xref: /freebsd/sys/netpfil/ipfw/ip_fw_sockopt.c (revision 5956d97f4b3204318ceb6aa9c77bd0bc6ea87a41)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright (c) 2002-2009 Luigi Rizzo, Universita` di Pisa
5  * Copyright (c) 2014 Yandex LLC
6  * Copyright (c) 2014 Alexander V. Chernikov
7  *
8  * Supported by: Valeria Paoli
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  */
31 
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD$");
34 
35 /*
36  * Control socket and rule management routines for ipfw.
37  * Control is currently implemented via IP_FW3 setsockopt() code.
38  */
39 
40 #include "opt_ipfw.h"
41 #include "opt_inet.h"
42 #ifndef INET
43 #error IPFIREWALL requires INET.
44 #endif /* INET */
45 #include "opt_inet6.h"
46 
47 #include <sys/param.h>
48 #include <sys/systm.h>
49 #include <sys/malloc.h>
50 #include <sys/mbuf.h>	/* struct m_tag used by nested headers */
51 #include <sys/kernel.h>
52 #include <sys/lock.h>
53 #include <sys/priv.h>
54 #include <sys/proc.h>
55 #include <sys/rwlock.h>
56 #include <sys/rmlock.h>
57 #include <sys/socket.h>
58 #include <sys/socketvar.h>
59 #include <sys/sysctl.h>
60 #include <sys/syslog.h>
61 #include <sys/fnv_hash.h>
62 #include <net/if.h>
63 #include <net/route.h>
64 #include <net/vnet.h>
65 #include <vm/vm.h>
66 #include <vm/vm_extern.h>
67 
68 #include <netinet/in.h>
69 #include <netinet/ip_var.h> /* hooks */
70 #include <netinet/ip_fw.h>
71 
72 #include <netpfil/ipfw/ip_fw_private.h>
73 #include <netpfil/ipfw/ip_fw_table.h>
74 
75 #ifdef MAC
76 #include <security/mac/mac_framework.h>
77 #endif
78 
79 static int ipfw_ctl(struct sockopt *sopt);
80 static int check_ipfw_rule_body(ipfw_insn *cmd, int cmd_len,
81     struct rule_check_info *ci);
82 static int check_ipfw_rule1(struct ip_fw_rule *rule, int size,
83     struct rule_check_info *ci);
84 static int check_ipfw_rule0(struct ip_fw_rule0 *rule, int size,
85     struct rule_check_info *ci);
86 static int rewrite_rule_uidx(struct ip_fw_chain *chain,
87     struct rule_check_info *ci);
88 
89 #define	NAMEDOBJ_HASH_SIZE	32
90 
91 struct namedobj_instance {
92 	struct namedobjects_head	*names;
93 	struct namedobjects_head	*values;
94 	uint32_t nn_size;		/* names hash size */
95 	uint32_t nv_size;		/* number hash size */
96 	u_long *idx_mask;		/* used items bitmask */
97 	uint32_t max_blocks;		/* number of "long" blocks in bitmask */
98 	uint32_t count;			/* number of items */
99 	uint16_t free_off[IPFW_MAX_SETS];	/* first possible free offset */
100 	objhash_hash_f	*hash_f;
101 	objhash_cmp_f	*cmp_f;
102 };
103 #define	BLOCK_ITEMS	(8 * sizeof(u_long))	/* Number of items for ffsl() */
104 
105 static uint32_t objhash_hash_name(struct namedobj_instance *ni,
106     const void *key, uint32_t kopt);
107 static uint32_t objhash_hash_idx(struct namedobj_instance *ni, uint32_t val);
108 static int objhash_cmp_name(struct named_object *no, const void *name,
109     uint32_t set);
110 
111 MALLOC_DEFINE(M_IPFW, "IpFw/IpAcct", "IpFw/IpAcct chain's");
112 
113 static int dump_config(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
114     struct sockopt_data *sd);
115 static int add_rules(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
116     struct sockopt_data *sd);
117 static int del_rules(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
118     struct sockopt_data *sd);
119 static int clear_rules(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
120     struct sockopt_data *sd);
121 static int move_rules(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
122     struct sockopt_data *sd);
123 static int manage_sets(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
124     struct sockopt_data *sd);
125 static int dump_soptcodes(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
126     struct sockopt_data *sd);
127 static int dump_srvobjects(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
128     struct sockopt_data *sd);
129 
130 /* ctl3 handler data */
131 struct mtx ctl3_lock;
132 #define	CTL3_LOCK_INIT()	mtx_init(&ctl3_lock, "ctl3_lock", NULL, MTX_DEF)
133 #define	CTL3_LOCK_DESTROY()	mtx_destroy(&ctl3_lock)
134 #define	CTL3_LOCK()		mtx_lock(&ctl3_lock)
135 #define	CTL3_UNLOCK()		mtx_unlock(&ctl3_lock)
136 
137 static struct ipfw_sopt_handler *ctl3_handlers;
138 static size_t ctl3_hsize;
139 static uint64_t ctl3_refct, ctl3_gencnt;
140 #define	CTL3_SMALLBUF	4096			/* small page-size write buffer */
141 #define	CTL3_LARGEBUF	16 * 1024 * 1024	/* handle large rulesets */
142 
143 static int ipfw_flush_sopt_data(struct sockopt_data *sd);
144 
145 static struct ipfw_sopt_handler	scodes[] = {
146 	{ IP_FW_XGET,		0,	HDIR_GET,	dump_config },
147 	{ IP_FW_XADD,		0,	HDIR_BOTH,	add_rules },
148 	{ IP_FW_XDEL,		0,	HDIR_BOTH,	del_rules },
149 	{ IP_FW_XZERO,		0,	HDIR_SET,	clear_rules },
150 	{ IP_FW_XRESETLOG,	0,	HDIR_SET,	clear_rules },
151 	{ IP_FW_XMOVE,		0,	HDIR_SET,	move_rules },
152 	{ IP_FW_SET_SWAP,	0,	HDIR_SET,	manage_sets },
153 	{ IP_FW_SET_MOVE,	0,	HDIR_SET,	manage_sets },
154 	{ IP_FW_SET_ENABLE,	0,	HDIR_SET,	manage_sets },
155 	{ IP_FW_DUMP_SOPTCODES,	0,	HDIR_GET,	dump_soptcodes },
156 	{ IP_FW_DUMP_SRVOBJECTS,0,	HDIR_GET,	dump_srvobjects },
157 };
158 
159 static int
160 set_legacy_obj_kidx(struct ip_fw_chain *ch, struct ip_fw_rule0 *rule);
161 static struct opcode_obj_rewrite *find_op_rw(ipfw_insn *cmd,
162     uint16_t *puidx, uint8_t *ptype);
163 static int ref_rule_objects(struct ip_fw_chain *ch, struct ip_fw *rule,
164     struct rule_check_info *ci, struct obj_idx *oib, struct tid_info *ti);
165 static int ref_opcode_object(struct ip_fw_chain *ch, ipfw_insn *cmd,
166     struct tid_info *ti, struct obj_idx *pidx, int *unresolved);
167 static void unref_rule_objects(struct ip_fw_chain *chain, struct ip_fw *rule);
168 static void unref_oib_objects(struct ip_fw_chain *ch, ipfw_insn *cmd,
169     struct obj_idx *oib, struct obj_idx *end);
170 static int export_objhash_ntlv(struct namedobj_instance *ni, uint16_t kidx,
171     struct sockopt_data *sd);
172 
173 /*
174  * Opcode object rewriter variables
175  */
176 struct opcode_obj_rewrite *ctl3_rewriters;
177 static size_t ctl3_rsize;
178 
179 /*
180  * static variables followed by global ones
181  */
182 
183 VNET_DEFINE_STATIC(uma_zone_t, ipfw_cntr_zone);
184 #define	V_ipfw_cntr_zone		VNET(ipfw_cntr_zone)
185 
186 void
187 ipfw_init_counters(void)
188 {
189 
190 	V_ipfw_cntr_zone = uma_zcreate("IPFW counters",
191 	    IPFW_RULE_CNTR_SIZE, NULL, NULL, NULL, NULL,
192 	    UMA_ALIGN_PTR, UMA_ZONE_PCPU);
193 }
194 
195 void
196 ipfw_destroy_counters(void)
197 {
198 
199 	uma_zdestroy(V_ipfw_cntr_zone);
200 }
201 
202 struct ip_fw *
203 ipfw_alloc_rule(struct ip_fw_chain *chain, size_t rulesize)
204 {
205 	struct ip_fw *rule;
206 
207 	rule = malloc(rulesize, M_IPFW, M_WAITOK | M_ZERO);
208 	rule->cntr = uma_zalloc_pcpu(V_ipfw_cntr_zone, M_WAITOK | M_ZERO);
209 	rule->refcnt = 1;
210 
211 	return (rule);
212 }
213 
214 void
215 ipfw_free_rule(struct ip_fw *rule)
216 {
217 
218 	/*
219 	 * We don't release refcnt here, since this function
220 	 * can be called without any locks held. The caller
221 	 * must release reference under IPFW_UH_WLOCK, and then
222 	 * call this function if refcount becomes 1.
223 	 */
224 	if (rule->refcnt > 1)
225 		return;
226 	uma_zfree_pcpu(V_ipfw_cntr_zone, rule->cntr);
227 	free(rule, M_IPFW);
228 }
229 
230 /*
231  * Find the smallest rule >= key, id.
232  * We could use bsearch but it is so simple that we code it directly
233  */
234 int
235 ipfw_find_rule(struct ip_fw_chain *chain, uint32_t key, uint32_t id)
236 {
237 	int i, lo, hi;
238 	struct ip_fw *r;
239 
240   	for (lo = 0, hi = chain->n_rules - 1; lo < hi;) {
241 		i = (lo + hi) / 2;
242 		r = chain->map[i];
243 		if (r->rulenum < key)
244 			lo = i + 1;	/* continue from the next one */
245 		else if (r->rulenum > key)
246 			hi = i;		/* this might be good */
247 		else if (r->id < id)
248 			lo = i + 1;	/* continue from the next one */
249 		else /* r->id >= id */
250 			hi = i;		/* this might be good */
251 	}
252 	return hi;
253 }
254 
255 /*
256  * Builds skipto cache on rule set @map.
257  */
258 static void
259 update_skipto_cache(struct ip_fw_chain *chain, struct ip_fw **map)
260 {
261 	int *smap, rulenum;
262 	int i, mi;
263 
264 	IPFW_UH_WLOCK_ASSERT(chain);
265 
266 	mi = 0;
267 	rulenum = map[mi]->rulenum;
268 	smap = chain->idxmap_back;
269 
270 	if (smap == NULL)
271 		return;
272 
273 	for (i = 0; i < 65536; i++) {
274 		smap[i] = mi;
275 		/* Use the same rule index until i < rulenum */
276 		if (i != rulenum || i == 65535)
277 			continue;
278 		/* Find next rule with num > i */
279 		rulenum = map[++mi]->rulenum;
280 		while (rulenum == i)
281 			rulenum = map[++mi]->rulenum;
282 	}
283 }
284 
285 /*
286  * Swaps prepared (backup) index with current one.
287  */
288 static void
289 swap_skipto_cache(struct ip_fw_chain *chain)
290 {
291 	int *map;
292 
293 	IPFW_UH_WLOCK_ASSERT(chain);
294 	IPFW_WLOCK_ASSERT(chain);
295 
296 	map = chain->idxmap;
297 	chain->idxmap = chain->idxmap_back;
298 	chain->idxmap_back = map;
299 }
300 
301 /*
302  * Allocate and initialize skipto cache.
303  */
304 void
305 ipfw_init_skipto_cache(struct ip_fw_chain *chain)
306 {
307 	int *idxmap, *idxmap_back;
308 
309 	idxmap = malloc(65536 * sizeof(int), M_IPFW, M_WAITOK | M_ZERO);
310 	idxmap_back = malloc(65536 * sizeof(int), M_IPFW, M_WAITOK);
311 
312 	/*
313 	 * Note we may be called at any time after initialization,
314 	 * for example, on first skipto rule, so we need to
315 	 * provide valid chain->idxmap on return
316 	 */
317 
318 	IPFW_UH_WLOCK(chain);
319 	if (chain->idxmap != NULL) {
320 		IPFW_UH_WUNLOCK(chain);
321 		free(idxmap, M_IPFW);
322 		free(idxmap_back, M_IPFW);
323 		return;
324 	}
325 
326 	/* Set backup pointer first to permit building cache */
327 	chain->idxmap_back = idxmap_back;
328 	update_skipto_cache(chain, chain->map);
329 	IPFW_WLOCK(chain);
330 	/* It is now safe to set chain->idxmap ptr */
331 	chain->idxmap = idxmap;
332 	swap_skipto_cache(chain);
333 	IPFW_WUNLOCK(chain);
334 	IPFW_UH_WUNLOCK(chain);
335 }
336 
337 /*
338  * Destroys skipto cache.
339  */
340 void
341 ipfw_destroy_skipto_cache(struct ip_fw_chain *chain)
342 {
343 
344 	if (chain->idxmap != NULL)
345 		free(chain->idxmap, M_IPFW);
346 	if (chain->idxmap != NULL)
347 		free(chain->idxmap_back, M_IPFW);
348 }
349 
350 /*
351  * allocate a new map, returns the chain locked. extra is the number
352  * of entries to add or delete.
353  */
354 static struct ip_fw **
355 get_map(struct ip_fw_chain *chain, int extra, int locked)
356 {
357 
358 	for (;;) {
359 		struct ip_fw **map;
360 		u_int i, mflags;
361 
362 		mflags = M_ZERO | ((locked != 0) ? M_NOWAIT : M_WAITOK);
363 
364 		i = chain->n_rules + extra;
365 		map = malloc(i * sizeof(struct ip_fw *), M_IPFW, mflags);
366 		if (map == NULL) {
367 			printf("%s: cannot allocate map\n", __FUNCTION__);
368 			return NULL;
369 		}
370 		if (!locked)
371 			IPFW_UH_WLOCK(chain);
372 		if (i >= chain->n_rules + extra) /* good */
373 			return map;
374 		/* otherwise we lost the race, free and retry */
375 		if (!locked)
376 			IPFW_UH_WUNLOCK(chain);
377 		free(map, M_IPFW);
378 	}
379 }
380 
381 /*
382  * swap the maps. It is supposed to be called with IPFW_UH_WLOCK
383  */
384 static struct ip_fw **
385 swap_map(struct ip_fw_chain *chain, struct ip_fw **new_map, int new_len)
386 {
387 	struct ip_fw **old_map;
388 
389 	IPFW_WLOCK(chain);
390 	chain->id++;
391 	chain->n_rules = new_len;
392 	old_map = chain->map;
393 	chain->map = new_map;
394 	swap_skipto_cache(chain);
395 	IPFW_WUNLOCK(chain);
396 	return old_map;
397 }
398 
399 static void
400 export_cntr1_base(struct ip_fw *krule, struct ip_fw_bcounter *cntr)
401 {
402 	struct timeval boottime;
403 
404 	cntr->size = sizeof(*cntr);
405 
406 	if (krule->cntr != NULL) {
407 		cntr->pcnt = counter_u64_fetch(krule->cntr);
408 		cntr->bcnt = counter_u64_fetch(krule->cntr + 1);
409 		cntr->timestamp = krule->timestamp;
410 	}
411 	if (cntr->timestamp > 0) {
412 		getboottime(&boottime);
413 		cntr->timestamp += boottime.tv_sec;
414 	}
415 }
416 
417 static void
418 export_cntr0_base(struct ip_fw *krule, struct ip_fw_bcounter0 *cntr)
419 {
420 	struct timeval boottime;
421 
422 	if (krule->cntr != NULL) {
423 		cntr->pcnt = counter_u64_fetch(krule->cntr);
424 		cntr->bcnt = counter_u64_fetch(krule->cntr + 1);
425 		cntr->timestamp = krule->timestamp;
426 	}
427 	if (cntr->timestamp > 0) {
428 		getboottime(&boottime);
429 		cntr->timestamp += boottime.tv_sec;
430 	}
431 }
432 
433 /*
434  * Copies rule @urule from v1 userland format (current).
435  * to kernel @krule.
436  * Assume @krule is zeroed.
437  */
438 static void
439 import_rule1(struct rule_check_info *ci)
440 {
441 	struct ip_fw_rule *urule;
442 	struct ip_fw *krule;
443 
444 	urule = (struct ip_fw_rule *)ci->urule;
445 	krule = (struct ip_fw *)ci->krule;
446 
447 	/* copy header */
448 	krule->act_ofs = urule->act_ofs;
449 	krule->cmd_len = urule->cmd_len;
450 	krule->rulenum = urule->rulenum;
451 	krule->set = urule->set;
452 	krule->flags = urule->flags;
453 
454 	/* Save rulenum offset */
455 	ci->urule_numoff = offsetof(struct ip_fw_rule, rulenum);
456 
457 	/* Copy opcodes */
458 	memcpy(krule->cmd, urule->cmd, krule->cmd_len * sizeof(uint32_t));
459 }
460 
461 /*
462  * Export rule into v1 format (Current).
463  * Layout:
464  * [ ipfw_obj_tlv(IPFW_TLV_RULE_ENT)
465  *     [ ip_fw_rule ] OR
466  *     [ ip_fw_bcounter ip_fw_rule] (depends on rcntrs).
467  * ]
468  * Assume @data is zeroed.
469  */
470 static void
471 export_rule1(struct ip_fw *krule, caddr_t data, int len, int rcntrs)
472 {
473 	struct ip_fw_bcounter *cntr;
474 	struct ip_fw_rule *urule;
475 	ipfw_obj_tlv *tlv;
476 
477 	/* Fill in TLV header */
478 	tlv = (ipfw_obj_tlv *)data;
479 	tlv->type = IPFW_TLV_RULE_ENT;
480 	tlv->length = len;
481 
482 	if (rcntrs != 0) {
483 		/* Copy counters */
484 		cntr = (struct ip_fw_bcounter *)(tlv + 1);
485 		urule = (struct ip_fw_rule *)(cntr + 1);
486 		export_cntr1_base(krule, cntr);
487 	} else
488 		urule = (struct ip_fw_rule *)(tlv + 1);
489 
490 	/* copy header */
491 	urule->act_ofs = krule->act_ofs;
492 	urule->cmd_len = krule->cmd_len;
493 	urule->rulenum = krule->rulenum;
494 	urule->set = krule->set;
495 	urule->flags = krule->flags;
496 	urule->id = krule->id;
497 
498 	/* Copy opcodes */
499 	memcpy(urule->cmd, krule->cmd, krule->cmd_len * sizeof(uint32_t));
500 }
501 
502 /*
503  * Copies rule @urule from FreeBSD8 userland format (v0)
504  * to kernel @krule.
505  * Assume @krule is zeroed.
506  */
507 static void
508 import_rule0(struct rule_check_info *ci)
509 {
510 	struct ip_fw_rule0 *urule;
511 	struct ip_fw *krule;
512 	int cmdlen, l;
513 	ipfw_insn *cmd;
514 	ipfw_insn_limit *lcmd;
515 	ipfw_insn_if *cmdif;
516 
517 	urule = (struct ip_fw_rule0 *)ci->urule;
518 	krule = (struct ip_fw *)ci->krule;
519 
520 	/* copy header */
521 	krule->act_ofs = urule->act_ofs;
522 	krule->cmd_len = urule->cmd_len;
523 	krule->rulenum = urule->rulenum;
524 	krule->set = urule->set;
525 	if ((urule->_pad & 1) != 0)
526 		krule->flags |= IPFW_RULE_NOOPT;
527 
528 	/* Save rulenum offset */
529 	ci->urule_numoff = offsetof(struct ip_fw_rule0, rulenum);
530 
531 	/* Copy opcodes */
532 	memcpy(krule->cmd, urule->cmd, krule->cmd_len * sizeof(uint32_t));
533 
534 	/*
535 	 * Alter opcodes:
536 	 * 1) convert tablearg value from 65535 to 0
537 	 * 2) Add high bit to O_SETFIB/O_SETDSCP values (to make room
538 	 *    for targ).
539 	 * 3) convert table number in iface opcodes to u16
540 	 * 4) convert old `nat global` into new 65535
541 	 */
542 	l = krule->cmd_len;
543 	cmd = krule->cmd;
544 	cmdlen = 0;
545 
546 	for ( ;	l > 0 ; l -= cmdlen, cmd += cmdlen) {
547 		cmdlen = F_LEN(cmd);
548 
549 		switch (cmd->opcode) {
550 		/* Opcodes supporting tablearg */
551 		case O_TAG:
552 		case O_TAGGED:
553 		case O_PIPE:
554 		case O_QUEUE:
555 		case O_DIVERT:
556 		case O_TEE:
557 		case O_SKIPTO:
558 		case O_CALLRETURN:
559 		case O_NETGRAPH:
560 		case O_NGTEE:
561 		case O_NAT:
562 			if (cmd->arg1 == IP_FW_TABLEARG)
563 				cmd->arg1 = IP_FW_TARG;
564 			else if (cmd->arg1 == 0)
565 				cmd->arg1 = IP_FW_NAT44_GLOBAL;
566 			break;
567 		case O_SETFIB:
568 		case O_SETDSCP:
569 			if (cmd->arg1 == IP_FW_TABLEARG)
570 				cmd->arg1 = IP_FW_TARG;
571 			else
572 				cmd->arg1 |= 0x8000;
573 			break;
574 		case O_LIMIT:
575 			lcmd = (ipfw_insn_limit *)cmd;
576 			if (lcmd->conn_limit == IP_FW_TABLEARG)
577 				lcmd->conn_limit = IP_FW_TARG;
578 			break;
579 		/* Interface tables */
580 		case O_XMIT:
581 		case O_RECV:
582 		case O_VIA:
583 			/* Interface table, possibly */
584 			cmdif = (ipfw_insn_if *)cmd;
585 			if (cmdif->name[0] != '\1')
586 				break;
587 
588 			cmdif->p.kidx = (uint16_t)cmdif->p.glob;
589 			break;
590 		}
591 	}
592 }
593 
594 /*
595  * Copies rule @krule from kernel to FreeBSD8 userland format (v0)
596  */
597 static void
598 export_rule0(struct ip_fw *krule, struct ip_fw_rule0 *urule, int len)
599 {
600 	int cmdlen, l;
601 	ipfw_insn *cmd;
602 	ipfw_insn_limit *lcmd;
603 	ipfw_insn_if *cmdif;
604 
605 	/* copy header */
606 	memset(urule, 0, len);
607 	urule->act_ofs = krule->act_ofs;
608 	urule->cmd_len = krule->cmd_len;
609 	urule->rulenum = krule->rulenum;
610 	urule->set = krule->set;
611 	if ((krule->flags & IPFW_RULE_NOOPT) != 0)
612 		urule->_pad |= 1;
613 
614 	/* Copy opcodes */
615 	memcpy(urule->cmd, krule->cmd, krule->cmd_len * sizeof(uint32_t));
616 
617 	/* Export counters */
618 	export_cntr0_base(krule, (struct ip_fw_bcounter0 *)&urule->pcnt);
619 
620 	/*
621 	 * Alter opcodes:
622 	 * 1) convert tablearg value from 0 to 65535
623 	 * 2) Remove highest bit from O_SETFIB/O_SETDSCP values.
624 	 * 3) convert table number in iface opcodes to int
625 	 */
626 	l = urule->cmd_len;
627 	cmd = urule->cmd;
628 	cmdlen = 0;
629 
630 	for ( ;	l > 0 ; l -= cmdlen, cmd += cmdlen) {
631 		cmdlen = F_LEN(cmd);
632 
633 		switch (cmd->opcode) {
634 		/* Opcodes supporting tablearg */
635 		case O_TAG:
636 		case O_TAGGED:
637 		case O_PIPE:
638 		case O_QUEUE:
639 		case O_DIVERT:
640 		case O_TEE:
641 		case O_SKIPTO:
642 		case O_CALLRETURN:
643 		case O_NETGRAPH:
644 		case O_NGTEE:
645 		case O_NAT:
646 			if (cmd->arg1 == IP_FW_TARG)
647 				cmd->arg1 = IP_FW_TABLEARG;
648 			else if (cmd->arg1 == IP_FW_NAT44_GLOBAL)
649 				cmd->arg1 = 0;
650 			break;
651 		case O_SETFIB:
652 		case O_SETDSCP:
653 			if (cmd->arg1 == IP_FW_TARG)
654 				cmd->arg1 = IP_FW_TABLEARG;
655 			else
656 				cmd->arg1 &= ~0x8000;
657 			break;
658 		case O_LIMIT:
659 			lcmd = (ipfw_insn_limit *)cmd;
660 			if (lcmd->conn_limit == IP_FW_TARG)
661 				lcmd->conn_limit = IP_FW_TABLEARG;
662 			break;
663 		/* Interface tables */
664 		case O_XMIT:
665 		case O_RECV:
666 		case O_VIA:
667 			/* Interface table, possibly */
668 			cmdif = (ipfw_insn_if *)cmd;
669 			if (cmdif->name[0] != '\1')
670 				break;
671 
672 			cmdif->p.glob = cmdif->p.kidx;
673 			break;
674 		}
675 	}
676 }
677 
678 /*
679  * Add new rule(s) to the list possibly creating rule number for each.
680  * Update the rule_number in the input struct so the caller knows it as well.
681  * Must be called without IPFW_UH held
682  */
683 static int
684 commit_rules(struct ip_fw_chain *chain, struct rule_check_info *rci, int count)
685 {
686 	int error, i, insert_before, tcount;
687 	uint16_t rulenum, *pnum;
688 	struct rule_check_info *ci;
689 	struct ip_fw *krule;
690 	struct ip_fw **map;	/* the new array of pointers */
691 
692 	/* Check if we need to do table/obj index remap */
693 	tcount = 0;
694 	for (ci = rci, i = 0; i < count; ci++, i++) {
695 		if (ci->object_opcodes == 0)
696 			continue;
697 
698 		/*
699 		 * Rule has some object opcodes.
700 		 * We need to find (and create non-existing)
701 		 * kernel objects, and reference existing ones.
702 		 */
703 		error = rewrite_rule_uidx(chain, ci);
704 		if (error != 0) {
705 			/*
706 			 * rewrite failed, state for current rule
707 			 * has been reverted. Check if we need to
708 			 * revert more.
709 			 */
710 			if (tcount > 0) {
711 				/*
712 				 * We have some more table rules
713 				 * we need to rollback.
714 				 */
715 
716 				IPFW_UH_WLOCK(chain);
717 				while (ci != rci) {
718 					ci--;
719 					if (ci->object_opcodes == 0)
720 						continue;
721 					unref_rule_objects(chain,ci->krule);
722 				}
723 				IPFW_UH_WUNLOCK(chain);
724 			}
725 
726 			return (error);
727 		}
728 
729 		tcount++;
730 	}
731 
732 	/* get_map returns with IPFW_UH_WLOCK if successful */
733 	map = get_map(chain, count, 0 /* not locked */);
734 	if (map == NULL) {
735 		if (tcount > 0) {
736 			/* Unbind tables */
737 			IPFW_UH_WLOCK(chain);
738 			for (ci = rci, i = 0; i < count; ci++, i++) {
739 				if (ci->object_opcodes == 0)
740 					continue;
741 
742 				unref_rule_objects(chain, ci->krule);
743 			}
744 			IPFW_UH_WUNLOCK(chain);
745 		}
746 
747 		return (ENOSPC);
748 	}
749 
750 	if (V_autoinc_step < 1)
751 		V_autoinc_step = 1;
752 	else if (V_autoinc_step > 1000)
753 		V_autoinc_step = 1000;
754 
755 	/* FIXME: Handle count > 1 */
756 	ci = rci;
757 	krule = ci->krule;
758 	rulenum = krule->rulenum;
759 
760 	/* find the insertion point, we will insert before */
761 	insert_before = rulenum ? rulenum + 1 : IPFW_DEFAULT_RULE;
762 	i = ipfw_find_rule(chain, insert_before, 0);
763 	/* duplicate first part */
764 	if (i > 0)
765 		bcopy(chain->map, map, i * sizeof(struct ip_fw *));
766 	map[i] = krule;
767 	/* duplicate remaining part, we always have the default rule */
768 	bcopy(chain->map + i, map + i + 1,
769 		sizeof(struct ip_fw *) *(chain->n_rules - i));
770 	if (rulenum == 0) {
771 		/* Compute rule number and write it back */
772 		rulenum = i > 0 ? map[i-1]->rulenum : 0;
773 		if (rulenum < IPFW_DEFAULT_RULE - V_autoinc_step)
774 			rulenum += V_autoinc_step;
775 		krule->rulenum = rulenum;
776 		/* Save number to userland rule */
777 		pnum = (uint16_t *)((caddr_t)ci->urule + ci->urule_numoff);
778 		*pnum = rulenum;
779 	}
780 
781 	krule->id = chain->id + 1;
782 	update_skipto_cache(chain, map);
783 	map = swap_map(chain, map, chain->n_rules + 1);
784 	chain->static_len += RULEUSIZE0(krule);
785 	IPFW_UH_WUNLOCK(chain);
786 	if (map)
787 		free(map, M_IPFW);
788 	return (0);
789 }
790 
791 int
792 ipfw_add_protected_rule(struct ip_fw_chain *chain, struct ip_fw *rule,
793     int locked)
794 {
795 	struct ip_fw **map;
796 
797 	map = get_map(chain, 1, locked);
798 	if (map == NULL)
799 		return (ENOMEM);
800 	if (chain->n_rules > 0)
801 		bcopy(chain->map, map,
802 		    chain->n_rules * sizeof(struct ip_fw *));
803 	map[chain->n_rules] = rule;
804 	rule->rulenum = IPFW_DEFAULT_RULE;
805 	rule->set = RESVD_SET;
806 	rule->id = chain->id + 1;
807 	/* We add rule in the end of chain, no need to update skipto cache */
808 	map = swap_map(chain, map, chain->n_rules + 1);
809 	chain->static_len += RULEUSIZE0(rule);
810 	IPFW_UH_WUNLOCK(chain);
811 	free(map, M_IPFW);
812 	return (0);
813 }
814 
815 /*
816  * Adds @rule to the list of rules to reap
817  */
818 void
819 ipfw_reap_add(struct ip_fw_chain *chain, struct ip_fw **head,
820     struct ip_fw *rule)
821 {
822 
823 	IPFW_UH_WLOCK_ASSERT(chain);
824 
825 	/* Unlink rule from everywhere */
826 	unref_rule_objects(chain, rule);
827 
828 	rule->next = *head;
829 	*head = rule;
830 }
831 
832 /*
833  * Reclaim storage associated with a list of rules.  This is
834  * typically the list created using remove_rule.
835  * A NULL pointer on input is handled correctly.
836  */
837 void
838 ipfw_reap_rules(struct ip_fw *head)
839 {
840 	struct ip_fw *rule;
841 
842 	while ((rule = head) != NULL) {
843 		head = head->next;
844 		ipfw_free_rule(rule);
845 	}
846 }
847 
848 /*
849  * Rules to keep are
850  *	(default || reserved || !match_set || !match_number)
851  * where
852  *   default ::= (rule->rulenum == IPFW_DEFAULT_RULE)
853  *	// the default rule is always protected
854  *
855  *   reserved ::= (cmd == 0 && n == 0 && rule->set == RESVD_SET)
856  *	// RESVD_SET is protected only if cmd == 0 and n == 0 ("ipfw flush")
857  *
858  *   match_set ::= (cmd == 0 || rule->set == set)
859  *	// set number is ignored for cmd == 0
860  *
861  *   match_number ::= (cmd == 1 || n == 0 || n == rule->rulenum)
862  *	// number is ignored for cmd == 1 or n == 0
863  *
864  */
865 int
866 ipfw_match_range(struct ip_fw *rule, ipfw_range_tlv *rt)
867 {
868 
869 	/* Don't match default rule for modification queries */
870 	if (rule->rulenum == IPFW_DEFAULT_RULE &&
871 	    (rt->flags & IPFW_RCFLAG_DEFAULT) == 0)
872 		return (0);
873 
874 	/* Don't match rules in reserved set for flush requests */
875 	if ((rt->flags & IPFW_RCFLAG_ALL) != 0 && rule->set == RESVD_SET)
876 		return (0);
877 
878 	/* If we're filtering by set, don't match other sets */
879 	if ((rt->flags & IPFW_RCFLAG_SET) != 0 && rule->set != rt->set)
880 		return (0);
881 
882 	if ((rt->flags & IPFW_RCFLAG_RANGE) != 0 &&
883 	    (rule->rulenum < rt->start_rule || rule->rulenum > rt->end_rule))
884 		return (0);
885 
886 	return (1);
887 }
888 
889 struct manage_sets_args {
890 	uint16_t	set;
891 	uint8_t		new_set;
892 };
893 
894 static int
895 swap_sets_cb(struct namedobj_instance *ni, struct named_object *no,
896     void *arg)
897 {
898 	struct manage_sets_args *args;
899 
900 	args = (struct manage_sets_args *)arg;
901 	if (no->set == (uint8_t)args->set)
902 		no->set = args->new_set;
903 	else if (no->set == args->new_set)
904 		no->set = (uint8_t)args->set;
905 	return (0);
906 }
907 
908 static int
909 move_sets_cb(struct namedobj_instance *ni, struct named_object *no,
910     void *arg)
911 {
912 	struct manage_sets_args *args;
913 
914 	args = (struct manage_sets_args *)arg;
915 	if (no->set == (uint8_t)args->set)
916 		no->set = args->new_set;
917 	return (0);
918 }
919 
920 static int
921 test_sets_cb(struct namedobj_instance *ni, struct named_object *no,
922     void *arg)
923 {
924 	struct manage_sets_args *args;
925 
926 	args = (struct manage_sets_args *)arg;
927 	if (no->set != (uint8_t)args->set)
928 		return (0);
929 	if (ipfw_objhash_lookup_name_type(ni, args->new_set,
930 	    no->etlv, no->name) != NULL)
931 		return (EEXIST);
932 	return (0);
933 }
934 
935 /*
936  * Generic function to handler moving and swapping sets.
937  */
938 int
939 ipfw_obj_manage_sets(struct namedobj_instance *ni, uint16_t type,
940     uint16_t set, uint8_t new_set, enum ipfw_sets_cmd cmd)
941 {
942 	struct manage_sets_args args;
943 	struct named_object *no;
944 
945 	args.set = set;
946 	args.new_set = new_set;
947 	switch (cmd) {
948 	case SWAP_ALL:
949 		return (ipfw_objhash_foreach_type(ni, swap_sets_cb,
950 		    &args, type));
951 	case TEST_ALL:
952 		return (ipfw_objhash_foreach_type(ni, test_sets_cb,
953 		    &args, type));
954 	case MOVE_ALL:
955 		return (ipfw_objhash_foreach_type(ni, move_sets_cb,
956 		    &args, type));
957 	case COUNT_ONE:
958 		/*
959 		 * @set used to pass kidx.
960 		 * When @new_set is zero - reset object counter,
961 		 * otherwise increment it.
962 		 */
963 		no = ipfw_objhash_lookup_kidx(ni, set);
964 		if (new_set != 0)
965 			no->ocnt++;
966 		else
967 			no->ocnt = 0;
968 		return (0);
969 	case TEST_ONE:
970 		/* @set used to pass kidx */
971 		no = ipfw_objhash_lookup_kidx(ni, set);
972 		/*
973 		 * First check number of references:
974 		 * when it differs, this mean other rules are holding
975 		 * reference to given object, so it is not possible to
976 		 * change its set. Note that refcnt may account references
977 		 * to some going-to-be-added rules. Since we don't know
978 		 * their numbers (and even if they will be added) it is
979 		 * perfectly OK to return error here.
980 		 */
981 		if (no->ocnt != no->refcnt)
982 			return (EBUSY);
983 		if (ipfw_objhash_lookup_name_type(ni, new_set, type,
984 		    no->name) != NULL)
985 			return (EEXIST);
986 		return (0);
987 	case MOVE_ONE:
988 		/* @set used to pass kidx */
989 		no = ipfw_objhash_lookup_kidx(ni, set);
990 		no->set = new_set;
991 		return (0);
992 	}
993 	return (EINVAL);
994 }
995 
996 /*
997  * Delete rules matching range @rt.
998  * Saves number of deleted rules in @ndel.
999  *
1000  * Returns 0 on success.
1001  */
1002 static int
1003 delete_range(struct ip_fw_chain *chain, ipfw_range_tlv *rt, int *ndel)
1004 {
1005 	struct ip_fw *reap, *rule, **map;
1006 	int end, start;
1007 	int i, n, ndyn, ofs;
1008 
1009 	reap = NULL;
1010 	IPFW_UH_WLOCK(chain);	/* arbitrate writers */
1011 
1012 	/*
1013 	 * Stage 1: Determine range to inspect.
1014 	 * Range is half-inclusive, e.g [start, end).
1015 	 */
1016 	start = 0;
1017 	end = chain->n_rules - 1;
1018 
1019 	if ((rt->flags & IPFW_RCFLAG_RANGE) != 0) {
1020 		start = ipfw_find_rule(chain, rt->start_rule, 0);
1021 
1022 		if (rt->end_rule >= IPFW_DEFAULT_RULE)
1023 			rt->end_rule = IPFW_DEFAULT_RULE - 1;
1024 		end = ipfw_find_rule(chain, rt->end_rule, UINT32_MAX);
1025 	}
1026 
1027 	if (rt->flags & IPFW_RCFLAG_DYNAMIC) {
1028 		/*
1029 		 * Requested deleting only for dynamic states.
1030 		 */
1031 		*ndel = 0;
1032 		ipfw_expire_dyn_states(chain, rt);
1033 		IPFW_UH_WUNLOCK(chain);
1034 		return (0);
1035 	}
1036 
1037 	/* Allocate new map of the same size */
1038 	map = get_map(chain, 0, 1 /* locked */);
1039 	if (map == NULL) {
1040 		IPFW_UH_WUNLOCK(chain);
1041 		return (ENOMEM);
1042 	}
1043 
1044 	n = 0;
1045 	ndyn = 0;
1046 	ofs = start;
1047 	/* 1. bcopy the initial part of the map */
1048 	if (start > 0)
1049 		bcopy(chain->map, map, start * sizeof(struct ip_fw *));
1050 	/* 2. copy active rules between start and end */
1051 	for (i = start; i < end; i++) {
1052 		rule = chain->map[i];
1053 		if (ipfw_match_range(rule, rt) == 0) {
1054 			map[ofs++] = rule;
1055 			continue;
1056 		}
1057 
1058 		n++;
1059 		if (ipfw_is_dyn_rule(rule) != 0)
1060 			ndyn++;
1061 	}
1062 	/* 3. copy the final part of the map */
1063 	bcopy(chain->map + end, map + ofs,
1064 		(chain->n_rules - end) * sizeof(struct ip_fw *));
1065 	/* 4. recalculate skipto cache */
1066 	update_skipto_cache(chain, map);
1067 	/* 5. swap the maps (under UH_WLOCK + WHLOCK) */
1068 	map = swap_map(chain, map, chain->n_rules - n);
1069 	/* 6. Remove all dynamic states originated by deleted rules */
1070 	if (ndyn > 0)
1071 		ipfw_expire_dyn_states(chain, rt);
1072 	/* 7. now remove the rules deleted from the old map */
1073 	for (i = start; i < end; i++) {
1074 		rule = map[i];
1075 		if (ipfw_match_range(rule, rt) == 0)
1076 			continue;
1077 		chain->static_len -= RULEUSIZE0(rule);
1078 		ipfw_reap_add(chain, &reap, rule);
1079 	}
1080 	IPFW_UH_WUNLOCK(chain);
1081 
1082 	ipfw_reap_rules(reap);
1083 	if (map != NULL)
1084 		free(map, M_IPFW);
1085 	*ndel = n;
1086 	return (0);
1087 }
1088 
1089 static int
1090 move_objects(struct ip_fw_chain *ch, ipfw_range_tlv *rt)
1091 {
1092 	struct opcode_obj_rewrite *rw;
1093 	struct ip_fw *rule;
1094 	ipfw_insn *cmd;
1095 	int cmdlen, i, l, c;
1096 	uint16_t kidx;
1097 
1098 	IPFW_UH_WLOCK_ASSERT(ch);
1099 
1100 	/* Stage 1: count number of references by given rules */
1101 	for (c = 0, i = 0; i < ch->n_rules - 1; i++) {
1102 		rule = ch->map[i];
1103 		if (ipfw_match_range(rule, rt) == 0)
1104 			continue;
1105 		if (rule->set == rt->new_set) /* nothing to do */
1106 			continue;
1107 		/* Search opcodes with named objects */
1108 		for (l = rule->cmd_len, cmdlen = 0, cmd = rule->cmd;
1109 		    l > 0; l -= cmdlen, cmd += cmdlen) {
1110 			cmdlen = F_LEN(cmd);
1111 			rw = find_op_rw(cmd, &kidx, NULL);
1112 			if (rw == NULL || rw->manage_sets == NULL)
1113 				continue;
1114 			/*
1115 			 * When manage_sets() returns non-zero value to
1116 			 * COUNT_ONE command, consider this as an object
1117 			 * doesn't support sets (e.g. disabled with sysctl).
1118 			 * So, skip checks for this object.
1119 			 */
1120 			if (rw->manage_sets(ch, kidx, 1, COUNT_ONE) != 0)
1121 				continue;
1122 			c++;
1123 		}
1124 	}
1125 	if (c == 0) /* No objects found */
1126 		return (0);
1127 	/* Stage 2: verify "ownership" */
1128 	for (c = 0, i = 0; (i < ch->n_rules - 1) && c == 0; i++) {
1129 		rule = ch->map[i];
1130 		if (ipfw_match_range(rule, rt) == 0)
1131 			continue;
1132 		if (rule->set == rt->new_set) /* nothing to do */
1133 			continue;
1134 		/* Search opcodes with named objects */
1135 		for (l = rule->cmd_len, cmdlen = 0, cmd = rule->cmd;
1136 		    l > 0 && c == 0; l -= cmdlen, cmd += cmdlen) {
1137 			cmdlen = F_LEN(cmd);
1138 			rw = find_op_rw(cmd, &kidx, NULL);
1139 			if (rw == NULL || rw->manage_sets == NULL)
1140 				continue;
1141 			/* Test for ownership and conflicting names */
1142 			c = rw->manage_sets(ch, kidx,
1143 			    (uint8_t)rt->new_set, TEST_ONE);
1144 		}
1145 	}
1146 	/* Stage 3: change set and cleanup */
1147 	for (i = 0; i < ch->n_rules - 1; i++) {
1148 		rule = ch->map[i];
1149 		if (ipfw_match_range(rule, rt) == 0)
1150 			continue;
1151 		if (rule->set == rt->new_set) /* nothing to do */
1152 			continue;
1153 		/* Search opcodes with named objects */
1154 		for (l = rule->cmd_len, cmdlen = 0, cmd = rule->cmd;
1155 		    l > 0; l -= cmdlen, cmd += cmdlen) {
1156 			cmdlen = F_LEN(cmd);
1157 			rw = find_op_rw(cmd, &kidx, NULL);
1158 			if (rw == NULL || rw->manage_sets == NULL)
1159 				continue;
1160 			/* cleanup object counter */
1161 			rw->manage_sets(ch, kidx,
1162 			    0 /* reset counter */, COUNT_ONE);
1163 			if (c != 0)
1164 				continue;
1165 			/* change set */
1166 			rw->manage_sets(ch, kidx,
1167 			    (uint8_t)rt->new_set, MOVE_ONE);
1168 		}
1169 	}
1170 	return (c);
1171 }
1172 
1173 /*
1174  * Changes set of given rule rannge @rt
1175  * with each other.
1176  *
1177  * Returns 0 on success.
1178  */
1179 static int
1180 move_range(struct ip_fw_chain *chain, ipfw_range_tlv *rt)
1181 {
1182 	struct ip_fw *rule;
1183 	int i;
1184 
1185 	IPFW_UH_WLOCK(chain);
1186 
1187 	/*
1188 	 * Move rules with matching paramenerts to a new set.
1189 	 * This one is much more complex. We have to ensure
1190 	 * that all referenced tables (if any) are referenced
1191 	 * by given rule subset only. Otherwise, we can't move
1192 	 * them to new set and have to return error.
1193 	 */
1194 	if ((i = move_objects(chain, rt)) != 0) {
1195 		IPFW_UH_WUNLOCK(chain);
1196 		return (i);
1197 	}
1198 
1199 	/* XXX: We have to do swap holding WLOCK */
1200 	for (i = 0; i < chain->n_rules; i++) {
1201 		rule = chain->map[i];
1202 		if (ipfw_match_range(rule, rt) == 0)
1203 			continue;
1204 		rule->set = rt->new_set;
1205 	}
1206 
1207 	IPFW_UH_WUNLOCK(chain);
1208 
1209 	return (0);
1210 }
1211 
1212 /*
1213  * Returns pointer to action instruction, skips all possible rule
1214  * modifiers like O_LOG, O_TAG, O_ALTQ.
1215  */
1216 ipfw_insn *
1217 ipfw_get_action(struct ip_fw *rule)
1218 {
1219 	ipfw_insn *cmd;
1220 	int l, cmdlen;
1221 
1222 	cmd = ACTION_PTR(rule);
1223 	l = rule->cmd_len - rule->act_ofs;
1224 	while (l > 0) {
1225 		switch (cmd->opcode) {
1226 		case O_ALTQ:
1227 		case O_LOG:
1228 		case O_TAG:
1229 			break;
1230 		default:
1231 			return (cmd);
1232 		}
1233 		cmdlen = F_LEN(cmd);
1234 		l -= cmdlen;
1235 		cmd += cmdlen;
1236 	}
1237 	panic("%s: rule (%p) has not action opcode", __func__, rule);
1238 	return (NULL);
1239 }
1240 
1241 /*
1242  * Clear counters for a specific rule.
1243  * Normally run under IPFW_UH_RLOCK, but these are idempotent ops
1244  * so we only care that rules do not disappear.
1245  */
1246 static void
1247 clear_counters(struct ip_fw *rule, int log_only)
1248 {
1249 	ipfw_insn_log *l = (ipfw_insn_log *)ACTION_PTR(rule);
1250 
1251 	if (log_only == 0)
1252 		IPFW_ZERO_RULE_COUNTER(rule);
1253 	if (l->o.opcode == O_LOG)
1254 		l->log_left = l->max_log;
1255 }
1256 
1257 /*
1258  * Flushes rules counters and/or log values on matching range.
1259  *
1260  * Returns number of items cleared.
1261  */
1262 static int
1263 clear_range(struct ip_fw_chain *chain, ipfw_range_tlv *rt, int log_only)
1264 {
1265 	struct ip_fw *rule;
1266 	int num;
1267 	int i;
1268 
1269 	num = 0;
1270 	rt->flags |= IPFW_RCFLAG_DEFAULT;
1271 
1272 	IPFW_UH_WLOCK(chain);	/* arbitrate writers */
1273 	for (i = 0; i < chain->n_rules; i++) {
1274 		rule = chain->map[i];
1275 		if (ipfw_match_range(rule, rt) == 0)
1276 			continue;
1277 		clear_counters(rule, log_only);
1278 		num++;
1279 	}
1280 	IPFW_UH_WUNLOCK(chain);
1281 
1282 	return (num);
1283 }
1284 
1285 static int
1286 check_range_tlv(ipfw_range_tlv *rt)
1287 {
1288 
1289 	if (rt->head.length != sizeof(*rt))
1290 		return (1);
1291 	if (rt->start_rule > rt->end_rule)
1292 		return (1);
1293 	if (rt->set >= IPFW_MAX_SETS || rt->new_set >= IPFW_MAX_SETS)
1294 		return (1);
1295 
1296 	if ((rt->flags & IPFW_RCFLAG_USER) != rt->flags)
1297 		return (1);
1298 
1299 	return (0);
1300 }
1301 
1302 /*
1303  * Delete rules matching specified parameters
1304  * Data layout (v0)(current):
1305  * Request: [ ipfw_obj_header ipfw_range_tlv ]
1306  * Reply: [ ipfw_obj_header ipfw_range_tlv ]
1307  *
1308  * Saves number of deleted rules in ipfw_range_tlv->new_set.
1309  *
1310  * Returns 0 on success.
1311  */
1312 static int
1313 del_rules(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
1314     struct sockopt_data *sd)
1315 {
1316 	ipfw_range_header *rh;
1317 	int error, ndel;
1318 
1319 	if (sd->valsize != sizeof(*rh))
1320 		return (EINVAL);
1321 
1322 	rh = (ipfw_range_header *)ipfw_get_sopt_space(sd, sd->valsize);
1323 
1324 	if (check_range_tlv(&rh->range) != 0)
1325 		return (EINVAL);
1326 
1327 	ndel = 0;
1328 	if ((error = delete_range(chain, &rh->range, &ndel)) != 0)
1329 		return (error);
1330 
1331 	/* Save number of rules deleted */
1332 	rh->range.new_set = ndel;
1333 	return (0);
1334 }
1335 
1336 /*
1337  * Move rules/sets matching specified parameters
1338  * Data layout (v0)(current):
1339  * Request: [ ipfw_obj_header ipfw_range_tlv ]
1340  *
1341  * Returns 0 on success.
1342  */
1343 static int
1344 move_rules(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
1345     struct sockopt_data *sd)
1346 {
1347 	ipfw_range_header *rh;
1348 
1349 	if (sd->valsize != sizeof(*rh))
1350 		return (EINVAL);
1351 
1352 	rh = (ipfw_range_header *)ipfw_get_sopt_space(sd, sd->valsize);
1353 
1354 	if (check_range_tlv(&rh->range) != 0)
1355 		return (EINVAL);
1356 
1357 	return (move_range(chain, &rh->range));
1358 }
1359 
1360 /*
1361  * Clear rule accounting data matching specified parameters
1362  * Data layout (v0)(current):
1363  * Request: [ ipfw_obj_header ipfw_range_tlv ]
1364  * Reply: [ ipfw_obj_header ipfw_range_tlv ]
1365  *
1366  * Saves number of cleared rules in ipfw_range_tlv->new_set.
1367  *
1368  * Returns 0 on success.
1369  */
1370 static int
1371 clear_rules(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
1372     struct sockopt_data *sd)
1373 {
1374 	ipfw_range_header *rh;
1375 	int log_only, num;
1376 	char *msg;
1377 
1378 	if (sd->valsize != sizeof(*rh))
1379 		return (EINVAL);
1380 
1381 	rh = (ipfw_range_header *)ipfw_get_sopt_space(sd, sd->valsize);
1382 
1383 	if (check_range_tlv(&rh->range) != 0)
1384 		return (EINVAL);
1385 
1386 	log_only = (op3->opcode == IP_FW_XRESETLOG);
1387 
1388 	num = clear_range(chain, &rh->range, log_only);
1389 
1390 	if (rh->range.flags & IPFW_RCFLAG_ALL)
1391 		msg = log_only ? "All logging counts reset" :
1392 		    "Accounting cleared";
1393 	else
1394 		msg = log_only ? "logging count reset" : "cleared";
1395 
1396 	if (V_fw_verbose) {
1397 		int lev = LOG_SECURITY | LOG_NOTICE;
1398 		log(lev, "ipfw: %s.\n", msg);
1399 	}
1400 
1401 	/* Save number of rules cleared */
1402 	rh->range.new_set = num;
1403 	return (0);
1404 }
1405 
1406 static void
1407 enable_sets(struct ip_fw_chain *chain, ipfw_range_tlv *rt)
1408 {
1409 	uint32_t v_set;
1410 
1411 	IPFW_UH_WLOCK_ASSERT(chain);
1412 
1413 	/* Change enabled/disabled sets mask */
1414 	v_set = (V_set_disable | rt->set) & ~rt->new_set;
1415 	v_set &= ~(1 << RESVD_SET); /* set RESVD_SET always enabled */
1416 	IPFW_WLOCK(chain);
1417 	V_set_disable = v_set;
1418 	IPFW_WUNLOCK(chain);
1419 }
1420 
1421 static int
1422 swap_sets(struct ip_fw_chain *chain, ipfw_range_tlv *rt, int mv)
1423 {
1424 	struct opcode_obj_rewrite *rw;
1425 	struct ip_fw *rule;
1426 	int i;
1427 
1428 	IPFW_UH_WLOCK_ASSERT(chain);
1429 
1430 	if (rt->set == rt->new_set) /* nothing to do */
1431 		return (0);
1432 
1433 	if (mv != 0) {
1434 		/*
1435 		 * Berfore moving the rules we need to check that
1436 		 * there aren't any conflicting named objects.
1437 		 */
1438 		for (rw = ctl3_rewriters;
1439 		    rw < ctl3_rewriters + ctl3_rsize; rw++) {
1440 			if (rw->manage_sets == NULL)
1441 				continue;
1442 			i = rw->manage_sets(chain, (uint8_t)rt->set,
1443 			    (uint8_t)rt->new_set, TEST_ALL);
1444 			if (i != 0)
1445 				return (EEXIST);
1446 		}
1447 	}
1448 	/* Swap or move two sets */
1449 	for (i = 0; i < chain->n_rules - 1; i++) {
1450 		rule = chain->map[i];
1451 		if (rule->set == (uint8_t)rt->set)
1452 			rule->set = (uint8_t)rt->new_set;
1453 		else if (rule->set == (uint8_t)rt->new_set && mv == 0)
1454 			rule->set = (uint8_t)rt->set;
1455 	}
1456 	for (rw = ctl3_rewriters; rw < ctl3_rewriters + ctl3_rsize; rw++) {
1457 		if (rw->manage_sets == NULL)
1458 			continue;
1459 		rw->manage_sets(chain, (uint8_t)rt->set,
1460 		    (uint8_t)rt->new_set, mv != 0 ? MOVE_ALL: SWAP_ALL);
1461 	}
1462 	return (0);
1463 }
1464 
1465 /*
1466  * Swaps or moves set
1467  * Data layout (v0)(current):
1468  * Request: [ ipfw_obj_header ipfw_range_tlv ]
1469  *
1470  * Returns 0 on success.
1471  */
1472 static int
1473 manage_sets(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
1474     struct sockopt_data *sd)
1475 {
1476 	ipfw_range_header *rh;
1477 	int ret;
1478 
1479 	if (sd->valsize != sizeof(*rh))
1480 		return (EINVAL);
1481 
1482 	rh = (ipfw_range_header *)ipfw_get_sopt_space(sd, sd->valsize);
1483 
1484 	if (rh->range.head.length != sizeof(ipfw_range_tlv))
1485 		return (1);
1486 	/* enable_sets() expects bitmasks. */
1487 	if (op3->opcode != IP_FW_SET_ENABLE &&
1488 	    (rh->range.set >= IPFW_MAX_SETS ||
1489 	    rh->range.new_set >= IPFW_MAX_SETS))
1490 		return (EINVAL);
1491 
1492 	ret = 0;
1493 	IPFW_UH_WLOCK(chain);
1494 	switch (op3->opcode) {
1495 	case IP_FW_SET_SWAP:
1496 	case IP_FW_SET_MOVE:
1497 		ret = swap_sets(chain, &rh->range,
1498 		    op3->opcode == IP_FW_SET_MOVE);
1499 		break;
1500 	case IP_FW_SET_ENABLE:
1501 		enable_sets(chain, &rh->range);
1502 		break;
1503 	}
1504 	IPFW_UH_WUNLOCK(chain);
1505 
1506 	return (ret);
1507 }
1508 
1509 /**
1510  * Remove all rules with given number, or do set manipulation.
1511  * Assumes chain != NULL && *chain != NULL.
1512  *
1513  * The argument is an uint32_t. The low 16 bit are the rule or set number;
1514  * the next 8 bits are the new set; the top 8 bits indicate the command:
1515  *
1516  *	0	delete rules numbered "rulenum"
1517  *	1	delete rules in set "rulenum"
1518  *	2	move rules "rulenum" to set "new_set"
1519  *	3	move rules from set "rulenum" to set "new_set"
1520  *	4	swap sets "rulenum" and "new_set"
1521  *	5	delete rules "rulenum" and set "new_set"
1522  */
1523 static int
1524 del_entry(struct ip_fw_chain *chain, uint32_t arg)
1525 {
1526 	uint32_t num;	/* rule number or old_set */
1527 	uint8_t cmd, new_set;
1528 	int do_del, ndel;
1529 	int error = 0;
1530 	ipfw_range_tlv rt;
1531 
1532 	num = arg & 0xffff;
1533 	cmd = (arg >> 24) & 0xff;
1534 	new_set = (arg >> 16) & 0xff;
1535 
1536 	if (cmd > 5 || new_set > RESVD_SET)
1537 		return EINVAL;
1538 	if (cmd == 0 || cmd == 2 || cmd == 5) {
1539 		if (num >= IPFW_DEFAULT_RULE)
1540 			return EINVAL;
1541 	} else {
1542 		if (num > RESVD_SET)	/* old_set */
1543 			return EINVAL;
1544 	}
1545 
1546 	/* Convert old requests into new representation */
1547 	memset(&rt, 0, sizeof(rt));
1548 	rt.start_rule = num;
1549 	rt.end_rule = num;
1550 	rt.set = num;
1551 	rt.new_set = new_set;
1552 	do_del = 0;
1553 
1554 	switch (cmd) {
1555 	case 0: /* delete rules numbered "rulenum" */
1556 		if (num == 0)
1557 			rt.flags |= IPFW_RCFLAG_ALL;
1558 		else
1559 			rt.flags |= IPFW_RCFLAG_RANGE;
1560 		do_del = 1;
1561 		break;
1562 	case 1: /* delete rules in set "rulenum" */
1563 		rt.flags |= IPFW_RCFLAG_SET;
1564 		do_del = 1;
1565 		break;
1566 	case 5: /* delete rules "rulenum" and set "new_set" */
1567 		rt.flags |= IPFW_RCFLAG_RANGE | IPFW_RCFLAG_SET;
1568 		rt.set = new_set;
1569 		rt.new_set = 0;
1570 		do_del = 1;
1571 		break;
1572 	case 2: /* move rules "rulenum" to set "new_set" */
1573 		rt.flags |= IPFW_RCFLAG_RANGE;
1574 		break;
1575 	case 3: /* move rules from set "rulenum" to set "new_set" */
1576 		IPFW_UH_WLOCK(chain);
1577 		error = swap_sets(chain, &rt, 1);
1578 		IPFW_UH_WUNLOCK(chain);
1579 		return (error);
1580 	case 4: /* swap sets "rulenum" and "new_set" */
1581 		IPFW_UH_WLOCK(chain);
1582 		error = swap_sets(chain, &rt, 0);
1583 		IPFW_UH_WUNLOCK(chain);
1584 		return (error);
1585 	default:
1586 		return (ENOTSUP);
1587 	}
1588 
1589 	if (do_del != 0) {
1590 		if ((error = delete_range(chain, &rt, &ndel)) != 0)
1591 			return (error);
1592 
1593 		if (ndel == 0 && (cmd != 1 && num != 0))
1594 			return (EINVAL);
1595 
1596 		return (0);
1597 	}
1598 
1599 	return (move_range(chain, &rt));
1600 }
1601 
1602 /**
1603  * Reset some or all counters on firewall rules.
1604  * The argument `arg' is an u_int32_t. The low 16 bit are the rule number,
1605  * the next 8 bits are the set number, the top 8 bits are the command:
1606  *	0	work with rules from all set's;
1607  *	1	work with rules only from specified set.
1608  * Specified rule number is zero if we want to clear all entries.
1609  * log_only is 1 if we only want to reset logs, zero otherwise.
1610  */
1611 static int
1612 zero_entry(struct ip_fw_chain *chain, u_int32_t arg, int log_only)
1613 {
1614 	struct ip_fw *rule;
1615 	char *msg;
1616 	int i;
1617 
1618 	uint16_t rulenum = arg & 0xffff;
1619 	uint8_t set = (arg >> 16) & 0xff;
1620 	uint8_t cmd = (arg >> 24) & 0xff;
1621 
1622 	if (cmd > 1)
1623 		return (EINVAL);
1624 	if (cmd == 1 && set > RESVD_SET)
1625 		return (EINVAL);
1626 
1627 	IPFW_UH_RLOCK(chain);
1628 	if (rulenum == 0) {
1629 		V_norule_counter = 0;
1630 		for (i = 0; i < chain->n_rules; i++) {
1631 			rule = chain->map[i];
1632 			/* Skip rules not in our set. */
1633 			if (cmd == 1 && rule->set != set)
1634 				continue;
1635 			clear_counters(rule, log_only);
1636 		}
1637 		msg = log_only ? "All logging counts reset" :
1638 		    "Accounting cleared";
1639 	} else {
1640 		int cleared = 0;
1641 		for (i = 0; i < chain->n_rules; i++) {
1642 			rule = chain->map[i];
1643 			if (rule->rulenum == rulenum) {
1644 				if (cmd == 0 || rule->set == set)
1645 					clear_counters(rule, log_only);
1646 				cleared = 1;
1647 			}
1648 			if (rule->rulenum > rulenum)
1649 				break;
1650 		}
1651 		if (!cleared) {	/* we did not find any matching rules */
1652 			IPFW_UH_RUNLOCK(chain);
1653 			return (EINVAL);
1654 		}
1655 		msg = log_only ? "logging count reset" : "cleared";
1656 	}
1657 	IPFW_UH_RUNLOCK(chain);
1658 
1659 	if (V_fw_verbose) {
1660 		int lev = LOG_SECURITY | LOG_NOTICE;
1661 
1662 		if (rulenum)
1663 			log(lev, "ipfw: Entry %d %s.\n", rulenum, msg);
1664 		else
1665 			log(lev, "ipfw: %s.\n", msg);
1666 	}
1667 	return (0);
1668 }
1669 
1670 /*
1671  * Check rule head in FreeBSD11 format
1672  *
1673  */
1674 static int
1675 check_ipfw_rule1(struct ip_fw_rule *rule, int size,
1676     struct rule_check_info *ci)
1677 {
1678 	int l;
1679 
1680 	if (size < sizeof(*rule)) {
1681 		printf("ipfw: rule too short\n");
1682 		return (EINVAL);
1683 	}
1684 
1685 	/* Check for valid cmd_len */
1686 	l = roundup2(RULESIZE(rule), sizeof(uint64_t));
1687 	if (l != size) {
1688 		printf("ipfw: size mismatch (have %d want %d)\n", size, l);
1689 		return (EINVAL);
1690 	}
1691 	if (rule->act_ofs >= rule->cmd_len) {
1692 		printf("ipfw: bogus action offset (%u > %u)\n",
1693 		    rule->act_ofs, rule->cmd_len - 1);
1694 		return (EINVAL);
1695 	}
1696 
1697 	if (rule->rulenum > IPFW_DEFAULT_RULE - 1)
1698 		return (EINVAL);
1699 
1700 	return (check_ipfw_rule_body(rule->cmd, rule->cmd_len, ci));
1701 }
1702 
1703 /*
1704  * Check rule head in FreeBSD8 format
1705  *
1706  */
1707 static int
1708 check_ipfw_rule0(struct ip_fw_rule0 *rule, int size,
1709     struct rule_check_info *ci)
1710 {
1711 	int l;
1712 
1713 	if (size < sizeof(*rule)) {
1714 		printf("ipfw: rule too short\n");
1715 		return (EINVAL);
1716 	}
1717 
1718 	/* Check for valid cmd_len */
1719 	l = sizeof(*rule) + rule->cmd_len * 4 - 4;
1720 	if (l != size) {
1721 		printf("ipfw: size mismatch (have %d want %d)\n", size, l);
1722 		return (EINVAL);
1723 	}
1724 	if (rule->act_ofs >= rule->cmd_len) {
1725 		printf("ipfw: bogus action offset (%u > %u)\n",
1726 		    rule->act_ofs, rule->cmd_len - 1);
1727 		return (EINVAL);
1728 	}
1729 
1730 	if (rule->rulenum > IPFW_DEFAULT_RULE - 1)
1731 		return (EINVAL);
1732 
1733 	return (check_ipfw_rule_body(rule->cmd, rule->cmd_len, ci));
1734 }
1735 
1736 static int
1737 check_ipfw_rule_body(ipfw_insn *cmd, int cmd_len, struct rule_check_info *ci)
1738 {
1739 	int cmdlen, l;
1740 	int have_action;
1741 
1742 	have_action = 0;
1743 
1744 	/*
1745 	 * Now go for the individual checks. Very simple ones, basically only
1746 	 * instruction sizes.
1747 	 */
1748 	for (l = cmd_len; l > 0 ; l -= cmdlen, cmd += cmdlen) {
1749 		cmdlen = F_LEN(cmd);
1750 		if (cmdlen > l) {
1751 			printf("ipfw: opcode %d size truncated\n",
1752 			    cmd->opcode);
1753 			return EINVAL;
1754 		}
1755 		switch (cmd->opcode) {
1756 		case O_PROBE_STATE:
1757 		case O_KEEP_STATE:
1758 			if (cmdlen != F_INSN_SIZE(ipfw_insn))
1759 				goto bad_size;
1760 			ci->object_opcodes++;
1761 			break;
1762 		case O_PROTO:
1763 		case O_IP_SRC_ME:
1764 		case O_IP_DST_ME:
1765 		case O_LAYER2:
1766 		case O_IN:
1767 		case O_FRAG:
1768 		case O_DIVERTED:
1769 		case O_IPOPT:
1770 		case O_IPTOS:
1771 		case O_IPPRECEDENCE:
1772 		case O_IPVER:
1773 		case O_SOCKARG:
1774 		case O_TCPFLAGS:
1775 		case O_TCPOPTS:
1776 		case O_ESTAB:
1777 		case O_VERREVPATH:
1778 		case O_VERSRCREACH:
1779 		case O_ANTISPOOF:
1780 		case O_IPSEC:
1781 #ifdef INET6
1782 		case O_IP6_SRC_ME:
1783 		case O_IP6_DST_ME:
1784 		case O_EXT_HDR:
1785 		case O_IP6:
1786 #endif
1787 		case O_IP4:
1788 		case O_TAG:
1789 		case O_SKIP_ACTION:
1790 			if (cmdlen != F_INSN_SIZE(ipfw_insn))
1791 				goto bad_size;
1792 			break;
1793 
1794 		case O_EXTERNAL_ACTION:
1795 			if (cmd->arg1 == 0 ||
1796 			    cmdlen != F_INSN_SIZE(ipfw_insn)) {
1797 				printf("ipfw: invalid external "
1798 				    "action opcode\n");
1799 				return (EINVAL);
1800 			}
1801 			ci->object_opcodes++;
1802 			/*
1803 			 * Do we have O_EXTERNAL_INSTANCE or O_EXTERNAL_DATA
1804 			 * opcode?
1805 			 */
1806 			if (l != cmdlen) {
1807 				l -= cmdlen;
1808 				cmd += cmdlen;
1809 				cmdlen = F_LEN(cmd);
1810 				if (cmd->opcode == O_EXTERNAL_DATA)
1811 					goto check_action;
1812 				if (cmd->opcode != O_EXTERNAL_INSTANCE) {
1813 					printf("ipfw: invalid opcode "
1814 					    "next to external action %u\n",
1815 					    cmd->opcode);
1816 					return (EINVAL);
1817 				}
1818 				if (cmd->arg1 == 0 ||
1819 				    cmdlen != F_INSN_SIZE(ipfw_insn)) {
1820 					printf("ipfw: invalid external "
1821 					    "action instance opcode\n");
1822 					return (EINVAL);
1823 				}
1824 				ci->object_opcodes++;
1825 			}
1826 			goto check_action;
1827 
1828 		case O_FIB:
1829 			if (cmdlen != F_INSN_SIZE(ipfw_insn))
1830 				goto bad_size;
1831 			if (cmd->arg1 >= rt_numfibs) {
1832 				printf("ipfw: invalid fib number %d\n",
1833 					cmd->arg1);
1834 				return EINVAL;
1835 			}
1836 			break;
1837 
1838 		case O_SETFIB:
1839 			if (cmdlen != F_INSN_SIZE(ipfw_insn))
1840 				goto bad_size;
1841 			if ((cmd->arg1 != IP_FW_TARG) &&
1842 			    ((cmd->arg1 & 0x7FFF) >= rt_numfibs)) {
1843 				printf("ipfw: invalid fib number %d\n",
1844 					cmd->arg1 & 0x7FFF);
1845 				return EINVAL;
1846 			}
1847 			goto check_action;
1848 
1849 		case O_UID:
1850 		case O_GID:
1851 		case O_JAIL:
1852 		case O_IP_SRC:
1853 		case O_IP_DST:
1854 		case O_TCPSEQ:
1855 		case O_TCPACK:
1856 		case O_PROB:
1857 		case O_ICMPTYPE:
1858 			if (cmdlen != F_INSN_SIZE(ipfw_insn_u32))
1859 				goto bad_size;
1860 			break;
1861 
1862 		case O_LIMIT:
1863 			if (cmdlen != F_INSN_SIZE(ipfw_insn_limit))
1864 				goto bad_size;
1865 			ci->object_opcodes++;
1866 			break;
1867 
1868 		case O_LOG:
1869 			if (cmdlen != F_INSN_SIZE(ipfw_insn_log))
1870 				goto bad_size;
1871 
1872 			((ipfw_insn_log *)cmd)->log_left =
1873 			    ((ipfw_insn_log *)cmd)->max_log;
1874 
1875 			break;
1876 
1877 		case O_IP_SRC_MASK:
1878 		case O_IP_DST_MASK:
1879 			/* only odd command lengths */
1880 			if ((cmdlen & 1) == 0)
1881 				goto bad_size;
1882 			break;
1883 
1884 		case O_IP_SRC_SET:
1885 		case O_IP_DST_SET:
1886 			if (cmd->arg1 == 0 || cmd->arg1 > 256) {
1887 				printf("ipfw: invalid set size %d\n",
1888 					cmd->arg1);
1889 				return EINVAL;
1890 			}
1891 			if (cmdlen != F_INSN_SIZE(ipfw_insn_u32) +
1892 			    (cmd->arg1+31)/32 )
1893 				goto bad_size;
1894 			break;
1895 
1896 		case O_IP_SRC_LOOKUP:
1897 			if (cmdlen > F_INSN_SIZE(ipfw_insn_u32))
1898 				goto bad_size;
1899 		case O_IP_DST_LOOKUP:
1900 			if (cmd->arg1 >= V_fw_tables_max) {
1901 				printf("ipfw: invalid table number %d\n",
1902 				    cmd->arg1);
1903 				return (EINVAL);
1904 			}
1905 			if (cmdlen != F_INSN_SIZE(ipfw_insn) &&
1906 			    cmdlen != F_INSN_SIZE(ipfw_insn_u32) + 1 &&
1907 			    cmdlen != F_INSN_SIZE(ipfw_insn_u32))
1908 				goto bad_size;
1909 			ci->object_opcodes++;
1910 			break;
1911 		case O_IP_FLOW_LOOKUP:
1912 		case O_MAC_DST_LOOKUP:
1913 		case O_MAC_SRC_LOOKUP:
1914 			if (cmd->arg1 >= V_fw_tables_max) {
1915 				printf("ipfw: invalid table number %d\n",
1916 				    cmd->arg1);
1917 				return (EINVAL);
1918 			}
1919 			if (cmdlen != F_INSN_SIZE(ipfw_insn) &&
1920 			    cmdlen != F_INSN_SIZE(ipfw_insn_u32))
1921 				goto bad_size;
1922 			ci->object_opcodes++;
1923 			break;
1924 		case O_MACADDR2:
1925 			if (cmdlen != F_INSN_SIZE(ipfw_insn_mac))
1926 				goto bad_size;
1927 			break;
1928 
1929 		case O_NOP:
1930 		case O_IPID:
1931 		case O_IPTTL:
1932 		case O_IPLEN:
1933 		case O_TCPDATALEN:
1934 		case O_TCPMSS:
1935 		case O_TCPWIN:
1936 		case O_TAGGED:
1937 			if (cmdlen < 1 || cmdlen > 31)
1938 				goto bad_size;
1939 			break;
1940 
1941 		case O_DSCP:
1942 			if (cmdlen != F_INSN_SIZE(ipfw_insn_u32) + 1)
1943 				goto bad_size;
1944 			break;
1945 
1946 		case O_MAC_TYPE:
1947 		case O_IP_SRCPORT:
1948 		case O_IP_DSTPORT: /* XXX artificial limit, 30 port pairs */
1949 			if (cmdlen < 2 || cmdlen > 31)
1950 				goto bad_size;
1951 			break;
1952 
1953 		case O_RECV:
1954 		case O_XMIT:
1955 		case O_VIA:
1956 			if (cmdlen != F_INSN_SIZE(ipfw_insn_if))
1957 				goto bad_size;
1958 			ci->object_opcodes++;
1959 			break;
1960 
1961 		case O_ALTQ:
1962 			if (cmdlen != F_INSN_SIZE(ipfw_insn_altq))
1963 				goto bad_size;
1964 			break;
1965 
1966 		case O_PIPE:
1967 		case O_QUEUE:
1968 			if (cmdlen != F_INSN_SIZE(ipfw_insn))
1969 				goto bad_size;
1970 			goto check_action;
1971 
1972 		case O_FORWARD_IP:
1973 			if (cmdlen != F_INSN_SIZE(ipfw_insn_sa))
1974 				goto bad_size;
1975 			goto check_action;
1976 #ifdef INET6
1977 		case O_FORWARD_IP6:
1978 			if (cmdlen != F_INSN_SIZE(ipfw_insn_sa6))
1979 				goto bad_size;
1980 			goto check_action;
1981 #endif /* INET6 */
1982 
1983 		case O_DIVERT:
1984 		case O_TEE:
1985 			if (ip_divert_ptr == NULL)
1986 				return EINVAL;
1987 			else
1988 				goto check_size;
1989 		case O_NETGRAPH:
1990 		case O_NGTEE:
1991 			if (ng_ipfw_input_p == NULL)
1992 				return EINVAL;
1993 			else
1994 				goto check_size;
1995 		case O_NAT:
1996 			if (!IPFW_NAT_LOADED)
1997 				return EINVAL;
1998 			if (cmdlen != F_INSN_SIZE(ipfw_insn_nat))
1999  				goto bad_size;
2000  			goto check_action;
2001 		case O_CHECK_STATE:
2002 			ci->object_opcodes++;
2003 			/* FALLTHROUGH */
2004 		case O_FORWARD_MAC: /* XXX not implemented yet */
2005 		case O_COUNT:
2006 		case O_ACCEPT:
2007 		case O_DENY:
2008 		case O_REJECT:
2009 		case O_SETDSCP:
2010 #ifdef INET6
2011 		case O_UNREACH6:
2012 #endif
2013 		case O_SKIPTO:
2014 		case O_REASS:
2015 		case O_CALLRETURN:
2016 check_size:
2017 			if (cmdlen != F_INSN_SIZE(ipfw_insn))
2018 				goto bad_size;
2019 check_action:
2020 			if (have_action) {
2021 				printf("ipfw: opcode %d, multiple actions"
2022 					" not allowed\n",
2023 					cmd->opcode);
2024 				return (EINVAL);
2025 			}
2026 			have_action = 1;
2027 			if (l != cmdlen) {
2028 				printf("ipfw: opcode %d, action must be"
2029 					" last opcode\n",
2030 					cmd->opcode);
2031 				return (EINVAL);
2032 			}
2033 			break;
2034 #ifdef INET6
2035 		case O_IP6_SRC:
2036 		case O_IP6_DST:
2037 			if (cmdlen != F_INSN_SIZE(struct in6_addr) +
2038 			    F_INSN_SIZE(ipfw_insn))
2039 				goto bad_size;
2040 			break;
2041 
2042 		case O_FLOW6ID:
2043 			if (cmdlen != F_INSN_SIZE(ipfw_insn_u32) +
2044 			    ((ipfw_insn_u32 *)cmd)->o.arg1)
2045 				goto bad_size;
2046 			break;
2047 
2048 		case O_IP6_SRC_MASK:
2049 		case O_IP6_DST_MASK:
2050 			if ( !(cmdlen & 1) || cmdlen > 127)
2051 				goto bad_size;
2052 			break;
2053 		case O_ICMP6TYPE:
2054 			if( cmdlen != F_INSN_SIZE( ipfw_insn_icmp6 ) )
2055 				goto bad_size;
2056 			break;
2057 #endif
2058 
2059 		default:
2060 			switch (cmd->opcode) {
2061 #ifndef INET6
2062 			case O_IP6_SRC_ME:
2063 			case O_IP6_DST_ME:
2064 			case O_EXT_HDR:
2065 			case O_IP6:
2066 			case O_UNREACH6:
2067 			case O_IP6_SRC:
2068 			case O_IP6_DST:
2069 			case O_FLOW6ID:
2070 			case O_IP6_SRC_MASK:
2071 			case O_IP6_DST_MASK:
2072 			case O_ICMP6TYPE:
2073 				printf("ipfw: no IPv6 support in kernel\n");
2074 				return (EPROTONOSUPPORT);
2075 #endif
2076 			default:
2077 				printf("ipfw: opcode %d, unknown opcode\n",
2078 					cmd->opcode);
2079 				return (EINVAL);
2080 			}
2081 		}
2082 	}
2083 	if (have_action == 0) {
2084 		printf("ipfw: missing action\n");
2085 		return (EINVAL);
2086 	}
2087 	return 0;
2088 
2089 bad_size:
2090 	printf("ipfw: opcode %d size %d wrong\n",
2091 		cmd->opcode, cmdlen);
2092 	return (EINVAL);
2093 }
2094 
2095 /*
2096  * Translation of requests for compatibility with FreeBSD 7.2/8.
2097  * a static variable tells us if we have an old client from userland,
2098  * and if necessary we translate requests and responses between the
2099  * two formats.
2100  */
2101 static int is7 = 0;
2102 
2103 struct ip_fw7 {
2104 	struct ip_fw7	*next;		/* linked list of rules     */
2105 	struct ip_fw7	*next_rule;	/* ptr to next [skipto] rule    */
2106 	/* 'next_rule' is used to pass up 'set_disable' status      */
2107 
2108 	uint16_t	act_ofs;	/* offset of action in 32-bit units */
2109 	uint16_t	cmd_len;	/* # of 32-bit words in cmd */
2110 	uint16_t	rulenum;	/* rule number          */
2111 	uint8_t		set;		/* rule set (0..31)     */
2112 	// #define RESVD_SET   31  /* set for default and persistent rules */
2113 	uint8_t		_pad;		/* padding          */
2114 	// uint32_t        id;             /* rule id, only in v.8 */
2115 	/* These fields are present in all rules.           */
2116 	uint64_t	pcnt;		/* Packet counter       */
2117 	uint64_t	bcnt;		/* Byte counter         */
2118 	uint32_t	timestamp;	/* tv_sec of last match     */
2119 
2120 	ipfw_insn	cmd[1];		/* storage for commands     */
2121 };
2122 
2123 static int convert_rule_to_7(struct ip_fw_rule0 *rule);
2124 static int convert_rule_to_8(struct ip_fw_rule0 *rule);
2125 
2126 #ifndef RULESIZE7
2127 #define RULESIZE7(rule)  (sizeof(struct ip_fw7) + \
2128 	((struct ip_fw7 *)(rule))->cmd_len * 4 - 4)
2129 #endif
2130 
2131 /*
2132  * Copy the static and dynamic rules to the supplied buffer
2133  * and return the amount of space actually used.
2134  * Must be run under IPFW_UH_RLOCK
2135  */
2136 static size_t
2137 ipfw_getrules(struct ip_fw_chain *chain, void *buf, size_t space)
2138 {
2139 	char *bp = buf;
2140 	char *ep = bp + space;
2141 	struct ip_fw *rule;
2142 	struct ip_fw_rule0 *dst;
2143 	struct timeval boottime;
2144 	int error, i, l, warnflag;
2145 	time_t	boot_seconds;
2146 
2147 	warnflag = 0;
2148 
2149 	getboottime(&boottime);
2150         boot_seconds = boottime.tv_sec;
2151 	for (i = 0; i < chain->n_rules; i++) {
2152 		rule = chain->map[i];
2153 
2154 		if (is7) {
2155 		    /* Convert rule to FreeBSd 7.2 format */
2156 		    l = RULESIZE7(rule);
2157 		    if (bp + l + sizeof(uint32_t) <= ep) {
2158 			bcopy(rule, bp, l + sizeof(uint32_t));
2159 			error = set_legacy_obj_kidx(chain,
2160 			    (struct ip_fw_rule0 *)bp);
2161 			if (error != 0)
2162 				return (0);
2163 			error = convert_rule_to_7((struct ip_fw_rule0 *) bp);
2164 			if (error)
2165 				return 0; /*XXX correct? */
2166 			/*
2167 			 * XXX HACK. Store the disable mask in the "next"
2168 			 * pointer in a wild attempt to keep the ABI the same.
2169 			 * Why do we do this on EVERY rule?
2170 			 */
2171 			bcopy(&V_set_disable,
2172 				&(((struct ip_fw7 *)bp)->next_rule),
2173 				sizeof(V_set_disable));
2174 			if (((struct ip_fw7 *)bp)->timestamp)
2175 			    ((struct ip_fw7 *)bp)->timestamp += boot_seconds;
2176 			bp += l;
2177 		    }
2178 		    continue; /* go to next rule */
2179 		}
2180 
2181 		l = RULEUSIZE0(rule);
2182 		if (bp + l > ep) { /* should not happen */
2183 			printf("overflow dumping static rules\n");
2184 			break;
2185 		}
2186 		dst = (struct ip_fw_rule0 *)bp;
2187 		export_rule0(rule, dst, l);
2188 		error = set_legacy_obj_kidx(chain, dst);
2189 
2190 		/*
2191 		 * XXX HACK. Store the disable mask in the "next"
2192 		 * pointer in a wild attempt to keep the ABI the same.
2193 		 * Why do we do this on EVERY rule?
2194 		 *
2195 		 * XXX: "ipfw set show" (ab)uses IP_FW_GET to read disabled mask
2196 		 * so we need to fail _after_ saving at least one mask.
2197 		 */
2198 		bcopy(&V_set_disable, &dst->next_rule, sizeof(V_set_disable));
2199 		if (dst->timestamp)
2200 			dst->timestamp += boot_seconds;
2201 		bp += l;
2202 
2203 		if (error != 0) {
2204 			if (error == 2) {
2205 				/* Non-fatal table rewrite error. */
2206 				warnflag = 1;
2207 				continue;
2208 			}
2209 			printf("Stop on rule %d. Fail to convert table\n",
2210 			    rule->rulenum);
2211 			break;
2212 		}
2213 	}
2214 	if (warnflag != 0)
2215 		printf("ipfw: process %s is using legacy interfaces,"
2216 		    " consider rebuilding\n", "");
2217 	ipfw_get_dynamic(chain, &bp, ep); /* protected by the dynamic lock */
2218 	return (bp - (char *)buf);
2219 }
2220 
2221 struct dump_args {
2222 	uint32_t	b;	/* start rule */
2223 	uint32_t	e;	/* end rule */
2224 	uint32_t	rcount;	/* number of rules */
2225 	uint32_t	rsize;	/* rules size */
2226 	uint32_t	tcount;	/* number of tables */
2227 	int		rcounters;	/* counters */
2228 	uint32_t	*bmask;	/* index bitmask of used named objects */
2229 };
2230 
2231 void
2232 ipfw_export_obj_ntlv(struct named_object *no, ipfw_obj_ntlv *ntlv)
2233 {
2234 
2235 	ntlv->head.type = no->etlv;
2236 	ntlv->head.length = sizeof(*ntlv);
2237 	ntlv->idx = no->kidx;
2238 	strlcpy(ntlv->name, no->name, sizeof(ntlv->name));
2239 }
2240 
2241 /*
2242  * Export named object info in instance @ni, identified by @kidx
2243  * to ipfw_obj_ntlv. TLV is allocated from @sd space.
2244  *
2245  * Returns 0 on success.
2246  */
2247 static int
2248 export_objhash_ntlv(struct namedobj_instance *ni, uint16_t kidx,
2249     struct sockopt_data *sd)
2250 {
2251 	struct named_object *no;
2252 	ipfw_obj_ntlv *ntlv;
2253 
2254 	no = ipfw_objhash_lookup_kidx(ni, kidx);
2255 	KASSERT(no != NULL, ("invalid object kernel index passed"));
2256 
2257 	ntlv = (ipfw_obj_ntlv *)ipfw_get_sopt_space(sd, sizeof(*ntlv));
2258 	if (ntlv == NULL)
2259 		return (ENOMEM);
2260 
2261 	ipfw_export_obj_ntlv(no, ntlv);
2262 	return (0);
2263 }
2264 
2265 static int
2266 export_named_objects(struct namedobj_instance *ni, struct dump_args *da,
2267     struct sockopt_data *sd)
2268 {
2269 	int error, i;
2270 
2271 	for (i = 0; i < IPFW_TABLES_MAX && da->tcount > 0; i++) {
2272 		if ((da->bmask[i / 32] & (1 << (i % 32))) == 0)
2273 			continue;
2274 		if ((error = export_objhash_ntlv(ni, i, sd)) != 0)
2275 			return (error);
2276 		da->tcount--;
2277 	}
2278 	return (0);
2279 }
2280 
2281 static int
2282 dump_named_objects(struct ip_fw_chain *ch, struct dump_args *da,
2283     struct sockopt_data *sd)
2284 {
2285 	ipfw_obj_ctlv *ctlv;
2286 	int error;
2287 
2288 	MPASS(da->tcount > 0);
2289 	/* Header first */
2290 	ctlv = (ipfw_obj_ctlv *)ipfw_get_sopt_space(sd, sizeof(*ctlv));
2291 	if (ctlv == NULL)
2292 		return (ENOMEM);
2293 	ctlv->head.type = IPFW_TLV_TBLNAME_LIST;
2294 	ctlv->head.length = da->tcount * sizeof(ipfw_obj_ntlv) +
2295 	    sizeof(*ctlv);
2296 	ctlv->count = da->tcount;
2297 	ctlv->objsize = sizeof(ipfw_obj_ntlv);
2298 
2299 	/* Dump table names first (if any) */
2300 	error = export_named_objects(ipfw_get_table_objhash(ch), da, sd);
2301 	if (error != 0)
2302 		return (error);
2303 	/* Then dump another named objects */
2304 	da->bmask += IPFW_TABLES_MAX / 32;
2305 	return (export_named_objects(CHAIN_TO_SRV(ch), da, sd));
2306 }
2307 
2308 /*
2309  * Dumps static rules with table TLVs in buffer @sd.
2310  *
2311  * Returns 0 on success.
2312  */
2313 static int
2314 dump_static_rules(struct ip_fw_chain *chain, struct dump_args *da,
2315     struct sockopt_data *sd)
2316 {
2317 	ipfw_obj_ctlv *ctlv;
2318 	struct ip_fw *krule;
2319 	caddr_t dst;
2320 	int i, l;
2321 
2322 	/* Dump rules */
2323 	ctlv = (ipfw_obj_ctlv *)ipfw_get_sopt_space(sd, sizeof(*ctlv));
2324 	if (ctlv == NULL)
2325 		return (ENOMEM);
2326 	ctlv->head.type = IPFW_TLV_RULE_LIST;
2327 	ctlv->head.length = da->rsize + sizeof(*ctlv);
2328 	ctlv->count = da->rcount;
2329 
2330 	for (i = da->b; i < da->e; i++) {
2331 		krule = chain->map[i];
2332 
2333 		l = RULEUSIZE1(krule) + sizeof(ipfw_obj_tlv);
2334 		if (da->rcounters != 0)
2335 			l += sizeof(struct ip_fw_bcounter);
2336 		dst = (caddr_t)ipfw_get_sopt_space(sd, l);
2337 		if (dst == NULL)
2338 			return (ENOMEM);
2339 
2340 		export_rule1(krule, dst, l, da->rcounters);
2341 	}
2342 
2343 	return (0);
2344 }
2345 
2346 int
2347 ipfw_mark_object_kidx(uint32_t *bmask, uint16_t etlv, uint16_t kidx)
2348 {
2349 	uint32_t bidx;
2350 
2351 	/*
2352 	 * Maintain separate bitmasks for table and non-table objects.
2353 	 */
2354 	bidx = (etlv == IPFW_TLV_TBL_NAME) ? 0: IPFW_TABLES_MAX / 32;
2355 	bidx += kidx / 32;
2356 	if ((bmask[bidx] & (1 << (kidx % 32))) != 0)
2357 		return (0);
2358 
2359 	bmask[bidx] |= 1 << (kidx % 32);
2360 	return (1);
2361 }
2362 
2363 /*
2364  * Marks every object index used in @rule with bit in @bmask.
2365  * Used to generate bitmask of referenced tables/objects for given ruleset
2366  * or its part.
2367  */
2368 static void
2369 mark_rule_objects(struct ip_fw_chain *ch, struct ip_fw *rule,
2370     struct dump_args *da)
2371 {
2372 	struct opcode_obj_rewrite *rw;
2373 	ipfw_insn *cmd;
2374 	int cmdlen, l;
2375 	uint16_t kidx;
2376 	uint8_t subtype;
2377 
2378 	l = rule->cmd_len;
2379 	cmd = rule->cmd;
2380 	cmdlen = 0;
2381 	for ( ;	l > 0 ; l -= cmdlen, cmd += cmdlen) {
2382 		cmdlen = F_LEN(cmd);
2383 
2384 		rw = find_op_rw(cmd, &kidx, &subtype);
2385 		if (rw == NULL)
2386 			continue;
2387 
2388 		if (ipfw_mark_object_kidx(da->bmask, rw->etlv, kidx))
2389 			da->tcount++;
2390 	}
2391 }
2392 
2393 /*
2394  * Dumps requested objects data
2395  * Data layout (version 0)(current):
2396  * Request: [ ipfw_cfg_lheader ] + IPFW_CFG_GET_* flags
2397  *   size = ipfw_cfg_lheader.size
2398  * Reply: [ ipfw_cfg_lheader
2399  *   [ ipfw_obj_ctlv(IPFW_TLV_TBL_LIST) ipfw_obj_ntlv x N ] (optional)
2400  *   [ ipfw_obj_ctlv(IPFW_TLV_RULE_LIST)
2401  *     ipfw_obj_tlv(IPFW_TLV_RULE_ENT) [ ip_fw_bcounter (optional) ip_fw_rule ]
2402  *   ] (optional)
2403  *   [ ipfw_obj_ctlv(IPFW_TLV_STATE_LIST) ipfw_obj_dyntlv x N ] (optional)
2404  * ]
2405  * * NOTE IPFW_TLV_STATE_LIST has the single valid field: objsize.
2406  * The rest (size, count) are set to zero and needs to be ignored.
2407  *
2408  * Returns 0 on success.
2409  */
2410 static int
2411 dump_config(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
2412     struct sockopt_data *sd)
2413 {
2414 	struct dump_args da;
2415 	ipfw_cfg_lheader *hdr;
2416 	struct ip_fw *rule;
2417 	size_t sz, rnum;
2418 	uint32_t hdr_flags, *bmask;
2419 	int error, i;
2420 
2421 	hdr = (ipfw_cfg_lheader *)ipfw_get_sopt_header(sd, sizeof(*hdr));
2422 	if (hdr == NULL)
2423 		return (EINVAL);
2424 
2425 	error = 0;
2426 	bmask = NULL;
2427 	memset(&da, 0, sizeof(da));
2428 	/*
2429 	 * Allocate needed state.
2430 	 * Note we allocate 2xspace mask, for table & srv
2431 	 */
2432 	if (hdr->flags & (IPFW_CFG_GET_STATIC | IPFW_CFG_GET_STATES))
2433 		da.bmask = bmask = malloc(
2434 		    sizeof(uint32_t) * IPFW_TABLES_MAX * 2 / 32, M_TEMP,
2435 		    M_WAITOK | M_ZERO);
2436 	IPFW_UH_RLOCK(chain);
2437 
2438 	/*
2439 	 * STAGE 1: Determine size/count for objects in range.
2440 	 * Prepare used tables bitmask.
2441 	 */
2442 	sz = sizeof(ipfw_cfg_lheader);
2443 	da.e = chain->n_rules;
2444 
2445 	if (hdr->end_rule != 0) {
2446 		/* Handle custom range */
2447 		if ((rnum = hdr->start_rule) > IPFW_DEFAULT_RULE)
2448 			rnum = IPFW_DEFAULT_RULE;
2449 		da.b = ipfw_find_rule(chain, rnum, 0);
2450 		rnum = (hdr->end_rule < IPFW_DEFAULT_RULE) ?
2451 		    hdr->end_rule + 1: IPFW_DEFAULT_RULE;
2452 		da.e = ipfw_find_rule(chain, rnum, UINT32_MAX) + 1;
2453 	}
2454 
2455 	if (hdr->flags & IPFW_CFG_GET_STATIC) {
2456 		for (i = da.b; i < da.e; i++) {
2457 			rule = chain->map[i];
2458 			da.rsize += RULEUSIZE1(rule) + sizeof(ipfw_obj_tlv);
2459 			da.rcount++;
2460 			/* Update bitmask of used objects for given range */
2461 			mark_rule_objects(chain, rule, &da);
2462 		}
2463 		/* Add counters if requested */
2464 		if (hdr->flags & IPFW_CFG_GET_COUNTERS) {
2465 			da.rsize += sizeof(struct ip_fw_bcounter) * da.rcount;
2466 			da.rcounters = 1;
2467 		}
2468 		sz += da.rsize + sizeof(ipfw_obj_ctlv);
2469 	}
2470 
2471 	if (hdr->flags & IPFW_CFG_GET_STATES) {
2472 		sz += sizeof(ipfw_obj_ctlv) +
2473 		    ipfw_dyn_get_count(bmask, &i) * sizeof(ipfw_obj_dyntlv);
2474 		da.tcount += i;
2475 	}
2476 
2477 	if (da.tcount > 0)
2478 		sz += da.tcount * sizeof(ipfw_obj_ntlv) +
2479 		    sizeof(ipfw_obj_ctlv);
2480 
2481 	/*
2482 	 * Fill header anyway.
2483 	 * Note we have to save header fields to stable storage
2484 	 * buffer inside @sd can be flushed after dumping rules
2485 	 */
2486 	hdr->size = sz;
2487 	hdr->set_mask = ~V_set_disable;
2488 	hdr_flags = hdr->flags;
2489 	hdr = NULL;
2490 
2491 	if (sd->valsize < sz) {
2492 		error = ENOMEM;
2493 		goto cleanup;
2494 	}
2495 
2496 	/* STAGE2: Store actual data */
2497 	if (da.tcount > 0) {
2498 		error = dump_named_objects(chain, &da, sd);
2499 		if (error != 0)
2500 			goto cleanup;
2501 	}
2502 
2503 	if (hdr_flags & IPFW_CFG_GET_STATIC) {
2504 		error = dump_static_rules(chain, &da, sd);
2505 		if (error != 0)
2506 			goto cleanup;
2507 	}
2508 
2509 	if (hdr_flags & IPFW_CFG_GET_STATES)
2510 		error = ipfw_dump_states(chain, sd);
2511 
2512 cleanup:
2513 	IPFW_UH_RUNLOCK(chain);
2514 
2515 	if (bmask != NULL)
2516 		free(bmask, M_TEMP);
2517 
2518 	return (error);
2519 }
2520 
2521 int
2522 ipfw_check_object_name_generic(const char *name)
2523 {
2524 	int nsize;
2525 
2526 	nsize = sizeof(((ipfw_obj_ntlv *)0)->name);
2527 	if (strnlen(name, nsize) == nsize)
2528 		return (EINVAL);
2529 	if (name[0] == '\0')
2530 		return (EINVAL);
2531 	return (0);
2532 }
2533 
2534 /*
2535  * Creates non-existent objects referenced by rule.
2536  *
2537  * Return 0 on success.
2538  */
2539 int
2540 create_objects_compat(struct ip_fw_chain *ch, ipfw_insn *cmd,
2541     struct obj_idx *oib, struct obj_idx *pidx, struct tid_info *ti)
2542 {
2543 	struct opcode_obj_rewrite *rw;
2544 	struct obj_idx *p;
2545 	uint16_t kidx;
2546 	int error;
2547 
2548 	/*
2549 	 * Compatibility stuff: do actual creation for non-existing,
2550 	 * but referenced objects.
2551 	 */
2552 	for (p = oib; p < pidx; p++) {
2553 		if (p->kidx != 0)
2554 			continue;
2555 
2556 		ti->uidx = p->uidx;
2557 		ti->type = p->type;
2558 		ti->atype = 0;
2559 
2560 		rw = find_op_rw(cmd + p->off, NULL, NULL);
2561 		KASSERT(rw != NULL, ("Unable to find handler for op %d",
2562 		    (cmd + p->off)->opcode));
2563 
2564 		if (rw->create_object == NULL)
2565 			error = EOPNOTSUPP;
2566 		else
2567 			error = rw->create_object(ch, ti, &kidx);
2568 		if (error == 0) {
2569 			p->kidx = kidx;
2570 			continue;
2571 		}
2572 
2573 		/*
2574 		 * Error happened. We have to rollback everything.
2575 		 * Drop all already acquired references.
2576 		 */
2577 		IPFW_UH_WLOCK(ch);
2578 		unref_oib_objects(ch, cmd, oib, pidx);
2579 		IPFW_UH_WUNLOCK(ch);
2580 
2581 		return (error);
2582 	}
2583 
2584 	return (0);
2585 }
2586 
2587 /*
2588  * Compatibility function for old ipfw(8) binaries.
2589  * Rewrites table/nat kernel indices with userland ones.
2590  * Convert tables matching '/^\d+$/' to their atoi() value.
2591  * Use number 65535 for other tables.
2592  *
2593  * Returns 0 on success.
2594  */
2595 static int
2596 set_legacy_obj_kidx(struct ip_fw_chain *ch, struct ip_fw_rule0 *rule)
2597 {
2598 	struct opcode_obj_rewrite *rw;
2599 	struct named_object *no;
2600 	ipfw_insn *cmd;
2601 	char *end;
2602 	long val;
2603 	int cmdlen, error, l;
2604 	uint16_t kidx, uidx;
2605 	uint8_t subtype;
2606 
2607 	error = 0;
2608 
2609 	l = rule->cmd_len;
2610 	cmd = rule->cmd;
2611 	cmdlen = 0;
2612 	for ( ;	l > 0 ; l -= cmdlen, cmd += cmdlen) {
2613 		cmdlen = F_LEN(cmd);
2614 
2615 		/* Check if is index in given opcode */
2616 		rw = find_op_rw(cmd, &kidx, &subtype);
2617 		if (rw == NULL)
2618 			continue;
2619 
2620 		/* Try to find referenced kernel object */
2621 		no = rw->find_bykidx(ch, kidx);
2622 		if (no == NULL)
2623 			continue;
2624 
2625 		val = strtol(no->name, &end, 10);
2626 		if (*end == '\0' && val < 65535) {
2627 			uidx = val;
2628 		} else {
2629 			/*
2630 			 * We are called via legacy opcode.
2631 			 * Save error and show table as fake number
2632 			 * not to make ipfw(8) hang.
2633 			 */
2634 			uidx = 65535;
2635 			error = 2;
2636 		}
2637 
2638 		rw->update(cmd, uidx);
2639 	}
2640 
2641 	return (error);
2642 }
2643 
2644 /*
2645  * Unreferences all already-referenced objects in given @cmd rule,
2646  * using information in @oib.
2647  *
2648  * Used to rollback partially converted rule on error.
2649  */
2650 static void
2651 unref_oib_objects(struct ip_fw_chain *ch, ipfw_insn *cmd, struct obj_idx *oib,
2652     struct obj_idx *end)
2653 {
2654 	struct opcode_obj_rewrite *rw;
2655 	struct named_object *no;
2656 	struct obj_idx *p;
2657 
2658 	IPFW_UH_WLOCK_ASSERT(ch);
2659 
2660 	for (p = oib; p < end; p++) {
2661 		if (p->kidx == 0)
2662 			continue;
2663 
2664 		rw = find_op_rw(cmd + p->off, NULL, NULL);
2665 		KASSERT(rw != NULL, ("Unable to find handler for op %d",
2666 		    (cmd + p->off)->opcode));
2667 
2668 		/* Find & unref by existing idx */
2669 		no = rw->find_bykidx(ch, p->kidx);
2670 		KASSERT(no != NULL, ("Ref'd object %d disappeared", p->kidx));
2671 		no->refcnt--;
2672 	}
2673 }
2674 
2675 /*
2676  * Remove references from every object used in @rule.
2677  * Used at rule removal code.
2678  */
2679 static void
2680 unref_rule_objects(struct ip_fw_chain *ch, struct ip_fw *rule)
2681 {
2682 	struct opcode_obj_rewrite *rw;
2683 	struct named_object *no;
2684 	ipfw_insn *cmd;
2685 	int cmdlen, l;
2686 	uint16_t kidx;
2687 	uint8_t subtype;
2688 
2689 	IPFW_UH_WLOCK_ASSERT(ch);
2690 
2691 	l = rule->cmd_len;
2692 	cmd = rule->cmd;
2693 	cmdlen = 0;
2694 	for ( ;	l > 0 ; l -= cmdlen, cmd += cmdlen) {
2695 		cmdlen = F_LEN(cmd);
2696 
2697 		rw = find_op_rw(cmd, &kidx, &subtype);
2698 		if (rw == NULL)
2699 			continue;
2700 		no = rw->find_bykidx(ch, kidx);
2701 
2702 		KASSERT(no != NULL, ("object id %d not found", kidx));
2703 		KASSERT(no->subtype == subtype,
2704 		    ("wrong type %d (%d) for object id %d",
2705 		    no->subtype, subtype, kidx));
2706 		KASSERT(no->refcnt > 0, ("refcount for object %d is %d",
2707 		    kidx, no->refcnt));
2708 
2709 		if (no->refcnt == 1 && rw->destroy_object != NULL)
2710 			rw->destroy_object(ch, no);
2711 		else
2712 			no->refcnt--;
2713 	}
2714 }
2715 
2716 /*
2717  * Find and reference object (if any) stored in instruction @cmd.
2718  *
2719  * Saves object info in @pidx, sets
2720  *  - @unresolved to 1 if object should exists but not found
2721  *
2722  * Returns non-zero value in case of error.
2723  */
2724 static int
2725 ref_opcode_object(struct ip_fw_chain *ch, ipfw_insn *cmd, struct tid_info *ti,
2726     struct obj_idx *pidx, int *unresolved)
2727 {
2728 	struct named_object *no;
2729 	struct opcode_obj_rewrite *rw;
2730 	int error;
2731 
2732 	/* Check if this opcode is candidate for rewrite */
2733 	rw = find_op_rw(cmd, &ti->uidx, &ti->type);
2734 	if (rw == NULL)
2735 		return (0);
2736 
2737 	/* Need to rewrite. Save necessary fields */
2738 	pidx->uidx = ti->uidx;
2739 	pidx->type = ti->type;
2740 
2741 	/* Try to find referenced kernel object */
2742 	error = rw->find_byname(ch, ti, &no);
2743 	if (error != 0)
2744 		return (error);
2745 	if (no == NULL) {
2746 		/*
2747 		 * Report about unresolved object for automaic
2748 		 * creation.
2749 		 */
2750 		*unresolved = 1;
2751 		return (0);
2752 	}
2753 
2754 	/*
2755 	 * Object is already exist.
2756 	 * Its subtype should match with expected value.
2757 	 */
2758 	if (ti->type != no->subtype)
2759 		return (EINVAL);
2760 
2761 	/* Bump refcount and update kidx. */
2762 	no->refcnt++;
2763 	rw->update(cmd, no->kidx);
2764 	return (0);
2765 }
2766 
2767 /*
2768  * Finds and bumps refcount for objects referenced by given @rule.
2769  * Auto-creates non-existing tables.
2770  * Fills in @oib array with userland/kernel indexes.
2771  *
2772  * Returns 0 on success.
2773  */
2774 static int
2775 ref_rule_objects(struct ip_fw_chain *ch, struct ip_fw *rule,
2776     struct rule_check_info *ci, struct obj_idx *oib, struct tid_info *ti)
2777 {
2778 	struct obj_idx *pidx;
2779 	ipfw_insn *cmd;
2780 	int cmdlen, error, l, unresolved;
2781 
2782 	pidx = oib;
2783 	l = rule->cmd_len;
2784 	cmd = rule->cmd;
2785 	cmdlen = 0;
2786 	error = 0;
2787 
2788 	IPFW_UH_WLOCK(ch);
2789 
2790 	/* Increase refcount on each existing referenced table. */
2791 	for ( ;	l > 0 ; l -= cmdlen, cmd += cmdlen) {
2792 		cmdlen = F_LEN(cmd);
2793 		unresolved = 0;
2794 
2795 		error = ref_opcode_object(ch, cmd, ti, pidx, &unresolved);
2796 		if (error != 0)
2797 			break;
2798 		/*
2799 		 * Compatibility stuff for old clients:
2800 		 * prepare to automaitcally create non-existing objects.
2801 		 */
2802 		if (unresolved != 0) {
2803 			pidx->off = rule->cmd_len - l;
2804 			pidx++;
2805 		}
2806 	}
2807 
2808 	if (error != 0) {
2809 		/* Unref everything we have already done */
2810 		unref_oib_objects(ch, rule->cmd, oib, pidx);
2811 		IPFW_UH_WUNLOCK(ch);
2812 		return (error);
2813 	}
2814 	IPFW_UH_WUNLOCK(ch);
2815 
2816 	/* Perform auto-creation for non-existing objects */
2817 	if (pidx != oib)
2818 		error = create_objects_compat(ch, rule->cmd, oib, pidx, ti);
2819 
2820 	/* Calculate real number of dynamic objects */
2821 	ci->object_opcodes = (uint16_t)(pidx - oib);
2822 
2823 	return (error);
2824 }
2825 
2826 /*
2827  * Checks is opcode is referencing table of appropriate type.
2828  * Adds reference count for found table if true.
2829  * Rewrites user-supplied opcode values with kernel ones.
2830  *
2831  * Returns 0 on success and appropriate error code otherwise.
2832  */
2833 static int
2834 rewrite_rule_uidx(struct ip_fw_chain *chain, struct rule_check_info *ci)
2835 {
2836 	int error;
2837 	ipfw_insn *cmd;
2838 	struct obj_idx *p, *pidx_first, *pidx_last;
2839 	struct tid_info ti;
2840 
2841 	/*
2842 	 * Prepare an array for storing opcode indices.
2843 	 * Use stack allocation by default.
2844 	 */
2845 	if (ci->object_opcodes <= (sizeof(ci->obuf)/sizeof(ci->obuf[0]))) {
2846 		/* Stack */
2847 		pidx_first = ci->obuf;
2848 	} else
2849 		pidx_first = malloc(
2850 		    ci->object_opcodes * sizeof(struct obj_idx),
2851 		    M_IPFW, M_WAITOK | M_ZERO);
2852 
2853 	error = 0;
2854 	memset(&ti, 0, sizeof(ti));
2855 
2856 	/* Use set rule is assigned to. */
2857 	ti.set = ci->krule->set;
2858 	if (ci->ctlv != NULL) {
2859 		ti.tlvs = (void *)(ci->ctlv + 1);
2860 		ti.tlen = ci->ctlv->head.length - sizeof(ipfw_obj_ctlv);
2861 	}
2862 
2863 	/* Reference all used tables and other objects */
2864 	error = ref_rule_objects(chain, ci->krule, ci, pidx_first, &ti);
2865 	if (error != 0)
2866 		goto free;
2867 	/*
2868 	 * Note that ref_rule_objects() might have updated ci->object_opcodes
2869 	 * to reflect actual number of object opcodes.
2870 	 */
2871 
2872 	/* Perform rewrite of remaining opcodes */
2873 	p = pidx_first;
2874 	pidx_last = pidx_first + ci->object_opcodes;
2875 	for (p = pidx_first; p < pidx_last; p++) {
2876 		cmd = ci->krule->cmd + p->off;
2877 		update_opcode_kidx(cmd, p->kidx);
2878 	}
2879 
2880 free:
2881 	if (pidx_first != ci->obuf)
2882 		free(pidx_first, M_IPFW);
2883 
2884 	return (error);
2885 }
2886 
2887 /*
2888  * Adds one or more rules to ipfw @chain.
2889  * Data layout (version 0)(current):
2890  * Request:
2891  * [
2892  *   ip_fw3_opheader
2893  *   [ ipfw_obj_ctlv(IPFW_TLV_TBL_LIST) ipfw_obj_ntlv x N ] (optional *1)
2894  *   [ ipfw_obj_ctlv(IPFW_TLV_RULE_LIST) ip_fw x N ] (*2) (*3)
2895  * ]
2896  * Reply:
2897  * [
2898  *   ip_fw3_opheader
2899  *   [ ipfw_obj_ctlv(IPFW_TLV_TBL_LIST) ipfw_obj_ntlv x N ] (optional)
2900  *   [ ipfw_obj_ctlv(IPFW_TLV_RULE_LIST) ip_fw x N ]
2901  * ]
2902  *
2903  * Rules in reply are modified to store their actual ruleset number.
2904  *
2905  * (*1) TLVs inside IPFW_TLV_TBL_LIST needs to be sorted ascending
2906  * according to their idx field and there has to be no duplicates.
2907  * (*2) Numbered rules inside IPFW_TLV_RULE_LIST needs to be sorted ascending.
2908  * (*3) Each ip_fw structure needs to be aligned to u64 boundary.
2909  *
2910  * Returns 0 on success.
2911  */
2912 static int
2913 add_rules(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
2914     struct sockopt_data *sd)
2915 {
2916 	ipfw_obj_ctlv *ctlv, *rtlv, *tstate;
2917 	ipfw_obj_ntlv *ntlv;
2918 	int clen, error, idx;
2919 	uint32_t count, read;
2920 	struct ip_fw_rule *r;
2921 	struct rule_check_info rci, *ci, *cbuf;
2922 	int i, rsize;
2923 
2924 	op3 = (ip_fw3_opheader *)ipfw_get_sopt_space(sd, sd->valsize);
2925 	ctlv = (ipfw_obj_ctlv *)(op3 + 1);
2926 
2927 	read = sizeof(ip_fw3_opheader);
2928 	rtlv = NULL;
2929 	tstate = NULL;
2930 	cbuf = NULL;
2931 	memset(&rci, 0, sizeof(struct rule_check_info));
2932 
2933 	if (read + sizeof(*ctlv) > sd->valsize)
2934 		return (EINVAL);
2935 
2936 	if (ctlv->head.type == IPFW_TLV_TBLNAME_LIST) {
2937 		clen = ctlv->head.length;
2938 		/* Check size and alignment */
2939 		if (clen > sd->valsize || clen < sizeof(*ctlv))
2940 			return (EINVAL);
2941 		if ((clen % sizeof(uint64_t)) != 0)
2942 			return (EINVAL);
2943 
2944 		/*
2945 		 * Some table names or other named objects.
2946 		 * Check for validness.
2947 		 */
2948 		count = (ctlv->head.length - sizeof(*ctlv)) / sizeof(*ntlv);
2949 		if (ctlv->count != count || ctlv->objsize != sizeof(*ntlv))
2950 			return (EINVAL);
2951 
2952 		/*
2953 		 * Check each TLV.
2954 		 * Ensure TLVs are sorted ascending and
2955 		 * there are no duplicates.
2956 		 */
2957 		idx = -1;
2958 		ntlv = (ipfw_obj_ntlv *)(ctlv + 1);
2959 		while (count > 0) {
2960 			if (ntlv->head.length != sizeof(ipfw_obj_ntlv))
2961 				return (EINVAL);
2962 
2963 			error = ipfw_check_object_name_generic(ntlv->name);
2964 			if (error != 0)
2965 				return (error);
2966 
2967 			if (ntlv->idx <= idx)
2968 				return (EINVAL);
2969 
2970 			idx = ntlv->idx;
2971 			count--;
2972 			ntlv++;
2973 		}
2974 
2975 		tstate = ctlv;
2976 		read += ctlv->head.length;
2977 		ctlv = (ipfw_obj_ctlv *)((caddr_t)ctlv + ctlv->head.length);
2978 	}
2979 
2980 	if (read + sizeof(*ctlv) > sd->valsize)
2981 		return (EINVAL);
2982 
2983 	if (ctlv->head.type == IPFW_TLV_RULE_LIST) {
2984 		clen = ctlv->head.length;
2985 		if (clen + read > sd->valsize || clen < sizeof(*ctlv))
2986 			return (EINVAL);
2987 		if ((clen % sizeof(uint64_t)) != 0)
2988 			return (EINVAL);
2989 
2990 		/*
2991 		 * TODO: Permit adding multiple rules at once
2992 		 */
2993 		if (ctlv->count != 1)
2994 			return (ENOTSUP);
2995 
2996 		clen -= sizeof(*ctlv);
2997 
2998 		if (ctlv->count > clen / sizeof(struct ip_fw_rule))
2999 			return (EINVAL);
3000 
3001 		/* Allocate state for each rule or use stack */
3002 		if (ctlv->count == 1) {
3003 			memset(&rci, 0, sizeof(struct rule_check_info));
3004 			cbuf = &rci;
3005 		} else
3006 			cbuf = malloc(ctlv->count * sizeof(*ci), M_TEMP,
3007 			    M_WAITOK | M_ZERO);
3008 		ci = cbuf;
3009 
3010 		/*
3011 		 * Check each rule for validness.
3012 		 * Ensure numbered rules are sorted ascending
3013 		 * and properly aligned
3014 		 */
3015 		idx = 0;
3016 		r = (struct ip_fw_rule *)(ctlv + 1);
3017 		count = 0;
3018 		error = 0;
3019 		while (clen > 0) {
3020 			rsize = roundup2(RULESIZE(r), sizeof(uint64_t));
3021 			if (rsize > clen || ctlv->count <= count) {
3022 				error = EINVAL;
3023 				break;
3024 			}
3025 
3026 			ci->ctlv = tstate;
3027 			error = check_ipfw_rule1(r, rsize, ci);
3028 			if (error != 0)
3029 				break;
3030 
3031 			/* Check sorting */
3032 			if (r->rulenum != 0 && r->rulenum < idx) {
3033 				printf("rulenum %d idx %d\n", r->rulenum, idx);
3034 				error = EINVAL;
3035 				break;
3036 			}
3037 			idx = r->rulenum;
3038 
3039 			ci->urule = (caddr_t)r;
3040 
3041 			rsize = roundup2(rsize, sizeof(uint64_t));
3042 			clen -= rsize;
3043 			r = (struct ip_fw_rule *)((caddr_t)r + rsize);
3044 			count++;
3045 			ci++;
3046 		}
3047 
3048 		if (ctlv->count != count || error != 0) {
3049 			if (cbuf != &rci)
3050 				free(cbuf, M_TEMP);
3051 			return (EINVAL);
3052 		}
3053 
3054 		rtlv = ctlv;
3055 		read += ctlv->head.length;
3056 		ctlv = (ipfw_obj_ctlv *)((caddr_t)ctlv + ctlv->head.length);
3057 	}
3058 
3059 	if (read != sd->valsize || rtlv == NULL || rtlv->count == 0) {
3060 		if (cbuf != NULL && cbuf != &rci)
3061 			free(cbuf, M_TEMP);
3062 		return (EINVAL);
3063 	}
3064 
3065 	/*
3066 	 * Passed rules seems to be valid.
3067 	 * Allocate storage and try to add them to chain.
3068 	 */
3069 	for (i = 0, ci = cbuf; i < rtlv->count; i++, ci++) {
3070 		clen = RULEKSIZE1((struct ip_fw_rule *)ci->urule);
3071 		ci->krule = ipfw_alloc_rule(chain, clen);
3072 		import_rule1(ci);
3073 	}
3074 
3075 	if ((error = commit_rules(chain, cbuf, rtlv->count)) != 0) {
3076 		/* Free allocate krules */
3077 		for (i = 0, ci = cbuf; i < rtlv->count; i++, ci++)
3078 			ipfw_free_rule(ci->krule);
3079 	}
3080 
3081 	if (cbuf != NULL && cbuf != &rci)
3082 		free(cbuf, M_TEMP);
3083 
3084 	return (error);
3085 }
3086 
3087 /*
3088  * Lists all sopts currently registered.
3089  * Data layout (v0)(current):
3090  * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size
3091  * Reply: [ ipfw_obj_lheader ipfw_sopt_info x N ]
3092  *
3093  * Returns 0 on success
3094  */
3095 static int
3096 dump_soptcodes(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
3097     struct sockopt_data *sd)
3098 {
3099 	struct _ipfw_obj_lheader *olh;
3100 	ipfw_sopt_info *i;
3101 	struct ipfw_sopt_handler *sh;
3102 	uint32_t count, n, size;
3103 
3104 	olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh));
3105 	if (olh == NULL)
3106 		return (EINVAL);
3107 	if (sd->valsize < olh->size)
3108 		return (EINVAL);
3109 
3110 	CTL3_LOCK();
3111 	count = ctl3_hsize;
3112 	size = count * sizeof(ipfw_sopt_info) + sizeof(ipfw_obj_lheader);
3113 
3114 	/* Fill in header regadless of buffer size */
3115 	olh->count = count;
3116 	olh->objsize = sizeof(ipfw_sopt_info);
3117 
3118 	if (size > olh->size) {
3119 		olh->size = size;
3120 		CTL3_UNLOCK();
3121 		return (ENOMEM);
3122 	}
3123 	olh->size = size;
3124 
3125 	for (n = 1; n <= count; n++) {
3126 		i = (ipfw_sopt_info *)ipfw_get_sopt_space(sd, sizeof(*i));
3127 		KASSERT(i != NULL, ("previously checked buffer is not enough"));
3128 		sh = &ctl3_handlers[n];
3129 		i->opcode = sh->opcode;
3130 		i->version = sh->version;
3131 		i->refcnt = sh->refcnt;
3132 	}
3133 	CTL3_UNLOCK();
3134 
3135 	return (0);
3136 }
3137 
3138 /*
3139  * Compares two opcodes.
3140  * Used both in qsort() and bsearch().
3141  *
3142  * Returns 0 if match is found.
3143  */
3144 static int
3145 compare_opcodes(const void *_a, const void *_b)
3146 {
3147 	const struct opcode_obj_rewrite *a, *b;
3148 
3149 	a = (const struct opcode_obj_rewrite *)_a;
3150 	b = (const struct opcode_obj_rewrite *)_b;
3151 
3152 	if (a->opcode < b->opcode)
3153 		return (-1);
3154 	else if (a->opcode > b->opcode)
3155 		return (1);
3156 
3157 	return (0);
3158 }
3159 
3160 /*
3161  * XXX: Rewrite bsearch()
3162  */
3163 static int
3164 find_op_rw_range(uint16_t op, struct opcode_obj_rewrite **plo,
3165     struct opcode_obj_rewrite **phi)
3166 {
3167 	struct opcode_obj_rewrite *ctl3_max, *lo, *hi, h, *rw;
3168 
3169 	memset(&h, 0, sizeof(h));
3170 	h.opcode = op;
3171 
3172 	rw = (struct opcode_obj_rewrite *)bsearch(&h, ctl3_rewriters,
3173 	    ctl3_rsize, sizeof(h), compare_opcodes);
3174 	if (rw == NULL)
3175 		return (1);
3176 
3177 	/* Find the first element matching the same opcode */
3178 	lo = rw;
3179 	for ( ; lo > ctl3_rewriters && (lo - 1)->opcode == op; lo--)
3180 		;
3181 
3182 	/* Find the last element matching the same opcode */
3183 	hi = rw;
3184 	ctl3_max = ctl3_rewriters + ctl3_rsize;
3185 	for ( ; (hi + 1) < ctl3_max && (hi + 1)->opcode == op; hi++)
3186 		;
3187 
3188 	*plo = lo;
3189 	*phi = hi;
3190 
3191 	return (0);
3192 }
3193 
3194 /*
3195  * Finds opcode object rewriter based on @code.
3196  *
3197  * Returns pointer to handler or NULL.
3198  */
3199 static struct opcode_obj_rewrite *
3200 find_op_rw(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
3201 {
3202 	struct opcode_obj_rewrite *rw, *lo, *hi;
3203 	uint16_t uidx;
3204 	uint8_t subtype;
3205 
3206 	if (find_op_rw_range(cmd->opcode, &lo, &hi) != 0)
3207 		return (NULL);
3208 
3209 	for (rw = lo; rw <= hi; rw++) {
3210 		if (rw->classifier(cmd, &uidx, &subtype) == 0) {
3211 			if (puidx != NULL)
3212 				*puidx = uidx;
3213 			if (ptype != NULL)
3214 				*ptype = subtype;
3215 			return (rw);
3216 		}
3217 	}
3218 
3219 	return (NULL);
3220 }
3221 int
3222 classify_opcode_kidx(ipfw_insn *cmd, uint16_t *puidx)
3223 {
3224 
3225 	if (find_op_rw(cmd, puidx, NULL) == NULL)
3226 		return (1);
3227 	return (0);
3228 }
3229 
3230 void
3231 update_opcode_kidx(ipfw_insn *cmd, uint16_t idx)
3232 {
3233 	struct opcode_obj_rewrite *rw;
3234 
3235 	rw = find_op_rw(cmd, NULL, NULL);
3236 	KASSERT(rw != NULL, ("No handler to update opcode %d", cmd->opcode));
3237 	rw->update(cmd, idx);
3238 }
3239 
3240 void
3241 ipfw_init_obj_rewriter(void)
3242 {
3243 
3244 	ctl3_rewriters = NULL;
3245 	ctl3_rsize = 0;
3246 }
3247 
3248 void
3249 ipfw_destroy_obj_rewriter(void)
3250 {
3251 
3252 	if (ctl3_rewriters != NULL)
3253 		free(ctl3_rewriters, M_IPFW);
3254 	ctl3_rewriters = NULL;
3255 	ctl3_rsize = 0;
3256 }
3257 
3258 /*
3259  * Adds one or more opcode object rewrite handlers to the global array.
3260  * Function may sleep.
3261  */
3262 void
3263 ipfw_add_obj_rewriter(struct opcode_obj_rewrite *rw, size_t count)
3264 {
3265 	size_t sz;
3266 	struct opcode_obj_rewrite *tmp;
3267 
3268 	CTL3_LOCK();
3269 
3270 	for (;;) {
3271 		sz = ctl3_rsize + count;
3272 		CTL3_UNLOCK();
3273 		tmp = malloc(sizeof(*rw) * sz, M_IPFW, M_WAITOK | M_ZERO);
3274 		CTL3_LOCK();
3275 		if (ctl3_rsize + count <= sz)
3276 			break;
3277 
3278 		/* Retry */
3279 		free(tmp, M_IPFW);
3280 	}
3281 
3282 	/* Merge old & new arrays */
3283 	sz = ctl3_rsize + count;
3284 	memcpy(tmp, ctl3_rewriters, ctl3_rsize * sizeof(*rw));
3285 	memcpy(&tmp[ctl3_rsize], rw, count * sizeof(*rw));
3286 	qsort(tmp, sz, sizeof(*rw), compare_opcodes);
3287 	/* Switch new and free old */
3288 	if (ctl3_rewriters != NULL)
3289 		free(ctl3_rewriters, M_IPFW);
3290 	ctl3_rewriters = tmp;
3291 	ctl3_rsize = sz;
3292 
3293 	CTL3_UNLOCK();
3294 }
3295 
3296 /*
3297  * Removes one or more object rewrite handlers from the global array.
3298  */
3299 int
3300 ipfw_del_obj_rewriter(struct opcode_obj_rewrite *rw, size_t count)
3301 {
3302 	size_t sz;
3303 	struct opcode_obj_rewrite *ctl3_max, *ktmp, *lo, *hi;
3304 	int i;
3305 
3306 	CTL3_LOCK();
3307 
3308 	for (i = 0; i < count; i++) {
3309 		if (find_op_rw_range(rw[i].opcode, &lo, &hi) != 0)
3310 			continue;
3311 
3312 		for (ktmp = lo; ktmp <= hi; ktmp++) {
3313 			if (ktmp->classifier != rw[i].classifier)
3314 				continue;
3315 
3316 			ctl3_max = ctl3_rewriters + ctl3_rsize;
3317 			sz = (ctl3_max - (ktmp + 1)) * sizeof(*ktmp);
3318 			memmove(ktmp, ktmp + 1, sz);
3319 			ctl3_rsize--;
3320 			break;
3321 		}
3322 	}
3323 
3324 	if (ctl3_rsize == 0) {
3325 		if (ctl3_rewriters != NULL)
3326 			free(ctl3_rewriters, M_IPFW);
3327 		ctl3_rewriters = NULL;
3328 	}
3329 
3330 	CTL3_UNLOCK();
3331 
3332 	return (0);
3333 }
3334 
3335 static int
3336 export_objhash_ntlv_internal(struct namedobj_instance *ni,
3337     struct named_object *no, void *arg)
3338 {
3339 	struct sockopt_data *sd;
3340 	ipfw_obj_ntlv *ntlv;
3341 
3342 	sd = (struct sockopt_data *)arg;
3343 	ntlv = (ipfw_obj_ntlv *)ipfw_get_sopt_space(sd, sizeof(*ntlv));
3344 	if (ntlv == NULL)
3345 		return (ENOMEM);
3346 	ipfw_export_obj_ntlv(no, ntlv);
3347 	return (0);
3348 }
3349 
3350 /*
3351  * Lists all service objects.
3352  * Data layout (v0)(current):
3353  * Request: [ ipfw_obj_lheader ] size = ipfw_obj_lheader.size
3354  * Reply: [ ipfw_obj_lheader [ ipfw_obj_ntlv x N ] (optional) ]
3355  * Returns 0 on success
3356  */
3357 static int
3358 dump_srvobjects(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
3359     struct sockopt_data *sd)
3360 {
3361 	ipfw_obj_lheader *hdr;
3362 	int count;
3363 
3364 	hdr = (ipfw_obj_lheader *)ipfw_get_sopt_header(sd, sizeof(*hdr));
3365 	if (hdr == NULL)
3366 		return (EINVAL);
3367 
3368 	IPFW_UH_RLOCK(chain);
3369 	count = ipfw_objhash_count(CHAIN_TO_SRV(chain));
3370 	hdr->size = sizeof(ipfw_obj_lheader) + count * sizeof(ipfw_obj_ntlv);
3371 	if (sd->valsize < hdr->size) {
3372 		IPFW_UH_RUNLOCK(chain);
3373 		return (ENOMEM);
3374 	}
3375 	hdr->count = count;
3376 	hdr->objsize = sizeof(ipfw_obj_ntlv);
3377 	if (count > 0)
3378 		ipfw_objhash_foreach(CHAIN_TO_SRV(chain),
3379 		    export_objhash_ntlv_internal, sd);
3380 	IPFW_UH_RUNLOCK(chain);
3381 	return (0);
3382 }
3383 
3384 /*
3385  * Compares two sopt handlers (code, version and handler ptr).
3386  * Used both as qsort() and bsearch().
3387  * Does not compare handler for latter case.
3388  *
3389  * Returns 0 if match is found.
3390  */
3391 static int
3392 compare_sh(const void *_a, const void *_b)
3393 {
3394 	const struct ipfw_sopt_handler *a, *b;
3395 
3396 	a = (const struct ipfw_sopt_handler *)_a;
3397 	b = (const struct ipfw_sopt_handler *)_b;
3398 
3399 	if (a->opcode < b->opcode)
3400 		return (-1);
3401 	else if (a->opcode > b->opcode)
3402 		return (1);
3403 
3404 	if (a->version < b->version)
3405 		return (-1);
3406 	else if (a->version > b->version)
3407 		return (1);
3408 
3409 	/* bsearch helper */
3410 	if (a->handler == NULL)
3411 		return (0);
3412 
3413 	if ((uintptr_t)a->handler < (uintptr_t)b->handler)
3414 		return (-1);
3415 	else if ((uintptr_t)a->handler > (uintptr_t)b->handler)
3416 		return (1);
3417 
3418 	return (0);
3419 }
3420 
3421 /*
3422  * Finds sopt handler based on @code and @version.
3423  *
3424  * Returns pointer to handler or NULL.
3425  */
3426 static struct ipfw_sopt_handler *
3427 find_sh(uint16_t code, uint8_t version, sopt_handler_f *handler)
3428 {
3429 	struct ipfw_sopt_handler *sh, h;
3430 
3431 	memset(&h, 0, sizeof(h));
3432 	h.opcode = code;
3433 	h.version = version;
3434 	h.handler = handler;
3435 
3436 	sh = (struct ipfw_sopt_handler *)bsearch(&h, ctl3_handlers,
3437 	    ctl3_hsize, sizeof(h), compare_sh);
3438 
3439 	return (sh);
3440 }
3441 
3442 static int
3443 find_ref_sh(uint16_t opcode, uint8_t version, struct ipfw_sopt_handler *psh)
3444 {
3445 	struct ipfw_sopt_handler *sh;
3446 
3447 	CTL3_LOCK();
3448 	if ((sh = find_sh(opcode, version, NULL)) == NULL) {
3449 		CTL3_UNLOCK();
3450 		printf("ipfw: ipfw_ctl3 invalid option %d""v""%d\n",
3451 		    opcode, version);
3452 		return (EINVAL);
3453 	}
3454 	sh->refcnt++;
3455 	ctl3_refct++;
3456 	/* Copy handler data to requested buffer */
3457 	*psh = *sh;
3458 	CTL3_UNLOCK();
3459 
3460 	return (0);
3461 }
3462 
3463 static void
3464 find_unref_sh(struct ipfw_sopt_handler *psh)
3465 {
3466 	struct ipfw_sopt_handler *sh;
3467 
3468 	CTL3_LOCK();
3469 	sh = find_sh(psh->opcode, psh->version, NULL);
3470 	KASSERT(sh != NULL, ("ctl3 handler disappeared"));
3471 	sh->refcnt--;
3472 	ctl3_refct--;
3473 	CTL3_UNLOCK();
3474 }
3475 
3476 void
3477 ipfw_init_sopt_handler(void)
3478 {
3479 
3480 	CTL3_LOCK_INIT();
3481 	IPFW_ADD_SOPT_HANDLER(1, scodes);
3482 }
3483 
3484 void
3485 ipfw_destroy_sopt_handler(void)
3486 {
3487 
3488 	IPFW_DEL_SOPT_HANDLER(1, scodes);
3489 	CTL3_LOCK_DESTROY();
3490 }
3491 
3492 /*
3493  * Adds one or more sockopt handlers to the global array.
3494  * Function may sleep.
3495  */
3496 void
3497 ipfw_add_sopt_handler(struct ipfw_sopt_handler *sh, size_t count)
3498 {
3499 	size_t sz;
3500 	struct ipfw_sopt_handler *tmp;
3501 
3502 	CTL3_LOCK();
3503 
3504 	for (;;) {
3505 		sz = ctl3_hsize + count;
3506 		CTL3_UNLOCK();
3507 		tmp = malloc(sizeof(*sh) * sz, M_IPFW, M_WAITOK | M_ZERO);
3508 		CTL3_LOCK();
3509 		if (ctl3_hsize + count <= sz)
3510 			break;
3511 
3512 		/* Retry */
3513 		free(tmp, M_IPFW);
3514 	}
3515 
3516 	/* Merge old & new arrays */
3517 	sz = ctl3_hsize + count;
3518 	memcpy(tmp, ctl3_handlers, ctl3_hsize * sizeof(*sh));
3519 	memcpy(&tmp[ctl3_hsize], sh, count * sizeof(*sh));
3520 	qsort(tmp, sz, sizeof(*sh), compare_sh);
3521 	/* Switch new and free old */
3522 	if (ctl3_handlers != NULL)
3523 		free(ctl3_handlers, M_IPFW);
3524 	ctl3_handlers = tmp;
3525 	ctl3_hsize = sz;
3526 	ctl3_gencnt++;
3527 
3528 	CTL3_UNLOCK();
3529 }
3530 
3531 /*
3532  * Removes one or more sockopt handlers from the global array.
3533  */
3534 int
3535 ipfw_del_sopt_handler(struct ipfw_sopt_handler *sh, size_t count)
3536 {
3537 	size_t sz;
3538 	struct ipfw_sopt_handler *tmp, *h;
3539 	int i;
3540 
3541 	CTL3_LOCK();
3542 
3543 	for (i = 0; i < count; i++) {
3544 		tmp = &sh[i];
3545 		h = find_sh(tmp->opcode, tmp->version, tmp->handler);
3546 		if (h == NULL)
3547 			continue;
3548 
3549 		sz = (ctl3_handlers + ctl3_hsize - (h + 1)) * sizeof(*h);
3550 		memmove(h, h + 1, sz);
3551 		ctl3_hsize--;
3552 	}
3553 
3554 	if (ctl3_hsize == 0) {
3555 		if (ctl3_handlers != NULL)
3556 			free(ctl3_handlers, M_IPFW);
3557 		ctl3_handlers = NULL;
3558 	}
3559 
3560 	ctl3_gencnt++;
3561 
3562 	CTL3_UNLOCK();
3563 
3564 	return (0);
3565 }
3566 
3567 /*
3568  * Writes data accumulated in @sd to sockopt buffer.
3569  * Zeroes internal @sd buffer.
3570  */
3571 static int
3572 ipfw_flush_sopt_data(struct sockopt_data *sd)
3573 {
3574 	struct sockopt *sopt;
3575 	int error;
3576 	size_t sz;
3577 
3578 	sz = sd->koff;
3579 	if (sz == 0)
3580 		return (0);
3581 
3582 	sopt = sd->sopt;
3583 
3584 	if (sopt->sopt_dir == SOPT_GET) {
3585 		error = copyout(sd->kbuf, sopt->sopt_val, sz);
3586 		if (error != 0)
3587 			return (error);
3588 	}
3589 
3590 	memset(sd->kbuf, 0, sd->ksize);
3591 	sd->ktotal += sz;
3592 	sd->koff = 0;
3593 	if (sd->ktotal + sd->ksize < sd->valsize)
3594 		sd->kavail = sd->ksize;
3595 	else
3596 		sd->kavail = sd->valsize - sd->ktotal;
3597 
3598 	/* Update sopt buffer data */
3599 	sopt->sopt_valsize = sd->ktotal;
3600 	sopt->sopt_val = sd->sopt_val + sd->ktotal;
3601 
3602 	return (0);
3603 }
3604 
3605 /*
3606  * Ensures that @sd buffer has contiguous @neeeded number of
3607  * bytes.
3608  *
3609  * Returns pointer to requested space or NULL.
3610  */
3611 caddr_t
3612 ipfw_get_sopt_space(struct sockopt_data *sd, size_t needed)
3613 {
3614 	int error;
3615 	caddr_t addr;
3616 
3617 	if (sd->kavail < needed) {
3618 		/*
3619 		 * Flush data and try another time.
3620 		 */
3621 		error = ipfw_flush_sopt_data(sd);
3622 
3623 		if (sd->kavail < needed || error != 0)
3624 			return (NULL);
3625 	}
3626 
3627 	addr = sd->kbuf + sd->koff;
3628 	sd->koff += needed;
3629 	sd->kavail -= needed;
3630 	return (addr);
3631 }
3632 
3633 /*
3634  * Requests @needed contiguous bytes from @sd buffer.
3635  * Function is used to notify subsystem that we are
3636  * interesed in first @needed bytes (request header)
3637  * and the rest buffer can be safely zeroed.
3638  *
3639  * Returns pointer to requested space or NULL.
3640  */
3641 caddr_t
3642 ipfw_get_sopt_header(struct sockopt_data *sd, size_t needed)
3643 {
3644 	caddr_t addr;
3645 
3646 	if ((addr = ipfw_get_sopt_space(sd, needed)) == NULL)
3647 		return (NULL);
3648 
3649 	if (sd->kavail > 0)
3650 		memset(sd->kbuf + sd->koff, 0, sd->kavail);
3651 
3652 	return (addr);
3653 }
3654 
3655 /*
3656  * New sockopt handler.
3657  */
3658 int
3659 ipfw_ctl3(struct sockopt *sopt)
3660 {
3661 	int error, locked;
3662 	size_t size, valsize;
3663 	struct ip_fw_chain *chain;
3664 	char xbuf[256];
3665 	struct sockopt_data sdata;
3666 	struct ipfw_sopt_handler h;
3667 	ip_fw3_opheader *op3 = NULL;
3668 
3669 	error = priv_check(sopt->sopt_td, PRIV_NETINET_IPFW);
3670 	if (error != 0)
3671 		return (error);
3672 
3673 	if (sopt->sopt_name != IP_FW3)
3674 		return (ipfw_ctl(sopt));
3675 
3676 	chain = &V_layer3_chain;
3677 	error = 0;
3678 
3679 	/* Save original valsize before it is altered via sooptcopyin() */
3680 	valsize = sopt->sopt_valsize;
3681 	memset(&sdata, 0, sizeof(sdata));
3682 	/* Read op3 header first to determine actual operation */
3683 	op3 = (ip_fw3_opheader *)xbuf;
3684 	error = sooptcopyin(sopt, op3, sizeof(*op3), sizeof(*op3));
3685 	if (error != 0)
3686 		return (error);
3687 	sopt->sopt_valsize = valsize;
3688 
3689 	/*
3690 	 * Find and reference command.
3691 	 */
3692 	error = find_ref_sh(op3->opcode, op3->version, &h);
3693 	if (error != 0)
3694 		return (error);
3695 
3696 	/*
3697 	 * Disallow modifications in really-really secure mode, but still allow
3698 	 * the logging counters to be reset.
3699 	 */
3700 	if ((h.dir & HDIR_SET) != 0 && h.opcode != IP_FW_XRESETLOG) {
3701 		error = securelevel_ge(sopt->sopt_td->td_ucred, 3);
3702 		if (error != 0) {
3703 			find_unref_sh(&h);
3704 			return (error);
3705 		}
3706 	}
3707 
3708 	/*
3709 	 * Fill in sockopt_data structure that may be useful for
3710 	 * IP_FW3 get requests.
3711 	 */
3712 	locked = 0;
3713 	if (valsize <= sizeof(xbuf)) {
3714 		/* use on-stack buffer */
3715 		sdata.kbuf = xbuf;
3716 		sdata.ksize = sizeof(xbuf);
3717 		sdata.kavail = valsize;
3718 	} else {
3719 		/*
3720 		 * Determine opcode type/buffer size:
3721 		 * allocate sliding-window buf for data export or
3722 		 * contiguous buffer for special ops.
3723 		 */
3724 		if ((h.dir & HDIR_SET) != 0) {
3725 			/* Set request. Allocate contigous buffer. */
3726 			if (valsize > CTL3_LARGEBUF) {
3727 				find_unref_sh(&h);
3728 				return (EFBIG);
3729 			}
3730 
3731 			size = valsize;
3732 		} else {
3733 			/* Get request. Allocate sliding window buffer */
3734 			size = (valsize<CTL3_SMALLBUF) ? valsize:CTL3_SMALLBUF;
3735 
3736 			if (size < valsize) {
3737 				/* We have to wire user buffer */
3738 				error = vslock(sopt->sopt_val, valsize);
3739 				if (error != 0)
3740 					return (error);
3741 				locked = 1;
3742 			}
3743 		}
3744 
3745 		sdata.kbuf = malloc(size, M_TEMP, M_WAITOK | M_ZERO);
3746 		sdata.ksize = size;
3747 		sdata.kavail = size;
3748 	}
3749 
3750 	sdata.sopt = sopt;
3751 	sdata.sopt_val = sopt->sopt_val;
3752 	sdata.valsize = valsize;
3753 
3754 	/*
3755 	 * Copy either all request (if valsize < bsize_max)
3756 	 * or first bsize_max bytes to guarantee most consumers
3757 	 * that all necessary data has been copied).
3758 	 * Anyway, copy not less than sizeof(ip_fw3_opheader).
3759 	 */
3760 	if ((error = sooptcopyin(sopt, sdata.kbuf, sdata.ksize,
3761 	    sizeof(ip_fw3_opheader))) != 0)
3762 		return (error);
3763 	op3 = (ip_fw3_opheader *)sdata.kbuf;
3764 
3765 	/* Finally, run handler */
3766 	error = h.handler(chain, op3, &sdata);
3767 	find_unref_sh(&h);
3768 
3769 	/* Flush state and free buffers */
3770 	if (error == 0)
3771 		error = ipfw_flush_sopt_data(&sdata);
3772 	else
3773 		ipfw_flush_sopt_data(&sdata);
3774 
3775 	if (locked != 0)
3776 		vsunlock(sdata.sopt_val, valsize);
3777 
3778 	/* Restore original pointer and set number of bytes written */
3779 	sopt->sopt_val = sdata.sopt_val;
3780 	sopt->sopt_valsize = sdata.ktotal;
3781 	if (sdata.kbuf != xbuf)
3782 		free(sdata.kbuf, M_TEMP);
3783 
3784 	return (error);
3785 }
3786 
3787 /**
3788  * {set|get}sockopt parser.
3789  */
3790 int
3791 ipfw_ctl(struct sockopt *sopt)
3792 {
3793 #define	RULE_MAXSIZE	(512*sizeof(u_int32_t))
3794 	int error;
3795 	size_t size;
3796 	struct ip_fw *buf;
3797 	struct ip_fw_rule0 *rule;
3798 	struct ip_fw_chain *chain;
3799 	u_int32_t rulenum[2];
3800 	uint32_t opt;
3801 	struct rule_check_info ci;
3802 	IPFW_RLOCK_TRACKER;
3803 
3804 	chain = &V_layer3_chain;
3805 	error = 0;
3806 
3807 	opt = sopt->sopt_name;
3808 
3809 	/*
3810 	 * Disallow modifications in really-really secure mode, but still allow
3811 	 * the logging counters to be reset.
3812 	 */
3813 	if (opt == IP_FW_ADD ||
3814 	    (sopt->sopt_dir == SOPT_SET && opt != IP_FW_RESETLOG)) {
3815 		error = securelevel_ge(sopt->sopt_td->td_ucred, 3);
3816 		if (error != 0)
3817 			return (error);
3818 	}
3819 
3820 	switch (opt) {
3821 	case IP_FW_GET:
3822 		/*
3823 		 * pass up a copy of the current rules. Static rules
3824 		 * come first (the last of which has number IPFW_DEFAULT_RULE),
3825 		 * followed by a possibly empty list of dynamic rule.
3826 		 * The last dynamic rule has NULL in the "next" field.
3827 		 *
3828 		 * Note that the calculated size is used to bound the
3829 		 * amount of data returned to the user.  The rule set may
3830 		 * change between calculating the size and returning the
3831 		 * data in which case we'll just return what fits.
3832 		 */
3833 		for (;;) {
3834 			int len = 0, want;
3835 
3836 			size = chain->static_len;
3837 			size += ipfw_dyn_len();
3838 			if (size >= sopt->sopt_valsize)
3839 				break;
3840 			buf = malloc(size, M_TEMP, M_WAITOK | M_ZERO);
3841 			IPFW_UH_RLOCK(chain);
3842 			/* check again how much space we need */
3843 			want = chain->static_len + ipfw_dyn_len();
3844 			if (size >= want)
3845 				len = ipfw_getrules(chain, buf, size);
3846 			IPFW_UH_RUNLOCK(chain);
3847 			if (size >= want)
3848 				error = sooptcopyout(sopt, buf, len);
3849 			free(buf, M_TEMP);
3850 			if (size >= want)
3851 				break;
3852 		}
3853 		break;
3854 
3855 	case IP_FW_FLUSH:
3856 		/* locking is done within del_entry() */
3857 		error = del_entry(chain, 0); /* special case, rule=0, cmd=0 means all */
3858 		break;
3859 
3860 	case IP_FW_ADD:
3861 		rule = malloc(RULE_MAXSIZE, M_TEMP, M_WAITOK);
3862 		error = sooptcopyin(sopt, rule, RULE_MAXSIZE,
3863 			sizeof(struct ip_fw7) );
3864 
3865 		memset(&ci, 0, sizeof(struct rule_check_info));
3866 
3867 		/*
3868 		 * If the size of commands equals RULESIZE7 then we assume
3869 		 * a FreeBSD7.2 binary is talking to us (set is7=1).
3870 		 * is7 is persistent so the next 'ipfw list' command
3871 		 * will use this format.
3872 		 * NOTE: If wrong version is guessed (this can happen if
3873 		 *       the first ipfw command is 'ipfw [pipe] list')
3874 		 *       the ipfw binary may crash or loop infinitly...
3875 		 */
3876 		size = sopt->sopt_valsize;
3877 		if (size == RULESIZE7(rule)) {
3878 		    is7 = 1;
3879 		    error = convert_rule_to_8(rule);
3880 		    if (error) {
3881 			free(rule, M_TEMP);
3882 			return error;
3883 		    }
3884 		    size = RULESIZE(rule);
3885 		} else
3886 		    is7 = 0;
3887 		if (error == 0)
3888 			error = check_ipfw_rule0(rule, size, &ci);
3889 		if (error == 0) {
3890 			/* locking is done within add_rule() */
3891 			struct ip_fw *krule;
3892 			krule = ipfw_alloc_rule(chain, RULEKSIZE0(rule));
3893 			ci.urule = (caddr_t)rule;
3894 			ci.krule = krule;
3895 			import_rule0(&ci);
3896 			error = commit_rules(chain, &ci, 1);
3897 			if (error != 0)
3898 				ipfw_free_rule(ci.krule);
3899 			else if (sopt->sopt_dir == SOPT_GET) {
3900 				if (is7) {
3901 					error = convert_rule_to_7(rule);
3902 					size = RULESIZE7(rule);
3903 					if (error) {
3904 						free(rule, M_TEMP);
3905 						return error;
3906 					}
3907 				}
3908 				error = sooptcopyout(sopt, rule, size);
3909 			}
3910 		}
3911 		free(rule, M_TEMP);
3912 		break;
3913 
3914 	case IP_FW_DEL:
3915 		/*
3916 		 * IP_FW_DEL is used for deleting single rules or sets,
3917 		 * and (ab)used to atomically manipulate sets. Argument size
3918 		 * is used to distinguish between the two:
3919 		 *    sizeof(u_int32_t)
3920 		 *	delete single rule or set of rules,
3921 		 *	or reassign rules (or sets) to a different set.
3922 		 *    2*sizeof(u_int32_t)
3923 		 *	atomic disable/enable sets.
3924 		 *	first u_int32_t contains sets to be disabled,
3925 		 *	second u_int32_t contains sets to be enabled.
3926 		 */
3927 		error = sooptcopyin(sopt, rulenum,
3928 			2*sizeof(u_int32_t), sizeof(u_int32_t));
3929 		if (error)
3930 			break;
3931 		size = sopt->sopt_valsize;
3932 		if (size == sizeof(u_int32_t) && rulenum[0] != 0) {
3933 			/* delete or reassign, locking done in del_entry() */
3934 			error = del_entry(chain, rulenum[0]);
3935 		} else if (size == 2*sizeof(u_int32_t)) { /* set enable/disable */
3936 			IPFW_UH_WLOCK(chain);
3937 			V_set_disable =
3938 			    (V_set_disable | rulenum[0]) & ~rulenum[1] &
3939 			    ~(1<<RESVD_SET); /* set RESVD_SET always enabled */
3940 			IPFW_UH_WUNLOCK(chain);
3941 		} else
3942 			error = EINVAL;
3943 		break;
3944 
3945 	case IP_FW_ZERO:
3946 	case IP_FW_RESETLOG: /* argument is an u_int_32, the rule number */
3947 		rulenum[0] = 0;
3948 		if (sopt->sopt_val != 0) {
3949 		    error = sooptcopyin(sopt, rulenum,
3950 			    sizeof(u_int32_t), sizeof(u_int32_t));
3951 		    if (error)
3952 			break;
3953 		}
3954 		error = zero_entry(chain, rulenum[0],
3955 			sopt->sopt_name == IP_FW_RESETLOG);
3956 		break;
3957 
3958 	/*--- TABLE opcodes ---*/
3959 	case IP_FW_TABLE_ADD:
3960 	case IP_FW_TABLE_DEL:
3961 		{
3962 			ipfw_table_entry ent;
3963 			struct tentry_info tei;
3964 			struct tid_info ti;
3965 			struct table_value v;
3966 
3967 			error = sooptcopyin(sopt, &ent,
3968 			    sizeof(ent), sizeof(ent));
3969 			if (error)
3970 				break;
3971 
3972 			memset(&tei, 0, sizeof(tei));
3973 			tei.paddr = &ent.addr;
3974 			tei.subtype = AF_INET;
3975 			tei.masklen = ent.masklen;
3976 			ipfw_import_table_value_legacy(ent.value, &v);
3977 			tei.pvalue = &v;
3978 			memset(&ti, 0, sizeof(ti));
3979 			ti.uidx = ent.tbl;
3980 			ti.type = IPFW_TABLE_CIDR;
3981 
3982 			error = (opt == IP_FW_TABLE_ADD) ?
3983 			    add_table_entry(chain, &ti, &tei, 0, 1) :
3984 			    del_table_entry(chain, &ti, &tei, 0, 1);
3985 		}
3986 		break;
3987 
3988 	case IP_FW_TABLE_FLUSH:
3989 		{
3990 			u_int16_t tbl;
3991 			struct tid_info ti;
3992 
3993 			error = sooptcopyin(sopt, &tbl,
3994 			    sizeof(tbl), sizeof(tbl));
3995 			if (error)
3996 				break;
3997 			memset(&ti, 0, sizeof(ti));
3998 			ti.uidx = tbl;
3999 			error = flush_table(chain, &ti);
4000 		}
4001 		break;
4002 
4003 	case IP_FW_TABLE_GETSIZE:
4004 		{
4005 			u_int32_t tbl, cnt;
4006 			struct tid_info ti;
4007 
4008 			if ((error = sooptcopyin(sopt, &tbl, sizeof(tbl),
4009 			    sizeof(tbl))))
4010 				break;
4011 			memset(&ti, 0, sizeof(ti));
4012 			ti.uidx = tbl;
4013 			IPFW_RLOCK(chain);
4014 			error = ipfw_count_table(chain, &ti, &cnt);
4015 			IPFW_RUNLOCK(chain);
4016 			if (error)
4017 				break;
4018 			error = sooptcopyout(sopt, &cnt, sizeof(cnt));
4019 		}
4020 		break;
4021 
4022 	case IP_FW_TABLE_LIST:
4023 		{
4024 			ipfw_table *tbl;
4025 			struct tid_info ti;
4026 
4027 			if (sopt->sopt_valsize < sizeof(*tbl)) {
4028 				error = EINVAL;
4029 				break;
4030 			}
4031 			size = sopt->sopt_valsize;
4032 			tbl = malloc(size, M_TEMP, M_WAITOK);
4033 			error = sooptcopyin(sopt, tbl, size, sizeof(*tbl));
4034 			if (error) {
4035 				free(tbl, M_TEMP);
4036 				break;
4037 			}
4038 			tbl->size = (size - sizeof(*tbl)) /
4039 			    sizeof(ipfw_table_entry);
4040 			memset(&ti, 0, sizeof(ti));
4041 			ti.uidx = tbl->tbl;
4042 			IPFW_RLOCK(chain);
4043 			error = ipfw_dump_table_legacy(chain, &ti, tbl);
4044 			IPFW_RUNLOCK(chain);
4045 			if (error) {
4046 				free(tbl, M_TEMP);
4047 				break;
4048 			}
4049 			error = sooptcopyout(sopt, tbl, size);
4050 			free(tbl, M_TEMP);
4051 		}
4052 		break;
4053 
4054 	/*--- NAT operations are protected by the IPFW_LOCK ---*/
4055 	case IP_FW_NAT_CFG:
4056 		if (IPFW_NAT_LOADED)
4057 			error = ipfw_nat_cfg_ptr(sopt);
4058 		else {
4059 			printf("IP_FW_NAT_CFG: %s\n",
4060 			    "ipfw_nat not present, please load it");
4061 			error = EINVAL;
4062 		}
4063 		break;
4064 
4065 	case IP_FW_NAT_DEL:
4066 		if (IPFW_NAT_LOADED)
4067 			error = ipfw_nat_del_ptr(sopt);
4068 		else {
4069 			printf("IP_FW_NAT_DEL: %s\n",
4070 			    "ipfw_nat not present, please load it");
4071 			error = EINVAL;
4072 		}
4073 		break;
4074 
4075 	case IP_FW_NAT_GET_CONFIG:
4076 		if (IPFW_NAT_LOADED)
4077 			error = ipfw_nat_get_cfg_ptr(sopt);
4078 		else {
4079 			printf("IP_FW_NAT_GET_CFG: %s\n",
4080 			    "ipfw_nat not present, please load it");
4081 			error = EINVAL;
4082 		}
4083 		break;
4084 
4085 	case IP_FW_NAT_GET_LOG:
4086 		if (IPFW_NAT_LOADED)
4087 			error = ipfw_nat_get_log_ptr(sopt);
4088 		else {
4089 			printf("IP_FW_NAT_GET_LOG: %s\n",
4090 			    "ipfw_nat not present, please load it");
4091 			error = EINVAL;
4092 		}
4093 		break;
4094 
4095 	default:
4096 		printf("ipfw: ipfw_ctl invalid option %d\n", sopt->sopt_name);
4097 		error = EINVAL;
4098 	}
4099 
4100 	return (error);
4101 #undef RULE_MAXSIZE
4102 }
4103 #define	RULE_MAXSIZE	(256*sizeof(u_int32_t))
4104 
4105 /* Functions to convert rules 7.2 <==> 8.0 */
4106 static int
4107 convert_rule_to_7(struct ip_fw_rule0 *rule)
4108 {
4109 	/* Used to modify original rule */
4110 	struct ip_fw7 *rule7 = (struct ip_fw7 *)rule;
4111 	/* copy of original rule, version 8 */
4112 	struct ip_fw_rule0 *tmp;
4113 
4114 	/* Used to copy commands */
4115 	ipfw_insn *ccmd, *dst;
4116 	int ll = 0, ccmdlen = 0;
4117 
4118 	tmp = malloc(RULE_MAXSIZE, M_TEMP, M_NOWAIT | M_ZERO);
4119 	if (tmp == NULL) {
4120 		return 1; //XXX error
4121 	}
4122 	bcopy(rule, tmp, RULE_MAXSIZE);
4123 
4124 	/* Copy fields */
4125 	//rule7->_pad = tmp->_pad;
4126 	rule7->set = tmp->set;
4127 	rule7->rulenum = tmp->rulenum;
4128 	rule7->cmd_len = tmp->cmd_len;
4129 	rule7->act_ofs = tmp->act_ofs;
4130 	rule7->next_rule = (struct ip_fw7 *)tmp->next_rule;
4131 	rule7->cmd_len = tmp->cmd_len;
4132 	rule7->pcnt = tmp->pcnt;
4133 	rule7->bcnt = tmp->bcnt;
4134 	rule7->timestamp = tmp->timestamp;
4135 
4136 	/* Copy commands */
4137 	for (ll = tmp->cmd_len, ccmd = tmp->cmd, dst = rule7->cmd ;
4138 			ll > 0 ; ll -= ccmdlen, ccmd += ccmdlen, dst += ccmdlen) {
4139 		ccmdlen = F_LEN(ccmd);
4140 
4141 		bcopy(ccmd, dst, F_LEN(ccmd)*sizeof(uint32_t));
4142 
4143 		if (dst->opcode > O_NAT)
4144 			/* O_REASS doesn't exists in 7.2 version, so
4145 			 * decrement opcode if it is after O_REASS
4146 			 */
4147 			dst->opcode--;
4148 
4149 		if (ccmdlen > ll) {
4150 			printf("ipfw: opcode %d size truncated\n",
4151 				ccmd->opcode);
4152 			return EINVAL;
4153 		}
4154 	}
4155 	free(tmp, M_TEMP);
4156 
4157 	return 0;
4158 }
4159 
4160 static int
4161 convert_rule_to_8(struct ip_fw_rule0 *rule)
4162 {
4163 	/* Used to modify original rule */
4164 	struct ip_fw7 *rule7 = (struct ip_fw7 *) rule;
4165 
4166 	/* Used to copy commands */
4167 	ipfw_insn *ccmd, *dst;
4168 	int ll = 0, ccmdlen = 0;
4169 
4170 	/* Copy of original rule */
4171 	struct ip_fw7 *tmp = malloc(RULE_MAXSIZE, M_TEMP, M_NOWAIT | M_ZERO);
4172 	if (tmp == NULL) {
4173 		return 1; //XXX error
4174 	}
4175 
4176 	bcopy(rule7, tmp, RULE_MAXSIZE);
4177 
4178 	for (ll = tmp->cmd_len, ccmd = tmp->cmd, dst = rule->cmd ;
4179 			ll > 0 ; ll -= ccmdlen, ccmd += ccmdlen, dst += ccmdlen) {
4180 		ccmdlen = F_LEN(ccmd);
4181 
4182 		bcopy(ccmd, dst, F_LEN(ccmd)*sizeof(uint32_t));
4183 
4184 		if (dst->opcode > O_NAT)
4185 			/* O_REASS doesn't exists in 7.2 version, so
4186 			 * increment opcode if it is after O_REASS
4187 			 */
4188 			dst->opcode++;
4189 
4190 		if (ccmdlen > ll) {
4191 			printf("ipfw: opcode %d size truncated\n",
4192 			    ccmd->opcode);
4193 			return EINVAL;
4194 		}
4195 	}
4196 
4197 	rule->_pad = tmp->_pad;
4198 	rule->set = tmp->set;
4199 	rule->rulenum = tmp->rulenum;
4200 	rule->cmd_len = tmp->cmd_len;
4201 	rule->act_ofs = tmp->act_ofs;
4202 	rule->next_rule = (struct ip_fw *)tmp->next_rule;
4203 	rule->cmd_len = tmp->cmd_len;
4204 	rule->id = 0; /* XXX see if is ok = 0 */
4205 	rule->pcnt = tmp->pcnt;
4206 	rule->bcnt = tmp->bcnt;
4207 	rule->timestamp = tmp->timestamp;
4208 
4209 	free (tmp, M_TEMP);
4210 	return 0;
4211 }
4212 
4213 /*
4214  * Named object api
4215  *
4216  */
4217 
4218 void
4219 ipfw_init_srv(struct ip_fw_chain *ch)
4220 {
4221 
4222 	ch->srvmap = ipfw_objhash_create(IPFW_OBJECTS_DEFAULT);
4223 	ch->srvstate = malloc(sizeof(void *) * IPFW_OBJECTS_DEFAULT,
4224 	    M_IPFW, M_WAITOK | M_ZERO);
4225 }
4226 
4227 void
4228 ipfw_destroy_srv(struct ip_fw_chain *ch)
4229 {
4230 
4231 	free(ch->srvstate, M_IPFW);
4232 	ipfw_objhash_destroy(ch->srvmap);
4233 }
4234 
4235 /*
4236  * Allocate new bitmask which can be used to enlarge/shrink
4237  * named instance index.
4238  */
4239 void
4240 ipfw_objhash_bitmap_alloc(uint32_t items, void **idx, int *pblocks)
4241 {
4242 	size_t size;
4243 	int max_blocks;
4244 	u_long *idx_mask;
4245 
4246 	KASSERT((items % BLOCK_ITEMS) == 0,
4247 	   ("bitmask size needs to power of 2 and greater or equal to %zu",
4248 	    BLOCK_ITEMS));
4249 
4250 	max_blocks = items / BLOCK_ITEMS;
4251 	size = items / 8;
4252 	idx_mask = malloc(size * IPFW_MAX_SETS, M_IPFW, M_WAITOK);
4253 	/* Mark all as free */
4254 	memset(idx_mask, 0xFF, size * IPFW_MAX_SETS);
4255 	*idx_mask &= ~(u_long)1; /* Skip index 0 */
4256 
4257 	*idx = idx_mask;
4258 	*pblocks = max_blocks;
4259 }
4260 
4261 /*
4262  * Copy current bitmask index to new one.
4263  */
4264 void
4265 ipfw_objhash_bitmap_merge(struct namedobj_instance *ni, void **idx, int *blocks)
4266 {
4267 	int old_blocks, new_blocks;
4268 	u_long *old_idx, *new_idx;
4269 	int i;
4270 
4271 	old_idx = ni->idx_mask;
4272 	old_blocks = ni->max_blocks;
4273 	new_idx = *idx;
4274 	new_blocks = *blocks;
4275 
4276 	for (i = 0; i < IPFW_MAX_SETS; i++) {
4277 		memcpy(&new_idx[new_blocks * i], &old_idx[old_blocks * i],
4278 		    old_blocks * sizeof(u_long));
4279 	}
4280 }
4281 
4282 /*
4283  * Swaps current @ni index with new one.
4284  */
4285 void
4286 ipfw_objhash_bitmap_swap(struct namedobj_instance *ni, void **idx, int *blocks)
4287 {
4288 	int old_blocks;
4289 	u_long *old_idx;
4290 
4291 	old_idx = ni->idx_mask;
4292 	old_blocks = ni->max_blocks;
4293 
4294 	ni->idx_mask = *idx;
4295 	ni->max_blocks = *blocks;
4296 
4297 	/* Save old values */
4298 	*idx = old_idx;
4299 	*blocks = old_blocks;
4300 }
4301 
4302 void
4303 ipfw_objhash_bitmap_free(void *idx, int blocks)
4304 {
4305 
4306 	free(idx, M_IPFW);
4307 }
4308 
4309 /*
4310  * Creates named hash instance.
4311  * Must be called without holding any locks.
4312  * Return pointer to new instance.
4313  */
4314 struct namedobj_instance *
4315 ipfw_objhash_create(uint32_t items)
4316 {
4317 	struct namedobj_instance *ni;
4318 	int i;
4319 	size_t size;
4320 
4321 	size = sizeof(struct namedobj_instance) +
4322 	    sizeof(struct namedobjects_head) * NAMEDOBJ_HASH_SIZE +
4323 	    sizeof(struct namedobjects_head) * NAMEDOBJ_HASH_SIZE;
4324 
4325 	ni = malloc(size, M_IPFW, M_WAITOK | M_ZERO);
4326 	ni->nn_size = NAMEDOBJ_HASH_SIZE;
4327 	ni->nv_size = NAMEDOBJ_HASH_SIZE;
4328 
4329 	ni->names = (struct namedobjects_head *)(ni +1);
4330 	ni->values = &ni->names[ni->nn_size];
4331 
4332 	for (i = 0; i < ni->nn_size; i++)
4333 		TAILQ_INIT(&ni->names[i]);
4334 
4335 	for (i = 0; i < ni->nv_size; i++)
4336 		TAILQ_INIT(&ni->values[i]);
4337 
4338 	/* Set default hashing/comparison functions */
4339 	ni->hash_f = objhash_hash_name;
4340 	ni->cmp_f = objhash_cmp_name;
4341 
4342 	/* Allocate bitmask separately due to possible resize */
4343 	ipfw_objhash_bitmap_alloc(items, (void*)&ni->idx_mask, &ni->max_blocks);
4344 
4345 	return (ni);
4346 }
4347 
4348 void
4349 ipfw_objhash_destroy(struct namedobj_instance *ni)
4350 {
4351 
4352 	free(ni->idx_mask, M_IPFW);
4353 	free(ni, M_IPFW);
4354 }
4355 
4356 void
4357 ipfw_objhash_set_funcs(struct namedobj_instance *ni, objhash_hash_f *hash_f,
4358     objhash_cmp_f *cmp_f)
4359 {
4360 
4361 	ni->hash_f = hash_f;
4362 	ni->cmp_f = cmp_f;
4363 }
4364 
4365 static uint32_t
4366 objhash_hash_name(struct namedobj_instance *ni, const void *name, uint32_t set)
4367 {
4368 
4369 	return (fnv_32_str((const char *)name, FNV1_32_INIT));
4370 }
4371 
4372 static int
4373 objhash_cmp_name(struct named_object *no, const void *name, uint32_t set)
4374 {
4375 
4376 	if ((strcmp(no->name, (const char *)name) == 0) && (no->set == set))
4377 		return (0);
4378 
4379 	return (1);
4380 }
4381 
4382 static uint32_t
4383 objhash_hash_idx(struct namedobj_instance *ni, uint32_t val)
4384 {
4385 	uint32_t v;
4386 
4387 	v = val % (ni->nv_size - 1);
4388 
4389 	return (v);
4390 }
4391 
4392 struct named_object *
4393 ipfw_objhash_lookup_name(struct namedobj_instance *ni, uint32_t set, char *name)
4394 {
4395 	struct named_object *no;
4396 	uint32_t hash;
4397 
4398 	hash = ni->hash_f(ni, name, set) % ni->nn_size;
4399 
4400 	TAILQ_FOREACH(no, &ni->names[hash], nn_next) {
4401 		if (ni->cmp_f(no, name, set) == 0)
4402 			return (no);
4403 	}
4404 
4405 	return (NULL);
4406 }
4407 
4408 /*
4409  * Find named object by @uid.
4410  * Check @tlvs for valid data inside.
4411  *
4412  * Returns pointer to found TLV or NULL.
4413  */
4414 ipfw_obj_ntlv *
4415 ipfw_find_name_tlv_type(void *tlvs, int len, uint16_t uidx, uint32_t etlv)
4416 {
4417 	ipfw_obj_ntlv *ntlv;
4418 	uintptr_t pa, pe;
4419 	int l;
4420 
4421 	pa = (uintptr_t)tlvs;
4422 	pe = pa + len;
4423 	l = 0;
4424 	for (; pa < pe; pa += l) {
4425 		ntlv = (ipfw_obj_ntlv *)pa;
4426 		l = ntlv->head.length;
4427 
4428 		if (l != sizeof(*ntlv))
4429 			return (NULL);
4430 
4431 		if (ntlv->idx != uidx)
4432 			continue;
4433 		/*
4434 		 * When userland has specified zero TLV type, do
4435 		 * not compare it with eltv. In some cases userland
4436 		 * doesn't know what type should it have. Use only
4437 		 * uidx and name for search named_object.
4438 		 */
4439 		if (ntlv->head.type != 0 &&
4440 		    ntlv->head.type != (uint16_t)etlv)
4441 			continue;
4442 
4443 		if (ipfw_check_object_name_generic(ntlv->name) != 0)
4444 			return (NULL);
4445 
4446 		return (ntlv);
4447 	}
4448 
4449 	return (NULL);
4450 }
4451 
4452 /*
4453  * Finds object config based on either legacy index
4454  * or name in ntlv.
4455  * Note @ti structure contains unchecked data from userland.
4456  *
4457  * Returns 0 in success and fills in @pno with found config
4458  */
4459 int
4460 ipfw_objhash_find_type(struct namedobj_instance *ni, struct tid_info *ti,
4461     uint32_t etlv, struct named_object **pno)
4462 {
4463 	char *name;
4464 	ipfw_obj_ntlv *ntlv;
4465 	uint32_t set;
4466 
4467 	if (ti->tlvs == NULL)
4468 		return (EINVAL);
4469 
4470 	ntlv = ipfw_find_name_tlv_type(ti->tlvs, ti->tlen, ti->uidx, etlv);
4471 	if (ntlv == NULL)
4472 		return (EINVAL);
4473 	name = ntlv->name;
4474 
4475 	/*
4476 	 * Use set provided by @ti instead of @ntlv one.
4477 	 * This is needed due to different sets behavior
4478 	 * controlled by V_fw_tables_sets.
4479 	 */
4480 	set = ti->set;
4481 	*pno = ipfw_objhash_lookup_name(ni, set, name);
4482 	if (*pno == NULL)
4483 		return (ESRCH);
4484 	return (0);
4485 }
4486 
4487 /*
4488  * Find named object by name, considering also its TLV type.
4489  */
4490 struct named_object *
4491 ipfw_objhash_lookup_name_type(struct namedobj_instance *ni, uint32_t set,
4492     uint32_t type, const char *name)
4493 {
4494 	struct named_object *no;
4495 	uint32_t hash;
4496 
4497 	hash = ni->hash_f(ni, name, set) % ni->nn_size;
4498 
4499 	TAILQ_FOREACH(no, &ni->names[hash], nn_next) {
4500 		if (ni->cmp_f(no, name, set) == 0 &&
4501 		    no->etlv == (uint16_t)type)
4502 			return (no);
4503 	}
4504 
4505 	return (NULL);
4506 }
4507 
4508 struct named_object *
4509 ipfw_objhash_lookup_kidx(struct namedobj_instance *ni, uint16_t kidx)
4510 {
4511 	struct named_object *no;
4512 	uint32_t hash;
4513 
4514 	hash = objhash_hash_idx(ni, kidx);
4515 
4516 	TAILQ_FOREACH(no, &ni->values[hash], nv_next) {
4517 		if (no->kidx == kidx)
4518 			return (no);
4519 	}
4520 
4521 	return (NULL);
4522 }
4523 
4524 int
4525 ipfw_objhash_same_name(struct namedobj_instance *ni, struct named_object *a,
4526     struct named_object *b)
4527 {
4528 
4529 	if ((strcmp(a->name, b->name) == 0) && a->set == b->set)
4530 		return (1);
4531 
4532 	return (0);
4533 }
4534 
4535 void
4536 ipfw_objhash_add(struct namedobj_instance *ni, struct named_object *no)
4537 {
4538 	uint32_t hash;
4539 
4540 	hash = ni->hash_f(ni, no->name, no->set) % ni->nn_size;
4541 	TAILQ_INSERT_HEAD(&ni->names[hash], no, nn_next);
4542 
4543 	hash = objhash_hash_idx(ni, no->kidx);
4544 	TAILQ_INSERT_HEAD(&ni->values[hash], no, nv_next);
4545 
4546 	ni->count++;
4547 }
4548 
4549 void
4550 ipfw_objhash_del(struct namedobj_instance *ni, struct named_object *no)
4551 {
4552 	uint32_t hash;
4553 
4554 	hash = ni->hash_f(ni, no->name, no->set) % ni->nn_size;
4555 	TAILQ_REMOVE(&ni->names[hash], no, nn_next);
4556 
4557 	hash = objhash_hash_idx(ni, no->kidx);
4558 	TAILQ_REMOVE(&ni->values[hash], no, nv_next);
4559 
4560 	ni->count--;
4561 }
4562 
4563 uint32_t
4564 ipfw_objhash_count(struct namedobj_instance *ni)
4565 {
4566 
4567 	return (ni->count);
4568 }
4569 
4570 uint32_t
4571 ipfw_objhash_count_type(struct namedobj_instance *ni, uint16_t type)
4572 {
4573 	struct named_object *no;
4574 	uint32_t count;
4575 	int i;
4576 
4577 	count = 0;
4578 	for (i = 0; i < ni->nn_size; i++) {
4579 		TAILQ_FOREACH(no, &ni->names[i], nn_next) {
4580 			if (no->etlv == type)
4581 				count++;
4582 		}
4583 	}
4584 	return (count);
4585 }
4586 
4587 /*
4588  * Runs @func for each found named object.
4589  * It is safe to delete objects from callback
4590  */
4591 int
4592 ipfw_objhash_foreach(struct namedobj_instance *ni, objhash_cb_t *f, void *arg)
4593 {
4594 	struct named_object *no, *no_tmp;
4595 	int i, ret;
4596 
4597 	for (i = 0; i < ni->nn_size; i++) {
4598 		TAILQ_FOREACH_SAFE(no, &ni->names[i], nn_next, no_tmp) {
4599 			ret = f(ni, no, arg);
4600 			if (ret != 0)
4601 				return (ret);
4602 		}
4603 	}
4604 	return (0);
4605 }
4606 
4607 /*
4608  * Runs @f for each found named object with type @type.
4609  * It is safe to delete objects from callback
4610  */
4611 int
4612 ipfw_objhash_foreach_type(struct namedobj_instance *ni, objhash_cb_t *f,
4613     void *arg, uint16_t type)
4614 {
4615 	struct named_object *no, *no_tmp;
4616 	int i, ret;
4617 
4618 	for (i = 0; i < ni->nn_size; i++) {
4619 		TAILQ_FOREACH_SAFE(no, &ni->names[i], nn_next, no_tmp) {
4620 			if (no->etlv != type)
4621 				continue;
4622 			ret = f(ni, no, arg);
4623 			if (ret != 0)
4624 				return (ret);
4625 		}
4626 	}
4627 	return (0);
4628 }
4629 
4630 /*
4631  * Removes index from given set.
4632  * Returns 0 on success.
4633  */
4634 int
4635 ipfw_objhash_free_idx(struct namedobj_instance *ni, uint16_t idx)
4636 {
4637 	u_long *mask;
4638 	int i, v;
4639 
4640 	i = idx / BLOCK_ITEMS;
4641 	v = idx % BLOCK_ITEMS;
4642 
4643 	if (i >= ni->max_blocks)
4644 		return (1);
4645 
4646 	mask = &ni->idx_mask[i];
4647 
4648 	if ((*mask & ((u_long)1 << v)) != 0)
4649 		return (1);
4650 
4651 	/* Mark as free */
4652 	*mask |= (u_long)1 << v;
4653 
4654 	/* Update free offset */
4655 	if (ni->free_off[0] > i)
4656 		ni->free_off[0] = i;
4657 
4658 	return (0);
4659 }
4660 
4661 /*
4662  * Allocate new index in given instance and stores in in @pidx.
4663  * Returns 0 on success.
4664  */
4665 int
4666 ipfw_objhash_alloc_idx(void *n, uint16_t *pidx)
4667 {
4668 	struct namedobj_instance *ni;
4669 	u_long *mask;
4670 	int i, off, v;
4671 
4672 	ni = (struct namedobj_instance *)n;
4673 
4674 	off = ni->free_off[0];
4675 	mask = &ni->idx_mask[off];
4676 
4677 	for (i = off; i < ni->max_blocks; i++, mask++) {
4678 		if ((v = ffsl(*mask)) == 0)
4679 			continue;
4680 
4681 		/* Mark as busy */
4682 		*mask &= ~ ((u_long)1 << (v - 1));
4683 
4684 		ni->free_off[0] = i;
4685 
4686 		v = BLOCK_ITEMS * i + v - 1;
4687 
4688 		*pidx = v;
4689 		return (0);
4690 	}
4691 
4692 	return (1);
4693 }
4694 
4695 /* end of file */
4696