1 /*- 2 * Copyright (c) 2004 Ruslan Ermilov and Vsevolod Lobko. 3 * Copyright (c) 2014 Yandex LLC 4 * Copyright (c) 2014 Alexander V. Chernikov 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25 * SUCH DAMAGE. 26 */ 27 28 #include <sys/cdefs.h> 29 __FBSDID("$FreeBSD$"); 30 31 /* 32 * Lookup table support for ipfw. 33 * 34 * This file contains handlers for all generic tables' operations: 35 * add/del/flush entries, list/dump tables etc.. 36 * 37 * Table data modification is protected by both UH and runtime lock 38 * while reading configuration/data is protected by UH lock. 39 * 40 * Lookup algorithms for all table types are located in ip_fw_table_algo.c 41 */ 42 43 #include "opt_ipfw.h" 44 45 #include <sys/param.h> 46 #include <sys/systm.h> 47 #include <sys/malloc.h> 48 #include <sys/kernel.h> 49 #include <sys/lock.h> 50 #include <sys/rwlock.h> 51 #include <sys/rmlock.h> 52 #include <sys/socket.h> 53 #include <sys/socketvar.h> 54 #include <sys/queue.h> 55 #include <net/if.h> /* ip_fw.h requires IFNAMSIZ */ 56 57 #include <netinet/in.h> 58 #include <netinet/ip_var.h> /* struct ipfw_rule_ref */ 59 #include <netinet/ip_fw.h> 60 61 #include <netpfil/ipfw/ip_fw_private.h> 62 #include <netpfil/ipfw/ip_fw_table.h> 63 64 /* 65 * Table has the following `type` concepts: 66 * 67 * `no.type` represents lookup key type (addr, ifp, uid, etc..) 68 * vmask represents bitmask of table values which are present at the moment. 69 * Special IPFW_VTYPE_LEGACY ( (uint32_t)-1 ) represents old 70 * single-value-for-all approach. 71 */ 72 struct table_config { 73 struct named_object no; 74 uint8_t tflags; /* type flags */ 75 uint8_t locked; /* 1 if locked from changes */ 76 uint8_t linked; /* 1 if already linked */ 77 uint8_t ochanged; /* used by set swapping */ 78 uint8_t vshared; /* 1 if using shared value array */ 79 uint8_t spare[3]; 80 uint32_t count; /* Number of records */ 81 uint32_t limit; /* Max number of records */ 82 uint32_t vmask; /* bitmask with supported values */ 83 uint32_t ocount; /* used by set swapping */ 84 uint64_t gencnt; /* generation count */ 85 char tablename[64]; /* table name */ 86 struct table_algo *ta; /* Callbacks for given algo */ 87 void *astate; /* algorithm state */ 88 struct table_info ti_copy; /* data to put to table_info */ 89 struct namedobj_instance *vi; 90 }; 91 92 static int find_table_err(struct namedobj_instance *ni, struct tid_info *ti, 93 struct table_config **tc); 94 static struct table_config *find_table(struct namedobj_instance *ni, 95 struct tid_info *ti); 96 static struct table_config *alloc_table_config(struct ip_fw_chain *ch, 97 struct tid_info *ti, struct table_algo *ta, char *adata, uint8_t tflags); 98 static void free_table_config(struct namedobj_instance *ni, 99 struct table_config *tc); 100 static int create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti, 101 char *aname, ipfw_xtable_info *i, uint16_t *pkidx, int ref); 102 static void link_table(struct ip_fw_chain *ch, struct table_config *tc); 103 static void unlink_table(struct ip_fw_chain *ch, struct table_config *tc); 104 static int find_ref_table(struct ip_fw_chain *ch, struct tid_info *ti, 105 struct tentry_info *tei, uint32_t count, int op, struct table_config **ptc); 106 #define OP_ADD 1 107 #define OP_DEL 0 108 static int export_tables(struct ip_fw_chain *ch, ipfw_obj_lheader *olh, 109 struct sockopt_data *sd); 110 static void export_table_info(struct ip_fw_chain *ch, struct table_config *tc, 111 ipfw_xtable_info *i); 112 static int dump_table_tentry(void *e, void *arg); 113 static int dump_table_xentry(void *e, void *arg); 114 115 static int swap_tables(struct ip_fw_chain *ch, struct tid_info *a, 116 struct tid_info *b); 117 118 static int check_table_name(const char *name); 119 static int check_table_space(struct ip_fw_chain *ch, struct tableop_state *ts, 120 struct table_config *tc, struct table_info *ti, uint32_t count); 121 static int destroy_table(struct ip_fw_chain *ch, struct tid_info *ti); 122 123 static struct table_algo *find_table_algo(struct tables_config *tableconf, 124 struct tid_info *ti, char *name); 125 126 static void objheader_to_ti(struct _ipfw_obj_header *oh, struct tid_info *ti); 127 static void ntlv_to_ti(struct _ipfw_obj_ntlv *ntlv, struct tid_info *ti); 128 129 #define CHAIN_TO_NI(chain) (CHAIN_TO_TCFG(chain)->namehash) 130 #define KIDX_TO_TI(ch, k) (&(((struct table_info *)(ch)->tablestate)[k])) 131 132 #define TA_BUF_SZ 128 /* On-stack buffer for add/delete state */ 133 134 void 135 rollback_toperation_state(struct ip_fw_chain *ch, void *object) 136 { 137 struct tables_config *tcfg; 138 struct op_state *os; 139 140 tcfg = CHAIN_TO_TCFG(ch); 141 TAILQ_FOREACH(os, &tcfg->state_list, next) 142 os->func(object, os); 143 } 144 145 void 146 add_toperation_state(struct ip_fw_chain *ch, struct tableop_state *ts) 147 { 148 struct tables_config *tcfg; 149 150 tcfg = CHAIN_TO_TCFG(ch); 151 TAILQ_INSERT_HEAD(&tcfg->state_list, &ts->opstate, next); 152 } 153 154 void 155 del_toperation_state(struct ip_fw_chain *ch, struct tableop_state *ts) 156 { 157 struct tables_config *tcfg; 158 159 tcfg = CHAIN_TO_TCFG(ch); 160 TAILQ_REMOVE(&tcfg->state_list, &ts->opstate, next); 161 } 162 163 void 164 tc_ref(struct table_config *tc) 165 { 166 167 tc->no.refcnt++; 168 } 169 170 void 171 tc_unref(struct table_config *tc) 172 { 173 174 tc->no.refcnt--; 175 } 176 177 static struct table_value * 178 get_table_value(struct ip_fw_chain *ch, struct table_config *tc, uint32_t kidx) 179 { 180 struct table_value *pval; 181 182 pval = (struct table_value *)ch->valuestate; 183 184 return (&pval[kidx]); 185 } 186 187 188 /* 189 * Checks if we're able to insert/update entry @tei into table 190 * w.r.t @tc limits. 191 * May alter @tei to indicate insertion error / insert 192 * options. 193 * 194 * Returns 0 if operation can be performed/ 195 */ 196 static int 197 check_table_limit(struct table_config *tc, struct tentry_info *tei) 198 { 199 200 if (tc->limit == 0 || tc->count < tc->limit) 201 return (0); 202 203 if ((tei->flags & TEI_FLAGS_UPDATE) == 0) { 204 /* Notify userland on error cause */ 205 tei->flags |= TEI_FLAGS_LIMIT; 206 return (EFBIG); 207 } 208 209 /* 210 * We have UPDATE flag set. 211 * Permit updating record (if found), 212 * but restrict adding new one since we've 213 * already hit the limit. 214 */ 215 tei->flags |= TEI_FLAGS_DONTADD; 216 217 return (0); 218 } 219 220 /* 221 * Convert algorithm callback return code into 222 * one of pre-defined states known by userland. 223 */ 224 static void 225 store_tei_result(struct tentry_info *tei, int op, int error, uint32_t num) 226 { 227 int flag; 228 229 flag = 0; 230 231 switch (error) { 232 case 0: 233 if (op == OP_ADD && num != 0) 234 flag = TEI_FLAGS_ADDED; 235 if (op == OP_DEL) 236 flag = TEI_FLAGS_DELETED; 237 break; 238 case ENOENT: 239 flag = TEI_FLAGS_NOTFOUND; 240 break; 241 case EEXIST: 242 flag = TEI_FLAGS_EXISTS; 243 break; 244 default: 245 flag = TEI_FLAGS_ERROR; 246 } 247 248 tei->flags |= flag; 249 } 250 251 /* 252 * Creates and references table with default parameters. 253 * Saves table config, algo and allocated kidx info @ptc, @pta and 254 * @pkidx if non-zero. 255 * Used for table auto-creation to support old binaries. 256 * 257 * Returns 0 on success. 258 */ 259 static int 260 create_table_compat(struct ip_fw_chain *ch, struct tid_info *ti, 261 uint16_t *pkidx) 262 { 263 ipfw_xtable_info xi; 264 int error; 265 266 memset(&xi, 0, sizeof(xi)); 267 /* Set default value mask for legacy clients */ 268 xi.vmask = IPFW_VTYPE_LEGACY; 269 270 error = create_table_internal(ch, ti, NULL, &xi, pkidx, 1); 271 if (error != 0) 272 return (error); 273 274 return (0); 275 } 276 277 /* 278 * Find and reference existing table optionally 279 * creating new one. 280 * 281 * Saves found table config into @ptc. 282 * Note function may drop/acquire UH_WLOCK. 283 * Returns 0 if table was found/created and referenced 284 * or non-zero return code. 285 */ 286 static int 287 find_ref_table(struct ip_fw_chain *ch, struct tid_info *ti, 288 struct tentry_info *tei, uint32_t count, int op, 289 struct table_config **ptc) 290 { 291 struct namedobj_instance *ni; 292 struct table_config *tc; 293 uint16_t kidx; 294 int error; 295 296 IPFW_UH_WLOCK_ASSERT(ch); 297 298 ni = CHAIN_TO_NI(ch); 299 tc = NULL; 300 if ((tc = find_table(ni, ti)) != NULL) { 301 /* check table type */ 302 if (tc->no.subtype != ti->type) 303 return (EINVAL); 304 305 if (tc->locked != 0) 306 return (EACCES); 307 308 /* Try to exit early on limit hit */ 309 if (op == OP_ADD && count == 1 && 310 check_table_limit(tc, tei) != 0) 311 return (EFBIG); 312 313 /* Reference and return */ 314 tc->no.refcnt++; 315 *ptc = tc; 316 return (0); 317 } 318 319 if (op == OP_DEL) 320 return (ESRCH); 321 322 /* Compatibility mode: create new table for old clients */ 323 if ((tei->flags & TEI_FLAGS_COMPAT) == 0) 324 return (ESRCH); 325 326 IPFW_UH_WUNLOCK(ch); 327 error = create_table_compat(ch, ti, &kidx); 328 IPFW_UH_WLOCK(ch); 329 330 if (error != 0) 331 return (error); 332 333 tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, kidx); 334 KASSERT(tc != NULL, ("create_table_compat returned bad idx %d", kidx)); 335 336 /* OK, now we've got referenced table. */ 337 *ptc = tc; 338 return (0); 339 } 340 341 /* 342 * Rolls back already @added to @tc entries using state array @ta_buf_m. 343 * Assume the following layout: 344 * 1) ADD state (ta_buf_m[0] ... t_buf_m[added - 1]) for handling update cases 345 * 2) DEL state (ta_buf_m[count[ ... t_buf_m[count + added - 1]) 346 * for storing deleted state 347 */ 348 static void 349 rollback_added_entries(struct ip_fw_chain *ch, struct table_config *tc, 350 struct table_info *tinfo, struct tentry_info *tei, caddr_t ta_buf_m, 351 uint32_t count, uint32_t added) 352 { 353 struct table_algo *ta; 354 struct tentry_info *ptei; 355 caddr_t v, vv; 356 size_t ta_buf_sz; 357 int error, i; 358 uint32_t num; 359 360 IPFW_UH_WLOCK_ASSERT(ch); 361 362 ta = tc->ta; 363 ta_buf_sz = ta->ta_buf_size; 364 v = ta_buf_m; 365 vv = v + count * ta_buf_sz; 366 for (i = 0; i < added; i++, v += ta_buf_sz, vv += ta_buf_sz) { 367 ptei = &tei[i]; 368 if ((ptei->flags & TEI_FLAGS_UPDATED) != 0) { 369 370 /* 371 * We have old value stored by previous 372 * call in @ptei->value. Do add once again 373 * to restore it. 374 */ 375 error = ta->add(tc->astate, tinfo, ptei, v, &num); 376 KASSERT(error == 0, ("rollback UPDATE fail")); 377 KASSERT(num == 0, ("rollback UPDATE fail2")); 378 continue; 379 } 380 381 error = ta->prepare_del(ch, ptei, vv); 382 KASSERT(error == 0, ("pre-rollback INSERT failed")); 383 error = ta->del(tc->astate, tinfo, ptei, vv, &num); 384 KASSERT(error == 0, ("rollback INSERT failed")); 385 tc->count -= num; 386 } 387 } 388 389 /* 390 * Prepares add/del state for all @count entries in @tei. 391 * Uses either stack buffer (@ta_buf) or allocates a new one. 392 * Stores pointer to allocated buffer back to @ta_buf. 393 * 394 * Returns 0 on success. 395 */ 396 static int 397 prepare_batch_buffer(struct ip_fw_chain *ch, struct table_algo *ta, 398 struct tentry_info *tei, uint32_t count, int op, caddr_t *ta_buf) 399 { 400 caddr_t ta_buf_m, v; 401 size_t ta_buf_sz, sz; 402 struct tentry_info *ptei; 403 int error, i; 404 405 error = 0; 406 ta_buf_sz = ta->ta_buf_size; 407 if (count == 1) { 408 /* Sigle add/delete, use on-stack buffer */ 409 memset(*ta_buf, 0, TA_BUF_SZ); 410 ta_buf_m = *ta_buf; 411 } else { 412 413 /* 414 * Multiple adds/deletes, allocate larger buffer 415 * 416 * Note we need 2xcount buffer for add case: 417 * we have hold both ADD state 418 * and DELETE state (this may be needed 419 * if we need to rollback all changes) 420 */ 421 sz = count * ta_buf_sz; 422 ta_buf_m = malloc((op == OP_ADD) ? sz * 2 : sz, M_TEMP, 423 M_WAITOK | M_ZERO); 424 } 425 426 v = ta_buf_m; 427 for (i = 0; i < count; i++, v += ta_buf_sz) { 428 ptei = &tei[i]; 429 error = (op == OP_ADD) ? 430 ta->prepare_add(ch, ptei, v) : ta->prepare_del(ch, ptei, v); 431 432 /* 433 * Some syntax error (incorrect mask, or address, or 434 * anything). Return error regardless of atomicity 435 * settings. 436 */ 437 if (error != 0) 438 break; 439 } 440 441 *ta_buf = ta_buf_m; 442 return (error); 443 } 444 445 /* 446 * Flushes allocated state for each @count entries in @tei. 447 * Frees @ta_buf_m if differs from stack buffer @ta_buf. 448 */ 449 static void 450 flush_batch_buffer(struct ip_fw_chain *ch, struct table_algo *ta, 451 struct tentry_info *tei, uint32_t count, int rollback, 452 caddr_t ta_buf_m, caddr_t ta_buf) 453 { 454 caddr_t v; 455 struct tentry_info *ptei; 456 size_t ta_buf_sz; 457 int i; 458 459 ta_buf_sz = ta->ta_buf_size; 460 461 /* Run cleaning callback anyway */ 462 v = ta_buf_m; 463 for (i = 0; i < count; i++, v += ta_buf_sz) { 464 ptei = &tei[i]; 465 ta->flush_entry(ch, ptei, v); 466 if (ptei->ptv != NULL) { 467 free(ptei->ptv, M_IPFW); 468 ptei->ptv = NULL; 469 } 470 } 471 472 /* Clean up "deleted" state in case of rollback */ 473 if (rollback != 0) { 474 v = ta_buf_m + count * ta_buf_sz; 475 for (i = 0; i < count; i++, v += ta_buf_sz) 476 ta->flush_entry(ch, &tei[i], v); 477 } 478 479 if (ta_buf_m != ta_buf) 480 free(ta_buf_m, M_TEMP); 481 } 482 483 484 static void 485 rollback_add_entry(void *object, struct op_state *_state) 486 { 487 struct ip_fw_chain *ch; 488 struct tableop_state *ts; 489 490 ts = (struct tableop_state *)_state; 491 492 if (ts->tc != object && ts->ch != object) 493 return; 494 495 ch = ts->ch; 496 497 IPFW_UH_WLOCK_ASSERT(ch); 498 499 /* Call specifid unlockers */ 500 rollback_table_values(ts); 501 502 /* Indicate we've called */ 503 ts->modified = 1; 504 } 505 506 /* 507 * Adds/updates one or more entries in table @ti. 508 * 509 * Function may drop/reacquire UH wlock multiple times due to 510 * items alloc, algorithm callbacks (check_space), value linkage 511 * (new values, value storage realloc), etc.. 512 * Other processes like other adds (which may involve storage resize), 513 * table swaps (which changes table data and may change algo type), 514 * table modify (which may change value mask) may be executed 515 * simultaneously so we need to deal with it. 516 * 517 * The following approach was implemented: 518 * we have per-chain linked list, protected with UH lock. 519 * add_table_entry prepares special on-stack structure wthich is passed 520 * to its descendants. Users add this structure to this list before unlock. 521 * After performing needed operations and acquiring UH lock back, each user 522 * checks if structure has changed. If true, it rolls local state back and 523 * returns without error to the caller. 524 * add_table_entry() on its own checks if structure has changed and restarts 525 * its operation from the beginning (goto restart). 526 * 527 * Functions which are modifying fields of interest (currently 528 * resize_shared_value_storage() and swap_tables() ) 529 * traverses given list while holding UH lock immediately before 530 * performing their operations calling function provided be list entry 531 * ( currently rollback_add_entry ) which performs rollback for all necessary 532 * state and sets appropriate values in structure indicating rollback 533 * has happened. 534 * 535 * Algo interaction: 536 * Function references @ti first to ensure table won't 537 * disappear or change its type. 538 * After that, prepare_add callback is called for each @tei entry. 539 * Next, we try to add each entry under UH+WHLOCK 540 * using add() callback. 541 * Finally, we free all state by calling flush_entry callback 542 * for each @tei. 543 * 544 * Returns 0 on success. 545 */ 546 int 547 add_table_entry(struct ip_fw_chain *ch, struct tid_info *ti, 548 struct tentry_info *tei, uint8_t flags, uint32_t count) 549 { 550 struct table_config *tc; 551 struct table_algo *ta; 552 uint16_t kidx; 553 int error, first_error, i, rollback; 554 uint32_t num, numadd; 555 struct tentry_info *ptei; 556 struct tableop_state ts; 557 char ta_buf[TA_BUF_SZ]; 558 caddr_t ta_buf_m, v; 559 560 memset(&ts, 0, sizeof(ts)); 561 ta = NULL; 562 IPFW_UH_WLOCK(ch); 563 564 /* 565 * Find and reference existing table. 566 */ 567 restart: 568 if (ts.modified != 0) { 569 IPFW_UH_WUNLOCK(ch); 570 flush_batch_buffer(ch, ta, tei, count, rollback, 571 ta_buf_m, ta_buf); 572 memset(&ts, 0, sizeof(ts)); 573 ta = NULL; 574 IPFW_UH_WLOCK(ch); 575 } 576 577 error = find_ref_table(ch, ti, tei, count, OP_ADD, &tc); 578 if (error != 0) { 579 IPFW_UH_WUNLOCK(ch); 580 return (error); 581 } 582 ta = tc->ta; 583 584 /* Fill in tablestate */ 585 ts.ch = ch; 586 ts.opstate.func = rollback_add_entry; 587 ts.tc = tc; 588 ts.vshared = tc->vshared; 589 ts.vmask = tc->vmask; 590 ts.ta = ta; 591 ts.tei = tei; 592 ts.count = count; 593 rollback = 0; 594 add_toperation_state(ch, &ts); 595 IPFW_UH_WUNLOCK(ch); 596 597 /* Allocate memory and prepare record(s) */ 598 /* Pass stack buffer by default */ 599 ta_buf_m = ta_buf; 600 error = prepare_batch_buffer(ch, ta, tei, count, OP_ADD, &ta_buf_m); 601 602 IPFW_UH_WLOCK(ch); 603 del_toperation_state(ch, &ts); 604 /* Drop reference we've used in first search */ 605 tc->no.refcnt--; 606 607 /* Check prepare_batch_buffer() error */ 608 if (error != 0) 609 goto cleanup; 610 611 /* 612 * Check if table swap has happened. 613 * (so table algo might be changed). 614 * Restart operation to achieve consistent behavior. 615 */ 616 if (ts.modified != 0) 617 goto restart; 618 619 /* 620 * Link all values values to shared/per-table value array. 621 * 622 * May release/reacquire UH_WLOCK. 623 */ 624 error = ipfw_link_table_values(ch, &ts); 625 if (error != 0) 626 goto cleanup; 627 if (ts.modified != 0) 628 goto restart; 629 630 /* 631 * Ensure we are able to add all entries without additional 632 * memory allocations. May release/reacquire UH_WLOCK. 633 */ 634 kidx = tc->no.kidx; 635 error = check_table_space(ch, &ts, tc, KIDX_TO_TI(ch, kidx), count); 636 if (error != 0) 637 goto cleanup; 638 if (ts.modified != 0) 639 goto restart; 640 641 /* We've got valid table in @tc. Let's try to add data */ 642 kidx = tc->no.kidx; 643 ta = tc->ta; 644 numadd = 0; 645 first_error = 0; 646 647 IPFW_WLOCK(ch); 648 649 v = ta_buf_m; 650 for (i = 0; i < count; i++, v += ta->ta_buf_size) { 651 ptei = &tei[i]; 652 num = 0; 653 /* check limit before adding */ 654 if ((error = check_table_limit(tc, ptei)) == 0) { 655 error = ta->add(tc->astate, KIDX_TO_TI(ch, kidx), 656 ptei, v, &num); 657 /* Set status flag to inform userland */ 658 store_tei_result(ptei, OP_ADD, error, num); 659 } 660 if (error == 0) { 661 /* Update number of records to ease limit checking */ 662 tc->count += num; 663 numadd += num; 664 continue; 665 } 666 667 if (first_error == 0) 668 first_error = error; 669 670 /* 671 * Some error have happened. Check our atomicity 672 * settings: continue if atomicity is not required, 673 * rollback changes otherwise. 674 */ 675 if ((flags & IPFW_CTF_ATOMIC) == 0) 676 continue; 677 678 rollback_added_entries(ch, tc, KIDX_TO_TI(ch, kidx), 679 tei, ta_buf_m, count, i); 680 681 rollback = 1; 682 break; 683 } 684 685 IPFW_WUNLOCK(ch); 686 687 ipfw_garbage_table_values(ch, tc, tei, count, rollback); 688 689 /* Permit post-add algorithm grow/rehash. */ 690 if (numadd != 0) 691 check_table_space(ch, NULL, tc, KIDX_TO_TI(ch, kidx), 0); 692 693 /* Return first error to user, if any */ 694 error = first_error; 695 696 cleanup: 697 IPFW_UH_WUNLOCK(ch); 698 699 flush_batch_buffer(ch, ta, tei, count, rollback, ta_buf_m, ta_buf); 700 701 return (error); 702 } 703 704 /* 705 * Deletes one or more entries in table @ti. 706 * 707 * Returns 0 on success. 708 */ 709 int 710 del_table_entry(struct ip_fw_chain *ch, struct tid_info *ti, 711 struct tentry_info *tei, uint8_t flags, uint32_t count) 712 { 713 struct table_config *tc; 714 struct table_algo *ta; 715 struct tentry_info *ptei; 716 uint16_t kidx; 717 int error, first_error, i; 718 uint32_t num, numdel; 719 char ta_buf[TA_BUF_SZ]; 720 caddr_t ta_buf_m, v; 721 722 /* 723 * Find and reference existing table. 724 */ 725 IPFW_UH_WLOCK(ch); 726 error = find_ref_table(ch, ti, tei, count, OP_DEL, &tc); 727 if (error != 0) { 728 IPFW_UH_WUNLOCK(ch); 729 return (error); 730 } 731 ta = tc->ta; 732 IPFW_UH_WUNLOCK(ch); 733 734 /* Allocate memory and prepare record(s) */ 735 /* Pass stack buffer by default */ 736 ta_buf_m = ta_buf; 737 error = prepare_batch_buffer(ch, ta, tei, count, OP_DEL, &ta_buf_m); 738 if (error != 0) 739 goto cleanup; 740 741 IPFW_UH_WLOCK(ch); 742 743 /* Drop reference we've used in first search */ 744 tc->no.refcnt--; 745 746 /* 747 * Check if table algo is still the same. 748 * (changed ta may be the result of table swap). 749 */ 750 if (ta != tc->ta) { 751 IPFW_UH_WUNLOCK(ch); 752 error = EINVAL; 753 goto cleanup; 754 } 755 756 kidx = tc->no.kidx; 757 numdel = 0; 758 first_error = 0; 759 760 IPFW_WLOCK(ch); 761 v = ta_buf_m; 762 for (i = 0; i < count; i++, v += ta->ta_buf_size) { 763 ptei = &tei[i]; 764 num = 0; 765 error = ta->del(tc->astate, KIDX_TO_TI(ch, kidx), ptei, v, 766 &num); 767 /* Save state for userland */ 768 store_tei_result(ptei, OP_DEL, error, num); 769 if (error != 0 && first_error == 0) 770 first_error = error; 771 tc->count -= num; 772 numdel += num; 773 } 774 IPFW_WUNLOCK(ch); 775 776 /* Unlink non-used values */ 777 ipfw_garbage_table_values(ch, tc, tei, count, 0); 778 779 if (numdel != 0) { 780 /* Run post-del hook to permit shrinking */ 781 check_table_space(ch, NULL, tc, KIDX_TO_TI(ch, kidx), 0); 782 } 783 784 IPFW_UH_WUNLOCK(ch); 785 786 /* Return first error to user, if any */ 787 error = first_error; 788 789 cleanup: 790 flush_batch_buffer(ch, ta, tei, count, 0, ta_buf_m, ta_buf); 791 792 return (error); 793 } 794 795 /* 796 * Ensure that table @tc has enough space to add @count entries without 797 * need for reallocation. 798 * 799 * Callbacks order: 800 * 0) need_modify() (UH_WLOCK) - checks if @count items can be added w/o resize. 801 * 802 * 1) alloc_modify (no locks, M_WAITOK) - alloc new state based on @pflags. 803 * 2) prepare_modifyt (UH_WLOCK) - copy old data into new storage 804 * 3) modify (UH_WLOCK + WLOCK) - switch pointers 805 * 4) flush_modify (UH_WLOCK) - free state, if needed 806 * 807 * Returns 0 on success. 808 */ 809 static int 810 check_table_space(struct ip_fw_chain *ch, struct tableop_state *ts, 811 struct table_config *tc, struct table_info *ti, uint32_t count) 812 { 813 struct table_algo *ta; 814 uint64_t pflags; 815 char ta_buf[TA_BUF_SZ]; 816 int error; 817 818 IPFW_UH_WLOCK_ASSERT(ch); 819 820 error = 0; 821 ta = tc->ta; 822 if (ta->need_modify == NULL) 823 return (0); 824 825 /* Acquire reference not to loose @tc between locks/unlocks */ 826 tc->no.refcnt++; 827 828 /* 829 * TODO: think about avoiding race between large add/large delete 830 * operation on algorithm which implements shrinking along with 831 * growing. 832 */ 833 while (true) { 834 pflags = 0; 835 if (ta->need_modify(tc->astate, ti, count, &pflags) == 0) { 836 error = 0; 837 break; 838 } 839 840 /* We have to shrink/grow table */ 841 if (ts != NULL) 842 add_toperation_state(ch, ts); 843 IPFW_UH_WUNLOCK(ch); 844 845 memset(&ta_buf, 0, sizeof(ta_buf)); 846 error = ta->prepare_mod(ta_buf, &pflags); 847 848 IPFW_UH_WLOCK(ch); 849 if (ts != NULL) 850 del_toperation_state(ch, ts); 851 852 if (error != 0) 853 break; 854 855 if (ts != NULL && ts->modified != 0) { 856 857 /* 858 * Swap operation has happened 859 * so we're currently operating on other 860 * table data. Stop doing this. 861 */ 862 ta->flush_mod(ta_buf); 863 break; 864 } 865 866 /* Check if we still need to alter table */ 867 ti = KIDX_TO_TI(ch, tc->no.kidx); 868 if (ta->need_modify(tc->astate, ti, count, &pflags) == 0) { 869 IPFW_UH_WUNLOCK(ch); 870 871 /* 872 * Other thread has already performed resize. 873 * Flush our state and return. 874 */ 875 ta->flush_mod(ta_buf); 876 break; 877 } 878 879 error = ta->fill_mod(tc->astate, ti, ta_buf, &pflags); 880 if (error == 0) { 881 /* Do actual modification */ 882 IPFW_WLOCK(ch); 883 ta->modify(tc->astate, ti, ta_buf, pflags); 884 IPFW_WUNLOCK(ch); 885 } 886 887 /* Anyway, flush data and retry */ 888 ta->flush_mod(ta_buf); 889 } 890 891 tc->no.refcnt--; 892 return (error); 893 } 894 895 /* 896 * Adds or deletes record in table. 897 * Data layout (v0): 898 * Request: [ ip_fw3_opheader ipfw_table_xentry ] 899 * 900 * Returns 0 on success 901 */ 902 static int 903 manage_table_ent_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 904 struct sockopt_data *sd) 905 { 906 ipfw_table_xentry *xent; 907 struct tentry_info tei; 908 struct tid_info ti; 909 struct table_value v; 910 int error, hdrlen, read; 911 912 hdrlen = offsetof(ipfw_table_xentry, k); 913 914 /* Check minimum header size */ 915 if (sd->valsize < (sizeof(*op3) + hdrlen)) 916 return (EINVAL); 917 918 read = sizeof(ip_fw3_opheader); 919 920 /* Check if xentry len field is valid */ 921 xent = (ipfw_table_xentry *)(op3 + 1); 922 if (xent->len < hdrlen || xent->len + read > sd->valsize) 923 return (EINVAL); 924 925 memset(&tei, 0, sizeof(tei)); 926 tei.paddr = &xent->k; 927 tei.masklen = xent->masklen; 928 ipfw_import_table_value_legacy(xent->value, &v); 929 tei.pvalue = &v; 930 /* Old requests compatibility */ 931 tei.flags = TEI_FLAGS_COMPAT; 932 if (xent->type == IPFW_TABLE_ADDR) { 933 if (xent->len - hdrlen == sizeof(in_addr_t)) 934 tei.subtype = AF_INET; 935 else 936 tei.subtype = AF_INET6; 937 } 938 939 memset(&ti, 0, sizeof(ti)); 940 ti.uidx = xent->tbl; 941 ti.type = xent->type; 942 943 error = (op3->opcode == IP_FW_TABLE_XADD) ? 944 add_table_entry(ch, &ti, &tei, 0, 1) : 945 del_table_entry(ch, &ti, &tei, 0, 1); 946 947 return (error); 948 } 949 950 /* 951 * Adds or deletes record in table. 952 * Data layout (v1)(current): 953 * Request: [ ipfw_obj_header 954 * ipfw_obj_ctlv(IPFW_TLV_TBLENT_LIST) [ ipfw_obj_tentry x N ] 955 * ] 956 * 957 * Returns 0 on success 958 */ 959 static int 960 manage_table_ent_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 961 struct sockopt_data *sd) 962 { 963 ipfw_obj_tentry *tent, *ptent; 964 ipfw_obj_ctlv *ctlv; 965 ipfw_obj_header *oh; 966 struct tentry_info *ptei, tei, *tei_buf; 967 struct tid_info ti; 968 int error, i, kidx, read; 969 970 /* Check minimum header size */ 971 if (sd->valsize < (sizeof(*oh) + sizeof(*ctlv))) 972 return (EINVAL); 973 974 /* Check if passed data is too long */ 975 if (sd->valsize != sd->kavail) 976 return (EINVAL); 977 978 oh = (ipfw_obj_header *)sd->kbuf; 979 980 /* Basic length checks for TLVs */ 981 if (oh->ntlv.head.length != sizeof(oh->ntlv)) 982 return (EINVAL); 983 984 read = sizeof(*oh); 985 986 ctlv = (ipfw_obj_ctlv *)(oh + 1); 987 if (ctlv->head.length + read != sd->valsize) 988 return (EINVAL); 989 990 read += sizeof(*ctlv); 991 tent = (ipfw_obj_tentry *)(ctlv + 1); 992 if (ctlv->count * sizeof(*tent) + read != sd->valsize) 993 return (EINVAL); 994 995 if (ctlv->count == 0) 996 return (0); 997 998 /* 999 * Mark entire buffer as "read". 1000 * This instructs sopt api write it back 1001 * after function return. 1002 */ 1003 ipfw_get_sopt_header(sd, sd->valsize); 1004 1005 /* Perform basic checks for each entry */ 1006 ptent = tent; 1007 kidx = tent->idx; 1008 for (i = 0; i < ctlv->count; i++, ptent++) { 1009 if (ptent->head.length != sizeof(*ptent)) 1010 return (EINVAL); 1011 if (ptent->idx != kidx) 1012 return (ENOTSUP); 1013 } 1014 1015 /* Convert data into kernel request objects */ 1016 objheader_to_ti(oh, &ti); 1017 ti.type = oh->ntlv.type; 1018 ti.uidx = kidx; 1019 1020 /* Use on-stack buffer for single add/del */ 1021 if (ctlv->count == 1) { 1022 memset(&tei, 0, sizeof(tei)); 1023 tei_buf = &tei; 1024 } else 1025 tei_buf = malloc(ctlv->count * sizeof(tei), M_TEMP, 1026 M_WAITOK | M_ZERO); 1027 1028 ptei = tei_buf; 1029 ptent = tent; 1030 for (i = 0; i < ctlv->count; i++, ptent++, ptei++) { 1031 ptei->paddr = &ptent->k; 1032 ptei->subtype = ptent->subtype; 1033 ptei->masklen = ptent->masklen; 1034 if (ptent->head.flags & IPFW_TF_UPDATE) 1035 ptei->flags |= TEI_FLAGS_UPDATE; 1036 1037 ipfw_import_table_value_v1(&ptent->v.value); 1038 ptei->pvalue = (struct table_value *)&ptent->v.value; 1039 } 1040 1041 error = (oh->opheader.opcode == IP_FW_TABLE_XADD) ? 1042 add_table_entry(ch, &ti, tei_buf, ctlv->flags, ctlv->count) : 1043 del_table_entry(ch, &ti, tei_buf, ctlv->flags, ctlv->count); 1044 1045 /* Translate result back to userland */ 1046 ptei = tei_buf; 1047 ptent = tent; 1048 for (i = 0; i < ctlv->count; i++, ptent++, ptei++) { 1049 if (ptei->flags & TEI_FLAGS_ADDED) 1050 ptent->result = IPFW_TR_ADDED; 1051 else if (ptei->flags & TEI_FLAGS_DELETED) 1052 ptent->result = IPFW_TR_DELETED; 1053 else if (ptei->flags & TEI_FLAGS_UPDATED) 1054 ptent->result = IPFW_TR_UPDATED; 1055 else if (ptei->flags & TEI_FLAGS_LIMIT) 1056 ptent->result = IPFW_TR_LIMIT; 1057 else if (ptei->flags & TEI_FLAGS_ERROR) 1058 ptent->result = IPFW_TR_ERROR; 1059 else if (ptei->flags & TEI_FLAGS_NOTFOUND) 1060 ptent->result = IPFW_TR_NOTFOUND; 1061 else if (ptei->flags & TEI_FLAGS_EXISTS) 1062 ptent->result = IPFW_TR_EXISTS; 1063 ipfw_export_table_value_v1(ptei->pvalue, &ptent->v.value); 1064 } 1065 1066 if (tei_buf != &tei) 1067 free(tei_buf, M_TEMP); 1068 1069 return (error); 1070 } 1071 1072 /* 1073 * Looks up an entry in given table. 1074 * Data layout (v0)(current): 1075 * Request: [ ipfw_obj_header ipfw_obj_tentry ] 1076 * Reply: [ ipfw_obj_header ipfw_obj_tentry ] 1077 * 1078 * Returns 0 on success 1079 */ 1080 static int 1081 find_table_entry(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1082 struct sockopt_data *sd) 1083 { 1084 ipfw_obj_tentry *tent; 1085 ipfw_obj_header *oh; 1086 struct tid_info ti; 1087 struct table_config *tc; 1088 struct table_algo *ta; 1089 struct table_info *kti; 1090 struct table_value *pval; 1091 struct namedobj_instance *ni; 1092 int error; 1093 size_t sz; 1094 1095 /* Check minimum header size */ 1096 sz = sizeof(*oh) + sizeof(*tent); 1097 if (sd->valsize != sz) 1098 return (EINVAL); 1099 1100 oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 1101 tent = (ipfw_obj_tentry *)(oh + 1); 1102 1103 /* Basic length checks for TLVs */ 1104 if (oh->ntlv.head.length != sizeof(oh->ntlv)) 1105 return (EINVAL); 1106 1107 objheader_to_ti(oh, &ti); 1108 ti.type = oh->ntlv.type; 1109 ti.uidx = tent->idx; 1110 1111 IPFW_UH_RLOCK(ch); 1112 ni = CHAIN_TO_NI(ch); 1113 1114 /* 1115 * Find existing table and check its type . 1116 */ 1117 ta = NULL; 1118 if ((tc = find_table(ni, &ti)) == NULL) { 1119 IPFW_UH_RUNLOCK(ch); 1120 return (ESRCH); 1121 } 1122 1123 /* check table type */ 1124 if (tc->no.subtype != ti.type) { 1125 IPFW_UH_RUNLOCK(ch); 1126 return (EINVAL); 1127 } 1128 1129 kti = KIDX_TO_TI(ch, tc->no.kidx); 1130 ta = tc->ta; 1131 1132 if (ta->find_tentry == NULL) 1133 return (ENOTSUP); 1134 1135 error = ta->find_tentry(tc->astate, kti, tent); 1136 if (error == 0) { 1137 pval = get_table_value(ch, tc, tent->v.kidx); 1138 ipfw_export_table_value_v1(pval, &tent->v.value); 1139 } 1140 IPFW_UH_RUNLOCK(ch); 1141 1142 return (error); 1143 } 1144 1145 /* 1146 * Flushes all entries or destroys given table. 1147 * Data layout (v0)(current): 1148 * Request: [ ipfw_obj_header ] 1149 * 1150 * Returns 0 on success 1151 */ 1152 static int 1153 flush_table_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1154 struct sockopt_data *sd) 1155 { 1156 int error; 1157 struct _ipfw_obj_header *oh; 1158 struct tid_info ti; 1159 1160 if (sd->valsize != sizeof(*oh)) 1161 return (EINVAL); 1162 1163 oh = (struct _ipfw_obj_header *)op3; 1164 objheader_to_ti(oh, &ti); 1165 1166 if (op3->opcode == IP_FW_TABLE_XDESTROY) 1167 error = destroy_table(ch, &ti); 1168 else if (op3->opcode == IP_FW_TABLE_XFLUSH) 1169 error = flush_table(ch, &ti); 1170 else 1171 return (ENOTSUP); 1172 1173 return (error); 1174 } 1175 1176 static void 1177 restart_flush(void *object, struct op_state *_state) 1178 { 1179 struct tableop_state *ts; 1180 1181 ts = (struct tableop_state *)_state; 1182 1183 if (ts->tc != object) 1184 return; 1185 1186 /* Indicate we've called */ 1187 ts->modified = 1; 1188 } 1189 1190 /* 1191 * Flushes given table. 1192 * 1193 * Function create new table instance with the same 1194 * parameters, swaps it with old one and 1195 * flushes state without holding runtime WLOCK. 1196 * 1197 * Returns 0 on success. 1198 */ 1199 int 1200 flush_table(struct ip_fw_chain *ch, struct tid_info *ti) 1201 { 1202 struct namedobj_instance *ni; 1203 struct table_config *tc; 1204 struct table_algo *ta; 1205 struct table_info ti_old, ti_new, *tablestate; 1206 void *astate_old, *astate_new; 1207 char algostate[64], *pstate; 1208 struct tableop_state ts; 1209 int error, need_gc; 1210 uint16_t kidx; 1211 uint8_t tflags; 1212 1213 /* 1214 * Stage 1: save table algorithm. 1215 * Reference found table to ensure it won't disappear. 1216 */ 1217 IPFW_UH_WLOCK(ch); 1218 ni = CHAIN_TO_NI(ch); 1219 if ((tc = find_table(ni, ti)) == NULL) { 1220 IPFW_UH_WUNLOCK(ch); 1221 return (ESRCH); 1222 } 1223 need_gc = 0; 1224 astate_new = NULL; 1225 memset(&ti_new, 0, sizeof(ti_new)); 1226 restart: 1227 /* Set up swap handler */ 1228 memset(&ts, 0, sizeof(ts)); 1229 ts.opstate.func = restart_flush; 1230 ts.tc = tc; 1231 1232 ta = tc->ta; 1233 /* Do not flush readonly tables */ 1234 if ((ta->flags & TA_FLAG_READONLY) != 0) { 1235 IPFW_UH_WUNLOCK(ch); 1236 return (EACCES); 1237 } 1238 /* Save startup algo parameters */ 1239 if (ta->print_config != NULL) { 1240 ta->print_config(tc->astate, KIDX_TO_TI(ch, tc->no.kidx), 1241 algostate, sizeof(algostate)); 1242 pstate = algostate; 1243 } else 1244 pstate = NULL; 1245 tflags = tc->tflags; 1246 tc->no.refcnt++; 1247 add_toperation_state(ch, &ts); 1248 IPFW_UH_WUNLOCK(ch); 1249 1250 /* 1251 * Stage 1.5: if this is not the first attempt, destroy previous state 1252 */ 1253 if (need_gc != 0) { 1254 ta->destroy(astate_new, &ti_new); 1255 need_gc = 0; 1256 } 1257 1258 /* 1259 * Stage 2: allocate new table instance using same algo. 1260 */ 1261 memset(&ti_new, 0, sizeof(struct table_info)); 1262 error = ta->init(ch, &astate_new, &ti_new, pstate, tflags); 1263 1264 /* 1265 * Stage 3: swap old state pointers with newly-allocated ones. 1266 * Decrease refcount. 1267 */ 1268 IPFW_UH_WLOCK(ch); 1269 tc->no.refcnt--; 1270 del_toperation_state(ch, &ts); 1271 1272 if (error != 0) { 1273 IPFW_UH_WUNLOCK(ch); 1274 return (error); 1275 } 1276 1277 /* 1278 * Restart operation if table swap has happened: 1279 * even if algo may be the same, algo init parameters 1280 * may change. Restart operation instead of doing 1281 * complex checks. 1282 */ 1283 if (ts.modified != 0) { 1284 /* Delay destroying data since we're holding UH lock */ 1285 need_gc = 1; 1286 goto restart; 1287 } 1288 1289 ni = CHAIN_TO_NI(ch); 1290 kidx = tc->no.kidx; 1291 tablestate = (struct table_info *)ch->tablestate; 1292 1293 IPFW_WLOCK(ch); 1294 ti_old = tablestate[kidx]; 1295 tablestate[kidx] = ti_new; 1296 IPFW_WUNLOCK(ch); 1297 1298 astate_old = tc->astate; 1299 tc->astate = astate_new; 1300 tc->ti_copy = ti_new; 1301 tc->count = 0; 1302 1303 /* Notify algo on real @ti address */ 1304 if (ta->change_ti != NULL) 1305 ta->change_ti(tc->astate, &tablestate[kidx]); 1306 1307 /* 1308 * Stage 4: unref values. 1309 */ 1310 ipfw_unref_table_values(ch, tc, ta, astate_old, &ti_old); 1311 IPFW_UH_WUNLOCK(ch); 1312 1313 /* 1314 * Stage 5: perform real flush/destroy. 1315 */ 1316 ta->destroy(astate_old, &ti_old); 1317 1318 return (0); 1319 } 1320 1321 /* 1322 * Swaps two tables. 1323 * Data layout (v0)(current): 1324 * Request: [ ipfw_obj_header ipfw_obj_ntlv ] 1325 * 1326 * Returns 0 on success 1327 */ 1328 static int 1329 swap_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1330 struct sockopt_data *sd) 1331 { 1332 int error; 1333 struct _ipfw_obj_header *oh; 1334 struct tid_info ti_a, ti_b; 1335 1336 if (sd->valsize != sizeof(*oh) + sizeof(ipfw_obj_ntlv)) 1337 return (EINVAL); 1338 1339 oh = (struct _ipfw_obj_header *)op3; 1340 ntlv_to_ti(&oh->ntlv, &ti_a); 1341 ntlv_to_ti((ipfw_obj_ntlv *)(oh + 1), &ti_b); 1342 1343 error = swap_tables(ch, &ti_a, &ti_b); 1344 1345 return (error); 1346 } 1347 1348 /* 1349 * Swaps two tables of the same type/valtype. 1350 * 1351 * Checks if tables are compatible and limits 1352 * permits swap, than actually perform swap. 1353 * 1354 * Each table consists of 2 different parts: 1355 * config: 1356 * @tc (with name, set, kidx) and rule bindings, which is "stable". 1357 * number of items 1358 * table algo 1359 * runtime: 1360 * runtime data @ti (ch->tablestate) 1361 * runtime cache in @tc 1362 * algo-specific data (@tc->astate) 1363 * 1364 * So we switch: 1365 * all runtime data 1366 * number of items 1367 * table algo 1368 * 1369 * After that we call @ti change handler for each table. 1370 * 1371 * Note that referencing @tc won't protect tc->ta from change. 1372 * XXX: Do we need to restrict swap between locked tables? 1373 * XXX: Do we need to exchange ftype? 1374 * 1375 * Returns 0 on success. 1376 */ 1377 static int 1378 swap_tables(struct ip_fw_chain *ch, struct tid_info *a, 1379 struct tid_info *b) 1380 { 1381 struct namedobj_instance *ni; 1382 struct table_config *tc_a, *tc_b; 1383 struct table_algo *ta; 1384 struct table_info ti, *tablestate; 1385 void *astate; 1386 uint32_t count; 1387 1388 /* 1389 * Stage 1: find both tables and ensure they are of 1390 * the same type. 1391 */ 1392 IPFW_UH_WLOCK(ch); 1393 ni = CHAIN_TO_NI(ch); 1394 if ((tc_a = find_table(ni, a)) == NULL) { 1395 IPFW_UH_WUNLOCK(ch); 1396 return (ESRCH); 1397 } 1398 if ((tc_b = find_table(ni, b)) == NULL) { 1399 IPFW_UH_WUNLOCK(ch); 1400 return (ESRCH); 1401 } 1402 1403 /* It is very easy to swap between the same table */ 1404 if (tc_a == tc_b) { 1405 IPFW_UH_WUNLOCK(ch); 1406 return (0); 1407 } 1408 1409 /* Check type and value are the same */ 1410 if (tc_a->no.subtype!=tc_b->no.subtype || tc_a->tflags!=tc_b->tflags) { 1411 IPFW_UH_WUNLOCK(ch); 1412 return (EINVAL); 1413 } 1414 1415 /* Check limits before swap */ 1416 if ((tc_a->limit != 0 && tc_b->count > tc_a->limit) || 1417 (tc_b->limit != 0 && tc_a->count > tc_b->limit)) { 1418 IPFW_UH_WUNLOCK(ch); 1419 return (EFBIG); 1420 } 1421 1422 /* Check if one of the tables is readonly */ 1423 if (((tc_a->ta->flags | tc_b->ta->flags) & TA_FLAG_READONLY) != 0) { 1424 IPFW_UH_WUNLOCK(ch); 1425 return (EACCES); 1426 } 1427 1428 /* Notify we're going to swap */ 1429 rollback_toperation_state(ch, tc_a); 1430 rollback_toperation_state(ch, tc_b); 1431 1432 /* Everything is fine, prepare to swap */ 1433 tablestate = (struct table_info *)ch->tablestate; 1434 ti = tablestate[tc_a->no.kidx]; 1435 ta = tc_a->ta; 1436 astate = tc_a->astate; 1437 count = tc_a->count; 1438 1439 IPFW_WLOCK(ch); 1440 /* a <- b */ 1441 tablestate[tc_a->no.kidx] = tablestate[tc_b->no.kidx]; 1442 tc_a->ta = tc_b->ta; 1443 tc_a->astate = tc_b->astate; 1444 tc_a->count = tc_b->count; 1445 /* b <- a */ 1446 tablestate[tc_b->no.kidx] = ti; 1447 tc_b->ta = ta; 1448 tc_b->astate = astate; 1449 tc_b->count = count; 1450 IPFW_WUNLOCK(ch); 1451 1452 /* Ensure tc.ti copies are in sync */ 1453 tc_a->ti_copy = tablestate[tc_a->no.kidx]; 1454 tc_b->ti_copy = tablestate[tc_b->no.kidx]; 1455 1456 /* Notify both tables on @ti change */ 1457 if (tc_a->ta->change_ti != NULL) 1458 tc_a->ta->change_ti(tc_a->astate, &tablestate[tc_a->no.kidx]); 1459 if (tc_b->ta->change_ti != NULL) 1460 tc_b->ta->change_ti(tc_b->astate, &tablestate[tc_b->no.kidx]); 1461 1462 IPFW_UH_WUNLOCK(ch); 1463 1464 return (0); 1465 } 1466 1467 /* 1468 * Destroys table specified by @ti. 1469 * Data layout (v0)(current): 1470 * Request: [ ip_fw3_opheader ] 1471 * 1472 * Returns 0 on success 1473 */ 1474 static int 1475 destroy_table(struct ip_fw_chain *ch, struct tid_info *ti) 1476 { 1477 struct namedobj_instance *ni; 1478 struct table_config *tc; 1479 1480 IPFW_UH_WLOCK(ch); 1481 1482 ni = CHAIN_TO_NI(ch); 1483 if ((tc = find_table(ni, ti)) == NULL) { 1484 IPFW_UH_WUNLOCK(ch); 1485 return (ESRCH); 1486 } 1487 1488 /* Do not permit destroying referenced tables */ 1489 if (tc->no.refcnt > 0) { 1490 IPFW_UH_WUNLOCK(ch); 1491 return (EBUSY); 1492 } 1493 1494 IPFW_WLOCK(ch); 1495 unlink_table(ch, tc); 1496 IPFW_WUNLOCK(ch); 1497 1498 /* Free obj index */ 1499 if (ipfw_objhash_free_idx(ni, tc->no.kidx) != 0) 1500 printf("Error unlinking kidx %d from table %s\n", 1501 tc->no.kidx, tc->tablename); 1502 1503 /* Unref values used in tables while holding UH lock */ 1504 ipfw_unref_table_values(ch, tc, tc->ta, tc->astate, &tc->ti_copy); 1505 IPFW_UH_WUNLOCK(ch); 1506 1507 free_table_config(ni, tc); 1508 1509 return (0); 1510 } 1511 1512 static uint32_t 1513 roundup2p(uint32_t v) 1514 { 1515 1516 v--; 1517 v |= v >> 1; 1518 v |= v >> 2; 1519 v |= v >> 4; 1520 v |= v >> 8; 1521 v |= v >> 16; 1522 v++; 1523 1524 return (v); 1525 } 1526 1527 /* 1528 * Grow tables index. 1529 * 1530 * Returns 0 on success. 1531 */ 1532 int 1533 ipfw_resize_tables(struct ip_fw_chain *ch, unsigned int ntables) 1534 { 1535 unsigned int ntables_old, tbl; 1536 struct namedobj_instance *ni; 1537 void *new_idx, *old_tablestate, *tablestate; 1538 struct table_info *ti; 1539 struct table_config *tc; 1540 int i, new_blocks; 1541 1542 /* Check new value for validity */ 1543 if (ntables == 0) 1544 return (EINVAL); 1545 if (ntables > IPFW_TABLES_MAX) 1546 ntables = IPFW_TABLES_MAX; 1547 /* Alight to nearest power of 2 */ 1548 ntables = (unsigned int)roundup2p(ntables); 1549 1550 /* Allocate new pointers */ 1551 tablestate = malloc(ntables * sizeof(struct table_info), 1552 M_IPFW, M_WAITOK | M_ZERO); 1553 1554 ipfw_objhash_bitmap_alloc(ntables, (void *)&new_idx, &new_blocks); 1555 1556 IPFW_UH_WLOCK(ch); 1557 1558 tbl = (ntables >= V_fw_tables_max) ? V_fw_tables_max : ntables; 1559 ni = CHAIN_TO_NI(ch); 1560 1561 /* Temporary restrict decreasing max_tables */ 1562 if (ntables < V_fw_tables_max) { 1563 1564 /* 1565 * FIXME: Check if we really can shrink 1566 */ 1567 IPFW_UH_WUNLOCK(ch); 1568 return (EINVAL); 1569 } 1570 1571 /* Copy table info/indices */ 1572 memcpy(tablestate, ch->tablestate, sizeof(struct table_info) * tbl); 1573 ipfw_objhash_bitmap_merge(ni, &new_idx, &new_blocks); 1574 1575 IPFW_WLOCK(ch); 1576 1577 /* Change pointers */ 1578 old_tablestate = ch->tablestate; 1579 ch->tablestate = tablestate; 1580 ipfw_objhash_bitmap_swap(ni, &new_idx, &new_blocks); 1581 1582 ntables_old = V_fw_tables_max; 1583 V_fw_tables_max = ntables; 1584 1585 IPFW_WUNLOCK(ch); 1586 1587 /* Notify all consumers that their @ti pointer has changed */ 1588 ti = (struct table_info *)ch->tablestate; 1589 for (i = 0; i < tbl; i++, ti++) { 1590 if (ti->lookup == NULL) 1591 continue; 1592 tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, i); 1593 if (tc == NULL || tc->ta->change_ti == NULL) 1594 continue; 1595 1596 tc->ta->change_ti(tc->astate, ti); 1597 } 1598 1599 IPFW_UH_WUNLOCK(ch); 1600 1601 /* Free old pointers */ 1602 free(old_tablestate, M_IPFW); 1603 ipfw_objhash_bitmap_free(new_idx, new_blocks); 1604 1605 return (0); 1606 } 1607 1608 /* 1609 * Lookup table's named object by its @kidx. 1610 */ 1611 struct named_object * 1612 ipfw_objhash_lookup_table_kidx(struct ip_fw_chain *ch, uint16_t kidx) 1613 { 1614 1615 return (ipfw_objhash_lookup_kidx(CHAIN_TO_NI(ch), kidx)); 1616 } 1617 1618 /* 1619 * Take reference to table specified in @ntlv. 1620 * On success return its @kidx. 1621 */ 1622 int 1623 ipfw_ref_table(struct ip_fw_chain *ch, ipfw_obj_ntlv *ntlv, uint16_t *kidx) 1624 { 1625 struct tid_info ti; 1626 struct table_config *tc; 1627 int error; 1628 1629 IPFW_UH_WLOCK_ASSERT(ch); 1630 1631 ntlv_to_ti(ntlv, &ti); 1632 error = find_table_err(CHAIN_TO_NI(ch), &ti, &tc); 1633 if (error != 0) 1634 return (error); 1635 1636 if (tc == NULL) 1637 return (ESRCH); 1638 1639 tc_ref(tc); 1640 *kidx = tc->no.kidx; 1641 1642 return (0); 1643 } 1644 1645 void 1646 ipfw_unref_table(struct ip_fw_chain *ch, uint16_t kidx) 1647 { 1648 1649 struct namedobj_instance *ni; 1650 struct named_object *no; 1651 1652 IPFW_UH_WLOCK_ASSERT(ch); 1653 ni = CHAIN_TO_NI(ch); 1654 no = ipfw_objhash_lookup_kidx(ni, kidx); 1655 KASSERT(no != NULL, ("Table with index %d not found", kidx)); 1656 no->refcnt--; 1657 } 1658 1659 /* 1660 * Lookup an IP @addr in table @tbl. 1661 * Stores found value in @val. 1662 * 1663 * Returns 1 if @addr was found. 1664 */ 1665 int 1666 ipfw_lookup_table(struct ip_fw_chain *ch, uint16_t tbl, in_addr_t addr, 1667 uint32_t *val) 1668 { 1669 struct table_info *ti; 1670 1671 ti = KIDX_TO_TI(ch, tbl); 1672 1673 return (ti->lookup(ti, &addr, sizeof(in_addr_t), val)); 1674 } 1675 1676 /* 1677 * Lookup an arbtrary key @paddr of legth @plen in table @tbl. 1678 * Stores found value in @val. 1679 * 1680 * Returns 1 if key was found. 1681 */ 1682 int 1683 ipfw_lookup_table_extended(struct ip_fw_chain *ch, uint16_t tbl, uint16_t plen, 1684 void *paddr, uint32_t *val) 1685 { 1686 struct table_info *ti; 1687 1688 ti = KIDX_TO_TI(ch, tbl); 1689 1690 return (ti->lookup(ti, paddr, plen, val)); 1691 } 1692 1693 /* 1694 * Info/List/dump support for tables. 1695 * 1696 */ 1697 1698 /* 1699 * High-level 'get' cmds sysctl handlers 1700 */ 1701 1702 /* 1703 * Lists all tables currently available in kernel. 1704 * Data layout (v0)(current): 1705 * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size 1706 * Reply: [ ipfw_obj_lheader ipfw_xtable_info x N ] 1707 * 1708 * Returns 0 on success 1709 */ 1710 static int 1711 list_tables(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1712 struct sockopt_data *sd) 1713 { 1714 struct _ipfw_obj_lheader *olh; 1715 int error; 1716 1717 olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh)); 1718 if (olh == NULL) 1719 return (EINVAL); 1720 if (sd->valsize < olh->size) 1721 return (EINVAL); 1722 1723 IPFW_UH_RLOCK(ch); 1724 error = export_tables(ch, olh, sd); 1725 IPFW_UH_RUNLOCK(ch); 1726 1727 return (error); 1728 } 1729 1730 /* 1731 * Store table info to buffer provided by @sd. 1732 * Data layout (v0)(current): 1733 * Request: [ ipfw_obj_header ipfw_xtable_info(empty)] 1734 * Reply: [ ipfw_obj_header ipfw_xtable_info ] 1735 * 1736 * Returns 0 on success. 1737 */ 1738 static int 1739 describe_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1740 struct sockopt_data *sd) 1741 { 1742 struct _ipfw_obj_header *oh; 1743 struct table_config *tc; 1744 struct tid_info ti; 1745 size_t sz; 1746 1747 sz = sizeof(*oh) + sizeof(ipfw_xtable_info); 1748 oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 1749 if (oh == NULL) 1750 return (EINVAL); 1751 1752 objheader_to_ti(oh, &ti); 1753 1754 IPFW_UH_RLOCK(ch); 1755 if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) { 1756 IPFW_UH_RUNLOCK(ch); 1757 return (ESRCH); 1758 } 1759 1760 export_table_info(ch, tc, (ipfw_xtable_info *)(oh + 1)); 1761 IPFW_UH_RUNLOCK(ch); 1762 1763 return (0); 1764 } 1765 1766 /* 1767 * Modifies existing table. 1768 * Data layout (v0)(current): 1769 * Request: [ ipfw_obj_header ipfw_xtable_info ] 1770 * 1771 * Returns 0 on success 1772 */ 1773 static int 1774 modify_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1775 struct sockopt_data *sd) 1776 { 1777 struct _ipfw_obj_header *oh; 1778 ipfw_xtable_info *i; 1779 char *tname; 1780 struct tid_info ti; 1781 struct namedobj_instance *ni; 1782 struct table_config *tc; 1783 1784 if (sd->valsize != sizeof(*oh) + sizeof(ipfw_xtable_info)) 1785 return (EINVAL); 1786 1787 oh = (struct _ipfw_obj_header *)sd->kbuf; 1788 i = (ipfw_xtable_info *)(oh + 1); 1789 1790 /* 1791 * Verify user-supplied strings. 1792 * Check for null-terminated/zero-length strings/ 1793 */ 1794 tname = oh->ntlv.name; 1795 if (check_table_name(tname) != 0) 1796 return (EINVAL); 1797 1798 objheader_to_ti(oh, &ti); 1799 ti.type = i->type; 1800 1801 IPFW_UH_WLOCK(ch); 1802 ni = CHAIN_TO_NI(ch); 1803 if ((tc = find_table(ni, &ti)) == NULL) { 1804 IPFW_UH_WUNLOCK(ch); 1805 return (ESRCH); 1806 } 1807 1808 /* Do not support any modifications for readonly tables */ 1809 if ((tc->ta->flags & TA_FLAG_READONLY) != 0) { 1810 IPFW_UH_WUNLOCK(ch); 1811 return (EACCES); 1812 } 1813 1814 if ((i->mflags & IPFW_TMFLAGS_LIMIT) != 0) 1815 tc->limit = i->limit; 1816 if ((i->mflags & IPFW_TMFLAGS_LOCK) != 0) 1817 tc->locked = ((i->flags & IPFW_TGFLAGS_LOCKED) != 0); 1818 IPFW_UH_WUNLOCK(ch); 1819 1820 return (0); 1821 } 1822 1823 /* 1824 * Creates new table. 1825 * Data layout (v0)(current): 1826 * Request: [ ipfw_obj_header ipfw_xtable_info ] 1827 * 1828 * Returns 0 on success 1829 */ 1830 static int 1831 create_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1832 struct sockopt_data *sd) 1833 { 1834 struct _ipfw_obj_header *oh; 1835 ipfw_xtable_info *i; 1836 char *tname, *aname; 1837 struct tid_info ti; 1838 struct namedobj_instance *ni; 1839 1840 if (sd->valsize != sizeof(*oh) + sizeof(ipfw_xtable_info)) 1841 return (EINVAL); 1842 1843 oh = (struct _ipfw_obj_header *)sd->kbuf; 1844 i = (ipfw_xtable_info *)(oh + 1); 1845 1846 /* 1847 * Verify user-supplied strings. 1848 * Check for null-terminated/zero-length strings/ 1849 */ 1850 tname = oh->ntlv.name; 1851 aname = i->algoname; 1852 if (check_table_name(tname) != 0 || 1853 strnlen(aname, sizeof(i->algoname)) == sizeof(i->algoname)) 1854 return (EINVAL); 1855 1856 if (aname[0] == '\0') { 1857 /* Use default algorithm */ 1858 aname = NULL; 1859 } 1860 1861 objheader_to_ti(oh, &ti); 1862 ti.type = i->type; 1863 1864 ni = CHAIN_TO_NI(ch); 1865 1866 IPFW_UH_RLOCK(ch); 1867 if (find_table(ni, &ti) != NULL) { 1868 IPFW_UH_RUNLOCK(ch); 1869 return (EEXIST); 1870 } 1871 IPFW_UH_RUNLOCK(ch); 1872 1873 return (create_table_internal(ch, &ti, aname, i, NULL, 0)); 1874 } 1875 1876 /* 1877 * Creates new table based on @ti and @aname. 1878 * 1879 * Assume @aname to be checked and valid. 1880 * Stores allocated table kidx inside @pkidx (if non-NULL). 1881 * Reference created table if @compat is non-zero. 1882 * 1883 * Returns 0 on success. 1884 */ 1885 static int 1886 create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti, 1887 char *aname, ipfw_xtable_info *i, uint16_t *pkidx, int compat) 1888 { 1889 struct namedobj_instance *ni; 1890 struct table_config *tc, *tc_new, *tmp; 1891 struct table_algo *ta; 1892 uint16_t kidx; 1893 1894 ni = CHAIN_TO_NI(ch); 1895 1896 ta = find_table_algo(CHAIN_TO_TCFG(ch), ti, aname); 1897 if (ta == NULL) 1898 return (ENOTSUP); 1899 1900 tc = alloc_table_config(ch, ti, ta, aname, i->tflags); 1901 if (tc == NULL) 1902 return (ENOMEM); 1903 1904 tc->vmask = i->vmask; 1905 tc->limit = i->limit; 1906 if (ta->flags & TA_FLAG_READONLY) 1907 tc->locked = 1; 1908 else 1909 tc->locked = (i->flags & IPFW_TGFLAGS_LOCKED) != 0; 1910 1911 IPFW_UH_WLOCK(ch); 1912 1913 /* Check if table has been already created */ 1914 tc_new = find_table(ni, ti); 1915 if (tc_new != NULL) { 1916 1917 /* 1918 * Compat: do not fail if we're 1919 * requesting to create existing table 1920 * which has the same type 1921 */ 1922 if (compat == 0 || tc_new->no.subtype != tc->no.subtype) { 1923 IPFW_UH_WUNLOCK(ch); 1924 free_table_config(ni, tc); 1925 return (EEXIST); 1926 } 1927 1928 /* Exchange tc and tc_new for proper refcounting & freeing */ 1929 tmp = tc; 1930 tc = tc_new; 1931 tc_new = tmp; 1932 } else { 1933 /* New table */ 1934 if (ipfw_objhash_alloc_idx(ni, &kidx) != 0) { 1935 IPFW_UH_WUNLOCK(ch); 1936 printf("Unable to allocate table index." 1937 " Consider increasing net.inet.ip.fw.tables_max"); 1938 free_table_config(ni, tc); 1939 return (EBUSY); 1940 } 1941 tc->no.kidx = kidx; 1942 tc->no.etlv = IPFW_TLV_TBL_NAME; 1943 1944 IPFW_WLOCK(ch); 1945 link_table(ch, tc); 1946 IPFW_WUNLOCK(ch); 1947 } 1948 1949 if (compat != 0) 1950 tc->no.refcnt++; 1951 if (pkidx != NULL) 1952 *pkidx = tc->no.kidx; 1953 1954 IPFW_UH_WUNLOCK(ch); 1955 1956 if (tc_new != NULL) 1957 free_table_config(ni, tc_new); 1958 1959 return (0); 1960 } 1961 1962 static void 1963 ntlv_to_ti(ipfw_obj_ntlv *ntlv, struct tid_info *ti) 1964 { 1965 1966 memset(ti, 0, sizeof(struct tid_info)); 1967 ti->set = ntlv->set; 1968 ti->uidx = ntlv->idx; 1969 ti->tlvs = ntlv; 1970 ti->tlen = ntlv->head.length; 1971 } 1972 1973 static void 1974 objheader_to_ti(struct _ipfw_obj_header *oh, struct tid_info *ti) 1975 { 1976 1977 ntlv_to_ti(&oh->ntlv, ti); 1978 } 1979 1980 struct namedobj_instance * 1981 ipfw_get_table_objhash(struct ip_fw_chain *ch) 1982 { 1983 1984 return (CHAIN_TO_NI(ch)); 1985 } 1986 1987 /* 1988 * Exports basic table info as name TLV. 1989 * Used inside dump_static_rules() to provide info 1990 * about all tables referenced by current ruleset. 1991 * 1992 * Returns 0 on success. 1993 */ 1994 int 1995 ipfw_export_table_ntlv(struct ip_fw_chain *ch, uint16_t kidx, 1996 struct sockopt_data *sd) 1997 { 1998 struct namedobj_instance *ni; 1999 struct named_object *no; 2000 ipfw_obj_ntlv *ntlv; 2001 2002 ni = CHAIN_TO_NI(ch); 2003 2004 no = ipfw_objhash_lookup_kidx(ni, kidx); 2005 KASSERT(no != NULL, ("invalid table kidx passed")); 2006 2007 ntlv = (ipfw_obj_ntlv *)ipfw_get_sopt_space(sd, sizeof(*ntlv)); 2008 if (ntlv == NULL) 2009 return (ENOMEM); 2010 2011 ntlv->head.type = IPFW_TLV_TBL_NAME; 2012 ntlv->head.length = sizeof(*ntlv); 2013 ntlv->idx = no->kidx; 2014 strlcpy(ntlv->name, no->name, sizeof(ntlv->name)); 2015 2016 return (0); 2017 } 2018 2019 struct dump_args { 2020 struct ip_fw_chain *ch; 2021 struct table_info *ti; 2022 struct table_config *tc; 2023 struct sockopt_data *sd; 2024 uint32_t cnt; 2025 uint16_t uidx; 2026 int error; 2027 uint32_t size; 2028 ipfw_table_entry *ent; 2029 ta_foreach_f *f; 2030 void *farg; 2031 ipfw_obj_tentry tent; 2032 }; 2033 2034 static int 2035 count_ext_entries(void *e, void *arg) 2036 { 2037 struct dump_args *da; 2038 2039 da = (struct dump_args *)arg; 2040 da->cnt++; 2041 2042 return (0); 2043 } 2044 2045 /* 2046 * Gets number of items from table either using 2047 * internal counter or calling algo callback for 2048 * externally-managed tables. 2049 * 2050 * Returns number of records. 2051 */ 2052 static uint32_t 2053 table_get_count(struct ip_fw_chain *ch, struct table_config *tc) 2054 { 2055 struct table_info *ti; 2056 struct table_algo *ta; 2057 struct dump_args da; 2058 2059 ti = KIDX_TO_TI(ch, tc->no.kidx); 2060 ta = tc->ta; 2061 2062 /* Use internal counter for self-managed tables */ 2063 if ((ta->flags & TA_FLAG_READONLY) == 0) 2064 return (tc->count); 2065 2066 /* Use callback to quickly get number of items */ 2067 if ((ta->flags & TA_FLAG_EXTCOUNTER) != 0) 2068 return (ta->get_count(tc->astate, ti)); 2069 2070 /* Count number of iterms ourselves */ 2071 memset(&da, 0, sizeof(da)); 2072 ta->foreach(tc->astate, ti, count_ext_entries, &da); 2073 2074 return (da.cnt); 2075 } 2076 2077 /* 2078 * Exports table @tc info into standard ipfw_xtable_info format. 2079 */ 2080 static void 2081 export_table_info(struct ip_fw_chain *ch, struct table_config *tc, 2082 ipfw_xtable_info *i) 2083 { 2084 struct table_info *ti; 2085 struct table_algo *ta; 2086 2087 i->type = tc->no.subtype; 2088 i->tflags = tc->tflags; 2089 i->vmask = tc->vmask; 2090 i->set = tc->no.set; 2091 i->kidx = tc->no.kidx; 2092 i->refcnt = tc->no.refcnt; 2093 i->count = table_get_count(ch, tc); 2094 i->limit = tc->limit; 2095 i->flags |= (tc->locked != 0) ? IPFW_TGFLAGS_LOCKED : 0; 2096 i->size = i->count * sizeof(ipfw_obj_tentry); 2097 i->size += sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info); 2098 strlcpy(i->tablename, tc->tablename, sizeof(i->tablename)); 2099 ti = KIDX_TO_TI(ch, tc->no.kidx); 2100 ta = tc->ta; 2101 if (ta->print_config != NULL) { 2102 /* Use algo function to print table config to string */ 2103 ta->print_config(tc->astate, ti, i->algoname, 2104 sizeof(i->algoname)); 2105 } else 2106 strlcpy(i->algoname, ta->name, sizeof(i->algoname)); 2107 /* Dump algo-specific data, if possible */ 2108 if (ta->dump_tinfo != NULL) { 2109 ta->dump_tinfo(tc->astate, ti, &i->ta_info); 2110 i->ta_info.flags |= IPFW_TATFLAGS_DATA; 2111 } 2112 } 2113 2114 struct dump_table_args { 2115 struct ip_fw_chain *ch; 2116 struct sockopt_data *sd; 2117 }; 2118 2119 static int 2120 export_table_internal(struct namedobj_instance *ni, struct named_object *no, 2121 void *arg) 2122 { 2123 ipfw_xtable_info *i; 2124 struct dump_table_args *dta; 2125 2126 dta = (struct dump_table_args *)arg; 2127 2128 i = (ipfw_xtable_info *)ipfw_get_sopt_space(dta->sd, sizeof(*i)); 2129 KASSERT(i != NULL, ("previously checked buffer is not enough")); 2130 2131 export_table_info(dta->ch, (struct table_config *)no, i); 2132 return (0); 2133 } 2134 2135 /* 2136 * Export all tables as ipfw_xtable_info structures to 2137 * storage provided by @sd. 2138 * 2139 * If supplied buffer is too small, fills in required size 2140 * and returns ENOMEM. 2141 * Returns 0 on success. 2142 */ 2143 static int 2144 export_tables(struct ip_fw_chain *ch, ipfw_obj_lheader *olh, 2145 struct sockopt_data *sd) 2146 { 2147 uint32_t size; 2148 uint32_t count; 2149 struct dump_table_args dta; 2150 2151 count = ipfw_objhash_count(CHAIN_TO_NI(ch)); 2152 size = count * sizeof(ipfw_xtable_info) + sizeof(ipfw_obj_lheader); 2153 2154 /* Fill in header regadless of buffer size */ 2155 olh->count = count; 2156 olh->objsize = sizeof(ipfw_xtable_info); 2157 2158 if (size > olh->size) { 2159 olh->size = size; 2160 return (ENOMEM); 2161 } 2162 2163 olh->size = size; 2164 2165 dta.ch = ch; 2166 dta.sd = sd; 2167 2168 ipfw_objhash_foreach(CHAIN_TO_NI(ch), export_table_internal, &dta); 2169 2170 return (0); 2171 } 2172 2173 /* 2174 * Dumps all table data 2175 * Data layout (v1)(current): 2176 * Request: [ ipfw_obj_header ], size = ipfw_xtable_info.size 2177 * Reply: [ ipfw_obj_header ipfw_xtable_info ipfw_obj_tentry x N ] 2178 * 2179 * Returns 0 on success 2180 */ 2181 static int 2182 dump_table_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 2183 struct sockopt_data *sd) 2184 { 2185 struct _ipfw_obj_header *oh; 2186 ipfw_xtable_info *i; 2187 struct tid_info ti; 2188 struct table_config *tc; 2189 struct table_algo *ta; 2190 struct dump_args da; 2191 uint32_t sz; 2192 2193 sz = sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info); 2194 oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 2195 if (oh == NULL) 2196 return (EINVAL); 2197 2198 i = (ipfw_xtable_info *)(oh + 1); 2199 objheader_to_ti(oh, &ti); 2200 2201 IPFW_UH_RLOCK(ch); 2202 if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) { 2203 IPFW_UH_RUNLOCK(ch); 2204 return (ESRCH); 2205 } 2206 export_table_info(ch, tc, i); 2207 2208 if (sd->valsize < i->size) { 2209 2210 /* 2211 * Submitted buffer size is not enough. 2212 * WE've already filled in @i structure with 2213 * relevant table info including size, so we 2214 * can return. Buffer will be flushed automatically. 2215 */ 2216 IPFW_UH_RUNLOCK(ch); 2217 return (ENOMEM); 2218 } 2219 2220 /* 2221 * Do the actual dump in eXtended format 2222 */ 2223 memset(&da, 0, sizeof(da)); 2224 da.ch = ch; 2225 da.ti = KIDX_TO_TI(ch, tc->no.kidx); 2226 da.tc = tc; 2227 da.sd = sd; 2228 2229 ta = tc->ta; 2230 2231 ta->foreach(tc->astate, da.ti, dump_table_tentry, &da); 2232 IPFW_UH_RUNLOCK(ch); 2233 2234 return (da.error); 2235 } 2236 2237 /* 2238 * Dumps all table data 2239 * Data layout (version 0)(legacy): 2240 * Request: [ ipfw_xtable ], size = IP_FW_TABLE_XGETSIZE() 2241 * Reply: [ ipfw_xtable ipfw_table_xentry x N ] 2242 * 2243 * Returns 0 on success 2244 */ 2245 static int 2246 dump_table_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 2247 struct sockopt_data *sd) 2248 { 2249 ipfw_xtable *xtbl; 2250 struct tid_info ti; 2251 struct table_config *tc; 2252 struct table_algo *ta; 2253 struct dump_args da; 2254 size_t sz, count; 2255 2256 xtbl = (ipfw_xtable *)ipfw_get_sopt_header(sd, sizeof(ipfw_xtable)); 2257 if (xtbl == NULL) 2258 return (EINVAL); 2259 2260 memset(&ti, 0, sizeof(ti)); 2261 ti.uidx = xtbl->tbl; 2262 2263 IPFW_UH_RLOCK(ch); 2264 if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) { 2265 IPFW_UH_RUNLOCK(ch); 2266 return (0); 2267 } 2268 count = table_get_count(ch, tc); 2269 sz = count * sizeof(ipfw_table_xentry) + sizeof(ipfw_xtable); 2270 2271 xtbl->cnt = count; 2272 xtbl->size = sz; 2273 xtbl->type = tc->no.subtype; 2274 xtbl->tbl = ti.uidx; 2275 2276 if (sd->valsize < sz) { 2277 2278 /* 2279 * Submitted buffer size is not enough. 2280 * WE've already filled in @i structure with 2281 * relevant table info including size, so we 2282 * can return. Buffer will be flushed automatically. 2283 */ 2284 IPFW_UH_RUNLOCK(ch); 2285 return (ENOMEM); 2286 } 2287 2288 /* Do the actual dump in eXtended format */ 2289 memset(&da, 0, sizeof(da)); 2290 da.ch = ch; 2291 da.ti = KIDX_TO_TI(ch, tc->no.kidx); 2292 da.tc = tc; 2293 da.sd = sd; 2294 2295 ta = tc->ta; 2296 2297 ta->foreach(tc->astate, da.ti, dump_table_xentry, &da); 2298 IPFW_UH_RUNLOCK(ch); 2299 2300 return (0); 2301 } 2302 2303 /* 2304 * Legacy function to retrieve number of items in table. 2305 */ 2306 static int 2307 get_table_size(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 2308 struct sockopt_data *sd) 2309 { 2310 uint32_t *tbl; 2311 struct tid_info ti; 2312 size_t sz; 2313 int error; 2314 2315 sz = sizeof(*op3) + sizeof(uint32_t); 2316 op3 = (ip_fw3_opheader *)ipfw_get_sopt_header(sd, sz); 2317 if (op3 == NULL) 2318 return (EINVAL); 2319 2320 tbl = (uint32_t *)(op3 + 1); 2321 memset(&ti, 0, sizeof(ti)); 2322 ti.uidx = *tbl; 2323 IPFW_UH_RLOCK(ch); 2324 error = ipfw_count_xtable(ch, &ti, tbl); 2325 IPFW_UH_RUNLOCK(ch); 2326 return (error); 2327 } 2328 2329 /* 2330 * Legacy IP_FW_TABLE_GETSIZE handler 2331 */ 2332 int 2333 ipfw_count_table(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt) 2334 { 2335 struct table_config *tc; 2336 2337 if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) 2338 return (ESRCH); 2339 *cnt = table_get_count(ch, tc); 2340 return (0); 2341 } 2342 2343 /* 2344 * Legacy IP_FW_TABLE_XGETSIZE handler 2345 */ 2346 int 2347 ipfw_count_xtable(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt) 2348 { 2349 struct table_config *tc; 2350 uint32_t count; 2351 2352 if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) { 2353 *cnt = 0; 2354 return (0); /* 'table all list' requires success */ 2355 } 2356 2357 count = table_get_count(ch, tc); 2358 *cnt = count * sizeof(ipfw_table_xentry); 2359 if (count > 0) 2360 *cnt += sizeof(ipfw_xtable); 2361 return (0); 2362 } 2363 2364 static int 2365 dump_table_entry(void *e, void *arg) 2366 { 2367 struct dump_args *da; 2368 struct table_config *tc; 2369 struct table_algo *ta; 2370 ipfw_table_entry *ent; 2371 struct table_value *pval; 2372 int error; 2373 2374 da = (struct dump_args *)arg; 2375 2376 tc = da->tc; 2377 ta = tc->ta; 2378 2379 /* Out of memory, returning */ 2380 if (da->cnt == da->size) 2381 return (1); 2382 ent = da->ent++; 2383 ent->tbl = da->uidx; 2384 da->cnt++; 2385 2386 error = ta->dump_tentry(tc->astate, da->ti, e, &da->tent); 2387 if (error != 0) 2388 return (error); 2389 2390 ent->addr = da->tent.k.addr.s_addr; 2391 ent->masklen = da->tent.masklen; 2392 pval = get_table_value(da->ch, da->tc, da->tent.v.kidx); 2393 ent->value = ipfw_export_table_value_legacy(pval); 2394 2395 return (0); 2396 } 2397 2398 /* 2399 * Dumps table in pre-8.1 legacy format. 2400 */ 2401 int 2402 ipfw_dump_table_legacy(struct ip_fw_chain *ch, struct tid_info *ti, 2403 ipfw_table *tbl) 2404 { 2405 struct table_config *tc; 2406 struct table_algo *ta; 2407 struct dump_args da; 2408 2409 tbl->cnt = 0; 2410 2411 if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) 2412 return (0); /* XXX: We should return ESRCH */ 2413 2414 ta = tc->ta; 2415 2416 /* This dump format supports IPv4 only */ 2417 if (tc->no.subtype != IPFW_TABLE_ADDR) 2418 return (0); 2419 2420 memset(&da, 0, sizeof(da)); 2421 da.ch = ch; 2422 da.ti = KIDX_TO_TI(ch, tc->no.kidx); 2423 da.tc = tc; 2424 da.ent = &tbl->ent[0]; 2425 da.size = tbl->size; 2426 2427 tbl->cnt = 0; 2428 ta->foreach(tc->astate, da.ti, dump_table_entry, &da); 2429 tbl->cnt = da.cnt; 2430 2431 return (0); 2432 } 2433 2434 /* 2435 * Dumps table entry in eXtended format (v1)(current). 2436 */ 2437 static int 2438 dump_table_tentry(void *e, void *arg) 2439 { 2440 struct dump_args *da; 2441 struct table_config *tc; 2442 struct table_algo *ta; 2443 struct table_value *pval; 2444 ipfw_obj_tentry *tent; 2445 int error; 2446 2447 da = (struct dump_args *)arg; 2448 2449 tc = da->tc; 2450 ta = tc->ta; 2451 2452 tent = (ipfw_obj_tentry *)ipfw_get_sopt_space(da->sd, sizeof(*tent)); 2453 /* Out of memory, returning */ 2454 if (tent == NULL) { 2455 da->error = ENOMEM; 2456 return (1); 2457 } 2458 tent->head.length = sizeof(ipfw_obj_tentry); 2459 tent->idx = da->uidx; 2460 2461 error = ta->dump_tentry(tc->astate, da->ti, e, tent); 2462 if (error != 0) 2463 return (error); 2464 2465 pval = get_table_value(da->ch, da->tc, tent->v.kidx); 2466 ipfw_export_table_value_v1(pval, &tent->v.value); 2467 2468 return (0); 2469 } 2470 2471 /* 2472 * Dumps table entry in eXtended format (v0). 2473 */ 2474 static int 2475 dump_table_xentry(void *e, void *arg) 2476 { 2477 struct dump_args *da; 2478 struct table_config *tc; 2479 struct table_algo *ta; 2480 ipfw_table_xentry *xent; 2481 ipfw_obj_tentry *tent; 2482 struct table_value *pval; 2483 int error; 2484 2485 da = (struct dump_args *)arg; 2486 2487 tc = da->tc; 2488 ta = tc->ta; 2489 2490 xent = (ipfw_table_xentry *)ipfw_get_sopt_space(da->sd, sizeof(*xent)); 2491 /* Out of memory, returning */ 2492 if (xent == NULL) 2493 return (1); 2494 xent->len = sizeof(ipfw_table_xentry); 2495 xent->tbl = da->uidx; 2496 2497 memset(&da->tent, 0, sizeof(da->tent)); 2498 tent = &da->tent; 2499 error = ta->dump_tentry(tc->astate, da->ti, e, tent); 2500 if (error != 0) 2501 return (error); 2502 2503 /* Convert current format to previous one */ 2504 xent->masklen = tent->masklen; 2505 pval = get_table_value(da->ch, da->tc, da->tent.v.kidx); 2506 xent->value = ipfw_export_table_value_legacy(pval); 2507 /* Apply some hacks */ 2508 if (tc->no.subtype == IPFW_TABLE_ADDR && tent->subtype == AF_INET) { 2509 xent->k.addr6.s6_addr32[3] = tent->k.addr.s_addr; 2510 xent->flags = IPFW_TCF_INET; 2511 } else 2512 memcpy(&xent->k, &tent->k, sizeof(xent->k)); 2513 2514 return (0); 2515 } 2516 2517 /* 2518 * Helper function to export table algo data 2519 * to tentry format before calling user function. 2520 * 2521 * Returns 0 on success. 2522 */ 2523 static int 2524 prepare_table_tentry(void *e, void *arg) 2525 { 2526 struct dump_args *da; 2527 struct table_config *tc; 2528 struct table_algo *ta; 2529 int error; 2530 2531 da = (struct dump_args *)arg; 2532 2533 tc = da->tc; 2534 ta = tc->ta; 2535 2536 error = ta->dump_tentry(tc->astate, da->ti, e, &da->tent); 2537 if (error != 0) 2538 return (error); 2539 2540 da->f(&da->tent, da->farg); 2541 2542 return (0); 2543 } 2544 2545 /* 2546 * Allow external consumers to read table entries in standard format. 2547 */ 2548 int 2549 ipfw_foreach_table_tentry(struct ip_fw_chain *ch, uint16_t kidx, 2550 ta_foreach_f *f, void *arg) 2551 { 2552 struct namedobj_instance *ni; 2553 struct table_config *tc; 2554 struct table_algo *ta; 2555 struct dump_args da; 2556 2557 ni = CHAIN_TO_NI(ch); 2558 2559 tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, kidx); 2560 if (tc == NULL) 2561 return (ESRCH); 2562 2563 ta = tc->ta; 2564 2565 memset(&da, 0, sizeof(da)); 2566 da.ch = ch; 2567 da.ti = KIDX_TO_TI(ch, tc->no.kidx); 2568 da.tc = tc; 2569 da.f = f; 2570 da.farg = arg; 2571 2572 ta->foreach(tc->astate, da.ti, prepare_table_tentry, &da); 2573 2574 return (0); 2575 } 2576 2577 /* 2578 * Table algorithms 2579 */ 2580 2581 /* 2582 * Finds algorithm by index, table type or supplied name. 2583 * 2584 * Returns pointer to algo or NULL. 2585 */ 2586 static struct table_algo * 2587 find_table_algo(struct tables_config *tcfg, struct tid_info *ti, char *name) 2588 { 2589 int i, l; 2590 struct table_algo *ta; 2591 2592 if (ti->type > IPFW_TABLE_MAXTYPE) 2593 return (NULL); 2594 2595 /* Search by index */ 2596 if (ti->atype != 0) { 2597 if (ti->atype > tcfg->algo_count) 2598 return (NULL); 2599 return (tcfg->algo[ti->atype]); 2600 } 2601 2602 if (name == NULL) { 2603 /* Return default algorithm for given type if set */ 2604 return (tcfg->def_algo[ti->type]); 2605 } 2606 2607 /* Search by name */ 2608 /* TODO: better search */ 2609 for (i = 1; i <= tcfg->algo_count; i++) { 2610 ta = tcfg->algo[i]; 2611 2612 /* 2613 * One can supply additional algorithm 2614 * parameters so we compare only the first word 2615 * of supplied name: 2616 * 'addr:chash hsize=32' 2617 * '^^^^^^^^^' 2618 * 2619 */ 2620 l = strlen(ta->name); 2621 if (strncmp(name, ta->name, l) != 0) 2622 continue; 2623 if (name[l] != '\0' && name[l] != ' ') 2624 continue; 2625 /* Check if we're requesting proper table type */ 2626 if (ti->type != 0 && ti->type != ta->type) 2627 return (NULL); 2628 return (ta); 2629 } 2630 2631 return (NULL); 2632 } 2633 2634 /* 2635 * Register new table algo @ta. 2636 * Stores algo id inside @idx. 2637 * 2638 * Returns 0 on success. 2639 */ 2640 int 2641 ipfw_add_table_algo(struct ip_fw_chain *ch, struct table_algo *ta, size_t size, 2642 int *idx) 2643 { 2644 struct tables_config *tcfg; 2645 struct table_algo *ta_new; 2646 size_t sz; 2647 2648 if (size > sizeof(struct table_algo)) 2649 return (EINVAL); 2650 2651 /* Check for the required on-stack size for add/del */ 2652 sz = roundup2(ta->ta_buf_size, sizeof(void *)); 2653 if (sz > TA_BUF_SZ) 2654 return (EINVAL); 2655 2656 KASSERT(ta->type <= IPFW_TABLE_MAXTYPE,("Increase IPFW_TABLE_MAXTYPE")); 2657 2658 /* Copy algorithm data to stable storage. */ 2659 ta_new = malloc(sizeof(struct table_algo), M_IPFW, M_WAITOK | M_ZERO); 2660 memcpy(ta_new, ta, size); 2661 2662 tcfg = CHAIN_TO_TCFG(ch); 2663 2664 KASSERT(tcfg->algo_count < 255, ("Increase algo array size")); 2665 2666 tcfg->algo[++tcfg->algo_count] = ta_new; 2667 ta_new->idx = tcfg->algo_count; 2668 2669 /* Set algorithm as default one for given type */ 2670 if ((ta_new->flags & TA_FLAG_DEFAULT) != 0 && 2671 tcfg->def_algo[ta_new->type] == NULL) 2672 tcfg->def_algo[ta_new->type] = ta_new; 2673 2674 *idx = ta_new->idx; 2675 2676 return (0); 2677 } 2678 2679 /* 2680 * Unregisters table algo using @idx as id. 2681 * XXX: It is NOT safe to call this function in any place 2682 * other than ipfw instance destroy handler. 2683 */ 2684 void 2685 ipfw_del_table_algo(struct ip_fw_chain *ch, int idx) 2686 { 2687 struct tables_config *tcfg; 2688 struct table_algo *ta; 2689 2690 tcfg = CHAIN_TO_TCFG(ch); 2691 2692 KASSERT(idx <= tcfg->algo_count, ("algo idx %d out of range 1..%d", 2693 idx, tcfg->algo_count)); 2694 2695 ta = tcfg->algo[idx]; 2696 KASSERT(ta != NULL, ("algo idx %d is NULL", idx)); 2697 2698 if (tcfg->def_algo[ta->type] == ta) 2699 tcfg->def_algo[ta->type] = NULL; 2700 2701 free(ta, M_IPFW); 2702 } 2703 2704 /* 2705 * Lists all table algorithms currently available. 2706 * Data layout (v0)(current): 2707 * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size 2708 * Reply: [ ipfw_obj_lheader ipfw_ta_info x N ] 2709 * 2710 * Returns 0 on success 2711 */ 2712 static int 2713 list_table_algo(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 2714 struct sockopt_data *sd) 2715 { 2716 struct _ipfw_obj_lheader *olh; 2717 struct tables_config *tcfg; 2718 ipfw_ta_info *i; 2719 struct table_algo *ta; 2720 uint32_t count, n, size; 2721 2722 olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh)); 2723 if (olh == NULL) 2724 return (EINVAL); 2725 if (sd->valsize < olh->size) 2726 return (EINVAL); 2727 2728 IPFW_UH_RLOCK(ch); 2729 tcfg = CHAIN_TO_TCFG(ch); 2730 count = tcfg->algo_count; 2731 size = count * sizeof(ipfw_ta_info) + sizeof(ipfw_obj_lheader); 2732 2733 /* Fill in header regadless of buffer size */ 2734 olh->count = count; 2735 olh->objsize = sizeof(ipfw_ta_info); 2736 2737 if (size > olh->size) { 2738 olh->size = size; 2739 IPFW_UH_RUNLOCK(ch); 2740 return (ENOMEM); 2741 } 2742 olh->size = size; 2743 2744 for (n = 1; n <= count; n++) { 2745 i = (ipfw_ta_info *)ipfw_get_sopt_space(sd, sizeof(*i)); 2746 KASSERT(i != NULL, ("previously checked buffer is not enough")); 2747 ta = tcfg->algo[n]; 2748 strlcpy(i->algoname, ta->name, sizeof(i->algoname)); 2749 i->type = ta->type; 2750 i->refcnt = ta->refcnt; 2751 } 2752 2753 IPFW_UH_RUNLOCK(ch); 2754 2755 return (0); 2756 } 2757 2758 static int 2759 classify_srcdst(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 2760 { 2761 /* Basic IPv4/IPv6 or u32 lookups */ 2762 *puidx = cmd->arg1; 2763 /* Assume ADDR by default */ 2764 *ptype = IPFW_TABLE_ADDR; 2765 int v; 2766 2767 if (F_LEN(cmd) > F_INSN_SIZE(ipfw_insn_u32)) { 2768 /* 2769 * generic lookup. The key must be 2770 * in 32bit big-endian format. 2771 */ 2772 v = ((ipfw_insn_u32 *)cmd)->d[1]; 2773 switch (v) { 2774 case 0: 2775 case 1: 2776 /* IPv4 src/dst */ 2777 break; 2778 case 2: 2779 case 3: 2780 /* src/dst port */ 2781 *ptype = IPFW_TABLE_NUMBER; 2782 break; 2783 case 4: 2784 /* uid/gid */ 2785 *ptype = IPFW_TABLE_NUMBER; 2786 break; 2787 case 5: 2788 /* jid */ 2789 *ptype = IPFW_TABLE_NUMBER; 2790 break; 2791 case 6: 2792 /* dscp */ 2793 *ptype = IPFW_TABLE_NUMBER; 2794 break; 2795 } 2796 } 2797 2798 return (0); 2799 } 2800 2801 static int 2802 classify_via(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 2803 { 2804 ipfw_insn_if *cmdif; 2805 2806 /* Interface table, possibly */ 2807 cmdif = (ipfw_insn_if *)cmd; 2808 if (cmdif->name[0] != '\1') 2809 return (1); 2810 2811 *ptype = IPFW_TABLE_INTERFACE; 2812 *puidx = cmdif->p.kidx; 2813 2814 return (0); 2815 } 2816 2817 static int 2818 classify_flow(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 2819 { 2820 2821 *puidx = cmd->arg1; 2822 *ptype = IPFW_TABLE_FLOW; 2823 2824 return (0); 2825 } 2826 2827 static void 2828 update_arg1(ipfw_insn *cmd, uint16_t idx) 2829 { 2830 2831 cmd->arg1 = idx; 2832 } 2833 2834 static void 2835 update_via(ipfw_insn *cmd, uint16_t idx) 2836 { 2837 ipfw_insn_if *cmdif; 2838 2839 cmdif = (ipfw_insn_if *)cmd; 2840 cmdif->p.kidx = idx; 2841 } 2842 2843 static int 2844 table_findbyname(struct ip_fw_chain *ch, struct tid_info *ti, 2845 struct named_object **pno) 2846 { 2847 struct table_config *tc; 2848 int error; 2849 2850 IPFW_UH_WLOCK_ASSERT(ch); 2851 2852 error = find_table_err(CHAIN_TO_NI(ch), ti, &tc); 2853 if (error != 0) 2854 return (error); 2855 2856 *pno = &tc->no; 2857 return (0); 2858 } 2859 2860 /* XXX: sets-sets! */ 2861 static struct named_object * 2862 table_findbykidx(struct ip_fw_chain *ch, uint16_t idx) 2863 { 2864 struct namedobj_instance *ni; 2865 struct table_config *tc; 2866 2867 IPFW_UH_WLOCK_ASSERT(ch); 2868 ni = CHAIN_TO_NI(ch); 2869 tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, idx); 2870 KASSERT(tc != NULL, ("Table with index %d not found", idx)); 2871 2872 return (&tc->no); 2873 } 2874 2875 static int 2876 table_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set, 2877 enum ipfw_sets_cmd cmd) 2878 { 2879 2880 switch (cmd) { 2881 case SWAP_ALL: 2882 case TEST_ALL: 2883 case MOVE_ALL: 2884 /* 2885 * Always return success, the real action and decision 2886 * should make table_manage_sets_all(). 2887 */ 2888 return (0); 2889 case TEST_ONE: 2890 case MOVE_ONE: 2891 /* 2892 * NOTE: we need to use ipfw_objhash_del/ipfw_objhash_add 2893 * if set number will be used in hash function. Currently 2894 * we can just use generic handler that replaces set value. 2895 */ 2896 if (V_fw_tables_sets == 0) 2897 return (0); 2898 break; 2899 case COUNT_ONE: 2900 /* 2901 * Return EOPNOTSUPP for COUNT_ONE when per-set sysctl is 2902 * disabled. This allow skip table's opcodes from additional 2903 * checks when specific rules moved to another set. 2904 */ 2905 if (V_fw_tables_sets == 0) 2906 return (EOPNOTSUPP); 2907 } 2908 /* Use generic sets handler when per-set sysctl is enabled. */ 2909 return (ipfw_obj_manage_sets(CHAIN_TO_NI(ch), IPFW_TLV_TBL_NAME, 2910 set, new_set, cmd)); 2911 } 2912 2913 /* 2914 * We register several opcode rewriters for lookup tables. 2915 * All tables opcodes have the same ETLV type, but different subtype. 2916 * To avoid invoking sets handler several times for XXX_ALL commands, 2917 * we use separate manage_sets handler. O_RECV has the lowest value, 2918 * so it should be called first. 2919 */ 2920 static int 2921 table_manage_sets_all(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set, 2922 enum ipfw_sets_cmd cmd) 2923 { 2924 2925 switch (cmd) { 2926 case SWAP_ALL: 2927 case TEST_ALL: 2928 /* 2929 * Return success for TEST_ALL, since nothing prevents 2930 * move rules from one set to another. All tables are 2931 * accessible from all sets when per-set tables sysctl 2932 * is disabled. 2933 */ 2934 case MOVE_ALL: 2935 if (V_fw_tables_sets == 0) 2936 return (0); 2937 break; 2938 default: 2939 return (table_manage_sets(ch, set, new_set, cmd)); 2940 } 2941 /* Use generic sets handler when per-set sysctl is enabled. */ 2942 return (ipfw_obj_manage_sets(CHAIN_TO_NI(ch), IPFW_TLV_TBL_NAME, 2943 set, new_set, cmd)); 2944 } 2945 2946 static struct opcode_obj_rewrite opcodes[] = { 2947 { 2948 .opcode = O_IP_SRC_LOOKUP, 2949 .etlv = IPFW_TLV_TBL_NAME, 2950 .classifier = classify_srcdst, 2951 .update = update_arg1, 2952 .find_byname = table_findbyname, 2953 .find_bykidx = table_findbykidx, 2954 .create_object = create_table_compat, 2955 .manage_sets = table_manage_sets, 2956 }, 2957 { 2958 .opcode = O_IP_DST_LOOKUP, 2959 .etlv = IPFW_TLV_TBL_NAME, 2960 .classifier = classify_srcdst, 2961 .update = update_arg1, 2962 .find_byname = table_findbyname, 2963 .find_bykidx = table_findbykidx, 2964 .create_object = create_table_compat, 2965 .manage_sets = table_manage_sets, 2966 }, 2967 { 2968 .opcode = O_IP_FLOW_LOOKUP, 2969 .etlv = IPFW_TLV_TBL_NAME, 2970 .classifier = classify_flow, 2971 .update = update_arg1, 2972 .find_byname = table_findbyname, 2973 .find_bykidx = table_findbykidx, 2974 .create_object = create_table_compat, 2975 .manage_sets = table_manage_sets, 2976 }, 2977 { 2978 .opcode = O_XMIT, 2979 .etlv = IPFW_TLV_TBL_NAME, 2980 .classifier = classify_via, 2981 .update = update_via, 2982 .find_byname = table_findbyname, 2983 .find_bykidx = table_findbykidx, 2984 .create_object = create_table_compat, 2985 .manage_sets = table_manage_sets, 2986 }, 2987 { 2988 .opcode = O_RECV, 2989 .etlv = IPFW_TLV_TBL_NAME, 2990 .classifier = classify_via, 2991 .update = update_via, 2992 .find_byname = table_findbyname, 2993 .find_bykidx = table_findbykidx, 2994 .create_object = create_table_compat, 2995 .manage_sets = table_manage_sets_all, 2996 }, 2997 { 2998 .opcode = O_VIA, 2999 .etlv = IPFW_TLV_TBL_NAME, 3000 .classifier = classify_via, 3001 .update = update_via, 3002 .find_byname = table_findbyname, 3003 .find_bykidx = table_findbykidx, 3004 .create_object = create_table_compat, 3005 .manage_sets = table_manage_sets, 3006 }, 3007 }; 3008 3009 static int 3010 test_sets_cb(struct namedobj_instance *ni __unused, struct named_object *no, 3011 void *arg __unused) 3012 { 3013 3014 /* Check that there aren't any tables in not default set */ 3015 if (no->set != 0) 3016 return (EBUSY); 3017 return (0); 3018 } 3019 3020 /* 3021 * Switch between "set 0" and "rule's set" table binding, 3022 * Check all ruleset bindings and permits changing 3023 * IFF each binding has both rule AND table in default set (set 0). 3024 * 3025 * Returns 0 on success. 3026 */ 3027 int 3028 ipfw_switch_tables_namespace(struct ip_fw_chain *ch, unsigned int sets) 3029 { 3030 struct opcode_obj_rewrite *rw; 3031 struct namedobj_instance *ni; 3032 struct named_object *no; 3033 struct ip_fw *rule; 3034 ipfw_insn *cmd; 3035 int cmdlen, i, l; 3036 uint16_t kidx; 3037 uint8_t subtype; 3038 3039 IPFW_UH_WLOCK(ch); 3040 3041 if (V_fw_tables_sets == sets) { 3042 IPFW_UH_WUNLOCK(ch); 3043 return (0); 3044 } 3045 ni = CHAIN_TO_NI(ch); 3046 if (sets == 0) { 3047 /* 3048 * Prevent disabling sets support if we have some tables 3049 * in not default sets. 3050 */ 3051 if (ipfw_objhash_foreach_type(ni, test_sets_cb, 3052 NULL, IPFW_TLV_TBL_NAME) != 0) { 3053 IPFW_UH_WUNLOCK(ch); 3054 return (EBUSY); 3055 } 3056 } 3057 /* 3058 * Scan all rules and examine tables opcodes. 3059 */ 3060 for (i = 0; i < ch->n_rules; i++) { 3061 rule = ch->map[i]; 3062 3063 l = rule->cmd_len; 3064 cmd = rule->cmd; 3065 cmdlen = 0; 3066 for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 3067 cmdlen = F_LEN(cmd); 3068 /* Check only tables opcodes */ 3069 for (kidx = 0, rw = opcodes; 3070 rw < opcodes + nitems(opcodes); rw++) { 3071 if (rw->opcode != cmd->opcode) 3072 continue; 3073 if (rw->classifier(cmd, &kidx, &subtype) == 0) 3074 break; 3075 } 3076 if (kidx == 0) 3077 continue; 3078 no = ipfw_objhash_lookup_kidx(ni, kidx); 3079 /* Check if both table object and rule has the set 0 */ 3080 if (no->set != 0 || rule->set != 0) { 3081 IPFW_UH_WUNLOCK(ch); 3082 return (EBUSY); 3083 } 3084 3085 } 3086 } 3087 V_fw_tables_sets = sets; 3088 IPFW_UH_WUNLOCK(ch); 3089 return (0); 3090 } 3091 3092 /* 3093 * Checks table name for validity. 3094 * Enforce basic length checks, the rest 3095 * should be done in userland. 3096 * 3097 * Returns 0 if name is considered valid. 3098 */ 3099 static int 3100 check_table_name(const char *name) 3101 { 3102 3103 /* 3104 * TODO: do some more complicated checks 3105 */ 3106 return (ipfw_check_object_name_generic(name)); 3107 } 3108 3109 /* 3110 * Finds table config based on either legacy index 3111 * or name in ntlv. 3112 * Note @ti structure contains unchecked data from userland. 3113 * 3114 * Returns 0 in success and fills in @tc with found config 3115 */ 3116 static int 3117 find_table_err(struct namedobj_instance *ni, struct tid_info *ti, 3118 struct table_config **tc) 3119 { 3120 char *name, bname[16]; 3121 struct named_object *no; 3122 ipfw_obj_ntlv *ntlv; 3123 uint32_t set; 3124 3125 if (ti->tlvs != NULL) { 3126 ntlv = ipfw_find_name_tlv_type(ti->tlvs, ti->tlen, ti->uidx, 3127 IPFW_TLV_TBL_NAME); 3128 if (ntlv == NULL) 3129 return (EINVAL); 3130 name = ntlv->name; 3131 3132 /* 3133 * Use set provided by @ti instead of @ntlv one. 3134 * This is needed due to different sets behavior 3135 * controlled by V_fw_tables_sets. 3136 */ 3137 set = (V_fw_tables_sets != 0) ? ti->set : 0; 3138 } else { 3139 snprintf(bname, sizeof(bname), "%d", ti->uidx); 3140 name = bname; 3141 set = 0; 3142 } 3143 3144 no = ipfw_objhash_lookup_name(ni, set, name); 3145 *tc = (struct table_config *)no; 3146 3147 return (0); 3148 } 3149 3150 /* 3151 * Finds table config based on either legacy index 3152 * or name in ntlv. 3153 * Note @ti structure contains unchecked data from userland. 3154 * 3155 * Returns pointer to table_config or NULL. 3156 */ 3157 static struct table_config * 3158 find_table(struct namedobj_instance *ni, struct tid_info *ti) 3159 { 3160 struct table_config *tc; 3161 3162 if (find_table_err(ni, ti, &tc) != 0) 3163 return (NULL); 3164 3165 return (tc); 3166 } 3167 3168 /* 3169 * Allocate new table config structure using 3170 * specified @algo and @aname. 3171 * 3172 * Returns pointer to config or NULL. 3173 */ 3174 static struct table_config * 3175 alloc_table_config(struct ip_fw_chain *ch, struct tid_info *ti, 3176 struct table_algo *ta, char *aname, uint8_t tflags) 3177 { 3178 char *name, bname[16]; 3179 struct table_config *tc; 3180 int error; 3181 ipfw_obj_ntlv *ntlv; 3182 uint32_t set; 3183 3184 if (ti->tlvs != NULL) { 3185 ntlv = ipfw_find_name_tlv_type(ti->tlvs, ti->tlen, ti->uidx, 3186 IPFW_TLV_TBL_NAME); 3187 if (ntlv == NULL) 3188 return (NULL); 3189 name = ntlv->name; 3190 set = ntlv->set; 3191 } else { 3192 /* Compat part: convert number to string representation */ 3193 snprintf(bname, sizeof(bname), "%d", ti->uidx); 3194 name = bname; 3195 set = 0; 3196 } 3197 3198 tc = malloc(sizeof(struct table_config), M_IPFW, M_WAITOK | M_ZERO); 3199 tc->no.name = tc->tablename; 3200 tc->no.subtype = ta->type; 3201 tc->no.set = set; 3202 tc->tflags = tflags; 3203 tc->ta = ta; 3204 strlcpy(tc->tablename, name, sizeof(tc->tablename)); 3205 /* Set "shared" value type by default */ 3206 tc->vshared = 1; 3207 3208 /* Preallocate data structures for new tables */ 3209 error = ta->init(ch, &tc->astate, &tc->ti_copy, aname, tflags); 3210 if (error != 0) { 3211 free(tc, M_IPFW); 3212 return (NULL); 3213 } 3214 3215 return (tc); 3216 } 3217 3218 /* 3219 * Destroys table state and config. 3220 */ 3221 static void 3222 free_table_config(struct namedobj_instance *ni, struct table_config *tc) 3223 { 3224 3225 KASSERT(tc->linked == 0, ("free() on linked config")); 3226 /* UH lock MUST NOT be held */ 3227 3228 /* 3229 * We're using ta without any locking/referencing. 3230 * TODO: fix this if we're going to use unloadable algos. 3231 */ 3232 tc->ta->destroy(tc->astate, &tc->ti_copy); 3233 free(tc, M_IPFW); 3234 } 3235 3236 /* 3237 * Links @tc to @chain table named instance. 3238 * Sets appropriate type/states in @chain table info. 3239 */ 3240 static void 3241 link_table(struct ip_fw_chain *ch, struct table_config *tc) 3242 { 3243 struct namedobj_instance *ni; 3244 struct table_info *ti; 3245 uint16_t kidx; 3246 3247 IPFW_UH_WLOCK_ASSERT(ch); 3248 IPFW_WLOCK_ASSERT(ch); 3249 3250 ni = CHAIN_TO_NI(ch); 3251 kidx = tc->no.kidx; 3252 3253 ipfw_objhash_add(ni, &tc->no); 3254 3255 ti = KIDX_TO_TI(ch, kidx); 3256 *ti = tc->ti_copy; 3257 3258 /* Notify algo on real @ti address */ 3259 if (tc->ta->change_ti != NULL) 3260 tc->ta->change_ti(tc->astate, ti); 3261 3262 tc->linked = 1; 3263 tc->ta->refcnt++; 3264 } 3265 3266 /* 3267 * Unlinks @tc from @chain table named instance. 3268 * Zeroes states in @chain and stores them in @tc. 3269 */ 3270 static void 3271 unlink_table(struct ip_fw_chain *ch, struct table_config *tc) 3272 { 3273 struct namedobj_instance *ni; 3274 struct table_info *ti; 3275 uint16_t kidx; 3276 3277 IPFW_UH_WLOCK_ASSERT(ch); 3278 IPFW_WLOCK_ASSERT(ch); 3279 3280 ni = CHAIN_TO_NI(ch); 3281 kidx = tc->no.kidx; 3282 3283 /* Clear state. @ti copy is already saved inside @tc */ 3284 ipfw_objhash_del(ni, &tc->no); 3285 ti = KIDX_TO_TI(ch, kidx); 3286 memset(ti, 0, sizeof(struct table_info)); 3287 tc->linked = 0; 3288 tc->ta->refcnt--; 3289 3290 /* Notify algo on real @ti address */ 3291 if (tc->ta->change_ti != NULL) 3292 tc->ta->change_ti(tc->astate, NULL); 3293 } 3294 3295 static struct ipfw_sopt_handler scodes[] = { 3296 { IP_FW_TABLE_XCREATE, 0, HDIR_SET, create_table }, 3297 { IP_FW_TABLE_XDESTROY, 0, HDIR_SET, flush_table_v0 }, 3298 { IP_FW_TABLE_XFLUSH, 0, HDIR_SET, flush_table_v0 }, 3299 { IP_FW_TABLE_XMODIFY, 0, HDIR_BOTH, modify_table }, 3300 { IP_FW_TABLE_XINFO, 0, HDIR_GET, describe_table }, 3301 { IP_FW_TABLES_XLIST, 0, HDIR_GET, list_tables }, 3302 { IP_FW_TABLE_XLIST, 0, HDIR_GET, dump_table_v0 }, 3303 { IP_FW_TABLE_XLIST, 1, HDIR_GET, dump_table_v1 }, 3304 { IP_FW_TABLE_XADD, 0, HDIR_BOTH, manage_table_ent_v0 }, 3305 { IP_FW_TABLE_XADD, 1, HDIR_BOTH, manage_table_ent_v1 }, 3306 { IP_FW_TABLE_XDEL, 0, HDIR_BOTH, manage_table_ent_v0 }, 3307 { IP_FW_TABLE_XDEL, 1, HDIR_BOTH, manage_table_ent_v1 }, 3308 { IP_FW_TABLE_XFIND, 0, HDIR_GET, find_table_entry }, 3309 { IP_FW_TABLE_XSWAP, 0, HDIR_SET, swap_table }, 3310 { IP_FW_TABLES_ALIST, 0, HDIR_GET, list_table_algo }, 3311 { IP_FW_TABLE_XGETSIZE, 0, HDIR_GET, get_table_size }, 3312 }; 3313 3314 static int 3315 destroy_table_locked(struct namedobj_instance *ni, struct named_object *no, 3316 void *arg) 3317 { 3318 3319 unlink_table((struct ip_fw_chain *)arg, (struct table_config *)no); 3320 if (ipfw_objhash_free_idx(ni, no->kidx) != 0) 3321 printf("Error unlinking kidx %d from table %s\n", 3322 no->kidx, no->name); 3323 free_table_config(ni, (struct table_config *)no); 3324 return (0); 3325 } 3326 3327 /* 3328 * Shuts tables module down. 3329 */ 3330 void 3331 ipfw_destroy_tables(struct ip_fw_chain *ch, int last) 3332 { 3333 3334 IPFW_DEL_SOPT_HANDLER(last, scodes); 3335 IPFW_DEL_OBJ_REWRITER(last, opcodes); 3336 3337 /* Remove all tables from working set */ 3338 IPFW_UH_WLOCK(ch); 3339 IPFW_WLOCK(ch); 3340 ipfw_objhash_foreach(CHAIN_TO_NI(ch), destroy_table_locked, ch); 3341 IPFW_WUNLOCK(ch); 3342 IPFW_UH_WUNLOCK(ch); 3343 3344 /* Free pointers itself */ 3345 free(ch->tablestate, M_IPFW); 3346 3347 ipfw_table_value_destroy(ch, last); 3348 ipfw_table_algo_destroy(ch); 3349 3350 ipfw_objhash_destroy(CHAIN_TO_NI(ch)); 3351 free(CHAIN_TO_TCFG(ch), M_IPFW); 3352 } 3353 3354 /* 3355 * Starts tables module. 3356 */ 3357 int 3358 ipfw_init_tables(struct ip_fw_chain *ch, int first) 3359 { 3360 struct tables_config *tcfg; 3361 3362 /* Allocate pointers */ 3363 ch->tablestate = malloc(V_fw_tables_max * sizeof(struct table_info), 3364 M_IPFW, M_WAITOK | M_ZERO); 3365 3366 tcfg = malloc(sizeof(struct tables_config), M_IPFW, M_WAITOK | M_ZERO); 3367 tcfg->namehash = ipfw_objhash_create(V_fw_tables_max); 3368 ch->tblcfg = tcfg; 3369 3370 ipfw_table_value_init(ch, first); 3371 ipfw_table_algo_init(ch); 3372 3373 IPFW_ADD_OBJ_REWRITER(first, opcodes); 3374 IPFW_ADD_SOPT_HANDLER(first, scodes); 3375 return (0); 3376 } 3377 3378 3379 3380