2 * Copyright (c) 2004 Ruslan Ermilov and Vsevolod Lobko.
3 * Copyright (c) 2014 Yandex LLC
4 * Copyright (c) 2014 Alexander V. Chernikov
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 #include <sys/cdefs.h>
29 __FBSDID("$FreeBSD$");
32 * Lookup table support for ipfw.
34 * This file contains handlers for all generic tables' operations:
35 * add/del/flush entries, list/dump tables etc..
37 * Table data modification is protected by both UH and runtime lock
38 * while reading configuration/data is protected by UH lock.
40 * Lookup algorithms for all table types are located in ip_fw_table_algo.c
45 #include <sys/param.h>
46 #include <sys/systm.h>
47 #include <sys/malloc.h>
48 #include <sys/kernel.h>
50 #include <sys/rwlock.h>
51 #include <sys/rmlock.h>
52 #include <sys/socket.h>
53 #include <sys/socketvar.h>
54 #include <sys/queue.h>
55 #include <net/if.h> /* ip_fw.h requires IFNAMSIZ */
57 #include <netinet/in.h>
58 #include <netinet/ip_var.h> /* struct ipfw_rule_ref */
59 #include <netinet/ip_fw.h>
61 #include <netpfil/ipfw/ip_fw_private.h>
62 #include <netpfil/ipfw/ip_fw_table.h>
65 * Table has the following `type` concepts:
67 * `no.type` represents lookup key type (addr, ifp, uid, etc..)
68 * vmask represents bitmask of table values which are present at the moment.
69 * Special IPFW_VTYPE_LEGACY ( (uint32_t)-1 ) represents old
70 * single-value-for-all approach.
73 struct named_object no;
74 uint8_t tflags; /* type flags */
75 uint8_t locked; /* 1 if locked from changes */
76 uint8_t linked; /* 1 if already linked */
77 uint8_t ochanged; /* used by set swapping */
78 uint8_t vshared; /* 1 if using shared value array */
80 uint32_t count; /* Number of records */
81 uint32_t limit; /* Max number of records */
82 uint32_t vmask; /* bitmask with supported values */
83 uint32_t ocount; /* used by set swapping */
84 uint64_t gencnt; /* generation count */
85 char tablename[64]; /* table name */
86 struct table_algo *ta; /* Callbacks for given algo */
87 void *astate; /* algorithm state */
88 struct table_info ti_copy; /* data to put to table_info */
89 struct namedobj_instance *vi;
92 static int find_table_err(struct namedobj_instance *ni, struct tid_info *ti,
93 struct table_config **tc);
94 static struct table_config *find_table(struct namedobj_instance *ni,
96 static struct table_config *alloc_table_config(struct ip_fw_chain *ch,
97 struct tid_info *ti, struct table_algo *ta, char *adata, uint8_t tflags);
98 static void free_table_config(struct namedobj_instance *ni,
99 struct table_config *tc);
100 static int create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti,
101 char *aname, ipfw_xtable_info *i, uint16_t *pkidx, int ref);
102 static void link_table(struct ip_fw_chain *ch, struct table_config *tc);
103 static void unlink_table(struct ip_fw_chain *ch, struct table_config *tc);
104 static int find_ref_table(struct ip_fw_chain *ch, struct tid_info *ti,
105 struct tentry_info *tei, uint32_t count, int op, struct table_config **ptc);
108 static int export_tables(struct ip_fw_chain *ch, ipfw_obj_lheader *olh,
109 struct sockopt_data *sd);
110 static void export_table_info(struct ip_fw_chain *ch, struct table_config *tc,
111 ipfw_xtable_info *i);
112 static int dump_table_tentry(void *e, void *arg);
113 static int dump_table_xentry(void *e, void *arg);
115 static int swap_tables(struct ip_fw_chain *ch, struct tid_info *a,
118 static int check_table_name(const char *name);
119 static int check_table_space(struct ip_fw_chain *ch, struct tableop_state *ts,
120 struct table_config *tc, struct table_info *ti, uint32_t count);
121 static int destroy_table(struct ip_fw_chain *ch, struct tid_info *ti);
123 static struct table_algo *find_table_algo(struct tables_config *tableconf,
124 struct tid_info *ti, char *name);
126 static void objheader_to_ti(struct _ipfw_obj_header *oh, struct tid_info *ti);
127 static void ntlv_to_ti(struct _ipfw_obj_ntlv *ntlv, struct tid_info *ti);
129 #define CHAIN_TO_NI(chain) (CHAIN_TO_TCFG(chain)->namehash)
130 #define KIDX_TO_TI(ch, k) (&(((struct table_info *)(ch)->tablestate)[k]))
132 #define TA_BUF_SZ 128 /* On-stack buffer for add/delete state */
135 rollback_toperation_state(struct ip_fw_chain *ch, void *object)
137 struct tables_config *tcfg;
140 tcfg = CHAIN_TO_TCFG(ch);
141 TAILQ_FOREACH(os, &tcfg->state_list, next)
142 os->func(object, os);
146 add_toperation_state(struct ip_fw_chain *ch, struct tableop_state *ts)
148 struct tables_config *tcfg;
150 tcfg = CHAIN_TO_TCFG(ch);
151 TAILQ_INSERT_HEAD(&tcfg->state_list, &ts->opstate, next);
155 del_toperation_state(struct ip_fw_chain *ch, struct tableop_state *ts)
157 struct tables_config *tcfg;
159 tcfg = CHAIN_TO_TCFG(ch);
160 TAILQ_REMOVE(&tcfg->state_list, &ts->opstate, next);
164 tc_ref(struct table_config *tc)
171 tc_unref(struct table_config *tc)
177 static struct table_value *
178 get_table_value(struct ip_fw_chain *ch, struct table_config *tc, uint32_t kidx)
180 struct table_value *pval;
182 pval = (struct table_value *)ch->valuestate;
184 return (&pval[kidx]);
189 * Checks if we're able to insert/update entry @tei into table
191 * May alter @tei to indicate insertion error / insert
194 * Returns 0 if operation can be performed/
197 check_table_limit(struct table_config *tc, struct tentry_info *tei)
200 if (tc->limit == 0 || tc->count < tc->limit)
203 if ((tei->flags & TEI_FLAGS_UPDATE) == 0) {
204 /* Notify userland on error cause */
205 tei->flags |= TEI_FLAGS_LIMIT;
210 * We have UPDATE flag set.
211 * Permit updating record (if found),
212 * but restrict adding new one since we've
213 * already hit the limit.
215 tei->flags |= TEI_FLAGS_DONTADD;
221 * Convert algorithm callback return code into
222 * one of pre-defined states known by userland.
225 store_tei_result(struct tentry_info *tei, int op, int error, uint32_t num)
233 if (op == OP_ADD && num != 0)
234 flag = TEI_FLAGS_ADDED;
236 flag = TEI_FLAGS_DELETED;
239 flag = TEI_FLAGS_NOTFOUND;
242 flag = TEI_FLAGS_EXISTS;
245 flag = TEI_FLAGS_ERROR;
252 * Creates and references table with default parameters.
253 * Saves table config, algo and allocated kidx info @ptc, @pta and
254 * @pkidx if non-zero.
255 * Used for table auto-creation to support old binaries.
257 * Returns 0 on success.
260 create_table_compat(struct ip_fw_chain *ch, struct tid_info *ti,
266 memset(&xi, 0, sizeof(xi));
267 /* Set default value mask for legacy clients */
268 xi.vmask = IPFW_VTYPE_LEGACY;
270 error = create_table_internal(ch, ti, NULL, &xi, pkidx, 1);
278 * Find and reference existing table optionally
281 * Saves found table config into @ptc.
282 * Note function may drop/acquire UH_WLOCK.
283 * Returns 0 if table was found/created and referenced
284 * or non-zero return code.
287 find_ref_table(struct ip_fw_chain *ch, struct tid_info *ti,
288 struct tentry_info *tei, uint32_t count, int op,
289 struct table_config **ptc)
291 struct namedobj_instance *ni;
292 struct table_config *tc;
296 IPFW_UH_WLOCK_ASSERT(ch);
298 ni = CHAIN_TO_NI(ch);
300 if ((tc = find_table(ni, ti)) != NULL) {
301 /* check table type */
302 if (tc->no.subtype != ti->type)
308 /* Try to exit early on limit hit */
309 if (op == OP_ADD && count == 1 &&
310 check_table_limit(tc, tei) != 0)
313 /* Reference and return */
322 /* Compatibility mode: create new table for old clients */
323 if ((tei->flags & TEI_FLAGS_COMPAT) == 0)
327 error = create_table_compat(ch, ti, &kidx);
333 tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, kidx);
334 KASSERT(tc != NULL, ("create_table_compat returned bad idx %d", kidx));
336 /* OK, now we've got referenced table. */
342 * Rolls back already @added to @tc entries using state array @ta_buf_m.
343 * Assume the following layout:
344 * 1) ADD state (ta_buf_m[0] ... t_buf_m[added - 1]) for handling update cases
345 * 2) DEL state (ta_buf_m[count[ ... t_buf_m[count + added - 1])
346 * for storing deleted state
349 rollback_added_entries(struct ip_fw_chain *ch, struct table_config *tc,
350 struct table_info *tinfo, struct tentry_info *tei, caddr_t ta_buf_m,
351 uint32_t count, uint32_t added)
353 struct table_algo *ta;
354 struct tentry_info *ptei;
360 IPFW_UH_WLOCK_ASSERT(ch);
363 ta_buf_sz = ta->ta_buf_size;
365 vv = v + count * ta_buf_sz;
366 for (i = 0; i < added; i++, v += ta_buf_sz, vv += ta_buf_sz) {
368 if ((ptei->flags & TEI_FLAGS_UPDATED) != 0) {
371 * We have old value stored by previous
372 * call in @ptei->value. Do add once again
375 error = ta->add(tc->astate, tinfo, ptei, v, &num);
376 KASSERT(error == 0, ("rollback UPDATE fail"));
377 KASSERT(num == 0, ("rollback UPDATE fail2"));
381 error = ta->prepare_del(ch, ptei, vv);
382 KASSERT(error == 0, ("pre-rollback INSERT failed"));
383 error = ta->del(tc->astate, tinfo, ptei, vv, &num);
384 KASSERT(error == 0, ("rollback INSERT failed"));
390 * Prepares add/del state for all @count entries in @tei.
391 * Uses either stack buffer (@ta_buf) or allocates a new one.
392 * Stores pointer to allocated buffer back to @ta_buf.
394 * Returns 0 on success.
397 prepare_batch_buffer(struct ip_fw_chain *ch, struct table_algo *ta,
398 struct tentry_info *tei, uint32_t count, int op, caddr_t *ta_buf)
401 size_t ta_buf_sz, sz;
402 struct tentry_info *ptei;
406 ta_buf_sz = ta->ta_buf_size;
408 /* Sigle add/delete, use on-stack buffer */
409 memset(*ta_buf, 0, TA_BUF_SZ);
414 * Multiple adds/deletes, allocate larger buffer
416 * Note we need 2xcount buffer for add case:
417 * we have hold both ADD state
418 * and DELETE state (this may be needed
419 * if we need to rollback all changes)
421 sz = count * ta_buf_sz;
422 ta_buf_m = malloc((op == OP_ADD) ? sz * 2 : sz, M_TEMP,
427 for (i = 0; i < count; i++, v += ta_buf_sz) {
429 error = (op == OP_ADD) ?
430 ta->prepare_add(ch, ptei, v) : ta->prepare_del(ch, ptei, v);
433 * Some syntax error (incorrect mask, or address, or
434 * anything). Return error regardless of atomicity
446 * Flushes allocated state for each @count entries in @tei.
447 * Frees @ta_buf_m if differs from stack buffer @ta_buf.
450 flush_batch_buffer(struct ip_fw_chain *ch, struct table_algo *ta,
451 struct tentry_info *tei, uint32_t count, int rollback,
452 caddr_t ta_buf_m, caddr_t ta_buf)
455 struct tentry_info *ptei;
459 ta_buf_sz = ta->ta_buf_size;
461 /* Run cleaning callback anyway */
463 for (i = 0; i < count; i++, v += ta_buf_sz) {
465 ta->flush_entry(ch, ptei, v);
466 if (ptei->ptv != NULL) {
467 free(ptei->ptv, M_IPFW);
472 /* Clean up "deleted" state in case of rollback */
474 v = ta_buf_m + count * ta_buf_sz;
475 for (i = 0; i < count; i++, v += ta_buf_sz)
476 ta->flush_entry(ch, &tei[i], v);
479 if (ta_buf_m != ta_buf)
480 free(ta_buf_m, M_TEMP);
485 rollback_add_entry(void *object, struct op_state *_state)
487 struct ip_fw_chain *ch;
488 struct tableop_state *ts;
490 ts = (struct tableop_state *)_state;
492 if (ts->tc != object && ts->ch != object)
497 IPFW_UH_WLOCK_ASSERT(ch);
499 /* Call specifid unlockers */
500 rollback_table_values(ts);
502 /* Indicate we've called */
507 * Adds/updates one or more entries in table @ti.
509 * Function may drop/reacquire UH wlock multiple times due to
510 * items alloc, algorithm callbacks (check_space), value linkage
511 * (new values, value storage realloc), etc..
512 * Other processes like other adds (which may involve storage resize),
513 * table swaps (which changes table data and may change algo type),
514 * table modify (which may change value mask) may be executed
515 * simultaneously so we need to deal with it.
517 * The following approach was implemented:
518 * we have per-chain linked list, protected with UH lock.
519 * add_table_entry prepares special on-stack structure wthich is passed
520 * to its descendants. Users add this structure to this list before unlock.
521 * After performing needed operations and acquiring UH lock back, each user
522 * checks if structure has changed. If true, it rolls local state back and
523 * returns without error to the caller.
524 * add_table_entry() on its own checks if structure has changed and restarts
525 * its operation from the beginning (goto restart).
527 * Functions which are modifying fields of interest (currently
528 * resize_shared_value_storage() and swap_tables() )
529 * traverses given list while holding UH lock immediately before
530 * performing their operations calling function provided be list entry
531 * ( currently rollback_add_entry ) which performs rollback for all necessary
532 * state and sets appropriate values in structure indicating rollback
536 * Function references @ti first to ensure table won't
537 * disappear or change its type.
538 * After that, prepare_add callback is called for each @tei entry.
539 * Next, we try to add each entry under UH+WHLOCK
540 * using add() callback.
541 * Finally, we free all state by calling flush_entry callback
544 * Returns 0 on success.
547 add_table_entry(struct ip_fw_chain *ch, struct tid_info *ti,
548 struct tentry_info *tei, uint8_t flags, uint32_t count)
550 struct table_config *tc;
551 struct table_algo *ta;
553 int error, first_error, i, rollback;
554 uint32_t num, numadd;
555 struct tentry_info *ptei;
556 struct tableop_state ts;
557 char ta_buf[TA_BUF_SZ];
560 memset(&ts, 0, sizeof(ts));
565 * Find and reference existing table.
568 if (ts.modified != 0) {
570 flush_batch_buffer(ch, ta, tei, count, rollback,
572 memset(&ts, 0, sizeof(ts));
577 error = find_ref_table(ch, ti, tei, count, OP_ADD, &tc);
584 /* Fill in tablestate */
586 ts.opstate.func = rollback_add_entry;
588 ts.vshared = tc->vshared;
589 ts.vmask = tc->vmask;
594 add_toperation_state(ch, &ts);
597 /* Allocate memory and prepare record(s) */
598 /* Pass stack buffer by default */
600 error = prepare_batch_buffer(ch, ta, tei, count, OP_ADD, &ta_buf_m);
603 del_toperation_state(ch, &ts);
604 /* Drop reference we've used in first search */
607 /* Check prepare_batch_buffer() error */
612 * Check if table swap has happened.
613 * (so table algo might be changed).
614 * Restart operation to achieve consistent behavior.
616 if (ts.modified != 0)
620 * Link all values values to shared/per-table value array.
622 * May release/reacquire UH_WLOCK.
624 error = ipfw_link_table_values(ch, &ts);
627 if (ts.modified != 0)
631 * Ensure we are able to add all entries without additional
632 * memory allocations. May release/reacquire UH_WLOCK.
635 error = check_table_space(ch, &ts, tc, KIDX_TO_TI(ch, kidx), count);
638 if (ts.modified != 0)
641 /* We've got valid table in @tc. Let's try to add data */
650 for (i = 0; i < count; i++, v += ta->ta_buf_size) {
653 /* check limit before adding */
654 if ((error = check_table_limit(tc, ptei)) == 0) {
655 error = ta->add(tc->astate, KIDX_TO_TI(ch, kidx),
657 /* Set status flag to inform userland */
658 store_tei_result(ptei, OP_ADD, error, num);
661 /* Update number of records to ease limit checking */
667 if (first_error == 0)
671 * Some error have happened. Check our atomicity
672 * settings: continue if atomicity is not required,
673 * rollback changes otherwise.
675 if ((flags & IPFW_CTF_ATOMIC) == 0)
678 rollback_added_entries(ch, tc, KIDX_TO_TI(ch, kidx),
679 tei, ta_buf_m, count, i);
687 ipfw_garbage_table_values(ch, tc, tei, count, rollback);
689 /* Permit post-add algorithm grow/rehash. */
691 check_table_space(ch, NULL, tc, KIDX_TO_TI(ch, kidx), 0);
693 /* Return first error to user, if any */
699 flush_batch_buffer(ch, ta, tei, count, rollback, ta_buf_m, ta_buf);
705 * Deletes one or more entries in table @ti.
707 * Returns 0 on success.
710 del_table_entry(struct ip_fw_chain *ch, struct tid_info *ti,
711 struct tentry_info *tei, uint8_t flags, uint32_t count)
713 struct table_config *tc;
714 struct table_algo *ta;
715 struct tentry_info *ptei;
717 int error, first_error, i;
718 uint32_t num, numdel;
719 char ta_buf[TA_BUF_SZ];
723 * Find and reference existing table.
726 error = find_ref_table(ch, ti, tei, count, OP_DEL, &tc);
734 /* Allocate memory and prepare record(s) */
735 /* Pass stack buffer by default */
737 error = prepare_batch_buffer(ch, ta, tei, count, OP_DEL, &ta_buf_m);
743 /* Drop reference we've used in first search */
747 * Check if table algo is still the same.
748 * (changed ta may be the result of table swap).
762 for (i = 0; i < count; i++, v += ta->ta_buf_size) {
765 error = ta->del(tc->astate, KIDX_TO_TI(ch, kidx), ptei, v,
767 /* Save state for userland */
768 store_tei_result(ptei, OP_DEL, error, num);
769 if (error != 0 && first_error == 0)
776 /* Unlink non-used values */
777 ipfw_garbage_table_values(ch, tc, tei, count, 0);
780 /* Run post-del hook to permit shrinking */
781 check_table_space(ch, NULL, tc, KIDX_TO_TI(ch, kidx), 0);
786 /* Return first error to user, if any */
790 flush_batch_buffer(ch, ta, tei, count, 0, ta_buf_m, ta_buf);
796 * Ensure that table @tc has enough space to add @count entries without
797 * need for reallocation.
800 * 0) need_modify() (UH_WLOCK) - checks if @count items can be added w/o resize.
802 * 1) alloc_modify (no locks, M_WAITOK) - alloc new state based on @pflags.
803 * 2) prepare_modifyt (UH_WLOCK) - copy old data into new storage
804 * 3) modify (UH_WLOCK + WLOCK) - switch pointers
805 * 4) flush_modify (UH_WLOCK) - free state, if needed
807 * Returns 0 on success.
810 check_table_space(struct ip_fw_chain *ch, struct tableop_state *ts,
811 struct table_config *tc, struct table_info *ti, uint32_t count)
813 struct table_algo *ta;
815 char ta_buf[TA_BUF_SZ];
818 IPFW_UH_WLOCK_ASSERT(ch);
822 if (ta->need_modify == NULL)
825 /* Acquire reference not to loose @tc between locks/unlocks */
829 * TODO: think about avoiding race between large add/large delete
830 * operation on algorithm which implements shrinking along with
835 if (ta->need_modify(tc->astate, ti, count, &pflags) == 0) {
840 /* We have to shrink/grow table */
842 add_toperation_state(ch, ts);
845 memset(&ta_buf, 0, sizeof(ta_buf));
846 error = ta->prepare_mod(ta_buf, &pflags);
850 del_toperation_state(ch, ts);
855 if (ts != NULL && ts->modified != 0) {
858 * Swap operation has happened
859 * so we're currently operating on other
860 * table data. Stop doing this.
862 ta->flush_mod(ta_buf);
866 /* Check if we still need to alter table */
867 ti = KIDX_TO_TI(ch, tc->no.kidx);
868 if (ta->need_modify(tc->astate, ti, count, &pflags) == 0) {
872 * Other thread has already performed resize.
873 * Flush our state and return.
875 ta->flush_mod(ta_buf);
879 error = ta->fill_mod(tc->astate, ti, ta_buf, &pflags);
881 /* Do actual modification */
883 ta->modify(tc->astate, ti, ta_buf, pflags);
887 /* Anyway, flush data and retry */
888 ta->flush_mod(ta_buf);
896 * Adds or deletes record in table.
898 * Request: [ ip_fw3_opheader ipfw_table_xentry ]
900 * Returns 0 on success
903 manage_table_ent_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
904 struct sockopt_data *sd)
906 ipfw_table_xentry *xent;
907 struct tentry_info tei;
909 struct table_value v;
910 int error, hdrlen, read;
912 hdrlen = offsetof(ipfw_table_xentry, k);
914 /* Check minimum header size */
915 if (sd->valsize < (sizeof(*op3) + hdrlen))
918 read = sizeof(ip_fw3_opheader);
920 /* Check if xentry len field is valid */
921 xent = (ipfw_table_xentry *)(op3 + 1);
922 if (xent->len < hdrlen || xent->len + read > sd->valsize)
925 memset(&tei, 0, sizeof(tei));
926 tei.paddr = &xent->k;
927 tei.masklen = xent->masklen;
928 ipfw_import_table_value_legacy(xent->value, &v);
930 /* Old requests compatibility */
931 tei.flags = TEI_FLAGS_COMPAT;
932 if (xent->type == IPFW_TABLE_ADDR) {
933 if (xent->len - hdrlen == sizeof(in_addr_t))
934 tei.subtype = AF_INET;
936 tei.subtype = AF_INET6;
939 memset(&ti, 0, sizeof(ti));
941 ti.type = xent->type;
943 error = (op3->opcode == IP_FW_TABLE_XADD) ?
944 add_table_entry(ch, &ti, &tei, 0, 1) :
945 del_table_entry(ch, &ti, &tei, 0, 1);
951 * Adds or deletes record in table.
952 * Data layout (v1)(current):
953 * Request: [ ipfw_obj_header
954 * ipfw_obj_ctlv(IPFW_TLV_TBLENT_LIST) [ ipfw_obj_tentry x N ]
957 * Returns 0 on success
960 manage_table_ent_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
961 struct sockopt_data *sd)
963 ipfw_obj_tentry *tent, *ptent;
966 struct tentry_info *ptei, tei, *tei_buf;
968 int error, i, kidx, read;
970 /* Check minimum header size */
971 if (sd->valsize < (sizeof(*oh) + sizeof(*ctlv)))
974 /* Check if passed data is too long */
975 if (sd->valsize != sd->kavail)
978 oh = (ipfw_obj_header *)sd->kbuf;
980 /* Basic length checks for TLVs */
981 if (oh->ntlv.head.length != sizeof(oh->ntlv))
986 ctlv = (ipfw_obj_ctlv *)(oh + 1);
987 if (ctlv->head.length + read != sd->valsize)
990 read += sizeof(*ctlv);
991 tent = (ipfw_obj_tentry *)(ctlv + 1);
992 if (ctlv->count * sizeof(*tent) + read != sd->valsize)
995 if (ctlv->count == 0)
999 * Mark entire buffer as "read".
1000 * This instructs sopt api write it back
1001 * after function return.
1003 ipfw_get_sopt_header(sd, sd->valsize);
1005 /* Perform basic checks for each entry */
1008 for (i = 0; i < ctlv->count; i++, ptent++) {
1009 if (ptent->head.length != sizeof(*ptent))
1011 if (ptent->idx != kidx)
1015 /* Convert data into kernel request objects */
1016 objheader_to_ti(oh, &ti);
1017 ti.type = oh->ntlv.type;
1020 /* Use on-stack buffer for single add/del */
1021 if (ctlv->count == 1) {
1022 memset(&tei, 0, sizeof(tei));
1025 tei_buf = malloc(ctlv->count * sizeof(tei), M_TEMP,
1030 for (i = 0; i < ctlv->count; i++, ptent++, ptei++) {
1031 ptei->paddr = &ptent->k;
1032 ptei->subtype = ptent->subtype;
1033 ptei->masklen = ptent->masklen;
1034 if (ptent->head.flags & IPFW_TF_UPDATE)
1035 ptei->flags |= TEI_FLAGS_UPDATE;
1037 ipfw_import_table_value_v1(&ptent->v.value);
1038 ptei->pvalue = (struct table_value *)&ptent->v.value;
1041 error = (oh->opheader.opcode == IP_FW_TABLE_XADD) ?
1042 add_table_entry(ch, &ti, tei_buf, ctlv->flags, ctlv->count) :
1043 del_table_entry(ch, &ti, tei_buf, ctlv->flags, ctlv->count);
1045 /* Translate result back to userland */
1048 for (i = 0; i < ctlv->count; i++, ptent++, ptei++) {
1049 if (ptei->flags & TEI_FLAGS_ADDED)
1050 ptent->result = IPFW_TR_ADDED;
1051 else if (ptei->flags & TEI_FLAGS_DELETED)
1052 ptent->result = IPFW_TR_DELETED;
1053 else if (ptei->flags & TEI_FLAGS_UPDATED)
1054 ptent->result = IPFW_TR_UPDATED;
1055 else if (ptei->flags & TEI_FLAGS_LIMIT)
1056 ptent->result = IPFW_TR_LIMIT;
1057 else if (ptei->flags & TEI_FLAGS_ERROR)
1058 ptent->result = IPFW_TR_ERROR;
1059 else if (ptei->flags & TEI_FLAGS_NOTFOUND)
1060 ptent->result = IPFW_TR_NOTFOUND;
1061 else if (ptei->flags & TEI_FLAGS_EXISTS)
1062 ptent->result = IPFW_TR_EXISTS;
1063 ipfw_export_table_value_v1(ptei->pvalue, &ptent->v.value);
1066 if (tei_buf != &tei)
1067 free(tei_buf, M_TEMP);
1073 * Looks up an entry in given table.
1074 * Data layout (v0)(current):
1075 * Request: [ ipfw_obj_header ipfw_obj_tentry ]
1076 * Reply: [ ipfw_obj_header ipfw_obj_tentry ]
1078 * Returns 0 on success
1081 find_table_entry(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1082 struct sockopt_data *sd)
1084 ipfw_obj_tentry *tent;
1085 ipfw_obj_header *oh;
1087 struct table_config *tc;
1088 struct table_algo *ta;
1089 struct table_info *kti;
1090 struct namedobj_instance *ni;
1094 /* Check minimum header size */
1095 sz = sizeof(*oh) + sizeof(*tent);
1096 if (sd->valsize != sz)
1099 oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz);
1100 tent = (ipfw_obj_tentry *)(oh + 1);
1102 /* Basic length checks for TLVs */
1103 if (oh->ntlv.head.length != sizeof(oh->ntlv))
1106 objheader_to_ti(oh, &ti);
1107 ti.type = oh->ntlv.type;
1108 ti.uidx = tent->idx;
1111 ni = CHAIN_TO_NI(ch);
1114 * Find existing table and check its type .
1117 if ((tc = find_table(ni, &ti)) == NULL) {
1118 IPFW_UH_RUNLOCK(ch);
1122 /* check table type */
1123 if (tc->no.subtype != ti.type) {
1124 IPFW_UH_RUNLOCK(ch);
1128 kti = KIDX_TO_TI(ch, tc->no.kidx);
1131 if (ta->find_tentry == NULL)
1134 error = ta->find_tentry(tc->astate, kti, tent);
1136 IPFW_UH_RUNLOCK(ch);
1142 * Flushes all entries or destroys given table.
1143 * Data layout (v0)(current):
1144 * Request: [ ipfw_obj_header ]
1146 * Returns 0 on success
1149 flush_table_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1150 struct sockopt_data *sd)
1153 struct _ipfw_obj_header *oh;
1156 if (sd->valsize != sizeof(*oh))
1159 oh = (struct _ipfw_obj_header *)op3;
1160 objheader_to_ti(oh, &ti);
1162 if (op3->opcode == IP_FW_TABLE_XDESTROY)
1163 error = destroy_table(ch, &ti);
1164 else if (op3->opcode == IP_FW_TABLE_XFLUSH)
1165 error = flush_table(ch, &ti);
1173 restart_flush(void *object, struct op_state *_state)
1175 struct tableop_state *ts;
1177 ts = (struct tableop_state *)_state;
1179 if (ts->tc != object)
1182 /* Indicate we've called */
1187 * Flushes given table.
1189 * Function create new table instance with the same
1190 * parameters, swaps it with old one and
1191 * flushes state without holding runtime WLOCK.
1193 * Returns 0 on success.
1196 flush_table(struct ip_fw_chain *ch, struct tid_info *ti)
1198 struct namedobj_instance *ni;
1199 struct table_config *tc;
1200 struct table_algo *ta;
1201 struct table_info ti_old, ti_new, *tablestate;
1202 void *astate_old, *astate_new;
1203 char algostate[64], *pstate;
1204 struct tableop_state ts;
1210 * Stage 1: save table algorithm.
1211 * Reference found table to ensure it won't disappear.
1214 ni = CHAIN_TO_NI(ch);
1215 if ((tc = find_table(ni, ti)) == NULL) {
1216 IPFW_UH_WUNLOCK(ch);
1221 memset(&ti_new, 0, sizeof(ti_new));
1223 /* Set up swap handler */
1224 memset(&ts, 0, sizeof(ts));
1225 ts.opstate.func = restart_flush;
1229 /* Do not flush readonly tables */
1230 if ((ta->flags & TA_FLAG_READONLY) != 0) {
1231 IPFW_UH_WUNLOCK(ch);
1234 /* Save startup algo parameters */
1235 if (ta->print_config != NULL) {
1236 ta->print_config(tc->astate, KIDX_TO_TI(ch, tc->no.kidx),
1237 algostate, sizeof(algostate));
1241 tflags = tc->tflags;
1243 add_toperation_state(ch, &ts);
1244 IPFW_UH_WUNLOCK(ch);
1247 * Stage 1.5: if this is not the first attempt, destroy previous state
1250 ta->destroy(astate_new, &ti_new);
1255 * Stage 2: allocate new table instance using same algo.
1257 memset(&ti_new, 0, sizeof(struct table_info));
1258 error = ta->init(ch, &astate_new, &ti_new, pstate, tflags);
1261 * Stage 3: swap old state pointers with newly-allocated ones.
1262 * Decrease refcount.
1266 del_toperation_state(ch, &ts);
1269 IPFW_UH_WUNLOCK(ch);
1274 * Restart operation if table swap has happened:
1275 * even if algo may be the same, algo init parameters
1276 * may change. Restart operation instead of doing
1279 if (ts.modified != 0) {
1280 /* Delay destroying data since we're holding UH lock */
1285 ni = CHAIN_TO_NI(ch);
1287 tablestate = (struct table_info *)ch->tablestate;
1290 ti_old = tablestate[kidx];
1291 tablestate[kidx] = ti_new;
1294 astate_old = tc->astate;
1295 tc->astate = astate_new;
1296 tc->ti_copy = ti_new;
1299 /* Notify algo on real @ti address */
1300 if (ta->change_ti != NULL)
1301 ta->change_ti(tc->astate, &tablestate[kidx]);
1304 * Stage 4: unref values.
1306 ipfw_unref_table_values(ch, tc, ta, astate_old, &ti_old);
1307 IPFW_UH_WUNLOCK(ch);
1310 * Stage 5: perform real flush/destroy.
1312 ta->destroy(astate_old, &ti_old);
1319 * Data layout (v0)(current):
1320 * Request: [ ipfw_obj_header ipfw_obj_ntlv ]
1322 * Returns 0 on success
1325 swap_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1326 struct sockopt_data *sd)
1329 struct _ipfw_obj_header *oh;
1330 struct tid_info ti_a, ti_b;
1332 if (sd->valsize != sizeof(*oh) + sizeof(ipfw_obj_ntlv))
1335 oh = (struct _ipfw_obj_header *)op3;
1336 ntlv_to_ti(&oh->ntlv, &ti_a);
1337 ntlv_to_ti((ipfw_obj_ntlv *)(oh + 1), &ti_b);
1339 error = swap_tables(ch, &ti_a, &ti_b);
1345 * Swaps two tables of the same type/valtype.
1347 * Checks if tables are compatible and limits
1348 * permits swap, than actually perform swap.
1350 * Each table consists of 2 different parts:
1352 * @tc (with name, set, kidx) and rule bindings, which is "stable".
1356 * runtime data @ti (ch->tablestate)
1357 * runtime cache in @tc
1358 * algo-specific data (@tc->astate)
1365 * After that we call @ti change handler for each table.
1367 * Note that referencing @tc won't protect tc->ta from change.
1368 * XXX: Do we need to restrict swap between locked tables?
1369 * XXX: Do we need to exchange ftype?
1371 * Returns 0 on success.
1374 swap_tables(struct ip_fw_chain *ch, struct tid_info *a,
1377 struct namedobj_instance *ni;
1378 struct table_config *tc_a, *tc_b;
1379 struct table_algo *ta;
1380 struct table_info ti, *tablestate;
1385 * Stage 1: find both tables and ensure they are of
1389 ni = CHAIN_TO_NI(ch);
1390 if ((tc_a = find_table(ni, a)) == NULL) {
1391 IPFW_UH_WUNLOCK(ch);
1394 if ((tc_b = find_table(ni, b)) == NULL) {
1395 IPFW_UH_WUNLOCK(ch);
1399 /* It is very easy to swap between the same table */
1401 IPFW_UH_WUNLOCK(ch);
1405 /* Check type and value are the same */
1406 if (tc_a->no.subtype!=tc_b->no.subtype || tc_a->tflags!=tc_b->tflags) {
1407 IPFW_UH_WUNLOCK(ch);
1411 /* Check limits before swap */
1412 if ((tc_a->limit != 0 && tc_b->count > tc_a->limit) ||
1413 (tc_b->limit != 0 && tc_a->count > tc_b->limit)) {
1414 IPFW_UH_WUNLOCK(ch);
1418 /* Check if one of the tables is readonly */
1419 if (((tc_a->ta->flags | tc_b->ta->flags) & TA_FLAG_READONLY) != 0) {
1420 IPFW_UH_WUNLOCK(ch);
1424 /* Notify we're going to swap */
1425 rollback_toperation_state(ch, tc_a);
1426 rollback_toperation_state(ch, tc_b);
1428 /* Everything is fine, prepare to swap */
1429 tablestate = (struct table_info *)ch->tablestate;
1430 ti = tablestate[tc_a->no.kidx];
1432 astate = tc_a->astate;
1433 count = tc_a->count;
1437 tablestate[tc_a->no.kidx] = tablestate[tc_b->no.kidx];
1438 tc_a->ta = tc_b->ta;
1439 tc_a->astate = tc_b->astate;
1440 tc_a->count = tc_b->count;
1442 tablestate[tc_b->no.kidx] = ti;
1444 tc_b->astate = astate;
1445 tc_b->count = count;
1448 /* Ensure tc.ti copies are in sync */
1449 tc_a->ti_copy = tablestate[tc_a->no.kidx];
1450 tc_b->ti_copy = tablestate[tc_b->no.kidx];
1452 /* Notify both tables on @ti change */
1453 if (tc_a->ta->change_ti != NULL)
1454 tc_a->ta->change_ti(tc_a->astate, &tablestate[tc_a->no.kidx]);
1455 if (tc_b->ta->change_ti != NULL)
1456 tc_b->ta->change_ti(tc_b->astate, &tablestate[tc_b->no.kidx]);
1458 IPFW_UH_WUNLOCK(ch);
1464 * Destroys table specified by @ti.
1465 * Data layout (v0)(current):
1466 * Request: [ ip_fw3_opheader ]
1468 * Returns 0 on success
1471 destroy_table(struct ip_fw_chain *ch, struct tid_info *ti)
1473 struct namedobj_instance *ni;
1474 struct table_config *tc;
1478 ni = CHAIN_TO_NI(ch);
1479 if ((tc = find_table(ni, ti)) == NULL) {
1480 IPFW_UH_WUNLOCK(ch);
1484 /* Do not permit destroying referenced tables */
1485 if (tc->no.refcnt > 0) {
1486 IPFW_UH_WUNLOCK(ch);
1491 unlink_table(ch, tc);
1494 /* Free obj index */
1495 if (ipfw_objhash_free_idx(ni, tc->no.kidx) != 0)
1496 printf("Error unlinking kidx %d from table %s\n",
1497 tc->no.kidx, tc->tablename);
1499 /* Unref values used in tables while holding UH lock */
1500 ipfw_unref_table_values(ch, tc, tc->ta, tc->astate, &tc->ti_copy);
1501 IPFW_UH_WUNLOCK(ch);
1503 free_table_config(ni, tc);
1509 roundup2p(uint32_t v)
1524 * Grow tables index.
1526 * Returns 0 on success.
1529 ipfw_resize_tables(struct ip_fw_chain *ch, unsigned int ntables)
1531 unsigned int ntables_old, tbl;
1532 struct namedobj_instance *ni;
1533 void *new_idx, *old_tablestate, *tablestate;
1534 struct table_info *ti;
1535 struct table_config *tc;
1538 /* Check new value for validity */
1541 if (ntables > IPFW_TABLES_MAX)
1542 ntables = IPFW_TABLES_MAX;
1543 /* Alight to nearest power of 2 */
1544 ntables = (unsigned int)roundup2p(ntables);
1546 /* Allocate new pointers */
1547 tablestate = malloc(ntables * sizeof(struct table_info),
1548 M_IPFW, M_WAITOK | M_ZERO);
1550 ipfw_objhash_bitmap_alloc(ntables, (void *)&new_idx, &new_blocks);
1554 tbl = (ntables >= V_fw_tables_max) ? V_fw_tables_max : ntables;
1555 ni = CHAIN_TO_NI(ch);
1557 /* Temporary restrict decreasing max_tables */
1558 if (ntables < V_fw_tables_max) {
1561 * FIXME: Check if we really can shrink
1563 IPFW_UH_WUNLOCK(ch);
1567 /* Copy table info/indices */
1568 memcpy(tablestate, ch->tablestate, sizeof(struct table_info) * tbl);
1569 ipfw_objhash_bitmap_merge(ni, &new_idx, &new_blocks);
1573 /* Change pointers */
1574 old_tablestate = ch->tablestate;
1575 ch->tablestate = tablestate;
1576 ipfw_objhash_bitmap_swap(ni, &new_idx, &new_blocks);
1578 ntables_old = V_fw_tables_max;
1579 V_fw_tables_max = ntables;
1583 /* Notify all consumers that their @ti pointer has changed */
1584 ti = (struct table_info *)ch->tablestate;
1585 for (i = 0; i < tbl; i++, ti++) {
1586 if (ti->lookup == NULL)
1588 tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, i);
1589 if (tc == NULL || tc->ta->change_ti == NULL)
1592 tc->ta->change_ti(tc->astate, ti);
1595 IPFW_UH_WUNLOCK(ch);
1597 /* Free old pointers */
1598 free(old_tablestate, M_IPFW);
1599 ipfw_objhash_bitmap_free(new_idx, new_blocks);
1605 * Lookup table's named object by its @kidx.
1607 struct named_object *
1608 ipfw_objhash_lookup_table_kidx(struct ip_fw_chain *ch, uint16_t kidx)
1611 return (ipfw_objhash_lookup_kidx(CHAIN_TO_NI(ch), kidx));
1615 * Take reference to table specified in @ntlv.
1616 * On success return its @kidx.
1619 ipfw_ref_table(struct ip_fw_chain *ch, ipfw_obj_ntlv *ntlv, uint16_t *kidx)
1622 struct table_config *tc;
1625 IPFW_UH_WLOCK_ASSERT(ch);
1627 ntlv_to_ti(ntlv, &ti);
1628 error = find_table_err(CHAIN_TO_NI(ch), &ti, &tc);
1636 *kidx = tc->no.kidx;
1642 ipfw_unref_table(struct ip_fw_chain *ch, uint16_t kidx)
1645 struct namedobj_instance *ni;
1646 struct named_object *no;
1648 IPFW_UH_WLOCK_ASSERT(ch);
1649 ni = CHAIN_TO_NI(ch);
1650 no = ipfw_objhash_lookup_kidx(ni, kidx);
1651 KASSERT(no != NULL, ("Table with index %d not found", kidx));
1656 * Lookup an IP @addr in table @tbl.
1657 * Stores found value in @val.
1659 * Returns 1 if @addr was found.
1662 ipfw_lookup_table(struct ip_fw_chain *ch, uint16_t tbl, in_addr_t addr,
1665 struct table_info *ti;
1667 ti = KIDX_TO_TI(ch, tbl);
1669 return (ti->lookup(ti, &addr, sizeof(in_addr_t), val));
1673 * Lookup an arbtrary key @paddr of legth @plen in table @tbl.
1674 * Stores found value in @val.
1676 * Returns 1 if key was found.
1679 ipfw_lookup_table_extended(struct ip_fw_chain *ch, uint16_t tbl, uint16_t plen,
1680 void *paddr, uint32_t *val)
1682 struct table_info *ti;
1684 ti = KIDX_TO_TI(ch, tbl);
1686 return (ti->lookup(ti, paddr, plen, val));
1690 * Info/List/dump support for tables.
1695 * High-level 'get' cmds sysctl handlers
1699 * Lists all tables currently available in kernel.
1700 * Data layout (v0)(current):
1701 * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size
1702 * Reply: [ ipfw_obj_lheader ipfw_xtable_info x N ]
1704 * Returns 0 on success
1707 list_tables(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1708 struct sockopt_data *sd)
1710 struct _ipfw_obj_lheader *olh;
1713 olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh));
1716 if (sd->valsize < olh->size)
1720 error = export_tables(ch, olh, sd);
1721 IPFW_UH_RUNLOCK(ch);
1727 * Store table info to buffer provided by @sd.
1728 * Data layout (v0)(current):
1729 * Request: [ ipfw_obj_header ipfw_xtable_info(empty)]
1730 * Reply: [ ipfw_obj_header ipfw_xtable_info ]
1732 * Returns 0 on success.
1735 describe_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1736 struct sockopt_data *sd)
1738 struct _ipfw_obj_header *oh;
1739 struct table_config *tc;
1743 sz = sizeof(*oh) + sizeof(ipfw_xtable_info);
1744 oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz);
1748 objheader_to_ti(oh, &ti);
1751 if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) {
1752 IPFW_UH_RUNLOCK(ch);
1756 export_table_info(ch, tc, (ipfw_xtable_info *)(oh + 1));
1757 IPFW_UH_RUNLOCK(ch);
1763 * Modifies existing table.
1764 * Data layout (v0)(current):
1765 * Request: [ ipfw_obj_header ipfw_xtable_info ]
1767 * Returns 0 on success
1770 modify_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1771 struct sockopt_data *sd)
1773 struct _ipfw_obj_header *oh;
1774 ipfw_xtable_info *i;
1777 struct namedobj_instance *ni;
1778 struct table_config *tc;
1780 if (sd->valsize != sizeof(*oh) + sizeof(ipfw_xtable_info))
1783 oh = (struct _ipfw_obj_header *)sd->kbuf;
1784 i = (ipfw_xtable_info *)(oh + 1);
1787 * Verify user-supplied strings.
1788 * Check for null-terminated/zero-length strings/
1790 tname = oh->ntlv.name;
1791 if (check_table_name(tname) != 0)
1794 objheader_to_ti(oh, &ti);
1798 ni = CHAIN_TO_NI(ch);
1799 if ((tc = find_table(ni, &ti)) == NULL) {
1800 IPFW_UH_WUNLOCK(ch);
1804 /* Do not support any modifications for readonly tables */
1805 if ((tc->ta->flags & TA_FLAG_READONLY) != 0) {
1806 IPFW_UH_WUNLOCK(ch);
1810 if ((i->mflags & IPFW_TMFLAGS_LIMIT) != 0)
1811 tc->limit = i->limit;
1812 if ((i->mflags & IPFW_TMFLAGS_LOCK) != 0)
1813 tc->locked = ((i->flags & IPFW_TGFLAGS_LOCKED) != 0);
1814 IPFW_UH_WUNLOCK(ch);
1820 * Creates new table.
1821 * Data layout (v0)(current):
1822 * Request: [ ipfw_obj_header ipfw_xtable_info ]
1824 * Returns 0 on success
1827 create_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1828 struct sockopt_data *sd)
1830 struct _ipfw_obj_header *oh;
1831 ipfw_xtable_info *i;
1832 char *tname, *aname;
1834 struct namedobj_instance *ni;
1836 if (sd->valsize != sizeof(*oh) + sizeof(ipfw_xtable_info))
1839 oh = (struct _ipfw_obj_header *)sd->kbuf;
1840 i = (ipfw_xtable_info *)(oh + 1);
1843 * Verify user-supplied strings.
1844 * Check for null-terminated/zero-length strings/
1846 tname = oh->ntlv.name;
1847 aname = i->algoname;
1848 if (check_table_name(tname) != 0 ||
1849 strnlen(aname, sizeof(i->algoname)) == sizeof(i->algoname))
1852 if (aname[0] == '\0') {
1853 /* Use default algorithm */
1857 objheader_to_ti(oh, &ti);
1860 ni = CHAIN_TO_NI(ch);
1863 if (find_table(ni, &ti) != NULL) {
1864 IPFW_UH_RUNLOCK(ch);
1867 IPFW_UH_RUNLOCK(ch);
1869 return (create_table_internal(ch, &ti, aname, i, NULL, 0));
1873 * Creates new table based on @ti and @aname.
1875 * Assume @aname to be checked and valid.
1876 * Stores allocated table kidx inside @pkidx (if non-NULL).
1877 * Reference created table if @compat is non-zero.
1879 * Returns 0 on success.
1882 create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti,
1883 char *aname, ipfw_xtable_info *i, uint16_t *pkidx, int compat)
1885 struct namedobj_instance *ni;
1886 struct table_config *tc, *tc_new, *tmp;
1887 struct table_algo *ta;
1890 ni = CHAIN_TO_NI(ch);
1892 ta = find_table_algo(CHAIN_TO_TCFG(ch), ti, aname);
1896 tc = alloc_table_config(ch, ti, ta, aname, i->tflags);
1900 tc->vmask = i->vmask;
1901 tc->limit = i->limit;
1902 if (ta->flags & TA_FLAG_READONLY)
1905 tc->locked = (i->flags & IPFW_TGFLAGS_LOCKED) != 0;
1909 /* Check if table has been already created */
1910 tc_new = find_table(ni, ti);
1911 if (tc_new != NULL) {
1914 * Compat: do not fail if we're
1915 * requesting to create existing table
1916 * which has the same type
1918 if (compat == 0 || tc_new->no.subtype != tc->no.subtype) {
1919 IPFW_UH_WUNLOCK(ch);
1920 free_table_config(ni, tc);
1924 /* Exchange tc and tc_new for proper refcounting & freeing */
1930 if (ipfw_objhash_alloc_idx(ni, &kidx) != 0) {
1931 IPFW_UH_WUNLOCK(ch);
1932 printf("Unable to allocate table index."
1933 " Consider increasing net.inet.ip.fw.tables_max");
1934 free_table_config(ni, tc);
1938 tc->no.etlv = IPFW_TLV_TBL_NAME;
1948 *pkidx = tc->no.kidx;
1950 IPFW_UH_WUNLOCK(ch);
1953 free_table_config(ni, tc_new);
1959 ntlv_to_ti(ipfw_obj_ntlv *ntlv, struct tid_info *ti)
1962 memset(ti, 0, sizeof(struct tid_info));
1963 ti->set = ntlv->set;
1964 ti->uidx = ntlv->idx;
1966 ti->tlen = ntlv->head.length;
1970 objheader_to_ti(struct _ipfw_obj_header *oh, struct tid_info *ti)
1973 ntlv_to_ti(&oh->ntlv, ti);
1976 struct namedobj_instance *
1977 ipfw_get_table_objhash(struct ip_fw_chain *ch)
1980 return (CHAIN_TO_NI(ch));
1984 * Exports basic table info as name TLV.
1985 * Used inside dump_static_rules() to provide info
1986 * about all tables referenced by current ruleset.
1988 * Returns 0 on success.
1991 ipfw_export_table_ntlv(struct ip_fw_chain *ch, uint16_t kidx,
1992 struct sockopt_data *sd)
1994 struct namedobj_instance *ni;
1995 struct named_object *no;
1996 ipfw_obj_ntlv *ntlv;
1998 ni = CHAIN_TO_NI(ch);
2000 no = ipfw_objhash_lookup_kidx(ni, kidx);
2001 KASSERT(no != NULL, ("invalid table kidx passed"));
2003 ntlv = (ipfw_obj_ntlv *)ipfw_get_sopt_space(sd, sizeof(*ntlv));
2007 ntlv->head.type = IPFW_TLV_TBL_NAME;
2008 ntlv->head.length = sizeof(*ntlv);
2009 ntlv->idx = no->kidx;
2010 strlcpy(ntlv->name, no->name, sizeof(ntlv->name));
2016 struct ip_fw_chain *ch;
2017 struct table_info *ti;
2018 struct table_config *tc;
2019 struct sockopt_data *sd;
2024 ipfw_table_entry *ent;
2027 ipfw_obj_tentry tent;
2031 count_ext_entries(void *e, void *arg)
2033 struct dump_args *da;
2035 da = (struct dump_args *)arg;
2042 * Gets number of items from table either using
2043 * internal counter or calling algo callback for
2044 * externally-managed tables.
2046 * Returns number of records.
2049 table_get_count(struct ip_fw_chain *ch, struct table_config *tc)
2051 struct table_info *ti;
2052 struct table_algo *ta;
2053 struct dump_args da;
2055 ti = KIDX_TO_TI(ch, tc->no.kidx);
2058 /* Use internal counter for self-managed tables */
2059 if ((ta->flags & TA_FLAG_READONLY) == 0)
2062 /* Use callback to quickly get number of items */
2063 if ((ta->flags & TA_FLAG_EXTCOUNTER) != 0)
2064 return (ta->get_count(tc->astate, ti));
2066 /* Count number of iterms ourselves */
2067 memset(&da, 0, sizeof(da));
2068 ta->foreach(tc->astate, ti, count_ext_entries, &da);
2074 * Exports table @tc info into standard ipfw_xtable_info format.
2077 export_table_info(struct ip_fw_chain *ch, struct table_config *tc,
2078 ipfw_xtable_info *i)
2080 struct table_info *ti;
2081 struct table_algo *ta;
2083 i->type = tc->no.subtype;
2084 i->tflags = tc->tflags;
2085 i->vmask = tc->vmask;
2086 i->set = tc->no.set;
2087 i->kidx = tc->no.kidx;
2088 i->refcnt = tc->no.refcnt;
2089 i->count = table_get_count(ch, tc);
2090 i->limit = tc->limit;
2091 i->flags |= (tc->locked != 0) ? IPFW_TGFLAGS_LOCKED : 0;
2092 i->size = i->count * sizeof(ipfw_obj_tentry);
2093 i->size += sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info);
2094 strlcpy(i->tablename, tc->tablename, sizeof(i->tablename));
2095 ti = KIDX_TO_TI(ch, tc->no.kidx);
2097 if (ta->print_config != NULL) {
2098 /* Use algo function to print table config to string */
2099 ta->print_config(tc->astate, ti, i->algoname,
2100 sizeof(i->algoname));
2102 strlcpy(i->algoname, ta->name, sizeof(i->algoname));
2103 /* Dump algo-specific data, if possible */
2104 if (ta->dump_tinfo != NULL) {
2105 ta->dump_tinfo(tc->astate, ti, &i->ta_info);
2106 i->ta_info.flags |= IPFW_TATFLAGS_DATA;
2110 struct dump_table_args {
2111 struct ip_fw_chain *ch;
2112 struct sockopt_data *sd;
2116 export_table_internal(struct namedobj_instance *ni, struct named_object *no,
2119 ipfw_xtable_info *i;
2120 struct dump_table_args *dta;
2122 dta = (struct dump_table_args *)arg;
2124 i = (ipfw_xtable_info *)ipfw_get_sopt_space(dta->sd, sizeof(*i));
2125 KASSERT(i != NULL, ("previously checked buffer is not enough"));
2127 export_table_info(dta->ch, (struct table_config *)no, i);
2132 * Export all tables as ipfw_xtable_info structures to
2133 * storage provided by @sd.
2135 * If supplied buffer is too small, fills in required size
2136 * and returns ENOMEM.
2137 * Returns 0 on success.
2140 export_tables(struct ip_fw_chain *ch, ipfw_obj_lheader *olh,
2141 struct sockopt_data *sd)
2145 struct dump_table_args dta;
2147 count = ipfw_objhash_count(CHAIN_TO_NI(ch));
2148 size = count * sizeof(ipfw_xtable_info) + sizeof(ipfw_obj_lheader);
2150 /* Fill in header regadless of buffer size */
2152 olh->objsize = sizeof(ipfw_xtable_info);
2154 if (size > olh->size) {
2164 ipfw_objhash_foreach(CHAIN_TO_NI(ch), export_table_internal, &dta);
2170 * Dumps all table data
2171 * Data layout (v1)(current):
2172 * Request: [ ipfw_obj_header ], size = ipfw_xtable_info.size
2173 * Reply: [ ipfw_obj_header ipfw_xtable_info ipfw_obj_tentry x N ]
2175 * Returns 0 on success
2178 dump_table_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
2179 struct sockopt_data *sd)
2181 struct _ipfw_obj_header *oh;
2182 ipfw_xtable_info *i;
2184 struct table_config *tc;
2185 struct table_algo *ta;
2186 struct dump_args da;
2189 sz = sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info);
2190 oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz);
2194 i = (ipfw_xtable_info *)(oh + 1);
2195 objheader_to_ti(oh, &ti);
2198 if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) {
2199 IPFW_UH_RUNLOCK(ch);
2202 export_table_info(ch, tc, i);
2204 if (sd->valsize < i->size) {
2207 * Submitted buffer size is not enough.
2208 * WE've already filled in @i structure with
2209 * relevant table info including size, so we
2210 * can return. Buffer will be flushed automatically.
2212 IPFW_UH_RUNLOCK(ch);
2217 * Do the actual dump in eXtended format
2219 memset(&da, 0, sizeof(da));
2221 da.ti = KIDX_TO_TI(ch, tc->no.kidx);
2227 ta->foreach(tc->astate, da.ti, dump_table_tentry, &da);
2228 IPFW_UH_RUNLOCK(ch);
2234 * Dumps all table data
2235 * Data layout (version 0)(legacy):
2236 * Request: [ ipfw_xtable ], size = IP_FW_TABLE_XGETSIZE()
2237 * Reply: [ ipfw_xtable ipfw_table_xentry x N ]
2239 * Returns 0 on success
2242 dump_table_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
2243 struct sockopt_data *sd)
2247 struct table_config *tc;
2248 struct table_algo *ta;
2249 struct dump_args da;
2252 xtbl = (ipfw_xtable *)ipfw_get_sopt_header(sd, sizeof(ipfw_xtable));
2256 memset(&ti, 0, sizeof(ti));
2257 ti.uidx = xtbl->tbl;
2260 if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) {
2261 IPFW_UH_RUNLOCK(ch);
2264 count = table_get_count(ch, tc);
2265 sz = count * sizeof(ipfw_table_xentry) + sizeof(ipfw_xtable);
2269 xtbl->type = tc->no.subtype;
2270 xtbl->tbl = ti.uidx;
2272 if (sd->valsize < sz) {
2275 * Submitted buffer size is not enough.
2276 * WE've already filled in @i structure with
2277 * relevant table info including size, so we
2278 * can return. Buffer will be flushed automatically.
2280 IPFW_UH_RUNLOCK(ch);
2284 /* Do the actual dump in eXtended format */
2285 memset(&da, 0, sizeof(da));
2287 da.ti = KIDX_TO_TI(ch, tc->no.kidx);
2293 ta->foreach(tc->astate, da.ti, dump_table_xentry, &da);
2294 IPFW_UH_RUNLOCK(ch);
2300 * Legacy function to retrieve number of items in table.
2303 get_table_size(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
2304 struct sockopt_data *sd)
2311 sz = sizeof(*op3) + sizeof(uint32_t);
2312 op3 = (ip_fw3_opheader *)ipfw_get_sopt_header(sd, sz);
2316 tbl = (uint32_t *)(op3 + 1);
2317 memset(&ti, 0, sizeof(ti));
2320 error = ipfw_count_xtable(ch, &ti, tbl);
2321 IPFW_UH_RUNLOCK(ch);
2326 * Legacy IP_FW_TABLE_GETSIZE handler
2329 ipfw_count_table(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt)
2331 struct table_config *tc;
2333 if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL)
2335 *cnt = table_get_count(ch, tc);
2340 * Legacy IP_FW_TABLE_XGETSIZE handler
2343 ipfw_count_xtable(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt)
2345 struct table_config *tc;
2348 if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) {
2350 return (0); /* 'table all list' requires success */
2353 count = table_get_count(ch, tc);
2354 *cnt = count * sizeof(ipfw_table_xentry);
2356 *cnt += sizeof(ipfw_xtable);
2361 dump_table_entry(void *e, void *arg)
2363 struct dump_args *da;
2364 struct table_config *tc;
2365 struct table_algo *ta;
2366 ipfw_table_entry *ent;
2367 struct table_value *pval;
2370 da = (struct dump_args *)arg;
2375 /* Out of memory, returning */
2376 if (da->cnt == da->size)
2379 ent->tbl = da->uidx;
2382 error = ta->dump_tentry(tc->astate, da->ti, e, &da->tent);
2386 ent->addr = da->tent.k.addr.s_addr;
2387 ent->masklen = da->tent.masklen;
2388 pval = get_table_value(da->ch, da->tc, da->tent.v.kidx);
2389 ent->value = ipfw_export_table_value_legacy(pval);
2395 * Dumps table in pre-8.1 legacy format.
2398 ipfw_dump_table_legacy(struct ip_fw_chain *ch, struct tid_info *ti,
2401 struct table_config *tc;
2402 struct table_algo *ta;
2403 struct dump_args da;
2407 if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL)
2408 return (0); /* XXX: We should return ESRCH */
2412 /* This dump format supports IPv4 only */
2413 if (tc->no.subtype != IPFW_TABLE_ADDR)
2416 memset(&da, 0, sizeof(da));
2418 da.ti = KIDX_TO_TI(ch, tc->no.kidx);
2420 da.ent = &tbl->ent[0];
2421 da.size = tbl->size;
2424 ta->foreach(tc->astate, da.ti, dump_table_entry, &da);
2431 * Dumps table entry in eXtended format (v1)(current).
2434 dump_table_tentry(void *e, void *arg)
2436 struct dump_args *da;
2437 struct table_config *tc;
2438 struct table_algo *ta;
2439 struct table_value *pval;
2440 ipfw_obj_tentry *tent;
2443 da = (struct dump_args *)arg;
2448 tent = (ipfw_obj_tentry *)ipfw_get_sopt_space(da->sd, sizeof(*tent));
2449 /* Out of memory, returning */
2454 tent->head.length = sizeof(ipfw_obj_tentry);
2455 tent->idx = da->uidx;
2457 error = ta->dump_tentry(tc->astate, da->ti, e, tent);
2461 pval = get_table_value(da->ch, da->tc, tent->v.kidx);
2462 ipfw_export_table_value_v1(pval, &tent->v.value);
2468 * Dumps table entry in eXtended format (v0).
2471 dump_table_xentry(void *e, void *arg)
2473 struct dump_args *da;
2474 struct table_config *tc;
2475 struct table_algo *ta;
2476 ipfw_table_xentry *xent;
2477 ipfw_obj_tentry *tent;
2478 struct table_value *pval;
2481 da = (struct dump_args *)arg;
2486 xent = (ipfw_table_xentry *)ipfw_get_sopt_space(da->sd, sizeof(*xent));
2487 /* Out of memory, returning */
2490 xent->len = sizeof(ipfw_table_xentry);
2491 xent->tbl = da->uidx;
2493 memset(&da->tent, 0, sizeof(da->tent));
2495 error = ta->dump_tentry(tc->astate, da->ti, e, tent);
2499 /* Convert current format to previous one */
2500 xent->masklen = tent->masklen;
2501 pval = get_table_value(da->ch, da->tc, da->tent.v.kidx);
2502 xent->value = ipfw_export_table_value_legacy(pval);
2503 /* Apply some hacks */
2504 if (tc->no.subtype == IPFW_TABLE_ADDR && tent->subtype == AF_INET) {
2505 xent->k.addr6.s6_addr32[3] = tent->k.addr.s_addr;
2506 xent->flags = IPFW_TCF_INET;
2508 memcpy(&xent->k, &tent->k, sizeof(xent->k));
2514 * Helper function to export table algo data
2515 * to tentry format before calling user function.
2517 * Returns 0 on success.
2520 prepare_table_tentry(void *e, void *arg)
2522 struct dump_args *da;
2523 struct table_config *tc;
2524 struct table_algo *ta;
2527 da = (struct dump_args *)arg;
2532 error = ta->dump_tentry(tc->astate, da->ti, e, &da->tent);
2536 da->f(&da->tent, da->farg);
2542 * Allow external consumers to read table entries in standard format.
2545 ipfw_foreach_table_tentry(struct ip_fw_chain *ch, uint16_t kidx,
2546 ta_foreach_f *f, void *arg)
2548 struct namedobj_instance *ni;
2549 struct table_config *tc;
2550 struct table_algo *ta;
2551 struct dump_args da;
2553 ni = CHAIN_TO_NI(ch);
2555 tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, kidx);
2561 memset(&da, 0, sizeof(da));
2563 da.ti = KIDX_TO_TI(ch, tc->no.kidx);
2568 ta->foreach(tc->astate, da.ti, prepare_table_tentry, &da);
2578 * Finds algorithm by index, table type or supplied name.
2580 * Returns pointer to algo or NULL.
2582 static struct table_algo *
2583 find_table_algo(struct tables_config *tcfg, struct tid_info *ti, char *name)
2586 struct table_algo *ta;
2588 if (ti->type > IPFW_TABLE_MAXTYPE)
2591 /* Search by index */
2592 if (ti->atype != 0) {
2593 if (ti->atype > tcfg->algo_count)
2595 return (tcfg->algo[ti->atype]);
2599 /* Return default algorithm for given type if set */
2600 return (tcfg->def_algo[ti->type]);
2603 /* Search by name */
2604 /* TODO: better search */
2605 for (i = 1; i <= tcfg->algo_count; i++) {
2609 * One can supply additional algorithm
2610 * parameters so we compare only the first word
2612 * 'addr:chash hsize=32'
2616 l = strlen(ta->name);
2617 if (strncmp(name, ta->name, l) != 0)
2619 if (name[l] != '\0' && name[l] != ' ')
2621 /* Check if we're requesting proper table type */
2622 if (ti->type != 0 && ti->type != ta->type)
2631 * Register new table algo @ta.
2632 * Stores algo id inside @idx.
2634 * Returns 0 on success.
2637 ipfw_add_table_algo(struct ip_fw_chain *ch, struct table_algo *ta, size_t size,
2640 struct tables_config *tcfg;
2641 struct table_algo *ta_new;
2644 if (size > sizeof(struct table_algo))
2647 /* Check for the required on-stack size for add/del */
2648 sz = roundup2(ta->ta_buf_size, sizeof(void *));
2652 KASSERT(ta->type <= IPFW_TABLE_MAXTYPE,("Increase IPFW_TABLE_MAXTYPE"));
2654 /* Copy algorithm data to stable storage. */
2655 ta_new = malloc(sizeof(struct table_algo), M_IPFW, M_WAITOK | M_ZERO);
2656 memcpy(ta_new, ta, size);
2658 tcfg = CHAIN_TO_TCFG(ch);
2660 KASSERT(tcfg->algo_count < 255, ("Increase algo array size"));
2662 tcfg->algo[++tcfg->algo_count] = ta_new;
2663 ta_new->idx = tcfg->algo_count;
2665 /* Set algorithm as default one for given type */
2666 if ((ta_new->flags & TA_FLAG_DEFAULT) != 0 &&
2667 tcfg->def_algo[ta_new->type] == NULL)
2668 tcfg->def_algo[ta_new->type] = ta_new;
2676 * Unregisters table algo using @idx as id.
2677 * XXX: It is NOT safe to call this function in any place
2678 * other than ipfw instance destroy handler.
2681 ipfw_del_table_algo(struct ip_fw_chain *ch, int idx)
2683 struct tables_config *tcfg;
2684 struct table_algo *ta;
2686 tcfg = CHAIN_TO_TCFG(ch);
2688 KASSERT(idx <= tcfg->algo_count, ("algo idx %d out of range 1..%d",
2689 idx, tcfg->algo_count));
2691 ta = tcfg->algo[idx];
2692 KASSERT(ta != NULL, ("algo idx %d is NULL", idx));
2694 if (tcfg->def_algo[ta->type] == ta)
2695 tcfg->def_algo[ta->type] = NULL;
2701 * Lists all table algorithms currently available.
2702 * Data layout (v0)(current):
2703 * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size
2704 * Reply: [ ipfw_obj_lheader ipfw_ta_info x N ]
2706 * Returns 0 on success
2709 list_table_algo(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
2710 struct sockopt_data *sd)
2712 struct _ipfw_obj_lheader *olh;
2713 struct tables_config *tcfg;
2715 struct table_algo *ta;
2716 uint32_t count, n, size;
2718 olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh));
2721 if (sd->valsize < olh->size)
2725 tcfg = CHAIN_TO_TCFG(ch);
2726 count = tcfg->algo_count;
2727 size = count * sizeof(ipfw_ta_info) + sizeof(ipfw_obj_lheader);
2729 /* Fill in header regadless of buffer size */
2731 olh->objsize = sizeof(ipfw_ta_info);
2733 if (size > olh->size) {
2735 IPFW_UH_RUNLOCK(ch);
2740 for (n = 1; n <= count; n++) {
2741 i = (ipfw_ta_info *)ipfw_get_sopt_space(sd, sizeof(*i));
2742 KASSERT(i != NULL, ("previously checked buffer is not enough"));
2744 strlcpy(i->algoname, ta->name, sizeof(i->algoname));
2746 i->refcnt = ta->refcnt;
2749 IPFW_UH_RUNLOCK(ch);
2755 classify_srcdst(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
2757 /* Basic IPv4/IPv6 or u32 lookups */
2759 /* Assume ADDR by default */
2760 *ptype = IPFW_TABLE_ADDR;
2763 if (F_LEN(cmd) > F_INSN_SIZE(ipfw_insn_u32)) {
2765 * generic lookup. The key must be
2766 * in 32bit big-endian format.
2768 v = ((ipfw_insn_u32 *)cmd)->d[1];
2777 *ptype = IPFW_TABLE_NUMBER;
2781 *ptype = IPFW_TABLE_NUMBER;
2785 *ptype = IPFW_TABLE_NUMBER;
2789 *ptype = IPFW_TABLE_NUMBER;
2798 classify_via(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
2800 ipfw_insn_if *cmdif;
2802 /* Interface table, possibly */
2803 cmdif = (ipfw_insn_if *)cmd;
2804 if (cmdif->name[0] != '\1')
2807 *ptype = IPFW_TABLE_INTERFACE;
2808 *puidx = cmdif->p.kidx;
2814 classify_flow(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
2818 *ptype = IPFW_TABLE_FLOW;
2824 update_arg1(ipfw_insn *cmd, uint16_t idx)
2831 update_via(ipfw_insn *cmd, uint16_t idx)
2833 ipfw_insn_if *cmdif;
2835 cmdif = (ipfw_insn_if *)cmd;
2836 cmdif->p.kidx = idx;
2840 table_findbyname(struct ip_fw_chain *ch, struct tid_info *ti,
2841 struct named_object **pno)
2843 struct table_config *tc;
2846 IPFW_UH_WLOCK_ASSERT(ch);
2848 error = find_table_err(CHAIN_TO_NI(ch), ti, &tc);
2856 /* XXX: sets-sets! */
2857 static struct named_object *
2858 table_findbykidx(struct ip_fw_chain *ch, uint16_t idx)
2860 struct namedobj_instance *ni;
2861 struct table_config *tc;
2863 IPFW_UH_WLOCK_ASSERT(ch);
2864 ni = CHAIN_TO_NI(ch);
2865 tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, idx);
2866 KASSERT(tc != NULL, ("Table with index %d not found", idx));
2872 table_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set,
2873 enum ipfw_sets_cmd cmd)
2880 * Return success for TEST_ALL, since nothing prevents
2881 * move rules from one set to another. All tables are
2882 * accessible from all sets when per-set tables sysctl
2889 * NOTE: we need to use ipfw_objhash_del/ipfw_objhash_add
2890 * if set number will be used in hash function. Currently
2891 * we can just use generic handler that replaces set value.
2893 if (V_fw_tables_sets == 0)
2898 * Return EOPNOTSUPP for COUNT_ONE when per-set sysctl is
2899 * disabled. This allow skip table's opcodes from additional
2900 * checks when specific rules moved to another set.
2902 if (V_fw_tables_sets == 0)
2903 return (EOPNOTSUPP);
2905 /* Use generic sets handler when per-set sysctl is enabled. */
2906 return (ipfw_obj_manage_sets(CHAIN_TO_NI(ch), IPFW_TLV_TBL_NAME,
2907 set, new_set, cmd));
2910 static struct opcode_obj_rewrite opcodes[] = {
2912 .opcode = O_IP_SRC_LOOKUP,
2913 .etlv = IPFW_TLV_TBL_NAME,
2914 .classifier = classify_srcdst,
2915 .update = update_arg1,
2916 .find_byname = table_findbyname,
2917 .find_bykidx = table_findbykidx,
2918 .create_object = create_table_compat,
2919 .manage_sets = table_manage_sets,
2922 .opcode = O_IP_DST_LOOKUP,
2923 .etlv = IPFW_TLV_TBL_NAME,
2924 .classifier = classify_srcdst,
2925 .update = update_arg1,
2926 .find_byname = table_findbyname,
2927 .find_bykidx = table_findbykidx,
2928 .create_object = create_table_compat,
2929 .manage_sets = table_manage_sets,
2932 .opcode = O_IP_FLOW_LOOKUP,
2933 .etlv = IPFW_TLV_TBL_NAME,
2934 .classifier = classify_flow,
2935 .update = update_arg1,
2936 .find_byname = table_findbyname,
2937 .find_bykidx = table_findbykidx,
2938 .create_object = create_table_compat,
2939 .manage_sets = table_manage_sets,
2943 .etlv = IPFW_TLV_TBL_NAME,
2944 .classifier = classify_via,
2945 .update = update_via,
2946 .find_byname = table_findbyname,
2947 .find_bykidx = table_findbykidx,
2948 .create_object = create_table_compat,
2949 .manage_sets = table_manage_sets,
2953 .etlv = IPFW_TLV_TBL_NAME,
2954 .classifier = classify_via,
2955 .update = update_via,
2956 .find_byname = table_findbyname,
2957 .find_bykidx = table_findbykidx,
2958 .create_object = create_table_compat,
2959 .manage_sets = table_manage_sets,
2963 .etlv = IPFW_TLV_TBL_NAME,
2964 .classifier = classify_via,
2965 .update = update_via,
2966 .find_byname = table_findbyname,
2967 .find_bykidx = table_findbykidx,
2968 .create_object = create_table_compat,
2969 .manage_sets = table_manage_sets,
2974 test_sets_cb(struct namedobj_instance *ni __unused, struct named_object *no,
2978 /* Check that there aren't any tables in not default set */
2985 * Switch between "set 0" and "rule's set" table binding,
2986 * Check all ruleset bindings and permits changing
2987 * IFF each binding has both rule AND table in default set (set 0).
2989 * Returns 0 on success.
2992 ipfw_switch_tables_namespace(struct ip_fw_chain *ch, unsigned int sets)
2994 struct opcode_obj_rewrite *rw;
2995 struct namedobj_instance *ni;
2996 struct named_object *no;
3005 if (V_fw_tables_sets == sets) {
3006 IPFW_UH_WUNLOCK(ch);
3009 ni = CHAIN_TO_NI(ch);
3012 * Prevent disabling sets support if we have some tables
3013 * in not default sets.
3015 if (ipfw_objhash_foreach_type(ni, test_sets_cb,
3016 NULL, IPFW_TLV_TBL_NAME) != 0) {
3017 IPFW_UH_WUNLOCK(ch);
3022 * Scan all rules and examine tables opcodes.
3024 for (i = 0; i < ch->n_rules; i++) {
3030 for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) {
3031 cmdlen = F_LEN(cmd);
3032 /* Check only tables opcodes */
3033 for (kidx = 0, rw = opcodes;
3034 rw < opcodes + nitems(opcodes); rw++) {
3035 if (rw->opcode != cmd->opcode)
3037 if (rw->classifier(cmd, &kidx, &subtype) == 0)
3042 no = ipfw_objhash_lookup_kidx(ni, kidx);
3043 /* Check if both table object and rule has the set 0 */
3044 if (no->set != 0 || rule->set != 0) {
3045 IPFW_UH_WUNLOCK(ch);
3051 V_fw_tables_sets = sets;
3052 IPFW_UH_WUNLOCK(ch);
3057 * Checks table name for validity.
3058 * Enforce basic length checks, the rest
3059 * should be done in userland.
3061 * Returns 0 if name is considered valid.
3064 check_table_name(const char *name)
3068 * TODO: do some more complicated checks
3070 return (ipfw_check_object_name_generic(name));
3074 * Finds table config based on either legacy index
3076 * Note @ti structure contains unchecked data from userland.
3078 * Returns 0 in success and fills in @tc with found config
3081 find_table_err(struct namedobj_instance *ni, struct tid_info *ti,
3082 struct table_config **tc)
3084 char *name, bname[16];
3085 struct named_object *no;
3086 ipfw_obj_ntlv *ntlv;
3089 if (ti->tlvs != NULL) {
3090 ntlv = ipfw_find_name_tlv_type(ti->tlvs, ti->tlen, ti->uidx,
3097 * Use set provided by @ti instead of @ntlv one.
3098 * This is needed due to different sets behavior
3099 * controlled by V_fw_tables_sets.
3101 set = (V_fw_tables_sets != 0) ? ti->set : 0;
3103 snprintf(bname, sizeof(bname), "%d", ti->uidx);
3108 no = ipfw_objhash_lookup_name(ni, set, name);
3109 *tc = (struct table_config *)no;
3115 * Finds table config based on either legacy index
3117 * Note @ti structure contains unchecked data from userland.
3119 * Returns pointer to table_config or NULL.
3121 static struct table_config *
3122 find_table(struct namedobj_instance *ni, struct tid_info *ti)
3124 struct table_config *tc;
3126 if (find_table_err(ni, ti, &tc) != 0)
3133 * Allocate new table config structure using
3134 * specified @algo and @aname.
3136 * Returns pointer to config or NULL.
3138 static struct table_config *
3139 alloc_table_config(struct ip_fw_chain *ch, struct tid_info *ti,
3140 struct table_algo *ta, char *aname, uint8_t tflags)
3142 char *name, bname[16];
3143 struct table_config *tc;
3145 ipfw_obj_ntlv *ntlv;
3148 if (ti->tlvs != NULL) {
3149 ntlv = ipfw_find_name_tlv_type(ti->tlvs, ti->tlen, ti->uidx,
3156 /* Compat part: convert number to string representation */
3157 snprintf(bname, sizeof(bname), "%d", ti->uidx);
3162 tc = malloc(sizeof(struct table_config), M_IPFW, M_WAITOK | M_ZERO);
3163 tc->no.name = tc->tablename;
3164 tc->no.subtype = ta->type;
3166 tc->tflags = tflags;
3168 strlcpy(tc->tablename, name, sizeof(tc->tablename));
3169 /* Set "shared" value type by default */
3172 /* Preallocate data structures for new tables */
3173 error = ta->init(ch, &tc->astate, &tc->ti_copy, aname, tflags);
3183 * Destroys table state and config.
3186 free_table_config(struct namedobj_instance *ni, struct table_config *tc)
3189 KASSERT(tc->linked == 0, ("free() on linked config"));
3190 /* UH lock MUST NOT be held */
3193 * We're using ta without any locking/referencing.
3194 * TODO: fix this if we're going to use unloadable algos.
3196 tc->ta->destroy(tc->astate, &tc->ti_copy);
3201 * Links @tc to @chain table named instance.
3202 * Sets appropriate type/states in @chain table info.
3205 link_table(struct ip_fw_chain *ch, struct table_config *tc)
3207 struct namedobj_instance *ni;
3208 struct table_info *ti;
3211 IPFW_UH_WLOCK_ASSERT(ch);
3212 IPFW_WLOCK_ASSERT(ch);
3214 ni = CHAIN_TO_NI(ch);
3217 ipfw_objhash_add(ni, &tc->no);
3219 ti = KIDX_TO_TI(ch, kidx);
3222 /* Notify algo on real @ti address */
3223 if (tc->ta->change_ti != NULL)
3224 tc->ta->change_ti(tc->astate, ti);
3231 * Unlinks @tc from @chain table named instance.
3232 * Zeroes states in @chain and stores them in @tc.
3235 unlink_table(struct ip_fw_chain *ch, struct table_config *tc)
3237 struct namedobj_instance *ni;
3238 struct table_info *ti;
3241 IPFW_UH_WLOCK_ASSERT(ch);
3242 IPFW_WLOCK_ASSERT(ch);
3244 ni = CHAIN_TO_NI(ch);
3247 /* Clear state. @ti copy is already saved inside @tc */
3248 ipfw_objhash_del(ni, &tc->no);
3249 ti = KIDX_TO_TI(ch, kidx);
3250 memset(ti, 0, sizeof(struct table_info));
3254 /* Notify algo on real @ti address */
3255 if (tc->ta->change_ti != NULL)
3256 tc->ta->change_ti(tc->astate, NULL);
3259 static struct ipfw_sopt_handler scodes[] = {
3260 { IP_FW_TABLE_XCREATE, 0, HDIR_SET, create_table },
3261 { IP_FW_TABLE_XDESTROY, 0, HDIR_SET, flush_table_v0 },
3262 { IP_FW_TABLE_XFLUSH, 0, HDIR_SET, flush_table_v0 },
3263 { IP_FW_TABLE_XMODIFY, 0, HDIR_BOTH, modify_table },
3264 { IP_FW_TABLE_XINFO, 0, HDIR_GET, describe_table },
3265 { IP_FW_TABLES_XLIST, 0, HDIR_GET, list_tables },
3266 { IP_FW_TABLE_XLIST, 0, HDIR_GET, dump_table_v0 },
3267 { IP_FW_TABLE_XLIST, 1, HDIR_GET, dump_table_v1 },
3268 { IP_FW_TABLE_XADD, 0, HDIR_BOTH, manage_table_ent_v0 },
3269 { IP_FW_TABLE_XADD, 1, HDIR_BOTH, manage_table_ent_v1 },
3270 { IP_FW_TABLE_XDEL, 0, HDIR_BOTH, manage_table_ent_v0 },
3271 { IP_FW_TABLE_XDEL, 1, HDIR_BOTH, manage_table_ent_v1 },
3272 { IP_FW_TABLE_XFIND, 0, HDIR_GET, find_table_entry },
3273 { IP_FW_TABLE_XSWAP, 0, HDIR_SET, swap_table },
3274 { IP_FW_TABLES_ALIST, 0, HDIR_GET, list_table_algo },
3275 { IP_FW_TABLE_XGETSIZE, 0, HDIR_GET, get_table_size },
3279 destroy_table_locked(struct namedobj_instance *ni, struct named_object *no,
3283 unlink_table((struct ip_fw_chain *)arg, (struct table_config *)no);
3284 if (ipfw_objhash_free_idx(ni, no->kidx) != 0)
3285 printf("Error unlinking kidx %d from table %s\n",
3286 no->kidx, no->name);
3287 free_table_config(ni, (struct table_config *)no);
3292 * Shuts tables module down.
3295 ipfw_destroy_tables(struct ip_fw_chain *ch, int last)
3298 IPFW_DEL_SOPT_HANDLER(last, scodes);
3299 IPFW_DEL_OBJ_REWRITER(last, opcodes);
3301 /* Remove all tables from working set */
3304 ipfw_objhash_foreach(CHAIN_TO_NI(ch), destroy_table_locked, ch);
3306 IPFW_UH_WUNLOCK(ch);
3308 /* Free pointers itself */
3309 free(ch->tablestate, M_IPFW);
3311 ipfw_table_value_destroy(ch, last);
3312 ipfw_table_algo_destroy(ch);
3314 ipfw_objhash_destroy(CHAIN_TO_NI(ch));
3315 free(CHAIN_TO_TCFG(ch), M_IPFW);
3319 * Starts tables module.
3322 ipfw_init_tables(struct ip_fw_chain *ch, int first)
3324 struct tables_config *tcfg;
3326 /* Allocate pointers */
3327 ch->tablestate = malloc(V_fw_tables_max * sizeof(struct table_info),
3328 M_IPFW, M_WAITOK | M_ZERO);
3330 tcfg = malloc(sizeof(struct tables_config), M_IPFW, M_WAITOK | M_ZERO);
3331 tcfg->namehash = ipfw_objhash_create(V_fw_tables_max);
3334 ipfw_table_value_init(ch, first);
3335 ipfw_table_algo_init(ch);
3337 IPFW_ADD_OBJ_REWRITER(first, opcodes);
3338 IPFW_ADD_SOPT_HANDLER(first, scodes);