netpfil/ipfw/ip_fw2.c

129 static int jump_fast(struct ip_fw_chain *chain, struct ip_fw *f, int num,
133 static int jump_linear(struct ip_fw_chain *chain, struct ip_fw *f, int num,
375 iface_match(struct ifnet *ifp, ipfw_insn_if *cmd, struct ip_fw_chain *chain,
385 			return ipfw_lookup_table_extended(chain, cmd->p.kidx, 0,
771 	struct ip_fw_chain *chain)
773 	args->rule.chain_id = chain->id;
775 	args->rule.rule_id = 1 + chain->map[slot]->id;
776 	args->rule.rulenum = chain->map[slot]->rulenum;
785 jump_fast(struct ip_fw_chain *chain, struct ip_fw *f, int num,
794 	if (num != IP_FW_TARG && f->cached_id == chain->id)
797 		int i = IP_FW_ARG_TABLEARG(chain, num, skipto);
801 		if (chain->idxmap != NULL)
802 			f_pos = chain->idxmap[i];
804 			f_pos = ipfw_find_rule(chain, i, 0);
807 			f->cached_id = chain->id;
819 jump_linear(struct ip_fw_chain *chain, struct ip_fw *f, int num,
824 	num = IP_FW_ARG_TABLEARG(chain, num, skipto);
828 	f_pos = chain->idxmap[num];
834 #define	TARG(k, f)	IP_FW_ARG_TABLEARG(chain, k, f)
975 	struct ip_fw_chain *chain = &V_layer3_chain;
1260 	IPFW_PF_RLOCK(chain);
1262 		IPFW_PF_RUNLOCK(chain);
1273 		f_pos = (args->rule.chain_id == chain->id) ?
1275 		    ipfw_find_rule(chain, args->rule.rulenum,
1299 	for (; f_pos < chain->n_rules; f_pos++) {
1305 		f = chain->map[f_pos];
1377 				    (ipfw_insn_if *)cmd, chain, &tablearg);
1382 				    chain, &tablearg);
1388 				    chain, &tablearg);
1508 				    match = ipfw_lookup_table(chain,
1521 					match = ipfw_lookup_table_extended(chain,
1535 					match = ipfw_lookup_table_extended(chain,
1827 				ipfw_log(chain, f, hlen, args, m,
2101 				if (ipfw_install_state(chain, f,
2140 					f_pos = ipfw_find_rule(chain,
2167 				set_match(args, f_pos, chain);
2187 				set_match(args, f_pos, chain);
2198 			    f_pos = JUMP(chain, f, cmd->arg1, tablearg, 0);
2205 			    for (; f_pos < chain->n_rules - 1 &&
2207 				     (1 << chain->map[f_pos]->set));
2211 			    f = chain->map[f_pos];
2287 			    		f_pos = JUMP(chain, f, cmd->arg1,
2292 					f_pos = ipfw_find_rule(chain, jmpto, 0);
2301 				for (; f_pos < chain->n_rules - 1 &&
2303 				    (1 << chain->map[f_pos]->set)); f_pos++)
2306 				f = chain->map[f_pos];
2379 						    chain, tablearg, nh6);
2387 							    TARG_VAL(chain,
2398 						    TARG_VAL(chain, tablearg,
2429 				set_match(args, f_pos, chain);
2490 				set_match(args, f_pos, chain);
2499 					t = (*lookup_nat_ptr)(&chain->nat, nat_id);
2540 				    set_match(args, f_pos, chain);
2547 				retval = ipfw_run_eaction(chain, args,
2580 		struct ip_fw *rule = chain->map[f_pos];
2587 	IPFW_PF_RUNLOCK(chain);
2719 	struct ip_fw_chain *chain;
2721 	chain = &V_layer3_chain;
2735 	LIST_INIT(&chain->nat);
2739 	ipfw_init_srv(chain);
2744 	chain->n_rules = 1;
2745 	chain->map = malloc(sizeof(struct ip_fw *), M_IPFW, M_WAITOK | M_ZERO);
2746 	rule = ipfw_alloc_rule(chain, sizeof(struct ip_fw));
2750 	error = ipfw_init_tables(chain, first);
2753 		free(chain->map, M_IPFW);
2765 	chain->default_rule = chain->map[0] = rule;
2766 	chain->id = rule->id = 1;
2768 	chain->static_len = sizeof(struct ip_fw_rule0);
2770 	IPFW_LOCK_INIT(chain);
2771 	ipfw_dyn_init(chain);
2772 	ipfw_eaction_init(chain, first);
2774 	ipfw_init_skipto_cache(chain);
2806 	struct ip_fw_chain *chain = &V_layer3_chain;
2822 	IPFW_UH_WLOCK(chain);
2823 	IPFW_UH_WUNLOCK(chain);
2827 	IPFW_UH_WLOCK(chain);
2830 	IPFW_WLOCK(chain);
2831 	for (i = 0; i < chain->n_rules; i++)
2832 		ipfw_reap_add(chain, &reap, chain->map[i]);
2833 	free(chain->map, M_IPFW);
2835 	ipfw_destroy_skipto_cache(chain);
2837 	IPFW_WUNLOCK(chain);
2838 	IPFW_UH_WUNLOCK(chain);
2839 	ipfw_destroy_tables(chain, last);
2840 	ipfw_eaction_uninit(chain, last);
2843 	vnet_ipfw_iface_destroy(chain);
2844 	ipfw_destroy_srv(chain);
2845 	IPFW_LOCK_DESTROY(chain);