b3a8eb9SGleb Smirnoff xent->len = sizeof(ipfw_table_xentry); 2488f1220db8SAlexander V. Chernikov xent->tbl = da->uidx; 24899f7d47b0SAlexander V. Chernikov 249081d3153dSAlexander V. Chernikov memset(&da->tent, 0, sizeof(da->tent)); 249181d3153dSAlexander V. Chernikov tent = &da->tent; 249281d3153dSAlexander V. Chernikov error = ta->dump_tentry(tc->astate, da->ti, e, tent); 249381d3153dSAlexander V. Chernikov if (error != 0) 249481d3153dSAlexander V. Chernikov return (error); 249581d3153dSAlexander V. Chernikov 249681d3153dSAlexander V. Chernikov /* Convert current format to previous one */ 249781d3153dSAlexander V. Chernikov xent->masklen = tent->masklen; 24980cba2b28SAlexander V. Chernikov pval = get_table_value(da->ch, da->tc, da->tent.v.kidx); 24990cba2b28SAlexander V. Chernikov xent->value = ipfw_export_table_value_legacy(pval); 250081d3153dSAlexander V. Chernikov /* Apply some hacks */ 2501c21034b7SAlexander V. Chernikov if (tc->no.type == IPFW_TABLE_ADDR && tent->subtype == AF_INET) { 250281d3153dSAlexander V. Chernikov xent->k.addr6.s6_addr32[3] = tent->k.addr.s_addr; 250381d3153dSAlexander V. Chernikov xent->flags = IPFW_TCF_INET; 250481d3153dSAlexander V. Chernikov } else 250581d3153dSAlexander V. Chernikov memcpy(&xent->k, &tent->k, sizeof(xent->k)); 250681d3153dSAlexander V. Chernikov 250781d3153dSAlexander V. Chernikov return (0); 25089f7d47b0SAlexander V. Chernikov } 25099f7d47b0SAlexander V. Chernikov 25109f7d47b0SAlexander V. Chernikov /* 25114dff4ae0SAlexander V. Chernikov * Helper function to export table algo data 25124dff4ae0SAlexander V. Chernikov * to tentry format before calling user function. 25134dff4ae0SAlexander V. Chernikov * 25144dff4ae0SAlexander V. Chernikov * Returns 0 on success. 25154dff4ae0SAlexander V. Chernikov */ 25164dff4ae0SAlexander V. Chernikov static int 25174dff4ae0SAlexander V. Chernikov prepare_table_tentry(void *e, void *arg) 25184dff4ae0SAlexander V. Chernikov { 25194dff4ae0SAlexander V. Chernikov struct dump_args *da; 25204dff4ae0SAlexander V. Chernikov struct table_config *tc; 25214dff4ae0SAlexander V. Chernikov struct table_algo *ta; 25224dff4ae0SAlexander V. Chernikov int error; 25234dff4ae0SAlexander V. Chernikov 25244dff4ae0SAlexander V. Chernikov da = (struct dump_args *)arg; 25254dff4ae0SAlexander V. Chernikov 25264dff4ae0SAlexander V. Chernikov tc = da->tc; 25274dff4ae0SAlexander V. Chernikov ta = tc->ta; 25284dff4ae0SAlexander V. Chernikov 25294dff4ae0SAlexander V. Chernikov error = ta->dump_tentry(tc->astate, da->ti, e, &da->tent); 25304dff4ae0SAlexander V. Chernikov if (error != 0) 25314dff4ae0SAlexander V. Chernikov return (error); 25324dff4ae0SAlexander V. Chernikov 25334dff4ae0SAlexander V. Chernikov da->f(&da->tent, da->farg); 25344dff4ae0SAlexander V. Chernikov 25354dff4ae0SAlexander V. Chernikov return (0); 25364dff4ae0SAlexander V. Chernikov } 25374dff4ae0SAlexander V. Chernikov 25384dff4ae0SAlexander V. Chernikov /* 25394dff4ae0SAlexander V. Chernikov * Allow external consumers to read table entries in standard format. 25404dff4ae0SAlexander V. Chernikov */ 25414dff4ae0SAlexander V. Chernikov int 25424dff4ae0SAlexander V. Chernikov ipfw_foreach_table_tentry(struct ip_fw_chain *ch, uint16_t kidx, 25434dff4ae0SAlexander V. Chernikov ta_foreach_f *f, void *arg) 25444dff4ae0SAlexander V. Chernikov { 25454dff4ae0SAlexander V. Chernikov struct namedobj_instance *ni; 25464dff4ae0SAlexander V. Chernikov struct table_config *tc; 25474dff4ae0SAlexander V. Chernikov struct table_algo *ta; 25484dff4ae0SAlexander V. Chernikov struct dump_args da; 25494dff4ae0SAlexander V. Chernikov 25504dff4ae0SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 25514dff4ae0SAlexander V. Chernikov 25524dff4ae0SAlexander V. Chernikov tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, kidx); 25534dff4ae0SAlexander V. Chernikov if (tc == NULL) 25544dff4ae0SAlexander V. Chernikov return (ESRCH); 25554dff4ae0SAlexander V. Chernikov 25564dff4ae0SAlexander V. Chernikov ta = tc->ta; 25574dff4ae0SAlexander V. Chernikov 25584dff4ae0SAlexander V. Chernikov memset(&da, 0, sizeof(da)); 25590cba2b28SAlexander V. Chernikov da.ch = ch; 25604dff4ae0SAlexander V. Chernikov da.ti = KIDX_TO_TI(ch, tc->no.kidx); 25614dff4ae0SAlexander V. Chernikov da.tc = tc; 25624dff4ae0SAlexander V. Chernikov da.f = f; 25634dff4ae0SAlexander V. Chernikov da.farg = arg; 25644dff4ae0SAlexander V. Chernikov 25654dff4ae0SAlexander V. Chernikov ta->foreach(tc->astate, da.ti, prepare_table_tentry, &da); 25664dff4ae0SAlexander V. Chernikov 25674dff4ae0SAlexander V. Chernikov return (0); 25684dff4ae0SAlexander V. Chernikov } 25694dff4ae0SAlexander V. Chernikov 25704dff4ae0SAlexander V. Chernikov /* 25719f7d47b0SAlexander V. Chernikov * Table algorithms 25729f7d47b0SAlexander V. Chernikov */ 25733b3a8eb9SGleb Smirnoff 25749f7d47b0SAlexander V. Chernikov /* 257535e1bbd0SAlexander V. Chernikov * Finds algoritm by index, table type or supplied name. 257635e1bbd0SAlexander V. Chernikov * 257735e1bbd0SAlexander V. Chernikov * Returns pointer to algo or NULL. 25789f7d47b0SAlexander V. Chernikov */ 25799f7d47b0SAlexander V. Chernikov static struct table_algo * 25809490a627SAlexander V. Chernikov find_table_algo(struct tables_config *tcfg, struct tid_info *ti, char *name) 25819f7d47b0SAlexander V. Chernikov { 25829490a627SAlexander V. Chernikov int i, l; 25839490a627SAlexander V. Chernikov struct table_algo *ta; 25849f7d47b0SAlexander V. Chernikov 258557a1cf95SAlexander V. Chernikov if (ti->type > IPFW_TABLE_MAXTYPE) 258657a1cf95SAlexander V. Chernikov return (NULL); 258757a1cf95SAlexander V. Chernikov 25889f7d47b0SAlexander V. Chernikov /* Search by index */ 25899f7d47b0SAlexander V. Chernikov if (ti->atype != 0) { 25909f7d47b0SAlexander V. Chernikov if (ti->atype > tcfg->algo_count) 25919f7d47b0SAlexander V. Chernikov return (NULL); 25929f7d47b0SAlexander V. Chernikov return (tcfg->algo[ti->atype]); 25939f7d47b0SAlexander V. Chernikov } 25949f7d47b0SAlexander V. Chernikov 2595fd0869d5SAlexander V. Chernikov if (name == NULL) { 2596fd0869d5SAlexander V. Chernikov /* Return default algorithm for given type if set */ 2597fd0869d5SAlexander V. Chernikov return (tcfg->def_algo[ti->type]); 2598fd0869d5SAlexander V. Chernikov } 2599fd0869d5SAlexander V. Chernikov 2600fd0869d5SAlexander V. Chernikov /* Search by name */ 26019490a627SAlexander V. Chernikov /* TODO: better search */ 26029490a627SAlexander V. Chernikov for (i = 1; i <= tcfg->algo_count; i++) { 26039490a627SAlexander V. Chernikov ta = tcfg->algo[i]; 26049490a627SAlexander V. Chernikov 26059490a627SAlexander V. Chernikov /* 26069490a627SAlexander V. Chernikov * One can supply additional algorithm 26079490a627SAlexander V. Chernikov * parameters so we compare only the first word 26089490a627SAlexander V. Chernikov * of supplied name: 2609c21034b7SAlexander V. Chernikov * 'addr:chash hsize=32' 26109490a627SAlexander V. Chernikov * '^^^^^^^^^' 26119490a627SAlexander V. Chernikov * 26129490a627SAlexander V. Chernikov */ 26139490a627SAlexander V. Chernikov l = strlen(ta->name); 2614fd0869d5SAlexander V. Chernikov if (strncmp(name, ta->name, l) != 0) 2615fd0869d5SAlexander V. Chernikov continue; 2616fd0869d5SAlexander V. Chernikov if (name[l] != '\0' && name[l] != ' ') 2617fd0869d5SAlexander V. Chernikov continue; 2618fd0869d5SAlexander V. Chernikov /* Check if we're requesting proper table type */ 2619fd0869d5SAlexander V. Chernikov if (ti->type != 0 && ti->type != ta->type) 2620fd0869d5SAlexander V. Chernikov return (NULL); 26219490a627SAlexander V. Chernikov return (ta); 26229490a627SAlexander V. Chernikov } 26239490a627SAlexander V. Chernikov 26249490a627SAlexander V. Chernikov return (NULL); 26259490a627SAlexander V. Chernikov } 26269490a627SAlexander V. Chernikov 2627b6ee846eSAlexander V. Chernikov /* 2628b6ee846eSAlexander V. Chernikov * Register new table algo @ta. 262935e1bbd0SAlexander V. Chernikov * Stores algo id inside @idx. 2630b6ee846eSAlexander V. Chernikov * 2631b6ee846eSAlexander V. Chernikov * Returns 0 on success. 2632b6ee846eSAlexander V. Chernikov */ 26330b565ac0SAlexander V. Chernikov int 26340b565ac0SAlexander V. Chernikov ipfw_add_table_algo(struct ip_fw_chain *ch, struct table_algo *ta, size_t size, 26350b565ac0SAlexander V. Chernikov int *idx) 26363b3a8eb9SGleb Smirnoff { 26379f7d47b0SAlexander V. Chernikov struct tables_config *tcfg; 26380b565ac0SAlexander V. Chernikov struct table_algo *ta_new; 2639b6ee846eSAlexander V. Chernikov size_t sz; 26400b565ac0SAlexander V. Chernikov 26410b565ac0SAlexander V. Chernikov if (size > sizeof(struct table_algo)) 26420b565ac0SAlexander V. Chernikov return (EINVAL); 26430b565ac0SAlexander V. Chernikov 2644b6ee846eSAlexander V. Chernikov /* Check for the required on-stack size for add/del */ 2645b6ee846eSAlexander V. Chernikov sz = roundup2(ta->ta_buf_size, sizeof(void *)); 2646b6ee846eSAlexander V. Chernikov if (sz > TA_BUF_SZ) 2647b6ee846eSAlexander V. Chernikov return (EINVAL); 2648b6ee846eSAlexander V. Chernikov 2649fddbbf75SAlexander V. Chernikov KASSERT(ta->type <= IPFW_TABLE_MAXTYPE,("Increase IPFW_TABLE_MAXTYPE")); 265057a1cf95SAlexander V. Chernikov 265135e1bbd0SAlexander V. Chernikov /* Copy algorithm data to stable storage. */ 26520b565ac0SAlexander V. Chernikov ta_new = malloc(sizeof(struct table_algo), M_IPFW, M_WAITOK | M_ZERO); 26530b565ac0SAlexander V. Chernikov memcpy(ta_new, ta, size); 26543b3a8eb9SGleb Smirnoff 26559f7d47b0SAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 2656b074b7bbSAlexander V. Chernikov 26579f7d47b0SAlexander V. Chernikov KASSERT(tcfg->algo_count < 255, ("Increase algo array size")); 26589f7d47b0SAlexander V. Chernikov 26590b565ac0SAlexander V. Chernikov tcfg->algo[++tcfg->algo_count] = ta_new; 26600b565ac0SAlexander V. Chernikov ta_new->idx = tcfg->algo_count; 26610b565ac0SAlexander V. Chernikov 266257a1cf95SAlexander V. Chernikov /* Set algorithm as default one for given type */ 266357a1cf95SAlexander V. Chernikov if ((ta_new->flags & TA_FLAG_DEFAULT) != 0 && 266457a1cf95SAlexander V. Chernikov tcfg->def_algo[ta_new->type] == NULL) 266557a1cf95SAlexander V. Chernikov tcfg->def_algo[ta_new->type] = ta_new; 266657a1cf95SAlexander V. Chernikov 26670b565ac0SAlexander V. Chernikov *idx = ta_new->idx; 26680b565ac0SAlexander V. Chernikov 26690b565ac0SAlexander V. Chernikov return (0); 26700b565ac0SAlexander V. Chernikov } 26710b565ac0SAlexander V. Chernikov 2672b6ee846eSAlexander V. Chernikov /* 2673b6ee846eSAlexander V. Chernikov * Unregisters table algo using @idx as id. 2674c8d5d308SAlexander V. Chernikov * XXX: It is NOT safe to call this function in any place 2675c8d5d308SAlexander V. Chernikov * other than ipfw instance destroy handler. 2676b6ee846eSAlexander V. Chernikov */ 26770b565ac0SAlexander V. Chernikov void 26780b565ac0SAlexander V. Chernikov ipfw_del_table_algo(struct ip_fw_chain *ch, int idx) 26790b565ac0SAlexander V. Chernikov { 26800b565ac0SAlexander V. Chernikov struct tables_config *tcfg; 26810b565ac0SAlexander V. Chernikov struct table_algo *ta; 26820b565ac0SAlexander V. Chernikov 26830b565ac0SAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 26840b565ac0SAlexander V. Chernikov 2685b6ee846eSAlexander V. Chernikov KASSERT(idx <= tcfg->algo_count, ("algo idx %d out of range 1..%d", 2686b6ee846eSAlexander V. Chernikov idx, tcfg->algo_count)); 26870b565ac0SAlexander V. Chernikov 26880b565ac0SAlexander V. Chernikov ta = tcfg->algo[idx]; 26890b565ac0SAlexander V. Chernikov KASSERT(ta != NULL, ("algo idx %d is NULL", idx)); 269057a1cf95SAlexander V. Chernikov 269157a1cf95SAlexander V. Chernikov if (tcfg->def_algo[ta->type] == ta) 269257a1cf95SAlexander V. Chernikov tcfg->def_algo[ta->type] = NULL; 269357a1cf95SAlexander V. Chernikov 26940b565ac0SAlexander V. Chernikov free(ta, M_IPFW); 26953b3a8eb9SGleb Smirnoff } 26963b3a8eb9SGleb Smirnoff 26979d099b4fSAlexander V. Chernikov /* 26989d099b4fSAlexander V. Chernikov * Lists all table algorithms currently available. 26999d099b4fSAlexander V. Chernikov * Data layout (v0)(current): 27009d099b4fSAlexander V. Chernikov * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size 27019d099b4fSAlexander V. Chernikov * Reply: [ ipfw_obj_lheader ipfw_ta_info x N ] 27029d099b4fSAlexander V. Chernikov * 27039d099b4fSAlexander V. Chernikov * Returns 0 on success 27049d099b4fSAlexander V. Chernikov */ 27056b988f3aSAlexander V. Chernikov static int 27066b988f3aSAlexander V. Chernikov list_table_algo(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 2707e822d936SAlexander V. Chernikov struct sockopt_data *sd) 27089d099b4fSAlexander V. Chernikov { 27099d099b4fSAlexander V. Chernikov struct _ipfw_obj_lheader *olh; 27109d099b4fSAlexander V. Chernikov struct tables_config *tcfg; 27119d099b4fSAlexander V. Chernikov ipfw_ta_info *i; 27129d099b4fSAlexander V. Chernikov struct table_algo *ta; 27139d099b4fSAlexander V. Chernikov uint32_t count, n, size; 27149d099b4fSAlexander V. Chernikov 27159d099b4fSAlexander V. Chernikov olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh)); 27169d099b4fSAlexander V. Chernikov if (olh == NULL) 27179d099b4fSAlexander V. Chernikov return (EINVAL); 27189d099b4fSAlexander V. Chernikov if (sd->valsize < olh->size) 27199d099b4fSAlexander V. Chernikov return (EINVAL); 27209d099b4fSAlexander V. Chernikov 27219d099b4fSAlexander V. Chernikov IPFW_UH_RLOCK(ch); 27229d099b4fSAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 27239d099b4fSAlexander V. Chernikov count = tcfg->algo_count; 27249d099b4fSAlexander V. Chernikov size = count * sizeof(ipfw_ta_info) + sizeof(ipfw_obj_lheader); 27259d099b4fSAlexander V. Chernikov 27269d099b4fSAlexander V. Chernikov /* Fill in header regadless of buffer size */ 27279d099b4fSAlexander V. Chernikov olh->count = count; 27289d099b4fSAlexander V. Chernikov olh->objsize = sizeof(ipfw_ta_info); 27299d099b4fSAlexander V. Chernikov 27309d099b4fSAlexander V. Chernikov if (size > olh->size) { 27319d099b4fSAlexander V. Chernikov olh->size = size; 27329d099b4fSAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 27339d099b4fSAlexander V. Chernikov return (ENOMEM); 27349d099b4fSAlexander V. Chernikov } 27359d099b4fSAlexander V. Chernikov olh->size = size; 27369d099b4fSAlexander V. Chernikov 27379d099b4fSAlexander V. Chernikov for (n = 1; n <= count; n++) { 27389d099b4fSAlexander V. Chernikov i = (ipfw_ta_info *)ipfw_get_sopt_space(sd, sizeof(*i)); 27399d099b4fSAlexander V. Chernikov KASSERT(i != 0, ("previously checked buffer is not enough")); 27409d099b4fSAlexander V. Chernikov ta = tcfg->algo[n]; 27419d099b4fSAlexander V. Chernikov strlcpy(i->algoname, ta->name, sizeof(i->algoname)); 27429d099b4fSAlexander V. Chernikov i->type = ta->type; 27439d099b4fSAlexander V. Chernikov i->refcnt = ta->refcnt; 27449d099b4fSAlexander V. Chernikov } 27459d099b4fSAlexander V. Chernikov 27469d099b4fSAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 27479d099b4fSAlexander V. Chernikov 27489d099b4fSAlexander V. Chernikov return (0); 27499d099b4fSAlexander V. Chernikov } 27509d099b4fSAlexander V. Chernikov 2751b074b7bbSAlexander V. Chernikov /* 2752b074b7bbSAlexander V. Chernikov * Tables rewriting code 2753b074b7bbSAlexander V. Chernikov */ 2754b074b7bbSAlexander V. Chernikov 2755b074b7bbSAlexander V. Chernikov /* 2756b074b7bbSAlexander V. Chernikov * Determine table number and lookup type for @cmd. 2757b074b7bbSAlexander V. Chernikov * Fill @tbl and @type with appropriate values. 2758b074b7bbSAlexander V. Chernikov * Returns 0 for relevant opcodes, 1 otherwise. 2759b074b7bbSAlexander V. Chernikov */ 2760b074b7bbSAlexander V. Chernikov static int 2761b074b7bbSAlexander V. Chernikov classify_table_opcode(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 2762b074b7bbSAlexander V. Chernikov { 2763b074b7bbSAlexander V. Chernikov ipfw_insn_if *cmdif; 2764b074b7bbSAlexander V. Chernikov int skip; 2765b074b7bbSAlexander V. Chernikov uint16_t v; 2766b074b7bbSAlexander V. Chernikov 2767b074b7bbSAlexander V. Chernikov skip = 1; 2768b074b7bbSAlexander V. Chernikov 2769b074b7bbSAlexander V. Chernikov switch (cmd->opcode) { 2770b074b7bbSAlexander V. Chernikov case O_IP_SRC_LOOKUP: 2771b074b7bbSAlexander V. Chernikov case O_IP_DST_LOOKUP: 2772b074b7bbSAlexander V. Chernikov /* Basic IPv4/IPv6 or u32 lookups */ 2773b074b7bbSAlexander V. Chernikov *puidx = cmd->arg1; 2774c21034b7SAlexander V. Chernikov /* Assume ADDR by default */ 2775c21034b7SAlexander V. Chernikov *ptype = IPFW_TABLE_ADDR; 2776b074b7bbSAlexander V. Chernikov skip = 0; 2777b074b7bbSAlexander V. Chernikov 2778b074b7bbSAlexander V. Chernikov if (F_LEN(cmd) > F_INSN_SIZE(ipfw_insn_u32)) { 2779b074b7bbSAlexander V. Chernikov /* 2780b074b7bbSAlexander V. Chernikov * generic lookup. The key must be 2781b074b7bbSAlexander V. Chernikov * in 32bit big-endian format. 2782b074b7bbSAlexander V. Chernikov */ 2783b074b7bbSAlexander V. Chernikov v = ((ipfw_insn_u32 *)cmd)->d[1]; 2784b074b7bbSAlexander V. Chernikov switch (v) { 2785b074b7bbSAlexander V. Chernikov case 0: 2786b074b7bbSAlexander V. Chernikov case 1: 2787b074b7bbSAlexander V. Chernikov /* IPv4 src/dst */ 2788b074b7bbSAlexander V. Chernikov break; 2789b074b7bbSAlexander V. Chernikov case 2: 2790b074b7bbSAlexander V. Chernikov case 3: 2791b074b7bbSAlexander V. Chernikov /* src/dst port */ 2792b23d5de9SAlexander V. Chernikov *ptype = IPFW_TABLE_NUMBER; 2793b074b7bbSAlexander V. Chernikov break; 2794b074b7bbSAlexander V. Chernikov case 4: 2795b074b7bbSAlexander V. Chernikov /* uid/gid */ 2796b23d5de9SAlexander V. Chernikov *ptype = IPFW_TABLE_NUMBER; 2797b23d5de9SAlexander V. Chernikov break; 2798b074b7bbSAlexander V. Chernikov case 5: 2799b074b7bbSAlexander V. Chernikov /* jid */ 2800b23d5de9SAlexander V. Chernikov *ptype = IPFW_TABLE_NUMBER; 2801b23d5de9SAlexander V. Chernikov break; 2802b074b7bbSAlexander V. Chernikov case 6: 2803b074b7bbSAlexander V. Chernikov /* dscp */ 2804b23d5de9SAlexander V. Chernikov *ptype = IPFW_TABLE_NUMBER; 2805b074b7bbSAlexander V. Chernikov break; 2806b074b7bbSAlexander V. Chernikov } 2807b074b7bbSAlexander V. Chernikov } 2808b074b7bbSAlexander V. Chernikov break; 2809b074b7bbSAlexander V. Chernikov case O_XMIT: 2810b074b7bbSAlexander V. Chernikov case O_RECV: 2811b074b7bbSAlexander V. Chernikov case O_VIA: 2812b074b7bbSAlexander V. Chernikov /* Interface table, possibly */ 2813b074b7bbSAlexander V. Chernikov cmdif = (ipfw_insn_if *)cmd; 2814b074b7bbSAlexander V. Chernikov if (cmdif->name[0] != '\1') 2815b074b7bbSAlexander V. Chernikov break; 2816b074b7bbSAlexander V. Chernikov 2817b074b7bbSAlexander V. Chernikov *ptype = IPFW_TABLE_INTERFACE; 28181940fa77SAlexander V. Chernikov *puidx = cmdif->p.kidx; 2819b074b7bbSAlexander V. Chernikov skip = 0; 2820b074b7bbSAlexander V. Chernikov break; 2821914bffb6SAlexander V. Chernikov case O_IP_FLOW_LOOKUP: 2822914bffb6SAlexander V. Chernikov *puidx = cmd->arg1; 2823914bffb6SAlexander V. Chernikov *ptype = IPFW_TABLE_FLOW; 2824914bffb6SAlexander V. Chernikov skip = 0; 2825914bffb6SAlexander V. Chernikov break; 2826b074b7bbSAlexander V. Chernikov } 2827b074b7bbSAlexander V. Chernikov 2828b074b7bbSAlexander V. Chernikov return (skip); 2829b074b7bbSAlexander V. Chernikov } 2830b074b7bbSAlexander V. Chernikov 2831b074b7bbSAlexander V. Chernikov /* 2832b074b7bbSAlexander V. Chernikov * Sets new table value for given opcode. 2833b074b7bbSAlexander V. Chernikov * Assume the same opcodes as classify_table_opcode() 2834b074b7bbSAlexander V. Chernikov */ 2835b074b7bbSAlexander V. Chernikov static void 2836b074b7bbSAlexander V. Chernikov update_table_opcode(ipfw_insn *cmd, uint16_t idx) 2837b074b7bbSAlexander V. Chernikov { 2838b074b7bbSAlexander V. Chernikov ipfw_insn_if *cmdif; 2839b074b7bbSAlexander V. Chernikov 2840b074b7bbSAlexander V. Chernikov switch (cmd->opcode) { 2841b074b7bbSAlexander V. Chernikov case O_IP_SRC_LOOKUP: 2842b074b7bbSAlexander V. Chernikov case O_IP_DST_LOOKUP: 2843b074b7bbSAlexander V. Chernikov /* Basic IPv4/IPv6 or u32 lookups */ 2844b074b7bbSAlexander V. Chernikov cmd->arg1 = idx; 2845b074b7bbSAlexander V. Chernikov break; 2846b074b7bbSAlexander V. Chernikov case O_XMIT: 2847b074b7bbSAlexander V. Chernikov case O_RECV: 2848b074b7bbSAlexander V. Chernikov case O_VIA: 2849b074b7bbSAlexander V. Chernikov /* Interface table, possibly */ 2850b074b7bbSAlexander V. Chernikov cmdif = (ipfw_insn_if *)cmd; 28511940fa77SAlexander V. Chernikov cmdif->p.kidx = idx; 2852b074b7bbSAlexander V. Chernikov break; 2853914bffb6SAlexander V. Chernikov case O_IP_FLOW_LOOKUP: 2854914bffb6SAlexander V. Chernikov cmd->arg1 = idx; 2855914bffb6SAlexander V. Chernikov break; 2856b074b7bbSAlexander V. Chernikov } 2857b074b7bbSAlexander V. Chernikov } 2858b074b7bbSAlexander V. Chernikov 2859ac35ff17SAlexander V. Chernikov /* 2860ac35ff17SAlexander V. Chernikov * Checks table name for validity. 2861ac35ff17SAlexander V. Chernikov * Enforce basic length checks, the rest 2862ac35ff17SAlexander V. Chernikov * should be done in userland. 2863ac35ff17SAlexander V. Chernikov * 2864ac35ff17SAlexander V. Chernikov * Returns 0 if name is considered valid. 2865ac35ff17SAlexander V. Chernikov */ 2866ac35ff17SAlexander V. Chernikov int 2867ac35ff17SAlexander V. Chernikov ipfw_check_table_name(char *name) 2868ac35ff17SAlexander V. Chernikov { 2869ac35ff17SAlexander V. Chernikov int nsize; 2870ac35ff17SAlexander V. Chernikov ipfw_obj_ntlv *ntlv = NULL; 2871ac35ff17SAlexander V. Chernikov 2872ac35ff17SAlexander V. Chernikov nsize = sizeof(ntlv->name); 2873ac35ff17SAlexander V. Chernikov 2874ac35ff17SAlexander V. Chernikov if (strnlen(name, nsize) == nsize) 2875ac35ff17SAlexander V. Chernikov return (EINVAL); 2876ac35ff17SAlexander V. Chernikov 2877ac35ff17SAlexander V. Chernikov if (name[0] == '\0') 2878ac35ff17SAlexander V. Chernikov return (EINVAL); 2879ac35ff17SAlexander V. Chernikov 2880ac35ff17SAlexander V. Chernikov /* 2881ac35ff17SAlexander V. Chernikov * TODO: do some more complicated checks 2882ac35ff17SAlexander V. Chernikov */ 2883ac35ff17SAlexander V. Chernikov 2884ac35ff17SAlexander V. Chernikov return (0); 2885ac35ff17SAlexander V. Chernikov } 2886ac35ff17SAlexander V. Chernikov 2887ac35ff17SAlexander V. Chernikov /* 2888ac35ff17SAlexander V. Chernikov * Find tablename TLV by @uid. 2889ac35ff17SAlexander V. Chernikov * Check @tlvs for valid data inside. 2890ac35ff17SAlexander V. Chernikov * 2891ac35ff17SAlexander V. Chernikov * Returns pointer to found TLV or NULL. 2892ac35ff17SAlexander V. Chernikov */ 2893ac35ff17SAlexander V. Chernikov static ipfw_obj_ntlv * 2894b074b7bbSAlexander V. Chernikov find_name_tlv(void *tlvs, int len, uint16_t uidx) 2895b074b7bbSAlexander V. Chernikov { 28969f7d47b0SAlexander V. Chernikov ipfw_obj_ntlv *ntlv; 2897b074b7bbSAlexander V. Chernikov uintptr_t pa, pe; 2898b074b7bbSAlexander V. Chernikov int l; 2899b074b7bbSAlexander V. Chernikov 2900b074b7bbSAlexander V. Chernikov pa = (uintptr_t)tlvs; 2901b074b7bbSAlexander V. Chernikov pe = pa + len; 2902b074b7bbSAlexander V. Chernikov l = 0; 2903b074b7bbSAlexander V. Chernikov for (; pa < pe; pa += l) { 29049f7d47b0SAlexander V. Chernikov ntlv = (ipfw_obj_ntlv *)pa; 2905b074b7bbSAlexander V. Chernikov l = ntlv->head.length; 2906ac35ff17SAlexander V. Chernikov 2907ac35ff17SAlexander V. Chernikov if (l != sizeof(*ntlv)) 2908ac35ff17SAlexander V. Chernikov return (NULL); 2909ac35ff17SAlexander V. Chernikov 2910563b5ab1SAlexander V. Chernikov if (ntlv->head.type != IPFW_TLV_TBL_NAME) 2911b074b7bbSAlexander V. Chernikov continue; 2912ac35ff17SAlexander V. Chernikov 2913b074b7bbSAlexander V. Chernikov if (ntlv->idx != uidx) 2914b074b7bbSAlexander V. Chernikov continue; 2915b074b7bbSAlexander V. Chernikov 2916ac35ff17SAlexander V. Chernikov if (ipfw_check_table_name(ntlv->name) != 0) 2917ac35ff17SAlexander V. Chernikov return (NULL); 2918ac35ff17SAlexander V. Chernikov 2919ac35ff17SAlexander V. Chernikov return (ntlv); 2920b074b7bbSAlexander V. Chernikov } 2921b074b7bbSAlexander V. Chernikov 2922b074b7bbSAlexander V. Chernikov return (NULL); 2923b074b7bbSAlexander V. Chernikov } 2924b074b7bbSAlexander V. Chernikov 2925ac35ff17SAlexander V. Chernikov /* 2926ac35ff17SAlexander V. Chernikov * Finds table config based on either legacy index 2927ac35ff17SAlexander V. Chernikov * or name in ntlv. 2928ac35ff17SAlexander V. Chernikov * Note @ti structure contains unchecked data from userland. 2929ac35ff17SAlexander V. Chernikov * 2930ac35ff17SAlexander V. Chernikov * Returns pointer to table_config or NULL. 2931ac35ff17SAlexander V. Chernikov */ 2932b074b7bbSAlexander V. Chernikov static struct table_config * 2933b074b7bbSAlexander V. Chernikov find_table(struct namedobj_instance *ni, struct tid_info *ti) 2934b074b7bbSAlexander V. Chernikov { 2935b074b7bbSAlexander V. Chernikov char *name, bname[16]; 2936b074b7bbSAlexander V. Chernikov struct named_object *no; 2937ac35ff17SAlexander V. Chernikov ipfw_obj_ntlv *ntlv; 2938ac35ff17SAlexander V. Chernikov uint32_t set; 2939b074b7bbSAlexander V. Chernikov 2940b074b7bbSAlexander V. Chernikov if (ti->tlvs != NULL) { 2941ac35ff17SAlexander V. Chernikov ntlv = find_name_tlv(ti->tlvs, ti->tlen, ti->uidx); 2942ac35ff17SAlexander V. Chernikov if (ntlv == NULL) 2943b074b7bbSAlexander V. Chernikov return (NULL); 2944ac35ff17SAlexander V. Chernikov name = ntlv->name; 294540e5f498SAlexander V. Chernikov 294640e5f498SAlexander V. Chernikov /* 294740e5f498SAlexander V. Chernikov * Use set provided by @ti instead of @ntlv one. 294840e5f498SAlexander V. Chernikov * This is needed due to different sets behavior 294940e5f498SAlexander V. Chernikov * controlled by V_fw_tables_sets. 295040e5f498SAlexander V. Chernikov */ 295140e5f498SAlexander V. Chernikov set = ti->set; 2952b074b7bbSAlexander V. Chernikov } else { 2953b074b7bbSAlexander V. Chernikov snprintf(bname, sizeof(bname), "%d", ti->uidx); 2954b074b7bbSAlexander V. Chernikov name = bname; 2955ac35ff17SAlexander V. Chernikov set = 0; 2956b074b7bbSAlexander V. Chernikov } 2957b074b7bbSAlexander V. Chernikov 2958ac35ff17SAlexander V. Chernikov no = ipfw_objhash_lookup_name(ni, set, name); 2959b074b7bbSAlexander V. Chernikov 2960b074b7bbSAlexander V. Chernikov return ((struct table_config *)no); 2961b074b7bbSAlexander V. Chernikov } 2962b074b7bbSAlexander V. Chernikov 296335e1bbd0SAlexander V. Chernikov /* 296435e1bbd0SAlexander V. Chernikov * Allocate new table config structure using 296535e1bbd0SAlexander V. Chernikov * specified @algo and @aname. 296635e1bbd0SAlexander V. Chernikov * 296735e1bbd0SAlexander V. Chernikov * Returns pointer to config or NULL. 296835e1bbd0SAlexander V. Chernikov */ 2969b074b7bbSAlexander V. Chernikov static struct table_config * 297068394ec8SAlexander V. Chernikov alloc_table_config(struct ip_fw_chain *ch, struct tid_info *ti, 29710cba2b28SAlexander V. Chernikov struct table_algo *ta, char *aname, uint8_t tflags) 2972b074b7bbSAlexander V. Chernikov { 2973b074b7bbSAlexander V. Chernikov char *name, bname[16]; 2974b074b7bbSAlexander V. Chernikov struct table_config *tc; 2975b074b7bbSAlexander V. Chernikov int error; 2976ac35ff17SAlexander V. Chernikov ipfw_obj_ntlv *ntlv; 2977ac35ff17SAlexander V. Chernikov uint32_t set; 2978b074b7bbSAlexander V. Chernikov 2979b074b7bbSAlexander V. Chernikov if (ti->tlvs != NULL) { 2980ac35ff17SAlexander V. Chernikov ntlv = find_name_tlv(ti->tlvs, ti->tlen, ti->uidx); 2981ac35ff17SAlexander V. Chernikov if (ntlv == NULL) 2982b074b7bbSAlexander V. Chernikov return (NULL); 2983ac35ff17SAlexander V. Chernikov name = ntlv->name; 2984ac35ff17SAlexander V. Chernikov set = ntlv->set; 2985b074b7bbSAlexander V. Chernikov } else { 2986b074b7bbSAlexander V. Chernikov snprintf(bname, sizeof(bname), "%d", ti->uidx); 2987b074b7bbSAlexander V. Chernikov name = bname; 2988ac35ff17SAlexander V. Chernikov set = 0; 2989b074b7bbSAlexander V. Chernikov } 2990b074b7bbSAlexander V. Chernikov 2991b074b7bbSAlexander V. Chernikov tc = malloc(sizeof(struct table_config), M_IPFW, M_WAITOK | M_ZERO); 2992b074b7bbSAlexander V. Chernikov tc->no.name = tc->tablename; 2993fd0869d5SAlexander V. Chernikov tc->no.type = ta->type; 2994ac35ff17SAlexander V. Chernikov tc->no.set = set; 2995914bffb6SAlexander V. Chernikov tc->tflags = tflags; 29969f7d47b0SAlexander V. Chernikov tc->ta = ta; 2997b074b7bbSAlexander V. Chernikov strlcpy(tc->tablename, name, sizeof(tc->tablename)); 29980cba2b28SAlexander V. Chernikov /* Set "shared" value type by default */ 29990cba2b28SAlexander V. Chernikov tc->vshared = 1; 3000b074b7bbSAlexander V. Chernikov 3001b074b7bbSAlexander V. Chernikov if (ti->tlvs == NULL) { 3002b074b7bbSAlexander V. Chernikov tc->no.compat = 1; 3003b074b7bbSAlexander V. Chernikov tc->no.uidx = ti->uidx; 3004b074b7bbSAlexander V. Chernikov } 3005b074b7bbSAlexander V. Chernikov 3006b074b7bbSAlexander V. Chernikov /* Preallocate data structures for new tables */ 3007914bffb6SAlexander V. Chernikov error = ta->init(ch, &tc->astate, &tc->ti, aname, tflags); 3008b074b7bbSAlexander V. Chernikov if (error != 0) { 3009b074b7bbSAlexander V. Chernikov free(tc, M_IPFW); 3010b074b7bbSAlexander V. Chernikov return (NULL); 3011b074b7bbSAlexander V. Chernikov } 3012b074b7bbSAlexander V. Chernikov 3013b074b7bbSAlexander V. Chernikov return (tc); 3014b074b7bbSAlexander V. Chernikov } 3015b074b7bbSAlexander V. Chernikov 301635e1bbd0SAlexander V. Chernikov /* 301735e1bbd0SAlexander V. Chernikov * Destroys table state and config. 301835e1bbd0SAlexander V. Chernikov */ 3019b074b7bbSAlexander V. Chernikov static void 3020b074b7bbSAlexander V. Chernikov free_table_config(struct namedobj_instance *ni, struct table_config *tc) 3021b074b7bbSAlexander V. Chernikov { 3022b074b7bbSAlexander V. Chernikov 302335e1bbd0SAlexander V. Chernikov KASSERT(tc->linked == 0, ("free() on linked config")); 3024b074b7bbSAlexander V. Chernikov 30250468c5baSAlexander V. Chernikov /* 30260468c5baSAlexander V. Chernikov * We're using ta without any locking/referencing. 30270468c5baSAlexander V. Chernikov * TODO: fix this if we're going to use unloadable algos. 30280468c5baSAlexander V. Chernikov */ 302935e1bbd0SAlexander V. Chernikov tc->ta->destroy(tc->astate, &tc->ti); 3030b074b7bbSAlexander V. Chernikov free(tc, M_IPFW); 3031b074b7bbSAlexander V. Chernikov } 3032b074b7bbSAlexander V. Chernikov 3033b074b7bbSAlexander V. Chernikov /* 3034b074b7bbSAlexander V. Chernikov * Links @tc to @chain table named instance. 3035b074b7bbSAlexander V. Chernikov * Sets appropriate type/states in @chain table info. 3036b074b7bbSAlexander V. Chernikov */ 3037b074b7bbSAlexander V. Chernikov static void 30389f7d47b0SAlexander V. Chernikov link_table(struct ip_fw_chain *ch, struct table_config *tc) 3039b074b7bbSAlexander V. Chernikov { 3040b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 30419f7d47b0SAlexander V. Chernikov struct table_info *ti; 3042b074b7bbSAlexander V. Chernikov uint16_t kidx; 3043b074b7bbSAlexander V. Chernikov 30449f7d47b0SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 30459f7d47b0SAlexander V. Chernikov IPFW_WLOCK_ASSERT(ch); 3046b074b7bbSAlexander V. Chernikov 30479f7d47b0SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 3048b074b7bbSAlexander V. Chernikov kidx = tc->no.kidx; 3049b074b7bbSAlexander V. Chernikov 3050b074b7bbSAlexander V. Chernikov ipfw_objhash_add(ni, &tc->no); 30519f7d47b0SAlexander V. Chernikov 30529f7d47b0SAlexander V. Chernikov ti = KIDX_TO_TI(ch, kidx); 30539f7d47b0SAlexander V. Chernikov *ti = tc->ti; 3054b074b7bbSAlexander V. Chernikov 305568394ec8SAlexander V. Chernikov /* Notify algo on real @ti address */ 305668394ec8SAlexander V. Chernikov if (tc->ta->change_ti != NULL) 305768394ec8SAlexander V. Chernikov tc->ta->change_ti(tc->astate, ti); 305868394ec8SAlexander V. Chernikov 3059b074b7bbSAlexander V. Chernikov tc->linked = 1; 30609d099b4fSAlexander V. Chernikov tc->ta->refcnt++; 3061b074b7bbSAlexander V. Chernikov } 3062b074b7bbSAlexander V. Chernikov 3063b074b7bbSAlexander V. Chernikov /* 3064b074b7bbSAlexander V. Chernikov * Unlinks @tc from @chain table named instance. 3065b074b7bbSAlexander V. Chernikov * Zeroes states in @chain and stores them in @tc. 3066b074b7bbSAlexander V. Chernikov */ 3067b074b7bbSAlexander V. Chernikov static void 30689f7d47b0SAlexander V. Chernikov unlink_table(struct ip_fw_chain *ch, struct table_config *tc) 3069b074b7bbSAlexander V. Chernikov { 3070b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 30719f7d47b0SAlexander V. Chernikov struct table_info *ti; 3072b074b7bbSAlexander V. Chernikov uint16_t kidx; 3073b074b7bbSAlexander V. Chernikov 30749f7d47b0SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 30759f7d47b0SAlexander V. Chernikov IPFW_WLOCK_ASSERT(ch); 3076b074b7bbSAlexander V. Chernikov 30779f7d47b0SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 3078b074b7bbSAlexander V. Chernikov kidx = tc->no.kidx; 3079b074b7bbSAlexander V. Chernikov 30809f7d47b0SAlexander V. Chernikov /* Clear state. @ti copy is already saved inside @tc */ 3081b074b7bbSAlexander V. Chernikov ipfw_objhash_del(ni, &tc->no); 30829f7d47b0SAlexander V. Chernikov ti = KIDX_TO_TI(ch, kidx); 30839f7d47b0SAlexander V. Chernikov memset(ti, 0, sizeof(struct table_info)); 3084b074b7bbSAlexander V. Chernikov tc->linked = 0; 30859d099b4fSAlexander V. Chernikov tc->ta->refcnt--; 308668394ec8SAlexander V. Chernikov 308768394ec8SAlexander V. Chernikov /* Notify algo on real @ti address */ 308868394ec8SAlexander V. Chernikov if (tc->ta->change_ti != NULL) 308968394ec8SAlexander V. Chernikov tc->ta->change_ti(tc->astate, NULL); 3090b074b7bbSAlexander V. Chernikov } 3091b074b7bbSAlexander V. Chernikov 3092a73d728dSAlexander V. Chernikov struct swap_table_args { 3093a73d728dSAlexander V. Chernikov int set; 3094a73d728dSAlexander V. Chernikov int new_set; 3095a73d728dSAlexander V. Chernikov int mv; 3096a73d728dSAlexander V. Chernikov }; 3097a73d728dSAlexander V. Chernikov 3098a73d728dSAlexander V. Chernikov /* 3099a73d728dSAlexander V. Chernikov * Change set for each matching table. 3100a73d728dSAlexander V. Chernikov * 3101a73d728dSAlexander V. Chernikov * Ensure we dispatch each table once by setting/checking ochange 3102a73d728dSAlexander V. Chernikov * fields. 3103a73d728dSAlexander V. Chernikov */ 3104a73d728dSAlexander V. Chernikov static void 3105a73d728dSAlexander V. Chernikov swap_table_set(struct namedobj_instance *ni, struct named_object *no, 3106a73d728dSAlexander V. Chernikov void *arg) 3107a73d728dSAlexander V. Chernikov { 3108a73d728dSAlexander V. Chernikov struct table_config *tc; 3109a73d728dSAlexander V. Chernikov struct swap_table_args *sta; 3110a73d728dSAlexander V. Chernikov 3111a73d728dSAlexander V. Chernikov tc = (struct table_config *)no; 3112a73d728dSAlexander V. Chernikov sta = (struct swap_table_args *)arg; 3113a73d728dSAlexander V. Chernikov 3114a73d728dSAlexander V. Chernikov if (no->set != sta->set && (no->set != sta->new_set || sta->mv != 0)) 3115a73d728dSAlexander V. Chernikov return; 3116a73d728dSAlexander V. Chernikov 3117a73d728dSAlexander V. Chernikov if (tc->ochanged != 0) 3118a73d728dSAlexander V. Chernikov return; 3119a73d728dSAlexander V. Chernikov 3120a73d728dSAlexander V. Chernikov tc->ochanged = 1; 3121a73d728dSAlexander V. Chernikov ipfw_objhash_del(ni, no); 3122a73d728dSAlexander V. Chernikov if (no->set == sta->set) 3123a73d728dSAlexander V. Chernikov no->set = sta->new_set; 3124a73d728dSAlexander V. Chernikov else 3125a73d728dSAlexander V. Chernikov no->set = sta->set; 3126a73d728dSAlexander V. Chernikov ipfw_objhash_add(ni, no); 3127a73d728dSAlexander V. Chernikov } 3128a73d728dSAlexander V. Chernikov 3129a73d728dSAlexander V. Chernikov /* 3130a73d728dSAlexander V. Chernikov * Cleans up ochange field for all tables. 3131a73d728dSAlexander V. Chernikov */ 3132a73d728dSAlexander V. Chernikov static void 3133a73d728dSAlexander V. Chernikov clean_table_set_data(struct namedobj_instance *ni, struct named_object *no, 3134a73d728dSAlexander V. Chernikov void *arg) 3135a73d728dSAlexander V. Chernikov { 3136a73d728dSAlexander V. Chernikov struct table_config *tc; 3137a73d728dSAlexander V. Chernikov struct swap_table_args *sta; 3138a73d728dSAlexander V. Chernikov 3139a73d728dSAlexander V. Chernikov tc = (struct table_config *)no; 3140a73d728dSAlexander V. Chernikov sta = (struct swap_table_args *)arg; 3141a73d728dSAlexander V. Chernikov 3142a73d728dSAlexander V. Chernikov tc->ochanged = 0; 3143a73d728dSAlexander V. Chernikov } 3144a73d728dSAlexander V. Chernikov 3145a73d728dSAlexander V. Chernikov /* 3146a73d728dSAlexander V. Chernikov * Swaps tables within two sets. 3147a73d728dSAlexander V. Chernikov */ 3148a73d728dSAlexander V. Chernikov void 3149a73d728dSAlexander V. Chernikov ipfw_swap_tables_sets(struct ip_fw_chain *ch, uint32_t set, 3150a73d728dSAlexander V. Chernikov uint32_t new_set, int mv) 3151a73d728dSAlexander V. Chernikov { 3152a73d728dSAlexander V. Chernikov struct swap_table_args sta; 3153a73d728dSAlexander V. Chernikov 3154a73d728dSAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 3155a73d728dSAlexander V. Chernikov 3156a73d728dSAlexander V. Chernikov sta.set = set; 3157a73d728dSAlexander V. Chernikov sta.new_set = new_set; 3158a73d728dSAlexander V. Chernikov sta.mv = mv; 3159a73d728dSAlexander V. Chernikov 3160a73d728dSAlexander V. Chernikov ipfw_objhash_foreach(CHAIN_TO_NI(ch), swap_table_set, &sta); 3161a73d728dSAlexander V. Chernikov ipfw_objhash_foreach(CHAIN_TO_NI(ch), clean_table_set_data, &sta); 3162a73d728dSAlexander V. Chernikov } 3163a73d728dSAlexander V. Chernikov 3164a73d728dSAlexander V. Chernikov /* 3165a73d728dSAlexander V. Chernikov * Move all tables which are reference by rules in @rr to set @new_set. 3166a73d728dSAlexander V. Chernikov * Makes sure that all relevant tables are referenced ONLLY by given rules. 3167a73d728dSAlexander V. Chernikov * 3168a73d728dSAlexander V. Chernikov * Retuns 0 on success, 3169a73d728dSAlexander V. Chernikov */ 3170a73d728dSAlexander V. Chernikov int 3171a73d728dSAlexander V. Chernikov ipfw_move_tables_sets(struct ip_fw_chain *ch, ipfw_range_tlv *rt, 3172a73d728dSAlexander V. Chernikov uint32_t new_set) 3173a73d728dSAlexander V. Chernikov { 3174a73d728dSAlexander V. Chernikov struct ip_fw *rule; 3175a73d728dSAlexander V. Chernikov struct table_config *tc; 3176a73d728dSAlexander V. Chernikov struct named_object *no; 3177a73d728dSAlexander V. Chernikov struct namedobj_instance *ni; 3178a73d728dSAlexander V. Chernikov int bad, i, l, cmdlen; 3179a73d728dSAlexander V. Chernikov uint16_t kidx; 3180a73d728dSAlexander V. Chernikov uint8_t type; 3181a73d728dSAlexander V. Chernikov ipfw_insn *cmd; 3182a73d728dSAlexander V. Chernikov 3183a73d728dSAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 3184a73d728dSAlexander V. Chernikov 3185a73d728dSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 3186a73d728dSAlexander V. Chernikov 3187a73d728dSAlexander V. Chernikov /* Stage 1: count number of references by given rules */ 3188a73d728dSAlexander V. Chernikov for (i = 0; i < ch->n_rules - 1; i++) { 3189a73d728dSAlexander V. Chernikov rule = ch->map[i]; 3190a73d728dSAlexander V. Chernikov if (ipfw_match_range(rule, rt) == 0) 3191a73d728dSAlexander V. Chernikov continue; 3192a73d728dSAlexander V. Chernikov 3193a73d728dSAlexander V. Chernikov l = rule->cmd_len; 3194a73d728dSAlexander V. Chernikov cmd = rule->cmd; 3195a73d728dSAlexander V. Chernikov cmdlen = 0; 3196a73d728dSAlexander V. Chernikov for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 3197a73d728dSAlexander V. Chernikov cmdlen = F_LEN(cmd); 3198a73d728dSAlexander V. Chernikov if (classify_table_opcode(cmd, &kidx, &type) != 0) 3199a73d728dSAlexander V. Chernikov continue; 3200a73d728dSAlexander V. Chernikov no = ipfw_objhash_lookup_kidx(ni, kidx); 3201a73d728dSAlexander V. Chernikov KASSERT(no != NULL, 3202a73d728dSAlexander V. Chernikov ("objhash lookup failed on index %d", kidx)); 3203a73d728dSAlexander V. Chernikov tc = (struct table_config *)no; 3204a73d728dSAlexander V. Chernikov tc->ocount++; 3205a73d728dSAlexander V. Chernikov } 3206a73d728dSAlexander V. Chernikov 3207a73d728dSAlexander V. Chernikov } 3208a73d728dSAlexander V. Chernikov 3209a73d728dSAlexander V. Chernikov /* Stage 2: verify "ownership" */ 3210a73d728dSAlexander V. Chernikov bad = 0; 3211a73d728dSAlexander V. Chernikov for (i = 0; i < ch->n_rules - 1; i++) { 3212a73d728dSAlexander V. Chernikov rule = ch->map[i]; 3213a73d728dSAlexander V. Chernikov if (ipfw_match_range(rule, rt) == 0) 3214a73d728dSAlexander V. Chernikov continue; 3215a73d728dSAlexander V. Chernikov 3216a73d728dSAlexander V. Chernikov l = rule->cmd_len; 3217a73d728dSAlexander V. Chernikov cmd = rule->cmd; 3218a73d728dSAlexander V. Chernikov cmdlen = 0; 3219a73d728dSAlexander V. Chernikov for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 3220a73d728dSAlexander V. Chernikov cmdlen = F_LEN(cmd); 3221a73d728dSAlexander V. Chernikov if (classify_table_opcode(cmd, &kidx, &type) != 0) 3222a73d728dSAlexander V. Chernikov continue; 3223a73d728dSAlexander V. Chernikov no = ipfw_objhash_lookup_kidx(ni, kidx); 3224a73d728dSAlexander V. Chernikov KASSERT(no != NULL, 3225a73d728dSAlexander V. Chernikov ("objhash lookup failed on index %d", kidx)); 3226a73d728dSAlexander V. Chernikov tc = (struct table_config *)no; 3227a73d728dSAlexander V. Chernikov if (tc->no.refcnt != tc->ocount) { 3228a73d728dSAlexander V. Chernikov 3229a73d728dSAlexander V. Chernikov /* 3230a73d728dSAlexander V. Chernikov * Number of references differ: 3231a73d728dSAlexander V. Chernikov * Other rule(s) are holding reference to given 3232a73d728dSAlexander V. Chernikov * table, so it is not possible to change its set. 3233a73d728dSAlexander V. Chernikov * 3234a73d728dSAlexander V. Chernikov * Note that refcnt may account 3235a73d728dSAlexander V. Chernikov * references to some going-to-be-added rules. 3236a73d728dSAlexander V. Chernikov * Since we don't know their numbers (and event 3237a73d728dSAlexander V. Chernikov * if they will be added) it is perfectly OK 3238a73d728dSAlexander V. Chernikov * to return error here. 3239a73d728dSAlexander V. Chernikov */ 3240a73d728dSAlexander V. Chernikov bad = 1; 3241a73d728dSAlexander V. Chernikov break; 3242a73d728dSAlexander V. Chernikov } 3243a73d728dSAlexander V. Chernikov } 3244a73d728dSAlexander V. Chernikov 3245a73d728dSAlexander V. Chernikov if (bad != 0) 3246a73d728dSAlexander V. Chernikov break; 3247a73d728dSAlexander V. Chernikov } 3248a73d728dSAlexander V. Chernikov 3249a73d728dSAlexander V. Chernikov /* Stage 3: change set or cleanup */ 3250a73d728dSAlexander V. Chernikov for (i = 0; i < ch->n_rules - 1; i++) { 3251a73d728dSAlexander V. Chernikov rule = ch->map[i]; 3252a73d728dSAlexander V. Chernikov if (ipfw_match_range(rule, rt) == 0) 3253a73d728dSAlexander V. Chernikov continue; 3254a73d728dSAlexander V. Chernikov 3255a73d728dSAlexander V. Chernikov l = rule->cmd_len; 3256a73d728dSAlexander V. Chernikov cmd = rule->cmd; 3257a73d728dSAlexander V. Chernikov cmdlen = 0; 3258a73d728dSAlexander V. Chernikov for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 3259a73d728dSAlexander V. Chernikov cmdlen = F_LEN(cmd); 3260a73d728dSAlexander V. Chernikov if (classify_table_opcode(cmd, &kidx, &type) != 0) 3261a73d728dSAlexander V. Chernikov continue; 3262a73d728dSAlexander V. Chernikov no = ipfw_objhash_lookup_kidx(ni, kidx); 3263a73d728dSAlexander V. Chernikov KASSERT(no != NULL, 3264a73d728dSAlexander V. Chernikov ("objhash lookup failed on index %d", kidx)); 3265a73d728dSAlexander V. Chernikov tc = (struct table_config *)no; 3266a73d728dSAlexander V. Chernikov 3267a73d728dSAlexander V. Chernikov tc->ocount = 0; 3268a73d728dSAlexander V. Chernikov if (bad != 0) 3269a73d728dSAlexander V. Chernikov continue; 3270a73d728dSAlexander V. Chernikov 3271a73d728dSAlexander V. Chernikov /* Actually change set. */ 3272a73d728dSAlexander V. Chernikov ipfw_objhash_del(ni, no); 3273a73d728dSAlexander V. Chernikov no->set = new_set; 3274a73d728dSAlexander V. Chernikov ipfw_objhash_add(ni, no); 3275a73d728dSAlexander V. Chernikov } 3276a73d728dSAlexander V. Chernikov } 3277a73d728dSAlexander V. Chernikov 3278a73d728dSAlexander V. Chernikov return (bad); 3279a73d728dSAlexander V. Chernikov } 3280a73d728dSAlexander V. Chernikov 3281b074b7bbSAlexander V. Chernikov /* 3282f99fbf96SAlexander V. Chernikov * Finds and bumps refcount for tables referenced by given @rule. 3283e5eec6ddSAlexander V. Chernikov * Auto-creates non-existing tables. 3284f99fbf96SAlexander V. Chernikov * Fills in @oib array with userland/kernel indexes. 3285f99fbf96SAlexander V. Chernikov * First free oidx pointer is saved back in @oib. 3286f99fbf96SAlexander V. Chernikov * 3287f99fbf96SAlexander V. Chernikov * Returns 0 on success. 3288f99fbf96SAlexander V. Chernikov */ 3289f99fbf96SAlexander V. Chernikov static int 3290e5eec6ddSAlexander V. Chernikov find_ref_rule_tables(struct ip_fw_chain *ch, struct ip_fw *rule, 3291f99fbf96SAlexander V. Chernikov struct rule_check_info *ci, struct obj_idx **oib, struct tid_info *ti) 3292f99fbf96SAlexander V. Chernikov { 3293f99fbf96SAlexander V. Chernikov struct table_config *tc; 3294f99fbf96SAlexander V. Chernikov struct namedobj_instance *ni; 3295f99fbf96SAlexander V. Chernikov struct named_object *no; 3296f99fbf96SAlexander V. Chernikov int cmdlen, error, l, numnew; 3297f99fbf96SAlexander V. Chernikov uint16_t kidx; 3298f99fbf96SAlexander V. Chernikov ipfw_insn *cmd; 3299f99fbf96SAlexander V. Chernikov struct obj_idx *pidx, *pidx_first, *p; 3300f99fbf96SAlexander V. Chernikov 3301f99fbf96SAlexander V. Chernikov pidx_first = *oib; 3302f99fbf96SAlexander V. Chernikov pidx = pidx_first; 3303f99fbf96SAlexander V. Chernikov l = rule->cmd_len; 3304f99fbf96SAlexander V. Chernikov cmd = rule->cmd; 3305f99fbf96SAlexander V. Chernikov cmdlen = 0; 3306f99fbf96SAlexander V. Chernikov error = 0; 3307f99fbf96SAlexander V. Chernikov numnew = 0; 3308f99fbf96SAlexander V. Chernikov 3309f99fbf96SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 3310f99fbf96SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 3311f99fbf96SAlexander V. Chernikov 3312e5eec6ddSAlexander V. Chernikov /* Increase refcount on each existing referenced table. */ 3313f99fbf96SAlexander V. Chernikov for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 3314f99fbf96SAlexander V. Chernikov cmdlen = F_LEN(cmd); 3315f99fbf96SAlexander V. Chernikov 3316f99fbf96SAlexander V. Chernikov if (classify_table_opcode(cmd, &ti->uidx, &ti->type) != 0) 3317f99fbf96SAlexander V. Chernikov continue; 3318f99fbf96SAlexander V. Chernikov 3319f99fbf96SAlexander V. Chernikov pidx->uidx = ti->uidx; 3320f99fbf96SAlexander V. Chernikov pidx->type = ti->type; 3321f99fbf96SAlexander V. Chernikov 3322f99fbf96SAlexander V. Chernikov if ((tc = find_table(ni, ti)) != NULL) { 3323f99fbf96SAlexander V. Chernikov if (tc->no.type != ti->type) { 3324f99fbf96SAlexander V. Chernikov /* Incompatible types */ 3325f99fbf96SAlexander V. Chernikov error = EINVAL; 3326f99fbf96SAlexander V. Chernikov break; 3327f99fbf96SAlexander V. Chernikov } 3328f99fbf96SAlexander V. Chernikov 3329f99fbf96SAlexander V. Chernikov /* Reference found table and save kidx */ 3330f99fbf96SAlexander V. Chernikov tc->no.refcnt++; 3331f99fbf96SAlexander V. Chernikov pidx->kidx = tc->no.kidx; 3332f99fbf96SAlexander V. Chernikov pidx++; 3333f99fbf96SAlexander V. Chernikov continue; 3334f99fbf96SAlexander V. Chernikov } 3335f99fbf96SAlexander V. Chernikov 3336f99fbf96SAlexander V. Chernikov /* 3337f99fbf96SAlexander V. Chernikov * Compability stuff for old clients: 3338f99fbf96SAlexander V. Chernikov * prepare to manually create non-existing tables. 3339f99fbf96SAlexander V. Chernikov */ 3340f99fbf96SAlexander V. Chernikov pidx++; 3341f99fbf96SAlexander V. Chernikov numnew++; 3342f99fbf96SAlexander V. Chernikov } 3343f99fbf96SAlexander V. Chernikov 3344f99fbf96SAlexander V. Chernikov if (error != 0) { 3345f99fbf96SAlexander V. Chernikov /* Unref everything we have already done */ 3346f99fbf96SAlexander V. Chernikov for (p = *oib; p < pidx; p++) { 3347f99fbf96SAlexander V. Chernikov if (p->kidx == 0) 3348f99fbf96SAlexander V. Chernikov continue; 3349f99fbf96SAlexander V. Chernikov 3350f99fbf96SAlexander V. Chernikov /* Find & unref by existing idx */ 3351f99fbf96SAlexander V. Chernikov no = ipfw_objhash_lookup_kidx(ni, p->kidx); 3352f99fbf96SAlexander V. Chernikov KASSERT(no != NULL, ("Ref'd table %d disappeared", 3353f99fbf96SAlexander V. Chernikov p->kidx)); 3354f99fbf96SAlexander V. Chernikov 3355f99fbf96SAlexander V. Chernikov no->refcnt--; 3356f99fbf96SAlexander V. Chernikov } 3357f99fbf96SAlexander V. Chernikov } 3358f99fbf96SAlexander V. Chernikov 3359f99fbf96SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 3360f99fbf96SAlexander V. Chernikov 3361f99fbf96SAlexander V. Chernikov if (numnew == 0) { 3362f99fbf96SAlexander V. Chernikov *oib = pidx; 3363f99fbf96SAlexander V. Chernikov return (error); 3364f99fbf96SAlexander V. Chernikov } 3365f99fbf96SAlexander V. Chernikov 3366f99fbf96SAlexander V. Chernikov /* 3367f99fbf96SAlexander V. Chernikov * Compatibility stuff: do actual creation for non-existing, 3368f99fbf96SAlexander V. Chernikov * but referenced tables. 3369f99fbf96SAlexander V. Chernikov */ 3370f99fbf96SAlexander V. Chernikov for (p = pidx_first; p < pidx; p++) { 3371f99fbf96SAlexander V. Chernikov if (p->kidx != 0) 3372f99fbf96SAlexander V. Chernikov continue; 3373f99fbf96SAlexander V. Chernikov 3374f99fbf96SAlexander V. Chernikov ti->uidx = p->uidx; 3375f99fbf96SAlexander V. Chernikov ti->type = p->type; 3376f99fbf96SAlexander V. Chernikov ti->atype = 0; 3377f99fbf96SAlexander V. Chernikov 3378867708f7SAlexander V. Chernikov error = create_table_compat(ch, ti, &kidx); 3379f99fbf96SAlexander V. Chernikov if (error == 0) { 3380f99fbf96SAlexander V. Chernikov p->kidx = kidx; 3381f99fbf96SAlexander V. Chernikov continue; 3382f99fbf96SAlexander V. Chernikov } 3383f99fbf96SAlexander V. Chernikov 3384f99fbf96SAlexander V. Chernikov /* Error. We have to drop references */ 3385f99fbf96SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 3386f99fbf96SAlexander V. Chernikov for (p = pidx_first; p < pidx; p++) { 3387f99fbf96SAlexander V. Chernikov if (p->kidx == 0) 3388f99fbf96SAlexander V. Chernikov continue; 3389f99fbf96SAlexander V. Chernikov 3390f99fbf96SAlexander V. Chernikov /* Find & unref by existing idx */ 3391f99fbf96SAlexander V. Chernikov no = ipfw_objhash_lookup_kidx(ni, p->kidx); 3392f99fbf96SAlexander V. Chernikov KASSERT(no != NULL, ("Ref'd table %d disappeared", 3393f99fbf96SAlexander V. Chernikov p->kidx)); 3394f99fbf96SAlexander V. Chernikov 3395f99fbf96SAlexander V. Chernikov no->refcnt--; 3396f99fbf96SAlexander V. Chernikov } 3397f99fbf96SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 3398f99fbf96SAlexander V. Chernikov 3399f99fbf96SAlexander V. Chernikov return (error); 3400f99fbf96SAlexander V. Chernikov } 3401f99fbf96SAlexander V. Chernikov 3402f99fbf96SAlexander V. Chernikov *oib = pidx; 3403f99fbf96SAlexander V. Chernikov 3404f99fbf96SAlexander V. Chernikov return (error); 3405f99fbf96SAlexander V. Chernikov } 3406f99fbf96SAlexander V. Chernikov 3407f99fbf96SAlexander V. Chernikov /* 3408f99fbf96SAlexander V. Chernikov * Remove references from every table used in @rule. 3409f99fbf96SAlexander V. Chernikov */ 3410f99fbf96SAlexander V. Chernikov void 3411e5eec6ddSAlexander V. Chernikov ipfw_unref_rule_tables(struct ip_fw_chain *chain, struct ip_fw *rule) 3412f99fbf96SAlexander V. Chernikov { 3413f99fbf96SAlexander V. Chernikov int cmdlen, l; 3414f99fbf96SAlexander V. Chernikov ipfw_insn *cmd; 3415f99fbf96SAlexander V. Chernikov struct namedobj_instance *ni; 3416f99fbf96SAlexander V. Chernikov struct named_object *no; 3417f99fbf96SAlexander V. Chernikov uint16_t kidx; 3418f99fbf96SAlexander V. Chernikov uint8_t type; 3419f99fbf96SAlexander V. Chernikov 3420f99fbf96SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(chain); 3421f99fbf96SAlexander V. Chernikov ni = CHAIN_TO_NI(chain); 3422f99fbf96SAlexander V. Chernikov 3423f99fbf96SAlexander V. Chernikov l = rule->cmd_len; 3424f99fbf96SAlexander V. Chernikov cmd = rule->cmd; 3425f99fbf96SAlexander V. Chernikov cmdlen = 0; 3426f99fbf96SAlexander V. Chernikov for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 3427f99fbf96SAlexander V. Chernikov cmdlen = F_LEN(cmd); 3428f99fbf96SAlexander V. Chernikov 3429f99fbf96SAlexander V. Chernikov if (classify_table_opcode(cmd, &kidx, &type) != 0) 3430f99fbf96SAlexander V. Chernikov continue; 3431f99fbf96SAlexander V. Chernikov 3432f99fbf96SAlexander V. Chernikov no = ipfw_objhash_lookup_kidx(ni, kidx); 3433f99fbf96SAlexander V. Chernikov 3434f99fbf96SAlexander V. Chernikov KASSERT(no != NULL, ("table id %d not found", kidx)); 3435f99fbf96SAlexander V. Chernikov KASSERT(no->type == type, ("wrong type %d (%d) for table id %d", 3436f99fbf96SAlexander V. Chernikov no->type, type, kidx)); 3437f99fbf96SAlexander V. Chernikov KASSERT(no->refcnt > 0, ("refcount for table %d is %d", 3438f99fbf96SAlexander V. Chernikov kidx, no->refcnt)); 3439f99fbf96SAlexander V. Chernikov 3440f99fbf96SAlexander V. Chernikov no->refcnt--; 3441f99fbf96SAlexander V. Chernikov } 3442f99fbf96SAlexander V. Chernikov } 3443f99fbf96SAlexander V. Chernikov 3444f99fbf96SAlexander V. Chernikov /* 3445b074b7bbSAlexander V. Chernikov * Compatibility function for old ipfw(8) binaries. 3446b074b7bbSAlexander V. Chernikov * Rewrites table kernel indices with userland ones. 344735e1bbd0SAlexander V. Chernikov * Convert tables matching '/^\d+$/' to their atoi() value. 344835e1bbd0SAlexander V. Chernikov * Use number 65535 for other tables. 3449b074b7bbSAlexander V. Chernikov * 3450b074b7bbSAlexander V. Chernikov * Returns 0 on success. 3451b074b7bbSAlexander V. Chernikov */ 3452b074b7bbSAlexander V. Chernikov int 34537e767c79SAlexander V. Chernikov ipfw_rewrite_table_kidx(struct ip_fw_chain *chain, struct ip_fw_rule0 *rule) 3454b074b7bbSAlexander V. Chernikov { 34551832a7b3SAlexander V. Chernikov int cmdlen, error, l; 3456b074b7bbSAlexander V. Chernikov ipfw_insn *cmd; 34571832a7b3SAlexander V. Chernikov uint16_t kidx, uidx; 3458b074b7bbSAlexander V. Chernikov uint8_t type; 3459b074b7bbSAlexander V. Chernikov struct named_object *no; 3460b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 3461b074b7bbSAlexander V. Chernikov 3462b074b7bbSAlexander V. Chernikov ni = CHAIN_TO_NI(chain); 34631832a7b3SAlexander V. Chernikov error = 0; 3464b074b7bbSAlexander V. Chernikov 3465b074b7bbSAlexander V. Chernikov l = rule->cmd_len; 3466b074b7bbSAlexander V. Chernikov cmd = rule->cmd; 3467b074b7bbSAlexander V. Chernikov cmdlen = 0; 3468b074b7bbSAlexander V. Chernikov for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 3469b074b7bbSAlexander V. Chernikov cmdlen = F_LEN(cmd); 3470b074b7bbSAlexander V. Chernikov 3471b074b7bbSAlexander V. Chernikov if (classify_table_opcode(cmd, &kidx, &type) != 0) 3472b074b7bbSAlexander V. Chernikov continue; 3473b074b7bbSAlexander V. Chernikov 3474ac35ff17SAlexander V. Chernikov if ((no = ipfw_objhash_lookup_kidx(ni, kidx)) == NULL) 3475b074b7bbSAlexander V. Chernikov return (1); 3476b074b7bbSAlexander V. Chernikov 34771832a7b3SAlexander V. Chernikov uidx = no->uidx; 34781832a7b3SAlexander V. Chernikov if (no->compat == 0) { 3479b074b7bbSAlexander V. Chernikov 34801832a7b3SAlexander V. Chernikov /* 34811832a7b3SAlexander V. Chernikov * We are called via legacy opcode. 34821832a7b3SAlexander V. Chernikov * Save error and show table as fake number 34831832a7b3SAlexander V. Chernikov * not to make ipfw(8) hang. 34841832a7b3SAlexander V. Chernikov */ 34851832a7b3SAlexander V. Chernikov uidx = 65535; 34861832a7b3SAlexander V. Chernikov error = 2; 3487b074b7bbSAlexander V. Chernikov } 3488b074b7bbSAlexander V. Chernikov 34891832a7b3SAlexander V. Chernikov update_table_opcode(cmd, uidx); 34901832a7b3SAlexander V. Chernikov } 34911832a7b3SAlexander V. Chernikov 34921832a7b3SAlexander V. Chernikov return (error); 3493b074b7bbSAlexander V. Chernikov } 3494b074b7bbSAlexander V. Chernikov 3495563b5ab1SAlexander V. Chernikov /* 3496b074b7bbSAlexander V. Chernikov * Checks is opcode is referencing table of appropriate type. 3497b074b7bbSAlexander V. Chernikov * Adds reference count for found table if true. 3498b074b7bbSAlexander V. Chernikov * Rewrites user-supplied opcode values with kernel ones. 3499b074b7bbSAlexander V. Chernikov * 3500b074b7bbSAlexander V. Chernikov * Returns 0 on success and appropriate error code otherwise. 3501b074b7bbSAlexander V. Chernikov */ 3502b074b7bbSAlexander V. Chernikov int 3503b074b7bbSAlexander V. Chernikov ipfw_rewrite_table_uidx(struct ip_fw_chain *chain, 3504b074b7bbSAlexander V. Chernikov struct rule_check_info *ci) 3505b074b7bbSAlexander V. Chernikov { 35060468c5baSAlexander V. Chernikov int cmdlen, error, l; 3507b074b7bbSAlexander V. Chernikov ipfw_insn *cmd; 3508b074b7bbSAlexander V. Chernikov uint16_t uidx; 3509b074b7bbSAlexander V. Chernikov uint8_t type; 3510b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 35119490a627SAlexander V. Chernikov struct obj_idx *p, *pidx_first, *pidx_last; 3512b074b7bbSAlexander V. Chernikov struct tid_info ti; 3513b074b7bbSAlexander V. Chernikov 3514b074b7bbSAlexander V. Chernikov ni = CHAIN_TO_NI(chain); 3515b074b7bbSAlexander V. Chernikov 3516b074b7bbSAlexander V. Chernikov /* 3517b074b7bbSAlexander V. Chernikov * Prepare an array for storing opcode indices. 3518b074b7bbSAlexander V. Chernikov * Use stack allocation by default. 3519b074b7bbSAlexander V. Chernikov */ 3520b074b7bbSAlexander V. Chernikov if (ci->table_opcodes <= (sizeof(ci->obuf)/sizeof(ci->obuf[0]))) { 3521b074b7bbSAlexander V. Chernikov /* Stack */ 35229490a627SAlexander V. Chernikov pidx_first = ci->obuf; 3523b074b7bbSAlexander V. Chernikov } else 35249490a627SAlexander V. Chernikov pidx_first = malloc(ci->table_opcodes * sizeof(struct obj_idx), 3525b074b7bbSAlexander V. Chernikov M_IPFW, M_WAITOK | M_ZERO); 3526b074b7bbSAlexander V. Chernikov 35279490a627SAlexander V. Chernikov pidx_last = pidx_first; 3528b074b7bbSAlexander V. Chernikov error = 0; 3529b074b7bbSAlexander V. Chernikov type = 0; 3530b074b7bbSAlexander V. Chernikov memset(&ti, 0, sizeof(ti)); 35311832a7b3SAlexander V. Chernikov 35321832a7b3SAlexander V. Chernikov /* 35331832a7b3SAlexander V. Chernikov * Use default set for looking up tables (old way) or 35341832a7b3SAlexander V. Chernikov * use set rule is assigned to (new way). 35351832a7b3SAlexander V. Chernikov */ 35361832a7b3SAlexander V. Chernikov ti.set = (V_fw_tables_sets != 0) ? ci->krule->set : 0; 35376c2997ffSAlexander V. Chernikov if (ci->ctlv != NULL) { 35386c2997ffSAlexander V. Chernikov ti.tlvs = (void *)(ci->ctlv + 1); 35396c2997ffSAlexander V. Chernikov ti.tlen = ci->ctlv->head.length - sizeof(ipfw_obj_ctlv); 35406c2997ffSAlexander V. Chernikov } 3541b074b7bbSAlexander V. Chernikov 35420468c5baSAlexander V. Chernikov /* Reference all used tables */ 3543e5eec6ddSAlexander V. Chernikov error = find_ref_rule_tables(chain, ci->krule, ci, &pidx_last, &ti); 35440468c5baSAlexander V. Chernikov if (error != 0) 35459f7d47b0SAlexander V. Chernikov goto free; 3546b074b7bbSAlexander V. Chernikov 35479f7d47b0SAlexander V. Chernikov IPFW_UH_WLOCK(chain); 35489f7d47b0SAlexander V. Chernikov 3549b074b7bbSAlexander V. Chernikov /* Perform rule rewrite */ 3550b074b7bbSAlexander V. Chernikov l = ci->krule->cmd_len; 3551b074b7bbSAlexander V. Chernikov cmd = ci->krule->cmd; 3552b074b7bbSAlexander V. Chernikov cmdlen = 0; 35539490a627SAlexander V. Chernikov p = pidx_first; 3554b074b7bbSAlexander V. Chernikov for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 3555b074b7bbSAlexander V. Chernikov cmdlen = F_LEN(cmd); 3556b074b7bbSAlexander V. Chernikov if (classify_table_opcode(cmd, &uidx, &type) != 0) 3557b074b7bbSAlexander V. Chernikov continue; 35589490a627SAlexander V. Chernikov update_table_opcode(cmd, p->kidx); 35599490a627SAlexander V. Chernikov p++; 3560b074b7bbSAlexander V. Chernikov } 3561b074b7bbSAlexander V. Chernikov 3562b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(chain); 3563b074b7bbSAlexander V. Chernikov 3564b074b7bbSAlexander V. Chernikov free: 35659490a627SAlexander V. Chernikov if (pidx_first != ci->obuf) 35669490a627SAlexander V. Chernikov free(pidx_first, M_IPFW); 3567b074b7bbSAlexander V. Chernikov 3568b074b7bbSAlexander V. Chernikov return (error); 3569b074b7bbSAlexander V. Chernikov } 3570b074b7bbSAlexander V. Chernikov 35716b988f3aSAlexander V. Chernikov static struct ipfw_sopt_handler scodes[] = { 35726b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XCREATE, 0, HDIR_SET, create_table }, 35736b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XDESTROY, 0, HDIR_SET, flush_table_v0 }, 35746b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XFLUSH, 0, HDIR_SET, flush_table_v0 }, 35756b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XMODIFY, 0, HDIR_BOTH, modify_table }, 35766b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XINFO, 0, HDIR_GET, describe_table }, 35776b988f3aSAlexander V. Chernikov { IP_FW_TABLES_XLIST, 0, HDIR_GET, list_tables }, 35786b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XLIST, 0, HDIR_GET, dump_table_v0 }, 35796b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XLIST, 1, HDIR_GET, dump_table_v1 }, 35806b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XADD, 0, HDIR_BOTH, manage_table_ent_v0 }, 35816b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XADD, 1, HDIR_BOTH, manage_table_ent_v1 }, 35826b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XDEL, 0, HDIR_BOTH, manage_table_ent_v0 }, 35836b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XDEL, 1, HDIR_BOTH, manage_table_ent_v1 }, 35846b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XFIND, 0, HDIR_GET, find_table_entry }, 35856b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XSWAP, 0, HDIR_SET, swap_table }, 35866b988f3aSAlexander V. Chernikov { IP_FW_TABLES_ALIST, 0, HDIR_GET, list_table_algo }, 35876b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XGETSIZE, 0, HDIR_GET, get_table_size }, 35886b988f3aSAlexander V. Chernikov }; 35896b988f3aSAlexander V. Chernikov 35906b988f3aSAlexander V. Chernikov static void 35916b988f3aSAlexander V. Chernikov destroy_table_locked(struct namedobj_instance *ni, struct named_object *no, 35926b988f3aSAlexander V. Chernikov void *arg) 35936b988f3aSAlexander V. Chernikov { 35946b988f3aSAlexander V. Chernikov 35956b988f3aSAlexander V. Chernikov unlink_table((struct ip_fw_chain *)arg, (struct table_config *)no); 35966b988f3aSAlexander V. Chernikov if (ipfw_objhash_free_idx(ni, no->kidx) != 0) 35976b988f3aSAlexander V. Chernikov printf("Error unlinking kidx %d from table %s\n", 35986b988f3aSAlexander V. Chernikov no->kidx, no->name); 35996b988f3aSAlexander V. Chernikov free_table_config(ni, (struct table_config *)no); 36006b988f3aSAlexander V. Chernikov } 36016b988f3aSAlexander V. Chernikov 36026b988f3aSAlexander V. Chernikov /* 36036b988f3aSAlexander V. Chernikov * Shuts tables module down. 36046b988f3aSAlexander V. Chernikov */ 36056b988f3aSAlexander V. Chernikov void 36066b988f3aSAlexander V. Chernikov ipfw_destroy_tables(struct ip_fw_chain *ch, int last) 36076b988f3aSAlexander V. Chernikov { 36086b988f3aSAlexander V. Chernikov 36096b988f3aSAlexander V. Chernikov IPFW_DEL_SOPT_HANDLER(last, scodes); 36106b988f3aSAlexander V. Chernikov 36116b988f3aSAlexander V. Chernikov /* Remove all tables from working set */ 36126b988f3aSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 36136b988f3aSAlexander V. Chernikov IPFW_WLOCK(ch); 36146b988f3aSAlexander V. Chernikov ipfw_objhash_foreach(CHAIN_TO_NI(ch), destroy_table_locked, ch); 36156b988f3aSAlexander V. Chernikov IPFW_WUNLOCK(ch); 36166b988f3aSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 36176b988f3aSAlexander V. Chernikov 36186b988f3aSAlexander V. Chernikov /* Free pointers itself */ 36196b988f3aSAlexander V. Chernikov free(ch->tablestate, M_IPFW); 36206b988f3aSAlexander V. Chernikov 36216b988f3aSAlexander V. Chernikov ipfw_table_value_destroy(ch, last); 36226b988f3aSAlexander V. Chernikov ipfw_table_algo_destroy(ch); 36236b988f3aSAlexander V. Chernikov 36246b988f3aSAlexander V. Chernikov ipfw_objhash_destroy(CHAIN_TO_NI(ch)); 36256b988f3aSAlexander V. Chernikov free(CHAIN_TO_TCFG(ch), M_IPFW); 36266b988f3aSAlexander V. Chernikov } 36276b988f3aSAlexander V. Chernikov 36286b988f3aSAlexander V. Chernikov /* 36296b988f3aSAlexander V. Chernikov * Starts tables module. 36306b988f3aSAlexander V. Chernikov */ 36316b988f3aSAlexander V. Chernikov int 36326b988f3aSAlexander V. Chernikov ipfw_init_tables(struct ip_fw_chain *ch, int first) 36336b988f3aSAlexander V. Chernikov { 36346b988f3aSAlexander V. Chernikov struct tables_config *tcfg; 36356b988f3aSAlexander V. Chernikov 36366b988f3aSAlexander V. Chernikov /* Allocate pointers */ 36376b988f3aSAlexander V. Chernikov ch->tablestate = malloc(V_fw_tables_max * sizeof(struct table_info), 36386b988f3aSAlexander V. Chernikov M_IPFW, M_WAITOK | M_ZERO); 36396b988f3aSAlexander V. Chernikov 36406b988f3aSAlexander V. Chernikov tcfg = malloc(sizeof(struct tables_config), M_IPFW, M_WAITOK | M_ZERO); 36416b988f3aSAlexander V. Chernikov tcfg->namehash = ipfw_objhash_create(V_fw_tables_max); 36426b988f3aSAlexander V. Chernikov ch->tblcfg = tcfg; 36436b988f3aSAlexander V. Chernikov 36446b988f3aSAlexander V. Chernikov ipfw_table_value_init(ch, first); 36456b988f3aSAlexander V. Chernikov ipfw_table_algo_init(ch); 36466b988f3aSAlexander V. Chernikov 36476b988f3aSAlexander V. Chernikov IPFW_ADD_SOPT_HANDLER(first, scodes); 36486b988f3aSAlexander V. Chernikov return (0); 36496b988f3aSAlexander V. Chernikov } 36506b988f3aSAlexander V. Chernikov 36516b988f3aSAlexander V. Chernikov 36526b988f3aSAlexander V. Chernikov 3653