1 /*- 2 * Copyright (c) 2004 Ruslan Ermilov and Vsevolod Lobko. 3 * Copyright (c) 2014 Yandex LLC 4 * Copyright (c) 2014 Alexander V. Chernikov 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25 * SUCH DAMAGE. 26 */ 27 28 #include <sys/cdefs.h> 29 __FBSDID("$FreeBSD$"); 30 31 /* 32 * Lookup table support for ipfw. 33 * 34 * This file contains handlers for all generic tables' operations: 35 * add/del/flush entries, list/dump tables etc.. 36 * 37 * Table data modification is protected by both UH and runtime lock 38 * while reading configuration/data is protected by UH lock. 39 * 40 * Lookup algorithms for all table types are located in ip_fw_table_algo.c 41 */ 42 43 #include "opt_ipfw.h" 44 45 #include <sys/param.h> 46 #include <sys/systm.h> 47 #include <sys/malloc.h> 48 #include <sys/kernel.h> 49 #include <sys/lock.h> 50 #include <sys/rwlock.h> 51 #include <sys/rmlock.h> 52 #include <sys/socket.h> 53 #include <sys/socketvar.h> 54 #include <sys/queue.h> 55 #include <net/if.h> /* ip_fw.h requires IFNAMSIZ */ 56 57 #include <netinet/in.h> 58 #include <netinet/ip_var.h> /* struct ipfw_rule_ref */ 59 #include <netinet/ip_fw.h> 60 61 #include <netpfil/ipfw/ip_fw_private.h> 62 #include <netpfil/ipfw/ip_fw_table.h> 63 64 /* 65 * Table has the following `type` concepts: 66 * 67 * `no.type` represents lookup key type (addr, ifp, uid, etc..) 68 * vmask represents bitmask of table values which are present at the moment. 69 * Special IPFW_VTYPE_LEGACY ( (uint32_t)-1 ) represents old 70 * single-value-for-all approach. 71 */ 72 struct table_config { 73 struct named_object no; 74 uint8_t tflags; /* type flags */ 75 uint8_t locked; /* 1 if locked from changes */ 76 uint8_t linked; /* 1 if already linked */ 77 uint8_t ochanged; /* used by set swapping */ 78 uint8_t vshared; /* 1 if using shared value array */ 79 uint8_t spare[3]; 80 uint32_t count; /* Number of records */ 81 uint32_t limit; /* Max number of records */ 82 uint32_t vmask; /* bitmask with supported values */ 83 uint32_t ocount; /* used by set swapping */ 84 uint64_t gencnt; /* generation count */ 85 char tablename[64]; /* table name */ 86 struct table_algo *ta; /* Callbacks for given algo */ 87 void *astate; /* algorithm state */ 88 struct table_info ti_copy; /* data to put to table_info */ 89 struct namedobj_instance *vi; 90 }; 91 92 static int find_table_err(struct namedobj_instance *ni, struct tid_info *ti, 93 struct table_config **tc); 94 static struct table_config *find_table(struct namedobj_instance *ni, 95 struct tid_info *ti); 96 static struct table_config *alloc_table_config(struct ip_fw_chain *ch, 97 struct tid_info *ti, struct table_algo *ta, char *adata, uint8_t tflags); 98 static void free_table_config(struct namedobj_instance *ni, 99 struct table_config *tc); 100 static int create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti, 101 char *aname, ipfw_xtable_info *i, uint16_t *pkidx, int ref); 102 static void link_table(struct ip_fw_chain *ch, struct table_config *tc); 103 static void unlink_table(struct ip_fw_chain *ch, struct table_config *tc); 104 static int find_ref_table(struct ip_fw_chain *ch, struct tid_info *ti, 105 struct tentry_info *tei, uint32_t count, int op, struct table_config **ptc); 106 #define OP_ADD 1 107 #define OP_DEL 0 108 static int export_tables(struct ip_fw_chain *ch, ipfw_obj_lheader *olh, 109 struct sockopt_data *sd); 110 static void export_table_info(struct ip_fw_chain *ch, struct table_config *tc, 111 ipfw_xtable_info *i); 112 static int dump_table_tentry(void *e, void *arg); 113 static int dump_table_xentry(void *e, void *arg); 114 115 static int swap_tables(struct ip_fw_chain *ch, struct tid_info *a, 116 struct tid_info *b); 117 118 static int check_table_name(const char *name); 119 static int check_table_space(struct ip_fw_chain *ch, struct tableop_state *ts, 120 struct table_config *tc, struct table_info *ti, uint32_t count); 121 static int destroy_table(struct ip_fw_chain *ch, struct tid_info *ti); 122 123 static struct table_algo *find_table_algo(struct tables_config *tableconf, 124 struct tid_info *ti, char *name); 125 126 static void objheader_to_ti(struct _ipfw_obj_header *oh, struct tid_info *ti); 127 static void ntlv_to_ti(struct _ipfw_obj_ntlv *ntlv, struct tid_info *ti); 128 129 #define CHAIN_TO_NI(chain) (CHAIN_TO_TCFG(chain)->namehash) 130 #define KIDX_TO_TI(ch, k) (&(((struct table_info *)(ch)->tablestate)[k])) 131 132 #define TA_BUF_SZ 128 /* On-stack buffer for add/delete state */ 133 134 void 135 rollback_toperation_state(struct ip_fw_chain *ch, void *object) 136 { 137 struct tables_config *tcfg; 138 struct op_state *os; 139 140 tcfg = CHAIN_TO_TCFG(ch); 141 TAILQ_FOREACH(os, &tcfg->state_list, next) 142 os->func(object, os); 143 } 144 145 void 146 add_toperation_state(struct ip_fw_chain *ch, struct tableop_state *ts) 147 { 148 struct tables_config *tcfg; 149 150 tcfg = CHAIN_TO_TCFG(ch); 151 TAILQ_INSERT_HEAD(&tcfg->state_list, &ts->opstate, next); 152 } 153 154 void 155 del_toperation_state(struct ip_fw_chain *ch, struct tableop_state *ts) 156 { 157 struct tables_config *tcfg; 158 159 tcfg = CHAIN_TO_TCFG(ch); 160 TAILQ_REMOVE(&tcfg->state_list, &ts->opstate, next); 161 } 162 163 void 164 tc_ref(struct table_config *tc) 165 { 166 167 tc->no.refcnt++; 168 } 169 170 void 171 tc_unref(struct table_config *tc) 172 { 173 174 tc->no.refcnt--; 175 } 176 177 static struct table_value * 178 get_table_value(struct ip_fw_chain *ch, struct table_config *tc, uint32_t kidx) 179 { 180 struct table_value *pval; 181 182 pval = (struct table_value *)ch->valuestate; 183 184 return (&pval[kidx]); 185 } 186 187 188 /* 189 * Checks if we're able to insert/update entry @tei into table 190 * w.r.t @tc limits. 191 * May alter @tei to indicate insertion error / insert 192 * options. 193 * 194 * Returns 0 if operation can be performed/ 195 */ 196 static int 197 check_table_limit(struct table_config *tc, struct tentry_info *tei) 198 { 199 200 if (tc->limit == 0 || tc->count < tc->limit) 201 return (0); 202 203 if ((tei->flags & TEI_FLAGS_UPDATE) == 0) { 204 /* Notify userland on error cause */ 205 tei->flags |= TEI_FLAGS_LIMIT; 206 return (EFBIG); 207 } 208 209 /* 210 * We have UPDATE flag set. 211 * Permit updating record (if found), 212 * but restrict adding new one since we've 213 * already hit the limit. 214 */ 215 tei->flags |= TEI_FLAGS_DONTADD; 216 217 return (0); 218 } 219 220 /* 221 * Convert algorithm callback return code into 222 * one of pre-defined states known by userland. 223 */ 224 static void 225 store_tei_result(struct tentry_info *tei, int op, int error, uint32_t num) 226 { 227 int flag; 228 229 flag = 0; 230 231 switch (error) { 232 case 0: 233 if (op == OP_ADD && num != 0) 234 flag = TEI_FLAGS_ADDED; 235 if (op == OP_DEL) 236 flag = TEI_FLAGS_DELETED; 237 break; 238 case ENOENT: 239 flag = TEI_FLAGS_NOTFOUND; 240 break; 241 case EEXIST: 242 flag = TEI_FLAGS_EXISTS; 243 break; 244 default: 245 flag = TEI_FLAGS_ERROR; 246 } 247 248 tei->flags |= flag; 249 } 250 251 /* 252 * Creates and references table with default parameters. 253 * Saves table config, algo and allocated kidx info @ptc, @pta and 254 * @pkidx if non-zero. 255 * Used for table auto-creation to support old binaries. 256 * 257 * Returns 0 on success. 258 */ 259 static int 260 create_table_compat(struct ip_fw_chain *ch, struct tid_info *ti, 261 uint16_t *pkidx) 262 { 263 ipfw_xtable_info xi; 264 int error; 265 266 memset(&xi, 0, sizeof(xi)); 267 /* Set default value mask for legacy clients */ 268 xi.vmask = IPFW_VTYPE_LEGACY; 269 270 error = create_table_internal(ch, ti, NULL, &xi, pkidx, 1); 271 if (error != 0) 272 return (error); 273 274 return (0); 275 } 276 277 /* 278 * Find and reference existing table optionally 279 * creating new one. 280 * 281 * Saves found table config into @ptc. 282 * Note function may drop/acquire UH_WLOCK. 283 * Returns 0 if table was found/created and referenced 284 * or non-zero return code. 285 */ 286 static int 287 find_ref_table(struct ip_fw_chain *ch, struct tid_info *ti, 288 struct tentry_info *tei, uint32_t count, int op, 289 struct table_config **ptc) 290 { 291 struct namedobj_instance *ni; 292 struct table_config *tc; 293 uint16_t kidx; 294 int error; 295 296 IPFW_UH_WLOCK_ASSERT(ch); 297 298 ni = CHAIN_TO_NI(ch); 299 tc = NULL; 300 if ((tc = find_table(ni, ti)) != NULL) { 301 /* check table type */ 302 if (tc->no.subtype != ti->type) 303 return (EINVAL); 304 305 if (tc->locked != 0) 306 return (EACCES); 307 308 /* Try to exit early on limit hit */ 309 if (op == OP_ADD && count == 1 && 310 check_table_limit(tc, tei) != 0) 311 return (EFBIG); 312 313 /* Reference and return */ 314 tc->no.refcnt++; 315 *ptc = tc; 316 return (0); 317 } 318 319 if (op == OP_DEL) 320 return (ESRCH); 321 322 /* Compatibility mode: create new table for old clients */ 323 if ((tei->flags & TEI_FLAGS_COMPAT) == 0) 324 return (ESRCH); 325 326 IPFW_UH_WUNLOCK(ch); 327 error = create_table_compat(ch, ti, &kidx); 328 IPFW_UH_WLOCK(ch); 329 330 if (error != 0) 331 return (error); 332 333 tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, kidx); 334 KASSERT(tc != NULL, ("create_table_compat returned bad idx %d", kidx)); 335 336 /* OK, now we've got referenced table. */ 337 *ptc = tc; 338 return (0); 339 } 340 341 /* 342 * Rolls back already @added to @tc entries using state array @ta_buf_m. 343 * Assume the following layout: 344 * 1) ADD state (ta_buf_m[0] ... t_buf_m[added - 1]) for handling update cases 345 * 2) DEL state (ta_buf_m[count[ ... t_buf_m[count + added - 1]) 346 * for storing deleted state 347 */ 348 static void 349 rollback_added_entries(struct ip_fw_chain *ch, struct table_config *tc, 350 struct table_info *tinfo, struct tentry_info *tei, caddr_t ta_buf_m, 351 uint32_t count, uint32_t added) 352 { 353 struct table_algo *ta; 354 struct tentry_info *ptei; 355 caddr_t v, vv; 356 size_t ta_buf_sz; 357 int error, i; 358 uint32_t num; 359 360 IPFW_UH_WLOCK_ASSERT(ch); 361 362 ta = tc->ta; 363 ta_buf_sz = ta->ta_buf_size; 364 v = ta_buf_m; 365 vv = v + count * ta_buf_sz; 366 for (i = 0; i < added; i++, v += ta_buf_sz, vv += ta_buf_sz) { 367 ptei = &tei[i]; 368 if ((ptei->flags & TEI_FLAGS_UPDATED) != 0) { 369 370 /* 371 * We have old value stored by previous 372 * call in @ptei->value. Do add once again 373 * to restore it. 374 */ 375 error = ta->add(tc->astate, tinfo, ptei, v, &num); 376 KASSERT(error == 0, ("rollback UPDATE fail")); 377 KASSERT(num == 0, ("rollback UPDATE fail2")); 378 continue; 379 } 380 381 error = ta->prepare_del(ch, ptei, vv); 382 KASSERT(error == 0, ("pre-rollback INSERT failed")); 383 error = ta->del(tc->astate, tinfo, ptei, vv, &num); 384 KASSERT(error == 0, ("rollback INSERT failed")); 385 tc->count -= num; 386 } 387 } 388 389 /* 390 * Prepares add/del state for all @count entries in @tei. 391 * Uses either stack buffer (@ta_buf) or allocates a new one. 392 * Stores pointer to allocated buffer back to @ta_buf. 393 * 394 * Returns 0 on success. 395 */ 396 static int 397 prepare_batch_buffer(struct ip_fw_chain *ch, struct table_algo *ta, 398 struct tentry_info *tei, uint32_t count, int op, caddr_t *ta_buf) 399 { 400 caddr_t ta_buf_m, v; 401 size_t ta_buf_sz, sz; 402 struct tentry_info *ptei; 403 int error, i; 404 405 error = 0; 406 ta_buf_sz = ta->ta_buf_size; 407 if (count == 1) { 408 /* Single add/delete, use on-stack buffer */ 409 memset(*ta_buf, 0, TA_BUF_SZ); 410 ta_buf_m = *ta_buf; 411 } else { 412 413 /* 414 * Multiple adds/deletes, allocate larger buffer 415 * 416 * Note we need 2xcount buffer for add case: 417 * we have hold both ADD state 418 * and DELETE state (this may be needed 419 * if we need to rollback all changes) 420 */ 421 sz = count * ta_buf_sz; 422 ta_buf_m = malloc((op == OP_ADD) ? sz * 2 : sz, M_TEMP, 423 M_WAITOK | M_ZERO); 424 } 425 426 v = ta_buf_m; 427 for (i = 0; i < count; i++, v += ta_buf_sz) { 428 ptei = &tei[i]; 429 error = (op == OP_ADD) ? 430 ta->prepare_add(ch, ptei, v) : ta->prepare_del(ch, ptei, v); 431 432 /* 433 * Some syntax error (incorrect mask, or address, or 434 * anything). Return error regardless of atomicity 435 * settings. 436 */ 437 if (error != 0) 438 break; 439 } 440 441 *ta_buf = ta_buf_m; 442 return (error); 443 } 444 445 /* 446 * Flushes allocated state for each @count entries in @tei. 447 * Frees @ta_buf_m if differs from stack buffer @ta_buf. 448 */ 449 static void 450 flush_batch_buffer(struct ip_fw_chain *ch, struct table_algo *ta, 451 struct tentry_info *tei, uint32_t count, int rollback, 452 caddr_t ta_buf_m, caddr_t ta_buf) 453 { 454 caddr_t v; 455 struct tentry_info *ptei; 456 size_t ta_buf_sz; 457 int i; 458 459 ta_buf_sz = ta->ta_buf_size; 460 461 /* Run cleaning callback anyway */ 462 v = ta_buf_m; 463 for (i = 0; i < count; i++, v += ta_buf_sz) { 464 ptei = &tei[i]; 465 ta->flush_entry(ch, ptei, v); 466 if (ptei->ptv != NULL) { 467 free(ptei->ptv, M_IPFW); 468 ptei->ptv = NULL; 469 } 470 } 471 472 /* Clean up "deleted" state in case of rollback */ 473 if (rollback != 0) { 474 v = ta_buf_m + count * ta_buf_sz; 475 for (i = 0; i < count; i++, v += ta_buf_sz) 476 ta->flush_entry(ch, &tei[i], v); 477 } 478 479 if (ta_buf_m != ta_buf) 480 free(ta_buf_m, M_TEMP); 481 } 482 483 484 static void 485 rollback_add_entry(void *object, struct op_state *_state) 486 { 487 struct ip_fw_chain *ch; 488 struct tableop_state *ts; 489 490 ts = (struct tableop_state *)_state; 491 492 if (ts->tc != object && ts->ch != object) 493 return; 494 495 ch = ts->ch; 496 497 IPFW_UH_WLOCK_ASSERT(ch); 498 499 /* Call specifid unlockers */ 500 rollback_table_values(ts); 501 502 /* Indicate we've called */ 503 ts->modified = 1; 504 } 505 506 /* 507 * Adds/updates one or more entries in table @ti. 508 * 509 * Function may drop/reacquire UH wlock multiple times due to 510 * items alloc, algorithm callbacks (check_space), value linkage 511 * (new values, value storage realloc), etc.. 512 * Other processes like other adds (which may involve storage resize), 513 * table swaps (which changes table data and may change algo type), 514 * table modify (which may change value mask) may be executed 515 * simultaneously so we need to deal with it. 516 * 517 * The following approach was implemented: 518 * we have per-chain linked list, protected with UH lock. 519 * add_table_entry prepares special on-stack structure wthich is passed 520 * to its descendants. Users add this structure to this list before unlock. 521 * After performing needed operations and acquiring UH lock back, each user 522 * checks if structure has changed. If true, it rolls local state back and 523 * returns without error to the caller. 524 * add_table_entry() on its own checks if structure has changed and restarts 525 * its operation from the beginning (goto restart). 526 * 527 * Functions which are modifying fields of interest (currently 528 * resize_shared_value_storage() and swap_tables() ) 529 * traverses given list while holding UH lock immediately before 530 * performing their operations calling function provided be list entry 531 * ( currently rollback_add_entry ) which performs rollback for all necessary 532 * state and sets appropriate values in structure indicating rollback 533 * has happened. 534 * 535 * Algo interaction: 536 * Function references @ti first to ensure table won't 537 * disappear or change its type. 538 * After that, prepare_add callback is called for each @tei entry. 539 * Next, we try to add each entry under UH+WHLOCK 540 * using add() callback. 541 * Finally, we free all state by calling flush_entry callback 542 * for each @tei. 543 * 544 * Returns 0 on success. 545 */ 546 int 547 add_table_entry(struct ip_fw_chain *ch, struct tid_info *ti, 548 struct tentry_info *tei, uint8_t flags, uint32_t count) 549 { 550 struct table_config *tc; 551 struct table_algo *ta; 552 uint16_t kidx; 553 int error, first_error, i, rollback; 554 uint32_t num, numadd; 555 struct tentry_info *ptei; 556 struct tableop_state ts; 557 char ta_buf[TA_BUF_SZ]; 558 caddr_t ta_buf_m, v; 559 560 memset(&ts, 0, sizeof(ts)); 561 ta = NULL; 562 IPFW_UH_WLOCK(ch); 563 564 /* 565 * Find and reference existing table. 566 */ 567 restart: 568 if (ts.modified != 0) { 569 IPFW_UH_WUNLOCK(ch); 570 flush_batch_buffer(ch, ta, tei, count, rollback, 571 ta_buf_m, ta_buf); 572 memset(&ts, 0, sizeof(ts)); 573 ta = NULL; 574 IPFW_UH_WLOCK(ch); 575 } 576 577 error = find_ref_table(ch, ti, tei, count, OP_ADD, &tc); 578 if (error != 0) { 579 IPFW_UH_WUNLOCK(ch); 580 return (error); 581 } 582 ta = tc->ta; 583 584 /* Fill in tablestate */ 585 ts.ch = ch; 586 ts.opstate.func = rollback_add_entry; 587 ts.tc = tc; 588 ts.vshared = tc->vshared; 589 ts.vmask = tc->vmask; 590 ts.ta = ta; 591 ts.tei = tei; 592 ts.count = count; 593 rollback = 0; 594 add_toperation_state(ch, &ts); 595 IPFW_UH_WUNLOCK(ch); 596 597 /* Allocate memory and prepare record(s) */ 598 /* Pass stack buffer by default */ 599 ta_buf_m = ta_buf; 600 error = prepare_batch_buffer(ch, ta, tei, count, OP_ADD, &ta_buf_m); 601 602 IPFW_UH_WLOCK(ch); 603 del_toperation_state(ch, &ts); 604 /* Drop reference we've used in first search */ 605 tc->no.refcnt--; 606 607 /* Check prepare_batch_buffer() error */ 608 if (error != 0) 609 goto cleanup; 610 611 /* 612 * Check if table swap has happened. 613 * (so table algo might be changed). 614 * Restart operation to achieve consistent behavior. 615 */ 616 if (ts.modified != 0) 617 goto restart; 618 619 /* 620 * Link all values values to shared/per-table value array. 621 * 622 * May release/reacquire UH_WLOCK. 623 */ 624 error = ipfw_link_table_values(ch, &ts); 625 if (error != 0) 626 goto cleanup; 627 if (ts.modified != 0) 628 goto restart; 629 630 /* 631 * Ensure we are able to add all entries without additional 632 * memory allocations. May release/reacquire UH_WLOCK. 633 */ 634 kidx = tc->no.kidx; 635 error = check_table_space(ch, &ts, tc, KIDX_TO_TI(ch, kidx), count); 636 if (error != 0) 637 goto cleanup; 638 if (ts.modified != 0) 639 goto restart; 640 641 /* We've got valid table in @tc. Let's try to add data */ 642 kidx = tc->no.kidx; 643 ta = tc->ta; 644 numadd = 0; 645 first_error = 0; 646 647 IPFW_WLOCK(ch); 648 649 v = ta_buf_m; 650 for (i = 0; i < count; i++, v += ta->ta_buf_size) { 651 ptei = &tei[i]; 652 num = 0; 653 /* check limit before adding */ 654 if ((error = check_table_limit(tc, ptei)) == 0) { 655 error = ta->add(tc->astate, KIDX_TO_TI(ch, kidx), 656 ptei, v, &num); 657 /* Set status flag to inform userland */ 658 store_tei_result(ptei, OP_ADD, error, num); 659 } 660 if (error == 0) { 661 /* Update number of records to ease limit checking */ 662 tc->count += num; 663 numadd += num; 664 continue; 665 } 666 667 if (first_error == 0) 668 first_error = error; 669 670 /* 671 * Some error have happened. Check our atomicity 672 * settings: continue if atomicity is not required, 673 * rollback changes otherwise. 674 */ 675 if ((flags & IPFW_CTF_ATOMIC) == 0) 676 continue; 677 678 rollback_added_entries(ch, tc, KIDX_TO_TI(ch, kidx), 679 tei, ta_buf_m, count, i); 680 681 rollback = 1; 682 break; 683 } 684 685 IPFW_WUNLOCK(ch); 686 687 ipfw_garbage_table_values(ch, tc, tei, count, rollback); 688 689 /* Permit post-add algorithm grow/rehash. */ 690 if (numadd != 0) 691 check_table_space(ch, NULL, tc, KIDX_TO_TI(ch, kidx), 0); 692 693 /* Return first error to user, if any */ 694 error = first_error; 695 696 cleanup: 697 IPFW_UH_WUNLOCK(ch); 698 699 flush_batch_buffer(ch, ta, tei, count, rollback, ta_buf_m, ta_buf); 700 701 return (error); 702 } 703 704 /* 705 * Deletes one or more entries in table @ti. 706 * 707 * Returns 0 on success. 708 */ 709 int 710 del_table_entry(struct ip_fw_chain *ch, struct tid_info *ti, 711 struct tentry_info *tei, uint8_t flags, uint32_t count) 712 { 713 struct table_config *tc; 714 struct table_algo *ta; 715 struct tentry_info *ptei; 716 uint16_t kidx; 717 int error, first_error, i; 718 uint32_t num, numdel; 719 char ta_buf[TA_BUF_SZ]; 720 caddr_t ta_buf_m, v; 721 722 /* 723 * Find and reference existing table. 724 */ 725 IPFW_UH_WLOCK(ch); 726 error = find_ref_table(ch, ti, tei, count, OP_DEL, &tc); 727 if (error != 0) { 728 IPFW_UH_WUNLOCK(ch); 729 return (error); 730 } 731 ta = tc->ta; 732 IPFW_UH_WUNLOCK(ch); 733 734 /* Allocate memory and prepare record(s) */ 735 /* Pass stack buffer by default */ 736 ta_buf_m = ta_buf; 737 error = prepare_batch_buffer(ch, ta, tei, count, OP_DEL, &ta_buf_m); 738 if (error != 0) 739 goto cleanup; 740 741 IPFW_UH_WLOCK(ch); 742 743 /* Drop reference we've used in first search */ 744 tc->no.refcnt--; 745 746 /* 747 * Check if table algo is still the same. 748 * (changed ta may be the result of table swap). 749 */ 750 if (ta != tc->ta) { 751 IPFW_UH_WUNLOCK(ch); 752 error = EINVAL; 753 goto cleanup; 754 } 755 756 kidx = tc->no.kidx; 757 numdel = 0; 758 first_error = 0; 759 760 IPFW_WLOCK(ch); 761 v = ta_buf_m; 762 for (i = 0; i < count; i++, v += ta->ta_buf_size) { 763 ptei = &tei[i]; 764 num = 0; 765 error = ta->del(tc->astate, KIDX_TO_TI(ch, kidx), ptei, v, 766 &num); 767 /* Save state for userland */ 768 store_tei_result(ptei, OP_DEL, error, num); 769 if (error != 0 && first_error == 0) 770 first_error = error; 771 tc->count -= num; 772 numdel += num; 773 } 774 IPFW_WUNLOCK(ch); 775 776 /* Unlink non-used values */ 777 ipfw_garbage_table_values(ch, tc, tei, count, 0); 778 779 if (numdel != 0) { 780 /* Run post-del hook to permit shrinking */ 781 check_table_space(ch, NULL, tc, KIDX_TO_TI(ch, kidx), 0); 782 } 783 784 IPFW_UH_WUNLOCK(ch); 785 786 /* Return first error to user, if any */ 787 error = first_error; 788 789 cleanup: 790 flush_batch_buffer(ch, ta, tei, count, 0, ta_buf_m, ta_buf); 791 792 return (error); 793 } 794 795 /* 796 * Ensure that table @tc has enough space to add @count entries without 797 * need for reallocation. 798 * 799 * Callbacks order: 800 * 0) need_modify() (UH_WLOCK) - checks if @count items can be added w/o resize. 801 * 802 * 1) alloc_modify (no locks, M_WAITOK) - alloc new state based on @pflags. 803 * 2) prepare_modifyt (UH_WLOCK) - copy old data into new storage 804 * 3) modify (UH_WLOCK + WLOCK) - switch pointers 805 * 4) flush_modify (UH_WLOCK) - free state, if needed 806 * 807 * Returns 0 on success. 808 */ 809 static int 810 check_table_space(struct ip_fw_chain *ch, struct tableop_state *ts, 811 struct table_config *tc, struct table_info *ti, uint32_t count) 812 { 813 struct table_algo *ta; 814 uint64_t pflags; 815 char ta_buf[TA_BUF_SZ]; 816 int error; 817 818 IPFW_UH_WLOCK_ASSERT(ch); 819 820 error = 0; 821 ta = tc->ta; 822 if (ta->need_modify == NULL) 823 return (0); 824 825 /* Acquire reference not to loose @tc between locks/unlocks */ 826 tc->no.refcnt++; 827 828 /* 829 * TODO: think about avoiding race between large add/large delete 830 * operation on algorithm which implements shrinking along with 831 * growing. 832 */ 833 while (true) { 834 pflags = 0; 835 if (ta->need_modify(tc->astate, ti, count, &pflags) == 0) { 836 error = 0; 837 break; 838 } 839 840 /* We have to shrink/grow table */ 841 if (ts != NULL) 842 add_toperation_state(ch, ts); 843 IPFW_UH_WUNLOCK(ch); 844 845 memset(&ta_buf, 0, sizeof(ta_buf)); 846 error = ta->prepare_mod(ta_buf, &pflags); 847 848 IPFW_UH_WLOCK(ch); 849 if (ts != NULL) 850 del_toperation_state(ch, ts); 851 852 if (error != 0) 853 break; 854 855 if (ts != NULL && ts->modified != 0) { 856 857 /* 858 * Swap operation has happened 859 * so we're currently operating on other 860 * table data. Stop doing this. 861 */ 862 ta->flush_mod(ta_buf); 863 break; 864 } 865 866 /* Check if we still need to alter table */ 867 ti = KIDX_TO_TI(ch, tc->no.kidx); 868 if (ta->need_modify(tc->astate, ti, count, &pflags) == 0) { 869 IPFW_UH_WUNLOCK(ch); 870 871 /* 872 * Other thread has already performed resize. 873 * Flush our state and return. 874 */ 875 ta->flush_mod(ta_buf); 876 break; 877 } 878 879 error = ta->fill_mod(tc->astate, ti, ta_buf, &pflags); 880 if (error == 0) { 881 /* Do actual modification */ 882 IPFW_WLOCK(ch); 883 ta->modify(tc->astate, ti, ta_buf, pflags); 884 IPFW_WUNLOCK(ch); 885 } 886 887 /* Anyway, flush data and retry */ 888 ta->flush_mod(ta_buf); 889 } 890 891 tc->no.refcnt--; 892 return (error); 893 } 894 895 /* 896 * Adds or deletes record in table. 897 * Data layout (v0): 898 * Request: [ ip_fw3_opheader ipfw_table_xentry ] 899 * 900 * Returns 0 on success 901 */ 902 static int 903 manage_table_ent_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 904 struct sockopt_data *sd) 905 { 906 ipfw_table_xentry *xent; 907 struct tentry_info tei; 908 struct tid_info ti; 909 struct table_value v; 910 int error, hdrlen, read; 911 912 hdrlen = offsetof(ipfw_table_xentry, k); 913 914 /* Check minimum header size */ 915 if (sd->valsize < (sizeof(*op3) + hdrlen)) 916 return (EINVAL); 917 918 read = sizeof(ip_fw3_opheader); 919 920 /* Check if xentry len field is valid */ 921 xent = (ipfw_table_xentry *)(op3 + 1); 922 if (xent->len < hdrlen || xent->len + read > sd->valsize) 923 return (EINVAL); 924 925 memset(&tei, 0, sizeof(tei)); 926 tei.paddr = &xent->k; 927 tei.masklen = xent->masklen; 928 ipfw_import_table_value_legacy(xent->value, &v); 929 tei.pvalue = &v; 930 /* Old requests compatibility */ 931 tei.flags = TEI_FLAGS_COMPAT; 932 if (xent->type == IPFW_TABLE_ADDR) { 933 if (xent->len - hdrlen == sizeof(in_addr_t)) 934 tei.subtype = AF_INET; 935 else 936 tei.subtype = AF_INET6; 937 } 938 939 memset(&ti, 0, sizeof(ti)); 940 ti.uidx = xent->tbl; 941 ti.type = xent->type; 942 943 error = (op3->opcode == IP_FW_TABLE_XADD) ? 944 add_table_entry(ch, &ti, &tei, 0, 1) : 945 del_table_entry(ch, &ti, &tei, 0, 1); 946 947 return (error); 948 } 949 950 /* 951 * Adds or deletes record in table. 952 * Data layout (v1)(current): 953 * Request: [ ipfw_obj_header 954 * ipfw_obj_ctlv(IPFW_TLV_TBLENT_LIST) [ ipfw_obj_tentry x N ] 955 * ] 956 * 957 * Returns 0 on success 958 */ 959 static int 960 manage_table_ent_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 961 struct sockopt_data *sd) 962 { 963 ipfw_obj_tentry *tent, *ptent; 964 ipfw_obj_ctlv *ctlv; 965 ipfw_obj_header *oh; 966 struct tentry_info *ptei, tei, *tei_buf; 967 struct tid_info ti; 968 int error, i, kidx, read; 969 970 /* Check minimum header size */ 971 if (sd->valsize < (sizeof(*oh) + sizeof(*ctlv))) 972 return (EINVAL); 973 974 /* Check if passed data is too long */ 975 if (sd->valsize != sd->kavail) 976 return (EINVAL); 977 978 oh = (ipfw_obj_header *)sd->kbuf; 979 980 /* Basic length checks for TLVs */ 981 if (oh->ntlv.head.length != sizeof(oh->ntlv)) 982 return (EINVAL); 983 984 read = sizeof(*oh); 985 986 ctlv = (ipfw_obj_ctlv *)(oh + 1); 987 if (ctlv->head.length + read != sd->valsize) 988 return (EINVAL); 989 990 read += sizeof(*ctlv); 991 tent = (ipfw_obj_tentry *)(ctlv + 1); 992 if (ctlv->count * sizeof(*tent) + read != sd->valsize) 993 return (EINVAL); 994 995 if (ctlv->count == 0) 996 return (0); 997 998 /* 999 * Mark entire buffer as "read". 1000 * This instructs sopt api write it back 1001 * after function return. 1002 */ 1003 ipfw_get_sopt_header(sd, sd->valsize); 1004 1005 /* Perform basic checks for each entry */ 1006 ptent = tent; 1007 kidx = tent->idx; 1008 for (i = 0; i < ctlv->count; i++, ptent++) { 1009 if (ptent->head.length != sizeof(*ptent)) 1010 return (EINVAL); 1011 if (ptent->idx != kidx) 1012 return (ENOTSUP); 1013 } 1014 1015 /* Convert data into kernel request objects */ 1016 objheader_to_ti(oh, &ti); 1017 ti.type = oh->ntlv.type; 1018 ti.uidx = kidx; 1019 1020 /* Use on-stack buffer for single add/del */ 1021 if (ctlv->count == 1) { 1022 memset(&tei, 0, sizeof(tei)); 1023 tei_buf = &tei; 1024 } else 1025 tei_buf = malloc(ctlv->count * sizeof(tei), M_TEMP, 1026 M_WAITOK | M_ZERO); 1027 1028 ptei = tei_buf; 1029 ptent = tent; 1030 for (i = 0; i < ctlv->count; i++, ptent++, ptei++) { 1031 ptei->paddr = &ptent->k; 1032 ptei->subtype = ptent->subtype; 1033 ptei->masklen = ptent->masklen; 1034 if (ptent->head.flags & IPFW_TF_UPDATE) 1035 ptei->flags |= TEI_FLAGS_UPDATE; 1036 1037 ipfw_import_table_value_v1(&ptent->v.value); 1038 ptei->pvalue = (struct table_value *)&ptent->v.value; 1039 } 1040 1041 error = (oh->opheader.opcode == IP_FW_TABLE_XADD) ? 1042 add_table_entry(ch, &ti, tei_buf, ctlv->flags, ctlv->count) : 1043 del_table_entry(ch, &ti, tei_buf, ctlv->flags, ctlv->count); 1044 1045 /* Translate result back to userland */ 1046 ptei = tei_buf; 1047 ptent = tent; 1048 for (i = 0; i < ctlv->count; i++, ptent++, ptei++) { 1049 if (ptei->flags & TEI_FLAGS_ADDED) 1050 ptent->result = IPFW_TR_ADDED; 1051 else if (ptei->flags & TEI_FLAGS_DELETED) 1052 ptent->result = IPFW_TR_DELETED; 1053 else if (ptei->flags & TEI_FLAGS_UPDATED) 1054 ptent->result = IPFW_TR_UPDATED; 1055 else if (ptei->flags & TEI_FLAGS_LIMIT) 1056 ptent->result = IPFW_TR_LIMIT; 1057 else if (ptei->flags & TEI_FLAGS_ERROR) 1058 ptent->result = IPFW_TR_ERROR; 1059 else if (ptei->flags & TEI_FLAGS_NOTFOUND) 1060 ptent->result = IPFW_TR_NOTFOUND; 1061 else if (ptei->flags & TEI_FLAGS_EXISTS) 1062 ptent->result = IPFW_TR_EXISTS; 1063 ipfw_export_table_value_v1(ptei->pvalue, &ptent->v.value); 1064 } 1065 1066 if (tei_buf != &tei) 1067 free(tei_buf, M_TEMP); 1068 1069 return (error); 1070 } 1071 1072 /* 1073 * Looks up an entry in given table. 1074 * Data layout (v0)(current): 1075 * Request: [ ipfw_obj_header ipfw_obj_tentry ] 1076 * Reply: [ ipfw_obj_header ipfw_obj_tentry ] 1077 * 1078 * Returns 0 on success 1079 */ 1080 static int 1081 find_table_entry(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1082 struct sockopt_data *sd) 1083 { 1084 ipfw_obj_tentry *tent; 1085 ipfw_obj_header *oh; 1086 struct tid_info ti; 1087 struct table_config *tc; 1088 struct table_algo *ta; 1089 struct table_info *kti; 1090 struct table_value *pval; 1091 struct namedobj_instance *ni; 1092 int error; 1093 size_t sz; 1094 1095 /* Check minimum header size */ 1096 sz = sizeof(*oh) + sizeof(*tent); 1097 if (sd->valsize != sz) 1098 return (EINVAL); 1099 1100 oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 1101 tent = (ipfw_obj_tentry *)(oh + 1); 1102 1103 /* Basic length checks for TLVs */ 1104 if (oh->ntlv.head.length != sizeof(oh->ntlv)) 1105 return (EINVAL); 1106 1107 objheader_to_ti(oh, &ti); 1108 ti.type = oh->ntlv.type; 1109 ti.uidx = tent->idx; 1110 1111 IPFW_UH_RLOCK(ch); 1112 ni = CHAIN_TO_NI(ch); 1113 1114 /* 1115 * Find existing table and check its type . 1116 */ 1117 ta = NULL; 1118 if ((tc = find_table(ni, &ti)) == NULL) { 1119 IPFW_UH_RUNLOCK(ch); 1120 return (ESRCH); 1121 } 1122 1123 /* check table type */ 1124 if (tc->no.subtype != ti.type) { 1125 IPFW_UH_RUNLOCK(ch); 1126 return (EINVAL); 1127 } 1128 1129 kti = KIDX_TO_TI(ch, tc->no.kidx); 1130 ta = tc->ta; 1131 1132 if (ta->find_tentry == NULL) 1133 return (ENOTSUP); 1134 1135 error = ta->find_tentry(tc->astate, kti, tent); 1136 if (error == 0) { 1137 pval = get_table_value(ch, tc, tent->v.kidx); 1138 ipfw_export_table_value_v1(pval, &tent->v.value); 1139 } 1140 IPFW_UH_RUNLOCK(ch); 1141 1142 return (error); 1143 } 1144 1145 /* 1146 * Flushes all entries or destroys given table. 1147 * Data layout (v0)(current): 1148 * Request: [ ipfw_obj_header ] 1149 * 1150 * Returns 0 on success 1151 */ 1152 static int 1153 flush_table_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1154 struct sockopt_data *sd) 1155 { 1156 int error; 1157 struct _ipfw_obj_header *oh; 1158 struct tid_info ti; 1159 1160 if (sd->valsize != sizeof(*oh)) 1161 return (EINVAL); 1162 1163 oh = (struct _ipfw_obj_header *)op3; 1164 objheader_to_ti(oh, &ti); 1165 1166 if (op3->opcode == IP_FW_TABLE_XDESTROY) 1167 error = destroy_table(ch, &ti); 1168 else if (op3->opcode == IP_FW_TABLE_XFLUSH) 1169 error = flush_table(ch, &ti); 1170 else 1171 return (ENOTSUP); 1172 1173 return (error); 1174 } 1175 1176 static void 1177 restart_flush(void *object, struct op_state *_state) 1178 { 1179 struct tableop_state *ts; 1180 1181 ts = (struct tableop_state *)_state; 1182 1183 if (ts->tc != object) 1184 return; 1185 1186 /* Indicate we've called */ 1187 ts->modified = 1; 1188 } 1189 1190 /* 1191 * Flushes given table. 1192 * 1193 * Function create new table instance with the same 1194 * parameters, swaps it with old one and 1195 * flushes state without holding runtime WLOCK. 1196 * 1197 * Returns 0 on success. 1198 */ 1199 int 1200 flush_table(struct ip_fw_chain *ch, struct tid_info *ti) 1201 { 1202 struct namedobj_instance *ni; 1203 struct table_config *tc; 1204 struct table_algo *ta; 1205 struct table_info ti_old, ti_new, *tablestate; 1206 void *astate_old, *astate_new; 1207 char algostate[64], *pstate; 1208 struct tableop_state ts; 1209 int error, need_gc; 1210 uint16_t kidx; 1211 uint8_t tflags; 1212 1213 /* 1214 * Stage 1: save table algorithm. 1215 * Reference found table to ensure it won't disappear. 1216 */ 1217 IPFW_UH_WLOCK(ch); 1218 ni = CHAIN_TO_NI(ch); 1219 if ((tc = find_table(ni, ti)) == NULL) { 1220 IPFW_UH_WUNLOCK(ch); 1221 return (ESRCH); 1222 } 1223 need_gc = 0; 1224 astate_new = NULL; 1225 memset(&ti_new, 0, sizeof(ti_new)); 1226 restart: 1227 /* Set up swap handler */ 1228 memset(&ts, 0, sizeof(ts)); 1229 ts.opstate.func = restart_flush; 1230 ts.tc = tc; 1231 1232 ta = tc->ta; 1233 /* Do not flush readonly tables */ 1234 if ((ta->flags & TA_FLAG_READONLY) != 0) { 1235 IPFW_UH_WUNLOCK(ch); 1236 return (EACCES); 1237 } 1238 /* Save startup algo parameters */ 1239 if (ta->print_config != NULL) { 1240 ta->print_config(tc->astate, KIDX_TO_TI(ch, tc->no.kidx), 1241 algostate, sizeof(algostate)); 1242 pstate = algostate; 1243 } else 1244 pstate = NULL; 1245 tflags = tc->tflags; 1246 tc->no.refcnt++; 1247 add_toperation_state(ch, &ts); 1248 IPFW_UH_WUNLOCK(ch); 1249 1250 /* 1251 * Stage 1.5: if this is not the first attempt, destroy previous state 1252 */ 1253 if (need_gc != 0) { 1254 ta->destroy(astate_new, &ti_new); 1255 need_gc = 0; 1256 } 1257 1258 /* 1259 * Stage 2: allocate new table instance using same algo. 1260 */ 1261 memset(&ti_new, 0, sizeof(struct table_info)); 1262 error = ta->init(ch, &astate_new, &ti_new, pstate, tflags); 1263 1264 /* 1265 * Stage 3: swap old state pointers with newly-allocated ones. 1266 * Decrease refcount. 1267 */ 1268 IPFW_UH_WLOCK(ch); 1269 tc->no.refcnt--; 1270 del_toperation_state(ch, &ts); 1271 1272 if (error != 0) { 1273 IPFW_UH_WUNLOCK(ch); 1274 return (error); 1275 } 1276 1277 /* 1278 * Restart operation if table swap has happened: 1279 * even if algo may be the same, algo init parameters 1280 * may change. Restart operation instead of doing 1281 * complex checks. 1282 */ 1283 if (ts.modified != 0) { 1284 /* Delay destroying data since we're holding UH lock */ 1285 need_gc = 1; 1286 goto restart; 1287 } 1288 1289 ni = CHAIN_TO_NI(ch); 1290 kidx = tc->no.kidx; 1291 tablestate = (struct table_info *)ch->tablestate; 1292 1293 IPFW_WLOCK(ch); 1294 ti_old = tablestate[kidx]; 1295 tablestate[kidx] = ti_new; 1296 IPFW_WUNLOCK(ch); 1297 1298 astate_old = tc->astate; 1299 tc->astate = astate_new; 1300 tc->ti_copy = ti_new; 1301 tc->count = 0; 1302 1303 /* Notify algo on real @ti address */ 1304 if (ta->change_ti != NULL) 1305 ta->change_ti(tc->astate, &tablestate[kidx]); 1306 1307 /* 1308 * Stage 4: unref values. 1309 */ 1310 ipfw_unref_table_values(ch, tc, ta, astate_old, &ti_old); 1311 IPFW_UH_WUNLOCK(ch); 1312 1313 /* 1314 * Stage 5: perform real flush/destroy. 1315 */ 1316 ta->destroy(astate_old, &ti_old); 1317 1318 return (0); 1319 } 1320 1321 /* 1322 * Swaps two tables. 1323 * Data layout (v0)(current): 1324 * Request: [ ipfw_obj_header ipfw_obj_ntlv ] 1325 * 1326 * Returns 0 on success 1327 */ 1328 static int 1329 swap_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1330 struct sockopt_data *sd) 1331 { 1332 int error; 1333 struct _ipfw_obj_header *oh; 1334 struct tid_info ti_a, ti_b; 1335 1336 if (sd->valsize != sizeof(*oh) + sizeof(ipfw_obj_ntlv)) 1337 return (EINVAL); 1338 1339 oh = (struct _ipfw_obj_header *)op3; 1340 ntlv_to_ti(&oh->ntlv, &ti_a); 1341 ntlv_to_ti((ipfw_obj_ntlv *)(oh + 1), &ti_b); 1342 1343 error = swap_tables(ch, &ti_a, &ti_b); 1344 1345 return (error); 1346 } 1347 1348 /* 1349 * Swaps two tables of the same type/valtype. 1350 * 1351 * Checks if tables are compatible and limits 1352 * permits swap, than actually perform swap. 1353 * 1354 * Each table consists of 2 different parts: 1355 * config: 1356 * @tc (with name, set, kidx) and rule bindings, which is "stable". 1357 * number of items 1358 * table algo 1359 * runtime: 1360 * runtime data @ti (ch->tablestate) 1361 * runtime cache in @tc 1362 * algo-specific data (@tc->astate) 1363 * 1364 * So we switch: 1365 * all runtime data 1366 * number of items 1367 * table algo 1368 * 1369 * After that we call @ti change handler for each table. 1370 * 1371 * Note that referencing @tc won't protect tc->ta from change. 1372 * XXX: Do we need to restrict swap between locked tables? 1373 * XXX: Do we need to exchange ftype? 1374 * 1375 * Returns 0 on success. 1376 */ 1377 static int 1378 swap_tables(struct ip_fw_chain *ch, struct tid_info *a, 1379 struct tid_info *b) 1380 { 1381 struct namedobj_instance *ni; 1382 struct table_config *tc_a, *tc_b; 1383 struct table_algo *ta; 1384 struct table_info ti, *tablestate; 1385 void *astate; 1386 uint32_t count; 1387 1388 /* 1389 * Stage 1: find both tables and ensure they are of 1390 * the same type. 1391 */ 1392 IPFW_UH_WLOCK(ch); 1393 ni = CHAIN_TO_NI(ch); 1394 if ((tc_a = find_table(ni, a)) == NULL) { 1395 IPFW_UH_WUNLOCK(ch); 1396 return (ESRCH); 1397 } 1398 if ((tc_b = find_table(ni, b)) == NULL) { 1399 IPFW_UH_WUNLOCK(ch); 1400 return (ESRCH); 1401 } 1402 1403 /* It is very easy to swap between the same table */ 1404 if (tc_a == tc_b) { 1405 IPFW_UH_WUNLOCK(ch); 1406 return (0); 1407 } 1408 1409 /* Check type and value are the same */ 1410 if (tc_a->no.subtype!=tc_b->no.subtype || tc_a->tflags!=tc_b->tflags) { 1411 IPFW_UH_WUNLOCK(ch); 1412 return (EINVAL); 1413 } 1414 1415 /* Check limits before swap */ 1416 if ((tc_a->limit != 0 && tc_b->count > tc_a->limit) || 1417 (tc_b->limit != 0 && tc_a->count > tc_b->limit)) { 1418 IPFW_UH_WUNLOCK(ch); 1419 return (EFBIG); 1420 } 1421 1422 /* Check if one of the tables is readonly */ 1423 if (((tc_a->ta->flags | tc_b->ta->flags) & TA_FLAG_READONLY) != 0) { 1424 IPFW_UH_WUNLOCK(ch); 1425 return (EACCES); 1426 } 1427 1428 /* Notify we're going to swap */ 1429 rollback_toperation_state(ch, tc_a); 1430 rollback_toperation_state(ch, tc_b); 1431 1432 /* Everything is fine, prepare to swap */ 1433 tablestate = (struct table_info *)ch->tablestate; 1434 ti = tablestate[tc_a->no.kidx]; 1435 ta = tc_a->ta; 1436 astate = tc_a->astate; 1437 count = tc_a->count; 1438 1439 IPFW_WLOCK(ch); 1440 /* a <- b */ 1441 tablestate[tc_a->no.kidx] = tablestate[tc_b->no.kidx]; 1442 tc_a->ta = tc_b->ta; 1443 tc_a->astate = tc_b->astate; 1444 tc_a->count = tc_b->count; 1445 /* b <- a */ 1446 tablestate[tc_b->no.kidx] = ti; 1447 tc_b->ta = ta; 1448 tc_b->astate = astate; 1449 tc_b->count = count; 1450 IPFW_WUNLOCK(ch); 1451 1452 /* Ensure tc.ti copies are in sync */ 1453 tc_a->ti_copy = tablestate[tc_a->no.kidx]; 1454 tc_b->ti_copy = tablestate[tc_b->no.kidx]; 1455 1456 /* Notify both tables on @ti change */ 1457 if (tc_a->ta->change_ti != NULL) 1458 tc_a->ta->change_ti(tc_a->astate, &tablestate[tc_a->no.kidx]); 1459 if (tc_b->ta->change_ti != NULL) 1460 tc_b->ta->change_ti(tc_b->astate, &tablestate[tc_b->no.kidx]); 1461 1462 IPFW_UH_WUNLOCK(ch); 1463 1464 return (0); 1465 } 1466 1467 /* 1468 * Destroys table specified by @ti. 1469 * Data layout (v0)(current): 1470 * Request: [ ip_fw3_opheader ] 1471 * 1472 * Returns 0 on success 1473 */ 1474 static int 1475 destroy_table(struct ip_fw_chain *ch, struct tid_info *ti) 1476 { 1477 struct namedobj_instance *ni; 1478 struct table_config *tc; 1479 1480 IPFW_UH_WLOCK(ch); 1481 1482 ni = CHAIN_TO_NI(ch); 1483 if ((tc = find_table(ni, ti)) == NULL) { 1484 IPFW_UH_WUNLOCK(ch); 1485 return (ESRCH); 1486 } 1487 1488 /* Do not permit destroying referenced tables */ 1489 if (tc->no.refcnt > 0) { 1490 IPFW_UH_WUNLOCK(ch); 1491 return (EBUSY); 1492 } 1493 1494 IPFW_WLOCK(ch); 1495 unlink_table(ch, tc); 1496 IPFW_WUNLOCK(ch); 1497 1498 /* Free obj index */ 1499 if (ipfw_objhash_free_idx(ni, tc->no.kidx) != 0) 1500 printf("Error unlinking kidx %d from table %s\n", 1501 tc->no.kidx, tc->tablename); 1502 1503 /* Unref values used in tables while holding UH lock */ 1504 ipfw_unref_table_values(ch, tc, tc->ta, tc->astate, &tc->ti_copy); 1505 IPFW_UH_WUNLOCK(ch); 1506 1507 free_table_config(ni, tc); 1508 1509 return (0); 1510 } 1511 1512 static uint32_t 1513 roundup2p(uint32_t v) 1514 { 1515 1516 v--; 1517 v |= v >> 1; 1518 v |= v >> 2; 1519 v |= v >> 4; 1520 v |= v >> 8; 1521 v |= v >> 16; 1522 v++; 1523 1524 return (v); 1525 } 1526 1527 /* 1528 * Grow tables index. 1529 * 1530 * Returns 0 on success. 1531 */ 1532 int 1533 ipfw_resize_tables(struct ip_fw_chain *ch, unsigned int ntables) 1534 { 1535 unsigned int ntables_old, tbl; 1536 struct namedobj_instance *ni; 1537 void *new_idx, *old_tablestate, *tablestate; 1538 struct table_info *ti; 1539 struct table_config *tc; 1540 int i, new_blocks; 1541 1542 /* Check new value for validity */ 1543 if (ntables == 0) 1544 return (EINVAL); 1545 if (ntables > IPFW_TABLES_MAX) 1546 ntables = IPFW_TABLES_MAX; 1547 /* Alight to nearest power of 2 */ 1548 ntables = (unsigned int)roundup2p(ntables); 1549 1550 /* Allocate new pointers */ 1551 tablestate = malloc(ntables * sizeof(struct table_info), 1552 M_IPFW, M_WAITOK | M_ZERO); 1553 1554 ipfw_objhash_bitmap_alloc(ntables, (void *)&new_idx, &new_blocks); 1555 1556 IPFW_UH_WLOCK(ch); 1557 1558 tbl = (ntables >= V_fw_tables_max) ? V_fw_tables_max : ntables; 1559 ni = CHAIN_TO_NI(ch); 1560 1561 /* Temporary restrict decreasing max_tables */ 1562 if (ntables < V_fw_tables_max) { 1563 1564 /* 1565 * FIXME: Check if we really can shrink 1566 */ 1567 IPFW_UH_WUNLOCK(ch); 1568 return (EINVAL); 1569 } 1570 1571 /* Copy table info/indices */ 1572 memcpy(tablestate, ch->tablestate, sizeof(struct table_info) * tbl); 1573 ipfw_objhash_bitmap_merge(ni, &new_idx, &new_blocks); 1574 1575 IPFW_WLOCK(ch); 1576 1577 /* Change pointers */ 1578 old_tablestate = ch->tablestate; 1579 ch->tablestate = tablestate; 1580 ipfw_objhash_bitmap_swap(ni, &new_idx, &new_blocks); 1581 1582 ntables_old = V_fw_tables_max; 1583 V_fw_tables_max = ntables; 1584 1585 IPFW_WUNLOCK(ch); 1586 1587 /* Notify all consumers that their @ti pointer has changed */ 1588 ti = (struct table_info *)ch->tablestate; 1589 for (i = 0; i < tbl; i++, ti++) { 1590 if (ti->lookup == NULL) 1591 continue; 1592 tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, i); 1593 if (tc == NULL || tc->ta->change_ti == NULL) 1594 continue; 1595 1596 tc->ta->change_ti(tc->astate, ti); 1597 } 1598 1599 IPFW_UH_WUNLOCK(ch); 1600 1601 /* Free old pointers */ 1602 free(old_tablestate, M_IPFW); 1603 ipfw_objhash_bitmap_free(new_idx, new_blocks); 1604 1605 return (0); 1606 } 1607 1608 /* 1609 * Lookup table's named object by its @kidx. 1610 */ 1611 struct named_object * 1612 ipfw_objhash_lookup_table_kidx(struct ip_fw_chain *ch, uint16_t kidx) 1613 { 1614 1615 return (ipfw_objhash_lookup_kidx(CHAIN_TO_NI(ch), kidx)); 1616 } 1617 1618 /* 1619 * Take reference to table specified in @ntlv. 1620 * On success return its @kidx. 1621 */ 1622 int 1623 ipfw_ref_table(struct ip_fw_chain *ch, ipfw_obj_ntlv *ntlv, uint16_t *kidx) 1624 { 1625 struct tid_info ti; 1626 struct table_config *tc; 1627 int error; 1628 1629 IPFW_UH_WLOCK_ASSERT(ch); 1630 1631 ntlv_to_ti(ntlv, &ti); 1632 error = find_table_err(CHAIN_TO_NI(ch), &ti, &tc); 1633 if (error != 0) 1634 return (error); 1635 1636 if (tc == NULL) 1637 return (ESRCH); 1638 1639 tc_ref(tc); 1640 *kidx = tc->no.kidx; 1641 1642 return (0); 1643 } 1644 1645 void 1646 ipfw_unref_table(struct ip_fw_chain *ch, uint16_t kidx) 1647 { 1648 1649 struct namedobj_instance *ni; 1650 struct named_object *no; 1651 1652 IPFW_UH_WLOCK_ASSERT(ch); 1653 ni = CHAIN_TO_NI(ch); 1654 no = ipfw_objhash_lookup_kidx(ni, kidx); 1655 KASSERT(no != NULL, ("Table with index %d not found", kidx)); 1656 no->refcnt--; 1657 } 1658 1659 /* 1660 * Lookup an arbtrary key @paddr of legth @plen in table @tbl. 1661 * Stores found value in @val. 1662 * 1663 * Returns 1 if key was found. 1664 */ 1665 int 1666 ipfw_lookup_table(struct ip_fw_chain *ch, uint16_t tbl, uint16_t plen, 1667 void *paddr, uint32_t *val) 1668 { 1669 struct table_info *ti; 1670 1671 ti = KIDX_TO_TI(ch, tbl); 1672 1673 return (ti->lookup(ti, paddr, plen, val)); 1674 } 1675 1676 /* 1677 * Info/List/dump support for tables. 1678 * 1679 */ 1680 1681 /* 1682 * High-level 'get' cmds sysctl handlers 1683 */ 1684 1685 /* 1686 * Lists all tables currently available in kernel. 1687 * Data layout (v0)(current): 1688 * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size 1689 * Reply: [ ipfw_obj_lheader ipfw_xtable_info x N ] 1690 * 1691 * Returns 0 on success 1692 */ 1693 static int 1694 list_tables(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1695 struct sockopt_data *sd) 1696 { 1697 struct _ipfw_obj_lheader *olh; 1698 int error; 1699 1700 olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh)); 1701 if (olh == NULL) 1702 return (EINVAL); 1703 if (sd->valsize < olh->size) 1704 return (EINVAL); 1705 1706 IPFW_UH_RLOCK(ch); 1707 error = export_tables(ch, olh, sd); 1708 IPFW_UH_RUNLOCK(ch); 1709 1710 return (error); 1711 } 1712 1713 /* 1714 * Store table info to buffer provided by @sd. 1715 * Data layout (v0)(current): 1716 * Request: [ ipfw_obj_header ipfw_xtable_info(empty)] 1717 * Reply: [ ipfw_obj_header ipfw_xtable_info ] 1718 * 1719 * Returns 0 on success. 1720 */ 1721 static int 1722 describe_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1723 struct sockopt_data *sd) 1724 { 1725 struct _ipfw_obj_header *oh; 1726 struct table_config *tc; 1727 struct tid_info ti; 1728 size_t sz; 1729 1730 sz = sizeof(*oh) + sizeof(ipfw_xtable_info); 1731 oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 1732 if (oh == NULL) 1733 return (EINVAL); 1734 1735 objheader_to_ti(oh, &ti); 1736 1737 IPFW_UH_RLOCK(ch); 1738 if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) { 1739 IPFW_UH_RUNLOCK(ch); 1740 return (ESRCH); 1741 } 1742 1743 export_table_info(ch, tc, (ipfw_xtable_info *)(oh + 1)); 1744 IPFW_UH_RUNLOCK(ch); 1745 1746 return (0); 1747 } 1748 1749 /* 1750 * Modifies existing table. 1751 * Data layout (v0)(current): 1752 * Request: [ ipfw_obj_header ipfw_xtable_info ] 1753 * 1754 * Returns 0 on success 1755 */ 1756 static int 1757 modify_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1758 struct sockopt_data *sd) 1759 { 1760 struct _ipfw_obj_header *oh; 1761 ipfw_xtable_info *i; 1762 char *tname; 1763 struct tid_info ti; 1764 struct namedobj_instance *ni; 1765 struct table_config *tc; 1766 1767 if (sd->valsize != sizeof(*oh) + sizeof(ipfw_xtable_info)) 1768 return (EINVAL); 1769 1770 oh = (struct _ipfw_obj_header *)sd->kbuf; 1771 i = (ipfw_xtable_info *)(oh + 1); 1772 1773 /* 1774 * Verify user-supplied strings. 1775 * Check for null-terminated/zero-length strings/ 1776 */ 1777 tname = oh->ntlv.name; 1778 if (check_table_name(tname) != 0) 1779 return (EINVAL); 1780 1781 objheader_to_ti(oh, &ti); 1782 ti.type = i->type; 1783 1784 IPFW_UH_WLOCK(ch); 1785 ni = CHAIN_TO_NI(ch); 1786 if ((tc = find_table(ni, &ti)) == NULL) { 1787 IPFW_UH_WUNLOCK(ch); 1788 return (ESRCH); 1789 } 1790 1791 /* Do not support any modifications for readonly tables */ 1792 if ((tc->ta->flags & TA_FLAG_READONLY) != 0) { 1793 IPFW_UH_WUNLOCK(ch); 1794 return (EACCES); 1795 } 1796 1797 if ((i->mflags & IPFW_TMFLAGS_LIMIT) != 0) 1798 tc->limit = i->limit; 1799 if ((i->mflags & IPFW_TMFLAGS_LOCK) != 0) 1800 tc->locked = ((i->flags & IPFW_TGFLAGS_LOCKED) != 0); 1801 IPFW_UH_WUNLOCK(ch); 1802 1803 return (0); 1804 } 1805 1806 /* 1807 * Creates new table. 1808 * Data layout (v0)(current): 1809 * Request: [ ipfw_obj_header ipfw_xtable_info ] 1810 * 1811 * Returns 0 on success 1812 */ 1813 static int 1814 create_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1815 struct sockopt_data *sd) 1816 { 1817 struct _ipfw_obj_header *oh; 1818 ipfw_xtable_info *i; 1819 char *tname, *aname; 1820 struct tid_info ti; 1821 struct namedobj_instance *ni; 1822 1823 if (sd->valsize != sizeof(*oh) + sizeof(ipfw_xtable_info)) 1824 return (EINVAL); 1825 1826 oh = (struct _ipfw_obj_header *)sd->kbuf; 1827 i = (ipfw_xtable_info *)(oh + 1); 1828 1829 /* 1830 * Verify user-supplied strings. 1831 * Check for null-terminated/zero-length strings/ 1832 */ 1833 tname = oh->ntlv.name; 1834 aname = i->algoname; 1835 if (check_table_name(tname) != 0 || 1836 strnlen(aname, sizeof(i->algoname)) == sizeof(i->algoname)) 1837 return (EINVAL); 1838 1839 if (aname[0] == '\0') { 1840 /* Use default algorithm */ 1841 aname = NULL; 1842 } 1843 1844 objheader_to_ti(oh, &ti); 1845 ti.type = i->type; 1846 1847 ni = CHAIN_TO_NI(ch); 1848 1849 IPFW_UH_RLOCK(ch); 1850 if (find_table(ni, &ti) != NULL) { 1851 IPFW_UH_RUNLOCK(ch); 1852 return (EEXIST); 1853 } 1854 IPFW_UH_RUNLOCK(ch); 1855 1856 return (create_table_internal(ch, &ti, aname, i, NULL, 0)); 1857 } 1858 1859 /* 1860 * Creates new table based on @ti and @aname. 1861 * 1862 * Assume @aname to be checked and valid. 1863 * Stores allocated table kidx inside @pkidx (if non-NULL). 1864 * Reference created table if @compat is non-zero. 1865 * 1866 * Returns 0 on success. 1867 */ 1868 static int 1869 create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti, 1870 char *aname, ipfw_xtable_info *i, uint16_t *pkidx, int compat) 1871 { 1872 struct namedobj_instance *ni; 1873 struct table_config *tc, *tc_new, *tmp; 1874 struct table_algo *ta; 1875 uint16_t kidx; 1876 1877 ni = CHAIN_TO_NI(ch); 1878 1879 ta = find_table_algo(CHAIN_TO_TCFG(ch), ti, aname); 1880 if (ta == NULL) 1881 return (ENOTSUP); 1882 1883 tc = alloc_table_config(ch, ti, ta, aname, i->tflags); 1884 if (tc == NULL) 1885 return (ENOMEM); 1886 1887 tc->vmask = i->vmask; 1888 tc->limit = i->limit; 1889 if (ta->flags & TA_FLAG_READONLY) 1890 tc->locked = 1; 1891 else 1892 tc->locked = (i->flags & IPFW_TGFLAGS_LOCKED) != 0; 1893 1894 IPFW_UH_WLOCK(ch); 1895 1896 /* Check if table has been already created */ 1897 tc_new = find_table(ni, ti); 1898 if (tc_new != NULL) { 1899 1900 /* 1901 * Compat: do not fail if we're 1902 * requesting to create existing table 1903 * which has the same type 1904 */ 1905 if (compat == 0 || tc_new->no.subtype != tc->no.subtype) { 1906 IPFW_UH_WUNLOCK(ch); 1907 free_table_config(ni, tc); 1908 return (EEXIST); 1909 } 1910 1911 /* Exchange tc and tc_new for proper refcounting & freeing */ 1912 tmp = tc; 1913 tc = tc_new; 1914 tc_new = tmp; 1915 } else { 1916 /* New table */ 1917 if (ipfw_objhash_alloc_idx(ni, &kidx) != 0) { 1918 IPFW_UH_WUNLOCK(ch); 1919 printf("Unable to allocate table index." 1920 " Consider increasing net.inet.ip.fw.tables_max"); 1921 free_table_config(ni, tc); 1922 return (EBUSY); 1923 } 1924 tc->no.kidx = kidx; 1925 tc->no.etlv = IPFW_TLV_TBL_NAME; 1926 1927 IPFW_WLOCK(ch); 1928 link_table(ch, tc); 1929 IPFW_WUNLOCK(ch); 1930 } 1931 1932 if (compat != 0) 1933 tc->no.refcnt++; 1934 if (pkidx != NULL) 1935 *pkidx = tc->no.kidx; 1936 1937 IPFW_UH_WUNLOCK(ch); 1938 1939 if (tc_new != NULL) 1940 free_table_config(ni, tc_new); 1941 1942 return (0); 1943 } 1944 1945 static void 1946 ntlv_to_ti(ipfw_obj_ntlv *ntlv, struct tid_info *ti) 1947 { 1948 1949 memset(ti, 0, sizeof(struct tid_info)); 1950 ti->set = ntlv->set; 1951 ti->uidx = ntlv->idx; 1952 ti->tlvs = ntlv; 1953 ti->tlen = ntlv->head.length; 1954 } 1955 1956 static void 1957 objheader_to_ti(struct _ipfw_obj_header *oh, struct tid_info *ti) 1958 { 1959 1960 ntlv_to_ti(&oh->ntlv, ti); 1961 } 1962 1963 struct namedobj_instance * 1964 ipfw_get_table_objhash(struct ip_fw_chain *ch) 1965 { 1966 1967 return (CHAIN_TO_NI(ch)); 1968 } 1969 1970 /* 1971 * Exports basic table info as name TLV. 1972 * Used inside dump_static_rules() to provide info 1973 * about all tables referenced by current ruleset. 1974 * 1975 * Returns 0 on success. 1976 */ 1977 int 1978 ipfw_export_table_ntlv(struct ip_fw_chain *ch, uint16_t kidx, 1979 struct sockopt_data *sd) 1980 { 1981 struct namedobj_instance *ni; 1982 struct named_object *no; 1983 ipfw_obj_ntlv *ntlv; 1984 1985 ni = CHAIN_TO_NI(ch); 1986 1987 no = ipfw_objhash_lookup_kidx(ni, kidx); 1988 KASSERT(no != NULL, ("invalid table kidx passed")); 1989 1990 ntlv = (ipfw_obj_ntlv *)ipfw_get_sopt_space(sd, sizeof(*ntlv)); 1991 if (ntlv == NULL) 1992 return (ENOMEM); 1993 1994 ntlv->head.type = IPFW_TLV_TBL_NAME; 1995 ntlv->head.length = sizeof(*ntlv); 1996 ntlv->idx = no->kidx; 1997 strlcpy(ntlv->name, no->name, sizeof(ntlv->name)); 1998 1999 return (0); 2000 } 2001 2002 struct dump_args { 2003 struct ip_fw_chain *ch; 2004 struct table_info *ti; 2005 struct table_config *tc; 2006 struct sockopt_data *sd; 2007 uint32_t cnt; 2008 uint16_t uidx; 2009 int error; 2010 uint32_t size; 2011 ipfw_table_entry *ent; 2012 ta_foreach_f *f; 2013 void *farg; 2014 ipfw_obj_tentry tent; 2015 }; 2016 2017 static int 2018 count_ext_entries(void *e, void *arg) 2019 { 2020 struct dump_args *da; 2021 2022 da = (struct dump_args *)arg; 2023 da->cnt++; 2024 2025 return (0); 2026 } 2027 2028 /* 2029 * Gets number of items from table either using 2030 * internal counter or calling algo callback for 2031 * externally-managed tables. 2032 * 2033 * Returns number of records. 2034 */ 2035 static uint32_t 2036 table_get_count(struct ip_fw_chain *ch, struct table_config *tc) 2037 { 2038 struct table_info *ti; 2039 struct table_algo *ta; 2040 struct dump_args da; 2041 2042 ti = KIDX_TO_TI(ch, tc->no.kidx); 2043 ta = tc->ta; 2044 2045 /* Use internal counter for self-managed tables */ 2046 if ((ta->flags & TA_FLAG_READONLY) == 0) 2047 return (tc->count); 2048 2049 /* Use callback to quickly get number of items */ 2050 if ((ta->flags & TA_FLAG_EXTCOUNTER) != 0) 2051 return (ta->get_count(tc->astate, ti)); 2052 2053 /* Count number of iterms ourselves */ 2054 memset(&da, 0, sizeof(da)); 2055 ta->foreach(tc->astate, ti, count_ext_entries, &da); 2056 2057 return (da.cnt); 2058 } 2059 2060 /* 2061 * Exports table @tc info into standard ipfw_xtable_info format. 2062 */ 2063 static void 2064 export_table_info(struct ip_fw_chain *ch, struct table_config *tc, 2065 ipfw_xtable_info *i) 2066 { 2067 struct table_info *ti; 2068 struct table_algo *ta; 2069 2070 i->type = tc->no.subtype; 2071 i->tflags = tc->tflags; 2072 i->vmask = tc->vmask; 2073 i->set = tc->no.set; 2074 i->kidx = tc->no.kidx; 2075 i->refcnt = tc->no.refcnt; 2076 i->count = table_get_count(ch, tc); 2077 i->limit = tc->limit; 2078 i->flags |= (tc->locked != 0) ? IPFW_TGFLAGS_LOCKED : 0; 2079 i->size = i->count * sizeof(ipfw_obj_tentry); 2080 i->size += sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info); 2081 strlcpy(i->tablename, tc->tablename, sizeof(i->tablename)); 2082 ti = KIDX_TO_TI(ch, tc->no.kidx); 2083 ta = tc->ta; 2084 if (ta->print_config != NULL) { 2085 /* Use algo function to print table config to string */ 2086 ta->print_config(tc->astate, ti, i->algoname, 2087 sizeof(i->algoname)); 2088 } else 2089 strlcpy(i->algoname, ta->name, sizeof(i->algoname)); 2090 /* Dump algo-specific data, if possible */ 2091 if (ta->dump_tinfo != NULL) { 2092 ta->dump_tinfo(tc->astate, ti, &i->ta_info); 2093 i->ta_info.flags |= IPFW_TATFLAGS_DATA; 2094 } 2095 } 2096 2097 struct dump_table_args { 2098 struct ip_fw_chain *ch; 2099 struct sockopt_data *sd; 2100 }; 2101 2102 static int 2103 export_table_internal(struct namedobj_instance *ni, struct named_object *no, 2104 void *arg) 2105 { 2106 ipfw_xtable_info *i; 2107 struct dump_table_args *dta; 2108 2109 dta = (struct dump_table_args *)arg; 2110 2111 i = (ipfw_xtable_info *)ipfw_get_sopt_space(dta->sd, sizeof(*i)); 2112 KASSERT(i != NULL, ("previously checked buffer is not enough")); 2113 2114 export_table_info(dta->ch, (struct table_config *)no, i); 2115 return (0); 2116 } 2117 2118 /* 2119 * Export all tables as ipfw_xtable_info structures to 2120 * storage provided by @sd. 2121 * 2122 * If supplied buffer is too small, fills in required size 2123 * and returns ENOMEM. 2124 * Returns 0 on success. 2125 */ 2126 static int 2127 export_tables(struct ip_fw_chain *ch, ipfw_obj_lheader *olh, 2128 struct sockopt_data *sd) 2129 { 2130 uint32_t size; 2131 uint32_t count; 2132 struct dump_table_args dta; 2133 2134 count = ipfw_objhash_count(CHAIN_TO_NI(ch)); 2135 size = count * sizeof(ipfw_xtable_info) + sizeof(ipfw_obj_lheader); 2136 2137 /* Fill in header regadless of buffer size */ 2138 olh->count = count; 2139 olh->objsize = sizeof(ipfw_xtable_info); 2140 2141 if (size > olh->size) { 2142 olh->size = size; 2143 return (ENOMEM); 2144 } 2145 2146 olh->size = size; 2147 2148 dta.ch = ch; 2149 dta.sd = sd; 2150 2151 ipfw_objhash_foreach(CHAIN_TO_NI(ch), export_table_internal, &dta); 2152 2153 return (0); 2154 } 2155 2156 /* 2157 * Dumps all table data 2158 * Data layout (v1)(current): 2159 * Request: [ ipfw_obj_header ], size = ipfw_xtable_info.size 2160 * Reply: [ ipfw_obj_header ipfw_xtable_info ipfw_obj_tentry x N ] 2161 * 2162 * Returns 0 on success 2163 */ 2164 static int 2165 dump_table_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 2166 struct sockopt_data *sd) 2167 { 2168 struct _ipfw_obj_header *oh; 2169 ipfw_xtable_info *i; 2170 struct tid_info ti; 2171 struct table_config *tc; 2172 struct table_algo *ta; 2173 struct dump_args da; 2174 uint32_t sz; 2175 2176 sz = sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info); 2177 oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 2178 if (oh == NULL) 2179 return (EINVAL); 2180 2181 i = (ipfw_xtable_info *)(oh + 1); 2182 objheader_to_ti(oh, &ti); 2183 2184 IPFW_UH_RLOCK(ch); 2185 if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) { 2186 IPFW_UH_RUNLOCK(ch); 2187 return (ESRCH); 2188 } 2189 export_table_info(ch, tc, i); 2190 2191 if (sd->valsize < i->size) { 2192 2193 /* 2194 * Submitted buffer size is not enough. 2195 * WE've already filled in @i structure with 2196 * relevant table info including size, so we 2197 * can return. Buffer will be flushed automatically. 2198 */ 2199 IPFW_UH_RUNLOCK(ch); 2200 return (ENOMEM); 2201 } 2202 2203 /* 2204 * Do the actual dump in eXtended format 2205 */ 2206 memset(&da, 0, sizeof(da)); 2207 da.ch = ch; 2208 da.ti = KIDX_TO_TI(ch, tc->no.kidx); 2209 da.tc = tc; 2210 da.sd = sd; 2211 2212 ta = tc->ta; 2213 2214 ta->foreach(tc->astate, da.ti, dump_table_tentry, &da); 2215 IPFW_UH_RUNLOCK(ch); 2216 2217 return (da.error); 2218 } 2219 2220 /* 2221 * Dumps all table data 2222 * Data layout (version 0)(legacy): 2223 * Request: [ ipfw_xtable ], size = IP_FW_TABLE_XGETSIZE() 2224 * Reply: [ ipfw_xtable ipfw_table_xentry x N ] 2225 * 2226 * Returns 0 on success 2227 */ 2228 static int 2229 dump_table_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 2230 struct sockopt_data *sd) 2231 { 2232 ipfw_xtable *xtbl; 2233 struct tid_info ti; 2234 struct table_config *tc; 2235 struct table_algo *ta; 2236 struct dump_args da; 2237 size_t sz, count; 2238 2239 xtbl = (ipfw_xtable *)ipfw_get_sopt_header(sd, sizeof(ipfw_xtable)); 2240 if (xtbl == NULL) 2241 return (EINVAL); 2242 2243 memset(&ti, 0, sizeof(ti)); 2244 ti.uidx = xtbl->tbl; 2245 2246 IPFW_UH_RLOCK(ch); 2247 if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) { 2248 IPFW_UH_RUNLOCK(ch); 2249 return (0); 2250 } 2251 count = table_get_count(ch, tc); 2252 sz = count * sizeof(ipfw_table_xentry) + sizeof(ipfw_xtable); 2253 2254 xtbl->cnt = count; 2255 xtbl->size = sz; 2256 xtbl->type = tc->no.subtype; 2257 xtbl->tbl = ti.uidx; 2258 2259 if (sd->valsize < sz) { 2260 2261 /* 2262 * Submitted buffer size is not enough. 2263 * WE've already filled in @i structure with 2264 * relevant table info including size, so we 2265 * can return. Buffer will be flushed automatically. 2266 */ 2267 IPFW_UH_RUNLOCK(ch); 2268 return (ENOMEM); 2269 } 2270 2271 /* Do the actual dump in eXtended format */ 2272 memset(&da, 0, sizeof(da)); 2273 da.ch = ch; 2274 da.ti = KIDX_TO_TI(ch, tc->no.kidx); 2275 da.tc = tc; 2276 da.sd = sd; 2277 2278 ta = tc->ta; 2279 2280 ta->foreach(tc->astate, da.ti, dump_table_xentry, &da); 2281 IPFW_UH_RUNLOCK(ch); 2282 2283 return (0); 2284 } 2285 2286 /* 2287 * Legacy function to retrieve number of items in table. 2288 */ 2289 static int 2290 get_table_size(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 2291 struct sockopt_data *sd) 2292 { 2293 uint32_t *tbl; 2294 struct tid_info ti; 2295 size_t sz; 2296 int error; 2297 2298 sz = sizeof(*op3) + sizeof(uint32_t); 2299 op3 = (ip_fw3_opheader *)ipfw_get_sopt_header(sd, sz); 2300 if (op3 == NULL) 2301 return (EINVAL); 2302 2303 tbl = (uint32_t *)(op3 + 1); 2304 memset(&ti, 0, sizeof(ti)); 2305 ti.uidx = *tbl; 2306 IPFW_UH_RLOCK(ch); 2307 error = ipfw_count_xtable(ch, &ti, tbl); 2308 IPFW_UH_RUNLOCK(ch); 2309 return (error); 2310 } 2311 2312 /* 2313 * Legacy IP_FW_TABLE_GETSIZE handler 2314 */ 2315 int 2316 ipfw_count_table(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt) 2317 { 2318 struct table_config *tc; 2319 2320 if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) 2321 return (ESRCH); 2322 *cnt = table_get_count(ch, tc); 2323 return (0); 2324 } 2325 2326 /* 2327 * Legacy IP_FW_TABLE_XGETSIZE handler 2328 */ 2329 int 2330 ipfw_count_xtable(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt) 2331 { 2332 struct table_config *tc; 2333 uint32_t count; 2334 2335 if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) { 2336 *cnt = 0; 2337 return (0); /* 'table all list' requires success */ 2338 } 2339 2340 count = table_get_count(ch, tc); 2341 *cnt = count * sizeof(ipfw_table_xentry); 2342 if (count > 0) 2343 *cnt += sizeof(ipfw_xtable); 2344 return (0); 2345 } 2346 2347 static int 2348 dump_table_entry(void *e, void *arg) 2349 { 2350 struct dump_args *da; 2351 struct table_config *tc; 2352 struct table_algo *ta; 2353 ipfw_table_entry *ent; 2354 struct table_value *pval; 2355 int error; 2356 2357 da = (struct dump_args *)arg; 2358 2359 tc = da->tc; 2360 ta = tc->ta; 2361 2362 /* Out of memory, returning */ 2363 if (da->cnt == da->size) 2364 return (1); 2365 ent = da->ent++; 2366 ent->tbl = da->uidx; 2367 da->cnt++; 2368 2369 error = ta->dump_tentry(tc->astate, da->ti, e, &da->tent); 2370 if (error != 0) 2371 return (error); 2372 2373 ent->addr = da->tent.k.addr.s_addr; 2374 ent->masklen = da->tent.masklen; 2375 pval = get_table_value(da->ch, da->tc, da->tent.v.kidx); 2376 ent->value = ipfw_export_table_value_legacy(pval); 2377 2378 return (0); 2379 } 2380 2381 /* 2382 * Dumps table in pre-8.1 legacy format. 2383 */ 2384 int 2385 ipfw_dump_table_legacy(struct ip_fw_chain *ch, struct tid_info *ti, 2386 ipfw_table *tbl) 2387 { 2388 struct table_config *tc; 2389 struct table_algo *ta; 2390 struct dump_args da; 2391 2392 tbl->cnt = 0; 2393 2394 if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) 2395 return (0); /* XXX: We should return ESRCH */ 2396 2397 ta = tc->ta; 2398 2399 /* This dump format supports IPv4 only */ 2400 if (tc->no.subtype != IPFW_TABLE_ADDR) 2401 return (0); 2402 2403 memset(&da, 0, sizeof(da)); 2404 da.ch = ch; 2405 da.ti = KIDX_TO_TI(ch, tc->no.kidx); 2406 da.tc = tc; 2407 da.ent = &tbl->ent[0]; 2408 da.size = tbl->size; 2409 2410 tbl->cnt = 0; 2411 ta->foreach(tc->astate, da.ti, dump_table_entry, &da); 2412 tbl->cnt = da.cnt; 2413 2414 return (0); 2415 } 2416 2417 /* 2418 * Dumps table entry in eXtended format (v1)(current). 2419 */ 2420 static int 2421 dump_table_tentry(void *e, void *arg) 2422 { 2423 struct dump_args *da; 2424 struct table_config *tc; 2425 struct table_algo *ta; 2426 struct table_value *pval; 2427 ipfw_obj_tentry *tent; 2428 int error; 2429 2430 da = (struct dump_args *)arg; 2431 2432 tc = da->tc; 2433 ta = tc->ta; 2434 2435 tent = (ipfw_obj_tentry *)ipfw_get_sopt_space(da->sd, sizeof(*tent)); 2436 /* Out of memory, returning */ 2437 if (tent == NULL) { 2438 da->error = ENOMEM; 2439 return (1); 2440 } 2441 tent->head.length = sizeof(ipfw_obj_tentry); 2442 tent->idx = da->uidx; 2443 2444 error = ta->dump_tentry(tc->astate, da->ti, e, tent); 2445 if (error != 0) 2446 return (error); 2447 2448 pval = get_table_value(da->ch, da->tc, tent->v.kidx); 2449 ipfw_export_table_value_v1(pval, &tent->v.value); 2450 2451 return (0); 2452 } 2453 2454 /* 2455 * Dumps table entry in eXtended format (v0). 2456 */ 2457 static int 2458 dump_table_xentry(void *e, void *arg) 2459 { 2460 struct dump_args *da; 2461 struct table_config *tc; 2462 struct table_algo *ta; 2463 ipfw_table_xentry *xent; 2464 ipfw_obj_tentry *tent; 2465 struct table_value *pval; 2466 int error; 2467 2468 da = (struct dump_args *)arg; 2469 2470 tc = da->tc; 2471 ta = tc->ta; 2472 2473 xent = (ipfw_table_xentry *)ipfw_get_sopt_space(da->sd, sizeof(*xent)); 2474 /* Out of memory, returning */ 2475 if (xent == NULL) 2476 return (1); 2477 xent->len = sizeof(ipfw_table_xentry); 2478 xent->tbl = da->uidx; 2479 2480 memset(&da->tent, 0, sizeof(da->tent)); 2481 tent = &da->tent; 2482 error = ta->dump_tentry(tc->astate, da->ti, e, tent); 2483 if (error != 0) 2484 return (error); 2485 2486 /* Convert current format to previous one */ 2487 xent->masklen = tent->masklen; 2488 pval = get_table_value(da->ch, da->tc, da->tent.v.kidx); 2489 xent->value = ipfw_export_table_value_legacy(pval); 2490 /* Apply some hacks */ 2491 if (tc->no.subtype == IPFW_TABLE_ADDR && tent->subtype == AF_INET) { 2492 xent->k.addr6.s6_addr32[3] = tent->k.addr.s_addr; 2493 xent->flags = IPFW_TCF_INET; 2494 } else 2495 memcpy(&xent->k, &tent->k, sizeof(xent->k)); 2496 2497 return (0); 2498 } 2499 2500 /* 2501 * Helper function to export table algo data 2502 * to tentry format before calling user function. 2503 * 2504 * Returns 0 on success. 2505 */ 2506 static int 2507 prepare_table_tentry(void *e, void *arg) 2508 { 2509 struct dump_args *da; 2510 struct table_config *tc; 2511 struct table_algo *ta; 2512 int error; 2513 2514 da = (struct dump_args *)arg; 2515 2516 tc = da->tc; 2517 ta = tc->ta; 2518 2519 error = ta->dump_tentry(tc->astate, da->ti, e, &da->tent); 2520 if (error != 0) 2521 return (error); 2522 2523 da->f(&da->tent, da->farg); 2524 2525 return (0); 2526 } 2527 2528 /* 2529 * Allow external consumers to read table entries in standard format. 2530 */ 2531 int 2532 ipfw_foreach_table_tentry(struct ip_fw_chain *ch, uint16_t kidx, 2533 ta_foreach_f *f, void *arg) 2534 { 2535 struct namedobj_instance *ni; 2536 struct table_config *tc; 2537 struct table_algo *ta; 2538 struct dump_args da; 2539 2540 ni = CHAIN_TO_NI(ch); 2541 2542 tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, kidx); 2543 if (tc == NULL) 2544 return (ESRCH); 2545 2546 ta = tc->ta; 2547 2548 memset(&da, 0, sizeof(da)); 2549 da.ch = ch; 2550 da.ti = KIDX_TO_TI(ch, tc->no.kidx); 2551 da.tc = tc; 2552 da.f = f; 2553 da.farg = arg; 2554 2555 ta->foreach(tc->astate, da.ti, prepare_table_tentry, &da); 2556 2557 return (0); 2558 } 2559 2560 /* 2561 * Table algorithms 2562 */ 2563 2564 /* 2565 * Finds algorithm by index, table type or supplied name. 2566 * 2567 * Returns pointer to algo or NULL. 2568 */ 2569 static struct table_algo * 2570 find_table_algo(struct tables_config *tcfg, struct tid_info *ti, char *name) 2571 { 2572 int i, l; 2573 struct table_algo *ta; 2574 2575 if (ti->type > IPFW_TABLE_MAXTYPE) 2576 return (NULL); 2577 2578 /* Search by index */ 2579 if (ti->atype != 0) { 2580 if (ti->atype > tcfg->algo_count) 2581 return (NULL); 2582 return (tcfg->algo[ti->atype]); 2583 } 2584 2585 if (name == NULL) { 2586 /* Return default algorithm for given type if set */ 2587 return (tcfg->def_algo[ti->type]); 2588 } 2589 2590 /* Search by name */ 2591 /* TODO: better search */ 2592 for (i = 1; i <= tcfg->algo_count; i++) { 2593 ta = tcfg->algo[i]; 2594 2595 /* 2596 * One can supply additional algorithm 2597 * parameters so we compare only the first word 2598 * of supplied name: 2599 * 'addr:chash hsize=32' 2600 * '^^^^^^^^^' 2601 * 2602 */ 2603 l = strlen(ta->name); 2604 if (strncmp(name, ta->name, l) != 0) 2605 continue; 2606 if (name[l] != '\0' && name[l] != ' ') 2607 continue; 2608 /* Check if we're requesting proper table type */ 2609 if (ti->type != 0 && ti->type != ta->type) 2610 return (NULL); 2611 return (ta); 2612 } 2613 2614 return (NULL); 2615 } 2616 2617 /* 2618 * Register new table algo @ta. 2619 * Stores algo id inside @idx. 2620 * 2621 * Returns 0 on success. 2622 */ 2623 int 2624 ipfw_add_table_algo(struct ip_fw_chain *ch, struct table_algo *ta, size_t size, 2625 int *idx) 2626 { 2627 struct tables_config *tcfg; 2628 struct table_algo *ta_new; 2629 size_t sz; 2630 2631 if (size > sizeof(struct table_algo)) 2632 return (EINVAL); 2633 2634 /* Check for the required on-stack size for add/del */ 2635 sz = roundup2(ta->ta_buf_size, sizeof(void *)); 2636 if (sz > TA_BUF_SZ) 2637 return (EINVAL); 2638 2639 KASSERT(ta->type <= IPFW_TABLE_MAXTYPE,("Increase IPFW_TABLE_MAXTYPE")); 2640 2641 /* Copy algorithm data to stable storage. */ 2642 ta_new = malloc(sizeof(struct table_algo), M_IPFW, M_WAITOK | M_ZERO); 2643 memcpy(ta_new, ta, size); 2644 2645 tcfg = CHAIN_TO_TCFG(ch); 2646 2647 KASSERT(tcfg->algo_count < 255, ("Increase algo array size")); 2648 2649 tcfg->algo[++tcfg->algo_count] = ta_new; 2650 ta_new->idx = tcfg->algo_count; 2651 2652 /* Set algorithm as default one for given type */ 2653 if ((ta_new->flags & TA_FLAG_DEFAULT) != 0 && 2654 tcfg->def_algo[ta_new->type] == NULL) 2655 tcfg->def_algo[ta_new->type] = ta_new; 2656 2657 *idx = ta_new->idx; 2658 2659 return (0); 2660 } 2661 2662 /* 2663 * Unregisters table algo using @idx as id. 2664 * XXX: It is NOT safe to call this function in any place 2665 * other than ipfw instance destroy handler. 2666 */ 2667 void 2668 ipfw_del_table_algo(struct ip_fw_chain *ch, int idx) 2669 { 2670 struct tables_config *tcfg; 2671 struct table_algo *ta; 2672 2673 tcfg = CHAIN_TO_TCFG(ch); 2674 2675 KASSERT(idx <= tcfg->algo_count, ("algo idx %d out of range 1..%d", 2676 idx, tcfg->algo_count)); 2677 2678 ta = tcfg->algo[idx]; 2679 KASSERT(ta != NULL, ("algo idx %d is NULL", idx)); 2680 2681 if (tcfg->def_algo[ta->type] == ta) 2682 tcfg->def_algo[ta->type] = NULL; 2683 2684 free(ta, M_IPFW); 2685 } 2686 2687 /* 2688 * Lists all table algorithms currently available. 2689 * Data layout (v0)(current): 2690 * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size 2691 * Reply: [ ipfw_obj_lheader ipfw_ta_info x N ] 2692 * 2693 * Returns 0 on success 2694 */ 2695 static int 2696 list_table_algo(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 2697 struct sockopt_data *sd) 2698 { 2699 struct _ipfw_obj_lheader *olh; 2700 struct tables_config *tcfg; 2701 ipfw_ta_info *i; 2702 struct table_algo *ta; 2703 uint32_t count, n, size; 2704 2705 olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh)); 2706 if (olh == NULL) 2707 return (EINVAL); 2708 if (sd->valsize < olh->size) 2709 return (EINVAL); 2710 2711 IPFW_UH_RLOCK(ch); 2712 tcfg = CHAIN_TO_TCFG(ch); 2713 count = tcfg->algo_count; 2714 size = count * sizeof(ipfw_ta_info) + sizeof(ipfw_obj_lheader); 2715 2716 /* Fill in header regadless of buffer size */ 2717 olh->count = count; 2718 olh->objsize = sizeof(ipfw_ta_info); 2719 2720 if (size > olh->size) { 2721 olh->size = size; 2722 IPFW_UH_RUNLOCK(ch); 2723 return (ENOMEM); 2724 } 2725 olh->size = size; 2726 2727 for (n = 1; n <= count; n++) { 2728 i = (ipfw_ta_info *)ipfw_get_sopt_space(sd, sizeof(*i)); 2729 KASSERT(i != NULL, ("previously checked buffer is not enough")); 2730 ta = tcfg->algo[n]; 2731 strlcpy(i->algoname, ta->name, sizeof(i->algoname)); 2732 i->type = ta->type; 2733 i->refcnt = ta->refcnt; 2734 } 2735 2736 IPFW_UH_RUNLOCK(ch); 2737 2738 return (0); 2739 } 2740 2741 static int 2742 classify_srcdst(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 2743 { 2744 /* Basic IPv4/IPv6 or u32 lookups */ 2745 *puidx = cmd->arg1; 2746 /* Assume ADDR by default */ 2747 *ptype = IPFW_TABLE_ADDR; 2748 int v; 2749 2750 if (F_LEN(cmd) > F_INSN_SIZE(ipfw_insn_u32)) { 2751 /* 2752 * generic lookup. The key must be 2753 * in 32bit big-endian format. 2754 */ 2755 v = ((ipfw_insn_u32 *)cmd)->d[1]; 2756 switch (v) { 2757 case 0: 2758 case 1: 2759 /* IPv4 src/dst */ 2760 break; 2761 case 2: 2762 case 3: 2763 /* src/dst port */ 2764 *ptype = IPFW_TABLE_NUMBER; 2765 break; 2766 case 4: 2767 /* uid/gid */ 2768 *ptype = IPFW_TABLE_NUMBER; 2769 break; 2770 case 5: 2771 /* jid */ 2772 *ptype = IPFW_TABLE_NUMBER; 2773 break; 2774 case 6: 2775 /* dscp */ 2776 *ptype = IPFW_TABLE_NUMBER; 2777 break; 2778 } 2779 } 2780 2781 return (0); 2782 } 2783 2784 static int 2785 classify_via(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 2786 { 2787 ipfw_insn_if *cmdif; 2788 2789 /* Interface table, possibly */ 2790 cmdif = (ipfw_insn_if *)cmd; 2791 if (cmdif->name[0] != '\1') 2792 return (1); 2793 2794 *ptype = IPFW_TABLE_INTERFACE; 2795 *puidx = cmdif->p.kidx; 2796 2797 return (0); 2798 } 2799 2800 static int 2801 classify_flow(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 2802 { 2803 2804 *puidx = cmd->arg1; 2805 *ptype = IPFW_TABLE_FLOW; 2806 2807 return (0); 2808 } 2809 2810 static void 2811 update_arg1(ipfw_insn *cmd, uint16_t idx) 2812 { 2813 2814 cmd->arg1 = idx; 2815 } 2816 2817 static void 2818 update_via(ipfw_insn *cmd, uint16_t idx) 2819 { 2820 ipfw_insn_if *cmdif; 2821 2822 cmdif = (ipfw_insn_if *)cmd; 2823 cmdif->p.kidx = idx; 2824 } 2825 2826 static int 2827 table_findbyname(struct ip_fw_chain *ch, struct tid_info *ti, 2828 struct named_object **pno) 2829 { 2830 struct table_config *tc; 2831 int error; 2832 2833 IPFW_UH_WLOCK_ASSERT(ch); 2834 2835 error = find_table_err(CHAIN_TO_NI(ch), ti, &tc); 2836 if (error != 0) 2837 return (error); 2838 2839 *pno = &tc->no; 2840 return (0); 2841 } 2842 2843 /* XXX: sets-sets! */ 2844 static struct named_object * 2845 table_findbykidx(struct ip_fw_chain *ch, uint16_t idx) 2846 { 2847 struct namedobj_instance *ni; 2848 struct table_config *tc; 2849 2850 IPFW_UH_WLOCK_ASSERT(ch); 2851 ni = CHAIN_TO_NI(ch); 2852 tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, idx); 2853 KASSERT(tc != NULL, ("Table with index %d not found", idx)); 2854 2855 return (&tc->no); 2856 } 2857 2858 static int 2859 table_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set, 2860 enum ipfw_sets_cmd cmd) 2861 { 2862 2863 switch (cmd) { 2864 case SWAP_ALL: 2865 case TEST_ALL: 2866 case MOVE_ALL: 2867 /* 2868 * Always return success, the real action and decision 2869 * should make table_manage_sets_all(). 2870 */ 2871 return (0); 2872 case TEST_ONE: 2873 case MOVE_ONE: 2874 /* 2875 * NOTE: we need to use ipfw_objhash_del/ipfw_objhash_add 2876 * if set number will be used in hash function. Currently 2877 * we can just use generic handler that replaces set value. 2878 */ 2879 if (V_fw_tables_sets == 0) 2880 return (0); 2881 break; 2882 case COUNT_ONE: 2883 /* 2884 * Return EOPNOTSUPP for COUNT_ONE when per-set sysctl is 2885 * disabled. This allow skip table's opcodes from additional 2886 * checks when specific rules moved to another set. 2887 */ 2888 if (V_fw_tables_sets == 0) 2889 return (EOPNOTSUPP); 2890 } 2891 /* Use generic sets handler when per-set sysctl is enabled. */ 2892 return (ipfw_obj_manage_sets(CHAIN_TO_NI(ch), IPFW_TLV_TBL_NAME, 2893 set, new_set, cmd)); 2894 } 2895 2896 /* 2897 * We register several opcode rewriters for lookup tables. 2898 * All tables opcodes have the same ETLV type, but different subtype. 2899 * To avoid invoking sets handler several times for XXX_ALL commands, 2900 * we use separate manage_sets handler. O_RECV has the lowest value, 2901 * so it should be called first. 2902 */ 2903 static int 2904 table_manage_sets_all(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set, 2905 enum ipfw_sets_cmd cmd) 2906 { 2907 2908 switch (cmd) { 2909 case SWAP_ALL: 2910 case TEST_ALL: 2911 /* 2912 * Return success for TEST_ALL, since nothing prevents 2913 * move rules from one set to another. All tables are 2914 * accessible from all sets when per-set tables sysctl 2915 * is disabled. 2916 */ 2917 case MOVE_ALL: 2918 if (V_fw_tables_sets == 0) 2919 return (0); 2920 break; 2921 default: 2922 return (table_manage_sets(ch, set, new_set, cmd)); 2923 } 2924 /* Use generic sets handler when per-set sysctl is enabled. */ 2925 return (ipfw_obj_manage_sets(CHAIN_TO_NI(ch), IPFW_TLV_TBL_NAME, 2926 set, new_set, cmd)); 2927 } 2928 2929 static struct opcode_obj_rewrite opcodes[] = { 2930 { 2931 .opcode = O_IP_SRC_LOOKUP, 2932 .etlv = IPFW_TLV_TBL_NAME, 2933 .classifier = classify_srcdst, 2934 .update = update_arg1, 2935 .find_byname = table_findbyname, 2936 .find_bykidx = table_findbykidx, 2937 .create_object = create_table_compat, 2938 .manage_sets = table_manage_sets, 2939 }, 2940 { 2941 .opcode = O_IP_DST_LOOKUP, 2942 .etlv = IPFW_TLV_TBL_NAME, 2943 .classifier = classify_srcdst, 2944 .update = update_arg1, 2945 .find_byname = table_findbyname, 2946 .find_bykidx = table_findbykidx, 2947 .create_object = create_table_compat, 2948 .manage_sets = table_manage_sets, 2949 }, 2950 { 2951 .opcode = O_IP_FLOW_LOOKUP, 2952 .etlv = IPFW_TLV_TBL_NAME, 2953 .classifier = classify_flow, 2954 .update = update_arg1, 2955 .find_byname = table_findbyname, 2956 .find_bykidx = table_findbykidx, 2957 .create_object = create_table_compat, 2958 .manage_sets = table_manage_sets, 2959 }, 2960 { 2961 .opcode = O_XMIT, 2962 .etlv = IPFW_TLV_TBL_NAME, 2963 .classifier = classify_via, 2964 .update = update_via, 2965 .find_byname = table_findbyname, 2966 .find_bykidx = table_findbykidx, 2967 .create_object = create_table_compat, 2968 .manage_sets = table_manage_sets, 2969 }, 2970 { 2971 .opcode = O_RECV, 2972 .etlv = IPFW_TLV_TBL_NAME, 2973 .classifier = classify_via, 2974 .update = update_via, 2975 .find_byname = table_findbyname, 2976 .find_bykidx = table_findbykidx, 2977 .create_object = create_table_compat, 2978 .manage_sets = table_manage_sets_all, 2979 }, 2980 { 2981 .opcode = O_VIA, 2982 .etlv = IPFW_TLV_TBL_NAME, 2983 .classifier = classify_via, 2984 .update = update_via, 2985 .find_byname = table_findbyname, 2986 .find_bykidx = table_findbykidx, 2987 .create_object = create_table_compat, 2988 .manage_sets = table_manage_sets, 2989 }, 2990 }; 2991 2992 static int 2993 test_sets_cb(struct namedobj_instance *ni __unused, struct named_object *no, 2994 void *arg __unused) 2995 { 2996 2997 /* Check that there aren't any tables in not default set */ 2998 if (no->set != 0) 2999 return (EBUSY); 3000 return (0); 3001 } 3002 3003 /* 3004 * Switch between "set 0" and "rule's set" table binding, 3005 * Check all ruleset bindings and permits changing 3006 * IFF each binding has both rule AND table in default set (set 0). 3007 * 3008 * Returns 0 on success. 3009 */ 3010 int 3011 ipfw_switch_tables_namespace(struct ip_fw_chain *ch, unsigned int sets) 3012 { 3013 struct opcode_obj_rewrite *rw; 3014 struct namedobj_instance *ni; 3015 struct named_object *no; 3016 struct ip_fw *rule; 3017 ipfw_insn *cmd; 3018 int cmdlen, i, l; 3019 uint16_t kidx; 3020 uint8_t subtype; 3021 3022 IPFW_UH_WLOCK(ch); 3023 3024 if (V_fw_tables_sets == sets) { 3025 IPFW_UH_WUNLOCK(ch); 3026 return (0); 3027 } 3028 ni = CHAIN_TO_NI(ch); 3029 if (sets == 0) { 3030 /* 3031 * Prevent disabling sets support if we have some tables 3032 * in not default sets. 3033 */ 3034 if (ipfw_objhash_foreach_type(ni, test_sets_cb, 3035 NULL, IPFW_TLV_TBL_NAME) != 0) { 3036 IPFW_UH_WUNLOCK(ch); 3037 return (EBUSY); 3038 } 3039 } 3040 /* 3041 * Scan all rules and examine tables opcodes. 3042 */ 3043 for (i = 0; i < ch->n_rules; i++) { 3044 rule = ch->map[i]; 3045 3046 l = rule->cmd_len; 3047 cmd = rule->cmd; 3048 cmdlen = 0; 3049 for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 3050 cmdlen = F_LEN(cmd); 3051 /* Check only tables opcodes */ 3052 for (kidx = 0, rw = opcodes; 3053 rw < opcodes + nitems(opcodes); rw++) { 3054 if (rw->opcode != cmd->opcode) 3055 continue; 3056 if (rw->classifier(cmd, &kidx, &subtype) == 0) 3057 break; 3058 } 3059 if (kidx == 0) 3060 continue; 3061 no = ipfw_objhash_lookup_kidx(ni, kidx); 3062 /* Check if both table object and rule has the set 0 */ 3063 if (no->set != 0 || rule->set != 0) { 3064 IPFW_UH_WUNLOCK(ch); 3065 return (EBUSY); 3066 } 3067 3068 } 3069 } 3070 V_fw_tables_sets = sets; 3071 IPFW_UH_WUNLOCK(ch); 3072 return (0); 3073 } 3074 3075 /* 3076 * Checks table name for validity. 3077 * Enforce basic length checks, the rest 3078 * should be done in userland. 3079 * 3080 * Returns 0 if name is considered valid. 3081 */ 3082 static int 3083 check_table_name(const char *name) 3084 { 3085 3086 /* 3087 * TODO: do some more complicated checks 3088 */ 3089 return (ipfw_check_object_name_generic(name)); 3090 } 3091 3092 /* 3093 * Finds table config based on either legacy index 3094 * or name in ntlv. 3095 * Note @ti structure contains unchecked data from userland. 3096 * 3097 * Returns 0 in success and fills in @tc with found config 3098 */ 3099 static int 3100 find_table_err(struct namedobj_instance *ni, struct tid_info *ti, 3101 struct table_config **tc) 3102 { 3103 char *name, bname[16]; 3104 struct named_object *no; 3105 ipfw_obj_ntlv *ntlv; 3106 uint32_t set; 3107 3108 if (ti->tlvs != NULL) { 3109 ntlv = ipfw_find_name_tlv_type(ti->tlvs, ti->tlen, ti->uidx, 3110 IPFW_TLV_TBL_NAME); 3111 if (ntlv == NULL) 3112 return (EINVAL); 3113 name = ntlv->name; 3114 3115 /* 3116 * Use set provided by @ti instead of @ntlv one. 3117 * This is needed due to different sets behavior 3118 * controlled by V_fw_tables_sets. 3119 */ 3120 set = (V_fw_tables_sets != 0) ? ti->set : 0; 3121 } else { 3122 snprintf(bname, sizeof(bname), "%d", ti->uidx); 3123 name = bname; 3124 set = 0; 3125 } 3126 3127 no = ipfw_objhash_lookup_name(ni, set, name); 3128 *tc = (struct table_config *)no; 3129 3130 return (0); 3131 } 3132 3133 /* 3134 * Finds table config based on either legacy index 3135 * or name in ntlv. 3136 * Note @ti structure contains unchecked data from userland. 3137 * 3138 * Returns pointer to table_config or NULL. 3139 */ 3140 static struct table_config * 3141 find_table(struct namedobj_instance *ni, struct tid_info *ti) 3142 { 3143 struct table_config *tc; 3144 3145 if (find_table_err(ni, ti, &tc) != 0) 3146 return (NULL); 3147 3148 return (tc); 3149 } 3150 3151 /* 3152 * Allocate new table config structure using 3153 * specified @algo and @aname. 3154 * 3155 * Returns pointer to config or NULL. 3156 */ 3157 static struct table_config * 3158 alloc_table_config(struct ip_fw_chain *ch, struct tid_info *ti, 3159 struct table_algo *ta, char *aname, uint8_t tflags) 3160 { 3161 char *name, bname[16]; 3162 struct table_config *tc; 3163 int error; 3164 ipfw_obj_ntlv *ntlv; 3165 uint32_t set; 3166 3167 if (ti->tlvs != NULL) { 3168 ntlv = ipfw_find_name_tlv_type(ti->tlvs, ti->tlen, ti->uidx, 3169 IPFW_TLV_TBL_NAME); 3170 if (ntlv == NULL) 3171 return (NULL); 3172 name = ntlv->name; 3173 set = ntlv->set; 3174 } else { 3175 /* Compat part: convert number to string representation */ 3176 snprintf(bname, sizeof(bname), "%d", ti->uidx); 3177 name = bname; 3178 set = 0; 3179 } 3180 3181 tc = malloc(sizeof(struct table_config), M_IPFW, M_WAITOK | M_ZERO); 3182 tc->no.name = tc->tablename; 3183 tc->no.subtype = ta->type; 3184 tc->no.set = set; 3185 tc->tflags = tflags; 3186 tc->ta = ta; 3187 strlcpy(tc->tablename, name, sizeof(tc->tablename)); 3188 /* Set "shared" value type by default */ 3189 tc->vshared = 1; 3190 3191 /* Preallocate data structures for new tables */ 3192 error = ta->init(ch, &tc->astate, &tc->ti_copy, aname, tflags); 3193 if (error != 0) { 3194 free(tc, M_IPFW); 3195 return (NULL); 3196 } 3197 3198 return (tc); 3199 } 3200 3201 /* 3202 * Destroys table state and config. 3203 */ 3204 static void 3205 free_table_config(struct namedobj_instance *ni, struct table_config *tc) 3206 { 3207 3208 KASSERT(tc->linked == 0, ("free() on linked config")); 3209 /* UH lock MUST NOT be held */ 3210 3211 /* 3212 * We're using ta without any locking/referencing. 3213 * TODO: fix this if we're going to use unloadable algos. 3214 */ 3215 tc->ta->destroy(tc->astate, &tc->ti_copy); 3216 free(tc, M_IPFW); 3217 } 3218 3219 /* 3220 * Links @tc to @chain table named instance. 3221 * Sets appropriate type/states in @chain table info. 3222 */ 3223 static void 3224 link_table(struct ip_fw_chain *ch, struct table_config *tc) 3225 { 3226 struct namedobj_instance *ni; 3227 struct table_info *ti; 3228 uint16_t kidx; 3229 3230 IPFW_UH_WLOCK_ASSERT(ch); 3231 IPFW_WLOCK_ASSERT(ch); 3232 3233 ni = CHAIN_TO_NI(ch); 3234 kidx = tc->no.kidx; 3235 3236 ipfw_objhash_add(ni, &tc->no); 3237 3238 ti = KIDX_TO_TI(ch, kidx); 3239 *ti = tc->ti_copy; 3240 3241 /* Notify algo on real @ti address */ 3242 if (tc->ta->change_ti != NULL) 3243 tc->ta->change_ti(tc->astate, ti); 3244 3245 tc->linked = 1; 3246 tc->ta->refcnt++; 3247 } 3248 3249 /* 3250 * Unlinks @tc from @chain table named instance. 3251 * Zeroes states in @chain and stores them in @tc. 3252 */ 3253 static void 3254 unlink_table(struct ip_fw_chain *ch, struct table_config *tc) 3255 { 3256 struct namedobj_instance *ni; 3257 struct table_info *ti; 3258 uint16_t kidx; 3259 3260 IPFW_UH_WLOCK_ASSERT(ch); 3261 IPFW_WLOCK_ASSERT(ch); 3262 3263 ni = CHAIN_TO_NI(ch); 3264 kidx = tc->no.kidx; 3265 3266 /* Clear state. @ti copy is already saved inside @tc */ 3267 ipfw_objhash_del(ni, &tc->no); 3268 ti = KIDX_TO_TI(ch, kidx); 3269 memset(ti, 0, sizeof(struct table_info)); 3270 tc->linked = 0; 3271 tc->ta->refcnt--; 3272 3273 /* Notify algo on real @ti address */ 3274 if (tc->ta->change_ti != NULL) 3275 tc->ta->change_ti(tc->astate, NULL); 3276 } 3277 3278 static struct ipfw_sopt_handler scodes[] = { 3279 { IP_FW_TABLE_XCREATE, 0, HDIR_SET, create_table }, 3280 { IP_FW_TABLE_XDESTROY, 0, HDIR_SET, flush_table_v0 }, 3281 { IP_FW_TABLE_XFLUSH, 0, HDIR_SET, flush_table_v0 }, 3282 { IP_FW_TABLE_XMODIFY, 0, HDIR_BOTH, modify_table }, 3283 { IP_FW_TABLE_XINFO, 0, HDIR_GET, describe_table }, 3284 { IP_FW_TABLES_XLIST, 0, HDIR_GET, list_tables }, 3285 { IP_FW_TABLE_XLIST, 0, HDIR_GET, dump_table_v0 }, 3286 { IP_FW_TABLE_XLIST, 1, HDIR_GET, dump_table_v1 }, 3287 { IP_FW_TABLE_XADD, 0, HDIR_BOTH, manage_table_ent_v0 }, 3288 { IP_FW_TABLE_XADD, 1, HDIR_BOTH, manage_table_ent_v1 }, 3289 { IP_FW_TABLE_XDEL, 0, HDIR_BOTH, manage_table_ent_v0 }, 3290 { IP_FW_TABLE_XDEL, 1, HDIR_BOTH, manage_table_ent_v1 }, 3291 { IP_FW_TABLE_XFIND, 0, HDIR_GET, find_table_entry }, 3292 { IP_FW_TABLE_XSWAP, 0, HDIR_SET, swap_table }, 3293 { IP_FW_TABLES_ALIST, 0, HDIR_GET, list_table_algo }, 3294 { IP_FW_TABLE_XGETSIZE, 0, HDIR_GET, get_table_size }, 3295 }; 3296 3297 static int 3298 destroy_table_locked(struct namedobj_instance *ni, struct named_object *no, 3299 void *arg) 3300 { 3301 3302 unlink_table((struct ip_fw_chain *)arg, (struct table_config *)no); 3303 if (ipfw_objhash_free_idx(ni, no->kidx) != 0) 3304 printf("Error unlinking kidx %d from table %s\n", 3305 no->kidx, no->name); 3306 free_table_config(ni, (struct table_config *)no); 3307 return (0); 3308 } 3309 3310 /* 3311 * Shuts tables module down. 3312 */ 3313 void 3314 ipfw_destroy_tables(struct ip_fw_chain *ch, int last) 3315 { 3316 3317 IPFW_DEL_SOPT_HANDLER(last, scodes); 3318 IPFW_DEL_OBJ_REWRITER(last, opcodes); 3319 3320 /* Remove all tables from working set */ 3321 IPFW_UH_WLOCK(ch); 3322 IPFW_WLOCK(ch); 3323 ipfw_objhash_foreach(CHAIN_TO_NI(ch), destroy_table_locked, ch); 3324 IPFW_WUNLOCK(ch); 3325 IPFW_UH_WUNLOCK(ch); 3326 3327 /* Free pointers itself */ 3328 free(ch->tablestate, M_IPFW); 3329 3330 ipfw_table_value_destroy(ch, last); 3331 ipfw_table_algo_destroy(ch); 3332 3333 ipfw_objhash_destroy(CHAIN_TO_NI(ch)); 3334 free(CHAIN_TO_TCFG(ch), M_IPFW); 3335 } 3336 3337 /* 3338 * Starts tables module. 3339 */ 3340 int 3341 ipfw_init_tables(struct ip_fw_chain *ch, int first) 3342 { 3343 struct tables_config *tcfg; 3344 3345 /* Allocate pointers */ 3346 ch->tablestate = malloc(V_fw_tables_max * sizeof(struct table_info), 3347 M_IPFW, M_WAITOK | M_ZERO); 3348 3349 tcfg = malloc(sizeof(struct tables_config), M_IPFW, M_WAITOK | M_ZERO); 3350 tcfg->namehash = ipfw_objhash_create(V_fw_tables_max); 3351 ch->tblcfg = tcfg; 3352 3353 ipfw_table_value_init(ch, first); 3354 ipfw_table_algo_init(ch); 3355 3356 IPFW_ADD_OBJ_REWRITER(first, opcodes); 3357 IPFW_ADD_SOPT_HANDLER(first, scodes); 3358 return (0); 3359 } 3360 3361 3362 3363