netpfil/ipfw/ip_fw_table.c

97 static struct table_config *alloc_table_config(struct ip_fw_chain *ch,
101 static int create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti,
103 static void link_table(struct ip_fw_chain *ch, struct table_config *tc);
104 static void unlink_table(struct ip_fw_chain *ch, struct table_config *tc);
105 static int find_ref_table(struct ip_fw_chain *ch, struct tid_info *ti,
109 static int export_tables(struct ip_fw_chain *ch, ipfw_obj_lheader *olh,
111 static void export_table_info(struct ip_fw_chain *ch, struct table_config *tc,
116 static int swap_tables(struct ip_fw_chain *ch, struct tid_info *a,
120 static int check_table_space(struct ip_fw_chain *ch, struct tableop_state *ts,
122 static int destroy_table(struct ip_fw_chain *ch, struct tid_info *ti);
131 #define	KIDX_TO_TI(ch, k)	(&(((struct table_info *)(ch)->tablestate)[k]))
136 rollback_toperation_state(struct ip_fw_chain *ch, void *object)
141 	tcfg = CHAIN_TO_TCFG(ch);
147 add_toperation_state(struct ip_fw_chain *ch, struct tableop_state *ts)
151 	tcfg = CHAIN_TO_TCFG(ch);
156 del_toperation_state(struct ip_fw_chain *ch, struct tableop_state *ts)
160 	tcfg = CHAIN_TO_TCFG(ch);
179 get_table_value(struct ip_fw_chain *ch, struct table_config *tc, uint32_t kidx)
183 	pval = (struct table_value *)ch->valuestate;
261 create_table_compat(struct ip_fw_chain *ch, struct tid_info *ti,
271 	error = create_table_internal(ch, ti, NULL, &xi, pkidx, 1);
288 find_ref_table(struct ip_fw_chain *ch, struct tid_info *ti,
297 	IPFW_UH_WLOCK_ASSERT(ch);
299 	ni = CHAIN_TO_NI(ch);
327 	IPFW_UH_WUNLOCK(ch);
328 	error = create_table_compat(ch, ti, &kidx);
329 	IPFW_UH_WLOCK(ch);
350 rollback_added_entries(struct ip_fw_chain *ch, struct table_config *tc,
361 	IPFW_UH_WLOCK_ASSERT(ch);
382 		error = ta->prepare_del(ch, ptei, vv);
398 prepare_batch_buffer(struct ip_fw_chain *ch, struct table_algo *ta,
431 		    ta->prepare_add(ch, ptei, v) : ta->prepare_del(ch, ptei, v);
451 flush_batch_buffer(struct ip_fw_chain *ch, struct table_algo *ta,
466 		ta->flush_entry(ch, ptei, v);
477 			ta->flush_entry(ch, &tei[i], v);
488 	struct ip_fw_chain *ch;
493 	if (ts->tc != object && ts->ch != object)
496 	ch = ts->ch;
498 	IPFW_UH_WLOCK_ASSERT(ch);
548 add_table_entry(struct ip_fw_chain *ch, struct tid_info *ti,
563 	IPFW_UH_WLOCK(ch);
570 		IPFW_UH_WUNLOCK(ch);
571 		flush_batch_buffer(ch, ta, tei, count, rollback,
575 		IPFW_UH_WLOCK(ch);
578 	error = find_ref_table(ch, ti, tei, count, OP_ADD, &tc);
580 		IPFW_UH_WUNLOCK(ch);
586 	ts.ch = ch;
595 	add_toperation_state(ch, &ts);
596 	IPFW_UH_WUNLOCK(ch);
601 	error = prepare_batch_buffer(ch, ta, tei, count, OP_ADD, &ta_buf_m);
603 	IPFW_UH_WLOCK(ch);
604 	del_toperation_state(ch, &ts);
625 	error = ipfw_link_table_values(ch, &ts);
636 	error = check_table_space(ch, &ts, tc, KIDX_TO_TI(ch, kidx), count);
648 	IPFW_WLOCK(ch);
656 			error = ta->add(tc->astate, KIDX_TO_TI(ch, kidx),
679 		rollback_added_entries(ch, tc, KIDX_TO_TI(ch, kidx),
686 	IPFW_WUNLOCK(ch);
688 	ipfw_garbage_table_values(ch, tc, tei, count, rollback);
692 		check_table_space(ch, NULL, tc, KIDX_TO_TI(ch, kidx), 0);
698 	IPFW_UH_WUNLOCK(ch);
700 	flush_batch_buffer(ch, ta, tei, count, rollback, ta_buf_m, ta_buf);
711 del_table_entry(struct ip_fw_chain *ch, struct tid_info *ti,
726 	IPFW_UH_WLOCK(ch);
727 	error = find_ref_table(ch, ti, tei, count, OP_DEL, &tc);
729 		IPFW_UH_WUNLOCK(ch);
733 	IPFW_UH_WUNLOCK(ch);
738 	error = prepare_batch_buffer(ch, ta, tei, count, OP_DEL, &ta_buf_m);
742 	IPFW_UH_WLOCK(ch);
752 		IPFW_UH_WUNLOCK(ch);
761 	IPFW_WLOCK(ch);
766 		error = ta->del(tc->astate, KIDX_TO_TI(ch, kidx), ptei, v,
775 	IPFW_WUNLOCK(ch);
778 	ipfw_garbage_table_values(ch, tc, tei, count, 0);
782 		check_table_space(ch, NULL, tc, KIDX_TO_TI(ch, kidx), 0);
785 	IPFW_UH_WUNLOCK(ch);
791 	flush_batch_buffer(ch, ta, tei, count, 0, ta_buf_m, ta_buf);
811 check_table_space(struct ip_fw_chain *ch, struct tableop_state *ts,
819 	IPFW_UH_WLOCK_ASSERT(ch);
843 			add_toperation_state(ch, ts);
844 		IPFW_UH_WUNLOCK(ch);
849 		IPFW_UH_WLOCK(ch);
851 			del_toperation_state(ch, ts);
868 		ti = KIDX_TO_TI(ch, tc->no.kidx);
870 			IPFW_UH_WUNLOCK(ch);
883 			IPFW_WLOCK(ch);
885 			IPFW_WUNLOCK(ch);
904 manage_table_ent_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
945 	    add_table_entry(ch, &ti, &tei, 0, 1) :
946 	    del_table_entry(ch, &ti, &tei, 0, 1);
961 manage_table_ent_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1043 	    add_table_entry(ch, &ti, tei_buf, ctlv->flags, ctlv->count) :
1044 	    del_table_entry(ch, &ti, tei_buf, ctlv->flags, ctlv->count);
1082 find_table_entry(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1112 	IPFW_UH_RLOCK(ch);
1113 	ni = CHAIN_TO_NI(ch);
1120 		IPFW_UH_RUNLOCK(ch);
1126 		IPFW_UH_RUNLOCK(ch);
1130 	kti = KIDX_TO_TI(ch, tc->no.kidx);
1138 		pval = get_table_value(ch, tc, tent->v.kidx);
1141 	IPFW_UH_RUNLOCK(ch);
1154 flush_table_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1168 		error = destroy_table(ch, &ti);
1170 		error = flush_table(ch, &ti);
1201 flush_table(struct ip_fw_chain *ch, struct tid_info *ti)
1218 	IPFW_UH_WLOCK(ch);
1219 	ni = CHAIN_TO_NI(ch);
1221 		IPFW_UH_WUNLOCK(ch);
1236 		IPFW_UH_WUNLOCK(ch);
1241 		ta->print_config(tc->astate, KIDX_TO_TI(ch, tc->no.kidx),
1248 	add_toperation_state(ch, &ts);
1249 	IPFW_UH_WUNLOCK(ch);
1263 	error = ta->init(ch, &astate_new, &ti_new, pstate, tflags);
1269 	IPFW_UH_WLOCK(ch);
1271 	del_toperation_state(ch, &ts);
1274 		IPFW_UH_WUNLOCK(ch);
1290 	ni = CHAIN_TO_NI(ch);
1292 	tablestate = (struct table_info *)ch->tablestate;
1294 	IPFW_WLOCK(ch);
1297 	IPFW_WUNLOCK(ch);
1311 	ipfw_unref_table_values(ch, tc, ta, astate_old, &ti_old);
1312 	IPFW_UH_WUNLOCK(ch);
1330 swap_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1344 	error = swap_tables(ch, &ti_a, &ti_b);
1361  *   runtime data @ti (ch->tablestate)
1379 swap_tables(struct ip_fw_chain *ch, struct tid_info *a,
1393 	IPFW_UH_WLOCK(ch);
1394 	ni = CHAIN_TO_NI(ch);
1396 		IPFW_UH_WUNLOCK(ch);
1400 		IPFW_UH_WUNLOCK(ch);
1406 		IPFW_UH_WUNLOCK(ch);
1412 		IPFW_UH_WUNLOCK(ch);
1419 		IPFW_UH_WUNLOCK(ch);
1425 		IPFW_UH_WUNLOCK(ch);
1430 	rollback_toperation_state(ch, tc_a);
1431 	rollback_toperation_state(ch, tc_b);
1434 	tablestate = (struct table_info *)ch->tablestate;
1440 	IPFW_WLOCK(ch);
1451 	IPFW_WUNLOCK(ch);
1463 	IPFW_UH_WUNLOCK(ch);
1476 destroy_table(struct ip_fw_chain *ch, struct tid_info *ti)
1481 	IPFW_UH_WLOCK(ch);
1483 	ni = CHAIN_TO_NI(ch);
1485 		IPFW_UH_WUNLOCK(ch);
1491 		IPFW_UH_WUNLOCK(ch);
1495 	IPFW_WLOCK(ch);
1496 	unlink_table(ch, tc);
1497 	IPFW_WUNLOCK(ch);
1505 	ipfw_unref_table_values(ch, tc, tc->ta, tc->astate, &tc->ti_copy);
1506 	IPFW_UH_WUNLOCK(ch);
1534 ipfw_resize_tables(struct ip_fw_chain *ch, unsigned int ntables)
1557 	IPFW_UH_WLOCK(ch);
1560 	ni = CHAIN_TO_NI(ch);
1568 		IPFW_UH_WUNLOCK(ch);
1573 	memcpy(tablestate, ch->tablestate, sizeof(struct table_info) * tbl);
1576 	IPFW_WLOCK(ch);
1579 	old_tablestate = ch->tablestate;
1580 	ch->tablestate = tablestate;
1586 	IPFW_WUNLOCK(ch);
1589 	ti = (struct table_info *)ch->tablestate;
1600 	IPFW_UH_WUNLOCK(ch);
1613 ipfw_objhash_lookup_table_kidx(struct ip_fw_chain *ch, uint16_t kidx)
1616 	return (ipfw_objhash_lookup_kidx(CHAIN_TO_NI(ch), kidx));
1624 ipfw_ref_table(struct ip_fw_chain *ch, ipfw_obj_ntlv *ntlv, uint16_t *kidx)
1630 	IPFW_UH_WLOCK_ASSERT(ch);
1633 	error = find_table_err(CHAIN_TO_NI(ch), &ti, &tc);
1647 ipfw_unref_table(struct ip_fw_chain *ch, uint16_t kidx)
1653 	IPFW_UH_WLOCK_ASSERT(ch);
1654 	ni = CHAIN_TO_NI(ch);
1667 ipfw_lookup_table(struct ip_fw_chain *ch, uint16_t tbl, uint16_t plen,
1672 	ti = KIDX_TO_TI(ch, tbl);
1695 list_tables(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1707 	IPFW_UH_RLOCK(ch);
1708 	error = export_tables(ch, olh, sd);
1709 	IPFW_UH_RUNLOCK(ch);
1723 describe_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1738 	IPFW_UH_RLOCK(ch);
1739 	if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) {
1740 		IPFW_UH_RUNLOCK(ch);
1744 	export_table_info(ch, tc, (ipfw_xtable_info *)(oh + 1));
1745 	IPFW_UH_RUNLOCK(ch);
1758 modify_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1785 	IPFW_UH_WLOCK(ch);
1786 	ni = CHAIN_TO_NI(ch);
1788 		IPFW_UH_WUNLOCK(ch);
1794 		IPFW_UH_WUNLOCK(ch);
1802 	IPFW_UH_WUNLOCK(ch);
1815 create_table(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
1848 	ni = CHAIN_TO_NI(ch);
1850 	IPFW_UH_RLOCK(ch);
1852 		IPFW_UH_RUNLOCK(ch);
1855 	IPFW_UH_RUNLOCK(ch);
1857 	return (create_table_internal(ch, &ti, aname, i, NULL, 0));
1870 create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti,
1878 	ni = CHAIN_TO_NI(ch);
1880 	ta = find_table_algo(CHAIN_TO_TCFG(ch), ti, aname);
1884 	tc = alloc_table_config(ch, ti, ta, aname, i->tflags);
1895 	IPFW_UH_WLOCK(ch);
1907 			IPFW_UH_WUNLOCK(ch);
1919 			IPFW_UH_WUNLOCK(ch);
1928 		link_table(ch, tc);
1936 	IPFW_UH_WUNLOCK(ch);
1963 ipfw_get_table_objhash(struct ip_fw_chain *ch)
1966 	return (CHAIN_TO_NI(ch));
1977 ipfw_export_table_ntlv(struct ip_fw_chain *ch, uint16_t kidx,
1984 	ni = CHAIN_TO_NI(ch);
2002 	struct ip_fw_chain *ch;
2035 table_get_count(struct ip_fw_chain *ch, struct table_config *tc)
2041 	ti = KIDX_TO_TI(ch, tc->no.kidx);
2063 export_table_info(struct ip_fw_chain *ch, struct table_config *tc,
2075 	i->count = table_get_count(ch, tc);
2081 	ti = KIDX_TO_TI(ch, tc->no.kidx);
2097 	struct ip_fw_chain *ch;
2113 	export_table_info(dta->ch, (struct table_config *)no, i);
2126 export_tables(struct ip_fw_chain *ch, ipfw_obj_lheader *olh,
2133 	count = ipfw_objhash_count(CHAIN_TO_NI(ch));
2147 	dta.ch = ch;
2150 	ipfw_objhash_foreach(CHAIN_TO_NI(ch), export_table_internal, &dta);
2164 dump_table_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
2183 	IPFW_UH_RLOCK(ch);
2184 	if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) {
2185 		IPFW_UH_RUNLOCK(ch);
2188 	export_table_info(ch, tc, i);
2198 		IPFW_UH_RUNLOCK(ch);
2206 	da.ch = ch;
2207 	da.ti = KIDX_TO_TI(ch, tc->no.kidx);
2214 	IPFW_UH_RUNLOCK(ch);
2228 dump_table_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
2245 	IPFW_UH_RLOCK(ch);
2246 	if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) {
2247 		IPFW_UH_RUNLOCK(ch);
2250 	count = table_get_count(ch, tc);
2266 		IPFW_UH_RUNLOCK(ch);
2272 	da.ch = ch;
2273 	da.ti = KIDX_TO_TI(ch, tc->no.kidx);
2280 	IPFW_UH_RUNLOCK(ch);
2289 get_table_size(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
2305 	IPFW_UH_RLOCK(ch);
2306 	error = ipfw_count_xtable(ch, &ti, tbl);
2307 	IPFW_UH_RUNLOCK(ch);
2315 ipfw_count_table(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt)
2319 	if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL)
2321 	*cnt = table_get_count(ch, tc);
2329 ipfw_count_xtable(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt)
2334 	if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) {
2339 	count = table_get_count(ch, tc);
2374 	pval = get_table_value(da->ch, da->tc, da->tent.v.kidx);
2384 ipfw_dump_table_legacy(struct ip_fw_chain *ch, struct tid_info *ti,
2393 	if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL)
2403 	da.ch = ch;
2404 	da.ti = KIDX_TO_TI(ch, tc->no.kidx);
2447 	pval = get_table_value(da->ch, da->tc, tent->v.kidx);
2487 	pval = get_table_value(da->ch, da->tc, da->tent.v.kidx);
2531 ipfw_foreach_table_tentry(struct ip_fw_chain *ch, uint16_t kidx,
2539 	ni = CHAIN_TO_NI(ch);
2548 	da.ch = ch;
2549 	da.ti = KIDX_TO_TI(ch, tc->no.kidx);
2623 ipfw_add_table_algo(struct ip_fw_chain *ch, struct table_algo *ta, size_t size,
2644 	tcfg = CHAIN_TO_TCFG(ch);
2667 ipfw_del_table_algo(struct ip_fw_chain *ch, int idx)
2672 	tcfg = CHAIN_TO_TCFG(ch);
2695 list_table_algo(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
2710 	IPFW_UH_RLOCK(ch);
2711 	tcfg = CHAIN_TO_TCFG(ch);
2721 		IPFW_UH_RUNLOCK(ch);
2735 	IPFW_UH_RUNLOCK(ch);
2826 table_findbyname(struct ip_fw_chain *ch, struct tid_info *ti,
2832 	IPFW_UH_WLOCK_ASSERT(ch);
2834 	error = find_table_err(CHAIN_TO_NI(ch), ti, &tc);
2844 table_findbykidx(struct ip_fw_chain *ch, uint16_t idx)
2849 	IPFW_UH_WLOCK_ASSERT(ch);
2850 	ni = CHAIN_TO_NI(ch);
2858 table_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set,
2891 	return (ipfw_obj_manage_sets(CHAIN_TO_NI(ch), IPFW_TLV_TBL_NAME,
2903 table_manage_sets_all(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set,
2921 		return (table_manage_sets(ch, set, new_set, cmd));
2924 	return (ipfw_obj_manage_sets(CHAIN_TO_NI(ch), IPFW_TLV_TBL_NAME,
3010 ipfw_switch_tables_namespace(struct ip_fw_chain *ch, unsigned int sets)
3021 	IPFW_UH_WLOCK(ch);
3024 		IPFW_UH_WUNLOCK(ch);
3027 	ni = CHAIN_TO_NI(ch);
3035 			IPFW_UH_WUNLOCK(ch);
3042 	for (i = 0; i < ch->n_rules; i++) {
3043 		rule = ch->map[i];
3063 				IPFW_UH_WUNLOCK(ch);
3070 	IPFW_UH_WUNLOCK(ch);
3157 alloc_table_config(struct ip_fw_chain *ch, struct tid_info *ti,
3191 	error = ta->init(ch, &tc->astate, &tc->ti_copy, aname, tflags);
3223 link_table(struct ip_fw_chain *ch, struct table_config *tc)
3229 	IPFW_UH_WLOCK_ASSERT(ch);
3231 	ni = CHAIN_TO_NI(ch);
3236 	ti = KIDX_TO_TI(ch, kidx);
3252 unlink_table(struct ip_fw_chain *ch, struct table_config *tc)
3258 	IPFW_UH_WLOCK_ASSERT(ch);
3259 	IPFW_WLOCK_ASSERT(ch);
3261 	ni = CHAIN_TO_NI(ch);
3266 	ti = KIDX_TO_TI(ch, kidx);
3312 ipfw_destroy_tables(struct ip_fw_chain *ch, int last)
3319 	IPFW_UH_WLOCK(ch);
3320 	IPFW_WLOCK(ch);
3321 	ipfw_objhash_foreach(CHAIN_TO_NI(ch), destroy_table_locked, ch);
3322 	IPFW_WUNLOCK(ch);
3323 	IPFW_UH_WUNLOCK(ch);
3326 	free(ch->tablestate, M_IPFW);
3328 	ipfw_table_value_destroy(ch, last);
3329 	ipfw_table_algo_destroy(ch);
3331 	ipfw_objhash_destroy(CHAIN_TO_NI(ch));
3332 	free(CHAIN_TO_TCFG(ch), M_IPFW);
3339 ipfw_init_tables(struct ip_fw_chain *ch, int first)
3344 	ch->tablestate = malloc(V_fw_tables_max * sizeof(struct table_info),
3349 	ch->tblcfg = tcfg;
3351 	ipfw_table_value_init(ch, first);
3352 	ipfw_table_algo_init(ch);