ip_fw_table_value.c revision 270968
1/*- 2 * Copyright (c) 2004 Ruslan Ermilov and Vsevolod Lobko. 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions 6 * are met: 7 * 1. Redistributions of source code must retain the above copyright 8 * notice, this list of conditions and the following disclaimer. 9 * 2. Redistributions in binary form must reproduce the above copyright 10 * notice, this list of conditions and the following disclaimer in the 11 * documentation and/or other materials provided with the distribution. 12 * 13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 14 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 15 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 16 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 17 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 18 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 19 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 20 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 21 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 22 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 23 * SUCH DAMAGE. 24 */ 25 26#include <sys/cdefs.h> 27__FBSDID("$FreeBSD: projects/ipfw/sys/netpfil/ipfw/ip_fw_table.c 270407 2014-08-23 12:41:39Z melifaro $"); 28 29/* 30 * Multi-field value support for ipfw tables. 31 * 32 * This file contains necessary functions to convert 33 * large multi-field values into u32 indices suitable to be fed 34 * to various table algorithms. Other machinery like proper refcounting, 35 * internal structures resizing are also kept here. 36 */ 37 38#include "opt_ipfw.h" 39 40#include <sys/param.h> 41#include <sys/systm.h> 42#include <sys/malloc.h> 43#include <sys/kernel.h> 44#include <sys/hash.h> 45#include <sys/lock.h> 46#include <sys/rwlock.h> 47#include <sys/socket.h> 48#include <sys/socketvar.h> 49#include <sys/queue.h> 50#include <net/if.h> /* ip_fw.h requires IFNAMSIZ */ 51 52#include <netinet/in.h> 53#include <netinet/ip_var.h> /* struct ipfw_rule_ref */ 54#include <netinet/ip_fw.h> 55 56#include <netpfil/ipfw/ip_fw_private.h> 57#include <netpfil/ipfw/ip_fw_table.h> 58 59static uint32_t hash_table_value(struct namedobj_instance *ni, void *key, 60 uint32_t kopt); 61static int cmp_table_value(struct named_object *no, void *key, uint32_t kopt); 62 63#define CHAIN_TO_VI(chain) (CHAIN_TO_TCFG(chain)->valhash) 64 65struct table_val_link 66{ 67 struct named_object no; 68 struct table_value *pval; /* Pointer to real table value */ 69}; 70#define VALDATA_START_SIZE 64 /* Allocate 64-items array by default */ 71 72struct vdump_args { 73 struct ip_fw_chain *ch; 74 struct sockopt_data *sd; 75 struct table_value *pval; 76 int error; 77}; 78 79 80void 81ipfw_table_value_init(struct ip_fw_chain *ch) 82{ 83 struct tables_config *tcfg; 84 85 ch->valuestate = malloc(VALDATA_START_SIZE * sizeof(struct table_value), 86 M_IPFW, M_WAITOK | M_ZERO); 87 88 tcfg = ch->tblcfg; 89 90 tcfg->val_size = VALDATA_START_SIZE; 91 tcfg->valhash = ipfw_objhash_create(tcfg->val_size); 92 ipfw_objhash_set_funcs(tcfg->valhash, hash_table_value, 93 cmp_table_value); 94} 95 96static void 97destroy_value(struct namedobj_instance *ni, struct named_object *no, 98 void *arg) 99{ 100 101 free(no, M_IPFW); 102} 103 104void 105ipfw_table_value_destroy(struct ip_fw_chain *ch) 106{ 107 108 free(ch->valuestate, M_IPFW); 109 ipfw_objhash_foreach(CHAIN_TO_VI(ch), destroy_value, ch); 110 ipfw_objhash_destroy(CHAIN_TO_VI(ch)); 111} 112 113static uint32_t 114hash_table_value(struct namedobj_instance *ni, void *key, uint32_t kopt) 115{ 116 117 return (hash32_buf(key, 56, 0)); 118} 119 120static int 121cmp_table_value(struct named_object *no, void *key, uint32_t kopt) 122{ 123 124 return (memcmp(((struct table_val_link *)no)->pval, key, 56)); 125} 126 127static void 128mask_table_value(struct table_value *src, struct table_value *dst, 129 uint32_t mask) 130{ 131#define _MCPY(f, b) if ((mask & (b)) != 0) { dst->f = src->f; } 132 133 memset(dst, 0, sizeof(*dst)); 134 _MCPY(tag, IPFW_VTYPE_TAG); 135 _MCPY(pipe, IPFW_VTYPE_PIPE); 136 _MCPY(divert, IPFW_VTYPE_DIVERT); 137 _MCPY(skipto, IPFW_VTYPE_SKIPTO); 138 _MCPY(netgraph, IPFW_VTYPE_NETGRAPH); 139 _MCPY(fib, IPFW_VTYPE_FIB); 140 _MCPY(nat, IPFW_VTYPE_NAT); 141 _MCPY(dscp, IPFW_VTYPE_DSCP); 142 _MCPY(nh4, IPFW_VTYPE_NH4); 143 _MCPY(nh6, IPFW_VTYPE_NH6); 144#undef _MCPY 145} 146 147static void 148get_value_ptrs(struct ip_fw_chain *ch, struct table_config *tc, int vshared, 149 struct table_value **ptv, struct namedobj_instance **pvi) 150{ 151 struct table_value *pval; 152 struct namedobj_instance *vi; 153 154 if (vshared != 0) { 155 pval = (struct table_value *)ch->valuestate; 156 vi = CHAIN_TO_VI(ch); 157 } else { 158 pval = NULL; 159 vi = NULL; 160 //pval = (struct table_value *)&tc->ti.data; 161 } 162 163 if (ptv != NULL) 164 *ptv = pval; 165 if (pvi != NULL) 166 *pvi = vi; 167} 168 169/* 170 * Update pointers to real vaues after @pval change. 171 */ 172static void 173update_tvalue(struct namedobj_instance *ni, struct named_object *no, void *arg) 174{ 175 struct vdump_args *da; 176 struct table_val_link *ptv; 177 struct table_value *pval; 178 179 da = (struct vdump_args *)arg; 180 ptv = (struct table_val_link *)no; 181 182 pval = da->pval; 183 ptv->pval = &pval[ptv->no.kidx]; 184 185} 186 187/* 188 * Grows value storage shared among all tables. 189 * Drops/reacquires UH locks. 190 * Notifies other running adds on @ch shared storage resize. 191 * Note function does not guarantee that free space 192 * will be available after invocation, so one caller needs 193 * to roll cycle himself. 194 * 195 * Returns 0 if case of no errors. 196 */ 197static int 198resize_shared_value_storage(struct ip_fw_chain *ch) 199{ 200 struct tables_config *tcfg; 201 struct namedobj_instance *vi; 202 struct table_value *pval, *valuestate, *old_valuestate; 203 void *new_idx; 204 struct vdump_args da; 205 int new_blocks; 206 int val_size, val_size_old; 207 208 IPFW_UH_WLOCK_ASSERT(ch); 209 210 valuestate = NULL; 211 new_idx = NULL; 212 213 pval = (struct table_value *)ch->valuestate; 214 vi = CHAIN_TO_VI(ch); 215 tcfg = CHAIN_TO_TCFG(ch); 216 217 val_size = tcfg->val_size * 2; 218 219 if (val_size == (1 << 30)) 220 return (ENOSPC); 221 222 IPFW_UH_WUNLOCK(ch); 223 224 valuestate = malloc(sizeof(struct table_value) * val_size, M_IPFW, 225 M_WAITOK | M_ZERO); 226 ipfw_objhash_bitmap_alloc(val_size, (void *)&new_idx, 227 &new_blocks); 228 229 IPFW_UH_WLOCK(ch); 230 231 /* 232 * Check if we still need to resize 233 */ 234 if (tcfg->val_size >= val_size) 235 goto done; 236 237 /* Update pointers and notify everyone we're changing @ch */ 238 pval = (struct table_value *)ch->valuestate; 239 rollback_toperation_state(ch, ch); 240 241 /* Good. Let's merge */ 242 memcpy(valuestate, pval, sizeof(struct table_value) * tcfg->val_size); 243 ipfw_objhash_bitmap_merge(CHAIN_TO_VI(ch), &new_idx, &new_blocks); 244 245 IPFW_WLOCK(ch); 246 /* Change pointers */ 247 old_valuestate = ch->valuestate; 248 ch->valuestate = valuestate; 249 valuestate = old_valuestate; 250 ipfw_objhash_bitmap_swap(CHAIN_TO_VI(ch), &new_idx, &new_blocks); 251 252 val_size_old = tcfg->val_size; 253 tcfg->val_size = val_size; 254 val_size = val_size_old; 255 IPFW_WUNLOCK(ch); 256 /* Update pointers to reflect resize */ 257 memset(&da, 0, sizeof(da)); 258 da.pval = (struct table_value *)ch->valuestate; 259 ipfw_objhash_foreach(vi, update_tvalue, &da); 260 261done: 262 free(valuestate, M_IPFW); 263 ipfw_objhash_bitmap_free(new_idx, new_blocks); 264 265 return (0); 266} 267 268/* 269 * Drops reference for table value with index @kidx, stored in @pval and 270 * @vi. Frees value if it has no references. 271 */ 272static void 273unref_table_value(struct namedobj_instance *vi, struct table_value *pval, 274 uint32_t kidx) 275{ 276 struct table_val_link *ptvl; 277 278 if (pval[kidx].refcnt > 1) { 279 pval[kidx].refcnt--; 280 return; 281 } 282 283 /* Last reference, delete item */ 284 ptvl = (struct table_val_link *)ipfw_objhash_lookup_kidx(vi, kidx); 285 KASSERT(ptvl != NULL, ("lookup on value kidx %d failed", kidx)); 286 ipfw_objhash_del(vi, &ptvl->no); 287 ipfw_objhash_free_idx(vi, kidx); 288 free(ptvl, M_IPFW); 289} 290 291struct flush_args { 292 struct ip_fw_chain *ch; 293 struct table_algo *ta; 294 struct table_info *ti; 295 void *astate; 296 ipfw_obj_tentry tent; 297}; 298 299static int 300unref_table_value_cb(void *e, void *arg) 301{ 302 struct flush_args *fa; 303 struct ip_fw_chain *ch; 304 struct table_algo *ta; 305 ipfw_obj_tentry *tent; 306 int error; 307 308 fa = (struct flush_args *)arg; 309 310 ta = fa->ta; 311 memset(&fa->tent, 0, sizeof(fa->tent)); 312 tent = &fa->tent; 313 error = ta->dump_tentry(fa->astate, fa->ti, e, tent); 314 if (error != 0) 315 return (error); 316 317 ch = fa->ch; 318 319 unref_table_value(CHAIN_TO_VI(ch), 320 (struct table_value *)ch->valuestate, tent->v.kidx); 321 322 return (0); 323} 324 325/* 326 * Drop references for each value used in @tc. 327 */ 328void 329ipfw_unref_table_values(struct ip_fw_chain *ch, struct table_config *tc, 330 struct table_algo *ta, void *astate, struct table_info *ti) 331{ 332 struct flush_args fa; 333 334 memset(&fa, 0, sizeof(fa)); 335 fa.ch = ch; 336 fa.ta = ta; 337 fa.astate = astate; 338 fa.ti = ti; 339 340 ta->foreach(astate, ti, unref_table_value_cb, &fa); 341} 342 343/* 344 * Table operation state handler. 345 * Called when we are going to change something in @tc which 346 * may lead to inconsistencies in on-going table data addition. 347 * 348 * Here we rollback all already committed state (table values, currently) 349 * and set "modified" field to non-zero value to indicate 350 * that we need to restart original operation. 351 */ 352void 353rollback_table_values(struct tableop_state *ts) 354{ 355 struct ip_fw_chain *ch; 356 struct table_value *pval; 357 struct tentry_info *ptei; 358 struct namedobj_instance *vi; 359 int i; 360 361 ch = ts->ch; 362 363 IPFW_UH_WLOCK_ASSERT(ch); 364 365 /* Get current table value pointer */ 366 get_value_ptrs(ch, ts->tc, ts->vshared, &pval, &vi); 367 368 for (i = 0; i < ts->count; i++) { 369 ptei = &ts->tei[i]; 370 371 if (ptei->value == 0) 372 continue; 373 374 unref_table_value(vi, pval, ptei->value); 375 } 376} 377 378/* 379 * Allocate new value index in either shared or per-table array. 380 * Function may drop/reacquire UH lock. 381 * 382 * Returns 0 on success. 383 */ 384static int 385alloc_table_vidx(struct ip_fw_chain *ch, struct tableop_state *ts, 386 struct namedobj_instance *vi, uint16_t *pvidx) 387{ 388 int error, vlimit; 389 uint16_t vidx; 390 391 IPFW_UH_WLOCK_ASSERT(ch); 392 393 error = ipfw_objhash_alloc_idx(vi, &vidx); 394 if (error != 0) { 395 396 /* 397 * We need to resize array. This involves 398 * lock/unlock, so we need to check "modified" 399 * state. 400 */ 401 ts->opstate.func(ts->tc, &ts->opstate); 402 error = resize_shared_value_storage(ch); 403 return (error); /* ts->modified should be set, we will restart */ 404 } 405 406 vlimit = ts->ta->vlimit; 407 if (vlimit != 0 && vidx >= vlimit) { 408 409 /* 410 * Algorithm is not able to store given index. 411 * We have to rollback state, start using 412 * per-table value array or return error 413 * if we're already using it. 414 * 415 * TODO: do not rollback state if 416 * atomicity is not required. 417 */ 418 if (ts->vshared != 0) { 419 /* shared -> per-table */ 420 return (ENOSPC); /* TODO: proper error */ 421 } 422 423 /* per-table. Fail for now. */ 424 return (ENOSPC); /* TODO: proper error */ 425 } 426 427 *pvidx = vidx; 428 return (0); 429} 430 431/* 432 * Drops value reference for unused values (updates, deletes, partially 433 * successful adds or rollbacks). 434 */ 435void 436ipfw_garbage_table_values(struct ip_fw_chain *ch, struct table_config *tc, 437 struct tentry_info *tei, uint32_t count, int rollback) 438{ 439 int i; 440 struct tentry_info *ptei; 441 struct table_value *pval; 442 struct namedobj_instance *vi; 443 444 /* 445 * We have two slightly different ADD cases here: 446 * either (1) we are successful / partially successful, 447 * in that case we need 448 * * to ignore ADDED entries values 449 * * rollback every other values (either UPDATED since 450 * old value has been stored there, or some failure like 451 * EXISTS or LIMIT or simply "ignored" case. 452 * 453 * (2): atomic rollback of partially successful operation 454 * in that case we simply need to unref all entries. 455 * 456 * DELETE case is simpler: no atomic support there, so 457 * we simply unref all non-zero values. 458 */ 459 460 /* 461 * Get current table value pointers. 462 * XXX: Properly read vshared 463 */ 464 get_value_ptrs(ch, tc, 1, &pval, &vi); 465 466 for (i = 0; i < count; i++) { 467 ptei = &tei[i]; 468 469 if (ptei->value == 0) { 470 471 /* 472 * We may be deleting non-existing record. 473 * Skip. 474 */ 475 continue; 476 } 477 478 if ((ptei->flags & TEI_FLAGS_ADDED) != 0 && rollback == 0) { 479 ptei->value = 0; 480 continue; 481 } 482 483 unref_table_value(vi, pval, ptei->value); 484 ptei->value = 0; 485 } 486} 487 488/* 489 * Main function used to link values of entries going to be added, 490 * to the index. Since we may perform many UH locks drops/acquires, 491 * handle changes by checking tablestate "modified" field. 492 * 493 * Success: return 0. 494 */ 495int 496ipfw_link_table_values(struct ip_fw_chain *ch, struct tableop_state *ts) 497{ 498 int error, i, found; 499 struct namedobj_instance *vi; 500 struct table_config *tc; 501 struct tentry_info *tei, *ptei; 502 uint32_t count, vlimit; 503 uint16_t vidx; 504 struct table_val_link *ptv; 505 struct table_value tval, *pval; 506 507 /* 508 * Stage 1: reference all existing values and 509 * save their indices. 510 */ 511 IPFW_UH_WLOCK_ASSERT(ch); 512 get_value_ptrs(ch, ts->tc, ts->vshared, &pval, &vi); 513 514 error = 0; 515 found = 0; 516 vlimit = ts->ta->vlimit; 517 tc = ts->tc; 518 tei = ts->tei; 519 count = ts->count; 520 for (i = 0; i < count; i++) { 521 ptei = &tei[i]; 522 ptei->value = 0; /* Ensure value is always 0 in the beginnig */ 523 mask_table_value(ptei->pvalue, &tval, ts->vmask); 524 ptv = (struct table_val_link *)ipfw_objhash_lookup_name(vi, 0, 525 (char *)&tval); 526 if (ptv == NULL) 527 continue; 528 /* Deal with vlimit later */ 529 if (vlimit > 0 && vlimit <= ptv->no.kidx) 530 continue; 531 532 /* Value found. Bump refcount */ 533 ptv->pval->refcnt++; 534 found++; 535 ptei->value = ptv->no.kidx; 536 } 537 538 if (ts->count == found) { 539 /* We've found all values , no need ts create new ones */ 540 return (0); 541 } 542 543 /* 544 * we have added some state here, let's attach operation 545 * state ts the list ts be able ts rollback if necessary. 546 */ 547 add_toperation_state(ch, ts); 548 /* Ensure table won't disappear */ 549 tc_ref(tc); 550 IPFW_UH_WUNLOCK(ch); 551 552 /* 553 * Stage 2: allocate objects for non-existing values. 554 */ 555 for (i = 0; i < count; i++) { 556 ptei = &tei[i]; 557 if (ptei->value != 0) 558 continue; 559 if (ptei->ptv != NULL) 560 continue; 561 ptei->ptv = malloc(sizeof(struct table_val_link), M_IPFW, 562 M_WAITOK | M_ZERO); 563 } 564 565 /* 566 * Stage 3: allocate index numbers for new values 567 * and link them to index. 568 */ 569 IPFW_UH_WLOCK(ch); 570 tc_unref(tc); 571 del_toperation_state(ch, ts); 572 if (ts->modified != 0) 573 return (0); 574 575 KASSERT(pval == ch->tablestate, ("resize_storage() notify failure")); 576 577 /* Let's try to link values */ 578 for (i = 0; i < count; i++) { 579 ptei = &tei[i]; 580 if (ptei->value != 0) 581 continue; 582 583 /* Check if record has appeared */ 584 mask_table_value(ptei->pvalue, &tval, ts->vmask); 585 ptv = (struct table_val_link *)ipfw_objhash_lookup_name(vi, 0, 586 (char *)&tval); 587 if (ptv != NULL) { 588 ptei->value = ptv->no.kidx; 589 continue; 590 } 591 592 /* May perform UH unlock/lock */ 593 error = alloc_table_vidx(ch, ts, vi, &vidx); 594 if (error != 0) { 595 ts->opstate.func(ts->tc, &ts->opstate); 596 return (error); 597 } 598 /* value storage resize has happened, return */ 599 if (ts->modified != 0) 600 return (0); 601 602 /* Finally, we have allocated valid index, let's add entry */ 603 ptei->value = vidx; 604 ptv = (struct table_val_link *)ptei->ptv; 605 ptei->ptv = NULL; 606 607 ptv->no.kidx = vidx; 608 ptv->no.name = (char *)&pval[vidx]; 609 ptv->pval = &pval[vidx]; 610 memcpy(ptv->pval, &tval, sizeof(struct table_value)); 611 pval[vidx].refcnt = 1; 612 ipfw_objhash_add(vi, &ptv->no); 613 } 614 615 return (0); 616} 617 618/* 619 * Compability function used to import data from old 620 * IP_FW_TABLE_ADD / IP_FW_TABLE_XADD opcodes. 621 */ 622void 623ipfw_import_table_value_legacy(uint32_t value, struct table_value *v) 624{ 625 626 memset(v, 0, sizeof(*v)); 627 v->tag = value; 628 v->pipe = value; 629 v->divert = value; 630 v->skipto = value; 631 v->netgraph = value; 632 v->fib = value; 633 v->nat = value; 634 v->nh4 = value; /* host format */ 635 v->dscp = value; 636 v->limit = value; 637} 638 639/* 640 * Export data to legacy table dumps opcodes. 641 */ 642uint32_t 643ipfw_export_table_value_legacy(struct table_value *v) 644{ 645 646 /* 647 * TODO: provide more compatibility depending on 648 * vmask value. 649 */ 650 return (v->tag); 651} 652 653/* 654 * Imports table value from current userland format. 655 * Saves value in kernel format to the same place. 656 */ 657void 658ipfw_import_table_value_v1(ipfw_table_value *iv) 659{ 660 struct table_value v; 661 662 memset(&v, 0, sizeof(v)); 663 v.tag = iv->tag; 664 v.pipe = iv->pipe; 665 v.divert = iv->divert; 666 v.skipto = iv->skipto; 667 v.netgraph = iv->netgraph; 668 v.fib = iv->fib; 669 v.nat = iv->nat; 670 v.dscp = iv->dscp; 671 v.nh4 = iv->nh4; 672 v.nh6 = iv->nh6; 673 v.limit = iv->limit; 674 675 memcpy(iv, &v, sizeof(ipfw_table_value)); 676} 677 678/* 679 * Export real table value @v to current userland format. 680 * Note that @v and @piv may point to the same memory. 681 */ 682void 683ipfw_export_table_value_v1(struct table_value *v, ipfw_table_value *piv) 684{ 685 ipfw_table_value iv; 686 687 memset(&iv, 0, sizeof(iv)); 688 iv.tag = v->tag; 689 iv.pipe = v->pipe; 690 iv.divert = v->divert; 691 iv.skipto = v->skipto; 692 iv.netgraph = v->netgraph; 693 iv.fib = v->fib; 694 iv.nat = v->nat; 695 iv.dscp = v->dscp; 696 iv.limit = v->limit; 697 iv.nh4 = v->nh4; 698 iv.nh6 = v->nh6; 699 700 memcpy(piv, &iv, sizeof(iv)); 701} 702 703/* 704 * Exports real value data into ipfw_table_value structure. 705 * Utilizes "spare1" field to store kernel index. 706 */ 707static void 708dump_tvalue(struct namedobj_instance *ni, struct named_object *no, void *arg) 709{ 710 struct vdump_args *da; 711 struct table_val_link *ptv; 712 struct table_value *v; 713 714 da = (struct vdump_args *)arg; 715 ptv = (struct table_val_link *)no; 716 717 v = (struct table_value *)ipfw_get_sopt_space(da->sd, sizeof(*v)); 718 /* Out of memory, returning */ 719 if (v == NULL) { 720 da->error = ENOMEM; 721 return; 722 } 723 724 memcpy(v, ptv->pval, sizeof(*v)); 725 v->spare1 = ptv->no.kidx; 726} 727 728/* 729 * Dumps all shared/table value data 730 * Data layout (v1)(current): 731 * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size 732 * Reply: [ ipfw_obj_lheader ipfw_table_value x N ] 733 * 734 * Returns 0 on success 735 */ 736int 737ipfw_list_table_values(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 738 struct sockopt_data *sd) 739{ 740 struct _ipfw_obj_lheader *olh; 741 struct namedobj_instance *vi; 742 struct vdump_args da; 743 uint32_t count, size; 744 745 olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh)); 746 if (olh == NULL) 747 return (EINVAL); 748 if (sd->valsize < olh->size) 749 return (EINVAL); 750 751 IPFW_UH_RLOCK(ch); 752 vi = CHAIN_TO_VI(ch); 753 754 count = ipfw_objhash_count(vi); 755 size = count * sizeof(ipfw_table_value) + sizeof(ipfw_obj_lheader); 756 757 /* Fill in header regadless of buffer size */ 758 olh->count = count; 759 olh->objsize = sizeof(ipfw_table_value); 760 761 if (size > olh->size) { 762 olh->size = size; 763 IPFW_UH_RUNLOCK(ch); 764 return (ENOMEM); 765 } 766 olh->size = size; 767 768 /* 769 * Do the actual value dump 770 */ 771 memset(&da, 0, sizeof(da)); 772 da.ch = ch; 773 da.sd = sd; 774 ipfw_objhash_foreach(vi, dump_tvalue, &da); 775 776 IPFW_UH_RUNLOCK(ch); 777 778 return (0); 779} 780 781