2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
4 * Copyright (c) 2004 Ruslan Ermilov and Vsevolod Lobko.
5 * Copyright (c) 2014 Yandex LLC
6 * Copyright (c) 2014 Alexander V. Chernikov
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 #include <sys/cdefs.h>
31 __FBSDID("$FreeBSD$");
34 * Lookup table support for ipfw.
36 * This file contains handlers for all generic tables' operations:
37 * add/del/flush entries, list/dump tables etc..
39 * Table data modification is protected by both UH and runtime lock
40 * while reading configuration/data is protected by UH lock.
42 * Lookup algorithms for all table types are located in ip_fw_table_algo.c
47 #include <sys/param.h>
48 #include <sys/systm.h>
49 #include <sys/malloc.h>
50 #include <sys/kernel.h>
52 #include <sys/rwlock.h>
53 #include <sys/rmlock.h>
54 #include <sys/socket.h>
55 #include <sys/socketvar.h>
56 #include <sys/queue.h>
57 #include <net/if.h> /* ip_fw.h requires IFNAMSIZ */
59 #include <netinet/in.h>
60 #include <netinet/ip_var.h> /* struct ipfw_rule_ref */
61 #include <netinet/ip_fw.h>
63 #include <netpfil/ipfw/ip_fw_private.h>
64 #include <netpfil/ipfw/ip_fw_table.h>
67 * Table has the following `type` concepts:
69 * `no.type` represents lookup key type (addr, ifp, uid, etc..)
70 * vmask represents bitmask of table values which are present at the moment.
71 * Special IPFW_VTYPE_LEGACY ( (uint32_t)-1 ) represents old
72 * single-value-for-all approach.
75 struct named_object no;
76 uint8_t tflags; /* type flags */
77 uint8_t locked; /* 1 if locked from changes */
78 uint8_t linked; /* 1 if already linked */
79 uint8_t ochanged; /* used by set swapping */
80 uint8_t vshared; /* 1 if using shared value array */
82 uint32_t count; /* Number of records */
83 uint32_t limit; /* Max number of records */
84 uint32_t vmask; /* bitmask with supported values */
85 uint32_t ocount; /* used by set swapping */
86 uint64_t gencnt; /* generation count */
87 char tablename[64]; /* table name */
88 struct table_algo *ta; /* Callbacks for given algo */
89 void *astate; /* algorithm state */
90 struct table_info ti_copy; /* data to put to table_info */
91 struct namedobj_instance *vi;
94 static int find_table_err(struct namedobj_instance *ni, struct tid_info *ti,
95 struct table_config **tc);
96 static struct table_config *find_table(struct namedobj_instance *ni,
98 static struct table_config *alloc_table_config(struct ip_fw_chain *ch,
99 struct tid_info *ti, struct table_algo *ta, char *adata, uint8_t tflags);
100 static void free_table_config(struct namedobj_instance *ni,
101 struct table_config *tc);
102 static int create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti,
103 char *aname, ipfw_xtable_info *i, uint16_t *pkidx, int ref);
104 static void link_table(struct ip_fw_chain *ch, struct table_config *tc);
105 static void unlink_table(struct ip_fw_chain *ch, struct table_config *tc);
106 static int find_ref_table(struct ip_fw_chain *ch, struct tid_info *ti,
107 struct tentry_info *tei, uint32_t count, int op, struct table_config **ptc);
110 static int export_tables(struct ip_fw_chain *ch, ipfw_obj_lheader *olh,
111 struct sockopt_data *sd);
112 static void export_table_info(struct ip_fw_chain *ch, struct table_config *tc,
113 ipfw_xtable_info *i);
114 static int dump_table_tentry(void *e, void *arg);
115 static int dump_table_xentry(void *e, void *arg);
117 static int swap_tables(struct ip_fw_chain *ch, struct tid_info *a,
120 static int check_table_name(const char *name);
121 static int check_table_space(struct ip_fw_chain *ch, struct tableop_state *ts,
122 struct table_config *tc, struct table_info *ti, uint32_t count);
123 static int destroy_table(struct ip_fw_chain *ch, struct tid_info *ti);
125 static struct table_algo *find_table_algo(struct tables_config *tableconf,
126 struct tid_info *ti, char *name);
128 static void objheader_to_ti(struct _ipfw_obj_header *oh, struct tid_info *ti);
129 static void ntlv_to_ti(struct _ipfw_obj_ntlv *ntlv, struct tid_info *ti);
131 #define CHAIN_TO_NI(chain) (CHAIN_TO_TCFG(chain)->namehash)
132 #define KIDX_TO_TI(ch, k) (&(((struct table_info *)(ch)->tablestate)[k]))
134 #define TA_BUF_SZ 128 /* On-stack buffer for add/delete state */
137 rollback_toperation_state(struct ip_fw_chain *ch, void *object)
139 struct tables_config *tcfg;
142 tcfg = CHAIN_TO_TCFG(ch);
143 TAILQ_FOREACH(os, &tcfg->state_list, next)
144 os->func(object, os);
148 add_toperation_state(struct ip_fw_chain *ch, struct tableop_state *ts)
150 struct tables_config *tcfg;
152 tcfg = CHAIN_TO_TCFG(ch);
153 TAILQ_INSERT_HEAD(&tcfg->state_list, &ts->opstate, next);
157 del_toperation_state(struct ip_fw_chain *ch, struct tableop_state *ts)
159 struct tables_config *tcfg;
161 tcfg = CHAIN_TO_TCFG(ch);
162 TAILQ_REMOVE(&tcfg->state_list, &ts->opstate, next);
166 tc_ref(struct table_config *tc)
173 tc_unref(struct table_config *tc)
179 static struct table_value *
180 get_table_value(struct ip_fw_chain *ch, struct table_config *tc, uint32_t kidx)
182 struct table_value *pval;
184 pval = (struct table_value *)ch->valuestate;
186 return (&pval[kidx]);
191 * Checks if we're able to insert/update entry @tei into table
193 * May alter @tei to indicate insertion error / insert
196 * Returns 0 if operation can be performed/
199 check_table_limit(struct table_config *tc, struct tentry_info *tei)
202 if (tc->limit == 0 || tc->count < tc->limit)
205 if ((tei->flags & TEI_FLAGS_UPDATE) == 0) {
206 /* Notify userland on error cause */
207 tei->flags |= TEI_FLAGS_LIMIT;
212 * We have UPDATE flag set.
213 * Permit updating record (if found),
214 * but restrict adding new one since we've
215 * already hit the limit.
217 tei->flags |= TEI_FLAGS_DONTADD;
223 * Convert algorithm callback return code into
224 * one of pre-defined states known by userland.
227 store_tei_result(struct tentry_info *tei, int op, int error, uint32_t num)
235 if (op == OP_ADD && num != 0)
236 flag = TEI_FLAGS_ADDED;
238 flag = TEI_FLAGS_DELETED;
241 flag = TEI_FLAGS_NOTFOUND;
244 flag = TEI_FLAGS_EXISTS;
247 flag = TEI_FLAGS_ERROR;
254 * Creates and references table with default parameters.
255 * Saves table config, algo and allocated kidx info @ptc, @pta and
256 * @pkidx if non-zero.
257 * Used for table auto-creation to support old binaries.
259 * Returns 0 on success.
262 create_table_compat(struct ip_fw_chain *ch, struct tid_info *ti,
268 memset(&xi, 0, sizeof(xi));
269 /* Set default value mask for legacy clients */
270 xi.vmask = IPFW_VTYPE_LEGACY;
272 error = create_table_internal(ch, ti, NULL, &xi, pkidx, 1);
280 * Find and reference existing table optionally
283 * Saves found table config into @ptc.
284 * Note function may drop/acquire UH_WLOCK.
285 * Returns 0 if table was found/created and referenced
286 * or non-zero return code.
289 find_ref_table(struct ip_fw_chain *ch, struct tid_info *ti,
290 struct tentry_info *tei, uint32_t count, int op,
291 struct table_config **ptc)
293 struct namedobj_instance *ni;
294 struct table_config *tc;
298 IPFW_UH_WLOCK_ASSERT(ch);
300 ni = CHAIN_TO_NI(ch);
302 if ((tc = find_table(ni, ti)) != NULL) {
303 /* check table type */
304 if (tc->no.subtype != ti->type)
310 /* Try to exit early on limit hit */
311 if (op == OP_ADD && count == 1 &&
312 check_table_limit(tc, tei) != 0)
315 /* Reference and return */
324 /* Compatibility mode: create new table for old clients */
325 if ((tei->flags & TEI_FLAGS_COMPAT) == 0)
329 error = create_table_compat(ch, ti, &kidx);
335 tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, kidx);
336 KASSERT(tc != NULL, ("create_table_compat returned bad idx %d", kidx));
338 /* OK, now we've got referenced table. */
344 * Rolls back already @added to @tc entries using state array @ta_buf_m.
345 * Assume the following layout:
346 * 1) ADD state (ta_buf_m[0] ... t_buf_m[added - 1]) for handling update cases
347 * 2) DEL state (ta_buf_m[count[ ... t_buf_m[count + added - 1])
348 * for storing deleted state
351 rollback_added_entries(struct ip_fw_chain *ch, struct table_config *tc,
352 struct table_info *tinfo, struct tentry_info *tei, caddr_t ta_buf_m,
353 uint32_t count, uint32_t added)
355 struct table_algo *ta;
356 struct tentry_info *ptei;
362 IPFW_UH_WLOCK_ASSERT(ch);
365 ta_buf_sz = ta->ta_buf_size;
367 vv = v + count * ta_buf_sz;
368 for (i = 0; i < added; i++, v += ta_buf_sz, vv += ta_buf_sz) {
370 if ((ptei->flags & TEI_FLAGS_UPDATED) != 0) {
373 * We have old value stored by previous
374 * call in @ptei->value. Do add once again
377 error = ta->add(tc->astate, tinfo, ptei, v, &num);
378 KASSERT(error == 0, ("rollback UPDATE fail"));
379 KASSERT(num == 0, ("rollback UPDATE fail2"));
383 error = ta->prepare_del(ch, ptei, vv);
384 KASSERT(error == 0, ("pre-rollback INSERT failed"));
385 error = ta->del(tc->astate, tinfo, ptei, vv, &num);
386 KASSERT(error == 0, ("rollback INSERT failed"));
392 * Prepares add/del state for all @count entries in @tei.
393 * Uses either stack buffer (@ta_buf) or allocates a new one.
394 * Stores pointer to allocated buffer back to @ta_buf.
396 * Returns 0 on success.
399 prepare_batch_buffer(struct ip_fw_chain *ch, struct table_algo *ta,
400 struct tentry_info *tei, uint32_t count, int op, caddr_t *ta_buf)
403 size_t ta_buf_sz, sz;
404 struct tentry_info *ptei;
408 ta_buf_sz = ta->ta_buf_size;
410 /* Single add/delete, use on-stack buffer */
411 memset(*ta_buf, 0, TA_BUF_SZ);
416 * Multiple adds/deletes, allocate larger buffer
418 * Note we need 2xcount buffer for add case:
419 * we have hold both ADD state
420 * and DELETE state (this may be needed
421 * if we need to rollback all changes)
423 sz = count * ta_buf_sz;
424 ta_buf_m = malloc((op == OP_ADD) ? sz * 2 : sz, M_TEMP,
429 for (i = 0; i < count; i++, v += ta_buf_sz) {
431 error = (op == OP_ADD) ?
432 ta->prepare_add(ch, ptei, v) : ta->prepare_del(ch, ptei, v);
435 * Some syntax error (incorrect mask, or address, or
436 * anything). Return error regardless of atomicity
448 * Flushes allocated state for each @count entries in @tei.
449 * Frees @ta_buf_m if differs from stack buffer @ta_buf.
452 flush_batch_buffer(struct ip_fw_chain *ch, struct table_algo *ta,
453 struct tentry_info *tei, uint32_t count, int rollback,
454 caddr_t ta_buf_m, caddr_t ta_buf)
457 struct tentry_info *ptei;
461 ta_buf_sz = ta->ta_buf_size;
463 /* Run cleaning callback anyway */
465 for (i = 0; i < count; i++, v += ta_buf_sz) {
467 ta->flush_entry(ch, ptei, v);
468 if (ptei->ptv != NULL) {
469 free(ptei->ptv, M_IPFW);
474 /* Clean up "deleted" state in case of rollback */
476 v = ta_buf_m + count * ta_buf_sz;
477 for (i = 0; i < count; i++, v += ta_buf_sz)
478 ta->flush_entry(ch, &tei[i], v);
481 if (ta_buf_m != ta_buf)
482 free(ta_buf_m, M_TEMP);
487 rollback_add_entry(void *object, struct op_state *_state)
489 struct ip_fw_chain *ch;
490 struct tableop_state *ts;
492 ts = (struct tableop_state *)_state;
494 if (ts->tc != object && ts->ch != object)
499 IPFW_UH_WLOCK_ASSERT(ch);
501 /* Call specifid unlockers */
502 rollback_table_values(ts);
504 /* Indicate we've called */
509 * Adds/updates one or more entries in table @ti.
511 * Function may drop/reacquire UH wlock multiple times due to
512 * items alloc, algorithm callbacks (check_space), value linkage
513 * (new values, value storage realloc), etc..
514 * Other processes like other adds (which may involve storage resize),
515 * table swaps (which changes table data and may change algo type),
516 * table modify (which may change value mask) may be executed
517 * simultaneously so we need to deal with it.
519 * The following approach was implemented:
520 * we have per-chain linked list, protected with UH lock.
521 * add_table_entry prepares special on-stack structure wthich is passed
522 * to its descendants. Users add this structure to this list before unlock.
523 * After performing needed operations and acquiring UH lock back, each user
524 * checks if structure has changed. If true, it rolls local state back and
525 * returns without error to the caller.
526 * add_table_entry() on its own checks if structure has changed and restarts
527 * its operation from the beginning (goto restart).
529 * Functions which are modifying fields of interest (currently
530 * resize_shared_value_storage() and swap_tables() )
531 * traverses given list while holding UH lock immediately before
532 * performing their operations calling function provided be list entry
533 * ( currently rollback_add_entry ) which performs rollback for all necessary
534 * state and sets appropriate values in structure indicating rollback
538 * Function references @ti first to ensure table won't
539 * disappear or change its type.
540 * After that, prepare_add callback is called for each @tei entry.
541 * Next, we try to add each entry under UH+WHLOCK
542 * using add() callback.
543 * Finally, we free all state by calling flush_entry callback
546 * Returns 0 on success.
549 add_table_entry(struct ip_fw_chain *ch, struct tid_info *ti,
550 struct tentry_info *tei, uint8_t flags, uint32_t count)
552 struct table_config *tc;
553 struct table_algo *ta;
555 int error, first_error, i, rollback;
556 uint32_t num, numadd;
557 struct tentry_info *ptei;
558 struct tableop_state ts;
559 char ta_buf[TA_BUF_SZ];
562 memset(&ts, 0, sizeof(ts));
567 * Find and reference existing table.
570 if (ts.modified != 0) {
572 flush_batch_buffer(ch, ta, tei, count, rollback,
574 memset(&ts, 0, sizeof(ts));
579 error = find_ref_table(ch, ti, tei, count, OP_ADD, &tc);
586 /* Fill in tablestate */
588 ts.opstate.func = rollback_add_entry;
590 ts.vshared = tc->vshared;
591 ts.vmask = tc->vmask;
596 add_toperation_state(ch, &ts);
599 /* Allocate memory and prepare record(s) */
600 /* Pass stack buffer by default */
602 error = prepare_batch_buffer(ch, ta, tei, count, OP_ADD, &ta_buf_m);
605 del_toperation_state(ch, &ts);
606 /* Drop reference we've used in first search */
609 /* Check prepare_batch_buffer() error */
614 * Check if table swap has happened.
615 * (so table algo might be changed).
616 * Restart operation to achieve consistent behavior.
618 if (ts.modified != 0)
622 * Link all values values to shared/per-table value array.
624 * May release/reacquire UH_WLOCK.
626 error = ipfw_link_table_values(ch, &ts, flags);
629 if (ts.modified != 0)
633 * Ensure we are able to add all entries without additional
634 * memory allocations. May release/reacquire UH_WLOCK.
637 error = check_table_space(ch, &ts, tc, KIDX_TO_TI(ch, kidx), count);
640 if (ts.modified != 0)
643 /* We've got valid table in @tc. Let's try to add data */
652 for (i = 0; i < count; i++, v += ta->ta_buf_size) {
655 /* check limit before adding */
656 if ((error = check_table_limit(tc, ptei)) == 0) {
658 * It should be safe to insert a record w/o
659 * a properly-linked value if atomicity is
662 * If the added item does not have a valid value
663 * index, it would get rejected by ta->add().
665 error = ta->add(tc->astate, KIDX_TO_TI(ch, kidx),
667 /* Set status flag to inform userland */
668 store_tei_result(ptei, OP_ADD, error, num);
671 /* Update number of records to ease limit checking */
677 if (first_error == 0)
681 * Some error have happened. Check our atomicity
682 * settings: continue if atomicity is not required,
683 * rollback changes otherwise.
685 if ((flags & IPFW_CTF_ATOMIC) == 0)
688 rollback_added_entries(ch, tc, KIDX_TO_TI(ch, kidx),
689 tei, ta_buf_m, count, i);
697 ipfw_garbage_table_values(ch, tc, tei, count, rollback);
699 /* Permit post-add algorithm grow/rehash. */
701 check_table_space(ch, NULL, tc, KIDX_TO_TI(ch, kidx), 0);
703 /* Return first error to user, if any */
709 flush_batch_buffer(ch, ta, tei, count, rollback, ta_buf_m, ta_buf);
715 * Deletes one or more entries in table @ti.
717 * Returns 0 on success.
720 del_table_entry(struct ip_fw_chain *ch, struct tid_info *ti,
721 struct tentry_info *tei, uint8_t flags, uint32_t count)
723 struct table_config *tc;
724 struct table_algo *ta;
725 struct tentry_info *ptei;
727 int error, first_error, i;
728 uint32_t num, numdel;
729 char ta_buf[TA_BUF_SZ];
733 * Find and reference existing table.
736 error = find_ref_table(ch, ti, tei, count, OP_DEL, &tc);
744 /* Allocate memory and prepare record(s) */
745 /* Pass stack buffer by default */
747 error = prepare_batch_buffer(ch, ta, tei, count, OP_DEL, &ta_buf_m);
753 /* Drop reference we've used in first search */
757 * Check if table algo is still the same.
758 * (changed ta may be the result of table swap).
772 for (i = 0; i < count; i++, v += ta->ta_buf_size) {
775 error = ta->del(tc->astate, KIDX_TO_TI(ch, kidx), ptei, v,
777 /* Save state for userland */
778 store_tei_result(ptei, OP_DEL, error, num);
779 if (error != 0 && first_error == 0)
786 /* Unlink non-used values */
787 ipfw_garbage_table_values(ch, tc, tei, count, 0);
790 /* Run post-del hook to permit shrinking */
791 check_table_space(ch, NULL, tc, KIDX_TO_TI(ch, kidx), 0);
796 /* Return first error to user, if any */
800 flush_batch_buffer(ch, ta, tei, count, 0, ta_buf_m, ta_buf);
806 * Ensure that table @tc has enough space to add @count entries without
807 * need for reallocation.
810 * 0) need_modify() (UH_WLOCK) - checks if @count items can be added w/o resize.
812 * 1) alloc_modify (no locks, M_WAITOK) - alloc new state based on @pflags.
813 * 2) prepare_modifyt (UH_WLOCK) - copy old data into new storage
814 * 3) modify (UH_WLOCK + WLOCK) - switch pointers
815 * 4) flush_modify (UH_WLOCK) - free state, if needed
817 * Returns 0 on success.
820 check_table_space(struct ip_fw_chain *ch, struct tableop_state *ts,
821 struct table_config *tc, struct table_info *ti, uint32_t count)
823 struct table_algo *ta;
825 char ta_buf[TA_BUF_SZ];
828 IPFW_UH_WLOCK_ASSERT(ch);
832 if (ta->need_modify == NULL)
835 /* Acquire reference not to loose @tc between locks/unlocks */
839 * TODO: think about avoiding race between large add/large delete
840 * operation on algorithm which implements shrinking along with
845 if (ta->need_modify(tc->astate, ti, count, &pflags) == 0) {
850 /* We have to shrink/grow table */
852 add_toperation_state(ch, ts);
855 memset(&ta_buf, 0, sizeof(ta_buf));
856 error = ta->prepare_mod(ta_buf, &pflags);
860 del_toperation_state(ch, ts);
865 if (ts != NULL && ts->modified != 0) {
868 * Swap operation has happened
869 * so we're currently operating on other
870 * table data. Stop doing this.
872 ta->flush_mod(ta_buf);
876 /* Check if we still need to alter table */
877 ti = KIDX_TO_TI(ch, tc->no.kidx);
878 if (ta->need_modify(tc->astate, ti, count, &pflags) == 0) {
882 * Other thread has already performed resize.
883 * Flush our state and return.
885 ta->flush_mod(ta_buf);
889 error = ta->fill_mod(tc->astate, ti, ta_buf, &pflags);
891 /* Do actual modification */
893 ta->modify(tc->astate, ti, ta_buf, pflags);
897 /* Anyway, flush data and retry */
898 ta->flush_mod(ta_buf);
906 * Adds or deletes record in table.
908 * Request: [ ip_fw3_opheader ipfw_table_xentry ]
910 * Returns 0 on success
913 manage_table_ent_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
914 struct sockopt_data *sd)
916 ipfw_table_xentry *xent;
917 struct tentry_info tei;
919 struct table_value v;
920 int error, hdrlen, read;
922 hdrlen = offsetof(ipfw_table_xentry, k);
924 /* Check minimum header size */
925 if (sd->valsize < (sizeof(*op3) + hdrlen))
928 read = sizeof(ip_fw3_opheader);
930 /* Check if xentry len field is valid */
931 xent = (ipfw_table_xentry *)(op3 + 1);
932 if (xent->len < hdrlen || xent->len + read > sd->valsize)
935 memset(&tei, 0, sizeof(tei));
936 tei.paddr = &xent->k;
937 tei.masklen = xent->masklen;
938 ipfw_import_table_value_legacy(xent->value, &v);
940 /* Old requests compatibility */
941 tei.flags = TEI_FLAGS_COMPAT;
942 if (xent->type == IPFW_TABLE_ADDR) {
943 if (xent->len - hdrlen == sizeof(in_addr_t))
944 tei.subtype = AF_INET;
946 tei.subtype = AF_INET6;
949 memset(&ti, 0, sizeof(ti));
951 ti.type = xent->type;
953 error = (op3->opcode == IP_FW_TABLE_XADD) ?
954 add_table_entry(ch, &ti, &tei, 0, 1) :
955 del_table_entry(ch, &ti, &tei, 0, 1);
961 * Adds or deletes record in table.
962 * Data layout (v1)(current):
963 * Request: [ ipfw_obj_header
964 * ipfw_obj_ctlv(IPFW_TLV_TBLENT_LIST) [ ipfw_obj_tentry x N ]
967 * Returns 0 on success
970 manage_table_ent_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
971 struct sockopt_data *sd)
973 ipfw_obj_tentry *tent, *ptent;
976 struct tentry_info *ptei, tei, *tei_buf;
978 int error, i, kidx, read;
980 /* Check minimum header size */
981 if (sd->valsize < (sizeof(*oh) + sizeof(*ctlv)))
984 /* Check if passed data is too long */
985 if (sd->valsize != sd->kavail)
988 oh = (ipfw_obj_header *)sd->kbuf;
990 /* Basic length checks for TLVs */
991 if (oh->ntlv.head.length != sizeof(oh->ntlv))
996 ctlv = (ipfw_obj_ctlv *)(oh + 1);
997 if (ctlv->head.length + read != sd->valsize)
1000 read += sizeof(*ctlv);
1001 tent = (ipfw_obj_tentry *)(ctlv + 1);
1002 if (ctlv->count * sizeof(*tent) + read != sd->valsize)
1005 if (ctlv->count == 0)
1009 * Mark entire buffer as "read".
1010 * This instructs sopt api write it back
1011 * after function return.
1013 ipfw_get_sopt_header(sd, sd->valsize);
1015 /* Perform basic checks for each entry */
1018 for (i = 0; i < ctlv->count; i++, ptent++) {
1019 if (ptent->head.length != sizeof(*ptent))
1021 if (ptent->idx != kidx)
1025 /* Convert data into kernel request objects */
1026 objheader_to_ti(oh, &ti);
1027 ti.type = oh->ntlv.type;
1030 /* Use on-stack buffer for single add/del */
1031 if (ctlv->count == 1) {
1032 memset(&tei, 0, sizeof(tei));
1035 tei_buf = malloc(ctlv->count * sizeof(tei), M_TEMP,
1040 for (i = 0; i < ctlv->count; i++, ptent++, ptei++) {
1041 ptei->paddr = &ptent->k;
1042 ptei->subtype = ptent->subtype;
1043 ptei->masklen = ptent->masklen;
1044 if (ptent->head.flags & IPFW_TF_UPDATE)
1045 ptei->flags |= TEI_FLAGS_UPDATE;
1047 ipfw_import_table_value_v1(&ptent->v.value);
1048 ptei->pvalue = (struct table_value *)&ptent->v.value;
1051 error = (oh->opheader.opcode == IP_FW_TABLE_XADD) ?
1052 add_table_entry(ch, &ti, tei_buf, ctlv->flags, ctlv->count) :
1053 del_table_entry(ch, &ti, tei_buf, ctlv->flags, ctlv->count);
1055 /* Translate result back to userland */
1058 for (i = 0; i < ctlv->count; i++, ptent++, ptei++) {
1059 if (ptei->flags & TEI_FLAGS_ADDED)
1060 ptent->result = IPFW_TR_ADDED;
1061 else if (ptei->flags & TEI_FLAGS_DELETED)
1062 ptent->result = IPFW_TR_DELETED;
1063 else if (ptei->flags & TEI_FLAGS_UPDATED)
1064 ptent->result = IPFW_TR_UPDATED;
1065 else if (ptei->flags & TEI_FLAGS_LIMIT)
1066 ptent->result = IPFW_TR_LIMIT;
1067 else if (ptei->flags & TEI_FLAGS_ERROR)
1068 ptent->result = IPFW_TR_ERROR;
1069 else if (ptei->flags & TEI_FLAGS_NOTFOUND)
1070 ptent->result = IPFW_TR_NOTFOUND;
1071 else if (ptei->flags & TEI_FLAGS_EXISTS)
1072 ptent->result = IPFW_TR_EXISTS;
1073 ipfw_export_table_value_v1(ptei->pvalue, &ptent->v.value);
1076 if (tei_buf != &tei)
1077 free(tei_buf, M_TEMP);
1083 * Looks up an entry in given table.
1084 * Data layout (v0)(current):
1085 * Request: [ ipfw_obj_header ipfw_obj_tentry ]
1086 * Reply: [ ipfw_obj_header ipfw_obj_tentry ]
1088 * Returns 0 on success
1091 find_table_entry(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1092 struct sockopt_data *sd)
1094 ipfw_obj_tentry *tent;
1095 ipfw_obj_header *oh;
1097 struct table_config *tc;
1098 struct table_algo *ta;
1099 struct table_info *kti;
1100 struct table_value *pval;
1101 struct namedobj_instance *ni;
1105 /* Check minimum header size */
1106 sz = sizeof(*oh) + sizeof(*tent);
1107 if (sd->valsize != sz)
1110 oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz);
1111 tent = (ipfw_obj_tentry *)(oh + 1);
1113 /* Basic length checks for TLVs */
1114 if (oh->ntlv.head.length != sizeof(oh->ntlv))
1117 objheader_to_ti(oh, &ti);
1118 ti.type = oh->ntlv.type;
1119 ti.uidx = tent->idx;
1122 ni = CHAIN_TO_NI(ch);
1125 * Find existing table and check its type .
1128 if ((tc = find_table(ni, &ti)) == NULL) {
1129 IPFW_UH_RUNLOCK(ch);
1133 /* check table type */
1134 if (tc->no.subtype != ti.type) {
1135 IPFW_UH_RUNLOCK(ch);
1139 kti = KIDX_TO_TI(ch, tc->no.kidx);
1142 if (ta->find_tentry == NULL)
1145 error = ta->find_tentry(tc->astate, kti, tent);
1147 pval = get_table_value(ch, tc, tent->v.kidx);
1148 ipfw_export_table_value_v1(pval, &tent->v.value);
1150 IPFW_UH_RUNLOCK(ch);
1156 * Flushes all entries or destroys given table.
1157 * Data layout (v0)(current):
1158 * Request: [ ipfw_obj_header ]
1160 * Returns 0 on success
1163 flush_table_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1164 struct sockopt_data *sd)
1167 struct _ipfw_obj_header *oh;
1170 if (sd->valsize != sizeof(*oh))
1173 oh = (struct _ipfw_obj_header *)op3;
1174 objheader_to_ti(oh, &ti);
1176 if (op3->opcode == IP_FW_TABLE_XDESTROY)
1177 error = destroy_table(ch, &ti);
1178 else if (op3->opcode == IP_FW_TABLE_XFLUSH)
1179 error = flush_table(ch, &ti);
1187 restart_flush(void *object, struct op_state *_state)
1189 struct tableop_state *ts;
1191 ts = (struct tableop_state *)_state;
1193 if (ts->tc != object)
1196 /* Indicate we've called */
1201 * Flushes given table.
1203 * Function create new table instance with the same
1204 * parameters, swaps it with old one and
1205 * flushes state without holding runtime WLOCK.
1207 * Returns 0 on success.
1210 flush_table(struct ip_fw_chain *ch, struct tid_info *ti)
1212 struct namedobj_instance *ni;
1213 struct table_config *tc;
1214 struct table_algo *ta;
1215 struct table_info ti_old, ti_new, *tablestate;
1216 void *astate_old, *astate_new;
1217 char algostate[64], *pstate;
1218 struct tableop_state ts;
1224 * Stage 1: save table algorithm.
1225 * Reference found table to ensure it won't disappear.
1228 ni = CHAIN_TO_NI(ch);
1229 if ((tc = find_table(ni, ti)) == NULL) {
1230 IPFW_UH_WUNLOCK(ch);
1235 memset(&ti_new, 0, sizeof(ti_new));
1237 /* Set up swap handler */
1238 memset(&ts, 0, sizeof(ts));
1239 ts.opstate.func = restart_flush;
1243 /* Do not flush readonly tables */
1244 if ((ta->flags & TA_FLAG_READONLY) != 0) {
1245 IPFW_UH_WUNLOCK(ch);
1248 /* Save startup algo parameters */
1249 if (ta->print_config != NULL) {
1250 ta->print_config(tc->astate, KIDX_TO_TI(ch, tc->no.kidx),
1251 algostate, sizeof(algostate));
1255 tflags = tc->tflags;
1257 add_toperation_state(ch, &ts);
1258 IPFW_UH_WUNLOCK(ch);
1261 * Stage 1.5: if this is not the first attempt, destroy previous state
1264 ta->destroy(astate_new, &ti_new);
1269 * Stage 2: allocate new table instance using same algo.
1271 memset(&ti_new, 0, sizeof(struct table_info));
1272 error = ta->init(ch, &astate_new, &ti_new, pstate, tflags);
1275 * Stage 3: swap old state pointers with newly-allocated ones.
1276 * Decrease refcount.
1280 del_toperation_state(ch, &ts);
1283 IPFW_UH_WUNLOCK(ch);
1288 * Restart operation if table swap has happened:
1289 * even if algo may be the same, algo init parameters
1290 * may change. Restart operation instead of doing
1293 if (ts.modified != 0) {
1294 /* Delay destroying data since we're holding UH lock */
1299 ni = CHAIN_TO_NI(ch);
1301 tablestate = (struct table_info *)ch->tablestate;
1304 ti_old = tablestate[kidx];
1305 tablestate[kidx] = ti_new;
1308 astate_old = tc->astate;
1309 tc->astate = astate_new;
1310 tc->ti_copy = ti_new;
1313 /* Notify algo on real @ti address */
1314 if (ta->change_ti != NULL)
1315 ta->change_ti(tc->astate, &tablestate[kidx]);
1318 * Stage 4: unref values.
1320 ipfw_unref_table_values(ch, tc, ta, astate_old, &ti_old);
1321 IPFW_UH_WUNLOCK(ch);
1324 * Stage 5: perform real flush/destroy.
1326 ta->destroy(astate_old, &ti_old);
1333 * Data layout (v0)(current):
1334 * Request: [ ipfw_obj_header ipfw_obj_ntlv ]
1336 * Returns 0 on success
1339 swap_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1340 struct sockopt_data *sd)
1343 struct _ipfw_obj_header *oh;
1344 struct tid_info ti_a, ti_b;
1346 if (sd->valsize != sizeof(*oh) + sizeof(ipfw_obj_ntlv))
1349 oh = (struct _ipfw_obj_header *)op3;
1350 ntlv_to_ti(&oh->ntlv, &ti_a);
1351 ntlv_to_ti((ipfw_obj_ntlv *)(oh + 1), &ti_b);
1353 error = swap_tables(ch, &ti_a, &ti_b);
1359 * Swaps two tables of the same type/valtype.
1361 * Checks if tables are compatible and limits
1362 * permits swap, than actually perform swap.
1364 * Each table consists of 2 different parts:
1366 * @tc (with name, set, kidx) and rule bindings, which is "stable".
1370 * runtime data @ti (ch->tablestate)
1371 * runtime cache in @tc
1372 * algo-specific data (@tc->astate)
1379 * After that we call @ti change handler for each table.
1381 * Note that referencing @tc won't protect tc->ta from change.
1382 * XXX: Do we need to restrict swap between locked tables?
1383 * XXX: Do we need to exchange ftype?
1385 * Returns 0 on success.
1388 swap_tables(struct ip_fw_chain *ch, struct tid_info *a,
1391 struct namedobj_instance *ni;
1392 struct table_config *tc_a, *tc_b;
1393 struct table_algo *ta;
1394 struct table_info ti, *tablestate;
1399 * Stage 1: find both tables and ensure they are of
1403 ni = CHAIN_TO_NI(ch);
1404 if ((tc_a = find_table(ni, a)) == NULL) {
1405 IPFW_UH_WUNLOCK(ch);
1408 if ((tc_b = find_table(ni, b)) == NULL) {
1409 IPFW_UH_WUNLOCK(ch);
1413 /* It is very easy to swap between the same table */
1415 IPFW_UH_WUNLOCK(ch);
1419 /* Check type and value are the same */
1420 if (tc_a->no.subtype!=tc_b->no.subtype || tc_a->tflags!=tc_b->tflags) {
1421 IPFW_UH_WUNLOCK(ch);
1425 /* Check limits before swap */
1426 if ((tc_a->limit != 0 && tc_b->count > tc_a->limit) ||
1427 (tc_b->limit != 0 && tc_a->count > tc_b->limit)) {
1428 IPFW_UH_WUNLOCK(ch);
1432 /* Check if one of the tables is readonly */
1433 if (((tc_a->ta->flags | tc_b->ta->flags) & TA_FLAG_READONLY) != 0) {
1434 IPFW_UH_WUNLOCK(ch);
1438 /* Notify we're going to swap */
1439 rollback_toperation_state(ch, tc_a);
1440 rollback_toperation_state(ch, tc_b);
1442 /* Everything is fine, prepare to swap */
1443 tablestate = (struct table_info *)ch->tablestate;
1444 ti = tablestate[tc_a->no.kidx];
1446 astate = tc_a->astate;
1447 count = tc_a->count;
1451 tablestate[tc_a->no.kidx] = tablestate[tc_b->no.kidx];
1452 tc_a->ta = tc_b->ta;
1453 tc_a->astate = tc_b->astate;
1454 tc_a->count = tc_b->count;
1456 tablestate[tc_b->no.kidx] = ti;
1458 tc_b->astate = astate;
1459 tc_b->count = count;
1462 /* Ensure tc.ti copies are in sync */
1463 tc_a->ti_copy = tablestate[tc_a->no.kidx];
1464 tc_b->ti_copy = tablestate[tc_b->no.kidx];
1466 /* Notify both tables on @ti change */
1467 if (tc_a->ta->change_ti != NULL)
1468 tc_a->ta->change_ti(tc_a->astate, &tablestate[tc_a->no.kidx]);
1469 if (tc_b->ta->change_ti != NULL)
1470 tc_b->ta->change_ti(tc_b->astate, &tablestate[tc_b->no.kidx]);
1472 IPFW_UH_WUNLOCK(ch);
1478 * Destroys table specified by @ti.
1479 * Data layout (v0)(current):
1480 * Request: [ ip_fw3_opheader ]
1482 * Returns 0 on success
1485 destroy_table(struct ip_fw_chain *ch, struct tid_info *ti)
1487 struct namedobj_instance *ni;
1488 struct table_config *tc;
1492 ni = CHAIN_TO_NI(ch);
1493 if ((tc = find_table(ni, ti)) == NULL) {
1494 IPFW_UH_WUNLOCK(ch);
1498 /* Do not permit destroying referenced tables */
1499 if (tc->no.refcnt > 0) {
1500 IPFW_UH_WUNLOCK(ch);
1505 unlink_table(ch, tc);
1508 /* Free obj index */
1509 if (ipfw_objhash_free_idx(ni, tc->no.kidx) != 0)
1510 printf("Error unlinking kidx %d from table %s\n",
1511 tc->no.kidx, tc->tablename);
1513 /* Unref values used in tables while holding UH lock */
1514 ipfw_unref_table_values(ch, tc, tc->ta, tc->astate, &tc->ti_copy);
1515 IPFW_UH_WUNLOCK(ch);
1517 free_table_config(ni, tc);
1523 roundup2p(uint32_t v)
1538 * Grow tables index.
1540 * Returns 0 on success.
1543 ipfw_resize_tables(struct ip_fw_chain *ch, unsigned int ntables)
1545 unsigned int ntables_old, tbl;
1546 struct namedobj_instance *ni;
1547 void *new_idx, *old_tablestate, *tablestate;
1548 struct table_info *ti;
1549 struct table_config *tc;
1552 /* Check new value for validity */
1555 if (ntables > IPFW_TABLES_MAX)
1556 ntables = IPFW_TABLES_MAX;
1557 /* Alight to nearest power of 2 */
1558 ntables = (unsigned int)roundup2p(ntables);
1560 /* Allocate new pointers */
1561 tablestate = malloc(ntables * sizeof(struct table_info),
1562 M_IPFW, M_WAITOK | M_ZERO);
1564 ipfw_objhash_bitmap_alloc(ntables, (void *)&new_idx, &new_blocks);
1568 tbl = (ntables >= V_fw_tables_max) ? V_fw_tables_max : ntables;
1569 ni = CHAIN_TO_NI(ch);
1571 /* Temporary restrict decreasing max_tables */
1572 if (ntables < V_fw_tables_max) {
1575 * FIXME: Check if we really can shrink
1577 IPFW_UH_WUNLOCK(ch);
1581 /* Copy table info/indices */
1582 memcpy(tablestate, ch->tablestate, sizeof(struct table_info) * tbl);
1583 ipfw_objhash_bitmap_merge(ni, &new_idx, &new_blocks);
1587 /* Change pointers */
1588 old_tablestate = ch->tablestate;
1589 ch->tablestate = tablestate;
1590 ipfw_objhash_bitmap_swap(ni, &new_idx, &new_blocks);
1592 ntables_old = V_fw_tables_max;
1593 V_fw_tables_max = ntables;
1597 /* Notify all consumers that their @ti pointer has changed */
1598 ti = (struct table_info *)ch->tablestate;
1599 for (i = 0; i < tbl; i++, ti++) {
1600 if (ti->lookup == NULL)
1602 tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, i);
1603 if (tc == NULL || tc->ta->change_ti == NULL)
1606 tc->ta->change_ti(tc->astate, ti);
1609 IPFW_UH_WUNLOCK(ch);
1611 /* Free old pointers */
1612 free(old_tablestate, M_IPFW);
1613 ipfw_objhash_bitmap_free(new_idx, new_blocks);
1619 * Lookup table's named object by its @kidx.
1621 struct named_object *
1622 ipfw_objhash_lookup_table_kidx(struct ip_fw_chain *ch, uint16_t kidx)
1625 return (ipfw_objhash_lookup_kidx(CHAIN_TO_NI(ch), kidx));
1629 * Take reference to table specified in @ntlv.
1630 * On success return its @kidx.
1633 ipfw_ref_table(struct ip_fw_chain *ch, ipfw_obj_ntlv *ntlv, uint16_t *kidx)
1636 struct table_config *tc;
1639 IPFW_UH_WLOCK_ASSERT(ch);
1641 ntlv_to_ti(ntlv, &ti);
1642 error = find_table_err(CHAIN_TO_NI(ch), &ti, &tc);
1650 *kidx = tc->no.kidx;
1656 ipfw_unref_table(struct ip_fw_chain *ch, uint16_t kidx)
1659 struct namedobj_instance *ni;
1660 struct named_object *no;
1662 IPFW_UH_WLOCK_ASSERT(ch);
1663 ni = CHAIN_TO_NI(ch);
1664 no = ipfw_objhash_lookup_kidx(ni, kidx);
1665 KASSERT(no != NULL, ("Table with index %d not found", kidx));
1670 * Lookup an arbitrary key @paddr of length @plen in table @tbl.
1671 * Stores found value in @val.
1673 * Returns 1 if key was found.
1676 ipfw_lookup_table(struct ip_fw_chain *ch, uint16_t tbl, uint16_t plen,
1677 void *paddr, uint32_t *val)
1679 struct table_info *ti;
1681 ti = KIDX_TO_TI(ch, tbl);
1683 return (ti->lookup(ti, paddr, plen, val));
1687 * Info/List/dump support for tables.
1692 * High-level 'get' cmds sysctl handlers
1696 * Lists all tables currently available in kernel.
1697 * Data layout (v0)(current):
1698 * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size
1699 * Reply: [ ipfw_obj_lheader ipfw_xtable_info x N ]
1701 * Returns 0 on success
1704 list_tables(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1705 struct sockopt_data *sd)
1707 struct _ipfw_obj_lheader *olh;
1710 olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh));
1713 if (sd->valsize < olh->size)
1717 error = export_tables(ch, olh, sd);
1718 IPFW_UH_RUNLOCK(ch);
1724 * Store table info to buffer provided by @sd.
1725 * Data layout (v0)(current):
1726 * Request: [ ipfw_obj_header ipfw_xtable_info(empty)]
1727 * Reply: [ ipfw_obj_header ipfw_xtable_info ]
1729 * Returns 0 on success.
1732 describe_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1733 struct sockopt_data *sd)
1735 struct _ipfw_obj_header *oh;
1736 struct table_config *tc;
1740 sz = sizeof(*oh) + sizeof(ipfw_xtable_info);
1741 oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz);
1745 objheader_to_ti(oh, &ti);
1748 if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) {
1749 IPFW_UH_RUNLOCK(ch);
1753 export_table_info(ch, tc, (ipfw_xtable_info *)(oh + 1));
1754 IPFW_UH_RUNLOCK(ch);
1760 * Modifies existing table.
1761 * Data layout (v0)(current):
1762 * Request: [ ipfw_obj_header ipfw_xtable_info ]
1764 * Returns 0 on success
1767 modify_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1768 struct sockopt_data *sd)
1770 struct _ipfw_obj_header *oh;
1771 ipfw_xtable_info *i;
1774 struct namedobj_instance *ni;
1775 struct table_config *tc;
1777 if (sd->valsize != sizeof(*oh) + sizeof(ipfw_xtable_info))
1780 oh = (struct _ipfw_obj_header *)sd->kbuf;
1781 i = (ipfw_xtable_info *)(oh + 1);
1784 * Verify user-supplied strings.
1785 * Check for null-terminated/zero-length strings/
1787 tname = oh->ntlv.name;
1788 if (check_table_name(tname) != 0)
1791 objheader_to_ti(oh, &ti);
1795 ni = CHAIN_TO_NI(ch);
1796 if ((tc = find_table(ni, &ti)) == NULL) {
1797 IPFW_UH_WUNLOCK(ch);
1801 /* Do not support any modifications for readonly tables */
1802 if ((tc->ta->flags & TA_FLAG_READONLY) != 0) {
1803 IPFW_UH_WUNLOCK(ch);
1807 if ((i->mflags & IPFW_TMFLAGS_LIMIT) != 0)
1808 tc->limit = i->limit;
1809 if ((i->mflags & IPFW_TMFLAGS_LOCK) != 0)
1810 tc->locked = ((i->flags & IPFW_TGFLAGS_LOCKED) != 0);
1811 IPFW_UH_WUNLOCK(ch);
1817 * Creates new table.
1818 * Data layout (v0)(current):
1819 * Request: [ ipfw_obj_header ipfw_xtable_info ]
1821 * Returns 0 on success
1824 create_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1825 struct sockopt_data *sd)
1827 struct _ipfw_obj_header *oh;
1828 ipfw_xtable_info *i;
1829 char *tname, *aname;
1831 struct namedobj_instance *ni;
1833 if (sd->valsize != sizeof(*oh) + sizeof(ipfw_xtable_info))
1836 oh = (struct _ipfw_obj_header *)sd->kbuf;
1837 i = (ipfw_xtable_info *)(oh + 1);
1840 * Verify user-supplied strings.
1841 * Check for null-terminated/zero-length strings/
1843 tname = oh->ntlv.name;
1844 aname = i->algoname;
1845 if (check_table_name(tname) != 0 ||
1846 strnlen(aname, sizeof(i->algoname)) == sizeof(i->algoname))
1849 if (aname[0] == '\0') {
1850 /* Use default algorithm */
1854 objheader_to_ti(oh, &ti);
1857 ni = CHAIN_TO_NI(ch);
1860 if (find_table(ni, &ti) != NULL) {
1861 IPFW_UH_RUNLOCK(ch);
1864 IPFW_UH_RUNLOCK(ch);
1866 return (create_table_internal(ch, &ti, aname, i, NULL, 0));
1870 * Creates new table based on @ti and @aname.
1872 * Assume @aname to be checked and valid.
1873 * Stores allocated table kidx inside @pkidx (if non-NULL).
1874 * Reference created table if @compat is non-zero.
1876 * Returns 0 on success.
1879 create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti,
1880 char *aname, ipfw_xtable_info *i, uint16_t *pkidx, int compat)
1882 struct namedobj_instance *ni;
1883 struct table_config *tc, *tc_new, *tmp;
1884 struct table_algo *ta;
1887 ni = CHAIN_TO_NI(ch);
1889 ta = find_table_algo(CHAIN_TO_TCFG(ch), ti, aname);
1893 tc = alloc_table_config(ch, ti, ta, aname, i->tflags);
1897 tc->vmask = i->vmask;
1898 tc->limit = i->limit;
1899 if (ta->flags & TA_FLAG_READONLY)
1902 tc->locked = (i->flags & IPFW_TGFLAGS_LOCKED) != 0;
1906 /* Check if table has been already created */
1907 tc_new = find_table(ni, ti);
1908 if (tc_new != NULL) {
1911 * Compat: do not fail if we're
1912 * requesting to create existing table
1913 * which has the same type
1915 if (compat == 0 || tc_new->no.subtype != tc->no.subtype) {
1916 IPFW_UH_WUNLOCK(ch);
1917 free_table_config(ni, tc);
1921 /* Exchange tc and tc_new for proper refcounting & freeing */
1927 if (ipfw_objhash_alloc_idx(ni, &kidx) != 0) {
1928 IPFW_UH_WUNLOCK(ch);
1929 printf("Unable to allocate table index."
1930 " Consider increasing net.inet.ip.fw.tables_max");
1931 free_table_config(ni, tc);
1935 tc->no.etlv = IPFW_TLV_TBL_NAME;
1943 *pkidx = tc->no.kidx;
1945 IPFW_UH_WUNLOCK(ch);
1948 free_table_config(ni, tc_new);
1954 ntlv_to_ti(ipfw_obj_ntlv *ntlv, struct tid_info *ti)
1957 memset(ti, 0, sizeof(struct tid_info));
1958 ti->set = ntlv->set;
1959 ti->uidx = ntlv->idx;
1961 ti->tlen = ntlv->head.length;
1965 objheader_to_ti(struct _ipfw_obj_header *oh, struct tid_info *ti)
1968 ntlv_to_ti(&oh->ntlv, ti);
1971 struct namedobj_instance *
1972 ipfw_get_table_objhash(struct ip_fw_chain *ch)
1975 return (CHAIN_TO_NI(ch));
1979 * Exports basic table info as name TLV.
1980 * Used inside dump_static_rules() to provide info
1981 * about all tables referenced by current ruleset.
1983 * Returns 0 on success.
1986 ipfw_export_table_ntlv(struct ip_fw_chain *ch, uint16_t kidx,
1987 struct sockopt_data *sd)
1989 struct namedobj_instance *ni;
1990 struct named_object *no;
1991 ipfw_obj_ntlv *ntlv;
1993 ni = CHAIN_TO_NI(ch);
1995 no = ipfw_objhash_lookup_kidx(ni, kidx);
1996 KASSERT(no != NULL, ("invalid table kidx passed"));
1998 ntlv = (ipfw_obj_ntlv *)ipfw_get_sopt_space(sd, sizeof(*ntlv));
2002 ntlv->head.type = IPFW_TLV_TBL_NAME;
2003 ntlv->head.length = sizeof(*ntlv);
2004 ntlv->idx = no->kidx;
2005 strlcpy(ntlv->name, no->name, sizeof(ntlv->name));
2011 struct ip_fw_chain *ch;
2012 struct table_info *ti;
2013 struct table_config *tc;
2014 struct sockopt_data *sd;
2019 ipfw_table_entry *ent;
2022 ipfw_obj_tentry tent;
2026 count_ext_entries(void *e, void *arg)
2028 struct dump_args *da;
2030 da = (struct dump_args *)arg;
2037 * Gets number of items from table either using
2038 * internal counter or calling algo callback for
2039 * externally-managed tables.
2041 * Returns number of records.
2044 table_get_count(struct ip_fw_chain *ch, struct table_config *tc)
2046 struct table_info *ti;
2047 struct table_algo *ta;
2048 struct dump_args da;
2050 ti = KIDX_TO_TI(ch, tc->no.kidx);
2053 /* Use internal counter for self-managed tables */
2054 if ((ta->flags & TA_FLAG_READONLY) == 0)
2057 /* Use callback to quickly get number of items */
2058 if ((ta->flags & TA_FLAG_EXTCOUNTER) != 0)
2059 return (ta->get_count(tc->astate, ti));
2061 /* Count number of iterms ourselves */
2062 memset(&da, 0, sizeof(da));
2063 ta->foreach(tc->astate, ti, count_ext_entries, &da);
2069 * Exports table @tc info into standard ipfw_xtable_info format.
2072 export_table_info(struct ip_fw_chain *ch, struct table_config *tc,
2073 ipfw_xtable_info *i)
2075 struct table_info *ti;
2076 struct table_algo *ta;
2078 i->type = tc->no.subtype;
2079 i->tflags = tc->tflags;
2080 i->vmask = tc->vmask;
2081 i->set = tc->no.set;
2082 i->kidx = tc->no.kidx;
2083 i->refcnt = tc->no.refcnt;
2084 i->count = table_get_count(ch, tc);
2085 i->limit = tc->limit;
2086 i->flags |= (tc->locked != 0) ? IPFW_TGFLAGS_LOCKED : 0;
2087 i->size = i->count * sizeof(ipfw_obj_tentry);
2088 i->size += sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info);
2089 strlcpy(i->tablename, tc->tablename, sizeof(i->tablename));
2090 ti = KIDX_TO_TI(ch, tc->no.kidx);
2092 if (ta->print_config != NULL) {
2093 /* Use algo function to print table config to string */
2094 ta->print_config(tc->astate, ti, i->algoname,
2095 sizeof(i->algoname));
2097 strlcpy(i->algoname, ta->name, sizeof(i->algoname));
2098 /* Dump algo-specific data, if possible */
2099 if (ta->dump_tinfo != NULL) {
2100 ta->dump_tinfo(tc->astate, ti, &i->ta_info);
2101 i->ta_info.flags |= IPFW_TATFLAGS_DATA;
2105 struct dump_table_args {
2106 struct ip_fw_chain *ch;
2107 struct sockopt_data *sd;
2111 export_table_internal(struct namedobj_instance *ni, struct named_object *no,
2114 ipfw_xtable_info *i;
2115 struct dump_table_args *dta;
2117 dta = (struct dump_table_args *)arg;
2119 i = (ipfw_xtable_info *)ipfw_get_sopt_space(dta->sd, sizeof(*i));
2120 KASSERT(i != NULL, ("previously checked buffer is not enough"));
2122 export_table_info(dta->ch, (struct table_config *)no, i);
2127 * Export all tables as ipfw_xtable_info structures to
2128 * storage provided by @sd.
2130 * If supplied buffer is too small, fills in required size
2131 * and returns ENOMEM.
2132 * Returns 0 on success.
2135 export_tables(struct ip_fw_chain *ch, ipfw_obj_lheader *olh,
2136 struct sockopt_data *sd)
2140 struct dump_table_args dta;
2142 count = ipfw_objhash_count(CHAIN_TO_NI(ch));
2143 size = count * sizeof(ipfw_xtable_info) + sizeof(ipfw_obj_lheader);
2145 /* Fill in header regadless of buffer size */
2147 olh->objsize = sizeof(ipfw_xtable_info);
2149 if (size > olh->size) {
2159 ipfw_objhash_foreach(CHAIN_TO_NI(ch), export_table_internal, &dta);
2165 * Dumps all table data
2166 * Data layout (v1)(current):
2167 * Request: [ ipfw_obj_header ], size = ipfw_xtable_info.size
2168 * Reply: [ ipfw_obj_header ipfw_xtable_info ipfw_obj_tentry x N ]
2170 * Returns 0 on success
2173 dump_table_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
2174 struct sockopt_data *sd)
2176 struct _ipfw_obj_header *oh;
2177 ipfw_xtable_info *i;
2179 struct table_config *tc;
2180 struct table_algo *ta;
2181 struct dump_args da;
2184 sz = sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info);
2185 oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz);
2189 i = (ipfw_xtable_info *)(oh + 1);
2190 objheader_to_ti(oh, &ti);
2193 if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) {
2194 IPFW_UH_RUNLOCK(ch);
2197 export_table_info(ch, tc, i);
2199 if (sd->valsize < i->size) {
2202 * Submitted buffer size is not enough.
2203 * WE've already filled in @i structure with
2204 * relevant table info including size, so we
2205 * can return. Buffer will be flushed automatically.
2207 IPFW_UH_RUNLOCK(ch);
2212 * Do the actual dump in eXtended format
2214 memset(&da, 0, sizeof(da));
2216 da.ti = KIDX_TO_TI(ch, tc->no.kidx);
2222 ta->foreach(tc->astate, da.ti, dump_table_tentry, &da);
2223 IPFW_UH_RUNLOCK(ch);
2229 * Dumps all table data
2230 * Data layout (version 0)(legacy):
2231 * Request: [ ipfw_xtable ], size = IP_FW_TABLE_XGETSIZE()
2232 * Reply: [ ipfw_xtable ipfw_table_xentry x N ]
2234 * Returns 0 on success
2237 dump_table_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
2238 struct sockopt_data *sd)
2242 struct table_config *tc;
2243 struct table_algo *ta;
2244 struct dump_args da;
2247 xtbl = (ipfw_xtable *)ipfw_get_sopt_header(sd, sizeof(ipfw_xtable));
2251 memset(&ti, 0, sizeof(ti));
2252 ti.uidx = xtbl->tbl;
2255 if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) {
2256 IPFW_UH_RUNLOCK(ch);
2259 count = table_get_count(ch, tc);
2260 sz = count * sizeof(ipfw_table_xentry) + sizeof(ipfw_xtable);
2264 xtbl->type = tc->no.subtype;
2265 xtbl->tbl = ti.uidx;
2267 if (sd->valsize < sz) {
2270 * Submitted buffer size is not enough.
2271 * WE've already filled in @i structure with
2272 * relevant table info including size, so we
2273 * can return. Buffer will be flushed automatically.
2275 IPFW_UH_RUNLOCK(ch);
2279 /* Do the actual dump in eXtended format */
2280 memset(&da, 0, sizeof(da));
2282 da.ti = KIDX_TO_TI(ch, tc->no.kidx);
2288 ta->foreach(tc->astate, da.ti, dump_table_xentry, &da);
2289 IPFW_UH_RUNLOCK(ch);
2295 * Legacy function to retrieve number of items in table.
2298 get_table_size(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
2299 struct sockopt_data *sd)
2306 sz = sizeof(*op3) + sizeof(uint32_t);
2307 op3 = (ip_fw3_opheader *)ipfw_get_sopt_header(sd, sz);
2311 tbl = (uint32_t *)(op3 + 1);
2312 memset(&ti, 0, sizeof(ti));
2315 error = ipfw_count_xtable(ch, &ti, tbl);
2316 IPFW_UH_RUNLOCK(ch);
2321 * Legacy IP_FW_TABLE_GETSIZE handler
2324 ipfw_count_table(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt)
2326 struct table_config *tc;
2328 if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL)
2330 *cnt = table_get_count(ch, tc);
2335 * Legacy IP_FW_TABLE_XGETSIZE handler
2338 ipfw_count_xtable(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt)
2340 struct table_config *tc;
2343 if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) {
2345 return (0); /* 'table all list' requires success */
2348 count = table_get_count(ch, tc);
2349 *cnt = count * sizeof(ipfw_table_xentry);
2351 *cnt += sizeof(ipfw_xtable);
2356 dump_table_entry(void *e, void *arg)
2358 struct dump_args *da;
2359 struct table_config *tc;
2360 struct table_algo *ta;
2361 ipfw_table_entry *ent;
2362 struct table_value *pval;
2365 da = (struct dump_args *)arg;
2370 /* Out of memory, returning */
2371 if (da->cnt == da->size)
2374 ent->tbl = da->uidx;
2377 error = ta->dump_tentry(tc->astate, da->ti, e, &da->tent);
2381 ent->addr = da->tent.k.addr.s_addr;
2382 ent->masklen = da->tent.masklen;
2383 pval = get_table_value(da->ch, da->tc, da->tent.v.kidx);
2384 ent->value = ipfw_export_table_value_legacy(pval);
2390 * Dumps table in pre-8.1 legacy format.
2393 ipfw_dump_table_legacy(struct ip_fw_chain *ch, struct tid_info *ti,
2396 struct table_config *tc;
2397 struct table_algo *ta;
2398 struct dump_args da;
2402 if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL)
2403 return (0); /* XXX: We should return ESRCH */
2407 /* This dump format supports IPv4 only */
2408 if (tc->no.subtype != IPFW_TABLE_ADDR)
2411 memset(&da, 0, sizeof(da));
2413 da.ti = KIDX_TO_TI(ch, tc->no.kidx);
2415 da.ent = &tbl->ent[0];
2416 da.size = tbl->size;
2419 ta->foreach(tc->astate, da.ti, dump_table_entry, &da);
2426 * Dumps table entry in eXtended format (v1)(current).
2429 dump_table_tentry(void *e, void *arg)
2431 struct dump_args *da;
2432 struct table_config *tc;
2433 struct table_algo *ta;
2434 struct table_value *pval;
2435 ipfw_obj_tentry *tent;
2438 da = (struct dump_args *)arg;
2443 tent = (ipfw_obj_tentry *)ipfw_get_sopt_space(da->sd, sizeof(*tent));
2444 /* Out of memory, returning */
2449 tent->head.length = sizeof(ipfw_obj_tentry);
2450 tent->idx = da->uidx;
2452 error = ta->dump_tentry(tc->astate, da->ti, e, tent);
2456 pval = get_table_value(da->ch, da->tc, tent->v.kidx);
2457 ipfw_export_table_value_v1(pval, &tent->v.value);
2463 * Dumps table entry in eXtended format (v0).
2466 dump_table_xentry(void *e, void *arg)
2468 struct dump_args *da;
2469 struct table_config *tc;
2470 struct table_algo *ta;
2471 ipfw_table_xentry *xent;
2472 ipfw_obj_tentry *tent;
2473 struct table_value *pval;
2476 da = (struct dump_args *)arg;
2481 xent = (ipfw_table_xentry *)ipfw_get_sopt_space(da->sd, sizeof(*xent));
2482 /* Out of memory, returning */
2485 xent->len = sizeof(ipfw_table_xentry);
2486 xent->tbl = da->uidx;
2488 memset(&da->tent, 0, sizeof(da->tent));
2490 error = ta->dump_tentry(tc->astate, da->ti, e, tent);
2494 /* Convert current format to previous one */
2495 xent->masklen = tent->masklen;
2496 pval = get_table_value(da->ch, da->tc, da->tent.v.kidx);
2497 xent->value = ipfw_export_table_value_legacy(pval);
2498 /* Apply some hacks */
2499 if (tc->no.subtype == IPFW_TABLE_ADDR && tent->subtype == AF_INET) {
2500 xent->k.addr6.s6_addr32[3] = tent->k.addr.s_addr;
2501 xent->flags = IPFW_TCF_INET;
2503 memcpy(&xent->k, &tent->k, sizeof(xent->k));
2509 * Helper function to export table algo data
2510 * to tentry format before calling user function.
2512 * Returns 0 on success.
2515 prepare_table_tentry(void *e, void *arg)
2517 struct dump_args *da;
2518 struct table_config *tc;
2519 struct table_algo *ta;
2522 da = (struct dump_args *)arg;
2527 error = ta->dump_tentry(tc->astate, da->ti, e, &da->tent);
2531 da->f(&da->tent, da->farg);
2537 * Allow external consumers to read table entries in standard format.
2540 ipfw_foreach_table_tentry(struct ip_fw_chain *ch, uint16_t kidx,
2541 ta_foreach_f *f, void *arg)
2543 struct namedobj_instance *ni;
2544 struct table_config *tc;
2545 struct table_algo *ta;
2546 struct dump_args da;
2548 ni = CHAIN_TO_NI(ch);
2550 tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, kidx);
2556 memset(&da, 0, sizeof(da));
2558 da.ti = KIDX_TO_TI(ch, tc->no.kidx);
2563 ta->foreach(tc->astate, da.ti, prepare_table_tentry, &da);
2573 * Finds algorithm by index, table type or supplied name.
2575 * Returns pointer to algo or NULL.
2577 static struct table_algo *
2578 find_table_algo(struct tables_config *tcfg, struct tid_info *ti, char *name)
2581 struct table_algo *ta;
2583 if (ti->type > IPFW_TABLE_MAXTYPE)
2586 /* Search by index */
2587 if (ti->atype != 0) {
2588 if (ti->atype > tcfg->algo_count)
2590 return (tcfg->algo[ti->atype]);
2594 /* Return default algorithm for given type if set */
2595 return (tcfg->def_algo[ti->type]);
2598 /* Search by name */
2599 /* TODO: better search */
2600 for (i = 1; i <= tcfg->algo_count; i++) {
2604 * One can supply additional algorithm
2605 * parameters so we compare only the first word
2607 * 'addr:chash hsize=32'
2611 l = strlen(ta->name);
2612 if (strncmp(name, ta->name, l) != 0)
2614 if (name[l] != '\0' && name[l] != ' ')
2616 /* Check if we're requesting proper table type */
2617 if (ti->type != 0 && ti->type != ta->type)
2626 * Register new table algo @ta.
2627 * Stores algo id inside @idx.
2629 * Returns 0 on success.
2632 ipfw_add_table_algo(struct ip_fw_chain *ch, struct table_algo *ta, size_t size,
2635 struct tables_config *tcfg;
2636 struct table_algo *ta_new;
2639 if (size > sizeof(struct table_algo))
2642 /* Check for the required on-stack size for add/del */
2643 sz = roundup2(ta->ta_buf_size, sizeof(void *));
2647 KASSERT(ta->type <= IPFW_TABLE_MAXTYPE,("Increase IPFW_TABLE_MAXTYPE"));
2649 /* Copy algorithm data to stable storage. */
2650 ta_new = malloc(sizeof(struct table_algo), M_IPFW, M_WAITOK | M_ZERO);
2651 memcpy(ta_new, ta, size);
2653 tcfg = CHAIN_TO_TCFG(ch);
2655 KASSERT(tcfg->algo_count < 255, ("Increase algo array size"));
2657 tcfg->algo[++tcfg->algo_count] = ta_new;
2658 ta_new->idx = tcfg->algo_count;
2660 /* Set algorithm as default one for given type */
2661 if ((ta_new->flags & TA_FLAG_DEFAULT) != 0 &&
2662 tcfg->def_algo[ta_new->type] == NULL)
2663 tcfg->def_algo[ta_new->type] = ta_new;
2671 * Unregisters table algo using @idx as id.
2672 * XXX: It is NOT safe to call this function in any place
2673 * other than ipfw instance destroy handler.
2676 ipfw_del_table_algo(struct ip_fw_chain *ch, int idx)
2678 struct tables_config *tcfg;
2679 struct table_algo *ta;
2681 tcfg = CHAIN_TO_TCFG(ch);
2683 KASSERT(idx <= tcfg->algo_count, ("algo idx %d out of range 1..%d",
2684 idx, tcfg->algo_count));
2686 ta = tcfg->algo[idx];
2687 KASSERT(ta != NULL, ("algo idx %d is NULL", idx));
2689 if (tcfg->def_algo[ta->type] == ta)
2690 tcfg->def_algo[ta->type] = NULL;
2696 * Lists all table algorithms currently available.
2697 * Data layout (v0)(current):
2698 * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size
2699 * Reply: [ ipfw_obj_lheader ipfw_ta_info x N ]
2701 * Returns 0 on success
2704 list_table_algo(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
2705 struct sockopt_data *sd)
2707 struct _ipfw_obj_lheader *olh;
2708 struct tables_config *tcfg;
2710 struct table_algo *ta;
2711 uint32_t count, n, size;
2713 olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh));
2716 if (sd->valsize < olh->size)
2720 tcfg = CHAIN_TO_TCFG(ch);
2721 count = tcfg->algo_count;
2722 size = count * sizeof(ipfw_ta_info) + sizeof(ipfw_obj_lheader);
2724 /* Fill in header regadless of buffer size */
2726 olh->objsize = sizeof(ipfw_ta_info);
2728 if (size > olh->size) {
2730 IPFW_UH_RUNLOCK(ch);
2735 for (n = 1; n <= count; n++) {
2736 i = (ipfw_ta_info *)ipfw_get_sopt_space(sd, sizeof(*i));
2737 KASSERT(i != NULL, ("previously checked buffer is not enough"));
2739 strlcpy(i->algoname, ta->name, sizeof(i->algoname));
2741 i->refcnt = ta->refcnt;
2744 IPFW_UH_RUNLOCK(ch);
2750 classify_srcdst(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
2752 /* Basic IPv4/IPv6 or u32 lookups */
2754 /* Assume ADDR by default */
2755 *ptype = IPFW_TABLE_ADDR;
2758 if (F_LEN(cmd) > F_INSN_SIZE(ipfw_insn_u32)) {
2760 * generic lookup. The key must be
2761 * in 32bit big-endian format.
2763 v = ((ipfw_insn_u32 *)cmd)->d[1];
2772 *ptype = IPFW_TABLE_NUMBER;
2776 *ptype = IPFW_TABLE_NUMBER;
2780 *ptype = IPFW_TABLE_NUMBER;
2784 *ptype = IPFW_TABLE_NUMBER;
2793 classify_via(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
2795 ipfw_insn_if *cmdif;
2797 /* Interface table, possibly */
2798 cmdif = (ipfw_insn_if *)cmd;
2799 if (cmdif->name[0] != '\1')
2802 *ptype = IPFW_TABLE_INTERFACE;
2803 *puidx = cmdif->p.kidx;
2809 classify_flow(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
2813 *ptype = IPFW_TABLE_FLOW;
2819 update_arg1(ipfw_insn *cmd, uint16_t idx)
2826 update_via(ipfw_insn *cmd, uint16_t idx)
2828 ipfw_insn_if *cmdif;
2830 cmdif = (ipfw_insn_if *)cmd;
2831 cmdif->p.kidx = idx;
2835 table_findbyname(struct ip_fw_chain *ch, struct tid_info *ti,
2836 struct named_object **pno)
2838 struct table_config *tc;
2841 IPFW_UH_WLOCK_ASSERT(ch);
2843 error = find_table_err(CHAIN_TO_NI(ch), ti, &tc);
2851 /* XXX: sets-sets! */
2852 static struct named_object *
2853 table_findbykidx(struct ip_fw_chain *ch, uint16_t idx)
2855 struct namedobj_instance *ni;
2856 struct table_config *tc;
2858 IPFW_UH_WLOCK_ASSERT(ch);
2859 ni = CHAIN_TO_NI(ch);
2860 tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, idx);
2861 KASSERT(tc != NULL, ("Table with index %d not found", idx));
2867 table_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set,
2868 enum ipfw_sets_cmd cmd)
2876 * Always return success, the real action and decision
2877 * should make table_manage_sets_all().
2883 * NOTE: we need to use ipfw_objhash_del/ipfw_objhash_add
2884 * if set number will be used in hash function. Currently
2885 * we can just use generic handler that replaces set value.
2887 if (V_fw_tables_sets == 0)
2892 * Return EOPNOTSUPP for COUNT_ONE when per-set sysctl is
2893 * disabled. This allow skip table's opcodes from additional
2894 * checks when specific rules moved to another set.
2896 if (V_fw_tables_sets == 0)
2897 return (EOPNOTSUPP);
2899 /* Use generic sets handler when per-set sysctl is enabled. */
2900 return (ipfw_obj_manage_sets(CHAIN_TO_NI(ch), IPFW_TLV_TBL_NAME,
2901 set, new_set, cmd));
2905 * We register several opcode rewriters for lookup tables.
2906 * All tables opcodes have the same ETLV type, but different subtype.
2907 * To avoid invoking sets handler several times for XXX_ALL commands,
2908 * we use separate manage_sets handler. O_RECV has the lowest value,
2909 * so it should be called first.
2912 table_manage_sets_all(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set,
2913 enum ipfw_sets_cmd cmd)
2920 * Return success for TEST_ALL, since nothing prevents
2921 * move rules from one set to another. All tables are
2922 * accessible from all sets when per-set tables sysctl
2926 if (V_fw_tables_sets == 0)
2930 return (table_manage_sets(ch, set, new_set, cmd));
2932 /* Use generic sets handler when per-set sysctl is enabled. */
2933 return (ipfw_obj_manage_sets(CHAIN_TO_NI(ch), IPFW_TLV_TBL_NAME,
2934 set, new_set, cmd));
2937 static struct opcode_obj_rewrite opcodes[] = {
2939 .opcode = O_IP_SRC_LOOKUP,
2940 .etlv = IPFW_TLV_TBL_NAME,
2941 .classifier = classify_srcdst,
2942 .update = update_arg1,
2943 .find_byname = table_findbyname,
2944 .find_bykidx = table_findbykidx,
2945 .create_object = create_table_compat,
2946 .manage_sets = table_manage_sets,
2949 .opcode = O_IP_DST_LOOKUP,
2950 .etlv = IPFW_TLV_TBL_NAME,
2951 .classifier = classify_srcdst,
2952 .update = update_arg1,
2953 .find_byname = table_findbyname,
2954 .find_bykidx = table_findbykidx,
2955 .create_object = create_table_compat,
2956 .manage_sets = table_manage_sets,
2959 .opcode = O_IP_FLOW_LOOKUP,
2960 .etlv = IPFW_TLV_TBL_NAME,
2961 .classifier = classify_flow,
2962 .update = update_arg1,
2963 .find_byname = table_findbyname,
2964 .find_bykidx = table_findbykidx,
2965 .create_object = create_table_compat,
2966 .manage_sets = table_manage_sets,
2970 .etlv = IPFW_TLV_TBL_NAME,
2971 .classifier = classify_via,
2972 .update = update_via,
2973 .find_byname = table_findbyname,
2974 .find_bykidx = table_findbykidx,
2975 .create_object = create_table_compat,
2976 .manage_sets = table_manage_sets,
2980 .etlv = IPFW_TLV_TBL_NAME,
2981 .classifier = classify_via,
2982 .update = update_via,
2983 .find_byname = table_findbyname,
2984 .find_bykidx = table_findbykidx,
2985 .create_object = create_table_compat,
2986 .manage_sets = table_manage_sets_all,
2990 .etlv = IPFW_TLV_TBL_NAME,
2991 .classifier = classify_via,
2992 .update = update_via,
2993 .find_byname = table_findbyname,
2994 .find_bykidx = table_findbykidx,
2995 .create_object = create_table_compat,
2996 .manage_sets = table_manage_sets,
3001 test_sets_cb(struct namedobj_instance *ni __unused, struct named_object *no,
3005 /* Check that there aren't any tables in not default set */
3012 * Switch between "set 0" and "rule's set" table binding,
3013 * Check all ruleset bindings and permits changing
3014 * IFF each binding has both rule AND table in default set (set 0).
3016 * Returns 0 on success.
3019 ipfw_switch_tables_namespace(struct ip_fw_chain *ch, unsigned int sets)
3021 struct opcode_obj_rewrite *rw;
3022 struct namedobj_instance *ni;
3023 struct named_object *no;
3032 if (V_fw_tables_sets == sets) {
3033 IPFW_UH_WUNLOCK(ch);
3036 ni = CHAIN_TO_NI(ch);
3039 * Prevent disabling sets support if we have some tables
3040 * in not default sets.
3042 if (ipfw_objhash_foreach_type(ni, test_sets_cb,
3043 NULL, IPFW_TLV_TBL_NAME) != 0) {
3044 IPFW_UH_WUNLOCK(ch);
3049 * Scan all rules and examine tables opcodes.
3051 for (i = 0; i < ch->n_rules; i++) {
3057 for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) {
3058 cmdlen = F_LEN(cmd);
3059 /* Check only tables opcodes */
3060 for (kidx = 0, rw = opcodes;
3061 rw < opcodes + nitems(opcodes); rw++) {
3062 if (rw->opcode != cmd->opcode)
3064 if (rw->classifier(cmd, &kidx, &subtype) == 0)
3069 no = ipfw_objhash_lookup_kidx(ni, kidx);
3070 /* Check if both table object and rule has the set 0 */
3071 if (no->set != 0 || rule->set != 0) {
3072 IPFW_UH_WUNLOCK(ch);
3078 V_fw_tables_sets = sets;
3079 IPFW_UH_WUNLOCK(ch);
3084 * Checks table name for validity.
3085 * Enforce basic length checks, the rest
3086 * should be done in userland.
3088 * Returns 0 if name is considered valid.
3091 check_table_name(const char *name)
3095 * TODO: do some more complicated checks
3097 return (ipfw_check_object_name_generic(name));
3101 * Finds table config based on either legacy index
3103 * Note @ti structure contains unchecked data from userland.
3105 * Returns 0 in success and fills in @tc with found config
3108 find_table_err(struct namedobj_instance *ni, struct tid_info *ti,
3109 struct table_config **tc)
3111 char *name, bname[16];
3112 struct named_object *no;
3113 ipfw_obj_ntlv *ntlv;
3116 if (ti->tlvs != NULL) {
3117 ntlv = ipfw_find_name_tlv_type(ti->tlvs, ti->tlen, ti->uidx,
3124 * Use set provided by @ti instead of @ntlv one.
3125 * This is needed due to different sets behavior
3126 * controlled by V_fw_tables_sets.
3128 set = (V_fw_tables_sets != 0) ? ti->set : 0;
3130 snprintf(bname, sizeof(bname), "%d", ti->uidx);
3135 no = ipfw_objhash_lookup_name(ni, set, name);
3136 *tc = (struct table_config *)no;
3142 * Finds table config based on either legacy index
3144 * Note @ti structure contains unchecked data from userland.
3146 * Returns pointer to table_config or NULL.
3148 static struct table_config *
3149 find_table(struct namedobj_instance *ni, struct tid_info *ti)
3151 struct table_config *tc;
3153 if (find_table_err(ni, ti, &tc) != 0)
3160 * Allocate new table config structure using
3161 * specified @algo and @aname.
3163 * Returns pointer to config or NULL.
3165 static struct table_config *
3166 alloc_table_config(struct ip_fw_chain *ch, struct tid_info *ti,
3167 struct table_algo *ta, char *aname, uint8_t tflags)
3169 char *name, bname[16];
3170 struct table_config *tc;
3172 ipfw_obj_ntlv *ntlv;
3175 if (ti->tlvs != NULL) {
3176 ntlv = ipfw_find_name_tlv_type(ti->tlvs, ti->tlen, ti->uidx,
3181 set = (V_fw_tables_sets == 0) ? 0 : ntlv->set;
3183 /* Compat part: convert number to string representation */
3184 snprintf(bname, sizeof(bname), "%d", ti->uidx);
3189 tc = malloc(sizeof(struct table_config), M_IPFW, M_WAITOK | M_ZERO);
3190 tc->no.name = tc->tablename;
3191 tc->no.subtype = ta->type;
3193 tc->tflags = tflags;
3195 strlcpy(tc->tablename, name, sizeof(tc->tablename));
3196 /* Set "shared" value type by default */
3199 /* Preallocate data structures for new tables */
3200 error = ta->init(ch, &tc->astate, &tc->ti_copy, aname, tflags);
3210 * Destroys table state and config.
3213 free_table_config(struct namedobj_instance *ni, struct table_config *tc)
3216 KASSERT(tc->linked == 0, ("free() on linked config"));
3217 /* UH lock MUST NOT be held */
3220 * We're using ta without any locking/referencing.
3221 * TODO: fix this if we're going to use unloadable algos.
3223 tc->ta->destroy(tc->astate, &tc->ti_copy);
3228 * Links @tc to @chain table named instance.
3229 * Sets appropriate type/states in @chain table info.
3232 link_table(struct ip_fw_chain *ch, struct table_config *tc)
3234 struct namedobj_instance *ni;
3235 struct table_info *ti;
3238 IPFW_UH_WLOCK_ASSERT(ch);
3240 ni = CHAIN_TO_NI(ch);
3243 ipfw_objhash_add(ni, &tc->no);
3245 ti = KIDX_TO_TI(ch, kidx);
3248 /* Notify algo on real @ti address */
3249 if (tc->ta->change_ti != NULL)
3250 tc->ta->change_ti(tc->astate, ti);
3257 * Unlinks @tc from @chain table named instance.
3258 * Zeroes states in @chain and stores them in @tc.
3261 unlink_table(struct ip_fw_chain *ch, struct table_config *tc)
3263 struct namedobj_instance *ni;
3264 struct table_info *ti;
3267 IPFW_UH_WLOCK_ASSERT(ch);
3268 IPFW_WLOCK_ASSERT(ch);
3270 ni = CHAIN_TO_NI(ch);
3273 /* Clear state. @ti copy is already saved inside @tc */
3274 ipfw_objhash_del(ni, &tc->no);
3275 ti = KIDX_TO_TI(ch, kidx);
3276 memset(ti, 0, sizeof(struct table_info));
3280 /* Notify algo on real @ti address */
3281 if (tc->ta->change_ti != NULL)
3282 tc->ta->change_ti(tc->astate, NULL);
3285 static struct ipfw_sopt_handler scodes[] = {
3286 { IP_FW_TABLE_XCREATE, 0, HDIR_SET, create_table },
3287 { IP_FW_TABLE_XDESTROY, 0, HDIR_SET, flush_table_v0 },
3288 { IP_FW_TABLE_XFLUSH, 0, HDIR_SET, flush_table_v0 },
3289 { IP_FW_TABLE_XMODIFY, 0, HDIR_BOTH, modify_table },
3290 { IP_FW_TABLE_XINFO, 0, HDIR_GET, describe_table },
3291 { IP_FW_TABLES_XLIST, 0, HDIR_GET, list_tables },
3292 { IP_FW_TABLE_XLIST, 0, HDIR_GET, dump_table_v0 },
3293 { IP_FW_TABLE_XLIST, 1, HDIR_GET, dump_table_v1 },
3294 { IP_FW_TABLE_XADD, 0, HDIR_BOTH, manage_table_ent_v0 },
3295 { IP_FW_TABLE_XADD, 1, HDIR_BOTH, manage_table_ent_v1 },
3296 { IP_FW_TABLE_XDEL, 0, HDIR_BOTH, manage_table_ent_v0 },
3297 { IP_FW_TABLE_XDEL, 1, HDIR_BOTH, manage_table_ent_v1 },
3298 { IP_FW_TABLE_XFIND, 0, HDIR_GET, find_table_entry },
3299 { IP_FW_TABLE_XSWAP, 0, HDIR_SET, swap_table },
3300 { IP_FW_TABLES_ALIST, 0, HDIR_GET, list_table_algo },
3301 { IP_FW_TABLE_XGETSIZE, 0, HDIR_GET, get_table_size },
3305 destroy_table_locked(struct namedobj_instance *ni, struct named_object *no,
3309 unlink_table((struct ip_fw_chain *)arg, (struct table_config *)no);
3310 if (ipfw_objhash_free_idx(ni, no->kidx) != 0)
3311 printf("Error unlinking kidx %d from table %s\n",
3312 no->kidx, no->name);
3313 free_table_config(ni, (struct table_config *)no);
3318 * Shuts tables module down.
3321 ipfw_destroy_tables(struct ip_fw_chain *ch, int last)
3324 IPFW_DEL_SOPT_HANDLER(last, scodes);
3325 IPFW_DEL_OBJ_REWRITER(last, opcodes);
3327 /* Remove all tables from working set */
3330 ipfw_objhash_foreach(CHAIN_TO_NI(ch), destroy_table_locked, ch);
3332 IPFW_UH_WUNLOCK(ch);
3334 /* Free pointers itself */
3335 free(ch->tablestate, M_IPFW);
3337 ipfw_table_value_destroy(ch, last);
3338 ipfw_table_algo_destroy(ch);
3340 ipfw_objhash_destroy(CHAIN_TO_NI(ch));
3341 free(CHAIN_TO_TCFG(ch), M_IPFW);
3345 * Starts tables module.
3348 ipfw_init_tables(struct ip_fw_chain *ch, int first)
3350 struct tables_config *tcfg;
3352 /* Allocate pointers */
3353 ch->tablestate = malloc(V_fw_tables_max * sizeof(struct table_info),
3354 M_IPFW, M_WAITOK | M_ZERO);
3356 tcfg = malloc(sizeof(struct tables_config), M_IPFW, M_WAITOK | M_ZERO);
3357 tcfg->namehash = ipfw_objhash_create(V_fw_tables_max);
3360 ipfw_table_value_init(ch, first);
3361 ipfw_table_algo_init(ch);
3363 IPFW_ADD_OBJ_REWRITER(first, opcodes);
3364 IPFW_ADD_SOPT_HANDLER(first, scodes);