1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2014-2025 Yandex LLC 5 * Copyright (c) 2014 Alexander V. Chernikov 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 #include <sys/cdefs.h> 30 /* 31 * Multi-field value support for ipfw tables. 32 * 33 * This file contains necessary functions to convert 34 * large multi-field values into u32 indices suitable to be fed 35 * to various table algorithms. Other machinery like proper refcounting, 36 * internal structures resizing are also kept here. 37 */ 38 39 #include "opt_ipfw.h" 40 41 #include <sys/param.h> 42 #include <sys/systm.h> 43 #include <sys/malloc.h> 44 #include <sys/kernel.h> 45 #include <sys/hash.h> 46 #include <sys/lock.h> 47 #include <sys/rwlock.h> 48 #include <sys/rmlock.h> 49 #include <sys/socket.h> 50 #include <sys/socketvar.h> 51 #include <sys/queue.h> 52 #include <net/if.h> /* ip_fw.h requires IFNAMSIZ */ 53 54 #include <netinet/in.h> 55 #include <netinet/ip_var.h> /* struct ipfw_rule_ref */ 56 #include <netinet/ip_fw.h> 57 58 #include <netpfil/ipfw/ip_fw_private.h> 59 #include <netpfil/ipfw/ip_fw_table.h> 60 61 static uint32_t hash_table_value(struct namedobj_instance *ni, const void *key, 62 uint32_t kopt); 63 static int cmp_table_value(struct named_object *no, const void *key, 64 uint32_t kopt); 65 66 static int list_table_values(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 67 struct sockopt_data *sd); 68 69 static struct ipfw_sopt_handler scodes[] = { 70 { IP_FW_TABLE_VLIST, IP_FW3_OPVER, HDIR_GET, list_table_values }, 71 }; 72 73 #define CHAIN_TO_VI(chain) (CHAIN_TO_TCFG(chain)->valhash) 74 75 struct table_val_link 76 { 77 struct named_object no; 78 struct table_value *pval; /* Pointer to real table value */ 79 }; 80 #define VALDATA_START_SIZE 64 /* Allocate 64-items array by default */ 81 #define VALDATA_HASH_SIZE 65536 82 83 struct vdump_args { 84 struct ip_fw_chain *ch; 85 struct sockopt_data *sd; 86 struct table_value *pval; 87 int error; 88 }; 89 90 static uint32_t hash_table_value(struct namedobj_instance * ni,const void * key,uint32_t kopt)91 hash_table_value(struct namedobj_instance *ni, const void *key, uint32_t kopt) 92 { 93 94 return (hash32_buf(key, 56, 0)); 95 } 96 97 static int cmp_table_value(struct named_object * no,const void * key,uint32_t kopt)98 cmp_table_value(struct named_object *no, const void *key, uint32_t kopt) 99 { 100 101 return (memcmp(((struct table_val_link *)no)->pval, key, 56)); 102 } 103 104 static void mask_table_value(struct table_value * src,struct table_value * dst,uint32_t mask)105 mask_table_value(struct table_value *src, struct table_value *dst, 106 uint32_t mask) 107 { 108 #define _MCPY(f, b) if ((mask & (b)) != 0) { dst->f = src->f; } 109 110 memset(dst, 0, sizeof(*dst)); 111 _MCPY(tag, IPFW_VTYPE_TAG); 112 _MCPY(pipe, IPFW_VTYPE_PIPE); 113 _MCPY(divert, IPFW_VTYPE_DIVERT); 114 _MCPY(skipto, IPFW_VTYPE_SKIPTO); 115 _MCPY(netgraph, IPFW_VTYPE_NETGRAPH); 116 _MCPY(fib, IPFW_VTYPE_FIB); 117 _MCPY(nat, IPFW_VTYPE_NAT); 118 _MCPY(limit, IPFW_VTYPE_LIMIT); 119 _MCPY(mark, IPFW_VTYPE_MARK); 120 _MCPY(dscp, IPFW_VTYPE_DSCP); 121 _MCPY(nh4, IPFW_VTYPE_NH4); 122 _MCPY(nh6, IPFW_VTYPE_NH6); 123 _MCPY(zoneid, IPFW_VTYPE_NH6); 124 #undef _MCPY 125 } 126 127 static void get_value_ptrs(struct ip_fw_chain * ch,struct table_config * tc,int vshared,struct table_value ** ptv,struct namedobj_instance ** pvi)128 get_value_ptrs(struct ip_fw_chain *ch, struct table_config *tc, int vshared, 129 struct table_value **ptv, struct namedobj_instance **pvi) 130 { 131 struct table_value *pval; 132 struct namedobj_instance *vi; 133 134 if (vshared != 0) { 135 pval = (struct table_value *)ch->valuestate; 136 vi = CHAIN_TO_VI(ch); 137 } else { 138 pval = NULL; 139 vi = NULL; 140 //pval = (struct table_value *)&tc->ti.data; 141 } 142 143 if (ptv != NULL) 144 *ptv = pval; 145 if (pvi != NULL) 146 *pvi = vi; 147 } 148 149 /* 150 * Update pointers to real vaues after @pval change. 151 */ 152 static int update_tvalue(struct namedobj_instance * ni,struct named_object * no,void * arg)153 update_tvalue(struct namedobj_instance *ni, struct named_object *no, void *arg) 154 { 155 struct vdump_args *da; 156 struct table_val_link *ptv; 157 struct table_value *pval; 158 159 da = (struct vdump_args *)arg; 160 ptv = (struct table_val_link *)no; 161 162 pval = da->pval; 163 ptv->pval = &pval[ptv->no.kidx]; 164 ptv->no.name = (char *)&pval[ptv->no.kidx]; 165 return (0); 166 } 167 168 /* 169 * Grows value storage shared among all tables. 170 * Drops/reacquires UH locks. 171 * Notifies other running adds on @ch shared storage resize. 172 * Note function does not guarantee that free space 173 * will be available after invocation, so one caller needs 174 * to roll cycle himself. 175 * 176 * Returns 0 if case of no errors. 177 */ 178 static int resize_shared_value_storage(struct ip_fw_chain * ch)179 resize_shared_value_storage(struct ip_fw_chain *ch) 180 { 181 struct tables_config *tcfg; 182 struct namedobj_instance *vi; 183 struct table_value *pval, *valuestate, *old_valuestate; 184 void *new_idx; 185 struct vdump_args da; 186 int new_blocks; 187 int val_size, val_size_old; 188 189 IPFW_UH_WLOCK_ASSERT(ch); 190 191 valuestate = NULL; 192 new_idx = NULL; 193 194 pval = (struct table_value *)ch->valuestate; 195 vi = CHAIN_TO_VI(ch); 196 tcfg = CHAIN_TO_TCFG(ch); 197 198 val_size = tcfg->val_size * 2; 199 200 if (val_size == (1 << 30)) 201 return (ENOSPC); 202 203 IPFW_UH_WUNLOCK(ch); 204 205 valuestate = malloc(sizeof(struct table_value) * val_size, M_IPFW, 206 M_WAITOK | M_ZERO); 207 ipfw_objhash_bitmap_alloc(val_size, (void *)&new_idx, 208 &new_blocks); 209 210 IPFW_UH_WLOCK(ch); 211 212 /* 213 * Check if we still need to resize 214 */ 215 if (tcfg->val_size >= val_size) 216 goto done; 217 218 /* Update pointers and notify everyone we're changing @ch */ 219 pval = (struct table_value *)ch->valuestate; 220 rollback_toperation_state(ch, ch); 221 222 /* Good. Let's merge */ 223 memcpy(valuestate, pval, sizeof(struct table_value) * tcfg->val_size); 224 ipfw_objhash_bitmap_merge(CHAIN_TO_VI(ch), &new_idx, &new_blocks); 225 226 IPFW_WLOCK(ch); 227 /* Change pointers */ 228 old_valuestate = ch->valuestate; 229 ch->valuestate = valuestate; 230 valuestate = old_valuestate; 231 ipfw_objhash_bitmap_swap(CHAIN_TO_VI(ch), &new_idx, &new_blocks); 232 233 val_size_old = tcfg->val_size; 234 tcfg->val_size = val_size; 235 val_size = val_size_old; 236 IPFW_WUNLOCK(ch); 237 /* Update pointers to reflect resize */ 238 memset(&da, 0, sizeof(da)); 239 da.pval = (struct table_value *)ch->valuestate; 240 ipfw_objhash_foreach(vi, update_tvalue, &da); 241 242 done: 243 free(valuestate, M_IPFW); 244 ipfw_objhash_bitmap_free(new_idx, new_blocks); 245 246 return (0); 247 } 248 249 /* 250 * Drops reference for table value with index @kidx, stored in @pval and 251 * @vi. Frees value if it has no references. 252 */ 253 static void unref_table_value(struct namedobj_instance * vi,struct table_value * pval,uint32_t kidx)254 unref_table_value(struct namedobj_instance *vi, struct table_value *pval, 255 uint32_t kidx) 256 { 257 struct table_val_link *ptvl; 258 259 KASSERT(pval[kidx].refcnt > 0, ("Refcount is 0 on kidx %d", kidx)); 260 if (--pval[kidx].refcnt > 0) 261 return; 262 263 /* Last reference, delete item */ 264 ptvl = (struct table_val_link *)ipfw_objhash_lookup_kidx(vi, kidx); 265 KASSERT(ptvl != NULL, ("lookup on value kidx %d failed", kidx)); 266 ipfw_objhash_del(vi, &ptvl->no); 267 ipfw_objhash_free_idx(vi, kidx); 268 free(ptvl, M_IPFW); 269 } 270 271 struct flush_args { 272 struct ip_fw_chain *ch; 273 struct table_algo *ta; 274 struct table_info *ti; 275 void *astate; 276 ipfw_obj_tentry tent; 277 }; 278 279 static int unref_table_value_cb(void * e,void * arg)280 unref_table_value_cb(void *e, void *arg) 281 { 282 struct flush_args *fa; 283 struct ip_fw_chain *ch; 284 struct table_algo *ta; 285 ipfw_obj_tentry *tent; 286 int error; 287 288 fa = (struct flush_args *)arg; 289 290 ta = fa->ta; 291 memset(&fa->tent, 0, sizeof(fa->tent)); 292 tent = &fa->tent; 293 error = ta->dump_tentry(fa->astate, fa->ti, e, tent); 294 if (error != 0) 295 return (error); 296 297 ch = fa->ch; 298 299 unref_table_value(CHAIN_TO_VI(ch), 300 (struct table_value *)ch->valuestate, tent->v.kidx); 301 302 return (0); 303 } 304 305 /* 306 * Drop references for each value used in @tc. 307 */ 308 void ipfw_unref_table_values(struct ip_fw_chain * ch,struct table_config * tc,struct table_algo * ta,void * astate,struct table_info * ti)309 ipfw_unref_table_values(struct ip_fw_chain *ch, struct table_config *tc, 310 struct table_algo *ta, void *astate, struct table_info *ti) 311 { 312 struct flush_args fa; 313 314 IPFW_UH_WLOCK_ASSERT(ch); 315 316 memset(&fa, 0, sizeof(fa)); 317 fa.ch = ch; 318 fa.ta = ta; 319 fa.astate = astate; 320 fa.ti = ti; 321 322 ta->foreach(astate, ti, unref_table_value_cb, &fa); 323 } 324 325 /* 326 * Table operation state handler. 327 * Called when we are going to change something in @tc which 328 * may lead to inconsistencies in on-going table data addition. 329 * 330 * Here we rollback all already committed state (table values, currently) 331 * and set "modified" field to non-zero value to indicate 332 * that we need to restart original operation. 333 */ 334 void rollback_table_values(struct tableop_state * ts)335 rollback_table_values(struct tableop_state *ts) 336 { 337 struct ip_fw_chain *ch; 338 struct table_value *pval; 339 struct tentry_info *ptei; 340 struct namedobj_instance *vi; 341 int i; 342 343 ch = ts->ch; 344 345 IPFW_UH_WLOCK_ASSERT(ch); 346 347 /* Get current table value pointer */ 348 get_value_ptrs(ch, ts->tc, ts->vshared, &pval, &vi); 349 350 for (i = 0; i < ts->count; i++) { 351 ptei = &ts->tei[i]; 352 353 if (ptei->value == 0) 354 continue; 355 356 unref_table_value(vi, pval, ptei->value); 357 } 358 } 359 360 /* 361 * Allocate new value index in either shared or per-table array. 362 * Function may drop/reacquire UH lock. 363 * 364 * Returns 0 on success. 365 */ 366 static int alloc_table_vidx(struct ip_fw_chain * ch,struct tableop_state * ts,struct namedobj_instance * vi,uint32_t * pvidx,uint8_t flags)367 alloc_table_vidx(struct ip_fw_chain *ch, struct tableop_state *ts, 368 struct namedobj_instance *vi, uint32_t *pvidx, uint8_t flags) 369 { 370 int error, vlimit; 371 uint32_t vidx; 372 373 IPFW_UH_WLOCK_ASSERT(ch); 374 375 error = ipfw_objhash_alloc_idx(vi, &vidx); 376 if (error != 0) { 377 /* 378 * We need to resize array. This involves 379 * lock/unlock, so we need to check "modified" 380 * state. 381 */ 382 ts->opstate.func(ts->tc, &ts->opstate); 383 error = resize_shared_value_storage(ch); 384 return (error); /* ts->modified should be set, we will restart */ 385 } 386 387 vlimit = ts->ta->vlimit; 388 if (vlimit != 0 && vidx >= vlimit && !(flags & IPFW_CTF_ATOMIC)) { 389 /* 390 * Algorithm is not able to store given index. 391 * We have to rollback state, start using 392 * per-table value array or return error 393 * if we're already using it. 394 */ 395 if (ts->vshared != 0) { 396 /* shared -> per-table */ 397 return (ENOSPC); /* TODO: proper error */ 398 } 399 400 /* per-table. Fail for now. */ 401 return (ENOSPC); /* TODO: proper error */ 402 } 403 404 *pvidx = vidx; 405 return (0); 406 } 407 408 /* 409 * Drops value reference for unused values (updates, deletes, partially 410 * successful adds or rollbacks). 411 */ 412 void ipfw_garbage_table_values(struct ip_fw_chain * ch,struct table_config * tc,struct tentry_info * tei,uint32_t count,int rollback)413 ipfw_garbage_table_values(struct ip_fw_chain *ch, struct table_config *tc, 414 struct tentry_info *tei, uint32_t count, int rollback) 415 { 416 int i; 417 struct tentry_info *ptei; 418 struct table_value *pval; 419 struct namedobj_instance *vi; 420 421 /* 422 * We have two slightly different ADD cases here: 423 * either (1) we are successful / partially successful, 424 * in that case we need 425 * * to ignore ADDED entries values 426 * * rollback every other values if atomicity is not 427 * * required (either UPDATED since old value has been 428 * stored there, or some failure like EXISTS or LIMIT 429 * or simply "ignored" case. 430 * 431 * (2): atomic rollback of partially successful operation 432 * in that case we simply need to unref all entries. 433 * 434 * DELETE case is simpler: no atomic support there, so 435 * we simply unref all non-zero values. 436 */ 437 438 /* 439 * Get current table value pointers. 440 * XXX: Properly read vshared 441 */ 442 get_value_ptrs(ch, tc, 1, &pval, &vi); 443 444 for (i = 0; i < count; i++) { 445 ptei = &tei[i]; 446 447 if (ptei->value == 0) { 448 /* 449 * We may be deleting non-existing record. 450 * Skip. 451 */ 452 continue; 453 } 454 455 if ((ptei->flags & TEI_FLAGS_ADDED) != 0 && rollback == 0) { 456 ptei->value = 0; 457 continue; 458 } 459 460 unref_table_value(vi, pval, ptei->value); 461 ptei->value = 0; 462 } 463 } 464 465 /* 466 * Main function used to link values of entries going to be added, 467 * to the index. Since we may perform many UH locks drops/acquires, 468 * handle changes by checking tablestate "modified" field. 469 * 470 * Success: return 0. 471 */ 472 int ipfw_link_table_values(struct ip_fw_chain * ch,struct tableop_state * ts,uint8_t flags)473 ipfw_link_table_values(struct ip_fw_chain *ch, struct tableop_state *ts, 474 uint8_t flags) 475 { 476 int error, i, found; 477 struct namedobj_instance *vi; 478 struct table_config *tc; 479 struct tentry_info *tei, *ptei; 480 uint32_t count, vidx, vlimit; 481 struct table_val_link *ptv; 482 struct table_value tval, *pval; 483 484 /* 485 * Stage 1: reference all existing values and 486 * save their indices. 487 */ 488 IPFW_UH_WLOCK_ASSERT(ch); 489 get_value_ptrs(ch, ts->tc, ts->vshared, &pval, &vi); 490 491 error = 0; 492 found = 0; 493 vlimit = ts->ta->vlimit; 494 vidx = 0; 495 tc = ts->tc; 496 tei = ts->tei; 497 count = ts->count; 498 for (i = 0; i < count; i++) { 499 ptei = &tei[i]; 500 ptei->value = 0; /* Ensure value is always 0 in the beginning */ 501 mask_table_value(ptei->pvalue, &tval, ts->vmask); 502 ptv = (struct table_val_link *)ipfw_objhash_lookup_name(vi, 0, 503 (char *)&tval); 504 if (ptv == NULL) 505 continue; 506 /* Deal with vlimit later */ 507 if (vlimit > 0 && vlimit <= ptv->no.kidx) 508 continue; 509 510 /* Value found. Bump refcount */ 511 ptv->pval->refcnt++; 512 ptei->value = ptv->no.kidx; 513 found++; 514 } 515 516 if (ts->count == found) { 517 /* We've found all values , no need ts create new ones */ 518 return (0); 519 } 520 521 /* 522 * we have added some state here, let's attach operation 523 * state ts the list ts be able ts rollback if necessary. 524 */ 525 add_toperation_state(ch, ts); 526 /* Ensure table won't disappear */ 527 tc_ref(tc); 528 IPFW_UH_WUNLOCK(ch); 529 530 /* 531 * Stage 2: allocate objects for non-existing values. 532 */ 533 for (i = 0; i < count; i++) { 534 ptei = &tei[i]; 535 if (ptei->value != 0) 536 continue; 537 if (ptei->ptv != NULL) 538 continue; 539 ptei->ptv = malloc(sizeof(struct table_val_link), M_IPFW, 540 M_WAITOK | M_ZERO); 541 } 542 543 /* 544 * Stage 3: allocate index numbers for new values 545 * and link them to index. 546 */ 547 IPFW_UH_WLOCK(ch); 548 tc_unref(tc); 549 del_toperation_state(ch, ts); 550 if (ts->modified != 0) { 551 /* 552 * In general, we should free all state/indexes here 553 * and return. However, we keep allocated state instead 554 * to ensure we achieve some progress on each restart. 555 */ 556 return (0); 557 } 558 559 KASSERT(pval == ch->valuestate, ("resize_storage() notify failure")); 560 561 /* Let's try to link values */ 562 for (i = 0; i < count; i++) { 563 ptei = &tei[i]; 564 565 /* Check if record has appeared */ 566 mask_table_value(ptei->pvalue, &tval, ts->vmask); 567 ptv = (struct table_val_link *)ipfw_objhash_lookup_name(vi, 0, 568 (char *)&tval); 569 if (ptv != NULL) { 570 ptv->pval->refcnt++; 571 ptei->value = ptv->no.kidx; 572 continue; 573 } 574 575 /* May perform UH unlock/lock */ 576 error = alloc_table_vidx(ch, ts, vi, &vidx, flags); 577 if (error != 0) { 578 ts->opstate.func(ts->tc, &ts->opstate); 579 return (error); 580 } 581 /* value storage resize has happened, return */ 582 if (ts->modified != 0) 583 return (0); 584 585 /* Finally, we have allocated valid index, let's add entry */ 586 ptei->value = vidx; 587 ptv = (struct table_val_link *)ptei->ptv; 588 ptei->ptv = NULL; 589 590 ptv->no.kidx = vidx; 591 ptv->no.name = (char *)&pval[vidx]; 592 ptv->pval = &pval[vidx]; 593 memcpy(ptv->pval, &tval, sizeof(struct table_value)); 594 pval[vidx].refcnt = 1; 595 ipfw_objhash_add(vi, &ptv->no); 596 } 597 598 return (0); 599 } 600 601 /* 602 * Imports table value from current userland format. 603 * Saves value in kernel format to the same place. 604 */ 605 void ipfw_import_table_value_v1(ipfw_table_value * iv)606 ipfw_import_table_value_v1(ipfw_table_value *iv) 607 { 608 struct table_value v; 609 610 memset(&v, 0, sizeof(v)); 611 v.tag = iv->tag; 612 v.pipe = iv->pipe; 613 v.divert = iv->divert; 614 v.skipto = iv->skipto; 615 v.netgraph = iv->netgraph; 616 v.fib = iv->fib; 617 v.nat = iv->nat; 618 v.dscp = iv->dscp; 619 v.nh4 = iv->nh4; 620 v.nh6 = iv->nh6; 621 v.limit = iv->limit; 622 v.zoneid = iv->zoneid; 623 v.mark = iv->mark; 624 625 memcpy(iv, &v, sizeof(ipfw_table_value)); 626 } 627 628 /* 629 * Export real table value @v to current userland format. 630 * Note that @v and @piv may point to the same memory. 631 */ 632 void ipfw_export_table_value_v1(struct table_value * v,ipfw_table_value * piv)633 ipfw_export_table_value_v1(struct table_value *v, ipfw_table_value *piv) 634 { 635 ipfw_table_value iv; 636 637 memset(&iv, 0, sizeof(iv)); 638 iv.tag = v->tag; 639 iv.pipe = v->pipe; 640 iv.divert = v->divert; 641 iv.skipto = v->skipto; 642 iv.netgraph = v->netgraph; 643 iv.fib = v->fib; 644 iv.nat = v->nat; 645 iv.dscp = v->dscp; 646 iv.limit = v->limit; 647 iv.nh4 = v->nh4; 648 iv.nh6 = v->nh6; 649 iv.zoneid = v->zoneid; 650 iv.mark = v->mark; 651 652 memcpy(piv, &iv, sizeof(iv)); 653 } 654 655 /* 656 * Exports real value data into ipfw_table_value structure including refcnt. 657 */ 658 static int dump_tvalue(struct namedobj_instance * ni,struct named_object * no,void * arg)659 dump_tvalue(struct namedobj_instance *ni, struct named_object *no, void *arg) 660 { 661 struct vdump_args *da; 662 struct table_val_link *ptv; 663 ipfw_table_value *v; 664 665 da = (struct vdump_args *)arg; 666 ptv = (struct table_val_link *)no; 667 668 v = (ipfw_table_value *)ipfw_get_sopt_space(da->sd, sizeof(*v)); 669 /* Out of memory, returning */ 670 if (v == NULL) { 671 da->error = ENOMEM; 672 return (ENOMEM); 673 } 674 675 ipfw_export_table_value_v1(ptv->pval, v); 676 v->refcnt = ptv->pval->refcnt; 677 v->kidx = ptv->no.kidx; 678 return (0); 679 } 680 681 /* 682 * Dumps all shared/table value data 683 * Data layout (v1)(current): 684 * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size 685 * Reply: [ ipfw_obj_lheader ipfw_table_value x N ] 686 * 687 * Returns 0 on success 688 */ 689 static int list_table_values(struct ip_fw_chain * ch,ip_fw3_opheader * op3,struct sockopt_data * sd)690 list_table_values(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 691 struct sockopt_data *sd) 692 { 693 struct _ipfw_obj_lheader *olh; 694 struct namedobj_instance *vi; 695 struct vdump_args da; 696 uint32_t count, size; 697 698 olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh)); 699 if (olh == NULL) 700 return (EINVAL); 701 if (sd->valsize < olh->size) 702 return (EINVAL); 703 704 IPFW_UH_RLOCK(ch); 705 vi = CHAIN_TO_VI(ch); 706 707 count = ipfw_objhash_count(vi); 708 size = count * sizeof(ipfw_table_value) + sizeof(ipfw_obj_lheader); 709 710 /* Fill in header regadless of buffer size */ 711 olh->count = count; 712 olh->objsize = sizeof(ipfw_table_value); 713 714 if (size > olh->size) { 715 olh->size = size; 716 IPFW_UH_RUNLOCK(ch); 717 return (ENOMEM); 718 } 719 olh->size = size; 720 721 /* 722 * Do the actual value dump 723 */ 724 memset(&da, 0, sizeof(da)); 725 da.ch = ch; 726 da.sd = sd; 727 ipfw_objhash_foreach(vi, dump_tvalue, &da); 728 729 IPFW_UH_RUNLOCK(ch); 730 731 return (0); 732 } 733 734 void ipfw_table_value_init(struct ip_fw_chain * ch,int first)735 ipfw_table_value_init(struct ip_fw_chain *ch, int first) 736 { 737 struct tables_config *tcfg; 738 739 ch->valuestate = malloc(VALDATA_START_SIZE * sizeof(struct table_value), 740 M_IPFW, M_WAITOK | M_ZERO); 741 742 tcfg = ch->tblcfg; 743 744 tcfg->val_size = VALDATA_START_SIZE; 745 tcfg->valhash = ipfw_objhash_create(tcfg->val_size, VALDATA_HASH_SIZE); 746 ipfw_objhash_set_funcs(tcfg->valhash, hash_table_value, 747 cmp_table_value); 748 749 IPFW_ADD_SOPT_HANDLER(first, scodes); 750 } 751 752 static int destroy_value(struct namedobj_instance * ni,struct named_object * no,void * arg)753 destroy_value(struct namedobj_instance *ni, struct named_object *no, 754 void *arg) 755 { 756 757 free(no, M_IPFW); 758 return (0); 759 } 760 761 void ipfw_table_value_destroy(struct ip_fw_chain * ch,int last)762 ipfw_table_value_destroy(struct ip_fw_chain *ch, int last) 763 { 764 765 IPFW_DEL_SOPT_HANDLER(last, scodes); 766 767 free(ch->valuestate, M_IPFW); 768 ipfw_objhash_foreach(CHAIN_TO_VI(ch), destroy_value, ch); 769 ipfw_objhash_destroy(CHAIN_TO_VI(ch)); 770 } 771