ip_fw_table_value.c revision 272714
1/*- 2 * Copyright (c) 2014 Yandex LLC 3 * Copyright (c) 2014 Alexander V. Chernikov 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24 * SUCH DAMAGE. 25 */ 26 27#include <sys/cdefs.h> 28__FBSDID("$FreeBSD: projects/ipfw/sys/netpfil/ipfw/ip_fw_table.c 270407 2014-08-23 12:41:39Z melifaro $"); 29 30/* 31 * Multi-field value support for ipfw tables. 32 * 33 * This file contains necessary functions to convert 34 * large multi-field values into u32 indices suitable to be fed 35 * to various table algorithms. Other machinery like proper refcounting, 36 * internal structures resizing are also kept here. 37 */ 38 39#include "opt_ipfw.h" 40 41#include <sys/param.h> 42#include <sys/systm.h> 43#include <sys/malloc.h> 44#include <sys/kernel.h> 45#include <sys/hash.h> 46#include <sys/lock.h> 47#include <sys/rwlock.h> 48#include <sys/rmlock.h> 49#include <sys/socket.h> 50#include <sys/socketvar.h> 51#include <sys/queue.h> 52#include <net/if.h> /* ip_fw.h requires IFNAMSIZ */ 53 54#include <netinet/in.h> 55#include <netinet/ip_var.h> /* struct ipfw_rule_ref */ 56#include <netinet/ip_fw.h> 57 58#include <netpfil/ipfw/ip_fw_private.h> 59#include <netpfil/ipfw/ip_fw_table.h> 60 61static uint32_t hash_table_value(struct namedobj_instance *ni, void *key, 62 uint32_t kopt); 63static int cmp_table_value(struct named_object *no, void *key, uint32_t kopt); 64 65static int list_table_values(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 66 struct sockopt_data *sd); 67 68static struct ipfw_sopt_handler scodes[] = { 69 { IP_FW_TABLE_VLIST, 0, HDIR_GET, list_table_values }, 70}; 71 72#define CHAIN_TO_VI(chain) (CHAIN_TO_TCFG(chain)->valhash) 73 74struct table_val_link 75{ 76 struct named_object no; 77 struct table_value *pval; /* Pointer to real table value */ 78}; 79#define VALDATA_START_SIZE 64 /* Allocate 64-items array by default */ 80 81struct vdump_args { 82 struct ip_fw_chain *ch; 83 struct sockopt_data *sd; 84 struct table_value *pval; 85 int error; 86}; 87 88 89static uint32_t 90hash_table_value(struct namedobj_instance *ni, void *key, uint32_t kopt) 91{ 92 93 return (hash32_buf(key, 56, 0)); 94} 95 96static int 97cmp_table_value(struct named_object *no, void *key, uint32_t kopt) 98{ 99 100 return (memcmp(((struct table_val_link *)no)->pval, key, 56)); 101} 102 103static void 104mask_table_value(struct table_value *src, struct table_value *dst, 105 uint32_t mask) 106{ 107#define _MCPY(f, b) if ((mask & (b)) != 0) { dst->f = src->f; } 108 109 memset(dst, 0, sizeof(*dst)); 110 _MCPY(tag, IPFW_VTYPE_TAG); 111 _MCPY(pipe, IPFW_VTYPE_PIPE); 112 _MCPY(divert, IPFW_VTYPE_DIVERT); 113 _MCPY(skipto, IPFW_VTYPE_SKIPTO); 114 _MCPY(netgraph, IPFW_VTYPE_NETGRAPH); 115 _MCPY(fib, IPFW_VTYPE_FIB); 116 _MCPY(nat, IPFW_VTYPE_NAT); 117 _MCPY(dscp, IPFW_VTYPE_DSCP); 118 _MCPY(nh4, IPFW_VTYPE_NH4); 119 _MCPY(nh6, IPFW_VTYPE_NH6); 120#undef _MCPY 121} 122 123static void 124get_value_ptrs(struct ip_fw_chain *ch, struct table_config *tc, int vshared, 125 struct table_value **ptv, struct namedobj_instance **pvi) 126{ 127 struct table_value *pval; 128 struct namedobj_instance *vi; 129 130 if (vshared != 0) { 131 pval = (struct table_value *)ch->valuestate; 132 vi = CHAIN_TO_VI(ch); 133 } else { 134 pval = NULL; 135 vi = NULL; 136 //pval = (struct table_value *)&tc->ti.data; 137 } 138 139 if (ptv != NULL) 140 *ptv = pval; 141 if (pvi != NULL) 142 *pvi = vi; 143} 144 145/* 146 * Update pointers to real vaues after @pval change. 147 */ 148static void 149update_tvalue(struct namedobj_instance *ni, struct named_object *no, void *arg) 150{ 151 struct vdump_args *da; 152 struct table_val_link *ptv; 153 struct table_value *pval; 154 155 da = (struct vdump_args *)arg; 156 ptv = (struct table_val_link *)no; 157 158 pval = da->pval; 159 ptv->pval = &pval[ptv->no.kidx]; 160 161} 162 163/* 164 * Grows value storage shared among all tables. 165 * Drops/reacquires UH locks. 166 * Notifies other running adds on @ch shared storage resize. 167 * Note function does not guarantee that free space 168 * will be available after invocation, so one caller needs 169 * to roll cycle himself. 170 * 171 * Returns 0 if case of no errors. 172 */ 173static int 174resize_shared_value_storage(struct ip_fw_chain *ch) 175{ 176 struct tables_config *tcfg; 177 struct namedobj_instance *vi; 178 struct table_value *pval, *valuestate, *old_valuestate; 179 void *new_idx; 180 struct vdump_args da; 181 int new_blocks; 182 int val_size, val_size_old; 183 184 IPFW_UH_WLOCK_ASSERT(ch); 185 186 valuestate = NULL; 187 new_idx = NULL; 188 189 pval = (struct table_value *)ch->valuestate; 190 vi = CHAIN_TO_VI(ch); 191 tcfg = CHAIN_TO_TCFG(ch); 192 193 val_size = tcfg->val_size * 2; 194 195 if (val_size == (1 << 30)) 196 return (ENOSPC); 197 198 IPFW_UH_WUNLOCK(ch); 199 200 valuestate = malloc(sizeof(struct table_value) * val_size, M_IPFW, 201 M_WAITOK | M_ZERO); 202 ipfw_objhash_bitmap_alloc(val_size, (void *)&new_idx, 203 &new_blocks); 204 205 IPFW_UH_WLOCK(ch); 206 207 /* 208 * Check if we still need to resize 209 */ 210 if (tcfg->val_size >= val_size) 211 goto done; 212 213 /* Update pointers and notify everyone we're changing @ch */ 214 pval = (struct table_value *)ch->valuestate; 215 rollback_toperation_state(ch, ch); 216 217 /* Good. Let's merge */ 218 memcpy(valuestate, pval, sizeof(struct table_value) * tcfg->val_size); 219 ipfw_objhash_bitmap_merge(CHAIN_TO_VI(ch), &new_idx, &new_blocks); 220 221 IPFW_WLOCK(ch); 222 /* Change pointers */ 223 old_valuestate = ch->valuestate; 224 ch->valuestate = valuestate; 225 valuestate = old_valuestate; 226 ipfw_objhash_bitmap_swap(CHAIN_TO_VI(ch), &new_idx, &new_blocks); 227 228 val_size_old = tcfg->val_size; 229 tcfg->val_size = val_size; 230 val_size = val_size_old; 231 IPFW_WUNLOCK(ch); 232 /* Update pointers to reflect resize */ 233 memset(&da, 0, sizeof(da)); 234 da.pval = (struct table_value *)ch->valuestate; 235 ipfw_objhash_foreach(vi, update_tvalue, &da); 236 237done: 238 free(valuestate, M_IPFW); 239 ipfw_objhash_bitmap_free(new_idx, new_blocks); 240 241 return (0); 242} 243 244/* 245 * Drops reference for table value with index @kidx, stored in @pval and 246 * @vi. Frees value if it has no references. 247 */ 248static void 249unref_table_value(struct namedobj_instance *vi, struct table_value *pval, 250 uint32_t kidx) 251{ 252 struct table_val_link *ptvl; 253 254 KASSERT(pval[kidx].refcnt > 0, ("Refcount is 0 on kidx %d", kidx)); 255 if (--pval[kidx].refcnt > 0) 256 return; 257 258 /* Last reference, delete item */ 259 ptvl = (struct table_val_link *)ipfw_objhash_lookup_kidx(vi, kidx); 260 KASSERT(ptvl != NULL, ("lookup on value kidx %d failed", kidx)); 261 ipfw_objhash_del(vi, &ptvl->no); 262 ipfw_objhash_free_idx(vi, kidx); 263 free(ptvl, M_IPFW); 264} 265 266struct flush_args { 267 struct ip_fw_chain *ch; 268 struct table_algo *ta; 269 struct table_info *ti; 270 void *astate; 271 ipfw_obj_tentry tent; 272}; 273 274static int 275unref_table_value_cb(void *e, void *arg) 276{ 277 struct flush_args *fa; 278 struct ip_fw_chain *ch; 279 struct table_algo *ta; 280 ipfw_obj_tentry *tent; 281 int error; 282 283 fa = (struct flush_args *)arg; 284 285 ta = fa->ta; 286 memset(&fa->tent, 0, sizeof(fa->tent)); 287 tent = &fa->tent; 288 error = ta->dump_tentry(fa->astate, fa->ti, e, tent); 289 if (error != 0) 290 return (error); 291 292 ch = fa->ch; 293 294 unref_table_value(CHAIN_TO_VI(ch), 295 (struct table_value *)ch->valuestate, tent->v.kidx); 296 297 return (0); 298} 299 300/* 301 * Drop references for each value used in @tc. 302 */ 303void 304ipfw_unref_table_values(struct ip_fw_chain *ch, struct table_config *tc, 305 struct table_algo *ta, void *astate, struct table_info *ti) 306{ 307 struct flush_args fa; 308 309 IPFW_UH_WLOCK_ASSERT(ch); 310 311 memset(&fa, 0, sizeof(fa)); 312 fa.ch = ch; 313 fa.ta = ta; 314 fa.astate = astate; 315 fa.ti = ti; 316 317 ta->foreach(astate, ti, unref_table_value_cb, &fa); 318} 319 320/* 321 * Table operation state handler. 322 * Called when we are going to change something in @tc which 323 * may lead to inconsistencies in on-going table data addition. 324 * 325 * Here we rollback all already committed state (table values, currently) 326 * and set "modified" field to non-zero value to indicate 327 * that we need to restart original operation. 328 */ 329void 330rollback_table_values(struct tableop_state *ts) 331{ 332 struct ip_fw_chain *ch; 333 struct table_value *pval; 334 struct tentry_info *ptei; 335 struct namedobj_instance *vi; 336 int i; 337 338 ch = ts->ch; 339 340 IPFW_UH_WLOCK_ASSERT(ch); 341 342 /* Get current table value pointer */ 343 get_value_ptrs(ch, ts->tc, ts->vshared, &pval, &vi); 344 345 for (i = 0; i < ts->count; i++) { 346 ptei = &ts->tei[i]; 347 348 if (ptei->value == 0) 349 continue; 350 351 unref_table_value(vi, pval, ptei->value); 352 } 353} 354 355/* 356 * Allocate new value index in either shared or per-table array. 357 * Function may drop/reacquire UH lock. 358 * 359 * Returns 0 on success. 360 */ 361static int 362alloc_table_vidx(struct ip_fw_chain *ch, struct tableop_state *ts, 363 struct namedobj_instance *vi, uint16_t *pvidx) 364{ 365 int error, vlimit; 366 uint16_t vidx; 367 368 IPFW_UH_WLOCK_ASSERT(ch); 369 370 error = ipfw_objhash_alloc_idx(vi, &vidx); 371 if (error != 0) { 372 373 /* 374 * We need to resize array. This involves 375 * lock/unlock, so we need to check "modified" 376 * state. 377 */ 378 ts->opstate.func(ts->tc, &ts->opstate); 379 error = resize_shared_value_storage(ch); 380 return (error); /* ts->modified should be set, we will restart */ 381 } 382 383 vlimit = ts->ta->vlimit; 384 if (vlimit != 0 && vidx >= vlimit) { 385 386 /* 387 * Algorithm is not able to store given index. 388 * We have to rollback state, start using 389 * per-table value array or return error 390 * if we're already using it. 391 * 392 * TODO: do not rollback state if 393 * atomicity is not required. 394 */ 395 if (ts->vshared != 0) { 396 /* shared -> per-table */ 397 return (ENOSPC); /* TODO: proper error */ 398 } 399 400 /* per-table. Fail for now. */ 401 return (ENOSPC); /* TODO: proper error */ 402 } 403 404 *pvidx = vidx; 405 return (0); 406} 407 408/* 409 * Drops value reference for unused values (updates, deletes, partially 410 * successful adds or rollbacks). 411 */ 412void 413ipfw_garbage_table_values(struct ip_fw_chain *ch, struct table_config *tc, 414 struct tentry_info *tei, uint32_t count, int rollback) 415{ 416 int i; 417 struct tentry_info *ptei; 418 struct table_value *pval; 419 struct namedobj_instance *vi; 420 421 /* 422 * We have two slightly different ADD cases here: 423 * either (1) we are successful / partially successful, 424 * in that case we need 425 * * to ignore ADDED entries values 426 * * rollback every other values (either UPDATED since 427 * old value has been stored there, or some failure like 428 * EXISTS or LIMIT or simply "ignored" case. 429 * 430 * (2): atomic rollback of partially successful operation 431 * in that case we simply need to unref all entries. 432 * 433 * DELETE case is simpler: no atomic support there, so 434 * we simply unref all non-zero values. 435 */ 436 437 /* 438 * Get current table value pointers. 439 * XXX: Properly read vshared 440 */ 441 get_value_ptrs(ch, tc, 1, &pval, &vi); 442 443 for (i = 0; i < count; i++) { 444 ptei = &tei[i]; 445 446 if (ptei->value == 0) { 447 448 /* 449 * We may be deleting non-existing record. 450 * Skip. 451 */ 452 continue; 453 } 454 455 if ((ptei->flags & TEI_FLAGS_ADDED) != 0 && rollback == 0) { 456 ptei->value = 0; 457 continue; 458 } 459 460 unref_table_value(vi, pval, ptei->value); 461 ptei->value = 0; 462 } 463} 464 465/* 466 * Main function used to link values of entries going to be added, 467 * to the index. Since we may perform many UH locks drops/acquires, 468 * handle changes by checking tablestate "modified" field. 469 * 470 * Success: return 0. 471 */ 472int 473ipfw_link_table_values(struct ip_fw_chain *ch, struct tableop_state *ts) 474{ 475 int error, i, found; 476 struct namedobj_instance *vi; 477 struct table_config *tc; 478 struct tentry_info *tei, *ptei; 479 uint32_t count, vlimit; 480 uint16_t vidx; 481 struct table_val_link *ptv; 482 struct table_value tval, *pval; 483 484 /* 485 * Stage 1: reference all existing values and 486 * save their indices. 487 */ 488 IPFW_UH_WLOCK_ASSERT(ch); 489 get_value_ptrs(ch, ts->tc, ts->vshared, &pval, &vi); 490 491 error = 0; 492 found = 0; 493 vlimit = ts->ta->vlimit; 494 vidx = 0; 495 tc = ts->tc; 496 tei = ts->tei; 497 count = ts->count; 498 for (i = 0; i < count; i++) { 499 ptei = &tei[i]; 500 ptei->value = 0; /* Ensure value is always 0 in the beginnig */ 501 mask_table_value(ptei->pvalue, &tval, ts->vmask); 502 ptv = (struct table_val_link *)ipfw_objhash_lookup_name(vi, 0, 503 (char *)&tval); 504 if (ptv == NULL) 505 continue; 506 /* Deal with vlimit later */ 507 if (vlimit > 0 && vlimit <= ptv->no.kidx) 508 continue; 509 510 /* Value found. Bump refcount */ 511 ptv->pval->refcnt++; 512 ptei->value = ptv->no.kidx; 513 found++; 514 } 515 516 if (ts->count == found) { 517 /* We've found all values , no need ts create new ones */ 518 return (0); 519 } 520 521 /* 522 * we have added some state here, let's attach operation 523 * state ts the list ts be able ts rollback if necessary. 524 */ 525 add_toperation_state(ch, ts); 526 /* Ensure table won't disappear */ 527 tc_ref(tc); 528 IPFW_UH_WUNLOCK(ch); 529 530 /* 531 * Stage 2: allocate objects for non-existing values. 532 */ 533 for (i = 0; i < count; i++) { 534 ptei = &tei[i]; 535 if (ptei->value != 0) 536 continue; 537 if (ptei->ptv != NULL) 538 continue; 539 ptei->ptv = malloc(sizeof(struct table_val_link), M_IPFW, 540 M_WAITOK | M_ZERO); 541 } 542 543 /* 544 * Stage 3: allocate index numbers for new values 545 * and link them to index. 546 */ 547 IPFW_UH_WLOCK(ch); 548 tc_unref(tc); 549 del_toperation_state(ch, ts); 550 if (ts->modified != 0) 551 return (0); 552 553 KASSERT(pval == ch->tablestate, ("resize_storage() notify failure")); 554 555 /* Let's try to link values */ 556 for (i = 0; i < count; i++) { 557 ptei = &tei[i]; 558 if (ptei->value != 0) { 559 560 /* 561 * We may be here after several process restarts, 562 * so we need to update all fields that might 563 * have changed. 564 */ 565 ptv = (struct table_val_link *)ptei->ptv; 566 ptv->pval = &pval[i]; 567 continue; 568 } 569 570 /* Check if record has appeared */ 571 mask_table_value(ptei->pvalue, &tval, ts->vmask); 572 ptv = (struct table_val_link *)ipfw_objhash_lookup_name(vi, 0, 573 (char *)&tval); 574 if (ptv != NULL) { 575 ptv->pval->refcnt++; 576 ptei->value = ptv->no.kidx; 577 continue; 578 } 579 580 /* May perform UH unlock/lock */ 581 error = alloc_table_vidx(ch, ts, vi, &vidx); 582 if (error != 0) { 583 ts->opstate.func(ts->tc, &ts->opstate); 584 return (error); 585 } 586 /* value storage resize has happened, return */ 587 if (ts->modified != 0) 588 return (0); 589 590 /* Finally, we have allocated valid index, let's add entry */ 591 ptei->value = vidx; 592 ptv = (struct table_val_link *)ptei->ptv; 593 ptei->ptv = NULL; 594 595 ptv->no.kidx = vidx; 596 ptv->no.name = (char *)&pval[vidx]; 597 ptv->pval = &pval[vidx]; 598 memcpy(ptv->pval, &tval, sizeof(struct table_value)); 599 pval[vidx].refcnt = 1; 600 ipfw_objhash_add(vi, &ptv->no); 601 } 602 603 return (0); 604} 605 606/* 607 * Compability function used to import data from old 608 * IP_FW_TABLE_ADD / IP_FW_TABLE_XADD opcodes. 609 */ 610void 611ipfw_import_table_value_legacy(uint32_t value, struct table_value *v) 612{ 613 614 memset(v, 0, sizeof(*v)); 615 v->tag = value; 616 v->pipe = value; 617 v->divert = value; 618 v->skipto = value; 619 v->netgraph = value; 620 v->fib = value; 621 v->nat = value; 622 v->nh4 = value; /* host format */ 623 v->dscp = value; 624 v->limit = value; 625} 626 627/* 628 * Export data to legacy table dumps opcodes. 629 */ 630uint32_t 631ipfw_export_table_value_legacy(struct table_value *v) 632{ 633 634 /* 635 * TODO: provide more compatibility depending on 636 * vmask value. 637 */ 638 return (v->tag); 639} 640 641/* 642 * Imports table value from current userland format. 643 * Saves value in kernel format to the same place. 644 */ 645void 646ipfw_import_table_value_v1(ipfw_table_value *iv) 647{ 648 struct table_value v; 649 650 memset(&v, 0, sizeof(v)); 651 v.tag = iv->tag; 652 v.pipe = iv->pipe; 653 v.divert = iv->divert; 654 v.skipto = iv->skipto; 655 v.netgraph = iv->netgraph; 656 v.fib = iv->fib; 657 v.nat = iv->nat; 658 v.dscp = iv->dscp; 659 v.nh4 = iv->nh4; 660 v.nh6 = iv->nh6; 661 v.limit = iv->limit; 662 663 memcpy(iv, &v, sizeof(ipfw_table_value)); 664} 665 666/* 667 * Export real table value @v to current userland format. 668 * Note that @v and @piv may point to the same memory. 669 */ 670void 671ipfw_export_table_value_v1(struct table_value *v, ipfw_table_value *piv) 672{ 673 ipfw_table_value iv; 674 675 memset(&iv, 0, sizeof(iv)); 676 iv.tag = v->tag; 677 iv.pipe = v->pipe; 678 iv.divert = v->divert; 679 iv.skipto = v->skipto; 680 iv.netgraph = v->netgraph; 681 iv.fib = v->fib; 682 iv.nat = v->nat; 683 iv.dscp = v->dscp; 684 iv.limit = v->limit; 685 iv.nh4 = v->nh4; 686 iv.nh6 = v->nh6; 687 688 memcpy(piv, &iv, sizeof(iv)); 689} 690 691/* 692 * Exports real value data into ipfw_table_value structure. 693 * Utilizes "spare1" field to store kernel index. 694 */ 695static void 696dump_tvalue(struct namedobj_instance *ni, struct named_object *no, void *arg) 697{ 698 struct vdump_args *da; 699 struct table_val_link *ptv; 700 struct table_value *v; 701 702 da = (struct vdump_args *)arg; 703 ptv = (struct table_val_link *)no; 704 705 v = (struct table_value *)ipfw_get_sopt_space(da->sd, sizeof(*v)); 706 /* Out of memory, returning */ 707 if (v == NULL) { 708 da->error = ENOMEM; 709 return; 710 } 711 712 memcpy(v, ptv->pval, sizeof(*v)); 713 v->spare1 = ptv->no.kidx; 714} 715 716/* 717 * Dumps all shared/table value data 718 * Data layout (v1)(current): 719 * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size 720 * Reply: [ ipfw_obj_lheader ipfw_table_value x N ] 721 * 722 * Returns 0 on success 723 */ 724static int 725list_table_values(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 726 struct sockopt_data *sd) 727{ 728 struct _ipfw_obj_lheader *olh; 729 struct namedobj_instance *vi; 730 struct vdump_args da; 731 uint32_t count, size; 732 733 olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh)); 734 if (olh == NULL) 735 return (EINVAL); 736 if (sd->valsize < olh->size) 737 return (EINVAL); 738 739 IPFW_UH_RLOCK(ch); 740 vi = CHAIN_TO_VI(ch); 741 742 count = ipfw_objhash_count(vi); 743 size = count * sizeof(ipfw_table_value) + sizeof(ipfw_obj_lheader); 744 745 /* Fill in header regadless of buffer size */ 746 olh->count = count; 747 olh->objsize = sizeof(ipfw_table_value); 748 749 if (size > olh->size) { 750 olh->size = size; 751 IPFW_UH_RUNLOCK(ch); 752 return (ENOMEM); 753 } 754 olh->size = size; 755 756 /* 757 * Do the actual value dump 758 */ 759 memset(&da, 0, sizeof(da)); 760 da.ch = ch; 761 da.sd = sd; 762 ipfw_objhash_foreach(vi, dump_tvalue, &da); 763 764 IPFW_UH_RUNLOCK(ch); 765 766 return (0); 767} 768 769void 770ipfw_table_value_init(struct ip_fw_chain *ch, int first) 771{ 772 struct tables_config *tcfg; 773 774 ch->valuestate = malloc(VALDATA_START_SIZE * sizeof(struct table_value), 775 M_IPFW, M_WAITOK | M_ZERO); 776 777 tcfg = ch->tblcfg; 778 779 tcfg->val_size = VALDATA_START_SIZE; 780 tcfg->valhash = ipfw_objhash_create(tcfg->val_size); 781 ipfw_objhash_set_funcs(tcfg->valhash, hash_table_value, 782 cmp_table_value); 783 784 IPFW_ADD_SOPT_HANDLER(first, scodes); 785} 786 787static void 788destroy_value(struct namedobj_instance *ni, struct named_object *no, 789 void *arg) 790{ 791 792 free(no, M_IPFW); 793} 794 795void 796ipfw_table_value_destroy(struct ip_fw_chain *ch, int last) 797{ 798 799 IPFW_DEL_SOPT_HANDLER(last, scodes); 800 801 free(ch->valuestate, M_IPFW); 802 ipfw_objhash_foreach(CHAIN_TO_VI(ch), destroy_value, ch); 803 ipfw_objhash_destroy(CHAIN_TO_VI(ch)); 804} 805 806