2 * Copyright (c) 2004 Ruslan Ermilov and Vsevolod Lobko.
3 * Copyright (c) 2014 Yandex LLC
4 * Copyright (c) 2014 Alexander V. Chernikov
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 #include <sys/cdefs.h>
29 __FBSDID("$FreeBSD$");
32 * Lookup table support for ipfw.
34 * This file contains handlers for all generic tables' operations:
35 * add/del/flush entries, list/dump tables etc..
37 * Table data modification is protected by both UH and runtime lock
38 * while reading configuration/data is protected by UH lock.
40 * Lookup algorithms for all table types are located in ip_fw_table_algo.c
45 #include <sys/param.h>
46 #include <sys/systm.h>
47 #include <sys/malloc.h>
48 #include <sys/kernel.h>
50 #include <sys/rwlock.h>
51 #include <sys/rmlock.h>
52 #include <sys/socket.h>
53 #include <sys/socketvar.h>
54 #include <sys/queue.h>
55 #include <net/if.h> /* ip_fw.h requires IFNAMSIZ */
58 #include <netinet/in.h>
59 #include <netinet/ip_var.h> /* struct ipfw_rule_ref */
60 #include <netinet/ip_fw.h>
62 #include <netpfil/ipfw/ip_fw_private.h>
63 #include <netpfil/ipfw/ip_fw_table.h>
66 * Table has the following `type` concepts:
68 * `no.type` represents lookup key type (addr, ifp, uid, etc..)
69 * vmask represents bitmask of table values which are present at the moment.
70 * Special IPFW_VTYPE_LEGACY ( (uint32_t)-1 ) represents old
71 * single-value-for-all approach.
74 struct named_object no;
75 uint8_t tflags; /* type flags */
76 uint8_t locked; /* 1 if locked from changes */
77 uint8_t linked; /* 1 if already linked */
78 uint8_t ochanged; /* used by set swapping */
79 uint8_t vshared; /* 1 if using shared value array */
81 uint32_t count; /* Number of records */
82 uint32_t limit; /* Max number of records */
83 uint32_t vmask; /* bitmask with supported values */
84 uint32_t ocount; /* used by set swapping */
85 uint64_t gencnt; /* generation count */
86 char tablename[64]; /* table name */
87 struct table_algo *ta; /* Callbacks for given algo */
88 void *astate; /* algorithm state */
89 struct table_info ti_copy; /* data to put to table_info */
90 struct namedobj_instance *vi;
93 static int find_table_err(struct namedobj_instance *ni, struct tid_info *ti,
94 struct table_config **tc);
95 static struct table_config *find_table(struct namedobj_instance *ni,
97 static struct table_config *alloc_table_config(struct ip_fw_chain *ch,
98 struct tid_info *ti, struct table_algo *ta, char *adata, uint8_t tflags);
99 static void free_table_config(struct namedobj_instance *ni,
100 struct table_config *tc);
101 static int create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti,
102 char *aname, ipfw_xtable_info *i, uint16_t *pkidx, int ref);
103 static void link_table(struct ip_fw_chain *ch, struct table_config *tc);
104 static void unlink_table(struct ip_fw_chain *ch, struct table_config *tc);
105 static int find_ref_table(struct ip_fw_chain *ch, struct tid_info *ti,
106 struct tentry_info *tei, uint32_t count, int op, struct table_config **ptc);
109 static int export_tables(struct ip_fw_chain *ch, ipfw_obj_lheader *olh,
110 struct sockopt_data *sd);
111 static void export_table_info(struct ip_fw_chain *ch, struct table_config *tc,
112 ipfw_xtable_info *i);
113 static int dump_table_tentry(void *e, void *arg);
114 static int dump_table_xentry(void *e, void *arg);
116 static int swap_tables(struct ip_fw_chain *ch, struct tid_info *a,
119 static int check_table_name(const char *name);
120 static int check_table_space(struct ip_fw_chain *ch, struct tableop_state *ts,
121 struct table_config *tc, struct table_info *ti, uint32_t count);
122 static int destroy_table(struct ip_fw_chain *ch, struct tid_info *ti);
124 static struct table_algo *find_table_algo(struct tables_config *tableconf,
125 struct tid_info *ti, char *name);
127 static void objheader_to_ti(struct _ipfw_obj_header *oh, struct tid_info *ti);
128 static void ntlv_to_ti(struct _ipfw_obj_ntlv *ntlv, struct tid_info *ti);
130 #define CHAIN_TO_NI(chain) (CHAIN_TO_TCFG(chain)->namehash)
131 #define KIDX_TO_TI(ch, k) (&(((struct table_info *)(ch)->tablestate)[k]))
133 #define TA_BUF_SZ 128 /* On-stack buffer for add/delete state */
136 rollback_toperation_state(struct ip_fw_chain *ch, void *object)
138 struct tables_config *tcfg;
141 tcfg = CHAIN_TO_TCFG(ch);
142 TAILQ_FOREACH(os, &tcfg->state_list, next)
143 os->func(object, os);
147 add_toperation_state(struct ip_fw_chain *ch, struct tableop_state *ts)
149 struct tables_config *tcfg;
151 tcfg = CHAIN_TO_TCFG(ch);
152 TAILQ_INSERT_HEAD(&tcfg->state_list, &ts->opstate, next);
156 del_toperation_state(struct ip_fw_chain *ch, struct tableop_state *ts)
158 struct tables_config *tcfg;
160 tcfg = CHAIN_TO_TCFG(ch);
161 TAILQ_REMOVE(&tcfg->state_list, &ts->opstate, next);
165 tc_ref(struct table_config *tc)
172 tc_unref(struct table_config *tc)
178 static struct table_value *
179 get_table_value(struct ip_fw_chain *ch, struct table_config *tc, uint32_t kidx)
181 struct table_value *pval;
183 pval = (struct table_value *)ch->valuestate;
185 return (&pval[kidx]);
190 * Checks if we're able to insert/update entry @tei into table
192 * May alter @tei to indicate insertion error / insert
195 * Returns 0 if operation can be performed/
198 check_table_limit(struct table_config *tc, struct tentry_info *tei)
201 if (tc->limit == 0 || tc->count < tc->limit)
204 if ((tei->flags & TEI_FLAGS_UPDATE) == 0) {
205 /* Notify userland on error cause */
206 tei->flags |= TEI_FLAGS_LIMIT;
211 * We have UPDATE flag set.
212 * Permit updating record (if found),
213 * but restrict adding new one since we've
214 * already hit the limit.
216 tei->flags |= TEI_FLAGS_DONTADD;
222 * Convert algorithm callback return code into
223 * one of pre-defined states known by userland.
226 store_tei_result(struct tentry_info *tei, int op, int error, uint32_t num)
234 if (op == OP_ADD && num != 0)
235 flag = TEI_FLAGS_ADDED;
237 flag = TEI_FLAGS_DELETED;
240 flag = TEI_FLAGS_NOTFOUND;
243 flag = TEI_FLAGS_EXISTS;
246 flag = TEI_FLAGS_ERROR;
253 * Creates and references table with default parameters.
254 * Saves table config, algo and allocated kidx info @ptc, @pta and
255 * @pkidx if non-zero.
256 * Used for table auto-creation to support old binaries.
258 * Returns 0 on success.
261 create_table_compat(struct ip_fw_chain *ch, struct tid_info *ti,
267 memset(&xi, 0, sizeof(xi));
268 /* Set default value mask for legacy clients */
269 xi.vmask = IPFW_VTYPE_LEGACY;
271 error = create_table_internal(ch, ti, NULL, &xi, pkidx, 1);
279 * Find and reference existing table optionally
282 * Saves found table config into @ptc.
283 * Note function may drop/acquire UH_WLOCK.
284 * Returns 0 if table was found/created and referenced
285 * or non-zero return code.
288 find_ref_table(struct ip_fw_chain *ch, struct tid_info *ti,
289 struct tentry_info *tei, uint32_t count, int op,
290 struct table_config **ptc)
292 struct namedobj_instance *ni;
293 struct table_config *tc;
297 IPFW_UH_WLOCK_ASSERT(ch);
299 ni = CHAIN_TO_NI(ch);
301 if ((tc = find_table(ni, ti)) != NULL) {
302 /* check table type */
303 if (tc->no.subtype != ti->type)
309 /* Try to exit early on limit hit */
310 if (op == OP_ADD && count == 1 &&
311 check_table_limit(tc, tei) != 0)
314 /* Reference and return */
323 /* Compatibility mode: create new table for old clients */
324 if ((tei->flags & TEI_FLAGS_COMPAT) == 0)
328 error = create_table_compat(ch, ti, &kidx);
334 tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, kidx);
335 KASSERT(tc != NULL, ("create_table_compat returned bad idx %d", kidx));
337 /* OK, now we've got referenced table. */
343 * Rolls back already @added to @tc entries using state array @ta_buf_m.
344 * Assume the following layout:
345 * 1) ADD state (ta_buf_m[0] ... t_buf_m[added - 1]) for handling update cases
346 * 2) DEL state (ta_buf_m[count[ ... t_buf_m[count + added - 1])
347 * for storing deleted state
350 rollback_added_entries(struct ip_fw_chain *ch, struct table_config *tc,
351 struct table_info *tinfo, struct tentry_info *tei, caddr_t ta_buf_m,
352 uint32_t count, uint32_t added)
354 struct table_algo *ta;
355 struct tentry_info *ptei;
361 IPFW_UH_WLOCK_ASSERT(ch);
364 ta_buf_sz = ta->ta_buf_size;
366 vv = v + count * ta_buf_sz;
367 for (i = 0; i < added; i++, v += ta_buf_sz, vv += ta_buf_sz) {
369 if ((ptei->flags & TEI_FLAGS_UPDATED) != 0) {
372 * We have old value stored by previous
373 * call in @ptei->value. Do add once again
376 error = ta->add(tc->astate, tinfo, ptei, v, &num);
377 KASSERT(error == 0, ("rollback UPDATE fail"));
378 KASSERT(num == 0, ("rollback UPDATE fail2"));
382 error = ta->prepare_del(ch, ptei, vv);
383 KASSERT(error == 0, ("pre-rollback INSERT failed"));
384 error = ta->del(tc->astate, tinfo, ptei, vv, &num);
385 KASSERT(error == 0, ("rollback INSERT failed"));
391 * Prepares add/del state for all @count entries in @tei.
392 * Uses either stack buffer (@ta_buf) or allocates a new one.
393 * Stores pointer to allocated buffer back to @ta_buf.
395 * Returns 0 on success.
398 prepare_batch_buffer(struct ip_fw_chain *ch, struct table_algo *ta,
399 struct tentry_info *tei, uint32_t count, int op, caddr_t *ta_buf)
402 size_t ta_buf_sz, sz;
403 struct tentry_info *ptei;
407 ta_buf_sz = ta->ta_buf_size;
409 /* Single add/delete, use on-stack buffer */
410 memset(*ta_buf, 0, TA_BUF_SZ);
415 * Multiple adds/deletes, allocate larger buffer
417 * Note we need 2xcount buffer for add case:
418 * we have hold both ADD state
419 * and DELETE state (this may be needed
420 * if we need to rollback all changes)
422 sz = count * ta_buf_sz;
423 ta_buf_m = malloc((op == OP_ADD) ? sz * 2 : sz, M_TEMP,
428 for (i = 0; i < count; i++, v += ta_buf_sz) {
430 error = (op == OP_ADD) ?
431 ta->prepare_add(ch, ptei, v) : ta->prepare_del(ch, ptei, v);
434 * Some syntax error (incorrect mask, or address, or
435 * anything). Return error regardless of atomicity
447 * Flushes allocated state for each @count entries in @tei.
448 * Frees @ta_buf_m if differs from stack buffer @ta_buf.
451 flush_batch_buffer(struct ip_fw_chain *ch, struct table_algo *ta,
452 struct tentry_info *tei, uint32_t count, int rollback,
453 caddr_t ta_buf_m, caddr_t ta_buf)
456 struct tentry_info *ptei;
460 ta_buf_sz = ta->ta_buf_size;
462 /* Run cleaning callback anyway */
464 for (i = 0; i < count; i++, v += ta_buf_sz) {
466 ta->flush_entry(ch, ptei, v);
467 if (ptei->ptv != NULL) {
468 free(ptei->ptv, M_IPFW);
473 /* Clean up "deleted" state in case of rollback */
475 v = ta_buf_m + count * ta_buf_sz;
476 for (i = 0; i < count; i++, v += ta_buf_sz)
477 ta->flush_entry(ch, &tei[i], v);
480 if (ta_buf_m != ta_buf)
481 free(ta_buf_m, M_TEMP);
486 rollback_add_entry(void *object, struct op_state *_state)
488 struct ip_fw_chain *ch;
489 struct tableop_state *ts;
491 ts = (struct tableop_state *)_state;
493 if (ts->tc != object && ts->ch != object)
498 IPFW_UH_WLOCK_ASSERT(ch);
500 /* Call specifid unlockers */
501 rollback_table_values(ts);
503 /* Indicate we've called */
508 * Adds/updates one or more entries in table @ti.
510 * Function may drop/reacquire UH wlock multiple times due to
511 * items alloc, algorithm callbacks (check_space), value linkage
512 * (new values, value storage realloc), etc..
513 * Other processes like other adds (which may involve storage resize),
514 * table swaps (which changes table data and may change algo type),
515 * table modify (which may change value mask) may be executed
516 * simultaneously so we need to deal with it.
518 * The following approach was implemented:
519 * we have per-chain linked list, protected with UH lock.
520 * add_table_entry prepares special on-stack structure wthich is passed
521 * to its descendants. Users add this structure to this list before unlock.
522 * After performing needed operations and acquiring UH lock back, each user
523 * checks if structure has changed. If true, it rolls local state back and
524 * returns without error to the caller.
525 * add_table_entry() on its own checks if structure has changed and restarts
526 * its operation from the beginning (goto restart).
528 * Functions which are modifying fields of interest (currently
529 * resize_shared_value_storage() and swap_tables() )
530 * traverses given list while holding UH lock immediately before
531 * performing their operations calling function provided be list entry
532 * ( currently rollback_add_entry ) which performs rollback for all necessary
533 * state and sets appropriate values in structure indicating rollback
537 * Function references @ti first to ensure table won't
538 * disappear or change its type.
539 * After that, prepare_add callback is called for each @tei entry.
540 * Next, we try to add each entry under UH+WHLOCK
541 * using add() callback.
542 * Finally, we free all state by calling flush_entry callback
545 * Returns 0 on success.
548 add_table_entry(struct ip_fw_chain *ch, struct tid_info *ti,
549 struct tentry_info *tei, uint8_t flags, uint32_t count)
551 struct table_config *tc;
552 struct table_algo *ta;
554 int error, first_error, i, rollback;
555 uint32_t num, numadd;
556 struct tentry_info *ptei;
557 struct tableop_state ts;
558 char ta_buf[TA_BUF_SZ];
561 memset(&ts, 0, sizeof(ts));
566 * Find and reference existing table.
569 if (ts.modified != 0) {
571 flush_batch_buffer(ch, ta, tei, count, rollback,
573 memset(&ts, 0, sizeof(ts));
578 error = find_ref_table(ch, ti, tei, count, OP_ADD, &tc);
585 /* Fill in tablestate */
587 ts.opstate.func = rollback_add_entry;
589 ts.vshared = tc->vshared;
590 ts.vmask = tc->vmask;
595 add_toperation_state(ch, &ts);
598 /* Allocate memory and prepare record(s) */
599 /* Pass stack buffer by default */
601 error = prepare_batch_buffer(ch, ta, tei, count, OP_ADD, &ta_buf_m);
604 del_toperation_state(ch, &ts);
605 /* Drop reference we've used in first search */
608 /* Check prepare_batch_buffer() error */
613 * Check if table swap has happened.
614 * (so table algo might be changed).
615 * Restart operation to achieve consistent behavior.
617 if (ts.modified != 0)
621 * Link all values values to shared/per-table value array.
623 * May release/reacquire UH_WLOCK.
625 error = ipfw_link_table_values(ch, &ts);
628 if (ts.modified != 0)
632 * Ensure we are able to add all entries without additional
633 * memory allocations. May release/reacquire UH_WLOCK.
636 error = check_table_space(ch, &ts, tc, KIDX_TO_TI(ch, kidx), count);
639 if (ts.modified != 0)
642 /* We've got valid table in @tc. Let's try to add data */
651 for (i = 0; i < count; i++, v += ta->ta_buf_size) {
654 /* check limit before adding */
655 if ((error = check_table_limit(tc, ptei)) == 0) {
656 error = ta->add(tc->astate, KIDX_TO_TI(ch, kidx),
658 /* Set status flag to inform userland */
659 store_tei_result(ptei, OP_ADD, error, num);
662 /* Update number of records to ease limit checking */
668 if (first_error == 0)
672 * Some error have happened. Check our atomicity
673 * settings: continue if atomicity is not required,
674 * rollback changes otherwise.
676 if ((flags & IPFW_CTF_ATOMIC) == 0)
679 rollback_added_entries(ch, tc, KIDX_TO_TI(ch, kidx),
680 tei, ta_buf_m, count, i);
688 ipfw_garbage_table_values(ch, tc, tei, count, rollback);
690 /* Permit post-add algorithm grow/rehash. */
692 check_table_space(ch, NULL, tc, KIDX_TO_TI(ch, kidx), 0);
694 /* Return first error to user, if any */
700 flush_batch_buffer(ch, ta, tei, count, rollback, ta_buf_m, ta_buf);
706 * Deletes one or more entries in table @ti.
708 * Returns 0 on success.
711 del_table_entry(struct ip_fw_chain *ch, struct tid_info *ti,
712 struct tentry_info *tei, uint8_t flags, uint32_t count)
714 struct table_config *tc;
715 struct table_algo *ta;
716 struct tentry_info *ptei;
718 int error, first_error, i;
719 uint32_t num, numdel;
720 char ta_buf[TA_BUF_SZ];
724 * Find and reference existing table.
727 error = find_ref_table(ch, ti, tei, count, OP_DEL, &tc);
735 /* Allocate memory and prepare record(s) */
736 /* Pass stack buffer by default */
738 error = prepare_batch_buffer(ch, ta, tei, count, OP_DEL, &ta_buf_m);
744 /* Drop reference we've used in first search */
748 * Check if table algo is still the same.
749 * (changed ta may be the result of table swap).
763 for (i = 0; i < count; i++, v += ta->ta_buf_size) {
766 error = ta->del(tc->astate, KIDX_TO_TI(ch, kidx), ptei, v,
768 /* Save state for userland */
769 store_tei_result(ptei, OP_DEL, error, num);
770 if (error != 0 && first_error == 0)
777 /* Unlink non-used values */
778 ipfw_garbage_table_values(ch, tc, tei, count, 0);
781 /* Run post-del hook to permit shrinking */
782 check_table_space(ch, NULL, tc, KIDX_TO_TI(ch, kidx), 0);
787 /* Return first error to user, if any */
791 flush_batch_buffer(ch, ta, tei, count, 0, ta_buf_m, ta_buf);
797 * Ensure that table @tc has enough space to add @count entries without
798 * need for reallocation.
801 * 0) need_modify() (UH_WLOCK) - checks if @count items can be added w/o resize.
803 * 1) alloc_modify (no locks, M_WAITOK) - alloc new state based on @pflags.
804 * 2) prepare_modifyt (UH_WLOCK) - copy old data into new storage
805 * 3) modify (UH_WLOCK + WLOCK) - switch pointers
806 * 4) flush_modify (UH_WLOCK) - free state, if needed
808 * Returns 0 on success.
811 check_table_space(struct ip_fw_chain *ch, struct tableop_state *ts,
812 struct table_config *tc, struct table_info *ti, uint32_t count)
814 struct table_algo *ta;
816 char ta_buf[TA_BUF_SZ];
819 IPFW_UH_WLOCK_ASSERT(ch);
823 if (ta->need_modify == NULL)
826 /* Acquire reference not to loose @tc between locks/unlocks */
830 * TODO: think about avoiding race between large add/large delete
831 * operation on algorithm which implements shrinking along with
836 if (ta->need_modify(tc->astate, ti, count, &pflags) == 0) {
841 /* We have to shrink/grow table */
843 add_toperation_state(ch, ts);
846 memset(&ta_buf, 0, sizeof(ta_buf));
847 error = ta->prepare_mod(ta_buf, &pflags);
851 del_toperation_state(ch, ts);
856 if (ts != NULL && ts->modified != 0) {
859 * Swap operation has happened
860 * so we're currently operating on other
861 * table data. Stop doing this.
863 ta->flush_mod(ta_buf);
867 /* Check if we still need to alter table */
868 ti = KIDX_TO_TI(ch, tc->no.kidx);
869 if (ta->need_modify(tc->astate, ti, count, &pflags) == 0) {
873 * Other thread has already performed resize.
874 * Flush our state and return.
876 ta->flush_mod(ta_buf);
880 error = ta->fill_mod(tc->astate, ti, ta_buf, &pflags);
882 /* Do actual modification */
884 ta->modify(tc->astate, ti, ta_buf, pflags);
888 /* Anyway, flush data and retry */
889 ta->flush_mod(ta_buf);
897 * Adds or deletes record in table.
899 * Request: [ ip_fw3_opheader ipfw_table_xentry ]
901 * Returns 0 on success
904 manage_table_ent_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
905 struct sockopt_data *sd)
907 ipfw_table_xentry *xent;
908 struct tentry_info tei;
910 struct table_value v;
911 int error, hdrlen, read;
913 hdrlen = offsetof(ipfw_table_xentry, k);
915 /* Check minimum header size */
916 if (sd->valsize < (sizeof(*op3) + hdrlen))
919 read = sizeof(ip_fw3_opheader);
921 /* Check if xentry len field is valid */
922 xent = (ipfw_table_xentry *)(op3 + 1);
923 if (xent->len < hdrlen || xent->len + read > sd->valsize)
926 memset(&tei, 0, sizeof(tei));
927 tei.paddr = &xent->k;
928 tei.masklen = xent->masklen;
929 ipfw_import_table_value_legacy(xent->value, &v);
931 /* Old requests compatibility */
932 tei.flags = TEI_FLAGS_COMPAT;
933 if (xent->type == IPFW_TABLE_ADDR) {
934 if (xent->len - hdrlen == sizeof(in_addr_t))
935 tei.subtype = AF_INET;
937 tei.subtype = AF_INET6;
940 memset(&ti, 0, sizeof(ti));
942 ti.type = xent->type;
944 error = (op3->opcode == IP_FW_TABLE_XADD) ?
945 add_table_entry(ch, &ti, &tei, 0, 1) :
946 del_table_entry(ch, &ti, &tei, 0, 1);
952 * Adds or deletes record in table.
953 * Data layout (v1)(current):
954 * Request: [ ipfw_obj_header
955 * ipfw_obj_ctlv(IPFW_TLV_TBLENT_LIST) [ ipfw_obj_tentry x N ]
958 * Returns 0 on success
961 manage_table_ent_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
962 struct sockopt_data *sd)
964 ipfw_obj_tentry *tent, *ptent;
967 struct tentry_info *ptei, tei, *tei_buf;
969 int error, i, kidx, read;
971 /* Check minimum header size */
972 if (sd->valsize < (sizeof(*oh) + sizeof(*ctlv)))
975 /* Check if passed data is too long */
976 if (sd->valsize != sd->kavail)
979 oh = (ipfw_obj_header *)sd->kbuf;
981 /* Basic length checks for TLVs */
982 if (oh->ntlv.head.length != sizeof(oh->ntlv))
987 ctlv = (ipfw_obj_ctlv *)(oh + 1);
988 if (ctlv->head.length + read != sd->valsize)
991 read += sizeof(*ctlv);
992 tent = (ipfw_obj_tentry *)(ctlv + 1);
993 if (ctlv->count * sizeof(*tent) + read != sd->valsize)
996 if (ctlv->count == 0)
1000 * Mark entire buffer as "read".
1001 * This instructs sopt api write it back
1002 * after function return.
1004 ipfw_get_sopt_header(sd, sd->valsize);
1006 /* Perform basic checks for each entry */
1009 for (i = 0; i < ctlv->count; i++, ptent++) {
1010 if (ptent->head.length != sizeof(*ptent))
1012 if (ptent->idx != kidx)
1016 /* Convert data into kernel request objects */
1017 objheader_to_ti(oh, &ti);
1018 ti.type = oh->ntlv.type;
1021 /* Use on-stack buffer for single add/del */
1022 if (ctlv->count == 1) {
1023 memset(&tei, 0, sizeof(tei));
1026 tei_buf = malloc(ctlv->count * sizeof(tei), M_TEMP,
1031 for (i = 0; i < ctlv->count; i++, ptent++, ptei++) {
1032 ptei->paddr = &ptent->k;
1033 ptei->subtype = ptent->subtype;
1034 ptei->masklen = ptent->masklen;
1035 if (ptent->head.flags & IPFW_TF_UPDATE)
1036 ptei->flags |= TEI_FLAGS_UPDATE;
1038 ipfw_import_table_value_v1(&ptent->v.value);
1039 ptei->pvalue = (struct table_value *)&ptent->v.value;
1042 error = (oh->opheader.opcode == IP_FW_TABLE_XADD) ?
1043 add_table_entry(ch, &ti, tei_buf, ctlv->flags, ctlv->count) :
1044 del_table_entry(ch, &ti, tei_buf, ctlv->flags, ctlv->count);
1046 /* Translate result back to userland */
1049 for (i = 0; i < ctlv->count; i++, ptent++, ptei++) {
1050 if (ptei->flags & TEI_FLAGS_ADDED)
1051 ptent->result = IPFW_TR_ADDED;
1052 else if (ptei->flags & TEI_FLAGS_DELETED)
1053 ptent->result = IPFW_TR_DELETED;
1054 else if (ptei->flags & TEI_FLAGS_UPDATED)
1055 ptent->result = IPFW_TR_UPDATED;
1056 else if (ptei->flags & TEI_FLAGS_LIMIT)
1057 ptent->result = IPFW_TR_LIMIT;
1058 else if (ptei->flags & TEI_FLAGS_ERROR)
1059 ptent->result = IPFW_TR_ERROR;
1060 else if (ptei->flags & TEI_FLAGS_NOTFOUND)
1061 ptent->result = IPFW_TR_NOTFOUND;
1062 else if (ptei->flags & TEI_FLAGS_EXISTS)
1063 ptent->result = IPFW_TR_EXISTS;
1064 ipfw_export_table_value_v1(ptei->pvalue, &ptent->v.value);
1067 if (tei_buf != &tei)
1068 free(tei_buf, M_TEMP);
1074 * Looks up an entry in given table.
1075 * Data layout (v0)(current):
1076 * Request: [ ipfw_obj_header ipfw_obj_tentry ]
1077 * Reply: [ ipfw_obj_header ipfw_obj_tentry ]
1079 * Returns 0 on success
1082 find_table_entry(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1083 struct sockopt_data *sd)
1085 ipfw_obj_tentry *tent;
1086 ipfw_obj_header *oh;
1088 struct table_config *tc;
1089 struct table_algo *ta;
1090 struct table_info *kti;
1091 struct table_value *pval;
1092 struct namedobj_instance *ni;
1096 /* Check minimum header size */
1097 sz = sizeof(*oh) + sizeof(*tent);
1098 if (sd->valsize != sz)
1101 oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz);
1102 tent = (ipfw_obj_tentry *)(oh + 1);
1104 /* Basic length checks for TLVs */
1105 if (oh->ntlv.head.length != sizeof(oh->ntlv))
1108 objheader_to_ti(oh, &ti);
1109 ti.type = oh->ntlv.type;
1110 ti.uidx = tent->idx;
1113 ni = CHAIN_TO_NI(ch);
1116 * Find existing table and check its type .
1119 if ((tc = find_table(ni, &ti)) == NULL) {
1120 IPFW_UH_RUNLOCK(ch);
1124 /* check table type */
1125 if (tc->no.subtype != ti.type) {
1126 IPFW_UH_RUNLOCK(ch);
1130 kti = KIDX_TO_TI(ch, tc->no.kidx);
1133 if (ta->find_tentry == NULL)
1136 error = ta->find_tentry(tc->astate, kti, tent);
1138 pval = get_table_value(ch, tc, tent->v.kidx);
1139 ipfw_export_table_value_v1(pval, &tent->v.value);
1141 IPFW_UH_RUNLOCK(ch);
1147 * Flushes all entries or destroys given table.
1148 * Data layout (v0)(current):
1149 * Request: [ ipfw_obj_header ]
1151 * Returns 0 on success
1154 flush_table_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1155 struct sockopt_data *sd)
1158 struct _ipfw_obj_header *oh;
1161 if (sd->valsize != sizeof(*oh))
1164 oh = (struct _ipfw_obj_header *)op3;
1165 objheader_to_ti(oh, &ti);
1167 if (op3->opcode == IP_FW_TABLE_XDESTROY)
1168 error = destroy_table(ch, &ti);
1169 else if (op3->opcode == IP_FW_TABLE_XFLUSH)
1170 error = flush_table(ch, &ti);
1178 restart_flush(void *object, struct op_state *_state)
1180 struct tableop_state *ts;
1182 ts = (struct tableop_state *)_state;
1184 if (ts->tc != object)
1187 /* Indicate we've called */
1192 * Flushes given table.
1194 * Function create new table instance with the same
1195 * parameters, swaps it with old one and
1196 * flushes state without holding runtime WLOCK.
1198 * Returns 0 on success.
1201 flush_table(struct ip_fw_chain *ch, struct tid_info *ti)
1203 struct namedobj_instance *ni;
1204 struct table_config *tc;
1205 struct table_algo *ta;
1206 struct table_info ti_old, ti_new, *tablestate;
1207 void *astate_old, *astate_new;
1208 char algostate[64], *pstate;
1209 struct tableop_state ts;
1215 * Stage 1: save table algorithm.
1216 * Reference found table to ensure it won't disappear.
1219 ni = CHAIN_TO_NI(ch);
1220 if ((tc = find_table(ni, ti)) == NULL) {
1221 IPFW_UH_WUNLOCK(ch);
1226 memset(&ti_new, 0, sizeof(ti_new));
1228 /* Set up swap handler */
1229 memset(&ts, 0, sizeof(ts));
1230 ts.opstate.func = restart_flush;
1234 /* Do not flush readonly tables */
1235 if ((ta->flags & TA_FLAG_READONLY) != 0) {
1236 IPFW_UH_WUNLOCK(ch);
1239 /* Save startup algo parameters */
1240 if (ta->print_config != NULL) {
1241 ta->print_config(tc->astate, KIDX_TO_TI(ch, tc->no.kidx),
1242 algostate, sizeof(algostate));
1246 tflags = tc->tflags;
1248 add_toperation_state(ch, &ts);
1249 IPFW_UH_WUNLOCK(ch);
1252 * Stage 1.5: if this is not the first attempt, destroy previous state
1255 ta->destroy(astate_new, &ti_new);
1260 * Stage 2: allocate new table instance using same algo.
1262 memset(&ti_new, 0, sizeof(struct table_info));
1263 error = ta->init(ch, &astate_new, &ti_new, pstate, tflags);
1266 * Stage 3: swap old state pointers with newly-allocated ones.
1267 * Decrease refcount.
1271 del_toperation_state(ch, &ts);
1274 IPFW_UH_WUNLOCK(ch);
1279 * Restart operation if table swap has happened:
1280 * even if algo may be the same, algo init parameters
1281 * may change. Restart operation instead of doing
1284 if (ts.modified != 0) {
1285 /* Delay destroying data since we're holding UH lock */
1290 ni = CHAIN_TO_NI(ch);
1292 tablestate = (struct table_info *)ch->tablestate;
1295 ti_old = tablestate[kidx];
1296 tablestate[kidx] = ti_new;
1299 astate_old = tc->astate;
1300 tc->astate = astate_new;
1301 tc->ti_copy = ti_new;
1304 /* Notify algo on real @ti address */
1305 if (ta->change_ti != NULL)
1306 ta->change_ti(tc->astate, &tablestate[kidx]);
1309 * Stage 4: unref values.
1311 ipfw_unref_table_values(ch, tc, ta, astate_old, &ti_old);
1312 IPFW_UH_WUNLOCK(ch);
1315 * Stage 5: perform real flush/destroy.
1317 ta->destroy(astate_old, &ti_old);
1324 * Data layout (v0)(current):
1325 * Request: [ ipfw_obj_header ipfw_obj_ntlv ]
1327 * Returns 0 on success
1330 swap_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1331 struct sockopt_data *sd)
1334 struct _ipfw_obj_header *oh;
1335 struct tid_info ti_a, ti_b;
1337 if (sd->valsize != sizeof(*oh) + sizeof(ipfw_obj_ntlv))
1340 oh = (struct _ipfw_obj_header *)op3;
1341 ntlv_to_ti(&oh->ntlv, &ti_a);
1342 ntlv_to_ti((ipfw_obj_ntlv *)(oh + 1), &ti_b);
1344 error = swap_tables(ch, &ti_a, &ti_b);
1350 * Swaps two tables of the same type/valtype.
1352 * Checks if tables are compatible and limits
1353 * permits swap, than actually perform swap.
1355 * Each table consists of 2 different parts:
1357 * @tc (with name, set, kidx) and rule bindings, which is "stable".
1361 * runtime data @ti (ch->tablestate)
1362 * runtime cache in @tc
1363 * algo-specific data (@tc->astate)
1370 * After that we call @ti change handler for each table.
1372 * Note that referencing @tc won't protect tc->ta from change.
1373 * XXX: Do we need to restrict swap between locked tables?
1374 * XXX: Do we need to exchange ftype?
1376 * Returns 0 on success.
1379 swap_tables(struct ip_fw_chain *ch, struct tid_info *a,
1382 struct namedobj_instance *ni;
1383 struct table_config *tc_a, *tc_b;
1384 struct table_algo *ta;
1385 struct table_info ti, *tablestate;
1390 * Stage 1: find both tables and ensure they are of
1394 ni = CHAIN_TO_NI(ch);
1395 if ((tc_a = find_table(ni, a)) == NULL) {
1396 IPFW_UH_WUNLOCK(ch);
1399 if ((tc_b = find_table(ni, b)) == NULL) {
1400 IPFW_UH_WUNLOCK(ch);
1404 /* It is very easy to swap between the same table */
1406 IPFW_UH_WUNLOCK(ch);
1410 /* Check type and value are the same */
1411 if (tc_a->no.subtype!=tc_b->no.subtype || tc_a->tflags!=tc_b->tflags) {
1412 IPFW_UH_WUNLOCK(ch);
1416 /* Check limits before swap */
1417 if ((tc_a->limit != 0 && tc_b->count > tc_a->limit) ||
1418 (tc_b->limit != 0 && tc_a->count > tc_b->limit)) {
1419 IPFW_UH_WUNLOCK(ch);
1423 /* Check if one of the tables is readonly */
1424 if (((tc_a->ta->flags | tc_b->ta->flags) & TA_FLAG_READONLY) != 0) {
1425 IPFW_UH_WUNLOCK(ch);
1429 /* Notify we're going to swap */
1430 rollback_toperation_state(ch, tc_a);
1431 rollback_toperation_state(ch, tc_b);
1433 /* Everything is fine, prepare to swap */
1434 tablestate = (struct table_info *)ch->tablestate;
1435 ti = tablestate[tc_a->no.kidx];
1437 astate = tc_a->astate;
1438 count = tc_a->count;
1442 tablestate[tc_a->no.kidx] = tablestate[tc_b->no.kidx];
1443 tc_a->ta = tc_b->ta;
1444 tc_a->astate = tc_b->astate;
1445 tc_a->count = tc_b->count;
1447 tablestate[tc_b->no.kidx] = ti;
1449 tc_b->astate = astate;
1450 tc_b->count = count;
1453 /* Ensure tc.ti copies are in sync */
1454 tc_a->ti_copy = tablestate[tc_a->no.kidx];
1455 tc_b->ti_copy = tablestate[tc_b->no.kidx];
1457 /* Notify both tables on @ti change */
1458 if (tc_a->ta->change_ti != NULL)
1459 tc_a->ta->change_ti(tc_a->astate, &tablestate[tc_a->no.kidx]);
1460 if (tc_b->ta->change_ti != NULL)
1461 tc_b->ta->change_ti(tc_b->astate, &tablestate[tc_b->no.kidx]);
1463 IPFW_UH_WUNLOCK(ch);
1469 * Destroys table specified by @ti.
1470 * Data layout (v0)(current):
1471 * Request: [ ip_fw3_opheader ]
1473 * Returns 0 on success
1476 destroy_table(struct ip_fw_chain *ch, struct tid_info *ti)
1478 struct namedobj_instance *ni;
1479 struct table_config *tc;
1483 ni = CHAIN_TO_NI(ch);
1484 if ((tc = find_table(ni, ti)) == NULL) {
1485 IPFW_UH_WUNLOCK(ch);
1489 /* Do not permit destroying referenced tables */
1490 if (tc->no.refcnt > 0) {
1491 IPFW_UH_WUNLOCK(ch);
1496 unlink_table(ch, tc);
1499 /* Free obj index */
1500 if (ipfw_objhash_free_idx(ni, tc->no.kidx) != 0)
1501 printf("Error unlinking kidx %d from table %s\n",
1502 tc->no.kidx, tc->tablename);
1504 /* Unref values used in tables while holding UH lock */
1505 ipfw_unref_table_values(ch, tc, tc->ta, tc->astate, &tc->ti_copy);
1506 IPFW_UH_WUNLOCK(ch);
1508 free_table_config(ni, tc);
1514 roundup2p(uint32_t v)
1529 * Grow tables index.
1531 * Returns 0 on success.
1534 ipfw_resize_tables(struct ip_fw_chain *ch, unsigned int ntables)
1536 unsigned int ntables_old, tbl;
1537 struct namedobj_instance *ni;
1538 void *new_idx, *old_tablestate, *tablestate;
1539 struct table_info *ti;
1540 struct table_config *tc;
1543 /* Check new value for validity */
1546 if (ntables > IPFW_TABLES_MAX)
1547 ntables = IPFW_TABLES_MAX;
1548 /* Alight to nearest power of 2 */
1549 ntables = (unsigned int)roundup2p(ntables);
1551 /* Allocate new pointers */
1552 tablestate = malloc(ntables * sizeof(struct table_info),
1553 M_IPFW, M_WAITOK | M_ZERO);
1555 ipfw_objhash_bitmap_alloc(ntables, (void *)&new_idx, &new_blocks);
1559 tbl = (ntables >= V_fw_tables_max) ? V_fw_tables_max : ntables;
1560 ni = CHAIN_TO_NI(ch);
1562 /* Temporary restrict decreasing max_tables */
1563 if (ntables < V_fw_tables_max) {
1566 * FIXME: Check if we really can shrink
1568 IPFW_UH_WUNLOCK(ch);
1572 /* Copy table info/indices */
1573 memcpy(tablestate, ch->tablestate, sizeof(struct table_info) * tbl);
1574 ipfw_objhash_bitmap_merge(ni, &new_idx, &new_blocks);
1578 /* Change pointers */
1579 old_tablestate = ch->tablestate;
1580 ch->tablestate = tablestate;
1581 ipfw_objhash_bitmap_swap(ni, &new_idx, &new_blocks);
1583 ntables_old = V_fw_tables_max;
1584 V_fw_tables_max = ntables;
1588 /* Notify all consumers that their @ti pointer has changed */
1589 ti = (struct table_info *)ch->tablestate;
1590 for (i = 0; i < tbl; i++, ti++) {
1591 if (ti->lookup == NULL)
1593 tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, i);
1594 if (tc == NULL || tc->ta->change_ti == NULL)
1597 tc->ta->change_ti(tc->astate, ti);
1600 IPFW_UH_WUNLOCK(ch);
1602 /* Free old pointers */
1603 free(old_tablestate, M_IPFW);
1604 ipfw_objhash_bitmap_free(new_idx, new_blocks);
1610 * Lookup table's named object by its @kidx.
1612 struct named_object *
1613 ipfw_objhash_lookup_table_kidx(struct ip_fw_chain *ch, uint16_t kidx)
1616 return (ipfw_objhash_lookup_kidx(CHAIN_TO_NI(ch), kidx));
1620 * Take reference to table specified in @ntlv.
1621 * On success return its @kidx.
1624 ipfw_ref_table(struct ip_fw_chain *ch, ipfw_obj_ntlv *ntlv, uint16_t *kidx)
1627 struct table_config *tc;
1630 IPFW_UH_WLOCK_ASSERT(ch);
1632 ntlv_to_ti(ntlv, &ti);
1633 error = find_table_err(CHAIN_TO_NI(ch), &ti, &tc);
1641 *kidx = tc->no.kidx;
1647 ipfw_unref_table(struct ip_fw_chain *ch, uint16_t kidx)
1650 struct namedobj_instance *ni;
1651 struct named_object *no;
1653 IPFW_UH_WLOCK_ASSERT(ch);
1654 ni = CHAIN_TO_NI(ch);
1655 no = ipfw_objhash_lookup_kidx(ni, kidx);
1656 KASSERT(no != NULL, ("Table with index %d not found", kidx));
1661 * Lookup an arbitrary key @paddr of length @plen in table @tbl.
1662 * Stores found value in @val.
1664 * Returns 1 if key was found.
1667 ipfw_lookup_table(struct ip_fw_chain *ch, uint16_t tbl, uint16_t plen,
1668 void *paddr, uint32_t *val)
1670 struct table_info *ti;
1672 ti = KIDX_TO_TI(ch, tbl);
1674 return (ti->lookup(ti, paddr, plen, val));
1678 * Info/List/dump support for tables.
1683 * High-level 'get' cmds sysctl handlers
1687 * Lists all tables currently available in kernel.
1688 * Data layout (v0)(current):
1689 * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size
1690 * Reply: [ ipfw_obj_lheader ipfw_xtable_info x N ]
1692 * Returns 0 on success
1695 list_tables(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1696 struct sockopt_data *sd)
1698 struct _ipfw_obj_lheader *olh;
1701 olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh));
1704 if (sd->valsize < olh->size)
1708 error = export_tables(ch, olh, sd);
1709 IPFW_UH_RUNLOCK(ch);
1715 * Store table info to buffer provided by @sd.
1716 * Data layout (v0)(current):
1717 * Request: [ ipfw_obj_header ipfw_xtable_info(empty)]
1718 * Reply: [ ipfw_obj_header ipfw_xtable_info ]
1720 * Returns 0 on success.
1723 describe_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1724 struct sockopt_data *sd)
1726 struct _ipfw_obj_header *oh;
1727 struct table_config *tc;
1731 sz = sizeof(*oh) + sizeof(ipfw_xtable_info);
1732 oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz);
1736 objheader_to_ti(oh, &ti);
1739 if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) {
1740 IPFW_UH_RUNLOCK(ch);
1744 export_table_info(ch, tc, (ipfw_xtable_info *)(oh + 1));
1745 IPFW_UH_RUNLOCK(ch);
1751 * Modifies existing table.
1752 * Data layout (v0)(current):
1753 * Request: [ ipfw_obj_header ipfw_xtable_info ]
1755 * Returns 0 on success
1758 modify_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1759 struct sockopt_data *sd)
1761 struct _ipfw_obj_header *oh;
1762 ipfw_xtable_info *i;
1765 struct namedobj_instance *ni;
1766 struct table_config *tc;
1768 if (sd->valsize != sizeof(*oh) + sizeof(ipfw_xtable_info))
1771 oh = (struct _ipfw_obj_header *)sd->kbuf;
1772 i = (ipfw_xtable_info *)(oh + 1);
1775 * Verify user-supplied strings.
1776 * Check for null-terminated/zero-length strings/
1778 tname = oh->ntlv.name;
1779 if (check_table_name(tname) != 0)
1782 objheader_to_ti(oh, &ti);
1786 ni = CHAIN_TO_NI(ch);
1787 if ((tc = find_table(ni, &ti)) == NULL) {
1788 IPFW_UH_WUNLOCK(ch);
1792 /* Do not support any modifications for readonly tables */
1793 if ((tc->ta->flags & TA_FLAG_READONLY) != 0) {
1794 IPFW_UH_WUNLOCK(ch);
1798 if ((i->mflags & IPFW_TMFLAGS_LIMIT) != 0)
1799 tc->limit = i->limit;
1800 if ((i->mflags & IPFW_TMFLAGS_LOCK) != 0)
1801 tc->locked = ((i->flags & IPFW_TGFLAGS_LOCKED) != 0);
1802 IPFW_UH_WUNLOCK(ch);
1808 * Creates new table.
1809 * Data layout (v0)(current):
1810 * Request: [ ipfw_obj_header ipfw_xtable_info ]
1812 * Returns 0 on success
1815 create_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1816 struct sockopt_data *sd)
1818 struct _ipfw_obj_header *oh;
1819 ipfw_xtable_info *i;
1820 char *tname, *aname;
1822 struct namedobj_instance *ni;
1824 if (sd->valsize != sizeof(*oh) + sizeof(ipfw_xtable_info))
1827 oh = (struct _ipfw_obj_header *)sd->kbuf;
1828 i = (ipfw_xtable_info *)(oh + 1);
1831 * Verify user-supplied strings.
1832 * Check for null-terminated/zero-length strings/
1834 tname = oh->ntlv.name;
1835 aname = i->algoname;
1836 if (check_table_name(tname) != 0 ||
1837 strnlen(aname, sizeof(i->algoname)) == sizeof(i->algoname))
1840 if (aname[0] == '\0') {
1841 /* Use default algorithm */
1845 objheader_to_ti(oh, &ti);
1848 ni = CHAIN_TO_NI(ch);
1851 if (find_table(ni, &ti) != NULL) {
1852 IPFW_UH_RUNLOCK(ch);
1855 IPFW_UH_RUNLOCK(ch);
1857 return (create_table_internal(ch, &ti, aname, i, NULL, 0));
1861 * Creates new table based on @ti and @aname.
1863 * Assume @aname to be checked and valid.
1864 * Stores allocated table kidx inside @pkidx (if non-NULL).
1865 * Reference created table if @compat is non-zero.
1867 * Returns 0 on success.
1870 create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti,
1871 char *aname, ipfw_xtable_info *i, uint16_t *pkidx, int compat)
1873 struct namedobj_instance *ni;
1874 struct table_config *tc, *tc_new, *tmp;
1875 struct table_algo *ta;
1878 ni = CHAIN_TO_NI(ch);
1880 ta = find_table_algo(CHAIN_TO_TCFG(ch), ti, aname);
1884 tc = alloc_table_config(ch, ti, ta, aname, i->tflags);
1888 tc->vmask = i->vmask;
1889 tc->limit = i->limit;
1890 if (ta->flags & TA_FLAG_READONLY)
1893 tc->locked = (i->flags & IPFW_TGFLAGS_LOCKED) != 0;
1897 /* Check if table has been already created */
1898 tc_new = find_table(ni, ti);
1899 if (tc_new != NULL) {
1902 * Compat: do not fail if we're
1903 * requesting to create existing table
1904 * which has the same type
1906 if (compat == 0 || tc_new->no.subtype != tc->no.subtype) {
1907 IPFW_UH_WUNLOCK(ch);
1908 free_table_config(ni, tc);
1912 /* Exchange tc and tc_new for proper refcounting & freeing */
1918 if (ipfw_objhash_alloc_idx(ni, &kidx) != 0) {
1919 IPFW_UH_WUNLOCK(ch);
1920 printf("Unable to allocate table index."
1921 " Consider increasing net.inet.ip.fw.tables_max");
1922 free_table_config(ni, tc);
1926 tc->no.etlv = IPFW_TLV_TBL_NAME;
1934 *pkidx = tc->no.kidx;
1936 IPFW_UH_WUNLOCK(ch);
1939 free_table_config(ni, tc_new);
1945 ntlv_to_ti(ipfw_obj_ntlv *ntlv, struct tid_info *ti)
1948 memset(ti, 0, sizeof(struct tid_info));
1949 ti->set = ntlv->set;
1950 ti->uidx = ntlv->idx;
1952 ti->tlen = ntlv->head.length;
1956 objheader_to_ti(struct _ipfw_obj_header *oh, struct tid_info *ti)
1959 ntlv_to_ti(&oh->ntlv, ti);
1962 struct namedobj_instance *
1963 ipfw_get_table_objhash(struct ip_fw_chain *ch)
1966 return (CHAIN_TO_NI(ch));
1970 * Exports basic table info as name TLV.
1971 * Used inside dump_static_rules() to provide info
1972 * about all tables referenced by current ruleset.
1974 * Returns 0 on success.
1977 ipfw_export_table_ntlv(struct ip_fw_chain *ch, uint16_t kidx,
1978 struct sockopt_data *sd)
1980 struct namedobj_instance *ni;
1981 struct named_object *no;
1982 ipfw_obj_ntlv *ntlv;
1984 ni = CHAIN_TO_NI(ch);
1986 no = ipfw_objhash_lookup_kidx(ni, kidx);
1987 KASSERT(no != NULL, ("invalid table kidx passed"));
1989 ntlv = (ipfw_obj_ntlv *)ipfw_get_sopt_space(sd, sizeof(*ntlv));
1993 ntlv->head.type = IPFW_TLV_TBL_NAME;
1994 ntlv->head.length = sizeof(*ntlv);
1995 ntlv->idx = no->kidx;
1996 strlcpy(ntlv->name, no->name, sizeof(ntlv->name));
2002 struct ip_fw_chain *ch;
2003 struct table_info *ti;
2004 struct table_config *tc;
2005 struct sockopt_data *sd;
2010 ipfw_table_entry *ent;
2013 ipfw_obj_tentry tent;
2017 count_ext_entries(void *e, void *arg)
2019 struct dump_args *da;
2021 da = (struct dump_args *)arg;
2028 * Gets number of items from table either using
2029 * internal counter or calling algo callback for
2030 * externally-managed tables.
2032 * Returns number of records.
2035 table_get_count(struct ip_fw_chain *ch, struct table_config *tc)
2037 struct table_info *ti;
2038 struct table_algo *ta;
2039 struct dump_args da;
2041 ti = KIDX_TO_TI(ch, tc->no.kidx);
2044 /* Use internal counter for self-managed tables */
2045 if ((ta->flags & TA_FLAG_READONLY) == 0)
2048 /* Use callback to quickly get number of items */
2049 if ((ta->flags & TA_FLAG_EXTCOUNTER) != 0)
2050 return (ta->get_count(tc->astate, ti));
2052 /* Count number of iterms ourselves */
2053 memset(&da, 0, sizeof(da));
2054 ta->foreach(tc->astate, ti, count_ext_entries, &da);
2060 * Exports table @tc info into standard ipfw_xtable_info format.
2063 export_table_info(struct ip_fw_chain *ch, struct table_config *tc,
2064 ipfw_xtable_info *i)
2066 struct table_info *ti;
2067 struct table_algo *ta;
2069 i->type = tc->no.subtype;
2070 i->tflags = tc->tflags;
2071 i->vmask = tc->vmask;
2072 i->set = tc->no.set;
2073 i->kidx = tc->no.kidx;
2074 i->refcnt = tc->no.refcnt;
2075 i->count = table_get_count(ch, tc);
2076 i->limit = tc->limit;
2077 i->flags |= (tc->locked != 0) ? IPFW_TGFLAGS_LOCKED : 0;
2078 i->size = i->count * sizeof(ipfw_obj_tentry);
2079 i->size += sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info);
2080 strlcpy(i->tablename, tc->tablename, sizeof(i->tablename));
2081 ti = KIDX_TO_TI(ch, tc->no.kidx);
2083 if (ta->print_config != NULL) {
2084 /* Use algo function to print table config to string */
2085 ta->print_config(tc->astate, ti, i->algoname,
2086 sizeof(i->algoname));
2088 strlcpy(i->algoname, ta->name, sizeof(i->algoname));
2089 /* Dump algo-specific data, if possible */
2090 if (ta->dump_tinfo != NULL) {
2091 ta->dump_tinfo(tc->astate, ti, &i->ta_info);
2092 i->ta_info.flags |= IPFW_TATFLAGS_DATA;
2096 struct dump_table_args {
2097 struct ip_fw_chain *ch;
2098 struct sockopt_data *sd;
2102 export_table_internal(struct namedobj_instance *ni, struct named_object *no,
2105 ipfw_xtable_info *i;
2106 struct dump_table_args *dta;
2108 dta = (struct dump_table_args *)arg;
2110 i = (ipfw_xtable_info *)ipfw_get_sopt_space(dta->sd, sizeof(*i));
2111 KASSERT(i != NULL, ("previously checked buffer is not enough"));
2113 export_table_info(dta->ch, (struct table_config *)no, i);
2118 * Export all tables as ipfw_xtable_info structures to
2119 * storage provided by @sd.
2121 * If supplied buffer is too small, fills in required size
2122 * and returns ENOMEM.
2123 * Returns 0 on success.
2126 export_tables(struct ip_fw_chain *ch, ipfw_obj_lheader *olh,
2127 struct sockopt_data *sd)
2131 struct dump_table_args dta;
2133 count = ipfw_objhash_count(CHAIN_TO_NI(ch));
2134 size = count * sizeof(ipfw_xtable_info) + sizeof(ipfw_obj_lheader);
2136 /* Fill in header regadless of buffer size */
2138 olh->objsize = sizeof(ipfw_xtable_info);
2140 if (size > olh->size) {
2150 ipfw_objhash_foreach(CHAIN_TO_NI(ch), export_table_internal, &dta);
2156 * Dumps all table data
2157 * Data layout (v1)(current):
2158 * Request: [ ipfw_obj_header ], size = ipfw_xtable_info.size
2159 * Reply: [ ipfw_obj_header ipfw_xtable_info ipfw_obj_tentry x N ]
2161 * Returns 0 on success
2164 dump_table_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
2165 struct sockopt_data *sd)
2167 struct _ipfw_obj_header *oh;
2168 ipfw_xtable_info *i;
2170 struct table_config *tc;
2171 struct table_algo *ta;
2172 struct dump_args da;
2175 sz = sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info);
2176 oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz);
2180 i = (ipfw_xtable_info *)(oh + 1);
2181 objheader_to_ti(oh, &ti);
2184 if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) {
2185 IPFW_UH_RUNLOCK(ch);
2188 export_table_info(ch, tc, i);
2190 if (sd->valsize < i->size) {
2193 * Submitted buffer size is not enough.
2194 * WE've already filled in @i structure with
2195 * relevant table info including size, so we
2196 * can return. Buffer will be flushed automatically.
2198 IPFW_UH_RUNLOCK(ch);
2203 * Do the actual dump in eXtended format
2205 memset(&da, 0, sizeof(da));
2207 da.ti = KIDX_TO_TI(ch, tc->no.kidx);
2213 ta->foreach(tc->astate, da.ti, dump_table_tentry, &da);
2214 IPFW_UH_RUNLOCK(ch);
2220 * Dumps all table data
2221 * Data layout (version 0)(legacy):
2222 * Request: [ ipfw_xtable ], size = IP_FW_TABLE_XGETSIZE()
2223 * Reply: [ ipfw_xtable ipfw_table_xentry x N ]
2225 * Returns 0 on success
2228 dump_table_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
2229 struct sockopt_data *sd)
2233 struct table_config *tc;
2234 struct table_algo *ta;
2235 struct dump_args da;
2238 xtbl = (ipfw_xtable *)ipfw_get_sopt_header(sd, sizeof(ipfw_xtable));
2242 memset(&ti, 0, sizeof(ti));
2243 ti.uidx = xtbl->tbl;
2246 if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) {
2247 IPFW_UH_RUNLOCK(ch);
2250 count = table_get_count(ch, tc);
2251 sz = count * sizeof(ipfw_table_xentry) + sizeof(ipfw_xtable);
2255 xtbl->type = tc->no.subtype;
2256 xtbl->tbl = ti.uidx;
2258 if (sd->valsize < sz) {
2261 * Submitted buffer size is not enough.
2262 * WE've already filled in @i structure with
2263 * relevant table info including size, so we
2264 * can return. Buffer will be flushed automatically.
2266 IPFW_UH_RUNLOCK(ch);
2270 /* Do the actual dump in eXtended format */
2271 memset(&da, 0, sizeof(da));
2273 da.ti = KIDX_TO_TI(ch, tc->no.kidx);
2279 ta->foreach(tc->astate, da.ti, dump_table_xentry, &da);
2280 IPFW_UH_RUNLOCK(ch);
2286 * Legacy function to retrieve number of items in table.
2289 get_table_size(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
2290 struct sockopt_data *sd)
2297 sz = sizeof(*op3) + sizeof(uint32_t);
2298 op3 = (ip_fw3_opheader *)ipfw_get_sopt_header(sd, sz);
2302 tbl = (uint32_t *)(op3 + 1);
2303 memset(&ti, 0, sizeof(ti));
2306 error = ipfw_count_xtable(ch, &ti, tbl);
2307 IPFW_UH_RUNLOCK(ch);
2312 * Legacy IP_FW_TABLE_GETSIZE handler
2315 ipfw_count_table(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt)
2317 struct table_config *tc;
2319 if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL)
2321 *cnt = table_get_count(ch, tc);
2326 * Legacy IP_FW_TABLE_XGETSIZE handler
2329 ipfw_count_xtable(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt)
2331 struct table_config *tc;
2334 if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) {
2336 return (0); /* 'table all list' requires success */
2339 count = table_get_count(ch, tc);
2340 *cnt = count * sizeof(ipfw_table_xentry);
2342 *cnt += sizeof(ipfw_xtable);
2347 dump_table_entry(void *e, void *arg)
2349 struct dump_args *da;
2350 struct table_config *tc;
2351 struct table_algo *ta;
2352 ipfw_table_entry *ent;
2353 struct table_value *pval;
2356 da = (struct dump_args *)arg;
2361 /* Out of memory, returning */
2362 if (da->cnt == da->size)
2365 ent->tbl = da->uidx;
2368 error = ta->dump_tentry(tc->astate, da->ti, e, &da->tent);
2372 ent->addr = da->tent.k.addr.s_addr;
2373 ent->masklen = da->tent.masklen;
2374 pval = get_table_value(da->ch, da->tc, da->tent.v.kidx);
2375 ent->value = ipfw_export_table_value_legacy(pval);
2381 * Dumps table in pre-8.1 legacy format.
2384 ipfw_dump_table_legacy(struct ip_fw_chain *ch, struct tid_info *ti,
2387 struct table_config *tc;
2388 struct table_algo *ta;
2389 struct dump_args da;
2393 if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL)
2394 return (0); /* XXX: We should return ESRCH */
2398 /* This dump format supports IPv4 only */
2399 if (tc->no.subtype != IPFW_TABLE_ADDR)
2402 memset(&da, 0, sizeof(da));
2404 da.ti = KIDX_TO_TI(ch, tc->no.kidx);
2406 da.ent = &tbl->ent[0];
2407 da.size = tbl->size;
2410 ta->foreach(tc->astate, da.ti, dump_table_entry, &da);
2417 * Dumps table entry in eXtended format (v1)(current).
2420 dump_table_tentry(void *e, void *arg)
2422 struct dump_args *da;
2423 struct table_config *tc;
2424 struct table_algo *ta;
2425 struct table_value *pval;
2426 ipfw_obj_tentry *tent;
2429 da = (struct dump_args *)arg;
2434 tent = (ipfw_obj_tentry *)ipfw_get_sopt_space(da->sd, sizeof(*tent));
2435 /* Out of memory, returning */
2440 tent->head.length = sizeof(ipfw_obj_tentry);
2441 tent->idx = da->uidx;
2443 error = ta->dump_tentry(tc->astate, da->ti, e, tent);
2447 pval = get_table_value(da->ch, da->tc, tent->v.kidx);
2448 ipfw_export_table_value_v1(pval, &tent->v.value);
2454 * Dumps table entry in eXtended format (v0).
2457 dump_table_xentry(void *e, void *arg)
2459 struct dump_args *da;
2460 struct table_config *tc;
2461 struct table_algo *ta;
2462 ipfw_table_xentry *xent;
2463 ipfw_obj_tentry *tent;
2464 struct table_value *pval;
2467 da = (struct dump_args *)arg;
2472 xent = (ipfw_table_xentry *)ipfw_get_sopt_space(da->sd, sizeof(*xent));
2473 /* Out of memory, returning */
2476 xent->len = sizeof(ipfw_table_xentry);
2477 xent->tbl = da->uidx;
2479 memset(&da->tent, 0, sizeof(da->tent));
2481 error = ta->dump_tentry(tc->astate, da->ti, e, tent);
2485 /* Convert current format to previous one */
2486 xent->masklen = tent->masklen;
2487 pval = get_table_value(da->ch, da->tc, da->tent.v.kidx);
2488 xent->value = ipfw_export_table_value_legacy(pval);
2489 /* Apply some hacks */
2490 if (tc->no.subtype == IPFW_TABLE_ADDR && tent->subtype == AF_INET) {
2491 xent->k.addr6.s6_addr32[3] = tent->k.addr.s_addr;
2492 xent->flags = IPFW_TCF_INET;
2494 memcpy(&xent->k, &tent->k, sizeof(xent->k));
2500 * Helper function to export table algo data
2501 * to tentry format before calling user function.
2503 * Returns 0 on success.
2506 prepare_table_tentry(void *e, void *arg)
2508 struct dump_args *da;
2509 struct table_config *tc;
2510 struct table_algo *ta;
2513 da = (struct dump_args *)arg;
2518 error = ta->dump_tentry(tc->astate, da->ti, e, &da->tent);
2522 da->f(&da->tent, da->farg);
2528 * Allow external consumers to read table entries in standard format.
2531 ipfw_foreach_table_tentry(struct ip_fw_chain *ch, uint16_t kidx,
2532 ta_foreach_f *f, void *arg)
2534 struct namedobj_instance *ni;
2535 struct table_config *tc;
2536 struct table_algo *ta;
2537 struct dump_args da;
2539 ni = CHAIN_TO_NI(ch);
2541 tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, kidx);
2547 memset(&da, 0, sizeof(da));
2549 da.ti = KIDX_TO_TI(ch, tc->no.kidx);
2554 ta->foreach(tc->astate, da.ti, prepare_table_tentry, &da);
2564 * Finds algorithm by index, table type or supplied name.
2566 * Returns pointer to algo or NULL.
2568 static struct table_algo *
2569 find_table_algo(struct tables_config *tcfg, struct tid_info *ti, char *name)
2572 struct table_algo *ta;
2574 if (ti->type > IPFW_TABLE_MAXTYPE)
2577 /* Search by index */
2578 if (ti->atype != 0) {
2579 if (ti->atype > tcfg->algo_count)
2581 return (tcfg->algo[ti->atype]);
2585 /* Return default algorithm for given type if set */
2586 return (tcfg->def_algo[ti->type]);
2589 /* Search by name */
2590 /* TODO: better search */
2591 for (i = 1; i <= tcfg->algo_count; i++) {
2595 * One can supply additional algorithm
2596 * parameters so we compare only the first word
2598 * 'addr:chash hsize=32'
2602 l = strlen(ta->name);
2603 if (strncmp(name, ta->name, l) != 0)
2605 if (name[l] != '\0' && name[l] != ' ')
2607 /* Check if we're requesting proper table type */
2608 if (ti->type != 0 && ti->type != ta->type)
2617 * Register new table algo @ta.
2618 * Stores algo id inside @idx.
2620 * Returns 0 on success.
2623 ipfw_add_table_algo(struct ip_fw_chain *ch, struct table_algo *ta, size_t size,
2626 struct tables_config *tcfg;
2627 struct table_algo *ta_new;
2630 if (size > sizeof(struct table_algo))
2633 /* Check for the required on-stack size for add/del */
2634 sz = roundup2(ta->ta_buf_size, sizeof(void *));
2638 KASSERT(ta->type <= IPFW_TABLE_MAXTYPE,("Increase IPFW_TABLE_MAXTYPE"));
2640 /* Copy algorithm data to stable storage. */
2641 ta_new = malloc(sizeof(struct table_algo), M_IPFW, M_WAITOK | M_ZERO);
2642 memcpy(ta_new, ta, size);
2644 tcfg = CHAIN_TO_TCFG(ch);
2646 KASSERT(tcfg->algo_count < 255, ("Increase algo array size"));
2648 tcfg->algo[++tcfg->algo_count] = ta_new;
2649 ta_new->idx = tcfg->algo_count;
2651 /* Set algorithm as default one for given type */
2652 if ((ta_new->flags & TA_FLAG_DEFAULT) != 0 &&
2653 tcfg->def_algo[ta_new->type] == NULL)
2654 tcfg->def_algo[ta_new->type] = ta_new;
2662 * Unregisters table algo using @idx as id.
2663 * XXX: It is NOT safe to call this function in any place
2664 * other than ipfw instance destroy handler.
2667 ipfw_del_table_algo(struct ip_fw_chain *ch, int idx)
2669 struct tables_config *tcfg;
2670 struct table_algo *ta;
2672 tcfg = CHAIN_TO_TCFG(ch);
2674 KASSERT(idx <= tcfg->algo_count, ("algo idx %d out of range 1..%d",
2675 idx, tcfg->algo_count));
2677 ta = tcfg->algo[idx];
2678 KASSERT(ta != NULL, ("algo idx %d is NULL", idx));
2680 if (tcfg->def_algo[ta->type] == ta)
2681 tcfg->def_algo[ta->type] = NULL;
2687 * Lists all table algorithms currently available.
2688 * Data layout (v0)(current):
2689 * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size
2690 * Reply: [ ipfw_obj_lheader ipfw_ta_info x N ]
2692 * Returns 0 on success
2695 list_table_algo(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
2696 struct sockopt_data *sd)
2698 struct _ipfw_obj_lheader *olh;
2699 struct tables_config *tcfg;
2701 struct table_algo *ta;
2702 uint32_t count, n, size;
2704 olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh));
2707 if (sd->valsize < olh->size)
2711 tcfg = CHAIN_TO_TCFG(ch);
2712 count = tcfg->algo_count;
2713 size = count * sizeof(ipfw_ta_info) + sizeof(ipfw_obj_lheader);
2715 /* Fill in header regadless of buffer size */
2717 olh->objsize = sizeof(ipfw_ta_info);
2719 if (size > olh->size) {
2721 IPFW_UH_RUNLOCK(ch);
2726 for (n = 1; n <= count; n++) {
2727 i = (ipfw_ta_info *)ipfw_get_sopt_space(sd, sizeof(*i));
2728 KASSERT(i != NULL, ("previously checked buffer is not enough"));
2730 strlcpy(i->algoname, ta->name, sizeof(i->algoname));
2732 i->refcnt = ta->refcnt;
2735 IPFW_UH_RUNLOCK(ch);
2741 classify_srcdst(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
2743 /* Basic IPv4/IPv6 or u32 lookups */
2745 /* Assume ADDR by default */
2746 *ptype = IPFW_TABLE_ADDR;
2749 if (F_LEN(cmd) > F_INSN_SIZE(ipfw_insn_u32)) {
2751 * generic lookup. The key must be
2752 * in 32bit big-endian format.
2754 v = ((ipfw_insn_u32 *)cmd)->d[1];
2763 *ptype = IPFW_TABLE_NUMBER;
2767 *ptype = IPFW_TABLE_NUMBER;
2771 *ptype = IPFW_TABLE_NUMBER;
2775 *ptype = IPFW_TABLE_NUMBER;
2784 classify_via(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
2786 ipfw_insn_if *cmdif;
2788 /* Interface table, possibly */
2789 cmdif = (ipfw_insn_if *)cmd;
2790 if (cmdif->name[0] != '\1')
2793 *ptype = IPFW_TABLE_INTERFACE;
2794 *puidx = cmdif->p.kidx;
2800 classify_flow(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
2804 *ptype = IPFW_TABLE_FLOW;
2810 update_arg1(ipfw_insn *cmd, uint16_t idx)
2817 update_via(ipfw_insn *cmd, uint16_t idx)
2819 ipfw_insn_if *cmdif;
2821 cmdif = (ipfw_insn_if *)cmd;
2822 cmdif->p.kidx = idx;
2826 table_findbyname(struct ip_fw_chain *ch, struct tid_info *ti,
2827 struct named_object **pno)
2829 struct table_config *tc;
2832 IPFW_UH_WLOCK_ASSERT(ch);
2834 error = find_table_err(CHAIN_TO_NI(ch), ti, &tc);
2842 /* XXX: sets-sets! */
2843 static struct named_object *
2844 table_findbykidx(struct ip_fw_chain *ch, uint16_t idx)
2846 struct namedobj_instance *ni;
2847 struct table_config *tc;
2849 IPFW_UH_WLOCK_ASSERT(ch);
2850 ni = CHAIN_TO_NI(ch);
2851 tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, idx);
2852 KASSERT(tc != NULL, ("Table with index %d not found", idx));
2858 table_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set,
2859 enum ipfw_sets_cmd cmd)
2867 * Always return success, the real action and decision
2868 * should make table_manage_sets_all().
2874 * NOTE: we need to use ipfw_objhash_del/ipfw_objhash_add
2875 * if set number will be used in hash function. Currently
2876 * we can just use generic handler that replaces set value.
2878 if (V_fw_tables_sets == 0)
2883 * Return EOPNOTSUPP for COUNT_ONE when per-set sysctl is
2884 * disabled. This allow skip table's opcodes from additional
2885 * checks when specific rules moved to another set.
2887 if (V_fw_tables_sets == 0)
2888 return (EOPNOTSUPP);
2890 /* Use generic sets handler when per-set sysctl is enabled. */
2891 return (ipfw_obj_manage_sets(CHAIN_TO_NI(ch), IPFW_TLV_TBL_NAME,
2892 set, new_set, cmd));
2896 * We register several opcode rewriters for lookup tables.
2897 * All tables opcodes have the same ETLV type, but different subtype.
2898 * To avoid invoking sets handler several times for XXX_ALL commands,
2899 * we use separate manage_sets handler. O_RECV has the lowest value,
2900 * so it should be called first.
2903 table_manage_sets_all(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set,
2904 enum ipfw_sets_cmd cmd)
2911 * Return success for TEST_ALL, since nothing prevents
2912 * move rules from one set to another. All tables are
2913 * accessible from all sets when per-set tables sysctl
2917 if (V_fw_tables_sets == 0)
2921 return (table_manage_sets(ch, set, new_set, cmd));
2923 /* Use generic sets handler when per-set sysctl is enabled. */
2924 return (ipfw_obj_manage_sets(CHAIN_TO_NI(ch), IPFW_TLV_TBL_NAME,
2925 set, new_set, cmd));
2928 static struct opcode_obj_rewrite opcodes[] = {
2930 .opcode = O_IP_SRC_LOOKUP,
2931 .etlv = IPFW_TLV_TBL_NAME,
2932 .classifier = classify_srcdst,
2933 .update = update_arg1,
2934 .find_byname = table_findbyname,
2935 .find_bykidx = table_findbykidx,
2936 .create_object = create_table_compat,
2937 .manage_sets = table_manage_sets,
2940 .opcode = O_IP_DST_LOOKUP,
2941 .etlv = IPFW_TLV_TBL_NAME,
2942 .classifier = classify_srcdst,
2943 .update = update_arg1,
2944 .find_byname = table_findbyname,
2945 .find_bykidx = table_findbykidx,
2946 .create_object = create_table_compat,
2947 .manage_sets = table_manage_sets,
2950 .opcode = O_IP_FLOW_LOOKUP,
2951 .etlv = IPFW_TLV_TBL_NAME,
2952 .classifier = classify_flow,
2953 .update = update_arg1,
2954 .find_byname = table_findbyname,
2955 .find_bykidx = table_findbykidx,
2956 .create_object = create_table_compat,
2957 .manage_sets = table_manage_sets,
2961 .etlv = IPFW_TLV_TBL_NAME,
2962 .classifier = classify_via,
2963 .update = update_via,
2964 .find_byname = table_findbyname,
2965 .find_bykidx = table_findbykidx,
2966 .create_object = create_table_compat,
2967 .manage_sets = table_manage_sets,
2971 .etlv = IPFW_TLV_TBL_NAME,
2972 .classifier = classify_via,
2973 .update = update_via,
2974 .find_byname = table_findbyname,
2975 .find_bykidx = table_findbykidx,
2976 .create_object = create_table_compat,
2977 .manage_sets = table_manage_sets_all,
2981 .etlv = IPFW_TLV_TBL_NAME,
2982 .classifier = classify_via,
2983 .update = update_via,
2984 .find_byname = table_findbyname,
2985 .find_bykidx = table_findbykidx,
2986 .create_object = create_table_compat,
2987 .manage_sets = table_manage_sets,
2992 test_sets_cb(struct namedobj_instance *ni __unused, struct named_object *no,
2996 /* Check that there aren't any tables in not default set */
3003 * Switch between "set 0" and "rule's set" table binding,
3004 * Check all ruleset bindings and permits changing
3005 * IFF each binding has both rule AND table in default set (set 0).
3007 * Returns 0 on success.
3010 ipfw_switch_tables_namespace(struct ip_fw_chain *ch, unsigned int sets)
3012 struct opcode_obj_rewrite *rw;
3013 struct namedobj_instance *ni;
3014 struct named_object *no;
3023 if (V_fw_tables_sets == sets) {
3024 IPFW_UH_WUNLOCK(ch);
3027 ni = CHAIN_TO_NI(ch);
3030 * Prevent disabling sets support if we have some tables
3031 * in not default sets.
3033 if (ipfw_objhash_foreach_type(ni, test_sets_cb,
3034 NULL, IPFW_TLV_TBL_NAME) != 0) {
3035 IPFW_UH_WUNLOCK(ch);
3040 * Scan all rules and examine tables opcodes.
3042 for (i = 0; i < ch->n_rules; i++) {
3048 for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) {
3049 cmdlen = F_LEN(cmd);
3050 /* Check only tables opcodes */
3051 for (kidx = 0, rw = opcodes;
3052 rw < opcodes + nitems(opcodes); rw++) {
3053 if (rw->opcode != cmd->opcode)
3055 if (rw->classifier(cmd, &kidx, &subtype) == 0)
3060 no = ipfw_objhash_lookup_kidx(ni, kidx);
3061 /* Check if both table object and rule has the set 0 */
3062 if (no->set != 0 || rule->set != 0) {
3063 IPFW_UH_WUNLOCK(ch);
3069 V_fw_tables_sets = sets;
3070 IPFW_UH_WUNLOCK(ch);
3075 * Checks table name for validity.
3076 * Enforce basic length checks, the rest
3077 * should be done in userland.
3079 * Returns 0 if name is considered valid.
3082 check_table_name(const char *name)
3086 * TODO: do some more complicated checks
3088 return (ipfw_check_object_name_generic(name));
3092 * Finds table config based on either legacy index
3094 * Note @ti structure contains unchecked data from userland.
3096 * Returns 0 in success and fills in @tc with found config
3099 find_table_err(struct namedobj_instance *ni, struct tid_info *ti,
3100 struct table_config **tc)
3102 char *name, bname[16];
3103 struct named_object *no;
3104 ipfw_obj_ntlv *ntlv;
3107 if (ti->tlvs != NULL) {
3108 ntlv = ipfw_find_name_tlv_type(ti->tlvs, ti->tlen, ti->uidx,
3115 * Use set provided by @ti instead of @ntlv one.
3116 * This is needed due to different sets behavior
3117 * controlled by V_fw_tables_sets.
3119 set = (V_fw_tables_sets != 0) ? ti->set : 0;
3121 snprintf(bname, sizeof(bname), "%d", ti->uidx);
3126 no = ipfw_objhash_lookup_name(ni, set, name);
3127 *tc = (struct table_config *)no;
3133 * Finds table config based on either legacy index
3135 * Note @ti structure contains unchecked data from userland.
3137 * Returns pointer to table_config or NULL.
3139 static struct table_config *
3140 find_table(struct namedobj_instance *ni, struct tid_info *ti)
3142 struct table_config *tc;
3144 if (find_table_err(ni, ti, &tc) != 0)
3151 * Allocate new table config structure using
3152 * specified @algo and @aname.
3154 * Returns pointer to config or NULL.
3156 static struct table_config *
3157 alloc_table_config(struct ip_fw_chain *ch, struct tid_info *ti,
3158 struct table_algo *ta, char *aname, uint8_t tflags)
3160 char *name, bname[16];
3161 struct table_config *tc;
3163 ipfw_obj_ntlv *ntlv;
3166 if (ti->tlvs != NULL) {
3167 ntlv = ipfw_find_name_tlv_type(ti->tlvs, ti->tlen, ti->uidx,
3174 /* Compat part: convert number to string representation */
3175 snprintf(bname, sizeof(bname), "%d", ti->uidx);
3180 tc = malloc(sizeof(struct table_config), M_IPFW, M_WAITOK | M_ZERO);
3181 tc->no.name = tc->tablename;
3182 tc->no.subtype = ta->type;
3184 tc->tflags = tflags;
3186 strlcpy(tc->tablename, name, sizeof(tc->tablename));
3187 /* Set "shared" value type by default */
3190 /* Preallocate data structures for new tables */
3191 error = ta->init(ch, &tc->astate, &tc->ti_copy, aname, tflags);
3201 * Destroys table state and config.
3204 free_table_config(struct namedobj_instance *ni, struct table_config *tc)
3207 KASSERT(tc->linked == 0, ("free() on linked config"));
3208 /* UH lock MUST NOT be held */
3211 * We're using ta without any locking/referencing.
3212 * TODO: fix this if we're going to use unloadable algos.
3214 tc->ta->destroy(tc->astate, &tc->ti_copy);
3219 * Links @tc to @chain table named instance.
3220 * Sets appropriate type/states in @chain table info.
3223 link_table(struct ip_fw_chain *ch, struct table_config *tc)
3225 struct namedobj_instance *ni;
3226 struct table_info *ti;
3229 IPFW_UH_WLOCK_ASSERT(ch);
3231 ni = CHAIN_TO_NI(ch);
3234 ipfw_objhash_add(ni, &tc->no);
3236 ti = KIDX_TO_TI(ch, kidx);
3239 /* Notify algo on real @ti address */
3240 if (tc->ta->change_ti != NULL)
3241 tc->ta->change_ti(tc->astate, ti);
3248 * Unlinks @tc from @chain table named instance.
3249 * Zeroes states in @chain and stores them in @tc.
3252 unlink_table(struct ip_fw_chain *ch, struct table_config *tc)
3254 struct namedobj_instance *ni;
3255 struct table_info *ti;
3258 IPFW_UH_WLOCK_ASSERT(ch);
3259 IPFW_WLOCK_ASSERT(ch);
3261 ni = CHAIN_TO_NI(ch);
3264 /* Clear state. @ti copy is already saved inside @tc */
3265 ipfw_objhash_del(ni, &tc->no);
3266 ti = KIDX_TO_TI(ch, kidx);
3267 memset(ti, 0, sizeof(struct table_info));
3271 /* Notify algo on real @ti address */
3272 if (tc->ta->change_ti != NULL)
3273 tc->ta->change_ti(tc->astate, NULL);
3276 static struct ipfw_sopt_handler scodes[] = {
3277 { IP_FW_TABLE_XCREATE, 0, HDIR_SET, create_table },
3278 { IP_FW_TABLE_XDESTROY, 0, HDIR_SET, flush_table_v0 },
3279 { IP_FW_TABLE_XFLUSH, 0, HDIR_SET, flush_table_v0 },
3280 { IP_FW_TABLE_XMODIFY, 0, HDIR_BOTH, modify_table },
3281 { IP_FW_TABLE_XINFO, 0, HDIR_GET, describe_table },
3282 { IP_FW_TABLES_XLIST, 0, HDIR_GET, list_tables },
3283 { IP_FW_TABLE_XLIST, 0, HDIR_GET, dump_table_v0 },
3284 { IP_FW_TABLE_XLIST, 1, HDIR_GET, dump_table_v1 },
3285 { IP_FW_TABLE_XADD, 0, HDIR_BOTH, manage_table_ent_v0 },
3286 { IP_FW_TABLE_XADD, 1, HDIR_BOTH, manage_table_ent_v1 },
3287 { IP_FW_TABLE_XDEL, 0, HDIR_BOTH, manage_table_ent_v0 },
3288 { IP_FW_TABLE_XDEL, 1, HDIR_BOTH, manage_table_ent_v1 },
3289 { IP_FW_TABLE_XFIND, 0, HDIR_GET, find_table_entry },
3290 { IP_FW_TABLE_XSWAP, 0, HDIR_SET, swap_table },
3291 { IP_FW_TABLES_ALIST, 0, HDIR_GET, list_table_algo },
3292 { IP_FW_TABLE_XGETSIZE, 0, HDIR_GET, get_table_size },
3296 destroy_table_locked(struct namedobj_instance *ni, struct named_object *no,
3300 unlink_table((struct ip_fw_chain *)arg, (struct table_config *)no);
3301 if (ipfw_objhash_free_idx(ni, no->kidx) != 0)
3302 printf("Error unlinking kidx %d from table %s\n",
3303 no->kidx, no->name);
3304 free_table_config(ni, (struct table_config *)no);
3309 * Shuts tables module down.
3312 ipfw_destroy_tables(struct ip_fw_chain *ch, int last)
3315 IPFW_DEL_SOPT_HANDLER(last, scodes);
3316 IPFW_DEL_OBJ_REWRITER(last, opcodes);
3318 /* Remove all tables from working set */
3321 ipfw_objhash_foreach(CHAIN_TO_NI(ch), destroy_table_locked, ch);
3323 IPFW_UH_WUNLOCK(ch);
3325 /* Free pointers itself */
3326 free(ch->tablestate, M_IPFW);
3328 ipfw_table_value_destroy(ch, last);
3329 ipfw_table_algo_destroy(ch);
3331 ipfw_objhash_destroy(CHAIN_TO_NI(ch));
3332 free(CHAIN_TO_TCFG(ch), M_IPFW);
3336 * Starts tables module.
3339 ipfw_init_tables(struct ip_fw_chain *ch, int first)
3341 struct tables_config *tcfg;
3343 /* Allocate pointers */
3344 ch->tablestate = malloc(V_fw_tables_max * sizeof(struct table_info),
3345 M_IPFW, M_WAITOK | M_ZERO);
3347 tcfg = malloc(sizeof(struct tables_config), M_IPFW, M_WAITOK | M_ZERO);
3348 tcfg->namehash = ipfw_objhash_create(V_fw_tables_max);
3351 ipfw_table_value_init(ch, first);
3352 ipfw_table_algo_init(ch);
3354 IPFW_ADD_OBJ_REWRITER(first, opcodes);
3355 IPFW_ADD_SOPT_HANDLER(first, scodes);