13b3a8eb9SGleb Smirnoff /*- 23b3a8eb9SGleb Smirnoff * Copyright (c) 2004 Ruslan Ermilov and Vsevolod Lobko. 33b3a8eb9SGleb Smirnoff * 43b3a8eb9SGleb Smirnoff * Redistribution and use in source and binary forms, with or without 53b3a8eb9SGleb Smirnoff * modification, are permitted provided that the following conditions 63b3a8eb9SGleb Smirnoff * are met: 73b3a8eb9SGleb Smirnoff * 1. Redistributions of source code must retain the above copyright 83b3a8eb9SGleb Smirnoff * notice, this list of conditions and the following disclaimer. 93b3a8eb9SGleb Smirnoff * 2. Redistributions in binary form must reproduce the above copyright 103b3a8eb9SGleb Smirnoff * notice, this list of conditions and the following disclaimer in the 113b3a8eb9SGleb Smirnoff * documentation and/or other materials provided with the distribution. 123b3a8eb9SGleb Smirnoff * 133b3a8eb9SGleb Smirnoff * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 143b3a8eb9SGleb Smirnoff * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 153b3a8eb9SGleb Smirnoff * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 163b3a8eb9SGleb Smirnoff * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 173b3a8eb9SGleb Smirnoff * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 183b3a8eb9SGleb Smirnoff * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 193b3a8eb9SGleb Smirnoff * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 203b3a8eb9SGleb Smirnoff * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 213b3a8eb9SGleb Smirnoff * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 223b3a8eb9SGleb Smirnoff * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 233b3a8eb9SGleb Smirnoff * SUCH DAMAGE. 243b3a8eb9SGleb Smirnoff */ 253b3a8eb9SGleb Smirnoff 263b3a8eb9SGleb Smirnoff #include <sys/cdefs.h> 273b3a8eb9SGleb Smirnoff __FBSDID("$FreeBSD$"); 283b3a8eb9SGleb Smirnoff 293b3a8eb9SGleb Smirnoff /* 30563b5ab1SAlexander V. Chernikov * Lookup table support for ipfw. 313b3a8eb9SGleb Smirnoff * 32ac35ff17SAlexander V. Chernikov * This file contains handlers for all generic tables' operations: 33563b5ab1SAlexander V. Chernikov * add/del/flush entries, list/dump tables etc.. 343b3a8eb9SGleb Smirnoff * 35563b5ab1SAlexander V. Chernikov * Table data modification is protected by both UH and runtimg lock 36563b5ab1SAlexander V. Chernikov * while reading configuration/data is protected by UH lock. 37563b5ab1SAlexander V. Chernikov * 38563b5ab1SAlexander V. Chernikov * Lookup algorithms for all table types are located in ip_fw_table_algo.c 393b3a8eb9SGleb Smirnoff */ 403b3a8eb9SGleb Smirnoff 413b3a8eb9SGleb Smirnoff #include "opt_ipfw.h" 423b3a8eb9SGleb Smirnoff 433b3a8eb9SGleb Smirnoff #include <sys/param.h> 443b3a8eb9SGleb Smirnoff #include <sys/systm.h> 453b3a8eb9SGleb Smirnoff #include <sys/malloc.h> 463b3a8eb9SGleb Smirnoff #include <sys/kernel.h> 473b3a8eb9SGleb Smirnoff #include <sys/lock.h> 483b3a8eb9SGleb Smirnoff #include <sys/rwlock.h> 493b3a8eb9SGleb Smirnoff #include <sys/socket.h> 50f1220db8SAlexander V. Chernikov #include <sys/socketvar.h> 513b3a8eb9SGleb Smirnoff #include <sys/queue.h> 523b3a8eb9SGleb Smirnoff #include <net/if.h> /* ip_fw.h requires IFNAMSIZ */ 533b3a8eb9SGleb Smirnoff 543b3a8eb9SGleb Smirnoff #include <netinet/in.h> 553b3a8eb9SGleb Smirnoff #include <netinet/ip_var.h> /* struct ipfw_rule_ref */ 563b3a8eb9SGleb Smirnoff #include <netinet/ip_fw.h> 573b3a8eb9SGleb Smirnoff 583b3a8eb9SGleb Smirnoff #include <netpfil/ipfw/ip_fw_private.h> 59ea761a5dSAlexander V. Chernikov #include <netpfil/ipfw/ip_fw_table.h> 603b3a8eb9SGleb Smirnoff 613b3a8eb9SGleb Smirnoff /* 62b074b7bbSAlexander V. Chernikov * Table has the following `type` concepts: 63b074b7bbSAlexander V. Chernikov * 64c21034b7SAlexander V. Chernikov * `no.type` represents lookup key type (addr, ifp, uid, etc..) 650cba2b28SAlexander V. Chernikov * vmask represents bitmask of table values which are present at the moment. 660cba2b28SAlexander V. Chernikov * Special IPFW_VTYPE_LEGACY ( (uint32_t)-1 ) represents old 670cba2b28SAlexander V. Chernikov * single-value-for-all approach. 68b074b7bbSAlexander V. Chernikov */ 69b074b7bbSAlexander V. Chernikov struct table_config { 70b074b7bbSAlexander V. Chernikov struct named_object no; 71914bffb6SAlexander V. Chernikov uint8_t tflags; /* type flags */ 724f43138aSAlexander V. Chernikov uint8_t locked; /* 1 if locked from changes */ 73adf3b2b9SAlexander V. Chernikov uint8_t linked; /* 1 if already linked */ 74adf3b2b9SAlexander V. Chernikov uint8_t ochanged; /* used by set swapping */ 750cba2b28SAlexander V. Chernikov uint8_t vshared; /* 1 if using shared value array */ 760cba2b28SAlexander V. Chernikov uint8_t spare[3]; 770cba2b28SAlexander V. Chernikov uint32_t count; /* Number of records */ 780cba2b28SAlexander V. Chernikov uint32_t limit; /* Max number of records */ 790cba2b28SAlexander V. Chernikov uint32_t vmask; /* bitmask with supported values */ 80a73d728dSAlexander V. Chernikov uint32_t ocount; /* used by set swapping */ 81a73d728dSAlexander V. Chernikov uint64_t gencnt; /* generation count */ 82b074b7bbSAlexander V. Chernikov char tablename[64]; /* table name */ 839f7d47b0SAlexander V. Chernikov struct table_algo *ta; /* Callbacks for given algo */ 849f7d47b0SAlexander V. Chernikov void *astate; /* algorithm state */ 859f7d47b0SAlexander V. Chernikov struct table_info ti; /* data to put to table_info */ 860cba2b28SAlexander V. Chernikov struct namedobj_instance *vi; 87b074b7bbSAlexander V. Chernikov }; 88b074b7bbSAlexander V. Chernikov 89b074b7bbSAlexander V. Chernikov static struct table_config *find_table(struct namedobj_instance *ni, 90b074b7bbSAlexander V. Chernikov struct tid_info *ti); 9168394ec8SAlexander V. Chernikov static struct table_config *alloc_table_config(struct ip_fw_chain *ch, 920cba2b28SAlexander V. Chernikov struct tid_info *ti, struct table_algo *ta, char *adata, uint8_t tflags); 93b074b7bbSAlexander V. Chernikov static void free_table_config(struct namedobj_instance *ni, 94b074b7bbSAlexander V. Chernikov struct table_config *tc); 95db785d31SAlexander V. Chernikov static int create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti, 96867708f7SAlexander V. Chernikov char *aname, ipfw_xtable_info *i, uint16_t *pkidx, int ref); 970468c5baSAlexander V. Chernikov static void link_table(struct ip_fw_chain *ch, struct table_config *tc); 980468c5baSAlexander V. Chernikov static void unlink_table(struct ip_fw_chain *ch, struct table_config *tc); 994dff4ae0SAlexander V. Chernikov static int find_ref_table(struct ip_fw_chain *ch, struct tid_info *ti, 100867708f7SAlexander V. Chernikov struct tentry_info *tei, uint32_t count, int op, struct table_config **ptc); 1014dff4ae0SAlexander V. Chernikov #define OP_ADD 1 1024dff4ae0SAlexander V. Chernikov #define OP_DEL 0 1032d99a349SAlexander V. Chernikov static int export_tables(struct ip_fw_chain *ch, ipfw_obj_lheader *olh, 1042d99a349SAlexander V. Chernikov struct sockopt_data *sd); 105ac35ff17SAlexander V. Chernikov static void export_table_info(struct ip_fw_chain *ch, struct table_config *tc, 106ac35ff17SAlexander V. Chernikov ipfw_xtable_info *i); 10781d3153dSAlexander V. Chernikov static int dump_table_tentry(void *e, void *arg); 108f1220db8SAlexander V. Chernikov static int dump_table_xentry(void *e, void *arg); 109b074b7bbSAlexander V. Chernikov 1102d99a349SAlexander V. Chernikov static int ipfw_dump_table_v0(struct ip_fw_chain *ch, struct sockopt_data *sd); 1112d99a349SAlexander V. Chernikov static int ipfw_dump_table_v1(struct ip_fw_chain *ch, struct sockopt_data *sd); 112db785d31SAlexander V. Chernikov static int ipfw_manage_table_ent_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 113ac35ff17SAlexander V. Chernikov struct sockopt_data *sd); 114db785d31SAlexander V. Chernikov static int ipfw_manage_table_ent_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 115ac35ff17SAlexander V. Chernikov struct sockopt_data *sd); 116a73d728dSAlexander V. Chernikov static int swap_tables(struct ip_fw_chain *ch, struct tid_info *a, 11746d52008SAlexander V. Chernikov struct tid_info *b); 118ac35ff17SAlexander V. Chernikov 1190cba2b28SAlexander V. Chernikov static int check_table_space(struct ip_fw_chain *ch, struct tableop_state *ts, 1200cba2b28SAlexander V. Chernikov struct table_config *tc, struct table_info *ti, uint32_t count); 121ac35ff17SAlexander V. Chernikov static int destroy_table(struct ip_fw_chain *ch, struct tid_info *ti); 122d3a4f924SAlexander V. Chernikov 1239f7d47b0SAlexander V. Chernikov static struct table_algo *find_table_algo(struct tables_config *tableconf, 1249490a627SAlexander V. Chernikov struct tid_info *ti, char *name); 125b074b7bbSAlexander V. Chernikov 12646d52008SAlexander V. Chernikov static void objheader_to_ti(struct _ipfw_obj_header *oh, struct tid_info *ti); 12746d52008SAlexander V. Chernikov static void ntlv_to_ti(struct _ipfw_obj_ntlv *ntlv, struct tid_info *ti); 128a73d728dSAlexander V. Chernikov static int classify_table_opcode(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype); 12946d52008SAlexander V. Chernikov 130b074b7bbSAlexander V. Chernikov #define CHAIN_TO_NI(chain) (CHAIN_TO_TCFG(chain)->namehash) 1319f7d47b0SAlexander V. Chernikov #define KIDX_TO_TI(ch, k) (&(((struct table_info *)(ch)->tablestate)[k])) 132b074b7bbSAlexander V. Chernikov 133b6ee846eSAlexander V. Chernikov #define TA_BUF_SZ 128 /* On-stack buffer for add/delete state */ 134b6ee846eSAlexander V. Chernikov 1350cba2b28SAlexander V. Chernikov void 1360cba2b28SAlexander V. Chernikov rollback_toperation_state(struct ip_fw_chain *ch, void *object) 1370cba2b28SAlexander V. Chernikov { 1380cba2b28SAlexander V. Chernikov struct tables_config *tcfg; 1390cba2b28SAlexander V. Chernikov struct op_state *os; 1400cba2b28SAlexander V. Chernikov 1410cba2b28SAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 1420cba2b28SAlexander V. Chernikov TAILQ_FOREACH(os, &tcfg->state_list, next) 143fb4b37a3SAlexander V. Chernikov os->func(object, os); 1440cba2b28SAlexander V. Chernikov } 1450cba2b28SAlexander V. Chernikov 1460cba2b28SAlexander V. Chernikov void 1470cba2b28SAlexander V. Chernikov add_toperation_state(struct ip_fw_chain *ch, struct tableop_state *ts) 1480cba2b28SAlexander V. Chernikov { 1490cba2b28SAlexander V. Chernikov struct tables_config *tcfg; 1500cba2b28SAlexander V. Chernikov 1510cba2b28SAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 1520cba2b28SAlexander V. Chernikov TAILQ_INSERT_HEAD(&tcfg->state_list, &ts->opstate, next); 1530cba2b28SAlexander V. Chernikov } 1540cba2b28SAlexander V. Chernikov 1550cba2b28SAlexander V. Chernikov void 1560cba2b28SAlexander V. Chernikov del_toperation_state(struct ip_fw_chain *ch, struct tableop_state *ts) 1570cba2b28SAlexander V. Chernikov { 1580cba2b28SAlexander V. Chernikov struct tables_config *tcfg; 1590cba2b28SAlexander V. Chernikov 1600cba2b28SAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 1610cba2b28SAlexander V. Chernikov TAILQ_REMOVE(&tcfg->state_list, &ts->opstate, next); 1620cba2b28SAlexander V. Chernikov } 1630cba2b28SAlexander V. Chernikov 1640cba2b28SAlexander V. Chernikov void 1650cba2b28SAlexander V. Chernikov tc_ref(struct table_config *tc) 1660cba2b28SAlexander V. Chernikov { 1670cba2b28SAlexander V. Chernikov 1680cba2b28SAlexander V. Chernikov tc->no.refcnt++; 1690cba2b28SAlexander V. Chernikov } 1700cba2b28SAlexander V. Chernikov 1710cba2b28SAlexander V. Chernikov void 1720cba2b28SAlexander V. Chernikov tc_unref(struct table_config *tc) 1730cba2b28SAlexander V. Chernikov { 1740cba2b28SAlexander V. Chernikov 1750cba2b28SAlexander V. Chernikov tc->no.refcnt--; 1760cba2b28SAlexander V. Chernikov } 1770cba2b28SAlexander V. Chernikov 1780cba2b28SAlexander V. Chernikov static struct table_value * 1790cba2b28SAlexander V. Chernikov get_table_value(struct ip_fw_chain *ch, struct table_config *tc, uint32_t kidx) 1800cba2b28SAlexander V. Chernikov { 1810cba2b28SAlexander V. Chernikov struct table_value *pval; 1820cba2b28SAlexander V. Chernikov 1830cba2b28SAlexander V. Chernikov pval = (struct table_value *)ch->valuestate; 1840cba2b28SAlexander V. Chernikov 1850cba2b28SAlexander V. Chernikov return (&pval[kidx]); 1860cba2b28SAlexander V. Chernikov } 1870cba2b28SAlexander V. Chernikov 1880cba2b28SAlexander V. Chernikov 1893a845e10SAlexander V. Chernikov /* 1903a845e10SAlexander V. Chernikov * Checks if we're able to insert/update entry @tei into table 1913a845e10SAlexander V. Chernikov * w.r.t @tc limits. 1923a845e10SAlexander V. Chernikov * May alter @tei to indicate insertion error / insert 1933a845e10SAlexander V. Chernikov * options. 1943a845e10SAlexander V. Chernikov * 1953a845e10SAlexander V. Chernikov * Returns 0 if operation can be performed/ 1963a845e10SAlexander V. Chernikov */ 1973a845e10SAlexander V. Chernikov static int 1983a845e10SAlexander V. Chernikov check_table_limit(struct table_config *tc, struct tentry_info *tei) 1993a845e10SAlexander V. Chernikov { 200b074b7bbSAlexander V. Chernikov 2013a845e10SAlexander V. Chernikov if (tc->limit == 0 || tc->count < tc->limit) 2023a845e10SAlexander V. Chernikov return (0); 2033a845e10SAlexander V. Chernikov 2043a845e10SAlexander V. Chernikov if ((tei->flags & TEI_FLAGS_UPDATE) == 0) { 2053a845e10SAlexander V. Chernikov /* Notify userland on error cause */ 2063a845e10SAlexander V. Chernikov tei->flags |= TEI_FLAGS_LIMIT; 2073a845e10SAlexander V. Chernikov return (EFBIG); 2083a845e10SAlexander V. Chernikov } 2093a845e10SAlexander V. Chernikov 2103a845e10SAlexander V. Chernikov /* 2113a845e10SAlexander V. Chernikov * We have UPDATE flag set. 2123a845e10SAlexander V. Chernikov * Permit updating record (if found), 2133a845e10SAlexander V. Chernikov * but restrict adding new one since we've 2143a845e10SAlexander V. Chernikov * already hit the limit. 2153a845e10SAlexander V. Chernikov */ 2163a845e10SAlexander V. Chernikov tei->flags |= TEI_FLAGS_DONTADD; 2173a845e10SAlexander V. Chernikov 2183a845e10SAlexander V. Chernikov return (0); 2193a845e10SAlexander V. Chernikov } 2203a845e10SAlexander V. Chernikov 2213a845e10SAlexander V. Chernikov /* 2221bc0d457SAlexander V. Chernikov * Convert algorithm callback return code into 2231bc0d457SAlexander V. Chernikov * one of pre-defined states known by userland. 2243a845e10SAlexander V. Chernikov */ 2251bc0d457SAlexander V. Chernikov static void 226867708f7SAlexander V. Chernikov store_tei_result(struct tentry_info *tei, int op, int error, uint32_t num) 2273b3a8eb9SGleb Smirnoff { 2281bc0d457SAlexander V. Chernikov int flag; 2293b3a8eb9SGleb Smirnoff 2301bc0d457SAlexander V. Chernikov flag = 0; 2311bc0d457SAlexander V. Chernikov 2321bc0d457SAlexander V. Chernikov switch (error) { 2331bc0d457SAlexander V. Chernikov case 0: 234867708f7SAlexander V. Chernikov if (op == OP_ADD && num != 0) 2351bc0d457SAlexander V. Chernikov flag = TEI_FLAGS_ADDED; 236867708f7SAlexander V. Chernikov if (op == OP_DEL) 2371bc0d457SAlexander V. Chernikov flag = TEI_FLAGS_DELETED; 2381bc0d457SAlexander V. Chernikov break; 2391bc0d457SAlexander V. Chernikov case ENOENT: 2401bc0d457SAlexander V. Chernikov flag = TEI_FLAGS_NOTFOUND; 2411bc0d457SAlexander V. Chernikov break; 2421bc0d457SAlexander V. Chernikov case EEXIST: 2431bc0d457SAlexander V. Chernikov flag = TEI_FLAGS_EXISTS; 2441bc0d457SAlexander V. Chernikov break; 2451bc0d457SAlexander V. Chernikov default: 2461bc0d457SAlexander V. Chernikov flag = TEI_FLAGS_ERROR; 2471bc0d457SAlexander V. Chernikov } 2481bc0d457SAlexander V. Chernikov 2491bc0d457SAlexander V. Chernikov tei->flags |= flag; 2501bc0d457SAlexander V. Chernikov } 2519f7d47b0SAlexander V. Chernikov 252f99fbf96SAlexander V. Chernikov /* 253f99fbf96SAlexander V. Chernikov * Creates and references table with default parameters. 254f99fbf96SAlexander V. Chernikov * Saves table config, algo and allocated kidx info @ptc, @pta and 255f99fbf96SAlexander V. Chernikov * @pkidx if non-zero. 256f99fbf96SAlexander V. Chernikov * Used for table auto-creation to support old binaries. 257f99fbf96SAlexander V. Chernikov * 258f99fbf96SAlexander V. Chernikov * Returns 0 on success. 259f99fbf96SAlexander V. Chernikov */ 2600468c5baSAlexander V. Chernikov static int 2610468c5baSAlexander V. Chernikov create_table_compat(struct ip_fw_chain *ch, struct tid_info *ti, 262867708f7SAlexander V. Chernikov uint16_t *pkidx) 2630468c5baSAlexander V. Chernikov { 2640468c5baSAlexander V. Chernikov ipfw_xtable_info xi; 2650468c5baSAlexander V. Chernikov int error; 2660468c5baSAlexander V. Chernikov 2670468c5baSAlexander V. Chernikov memset(&xi, 0, sizeof(xi)); 2680cba2b28SAlexander V. Chernikov /* Set default value mask for legacy clients */ 2690cba2b28SAlexander V. Chernikov xi.vmask = IPFW_VTYPE_LEGACY; 2700468c5baSAlexander V. Chernikov 271867708f7SAlexander V. Chernikov error = create_table_internal(ch, ti, NULL, &xi, pkidx, 1); 2720468c5baSAlexander V. Chernikov if (error != 0) 2730468c5baSAlexander V. Chernikov return (error); 2740468c5baSAlexander V. Chernikov 2750468c5baSAlexander V. Chernikov return (0); 2760468c5baSAlexander V. Chernikov } 2770468c5baSAlexander V. Chernikov 2789f7d47b0SAlexander V. Chernikov /* 2791bc0d457SAlexander V. Chernikov * Find and reference existing table optionally 2801bc0d457SAlexander V. Chernikov * creating new one. 2811bc0d457SAlexander V. Chernikov * 282867708f7SAlexander V. Chernikov * Saves found table config into @ptc. 283867708f7SAlexander V. Chernikov * Note function may drop/acquire UH_WLOCK. 2841bc0d457SAlexander V. Chernikov * Returns 0 if table was found/created and referenced 2851bc0d457SAlexander V. Chernikov * or non-zero return code. 2869f7d47b0SAlexander V. Chernikov */ 2871bc0d457SAlexander V. Chernikov static int 2881bc0d457SAlexander V. Chernikov find_ref_table(struct ip_fw_chain *ch, struct tid_info *ti, 2894dff4ae0SAlexander V. Chernikov struct tentry_info *tei, uint32_t count, int op, 290867708f7SAlexander V. Chernikov struct table_config **ptc) 2911bc0d457SAlexander V. Chernikov { 2921bc0d457SAlexander V. Chernikov struct namedobj_instance *ni; 2931bc0d457SAlexander V. Chernikov struct table_config *tc; 294867708f7SAlexander V. Chernikov uint16_t kidx; 2951bc0d457SAlexander V. Chernikov int error; 2961bc0d457SAlexander V. Chernikov 297867708f7SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 2981bc0d457SAlexander V. Chernikov 2991bc0d457SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 3001bc0d457SAlexander V. Chernikov tc = NULL; 3019f7d47b0SAlexander V. Chernikov if ((tc = find_table(ni, ti)) != NULL) { 3029f7d47b0SAlexander V. Chernikov /* check table type */ 303867708f7SAlexander V. Chernikov if (tc->no.type != ti->type) 3043b3a8eb9SGleb Smirnoff return (EINVAL); 3053b3a8eb9SGleb Smirnoff 306867708f7SAlexander V. Chernikov if (tc->locked != 0) 3074f43138aSAlexander V. Chernikov return (EACCES); 3084f43138aSAlexander V. Chernikov 3094c0c07a5SAlexander V. Chernikov /* Try to exit early on limit hit */ 3104dff4ae0SAlexander V. Chernikov if (op == OP_ADD && count == 1 && 311867708f7SAlexander V. Chernikov check_table_limit(tc, tei) != 0) 3124c0c07a5SAlexander V. Chernikov return (EFBIG); 3134c0c07a5SAlexander V. Chernikov 314867708f7SAlexander V. Chernikov /* Reference and return */ 3159f7d47b0SAlexander V. Chernikov tc->no.refcnt++; 316867708f7SAlexander V. Chernikov *ptc = tc; 317867708f7SAlexander V. Chernikov return (0); 3189f7d47b0SAlexander V. Chernikov } 3193b3a8eb9SGleb Smirnoff 3204dff4ae0SAlexander V. Chernikov if (op == OP_DEL) 3211bc0d457SAlexander V. Chernikov return (ESRCH); 3221bc0d457SAlexander V. Chernikov 323db785d31SAlexander V. Chernikov /* Compability mode: create new table for old clients */ 324db785d31SAlexander V. Chernikov if ((tei->flags & TEI_FLAGS_COMPAT) == 0) 325db785d31SAlexander V. Chernikov return (ESRCH); 3263b3a8eb9SGleb Smirnoff 327867708f7SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 328867708f7SAlexander V. Chernikov error = create_table_compat(ch, ti, &kidx); 329867708f7SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 330867708f7SAlexander V. Chernikov 331db785d31SAlexander V. Chernikov if (error != 0) 332db785d31SAlexander V. Chernikov return (error); 333db785d31SAlexander V. Chernikov 334867708f7SAlexander V. Chernikov tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, kidx); 335867708f7SAlexander V. Chernikov KASSERT(tc != NULL, ("create_table_compat returned bad idx %d", kidx)); 336db785d31SAlexander V. Chernikov 337867708f7SAlexander V. Chernikov /* OK, now we've got referenced table. */ 3381bc0d457SAlexander V. Chernikov *ptc = tc; 3391bc0d457SAlexander V. Chernikov return (0); 3401bc0d457SAlexander V. Chernikov } 3411bc0d457SAlexander V. Chernikov 3421bc0d457SAlexander V. Chernikov /* 343867708f7SAlexander V. Chernikov * Rolls back already @added to @tc entries using state array @ta_buf_m. 3441bc0d457SAlexander V. Chernikov * Assume the following layout: 3451bc0d457SAlexander V. Chernikov * 1) ADD state (ta_buf_m[0] ... t_buf_m[added - 1]) for handling update cases 3461bc0d457SAlexander V. Chernikov * 2) DEL state (ta_buf_m[count[ ... t_buf_m[count + added - 1]) 3471bc0d457SAlexander V. Chernikov * for storing deleted state 3481bc0d457SAlexander V. Chernikov */ 3491bc0d457SAlexander V. Chernikov static void 3501bc0d457SAlexander V. Chernikov rollback_added_entries(struct ip_fw_chain *ch, struct table_config *tc, 3511bc0d457SAlexander V. Chernikov struct table_info *tinfo, struct tentry_info *tei, caddr_t ta_buf_m, 3521bc0d457SAlexander V. Chernikov uint32_t count, uint32_t added) 3531bc0d457SAlexander V. Chernikov { 3541bc0d457SAlexander V. Chernikov struct table_algo *ta; 3551bc0d457SAlexander V. Chernikov struct tentry_info *ptei; 3561bc0d457SAlexander V. Chernikov caddr_t v, vv; 3571bc0d457SAlexander V. Chernikov size_t ta_buf_sz; 3581bc0d457SAlexander V. Chernikov int error, i; 3591bc0d457SAlexander V. Chernikov uint32_t num; 3601bc0d457SAlexander V. Chernikov 3611bc0d457SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 3621bc0d457SAlexander V. Chernikov 3631bc0d457SAlexander V. Chernikov ta = tc->ta; 3643a845e10SAlexander V. Chernikov ta_buf_sz = ta->ta_buf_size; 3651bc0d457SAlexander V. Chernikov v = ta_buf_m; 3661bc0d457SAlexander V. Chernikov vv = v + count * ta_buf_sz; 3671bc0d457SAlexander V. Chernikov for (i = 0; i < added; i++, v += ta_buf_sz, vv += ta_buf_sz) { 3681bc0d457SAlexander V. Chernikov ptei = &tei[i]; 3691bc0d457SAlexander V. Chernikov if ((ptei->flags & TEI_FLAGS_UPDATED) != 0) { 3701bc0d457SAlexander V. Chernikov 3711bc0d457SAlexander V. Chernikov /* 3721bc0d457SAlexander V. Chernikov * We have old value stored by previous 3731bc0d457SAlexander V. Chernikov * call in @ptei->value. Do add once again 3741bc0d457SAlexander V. Chernikov * to restore it. 3751bc0d457SAlexander V. Chernikov */ 3761bc0d457SAlexander V. Chernikov error = ta->add(tc->astate, tinfo, ptei, v, &num); 3771bc0d457SAlexander V. Chernikov KASSERT(error == 0, ("rollback UPDATE fail")); 3781bc0d457SAlexander V. Chernikov KASSERT(num == 0, ("rollback UPDATE fail2")); 3791bc0d457SAlexander V. Chernikov continue; 3801bc0d457SAlexander V. Chernikov } 3811bc0d457SAlexander V. Chernikov 3821bc0d457SAlexander V. Chernikov error = ta->prepare_del(ch, ptei, vv); 3831bc0d457SAlexander V. Chernikov KASSERT(error == 0, ("pre-rollback INSERT failed")); 3841bc0d457SAlexander V. Chernikov error = ta->del(tc->astate, tinfo, ptei, vv, &num); 3851bc0d457SAlexander V. Chernikov KASSERT(error == 0, ("rollback INSERT failed")); 3861bc0d457SAlexander V. Chernikov tc->count -= num; 3871bc0d457SAlexander V. Chernikov } 3881bc0d457SAlexander V. Chernikov } 3891bc0d457SAlexander V. Chernikov 3901bc0d457SAlexander V. Chernikov /* 3911bc0d457SAlexander V. Chernikov * Prepares add/del state for all @count entries in @tei. 3921bc0d457SAlexander V. Chernikov * Uses either stack buffer (@ta_buf) or allocates a new one. 3931bc0d457SAlexander V. Chernikov * Stores pointer to allocated buffer back to @ta_buf. 3941bc0d457SAlexander V. Chernikov * 3951bc0d457SAlexander V. Chernikov * Returns 0 on success. 3961bc0d457SAlexander V. Chernikov */ 3971bc0d457SAlexander V. Chernikov static int 3981bc0d457SAlexander V. Chernikov prepare_batch_buffer(struct ip_fw_chain *ch, struct table_algo *ta, 3994dff4ae0SAlexander V. Chernikov struct tentry_info *tei, uint32_t count, int op, caddr_t *ta_buf) 4001bc0d457SAlexander V. Chernikov { 4011bc0d457SAlexander V. Chernikov caddr_t ta_buf_m, v; 4021bc0d457SAlexander V. Chernikov size_t ta_buf_sz, sz; 4031bc0d457SAlexander V. Chernikov struct tentry_info *ptei; 4041bc0d457SAlexander V. Chernikov int error, i; 4051bc0d457SAlexander V. Chernikov 4061bc0d457SAlexander V. Chernikov error = 0; 4071bc0d457SAlexander V. Chernikov ta_buf_sz = ta->ta_buf_size; 4083a845e10SAlexander V. Chernikov if (count == 1) { 4091bc0d457SAlexander V. Chernikov /* Sigle add/delete, use on-stack buffer */ 4101bc0d457SAlexander V. Chernikov memset(*ta_buf, 0, TA_BUF_SZ); 4111bc0d457SAlexander V. Chernikov ta_buf_m = *ta_buf; 4123a845e10SAlexander V. Chernikov } else { 4133a845e10SAlexander V. Chernikov 4143a845e10SAlexander V. Chernikov /* 4151bc0d457SAlexander V. Chernikov * Multiple adds/deletes, allocate larger buffer 4161bc0d457SAlexander V. Chernikov * 4171bc0d457SAlexander V. Chernikov * Note we need 2xcount buffer for add case: 4181bc0d457SAlexander V. Chernikov * we have hold both ADD state 4193a845e10SAlexander V. Chernikov * and DELETE state (this may be needed 4203a845e10SAlexander V. Chernikov * if we need to rollback all changes) 4213a845e10SAlexander V. Chernikov */ 4221bc0d457SAlexander V. Chernikov sz = count * ta_buf_sz; 4234dff4ae0SAlexander V. Chernikov ta_buf_m = malloc((op == OP_ADD) ? sz * 2 : sz, M_TEMP, 4243a845e10SAlexander V. Chernikov M_WAITOK | M_ZERO); 4253a845e10SAlexander V. Chernikov } 4261bc0d457SAlexander V. Chernikov 4273a845e10SAlexander V. Chernikov v = ta_buf_m; 4283a845e10SAlexander V. Chernikov for (i = 0; i < count; i++, v += ta_buf_sz) { 4291bc0d457SAlexander V. Chernikov ptei = &tei[i]; 4304dff4ae0SAlexander V. Chernikov error = (op == OP_ADD) ? 4311bc0d457SAlexander V. Chernikov ta->prepare_add(ch, ptei, v) : ta->prepare_del(ch, ptei, v); 4323a845e10SAlexander V. Chernikov 4333a845e10SAlexander V. Chernikov /* 4343a845e10SAlexander V. Chernikov * Some syntax error (incorrect mask, or address, or 4353a845e10SAlexander V. Chernikov * anything). Return error regardless of atomicity 4363a845e10SAlexander V. Chernikov * settings. 4373a845e10SAlexander V. Chernikov */ 438db785d31SAlexander V. Chernikov if (error != 0) 4391bc0d457SAlexander V. Chernikov break; 4403a845e10SAlexander V. Chernikov } 4413b3a8eb9SGleb Smirnoff 4421bc0d457SAlexander V. Chernikov *ta_buf = ta_buf_m; 4431bc0d457SAlexander V. Chernikov return (error); 4441bc0d457SAlexander V. Chernikov } 4451bc0d457SAlexander V. Chernikov 4461bc0d457SAlexander V. Chernikov /* 4471bc0d457SAlexander V. Chernikov * Flushes allocated state for each @count entries in @tei. 4481bc0d457SAlexander V. Chernikov * Frees @ta_buf_m if differs from stack buffer @ta_buf. 4491bc0d457SAlexander V. Chernikov */ 4501bc0d457SAlexander V. Chernikov static void 4511bc0d457SAlexander V. Chernikov flush_batch_buffer(struct ip_fw_chain *ch, struct table_algo *ta, 452867708f7SAlexander V. Chernikov struct tentry_info *tei, uint32_t count, int rollback, 4531bc0d457SAlexander V. Chernikov caddr_t ta_buf_m, caddr_t ta_buf) 4541bc0d457SAlexander V. Chernikov { 4551bc0d457SAlexander V. Chernikov caddr_t v; 4560cba2b28SAlexander V. Chernikov struct tentry_info *ptei; 4571bc0d457SAlexander V. Chernikov size_t ta_buf_sz; 4581bc0d457SAlexander V. Chernikov int i; 4591bc0d457SAlexander V. Chernikov 4601bc0d457SAlexander V. Chernikov ta_buf_sz = ta->ta_buf_size; 4611bc0d457SAlexander V. Chernikov 4621bc0d457SAlexander V. Chernikov /* Run cleaning callback anyway */ 4631bc0d457SAlexander V. Chernikov v = ta_buf_m; 4640cba2b28SAlexander V. Chernikov for (i = 0; i < count; i++, v += ta_buf_sz) { 4650cba2b28SAlexander V. Chernikov ptei = &tei[i]; 4660cba2b28SAlexander V. Chernikov ta->flush_entry(ch, ptei, v); 4670cba2b28SAlexander V. Chernikov if (ptei->ptv != NULL) { 4680cba2b28SAlexander V. Chernikov free(ptei->ptv, M_IPFW); 4690cba2b28SAlexander V. Chernikov ptei->ptv = NULL; 4700cba2b28SAlexander V. Chernikov } 4710cba2b28SAlexander V. Chernikov } 4721bc0d457SAlexander V. Chernikov 4731bc0d457SAlexander V. Chernikov /* Clean up "deleted" state in case of rollback */ 4741bc0d457SAlexander V. Chernikov if (rollback != 0) { 4751bc0d457SAlexander V. Chernikov v = ta_buf_m + count * ta_buf_sz; 4761bc0d457SAlexander V. Chernikov for (i = 0; i < count; i++, v += ta_buf_sz) 4771bc0d457SAlexander V. Chernikov ta->flush_entry(ch, &tei[i], v); 4781bc0d457SAlexander V. Chernikov } 4791bc0d457SAlexander V. Chernikov 4801bc0d457SAlexander V. Chernikov if (ta_buf_m != ta_buf) 4811bc0d457SAlexander V. Chernikov free(ta_buf_m, M_TEMP); 4821bc0d457SAlexander V. Chernikov } 4831bc0d457SAlexander V. Chernikov 48471af39bfSAlexander V. Chernikov 48571af39bfSAlexander V. Chernikov static void 48671af39bfSAlexander V. Chernikov rollback_add_entry(void *object, struct op_state *_state) 48771af39bfSAlexander V. Chernikov { 48871af39bfSAlexander V. Chernikov struct ip_fw_chain *ch; 48971af39bfSAlexander V. Chernikov struct tableop_state *ts; 49071af39bfSAlexander V. Chernikov 49171af39bfSAlexander V. Chernikov ts = (struct tableop_state *)_state; 49271af39bfSAlexander V. Chernikov 49371af39bfSAlexander V. Chernikov if (ts->tc != object && ts->ch != object) 49471af39bfSAlexander V. Chernikov return; 49571af39bfSAlexander V. Chernikov 49671af39bfSAlexander V. Chernikov ch = ts->ch; 49771af39bfSAlexander V. Chernikov 49871af39bfSAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 49971af39bfSAlexander V. Chernikov 50071af39bfSAlexander V. Chernikov /* Call specifid unlockers */ 50171af39bfSAlexander V. Chernikov rollback_table_values(ts); 50271af39bfSAlexander V. Chernikov 50371af39bfSAlexander V. Chernikov /* Indicate we've called */ 50471af39bfSAlexander V. Chernikov ts->modified = 1; 50571af39bfSAlexander V. Chernikov } 50671af39bfSAlexander V. Chernikov 5071bc0d457SAlexander V. Chernikov /* 5081bc0d457SAlexander V. Chernikov * Adds/updates one or more entries in table @ti. 50971af39bfSAlexander V. Chernikov * 51071af39bfSAlexander V. Chernikov * Function may drop/reacquire UH wlock multiple times due to 51171af39bfSAlexander V. Chernikov * items alloc, algorithm callbacks (check_space), value linkage 51271af39bfSAlexander V. Chernikov * (new values, value storage realloc), etc.. 51371af39bfSAlexander V. Chernikov * Other processes like other adds (which may involve storage resize), 51471af39bfSAlexander V. Chernikov * table swaps (which changes table data and may change algo type), 51571af39bfSAlexander V. Chernikov * table modify (which may change value mask) may be executed 51671af39bfSAlexander V. Chernikov * simultaneously so we need to deal with it. 51771af39bfSAlexander V. Chernikov * 51871af39bfSAlexander V. Chernikov * The following approach was implemented: 51971af39bfSAlexander V. Chernikov * we have per-chain linked list, protected with UH lock. 52071af39bfSAlexander V. Chernikov * add_table_entry prepares special on-stack structure wthich is passed 52171af39bfSAlexander V. Chernikov * to its descendants. Users add this structure to this list before unlock. 52271af39bfSAlexander V. Chernikov * After performing needed operations and acquiring UH lock back, each user 52371af39bfSAlexander V. Chernikov * checks if structure has changed. If true, it rolls local state back and 52471af39bfSAlexander V. Chernikov * returns without error to the caller. 52571af39bfSAlexander V. Chernikov * add_table_entry() on its own checks if structure has changed and restarts 52671af39bfSAlexander V. Chernikov * its operation from the beginning (goto restart). 52771af39bfSAlexander V. Chernikov * 52871af39bfSAlexander V. Chernikov * Functions which are modifying fields of interest (currently 52971af39bfSAlexander V. Chernikov * resize_shared_value_storage() and swap_tables() ) 53071af39bfSAlexander V. Chernikov * traverses given list while holding UH lock immediately before 53171af39bfSAlexander V. Chernikov * performing their operations calling function provided be list entry 53271af39bfSAlexander V. Chernikov * ( currently rollback_add_entry ) which performs rollback for all necessary 53371af39bfSAlexander V. Chernikov * state and sets appropriate values in structure indicating rollback 53471af39bfSAlexander V. Chernikov * has happened. 53571af39bfSAlexander V. Chernikov * 53671af39bfSAlexander V. Chernikov * Algo interaction: 5370468c5baSAlexander V. Chernikov * Function references @ti first to ensure table won't 5380468c5baSAlexander V. Chernikov * disappear or change its type. 5390468c5baSAlexander V. Chernikov * After that, prepare_add callback is called for each @tei entry. 5400468c5baSAlexander V. Chernikov * Next, we try to add each entry under UH+WHLOCK 5410468c5baSAlexander V. Chernikov * using add() callback. 5420468c5baSAlexander V. Chernikov * Finally, we free all state by calling flush_entry callback 5430468c5baSAlexander V. Chernikov * for each @tei. 5441bc0d457SAlexander V. Chernikov * 5451bc0d457SAlexander V. Chernikov * Returns 0 on success. 5461bc0d457SAlexander V. Chernikov */ 5471bc0d457SAlexander V. Chernikov int 5481bc0d457SAlexander V. Chernikov add_table_entry(struct ip_fw_chain *ch, struct tid_info *ti, 5491bc0d457SAlexander V. Chernikov struct tentry_info *tei, uint8_t flags, uint32_t count) 5501bc0d457SAlexander V. Chernikov { 5511bc0d457SAlexander V. Chernikov struct table_config *tc; 5521bc0d457SAlexander V. Chernikov struct table_algo *ta; 5531bc0d457SAlexander V. Chernikov uint16_t kidx; 5541bc0d457SAlexander V. Chernikov int error, first_error, i, rollback; 5551bc0d457SAlexander V. Chernikov uint32_t num, numadd; 5561bc0d457SAlexander V. Chernikov struct tentry_info *ptei; 5570cba2b28SAlexander V. Chernikov struct tableop_state ts; 5581bc0d457SAlexander V. Chernikov char ta_buf[TA_BUF_SZ]; 5591bc0d457SAlexander V. Chernikov caddr_t ta_buf_m, v; 5601bc0d457SAlexander V. Chernikov 5610cba2b28SAlexander V. Chernikov memset(&ts, 0, sizeof(ts)); 5620cba2b28SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 5630cba2b28SAlexander V. Chernikov 5641bc0d457SAlexander V. Chernikov /* 5651bc0d457SAlexander V. Chernikov * Find and reference existing table. 5661bc0d457SAlexander V. Chernikov */ 5670cba2b28SAlexander V. Chernikov restart: 5680cba2b28SAlexander V. Chernikov if (ts.modified != 0) { 5690cba2b28SAlexander V. Chernikov flush_batch_buffer(ch, ta, tei, count, rollback, 5700cba2b28SAlexander V. Chernikov ta_buf_m, ta_buf); 5710cba2b28SAlexander V. Chernikov memset(&ts, 0, sizeof(ts)); 5720cba2b28SAlexander V. Chernikov } 573867708f7SAlexander V. Chernikov error = find_ref_table(ch, ti, tei, count, OP_ADD, &tc); 574867708f7SAlexander V. Chernikov if (error != 0) { 575867708f7SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 5761bc0d457SAlexander V. Chernikov return (error); 577867708f7SAlexander V. Chernikov } 578867708f7SAlexander V. Chernikov ta = tc->ta; 579fb4b37a3SAlexander V. Chernikov 580fb4b37a3SAlexander V. Chernikov /* Fill in tablestate */ 5810cba2b28SAlexander V. Chernikov ts.ch = ch; 58271af39bfSAlexander V. Chernikov ts.opstate.func = rollback_add_entry; 5830cba2b28SAlexander V. Chernikov ts.tc = tc; 5840cba2b28SAlexander V. Chernikov ts.vshared = tc->vshared; 5850cba2b28SAlexander V. Chernikov ts.vmask = tc->vmask; 5860cba2b28SAlexander V. Chernikov ts.ta = ta; 5870cba2b28SAlexander V. Chernikov ts.tei = tei; 5880cba2b28SAlexander V. Chernikov ts.count = count; 5890cba2b28SAlexander V. Chernikov rollback = 0; 5900cba2b28SAlexander V. Chernikov add_toperation_state(ch, &ts); 591867708f7SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 5921bc0d457SAlexander V. Chernikov 5931bc0d457SAlexander V. Chernikov /* Allocate memory and prepare record(s) */ 5941bc0d457SAlexander V. Chernikov /* Pass stack buffer by default */ 5951bc0d457SAlexander V. Chernikov ta_buf_m = ta_buf; 5964dff4ae0SAlexander V. Chernikov error = prepare_batch_buffer(ch, ta, tei, count, OP_ADD, &ta_buf_m); 5971bc0d457SAlexander V. Chernikov if (error != 0) 5981bc0d457SAlexander V. Chernikov goto cleanup; 5991bc0d457SAlexander V. Chernikov 600b074b7bbSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 601c8d5d308SAlexander V. Chernikov /* Drop reference we've used in first search */ 602c8d5d308SAlexander V. Chernikov tc->no.refcnt--; 603c8d5d308SAlexander V. Chernikov 604b6ee846eSAlexander V. Chernikov /* 6050cba2b28SAlexander V. Chernikov * Check if table swap has happened. 6060cba2b28SAlexander V. Chernikov * (so table algo might be changed). 6070cba2b28SAlexander V. Chernikov * Restart operation to achieve consistent behavior. 608b6ee846eSAlexander V. Chernikov */ 6090cba2b28SAlexander V. Chernikov del_toperation_state(ch, &ts); 6100cba2b28SAlexander V. Chernikov if (ts.modified != 0) 6110cba2b28SAlexander V. Chernikov goto restart; 612b6ee846eSAlexander V. Chernikov 613c8d5d308SAlexander V. Chernikov /* 6140cba2b28SAlexander V. Chernikov * Link all values values to shared/per-table value array. 6150cba2b28SAlexander V. Chernikov * 6160cba2b28SAlexander V. Chernikov * May release/reacquire UH_WLOCK. 617c8d5d308SAlexander V. Chernikov */ 6180cba2b28SAlexander V. Chernikov error = ipfw_link_table_values(ch, &ts); 6190cba2b28SAlexander V. Chernikov if (error != 0) 620c8d5d308SAlexander V. Chernikov goto cleanup; 6210cba2b28SAlexander V. Chernikov if (ts.modified != 0) 6220cba2b28SAlexander V. Chernikov goto restart; 6230cba2b28SAlexander V. Chernikov 6240cba2b28SAlexander V. Chernikov /* 6250cba2b28SAlexander V. Chernikov * Ensure we are able to add all entries without additional 6260cba2b28SAlexander V. Chernikov * memory allocations. May release/reacquire UH_WLOCK. 6270cba2b28SAlexander V. Chernikov */ 6280cba2b28SAlexander V. Chernikov kidx = tc->no.kidx; 6290cba2b28SAlexander V. Chernikov error = check_table_space(ch, &ts, tc, KIDX_TO_TI(ch, kidx), count); 6300cba2b28SAlexander V. Chernikov if (error != 0) 6310cba2b28SAlexander V. Chernikov goto cleanup; 6320cba2b28SAlexander V. Chernikov if (ts.modified != 0) 6330cba2b28SAlexander V. Chernikov goto restart; 634c8d5d308SAlexander V. Chernikov 6353a845e10SAlexander V. Chernikov /* We've got valid table in @tc. Let's try to add data */ 6369f7d47b0SAlexander V. Chernikov kidx = tc->no.kidx; 6379f7d47b0SAlexander V. Chernikov ta = tc->ta; 6383a845e10SAlexander V. Chernikov numadd = 0; 6393a845e10SAlexander V. Chernikov first_error = 0; 6409f7d47b0SAlexander V. Chernikov 641b074b7bbSAlexander V. Chernikov IPFW_WLOCK(ch); 6423a845e10SAlexander V. Chernikov 6433a845e10SAlexander V. Chernikov v = ta_buf_m; 6441bc0d457SAlexander V. Chernikov for (i = 0; i < count; i++, v += ta->ta_buf_size) { 6453a845e10SAlexander V. Chernikov ptei = &tei[i]; 6463a845e10SAlexander V. Chernikov num = 0; 6473a845e10SAlexander V. Chernikov /* check limit before adding */ 6483a845e10SAlexander V. Chernikov if ((error = check_table_limit(tc, ptei)) == 0) { 6493a845e10SAlexander V. Chernikov error = ta->add(tc->astate, KIDX_TO_TI(ch, kidx), 6503a845e10SAlexander V. Chernikov ptei, v, &num); 6513a845e10SAlexander V. Chernikov /* Set status flag to inform userland */ 652867708f7SAlexander V. Chernikov store_tei_result(ptei, OP_ADD, error, num); 6533a845e10SAlexander V. Chernikov } 6543a845e10SAlexander V. Chernikov if (error == 0) { 6553a845e10SAlexander V. Chernikov /* Update number of records to ease limit checking */ 6563a845e10SAlexander V. Chernikov tc->count += num; 6573a845e10SAlexander V. Chernikov numadd += num; 6583a845e10SAlexander V. Chernikov continue; 6593a845e10SAlexander V. Chernikov } 6603a845e10SAlexander V. Chernikov 6613a845e10SAlexander V. Chernikov if (first_error == 0) 6623a845e10SAlexander V. Chernikov first_error = error; 6633a845e10SAlexander V. Chernikov 6643a845e10SAlexander V. Chernikov /* 6653a845e10SAlexander V. Chernikov * Some error have happened. Check our atomicity 6663a845e10SAlexander V. Chernikov * settings: continue if atomicity is not required, 6673a845e10SAlexander V. Chernikov * rollback changes otherwise. 6683a845e10SAlexander V. Chernikov */ 6693a845e10SAlexander V. Chernikov if ((flags & IPFW_CTF_ATOMIC) == 0) 6703a845e10SAlexander V. Chernikov continue; 6713a845e10SAlexander V. Chernikov 6721bc0d457SAlexander V. Chernikov rollback_added_entries(ch, tc, KIDX_TO_TI(ch, kidx), 6731bc0d457SAlexander V. Chernikov tei, ta_buf_m, count, i); 6740cba2b28SAlexander V. Chernikov 6750cba2b28SAlexander V. Chernikov rollback = 1; 6763a845e10SAlexander V. Chernikov break; 6773a845e10SAlexander V. Chernikov } 6783a845e10SAlexander V. Chernikov 6793b3a8eb9SGleb Smirnoff IPFW_WUNLOCK(ch); 6809f7d47b0SAlexander V. Chernikov 68171af39bfSAlexander V. Chernikov ipfw_garbage_table_values(ch, tc, tei, count, rollback); 6820cba2b28SAlexander V. Chernikov 683b6ee846eSAlexander V. Chernikov /* Permit post-add algorithm grow/rehash. */ 6843a845e10SAlexander V. Chernikov if (numadd != 0) 6850cba2b28SAlexander V. Chernikov check_table_space(ch, NULL, tc, KIDX_TO_TI(ch, kidx), 0); 686b074b7bbSAlexander V. Chernikov 6873a845e10SAlexander V. Chernikov /* Return first error to user, if any */ 6883a845e10SAlexander V. Chernikov error = first_error; 6893a845e10SAlexander V. Chernikov 6903a845e10SAlexander V. Chernikov cleanup: 6910cba2b28SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 6920cba2b28SAlexander V. Chernikov 693867708f7SAlexander V. Chernikov flush_batch_buffer(ch, ta, tei, count, rollback, ta_buf_m, ta_buf); 694b074b7bbSAlexander V. Chernikov 6959f7d47b0SAlexander V. Chernikov return (error); 6963b3a8eb9SGleb Smirnoff } 6973b3a8eb9SGleb Smirnoff 6983a845e10SAlexander V. Chernikov /* 6993a845e10SAlexander V. Chernikov * Deletes one or more entries in table @ti. 7003a845e10SAlexander V. Chernikov * 7013a845e10SAlexander V. Chernikov * Returns 0 on success. 7023a845e10SAlexander V. Chernikov */ 7033b3a8eb9SGleb Smirnoff int 7041832a7b3SAlexander V. Chernikov del_table_entry(struct ip_fw_chain *ch, struct tid_info *ti, 7053a845e10SAlexander V. Chernikov struct tentry_info *tei, uint8_t flags, uint32_t count) 7063b3a8eb9SGleb Smirnoff { 707b074b7bbSAlexander V. Chernikov struct table_config *tc; 7089f7d47b0SAlexander V. Chernikov struct table_algo *ta; 7093a845e10SAlexander V. Chernikov struct tentry_info *ptei; 710b074b7bbSAlexander V. Chernikov uint16_t kidx; 7113a845e10SAlexander V. Chernikov int error, first_error, i; 7123a845e10SAlexander V. Chernikov uint32_t num, numdel; 713b6ee846eSAlexander V. Chernikov char ta_buf[TA_BUF_SZ]; 7143a845e10SAlexander V. Chernikov caddr_t ta_buf_m, v; 7153b3a8eb9SGleb Smirnoff 716db785d31SAlexander V. Chernikov /* 7171bc0d457SAlexander V. Chernikov * Find and reference existing table. 718db785d31SAlexander V. Chernikov */ 719867708f7SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 720867708f7SAlexander V. Chernikov error = find_ref_table(ch, ti, tei, count, OP_DEL, &tc); 721867708f7SAlexander V. Chernikov if (error != 0) { 722867708f7SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 723db785d31SAlexander V. Chernikov return (error); 724867708f7SAlexander V. Chernikov } 725867708f7SAlexander V. Chernikov ta = tc->ta; 726867708f7SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 7273a845e10SAlexander V. Chernikov 72835e1bbd0SAlexander V. Chernikov /* Allocate memory and prepare record(s) */ 7291bc0d457SAlexander V. Chernikov /* Pass stack buffer by default */ 7303a845e10SAlexander V. Chernikov ta_buf_m = ta_buf; 7314dff4ae0SAlexander V. Chernikov error = prepare_batch_buffer(ch, ta, tei, count, OP_DEL, &ta_buf_m); 7323a845e10SAlexander V. Chernikov if (error != 0) 7333a845e10SAlexander V. Chernikov goto cleanup; 7349f7d47b0SAlexander V. Chernikov 7353a845e10SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 7363a845e10SAlexander V. Chernikov 7373a845e10SAlexander V. Chernikov /* Drop reference we've used in first search */ 7383a845e10SAlexander V. Chernikov tc->no.refcnt--; 7393a845e10SAlexander V. Chernikov 740c8d5d308SAlexander V. Chernikov /* 741c8d5d308SAlexander V. Chernikov * Check if table algo is still the same. 742c8d5d308SAlexander V. Chernikov * (changed ta may be the result of table swap). 743c8d5d308SAlexander V. Chernikov */ 744c8d5d308SAlexander V. Chernikov if (ta != tc->ta) { 745c8d5d308SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 746c8d5d308SAlexander V. Chernikov error = EINVAL; 747c8d5d308SAlexander V. Chernikov goto cleanup; 748c8d5d308SAlexander V. Chernikov } 749c8d5d308SAlexander V. Chernikov 750b074b7bbSAlexander V. Chernikov kidx = tc->no.kidx; 7513a845e10SAlexander V. Chernikov numdel = 0; 7523a845e10SAlexander V. Chernikov first_error = 0; 753b074b7bbSAlexander V. Chernikov 754b074b7bbSAlexander V. Chernikov IPFW_WLOCK(ch); 7553a845e10SAlexander V. Chernikov v = ta_buf_m; 7561bc0d457SAlexander V. Chernikov for (i = 0; i < count; i++, v += ta->ta_buf_size) { 7573a845e10SAlexander V. Chernikov ptei = &tei[i]; 7583a845e10SAlexander V. Chernikov num = 0; 7593a845e10SAlexander V. Chernikov error = ta->del(tc->astate, KIDX_TO_TI(ch, kidx), ptei, v, 7603a845e10SAlexander V. Chernikov &num); 7613a845e10SAlexander V. Chernikov /* Save state for userland */ 762867708f7SAlexander V. Chernikov store_tei_result(ptei, OP_DEL, error, num); 7633a845e10SAlexander V. Chernikov if (error != 0 && first_error == 0) 7643a845e10SAlexander V. Chernikov first_error = error; 7653a845e10SAlexander V. Chernikov tc->count -= num; 7663a845e10SAlexander V. Chernikov numdel += num; 7673a845e10SAlexander V. Chernikov } 7683b3a8eb9SGleb Smirnoff IPFW_WUNLOCK(ch); 7693b3a8eb9SGleb Smirnoff 7700cba2b28SAlexander V. Chernikov /* Unlink non-used values */ 77171af39bfSAlexander V. Chernikov ipfw_garbage_table_values(ch, tc, tei, count, 0); 7720cba2b28SAlexander V. Chernikov 7733a845e10SAlexander V. Chernikov if (numdel != 0) { 774b6ee846eSAlexander V. Chernikov /* Run post-del hook to permit shrinking */ 7750cba2b28SAlexander V. Chernikov check_table_space(ch, NULL, tc, KIDX_TO_TI(ch, kidx), 0); 776b6ee846eSAlexander V. Chernikov } 777b074b7bbSAlexander V. Chernikov 7789f7d47b0SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 7793b3a8eb9SGleb Smirnoff 7803a845e10SAlexander V. Chernikov /* Return first error to user, if any */ 7813a845e10SAlexander V. Chernikov error = first_error; 7823a845e10SAlexander V. Chernikov 7833a845e10SAlexander V. Chernikov cleanup: 784867708f7SAlexander V. Chernikov flush_batch_buffer(ch, ta, tei, count, 0, ta_buf_m, ta_buf); 785ac35ff17SAlexander V. Chernikov 786ac35ff17SAlexander V. Chernikov return (error); 787ac35ff17SAlexander V. Chernikov } 788ac35ff17SAlexander V. Chernikov 789db785d31SAlexander V. Chernikov /* 790b6ee846eSAlexander V. Chernikov * Ensure that table @tc has enough space to add @count entries without 791b6ee846eSAlexander V. Chernikov * need for reallocation. 792db785d31SAlexander V. Chernikov * 793db785d31SAlexander V. Chernikov * Callbacks order: 794301290bcSAlexander V. Chernikov * 0) need_modify() (UH_WLOCK) - checks if @count items can be added w/o resize. 795b6ee846eSAlexander V. Chernikov * 796db785d31SAlexander V. Chernikov * 1) alloc_modify (no locks, M_WAITOK) - alloc new state based on @pflags. 797db785d31SAlexander V. Chernikov * 2) prepare_modifyt (UH_WLOCK) - copy old data into new storage 798db785d31SAlexander V. Chernikov * 3) modify (UH_WLOCK + WLOCK) - switch pointers 799b6ee846eSAlexander V. Chernikov * 4) flush_modify (UH_WLOCK) - free state, if needed 800b6ee846eSAlexander V. Chernikov * 801b6ee846eSAlexander V. Chernikov * Returns 0 on success. 802db785d31SAlexander V. Chernikov */ 803db785d31SAlexander V. Chernikov static int 8040cba2b28SAlexander V. Chernikov check_table_space(struct ip_fw_chain *ch, struct tableop_state *ts, 8050cba2b28SAlexander V. Chernikov struct table_config *tc, struct table_info *ti, uint32_t count) 806db785d31SAlexander V. Chernikov { 807b6ee846eSAlexander V. Chernikov struct table_algo *ta; 808b6ee846eSAlexander V. Chernikov uint64_t pflags; 809b6ee846eSAlexander V. Chernikov char ta_buf[TA_BUF_SZ]; 810db785d31SAlexander V. Chernikov int error; 811db785d31SAlexander V. Chernikov 812b6ee846eSAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 813db785d31SAlexander V. Chernikov 814b6ee846eSAlexander V. Chernikov error = 0; 815b6ee846eSAlexander V. Chernikov ta = tc->ta; 816fd0869d5SAlexander V. Chernikov if (ta->need_modify == NULL) 817fd0869d5SAlexander V. Chernikov return (0); 818fd0869d5SAlexander V. Chernikov 819b6ee846eSAlexander V. Chernikov /* Acquire reference not to loose @tc between locks/unlocks */ 820b6ee846eSAlexander V. Chernikov tc->no.refcnt++; 821db785d31SAlexander V. Chernikov 822db785d31SAlexander V. Chernikov /* 823b6ee846eSAlexander V. Chernikov * TODO: think about avoiding race between large add/large delete 824b6ee846eSAlexander V. Chernikov * operation on algorithm which implements shrinking along with 825b6ee846eSAlexander V. Chernikov * growing. 826db785d31SAlexander V. Chernikov */ 827b6ee846eSAlexander V. Chernikov while (true) { 828b6ee846eSAlexander V. Chernikov pflags = 0; 829301290bcSAlexander V. Chernikov if (ta->need_modify(tc->astate, ti, count, &pflags) == 0) { 83035e1bbd0SAlexander V. Chernikov error = 0; 83135e1bbd0SAlexander V. Chernikov break; 832b6ee846eSAlexander V. Chernikov } 833db785d31SAlexander V. Chernikov 834b6ee846eSAlexander V. Chernikov /* We have to shrink/grow table */ 8350cba2b28SAlexander V. Chernikov if (ts != NULL) 8360cba2b28SAlexander V. Chernikov add_toperation_state(ch, ts); 837b6ee846eSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 838b6ee846eSAlexander V. Chernikov 839301290bcSAlexander V. Chernikov memset(&ta_buf, 0, sizeof(ta_buf)); 8400cba2b28SAlexander V. Chernikov error = ta->prepare_mod(ta_buf, &pflags); 841b6ee846eSAlexander V. Chernikov 842b6ee846eSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 8430cba2b28SAlexander V. Chernikov if (ts != NULL) 8440cba2b28SAlexander V. Chernikov del_toperation_state(ch, ts); 8450cba2b28SAlexander V. Chernikov 8460cba2b28SAlexander V. Chernikov if (error != 0) 8470cba2b28SAlexander V. Chernikov break; 8480cba2b28SAlexander V. Chernikov 8490cba2b28SAlexander V. Chernikov if (ts != NULL && ts->modified != 0) { 8500cba2b28SAlexander V. Chernikov 8510cba2b28SAlexander V. Chernikov /* 8520cba2b28SAlexander V. Chernikov * Swap operation has happened 8530cba2b28SAlexander V. Chernikov * so we're currently operating on other 8540cba2b28SAlexander V. Chernikov * table data. Stop doing this. 8550cba2b28SAlexander V. Chernikov */ 8560cba2b28SAlexander V. Chernikov ta->flush_mod(ta_buf); 8570cba2b28SAlexander V. Chernikov break; 8580cba2b28SAlexander V. Chernikov } 859b6ee846eSAlexander V. Chernikov 860b6ee846eSAlexander V. Chernikov /* Check if we still need to alter table */ 861b6ee846eSAlexander V. Chernikov ti = KIDX_TO_TI(ch, tc->no.kidx); 862301290bcSAlexander V. Chernikov if (ta->need_modify(tc->astate, ti, count, &pflags) == 0) { 863301290bcSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 864b6ee846eSAlexander V. Chernikov 865b6ee846eSAlexander V. Chernikov /* 86635e1bbd0SAlexander V. Chernikov * Other thread has already performed resize. 86735e1bbd0SAlexander V. Chernikov * Flush our state and return. 868b6ee846eSAlexander V. Chernikov */ 869b6ee846eSAlexander V. Chernikov ta->flush_mod(ta_buf); 870b6ee846eSAlexander V. Chernikov break; 871b6ee846eSAlexander V. Chernikov } 872b6ee846eSAlexander V. Chernikov 873b6ee846eSAlexander V. Chernikov error = ta->fill_mod(tc->astate, ti, ta_buf, &pflags); 874b6ee846eSAlexander V. Chernikov if (error == 0) { 875db785d31SAlexander V. Chernikov /* Do actual modification */ 876db785d31SAlexander V. Chernikov IPFW_WLOCK(ch); 87768394ec8SAlexander V. Chernikov ta->modify(tc->astate, ti, ta_buf, pflags); 878db785d31SAlexander V. Chernikov IPFW_WUNLOCK(ch); 879db785d31SAlexander V. Chernikov } 880db785d31SAlexander V. Chernikov 881b6ee846eSAlexander V. Chernikov /* Anyway, flush data and retry */ 882db785d31SAlexander V. Chernikov ta->flush_mod(ta_buf); 883b6ee846eSAlexander V. Chernikov } 884db785d31SAlexander V. Chernikov 885b6ee846eSAlexander V. Chernikov tc->no.refcnt--; 886db785d31SAlexander V. Chernikov return (error); 887db785d31SAlexander V. Chernikov } 888db785d31SAlexander V. Chernikov 8893a845e10SAlexander V. Chernikov /* 8903a845e10SAlexander V. Chernikov * Selects appropriate table operation handler 8913a845e10SAlexander V. Chernikov * depending on opcode version. 8923a845e10SAlexander V. Chernikov */ 893ac35ff17SAlexander V. Chernikov int 894db785d31SAlexander V. Chernikov ipfw_manage_table_ent(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 895ac35ff17SAlexander V. Chernikov struct sockopt_data *sd) 896ac35ff17SAlexander V. Chernikov { 897ac35ff17SAlexander V. Chernikov int error; 898ac35ff17SAlexander V. Chernikov 899ac35ff17SAlexander V. Chernikov switch (op3->version) { 900ac35ff17SAlexander V. Chernikov case 0: 901db785d31SAlexander V. Chernikov error = ipfw_manage_table_ent_v0(ch, op3, sd); 902ac35ff17SAlexander V. Chernikov break; 903ac35ff17SAlexander V. Chernikov case 1: 904db785d31SAlexander V. Chernikov error = ipfw_manage_table_ent_v1(ch, op3, sd); 905ac35ff17SAlexander V. Chernikov break; 906ac35ff17SAlexander V. Chernikov default: 907ac35ff17SAlexander V. Chernikov error = ENOTSUP; 908ac35ff17SAlexander V. Chernikov } 909ac35ff17SAlexander V. Chernikov 910ac35ff17SAlexander V. Chernikov return (error); 911ac35ff17SAlexander V. Chernikov } 912ac35ff17SAlexander V. Chernikov 913ac35ff17SAlexander V. Chernikov /* 914ac35ff17SAlexander V. Chernikov * Adds or deletes record in table. 915ac35ff17SAlexander V. Chernikov * Data layout (v0): 916ac35ff17SAlexander V. Chernikov * Request: [ ip_fw3_opheader ipfw_table_xentry ] 917ac35ff17SAlexander V. Chernikov * 918ac35ff17SAlexander V. Chernikov * Returns 0 on success 919ac35ff17SAlexander V. Chernikov */ 920ac35ff17SAlexander V. Chernikov static int 921db785d31SAlexander V. Chernikov ipfw_manage_table_ent_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 922ac35ff17SAlexander V. Chernikov struct sockopt_data *sd) 923ac35ff17SAlexander V. Chernikov { 924ac35ff17SAlexander V. Chernikov ipfw_table_xentry *xent; 925ac35ff17SAlexander V. Chernikov struct tentry_info tei; 926ac35ff17SAlexander V. Chernikov struct tid_info ti; 9270cba2b28SAlexander V. Chernikov struct table_value v; 928ac35ff17SAlexander V. Chernikov int error, hdrlen, read; 929ac35ff17SAlexander V. Chernikov 930ac35ff17SAlexander V. Chernikov hdrlen = offsetof(ipfw_table_xentry, k); 931ac35ff17SAlexander V. Chernikov 932ac35ff17SAlexander V. Chernikov /* Check minimum header size */ 933ac35ff17SAlexander V. Chernikov if (sd->valsize < (sizeof(*op3) + hdrlen)) 934ac35ff17SAlexander V. Chernikov return (EINVAL); 935ac35ff17SAlexander V. Chernikov 936ac35ff17SAlexander V. Chernikov read = sizeof(ip_fw3_opheader); 937ac35ff17SAlexander V. Chernikov 938ac35ff17SAlexander V. Chernikov /* Check if xentry len field is valid */ 939ac35ff17SAlexander V. Chernikov xent = (ipfw_table_xentry *)(op3 + 1); 940ac35ff17SAlexander V. Chernikov if (xent->len < hdrlen || xent->len + read > sd->valsize) 941ac35ff17SAlexander V. Chernikov return (EINVAL); 942ac35ff17SAlexander V. Chernikov 943ac35ff17SAlexander V. Chernikov memset(&tei, 0, sizeof(tei)); 944ac35ff17SAlexander V. Chernikov tei.paddr = &xent->k; 945ac35ff17SAlexander V. Chernikov tei.masklen = xent->masklen; 9460cba2b28SAlexander V. Chernikov ipfw_import_table_value_legacy(xent->value, &v); 9470cba2b28SAlexander V. Chernikov tei.pvalue = &v; 948ac35ff17SAlexander V. Chernikov /* Old requests compability */ 949db785d31SAlexander V. Chernikov tei.flags = TEI_FLAGS_COMPAT; 950c21034b7SAlexander V. Chernikov if (xent->type == IPFW_TABLE_ADDR) { 951ac35ff17SAlexander V. Chernikov if (xent->len - hdrlen == sizeof(in_addr_t)) 952ac35ff17SAlexander V. Chernikov tei.subtype = AF_INET; 953ac35ff17SAlexander V. Chernikov else 954ac35ff17SAlexander V. Chernikov tei.subtype = AF_INET6; 955ac35ff17SAlexander V. Chernikov } 956ac35ff17SAlexander V. Chernikov 957ac35ff17SAlexander V. Chernikov memset(&ti, 0, sizeof(ti)); 958ac35ff17SAlexander V. Chernikov ti.uidx = xent->tbl; 959ac35ff17SAlexander V. Chernikov ti.type = xent->type; 960ac35ff17SAlexander V. Chernikov 961ac35ff17SAlexander V. Chernikov error = (op3->opcode == IP_FW_TABLE_XADD) ? 9623a845e10SAlexander V. Chernikov add_table_entry(ch, &ti, &tei, 0, 1) : 9633a845e10SAlexander V. Chernikov del_table_entry(ch, &ti, &tei, 0, 1); 964ac35ff17SAlexander V. Chernikov 965ac35ff17SAlexander V. Chernikov return (error); 966ac35ff17SAlexander V. Chernikov } 967ac35ff17SAlexander V. Chernikov 968ac35ff17SAlexander V. Chernikov /* 969ac35ff17SAlexander V. Chernikov * Adds or deletes record in table. 970ac35ff17SAlexander V. Chernikov * Data layout (v1)(current): 971db785d31SAlexander V. Chernikov * Request: [ ipfw_obj_header 972db785d31SAlexander V. Chernikov * ipfw_obj_ctlv(IPFW_TLV_TBLENT_LIST) [ ipfw_obj_tentry x N ] 973db785d31SAlexander V. Chernikov * ] 974ac35ff17SAlexander V. Chernikov * 975ac35ff17SAlexander V. Chernikov * Returns 0 on success 976ac35ff17SAlexander V. Chernikov */ 977ac35ff17SAlexander V. Chernikov static int 978db785d31SAlexander V. Chernikov ipfw_manage_table_ent_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 979ac35ff17SAlexander V. Chernikov struct sockopt_data *sd) 980ac35ff17SAlexander V. Chernikov { 9813a845e10SAlexander V. Chernikov ipfw_obj_tentry *tent, *ptent; 982db785d31SAlexander V. Chernikov ipfw_obj_ctlv *ctlv; 983ac35ff17SAlexander V. Chernikov ipfw_obj_header *oh; 9843a845e10SAlexander V. Chernikov struct tentry_info *ptei, tei, *tei_buf; 985ac35ff17SAlexander V. Chernikov struct tid_info ti; 9863a845e10SAlexander V. Chernikov int error, i, kidx, read; 987ac35ff17SAlexander V. Chernikov 988ac35ff17SAlexander V. Chernikov /* Check minimum header size */ 989db785d31SAlexander V. Chernikov if (sd->valsize < (sizeof(*oh) + sizeof(*ctlv))) 990ac35ff17SAlexander V. Chernikov return (EINVAL); 991ac35ff17SAlexander V. Chernikov 992ac35ff17SAlexander V. Chernikov /* Check if passed data is too long */ 993ac35ff17SAlexander V. Chernikov if (sd->valsize != sd->kavail) 994ac35ff17SAlexander V. Chernikov return (EINVAL); 995ac35ff17SAlexander V. Chernikov 996ac35ff17SAlexander V. Chernikov oh = (ipfw_obj_header *)sd->kbuf; 997ac35ff17SAlexander V. Chernikov 998ac35ff17SAlexander V. Chernikov /* Basic length checks for TLVs */ 999ac35ff17SAlexander V. Chernikov if (oh->ntlv.head.length != sizeof(oh->ntlv)) 1000ac35ff17SAlexander V. Chernikov return (EINVAL); 1001ac35ff17SAlexander V. Chernikov 1002ac35ff17SAlexander V. Chernikov read = sizeof(*oh); 1003ac35ff17SAlexander V. Chernikov 1004db785d31SAlexander V. Chernikov ctlv = (ipfw_obj_ctlv *)(oh + 1); 1005db785d31SAlexander V. Chernikov if (ctlv->head.length + read != sd->valsize) 1006db785d31SAlexander V. Chernikov return (EINVAL); 1007db785d31SAlexander V. Chernikov 1008db785d31SAlexander V. Chernikov read += sizeof(*ctlv); 1009db785d31SAlexander V. Chernikov tent = (ipfw_obj_tentry *)(ctlv + 1); 10103a845e10SAlexander V. Chernikov if (ctlv->count * sizeof(*tent) + read != sd->valsize) 1011ac35ff17SAlexander V. Chernikov return (EINVAL); 1012ac35ff17SAlexander V. Chernikov 10133a845e10SAlexander V. Chernikov if (ctlv->count == 0) 10143a845e10SAlexander V. Chernikov return (0); 1015ac35ff17SAlexander V. Chernikov 10163a845e10SAlexander V. Chernikov /* 10173a845e10SAlexander V. Chernikov * Mark entire buffer as "read". 101835e1bbd0SAlexander V. Chernikov * This instructs sopt api write it back 10193a845e10SAlexander V. Chernikov * after function return. 10203a845e10SAlexander V. Chernikov */ 10213a845e10SAlexander V. Chernikov ipfw_get_sopt_header(sd, sd->valsize); 10223a845e10SAlexander V. Chernikov 10233a845e10SAlexander V. Chernikov /* Perform basic checks for each entry */ 10243a845e10SAlexander V. Chernikov ptent = tent; 10253a845e10SAlexander V. Chernikov kidx = tent->idx; 10263a845e10SAlexander V. Chernikov for (i = 0; i < ctlv->count; i++, ptent++) { 10273a845e10SAlexander V. Chernikov if (ptent->head.length != sizeof(*ptent)) 10283a845e10SAlexander V. Chernikov return (EINVAL); 10293a845e10SAlexander V. Chernikov if (ptent->idx != kidx) 10303a845e10SAlexander V. Chernikov return (ENOTSUP); 10313a845e10SAlexander V. Chernikov } 10323a845e10SAlexander V. Chernikov 10333a845e10SAlexander V. Chernikov /* Convert data into kernel request objects */ 103481d3153dSAlexander V. Chernikov objheader_to_ti(oh, &ti); 1035ac35ff17SAlexander V. Chernikov ti.type = oh->ntlv.type; 10363a845e10SAlexander V. Chernikov ti.uidx = kidx; 10373a845e10SAlexander V. Chernikov 10383a845e10SAlexander V. Chernikov /* Use on-stack buffer for single add/del */ 10393a845e10SAlexander V. Chernikov if (ctlv->count == 1) { 10403a845e10SAlexander V. Chernikov memset(&tei, 0, sizeof(tei)); 10413a845e10SAlexander V. Chernikov tei_buf = &tei; 10423a845e10SAlexander V. Chernikov } else 10433a845e10SAlexander V. Chernikov tei_buf = malloc(ctlv->count * sizeof(tei), M_TEMP, 10443a845e10SAlexander V. Chernikov M_WAITOK | M_ZERO); 10453a845e10SAlexander V. Chernikov 10463a845e10SAlexander V. Chernikov ptei = tei_buf; 10473a845e10SAlexander V. Chernikov ptent = tent; 10483a845e10SAlexander V. Chernikov for (i = 0; i < ctlv->count; i++, ptent++, ptei++) { 10493a845e10SAlexander V. Chernikov ptei->paddr = &ptent->k; 10503a845e10SAlexander V. Chernikov ptei->subtype = ptent->subtype; 10513a845e10SAlexander V. Chernikov ptei->masklen = ptent->masklen; 10523a845e10SAlexander V. Chernikov if (ptent->head.flags & IPFW_TF_UPDATE) 10533a845e10SAlexander V. Chernikov ptei->flags |= TEI_FLAGS_UPDATE; 10540cba2b28SAlexander V. Chernikov 10550cba2b28SAlexander V. Chernikov ipfw_import_table_value_v1(&ptent->v.value); 10560cba2b28SAlexander V. Chernikov ptei->pvalue = (struct table_value *)&ptent->v.value; 10573a845e10SAlexander V. Chernikov } 1058ac35ff17SAlexander V. Chernikov 1059ac35ff17SAlexander V. Chernikov error = (oh->opheader.opcode == IP_FW_TABLE_XADD) ? 10603a845e10SAlexander V. Chernikov add_table_entry(ch, &ti, tei_buf, ctlv->flags, ctlv->count) : 10613a845e10SAlexander V. Chernikov del_table_entry(ch, &ti, tei_buf, ctlv->flags, ctlv->count); 10623a845e10SAlexander V. Chernikov 10633a845e10SAlexander V. Chernikov /* Translate result back to userland */ 10643a845e10SAlexander V. Chernikov ptei = tei_buf; 10653a845e10SAlexander V. Chernikov ptent = tent; 10663a845e10SAlexander V. Chernikov for (i = 0; i < ctlv->count; i++, ptent++, ptei++) { 10673a845e10SAlexander V. Chernikov if (ptei->flags & TEI_FLAGS_ADDED) 10683a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_ADDED; 10693a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_DELETED) 10703a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_DELETED; 10713a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_UPDATED) 10723a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_UPDATED; 10733a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_LIMIT) 10743a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_LIMIT; 10753a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_ERROR) 10763a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_ERROR; 10773a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_NOTFOUND) 10783a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_NOTFOUND; 10793a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_EXISTS) 10803a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_EXISTS; 10810cba2b28SAlexander V. Chernikov ipfw_export_table_value_v1(ptei->pvalue, &ptent->v.value); 10823a845e10SAlexander V. Chernikov } 10833a845e10SAlexander V. Chernikov 10843a845e10SAlexander V. Chernikov if (tei_buf != &tei) 10853a845e10SAlexander V. Chernikov free(tei_buf, M_TEMP); 1086ac35ff17SAlexander V. Chernikov 1087ac35ff17SAlexander V. Chernikov return (error); 1088ac35ff17SAlexander V. Chernikov } 1089ac35ff17SAlexander V. Chernikov 109081d3153dSAlexander V. Chernikov /* 109181d3153dSAlexander V. Chernikov * Looks up an entry in given table. 109281d3153dSAlexander V. Chernikov * Data layout (v0)(current): 109381d3153dSAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_obj_tentry ] 109481d3153dSAlexander V. Chernikov * Reply: [ ipfw_obj_header ipfw_obj_tentry ] 109581d3153dSAlexander V. Chernikov * 109681d3153dSAlexander V. Chernikov * Returns 0 on success 109781d3153dSAlexander V. Chernikov */ 109881d3153dSAlexander V. Chernikov int 109981d3153dSAlexander V. Chernikov ipfw_find_table_entry(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 110081d3153dSAlexander V. Chernikov struct sockopt_data *sd) 110181d3153dSAlexander V. Chernikov { 110281d3153dSAlexander V. Chernikov ipfw_obj_tentry *tent; 110381d3153dSAlexander V. Chernikov ipfw_obj_header *oh; 110481d3153dSAlexander V. Chernikov struct tid_info ti; 110581d3153dSAlexander V. Chernikov struct table_config *tc; 110681d3153dSAlexander V. Chernikov struct table_algo *ta; 110781d3153dSAlexander V. Chernikov struct table_info *kti; 110881d3153dSAlexander V. Chernikov struct namedobj_instance *ni; 1109914bffb6SAlexander V. Chernikov int error; 111081d3153dSAlexander V. Chernikov size_t sz; 111181d3153dSAlexander V. Chernikov 111281d3153dSAlexander V. Chernikov /* Check minimum header size */ 111381d3153dSAlexander V. Chernikov sz = sizeof(*oh) + sizeof(*tent); 111481d3153dSAlexander V. Chernikov if (sd->valsize != sz) 111581d3153dSAlexander V. Chernikov return (EINVAL); 111681d3153dSAlexander V. Chernikov 111781d3153dSAlexander V. Chernikov oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 111881d3153dSAlexander V. Chernikov tent = (ipfw_obj_tentry *)(oh + 1); 111981d3153dSAlexander V. Chernikov 112081d3153dSAlexander V. Chernikov /* Basic length checks for TLVs */ 112181d3153dSAlexander V. Chernikov if (oh->ntlv.head.length != sizeof(oh->ntlv)) 112281d3153dSAlexander V. Chernikov return (EINVAL); 112381d3153dSAlexander V. Chernikov 112481d3153dSAlexander V. Chernikov objheader_to_ti(oh, &ti); 112581d3153dSAlexander V. Chernikov ti.type = oh->ntlv.type; 112681d3153dSAlexander V. Chernikov ti.uidx = tent->idx; 112781d3153dSAlexander V. Chernikov 112881d3153dSAlexander V. Chernikov IPFW_UH_RLOCK(ch); 112981d3153dSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 113081d3153dSAlexander V. Chernikov 113181d3153dSAlexander V. Chernikov /* 113281d3153dSAlexander V. Chernikov * Find existing table and check its type . 113381d3153dSAlexander V. Chernikov */ 113481d3153dSAlexander V. Chernikov ta = NULL; 113581d3153dSAlexander V. Chernikov if ((tc = find_table(ni, &ti)) == NULL) { 113681d3153dSAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 113781d3153dSAlexander V. Chernikov return (ESRCH); 113881d3153dSAlexander V. Chernikov } 113981d3153dSAlexander V. Chernikov 114081d3153dSAlexander V. Chernikov /* check table type */ 114181d3153dSAlexander V. Chernikov if (tc->no.type != ti.type) { 114281d3153dSAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 114381d3153dSAlexander V. Chernikov return (EINVAL); 114481d3153dSAlexander V. Chernikov } 114581d3153dSAlexander V. Chernikov 114681d3153dSAlexander V. Chernikov kti = KIDX_TO_TI(ch, tc->no.kidx); 114781d3153dSAlexander V. Chernikov ta = tc->ta; 114881d3153dSAlexander V. Chernikov 1149914bffb6SAlexander V. Chernikov if (ta->find_tentry == NULL) 1150914bffb6SAlexander V. Chernikov return (ENOTSUP); 1151914bffb6SAlexander V. Chernikov 1152914bffb6SAlexander V. Chernikov error = ta->find_tentry(tc->astate, kti, tent); 115381d3153dSAlexander V. Chernikov 115481d3153dSAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 115581d3153dSAlexander V. Chernikov 115681d3153dSAlexander V. Chernikov return (error); 115781d3153dSAlexander V. Chernikov } 115881d3153dSAlexander V. Chernikov 115946d52008SAlexander V. Chernikov /* 116046d52008SAlexander V. Chernikov * Flushes all entries or destroys given table. 116146d52008SAlexander V. Chernikov * Data layout (v0)(current): 116246d52008SAlexander V. Chernikov * Request: [ ipfw_obj_header ] 116346d52008SAlexander V. Chernikov * 116446d52008SAlexander V. Chernikov * Returns 0 on success 116546d52008SAlexander V. Chernikov */ 1166ac35ff17SAlexander V. Chernikov int 1167ac35ff17SAlexander V. Chernikov ipfw_flush_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1168ac35ff17SAlexander V. Chernikov struct sockopt_data *sd) 1169ac35ff17SAlexander V. Chernikov { 1170ac35ff17SAlexander V. Chernikov int error; 1171ac35ff17SAlexander V. Chernikov struct _ipfw_obj_header *oh; 1172ac35ff17SAlexander V. Chernikov struct tid_info ti; 1173ac35ff17SAlexander V. Chernikov 1174ac35ff17SAlexander V. Chernikov if (sd->valsize != sizeof(*oh)) 1175ac35ff17SAlexander V. Chernikov return (EINVAL); 1176ac35ff17SAlexander V. Chernikov 1177ac35ff17SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)op3; 1178ac35ff17SAlexander V. Chernikov objheader_to_ti(oh, &ti); 1179ac35ff17SAlexander V. Chernikov 11801832a7b3SAlexander V. Chernikov if (op3->opcode == IP_FW_TABLE_XDESTROY) 1181ac35ff17SAlexander V. Chernikov error = destroy_table(ch, &ti); 11821832a7b3SAlexander V. Chernikov else if (op3->opcode == IP_FW_TABLE_XFLUSH) 1183ac35ff17SAlexander V. Chernikov error = flush_table(ch, &ti); 1184ac35ff17SAlexander V. Chernikov else 1185ac35ff17SAlexander V. Chernikov return (ENOTSUP); 1186ac35ff17SAlexander V. Chernikov 1187ac35ff17SAlexander V. Chernikov return (error); 11883b3a8eb9SGleb Smirnoff } 11893b3a8eb9SGleb Smirnoff 1190fb4b37a3SAlexander V. Chernikov static void 1191fb4b37a3SAlexander V. Chernikov restart_flush(void *object, struct op_state *_state) 1192fb4b37a3SAlexander V. Chernikov { 1193fb4b37a3SAlexander V. Chernikov struct tableop_state *ts; 1194fb4b37a3SAlexander V. Chernikov 1195fb4b37a3SAlexander V. Chernikov ts = (struct tableop_state *)_state; 1196fb4b37a3SAlexander V. Chernikov 1197fb4b37a3SAlexander V. Chernikov if (ts->tc != object) 1198fb4b37a3SAlexander V. Chernikov return; 1199fb4b37a3SAlexander V. Chernikov 1200fb4b37a3SAlexander V. Chernikov /* Indicate we've called */ 1201fb4b37a3SAlexander V. Chernikov ts->modified = 1; 1202fb4b37a3SAlexander V. Chernikov } 1203fb4b37a3SAlexander V. Chernikov 120435e1bbd0SAlexander V. Chernikov /* 120535e1bbd0SAlexander V. Chernikov * Flushes given table. 120635e1bbd0SAlexander V. Chernikov * 120735e1bbd0SAlexander V. Chernikov * Function create new table instance with the same 120835e1bbd0SAlexander V. Chernikov * parameters, swaps it with old one and 1209fb4b37a3SAlexander V. Chernikov * flushes state without holding runtime WLOCK. 121035e1bbd0SAlexander V. Chernikov * 121135e1bbd0SAlexander V. Chernikov * Returns 0 on success. 121235e1bbd0SAlexander V. Chernikov */ 12131832a7b3SAlexander V. Chernikov int 1214ac35ff17SAlexander V. Chernikov flush_table(struct ip_fw_chain *ch, struct tid_info *ti) 12153b3a8eb9SGleb Smirnoff { 1216b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 1217b074b7bbSAlexander V. Chernikov struct table_config *tc; 12189f7d47b0SAlexander V. Chernikov struct table_algo *ta; 12199f7d47b0SAlexander V. Chernikov struct table_info ti_old, ti_new, *tablestate; 12209f7d47b0SAlexander V. Chernikov void *astate_old, *astate_new; 1221914bffb6SAlexander V. Chernikov char algostate[64], *pstate; 1222fb4b37a3SAlexander V. Chernikov struct tableop_state ts; 1223b074b7bbSAlexander V. Chernikov int error; 1224b074b7bbSAlexander V. Chernikov uint16_t kidx; 1225914bffb6SAlexander V. Chernikov uint8_t tflags; 12263b3a8eb9SGleb Smirnoff 12273b3a8eb9SGleb Smirnoff /* 12289f7d47b0SAlexander V. Chernikov * Stage 1: save table algoritm. 1229b074b7bbSAlexander V. Chernikov * Reference found table to ensure it won't disappear. 12303b3a8eb9SGleb Smirnoff */ 1231b074b7bbSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1232b074b7bbSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1233b074b7bbSAlexander V. Chernikov if ((tc = find_table(ni, ti)) == NULL) { 1234b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1235b074b7bbSAlexander V. Chernikov return (ESRCH); 1236b074b7bbSAlexander V. Chernikov } 1237fb4b37a3SAlexander V. Chernikov restart: 1238fb4b37a3SAlexander V. Chernikov /* Set up swap handler */ 1239fb4b37a3SAlexander V. Chernikov memset(&ts, 0, sizeof(ts)); 1240fb4b37a3SAlexander V. Chernikov ts.opstate.func = restart_flush; 1241fb4b37a3SAlexander V. Chernikov ts.tc = tc; 1242fb4b37a3SAlexander V. Chernikov 12439f7d47b0SAlexander V. Chernikov ta = tc->ta; 1244fd0869d5SAlexander V. Chernikov /* Do not flush readonly tables */ 1245fd0869d5SAlexander V. Chernikov if ((ta->flags & TA_FLAG_READONLY) != 0) { 1246fd0869d5SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1247fd0869d5SAlexander V. Chernikov return (EACCES); 1248fd0869d5SAlexander V. Chernikov } 124935e1bbd0SAlexander V. Chernikov /* Save startup algo parameters */ 1250daabb523SAlexander V. Chernikov if (ta->print_config != NULL) { 1251daabb523SAlexander V. Chernikov ta->print_config(tc->astate, KIDX_TO_TI(ch, tc->no.kidx), 1252daabb523SAlexander V. Chernikov algostate, sizeof(algostate)); 1253daabb523SAlexander V. Chernikov pstate = algostate; 1254daabb523SAlexander V. Chernikov } else 1255daabb523SAlexander V. Chernikov pstate = NULL; 1256914bffb6SAlexander V. Chernikov tflags = tc->tflags; 1257fb4b37a3SAlexander V. Chernikov tc->no.refcnt++; 1258fb4b37a3SAlexander V. Chernikov add_toperation_state(ch, &ts); 1259b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 12603b3a8eb9SGleb Smirnoff 1261b074b7bbSAlexander V. Chernikov /* 12629f7d47b0SAlexander V. Chernikov * Stage 2: allocate new table instance using same algo. 1263b074b7bbSAlexander V. Chernikov */ 12649f7d47b0SAlexander V. Chernikov memset(&ti_new, 0, sizeof(struct table_info)); 1265fb4b37a3SAlexander V. Chernikov error = ta->init(ch, &astate_new, &ti_new, pstate, tflags); 1266b074b7bbSAlexander V. Chernikov 1267b074b7bbSAlexander V. Chernikov /* 1268b074b7bbSAlexander V. Chernikov * Stage 3: swap old state pointers with newly-allocated ones. 1269b074b7bbSAlexander V. Chernikov * Decrease refcount. 1270b074b7bbSAlexander V. Chernikov */ 1271b074b7bbSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1272fb4b37a3SAlexander V. Chernikov tc->no.refcnt--; 1273fb4b37a3SAlexander V. Chernikov del_toperation_state(ch, &ts); 1274fb4b37a3SAlexander V. Chernikov 1275fb4b37a3SAlexander V. Chernikov if (error != 0) { 1276fb4b37a3SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1277fb4b37a3SAlexander V. Chernikov return (error); 1278fb4b37a3SAlexander V. Chernikov } 1279fb4b37a3SAlexander V. Chernikov 1280fb4b37a3SAlexander V. Chernikov /* 1281fb4b37a3SAlexander V. Chernikov * Restart operation if table swap has happened: 1282fb4b37a3SAlexander V. Chernikov * even if algo may be the same, algo init parameters 1283fb4b37a3SAlexander V. Chernikov * may change. Restart operation instead of doing 1284fb4b37a3SAlexander V. Chernikov * complex checks. 1285fb4b37a3SAlexander V. Chernikov */ 1286fb4b37a3SAlexander V. Chernikov if (ts.modified != 0) { 1287fb4b37a3SAlexander V. Chernikov ta->destroy(astate_new, &ti_new); 1288fb4b37a3SAlexander V. Chernikov goto restart; 1289fb4b37a3SAlexander V. Chernikov } 1290b074b7bbSAlexander V. Chernikov 1291b074b7bbSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1292b074b7bbSAlexander V. Chernikov kidx = tc->no.kidx; 12939f7d47b0SAlexander V. Chernikov tablestate = (struct table_info *)ch->tablestate; 1294b074b7bbSAlexander V. Chernikov 12959f7d47b0SAlexander V. Chernikov IPFW_WLOCK(ch); 12969f7d47b0SAlexander V. Chernikov ti_old = tablestate[kidx]; 12979f7d47b0SAlexander V. Chernikov tablestate[kidx] = ti_new; 12989f7d47b0SAlexander V. Chernikov IPFW_WUNLOCK(ch); 1299b074b7bbSAlexander V. Chernikov 13009f7d47b0SAlexander V. Chernikov astate_old = tc->astate; 13019f7d47b0SAlexander V. Chernikov tc->astate = astate_new; 13029f7d47b0SAlexander V. Chernikov tc->ti = ti_new; 13039f7d47b0SAlexander V. Chernikov tc->count = 0; 1304b074b7bbSAlexander V. Chernikov 13050cba2b28SAlexander V. Chernikov /* 13060cba2b28SAlexander V. Chernikov * Stage 4: unref values. 13070cba2b28SAlexander V. Chernikov */ 13080cba2b28SAlexander V. Chernikov ipfw_unref_table_values(ch, tc, ta, astate_old, &ti_old); 1309b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 13103b3a8eb9SGleb Smirnoff 1311b074b7bbSAlexander V. Chernikov /* 13120cba2b28SAlexander V. Chernikov * Stage 5: perform real flush/destroy. 1313b074b7bbSAlexander V. Chernikov */ 13149f7d47b0SAlexander V. Chernikov ta->destroy(astate_old, &ti_old); 13153b3a8eb9SGleb Smirnoff 13163b3a8eb9SGleb Smirnoff return (0); 13173b3a8eb9SGleb Smirnoff } 13183b3a8eb9SGleb Smirnoff 1319b074b7bbSAlexander V. Chernikov /* 132046d52008SAlexander V. Chernikov * Swaps two tables. 132146d52008SAlexander V. Chernikov * Data layout (v0)(current): 132246d52008SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_obj_ntlv ] 132346d52008SAlexander V. Chernikov * 132446d52008SAlexander V. Chernikov * Returns 0 on success 132546d52008SAlexander V. Chernikov */ 132646d52008SAlexander V. Chernikov int 132746d52008SAlexander V. Chernikov ipfw_swap_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 132846d52008SAlexander V. Chernikov struct sockopt_data *sd) 132946d52008SAlexander V. Chernikov { 133046d52008SAlexander V. Chernikov int error; 133146d52008SAlexander V. Chernikov struct _ipfw_obj_header *oh; 133246d52008SAlexander V. Chernikov struct tid_info ti_a, ti_b; 133346d52008SAlexander V. Chernikov 133446d52008SAlexander V. Chernikov if (sd->valsize != sizeof(*oh) + sizeof(ipfw_obj_ntlv)) 133546d52008SAlexander V. Chernikov return (EINVAL); 133646d52008SAlexander V. Chernikov 133746d52008SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)op3; 133846d52008SAlexander V. Chernikov ntlv_to_ti(&oh->ntlv, &ti_a); 133946d52008SAlexander V. Chernikov ntlv_to_ti((ipfw_obj_ntlv *)(oh + 1), &ti_b); 134046d52008SAlexander V. Chernikov 1341a73d728dSAlexander V. Chernikov error = swap_tables(ch, &ti_a, &ti_b); 134246d52008SAlexander V. Chernikov 134346d52008SAlexander V. Chernikov return (error); 134446d52008SAlexander V. Chernikov } 134546d52008SAlexander V. Chernikov 134635e1bbd0SAlexander V. Chernikov /* 134735e1bbd0SAlexander V. Chernikov * Swaps two tables of the same type/valtype. 134835e1bbd0SAlexander V. Chernikov * 134935e1bbd0SAlexander V. Chernikov * Checks if tables are compatible and limits 1350c8d5d308SAlexander V. Chernikov * permits swap, than actually perform swap. 135135e1bbd0SAlexander V. Chernikov * 1352c8d5d308SAlexander V. Chernikov * Each table consists of 2 different parts: 1353c8d5d308SAlexander V. Chernikov * config: 1354c8d5d308SAlexander V. Chernikov * @tc (with name, set, kidx) and rule bindings, which is "stable". 1355c8d5d308SAlexander V. Chernikov * number of items 1356c8d5d308SAlexander V. Chernikov * table algo 1357c8d5d308SAlexander V. Chernikov * runtime: 1358c8d5d308SAlexander V. Chernikov * runtime data @ti (ch->tablestate) 1359c8d5d308SAlexander V. Chernikov * runtime cache in @tc 1360c8d5d308SAlexander V. Chernikov * algo-specific data (@tc->astate) 1361c8d5d308SAlexander V. Chernikov * 1362c8d5d308SAlexander V. Chernikov * So we switch: 1363c8d5d308SAlexander V. Chernikov * all runtime data 1364c8d5d308SAlexander V. Chernikov * number of items 1365c8d5d308SAlexander V. Chernikov * table algo 1366c8d5d308SAlexander V. Chernikov * 1367c8d5d308SAlexander V. Chernikov * After that we call @ti change handler for each table. 1368c8d5d308SAlexander V. Chernikov * 1369c8d5d308SAlexander V. Chernikov * Note that referencing @tc won't protect tc->ta from change. 1370c8d5d308SAlexander V. Chernikov * XXX: Do we need to restrict swap between locked tables? 1371c8d5d308SAlexander V. Chernikov * XXX: Do we need to exchange ftype? 137235e1bbd0SAlexander V. Chernikov * 137335e1bbd0SAlexander V. Chernikov * Returns 0 on success. 137435e1bbd0SAlexander V. Chernikov */ 137546d52008SAlexander V. Chernikov static int 1376a73d728dSAlexander V. Chernikov swap_tables(struct ip_fw_chain *ch, struct tid_info *a, 137746d52008SAlexander V. Chernikov struct tid_info *b) 137846d52008SAlexander V. Chernikov { 137946d52008SAlexander V. Chernikov struct namedobj_instance *ni; 138046d52008SAlexander V. Chernikov struct table_config *tc_a, *tc_b; 138146d52008SAlexander V. Chernikov struct table_algo *ta; 138246d52008SAlexander V. Chernikov struct table_info ti, *tablestate; 138346d52008SAlexander V. Chernikov void *astate; 138446d52008SAlexander V. Chernikov uint32_t count; 138546d52008SAlexander V. Chernikov 138646d52008SAlexander V. Chernikov /* 138746d52008SAlexander V. Chernikov * Stage 1: find both tables and ensure they are of 138835e1bbd0SAlexander V. Chernikov * the same type. 138946d52008SAlexander V. Chernikov */ 139046d52008SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 139146d52008SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 139246d52008SAlexander V. Chernikov if ((tc_a = find_table(ni, a)) == NULL) { 139346d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 139446d52008SAlexander V. Chernikov return (ESRCH); 139546d52008SAlexander V. Chernikov } 139646d52008SAlexander V. Chernikov if ((tc_b = find_table(ni, b)) == NULL) { 139746d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 139846d52008SAlexander V. Chernikov return (ESRCH); 139946d52008SAlexander V. Chernikov } 140046d52008SAlexander V. Chernikov 140146d52008SAlexander V. Chernikov /* It is very easy to swap between the same table */ 140246d52008SAlexander V. Chernikov if (tc_a == tc_b) { 140346d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 140446d52008SAlexander V. Chernikov return (0); 140546d52008SAlexander V. Chernikov } 140646d52008SAlexander V. Chernikov 140746d52008SAlexander V. Chernikov /* Check type and value are the same */ 14080cba2b28SAlexander V. Chernikov if (tc_a->no.type != tc_b->no.type || tc_a->tflags != tc_b->tflags) { 140946d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 141046d52008SAlexander V. Chernikov return (EINVAL); 141146d52008SAlexander V. Chernikov } 141246d52008SAlexander V. Chernikov 141346d52008SAlexander V. Chernikov /* Check limits before swap */ 141446d52008SAlexander V. Chernikov if ((tc_a->limit != 0 && tc_b->count > tc_a->limit) || 141546d52008SAlexander V. Chernikov (tc_b->limit != 0 && tc_a->count > tc_b->limit)) { 141646d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 141746d52008SAlexander V. Chernikov return (EFBIG); 141846d52008SAlexander V. Chernikov } 141946d52008SAlexander V. Chernikov 1420fd0869d5SAlexander V. Chernikov /* Check if one of the tables is readonly */ 1421fd0869d5SAlexander V. Chernikov if (((tc_a->ta->flags | tc_b->ta->flags) & TA_FLAG_READONLY) != 0) { 1422fd0869d5SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1423fd0869d5SAlexander V. Chernikov return (EACCES); 1424fd0869d5SAlexander V. Chernikov } 1425fd0869d5SAlexander V. Chernikov 14260cba2b28SAlexander V. Chernikov /* Notify we're going to swap */ 14270cba2b28SAlexander V. Chernikov rollback_toperation_state(ch, tc_a); 14280cba2b28SAlexander V. Chernikov rollback_toperation_state(ch, tc_b); 14290cba2b28SAlexander V. Chernikov 143046d52008SAlexander V. Chernikov /* Everything is fine, prepare to swap */ 143146d52008SAlexander V. Chernikov tablestate = (struct table_info *)ch->tablestate; 143246d52008SAlexander V. Chernikov ti = tablestate[tc_a->no.kidx]; 143346d52008SAlexander V. Chernikov ta = tc_a->ta; 143446d52008SAlexander V. Chernikov astate = tc_a->astate; 143546d52008SAlexander V. Chernikov count = tc_a->count; 143646d52008SAlexander V. Chernikov 143746d52008SAlexander V. Chernikov IPFW_WLOCK(ch); 143846d52008SAlexander V. Chernikov /* a <- b */ 143946d52008SAlexander V. Chernikov tablestate[tc_a->no.kidx] = tablestate[tc_b->no.kidx]; 144046d52008SAlexander V. Chernikov tc_a->ta = tc_b->ta; 144146d52008SAlexander V. Chernikov tc_a->astate = tc_b->astate; 144246d52008SAlexander V. Chernikov tc_a->count = tc_b->count; 144346d52008SAlexander V. Chernikov /* b <- a */ 144446d52008SAlexander V. Chernikov tablestate[tc_b->no.kidx] = ti; 144546d52008SAlexander V. Chernikov tc_b->ta = ta; 144646d52008SAlexander V. Chernikov tc_b->astate = astate; 144746d52008SAlexander V. Chernikov tc_b->count = count; 144846d52008SAlexander V. Chernikov IPFW_WUNLOCK(ch); 144946d52008SAlexander V. Chernikov 145046d52008SAlexander V. Chernikov /* Ensure tc.ti copies are in sync */ 145146d52008SAlexander V. Chernikov tc_a->ti = tablestate[tc_a->no.kidx]; 145246d52008SAlexander V. Chernikov tc_b->ti = tablestate[tc_b->no.kidx]; 145346d52008SAlexander V. Chernikov 145446d52008SAlexander V. Chernikov /* Notify both tables on @ti change */ 145546d52008SAlexander V. Chernikov if (tc_a->ta->change_ti != NULL) 145646d52008SAlexander V. Chernikov tc_a->ta->change_ti(tc_a->astate, &tablestate[tc_a->no.kidx]); 145746d52008SAlexander V. Chernikov if (tc_b->ta->change_ti != NULL) 145846d52008SAlexander V. Chernikov tc_b->ta->change_ti(tc_b->astate, &tablestate[tc_b->no.kidx]); 145946d52008SAlexander V. Chernikov 146046d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 146146d52008SAlexander V. Chernikov 146246d52008SAlexander V. Chernikov return (0); 146346d52008SAlexander V. Chernikov } 146446d52008SAlexander V. Chernikov 146546d52008SAlexander V. Chernikov /* 14669f7d47b0SAlexander V. Chernikov * Destroys table specified by @ti. 1467ac35ff17SAlexander V. Chernikov * Data layout (v0)(current): 1468ac35ff17SAlexander V. Chernikov * Request: [ ip_fw3_opheader ] 1469ac35ff17SAlexander V. Chernikov * 1470ac35ff17SAlexander V. Chernikov * Returns 0 on success 1471b074b7bbSAlexander V. Chernikov */ 1472ac35ff17SAlexander V. Chernikov static int 1473ac35ff17SAlexander V. Chernikov destroy_table(struct ip_fw_chain *ch, struct tid_info *ti) 1474b074b7bbSAlexander V. Chernikov { 1475b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 1476b074b7bbSAlexander V. Chernikov struct table_config *tc; 1477b074b7bbSAlexander V. Chernikov 1478b074b7bbSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1479b074b7bbSAlexander V. Chernikov 1480b074b7bbSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1481b074b7bbSAlexander V. Chernikov if ((tc = find_table(ni, ti)) == NULL) { 1482b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1483b074b7bbSAlexander V. Chernikov return (ESRCH); 1484b074b7bbSAlexander V. Chernikov } 1485b074b7bbSAlexander V. Chernikov 14869f7d47b0SAlexander V. Chernikov /* Do not permit destroying referenced tables */ 14879f7d47b0SAlexander V. Chernikov if (tc->no.refcnt > 0) { 1488b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1489b074b7bbSAlexander V. Chernikov return (EBUSY); 1490b074b7bbSAlexander V. Chernikov } 1491b074b7bbSAlexander V. Chernikov 1492b074b7bbSAlexander V. Chernikov IPFW_WLOCK(ch); 1493b074b7bbSAlexander V. Chernikov unlink_table(ch, tc); 1494b074b7bbSAlexander V. Chernikov IPFW_WUNLOCK(ch); 1495b074b7bbSAlexander V. Chernikov 1496b074b7bbSAlexander V. Chernikov /* Free obj index */ 1497ac35ff17SAlexander V. Chernikov if (ipfw_objhash_free_idx(ni, tc->no.kidx) != 0) 1498b074b7bbSAlexander V. Chernikov printf("Error unlinking kidx %d from table %s\n", 1499b074b7bbSAlexander V. Chernikov tc->no.kidx, tc->tablename); 1500b074b7bbSAlexander V. Chernikov 15010cba2b28SAlexander V. Chernikov /* Unref values used in tables while holding UH lock */ 15020cba2b28SAlexander V. Chernikov ipfw_unref_table_values(ch, tc, tc->ta, tc->astate, 15030cba2b28SAlexander V. Chernikov &((struct table_info *)ch->tablestate)[tc->no.kidx]); 1504b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1505b074b7bbSAlexander V. Chernikov 1506b074b7bbSAlexander V. Chernikov free_table_config(ni, tc); 1507b074b7bbSAlexander V. Chernikov 1508b074b7bbSAlexander V. Chernikov return (0); 1509b074b7bbSAlexander V. Chernikov } 1510b074b7bbSAlexander V. Chernikov 1511b074b7bbSAlexander V. Chernikov static void 1512b074b7bbSAlexander V. Chernikov destroy_table_locked(struct namedobj_instance *ni, struct named_object *no, 1513b074b7bbSAlexander V. Chernikov void *arg) 1514b074b7bbSAlexander V. Chernikov { 1515b074b7bbSAlexander V. Chernikov 1516b074b7bbSAlexander V. Chernikov unlink_table((struct ip_fw_chain *)arg, (struct table_config *)no); 1517ac35ff17SAlexander V. Chernikov if (ipfw_objhash_free_idx(ni, no->kidx) != 0) 1518b074b7bbSAlexander V. Chernikov printf("Error unlinking kidx %d from table %s\n", 1519b074b7bbSAlexander V. Chernikov no->kidx, no->name); 1520b074b7bbSAlexander V. Chernikov free_table_config(ni, (struct table_config *)no); 1521b074b7bbSAlexander V. Chernikov } 1522b074b7bbSAlexander V. Chernikov 152335e1bbd0SAlexander V. Chernikov /* 152435e1bbd0SAlexander V. Chernikov * Shuts tables module down. 152535e1bbd0SAlexander V. Chernikov */ 15263b3a8eb9SGleb Smirnoff void 15273b3a8eb9SGleb Smirnoff ipfw_destroy_tables(struct ip_fw_chain *ch) 15283b3a8eb9SGleb Smirnoff { 15293b3a8eb9SGleb Smirnoff 1530b074b7bbSAlexander V. Chernikov /* Remove all tables from working set */ 1531b074b7bbSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1532b074b7bbSAlexander V. Chernikov IPFW_WLOCK(ch); 1533b074b7bbSAlexander V. Chernikov ipfw_objhash_foreach(CHAIN_TO_NI(ch), destroy_table_locked, ch); 1534b074b7bbSAlexander V. Chernikov IPFW_WUNLOCK(ch); 1535b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 15363b3a8eb9SGleb Smirnoff 15373b3a8eb9SGleb Smirnoff /* Free pointers itself */ 15389f7d47b0SAlexander V. Chernikov free(ch->tablestate, M_IPFW); 15399f7d47b0SAlexander V. Chernikov 15400cba2b28SAlexander V. Chernikov ipfw_table_value_destroy(ch); 15419f7d47b0SAlexander V. Chernikov ipfw_table_algo_destroy(ch); 1542b074b7bbSAlexander V. Chernikov 1543b074b7bbSAlexander V. Chernikov ipfw_objhash_destroy(CHAIN_TO_NI(ch)); 1544b074b7bbSAlexander V. Chernikov free(CHAIN_TO_TCFG(ch), M_IPFW); 15453b3a8eb9SGleb Smirnoff } 15463b3a8eb9SGleb Smirnoff 154735e1bbd0SAlexander V. Chernikov /* 154835e1bbd0SAlexander V. Chernikov * Starts tables module. 154935e1bbd0SAlexander V. Chernikov */ 15503b3a8eb9SGleb Smirnoff int 15513b3a8eb9SGleb Smirnoff ipfw_init_tables(struct ip_fw_chain *ch) 15523b3a8eb9SGleb Smirnoff { 1553b074b7bbSAlexander V. Chernikov struct tables_config *tcfg; 1554b074b7bbSAlexander V. Chernikov 15553b3a8eb9SGleb Smirnoff /* Allocate pointers */ 15569f7d47b0SAlexander V. Chernikov ch->tablestate = malloc(V_fw_tables_max * sizeof(struct table_info), 15579f7d47b0SAlexander V. Chernikov M_IPFW, M_WAITOK | M_ZERO); 1558b074b7bbSAlexander V. Chernikov 1559b074b7bbSAlexander V. Chernikov tcfg = malloc(sizeof(struct tables_config), M_IPFW, M_WAITOK | M_ZERO); 1560b074b7bbSAlexander V. Chernikov tcfg->namehash = ipfw_objhash_create(V_fw_tables_max); 1561b074b7bbSAlexander V. Chernikov ch->tblcfg = tcfg; 1562b074b7bbSAlexander V. Chernikov 15630cba2b28SAlexander V. Chernikov ipfw_table_value_init(ch); 15649f7d47b0SAlexander V. Chernikov ipfw_table_algo_init(ch); 15659f7d47b0SAlexander V. Chernikov 15663b3a8eb9SGleb Smirnoff return (0); 15673b3a8eb9SGleb Smirnoff } 15683b3a8eb9SGleb Smirnoff 156935e1bbd0SAlexander V. Chernikov /* 157035e1bbd0SAlexander V. Chernikov * Grow tables index. 157135e1bbd0SAlexander V. Chernikov * 157235e1bbd0SAlexander V. Chernikov * Returns 0 on success. 157335e1bbd0SAlexander V. Chernikov */ 15743b3a8eb9SGleb Smirnoff int 15753b3a8eb9SGleb Smirnoff ipfw_resize_tables(struct ip_fw_chain *ch, unsigned int ntables) 15763b3a8eb9SGleb Smirnoff { 15773b3a8eb9SGleb Smirnoff unsigned int ntables_old, tbl; 1578b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 15799f7d47b0SAlexander V. Chernikov void *new_idx, *old_tablestate, *tablestate; 158068394ec8SAlexander V. Chernikov struct table_info *ti; 158168394ec8SAlexander V. Chernikov struct table_config *tc; 158268394ec8SAlexander V. Chernikov int i, new_blocks; 15833b3a8eb9SGleb Smirnoff 15843b3a8eb9SGleb Smirnoff /* Check new value for validity */ 15853b3a8eb9SGleb Smirnoff if (ntables > IPFW_TABLES_MAX) 15863b3a8eb9SGleb Smirnoff ntables = IPFW_TABLES_MAX; 15873b3a8eb9SGleb Smirnoff 15883b3a8eb9SGleb Smirnoff /* Allocate new pointers */ 15899f7d47b0SAlexander V. Chernikov tablestate = malloc(ntables * sizeof(struct table_info), 15909f7d47b0SAlexander V. Chernikov M_IPFW, M_WAITOK | M_ZERO); 15919f7d47b0SAlexander V. Chernikov 1592b074b7bbSAlexander V. Chernikov ipfw_objhash_bitmap_alloc(ntables, (void *)&new_idx, &new_blocks); 15933b3a8eb9SGleb Smirnoff 15949f7d47b0SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 15953b3a8eb9SGleb Smirnoff 15963b3a8eb9SGleb Smirnoff tbl = (ntables >= V_fw_tables_max) ? V_fw_tables_max : ntables; 1597b074b7bbSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1598b074b7bbSAlexander V. Chernikov 15999f7d47b0SAlexander V. Chernikov /* Temporary restrict decreasing max_tables */ 16009f7d47b0SAlexander V. Chernikov if (ntables < V_fw_tables_max) { 16019f7d47b0SAlexander V. Chernikov 16029f7d47b0SAlexander V. Chernikov /* 16039f7d47b0SAlexander V. Chernikov * FIXME: Check if we really can shrink 16049f7d47b0SAlexander V. Chernikov */ 16059f7d47b0SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1606b074b7bbSAlexander V. Chernikov return (EINVAL); 1607b074b7bbSAlexander V. Chernikov } 16083b3a8eb9SGleb Smirnoff 16099f7d47b0SAlexander V. Chernikov /* Copy table info/indices */ 16109f7d47b0SAlexander V. Chernikov memcpy(tablestate, ch->tablestate, sizeof(struct table_info) * tbl); 16119f7d47b0SAlexander V. Chernikov ipfw_objhash_bitmap_merge(ni, &new_idx, &new_blocks); 16123b3a8eb9SGleb Smirnoff 16139f7d47b0SAlexander V. Chernikov IPFW_WLOCK(ch); 16149f7d47b0SAlexander V. Chernikov 16159f7d47b0SAlexander V. Chernikov /* Change pointers */ 16169f7d47b0SAlexander V. Chernikov old_tablestate = ch->tablestate; 16179f7d47b0SAlexander V. Chernikov ch->tablestate = tablestate; 16189f7d47b0SAlexander V. Chernikov ipfw_objhash_bitmap_swap(ni, &new_idx, &new_blocks); 16193b3a8eb9SGleb Smirnoff 16203b3a8eb9SGleb Smirnoff ntables_old = V_fw_tables_max; 16213b3a8eb9SGleb Smirnoff V_fw_tables_max = ntables; 16223b3a8eb9SGleb Smirnoff 16233b3a8eb9SGleb Smirnoff IPFW_WUNLOCK(ch); 162468394ec8SAlexander V. Chernikov 162568394ec8SAlexander V. Chernikov /* Notify all consumers that their @ti pointer has changed */ 162668394ec8SAlexander V. Chernikov ti = (struct table_info *)ch->tablestate; 162768394ec8SAlexander V. Chernikov for (i = 0; i < tbl; i++, ti++) { 162868394ec8SAlexander V. Chernikov if (ti->lookup == NULL) 162968394ec8SAlexander V. Chernikov continue; 163068394ec8SAlexander V. Chernikov tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, i); 163168394ec8SAlexander V. Chernikov if (tc == NULL || tc->ta->change_ti == NULL) 163268394ec8SAlexander V. Chernikov continue; 163368394ec8SAlexander V. Chernikov 163468394ec8SAlexander V. Chernikov tc->ta->change_ti(tc->astate, ti); 163568394ec8SAlexander V. Chernikov } 163668394ec8SAlexander V. Chernikov 16379f7d47b0SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 16383b3a8eb9SGleb Smirnoff 16393b3a8eb9SGleb Smirnoff /* Free old pointers */ 16409f7d47b0SAlexander V. Chernikov free(old_tablestate, M_IPFW); 1641b074b7bbSAlexander V. Chernikov ipfw_objhash_bitmap_free(new_idx, new_blocks); 16423b3a8eb9SGleb Smirnoff 16433b3a8eb9SGleb Smirnoff return (0); 16443b3a8eb9SGleb Smirnoff } 16453b3a8eb9SGleb Smirnoff 1646a73d728dSAlexander V. Chernikov /* 164735e1bbd0SAlexander V. Chernikov * Switch between "set 0" and "rule's set" table binding, 1648a73d728dSAlexander V. Chernikov * Check all ruleset bindings and permits changing 1649a73d728dSAlexander V. Chernikov * IFF each binding has both rule AND table in default set (set 0). 1650a73d728dSAlexander V. Chernikov * 1651a73d728dSAlexander V. Chernikov * Returns 0 on success. 1652a73d728dSAlexander V. Chernikov */ 1653a73d728dSAlexander V. Chernikov int 1654a73d728dSAlexander V. Chernikov ipfw_switch_tables_namespace(struct ip_fw_chain *ch, unsigned int sets) 1655a73d728dSAlexander V. Chernikov { 1656a73d728dSAlexander V. Chernikov struct namedobj_instance *ni; 1657a73d728dSAlexander V. Chernikov struct named_object *no; 1658a73d728dSAlexander V. Chernikov struct ip_fw *rule; 1659a73d728dSAlexander V. Chernikov ipfw_insn *cmd; 1660a73d728dSAlexander V. Chernikov int cmdlen, i, l; 1661a73d728dSAlexander V. Chernikov uint16_t kidx; 1662a73d728dSAlexander V. Chernikov uint8_t type; 1663a73d728dSAlexander V. Chernikov 1664a73d728dSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1665a73d728dSAlexander V. Chernikov 1666a73d728dSAlexander V. Chernikov if (V_fw_tables_sets == sets) { 1667a73d728dSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1668a73d728dSAlexander V. Chernikov return (0); 1669a73d728dSAlexander V. Chernikov } 1670a73d728dSAlexander V. Chernikov 1671a73d728dSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1672a73d728dSAlexander V. Chernikov 167335e1bbd0SAlexander V. Chernikov /* 167435e1bbd0SAlexander V. Chernikov * Scan all rules and examine tables opcodes. 167535e1bbd0SAlexander V. Chernikov */ 1676a73d728dSAlexander V. Chernikov for (i = 0; i < ch->n_rules; i++) { 1677a73d728dSAlexander V. Chernikov rule = ch->map[i]; 1678a73d728dSAlexander V. Chernikov 1679a73d728dSAlexander V. Chernikov l = rule->cmd_len; 1680a73d728dSAlexander V. Chernikov cmd = rule->cmd; 1681a73d728dSAlexander V. Chernikov cmdlen = 0; 1682a73d728dSAlexander V. Chernikov for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 1683a73d728dSAlexander V. Chernikov cmdlen = F_LEN(cmd); 1684a73d728dSAlexander V. Chernikov 1685a73d728dSAlexander V. Chernikov if (classify_table_opcode(cmd, &kidx, &type) != 0) 1686a73d728dSAlexander V. Chernikov continue; 1687a73d728dSAlexander V. Chernikov 1688a73d728dSAlexander V. Chernikov no = ipfw_objhash_lookup_kidx(ni, kidx); 1689a73d728dSAlexander V. Chernikov 169035e1bbd0SAlexander V. Chernikov /* Check if both table object and rule has the set 0 */ 1691a73d728dSAlexander V. Chernikov if (no->set != 0 || rule->set != 0) { 1692a73d728dSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1693a73d728dSAlexander V. Chernikov return (EBUSY); 1694a73d728dSAlexander V. Chernikov } 1695a73d728dSAlexander V. Chernikov 1696a73d728dSAlexander V. Chernikov } 1697a73d728dSAlexander V. Chernikov } 1698a73d728dSAlexander V. Chernikov V_fw_tables_sets = sets; 1699a73d728dSAlexander V. Chernikov 1700a73d728dSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1701a73d728dSAlexander V. Chernikov 1702a73d728dSAlexander V. Chernikov return (0); 1703a73d728dSAlexander V. Chernikov } 1704a73d728dSAlexander V. Chernikov 1705c8d5d308SAlexander V. Chernikov /* 1706c8d5d308SAlexander V. Chernikov * Lookup an IP @addr in table @tbl. 1707c8d5d308SAlexander V. Chernikov * Stores found value in @val. 1708c8d5d308SAlexander V. Chernikov * 1709c8d5d308SAlexander V. Chernikov * Returns 1 if @addr was found. 1710c8d5d308SAlexander V. Chernikov */ 17113b3a8eb9SGleb Smirnoff int 17123b3a8eb9SGleb Smirnoff ipfw_lookup_table(struct ip_fw_chain *ch, uint16_t tbl, in_addr_t addr, 17133b3a8eb9SGleb Smirnoff uint32_t *val) 17143b3a8eb9SGleb Smirnoff { 17159f7d47b0SAlexander V. Chernikov struct table_info *ti; 17163b3a8eb9SGleb Smirnoff 1717c8d5d308SAlexander V. Chernikov ti = KIDX_TO_TI(ch, tbl); 17189f7d47b0SAlexander V. Chernikov 17199f7d47b0SAlexander V. Chernikov return (ti->lookup(ti, &addr, sizeof(in_addr_t), val)); 17203b3a8eb9SGleb Smirnoff } 17219f7d47b0SAlexander V. Chernikov 1722c8d5d308SAlexander V. Chernikov /* 1723c8d5d308SAlexander V. Chernikov * Lookup an arbtrary key @paddr of legth @plen in table @tbl. 1724c8d5d308SAlexander V. Chernikov * Stores found value in @val. 1725c8d5d308SAlexander V. Chernikov * 1726c8d5d308SAlexander V. Chernikov * Returns 1 if key was found. 1727c8d5d308SAlexander V. Chernikov */ 17289f7d47b0SAlexander V. Chernikov int 17299f7d47b0SAlexander V. Chernikov ipfw_lookup_table_extended(struct ip_fw_chain *ch, uint16_t tbl, uint16_t plen, 17309f7d47b0SAlexander V. Chernikov void *paddr, uint32_t *val) 17319f7d47b0SAlexander V. Chernikov { 17329f7d47b0SAlexander V. Chernikov struct table_info *ti; 17339f7d47b0SAlexander V. Chernikov 1734c8d5d308SAlexander V. Chernikov ti = KIDX_TO_TI(ch, tbl); 17359f7d47b0SAlexander V. Chernikov 17369f7d47b0SAlexander V. Chernikov return (ti->lookup(ti, paddr, plen, val)); 17379f7d47b0SAlexander V. Chernikov } 17389f7d47b0SAlexander V. Chernikov 17399f7d47b0SAlexander V. Chernikov /* 17409f7d47b0SAlexander V. Chernikov * Info/List/dump support for tables. 17419f7d47b0SAlexander V. Chernikov * 17429f7d47b0SAlexander V. Chernikov */ 17439f7d47b0SAlexander V. Chernikov 1744f1220db8SAlexander V. Chernikov /* 1745d3a4f924SAlexander V. Chernikov * High-level 'get' cmds sysctl handlers 1746d3a4f924SAlexander V. Chernikov */ 1747d3a4f924SAlexander V. Chernikov 1748d3a4f924SAlexander V. Chernikov /* 1749d3a4f924SAlexander V. Chernikov * Lists all tables currently available in kernel. 1750ac35ff17SAlexander V. Chernikov * Data layout (v0)(current): 1751d3a4f924SAlexander V. Chernikov * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size 1752d3a4f924SAlexander V. Chernikov * Reply: [ ipfw_obj_lheader ipfw_xtable_info x N ] 1753d3a4f924SAlexander V. Chernikov * 1754d3a4f924SAlexander V. Chernikov * Returns 0 on success 1755d3a4f924SAlexander V. Chernikov */ 1756f1220db8SAlexander V. Chernikov int 1757e822d936SAlexander V. Chernikov ipfw_list_tables(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1758e822d936SAlexander V. Chernikov struct sockopt_data *sd) 1759f1220db8SAlexander V. Chernikov { 1760f1220db8SAlexander V. Chernikov struct _ipfw_obj_lheader *olh; 1761f1220db8SAlexander V. Chernikov int error; 1762f1220db8SAlexander V. Chernikov 17632d99a349SAlexander V. Chernikov olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh)); 17642d99a349SAlexander V. Chernikov if (olh == NULL) 1765d3a4f924SAlexander V. Chernikov return (EINVAL); 176668394ec8SAlexander V. Chernikov if (sd->valsize < olh->size) 176768394ec8SAlexander V. Chernikov return (EINVAL); 1768d3a4f924SAlexander V. Chernikov 1769f1220db8SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 17702d99a349SAlexander V. Chernikov error = export_tables(ch, olh, sd); 1771f1220db8SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 1772f1220db8SAlexander V. Chernikov 1773f1220db8SAlexander V. Chernikov return (error); 1774f1220db8SAlexander V. Chernikov } 1775f1220db8SAlexander V. Chernikov 1776f1220db8SAlexander V. Chernikov /* 17772d99a349SAlexander V. Chernikov * Store table info to buffer provided by @sd. 1778ac35ff17SAlexander V. Chernikov * Data layout (v0)(current): 1779d3a4f924SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_xtable_info(empty)] 1780d3a4f924SAlexander V. Chernikov * Reply: [ ipfw_obj_header ipfw_xtable_info ] 1781d3a4f924SAlexander V. Chernikov * 1782d3a4f924SAlexander V. Chernikov * Returns 0 on success. 1783d3a4f924SAlexander V. Chernikov */ 1784d3a4f924SAlexander V. Chernikov int 1785e822d936SAlexander V. Chernikov ipfw_describe_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1786e822d936SAlexander V. Chernikov struct sockopt_data *sd) 1787d3a4f924SAlexander V. Chernikov { 1788d3a4f924SAlexander V. Chernikov struct _ipfw_obj_header *oh; 1789d3a4f924SAlexander V. Chernikov struct table_config *tc; 1790d3a4f924SAlexander V. Chernikov struct tid_info ti; 1791d3a4f924SAlexander V. Chernikov size_t sz; 1792d3a4f924SAlexander V. Chernikov 1793d3a4f924SAlexander V. Chernikov sz = sizeof(*oh) + sizeof(ipfw_xtable_info); 17942d99a349SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 17952d99a349SAlexander V. Chernikov if (oh == NULL) 1796d3a4f924SAlexander V. Chernikov return (EINVAL); 1797d3a4f924SAlexander V. Chernikov 1798d3a4f924SAlexander V. Chernikov objheader_to_ti(oh, &ti); 1799d3a4f924SAlexander V. Chernikov 1800d3a4f924SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 1801d3a4f924SAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) { 1802d3a4f924SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 1803d3a4f924SAlexander V. Chernikov return (ESRCH); 1804d3a4f924SAlexander V. Chernikov } 1805d3a4f924SAlexander V. Chernikov 1806ac35ff17SAlexander V. Chernikov export_table_info(ch, tc, (ipfw_xtable_info *)(oh + 1)); 1807d3a4f924SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 1808d3a4f924SAlexander V. Chernikov 18092d99a349SAlexander V. Chernikov return (0); 1810d3a4f924SAlexander V. Chernikov } 1811d3a4f924SAlexander V. Chernikov 1812d3a4f924SAlexander V. Chernikov /* 1813adf3b2b9SAlexander V. Chernikov * Modifies existing table. 1814adf3b2b9SAlexander V. Chernikov * Data layout (v0)(current): 1815adf3b2b9SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_xtable_info ] 1816adf3b2b9SAlexander V. Chernikov * 1817adf3b2b9SAlexander V. Chernikov * Returns 0 on success 1818adf3b2b9SAlexander V. Chernikov */ 1819adf3b2b9SAlexander V. Chernikov int 1820adf3b2b9SAlexander V. Chernikov ipfw_modify_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1821adf3b2b9SAlexander V. Chernikov struct sockopt_data *sd) 1822adf3b2b9SAlexander V. Chernikov { 1823adf3b2b9SAlexander V. Chernikov struct _ipfw_obj_header *oh; 1824adf3b2b9SAlexander V. Chernikov ipfw_xtable_info *i; 1825adf3b2b9SAlexander V. Chernikov char *tname; 1826adf3b2b9SAlexander V. Chernikov struct tid_info ti; 1827adf3b2b9SAlexander V. Chernikov struct namedobj_instance *ni; 1828adf3b2b9SAlexander V. Chernikov struct table_config *tc; 1829adf3b2b9SAlexander V. Chernikov 1830adf3b2b9SAlexander V. Chernikov if (sd->valsize != sizeof(*oh) + sizeof(ipfw_xtable_info)) 1831adf3b2b9SAlexander V. Chernikov return (EINVAL); 1832adf3b2b9SAlexander V. Chernikov 1833adf3b2b9SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)sd->kbuf; 1834adf3b2b9SAlexander V. Chernikov i = (ipfw_xtable_info *)(oh + 1); 1835adf3b2b9SAlexander V. Chernikov 1836adf3b2b9SAlexander V. Chernikov /* 1837adf3b2b9SAlexander V. Chernikov * Verify user-supplied strings. 1838adf3b2b9SAlexander V. Chernikov * Check for null-terminated/zero-length strings/ 1839adf3b2b9SAlexander V. Chernikov */ 1840adf3b2b9SAlexander V. Chernikov tname = oh->ntlv.name; 1841adf3b2b9SAlexander V. Chernikov if (ipfw_check_table_name(tname) != 0) 1842adf3b2b9SAlexander V. Chernikov return (EINVAL); 1843adf3b2b9SAlexander V. Chernikov 1844adf3b2b9SAlexander V. Chernikov objheader_to_ti(oh, &ti); 1845adf3b2b9SAlexander V. Chernikov ti.type = i->type; 1846adf3b2b9SAlexander V. Chernikov 1847adf3b2b9SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1848adf3b2b9SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1849adf3b2b9SAlexander V. Chernikov if ((tc = find_table(ni, &ti)) == NULL) { 1850adf3b2b9SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1851adf3b2b9SAlexander V. Chernikov return (ESRCH); 1852adf3b2b9SAlexander V. Chernikov } 1853fd0869d5SAlexander V. Chernikov 1854fd0869d5SAlexander V. Chernikov /* Do not support any modifications for readonly tables */ 1855fd0869d5SAlexander V. Chernikov if ((tc->ta->flags & TA_FLAG_READONLY) != 0) { 1856fd0869d5SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1857fd0869d5SAlexander V. Chernikov return (EACCES); 1858fd0869d5SAlexander V. Chernikov } 1859fd0869d5SAlexander V. Chernikov 1860adf3b2b9SAlexander V. Chernikov if ((i->mflags & IPFW_TMFLAGS_LIMIT) != 0) 1861adf3b2b9SAlexander V. Chernikov tc->limit = i->limit; 18624f43138aSAlexander V. Chernikov if ((i->mflags & IPFW_TMFLAGS_LOCK) != 0) 18634f43138aSAlexander V. Chernikov tc->locked = ((i->flags & IPFW_TGFLAGS_LOCKED) != 0); 1864adf3b2b9SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1865adf3b2b9SAlexander V. Chernikov 1866adf3b2b9SAlexander V. Chernikov return (0); 1867adf3b2b9SAlexander V. Chernikov } 1868adf3b2b9SAlexander V. Chernikov 1869adf3b2b9SAlexander V. Chernikov /* 18709490a627SAlexander V. Chernikov * Creates new table. 1871ac35ff17SAlexander V. Chernikov * Data layout (v0)(current): 18729490a627SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_xtable_info ] 18739490a627SAlexander V. Chernikov * 18749490a627SAlexander V. Chernikov * Returns 0 on success 18759490a627SAlexander V. Chernikov */ 18769490a627SAlexander V. Chernikov int 1877ac35ff17SAlexander V. Chernikov ipfw_create_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1878ac35ff17SAlexander V. Chernikov struct sockopt_data *sd) 18799490a627SAlexander V. Chernikov { 18809490a627SAlexander V. Chernikov struct _ipfw_obj_header *oh; 18819490a627SAlexander V. Chernikov ipfw_xtable_info *i; 18829490a627SAlexander V. Chernikov char *tname, *aname; 18839490a627SAlexander V. Chernikov struct tid_info ti; 18849490a627SAlexander V. Chernikov struct namedobj_instance *ni; 18859490a627SAlexander V. Chernikov struct table_config *tc; 18869490a627SAlexander V. Chernikov 1887ac35ff17SAlexander V. Chernikov if (sd->valsize != sizeof(*oh) + sizeof(ipfw_xtable_info)) 18889490a627SAlexander V. Chernikov return (EINVAL); 18899490a627SAlexander V. Chernikov 1890ac35ff17SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)sd->kbuf; 18919490a627SAlexander V. Chernikov i = (ipfw_xtable_info *)(oh + 1); 18929490a627SAlexander V. Chernikov 18939490a627SAlexander V. Chernikov /* 18949490a627SAlexander V. Chernikov * Verify user-supplied strings. 18952d99a349SAlexander V. Chernikov * Check for null-terminated/zero-length strings/ 18969490a627SAlexander V. Chernikov */ 1897ac35ff17SAlexander V. Chernikov tname = oh->ntlv.name; 18989490a627SAlexander V. Chernikov aname = i->algoname; 1899ac35ff17SAlexander V. Chernikov if (ipfw_check_table_name(tname) != 0 || 19009490a627SAlexander V. Chernikov strnlen(aname, sizeof(i->algoname)) == sizeof(i->algoname)) 19019490a627SAlexander V. Chernikov return (EINVAL); 19029490a627SAlexander V. Chernikov 19039490a627SAlexander V. Chernikov if (aname[0] == '\0') { 19049490a627SAlexander V. Chernikov /* Use default algorithm */ 19059490a627SAlexander V. Chernikov aname = NULL; 19069490a627SAlexander V. Chernikov } 19079490a627SAlexander V. Chernikov 19089490a627SAlexander V. Chernikov objheader_to_ti(oh, &ti); 1909ac35ff17SAlexander V. Chernikov ti.type = i->type; 19109490a627SAlexander V. Chernikov 19119490a627SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 19129490a627SAlexander V. Chernikov 19139490a627SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 19149490a627SAlexander V. Chernikov if ((tc = find_table(ni, &ti)) != NULL) { 19159490a627SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 19169490a627SAlexander V. Chernikov return (EEXIST); 19179490a627SAlexander V. Chernikov } 19189490a627SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 19199490a627SAlexander V. Chernikov 1920867708f7SAlexander V. Chernikov return (create_table_internal(ch, &ti, aname, i, NULL, 0)); 1921db785d31SAlexander V. Chernikov } 1922db785d31SAlexander V. Chernikov 1923db785d31SAlexander V. Chernikov /* 1924db785d31SAlexander V. Chernikov * Creates new table based on @ti and @aname. 1925db785d31SAlexander V. Chernikov * 1926db785d31SAlexander V. Chernikov * Relies on table name checking inside find_name_tlv() 1927db785d31SAlexander V. Chernikov * Assume @aname to be checked and valid. 1928867708f7SAlexander V. Chernikov * Stores allocated table kidx inside @pkidx (if non-NULL). 19290468c5baSAlexander V. Chernikov * Reference created table if @compat is non-zero. 1930db785d31SAlexander V. Chernikov * 1931db785d31SAlexander V. Chernikov * Returns 0 on success. 1932db785d31SAlexander V. Chernikov */ 1933db785d31SAlexander V. Chernikov static int 1934db785d31SAlexander V. Chernikov create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti, 1935867708f7SAlexander V. Chernikov char *aname, ipfw_xtable_info *i, uint16_t *pkidx, int compat) 1936db785d31SAlexander V. Chernikov { 1937db785d31SAlexander V. Chernikov struct namedobj_instance *ni; 1938c8d5d308SAlexander V. Chernikov struct table_config *tc, *tc_new, *tmp; 1939db785d31SAlexander V. Chernikov struct table_algo *ta; 1940db785d31SAlexander V. Chernikov uint16_t kidx; 1941db785d31SAlexander V. Chernikov 1942db785d31SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1943db785d31SAlexander V. Chernikov 1944db785d31SAlexander V. Chernikov ta = find_table_algo(CHAIN_TO_TCFG(ch), ti, aname); 19459490a627SAlexander V. Chernikov if (ta == NULL) 19469490a627SAlexander V. Chernikov return (ENOTSUP); 19479490a627SAlexander V. Chernikov 19480cba2b28SAlexander V. Chernikov tc = alloc_table_config(ch, ti, ta, aname, i->tflags); 19494c0c07a5SAlexander V. Chernikov if (tc == NULL) 19509490a627SAlexander V. Chernikov return (ENOMEM); 19519490a627SAlexander V. Chernikov 19520cba2b28SAlexander V. Chernikov tc->vmask = i->vmask; 19534c0c07a5SAlexander V. Chernikov tc->limit = i->limit; 1954fd0869d5SAlexander V. Chernikov if (ta->flags & TA_FLAG_READONLY) 1955fd0869d5SAlexander V. Chernikov tc->locked = 1; 1956fd0869d5SAlexander V. Chernikov else 19574f43138aSAlexander V. Chernikov tc->locked = (i->flags & IPFW_TGFLAGS_LOCKED) != 0; 19584c0c07a5SAlexander V. Chernikov 19599490a627SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1960db785d31SAlexander V. Chernikov 1961db785d31SAlexander V. Chernikov /* Check if table has been already created */ 19620468c5baSAlexander V. Chernikov tc_new = find_table(ni, ti); 19630468c5baSAlexander V. Chernikov if (tc_new != NULL) { 19640468c5baSAlexander V. Chernikov 19650468c5baSAlexander V. Chernikov /* 19660468c5baSAlexander V. Chernikov * Compat: do not fail if we're 19670468c5baSAlexander V. Chernikov * requesting to create existing table 19680cba2b28SAlexander V. Chernikov * which has the same type 19690468c5baSAlexander V. Chernikov */ 19700cba2b28SAlexander V. Chernikov if (compat == 0 || tc_new->no.type != tc->no.type) { 1971db785d31SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1972db785d31SAlexander V. Chernikov free_table_config(ni, tc); 1973db785d31SAlexander V. Chernikov return (EEXIST); 1974db785d31SAlexander V. Chernikov } 1975db785d31SAlexander V. Chernikov 19760468c5baSAlexander V. Chernikov /* Exchange tc and tc_new for proper refcounting & freeing */ 19770468c5baSAlexander V. Chernikov tmp = tc; 19780468c5baSAlexander V. Chernikov tc = tc_new; 19790468c5baSAlexander V. Chernikov tc_new = tmp; 19800468c5baSAlexander V. Chernikov } else { 19810468c5baSAlexander V. Chernikov /* New table */ 1982ac35ff17SAlexander V. Chernikov if (ipfw_objhash_alloc_idx(ni, &kidx) != 0) { 19839490a627SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1984db785d31SAlexander V. Chernikov printf("Unable to allocate table index." 1985db785d31SAlexander V. Chernikov " Consider increasing net.inet.ip.fw.tables_max"); 19869490a627SAlexander V. Chernikov free_table_config(ni, tc); 19879490a627SAlexander V. Chernikov return (EBUSY); 19889490a627SAlexander V. Chernikov } 19899490a627SAlexander V. Chernikov tc->no.kidx = kidx; 19909490a627SAlexander V. Chernikov 19919490a627SAlexander V. Chernikov IPFW_WLOCK(ch); 19929490a627SAlexander V. Chernikov link_table(ch, tc); 19939490a627SAlexander V. Chernikov IPFW_WUNLOCK(ch); 19940468c5baSAlexander V. Chernikov } 19950468c5baSAlexander V. Chernikov 19960468c5baSAlexander V. Chernikov if (compat != 0) 19970468c5baSAlexander V. Chernikov tc->no.refcnt++; 19980468c5baSAlexander V. Chernikov if (pkidx != NULL) 19990468c5baSAlexander V. Chernikov *pkidx = tc->no.kidx; 20009490a627SAlexander V. Chernikov 20019490a627SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 20029490a627SAlexander V. Chernikov 20030468c5baSAlexander V. Chernikov if (tc_new != NULL) 20040468c5baSAlexander V. Chernikov free_table_config(ni, tc_new); 20050468c5baSAlexander V. Chernikov 20069490a627SAlexander V. Chernikov return (0); 20079490a627SAlexander V. Chernikov } 20089490a627SAlexander V. Chernikov 200946d52008SAlexander V. Chernikov static void 201046d52008SAlexander V. Chernikov ntlv_to_ti(ipfw_obj_ntlv *ntlv, struct tid_info *ti) 2011d3a4f924SAlexander V. Chernikov { 2012d3a4f924SAlexander V. Chernikov 2013d3a4f924SAlexander V. Chernikov memset(ti, 0, sizeof(struct tid_info)); 201446d52008SAlexander V. Chernikov ti->set = ntlv->set; 201546d52008SAlexander V. Chernikov ti->uidx = ntlv->idx; 201646d52008SAlexander V. Chernikov ti->tlvs = ntlv; 201746d52008SAlexander V. Chernikov ti->tlen = ntlv->head.length; 201846d52008SAlexander V. Chernikov } 201946d52008SAlexander V. Chernikov 202046d52008SAlexander V. Chernikov static void 202146d52008SAlexander V. Chernikov objheader_to_ti(struct _ipfw_obj_header *oh, struct tid_info *ti) 202246d52008SAlexander V. Chernikov { 202346d52008SAlexander V. Chernikov 202446d52008SAlexander V. Chernikov ntlv_to_ti(&oh->ntlv, ti); 2025d3a4f924SAlexander V. Chernikov } 2026d3a4f924SAlexander V. Chernikov 202735e1bbd0SAlexander V. Chernikov /* 202835e1bbd0SAlexander V. Chernikov * Exports basic table info as name TLV. 202935e1bbd0SAlexander V. Chernikov * Used inside dump_static_rules() to provide info 203035e1bbd0SAlexander V. Chernikov * about all tables referenced by current ruleset. 203135e1bbd0SAlexander V. Chernikov * 203235e1bbd0SAlexander V. Chernikov * Returns 0 on success. 203335e1bbd0SAlexander V. Chernikov */ 2034563b5ab1SAlexander V. Chernikov int 2035563b5ab1SAlexander V. Chernikov ipfw_export_table_ntlv(struct ip_fw_chain *ch, uint16_t kidx, 2036563b5ab1SAlexander V. Chernikov struct sockopt_data *sd) 2037563b5ab1SAlexander V. Chernikov { 2038563b5ab1SAlexander V. Chernikov struct namedobj_instance *ni; 2039563b5ab1SAlexander V. Chernikov struct named_object *no; 2040563b5ab1SAlexander V. Chernikov ipfw_obj_ntlv *ntlv; 2041563b5ab1SAlexander V. Chernikov 2042563b5ab1SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 2043563b5ab1SAlexander V. Chernikov 2044ac35ff17SAlexander V. Chernikov no = ipfw_objhash_lookup_kidx(ni, kidx); 2045563b5ab1SAlexander V. Chernikov KASSERT(no != NULL, ("invalid table kidx passed")); 2046563b5ab1SAlexander V. Chernikov 2047563b5ab1SAlexander V. Chernikov ntlv = (ipfw_obj_ntlv *)ipfw_get_sopt_space(sd, sizeof(*ntlv)); 2048563b5ab1SAlexander V. Chernikov if (ntlv == NULL) 2049563b5ab1SAlexander V. Chernikov return (ENOMEM); 2050563b5ab1SAlexander V. Chernikov 2051563b5ab1SAlexander V. Chernikov ntlv->head.type = IPFW_TLV_TBL_NAME; 2052563b5ab1SAlexander V. Chernikov ntlv->head.length = sizeof(*ntlv); 2053563b5ab1SAlexander V. Chernikov ntlv->idx = no->kidx; 2054563b5ab1SAlexander V. Chernikov strlcpy(ntlv->name, no->name, sizeof(ntlv->name)); 2055563b5ab1SAlexander V. Chernikov 2056563b5ab1SAlexander V. Chernikov return (0); 2057563b5ab1SAlexander V. Chernikov } 2058563b5ab1SAlexander V. Chernikov 205935e1bbd0SAlexander V. Chernikov /* 2060f99fbf96SAlexander V. Chernikov * Marks every table kidx used in @rule with bit in @bmask. 2061f99fbf96SAlexander V. Chernikov * Used to generate bitmask of referenced tables for given ruleset. 2062f99fbf96SAlexander V. Chernikov * 2063f99fbf96SAlexander V. Chernikov * Returns number of newly-referenced tables. 2064f99fbf96SAlexander V. Chernikov */ 2065f99fbf96SAlexander V. Chernikov int 2066f99fbf96SAlexander V. Chernikov ipfw_mark_table_kidx(struct ip_fw_chain *chain, struct ip_fw *rule, 2067f99fbf96SAlexander V. Chernikov uint32_t *bmask) 2068f99fbf96SAlexander V. Chernikov { 2069f99fbf96SAlexander V. Chernikov int cmdlen, l, count; 2070f99fbf96SAlexander V. Chernikov ipfw_insn *cmd; 2071f99fbf96SAlexander V. Chernikov uint16_t kidx; 2072f99fbf96SAlexander V. Chernikov uint8_t type; 2073f99fbf96SAlexander V. Chernikov 2074f99fbf96SAlexander V. Chernikov l = rule->cmd_len; 2075f99fbf96SAlexander V. Chernikov cmd = rule->cmd; 2076f99fbf96SAlexander V. Chernikov cmdlen = 0; 2077f99fbf96SAlexander V. Chernikov count = 0; 2078f99fbf96SAlexander V. Chernikov for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 2079f99fbf96SAlexander V. Chernikov cmdlen = F_LEN(cmd); 2080f99fbf96SAlexander V. Chernikov 2081f99fbf96SAlexander V. Chernikov if (classify_table_opcode(cmd, &kidx, &type) != 0) 2082f99fbf96SAlexander V. Chernikov continue; 2083f99fbf96SAlexander V. Chernikov 2084f99fbf96SAlexander V. Chernikov if ((bmask[kidx / 32] & (1 << (kidx % 32))) == 0) 2085f99fbf96SAlexander V. Chernikov count++; 2086f99fbf96SAlexander V. Chernikov 2087f99fbf96SAlexander V. Chernikov bmask[kidx / 32] |= 1 << (kidx % 32); 2088f99fbf96SAlexander V. Chernikov } 2089f99fbf96SAlexander V. Chernikov 2090f99fbf96SAlexander V. Chernikov return (count); 2091f99fbf96SAlexander V. Chernikov } 2092f99fbf96SAlexander V. Chernikov 2093d3b00c08SAlexander V. Chernikov struct dump_args { 20940cba2b28SAlexander V. Chernikov struct ip_fw_chain *ch; 2095d3b00c08SAlexander V. Chernikov struct table_info *ti; 2096d3b00c08SAlexander V. Chernikov struct table_config *tc; 2097d3b00c08SAlexander V. Chernikov struct sockopt_data *sd; 2098d3b00c08SAlexander V. Chernikov uint32_t cnt; 2099d3b00c08SAlexander V. Chernikov uint16_t uidx; 2100d3b00c08SAlexander V. Chernikov int error; 2101d3b00c08SAlexander V. Chernikov uint32_t size; 21024dff4ae0SAlexander V. Chernikov ipfw_table_entry *ent; 21034dff4ae0SAlexander V. Chernikov ta_foreach_f *f; 21044dff4ae0SAlexander V. Chernikov void *farg; 2105d3b00c08SAlexander V. Chernikov ipfw_obj_tentry tent; 2106d3b00c08SAlexander V. Chernikov }; 2107d3b00c08SAlexander V. Chernikov 2108d3b00c08SAlexander V. Chernikov static int 2109d3b00c08SAlexander V. Chernikov count_ext_entries(void *e, void *arg) 2110d3b00c08SAlexander V. Chernikov { 2111d3b00c08SAlexander V. Chernikov struct dump_args *da; 2112d3b00c08SAlexander V. Chernikov 2113d3b00c08SAlexander V. Chernikov da = (struct dump_args *)arg; 2114d3b00c08SAlexander V. Chernikov da->cnt++; 2115d3b00c08SAlexander V. Chernikov 2116d3b00c08SAlexander V. Chernikov return (0); 2117d3b00c08SAlexander V. Chernikov } 2118d3b00c08SAlexander V. Chernikov 2119d3b00c08SAlexander V. Chernikov /* 2120d3b00c08SAlexander V. Chernikov * Gets number of items from table either using 2121d3b00c08SAlexander V. Chernikov * internal counter or calling algo callback for 2122d3b00c08SAlexander V. Chernikov * externally-managed tables. 2123d3b00c08SAlexander V. Chernikov * 2124d3b00c08SAlexander V. Chernikov * Returns number of records. 2125d3b00c08SAlexander V. Chernikov */ 2126d3b00c08SAlexander V. Chernikov static uint32_t 2127d3b00c08SAlexander V. Chernikov table_get_count(struct ip_fw_chain *ch, struct table_config *tc) 2128d3b00c08SAlexander V. Chernikov { 2129d3b00c08SAlexander V. Chernikov struct table_info *ti; 2130d3b00c08SAlexander V. Chernikov struct table_algo *ta; 2131d3b00c08SAlexander V. Chernikov struct dump_args da; 2132d3b00c08SAlexander V. Chernikov 2133d3b00c08SAlexander V. Chernikov ti = KIDX_TO_TI(ch, tc->no.kidx); 2134d3b00c08SAlexander V. Chernikov ta = tc->ta; 2135d3b00c08SAlexander V. Chernikov 2136d3b00c08SAlexander V. Chernikov /* Use internal counter for self-managed tables */ 2137d3b00c08SAlexander V. Chernikov if ((ta->flags & TA_FLAG_READONLY) == 0) 2138d3b00c08SAlexander V. Chernikov return (tc->count); 2139d3b00c08SAlexander V. Chernikov 2140d3b00c08SAlexander V. Chernikov /* Use callback to quickly get number of items */ 2141d3b00c08SAlexander V. Chernikov if ((ta->flags & TA_FLAG_EXTCOUNTER) != 0) 2142d3b00c08SAlexander V. Chernikov return (ta->get_count(tc->astate, ti)); 2143d3b00c08SAlexander V. Chernikov 2144d3b00c08SAlexander V. Chernikov /* Count number of iterms ourselves */ 2145d3b00c08SAlexander V. Chernikov memset(&da, 0, sizeof(da)); 2146d3b00c08SAlexander V. Chernikov ta->foreach(tc->astate, ti, count_ext_entries, &da); 2147d3b00c08SAlexander V. Chernikov 2148d3b00c08SAlexander V. Chernikov return (da.cnt); 2149d3b00c08SAlexander V. Chernikov } 2150f99fbf96SAlexander V. Chernikov 2151f99fbf96SAlexander V. Chernikov /* 215235e1bbd0SAlexander V. Chernikov * Exports table @tc info into standard ipfw_xtable_info format. 215335e1bbd0SAlexander V. Chernikov */ 21549f7d47b0SAlexander V. Chernikov static void 2155ac35ff17SAlexander V. Chernikov export_table_info(struct ip_fw_chain *ch, struct table_config *tc, 2156ac35ff17SAlexander V. Chernikov ipfw_xtable_info *i) 21579f7d47b0SAlexander V. Chernikov { 2158ac35ff17SAlexander V. Chernikov struct table_info *ti; 21595f379342SAlexander V. Chernikov struct table_algo *ta; 21609f7d47b0SAlexander V. Chernikov 21619f7d47b0SAlexander V. Chernikov i->type = tc->no.type; 2162914bffb6SAlexander V. Chernikov i->tflags = tc->tflags; 21630cba2b28SAlexander V. Chernikov i->vmask = tc->vmask; 21649f7d47b0SAlexander V. Chernikov i->set = tc->no.set; 21659f7d47b0SAlexander V. Chernikov i->kidx = tc->no.kidx; 21669f7d47b0SAlexander V. Chernikov i->refcnt = tc->no.refcnt; 2167d3b00c08SAlexander V. Chernikov i->count = table_get_count(ch, tc); 21684c0c07a5SAlexander V. Chernikov i->limit = tc->limit; 21694f43138aSAlexander V. Chernikov i->flags |= (tc->locked != 0) ? IPFW_TGFLAGS_LOCKED : 0; 217081d3153dSAlexander V. Chernikov i->size = tc->count * sizeof(ipfw_obj_tentry); 2171f1220db8SAlexander V. Chernikov i->size += sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info); 21729f7d47b0SAlexander V. Chernikov strlcpy(i->tablename, tc->tablename, sizeof(i->tablename)); 2173ac35ff17SAlexander V. Chernikov ti = KIDX_TO_TI(ch, tc->no.kidx); 21745f379342SAlexander V. Chernikov ta = tc->ta; 21755f379342SAlexander V. Chernikov if (ta->print_config != NULL) { 21765f379342SAlexander V. Chernikov /* Use algo function to print table config to string */ 21775f379342SAlexander V. Chernikov ta->print_config(tc->astate, ti, i->algoname, 2178ac35ff17SAlexander V. Chernikov sizeof(i->algoname)); 2179ac35ff17SAlexander V. Chernikov } else 21805f379342SAlexander V. Chernikov strlcpy(i->algoname, ta->name, sizeof(i->algoname)); 21815f379342SAlexander V. Chernikov /* Dump algo-specific data, if possible */ 21825f379342SAlexander V. Chernikov if (ta->dump_tinfo != NULL) { 21835f379342SAlexander V. Chernikov ta->dump_tinfo(tc->astate, ti, &i->ta_info); 21845f379342SAlexander V. Chernikov i->ta_info.flags |= IPFW_TATFLAGS_DATA; 21855f379342SAlexander V. Chernikov } 21869f7d47b0SAlexander V. Chernikov } 21879f7d47b0SAlexander V. Chernikov 2188ac35ff17SAlexander V. Chernikov struct dump_table_args { 2189ac35ff17SAlexander V. Chernikov struct ip_fw_chain *ch; 2190ac35ff17SAlexander V. Chernikov struct sockopt_data *sd; 2191ac35ff17SAlexander V. Chernikov }; 2192ac35ff17SAlexander V. Chernikov 21939f7d47b0SAlexander V. Chernikov static void 21949f7d47b0SAlexander V. Chernikov export_table_internal(struct namedobj_instance *ni, struct named_object *no, 21959f7d47b0SAlexander V. Chernikov void *arg) 21963b3a8eb9SGleb Smirnoff { 21979f7d47b0SAlexander V. Chernikov ipfw_xtable_info *i; 2198ac35ff17SAlexander V. Chernikov struct dump_table_args *dta; 21993b3a8eb9SGleb Smirnoff 2200ac35ff17SAlexander V. Chernikov dta = (struct dump_table_args *)arg; 2201ac35ff17SAlexander V. Chernikov 2202ac35ff17SAlexander V. Chernikov i = (ipfw_xtable_info *)ipfw_get_sopt_space(dta->sd, sizeof(*i)); 220368394ec8SAlexander V. Chernikov KASSERT(i != 0, ("previously checked buffer is not enough")); 22049f7d47b0SAlexander V. Chernikov 2205ac35ff17SAlexander V. Chernikov export_table_info(dta->ch, (struct table_config *)no, i); 22069f7d47b0SAlexander V. Chernikov } 22079f7d47b0SAlexander V. Chernikov 2208f1220db8SAlexander V. Chernikov /* 2209f1220db8SAlexander V. Chernikov * Export all tables as ipfw_xtable_info structures to 22102d99a349SAlexander V. Chernikov * storage provided by @sd. 221128ea4fa3SAlexander V. Chernikov * 221228ea4fa3SAlexander V. Chernikov * If supplied buffer is too small, fills in required size 221328ea4fa3SAlexander V. Chernikov * and returns ENOMEM. 2214f1220db8SAlexander V. Chernikov * Returns 0 on success. 2215f1220db8SAlexander V. Chernikov */ 2216f1220db8SAlexander V. Chernikov static int 22172d99a349SAlexander V. Chernikov export_tables(struct ip_fw_chain *ch, ipfw_obj_lheader *olh, 22182d99a349SAlexander V. Chernikov struct sockopt_data *sd) 22199f7d47b0SAlexander V. Chernikov { 22209f7d47b0SAlexander V. Chernikov uint32_t size; 22219f7d47b0SAlexander V. Chernikov uint32_t count; 2222ac35ff17SAlexander V. Chernikov struct dump_table_args dta; 22239f7d47b0SAlexander V. Chernikov 22249f7d47b0SAlexander V. Chernikov count = ipfw_objhash_count(CHAIN_TO_NI(ch)); 22259f7d47b0SAlexander V. Chernikov size = count * sizeof(ipfw_xtable_info) + sizeof(ipfw_obj_lheader); 22262d99a349SAlexander V. Chernikov 22272d99a349SAlexander V. Chernikov /* Fill in header regadless of buffer size */ 2228f1220db8SAlexander V. Chernikov olh->count = count; 2229f1220db8SAlexander V. Chernikov olh->objsize = sizeof(ipfw_xtable_info); 22302d99a349SAlexander V. Chernikov 22312d99a349SAlexander V. Chernikov if (size > olh->size) { 22322d99a349SAlexander V. Chernikov olh->size = size; 22339f7d47b0SAlexander V. Chernikov return (ENOMEM); 2234f1220db8SAlexander V. Chernikov } 223568394ec8SAlexander V. Chernikov 22369f7d47b0SAlexander V. Chernikov olh->size = size; 22372d99a349SAlexander V. Chernikov 2238ac35ff17SAlexander V. Chernikov dta.ch = ch; 2239ac35ff17SAlexander V. Chernikov dta.sd = sd; 2240ac35ff17SAlexander V. Chernikov 2241ac35ff17SAlexander V. Chernikov ipfw_objhash_foreach(CHAIN_TO_NI(ch), export_table_internal, &dta); 22429f7d47b0SAlexander V. Chernikov 22433b3a8eb9SGleb Smirnoff return (0); 22443b3a8eb9SGleb Smirnoff } 22453b3a8eb9SGleb Smirnoff 2246f99fbf96SAlexander V. Chernikov int 2247f99fbf96SAlexander V. Chernikov ipfw_dump_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 2248f99fbf96SAlexander V. Chernikov struct sockopt_data *sd) 2249f99fbf96SAlexander V. Chernikov { 2250f99fbf96SAlexander V. Chernikov int error; 2251f99fbf96SAlexander V. Chernikov 2252f99fbf96SAlexander V. Chernikov switch (op3->version) { 2253f99fbf96SAlexander V. Chernikov case 0: 2254f99fbf96SAlexander V. Chernikov error = ipfw_dump_table_v0(ch, sd); 2255f99fbf96SAlexander V. Chernikov break; 2256f99fbf96SAlexander V. Chernikov case 1: 2257f99fbf96SAlexander V. Chernikov error = ipfw_dump_table_v1(ch, sd); 2258f99fbf96SAlexander V. Chernikov break; 2259f99fbf96SAlexander V. Chernikov default: 2260f99fbf96SAlexander V. Chernikov error = ENOTSUP; 2261f99fbf96SAlexander V. Chernikov } 2262f99fbf96SAlexander V. Chernikov 2263f99fbf96SAlexander V. Chernikov return (error); 2264f99fbf96SAlexander V. Chernikov } 2265f99fbf96SAlexander V. Chernikov 2266f99fbf96SAlexander V. Chernikov /* 2267f99fbf96SAlexander V. Chernikov * Dumps all table data 2268f99fbf96SAlexander V. Chernikov * Data layout (v1)(current): 2269f99fbf96SAlexander V. Chernikov * Request: [ ipfw_obj_header ], size = ipfw_xtable_info.size 2270f99fbf96SAlexander V. Chernikov * Reply: [ ipfw_obj_header ipfw_xtable_info ipfw_obj_tentry x N ] 2271f99fbf96SAlexander V. Chernikov * 2272f99fbf96SAlexander V. Chernikov * Returns 0 on success 2273f99fbf96SAlexander V. Chernikov */ 2274f99fbf96SAlexander V. Chernikov static int 2275f99fbf96SAlexander V. Chernikov ipfw_dump_table_v1(struct ip_fw_chain *ch, struct sockopt_data *sd) 2276f99fbf96SAlexander V. Chernikov { 2277f99fbf96SAlexander V. Chernikov struct _ipfw_obj_header *oh; 2278f99fbf96SAlexander V. Chernikov ipfw_xtable_info *i; 2279f99fbf96SAlexander V. Chernikov struct tid_info ti; 2280f99fbf96SAlexander V. Chernikov struct table_config *tc; 2281f99fbf96SAlexander V. Chernikov struct table_algo *ta; 2282f99fbf96SAlexander V. Chernikov struct dump_args da; 2283f99fbf96SAlexander V. Chernikov uint32_t sz; 2284f99fbf96SAlexander V. Chernikov 2285f99fbf96SAlexander V. Chernikov sz = sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info); 2286f99fbf96SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 2287f99fbf96SAlexander V. Chernikov if (oh == NULL) 2288f99fbf96SAlexander V. Chernikov return (EINVAL); 2289f99fbf96SAlexander V. Chernikov 2290f99fbf96SAlexander V. Chernikov i = (ipfw_xtable_info *)(oh + 1); 2291f99fbf96SAlexander V. Chernikov objheader_to_ti(oh, &ti); 2292f99fbf96SAlexander V. Chernikov 2293f99fbf96SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 2294f99fbf96SAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) { 2295f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2296f99fbf96SAlexander V. Chernikov return (ESRCH); 2297f99fbf96SAlexander V. Chernikov } 2298f99fbf96SAlexander V. Chernikov export_table_info(ch, tc, i); 2299f99fbf96SAlexander V. Chernikov 2300f99fbf96SAlexander V. Chernikov if (sd->valsize < i->size) { 2301f99fbf96SAlexander V. Chernikov 2302f99fbf96SAlexander V. Chernikov /* 2303f99fbf96SAlexander V. Chernikov * Submitted buffer size is not enough. 2304f99fbf96SAlexander V. Chernikov * WE've already filled in @i structure with 2305f99fbf96SAlexander V. Chernikov * relevant table info including size, so we 2306f99fbf96SAlexander V. Chernikov * can return. Buffer will be flushed automatically. 2307f99fbf96SAlexander V. Chernikov */ 2308f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2309f99fbf96SAlexander V. Chernikov return (ENOMEM); 2310f99fbf96SAlexander V. Chernikov } 2311f99fbf96SAlexander V. Chernikov 2312f99fbf96SAlexander V. Chernikov /* 2313f99fbf96SAlexander V. Chernikov * Do the actual dump in eXtended format 2314f99fbf96SAlexander V. Chernikov */ 2315f99fbf96SAlexander V. Chernikov memset(&da, 0, sizeof(da)); 23160cba2b28SAlexander V. Chernikov da.ch = ch; 2317f99fbf96SAlexander V. Chernikov da.ti = KIDX_TO_TI(ch, tc->no.kidx); 2318f99fbf96SAlexander V. Chernikov da.tc = tc; 2319f99fbf96SAlexander V. Chernikov da.sd = sd; 2320f99fbf96SAlexander V. Chernikov 2321f99fbf96SAlexander V. Chernikov ta = tc->ta; 2322f99fbf96SAlexander V. Chernikov 2323f99fbf96SAlexander V. Chernikov ta->foreach(tc->astate, da.ti, dump_table_tentry, &da); 2324f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2325f99fbf96SAlexander V. Chernikov 2326f99fbf96SAlexander V. Chernikov return (da.error); 2327f99fbf96SAlexander V. Chernikov } 2328f99fbf96SAlexander V. Chernikov 2329f99fbf96SAlexander V. Chernikov /* 2330f99fbf96SAlexander V. Chernikov * Dumps all table data 2331f99fbf96SAlexander V. Chernikov * Data layout (version 0)(legacy): 2332f99fbf96SAlexander V. Chernikov * Request: [ ipfw_xtable ], size = IP_FW_TABLE_XGETSIZE() 2333f99fbf96SAlexander V. Chernikov * Reply: [ ipfw_xtable ipfw_table_xentry x N ] 2334f99fbf96SAlexander V. Chernikov * 2335f99fbf96SAlexander V. Chernikov * Returns 0 on success 2336f99fbf96SAlexander V. Chernikov */ 2337f99fbf96SAlexander V. Chernikov static int 2338f99fbf96SAlexander V. Chernikov ipfw_dump_table_v0(struct ip_fw_chain *ch, struct sockopt_data *sd) 2339f99fbf96SAlexander V. Chernikov { 2340f99fbf96SAlexander V. Chernikov ipfw_xtable *xtbl; 2341f99fbf96SAlexander V. Chernikov struct tid_info ti; 2342f99fbf96SAlexander V. Chernikov struct table_config *tc; 2343f99fbf96SAlexander V. Chernikov struct table_algo *ta; 2344f99fbf96SAlexander V. Chernikov struct dump_args da; 2345d3b00c08SAlexander V. Chernikov size_t sz, count; 2346f99fbf96SAlexander V. Chernikov 2347f99fbf96SAlexander V. Chernikov xtbl = (ipfw_xtable *)ipfw_get_sopt_header(sd, sizeof(ipfw_xtable)); 2348f99fbf96SAlexander V. Chernikov if (xtbl == NULL) 2349f99fbf96SAlexander V. Chernikov return (EINVAL); 2350f99fbf96SAlexander V. Chernikov 2351f99fbf96SAlexander V. Chernikov memset(&ti, 0, sizeof(ti)); 2352f99fbf96SAlexander V. Chernikov ti.uidx = xtbl->tbl; 2353f99fbf96SAlexander V. Chernikov 2354f99fbf96SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 2355f99fbf96SAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) { 2356f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2357f99fbf96SAlexander V. Chernikov return (0); 2358f99fbf96SAlexander V. Chernikov } 2359d3b00c08SAlexander V. Chernikov count = table_get_count(ch, tc); 2360d3b00c08SAlexander V. Chernikov sz = count * sizeof(ipfw_table_xentry) + sizeof(ipfw_xtable); 2361f99fbf96SAlexander V. Chernikov 2362d3b00c08SAlexander V. Chernikov xtbl->cnt = count; 2363f99fbf96SAlexander V. Chernikov xtbl->size = sz; 2364f99fbf96SAlexander V. Chernikov xtbl->type = tc->no.type; 2365f99fbf96SAlexander V. Chernikov xtbl->tbl = ti.uidx; 2366f99fbf96SAlexander V. Chernikov 2367f99fbf96SAlexander V. Chernikov if (sd->valsize < sz) { 2368f99fbf96SAlexander V. Chernikov 2369f99fbf96SAlexander V. Chernikov /* 2370f99fbf96SAlexander V. Chernikov * Submitted buffer size is not enough. 2371f99fbf96SAlexander V. Chernikov * WE've already filled in @i structure with 2372f99fbf96SAlexander V. Chernikov * relevant table info including size, so we 2373f99fbf96SAlexander V. Chernikov * can return. Buffer will be flushed automatically. 2374f99fbf96SAlexander V. Chernikov */ 2375f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2376f99fbf96SAlexander V. Chernikov return (ENOMEM); 2377f99fbf96SAlexander V. Chernikov } 2378f99fbf96SAlexander V. Chernikov 2379f99fbf96SAlexander V. Chernikov /* Do the actual dump in eXtended format */ 2380f99fbf96SAlexander V. Chernikov memset(&da, 0, sizeof(da)); 23810cba2b28SAlexander V. Chernikov da.ch = ch; 2382f99fbf96SAlexander V. Chernikov da.ti = KIDX_TO_TI(ch, tc->no.kidx); 2383f99fbf96SAlexander V. Chernikov da.tc = tc; 2384f99fbf96SAlexander V. Chernikov da.sd = sd; 2385f99fbf96SAlexander V. Chernikov 2386f99fbf96SAlexander V. Chernikov ta = tc->ta; 2387f99fbf96SAlexander V. Chernikov 2388f99fbf96SAlexander V. Chernikov ta->foreach(tc->astate, da.ti, dump_table_xentry, &da); 2389f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2390f99fbf96SAlexander V. Chernikov 2391f99fbf96SAlexander V. Chernikov return (0); 2392f99fbf96SAlexander V. Chernikov } 2393f99fbf96SAlexander V. Chernikov 239481d3153dSAlexander V. Chernikov /* 2395e822d936SAlexander V. Chernikov * Legacy function to retrieve number of items in table. 2396e822d936SAlexander V. Chernikov */ 2397e822d936SAlexander V. Chernikov int 2398e822d936SAlexander V. Chernikov ipfw_get_table_size(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 2399e822d936SAlexander V. Chernikov struct sockopt_data *sd) 2400e822d936SAlexander V. Chernikov { 2401e822d936SAlexander V. Chernikov uint32_t *tbl; 2402e822d936SAlexander V. Chernikov struct tid_info ti; 2403e822d936SAlexander V. Chernikov size_t sz; 2404e822d936SAlexander V. Chernikov int error; 2405e822d936SAlexander V. Chernikov 2406e822d936SAlexander V. Chernikov sz = sizeof(*op3) + sizeof(uint32_t); 2407e822d936SAlexander V. Chernikov op3 = (ip_fw3_opheader *)ipfw_get_sopt_header(sd, sz); 2408e822d936SAlexander V. Chernikov if (op3 == NULL) 2409e822d936SAlexander V. Chernikov return (EINVAL); 2410e822d936SAlexander V. Chernikov 2411e822d936SAlexander V. Chernikov tbl = (uint32_t *)(op3 + 1); 2412e822d936SAlexander V. Chernikov memset(&ti, 0, sizeof(ti)); 2413e822d936SAlexander V. Chernikov ti.uidx = *tbl; 2414e822d936SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 2415e822d936SAlexander V. Chernikov error = ipfw_count_xtable(ch, &ti, tbl); 2416e822d936SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2417e822d936SAlexander V. Chernikov return (error); 2418e822d936SAlexander V. Chernikov } 2419e822d936SAlexander V. Chernikov 2420e822d936SAlexander V. Chernikov /* 242181d3153dSAlexander V. Chernikov * Legacy IP_FW_TABLE_GETSIZE handler 242281d3153dSAlexander V. Chernikov */ 24233b3a8eb9SGleb Smirnoff int 2424b074b7bbSAlexander V. Chernikov ipfw_count_table(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt) 24253b3a8eb9SGleb Smirnoff { 2426b074b7bbSAlexander V. Chernikov struct table_config *tc; 24273b3a8eb9SGleb Smirnoff 2428b074b7bbSAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) 2429b074b7bbSAlexander V. Chernikov return (ESRCH); 2430d3b00c08SAlexander V. Chernikov *cnt = table_get_count(ch, tc); 24313b3a8eb9SGleb Smirnoff return (0); 24323b3a8eb9SGleb Smirnoff } 24333b3a8eb9SGleb Smirnoff 243481d3153dSAlexander V. Chernikov /* 243581d3153dSAlexander V. Chernikov * Legacy IP_FW_TABLE_XGETSIZE handler 243681d3153dSAlexander V. Chernikov */ 24379f7d47b0SAlexander V. Chernikov int 24389f7d47b0SAlexander V. Chernikov ipfw_count_xtable(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt) 24393b3a8eb9SGleb Smirnoff { 24409f7d47b0SAlexander V. Chernikov struct table_config *tc; 2441d3b00c08SAlexander V. Chernikov uint32_t count; 24429f7d47b0SAlexander V. Chernikov 2443d3a4f924SAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) { 2444d3a4f924SAlexander V. Chernikov *cnt = 0; 24459f7d47b0SAlexander V. Chernikov return (0); /* 'table all list' requires success */ 2446d3a4f924SAlexander V. Chernikov } 2447d3b00c08SAlexander V. Chernikov 2448d3b00c08SAlexander V. Chernikov count = table_get_count(ch, tc); 2449d3b00c08SAlexander V. Chernikov *cnt = count * sizeof(ipfw_table_xentry); 2450d3b00c08SAlexander V. Chernikov if (count > 0) 24519f7d47b0SAlexander V. Chernikov *cnt += sizeof(ipfw_xtable); 24529f7d47b0SAlexander V. Chernikov return (0); 24539f7d47b0SAlexander V. Chernikov } 24549f7d47b0SAlexander V. Chernikov 24559f7d47b0SAlexander V. Chernikov static int 24569f7d47b0SAlexander V. Chernikov dump_table_entry(void *e, void *arg) 24579f7d47b0SAlexander V. Chernikov { 24589f7d47b0SAlexander V. Chernikov struct dump_args *da; 24599f7d47b0SAlexander V. Chernikov struct table_config *tc; 24609f7d47b0SAlexander V. Chernikov struct table_algo *ta; 24613b3a8eb9SGleb Smirnoff ipfw_table_entry *ent; 24620cba2b28SAlexander V. Chernikov struct table_value *pval; 246381d3153dSAlexander V. Chernikov int error; 24643b3a8eb9SGleb Smirnoff 24659f7d47b0SAlexander V. Chernikov da = (struct dump_args *)arg; 24669f7d47b0SAlexander V. Chernikov 24679f7d47b0SAlexander V. Chernikov tc = da->tc; 24689f7d47b0SAlexander V. Chernikov ta = tc->ta; 24699f7d47b0SAlexander V. Chernikov 24709f7d47b0SAlexander V. Chernikov /* Out of memory, returning */ 2471f1220db8SAlexander V. Chernikov if (da->cnt == da->size) 24723b3a8eb9SGleb Smirnoff return (1); 2473f1220db8SAlexander V. Chernikov ent = da->ent++; 2474f1220db8SAlexander V. Chernikov ent->tbl = da->uidx; 2475f1220db8SAlexander V. Chernikov da->cnt++; 24769f7d47b0SAlexander V. Chernikov 247781d3153dSAlexander V. Chernikov error = ta->dump_tentry(tc->astate, da->ti, e, &da->tent); 247881d3153dSAlexander V. Chernikov if (error != 0) 247981d3153dSAlexander V. Chernikov return (error); 248081d3153dSAlexander V. Chernikov 248181d3153dSAlexander V. Chernikov ent->addr = da->tent.k.addr.s_addr; 248281d3153dSAlexander V. Chernikov ent->masklen = da->tent.masklen; 24830cba2b28SAlexander V. Chernikov pval = get_table_value(da->ch, da->tc, da->tent.v.kidx); 24840cba2b28SAlexander V. Chernikov ent->value = ipfw_export_table_value_legacy(pval); 248581d3153dSAlexander V. Chernikov 248681d3153dSAlexander V. Chernikov return (0); 24873b3a8eb9SGleb Smirnoff } 24883b3a8eb9SGleb Smirnoff 2489f1220db8SAlexander V. Chernikov /* 2490f1220db8SAlexander V. Chernikov * Dumps table in pre-8.1 legacy format. 2491f1220db8SAlexander V. Chernikov */ 24923b3a8eb9SGleb Smirnoff int 2493f1220db8SAlexander V. Chernikov ipfw_dump_table_legacy(struct ip_fw_chain *ch, struct tid_info *ti, 2494f1220db8SAlexander V. Chernikov ipfw_table *tbl) 24953b3a8eb9SGleb Smirnoff { 2496b074b7bbSAlexander V. Chernikov struct table_config *tc; 24979f7d47b0SAlexander V. Chernikov struct table_algo *ta; 24989f7d47b0SAlexander V. Chernikov struct dump_args da; 24993b3a8eb9SGleb Smirnoff 25003b3a8eb9SGleb Smirnoff tbl->cnt = 0; 25013b3a8eb9SGleb Smirnoff 2502b074b7bbSAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) 2503b074b7bbSAlexander V. Chernikov return (0); /* XXX: We should return ESRCH */ 25049f7d47b0SAlexander V. Chernikov 25059f7d47b0SAlexander V. Chernikov ta = tc->ta; 25069f7d47b0SAlexander V. Chernikov 250781d3153dSAlexander V. Chernikov /* This dump format supports IPv4 only */ 2508c21034b7SAlexander V. Chernikov if (tc->no.type != IPFW_TABLE_ADDR) 250981d3153dSAlexander V. Chernikov return (0); 25109f7d47b0SAlexander V. Chernikov 2511d3a4f924SAlexander V. Chernikov memset(&da, 0, sizeof(da)); 25120cba2b28SAlexander V. Chernikov da.ch = ch; 25139f7d47b0SAlexander V. Chernikov da.ti = KIDX_TO_TI(ch, tc->no.kidx); 25149f7d47b0SAlexander V. Chernikov da.tc = tc; 2515f1220db8SAlexander V. Chernikov da.ent = &tbl->ent[0]; 2516f1220db8SAlexander V. Chernikov da.size = tbl->size; 25179f7d47b0SAlexander V. Chernikov 25189f7d47b0SAlexander V. Chernikov tbl->cnt = 0; 25199f7d47b0SAlexander V. Chernikov ta->foreach(tc->astate, da.ti, dump_table_entry, &da); 2520f1220db8SAlexander V. Chernikov tbl->cnt = da.cnt; 25219f7d47b0SAlexander V. Chernikov 25223b3a8eb9SGleb Smirnoff return (0); 25233b3a8eb9SGleb Smirnoff } 25243b3a8eb9SGleb Smirnoff 25259490a627SAlexander V. Chernikov /* 252681d3153dSAlexander V. Chernikov * Dumps table entry in eXtended format (v1)(current). 252781d3153dSAlexander V. Chernikov */ 252881d3153dSAlexander V. Chernikov static int 252981d3153dSAlexander V. Chernikov dump_table_tentry(void *e, void *arg) 253081d3153dSAlexander V. Chernikov { 253181d3153dSAlexander V. Chernikov struct dump_args *da; 253281d3153dSAlexander V. Chernikov struct table_config *tc; 253381d3153dSAlexander V. Chernikov struct table_algo *ta; 25340cba2b28SAlexander V. Chernikov struct table_value *pval; 253581d3153dSAlexander V. Chernikov ipfw_obj_tentry *tent; 25360cba2b28SAlexander V. Chernikov int error; 253781d3153dSAlexander V. Chernikov 253881d3153dSAlexander V. Chernikov da = (struct dump_args *)arg; 253981d3153dSAlexander V. Chernikov 254081d3153dSAlexander V. Chernikov tc = da->tc; 254181d3153dSAlexander V. Chernikov ta = tc->ta; 254281d3153dSAlexander V. Chernikov 254381d3153dSAlexander V. Chernikov tent = (ipfw_obj_tentry *)ipfw_get_sopt_space(da->sd, sizeof(*tent)); 254481d3153dSAlexander V. Chernikov /* Out of memory, returning */ 254581d3153dSAlexander V. Chernikov if (tent == NULL) { 254681d3153dSAlexander V. Chernikov da->error = ENOMEM; 254781d3153dSAlexander V. Chernikov return (1); 254881d3153dSAlexander V. Chernikov } 254981d3153dSAlexander V. Chernikov tent->head.length = sizeof(ipfw_obj_tentry); 255081d3153dSAlexander V. Chernikov tent->idx = da->uidx; 255181d3153dSAlexander V. Chernikov 25520cba2b28SAlexander V. Chernikov error = ta->dump_tentry(tc->astate, da->ti, e, tent); 25530cba2b28SAlexander V. Chernikov if (error != 0) 25540cba2b28SAlexander V. Chernikov return (error); 25550cba2b28SAlexander V. Chernikov 25560cba2b28SAlexander V. Chernikov pval = get_table_value(da->ch, da->tc, tent->v.kidx); 25570cba2b28SAlexander V. Chernikov ipfw_export_table_value_v1(pval, &tent->v.value); 25580cba2b28SAlexander V. Chernikov 25590cba2b28SAlexander V. Chernikov return (0); 256081d3153dSAlexander V. Chernikov } 256181d3153dSAlexander V. Chernikov 256281d3153dSAlexander V. Chernikov /* 256381d3153dSAlexander V. Chernikov * Dumps table entry in eXtended format (v0). 25649490a627SAlexander V. Chernikov */ 25653b3a8eb9SGleb Smirnoff static int 25669f7d47b0SAlexander V. Chernikov dump_table_xentry(void *e, void *arg) 25673b3a8eb9SGleb Smirnoff { 25689f7d47b0SAlexander V. Chernikov struct dump_args *da; 25699f7d47b0SAlexander V. Chernikov struct table_config *tc; 25709f7d47b0SAlexander V. Chernikov struct table_algo *ta; 25713b3a8eb9SGleb Smirnoff ipfw_table_xentry *xent; 257281d3153dSAlexander V. Chernikov ipfw_obj_tentry *tent; 25730cba2b28SAlexander V. Chernikov struct table_value *pval; 257481d3153dSAlexander V. Chernikov int error; 25753b3a8eb9SGleb Smirnoff 25769f7d47b0SAlexander V. Chernikov da = (struct dump_args *)arg; 25779f7d47b0SAlexander V. Chernikov 25789f7d47b0SAlexander V. Chernikov tc = da->tc; 25799f7d47b0SAlexander V. Chernikov ta = tc->ta; 25809f7d47b0SAlexander V. Chernikov 25812d99a349SAlexander V. Chernikov xent = (ipfw_table_xentry *)ipfw_get_sopt_space(da->sd, sizeof(*xent)); 25823b3a8eb9SGleb Smirnoff /* Out of memory, returning */ 25832d99a349SAlexander V. Chernikov if (xent == NULL) 25843b3a8eb9SGleb Smirnoff return (1); 25853b3a8eb9SGleb Smirnoff xent->len = sizeof(ipfw_table_xentry); 2586f1220db8SAlexander V. Chernikov xent->tbl = da->uidx; 25879f7d47b0SAlexander V. Chernikov 258881d3153dSAlexander V. Chernikov memset(&da->tent, 0, sizeof(da->tent)); 258981d3153dSAlexander V. Chernikov tent = &da->tent; 259081d3153dSAlexander V. Chernikov error = ta->dump_tentry(tc->astate, da->ti, e, tent); 259181d3153dSAlexander V. Chernikov if (error != 0) 259281d3153dSAlexander V. Chernikov return (error); 259381d3153dSAlexander V. Chernikov 259481d3153dSAlexander V. Chernikov /* Convert current format to previous one */ 259581d3153dSAlexander V. Chernikov xent->masklen = tent->masklen; 25960cba2b28SAlexander V. Chernikov pval = get_table_value(da->ch, da->tc, da->tent.v.kidx); 25970cba2b28SAlexander V. Chernikov xent->value = ipfw_export_table_value_legacy(pval); 259881d3153dSAlexander V. Chernikov /* Apply some hacks */ 2599c21034b7SAlexander V. Chernikov if (tc->no.type == IPFW_TABLE_ADDR && tent->subtype == AF_INET) { 260081d3153dSAlexander V. Chernikov xent->k.addr6.s6_addr32[3] = tent->k.addr.s_addr; 260181d3153dSAlexander V. Chernikov xent->flags = IPFW_TCF_INET; 260281d3153dSAlexander V. Chernikov } else 260381d3153dSAlexander V. Chernikov memcpy(&xent->k, &tent->k, sizeof(xent->k)); 260481d3153dSAlexander V. Chernikov 260581d3153dSAlexander V. Chernikov return (0); 26069f7d47b0SAlexander V. Chernikov } 26079f7d47b0SAlexander V. Chernikov 26089f7d47b0SAlexander V. Chernikov /* 26094dff4ae0SAlexander V. Chernikov * Helper function to export table algo data 26104dff4ae0SAlexander V. Chernikov * to tentry format before calling user function. 26114dff4ae0SAlexander V. Chernikov * 26124dff4ae0SAlexander V. Chernikov * Returns 0 on success. 26134dff4ae0SAlexander V. Chernikov */ 26144dff4ae0SAlexander V. Chernikov static int 26154dff4ae0SAlexander V. Chernikov prepare_table_tentry(void *e, void *arg) 26164dff4ae0SAlexander V. Chernikov { 26174dff4ae0SAlexander V. Chernikov struct dump_args *da; 26184dff4ae0SAlexander V. Chernikov struct table_config *tc; 26194dff4ae0SAlexander V. Chernikov struct table_algo *ta; 26204dff4ae0SAlexander V. Chernikov int error; 26214dff4ae0SAlexander V. Chernikov 26224dff4ae0SAlexander V. Chernikov da = (struct dump_args *)arg; 26234dff4ae0SAlexander V. Chernikov 26244dff4ae0SAlexander V. Chernikov tc = da->tc; 26254dff4ae0SAlexander V. Chernikov ta = tc->ta; 26264dff4ae0SAlexander V. Chernikov 26274dff4ae0SAlexander V. Chernikov error = ta->dump_tentry(tc->astate, da->ti, e, &da->tent); 26284dff4ae0SAlexander V. Chernikov if (error != 0) 26294dff4ae0SAlexander V. Chernikov return (error); 26304dff4ae0SAlexander V. Chernikov 26314dff4ae0SAlexander V. Chernikov da->f(&da->tent, da->farg); 26324dff4ae0SAlexander V. Chernikov 26334dff4ae0SAlexander V. Chernikov return (0); 26344dff4ae0SAlexander V. Chernikov } 26354dff4ae0SAlexander V. Chernikov 26364dff4ae0SAlexander V. Chernikov /* 26374dff4ae0SAlexander V. Chernikov * Allow external consumers to read table entries in standard format. 26384dff4ae0SAlexander V. Chernikov */ 26394dff4ae0SAlexander V. Chernikov int 26404dff4ae0SAlexander V. Chernikov ipfw_foreach_table_tentry(struct ip_fw_chain *ch, uint16_t kidx, 26414dff4ae0SAlexander V. Chernikov ta_foreach_f *f, void *arg) 26424dff4ae0SAlexander V. Chernikov { 26434dff4ae0SAlexander V. Chernikov struct namedobj_instance *ni; 26444dff4ae0SAlexander V. Chernikov struct table_config *tc; 26454dff4ae0SAlexander V. Chernikov struct table_algo *ta; 26464dff4ae0SAlexander V. Chernikov struct dump_args da; 26474dff4ae0SAlexander V. Chernikov 26484dff4ae0SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 26494dff4ae0SAlexander V. Chernikov 26504dff4ae0SAlexander V. Chernikov tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, kidx); 26514dff4ae0SAlexander V. Chernikov if (tc == NULL) 26524dff4ae0SAlexander V. Chernikov return (ESRCH); 26534dff4ae0SAlexander V. Chernikov 26544dff4ae0SAlexander V. Chernikov ta = tc->ta; 26554dff4ae0SAlexander V. Chernikov 26564dff4ae0SAlexander V. Chernikov memset(&da, 0, sizeof(da)); 26570cba2b28SAlexander V. Chernikov da.ch = ch; 26584dff4ae0SAlexander V. Chernikov da.ti = KIDX_TO_TI(ch, tc->no.kidx); 26594dff4ae0SAlexander V. Chernikov da.tc = tc; 26604dff4ae0SAlexander V. Chernikov da.f = f; 26614dff4ae0SAlexander V. Chernikov da.farg = arg; 26624dff4ae0SAlexander V. Chernikov 26634dff4ae0SAlexander V. Chernikov ta->foreach(tc->astate, da.ti, prepare_table_tentry, &da); 26644dff4ae0SAlexander V. Chernikov 26654dff4ae0SAlexander V. Chernikov return (0); 26664dff4ae0SAlexander V. Chernikov } 26674dff4ae0SAlexander V. Chernikov 26684dff4ae0SAlexander V. Chernikov /* 26699f7d47b0SAlexander V. Chernikov * Table algorithms 26709f7d47b0SAlexander V. Chernikov */ 26713b3a8eb9SGleb Smirnoff 26729f7d47b0SAlexander V. Chernikov /* 267335e1bbd0SAlexander V. Chernikov * Finds algoritm by index, table type or supplied name. 267435e1bbd0SAlexander V. Chernikov * 267535e1bbd0SAlexander V. Chernikov * Returns pointer to algo or NULL. 26769f7d47b0SAlexander V. Chernikov */ 26779f7d47b0SAlexander V. Chernikov static struct table_algo * 26789490a627SAlexander V. Chernikov find_table_algo(struct tables_config *tcfg, struct tid_info *ti, char *name) 26799f7d47b0SAlexander V. Chernikov { 26809490a627SAlexander V. Chernikov int i, l; 26819490a627SAlexander V. Chernikov struct table_algo *ta; 26829f7d47b0SAlexander V. Chernikov 268357a1cf95SAlexander V. Chernikov if (ti->type > IPFW_TABLE_MAXTYPE) 268457a1cf95SAlexander V. Chernikov return (NULL); 268557a1cf95SAlexander V. Chernikov 26869f7d47b0SAlexander V. Chernikov /* Search by index */ 26879f7d47b0SAlexander V. Chernikov if (ti->atype != 0) { 26889f7d47b0SAlexander V. Chernikov if (ti->atype > tcfg->algo_count) 26899f7d47b0SAlexander V. Chernikov return (NULL); 26909f7d47b0SAlexander V. Chernikov return (tcfg->algo[ti->atype]); 26919f7d47b0SAlexander V. Chernikov } 26929f7d47b0SAlexander V. Chernikov 2693fd0869d5SAlexander V. Chernikov if (name == NULL) { 2694fd0869d5SAlexander V. Chernikov /* Return default algorithm for given type if set */ 2695fd0869d5SAlexander V. Chernikov return (tcfg->def_algo[ti->type]); 2696fd0869d5SAlexander V. Chernikov } 2697fd0869d5SAlexander V. Chernikov 2698fd0869d5SAlexander V. Chernikov /* Search by name */ 26999490a627SAlexander V. Chernikov /* TODO: better search */ 27009490a627SAlexander V. Chernikov for (i = 1; i <= tcfg->algo_count; i++) { 27019490a627SAlexander V. Chernikov ta = tcfg->algo[i]; 27029490a627SAlexander V. Chernikov 27039490a627SAlexander V. Chernikov /* 27049490a627SAlexander V. Chernikov * One can supply additional algorithm 27059490a627SAlexander V. Chernikov * parameters so we compare only the first word 27069490a627SAlexander V. Chernikov * of supplied name: 2707c21034b7SAlexander V. Chernikov * 'addr:chash hsize=32' 27089490a627SAlexander V. Chernikov * '^^^^^^^^^' 27099490a627SAlexander V. Chernikov * 27109490a627SAlexander V. Chernikov */ 27119490a627SAlexander V. Chernikov l = strlen(ta->name); 2712fd0869d5SAlexander V. Chernikov if (strncmp(name, ta->name, l) != 0) 2713fd0869d5SAlexander V. Chernikov continue; 2714fd0869d5SAlexander V. Chernikov if (name[l] != '\0' && name[l] != ' ') 2715fd0869d5SAlexander V. Chernikov continue; 2716fd0869d5SAlexander V. Chernikov /* Check if we're requesting proper table type */ 2717fd0869d5SAlexander V. Chernikov if (ti->type != 0 && ti->type != ta->type) 2718fd0869d5SAlexander V. Chernikov return (NULL); 27199490a627SAlexander V. Chernikov return (ta); 27209490a627SAlexander V. Chernikov } 27219490a627SAlexander V. Chernikov 27229490a627SAlexander V. Chernikov return (NULL); 27239490a627SAlexander V. Chernikov } 27249490a627SAlexander V. Chernikov 2725b6ee846eSAlexander V. Chernikov /* 2726b6ee846eSAlexander V. Chernikov * Register new table algo @ta. 272735e1bbd0SAlexander V. Chernikov * Stores algo id inside @idx. 2728b6ee846eSAlexander V. Chernikov * 2729b6ee846eSAlexander V. Chernikov * Returns 0 on success. 2730b6ee846eSAlexander V. Chernikov */ 27310b565ac0SAlexander V. Chernikov int 27320b565ac0SAlexander V. Chernikov ipfw_add_table_algo(struct ip_fw_chain *ch, struct table_algo *ta, size_t size, 27330b565ac0SAlexander V. Chernikov int *idx) 27343b3a8eb9SGleb Smirnoff { 27359f7d47b0SAlexander V. Chernikov struct tables_config *tcfg; 27360b565ac0SAlexander V. Chernikov struct table_algo *ta_new; 2737b6ee846eSAlexander V. Chernikov size_t sz; 27380b565ac0SAlexander V. Chernikov 27390b565ac0SAlexander V. Chernikov if (size > sizeof(struct table_algo)) 27400b565ac0SAlexander V. Chernikov return (EINVAL); 27410b565ac0SAlexander V. Chernikov 2742b6ee846eSAlexander V. Chernikov /* Check for the required on-stack size for add/del */ 2743b6ee846eSAlexander V. Chernikov sz = roundup2(ta->ta_buf_size, sizeof(void *)); 2744b6ee846eSAlexander V. Chernikov if (sz > TA_BUF_SZ) 2745b6ee846eSAlexander V. Chernikov return (EINVAL); 2746b6ee846eSAlexander V. Chernikov 2747fddbbf75SAlexander V. Chernikov KASSERT(ta->type <= IPFW_TABLE_MAXTYPE,("Increase IPFW_TABLE_MAXTYPE")); 274857a1cf95SAlexander V. Chernikov 274935e1bbd0SAlexander V. Chernikov /* Copy algorithm data to stable storage. */ 27500b565ac0SAlexander V. Chernikov ta_new = malloc(sizeof(struct table_algo), M_IPFW, M_WAITOK | M_ZERO); 27510b565ac0SAlexander V. Chernikov memcpy(ta_new, ta, size); 27523b3a8eb9SGleb Smirnoff 27539f7d47b0SAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 2754b074b7bbSAlexander V. Chernikov 27559f7d47b0SAlexander V. Chernikov KASSERT(tcfg->algo_count < 255, ("Increase algo array size")); 27569f7d47b0SAlexander V. Chernikov 27570b565ac0SAlexander V. Chernikov tcfg->algo[++tcfg->algo_count] = ta_new; 27580b565ac0SAlexander V. Chernikov ta_new->idx = tcfg->algo_count; 27590b565ac0SAlexander V. Chernikov 276057a1cf95SAlexander V. Chernikov /* Set algorithm as default one for given type */ 276157a1cf95SAlexander V. Chernikov if ((ta_new->flags & TA_FLAG_DEFAULT) != 0 && 276257a1cf95SAlexander V. Chernikov tcfg->def_algo[ta_new->type] == NULL) 276357a1cf95SAlexander V. Chernikov tcfg->def_algo[ta_new->type] = ta_new; 276457a1cf95SAlexander V. Chernikov 27650b565ac0SAlexander V. Chernikov *idx = ta_new->idx; 27660b565ac0SAlexander V. Chernikov 27670b565ac0SAlexander V. Chernikov return (0); 27680b565ac0SAlexander V. Chernikov } 27690b565ac0SAlexander V. Chernikov 2770b6ee846eSAlexander V. Chernikov /* 2771b6ee846eSAlexander V. Chernikov * Unregisters table algo using @idx as id. 2772c8d5d308SAlexander V. Chernikov * XXX: It is NOT safe to call this function in any place 2773c8d5d308SAlexander V. Chernikov * other than ipfw instance destroy handler. 2774b6ee846eSAlexander V. Chernikov */ 27750b565ac0SAlexander V. Chernikov void 27760b565ac0SAlexander V. Chernikov ipfw_del_table_algo(struct ip_fw_chain *ch, int idx) 27770b565ac0SAlexander V. Chernikov { 27780b565ac0SAlexander V. Chernikov struct tables_config *tcfg; 27790b565ac0SAlexander V. Chernikov struct table_algo *ta; 27800b565ac0SAlexander V. Chernikov 27810b565ac0SAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 27820b565ac0SAlexander V. Chernikov 2783b6ee846eSAlexander V. Chernikov KASSERT(idx <= tcfg->algo_count, ("algo idx %d out of range 1..%d", 2784b6ee846eSAlexander V. Chernikov idx, tcfg->algo_count)); 27850b565ac0SAlexander V. Chernikov 27860b565ac0SAlexander V. Chernikov ta = tcfg->algo[idx]; 27870b565ac0SAlexander V. Chernikov KASSERT(ta != NULL, ("algo idx %d is NULL", idx)); 278857a1cf95SAlexander V. Chernikov 278957a1cf95SAlexander V. Chernikov if (tcfg->def_algo[ta->type] == ta) 279057a1cf95SAlexander V. Chernikov tcfg->def_algo[ta->type] = NULL; 279157a1cf95SAlexander V. Chernikov 27920b565ac0SAlexander V. Chernikov free(ta, M_IPFW); 27933b3a8eb9SGleb Smirnoff } 27943b3a8eb9SGleb Smirnoff 27959d099b4fSAlexander V. Chernikov /* 27969d099b4fSAlexander V. Chernikov * Lists all table algorithms currently available. 27979d099b4fSAlexander V. Chernikov * Data layout (v0)(current): 27989d099b4fSAlexander V. Chernikov * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size 27999d099b4fSAlexander V. Chernikov * Reply: [ ipfw_obj_lheader ipfw_ta_info x N ] 28009d099b4fSAlexander V. Chernikov * 28019d099b4fSAlexander V. Chernikov * Returns 0 on success 28029d099b4fSAlexander V. Chernikov */ 28039d099b4fSAlexander V. Chernikov int 2804e822d936SAlexander V. Chernikov ipfw_list_table_algo(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 2805e822d936SAlexander V. Chernikov struct sockopt_data *sd) 28069d099b4fSAlexander V. Chernikov { 28079d099b4fSAlexander V. Chernikov struct _ipfw_obj_lheader *olh; 28089d099b4fSAlexander V. Chernikov struct tables_config *tcfg; 28099d099b4fSAlexander V. Chernikov ipfw_ta_info *i; 28109d099b4fSAlexander V. Chernikov struct table_algo *ta; 28119d099b4fSAlexander V. Chernikov uint32_t count, n, size; 28129d099b4fSAlexander V. Chernikov 28139d099b4fSAlexander V. Chernikov olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh)); 28149d099b4fSAlexander V. Chernikov if (olh == NULL) 28159d099b4fSAlexander V. Chernikov return (EINVAL); 28169d099b4fSAlexander V. Chernikov if (sd->valsize < olh->size) 28179d099b4fSAlexander V. Chernikov return (EINVAL); 28189d099b4fSAlexander V. Chernikov 28199d099b4fSAlexander V. Chernikov IPFW_UH_RLOCK(ch); 28209d099b4fSAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 28219d099b4fSAlexander V. Chernikov count = tcfg->algo_count; 28229d099b4fSAlexander V. Chernikov size = count * sizeof(ipfw_ta_info) + sizeof(ipfw_obj_lheader); 28239d099b4fSAlexander V. Chernikov 28249d099b4fSAlexander V. Chernikov /* Fill in header regadless of buffer size */ 28259d099b4fSAlexander V. Chernikov olh->count = count; 28269d099b4fSAlexander V. Chernikov olh->objsize = sizeof(ipfw_ta_info); 28279d099b4fSAlexander V. Chernikov 28289d099b4fSAlexander V. Chernikov if (size > olh->size) { 28299d099b4fSAlexander V. Chernikov olh->size = size; 28309d099b4fSAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 28319d099b4fSAlexander V. Chernikov return (ENOMEM); 28329d099b4fSAlexander V. Chernikov } 28339d099b4fSAlexander V. Chernikov olh->size = size; 28349d099b4fSAlexander V. Chernikov 28359d099b4fSAlexander V. Chernikov for (n = 1; n <= count; n++) { 28369d099b4fSAlexander V. Chernikov i = (ipfw_ta_info *)ipfw_get_sopt_space(sd, sizeof(*i)); 28379d099b4fSAlexander V. Chernikov KASSERT(i != 0, ("previously checked buffer is not enough")); 28389d099b4fSAlexander V. Chernikov ta = tcfg->algo[n]; 28399d099b4fSAlexander V. Chernikov strlcpy(i->algoname, ta->name, sizeof(i->algoname)); 28409d099b4fSAlexander V. Chernikov i->type = ta->type; 28419d099b4fSAlexander V. Chernikov i->refcnt = ta->refcnt; 28429d099b4fSAlexander V. Chernikov } 28439d099b4fSAlexander V. Chernikov 28449d099b4fSAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 28459d099b4fSAlexander V. Chernikov 28469d099b4fSAlexander V. Chernikov return (0); 28479d099b4fSAlexander V. Chernikov } 28489d099b4fSAlexander V. Chernikov 2849b074b7bbSAlexander V. Chernikov /* 2850b074b7bbSAlexander V. Chernikov * Tables rewriting code 2851b074b7bbSAlexander V. Chernikov */ 2852b074b7bbSAlexander V. Chernikov 2853b074b7bbSAlexander V. Chernikov /* 2854b074b7bbSAlexander V. Chernikov * Determine table number and lookup type for @cmd. 2855b074b7bbSAlexander V. Chernikov * Fill @tbl and @type with appropriate values. 2856b074b7bbSAlexander V. Chernikov * Returns 0 for relevant opcodes, 1 otherwise. 2857b074b7bbSAlexander V. Chernikov */ 2858b074b7bbSAlexander V. Chernikov static int 2859b074b7bbSAlexander V. Chernikov classify_table_opcode(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 2860b074b7bbSAlexander V. Chernikov { 2861b074b7bbSAlexander V. Chernikov ipfw_insn_if *cmdif; 2862b074b7bbSAlexander V. Chernikov int skip; 2863b074b7bbSAlexander V. Chernikov uint16_t v; 2864b074b7bbSAlexander V. Chernikov 2865b074b7bbSAlexander V. Chernikov skip = 1; 2866b074b7bbSAlexander V. Chernikov 2867b074b7bbSAlexander V. Chernikov switch (cmd->opcode) { 2868b074b7bbSAlexander V. Chernikov case O_IP_SRC_LOOKUP: 2869b074b7bbSAlexander V. Chernikov case O_IP_DST_LOOKUP: 2870b074b7bbSAlexander V. Chernikov /* Basic IPv4/IPv6 or u32 lookups */ 2871b074b7bbSAlexander V. Chernikov *puidx = cmd->arg1; 2872c21034b7SAlexander V. Chernikov /* Assume ADDR by default */ 2873c21034b7SAlexander V. Chernikov *ptype = IPFW_TABLE_ADDR; 2874b074b7bbSAlexander V. Chernikov skip = 0; 2875b074b7bbSAlexander V. Chernikov 2876b074b7bbSAlexander V. Chernikov if (F_LEN(cmd) > F_INSN_SIZE(ipfw_insn_u32)) { 2877b074b7bbSAlexander V. Chernikov /* 2878b074b7bbSAlexander V. Chernikov * generic lookup. The key must be 2879b074b7bbSAlexander V. Chernikov * in 32bit big-endian format. 2880b074b7bbSAlexander V. Chernikov */ 2881b074b7bbSAlexander V. Chernikov v = ((ipfw_insn_u32 *)cmd)->d[1]; 2882b074b7bbSAlexander V. Chernikov switch (v) { 2883b074b7bbSAlexander V. Chernikov case 0: 2884b074b7bbSAlexander V. Chernikov case 1: 2885b074b7bbSAlexander V. Chernikov /* IPv4 src/dst */ 2886b074b7bbSAlexander V. Chernikov break; 2887b074b7bbSAlexander V. Chernikov case 2: 2888b074b7bbSAlexander V. Chernikov case 3: 2889b074b7bbSAlexander V. Chernikov /* src/dst port */ 2890b23d5de9SAlexander V. Chernikov *ptype = IPFW_TABLE_NUMBER; 2891b074b7bbSAlexander V. Chernikov break; 2892b074b7bbSAlexander V. Chernikov case 4: 2893b074b7bbSAlexander V. Chernikov /* uid/gid */ 2894b23d5de9SAlexander V. Chernikov *ptype = IPFW_TABLE_NUMBER; 2895b23d5de9SAlexander V. Chernikov break; 2896b074b7bbSAlexander V. Chernikov case 5: 2897b074b7bbSAlexander V. Chernikov /* jid */ 2898b23d5de9SAlexander V. Chernikov *ptype = IPFW_TABLE_NUMBER; 2899b23d5de9SAlexander V. Chernikov break; 2900b074b7bbSAlexander V. Chernikov case 6: 2901b074b7bbSAlexander V. Chernikov /* dscp */ 2902b23d5de9SAlexander V. Chernikov *ptype = IPFW_TABLE_NUMBER; 2903b074b7bbSAlexander V. Chernikov break; 2904b074b7bbSAlexander V. Chernikov } 2905b074b7bbSAlexander V. Chernikov } 2906b074b7bbSAlexander V. Chernikov break; 2907b074b7bbSAlexander V. Chernikov case O_XMIT: 2908b074b7bbSAlexander V. Chernikov case O_RECV: 2909b074b7bbSAlexander V. Chernikov case O_VIA: 2910b074b7bbSAlexander V. Chernikov /* Interface table, possibly */ 2911b074b7bbSAlexander V. Chernikov cmdif = (ipfw_insn_if *)cmd; 2912b074b7bbSAlexander V. Chernikov if (cmdif->name[0] != '\1') 2913b074b7bbSAlexander V. Chernikov break; 2914b074b7bbSAlexander V. Chernikov 2915b074b7bbSAlexander V. Chernikov *ptype = IPFW_TABLE_INTERFACE; 29161940fa77SAlexander V. Chernikov *puidx = cmdif->p.kidx; 2917b074b7bbSAlexander V. Chernikov skip = 0; 2918b074b7bbSAlexander V. Chernikov break; 2919914bffb6SAlexander V. Chernikov case O_IP_FLOW_LOOKUP: 2920914bffb6SAlexander V. Chernikov *puidx = cmd->arg1; 2921914bffb6SAlexander V. Chernikov *ptype = IPFW_TABLE_FLOW; 2922914bffb6SAlexander V. Chernikov skip = 0; 2923914bffb6SAlexander V. Chernikov break; 2924b074b7bbSAlexander V. Chernikov } 2925b074b7bbSAlexander V. Chernikov 2926b074b7bbSAlexander V. Chernikov return (skip); 2927b074b7bbSAlexander V. Chernikov } 2928b074b7bbSAlexander V. Chernikov 2929b074b7bbSAlexander V. Chernikov /* 2930b074b7bbSAlexander V. Chernikov * Sets new table value for given opcode. 2931b074b7bbSAlexander V. Chernikov * Assume the same opcodes as classify_table_opcode() 2932b074b7bbSAlexander V. Chernikov */ 2933b074b7bbSAlexander V. Chernikov static void 2934b074b7bbSAlexander V. Chernikov update_table_opcode(ipfw_insn *cmd, uint16_t idx) 2935b074b7bbSAlexander V. Chernikov { 2936b074b7bbSAlexander V. Chernikov ipfw_insn_if *cmdif; 2937b074b7bbSAlexander V. Chernikov 2938b074b7bbSAlexander V. Chernikov switch (cmd->opcode) { 2939b074b7bbSAlexander V. Chernikov case O_IP_SRC_LOOKUP: 2940b074b7bbSAlexander V. Chernikov case O_IP_DST_LOOKUP: 2941b074b7bbSAlexander V. Chernikov /* Basic IPv4/IPv6 or u32 lookups */ 2942b074b7bbSAlexander V. Chernikov cmd->arg1 = idx; 2943b074b7bbSAlexander V. Chernikov break; 2944b074b7bbSAlexander V. Chernikov case O_XMIT: 2945b074b7bbSAlexander V. Chernikov case O_RECV: 2946b074b7bbSAlexander V. Chernikov case O_VIA: 2947b074b7bbSAlexander V. Chernikov /* Interface table, possibly */ 2948b074b7bbSAlexander V. Chernikov cmdif = (ipfw_insn_if *)cmd; 29491940fa77SAlexander V. Chernikov cmdif->p.kidx = idx; 2950b074b7bbSAlexander V. Chernikov break; 2951914bffb6SAlexander V. Chernikov case O_IP_FLOW_LOOKUP: 2952914bffb6SAlexander V. Chernikov cmd->arg1 = idx; 2953914bffb6SAlexander V. Chernikov break; 2954b074b7bbSAlexander V. Chernikov } 2955b074b7bbSAlexander V. Chernikov } 2956b074b7bbSAlexander V. Chernikov 2957ac35ff17SAlexander V. Chernikov /* 2958ac35ff17SAlexander V. Chernikov * Checks table name for validity. 2959ac35ff17SAlexander V. Chernikov * Enforce basic length checks, the rest 2960ac35ff17SAlexander V. Chernikov * should be done in userland. 2961ac35ff17SAlexander V. Chernikov * 2962ac35ff17SAlexander V. Chernikov * Returns 0 if name is considered valid. 2963ac35ff17SAlexander V. Chernikov */ 2964ac35ff17SAlexander V. Chernikov int 2965ac35ff17SAlexander V. Chernikov ipfw_check_table_name(char *name) 2966ac35ff17SAlexander V. Chernikov { 2967ac35ff17SAlexander V. Chernikov int nsize; 2968ac35ff17SAlexander V. Chernikov ipfw_obj_ntlv *ntlv = NULL; 2969ac35ff17SAlexander V. Chernikov 2970ac35ff17SAlexander V. Chernikov nsize = sizeof(ntlv->name); 2971ac35ff17SAlexander V. Chernikov 2972ac35ff17SAlexander V. Chernikov if (strnlen(name, nsize) == nsize) 2973ac35ff17SAlexander V. Chernikov return (EINVAL); 2974ac35ff17SAlexander V. Chernikov 2975ac35ff17SAlexander V. Chernikov if (name[0] == '\0') 2976ac35ff17SAlexander V. Chernikov return (EINVAL); 2977ac35ff17SAlexander V. Chernikov 2978ac35ff17SAlexander V. Chernikov /* 2979ac35ff17SAlexander V. Chernikov * TODO: do some more complicated checks 2980ac35ff17SAlexander V. Chernikov */ 2981ac35ff17SAlexander V. Chernikov 2982ac35ff17SAlexander V. Chernikov return (0); 2983ac35ff17SAlexander V. Chernikov } 2984ac35ff17SAlexander V. Chernikov 2985ac35ff17SAlexander V. Chernikov /* 2986ac35ff17SAlexander V. Chernikov * Find tablename TLV by @uid. 2987ac35ff17SAlexander V. Chernikov * Check @tlvs for valid data inside. 2988ac35ff17SAlexander V. Chernikov * 2989ac35ff17SAlexander V. Chernikov * Returns pointer to found TLV or NULL. 2990ac35ff17SAlexander V. Chernikov */ 2991ac35ff17SAlexander V. Chernikov static ipfw_obj_ntlv * 2992b074b7bbSAlexander V. Chernikov find_name_tlv(void *tlvs, int len, uint16_t uidx) 2993b074b7bbSAlexander V. Chernikov { 29949f7d47b0SAlexander V. Chernikov ipfw_obj_ntlv *ntlv; 2995b074b7bbSAlexander V. Chernikov uintptr_t pa, pe; 2996b074b7bbSAlexander V. Chernikov int l; 2997b074b7bbSAlexander V. Chernikov 2998b074b7bbSAlexander V. Chernikov pa = (uintptr_t)tlvs; 2999b074b7bbSAlexander V. Chernikov pe = pa + len; 3000b074b7bbSAlexander V. Chernikov l = 0; 3001b074b7bbSAlexander V. Chernikov for (; pa < pe; pa += l) { 30029f7d47b0SAlexander V. Chernikov ntlv = (ipfw_obj_ntlv *)pa; 3003b074b7bbSAlexander V. Chernikov l = ntlv->head.length; 3004ac35ff17SAlexander V. Chernikov 3005ac35ff17SAlexander V. Chernikov if (l != sizeof(*ntlv)) 3006ac35ff17SAlexander V. Chernikov return (NULL); 3007ac35ff17SAlexander V. Chernikov 3008563b5ab1SAlexander V. Chernikov if (ntlv->head.type != IPFW_TLV_TBL_NAME) 3009b074b7bbSAlexander V. Chernikov continue; 3010ac35ff17SAlexander V. Chernikov 3011b074b7bbSAlexander V. Chernikov if (ntlv->idx != uidx) 3012b074b7bbSAlexander V. Chernikov continue; 3013b074b7bbSAlexander V. Chernikov 3014ac35ff17SAlexander V. Chernikov if (ipfw_check_table_name(ntlv->name) != 0) 3015ac35ff17SAlexander V. Chernikov return (NULL); 3016ac35ff17SAlexander V. Chernikov 3017ac35ff17SAlexander V. Chernikov return (ntlv); 3018b074b7bbSAlexander V. Chernikov } 3019b074b7bbSAlexander V. Chernikov 3020b074b7bbSAlexander V. Chernikov return (NULL); 3021b074b7bbSAlexander V. Chernikov } 3022b074b7bbSAlexander V. Chernikov 3023ac35ff17SAlexander V. Chernikov /* 3024ac35ff17SAlexander V. Chernikov * Finds table config based on either legacy index 3025ac35ff17SAlexander V. Chernikov * or name in ntlv. 3026ac35ff17SAlexander V. Chernikov * Note @ti structure contains unchecked data from userland. 3027ac35ff17SAlexander V. Chernikov * 3028ac35ff17SAlexander V. Chernikov * Returns pointer to table_config or NULL. 3029ac35ff17SAlexander V. Chernikov */ 3030b074b7bbSAlexander V. Chernikov static struct table_config * 3031b074b7bbSAlexander V. Chernikov find_table(struct namedobj_instance *ni, struct tid_info *ti) 3032b074b7bbSAlexander V. Chernikov { 3033b074b7bbSAlexander V. Chernikov char *name, bname[16]; 3034b074b7bbSAlexander V. Chernikov struct named_object *no; 3035ac35ff17SAlexander V. Chernikov ipfw_obj_ntlv *ntlv; 3036ac35ff17SAlexander V. Chernikov uint32_t set; 3037b074b7bbSAlexander V. Chernikov 3038b074b7bbSAlexander V. Chernikov if (ti->tlvs != NULL) { 3039ac35ff17SAlexander V. Chernikov ntlv = find_name_tlv(ti->tlvs, ti->tlen, ti->uidx); 3040ac35ff17SAlexander V. Chernikov if (ntlv == NULL) 3041b074b7bbSAlexander V. Chernikov return (NULL); 3042ac35ff17SAlexander V. Chernikov name = ntlv->name; 304340e5f498SAlexander V. Chernikov 304440e5f498SAlexander V. Chernikov /* 304540e5f498SAlexander V. Chernikov * Use set provided by @ti instead of @ntlv one. 304640e5f498SAlexander V. Chernikov * This is needed due to different sets behavior 304740e5f498SAlexander V. Chernikov * controlled by V_fw_tables_sets. 304840e5f498SAlexander V. Chernikov */ 304940e5f498SAlexander V. Chernikov set = ti->set; 3050b074b7bbSAlexander V. Chernikov } else { 3051b074b7bbSAlexander V. Chernikov snprintf(bname, sizeof(bname), "%d", ti->uidx); 3052b074b7bbSAlexander V. Chernikov name = bname; 3053ac35ff17SAlexander V. Chernikov set = 0; 3054b074b7bbSAlexander V. Chernikov } 3055b074b7bbSAlexander V. Chernikov 3056ac35ff17SAlexander V. Chernikov no = ipfw_objhash_lookup_name(ni, set, name); 3057b074b7bbSAlexander V. Chernikov 3058b074b7bbSAlexander V. Chernikov return ((struct table_config *)no); 3059b074b7bbSAlexander V. Chernikov } 3060b074b7bbSAlexander V. Chernikov 306135e1bbd0SAlexander V. Chernikov /* 306235e1bbd0SAlexander V. Chernikov * Allocate new table config structure using 306335e1bbd0SAlexander V. Chernikov * specified @algo and @aname. 306435e1bbd0SAlexander V. Chernikov * 306535e1bbd0SAlexander V. Chernikov * Returns pointer to config or NULL. 306635e1bbd0SAlexander V. Chernikov */ 3067b074b7bbSAlexander V. Chernikov static struct table_config * 306868394ec8SAlexander V. Chernikov alloc_table_config(struct ip_fw_chain *ch, struct tid_info *ti, 30690cba2b28SAlexander V. Chernikov struct table_algo *ta, char *aname, uint8_t tflags) 3070b074b7bbSAlexander V. Chernikov { 3071b074b7bbSAlexander V. Chernikov char *name, bname[16]; 3072b074b7bbSAlexander V. Chernikov struct table_config *tc; 3073b074b7bbSAlexander V. Chernikov int error; 3074ac35ff17SAlexander V. Chernikov ipfw_obj_ntlv *ntlv; 3075ac35ff17SAlexander V. Chernikov uint32_t set; 3076b074b7bbSAlexander V. Chernikov 3077b074b7bbSAlexander V. Chernikov if (ti->tlvs != NULL) { 3078ac35ff17SAlexander V. Chernikov ntlv = find_name_tlv(ti->tlvs, ti->tlen, ti->uidx); 3079ac35ff17SAlexander V. Chernikov if (ntlv == NULL) 3080b074b7bbSAlexander V. Chernikov return (NULL); 3081ac35ff17SAlexander V. Chernikov name = ntlv->name; 3082ac35ff17SAlexander V. Chernikov set = ntlv->set; 3083b074b7bbSAlexander V. Chernikov } else { 3084b074b7bbSAlexander V. Chernikov snprintf(bname, sizeof(bname), "%d", ti->uidx); 3085b074b7bbSAlexander V. Chernikov name = bname; 3086ac35ff17SAlexander V. Chernikov set = 0; 3087b074b7bbSAlexander V. Chernikov } 3088b074b7bbSAlexander V. Chernikov 3089b074b7bbSAlexander V. Chernikov tc = malloc(sizeof(struct table_config), M_IPFW, M_WAITOK | M_ZERO); 3090b074b7bbSAlexander V. Chernikov tc->no.name = tc->tablename; 3091fd0869d5SAlexander V. Chernikov tc->no.type = ta->type; 3092ac35ff17SAlexander V. Chernikov tc->no.set = set; 3093914bffb6SAlexander V. Chernikov tc->tflags = tflags; 30949f7d47b0SAlexander V. Chernikov tc->ta = ta; 3095b074b7bbSAlexander V. Chernikov strlcpy(tc->tablename, name, sizeof(tc->tablename)); 30960cba2b28SAlexander V. Chernikov /* Set "shared" value type by default */ 30970cba2b28SAlexander V. Chernikov tc->vshared = 1; 3098b074b7bbSAlexander V. Chernikov 3099b074b7bbSAlexander V. Chernikov if (ti->tlvs == NULL) { 3100b074b7bbSAlexander V. Chernikov tc->no.compat = 1; 3101b074b7bbSAlexander V. Chernikov tc->no.uidx = ti->uidx; 3102b074b7bbSAlexander V. Chernikov } 3103b074b7bbSAlexander V. Chernikov 3104b074b7bbSAlexander V. Chernikov /* Preallocate data structures for new tables */ 3105914bffb6SAlexander V. Chernikov error = ta->init(ch, &tc->astate, &tc->ti, aname, tflags); 3106b074b7bbSAlexander V. Chernikov if (error != 0) { 3107b074b7bbSAlexander V. Chernikov free(tc, M_IPFW); 3108b074b7bbSAlexander V. Chernikov return (NULL); 3109b074b7bbSAlexander V. Chernikov } 3110b074b7bbSAlexander V. Chernikov 3111b074b7bbSAlexander V. Chernikov return (tc); 3112b074b7bbSAlexander V. Chernikov } 3113b074b7bbSAlexander V. Chernikov 311435e1bbd0SAlexander V. Chernikov /* 311535e1bbd0SAlexander V. Chernikov * Destroys table state and config. 311635e1bbd0SAlexander V. Chernikov */ 3117b074b7bbSAlexander V. Chernikov static void 3118b074b7bbSAlexander V. Chernikov free_table_config(struct namedobj_instance *ni, struct table_config *tc) 3119b074b7bbSAlexander V. Chernikov { 3120b074b7bbSAlexander V. Chernikov 312135e1bbd0SAlexander V. Chernikov KASSERT(tc->linked == 0, ("free() on linked config")); 3122b074b7bbSAlexander V. Chernikov 31230468c5baSAlexander V. Chernikov /* 31240468c5baSAlexander V. Chernikov * We're using ta without any locking/referencing. 31250468c5baSAlexander V. Chernikov * TODO: fix this if we're going to use unloadable algos. 31260468c5baSAlexander V. Chernikov */ 312735e1bbd0SAlexander V. Chernikov tc->ta->destroy(tc->astate, &tc->ti); 3128b074b7bbSAlexander V. Chernikov free(tc, M_IPFW); 3129b074b7bbSAlexander V. Chernikov } 3130b074b7bbSAlexander V. Chernikov 3131b074b7bbSAlexander V. Chernikov /* 3132b074b7bbSAlexander V. Chernikov * Links @tc to @chain table named instance. 3133b074b7bbSAlexander V. Chernikov * Sets appropriate type/states in @chain table info. 3134b074b7bbSAlexander V. Chernikov */ 3135b074b7bbSAlexander V. Chernikov static void 31369f7d47b0SAlexander V. Chernikov link_table(struct ip_fw_chain *ch, struct table_config *tc) 3137b074b7bbSAlexander V. Chernikov { 3138b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 31399f7d47b0SAlexander V. Chernikov struct table_info *ti; 3140b074b7bbSAlexander V. Chernikov uint16_t kidx; 3141b074b7bbSAlexander V. Chernikov 31429f7d47b0SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 31439f7d47b0SAlexander V. Chernikov IPFW_WLOCK_ASSERT(ch); 3144b074b7bbSAlexander V. Chernikov 31459f7d47b0SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 3146b074b7bbSAlexander V. Chernikov kidx = tc->no.kidx; 3147b074b7bbSAlexander V. Chernikov 3148b074b7bbSAlexander V. Chernikov ipfw_objhash_add(ni, &tc->no); 31499f7d47b0SAlexander V. Chernikov 31509f7d47b0SAlexander V. Chernikov ti = KIDX_TO_TI(ch, kidx); 31519f7d47b0SAlexander V. Chernikov *ti = tc->ti; 3152b074b7bbSAlexander V. Chernikov 315368394ec8SAlexander V. Chernikov /* Notify algo on real @ti address */ 315468394ec8SAlexander V. Chernikov if (tc->ta->change_ti != NULL) 315568394ec8SAlexander V. Chernikov tc->ta->change_ti(tc->astate, ti); 315668394ec8SAlexander V. Chernikov 3157b074b7bbSAlexander V. Chernikov tc->linked = 1; 31589d099b4fSAlexander V. Chernikov tc->ta->refcnt++; 3159b074b7bbSAlexander V. Chernikov } 3160b074b7bbSAlexander V. Chernikov 3161b074b7bbSAlexander V. Chernikov /* 3162b074b7bbSAlexander V. Chernikov * Unlinks @tc from @chain table named instance. 3163b074b7bbSAlexander V. Chernikov * Zeroes states in @chain and stores them in @tc. 3164b074b7bbSAlexander V. Chernikov */ 3165b074b7bbSAlexander V. Chernikov static void 31669f7d47b0SAlexander V. Chernikov unlink_table(struct ip_fw_chain *ch, struct table_config *tc) 3167b074b7bbSAlexander V. Chernikov { 3168b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 31699f7d47b0SAlexander V. Chernikov struct table_info *ti; 3170b074b7bbSAlexander V. Chernikov uint16_t kidx; 3171b074b7bbSAlexander V. Chernikov 31729f7d47b0SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 31739f7d47b0SAlexander V. Chernikov IPFW_WLOCK_ASSERT(ch); 3174b074b7bbSAlexander V. Chernikov 31759f7d47b0SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 3176b074b7bbSAlexander V. Chernikov kidx = tc->no.kidx; 3177b074b7bbSAlexander V. Chernikov 31789f7d47b0SAlexander V. Chernikov /* Clear state. @ti copy is already saved inside @tc */ 3179b074b7bbSAlexander V. Chernikov ipfw_objhash_del(ni, &tc->no); 31809f7d47b0SAlexander V. Chernikov ti = KIDX_TO_TI(ch, kidx); 31819f7d47b0SAlexander V. Chernikov memset(ti, 0, sizeof(struct table_info)); 3182b074b7bbSAlexander V. Chernikov tc->linked = 0; 31839d099b4fSAlexander V. Chernikov tc->ta->refcnt--; 318468394ec8SAlexander V. Chernikov 318568394ec8SAlexander V. Chernikov /* Notify algo on real @ti address */ 318668394ec8SAlexander V. Chernikov if (tc->ta->change_ti != NULL) 318768394ec8SAlexander V. Chernikov tc->ta->change_ti(tc->astate, NULL); 3188b074b7bbSAlexander V. Chernikov } 3189b074b7bbSAlexander V. Chernikov 3190a73d728dSAlexander V. Chernikov struct swap_table_args { 3191a73d728dSAlexander V. Chernikov int set; 3192a73d728dSAlexander V. Chernikov int new_set; 3193a73d728dSAlexander V. Chernikov int mv; 3194a73d728dSAlexander V. Chernikov }; 3195a73d728dSAlexander V. Chernikov 3196a73d728dSAlexander V. Chernikov /* 3197a73d728dSAlexander V. Chernikov * Change set for each matching table. 3198a73d728dSAlexander V. Chernikov * 3199a73d728dSAlexander V. Chernikov * Ensure we dispatch each table once by setting/checking ochange 3200a73d728dSAlexander V. Chernikov * fields. 3201a73d728dSAlexander V. Chernikov */ 3202a73d728dSAlexander V. Chernikov static void 3203a73d728dSAlexander V. Chernikov swap_table_set(struct namedobj_instance *ni, struct named_object *no, 3204a73d728dSAlexander V. Chernikov void *arg) 3205a73d728dSAlexander V. Chernikov { 3206a73d728dSAlexander V. Chernikov struct table_config *tc; 3207a73d728dSAlexander V. Chernikov struct swap_table_args *sta; 3208a73d728dSAlexander V. Chernikov 3209a73d728dSAlexander V. Chernikov tc = (struct table_config *)no; 3210a73d728dSAlexander V. Chernikov sta = (struct swap_table_args *)arg; 3211a73d728dSAlexander V. Chernikov 3212a73d728dSAlexander V. Chernikov if (no->set != sta->set && (no->set != sta->new_set || sta->mv != 0)) 3213a73d728dSAlexander V. Chernikov return; 3214a73d728dSAlexander V. Chernikov 3215a73d728dSAlexander V. Chernikov if (tc->ochanged != 0) 3216a73d728dSAlexander V. Chernikov return; 3217a73d728dSAlexander V. Chernikov 3218a73d728dSAlexander V. Chernikov tc->ochanged = 1; 3219a73d728dSAlexander V. Chernikov ipfw_objhash_del(ni, no); 3220a73d728dSAlexander V. Chernikov if (no->set == sta->set) 3221a73d728dSAlexander V. Chernikov no->set = sta->new_set; 3222a73d728dSAlexander V. Chernikov else 3223a73d728dSAlexander V. Chernikov no->set = sta->set; 3224a73d728dSAlexander V. Chernikov ipfw_objhash_add(ni, no); 3225a73d728dSAlexander V. Chernikov } 3226a73d728dSAlexander V. Chernikov 3227a73d728dSAlexander V. Chernikov /* 3228a73d728dSAlexander V. Chernikov * Cleans up ochange field for all tables. 3229a73d728dSAlexander V. Chernikov */ 3230a73d728dSAlexander V. Chernikov static void 3231a73d728dSAlexander V. Chernikov clean_table_set_data(struct namedobj_instance *ni, struct named_object *no, 3232a73d728dSAlexander V. Chernikov void *arg) 3233a73d728dSAlexander V. Chernikov { 3234a73d728dSAlexander V. Chernikov struct table_config *tc; 3235a73d728dSAlexander V. Chernikov struct swap_table_args *sta; 3236a73d728dSAlexander V. Chernikov 3237a73d728dSAlexander V. Chernikov tc = (struct table_config *)no; 3238a73d728dSAlexander V. Chernikov sta = (struct swap_table_args *)arg; 3239a73d728dSAlexander V. Chernikov 3240a73d728dSAlexander V. Chernikov tc->ochanged = 0; 3241a73d728dSAlexander V. Chernikov } 3242a73d728dSAlexander V. Chernikov 3243a73d728dSAlexander V. Chernikov /* 3244a73d728dSAlexander V. Chernikov * Swaps tables within two sets. 3245a73d728dSAlexander V. Chernikov */ 3246a73d728dSAlexander V. Chernikov void 3247a73d728dSAlexander V. Chernikov ipfw_swap_tables_sets(struct ip_fw_chain *ch, uint32_t set, 3248a73d728dSAlexander V. Chernikov uint32_t new_set, int mv) 3249a73d728dSAlexander V. Chernikov { 3250a73d728dSAlexander V. Chernikov struct swap_table_args sta; 3251a73d728dSAlexander V. Chernikov 3252a73d728dSAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 3253a73d728dSAlexander V. Chernikov 3254a73d728dSAlexander V. Chernikov sta.set = set; 3255a73d728dSAlexander V. Chernikov sta.new_set = new_set; 3256a73d728dSAlexander V. Chernikov sta.mv = mv; 3257a73d728dSAlexander V. Chernikov 3258a73d728dSAlexander V. Chernikov ipfw_objhash_foreach(CHAIN_TO_NI(ch), swap_table_set, &sta); 3259a73d728dSAlexander V. Chernikov ipfw_objhash_foreach(CHAIN_TO_NI(ch), clean_table_set_data, &sta); 3260a73d728dSAlexander V. Chernikov } 3261a73d728dSAlexander V. Chernikov 3262a73d728dSAlexander V. Chernikov /* 3263a73d728dSAlexander V. Chernikov * Move all tables which are reference by rules in @rr to set @new_set. 3264a73d728dSAlexander V. Chernikov * Makes sure that all relevant tables are referenced ONLLY by given rules. 3265a73d728dSAlexander V. Chernikov * 3266a73d728dSAlexander V. Chernikov * Retuns 0 on success, 3267a73d728dSAlexander V. Chernikov */ 3268a73d728dSAlexander V. Chernikov int 3269a73d728dSAlexander V. Chernikov ipfw_move_tables_sets(struct ip_fw_chain *ch, ipfw_range_tlv *rt, 3270a73d728dSAlexander V. Chernikov uint32_t new_set) 3271a73d728dSAlexander V. Chernikov { 3272a73d728dSAlexander V. Chernikov struct ip_fw *rule; 3273a73d728dSAlexander V. Chernikov struct table_config *tc; 3274a73d728dSAlexander V. Chernikov struct named_object *no; 3275a73d728dSAlexander V. Chernikov struct namedobj_instance *ni; 3276a73d728dSAlexander V. Chernikov int bad, i, l, cmdlen; 3277a73d728dSAlexander V. Chernikov uint16_t kidx; 3278a73d728dSAlexander V. Chernikov uint8_t type; 3279a73d728dSAlexander V. Chernikov ipfw_insn *cmd; 3280a73d728dSAlexander V. Chernikov 3281a73d728dSAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 3282a73d728dSAlexander V. Chernikov 3283a73d728dSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 3284a73d728dSAlexander V. Chernikov 3285a73d728dSAlexander V. Chernikov /* Stage 1: count number of references by given rules */ 3286a73d728dSAlexander V. Chernikov for (i = 0; i < ch->n_rules - 1; i++) { 3287a73d728dSAlexander V. Chernikov rule = ch->map[i]; 3288a73d728dSAlexander V. Chernikov if (ipfw_match_range(rule, rt) == 0) 3289a73d728dSAlexander V. Chernikov continue; 3290a73d728dSAlexander V. Chernikov 3291a73d728dSAlexander V. Chernikov l = rule->cmd_len; 3292a73d728dSAlexander V. Chernikov cmd = rule->cmd; 3293a73d728dSAlexander V. Chernikov cmdlen = 0; 3294a73d728dSAlexander V. Chernikov for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 3295a73d728dSAlexander V. Chernikov cmdlen = F_LEN(cmd); 3296a73d728dSAlexander V. Chernikov if (classify_table_opcode(cmd, &kidx, &type) != 0) 3297a73d728dSAlexander V. Chernikov continue; 3298a73d728dSAlexander V. Chernikov no = ipfw_objhash_lookup_kidx(ni, kidx); 3299a73d728dSAlexander V. Chernikov KASSERT(no != NULL, 3300a73d728dSAlexander V. Chernikov ("objhash lookup failed on index %d", kidx)); 3301a73d728dSAlexander V. Chernikov tc = (struct table_config *)no; 3302a73d728dSAlexander V. Chernikov tc->ocount++; 3303a73d728dSAlexander V. Chernikov } 3304a73d728dSAlexander V. Chernikov 3305a73d728dSAlexander V. Chernikov } 3306a73d728dSAlexander V. Chernikov 3307a73d728dSAlexander V. Chernikov /* Stage 2: verify "ownership" */ 3308a73d728dSAlexander V. Chernikov bad = 0; 3309a73d728dSAlexander V. Chernikov for (i = 0; i < ch->n_rules - 1; i++) { 3310a73d728dSAlexander V. Chernikov rule = ch->map[i]; 3311a73d728dSAlexander V. Chernikov if (ipfw_match_range(rule, rt) == 0) 3312a73d728dSAlexander V. Chernikov continue; 3313a73d728dSAlexander V. Chernikov 3314a73d728dSAlexander V. Chernikov l = rule->cmd_len; 3315a73d728dSAlexander V. Chernikov cmd = rule->cmd; 3316a73d728dSAlexander V. Chernikov cmdlen = 0; 3317a73d728dSAlexander V. Chernikov for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 3318a73d728dSAlexander V. Chernikov cmdlen = F_LEN(cmd); 3319a73d728dSAlexander V. Chernikov if (classify_table_opcode(cmd, &kidx, &type) != 0) 3320a73d728dSAlexander V. Chernikov continue; 3321a73d728dSAlexander V. Chernikov no = ipfw_objhash_lookup_kidx(ni, kidx); 3322a73d728dSAlexander V. Chernikov KASSERT(no != NULL, 3323a73d728dSAlexander V. Chernikov ("objhash lookup failed on index %d", kidx)); 3324a73d728dSAlexander V. Chernikov tc = (struct table_config *)no; 3325a73d728dSAlexander V. Chernikov if (tc->no.refcnt != tc->ocount) { 3326a73d728dSAlexander V. Chernikov 3327a73d728dSAlexander V. Chernikov /* 3328a73d728dSAlexander V. Chernikov * Number of references differ: 3329a73d728dSAlexander V. Chernikov * Other rule(s) are holding reference to given 3330a73d728dSAlexander V. Chernikov * table, so it is not possible to change its set. 3331a73d728dSAlexander V. Chernikov * 3332a73d728dSAlexander V. Chernikov * Note that refcnt may account 3333a73d728dSAlexander V. Chernikov * references to some going-to-be-added rules. 3334a73d728dSAlexander V. Chernikov * Since we don't know their numbers (and event 3335a73d728dSAlexander V. Chernikov * if they will be added) it is perfectly OK 3336a73d728dSAlexander V. Chernikov * to return error here. 3337a73d728dSAlexander V. Chernikov */ 3338a73d728dSAlexander V. Chernikov bad = 1; 3339a73d728dSAlexander V. Chernikov break; 3340a73d728dSAlexander V. Chernikov } 3341a73d728dSAlexander V. Chernikov } 3342a73d728dSAlexander V. Chernikov 3343a73d728dSAlexander V. Chernikov if (bad != 0) 3344a73d728dSAlexander V. Chernikov break; 3345a73d728dSAlexander V. Chernikov } 3346a73d728dSAlexander V. Chernikov 3347a73d728dSAlexander V. Chernikov /* Stage 3: change set or cleanup */ 3348a73d728dSAlexander V. Chernikov for (i = 0; i < ch->n_rules - 1; i++) { 3349a73d728dSAlexander V. Chernikov rule = ch->map[i]; 3350a73d728dSAlexander V. Chernikov if (ipfw_match_range(rule, rt) == 0) 3351a73d728dSAlexander V. Chernikov continue; 3352a73d728dSAlexander V. Chernikov 3353a73d728dSAlexander V. Chernikov l = rule->cmd_len; 3354a73d728dSAlexander V. Chernikov cmd = rule->cmd; 3355a73d728dSAlexander V. Chernikov cmdlen = 0; 3356a73d728dSAlexander V. Chernikov for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 3357a73d728dSAlexander V. Chernikov cmdlen = F_LEN(cmd); 3358a73d728dSAlexander V. Chernikov if (classify_table_opcode(cmd, &kidx, &type) != 0) 3359a73d728dSAlexander V. Chernikov continue; 3360a73d728dSAlexander V. Chernikov no = ipfw_objhash_lookup_kidx(ni, kidx); 3361a73d728dSAlexander V. Chernikov KASSERT(no != NULL, 3362a73d728dSAlexander V. Chernikov ("objhash lookup failed on index %d", kidx)); 3363a73d728dSAlexander V. Chernikov tc = (struct table_config *)no; 3364a73d728dSAlexander V. Chernikov 3365a73d728dSAlexander V. Chernikov tc->ocount = 0; 3366a73d728dSAlexander V. Chernikov if (bad != 0) 3367a73d728dSAlexander V. Chernikov continue; 3368a73d728dSAlexander V. Chernikov 3369a73d728dSAlexander V. Chernikov /* Actually change set. */ 3370a73d728dSAlexander V. Chernikov ipfw_objhash_del(ni, no); 3371a73d728dSAlexander V. Chernikov no->set = new_set; 3372a73d728dSAlexander V. Chernikov ipfw_objhash_add(ni, no); 3373a73d728dSAlexander V. Chernikov } 3374a73d728dSAlexander V. Chernikov } 3375a73d728dSAlexander V. Chernikov 3376a73d728dSAlexander V. Chernikov return (bad); 3377a73d728dSAlexander V. Chernikov } 3378a73d728dSAlexander V. Chernikov 3379b074b7bbSAlexander V. Chernikov /* 3380f99fbf96SAlexander V. Chernikov * Finds and bumps refcount for tables referenced by given @rule. 3381e5eec6ddSAlexander V. Chernikov * Auto-creates non-existing tables. 3382f99fbf96SAlexander V. Chernikov * Fills in @oib array with userland/kernel indexes. 3383f99fbf96SAlexander V. Chernikov * First free oidx pointer is saved back in @oib. 3384f99fbf96SAlexander V. Chernikov * 3385f99fbf96SAlexander V. Chernikov * Returns 0 on success. 3386f99fbf96SAlexander V. Chernikov */ 3387f99fbf96SAlexander V. Chernikov static int 3388e5eec6ddSAlexander V. Chernikov find_ref_rule_tables(struct ip_fw_chain *ch, struct ip_fw *rule, 3389f99fbf96SAlexander V. Chernikov struct rule_check_info *ci, struct obj_idx **oib, struct tid_info *ti) 3390f99fbf96SAlexander V. Chernikov { 3391f99fbf96SAlexander V. Chernikov struct table_config *tc; 3392f99fbf96SAlexander V. Chernikov struct namedobj_instance *ni; 3393f99fbf96SAlexander V. Chernikov struct named_object *no; 3394f99fbf96SAlexander V. Chernikov int cmdlen, error, l, numnew; 3395f99fbf96SAlexander V. Chernikov uint16_t kidx; 3396f99fbf96SAlexander V. Chernikov ipfw_insn *cmd; 3397f99fbf96SAlexander V. Chernikov struct obj_idx *pidx, *pidx_first, *p; 3398f99fbf96SAlexander V. Chernikov 3399f99fbf96SAlexander V. Chernikov pidx_first = *oib; 3400f99fbf96SAlexander V. Chernikov pidx = pidx_first; 3401f99fbf96SAlexander V. Chernikov l = rule->cmd_len; 3402f99fbf96SAlexander V. Chernikov cmd = rule->cmd; 3403f99fbf96SAlexander V. Chernikov cmdlen = 0; 3404f99fbf96SAlexander V. Chernikov error = 0; 3405f99fbf96SAlexander V. Chernikov numnew = 0; 3406f99fbf96SAlexander V. Chernikov 3407f99fbf96SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 3408f99fbf96SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 3409f99fbf96SAlexander V. Chernikov 3410e5eec6ddSAlexander V. Chernikov /* Increase refcount on each existing referenced table. */ 3411f99fbf96SAlexander V. Chernikov for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 3412f99fbf96SAlexander V. Chernikov cmdlen = F_LEN(cmd); 3413f99fbf96SAlexander V. Chernikov 3414f99fbf96SAlexander V. Chernikov if (classify_table_opcode(cmd, &ti->uidx, &ti->type) != 0) 3415f99fbf96SAlexander V. Chernikov continue; 3416f99fbf96SAlexander V. Chernikov 3417f99fbf96SAlexander V. Chernikov pidx->uidx = ti->uidx; 3418f99fbf96SAlexander V. Chernikov pidx->type = ti->type; 3419f99fbf96SAlexander V. Chernikov 3420f99fbf96SAlexander V. Chernikov if ((tc = find_table(ni, ti)) != NULL) { 3421f99fbf96SAlexander V. Chernikov if (tc->no.type != ti->type) { 3422f99fbf96SAlexander V. Chernikov /* Incompatible types */ 3423f99fbf96SAlexander V. Chernikov error = EINVAL; 3424f99fbf96SAlexander V. Chernikov break; 3425f99fbf96SAlexander V. Chernikov } 3426f99fbf96SAlexander V. Chernikov 3427f99fbf96SAlexander V. Chernikov /* Reference found table and save kidx */ 3428f99fbf96SAlexander V. Chernikov tc->no.refcnt++; 3429f99fbf96SAlexander V. Chernikov pidx->kidx = tc->no.kidx; 3430f99fbf96SAlexander V. Chernikov pidx++; 3431f99fbf96SAlexander V. Chernikov continue; 3432f99fbf96SAlexander V. Chernikov } 3433f99fbf96SAlexander V. Chernikov 3434f99fbf96SAlexander V. Chernikov /* 3435f99fbf96SAlexander V. Chernikov * Compability stuff for old clients: 3436f99fbf96SAlexander V. Chernikov * prepare to manually create non-existing tables. 3437f99fbf96SAlexander V. Chernikov */ 3438f99fbf96SAlexander V. Chernikov pidx++; 3439f99fbf96SAlexander V. Chernikov numnew++; 3440f99fbf96SAlexander V. Chernikov } 3441f99fbf96SAlexander V. Chernikov 3442f99fbf96SAlexander V. Chernikov if (error != 0) { 3443f99fbf96SAlexander V. Chernikov /* Unref everything we have already done */ 3444f99fbf96SAlexander V. Chernikov for (p = *oib; p < pidx; p++) { 3445f99fbf96SAlexander V. Chernikov if (p->kidx == 0) 3446f99fbf96SAlexander V. Chernikov continue; 3447f99fbf96SAlexander V. Chernikov 3448f99fbf96SAlexander V. Chernikov /* Find & unref by existing idx */ 3449f99fbf96SAlexander V. Chernikov no = ipfw_objhash_lookup_kidx(ni, p->kidx); 3450f99fbf96SAlexander V. Chernikov KASSERT(no != NULL, ("Ref'd table %d disappeared", 3451f99fbf96SAlexander V. Chernikov p->kidx)); 3452f99fbf96SAlexander V. Chernikov 3453f99fbf96SAlexander V. Chernikov no->refcnt--; 3454f99fbf96SAlexander V. Chernikov } 3455f99fbf96SAlexander V. Chernikov } 3456f99fbf96SAlexander V. Chernikov 3457f99fbf96SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 3458f99fbf96SAlexander V. Chernikov 3459f99fbf96SAlexander V. Chernikov if (numnew == 0) { 3460f99fbf96SAlexander V. Chernikov *oib = pidx; 3461f99fbf96SAlexander V. Chernikov return (error); 3462f99fbf96SAlexander V. Chernikov } 3463f99fbf96SAlexander V. Chernikov 3464f99fbf96SAlexander V. Chernikov /* 3465f99fbf96SAlexander V. Chernikov * Compatibility stuff: do actual creation for non-existing, 3466f99fbf96SAlexander V. Chernikov * but referenced tables. 3467f99fbf96SAlexander V. Chernikov */ 3468f99fbf96SAlexander V. Chernikov for (p = pidx_first; p < pidx; p++) { 3469f99fbf96SAlexander V. Chernikov if (p->kidx != 0) 3470f99fbf96SAlexander V. Chernikov continue; 3471f99fbf96SAlexander V. Chernikov 3472f99fbf96SAlexander V. Chernikov ti->uidx = p->uidx; 3473f99fbf96SAlexander V. Chernikov ti->type = p->type; 3474f99fbf96SAlexander V. Chernikov ti->atype = 0; 3475f99fbf96SAlexander V. Chernikov 3476867708f7SAlexander V. Chernikov error = create_table_compat(ch, ti, &kidx); 3477f99fbf96SAlexander V. Chernikov if (error == 0) { 3478f99fbf96SAlexander V. Chernikov p->kidx = kidx; 3479f99fbf96SAlexander V. Chernikov continue; 3480f99fbf96SAlexander V. Chernikov } 3481f99fbf96SAlexander V. Chernikov 3482f99fbf96SAlexander V. Chernikov /* Error. We have to drop references */ 3483f99fbf96SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 3484f99fbf96SAlexander V. Chernikov for (p = pidx_first; p < pidx; p++) { 3485f99fbf96SAlexander V. Chernikov if (p->kidx == 0) 3486f99fbf96SAlexander V. Chernikov continue; 3487f99fbf96SAlexander V. Chernikov 3488f99fbf96SAlexander V. Chernikov /* Find & unref by existing idx */ 3489f99fbf96SAlexander V. Chernikov no = ipfw_objhash_lookup_kidx(ni, p->kidx); 3490f99fbf96SAlexander V. Chernikov KASSERT(no != NULL, ("Ref'd table %d disappeared", 3491f99fbf96SAlexander V. Chernikov p->kidx)); 3492f99fbf96SAlexander V. Chernikov 3493f99fbf96SAlexander V. Chernikov no->refcnt--; 3494f99fbf96SAlexander V. Chernikov } 3495f99fbf96SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 3496f99fbf96SAlexander V. Chernikov 3497f99fbf96SAlexander V. Chernikov return (error); 3498f99fbf96SAlexander V. Chernikov } 3499f99fbf96SAlexander V. Chernikov 3500f99fbf96SAlexander V. Chernikov *oib = pidx; 3501f99fbf96SAlexander V. Chernikov 3502f99fbf96SAlexander V. Chernikov return (error); 3503f99fbf96SAlexander V. Chernikov } 3504f99fbf96SAlexander V. Chernikov 3505f99fbf96SAlexander V. Chernikov /* 3506f99fbf96SAlexander V. Chernikov * Remove references from every table used in @rule. 3507f99fbf96SAlexander V. Chernikov */ 3508f99fbf96SAlexander V. Chernikov void 3509e5eec6ddSAlexander V. Chernikov ipfw_unref_rule_tables(struct ip_fw_chain *chain, struct ip_fw *rule) 3510f99fbf96SAlexander V. Chernikov { 3511f99fbf96SAlexander V. Chernikov int cmdlen, l; 3512f99fbf96SAlexander V. Chernikov ipfw_insn *cmd; 3513f99fbf96SAlexander V. Chernikov struct namedobj_instance *ni; 3514f99fbf96SAlexander V. Chernikov struct named_object *no; 3515f99fbf96SAlexander V. Chernikov uint16_t kidx; 3516f99fbf96SAlexander V. Chernikov uint8_t type; 3517f99fbf96SAlexander V. Chernikov 3518f99fbf96SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(chain); 3519f99fbf96SAlexander V. Chernikov ni = CHAIN_TO_NI(chain); 3520f99fbf96SAlexander V. Chernikov 3521f99fbf96SAlexander V. Chernikov l = rule->cmd_len; 3522f99fbf96SAlexander V. Chernikov cmd = rule->cmd; 3523f99fbf96SAlexander V. Chernikov cmdlen = 0; 3524f99fbf96SAlexander V. Chernikov for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 3525f99fbf96SAlexander V. Chernikov cmdlen = F_LEN(cmd); 3526f99fbf96SAlexander V. Chernikov 3527f99fbf96SAlexander V. Chernikov if (classify_table_opcode(cmd, &kidx, &type) != 0) 3528f99fbf96SAlexander V. Chernikov continue; 3529f99fbf96SAlexander V. Chernikov 3530f99fbf96SAlexander V. Chernikov no = ipfw_objhash_lookup_kidx(ni, kidx); 3531f99fbf96SAlexander V. Chernikov 3532f99fbf96SAlexander V. Chernikov KASSERT(no != NULL, ("table id %d not found", kidx)); 3533f99fbf96SAlexander V. Chernikov KASSERT(no->type == type, ("wrong type %d (%d) for table id %d", 3534f99fbf96SAlexander V. Chernikov no->type, type, kidx)); 3535f99fbf96SAlexander V. Chernikov KASSERT(no->refcnt > 0, ("refcount for table %d is %d", 3536f99fbf96SAlexander V. Chernikov kidx, no->refcnt)); 3537f99fbf96SAlexander V. Chernikov 3538f99fbf96SAlexander V. Chernikov no->refcnt--; 3539f99fbf96SAlexander V. Chernikov } 3540f99fbf96SAlexander V. Chernikov } 3541f99fbf96SAlexander V. Chernikov 3542f99fbf96SAlexander V. Chernikov /* 3543b074b7bbSAlexander V. Chernikov * Compatibility function for old ipfw(8) binaries. 3544b074b7bbSAlexander V. Chernikov * Rewrites table kernel indices with userland ones. 354535e1bbd0SAlexander V. Chernikov * Convert tables matching '/^\d+$/' to their atoi() value. 354635e1bbd0SAlexander V. Chernikov * Use number 65535 for other tables. 3547b074b7bbSAlexander V. Chernikov * 3548b074b7bbSAlexander V. Chernikov * Returns 0 on success. 3549b074b7bbSAlexander V. Chernikov */ 3550b074b7bbSAlexander V. Chernikov int 35517e767c79SAlexander V. Chernikov ipfw_rewrite_table_kidx(struct ip_fw_chain *chain, struct ip_fw_rule0 *rule) 3552b074b7bbSAlexander V. Chernikov { 35531832a7b3SAlexander V. Chernikov int cmdlen, error, l; 3554b074b7bbSAlexander V. Chernikov ipfw_insn *cmd; 35551832a7b3SAlexander V. Chernikov uint16_t kidx, uidx; 3556b074b7bbSAlexander V. Chernikov uint8_t type; 3557b074b7bbSAlexander V. Chernikov struct named_object *no; 3558b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 3559b074b7bbSAlexander V. Chernikov 3560b074b7bbSAlexander V. Chernikov ni = CHAIN_TO_NI(chain); 35611832a7b3SAlexander V. Chernikov error = 0; 3562b074b7bbSAlexander V. Chernikov 3563b074b7bbSAlexander V. Chernikov l = rule->cmd_len; 3564b074b7bbSAlexander V. Chernikov cmd = rule->cmd; 3565b074b7bbSAlexander V. Chernikov cmdlen = 0; 3566b074b7bbSAlexander V. Chernikov for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 3567b074b7bbSAlexander V. Chernikov cmdlen = F_LEN(cmd); 3568b074b7bbSAlexander V. Chernikov 3569b074b7bbSAlexander V. Chernikov if (classify_table_opcode(cmd, &kidx, &type) != 0) 3570b074b7bbSAlexander V. Chernikov continue; 3571b074b7bbSAlexander V. Chernikov 3572ac35ff17SAlexander V. Chernikov if ((no = ipfw_objhash_lookup_kidx(ni, kidx)) == NULL) 3573b074b7bbSAlexander V. Chernikov return (1); 3574b074b7bbSAlexander V. Chernikov 35751832a7b3SAlexander V. Chernikov uidx = no->uidx; 35761832a7b3SAlexander V. Chernikov if (no->compat == 0) { 3577b074b7bbSAlexander V. Chernikov 35781832a7b3SAlexander V. Chernikov /* 35791832a7b3SAlexander V. Chernikov * We are called via legacy opcode. 35801832a7b3SAlexander V. Chernikov * Save error and show table as fake number 35811832a7b3SAlexander V. Chernikov * not to make ipfw(8) hang. 35821832a7b3SAlexander V. Chernikov */ 35831832a7b3SAlexander V. Chernikov uidx = 65535; 35841832a7b3SAlexander V. Chernikov error = 2; 3585b074b7bbSAlexander V. Chernikov } 3586b074b7bbSAlexander V. Chernikov 35871832a7b3SAlexander V. Chernikov update_table_opcode(cmd, uidx); 35881832a7b3SAlexander V. Chernikov } 35891832a7b3SAlexander V. Chernikov 35901832a7b3SAlexander V. Chernikov return (error); 3591b074b7bbSAlexander V. Chernikov } 3592b074b7bbSAlexander V. Chernikov 3593563b5ab1SAlexander V. Chernikov /* 3594b074b7bbSAlexander V. Chernikov * Checks is opcode is referencing table of appropriate type. 3595b074b7bbSAlexander V. Chernikov * Adds reference count for found table if true. 3596b074b7bbSAlexander V. Chernikov * Rewrites user-supplied opcode values with kernel ones. 3597b074b7bbSAlexander V. Chernikov * 3598b074b7bbSAlexander V. Chernikov * Returns 0 on success and appropriate error code otherwise. 3599b074b7bbSAlexander V. Chernikov */ 3600b074b7bbSAlexander V. Chernikov int 3601b074b7bbSAlexander V. Chernikov ipfw_rewrite_table_uidx(struct ip_fw_chain *chain, 3602b074b7bbSAlexander V. Chernikov struct rule_check_info *ci) 3603b074b7bbSAlexander V. Chernikov { 36040468c5baSAlexander V. Chernikov int cmdlen, error, l; 3605b074b7bbSAlexander V. Chernikov ipfw_insn *cmd; 3606b074b7bbSAlexander V. Chernikov uint16_t uidx; 3607b074b7bbSAlexander V. Chernikov uint8_t type; 3608b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 36099490a627SAlexander V. Chernikov struct obj_idx *p, *pidx_first, *pidx_last; 3610b074b7bbSAlexander V. Chernikov struct tid_info ti; 3611b074b7bbSAlexander V. Chernikov 3612b074b7bbSAlexander V. Chernikov ni = CHAIN_TO_NI(chain); 3613b074b7bbSAlexander V. Chernikov 3614b074b7bbSAlexander V. Chernikov /* 3615b074b7bbSAlexander V. Chernikov * Prepare an array for storing opcode indices. 3616b074b7bbSAlexander V. Chernikov * Use stack allocation by default. 3617b074b7bbSAlexander V. Chernikov */ 3618b074b7bbSAlexander V. Chernikov if (ci->table_opcodes <= (sizeof(ci->obuf)/sizeof(ci->obuf[0]))) { 3619b074b7bbSAlexander V. Chernikov /* Stack */ 36209490a627SAlexander V. Chernikov pidx_first = ci->obuf; 3621b074b7bbSAlexander V. Chernikov } else 36229490a627SAlexander V. Chernikov pidx_first = malloc(ci->table_opcodes * sizeof(struct obj_idx), 3623b074b7bbSAlexander V. Chernikov M_IPFW, M_WAITOK | M_ZERO); 3624b074b7bbSAlexander V. Chernikov 36259490a627SAlexander V. Chernikov pidx_last = pidx_first; 3626b074b7bbSAlexander V. Chernikov error = 0; 3627b074b7bbSAlexander V. Chernikov type = 0; 3628b074b7bbSAlexander V. Chernikov memset(&ti, 0, sizeof(ti)); 36291832a7b3SAlexander V. Chernikov 36301832a7b3SAlexander V. Chernikov /* 36311832a7b3SAlexander V. Chernikov * Use default set for looking up tables (old way) or 36321832a7b3SAlexander V. Chernikov * use set rule is assigned to (new way). 36331832a7b3SAlexander V. Chernikov */ 36341832a7b3SAlexander V. Chernikov ti.set = (V_fw_tables_sets != 0) ? ci->krule->set : 0; 36356c2997ffSAlexander V. Chernikov if (ci->ctlv != NULL) { 36366c2997ffSAlexander V. Chernikov ti.tlvs = (void *)(ci->ctlv + 1); 36376c2997ffSAlexander V. Chernikov ti.tlen = ci->ctlv->head.length - sizeof(ipfw_obj_ctlv); 36386c2997ffSAlexander V. Chernikov } 3639b074b7bbSAlexander V. Chernikov 36400468c5baSAlexander V. Chernikov /* Reference all used tables */ 3641e5eec6ddSAlexander V. Chernikov error = find_ref_rule_tables(chain, ci->krule, ci, &pidx_last, &ti); 36420468c5baSAlexander V. Chernikov if (error != 0) 36439f7d47b0SAlexander V. Chernikov goto free; 3644b074b7bbSAlexander V. Chernikov 36459f7d47b0SAlexander V. Chernikov IPFW_UH_WLOCK(chain); 36469f7d47b0SAlexander V. Chernikov 3647b074b7bbSAlexander V. Chernikov /* Perform rule rewrite */ 3648b074b7bbSAlexander V. Chernikov l = ci->krule->cmd_len; 3649b074b7bbSAlexander V. Chernikov cmd = ci->krule->cmd; 3650b074b7bbSAlexander V. Chernikov cmdlen = 0; 36519490a627SAlexander V. Chernikov p = pidx_first; 3652b074b7bbSAlexander V. Chernikov for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 3653b074b7bbSAlexander V. Chernikov cmdlen = F_LEN(cmd); 3654b074b7bbSAlexander V. Chernikov if (classify_table_opcode(cmd, &uidx, &type) != 0) 3655b074b7bbSAlexander V. Chernikov continue; 36569490a627SAlexander V. Chernikov update_table_opcode(cmd, p->kidx); 36579490a627SAlexander V. Chernikov p++; 3658b074b7bbSAlexander V. Chernikov } 3659b074b7bbSAlexander V. Chernikov 3660b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(chain); 3661b074b7bbSAlexander V. Chernikov 3662b074b7bbSAlexander V. Chernikov free: 36639490a627SAlexander V. Chernikov if (pidx_first != ci->obuf) 36649490a627SAlexander V. Chernikov free(pidx_first, M_IPFW); 3665b074b7bbSAlexander V. Chernikov 3666b074b7bbSAlexander V. Chernikov return (error); 3667b074b7bbSAlexander V. Chernikov } 3668b074b7bbSAlexander V. Chernikov 3669