13b3a8eb9SGleb Smirnoff /*- 2fe267a55SPedro F. Giffuni * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 3fe267a55SPedro F. Giffuni * 43b3a8eb9SGleb Smirnoff * Copyright (c) 2004 Ruslan Ermilov and Vsevolod Lobko. 51a33e799SAlexander V. Chernikov * Copyright (c) 2014 Yandex LLC 61a33e799SAlexander V. Chernikov * Copyright (c) 2014 Alexander V. Chernikov 73b3a8eb9SGleb Smirnoff * 83b3a8eb9SGleb Smirnoff * Redistribution and use in source and binary forms, with or without 93b3a8eb9SGleb Smirnoff * modification, are permitted provided that the following conditions 103b3a8eb9SGleb Smirnoff * are met: 113b3a8eb9SGleb Smirnoff * 1. Redistributions of source code must retain the above copyright 123b3a8eb9SGleb Smirnoff * notice, this list of conditions and the following disclaimer. 133b3a8eb9SGleb Smirnoff * 2. Redistributions in binary form must reproduce the above copyright 143b3a8eb9SGleb Smirnoff * notice, this list of conditions and the following disclaimer in the 153b3a8eb9SGleb Smirnoff * documentation and/or other materials provided with the distribution. 163b3a8eb9SGleb Smirnoff * 173b3a8eb9SGleb Smirnoff * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 183b3a8eb9SGleb Smirnoff * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 193b3a8eb9SGleb Smirnoff * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 203b3a8eb9SGleb Smirnoff * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 213b3a8eb9SGleb Smirnoff * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 223b3a8eb9SGleb Smirnoff * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 233b3a8eb9SGleb Smirnoff * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 243b3a8eb9SGleb Smirnoff * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 253b3a8eb9SGleb Smirnoff * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 263b3a8eb9SGleb Smirnoff * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 273b3a8eb9SGleb Smirnoff * SUCH DAMAGE. 283b3a8eb9SGleb Smirnoff */ 293b3a8eb9SGleb Smirnoff 303b3a8eb9SGleb Smirnoff #include <sys/cdefs.h> 313b3a8eb9SGleb Smirnoff __FBSDID("$FreeBSD$"); 323b3a8eb9SGleb Smirnoff 333b3a8eb9SGleb Smirnoff /* 34563b5ab1SAlexander V. Chernikov * Lookup table support for ipfw. 353b3a8eb9SGleb Smirnoff * 36ac35ff17SAlexander V. Chernikov * This file contains handlers for all generic tables' operations: 37563b5ab1SAlexander V. Chernikov * add/del/flush entries, list/dump tables etc.. 383b3a8eb9SGleb Smirnoff * 391a33e799SAlexander V. Chernikov * Table data modification is protected by both UH and runtime lock 40563b5ab1SAlexander V. Chernikov * while reading configuration/data is protected by UH lock. 41563b5ab1SAlexander V. Chernikov * 42563b5ab1SAlexander V. Chernikov * Lookup algorithms for all table types are located in ip_fw_table_algo.c 433b3a8eb9SGleb Smirnoff */ 443b3a8eb9SGleb Smirnoff 453b3a8eb9SGleb Smirnoff #include "opt_ipfw.h" 463b3a8eb9SGleb Smirnoff 473b3a8eb9SGleb Smirnoff #include <sys/param.h> 483b3a8eb9SGleb Smirnoff #include <sys/systm.h> 493b3a8eb9SGleb Smirnoff #include <sys/malloc.h> 503b3a8eb9SGleb Smirnoff #include <sys/kernel.h> 513b3a8eb9SGleb Smirnoff #include <sys/lock.h> 523b3a8eb9SGleb Smirnoff #include <sys/rwlock.h> 53ccba94b8SAlexander V. Chernikov #include <sys/rmlock.h> 543b3a8eb9SGleb Smirnoff #include <sys/socket.h> 55f1220db8SAlexander V. Chernikov #include <sys/socketvar.h> 563b3a8eb9SGleb Smirnoff #include <sys/queue.h> 573b3a8eb9SGleb Smirnoff #include <net/if.h> /* ip_fw.h requires IFNAMSIZ */ 583b3a8eb9SGleb Smirnoff 593b3a8eb9SGleb Smirnoff #include <netinet/in.h> 603b3a8eb9SGleb Smirnoff #include <netinet/ip_var.h> /* struct ipfw_rule_ref */ 613b3a8eb9SGleb Smirnoff #include <netinet/ip_fw.h> 623b3a8eb9SGleb Smirnoff 633b3a8eb9SGleb Smirnoff #include <netpfil/ipfw/ip_fw_private.h> 64ea761a5dSAlexander V. Chernikov #include <netpfil/ipfw/ip_fw_table.h> 653b3a8eb9SGleb Smirnoff 663b3a8eb9SGleb Smirnoff /* 67b074b7bbSAlexander V. Chernikov * Table has the following `type` concepts: 68b074b7bbSAlexander V. Chernikov * 69c21034b7SAlexander V. Chernikov * `no.type` represents lookup key type (addr, ifp, uid, etc..) 700cba2b28SAlexander V. Chernikov * vmask represents bitmask of table values which are present at the moment. 710cba2b28SAlexander V. Chernikov * Special IPFW_VTYPE_LEGACY ( (uint32_t)-1 ) represents old 720cba2b28SAlexander V. Chernikov * single-value-for-all approach. 73b074b7bbSAlexander V. Chernikov */ 74b074b7bbSAlexander V. Chernikov struct table_config { 75b074b7bbSAlexander V. Chernikov struct named_object no; 76914bffb6SAlexander V. Chernikov uint8_t tflags; /* type flags */ 774f43138aSAlexander V. Chernikov uint8_t locked; /* 1 if locked from changes */ 78adf3b2b9SAlexander V. Chernikov uint8_t linked; /* 1 if already linked */ 79adf3b2b9SAlexander V. Chernikov uint8_t ochanged; /* used by set swapping */ 800cba2b28SAlexander V. Chernikov uint8_t vshared; /* 1 if using shared value array */ 810cba2b28SAlexander V. Chernikov uint8_t spare[3]; 820cba2b28SAlexander V. Chernikov uint32_t count; /* Number of records */ 830cba2b28SAlexander V. Chernikov uint32_t limit; /* Max number of records */ 840cba2b28SAlexander V. Chernikov uint32_t vmask; /* bitmask with supported values */ 85a73d728dSAlexander V. Chernikov uint32_t ocount; /* used by set swapping */ 86a73d728dSAlexander V. Chernikov uint64_t gencnt; /* generation count */ 87b074b7bbSAlexander V. Chernikov char tablename[64]; /* table name */ 889f7d47b0SAlexander V. Chernikov struct table_algo *ta; /* Callbacks for given algo */ 899f7d47b0SAlexander V. Chernikov void *astate; /* algorithm state */ 904c060d85SAlexander V. Chernikov struct table_info ti_copy; /* data to put to table_info */ 910cba2b28SAlexander V. Chernikov struct namedobj_instance *vi; 92b074b7bbSAlexander V. Chernikov }; 93b074b7bbSAlexander V. Chernikov 9474b22066SAlexander V. Chernikov static int find_table_err(struct namedobj_instance *ni, struct tid_info *ti, 9574b22066SAlexander V. Chernikov struct table_config **tc); 96b074b7bbSAlexander V. Chernikov static struct table_config *find_table(struct namedobj_instance *ni, 97b074b7bbSAlexander V. Chernikov struct tid_info *ti); 9868394ec8SAlexander V. Chernikov static struct table_config *alloc_table_config(struct ip_fw_chain *ch, 990cba2b28SAlexander V. Chernikov struct tid_info *ti, struct table_algo *ta, char *adata, uint8_t tflags); 100b074b7bbSAlexander V. Chernikov static void free_table_config(struct namedobj_instance *ni, 101b074b7bbSAlexander V. Chernikov struct table_config *tc); 102db785d31SAlexander V. Chernikov static int create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti, 103867708f7SAlexander V. Chernikov char *aname, ipfw_xtable_info *i, uint16_t *pkidx, int ref); 1040468c5baSAlexander V. Chernikov static void link_table(struct ip_fw_chain *ch, struct table_config *tc); 1050468c5baSAlexander V. Chernikov static void unlink_table(struct ip_fw_chain *ch, struct table_config *tc); 1064dff4ae0SAlexander V. Chernikov static int find_ref_table(struct ip_fw_chain *ch, struct tid_info *ti, 107867708f7SAlexander V. Chernikov struct tentry_info *tei, uint32_t count, int op, struct table_config **ptc); 1084dff4ae0SAlexander V. Chernikov #define OP_ADD 1 1094dff4ae0SAlexander V. Chernikov #define OP_DEL 0 1102d99a349SAlexander V. Chernikov static int export_tables(struct ip_fw_chain *ch, ipfw_obj_lheader *olh, 1112d99a349SAlexander V. Chernikov struct sockopt_data *sd); 112ac35ff17SAlexander V. Chernikov static void export_table_info(struct ip_fw_chain *ch, struct table_config *tc, 113ac35ff17SAlexander V. Chernikov ipfw_xtable_info *i); 11481d3153dSAlexander V. Chernikov static int dump_table_tentry(void *e, void *arg); 115f1220db8SAlexander V. Chernikov static int dump_table_xentry(void *e, void *arg); 116b074b7bbSAlexander V. Chernikov 117a73d728dSAlexander V. Chernikov static int swap_tables(struct ip_fw_chain *ch, struct tid_info *a, 11846d52008SAlexander V. Chernikov struct tid_info *b); 119ac35ff17SAlexander V. Chernikov 120f81431ccSAndrey V. Elsukov static int check_table_name(const char *name); 1210cba2b28SAlexander V. Chernikov static int check_table_space(struct ip_fw_chain *ch, struct tableop_state *ts, 1220cba2b28SAlexander V. Chernikov struct table_config *tc, struct table_info *ti, uint32_t count); 123ac35ff17SAlexander V. Chernikov static int destroy_table(struct ip_fw_chain *ch, struct tid_info *ti); 124d3a4f924SAlexander V. Chernikov 1259f7d47b0SAlexander V. Chernikov static struct table_algo *find_table_algo(struct tables_config *tableconf, 1269490a627SAlexander V. Chernikov struct tid_info *ti, char *name); 127b074b7bbSAlexander V. Chernikov 12846d52008SAlexander V. Chernikov static void objheader_to_ti(struct _ipfw_obj_header *oh, struct tid_info *ti); 12946d52008SAlexander V. Chernikov static void ntlv_to_ti(struct _ipfw_obj_ntlv *ntlv, struct tid_info *ti); 13046d52008SAlexander V. Chernikov 131b074b7bbSAlexander V. Chernikov #define CHAIN_TO_NI(chain) (CHAIN_TO_TCFG(chain)->namehash) 1329f7d47b0SAlexander V. Chernikov #define KIDX_TO_TI(ch, k) (&(((struct table_info *)(ch)->tablestate)[k])) 133b074b7bbSAlexander V. Chernikov 134b6ee846eSAlexander V. Chernikov #define TA_BUF_SZ 128 /* On-stack buffer for add/delete state */ 135b6ee846eSAlexander V. Chernikov 1360cba2b28SAlexander V. Chernikov void 1370cba2b28SAlexander V. Chernikov rollback_toperation_state(struct ip_fw_chain *ch, void *object) 1380cba2b28SAlexander V. Chernikov { 1390cba2b28SAlexander V. Chernikov struct tables_config *tcfg; 1400cba2b28SAlexander V. Chernikov struct op_state *os; 1410cba2b28SAlexander V. Chernikov 1420cba2b28SAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 1430cba2b28SAlexander V. Chernikov TAILQ_FOREACH(os, &tcfg->state_list, next) 144fb4b37a3SAlexander V. Chernikov os->func(object, os); 1450cba2b28SAlexander V. Chernikov } 1460cba2b28SAlexander V. Chernikov 1470cba2b28SAlexander V. Chernikov void 1480cba2b28SAlexander V. Chernikov add_toperation_state(struct ip_fw_chain *ch, struct tableop_state *ts) 1490cba2b28SAlexander V. Chernikov { 1500cba2b28SAlexander V. Chernikov struct tables_config *tcfg; 1510cba2b28SAlexander V. Chernikov 1520cba2b28SAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 1530cba2b28SAlexander V. Chernikov TAILQ_INSERT_HEAD(&tcfg->state_list, &ts->opstate, next); 1540cba2b28SAlexander V. Chernikov } 1550cba2b28SAlexander V. Chernikov 1560cba2b28SAlexander V. Chernikov void 1570cba2b28SAlexander V. Chernikov del_toperation_state(struct ip_fw_chain *ch, struct tableop_state *ts) 1580cba2b28SAlexander V. Chernikov { 1590cba2b28SAlexander V. Chernikov struct tables_config *tcfg; 1600cba2b28SAlexander V. Chernikov 1610cba2b28SAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 1620cba2b28SAlexander V. Chernikov TAILQ_REMOVE(&tcfg->state_list, &ts->opstate, next); 1630cba2b28SAlexander V. Chernikov } 1640cba2b28SAlexander V. Chernikov 1650cba2b28SAlexander V. Chernikov void 1660cba2b28SAlexander V. Chernikov tc_ref(struct table_config *tc) 1670cba2b28SAlexander V. Chernikov { 1680cba2b28SAlexander V. Chernikov 1690cba2b28SAlexander V. Chernikov tc->no.refcnt++; 1700cba2b28SAlexander V. Chernikov } 1710cba2b28SAlexander V. Chernikov 1720cba2b28SAlexander V. Chernikov void 1730cba2b28SAlexander V. Chernikov tc_unref(struct table_config *tc) 1740cba2b28SAlexander V. Chernikov { 1750cba2b28SAlexander V. Chernikov 1760cba2b28SAlexander V. Chernikov tc->no.refcnt--; 1770cba2b28SAlexander V. Chernikov } 1780cba2b28SAlexander V. Chernikov 1790cba2b28SAlexander V. Chernikov static struct table_value * 1800cba2b28SAlexander V. Chernikov get_table_value(struct ip_fw_chain *ch, struct table_config *tc, uint32_t kidx) 1810cba2b28SAlexander V. Chernikov { 1820cba2b28SAlexander V. Chernikov struct table_value *pval; 1830cba2b28SAlexander V. Chernikov 1840cba2b28SAlexander V. Chernikov pval = (struct table_value *)ch->valuestate; 1850cba2b28SAlexander V. Chernikov 1860cba2b28SAlexander V. Chernikov return (&pval[kidx]); 1870cba2b28SAlexander V. Chernikov } 1880cba2b28SAlexander V. Chernikov 1893a845e10SAlexander V. Chernikov /* 1903a845e10SAlexander V. Chernikov * Checks if we're able to insert/update entry @tei into table 1913a845e10SAlexander V. Chernikov * w.r.t @tc limits. 1923a845e10SAlexander V. Chernikov * May alter @tei to indicate insertion error / insert 1933a845e10SAlexander V. Chernikov * options. 1943a845e10SAlexander V. Chernikov * 1953a845e10SAlexander V. Chernikov * Returns 0 if operation can be performed/ 1963a845e10SAlexander V. Chernikov */ 1973a845e10SAlexander V. Chernikov static int 1983a845e10SAlexander V. Chernikov check_table_limit(struct table_config *tc, struct tentry_info *tei) 1993a845e10SAlexander V. Chernikov { 200b074b7bbSAlexander V. Chernikov 2013a845e10SAlexander V. Chernikov if (tc->limit == 0 || tc->count < tc->limit) 2023a845e10SAlexander V. Chernikov return (0); 2033a845e10SAlexander V. Chernikov 2043a845e10SAlexander V. Chernikov if ((tei->flags & TEI_FLAGS_UPDATE) == 0) { 2053a845e10SAlexander V. Chernikov /* Notify userland on error cause */ 2063a845e10SAlexander V. Chernikov tei->flags |= TEI_FLAGS_LIMIT; 2073a845e10SAlexander V. Chernikov return (EFBIG); 2083a845e10SAlexander V. Chernikov } 2093a845e10SAlexander V. Chernikov 2103a845e10SAlexander V. Chernikov /* 2113a845e10SAlexander V. Chernikov * We have UPDATE flag set. 2123a845e10SAlexander V. Chernikov * Permit updating record (if found), 2133a845e10SAlexander V. Chernikov * but restrict adding new one since we've 2143a845e10SAlexander V. Chernikov * already hit the limit. 2153a845e10SAlexander V. Chernikov */ 2163a845e10SAlexander V. Chernikov tei->flags |= TEI_FLAGS_DONTADD; 2173a845e10SAlexander V. Chernikov 2183a845e10SAlexander V. Chernikov return (0); 2193a845e10SAlexander V. Chernikov } 2203a845e10SAlexander V. Chernikov 2213a845e10SAlexander V. Chernikov /* 2221bc0d457SAlexander V. Chernikov * Convert algorithm callback return code into 2231bc0d457SAlexander V. Chernikov * one of pre-defined states known by userland. 2243a845e10SAlexander V. Chernikov */ 2251bc0d457SAlexander V. Chernikov static void 226867708f7SAlexander V. Chernikov store_tei_result(struct tentry_info *tei, int op, int error, uint32_t num) 2273b3a8eb9SGleb Smirnoff { 2281bc0d457SAlexander V. Chernikov int flag; 2293b3a8eb9SGleb Smirnoff 2301bc0d457SAlexander V. Chernikov flag = 0; 2311bc0d457SAlexander V. Chernikov 2321bc0d457SAlexander V. Chernikov switch (error) { 2331bc0d457SAlexander V. Chernikov case 0: 234867708f7SAlexander V. Chernikov if (op == OP_ADD && num != 0) 2351bc0d457SAlexander V. Chernikov flag = TEI_FLAGS_ADDED; 236867708f7SAlexander V. Chernikov if (op == OP_DEL) 2371bc0d457SAlexander V. Chernikov flag = TEI_FLAGS_DELETED; 2381bc0d457SAlexander V. Chernikov break; 2391bc0d457SAlexander V. Chernikov case ENOENT: 2401bc0d457SAlexander V. Chernikov flag = TEI_FLAGS_NOTFOUND; 2411bc0d457SAlexander V. Chernikov break; 2421bc0d457SAlexander V. Chernikov case EEXIST: 2431bc0d457SAlexander V. Chernikov flag = TEI_FLAGS_EXISTS; 2441bc0d457SAlexander V. Chernikov break; 2451bc0d457SAlexander V. Chernikov default: 2461bc0d457SAlexander V. Chernikov flag = TEI_FLAGS_ERROR; 2471bc0d457SAlexander V. Chernikov } 2481bc0d457SAlexander V. Chernikov 2491bc0d457SAlexander V. Chernikov tei->flags |= flag; 2501bc0d457SAlexander V. Chernikov } 2519f7d47b0SAlexander V. Chernikov 252f99fbf96SAlexander V. Chernikov /* 253f99fbf96SAlexander V. Chernikov * Creates and references table with default parameters. 254f99fbf96SAlexander V. Chernikov * Saves table config, algo and allocated kidx info @ptc, @pta and 255f99fbf96SAlexander V. Chernikov * @pkidx if non-zero. 256f99fbf96SAlexander V. Chernikov * Used for table auto-creation to support old binaries. 257f99fbf96SAlexander V. Chernikov * 258f99fbf96SAlexander V. Chernikov * Returns 0 on success. 259f99fbf96SAlexander V. Chernikov */ 2600468c5baSAlexander V. Chernikov static int 2610468c5baSAlexander V. Chernikov create_table_compat(struct ip_fw_chain *ch, struct tid_info *ti, 262867708f7SAlexander V. Chernikov uint16_t *pkidx) 2630468c5baSAlexander V. Chernikov { 2640468c5baSAlexander V. Chernikov ipfw_xtable_info xi; 2650468c5baSAlexander V. Chernikov int error; 2660468c5baSAlexander V. Chernikov 2670468c5baSAlexander V. Chernikov memset(&xi, 0, sizeof(xi)); 2680cba2b28SAlexander V. Chernikov /* Set default value mask for legacy clients */ 2690cba2b28SAlexander V. Chernikov xi.vmask = IPFW_VTYPE_LEGACY; 2700468c5baSAlexander V. Chernikov 271867708f7SAlexander V. Chernikov error = create_table_internal(ch, ti, NULL, &xi, pkidx, 1); 2720468c5baSAlexander V. Chernikov if (error != 0) 2730468c5baSAlexander V. Chernikov return (error); 2740468c5baSAlexander V. Chernikov 2750468c5baSAlexander V. Chernikov return (0); 2760468c5baSAlexander V. Chernikov } 2770468c5baSAlexander V. Chernikov 2789f7d47b0SAlexander V. Chernikov /* 2791bc0d457SAlexander V. Chernikov * Find and reference existing table optionally 2801bc0d457SAlexander V. Chernikov * creating new one. 2811bc0d457SAlexander V. Chernikov * 282867708f7SAlexander V. Chernikov * Saves found table config into @ptc. 283867708f7SAlexander V. Chernikov * Note function may drop/acquire UH_WLOCK. 2841bc0d457SAlexander V. Chernikov * Returns 0 if table was found/created and referenced 2851bc0d457SAlexander V. Chernikov * or non-zero return code. 2869f7d47b0SAlexander V. Chernikov */ 2871bc0d457SAlexander V. Chernikov static int 2881bc0d457SAlexander V. Chernikov find_ref_table(struct ip_fw_chain *ch, struct tid_info *ti, 2894dff4ae0SAlexander V. Chernikov struct tentry_info *tei, uint32_t count, int op, 290867708f7SAlexander V. Chernikov struct table_config **ptc) 2911bc0d457SAlexander V. Chernikov { 2921bc0d457SAlexander V. Chernikov struct namedobj_instance *ni; 2931bc0d457SAlexander V. Chernikov struct table_config *tc; 294867708f7SAlexander V. Chernikov uint16_t kidx; 2951bc0d457SAlexander V. Chernikov int error; 2961bc0d457SAlexander V. Chernikov 297867708f7SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 2981bc0d457SAlexander V. Chernikov 2991bc0d457SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 3001bc0d457SAlexander V. Chernikov tc = NULL; 3019f7d47b0SAlexander V. Chernikov if ((tc = find_table(ni, ti)) != NULL) { 3029f7d47b0SAlexander V. Chernikov /* check table type */ 30374b22066SAlexander V. Chernikov if (tc->no.subtype != ti->type) 3043b3a8eb9SGleb Smirnoff return (EINVAL); 3053b3a8eb9SGleb Smirnoff 306867708f7SAlexander V. Chernikov if (tc->locked != 0) 3074f43138aSAlexander V. Chernikov return (EACCES); 3084f43138aSAlexander V. Chernikov 3094c0c07a5SAlexander V. Chernikov /* Try to exit early on limit hit */ 3104dff4ae0SAlexander V. Chernikov if (op == OP_ADD && count == 1 && 311867708f7SAlexander V. Chernikov check_table_limit(tc, tei) != 0) 3124c0c07a5SAlexander V. Chernikov return (EFBIG); 3134c0c07a5SAlexander V. Chernikov 314867708f7SAlexander V. Chernikov /* Reference and return */ 3159f7d47b0SAlexander V. Chernikov tc->no.refcnt++; 316867708f7SAlexander V. Chernikov *ptc = tc; 317867708f7SAlexander V. Chernikov return (0); 3189f7d47b0SAlexander V. Chernikov } 3193b3a8eb9SGleb Smirnoff 3204dff4ae0SAlexander V. Chernikov if (op == OP_DEL) 3211bc0d457SAlexander V. Chernikov return (ESRCH); 3221bc0d457SAlexander V. Chernikov 323a4641f4eSPedro F. Giffuni /* Compatibility mode: create new table for old clients */ 324db785d31SAlexander V. Chernikov if ((tei->flags & TEI_FLAGS_COMPAT) == 0) 325db785d31SAlexander V. Chernikov return (ESRCH); 3263b3a8eb9SGleb Smirnoff 327867708f7SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 328867708f7SAlexander V. Chernikov error = create_table_compat(ch, ti, &kidx); 329867708f7SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 330867708f7SAlexander V. Chernikov 331db785d31SAlexander V. Chernikov if (error != 0) 332db785d31SAlexander V. Chernikov return (error); 333db785d31SAlexander V. Chernikov 334867708f7SAlexander V. Chernikov tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, kidx); 335867708f7SAlexander V. Chernikov KASSERT(tc != NULL, ("create_table_compat returned bad idx %d", kidx)); 336db785d31SAlexander V. Chernikov 337867708f7SAlexander V. Chernikov /* OK, now we've got referenced table. */ 3381bc0d457SAlexander V. Chernikov *ptc = tc; 3391bc0d457SAlexander V. Chernikov return (0); 3401bc0d457SAlexander V. Chernikov } 3411bc0d457SAlexander V. Chernikov 3421bc0d457SAlexander V. Chernikov /* 343867708f7SAlexander V. Chernikov * Rolls back already @added to @tc entries using state array @ta_buf_m. 3441bc0d457SAlexander V. Chernikov * Assume the following layout: 3451bc0d457SAlexander V. Chernikov * 1) ADD state (ta_buf_m[0] ... t_buf_m[added - 1]) for handling update cases 3461bc0d457SAlexander V. Chernikov * 2) DEL state (ta_buf_m[count[ ... t_buf_m[count + added - 1]) 3471bc0d457SAlexander V. Chernikov * for storing deleted state 3481bc0d457SAlexander V. Chernikov */ 3491bc0d457SAlexander V. Chernikov static void 3501bc0d457SAlexander V. Chernikov rollback_added_entries(struct ip_fw_chain *ch, struct table_config *tc, 3511bc0d457SAlexander V. Chernikov struct table_info *tinfo, struct tentry_info *tei, caddr_t ta_buf_m, 3521bc0d457SAlexander V. Chernikov uint32_t count, uint32_t added) 3531bc0d457SAlexander V. Chernikov { 3541bc0d457SAlexander V. Chernikov struct table_algo *ta; 3551bc0d457SAlexander V. Chernikov struct tentry_info *ptei; 3561bc0d457SAlexander V. Chernikov caddr_t v, vv; 3571bc0d457SAlexander V. Chernikov size_t ta_buf_sz; 35860a28b09SMateusz Guzik int error __diagused, i; 3591bc0d457SAlexander V. Chernikov uint32_t num; 3601bc0d457SAlexander V. Chernikov 3611bc0d457SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 3621bc0d457SAlexander V. Chernikov 3631bc0d457SAlexander V. Chernikov ta = tc->ta; 3643a845e10SAlexander V. Chernikov ta_buf_sz = ta->ta_buf_size; 3651bc0d457SAlexander V. Chernikov v = ta_buf_m; 3661bc0d457SAlexander V. Chernikov vv = v + count * ta_buf_sz; 3671bc0d457SAlexander V. Chernikov for (i = 0; i < added; i++, v += ta_buf_sz, vv += ta_buf_sz) { 3681bc0d457SAlexander V. Chernikov ptei = &tei[i]; 3691bc0d457SAlexander V. Chernikov if ((ptei->flags & TEI_FLAGS_UPDATED) != 0) { 3701bc0d457SAlexander V. Chernikov /* 3711bc0d457SAlexander V. Chernikov * We have old value stored by previous 3721bc0d457SAlexander V. Chernikov * call in @ptei->value. Do add once again 3731bc0d457SAlexander V. Chernikov * to restore it. 3741bc0d457SAlexander V. Chernikov */ 3751bc0d457SAlexander V. Chernikov error = ta->add(tc->astate, tinfo, ptei, v, &num); 3761bc0d457SAlexander V. Chernikov KASSERT(error == 0, ("rollback UPDATE fail")); 3771bc0d457SAlexander V. Chernikov KASSERT(num == 0, ("rollback UPDATE fail2")); 3781bc0d457SAlexander V. Chernikov continue; 3791bc0d457SAlexander V. Chernikov } 3801bc0d457SAlexander V. Chernikov 3811bc0d457SAlexander V. Chernikov error = ta->prepare_del(ch, ptei, vv); 3821bc0d457SAlexander V. Chernikov KASSERT(error == 0, ("pre-rollback INSERT failed")); 3831bc0d457SAlexander V. Chernikov error = ta->del(tc->astate, tinfo, ptei, vv, &num); 3841bc0d457SAlexander V. Chernikov KASSERT(error == 0, ("rollback INSERT failed")); 3851bc0d457SAlexander V. Chernikov tc->count -= num; 3861bc0d457SAlexander V. Chernikov } 3871bc0d457SAlexander V. Chernikov } 3881bc0d457SAlexander V. Chernikov 3891bc0d457SAlexander V. Chernikov /* 3901bc0d457SAlexander V. Chernikov * Prepares add/del state for all @count entries in @tei. 3911bc0d457SAlexander V. Chernikov * Uses either stack buffer (@ta_buf) or allocates a new one. 3921bc0d457SAlexander V. Chernikov * Stores pointer to allocated buffer back to @ta_buf. 3931bc0d457SAlexander V. Chernikov * 3941bc0d457SAlexander V. Chernikov * Returns 0 on success. 3951bc0d457SAlexander V. Chernikov */ 3961bc0d457SAlexander V. Chernikov static int 3971bc0d457SAlexander V. Chernikov prepare_batch_buffer(struct ip_fw_chain *ch, struct table_algo *ta, 3984dff4ae0SAlexander V. Chernikov struct tentry_info *tei, uint32_t count, int op, caddr_t *ta_buf) 3991bc0d457SAlexander V. Chernikov { 4001bc0d457SAlexander V. Chernikov caddr_t ta_buf_m, v; 4011bc0d457SAlexander V. Chernikov size_t ta_buf_sz, sz; 4021bc0d457SAlexander V. Chernikov struct tentry_info *ptei; 4031bc0d457SAlexander V. Chernikov int error, i; 4041bc0d457SAlexander V. Chernikov 4051bc0d457SAlexander V. Chernikov error = 0; 4061bc0d457SAlexander V. Chernikov ta_buf_sz = ta->ta_buf_size; 4073a845e10SAlexander V. Chernikov if (count == 1) { 408f621c2cdSMaxim Konovalov /* Single add/delete, use on-stack buffer */ 4091bc0d457SAlexander V. Chernikov memset(*ta_buf, 0, TA_BUF_SZ); 4101bc0d457SAlexander V. Chernikov ta_buf_m = *ta_buf; 4113a845e10SAlexander V. Chernikov } else { 4123a845e10SAlexander V. Chernikov /* 4131bc0d457SAlexander V. Chernikov * Multiple adds/deletes, allocate larger buffer 4141bc0d457SAlexander V. Chernikov * 4151bc0d457SAlexander V. Chernikov * Note we need 2xcount buffer for add case: 4161bc0d457SAlexander V. Chernikov * we have hold both ADD state 4173a845e10SAlexander V. Chernikov * and DELETE state (this may be needed 4183a845e10SAlexander V. Chernikov * if we need to rollback all changes) 4193a845e10SAlexander V. Chernikov */ 4201bc0d457SAlexander V. Chernikov sz = count * ta_buf_sz; 4214dff4ae0SAlexander V. Chernikov ta_buf_m = malloc((op == OP_ADD) ? sz * 2 : sz, M_TEMP, 4223a845e10SAlexander V. Chernikov M_WAITOK | M_ZERO); 4233a845e10SAlexander V. Chernikov } 4241bc0d457SAlexander V. Chernikov 4253a845e10SAlexander V. Chernikov v = ta_buf_m; 4263a845e10SAlexander V. Chernikov for (i = 0; i < count; i++, v += ta_buf_sz) { 4271bc0d457SAlexander V. Chernikov ptei = &tei[i]; 4284dff4ae0SAlexander V. Chernikov error = (op == OP_ADD) ? 4291bc0d457SAlexander V. Chernikov ta->prepare_add(ch, ptei, v) : ta->prepare_del(ch, ptei, v); 4303a845e10SAlexander V. Chernikov 4313a845e10SAlexander V. Chernikov /* 4323a845e10SAlexander V. Chernikov * Some syntax error (incorrect mask, or address, or 4333a845e10SAlexander V. Chernikov * anything). Return error regardless of atomicity 4343a845e10SAlexander V. Chernikov * settings. 4353a845e10SAlexander V. Chernikov */ 436db785d31SAlexander V. Chernikov if (error != 0) 4371bc0d457SAlexander V. Chernikov break; 4383a845e10SAlexander V. Chernikov } 4393b3a8eb9SGleb Smirnoff 4401bc0d457SAlexander V. Chernikov *ta_buf = ta_buf_m; 4411bc0d457SAlexander V. Chernikov return (error); 4421bc0d457SAlexander V. Chernikov } 4431bc0d457SAlexander V. Chernikov 4441bc0d457SAlexander V. Chernikov /* 4451bc0d457SAlexander V. Chernikov * Flushes allocated state for each @count entries in @tei. 4461bc0d457SAlexander V. Chernikov * Frees @ta_buf_m if differs from stack buffer @ta_buf. 4471bc0d457SAlexander V. Chernikov */ 4481bc0d457SAlexander V. Chernikov static void 4491bc0d457SAlexander V. Chernikov flush_batch_buffer(struct ip_fw_chain *ch, struct table_algo *ta, 450867708f7SAlexander V. Chernikov struct tentry_info *tei, uint32_t count, int rollback, 4511bc0d457SAlexander V. Chernikov caddr_t ta_buf_m, caddr_t ta_buf) 4521bc0d457SAlexander V. Chernikov { 4531bc0d457SAlexander V. Chernikov caddr_t v; 4540cba2b28SAlexander V. Chernikov struct tentry_info *ptei; 4551bc0d457SAlexander V. Chernikov size_t ta_buf_sz; 4561bc0d457SAlexander V. Chernikov int i; 4571bc0d457SAlexander V. Chernikov 4581bc0d457SAlexander V. Chernikov ta_buf_sz = ta->ta_buf_size; 4591bc0d457SAlexander V. Chernikov 4601bc0d457SAlexander V. Chernikov /* Run cleaning callback anyway */ 4611bc0d457SAlexander V. Chernikov v = ta_buf_m; 4620cba2b28SAlexander V. Chernikov for (i = 0; i < count; i++, v += ta_buf_sz) { 4630cba2b28SAlexander V. Chernikov ptei = &tei[i]; 4640cba2b28SAlexander V. Chernikov ta->flush_entry(ch, ptei, v); 4650cba2b28SAlexander V. Chernikov if (ptei->ptv != NULL) { 4660cba2b28SAlexander V. Chernikov free(ptei->ptv, M_IPFW); 4670cba2b28SAlexander V. Chernikov ptei->ptv = NULL; 4680cba2b28SAlexander V. Chernikov } 4690cba2b28SAlexander V. Chernikov } 4701bc0d457SAlexander V. Chernikov 4711bc0d457SAlexander V. Chernikov /* Clean up "deleted" state in case of rollback */ 4721bc0d457SAlexander V. Chernikov if (rollback != 0) { 4731bc0d457SAlexander V. Chernikov v = ta_buf_m + count * ta_buf_sz; 4741bc0d457SAlexander V. Chernikov for (i = 0; i < count; i++, v += ta_buf_sz) 4751bc0d457SAlexander V. Chernikov ta->flush_entry(ch, &tei[i], v); 4761bc0d457SAlexander V. Chernikov } 4771bc0d457SAlexander V. Chernikov 4781bc0d457SAlexander V. Chernikov if (ta_buf_m != ta_buf) 4791bc0d457SAlexander V. Chernikov free(ta_buf_m, M_TEMP); 4801bc0d457SAlexander V. Chernikov } 4811bc0d457SAlexander V. Chernikov 48271af39bfSAlexander V. Chernikov static void 48371af39bfSAlexander V. Chernikov rollback_add_entry(void *object, struct op_state *_state) 48471af39bfSAlexander V. Chernikov { 48560a28b09SMateusz Guzik struct ip_fw_chain *ch __diagused; 48671af39bfSAlexander V. Chernikov struct tableop_state *ts; 48771af39bfSAlexander V. Chernikov 48871af39bfSAlexander V. Chernikov ts = (struct tableop_state *)_state; 48971af39bfSAlexander V. Chernikov 49071af39bfSAlexander V. Chernikov if (ts->tc != object && ts->ch != object) 49171af39bfSAlexander V. Chernikov return; 49271af39bfSAlexander V. Chernikov 49371af39bfSAlexander V. Chernikov ch = ts->ch; 49471af39bfSAlexander V. Chernikov 49571af39bfSAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 49671af39bfSAlexander V. Chernikov 49771af39bfSAlexander V. Chernikov /* Call specifid unlockers */ 49871af39bfSAlexander V. Chernikov rollback_table_values(ts); 49971af39bfSAlexander V. Chernikov 50071af39bfSAlexander V. Chernikov /* Indicate we've called */ 50171af39bfSAlexander V. Chernikov ts->modified = 1; 50271af39bfSAlexander V. Chernikov } 50371af39bfSAlexander V. Chernikov 5041bc0d457SAlexander V. Chernikov /* 5051bc0d457SAlexander V. Chernikov * Adds/updates one or more entries in table @ti. 50671af39bfSAlexander V. Chernikov * 50771af39bfSAlexander V. Chernikov * Function may drop/reacquire UH wlock multiple times due to 50871af39bfSAlexander V. Chernikov * items alloc, algorithm callbacks (check_space), value linkage 50971af39bfSAlexander V. Chernikov * (new values, value storage realloc), etc.. 51071af39bfSAlexander V. Chernikov * Other processes like other adds (which may involve storage resize), 51171af39bfSAlexander V. Chernikov * table swaps (which changes table data and may change algo type), 51271af39bfSAlexander V. Chernikov * table modify (which may change value mask) may be executed 51371af39bfSAlexander V. Chernikov * simultaneously so we need to deal with it. 51471af39bfSAlexander V. Chernikov * 51571af39bfSAlexander V. Chernikov * The following approach was implemented: 51671af39bfSAlexander V. Chernikov * we have per-chain linked list, protected with UH lock. 51771af39bfSAlexander V. Chernikov * add_table_entry prepares special on-stack structure wthich is passed 51871af39bfSAlexander V. Chernikov * to its descendants. Users add this structure to this list before unlock. 51971af39bfSAlexander V. Chernikov * After performing needed operations and acquiring UH lock back, each user 52071af39bfSAlexander V. Chernikov * checks if structure has changed. If true, it rolls local state back and 52171af39bfSAlexander V. Chernikov * returns without error to the caller. 52271af39bfSAlexander V. Chernikov * add_table_entry() on its own checks if structure has changed and restarts 52371af39bfSAlexander V. Chernikov * its operation from the beginning (goto restart). 52471af39bfSAlexander V. Chernikov * 52571af39bfSAlexander V. Chernikov * Functions which are modifying fields of interest (currently 52671af39bfSAlexander V. Chernikov * resize_shared_value_storage() and swap_tables() ) 52771af39bfSAlexander V. Chernikov * traverses given list while holding UH lock immediately before 52871af39bfSAlexander V. Chernikov * performing their operations calling function provided be list entry 52971af39bfSAlexander V. Chernikov * ( currently rollback_add_entry ) which performs rollback for all necessary 53071af39bfSAlexander V. Chernikov * state and sets appropriate values in structure indicating rollback 53171af39bfSAlexander V. Chernikov * has happened. 53271af39bfSAlexander V. Chernikov * 53371af39bfSAlexander V. Chernikov * Algo interaction: 5340468c5baSAlexander V. Chernikov * Function references @ti first to ensure table won't 5350468c5baSAlexander V. Chernikov * disappear or change its type. 5360468c5baSAlexander V. Chernikov * After that, prepare_add callback is called for each @tei entry. 5370468c5baSAlexander V. Chernikov * Next, we try to add each entry under UH+WHLOCK 5380468c5baSAlexander V. Chernikov * using add() callback. 5390468c5baSAlexander V. Chernikov * Finally, we free all state by calling flush_entry callback 5400468c5baSAlexander V. Chernikov * for each @tei. 5411bc0d457SAlexander V. Chernikov * 5421bc0d457SAlexander V. Chernikov * Returns 0 on success. 5431bc0d457SAlexander V. Chernikov */ 5441bc0d457SAlexander V. Chernikov int 5451bc0d457SAlexander V. Chernikov add_table_entry(struct ip_fw_chain *ch, struct tid_info *ti, 5461bc0d457SAlexander V. Chernikov struct tentry_info *tei, uint8_t flags, uint32_t count) 5471bc0d457SAlexander V. Chernikov { 5481bc0d457SAlexander V. Chernikov struct table_config *tc; 5491bc0d457SAlexander V. Chernikov struct table_algo *ta; 5501bc0d457SAlexander V. Chernikov uint16_t kidx; 5511bc0d457SAlexander V. Chernikov int error, first_error, i, rollback; 5521bc0d457SAlexander V. Chernikov uint32_t num, numadd; 5531bc0d457SAlexander V. Chernikov struct tentry_info *ptei; 5540cba2b28SAlexander V. Chernikov struct tableop_state ts; 5551bc0d457SAlexander V. Chernikov char ta_buf[TA_BUF_SZ]; 5561bc0d457SAlexander V. Chernikov caddr_t ta_buf_m, v; 5571bc0d457SAlexander V. Chernikov 5580cba2b28SAlexander V. Chernikov memset(&ts, 0, sizeof(ts)); 559d4e1b515SAlexander V. Chernikov ta = NULL; 5600cba2b28SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 5610cba2b28SAlexander V. Chernikov 5621bc0d457SAlexander V. Chernikov /* 5631bc0d457SAlexander V. Chernikov * Find and reference existing table. 5641bc0d457SAlexander V. Chernikov */ 5650cba2b28SAlexander V. Chernikov restart: 5660cba2b28SAlexander V. Chernikov if (ts.modified != 0) { 5678ebca97fSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 5680cba2b28SAlexander V. Chernikov flush_batch_buffer(ch, ta, tei, count, rollback, 5690cba2b28SAlexander V. Chernikov ta_buf_m, ta_buf); 5700cba2b28SAlexander V. Chernikov memset(&ts, 0, sizeof(ts)); 5718ebca97fSAlexander V. Chernikov ta = NULL; 5728ebca97fSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 5730cba2b28SAlexander V. Chernikov } 5748ebca97fSAlexander V. Chernikov 575867708f7SAlexander V. Chernikov error = find_ref_table(ch, ti, tei, count, OP_ADD, &tc); 576867708f7SAlexander V. Chernikov if (error != 0) { 577867708f7SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 5781bc0d457SAlexander V. Chernikov return (error); 579867708f7SAlexander V. Chernikov } 580867708f7SAlexander V. Chernikov ta = tc->ta; 581fb4b37a3SAlexander V. Chernikov 582fb4b37a3SAlexander V. Chernikov /* Fill in tablestate */ 5830cba2b28SAlexander V. Chernikov ts.ch = ch; 58471af39bfSAlexander V. Chernikov ts.opstate.func = rollback_add_entry; 5850cba2b28SAlexander V. Chernikov ts.tc = tc; 5860cba2b28SAlexander V. Chernikov ts.vshared = tc->vshared; 5870cba2b28SAlexander V. Chernikov ts.vmask = tc->vmask; 5880cba2b28SAlexander V. Chernikov ts.ta = ta; 5890cba2b28SAlexander V. Chernikov ts.tei = tei; 5900cba2b28SAlexander V. Chernikov ts.count = count; 5910cba2b28SAlexander V. Chernikov rollback = 0; 5920cba2b28SAlexander V. Chernikov add_toperation_state(ch, &ts); 593867708f7SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 5941bc0d457SAlexander V. Chernikov 5951bc0d457SAlexander V. Chernikov /* Allocate memory and prepare record(s) */ 5961bc0d457SAlexander V. Chernikov /* Pass stack buffer by default */ 5971bc0d457SAlexander V. Chernikov ta_buf_m = ta_buf; 5984dff4ae0SAlexander V. Chernikov error = prepare_batch_buffer(ch, ta, tei, count, OP_ADD, &ta_buf_m); 5991bc0d457SAlexander V. Chernikov 600b074b7bbSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 601b45fa3faSAlexander V. Chernikov del_toperation_state(ch, &ts); 602c8d5d308SAlexander V. Chernikov /* Drop reference we've used in first search */ 603c8d5d308SAlexander V. Chernikov tc->no.refcnt--; 604c8d5d308SAlexander V. Chernikov 605b45fa3faSAlexander V. Chernikov /* Check prepare_batch_buffer() error */ 606b45fa3faSAlexander V. Chernikov if (error != 0) 607b45fa3faSAlexander V. Chernikov goto cleanup; 608b45fa3faSAlexander V. Chernikov 609b6ee846eSAlexander V. Chernikov /* 6100cba2b28SAlexander V. Chernikov * Check if table swap has happened. 6110cba2b28SAlexander V. Chernikov * (so table algo might be changed). 6120cba2b28SAlexander V. Chernikov * Restart operation to achieve consistent behavior. 613b6ee846eSAlexander V. Chernikov */ 6140cba2b28SAlexander V. Chernikov if (ts.modified != 0) 6150cba2b28SAlexander V. Chernikov goto restart; 616b6ee846eSAlexander V. Chernikov 617c8d5d308SAlexander V. Chernikov /* 6180cba2b28SAlexander V. Chernikov * Link all values values to shared/per-table value array. 6190cba2b28SAlexander V. Chernikov * 6200cba2b28SAlexander V. Chernikov * May release/reacquire UH_WLOCK. 621c8d5d308SAlexander V. Chernikov */ 62257ddf396SAlexander V. Chernikov error = ipfw_link_table_values(ch, &ts, flags); 6230cba2b28SAlexander V. Chernikov if (error != 0) 624c8d5d308SAlexander V. Chernikov goto cleanup; 6250cba2b28SAlexander V. Chernikov if (ts.modified != 0) 6260cba2b28SAlexander V. Chernikov goto restart; 6270cba2b28SAlexander V. Chernikov 6280cba2b28SAlexander V. Chernikov /* 6290cba2b28SAlexander V. Chernikov * Ensure we are able to add all entries without additional 6300cba2b28SAlexander V. Chernikov * memory allocations. May release/reacquire UH_WLOCK. 6310cba2b28SAlexander V. Chernikov */ 6320cba2b28SAlexander V. Chernikov kidx = tc->no.kidx; 6330cba2b28SAlexander V. Chernikov error = check_table_space(ch, &ts, tc, KIDX_TO_TI(ch, kidx), count); 6340cba2b28SAlexander V. Chernikov if (error != 0) 6350cba2b28SAlexander V. Chernikov goto cleanup; 6360cba2b28SAlexander V. Chernikov if (ts.modified != 0) 6370cba2b28SAlexander V. Chernikov goto restart; 638c8d5d308SAlexander V. Chernikov 6393a845e10SAlexander V. Chernikov /* We've got valid table in @tc. Let's try to add data */ 6409f7d47b0SAlexander V. Chernikov kidx = tc->no.kidx; 6419f7d47b0SAlexander V. Chernikov ta = tc->ta; 6423a845e10SAlexander V. Chernikov numadd = 0; 6433a845e10SAlexander V. Chernikov first_error = 0; 6449f7d47b0SAlexander V. Chernikov 645b074b7bbSAlexander V. Chernikov IPFW_WLOCK(ch); 6463a845e10SAlexander V. Chernikov 6473a845e10SAlexander V. Chernikov v = ta_buf_m; 6481bc0d457SAlexander V. Chernikov for (i = 0; i < count; i++, v += ta->ta_buf_size) { 6493a845e10SAlexander V. Chernikov ptei = &tei[i]; 6503a845e10SAlexander V. Chernikov num = 0; 6513a845e10SAlexander V. Chernikov /* check limit before adding */ 6523a845e10SAlexander V. Chernikov if ((error = check_table_limit(tc, ptei)) == 0) { 65357ddf396SAlexander V. Chernikov /* 65457ddf396SAlexander V. Chernikov * It should be safe to insert a record w/o 65557ddf396SAlexander V. Chernikov * a properly-linked value if atomicity is 65657ddf396SAlexander V. Chernikov * not required. 65757ddf396SAlexander V. Chernikov * 65857ddf396SAlexander V. Chernikov * If the added item does not have a valid value 65957ddf396SAlexander V. Chernikov * index, it would get rejected by ta->add(). 66057ddf396SAlexander V. Chernikov * */ 6613a845e10SAlexander V. Chernikov error = ta->add(tc->astate, KIDX_TO_TI(ch, kidx), 6623a845e10SAlexander V. Chernikov ptei, v, &num); 6633a845e10SAlexander V. Chernikov /* Set status flag to inform userland */ 664867708f7SAlexander V. Chernikov store_tei_result(ptei, OP_ADD, error, num); 6653a845e10SAlexander V. Chernikov } 6663a845e10SAlexander V. Chernikov if (error == 0) { 6673a845e10SAlexander V. Chernikov /* Update number of records to ease limit checking */ 6683a845e10SAlexander V. Chernikov tc->count += num; 6693a845e10SAlexander V. Chernikov numadd += num; 6703a845e10SAlexander V. Chernikov continue; 6713a845e10SAlexander V. Chernikov } 6723a845e10SAlexander V. Chernikov 6733a845e10SAlexander V. Chernikov if (first_error == 0) 6743a845e10SAlexander V. Chernikov first_error = error; 6753a845e10SAlexander V. Chernikov 6763a845e10SAlexander V. Chernikov /* 6773a845e10SAlexander V. Chernikov * Some error have happened. Check our atomicity 6783a845e10SAlexander V. Chernikov * settings: continue if atomicity is not required, 6793a845e10SAlexander V. Chernikov * rollback changes otherwise. 6803a845e10SAlexander V. Chernikov */ 6813a845e10SAlexander V. Chernikov if ((flags & IPFW_CTF_ATOMIC) == 0) 6823a845e10SAlexander V. Chernikov continue; 6833a845e10SAlexander V. Chernikov 6841bc0d457SAlexander V. Chernikov rollback_added_entries(ch, tc, KIDX_TO_TI(ch, kidx), 6851bc0d457SAlexander V. Chernikov tei, ta_buf_m, count, i); 6860cba2b28SAlexander V. Chernikov 6870cba2b28SAlexander V. Chernikov rollback = 1; 6883a845e10SAlexander V. Chernikov break; 6893a845e10SAlexander V. Chernikov } 6903a845e10SAlexander V. Chernikov 6913b3a8eb9SGleb Smirnoff IPFW_WUNLOCK(ch); 6929f7d47b0SAlexander V. Chernikov 69371af39bfSAlexander V. Chernikov ipfw_garbage_table_values(ch, tc, tei, count, rollback); 6940cba2b28SAlexander V. Chernikov 695b6ee846eSAlexander V. Chernikov /* Permit post-add algorithm grow/rehash. */ 6963a845e10SAlexander V. Chernikov if (numadd != 0) 6970cba2b28SAlexander V. Chernikov check_table_space(ch, NULL, tc, KIDX_TO_TI(ch, kidx), 0); 698b074b7bbSAlexander V. Chernikov 6993a845e10SAlexander V. Chernikov /* Return first error to user, if any */ 7003a845e10SAlexander V. Chernikov error = first_error; 7013a845e10SAlexander V. Chernikov 7023a845e10SAlexander V. Chernikov cleanup: 7030cba2b28SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 7040cba2b28SAlexander V. Chernikov 705867708f7SAlexander V. Chernikov flush_batch_buffer(ch, ta, tei, count, rollback, ta_buf_m, ta_buf); 706b074b7bbSAlexander V. Chernikov 7079f7d47b0SAlexander V. Chernikov return (error); 7083b3a8eb9SGleb Smirnoff } 7093b3a8eb9SGleb Smirnoff 7103a845e10SAlexander V. Chernikov /* 7113a845e10SAlexander V. Chernikov * Deletes one or more entries in table @ti. 7123a845e10SAlexander V. Chernikov * 7133a845e10SAlexander V. Chernikov * Returns 0 on success. 7143a845e10SAlexander V. Chernikov */ 7153b3a8eb9SGleb Smirnoff int 7161832a7b3SAlexander V. Chernikov del_table_entry(struct ip_fw_chain *ch, struct tid_info *ti, 7173a845e10SAlexander V. Chernikov struct tentry_info *tei, uint8_t flags, uint32_t count) 7183b3a8eb9SGleb Smirnoff { 719b074b7bbSAlexander V. Chernikov struct table_config *tc; 7209f7d47b0SAlexander V. Chernikov struct table_algo *ta; 7213a845e10SAlexander V. Chernikov struct tentry_info *ptei; 722b074b7bbSAlexander V. Chernikov uint16_t kidx; 7233a845e10SAlexander V. Chernikov int error, first_error, i; 7243a845e10SAlexander V. Chernikov uint32_t num, numdel; 725b6ee846eSAlexander V. Chernikov char ta_buf[TA_BUF_SZ]; 7263a845e10SAlexander V. Chernikov caddr_t ta_buf_m, v; 7273b3a8eb9SGleb Smirnoff 728db785d31SAlexander V. Chernikov /* 7291bc0d457SAlexander V. Chernikov * Find and reference existing table. 730db785d31SAlexander V. Chernikov */ 731867708f7SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 732867708f7SAlexander V. Chernikov error = find_ref_table(ch, ti, tei, count, OP_DEL, &tc); 733867708f7SAlexander V. Chernikov if (error != 0) { 734867708f7SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 735db785d31SAlexander V. Chernikov return (error); 736867708f7SAlexander V. Chernikov } 737867708f7SAlexander V. Chernikov ta = tc->ta; 738867708f7SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 7393a845e10SAlexander V. Chernikov 74035e1bbd0SAlexander V. Chernikov /* Allocate memory and prepare record(s) */ 7411bc0d457SAlexander V. Chernikov /* Pass stack buffer by default */ 7423a845e10SAlexander V. Chernikov ta_buf_m = ta_buf; 7434dff4ae0SAlexander V. Chernikov error = prepare_batch_buffer(ch, ta, tei, count, OP_DEL, &ta_buf_m); 7443a845e10SAlexander V. Chernikov if (error != 0) 7453a845e10SAlexander V. Chernikov goto cleanup; 7469f7d47b0SAlexander V. Chernikov 7473a845e10SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 7483a845e10SAlexander V. Chernikov 7493a845e10SAlexander V. Chernikov /* Drop reference we've used in first search */ 7503a845e10SAlexander V. Chernikov tc->no.refcnt--; 7513a845e10SAlexander V. Chernikov 752c8d5d308SAlexander V. Chernikov /* 753c8d5d308SAlexander V. Chernikov * Check if table algo is still the same. 754c8d5d308SAlexander V. Chernikov * (changed ta may be the result of table swap). 755c8d5d308SAlexander V. Chernikov */ 756c8d5d308SAlexander V. Chernikov if (ta != tc->ta) { 757c8d5d308SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 758c8d5d308SAlexander V. Chernikov error = EINVAL; 759c8d5d308SAlexander V. Chernikov goto cleanup; 760c8d5d308SAlexander V. Chernikov } 761c8d5d308SAlexander V. Chernikov 762b074b7bbSAlexander V. Chernikov kidx = tc->no.kidx; 7633a845e10SAlexander V. Chernikov numdel = 0; 7643a845e10SAlexander V. Chernikov first_error = 0; 765b074b7bbSAlexander V. Chernikov 766b074b7bbSAlexander V. Chernikov IPFW_WLOCK(ch); 7673a845e10SAlexander V. Chernikov v = ta_buf_m; 7681bc0d457SAlexander V. Chernikov for (i = 0; i < count; i++, v += ta->ta_buf_size) { 7693a845e10SAlexander V. Chernikov ptei = &tei[i]; 7703a845e10SAlexander V. Chernikov num = 0; 7713a845e10SAlexander V. Chernikov error = ta->del(tc->astate, KIDX_TO_TI(ch, kidx), ptei, v, 7723a845e10SAlexander V. Chernikov &num); 7733a845e10SAlexander V. Chernikov /* Save state for userland */ 774867708f7SAlexander V. Chernikov store_tei_result(ptei, OP_DEL, error, num); 7753a845e10SAlexander V. Chernikov if (error != 0 && first_error == 0) 7763a845e10SAlexander V. Chernikov first_error = error; 7773a845e10SAlexander V. Chernikov tc->count -= num; 7783a845e10SAlexander V. Chernikov numdel += num; 7793a845e10SAlexander V. Chernikov } 7803b3a8eb9SGleb Smirnoff IPFW_WUNLOCK(ch); 7813b3a8eb9SGleb Smirnoff 7820cba2b28SAlexander V. Chernikov /* Unlink non-used values */ 78371af39bfSAlexander V. Chernikov ipfw_garbage_table_values(ch, tc, tei, count, 0); 7840cba2b28SAlexander V. Chernikov 7853a845e10SAlexander V. Chernikov if (numdel != 0) { 786b6ee846eSAlexander V. Chernikov /* Run post-del hook to permit shrinking */ 7870cba2b28SAlexander V. Chernikov check_table_space(ch, NULL, tc, KIDX_TO_TI(ch, kidx), 0); 788b6ee846eSAlexander V. Chernikov } 789b074b7bbSAlexander V. Chernikov 7909f7d47b0SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 7913b3a8eb9SGleb Smirnoff 7923a845e10SAlexander V. Chernikov /* Return first error to user, if any */ 7933a845e10SAlexander V. Chernikov error = first_error; 7943a845e10SAlexander V. Chernikov 7953a845e10SAlexander V. Chernikov cleanup: 796867708f7SAlexander V. Chernikov flush_batch_buffer(ch, ta, tei, count, 0, ta_buf_m, ta_buf); 797ac35ff17SAlexander V. Chernikov 798ac35ff17SAlexander V. Chernikov return (error); 799ac35ff17SAlexander V. Chernikov } 800ac35ff17SAlexander V. Chernikov 801db785d31SAlexander V. Chernikov /* 802b6ee846eSAlexander V. Chernikov * Ensure that table @tc has enough space to add @count entries without 803b6ee846eSAlexander V. Chernikov * need for reallocation. 804db785d31SAlexander V. Chernikov * 805db785d31SAlexander V. Chernikov * Callbacks order: 806301290bcSAlexander V. Chernikov * 0) need_modify() (UH_WLOCK) - checks if @count items can be added w/o resize. 807b6ee846eSAlexander V. Chernikov * 808db785d31SAlexander V. Chernikov * 1) alloc_modify (no locks, M_WAITOK) - alloc new state based on @pflags. 809db785d31SAlexander V. Chernikov * 2) prepare_modifyt (UH_WLOCK) - copy old data into new storage 810db785d31SAlexander V. Chernikov * 3) modify (UH_WLOCK + WLOCK) - switch pointers 811b6ee846eSAlexander V. Chernikov * 4) flush_modify (UH_WLOCK) - free state, if needed 812b6ee846eSAlexander V. Chernikov * 813b6ee846eSAlexander V. Chernikov * Returns 0 on success. 814db785d31SAlexander V. Chernikov */ 815db785d31SAlexander V. Chernikov static int 8160cba2b28SAlexander V. Chernikov check_table_space(struct ip_fw_chain *ch, struct tableop_state *ts, 8170cba2b28SAlexander V. Chernikov struct table_config *tc, struct table_info *ti, uint32_t count) 818db785d31SAlexander V. Chernikov { 819b6ee846eSAlexander V. Chernikov struct table_algo *ta; 820b6ee846eSAlexander V. Chernikov uint64_t pflags; 821b6ee846eSAlexander V. Chernikov char ta_buf[TA_BUF_SZ]; 822db785d31SAlexander V. Chernikov int error; 823db785d31SAlexander V. Chernikov 824b6ee846eSAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 825db785d31SAlexander V. Chernikov 826b6ee846eSAlexander V. Chernikov error = 0; 827b6ee846eSAlexander V. Chernikov ta = tc->ta; 828fd0869d5SAlexander V. Chernikov if (ta->need_modify == NULL) 829fd0869d5SAlexander V. Chernikov return (0); 830fd0869d5SAlexander V. Chernikov 831b6ee846eSAlexander V. Chernikov /* Acquire reference not to loose @tc between locks/unlocks */ 832b6ee846eSAlexander V. Chernikov tc->no.refcnt++; 833db785d31SAlexander V. Chernikov 834db785d31SAlexander V. Chernikov /* 835b6ee846eSAlexander V. Chernikov * TODO: think about avoiding race between large add/large delete 836b6ee846eSAlexander V. Chernikov * operation on algorithm which implements shrinking along with 837b6ee846eSAlexander V. Chernikov * growing. 838db785d31SAlexander V. Chernikov */ 839b6ee846eSAlexander V. Chernikov while (true) { 840b6ee846eSAlexander V. Chernikov pflags = 0; 841301290bcSAlexander V. Chernikov if (ta->need_modify(tc->astate, ti, count, &pflags) == 0) { 84235e1bbd0SAlexander V. Chernikov error = 0; 84335e1bbd0SAlexander V. Chernikov break; 844b6ee846eSAlexander V. Chernikov } 845db785d31SAlexander V. Chernikov 846b6ee846eSAlexander V. Chernikov /* We have to shrink/grow table */ 8470cba2b28SAlexander V. Chernikov if (ts != NULL) 8480cba2b28SAlexander V. Chernikov add_toperation_state(ch, ts); 849b6ee846eSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 850b6ee846eSAlexander V. Chernikov 851301290bcSAlexander V. Chernikov memset(&ta_buf, 0, sizeof(ta_buf)); 8520cba2b28SAlexander V. Chernikov error = ta->prepare_mod(ta_buf, &pflags); 853b6ee846eSAlexander V. Chernikov 854b6ee846eSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 8550cba2b28SAlexander V. Chernikov if (ts != NULL) 8560cba2b28SAlexander V. Chernikov del_toperation_state(ch, ts); 8570cba2b28SAlexander V. Chernikov 8580cba2b28SAlexander V. Chernikov if (error != 0) 8590cba2b28SAlexander V. Chernikov break; 8600cba2b28SAlexander V. Chernikov 8610cba2b28SAlexander V. Chernikov if (ts != NULL && ts->modified != 0) { 8620cba2b28SAlexander V. Chernikov /* 8630cba2b28SAlexander V. Chernikov * Swap operation has happened 8640cba2b28SAlexander V. Chernikov * so we're currently operating on other 8650cba2b28SAlexander V. Chernikov * table data. Stop doing this. 8660cba2b28SAlexander V. Chernikov */ 8670cba2b28SAlexander V. Chernikov ta->flush_mod(ta_buf); 8680cba2b28SAlexander V. Chernikov break; 8690cba2b28SAlexander V. Chernikov } 870b6ee846eSAlexander V. Chernikov 871b6ee846eSAlexander V. Chernikov /* Check if we still need to alter table */ 872b6ee846eSAlexander V. Chernikov ti = KIDX_TO_TI(ch, tc->no.kidx); 873301290bcSAlexander V. Chernikov if (ta->need_modify(tc->astate, ti, count, &pflags) == 0) { 874301290bcSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 875b6ee846eSAlexander V. Chernikov 876b6ee846eSAlexander V. Chernikov /* 87735e1bbd0SAlexander V. Chernikov * Other thread has already performed resize. 87835e1bbd0SAlexander V. Chernikov * Flush our state and return. 879b6ee846eSAlexander V. Chernikov */ 880b6ee846eSAlexander V. Chernikov ta->flush_mod(ta_buf); 881b6ee846eSAlexander V. Chernikov break; 882b6ee846eSAlexander V. Chernikov } 883b6ee846eSAlexander V. Chernikov 884b6ee846eSAlexander V. Chernikov error = ta->fill_mod(tc->astate, ti, ta_buf, &pflags); 885b6ee846eSAlexander V. Chernikov if (error == 0) { 886db785d31SAlexander V. Chernikov /* Do actual modification */ 887db785d31SAlexander V. Chernikov IPFW_WLOCK(ch); 88868394ec8SAlexander V. Chernikov ta->modify(tc->astate, ti, ta_buf, pflags); 889db785d31SAlexander V. Chernikov IPFW_WUNLOCK(ch); 890db785d31SAlexander V. Chernikov } 891db785d31SAlexander V. Chernikov 892b6ee846eSAlexander V. Chernikov /* Anyway, flush data and retry */ 893db785d31SAlexander V. Chernikov ta->flush_mod(ta_buf); 894b6ee846eSAlexander V. Chernikov } 895db785d31SAlexander V. Chernikov 896b6ee846eSAlexander V. Chernikov tc->no.refcnt--; 897db785d31SAlexander V. Chernikov return (error); 898db785d31SAlexander V. Chernikov } 899db785d31SAlexander V. Chernikov 9003a845e10SAlexander V. Chernikov /* 901ac35ff17SAlexander V. Chernikov * Adds or deletes record in table. 902ac35ff17SAlexander V. Chernikov * Data layout (v0): 903ac35ff17SAlexander V. Chernikov * Request: [ ip_fw3_opheader ipfw_table_xentry ] 904ac35ff17SAlexander V. Chernikov * 905ac35ff17SAlexander V. Chernikov * Returns 0 on success 906ac35ff17SAlexander V. Chernikov */ 907ac35ff17SAlexander V. Chernikov static int 9086b988f3aSAlexander V. Chernikov manage_table_ent_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 909ac35ff17SAlexander V. Chernikov struct sockopt_data *sd) 910ac35ff17SAlexander V. Chernikov { 911ac35ff17SAlexander V. Chernikov ipfw_table_xentry *xent; 912ac35ff17SAlexander V. Chernikov struct tentry_info tei; 913ac35ff17SAlexander V. Chernikov struct tid_info ti; 9140cba2b28SAlexander V. Chernikov struct table_value v; 915ac35ff17SAlexander V. Chernikov int error, hdrlen, read; 916ac35ff17SAlexander V. Chernikov 917ac35ff17SAlexander V. Chernikov hdrlen = offsetof(ipfw_table_xentry, k); 918ac35ff17SAlexander V. Chernikov 919ac35ff17SAlexander V. Chernikov /* Check minimum header size */ 920ac35ff17SAlexander V. Chernikov if (sd->valsize < (sizeof(*op3) + hdrlen)) 921ac35ff17SAlexander V. Chernikov return (EINVAL); 922ac35ff17SAlexander V. Chernikov 923ac35ff17SAlexander V. Chernikov read = sizeof(ip_fw3_opheader); 924ac35ff17SAlexander V. Chernikov 925ac35ff17SAlexander V. Chernikov /* Check if xentry len field is valid */ 926ac35ff17SAlexander V. Chernikov xent = (ipfw_table_xentry *)(op3 + 1); 927ac35ff17SAlexander V. Chernikov if (xent->len < hdrlen || xent->len + read > sd->valsize) 928ac35ff17SAlexander V. Chernikov return (EINVAL); 929ac35ff17SAlexander V. Chernikov 930ac35ff17SAlexander V. Chernikov memset(&tei, 0, sizeof(tei)); 931ac35ff17SAlexander V. Chernikov tei.paddr = &xent->k; 932ac35ff17SAlexander V. Chernikov tei.masklen = xent->masklen; 9330cba2b28SAlexander V. Chernikov ipfw_import_table_value_legacy(xent->value, &v); 9340cba2b28SAlexander V. Chernikov tei.pvalue = &v; 935a4641f4eSPedro F. Giffuni /* Old requests compatibility */ 936db785d31SAlexander V. Chernikov tei.flags = TEI_FLAGS_COMPAT; 937c21034b7SAlexander V. Chernikov if (xent->type == IPFW_TABLE_ADDR) { 938ac35ff17SAlexander V. Chernikov if (xent->len - hdrlen == sizeof(in_addr_t)) 939ac35ff17SAlexander V. Chernikov tei.subtype = AF_INET; 940ac35ff17SAlexander V. Chernikov else 941ac35ff17SAlexander V. Chernikov tei.subtype = AF_INET6; 942ac35ff17SAlexander V. Chernikov } 943ac35ff17SAlexander V. Chernikov 944ac35ff17SAlexander V. Chernikov memset(&ti, 0, sizeof(ti)); 945ac35ff17SAlexander V. Chernikov ti.uidx = xent->tbl; 946ac35ff17SAlexander V. Chernikov ti.type = xent->type; 947ac35ff17SAlexander V. Chernikov 948ac35ff17SAlexander V. Chernikov error = (op3->opcode == IP_FW_TABLE_XADD) ? 9493a845e10SAlexander V. Chernikov add_table_entry(ch, &ti, &tei, 0, 1) : 9503a845e10SAlexander V. Chernikov del_table_entry(ch, &ti, &tei, 0, 1); 951ac35ff17SAlexander V. Chernikov 952ac35ff17SAlexander V. Chernikov return (error); 953ac35ff17SAlexander V. Chernikov } 954ac35ff17SAlexander V. Chernikov 955ac35ff17SAlexander V. Chernikov /* 956ac35ff17SAlexander V. Chernikov * Adds or deletes record in table. 957ac35ff17SAlexander V. Chernikov * Data layout (v1)(current): 958db785d31SAlexander V. Chernikov * Request: [ ipfw_obj_header 959db785d31SAlexander V. Chernikov * ipfw_obj_ctlv(IPFW_TLV_TBLENT_LIST) [ ipfw_obj_tentry x N ] 960db785d31SAlexander V. Chernikov * ] 961ac35ff17SAlexander V. Chernikov * 962ac35ff17SAlexander V. Chernikov * Returns 0 on success 963ac35ff17SAlexander V. Chernikov */ 964ac35ff17SAlexander V. Chernikov static int 9656b988f3aSAlexander V. Chernikov manage_table_ent_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 966ac35ff17SAlexander V. Chernikov struct sockopt_data *sd) 967ac35ff17SAlexander V. Chernikov { 9683a845e10SAlexander V. Chernikov ipfw_obj_tentry *tent, *ptent; 969db785d31SAlexander V. Chernikov ipfw_obj_ctlv *ctlv; 970ac35ff17SAlexander V. Chernikov ipfw_obj_header *oh; 9713a845e10SAlexander V. Chernikov struct tentry_info *ptei, tei, *tei_buf; 972ac35ff17SAlexander V. Chernikov struct tid_info ti; 9733a845e10SAlexander V. Chernikov int error, i, kidx, read; 974ac35ff17SAlexander V. Chernikov 975ac35ff17SAlexander V. Chernikov /* Check minimum header size */ 976db785d31SAlexander V. Chernikov if (sd->valsize < (sizeof(*oh) + sizeof(*ctlv))) 977ac35ff17SAlexander V. Chernikov return (EINVAL); 978ac35ff17SAlexander V. Chernikov 979ac35ff17SAlexander V. Chernikov /* Check if passed data is too long */ 980ac35ff17SAlexander V. Chernikov if (sd->valsize != sd->kavail) 981ac35ff17SAlexander V. Chernikov return (EINVAL); 982ac35ff17SAlexander V. Chernikov 983ac35ff17SAlexander V. Chernikov oh = (ipfw_obj_header *)sd->kbuf; 984ac35ff17SAlexander V. Chernikov 985ac35ff17SAlexander V. Chernikov /* Basic length checks for TLVs */ 986ac35ff17SAlexander V. Chernikov if (oh->ntlv.head.length != sizeof(oh->ntlv)) 987ac35ff17SAlexander V. Chernikov return (EINVAL); 988ac35ff17SAlexander V. Chernikov 989ac35ff17SAlexander V. Chernikov read = sizeof(*oh); 990ac35ff17SAlexander V. Chernikov 991db785d31SAlexander V. Chernikov ctlv = (ipfw_obj_ctlv *)(oh + 1); 992db785d31SAlexander V. Chernikov if (ctlv->head.length + read != sd->valsize) 993db785d31SAlexander V. Chernikov return (EINVAL); 994db785d31SAlexander V. Chernikov 995db785d31SAlexander V. Chernikov read += sizeof(*ctlv); 996db785d31SAlexander V. Chernikov tent = (ipfw_obj_tentry *)(ctlv + 1); 9973a845e10SAlexander V. Chernikov if (ctlv->count * sizeof(*tent) + read != sd->valsize) 998ac35ff17SAlexander V. Chernikov return (EINVAL); 999ac35ff17SAlexander V. Chernikov 10003a845e10SAlexander V. Chernikov if (ctlv->count == 0) 10013a845e10SAlexander V. Chernikov return (0); 1002ac35ff17SAlexander V. Chernikov 10033a845e10SAlexander V. Chernikov /* 10043a845e10SAlexander V. Chernikov * Mark entire buffer as "read". 100535e1bbd0SAlexander V. Chernikov * This instructs sopt api write it back 10063a845e10SAlexander V. Chernikov * after function return. 10073a845e10SAlexander V. Chernikov */ 10083a845e10SAlexander V. Chernikov ipfw_get_sopt_header(sd, sd->valsize); 10093a845e10SAlexander V. Chernikov 10103a845e10SAlexander V. Chernikov /* Perform basic checks for each entry */ 10113a845e10SAlexander V. Chernikov ptent = tent; 10123a845e10SAlexander V. Chernikov kidx = tent->idx; 10133a845e10SAlexander V. Chernikov for (i = 0; i < ctlv->count; i++, ptent++) { 10143a845e10SAlexander V. Chernikov if (ptent->head.length != sizeof(*ptent)) 10153a845e10SAlexander V. Chernikov return (EINVAL); 10163a845e10SAlexander V. Chernikov if (ptent->idx != kidx) 10173a845e10SAlexander V. Chernikov return (ENOTSUP); 10183a845e10SAlexander V. Chernikov } 10193a845e10SAlexander V. Chernikov 10203a845e10SAlexander V. Chernikov /* Convert data into kernel request objects */ 102181d3153dSAlexander V. Chernikov objheader_to_ti(oh, &ti); 1022ac35ff17SAlexander V. Chernikov ti.type = oh->ntlv.type; 10233a845e10SAlexander V. Chernikov ti.uidx = kidx; 10243a845e10SAlexander V. Chernikov 10253a845e10SAlexander V. Chernikov /* Use on-stack buffer for single add/del */ 10263a845e10SAlexander V. Chernikov if (ctlv->count == 1) { 10273a845e10SAlexander V. Chernikov memset(&tei, 0, sizeof(tei)); 10283a845e10SAlexander V. Chernikov tei_buf = &tei; 10293a845e10SAlexander V. Chernikov } else 10303a845e10SAlexander V. Chernikov tei_buf = malloc(ctlv->count * sizeof(tei), M_TEMP, 10313a845e10SAlexander V. Chernikov M_WAITOK | M_ZERO); 10323a845e10SAlexander V. Chernikov 10333a845e10SAlexander V. Chernikov ptei = tei_buf; 10343a845e10SAlexander V. Chernikov ptent = tent; 10353a845e10SAlexander V. Chernikov for (i = 0; i < ctlv->count; i++, ptent++, ptei++) { 10363a845e10SAlexander V. Chernikov ptei->paddr = &ptent->k; 10373a845e10SAlexander V. Chernikov ptei->subtype = ptent->subtype; 10383a845e10SAlexander V. Chernikov ptei->masklen = ptent->masklen; 10393a845e10SAlexander V. Chernikov if (ptent->head.flags & IPFW_TF_UPDATE) 10403a845e10SAlexander V. Chernikov ptei->flags |= TEI_FLAGS_UPDATE; 10410cba2b28SAlexander V. Chernikov 10420cba2b28SAlexander V. Chernikov ipfw_import_table_value_v1(&ptent->v.value); 10430cba2b28SAlexander V. Chernikov ptei->pvalue = (struct table_value *)&ptent->v.value; 10443a845e10SAlexander V. Chernikov } 1045ac35ff17SAlexander V. Chernikov 1046ac35ff17SAlexander V. Chernikov error = (oh->opheader.opcode == IP_FW_TABLE_XADD) ? 10473a845e10SAlexander V. Chernikov add_table_entry(ch, &ti, tei_buf, ctlv->flags, ctlv->count) : 10483a845e10SAlexander V. Chernikov del_table_entry(ch, &ti, tei_buf, ctlv->flags, ctlv->count); 10493a845e10SAlexander V. Chernikov 10503a845e10SAlexander V. Chernikov /* Translate result back to userland */ 10513a845e10SAlexander V. Chernikov ptei = tei_buf; 10523a845e10SAlexander V. Chernikov ptent = tent; 10533a845e10SAlexander V. Chernikov for (i = 0; i < ctlv->count; i++, ptent++, ptei++) { 10543a845e10SAlexander V. Chernikov if (ptei->flags & TEI_FLAGS_ADDED) 10553a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_ADDED; 10563a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_DELETED) 10573a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_DELETED; 10583a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_UPDATED) 10593a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_UPDATED; 10603a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_LIMIT) 10613a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_LIMIT; 10623a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_ERROR) 10633a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_ERROR; 10643a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_NOTFOUND) 10653a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_NOTFOUND; 10663a845e10SAlexander V. Chernikov else if (ptei->flags & TEI_FLAGS_EXISTS) 10673a845e10SAlexander V. Chernikov ptent->result = IPFW_TR_EXISTS; 10680cba2b28SAlexander V. Chernikov ipfw_export_table_value_v1(ptei->pvalue, &ptent->v.value); 10693a845e10SAlexander V. Chernikov } 10703a845e10SAlexander V. Chernikov 10713a845e10SAlexander V. Chernikov if (tei_buf != &tei) 10723a845e10SAlexander V. Chernikov free(tei_buf, M_TEMP); 1073ac35ff17SAlexander V. Chernikov 1074ac35ff17SAlexander V. Chernikov return (error); 1075ac35ff17SAlexander V. Chernikov } 1076ac35ff17SAlexander V. Chernikov 107781d3153dSAlexander V. Chernikov /* 107881d3153dSAlexander V. Chernikov * Looks up an entry in given table. 107981d3153dSAlexander V. Chernikov * Data layout (v0)(current): 108081d3153dSAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_obj_tentry ] 108181d3153dSAlexander V. Chernikov * Reply: [ ipfw_obj_header ipfw_obj_tentry ] 108281d3153dSAlexander V. Chernikov * 108381d3153dSAlexander V. Chernikov * Returns 0 on success 108481d3153dSAlexander V. Chernikov */ 10856b988f3aSAlexander V. Chernikov static int 10866b988f3aSAlexander V. Chernikov find_table_entry(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 108781d3153dSAlexander V. Chernikov struct sockopt_data *sd) 108881d3153dSAlexander V. Chernikov { 108981d3153dSAlexander V. Chernikov ipfw_obj_tentry *tent; 109081d3153dSAlexander V. Chernikov ipfw_obj_header *oh; 109181d3153dSAlexander V. Chernikov struct tid_info ti; 109281d3153dSAlexander V. Chernikov struct table_config *tc; 109381d3153dSAlexander V. Chernikov struct table_algo *ta; 109481d3153dSAlexander V. Chernikov struct table_info *kti; 1095308f2c6dSAndrey V. Elsukov struct table_value *pval; 109681d3153dSAlexander V. Chernikov struct namedobj_instance *ni; 1097914bffb6SAlexander V. Chernikov int error; 109881d3153dSAlexander V. Chernikov size_t sz; 109981d3153dSAlexander V. Chernikov 110081d3153dSAlexander V. Chernikov /* Check minimum header size */ 110181d3153dSAlexander V. Chernikov sz = sizeof(*oh) + sizeof(*tent); 110281d3153dSAlexander V. Chernikov if (sd->valsize != sz) 110381d3153dSAlexander V. Chernikov return (EINVAL); 110481d3153dSAlexander V. Chernikov 110581d3153dSAlexander V. Chernikov oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 110681d3153dSAlexander V. Chernikov tent = (ipfw_obj_tentry *)(oh + 1); 110781d3153dSAlexander V. Chernikov 110881d3153dSAlexander V. Chernikov /* Basic length checks for TLVs */ 110981d3153dSAlexander V. Chernikov if (oh->ntlv.head.length != sizeof(oh->ntlv)) 111081d3153dSAlexander V. Chernikov return (EINVAL); 111181d3153dSAlexander V. Chernikov 111281d3153dSAlexander V. Chernikov objheader_to_ti(oh, &ti); 111381d3153dSAlexander V. Chernikov ti.type = oh->ntlv.type; 111481d3153dSAlexander V. Chernikov ti.uidx = tent->idx; 111581d3153dSAlexander V. Chernikov 111681d3153dSAlexander V. Chernikov IPFW_UH_RLOCK(ch); 111781d3153dSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 111881d3153dSAlexander V. Chernikov 111981d3153dSAlexander V. Chernikov /* 112081d3153dSAlexander V. Chernikov * Find existing table and check its type . 112181d3153dSAlexander V. Chernikov */ 112281d3153dSAlexander V. Chernikov ta = NULL; 112381d3153dSAlexander V. Chernikov if ((tc = find_table(ni, &ti)) == NULL) { 112481d3153dSAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 112581d3153dSAlexander V. Chernikov return (ESRCH); 112681d3153dSAlexander V. Chernikov } 112781d3153dSAlexander V. Chernikov 112881d3153dSAlexander V. Chernikov /* check table type */ 112974b22066SAlexander V. Chernikov if (tc->no.subtype != ti.type) { 113081d3153dSAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 113181d3153dSAlexander V. Chernikov return (EINVAL); 113281d3153dSAlexander V. Chernikov } 113381d3153dSAlexander V. Chernikov 113481d3153dSAlexander V. Chernikov kti = KIDX_TO_TI(ch, tc->no.kidx); 113581d3153dSAlexander V. Chernikov ta = tc->ta; 113681d3153dSAlexander V. Chernikov 1137914bffb6SAlexander V. Chernikov if (ta->find_tentry == NULL) 1138914bffb6SAlexander V. Chernikov return (ENOTSUP); 1139914bffb6SAlexander V. Chernikov 1140914bffb6SAlexander V. Chernikov error = ta->find_tentry(tc->astate, kti, tent); 1141308f2c6dSAndrey V. Elsukov if (error == 0) { 1142308f2c6dSAndrey V. Elsukov pval = get_table_value(ch, tc, tent->v.kidx); 1143308f2c6dSAndrey V. Elsukov ipfw_export_table_value_v1(pval, &tent->v.value); 1144308f2c6dSAndrey V. Elsukov } 114581d3153dSAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 114681d3153dSAlexander V. Chernikov 114781d3153dSAlexander V. Chernikov return (error); 114881d3153dSAlexander V. Chernikov } 114981d3153dSAlexander V. Chernikov 115046d52008SAlexander V. Chernikov /* 115146d52008SAlexander V. Chernikov * Flushes all entries or destroys given table. 115246d52008SAlexander V. Chernikov * Data layout (v0)(current): 115346d52008SAlexander V. Chernikov * Request: [ ipfw_obj_header ] 115446d52008SAlexander V. Chernikov * 115546d52008SAlexander V. Chernikov * Returns 0 on success 115646d52008SAlexander V. Chernikov */ 11576b988f3aSAlexander V. Chernikov static int 11586b988f3aSAlexander V. Chernikov flush_table_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1159ac35ff17SAlexander V. Chernikov struct sockopt_data *sd) 1160ac35ff17SAlexander V. Chernikov { 1161ac35ff17SAlexander V. Chernikov int error; 1162ac35ff17SAlexander V. Chernikov struct _ipfw_obj_header *oh; 1163ac35ff17SAlexander V. Chernikov struct tid_info ti; 1164ac35ff17SAlexander V. Chernikov 1165ac35ff17SAlexander V. Chernikov if (sd->valsize != sizeof(*oh)) 1166ac35ff17SAlexander V. Chernikov return (EINVAL); 1167ac35ff17SAlexander V. Chernikov 1168ac35ff17SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)op3; 1169ac35ff17SAlexander V. Chernikov objheader_to_ti(oh, &ti); 1170ac35ff17SAlexander V. Chernikov 11711832a7b3SAlexander V. Chernikov if (op3->opcode == IP_FW_TABLE_XDESTROY) 1172ac35ff17SAlexander V. Chernikov error = destroy_table(ch, &ti); 11731832a7b3SAlexander V. Chernikov else if (op3->opcode == IP_FW_TABLE_XFLUSH) 1174ac35ff17SAlexander V. Chernikov error = flush_table(ch, &ti); 1175ac35ff17SAlexander V. Chernikov else 1176ac35ff17SAlexander V. Chernikov return (ENOTSUP); 1177ac35ff17SAlexander V. Chernikov 1178ac35ff17SAlexander V. Chernikov return (error); 11793b3a8eb9SGleb Smirnoff } 11803b3a8eb9SGleb Smirnoff 1181fb4b37a3SAlexander V. Chernikov static void 1182fb4b37a3SAlexander V. Chernikov restart_flush(void *object, struct op_state *_state) 1183fb4b37a3SAlexander V. Chernikov { 1184fb4b37a3SAlexander V. Chernikov struct tableop_state *ts; 1185fb4b37a3SAlexander V. Chernikov 1186fb4b37a3SAlexander V. Chernikov ts = (struct tableop_state *)_state; 1187fb4b37a3SAlexander V. Chernikov 1188fb4b37a3SAlexander V. Chernikov if (ts->tc != object) 1189fb4b37a3SAlexander V. Chernikov return; 1190fb4b37a3SAlexander V. Chernikov 1191fb4b37a3SAlexander V. Chernikov /* Indicate we've called */ 1192fb4b37a3SAlexander V. Chernikov ts->modified = 1; 1193fb4b37a3SAlexander V. Chernikov } 1194fb4b37a3SAlexander V. Chernikov 119535e1bbd0SAlexander V. Chernikov /* 119635e1bbd0SAlexander V. Chernikov * Flushes given table. 119735e1bbd0SAlexander V. Chernikov * 119835e1bbd0SAlexander V. Chernikov * Function create new table instance with the same 119935e1bbd0SAlexander V. Chernikov * parameters, swaps it with old one and 1200fb4b37a3SAlexander V. Chernikov * flushes state without holding runtime WLOCK. 120135e1bbd0SAlexander V. Chernikov * 120235e1bbd0SAlexander V. Chernikov * Returns 0 on success. 120335e1bbd0SAlexander V. Chernikov */ 12041832a7b3SAlexander V. Chernikov int 1205ac35ff17SAlexander V. Chernikov flush_table(struct ip_fw_chain *ch, struct tid_info *ti) 12063b3a8eb9SGleb Smirnoff { 1207b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 1208b074b7bbSAlexander V. Chernikov struct table_config *tc; 12099f7d47b0SAlexander V. Chernikov struct table_algo *ta; 12109f7d47b0SAlexander V. Chernikov struct table_info ti_old, ti_new, *tablestate; 12119f7d47b0SAlexander V. Chernikov void *astate_old, *astate_new; 1212914bffb6SAlexander V. Chernikov char algostate[64], *pstate; 1213fb4b37a3SAlexander V. Chernikov struct tableop_state ts; 12140caab009SAlexander V. Chernikov int error, need_gc; 1215b074b7bbSAlexander V. Chernikov uint16_t kidx; 1216914bffb6SAlexander V. Chernikov uint8_t tflags; 12173b3a8eb9SGleb Smirnoff 12183b3a8eb9SGleb Smirnoff /* 1219a4641f4eSPedro F. Giffuni * Stage 1: save table algorithm. 1220b074b7bbSAlexander V. Chernikov * Reference found table to ensure it won't disappear. 12213b3a8eb9SGleb Smirnoff */ 1222b074b7bbSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1223b074b7bbSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1224b074b7bbSAlexander V. Chernikov if ((tc = find_table(ni, ti)) == NULL) { 1225b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1226b074b7bbSAlexander V. Chernikov return (ESRCH); 1227b074b7bbSAlexander V. Chernikov } 12280caab009SAlexander V. Chernikov need_gc = 0; 12290caab009SAlexander V. Chernikov astate_new = NULL; 12300caab009SAlexander V. Chernikov memset(&ti_new, 0, sizeof(ti_new)); 1231fb4b37a3SAlexander V. Chernikov restart: 1232fb4b37a3SAlexander V. Chernikov /* Set up swap handler */ 1233fb4b37a3SAlexander V. Chernikov memset(&ts, 0, sizeof(ts)); 1234fb4b37a3SAlexander V. Chernikov ts.opstate.func = restart_flush; 1235fb4b37a3SAlexander V. Chernikov ts.tc = tc; 1236fb4b37a3SAlexander V. Chernikov 12379f7d47b0SAlexander V. Chernikov ta = tc->ta; 1238fd0869d5SAlexander V. Chernikov /* Do not flush readonly tables */ 1239fd0869d5SAlexander V. Chernikov if ((ta->flags & TA_FLAG_READONLY) != 0) { 1240fd0869d5SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1241fd0869d5SAlexander V. Chernikov return (EACCES); 1242fd0869d5SAlexander V. Chernikov } 124335e1bbd0SAlexander V. Chernikov /* Save startup algo parameters */ 1244daabb523SAlexander V. Chernikov if (ta->print_config != NULL) { 1245daabb523SAlexander V. Chernikov ta->print_config(tc->astate, KIDX_TO_TI(ch, tc->no.kidx), 1246daabb523SAlexander V. Chernikov algostate, sizeof(algostate)); 1247daabb523SAlexander V. Chernikov pstate = algostate; 1248daabb523SAlexander V. Chernikov } else 1249daabb523SAlexander V. Chernikov pstate = NULL; 1250914bffb6SAlexander V. Chernikov tflags = tc->tflags; 1251fb4b37a3SAlexander V. Chernikov tc->no.refcnt++; 1252fb4b37a3SAlexander V. Chernikov add_toperation_state(ch, &ts); 1253b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 12543b3a8eb9SGleb Smirnoff 1255b074b7bbSAlexander V. Chernikov /* 12560caab009SAlexander V. Chernikov * Stage 1.5: if this is not the first attempt, destroy previous state 12570caab009SAlexander V. Chernikov */ 12580caab009SAlexander V. Chernikov if (need_gc != 0) { 12590caab009SAlexander V. Chernikov ta->destroy(astate_new, &ti_new); 12600caab009SAlexander V. Chernikov need_gc = 0; 12610caab009SAlexander V. Chernikov } 12620caab009SAlexander V. Chernikov 12630caab009SAlexander V. Chernikov /* 12649f7d47b0SAlexander V. Chernikov * Stage 2: allocate new table instance using same algo. 1265b074b7bbSAlexander V. Chernikov */ 12669f7d47b0SAlexander V. Chernikov memset(&ti_new, 0, sizeof(struct table_info)); 1267fb4b37a3SAlexander V. Chernikov error = ta->init(ch, &astate_new, &ti_new, pstate, tflags); 1268b074b7bbSAlexander V. Chernikov 1269b074b7bbSAlexander V. Chernikov /* 1270b074b7bbSAlexander V. Chernikov * Stage 3: swap old state pointers with newly-allocated ones. 1271b074b7bbSAlexander V. Chernikov * Decrease refcount. 1272b074b7bbSAlexander V. Chernikov */ 1273b074b7bbSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1274fb4b37a3SAlexander V. Chernikov tc->no.refcnt--; 1275fb4b37a3SAlexander V. Chernikov del_toperation_state(ch, &ts); 1276fb4b37a3SAlexander V. Chernikov 1277fb4b37a3SAlexander V. Chernikov if (error != 0) { 1278fb4b37a3SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1279fb4b37a3SAlexander V. Chernikov return (error); 1280fb4b37a3SAlexander V. Chernikov } 1281fb4b37a3SAlexander V. Chernikov 1282fb4b37a3SAlexander V. Chernikov /* 1283fb4b37a3SAlexander V. Chernikov * Restart operation if table swap has happened: 1284fb4b37a3SAlexander V. Chernikov * even if algo may be the same, algo init parameters 1285fb4b37a3SAlexander V. Chernikov * may change. Restart operation instead of doing 1286fb4b37a3SAlexander V. Chernikov * complex checks. 1287fb4b37a3SAlexander V. Chernikov */ 1288fb4b37a3SAlexander V. Chernikov if (ts.modified != 0) { 12890caab009SAlexander V. Chernikov /* Delay destroying data since we're holding UH lock */ 12900caab009SAlexander V. Chernikov need_gc = 1; 1291fb4b37a3SAlexander V. Chernikov goto restart; 1292fb4b37a3SAlexander V. Chernikov } 1293b074b7bbSAlexander V. Chernikov 1294b074b7bbSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1295b074b7bbSAlexander V. Chernikov kidx = tc->no.kidx; 12969f7d47b0SAlexander V. Chernikov tablestate = (struct table_info *)ch->tablestate; 1297b074b7bbSAlexander V. Chernikov 12989f7d47b0SAlexander V. Chernikov IPFW_WLOCK(ch); 12999f7d47b0SAlexander V. Chernikov ti_old = tablestate[kidx]; 13009f7d47b0SAlexander V. Chernikov tablestate[kidx] = ti_new; 13019f7d47b0SAlexander V. Chernikov IPFW_WUNLOCK(ch); 1302b074b7bbSAlexander V. Chernikov 13039f7d47b0SAlexander V. Chernikov astate_old = tc->astate; 13049f7d47b0SAlexander V. Chernikov tc->astate = astate_new; 13054c060d85SAlexander V. Chernikov tc->ti_copy = ti_new; 13069f7d47b0SAlexander V. Chernikov tc->count = 0; 1307b074b7bbSAlexander V. Chernikov 130879e86902SAlexander V. Chernikov /* Notify algo on real @ti address */ 130979e86902SAlexander V. Chernikov if (ta->change_ti != NULL) 131079e86902SAlexander V. Chernikov ta->change_ti(tc->astate, &tablestate[kidx]); 131179e86902SAlexander V. Chernikov 13120cba2b28SAlexander V. Chernikov /* 13130cba2b28SAlexander V. Chernikov * Stage 4: unref values. 13140cba2b28SAlexander V. Chernikov */ 13150cba2b28SAlexander V. Chernikov ipfw_unref_table_values(ch, tc, ta, astate_old, &ti_old); 1316b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 13173b3a8eb9SGleb Smirnoff 1318b074b7bbSAlexander V. Chernikov /* 13190cba2b28SAlexander V. Chernikov * Stage 5: perform real flush/destroy. 1320b074b7bbSAlexander V. Chernikov */ 13219f7d47b0SAlexander V. Chernikov ta->destroy(astate_old, &ti_old); 13223b3a8eb9SGleb Smirnoff 13233b3a8eb9SGleb Smirnoff return (0); 13243b3a8eb9SGleb Smirnoff } 13253b3a8eb9SGleb Smirnoff 1326b074b7bbSAlexander V. Chernikov /* 132746d52008SAlexander V. Chernikov * Swaps two tables. 132846d52008SAlexander V. Chernikov * Data layout (v0)(current): 132946d52008SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_obj_ntlv ] 133046d52008SAlexander V. Chernikov * 133146d52008SAlexander V. Chernikov * Returns 0 on success 133246d52008SAlexander V. Chernikov */ 13336b988f3aSAlexander V. Chernikov static int 13346b988f3aSAlexander V. Chernikov swap_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 133546d52008SAlexander V. Chernikov struct sockopt_data *sd) 133646d52008SAlexander V. Chernikov { 133746d52008SAlexander V. Chernikov int error; 133846d52008SAlexander V. Chernikov struct _ipfw_obj_header *oh; 133946d52008SAlexander V. Chernikov struct tid_info ti_a, ti_b; 134046d52008SAlexander V. Chernikov 134146d52008SAlexander V. Chernikov if (sd->valsize != sizeof(*oh) + sizeof(ipfw_obj_ntlv)) 134246d52008SAlexander V. Chernikov return (EINVAL); 134346d52008SAlexander V. Chernikov 134446d52008SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)op3; 134546d52008SAlexander V. Chernikov ntlv_to_ti(&oh->ntlv, &ti_a); 134646d52008SAlexander V. Chernikov ntlv_to_ti((ipfw_obj_ntlv *)(oh + 1), &ti_b); 134746d52008SAlexander V. Chernikov 1348a73d728dSAlexander V. Chernikov error = swap_tables(ch, &ti_a, &ti_b); 134946d52008SAlexander V. Chernikov 135046d52008SAlexander V. Chernikov return (error); 135146d52008SAlexander V. Chernikov } 135246d52008SAlexander V. Chernikov 135335e1bbd0SAlexander V. Chernikov /* 135435e1bbd0SAlexander V. Chernikov * Swaps two tables of the same type/valtype. 135535e1bbd0SAlexander V. Chernikov * 135635e1bbd0SAlexander V. Chernikov * Checks if tables are compatible and limits 1357c8d5d308SAlexander V. Chernikov * permits swap, than actually perform swap. 135835e1bbd0SAlexander V. Chernikov * 1359c8d5d308SAlexander V. Chernikov * Each table consists of 2 different parts: 1360c8d5d308SAlexander V. Chernikov * config: 1361c8d5d308SAlexander V. Chernikov * @tc (with name, set, kidx) and rule bindings, which is "stable". 1362c8d5d308SAlexander V. Chernikov * number of items 1363c8d5d308SAlexander V. Chernikov * table algo 1364c8d5d308SAlexander V. Chernikov * runtime: 1365c8d5d308SAlexander V. Chernikov * runtime data @ti (ch->tablestate) 1366c8d5d308SAlexander V. Chernikov * runtime cache in @tc 1367c8d5d308SAlexander V. Chernikov * algo-specific data (@tc->astate) 1368c8d5d308SAlexander V. Chernikov * 1369c8d5d308SAlexander V. Chernikov * So we switch: 1370c8d5d308SAlexander V. Chernikov * all runtime data 1371c8d5d308SAlexander V. Chernikov * number of items 1372c8d5d308SAlexander V. Chernikov * table algo 1373c8d5d308SAlexander V. Chernikov * 1374c8d5d308SAlexander V. Chernikov * After that we call @ti change handler for each table. 1375c8d5d308SAlexander V. Chernikov * 1376c8d5d308SAlexander V. Chernikov * Note that referencing @tc won't protect tc->ta from change. 1377c8d5d308SAlexander V. Chernikov * XXX: Do we need to restrict swap between locked tables? 1378c8d5d308SAlexander V. Chernikov * XXX: Do we need to exchange ftype? 137935e1bbd0SAlexander V. Chernikov * 138035e1bbd0SAlexander V. Chernikov * Returns 0 on success. 138135e1bbd0SAlexander V. Chernikov */ 138246d52008SAlexander V. Chernikov static int 1383a73d728dSAlexander V. Chernikov swap_tables(struct ip_fw_chain *ch, struct tid_info *a, 138446d52008SAlexander V. Chernikov struct tid_info *b) 138546d52008SAlexander V. Chernikov { 138646d52008SAlexander V. Chernikov struct namedobj_instance *ni; 138746d52008SAlexander V. Chernikov struct table_config *tc_a, *tc_b; 138846d52008SAlexander V. Chernikov struct table_algo *ta; 138946d52008SAlexander V. Chernikov struct table_info ti, *tablestate; 139046d52008SAlexander V. Chernikov void *astate; 139146d52008SAlexander V. Chernikov uint32_t count; 139246d52008SAlexander V. Chernikov 139346d52008SAlexander V. Chernikov /* 139446d52008SAlexander V. Chernikov * Stage 1: find both tables and ensure they are of 139535e1bbd0SAlexander V. Chernikov * the same type. 139646d52008SAlexander V. Chernikov */ 139746d52008SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 139846d52008SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 139946d52008SAlexander V. Chernikov if ((tc_a = find_table(ni, a)) == NULL) { 140046d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 140146d52008SAlexander V. Chernikov return (ESRCH); 140246d52008SAlexander V. Chernikov } 140346d52008SAlexander V. Chernikov if ((tc_b = find_table(ni, b)) == NULL) { 140446d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 140546d52008SAlexander V. Chernikov return (ESRCH); 140646d52008SAlexander V. Chernikov } 140746d52008SAlexander V. Chernikov 140846d52008SAlexander V. Chernikov /* It is very easy to swap between the same table */ 140946d52008SAlexander V. Chernikov if (tc_a == tc_b) { 141046d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 141146d52008SAlexander V. Chernikov return (0); 141246d52008SAlexander V. Chernikov } 141346d52008SAlexander V. Chernikov 141446d52008SAlexander V. Chernikov /* Check type and value are the same */ 141574b22066SAlexander V. Chernikov if (tc_a->no.subtype!=tc_b->no.subtype || tc_a->tflags!=tc_b->tflags) { 141646d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 141746d52008SAlexander V. Chernikov return (EINVAL); 141846d52008SAlexander V. Chernikov } 141946d52008SAlexander V. Chernikov 142046d52008SAlexander V. Chernikov /* Check limits before swap */ 142146d52008SAlexander V. Chernikov if ((tc_a->limit != 0 && tc_b->count > tc_a->limit) || 142246d52008SAlexander V. Chernikov (tc_b->limit != 0 && tc_a->count > tc_b->limit)) { 142346d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 142446d52008SAlexander V. Chernikov return (EFBIG); 142546d52008SAlexander V. Chernikov } 142646d52008SAlexander V. Chernikov 1427fd0869d5SAlexander V. Chernikov /* Check if one of the tables is readonly */ 1428fd0869d5SAlexander V. Chernikov if (((tc_a->ta->flags | tc_b->ta->flags) & TA_FLAG_READONLY) != 0) { 1429fd0869d5SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1430fd0869d5SAlexander V. Chernikov return (EACCES); 1431fd0869d5SAlexander V. Chernikov } 1432fd0869d5SAlexander V. Chernikov 14330cba2b28SAlexander V. Chernikov /* Notify we're going to swap */ 14340cba2b28SAlexander V. Chernikov rollback_toperation_state(ch, tc_a); 14350cba2b28SAlexander V. Chernikov rollback_toperation_state(ch, tc_b); 14360cba2b28SAlexander V. Chernikov 143746d52008SAlexander V. Chernikov /* Everything is fine, prepare to swap */ 143846d52008SAlexander V. Chernikov tablestate = (struct table_info *)ch->tablestate; 143946d52008SAlexander V. Chernikov ti = tablestate[tc_a->no.kidx]; 144046d52008SAlexander V. Chernikov ta = tc_a->ta; 144146d52008SAlexander V. Chernikov astate = tc_a->astate; 144246d52008SAlexander V. Chernikov count = tc_a->count; 144346d52008SAlexander V. Chernikov 144446d52008SAlexander V. Chernikov IPFW_WLOCK(ch); 144546d52008SAlexander V. Chernikov /* a <- b */ 144646d52008SAlexander V. Chernikov tablestate[tc_a->no.kidx] = tablestate[tc_b->no.kidx]; 144746d52008SAlexander V. Chernikov tc_a->ta = tc_b->ta; 144846d52008SAlexander V. Chernikov tc_a->astate = tc_b->astate; 144946d52008SAlexander V. Chernikov tc_a->count = tc_b->count; 145046d52008SAlexander V. Chernikov /* b <- a */ 145146d52008SAlexander V. Chernikov tablestate[tc_b->no.kidx] = ti; 145246d52008SAlexander V. Chernikov tc_b->ta = ta; 145346d52008SAlexander V. Chernikov tc_b->astate = astate; 145446d52008SAlexander V. Chernikov tc_b->count = count; 145546d52008SAlexander V. Chernikov IPFW_WUNLOCK(ch); 145646d52008SAlexander V. Chernikov 145746d52008SAlexander V. Chernikov /* Ensure tc.ti copies are in sync */ 14584c060d85SAlexander V. Chernikov tc_a->ti_copy = tablestate[tc_a->no.kidx]; 14594c060d85SAlexander V. Chernikov tc_b->ti_copy = tablestate[tc_b->no.kidx]; 146046d52008SAlexander V. Chernikov 146146d52008SAlexander V. Chernikov /* Notify both tables on @ti change */ 146246d52008SAlexander V. Chernikov if (tc_a->ta->change_ti != NULL) 146346d52008SAlexander V. Chernikov tc_a->ta->change_ti(tc_a->astate, &tablestate[tc_a->no.kidx]); 146446d52008SAlexander V. Chernikov if (tc_b->ta->change_ti != NULL) 146546d52008SAlexander V. Chernikov tc_b->ta->change_ti(tc_b->astate, &tablestate[tc_b->no.kidx]); 146646d52008SAlexander V. Chernikov 146746d52008SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 146846d52008SAlexander V. Chernikov 146946d52008SAlexander V. Chernikov return (0); 147046d52008SAlexander V. Chernikov } 147146d52008SAlexander V. Chernikov 147246d52008SAlexander V. Chernikov /* 14739f7d47b0SAlexander V. Chernikov * Destroys table specified by @ti. 1474ac35ff17SAlexander V. Chernikov * Data layout (v0)(current): 1475ac35ff17SAlexander V. Chernikov * Request: [ ip_fw3_opheader ] 1476ac35ff17SAlexander V. Chernikov * 1477ac35ff17SAlexander V. Chernikov * Returns 0 on success 1478b074b7bbSAlexander V. Chernikov */ 1479ac35ff17SAlexander V. Chernikov static int 1480ac35ff17SAlexander V. Chernikov destroy_table(struct ip_fw_chain *ch, struct tid_info *ti) 1481b074b7bbSAlexander V. Chernikov { 1482b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 1483b074b7bbSAlexander V. Chernikov struct table_config *tc; 1484b074b7bbSAlexander V. Chernikov 1485b074b7bbSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1486b074b7bbSAlexander V. Chernikov 1487b074b7bbSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1488b074b7bbSAlexander V. Chernikov if ((tc = find_table(ni, ti)) == NULL) { 1489b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1490b074b7bbSAlexander V. Chernikov return (ESRCH); 1491b074b7bbSAlexander V. Chernikov } 1492b074b7bbSAlexander V. Chernikov 14939f7d47b0SAlexander V. Chernikov /* Do not permit destroying referenced tables */ 14949f7d47b0SAlexander V. Chernikov if (tc->no.refcnt > 0) { 1495b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1496b074b7bbSAlexander V. Chernikov return (EBUSY); 1497b074b7bbSAlexander V. Chernikov } 1498b074b7bbSAlexander V. Chernikov 1499b074b7bbSAlexander V. Chernikov IPFW_WLOCK(ch); 1500b074b7bbSAlexander V. Chernikov unlink_table(ch, tc); 1501b074b7bbSAlexander V. Chernikov IPFW_WUNLOCK(ch); 1502b074b7bbSAlexander V. Chernikov 1503b074b7bbSAlexander V. Chernikov /* Free obj index */ 1504ac35ff17SAlexander V. Chernikov if (ipfw_objhash_free_idx(ni, tc->no.kidx) != 0) 1505b074b7bbSAlexander V. Chernikov printf("Error unlinking kidx %d from table %s\n", 1506b074b7bbSAlexander V. Chernikov tc->no.kidx, tc->tablename); 1507b074b7bbSAlexander V. Chernikov 15080cba2b28SAlexander V. Chernikov /* Unref values used in tables while holding UH lock */ 15094c060d85SAlexander V. Chernikov ipfw_unref_table_values(ch, tc, tc->ta, tc->astate, &tc->ti_copy); 1510b074b7bbSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1511b074b7bbSAlexander V. Chernikov 1512b074b7bbSAlexander V. Chernikov free_table_config(ni, tc); 1513b074b7bbSAlexander V. Chernikov 1514b074b7bbSAlexander V. Chernikov return (0); 1515b074b7bbSAlexander V. Chernikov } 1516b074b7bbSAlexander V. Chernikov 15174040f4ecSAlexander V. Chernikov static uint32_t 15184040f4ecSAlexander V. Chernikov roundup2p(uint32_t v) 15194040f4ecSAlexander V. Chernikov { 15204040f4ecSAlexander V. Chernikov 15214040f4ecSAlexander V. Chernikov v--; 15224040f4ecSAlexander V. Chernikov v |= v >> 1; 15234040f4ecSAlexander V. Chernikov v |= v >> 2; 15244040f4ecSAlexander V. Chernikov v |= v >> 4; 15254040f4ecSAlexander V. Chernikov v |= v >> 8; 15264040f4ecSAlexander V. Chernikov v |= v >> 16; 15274040f4ecSAlexander V. Chernikov v++; 15284040f4ecSAlexander V. Chernikov 15294040f4ecSAlexander V. Chernikov return (v); 15304040f4ecSAlexander V. Chernikov } 15314040f4ecSAlexander V. Chernikov 153235e1bbd0SAlexander V. Chernikov /* 153335e1bbd0SAlexander V. Chernikov * Grow tables index. 153435e1bbd0SAlexander V. Chernikov * 153535e1bbd0SAlexander V. Chernikov * Returns 0 on success. 153635e1bbd0SAlexander V. Chernikov */ 15373b3a8eb9SGleb Smirnoff int 15383b3a8eb9SGleb Smirnoff ipfw_resize_tables(struct ip_fw_chain *ch, unsigned int ntables) 15393b3a8eb9SGleb Smirnoff { 154060a28b09SMateusz Guzik unsigned int tbl; 1541b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 15429f7d47b0SAlexander V. Chernikov void *new_idx, *old_tablestate, *tablestate; 154368394ec8SAlexander V. Chernikov struct table_info *ti; 154468394ec8SAlexander V. Chernikov struct table_config *tc; 154568394ec8SAlexander V. Chernikov int i, new_blocks; 15463b3a8eb9SGleb Smirnoff 15473b3a8eb9SGleb Smirnoff /* Check new value for validity */ 15484040f4ecSAlexander V. Chernikov if (ntables == 0) 15494040f4ecSAlexander V. Chernikov return (EINVAL); 15503b3a8eb9SGleb Smirnoff if (ntables > IPFW_TABLES_MAX) 15513b3a8eb9SGleb Smirnoff ntables = IPFW_TABLES_MAX; 15524040f4ecSAlexander V. Chernikov /* Alight to nearest power of 2 */ 15534040f4ecSAlexander V. Chernikov ntables = (unsigned int)roundup2p(ntables); 15543b3a8eb9SGleb Smirnoff 15553b3a8eb9SGleb Smirnoff /* Allocate new pointers */ 15569f7d47b0SAlexander V. Chernikov tablestate = malloc(ntables * sizeof(struct table_info), 15579f7d47b0SAlexander V. Chernikov M_IPFW, M_WAITOK | M_ZERO); 15589f7d47b0SAlexander V. Chernikov 1559b074b7bbSAlexander V. Chernikov ipfw_objhash_bitmap_alloc(ntables, (void *)&new_idx, &new_blocks); 15603b3a8eb9SGleb Smirnoff 15619f7d47b0SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 15623b3a8eb9SGleb Smirnoff 15633b3a8eb9SGleb Smirnoff tbl = (ntables >= V_fw_tables_max) ? V_fw_tables_max : ntables; 1564b074b7bbSAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1565b074b7bbSAlexander V. Chernikov 15669f7d47b0SAlexander V. Chernikov /* Temporary restrict decreasing max_tables */ 15679f7d47b0SAlexander V. Chernikov if (ntables < V_fw_tables_max) { 15689f7d47b0SAlexander V. Chernikov /* 15699f7d47b0SAlexander V. Chernikov * FIXME: Check if we really can shrink 15709f7d47b0SAlexander V. Chernikov */ 15719f7d47b0SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1572b074b7bbSAlexander V. Chernikov return (EINVAL); 1573b074b7bbSAlexander V. Chernikov } 15743b3a8eb9SGleb Smirnoff 15759f7d47b0SAlexander V. Chernikov /* Copy table info/indices */ 15769f7d47b0SAlexander V. Chernikov memcpy(tablestate, ch->tablestate, sizeof(struct table_info) * tbl); 15779f7d47b0SAlexander V. Chernikov ipfw_objhash_bitmap_merge(ni, &new_idx, &new_blocks); 15783b3a8eb9SGleb Smirnoff 15799f7d47b0SAlexander V. Chernikov IPFW_WLOCK(ch); 15809f7d47b0SAlexander V. Chernikov 15819f7d47b0SAlexander V. Chernikov /* Change pointers */ 15829f7d47b0SAlexander V. Chernikov old_tablestate = ch->tablestate; 15839f7d47b0SAlexander V. Chernikov ch->tablestate = tablestate; 15849f7d47b0SAlexander V. Chernikov ipfw_objhash_bitmap_swap(ni, &new_idx, &new_blocks); 15853b3a8eb9SGleb Smirnoff 15863b3a8eb9SGleb Smirnoff V_fw_tables_max = ntables; 15873b3a8eb9SGleb Smirnoff 15883b3a8eb9SGleb Smirnoff IPFW_WUNLOCK(ch); 158968394ec8SAlexander V. Chernikov 159068394ec8SAlexander V. Chernikov /* Notify all consumers that their @ti pointer has changed */ 159168394ec8SAlexander V. Chernikov ti = (struct table_info *)ch->tablestate; 159268394ec8SAlexander V. Chernikov for (i = 0; i < tbl; i++, ti++) { 159368394ec8SAlexander V. Chernikov if (ti->lookup == NULL) 159468394ec8SAlexander V. Chernikov continue; 159568394ec8SAlexander V. Chernikov tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, i); 159668394ec8SAlexander V. Chernikov if (tc == NULL || tc->ta->change_ti == NULL) 159768394ec8SAlexander V. Chernikov continue; 159868394ec8SAlexander V. Chernikov 159968394ec8SAlexander V. Chernikov tc->ta->change_ti(tc->astate, ti); 160068394ec8SAlexander V. Chernikov } 160168394ec8SAlexander V. Chernikov 16029f7d47b0SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 16033b3a8eb9SGleb Smirnoff 16043b3a8eb9SGleb Smirnoff /* Free old pointers */ 16059f7d47b0SAlexander V. Chernikov free(old_tablestate, M_IPFW); 1606b074b7bbSAlexander V. Chernikov ipfw_objhash_bitmap_free(new_idx, new_blocks); 16073b3a8eb9SGleb Smirnoff 16083b3a8eb9SGleb Smirnoff return (0); 16093b3a8eb9SGleb Smirnoff } 16103b3a8eb9SGleb Smirnoff 1611a73d728dSAlexander V. Chernikov /* 16126951cecfSAndrey V. Elsukov * Lookup table's named object by its @kidx. 16136951cecfSAndrey V. Elsukov */ 16146951cecfSAndrey V. Elsukov struct named_object * 16156951cecfSAndrey V. Elsukov ipfw_objhash_lookup_table_kidx(struct ip_fw_chain *ch, uint16_t kidx) 16166951cecfSAndrey V. Elsukov { 16176951cecfSAndrey V. Elsukov 16186951cecfSAndrey V. Elsukov return (ipfw_objhash_lookup_kidx(CHAIN_TO_NI(ch), kidx)); 16196951cecfSAndrey V. Elsukov } 16206951cecfSAndrey V. Elsukov 16216951cecfSAndrey V. Elsukov /* 16226951cecfSAndrey V. Elsukov * Take reference to table specified in @ntlv. 16236951cecfSAndrey V. Elsukov * On success return its @kidx. 16246951cecfSAndrey V. Elsukov */ 16256951cecfSAndrey V. Elsukov int 16266951cecfSAndrey V. Elsukov ipfw_ref_table(struct ip_fw_chain *ch, ipfw_obj_ntlv *ntlv, uint16_t *kidx) 16276951cecfSAndrey V. Elsukov { 16286951cecfSAndrey V. Elsukov struct tid_info ti; 16296951cecfSAndrey V. Elsukov struct table_config *tc; 16306951cecfSAndrey V. Elsukov int error; 16316951cecfSAndrey V. Elsukov 16326951cecfSAndrey V. Elsukov IPFW_UH_WLOCK_ASSERT(ch); 16336951cecfSAndrey V. Elsukov 16346951cecfSAndrey V. Elsukov ntlv_to_ti(ntlv, &ti); 16356951cecfSAndrey V. Elsukov error = find_table_err(CHAIN_TO_NI(ch), &ti, &tc); 16366951cecfSAndrey V. Elsukov if (error != 0) 16376951cecfSAndrey V. Elsukov return (error); 16386951cecfSAndrey V. Elsukov 16396951cecfSAndrey V. Elsukov if (tc == NULL) 16406951cecfSAndrey V. Elsukov return (ESRCH); 16416951cecfSAndrey V. Elsukov 16426951cecfSAndrey V. Elsukov tc_ref(tc); 16436951cecfSAndrey V. Elsukov *kidx = tc->no.kidx; 16446951cecfSAndrey V. Elsukov 16456951cecfSAndrey V. Elsukov return (0); 16466951cecfSAndrey V. Elsukov } 16476951cecfSAndrey V. Elsukov 16486951cecfSAndrey V. Elsukov void 16496951cecfSAndrey V. Elsukov ipfw_unref_table(struct ip_fw_chain *ch, uint16_t kidx) 16506951cecfSAndrey V. Elsukov { 16516951cecfSAndrey V. Elsukov 16526951cecfSAndrey V. Elsukov struct namedobj_instance *ni; 16536951cecfSAndrey V. Elsukov struct named_object *no; 16546951cecfSAndrey V. Elsukov 16556951cecfSAndrey V. Elsukov IPFW_UH_WLOCK_ASSERT(ch); 16566951cecfSAndrey V. Elsukov ni = CHAIN_TO_NI(ch); 16576951cecfSAndrey V. Elsukov no = ipfw_objhash_lookup_kidx(ni, kidx); 16586951cecfSAndrey V. Elsukov KASSERT(no != NULL, ("Table with index %d not found", kidx)); 16596951cecfSAndrey V. Elsukov no->refcnt--; 16606951cecfSAndrey V. Elsukov } 16616951cecfSAndrey V. Elsukov 16626951cecfSAndrey V. Elsukov /* 16639ffd0f54SLuiz Otavio O Souza * Lookup an arbitrary key @paddr of length @plen in table @tbl. 1664c8d5d308SAlexander V. Chernikov * Stores found value in @val. 1665c8d5d308SAlexander V. Chernikov * 1666c8d5d308SAlexander V. Chernikov * Returns 1 if key was found. 1667c8d5d308SAlexander V. Chernikov */ 16689f7d47b0SAlexander V. Chernikov int 166954e5669dSAndrey V. Elsukov ipfw_lookup_table(struct ip_fw_chain *ch, uint16_t tbl, uint16_t plen, 16709f7d47b0SAlexander V. Chernikov void *paddr, uint32_t *val) 16719f7d47b0SAlexander V. Chernikov { 16729f7d47b0SAlexander V. Chernikov struct table_info *ti; 16739f7d47b0SAlexander V. Chernikov 1674c8d5d308SAlexander V. Chernikov ti = KIDX_TO_TI(ch, tbl); 16759f7d47b0SAlexander V. Chernikov 16769f7d47b0SAlexander V. Chernikov return (ti->lookup(ti, paddr, plen, val)); 16779f7d47b0SAlexander V. Chernikov } 16789f7d47b0SAlexander V. Chernikov 16799f7d47b0SAlexander V. Chernikov /* 16809f7d47b0SAlexander V. Chernikov * Info/List/dump support for tables. 16819f7d47b0SAlexander V. Chernikov * 16829f7d47b0SAlexander V. Chernikov */ 16839f7d47b0SAlexander V. Chernikov 1684f1220db8SAlexander V. Chernikov /* 1685d3a4f924SAlexander V. Chernikov * High-level 'get' cmds sysctl handlers 1686d3a4f924SAlexander V. Chernikov */ 1687d3a4f924SAlexander V. Chernikov 1688d3a4f924SAlexander V. Chernikov /* 1689d3a4f924SAlexander V. Chernikov * Lists all tables currently available in kernel. 1690ac35ff17SAlexander V. Chernikov * Data layout (v0)(current): 1691d3a4f924SAlexander V. Chernikov * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size 1692d3a4f924SAlexander V. Chernikov * Reply: [ ipfw_obj_lheader ipfw_xtable_info x N ] 1693d3a4f924SAlexander V. Chernikov * 1694d3a4f924SAlexander V. Chernikov * Returns 0 on success 1695d3a4f924SAlexander V. Chernikov */ 16966b988f3aSAlexander V. Chernikov static int 16976b988f3aSAlexander V. Chernikov list_tables(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1698e822d936SAlexander V. Chernikov struct sockopt_data *sd) 1699f1220db8SAlexander V. Chernikov { 1700f1220db8SAlexander V. Chernikov struct _ipfw_obj_lheader *olh; 1701f1220db8SAlexander V. Chernikov int error; 1702f1220db8SAlexander V. Chernikov 17032d99a349SAlexander V. Chernikov olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh)); 17042d99a349SAlexander V. Chernikov if (olh == NULL) 1705d3a4f924SAlexander V. Chernikov return (EINVAL); 170668394ec8SAlexander V. Chernikov if (sd->valsize < olh->size) 170768394ec8SAlexander V. Chernikov return (EINVAL); 1708d3a4f924SAlexander V. Chernikov 1709f1220db8SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 17102d99a349SAlexander V. Chernikov error = export_tables(ch, olh, sd); 1711f1220db8SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 1712f1220db8SAlexander V. Chernikov 1713f1220db8SAlexander V. Chernikov return (error); 1714f1220db8SAlexander V. Chernikov } 1715f1220db8SAlexander V. Chernikov 1716f1220db8SAlexander V. Chernikov /* 17172d99a349SAlexander V. Chernikov * Store table info to buffer provided by @sd. 1718ac35ff17SAlexander V. Chernikov * Data layout (v0)(current): 1719d3a4f924SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_xtable_info(empty)] 1720d3a4f924SAlexander V. Chernikov * Reply: [ ipfw_obj_header ipfw_xtable_info ] 1721d3a4f924SAlexander V. Chernikov * 1722d3a4f924SAlexander V. Chernikov * Returns 0 on success. 1723d3a4f924SAlexander V. Chernikov */ 17246b988f3aSAlexander V. Chernikov static int 17256b988f3aSAlexander V. Chernikov describe_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1726e822d936SAlexander V. Chernikov struct sockopt_data *sd) 1727d3a4f924SAlexander V. Chernikov { 1728d3a4f924SAlexander V. Chernikov struct _ipfw_obj_header *oh; 1729d3a4f924SAlexander V. Chernikov struct table_config *tc; 1730d3a4f924SAlexander V. Chernikov struct tid_info ti; 1731d3a4f924SAlexander V. Chernikov size_t sz; 1732d3a4f924SAlexander V. Chernikov 1733d3a4f924SAlexander V. Chernikov sz = sizeof(*oh) + sizeof(ipfw_xtable_info); 17342d99a349SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 17352d99a349SAlexander V. Chernikov if (oh == NULL) 1736d3a4f924SAlexander V. Chernikov return (EINVAL); 1737d3a4f924SAlexander V. Chernikov 1738d3a4f924SAlexander V. Chernikov objheader_to_ti(oh, &ti); 1739d3a4f924SAlexander V. Chernikov 1740d3a4f924SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 1741d3a4f924SAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) { 1742d3a4f924SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 1743d3a4f924SAlexander V. Chernikov return (ESRCH); 1744d3a4f924SAlexander V. Chernikov } 1745d3a4f924SAlexander V. Chernikov 1746ac35ff17SAlexander V. Chernikov export_table_info(ch, tc, (ipfw_xtable_info *)(oh + 1)); 1747d3a4f924SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 1748d3a4f924SAlexander V. Chernikov 17492d99a349SAlexander V. Chernikov return (0); 1750d3a4f924SAlexander V. Chernikov } 1751d3a4f924SAlexander V. Chernikov 1752d3a4f924SAlexander V. Chernikov /* 1753adf3b2b9SAlexander V. Chernikov * Modifies existing table. 1754adf3b2b9SAlexander V. Chernikov * Data layout (v0)(current): 1755adf3b2b9SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_xtable_info ] 1756adf3b2b9SAlexander V. Chernikov * 1757adf3b2b9SAlexander V. Chernikov * Returns 0 on success 1758adf3b2b9SAlexander V. Chernikov */ 17596b988f3aSAlexander V. Chernikov static int 17606b988f3aSAlexander V. Chernikov modify_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1761adf3b2b9SAlexander V. Chernikov struct sockopt_data *sd) 1762adf3b2b9SAlexander V. Chernikov { 1763adf3b2b9SAlexander V. Chernikov struct _ipfw_obj_header *oh; 1764adf3b2b9SAlexander V. Chernikov ipfw_xtable_info *i; 1765adf3b2b9SAlexander V. Chernikov char *tname; 1766adf3b2b9SAlexander V. Chernikov struct tid_info ti; 1767adf3b2b9SAlexander V. Chernikov struct namedobj_instance *ni; 1768adf3b2b9SAlexander V. Chernikov struct table_config *tc; 1769adf3b2b9SAlexander V. Chernikov 1770adf3b2b9SAlexander V. Chernikov if (sd->valsize != sizeof(*oh) + sizeof(ipfw_xtable_info)) 1771adf3b2b9SAlexander V. Chernikov return (EINVAL); 1772adf3b2b9SAlexander V. Chernikov 1773adf3b2b9SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)sd->kbuf; 1774adf3b2b9SAlexander V. Chernikov i = (ipfw_xtable_info *)(oh + 1); 1775adf3b2b9SAlexander V. Chernikov 1776adf3b2b9SAlexander V. Chernikov /* 1777adf3b2b9SAlexander V. Chernikov * Verify user-supplied strings. 1778adf3b2b9SAlexander V. Chernikov * Check for null-terminated/zero-length strings/ 1779adf3b2b9SAlexander V. Chernikov */ 1780adf3b2b9SAlexander V. Chernikov tname = oh->ntlv.name; 1781f81431ccSAndrey V. Elsukov if (check_table_name(tname) != 0) 1782adf3b2b9SAlexander V. Chernikov return (EINVAL); 1783adf3b2b9SAlexander V. Chernikov 1784adf3b2b9SAlexander V. Chernikov objheader_to_ti(oh, &ti); 1785adf3b2b9SAlexander V. Chernikov ti.type = i->type; 1786adf3b2b9SAlexander V. Chernikov 1787adf3b2b9SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1788adf3b2b9SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1789adf3b2b9SAlexander V. Chernikov if ((tc = find_table(ni, &ti)) == NULL) { 1790adf3b2b9SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1791adf3b2b9SAlexander V. Chernikov return (ESRCH); 1792adf3b2b9SAlexander V. Chernikov } 1793fd0869d5SAlexander V. Chernikov 1794fd0869d5SAlexander V. Chernikov /* Do not support any modifications for readonly tables */ 1795fd0869d5SAlexander V. Chernikov if ((tc->ta->flags & TA_FLAG_READONLY) != 0) { 1796fd0869d5SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1797fd0869d5SAlexander V. Chernikov return (EACCES); 1798fd0869d5SAlexander V. Chernikov } 1799fd0869d5SAlexander V. Chernikov 1800adf3b2b9SAlexander V. Chernikov if ((i->mflags & IPFW_TMFLAGS_LIMIT) != 0) 1801adf3b2b9SAlexander V. Chernikov tc->limit = i->limit; 18024f43138aSAlexander V. Chernikov if ((i->mflags & IPFW_TMFLAGS_LOCK) != 0) 18034f43138aSAlexander V. Chernikov tc->locked = ((i->flags & IPFW_TGFLAGS_LOCKED) != 0); 1804adf3b2b9SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1805adf3b2b9SAlexander V. Chernikov 1806adf3b2b9SAlexander V. Chernikov return (0); 1807adf3b2b9SAlexander V. Chernikov } 1808adf3b2b9SAlexander V. Chernikov 1809adf3b2b9SAlexander V. Chernikov /* 18109490a627SAlexander V. Chernikov * Creates new table. 1811ac35ff17SAlexander V. Chernikov * Data layout (v0)(current): 18129490a627SAlexander V. Chernikov * Request: [ ipfw_obj_header ipfw_xtable_info ] 18139490a627SAlexander V. Chernikov * 18149490a627SAlexander V. Chernikov * Returns 0 on success 18159490a627SAlexander V. Chernikov */ 18166b988f3aSAlexander V. Chernikov static int 18176b988f3aSAlexander V. Chernikov create_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1818ac35ff17SAlexander V. Chernikov struct sockopt_data *sd) 18199490a627SAlexander V. Chernikov { 18209490a627SAlexander V. Chernikov struct _ipfw_obj_header *oh; 18219490a627SAlexander V. Chernikov ipfw_xtable_info *i; 18229490a627SAlexander V. Chernikov char *tname, *aname; 18239490a627SAlexander V. Chernikov struct tid_info ti; 18249490a627SAlexander V. Chernikov struct namedobj_instance *ni; 18259490a627SAlexander V. Chernikov 1826ac35ff17SAlexander V. Chernikov if (sd->valsize != sizeof(*oh) + sizeof(ipfw_xtable_info)) 18279490a627SAlexander V. Chernikov return (EINVAL); 18289490a627SAlexander V. Chernikov 1829ac35ff17SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)sd->kbuf; 18309490a627SAlexander V. Chernikov i = (ipfw_xtable_info *)(oh + 1); 18319490a627SAlexander V. Chernikov 18329490a627SAlexander V. Chernikov /* 18339490a627SAlexander V. Chernikov * Verify user-supplied strings. 18342d99a349SAlexander V. Chernikov * Check for null-terminated/zero-length strings/ 18359490a627SAlexander V. Chernikov */ 1836ac35ff17SAlexander V. Chernikov tname = oh->ntlv.name; 18379490a627SAlexander V. Chernikov aname = i->algoname; 1838f81431ccSAndrey V. Elsukov if (check_table_name(tname) != 0 || 18399490a627SAlexander V. Chernikov strnlen(aname, sizeof(i->algoname)) == sizeof(i->algoname)) 18409490a627SAlexander V. Chernikov return (EINVAL); 18419490a627SAlexander V. Chernikov 18429490a627SAlexander V. Chernikov if (aname[0] == '\0') { 18439490a627SAlexander V. Chernikov /* Use default algorithm */ 18449490a627SAlexander V. Chernikov aname = NULL; 18459490a627SAlexander V. Chernikov } 18469490a627SAlexander V. Chernikov 18479490a627SAlexander V. Chernikov objheader_to_ti(oh, &ti); 1848ac35ff17SAlexander V. Chernikov ti.type = i->type; 18499490a627SAlexander V. Chernikov 18509490a627SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 18519490a627SAlexander V. Chernikov 18529490a627SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 1853038263c3SAlexander V. Chernikov if (find_table(ni, &ti) != NULL) { 18549490a627SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 18559490a627SAlexander V. Chernikov return (EEXIST); 18569490a627SAlexander V. Chernikov } 18579490a627SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 18589490a627SAlexander V. Chernikov 1859867708f7SAlexander V. Chernikov return (create_table_internal(ch, &ti, aname, i, NULL, 0)); 1860db785d31SAlexander V. Chernikov } 1861db785d31SAlexander V. Chernikov 1862db785d31SAlexander V. Chernikov /* 1863db785d31SAlexander V. Chernikov * Creates new table based on @ti and @aname. 1864db785d31SAlexander V. Chernikov * 1865db785d31SAlexander V. Chernikov * Assume @aname to be checked and valid. 1866867708f7SAlexander V. Chernikov * Stores allocated table kidx inside @pkidx (if non-NULL). 18670468c5baSAlexander V. Chernikov * Reference created table if @compat is non-zero. 1868db785d31SAlexander V. Chernikov * 1869db785d31SAlexander V. Chernikov * Returns 0 on success. 1870db785d31SAlexander V. Chernikov */ 1871db785d31SAlexander V. Chernikov static int 1872db785d31SAlexander V. Chernikov create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti, 1873867708f7SAlexander V. Chernikov char *aname, ipfw_xtable_info *i, uint16_t *pkidx, int compat) 1874db785d31SAlexander V. Chernikov { 1875db785d31SAlexander V. Chernikov struct namedobj_instance *ni; 1876c8d5d308SAlexander V. Chernikov struct table_config *tc, *tc_new, *tmp; 1877db785d31SAlexander V. Chernikov struct table_algo *ta; 1878db785d31SAlexander V. Chernikov uint16_t kidx; 1879db785d31SAlexander V. Chernikov 1880db785d31SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1881db785d31SAlexander V. Chernikov 1882db785d31SAlexander V. Chernikov ta = find_table_algo(CHAIN_TO_TCFG(ch), ti, aname); 18839490a627SAlexander V. Chernikov if (ta == NULL) 18849490a627SAlexander V. Chernikov return (ENOTSUP); 18859490a627SAlexander V. Chernikov 18860cba2b28SAlexander V. Chernikov tc = alloc_table_config(ch, ti, ta, aname, i->tflags); 18874c0c07a5SAlexander V. Chernikov if (tc == NULL) 18889490a627SAlexander V. Chernikov return (ENOMEM); 18899490a627SAlexander V. Chernikov 18900cba2b28SAlexander V. Chernikov tc->vmask = i->vmask; 18914c0c07a5SAlexander V. Chernikov tc->limit = i->limit; 1892fd0869d5SAlexander V. Chernikov if (ta->flags & TA_FLAG_READONLY) 1893fd0869d5SAlexander V. Chernikov tc->locked = 1; 1894fd0869d5SAlexander V. Chernikov else 18954f43138aSAlexander V. Chernikov tc->locked = (i->flags & IPFW_TGFLAGS_LOCKED) != 0; 18964c0c07a5SAlexander V. Chernikov 18979490a627SAlexander V. Chernikov IPFW_UH_WLOCK(ch); 1898db785d31SAlexander V. Chernikov 1899db785d31SAlexander V. Chernikov /* Check if table has been already created */ 19000468c5baSAlexander V. Chernikov tc_new = find_table(ni, ti); 19010468c5baSAlexander V. Chernikov if (tc_new != NULL) { 19020468c5baSAlexander V. Chernikov /* 19030468c5baSAlexander V. Chernikov * Compat: do not fail if we're 19040468c5baSAlexander V. Chernikov * requesting to create existing table 19050cba2b28SAlexander V. Chernikov * which has the same type 19060468c5baSAlexander V. Chernikov */ 190774b22066SAlexander V. Chernikov if (compat == 0 || tc_new->no.subtype != tc->no.subtype) { 1908db785d31SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1909db785d31SAlexander V. Chernikov free_table_config(ni, tc); 1910db785d31SAlexander V. Chernikov return (EEXIST); 1911db785d31SAlexander V. Chernikov } 1912db785d31SAlexander V. Chernikov 19130468c5baSAlexander V. Chernikov /* Exchange tc and tc_new for proper refcounting & freeing */ 19140468c5baSAlexander V. Chernikov tmp = tc; 19150468c5baSAlexander V. Chernikov tc = tc_new; 19160468c5baSAlexander V. Chernikov tc_new = tmp; 19170468c5baSAlexander V. Chernikov } else { 19180468c5baSAlexander V. Chernikov /* New table */ 1919ac35ff17SAlexander V. Chernikov if (ipfw_objhash_alloc_idx(ni, &kidx) != 0) { 19209490a627SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 1921db785d31SAlexander V. Chernikov printf("Unable to allocate table index." 1922db785d31SAlexander V. Chernikov " Consider increasing net.inet.ip.fw.tables_max"); 19239490a627SAlexander V. Chernikov free_table_config(ni, tc); 19249490a627SAlexander V. Chernikov return (EBUSY); 19259490a627SAlexander V. Chernikov } 19269490a627SAlexander V. Chernikov tc->no.kidx = kidx; 192774b22066SAlexander V. Chernikov tc->no.etlv = IPFW_TLV_TBL_NAME; 19289490a627SAlexander V. Chernikov 19299490a627SAlexander V. Chernikov link_table(ch, tc); 19300468c5baSAlexander V. Chernikov } 19310468c5baSAlexander V. Chernikov 19320468c5baSAlexander V. Chernikov if (compat != 0) 19330468c5baSAlexander V. Chernikov tc->no.refcnt++; 19340468c5baSAlexander V. Chernikov if (pkidx != NULL) 19350468c5baSAlexander V. Chernikov *pkidx = tc->no.kidx; 19369490a627SAlexander V. Chernikov 19379490a627SAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 19389490a627SAlexander V. Chernikov 19390468c5baSAlexander V. Chernikov if (tc_new != NULL) 19400468c5baSAlexander V. Chernikov free_table_config(ni, tc_new); 19410468c5baSAlexander V. Chernikov 19429490a627SAlexander V. Chernikov return (0); 19439490a627SAlexander V. Chernikov } 19449490a627SAlexander V. Chernikov 194546d52008SAlexander V. Chernikov static void 194646d52008SAlexander V. Chernikov ntlv_to_ti(ipfw_obj_ntlv *ntlv, struct tid_info *ti) 1947d3a4f924SAlexander V. Chernikov { 1948d3a4f924SAlexander V. Chernikov 1949d3a4f924SAlexander V. Chernikov memset(ti, 0, sizeof(struct tid_info)); 195046d52008SAlexander V. Chernikov ti->set = ntlv->set; 195146d52008SAlexander V. Chernikov ti->uidx = ntlv->idx; 195246d52008SAlexander V. Chernikov ti->tlvs = ntlv; 195346d52008SAlexander V. Chernikov ti->tlen = ntlv->head.length; 195446d52008SAlexander V. Chernikov } 195546d52008SAlexander V. Chernikov 195646d52008SAlexander V. Chernikov static void 195746d52008SAlexander V. Chernikov objheader_to_ti(struct _ipfw_obj_header *oh, struct tid_info *ti) 195846d52008SAlexander V. Chernikov { 195946d52008SAlexander V. Chernikov 196046d52008SAlexander V. Chernikov ntlv_to_ti(&oh->ntlv, ti); 1961d3a4f924SAlexander V. Chernikov } 1962d3a4f924SAlexander V. Chernikov 196374b22066SAlexander V. Chernikov struct namedobj_instance * 196474b22066SAlexander V. Chernikov ipfw_get_table_objhash(struct ip_fw_chain *ch) 196574b22066SAlexander V. Chernikov { 196674b22066SAlexander V. Chernikov 196774b22066SAlexander V. Chernikov return (CHAIN_TO_NI(ch)); 196874b22066SAlexander V. Chernikov } 196974b22066SAlexander V. Chernikov 197035e1bbd0SAlexander V. Chernikov /* 197135e1bbd0SAlexander V. Chernikov * Exports basic table info as name TLV. 197235e1bbd0SAlexander V. Chernikov * Used inside dump_static_rules() to provide info 197335e1bbd0SAlexander V. Chernikov * about all tables referenced by current ruleset. 197435e1bbd0SAlexander V. Chernikov * 197535e1bbd0SAlexander V. Chernikov * Returns 0 on success. 197635e1bbd0SAlexander V. Chernikov */ 1977563b5ab1SAlexander V. Chernikov int 1978563b5ab1SAlexander V. Chernikov ipfw_export_table_ntlv(struct ip_fw_chain *ch, uint16_t kidx, 1979563b5ab1SAlexander V. Chernikov struct sockopt_data *sd) 1980563b5ab1SAlexander V. Chernikov { 1981563b5ab1SAlexander V. Chernikov struct namedobj_instance *ni; 1982563b5ab1SAlexander V. Chernikov struct named_object *no; 1983563b5ab1SAlexander V. Chernikov ipfw_obj_ntlv *ntlv; 1984563b5ab1SAlexander V. Chernikov 1985563b5ab1SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 1986563b5ab1SAlexander V. Chernikov 1987ac35ff17SAlexander V. Chernikov no = ipfw_objhash_lookup_kidx(ni, kidx); 1988563b5ab1SAlexander V. Chernikov KASSERT(no != NULL, ("invalid table kidx passed")); 1989563b5ab1SAlexander V. Chernikov 1990563b5ab1SAlexander V. Chernikov ntlv = (ipfw_obj_ntlv *)ipfw_get_sopt_space(sd, sizeof(*ntlv)); 1991563b5ab1SAlexander V. Chernikov if (ntlv == NULL) 1992563b5ab1SAlexander V. Chernikov return (ENOMEM); 1993563b5ab1SAlexander V. Chernikov 1994563b5ab1SAlexander V. Chernikov ntlv->head.type = IPFW_TLV_TBL_NAME; 1995563b5ab1SAlexander V. Chernikov ntlv->head.length = sizeof(*ntlv); 1996563b5ab1SAlexander V. Chernikov ntlv->idx = no->kidx; 1997563b5ab1SAlexander V. Chernikov strlcpy(ntlv->name, no->name, sizeof(ntlv->name)); 1998563b5ab1SAlexander V. Chernikov 1999563b5ab1SAlexander V. Chernikov return (0); 2000563b5ab1SAlexander V. Chernikov } 2001563b5ab1SAlexander V. Chernikov 2002d3b00c08SAlexander V. Chernikov struct dump_args { 20030cba2b28SAlexander V. Chernikov struct ip_fw_chain *ch; 2004d3b00c08SAlexander V. Chernikov struct table_info *ti; 2005d3b00c08SAlexander V. Chernikov struct table_config *tc; 2006d3b00c08SAlexander V. Chernikov struct sockopt_data *sd; 2007d3b00c08SAlexander V. Chernikov uint32_t cnt; 2008d3b00c08SAlexander V. Chernikov uint16_t uidx; 2009d3b00c08SAlexander V. Chernikov int error; 2010d3b00c08SAlexander V. Chernikov uint32_t size; 20114dff4ae0SAlexander V. Chernikov ipfw_table_entry *ent; 20124dff4ae0SAlexander V. Chernikov ta_foreach_f *f; 20134dff4ae0SAlexander V. Chernikov void *farg; 2014d3b00c08SAlexander V. Chernikov ipfw_obj_tentry tent; 2015d3b00c08SAlexander V. Chernikov }; 2016d3b00c08SAlexander V. Chernikov 2017d3b00c08SAlexander V. Chernikov static int 2018d3b00c08SAlexander V. Chernikov count_ext_entries(void *e, void *arg) 2019d3b00c08SAlexander V. Chernikov { 2020d3b00c08SAlexander V. Chernikov struct dump_args *da; 2021d3b00c08SAlexander V. Chernikov 2022d3b00c08SAlexander V. Chernikov da = (struct dump_args *)arg; 2023d3b00c08SAlexander V. Chernikov da->cnt++; 2024d3b00c08SAlexander V. Chernikov 2025d3b00c08SAlexander V. Chernikov return (0); 2026d3b00c08SAlexander V. Chernikov } 2027d3b00c08SAlexander V. Chernikov 2028d3b00c08SAlexander V. Chernikov /* 2029d3b00c08SAlexander V. Chernikov * Gets number of items from table either using 2030d3b00c08SAlexander V. Chernikov * internal counter or calling algo callback for 2031d3b00c08SAlexander V. Chernikov * externally-managed tables. 2032d3b00c08SAlexander V. Chernikov * 2033d3b00c08SAlexander V. Chernikov * Returns number of records. 2034d3b00c08SAlexander V. Chernikov */ 2035d3b00c08SAlexander V. Chernikov static uint32_t 2036d3b00c08SAlexander V. Chernikov table_get_count(struct ip_fw_chain *ch, struct table_config *tc) 2037d3b00c08SAlexander V. Chernikov { 2038d3b00c08SAlexander V. Chernikov struct table_info *ti; 2039d3b00c08SAlexander V. Chernikov struct table_algo *ta; 2040d3b00c08SAlexander V. Chernikov struct dump_args da; 2041d3b00c08SAlexander V. Chernikov 2042d3b00c08SAlexander V. Chernikov ti = KIDX_TO_TI(ch, tc->no.kidx); 2043d3b00c08SAlexander V. Chernikov ta = tc->ta; 2044d3b00c08SAlexander V. Chernikov 2045d3b00c08SAlexander V. Chernikov /* Use internal counter for self-managed tables */ 2046d3b00c08SAlexander V. Chernikov if ((ta->flags & TA_FLAG_READONLY) == 0) 2047d3b00c08SAlexander V. Chernikov return (tc->count); 2048d3b00c08SAlexander V. Chernikov 2049d3b00c08SAlexander V. Chernikov /* Use callback to quickly get number of items */ 2050d3b00c08SAlexander V. Chernikov if ((ta->flags & TA_FLAG_EXTCOUNTER) != 0) 2051d3b00c08SAlexander V. Chernikov return (ta->get_count(tc->astate, ti)); 2052d3b00c08SAlexander V. Chernikov 2053d3b00c08SAlexander V. Chernikov /* Count number of iterms ourselves */ 2054d3b00c08SAlexander V. Chernikov memset(&da, 0, sizeof(da)); 2055d3b00c08SAlexander V. Chernikov ta->foreach(tc->astate, ti, count_ext_entries, &da); 2056d3b00c08SAlexander V. Chernikov 2057d3b00c08SAlexander V. Chernikov return (da.cnt); 2058d3b00c08SAlexander V. Chernikov } 2059f99fbf96SAlexander V. Chernikov 2060f99fbf96SAlexander V. Chernikov /* 206135e1bbd0SAlexander V. Chernikov * Exports table @tc info into standard ipfw_xtable_info format. 206235e1bbd0SAlexander V. Chernikov */ 20639f7d47b0SAlexander V. Chernikov static void 2064ac35ff17SAlexander V. Chernikov export_table_info(struct ip_fw_chain *ch, struct table_config *tc, 2065ac35ff17SAlexander V. Chernikov ipfw_xtable_info *i) 20669f7d47b0SAlexander V. Chernikov { 2067ac35ff17SAlexander V. Chernikov struct table_info *ti; 20685f379342SAlexander V. Chernikov struct table_algo *ta; 20699f7d47b0SAlexander V. Chernikov 207074b22066SAlexander V. Chernikov i->type = tc->no.subtype; 2071914bffb6SAlexander V. Chernikov i->tflags = tc->tflags; 20720cba2b28SAlexander V. Chernikov i->vmask = tc->vmask; 20739f7d47b0SAlexander V. Chernikov i->set = tc->no.set; 20749f7d47b0SAlexander V. Chernikov i->kidx = tc->no.kidx; 20759f7d47b0SAlexander V. Chernikov i->refcnt = tc->no.refcnt; 2076d3b00c08SAlexander V. Chernikov i->count = table_get_count(ch, tc); 20774c0c07a5SAlexander V. Chernikov i->limit = tc->limit; 20784f43138aSAlexander V. Chernikov i->flags |= (tc->locked != 0) ? IPFW_TGFLAGS_LOCKED : 0; 207936738284SAlexander V. Chernikov i->size = i->count * sizeof(ipfw_obj_tentry); 2080f1220db8SAlexander V. Chernikov i->size += sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info); 20819f7d47b0SAlexander V. Chernikov strlcpy(i->tablename, tc->tablename, sizeof(i->tablename)); 2082ac35ff17SAlexander V. Chernikov ti = KIDX_TO_TI(ch, tc->no.kidx); 20835f379342SAlexander V. Chernikov ta = tc->ta; 20845f379342SAlexander V. Chernikov if (ta->print_config != NULL) { 20855f379342SAlexander V. Chernikov /* Use algo function to print table config to string */ 20865f379342SAlexander V. Chernikov ta->print_config(tc->astate, ti, i->algoname, 2087ac35ff17SAlexander V. Chernikov sizeof(i->algoname)); 2088ac35ff17SAlexander V. Chernikov } else 20895f379342SAlexander V. Chernikov strlcpy(i->algoname, ta->name, sizeof(i->algoname)); 20905f379342SAlexander V. Chernikov /* Dump algo-specific data, if possible */ 20915f379342SAlexander V. Chernikov if (ta->dump_tinfo != NULL) { 20925f379342SAlexander V. Chernikov ta->dump_tinfo(tc->astate, ti, &i->ta_info); 20935f379342SAlexander V. Chernikov i->ta_info.flags |= IPFW_TATFLAGS_DATA; 20945f379342SAlexander V. Chernikov } 20959f7d47b0SAlexander V. Chernikov } 20969f7d47b0SAlexander V. Chernikov 2097ac35ff17SAlexander V. Chernikov struct dump_table_args { 2098ac35ff17SAlexander V. Chernikov struct ip_fw_chain *ch; 2099ac35ff17SAlexander V. Chernikov struct sockopt_data *sd; 2100ac35ff17SAlexander V. Chernikov }; 2101ac35ff17SAlexander V. Chernikov 2102b309f085SAndrey V. Elsukov static int 21039f7d47b0SAlexander V. Chernikov export_table_internal(struct namedobj_instance *ni, struct named_object *no, 21049f7d47b0SAlexander V. Chernikov void *arg) 21053b3a8eb9SGleb Smirnoff { 21069f7d47b0SAlexander V. Chernikov ipfw_xtable_info *i; 2107ac35ff17SAlexander V. Chernikov struct dump_table_args *dta; 21083b3a8eb9SGleb Smirnoff 2109ac35ff17SAlexander V. Chernikov dta = (struct dump_table_args *)arg; 2110ac35ff17SAlexander V. Chernikov 2111ac35ff17SAlexander V. Chernikov i = (ipfw_xtable_info *)ipfw_get_sopt_space(dta->sd, sizeof(*i)); 21127a6ab8f1SPedro F. Giffuni KASSERT(i != NULL, ("previously checked buffer is not enough")); 21139f7d47b0SAlexander V. Chernikov 2114ac35ff17SAlexander V. Chernikov export_table_info(dta->ch, (struct table_config *)no, i); 2115b309f085SAndrey V. Elsukov return (0); 21169f7d47b0SAlexander V. Chernikov } 21179f7d47b0SAlexander V. Chernikov 2118f1220db8SAlexander V. Chernikov /* 2119f1220db8SAlexander V. Chernikov * Export all tables as ipfw_xtable_info structures to 21202d99a349SAlexander V. Chernikov * storage provided by @sd. 212128ea4fa3SAlexander V. Chernikov * 212228ea4fa3SAlexander V. Chernikov * If supplied buffer is too small, fills in required size 212328ea4fa3SAlexander V. Chernikov * and returns ENOMEM. 2124f1220db8SAlexander V. Chernikov * Returns 0 on success. 2125f1220db8SAlexander V. Chernikov */ 2126f1220db8SAlexander V. Chernikov static int 21272d99a349SAlexander V. Chernikov export_tables(struct ip_fw_chain *ch, ipfw_obj_lheader *olh, 21282d99a349SAlexander V. Chernikov struct sockopt_data *sd) 21299f7d47b0SAlexander V. Chernikov { 21309f7d47b0SAlexander V. Chernikov uint32_t size; 21319f7d47b0SAlexander V. Chernikov uint32_t count; 2132ac35ff17SAlexander V. Chernikov struct dump_table_args dta; 21339f7d47b0SAlexander V. Chernikov 21349f7d47b0SAlexander V. Chernikov count = ipfw_objhash_count(CHAIN_TO_NI(ch)); 21359f7d47b0SAlexander V. Chernikov size = count * sizeof(ipfw_xtable_info) + sizeof(ipfw_obj_lheader); 21362d99a349SAlexander V. Chernikov 21372d99a349SAlexander V. Chernikov /* Fill in header regadless of buffer size */ 2138f1220db8SAlexander V. Chernikov olh->count = count; 2139f1220db8SAlexander V. Chernikov olh->objsize = sizeof(ipfw_xtable_info); 21402d99a349SAlexander V. Chernikov 21412d99a349SAlexander V. Chernikov if (size > olh->size) { 21422d99a349SAlexander V. Chernikov olh->size = size; 21439f7d47b0SAlexander V. Chernikov return (ENOMEM); 2144f1220db8SAlexander V. Chernikov } 214568394ec8SAlexander V. Chernikov 21469f7d47b0SAlexander V. Chernikov olh->size = size; 21472d99a349SAlexander V. Chernikov 2148ac35ff17SAlexander V. Chernikov dta.ch = ch; 2149ac35ff17SAlexander V. Chernikov dta.sd = sd; 2150ac35ff17SAlexander V. Chernikov 2151ac35ff17SAlexander V. Chernikov ipfw_objhash_foreach(CHAIN_TO_NI(ch), export_table_internal, &dta); 21529f7d47b0SAlexander V. Chernikov 21533b3a8eb9SGleb Smirnoff return (0); 21543b3a8eb9SGleb Smirnoff } 21553b3a8eb9SGleb Smirnoff 2156f99fbf96SAlexander V. Chernikov /* 2157f99fbf96SAlexander V. Chernikov * Dumps all table data 2158f99fbf96SAlexander V. Chernikov * Data layout (v1)(current): 2159f99fbf96SAlexander V. Chernikov * Request: [ ipfw_obj_header ], size = ipfw_xtable_info.size 2160f99fbf96SAlexander V. Chernikov * Reply: [ ipfw_obj_header ipfw_xtable_info ipfw_obj_tentry x N ] 2161f99fbf96SAlexander V. Chernikov * 2162f99fbf96SAlexander V. Chernikov * Returns 0 on success 2163f99fbf96SAlexander V. Chernikov */ 2164f99fbf96SAlexander V. Chernikov static int 21656b988f3aSAlexander V. Chernikov dump_table_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 21666b988f3aSAlexander V. Chernikov struct sockopt_data *sd) 2167f99fbf96SAlexander V. Chernikov { 2168f99fbf96SAlexander V. Chernikov struct _ipfw_obj_header *oh; 2169f99fbf96SAlexander V. Chernikov ipfw_xtable_info *i; 2170f99fbf96SAlexander V. Chernikov struct tid_info ti; 2171f99fbf96SAlexander V. Chernikov struct table_config *tc; 2172f99fbf96SAlexander V. Chernikov struct table_algo *ta; 2173f99fbf96SAlexander V. Chernikov struct dump_args da; 2174f99fbf96SAlexander V. Chernikov uint32_t sz; 2175f99fbf96SAlexander V. Chernikov 2176f99fbf96SAlexander V. Chernikov sz = sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info); 2177f99fbf96SAlexander V. Chernikov oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 2178f99fbf96SAlexander V. Chernikov if (oh == NULL) 2179f99fbf96SAlexander V. Chernikov return (EINVAL); 2180f99fbf96SAlexander V. Chernikov 2181f99fbf96SAlexander V. Chernikov i = (ipfw_xtable_info *)(oh + 1); 2182f99fbf96SAlexander V. Chernikov objheader_to_ti(oh, &ti); 2183f99fbf96SAlexander V. Chernikov 2184f99fbf96SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 2185f99fbf96SAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) { 2186f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2187f99fbf96SAlexander V. Chernikov return (ESRCH); 2188f99fbf96SAlexander V. Chernikov } 2189f99fbf96SAlexander V. Chernikov export_table_info(ch, tc, i); 2190f99fbf96SAlexander V. Chernikov 2191f99fbf96SAlexander V. Chernikov if (sd->valsize < i->size) { 2192f99fbf96SAlexander V. Chernikov /* 2193f99fbf96SAlexander V. Chernikov * Submitted buffer size is not enough. 2194f99fbf96SAlexander V. Chernikov * WE've already filled in @i structure with 2195f99fbf96SAlexander V. Chernikov * relevant table info including size, so we 2196f99fbf96SAlexander V. Chernikov * can return. Buffer will be flushed automatically. 2197f99fbf96SAlexander V. Chernikov */ 2198f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2199f99fbf96SAlexander V. Chernikov return (ENOMEM); 2200f99fbf96SAlexander V. Chernikov } 2201f99fbf96SAlexander V. Chernikov 2202f99fbf96SAlexander V. Chernikov /* 2203f99fbf96SAlexander V. Chernikov * Do the actual dump in eXtended format 2204f99fbf96SAlexander V. Chernikov */ 2205f99fbf96SAlexander V. Chernikov memset(&da, 0, sizeof(da)); 22060cba2b28SAlexander V. Chernikov da.ch = ch; 2207f99fbf96SAlexander V. Chernikov da.ti = KIDX_TO_TI(ch, tc->no.kidx); 2208f99fbf96SAlexander V. Chernikov da.tc = tc; 2209f99fbf96SAlexander V. Chernikov da.sd = sd; 2210f99fbf96SAlexander V. Chernikov 2211f99fbf96SAlexander V. Chernikov ta = tc->ta; 2212f99fbf96SAlexander V. Chernikov 2213f99fbf96SAlexander V. Chernikov ta->foreach(tc->astate, da.ti, dump_table_tentry, &da); 2214f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2215f99fbf96SAlexander V. Chernikov 2216f99fbf96SAlexander V. Chernikov return (da.error); 2217f99fbf96SAlexander V. Chernikov } 2218f99fbf96SAlexander V. Chernikov 2219f99fbf96SAlexander V. Chernikov /* 2220f99fbf96SAlexander V. Chernikov * Dumps all table data 2221f99fbf96SAlexander V. Chernikov * Data layout (version 0)(legacy): 2222f99fbf96SAlexander V. Chernikov * Request: [ ipfw_xtable ], size = IP_FW_TABLE_XGETSIZE() 2223f99fbf96SAlexander V. Chernikov * Reply: [ ipfw_xtable ipfw_table_xentry x N ] 2224f99fbf96SAlexander V. Chernikov * 2225f99fbf96SAlexander V. Chernikov * Returns 0 on success 2226f99fbf96SAlexander V. Chernikov */ 2227f99fbf96SAlexander V. Chernikov static int 22286b988f3aSAlexander V. Chernikov dump_table_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 22296b988f3aSAlexander V. Chernikov struct sockopt_data *sd) 2230f99fbf96SAlexander V. Chernikov { 2231f99fbf96SAlexander V. Chernikov ipfw_xtable *xtbl; 2232f99fbf96SAlexander V. Chernikov struct tid_info ti; 2233f99fbf96SAlexander V. Chernikov struct table_config *tc; 2234f99fbf96SAlexander V. Chernikov struct table_algo *ta; 2235f99fbf96SAlexander V. Chernikov struct dump_args da; 2236d3b00c08SAlexander V. Chernikov size_t sz, count; 2237f99fbf96SAlexander V. Chernikov 2238f99fbf96SAlexander V. Chernikov xtbl = (ipfw_xtable *)ipfw_get_sopt_header(sd, sizeof(ipfw_xtable)); 2239f99fbf96SAlexander V. Chernikov if (xtbl == NULL) 2240f99fbf96SAlexander V. Chernikov return (EINVAL); 2241f99fbf96SAlexander V. Chernikov 2242f99fbf96SAlexander V. Chernikov memset(&ti, 0, sizeof(ti)); 2243f99fbf96SAlexander V. Chernikov ti.uidx = xtbl->tbl; 2244f99fbf96SAlexander V. Chernikov 2245f99fbf96SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 2246f99fbf96SAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) { 2247f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2248f99fbf96SAlexander V. Chernikov return (0); 2249f99fbf96SAlexander V. Chernikov } 2250d3b00c08SAlexander V. Chernikov count = table_get_count(ch, tc); 2251d3b00c08SAlexander V. Chernikov sz = count * sizeof(ipfw_table_xentry) + sizeof(ipfw_xtable); 2252f99fbf96SAlexander V. Chernikov 2253d3b00c08SAlexander V. Chernikov xtbl->cnt = count; 2254f99fbf96SAlexander V. Chernikov xtbl->size = sz; 225574b22066SAlexander V. Chernikov xtbl->type = tc->no.subtype; 2256f99fbf96SAlexander V. Chernikov xtbl->tbl = ti.uidx; 2257f99fbf96SAlexander V. Chernikov 2258f99fbf96SAlexander V. Chernikov if (sd->valsize < sz) { 2259f99fbf96SAlexander V. Chernikov /* 2260f99fbf96SAlexander V. Chernikov * Submitted buffer size is not enough. 2261f99fbf96SAlexander V. Chernikov * WE've already filled in @i structure with 2262f99fbf96SAlexander V. Chernikov * relevant table info including size, so we 2263f99fbf96SAlexander V. Chernikov * can return. Buffer will be flushed automatically. 2264f99fbf96SAlexander V. Chernikov */ 2265f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2266f99fbf96SAlexander V. Chernikov return (ENOMEM); 2267f99fbf96SAlexander V. Chernikov } 2268f99fbf96SAlexander V. Chernikov 2269f99fbf96SAlexander V. Chernikov /* Do the actual dump in eXtended format */ 2270f99fbf96SAlexander V. Chernikov memset(&da, 0, sizeof(da)); 22710cba2b28SAlexander V. Chernikov da.ch = ch; 2272f99fbf96SAlexander V. Chernikov da.ti = KIDX_TO_TI(ch, tc->no.kidx); 2273f99fbf96SAlexander V. Chernikov da.tc = tc; 2274f99fbf96SAlexander V. Chernikov da.sd = sd; 2275f99fbf96SAlexander V. Chernikov 2276f99fbf96SAlexander V. Chernikov ta = tc->ta; 2277f99fbf96SAlexander V. Chernikov 2278f99fbf96SAlexander V. Chernikov ta->foreach(tc->astate, da.ti, dump_table_xentry, &da); 2279f99fbf96SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2280f99fbf96SAlexander V. Chernikov 2281f99fbf96SAlexander V. Chernikov return (0); 2282f99fbf96SAlexander V. Chernikov } 2283f99fbf96SAlexander V. Chernikov 228481d3153dSAlexander V. Chernikov /* 2285e822d936SAlexander V. Chernikov * Legacy function to retrieve number of items in table. 2286e822d936SAlexander V. Chernikov */ 22876b988f3aSAlexander V. Chernikov static int 22886b988f3aSAlexander V. Chernikov get_table_size(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 2289e822d936SAlexander V. Chernikov struct sockopt_data *sd) 2290e822d936SAlexander V. Chernikov { 2291e822d936SAlexander V. Chernikov uint32_t *tbl; 2292e822d936SAlexander V. Chernikov struct tid_info ti; 2293e822d936SAlexander V. Chernikov size_t sz; 2294e822d936SAlexander V. Chernikov int error; 2295e822d936SAlexander V. Chernikov 2296e822d936SAlexander V. Chernikov sz = sizeof(*op3) + sizeof(uint32_t); 2297e822d936SAlexander V. Chernikov op3 = (ip_fw3_opheader *)ipfw_get_sopt_header(sd, sz); 2298e822d936SAlexander V. Chernikov if (op3 == NULL) 2299e822d936SAlexander V. Chernikov return (EINVAL); 2300e822d936SAlexander V. Chernikov 2301e822d936SAlexander V. Chernikov tbl = (uint32_t *)(op3 + 1); 2302e822d936SAlexander V. Chernikov memset(&ti, 0, sizeof(ti)); 2303e822d936SAlexander V. Chernikov ti.uidx = *tbl; 2304e822d936SAlexander V. Chernikov IPFW_UH_RLOCK(ch); 2305e822d936SAlexander V. Chernikov error = ipfw_count_xtable(ch, &ti, tbl); 2306e822d936SAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 2307e822d936SAlexander V. Chernikov return (error); 2308e822d936SAlexander V. Chernikov } 2309e822d936SAlexander V. Chernikov 2310e822d936SAlexander V. Chernikov /* 231181d3153dSAlexander V. Chernikov * Legacy IP_FW_TABLE_GETSIZE handler 231281d3153dSAlexander V. Chernikov */ 23133b3a8eb9SGleb Smirnoff int 2314b074b7bbSAlexander V. Chernikov ipfw_count_table(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt) 23153b3a8eb9SGleb Smirnoff { 2316b074b7bbSAlexander V. Chernikov struct table_config *tc; 23173b3a8eb9SGleb Smirnoff 2318b074b7bbSAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) 2319b074b7bbSAlexander V. Chernikov return (ESRCH); 2320d3b00c08SAlexander V. Chernikov *cnt = table_get_count(ch, tc); 23213b3a8eb9SGleb Smirnoff return (0); 23223b3a8eb9SGleb Smirnoff } 23233b3a8eb9SGleb Smirnoff 232481d3153dSAlexander V. Chernikov /* 232581d3153dSAlexander V. Chernikov * Legacy IP_FW_TABLE_XGETSIZE handler 232681d3153dSAlexander V. Chernikov */ 23279f7d47b0SAlexander V. Chernikov int 23289f7d47b0SAlexander V. Chernikov ipfw_count_xtable(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt) 23293b3a8eb9SGleb Smirnoff { 23309f7d47b0SAlexander V. Chernikov struct table_config *tc; 2331d3b00c08SAlexander V. Chernikov uint32_t count; 23329f7d47b0SAlexander V. Chernikov 2333d3a4f924SAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) { 2334d3a4f924SAlexander V. Chernikov *cnt = 0; 23359f7d47b0SAlexander V. Chernikov return (0); /* 'table all list' requires success */ 2336d3a4f924SAlexander V. Chernikov } 2337d3b00c08SAlexander V. Chernikov 2338d3b00c08SAlexander V. Chernikov count = table_get_count(ch, tc); 2339d3b00c08SAlexander V. Chernikov *cnt = count * sizeof(ipfw_table_xentry); 2340d3b00c08SAlexander V. Chernikov if (count > 0) 23419f7d47b0SAlexander V. Chernikov *cnt += sizeof(ipfw_xtable); 23429f7d47b0SAlexander V. Chernikov return (0); 23439f7d47b0SAlexander V. Chernikov } 23449f7d47b0SAlexander V. Chernikov 23459f7d47b0SAlexander V. Chernikov static int 23469f7d47b0SAlexander V. Chernikov dump_table_entry(void *e, void *arg) 23479f7d47b0SAlexander V. Chernikov { 23489f7d47b0SAlexander V. Chernikov struct dump_args *da; 23499f7d47b0SAlexander V. Chernikov struct table_config *tc; 23509f7d47b0SAlexander V. Chernikov struct table_algo *ta; 23513b3a8eb9SGleb Smirnoff ipfw_table_entry *ent; 23520cba2b28SAlexander V. Chernikov struct table_value *pval; 235381d3153dSAlexander V. Chernikov int error; 23543b3a8eb9SGleb Smirnoff 23559f7d47b0SAlexander V. Chernikov da = (struct dump_args *)arg; 23569f7d47b0SAlexander V. Chernikov 23579f7d47b0SAlexander V. Chernikov tc = da->tc; 23589f7d47b0SAlexander V. Chernikov ta = tc->ta; 23599f7d47b0SAlexander V. Chernikov 23609f7d47b0SAlexander V. Chernikov /* Out of memory, returning */ 2361f1220db8SAlexander V. Chernikov if (da->cnt == da->size) 23623b3a8eb9SGleb Smirnoff return (1); 2363f1220db8SAlexander V. Chernikov ent = da->ent++; 2364f1220db8SAlexander V. Chernikov ent->tbl = da->uidx; 2365f1220db8SAlexander V. Chernikov da->cnt++; 23669f7d47b0SAlexander V. Chernikov 236781d3153dSAlexander V. Chernikov error = ta->dump_tentry(tc->astate, da->ti, e, &da->tent); 236881d3153dSAlexander V. Chernikov if (error != 0) 236981d3153dSAlexander V. Chernikov return (error); 237081d3153dSAlexander V. Chernikov 237181d3153dSAlexander V. Chernikov ent->addr = da->tent.k.addr.s_addr; 237281d3153dSAlexander V. Chernikov ent->masklen = da->tent.masklen; 23730cba2b28SAlexander V. Chernikov pval = get_table_value(da->ch, da->tc, da->tent.v.kidx); 23740cba2b28SAlexander V. Chernikov ent->value = ipfw_export_table_value_legacy(pval); 237581d3153dSAlexander V. Chernikov 237681d3153dSAlexander V. Chernikov return (0); 23773b3a8eb9SGleb Smirnoff } 23783b3a8eb9SGleb Smirnoff 2379f1220db8SAlexander V. Chernikov /* 2380f1220db8SAlexander V. Chernikov * Dumps table in pre-8.1 legacy format. 2381f1220db8SAlexander V. Chernikov */ 23823b3a8eb9SGleb Smirnoff int 2383f1220db8SAlexander V. Chernikov ipfw_dump_table_legacy(struct ip_fw_chain *ch, struct tid_info *ti, 2384f1220db8SAlexander V. Chernikov ipfw_table *tbl) 23853b3a8eb9SGleb Smirnoff { 2386b074b7bbSAlexander V. Chernikov struct table_config *tc; 23879f7d47b0SAlexander V. Chernikov struct table_algo *ta; 23889f7d47b0SAlexander V. Chernikov struct dump_args da; 23893b3a8eb9SGleb Smirnoff 23903b3a8eb9SGleb Smirnoff tbl->cnt = 0; 23913b3a8eb9SGleb Smirnoff 2392b074b7bbSAlexander V. Chernikov if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) 2393b074b7bbSAlexander V. Chernikov return (0); /* XXX: We should return ESRCH */ 23949f7d47b0SAlexander V. Chernikov 23959f7d47b0SAlexander V. Chernikov ta = tc->ta; 23969f7d47b0SAlexander V. Chernikov 239781d3153dSAlexander V. Chernikov /* This dump format supports IPv4 only */ 239874b22066SAlexander V. Chernikov if (tc->no.subtype != IPFW_TABLE_ADDR) 239981d3153dSAlexander V. Chernikov return (0); 24009f7d47b0SAlexander V. Chernikov 2401d3a4f924SAlexander V. Chernikov memset(&da, 0, sizeof(da)); 24020cba2b28SAlexander V. Chernikov da.ch = ch; 24039f7d47b0SAlexander V. Chernikov da.ti = KIDX_TO_TI(ch, tc->no.kidx); 24049f7d47b0SAlexander V. Chernikov da.tc = tc; 2405f1220db8SAlexander V. Chernikov da.ent = &tbl->ent[0]; 2406f1220db8SAlexander V. Chernikov da.size = tbl->size; 24079f7d47b0SAlexander V. Chernikov 24089f7d47b0SAlexander V. Chernikov tbl->cnt = 0; 24099f7d47b0SAlexander V. Chernikov ta->foreach(tc->astate, da.ti, dump_table_entry, &da); 2410f1220db8SAlexander V. Chernikov tbl->cnt = da.cnt; 24119f7d47b0SAlexander V. Chernikov 24123b3a8eb9SGleb Smirnoff return (0); 24133b3a8eb9SGleb Smirnoff } 24143b3a8eb9SGleb Smirnoff 24159490a627SAlexander V. Chernikov /* 241681d3153dSAlexander V. Chernikov * Dumps table entry in eXtended format (v1)(current). 241781d3153dSAlexander V. Chernikov */ 241881d3153dSAlexander V. Chernikov static int 241981d3153dSAlexander V. Chernikov dump_table_tentry(void *e, void *arg) 242081d3153dSAlexander V. Chernikov { 242181d3153dSAlexander V. Chernikov struct dump_args *da; 242281d3153dSAlexander V. Chernikov struct table_config *tc; 242381d3153dSAlexander V. Chernikov struct table_algo *ta; 24240cba2b28SAlexander V. Chernikov struct table_value *pval; 242581d3153dSAlexander V. Chernikov ipfw_obj_tentry *tent; 24260cba2b28SAlexander V. Chernikov int error; 242781d3153dSAlexander V. Chernikov 242881d3153dSAlexander V. Chernikov da = (struct dump_args *)arg; 242981d3153dSAlexander V. Chernikov 243081d3153dSAlexander V. Chernikov tc = da->tc; 243181d3153dSAlexander V. Chernikov ta = tc->ta; 243281d3153dSAlexander V. Chernikov 243381d3153dSAlexander V. Chernikov tent = (ipfw_obj_tentry *)ipfw_get_sopt_space(da->sd, sizeof(*tent)); 243481d3153dSAlexander V. Chernikov /* Out of memory, returning */ 243581d3153dSAlexander V. Chernikov if (tent == NULL) { 243681d3153dSAlexander V. Chernikov da->error = ENOMEM; 243781d3153dSAlexander V. Chernikov return (1); 243881d3153dSAlexander V. Chernikov } 243981d3153dSAlexander V. Chernikov tent->head.length = sizeof(ipfw_obj_tentry); 244081d3153dSAlexander V. Chernikov tent->idx = da->uidx; 244181d3153dSAlexander V. Chernikov 24420cba2b28SAlexander V. Chernikov error = ta->dump_tentry(tc->astate, da->ti, e, tent); 24430cba2b28SAlexander V. Chernikov if (error != 0) 24440cba2b28SAlexander V. Chernikov return (error); 24450cba2b28SAlexander V. Chernikov 24460cba2b28SAlexander V. Chernikov pval = get_table_value(da->ch, da->tc, tent->v.kidx); 24470cba2b28SAlexander V. Chernikov ipfw_export_table_value_v1(pval, &tent->v.value); 24480cba2b28SAlexander V. Chernikov 24490cba2b28SAlexander V. Chernikov return (0); 245081d3153dSAlexander V. Chernikov } 245181d3153dSAlexander V. Chernikov 245281d3153dSAlexander V. Chernikov /* 245381d3153dSAlexander V. Chernikov * Dumps table entry in eXtended format (v0). 24549490a627SAlexander V. Chernikov */ 24553b3a8eb9SGleb Smirnoff static int 24569f7d47b0SAlexander V. Chernikov dump_table_xentry(void *e, void *arg) 24573b3a8eb9SGleb Smirnoff { 24589f7d47b0SAlexander V. Chernikov struct dump_args *da; 24599f7d47b0SAlexander V. Chernikov struct table_config *tc; 24609f7d47b0SAlexander V. Chernikov struct table_algo *ta; 24613b3a8eb9SGleb Smirnoff ipfw_table_xentry *xent; 246281d3153dSAlexander V. Chernikov ipfw_obj_tentry *tent; 24630cba2b28SAlexander V. Chernikov struct table_value *pval; 246481d3153dSAlexander V. Chernikov int error; 24653b3a8eb9SGleb Smirnoff 24669f7d47b0SAlexander V. Chernikov da = (struct dump_args *)arg; 24679f7d47b0SAlexander V. Chernikov 24689f7d47b0SAlexander V. Chernikov tc = da->tc; 24699f7d47b0SAlexander V. Chernikov ta = tc->ta; 24709f7d47b0SAlexander V. Chernikov 24712d99a349SAlexander V. Chernikov xent = (ipfw_table_xentry *)ipfw_get_sopt_space(da->sd, sizeof(*xent)); 24723b3a8eb9SGleb Smirnoff /* Out of memory, returning */ 24732d99a349SAlexander V. Chernikov if (xent == NULL) 24743b3a8eb9SGleb Smirnoff return (1); 24753b3a8eb9SGleb Smirnoff xent->len = sizeof(ipfw_table_xentry); 2476f1220db8SAlexander V. Chernikov xent->tbl = da->uidx; 24779f7d47b0SAlexander V. Chernikov 247881d3153dSAlexander V. Chernikov memset(&da->tent, 0, sizeof(da->tent)); 247981d3153dSAlexander V. Chernikov tent = &da->tent; 248081d3153dSAlexander V. Chernikov error = ta->dump_tentry(tc->astate, da->ti, e, tent); 248181d3153dSAlexander V. Chernikov if (error != 0) 248281d3153dSAlexander V. Chernikov return (error); 248381d3153dSAlexander V. Chernikov 248481d3153dSAlexander V. Chernikov /* Convert current format to previous one */ 248581d3153dSAlexander V. Chernikov xent->masklen = tent->masklen; 24860cba2b28SAlexander V. Chernikov pval = get_table_value(da->ch, da->tc, da->tent.v.kidx); 24870cba2b28SAlexander V. Chernikov xent->value = ipfw_export_table_value_legacy(pval); 248881d3153dSAlexander V. Chernikov /* Apply some hacks */ 248974b22066SAlexander V. Chernikov if (tc->no.subtype == IPFW_TABLE_ADDR && tent->subtype == AF_INET) { 249081d3153dSAlexander V. Chernikov xent->k.addr6.s6_addr32[3] = tent->k.addr.s_addr; 249181d3153dSAlexander V. Chernikov xent->flags = IPFW_TCF_INET; 249281d3153dSAlexander V. Chernikov } else 249381d3153dSAlexander V. Chernikov memcpy(&xent->k, &tent->k, sizeof(xent->k)); 249481d3153dSAlexander V. Chernikov 249581d3153dSAlexander V. Chernikov return (0); 24969f7d47b0SAlexander V. Chernikov } 24979f7d47b0SAlexander V. Chernikov 24989f7d47b0SAlexander V. Chernikov /* 24994dff4ae0SAlexander V. Chernikov * Helper function to export table algo data 25004dff4ae0SAlexander V. Chernikov * to tentry format before calling user function. 25014dff4ae0SAlexander V. Chernikov * 25024dff4ae0SAlexander V. Chernikov * Returns 0 on success. 25034dff4ae0SAlexander V. Chernikov */ 25044dff4ae0SAlexander V. Chernikov static int 25054dff4ae0SAlexander V. Chernikov prepare_table_tentry(void *e, void *arg) 25064dff4ae0SAlexander V. Chernikov { 25074dff4ae0SAlexander V. Chernikov struct dump_args *da; 25084dff4ae0SAlexander V. Chernikov struct table_config *tc; 25094dff4ae0SAlexander V. Chernikov struct table_algo *ta; 25104dff4ae0SAlexander V. Chernikov int error; 25114dff4ae0SAlexander V. Chernikov 25124dff4ae0SAlexander V. Chernikov da = (struct dump_args *)arg; 25134dff4ae0SAlexander V. Chernikov 25144dff4ae0SAlexander V. Chernikov tc = da->tc; 25154dff4ae0SAlexander V. Chernikov ta = tc->ta; 25164dff4ae0SAlexander V. Chernikov 25174dff4ae0SAlexander V. Chernikov error = ta->dump_tentry(tc->astate, da->ti, e, &da->tent); 25184dff4ae0SAlexander V. Chernikov if (error != 0) 25194dff4ae0SAlexander V. Chernikov return (error); 25204dff4ae0SAlexander V. Chernikov 25214dff4ae0SAlexander V. Chernikov da->f(&da->tent, da->farg); 25224dff4ae0SAlexander V. Chernikov 25234dff4ae0SAlexander V. Chernikov return (0); 25244dff4ae0SAlexander V. Chernikov } 25254dff4ae0SAlexander V. Chernikov 25264dff4ae0SAlexander V. Chernikov /* 25274dff4ae0SAlexander V. Chernikov * Allow external consumers to read table entries in standard format. 25284dff4ae0SAlexander V. Chernikov */ 25294dff4ae0SAlexander V. Chernikov int 25304dff4ae0SAlexander V. Chernikov ipfw_foreach_table_tentry(struct ip_fw_chain *ch, uint16_t kidx, 25314dff4ae0SAlexander V. Chernikov ta_foreach_f *f, void *arg) 25324dff4ae0SAlexander V. Chernikov { 25334dff4ae0SAlexander V. Chernikov struct namedobj_instance *ni; 25344dff4ae0SAlexander V. Chernikov struct table_config *tc; 25354dff4ae0SAlexander V. Chernikov struct table_algo *ta; 25364dff4ae0SAlexander V. Chernikov struct dump_args da; 25374dff4ae0SAlexander V. Chernikov 25384dff4ae0SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 25394dff4ae0SAlexander V. Chernikov 25404dff4ae0SAlexander V. Chernikov tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, kidx); 25414dff4ae0SAlexander V. Chernikov if (tc == NULL) 25424dff4ae0SAlexander V. Chernikov return (ESRCH); 25434dff4ae0SAlexander V. Chernikov 25444dff4ae0SAlexander V. Chernikov ta = tc->ta; 25454dff4ae0SAlexander V. Chernikov 25464dff4ae0SAlexander V. Chernikov memset(&da, 0, sizeof(da)); 25470cba2b28SAlexander V. Chernikov da.ch = ch; 25484dff4ae0SAlexander V. Chernikov da.ti = KIDX_TO_TI(ch, tc->no.kidx); 25494dff4ae0SAlexander V. Chernikov da.tc = tc; 25504dff4ae0SAlexander V. Chernikov da.f = f; 25514dff4ae0SAlexander V. Chernikov da.farg = arg; 25524dff4ae0SAlexander V. Chernikov 25534dff4ae0SAlexander V. Chernikov ta->foreach(tc->astate, da.ti, prepare_table_tentry, &da); 25544dff4ae0SAlexander V. Chernikov 25554dff4ae0SAlexander V. Chernikov return (0); 25564dff4ae0SAlexander V. Chernikov } 25574dff4ae0SAlexander V. Chernikov 25584dff4ae0SAlexander V. Chernikov /* 25599f7d47b0SAlexander V. Chernikov * Table algorithms 25609f7d47b0SAlexander V. Chernikov */ 25613b3a8eb9SGleb Smirnoff 25629f7d47b0SAlexander V. Chernikov /* 2563a4641f4eSPedro F. Giffuni * Finds algorithm by index, table type or supplied name. 256435e1bbd0SAlexander V. Chernikov * 256535e1bbd0SAlexander V. Chernikov * Returns pointer to algo or NULL. 25669f7d47b0SAlexander V. Chernikov */ 25679f7d47b0SAlexander V. Chernikov static struct table_algo * 25689490a627SAlexander V. Chernikov find_table_algo(struct tables_config *tcfg, struct tid_info *ti, char *name) 25699f7d47b0SAlexander V. Chernikov { 25709490a627SAlexander V. Chernikov int i, l; 25719490a627SAlexander V. Chernikov struct table_algo *ta; 25729f7d47b0SAlexander V. Chernikov 257357a1cf95SAlexander V. Chernikov if (ti->type > IPFW_TABLE_MAXTYPE) 257457a1cf95SAlexander V. Chernikov return (NULL); 257557a1cf95SAlexander V. Chernikov 25769f7d47b0SAlexander V. Chernikov /* Search by index */ 25779f7d47b0SAlexander V. Chernikov if (ti->atype != 0) { 25789f7d47b0SAlexander V. Chernikov if (ti->atype > tcfg->algo_count) 25799f7d47b0SAlexander V. Chernikov return (NULL); 25809f7d47b0SAlexander V. Chernikov return (tcfg->algo[ti->atype]); 25819f7d47b0SAlexander V. Chernikov } 25829f7d47b0SAlexander V. Chernikov 2583fd0869d5SAlexander V. Chernikov if (name == NULL) { 2584fd0869d5SAlexander V. Chernikov /* Return default algorithm for given type if set */ 2585fd0869d5SAlexander V. Chernikov return (tcfg->def_algo[ti->type]); 2586fd0869d5SAlexander V. Chernikov } 2587fd0869d5SAlexander V. Chernikov 2588fd0869d5SAlexander V. Chernikov /* Search by name */ 25899490a627SAlexander V. Chernikov /* TODO: better search */ 25909490a627SAlexander V. Chernikov for (i = 1; i <= tcfg->algo_count; i++) { 25919490a627SAlexander V. Chernikov ta = tcfg->algo[i]; 25929490a627SAlexander V. Chernikov 25939490a627SAlexander V. Chernikov /* 25949490a627SAlexander V. Chernikov * One can supply additional algorithm 25959490a627SAlexander V. Chernikov * parameters so we compare only the first word 25969490a627SAlexander V. Chernikov * of supplied name: 2597c21034b7SAlexander V. Chernikov * 'addr:chash hsize=32' 25989490a627SAlexander V. Chernikov * '^^^^^^^^^' 25999490a627SAlexander V. Chernikov * 26009490a627SAlexander V. Chernikov */ 26019490a627SAlexander V. Chernikov l = strlen(ta->name); 2602fd0869d5SAlexander V. Chernikov if (strncmp(name, ta->name, l) != 0) 2603fd0869d5SAlexander V. Chernikov continue; 2604fd0869d5SAlexander V. Chernikov if (name[l] != '\0' && name[l] != ' ') 2605fd0869d5SAlexander V. Chernikov continue; 2606fd0869d5SAlexander V. Chernikov /* Check if we're requesting proper table type */ 2607fd0869d5SAlexander V. Chernikov if (ti->type != 0 && ti->type != ta->type) 2608fd0869d5SAlexander V. Chernikov return (NULL); 26099490a627SAlexander V. Chernikov return (ta); 26109490a627SAlexander V. Chernikov } 26119490a627SAlexander V. Chernikov 26129490a627SAlexander V. Chernikov return (NULL); 26139490a627SAlexander V. Chernikov } 26149490a627SAlexander V. Chernikov 2615b6ee846eSAlexander V. Chernikov /* 2616b6ee846eSAlexander V. Chernikov * Register new table algo @ta. 261735e1bbd0SAlexander V. Chernikov * Stores algo id inside @idx. 2618b6ee846eSAlexander V. Chernikov * 2619b6ee846eSAlexander V. Chernikov * Returns 0 on success. 2620b6ee846eSAlexander V. Chernikov */ 26210b565ac0SAlexander V. Chernikov int 26220b565ac0SAlexander V. Chernikov ipfw_add_table_algo(struct ip_fw_chain *ch, struct table_algo *ta, size_t size, 26230b565ac0SAlexander V. Chernikov int *idx) 26243b3a8eb9SGleb Smirnoff { 26259f7d47b0SAlexander V. Chernikov struct tables_config *tcfg; 26260b565ac0SAlexander V. Chernikov struct table_algo *ta_new; 2627b6ee846eSAlexander V. Chernikov size_t sz; 26280b565ac0SAlexander V. Chernikov 26290b565ac0SAlexander V. Chernikov if (size > sizeof(struct table_algo)) 26300b565ac0SAlexander V. Chernikov return (EINVAL); 26310b565ac0SAlexander V. Chernikov 2632b6ee846eSAlexander V. Chernikov /* Check for the required on-stack size for add/del */ 2633b6ee846eSAlexander V. Chernikov sz = roundup2(ta->ta_buf_size, sizeof(void *)); 2634b6ee846eSAlexander V. Chernikov if (sz > TA_BUF_SZ) 2635b6ee846eSAlexander V. Chernikov return (EINVAL); 2636b6ee846eSAlexander V. Chernikov 2637fddbbf75SAlexander V. Chernikov KASSERT(ta->type <= IPFW_TABLE_MAXTYPE,("Increase IPFW_TABLE_MAXTYPE")); 263857a1cf95SAlexander V. Chernikov 263935e1bbd0SAlexander V. Chernikov /* Copy algorithm data to stable storage. */ 26400b565ac0SAlexander V. Chernikov ta_new = malloc(sizeof(struct table_algo), M_IPFW, M_WAITOK | M_ZERO); 26410b565ac0SAlexander V. Chernikov memcpy(ta_new, ta, size); 26423b3a8eb9SGleb Smirnoff 26439f7d47b0SAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 2644b074b7bbSAlexander V. Chernikov 26459f7d47b0SAlexander V. Chernikov KASSERT(tcfg->algo_count < 255, ("Increase algo array size")); 26469f7d47b0SAlexander V. Chernikov 26470b565ac0SAlexander V. Chernikov tcfg->algo[++tcfg->algo_count] = ta_new; 26480b565ac0SAlexander V. Chernikov ta_new->idx = tcfg->algo_count; 26490b565ac0SAlexander V. Chernikov 265057a1cf95SAlexander V. Chernikov /* Set algorithm as default one for given type */ 265157a1cf95SAlexander V. Chernikov if ((ta_new->flags & TA_FLAG_DEFAULT) != 0 && 265257a1cf95SAlexander V. Chernikov tcfg->def_algo[ta_new->type] == NULL) 265357a1cf95SAlexander V. Chernikov tcfg->def_algo[ta_new->type] = ta_new; 265457a1cf95SAlexander V. Chernikov 26550b565ac0SAlexander V. Chernikov *idx = ta_new->idx; 26560b565ac0SAlexander V. Chernikov 26570b565ac0SAlexander V. Chernikov return (0); 26580b565ac0SAlexander V. Chernikov } 26590b565ac0SAlexander V. Chernikov 2660b6ee846eSAlexander V. Chernikov /* 2661b6ee846eSAlexander V. Chernikov * Unregisters table algo using @idx as id. 2662c8d5d308SAlexander V. Chernikov * XXX: It is NOT safe to call this function in any place 2663c8d5d308SAlexander V. Chernikov * other than ipfw instance destroy handler. 2664b6ee846eSAlexander V. Chernikov */ 26650b565ac0SAlexander V. Chernikov void 26660b565ac0SAlexander V. Chernikov ipfw_del_table_algo(struct ip_fw_chain *ch, int idx) 26670b565ac0SAlexander V. Chernikov { 26680b565ac0SAlexander V. Chernikov struct tables_config *tcfg; 26690b565ac0SAlexander V. Chernikov struct table_algo *ta; 26700b565ac0SAlexander V. Chernikov 26710b565ac0SAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 26720b565ac0SAlexander V. Chernikov 2673b6ee846eSAlexander V. Chernikov KASSERT(idx <= tcfg->algo_count, ("algo idx %d out of range 1..%d", 2674b6ee846eSAlexander V. Chernikov idx, tcfg->algo_count)); 26750b565ac0SAlexander V. Chernikov 26760b565ac0SAlexander V. Chernikov ta = tcfg->algo[idx]; 26770b565ac0SAlexander V. Chernikov KASSERT(ta != NULL, ("algo idx %d is NULL", idx)); 267857a1cf95SAlexander V. Chernikov 267957a1cf95SAlexander V. Chernikov if (tcfg->def_algo[ta->type] == ta) 268057a1cf95SAlexander V. Chernikov tcfg->def_algo[ta->type] = NULL; 268157a1cf95SAlexander V. Chernikov 26820b565ac0SAlexander V. Chernikov free(ta, M_IPFW); 26833b3a8eb9SGleb Smirnoff } 26843b3a8eb9SGleb Smirnoff 26859d099b4fSAlexander V. Chernikov /* 26869d099b4fSAlexander V. Chernikov * Lists all table algorithms currently available. 26879d099b4fSAlexander V. Chernikov * Data layout (v0)(current): 26889d099b4fSAlexander V. Chernikov * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size 26899d099b4fSAlexander V. Chernikov * Reply: [ ipfw_obj_lheader ipfw_ta_info x N ] 26909d099b4fSAlexander V. Chernikov * 26919d099b4fSAlexander V. Chernikov * Returns 0 on success 26929d099b4fSAlexander V. Chernikov */ 26936b988f3aSAlexander V. Chernikov static int 26946b988f3aSAlexander V. Chernikov list_table_algo(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 2695e822d936SAlexander V. Chernikov struct sockopt_data *sd) 26969d099b4fSAlexander V. Chernikov { 26979d099b4fSAlexander V. Chernikov struct _ipfw_obj_lheader *olh; 26989d099b4fSAlexander V. Chernikov struct tables_config *tcfg; 26999d099b4fSAlexander V. Chernikov ipfw_ta_info *i; 27009d099b4fSAlexander V. Chernikov struct table_algo *ta; 27019d099b4fSAlexander V. Chernikov uint32_t count, n, size; 27029d099b4fSAlexander V. Chernikov 27039d099b4fSAlexander V. Chernikov olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh)); 27049d099b4fSAlexander V. Chernikov if (olh == NULL) 27059d099b4fSAlexander V. Chernikov return (EINVAL); 27069d099b4fSAlexander V. Chernikov if (sd->valsize < olh->size) 27079d099b4fSAlexander V. Chernikov return (EINVAL); 27089d099b4fSAlexander V. Chernikov 27099d099b4fSAlexander V. Chernikov IPFW_UH_RLOCK(ch); 27109d099b4fSAlexander V. Chernikov tcfg = CHAIN_TO_TCFG(ch); 27119d099b4fSAlexander V. Chernikov count = tcfg->algo_count; 27129d099b4fSAlexander V. Chernikov size = count * sizeof(ipfw_ta_info) + sizeof(ipfw_obj_lheader); 27139d099b4fSAlexander V. Chernikov 27149d099b4fSAlexander V. Chernikov /* Fill in header regadless of buffer size */ 27159d099b4fSAlexander V. Chernikov olh->count = count; 27169d099b4fSAlexander V. Chernikov olh->objsize = sizeof(ipfw_ta_info); 27179d099b4fSAlexander V. Chernikov 27189d099b4fSAlexander V. Chernikov if (size > olh->size) { 27199d099b4fSAlexander V. Chernikov olh->size = size; 27209d099b4fSAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 27219d099b4fSAlexander V. Chernikov return (ENOMEM); 27229d099b4fSAlexander V. Chernikov } 27239d099b4fSAlexander V. Chernikov olh->size = size; 27249d099b4fSAlexander V. Chernikov 27259d099b4fSAlexander V. Chernikov for (n = 1; n <= count; n++) { 27269d099b4fSAlexander V. Chernikov i = (ipfw_ta_info *)ipfw_get_sopt_space(sd, sizeof(*i)); 27277a6ab8f1SPedro F. Giffuni KASSERT(i != NULL, ("previously checked buffer is not enough")); 27289d099b4fSAlexander V. Chernikov ta = tcfg->algo[n]; 27299d099b4fSAlexander V. Chernikov strlcpy(i->algoname, ta->name, sizeof(i->algoname)); 27309d099b4fSAlexander V. Chernikov i->type = ta->type; 27319d099b4fSAlexander V. Chernikov i->refcnt = ta->refcnt; 27329d099b4fSAlexander V. Chernikov } 27339d099b4fSAlexander V. Chernikov 27349d099b4fSAlexander V. Chernikov IPFW_UH_RUNLOCK(ch); 27359d099b4fSAlexander V. Chernikov 27369d099b4fSAlexander V. Chernikov return (0); 27379d099b4fSAlexander V. Chernikov } 27389d099b4fSAlexander V. Chernikov 2739b074b7bbSAlexander V. Chernikov static int 274074b22066SAlexander V. Chernikov classify_srcdst(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 2741b074b7bbSAlexander V. Chernikov { 2742b074b7bbSAlexander V. Chernikov /* Basic IPv4/IPv6 or u32 lookups */ 2743b074b7bbSAlexander V. Chernikov *puidx = cmd->arg1; 2744c21034b7SAlexander V. Chernikov /* Assume ADDR by default */ 2745c21034b7SAlexander V. Chernikov *ptype = IPFW_TABLE_ADDR; 274674b22066SAlexander V. Chernikov int v; 2747b074b7bbSAlexander V. Chernikov 2748b074b7bbSAlexander V. Chernikov if (F_LEN(cmd) > F_INSN_SIZE(ipfw_insn_u32)) { 2749b074b7bbSAlexander V. Chernikov /* 2750b074b7bbSAlexander V. Chernikov * generic lookup. The key must be 2751b074b7bbSAlexander V. Chernikov * in 32bit big-endian format. 2752b074b7bbSAlexander V. Chernikov */ 2753b074b7bbSAlexander V. Chernikov v = ((ipfw_insn_u32 *)cmd)->d[1]; 2754b074b7bbSAlexander V. Chernikov switch (v) { 275581cac390SArseny Smalyuk case LOOKUP_DST_IP: 275681cac390SArseny Smalyuk case LOOKUP_SRC_IP: 2757b074b7bbSAlexander V. Chernikov break; 275881cac390SArseny Smalyuk case LOOKUP_DST_PORT: 275981cac390SArseny Smalyuk case LOOKUP_SRC_PORT: 276081cac390SArseny Smalyuk case LOOKUP_UID: 276181cac390SArseny Smalyuk case LOOKUP_JAIL: 276281cac390SArseny Smalyuk case LOOKUP_DSCP: 2763fc727ad6SBoris Lytochkin case LOOKUP_MARK: 2764b23d5de9SAlexander V. Chernikov *ptype = IPFW_TABLE_NUMBER; 2765b074b7bbSAlexander V. Chernikov break; 276681cac390SArseny Smalyuk case LOOKUP_DST_MAC: 276781cac390SArseny Smalyuk case LOOKUP_SRC_MAC: 276881cac390SArseny Smalyuk *ptype = IPFW_TABLE_MAC; 2769b074b7bbSAlexander V. Chernikov break; 2770b074b7bbSAlexander V. Chernikov } 2771b074b7bbSAlexander V. Chernikov } 2772b074b7bbSAlexander V. Chernikov 277374b22066SAlexander V. Chernikov return (0); 2774b074b7bbSAlexander V. Chernikov } 2775b074b7bbSAlexander V. Chernikov 277674b22066SAlexander V. Chernikov static int 277774b22066SAlexander V. Chernikov classify_via(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 2778b074b7bbSAlexander V. Chernikov { 2779b074b7bbSAlexander V. Chernikov ipfw_insn_if *cmdif; 2780b074b7bbSAlexander V. Chernikov 2781b074b7bbSAlexander V. Chernikov /* Interface table, possibly */ 2782b074b7bbSAlexander V. Chernikov cmdif = (ipfw_insn_if *)cmd; 278374b22066SAlexander V. Chernikov if (cmdif->name[0] != '\1') 278474b22066SAlexander V. Chernikov return (1); 278574b22066SAlexander V. Chernikov 278674b22066SAlexander V. Chernikov *ptype = IPFW_TABLE_INTERFACE; 278774b22066SAlexander V. Chernikov *puidx = cmdif->p.kidx; 278874b22066SAlexander V. Chernikov 278974b22066SAlexander V. Chernikov return (0); 279074b22066SAlexander V. Chernikov } 279174b22066SAlexander V. Chernikov 279274b22066SAlexander V. Chernikov static int 279374b22066SAlexander V. Chernikov classify_flow(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 279474b22066SAlexander V. Chernikov { 279574b22066SAlexander V. Chernikov 279674b22066SAlexander V. Chernikov *puidx = cmd->arg1; 279774b22066SAlexander V. Chernikov *ptype = IPFW_TABLE_FLOW; 279874b22066SAlexander V. Chernikov 279974b22066SAlexander V. Chernikov return (0); 280074b22066SAlexander V. Chernikov } 280174b22066SAlexander V. Chernikov 280281cac390SArseny Smalyuk static int 280381cac390SArseny Smalyuk classify_mac_lookup(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 280481cac390SArseny Smalyuk { 280581cac390SArseny Smalyuk *puidx = cmd->arg1; 280681cac390SArseny Smalyuk *ptype = IPFW_TABLE_MAC; 280781cac390SArseny Smalyuk return (0); 280881cac390SArseny Smalyuk } 280981cac390SArseny Smalyuk 281074b22066SAlexander V. Chernikov static void 281174b22066SAlexander V. Chernikov update_arg1(ipfw_insn *cmd, uint16_t idx) 281274b22066SAlexander V. Chernikov { 281374b22066SAlexander V. Chernikov 2814914bffb6SAlexander V. Chernikov cmd->arg1 = idx; 2815b074b7bbSAlexander V. Chernikov } 281674b22066SAlexander V. Chernikov 281774b22066SAlexander V. Chernikov static void 281874b22066SAlexander V. Chernikov update_via(ipfw_insn *cmd, uint16_t idx) 281974b22066SAlexander V. Chernikov { 282074b22066SAlexander V. Chernikov ipfw_insn_if *cmdif; 282174b22066SAlexander V. Chernikov 282274b22066SAlexander V. Chernikov cmdif = (ipfw_insn_if *)cmd; 282374b22066SAlexander V. Chernikov cmdif->p.kidx = idx; 2824b074b7bbSAlexander V. Chernikov } 2825b074b7bbSAlexander V. Chernikov 282674b22066SAlexander V. Chernikov static int 282774b22066SAlexander V. Chernikov table_findbyname(struct ip_fw_chain *ch, struct tid_info *ti, 282874b22066SAlexander V. Chernikov struct named_object **pno) 282974b22066SAlexander V. Chernikov { 283074b22066SAlexander V. Chernikov struct table_config *tc; 283174b22066SAlexander V. Chernikov int error; 283274b22066SAlexander V. Chernikov 283374b22066SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 283474b22066SAlexander V. Chernikov 283574b22066SAlexander V. Chernikov error = find_table_err(CHAIN_TO_NI(ch), ti, &tc); 283674b22066SAlexander V. Chernikov if (error != 0) 283774b22066SAlexander V. Chernikov return (error); 283874b22066SAlexander V. Chernikov 283974b22066SAlexander V. Chernikov *pno = &tc->no; 284074b22066SAlexander V. Chernikov return (0); 284174b22066SAlexander V. Chernikov } 284274b22066SAlexander V. Chernikov 284374b22066SAlexander V. Chernikov /* XXX: sets-sets! */ 284474b22066SAlexander V. Chernikov static struct named_object * 284574b22066SAlexander V. Chernikov table_findbykidx(struct ip_fw_chain *ch, uint16_t idx) 284674b22066SAlexander V. Chernikov { 284774b22066SAlexander V. Chernikov struct namedobj_instance *ni; 284874b22066SAlexander V. Chernikov struct table_config *tc; 284974b22066SAlexander V. Chernikov 285074b22066SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 285174b22066SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 285274b22066SAlexander V. Chernikov tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, idx); 285374b22066SAlexander V. Chernikov KASSERT(tc != NULL, ("Table with index %d not found", idx)); 285474b22066SAlexander V. Chernikov 285574b22066SAlexander V. Chernikov return (&tc->no); 285674b22066SAlexander V. Chernikov } 285774b22066SAlexander V. Chernikov 28582685841bSAndrey V. Elsukov static int 28592685841bSAndrey V. Elsukov table_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set, 28602685841bSAndrey V. Elsukov enum ipfw_sets_cmd cmd) 28612685841bSAndrey V. Elsukov { 28622685841bSAndrey V. Elsukov 28632685841bSAndrey V. Elsukov switch (cmd) { 28642685841bSAndrey V. Elsukov case SWAP_ALL: 28652685841bSAndrey V. Elsukov case TEST_ALL: 28662685841bSAndrey V. Elsukov case MOVE_ALL: 286770c1466dSAndrey V. Elsukov /* 286870c1466dSAndrey V. Elsukov * Always return success, the real action and decision 286970c1466dSAndrey V. Elsukov * should make table_manage_sets_all(). 287070c1466dSAndrey V. Elsukov */ 287170c1466dSAndrey V. Elsukov return (0); 28722685841bSAndrey V. Elsukov case TEST_ONE: 28732685841bSAndrey V. Elsukov case MOVE_ONE: 28742685841bSAndrey V. Elsukov /* 28752685841bSAndrey V. Elsukov * NOTE: we need to use ipfw_objhash_del/ipfw_objhash_add 28762685841bSAndrey V. Elsukov * if set number will be used in hash function. Currently 28772685841bSAndrey V. Elsukov * we can just use generic handler that replaces set value. 28782685841bSAndrey V. Elsukov */ 28792685841bSAndrey V. Elsukov if (V_fw_tables_sets == 0) 28802685841bSAndrey V. Elsukov return (0); 28812685841bSAndrey V. Elsukov break; 28822685841bSAndrey V. Elsukov case COUNT_ONE: 28832685841bSAndrey V. Elsukov /* 28842685841bSAndrey V. Elsukov * Return EOPNOTSUPP for COUNT_ONE when per-set sysctl is 28852685841bSAndrey V. Elsukov * disabled. This allow skip table's opcodes from additional 28862685841bSAndrey V. Elsukov * checks when specific rules moved to another set. 28872685841bSAndrey V. Elsukov */ 28882685841bSAndrey V. Elsukov if (V_fw_tables_sets == 0) 28892685841bSAndrey V. Elsukov return (EOPNOTSUPP); 28902685841bSAndrey V. Elsukov } 28912685841bSAndrey V. Elsukov /* Use generic sets handler when per-set sysctl is enabled. */ 28922685841bSAndrey V. Elsukov return (ipfw_obj_manage_sets(CHAIN_TO_NI(ch), IPFW_TLV_TBL_NAME, 28932685841bSAndrey V. Elsukov set, new_set, cmd)); 28942685841bSAndrey V. Elsukov } 28952685841bSAndrey V. Elsukov 289670c1466dSAndrey V. Elsukov /* 289770c1466dSAndrey V. Elsukov * We register several opcode rewriters for lookup tables. 289870c1466dSAndrey V. Elsukov * All tables opcodes have the same ETLV type, but different subtype. 289970c1466dSAndrey V. Elsukov * To avoid invoking sets handler several times for XXX_ALL commands, 290070c1466dSAndrey V. Elsukov * we use separate manage_sets handler. O_RECV has the lowest value, 290170c1466dSAndrey V. Elsukov * so it should be called first. 290270c1466dSAndrey V. Elsukov */ 290370c1466dSAndrey V. Elsukov static int 290470c1466dSAndrey V. Elsukov table_manage_sets_all(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set, 290570c1466dSAndrey V. Elsukov enum ipfw_sets_cmd cmd) 290670c1466dSAndrey V. Elsukov { 290770c1466dSAndrey V. Elsukov 290870c1466dSAndrey V. Elsukov switch (cmd) { 290970c1466dSAndrey V. Elsukov case SWAP_ALL: 291070c1466dSAndrey V. Elsukov case TEST_ALL: 291170c1466dSAndrey V. Elsukov /* 291270c1466dSAndrey V. Elsukov * Return success for TEST_ALL, since nothing prevents 291370c1466dSAndrey V. Elsukov * move rules from one set to another. All tables are 291470c1466dSAndrey V. Elsukov * accessible from all sets when per-set tables sysctl 291570c1466dSAndrey V. Elsukov * is disabled. 291670c1466dSAndrey V. Elsukov */ 291770c1466dSAndrey V. Elsukov case MOVE_ALL: 291870c1466dSAndrey V. Elsukov if (V_fw_tables_sets == 0) 291970c1466dSAndrey V. Elsukov return (0); 292070c1466dSAndrey V. Elsukov break; 292170c1466dSAndrey V. Elsukov default: 292270c1466dSAndrey V. Elsukov return (table_manage_sets(ch, set, new_set, cmd)); 292370c1466dSAndrey V. Elsukov } 292470c1466dSAndrey V. Elsukov /* Use generic sets handler when per-set sysctl is enabled. */ 292570c1466dSAndrey V. Elsukov return (ipfw_obj_manage_sets(CHAIN_TO_NI(ch), IPFW_TLV_TBL_NAME, 292670c1466dSAndrey V. Elsukov set, new_set, cmd)); 292770c1466dSAndrey V. Elsukov } 292870c1466dSAndrey V. Elsukov 292974b22066SAlexander V. Chernikov static struct opcode_obj_rewrite opcodes[] = { 293074b22066SAlexander V. Chernikov { 29312685841bSAndrey V. Elsukov .opcode = O_IP_SRC_LOOKUP, 29322685841bSAndrey V. Elsukov .etlv = IPFW_TLV_TBL_NAME, 29332685841bSAndrey V. Elsukov .classifier = classify_srcdst, 29342685841bSAndrey V. Elsukov .update = update_arg1, 29352685841bSAndrey V. Elsukov .find_byname = table_findbyname, 29362685841bSAndrey V. Elsukov .find_bykidx = table_findbykidx, 29372685841bSAndrey V. Elsukov .create_object = create_table_compat, 29382685841bSAndrey V. Elsukov .manage_sets = table_manage_sets, 293974b22066SAlexander V. Chernikov }, 294074b22066SAlexander V. Chernikov { 29412685841bSAndrey V. Elsukov .opcode = O_IP_DST_LOOKUP, 29422685841bSAndrey V. Elsukov .etlv = IPFW_TLV_TBL_NAME, 29432685841bSAndrey V. Elsukov .classifier = classify_srcdst, 29442685841bSAndrey V. Elsukov .update = update_arg1, 29452685841bSAndrey V. Elsukov .find_byname = table_findbyname, 29462685841bSAndrey V. Elsukov .find_bykidx = table_findbykidx, 29472685841bSAndrey V. Elsukov .create_object = create_table_compat, 29482685841bSAndrey V. Elsukov .manage_sets = table_manage_sets, 294974b22066SAlexander V. Chernikov }, 295074b22066SAlexander V. Chernikov { 29512685841bSAndrey V. Elsukov .opcode = O_IP_FLOW_LOOKUP, 29522685841bSAndrey V. Elsukov .etlv = IPFW_TLV_TBL_NAME, 29532685841bSAndrey V. Elsukov .classifier = classify_flow, 29542685841bSAndrey V. Elsukov .update = update_arg1, 29552685841bSAndrey V. Elsukov .find_byname = table_findbyname, 29562685841bSAndrey V. Elsukov .find_bykidx = table_findbykidx, 29572685841bSAndrey V. Elsukov .create_object = create_table_compat, 29582685841bSAndrey V. Elsukov .manage_sets = table_manage_sets, 295974b22066SAlexander V. Chernikov }, 296074b22066SAlexander V. Chernikov { 296181cac390SArseny Smalyuk .opcode = O_MAC_SRC_LOOKUP, 296281cac390SArseny Smalyuk .etlv = IPFW_TLV_TBL_NAME, 296381cac390SArseny Smalyuk .classifier = classify_mac_lookup, 296481cac390SArseny Smalyuk .update = update_arg1, 296581cac390SArseny Smalyuk .find_byname = table_findbyname, 296681cac390SArseny Smalyuk .find_bykidx = table_findbykidx, 296781cac390SArseny Smalyuk .create_object = create_table_compat, 296881cac390SArseny Smalyuk .manage_sets = table_manage_sets, 296981cac390SArseny Smalyuk }, 297081cac390SArseny Smalyuk { 297181cac390SArseny Smalyuk .opcode = O_MAC_DST_LOOKUP, 297281cac390SArseny Smalyuk .etlv = IPFW_TLV_TBL_NAME, 297381cac390SArseny Smalyuk .classifier = classify_mac_lookup, 297481cac390SArseny Smalyuk .update = update_arg1, 297581cac390SArseny Smalyuk .find_byname = table_findbyname, 297681cac390SArseny Smalyuk .find_bykidx = table_findbykidx, 297781cac390SArseny Smalyuk .create_object = create_table_compat, 297881cac390SArseny Smalyuk .manage_sets = table_manage_sets, 297981cac390SArseny Smalyuk }, 298081cac390SArseny Smalyuk { 29812685841bSAndrey V. Elsukov .opcode = O_XMIT, 29822685841bSAndrey V. Elsukov .etlv = IPFW_TLV_TBL_NAME, 29832685841bSAndrey V. Elsukov .classifier = classify_via, 29842685841bSAndrey V. Elsukov .update = update_via, 29852685841bSAndrey V. Elsukov .find_byname = table_findbyname, 29862685841bSAndrey V. Elsukov .find_bykidx = table_findbykidx, 29872685841bSAndrey V. Elsukov .create_object = create_table_compat, 29882685841bSAndrey V. Elsukov .manage_sets = table_manage_sets, 298974b22066SAlexander V. Chernikov }, 299074b22066SAlexander V. Chernikov { 29912685841bSAndrey V. Elsukov .opcode = O_RECV, 29922685841bSAndrey V. Elsukov .etlv = IPFW_TLV_TBL_NAME, 29932685841bSAndrey V. Elsukov .classifier = classify_via, 29942685841bSAndrey V. Elsukov .update = update_via, 29952685841bSAndrey V. Elsukov .find_byname = table_findbyname, 29962685841bSAndrey V. Elsukov .find_bykidx = table_findbykidx, 29972685841bSAndrey V. Elsukov .create_object = create_table_compat, 299870c1466dSAndrey V. Elsukov .manage_sets = table_manage_sets_all, 299974b22066SAlexander V. Chernikov }, 300074b22066SAlexander V. Chernikov { 30012685841bSAndrey V. Elsukov .opcode = O_VIA, 30022685841bSAndrey V. Elsukov .etlv = IPFW_TLV_TBL_NAME, 30032685841bSAndrey V. Elsukov .classifier = classify_via, 30042685841bSAndrey V. Elsukov .update = update_via, 30052685841bSAndrey V. Elsukov .find_byname = table_findbyname, 30062685841bSAndrey V. Elsukov .find_bykidx = table_findbykidx, 30072685841bSAndrey V. Elsukov .create_object = create_table_compat, 30082685841bSAndrey V. Elsukov .manage_sets = table_manage_sets, 300974b22066SAlexander V. Chernikov }, 301074b22066SAlexander V. Chernikov }; 301174b22066SAlexander V. Chernikov 30122685841bSAndrey V. Elsukov static int 30132685841bSAndrey V. Elsukov test_sets_cb(struct namedobj_instance *ni __unused, struct named_object *no, 30142685841bSAndrey V. Elsukov void *arg __unused) 30152685841bSAndrey V. Elsukov { 30162685841bSAndrey V. Elsukov 30172685841bSAndrey V. Elsukov /* Check that there aren't any tables in not default set */ 30182685841bSAndrey V. Elsukov if (no->set != 0) 30192685841bSAndrey V. Elsukov return (EBUSY); 30202685841bSAndrey V. Elsukov return (0); 30212685841bSAndrey V. Elsukov } 30222685841bSAndrey V. Elsukov 30232685841bSAndrey V. Elsukov /* 30242685841bSAndrey V. Elsukov * Switch between "set 0" and "rule's set" table binding, 30252685841bSAndrey V. Elsukov * Check all ruleset bindings and permits changing 30262685841bSAndrey V. Elsukov * IFF each binding has both rule AND table in default set (set 0). 30272685841bSAndrey V. Elsukov * 30282685841bSAndrey V. Elsukov * Returns 0 on success. 30292685841bSAndrey V. Elsukov */ 30302685841bSAndrey V. Elsukov int 30312685841bSAndrey V. Elsukov ipfw_switch_tables_namespace(struct ip_fw_chain *ch, unsigned int sets) 30322685841bSAndrey V. Elsukov { 30332685841bSAndrey V. Elsukov struct opcode_obj_rewrite *rw; 30342685841bSAndrey V. Elsukov struct namedobj_instance *ni; 30352685841bSAndrey V. Elsukov struct named_object *no; 30362685841bSAndrey V. Elsukov struct ip_fw *rule; 30372685841bSAndrey V. Elsukov ipfw_insn *cmd; 30382685841bSAndrey V. Elsukov int cmdlen, i, l; 30392685841bSAndrey V. Elsukov uint16_t kidx; 30402685841bSAndrey V. Elsukov uint8_t subtype; 30412685841bSAndrey V. Elsukov 30422685841bSAndrey V. Elsukov IPFW_UH_WLOCK(ch); 30432685841bSAndrey V. Elsukov 30442685841bSAndrey V. Elsukov if (V_fw_tables_sets == sets) { 30452685841bSAndrey V. Elsukov IPFW_UH_WUNLOCK(ch); 30462685841bSAndrey V. Elsukov return (0); 30472685841bSAndrey V. Elsukov } 30482685841bSAndrey V. Elsukov ni = CHAIN_TO_NI(ch); 30492685841bSAndrey V. Elsukov if (sets == 0) { 30502685841bSAndrey V. Elsukov /* 30512685841bSAndrey V. Elsukov * Prevent disabling sets support if we have some tables 30522685841bSAndrey V. Elsukov * in not default sets. 30532685841bSAndrey V. Elsukov */ 30542685841bSAndrey V. Elsukov if (ipfw_objhash_foreach_type(ni, test_sets_cb, 30552685841bSAndrey V. Elsukov NULL, IPFW_TLV_TBL_NAME) != 0) { 30562685841bSAndrey V. Elsukov IPFW_UH_WUNLOCK(ch); 30572685841bSAndrey V. Elsukov return (EBUSY); 30582685841bSAndrey V. Elsukov } 30592685841bSAndrey V. Elsukov } 30602685841bSAndrey V. Elsukov /* 30612685841bSAndrey V. Elsukov * Scan all rules and examine tables opcodes. 30622685841bSAndrey V. Elsukov */ 30632685841bSAndrey V. Elsukov for (i = 0; i < ch->n_rules; i++) { 30642685841bSAndrey V. Elsukov rule = ch->map[i]; 30652685841bSAndrey V. Elsukov 30662685841bSAndrey V. Elsukov l = rule->cmd_len; 30672685841bSAndrey V. Elsukov cmd = rule->cmd; 30682685841bSAndrey V. Elsukov cmdlen = 0; 30692685841bSAndrey V. Elsukov for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 30702685841bSAndrey V. Elsukov cmdlen = F_LEN(cmd); 30712685841bSAndrey V. Elsukov /* Check only tables opcodes */ 30722685841bSAndrey V. Elsukov for (kidx = 0, rw = opcodes; 30732685841bSAndrey V. Elsukov rw < opcodes + nitems(opcodes); rw++) { 30742685841bSAndrey V. Elsukov if (rw->opcode != cmd->opcode) 30752685841bSAndrey V. Elsukov continue; 30762685841bSAndrey V. Elsukov if (rw->classifier(cmd, &kidx, &subtype) == 0) 30772685841bSAndrey V. Elsukov break; 30782685841bSAndrey V. Elsukov } 30792685841bSAndrey V. Elsukov if (kidx == 0) 30802685841bSAndrey V. Elsukov continue; 30812685841bSAndrey V. Elsukov no = ipfw_objhash_lookup_kidx(ni, kidx); 30822685841bSAndrey V. Elsukov /* Check if both table object and rule has the set 0 */ 30832685841bSAndrey V. Elsukov if (no->set != 0 || rule->set != 0) { 30842685841bSAndrey V. Elsukov IPFW_UH_WUNLOCK(ch); 30852685841bSAndrey V. Elsukov return (EBUSY); 30862685841bSAndrey V. Elsukov } 30872685841bSAndrey V. Elsukov } 30882685841bSAndrey V. Elsukov } 30892685841bSAndrey V. Elsukov V_fw_tables_sets = sets; 30902685841bSAndrey V. Elsukov IPFW_UH_WUNLOCK(ch); 30912685841bSAndrey V. Elsukov return (0); 30922685841bSAndrey V. Elsukov } 309374b22066SAlexander V. Chernikov 3094ac35ff17SAlexander V. Chernikov /* 3095ac35ff17SAlexander V. Chernikov * Checks table name for validity. 3096ac35ff17SAlexander V. Chernikov * Enforce basic length checks, the rest 3097ac35ff17SAlexander V. Chernikov * should be done in userland. 3098ac35ff17SAlexander V. Chernikov * 3099ac35ff17SAlexander V. Chernikov * Returns 0 if name is considered valid. 3100ac35ff17SAlexander V. Chernikov */ 3101f81431ccSAndrey V. Elsukov static int 3102f81431ccSAndrey V. Elsukov check_table_name(const char *name) 3103ac35ff17SAlexander V. Chernikov { 3104ac35ff17SAlexander V. Chernikov 3105ac35ff17SAlexander V. Chernikov /* 3106ac35ff17SAlexander V. Chernikov * TODO: do some more complicated checks 3107ac35ff17SAlexander V. Chernikov */ 3108f81431ccSAndrey V. Elsukov return (ipfw_check_object_name_generic(name)); 3109ac35ff17SAlexander V. Chernikov } 3110ac35ff17SAlexander V. Chernikov 3111ac35ff17SAlexander V. Chernikov /* 3112ac35ff17SAlexander V. Chernikov * Finds table config based on either legacy index 3113ac35ff17SAlexander V. Chernikov * or name in ntlv. 3114ac35ff17SAlexander V. Chernikov * Note @ti structure contains unchecked data from userland. 3115ac35ff17SAlexander V. Chernikov * 311674b22066SAlexander V. Chernikov * Returns 0 in success and fills in @tc with found config 3117ac35ff17SAlexander V. Chernikov */ 311874b22066SAlexander V. Chernikov static int 311974b22066SAlexander V. Chernikov find_table_err(struct namedobj_instance *ni, struct tid_info *ti, 312074b22066SAlexander V. Chernikov struct table_config **tc) 3121b074b7bbSAlexander V. Chernikov { 3122b074b7bbSAlexander V. Chernikov char *name, bname[16]; 3123b074b7bbSAlexander V. Chernikov struct named_object *no; 3124ac35ff17SAlexander V. Chernikov ipfw_obj_ntlv *ntlv; 3125ac35ff17SAlexander V. Chernikov uint32_t set; 3126b074b7bbSAlexander V. Chernikov 3127b074b7bbSAlexander V. Chernikov if (ti->tlvs != NULL) { 31282df1a11fSAndrey V. Elsukov ntlv = ipfw_find_name_tlv_type(ti->tlvs, ti->tlen, ti->uidx, 31292df1a11fSAndrey V. Elsukov IPFW_TLV_TBL_NAME); 3130ac35ff17SAlexander V. Chernikov if (ntlv == NULL) 313174b22066SAlexander V. Chernikov return (EINVAL); 3132ac35ff17SAlexander V. Chernikov name = ntlv->name; 313340e5f498SAlexander V. Chernikov 313440e5f498SAlexander V. Chernikov /* 313540e5f498SAlexander V. Chernikov * Use set provided by @ti instead of @ntlv one. 313640e5f498SAlexander V. Chernikov * This is needed due to different sets behavior 313740e5f498SAlexander V. Chernikov * controlled by V_fw_tables_sets. 313840e5f498SAlexander V. Chernikov */ 31392685841bSAndrey V. Elsukov set = (V_fw_tables_sets != 0) ? ti->set : 0; 3140b074b7bbSAlexander V. Chernikov } else { 3141b074b7bbSAlexander V. Chernikov snprintf(bname, sizeof(bname), "%d", ti->uidx); 3142b074b7bbSAlexander V. Chernikov name = bname; 3143ac35ff17SAlexander V. Chernikov set = 0; 3144b074b7bbSAlexander V. Chernikov } 3145b074b7bbSAlexander V. Chernikov 3146ac35ff17SAlexander V. Chernikov no = ipfw_objhash_lookup_name(ni, set, name); 314774b22066SAlexander V. Chernikov *tc = (struct table_config *)no; 3148b074b7bbSAlexander V. Chernikov 314974b22066SAlexander V. Chernikov return (0); 315074b22066SAlexander V. Chernikov } 315174b22066SAlexander V. Chernikov 315274b22066SAlexander V. Chernikov /* 315374b22066SAlexander V. Chernikov * Finds table config based on either legacy index 315474b22066SAlexander V. Chernikov * or name in ntlv. 315574b22066SAlexander V. Chernikov * Note @ti structure contains unchecked data from userland. 315674b22066SAlexander V. Chernikov * 315774b22066SAlexander V. Chernikov * Returns pointer to table_config or NULL. 315874b22066SAlexander V. Chernikov */ 315974b22066SAlexander V. Chernikov static struct table_config * 316074b22066SAlexander V. Chernikov find_table(struct namedobj_instance *ni, struct tid_info *ti) 316174b22066SAlexander V. Chernikov { 316274b22066SAlexander V. Chernikov struct table_config *tc; 316374b22066SAlexander V. Chernikov 316474b22066SAlexander V. Chernikov if (find_table_err(ni, ti, &tc) != 0) 316574b22066SAlexander V. Chernikov return (NULL); 316674b22066SAlexander V. Chernikov 316774b22066SAlexander V. Chernikov return (tc); 3168b074b7bbSAlexander V. Chernikov } 3169b074b7bbSAlexander V. Chernikov 317035e1bbd0SAlexander V. Chernikov /* 317135e1bbd0SAlexander V. Chernikov * Allocate new table config structure using 317235e1bbd0SAlexander V. Chernikov * specified @algo and @aname. 317335e1bbd0SAlexander V. Chernikov * 317435e1bbd0SAlexander V. Chernikov * Returns pointer to config or NULL. 317535e1bbd0SAlexander V. Chernikov */ 3176b074b7bbSAlexander V. Chernikov static struct table_config * 317768394ec8SAlexander V. Chernikov alloc_table_config(struct ip_fw_chain *ch, struct tid_info *ti, 31780cba2b28SAlexander V. Chernikov struct table_algo *ta, char *aname, uint8_t tflags) 3179b074b7bbSAlexander V. Chernikov { 3180b074b7bbSAlexander V. Chernikov char *name, bname[16]; 3181b074b7bbSAlexander V. Chernikov struct table_config *tc; 3182b074b7bbSAlexander V. Chernikov int error; 3183ac35ff17SAlexander V. Chernikov ipfw_obj_ntlv *ntlv; 3184ac35ff17SAlexander V. Chernikov uint32_t set; 3185b074b7bbSAlexander V. Chernikov 3186b074b7bbSAlexander V. Chernikov if (ti->tlvs != NULL) { 31872df1a11fSAndrey V. Elsukov ntlv = ipfw_find_name_tlv_type(ti->tlvs, ti->tlen, ti->uidx, 31882df1a11fSAndrey V. Elsukov IPFW_TLV_TBL_NAME); 3189ac35ff17SAlexander V. Chernikov if (ntlv == NULL) 3190b074b7bbSAlexander V. Chernikov return (NULL); 3191ac35ff17SAlexander V. Chernikov name = ntlv->name; 31923995ad17SOleg Bulyzhin set = (V_fw_tables_sets == 0) ? 0 : ntlv->set; 3193b074b7bbSAlexander V. Chernikov } else { 319474b22066SAlexander V. Chernikov /* Compat part: convert number to string representation */ 3195b074b7bbSAlexander V. Chernikov snprintf(bname, sizeof(bname), "%d", ti->uidx); 3196b074b7bbSAlexander V. Chernikov name = bname; 3197ac35ff17SAlexander V. Chernikov set = 0; 3198b074b7bbSAlexander V. Chernikov } 3199b074b7bbSAlexander V. Chernikov 3200b074b7bbSAlexander V. Chernikov tc = malloc(sizeof(struct table_config), M_IPFW, M_WAITOK | M_ZERO); 3201b074b7bbSAlexander V. Chernikov tc->no.name = tc->tablename; 320274b22066SAlexander V. Chernikov tc->no.subtype = ta->type; 3203ac35ff17SAlexander V. Chernikov tc->no.set = set; 3204914bffb6SAlexander V. Chernikov tc->tflags = tflags; 32059f7d47b0SAlexander V. Chernikov tc->ta = ta; 3206b074b7bbSAlexander V. Chernikov strlcpy(tc->tablename, name, sizeof(tc->tablename)); 32070cba2b28SAlexander V. Chernikov /* Set "shared" value type by default */ 32080cba2b28SAlexander V. Chernikov tc->vshared = 1; 3209b074b7bbSAlexander V. Chernikov 3210b074b7bbSAlexander V. Chernikov /* Preallocate data structures for new tables */ 32114c060d85SAlexander V. Chernikov error = ta->init(ch, &tc->astate, &tc->ti_copy, aname, tflags); 3212b074b7bbSAlexander V. Chernikov if (error != 0) { 3213b074b7bbSAlexander V. Chernikov free(tc, M_IPFW); 3214b074b7bbSAlexander V. Chernikov return (NULL); 3215b074b7bbSAlexander V. Chernikov } 3216b074b7bbSAlexander V. Chernikov 3217b074b7bbSAlexander V. Chernikov return (tc); 3218b074b7bbSAlexander V. Chernikov } 3219b074b7bbSAlexander V. Chernikov 322035e1bbd0SAlexander V. Chernikov /* 322135e1bbd0SAlexander V. Chernikov * Destroys table state and config. 322235e1bbd0SAlexander V. Chernikov */ 3223b074b7bbSAlexander V. Chernikov static void 3224b074b7bbSAlexander V. Chernikov free_table_config(struct namedobj_instance *ni, struct table_config *tc) 3225b074b7bbSAlexander V. Chernikov { 3226b074b7bbSAlexander V. Chernikov 322735e1bbd0SAlexander V. Chernikov KASSERT(tc->linked == 0, ("free() on linked config")); 32280caab009SAlexander V. Chernikov /* UH lock MUST NOT be held */ 3229b074b7bbSAlexander V. Chernikov 32300468c5baSAlexander V. Chernikov /* 32310468c5baSAlexander V. Chernikov * We're using ta without any locking/referencing. 32320468c5baSAlexander V. Chernikov * TODO: fix this if we're going to use unloadable algos. 32330468c5baSAlexander V. Chernikov */ 32344c060d85SAlexander V. Chernikov tc->ta->destroy(tc->astate, &tc->ti_copy); 3235b074b7bbSAlexander V. Chernikov free(tc, M_IPFW); 3236b074b7bbSAlexander V. Chernikov } 3237b074b7bbSAlexander V. Chernikov 3238b074b7bbSAlexander V. Chernikov /* 3239b074b7bbSAlexander V. Chernikov * Links @tc to @chain table named instance. 3240b074b7bbSAlexander V. Chernikov * Sets appropriate type/states in @chain table info. 3241b074b7bbSAlexander V. Chernikov */ 3242b074b7bbSAlexander V. Chernikov static void 32439f7d47b0SAlexander V. Chernikov link_table(struct ip_fw_chain *ch, struct table_config *tc) 3244b074b7bbSAlexander V. Chernikov { 3245b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 32469f7d47b0SAlexander V. Chernikov struct table_info *ti; 3247b074b7bbSAlexander V. Chernikov uint16_t kidx; 3248b074b7bbSAlexander V. Chernikov 32499f7d47b0SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 3250b074b7bbSAlexander V. Chernikov 32519f7d47b0SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 3252b074b7bbSAlexander V. Chernikov kidx = tc->no.kidx; 3253b074b7bbSAlexander V. Chernikov 3254b074b7bbSAlexander V. Chernikov ipfw_objhash_add(ni, &tc->no); 32559f7d47b0SAlexander V. Chernikov 32569f7d47b0SAlexander V. Chernikov ti = KIDX_TO_TI(ch, kidx); 32574c060d85SAlexander V. Chernikov *ti = tc->ti_copy; 3258b074b7bbSAlexander V. Chernikov 325968394ec8SAlexander V. Chernikov /* Notify algo on real @ti address */ 326068394ec8SAlexander V. Chernikov if (tc->ta->change_ti != NULL) 326168394ec8SAlexander V. Chernikov tc->ta->change_ti(tc->astate, ti); 326268394ec8SAlexander V. Chernikov 3263b074b7bbSAlexander V. Chernikov tc->linked = 1; 32649d099b4fSAlexander V. Chernikov tc->ta->refcnt++; 3265b074b7bbSAlexander V. Chernikov } 3266b074b7bbSAlexander V. Chernikov 3267b074b7bbSAlexander V. Chernikov /* 3268b074b7bbSAlexander V. Chernikov * Unlinks @tc from @chain table named instance. 3269b074b7bbSAlexander V. Chernikov * Zeroes states in @chain and stores them in @tc. 3270b074b7bbSAlexander V. Chernikov */ 3271b074b7bbSAlexander V. Chernikov static void 32729f7d47b0SAlexander V. Chernikov unlink_table(struct ip_fw_chain *ch, struct table_config *tc) 3273b074b7bbSAlexander V. Chernikov { 3274b074b7bbSAlexander V. Chernikov struct namedobj_instance *ni; 32759f7d47b0SAlexander V. Chernikov struct table_info *ti; 3276b074b7bbSAlexander V. Chernikov uint16_t kidx; 3277b074b7bbSAlexander V. Chernikov 32789f7d47b0SAlexander V. Chernikov IPFW_UH_WLOCK_ASSERT(ch); 32799f7d47b0SAlexander V. Chernikov IPFW_WLOCK_ASSERT(ch); 3280b074b7bbSAlexander V. Chernikov 32819f7d47b0SAlexander V. Chernikov ni = CHAIN_TO_NI(ch); 3282b074b7bbSAlexander V. Chernikov kidx = tc->no.kidx; 3283b074b7bbSAlexander V. Chernikov 32849f7d47b0SAlexander V. Chernikov /* Clear state. @ti copy is already saved inside @tc */ 3285b074b7bbSAlexander V. Chernikov ipfw_objhash_del(ni, &tc->no); 32869f7d47b0SAlexander V. Chernikov ti = KIDX_TO_TI(ch, kidx); 32879f7d47b0SAlexander V. Chernikov memset(ti, 0, sizeof(struct table_info)); 3288b074b7bbSAlexander V. Chernikov tc->linked = 0; 32899d099b4fSAlexander V. Chernikov tc->ta->refcnt--; 329068394ec8SAlexander V. Chernikov 329168394ec8SAlexander V. Chernikov /* Notify algo on real @ti address */ 329268394ec8SAlexander V. Chernikov if (tc->ta->change_ti != NULL) 329368394ec8SAlexander V. Chernikov tc->ta->change_ti(tc->astate, NULL); 3294b074b7bbSAlexander V. Chernikov } 3295b074b7bbSAlexander V. Chernikov 32966b988f3aSAlexander V. Chernikov static struct ipfw_sopt_handler scodes[] = { 32976b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XCREATE, 0, HDIR_SET, create_table }, 32986b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XDESTROY, 0, HDIR_SET, flush_table_v0 }, 32996b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XFLUSH, 0, HDIR_SET, flush_table_v0 }, 33006b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XMODIFY, 0, HDIR_BOTH, modify_table }, 33016b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XINFO, 0, HDIR_GET, describe_table }, 33026b988f3aSAlexander V. Chernikov { IP_FW_TABLES_XLIST, 0, HDIR_GET, list_tables }, 33036b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XLIST, 0, HDIR_GET, dump_table_v0 }, 33046b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XLIST, 1, HDIR_GET, dump_table_v1 }, 33056b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XADD, 0, HDIR_BOTH, manage_table_ent_v0 }, 33066b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XADD, 1, HDIR_BOTH, manage_table_ent_v1 }, 33076b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XDEL, 0, HDIR_BOTH, manage_table_ent_v0 }, 33086b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XDEL, 1, HDIR_BOTH, manage_table_ent_v1 }, 33096b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XFIND, 0, HDIR_GET, find_table_entry }, 33106b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XSWAP, 0, HDIR_SET, swap_table }, 33116b988f3aSAlexander V. Chernikov { IP_FW_TABLES_ALIST, 0, HDIR_GET, list_table_algo }, 33126b988f3aSAlexander V. Chernikov { IP_FW_TABLE_XGETSIZE, 0, HDIR_GET, get_table_size }, 33136b988f3aSAlexander V. Chernikov }; 33146b988f3aSAlexander V. Chernikov 3315b309f085SAndrey V. Elsukov static int 33166b988f3aSAlexander V. Chernikov destroy_table_locked(struct namedobj_instance *ni, struct named_object *no, 33176b988f3aSAlexander V. Chernikov void *arg) 33186b988f3aSAlexander V. Chernikov { 33196b988f3aSAlexander V. Chernikov 33206b988f3aSAlexander V. Chernikov unlink_table((struct ip_fw_chain *)arg, (struct table_config *)no); 33216b988f3aSAlexander V. Chernikov if (ipfw_objhash_free_idx(ni, no->kidx) != 0) 33226b988f3aSAlexander V. Chernikov printf("Error unlinking kidx %d from table %s\n", 33236b988f3aSAlexander V. Chernikov no->kidx, no->name); 33246b988f3aSAlexander V. Chernikov free_table_config(ni, (struct table_config *)no); 3325b309f085SAndrey V. Elsukov return (0); 33266b988f3aSAlexander V. Chernikov } 33276b988f3aSAlexander V. Chernikov 33286b988f3aSAlexander V. Chernikov /* 33296b988f3aSAlexander V. Chernikov * Shuts tables module down. 33306b988f3aSAlexander V. Chernikov */ 33316b988f3aSAlexander V. Chernikov void 33326b988f3aSAlexander V. Chernikov ipfw_destroy_tables(struct ip_fw_chain *ch, int last) 33336b988f3aSAlexander V. Chernikov { 33346b988f3aSAlexander V. Chernikov 33356b988f3aSAlexander V. Chernikov IPFW_DEL_SOPT_HANDLER(last, scodes); 333674b22066SAlexander V. Chernikov IPFW_DEL_OBJ_REWRITER(last, opcodes); 33376b988f3aSAlexander V. Chernikov 33386b988f3aSAlexander V. Chernikov /* Remove all tables from working set */ 33396b988f3aSAlexander V. Chernikov IPFW_UH_WLOCK(ch); 33406b988f3aSAlexander V. Chernikov IPFW_WLOCK(ch); 33416b988f3aSAlexander V. Chernikov ipfw_objhash_foreach(CHAIN_TO_NI(ch), destroy_table_locked, ch); 33426b988f3aSAlexander V. Chernikov IPFW_WUNLOCK(ch); 33436b988f3aSAlexander V. Chernikov IPFW_UH_WUNLOCK(ch); 33446b988f3aSAlexander V. Chernikov 33456b988f3aSAlexander V. Chernikov /* Free pointers itself */ 33466b988f3aSAlexander V. Chernikov free(ch->tablestate, M_IPFW); 33476b988f3aSAlexander V. Chernikov 33486b988f3aSAlexander V. Chernikov ipfw_table_value_destroy(ch, last); 33496b988f3aSAlexander V. Chernikov ipfw_table_algo_destroy(ch); 33506b988f3aSAlexander V. Chernikov 33516b988f3aSAlexander V. Chernikov ipfw_objhash_destroy(CHAIN_TO_NI(ch)); 33526b988f3aSAlexander V. Chernikov free(CHAIN_TO_TCFG(ch), M_IPFW); 33536b988f3aSAlexander V. Chernikov } 33546b988f3aSAlexander V. Chernikov 33556b988f3aSAlexander V. Chernikov /* 33566b988f3aSAlexander V. Chernikov * Starts tables module. 33576b988f3aSAlexander V. Chernikov */ 33586b988f3aSAlexander V. Chernikov int 33596b988f3aSAlexander V. Chernikov ipfw_init_tables(struct ip_fw_chain *ch, int first) 33606b988f3aSAlexander V. Chernikov { 33616b988f3aSAlexander V. Chernikov struct tables_config *tcfg; 33626b988f3aSAlexander V. Chernikov 33636b988f3aSAlexander V. Chernikov /* Allocate pointers */ 33646b988f3aSAlexander V. Chernikov ch->tablestate = malloc(V_fw_tables_max * sizeof(struct table_info), 33656b988f3aSAlexander V. Chernikov M_IPFW, M_WAITOK | M_ZERO); 33666b988f3aSAlexander V. Chernikov 33676b988f3aSAlexander V. Chernikov tcfg = malloc(sizeof(struct tables_config), M_IPFW, M_WAITOK | M_ZERO); 33686b988f3aSAlexander V. Chernikov tcfg->namehash = ipfw_objhash_create(V_fw_tables_max); 33696b988f3aSAlexander V. Chernikov ch->tblcfg = tcfg; 33706b988f3aSAlexander V. Chernikov 33716b988f3aSAlexander V. Chernikov ipfw_table_value_init(ch, first); 33726b988f3aSAlexander V. Chernikov ipfw_table_algo_init(ch); 33736b988f3aSAlexander V. Chernikov 337474b22066SAlexander V. Chernikov IPFW_ADD_OBJ_REWRITER(first, opcodes); 33756b988f3aSAlexander V. Chernikov IPFW_ADD_SOPT_HANDLER(first, scodes); 33766b988f3aSAlexander V. Chernikov return (0); 33776b988f3aSAlexander V. Chernikov } 3378