13b3a8eb9SGleb Smirnoff /*- 23b3a8eb9SGleb Smirnoff * Copyright (c) 2004 Ruslan Ermilov and Vsevolod Lobko. 31a33e799SAlexander V. Chernikov * Copyright (c) 2014 Yandex LLC 41a33e799SAlexander V. Chernikov * Copyright (c) 2014 Alexander V. Chernikov 53b3a8eb9SGleb Smirnoff * 63b3a8eb9SGleb Smirnoff * Redistribution and use in source and binary forms, with or without 73b3a8eb9SGleb Smirnoff * modification, are permitted provided that the following conditions 83b3a8eb9SGleb Smirnoff * are met: 93b3a8eb9SGleb Smirnoff * 1. Redistributions of source code must retain the above copyright 103b3a8eb9SGleb Smirnoff * notice, this list of conditions and the following disclaimer. 113b3a8eb9SGleb Smirnoff * 2. Redistributions in binary form must reproduce the above copyright 123b3a8eb9SGleb Smirnoff * notice, this list of conditions and the following disclaimer in the 133b3a8eb9SGleb Smirnoff * documentation and/or other materials provided with the distribution. 143b3a8eb9SGleb Smirnoff * 153b3a8eb9SGleb Smirnoff * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 163b3a8eb9SGleb Smirnoff * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 173b3a8eb9SGleb Smirnoff * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 183b3a8eb9SGleb Smirnoff * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 193b3a8eb9SGleb Smirnoff * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 203b3a8eb9SGleb Smirnoff * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 213b3a8eb9SGleb Smirnoff * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 223b3a8eb9SGleb Smirnoff * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 233b3a8eb9SGleb Smirnoff * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 243b3a8eb9SGleb Smirnoff * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 253b3a8eb9SGleb Smirnoff * SUCH DAMAGE. 263b3a8eb9SGleb Smirnoff */ 273b3a8eb9SGleb Smirnoff 283b3a8eb9SGleb Smirnoff #include <sys/cdefs.h> 293b3a8eb9SGleb Smirnoff __FBSDID("$FreeBSD$"); 303b3a8eb9SGleb Smirnoff 313b3a8eb9SGleb Smirnoff /* 32563b5ab1SAlexander V. Chernikov * Lookup table support for ipfw. 333b3a8eb9SGleb Smirnoff * 34ac35ff17SAlexander V. Chernikov * This file contains handlers for all generic tables' operations: 35563b5ab1SAlexander V. Chernikov * add/del/flush entries, list/dump tables etc.. 363b3a8eb9SGleb Smirnoff * 371a33e799SAlexander V. Chernikov * Table data modification is protected by both UH and runtime lock 38563b5ab1SAlexander V. Chernikov * while reading configuration/data is protected by UH lock. 39563b5ab1SAlexander V. Chernikov * 40563b5ab1SAlexander V. Chernikov * Lookup algorithms for all table types are located in ip_fw_table_algo.c 413b3a8eb9SGleb Smirnoff */ 423b3a8eb9SGleb Smirnoff 433b3a8eb9SGleb Smirnoff #include "opt_ipfw.h" 443b3a8eb9SGleb Smirnoff 453b3a8eb9SGleb Smirnoff #include <sys/param.h> 463b3a8eb9SGleb Smirnoff #include <sys/systm.h> 473b3a8eb9SGleb Smirnoff #include <sys/malloc.h> 483b3a8eb9SGleb Smirnoff #include <sys/kernel.h> 493b3a8eb9SGleb Smirnoff #include <sys/lock.h> 503b3a8eb9SGleb Smirnoff #include <sys/rwlock.h> 51ccba94b8SAlexander V. Chernikov #include <sys/rmlock.h> 523b3a8eb9SGleb Smirnoff #include <sys/socket.h> 53f1220db8SAlexander V. Chernikov #include <sys/socketvar.h> 543b3a8eb9SGleb Smirnoff #include <sys/queue.h> 553b3a8eb9SGleb Smirnoff #include <net/if.h> /* ip_fw.h requires IFNAMSIZ */ 563b3a8eb9SGleb Smirnoff 573b3a8eb9SGleb Smirnoff #include <netinet/in.h> 583b3a8eb9SGleb Smirnoff #include <netinet/ip_var.h> /* struct ipfw_rule_ref */ 593b3a8eb9SGleb Smirnoff #include <netinet/ip_fw.h> 603b3a8eb9SGleb Smirnoff 613b3a8eb9SGleb Smirnoff #include <netpfil/ipfw/ip_fw_private.h> 62ea761a5dSAlexander V. Chernikov #include <netpfil/ipfw/ip_fw_table.h> 633b3a8eb9SGleb Smirnoff 643b3a8eb9SGleb Smirnoff /* 65b074b7bbSAlexander V. Chernikov * Table has the following `type` concepts: 66b074b7bbSAlexander V. Chernikov * 67c21034b7SAlexander V. Chernikov * `no.type` represents lookup key type (addr, ifp, uid, etc..) 680cba2b28SAlexander V. Chernikov * vmask represents bitmask of table values which are present at the moment. 690cba2b28SAlexander V. Chernikov * Special IPFW_VTYPE_LEGACY ( (uint32_t)-1 ) represents old 700cba2b28SAlexander V. Chernikov * single-value-for-all approach. 71b074b7bbSAlexander V. Chernikov */ 72b074b7bbSAlexander V. Chernikov struct table_config { 73b074b7bbSAlexander V. Chernikov struct named_object no; 74914bffb6SAlexander V. Chernikov uint8_t tflags; /* type flags */ 754f43138aSAlexander V. Chernikov uint8_t locked; /* 1 if locked from changes */ 76adf3b2b9SAlexander V. Chernikov uint8_t linked; /* 1 if already linked */ 77adf3b2b9SAlexander V. Chernikov uint8_t ochanged; /* used by set swapping */ 780cba2b28SAlexander V. Chernikov uint8_t vshared; /* 1 if using shared value array */ 790cba2b28SAlexander V. Chernikov uint8_t spare[3]; 800cba2b28SAlexander V. Chernikov uint32_t count; /* Number of records */ 810cba2b28SAlexander V. Chernikov uint32_t limit; /* Max number of records */ 820cba2b28SAlexander V. Chernikov uint32_t vmask; /* bitmask with supported values */ 83a73d728dSAlexander V. Chernikov uint32_t ocount; /* used by set swapping */ 84a73d728dSAlexander V. Chernikov uint64_t gencnt; /* generation count */ 85b074b7bbSAlexander V. Chernikov char tablename[64]; /* table name */ 869f7d47b0SAlexander V. Chernikov struct table_algo *ta; /* Callbacks for given algo */ 879f7d47b0SAlexander V. Chernikov void *astate; /* algorithm state */ 884c060d85SAlexander V. Chernikov struct table_info ti_copy; /* data to put to table_info */ 890cba2b28SAlexander V. Chernikov struct namedobj_instance *vi; 90b074b7bbSAlexander V. Chernikov }; 91b074b7bbSAlexander V. Chernikov 9274b22066SAlexander V. Chernikov static int find_table_err(struct namedobj_instance *ni, struct tid_info *ti, 9374b22066SAlexander V. Chernikov struct table_config **tc); 94b074b7bbSAlexander V. Chernikov static struct table_config *find_table(struct namedobj_instance *ni, 95b074b7bbSAlexander V. Chernikov struct tid_info *ti); 9668394ec8SAlexander V. Chernikov static struct table_config *alloc_table_config(struct ip_fw_chain *ch, 970cba2b28SAlexander V. Chernikov struct tid_info *ti, struct table_algo *ta, char *adata, uint8_t tflags); 98b074b7bbSAlexander V. Chernikov static void free_table_config(struct namedobj_instance *ni, 99b074b7bbSAlexander V. Chernikov struct table_config *tc); 100db785d31SAlexander V. Chernikov static int create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti, 101867708f7SAlexander V. Chernikov char *aname, ipfw_xtable_info *i, uint16_t *pkidx, int ref); 1020468c5baSAlexander V. Chernikov static void link_table(struct ip_fw_chain *ch, struct table_config *tc); 1030468c5baSAlexander V. Chernikov static void unlink_table(struct ip_fw_chain *ch, struct table_config *tc); 1044dff4ae0SAlexander V. Chernikov static int find_ref_table(struct ip_fw_chain *ch, struct tid_info *ti, 105867708f7SAlexander V. Chernikov struct tentry_info *tei, uint32_t count, int op, struct table_config **ptc); 1064dff4ae0SAlexander V. Chernikov #define OP_ADD 1 1074dff4ae0SAlexander V. Chernikov #define OP_DEL 0 1082d99a349SAlexander V. Chernikov static int export_tables(struct ip_fw_chain *ch, ipfw_obj_lheader *olh, 1092d99a349SAlexander V. Chernikov struct sockopt_data *sd); 110ac35ff17SAlexander V. Chernikov static void export_table_info(struct ip_fw_chain *ch, struct table_config *tc, 111ac35ff17SAlexander V. Chernikov ipfw_xtable_info *i); 11281d3153dSAlexander V. Chernikov static int dump_table_tentry(void *e, void *arg); 113f1220db8SAlexander V. Chernikov static int dump_table_xentry(void *e, void *arg); 114b074b7bbSAlexander V. Chernikov 115a73d728dSAlexander V. Chernikov static int swap_tables(struct ip_fw_chain *ch, struct tid_info *a, 11646d52008SAlexander V. Chernikov struct tid_info *b); 117ac35ff17SAlexander V. Chernikov 1180cba2b28SAlexander V. Chernikov static int check_table_space(struct ip_fw_chain *ch, struct tableop_state *ts, 1190cba2b28SAlexander V. Chernikov struct table_config *tc, struct table_info *ti, uint32_t count); 120ac35ff17SAlexander V. Chernikov static int destroy_table(struct ip_fw_chain *ch, struct tid_info *ti); 121d3a4f924SAlexander V. Chernikov 1229f7d47b0SAlexander V. Chernikov static struct table_algo *find_table_algo(struct tables_config *tableconf, 1239490a627SAlexander V. Chernikov struct tid_info *ti, char *name); 124b074b7bbSAlexander V. Chernikov 12546d52008SAlexander V. Chernikov static void objheader_to_ti(struct _ipfw_obj_header *oh, struct tid_info *ti); 12646d52008SAlexander V. Chernikov static void ntlv_to_ti(struct _ipfw_obj_ntlv *ntlv, struct tid_info *ti); 12746d52008SAlexander V. Chernikov 128b074b7bbSAlexander V. Chernikov #define CHAIN_TO_NI(chain) (CHAIN_TO_TCFG(chain)->namehash) 1299f7d47b0SAlexander V. Chernikov #define KIDX_TO_TI(ch, k) (&(((struct table_info *)(ch)->tablestate)[k])) 130b074b7bbSAlexander V. Chernikov 131b6ee846eSAlexander V. Chernikov #define TA_BUF_SZ 128 /* On-stack buffer for add/delete state */ 132b6ee846eSAlexander V. Chernikov 1330cba2b28SAlexander V. Chernikov void 1340cba2b28SAlexander V. Chernikov rollback_toperation_state(struct ip_fw_chain *ch, void *object) 1350cba2b28SAlexander V. Chernikov { 1360cba2b28SAlexander V. Chernikov struct tables_config *tcfg; 1370cba2b28SAlexander V. Chernikov struct op_state *os; 1380cba2b28SAlexander V. Chernikov 1390cba2b28SAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 1400cba2b28SAlexander V. Chernikov TAILQ_FOREACH(os, &tcfg->state_list, next) 141fb4b37a3SAlexander V. Chernikov os->func(object, os); 1420cba2b28SAlexander V. Chernikov } 1430cba2b28SAlexander V. Chernikov 1440cba2b28SAlexander V. Chernikov void 1450cba2b28SAlexander V. Chernikov add_toperation_state(struct ip_fw_chain *ch, struct tableop_state *ts) 1460cba2b28SAlexander V. Chernikov { 1470cba2b28SAlexander V. Chernikov struct tables_config *tcfg; 1480cba2b28SAlexander V. Chernikov 1490cba2b28SAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 1500cba2b28SAlexander V. Chernikov TAILQ_INSERT_HEAD(&tcfg->state_list, &ts->opstate, next); 1510cba2b28SAlexander V. Chernikov } 1520cba2b28SAlexander V. Chernikov 1530cba2b28SAlexander V. Chernikov void 1540cba2b28SAlexander V. Chernikov del_toperation_state(struct ip_fw_chain *ch, struct tableop_state *ts) 1550cba2b28SAlexander V. Chernikov { 1560cba2b28SAlexander V. Chernikov struct tables_config *tcfg; 1570cba2b28SAlexander V. Chernikov 1580cba2b28SAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 1590cba2b28SAlexander V. Chernikov TAILQ_REMOVE(&tcfg->state_list, &ts->opstate, next); 1600cba2b28SAlexander V. Chernikov } 1610cba2b28SAlexander V. Chernikov 1620cba2b28SAlexander V. Chernikov void 1630cba2b28SAlexander V. Chernikov tc_ref(struct table_config *tc) 1640cba2b28SAlexander V. Chernikov { 1650cba2b28SAlexander V. Chernikov 1660cba2b28SAlexander V. Chernikov tc->no.refcnt++; 1670cba2b28SAlexander V. Chernikov } 1680cba2b28SAlexander V. Chernikov 1690cba2b28SAlexander V. Chernikov void 1700cba2b28SAlexander V. Chernikov tc_unref(struct table_config *tc) 1710cba2b28SAlexander V. Chernikov { 1720cba2b28SAlexander V. Chernikov 1730cba2b28SAlexander V. Chernikov tc->no.refcnt--; 1740cba2b28SAlexander V. Chernikov } 1750cba2b28SAlexander V. Chernikov 1760cba2b28SAlexander V. Chernikov static struct table_value * 1770cba2b28SAlexander V. Chernikov get_table_value(struct ip_fw_chain *ch, struct table_config *tc, uint32_t kidx) 1780cba2b28SAlexander V. Chernikov { 1790cba2b28SAlexander V. Chernikov struct table_value *pval; 1800cba2b28SAlexander V. Chernikov 1810cba2b28SAlexander V. Chernikov pval = (struct table_value *)ch->valuestate; 1820cba2b28SAlexander V. Chernikov 1830cba2b28SAlexander V. Chernikov return (&pval[kidx]); 1840cba2b28SAlexander V. Chernikov } 1850cba2b28SAlexander V. Chernikov 1860cba2b28SAlexander V. Chernikov 1873a845e10SAlexander V. Chernikov /* 1883a845e10SAlexander V. Chernikov * Checks if we're able to insert/update entry @tei into table 1893a845e10SAlexander V. Chernikov * w.r.t @tc limits. 1903a845e10SAlexander V. Chernikov * May alter @tei to indicate insertion error / insert 1913a845e10SAlexander V. Chernikov * options. 1923a845e10SAlexander V. Chernikov * 1933a845e10SAlexander V. Chernikov * Returns 0 if operation can be performed/ 1943a845e10SAlexander V. Chernikov */ 1953a845e10SAlexander V. Chernikov static int 1963a845e10SAlexander V. Chernikov check_table_limit(struct table_config *tc, struct tentry_info *tei) 1973a845e10SAlexander V. Chernikov { 198b074b7bbSAlexander V. Chernikov 1993a845e10SAlexander V. Chernikov if (tc->limit == 0 || tc->count < tc->limit) 2003a845e10SAlexander V. Chernikov return (0); 2013a845e10SAlexander V. Chernikov 2023a845e10SAlexander V. Chernikov if ((tei->flags & TEI_FLAGS_UPDATE) == 0) { 2033a845e10SAlexander V. Chernikov /* Notify userland on error cause */ 2043a845e10SAlexander V. Chernikov tei->flags |= TEI_FLAGS_LIMIT; 2053a845e10SAlexander V. Chernikov return (EFBIG); 2063a845e10SAlexander V. Chernikov } 2073a845e10SAlexander V. Chernikov 2083a845e10SAlexander V. Chernikov /* 2093a845e10SAlexander V. Chernikov * We have UPDATE flag set. 2103a845e10SAlexander V. Chernikov * Permit updating record (if found), 2113a845e10SAlexander V. Chernikov * but restrict adding new one since we've 2123a845e10SAlexander V. Chernikov * already hit the limit. 2133a845e10SAlexander V. Chernikov */ 2143a845e10SAlexander V. Chernikov tei->flags |= TEI_FLAGS_DONTADD; 2153a845e10SAlexander V. Chernikov 2163a845e10SAlexander V. Chernikov return (0); 2173a845e10SAlexander V. Chernikov } 2183a845e10SAlexander V. Chernikov 2193a845e10SAlexander V. Chernikov /* 2201bc0d457SAlexander V. Chernikov * Convert algorithm callback return code into 2211bc0d457SAlexander V. Chernikov * one of pre-defined states known by userland. 2223a845e10SAlexander V. Chernikov */ 2231bc0d457SAlexander V. Chernikov static void 224867708f7SAlexander V. Chernikov store_tei_result(struct tentry_info *tei, int op, int error, uint32_t num) 2253b3a8eb9SGleb Smirnoff { 2261bc0d457SAlexander V. Chernikov int flag; 2273b3a8eb9SGleb Smirnoff 2281bc0d457SAlexander V. Chernikov flag = 0; 2291bc0d457SAlexander V. Chernikov 2301bc0d457SAlexander V. Chernikov switch (error) { 2311bc0d457SAlexander V. Chernikov case 0: 232867708f7SAlexander V. Chernikov if (op == OP_ADD && num != 0) 2331bc0d457SAlexander V. Chernikov flag = TEI_FLAGS_ADDED; 234867708f7SAlexander V. Chernikov if (op == OP_DEL) 2351bc0d457SAlexander V. Chernikov flag = TEI_FLAGS_DELETED; 2361bc0d457SAlexander V. Chernikov break; 2371bc0d457SAlexander V. Chernikov case ENOENT: 2381bc0d457SAlexander V. Chernikov flag = TEI_FLAGS_NOTFOUND; 2391bc0d457SAlexander V. Chernikov break; 2401bc0d457SAlexander V. Chernikov case EEXIST: 2411bc0d457SAlexander V. Chernikov flag = TEI_FLAGS_EXISTS; 2421bc0d457SAlexander V. Chernikov break; 2431bc0d457SAlexander V. Chernikov default: 2441bc0d457SAlexander V. Chernikov flag = TEI_FLAGS_ERROR; 2451bc0d457SAlexander V. Chernikov } 2461bc0d457SAlexander V. Chernikov 2471bc0d457SAlexander V. Chernikov tei->flags |= flag; 2481bc0d457SAlexander V. Chernikov } 2499f7d47b0SAlexander V. Chernikov 250f99fbf96SAlexander V. Chernikov /* 251f99fbf96SAlexander V. Chernikov * Creates and references table with default parameters. 252f99fbf96SAlexander V. Chernikov * Saves table config, algo and allocated kidx info @ptc, @pta and 253f99fbf96SAlexander V. Chernikov * @pkidx if non-zero. 254f99fbf96SAlexander V. Chernikov * Used for table auto-creation to support old binaries. 255f99fbf96SAlexander V. Chernikov * 256f99fbf96SAlexander V. Chernikov * Returns 0 on success. 257f99fbf96SAlexander V. Chernikov */ 2580468c5baSAlexander V. Chernikov static int 2590468c5baSAlexander V. Chernikov create_table_compat(struct ip_fw_chain *ch, struct tid_info *ti, 260867708f7SAlexander V. Chernikov uint16_t *pkidx) 2610468c5baSAlexander V. Chernikov { 2620468c5baSAlexander V. Chernikov ipfw_xtable_info xi; 2630468c5baSAlexander V. Chernikov int error; 2640468c5baSAlexander V. Chernikov 2650468c5baSAlexander V. Chernikov memset(&xi, 0, sizeof(xi)); 2660cba2b28SAlexander V. Chernikov /* Set default value mask for legacy clients */ 2670cba2b28SAlexander V. Chernikov xi.vmask = IPFW_VTYPE_LEGACY; 2680468c5baSAlexander V. Chernikov 269867708f7SAlexander V. Chernikov error = create_table_internal(ch, ti, NULL, &xi, pkidx, 1); 2700468c5baSAlexander V. Chernikov if (error != 0) 2710468c5baSAlexander V. Chernikov return (error); 2720468c5baSAlexander V. Chernikov 2730468c5baSAlexander V. Chernikov return (0); 2740468c5baSAlexander V. Chernikov } 2750468c5baSAlexander V. Chernikov 2769f7d47b0SAlexander V. Chernikov /* 2771bc0d457SAlexander V. Chernikov * Find and reference existing table optionally 2781bc0d457SAlexander V. Chernikov * creating new one. 2791bc0d457SAlexander V. Chernikov * 280867708f7SAlexander V. Chernikov * Saves found table config into @ptc. 281867708f7SAlexander V. Chernikov * Note function may drop/acquire UH_WLOCK. 2821bc0d457SAlexander V. Chernikov * Returns 0 if table was found/created and referenced 2831bc0d457SAlexander V. Chernikov * or non-zero return code. 2849f7d47b0SAlexander V. Chernikov */ 2851bc0d457SAlexander V. Chernikov static int 2861bc0d457SAlexander V. Chernikov find_ref_table(struct ip_fw_chain *ch, struct tid_info *ti, 2874dff4ae0SAlexander V. Chernikov struct tentry_info *tei, uint32_t count, int op, 288867708f7SAlexander V. Chernikov struct table_config **ptc) 2891bc0d457SAlexander V. Chernikov { 2901bc0d457SAlexander V. Chernikov struct namedobj_instance *ni; 2911bc0d457SAlexander V. Chernikov struct table_config *tc; 292867708f7SAlexander V. Chernikov uint16_t kidx; 2931bc0d457SAlexander V. Chernikov int error; 2941bc0d457SAlexander V. Chernikov 295867708f7SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 2961bc0d457SAlexander V. Chernikov 2971bc0d457SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 2981bc0d457SAlexander V. Chernikov tc = NULL; 2999f7d47b0SAlexander V. Chernikov if ((tc = find_table(ni, ti)) != NULL) { 3009f7d47b0SAlexander V. Chernikov /* check table type */ 30174b22066SAlexander V. Chernikov if (tc->no.subtype != ti->type) 3023b3a8eb9SGleb Smirnoff return (EINVAL); 3033b3a8eb9SGleb Smirnoff 304867708f7SAlexander V. Chernikov if (tc->locked != 0) 3054f43138aSAlexander V. Chernikov return (EACCES); 3064f43138aSAlexander V. Chernikov 3074c0c07a5SAlexander V. Chernikov /* Try to exit early on limit hit */ 3084dff4ae0SAlexander V. Chernikov if (op == OP_ADD && count == 1 && 309867708f7SAlexander V. Chernikov check_table_limit(tc, tei) != 0) 3104c0c07a5SAlexander V. Chernikov return (EFBIG); 3114c0c07a5SAlexander V. Chernikov 312867708f7SAlexander V. Chernikov /* Reference and return */ 3139f7d47b0SAlexander V. Chernikov tc->no.refcnt++; 314867708f7SAlexander V. Chernikov *ptc = tc; 315867708f7SAlexander V. Chernikov return (0); 3169f7d47b0SAlexander V. Chernikov } 3173b3a8eb9SGleb Smirnoff 3184dff4ae0SAlexander V. Chernikov if (op == OP_DEL) 3191bc0d457SAlexander V. Chernikov return (ESRCH); 3201bc0d457SAlexander V. Chernikov 321db785d31SAlexander V. Chernikov /* Compability mode: create new table for old clients */ 322db785d31SAlexander V. Chernikov if ((tei->flags & TEI_FLAGS_COMPAT) == 0) 323db785d31SAlexander V. Chernikov return (ESRCH); 3243b3a8eb9SGleb Smirnoff 325867708f7SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 326867708f7SAlexander V. Chernikov error = create_table_compat(ch, ti, &kidx); 327867708f7SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 328867708f7SAlexander V. Chernikov 329db785d31SAlexander V. Chernikov if (error != 0) 330db785d31SAlexander V. Chernikov return (error); 331db785d31SAlexander V. Chernikov 332867708f7SAlexander V. Chernikov tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, kidx); 333867708f7SAlexander V. Chernikov KASSERT(tc != NULL, ("create_table_compat returned bad idx %d", kidx)); 334db785d31SAlexander V. Chernikov 335867708f7SAlexander V. Chernikov /* OK, now we've got referenced table. */ 3361bc0d457SAlexander V. Chernikov *ptc = tc; 3371bc0d457SAlexander V. Chernikov return (0); 3381bc0d457SAlexander V. Chernikov } 3391bc0d457SAlexander V. Chernikov 3401bc0d457SAlexander V. Chernikov /* 341867708f7SAlexander V. Chernikov * Rolls back already @added to @tc entries using state array @ta_buf_m. 3421bc0d457SAlexander V. Chernikov * Assume the following layout: 3431bc0d457SAlexander V. Chernikov * 1) ADD state (ta_buf_m[0] ... t_buf_m[added - 1]) for handling update cases 3441bc0d457SAlexander V. Chernikov * 2) DEL state (ta_buf_m[count[ ... t_buf_m[count + added - 1]) 3451bc0d457SAlexander V. Chernikov * for storing deleted state 3461bc0d457SAlexander V. Chernikov */ 3471bc0d457SAlexander V. Chernikov static void 3481bc0d457SAlexander V. Chernikov rollback_added_entries(struct ip_fw_chain *ch, struct table_config *tc, 3491bc0d457SAlexander V. Chernikov struct table_info *tinfo, struct tentry_info *tei, caddr_t ta_buf_m, 3501bc0d457SAlexander V. Chernikov uint32_t count, uint32_t added) 3511bc0d457SAlexander V. Chernikov { 3521bc0d457SAlexander V. Chernikov struct table_algo *ta; 3531bc0d457SAlexander V. Chernikov struct tentry_info *ptei; 3541bc0d457SAlexander V. Chernikov caddr_t v, vv; 3551bc0d457SAlexander V. Chernikov size_t ta_buf_sz; 3561bc0d457SAlexander V. Chernikov int error, i; 3571bc0d457SAlexander V. Chernikov uint32_t num; 3581bc0d457SAlexander V. Chernikov 3591bc0d457SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 3601bc0d457SAlexander V. Chernikov 3611bc0d457SAlexander V. Chernikov ta = tc->ta; 3623a845e10SAlexander V. Chernikov ta_buf_sz = ta->ta_buf_size; 3631bc0d457SAlexander V. Chernikov v = ta_buf_m; 3641bc0d457SAlexander V. Chernikov vv = v + count * ta_buf_sz; 3651bc0d457SAlexander V. Chernikov for (i = 0; i < added; i++, v += ta_buf_sz, vv += ta_buf_sz) { 3661bc0d457SAlexander V. Chernikov ptei = &tei[i]; 3671bc0d457SAlexander V. Chernikov if ((ptei->flags & TEI_FLAGS_UPDATED) != 0) { 3681bc0d457SAlexander V. Chernikov 3691bc0d457SAlexander V. Chernikov /* 3701bc0d457SAlexander V. Chernikov * We have old value stored by previous 3711bc0d457SAlexander V. Chernikov * call in @ptei->value. Do add once again 3721bc0d457SAlexander V. Chernikov * to restore it. 3731bc0d457SAlexander V. Chernikov */ 3741bc0d457SAlexander V. Chernikov error = ta->add(tc->astate, tinfo, ptei, v, &num); 3751bc0d457SAlexander V. Chernikov KASSERT(error == 0, ("rollback UPDATE fail")); 3761bc0d457SAlexander V. Chernikov KASSERT(num == 0, ("rollback UPDATE fail2")); 3771bc0d457SAlexander V. Chernikov continue; 3781bc0d457SAlexander V. Chernikov } 3791bc0d457SAlexander V. Chernikov 3801bc0d457SAlexander V. Chernikov error = ta->prepare_del(ch, ptei, vv); 3811bc0d457SAlexander V. Chernikov KASSERT(error == 0, ("pre-rollback INSERT failed")); 3821bc0d457SAlexander V. Chernikov error = ta->del(tc->astate, tinfo, ptei, vv, &num); 3831bc0d457SAlexander V. Chernikov KASSERT(error == 0, ("rollback INSERT failed")); 3841bc0d457SAlexander V. Chernikov tc->count -= num; 3851bc0d457SAlexander V. Chernikov } 3861bc0d457SAlexander V. Chernikov } 3871bc0d457SAlexander V. Chernikov 3881bc0d457SAlexander V. Chernikov /* 3891bc0d457SAlexander V. Chernikov * Prepares add/del state for all @count entries in @tei. 3901bc0d457SAlexander V. Chernikov * Uses either stack buffer (@ta_buf) or allocates a new one. 3911bc0d457SAlexander V. Chernikov * Stores pointer to allocated buffer back to @ta_buf. 3921bc0d457SAlexander V. Chernikov * 3931bc0d457SAlexander V. Chernikov * Returns 0 on success. 3941bc0d457SAlexander V. Chernikov */ 3951bc0d457SAlexander V. Chernikov static int 3961bc0d457SAlexander V. Chernikov prepare_batch_buffer(struct ip_fw_chain *ch, struct table_algo *ta, 3974dff4ae0SAlexander V. Chernikov struct tentry_info *tei, uint32_t count, int op, caddr_t *ta_buf) 3981bc0d457SAlexander V. Chernikov { 3991bc0d457SAlexander V. Chernikov caddr_t ta_buf_m, v; 4001bc0d457SAlexander V. Chernikov size_t ta_buf_sz, sz; 4011bc0d457SAlexander V. Chernikov struct tentry_info *ptei; 4021bc0d457SAlexander V. Chernikov int error, i; 4031bc0d457SAlexander V. Chernikov 4041bc0d457SAlexander V. Chernikov error = 0; 4051bc0d457SAlexander V. Chernikov ta_buf_sz = ta->ta_buf_size; 4063a845e10SAlexander V. Chernikov if (count == 1) { 4071bc0d457SAlexander V. Chernikov /* Sigle add/delete, use on-stack buffer */ 4081bc0d457SAlexander V. Chernikov memset(*ta_buf, 0, TA_BUF_SZ); 4091bc0d457SAlexander V. Chernikov ta_buf_m = *ta_buf; 4103a845e10SAlexander V. Chernikov } else { 4113a845e10SAlexander V. Chernikov 4123a845e10SAlexander V. Chernikov /* 4131bc0d457SAlexander V. Chernikov * Multiple adds/deletes, allocate larger buffer 4141bc0d457SAlexander V. Chernikov * 4151bc0d457SAlexander V. Chernikov * Note we need 2xcount buffer for add case: 4161bc0d457SAlexander V. Chernikov * we have hold both ADD state 4173a845e10SAlexander V. Chernikov * and DELETE state (this may be needed 4183a845e10SAlexander V. Chernikov * if we need to rollback all changes) 4193a845e10SAlexander V. Chernikov */ 4201bc0d457SAlexander V. Chernikov sz = count * ta_buf_sz; 4214dff4ae0SAlexander V. Chernikov ta_buf_m = malloc((op == OP_ADD) ? sz * 2 : sz, M_TEMP, 4223a845e10SAlexander V. Chernikov M_WAITOK | M_ZERO); 4233a845e10SAlexander V. Chernikov } 4241bc0d457SAlexander V. Chernikov 4253a845e10SAlexander V. Chernikov v = ta_buf_m; 4263a845e10SAlexander V. Chernikov for (i = 0; i < count; i++, v += ta_buf_sz) { 4271bc0d457SAlexander V. Chernikov ptei = &tei[i]; 4284dff4ae0SAlexander V. Chernikov error = (op == OP_ADD) ? 4291bc0d457SAlexander V. Chernikov ta->prepare_add(ch, ptei, v) : ta->prepare_del(ch, ptei, v); 4303a845e10SAlexander V. Chernikov 4313a845e10SAlexander V. Chernikov /* 4323a845e10SAlexander V. Chernikov * Some syntax error (incorrect mask, or address, or 4333a845e10SAlexander V. Chernikov * anything). Return error regardless of atomicity 4343a845e10SAlexander V. Chernikov * settings. 4353a845e10SAlexander V. Chernikov */ 436db785d31SAlexander V. Chernikov if (error != 0) 4371bc0d457SAlexander V. Chernikov break; 4383a845e10SAlexander V. Chernikov } 4393b3a8eb9SGleb Smirnoff 4401bc0d457SAlexander V. Chernikov *ta_buf = ta_buf_m; 4411bc0d457SAlexander V. Chernikov return (error); 4421bc0d457SAlexander V. Chernikov } 4431bc0d457SAlexander V. Chernikov 4441bc0d457SAlexander V. Chernikov /* 4451bc0d457SAlexander V. Chernikov * Flushes allocated state for each @count entries in @tei. 4461bc0d457SAlexander V. Chernikov * Frees @ta_buf_m if differs from stack buffer @ta_buf. 4471bc0d457SAlexander V. Chernikov */ 4481bc0d457SAlexander V. Chernikov static void 4491bc0d457SAlexander V. Chernikov flush_batch_buffer(struct ip_fw_chain *ch, struct table_algo *ta, 450867708f7SAlexander V. Chernikov struct tentry_info *tei, uint32_t count, int rollback, 4511bc0d457SAlexander V. Chernikov caddr_t ta_buf_m, caddr_t ta_buf) 4521bc0d457SAlexander V. Chernikov { 4531bc0d457SAlexander V. Chernikov caddr_t v; 4540cba2b28SAlexander V. Chernikov struct tentry_info *ptei; 4551bc0d457SAlexander V. Chernikov size_t ta_buf_sz; 4561bc0d457SAlexander V. Chernikov int i; 4571bc0d457SAlexander V. Chernikov 4581bc0d457SAlexander V. Chernikov ta_buf_sz = ta->ta_buf_size; 4591bc0d457SAlexander V. Chernikov 4601bc0d457SAlexander V. Chernikov /* Run cleaning callback anyway */ 4611bc0d457SAlexander V. Chernikov v = ta_buf_m; 4620cba2b28SAlexander V. Chernikov for (i = 0; i < count; i++, v += ta_buf_sz) { 4630cba2b28SAlexander V. Chernikov ptei = &tei[i]; 4640cba2b28SAlexander V. Chernikov ta->flush_entry(ch, ptei, v); 4650cba2b28SAlexander V. Chernikov if (ptei->ptv != NULL) { 4660cba2b28SAlexander V. Chernikov free(ptei->ptv, M_IPFW); 4670cba2b28SAlexander V. Chernikov ptei->ptv = NULL; 4680cba2b28SAlexander V. Chernikov } 4690cba2b28SAlexander V. Chernikov } 4701bc0d457SAlexander V. Chernikov 4711bc0d457SAlexander V. Chernikov /* Clean up "deleted" state in case of rollback */ 4721bc0d457SAlexander V. Chernikov if (rollback != 0) { 4731bc0d457SAlexander V. Chernikov v = ta_buf_m + count * ta_buf_sz; 4741bc0d457SAlexander V. Chernikov for (i = 0; i < count; i++, v += ta_buf_sz) 4751bc0d457SAlexander V. Chernikov ta->flush_entry(ch, &tei[i], v); 4761bc0d457SAlexander V. Chernikov } 4771bc0d457SAlexander V. Chernikov 4781bc0d457SAlexander V. Chernikov if (ta_buf_m != ta_buf) 4791bc0d457SAlexander V. Chernikov free(ta_buf_m, M_TEMP); 4801bc0d457SAlexander V. Chernikov } 4811bc0d457SAlexander V. Chernikov 48271af39bfSAlexander V. Chernikov 48371af39bfSAlexander V. Chernikov static void 48471af39bfSAlexander V. Chernikov rollback_add_entry(void *object, struct op_state *_state) 48571af39bfSAlexander V. Chernikov { 48671af39bfSAlexander V. Chernikov struct ip_fw_chain *ch; 48771af39bfSAlexander V. Chernikov struct tableop_state *ts; 48871af39bfSAlexander V. Chernikov 48971af39bfSAlexander V. Chernikov ts = (struct tableop_state *)_state; 49071af39bfSAlexander V. Chernikov 49171af39bfSAlexander V. Chernikov if (ts->tc != object && ts->ch != object) 49271af39bfSAlexander V. Chernikov return; 49371af39bfSAlexander V. Chernikov 49471af39bfSAlexander V. Chernikov ch = ts->ch; 49571af39bfSAlexander V. Chernikov 49671af39bfSAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 49771af39bfSAlexander V. Chernikov 49871af39bfSAlexander V. Chernikov /* Call specifid unlockers */ 49971af39bfSAlexander V. Chernikov rollback_table_values(ts); 50071af39bfSAlexander V. Chernikov 50171af39bfSAlexander V. Chernikov /* Indicate we've called */ 50271af39bfSAlexander V. Chernikov ts->modified = 1; 50371af39bfSAlexander V. Chernikov } 50471af39bfSAlexander V. Chernikov 5051bc0d457SAlexander V. Chernikov /* 5061bc0d457SAlexander V. Chernikov * Adds/updates one or more entries in table @ti. 50771af39bfSAlexander V. Chernikov * 50871af39bfSAlexander V. Chernikov * Function may drop/reacquire UH wlock multiple times due to 50971af39bfSAlexander V. Chernikov * items alloc, algorithm callbacks (check_space), value linkage 51071af39bfSAlexander V. Chernikov * (new values, value storage realloc), etc.. 51171af39bfSAlexander V. Chernikov * Other processes like other adds (which may involve storage resize), 51271af39bfSAlexander V. Chernikov * table swaps (which changes table data and may change algo type), 51371af39bfSAlexander V. Chernikov * table modify (which may change value mask) may be executed 51471af39bfSAlexander V. Chernikov * simultaneously so we need to deal with it. 51571af39bfSAlexander V. Chernikov * 51671af39bfSAlexander V. Chernikov * The following approach was implemented: 51771af39bfSAlexander V. Chernikov * we have per-chain linked list, protected with UH lock. 51871af39bfSAlexander V. Chernikov * add_table_entry prepares special on-stack structure wthich is passed 51971af39bfSAlexander V. Chernikov * to its descendants. Users add this structure to this list before unlock. 52071af39bfSAlexander V. Chernikov * After performing needed operations and acquiring UH lock back, each user 52171af39bfSAlexander V. Chernikov * checks if structure has changed. If true, it rolls local state back and 52271af39bfSAlexander V. Chernikov * returns without error to the caller. 52371af39bfSAlexander V. Chernikov * add_table_entry() on its own checks if structure has changed and restarts 52471af39bfSAlexander V. Chernikov * its operation from the beginning (goto restart). 52571af39bfSAlexander V. Chernikov * 52671af39bfSAlexander V. Chernikov * Functions which are modifying fields of interest (currently 52771af39bfSAlexander V. Chernikov * resize_shared_value_storage() and swap_tables() ) 52871af39bfSAlexander V. Chernikov * traverses given list while holding UH lock immediately before 52971af39bfSAlexander V. Chernikov * performing their operations calling function provided be list entry 53071af39bfSAlexander V. Chernikov * ( currently rollback_add_entry ) which performs rollback for all necessary 53171af39bfSAlexander V. Chernikov * state and sets appropriate values in structure indicating rollback 53271af39bfSAlexander V. Chernikov * has happened. 53371af39bfSAlexander V. Chernikov * 53471af39bfSAlexander V. Chernikov * Algo interaction: 5350468c5baSAlexander V. Chernikov * Function references @ti first to ensure table won't 5360468c5baSAlexander V. Chernikov * disappear or change its type. 5370468c5baSAlexander V. Chernikov * After that, prepare_add callback is called for each @tei entry. 5380468c5baSAlexander V. Chernikov * Next, we try to add each entry under UH+WHLOCK 5390468c5baSAlexander V. Chernikov * using add() callback. 5400468c5baSAlexander V. Chernikov * Finally, we free all state by calling flush_entry callback 5410468c5baSAlexander V. Chernikov * for each @tei. 5421bc0d457SAlexander V. Chernikov * 5431bc0d457SAlexander V. Chernikov * Returns 0 on success. 5441bc0d457SAlexander V. Chernikov */ 5451bc0d457SAlexander V. Chernikov int 5461bc0d457SAlexander V. Chernikov add_table_entry(struct ip_fw_chain *ch, struct tid_info *ti, 5471bc0d457SAlexander V. Chernikov struct tentry_info *tei, uint8_t flags, uint32_t count) 5481bc0d457SAlexander V. Chernikov { 5491bc0d457SAlexander V. Chernikov struct table_config *tc; 5501bc0d457SAlexander V. Chernikov struct table_algo *ta; 5511bc0d457SAlexander V. Chernikov uint16_t kidx; 5521bc0d457SAlexander V. Chernikov int error, first_error, i, rollback; 5531bc0d457SAlexander V. Chernikov uint32_t num, numadd; 5541bc0d457SAlexander V. Chernikov struct tentry_info *ptei; 5550cba2b28SAlexander V. Chernikov struct tableop_state ts; 5561bc0d457SAlexander V. Chernikov char ta_buf[TA_BUF_SZ]; 5571bc0d457SAlexander V. Chernikov caddr_t ta_buf_m, v; 5581bc0d457SAlexander V. Chernikov 5590cba2b28SAlexander V. Chernikov memset(&ts, 0, sizeof(ts)); 560d4e1b515SAlexander V. Chernikov ta = NULL; 5610cba2b28SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 5620cba2b28SAlexander V. Chernikov 5631bc0d457SAlexander V. Chernikov /* 5641bc0d457SAlexander V. Chernikov * Find and reference existing table. 5651bc0d457SAlexander V. Chernikov */ 5660cba2b28SAlexander V. Chernikov restart: 5670cba2b28SAlexander V. Chernikov if (ts.modified != 0) { 5688ebca97fSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 5690cba2b28SAlexander V. Chernikov flush_batch_buffer(ch, ta, tei, count, rollback, 5700cba2b28SAlexander V. Chernikov ta_buf_m, ta_buf); 5710cba2b28SAlexander V. Chernikov memset(&ts, 0, sizeof(ts)); 5728ebca97fSAlexander V. Chernikov ta = NULL; 5738ebca97fSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 5740cba2b28SAlexander V. Chernikov } 5758ebca97fSAlexander V. Chernikov 576867708f7SAlexander V. Chernikov error = find_ref_table(ch, ti, tei, count, OP_ADD, &tc); 577867708f7SAlexander V. Chernikov if (error != 0) { 578867708f7SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 5791bc0d457SAlexander V. Chernikov return (error); 580867708f7SAlexander V. Chernikov } 581867708f7SAlexander V. Chernikov ta = tc->ta; 582fb4b37a3SAlexander V. Chernikov 583fb4b37a3SAlexander V. Chernikov /* Fill in tablestate */ 5840cba2b28SAlexander V. Chernikov ts.ch = ch; 58571af39bfSAlexander V. Chernikov ts.opstate.func = rollback_add_entry; 5860cba2b28SAlexander V. Chernikov ts.tc = tc; 5870cba2b28SAlexander V. Chernikov ts.vshared = tc->vshared; 5880cba2b28SAlexander V. Chernikov ts.vmask = tc->vmask; 5890cba2b28SAlexander V. Chernikov ts.ta = ta; 5900cba2b28SAlexander V. Chernikov ts.tei = tei; 5910cba2b28SAlexander V. Chernikov ts.count = count; 5920cba2b28SAlexander V. Chernikov rollback = 0; 5930cba2b28SAlexander V. Chernikov add_toperation_state(ch, &ts); 594867708f7SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 5951bc0d457SAlexander V. Chernikov 5961bc0d457SAlexander V. Chernikov /* Allocate memory and prepare record(s) */ 5971bc0d457SAlexander V. Chernikov /* Pass stack buffer by default */ 5981bc0d457SAlexander V. Chernikov ta_buf_m = ta_buf; 5994dff4ae0SAlexander V. Chernikov error = prepare_batch_buffer(ch, ta, tei, count, OP_ADD, &ta_buf_m); 6001bc0d457SAlexander V. Chernikov 601b074b7bbSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 602b45fa3faSAlexander V. Chernikov del_toperation_state(ch, &ts); 603c8d5d308SAlexander V. Chernikov /* Drop reference we've used in first search */ 604c8d5d308SAlexander V. Chernikov tc->no.refcnt--; 605c8d5d308SAlexander V. Chernikov 606b45fa3faSAlexander V. Chernikov /* Check prepare_batch_buffer() error */ 607b45fa3faSAlexander V. Chernikov if (error != 0) 608b45fa3faSAlexander V. Chernikov goto cleanup; 609b45fa3faSAlexander V. Chernikov 610b6ee846eSAlexander V. Chernikov /* 6110cba2b28SAlexander V. Chernikov * Check if table swap has happened. 6120cba2b28SAlexander V. Chernikov * (so table algo might be changed). 6130cba2b28SAlexander V. Chernikov * Restart operation to achieve consistent behavior. 614b6ee846eSAlexander V. Chernikov */ 6150cba2b28SAlexander V. Chernikov if (ts.modified != 0) 6160cba2b28SAlexander V. Chernikov goto restart; 617b6ee846eSAlexander V. Chernikov 618c8d5d308SAlexander V. Chernikov /* 6190cba2b28SAlexander V. Chernikov * Link all values values to shared/per-table value array. 6200cba2b28SAlexander V. Chernikov * 6210cba2b28SAlexander V. Chernikov * May release/reacquire UH_WLOCK. 622c8d5d308SAlexander V. Chernikov */ 6230cba2b28SAlexander V. Chernikov error = ipfw_link_table_values(ch, &ts); 6240cba2b28SAlexander V. Chernikov if (error != 0) 625c8d5d308SAlexander V. Chernikov goto cleanup; 6260cba2b28SAlexander V. Chernikov if (ts.modified != 0) 6270cba2b28SAlexander V. Chernikov goto restart; 6280cba2b28SAlexander V. Chernikov 6290cba2b28SAlexander V. Chernikov /* 6300cba2b28SAlexander V. Chernikov * Ensure we are able to add all entries without additional 6310cba2b28SAlexander V. Chernikov * memory allocations. May release/reacquire UH_WLOCK. 6320cba2b28SAlexander V. Chernikov */ 6330cba2b28SAlexander V. Chernikov kidx = tc->no.kidx; 6340cba2b28SAlexander V. Chernikov error = check_table_space(ch, &ts, tc, KIDX_TO_TI(ch, kidx), count); 6350cba2b28SAlexander V. Chernikov if (error != 0) 6360cba2b28SAlexander V. Chernikov goto cleanup; 6370cba2b28SAlexander V. Chernikov if (ts.modified != 0) 6380cba2b28SAlexander V. Chernikov goto restart; 639c8d5d308SAlexander V. Chernikov 6403a845e10SAlexander V. Chernikov /* We've got valid table in @tc. Let's try to add data */ 6419f7d47b0SAlexander V. Chernikov kidx = tc->no.kidx; 6429f7d47b0SAlexander V. Chernikov ta = tc->ta; 6433a845e10SAlexander V. Chernikov numadd = 0; 6443a845e10SAlexander V. Chernikov first_error = 0; 6459f7d47b0SAlexander V. Chernikov 646b074b7bbSAlexander V. Chernikov IPFW_WLOCK(ch); 6473a845e10SAlexander V. Chernikov 6483a845e10SAlexander V. Chernikov v = ta_buf_m; 6491bc0d457SAlexander V. Chernikov for (i = 0; i < count; i++, v += ta->ta_buf_size) { 6503a845e10SAlexander V. Chernikov ptei = &tei[i]; 6513a845e10SAlexander V. Chernikov num = 0; 6523a845e10SAlexander V. Chernikov /* check limit before adding */ 6533a845e10SAlexander V. Chernikov if ((error = check_table_limit(tc, ptei)) == 0) { 6543a845e10SAlexander V. Chernikov error = ta->add(tc->astate, KIDX_TO_TI(ch, kidx), 6553a845e10SAlexander V. Chernikov ptei, v, &num); 6563a845e10SAlexander V. Chernikov /* Set status flag to inform userland */ 657867708f7SAlexander V. Chernikov store_tei_result(ptei, OP_ADD, error, num); 6583a845e10SAlexander V. Chernikov } 6593a845e10SAlexander V. Chernikov if (error == 0) { 6603a845e10SAlexander V. Chernikov /* Update number of records to ease limit checking */ 6613a845e10SAlexander V. Chernikov tc->count += num; 6623a845e10SAlexander V. Chernikov numadd += num; 6633a845e10SAlexander V. Chernikov continue; 6643a845e10SAlexander V. Chernikov } 6653a845e10SAlexander V. Chernikov 6663a845e10SAlexander V. Chernikov if (first_error == 0) 6673a845e10SAlexander V. Chernikov first_error = error; 6683a845e10SAlexander V. Chernikov 6693a845e10SAlexander V. Chernikov /* 6703a845e10SAlexander V. Chernikov * Some error have happened. Check our atomicity 6713a845e10SAlexander V. Chernikov * settings: continue if atomicity is not required, 6723a845e10SAlexander V. Chernikov * rollback changes otherwise. 6733a845e10SAlexander V. Chernikov */ 6743a845e10SAlexander V. Chernikov if ((flags & IPFW_CTF_ATOMIC) == 0) 6753a845e10SAlexander V. Chernikov continue; 6763a845e10SAlexander V. Chernikov 6771bc0d457SAlexander V. Chernikov rollback_added_entries(ch, tc, KIDX_TO_TI(ch, kidx), 6781bc0d457SAlexander V. Chernikov tei, ta_buf_m, count, i); 6790cba2b28SAlexander V. Chernikov 6800cba2b28SAlexander V. Chernikov rollback = 1; 6813a845e10SAlexander V. Chernikov break; 6823a845e10SAlexander V. Chernikov } 6833a845e10SAlexander V. Chernikov 6843b3a8eb9SGleb Smirnoff IPFW_WUNLOCK(ch); 6859f7d47b0SAlexander V. Chernikov 68671af39bfSAlexander V. Chernikov ipfw_garbage_table_values(ch, tc, tei, count, rollback); 6870cba2b28SAlexander V. Chernikov 688b6ee846eSAlexander V. Chernikov /* Permit post-add algorithm grow/rehash. */ 6893a845e10SAlexander V. Chernikov if (numadd != 0) 6900cba2b28SAlexander V. Chernikov check_table_space(ch, NULL, tc, KIDX_TO_TI(ch, kidx), 0); 691b074b7bbSAlexander V. Chernikov 6923a845e10SAlexander V. Chernikov /* Return first error to user, if any */ 6933a845e10SAlexander V. Chernikov error = first_error; 6943a845e10SAlexander V. Chernikov 6953a845e10SAlexander V. Chernikov cleanup: 6960cba2b28SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 6970cba2b28SAlexander V. Chernikov 698867708f7SAlexander V. Chernikov flush_batch_buffer(ch, ta, tei, count, rollback, ta_buf_m, ta_buf); 699b074b7bbSAlexander V. Chernikov 7009f7d47b0SAlexander V. Chernikov return (error); 7013b3a8eb9SGleb Smirnoff } 7023b3a8eb9SGleb Smirnoff 7033a845e10SAlexander V. Chernikov /* 7043a845e10SAlexander V. Chernikov * Deletes one or more entries in table @ti. 7053a845e10SAlexander V. Chernikov * 7063a845e10SAlexander V. Chernikov * Returns 0 on success. 7073a845e10SAlexander V. Chernikov */ 7083b3a8eb9SGleb Smirnoff int 7091832a7b3SAlexander V. Chernikov del_table_entry(struct ip_fw_chain *ch, struct tid_info *ti, 7103a845e10SAlexander V. Chernikov struct tentry_info *tei, uint8_t flags, uint32_t count) 7113b3a8eb9SGleb Smirnoff { 712b074b7bbSAlexander V. Chernikov struct table_config *tc; 7139f7d47b0SAlexander V. Chernikov struct table_algo *ta; 7143a845e10SAlexander V. Chernikov struct tentry_info *ptei; 715b074b7bbSAlexander V. Chernikov uint16_t kidx; 7163a845e10SAlexander V. Chernikov int error, first_error, i; 7173a845e10SAlexander V. Chernikov uint32_t num, numdel; 718b6ee846eSAlexander V. Chernikov char ta_buf[TA_BUF_SZ]; 7193a845e10SAlexander V. Chernikov caddr_t ta_buf_m, v; 7203b3a8eb9SGleb Smirnoff 721db785d31SAlexander V. Chernikov /* 7221bc0d457SAlexander V. Chernikov * Find and reference existing table. 723db785d31SAlexander V. Chernikov */ 724867708f7SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 725867708f7SAlexander V. Chernikov error = find_ref_table(ch, ti, tei, count, OP_DEL, &tc); 726867708f7SAlexander V. Chernikov if (error != 0) { 727867708f7SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 728db785d31SAlexander V. Chernikov return (error); 729867708f7SAlexander V. Chernikov } 730867708f7SAlexander V. Chernikov ta = tc->ta; 731867708f7SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 7323a845e10SAlexander V. Chernikov 73335e1bbd0SAlexander V. Chernikov /* Allocate memory and prepare record(s) */ 7341bc0d457SAlexander V. Chernikov /* Pass stack buffer by default */ 7353a845e10SAlexander V. Chernikov ta_buf_m = ta_buf; 7364dff4ae0SAlexander V. Chernikov error = prepare_batch_buffer(ch, ta, tei, count, OP_DEL, &ta_buf_m); 7373a845e10SAlexander V. Chernikov if (error != 0) 7383a845e10SAlexander V. Chernikov goto cleanup; 7399f7d47b0SAlexander V. Chernikov 7403a845e10SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 7413a845e10SAlexander V. Chernikov 7423a845e10SAlexander V. Chernikov /* Drop reference we've used in first search */ 7433a845e10SAlexander V. Chernikov tc->no.refcnt--; 7443a845e10SAlexander V. Chernikov 745c8d5d308SAlexander V. Chernikov /* 746c8d5d308SAlexander V. Chernikov * Check if table algo is still the same. 747c8d5d308SAlexander V. Chernikov * (changed ta may be the result of table swap). 748c8d5d308SAlexander V. Chernikov */ 749c8d5d308SAlexander V. Chernikov if (ta != tc->ta) { 750c8d5d308SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 751c8d5d308SAlexander V. Chernikov error = EINVAL; 752c8d5d308SAlexander V. Chernikov goto cleanup; 753c8d5d308SAlexander V. Chernikov } 754c8d5d308SAlexander V. Chernikov 755b074b7bbSAlexander V. Chernikov kidx = tc->no.kidx; 7563a845e10SAlexander V. Chernikov numdel = 0; 7573a845e10SAlexander V. Chernikov first_error = 0; 758b074b7bbSAlexander V. Chernikov 759b074b7bbSAlexander V. Chernikov IPFW_WLOCK(ch); 7603a845e10SAlexander V. Chernikov v = ta_buf_m; 7611bc0d457SAlexander V. Chernikov for (i = 0; i < count; i++, v += ta->ta_buf_size) { 7623a845e10SAlexander V. Chernikov ptei = &tei[i]; 7633a845e10SAlexander V. Chernikov num = 0; 7643a845e10SAlexander V. Chernikov error = ta->del(tc->astate, KIDX_TO_TI(ch, kidx), ptei, v, 7653a845e10SAlexander V. Chernikov &num); 7663a845e10SAlexander V. Chernikov /* Save state for userland */ 767867708f7SAlexander V. Chernikov store_tei_result(ptei, OP_DEL, error, num); 7683a845e10SAlexander V. Chernikov if (error != 0 && first_error == 0) 7693a845e10SAlexander V. Chernikov first_error = error; 7703a845e10SAlexander V. Chernikov tc->count -= num; 7713a845e10SAlexander V. Chernikov numdel += num; 7723a845e10SAlexander V. Chernikov } 7733b3a8eb9SGleb Smirnoff IPFW_WUNLOCK(ch); 7743b3a8eb9SGleb Smirnoff 7750cba2b28SAlexander V. Chernikov /* Unlink non-used values */ 77671af39bfSAlexander V. Chernikov ipfw_garbage_table_values(ch, tc, tei, count, 0); 7770cba2b28SAlexander V. Chernikov 7783a845e10SAlexander V. Chernikov if (numdel != 0) { 779b6ee846eSAlexander V. Chernikov /* Run post-del hook to permit shrinking */ 7800cba2b28SAlexander V. Chernikov check_table_space(ch, NULL, tc, KIDX_TO_TI(ch, kidx), 0); 781b6ee846eSAlexander V. Chernikov } 782b074b7bbSAlexander V. Chernikov 7839f7d47b0SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 7843b3a8eb9SGleb Smirnoff 7853a845e10SAlexander V. Chernikov /* Return first error to user, if any */ 7863a845e10SAlexander V. Chernikov error = first_error; 7873a845e10SAlexander V. Chernikov 7883a845e10SAlexander V. Chernikov cleanup: 789867708f7SAlexander V. Chernikov flush_batch_buffer(ch, ta, tei, count, 0, ta_buf_m, ta_buf); 790ac35ff17SAlexander V. Chernikov 791ac35ff17SAlexander V. Chernikov return (error); 792ac35ff17SAlexander V. Chernikov } 793ac35ff17SAlexander V. Chernikov 794db785d31SAlexander V. Chernikov /* 795b6ee846eSAlexander V. Chernikov * Ensure that table @tc has enough space to add @count entries without 796b6ee846eSAlexander V. Chernikov * need for reallocation. 797db785d31SAlexander V. Chernikov * 798db785d31SAlexander V. Chernikov * Callbacks order: 799301290bcSAlexander V. Chernikov * 0) need_modify() (UH_WLOCK) - checks if @count items can be added w/o resize. 800b6ee846eSAlexander V. Chernikov * 801db785d31SAlexander V. Chernikov * 1) alloc_modify (no locks, M_WAITOK) - alloc new state based on @pflags. 802db785d31SAlexander V. Chernikov * 2) prepare_modifyt (UH_WLOCK) - copy old data into new storage 803db785d31SAlexander V. Chernikov * 3) modify (UH_WLOCK + WLOCK) - switch pointers 804b6ee846eSAlexander V. Chernikov * 4) flush_modify (UH_WLOCK) - free state, if needed 805b6ee846eSAlexander V. Chernikov * 806b6ee846eSAlexander V. Chernikov * Returns 0 on success. 807db785d31SAlexander V. Chernikov */ 808db785d31SAlexander V. Chernikov static int 8090cba2b28SAlexander V. Chernikov check_table_space(struct ip_fw_chain *ch, struct tableop_state *ts, 8100cba2b28SAlexander V. Chernikov struct table_config *tc, struct table_info *ti, uint32_t count) 811db785d31SAlexander V. Chernikov { 812b6ee846eSAlexander V. Chernikov struct table_algo *ta; 813b6ee846eSAlexander V. Chernikov uint64_t pflags; 814b6ee846eSAlexander V. Chernikov char ta_buf[TA_BUF_SZ]; 815db785d31SAlexander V. Chernikov int error; 816db785d31SAlexander V. Chernikov 817b6ee846eSAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 818db785d31SAlexander V. Chernikov 819b6ee846eSAlexander V. Chernikov error = 0; 820b6ee846eSAlexander V. Chernikov ta = tc->ta; 821fd0869d5SAlexander V. Chernikov if (ta->need_modify == NULL) 822fd0869d5SAlexander V. Chernikov return (0); 823fd0869d5SAlexander V. Chernikov 824b6ee846eSAlexander V. Chernikov /* Acquire reference not to loose @tc between locks/unlocks */ 825b6ee846eSAlexander V. Chernikov tc->no.refcnt++; 826db785d31SAlexander V. Chernikov 827db785d31SAlexander V. Chernikov /* 828b6ee846eSAlexander V. Chernikov * TODO: think about avoiding race between large add/large delete 829b6ee846eSAlexander V. Chernikov * operation on algorithm which implements shrinking along with 830b6ee846eSAlexander V. Chernikov * growing. 831db785d31SAlexander V. Chernikov */ 832b6ee846eSAlexander V. Chernikov while (true) { 833b6ee846eSAlexander V. Chernikov pflags = 0; 834301290bcSAlexander V. Chernikov if (ta->need_modify(tc->astate, ti, count, &pflags) == 0) { 83535e1bbd0SAlexander V. Chernikov error = 0; 83635e1bbd0SAlexander V. Chernikov break; 837b6ee846eSAlexander V. Chernikov } 838db785d31SAlexander V. Chernikov 839b6ee846eSAlexander V. Chernikov /* We have to shrink/grow table */ 8400cba2b28SAlexander V. Chernikov if (ts != NULL) 8410cba2b28SAlexander V. Chernikov add_toperation_state(ch, ts); 842b6ee846eSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 843b6ee846eSAlexander V. Chernikov 844301290bcSAlexander V. Chernikov memset(&ta_buf, 0, sizeof(ta_buf)); 8450cba2b28SAlexander V. Chernikov error = ta->prepare_mod(ta_buf, &pflags); 846b6ee846eSAlexander V. Chernikov 847b6ee846eSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 8480cba2b28SAlexander V. Chernikov if (ts != NULL) 8490cba2b28SAlexander V. Chernikov del_toperation_state(ch, ts); 8500cba2b28SAlexander V. Chernikov 8510cba2b28SAlexander V. Chernikov if (error != 0) 8520cba2b28SAlexander V. Chernikov break; 8530cba2b28SAlexander V. Chernikov 8540cba2b28SAlexander V. Chernikov if (ts != NULL && ts->modified != 0) { 8550cba2b28SAlexander V. Chernikov 8560cba2b28SAlexander V. Chernikov /* 8570cba2b28SAlexander V. Chernikov * Swap operation has happened 8580cba2b28SAlexander V. Chernikov * so we're currently operating on other 8590cba2b28SAlexander V. Chernikov * table data. Stop doing this. 8600cba2b28SAlexander V. Chernikov */ 8610cba2b28SAlexander V. Chernikov ta->flush_mod(ta_buf); 8620cba2b28SAlexander V. Chernikov break; 8630cba2b28SAlexander V. Chernikov } 864b6ee846eSAlexander V. Chernikov 865b6ee846eSAlexander V. Chernikov /* Check if we still need to alter table */ 866b6ee846eSAlexander V. Chernikov ti = KIDX_TO_TI(ch, tc->no.kidx); 867301290bcSAlexander V. Chernikov if (ta->need_modify(tc->astate, ti, count, &pflags) == 0) { 868301290bcSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 869b6ee846eSAlexander V. Chernikov 870b6ee846eSAlexander V. Chernikov /* 87135e1bbd0SAlexander V. Chernikov * Other thread has already performed resize. 87235e1bbd0SAlexander V. Chernikov * Flush our state and return. 873b6ee846eSAlexander V. Chernikov */ 874b6ee846eSAlexander V. Chernikov ta->flush_mod(ta_buf); 875b6ee846eSAlexander V. Chernikov break; 876b6ee846eSAlexander V. Chernikov } 877b6ee846eSAlexander V. Chernikov 878b6ee846eSAlexander V. Chernikov error = ta->fill_mod(tc->astate, ti, ta_buf, &pflags); 879b6ee846eSAlexander V. Chernikov if (error == 0) { 880db785d31SAlexander V. Chernikov /* Do actual modification */ 881db785d31SAlexander V. Chernikov IPFW_WLOCK(ch); 88268394ec8SAlexander V. Chernikov ta->modify(tc->astate, ti, ta_buf, pflags); 883db785d31SAlexander V. Chernikov IPFW_WUNLOCK(ch); 884db785d31SAlexander V. Chernikov } 885db785d31SAlexander V. Chernikov 886b6ee846eSAlexander V. Chernikov /* Anyway, flush data and retry */ 887db785d31SAlexander V. Chernikov ta->flush_mod(ta_buf); 888b6ee846eSAlexander V. Chernikov } 889db785d31SAlexander V. Chernikov 890b6ee846eSAlexander V. Chernikov tc->no.refcnt--; 891db785d31SAlexander V. Chernikov return (error); 892db785d31SAlexander V. Chernikov } 893db785d31SAlexander V. Chernikov 8943a845e10SAlexander V. Chernikov /* 895ac35ff17SAlexander V. Chernikov * Adds or deletes record in table. 896ac35ff17SAlexander V. Chernikov * Data layout (v0): 897ac35ff17SAlexander V. Chernikov * Request: [ ip_fw3_opheader ipfw_table_xentry ] 898ac35ff17SAlexander V. Chernikov * 899ac35ff17SAlexander V. Chernikov * Returns 0 on success 900ac35ff17SAlexander V. Chernikov */ 901ac35ff17SAlexander V. Chernikov static int 9026b988f3aSAlexander V. Chernikov manage_table_ent_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 903ac35ff17SAlexander V. Chernikov struct sockopt_data *sd) 904ac35ff17SAlexander V. Chernikov { 905ac35ff17SAlexander V. Chernikov ipfw_table_xentry *xent; 906ac35ff17SAlexander V. Chernikov struct tentry_info tei; 907ac35ff17SAlexander V. Chernikov struct tid_info ti; 9080cba2b28SAlexander V. Chernikov struct table_value v; 909ac35ff17SAlexander V. Chernikov int error, hdrlen, read; 910ac35ff17SAlexander V. Chernikov 911ac35ff17SAlexander V. Chernikov hdrlen = offsetof(ipfw_table_xentry, k); 912ac35ff17SAlexander V. Chernikov 913ac35ff17SAlexander V. Chernikov /* Check minimum header size */ 914ac35ff17SAlexander V. Chernikov if (sd->valsize < (sizeof(*op3) + hdrlen)) 915ac35ff17SAlexander V. Chernikov return (EINVAL); 916ac35ff17SAlexander V. Chernikov 917ac35ff17SAlexander V. Chernikov read = sizeof(ip_fw3_opheader); 918ac35ff17SAlexander V. Chernikov 919ac35ff17SAlexander V. Chernikov /* Check if xentry len field is valid */ 920ac35ff17SAlexander V. Chernikov xent = (ipfw_table_xentry *)(op3 + 1); 921ac35ff17SAlexander V. Chernikov if (xent->len < hdrlen || xent->len + read > sd->valsize) 922ac35ff17SAlexander V. Chernikov return (EINVAL); 923ac35ff17SAlexander V. Chernikov 924ac35ff17SAlexander V. Chernikov memset(&tei, 0, sizeof(tei)); 925ac35ff17SAlexander V. Chernikov tei.paddr = &xent->k; 926ac35ff17SAlexander V. Chernikov tei.masklen = xent->masklen; 9270cba2b28SAlexander V. Chernikov ipfw_import_table_value_legacy(xent->value, &v); 9280cba2b28SAlexander V. Chernikov tei.pvalue = &v; 929ac35ff17SAlexander V. Chernikov /* Old requests compability */ 930db785d31SAlexander V. Chernikov tei.flags = TEI_FLAGS_COMPAT; 931c21034b7SAlexander V. Chernikov if (xent->type == IPFW_TABLE_ADDR) { 932ac35ff17SAlexander V. Chernikov if (xent->len - hdrlen == sizeof(in_addr_t)) 933ac35ff17SAlexander V. Chernikov tei.subtype = AF_INET; 934ac35ff17SAlexander V. Chernikov else 935ac35ff17SAlexander V. Chernikov tei.subtype = AF_INET6; 936ac35ff17SAlexander V. Chernikov } 937ac35ff17SAlexander V. Chernikov 938ac35ff17SAlexander V. Chernikov memset(&ti, 0, sizeof(ti)); 939ac35ff17SAlexander V. Chernikov ti.uidx = xent->tbl; 940ac35ff17SAlexander V. Chernikov ti.type = xent->type; 941ac35ff17SAlexander V. Chernikov 942ac35ff17SAlexander V. Chernikov error = (op3->opcode == IP_FW_TABLE_XADD) ? 9433a845e10SAlexander V. Chernikov add_table_entry(ch, &ti, &tei, 0, 1) : 9443a845e10SAlexander V. Chernikov del_table_entry(ch, &ti, &tei, 0, 1); 945ac35ff17SAlexander V. Chernikov 946ac35ff17SAlexander V. Chernikov return (error); 947ac35ff17SAlexander V. Chernikov } 948ac35ff17SAlexander V. Chernikov 949ac35ff17SAlexander V. Chernikov /* 950ac35ff17SAlexander V. Chernikov * Adds or deletes record in table. 951ac35ff17SAlexander V. Chernikov * Data layout (v1)(current): 952db785d31SAlexander V. Chernikov * Request: [ ipfw_obj_header 953db785d31SAlexander V. Chernikov * ipfw_obj_ctlv(IPFW_TLV_TBLENT_LIST) [ ipfw_obj_tentry x N ] 954db785d31SAlexander V. Chernikov * ] 955ac35ff17SAlexander V. Chernikov * 956ac35ff17SAlexander V. Chernikov * Returns 0 on success 957ac35ff17SAlexander V. Chernikov */ 958ac35ff17SAlexander V. Chernikov static int 9596b988f3aSAlexander V. Chernikov manage_table_ent_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 960ac35ff17SAlexander V. Chernikov struct sockopt_data *sd) 961ac35ff17SAlexander V. Chernikov { 9623a845e10SAlexander V. Chernikov ipfw_obj_tentry *tent, *ptent; 963db785d31SAlexander V. Chernikov ipfw_obj_ctlv *ctlv; 964ac35ff17SAlexander V. Chernikov ipfw_obj_header *oh; 9653a845e10SAlexander V. Chernikov struct tentry_info *ptei, tei, *tei_buf; 966ac35ff17SAlexander V. Chernikov struct tid_info ti; 9673a845e10SAlexander V. Chernikov int error, i, kidx, read; 968ac35ff17SAlexander V. Chernikov 969ac35ff17SAlexander V. Chernikov /* Check minimum header size */ 970db785d31SAlexander V. Chernikov if (sd->valsize < (sizeof(*oh) + sizeof(*ctlv))) 971ac35ff17SAlexander V. Chernikov return (EINVAL); 972ac35ff17SAlexander V. Chernikov 973ac35ff17SAlexander V. Chernikov /* Check if passed data is too long */ 974ac35ff17SAlexander V. Chernikov if (sd->valsize != sd->kavail) 975ac35ff17SAlexander V. Chernikov return (EINVAL); 976ac35ff17SAlexander V. Chernikov 977ac35ff17SAlexander V. Chernikov oh = (ipfw_obj_header *)sd->kbuf; 978ac35ff17SAlexander V. Chernikov 979ac35ff17SAlexander V. Chernikov /* Basic length checks for TLVs */ 980ac35ff17SAlexander V. Chernikov if (oh->ntlv.head.length != sizeof(oh->ntlv)) 981ac35ff17SAlexander V. Chernikov return (EINVAL); 982ac35ff17SAlexander V. Chernikov 983ac35ff17SAlexander V. Chernikov read = sizeof(*oh); 984ac35ff17SAlexander V. Chernikov 985db785d31SAlexander V. Chernikov ctlv = (ipfw_obj_ctlv *)(oh + 1); 986db785d31SAlexander V. Chernikov if (ctlv->head.length + read != sd->valsize) 987db785d31SAlexander V. Chernikov return (EINVAL); 988db785d31SAlexander V. Chernikov 989db785d31SAlexander V. Chernikov read += sizeof(*ctlv); 990db785d31SAlexander V. Chernikov tent = (ipfw_obj_tentry *)(ctlv + 1); 9913a845e10SAlexander V. Chernikov if (ctlv->count * sizeof(*tent) + read != sd->valsize) 992ac35ff17SAlexander V. Chernikov return (EINVAL); 993ac35ff17SAlexander V. Chernikov 9943a845e10SAlexander V. Chernikov if (ctlv->count == 0) 9953a845e10SAlexander V. Chernikov return (0); 996ac35ff17SAlexander V. Chernikov 9973a845e10SAlexander V. Chernikov /* 9983a845e10SAlexander V. Chernikov * Mark entire buffer as "read". 99935e1bbd0SAlexander V. Chernikov * This instructs sopt api write it back 10003a845e10SAlexander V. Chernikov * after function return. 10013a845e10SAlexander V. Chernikov */ 10023a845e10SAlexander V. Chernikov ipfw_get_sopt_header(sd, sd->valsize); 10033a845e10SAlexander V. Chernikov 10043a845e10SAlexander V. Chernikov /* Perform basic checks for each entry */ 10053a845e10SAlexander V. Chernikov ptent = tent; 10063a845e10SAlexander V. Chernikov kidx = tent->idx; 10073a845e10SAlexander V. Chernikov for (i = 0; i < ctlv->count; i++, ptent++) { 10083a845e10SAlexander V. Chernikov if (ptent->head.length != sizeof(*ptent)) 10093a845e10SAlexander V. Chernikov return (EINVAL); 10103a845e10SAlexander V. Chernikov if (ptent->idx != kidx) 10113a845e10SAlexander V. Chernikov return (ENOTSUP); 10123a845e10SAlexander V. Chernikov } 10133a845e10SAlexander V. Chernikov 10143a845e10SAlexander V. Chernikov /* Convert data into kernel request objects */ 101581d3153dSAlexander V. Chernikov objheader_to_ti(oh, &ti); 1016ac35ff17SAlexander V. Chernikov ti.type = oh->ntlv.type; 10173a845e10SAlexander V. Chernikov ti.uidx = kidx; 10183a845e10SAlexander V. Chernikov 10193a845e10SAlexander V. Chernikov /* Use on-stack buffer for single add/del */ 10203a845e10SAlexander V. Chernikov if (ctlv->count == 1) { 10213a845e10SAlexander V. Chernikov memset(&tei, 0, sizeof(tei)); 10223a845e10SAlexander V. Chernikov tei_buf = &tei; 10233a845e10SAlexander V. Chernikov } else 10243a845e10SAlexander V. Chernikov tei_buf = malloc(ctlv->count * sizeof(tei), M_TEMP, 10253a845e10SAlexander V. Chernikov M_WAITOK | M_ZERO); 10263a845e10SAlexander V. Chernikov 10273a845e10SAlexander V. Chernikov ptei = tei_buf; 10283a845e10SAlexander V. Chernikov ptent = tent; 10293a845e10SAlexander V. Chernikov for (i = 0; i < ctlv->count; i++, ptent++, ptei++) { 10303a845e10SAlexander V. Chernikov ptei->paddr = &ptent->k; 10313a845e10SAlexander V. Chernikov ptei->subtype = ptent->subtype; 10323a845e10SAlexander V. Chernikov ptei->masklen = ptent->masklen; 10333a845e10SAlexander V. Chernikov if (ptent->head.flags & IPFW_TF_UPDATE) 10343a845e10SAlexander V. Chernikov ptei->flags |= TEI_FLAGS_UPDATE; 10350cba2b28SAlexander V. Chernikov 10360cba2b28SAlexander V. Chernikov ipfw_import_table_value_v1(&ptent->v.value); 10370cba2b28SAlexander V. Chernikov ptei->pvalue = (struct table_value *)&ptent->v.value; 10383a845e10SAlexander V. Chernikov } 1039ac35ff17SAlexander V. Chernikov 1040ac35ff17SAlexander V. Chernikov error = (oh->opheader.opcode == IP_FW_TABLE_XADD) ? 10413a845e10SAlexander V. Chernikov add_table_entry(ch, &ti, tei_buf, ctlv->flags, ctlv->count) : 10423a845e10SAlexander V. Chernikov del_table_entry(ch, &ti, tei_buf, ctlv->flags, ctlv->count); 10433a845e10SAlexander V. Chernikov 10443a845e10SAlexander V. Chernikov /* Translate result back to userland */ 10453a845e10SAlexander V. Chernikov ptei = tei_buf; 10463a845e10SAlexander V. Chernikov ptent = tent; 10473a845e10SAlexander V. Chernikov for (i = 0; i < ctlv->count; i++, ptent++, ptei++) { 10483a845e10SAlexander V. Chernikov if (ptei->flags & TEI_FLAGS_ADDED) 10493a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_ADDED; 10503a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_DELETED) 10513a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_DELETED; 10523a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_UPDATED) 10533a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_UPDATED; 10543a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_LIMIT) 10553a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_LIMIT; 10563a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_ERROR) 10573a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_ERROR; 10583a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_NOTFOUND) 10593a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_NOTFOUND; 10603a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_EXISTS) 10613a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_EXISTS; 10620cba2b28SAlexander V. Chernikov ipfw_export_table_value_v1(ptei->pvalue, &ptent->v.value); 10633a845e10SAlexander V. Chernikov } 10643a845e10SAlexander V. Chernikov 10653a845e10SAlexander V. Chernikov if (tei_buf != &tei) 10663a845e10SAlexander V. Chernikov free(tei_buf, M_TEMP); 1067ac35ff17SAlexander V. Chernikov 1068ac35ff17SAlexander V. Chernikov return (error); 1069ac35ff17SAlexander V. Chernikov } 1070ac35ff17SAlexander V. Chernikov 107181d3153dSAlexander V. Chernikov /* 107281d3153dSAlexander V. Chernikov * Looks up an entry in given table. 107381d3153dSAlexander V. Chernikov * Data layout (v0)(current): 107481d3153dSAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_obj_tentry ] 107581d3153dSAlexander V. Chernikov * Reply: [ ipfw_obj_header ipfw_obj_tentry ] 107681d3153dSAlexander V. Chernikov * 107781d3153dSAlexander V. Chernikov * Returns 0 on success 107881d3153dSAlexander V. Chernikov */ 10796b988f3aSAlexander V. Chernikov static int 10806b988f3aSAlexander V. Chernikov find_table_entry(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 108181d3153dSAlexander V. Chernikov struct sockopt_data *sd) 108281d3153dSAlexander V. Chernikov { 108381d3153dSAlexander V. Chernikov ipfw_obj_tentry *tent; 108481d3153dSAlexander V. Chernikov ipfw_obj_header *oh; 108581d3153dSAlexander V. Chernikov struct tid_info ti; 108681d3153dSAlexander V. Chernikov struct table_config *tc; 108781d3153dSAlexander V. Chernikov struct table_algo *ta; 108881d3153dSAlexander V. Chernikov struct table_info *kti; 108981d3153dSAlexander V. Chernikov struct namedobj_instance *ni; 1090914bffb6SAlexander V. Chernikov int error; 109181d3153dSAlexander V. Chernikov size_t sz; 109281d3153dSAlexander V. Chernikov 109381d3153dSAlexander V. Chernikov /* Check minimum header size */ 109481d3153dSAlexander V. Chernikov sz = sizeof(*oh) + sizeof(*tent); 109581d3153dSAlexander V. Chernikov if (sd->valsize != sz) 109681d3153dSAlexander V. Chernikov return (EINVAL); 109781d3153dSAlexander V. Chernikov 109881d3153dSAlexander V. Chernikov oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 109981d3153dSAlexander V. Chernikov tent = (ipfw_obj_tentry *)(oh + 1); 110081d3153dSAlexander V. Chernikov 110181d3153dSAlexander V. Chernikov /* Basic length checks for TLVs */ 110281d3153dSAlexander V. Chernikov if (oh->ntlv.head.length != sizeof(oh->ntlv)) 110381d3153dSAlexander V. Chernikov return (EINVAL); 110481d3153dSAlexander V. Chernikov 110581d3153dSAlexander V. Chernikov objheader_to_ti(oh, &ti); 110681d3153dSAlexander V. Chernikov ti.type = oh->ntlv.type; 110781d3153dSAlexander V. Chernikov ti.uidx = tent->idx; 110881d3153dSAlexander V. Chernikov 110981d3153dSAlexander V. Chernikov IPFW_UH_RLOCK(ch); 111081d3153dSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 111181d3153dSAlexander V. Chernikov 111281d3153dSAlexander V. Chernikov /* 111381d3153dSAlexander V. Chernikov * Find existing table and check its type . 111481d3153dSAlexander V. Chernikov */ 111581d3153dSAlexander V. Chernikov ta = NULL; 111681d3153dSAlexander V. Chernikov if ((tc = find_table(ni, &ti)) == NULL) { 111781d3153dSAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 111881d3153dSAlexander V. Chernikov return (ESRCH); 111981d3153dSAlexander V. Chernikov } 112081d3153dSAlexander V. Chernikov 112181d3153dSAlexander V. Chernikov /* check table type */ 112274b22066SAlexander V. Chernikov if (tc->no.subtype != ti.type) { 112381d3153dSAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 112481d3153dSAlexander V. Chernikov return (EINVAL); 112581d3153dSAlexander V. Chernikov } 112681d3153dSAlexander V. Chernikov 112781d3153dSAlexander V. Chernikov kti = KIDX_TO_TI(ch, tc->no.kidx); 112881d3153dSAlexander V. Chernikov ta = tc->ta; 112981d3153dSAlexander V. Chernikov 1130914bffb6SAlexander V. Chernikov if (ta->find_tentry == NULL) 1131914bffb6SAlexander V. Chernikov return (ENOTSUP); 1132914bffb6SAlexander V. Chernikov 1133914bffb6SAlexander V. Chernikov error = ta->find_tentry(tc->astate, kti, tent); 113481d3153dSAlexander V. Chernikov 113581d3153dSAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 113681d3153dSAlexander V. Chernikov 113781d3153dSAlexander V. Chernikov return (error); 113881d3153dSAlexander V. Chernikov } 113981d3153dSAlexander V. Chernikov 114046d52008SAlexander V. Chernikov /* 114146d52008SAlexander V. Chernikov * Flushes all entries or destroys given table. 114246d52008SAlexander V. Chernikov * Data layout (v0)(current): 114346d52008SAlexander V. Chernikov * Request: [ ipfw_obj_header ] 114446d52008SAlexander V. Chernikov * 114546d52008SAlexander V. Chernikov * Returns 0 on success 114646d52008SAlexander V. Chernikov */ 11476b988f3aSAlexander V. Chernikov static int 11486b988f3aSAlexander V. Chernikov flush_table_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1149ac35ff17SAlexander V. Chernikov struct sockopt_data *sd) 1150ac35ff17SAlexander V. Chernikov { 1151ac35ff17SAlexander V. Chernikov int error; 1152ac35ff17SAlexander V. Chernikov struct _ipfw_obj_header *oh; 1153ac35ff17SAlexander V. Chernikov struct tid_info ti; 1154ac35ff17SAlexander V. Chernikov 1155ac35ff17SAlexander V. Chernikov if (sd->valsize != sizeof(*oh)) 1156ac35ff17SAlexander V. Chernikov return (EINVAL); 1157ac35ff17SAlexander V. Chernikov 1158ac35ff17SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)op3; 1159ac35ff17SAlexander V. Chernikov objheader_to_ti(oh, &ti); 1160ac35ff17SAlexander V. Chernikov 11611832a7b3SAlexander V. Chernikov if (op3->opcode == IP_FW_TABLE_XDESTROY) 1162ac35ff17SAlexander V. Chernikov error = destroy_table(ch, &ti); 11631832a7b3SAlexander V. Chernikov else if (op3->opcode == IP_FW_TABLE_XFLUSH) 1164ac35ff17SAlexander V. Chernikov error = flush_table(ch, &ti); 1165ac35ff17SAlexander V. Chernikov else 1166ac35ff17SAlexander V. Chernikov return (ENOTSUP); 1167ac35ff17SAlexander V. Chernikov 1168ac35ff17SAlexander V. Chernikov return (error); 11693b3a8eb9SGleb Smirnoff } 11703b3a8eb9SGleb Smirnoff 1171fb4b37a3SAlexander V. Chernikov static void 1172fb4b37a3SAlexander V. Chernikov restart_flush(void *object, struct op_state *_state) 1173fb4b37a3SAlexander V. Chernikov { 1174fb4b37a3SAlexander V. Chernikov struct tableop_state *ts; 1175fb4b37a3SAlexander V. Chernikov 1176fb4b37a3SAlexander V. Chernikov ts = (struct tableop_state *)_state; 1177fb4b37a3SAlexander V. Chernikov 1178fb4b37a3SAlexander V. Chernikov if (ts->tc != object) 1179fb4b37a3SAlexander V. Chernikov return; 1180fb4b37a3SAlexander V. Chernikov 1181fb4b37a3SAlexander V. Chernikov /* Indicate we've called */ 1182fb4b37a3SAlexander V. Chernikov ts->modified = 1; 1183fb4b37a3SAlexander V. Chernikov } 1184fb4b37a3SAlexander V. Chernikov 118535e1bbd0SAlexander V. Chernikov /* 118635e1bbd0SAlexander V. Chernikov * Flushes given table. 118735e1bbd0SAlexander V. Chernikov * 118835e1bbd0SAlexander V. Chernikov * Function create new table instance with the same 118935e1bbd0SAlexander V. Chernikov * parameters, swaps it with old one and 1190fb4b37a3SAlexander V. Chernikov * flushes state without holding runtime WLOCK. 119135e1bbd0SAlexander V. Chernikov * 119235e1bbd0SAlexander V. Chernikov * Returns 0 on success. 119335e1bbd0SAlexander V. Chernikov */ 11941832a7b3SAlexander V. Chernikov int 1195ac35ff17SAlexander V. Chernikov flush_table(struct ip_fw_chain *ch, struct tid_info *ti) 11963b3a8eb9SGleb Smirnoff { 1197b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 1198b074b7bbSAlexander V. Chernikov struct table_config *tc; 11999f7d47b0SAlexander V. Chernikov struct table_algo *ta; 12009f7d47b0SAlexander V. Chernikov struct table_info ti_old, ti_new, *tablestate; 12019f7d47b0SAlexander V. Chernikov void *astate_old, *astate_new; 1202914bffb6SAlexander V. Chernikov char algostate[64], *pstate; 1203fb4b37a3SAlexander V. Chernikov struct tableop_state ts; 12040caab009SAlexander V. Chernikov int error, need_gc; 1205b074b7bbSAlexander V. Chernikov uint16_t kidx; 1206914bffb6SAlexander V. Chernikov uint8_t tflags; 12073b3a8eb9SGleb Smirnoff 12083b3a8eb9SGleb Smirnoff /* 12099f7d47b0SAlexander V. Chernikov * Stage 1: save table algoritm. 1210b074b7bbSAlexander V. Chernikov * Reference found table to ensure it won't disappear. 12113b3a8eb9SGleb Smirnoff */ 1212b074b7bbSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1213b074b7bbSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1214b074b7bbSAlexander V. Chernikov if ((tc = find_table(ni, ti)) == NULL) { 1215b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1216b074b7bbSAlexander V. Chernikov return (ESRCH); 1217b074b7bbSAlexander V. Chernikov } 12180caab009SAlexander V. Chernikov need_gc = 0; 12190caab009SAlexander V. Chernikov astate_new = NULL; 12200caab009SAlexander V. Chernikov memset(&ti_new, 0, sizeof(ti_new)); 1221fb4b37a3SAlexander V. Chernikov restart: 1222fb4b37a3SAlexander V. Chernikov /* Set up swap handler */ 1223fb4b37a3SAlexander V. Chernikov memset(&ts, 0, sizeof(ts)); 1224fb4b37a3SAlexander V. Chernikov ts.opstate.func = restart_flush; 1225fb4b37a3SAlexander V. Chernikov ts.tc = tc; 1226fb4b37a3SAlexander V. Chernikov 12279f7d47b0SAlexander V. Chernikov ta = tc->ta; 1228fd0869d5SAlexander V. Chernikov /* Do not flush readonly tables */ 1229fd0869d5SAlexander V. Chernikov if ((ta->flags & TA_FLAG_READONLY) != 0) { 1230fd0869d5SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1231fd0869d5SAlexander V. Chernikov return (EACCES); 1232fd0869d5SAlexander V. Chernikov } 123335e1bbd0SAlexander V. Chernikov /* Save startup algo parameters */ 1234daabb523SAlexander V. Chernikov if (ta->print_config != NULL) { 1235daabb523SAlexander V. Chernikov ta->print_config(tc->astate, KIDX_TO_TI(ch, tc->no.kidx), 1236daabb523SAlexander V. Chernikov algostate, sizeof(algostate)); 1237daabb523SAlexander V. Chernikov pstate = algostate; 1238daabb523SAlexander V. Chernikov } else 1239daabb523SAlexander V. Chernikov pstate = NULL; 1240914bffb6SAlexander V. Chernikov tflags = tc->tflags; 1241fb4b37a3SAlexander V. Chernikov tc->no.refcnt++; 1242fb4b37a3SAlexander V. Chernikov add_toperation_state(ch, &ts); 1243b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 12443b3a8eb9SGleb Smirnoff 1245b074b7bbSAlexander V. Chernikov /* 12460caab009SAlexander V. Chernikov * Stage 1.5: if this is not the first attempt, destroy previous state 12470caab009SAlexander V. Chernikov */ 12480caab009SAlexander V. Chernikov if (need_gc != 0) { 12490caab009SAlexander V. Chernikov ta->destroy(astate_new, &ti_new); 12500caab009SAlexander V. Chernikov need_gc = 0; 12510caab009SAlexander V. Chernikov } 12520caab009SAlexander V. Chernikov 12530caab009SAlexander V. Chernikov /* 12549f7d47b0SAlexander V. Chernikov * Stage 2: allocate new table instance using same algo. 1255b074b7bbSAlexander V. Chernikov */ 12569f7d47b0SAlexander V. Chernikov memset(&ti_new, 0, sizeof(struct table_info)); 1257fb4b37a3SAlexander V. Chernikov error = ta->init(ch, &astate_new, &ti_new, pstate, tflags); 1258b074b7bbSAlexander V. Chernikov 1259b074b7bbSAlexander V. Chernikov /* 1260b074b7bbSAlexander V. Chernikov * Stage 3: swap old state pointers with newly-allocated ones. 1261b074b7bbSAlexander V. Chernikov * Decrease refcount. 1262b074b7bbSAlexander V. Chernikov */ 1263b074b7bbSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1264fb4b37a3SAlexander V. Chernikov tc->no.refcnt--; 1265fb4b37a3SAlexander V. Chernikov del_toperation_state(ch, &ts); 1266fb4b37a3SAlexander V. Chernikov 1267fb4b37a3SAlexander V. Chernikov if (error != 0) { 1268fb4b37a3SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1269fb4b37a3SAlexander V. Chernikov return (error); 1270fb4b37a3SAlexander V. Chernikov } 1271fb4b37a3SAlexander V. Chernikov 1272fb4b37a3SAlexander V. Chernikov /* 1273fb4b37a3SAlexander V. Chernikov * Restart operation if table swap has happened: 1274fb4b37a3SAlexander V. Chernikov * even if algo may be the same, algo init parameters 1275fb4b37a3SAlexander V. Chernikov * may change. Restart operation instead of doing 1276fb4b37a3SAlexander V. Chernikov * complex checks. 1277fb4b37a3SAlexander V. Chernikov */ 1278fb4b37a3SAlexander V. Chernikov if (ts.modified != 0) { 12790caab009SAlexander V. Chernikov /* Delay destroying data since we're holding UH lock */ 12800caab009SAlexander V. Chernikov need_gc = 1; 1281fb4b37a3SAlexander V. Chernikov goto restart; 1282fb4b37a3SAlexander V. Chernikov } 1283b074b7bbSAlexander V. Chernikov 1284b074b7bbSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1285b074b7bbSAlexander V. Chernikov kidx = tc->no.kidx; 12869f7d47b0SAlexander V. Chernikov tablestate = (struct table_info *)ch->tablestate; 1287b074b7bbSAlexander V. Chernikov 12889f7d47b0SAlexander V. Chernikov IPFW_WLOCK(ch); 12899f7d47b0SAlexander V. Chernikov ti_old = tablestate[kidx]; 12909f7d47b0SAlexander V. Chernikov tablestate[kidx] = ti_new; 12919f7d47b0SAlexander V. Chernikov IPFW_WUNLOCK(ch); 1292b074b7bbSAlexander V. Chernikov 12939f7d47b0SAlexander V. Chernikov astate_old = tc->astate; 12949f7d47b0SAlexander V. Chernikov tc->astate = astate_new; 12954c060d85SAlexander V. Chernikov tc->ti_copy = ti_new; 12969f7d47b0SAlexander V. Chernikov tc->count = 0; 1297b074b7bbSAlexander V. Chernikov 129879e86902SAlexander V. Chernikov /* Notify algo on real @ti address */ 129979e86902SAlexander V. Chernikov if (ta->change_ti != NULL) 130079e86902SAlexander V. Chernikov ta->change_ti(tc->astate, &tablestate[kidx]); 130179e86902SAlexander V. Chernikov 13020cba2b28SAlexander V. Chernikov /* 13030cba2b28SAlexander V. Chernikov * Stage 4: unref values. 13040cba2b28SAlexander V. Chernikov */ 13050cba2b28SAlexander V. Chernikov ipfw_unref_table_values(ch, tc, ta, astate_old, &ti_old); 1306b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 13073b3a8eb9SGleb Smirnoff 1308b074b7bbSAlexander V. Chernikov /* 13090cba2b28SAlexander V. Chernikov * Stage 5: perform real flush/destroy. 1310b074b7bbSAlexander V. Chernikov */ 13119f7d47b0SAlexander V. Chernikov ta->destroy(astate_old, &ti_old); 13123b3a8eb9SGleb Smirnoff 13133b3a8eb9SGleb Smirnoff return (0); 13143b3a8eb9SGleb Smirnoff } 13153b3a8eb9SGleb Smirnoff 1316b074b7bbSAlexander V. Chernikov /* 131746d52008SAlexander V. Chernikov * Swaps two tables. 131846d52008SAlexander V. Chernikov * Data layout (v0)(current): 131946d52008SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_obj_ntlv ] 132046d52008SAlexander V. Chernikov * 132146d52008SAlexander V. Chernikov * Returns 0 on success 132246d52008SAlexander V. Chernikov */ 13236b988f3aSAlexander V. Chernikov static int 13246b988f3aSAlexander V. Chernikov swap_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 132546d52008SAlexander V. Chernikov struct sockopt_data *sd) 132646d52008SAlexander V. Chernikov { 132746d52008SAlexander V. Chernikov int error; 132846d52008SAlexander V. Chernikov struct _ipfw_obj_header *oh; 132946d52008SAlexander V. Chernikov struct tid_info ti_a, ti_b; 133046d52008SAlexander V. Chernikov 133146d52008SAlexander V. Chernikov if (sd->valsize != sizeof(*oh) + sizeof(ipfw_obj_ntlv)) 133246d52008SAlexander V. Chernikov return (EINVAL); 133346d52008SAlexander V. Chernikov 133446d52008SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)op3; 133546d52008SAlexander V. Chernikov ntlv_to_ti(&oh->ntlv, &ti_a); 133646d52008SAlexander V. Chernikov ntlv_to_ti((ipfw_obj_ntlv *)(oh + 1), &ti_b); 133746d52008SAlexander V. Chernikov 1338a73d728dSAlexander V. Chernikov error = swap_tables(ch, &ti_a, &ti_b); 133946d52008SAlexander V. Chernikov 134046d52008SAlexander V. Chernikov return (error); 134146d52008SAlexander V. Chernikov } 134246d52008SAlexander V. Chernikov 134335e1bbd0SAlexander V. Chernikov /* 134435e1bbd0SAlexander V. Chernikov * Swaps two tables of the same type/valtype. 134535e1bbd0SAlexander V. Chernikov * 134635e1bbd0SAlexander V. Chernikov * Checks if tables are compatible and limits 1347c8d5d308SAlexander V. Chernikov * permits swap, than actually perform swap. 134835e1bbd0SAlexander V. Chernikov * 1349c8d5d308SAlexander V. Chernikov * Each table consists of 2 different parts: 1350c8d5d308SAlexander V. Chernikov * config: 1351c8d5d308SAlexander V. Chernikov * @tc (with name, set, kidx) and rule bindings, which is "stable". 1352c8d5d308SAlexander V. Chernikov * number of items 1353c8d5d308SAlexander V. Chernikov * table algo 1354c8d5d308SAlexander V. Chernikov * runtime: 1355c8d5d308SAlexander V. Chernikov * runtime data @ti (ch->tablestate) 1356c8d5d308SAlexander V. Chernikov * runtime cache in @tc 1357c8d5d308SAlexander V. Chernikov * algo-specific data (@tc->astate) 1358c8d5d308SAlexander V. Chernikov * 1359c8d5d308SAlexander V. Chernikov * So we switch: 1360c8d5d308SAlexander V. Chernikov * all runtime data 1361c8d5d308SAlexander V. Chernikov * number of items 1362c8d5d308SAlexander V. Chernikov * table algo 1363c8d5d308SAlexander V. Chernikov * 1364c8d5d308SAlexander V. Chernikov * After that we call @ti change handler for each table. 1365c8d5d308SAlexander V. Chernikov * 1366c8d5d308SAlexander V. Chernikov * Note that referencing @tc won't protect tc->ta from change. 1367c8d5d308SAlexander V. Chernikov * XXX: Do we need to restrict swap between locked tables? 1368c8d5d308SAlexander V. Chernikov * XXX: Do we need to exchange ftype? 136935e1bbd0SAlexander V. Chernikov * 137035e1bbd0SAlexander V. Chernikov * Returns 0 on success. 137135e1bbd0SAlexander V. Chernikov */ 137246d52008SAlexander V. Chernikov static int 1373a73d728dSAlexander V. Chernikov swap_tables(struct ip_fw_chain *ch, struct tid_info *a, 137446d52008SAlexander V. Chernikov struct tid_info *b) 137546d52008SAlexander V. Chernikov { 137646d52008SAlexander V. Chernikov struct namedobj_instance *ni; 137746d52008SAlexander V. Chernikov struct table_config *tc_a, *tc_b; 137846d52008SAlexander V. Chernikov struct table_algo *ta; 137946d52008SAlexander V. Chernikov struct table_info ti, *tablestate; 138046d52008SAlexander V. Chernikov void *astate; 138146d52008SAlexander V. Chernikov uint32_t count; 138246d52008SAlexander V. Chernikov 138346d52008SAlexander V. Chernikov /* 138446d52008SAlexander V. Chernikov * Stage 1: find both tables and ensure they are of 138535e1bbd0SAlexander V. Chernikov * the same type. 138646d52008SAlexander V. Chernikov */ 138746d52008SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 138846d52008SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 138946d52008SAlexander V. Chernikov if ((tc_a = find_table(ni, a)) == NULL) { 139046d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 139146d52008SAlexander V. Chernikov return (ESRCH); 139246d52008SAlexander V. Chernikov } 139346d52008SAlexander V. Chernikov if ((tc_b = find_table(ni, b)) == NULL) { 139446d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 139546d52008SAlexander V. Chernikov return (ESRCH); 139646d52008SAlexander V. Chernikov } 139746d52008SAlexander V. Chernikov 139846d52008SAlexander V. Chernikov /* It is very easy to swap between the same table */ 139946d52008SAlexander V. Chernikov if (tc_a == tc_b) { 140046d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 140146d52008SAlexander V. Chernikov return (0); 140246d52008SAlexander V. Chernikov } 140346d52008SAlexander V. Chernikov 140446d52008SAlexander V. Chernikov /* Check type and value are the same */ 140574b22066SAlexander V. Chernikov if (tc_a->no.subtype!=tc_b->no.subtype || tc_a->tflags!=tc_b->tflags) { 140646d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 140746d52008SAlexander V. Chernikov return (EINVAL); 140846d52008SAlexander V. Chernikov } 140946d52008SAlexander V. Chernikov 141046d52008SAlexander V. Chernikov /* Check limits before swap */ 141146d52008SAlexander V. Chernikov if ((tc_a->limit != 0 && tc_b->count > tc_a->limit) || 141246d52008SAlexander V. Chernikov (tc_b->limit != 0 && tc_a->count > tc_b->limit)) { 141346d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 141446d52008SAlexander V. Chernikov return (EFBIG); 141546d52008SAlexander V. Chernikov } 141646d52008SAlexander V. Chernikov 1417fd0869d5SAlexander V. Chernikov /* Check if one of the tables is readonly */ 1418fd0869d5SAlexander V. Chernikov if (((tc_a->ta->flags | tc_b->ta->flags) & TA_FLAG_READONLY) != 0) { 1419fd0869d5SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1420fd0869d5SAlexander V. Chernikov return (EACCES); 1421fd0869d5SAlexander V. Chernikov } 1422fd0869d5SAlexander V. Chernikov 14230cba2b28SAlexander V. Chernikov /* Notify we're going to swap */ 14240cba2b28SAlexander V. Chernikov rollback_toperation_state(ch, tc_a); 14250cba2b28SAlexander V. Chernikov rollback_toperation_state(ch, tc_b); 14260cba2b28SAlexander V. Chernikov 142746d52008SAlexander V. Chernikov /* Everything is fine, prepare to swap */ 142846d52008SAlexander V. Chernikov tablestate = (struct table_info *)ch->tablestate; 142946d52008SAlexander V. Chernikov ti = tablestate[tc_a->no.kidx]; 143046d52008SAlexander V. Chernikov ta = tc_a->ta; 143146d52008SAlexander V. Chernikov astate = tc_a->astate; 143246d52008SAlexander V. Chernikov count = tc_a->count; 143346d52008SAlexander V. Chernikov 143446d52008SAlexander V. Chernikov IPFW_WLOCK(ch); 143546d52008SAlexander V. Chernikov /* a <- b */ 143646d52008SAlexander V. Chernikov tablestate[tc_a->no.kidx] = tablestate[tc_b->no.kidx]; 143746d52008SAlexander V. Chernikov tc_a->ta = tc_b->ta; 143846d52008SAlexander V. Chernikov tc_a->astate = tc_b->astate; 143946d52008SAlexander V. Chernikov tc_a->count = tc_b->count; 144046d52008SAlexander V. Chernikov /* b <- a */ 144146d52008SAlexander V. Chernikov tablestate[tc_b->no.kidx] = ti; 144246d52008SAlexander V. Chernikov tc_b->ta = ta; 144346d52008SAlexander V. Chernikov tc_b->astate = astate; 144446d52008SAlexander V. Chernikov tc_b->count = count; 144546d52008SAlexander V. Chernikov IPFW_WUNLOCK(ch); 144646d52008SAlexander V. Chernikov 144746d52008SAlexander V. Chernikov /* Ensure tc.ti copies are in sync */ 14484c060d85SAlexander V. Chernikov tc_a->ti_copy = tablestate[tc_a->no.kidx]; 14494c060d85SAlexander V. Chernikov tc_b->ti_copy = tablestate[tc_b->no.kidx]; 145046d52008SAlexander V. Chernikov 145146d52008SAlexander V. Chernikov /* Notify both tables on @ti change */ 145246d52008SAlexander V. Chernikov if (tc_a->ta->change_ti != NULL) 145346d52008SAlexander V. Chernikov tc_a->ta->change_ti(tc_a->astate, &tablestate[tc_a->no.kidx]); 145446d52008SAlexander V. Chernikov if (tc_b->ta->change_ti != NULL) 145546d52008SAlexander V. Chernikov tc_b->ta->change_ti(tc_b->astate, &tablestate[tc_b->no.kidx]); 145646d52008SAlexander V. Chernikov 145746d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 145846d52008SAlexander V. Chernikov 145946d52008SAlexander V. Chernikov return (0); 146046d52008SAlexander V. Chernikov } 146146d52008SAlexander V. Chernikov 146246d52008SAlexander V. Chernikov /* 14639f7d47b0SAlexander V. Chernikov * Destroys table specified by @ti. 1464ac35ff17SAlexander V. Chernikov * Data layout (v0)(current): 1465ac35ff17SAlexander V. Chernikov * Request: [ ip_fw3_opheader ] 1466ac35ff17SAlexander V. Chernikov * 1467ac35ff17SAlexander V. Chernikov * Returns 0 on success 1468b074b7bbSAlexander V. Chernikov */ 1469ac35ff17SAlexander V. Chernikov static int 1470ac35ff17SAlexander V. Chernikov destroy_table(struct ip_fw_chain *ch, struct tid_info *ti) 1471b074b7bbSAlexander V. Chernikov { 1472b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 1473b074b7bbSAlexander V. Chernikov struct table_config *tc; 1474b074b7bbSAlexander V. Chernikov 1475b074b7bbSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1476b074b7bbSAlexander V. Chernikov 1477b074b7bbSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1478b074b7bbSAlexander V. Chernikov if ((tc = find_table(ni, ti)) == NULL) { 1479b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1480b074b7bbSAlexander V. Chernikov return (ESRCH); 1481b074b7bbSAlexander V. Chernikov } 1482b074b7bbSAlexander V. Chernikov 14839f7d47b0SAlexander V. Chernikov /* Do not permit destroying referenced tables */ 14849f7d47b0SAlexander V. Chernikov if (tc->no.refcnt > 0) { 1485b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1486b074b7bbSAlexander V. Chernikov return (EBUSY); 1487b074b7bbSAlexander V. Chernikov } 1488b074b7bbSAlexander V. Chernikov 1489b074b7bbSAlexander V. Chernikov IPFW_WLOCK(ch); 1490b074b7bbSAlexander V. Chernikov unlink_table(ch, tc); 1491b074b7bbSAlexander V. Chernikov IPFW_WUNLOCK(ch); 1492b074b7bbSAlexander V. Chernikov 1493b074b7bbSAlexander V. Chernikov /* Free obj index */ 1494ac35ff17SAlexander V. Chernikov if (ipfw_objhash_free_idx(ni, tc->no.kidx) != 0) 1495b074b7bbSAlexander V. Chernikov printf("Error unlinking kidx %d from table %s\n", 1496b074b7bbSAlexander V. Chernikov tc->no.kidx, tc->tablename); 1497b074b7bbSAlexander V. Chernikov 14980cba2b28SAlexander V. Chernikov /* Unref values used in tables while holding UH lock */ 14994c060d85SAlexander V. Chernikov ipfw_unref_table_values(ch, tc, tc->ta, tc->astate, &tc->ti_copy); 1500b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1501b074b7bbSAlexander V. Chernikov 1502b074b7bbSAlexander V. Chernikov free_table_config(ni, tc); 1503b074b7bbSAlexander V. Chernikov 1504b074b7bbSAlexander V. Chernikov return (0); 1505b074b7bbSAlexander V. Chernikov } 1506b074b7bbSAlexander V. Chernikov 15074040f4ecSAlexander V. Chernikov static uint32_t 15084040f4ecSAlexander V. Chernikov roundup2p(uint32_t v) 15094040f4ecSAlexander V. Chernikov { 15104040f4ecSAlexander V. Chernikov 15114040f4ecSAlexander V. Chernikov v--; 15124040f4ecSAlexander V. Chernikov v |= v >> 1; 15134040f4ecSAlexander V. Chernikov v |= v >> 2; 15144040f4ecSAlexander V. Chernikov v |= v >> 4; 15154040f4ecSAlexander V. Chernikov v |= v >> 8; 15164040f4ecSAlexander V. Chernikov v |= v >> 16; 15174040f4ecSAlexander V. Chernikov v++; 15184040f4ecSAlexander V. Chernikov 15194040f4ecSAlexander V. Chernikov return (v); 15204040f4ecSAlexander V. Chernikov } 15214040f4ecSAlexander V. Chernikov 152235e1bbd0SAlexander V. Chernikov /* 152335e1bbd0SAlexander V. Chernikov * Grow tables index. 152435e1bbd0SAlexander V. Chernikov * 152535e1bbd0SAlexander V. Chernikov * Returns 0 on success. 152635e1bbd0SAlexander V. Chernikov */ 15273b3a8eb9SGleb Smirnoff int 15283b3a8eb9SGleb Smirnoff ipfw_resize_tables(struct ip_fw_chain *ch, unsigned int ntables) 15293b3a8eb9SGleb Smirnoff { 15303b3a8eb9SGleb Smirnoff unsigned int ntables_old, tbl; 1531b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 15329f7d47b0SAlexander V. Chernikov void *new_idx, *old_tablestate, *tablestate; 153368394ec8SAlexander V. Chernikov struct table_info *ti; 153468394ec8SAlexander V. Chernikov struct table_config *tc; 153568394ec8SAlexander V. Chernikov int i, new_blocks; 15363b3a8eb9SGleb Smirnoff 15373b3a8eb9SGleb Smirnoff /* Check new value for validity */ 15384040f4ecSAlexander V. Chernikov if (ntables == 0) 15394040f4ecSAlexander V. Chernikov return (EINVAL); 15403b3a8eb9SGleb Smirnoff if (ntables > IPFW_TABLES_MAX) 15413b3a8eb9SGleb Smirnoff ntables = IPFW_TABLES_MAX; 15424040f4ecSAlexander V. Chernikov /* Alight to nearest power of 2 */ 15434040f4ecSAlexander V. Chernikov ntables = (unsigned int)roundup2p(ntables); 15443b3a8eb9SGleb Smirnoff 15453b3a8eb9SGleb Smirnoff /* Allocate new pointers */ 15469f7d47b0SAlexander V. Chernikov tablestate = malloc(ntables * sizeof(struct table_info), 15479f7d47b0SAlexander V. Chernikov M_IPFW, M_WAITOK | M_ZERO); 15489f7d47b0SAlexander V. Chernikov 1549b074b7bbSAlexander V. Chernikov ipfw_objhash_bitmap_alloc(ntables, (void *)&new_idx, &new_blocks); 15503b3a8eb9SGleb Smirnoff 15519f7d47b0SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 15523b3a8eb9SGleb Smirnoff 15533b3a8eb9SGleb Smirnoff tbl = (ntables >= V_fw_tables_max) ? V_fw_tables_max : ntables; 1554b074b7bbSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1555b074b7bbSAlexander V. Chernikov 15569f7d47b0SAlexander V. Chernikov /* Temporary restrict decreasing max_tables */ 15579f7d47b0SAlexander V. Chernikov if (ntables < V_fw_tables_max) { 15589f7d47b0SAlexander V. Chernikov 15599f7d47b0SAlexander V. Chernikov /* 15609f7d47b0SAlexander V. Chernikov * FIXME: Check if we really can shrink 15619f7d47b0SAlexander V. Chernikov */ 15629f7d47b0SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1563b074b7bbSAlexander V. Chernikov return (EINVAL); 1564b074b7bbSAlexander V. Chernikov } 15653b3a8eb9SGleb Smirnoff 15669f7d47b0SAlexander V. Chernikov /* Copy table info/indices */ 15679f7d47b0SAlexander V. Chernikov memcpy(tablestate, ch->tablestate, sizeof(struct table_info) * tbl); 15689f7d47b0SAlexander V. Chernikov ipfw_objhash_bitmap_merge(ni, &new_idx, &new_blocks); 15693b3a8eb9SGleb Smirnoff 15709f7d47b0SAlexander V. Chernikov IPFW_WLOCK(ch); 15719f7d47b0SAlexander V. Chernikov 15729f7d47b0SAlexander V. Chernikov /* Change pointers */ 15739f7d47b0SAlexander V. Chernikov old_tablestate = ch->tablestate; 15749f7d47b0SAlexander V. Chernikov ch->tablestate = tablestate; 15759f7d47b0SAlexander V. Chernikov ipfw_objhash_bitmap_swap(ni, &new_idx, &new_blocks); 15763b3a8eb9SGleb Smirnoff 15773b3a8eb9SGleb Smirnoff ntables_old = V_fw_tables_max; 15783b3a8eb9SGleb Smirnoff V_fw_tables_max = ntables; 15793b3a8eb9SGleb Smirnoff 15803b3a8eb9SGleb Smirnoff IPFW_WUNLOCK(ch); 158168394ec8SAlexander V. Chernikov 158268394ec8SAlexander V. Chernikov /* Notify all consumers that their @ti pointer has changed */ 158368394ec8SAlexander V. Chernikov ti = (struct table_info *)ch->tablestate; 158468394ec8SAlexander V. Chernikov for (i = 0; i < tbl; i++, ti++) { 158568394ec8SAlexander V. Chernikov if (ti->lookup == NULL) 158668394ec8SAlexander V. Chernikov continue; 158768394ec8SAlexander V. Chernikov tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, i); 158868394ec8SAlexander V. Chernikov if (tc == NULL || tc->ta->change_ti == NULL) 158968394ec8SAlexander V. Chernikov continue; 159068394ec8SAlexander V. Chernikov 159168394ec8SAlexander V. Chernikov tc->ta->change_ti(tc->astate, ti); 159268394ec8SAlexander V. Chernikov } 159368394ec8SAlexander V. Chernikov 15949f7d47b0SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 15953b3a8eb9SGleb Smirnoff 15963b3a8eb9SGleb Smirnoff /* Free old pointers */ 15979f7d47b0SAlexander V. Chernikov free(old_tablestate, M_IPFW); 1598b074b7bbSAlexander V. Chernikov ipfw_objhash_bitmap_free(new_idx, new_blocks); 15993b3a8eb9SGleb Smirnoff 16003b3a8eb9SGleb Smirnoff return (0); 16013b3a8eb9SGleb Smirnoff } 16023b3a8eb9SGleb Smirnoff 1603a73d728dSAlexander V. Chernikov /* 160435e1bbd0SAlexander V. Chernikov * Switch between "set 0" and "rule's set" table binding, 1605a73d728dSAlexander V. Chernikov * Check all ruleset bindings and permits changing 1606a73d728dSAlexander V. Chernikov * IFF each binding has both rule AND table in default set (set 0). 1607a73d728dSAlexander V. Chernikov * 1608a73d728dSAlexander V. Chernikov * Returns 0 on success. 1609a73d728dSAlexander V. Chernikov */ 1610a73d728dSAlexander V. Chernikov int 1611a73d728dSAlexander V. Chernikov ipfw_switch_tables_namespace(struct ip_fw_chain *ch, unsigned int sets) 1612a73d728dSAlexander V. Chernikov { 1613a73d728dSAlexander V. Chernikov struct namedobj_instance *ni; 1614a73d728dSAlexander V. Chernikov struct named_object *no; 1615a73d728dSAlexander V. Chernikov struct ip_fw *rule; 1616a73d728dSAlexander V. Chernikov ipfw_insn *cmd; 1617a73d728dSAlexander V. Chernikov int cmdlen, i, l; 1618a73d728dSAlexander V. Chernikov uint16_t kidx; 1619a73d728dSAlexander V. Chernikov 1620a73d728dSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1621a73d728dSAlexander V. Chernikov 1622a73d728dSAlexander V. Chernikov if (V_fw_tables_sets == sets) { 1623a73d728dSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1624a73d728dSAlexander V. Chernikov return (0); 1625a73d728dSAlexander V. Chernikov } 1626a73d728dSAlexander V. Chernikov 1627a73d728dSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1628a73d728dSAlexander V. Chernikov 162935e1bbd0SAlexander V. Chernikov /* 163035e1bbd0SAlexander V. Chernikov * Scan all rules and examine tables opcodes. 163135e1bbd0SAlexander V. Chernikov */ 1632a73d728dSAlexander V. Chernikov for (i = 0; i < ch->n_rules; i++) { 1633a73d728dSAlexander V. Chernikov rule = ch->map[i]; 1634a73d728dSAlexander V. Chernikov 1635a73d728dSAlexander V. Chernikov l = rule->cmd_len; 1636a73d728dSAlexander V. Chernikov cmd = rule->cmd; 1637a73d728dSAlexander V. Chernikov cmdlen = 0; 1638a73d728dSAlexander V. Chernikov for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 1639a73d728dSAlexander V. Chernikov cmdlen = F_LEN(cmd); 1640a73d728dSAlexander V. Chernikov 164174b22066SAlexander V. Chernikov if (classify_opcode_kidx(cmd, &kidx) != 0) 1642a73d728dSAlexander V. Chernikov continue; 1643a73d728dSAlexander V. Chernikov 1644a73d728dSAlexander V. Chernikov no = ipfw_objhash_lookup_kidx(ni, kidx); 1645a73d728dSAlexander V. Chernikov 164635e1bbd0SAlexander V. Chernikov /* Check if both table object and rule has the set 0 */ 1647a73d728dSAlexander V. Chernikov if (no->set != 0 || rule->set != 0) { 1648a73d728dSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1649a73d728dSAlexander V. Chernikov return (EBUSY); 1650a73d728dSAlexander V. Chernikov } 1651a73d728dSAlexander V. Chernikov 1652a73d728dSAlexander V. Chernikov } 1653a73d728dSAlexander V. Chernikov } 1654a73d728dSAlexander V. Chernikov V_fw_tables_sets = sets; 1655a73d728dSAlexander V. Chernikov 1656a73d728dSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1657a73d728dSAlexander V. Chernikov 1658a73d728dSAlexander V. Chernikov return (0); 1659a73d728dSAlexander V. Chernikov } 1660a73d728dSAlexander V. Chernikov 1661c8d5d308SAlexander V. Chernikov /* 1662c8d5d308SAlexander V. Chernikov * Lookup an IP @addr in table @tbl. 1663c8d5d308SAlexander V. Chernikov * Stores found value in @val. 1664c8d5d308SAlexander V. Chernikov * 1665c8d5d308SAlexander V. Chernikov * Returns 1 if @addr was found. 1666c8d5d308SAlexander V. Chernikov */ 16673b3a8eb9SGleb Smirnoff int 16683b3a8eb9SGleb Smirnoff ipfw_lookup_table(struct ip_fw_chain *ch, uint16_t tbl, in_addr_t addr, 16693b3a8eb9SGleb Smirnoff uint32_t *val) 16703b3a8eb9SGleb Smirnoff { 16719f7d47b0SAlexander V. Chernikov struct table_info *ti; 16723b3a8eb9SGleb Smirnoff 1673c8d5d308SAlexander V. Chernikov ti = KIDX_TO_TI(ch, tbl); 16749f7d47b0SAlexander V. Chernikov 16759f7d47b0SAlexander V. Chernikov return (ti->lookup(ti, &addr, sizeof(in_addr_t), val)); 16763b3a8eb9SGleb Smirnoff } 16779f7d47b0SAlexander V. Chernikov 1678c8d5d308SAlexander V. Chernikov /* 1679c8d5d308SAlexander V. Chernikov * Lookup an arbtrary key @paddr of legth @plen in table @tbl. 1680c8d5d308SAlexander V. Chernikov * Stores found value in @val. 1681c8d5d308SAlexander V. Chernikov * 1682c8d5d308SAlexander V. Chernikov * Returns 1 if key was found. 1683c8d5d308SAlexander V. Chernikov */ 16849f7d47b0SAlexander V. Chernikov int 16859f7d47b0SAlexander V. Chernikov ipfw_lookup_table_extended(struct ip_fw_chain *ch, uint16_t tbl, uint16_t plen, 16869f7d47b0SAlexander V. Chernikov void *paddr, uint32_t *val) 16879f7d47b0SAlexander V. Chernikov { 16889f7d47b0SAlexander V. Chernikov struct table_info *ti; 16899f7d47b0SAlexander V. Chernikov 1690c8d5d308SAlexander V. Chernikov ti = KIDX_TO_TI(ch, tbl); 16919f7d47b0SAlexander V. Chernikov 16929f7d47b0SAlexander V. Chernikov return (ti->lookup(ti, paddr, plen, val)); 16939f7d47b0SAlexander V. Chernikov } 16949f7d47b0SAlexander V. Chernikov 16959f7d47b0SAlexander V. Chernikov /* 16969f7d47b0SAlexander V. Chernikov * Info/List/dump support for tables. 16979f7d47b0SAlexander V. Chernikov * 16989f7d47b0SAlexander V. Chernikov */ 16999f7d47b0SAlexander V. Chernikov 1700f1220db8SAlexander V. Chernikov /* 1701d3a4f924SAlexander V. Chernikov * High-level 'get' cmds sysctl handlers 1702d3a4f924SAlexander V. Chernikov */ 1703d3a4f924SAlexander V. Chernikov 1704d3a4f924SAlexander V. Chernikov /* 1705d3a4f924SAlexander V. Chernikov * Lists all tables currently available in kernel. 1706ac35ff17SAlexander V. Chernikov * Data layout (v0)(current): 1707d3a4f924SAlexander V. Chernikov * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size 1708d3a4f924SAlexander V. Chernikov * Reply: [ ipfw_obj_lheader ipfw_xtable_info x N ] 1709d3a4f924SAlexander V. Chernikov * 1710d3a4f924SAlexander V. Chernikov * Returns 0 on success 1711d3a4f924SAlexander V. Chernikov */ 17126b988f3aSAlexander V. Chernikov static int 17136b988f3aSAlexander V. Chernikov list_tables(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1714e822d936SAlexander V. Chernikov struct sockopt_data *sd) 1715f1220db8SAlexander V. Chernikov { 1716f1220db8SAlexander V. Chernikov struct _ipfw_obj_lheader *olh; 1717f1220db8SAlexander V. Chernikov int error; 1718f1220db8SAlexander V. Chernikov 17192d99a349SAlexander V. Chernikov olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh)); 17202d99a349SAlexander V. Chernikov if (olh == NULL) 1721d3a4f924SAlexander V. Chernikov return (EINVAL); 172268394ec8SAlexander V. Chernikov if (sd->valsize < olh->size) 172368394ec8SAlexander V. Chernikov return (EINVAL); 1724d3a4f924SAlexander V. Chernikov 1725f1220db8SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 17262d99a349SAlexander V. Chernikov error = export_tables(ch, olh, sd); 1727f1220db8SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 1728f1220db8SAlexander V. Chernikov 1729f1220db8SAlexander V. Chernikov return (error); 1730f1220db8SAlexander V. Chernikov } 1731f1220db8SAlexander V. Chernikov 1732f1220db8SAlexander V. Chernikov /* 17332d99a349SAlexander V. Chernikov * Store table info to buffer provided by @sd. 1734ac35ff17SAlexander V. Chernikov * Data layout (v0)(current): 1735d3a4f924SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_xtable_info(empty)] 1736d3a4f924SAlexander V. Chernikov * Reply: [ ipfw_obj_header ipfw_xtable_info ] 1737d3a4f924SAlexander V. Chernikov * 1738d3a4f924SAlexander V. Chernikov * Returns 0 on success. 1739d3a4f924SAlexander V. Chernikov */ 17406b988f3aSAlexander V. Chernikov static int 17416b988f3aSAlexander V. Chernikov describe_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1742e822d936SAlexander V. Chernikov struct sockopt_data *sd) 1743d3a4f924SAlexander V. Chernikov { 1744d3a4f924SAlexander V. Chernikov struct _ipfw_obj_header *oh; 1745d3a4f924SAlexander V. Chernikov struct table_config *tc; 1746d3a4f924SAlexander V. Chernikov struct tid_info ti; 1747d3a4f924SAlexander V. Chernikov size_t sz; 1748d3a4f924SAlexander V. Chernikov 1749d3a4f924SAlexander V. Chernikov sz = sizeof(*oh) + sizeof(ipfw_xtable_info); 17502d99a349SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 17512d99a349SAlexander V. Chernikov if (oh == NULL) 1752d3a4f924SAlexander V. Chernikov return (EINVAL); 1753d3a4f924SAlexander V. Chernikov 1754d3a4f924SAlexander V. Chernikov objheader_to_ti(oh, &ti); 1755d3a4f924SAlexander V. Chernikov 1756d3a4f924SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 1757d3a4f924SAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) { 1758d3a4f924SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 1759d3a4f924SAlexander V. Chernikov return (ESRCH); 1760d3a4f924SAlexander V. Chernikov } 1761d3a4f924SAlexander V. Chernikov 1762ac35ff17SAlexander V. Chernikov export_table_info(ch, tc, (ipfw_xtable_info *)(oh + 1)); 1763d3a4f924SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 1764d3a4f924SAlexander V. Chernikov 17652d99a349SAlexander V. Chernikov return (0); 1766d3a4f924SAlexander V. Chernikov } 1767d3a4f924SAlexander V. Chernikov 1768d3a4f924SAlexander V. Chernikov /* 1769adf3b2b9SAlexander V. Chernikov * Modifies existing table. 1770adf3b2b9SAlexander V. Chernikov * Data layout (v0)(current): 1771adf3b2b9SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_xtable_info ] 1772adf3b2b9SAlexander V. Chernikov * 1773adf3b2b9SAlexander V. Chernikov * Returns 0 on success 1774adf3b2b9SAlexander V. Chernikov */ 17756b988f3aSAlexander V. Chernikov static int 17766b988f3aSAlexander V. Chernikov modify_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1777adf3b2b9SAlexander V. Chernikov struct sockopt_data *sd) 1778adf3b2b9SAlexander V. Chernikov { 1779adf3b2b9SAlexander V. Chernikov struct _ipfw_obj_header *oh; 1780adf3b2b9SAlexander V. Chernikov ipfw_xtable_info *i; 1781adf3b2b9SAlexander V. Chernikov char *tname; 1782adf3b2b9SAlexander V. Chernikov struct tid_info ti; 1783adf3b2b9SAlexander V. Chernikov struct namedobj_instance *ni; 1784adf3b2b9SAlexander V. Chernikov struct table_config *tc; 1785adf3b2b9SAlexander V. Chernikov 1786adf3b2b9SAlexander V. Chernikov if (sd->valsize != sizeof(*oh) + sizeof(ipfw_xtable_info)) 1787adf3b2b9SAlexander V. Chernikov return (EINVAL); 1788adf3b2b9SAlexander V. Chernikov 1789adf3b2b9SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)sd->kbuf; 1790adf3b2b9SAlexander V. Chernikov i = (ipfw_xtable_info *)(oh + 1); 1791adf3b2b9SAlexander V. Chernikov 1792adf3b2b9SAlexander V. Chernikov /* 1793adf3b2b9SAlexander V. Chernikov * Verify user-supplied strings. 1794adf3b2b9SAlexander V. Chernikov * Check for null-terminated/zero-length strings/ 1795adf3b2b9SAlexander V. Chernikov */ 1796adf3b2b9SAlexander V. Chernikov tname = oh->ntlv.name; 1797adf3b2b9SAlexander V. Chernikov if (ipfw_check_table_name(tname) != 0) 1798adf3b2b9SAlexander V. Chernikov return (EINVAL); 1799adf3b2b9SAlexander V. Chernikov 1800adf3b2b9SAlexander V. Chernikov objheader_to_ti(oh, &ti); 1801adf3b2b9SAlexander V. Chernikov ti.type = i->type; 1802adf3b2b9SAlexander V. Chernikov 1803adf3b2b9SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1804adf3b2b9SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1805adf3b2b9SAlexander V. Chernikov if ((tc = find_table(ni, &ti)) == NULL) { 1806adf3b2b9SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1807adf3b2b9SAlexander V. Chernikov return (ESRCH); 1808adf3b2b9SAlexander V. Chernikov } 1809fd0869d5SAlexander V. Chernikov 1810fd0869d5SAlexander V. Chernikov /* Do not support any modifications for readonly tables */ 1811fd0869d5SAlexander V. Chernikov if ((tc->ta->flags & TA_FLAG_READONLY) != 0) { 1812fd0869d5SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1813fd0869d5SAlexander V. Chernikov return (EACCES); 1814fd0869d5SAlexander V. Chernikov } 1815fd0869d5SAlexander V. Chernikov 1816adf3b2b9SAlexander V. Chernikov if ((i->mflags & IPFW_TMFLAGS_LIMIT) != 0) 1817adf3b2b9SAlexander V. Chernikov tc->limit = i->limit; 18184f43138aSAlexander V. Chernikov if ((i->mflags & IPFW_TMFLAGS_LOCK) != 0) 18194f43138aSAlexander V. Chernikov tc->locked = ((i->flags & IPFW_TGFLAGS_LOCKED) != 0); 1820adf3b2b9SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1821adf3b2b9SAlexander V. Chernikov 1822adf3b2b9SAlexander V. Chernikov return (0); 1823adf3b2b9SAlexander V. Chernikov } 1824adf3b2b9SAlexander V. Chernikov 1825adf3b2b9SAlexander V. Chernikov /* 18269490a627SAlexander V. Chernikov * Creates new table. 1827ac35ff17SAlexander V. Chernikov * Data layout (v0)(current): 18289490a627SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_xtable_info ] 18299490a627SAlexander V. Chernikov * 18309490a627SAlexander V. Chernikov * Returns 0 on success 18319490a627SAlexander V. Chernikov */ 18326b988f3aSAlexander V. Chernikov static int 18336b988f3aSAlexander V. Chernikov create_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1834ac35ff17SAlexander V. Chernikov struct sockopt_data *sd) 18359490a627SAlexander V. Chernikov { 18369490a627SAlexander V. Chernikov struct _ipfw_obj_header *oh; 18379490a627SAlexander V. Chernikov ipfw_xtable_info *i; 18389490a627SAlexander V. Chernikov char *tname, *aname; 18399490a627SAlexander V. Chernikov struct tid_info ti; 18409490a627SAlexander V. Chernikov struct namedobj_instance *ni; 18419490a627SAlexander V. Chernikov 1842ac35ff17SAlexander V. Chernikov if (sd->valsize != sizeof(*oh) + sizeof(ipfw_xtable_info)) 18439490a627SAlexander V. Chernikov return (EINVAL); 18449490a627SAlexander V. Chernikov 1845ac35ff17SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)sd->kbuf; 18469490a627SAlexander V. Chernikov i = (ipfw_xtable_info *)(oh + 1); 18479490a627SAlexander V. Chernikov 18489490a627SAlexander V. Chernikov /* 18499490a627SAlexander V. Chernikov * Verify user-supplied strings. 18502d99a349SAlexander V. Chernikov * Check for null-terminated/zero-length strings/ 18519490a627SAlexander V. Chernikov */ 1852ac35ff17SAlexander V. Chernikov tname = oh->ntlv.name; 18539490a627SAlexander V. Chernikov aname = i->algoname; 1854ac35ff17SAlexander V. Chernikov if (ipfw_check_table_name(tname) != 0 || 18559490a627SAlexander V. Chernikov strnlen(aname, sizeof(i->algoname)) == sizeof(i->algoname)) 18569490a627SAlexander V. Chernikov return (EINVAL); 18579490a627SAlexander V. Chernikov 18589490a627SAlexander V. Chernikov if (aname[0] == '\0') { 18599490a627SAlexander V. Chernikov /* Use default algorithm */ 18609490a627SAlexander V. Chernikov aname = NULL; 18619490a627SAlexander V. Chernikov } 18629490a627SAlexander V. Chernikov 18639490a627SAlexander V. Chernikov objheader_to_ti(oh, &ti); 1864ac35ff17SAlexander V. Chernikov ti.type = i->type; 18659490a627SAlexander V. Chernikov 18669490a627SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 18679490a627SAlexander V. Chernikov 18689490a627SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 1869038263c3SAlexander V. Chernikov if (find_table(ni, &ti) != NULL) { 18709490a627SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 18719490a627SAlexander V. Chernikov return (EEXIST); 18729490a627SAlexander V. Chernikov } 18739490a627SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 18749490a627SAlexander V. Chernikov 1875867708f7SAlexander V. Chernikov return (create_table_internal(ch, &ti, aname, i, NULL, 0)); 1876db785d31SAlexander V. Chernikov } 1877db785d31SAlexander V. Chernikov 1878db785d31SAlexander V. Chernikov /* 1879db785d31SAlexander V. Chernikov * Creates new table based on @ti and @aname. 1880db785d31SAlexander V. Chernikov * 1881db785d31SAlexander V. Chernikov * Relies on table name checking inside find_name_tlv() 1882db785d31SAlexander V. Chernikov * Assume @aname to be checked and valid. 1883867708f7SAlexander V. Chernikov * Stores allocated table kidx inside @pkidx (if non-NULL). 18840468c5baSAlexander V. Chernikov * Reference created table if @compat is non-zero. 1885db785d31SAlexander V. Chernikov * 1886db785d31SAlexander V. Chernikov * Returns 0 on success. 1887db785d31SAlexander V. Chernikov */ 1888db785d31SAlexander V. Chernikov static int 1889db785d31SAlexander V. Chernikov create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti, 1890867708f7SAlexander V. Chernikov char *aname, ipfw_xtable_info *i, uint16_t *pkidx, int compat) 1891db785d31SAlexander V. Chernikov { 1892db785d31SAlexander V. Chernikov struct namedobj_instance *ni; 1893c8d5d308SAlexander V. Chernikov struct table_config *tc, *tc_new, *tmp; 1894db785d31SAlexander V. Chernikov struct table_algo *ta; 1895db785d31SAlexander V. Chernikov uint16_t kidx; 1896db785d31SAlexander V. Chernikov 1897db785d31SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1898db785d31SAlexander V. Chernikov 1899db785d31SAlexander V. Chernikov ta = find_table_algo(CHAIN_TO_TCFG(ch), ti, aname); 19009490a627SAlexander V. Chernikov if (ta == NULL) 19019490a627SAlexander V. Chernikov return (ENOTSUP); 19029490a627SAlexander V. Chernikov 19030cba2b28SAlexander V. Chernikov tc = alloc_table_config(ch, ti, ta, aname, i->tflags); 19044c0c07a5SAlexander V. Chernikov if (tc == NULL) 19059490a627SAlexander V. Chernikov return (ENOMEM); 19069490a627SAlexander V. Chernikov 19070cba2b28SAlexander V. Chernikov tc->vmask = i->vmask; 19084c0c07a5SAlexander V. Chernikov tc->limit = i->limit; 1909fd0869d5SAlexander V. Chernikov if (ta->flags & TA_FLAG_READONLY) 1910fd0869d5SAlexander V. Chernikov tc->locked = 1; 1911fd0869d5SAlexander V. Chernikov else 19124f43138aSAlexander V. Chernikov tc->locked = (i->flags & IPFW_TGFLAGS_LOCKED) != 0; 19134c0c07a5SAlexander V. Chernikov 19149490a627SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1915db785d31SAlexander V. Chernikov 1916db785d31SAlexander V. Chernikov /* Check if table has been already created */ 19170468c5baSAlexander V. Chernikov tc_new = find_table(ni, ti); 19180468c5baSAlexander V. Chernikov if (tc_new != NULL) { 19190468c5baSAlexander V. Chernikov 19200468c5baSAlexander V. Chernikov /* 19210468c5baSAlexander V. Chernikov * Compat: do not fail if we're 19220468c5baSAlexander V. Chernikov * requesting to create existing table 19230cba2b28SAlexander V. Chernikov * which has the same type 19240468c5baSAlexander V. Chernikov */ 192574b22066SAlexander V. Chernikov if (compat == 0 || tc_new->no.subtype != tc->no.subtype) { 1926db785d31SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1927db785d31SAlexander V. Chernikov free_table_config(ni, tc); 1928db785d31SAlexander V. Chernikov return (EEXIST); 1929db785d31SAlexander V. Chernikov } 1930db785d31SAlexander V. Chernikov 19310468c5baSAlexander V. Chernikov /* Exchange tc and tc_new for proper refcounting & freeing */ 19320468c5baSAlexander V. Chernikov tmp = tc; 19330468c5baSAlexander V. Chernikov tc = tc_new; 19340468c5baSAlexander V. Chernikov tc_new = tmp; 19350468c5baSAlexander V. Chernikov } else { 19360468c5baSAlexander V. Chernikov /* New table */ 1937ac35ff17SAlexander V. Chernikov if (ipfw_objhash_alloc_idx(ni, &kidx) != 0) { 19389490a627SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1939db785d31SAlexander V. Chernikov printf("Unable to allocate table index." 1940db785d31SAlexander V. Chernikov " Consider increasing net.inet.ip.fw.tables_max"); 19419490a627SAlexander V. Chernikov free_table_config(ni, tc); 19429490a627SAlexander V. Chernikov return (EBUSY); 19439490a627SAlexander V. Chernikov } 19449490a627SAlexander V. Chernikov tc->no.kidx = kidx; 194574b22066SAlexander V. Chernikov tc->no.etlv = IPFW_TLV_TBL_NAME; 19469490a627SAlexander V. Chernikov 19479490a627SAlexander V. Chernikov IPFW_WLOCK(ch); 19489490a627SAlexander V. Chernikov link_table(ch, tc); 19499490a627SAlexander V. Chernikov IPFW_WUNLOCK(ch); 19500468c5baSAlexander V. Chernikov } 19510468c5baSAlexander V. Chernikov 19520468c5baSAlexander V. Chernikov if (compat != 0) 19530468c5baSAlexander V. Chernikov tc->no.refcnt++; 19540468c5baSAlexander V. Chernikov if (pkidx != NULL) 19550468c5baSAlexander V. Chernikov *pkidx = tc->no.kidx; 19569490a627SAlexander V. Chernikov 19579490a627SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 19589490a627SAlexander V. Chernikov 19590468c5baSAlexander V. Chernikov if (tc_new != NULL) 19600468c5baSAlexander V. Chernikov free_table_config(ni, tc_new); 19610468c5baSAlexander V. Chernikov 19629490a627SAlexander V. Chernikov return (0); 19639490a627SAlexander V. Chernikov } 19649490a627SAlexander V. Chernikov 196546d52008SAlexander V. Chernikov static void 196646d52008SAlexander V. Chernikov ntlv_to_ti(ipfw_obj_ntlv *ntlv, struct tid_info *ti) 1967d3a4f924SAlexander V. Chernikov { 1968d3a4f924SAlexander V. Chernikov 1969d3a4f924SAlexander V. Chernikov memset(ti, 0, sizeof(struct tid_info)); 197046d52008SAlexander V. Chernikov ti->set = ntlv->set; 197146d52008SAlexander V. Chernikov ti->uidx = ntlv->idx; 197246d52008SAlexander V. Chernikov ti->tlvs = ntlv; 197346d52008SAlexander V. Chernikov ti->tlen = ntlv->head.length; 197446d52008SAlexander V. Chernikov } 197546d52008SAlexander V. Chernikov 197646d52008SAlexander V. Chernikov static void 197746d52008SAlexander V. Chernikov objheader_to_ti(struct _ipfw_obj_header *oh, struct tid_info *ti) 197846d52008SAlexander V. Chernikov { 197946d52008SAlexander V. Chernikov 198046d52008SAlexander V. Chernikov ntlv_to_ti(&oh->ntlv, ti); 1981d3a4f924SAlexander V. Chernikov } 1982d3a4f924SAlexander V. Chernikov 198374b22066SAlexander V. Chernikov struct namedobj_instance * 198474b22066SAlexander V. Chernikov ipfw_get_table_objhash(struct ip_fw_chain *ch) 198574b22066SAlexander V. Chernikov { 198674b22066SAlexander V. Chernikov 198774b22066SAlexander V. Chernikov return (CHAIN_TO_NI(ch)); 198874b22066SAlexander V. Chernikov } 198974b22066SAlexander V. Chernikov 199035e1bbd0SAlexander V. Chernikov /* 199135e1bbd0SAlexander V. Chernikov * Exports basic table info as name TLV. 199235e1bbd0SAlexander V. Chernikov * Used inside dump_static_rules() to provide info 199335e1bbd0SAlexander V. Chernikov * about all tables referenced by current ruleset. 199435e1bbd0SAlexander V. Chernikov * 199535e1bbd0SAlexander V. Chernikov * Returns 0 on success. 199635e1bbd0SAlexander V. Chernikov */ 1997563b5ab1SAlexander V. Chernikov int 1998563b5ab1SAlexander V. Chernikov ipfw_export_table_ntlv(struct ip_fw_chain *ch, uint16_t kidx, 1999563b5ab1SAlexander V. Chernikov struct sockopt_data *sd) 2000563b5ab1SAlexander V. Chernikov { 2001563b5ab1SAlexander V. Chernikov struct namedobj_instance *ni; 2002563b5ab1SAlexander V. Chernikov struct named_object *no; 2003563b5ab1SAlexander V. Chernikov ipfw_obj_ntlv *ntlv; 2004563b5ab1SAlexander V. Chernikov 2005563b5ab1SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 2006563b5ab1SAlexander V. Chernikov 2007ac35ff17SAlexander V. Chernikov no = ipfw_objhash_lookup_kidx(ni, kidx); 2008563b5ab1SAlexander V. Chernikov KASSERT(no != NULL, ("invalid table kidx passed")); 2009563b5ab1SAlexander V. Chernikov 2010563b5ab1SAlexander V. Chernikov ntlv = (ipfw_obj_ntlv *)ipfw_get_sopt_space(sd, sizeof(*ntlv)); 2011563b5ab1SAlexander V. Chernikov if (ntlv == NULL) 2012563b5ab1SAlexander V. Chernikov return (ENOMEM); 2013563b5ab1SAlexander V. Chernikov 2014563b5ab1SAlexander V. Chernikov ntlv->head.type = IPFW_TLV_TBL_NAME; 2015563b5ab1SAlexander V. Chernikov ntlv->head.length = sizeof(*ntlv); 2016563b5ab1SAlexander V. Chernikov ntlv->idx = no->kidx; 2017563b5ab1SAlexander V. Chernikov strlcpy(ntlv->name, no->name, sizeof(ntlv->name)); 2018563b5ab1SAlexander V. Chernikov 2019563b5ab1SAlexander V. Chernikov return (0); 2020563b5ab1SAlexander V. Chernikov } 2021563b5ab1SAlexander V. Chernikov 2022d3b00c08SAlexander V. Chernikov struct dump_args { 20230cba2b28SAlexander V. Chernikov struct ip_fw_chain *ch; 2024d3b00c08SAlexander V. Chernikov struct table_info *ti; 2025d3b00c08SAlexander V. Chernikov struct table_config *tc; 2026d3b00c08SAlexander V. Chernikov struct sockopt_data *sd; 2027d3b00c08SAlexander V. Chernikov uint32_t cnt; 2028d3b00c08SAlexander V. Chernikov uint16_t uidx; 2029d3b00c08SAlexander V. Chernikov int error; 2030d3b00c08SAlexander V. Chernikov uint32_t size; 20314dff4ae0SAlexander V. Chernikov ipfw_table_entry *ent; 20324dff4ae0SAlexander V. Chernikov ta_foreach_f *f; 20334dff4ae0SAlexander V. Chernikov void *farg; 2034d3b00c08SAlexander V. Chernikov ipfw_obj_tentry tent; 2035d3b00c08SAlexander V. Chernikov }; 2036d3b00c08SAlexander V. Chernikov 2037d3b00c08SAlexander V. Chernikov static int 2038d3b00c08SAlexander V. Chernikov count_ext_entries(void *e, void *arg) 2039d3b00c08SAlexander V. Chernikov { 2040d3b00c08SAlexander V. Chernikov struct dump_args *da; 2041d3b00c08SAlexander V. Chernikov 2042d3b00c08SAlexander V. Chernikov da = (struct dump_args *)arg; 2043d3b00c08SAlexander V. Chernikov da->cnt++; 2044d3b00c08SAlexander V. Chernikov 2045d3b00c08SAlexander V. Chernikov return (0); 2046d3b00c08SAlexander V. Chernikov } 2047d3b00c08SAlexander V. Chernikov 2048d3b00c08SAlexander V. Chernikov /* 2049d3b00c08SAlexander V. Chernikov * Gets number of items from table either using 2050d3b00c08SAlexander V. Chernikov * internal counter or calling algo callback for 2051d3b00c08SAlexander V. Chernikov * externally-managed tables. 2052d3b00c08SAlexander V. Chernikov * 2053d3b00c08SAlexander V. Chernikov * Returns number of records. 2054d3b00c08SAlexander V. Chernikov */ 2055d3b00c08SAlexander V. Chernikov static uint32_t 2056d3b00c08SAlexander V. Chernikov table_get_count(struct ip_fw_chain *ch, struct table_config *tc) 2057d3b00c08SAlexander V. Chernikov { 2058d3b00c08SAlexander V. Chernikov struct table_info *ti; 2059d3b00c08SAlexander V. Chernikov struct table_algo *ta; 2060d3b00c08SAlexander V. Chernikov struct dump_args da; 2061d3b00c08SAlexander V. Chernikov 2062d3b00c08SAlexander V. Chernikov ti = KIDX_TO_TI(ch, tc->no.kidx); 2063d3b00c08SAlexander V. Chernikov ta = tc->ta; 2064d3b00c08SAlexander V. Chernikov 2065d3b00c08SAlexander V. Chernikov /* Use internal counter for self-managed tables */ 2066d3b00c08SAlexander V. Chernikov if ((ta->flags & TA_FLAG_READONLY) == 0) 2067d3b00c08SAlexander V. Chernikov return (tc->count); 2068d3b00c08SAlexander V. Chernikov 2069d3b00c08SAlexander V. Chernikov /* Use callback to quickly get number of items */ 2070d3b00c08SAlexander V. Chernikov if ((ta->flags & TA_FLAG_EXTCOUNTER) != 0) 2071d3b00c08SAlexander V. Chernikov return (ta->get_count(tc->astate, ti)); 2072d3b00c08SAlexander V. Chernikov 2073d3b00c08SAlexander V. Chernikov /* Count number of iterms ourselves */ 2074d3b00c08SAlexander V. Chernikov memset(&da, 0, sizeof(da)); 2075d3b00c08SAlexander V. Chernikov ta->foreach(tc->astate, ti, count_ext_entries, &da); 2076d3b00c08SAlexander V. Chernikov 2077d3b00c08SAlexander V. Chernikov return (da.cnt); 2078d3b00c08SAlexander V. Chernikov } 2079f99fbf96SAlexander V. Chernikov 2080f99fbf96SAlexander V. Chernikov /* 208135e1bbd0SAlexander V. Chernikov * Exports table @tc info into standard ipfw_xtable_info format. 208235e1bbd0SAlexander V. Chernikov */ 20839f7d47b0SAlexander V. Chernikov static void 2084ac35ff17SAlexander V. Chernikov export_table_info(struct ip_fw_chain *ch, struct table_config *tc, 2085ac35ff17SAlexander V. Chernikov ipfw_xtable_info *i) 20869f7d47b0SAlexander V. Chernikov { 2087ac35ff17SAlexander V. Chernikov struct table_info *ti; 20885f379342SAlexander V. Chernikov struct table_algo *ta; 20899f7d47b0SAlexander V. Chernikov 209074b22066SAlexander V. Chernikov i->type = tc->no.subtype; 2091914bffb6SAlexander V. Chernikov i->tflags = tc->tflags; 20920cba2b28SAlexander V. Chernikov i->vmask = tc->vmask; 20939f7d47b0SAlexander V. Chernikov i->set = tc->no.set; 20949f7d47b0SAlexander V. Chernikov i->kidx = tc->no.kidx; 20959f7d47b0SAlexander V. Chernikov i->refcnt = tc->no.refcnt; 2096d3b00c08SAlexander V. Chernikov i->count = table_get_count(ch, tc); 20974c0c07a5SAlexander V. Chernikov i->limit = tc->limit; 20984f43138aSAlexander V. Chernikov i->flags |= (tc->locked != 0) ? IPFW_TGFLAGS_LOCKED : 0; 209981d3153dSAlexander V. Chernikov i->size = tc->count * sizeof(ipfw_obj_tentry); 2100f1220db8SAlexander V. Chernikov i->size += sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info); 21019f7d47b0SAlexander V. Chernikov strlcpy(i->tablename, tc->tablename, sizeof(i->tablename)); 2102ac35ff17SAlexander V. Chernikov ti = KIDX_TO_TI(ch, tc->no.kidx); 21035f379342SAlexander V. Chernikov ta = tc->ta; 21045f379342SAlexander V. Chernikov if (ta->print_config != NULL) { 21055f379342SAlexander V. Chernikov /* Use algo function to print table config to string */ 21065f379342SAlexander V. Chernikov ta->print_config(tc->astate, ti, i->algoname, 2107ac35ff17SAlexander V. Chernikov sizeof(i->algoname)); 2108ac35ff17SAlexander V. Chernikov } else 21095f379342SAlexander V. Chernikov strlcpy(i->algoname, ta->name, sizeof(i->algoname)); 21105f379342SAlexander V. Chernikov /* Dump algo-specific data, if possible */ 21115f379342SAlexander V. Chernikov if (ta->dump_tinfo != NULL) { 21125f379342SAlexander V. Chernikov ta->dump_tinfo(tc->astate, ti, &i->ta_info); 21135f379342SAlexander V. Chernikov i->ta_info.flags |= IPFW_TATFLAGS_DATA; 21145f379342SAlexander V. Chernikov } 21159f7d47b0SAlexander V. Chernikov } 21169f7d47b0SAlexander V. Chernikov 2117ac35ff17SAlexander V. Chernikov struct dump_table_args { 2118ac35ff17SAlexander V. Chernikov struct ip_fw_chain *ch; 2119ac35ff17SAlexander V. Chernikov struct sockopt_data *sd; 2120ac35ff17SAlexander V. Chernikov }; 2121ac35ff17SAlexander V. Chernikov 21229f7d47b0SAlexander V. Chernikov static void 21239f7d47b0SAlexander V. Chernikov export_table_internal(struct namedobj_instance *ni, struct named_object *no, 21249f7d47b0SAlexander V. Chernikov void *arg) 21253b3a8eb9SGleb Smirnoff { 21269f7d47b0SAlexander V. Chernikov ipfw_xtable_info *i; 2127ac35ff17SAlexander V. Chernikov struct dump_table_args *dta; 21283b3a8eb9SGleb Smirnoff 2129ac35ff17SAlexander V. Chernikov dta = (struct dump_table_args *)arg; 2130ac35ff17SAlexander V. Chernikov 2131ac35ff17SAlexander V. Chernikov i = (ipfw_xtable_info *)ipfw_get_sopt_space(dta->sd, sizeof(*i)); 213268394ec8SAlexander V. Chernikov KASSERT(i != 0, ("previously checked buffer is not enough")); 21339f7d47b0SAlexander V. Chernikov 2134ac35ff17SAlexander V. Chernikov export_table_info(dta->ch, (struct table_config *)no, i); 21359f7d47b0SAlexander V. Chernikov } 21369f7d47b0SAlexander V. Chernikov 2137f1220db8SAlexander V. Chernikov /* 2138f1220db8SAlexander V. Chernikov * Export all tables as ipfw_xtable_info structures to 21392d99a349SAlexander V. Chernikov * storage provided by @sd. 214028ea4fa3SAlexander V. Chernikov * 214128ea4fa3SAlexander V. Chernikov * If supplied buffer is too small, fills in required size 214228ea4fa3SAlexander V. Chernikov * and returns ENOMEM. 2143f1220db8SAlexander V. Chernikov * Returns 0 on success. 2144f1220db8SAlexander V. Chernikov */ 2145f1220db8SAlexander V. Chernikov static int 21462d99a349SAlexander V. Chernikov export_tables(struct ip_fw_chain *ch, ipfw_obj_lheader *olh, 21472d99a349SAlexander V. Chernikov struct sockopt_data *sd) 21489f7d47b0SAlexander V. Chernikov { 21499f7d47b0SAlexander V. Chernikov uint32_t size; 21509f7d47b0SAlexander V. Chernikov uint32_t count; 2151ac35ff17SAlexander V. Chernikov struct dump_table_args dta; 21529f7d47b0SAlexander V. Chernikov 21539f7d47b0SAlexander V. Chernikov count = ipfw_objhash_count(CHAIN_TO_NI(ch)); 21549f7d47b0SAlexander V. Chernikov size = count * sizeof(ipfw_xtable_info) + sizeof(ipfw_obj_lheader); 21552d99a349SAlexander V. Chernikov 21562d99a349SAlexander V. Chernikov /* Fill in header regadless of buffer size */ 2157f1220db8SAlexander V. Chernikov olh->count = count; 2158f1220db8SAlexander V. Chernikov olh->objsize = sizeof(ipfw_xtable_info); 21592d99a349SAlexander V. Chernikov 21602d99a349SAlexander V. Chernikov if (size > olh->size) { 21612d99a349SAlexander V. Chernikov olh->size = size; 21629f7d47b0SAlexander V. Chernikov return (ENOMEM); 2163f1220db8SAlexander V. Chernikov } 216468394ec8SAlexander V. Chernikov 21659f7d47b0SAlexander V. Chernikov olh->size = size; 21662d99a349SAlexander V. Chernikov 2167ac35ff17SAlexander V. Chernikov dta.ch = ch; 2168ac35ff17SAlexander V. Chernikov dta.sd = sd; 2169ac35ff17SAlexander V. Chernikov 2170ac35ff17SAlexander V. Chernikov ipfw_objhash_foreach(CHAIN_TO_NI(ch), export_table_internal, &dta); 21719f7d47b0SAlexander V. Chernikov 21723b3a8eb9SGleb Smirnoff return (0); 21733b3a8eb9SGleb Smirnoff } 21743b3a8eb9SGleb Smirnoff 2175f99fbf96SAlexander V. Chernikov /* 2176f99fbf96SAlexander V. Chernikov * Dumps all table data 2177f99fbf96SAlexander V. Chernikov * Data layout (v1)(current): 2178f99fbf96SAlexander V. Chernikov * Request: [ ipfw_obj_header ], size = ipfw_xtable_info.size 2179f99fbf96SAlexander V. Chernikov * Reply: [ ipfw_obj_header ipfw_xtable_info ipfw_obj_tentry x N ] 2180f99fbf96SAlexander V. Chernikov * 2181f99fbf96SAlexander V. Chernikov * Returns 0 on success 2182f99fbf96SAlexander V. Chernikov */ 2183f99fbf96SAlexander V. Chernikov static int 21846b988f3aSAlexander V. Chernikov dump_table_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 21856b988f3aSAlexander V. Chernikov struct sockopt_data *sd) 2186f99fbf96SAlexander V. Chernikov { 2187f99fbf96SAlexander V. Chernikov struct _ipfw_obj_header *oh; 2188f99fbf96SAlexander V. Chernikov ipfw_xtable_info *i; 2189f99fbf96SAlexander V. Chernikov struct tid_info ti; 2190f99fbf96SAlexander V. Chernikov struct table_config *tc; 2191f99fbf96SAlexander V. Chernikov struct table_algo *ta; 2192f99fbf96SAlexander V. Chernikov struct dump_args da; 2193f99fbf96SAlexander V. Chernikov uint32_t sz; 2194f99fbf96SAlexander V. Chernikov 2195f99fbf96SAlexander V. Chernikov sz = sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info); 2196f99fbf96SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 2197f99fbf96SAlexander V. Chernikov if (oh == NULL) 2198f99fbf96SAlexander V. Chernikov return (EINVAL); 2199f99fbf96SAlexander V. Chernikov 2200f99fbf96SAlexander V. Chernikov i = (ipfw_xtable_info *)(oh + 1); 2201f99fbf96SAlexander V. Chernikov objheader_to_ti(oh, &ti); 2202f99fbf96SAlexander V. Chernikov 2203f99fbf96SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 2204f99fbf96SAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) { 2205f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2206f99fbf96SAlexander V. Chernikov return (ESRCH); 2207f99fbf96SAlexander V. Chernikov } 2208f99fbf96SAlexander V. Chernikov export_table_info(ch, tc, i); 2209f99fbf96SAlexander V. Chernikov 2210f99fbf96SAlexander V. Chernikov if (sd->valsize < i->size) { 2211f99fbf96SAlexander V. Chernikov 2212f99fbf96SAlexander V. Chernikov /* 2213f99fbf96SAlexander V. Chernikov * Submitted buffer size is not enough. 2214f99fbf96SAlexander V. Chernikov * WE've already filled in @i structure with 2215f99fbf96SAlexander V. Chernikov * relevant table info including size, so we 2216f99fbf96SAlexander V. Chernikov * can return. Buffer will be flushed automatically. 2217f99fbf96SAlexander V. Chernikov */ 2218f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2219f99fbf96SAlexander V. Chernikov return (ENOMEM); 2220f99fbf96SAlexander V. Chernikov } 2221f99fbf96SAlexander V. Chernikov 2222f99fbf96SAlexander V. Chernikov /* 2223f99fbf96SAlexander V. Chernikov * Do the actual dump in eXtended format 2224f99fbf96SAlexander V. Chernikov */ 2225f99fbf96SAlexander V. Chernikov memset(&da, 0, sizeof(da)); 22260cba2b28SAlexander V. Chernikov da.ch = ch; 2227f99fbf96SAlexander V. Chernikov da.ti = KIDX_TO_TI(ch, tc->no.kidx); 2228f99fbf96SAlexander V. Chernikov da.tc = tc; 2229f99fbf96SAlexander V. Chernikov da.sd = sd; 2230f99fbf96SAlexander V. Chernikov 2231f99fbf96SAlexander V. Chernikov ta = tc->ta; 2232f99fbf96SAlexander V. Chernikov 2233f99fbf96SAlexander V. Chernikov ta->foreach(tc->astate, da.ti, dump_table_tentry, &da); 2234f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2235f99fbf96SAlexander V. Chernikov 2236f99fbf96SAlexander V. Chernikov return (da.error); 2237f99fbf96SAlexander V. Chernikov } 2238f99fbf96SAlexander V. Chernikov 2239f99fbf96SAlexander V. Chernikov /* 2240f99fbf96SAlexander V. Chernikov * Dumps all table data 2241f99fbf96SAlexander V. Chernikov * Data layout (version 0)(legacy): 2242f99fbf96SAlexander V. Chernikov * Request: [ ipfw_xtable ], size = IP_FW_TABLE_XGETSIZE() 2243f99fbf96SAlexander V. Chernikov * Reply: [ ipfw_xtable ipfw_table_xentry x N ] 2244f99fbf96SAlexander V. Chernikov * 2245f99fbf96SAlexander V. Chernikov * Returns 0 on success 2246f99fbf96SAlexander V. Chernikov */ 2247f99fbf96SAlexander V. Chernikov static int 22486b988f3aSAlexander V. Chernikov dump_table_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 22496b988f3aSAlexander V. Chernikov struct sockopt_data *sd) 2250f99fbf96SAlexander V. Chernikov { 2251f99fbf96SAlexander V. Chernikov ipfw_xtable *xtbl; 2252f99fbf96SAlexander V. Chernikov struct tid_info ti; 2253f99fbf96SAlexander V. Chernikov struct table_config *tc; 2254f99fbf96SAlexander V. Chernikov struct table_algo *ta; 2255f99fbf96SAlexander V. Chernikov struct dump_args da; 2256d3b00c08SAlexander V. Chernikov size_t sz, count; 2257f99fbf96SAlexander V. Chernikov 2258f99fbf96SAlexander V. Chernikov xtbl = (ipfw_xtable *)ipfw_get_sopt_header(sd, sizeof(ipfw_xtable)); 2259f99fbf96SAlexander V. Chernikov if (xtbl == NULL) 2260f99fbf96SAlexander V. Chernikov return (EINVAL); 2261f99fbf96SAlexander V. Chernikov 2262f99fbf96SAlexander V. Chernikov memset(&ti, 0, sizeof(ti)); 2263f99fbf96SAlexander V. Chernikov ti.uidx = xtbl->tbl; 2264f99fbf96SAlexander V. Chernikov 2265f99fbf96SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 2266f99fbf96SAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) { 2267f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2268f99fbf96SAlexander V. Chernikov return (0); 2269f99fbf96SAlexander V. Chernikov } 2270d3b00c08SAlexander V. Chernikov count = table_get_count(ch, tc); 2271d3b00c08SAlexander V. Chernikov sz = count * sizeof(ipfw_table_xentry) + sizeof(ipfw_xtable); 2272f99fbf96SAlexander V. Chernikov 2273d3b00c08SAlexander V. Chernikov xtbl->cnt = count; 2274f99fbf96SAlexander V. Chernikov xtbl->size = sz; 227574b22066SAlexander V. Chernikov xtbl->type = tc->no.subtype; 2276f99fbf96SAlexander V. Chernikov xtbl->tbl = ti.uidx; 2277f99fbf96SAlexander V. Chernikov 2278f99fbf96SAlexander V. Chernikov if (sd->valsize < sz) { 2279f99fbf96SAlexander V. Chernikov 2280f99fbf96SAlexander V. Chernikov /* 2281f99fbf96SAlexander V. Chernikov * Submitted buffer size is not enough. 2282f99fbf96SAlexander V. Chernikov * WE've already filled in @i structure with 2283f99fbf96SAlexander V. Chernikov * relevant table info including size, so we 2284f99fbf96SAlexander V. Chernikov * can return. Buffer will be flushed automatically. 2285f99fbf96SAlexander V. Chernikov */ 2286f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2287f99fbf96SAlexander V. Chernikov return (ENOMEM); 2288f99fbf96SAlexander V. Chernikov } 2289f99fbf96SAlexander V. Chernikov 2290f99fbf96SAlexander V. Chernikov /* Do the actual dump in eXtended format */ 2291f99fbf96SAlexander V. Chernikov memset(&da, 0, sizeof(da)); 22920cba2b28SAlexander V. Chernikov da.ch = ch; 2293f99fbf96SAlexander V. Chernikov da.ti = KIDX_TO_TI(ch, tc->no.kidx); 2294f99fbf96SAlexander V. Chernikov da.tc = tc; 2295f99fbf96SAlexander V. Chernikov da.sd = sd; 2296f99fbf96SAlexander V. Chernikov 2297f99fbf96SAlexander V. Chernikov ta = tc->ta; 2298f99fbf96SAlexander V. Chernikov 2299f99fbf96SAlexander V. Chernikov ta->foreach(tc->astate, da.ti, dump_table_xentry, &da); 2300f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2301f99fbf96SAlexander V. Chernikov 2302f99fbf96SAlexander V. Chernikov return (0); 2303f99fbf96SAlexander V. Chernikov } 2304f99fbf96SAlexander V. Chernikov 230581d3153dSAlexander V. Chernikov /* 2306e822d936SAlexander V. Chernikov * Legacy function to retrieve number of items in table. 2307e822d936SAlexander V. Chernikov */ 23086b988f3aSAlexander V. Chernikov static int 23096b988f3aSAlexander V. Chernikov get_table_size(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 2310e822d936SAlexander V. Chernikov struct sockopt_data *sd) 2311e822d936SAlexander V. Chernikov { 2312e822d936SAlexander V. Chernikov uint32_t *tbl; 2313e822d936SAlexander V. Chernikov struct tid_info ti; 2314e822d936SAlexander V. Chernikov size_t sz; 2315e822d936SAlexander V. Chernikov int error; 2316e822d936SAlexander V. Chernikov 2317e822d936SAlexander V. Chernikov sz = sizeof(*op3) + sizeof(uint32_t); 2318e822d936SAlexander V. Chernikov op3 = (ip_fw3_opheader *)ipfw_get_sopt_header(sd, sz); 2319e822d936SAlexander V. Chernikov if (op3 == NULL) 2320e822d936SAlexander V. Chernikov return (EINVAL); 2321e822d936SAlexander V. Chernikov 2322e822d936SAlexander V. Chernikov tbl = (uint32_t *)(op3 + 1); 2323e822d936SAlexander V. Chernikov memset(&ti, 0, sizeof(ti)); 2324e822d936SAlexander V. Chernikov ti.uidx = *tbl; 2325e822d936SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 2326e822d936SAlexander V. Chernikov error = ipfw_count_xtable(ch, &ti, tbl); 2327e822d936SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2328e822d936SAlexander V. Chernikov return (error); 2329e822d936SAlexander V. Chernikov } 2330e822d936SAlexander V. Chernikov 2331e822d936SAlexander V. Chernikov /* 233281d3153dSAlexander V. Chernikov * Legacy IP_FW_TABLE_GETSIZE handler 233381d3153dSAlexander V. Chernikov */ 23343b3a8eb9SGleb Smirnoff int 2335b074b7bbSAlexander V. Chernikov ipfw_count_table(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt) 23363b3a8eb9SGleb Smirnoff { 2337b074b7bbSAlexander V. Chernikov struct table_config *tc; 23383b3a8eb9SGleb Smirnoff 2339b074b7bbSAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) 2340b074b7bbSAlexander V. Chernikov return (ESRCH); 2341d3b00c08SAlexander V. Chernikov *cnt = table_get_count(ch, tc); 23423b3a8eb9SGleb Smirnoff return (0); 23433b3a8eb9SGleb Smirnoff } 23443b3a8eb9SGleb Smirnoff 234581d3153dSAlexander V. Chernikov /* 234681d3153dSAlexander V. Chernikov * Legacy IP_FW_TABLE_XGETSIZE handler 234781d3153dSAlexander V. Chernikov */ 23489f7d47b0SAlexander V. Chernikov int 23499f7d47b0SAlexander V. Chernikov ipfw_count_xtable(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt) 23503b3a8eb9SGleb Smirnoff { 23519f7d47b0SAlexander V. Chernikov struct table_config *tc; 2352d3b00c08SAlexander V. Chernikov uint32_t count; 23539f7d47b0SAlexander V. Chernikov 2354d3a4f924SAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) { 2355d3a4f924SAlexander V. Chernikov *cnt = 0; 23569f7d47b0SAlexander V. Chernikov return (0); /* 'table all list' requires success */ 2357d3a4f924SAlexander V. Chernikov } 2358d3b00c08SAlexander V. Chernikov 2359d3b00c08SAlexander V. Chernikov count = table_get_count(ch, tc); 2360d3b00c08SAlexander V. Chernikov *cnt = count * sizeof(ipfw_table_xentry); 2361d3b00c08SAlexander V. Chernikov if (count > 0) 23629f7d47b0SAlexander V. Chernikov *cnt += sizeof(ipfw_xtable); 23639f7d47b0SAlexander V. Chernikov return (0); 23649f7d47b0SAlexander V. Chernikov } 23659f7d47b0SAlexander V. Chernikov 23669f7d47b0SAlexander V. Chernikov static int 23679f7d47b0SAlexander V. Chernikov dump_table_entry(void *e, void *arg) 23689f7d47b0SAlexander V. Chernikov { 23699f7d47b0SAlexander V. Chernikov struct dump_args *da; 23709f7d47b0SAlexander V. Chernikov struct table_config *tc; 23719f7d47b0SAlexander V. Chernikov struct table_algo *ta; 23723b3a8eb9SGleb Smirnoff ipfw_table_entry *ent; 23730cba2b28SAlexander V. Chernikov struct table_value *pval; 237481d3153dSAlexander V. Chernikov int error; 23753b3a8eb9SGleb Smirnoff 23769f7d47b0SAlexander V. Chernikov da = (struct dump_args *)arg; 23779f7d47b0SAlexander V. Chernikov 23789f7d47b0SAlexander V. Chernikov tc = da->tc; 23799f7d47b0SAlexander V. Chernikov ta = tc->ta; 23809f7d47b0SAlexander V. Chernikov 23819f7d47b0SAlexander V. Chernikov /* Out of memory, returning */ 2382f1220db8SAlexander V. Chernikov if (da->cnt == da->size) 23833b3a8eb9SGleb Smirnoff return (1); 2384f1220db8SAlexander V. Chernikov ent = da->ent++; 2385f1220db8SAlexander V. Chernikov ent->tbl = da->uidx; 2386f1220db8SAlexander V. Chernikov da->cnt++; 23879f7d47b0SAlexander V. Chernikov 238881d3153dSAlexander V. Chernikov error = ta->dump_tentry(tc->astate, da->ti, e, &da->tent); 238981d3153dSAlexander V. Chernikov if (error != 0) 239081d3153dSAlexander V. Chernikov return (error); 239181d3153dSAlexander V. Chernikov 239281d3153dSAlexander V. Chernikov ent->addr = da->tent.k.addr.s_addr; 239381d3153dSAlexander V. Chernikov ent->masklen = da->tent.masklen; 23940cba2b28SAlexander V. Chernikov pval = get_table_value(da->ch, da->tc, da->tent.v.kidx); 23950cba2b28SAlexander V. Chernikov ent->value = ipfw_export_table_value_legacy(pval); 239681d3153dSAlexander V. Chernikov 239781d3153dSAlexander V. Chernikov return (0); 23983b3a8eb9SGleb Smirnoff } 23993b3a8eb9SGleb Smirnoff 2400f1220db8SAlexander V. Chernikov /* 2401f1220db8SAlexander V. Chernikov * Dumps table in pre-8.1 legacy format. 2402f1220db8SAlexander V. Chernikov */ 24033b3a8eb9SGleb Smirnoff int 2404f1220db8SAlexander V. Chernikov ipfw_dump_table_legacy(struct ip_fw_chain *ch, struct tid_info *ti, 2405f1220db8SAlexander V. Chernikov ipfw_table *tbl) 24063b3a8eb9SGleb Smirnoff { 2407b074b7bbSAlexander V. Chernikov struct table_config *tc; 24089f7d47b0SAlexander V. Chernikov struct table_algo *ta; 24099f7d47b0SAlexander V. Chernikov struct dump_args da; 24103b3a8eb9SGleb Smirnoff 24113b3a8eb9SGleb Smirnoff tbl->cnt = 0; 24123b3a8eb9SGleb Smirnoff 2413b074b7bbSAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) 2414b074b7bbSAlexander V. Chernikov return (0); /* XXX: We should return ESRCH */ 24159f7d47b0SAlexander V. Chernikov 24169f7d47b0SAlexander V. Chernikov ta = tc->ta; 24179f7d47b0SAlexander V. Chernikov 241881d3153dSAlexander V. Chernikov /* This dump format supports IPv4 only */ 241974b22066SAlexander V. Chernikov if (tc->no.subtype != IPFW_TABLE_ADDR) 242081d3153dSAlexander V. Chernikov return (0); 24219f7d47b0SAlexander V. Chernikov 2422d3a4f924SAlexander V. Chernikov memset(&da, 0, sizeof(da)); 24230cba2b28SAlexander V. Chernikov da.ch = ch; 24249f7d47b0SAlexander V. Chernikov da.ti = KIDX_TO_TI(ch, tc->no.kidx); 24259f7d47b0SAlexander V. Chernikov da.tc = tc; 2426f1220db8SAlexander V. Chernikov da.ent = &tbl->ent[0]; 2427f1220db8SAlexander V. Chernikov da.size = tbl->size; 24289f7d47b0SAlexander V. Chernikov 24299f7d47b0SAlexander V. Chernikov tbl->cnt = 0; 24309f7d47b0SAlexander V. Chernikov ta->foreach(tc->astate, da.ti, dump_table_entry, &da); 2431f1220db8SAlexander V. Chernikov tbl->cnt = da.cnt; 24329f7d47b0SAlexander V. Chernikov 24333b3a8eb9SGleb Smirnoff return (0); 24343b3a8eb9SGleb Smirnoff } 24353b3a8eb9SGleb Smirnoff 24369490a627SAlexander V. Chernikov /* 243781d3153dSAlexander V. Chernikov * Dumps table entry in eXtended format (v1)(current). 243881d3153dSAlexander V. Chernikov */ 243981d3153dSAlexander V. Chernikov static int 244081d3153dSAlexander V. Chernikov dump_table_tentry(void *e, void *arg) 244181d3153dSAlexander V. Chernikov { 244281d3153dSAlexander V. Chernikov struct dump_args *da; 244381d3153dSAlexander V. Chernikov struct table_config *tc; 244481d3153dSAlexander V. Chernikov struct table_algo *ta; 24450cba2b28SAlexander V. Chernikov struct table_value *pval; 244681d3153dSAlexander V. Chernikov ipfw_obj_tentry *tent; 24470cba2b28SAlexander V. Chernikov int error; 244881d3153dSAlexander V. Chernikov 244981d3153dSAlexander V. Chernikov da = (struct dump_args *)arg; 245081d3153dSAlexander V. Chernikov 245181d3153dSAlexander V. Chernikov tc = da->tc; 245281d3153dSAlexander V. Chernikov ta = tc->ta; 245381d3153dSAlexander V. Chernikov 245481d3153dSAlexander V. Chernikov tent = (ipfw_obj_tentry *)ipfw_get_sopt_space(da->sd, sizeof(*tent)); 245581d3153dSAlexander V. Chernikov /* Out of memory, returning */ 245681d3153dSAlexander V. Chernikov if (tent == NULL) { 245781d3153dSAlexander V. Chernikov da->error = ENOMEM; 245881d3153dSAlexander V. Chernikov return (1); 245981d3153dSAlexander V. Chernikov } 246081d3153dSAlexander V. Chernikov tent->head.length = sizeof(ipfw_obj_tentry); 246181d3153dSAlexander V. Chernikov tent->idx = da->uidx; 246281d3153dSAlexander V. Chernikov 24630cba2b28SAlexander V. Chernikov error = ta->dump_tentry(tc->astate, da->ti, e, tent); 24640cba2b28SAlexander V. Chernikov if (error != 0) 24650cba2b28SAlexander V. Chernikov return (error); 24660cba2b28SAlexander V. Chernikov 24670cba2b28SAlexander V. Chernikov pval = get_table_value(da->ch, da->tc, tent->v.kidx); 24680cba2b28SAlexander V. Chernikov ipfw_export_table_value_v1(pval, &tent->v.value); 24690cba2b28SAlexander V. Chernikov 24700cba2b28SAlexander V. Chernikov return (0); 247181d3153dSAlexander V. Chernikov } 247281d3153dSAlexander V. Chernikov 247381d3153dSAlexander V. Chernikov /* 247481d3153dSAlexander V. Chernikov * Dumps table entry in eXtended format (v0). 24759490a627SAlexander V. Chernikov */ 24763b3a8eb9SGleb Smirnoff static int 24779f7d47b0SAlexander V. Chernikov dump_table_xentry(void *e, void *arg) 24783b3a8eb9SGleb Smirnoff { 24799f7d47b0SAlexander V. Chernikov struct dump_args *da; 24809f7d47b0SAlexander V. Chernikov struct table_config *tc; 24819f7d47b0SAlexander V. Chernikov struct table_algo *ta; 24823b3a8eb9SGleb Smirnoff ipfw_table_xentry *xent; 248381d3153dSAlexander V. Chernikov ipfw_obj_tentry *tent; 24840cba2b28SAlexander V. Chernikov struct table_value *pval; 248581d3153dSAlexander V. Chernikov int error; 24863b3a8eb9SGleb Smirnoff 24879f7d47b0SAlexander V. Chernikov da = (struct dump_args *)arg; 24889f7d47b0SAlexander V. Chernikov 24899f7d47b0SAlexander V. Chernikov tc = da->tc; 24909f7d47b0SAlexander V. Chernikov ta = tc->ta; 24919f7d47b0SAlexander V. Chernikov 24922d99a349SAlexander V. Chernikov xent = (ipfw_table_xentry *)ipfw_get_sopt_space(da->sd, sizeof(*xent)); 24933b3a8eb9SGleb Smirnoff /* Out of memory, returning */ 24942d99a349SAlexander V. Chernikov if (xent == NULL) 24953b3a8eb9SGleb Smirnoff return (1); 24963b3a8eb9SGleb Smirnoff xent->len = sizeof(ipfw_table_xentry); 2497f1220db8SAlexander V. Chernikov xent->tbl = da->uidx; 24989f7d47b0SAlexander V. Chernikov 249981d3153dSAlexander V. Chernikov memset(&da->tent, 0, sizeof(da->tent)); 250081d3153dSAlexander V. Chernikov tent = &da->tent; 250181d3153dSAlexander V. Chernikov error = ta->dump_tentry(tc->astate, da->ti, e, tent); 250281d3153dSAlexander V. Chernikov if (error != 0) 250381d3153dSAlexander V. Chernikov return (error); 250481d3153dSAlexander V. Chernikov 250581d3153dSAlexander V. Chernikov /* Convert current format to previous one */ 250681d3153dSAlexander V. Chernikov xent->masklen = tent->masklen; 25070cba2b28SAlexander V. Chernikov pval = get_table_value(da->ch, da->tc, da->tent.v.kidx); 25080cba2b28SAlexander V. Chernikov xent->value = ipfw_export_table_value_legacy(pval); 250981d3153dSAlexander V. Chernikov /* Apply some hacks */ 251074b22066SAlexander V. Chernikov if (tc->no.subtype == IPFW_TABLE_ADDR && tent->subtype == AF_INET) { 251181d3153dSAlexander V. Chernikov xent->k.addr6.s6_addr32[3] = tent->k.addr.s_addr; 251281d3153dSAlexander V. Chernikov xent->flags = IPFW_TCF_INET; 251381d3153dSAlexander V. Chernikov } else 251481d3153dSAlexander V. Chernikov memcpy(&xent->k, &tent->k, sizeof(xent->k)); 251581d3153dSAlexander V. Chernikov 251681d3153dSAlexander V. Chernikov return (0); 25179f7d47b0SAlexander V. Chernikov } 25189f7d47b0SAlexander V. Chernikov 25199f7d47b0SAlexander V. Chernikov /* 25204dff4ae0SAlexander V. Chernikov * Helper function to export table algo data 25214dff4ae0SAlexander V. Chernikov * to tentry format before calling user function. 25224dff4ae0SAlexander V. Chernikov * 25234dff4ae0SAlexander V. Chernikov * Returns 0 on success. 25244dff4ae0SAlexander V. Chernikov */ 25254dff4ae0SAlexander V. Chernikov static int 25264dff4ae0SAlexander V. Chernikov prepare_table_tentry(void *e, void *arg) 25274dff4ae0SAlexander V. Chernikov { 25284dff4ae0SAlexander V. Chernikov struct dump_args *da; 25294dff4ae0SAlexander V. Chernikov struct table_config *tc; 25304dff4ae0SAlexander V. Chernikov struct table_algo *ta; 25314dff4ae0SAlexander V. Chernikov int error; 25324dff4ae0SAlexander V. Chernikov 25334dff4ae0SAlexander V. Chernikov da = (struct dump_args *)arg; 25344dff4ae0SAlexander V. Chernikov 25354dff4ae0SAlexander V. Chernikov tc = da->tc; 25364dff4ae0SAlexander V. Chernikov ta = tc->ta; 25374dff4ae0SAlexander V. Chernikov 25384dff4ae0SAlexander V. Chernikov error = ta->dump_tentry(tc->astate, da->ti, e, &da->tent); 25394dff4ae0SAlexander V. Chernikov if (error != 0) 25404dff4ae0SAlexander V. Chernikov return (error); 25414dff4ae0SAlexander V. Chernikov 25424dff4ae0SAlexander V. Chernikov da->f(&da->tent, da->farg); 25434dff4ae0SAlexander V. Chernikov 25444dff4ae0SAlexander V. Chernikov return (0); 25454dff4ae0SAlexander V. Chernikov } 25464dff4ae0SAlexander V. Chernikov 25474dff4ae0SAlexander V. Chernikov /* 25484dff4ae0SAlexander V. Chernikov * Allow external consumers to read table entries in standard format. 25494dff4ae0SAlexander V. Chernikov */ 25504dff4ae0SAlexander V. Chernikov int 25514dff4ae0SAlexander V. Chernikov ipfw_foreach_table_tentry(struct ip_fw_chain *ch, uint16_t kidx, 25524dff4ae0SAlexander V. Chernikov ta_foreach_f *f, void *arg) 25534dff4ae0SAlexander V. Chernikov { 25544dff4ae0SAlexander V. Chernikov struct namedobj_instance *ni; 25554dff4ae0SAlexander V. Chernikov struct table_config *tc; 25564dff4ae0SAlexander V. Chernikov struct table_algo *ta; 25574dff4ae0SAlexander V. Chernikov struct dump_args da; 25584dff4ae0SAlexander V. Chernikov 25594dff4ae0SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 25604dff4ae0SAlexander V. Chernikov 25614dff4ae0SAlexander V. Chernikov tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, kidx); 25624dff4ae0SAlexander V. Chernikov if (tc == NULL) 25634dff4ae0SAlexander V. Chernikov return (ESRCH); 25644dff4ae0SAlexander V. Chernikov 25654dff4ae0SAlexander V. Chernikov ta = tc->ta; 25664dff4ae0SAlexander V. Chernikov 25674dff4ae0SAlexander V. Chernikov memset(&da, 0, sizeof(da)); 25680cba2b28SAlexander V. Chernikov da.ch = ch; 25694dff4ae0SAlexander V. Chernikov da.ti = KIDX_TO_TI(ch, tc->no.kidx); 25704dff4ae0SAlexander V. Chernikov da.tc = tc; 25714dff4ae0SAlexander V. Chernikov da.f = f; 25724dff4ae0SAlexander V. Chernikov da.farg = arg; 25734dff4ae0SAlexander V. Chernikov 25744dff4ae0SAlexander V. Chernikov ta->foreach(tc->astate, da.ti, prepare_table_tentry, &da); 25754dff4ae0SAlexander V. Chernikov 25764dff4ae0SAlexander V. Chernikov return (0); 25774dff4ae0SAlexander V. Chernikov } 25784dff4ae0SAlexander V. Chernikov 25794dff4ae0SAlexander V. Chernikov /* 25809f7d47b0SAlexander V. Chernikov * Table algorithms 25819f7d47b0SAlexander V. Chernikov */ 25823b3a8eb9SGleb Smirnoff 25839f7d47b0SAlexander V. Chernikov /* 258435e1bbd0SAlexander V. Chernikov * Finds algoritm by index, table type or supplied name. 258535e1bbd0SAlexander V. Chernikov * 258635e1bbd0SAlexander V. Chernikov * Returns pointer to algo or NULL. 25879f7d47b0SAlexander V. Chernikov */ 25889f7d47b0SAlexander V. Chernikov static struct table_algo * 25899490a627SAlexander V. Chernikov find_table_algo(struct tables_config *tcfg, struct tid_info *ti, char *name) 25909f7d47b0SAlexander V. Chernikov { 25919490a627SAlexander V. Chernikov int i, l; 25929490a627SAlexander V. Chernikov struct table_algo *ta; 25939f7d47b0SAlexander V. Chernikov 259457a1cf95SAlexander V. Chernikov if (ti->type > IPFW_TABLE_MAXTYPE) 259557a1cf95SAlexander V. Chernikov return (NULL); 259657a1cf95SAlexander V. Chernikov 25979f7d47b0SAlexander V. Chernikov /* Search by index */ 25989f7d47b0SAlexander V. Chernikov if (ti->atype != 0) { 25999f7d47b0SAlexander V. Chernikov if (ti->atype > tcfg->algo_count) 26009f7d47b0SAlexander V. Chernikov return (NULL); 26019f7d47b0SAlexander V. Chernikov return (tcfg->algo[ti->atype]); 26029f7d47b0SAlexander V. Chernikov } 26039f7d47b0SAlexander V. Chernikov 2604fd0869d5SAlexander V. Chernikov if (name == NULL) { 2605fd0869d5SAlexander V. Chernikov /* Return default algorithm for given type if set */ 2606fd0869d5SAlexander V. Chernikov return (tcfg->def_algo[ti->type]); 2607fd0869d5SAlexander V. Chernikov } 2608fd0869d5SAlexander V. Chernikov 2609fd0869d5SAlexander V. Chernikov /* Search by name */ 26109490a627SAlexander V. Chernikov /* TODO: better search */ 26119490a627SAlexander V. Chernikov for (i = 1; i <= tcfg->algo_count; i++) { 26129490a627SAlexander V. Chernikov ta = tcfg->algo[i]; 26139490a627SAlexander V. Chernikov 26149490a627SAlexander V. Chernikov /* 26159490a627SAlexander V. Chernikov * One can supply additional algorithm 26169490a627SAlexander V. Chernikov * parameters so we compare only the first word 26179490a627SAlexander V. Chernikov * of supplied name: 2618c21034b7SAlexander V. Chernikov * 'addr:chash hsize=32' 26199490a627SAlexander V. Chernikov * '^^^^^^^^^' 26209490a627SAlexander V. Chernikov * 26219490a627SAlexander V. Chernikov */ 26229490a627SAlexander V. Chernikov l = strlen(ta->name); 2623fd0869d5SAlexander V. Chernikov if (strncmp(name, ta->name, l) != 0) 2624fd0869d5SAlexander V. Chernikov continue; 2625fd0869d5SAlexander V. Chernikov if (name[l] != '\0' && name[l] != ' ') 2626fd0869d5SAlexander V. Chernikov continue; 2627fd0869d5SAlexander V. Chernikov /* Check if we're requesting proper table type */ 2628fd0869d5SAlexander V. Chernikov if (ti->type != 0 && ti->type != ta->type) 2629fd0869d5SAlexander V. Chernikov return (NULL); 26309490a627SAlexander V. Chernikov return (ta); 26319490a627SAlexander V. Chernikov } 26329490a627SAlexander V. Chernikov 26339490a627SAlexander V. Chernikov return (NULL); 26349490a627SAlexander V. Chernikov } 26359490a627SAlexander V. Chernikov 2636b6ee846eSAlexander V. Chernikov /* 2637b6ee846eSAlexander V. Chernikov * Register new table algo @ta. 263835e1bbd0SAlexander V. Chernikov * Stores algo id inside @idx. 2639b6ee846eSAlexander V. Chernikov * 2640b6ee846eSAlexander V. Chernikov * Returns 0 on success. 2641b6ee846eSAlexander V. Chernikov */ 26420b565ac0SAlexander V. Chernikov int 26430b565ac0SAlexander V. Chernikov ipfw_add_table_algo(struct ip_fw_chain *ch, struct table_algo *ta, size_t size, 26440b565ac0SAlexander V. Chernikov int *idx) 26453b3a8eb9SGleb Smirnoff { 26469f7d47b0SAlexander V. Chernikov struct tables_config *tcfg; 26470b565ac0SAlexander V. Chernikov struct table_algo *ta_new; 2648b6ee846eSAlexander V. Chernikov size_t sz; 26490b565ac0SAlexander V. Chernikov 26500b565ac0SAlexander V. Chernikov if (size > sizeof(struct table_algo)) 26510b565ac0SAlexander V. Chernikov return (EINVAL); 26520b565ac0SAlexander V. Chernikov 2653b6ee846eSAlexander V. Chernikov /* Check for the required on-stack size for add/del */ 2654b6ee846eSAlexander V. Chernikov sz = roundup2(ta->ta_buf_size, sizeof(void *)); 2655b6ee846eSAlexander V. Chernikov if (sz > TA_BUF_SZ) 2656b6ee846eSAlexander V. Chernikov return (EINVAL); 2657b6ee846eSAlexander V. Chernikov 2658fddbbf75SAlexander V. Chernikov KASSERT(ta->type <= IPFW_TABLE_MAXTYPE,("Increase IPFW_TABLE_MAXTYPE")); 265957a1cf95SAlexander V. Chernikov 266035e1bbd0SAlexander V. Chernikov /* Copy algorithm data to stable storage. */ 26610b565ac0SAlexander V. Chernikov ta_new = malloc(sizeof(struct table_algo), M_IPFW, M_WAITOK | M_ZERO); 26620b565ac0SAlexander V. Chernikov memcpy(ta_new, ta, size); 26633b3a8eb9SGleb Smirnoff 26649f7d47b0SAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 2665b074b7bbSAlexander V. Chernikov 26669f7d47b0SAlexander V. Chernikov KASSERT(tcfg->algo_count < 255, ("Increase algo array size")); 26679f7d47b0SAlexander V. Chernikov 26680b565ac0SAlexander V. Chernikov tcfg->algo[++tcfg->algo_count] = ta_new; 26690b565ac0SAlexander V. Chernikov ta_new->idx = tcfg->algo_count; 26700b565ac0SAlexander V. Chernikov 267157a1cf95SAlexander V. Chernikov /* Set algorithm as default one for given type */ 267257a1cf95SAlexander V. Chernikov if ((ta_new->flags & TA_FLAG_DEFAULT) != 0 && 267357a1cf95SAlexander V. Chernikov tcfg->def_algo[ta_new->type] == NULL) 267457a1cf95SAlexander V. Chernikov tcfg->def_algo[ta_new->type] = ta_new; 267557a1cf95SAlexander V. Chernikov 26760b565ac0SAlexander V. Chernikov *idx = ta_new->idx; 26770b565ac0SAlexander V. Chernikov 26780b565ac0SAlexander V. Chernikov return (0); 26790b565ac0SAlexander V. Chernikov } 26800b565ac0SAlexander V. Chernikov 2681b6ee846eSAlexander V. Chernikov /* 2682b6ee846eSAlexander V. Chernikov * Unregisters table algo using @idx as id. 2683c8d5d308SAlexander V. Chernikov * XXX: It is NOT safe to call this function in any place 2684c8d5d308SAlexander V. Chernikov * other than ipfw instance destroy handler. 2685b6ee846eSAlexander V. Chernikov */ 26860b565ac0SAlexander V. Chernikov void 26870b565ac0SAlexander V. Chernikov ipfw_del_table_algo(struct ip_fw_chain *ch, int idx) 26880b565ac0SAlexander V. Chernikov { 26890b565ac0SAlexander V. Chernikov struct tables_config *tcfg; 26900b565ac0SAlexander V. Chernikov struct table_algo *ta; 26910b565ac0SAlexander V. Chernikov 26920b565ac0SAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 26930b565ac0SAlexander V. Chernikov 2694b6ee846eSAlexander V. Chernikov KASSERT(idx <= tcfg->algo_count, ("algo idx %d out of range 1..%d", 2695b6ee846eSAlexander V. Chernikov idx, tcfg->algo_count)); 26960b565ac0SAlexander V. Chernikov 26970b565ac0SAlexander V. Chernikov ta = tcfg->algo[idx]; 26980b565ac0SAlexander V. Chernikov KASSERT(ta != NULL, ("algo idx %d is NULL", idx)); 269957a1cf95SAlexander V. Chernikov 270057a1cf95SAlexander V. Chernikov if (tcfg->def_algo[ta->type] == ta) 270157a1cf95SAlexander V. Chernikov tcfg->def_algo[ta->type] = NULL; 270257a1cf95SAlexander V. Chernikov 27030b565ac0SAlexander V. Chernikov free(ta, M_IPFW); 27043b3a8eb9SGleb Smirnoff } 27053b3a8eb9SGleb Smirnoff 27069d099b4fSAlexander V. Chernikov /* 27079d099b4fSAlexander V. Chernikov * Lists all table algorithms currently available. 27089d099b4fSAlexander V. Chernikov * Data layout (v0)(current): 27099d099b4fSAlexander V. Chernikov * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size 27109d099b4fSAlexander V. Chernikov * Reply: [ ipfw_obj_lheader ipfw_ta_info x N ] 27119d099b4fSAlexander V. Chernikov * 27129d099b4fSAlexander V. Chernikov * Returns 0 on success 27139d099b4fSAlexander V. Chernikov */ 27146b988f3aSAlexander V. Chernikov static int 27156b988f3aSAlexander V. Chernikov list_table_algo(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 2716e822d936SAlexander V. Chernikov struct sockopt_data *sd) 27179d099b4fSAlexander V. Chernikov { 27189d099b4fSAlexander V. Chernikov struct _ipfw_obj_lheader *olh; 27199d099b4fSAlexander V. Chernikov struct tables_config *tcfg; 27209d099b4fSAlexander V. Chernikov ipfw_ta_info *i; 27219d099b4fSAlexander V. Chernikov struct table_algo *ta; 27229d099b4fSAlexander V. Chernikov uint32_t count, n, size; 27239d099b4fSAlexander V. Chernikov 27249d099b4fSAlexander V. Chernikov olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh)); 27259d099b4fSAlexander V. Chernikov if (olh == NULL) 27269d099b4fSAlexander V. Chernikov return (EINVAL); 27279d099b4fSAlexander V. Chernikov if (sd->valsize < olh->size) 27289d099b4fSAlexander V. Chernikov return (EINVAL); 27299d099b4fSAlexander V. Chernikov 27309d099b4fSAlexander V. Chernikov IPFW_UH_RLOCK(ch); 27319d099b4fSAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 27329d099b4fSAlexander V. Chernikov count = tcfg->algo_count; 27339d099b4fSAlexander V. Chernikov size = count * sizeof(ipfw_ta_info) + sizeof(ipfw_obj_lheader); 27349d099b4fSAlexander V. Chernikov 27359d099b4fSAlexander V. Chernikov /* Fill in header regadless of buffer size */ 27369d099b4fSAlexander V. Chernikov olh->count = count; 27379d099b4fSAlexander V. Chernikov olh->objsize = sizeof(ipfw_ta_info); 27389d099b4fSAlexander V. Chernikov 27399d099b4fSAlexander V. Chernikov if (size > olh->size) { 27409d099b4fSAlexander V. Chernikov olh->size = size; 27419d099b4fSAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 27429d099b4fSAlexander V. Chernikov return (ENOMEM); 27439d099b4fSAlexander V. Chernikov } 27449d099b4fSAlexander V. Chernikov olh->size = size; 27459d099b4fSAlexander V. Chernikov 27469d099b4fSAlexander V. Chernikov for (n = 1; n <= count; n++) { 27479d099b4fSAlexander V. Chernikov i = (ipfw_ta_info *)ipfw_get_sopt_space(sd, sizeof(*i)); 27489d099b4fSAlexander V. Chernikov KASSERT(i != 0, ("previously checked buffer is not enough")); 27499d099b4fSAlexander V. Chernikov ta = tcfg->algo[n]; 27509d099b4fSAlexander V. Chernikov strlcpy(i->algoname, ta->name, sizeof(i->algoname)); 27519d099b4fSAlexander V. Chernikov i->type = ta->type; 27529d099b4fSAlexander V. Chernikov i->refcnt = ta->refcnt; 27539d099b4fSAlexander V. Chernikov } 27549d099b4fSAlexander V. Chernikov 27559d099b4fSAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 27569d099b4fSAlexander V. Chernikov 27579d099b4fSAlexander V. Chernikov return (0); 27589d099b4fSAlexander V. Chernikov } 27599d099b4fSAlexander V. Chernikov 2760b074b7bbSAlexander V. Chernikov static int 276174b22066SAlexander V. Chernikov classify_srcdst(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 2762b074b7bbSAlexander V. Chernikov { 2763b074b7bbSAlexander V. Chernikov /* Basic IPv4/IPv6 or u32 lookups */ 2764b074b7bbSAlexander V. Chernikov *puidx = cmd->arg1; 2765c21034b7SAlexander V. Chernikov /* Assume ADDR by default */ 2766c21034b7SAlexander V. Chernikov *ptype = IPFW_TABLE_ADDR; 276774b22066SAlexander V. Chernikov int v; 2768b074b7bbSAlexander V. Chernikov 2769b074b7bbSAlexander V. Chernikov if (F_LEN(cmd) > F_INSN_SIZE(ipfw_insn_u32)) { 2770b074b7bbSAlexander V. Chernikov /* 2771b074b7bbSAlexander V. Chernikov * generic lookup. The key must be 2772b074b7bbSAlexander V. Chernikov * in 32bit big-endian format. 2773b074b7bbSAlexander V. Chernikov */ 2774b074b7bbSAlexander V. Chernikov v = ((ipfw_insn_u32 *)cmd)->d[1]; 2775b074b7bbSAlexander V. Chernikov switch (v) { 2776b074b7bbSAlexander V. Chernikov case 0: 2777b074b7bbSAlexander V. Chernikov case 1: 2778b074b7bbSAlexander V. Chernikov /* IPv4 src/dst */ 2779b074b7bbSAlexander V. Chernikov break; 2780b074b7bbSAlexander V. Chernikov case 2: 2781b074b7bbSAlexander V. Chernikov case 3: 2782b074b7bbSAlexander V. Chernikov /* src/dst port */ 2783b23d5de9SAlexander V. Chernikov *ptype = IPFW_TABLE_NUMBER; 2784b074b7bbSAlexander V. Chernikov break; 2785b074b7bbSAlexander V. Chernikov case 4: 2786b074b7bbSAlexander V. Chernikov /* uid/gid */ 2787b23d5de9SAlexander V. Chernikov *ptype = IPFW_TABLE_NUMBER; 2788b23d5de9SAlexander V. Chernikov break; 2789b074b7bbSAlexander V. Chernikov case 5: 2790b074b7bbSAlexander V. Chernikov /* jid */ 2791b23d5de9SAlexander V. Chernikov *ptype = IPFW_TABLE_NUMBER; 2792b23d5de9SAlexander V. Chernikov break; 2793b074b7bbSAlexander V. Chernikov case 6: 2794b074b7bbSAlexander V. Chernikov /* dscp */ 2795b23d5de9SAlexander V. Chernikov *ptype = IPFW_TABLE_NUMBER; 2796b074b7bbSAlexander V. Chernikov break; 2797b074b7bbSAlexander V. Chernikov } 2798b074b7bbSAlexander V. Chernikov } 2799b074b7bbSAlexander V. Chernikov 280074b22066SAlexander V. Chernikov return (0); 2801b074b7bbSAlexander V. Chernikov } 2802b074b7bbSAlexander V. Chernikov 280374b22066SAlexander V. Chernikov static int 280474b22066SAlexander V. Chernikov classify_via(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 2805b074b7bbSAlexander V. Chernikov { 2806b074b7bbSAlexander V. Chernikov ipfw_insn_if *cmdif; 2807b074b7bbSAlexander V. Chernikov 2808b074b7bbSAlexander V. Chernikov /* Interface table, possibly */ 2809b074b7bbSAlexander V. Chernikov cmdif = (ipfw_insn_if *)cmd; 281074b22066SAlexander V. Chernikov if (cmdif->name[0] != '\1') 281174b22066SAlexander V. Chernikov return (1); 281274b22066SAlexander V. Chernikov 281374b22066SAlexander V. Chernikov *ptype = IPFW_TABLE_INTERFACE; 281474b22066SAlexander V. Chernikov *puidx = cmdif->p.kidx; 281574b22066SAlexander V. Chernikov 281674b22066SAlexander V. Chernikov return (0); 281774b22066SAlexander V. Chernikov } 281874b22066SAlexander V. Chernikov 281974b22066SAlexander V. Chernikov static int 282074b22066SAlexander V. Chernikov classify_flow(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 282174b22066SAlexander V. Chernikov { 282274b22066SAlexander V. Chernikov 282374b22066SAlexander V. Chernikov *puidx = cmd->arg1; 282474b22066SAlexander V. Chernikov *ptype = IPFW_TABLE_FLOW; 282574b22066SAlexander V. Chernikov 282674b22066SAlexander V. Chernikov return (0); 282774b22066SAlexander V. Chernikov } 282874b22066SAlexander V. Chernikov 282974b22066SAlexander V. Chernikov static void 283074b22066SAlexander V. Chernikov update_arg1(ipfw_insn *cmd, uint16_t idx) 283174b22066SAlexander V. Chernikov { 283274b22066SAlexander V. Chernikov 2833914bffb6SAlexander V. Chernikov cmd->arg1 = idx; 2834b074b7bbSAlexander V. Chernikov } 283574b22066SAlexander V. Chernikov 283674b22066SAlexander V. Chernikov static void 283774b22066SAlexander V. Chernikov update_via(ipfw_insn *cmd, uint16_t idx) 283874b22066SAlexander V. Chernikov { 283974b22066SAlexander V. Chernikov ipfw_insn_if *cmdif; 284074b22066SAlexander V. Chernikov 284174b22066SAlexander V. Chernikov cmdif = (ipfw_insn_if *)cmd; 284274b22066SAlexander V. Chernikov cmdif->p.kidx = idx; 2843b074b7bbSAlexander V. Chernikov } 2844b074b7bbSAlexander V. Chernikov 284574b22066SAlexander V. Chernikov static int 284674b22066SAlexander V. Chernikov table_findbyname(struct ip_fw_chain *ch, struct tid_info *ti, 284774b22066SAlexander V. Chernikov struct named_object **pno) 284874b22066SAlexander V. Chernikov { 284974b22066SAlexander V. Chernikov struct table_config *tc; 285074b22066SAlexander V. Chernikov int error; 285174b22066SAlexander V. Chernikov 285274b22066SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 285374b22066SAlexander V. Chernikov 285474b22066SAlexander V. Chernikov error = find_table_err(CHAIN_TO_NI(ch), ti, &tc); 285574b22066SAlexander V. Chernikov if (error != 0) 285674b22066SAlexander V. Chernikov return (error); 285774b22066SAlexander V. Chernikov 285874b22066SAlexander V. Chernikov *pno = &tc->no; 285974b22066SAlexander V. Chernikov return (0); 286074b22066SAlexander V. Chernikov } 286174b22066SAlexander V. Chernikov 286274b22066SAlexander V. Chernikov /* XXX: sets-sets! */ 286374b22066SAlexander V. Chernikov static struct named_object * 286474b22066SAlexander V. Chernikov table_findbykidx(struct ip_fw_chain *ch, uint16_t idx) 286574b22066SAlexander V. Chernikov { 286674b22066SAlexander V. Chernikov struct namedobj_instance *ni; 286774b22066SAlexander V. Chernikov struct table_config *tc; 286874b22066SAlexander V. Chernikov 286974b22066SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 287074b22066SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 287174b22066SAlexander V. Chernikov tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, idx); 287274b22066SAlexander V. Chernikov KASSERT(tc != NULL, ("Table with index %d not found", idx)); 287374b22066SAlexander V. Chernikov 287474b22066SAlexander V. Chernikov return (&tc->no); 287574b22066SAlexander V. Chernikov } 287674b22066SAlexander V. Chernikov 287774b22066SAlexander V. Chernikov static struct opcode_obj_rewrite opcodes[] = { 287874b22066SAlexander V. Chernikov { 287974b22066SAlexander V. Chernikov O_IP_SRC_LOOKUP, IPFW_TLV_TBL_NAME, 288074b22066SAlexander V. Chernikov classify_srcdst, update_arg1, 288174b22066SAlexander V. Chernikov table_findbyname, table_findbykidx, create_table_compat 288274b22066SAlexander V. Chernikov }, 288374b22066SAlexander V. Chernikov { 288474b22066SAlexander V. Chernikov O_IP_DST_LOOKUP, IPFW_TLV_TBL_NAME, 288574b22066SAlexander V. Chernikov classify_srcdst, update_arg1, 288674b22066SAlexander V. Chernikov table_findbyname, table_findbykidx, create_table_compat 288774b22066SAlexander V. Chernikov }, 288874b22066SAlexander V. Chernikov { 288974b22066SAlexander V. Chernikov O_IP_FLOW_LOOKUP, IPFW_TLV_TBL_NAME, 289074b22066SAlexander V. Chernikov classify_flow, update_arg1, 289174b22066SAlexander V. Chernikov table_findbyname, table_findbykidx, create_table_compat 289274b22066SAlexander V. Chernikov }, 289374b22066SAlexander V. Chernikov { 289474b22066SAlexander V. Chernikov O_XMIT, IPFW_TLV_TBL_NAME, 289574b22066SAlexander V. Chernikov classify_via, update_via, 289674b22066SAlexander V. Chernikov table_findbyname, table_findbykidx, create_table_compat 289774b22066SAlexander V. Chernikov }, 289874b22066SAlexander V. Chernikov { 289974b22066SAlexander V. Chernikov O_RECV, IPFW_TLV_TBL_NAME, 290074b22066SAlexander V. Chernikov classify_via, update_via, 290174b22066SAlexander V. Chernikov table_findbyname, table_findbykidx, create_table_compat 290274b22066SAlexander V. Chernikov }, 290374b22066SAlexander V. Chernikov { 290474b22066SAlexander V. Chernikov O_VIA, IPFW_TLV_TBL_NAME, 290574b22066SAlexander V. Chernikov classify_via, update_via, 290674b22066SAlexander V. Chernikov table_findbyname, table_findbykidx, create_table_compat 290774b22066SAlexander V. Chernikov }, 290874b22066SAlexander V. Chernikov }; 290974b22066SAlexander V. Chernikov 291074b22066SAlexander V. Chernikov 2911ac35ff17SAlexander V. Chernikov /* 2912ac35ff17SAlexander V. Chernikov * Checks table name for validity. 2913ac35ff17SAlexander V. Chernikov * Enforce basic length checks, the rest 2914ac35ff17SAlexander V. Chernikov * should be done in userland. 2915ac35ff17SAlexander V. Chernikov * 2916ac35ff17SAlexander V. Chernikov * Returns 0 if name is considered valid. 2917ac35ff17SAlexander V. Chernikov */ 2918ac35ff17SAlexander V. Chernikov int 2919ac35ff17SAlexander V. Chernikov ipfw_check_table_name(char *name) 2920ac35ff17SAlexander V. Chernikov { 2921ac35ff17SAlexander V. Chernikov int nsize; 2922ac35ff17SAlexander V. Chernikov ipfw_obj_ntlv *ntlv = NULL; 2923ac35ff17SAlexander V. Chernikov 2924ac35ff17SAlexander V. Chernikov nsize = sizeof(ntlv->name); 2925ac35ff17SAlexander V. Chernikov 2926ac35ff17SAlexander V. Chernikov if (strnlen(name, nsize) == nsize) 2927ac35ff17SAlexander V. Chernikov return (EINVAL); 2928ac35ff17SAlexander V. Chernikov 2929ac35ff17SAlexander V. Chernikov if (name[0] == '\0') 2930ac35ff17SAlexander V. Chernikov return (EINVAL); 2931ac35ff17SAlexander V. Chernikov 2932ac35ff17SAlexander V. Chernikov /* 2933ac35ff17SAlexander V. Chernikov * TODO: do some more complicated checks 2934ac35ff17SAlexander V. Chernikov */ 2935ac35ff17SAlexander V. Chernikov 2936ac35ff17SAlexander V. Chernikov return (0); 2937ac35ff17SAlexander V. Chernikov } 2938ac35ff17SAlexander V. Chernikov 2939ac35ff17SAlexander V. Chernikov /* 2940ac35ff17SAlexander V. Chernikov * Find tablename TLV by @uid. 2941ac35ff17SAlexander V. Chernikov * Check @tlvs for valid data inside. 2942ac35ff17SAlexander V. Chernikov * 2943ac35ff17SAlexander V. Chernikov * Returns pointer to found TLV or NULL. 2944ac35ff17SAlexander V. Chernikov */ 2945ac35ff17SAlexander V. Chernikov static ipfw_obj_ntlv * 2946b074b7bbSAlexander V. Chernikov find_name_tlv(void *tlvs, int len, uint16_t uidx) 2947b074b7bbSAlexander V. Chernikov { 29489f7d47b0SAlexander V. Chernikov ipfw_obj_ntlv *ntlv; 2949b074b7bbSAlexander V. Chernikov uintptr_t pa, pe; 2950b074b7bbSAlexander V. Chernikov int l; 2951b074b7bbSAlexander V. Chernikov 2952b074b7bbSAlexander V. Chernikov pa = (uintptr_t)tlvs; 2953b074b7bbSAlexander V. Chernikov pe = pa + len; 2954b074b7bbSAlexander V. Chernikov l = 0; 2955b074b7bbSAlexander V. Chernikov for (; pa < pe; pa += l) { 29569f7d47b0SAlexander V. Chernikov ntlv = (ipfw_obj_ntlv *)pa; 2957b074b7bbSAlexander V. Chernikov l = ntlv->head.length; 2958ac35ff17SAlexander V. Chernikov 2959ac35ff17SAlexander V. Chernikov if (l != sizeof(*ntlv)) 2960ac35ff17SAlexander V. Chernikov return (NULL); 2961ac35ff17SAlexander V. Chernikov 2962563b5ab1SAlexander V. Chernikov if (ntlv->head.type != IPFW_TLV_TBL_NAME) 2963b074b7bbSAlexander V. Chernikov continue; 2964ac35ff17SAlexander V. Chernikov 2965b074b7bbSAlexander V. Chernikov if (ntlv->idx != uidx) 2966b074b7bbSAlexander V. Chernikov continue; 2967b074b7bbSAlexander V. Chernikov 2968ac35ff17SAlexander V. Chernikov if (ipfw_check_table_name(ntlv->name) != 0) 2969ac35ff17SAlexander V. Chernikov return (NULL); 2970ac35ff17SAlexander V. Chernikov 2971ac35ff17SAlexander V. Chernikov return (ntlv); 2972b074b7bbSAlexander V. Chernikov } 2973b074b7bbSAlexander V. Chernikov 2974b074b7bbSAlexander V. Chernikov return (NULL); 2975b074b7bbSAlexander V. Chernikov } 2976b074b7bbSAlexander V. Chernikov 2977ac35ff17SAlexander V. Chernikov /* 2978ac35ff17SAlexander V. Chernikov * Finds table config based on either legacy index 2979ac35ff17SAlexander V. Chernikov * or name in ntlv. 2980ac35ff17SAlexander V. Chernikov * Note @ti structure contains unchecked data from userland. 2981ac35ff17SAlexander V. Chernikov * 298274b22066SAlexander V. Chernikov * Returns 0 in success and fills in @tc with found config 2983ac35ff17SAlexander V. Chernikov */ 298474b22066SAlexander V. Chernikov static int 298574b22066SAlexander V. Chernikov find_table_err(struct namedobj_instance *ni, struct tid_info *ti, 298674b22066SAlexander V. Chernikov struct table_config **tc) 2987b074b7bbSAlexander V. Chernikov { 2988b074b7bbSAlexander V. Chernikov char *name, bname[16]; 2989b074b7bbSAlexander V. Chernikov struct named_object *no; 2990ac35ff17SAlexander V. Chernikov ipfw_obj_ntlv *ntlv; 2991ac35ff17SAlexander V. Chernikov uint32_t set; 2992b074b7bbSAlexander V. Chernikov 2993b074b7bbSAlexander V. Chernikov if (ti->tlvs != NULL) { 2994ac35ff17SAlexander V. Chernikov ntlv = find_name_tlv(ti->tlvs, ti->tlen, ti->uidx); 2995ac35ff17SAlexander V. Chernikov if (ntlv == NULL) 299674b22066SAlexander V. Chernikov return (EINVAL); 2997ac35ff17SAlexander V. Chernikov name = ntlv->name; 299840e5f498SAlexander V. Chernikov 299940e5f498SAlexander V. Chernikov /* 300040e5f498SAlexander V. Chernikov * Use set provided by @ti instead of @ntlv one. 300140e5f498SAlexander V. Chernikov * This is needed due to different sets behavior 300240e5f498SAlexander V. Chernikov * controlled by V_fw_tables_sets. 300340e5f498SAlexander V. Chernikov */ 300440e5f498SAlexander V. Chernikov set = ti->set; 3005b074b7bbSAlexander V. Chernikov } else { 3006b074b7bbSAlexander V. Chernikov snprintf(bname, sizeof(bname), "%d", ti->uidx); 3007b074b7bbSAlexander V. Chernikov name = bname; 3008ac35ff17SAlexander V. Chernikov set = 0; 3009b074b7bbSAlexander V. Chernikov } 3010b074b7bbSAlexander V. Chernikov 3011ac35ff17SAlexander V. Chernikov no = ipfw_objhash_lookup_name(ni, set, name); 301274b22066SAlexander V. Chernikov *tc = (struct table_config *)no; 3013b074b7bbSAlexander V. Chernikov 301474b22066SAlexander V. Chernikov return (0); 301574b22066SAlexander V. Chernikov } 301674b22066SAlexander V. Chernikov 301774b22066SAlexander V. Chernikov /* 301874b22066SAlexander V. Chernikov * Finds table config based on either legacy index 301974b22066SAlexander V. Chernikov * or name in ntlv. 302074b22066SAlexander V. Chernikov * Note @ti structure contains unchecked data from userland. 302174b22066SAlexander V. Chernikov * 302274b22066SAlexander V. Chernikov * Returns pointer to table_config or NULL. 302374b22066SAlexander V. Chernikov */ 302474b22066SAlexander V. Chernikov static struct table_config * 302574b22066SAlexander V. Chernikov find_table(struct namedobj_instance *ni, struct tid_info *ti) 302674b22066SAlexander V. Chernikov { 302774b22066SAlexander V. Chernikov struct table_config *tc; 302874b22066SAlexander V. Chernikov 302974b22066SAlexander V. Chernikov if (find_table_err(ni, ti, &tc) != 0) 303074b22066SAlexander V. Chernikov return (NULL); 303174b22066SAlexander V. Chernikov 303274b22066SAlexander V. Chernikov return (tc); 3033b074b7bbSAlexander V. Chernikov } 3034b074b7bbSAlexander V. Chernikov 303535e1bbd0SAlexander V. Chernikov /* 303635e1bbd0SAlexander V. Chernikov * Allocate new table config structure using 303735e1bbd0SAlexander V. Chernikov * specified @algo and @aname. 303835e1bbd0SAlexander V. Chernikov * 303935e1bbd0SAlexander V. Chernikov * Returns pointer to config or NULL. 304035e1bbd0SAlexander V. Chernikov */ 3041b074b7bbSAlexander V. Chernikov static struct table_config * 304268394ec8SAlexander V. Chernikov alloc_table_config(struct ip_fw_chain *ch, struct tid_info *ti, 30430cba2b28SAlexander V. Chernikov struct table_algo *ta, char *aname, uint8_t tflags) 3044b074b7bbSAlexander V. Chernikov { 3045b074b7bbSAlexander V. Chernikov char *name, bname[16]; 3046b074b7bbSAlexander V. Chernikov struct table_config *tc; 3047b074b7bbSAlexander V. Chernikov int error; 3048ac35ff17SAlexander V. Chernikov ipfw_obj_ntlv *ntlv; 3049ac35ff17SAlexander V. Chernikov uint32_t set; 3050b074b7bbSAlexander V. Chernikov 3051b074b7bbSAlexander V. Chernikov if (ti->tlvs != NULL) { 3052ac35ff17SAlexander V. Chernikov ntlv = find_name_tlv(ti->tlvs, ti->tlen, ti->uidx); 3053ac35ff17SAlexander V. Chernikov if (ntlv == NULL) 3054b074b7bbSAlexander V. Chernikov return (NULL); 3055ac35ff17SAlexander V. Chernikov name = ntlv->name; 3056ac35ff17SAlexander V. Chernikov set = ntlv->set; 3057b074b7bbSAlexander V. Chernikov } else { 305874b22066SAlexander V. Chernikov /* Compat part: convert number to string representation */ 3059b074b7bbSAlexander V. Chernikov snprintf(bname, sizeof(bname), "%d", ti->uidx); 3060b074b7bbSAlexander V. Chernikov name = bname; 3061ac35ff17SAlexander V. Chernikov set = 0; 3062b074b7bbSAlexander V. Chernikov } 3063b074b7bbSAlexander V. Chernikov 3064b074b7bbSAlexander V. Chernikov tc = malloc(sizeof(struct table_config), M_IPFW, M_WAITOK | M_ZERO); 3065b074b7bbSAlexander V. Chernikov tc->no.name = tc->tablename; 306674b22066SAlexander V. Chernikov tc->no.subtype = ta->type; 3067ac35ff17SAlexander V. Chernikov tc->no.set = set; 3068914bffb6SAlexander V. Chernikov tc->tflags = tflags; 30699f7d47b0SAlexander V. Chernikov tc->ta = ta; 3070b074b7bbSAlexander V. Chernikov strlcpy(tc->tablename, name, sizeof(tc->tablename)); 30710cba2b28SAlexander V. Chernikov /* Set "shared" value type by default */ 30720cba2b28SAlexander V. Chernikov tc->vshared = 1; 3073b074b7bbSAlexander V. Chernikov 3074b074b7bbSAlexander V. Chernikov /* Preallocate data structures for new tables */ 30754c060d85SAlexander V. Chernikov error = ta->init(ch, &tc->astate, &tc->ti_copy, aname, tflags); 3076b074b7bbSAlexander V. Chernikov if (error != 0) { 3077b074b7bbSAlexander V. Chernikov free(tc, M_IPFW); 3078b074b7bbSAlexander V. Chernikov return (NULL); 3079b074b7bbSAlexander V. Chernikov } 3080b074b7bbSAlexander V. Chernikov 3081b074b7bbSAlexander V. Chernikov return (tc); 3082b074b7bbSAlexander V. Chernikov } 3083b074b7bbSAlexander V. Chernikov 308435e1bbd0SAlexander V. Chernikov /* 308535e1bbd0SAlexander V. Chernikov * Destroys table state and config. 308635e1bbd0SAlexander V. Chernikov */ 3087b074b7bbSAlexander V. Chernikov static void 3088b074b7bbSAlexander V. Chernikov free_table_config(struct namedobj_instance *ni, struct table_config *tc) 3089b074b7bbSAlexander V. Chernikov { 3090b074b7bbSAlexander V. Chernikov 309135e1bbd0SAlexander V. Chernikov KASSERT(tc->linked == 0, ("free() on linked config")); 30920caab009SAlexander V. Chernikov /* UH lock MUST NOT be held */ 3093b074b7bbSAlexander V. Chernikov 30940468c5baSAlexander V. Chernikov /* 30950468c5baSAlexander V. Chernikov * We're using ta without any locking/referencing. 30960468c5baSAlexander V. Chernikov * TODO: fix this if we're going to use unloadable algos. 30970468c5baSAlexander V. Chernikov */ 30984c060d85SAlexander V. Chernikov tc->ta->destroy(tc->astate, &tc->ti_copy); 3099b074b7bbSAlexander V. Chernikov free(tc, M_IPFW); 3100b074b7bbSAlexander V. Chernikov } 3101b074b7bbSAlexander V. Chernikov 3102b074b7bbSAlexander V. Chernikov /* 3103b074b7bbSAlexander V. Chernikov * Links @tc to @chain table named instance. 3104b074b7bbSAlexander V. Chernikov * Sets appropriate type/states in @chain table info. 3105b074b7bbSAlexander V. Chernikov */ 3106b074b7bbSAlexander V. Chernikov static void 31079f7d47b0SAlexander V. Chernikov link_table(struct ip_fw_chain *ch, struct table_config *tc) 3108b074b7bbSAlexander V. Chernikov { 3109b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 31109f7d47b0SAlexander V. Chernikov struct table_info *ti; 3111b074b7bbSAlexander V. Chernikov uint16_t kidx; 3112b074b7bbSAlexander V. Chernikov 31139f7d47b0SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 31149f7d47b0SAlexander V. Chernikov IPFW_WLOCK_ASSERT(ch); 3115b074b7bbSAlexander V. Chernikov 31169f7d47b0SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 3117b074b7bbSAlexander V. Chernikov kidx = tc->no.kidx; 3118b074b7bbSAlexander V. Chernikov 3119b074b7bbSAlexander V. Chernikov ipfw_objhash_add(ni, &tc->no); 31209f7d47b0SAlexander V. Chernikov 31219f7d47b0SAlexander V. Chernikov ti = KIDX_TO_TI(ch, kidx); 31224c060d85SAlexander V. Chernikov *ti = tc->ti_copy; 3123b074b7bbSAlexander V. Chernikov 312468394ec8SAlexander V. Chernikov /* Notify algo on real @ti address */ 312568394ec8SAlexander V. Chernikov if (tc->ta->change_ti != NULL) 312668394ec8SAlexander V. Chernikov tc->ta->change_ti(tc->astate, ti); 312768394ec8SAlexander V. Chernikov 3128b074b7bbSAlexander V. Chernikov tc->linked = 1; 31299d099b4fSAlexander V. Chernikov tc->ta->refcnt++; 3130b074b7bbSAlexander V. Chernikov } 3131b074b7bbSAlexander V. Chernikov 3132b074b7bbSAlexander V. Chernikov /* 3133b074b7bbSAlexander V. Chernikov * Unlinks @tc from @chain table named instance. 3134b074b7bbSAlexander V. Chernikov * Zeroes states in @chain and stores them in @tc. 3135b074b7bbSAlexander V. Chernikov */ 3136b074b7bbSAlexander V. Chernikov static void 31379f7d47b0SAlexander V. Chernikov unlink_table(struct ip_fw_chain *ch, struct table_config *tc) 3138b074b7bbSAlexander V. Chernikov { 3139b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 31409f7d47b0SAlexander V. Chernikov struct table_info *ti; 3141b074b7bbSAlexander V. Chernikov uint16_t kidx; 3142b074b7bbSAlexander V. Chernikov 31439f7d47b0SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 31449f7d47b0SAlexander V. Chernikov IPFW_WLOCK_ASSERT(ch); 3145b074b7bbSAlexander V. Chernikov 31469f7d47b0SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 3147b074b7bbSAlexander V. Chernikov kidx = tc->no.kidx; 3148b074b7bbSAlexander V. Chernikov 31499f7d47b0SAlexander V. Chernikov /* Clear state. @ti copy is already saved inside @tc */ 3150b074b7bbSAlexander V. Chernikov ipfw_objhash_del(ni, &tc->no); 31519f7d47b0SAlexander V. Chernikov ti = KIDX_TO_TI(ch, kidx); 31529f7d47b0SAlexander V. Chernikov memset(ti, 0, sizeof(struct table_info)); 3153b074b7bbSAlexander V. Chernikov tc->linked = 0; 31549d099b4fSAlexander V. Chernikov tc->ta->refcnt--; 315568394ec8SAlexander V. Chernikov 315668394ec8SAlexander V. Chernikov /* Notify algo on real @ti address */ 315768394ec8SAlexander V. Chernikov if (tc->ta->change_ti != NULL) 315868394ec8SAlexander V. Chernikov tc->ta->change_ti(tc->astate, NULL); 3159b074b7bbSAlexander V. Chernikov } 3160b074b7bbSAlexander V. Chernikov 3161a73d728dSAlexander V. Chernikov struct swap_table_args { 3162a73d728dSAlexander V. Chernikov int set; 3163a73d728dSAlexander V. Chernikov int new_set; 3164a73d728dSAlexander V. Chernikov int mv; 3165a73d728dSAlexander V. Chernikov }; 3166a73d728dSAlexander V. Chernikov 3167a73d728dSAlexander V. Chernikov /* 3168a73d728dSAlexander V. Chernikov * Change set for each matching table. 3169a73d728dSAlexander V. Chernikov * 3170a73d728dSAlexander V. Chernikov * Ensure we dispatch each table once by setting/checking ochange 3171a73d728dSAlexander V. Chernikov * fields. 3172a73d728dSAlexander V. Chernikov */ 3173a73d728dSAlexander V. Chernikov static void 3174a73d728dSAlexander V. Chernikov swap_table_set(struct namedobj_instance *ni, struct named_object *no, 3175a73d728dSAlexander V. Chernikov void *arg) 3176a73d728dSAlexander V. Chernikov { 3177a73d728dSAlexander V. Chernikov struct table_config *tc; 3178a73d728dSAlexander V. Chernikov struct swap_table_args *sta; 3179a73d728dSAlexander V. Chernikov 3180a73d728dSAlexander V. Chernikov tc = (struct table_config *)no; 3181a73d728dSAlexander V. Chernikov sta = (struct swap_table_args *)arg; 3182a73d728dSAlexander V. Chernikov 3183a73d728dSAlexander V. Chernikov if (no->set != sta->set && (no->set != sta->new_set || sta->mv != 0)) 3184a73d728dSAlexander V. Chernikov return; 3185a73d728dSAlexander V. Chernikov 3186a73d728dSAlexander V. Chernikov if (tc->ochanged != 0) 3187a73d728dSAlexander V. Chernikov return; 3188a73d728dSAlexander V. Chernikov 3189a73d728dSAlexander V. Chernikov tc->ochanged = 1; 3190a73d728dSAlexander V. Chernikov ipfw_objhash_del(ni, no); 3191a73d728dSAlexander V. Chernikov if (no->set == sta->set) 3192a73d728dSAlexander V. Chernikov no->set = sta->new_set; 3193a73d728dSAlexander V. Chernikov else 3194a73d728dSAlexander V. Chernikov no->set = sta->set; 3195a73d728dSAlexander V. Chernikov ipfw_objhash_add(ni, no); 3196a73d728dSAlexander V. Chernikov } 3197a73d728dSAlexander V. Chernikov 3198a73d728dSAlexander V. Chernikov /* 3199a73d728dSAlexander V. Chernikov * Cleans up ochange field for all tables. 3200a73d728dSAlexander V. Chernikov */ 3201a73d728dSAlexander V. Chernikov static void 3202a73d728dSAlexander V. Chernikov clean_table_set_data(struct namedobj_instance *ni, struct named_object *no, 3203a73d728dSAlexander V. Chernikov void *arg) 3204a73d728dSAlexander V. Chernikov { 3205a73d728dSAlexander V. Chernikov struct table_config *tc; 3206a73d728dSAlexander V. Chernikov struct swap_table_args *sta; 3207a73d728dSAlexander V. Chernikov 3208a73d728dSAlexander V. Chernikov tc = (struct table_config *)no; 3209a73d728dSAlexander V. Chernikov sta = (struct swap_table_args *)arg; 3210a73d728dSAlexander V. Chernikov 3211a73d728dSAlexander V. Chernikov tc->ochanged = 0; 3212a73d728dSAlexander V. Chernikov } 3213a73d728dSAlexander V. Chernikov 3214a73d728dSAlexander V. Chernikov /* 3215a73d728dSAlexander V. Chernikov * Swaps tables within two sets. 3216a73d728dSAlexander V. Chernikov */ 3217a73d728dSAlexander V. Chernikov void 3218a73d728dSAlexander V. Chernikov ipfw_swap_tables_sets(struct ip_fw_chain *ch, uint32_t set, 3219a73d728dSAlexander V. Chernikov uint32_t new_set, int mv) 3220a73d728dSAlexander V. Chernikov { 3221a73d728dSAlexander V. Chernikov struct swap_table_args sta; 3222a73d728dSAlexander V. Chernikov 3223a73d728dSAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 3224a73d728dSAlexander V. Chernikov 3225a73d728dSAlexander V. Chernikov sta.set = set; 3226a73d728dSAlexander V. Chernikov sta.new_set = new_set; 3227a73d728dSAlexander V. Chernikov sta.mv = mv; 3228a73d728dSAlexander V. Chernikov 3229a73d728dSAlexander V. Chernikov ipfw_objhash_foreach(CHAIN_TO_NI(ch), swap_table_set, &sta); 3230a73d728dSAlexander V. Chernikov ipfw_objhash_foreach(CHAIN_TO_NI(ch), clean_table_set_data, &sta); 3231a73d728dSAlexander V. Chernikov } 3232a73d728dSAlexander V. Chernikov 3233a73d728dSAlexander V. Chernikov /* 3234a73d728dSAlexander V. Chernikov * Move all tables which are reference by rules in @rr to set @new_set. 3235a73d728dSAlexander V. Chernikov * Makes sure that all relevant tables are referenced ONLLY by given rules. 3236a73d728dSAlexander V. Chernikov * 3237a73d728dSAlexander V. Chernikov * Retuns 0 on success, 3238a73d728dSAlexander V. Chernikov */ 3239a73d728dSAlexander V. Chernikov int 3240a73d728dSAlexander V. Chernikov ipfw_move_tables_sets(struct ip_fw_chain *ch, ipfw_range_tlv *rt, 3241a73d728dSAlexander V. Chernikov uint32_t new_set) 3242a73d728dSAlexander V. Chernikov { 3243a73d728dSAlexander V. Chernikov struct ip_fw *rule; 3244a73d728dSAlexander V. Chernikov struct table_config *tc; 3245a73d728dSAlexander V. Chernikov struct named_object *no; 3246a73d728dSAlexander V. Chernikov struct namedobj_instance *ni; 3247a73d728dSAlexander V. Chernikov int bad, i, l, cmdlen; 3248a73d728dSAlexander V. Chernikov uint16_t kidx; 3249a73d728dSAlexander V. Chernikov ipfw_insn *cmd; 3250a73d728dSAlexander V. Chernikov 3251a73d728dSAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 3252a73d728dSAlexander V. Chernikov 3253a73d728dSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 3254a73d728dSAlexander V. Chernikov 3255a73d728dSAlexander V. Chernikov /* Stage 1: count number of references by given rules */ 3256a73d728dSAlexander V. Chernikov for (i = 0; i < ch->n_rules - 1; i++) { 3257a73d728dSAlexander V. Chernikov rule = ch->map[i]; 3258a73d728dSAlexander V. Chernikov if (ipfw_match_range(rule, rt) == 0) 3259a73d728dSAlexander V. Chernikov continue; 3260a73d728dSAlexander V. Chernikov 3261a73d728dSAlexander V. Chernikov l = rule->cmd_len; 3262a73d728dSAlexander V. Chernikov cmd = rule->cmd; 3263a73d728dSAlexander V. Chernikov cmdlen = 0; 3264a73d728dSAlexander V. Chernikov for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 3265a73d728dSAlexander V. Chernikov cmdlen = F_LEN(cmd); 326674b22066SAlexander V. Chernikov if (classify_opcode_kidx(cmd, &kidx) != 0) 3267a73d728dSAlexander V. Chernikov continue; 3268a73d728dSAlexander V. Chernikov no = ipfw_objhash_lookup_kidx(ni, kidx); 3269a73d728dSAlexander V. Chernikov KASSERT(no != NULL, 3270a73d728dSAlexander V. Chernikov ("objhash lookup failed on index %d", kidx)); 3271a73d728dSAlexander V. Chernikov tc = (struct table_config *)no; 3272a73d728dSAlexander V. Chernikov tc->ocount++; 3273a73d728dSAlexander V. Chernikov } 3274a73d728dSAlexander V. Chernikov 3275a73d728dSAlexander V. Chernikov } 3276a73d728dSAlexander V. Chernikov 3277a73d728dSAlexander V. Chernikov /* Stage 2: verify "ownership" */ 3278a73d728dSAlexander V. Chernikov bad = 0; 3279a73d728dSAlexander V. Chernikov for (i = 0; i < ch->n_rules - 1; i++) { 3280a73d728dSAlexander V. Chernikov rule = ch->map[i]; 3281a73d728dSAlexander V. Chernikov if (ipfw_match_range(rule, rt) == 0) 3282a73d728dSAlexander V. Chernikov continue; 3283a73d728dSAlexander V. Chernikov 3284a73d728dSAlexander V. Chernikov l = rule->cmd_len; 3285a73d728dSAlexander V. Chernikov cmd = rule->cmd; 3286a73d728dSAlexander V. Chernikov cmdlen = 0; 3287a73d728dSAlexander V. Chernikov for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 3288a73d728dSAlexander V. Chernikov cmdlen = F_LEN(cmd); 328974b22066SAlexander V. Chernikov if (classify_opcode_kidx(cmd, &kidx) != 0) 3290a73d728dSAlexander V. Chernikov continue; 3291a73d728dSAlexander V. Chernikov no = ipfw_objhash_lookup_kidx(ni, kidx); 3292a73d728dSAlexander V. Chernikov KASSERT(no != NULL, 3293a73d728dSAlexander V. Chernikov ("objhash lookup failed on index %d", kidx)); 3294a73d728dSAlexander V. Chernikov tc = (struct table_config *)no; 3295a73d728dSAlexander V. Chernikov if (tc->no.refcnt != tc->ocount) { 3296a73d728dSAlexander V. Chernikov 3297a73d728dSAlexander V. Chernikov /* 3298a73d728dSAlexander V. Chernikov * Number of references differ: 3299a73d728dSAlexander V. Chernikov * Other rule(s) are holding reference to given 3300a73d728dSAlexander V. Chernikov * table, so it is not possible to change its set. 3301a73d728dSAlexander V. Chernikov * 3302a73d728dSAlexander V. Chernikov * Note that refcnt may account 3303a73d728dSAlexander V. Chernikov * references to some going-to-be-added rules. 3304a73d728dSAlexander V. Chernikov * Since we don't know their numbers (and event 3305a73d728dSAlexander V. Chernikov * if they will be added) it is perfectly OK 3306a73d728dSAlexander V. Chernikov * to return error here. 3307a73d728dSAlexander V. Chernikov */ 3308a73d728dSAlexander V. Chernikov bad = 1; 3309a73d728dSAlexander V. Chernikov break; 3310a73d728dSAlexander V. Chernikov } 3311a73d728dSAlexander V. Chernikov } 3312a73d728dSAlexander V. Chernikov 3313a73d728dSAlexander V. Chernikov if (bad != 0) 3314a73d728dSAlexander V. Chernikov break; 3315a73d728dSAlexander V. Chernikov } 3316a73d728dSAlexander V. Chernikov 3317a73d728dSAlexander V. Chernikov /* Stage 3: change set or cleanup */ 3318a73d728dSAlexander V. Chernikov for (i = 0; i < ch->n_rules - 1; i++) { 3319a73d728dSAlexander V. Chernikov rule = ch->map[i]; 3320a73d728dSAlexander V. Chernikov if (ipfw_match_range(rule, rt) == 0) 3321a73d728dSAlexander V. Chernikov continue; 3322a73d728dSAlexander V. Chernikov 3323a73d728dSAlexander V. Chernikov l = rule->cmd_len; 3324a73d728dSAlexander V. Chernikov cmd = rule->cmd; 3325a73d728dSAlexander V. Chernikov cmdlen = 0; 3326a73d728dSAlexander V. Chernikov for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 3327a73d728dSAlexander V. Chernikov cmdlen = F_LEN(cmd); 332874b22066SAlexander V. Chernikov if (classify_opcode_kidx(cmd, &kidx) != 0) 3329a73d728dSAlexander V. Chernikov continue; 3330a73d728dSAlexander V. Chernikov no = ipfw_objhash_lookup_kidx(ni, kidx); 3331a73d728dSAlexander V. Chernikov KASSERT(no != NULL, 3332a73d728dSAlexander V. Chernikov ("objhash lookup failed on index %d", kidx)); 3333a73d728dSAlexander V. Chernikov tc = (struct table_config *)no; 3334a73d728dSAlexander V. Chernikov 3335a73d728dSAlexander V. Chernikov tc->ocount = 0; 3336a73d728dSAlexander V. Chernikov if (bad != 0) 3337a73d728dSAlexander V. Chernikov continue; 3338a73d728dSAlexander V. Chernikov 3339a73d728dSAlexander V. Chernikov /* Actually change set. */ 3340a73d728dSAlexander V. Chernikov ipfw_objhash_del(ni, no); 3341a73d728dSAlexander V. Chernikov no->set = new_set; 3342a73d728dSAlexander V. Chernikov ipfw_objhash_add(ni, no); 3343a73d728dSAlexander V. Chernikov } 3344a73d728dSAlexander V. Chernikov } 3345a73d728dSAlexander V. Chernikov 3346a73d728dSAlexander V. Chernikov return (bad); 3347a73d728dSAlexander V. Chernikov } 3348a73d728dSAlexander V. Chernikov 3349b074b7bbSAlexander V. Chernikov /* 335074b22066SAlexander V. Chernikov * Finds and bumps refcount for objects referenced by given @rule. 3351e5eec6ddSAlexander V. Chernikov * Auto-creates non-existing tables. 3352f99fbf96SAlexander V. Chernikov * Fills in @oib array with userland/kernel indexes. 3353f99fbf96SAlexander V. Chernikov * 3354f99fbf96SAlexander V. Chernikov * Returns 0 on success. 3355f99fbf96SAlexander V. Chernikov */ 3356f99fbf96SAlexander V. Chernikov static int 335774b22066SAlexander V. Chernikov ref_rule_objects(struct ip_fw_chain *ch, struct ip_fw *rule, 335874b22066SAlexander V. Chernikov struct rule_check_info *ci, struct obj_idx *oib, struct tid_info *ti) 3359f99fbf96SAlexander V. Chernikov { 3360f99fbf96SAlexander V. Chernikov int cmdlen, error, l, numnew; 3361f99fbf96SAlexander V. Chernikov ipfw_insn *cmd; 336274b22066SAlexander V. Chernikov struct obj_idx *pidx; 336374b22066SAlexander V. Chernikov int found, unresolved; 3364f99fbf96SAlexander V. Chernikov 336574b22066SAlexander V. Chernikov pidx = oib; 3366f99fbf96SAlexander V. Chernikov l = rule->cmd_len; 3367f99fbf96SAlexander V. Chernikov cmd = rule->cmd; 3368f99fbf96SAlexander V. Chernikov cmdlen = 0; 3369f99fbf96SAlexander V. Chernikov error = 0; 3370f99fbf96SAlexander V. Chernikov numnew = 0; 337174b22066SAlexander V. Chernikov found = 0; 337274b22066SAlexander V. Chernikov unresolved = 0; 3373f99fbf96SAlexander V. Chernikov 3374f99fbf96SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 3375f99fbf96SAlexander V. Chernikov 3376e5eec6ddSAlexander V. Chernikov /* Increase refcount on each existing referenced table. */ 3377f99fbf96SAlexander V. Chernikov for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 3378f99fbf96SAlexander V. Chernikov cmdlen = F_LEN(cmd); 3379f99fbf96SAlexander V. Chernikov 338074b22066SAlexander V. Chernikov error = ref_opcode_object(ch, cmd, ti, pidx, &found, &unresolved); 338174b22066SAlexander V. Chernikov if (error != 0) 3382f99fbf96SAlexander V. Chernikov break; 338374b22066SAlexander V. Chernikov if (found || unresolved) { 338474b22066SAlexander V. Chernikov pidx->off = rule->cmd_len - l; 3385f99fbf96SAlexander V. Chernikov pidx++; 3386f99fbf96SAlexander V. Chernikov } 3387f99fbf96SAlexander V. Chernikov /* 3388f99fbf96SAlexander V. Chernikov * Compability stuff for old clients: 338974b22066SAlexander V. Chernikov * prepare to manually create non-existing objects. 3390f99fbf96SAlexander V. Chernikov */ 339174b22066SAlexander V. Chernikov if (unresolved) 3392f99fbf96SAlexander V. Chernikov numnew++; 3393f99fbf96SAlexander V. Chernikov } 3394f99fbf96SAlexander V. Chernikov 3395f99fbf96SAlexander V. Chernikov if (error != 0) { 3396f99fbf96SAlexander V. Chernikov /* Unref everything we have already done */ 339774b22066SAlexander V. Chernikov unref_oib_objects(ch, rule->cmd, oib, pidx); 339874b22066SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 339974b22066SAlexander V. Chernikov return (error); 3400f99fbf96SAlexander V. Chernikov } 3401f99fbf96SAlexander V. Chernikov 3402f99fbf96SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 3403f99fbf96SAlexander V. Chernikov 3404caf99391SAlexander V. Chernikov found = pidx - oib; 3405caf99391SAlexander V. Chernikov KASSERT(found == ci->object_opcodes, 3406caf99391SAlexander V. Chernikov ("refcount inconsistency: found: %d total: %d", 3407caf99391SAlexander V. Chernikov found, ci->object_opcodes)); 3408e9484895SAlexander V. Chernikov 340974b22066SAlexander V. Chernikov /* Perform auto-creation for non-existing objects */ 341074b22066SAlexander V. Chernikov if (numnew != 0) 341174b22066SAlexander V. Chernikov error = create_objects_compat(ch, rule->cmd, oib, pidx, ti); 34121832a7b3SAlexander V. Chernikov 34131832a7b3SAlexander V. Chernikov return (error); 3414b074b7bbSAlexander V. Chernikov } 3415b074b7bbSAlexander V. Chernikov 3416563b5ab1SAlexander V. Chernikov /* 3417b074b7bbSAlexander V. Chernikov * Checks is opcode is referencing table of appropriate type. 3418b074b7bbSAlexander V. Chernikov * Adds reference count for found table if true. 3419b074b7bbSAlexander V. Chernikov * Rewrites user-supplied opcode values with kernel ones. 3420b074b7bbSAlexander V. Chernikov * 3421b074b7bbSAlexander V. Chernikov * Returns 0 on success and appropriate error code otherwise. 3422b074b7bbSAlexander V. Chernikov */ 3423b074b7bbSAlexander V. Chernikov int 342474b22066SAlexander V. Chernikov ipfw_rewrite_rule_uidx(struct ip_fw_chain *chain, 3425b074b7bbSAlexander V. Chernikov struct rule_check_info *ci) 3426b074b7bbSAlexander V. Chernikov { 342774b22066SAlexander V. Chernikov int error; 3428b074b7bbSAlexander V. Chernikov ipfw_insn *cmd; 3429b074b7bbSAlexander V. Chernikov uint8_t type; 34309490a627SAlexander V. Chernikov struct obj_idx *p, *pidx_first, *pidx_last; 3431b074b7bbSAlexander V. Chernikov struct tid_info ti; 3432b074b7bbSAlexander V. Chernikov 3433b074b7bbSAlexander V. Chernikov /* 3434b074b7bbSAlexander V. Chernikov * Prepare an array for storing opcode indices. 3435b074b7bbSAlexander V. Chernikov * Use stack allocation by default. 3436b074b7bbSAlexander V. Chernikov */ 343774b22066SAlexander V. Chernikov if (ci->object_opcodes <= (sizeof(ci->obuf)/sizeof(ci->obuf[0]))) { 3438b074b7bbSAlexander V. Chernikov /* Stack */ 34399490a627SAlexander V. Chernikov pidx_first = ci->obuf; 3440b074b7bbSAlexander V. Chernikov } else 344174b22066SAlexander V. Chernikov pidx_first = malloc(ci->object_opcodes * sizeof(struct obj_idx), 3442b074b7bbSAlexander V. Chernikov M_IPFW, M_WAITOK | M_ZERO); 3443b074b7bbSAlexander V. Chernikov 344474b22066SAlexander V. Chernikov pidx_last = pidx_first + ci->object_opcodes; 3445b074b7bbSAlexander V. Chernikov error = 0; 3446b074b7bbSAlexander V. Chernikov type = 0; 3447b074b7bbSAlexander V. Chernikov memset(&ti, 0, sizeof(ti)); 34481832a7b3SAlexander V. Chernikov 34491832a7b3SAlexander V. Chernikov /* 34501832a7b3SAlexander V. Chernikov * Use default set for looking up tables (old way) or 34511832a7b3SAlexander V. Chernikov * use set rule is assigned to (new way). 34521832a7b3SAlexander V. Chernikov */ 34531832a7b3SAlexander V. Chernikov ti.set = (V_fw_tables_sets != 0) ? ci->krule->set : 0; 34546c2997ffSAlexander V. Chernikov if (ci->ctlv != NULL) { 34556c2997ffSAlexander V. Chernikov ti.tlvs = (void *)(ci->ctlv + 1); 34566c2997ffSAlexander V. Chernikov ti.tlen = ci->ctlv->head.length - sizeof(ipfw_obj_ctlv); 34576c2997ffSAlexander V. Chernikov } 3458b074b7bbSAlexander V. Chernikov 345974b22066SAlexander V. Chernikov /* Reference all used tables and other objects */ 346074b22066SAlexander V. Chernikov error = ref_rule_objects(chain, ci->krule, ci, pidx_first, &ti); 34610468c5baSAlexander V. Chernikov if (error != 0) 34629f7d47b0SAlexander V. Chernikov goto free; 3463b074b7bbSAlexander V. Chernikov 3464b074b7bbSAlexander V. Chernikov /* Perform rule rewrite */ 34659490a627SAlexander V. Chernikov p = pidx_first; 346674b22066SAlexander V. Chernikov for (p = pidx_first; p < pidx_last; p++) { 346774b22066SAlexander V. Chernikov cmd = ci->krule->cmd + p->off; 346874b22066SAlexander V. Chernikov update_opcode_kidx(cmd, p->kidx); 3469b074b7bbSAlexander V. Chernikov } 3470b074b7bbSAlexander V. Chernikov 3471b074b7bbSAlexander V. Chernikov free: 34729490a627SAlexander V. Chernikov if (pidx_first != ci->obuf) 34739490a627SAlexander V. Chernikov free(pidx_first, M_IPFW); 3474b074b7bbSAlexander V. Chernikov 3475b074b7bbSAlexander V. Chernikov return (error); 3476b074b7bbSAlexander V. Chernikov } 3477b074b7bbSAlexander V. Chernikov 34786b988f3aSAlexander V. Chernikov static struct ipfw_sopt_handler scodes[] = { 34796b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XCREATE, 0, HDIR_SET, create_table }, 34806b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XDESTROY, 0, HDIR_SET, flush_table_v0 }, 34816b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XFLUSH, 0, HDIR_SET, flush_table_v0 }, 34826b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XMODIFY, 0, HDIR_BOTH, modify_table }, 34836b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XINFO, 0, HDIR_GET, describe_table }, 34846b988f3aSAlexander V. Chernikov { IP_FW_TABLES_XLIST, 0, HDIR_GET, list_tables }, 34856b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XLIST, 0, HDIR_GET, dump_table_v0 }, 34866b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XLIST, 1, HDIR_GET, dump_table_v1 }, 34876b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XADD, 0, HDIR_BOTH, manage_table_ent_v0 }, 34886b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XADD, 1, HDIR_BOTH, manage_table_ent_v1 }, 34896b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XDEL, 0, HDIR_BOTH, manage_table_ent_v0 }, 34906b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XDEL, 1, HDIR_BOTH, manage_table_ent_v1 }, 34916b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XFIND, 0, HDIR_GET, find_table_entry }, 34926b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XSWAP, 0, HDIR_SET, swap_table }, 34936b988f3aSAlexander V. Chernikov { IP_FW_TABLES_ALIST, 0, HDIR_GET, list_table_algo }, 34946b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XGETSIZE, 0, HDIR_GET, get_table_size }, 34956b988f3aSAlexander V. Chernikov }; 34966b988f3aSAlexander V. Chernikov 34976b988f3aSAlexander V. Chernikov static void 34986b988f3aSAlexander V. Chernikov destroy_table_locked(struct namedobj_instance *ni, struct named_object *no, 34996b988f3aSAlexander V. Chernikov void *arg) 35006b988f3aSAlexander V. Chernikov { 35016b988f3aSAlexander V. Chernikov 35026b988f3aSAlexander V. Chernikov unlink_table((struct ip_fw_chain *)arg, (struct table_config *)no); 35036b988f3aSAlexander V. Chernikov if (ipfw_objhash_free_idx(ni, no->kidx) != 0) 35046b988f3aSAlexander V. Chernikov printf("Error unlinking kidx %d from table %s\n", 35056b988f3aSAlexander V. Chernikov no->kidx, no->name); 35066b988f3aSAlexander V. Chernikov free_table_config(ni, (struct table_config *)no); 35076b988f3aSAlexander V. Chernikov } 35086b988f3aSAlexander V. Chernikov 35096b988f3aSAlexander V. Chernikov /* 35106b988f3aSAlexander V. Chernikov * Shuts tables module down. 35116b988f3aSAlexander V. Chernikov */ 35126b988f3aSAlexander V. Chernikov void 35136b988f3aSAlexander V. Chernikov ipfw_destroy_tables(struct ip_fw_chain *ch, int last) 35146b988f3aSAlexander V. Chernikov { 35156b988f3aSAlexander V. Chernikov 35166b988f3aSAlexander V. Chernikov IPFW_DEL_SOPT_HANDLER(last, scodes); 351774b22066SAlexander V. Chernikov IPFW_DEL_OBJ_REWRITER(last, opcodes); 35186b988f3aSAlexander V. Chernikov 35196b988f3aSAlexander V. Chernikov /* Remove all tables from working set */ 35206b988f3aSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 35216b988f3aSAlexander V. Chernikov IPFW_WLOCK(ch); 35226b988f3aSAlexander V. Chernikov ipfw_objhash_foreach(CHAIN_TO_NI(ch), destroy_table_locked, ch); 35236b988f3aSAlexander V. Chernikov IPFW_WUNLOCK(ch); 35246b988f3aSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 35256b988f3aSAlexander V. Chernikov 35266b988f3aSAlexander V. Chernikov /* Free pointers itself */ 35276b988f3aSAlexander V. Chernikov free(ch->tablestate, M_IPFW); 35286b988f3aSAlexander V. Chernikov 35296b988f3aSAlexander V. Chernikov ipfw_table_value_destroy(ch, last); 35306b988f3aSAlexander V. Chernikov ipfw_table_algo_destroy(ch); 35316b988f3aSAlexander V. Chernikov 35326b988f3aSAlexander V. Chernikov ipfw_objhash_destroy(CHAIN_TO_NI(ch)); 35336b988f3aSAlexander V. Chernikov free(CHAIN_TO_TCFG(ch), M_IPFW); 35346b988f3aSAlexander V. Chernikov } 35356b988f3aSAlexander V. Chernikov 35366b988f3aSAlexander V. Chernikov /* 35376b988f3aSAlexander V. Chernikov * Starts tables module. 35386b988f3aSAlexander V. Chernikov */ 35396b988f3aSAlexander V. Chernikov int 35406b988f3aSAlexander V. Chernikov ipfw_init_tables(struct ip_fw_chain *ch, int first) 35416b988f3aSAlexander V. Chernikov { 35426b988f3aSAlexander V. Chernikov struct tables_config *tcfg; 35436b988f3aSAlexander V. Chernikov 35446b988f3aSAlexander V. Chernikov /* Allocate pointers */ 35456b988f3aSAlexander V. Chernikov ch->tablestate = malloc(V_fw_tables_max * sizeof(struct table_info), 35466b988f3aSAlexander V. Chernikov M_IPFW, M_WAITOK | M_ZERO); 35476b988f3aSAlexander V. Chernikov 35486b988f3aSAlexander V. Chernikov tcfg = malloc(sizeof(struct tables_config), M_IPFW, M_WAITOK | M_ZERO); 35496b988f3aSAlexander V. Chernikov tcfg->namehash = ipfw_objhash_create(V_fw_tables_max); 35506b988f3aSAlexander V. Chernikov ch->tblcfg = tcfg; 35516b988f3aSAlexander V. Chernikov 35526b988f3aSAlexander V. Chernikov ipfw_table_value_init(ch, first); 35536b988f3aSAlexander V. Chernikov ipfw_table_algo_init(ch); 35546b988f3aSAlexander V. Chernikov 355574b22066SAlexander V. Chernikov IPFW_ADD_OBJ_REWRITER(first, opcodes); 35566b988f3aSAlexander V. Chernikov IPFW_ADD_SOPT_HANDLER(first, scodes); 35576b988f3aSAlexander V. Chernikov return (0); 35586b988f3aSAlexander V. Chernikov } 35596b988f3aSAlexander V. Chernikov 35606b988f3aSAlexander V. Chernikov 35616b988f3aSAlexander V. Chernikov 3562