1 /*- 2 * Copyright (c) 2004 Ruslan Ermilov and Vsevolod Lobko. 3 * Copyright (c) 2014 Yandex LLC 4 * Copyright (c) 2014 Alexander V. Chernikov 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25 * SUCH DAMAGE. 26 */ 27 28 #include <sys/cdefs.h> 29 __FBSDID("$FreeBSD$"); 30 31 /* 32 * Lookup table support for ipfw. 33 * 34 * This file contains handlers for all generic tables' operations: 35 * add/del/flush entries, list/dump tables etc.. 36 * 37 * Table data modification is protected by both UH and runtime lock 38 * while reading configuration/data is protected by UH lock. 39 * 40 * Lookup algorithms for all table types are located in ip_fw_table_algo.c 41 */ 42 43 #include "opt_ipfw.h" 44 45 #include <sys/param.h> 46 #include <sys/systm.h> 47 #include <sys/malloc.h> 48 #include <sys/kernel.h> 49 #include <sys/lock.h> 50 #include <sys/rwlock.h> 51 #include <sys/rmlock.h> 52 #include <sys/socket.h> 53 #include <sys/socketvar.h> 54 #include <sys/queue.h> 55 #include <net/if.h> /* ip_fw.h requires IFNAMSIZ */ 56 57 #include <netinet/in.h> 58 #include <netinet/ip_var.h> /* struct ipfw_rule_ref */ 59 #include <netinet/ip_fw.h> 60 61 #include <netpfil/ipfw/ip_fw_private.h> 62 #include <netpfil/ipfw/ip_fw_table.h> 63 64 /* 65 * Table has the following `type` concepts: 66 * 67 * `no.type` represents lookup key type (addr, ifp, uid, etc..) 68 * vmask represents bitmask of table values which are present at the moment. 69 * Special IPFW_VTYPE_LEGACY ( (uint32_t)-1 ) represents old 70 * single-value-for-all approach. 71 */ 72 struct table_config { 73 struct named_object no; 74 uint8_t tflags; /* type flags */ 75 uint8_t locked; /* 1 if locked from changes */ 76 uint8_t linked; /* 1 if already linked */ 77 uint8_t ochanged; /* used by set swapping */ 78 uint8_t vshared; /* 1 if using shared value array */ 79 uint8_t spare[3]; 80 uint32_t count; /* Number of records */ 81 uint32_t limit; /* Max number of records */ 82 uint32_t vmask; /* bitmask with supported values */ 83 uint32_t ocount; /* used by set swapping */ 84 uint64_t gencnt; /* generation count */ 85 char tablename[64]; /* table name */ 86 struct table_algo *ta; /* Callbacks for given algo */ 87 void *astate; /* algorithm state */ 88 struct table_info ti_copy; /* data to put to table_info */ 89 struct namedobj_instance *vi; 90 }; 91 92 static int find_table_err(struct namedobj_instance *ni, struct tid_info *ti, 93 struct table_config **tc); 94 static struct table_config *find_table(struct namedobj_instance *ni, 95 struct tid_info *ti); 96 static struct table_config *alloc_table_config(struct ip_fw_chain *ch, 97 struct tid_info *ti, struct table_algo *ta, char *adata, uint8_t tflags); 98 static void free_table_config(struct namedobj_instance *ni, 99 struct table_config *tc); 100 static int create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti, 101 char *aname, ipfw_xtable_info *i, uint16_t *pkidx, int ref); 102 static void link_table(struct ip_fw_chain *ch, struct table_config *tc); 103 static void unlink_table(struct ip_fw_chain *ch, struct table_config *tc); 104 static int find_ref_table(struct ip_fw_chain *ch, struct tid_info *ti, 105 struct tentry_info *tei, uint32_t count, int op, struct table_config **ptc); 106 #define OP_ADD 1 107 #define OP_DEL 0 108 static int export_tables(struct ip_fw_chain *ch, ipfw_obj_lheader *olh, 109 struct sockopt_data *sd); 110 static void export_table_info(struct ip_fw_chain *ch, struct table_config *tc, 111 ipfw_xtable_info *i); 112 static int dump_table_tentry(void *e, void *arg); 113 static int dump_table_xentry(void *e, void *arg); 114 115 static int swap_tables(struct ip_fw_chain *ch, struct tid_info *a, 116 struct tid_info *b); 117 118 static int check_table_name(const char *name); 119 static int check_table_space(struct ip_fw_chain *ch, struct tableop_state *ts, 120 struct table_config *tc, struct table_info *ti, uint32_t count); 121 static int destroy_table(struct ip_fw_chain *ch, struct tid_info *ti); 122 123 static struct table_algo *find_table_algo(struct tables_config *tableconf, 124 struct tid_info *ti, char *name); 125 126 static void objheader_to_ti(struct _ipfw_obj_header *oh, struct tid_info *ti); 127 static void ntlv_to_ti(struct _ipfw_obj_ntlv *ntlv, struct tid_info *ti); 128 129 #define CHAIN_TO_NI(chain) (CHAIN_TO_TCFG(chain)->namehash) 130 #define KIDX_TO_TI(ch, k) (&(((struct table_info *)(ch)->tablestate)[k])) 131 132 #define TA_BUF_SZ 128 /* On-stack buffer for add/delete state */ 133 134 void 135 rollback_toperation_state(struct ip_fw_chain *ch, void *object) 136 { 137 struct tables_config *tcfg; 138 struct op_state *os; 139 140 tcfg = CHAIN_TO_TCFG(ch); 141 TAILQ_FOREACH(os, &tcfg->state_list, next) 142 os->func(object, os); 143 } 144 145 void 146 add_toperation_state(struct ip_fw_chain *ch, struct tableop_state *ts) 147 { 148 struct tables_config *tcfg; 149 150 tcfg = CHAIN_TO_TCFG(ch); 151 TAILQ_INSERT_HEAD(&tcfg->state_list, &ts->opstate, next); 152 } 153 154 void 155 del_toperation_state(struct ip_fw_chain *ch, struct tableop_state *ts) 156 { 157 struct tables_config *tcfg; 158 159 tcfg = CHAIN_TO_TCFG(ch); 160 TAILQ_REMOVE(&tcfg->state_list, &ts->opstate, next); 161 } 162 163 void 164 tc_ref(struct table_config *tc) 165 { 166 167 tc->no.refcnt++; 168 } 169 170 void 171 tc_unref(struct table_config *tc) 172 { 173 174 tc->no.refcnt--; 175 } 176 177 static struct table_value * 178 get_table_value(struct ip_fw_chain *ch, struct table_config *tc, uint32_t kidx) 179 { 180 struct table_value *pval; 181 182 pval = (struct table_value *)ch->valuestate; 183 184 return (&pval[kidx]); 185 } 186 187 188 /* 189 * Checks if we're able to insert/update entry @tei into table 190 * w.r.t @tc limits. 191 * May alter @tei to indicate insertion error / insert 192 * options. 193 * 194 * Returns 0 if operation can be performed/ 195 */ 196 static int 197 check_table_limit(struct table_config *tc, struct tentry_info *tei) 198 { 199 200 if (tc->limit == 0 || tc->count < tc->limit) 201 return (0); 202 203 if ((tei->flags & TEI_FLAGS_UPDATE) == 0) { 204 /* Notify userland on error cause */ 205 tei->flags |= TEI_FLAGS_LIMIT; 206 return (EFBIG); 207 } 208 209 /* 210 * We have UPDATE flag set. 211 * Permit updating record (if found), 212 * but restrict adding new one since we've 213 * already hit the limit. 214 */ 215 tei->flags |= TEI_FLAGS_DONTADD; 216 217 return (0); 218 } 219 220 /* 221 * Convert algorithm callback return code into 222 * one of pre-defined states known by userland. 223 */ 224 static void 225 store_tei_result(struct tentry_info *tei, int op, int error, uint32_t num) 226 { 227 int flag; 228 229 flag = 0; 230 231 switch (error) { 232 case 0: 233 if (op == OP_ADD && num != 0) 234 flag = TEI_FLAGS_ADDED; 235 if (op == OP_DEL) 236 flag = TEI_FLAGS_DELETED; 237 break; 238 case ENOENT: 239 flag = TEI_FLAGS_NOTFOUND; 240 break; 241 case EEXIST: 242 flag = TEI_FLAGS_EXISTS; 243 break; 244 default: 245 flag = TEI_FLAGS_ERROR; 246 } 247 248 tei->flags |= flag; 249 } 250 251 /* 252 * Creates and references table with default parameters. 253 * Saves table config, algo and allocated kidx info @ptc, @pta and 254 * @pkidx if non-zero. 255 * Used for table auto-creation to support old binaries. 256 * 257 * Returns 0 on success. 258 */ 259 static int 260 create_table_compat(struct ip_fw_chain *ch, struct tid_info *ti, 261 uint16_t *pkidx) 262 { 263 ipfw_xtable_info xi; 264 int error; 265 266 memset(&xi, 0, sizeof(xi)); 267 /* Set default value mask for legacy clients */ 268 xi.vmask = IPFW_VTYPE_LEGACY; 269 270 error = create_table_internal(ch, ti, NULL, &xi, pkidx, 1); 271 if (error != 0) 272 return (error); 273 274 return (0); 275 } 276 277 /* 278 * Find and reference existing table optionally 279 * creating new one. 280 * 281 * Saves found table config into @ptc. 282 * Note function may drop/acquire UH_WLOCK. 283 * Returns 0 if table was found/created and referenced 284 * or non-zero return code. 285 */ 286 static int 287 find_ref_table(struct ip_fw_chain *ch, struct tid_info *ti, 288 struct tentry_info *tei, uint32_t count, int op, 289 struct table_config **ptc) 290 { 291 struct namedobj_instance *ni; 292 struct table_config *tc; 293 uint16_t kidx; 294 int error; 295 296 IPFW_UH_WLOCK_ASSERT(ch); 297 298 ni = CHAIN_TO_NI(ch); 299 tc = NULL; 300 if ((tc = find_table(ni, ti)) != NULL) { 301 /* check table type */ 302 if (tc->no.subtype != ti->type) 303 return (EINVAL); 304 305 if (tc->locked != 0) 306 return (EACCES); 307 308 /* Try to exit early on limit hit */ 309 if (op == OP_ADD && count == 1 && 310 check_table_limit(tc, tei) != 0) 311 return (EFBIG); 312 313 /* Reference and return */ 314 tc->no.refcnt++; 315 *ptc = tc; 316 return (0); 317 } 318 319 if (op == OP_DEL) 320 return (ESRCH); 321 322 /* Compability mode: create new table for old clients */ 323 if ((tei->flags & TEI_FLAGS_COMPAT) == 0) 324 return (ESRCH); 325 326 IPFW_UH_WUNLOCK(ch); 327 error = create_table_compat(ch, ti, &kidx); 328 IPFW_UH_WLOCK(ch); 329 330 if (error != 0) 331 return (error); 332 333 tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, kidx); 334 KASSERT(tc != NULL, ("create_table_compat returned bad idx %d", kidx)); 335 336 /* OK, now we've got referenced table. */ 337 *ptc = tc; 338 return (0); 339 } 340 341 /* 342 * Rolls back already @added to @tc entries using state array @ta_buf_m. 343 * Assume the following layout: 344 * 1) ADD state (ta_buf_m[0] ... t_buf_m[added - 1]) for handling update cases 345 * 2) DEL state (ta_buf_m[count[ ... t_buf_m[count + added - 1]) 346 * for storing deleted state 347 */ 348 static void 349 rollback_added_entries(struct ip_fw_chain *ch, struct table_config *tc, 350 struct table_info *tinfo, struct tentry_info *tei, caddr_t ta_buf_m, 351 uint32_t count, uint32_t added) 352 { 353 struct table_algo *ta; 354 struct tentry_info *ptei; 355 caddr_t v, vv; 356 size_t ta_buf_sz; 357 int error, i; 358 uint32_t num; 359 360 IPFW_UH_WLOCK_ASSERT(ch); 361 362 ta = tc->ta; 363 ta_buf_sz = ta->ta_buf_size; 364 v = ta_buf_m; 365 vv = v + count * ta_buf_sz; 366 for (i = 0; i < added; i++, v += ta_buf_sz, vv += ta_buf_sz) { 367 ptei = &tei[i]; 368 if ((ptei->flags & TEI_FLAGS_UPDATED) != 0) { 369 370 /* 371 * We have old value stored by previous 372 * call in @ptei->value. Do add once again 373 * to restore it. 374 */ 375 error = ta->add(tc->astate, tinfo, ptei, v, &num); 376 KASSERT(error == 0, ("rollback UPDATE fail")); 377 KASSERT(num == 0, ("rollback UPDATE fail2")); 378 continue; 379 } 380 381 error = ta->prepare_del(ch, ptei, vv); 382 KASSERT(error == 0, ("pre-rollback INSERT failed")); 383 error = ta->del(tc->astate, tinfo, ptei, vv, &num); 384 KASSERT(error == 0, ("rollback INSERT failed")); 385 tc->count -= num; 386 } 387 } 388 389 /* 390 * Prepares add/del state for all @count entries in @tei. 391 * Uses either stack buffer (@ta_buf) or allocates a new one. 392 * Stores pointer to allocated buffer back to @ta_buf. 393 * 394 * Returns 0 on success. 395 */ 396 static int 397 prepare_batch_buffer(struct ip_fw_chain *ch, struct table_algo *ta, 398 struct tentry_info *tei, uint32_t count, int op, caddr_t *ta_buf) 399 { 400 caddr_t ta_buf_m, v; 401 size_t ta_buf_sz, sz; 402 struct tentry_info *ptei; 403 int error, i; 404 405 error = 0; 406 ta_buf_sz = ta->ta_buf_size; 407 if (count == 1) { 408 /* Sigle add/delete, use on-stack buffer */ 409 memset(*ta_buf, 0, TA_BUF_SZ); 410 ta_buf_m = *ta_buf; 411 } else { 412 413 /* 414 * Multiple adds/deletes, allocate larger buffer 415 * 416 * Note we need 2xcount buffer for add case: 417 * we have hold both ADD state 418 * and DELETE state (this may be needed 419 * if we need to rollback all changes) 420 */ 421 sz = count * ta_buf_sz; 422 ta_buf_m = malloc((op == OP_ADD) ? sz * 2 : sz, M_TEMP, 423 M_WAITOK | M_ZERO); 424 } 425 426 v = ta_buf_m; 427 for (i = 0; i < count; i++, v += ta_buf_sz) { 428 ptei = &tei[i]; 429 error = (op == OP_ADD) ? 430 ta->prepare_add(ch, ptei, v) : ta->prepare_del(ch, ptei, v); 431 432 /* 433 * Some syntax error (incorrect mask, or address, or 434 * anything). Return error regardless of atomicity 435 * settings. 436 */ 437 if (error != 0) 438 break; 439 } 440 441 *ta_buf = ta_buf_m; 442 return (error); 443 } 444 445 /* 446 * Flushes allocated state for each @count entries in @tei. 447 * Frees @ta_buf_m if differs from stack buffer @ta_buf. 448 */ 449 static void 450 flush_batch_buffer(struct ip_fw_chain *ch, struct table_algo *ta, 451 struct tentry_info *tei, uint32_t count, int rollback, 452 caddr_t ta_buf_m, caddr_t ta_buf) 453 { 454 caddr_t v; 455 struct tentry_info *ptei; 456 size_t ta_buf_sz; 457 int i; 458 459 ta_buf_sz = ta->ta_buf_size; 460 461 /* Run cleaning callback anyway */ 462 v = ta_buf_m; 463 for (i = 0; i < count; i++, v += ta_buf_sz) { 464 ptei = &tei[i]; 465 ta->flush_entry(ch, ptei, v); 466 if (ptei->ptv != NULL) { 467 free(ptei->ptv, M_IPFW); 468 ptei->ptv = NULL; 469 } 470 } 471 472 /* Clean up "deleted" state in case of rollback */ 473 if (rollback != 0) { 474 v = ta_buf_m + count * ta_buf_sz; 475 for (i = 0; i < count; i++, v += ta_buf_sz) 476 ta->flush_entry(ch, &tei[i], v); 477 } 478 479 if (ta_buf_m != ta_buf) 480 free(ta_buf_m, M_TEMP); 481 } 482 483 484 static void 485 rollback_add_entry(void *object, struct op_state *_state) 486 { 487 struct ip_fw_chain *ch; 488 struct tableop_state *ts; 489 490 ts = (struct tableop_state *)_state; 491 492 if (ts->tc != object && ts->ch != object) 493 return; 494 495 ch = ts->ch; 496 497 IPFW_UH_WLOCK_ASSERT(ch); 498 499 /* Call specifid unlockers */ 500 rollback_table_values(ts); 501 502 /* Indicate we've called */ 503 ts->modified = 1; 504 } 505 506 /* 507 * Adds/updates one or more entries in table @ti. 508 * 509 * Function may drop/reacquire UH wlock multiple times due to 510 * items alloc, algorithm callbacks (check_space), value linkage 511 * (new values, value storage realloc), etc.. 512 * Other processes like other adds (which may involve storage resize), 513 * table swaps (which changes table data and may change algo type), 514 * table modify (which may change value mask) may be executed 515 * simultaneously so we need to deal with it. 516 * 517 * The following approach was implemented: 518 * we have per-chain linked list, protected with UH lock. 519 * add_table_entry prepares special on-stack structure wthich is passed 520 * to its descendants. Users add this structure to this list before unlock. 521 * After performing needed operations and acquiring UH lock back, each user 522 * checks if structure has changed. If true, it rolls local state back and 523 * returns without error to the caller. 524 * add_table_entry() on its own checks if structure has changed and restarts 525 * its operation from the beginning (goto restart). 526 * 527 * Functions which are modifying fields of interest (currently 528 * resize_shared_value_storage() and swap_tables() ) 529 * traverses given list while holding UH lock immediately before 530 * performing their operations calling function provided be list entry 531 * ( currently rollback_add_entry ) which performs rollback for all necessary 532 * state and sets appropriate values in structure indicating rollback 533 * has happened. 534 * 535 * Algo interaction: 536 * Function references @ti first to ensure table won't 537 * disappear or change its type. 538 * After that, prepare_add callback is called for each @tei entry. 539 * Next, we try to add each entry under UH+WHLOCK 540 * using add() callback. 541 * Finally, we free all state by calling flush_entry callback 542 * for each @tei. 543 * 544 * Returns 0 on success. 545 */ 546 int 547 add_table_entry(struct ip_fw_chain *ch, struct tid_info *ti, 548 struct tentry_info *tei, uint8_t flags, uint32_t count) 549 { 550 struct table_config *tc; 551 struct table_algo *ta; 552 uint16_t kidx; 553 int error, first_error, i, rollback; 554 uint32_t num, numadd; 555 struct tentry_info *ptei; 556 struct tableop_state ts; 557 char ta_buf[TA_BUF_SZ]; 558 caddr_t ta_buf_m, v; 559 560 memset(&ts, 0, sizeof(ts)); 561 ta = NULL; 562 IPFW_UH_WLOCK(ch); 563 564 /* 565 * Find and reference existing table. 566 */ 567 restart: 568 if (ts.modified != 0) { 569 IPFW_UH_WUNLOCK(ch); 570 flush_batch_buffer(ch, ta, tei, count, rollback, 571 ta_buf_m, ta_buf); 572 memset(&ts, 0, sizeof(ts)); 573 ta = NULL; 574 IPFW_UH_WLOCK(ch); 575 } 576 577 error = find_ref_table(ch, ti, tei, count, OP_ADD, &tc); 578 if (error != 0) { 579 IPFW_UH_WUNLOCK(ch); 580 return (error); 581 } 582 ta = tc->ta; 583 584 /* Fill in tablestate */ 585 ts.ch = ch; 586 ts.opstate.func = rollback_add_entry; 587 ts.tc = tc; 588 ts.vshared = tc->vshared; 589 ts.vmask = tc->vmask; 590 ts.ta = ta; 591 ts.tei = tei; 592 ts.count = count; 593 rollback = 0; 594 add_toperation_state(ch, &ts); 595 IPFW_UH_WUNLOCK(ch); 596 597 /* Allocate memory and prepare record(s) */ 598 /* Pass stack buffer by default */ 599 ta_buf_m = ta_buf; 600 error = prepare_batch_buffer(ch, ta, tei, count, OP_ADD, &ta_buf_m); 601 602 IPFW_UH_WLOCK(ch); 603 del_toperation_state(ch, &ts); 604 /* Drop reference we've used in first search */ 605 tc->no.refcnt--; 606 607 /* Check prepare_batch_buffer() error */ 608 if (error != 0) 609 goto cleanup; 610 611 /* 612 * Check if table swap has happened. 613 * (so table algo might be changed). 614 * Restart operation to achieve consistent behavior. 615 */ 616 if (ts.modified != 0) 617 goto restart; 618 619 /* 620 * Link all values values to shared/per-table value array. 621 * 622 * May release/reacquire UH_WLOCK. 623 */ 624 error = ipfw_link_table_values(ch, &ts); 625 if (error != 0) 626 goto cleanup; 627 if (ts.modified != 0) 628 goto restart; 629 630 /* 631 * Ensure we are able to add all entries without additional 632 * memory allocations. May release/reacquire UH_WLOCK. 633 */ 634 kidx = tc->no.kidx; 635 error = check_table_space(ch, &ts, tc, KIDX_TO_TI(ch, kidx), count); 636 if (error != 0) 637 goto cleanup; 638 if (ts.modified != 0) 639 goto restart; 640 641 /* We've got valid table in @tc. Let's try to add data */ 642 kidx = tc->no.kidx; 643 ta = tc->ta; 644 numadd = 0; 645 first_error = 0; 646 647 IPFW_WLOCK(ch); 648 649 v = ta_buf_m; 650 for (i = 0; i < count; i++, v += ta->ta_buf_size) { 651 ptei = &tei[i]; 652 num = 0; 653 /* check limit before adding */ 654 if ((error = check_table_limit(tc, ptei)) == 0) { 655 error = ta->add(tc->astate, KIDX_TO_TI(ch, kidx), 656 ptei, v, &num); 657 /* Set status flag to inform userland */ 658 store_tei_result(ptei, OP_ADD, error, num); 659 } 660 if (error == 0) { 661 /* Update number of records to ease limit checking */ 662 tc->count += num; 663 numadd += num; 664 continue; 665 } 666 667 if (first_error == 0) 668 first_error = error; 669 670 /* 671 * Some error have happened. Check our atomicity 672 * settings: continue if atomicity is not required, 673 * rollback changes otherwise. 674 */ 675 if ((flags & IPFW_CTF_ATOMIC) == 0) 676 continue; 677 678 rollback_added_entries(ch, tc, KIDX_TO_TI(ch, kidx), 679 tei, ta_buf_m, count, i); 680 681 rollback = 1; 682 break; 683 } 684 685 IPFW_WUNLOCK(ch); 686 687 ipfw_garbage_table_values(ch, tc, tei, count, rollback); 688 689 /* Permit post-add algorithm grow/rehash. */ 690 if (numadd != 0) 691 check_table_space(ch, NULL, tc, KIDX_TO_TI(ch, kidx), 0); 692 693 /* Return first error to user, if any */ 694 error = first_error; 695 696 cleanup: 697 IPFW_UH_WUNLOCK(ch); 698 699 flush_batch_buffer(ch, ta, tei, count, rollback, ta_buf_m, ta_buf); 700 701 return (error); 702 } 703 704 /* 705 * Deletes one or more entries in table @ti. 706 * 707 * Returns 0 on success. 708 */ 709 int 710 del_table_entry(struct ip_fw_chain *ch, struct tid_info *ti, 711 struct tentry_info *tei, uint8_t flags, uint32_t count) 712 { 713 struct table_config *tc; 714 struct table_algo *ta; 715 struct tentry_info *ptei; 716 uint16_t kidx; 717 int error, first_error, i; 718 uint32_t num, numdel; 719 char ta_buf[TA_BUF_SZ]; 720 caddr_t ta_buf_m, v; 721 722 /* 723 * Find and reference existing table. 724 */ 725 IPFW_UH_WLOCK(ch); 726 error = find_ref_table(ch, ti, tei, count, OP_DEL, &tc); 727 if (error != 0) { 728 IPFW_UH_WUNLOCK(ch); 729 return (error); 730 } 731 ta = tc->ta; 732 IPFW_UH_WUNLOCK(ch); 733 734 /* Allocate memory and prepare record(s) */ 735 /* Pass stack buffer by default */ 736 ta_buf_m = ta_buf; 737 error = prepare_batch_buffer(ch, ta, tei, count, OP_DEL, &ta_buf_m); 738 if (error != 0) 739 goto cleanup; 740 741 IPFW_UH_WLOCK(ch); 742 743 /* Drop reference we've used in first search */ 744 tc->no.refcnt--; 745 746 /* 747 * Check if table algo is still the same. 748 * (changed ta may be the result of table swap). 749 */ 750 if (ta != tc->ta) { 751 IPFW_UH_WUNLOCK(ch); 752 error = EINVAL; 753 goto cleanup; 754 } 755 756 kidx = tc->no.kidx; 757 numdel = 0; 758 first_error = 0; 759 760 IPFW_WLOCK(ch); 761 v = ta_buf_m; 762 for (i = 0; i < count; i++, v += ta->ta_buf_size) { 763 ptei = &tei[i]; 764 num = 0; 765 error = ta->del(tc->astate, KIDX_TO_TI(ch, kidx), ptei, v, 766 &num); 767 /* Save state for userland */ 768 store_tei_result(ptei, OP_DEL, error, num); 769 if (error != 0 && first_error == 0) 770 first_error = error; 771 tc->count -= num; 772 numdel += num; 773 } 774 IPFW_WUNLOCK(ch); 775 776 /* Unlink non-used values */ 777 ipfw_garbage_table_values(ch, tc, tei, count, 0); 778 779 if (numdel != 0) { 780 /* Run post-del hook to permit shrinking */ 781 check_table_space(ch, NULL, tc, KIDX_TO_TI(ch, kidx), 0); 782 } 783 784 IPFW_UH_WUNLOCK(ch); 785 786 /* Return first error to user, if any */ 787 error = first_error; 788 789 cleanup: 790 flush_batch_buffer(ch, ta, tei, count, 0, ta_buf_m, ta_buf); 791 792 return (error); 793 } 794 795 /* 796 * Ensure that table @tc has enough space to add @count entries without 797 * need for reallocation. 798 * 799 * Callbacks order: 800 * 0) need_modify() (UH_WLOCK) - checks if @count items can be added w/o resize. 801 * 802 * 1) alloc_modify (no locks, M_WAITOK) - alloc new state based on @pflags. 803 * 2) prepare_modifyt (UH_WLOCK) - copy old data into new storage 804 * 3) modify (UH_WLOCK + WLOCK) - switch pointers 805 * 4) flush_modify (UH_WLOCK) - free state, if needed 806 * 807 * Returns 0 on success. 808 */ 809 static int 810 check_table_space(struct ip_fw_chain *ch, struct tableop_state *ts, 811 struct table_config *tc, struct table_info *ti, uint32_t count) 812 { 813 struct table_algo *ta; 814 uint64_t pflags; 815 char ta_buf[TA_BUF_SZ]; 816 int error; 817 818 IPFW_UH_WLOCK_ASSERT(ch); 819 820 error = 0; 821 ta = tc->ta; 822 if (ta->need_modify == NULL) 823 return (0); 824 825 /* Acquire reference not to loose @tc between locks/unlocks */ 826 tc->no.refcnt++; 827 828 /* 829 * TODO: think about avoiding race between large add/large delete 830 * operation on algorithm which implements shrinking along with 831 * growing. 832 */ 833 while (true) { 834 pflags = 0; 835 if (ta->need_modify(tc->astate, ti, count, &pflags) == 0) { 836 error = 0; 837 break; 838 } 839 840 /* We have to shrink/grow table */ 841 if (ts != NULL) 842 add_toperation_state(ch, ts); 843 IPFW_UH_WUNLOCK(ch); 844 845 memset(&ta_buf, 0, sizeof(ta_buf)); 846 error = ta->prepare_mod(ta_buf, &pflags); 847 848 IPFW_UH_WLOCK(ch); 849 if (ts != NULL) 850 del_toperation_state(ch, ts); 851 852 if (error != 0) 853 break; 854 855 if (ts != NULL && ts->modified != 0) { 856 857 /* 858 * Swap operation has happened 859 * so we're currently operating on other 860 * table data. Stop doing this. 861 */ 862 ta->flush_mod(ta_buf); 863 break; 864 } 865 866 /* Check if we still need to alter table */ 867 ti = KIDX_TO_TI(ch, tc->no.kidx); 868 if (ta->need_modify(tc->astate, ti, count, &pflags) == 0) { 869 IPFW_UH_WUNLOCK(ch); 870 871 /* 872 * Other thread has already performed resize. 873 * Flush our state and return. 874 */ 875 ta->flush_mod(ta_buf); 876 break; 877 } 878 879 error = ta->fill_mod(tc->astate, ti, ta_buf, &pflags); 880 if (error == 0) { 881 /* Do actual modification */ 882 IPFW_WLOCK(ch); 883 ta->modify(tc->astate, ti, ta_buf, pflags); 884 IPFW_WUNLOCK(ch); 885 } 886 887 /* Anyway, flush data and retry */ 888 ta->flush_mod(ta_buf); 889 } 890 891 tc->no.refcnt--; 892 return (error); 893 } 894 895 /* 896 * Adds or deletes record in table. 897 * Data layout (v0): 898 * Request: [ ip_fw3_opheader ipfw_table_xentry ] 899 * 900 * Returns 0 on success 901 */ 902 static int 903 manage_table_ent_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 904 struct sockopt_data *sd) 905 { 906 ipfw_table_xentry *xent; 907 struct tentry_info tei; 908 struct tid_info ti; 909 struct table_value v; 910 int error, hdrlen, read; 911 912 hdrlen = offsetof(ipfw_table_xentry, k); 913 914 /* Check minimum header size */ 915 if (sd->valsize < (sizeof(*op3) + hdrlen)) 916 return (EINVAL); 917 918 read = sizeof(ip_fw3_opheader); 919 920 /* Check if xentry len field is valid */ 921 xent = (ipfw_table_xentry *)(op3 + 1); 922 if (xent->len < hdrlen || xent->len + read > sd->valsize) 923 return (EINVAL); 924 925 memset(&tei, 0, sizeof(tei)); 926 tei.paddr = &xent->k; 927 tei.masklen = xent->masklen; 928 ipfw_import_table_value_legacy(xent->value, &v); 929 tei.pvalue = &v; 930 /* Old requests compability */ 931 tei.flags = TEI_FLAGS_COMPAT; 932 if (xent->type == IPFW_TABLE_ADDR) { 933 if (xent->len - hdrlen == sizeof(in_addr_t)) 934 tei.subtype = AF_INET; 935 else 936 tei.subtype = AF_INET6; 937 } 938 939 memset(&ti, 0, sizeof(ti)); 940 ti.uidx = xent->tbl; 941 ti.type = xent->type; 942 943 error = (op3->opcode == IP_FW_TABLE_XADD) ? 944 add_table_entry(ch, &ti, &tei, 0, 1) : 945 del_table_entry(ch, &ti, &tei, 0, 1); 946 947 return (error); 948 } 949 950 /* 951 * Adds or deletes record in table. 952 * Data layout (v1)(current): 953 * Request: [ ipfw_obj_header 954 * ipfw_obj_ctlv(IPFW_TLV_TBLENT_LIST) [ ipfw_obj_tentry x N ] 955 * ] 956 * 957 * Returns 0 on success 958 */ 959 static int 960 manage_table_ent_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 961 struct sockopt_data *sd) 962 { 963 ipfw_obj_tentry *tent, *ptent; 964 ipfw_obj_ctlv *ctlv; 965 ipfw_obj_header *oh; 966 struct tentry_info *ptei, tei, *tei_buf; 967 struct tid_info ti; 968 int error, i, kidx, read; 969 970 /* Check minimum header size */ 971 if (sd->valsize < (sizeof(*oh) + sizeof(*ctlv))) 972 return (EINVAL); 973 974 /* Check if passed data is too long */ 975 if (sd->valsize != sd->kavail) 976 return (EINVAL); 977 978 oh = (ipfw_obj_header *)sd->kbuf; 979 980 /* Basic length checks for TLVs */ 981 if (oh->ntlv.head.length != sizeof(oh->ntlv)) 982 return (EINVAL); 983 984 read = sizeof(*oh); 985 986 ctlv = (ipfw_obj_ctlv *)(oh + 1); 987 if (ctlv->head.length + read != sd->valsize) 988 return (EINVAL); 989 990 read += sizeof(*ctlv); 991 tent = (ipfw_obj_tentry *)(ctlv + 1); 992 if (ctlv->count * sizeof(*tent) + read != sd->valsize) 993 return (EINVAL); 994 995 if (ctlv->count == 0) 996 return (0); 997 998 /* 999 * Mark entire buffer as "read". 1000 * This instructs sopt api write it back 1001 * after function return. 1002 */ 1003 ipfw_get_sopt_header(sd, sd->valsize); 1004 1005 /* Perform basic checks for each entry */ 1006 ptent = tent; 1007 kidx = tent->idx; 1008 for (i = 0; i < ctlv->count; i++, ptent++) { 1009 if (ptent->head.length != sizeof(*ptent)) 1010 return (EINVAL); 1011 if (ptent->idx != kidx) 1012 return (ENOTSUP); 1013 } 1014 1015 /* Convert data into kernel request objects */ 1016 objheader_to_ti(oh, &ti); 1017 ti.type = oh->ntlv.type; 1018 ti.uidx = kidx; 1019 1020 /* Use on-stack buffer for single add/del */ 1021 if (ctlv->count == 1) { 1022 memset(&tei, 0, sizeof(tei)); 1023 tei_buf = &tei; 1024 } else 1025 tei_buf = malloc(ctlv->count * sizeof(tei), M_TEMP, 1026 M_WAITOK | M_ZERO); 1027 1028 ptei = tei_buf; 1029 ptent = tent; 1030 for (i = 0; i < ctlv->count; i++, ptent++, ptei++) { 1031 ptei->paddr = &ptent->k; 1032 ptei->subtype = ptent->subtype; 1033 ptei->masklen = ptent->masklen; 1034 if (ptent->head.flags & IPFW_TF_UPDATE) 1035 ptei->flags |= TEI_FLAGS_UPDATE; 1036 1037 ipfw_import_table_value_v1(&ptent->v.value); 1038 ptei->pvalue = (struct table_value *)&ptent->v.value; 1039 } 1040 1041 error = (oh->opheader.opcode == IP_FW_TABLE_XADD) ? 1042 add_table_entry(ch, &ti, tei_buf, ctlv->flags, ctlv->count) : 1043 del_table_entry(ch, &ti, tei_buf, ctlv->flags, ctlv->count); 1044 1045 /* Translate result back to userland */ 1046 ptei = tei_buf; 1047 ptent = tent; 1048 for (i = 0; i < ctlv->count; i++, ptent++, ptei++) { 1049 if (ptei->flags & TEI_FLAGS_ADDED) 1050 ptent->result = IPFW_TR_ADDED; 1051 else if (ptei->flags & TEI_FLAGS_DELETED) 1052 ptent->result = IPFW_TR_DELETED; 1053 else if (ptei->flags & TEI_FLAGS_UPDATED) 1054 ptent->result = IPFW_TR_UPDATED; 1055 else if (ptei->flags & TEI_FLAGS_LIMIT) 1056 ptent->result = IPFW_TR_LIMIT; 1057 else if (ptei->flags & TEI_FLAGS_ERROR) 1058 ptent->result = IPFW_TR_ERROR; 1059 else if (ptei->flags & TEI_FLAGS_NOTFOUND) 1060 ptent->result = IPFW_TR_NOTFOUND; 1061 else if (ptei->flags & TEI_FLAGS_EXISTS) 1062 ptent->result = IPFW_TR_EXISTS; 1063 ipfw_export_table_value_v1(ptei->pvalue, &ptent->v.value); 1064 } 1065 1066 if (tei_buf != &tei) 1067 free(tei_buf, M_TEMP); 1068 1069 return (error); 1070 } 1071 1072 /* 1073 * Looks up an entry in given table. 1074 * Data layout (v0)(current): 1075 * Request: [ ipfw_obj_header ipfw_obj_tentry ] 1076 * Reply: [ ipfw_obj_header ipfw_obj_tentry ] 1077 * 1078 * Returns 0 on success 1079 */ 1080 static int 1081 find_table_entry(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1082 struct sockopt_data *sd) 1083 { 1084 ipfw_obj_tentry *tent; 1085 ipfw_obj_header *oh; 1086 struct tid_info ti; 1087 struct table_config *tc; 1088 struct table_algo *ta; 1089 struct table_info *kti; 1090 struct namedobj_instance *ni; 1091 int error; 1092 size_t sz; 1093 1094 /* Check minimum header size */ 1095 sz = sizeof(*oh) + sizeof(*tent); 1096 if (sd->valsize != sz) 1097 return (EINVAL); 1098 1099 oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 1100 tent = (ipfw_obj_tentry *)(oh + 1); 1101 1102 /* Basic length checks for TLVs */ 1103 if (oh->ntlv.head.length != sizeof(oh->ntlv)) 1104 return (EINVAL); 1105 1106 objheader_to_ti(oh, &ti); 1107 ti.type = oh->ntlv.type; 1108 ti.uidx = tent->idx; 1109 1110 IPFW_UH_RLOCK(ch); 1111 ni = CHAIN_TO_NI(ch); 1112 1113 /* 1114 * Find existing table and check its type . 1115 */ 1116 ta = NULL; 1117 if ((tc = find_table(ni, &ti)) == NULL) { 1118 IPFW_UH_RUNLOCK(ch); 1119 return (ESRCH); 1120 } 1121 1122 /* check table type */ 1123 if (tc->no.subtype != ti.type) { 1124 IPFW_UH_RUNLOCK(ch); 1125 return (EINVAL); 1126 } 1127 1128 kti = KIDX_TO_TI(ch, tc->no.kidx); 1129 ta = tc->ta; 1130 1131 if (ta->find_tentry == NULL) 1132 return (ENOTSUP); 1133 1134 error = ta->find_tentry(tc->astate, kti, tent); 1135 1136 IPFW_UH_RUNLOCK(ch); 1137 1138 return (error); 1139 } 1140 1141 /* 1142 * Flushes all entries or destroys given table. 1143 * Data layout (v0)(current): 1144 * Request: [ ipfw_obj_header ] 1145 * 1146 * Returns 0 on success 1147 */ 1148 static int 1149 flush_table_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1150 struct sockopt_data *sd) 1151 { 1152 int error; 1153 struct _ipfw_obj_header *oh; 1154 struct tid_info ti; 1155 1156 if (sd->valsize != sizeof(*oh)) 1157 return (EINVAL); 1158 1159 oh = (struct _ipfw_obj_header *)op3; 1160 objheader_to_ti(oh, &ti); 1161 1162 if (op3->opcode == IP_FW_TABLE_XDESTROY) 1163 error = destroy_table(ch, &ti); 1164 else if (op3->opcode == IP_FW_TABLE_XFLUSH) 1165 error = flush_table(ch, &ti); 1166 else 1167 return (ENOTSUP); 1168 1169 return (error); 1170 } 1171 1172 static void 1173 restart_flush(void *object, struct op_state *_state) 1174 { 1175 struct tableop_state *ts; 1176 1177 ts = (struct tableop_state *)_state; 1178 1179 if (ts->tc != object) 1180 return; 1181 1182 /* Indicate we've called */ 1183 ts->modified = 1; 1184 } 1185 1186 /* 1187 * Flushes given table. 1188 * 1189 * Function create new table instance with the same 1190 * parameters, swaps it with old one and 1191 * flushes state without holding runtime WLOCK. 1192 * 1193 * Returns 0 on success. 1194 */ 1195 int 1196 flush_table(struct ip_fw_chain *ch, struct tid_info *ti) 1197 { 1198 struct namedobj_instance *ni; 1199 struct table_config *tc; 1200 struct table_algo *ta; 1201 struct table_info ti_old, ti_new, *tablestate; 1202 void *astate_old, *astate_new; 1203 char algostate[64], *pstate; 1204 struct tableop_state ts; 1205 int error, need_gc; 1206 uint16_t kidx; 1207 uint8_t tflags; 1208 1209 /* 1210 * Stage 1: save table algoritm. 1211 * Reference found table to ensure it won't disappear. 1212 */ 1213 IPFW_UH_WLOCK(ch); 1214 ni = CHAIN_TO_NI(ch); 1215 if ((tc = find_table(ni, ti)) == NULL) { 1216 IPFW_UH_WUNLOCK(ch); 1217 return (ESRCH); 1218 } 1219 need_gc = 0; 1220 astate_new = NULL; 1221 memset(&ti_new, 0, sizeof(ti_new)); 1222 restart: 1223 /* Set up swap handler */ 1224 memset(&ts, 0, sizeof(ts)); 1225 ts.opstate.func = restart_flush; 1226 ts.tc = tc; 1227 1228 ta = tc->ta; 1229 /* Do not flush readonly tables */ 1230 if ((ta->flags & TA_FLAG_READONLY) != 0) { 1231 IPFW_UH_WUNLOCK(ch); 1232 return (EACCES); 1233 } 1234 /* Save startup algo parameters */ 1235 if (ta->print_config != NULL) { 1236 ta->print_config(tc->astate, KIDX_TO_TI(ch, tc->no.kidx), 1237 algostate, sizeof(algostate)); 1238 pstate = algostate; 1239 } else 1240 pstate = NULL; 1241 tflags = tc->tflags; 1242 tc->no.refcnt++; 1243 add_toperation_state(ch, &ts); 1244 IPFW_UH_WUNLOCK(ch); 1245 1246 /* 1247 * Stage 1.5: if this is not the first attempt, destroy previous state 1248 */ 1249 if (need_gc != 0) { 1250 ta->destroy(astate_new, &ti_new); 1251 need_gc = 0; 1252 } 1253 1254 /* 1255 * Stage 2: allocate new table instance using same algo. 1256 */ 1257 memset(&ti_new, 0, sizeof(struct table_info)); 1258 error = ta->init(ch, &astate_new, &ti_new, pstate, tflags); 1259 1260 /* 1261 * Stage 3: swap old state pointers with newly-allocated ones. 1262 * Decrease refcount. 1263 */ 1264 IPFW_UH_WLOCK(ch); 1265 tc->no.refcnt--; 1266 del_toperation_state(ch, &ts); 1267 1268 if (error != 0) { 1269 IPFW_UH_WUNLOCK(ch); 1270 return (error); 1271 } 1272 1273 /* 1274 * Restart operation if table swap has happened: 1275 * even if algo may be the same, algo init parameters 1276 * may change. Restart operation instead of doing 1277 * complex checks. 1278 */ 1279 if (ts.modified != 0) { 1280 /* Delay destroying data since we're holding UH lock */ 1281 need_gc = 1; 1282 goto restart; 1283 } 1284 1285 ni = CHAIN_TO_NI(ch); 1286 kidx = tc->no.kidx; 1287 tablestate = (struct table_info *)ch->tablestate; 1288 1289 IPFW_WLOCK(ch); 1290 ti_old = tablestate[kidx]; 1291 tablestate[kidx] = ti_new; 1292 IPFW_WUNLOCK(ch); 1293 1294 astate_old = tc->astate; 1295 tc->astate = astate_new; 1296 tc->ti_copy = ti_new; 1297 tc->count = 0; 1298 1299 /* Notify algo on real @ti address */ 1300 if (ta->change_ti != NULL) 1301 ta->change_ti(tc->astate, &tablestate[kidx]); 1302 1303 /* 1304 * Stage 4: unref values. 1305 */ 1306 ipfw_unref_table_values(ch, tc, ta, astate_old, &ti_old); 1307 IPFW_UH_WUNLOCK(ch); 1308 1309 /* 1310 * Stage 5: perform real flush/destroy. 1311 */ 1312 ta->destroy(astate_old, &ti_old); 1313 1314 return (0); 1315 } 1316 1317 /* 1318 * Swaps two tables. 1319 * Data layout (v0)(current): 1320 * Request: [ ipfw_obj_header ipfw_obj_ntlv ] 1321 * 1322 * Returns 0 on success 1323 */ 1324 static int 1325 swap_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1326 struct sockopt_data *sd) 1327 { 1328 int error; 1329 struct _ipfw_obj_header *oh; 1330 struct tid_info ti_a, ti_b; 1331 1332 if (sd->valsize != sizeof(*oh) + sizeof(ipfw_obj_ntlv)) 1333 return (EINVAL); 1334 1335 oh = (struct _ipfw_obj_header *)op3; 1336 ntlv_to_ti(&oh->ntlv, &ti_a); 1337 ntlv_to_ti((ipfw_obj_ntlv *)(oh + 1), &ti_b); 1338 1339 error = swap_tables(ch, &ti_a, &ti_b); 1340 1341 return (error); 1342 } 1343 1344 /* 1345 * Swaps two tables of the same type/valtype. 1346 * 1347 * Checks if tables are compatible and limits 1348 * permits swap, than actually perform swap. 1349 * 1350 * Each table consists of 2 different parts: 1351 * config: 1352 * @tc (with name, set, kidx) and rule bindings, which is "stable". 1353 * number of items 1354 * table algo 1355 * runtime: 1356 * runtime data @ti (ch->tablestate) 1357 * runtime cache in @tc 1358 * algo-specific data (@tc->astate) 1359 * 1360 * So we switch: 1361 * all runtime data 1362 * number of items 1363 * table algo 1364 * 1365 * After that we call @ti change handler for each table. 1366 * 1367 * Note that referencing @tc won't protect tc->ta from change. 1368 * XXX: Do we need to restrict swap between locked tables? 1369 * XXX: Do we need to exchange ftype? 1370 * 1371 * Returns 0 on success. 1372 */ 1373 static int 1374 swap_tables(struct ip_fw_chain *ch, struct tid_info *a, 1375 struct tid_info *b) 1376 { 1377 struct namedobj_instance *ni; 1378 struct table_config *tc_a, *tc_b; 1379 struct table_algo *ta; 1380 struct table_info ti, *tablestate; 1381 void *astate; 1382 uint32_t count; 1383 1384 /* 1385 * Stage 1: find both tables and ensure they are of 1386 * the same type. 1387 */ 1388 IPFW_UH_WLOCK(ch); 1389 ni = CHAIN_TO_NI(ch); 1390 if ((tc_a = find_table(ni, a)) == NULL) { 1391 IPFW_UH_WUNLOCK(ch); 1392 return (ESRCH); 1393 } 1394 if ((tc_b = find_table(ni, b)) == NULL) { 1395 IPFW_UH_WUNLOCK(ch); 1396 return (ESRCH); 1397 } 1398 1399 /* It is very easy to swap between the same table */ 1400 if (tc_a == tc_b) { 1401 IPFW_UH_WUNLOCK(ch); 1402 return (0); 1403 } 1404 1405 /* Check type and value are the same */ 1406 if (tc_a->no.subtype!=tc_b->no.subtype || tc_a->tflags!=tc_b->tflags) { 1407 IPFW_UH_WUNLOCK(ch); 1408 return (EINVAL); 1409 } 1410 1411 /* Check limits before swap */ 1412 if ((tc_a->limit != 0 && tc_b->count > tc_a->limit) || 1413 (tc_b->limit != 0 && tc_a->count > tc_b->limit)) { 1414 IPFW_UH_WUNLOCK(ch); 1415 return (EFBIG); 1416 } 1417 1418 /* Check if one of the tables is readonly */ 1419 if (((tc_a->ta->flags | tc_b->ta->flags) & TA_FLAG_READONLY) != 0) { 1420 IPFW_UH_WUNLOCK(ch); 1421 return (EACCES); 1422 } 1423 1424 /* Notify we're going to swap */ 1425 rollback_toperation_state(ch, tc_a); 1426 rollback_toperation_state(ch, tc_b); 1427 1428 /* Everything is fine, prepare to swap */ 1429 tablestate = (struct table_info *)ch->tablestate; 1430 ti = tablestate[tc_a->no.kidx]; 1431 ta = tc_a->ta; 1432 astate = tc_a->astate; 1433 count = tc_a->count; 1434 1435 IPFW_WLOCK(ch); 1436 /* a <- b */ 1437 tablestate[tc_a->no.kidx] = tablestate[tc_b->no.kidx]; 1438 tc_a->ta = tc_b->ta; 1439 tc_a->astate = tc_b->astate; 1440 tc_a->count = tc_b->count; 1441 /* b <- a */ 1442 tablestate[tc_b->no.kidx] = ti; 1443 tc_b->ta = ta; 1444 tc_b->astate = astate; 1445 tc_b->count = count; 1446 IPFW_WUNLOCK(ch); 1447 1448 /* Ensure tc.ti copies are in sync */ 1449 tc_a->ti_copy = tablestate[tc_a->no.kidx]; 1450 tc_b->ti_copy = tablestate[tc_b->no.kidx]; 1451 1452 /* Notify both tables on @ti change */ 1453 if (tc_a->ta->change_ti != NULL) 1454 tc_a->ta->change_ti(tc_a->astate, &tablestate[tc_a->no.kidx]); 1455 if (tc_b->ta->change_ti != NULL) 1456 tc_b->ta->change_ti(tc_b->astate, &tablestate[tc_b->no.kidx]); 1457 1458 IPFW_UH_WUNLOCK(ch); 1459 1460 return (0); 1461 } 1462 1463 /* 1464 * Destroys table specified by @ti. 1465 * Data layout (v0)(current): 1466 * Request: [ ip_fw3_opheader ] 1467 * 1468 * Returns 0 on success 1469 */ 1470 static int 1471 destroy_table(struct ip_fw_chain *ch, struct tid_info *ti) 1472 { 1473 struct namedobj_instance *ni; 1474 struct table_config *tc; 1475 1476 IPFW_UH_WLOCK(ch); 1477 1478 ni = CHAIN_TO_NI(ch); 1479 if ((tc = find_table(ni, ti)) == NULL) { 1480 IPFW_UH_WUNLOCK(ch); 1481 return (ESRCH); 1482 } 1483 1484 /* Do not permit destroying referenced tables */ 1485 if (tc->no.refcnt > 0) { 1486 IPFW_UH_WUNLOCK(ch); 1487 return (EBUSY); 1488 } 1489 1490 IPFW_WLOCK(ch); 1491 unlink_table(ch, tc); 1492 IPFW_WUNLOCK(ch); 1493 1494 /* Free obj index */ 1495 if (ipfw_objhash_free_idx(ni, tc->no.kidx) != 0) 1496 printf("Error unlinking kidx %d from table %s\n", 1497 tc->no.kidx, tc->tablename); 1498 1499 /* Unref values used in tables while holding UH lock */ 1500 ipfw_unref_table_values(ch, tc, tc->ta, tc->astate, &tc->ti_copy); 1501 IPFW_UH_WUNLOCK(ch); 1502 1503 free_table_config(ni, tc); 1504 1505 return (0); 1506 } 1507 1508 static uint32_t 1509 roundup2p(uint32_t v) 1510 { 1511 1512 v--; 1513 v |= v >> 1; 1514 v |= v >> 2; 1515 v |= v >> 4; 1516 v |= v >> 8; 1517 v |= v >> 16; 1518 v++; 1519 1520 return (v); 1521 } 1522 1523 /* 1524 * Grow tables index. 1525 * 1526 * Returns 0 on success. 1527 */ 1528 int 1529 ipfw_resize_tables(struct ip_fw_chain *ch, unsigned int ntables) 1530 { 1531 unsigned int ntables_old, tbl; 1532 struct namedobj_instance *ni; 1533 void *new_idx, *old_tablestate, *tablestate; 1534 struct table_info *ti; 1535 struct table_config *tc; 1536 int i, new_blocks; 1537 1538 /* Check new value for validity */ 1539 if (ntables == 0) 1540 return (EINVAL); 1541 if (ntables > IPFW_TABLES_MAX) 1542 ntables = IPFW_TABLES_MAX; 1543 /* Alight to nearest power of 2 */ 1544 ntables = (unsigned int)roundup2p(ntables); 1545 1546 /* Allocate new pointers */ 1547 tablestate = malloc(ntables * sizeof(struct table_info), 1548 M_IPFW, M_WAITOK | M_ZERO); 1549 1550 ipfw_objhash_bitmap_alloc(ntables, (void *)&new_idx, &new_blocks); 1551 1552 IPFW_UH_WLOCK(ch); 1553 1554 tbl = (ntables >= V_fw_tables_max) ? V_fw_tables_max : ntables; 1555 ni = CHAIN_TO_NI(ch); 1556 1557 /* Temporary restrict decreasing max_tables */ 1558 if (ntables < V_fw_tables_max) { 1559 1560 /* 1561 * FIXME: Check if we really can shrink 1562 */ 1563 IPFW_UH_WUNLOCK(ch); 1564 return (EINVAL); 1565 } 1566 1567 /* Copy table info/indices */ 1568 memcpy(tablestate, ch->tablestate, sizeof(struct table_info) * tbl); 1569 ipfw_objhash_bitmap_merge(ni, &new_idx, &new_blocks); 1570 1571 IPFW_WLOCK(ch); 1572 1573 /* Change pointers */ 1574 old_tablestate = ch->tablestate; 1575 ch->tablestate = tablestate; 1576 ipfw_objhash_bitmap_swap(ni, &new_idx, &new_blocks); 1577 1578 ntables_old = V_fw_tables_max; 1579 V_fw_tables_max = ntables; 1580 1581 IPFW_WUNLOCK(ch); 1582 1583 /* Notify all consumers that their @ti pointer has changed */ 1584 ti = (struct table_info *)ch->tablestate; 1585 for (i = 0; i < tbl; i++, ti++) { 1586 if (ti->lookup == NULL) 1587 continue; 1588 tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, i); 1589 if (tc == NULL || tc->ta->change_ti == NULL) 1590 continue; 1591 1592 tc->ta->change_ti(tc->astate, ti); 1593 } 1594 1595 IPFW_UH_WUNLOCK(ch); 1596 1597 /* Free old pointers */ 1598 free(old_tablestate, M_IPFW); 1599 ipfw_objhash_bitmap_free(new_idx, new_blocks); 1600 1601 return (0); 1602 } 1603 1604 /* 1605 * Switch between "set 0" and "rule's set" table binding, 1606 * Check all ruleset bindings and permits changing 1607 * IFF each binding has both rule AND table in default set (set 0). 1608 * 1609 * Returns 0 on success. 1610 */ 1611 int 1612 ipfw_switch_tables_namespace(struct ip_fw_chain *ch, unsigned int sets) 1613 { 1614 struct namedobj_instance *ni; 1615 struct named_object *no; 1616 struct ip_fw *rule; 1617 ipfw_insn *cmd; 1618 int cmdlen, i, l; 1619 uint16_t kidx; 1620 1621 IPFW_UH_WLOCK(ch); 1622 1623 if (V_fw_tables_sets == sets) { 1624 IPFW_UH_WUNLOCK(ch); 1625 return (0); 1626 } 1627 1628 ni = CHAIN_TO_NI(ch); 1629 1630 /* 1631 * Scan all rules and examine tables opcodes. 1632 */ 1633 for (i = 0; i < ch->n_rules; i++) { 1634 rule = ch->map[i]; 1635 1636 l = rule->cmd_len; 1637 cmd = rule->cmd; 1638 cmdlen = 0; 1639 for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 1640 cmdlen = F_LEN(cmd); 1641 1642 if (classify_opcode_kidx(cmd, &kidx) != 0) 1643 continue; 1644 1645 no = ipfw_objhash_lookup_kidx(ni, kidx); 1646 1647 /* Check if both table object and rule has the set 0 */ 1648 if (no->set != 0 || rule->set != 0) { 1649 IPFW_UH_WUNLOCK(ch); 1650 return (EBUSY); 1651 } 1652 1653 } 1654 } 1655 V_fw_tables_sets = sets; 1656 1657 IPFW_UH_WUNLOCK(ch); 1658 1659 return (0); 1660 } 1661 1662 /* 1663 * Lookup an IP @addr in table @tbl. 1664 * Stores found value in @val. 1665 * 1666 * Returns 1 if @addr was found. 1667 */ 1668 int 1669 ipfw_lookup_table(struct ip_fw_chain *ch, uint16_t tbl, in_addr_t addr, 1670 uint32_t *val) 1671 { 1672 struct table_info *ti; 1673 1674 ti = KIDX_TO_TI(ch, tbl); 1675 1676 return (ti->lookup(ti, &addr, sizeof(in_addr_t), val)); 1677 } 1678 1679 /* 1680 * Lookup an arbtrary key @paddr of legth @plen in table @tbl. 1681 * Stores found value in @val. 1682 * 1683 * Returns 1 if key was found. 1684 */ 1685 int 1686 ipfw_lookup_table_extended(struct ip_fw_chain *ch, uint16_t tbl, uint16_t plen, 1687 void *paddr, uint32_t *val) 1688 { 1689 struct table_info *ti; 1690 1691 ti = KIDX_TO_TI(ch, tbl); 1692 1693 return (ti->lookup(ti, paddr, plen, val)); 1694 } 1695 1696 /* 1697 * Info/List/dump support for tables. 1698 * 1699 */ 1700 1701 /* 1702 * High-level 'get' cmds sysctl handlers 1703 */ 1704 1705 /* 1706 * Lists all tables currently available in kernel. 1707 * Data layout (v0)(current): 1708 * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size 1709 * Reply: [ ipfw_obj_lheader ipfw_xtable_info x N ] 1710 * 1711 * Returns 0 on success 1712 */ 1713 static int 1714 list_tables(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1715 struct sockopt_data *sd) 1716 { 1717 struct _ipfw_obj_lheader *olh; 1718 int error; 1719 1720 olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh)); 1721 if (olh == NULL) 1722 return (EINVAL); 1723 if (sd->valsize < olh->size) 1724 return (EINVAL); 1725 1726 IPFW_UH_RLOCK(ch); 1727 error = export_tables(ch, olh, sd); 1728 IPFW_UH_RUNLOCK(ch); 1729 1730 return (error); 1731 } 1732 1733 /* 1734 * Store table info to buffer provided by @sd. 1735 * Data layout (v0)(current): 1736 * Request: [ ipfw_obj_header ipfw_xtable_info(empty)] 1737 * Reply: [ ipfw_obj_header ipfw_xtable_info ] 1738 * 1739 * Returns 0 on success. 1740 */ 1741 static int 1742 describe_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1743 struct sockopt_data *sd) 1744 { 1745 struct _ipfw_obj_header *oh; 1746 struct table_config *tc; 1747 struct tid_info ti; 1748 size_t sz; 1749 1750 sz = sizeof(*oh) + sizeof(ipfw_xtable_info); 1751 oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 1752 if (oh == NULL) 1753 return (EINVAL); 1754 1755 objheader_to_ti(oh, &ti); 1756 1757 IPFW_UH_RLOCK(ch); 1758 if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) { 1759 IPFW_UH_RUNLOCK(ch); 1760 return (ESRCH); 1761 } 1762 1763 export_table_info(ch, tc, (ipfw_xtable_info *)(oh + 1)); 1764 IPFW_UH_RUNLOCK(ch); 1765 1766 return (0); 1767 } 1768 1769 /* 1770 * Modifies existing table. 1771 * Data layout (v0)(current): 1772 * Request: [ ipfw_obj_header ipfw_xtable_info ] 1773 * 1774 * Returns 0 on success 1775 */ 1776 static int 1777 modify_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1778 struct sockopt_data *sd) 1779 { 1780 struct _ipfw_obj_header *oh; 1781 ipfw_xtable_info *i; 1782 char *tname; 1783 struct tid_info ti; 1784 struct namedobj_instance *ni; 1785 struct table_config *tc; 1786 1787 if (sd->valsize != sizeof(*oh) + sizeof(ipfw_xtable_info)) 1788 return (EINVAL); 1789 1790 oh = (struct _ipfw_obj_header *)sd->kbuf; 1791 i = (ipfw_xtable_info *)(oh + 1); 1792 1793 /* 1794 * Verify user-supplied strings. 1795 * Check for null-terminated/zero-length strings/ 1796 */ 1797 tname = oh->ntlv.name; 1798 if (check_table_name(tname) != 0) 1799 return (EINVAL); 1800 1801 objheader_to_ti(oh, &ti); 1802 ti.type = i->type; 1803 1804 IPFW_UH_WLOCK(ch); 1805 ni = CHAIN_TO_NI(ch); 1806 if ((tc = find_table(ni, &ti)) == NULL) { 1807 IPFW_UH_WUNLOCK(ch); 1808 return (ESRCH); 1809 } 1810 1811 /* Do not support any modifications for readonly tables */ 1812 if ((tc->ta->flags & TA_FLAG_READONLY) != 0) { 1813 IPFW_UH_WUNLOCK(ch); 1814 return (EACCES); 1815 } 1816 1817 if ((i->mflags & IPFW_TMFLAGS_LIMIT) != 0) 1818 tc->limit = i->limit; 1819 if ((i->mflags & IPFW_TMFLAGS_LOCK) != 0) 1820 tc->locked = ((i->flags & IPFW_TGFLAGS_LOCKED) != 0); 1821 IPFW_UH_WUNLOCK(ch); 1822 1823 return (0); 1824 } 1825 1826 /* 1827 * Creates new table. 1828 * Data layout (v0)(current): 1829 * Request: [ ipfw_obj_header ipfw_xtable_info ] 1830 * 1831 * Returns 0 on success 1832 */ 1833 static int 1834 create_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 1835 struct sockopt_data *sd) 1836 { 1837 struct _ipfw_obj_header *oh; 1838 ipfw_xtable_info *i; 1839 char *tname, *aname; 1840 struct tid_info ti; 1841 struct namedobj_instance *ni; 1842 1843 if (sd->valsize != sizeof(*oh) + sizeof(ipfw_xtable_info)) 1844 return (EINVAL); 1845 1846 oh = (struct _ipfw_obj_header *)sd->kbuf; 1847 i = (ipfw_xtable_info *)(oh + 1); 1848 1849 /* 1850 * Verify user-supplied strings. 1851 * Check for null-terminated/zero-length strings/ 1852 */ 1853 tname = oh->ntlv.name; 1854 aname = i->algoname; 1855 if (check_table_name(tname) != 0 || 1856 strnlen(aname, sizeof(i->algoname)) == sizeof(i->algoname)) 1857 return (EINVAL); 1858 1859 if (aname[0] == '\0') { 1860 /* Use default algorithm */ 1861 aname = NULL; 1862 } 1863 1864 objheader_to_ti(oh, &ti); 1865 ti.type = i->type; 1866 1867 ni = CHAIN_TO_NI(ch); 1868 1869 IPFW_UH_RLOCK(ch); 1870 if (find_table(ni, &ti) != NULL) { 1871 IPFW_UH_RUNLOCK(ch); 1872 return (EEXIST); 1873 } 1874 IPFW_UH_RUNLOCK(ch); 1875 1876 return (create_table_internal(ch, &ti, aname, i, NULL, 0)); 1877 } 1878 1879 /* 1880 * Creates new table based on @ti and @aname. 1881 * 1882 * Relies on table name checking inside find_name_tlv() 1883 * Assume @aname to be checked and valid. 1884 * Stores allocated table kidx inside @pkidx (if non-NULL). 1885 * Reference created table if @compat is non-zero. 1886 * 1887 * Returns 0 on success. 1888 */ 1889 static int 1890 create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti, 1891 char *aname, ipfw_xtable_info *i, uint16_t *pkidx, int compat) 1892 { 1893 struct namedobj_instance *ni; 1894 struct table_config *tc, *tc_new, *tmp; 1895 struct table_algo *ta; 1896 uint16_t kidx; 1897 1898 ni = CHAIN_TO_NI(ch); 1899 1900 ta = find_table_algo(CHAIN_TO_TCFG(ch), ti, aname); 1901 if (ta == NULL) 1902 return (ENOTSUP); 1903 1904 tc = alloc_table_config(ch, ti, ta, aname, i->tflags); 1905 if (tc == NULL) 1906 return (ENOMEM); 1907 1908 tc->vmask = i->vmask; 1909 tc->limit = i->limit; 1910 if (ta->flags & TA_FLAG_READONLY) 1911 tc->locked = 1; 1912 else 1913 tc->locked = (i->flags & IPFW_TGFLAGS_LOCKED) != 0; 1914 1915 IPFW_UH_WLOCK(ch); 1916 1917 /* Check if table has been already created */ 1918 tc_new = find_table(ni, ti); 1919 if (tc_new != NULL) { 1920 1921 /* 1922 * Compat: do not fail if we're 1923 * requesting to create existing table 1924 * which has the same type 1925 */ 1926 if (compat == 0 || tc_new->no.subtype != tc->no.subtype) { 1927 IPFW_UH_WUNLOCK(ch); 1928 free_table_config(ni, tc); 1929 return (EEXIST); 1930 } 1931 1932 /* Exchange tc and tc_new for proper refcounting & freeing */ 1933 tmp = tc; 1934 tc = tc_new; 1935 tc_new = tmp; 1936 } else { 1937 /* New table */ 1938 if (ipfw_objhash_alloc_idx(ni, &kidx) != 0) { 1939 IPFW_UH_WUNLOCK(ch); 1940 printf("Unable to allocate table index." 1941 " Consider increasing net.inet.ip.fw.tables_max"); 1942 free_table_config(ni, tc); 1943 return (EBUSY); 1944 } 1945 tc->no.kidx = kidx; 1946 tc->no.etlv = IPFW_TLV_TBL_NAME; 1947 1948 IPFW_WLOCK(ch); 1949 link_table(ch, tc); 1950 IPFW_WUNLOCK(ch); 1951 } 1952 1953 if (compat != 0) 1954 tc->no.refcnt++; 1955 if (pkidx != NULL) 1956 *pkidx = tc->no.kidx; 1957 1958 IPFW_UH_WUNLOCK(ch); 1959 1960 if (tc_new != NULL) 1961 free_table_config(ni, tc_new); 1962 1963 return (0); 1964 } 1965 1966 static void 1967 ntlv_to_ti(ipfw_obj_ntlv *ntlv, struct tid_info *ti) 1968 { 1969 1970 memset(ti, 0, sizeof(struct tid_info)); 1971 ti->set = ntlv->set; 1972 ti->uidx = ntlv->idx; 1973 ti->tlvs = ntlv; 1974 ti->tlen = ntlv->head.length; 1975 } 1976 1977 static void 1978 objheader_to_ti(struct _ipfw_obj_header *oh, struct tid_info *ti) 1979 { 1980 1981 ntlv_to_ti(&oh->ntlv, ti); 1982 } 1983 1984 struct namedobj_instance * 1985 ipfw_get_table_objhash(struct ip_fw_chain *ch) 1986 { 1987 1988 return (CHAIN_TO_NI(ch)); 1989 } 1990 1991 /* 1992 * Exports basic table info as name TLV. 1993 * Used inside dump_static_rules() to provide info 1994 * about all tables referenced by current ruleset. 1995 * 1996 * Returns 0 on success. 1997 */ 1998 int 1999 ipfw_export_table_ntlv(struct ip_fw_chain *ch, uint16_t kidx, 2000 struct sockopt_data *sd) 2001 { 2002 struct namedobj_instance *ni; 2003 struct named_object *no; 2004 ipfw_obj_ntlv *ntlv; 2005 2006 ni = CHAIN_TO_NI(ch); 2007 2008 no = ipfw_objhash_lookup_kidx(ni, kidx); 2009 KASSERT(no != NULL, ("invalid table kidx passed")); 2010 2011 ntlv = (ipfw_obj_ntlv *)ipfw_get_sopt_space(sd, sizeof(*ntlv)); 2012 if (ntlv == NULL) 2013 return (ENOMEM); 2014 2015 ntlv->head.type = IPFW_TLV_TBL_NAME; 2016 ntlv->head.length = sizeof(*ntlv); 2017 ntlv->idx = no->kidx; 2018 strlcpy(ntlv->name, no->name, sizeof(ntlv->name)); 2019 2020 return (0); 2021 } 2022 2023 struct dump_args { 2024 struct ip_fw_chain *ch; 2025 struct table_info *ti; 2026 struct table_config *tc; 2027 struct sockopt_data *sd; 2028 uint32_t cnt; 2029 uint16_t uidx; 2030 int error; 2031 uint32_t size; 2032 ipfw_table_entry *ent; 2033 ta_foreach_f *f; 2034 void *farg; 2035 ipfw_obj_tentry tent; 2036 }; 2037 2038 static int 2039 count_ext_entries(void *e, void *arg) 2040 { 2041 struct dump_args *da; 2042 2043 da = (struct dump_args *)arg; 2044 da->cnt++; 2045 2046 return (0); 2047 } 2048 2049 /* 2050 * Gets number of items from table either using 2051 * internal counter or calling algo callback for 2052 * externally-managed tables. 2053 * 2054 * Returns number of records. 2055 */ 2056 static uint32_t 2057 table_get_count(struct ip_fw_chain *ch, struct table_config *tc) 2058 { 2059 struct table_info *ti; 2060 struct table_algo *ta; 2061 struct dump_args da; 2062 2063 ti = KIDX_TO_TI(ch, tc->no.kidx); 2064 ta = tc->ta; 2065 2066 /* Use internal counter for self-managed tables */ 2067 if ((ta->flags & TA_FLAG_READONLY) == 0) 2068 return (tc->count); 2069 2070 /* Use callback to quickly get number of items */ 2071 if ((ta->flags & TA_FLAG_EXTCOUNTER) != 0) 2072 return (ta->get_count(tc->astate, ti)); 2073 2074 /* Count number of iterms ourselves */ 2075 memset(&da, 0, sizeof(da)); 2076 ta->foreach(tc->astate, ti, count_ext_entries, &da); 2077 2078 return (da.cnt); 2079 } 2080 2081 /* 2082 * Exports table @tc info into standard ipfw_xtable_info format. 2083 */ 2084 static void 2085 export_table_info(struct ip_fw_chain *ch, struct table_config *tc, 2086 ipfw_xtable_info *i) 2087 { 2088 struct table_info *ti; 2089 struct table_algo *ta; 2090 2091 i->type = tc->no.subtype; 2092 i->tflags = tc->tflags; 2093 i->vmask = tc->vmask; 2094 i->set = tc->no.set; 2095 i->kidx = tc->no.kidx; 2096 i->refcnt = tc->no.refcnt; 2097 i->count = table_get_count(ch, tc); 2098 i->limit = tc->limit; 2099 i->flags |= (tc->locked != 0) ? IPFW_TGFLAGS_LOCKED : 0; 2100 i->size = i->count * sizeof(ipfw_obj_tentry); 2101 i->size += sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info); 2102 strlcpy(i->tablename, tc->tablename, sizeof(i->tablename)); 2103 ti = KIDX_TO_TI(ch, tc->no.kidx); 2104 ta = tc->ta; 2105 if (ta->print_config != NULL) { 2106 /* Use algo function to print table config to string */ 2107 ta->print_config(tc->astate, ti, i->algoname, 2108 sizeof(i->algoname)); 2109 } else 2110 strlcpy(i->algoname, ta->name, sizeof(i->algoname)); 2111 /* Dump algo-specific data, if possible */ 2112 if (ta->dump_tinfo != NULL) { 2113 ta->dump_tinfo(tc->astate, ti, &i->ta_info); 2114 i->ta_info.flags |= IPFW_TATFLAGS_DATA; 2115 } 2116 } 2117 2118 struct dump_table_args { 2119 struct ip_fw_chain *ch; 2120 struct sockopt_data *sd; 2121 }; 2122 2123 static void 2124 export_table_internal(struct namedobj_instance *ni, struct named_object *no, 2125 void *arg) 2126 { 2127 ipfw_xtable_info *i; 2128 struct dump_table_args *dta; 2129 2130 dta = (struct dump_table_args *)arg; 2131 2132 i = (ipfw_xtable_info *)ipfw_get_sopt_space(dta->sd, sizeof(*i)); 2133 KASSERT(i != 0, ("previously checked buffer is not enough")); 2134 2135 export_table_info(dta->ch, (struct table_config *)no, i); 2136 } 2137 2138 /* 2139 * Export all tables as ipfw_xtable_info structures to 2140 * storage provided by @sd. 2141 * 2142 * If supplied buffer is too small, fills in required size 2143 * and returns ENOMEM. 2144 * Returns 0 on success. 2145 */ 2146 static int 2147 export_tables(struct ip_fw_chain *ch, ipfw_obj_lheader *olh, 2148 struct sockopt_data *sd) 2149 { 2150 uint32_t size; 2151 uint32_t count; 2152 struct dump_table_args dta; 2153 2154 count = ipfw_objhash_count(CHAIN_TO_NI(ch)); 2155 size = count * sizeof(ipfw_xtable_info) + sizeof(ipfw_obj_lheader); 2156 2157 /* Fill in header regadless of buffer size */ 2158 olh->count = count; 2159 olh->objsize = sizeof(ipfw_xtable_info); 2160 2161 if (size > olh->size) { 2162 olh->size = size; 2163 return (ENOMEM); 2164 } 2165 2166 olh->size = size; 2167 2168 dta.ch = ch; 2169 dta.sd = sd; 2170 2171 ipfw_objhash_foreach(CHAIN_TO_NI(ch), export_table_internal, &dta); 2172 2173 return (0); 2174 } 2175 2176 /* 2177 * Dumps all table data 2178 * Data layout (v1)(current): 2179 * Request: [ ipfw_obj_header ], size = ipfw_xtable_info.size 2180 * Reply: [ ipfw_obj_header ipfw_xtable_info ipfw_obj_tentry x N ] 2181 * 2182 * Returns 0 on success 2183 */ 2184 static int 2185 dump_table_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 2186 struct sockopt_data *sd) 2187 { 2188 struct _ipfw_obj_header *oh; 2189 ipfw_xtable_info *i; 2190 struct tid_info ti; 2191 struct table_config *tc; 2192 struct table_algo *ta; 2193 struct dump_args da; 2194 uint32_t sz; 2195 2196 sz = sizeof(ipfw_obj_header) + sizeof(ipfw_xtable_info); 2197 oh = (struct _ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 2198 if (oh == NULL) 2199 return (EINVAL); 2200 2201 i = (ipfw_xtable_info *)(oh + 1); 2202 objheader_to_ti(oh, &ti); 2203 2204 IPFW_UH_RLOCK(ch); 2205 if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) { 2206 IPFW_UH_RUNLOCK(ch); 2207 return (ESRCH); 2208 } 2209 export_table_info(ch, tc, i); 2210 2211 if (sd->valsize < i->size) { 2212 2213 /* 2214 * Submitted buffer size is not enough. 2215 * WE've already filled in @i structure with 2216 * relevant table info including size, so we 2217 * can return. Buffer will be flushed automatically. 2218 */ 2219 IPFW_UH_RUNLOCK(ch); 2220 return (ENOMEM); 2221 } 2222 2223 /* 2224 * Do the actual dump in eXtended format 2225 */ 2226 memset(&da, 0, sizeof(da)); 2227 da.ch = ch; 2228 da.ti = KIDX_TO_TI(ch, tc->no.kidx); 2229 da.tc = tc; 2230 da.sd = sd; 2231 2232 ta = tc->ta; 2233 2234 ta->foreach(tc->astate, da.ti, dump_table_tentry, &da); 2235 IPFW_UH_RUNLOCK(ch); 2236 2237 return (da.error); 2238 } 2239 2240 /* 2241 * Dumps all table data 2242 * Data layout (version 0)(legacy): 2243 * Request: [ ipfw_xtable ], size = IP_FW_TABLE_XGETSIZE() 2244 * Reply: [ ipfw_xtable ipfw_table_xentry x N ] 2245 * 2246 * Returns 0 on success 2247 */ 2248 static int 2249 dump_table_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 2250 struct sockopt_data *sd) 2251 { 2252 ipfw_xtable *xtbl; 2253 struct tid_info ti; 2254 struct table_config *tc; 2255 struct table_algo *ta; 2256 struct dump_args da; 2257 size_t sz, count; 2258 2259 xtbl = (ipfw_xtable *)ipfw_get_sopt_header(sd, sizeof(ipfw_xtable)); 2260 if (xtbl == NULL) 2261 return (EINVAL); 2262 2263 memset(&ti, 0, sizeof(ti)); 2264 ti.uidx = xtbl->tbl; 2265 2266 IPFW_UH_RLOCK(ch); 2267 if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) { 2268 IPFW_UH_RUNLOCK(ch); 2269 return (0); 2270 } 2271 count = table_get_count(ch, tc); 2272 sz = count * sizeof(ipfw_table_xentry) + sizeof(ipfw_xtable); 2273 2274 xtbl->cnt = count; 2275 xtbl->size = sz; 2276 xtbl->type = tc->no.subtype; 2277 xtbl->tbl = ti.uidx; 2278 2279 if (sd->valsize < sz) { 2280 2281 /* 2282 * Submitted buffer size is not enough. 2283 * WE've already filled in @i structure with 2284 * relevant table info including size, so we 2285 * can return. Buffer will be flushed automatically. 2286 */ 2287 IPFW_UH_RUNLOCK(ch); 2288 return (ENOMEM); 2289 } 2290 2291 /* Do the actual dump in eXtended format */ 2292 memset(&da, 0, sizeof(da)); 2293 da.ch = ch; 2294 da.ti = KIDX_TO_TI(ch, tc->no.kidx); 2295 da.tc = tc; 2296 da.sd = sd; 2297 2298 ta = tc->ta; 2299 2300 ta->foreach(tc->astate, da.ti, dump_table_xentry, &da); 2301 IPFW_UH_RUNLOCK(ch); 2302 2303 return (0); 2304 } 2305 2306 /* 2307 * Legacy function to retrieve number of items in table. 2308 */ 2309 static int 2310 get_table_size(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 2311 struct sockopt_data *sd) 2312 { 2313 uint32_t *tbl; 2314 struct tid_info ti; 2315 size_t sz; 2316 int error; 2317 2318 sz = sizeof(*op3) + sizeof(uint32_t); 2319 op3 = (ip_fw3_opheader *)ipfw_get_sopt_header(sd, sz); 2320 if (op3 == NULL) 2321 return (EINVAL); 2322 2323 tbl = (uint32_t *)(op3 + 1); 2324 memset(&ti, 0, sizeof(ti)); 2325 ti.uidx = *tbl; 2326 IPFW_UH_RLOCK(ch); 2327 error = ipfw_count_xtable(ch, &ti, tbl); 2328 IPFW_UH_RUNLOCK(ch); 2329 return (error); 2330 } 2331 2332 /* 2333 * Legacy IP_FW_TABLE_GETSIZE handler 2334 */ 2335 int 2336 ipfw_count_table(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt) 2337 { 2338 struct table_config *tc; 2339 2340 if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) 2341 return (ESRCH); 2342 *cnt = table_get_count(ch, tc); 2343 return (0); 2344 } 2345 2346 /* 2347 * Legacy IP_FW_TABLE_XGETSIZE handler 2348 */ 2349 int 2350 ipfw_count_xtable(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt) 2351 { 2352 struct table_config *tc; 2353 uint32_t count; 2354 2355 if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) { 2356 *cnt = 0; 2357 return (0); /* 'table all list' requires success */ 2358 } 2359 2360 count = table_get_count(ch, tc); 2361 *cnt = count * sizeof(ipfw_table_xentry); 2362 if (count > 0) 2363 *cnt += sizeof(ipfw_xtable); 2364 return (0); 2365 } 2366 2367 static int 2368 dump_table_entry(void *e, void *arg) 2369 { 2370 struct dump_args *da; 2371 struct table_config *tc; 2372 struct table_algo *ta; 2373 ipfw_table_entry *ent; 2374 struct table_value *pval; 2375 int error; 2376 2377 da = (struct dump_args *)arg; 2378 2379 tc = da->tc; 2380 ta = tc->ta; 2381 2382 /* Out of memory, returning */ 2383 if (da->cnt == da->size) 2384 return (1); 2385 ent = da->ent++; 2386 ent->tbl = da->uidx; 2387 da->cnt++; 2388 2389 error = ta->dump_tentry(tc->astate, da->ti, e, &da->tent); 2390 if (error != 0) 2391 return (error); 2392 2393 ent->addr = da->tent.k.addr.s_addr; 2394 ent->masklen = da->tent.masklen; 2395 pval = get_table_value(da->ch, da->tc, da->tent.v.kidx); 2396 ent->value = ipfw_export_table_value_legacy(pval); 2397 2398 return (0); 2399 } 2400 2401 /* 2402 * Dumps table in pre-8.1 legacy format. 2403 */ 2404 int 2405 ipfw_dump_table_legacy(struct ip_fw_chain *ch, struct tid_info *ti, 2406 ipfw_table *tbl) 2407 { 2408 struct table_config *tc; 2409 struct table_algo *ta; 2410 struct dump_args da; 2411 2412 tbl->cnt = 0; 2413 2414 if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) 2415 return (0); /* XXX: We should return ESRCH */ 2416 2417 ta = tc->ta; 2418 2419 /* This dump format supports IPv4 only */ 2420 if (tc->no.subtype != IPFW_TABLE_ADDR) 2421 return (0); 2422 2423 memset(&da, 0, sizeof(da)); 2424 da.ch = ch; 2425 da.ti = KIDX_TO_TI(ch, tc->no.kidx); 2426 da.tc = tc; 2427 da.ent = &tbl->ent[0]; 2428 da.size = tbl->size; 2429 2430 tbl->cnt = 0; 2431 ta->foreach(tc->astate, da.ti, dump_table_entry, &da); 2432 tbl->cnt = da.cnt; 2433 2434 return (0); 2435 } 2436 2437 /* 2438 * Dumps table entry in eXtended format (v1)(current). 2439 */ 2440 static int 2441 dump_table_tentry(void *e, void *arg) 2442 { 2443 struct dump_args *da; 2444 struct table_config *tc; 2445 struct table_algo *ta; 2446 struct table_value *pval; 2447 ipfw_obj_tentry *tent; 2448 int error; 2449 2450 da = (struct dump_args *)arg; 2451 2452 tc = da->tc; 2453 ta = tc->ta; 2454 2455 tent = (ipfw_obj_tentry *)ipfw_get_sopt_space(da->sd, sizeof(*tent)); 2456 /* Out of memory, returning */ 2457 if (tent == NULL) { 2458 da->error = ENOMEM; 2459 return (1); 2460 } 2461 tent->head.length = sizeof(ipfw_obj_tentry); 2462 tent->idx = da->uidx; 2463 2464 error = ta->dump_tentry(tc->astate, da->ti, e, tent); 2465 if (error != 0) 2466 return (error); 2467 2468 pval = get_table_value(da->ch, da->tc, tent->v.kidx); 2469 ipfw_export_table_value_v1(pval, &tent->v.value); 2470 2471 return (0); 2472 } 2473 2474 /* 2475 * Dumps table entry in eXtended format (v0). 2476 */ 2477 static int 2478 dump_table_xentry(void *e, void *arg) 2479 { 2480 struct dump_args *da; 2481 struct table_config *tc; 2482 struct table_algo *ta; 2483 ipfw_table_xentry *xent; 2484 ipfw_obj_tentry *tent; 2485 struct table_value *pval; 2486 int error; 2487 2488 da = (struct dump_args *)arg; 2489 2490 tc = da->tc; 2491 ta = tc->ta; 2492 2493 xent = (ipfw_table_xentry *)ipfw_get_sopt_space(da->sd, sizeof(*xent)); 2494 /* Out of memory, returning */ 2495 if (xent == NULL) 2496 return (1); 2497 xent->len = sizeof(ipfw_table_xentry); 2498 xent->tbl = da->uidx; 2499 2500 memset(&da->tent, 0, sizeof(da->tent)); 2501 tent = &da->tent; 2502 error = ta->dump_tentry(tc->astate, da->ti, e, tent); 2503 if (error != 0) 2504 return (error); 2505 2506 /* Convert current format to previous one */ 2507 xent->masklen = tent->masklen; 2508 pval = get_table_value(da->ch, da->tc, da->tent.v.kidx); 2509 xent->value = ipfw_export_table_value_legacy(pval); 2510 /* Apply some hacks */ 2511 if (tc->no.subtype == IPFW_TABLE_ADDR && tent->subtype == AF_INET) { 2512 xent->k.addr6.s6_addr32[3] = tent->k.addr.s_addr; 2513 xent->flags = IPFW_TCF_INET; 2514 } else 2515 memcpy(&xent->k, &tent->k, sizeof(xent->k)); 2516 2517 return (0); 2518 } 2519 2520 /* 2521 * Helper function to export table algo data 2522 * to tentry format before calling user function. 2523 * 2524 * Returns 0 on success. 2525 */ 2526 static int 2527 prepare_table_tentry(void *e, void *arg) 2528 { 2529 struct dump_args *da; 2530 struct table_config *tc; 2531 struct table_algo *ta; 2532 int error; 2533 2534 da = (struct dump_args *)arg; 2535 2536 tc = da->tc; 2537 ta = tc->ta; 2538 2539 error = ta->dump_tentry(tc->astate, da->ti, e, &da->tent); 2540 if (error != 0) 2541 return (error); 2542 2543 da->f(&da->tent, da->farg); 2544 2545 return (0); 2546 } 2547 2548 /* 2549 * Allow external consumers to read table entries in standard format. 2550 */ 2551 int 2552 ipfw_foreach_table_tentry(struct ip_fw_chain *ch, uint16_t kidx, 2553 ta_foreach_f *f, void *arg) 2554 { 2555 struct namedobj_instance *ni; 2556 struct table_config *tc; 2557 struct table_algo *ta; 2558 struct dump_args da; 2559 2560 ni = CHAIN_TO_NI(ch); 2561 2562 tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, kidx); 2563 if (tc == NULL) 2564 return (ESRCH); 2565 2566 ta = tc->ta; 2567 2568 memset(&da, 0, sizeof(da)); 2569 da.ch = ch; 2570 da.ti = KIDX_TO_TI(ch, tc->no.kidx); 2571 da.tc = tc; 2572 da.f = f; 2573 da.farg = arg; 2574 2575 ta->foreach(tc->astate, da.ti, prepare_table_tentry, &da); 2576 2577 return (0); 2578 } 2579 2580 /* 2581 * Table algorithms 2582 */ 2583 2584 /* 2585 * Finds algoritm by index, table type or supplied name. 2586 * 2587 * Returns pointer to algo or NULL. 2588 */ 2589 static struct table_algo * 2590 find_table_algo(struct tables_config *tcfg, struct tid_info *ti, char *name) 2591 { 2592 int i, l; 2593 struct table_algo *ta; 2594 2595 if (ti->type > IPFW_TABLE_MAXTYPE) 2596 return (NULL); 2597 2598 /* Search by index */ 2599 if (ti->atype != 0) { 2600 if (ti->atype > tcfg->algo_count) 2601 return (NULL); 2602 return (tcfg->algo[ti->atype]); 2603 } 2604 2605 if (name == NULL) { 2606 /* Return default algorithm for given type if set */ 2607 return (tcfg->def_algo[ti->type]); 2608 } 2609 2610 /* Search by name */ 2611 /* TODO: better search */ 2612 for (i = 1; i <= tcfg->algo_count; i++) { 2613 ta = tcfg->algo[i]; 2614 2615 /* 2616 * One can supply additional algorithm 2617 * parameters so we compare only the first word 2618 * of supplied name: 2619 * 'addr:chash hsize=32' 2620 * '^^^^^^^^^' 2621 * 2622 */ 2623 l = strlen(ta->name); 2624 if (strncmp(name, ta->name, l) != 0) 2625 continue; 2626 if (name[l] != '\0' && name[l] != ' ') 2627 continue; 2628 /* Check if we're requesting proper table type */ 2629 if (ti->type != 0 && ti->type != ta->type) 2630 return (NULL); 2631 return (ta); 2632 } 2633 2634 return (NULL); 2635 } 2636 2637 /* 2638 * Register new table algo @ta. 2639 * Stores algo id inside @idx. 2640 * 2641 * Returns 0 on success. 2642 */ 2643 int 2644 ipfw_add_table_algo(struct ip_fw_chain *ch, struct table_algo *ta, size_t size, 2645 int *idx) 2646 { 2647 struct tables_config *tcfg; 2648 struct table_algo *ta_new; 2649 size_t sz; 2650 2651 if (size > sizeof(struct table_algo)) 2652 return (EINVAL); 2653 2654 /* Check for the required on-stack size for add/del */ 2655 sz = roundup2(ta->ta_buf_size, sizeof(void *)); 2656 if (sz > TA_BUF_SZ) 2657 return (EINVAL); 2658 2659 KASSERT(ta->type <= IPFW_TABLE_MAXTYPE,("Increase IPFW_TABLE_MAXTYPE")); 2660 2661 /* Copy algorithm data to stable storage. */ 2662 ta_new = malloc(sizeof(struct table_algo), M_IPFW, M_WAITOK | M_ZERO); 2663 memcpy(ta_new, ta, size); 2664 2665 tcfg = CHAIN_TO_TCFG(ch); 2666 2667 KASSERT(tcfg->algo_count < 255, ("Increase algo array size")); 2668 2669 tcfg->algo[++tcfg->algo_count] = ta_new; 2670 ta_new->idx = tcfg->algo_count; 2671 2672 /* Set algorithm as default one for given type */ 2673 if ((ta_new->flags & TA_FLAG_DEFAULT) != 0 && 2674 tcfg->def_algo[ta_new->type] == NULL) 2675 tcfg->def_algo[ta_new->type] = ta_new; 2676 2677 *idx = ta_new->idx; 2678 2679 return (0); 2680 } 2681 2682 /* 2683 * Unregisters table algo using @idx as id. 2684 * XXX: It is NOT safe to call this function in any place 2685 * other than ipfw instance destroy handler. 2686 */ 2687 void 2688 ipfw_del_table_algo(struct ip_fw_chain *ch, int idx) 2689 { 2690 struct tables_config *tcfg; 2691 struct table_algo *ta; 2692 2693 tcfg = CHAIN_TO_TCFG(ch); 2694 2695 KASSERT(idx <= tcfg->algo_count, ("algo idx %d out of range 1..%d", 2696 idx, tcfg->algo_count)); 2697 2698 ta = tcfg->algo[idx]; 2699 KASSERT(ta != NULL, ("algo idx %d is NULL", idx)); 2700 2701 if (tcfg->def_algo[ta->type] == ta) 2702 tcfg->def_algo[ta->type] = NULL; 2703 2704 free(ta, M_IPFW); 2705 } 2706 2707 /* 2708 * Lists all table algorithms currently available. 2709 * Data layout (v0)(current): 2710 * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size 2711 * Reply: [ ipfw_obj_lheader ipfw_ta_info x N ] 2712 * 2713 * Returns 0 on success 2714 */ 2715 static int 2716 list_table_algo(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 2717 struct sockopt_data *sd) 2718 { 2719 struct _ipfw_obj_lheader *olh; 2720 struct tables_config *tcfg; 2721 ipfw_ta_info *i; 2722 struct table_algo *ta; 2723 uint32_t count, n, size; 2724 2725 olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh)); 2726 if (olh == NULL) 2727 return (EINVAL); 2728 if (sd->valsize < olh->size) 2729 return (EINVAL); 2730 2731 IPFW_UH_RLOCK(ch); 2732 tcfg = CHAIN_TO_TCFG(ch); 2733 count = tcfg->algo_count; 2734 size = count * sizeof(ipfw_ta_info) + sizeof(ipfw_obj_lheader); 2735 2736 /* Fill in header regadless of buffer size */ 2737 olh->count = count; 2738 olh->objsize = sizeof(ipfw_ta_info); 2739 2740 if (size > olh->size) { 2741 olh->size = size; 2742 IPFW_UH_RUNLOCK(ch); 2743 return (ENOMEM); 2744 } 2745 olh->size = size; 2746 2747 for (n = 1; n <= count; n++) { 2748 i = (ipfw_ta_info *)ipfw_get_sopt_space(sd, sizeof(*i)); 2749 KASSERT(i != 0, ("previously checked buffer is not enough")); 2750 ta = tcfg->algo[n]; 2751 strlcpy(i->algoname, ta->name, sizeof(i->algoname)); 2752 i->type = ta->type; 2753 i->refcnt = ta->refcnt; 2754 } 2755 2756 IPFW_UH_RUNLOCK(ch); 2757 2758 return (0); 2759 } 2760 2761 static int 2762 classify_srcdst(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 2763 { 2764 /* Basic IPv4/IPv6 or u32 lookups */ 2765 *puidx = cmd->arg1; 2766 /* Assume ADDR by default */ 2767 *ptype = IPFW_TABLE_ADDR; 2768 int v; 2769 2770 if (F_LEN(cmd) > F_INSN_SIZE(ipfw_insn_u32)) { 2771 /* 2772 * generic lookup. The key must be 2773 * in 32bit big-endian format. 2774 */ 2775 v = ((ipfw_insn_u32 *)cmd)->d[1]; 2776 switch (v) { 2777 case 0: 2778 case 1: 2779 /* IPv4 src/dst */ 2780 break; 2781 case 2: 2782 case 3: 2783 /* src/dst port */ 2784 *ptype = IPFW_TABLE_NUMBER; 2785 break; 2786 case 4: 2787 /* uid/gid */ 2788 *ptype = IPFW_TABLE_NUMBER; 2789 break; 2790 case 5: 2791 /* jid */ 2792 *ptype = IPFW_TABLE_NUMBER; 2793 break; 2794 case 6: 2795 /* dscp */ 2796 *ptype = IPFW_TABLE_NUMBER; 2797 break; 2798 } 2799 } 2800 2801 return (0); 2802 } 2803 2804 static int 2805 classify_via(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 2806 { 2807 ipfw_insn_if *cmdif; 2808 2809 /* Interface table, possibly */ 2810 cmdif = (ipfw_insn_if *)cmd; 2811 if (cmdif->name[0] != '\1') 2812 return (1); 2813 2814 *ptype = IPFW_TABLE_INTERFACE; 2815 *puidx = cmdif->p.kidx; 2816 2817 return (0); 2818 } 2819 2820 static int 2821 classify_flow(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 2822 { 2823 2824 *puidx = cmd->arg1; 2825 *ptype = IPFW_TABLE_FLOW; 2826 2827 return (0); 2828 } 2829 2830 static void 2831 update_arg1(ipfw_insn *cmd, uint16_t idx) 2832 { 2833 2834 cmd->arg1 = idx; 2835 } 2836 2837 static void 2838 update_via(ipfw_insn *cmd, uint16_t idx) 2839 { 2840 ipfw_insn_if *cmdif; 2841 2842 cmdif = (ipfw_insn_if *)cmd; 2843 cmdif->p.kidx = idx; 2844 } 2845 2846 static int 2847 table_findbyname(struct ip_fw_chain *ch, struct tid_info *ti, 2848 struct named_object **pno) 2849 { 2850 struct table_config *tc; 2851 int error; 2852 2853 IPFW_UH_WLOCK_ASSERT(ch); 2854 2855 error = find_table_err(CHAIN_TO_NI(ch), ti, &tc); 2856 if (error != 0) 2857 return (error); 2858 2859 *pno = &tc->no; 2860 return (0); 2861 } 2862 2863 /* XXX: sets-sets! */ 2864 static struct named_object * 2865 table_findbykidx(struct ip_fw_chain *ch, uint16_t idx) 2866 { 2867 struct namedobj_instance *ni; 2868 struct table_config *tc; 2869 2870 IPFW_UH_WLOCK_ASSERT(ch); 2871 ni = CHAIN_TO_NI(ch); 2872 tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, idx); 2873 KASSERT(tc != NULL, ("Table with index %d not found", idx)); 2874 2875 return (&tc->no); 2876 } 2877 2878 static struct opcode_obj_rewrite opcodes[] = { 2879 { 2880 O_IP_SRC_LOOKUP, IPFW_TLV_TBL_NAME, 2881 classify_srcdst, update_arg1, 2882 table_findbyname, table_findbykidx, create_table_compat 2883 }, 2884 { 2885 O_IP_DST_LOOKUP, IPFW_TLV_TBL_NAME, 2886 classify_srcdst, update_arg1, 2887 table_findbyname, table_findbykidx, create_table_compat 2888 }, 2889 { 2890 O_IP_FLOW_LOOKUP, IPFW_TLV_TBL_NAME, 2891 classify_flow, update_arg1, 2892 table_findbyname, table_findbykidx, create_table_compat 2893 }, 2894 { 2895 O_XMIT, IPFW_TLV_TBL_NAME, 2896 classify_via, update_via, 2897 table_findbyname, table_findbykidx, create_table_compat 2898 }, 2899 { 2900 O_RECV, IPFW_TLV_TBL_NAME, 2901 classify_via, update_via, 2902 table_findbyname, table_findbykidx, create_table_compat 2903 }, 2904 { 2905 O_VIA, IPFW_TLV_TBL_NAME, 2906 classify_via, update_via, 2907 table_findbyname, table_findbykidx, create_table_compat 2908 }, 2909 }; 2910 2911 2912 /* 2913 * Checks table name for validity. 2914 * Enforce basic length checks, the rest 2915 * should be done in userland. 2916 * 2917 * Returns 0 if name is considered valid. 2918 */ 2919 static int 2920 check_table_name(const char *name) 2921 { 2922 2923 /* 2924 * TODO: do some more complicated checks 2925 */ 2926 return (ipfw_check_object_name_generic(name)); 2927 } 2928 2929 /* 2930 * Find tablename TLV by @uid. 2931 * Check @tlvs for valid data inside. 2932 * 2933 * Returns pointer to found TLV or NULL. 2934 */ 2935 static ipfw_obj_ntlv * 2936 find_name_tlv(void *tlvs, int len, uint16_t uidx) 2937 { 2938 ipfw_obj_ntlv *ntlv; 2939 uintptr_t pa, pe; 2940 int l; 2941 2942 pa = (uintptr_t)tlvs; 2943 pe = pa + len; 2944 l = 0; 2945 for (; pa < pe; pa += l) { 2946 ntlv = (ipfw_obj_ntlv *)pa; 2947 l = ntlv->head.length; 2948 2949 if (l != sizeof(*ntlv)) 2950 return (NULL); 2951 2952 if (ntlv->head.type != IPFW_TLV_TBL_NAME) 2953 continue; 2954 2955 if (ntlv->idx != uidx) 2956 continue; 2957 2958 if (check_table_name(ntlv->name) != 0) 2959 return (NULL); 2960 2961 return (ntlv); 2962 } 2963 2964 return (NULL); 2965 } 2966 2967 /* 2968 * Finds table config based on either legacy index 2969 * or name in ntlv. 2970 * Note @ti structure contains unchecked data from userland. 2971 * 2972 * Returns 0 in success and fills in @tc with found config 2973 */ 2974 static int 2975 find_table_err(struct namedobj_instance *ni, struct tid_info *ti, 2976 struct table_config **tc) 2977 { 2978 char *name, bname[16]; 2979 struct named_object *no; 2980 ipfw_obj_ntlv *ntlv; 2981 uint32_t set; 2982 2983 if (ti->tlvs != NULL) { 2984 ntlv = find_name_tlv(ti->tlvs, ti->tlen, ti->uidx); 2985 if (ntlv == NULL) 2986 return (EINVAL); 2987 name = ntlv->name; 2988 2989 /* 2990 * Use set provided by @ti instead of @ntlv one. 2991 * This is needed due to different sets behavior 2992 * controlled by V_fw_tables_sets. 2993 */ 2994 set = ti->set; 2995 } else { 2996 snprintf(bname, sizeof(bname), "%d", ti->uidx); 2997 name = bname; 2998 set = 0; 2999 } 3000 3001 no = ipfw_objhash_lookup_name(ni, set, name); 3002 *tc = (struct table_config *)no; 3003 3004 return (0); 3005 } 3006 3007 /* 3008 * Finds table config based on either legacy index 3009 * or name in ntlv. 3010 * Note @ti structure contains unchecked data from userland. 3011 * 3012 * Returns pointer to table_config or NULL. 3013 */ 3014 static struct table_config * 3015 find_table(struct namedobj_instance *ni, struct tid_info *ti) 3016 { 3017 struct table_config *tc; 3018 3019 if (find_table_err(ni, ti, &tc) != 0) 3020 return (NULL); 3021 3022 return (tc); 3023 } 3024 3025 /* 3026 * Allocate new table config structure using 3027 * specified @algo and @aname. 3028 * 3029 * Returns pointer to config or NULL. 3030 */ 3031 static struct table_config * 3032 alloc_table_config(struct ip_fw_chain *ch, struct tid_info *ti, 3033 struct table_algo *ta, char *aname, uint8_t tflags) 3034 { 3035 char *name, bname[16]; 3036 struct table_config *tc; 3037 int error; 3038 ipfw_obj_ntlv *ntlv; 3039 uint32_t set; 3040 3041 if (ti->tlvs != NULL) { 3042 ntlv = find_name_tlv(ti->tlvs, ti->tlen, ti->uidx); 3043 if (ntlv == NULL) 3044 return (NULL); 3045 name = ntlv->name; 3046 set = ntlv->set; 3047 } else { 3048 /* Compat part: convert number to string representation */ 3049 snprintf(bname, sizeof(bname), "%d", ti->uidx); 3050 name = bname; 3051 set = 0; 3052 } 3053 3054 tc = malloc(sizeof(struct table_config), M_IPFW, M_WAITOK | M_ZERO); 3055 tc->no.name = tc->tablename; 3056 tc->no.subtype = ta->type; 3057 tc->no.set = set; 3058 tc->tflags = tflags; 3059 tc->ta = ta; 3060 strlcpy(tc->tablename, name, sizeof(tc->tablename)); 3061 /* Set "shared" value type by default */ 3062 tc->vshared = 1; 3063 3064 /* Preallocate data structures for new tables */ 3065 error = ta->init(ch, &tc->astate, &tc->ti_copy, aname, tflags); 3066 if (error != 0) { 3067 free(tc, M_IPFW); 3068 return (NULL); 3069 } 3070 3071 return (tc); 3072 } 3073 3074 /* 3075 * Destroys table state and config. 3076 */ 3077 static void 3078 free_table_config(struct namedobj_instance *ni, struct table_config *tc) 3079 { 3080 3081 KASSERT(tc->linked == 0, ("free() on linked config")); 3082 /* UH lock MUST NOT be held */ 3083 3084 /* 3085 * We're using ta without any locking/referencing. 3086 * TODO: fix this if we're going to use unloadable algos. 3087 */ 3088 tc->ta->destroy(tc->astate, &tc->ti_copy); 3089 free(tc, M_IPFW); 3090 } 3091 3092 /* 3093 * Links @tc to @chain table named instance. 3094 * Sets appropriate type/states in @chain table info. 3095 */ 3096 static void 3097 link_table(struct ip_fw_chain *ch, struct table_config *tc) 3098 { 3099 struct namedobj_instance *ni; 3100 struct table_info *ti; 3101 uint16_t kidx; 3102 3103 IPFW_UH_WLOCK_ASSERT(ch); 3104 IPFW_WLOCK_ASSERT(ch); 3105 3106 ni = CHAIN_TO_NI(ch); 3107 kidx = tc->no.kidx; 3108 3109 ipfw_objhash_add(ni, &tc->no); 3110 3111 ti = KIDX_TO_TI(ch, kidx); 3112 *ti = tc->ti_copy; 3113 3114 /* Notify algo on real @ti address */ 3115 if (tc->ta->change_ti != NULL) 3116 tc->ta->change_ti(tc->astate, ti); 3117 3118 tc->linked = 1; 3119 tc->ta->refcnt++; 3120 } 3121 3122 /* 3123 * Unlinks @tc from @chain table named instance. 3124 * Zeroes states in @chain and stores them in @tc. 3125 */ 3126 static void 3127 unlink_table(struct ip_fw_chain *ch, struct table_config *tc) 3128 { 3129 struct namedobj_instance *ni; 3130 struct table_info *ti; 3131 uint16_t kidx; 3132 3133 IPFW_UH_WLOCK_ASSERT(ch); 3134 IPFW_WLOCK_ASSERT(ch); 3135 3136 ni = CHAIN_TO_NI(ch); 3137 kidx = tc->no.kidx; 3138 3139 /* Clear state. @ti copy is already saved inside @tc */ 3140 ipfw_objhash_del(ni, &tc->no); 3141 ti = KIDX_TO_TI(ch, kidx); 3142 memset(ti, 0, sizeof(struct table_info)); 3143 tc->linked = 0; 3144 tc->ta->refcnt--; 3145 3146 /* Notify algo on real @ti address */ 3147 if (tc->ta->change_ti != NULL) 3148 tc->ta->change_ti(tc->astate, NULL); 3149 } 3150 3151 struct swap_table_args { 3152 int set; 3153 int new_set; 3154 int mv; 3155 }; 3156 3157 /* 3158 * Change set for each matching table. 3159 * 3160 * Ensure we dispatch each table once by setting/checking ochange 3161 * fields. 3162 */ 3163 static void 3164 swap_table_set(struct namedobj_instance *ni, struct named_object *no, 3165 void *arg) 3166 { 3167 struct table_config *tc; 3168 struct swap_table_args *sta; 3169 3170 tc = (struct table_config *)no; 3171 sta = (struct swap_table_args *)arg; 3172 3173 if (no->set != sta->set && (no->set != sta->new_set || sta->mv != 0)) 3174 return; 3175 3176 if (tc->ochanged != 0) 3177 return; 3178 3179 tc->ochanged = 1; 3180 ipfw_objhash_del(ni, no); 3181 if (no->set == sta->set) 3182 no->set = sta->new_set; 3183 else 3184 no->set = sta->set; 3185 ipfw_objhash_add(ni, no); 3186 } 3187 3188 /* 3189 * Cleans up ochange field for all tables. 3190 */ 3191 static void 3192 clean_table_set_data(struct namedobj_instance *ni, struct named_object *no, 3193 void *arg) 3194 { 3195 struct table_config *tc; 3196 struct swap_table_args *sta; 3197 3198 tc = (struct table_config *)no; 3199 sta = (struct swap_table_args *)arg; 3200 3201 tc->ochanged = 0; 3202 } 3203 3204 /* 3205 * Swaps tables within two sets. 3206 */ 3207 void 3208 ipfw_swap_tables_sets(struct ip_fw_chain *ch, uint32_t set, 3209 uint32_t new_set, int mv) 3210 { 3211 struct swap_table_args sta; 3212 3213 IPFW_UH_WLOCK_ASSERT(ch); 3214 3215 sta.set = set; 3216 sta.new_set = new_set; 3217 sta.mv = mv; 3218 3219 ipfw_objhash_foreach(CHAIN_TO_NI(ch), swap_table_set, &sta); 3220 ipfw_objhash_foreach(CHAIN_TO_NI(ch), clean_table_set_data, &sta); 3221 } 3222 3223 /* 3224 * Move all tables which are reference by rules in @rr to set @new_set. 3225 * Makes sure that all relevant tables are referenced ONLLY by given rules. 3226 * 3227 * Retuns 0 on success, 3228 */ 3229 int 3230 ipfw_move_tables_sets(struct ip_fw_chain *ch, ipfw_range_tlv *rt, 3231 uint32_t new_set) 3232 { 3233 struct ip_fw *rule; 3234 struct table_config *tc; 3235 struct named_object *no; 3236 struct namedobj_instance *ni; 3237 int bad, i, l, cmdlen; 3238 uint16_t kidx; 3239 ipfw_insn *cmd; 3240 3241 IPFW_UH_WLOCK_ASSERT(ch); 3242 3243 ni = CHAIN_TO_NI(ch); 3244 3245 /* Stage 1: count number of references by given rules */ 3246 for (i = 0; i < ch->n_rules - 1; i++) { 3247 rule = ch->map[i]; 3248 if (ipfw_match_range(rule, rt) == 0) 3249 continue; 3250 3251 l = rule->cmd_len; 3252 cmd = rule->cmd; 3253 cmdlen = 0; 3254 for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 3255 cmdlen = F_LEN(cmd); 3256 if (classify_opcode_kidx(cmd, &kidx) != 0) 3257 continue; 3258 no = ipfw_objhash_lookup_kidx(ni, kidx); 3259 KASSERT(no != NULL, 3260 ("objhash lookup failed on index %d", kidx)); 3261 tc = (struct table_config *)no; 3262 tc->ocount++; 3263 } 3264 3265 } 3266 3267 /* Stage 2: verify "ownership" */ 3268 bad = 0; 3269 for (i = 0; i < ch->n_rules - 1; i++) { 3270 rule = ch->map[i]; 3271 if (ipfw_match_range(rule, rt) == 0) 3272 continue; 3273 3274 l = rule->cmd_len; 3275 cmd = rule->cmd; 3276 cmdlen = 0; 3277 for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 3278 cmdlen = F_LEN(cmd); 3279 if (classify_opcode_kidx(cmd, &kidx) != 0) 3280 continue; 3281 no = ipfw_objhash_lookup_kidx(ni, kidx); 3282 KASSERT(no != NULL, 3283 ("objhash lookup failed on index %d", kidx)); 3284 tc = (struct table_config *)no; 3285 if (tc->no.refcnt != tc->ocount) { 3286 3287 /* 3288 * Number of references differ: 3289 * Other rule(s) are holding reference to given 3290 * table, so it is not possible to change its set. 3291 * 3292 * Note that refcnt may account 3293 * references to some going-to-be-added rules. 3294 * Since we don't know their numbers (and event 3295 * if they will be added) it is perfectly OK 3296 * to return error here. 3297 */ 3298 bad = 1; 3299 break; 3300 } 3301 } 3302 3303 if (bad != 0) 3304 break; 3305 } 3306 3307 /* Stage 3: change set or cleanup */ 3308 for (i = 0; i < ch->n_rules - 1; i++) { 3309 rule = ch->map[i]; 3310 if (ipfw_match_range(rule, rt) == 0) 3311 continue; 3312 3313 l = rule->cmd_len; 3314 cmd = rule->cmd; 3315 cmdlen = 0; 3316 for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 3317 cmdlen = F_LEN(cmd); 3318 if (classify_opcode_kidx(cmd, &kidx) != 0) 3319 continue; 3320 no = ipfw_objhash_lookup_kidx(ni, kidx); 3321 KASSERT(no != NULL, 3322 ("objhash lookup failed on index %d", kidx)); 3323 tc = (struct table_config *)no; 3324 3325 tc->ocount = 0; 3326 if (bad != 0) 3327 continue; 3328 3329 /* Actually change set. */ 3330 ipfw_objhash_del(ni, no); 3331 no->set = new_set; 3332 ipfw_objhash_add(ni, no); 3333 } 3334 } 3335 3336 return (bad); 3337 } 3338 3339 /* 3340 * Finds and bumps refcount for objects referenced by given @rule. 3341 * Auto-creates non-existing tables. 3342 * Fills in @oib array with userland/kernel indexes. 3343 * 3344 * Returns 0 on success. 3345 */ 3346 static int 3347 ref_rule_objects(struct ip_fw_chain *ch, struct ip_fw *rule, 3348 struct rule_check_info *ci, struct obj_idx *oib, struct tid_info *ti) 3349 { 3350 int cmdlen, error, l, numnew; 3351 ipfw_insn *cmd; 3352 struct obj_idx *pidx; 3353 int found, unresolved; 3354 3355 pidx = oib; 3356 l = rule->cmd_len; 3357 cmd = rule->cmd; 3358 cmdlen = 0; 3359 error = 0; 3360 numnew = 0; 3361 found = 0; 3362 unresolved = 0; 3363 3364 IPFW_UH_WLOCK(ch); 3365 3366 /* Increase refcount on each existing referenced table. */ 3367 for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { 3368 cmdlen = F_LEN(cmd); 3369 3370 error = ref_opcode_object(ch, cmd, ti, pidx, &found, &unresolved); 3371 if (error != 0) 3372 break; 3373 if (found || unresolved) { 3374 pidx->off = rule->cmd_len - l; 3375 pidx++; 3376 } 3377 /* 3378 * Compability stuff for old clients: 3379 * prepare to manually create non-existing objects. 3380 */ 3381 if (unresolved) 3382 numnew++; 3383 } 3384 3385 if (error != 0) { 3386 /* Unref everything we have already done */ 3387 unref_oib_objects(ch, rule->cmd, oib, pidx); 3388 IPFW_UH_WUNLOCK(ch); 3389 return (error); 3390 } 3391 IPFW_UH_WUNLOCK(ch); 3392 3393 /* Perform auto-creation for non-existing objects */ 3394 if (numnew != 0) 3395 error = create_objects_compat(ch, rule->cmd, oib, pidx, ti); 3396 3397 /* Calculate real number of dynamic objects */ 3398 ci->object_opcodes = (uint16_t)(pidx - oib); 3399 3400 return (error); 3401 } 3402 3403 /* 3404 * Checks is opcode is referencing table of appropriate type. 3405 * Adds reference count for found table if true. 3406 * Rewrites user-supplied opcode values with kernel ones. 3407 * 3408 * Returns 0 on success and appropriate error code otherwise. 3409 */ 3410 int 3411 ipfw_rewrite_rule_uidx(struct ip_fw_chain *chain, 3412 struct rule_check_info *ci) 3413 { 3414 int error; 3415 ipfw_insn *cmd; 3416 uint8_t type; 3417 struct obj_idx *p, *pidx_first, *pidx_last; 3418 struct tid_info ti; 3419 3420 /* 3421 * Prepare an array for storing opcode indices. 3422 * Use stack allocation by default. 3423 */ 3424 if (ci->object_opcodes <= (sizeof(ci->obuf)/sizeof(ci->obuf[0]))) { 3425 /* Stack */ 3426 pidx_first = ci->obuf; 3427 } else 3428 pidx_first = malloc(ci->object_opcodes * sizeof(struct obj_idx), 3429 M_IPFW, M_WAITOK | M_ZERO); 3430 3431 error = 0; 3432 type = 0; 3433 memset(&ti, 0, sizeof(ti)); 3434 3435 /* 3436 * Use default set for looking up tables (old way) or 3437 * use set rule is assigned to (new way). 3438 */ 3439 ti.set = (V_fw_tables_sets != 0) ? ci->krule->set : 0; 3440 if (ci->ctlv != NULL) { 3441 ti.tlvs = (void *)(ci->ctlv + 1); 3442 ti.tlen = ci->ctlv->head.length - sizeof(ipfw_obj_ctlv); 3443 } 3444 3445 /* Reference all used tables and other objects */ 3446 error = ref_rule_objects(chain, ci->krule, ci, pidx_first, &ti); 3447 if (error != 0) 3448 goto free; 3449 /* 3450 * Note that ref_rule_objects() might have updated ci->object_opcodes 3451 * to reflect actual number of object opcodes. 3452 */ 3453 3454 /* Perform rule rewrite */ 3455 p = pidx_first; 3456 pidx_last = pidx_first + ci->object_opcodes; 3457 for (p = pidx_first; p < pidx_last; p++) { 3458 cmd = ci->krule->cmd + p->off; 3459 update_opcode_kidx(cmd, p->kidx); 3460 } 3461 3462 free: 3463 if (pidx_first != ci->obuf) 3464 free(pidx_first, M_IPFW); 3465 3466 return (error); 3467 } 3468 3469 static struct ipfw_sopt_handler scodes[] = { 3470 { IP_FW_TABLE_XCREATE, 0, HDIR_SET, create_table }, 3471 { IP_FW_TABLE_XDESTROY, 0, HDIR_SET, flush_table_v0 }, 3472 { IP_FW_TABLE_XFLUSH, 0, HDIR_SET, flush_table_v0 }, 3473 { IP_FW_TABLE_XMODIFY, 0, HDIR_BOTH, modify_table }, 3474 { IP_FW_TABLE_XINFO, 0, HDIR_GET, describe_table }, 3475 { IP_FW_TABLES_XLIST, 0, HDIR_GET, list_tables }, 3476 { IP_FW_TABLE_XLIST, 0, HDIR_GET, dump_table_v0 }, 3477 { IP_FW_TABLE_XLIST, 1, HDIR_GET, dump_table_v1 }, 3478 { IP_FW_TABLE_XADD, 0, HDIR_BOTH, manage_table_ent_v0 }, 3479 { IP_FW_TABLE_XADD, 1, HDIR_BOTH, manage_table_ent_v1 }, 3480 { IP_FW_TABLE_XDEL, 0, HDIR_BOTH, manage_table_ent_v0 }, 3481 { IP_FW_TABLE_XDEL, 1, HDIR_BOTH, manage_table_ent_v1 }, 3482 { IP_FW_TABLE_XFIND, 0, HDIR_GET, find_table_entry }, 3483 { IP_FW_TABLE_XSWAP, 0, HDIR_SET, swap_table }, 3484 { IP_FW_TABLES_ALIST, 0, HDIR_GET, list_table_algo }, 3485 { IP_FW_TABLE_XGETSIZE, 0, HDIR_GET, get_table_size }, 3486 }; 3487 3488 static void 3489 destroy_table_locked(struct namedobj_instance *ni, struct named_object *no, 3490 void *arg) 3491 { 3492 3493 unlink_table((struct ip_fw_chain *)arg, (struct table_config *)no); 3494 if (ipfw_objhash_free_idx(ni, no->kidx) != 0) 3495 printf("Error unlinking kidx %d from table %s\n", 3496 no->kidx, no->name); 3497 free_table_config(ni, (struct table_config *)no); 3498 } 3499 3500 /* 3501 * Shuts tables module down. 3502 */ 3503 void 3504 ipfw_destroy_tables(struct ip_fw_chain *ch, int last) 3505 { 3506 3507 IPFW_DEL_SOPT_HANDLER(last, scodes); 3508 IPFW_DEL_OBJ_REWRITER(last, opcodes); 3509 3510 /* Remove all tables from working set */ 3511 IPFW_UH_WLOCK(ch); 3512 IPFW_WLOCK(ch); 3513 ipfw_objhash_foreach(CHAIN_TO_NI(ch), destroy_table_locked, ch); 3514 IPFW_WUNLOCK(ch); 3515 IPFW_UH_WUNLOCK(ch); 3516 3517 /* Free pointers itself */ 3518 free(ch->tablestate, M_IPFW); 3519 3520 ipfw_table_value_destroy(ch, last); 3521 ipfw_table_algo_destroy(ch); 3522 3523 ipfw_objhash_destroy(CHAIN_TO_NI(ch)); 3524 free(CHAIN_TO_TCFG(ch), M_IPFW); 3525 } 3526 3527 /* 3528 * Starts tables module. 3529 */ 3530 int 3531 ipfw_init_tables(struct ip_fw_chain *ch, int first) 3532 { 3533 struct tables_config *tcfg; 3534 3535 /* Allocate pointers */ 3536 ch->tablestate = malloc(V_fw_tables_max * sizeof(struct table_info), 3537 M_IPFW, M_WAITOK | M_ZERO); 3538 3539 tcfg = malloc(sizeof(struct tables_config), M_IPFW, M_WAITOK | M_ZERO); 3540 tcfg->namehash = ipfw_objhash_create(V_fw_tables_max); 3541 ch->tblcfg = tcfg; 3542 3543 ipfw_table_value_init(ch, first); 3544 ipfw_table_algo_init(ch); 3545 3546 IPFW_ADD_OBJ_REWRITER(first, opcodes); 3547 IPFW_ADD_SOPT_HANDLER(first, scodes); 3548 return (0); 3549 } 3550 3551 3552 3553