Page MenuHomeFreeBSD
Files F145762263

D46183.1778487961.diff
No OneTemporary
Actions

Size
291 KB
Referenced Files
None
Subscribers
None

D46183.1778487961.diff
View Options

This file is larger than 256 KB, so syntax highlighting was skipped.
diff --git a/sbin/ipfw/ipfw.8 b/sbin/ipfw/ipfw.8
--- a/sbin/ipfw/ipfw.8
+++ b/sbin/ipfw/ipfw.8
@@ -1,5 +1,5 @@
.\"
-.Dd December 6, 2024
+.Dd March 3, 2025
.Dt IPFW 8
.Os
.Sh NAME
@@ -40,10 +40,10 @@
.Ss SYSCTL SHORTCUTS
.Nm
.Cm enable
-.Brq Cm firewall | altq | one_pass | debug | verbose | dyn_keepalive
+.Brq Cm firewall | altq | one_pass | debug | verbose | dyn_keepalive | skipto_cache
.Nm
.Cm disable
-.Brq Cm firewall | altq | one_pass | debug | verbose | dyn_keepalive
+.Brq Cm firewall | altq | one_pass | debug | verbose | dyn_keepalive | skipto_cache
.Ss LOOKUP TABLES
.Nm
.Oo Cm set Ar N Oc Cm table Ar name Cm create Ar create-options
@@ -1395,6 +1395,16 @@
If an optional 32-bit unsigned
.Ar value
is also specified, an entry will match only if it has this value.
+If
+.Ar value
+is specified in form
+.Ar valtype=value ,
+then specified value type field will be checked.
+It can be
+.Ar skipto, pipe, fib, nat, dscp, tag, divert, netgraph, limit, nh4
+and
+.Ar mark.
+
See the
.Sx LOOKUP TABLES
section below for more information on lookup tables.
@@ -1865,7 +1875,7 @@
of source and destination addresses and ports can be
specified.
.It Cm lookup Bro Cm dst-ip | dst-port | dst-mac | src-ip | src-port | src-mac | uid |
-.Cm jail | dscp | mark Brc Ar name
+.Cm jail | dscp | mark | rulenum Brc Ar name
Search an entry in lookup table
.Ar name
that matches the field specified as argument.
diff --git a/sbin/ipfw/ipfw2.h b/sbin/ipfw/ipfw2.h
--- a/sbin/ipfw/ipfw2.h
+++ b/sbin/ipfw/ipfw2.h
@@ -305,6 +305,8 @@
TOK_LOGOFF,
TOK_PRIVATE,
TOK_PRIVATEOFF,
+ TOK_SWAPCONF,
+ TOK_SWAPCONFOFF,
/* NAT64 CLAT tokens */
TOK_NAT64CLAT,
@@ -463,5 +465,5 @@
void ipfw_list_ta(int ac, char *av[]);
void ipfw_list_values(int ac, char *av[]);
void table_fill_ntlv(struct _ipfw_obj_ntlv *ntlv, const char *name,
- uint8_t set, uint16_t uidx);
+ uint8_t set, uint32_t uidx);
diff --git a/sbin/ipfw/ipfw2.c b/sbin/ipfw/ipfw2.c
--- a/sbin/ipfw/ipfw2.c
+++ b/sbin/ipfw/ipfw2.c
@@ -290,6 +290,12 @@
{ NULL, 0 } /* terminator */
};
+static struct _s_x return_types[] = {
+ { "next-rulenum", RETURN_NEXT_RULENUM },
+ { "next-rule", RETURN_NEXT_RULE },
+ { NULL, 0 } /* terminator */
+};
+
static struct _s_x rule_action_params[] = {
{ "altq", TOK_ALTQ },
{ "log", TOK_LOG },
@@ -300,7 +306,7 @@
/*
* The 'lookup' instruction accepts one of the following arguments.
- * Arguments are passed as v[1] in O_DST_LOOKUP options.
+ * Arguments are passed as o.arg1 and o->value in O_DST_LOOKUP option.
*/
static struct _s_x lookup_keys[] = {
{ "dst-ip", LOOKUP_DST_IP },
@@ -313,9 +319,29 @@
{ "jail", LOOKUP_JAIL },
{ "dscp", LOOKUP_DSCP },
{ "mark", LOOKUP_MARK },
+ { "rulenum", LOOKUP_RULENUM },
{ NULL, 0 },
};
+/*
+ * table(name,valuename=value) instruction accepts one of the
+ * following arguments as valuename.
+ */
+static struct _s_x tvalue_names[] = {
+ { "tag", TVALUE_TAG },
+ { "pipe", TVALUE_PIPE },
+ { "divert", TVALUE_DIVERT },
+ { "skipto", TVALUE_SKIPTO },
+ { "netgraph", TVALUE_NETGRAPH },
+ { "fib", TVALUE_FIB },
+ { "nat", TVALUE_NAT },
+ { "nh4", TVALUE_NH4 },
+ { "dscp", TVALUE_DSCP },
+ { "limit", TVALUE_LIMIT },
+ { "mark", TVALUE_MARK },
+ { NULL, 0 }
+};
+
static struct _s_x rule_options[] = {
{ "tagged", TOK_TAGGED },
{ "uid", TOK_UID },
@@ -415,12 +441,12 @@
static void ipfw_list_tifaces(void);
struct tidx;
-static uint16_t pack_object(struct tidx *tstate, const char *name, int otype);
-static uint16_t pack_table(struct tidx *tstate, const char *name);
+static uint32_t pack_object(struct tidx *tstate, const char *name, int otype);
+static uint32_t pack_table(struct tidx *tstate, const char *name);
-static char *table_search_ctlv(ipfw_obj_ctlv *ctlv, uint16_t idx);
+static char *table_search_ctlv(ipfw_obj_ctlv *ctlv, uint32_t idx);
static void object_sort_ctlv(ipfw_obj_ctlv *ctlv);
-static char *object_search_ctlv(ipfw_obj_ctlv *ctlv, uint16_t idx,
+static char *object_search_ctlv(ipfw_obj_ctlv *ctlv, uint32_t idx,
uint16_t type);
int
@@ -650,6 +676,7 @@
{
op3->opcode = optname;
+ op3->version = IP_FW3_OPVER; /* use last version */
if (g_co.debug_only) {
struct debug_header dbg = {
@@ -690,6 +717,7 @@
socklen_t len;
op3->opcode = optname;
+ op3->version = IP_FW3_OPVER; /* use last version */
if (g_co.debug_only) {
struct debug_header dbg = {
@@ -1284,6 +1312,15 @@
}
}
+static void
+print_tvalue(struct buf_pr *bp, const ipfw_insn_table *cmd)
+{
+ const char *name;
+
+ name = match_value(tvalue_names, IPFW_TVALUE_TYPE(&cmd->o));
+ bprintf(bp, ",%s=%u", name != NULL ? name: "<invalid>", cmd->value);
+}
+
/*
* Print the ip address contained in a command.
@@ -1295,33 +1332,46 @@
struct hostent *he = NULL;
const struct in_addr *ia;
const uint32_t *a = ((const ipfw_insn_u32 *)cmd)->d;
- uint32_t len = F_LEN((const ipfw_insn *)cmd);
+ uint32_t len = F_LEN(&cmd->o);
char *t;
bprintf(bp, " ");
- if (cmd->o.opcode == O_IP_DST_LOOKUP && len > F_INSN_SIZE(ipfw_insn_u32)) {
- const char *arg;
-
- arg = match_value(lookup_keys, a[1]);
- t = table_search_ctlv(fo->tstate,
- ((const ipfw_insn *)cmd)->arg1);
- bprintf(bp, "lookup %s %s", arg, t);
- return;
- }
- if (cmd->o.opcode == O_IP_SRC_ME || cmd->o.opcode == O_IP_DST_ME) {
+ switch (cmd->o.opcode) {
+ case O_IP_SRC_ME:
+ case O_IP_DST_ME:
bprintf(bp, "me");
return;
- }
- if (cmd->o.opcode == O_IP_SRC_LOOKUP ||
- cmd->o.opcode == O_IP_DST_LOOKUP) {
+
+ case O_IP_DST_LOOKUP:
+ if ((len == F_INSN_SIZE(ipfw_insn_kidx) ||
+ len == F_INSN_SIZE(ipfw_insn_table)) &&
+ IPFW_LOOKUP_TYPE(&cmd->o) != LOOKUP_NONE) {
+ const char *key;
+
+ key = match_value(lookup_keys,
+ IPFW_LOOKUP_TYPE(&cmd->o));
+ t = table_search_ctlv(fo->tstate,
+ insntoc(&cmd->o, kidx)->kidx);
+ if (len == F_INSN_SIZE(ipfw_insn_table)) {
+ bprintf(bp, "lookup %s:%#x %s",
+ (key != NULL ? key : "<invalid>"),
+ insntoc(&cmd->o, table)->value, t);
+ } else
+ bprintf(bp, "lookup %s %s", key != NULL ? key:
+ "<invalid>", t);
+ return;
+ }
+ /* FALLTHROUGH */
+ case O_IP_SRC_LOOKUP:
t = table_search_ctlv(fo->tstate,
- ((const ipfw_insn *)cmd)->arg1);
+ insntoc(&cmd->o, kidx)->kidx);
bprintf(bp, "table(%s", t);
- if (len == F_INSN_SIZE(ipfw_insn_u32))
- bprintf(bp, ",%u", *a);
+ if (len == F_INSN_SIZE(ipfw_insn_table))
+ print_tvalue(bp, insntoc(&cmd->o, table));
bprintf(bp, ")");
return;
}
+
if (cmd->o.opcode == O_IP_SRC_SET || cmd->o.opcode == O_IP_DST_SET) {
const uint32_t *map = (const uint32_t *)&cmd->mask;
struct in_addr addr;
@@ -1427,10 +1477,10 @@
bprintf(bp, " ");
- t = table_search_ctlv(fo->tstate, cmd->arg1);
+ t = table_search_ctlv(fo->tstate, insntoc(cmd, kidx)->kidx);
bprintf(bp, "table(%s", t);
- if (len == F_INSN_SIZE(ipfw_insn_u32))
- bprintf(bp, ",%u", ((const ipfw_insn_u32 *)cmd)->d[0]);
+ if (len == F_INSN_SIZE(ipfw_insn_table))
+ print_tvalue(bp, insntoc(cmd, table));
bprintf(bp, ")");
}
@@ -1497,10 +1547,9 @@
}
}
-#define insntod(cmd, type) ((const ipfw_insn_ ## type *)(cmd))
struct show_state {
struct ip_fw_rule *rule;
- const ipfw_insn *eaction;
+ const ipfw_insn_kidx *eaction;
uint8_t *printed;
int flags;
#define HAVE_PROTO 0x0001
@@ -1583,7 +1632,7 @@
switch (cmd->opcode) {
case O_PROB:
- d = 1.0 * insntod(cmd, u32)->d[0] / 0x7fffffff;
+ d = 1.0 * insntoc(cmd, u32)->d[0] / 0x7fffffff;
bprintf(bp, "prob %f ", d);
break;
case O_PROBE_STATE: /* no need to print anything here */
@@ -1596,30 +1645,36 @@
case O_IP_SRC_SET:
if (state->flags & HAVE_SRCIP)
bprintf(bp, " src-ip");
- print_ip(bp, fo, insntod(cmd, ip));
+ print_ip(bp, fo, insntoc(cmd, ip));
break;
case O_IP_DST:
- case O_IP_DST_LOOKUP:
case O_IP_DST_MASK:
case O_IP_DST_ME:
case O_IP_DST_SET:
- if (state->flags & HAVE_DSTIP)
+ case O_IP_DST_LOOKUP:
+ /*
+ * Special handling for O_IP_DST_LOOKUP when
+ * lookup type is not LOOKUP_NONE.
+ */
+ if ((state->flags & HAVE_DSTIP) != 0 && (
+ cmd->opcode != O_IP_DST_LOOKUP ||
+ IPFW_LOOKUP_TYPE(cmd) == LOOKUP_NONE))
bprintf(bp, " dst-ip");
- print_ip(bp, fo, insntod(cmd, ip));
+ print_ip(bp, fo, insntoc(cmd, ip));
break;
case O_IP6_SRC:
case O_IP6_SRC_MASK:
case O_IP6_SRC_ME:
if (state->flags & HAVE_SRCIP)
bprintf(bp, " src-ip6");
- print_ip6(bp, insntod(cmd, ip6));
+ print_ip6(bp, insntoc(cmd, ip6));
break;
case O_IP6_DST:
case O_IP6_DST_MASK:
case O_IP6_DST_ME:
if (state->flags & HAVE_DSTIP)
bprintf(bp, " dst-ip6");
- print_ip6(bp, insntod(cmd, ip6));
+ print_ip6(bp, insntoc(cmd, ip6));
break;
case O_MAC_SRC_LOOKUP:
bprintf(bp, " src-mac");
@@ -1630,11 +1685,11 @@
print_mac_lookup(bp, fo, cmd);
break;
case O_FLOW6ID:
- print_flow6id(bp, insntod(cmd, u32));
+ print_flow6id(bp, insntoc(cmd, u32));
break;
case O_IP_DSTPORT:
case O_IP_SRCPORT:
- print_newports(bp, insntod(cmd, u16), state->proto,
+ print_newports(bp, insntoc(cmd, u16), state->proto,
(state->flags & (HAVE_SRCIP | HAVE_DSTIP)) ==
(HAVE_SRCIP | HAVE_DSTIP) ? cmd->opcode: 0);
break;
@@ -1649,10 +1704,10 @@
state->proto = cmd->arg1;
break;
case O_MACADDR2:
- print_mac(bp, insntod(cmd, mac));
+ print_mac(bp, insntoc(cmd, mac));
break;
case O_MAC_TYPE:
- print_newports(bp, insntod(cmd, u16),
+ print_newports(bp, insntoc(cmd, u16),
IPPROTO_ETHERTYPE, cmd->opcode);
break;
case O_FRAG:
@@ -1695,26 +1750,27 @@
s = "recv";
else /* if (cmd->opcode == O_VIA) */
s = "via";
- switch (insntod(cmd, if)->name[0]) {
+ switch (insntoc(cmd, if)->name[0]) {
case '\0':
bprintf(bp, " %s %s", s,
- inet_ntoa(insntod(cmd, if)->p.ip));
+ inet_ntoa(insntoc(cmd, if)->p.ip));
break;
case '\1':
bprintf(bp, " %s table(%s)", s,
table_search_ctlv(fo->tstate,
- insntod(cmd, if)->p.kidx));
+ insntoc(cmd, if)->p.kidx));
break;
default:
bprintf(bp, " %s %s", s,
- insntod(cmd, if)->name);
+ insntoc(cmd, if)->name);
}
break;
case O_IP_FLOW_LOOKUP:
- s = table_search_ctlv(fo->tstate, cmd->arg1);
+ s = table_search_ctlv(fo->tstate,
+ insntoc(cmd, kidx)->kidx);
bprintf(bp, " flow table(%s", s);
- if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn_u32))
- bprintf(bp, ",%u", insntod(cmd, u32)->d[0]);
+ if (F_LEN(cmd) == F_INSN_SIZE(ipfw_insn_table))
+ print_tvalue(bp, insntoc(cmd, table));
bprintf(bp, ")");
break;
case O_IPID:
@@ -1749,7 +1805,7 @@
}
bprintf(bp, " %s %u", s, cmd->arg1);
} else
- print_newports(bp, insntod(cmd, u16), 0,
+ print_newports(bp, insntoc(cmd, u16), 0,
cmd->opcode);
break;
case O_IPVER:
@@ -1759,7 +1815,7 @@
bprintf(bp, " ipprecedence %u", cmd->arg1 >> 5);
break;
case O_DSCP:
- print_dscp(bp, insntod(cmd, u32));
+ print_dscp(bp, insntoc(cmd, u32));
break;
case O_IPOPT:
print_flags(bp, "ipoptions", cmd, f_ipopts);
@@ -1768,7 +1824,7 @@
print_flags(bp, "iptos", cmd, f_iptos);
break;
case O_ICMPTYPE:
- print_icmptypes(bp, insntod(cmd, u32));
+ print_icmptypes(bp, insntoc(cmd, u32));
break;
case O_ESTAB:
bprintf(bp, " established");
@@ -1781,30 +1837,30 @@
break;
case O_TCPACK:
bprintf(bp, " tcpack %d",
- ntohl(insntod(cmd, u32)->d[0]));
+ ntohl(insntoc(cmd, u32)->d[0]));
break;
case O_TCPSEQ:
bprintf(bp, " tcpseq %d",
- ntohl(insntod(cmd, u32)->d[0]));
+ ntohl(insntoc(cmd, u32)->d[0]));
break;
case O_UID:
- pwd = getpwuid(insntod(cmd, u32)->d[0]);
+ pwd = getpwuid(insntoc(cmd, u32)->d[0]);
if (pwd != NULL)
bprintf(bp, " uid %s", pwd->pw_name);
else
bprintf(bp, " uid %u",
- insntod(cmd, u32)->d[0]);
+ insntoc(cmd, u32)->d[0]);
break;
case O_GID:
- grp = getgrgid(insntod(cmd, u32)->d[0]);
+ grp = getgrgid(insntoc(cmd, u32)->d[0]);
if (grp != NULL)
bprintf(bp, " gid %s", grp->gr_name);
else
bprintf(bp, " gid %u",
- insntod(cmd, u32)->d[0]);
+ insntoc(cmd, u32)->d[0]);
break;
case O_JAIL:
- bprintf(bp, " jail %d", insntod(cmd, u32)->d[0]);
+ bprintf(bp, " jail %d", insntoc(cmd, u32)->d[0]);
break;
case O_VERREVPATH:
bprintf(bp, " verrevpath");
@@ -1827,7 +1883,8 @@
else
bprintf(bp, " record-state");
bprintf(bp, " :%s",
- object_search_ctlv(fo->tstate, cmd->arg1,
+ object_search_ctlv(fo->tstate,
+ insntoc(cmd, kidx)->kidx,
IPFW_TLV_STATE_NAME));
break;
case O_LIMIT:
@@ -1835,9 +1892,10 @@
bprintf(bp, " limit");
else
bprintf(bp, " set-limit");
- print_limit_mask(bp, insntod(cmd, limit));
+ print_limit_mask(bp, insntoc(cmd, limit));
bprintf(bp, " :%s",
- object_search_ctlv(fo->tstate, cmd->arg1,
+ object_search_ctlv(fo->tstate,
+ insntoc(cmd, kidx)->kidx,
IPFW_TLV_STATE_NAME));
break;
case O_IP6:
@@ -1851,7 +1909,7 @@
bprintf(bp, " ip4");
break;
case O_ICMP6TYPE:
- print_icmp6types(bp, insntod(cmd, u32));
+ print_icmp6types(bp, insntoc(cmd, u32));
break;
case O_EXT_HDR:
print_ext6hdr(bp, cmd);
@@ -1860,7 +1918,7 @@
if (F_LEN(cmd) == 1)
bprint_uint_arg(bp, " tagged ", cmd->arg1);
else
- print_newports(bp, insntod(cmd, u16),
+ print_newports(bp, insntoc(cmd, u16),
0, O_TAGGED);
break;
case O_SKIP_ACTION:
@@ -1871,12 +1929,10 @@
if (cmd->arg1 == IP_FW_TARG)
bprintf(bp, " tablearg");
else
- bprintf(bp, " %#x",
- ((const ipfw_insn_u32 *)cmd)->d[0]);
+ bprintf(bp, " %#x", insntoc(cmd, u32)->d[0]);
- if (((const ipfw_insn_u32 *)cmd)->d[1] != 0xFFFFFFFF)
- bprintf(bp, ":%#x",
- ((const ipfw_insn_u32 *)cmd)->d[1]);
+ if (insntoc(cmd, u32)->d[1] != 0xFFFFFFFF)
+ bprintf(bp, ":%#x", insntoc(cmd, u32)->d[1]);
break;
default:
@@ -1929,14 +1985,14 @@
uint16_t port;
if (cmd->opcode == O_FORWARD_IP) {
- sa = insntod(cmd, sa);
+ sa = insntoc(cmd, sa);
port = sa->sa.sin_port;
if (sa->sa.sin_addr.s_addr == INADDR_ANY)
bprintf(bp, "fwd tablearg");
else
bprintf(bp, "fwd %s", inet_ntoa(sa->sa.sin_addr));
} else {
- sa6 = insntod(cmd, sa6);
+ sa6 = insntoc(cmd, sa6);
port = sa6->sa.sin6_port;
bprintf(bp, "fwd ");
if (getnameinfo((const struct sockaddr *)&sa6->sa,
@@ -1948,6 +2004,26 @@
bprintf(bp, ",%u", port);
}
+static void
+print_logdst(struct buf_pr *bp, uint16_t arg1)
+{
+ char const *comma = "";
+
+ bprintf(bp, " logdst ", arg1);
+ if (arg1 & IPFW_LOG_SYSLOG) {
+ bprintf(bp, "%ssyslog", comma);
+ comma = ",";
+ }
+ if (arg1 & IPFW_LOG_IPFW0) {
+ bprintf(bp, "%sipfw0", comma);
+ comma = ",";
+ }
+ if (arg1 & IPFW_LOG_RTSOCK) {
+ bprintf(bp, "%srtsock", comma);
+ comma = ",";
+ }
+}
+
static int
print_action_instruction(struct buf_pr *bp, const struct format_opts *fo,
struct show_state *state, const ipfw_insn *cmd)
@@ -1959,8 +2035,9 @@
switch (cmd->opcode) {
case O_CHECK_STATE:
bprintf(bp, "check-state");
- if (cmd->arg1 != 0)
- s = object_search_ctlv(fo->tstate, cmd->arg1,
+ if (insntoc(cmd, kidx)->kidx != 0)
+ s = object_search_ctlv(fo->tstate,
+ insntoc(cmd, kidx)->kidx,
IPFW_TLV_STATE_NAME);
else
s = NULL;
@@ -1985,7 +2062,7 @@
else if (cmd->arg1 == ICMP_UNREACH_NEEDFRAG &&
cmd->len == F_INSN_SIZE(ipfw_insn_u16))
bprintf(bp, "needfrag %u",
- ((const ipfw_insn_u16 *)cmd)->ports[0]);
+ insntoc(cmd, u16)->ports[0]);
else
print_reject_code(bp, cmd->arg1);
break;
@@ -1998,7 +2075,7 @@
print_unreach6_code(bp, cmd->arg1);
break;
case O_SKIPTO:
- bprint_uint_arg(bp, "skipto ", cmd->arg1);
+ bprint_uint_arg(bp, "skipto ", insntoc(cmd, u32)->d[0]);
break;
case O_PIPE:
bprint_uint_arg(bp, "pipe ", cmd->arg1);
@@ -2023,15 +2100,16 @@
print_fwd(bp, cmd);
break;
case O_LOG:
- if (insntod(cmd, log)->max_log > 0)
- bprintf(bp, " log logamount %d",
- insntod(cmd, log)->max_log);
- else
- bprintf(bp, " log");
+ bprintf(bp, " log");
+ if (insntoc(cmd, log)->max_log > 0)
+ bprintf(bp, " logamount %d",
+ insntoc(cmd, log)->max_log);
+ if (cmd->arg1 != IPFW_LOG_DEFAULT)
+ print_logdst(bp, cmd->arg1);
break;
case O_ALTQ:
#ifndef NO_ALTQ
- print_altq_cmd(bp, insntod(cmd, altq));
+ print_altq_cmd(bp, insntoc(cmd, altq));
#endif
break;
case O_TAG:
@@ -2060,8 +2138,9 @@
* NOTE: in case when external action has no named
* instances support, the second opcode isn't needed.
*/
- state->eaction = cmd;
- s = object_search_ctlv(fo->tstate, cmd->arg1,
+ state->eaction = insntoc(cmd, kidx);
+ s = object_search_ctlv(fo->tstate,
+ state->eaction->kidx,
IPFW_TLV_EACTION);
if (match_token(rule_eactions, s) != -1)
bprintf(bp, "%s", s);
@@ -2081,11 +2160,12 @@
* we calculate TLV type using IPFW_TLV_EACTION_NAME()
* macro.
*/
- s = object_search_ctlv(fo->tstate, cmd->arg1, 0);
+ s = object_search_ctlv(fo->tstate,
+ insntoc(cmd, kidx)->kidx, 0);
if (s == NULL)
s = object_search_ctlv(fo->tstate,
- cmd->arg1, IPFW_TLV_EACTION_NAME(
- state->eaction->arg1));
+ insntoc(cmd, kidx)->kidx, IPFW_TLV_EACTION_NAME(
+ state->eaction->kidx));
bprintf(bp, " %s", s);
break;
case O_EXTERNAL_DATA:
@@ -2117,17 +2197,18 @@
bprintf(bp, "reass");
break;
case O_CALLRETURN:
- if (cmd->len & F_NOT)
- bprintf(bp, "return");
- else
- bprint_uint_arg(bp, "call ", cmd->arg1);
+ if (cmd->len & F_NOT) {
+ s = match_value(return_types, cmd->arg1);
+ bprintf(bp, "return %s", s ? s: "<invalid>");
+ } else
+ bprint_uint_arg(bp, "call ", insntoc(cmd, u32)->d[0]);
break;
case O_SETMARK:
if (cmd->arg1 == IP_FW_TARG) {
bprintf(bp, "setmark tablearg");
break;
}
- bprintf(bp, "setmark %#x", ((const ipfw_insn_u32 *)cmd)->d[0]);
+ bprintf(bp, "setmark %#x", insntoc(cmd, u32)->d[0]);
break;
default:
bprintf(bp, "** unrecognized action %d len %d ",
@@ -2233,9 +2314,16 @@
count = portcnt = 0;
for (l = state->rule->act_ofs, cmd = state->rule->cmd;
l > 0; l -= F_LEN(cmd), cmd += F_LEN(cmd)) {
- if (match_opcode(cmd->opcode, opcodes, nops))
+ if (match_opcode(cmd->opcode, opcodes, nops)) {
+ /*
+ * Special handling for O_IP_DST_LOOKUP when
+ * lookup type is not LOOKUP_NONE.
+ */
+ if (cmd->opcode == O_IP_DST_LOOKUP &&
+ IPFW_LOOKUP_TYPE(cmd) != LOOKUP_NONE)
+ continue;
count++;
- else if (cmd->opcode == portop)
+ } else if (cmd->opcode == portop)
portcnt++;
}
if (count == 0)
@@ -2292,6 +2380,12 @@
O_IP_DST_SET, O_IP6_DST, O_IP6_DST_MASK, O_IP6_DST_ME
};
+#if IPFW_DEFAULT_RULE > 65535
+#define RULENUM_FORMAT "%06d"
+#else
+#define RULENUM_FORMAT "%05d"
+#endif
+
static void
show_static_rule(struct cmdline_opts *co, struct format_opts *fo,
struct buf_pr *bp, struct ip_fw_rule *rule, struct ip_fw_bcounter *cntr)
@@ -2313,7 +2407,8 @@
warn("init_show_state() failed");
return;
}
- bprintf(bp, "%05u ", rule->rulenum);
+
+ bprintf(bp, RULENUM_FORMAT " ", rule->rulenum);
/* only if counters are available */
if (cntr != NULL) {
@@ -2423,23 +2518,21 @@
{
struct protoent *pe;
struct in_addr a;
- uint16_t rulenum;
char buf[INET6_ADDRSTRLEN];
- if (d->expire == 0 && d->dyn_type != O_LIMIT_PARENT)
+ if (!d->expire && !(d->type == O_LIMIT_PARENT))
return;
- bcopy(&d->rule, &rulenum, sizeof(rulenum));
- bprintf(bp, "%05d", rulenum);
+ bprintf(bp, RULENUM_FORMAT, d->rulenum);
if (fo->pcwidth > 0 || fo->bcwidth > 0) {
bprintf(bp, " ");
pr_u64(bp, &d->pcnt, fo->pcwidth);
pr_u64(bp, &d->bcnt, fo->bcwidth);
bprintf(bp, "(%ds)", d->expire);
}
- switch (d->dyn_type) {
+ switch (d->type) {
case O_LIMIT_PARENT:
- bprintf(bp, " PARENT %d", d->count);
+ bprintf(bp, " PARENT %u", d->count);
break;
case O_LIMIT:
bprintf(bp, " LIMIT");
@@ -2531,9 +2624,8 @@
ipfw_range_tlv rt;
const char *msg;
size_t size;
- uint32_t masks[2];
+ uint32_t masks[2], rulenum;
int i;
- uint16_t rulenum;
uint8_t cmd;
av++;
@@ -2584,7 +2676,7 @@
if (av[0] == NULL || av[1] == NULL || av[2] == NULL ||
av[3] != NULL || _substrcmp(av[1], "to") != 0)
errx(EX_USAGE, "syntax: set move [rule] X to Y\n");
- rulenum = atoi(av[0]);
+ rulenum = (uint32_t)strtoul(av[0], NULL, 10);
rt.new_set = atoi(av[2]);
if (cmd == IP_FW_XMOVE) {
rt.start_rule = rulenum;
@@ -2637,6 +2729,18 @@
errx(EX_USAGE, "invalid set command %s\n", *av);
}
+static void
+manage_skipto_cache(int op)
+{
+ ipfw_cmd_header req;
+
+ memset(&req, 0, sizeof(req));
+ req.size = sizeof(req);
+ req.cmd = op ? SKIPTO_CACHE_ENABLE : SKIPTO_CACHE_DISABLE;
+
+ do_set3(IP_FW_SKIPTO_CACHE, &req.opheader, sizeof(req));
+}
+
void
ipfw_sysctl_handler(char *av[], int which)
{
@@ -2661,6 +2765,8 @@
} else if (_substrcmp(*av, "dyn_keepalive") == 0) {
sysctlbyname("net.inet.ip.fw.dyn_keepalive", NULL, 0,
&which, sizeof(which));
+ } else if (_substrcmp(*av, "skipto_cache") == 0) {
+ manage_skipto_cache(which);
#ifndef NO_ALTQ
} else if (_substrcmp(*av, "altq") == 0) {
altq_set_enabled(which);
@@ -2679,7 +2785,6 @@
{
ipfw_dyn_rule *d;
int width;
- uint8_t set;
d = (ipfw_dyn_rule *)_state;
/* Count _ALL_ states */
@@ -2688,13 +2793,9 @@
if (fo->show_counters == 0)
return;
- if (co->use_set) {
- /* skip states from another set */
- bcopy((char *)&d->rule + sizeof(uint16_t), &set,
- sizeof(uint8_t));
- if (set != co->use_set - 1)
- return;
- }
+ /* skip states from another set */
+ if (co->use_set != 0 && d->set != co->use_set - 1)
+ return;
width = pr_u64(NULL, &d->pcnt, 0);
if (width > fo->pcwidth)
@@ -2822,24 +2923,17 @@
list_dyn_state(struct cmdline_opts *co, struct format_opts *fo,
void *_arg, void *_state)
{
- uint16_t rulenum;
- uint8_t set;
ipfw_dyn_rule *d;
struct buf_pr *bp;
d = (ipfw_dyn_rule *)_state;
bp = (struct buf_pr *)_arg;
- bcopy(&d->rule, &rulenum, sizeof(rulenum));
- if (rulenum > fo->last)
+ if (d->rulenum > fo->last)
return;
- if (co->use_set) {
- bcopy((char *)&d->rule + sizeof(uint16_t),
- &set, sizeof(uint8_t));
- if (set != co->use_set - 1)
- return;
- }
- if (rulenum >= fo->first) {
+ if (co->use_set != 0 && d->set != co->use_set - 1)
+ return;
+ if (d->rulenum >= fo->first) {
show_dyn_state(co, fo, bp, d);
printf("%s\n", bp->buf);
bp_flush(bp);
@@ -3165,7 +3259,7 @@
return (0);
}
-static uint16_t
+static uint32_t
pack_object(struct tidx *tstate, const char *name, int otype)
{
ipfw_obj_ntlv *ntlv;
@@ -3202,7 +3296,7 @@
return (ntlv->idx);
}
-static uint16_t
+static uint32_t
pack_table(struct tidx *tstate, const char *name)
{
@@ -3212,12 +3306,32 @@
return (pack_object(tstate, name, IPFW_TLV_TBL_NAME));
}
+static void
+fill_table_value(ipfw_insn *cmd, char *s)
+{
+ char *p;
+ int i;
+
+ p = strchr(s, '=');
+ if (p != NULL) {
+ *p++ = '\0';
+ i = match_token(tvalue_names, s);
+ if (i == -1)
+ errx(EX_USAGE,
+ "format: unknown table value name %s", s);
+ } else {
+ i = TVALUE_TAG;
+ p = s;
+ }
+
+ IPFW_SET_TVALUE_TYPE(cmd, i);
+ insntod(cmd, table)->value = strtoul(p, NULL, 0);
+}
+
void
-fill_table(struct _ipfw_insn *cmd, char *av, uint8_t opcode,
- struct tidx *tstate)
+fill_table(ipfw_insn *cmd, char *av, uint8_t opcode, struct tidx *tstate)
{
- uint32_t *d = ((ipfw_insn_u32 *)cmd)->d;
- uint16_t uidx;
+ ipfw_insn_kidx *c = insntod(cmd, kidx);
char *p;
if ((p = strchr(av + 6, ')')) == NULL)
@@ -3227,19 +3341,19 @@
if (p)
*p++ = '\0';
- if ((uidx = pack_table(tstate, av + 6)) == 0)
+ if ((c->kidx = pack_table(tstate, av + 6)) == 0)
errx(EX_DATAERR, "Invalid table name: %s", av + 6);
cmd->opcode = opcode;
- cmd->arg1 = uidx;
if (p) {
- cmd->len |= F_INSN_SIZE(ipfw_insn_u32);
- d[0] = strtoul(p, NULL, 0);
- } else
- cmd->len |= F_INSN_SIZE(ipfw_insn);
+ cmd->len |= F_INSN_SIZE(ipfw_insn_table);
+ fill_table_value(cmd, p);
+ } else {
+ IPFW_SET_LOOKUP_TYPE(cmd, LOOKUP_NONE);
+ cmd->len |= F_INSN_SIZE(ipfw_insn_kidx);
+ }
}
-
/*
* fills the addr and mask fields in the instruction as appropriate from av.
* Update length as appropriate.
@@ -3470,7 +3584,7 @@
{
ipfw_range_tlv rt;
char *sep;
- int i, j;
+ uint32_t i, j;
int exitval = EX_OK;
int do_set = 0;
@@ -3503,8 +3617,8 @@
rt.set = i & 31;
rt.flags = IPFW_RCFLAG_SET;
} else {
- rt.start_rule = i & 0xffff;
- rt.end_rule = j & 0xffff;
+ rt.start_rule = i;
+ rt.end_rule = j;
if (rt.start_rule == 0 && rt.end_rule == 0)
rt.flags |= IPFW_RCFLAG_ALL;
else
@@ -3541,7 +3655,6 @@
exit(exitval);
}
-
/*
* fill the interface structure. We do not check the name as we can
* create interfaces dynamically, so checking them at insert time
@@ -3553,7 +3666,7 @@
fill_iface(ipfw_insn_if *cmd, char *arg, int cblen, struct tidx *tstate)
{
char *p;
- uint16_t uidx;
+ uint32_t uidx;
cmd->name[0] = '\0';
cmd->o.len |= F_INSN_SIZE(ipfw_insn_if);
@@ -3861,6 +3974,8 @@
{ "to", TOK_OR },
{ "via", TOK_OR },
{ "{", TOK_OR },
+ { "lookup", TOK_OR },
+ { "tagged", TOK_OR },
{ NULL, 0 } /* terminator */
};
@@ -3941,8 +4056,35 @@
return ret;
}
-static inline int
-arg_or_targ_relaxed(const char *arg, const char *action)
+static uint16_t
+parse_logdst(char *logdst_iter)
+{
+ char *token;
+ uint16_t ret;
+
+ ret = IPFW_LOG_DEFAULT;
+ while ((token = strsep(&logdst_iter, ",")) != NULL) {
+ if (_substrcmp(token, "syslog") == 0) {
+ ret |= IPFW_LOG_SYSLOG;
+ continue;
+ }
+ if (_substrcmp(token, "ipfw0") == 0) {
+ /* XXX add multiple ipfw* */
+ ret |= IPFW_LOG_IPFW0;
+ continue;
+ }
+ if (_substrcmp(token, "rtsock") == 0) {
+ ret |= IPFW_LOG_RTSOCK;
+ continue;
+ }
+ errx(EX_DATAERR,
+ "unsupported logdst token");
+ }
+ return (ret);
+}
+
+static inline uint32_t
+arg_or_targ_relaxed(const char *arg, const char *action, uint32_t maxarg)
{
uint32_t arg1 = (uint32_t)(-1);
@@ -3950,7 +4092,7 @@
errx(EX_USAGE, "missing argument for %s", action);
if (isdigit(arg[0])) {
arg1 = strtoul(arg, NULL, 10);
- if (arg1 <= 0 || arg1 >= IP_FW_TABLEARG)
+ if (arg1 < IPFW_ARG_MIN || arg1 > maxarg)
errx(EX_DATAERR, "illegal argument %s(%u) for %s",
arg, arg1, action);
} else if (_substrcmp(arg, "tablearg") == 0)
@@ -3958,10 +4100,10 @@
return (arg1);
}
-static inline uint16_t
+static inline uint32_t
arg_or_targ(const char *arg, const char *action)
{
- uint32_t arg1 = arg_or_targ_relaxed(arg, action);
+ uint32_t arg1 = arg_or_targ_relaxed(arg, action, IPFW_ARG_MAX);
if (arg1 == (uint32_t)(-1))
errx(EX_DATAERR, "illegal argument %s(%u) for %s",
@@ -3972,7 +4114,7 @@
static uint16_t
get_divert_port(const char *arg, const char *action)
{
- uint32_t arg1 = arg_or_targ_relaxed(arg, action);
+ uint32_t arg1 = arg_or_targ_relaxed(arg, action, IPFW_ARG_MAX);
if (arg1 != (uint32_t)(-1))
return (arg1);
@@ -4086,18 +4228,20 @@
case TOK_CHECKSTATE:
have_state = action;
action->opcode = O_CHECK_STATE;
+ action->len = F_INSN_SIZE(ipfw_insn_kidx);
+ CHECK_ACTLEN;
if (*av == NULL ||
match_token(rule_options, *av) == TOK_COMMENT) {
- action->arg1 = pack_object(tstate,
+ insntod(have_state, kidx)->kidx = pack_object(tstate,
default_state_name, IPFW_TLV_STATE_NAME);
break;
}
if (*av[0] == ':') {
if (strcmp(*av + 1, "any") == 0)
- action->arg1 = 0;
+ insntod(have_state, kidx)->kidx = 0;
else if (state_check_name(*av + 1) == 0)
- action->arg1 = pack_object(tstate, *av + 1,
- IPFW_TLV_STATE_NAME);
+ insntod(have_state, kidx)->kidx = pack_object(
+ tstate, *av + 1, IPFW_TLV_STATE_NAME);
else
errx(EX_DATAERR, "Invalid state name %s",
*av);
@@ -4154,7 +4298,7 @@
errx(EX_DATAERR, "illegal argument for %s",
*(av - 1));
action->len = F_INSN_SIZE(ipfw_insn_u16);
- ((ipfw_insn_u16 *)action)->ports[0] = mtu;
+ insntod(action, u16)->ports[0] = mtu;
av++;
}
break;
@@ -4192,7 +4336,10 @@
break;
case TOK_SKIPTO:
action->opcode = O_SKIPTO;
- action->arg1 = arg_or_targ(av[0], *(av - 1));
+ action->len = F_INSN_SIZE(ipfw_insn_u32);
+ CHECK_ACTLEN;
+ insntod(action, u32)->d[0] =
+ arg_or_targ_relaxed(av[0], *(av - 1), IPFW_DEFAULT_RULE);
av++;
break;
case TOK_NETGRAPH:
@@ -4217,7 +4364,10 @@
break;
case TOK_CALL:
action->opcode = O_CALLRETURN;
- action->arg1 = arg_or_targ(av[0], *(av - 1));
+ action->len = F_INSN_SIZE(ipfw_insn_u32);
+ CHECK_ACTLEN;
+ insntod(action, u32)->d[0] =
+ arg_or_targ_relaxed(av[0], *(av - 1), IPFW_DEFAULT_RULE);
av++;
break;
@@ -4385,7 +4535,21 @@
break;
case TOK_RETURN:
- fill_cmd(action, O_CALLRETURN, F_NOT, 0);
+ action->opcode = O_CALLRETURN;
+ action->len = F_INSN_SIZE(ipfw_insn_u32) | F_NOT;
+ CHECK_ACTLEN;
+ if (*av != NULL) {
+ /*
+ * Return type is optional.
+ * By default we use RETURN_NEXT_RULENUM.
+ */
+ i = match_token(return_types, *av);
+ if (i >= 0) {
+ action->arg1 = i;
+ av++;
+ } else
+ action->arg1 = RETURN_NEXT_RULENUM;
+ }
break;
case TOK_SETMARK: {
@@ -4395,8 +4559,7 @@
if (strcmp(*av, "tablearg") == 0) {
action->arg1 = IP_FW_TARG;
} else {
- ((ipfw_insn_u32 *)action)->d[0] =
- strtoul(*av, NULL, 0);
+ insntod(action, u32)->d[0] = strtoul(*av, NULL, 0);
/* This is not a tablearg */
action->arg1 |= 0x8000;
}
@@ -4407,12 +4570,16 @@
case TOK_TCPSETMSS: {
u_long mss;
- uint16_t idx;
+ uint32_t idx;
idx = pack_object(tstate, "tcp-setmss", IPFW_TLV_EACTION);
if (idx == 0)
errx(EX_DATAERR, "pack_object failed");
- fill_cmd(action, O_EXTERNAL_ACTION, 0, idx);
+ action->opcode = O_EXTERNAL_ACTION;
+ action->len = F_INSN_SIZE(ipfw_insn_kidx);
+ CHECK_ACTLEN;
+ insntod(action, kidx)->kidx = idx;
+
NEED1("Missing MSS value");
action = next_cmd(action, &ablen);
action->len = 1;
@@ -4438,7 +4605,7 @@
* syntax.
*/
case TOK_EACTION: {
- uint16_t idx;
+ uint32_t idx;
NEED1("Missing eaction name");
if (eaction_check_name(*av) != 0)
@@ -4446,12 +4613,13 @@
idx = pack_object(tstate, *av, IPFW_TLV_EACTION);
if (idx == 0)
errx(EX_DATAERR, "pack_object failed");
- fill_cmd(action, O_EXTERNAL_ACTION, 0, idx);
+ action->opcode = O_EXTERNAL_ACTION;
+ action->len = F_INSN_SIZE(ipfw_insn_kidx);
+ CHECK_ACTLEN;
+ insntod(action, kidx)->kidx = idx;
+
av++;
NEED1("Missing eaction instance name");
- action = next_cmd(action, &ablen);
- action->len = 1;
- CHECK_ACTLEN;
if (eaction_check_name(*av) != 0)
errx(EX_DATAERR, "Invalid eaction instance name %s",
*av);
@@ -4463,7 +4631,11 @@
idx = pack_object(tstate, *av, 0);
if (idx == 0)
errx(EX_DATAERR, "pack_object failed");
- fill_cmd(action, O_EXTERNAL_INSTANCE, 0, idx);
+ action = next_cmd(action, &ablen);
+ action->opcode = O_EXTERNAL_INSTANCE;
+ action->len = F_INSN_SIZE(ipfw_insn_kidx);
+ CHECK_ACTLEN;
+ insntod(action, kidx)->kidx = idx;
av++;
}
}
@@ -4491,6 +4663,15 @@
cmd->len = F_INSN_SIZE(ipfw_insn_log);
CHECK_CMDLEN;
cmd->opcode = O_LOG;
+ cmd->arg1 = IPFW_LOG_DEFAULT;
+ /* logdst before logamount */
+ if (av[0] && _substrcmp(*av, "logdst") == 0) {
+ av++;
+ NEED1("logdst requires argument");
+ cmd->arg1 = parse_logdst(*av);
+ av++;
+ }
+
if (av[0] && _substrcmp(*av, "logamount") == 0) {
av++;
NEED1("logamount requires argument");
@@ -4512,6 +4693,14 @@
"net.inet.ip.fw.verbose_limit");
}
}
+
+ /* logdst after logamount */
+ if (av[0] && _substrcmp(*av, "logdst") == 0) {
+ av++;
+ NEED1("logdst requires argument");
+ cmd->arg1 = parse_logdst(*av);
+ av++;
+ }
}
break;
@@ -4824,7 +5013,7 @@
case TOK_VIA:
NEED1("recv, xmit, via require interface name"
" or address");
- fill_iface((ipfw_insn_if *)cmd, av[0], cblen, tstate);
+ fill_iface(insntod(cmd, if), av[0], cblen, tstate);
av++;
if (F_LEN(cmd) == 0) /* not a valid address */
break;
@@ -5034,7 +5223,7 @@
case TOK_KEEPSTATE:
case TOK_RECORDSTATE: {
- uint16_t uidx;
+ uint32_t uidx;
if (open_par)
errx(EX_USAGE, "keep-state or record-state cannot be part "
@@ -5054,13 +5243,16 @@
IPFW_TLV_STATE_NAME);
have_state = cmd;
have_rstate = i == TOK_RECORDSTATE;
- fill_cmd(cmd, O_KEEP_STATE, 0, uidx);
+ cmd->opcode = O_KEEP_STATE;
+ cmd->len = F_INSN_SIZE(ipfw_insn_kidx);
+ CHECK_CMDLEN;
+ insntod(have_state, kidx)->kidx = uidx;
break;
}
case TOK_LIMIT:
case TOK_SETLIMIT: {
- ipfw_insn_limit *c = (ipfw_insn_limit *)cmd;
+ ipfw_insn_limit *c = insntod(cmd, limit);
int val;
if (open_par)
@@ -5072,10 +5264,10 @@
have_state = cmd;
have_rstate = i == TOK_SETLIMIT;
+ cmd->opcode = O_LIMIT;
cmd->len = F_INSN_SIZE(ipfw_insn_limit);
CHECK_CMDLEN;
- cmd->opcode = O_LIMIT;
- c->limit_mask = c->conn_limit = 0;
+ c->limit_mask = c->conn_limit = c->kidx = 0;
while ( av[0] != NULL ) {
if ((val = match_token(limit_masks, *av)) <= 0)
@@ -5095,11 +5287,11 @@
if (state_check_name(*av + 1) != 0)
errx(EX_DATAERR,
"Invalid state name %s", *av);
- cmd->arg1 = pack_object(tstate, *av + 1,
+ c->kidx = pack_object(tstate, *av + 1,
IPFW_TLV_STATE_NAME);
av++;
} else
- cmd->arg1 = pack_object(tstate,
+ c->kidx = pack_object(tstate,
default_state_name, IPFW_TLV_STATE_NAME);
break;
}
@@ -5256,24 +5448,55 @@
break;
case TOK_LOOKUP: {
- ipfw_insn_u32 *c = (ipfw_insn_u32 *)cmd;
+ /* optional mask for some LOOKUP types */
+ ipfw_insn_table *c = insntod(cmd, table);
+ char *lkey;
if (!av[0] || !av[1])
- errx(EX_USAGE, "format: lookup argument tablenum");
+ errx(EX_USAGE,
+ "format: lookup argument tablenum");
cmd->opcode = O_IP_DST_LOOKUP;
- cmd->len |= F_INSN_SIZE(ipfw_insn) + 2;
- i = match_token(lookup_keys, *av);
- if (i == -1)
- errx(EX_USAGE, "format: cannot lookup on %s", *av);
- __PAST_END(c->d, 1) = i;
- av++;
- if ((i = pack_table(tstate, *av)) == 0)
- errx(EX_DATAERR, "Invalid table name: %s", *av);
+ lkey = strsep(av, ":");
+ i = match_token(lookup_keys, lkey);
+ if (i == -1)
+ errx(EX_USAGE,
+ "format: cannot lookup on %s", lkey);
+ /* masked lookup key */
+ if (*av != NULL) {
+ switch (i) {
+ case LOOKUP_DST_PORT:
+ case LOOKUP_SRC_PORT:
+ case LOOKUP_UID:
+ case LOOKUP_JAIL:
+ case LOOKUP_DSCP:
+ case LOOKUP_MARK:
+ case LOOKUP_RULENUM:
+ break;
+ default:
+ errx(EX_USAGE,
+ "masked lookup is not supported "
+ "for %s", lkey);
+ }
+ cmd->len |= F_INSN_SIZE(ipfw_insn_table);
+ c->value = strtoul(*av, NULL, 0);
+ if (c->value == 0)
+ errx(EX_USAGE,
+ "all-zeroes bitmask for lookup "
+ "is meaningless");
+ } else {
+ cmd->len |= F_INSN_SIZE(ipfw_insn_kidx);
+ }
+ CHECK_CMDLEN;
- cmd->arg1 = i;
+ IPFW_SET_LOOKUP_TYPE(cmd, i);
av++;
- }
+ c->kidx = pack_table(tstate, *av);
+ if (c->kidx == 0)
+ errx(EX_DATAERR,
+ "Invalid table name: %s", *av);
+ av++;
+ }
break;
case TOK_FLOW:
NEED1("missing table name");
@@ -5336,7 +5559,9 @@
* generate O_PROBE_STATE if necessary
*/
if (have_state && have_state->opcode != O_CHECK_STATE && !have_rstate) {
- fill_cmd(dst, O_PROBE_STATE, 0, have_state->arg1);
+ dst->opcode = O_PROBE_STATE;
+ dst->len = F_INSN_SIZE(ipfw_insn_kidx);
+ insntod(dst, kidx)->kidx = insntod(have_state, kidx)->kidx;
dst = next_cmd(dst, &rblen);
}
@@ -5458,7 +5683,7 @@
}
struct object_kt {
- uint16_t uidx;
+ uint32_t uidx;
uint16_t type;
};
static int
@@ -5492,7 +5717,7 @@
* Returns table name or NULL.
*/
static char *
-object_search_ctlv(ipfw_obj_ctlv *ctlv, uint16_t idx, uint16_t type)
+object_search_ctlv(ipfw_obj_ctlv *ctlv, uint32_t idx, uint16_t type)
{
ipfw_obj_ntlv *ntlv;
struct object_kt key;
@@ -5510,7 +5735,7 @@
}
static char *
-table_search_ctlv(ipfw_obj_ctlv *ctlv, uint16_t idx)
+table_search_ctlv(ipfw_obj_ctlv *ctlv, uint32_t idx)
{
return (object_search_ctlv(ctlv, idx, IPFW_TLV_TBL_NAME));
diff --git a/sbin/ipfw/nat64lsn.c b/sbin/ipfw/nat64lsn.c
--- a/sbin/ipfw/nat64lsn.c
+++ b/sbin/ipfw/nat64lsn.c
@@ -380,6 +380,8 @@
{ "-log", TOK_LOGOFF },
{ "allow_private", TOK_PRIVATE },
{ "-allow_private", TOK_PRIVATEOFF },
+ { "swap_conf", TOK_SWAPCONF },
+ { "-swap_conf", TOK_SWAPCONFOFF },
/* for compatibility with old configurations */
{ "max_ports", TOK_MAX_PORTS }, /* unused */
{ NULL, 0 }
@@ -514,6 +516,12 @@
case TOK_PRIVATEOFF:
cfg->flags &= ~NAT64_ALLOW_PRIVATE;
break;
+ case TOK_SWAPCONF:
+ cfg->flags |= NAT64LSN_ALLOW_SWAPCONF;
+ break;
+ case TOK_SWAPCONFOFF:
+ cfg->flags &= ~NAT64LSN_ALLOW_SWAPCONF;
+ break;
}
}
@@ -631,6 +639,12 @@
case TOK_PRIVATEOFF:
cfg->flags &= ~NAT64_ALLOW_PRIVATE;
break;
+ case TOK_SWAPCONF:
+ cfg->flags |= NAT64LSN_ALLOW_SWAPCONF;
+ break;
+ case TOK_SWAPCONFOFF:
+ cfg->flags &= ~NAT64LSN_ALLOW_SWAPCONF;
+ break;
default:
errx(EX_USAGE, "Can't change %s option", opt);
}
@@ -796,6 +810,8 @@
printf(" icmp_age %u", cfg->st_icmp_ttl);
if (g_co.verbose || cfg->jmaxlen != NAT64LSN_JMAXLEN)
printf(" jmaxlen %u", cfg->jmaxlen);
+ if (cfg->flags & NAT64LSN_ALLOW_SWAPCONF)
+ printf(" swap_conf");
if (cfg->flags & NAT64_LOG)
printf(" log");
if (cfg->flags & NAT64_ALLOW_PRIVATE)
diff --git a/sbin/ipfw/tables.c b/sbin/ipfw/tables.c
--- a/sbin/ipfw/tables.c
+++ b/sbin/ipfw/tables.c
@@ -312,7 +312,7 @@
void
table_fill_ntlv(ipfw_obj_ntlv *ntlv, const char *name, uint8_t set,
- uint16_t uidx)
+ uint32_t uidx)
{
ntlv->head.type = IPFW_TLV_TBL_NAME;
diff --git a/sbin/route/route.c b/sbin/route/route.c
--- a/sbin/route/route.c
+++ b/sbin/route/route.c
@@ -1663,6 +1663,7 @@
"RTM_DELMADDR: multicast group membership removed from iface",
"RTM_IFANNOUNCE: interface arrival/departure",
"RTM_IEEE80211: IEEE 802.11 wireless event",
+ "RTM_IPFWLOG: IPFW log",
};
static const char metricnames[] =
diff --git a/sys/net/route.h b/sys/net/route.h
--- a/sys/net/route.h
+++ b/sys/net/route.h
@@ -295,6 +295,7 @@
#define RTM_DELMADDR 0x10 /* (4) mcast group membership being deleted */
#define RTM_IFANNOUNCE 0x11 /* (5) iface arrival/departure */
#define RTM_IEEE80211 0x12 /* (5) IEEE80211 wireless event */
+#define RTM_IPFWLOG 0x13 /* (1) IPFW rule match log event */
#endif /* NETLINK_COMPAT*/
diff --git a/sys/netinet/ip_fw.h b/sys/netinet/ip_fw.h
--- a/sys/netinet/ip_fw.h
+++ b/sys/netinet/ip_fw.h
@@ -75,6 +75,10 @@
uint16_t reserved[2]; /* Align to 64-bit boundary */
} ip_fw3_opheader;
+#define IP_FW3_OPVER_0 0
+#define IP_FW3_OPVER_1 1 /* 32bit rulenum */
+#define IP_FW3_OPVER IP_FW3_OPVER_1
+
/* IP_FW3 opcodes */
#define IP_FW_TABLE_XADD 86 /* add entry */
#define IP_FW_TABLE_XDEL 87 /* delete entry */
@@ -109,6 +113,7 @@
#define IP_FW_DUMP_SOPTCODES 116 /* Dump available sopts/versions */
#define IP_FW_DUMP_SRVOBJECTS 117 /* Dump existing named objects */
+#define IP_FW_SKIPTO_CACHE 118 /* Manage skipto cache */
#define IP_FW_NAT64STL_CREATE 130 /* Create stateless NAT64 instance */
#define IP_FW_NAT64STL_DESTROY 131 /* Destroy stateless NAT64 instance */
@@ -211,8 +216,8 @@
O_VERREVPATH, /* none */
O_VERSRCREACH, /* none */
- O_PROBE_STATE, /* none */
- O_KEEP_STATE, /* none */
+ O_PROBE_STATE, /* v0:arg1=kidx, v1:kidx=kidx */
+ O_KEEP_STATE, /* v0:arg1=kidx, v1:kidx=kidx */
O_LIMIT, /* ipfw_insn_limit */
O_LIMIT_PARENT, /* dyn_type, not an opcode. */
@@ -223,12 +228,13 @@
O_LOG, /* ipfw_insn_log */
O_PROB, /* u32 = match probability */
- O_CHECK_STATE, /* none */
+ O_CHECK_STATE, /* v0:arg1=kidx, v1:kidx=kidx */
O_ACCEPT, /* none */
O_DENY, /* none */
O_REJECT, /* arg1=icmp arg (same as deny) */
O_COUNT, /* none */
- O_SKIPTO, /* arg1=next rule number */
+ O_SKIPTO, /* v0:arg1=next rule number */
+ /* v1:kidx= next rule number */
O_PIPE, /* arg1=pipe number */
O_QUEUE, /* arg1=queue number */
O_DIVERT, /* arg1=port number */
@@ -242,8 +248,10 @@
* More opcodes.
*/
O_IPSEC, /* has ipsec history */
- O_IP_SRC_LOOKUP, /* arg1=table number, u32=value */
+ O_IP_SRC_LOOKUP, /* v0:arg1=table number, u32=value */
+ /* v1:kidx=name, u32=value, arg1=key */
O_IP_DST_LOOKUP, /* arg1=table number, u32=value */
+ /* v1:kidx=name, u32=value, arg1=key */
O_ANTISPOOF, /* none */
O_JAIL, /* u32 = id */
O_ALTQ, /* u32 = altq classif. qid */
@@ -278,23 +286,27 @@
O_SOCKARG, /* socket argument */
- O_CALLRETURN, /* arg1=called rule number */
+ O_CALLRETURN, /* v0:arg1=called rule number */
+ /* v1:kidx=called rule number */
O_FORWARD_IP6, /* fwd sockaddr_in6 */
O_DSCP, /* 2 u32 = DSCP mask */
O_SETDSCP, /* arg1=DSCP value */
- O_IP_FLOW_LOOKUP, /* arg1=table number, u32=value */
+ O_IP_FLOW_LOOKUP, /* v0:arg1=table number, u32=value */
+ /* v1:kidx=name, u32=value */
- O_EXTERNAL_ACTION, /* arg1=id of external action handler */
- O_EXTERNAL_INSTANCE, /* arg1=id of eaction handler instance */
+ O_EXTERNAL_ACTION, /* v0:arg1=id of external action handler */
+ /* v1:kidx=id of external action handler */
+ O_EXTERNAL_INSTANCE, /* v0:arg1=id of eaction handler instance */
+ /* v1:kidx=id of eaction handler instance */
O_EXTERNAL_DATA, /* variable length data */
O_SKIP_ACTION, /* none */
O_TCPMSS, /* arg1=MSS value */
- O_MAC_SRC_LOOKUP, /* arg1=table number, u32=value */
- O_MAC_DST_LOOKUP, /* arg1=table number, u32=value */
+ O_MAC_SRC_LOOKUP, /* kidx=name, u32=value, arg1=key */
+ O_MAC_DST_LOOKUP, /* kidx=name, u32=value, arg1=key */
O_SETMARK, /* u32 = value */
O_MARK, /* 2 u32 = value, bitmask */
@@ -302,22 +314,6 @@
O_LAST_OPCODE /* not an opcode! */
};
-/*
- * Defines key types used by lookup instruction
- */
-enum ipfw_table_lookup_type {
- LOOKUP_DST_IP,
- LOOKUP_SRC_IP,
- LOOKUP_DST_PORT,
- LOOKUP_SRC_PORT,
- LOOKUP_UID,
- LOOKUP_JAIL,
- LOOKUP_DSCP,
- LOOKUP_DST_MAC,
- LOOKUP_SRC_MAC,
- LOOKUP_MARK,
-};
-
/*
* The extension header are filtered only for presence using a bit
* vector with a flag for each header.
@@ -392,6 +388,11 @@
u_int32_t d[1]; /* one or more */
} ipfw_insn_u32;
+typedef struct _ipfw_insn_kidx {
+ ipfw_insn o;
+ uint32_t kidx;
+} ipfw_insn_kidx;
+
/*
* This is used to store IP addr-mask pairs.
*/
@@ -401,6 +402,47 @@
struct in_addr mask;
} ipfw_insn_ip;
+typedef struct _ipfw_insn_table {
+ ipfw_insn o; /* arg1 is optional lookup key */
+ uint32_t kidx; /* table name index */
+ uint32_t value; /* table value */
+} ipfw_insn_table;
+
+#define IPFW_LOOKUP_TYPE_MASK 0x00FF
+#define IPFW_LOOKUP_TYPE(insn) ((insn)->arg1 & IPFW_LOOKUP_TYPE_MASK)
+#define IPFW_SET_LOOKUP_TYPE(insn, type) do { \
+ (insn)->arg1 &= ~IPFW_LOOKUP_TYPE_MASK; \
+ (insn)->arg1 |= (type) & IPFW_LOOKUP_TYPE_MASK; \
+} while (0)
+
+/*
+ * Defines key types used by lookup instruction
+ */
+enum ipfw_table_lookup_type {
+ LOOKUP_NONE = 0,
+ LOOKUP_DST_IP,
+ LOOKUP_SRC_IP,
+ LOOKUP_DST_PORT,
+ LOOKUP_SRC_PORT,
+ LOOKUP_UID,
+ LOOKUP_JAIL,
+ LOOKUP_DSCP,
+ LOOKUP_DST_MAC,
+ LOOKUP_SRC_MAC,
+ LOOKUP_MARK,
+ LOOKUP_RULENUM,
+};
+
+enum ipfw_return_type {
+ RETURN_NEXT_RULENUM = 0,
+ RETURN_NEXT_RULE,
+};
+
+enum ipfw_skipto_cache_op {
+ SKIPTO_CACHE_DISABLE = 0,
+ SKIPTO_CACHE_ENABLE,
+};
+
/*
* This is used to forward to a given address (ip).
*/
@@ -434,7 +476,8 @@
union {
struct in_addr ip;
int glob;
- uint16_t kidx;
+ uint16_t kidx_v0;
+ uint32_t kidx;
} p;
char name[IFNAMSIZ];
} ipfw_insn_if;
@@ -452,6 +495,7 @@
*/
typedef struct _ipfw_insn_limit {
ipfw_insn o;
+ u_int32_t kidx;
u_int8_t _pad;
u_int8_t limit_mask; /* combination of DYN_* below */
#define DYN_SRC_ADDR 0x1
@@ -462,6 +506,9 @@
u_int16_t conn_limit;
} ipfw_insn_limit;
+/* MAC/InfiniBand/etc address length */
+#define IPFW_MAX_L2_ADDR_LEN 20
+
/*
* This is used for log instructions.
*/
@@ -471,6 +518,22 @@
u_int32_t log_left; /* how many left to log */
} ipfw_insn_log;
+/* ipfw_insn_log->o.arg1 bitmasks */
+#define IPFW_LOG_DEFAULT 0x0000
+#define IPFW_LOG_SYSLOG (1 << 15)
+#define IPFW_LOG_IPFW0 (1 << 14)
+#define IPFW_LOG_RTSOCK (1 << 13)
+
+typedef struct _ipfwlog_rtsock_hdr_v2 {
+ uint32_t rulenum;
+ uint32_t tablearg;
+ ipfw_insn cmd;
+ u_char ether_shost[IPFW_MAX_L2_ADDR_LEN];
+ u_char ether_dhost[IPFW_MAX_L2_ADDR_LEN];
+ uint32_t mark;
+ char comment[0];
+} ipfwlog_rtsock_hdr_v2;
+
/* Legacy NAT structures, compat only */
#ifndef _KERNEL
/*
@@ -604,6 +667,10 @@
*/
} ipfw_insn_icmp6;
+/* Convert pointer to instruction with specified type */
+#define insntod(p, type) ((ipfw_insn_ ## type *)(p))
+#define insntoc(p, type) ((const ipfw_insn_ ## type *)(p))
+
/*
* Here we have the structure representing an ipfw rule.
*
@@ -719,30 +786,29 @@
/*
* Dynamic ipfw rule.
*/
-typedef struct _ipfw_dyn_rule ipfw_dyn_rule;
-
-struct _ipfw_dyn_rule {
- ipfw_dyn_rule *next; /* linked list of rules. */
- struct ip_fw *rule; /* pointer to rule */
- /* 'rule' is used to pass up the rule number (from the parent) */
+#define IPFW_DYN_ORPHANED 0x40000 /* state's parent rule was deleted */
- ipfw_dyn_rule *parent; /* pointer to parent rule */
- u_int64_t pcnt; /* packet match counter */
- u_int64_t bcnt; /* byte match counter */
+typedef struct _ipfw_dyn_rule {
struct ipfw_flow_id id; /* (masked) flow id */
- u_int32_t expire; /* expire time */
- u_int32_t bucket; /* which bucket in hash table */
- u_int32_t state; /* state of this rule (typically a
+ uint8_t set;
+ uint8_t type; /* rule type */
+ uint16_t pad;
+ uint32_t expire; /* expire time */
+ uint32_t rulenum; /* parent's rule number */
+ uint32_t kidx; /* index of named object */
+ uint64_t pcnt; /* packet match counter */
+ uint64_t bcnt; /* byte match counter */
+ uint32_t hashval; /* hash value */
+ union {
+ uint32_t state; /* state of this rule (typically a
* combination of TCP flags)
*/
-#define IPFW_DYN_ORPHANED 0x40000 /* state's parent rule was deleted */
- u_int32_t ack_fwd; /* most recent ACKs in forward */
- u_int32_t ack_rev; /* and reverse directions (used */
+ uint32_t count; /* number of linked states */
+ };
+ uint32_t ack_fwd; /* most recent ACKs in forward */
+ uint32_t ack_rev; /* and reverse directions (used */
/* to generate keepalives) */
- u_int16_t dyn_type; /* rule type */
- u_int16_t count; /* refcount */
- u_int16_t kidx; /* index of named object */
-} __packed __aligned(8);
+} __packed __aligned(8) ipfw_dyn_rule;
/*
* Definitions for IP option names.
@@ -794,16 +860,6 @@
#define IPFW_VTYPE_NH6 0x00000400 /* IPv6 nexthop */
#define IPFW_VTYPE_MARK 0x00000800 /* [fw]mark */
-/* MAC/InfiniBand/etc address length */
-#define IPFW_MAX_L2_ADDR_LEN 20
-
-typedef struct _ipfw_table_entry {
- in_addr_t addr; /* network address */
- u_int32_t value; /* value */
- u_int16_t tbl; /* table number */
- u_int8_t masklen; /* mask length */
-} ipfw_table_entry;
-
typedef struct _ipfw_table_xentry {
uint16_t len; /* Total entry length */
uint8_t type; /* entry type */
@@ -819,13 +875,6 @@
} ipfw_table_xentry;
#define IPFW_TCF_INET 0x01 /* CIDR flags: IPv4 record */
-typedef struct _ipfw_table {
- u_int32_t size; /* size of entries in bytes */
- u_int32_t cnt; /* # of entries */
- u_int16_t tbl; /* table number */
- ipfw_table_entry ent[0]; /* entries */
-} ipfw_table;
-
typedef struct _ipfw_xtable {
ip_fw3_opheader opheader; /* IP_FW3 opcode */
uint32_t size; /* size of entries in bytes */
@@ -865,10 +914,10 @@
/* Object name TLV */
typedef struct _ipfw_obj_ntlv {
ipfw_obj_tlv head; /* TLV header */
- uint16_t idx; /* Name index */
+ uint32_t idx; /* Name index */
uint8_t set; /* set, if applicable */
uint8_t type; /* object type, if applicable */
- uint32_t spare; /* unused */
+ uint16_t spare; /* unused */
char name[64]; /* Null-terminated name */
} ipfw_obj_ntlv;
@@ -891,19 +940,40 @@
} a;
};
+#define IPFW_TVALUE_TYPE_MASK 0xFF00
+#define IPFW_TVALUE_TYPE(insn) (((insn)->arg1 & IPFW_TVALUE_TYPE_MASK) >> 8)
+#define IPFW_SET_TVALUE_TYPE(insn, type) do { \
+ (insn)->arg1 &= ~IPFW_TVALUE_TYPE_MASK; \
+ (insn)->arg1 |= ((type) << 8) & IPFW_TVALUE_TYPE_MASK; \
+} while (0)
+
+enum ipfw_table_value_type {
+ TVALUE_TAG = 0,
+ TVALUE_PIPE,
+ TVALUE_DIVERT,
+ TVALUE_SKIPTO,
+ TVALUE_NETGRAPH,
+ TVALUE_FIB,
+ TVALUE_NAT,
+ TVALUE_NH4,
+ TVALUE_DSCP,
+ TVALUE_LIMIT,
+ TVALUE_MARK,
+};
+
/* 64-byte structure representing multi-field table value */
typedef struct _ipfw_table_value {
uint32_t tag; /* O_TAG/O_TAGGED */
- uint32_t pipe; /* O_PIPE/O_QUEUE */
+ uint16_t pipe; /* O_PIPE/O_QUEUE */
uint16_t divert; /* O_DIVERT/O_TEE */
- uint16_t skipto; /* skipto, CALLRET */
+ uint32_t skipto; /* skipto, CALLRET */
uint32_t netgraph; /* O_NETGRAPH/O_NGTEE */
- uint32_t fib; /* O_SETFIB */
uint32_t nat; /* O_NAT */
uint32_t nh4;
+ uint16_t fib; /* O_SETFIB */
uint8_t dscp;
uint8_t spare0;
- uint16_t kidx; /* value kernel index */
+ uint32_t kidx; /* value kernel index */
struct in6_addr nh6;
uint32_t limit; /* O_LIMIT */
uint32_t zoneid; /* scope zone id for nh6 */
@@ -918,8 +988,7 @@
uint8_t masklen; /* mask length */
uint8_t result; /* request result */
uint8_t spare0;
- uint16_t idx; /* Table name index */
- uint16_t spare1;
+ uint32_t idx; /* Table name index */
union {
/* Longest field needs to be aligned by 8-byte boundary */
struct in_addr addr; /* IPv4 address */
@@ -966,8 +1035,8 @@
typedef struct _ipfw_range_tlv {
ipfw_obj_tlv head; /* TLV header */
uint32_t flags; /* Range flags */
- uint16_t start_rule; /* Range start */
- uint16_t end_rule; /* Range end */
+ uint32_t start_rule; /* Range start */
+ uint32_t end_rule; /* Range end */
uint32_t set; /* Range set to match */
uint32_t new_set; /* New set to move/swap to */
} ipfw_range_tlv;
@@ -1051,10 +1120,16 @@
uint64_t spare1;
} ipfw_ta_info;
+typedef struct _ipfw_cmd_header { /* control command header */
+ ip_fw3_opheader opheader; /* IP_FW3 opcode */
+ uint32_t size; /* Total size (incl. header) */
+ uint32_t cmd; /* command */
+} ipfw_cmd_header;
+
typedef struct _ipfw_obj_header {
ip_fw3_opheader opheader; /* IP_FW3 opcode */
- uint32_t spare;
- uint16_t idx; /* object name index */
+ uint32_t idx; /* object name index */
+ uint16_t spare;
uint8_t objtype; /* object type */
uint8_t objsubtype; /* object subtype */
ipfw_obj_ntlv ntlv; /* object name tlv */
diff --git a/sys/netinet6/ip_fw_nat64.h b/sys/netinet6/ip_fw_nat64.h
--- a/sys/netinet6/ip_fw_nat64.h
+++ b/sys/netinet6/ip_fw_nat64.h
@@ -84,9 +84,9 @@
uint64_t spgcreated; /* Number of portgroups created */
uint64_t spgdeleted; /* Number of portgroups deleted */
uint64_t hostcount; /* Number of hosts */
- uint64_t tcpchunks; /* Number of TCP chunks */
- uint64_t udpchunks; /* Number of UDP chunks */
- uint64_t icmpchunks; /* Number of ICMP chunks */
+ uint64_t tcpchunks; /* Number of TCP portgroups */
+ uint64_t udpchunks; /* Number of UDP portgroups */
+ uint64_t icmpchunks; /* Number of ICMP portgroups */
uint64_t _reserved[4];
};
@@ -95,6 +95,10 @@
#define NAT64_ALLOW_PRIVATE 0x0002 /* Allow private IPv4 address
* translation
*/
+#define NAT64LSN_ALLOW_SWAPCONF 0x0004 /* Allow configuration exchange
+ * between NAT64LSN instances
+ * during the sets swapping.
+ */
typedef struct _ipfw_nat64stl_cfg {
char name[64]; /* NAT name */
ipfw_obj_ntlv ntlv6; /* object name tlv */
diff --git a/sys/netpfil/ipfw/ip_fw2.c b/sys/netpfil/ipfw/ip_fw2.c
--- a/sys/netpfil/ipfw/ip_fw2.c
+++ b/sys/netpfil/ipfw/ip_fw2.c
@@ -144,16 +144,15 @@
/* Use 128 tables by default */
static unsigned int default_fw_tables = IPFW_TABLES_DEFAULT;
-static int jump_lookup_pos(struct ip_fw_chain *chain, struct ip_fw *f, int num,
- int tablearg, int jump_backwards);
-#ifndef LINEAR_SKIPTO
-static int jump_cached(struct ip_fw_chain *chain, struct ip_fw *f, int num,
- int tablearg, int jump_backwards);
-#define JUMP(ch, f, num, targ, back) jump_cached(ch, f, num, targ, back)
+#ifndef IPFIREWALL_LINEAR_SKIPTO
+VNET_DEFINE(int, skipto_cache) = 0;
#else
-#define JUMP(ch, f, num, targ, back) jump_lookup_pos(ch, f, num, targ, back)
+VNET_DEFINE(int, skipto_cache) = 1;
#endif
+static uint32_t jump(struct ip_fw_chain *chain, struct ip_fw *f,
+ uint32_t num, int tablearg, bool jump_backwards);
+
/*
* Each rule belongs to one of 32 different sets (0..31).
* The variable set_disable contains one bit per set.
@@ -207,6 +206,9 @@
SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, verbose_limit,
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(verbose_limit), 0,
"Set upper limit of matches of ipfw rules logged");
+SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, skipto_cache,
+ CTLFLAG_VNET | CTLFLAG_RD, &VNET_NAME(skipto_cache), 0,
+ "Status of linear skipto cache: 1 - enabled, 0 - disabled.");
SYSCTL_UINT(_net_inet_ip_fw, OID_AUTO, default_rule, CTLFLAG_RD,
&dummy_def, 0,
"The default/max possible rule number.");
@@ -1228,38 +1230,36 @@
args->flags |= IPFW_ARGS_REF;
}
-static int
-jump_lookup_pos(struct ip_fw_chain *chain, struct ip_fw *f, int num,
- int tablearg, int jump_backwards)
+static uint32_t
+jump_lookup_pos(struct ip_fw_chain *chain, struct ip_fw *f, uint32_t num,
+ int tablearg, bool jump_backwards)
{
int f_pos, i;
+ /*
+ * Make sure we do not jump backward.
+ */
i = IP_FW_ARG_TABLEARG(chain, num, skipto);
- /* make sure we do not jump backward */
- if (jump_backwards == 0 && i <= f->rulenum)
+ if (!jump_backwards && i <= f->rulenum)
i = f->rulenum + 1;
-#ifndef LINEAR_SKIPTO
- if (chain->idxmap != NULL)
- f_pos = chain->idxmap[i];
- else
+ if (V_skipto_cache == 0)
f_pos = ipfw_find_rule(chain, i, 0);
-#else
- f_pos = chain->idxmap[i];
-#endif /* LINEAR_SKIPTO */
+ else {
+ /*
+ * Make sure we do not do out of bounds access.
+ */
+ if (i >= IPFW_DEFAULT_RULE)
+ i = IPFW_DEFAULT_RULE - 1;
+ f_pos = chain->idxmap[i];
+ }
return (f_pos);
}
-
-#ifndef LINEAR_SKIPTO
-/*
- * Helper function to enable cached rule lookups using
- * cache.id and cache.pos fields in ipfw rule.
- */
-static int
-jump_cached(struct ip_fw_chain *chain, struct ip_fw *f, int num,
- int tablearg, int jump_backwards)
+static uint32_t
+jump(struct ip_fw_chain *chain, struct ip_fw *f, uint32_t num,
+ int tablearg, bool jump_backwards)
{
int f_pos;
@@ -1304,9 +1304,54 @@
#endif /* !__LP64__ */
return (f_pos);
}
-#endif /* !LINEAR_SKIPTO */
#define TARG(k, f) IP_FW_ARG_TABLEARG(chain, k, f)
+
+static inline int
+tvalue_match(struct ip_fw_chain *ch, const ipfw_insn_table *cmd,
+ uint32_t tablearg)
+{
+ uint32_t tvalue;
+
+ switch (IPFW_TVALUE_TYPE(&cmd->o)) {
+ case TVALUE_PIPE:
+ tvalue = TARG_VAL(ch, tablearg, pipe);
+ break;
+ case TVALUE_DIVERT:
+ tvalue = TARG_VAL(ch, tablearg, divert);
+ break;
+ case TVALUE_SKIPTO:
+ tvalue = TARG_VAL(ch, tablearg, skipto);
+ break;
+ case TVALUE_NETGRAPH:
+ tvalue = TARG_VAL(ch, tablearg, netgraph);
+ break;
+ case TVALUE_FIB:
+ tvalue = TARG_VAL(ch, tablearg, fib);
+ break;
+ case TVALUE_NAT:
+ tvalue = TARG_VAL(ch, tablearg, nat);
+ break;
+ case TVALUE_NH4:
+ tvalue = TARG_VAL(ch, tablearg, nh4);
+ break;
+ case TVALUE_DSCP:
+ tvalue = TARG_VAL(ch, tablearg, dscp);
+ break;
+ case TVALUE_LIMIT:
+ tvalue = TARG_VAL(ch, tablearg, limit);
+ break;
+ case TVALUE_MARK:
+ tvalue = TARG_VAL(ch, tablearg, mark);
+ break;
+ case TVALUE_TAG:
+ default:
+ tvalue = TARG_VAL(ch, tablearg, tag);
+ break;
+ }
+ return (tvalue == cmd->value);
+}
+
/*
* The main check routine for the firewall.
*
@@ -1381,8 +1426,8 @@
#else
struct ucred *ucred_cache = NULL;
#endif
+ uint32_t f_pos = 0; /* index of current rule in the array */
int ucred_lookup = 0;
- int f_pos = 0; /* index of current rule in the array */
int retval = 0;
struct ifnet *oif, *iif;
@@ -2045,104 +2090,133 @@
break;
case O_IP_DST_LOOKUP:
- {
- if (cmdlen > F_INSN_SIZE(ipfw_insn_u32)) {
- void *pkey;
- uint32_t vidx, key;
- uint16_t keylen = 0; /* zero if can't match the packet */
-
- /* Determine lookup key type */
- vidx = ((ipfw_insn_u32 *)cmd)->d[1];
- switch (vidx) {
- case LOOKUP_DST_IP:
- case LOOKUP_SRC_IP:
- /* Need IP frame */
- if (is_ipv6 == 0 && is_ipv4 == 0)
- break;
- if (vidx == LOOKUP_DST_IP)
- pkey = is_ipv6 ?
- (void *)&args->f_id.dst_ip6:
- (void *)&dst_ip;
+ if (IPFW_LOOKUP_TYPE(cmd) != LOOKUP_NONE) {
+ void *pkey = NULL;
+ uint32_t key, vidx;
+ uint16_t keylen = 0; /* zero if can't match the packet */
+ uint8_t lookup_type;
+
+ lookup_type = IPFW_LOOKUP_TYPE(cmd);
+
+ switch (lookup_type) {
+ case LOOKUP_DST_IP:
+ case LOOKUP_SRC_IP:
+ if (is_ipv4) {
+ keylen = sizeof(in_addr_t);
+ if (lookup_type == LOOKUP_DST_IP)
+ pkey = &dst_ip;
else
- pkey = is_ipv6 ?
- (void *)&args->f_id.src_ip6:
- (void *)&src_ip;
- keylen = is_ipv6 ?
- sizeof(struct in6_addr):
- sizeof(in_addr_t);
- break;
- case LOOKUP_DST_PORT:
- case LOOKUP_SRC_PORT:
- /* Need IP frame */
- if (is_ipv6 == 0 && is_ipv4 == 0)
- break;
- /* Skip fragments */
- if (offset != 0)
- break;
- /* Skip proto without ports */
- if (proto != IPPROTO_TCP &&
- proto != IPPROTO_UDP &&
- proto != IPPROTO_UDPLITE &&
- proto != IPPROTO_SCTP)
- break;
- key = vidx == LOOKUP_DST_PORT ?
- dst_port:
- src_port;
- pkey = &key;
- keylen = sizeof(key);
- break;
- case LOOKUP_UID:
- case LOOKUP_JAIL:
- check_uidgid(
- (ipfw_insn_u32 *)cmd,
- args, &ucred_lookup,
- &ucred_cache);
- key = vidx == LOOKUP_UID ?
- ucred_cache->cr_uid:
- ucred_cache->cr_prison->pr_id;
- pkey = &key;
- keylen = sizeof(key);
- break;
- case LOOKUP_DSCP:
- /* Need IP frame */
- if (is_ipv6 == 0 && is_ipv4 == 0)
- break;
- if (is_ipv6)
- key = IPV6_DSCP(
- (struct ip6_hdr *)ip) >> 2;
+ pkey = &src_ip;
+ } else if (is_ipv6) {
+ keylen = sizeof(struct in6_addr);
+ if (lookup_type == LOOKUP_DST_IP)
+ pkey = &args->f_id.dst_ip6;
else
- key = ip->ip_tos >> 2;
- pkey = &key;
- keylen = sizeof(key);
+ pkey = &args->f_id.src_ip6;
+ } else /* only for L3 */
break;
- case LOOKUP_DST_MAC:
- case LOOKUP_SRC_MAC:
- /* Need ether frame */
- if ((args->flags & IPFW_ARGS_ETHER) == 0)
- break;
- pkey = vidx == LOOKUP_DST_MAC ?
- eh->ether_dhost:
- eh->ether_shost;
- keylen = ETHER_ADDR_LEN;
+ case LOOKUP_DSCP:
+ if (is_ipv4)
+ key = ip->ip_tos >> 2;
+ else if (is_ipv6)
+ key = IPV6_DSCP(
+ (struct ip6_hdr *)ip) >> 2;
+ else
+ break; /* only for L3 */
+
+ key &= 0x3f;
+ if (cmdlen == F_INSN_SIZE(ipfw_insn_table))
+ key &= insntod(cmd, table)->value;
+ pkey = &key;
+ keylen = sizeof(key);
+ break;
+ case LOOKUP_DST_PORT:
+ case LOOKUP_SRC_PORT:
+ /* only for L3 */
+ if (is_ipv6 == 0 && is_ipv4 == 0) {
break;
- case LOOKUP_MARK:
- key = args->rule.pkt_mark;
- pkey = &key;
- keylen = sizeof(key);
+ }
+ /* Skip fragments */
+ if (offset != 0) {
break;
}
- if (keylen == 0)
+ /* Skip proto without ports */
+ if (proto != IPPROTO_TCP &&
+ proto != IPPROTO_UDP &&
+ proto != IPPROTO_UDPLITE &&
+ proto != IPPROTO_SCTP)
break;
- match = ipfw_lookup_table(chain,
- cmd->arg1, keylen, pkey, &vidx);
- if (!match)
+ if (lookup_type == LOOKUP_DST_PORT)
+ key = dst_port;
+ else
+ key = src_port;
+ pkey = &key;
+ if (cmdlen == F_INSN_SIZE(ipfw_insn_table))
+ key &= insntod(cmd, table)->value;
+ keylen = sizeof(key);
+ break;
+ case LOOKUP_DST_MAC:
+ case LOOKUP_SRC_MAC:
+ /* only for L2 */
+ if ((args->flags & IPFW_ARGS_ETHER) == 0)
break;
- tablearg = vidx;
+
+ pkey = lookup_type == LOOKUP_DST_MAC ?
+ eh->ether_dhost : eh->ether_shost;
+ keylen = ETHER_ADDR_LEN;
+ break;
+#ifndef USERSPACE
+ case LOOKUP_UID:
+ case LOOKUP_JAIL:
+ check_uidgid(insntod(cmd, u32),
+ args, &ucred_lookup,
+#ifdef __FreeBSD__
+ &ucred_cache);
+ if (lookup_type == LOOKUP_UID)
+ key = ucred_cache->cr_uid;
+ else if (lookup_type == LOOKUP_JAIL)
+ key = ucred_cache->cr_prison->pr_id;
+#else /* !__FreeBSD__ */
+ (void *)&ucred_cache);
+ if (lookup_type == LOOKUP_UID)
+ key = ucred_cache.uid;
+ else if (lookup_type == LOOKUP_JAIL)
+ key = ucred_cache.xid;
+#endif /* !__FreeBSD__ */
+ pkey = &key;
+ if (cmdlen == F_INSN_SIZE(ipfw_insn_table))
+ key &= insntod(cmd, table)->value;
+ keylen = sizeof(key);
+ break;
+#endif /* !USERSPACE */
+ case LOOKUP_MARK:
+ key = args->rule.pkt_mark;
+ if (cmdlen == F_INSN_SIZE(ipfw_insn_table))
+ key &= insntod(cmd, table)->value;
+ pkey = &key;
+ keylen = sizeof(key);
+ break;
+ case LOOKUP_RULENUM:
+ key = f->rulenum;
+ if (cmdlen == F_INSN_SIZE(ipfw_insn_table))
+ key &= insntod(cmd, table)->value;
+ pkey = &key;
+ keylen = sizeof(key);
break;
}
- /* cmdlen =< F_INSN_SIZE(ipfw_insn_u32) */
- /* FALLTHROUGH */
+ /* unknown key type */
+ if (keylen == 0)
+ break;
+ match = ipfw_lookup_table(chain,
+ insntod(cmd, kidx)->kidx, keylen,
+ pkey, &vidx);
+
+ if (match)
+ tablearg = vidx;
+ break;
}
+ /* LOOKUP_NONE */
+ /* FALLTHROUGH */
case O_IP_SRC_LOOKUP:
{
void *pkey;
@@ -2163,13 +2237,14 @@
pkey = &args->f_id.src_ip6;
} else
break;
- match = ipfw_lookup_table(chain, cmd->arg1,
+ match = ipfw_lookup_table(chain,
+ insntod(cmd, kidx)->kidx,
keylen, pkey, &vidx);
if (!match)
break;
- if (cmdlen == F_INSN_SIZE(ipfw_insn_u32)) {
- match = ((ipfw_insn_u32 *)cmd)->d[0] ==
- TARG_VAL(chain, vidx, tag);
+ if (cmdlen == F_INSN_SIZE(ipfw_insn_table)) {
+ match = tvalue_match(chain,
+ insntod(cmd, table), vidx);
if (!match)
break;
}
@@ -2193,13 +2268,14 @@
else
pkey = eh->ether_shost;
- match = ipfw_lookup_table(chain, cmd->arg1,
+ match = ipfw_lookup_table(chain,
+ insntod(cmd, kidx)->kidx,
keylen, pkey, &vidx);
if (!match)
break;
- if (cmdlen == F_INSN_SIZE(ipfw_insn_u32)) {
- match = ((ipfw_insn_u32 *)cmd)->d[0] ==
- TARG_VAL(chain, vidx, tag);
+ if (cmdlen == F_INSN_SIZE(ipfw_insn_table)) {
+ match = tvalue_match(chain,
+ insntod(cmd, table), vidx);
if (!match)
break;
}
@@ -2208,19 +2284,22 @@
}
case O_IP_FLOW_LOOKUP:
- {
- uint32_t v = 0;
- match = ipfw_lookup_table(chain,
- cmd->arg1, 0, &args->f_id, &v);
- if (!match)
- break;
- if (cmdlen == F_INSN_SIZE(ipfw_insn_u32))
- match = ((ipfw_insn_u32 *)cmd)->d[0] ==
- TARG_VAL(chain, v, tag);
- if (match)
- tablearg = v;
- }
+ {
+ uint32_t vidx = 0;
+
+ match = ipfw_lookup_table(chain,
+ insntod(cmd, kidx)->kidx, 0,
+ &args->f_id, &vidx);
+ if (!match)
+ break;
+ if (cmdlen == F_INSN_SIZE(ipfw_insn_table))
+ match = tvalue_match(chain,
+ insntod(cmd, table), vidx);
+ if (match)
+ tablearg = vidx;
break;
+ }
+
case O_IP_SRC_MASK:
case O_IP_DST_MASK:
if (is_ipv4) {
@@ -2548,7 +2627,7 @@
case O_LOG:
ipfw_log(chain, f, hlen, args,
- offset | ip6f_mf, tablearg, ip);
+ offset | ip6f_mf, tablearg, ip, eh);
match = 1;
break;
@@ -2787,14 +2866,14 @@
if (cmd->arg1 == IP_FW_TARG)
mark = TARG_VAL(chain, tablearg, mark);
else
- mark = ((ipfw_insn_u32 *)cmd)->d[0];
+ mark = insntoc(cmd, u32)->d[0];
match =
(args->rule.pkt_mark &
- ((ipfw_insn_u32 *)cmd)->d[1]) ==
- (mark & ((ipfw_insn_u32 *)cmd)->d[1]);
+ insntoc(cmd, u32)->d[1]) ==
+ (mark & insntoc(cmd, u32)->d[1]);
break;
}
-
+
/*
* The second set of opcodes represents 'actions',
* i.e. the terminal part of a rule once the packet
@@ -2942,7 +3021,8 @@
case O_SKIPTO:
IPFW_INC_RULE_COUNTER(f, pktlen);
- f_pos = JUMP(chain, f, cmd->arg1, tablearg, 0);
+ f_pos = jump(chain, f,
+ insntod(cmd, u32)->d[0], tablearg, false);
/*
* Skip disabled rules, and re-enter
* the inner loop with the correct
@@ -2976,7 +3056,7 @@
* stack pointer.
*/
struct m_tag *mtag;
- uint16_t jmpto, *stack;
+ uint32_t jmpto, *stack;
#define IS_CALL ((cmd->len & F_NOT) == 0)
#define IS_RETURN ((cmd->len & F_NOT) != 0)
@@ -2992,51 +3072,83 @@
break;
mtag = m_tag_next(m, mtag);
}
- if (mtag == NULL && IS_CALL) {
- mtag = m_tag_alloc(MTAG_IPFW_CALL, 0,
- IPFW_CALLSTACK_SIZE *
- sizeof(uint16_t), M_NOWAIT);
- if (mtag != NULL)
- m_tag_prepend(m, mtag);
+
+ /*
+ * We keep ruleset id in the first element
+ * of stack. If it doesn't match chain->id,
+ * then we can't trust information in the
+ * stack, since rules were changed.
+ * We reset stack pointer to be able reuse
+ * tag if it will be needed.
+ */
+ if (mtag != NULL) {
+ stack = (uint32_t *)(mtag + 1);
+ if (stack[0] != chain->id) {
+ stack[0] = chain->id;
+ mtag->m_tag_id = 0;
+ }
}
/*
- * On error both `call' and `return' just
- * continue with next rule.
+ * If there is no mtag or stack is empty,
+ * `return` continues with next rule.
*/
if (IS_RETURN && (mtag == NULL ||
mtag->m_tag_id == 0)) {
l = 0; /* exit inner loop */
break;
}
- if (IS_CALL && (mtag == NULL ||
- mtag->m_tag_id >= IPFW_CALLSTACK_SIZE)) {
- printf("ipfw: call stack error, "
- "go to next rule\n");
+
+ if (mtag == NULL) {
+ MPASS(IS_CALL);
+ mtag = m_tag_alloc(MTAG_IPFW_CALL, 0,
+ IPFW_CALLSTACK_SIZE *
+ sizeof(uint32_t), M_NOWAIT);
+ if (mtag != NULL) {
+ m_tag_prepend(m, mtag);
+ stack = (uint32_t *)(mtag + 1);
+ stack[0] = chain->id;
+ }
+ }
+
+ if (mtag == NULL) {
+ printf("ipfw: rule %u: failed to "
+ "allocate call stack. "
+ "Denying packet.\n",
+ f->rulenum);
+ l = 0; /* exit inner loop */
+ done = 1; /* exit outer loop */
+ retval = IP_FW_DENY; /* drop packet */
+ break;
+ }
+
+ if (IS_CALL && mtag->m_tag_id >=
+ IPFW_CALLSTACK_SIZE - 1) {
+ printf("ipfw: rule %u: call stack "
+ "overflow. Denying packet.\n",
+ f->rulenum);
l = 0; /* exit inner loop */
+ done = 1; /* exit outer loop */
+ retval = IP_FW_DENY; /* drop packet */
break;
}
+ MPASS(stack == (uint32_t *)(mtag + 1));
IPFW_INC_RULE_COUNTER(f, pktlen);
- stack = (uint16_t *)(mtag + 1);
- /*
- * The `call' action may use cached f_pos
- * (in f->next_rule), whose version is written
- * in f->next_rule.
- * The `return' action, however, doesn't have
- * fixed jump address in cmd->arg1 and can't use
- * cache.
- */
if (IS_CALL) {
- stack[mtag->m_tag_id] = f->rulenum;
- mtag->m_tag_id++;
- f_pos = JUMP(chain, f, cmd->arg1,
- tablearg, 1);
+ stack[++mtag->m_tag_id] = f_pos;
+ f_pos = jump(chain, f,
+ insntod(cmd, u32)->d[0],
+ tablearg, true);
} else { /* `return' action */
- mtag->m_tag_id--;
- jmpto = stack[mtag->m_tag_id] + 1;
- f_pos = ipfw_find_rule(chain, jmpto, 0);
+ jmpto = stack[mtag->m_tag_id--];
+ if (cmd->arg1 == RETURN_NEXT_RULE)
+ f_pos = jmpto + 1;
+ else /* RETURN_NEXT_RULENUM */
+ f_pos = ipfw_find_rule(chain,
+ chain->map[
+ jmpto]->rulenum + 1, 0);
}
/*
@@ -3045,11 +3157,15 @@
* f_pos, f, l and cmd.
* Also clear cmdlen and skip_or
*/
+ MPASS(f_pos < chain->n_rules - 1);
for (; f_pos < chain->n_rules - 1 &&
(V_set_disable &
(1 << chain->map[f_pos]->set)); f_pos++)
;
- /* Re-enter the inner loop at the dest rule. */
+ /*
+ * Re-enter the inner loop at the dest
+ * rule.
+ */
f = chain->map[f_pos];
l = f->cmd_len;
cmd = f->cmd;
@@ -3312,7 +3428,7 @@
args->rule.pkt_mark = (
(cmd->arg1 == IP_FW_TARG) ?
TARG_VAL(chain, tablearg, mark) :
- ((ipfw_insn_u32 *)cmd)->d[0]);
+ insntoc(cmd, u32)->d[0]);
IPFW_INC_RULE_COUNTER(f, pktlen);
break;
@@ -3341,7 +3457,8 @@
break;
default:
- panic("-- unknown opcode %d\n", cmd->opcode);
+ panic("ipfw: rule %u: unknown opcode %d\n",
+ f->rulenum, cmd->opcode);
} /* end of switch() on opcodes */
/*
* if we get here with l=0, then match is irrelevant.
@@ -3574,9 +3691,7 @@
ipfw_dyn_init(chain);
ipfw_eaction_init(chain, first);
-#ifdef LINEAR_SKIPTO
ipfw_init_skipto_cache(chain);
-#endif
ipfw_bpf_init(first);
/* First set up some values that are compile time options */
@@ -3633,9 +3748,7 @@
for (i = 0; i < chain->n_rules; i++)
ipfw_reap_add(chain, &reap, chain->map[i]);
free(chain->map, M_IPFW);
-#ifdef LINEAR_SKIPTO
ipfw_destroy_skipto_cache(chain);
-#endif
IPFW_WUNLOCK(chain);
IPFW_UH_WUNLOCK(chain);
ipfw_destroy_tables(chain, last);
diff --git a/sys/netpfil/ipfw/ip_fw_compat.c b/sys/netpfil/ipfw/ip_fw_compat.c
new file mode 100644
--- /dev/null
+++ b/sys/netpfil/ipfw/ip_fw_compat.c
@@ -0,0 +1,714 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
+ * Copyright (c) 2025 Yandex LLC
+ * Copyright (c) 2025 Andrey V. Elsukov <ae@FreeBSD.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+/*
+ * Example of compatibility layer for ipfw's rule management routines.
+ */
+
+#include "opt_inet.h"
+#include "opt_inet6.h"
+#include "opt_ipfw.h"
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/malloc.h>
+#include <sys/mbuf.h>
+#include <sys/module.h>
+#include <sys/kernel.h>
+#include <sys/lock.h>
+#include <sys/priv.h>
+#include <sys/proc.h>
+#include <sys/rwlock.h>
+#include <sys/rmlock.h>
+#include <sys/socket.h>
+#include <sys/socketvar.h>
+#include <sys/sysctl.h>
+#include <sys/syslog.h>
+#include <sys/fnv_hash.h>
+#include <net/if.h>
+#include <net/pfil.h>
+#include <net/route.h>
+#include <net/vnet.h>
+#include <vm/vm.h>
+#include <vm/vm_extern.h>
+
+#include <netinet/in.h>
+#include <netinet/ip_var.h> /* hooks */
+#include <netinet/ip_fw.h>
+
+#include <netpfil/ipfw/ip_fw_private.h>
+#include <netpfil/ipfw/ip_fw_table.h>
+
+#ifdef MAC
+#include <security/mac/mac_framework.h>
+#endif
+
+/*
+ * These structures were used by IP_FW3 socket option with version 0.
+ */
+typedef struct _ipfw_dyn_rule_v0 {
+ ipfw_dyn_rule *next; /* linked list of rules. */
+ struct ip_fw *rule; /* pointer to rule */
+ /* 'rule' is used to pass up the rule number (from the parent) */
+
+ ipfw_dyn_rule *parent; /* pointer to parent rule */
+ u_int64_t pcnt; /* packet match counter */
+ u_int64_t bcnt; /* byte match counter */
+ struct ipfw_flow_id id; /* (masked) flow id */
+ u_int32_t expire; /* expire time */
+ u_int32_t bucket; /* which bucket in hash table */
+ u_int32_t state; /* state of this rule (typically a
+ * combination of TCP flags)
+ */
+ u_int32_t ack_fwd; /* most recent ACKs in forward */
+ u_int32_t ack_rev; /* and reverse directions (used */
+ /* to generate keepalives) */
+ u_int16_t dyn_type; /* rule type */
+ u_int16_t count; /* refcount */
+ u_int16_t kidx; /* index of named object */
+} __packed __aligned(8) ipfw_dyn_rule_v0;
+
+typedef struct _ipfw_obj_dyntlv_v0 {
+ ipfw_obj_tlv head;
+ ipfw_dyn_rule_v0 state;
+} ipfw_obj_dyntlv_v0;
+
+typedef struct _ipfw_obj_ntlv_v0 {
+ ipfw_obj_tlv head; /* TLV header */
+ uint16_t idx; /* Name index */
+ uint8_t set; /* set, if applicable */
+ uint8_t type; /* object type, if applicable */
+ uint32_t spare; /* unused */
+ char name[64]; /* Null-terminated name */
+} ipfw_obj_ntlv_v0;
+
+typedef struct _ipfw_range_tlv_v0 {
+ ipfw_obj_tlv head; /* TLV header */
+ uint32_t flags; /* Range flags */
+ uint16_t start_rule; /* Range start */
+ uint16_t end_rule; /* Range end */
+ uint32_t set; /* Range set to match */
+ uint32_t new_set; /* New set to move/swap to */
+} ipfw_range_tlv_v0;
+
+typedef struct _ipfw_range_header_v0 {
+ ip_fw3_opheader opheader; /* IP_FW3 opcode */
+ ipfw_range_tlv_v0 range;
+} ipfw_range_header_v0;
+
+typedef struct _ipfw_insn_limit_v0 {
+ ipfw_insn o;
+ uint8_t _pad;
+ uint8_t limit_mask;
+ uint16_t conn_limit;
+} ipfw_insn_limit_v0;
+
+typedef struct _ipfw_obj_tentry_v0 {
+ ipfw_obj_tlv head; /* TLV header */
+ uint8_t subtype; /* subtype (IPv4,IPv6) */
+ uint8_t masklen; /* mask length */
+ uint8_t result; /* request result */
+ uint8_t spare0;
+ uint16_t idx; /* Table name index */
+ uint16_t spare1;
+ union {
+ /* Longest field needs to be aligned by 8-byte boundary */
+ struct in_addr addr; /* IPv4 address */
+ uint32_t key; /* uid/gid/port */
+ struct in6_addr addr6; /* IPv6 address */
+ char iface[IF_NAMESIZE]; /* interface name */
+ struct tflow_entry flow;
+ } k;
+ union {
+ ipfw_table_value value; /* value data */
+ uint32_t kidx; /* value kernel index */
+ } v;
+} ipfw_obj_tentry_v0;
+
+static sopt_handler_f dump_config_v0, add_rules_v0, del_rules_v0,
+ clear_rules_v0, move_rules_v0, manage_sets_v0, dump_soptcodes_v0,
+ dump_srvobjects_v0;
+
+static struct ipfw_sopt_handler scodes[] = {
+ { IP_FW_XGET, IP_FW3_OPVER_0, HDIR_GET, dump_config_v0 },
+ { IP_FW_XADD, IP_FW3_OPVER_0, HDIR_BOTH, add_rules_v0 },
+ { IP_FW_XDEL, IP_FW3_OPVER_0, HDIR_BOTH, del_rules_v0 },
+ { IP_FW_XZERO, IP_FW3_OPVER_0, HDIR_SET, clear_rules_v0 },
+ { IP_FW_XRESETLOG, IP_FW3_OPVER_0, HDIR_SET, clear_rules_v0 },
+ { IP_FW_XMOVE, IP_FW3_OPVER_0, HDIR_SET, move_rules_v0 },
+ { IP_FW_SET_SWAP, IP_FW3_OPVER_0, HDIR_SET, manage_sets_v0 },
+ { IP_FW_SET_MOVE, IP_FW3_OPVER_0, HDIR_SET, manage_sets_v0 },
+ { IP_FW_SET_ENABLE, IP_FW3_OPVER_0, HDIR_SET, manage_sets_v0 },
+ { IP_FW_DUMP_SOPTCODES, IP_FW3_OPVER_0, HDIR_GET, dump_soptcodes_v0 },
+ { IP_FW_DUMP_SRVOBJECTS, IP_FW3_OPVER_0, HDIR_GET, dump_srvobjects_v0 },
+};
+
+static int
+dump_config_v0(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
+ struct sockopt_data *sd)
+{
+ return (EOPNOTSUPP);
+}
+
+/*
+ * Calculate the size adjust needed to store opcodes converted from v0
+ * to v1.
+ */
+static int
+adjust_size_v0(ipfw_insn *cmd)
+{
+ int cmdlen, adjust;
+
+ cmdlen = F_LEN(cmd);
+ switch (cmd->opcode) {
+ case O_CHECK_STATE:
+ case O_KEEP_STATE:
+ case O_PROBE_STATE:
+ case O_EXTERNAL_ACTION:
+ case O_EXTERNAL_INSTANCE:
+ adjust = F_INSN_SIZE(ipfw_insn_kidx) - cmdlen;
+ break;
+ case O_LIMIT:
+ adjust = F_INSN_SIZE(ipfw_insn_limit) - cmdlen;
+ break;
+ case O_IP_SRC_LOOKUP:
+ case O_IP_DST_LOOKUP:
+ case O_IP_FLOW_LOOKUP:
+ case O_MAC_SRC_LOOKUP:
+ case O_MAC_DST_LOOKUP:
+ if (cmdlen == F_INSN_SIZE(ipfw_insn))
+ adjust = F_INSN_SIZE(ipfw_insn_kidx) - cmdlen;
+ else
+ adjust = F_INSN_SIZE(ipfw_insn_table) - cmdlen;
+ break;
+ case O_SKIPTO:
+ case O_CALLRETURN:
+ adjust = F_INSN_SIZE(ipfw_insn_u32) - cmdlen;
+ break;
+ default:
+ adjust = 0;
+ }
+ return (adjust);
+}
+
+static int
+parse_rules_v0(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
+ struct sockopt_data *sd, ipfw_obj_ctlv **prtlv,
+ struct rule_check_info **pci)
+{
+ ipfw_obj_ctlv *ctlv, *rtlv, *tstate;
+ ipfw_obj_ntlv_v0 *ntlv;
+ struct rule_check_info *ci, *cbuf;
+ struct ip_fw_rule *r;
+ size_t count, clen, read, rsize;
+ uint32_t rulenum;
+ int idx, error;
+
+ op3 = (ip_fw3_opheader *)ipfw_get_sopt_space(sd, sd->valsize);
+ ctlv = (ipfw_obj_ctlv *)(op3 + 1);
+ read = sizeof(ip_fw3_opheader);
+ if (read + sizeof(*ctlv) > sd->valsize)
+ return (EINVAL);
+
+ rtlv = NULL;
+ tstate = NULL;
+ cbuf = NULL;
+ /* Table names or other named objects. */
+ if (ctlv->head.type == IPFW_TLV_TBLNAME_LIST) {
+ /* Check size and alignment. */
+ clen = ctlv->head.length;
+ if (read + clen > sd->valsize || clen < sizeof(*ctlv) ||
+ (clen % sizeof(uint64_t)) != 0)
+ return (EINVAL);
+ /* Check for validness. */
+ count = (ctlv->head.length - sizeof(*ctlv)) / sizeof(*ntlv);
+ if (ctlv->count != count || ctlv->objsize != sizeof(*ntlv))
+ return (EINVAL);
+ /*
+ * Check each TLV.
+ * Ensure TLVs are sorted ascending and
+ * there are no duplicates.
+ */
+ idx = -1;
+ ntlv = (ipfw_obj_ntlv_v0 *)(ctlv + 1);
+ while (count > 0) {
+ if (ntlv->head.length != sizeof(ipfw_obj_ntlv_v0))
+ return (EINVAL);
+
+ error = ipfw_check_object_name_generic(ntlv->name);
+ if (error != 0)
+ return (error);
+
+ if (ntlv->idx <= idx)
+ return (EINVAL);
+
+ idx = ntlv->idx;
+ count--;
+ ntlv++;
+ }
+
+ tstate = ctlv;
+ read += ctlv->head.length;
+ ctlv = (ipfw_obj_ctlv *)((caddr_t)ctlv + ctlv->head.length);
+
+ if (read + sizeof(*ctlv) > sd->valsize)
+ return (EINVAL);
+ }
+
+ /* List of rules. */
+ if (ctlv->head.type == IPFW_TLV_RULE_LIST) {
+ clen = ctlv->head.length;
+ if (read + clen > sd->valsize || clen < sizeof(*ctlv) ||
+ (clen % sizeof(uint64_t)) != 0)
+ return (EINVAL);
+
+ clen -= sizeof(*ctlv);
+ if (ctlv->count == 0 ||
+ ctlv->count > clen / sizeof(struct ip_fw_rule))
+ return (EINVAL);
+
+ /* Allocate state for each rule */
+ cbuf = malloc(ctlv->count * sizeof(struct rule_check_info),
+ M_TEMP, M_WAITOK | M_ZERO);
+
+ /*
+ * Check each rule for validness.
+ * Ensure numbered rules are sorted ascending
+ * and properly aligned
+ */
+ rulenum = 0;
+ count = 0;
+ error = 0;
+ ci = cbuf;
+ r = (struct ip_fw_rule *)(ctlv + 1);
+ while (clen > 0) {
+ rsize = RULEUSIZE1(r);
+ if (rsize > clen || count > ctlv->count) {
+ error = EINVAL;
+ break;
+ }
+ ci->ctlv = tstate;
+ ci->version = IP_FW3_OPVER_0;
+ error = ipfw_check_rule(r, rsize, ci);
+ if (error != 0)
+ break;
+
+ /* Check sorting */
+ if (r->rulenum != 0 && r->rulenum < rulenum) {
+ printf("ipfw: wrong order: rulenum %u"
+ " vs %u\n", r->rulenum, rulenum);
+ error = EINVAL;
+ break;
+ }
+ rulenum = r->rulenum;
+ ci->urule = (caddr_t)r;
+ clen -= rsize;
+ r = (struct ip_fw_rule *)((caddr_t)r + rsize);
+ count++;
+ ci++;
+ }
+
+ if (ctlv->count != count || error != 0) {
+ free(cbuf, M_TEMP);
+ return (EINVAL);
+ }
+
+ rtlv = ctlv;
+ read += ctlv->head.length;
+ ctlv = (ipfw_obj_ctlv *)((caddr_t)ctlv + ctlv->head.length);
+ }
+
+ if (read != sd->valsize || rtlv == NULL) {
+ free(cbuf, M_TEMP);
+ return (EINVAL);
+ }
+
+ *prtlv = rtlv;
+ *pci = cbuf;
+ return (0);
+}
+
+static void
+convert_v0_to_v1(struct rule_check_info *ci, int rule_len)
+{
+ struct ip_fw_rule *urule;
+ struct ip_fw *krule;
+ ipfw_insn *src, *dst;
+ int l, cmdlen, newlen;
+
+ urule = (struct ip_fw_rule *)ci->urule;
+ krule = ci->krule;
+ for (l = urule->cmd_len, src = urule->cmd, dst = krule->cmd;
+ l > 0 && rule_len > 0;
+ l -= cmdlen, src += cmdlen,
+ rule_len -= newlen, dst += newlen) {
+ cmdlen = F_LEN(src);
+ switch (src->opcode) {
+ case O_CHECK_STATE:
+ case O_KEEP_STATE:
+ case O_PROBE_STATE:
+ case O_EXTERNAL_ACTION:
+ case O_EXTERNAL_INSTANCE:
+ newlen = F_INSN_SIZE(ipfw_insn_kidx);
+ insntod(dst, kidx)->kidx = src->arg1;
+ break;
+ case O_LIMIT:
+ newlen = F_INSN_SIZE(ipfw_insn_limit);
+ insntod(dst, limit)->kidx = src->arg1;
+ insntod(dst, limit)->limit_mask =
+ insntoc(src, limit)->limit_mask;
+ insntod(dst, limit)->conn_limit =
+ insntoc(src, limit)->conn_limit;
+ break;
+ case O_IP_DST_LOOKUP:
+ if (cmdlen == F_INSN_SIZE(ipfw_insn) + 2) {
+ /* lookup type stored in d[1] */
+ dst->arg1 = insntoc(src, table)->value;
+ }
+ case O_IP_SRC_LOOKUP:
+ case O_IP_FLOW_LOOKUP:
+ case O_MAC_SRC_LOOKUP:
+ case O_MAC_DST_LOOKUP:
+ if (cmdlen == F_INSN_SIZE(ipfw_insn)) {
+ newlen = F_INSN_SIZE(ipfw_insn_kidx);
+ insntod(dst, kidx)->kidx = src->arg1;
+ } else {
+ newlen = F_INSN_SIZE(ipfw_insn_table);
+ insntod(dst, table)->kidx = src->arg1;
+ insntod(dst, table)->value =
+ insntoc(src, u32)->d[0];
+ }
+ break;
+ case O_CALLRETURN:
+ case O_SKIPTO:
+ newlen = F_INSN_SIZE(ipfw_insn_u32);
+ insntod(dst, u32)->d[0] = src->arg1;
+ break;
+ default:
+ newlen = cmdlen;
+ memcpy(dst, src, sizeof(uint32_t) * newlen);
+ continue;
+ }
+ dst->opcode = src->opcode;
+ dst->len = (src->len & (F_NOT | F_OR)) | newlen;
+ }
+}
+
+/*
+ * Copy rule @urule from v0 userland format to kernel @krule.
+ */
+static void
+import_rule_v0(struct ip_fw_chain *chain, struct rule_check_info *ci)
+{
+ struct ip_fw_rule *urule;
+ struct ip_fw *krule;
+ ipfw_insn *cmd;
+ int l, cmdlen, adjust, aadjust;
+
+ urule = (struct ip_fw_rule *)ci->urule;
+ l = urule->cmd_len;
+ cmd = urule->cmd;
+ adjust = aadjust = 0;
+
+ /* Scan all opcodes and determine the needed size */
+ while (l > 0) {
+ adjust += adjust_size_v0(cmd);
+ if (ACTION_PTR(urule) < cmd)
+ aadjust = adjust;
+ cmdlen = F_LEN(cmd);
+ l -= cmdlen;
+ cmd += cmdlen;
+ }
+
+ cmdlen = urule->cmd_len + adjust;
+ krule = ci->krule = ipfw_alloc_rule(chain, /* RULEKSIZE1(cmdlen) */
+ roundup2(sizeof(struct ip_fw) + cmdlen * 4 - 4, 8));
+
+ krule->act_ofs = urule->act_ofs + aadjust;
+ krule->cmd_len = urule->cmd_len + adjust;
+
+ if (adjust != 0)
+ printf("%s: converted rule %u: cmd_len %u -> %u, "
+ "act_ofs %u -> %u\n", __func__, urule->rulenum,
+ urule->cmd_len, krule->cmd_len, urule->act_ofs,
+ krule->act_ofs);
+
+ krule->rulenum = urule->rulenum;
+ krule->set = urule->set;
+ krule->flags = urule->flags;
+
+ /* Save rulenum offset */
+ ci->urule_numoff = offsetof(struct ip_fw_rule, rulenum);
+ convert_v0_to_v1(ci, cmdlen);
+}
+
+static int
+add_rules_v0(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
+ struct sockopt_data *sd)
+{
+ ipfw_obj_ctlv *rtlv;
+ struct rule_check_info *ci, *nci;
+ int i, ret;
+
+ /*
+ * Check rules buffer for validness.
+ */
+ ret = parse_rules_v0(chain, op3, sd, &rtlv, &nci);
+ if (ret != 0)
+ return (ret);
+ /*
+ * Allocate storage for the kernel representation of rules.
+ */
+ for (i = 0, ci = nci; i < rtlv->count; i++, ci++)
+ import_rule_v0(chain, ci);
+ /*
+ * Try to add new rules to the chain.
+ */
+ if ((ret = ipfw_commit_rules(chain, nci, rtlv->count)) != 0) {
+ for (i = 0, ci = nci; i < rtlv->count; i++, ci++)
+ ipfw_free_rule(ci->krule);
+ }
+ /* Cleanup after ipfw_parse_rules() */
+ free(nci, M_TEMP);
+ return (ret);
+}
+
+static int
+check_range_tlv_v0(const ipfw_range_tlv_v0 *rt, ipfw_range_tlv *crt)
+{
+ if (rt->head.length != sizeof(*rt))
+ return (1);
+ if (rt->start_rule > rt->end_rule)
+ return (1);
+ if (rt->set >= IPFW_MAX_SETS || rt->new_set >= IPFW_MAX_SETS)
+ return (1);
+ if ((rt->flags & IPFW_RCFLAG_USER) != rt->flags)
+ return (1);
+
+ crt->head = rt->head;
+ crt->head.length = sizeof(*crt);
+ crt->flags = rt->flags;
+ crt->start_rule = rt->start_rule;
+ crt->end_rule = rt->end_rule;
+ crt->set = rt->set;
+ crt->new_set = rt->new_set;
+ return (0);
+}
+
+static int
+del_rules_v0(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
+ struct sockopt_data *sd)
+{
+ ipfw_range_tlv rv;
+ ipfw_range_header_v0 *rh;
+ int error, ndel;
+
+ if (sd->valsize != sizeof(*rh))
+ return (EINVAL);
+
+ rh = (ipfw_range_header_v0 *)ipfw_get_sopt_space(sd, sd->valsize);
+ if (check_range_tlv_v0(&rh->range, &rv) != 0)
+ return (EINVAL);
+
+ ndel = 0;
+ if ((error = delete_range(chain, &rv, &ndel)) != 0)
+ return (error);
+
+ /* Save number of rules deleted */
+ rh->range.new_set = ndel;
+ return (0);
+}
+
+static int
+clear_rules_v0(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
+ struct sockopt_data *sd)
+{
+ return (EOPNOTSUPP);
+}
+
+static int
+move_rules_v0(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
+ struct sockopt_data *sd)
+{
+ return (EOPNOTSUPP);
+}
+
+static int
+manage_sets_v0(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
+ struct sockopt_data *sd)
+{
+ return (EOPNOTSUPP);
+}
+
+static int
+dump_soptcodes_v0(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
+ struct sockopt_data *sd)
+{
+ return (EOPNOTSUPP);
+}
+
+static int
+dump_srvobjects_v0(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
+ struct sockopt_data *sd)
+{
+ return (EOPNOTSUPP);
+}
+
+static enum ipfw_opcheck_result
+check_opcode_compat(ipfw_insn **pcmd, int *plen, struct rule_check_info *ci)
+{
+ ipfw_insn *cmd;
+ size_t cmdlen;
+
+ if (ci->version != IP_FW3_OPVER_0)
+ return (FAILED);
+
+ cmd = *pcmd;
+ cmdlen = F_LEN(cmd);
+ switch (cmd->opcode) {
+ case O_PROBE_STATE:
+ case O_KEEP_STATE:
+ if (cmdlen != F_INSN_SIZE(ipfw_insn))
+ return (BAD_SIZE);
+ ci->object_opcodes++;
+ break;
+ case O_LIMIT:
+ if (cmdlen != F_INSN_SIZE(ipfw_insn_limit_v0))
+ return (BAD_SIZE);
+ ci->object_opcodes++;
+ break;
+ case O_IP_SRC_LOOKUP:
+ if (cmdlen > F_INSN_SIZE(ipfw_insn_u32))
+ return (BAD_SIZE);
+ /* FALLTHROUGH */
+ case O_IP_DST_LOOKUP:
+ if (cmdlen != F_INSN_SIZE(ipfw_insn) &&
+ cmdlen != F_INSN_SIZE(ipfw_insn_u32) + 1 &&
+ cmdlen != F_INSN_SIZE(ipfw_insn_u32))
+ return (BAD_SIZE);
+ if (cmd->arg1 >= V_fw_tables_max) {
+ printf("ipfw: invalid table number %u\n",
+ cmd->arg1);
+ return (FAILED);
+ }
+ ci->object_opcodes++;
+ break;
+ case O_IP_FLOW_LOOKUP:
+ if (cmdlen != F_INSN_SIZE(ipfw_insn) &&
+ cmdlen != F_INSN_SIZE(ipfw_insn_u32))
+ return (BAD_SIZE);
+ if (cmd->arg1 >= V_fw_tables_max) {
+ printf("ipfw: invalid table number %u\n",
+ cmd->arg1);
+ return (FAILED);
+ }
+ ci->object_opcodes++;
+ break;
+ case O_CHECK_STATE:
+ ci->object_opcodes++;
+ /* FALLTHROUGH */
+ case O_SKIPTO:
+ case O_CALLRETURN:
+ if (cmdlen != F_INSN_SIZE(ipfw_insn))
+ return (BAD_SIZE);
+ return (CHECK_ACTION);
+
+ case O_EXTERNAL_ACTION:
+ if (cmd->arg1 == 0 ||
+ cmdlen != F_INSN_SIZE(ipfw_insn)) {
+ printf("ipfw: invalid external "
+ "action opcode\n");
+ return (FAILED);
+ }
+ ci->object_opcodes++;
+ /*
+ * Do we have O_EXTERNAL_INSTANCE or O_EXTERNAL_DATA
+ * opcode?
+ */
+ if (*plen != cmdlen) {
+ *plen -= cmdlen;
+ *pcmd = cmd += cmdlen;
+ cmdlen = F_LEN(cmd);
+ if (cmd->opcode == O_EXTERNAL_DATA)
+ return (CHECK_ACTION);
+ if (cmd->opcode != O_EXTERNAL_INSTANCE) {
+ printf("ipfw: invalid opcode "
+ "next to external action %u\n",
+ cmd->opcode);
+ return (FAILED);
+ }
+ if (cmd->arg1 == 0 ||
+ cmdlen != F_INSN_SIZE(ipfw_insn)) {
+ printf("ipfw: invalid external "
+ "action instance opcode\n");
+ return (FAILED);
+ }
+ ci->object_opcodes++;
+ }
+ return (CHECK_ACTION);
+
+ default:
+ return (ipfw_check_opcode(pcmd, plen, ci));
+ }
+ return (SUCCESS);
+}
+
+static int
+ipfw_compat_modevent(module_t mod, int type, void *unused)
+{
+ switch (type) {
+ case MOD_LOAD:
+ IPFW_ADD_SOPT_HANDLER(1, scodes);
+ ipfw_register_compat(check_opcode_compat);
+ break;
+ case MOD_UNLOAD:
+ ipfw_unregister_compat();
+ IPFW_DEL_SOPT_HANDLER(1, scodes);
+ break;
+ default:
+ return (EOPNOTSUPP);
+ }
+ return (0);
+}
+
+static moduledata_t ipfw_compat_mod = {
+ "ipfw_compat",
+ ipfw_compat_modevent,
+ 0
+};
+
+/* Define startup order. */
+#define IPFW_COMPAT_SI_SUB_FIREWALL SI_SUB_PROTO_FIREWALL
+#define IPFW_COMPAT_MODEVENT_ORDER (SI_ORDER_ANY - 128) /* after ipfw */
+#define IPFW_COMPAT_MODULE_ORDER (IPFW_COMPAT_MODEVENT_ORDER + 1)
+
+DECLARE_MODULE(ipfw_compat, ipfw_compat_mod, IPFW_COMPAT_SI_SUB_FIREWALL,
+ IPFW_COMPAT_MODULE_ORDER);
+MODULE_DEPEND(ipfw_compat, ipfw, 3, 3, 3);
+MODULE_VERSION(ipfw_compat, 1);
diff --git a/sys/netpfil/ipfw/ip_fw_dynamic.c b/sys/netpfil/ipfw/ip_fw_dynamic.c
--- a/sys/netpfil/ipfw/ip_fw_dynamic.c
+++ b/sys/netpfil/ipfw/ip_fw_dynamic.c
@@ -1,8 +1,8 @@
/*-
* SPDX-License-Identifier: BSD-2-Clause
*
- * Copyright (c) 2017-2018 Yandex LLC
- * Copyright (c) 2017-2018 Andrey V. Elsukov <ae@FreeBSD.org>
+ * Copyright (c) 2017-2025 Yandex LLC
+ * Copyright (c) 2017-2025 Andrey V. Elsukov <ae@FreeBSD.org>
* Copyright (c) 2002 Luigi Rizzo, Universita` di Pisa
*
* Redistribution and use in source and binary forms, with or without
@@ -57,8 +57,8 @@
#include <netinet/ip.h>
#include <netinet/ip_var.h>
#include <netinet/ip_fw.h>
-#include <netinet/udp.h>
#include <netinet/tcp.h>
+#include <netinet/udp.h>
#include <netinet/ip6.h> /* IN6_ARE_ADDR_EQUAL */
#ifdef INET6
@@ -132,9 +132,9 @@
uint32_t hashval; /* hash value used for hash resize */
uint16_t fibnum; /* fib used to send keepalives */
- uint8_t _pad[3];
+ uint8_t _pad;
uint8_t flags; /* internal flags */
- uint16_t rulenum; /* parent rule number */
+ uint32_t rulenum; /* parent rule number */
uint32_t ruleid; /* parent rule id */
uint32_t state; /* TCP session state and flags */
@@ -159,8 +159,7 @@
struct dyn_parent {
void *parent; /* pointer to parent rule */
uint32_t count; /* number of linked states */
- uint8_t _pad[2];
- uint16_t rulenum; /* parent rule number */
+ uint32_t rulenum; /* parent rule number */
uint32_t ruleid; /* parent rule id */
uint32_t hashval; /* hash value used for hash resize */
uint32_t expire; /* expire time */
@@ -169,7 +168,8 @@
struct dyn_ipv4_state {
uint8_t type; /* State type */
uint8_t proto; /* UL Protocol */
- uint16_t kidx; /* named object index */
+ uint16_t spare;
+ uint32_t kidx; /* named object index */
uint16_t sport, dport; /* ULP source and destination ports */
in_addr_t src, dst; /* IPv4 source and destination */
@@ -501,12 +501,12 @@
const struct ipfw_flow_id *, uint32_t, const void *,
struct ipfw_dyn_info *, int);
static int dyn_lookup_ipv6_state_locked(const struct ipfw_flow_id *,
- uint32_t, const void *, int, uint32_t, uint16_t);
+ uint32_t, const void *, int, uint32_t, uint32_t);
static struct dyn_ipv6_state *dyn_alloc_ipv6_state(
- const struct ipfw_flow_id *, uint32_t, uint16_t, uint8_t);
-static int dyn_add_ipv6_state(void *, uint32_t, uint16_t,
+ const struct ipfw_flow_id *, uint32_t, uint32_t, uint8_t);
+static int dyn_add_ipv6_state(void *, uint32_t, uint32_t,
const struct ipfw_flow_id *, uint32_t, const void *, int, uint32_t,
- struct ipfw_dyn_info *, uint16_t, uint16_t, uint8_t);
+ struct ipfw_dyn_info *, uint16_t, uint32_t, uint8_t);
static void dyn_export_ipv6_state(const struct dyn_ipv6_state *,
ipfw_dyn_rule *);
@@ -519,33 +519,33 @@
static void dyn_send_keepalive_ipv6(struct ip_fw_chain *);
static struct dyn_ipv6_state *dyn_lookup_ipv6_parent(
- const struct ipfw_flow_id *, uint32_t, const void *, uint32_t, uint16_t,
+ const struct ipfw_flow_id *, uint32_t, const void *, uint32_t, uint32_t,
uint32_t);
static struct dyn_ipv6_state *dyn_lookup_ipv6_parent_locked(
- const struct ipfw_flow_id *, uint32_t, const void *, uint32_t, uint16_t,
+ const struct ipfw_flow_id *, uint32_t, const void *, uint32_t, uint32_t,
uint32_t);
-static struct dyn_ipv6_state *dyn_add_ipv6_parent(void *, uint32_t, uint16_t,
- const struct ipfw_flow_id *, uint32_t, uint32_t, uint32_t, uint16_t);
+static struct dyn_ipv6_state *dyn_add_ipv6_parent(void *, uint32_t, uint32_t,
+ const struct ipfw_flow_id *, uint32_t, uint32_t, uint32_t, uint32_t);
#endif /* INET6 */
/* Functions to work with limit states */
static void *dyn_get_parent_state(const struct ipfw_flow_id *, uint32_t,
- struct ip_fw *, uint32_t, uint32_t, uint16_t);
+ struct ip_fw *, uint32_t, uint32_t, uint32_t);
static struct dyn_ipv4_state *dyn_lookup_ipv4_parent(
- const struct ipfw_flow_id *, const void *, uint32_t, uint16_t, uint32_t);
+ const struct ipfw_flow_id *, const void *, uint32_t, uint32_t, uint32_t);
static struct dyn_ipv4_state *dyn_lookup_ipv4_parent_locked(
- const struct ipfw_flow_id *, const void *, uint32_t, uint16_t, uint32_t);
-static struct dyn_parent *dyn_alloc_parent(void *, uint32_t, uint16_t,
+ const struct ipfw_flow_id *, const void *, uint32_t, uint32_t, uint32_t);
+static struct dyn_parent *dyn_alloc_parent(void *, uint32_t, uint32_t,
uint32_t);
-static struct dyn_ipv4_state *dyn_add_ipv4_parent(void *, uint32_t, uint16_t,
- const struct ipfw_flow_id *, uint32_t, uint32_t, uint16_t);
+static struct dyn_ipv4_state *dyn_add_ipv4_parent(void *, uint32_t, uint32_t,
+ const struct ipfw_flow_id *, uint32_t, uint32_t, uint32_t);
static void dyn_tick(void *);
static void dyn_expire_states(struct ip_fw_chain *, ipfw_range_tlv *);
static void dyn_free_states(struct ip_fw_chain *);
-static void dyn_export_parent(const struct dyn_parent *, uint16_t, uint8_t,
+static void dyn_export_parent(const struct dyn_parent *, uint32_t, uint8_t,
ipfw_dyn_rule *);
-static void dyn_export_data(const struct dyn_data *, uint16_t, uint8_t,
+static void dyn_export_data(const struct dyn_data *, uint32_t, uint8_t,
uint8_t, ipfw_dyn_rule *);
static uint32_t dyn_update_tcp_state(struct dyn_data *,
const struct ipfw_flow_id *, const struct tcphdr *, int);
@@ -556,12 +556,12 @@
struct dyn_ipv4_state *dyn_lookup_ipv4_state(const struct ipfw_flow_id *,
const void *, struct ipfw_dyn_info *, int);
static int dyn_lookup_ipv4_state_locked(const struct ipfw_flow_id *,
- const void *, int, uint32_t, uint16_t);
+ const void *, int, uint32_t, uint32_t);
static struct dyn_ipv4_state *dyn_alloc_ipv4_state(
- const struct ipfw_flow_id *, uint16_t, uint8_t);
-static int dyn_add_ipv4_state(void *, uint32_t, uint16_t,
+ const struct ipfw_flow_id *, uint32_t, uint8_t);
+static int dyn_add_ipv4_state(void *, uint32_t, uint32_t,
const struct ipfw_flow_id *, const void *, int, uint32_t,
- struct ipfw_dyn_info *, uint16_t, uint16_t, uint8_t);
+ struct ipfw_dyn_info *, uint16_t, uint32_t, uint8_t);
static void dyn_export_ipv4_state(const struct dyn_ipv4_state *,
ipfw_dyn_rule *);
@@ -574,34 +574,41 @@
char name[64];
};
-#define DYN_STATE_OBJ(ch, cmd) \
- ((struct dyn_state_obj *)SRV_OBJECT(ch, (cmd)->arg1))
/*
* Classifier callback.
* Return 0 if opcode contains object that should be referenced
* or rewritten.
*/
static int
-dyn_classify(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
+dyn_classify(ipfw_insn *cmd0, uint32_t *puidx, uint8_t *ptype)
{
+ ipfw_insn_kidx *cmd;
- DYN_DEBUG("opcode %d, arg1 %d", cmd->opcode, cmd->arg1);
+ if (F_LEN(cmd0) < 2)
+ return (EINVAL);
+
+ /*
+ * NOTE: ipfw_insn_kidx and ipfw_insn_limit has overlapped kidx
+ * field, so we can use one type to get access to kidx field.
+ */
+ cmd = insntod(cmd0, kidx);
+ DYN_DEBUG("opcode %u, kidx %u", cmd0->opcode, cmd->kidx);
/* Don't rewrite "check-state any" */
- if (cmd->arg1 == 0 &&
- cmd->opcode == O_CHECK_STATE)
+ if (cmd->kidx == 0 &&
+ cmd0->opcode == O_CHECK_STATE)
return (1);
- *puidx = cmd->arg1;
+ *puidx = cmd->kidx;
*ptype = 0;
return (0);
}
static void
-dyn_update(ipfw_insn *cmd, uint16_t idx)
+dyn_update(ipfw_insn *cmd0, uint32_t idx)
{
- cmd->arg1 = idx;
- DYN_DEBUG("opcode %d, arg1 %d", cmd->opcode, cmd->arg1);
+ insntod(cmd0, kidx)->kidx = idx;
+ DYN_DEBUG("opcode %u, kidx %u", cmd0->opcode, idx);
}
static int
@@ -611,7 +618,7 @@
ipfw_obj_ntlv *ntlv;
const char *name;
- DYN_DEBUG("uidx %d", ti->uidx);
+ DYN_DEBUG("uidx %u", ti->uidx);
if (ti->uidx != 0) {
if (ti->tlvs == NULL)
return (EINVAL);
@@ -639,16 +646,16 @@
}
static struct named_object *
-dyn_findbykidx(struct ip_fw_chain *ch, uint16_t idx)
+dyn_findbykidx(struct ip_fw_chain *ch, uint32_t idx)
{
- DYN_DEBUG("kidx %d", idx);
+ DYN_DEBUG("kidx %u", idx);
return (ipfw_objhash_lookup_kidx(CHAIN_TO_SRV(ch), idx));
}
static int
dyn_create(struct ip_fw_chain *ch, struct tid_info *ti,
- uint16_t *pkidx)
+ uint32_t *pkidx)
{
struct namedobj_instance *ni;
struct dyn_state_obj *obj;
@@ -656,7 +663,7 @@
ipfw_obj_ntlv *ntlv;
char *name;
- DYN_DEBUG("uidx %d", ti->uidx);
+ DYN_DEBUG("uidx %u", ti->uidx);
if (ti->uidx != 0) {
if (ti->tlvs == NULL)
return (EINVAL);
@@ -686,7 +693,7 @@
no->refcnt++;
IPFW_UH_WUNLOCK(ch);
free(obj, M_IPFW);
- DYN_DEBUG("\tfound kidx %d", *pkidx);
+ DYN_DEBUG("\tfound kidx %u for name '%s'", *pkidx, no->name);
return (0);
}
if (ipfw_objhash_alloc_idx(ni, &obj->no.kidx) != 0) {
@@ -700,7 +707,7 @@
obj->no.refcnt++;
*pkidx = obj->no.kidx;
IPFW_UH_WUNLOCK(ch);
- DYN_DEBUG("\tcreated kidx %d", *pkidx);
+ DYN_DEBUG("\tcreated kidx %u for name '%s'", *pkidx, name);
return (0);
}
@@ -716,7 +723,7 @@
KASSERT(no->refcnt == 1,
("Destroying object '%s' (type %u, idx %u) with refcnt %u",
no->name, no->etlv, no->kidx, no->refcnt));
- DYN_DEBUG("kidx %d", no->kidx);
+ DYN_DEBUG("kidx %u", no->kidx);
obj = SRV_OBJECT(ch, no->kidx);
SRV_OBJECT(ch, no->kidx) = NULL;
ipfw_objhash_del(CHAIN_TO_SRV(ch), no);
@@ -1079,7 +1086,7 @@
*/
static int
dyn_lookup_ipv4_state_locked(const struct ipfw_flow_id *pkt,
- const void *ulp, int pktlen, uint32_t bucket, uint16_t kidx)
+ const void *ulp, int pktlen, uint32_t bucket, uint32_t kidx)
{
struct dyn_ipv4_state *s;
int dir;
@@ -1109,7 +1116,7 @@
struct dyn_ipv4_state *
dyn_lookup_ipv4_parent(const struct ipfw_flow_id *pkt, const void *rule,
- uint32_t ruleid, uint16_t rulenum, uint32_t hashval)
+ uint32_t ruleid, uint32_t rulenum, uint32_t hashval)
{
struct dyn_ipv4_state *s;
uint32_t version, bucket;
@@ -1145,7 +1152,7 @@
static struct dyn_ipv4_state *
dyn_lookup_ipv4_parent_locked(const struct ipfw_flow_id *pkt,
- const void *rule, uint32_t ruleid, uint16_t rulenum, uint32_t bucket)
+ const void *rule, uint32_t ruleid, uint32_t rulenum, uint32_t bucket)
{
struct dyn_ipv4_state *s;
@@ -1227,7 +1234,7 @@
*/
static int
dyn_lookup_ipv6_state_locked(const struct ipfw_flow_id *pkt, uint32_t zoneid,
- const void *ulp, int pktlen, uint32_t bucket, uint16_t kidx)
+ const void *ulp, int pktlen, uint32_t bucket, uint32_t kidx)
{
struct dyn_ipv6_state *s;
int dir;
@@ -1258,7 +1265,7 @@
static struct dyn_ipv6_state *
dyn_lookup_ipv6_parent(const struct ipfw_flow_id *pkt, uint32_t zoneid,
- const void *rule, uint32_t ruleid, uint16_t rulenum, uint32_t hashval)
+ const void *rule, uint32_t ruleid, uint32_t rulenum, uint32_t hashval)
{
struct dyn_ipv6_state *s;
uint32_t version, bucket;
@@ -1295,7 +1302,7 @@
static struct dyn_ipv6_state *
dyn_lookup_ipv6_parent_locked(const struct ipfw_flow_id *pkt, uint32_t zoneid,
- const void *rule, uint32_t ruleid, uint16_t rulenum, uint32_t bucket)
+ const void *rule, uint32_t ruleid, uint32_t rulenum, uint32_t bucket)
{
struct dyn_ipv6_state *s;
@@ -1333,10 +1340,11 @@
struct ip_fw *rule;
IPFW_RLOCK_ASSERT(&V_layer3_chain);
+ MPASS(F_LEN(cmd) >= F_INSN_SIZE(ipfw_insn_kidx));
data = NULL;
rule = NULL;
- info->kidx = cmd->arg1;
+ info->kidx = insntoc(cmd, kidx)->kidx;
info->direction = MATCH_NONE;
info->hashval = hash_packet(&args->f_id);
@@ -1411,7 +1419,6 @@
*/
if (V_layer3_chain.map[data->f_pos] == rule) {
data->chain_id = V_layer3_chain.id;
- info->f_pos = data->f_pos;
} else if (V_dyn_keep_states != 0) {
/*
* The original rule pointer is still usable.
@@ -1421,7 +1428,6 @@
MPASS(V_layer3_chain.n_rules > 1);
data->chain_id = V_layer3_chain.id;
data->f_pos = V_layer3_chain.n_rules - 2;
- info->f_pos = data->f_pos;
} else {
rule = NULL;
info->direction = MATCH_NONE;
@@ -1430,8 +1436,8 @@
data->rulenum, data);
/* info->f_pos doesn't matter here. */
}
- } else
- info->f_pos = data->f_pos;
+ }
+ info->f_pos = data->f_pos;
}
DYNSTATE_CRITICAL_EXIT();
#if 0
@@ -1452,7 +1458,7 @@
}
static struct dyn_parent *
-dyn_alloc_parent(void *parent, uint32_t ruleid, uint16_t rulenum,
+dyn_alloc_parent(void *parent, uint32_t ruleid, uint32_t rulenum,
uint32_t hashval)
{
struct dyn_parent *limit;
@@ -1478,7 +1484,7 @@
}
static struct dyn_data *
-dyn_alloc_dyndata(void *parent, uint32_t ruleid, uint16_t rulenum,
+dyn_alloc_dyndata(void *parent, uint32_t ruleid, uint32_t rulenum,
const struct ipfw_flow_id *pkt, const void *ulp, int pktlen,
uint32_t hashval, uint16_t fibnum)
{
@@ -1506,7 +1512,7 @@
}
static struct dyn_ipv4_state *
-dyn_alloc_ipv4_state(const struct ipfw_flow_id *pkt, uint16_t kidx,
+dyn_alloc_ipv4_state(const struct ipfw_flow_id *pkt, uint32_t kidx,
uint8_t type)
{
struct dyn_ipv4_state *s;
@@ -1533,9 +1539,9 @@
* is not needed.
*/
static struct dyn_ipv4_state *
-dyn_add_ipv4_parent(void *rule, uint32_t ruleid, uint16_t rulenum,
+dyn_add_ipv4_parent(void *rule, uint32_t ruleid, uint32_t rulenum,
const struct ipfw_flow_id *pkt, uint32_t hashval, uint32_t version,
- uint16_t kidx)
+ uint32_t kidx)
{
struct dyn_ipv4_state *s;
struct dyn_parent *limit;
@@ -1586,10 +1592,10 @@
}
static int
-dyn_add_ipv4_state(void *parent, uint32_t ruleid, uint16_t rulenum,
+dyn_add_ipv4_state(void *parent, uint32_t ruleid, uint32_t rulenum,
const struct ipfw_flow_id *pkt, const void *ulp, int pktlen,
uint32_t hashval, struct ipfw_dyn_info *info, uint16_t fibnum,
- uint16_t kidx, uint8_t type)
+ uint32_t kidx, uint8_t type)
{
struct dyn_ipv4_state *s;
void *data;
@@ -1637,7 +1643,7 @@
#ifdef INET6
static struct dyn_ipv6_state *
dyn_alloc_ipv6_state(const struct ipfw_flow_id *pkt, uint32_t zoneid,
- uint16_t kidx, uint8_t type)
+ uint32_t kidx, uint8_t type)
{
struct dyn_ipv6_state *s;
@@ -1664,9 +1670,9 @@
* is not needed.
*/
static struct dyn_ipv6_state *
-dyn_add_ipv6_parent(void *rule, uint32_t ruleid, uint16_t rulenum,
+dyn_add_ipv6_parent(void *rule, uint32_t ruleid, uint32_t rulenum,
const struct ipfw_flow_id *pkt, uint32_t zoneid, uint32_t hashval,
- uint32_t version, uint16_t kidx)
+ uint32_t version, uint32_t kidx)
{
struct dyn_ipv6_state *s;
struct dyn_parent *limit;
@@ -1717,10 +1723,10 @@
}
static int
-dyn_add_ipv6_state(void *parent, uint32_t ruleid, uint16_t rulenum,
+dyn_add_ipv6_state(void *parent, uint32_t ruleid, uint32_t rulenum,
const struct ipfw_flow_id *pkt, uint32_t zoneid, const void *ulp,
int pktlen, uint32_t hashval, struct ipfw_dyn_info *info,
- uint16_t fibnum, uint16_t kidx, uint8_t type)
+ uint16_t fibnum, uint32_t kidx, uint8_t type)
{
struct dyn_ipv6_state *s;
struct dyn_data *data;
@@ -1768,7 +1774,7 @@
static void *
dyn_get_parent_state(const struct ipfw_flow_id *pkt, uint32_t zoneid,
- struct ip_fw *rule, uint32_t hashval, uint32_t limit, uint16_t kidx)
+ struct ip_fw *rule, uint32_t hashval, uint32_t limit, uint32_t kidx)
{
char sbuf[24];
struct dyn_parent *p;
@@ -1862,7 +1868,7 @@
dyn_install_state(const struct ipfw_flow_id *pkt, uint32_t zoneid,
uint16_t fibnum, const void *ulp, int pktlen, struct ip_fw *rule,
struct ipfw_dyn_info *info, uint32_t limit, uint16_t limit_mask,
- uint16_t kidx, uint8_t type)
+ uint32_t kidx, uint8_t type)
{
struct ipfw_flow_id id;
uint32_t hashval, parent_hashval, ruleid, rulenum;
@@ -1999,12 +2005,16 @@
limit = 0;
limit_mask = 0;
}
+ /*
+ * NOTE: we assume that kidx field of struct ipfw_insn_kidx
+ * located in the same place as kidx field of ipfw_insn_limit.
+ */
return (dyn_install_state(&args->f_id,
#ifdef INET6
IS_IP6_FLOW_ID(&args->f_id) ? dyn_getscopeid(args):
#endif
0, M_GETFIB(args->m), ulp, pktlen, rule, info, limit,
- limit_mask, cmd->o.arg1, cmd->o.opcode));
+ limit_mask, cmd->kidx, cmd->o.opcode));
}
/*
@@ -2108,7 +2118,7 @@
* dynamic states.
*/
static int
-dyn_match_range(uint16_t rulenum, uint8_t set, const ipfw_range_tlv *rt)
+dyn_match_range(uint32_t rulenum, uint8_t set, const ipfw_range_tlv *rt)
{
MPASS(rt != NULL);
@@ -2130,7 +2140,7 @@
static void
dyn_acquire_rule(struct ip_fw_chain *ch, struct dyn_data *data,
- struct ip_fw *rule, uint16_t kidx)
+ struct ip_fw *rule, uint32_t kidx)
{
struct dyn_state_obj *obj;
@@ -2157,7 +2167,7 @@
static void
dyn_release_rule(struct ip_fw_chain *ch, struct dyn_data *data,
- struct ip_fw *rule, uint16_t kidx)
+ struct ip_fw *rule, uint32_t kidx)
{
struct dyn_state_obj *obj;
@@ -2819,8 +2829,8 @@
* Pass through all states and reset eaction for orphaned rules.
*/
void
-ipfw_dyn_reset_eaction(struct ip_fw_chain *ch, uint16_t eaction_id,
- uint16_t default_id, uint16_t instance_id)
+ipfw_dyn_reset_eaction(struct ip_fw_chain *ch, uint32_t eaction_id,
+ uint32_t default_id, uint32_t instance_id)
{
#ifdef INET6
struct dyn_ipv6_state *s6;
@@ -2931,70 +2941,47 @@
}
static void
-dyn_export_parent(const struct dyn_parent *p, uint16_t kidx, uint8_t set,
+dyn_export_parent(const struct dyn_parent *p, uint32_t kidx, uint8_t set,
ipfw_dyn_rule *dst)
{
- dst->dyn_type = O_LIMIT_PARENT;
+ dst->type = O_LIMIT_PARENT;
+ dst->set = set;
dst->kidx = kidx;
- dst->count = (uint16_t)DPARENT_COUNT(p);
+ dst->rulenum = p->rulenum;
+ dst->count = DPARENT_COUNT(p);
dst->expire = TIME_LEQ(p->expire, time_uptime) ? 0:
p->expire - time_uptime;
-
- /* 'rule' is used to pass up the rule number and set */
- memcpy(&dst->rule, &p->rulenum, sizeof(p->rulenum));
-
- /* store set number into high word of dst->rule pointer. */
- memcpy((char *)&dst->rule + sizeof(p->rulenum), &set, sizeof(set));
+ dst->hashval = p->hashval;
/* unused fields */
+ dst->pad = 0;
dst->pcnt = 0;
dst->bcnt = 0;
- dst->parent = NULL;
- dst->state = 0;
dst->ack_fwd = 0;
dst->ack_rev = 0;
- dst->bucket = p->hashval;
- /*
- * The legacy userland code will interpret a NULL here as a marker
- * for the last dynamic rule.
- */
- dst->next = (ipfw_dyn_rule *)1;
}
static void
-dyn_export_data(const struct dyn_data *data, uint16_t kidx, uint8_t type,
+dyn_export_data(const struct dyn_data *data, uint32_t kidx, uint8_t type,
uint8_t set, ipfw_dyn_rule *dst)
{
- dst->dyn_type = type;
+ dst->type = type;
+ dst->set = set;
dst->kidx = kidx;
+ dst->rulenum = data->rulenum;
dst->pcnt = data->pcnt_fwd + data->pcnt_rev;
dst->bcnt = data->bcnt_fwd + data->bcnt_rev;
dst->expire = TIME_LEQ(data->expire, time_uptime) ? 0:
data->expire - time_uptime;
-
- /* 'rule' is used to pass up the rule number and set */
- memcpy(&dst->rule, &data->rulenum, sizeof(data->rulenum));
-
- /* store set number into high word of dst->rule pointer. */
- memcpy((char *)&dst->rule + sizeof(data->rulenum), &set, sizeof(set));
-
dst->state = data->state;
if (data->flags & DYN_REFERENCED)
dst->state |= IPFW_DYN_ORPHANED;
- /* unused fields */
- dst->parent = NULL;
dst->ack_fwd = data->ack_fwd;
dst->ack_rev = data->ack_rev;
- dst->count = 0;
- dst->bucket = data->hashval;
- /*
- * The legacy userland code will interpret a NULL here as a marker
- * for the last dynamic rule.
- */
- dst->next = (ipfw_dyn_rule *)1;
+ dst->hashval = data->hashval;
}
static void
@@ -3122,52 +3109,6 @@
#undef DYN_EXPORT_STATES
}
-/*
- * Fill given buffer with dynamic states (legacy format).
- * IPFW_UH_RLOCK has to be held while calling.
- */
-void
-ipfw_get_dynamic(struct ip_fw_chain *chain, char **pbp, const char *ep)
-{
-#ifdef INET6
- struct dyn_ipv6_state *s6;
-#endif
- struct dyn_ipv4_state *s4;
- ipfw_dyn_rule *p, *last = NULL;
- char *bp;
- uint32_t bucket;
-
- if (V_dyn_count == 0)
- return;
- bp = *pbp;
-
- IPFW_UH_RLOCK_ASSERT(chain);
-
-#define DYN_EXPORT_STATES(s, af, head, b) \
- CK_SLIST_FOREACH(s, &V_dyn_ ## head[b], entry) { \
- if (bp + sizeof(*p) > ep) \
- break; \
- p = (ipfw_dyn_rule *)bp; \
- dyn_export_ ## af ## _state(s, p); \
- last = p; \
- bp += sizeof(*p); \
- }
-
- for (bucket = 0; bucket < V_curr_dyn_buckets; bucket++) {
- DYN_EXPORT_STATES(s4, ipv4, ipv4_parent, bucket);
- DYN_EXPORT_STATES(s4, ipv4, ipv4, bucket);
-#ifdef INET6
- DYN_EXPORT_STATES(s6, ipv6, ipv6_parent, bucket);
- DYN_EXPORT_STATES(s6, ipv6, ipv6, bucket);
-#endif /* INET6 */
- }
-
- if (last != NULL) /* mark last dynamic rule */
- last->next = NULL;
- *pbp = bp;
-#undef DYN_EXPORT_STATES
-}
-
void
ipfw_dyn_init(struct ip_fw_chain *chain)
{
diff --git a/sys/netpfil/ipfw/ip_fw_eaction.c b/sys/netpfil/ipfw/ip_fw_eaction.c
--- a/sys/netpfil/ipfw/ip_fw_eaction.c
+++ b/sys/netpfil/ipfw/ip_fw_eaction.c
@@ -1,6 +1,8 @@
/*-
- * Copyright (c) 2016-2017 Yandex LLC
- * Copyright (c) 2016-2017 Andrey V. Elsukov <ae@FreeBSD.org>
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
+ * Copyright (c) 2016-2025 Yandex LLC
+ * Copyright (c) 2016-2025 Andrey V. Elsukov <ae@FreeBSD.org>
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -68,7 +70,7 @@
* It is possible to pass some additional information to external
* action handler using O_EXTERNAL_INSTANCE and O_EXTERNAL_DATA opcodes.
* Such opcodes should be next after the O_EXTERNAL_ACTION opcode.
- * For the O_EXTERNAL_INSTANCE opcode the cmd->arg1 contains index of named
+ * For the O_EXTERNAL_INSTANCE opcode the cmd->kidx contains index of named
* object related to an instance of external action.
* For the O_EXTERNAL_DATA opcode the cmd contains the data that can be used
* by external action handler without needing to create named instance.
@@ -76,7 +78,7 @@
* In case when eaction module uses named instances, it should register
* opcode rewriting routines for O_EXTERNAL_INSTANCE opcode. The
* classifier callback can look back into O_EXTERNAL_ACTION opcode (it
- * must be in the (ipfw_insn *)(cmd - 1)). By arg1 from O_EXTERNAL_ACTION
+ * must be in the (ipfw_insn *)(cmd - 2)). By kidx from O_EXTERNAL_ACTION
* it can deteremine eaction_id and compare it with its own.
* The macro IPFW_TLV_EACTION_NAME(eaction_id) can be used to deteremine
* the type of named_object related to external action instance.
@@ -92,7 +94,7 @@
};
#define EACTION_OBJ(ch, cmd) \
- ((struct eaction_obj *)SRV_OBJECT((ch), (cmd)->arg1))
+ ((struct eaction_obj *)SRV_OBJECT((ch), insntod((cmd), kidx)->kidx))
#if 0
#define EACTION_DEBUG(fmt, ...) do { \
@@ -116,21 +118,28 @@
* Opcode rewriting callbacks.
*/
static int
-eaction_classify(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
+eaction_classify(ipfw_insn *cmd0, uint32_t *puidx, uint8_t *ptype)
{
+ ipfw_insn_kidx *cmd;
+
+ if (F_LEN(cmd0) <= 1)
+ return (EINVAL);
- EACTION_DEBUG("opcode %d, arg1 %d", cmd->opcode, cmd->arg1);
- *puidx = cmd->arg1;
+ cmd = insntod(cmd0, kidx);
+ EACTION_DEBUG("opcode %u, kidx %u", cmd0->opcode, cmd->kidx);
+ *puidx = cmd->kidx;
*ptype = 0;
return (0);
}
static void
-eaction_update(ipfw_insn *cmd, uint16_t idx)
+eaction_update(ipfw_insn *cmd0, uint32_t idx)
{
+ ipfw_insn_kidx *cmd;
- cmd->arg1 = idx;
- EACTION_DEBUG("opcode %d, arg1 -> %d", cmd->opcode, cmd->arg1);
+ cmd = insntod(cmd0, kidx);
+ cmd->kidx = idx;
+ EACTION_DEBUG("opcode %u, kidx -> %u", cmd0->opcode, cmd->kidx);
}
static int
@@ -162,7 +171,7 @@
}
static struct named_object *
-eaction_findbykidx(struct ip_fw_chain *ch, uint16_t idx)
+eaction_findbykidx(struct ip_fw_chain *ch, uint32_t idx)
{
EACTION_DEBUG("kidx %u", idx);
@@ -182,7 +191,7 @@
static int
create_eaction_obj(struct ip_fw_chain *ch, ipfw_eaction_t handler,
- const char *name, uint16_t *eaction_id)
+ const char *name, uint32_t *eaction_id)
{
struct namedobj_instance *ni;
struct eaction_obj *obj;
@@ -249,8 +258,8 @@
* Resets all eaction opcodes to default handlers.
*/
static void
-reset_eaction_rules(struct ip_fw_chain *ch, uint16_t eaction_id,
- uint16_t instance_id, bool reset_rules)
+reset_eaction_rules(struct ip_fw_chain *ch, uint32_t eaction_id,
+ uint32_t instance_id, bool reset_rules)
{
struct named_object *no;
int i;
@@ -332,11 +341,11 @@
* Registers external action handler to the global array.
* On success it returns eaction id, otherwise - zero.
*/
-uint16_t
+uint32_t
ipfw_add_eaction(struct ip_fw_chain *ch, ipfw_eaction_t handler,
const char *name)
{
- uint16_t eaction_id;
+ uint32_t eaction_id;
eaction_id = 0;
if (ipfw_check_object_name_generic(name) == 0) {
@@ -351,7 +360,7 @@
* Deregisters external action handler with id eaction_id.
*/
int
-ipfw_del_eaction(struct ip_fw_chain *ch, uint16_t eaction_id)
+ipfw_del_eaction(struct ip_fw_chain *ch, uint32_t eaction_id)
{
struct named_object *no;
@@ -371,7 +380,7 @@
int
ipfw_reset_eaction(struct ip_fw_chain *ch, struct ip_fw *rule,
- uint16_t eaction_id, uint16_t default_id, uint16_t instance_id)
+ uint32_t eaction_id, uint32_t default_id, uint32_t instance_id)
{
ipfw_insn *cmd, *icmd;
int l;
@@ -385,22 +394,23 @@
*/
cmd = ipfw_get_action(rule);
if (cmd->opcode != O_EXTERNAL_ACTION ||
- cmd->arg1 != eaction_id)
+ insntod(cmd, kidx)->kidx != eaction_id)
return (0);
/*
* Check if there is O_EXTERNAL_INSTANCE opcode, we need
* to truncate the rule length.
*
- * NOTE: F_LEN(cmd) must be 1 for O_EXTERNAL_ACTION opcode,
+ * NOTE: F_LEN(cmd) must be 2 for O_EXTERNAL_ACTION opcode,
* and rule length should be enough to keep O_EXTERNAL_INSTANCE
- * opcode, thus we do check for l > 1.
+ * opcode, thus we do check for l > 2.
*/
l = rule->cmd + rule->cmd_len - cmd;
- if (l > 1) {
- MPASS(F_LEN(cmd) == 1);
- icmd = cmd + 1;
+ if (l > 2) {
+ MPASS(F_LEN(cmd) == 2);
+ icmd = cmd + F_LEN(cmd);
if (icmd->opcode == O_EXTERNAL_INSTANCE &&
- instance_id != 0 && icmd->arg1 != instance_id)
+ instance_id != 0 &&
+ insntod(icmd, kidx)->kidx != instance_id)
return (0);
/*
* Since named_object related to this instance will be
@@ -408,7 +418,7 @@
* the rest of cmd chain just after O_EXTERNAL_ACTION
* opcode.
*/
- EACTION_DEBUG("truncate rule %d: len %u -> %u",
+ EACTION_DEBUG("truncate rule %u: len %u -> %u",
rule->rulenum, rule->cmd_len,
rule->cmd_len - F_LEN(icmd));
rule->cmd_len -= F_LEN(icmd);
@@ -416,7 +426,7 @@
(uint32_t *)rule->cmd) == rule->cmd_len);
}
- cmd->arg1 = default_id; /* Set to default id */
+ insntod(cmd, kidx)->kidx = default_id; /* Set to default id */
/*
* Return 1 when reset successfully happened.
*/
@@ -429,8 +439,8 @@
* eaction has instance with id == kidx.
*/
int
-ipfw_reset_eaction_instance(struct ip_fw_chain *ch, uint16_t eaction_id,
- uint16_t kidx)
+ipfw_reset_eaction_instance(struct ip_fw_chain *ch, uint32_t eaction_id,
+ uint32_t kidx)
{
struct named_object *no;
@@ -448,5 +458,6 @@
ipfw_insn *cmd, int *done)
{
+ MPASS(F_LEN(cmd) == 2);
return (EACTION_OBJ(ch, cmd)->handler(ch, args, cmd, done));
}
diff --git a/sys/netpfil/ipfw/ip_fw_iface.c b/sys/netpfil/ipfw/ip_fw_iface.c
--- a/sys/netpfil/ipfw/ip_fw_iface.c
+++ b/sys/netpfil/ipfw/ip_fw_iface.c
@@ -1,5 +1,7 @@
/*-
- * Copyright (c) 2014 Yandex LLC.
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
+ * Copyright (c) 2014-2025 Yandex LLC.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -69,7 +71,7 @@
struct sockopt_data *sd);
static struct ipfw_sopt_handler scodes[] = {
- { IP_FW_XIFLIST, 0, HDIR_GET, list_ifaces },
+ { IP_FW_XIFLIST, IP_FW3_OPVER, HDIR_GET, list_ifaces },
};
/*
@@ -231,7 +233,7 @@
{
struct namedobj_instance *ii;
- ii = ipfw_objhash_create(DEFAULT_IFACES);
+ ii = ipfw_objhash_create(DEFAULT_IFACES, DEFAULT_OBJHASH_SIZE);
IPFW_UH_WLOCK(ch);
if (ch->ifcfg == NULL) {
ch->ifcfg = ii;
@@ -485,7 +487,7 @@
/*
* Lists all interface currently tracked by ipfw.
- * Data layout (v0)(current):
+ * Data layout (v1)(current):
* Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size
* Reply: [ ipfw_obj_lheader ipfw_iface_info x N ]
*
diff --git a/sys/netpfil/ipfw/ip_fw_log.c b/sys/netpfil/ipfw/ip_fw_log.c
--- a/sys/netpfil/ipfw/ip_fw_log.c
+++ b/sys/netpfil/ipfw/ip_fw_log.c
@@ -46,9 +46,12 @@
#include <sys/syslog.h>
#include <net/ethernet.h> /* for ETHERTYPE_IP */
#include <net/if.h>
+#include <net/if_dl.h>
#include <net/if_var.h>
#include <net/if_private.h>
#include <net/vnet.h>
+#include <net/route.h>
+#include <net/route/route_var.h>
#include <netinet/in.h>
#include <netinet/ip.h>
@@ -92,42 +95,43 @@
#endif /* !__APPLE__ */
#define TARG(k, f) IP_FW_ARG_TABLEARG(chain, k, f)
+
+static void
+ipfw_log_ipfw0(struct ip_fw_args *args, struct ip *ip)
+{
+ if (args->flags & IPFW_ARGS_LENMASK)
+ ipfw_bpf_tap(args->mem, IPFW_ARGS_LENGTH(args->flags));
+ else if (args->flags & IPFW_ARGS_ETHER)
+ /* layer2, use orig hdr */
+ ipfw_bpf_mtap(args->m);
+ else {
+ /* Add fake header. Later we will store
+ * more info in the header.
+ */
+ if (ip->ip_v == 4)
+ ipfw_bpf_mtap2("DDDDDDSSSSSS\x08\x00",
+ ETHER_HDR_LEN, args->m);
+ else if (ip->ip_v == 6)
+ ipfw_bpf_mtap2("DDDDDDSSSSSS\x86\xdd",
+ ETHER_HDR_LEN, args->m);
+ else
+ /* Obviously bogus EtherType. */
+ ipfw_bpf_mtap2("DDDDDDSSSSSS\xff\xff",
+ ETHER_HDR_LEN, args->m);
+ }
+}
+
/*
- * We enter here when we have a rule with O_LOG.
* XXX this function alone takes about 2Kbytes of code!
*/
-void
-ipfw_log(struct ip_fw_chain *chain, struct ip_fw *f, u_int hlen,
+static void
+ipfw_log_syslog(struct ip_fw_chain *chain, struct ip_fw *f, u_int hlen,
struct ip_fw_args *args, u_short offset, uint32_t tablearg, struct ip *ip)
{
char *action;
int limit_reached = 0;
char action2[92], proto[128], fragment[32], mark_str[24];
- if (V_fw_verbose == 0) {
- if (args->flags & IPFW_ARGS_LENMASK)
- ipfw_bpf_tap(args->mem, IPFW_ARGS_LENGTH(args->flags));
- else if (args->flags & IPFW_ARGS_ETHER)
- /* layer2, use orig hdr */
- ipfw_bpf_mtap(args->m);
- else {
- /* Add fake header. Later we will store
- * more info in the header.
- */
- if (ip->ip_v == 4)
- ipfw_bpf_mtap2("DDDDDDSSSSSS\x08\x00",
- ETHER_HDR_LEN, args->m);
- else if (ip->ip_v == 6)
- ipfw_bpf_mtap2("DDDDDDSSSSSS\x86\xdd",
- ETHER_HDR_LEN, args->m);
- else
- /* Obviously bogus EtherType. */
- ipfw_bpf_mtap2("DDDDDDSSSSSS\xff\xff",
- ETHER_HDR_LEN, args->m);
- }
- return;
- }
- /* the old 'log' function */
fragment[0] = '\0';
proto[0] = '\0';
@@ -210,7 +214,7 @@
break;
case O_SKIPTO:
snprintf(SNPARGS(action2, 0), "SkipTo %d",
- TARG(cmd->arg1, skipto));
+ TARG(insntod(cmd, u32)->d[0], skipto));
break;
case O_PIPE:
snprintf(SNPARGS(action2, 0), "Pipe %d",
@@ -269,23 +273,25 @@
break;
case O_CALLRETURN:
if (cmd->len & F_NOT)
- action = "Return";
+ snprintf(SNPARGS(action2, 0), "Return %s",
+ cmd->arg1 == RETURN_NEXT_RULENUM ?
+ "next-rulenum": "next-rule");
else
snprintf(SNPARGS(action2, 0), "Call %d",
- cmd->arg1);
+ TARG(insntod(cmd, u32)->d[0], skipto));
break;
case O_SETMARK:
if (cmd->arg1 == IP_FW_TARG)
- snprintf(SNPARGS(action2, 0), "SetMark %#x",
+ snprintf(SNPARGS(action2, 0), "SetMark %#010x",
TARG(cmd->arg1, mark));
else
- snprintf(SNPARGS(action2, 0), "SetMark %#x",
- ((ipfw_insn_u32 *)cmd)->d[0]);
+ snprintf(SNPARGS(action2, 0), "SetMark %#010x",
+ insntoc(cmd, u32)->d[0]);
break;
case O_EXTERNAL_ACTION:
snprintf(SNPARGS(action2, 0), "Eaction %s",
((struct named_object *)SRV_OBJECT(chain,
- cmd->arg1))->name);
+ insntod(cmd, kidx)->kidx))->name);
break;
default:
action = "UNKNOWN";
@@ -438,4 +444,245 @@
"ipfw: limit %d reached on entry %d\n",
limit_reached, f ? f->rulenum : -1);
}
+
+static void
+ipfw_rtsocklog_fill_l3(struct ip_fw_args *args,
+ char **buf, struct sockaddr **src, struct sockaddr **dst)
+{
+ struct sockaddr_in *v4src, *v4dst;
+#ifdef INET6
+ struct sockaddr_in6 *v6src, *v6dst;
+
+ if (IS_IP6_FLOW_ID(&(args->f_id))) {
+ v6src = (struct sockaddr_in6 *)*buf;
+ *buf += sizeof(*v6src);
+ v6dst = (struct sockaddr_in6 *)*buf;
+ *buf += sizeof(*v6dst);
+ v6src->sin6_len = v6dst->sin6_len = sizeof(*v6src);
+ v6src->sin6_family = v6dst->sin6_family = AF_INET6;
+ v6src->sin6_addr = args->f_id.src_ip6;
+ v6dst->sin6_addr = args->f_id.dst_ip6;
+
+ *src = (struct sockaddr *)v6src;
+ *dst = (struct sockaddr *)v6dst;
+ } else
+#endif
+ {
+ v4src = (struct sockaddr_in *)*buf;
+ *buf += sizeof(*v4src);
+ v4dst = (struct sockaddr_in *)*buf;
+ *buf += sizeof(*v4dst);
+ v4src->sin_len = v4dst->sin_len = sizeof(*v4src);
+ v4src->sin_family = v4dst->sin_family = AF_INET;
+ v4src->sin_addr.s_addr = htonl(args->f_id.src_ip);
+ v4dst->sin_addr.s_addr = htonl(args->f_id.dst_ip);
+
+ *src = (struct sockaddr *)v4src;
+ *dst = (struct sockaddr *)v4dst;
+ }
+}
+
+static struct sockaddr *
+ipfw_rtsocklog_handle_tablearg(struct ip_fw_chain *chain, ipfw_insn *cmd,
+ uint32_t tablearg, uint32_t *targ_value, char **buf)
+{
+ struct sockaddr_in *v4nh = NULL;
+
+ /* handle tablearg now */
+ switch (cmd->opcode) {
+ case O_DIVERT:
+ case O_TEE:
+ *targ_value = TARG(cmd->arg1, divert);
+ break;
+ case O_NETGRAPH:
+ case O_NGTEE:
+ *targ_value = TARG(cmd->arg1, netgraph);
+ break;
+ case O_SETDSCP:
+ *targ_value = (TARG(cmd->arg1, dscp) & 0x3F);
+ break;
+ case O_SETFIB:
+ *targ_value = (TARG(cmd->arg1, fib) & 0x7FFF);
+ break;
+ case O_SKIPTO:
+ case O_CALLRETURN:
+ if (cmd->opcode == O_CALLRETURN && (cmd->len & F_NOT))
+ break;
+ *targ_value = (TARG(insntod(cmd, u32)->d[0], skipto));
+ break;
+ case O_PIPE:
+ case O_QUEUE:
+ *targ_value = TARG(cmd->arg1, pipe);
+ break;
+ case O_MARK:
+ *targ_value = TARG(cmd->arg1, mark);
+ break;
+ case O_FORWARD_IP:
+ v4nh = (struct sockaddr_in *)buf;
+ buf += sizeof(*v4nh);
+ *v4nh = ((ipfw_insn_sa *)cmd)->sa;
+ if (v4nh->sin_addr.s_addr == INADDR_ANY)
+ v4nh->sin_addr.s_addr = htonl(tablearg);
+
+ return (struct sockaddr *)v4nh;
+#ifdef INET6
+ case O_FORWARD_IP6:
+ return (struct sockaddr *)&(((ipfw_insn_sa6 *)cmd)->sa);
+#endif
+ default:
+ break;
+ }
+
+ return (NULL);
+}
+
+#define MAX_COMMENT_LEN 80
+
+static size_t
+ipfw_copy_rule_comment(struct ip_fw *f, char *dst)
+{
+ ipfw_insn *cmd;
+ size_t rcomment_len = 0;
+ int l, cmdlen;
+
+ for (l = f->cmd_len, cmd = f->cmd; l > 0; l -= cmdlen, cmd += cmdlen) {
+ cmdlen = F_LEN(cmd);
+ if (cmd->opcode != O_NOP) {
+ continue;
+ } else if (cmd->len == 1) {
+ return (0);
+ }
+ break;
+ }
+ if (l <= 0) {
+ return (0);
+ }
+ rcomment_len = strnlen((char *)(cmd + 1), MAX_COMMENT_LEN - 1) + 1;
+ strlcpy(dst, (char *)(cmd + 1), rcomment_len);
+ return (rcomment_len);
+}
+
+static void
+ipfw_log_rtsock(struct ip_fw_chain *chain, struct ip_fw *f, u_int hlen,
+ struct ip_fw_args *args, u_short offset, uint32_t tablearg,
+ void *_eh)
+{
+ struct sockaddr_dl *sdl_ipfwcmd;
+ struct ether_header *eh = _eh;
+ struct rt_addrinfo *info;
+ uint32_t *targ_value;
+ ipfwlog_rtsock_hdr_v2 *hdr;
+ ipfw_insn *cmd;
+ ipfw_insn_log *l;
+ char *buf, *orig_buf;
+ /* at least 4 x sizeof(struct sockaddr_dl) + rule comment (80) */
+ size_t buflen = 512;
+
+ /* Should we log? O_LOG is the first one */
+ cmd = ACTION_PTR(f);
+ l = (ipfw_insn_log *)cmd;
+
+ if (l->max_log != 0 && l->log_left == 0)
+ return;
+
+ l->log_left--;
+ if (V_fw_verbose != 0 && l->log_left == 0) {
+ log(LOG_SECURITY | LOG_NOTICE,
+ "ipfw: limit %d reached on entry %d\n",
+ l->max_log, f ? f->rulenum : -1);
+ }
+
+ buf = orig_buf = malloc(buflen, M_TEMP, M_NOWAIT | M_ZERO);
+ if (buf == NULL)
+ return;
+
+ info = (struct rt_addrinfo *)buf;
+ buf += sizeof (*info);
+
+ cmd = ipfw_get_action(f);
+ sdl_ipfwcmd = (struct sockaddr_dl *)buf;
+ sdl_ipfwcmd->sdl_family = AF_IPFWLOG;
+ sdl_ipfwcmd->sdl_index = f->set;
+ sdl_ipfwcmd->sdl_type = 2; /* version */
+ sdl_ipfwcmd->sdl_alen = sizeof(*hdr);
+ hdr = (ipfwlog_rtsock_hdr_v2 *)(sdl_ipfwcmd->sdl_data);
+ /* fill rule comment in if any */
+ sdl_ipfwcmd->sdl_nlen = ipfw_copy_rule_comment(f, hdr->comment);
+ targ_value = &hdr->tablearg;
+ hdr->rulenum = f->rulenum;
+ hdr->mark = args->rule.pkt_mark;
+ hdr->cmd = *cmd;
+
+ sdl_ipfwcmd->sdl_len = sizeof(*sdl_ipfwcmd);
+ if (sizeof(*hdr) + sdl_ipfwcmd->sdl_nlen > sizeof(sdl_ipfwcmd->sdl_data)) {
+ sdl_ipfwcmd->sdl_len += sizeof(*hdr) + sdl_ipfwcmd->sdl_nlen -
+ sizeof(sdl_ipfwcmd->sdl_data);
+ }
+ buf += sdl_ipfwcmd->sdl_len;
+
+ /* fill L2 in if present */
+ if (args->flags & IPFW_ARGS_ETHER && eh != NULL) {
+ sdl_ipfwcmd->sdl_slen = sizeof(eh->ether_shost);
+ memcpy(hdr->ether_shost, eh->ether_shost,
+ sdl_ipfwcmd->sdl_slen);
+ memcpy(hdr->ether_dhost, eh->ether_dhost,
+ sdl_ipfwcmd->sdl_slen);
+ }
+
+ info->rti_info[RTAX_DST] = (struct sockaddr *)sdl_ipfwcmd;
+
+ /* Warn if we're about to stop sending messages */
+ if (l->max_log != 0 && l->log_left < (l->max_log >> 1)) {
+ info->rti_flags |= RTF_PROTO1;
+ }
+
+ /* handle tablearg */
+ info->rti_info[RTAX_GENMASK] = ipfw_rtsocklog_handle_tablearg(
+ chain, cmd, tablearg, targ_value, &buf);
+
+ /* L3 */
+ ipfw_rtsocklog_fill_l3(args, &buf,
+ &info->rti_info[RTAX_GATEWAY],
+ &info->rti_info[RTAX_NETMASK]);
+
+ info->rti_ifp = args->ifp;
+ rtsock_routemsg_info(RTM_IPFWLOG, info, RT_ALL_FIBS);
+
+ free(orig_buf, M_TEMP);
+}
+
+/*
+ * We enter here when we have a rule with O_LOG.
+ */
+void
+ipfw_log(struct ip_fw_chain *chain, struct ip_fw *f, u_int hlen,
+ struct ip_fw_args *args, u_short offset, uint32_t tablearg,
+ struct ip *ip, void *eh)
+{
+ ipfw_insn *cmd;
+
+ if (f == NULL || hlen == 0)
+ return;
+
+ /* O_LOG is the first action */
+ cmd = ACTION_PTR(f);
+
+ if (cmd->arg1 == IPFW_LOG_DEFAULT) {
+ if (V_fw_verbose == 0) {
+ ipfw_log_ipfw0(args, ip);
+ return;
+ }
+ ipfw_log_syslog(chain, f, hlen, args, offset, tablearg, ip);
+ return;
+ }
+
+ if (cmd->arg1 & IPFW_LOG_SYSLOG)
+ ipfw_log_syslog(chain, f, hlen, args, offset, tablearg, ip);
+
+ if (cmd->arg1 & IPFW_LOG_RTSOCK)
+ ipfw_log_rtsock(chain, f, hlen, args, offset, tablearg, eh);
+
+ if (cmd->arg1 & IPFW_LOG_IPFW0)
+ ipfw_log_ipfw0(args, ip);
+}
/* end of file */
diff --git a/sys/netpfil/ipfw/ip_fw_nat.c b/sys/netpfil/ipfw/ip_fw_nat.c
--- a/sys/netpfil/ipfw/ip_fw_nat.c
+++ b/sys/netpfil/ipfw/ip_fw_nat.c
@@ -881,11 +881,11 @@
}
static struct ipfw_sopt_handler scodes[] = {
- { IP_FW_NAT44_XCONFIG, 0, HDIR_SET, nat44_cfg },
- { IP_FW_NAT44_DESTROY, 0, HDIR_SET, nat44_destroy },
- { IP_FW_NAT44_XGETCONFIG, 0, HDIR_GET, nat44_get_cfg },
- { IP_FW_NAT44_LIST_NAT, 0, HDIR_GET, nat44_list_nat },
- { IP_FW_NAT44_XGETLOG, 0, HDIR_GET, nat44_get_log },
+ { IP_FW_NAT44_XCONFIG, IP_FW3_OPVER, HDIR_SET, nat44_cfg },
+ { IP_FW_NAT44_DESTROY, IP_FW3_OPVER, HDIR_SET, nat44_destroy },
+ { IP_FW_NAT44_XGETCONFIG, IP_FW3_OPVER, HDIR_GET, nat44_get_cfg },
+ { IP_FW_NAT44_LIST_NAT, IP_FW3_OPVER, HDIR_GET, nat44_list_nat },
+ { IP_FW_NAT44_XGETLOG, IP_FW3_OPVER, HDIR_GET, nat44_get_log },
};
/*
diff --git a/sys/netpfil/ipfw/ip_fw_private.h b/sys/netpfil/ipfw/ip_fw_private.h
--- a/sys/netpfil/ipfw/ip_fw_private.h
+++ b/sys/netpfil/ipfw/ip_fw_private.h
@@ -156,6 +156,7 @@
/* In ip_fw_log.c */
struct ip;
+struct ip_fw;
struct ip_fw_chain;
void ipfw_bpf_init(int);
@@ -164,7 +165,8 @@
void ipfw_bpf_mtap(struct mbuf *);
void ipfw_bpf_mtap2(void *, u_int, struct mbuf *);
void ipfw_log(struct ip_fw_chain *chain, struct ip_fw *f, u_int hlen,
- struct ip_fw_args *args, u_short offset, uint32_t tablearg, struct ip *ip);
+ struct ip_fw_args *args, u_short offset, uint32_t tablearg, struct ip *ip,
+ void *eh);
VNET_DECLARE(u_int64_t, norule_counter);
#define V_norule_counter VNET(norule_counter)
VNET_DECLARE(int, verbose_limit);
@@ -196,8 +198,8 @@
(p)->kidx = 0; \
} while (0)
struct ipfw_dyn_info {
- uint16_t direction; /* match direction */
- uint16_t kidx; /* state name kidx */
+ uint32_t direction; /* match direction */
+ uint32_t kidx; /* state name kidx */
uint32_t hashval; /* hash value */
uint32_t version; /* bucket version */
uint32_t f_pos;
@@ -219,8 +221,8 @@
void ipfw_dyn_uninit(int); /* per-vnet deinitialization */
int ipfw_dyn_len(void);
uint32_t ipfw_dyn_get_count(uint32_t *, int *);
-void ipfw_dyn_reset_eaction(struct ip_fw_chain *ch, uint16_t eaction_id,
- uint16_t default_id, uint16_t instance_id);
+void ipfw_dyn_reset_eaction(struct ip_fw_chain *ch, uint32_t eaction_id,
+ uint32_t default_id, uint32_t instance_id);
/* common variables */
VNET_DECLARE(int, fw_one_pass);
@@ -235,6 +237,9 @@
VNET_DECLARE(int, ipfw_vnet_ready);
#define V_ipfw_vnet_ready VNET(ipfw_vnet_ready)
+VNET_DECLARE(int, skipto_cache);
+#define V_skipto_cache VNET(skipto_cache)
+
VNET_DECLARE(u_int32_t, set_disable);
#define V_set_disable VNET(set_disable)
@@ -276,9 +281,10 @@
struct ip_fw {
uint16_t act_ofs; /* offset of action in 32-bit units */
uint16_t cmd_len; /* # of 32-bit words in cmd */
- uint16_t rulenum; /* rule number */
+ uint32_t rulenum; /* rule number */
uint8_t set; /* rule set (0..31) */
uint8_t flags; /* currently unused */
+ uint16_t _pad;
counter_u64_t cntr; /* Pointer to rule counters */
struct ip_fw_jump_cache cache; /* used by jump_fast */
uint32_t timestamp; /* tv_sec of last match */
@@ -306,7 +312,6 @@
#else
struct rmlock rwmtx;
#endif
- int static_len; /* total len of static rules (v0) */
uint32_t gencnt; /* NAT generation count */
LIST_HEAD(nat_list, cfg_nat) nat; /* list of nat entries */
struct ip_fw *default_rule;
@@ -324,9 +329,9 @@
/* 64-byte structure representing multi-field table value */
struct table_value {
uint32_t tag; /* O_TAG/O_TAGGED */
- uint32_t pipe; /* O_PIPE/O_QUEUE */
+ uint16_t pipe; /* O_PIPE/O_QUEUE */
uint16_t divert; /* O_DIVERT/O_TEE */
- uint16_t skipto; /* skipto, CALLRET */
+ uint32_t skipto; /* skipto, CALLRET */
uint32_t netgraph; /* O_NETGRAPH/O_NGTEE */
uint16_t fib; /* O_SETFIB */
uint16_t nat; /* O_NAT */
@@ -349,8 +354,7 @@
uint16_t etlv; /* Export TLV id */
uint8_t subtype;/* object subtype within class */
uint8_t set; /* set object belongs to */
- uint16_t kidx; /* object kernel index */
- uint16_t spare;
+ uint32_t kidx; /* object kernel index */
uint32_t ocnt; /* object counter for internal use */
uint32_t refcnt; /* number of references */
};
@@ -476,8 +480,8 @@
#define IPFW_UH_WUNLOCK(p) rw_wunlock(&(p)->uh_lock)
struct obj_idx {
- uint16_t uidx; /* internal index supplied by userland */
- uint16_t kidx; /* kernel object index */
+ uint32_t uidx; /* internal index supplied by userland */
+ uint32_t kidx; /* kernel object index */
uint16_t off; /* tlv offset from rule end in 4-byte words */
uint8_t spare;
uint8_t type; /* object type within its category */
@@ -495,36 +499,6 @@
struct obj_idx obuf[8]; /* table references storage */
};
-/* Legacy interface support */
-/*
- * FreeBSD 8 export rule format
- */
-struct ip_fw_rule0 {
- struct ip_fw *x_next; /* linked list of rules */
- struct ip_fw *next_rule; /* ptr to next [skipto] rule */
- /* 'next_rule' is used to pass up 'set_disable' status */
-
- uint16_t act_ofs; /* offset of action in 32-bit units */
- uint16_t cmd_len; /* # of 32-bit words in cmd */
- uint16_t rulenum; /* rule number */
- uint8_t set; /* rule set (0..31) */
- uint8_t _pad; /* padding */
- uint32_t id; /* rule id */
-
- /* These fields are present in all rules. */
- uint64_t pcnt; /* Packet counter */
- uint64_t bcnt; /* Byte counter */
- uint32_t timestamp; /* tv_sec of last match */
-
- ipfw_insn cmd[1]; /* storage for commands */
-};
-
-struct ip_fw_bcounter0 {
- uint64_t pcnt; /* Packet counter */
- uint64_t bcnt; /* Byte counter */
- uint32_t timestamp; /* tv_sec of last match */
-};
-
/* Kernel rule length */
/*
* RULE _K_ SIZE _V_ ->
@@ -534,9 +508,6 @@
* RULESIZE _V_ ->
* get user size rule length
*/
-/* FreeBSD8 <> current kernel format */
-#define RULEUSIZE0(r) (sizeof(struct ip_fw_rule0) + (r)->cmd_len * 4 - 4)
-#define RULEKSIZE0(r) roundup2((sizeof(struct ip_fw) + (r)->cmd_len*4 - 4), 8)
/* FreeBSD11 <> current kernel format */
#define RULEUSIZE1(r) (roundup2(sizeof(struct ip_fw_rule) + \
(r)->cmd_len * 4 - 4, 8))
@@ -550,17 +521,17 @@
#define IPFW_TABLES_MAX 65536
#define IPFW_TABLES_DEFAULT 128
#define IPFW_OBJECTS_MAX 65536
-#define IPFW_OBJECTS_DEFAULT 1024
+#define IPFW_OBJECTS_DEFAULT 4096
#define CHAIN_TO_SRV(ch) ((ch)->srvmap)
#define SRV_OBJECT(ch, idx) ((ch)->srvstate[(idx)])
struct tid_info {
uint32_t set; /* table set */
- uint16_t uidx; /* table index */
+ uint32_t uidx; /* table index */
uint8_t type; /* table type */
uint8_t atype;
- uint8_t spare;
+ uint16_t spare;
int tlen; /* Total TLV size block */
void *tlvs; /* Pointer to first TLV */
};
@@ -570,11 +541,11 @@
* If true, returns its index and type.
* Returns 0 if match is found, 1 overwise.
*/
-typedef int (ipfw_obj_rw_cl)(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype);
+typedef int (ipfw_obj_rw_cl)(ipfw_insn *cmd, uint32_t *puidx, uint8_t *ptype);
/*
* Updater callback. Sets kernel object reference index to @puidx
*/
-typedef void (ipfw_obj_rw_upd)(ipfw_insn *cmd, uint16_t puidx);
+typedef void (ipfw_obj_rw_upd)(ipfw_insn *cmd, uint32_t puidx);
/*
* Finder callback. Tries to find named object by name (specified via @ti).
* Stores found named object pointer in @pno.
@@ -590,7 +561,7 @@
* Returns pointer to named object or NULL.
*/
typedef struct named_object *(ipfw_obj_fidx_cb)(struct ip_fw_chain *ch,
- uint16_t kidx);
+ uint32_t kidx);
/*
* Object creator callback. Tries to create object specified by @ti.
* Stores newly-allocated object index in @pkidx.
@@ -598,7 +569,7 @@
* Returns 0 on success.
*/
typedef int (ipfw_obj_create_cb)(struct ip_fw_chain *ch, struct tid_info *ti,
- uint16_t *pkidx);
+ uint32_t *pkidx);
/*
* Object destroy callback. Intended to free resources allocated by
* create_object callback.
@@ -618,7 +589,7 @@
SWAP_ALL = 0, TEST_ALL, MOVE_ALL, COUNT_ONE, TEST_ONE, MOVE_ONE
};
typedef int (ipfw_obj_sets_cb)(struct ip_fw_chain *ch,
- uint16_t set, uint8_t new_set, enum ipfw_sets_cmd cmd);
+ uint32_t set, uint8_t new_set, enum ipfw_sets_cmd cmd);
struct opcode_obj_rewrite {
uint32_t opcode; /* Opcode to act upon */
@@ -654,8 +625,23 @@
void ipfw_iface_del_notify(struct ip_fw_chain *ch, struct ipfw_ifc *ic);
/* In ip_fw_sockopt.c */
+enum ipfw_opcheck_result {
+ SUCCESS = 0,
+ FAILED,
+ BAD_SIZE,
+ CHECK_ACTION,
+};
+typedef enum ipfw_opcheck_result (*ipfw_check_opcode_t)(ipfw_insn **,
+ int *, struct rule_check_info *);
+
+void ipfw_register_compat(ipfw_check_opcode_t);
+void ipfw_unregister_compat(void);
+
+enum ipfw_opcheck_result ipfw_check_opcode(ipfw_insn **, int *,
+ struct rule_check_info *);
void ipfw_init_skipto_cache(struct ip_fw_chain *chain);
void ipfw_destroy_skipto_cache(struct ip_fw_chain *chain);
+void ipfw_enable_skipto_cache(struct ip_fw_chain *chain);
int ipfw_find_rule(struct ip_fw_chain *chain, uint32_t key, uint32_t id);
int ipfw_ctl3(struct sockopt *sopt);
int ipfw_add_protected_rule(struct ip_fw_chain *chain, struct ip_fw *rule,
@@ -665,11 +651,16 @@
void ipfw_reap_rules(struct ip_fw *head);
void ipfw_init_counters(void);
void ipfw_destroy_counters(void);
+int ipfw_commit_rules(struct ip_fw_chain *chain, struct rule_check_info *rci,
+ int count);
+int delete_range(struct ip_fw_chain *chain, ipfw_range_tlv *rt, int *ndel);
struct ip_fw *ipfw_alloc_rule(struct ip_fw_chain *chain, size_t rulesize);
void ipfw_free_rule(struct ip_fw *rule);
int ipfw_match_range(struct ip_fw *rule, ipfw_range_tlv *rt);
-int ipfw_mark_object_kidx(uint32_t *bmask, uint16_t etlv, uint16_t kidx);
+int ipfw_mark_object_kidx(uint32_t *bmask, uint16_t etlv, uint32_t kidx);
ipfw_insn *ipfw_get_action(struct ip_fw *);
+int ipfw_check_rule(struct ip_fw_rule *rule, size_t size,
+ struct rule_check_info *ci);
typedef int (sopt_handler_f)(struct ip_fw_chain *ch,
ip_fw3_opheader *op3, struct sockopt_data *sd);
@@ -701,6 +692,7 @@
sizeof(c) / sizeof(c[0])); \
} while(0)
+#define DEFAULT_OBJHASH_SIZE 32
struct namedobj_instance;
typedef int (objhash_cb_t)(struct namedobj_instance *ni, struct named_object *,
void *arg);
@@ -708,7 +700,7 @@
uint32_t kopt);
typedef int (objhash_cmp_f)(struct named_object *no, const void *key,
uint32_t kopt);
-struct namedobj_instance *ipfw_objhash_create(uint32_t items);
+struct namedobj_instance *ipfw_objhash_create(uint32_t items, size_t hash_size);
void ipfw_objhash_destroy(struct namedobj_instance *);
void ipfw_objhash_bitmap_alloc(uint32_t items, void **idx, int *pblocks);
void ipfw_objhash_bitmap_merge(struct namedobj_instance *ni,
@@ -722,7 +714,7 @@
struct named_object *ipfw_objhash_lookup_name_type(struct namedobj_instance *ni,
uint32_t set, uint32_t type, const char *name);
struct named_object *ipfw_objhash_lookup_kidx(struct namedobj_instance *ni,
- uint16_t idx);
+ uint32_t idx);
int ipfw_objhash_same_name(struct namedobj_instance *ni, struct named_object *a,
struct named_object *b);
void ipfw_objhash_add(struct namedobj_instance *ni, struct named_object *no);
@@ -733,14 +725,14 @@
void *arg);
int ipfw_objhash_foreach_type(struct namedobj_instance *ni, objhash_cb_t *f,
void *arg, uint16_t type);
-int ipfw_objhash_free_idx(struct namedobj_instance *ni, uint16_t idx);
-int ipfw_objhash_alloc_idx(void *n, uint16_t *pidx);
+int ipfw_objhash_free_idx(struct namedobj_instance *ni, uint32_t idx);
+int ipfw_objhash_alloc_idx(void *n, uint32_t *pidx);
void ipfw_objhash_set_funcs(struct namedobj_instance *ni,
objhash_hash_f *hash_f, objhash_cmp_f *cmp_f);
int ipfw_objhash_find_type(struct namedobj_instance *ni, struct tid_info *ti,
uint32_t etlv, struct named_object **pno);
void ipfw_export_obj_ntlv(struct named_object *no, ipfw_obj_ntlv *ntlv);
-ipfw_obj_ntlv *ipfw_find_name_tlv_type(void *tlvs, int len, uint16_t uidx,
+ipfw_obj_ntlv *ipfw_find_name_tlv_type(void *tlvs, int len, uint32_t uidx,
uint32_t etlv);
void ipfw_init_obj_rewriter(void);
void ipfw_destroy_obj_rewriter(void);
@@ -749,13 +741,13 @@
int create_objects_compat(struct ip_fw_chain *ch, ipfw_insn *cmd,
struct obj_idx *oib, struct obj_idx *pidx, struct tid_info *ti);
-void update_opcode_kidx(ipfw_insn *cmd, uint16_t idx);
-int classify_opcode_kidx(ipfw_insn *cmd, uint16_t *puidx);
+void update_opcode_kidx(ipfw_insn *cmd, uint32_t idx);
+int classify_opcode_kidx(ipfw_insn *cmd, uint32_t *puidx);
void ipfw_init_srv(struct ip_fw_chain *ch);
void ipfw_destroy_srv(struct ip_fw_chain *ch);
int ipfw_check_object_name_generic(const char *name);
int ipfw_obj_manage_sets(struct namedobj_instance *ni, uint16_t type,
- uint16_t set, uint8_t new_set, enum ipfw_sets_cmd cmd);
+ uint32_t set, uint8_t new_set, enum ipfw_sets_cmd cmd);
/* In ip_fw_eaction.c */
typedef int (ipfw_eaction_t)(struct ip_fw_chain *ch, struct ip_fw_args *args,
@@ -763,15 +755,15 @@
int ipfw_eaction_init(struct ip_fw_chain *ch, int first);
void ipfw_eaction_uninit(struct ip_fw_chain *ch, int last);
-uint16_t ipfw_add_eaction(struct ip_fw_chain *ch, ipfw_eaction_t handler,
+uint32_t ipfw_add_eaction(struct ip_fw_chain *ch, ipfw_eaction_t handler,
const char *name);
-int ipfw_del_eaction(struct ip_fw_chain *ch, uint16_t eaction_id);
+int ipfw_del_eaction(struct ip_fw_chain *ch, uint32_t eaction_id);
int ipfw_run_eaction(struct ip_fw_chain *ch, struct ip_fw_args *args,
ipfw_insn *cmd, int *done);
int ipfw_reset_eaction(struct ip_fw_chain *ch, struct ip_fw *rule,
- uint16_t eaction_id, uint16_t default_id, uint16_t instance_id);
-int ipfw_reset_eaction_instance(struct ip_fw_chain *ch, uint16_t eaction_id,
- uint16_t instance_id);
+ uint32_t eaction_id, uint32_t default_id, uint32_t instance_id);
+int ipfw_reset_eaction_instance(struct ip_fw_chain *ch, uint32_t eaction_id,
+ uint32_t instance_id);
/* In ip_fw_table.c */
struct table_info;
@@ -779,12 +771,12 @@
typedef int (table_lookup_t)(struct table_info *ti, void *key, uint32_t keylen,
uint32_t *val);
-int ipfw_lookup_table(struct ip_fw_chain *ch, uint16_t tbl, uint16_t plen,
+int ipfw_lookup_table(struct ip_fw_chain *ch, uint32_t tbl, uint16_t plen,
void *paddr, uint32_t *val);
struct named_object *ipfw_objhash_lookup_table_kidx(struct ip_fw_chain *ch,
- uint16_t kidx);
-int ipfw_ref_table(struct ip_fw_chain *ch, ipfw_obj_ntlv *ntlv, uint16_t *kidx);
-void ipfw_unref_table(struct ip_fw_chain *ch, uint16_t kidx);
+ uint32_t kidx);
+int ipfw_ref_table(struct ip_fw_chain *ch, ipfw_obj_ntlv *ntlv, uint32_t *kidx);
+void ipfw_unref_table(struct ip_fw_chain *ch, uint32_t kidx);
int ipfw_init_tables(struct ip_fw_chain *ch, int first);
int ipfw_resize_tables(struct ip_fw_chain *ch, unsigned int ntables);
int ipfw_switch_tables_namespace(struct ip_fw_chain *ch, unsigned int nsets);
diff --git a/sys/netpfil/ipfw/ip_fw_sockopt.c b/sys/netpfil/ipfw/ip_fw_sockopt.c
--- a/sys/netpfil/ipfw/ip_fw_sockopt.c
+++ b/sys/netpfil/ipfw/ip_fw_sockopt.c
@@ -2,7 +2,7 @@
* SPDX-License-Identifier: BSD-2-Clause
*
* Copyright (c) 2002-2009 Luigi Rizzo, Universita` di Pisa
- * Copyright (c) 2014 Yandex LLC
+ * Copyright (c) 2014-2025 Yandex LLC
* Copyright (c) 2014 Alexander V. Chernikov
*
* Supported by: Valeria Paoli
@@ -74,18 +74,21 @@
#include <security/mac/mac_framework.h>
#endif
-static int ipfw_ctl(struct sockopt *sopt);
+static enum ipfw_opcheck_result
+check_opcode_compat_nop(ipfw_insn **pcmd, int *plen,
+ struct rule_check_info *ci)
+{
+ /* Compatibility code is not registered */
+ return (FAILED);
+}
+
+static ipfw_check_opcode_t check_opcode_f = check_opcode_compat_nop;
+
static int check_ipfw_rule_body(ipfw_insn *cmd, int cmd_len,
struct rule_check_info *ci);
-static int check_ipfw_rule1(struct ip_fw_rule *rule, int size,
- struct rule_check_info *ci);
-static int check_ipfw_rule0(struct ip_fw_rule0 *rule, int size,
- struct rule_check_info *ci);
static int rewrite_rule_uidx(struct ip_fw_chain *chain,
struct rule_check_info *ci);
-#define NAMEDOBJ_HASH_SIZE 32
-
struct namedobj_instance {
struct namedobjects_head *names;
struct namedobjects_head *values;
@@ -108,25 +111,8 @@
MALLOC_DEFINE(M_IPFW, "IpFw/IpAcct", "IpFw/IpAcct chain's");
-static int dump_config(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
- struct sockopt_data *sd);
-static int add_rules(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
- struct sockopt_data *sd);
-static int del_rules(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
- struct sockopt_data *sd);
-static int clear_rules(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
- struct sockopt_data *sd);
-static int move_rules(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
- struct sockopt_data *sd);
-static int manage_sets(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
- struct sockopt_data *sd);
-static int dump_soptcodes(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
- struct sockopt_data *sd);
-static int dump_srvobjects(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
- struct sockopt_data *sd);
-
/* ctl3 handler data */
-struct mtx ctl3_lock;
+static struct mtx ctl3_lock;
#define CTL3_LOCK_INIT() mtx_init(&ctl3_lock, "ctl3_lock", NULL, MTX_DEF)
#define CTL3_LOCK_DESTROY() mtx_destroy(&ctl3_lock)
#define CTL3_LOCK() mtx_lock(&ctl3_lock)
@@ -136,28 +122,31 @@
static size_t ctl3_hsize;
static uint64_t ctl3_refct, ctl3_gencnt;
#define CTL3_SMALLBUF 4096 /* small page-size write buffer */
-#define CTL3_LARGEBUF 16 * 1024 * 1024 /* handle large rulesets */
+#define CTL3_LARGEBUF (16 * 1024 * 1024) /* handle large rulesets */
static int ipfw_flush_sopt_data(struct sockopt_data *sd);
-static struct ipfw_sopt_handler scodes[] = {
- { IP_FW_XGET, 0, HDIR_GET, dump_config },
- { IP_FW_XADD, 0, HDIR_BOTH, add_rules },
- { IP_FW_XDEL, 0, HDIR_BOTH, del_rules },
- { IP_FW_XZERO, 0, HDIR_SET, clear_rules },
- { IP_FW_XRESETLOG, 0, HDIR_SET, clear_rules },
- { IP_FW_XMOVE, 0, HDIR_SET, move_rules },
- { IP_FW_SET_SWAP, 0, HDIR_SET, manage_sets },
- { IP_FW_SET_MOVE, 0, HDIR_SET, manage_sets },
- { IP_FW_SET_ENABLE, 0, HDIR_SET, manage_sets },
- { IP_FW_DUMP_SOPTCODES, 0, HDIR_GET, dump_soptcodes },
- { IP_FW_DUMP_SRVOBJECTS,0, HDIR_GET, dump_srvobjects },
+static sopt_handler_f dump_config, add_rules, del_rules, clear_rules,
+ move_rules, manage_sets, dump_soptcodes, dump_srvobjects,
+ manage_skiptocache;
+
+static struct ipfw_sopt_handler scodes[] = {
+ { IP_FW_XGET, IP_FW3_OPVER, HDIR_GET, dump_config },
+ { IP_FW_XADD, IP_FW3_OPVER, HDIR_BOTH, add_rules },
+ { IP_FW_XDEL, IP_FW3_OPVER, HDIR_BOTH, del_rules },
+ { IP_FW_XZERO, IP_FW3_OPVER, HDIR_SET, clear_rules },
+ { IP_FW_XRESETLOG, IP_FW3_OPVER, HDIR_SET, clear_rules },
+ { IP_FW_XMOVE, IP_FW3_OPVER, HDIR_SET, move_rules },
+ { IP_FW_SET_SWAP, IP_FW3_OPVER, HDIR_SET, manage_sets },
+ { IP_FW_SET_MOVE, IP_FW3_OPVER, HDIR_SET, manage_sets },
+ { IP_FW_SET_ENABLE, IP_FW3_OPVER, HDIR_SET, manage_sets },
+ { IP_FW_DUMP_SOPTCODES, IP_FW3_OPVER, HDIR_GET, dump_soptcodes },
+ { IP_FW_DUMP_SRVOBJECTS, IP_FW3_OPVER, HDIR_GET, dump_srvobjects },
+ { IP_FW_SKIPTO_CACHE, IP_FW3_OPVER, HDIR_BOTH, manage_skiptocache },
};
-static int
-set_legacy_obj_kidx(struct ip_fw_chain *ch, struct ip_fw_rule0 *rule);
static struct opcode_obj_rewrite *find_op_rw(ipfw_insn *cmd,
- uint16_t *puidx, uint8_t *ptype);
+ uint32_t *puidx, uint8_t *ptype);
static int ref_rule_objects(struct ip_fw_chain *ch, struct ip_fw *rule,
struct rule_check_info *ci, struct obj_idx *oib, struct tid_info *ti);
static int ref_opcode_object(struct ip_fw_chain *ch, ipfw_insn *cmd,
@@ -165,7 +154,7 @@
static void unref_rule_objects(struct ip_fw_chain *chain, struct ip_fw *rule);
static void unref_oib_objects(struct ip_fw_chain *ch, ipfw_insn *cmd,
struct obj_idx *oib, struct obj_idx *end);
-static int export_objhash_ntlv(struct namedobj_instance *ni, uint16_t kidx,
+static int export_objhash_ntlv(struct namedobj_instance *ni, uint32_t kidx,
struct sockopt_data *sd);
/*
@@ -256,7 +245,7 @@
static void
update_skipto_cache(struct ip_fw_chain *chain, struct ip_fw **map)
{
- int *smap, rulenum;
+ uint32_t *smap, rulenum;
int i, mi;
IPFW_UH_WLOCK_ASSERT(chain);
@@ -268,10 +257,10 @@
if (smap == NULL)
return;
- for (i = 0; i < 65536; i++) {
+ for (i = 0; i <= IPFW_DEFAULT_RULE; i++) {
smap[i] = mi;
/* Use the same rule index until i < rulenum */
- if (i != rulenum || i == 65535)
+ if (i != rulenum || i == IPFW_DEFAULT_RULE)
continue;
/* Find next rule with num > i */
rulenum = map[++mi]->rulenum;
@@ -286,7 +275,7 @@
static void
swap_skipto_cache(struct ip_fw_chain *chain)
{
- int *map;
+ uint32_t *map;
IPFW_UH_WLOCK_ASSERT(chain);
IPFW_WLOCK_ASSERT(chain);
@@ -302,10 +291,12 @@
void
ipfw_init_skipto_cache(struct ip_fw_chain *chain)
{
- int *idxmap, *idxmap_back;
+ uint32_t *idxmap, *idxmap_back;
- idxmap = malloc(65536 * sizeof(int), M_IPFW, M_WAITOK | M_ZERO);
- idxmap_back = malloc(65536 * sizeof(int), M_IPFW, M_WAITOK);
+ idxmap = malloc((IPFW_DEFAULT_RULE + 1) * sizeof(uint32_t),
+ M_IPFW, M_WAITOK | M_ZERO);
+ idxmap_back = malloc((IPFW_DEFAULT_RULE + 1) * sizeof(uint32_t),
+ M_IPFW, M_WAITOK | M_ZERO);
/*
* Note we may be called at any time after initialization,
@@ -323,7 +314,8 @@
/* Set backup pointer first to permit building cache */
chain->idxmap_back = idxmap_back;
- update_skipto_cache(chain, chain->map);
+ if (V_skipto_cache != 0)
+ update_skipto_cache(chain, chain->map);
IPFW_WLOCK(chain);
/* It is now safe to set chain->idxmap ptr */
chain->idxmap = idxmap;
@@ -338,11 +330,8 @@
void
ipfw_destroy_skipto_cache(struct ip_fw_chain *chain)
{
-
- if (chain->idxmap != NULL)
- free(chain->idxmap, M_IPFW);
- if (chain->idxmap != NULL)
- free(chain->idxmap_back, M_IPFW);
+ free(chain->idxmap, M_IPFW);
+ free(chain->idxmap_back, M_IPFW);
}
/*
@@ -412,50 +401,6 @@
}
}
-static void
-export_cntr0_base(struct ip_fw *krule, struct ip_fw_bcounter0 *cntr)
-{
- struct timeval boottime;
-
- if (krule->cntr != NULL) {
- cntr->pcnt = counter_u64_fetch(krule->cntr);
- cntr->bcnt = counter_u64_fetch(krule->cntr + 1);
- cntr->timestamp = krule->timestamp;
- }
- if (cntr->timestamp > 0) {
- getboottime(&boottime);
- cntr->timestamp += boottime.tv_sec;
- }
-}
-
-/*
- * Copies rule @urule from v1 userland format (current).
- * to kernel @krule.
- * Assume @krule is zeroed.
- */
-static void
-import_rule1(struct rule_check_info *ci)
-{
- struct ip_fw_rule *urule;
- struct ip_fw *krule;
-
- urule = (struct ip_fw_rule *)ci->urule;
- krule = (struct ip_fw *)ci->krule;
-
- /* copy header */
- krule->act_ofs = urule->act_ofs;
- krule->cmd_len = urule->cmd_len;
- krule->rulenum = urule->rulenum;
- krule->set = urule->set;
- krule->flags = urule->flags;
-
- /* Save rulenum offset */
- ci->urule_numoff = offsetof(struct ip_fw_rule, rulenum);
-
- /* Copy opcodes */
- memcpy(krule->cmd, urule->cmd, krule->cmd_len * sizeof(uint32_t));
-}
-
/*
* Export rule into v1 format (Current).
* Layout:
@@ -497,196 +442,17 @@
memcpy(urule->cmd, krule->cmd, krule->cmd_len * sizeof(uint32_t));
}
-/*
- * Copies rule @urule from FreeBSD8 userland format (v0)
- * to kernel @krule.
- * Assume @krule is zeroed.
- */
-static void
-import_rule0(struct rule_check_info *ci)
-{
- struct ip_fw_rule0 *urule;
- struct ip_fw *krule;
- int cmdlen, l;
- ipfw_insn *cmd;
- ipfw_insn_limit *lcmd;
- ipfw_insn_if *cmdif;
-
- urule = (struct ip_fw_rule0 *)ci->urule;
- krule = (struct ip_fw *)ci->krule;
-
- /* copy header */
- krule->act_ofs = urule->act_ofs;
- krule->cmd_len = urule->cmd_len;
- krule->rulenum = urule->rulenum;
- krule->set = urule->set;
- if ((urule->_pad & 1) != 0)
- krule->flags |= IPFW_RULE_NOOPT;
-
- /* Save rulenum offset */
- ci->urule_numoff = offsetof(struct ip_fw_rule0, rulenum);
-
- /* Copy opcodes */
- memcpy(krule->cmd, urule->cmd, krule->cmd_len * sizeof(uint32_t));
-
- /*
- * Alter opcodes:
- * 1) convert tablearg value from 65535 to 0
- * 2) Add high bit to O_SETFIB/O_SETDSCP values (to make room
- * for targ).
- * 3) convert table number in iface opcodes to u16
- * 4) convert old `nat global` into new 65535
- */
- l = krule->cmd_len;
- cmd = krule->cmd;
- cmdlen = 0;
-
- for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) {
- cmdlen = F_LEN(cmd);
-
- switch (cmd->opcode) {
- /* Opcodes supporting tablearg */
- case O_TAG:
- case O_TAGGED:
- case O_PIPE:
- case O_QUEUE:
- case O_DIVERT:
- case O_TEE:
- case O_SKIPTO:
- case O_CALLRETURN:
- case O_NETGRAPH:
- case O_NGTEE:
- case O_NAT:
- if (cmd->arg1 == IP_FW_TABLEARG)
- cmd->arg1 = IP_FW_TARG;
- else if (cmd->arg1 == 0)
- cmd->arg1 = IP_FW_NAT44_GLOBAL;
- break;
- case O_SETFIB:
- case O_SETDSCP:
- case O_SETMARK:
- case O_MARK:
- if (cmd->arg1 == IP_FW_TABLEARG)
- cmd->arg1 = IP_FW_TARG;
- else
- cmd->arg1 |= 0x8000;
- break;
- case O_LIMIT:
- lcmd = (ipfw_insn_limit *)cmd;
- if (lcmd->conn_limit == IP_FW_TABLEARG)
- lcmd->conn_limit = IP_FW_TARG;
- break;
- /* Interface tables */
- case O_XMIT:
- case O_RECV:
- case O_VIA:
- /* Interface table, possibly */
- cmdif = (ipfw_insn_if *)cmd;
- if (cmdif->name[0] != '\1')
- break;
-
- cmdif->p.kidx = (uint16_t)cmdif->p.glob;
- break;
- }
- }
-}
-
-/*
- * Copies rule @krule from kernel to FreeBSD8 userland format (v0)
- */
-static void
-export_rule0(struct ip_fw *krule, struct ip_fw_rule0 *urule, int len)
-{
- int cmdlen, l;
- ipfw_insn *cmd;
- ipfw_insn_limit *lcmd;
- ipfw_insn_if *cmdif;
-
- /* copy header */
- memset(urule, 0, len);
- urule->act_ofs = krule->act_ofs;
- urule->cmd_len = krule->cmd_len;
- urule->rulenum = krule->rulenum;
- urule->set = krule->set;
- if ((krule->flags & IPFW_RULE_NOOPT) != 0)
- urule->_pad |= 1;
-
- /* Copy opcodes */
- memcpy(urule->cmd, krule->cmd, krule->cmd_len * sizeof(uint32_t));
-
- /* Export counters */
- export_cntr0_base(krule, (struct ip_fw_bcounter0 *)&urule->pcnt);
-
- /*
- * Alter opcodes:
- * 1) convert tablearg value from 0 to 65535
- * 2) Remove highest bit from O_SETFIB/O_SETDSCP values.
- * 3) convert table number in iface opcodes to int
- */
- l = urule->cmd_len;
- cmd = urule->cmd;
- cmdlen = 0;
-
- for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) {
- cmdlen = F_LEN(cmd);
-
- switch (cmd->opcode) {
- /* Opcodes supporting tablearg */
- case O_TAG:
- case O_TAGGED:
- case O_PIPE:
- case O_QUEUE:
- case O_DIVERT:
- case O_TEE:
- case O_SKIPTO:
- case O_CALLRETURN:
- case O_NETGRAPH:
- case O_NGTEE:
- case O_NAT:
- if (cmd->arg1 == IP_FW_TARG)
- cmd->arg1 = IP_FW_TABLEARG;
- else if (cmd->arg1 == IP_FW_NAT44_GLOBAL)
- cmd->arg1 = 0;
- break;
- case O_SETFIB:
- case O_SETDSCP:
- case O_SETMARK:
- case O_MARK:
- if (cmd->arg1 == IP_FW_TARG)
- cmd->arg1 = IP_FW_TABLEARG;
- else
- cmd->arg1 &= ~0x8000;
- break;
- case O_LIMIT:
- lcmd = (ipfw_insn_limit *)cmd;
- if (lcmd->conn_limit == IP_FW_TARG)
- lcmd->conn_limit = IP_FW_TABLEARG;
- break;
- /* Interface tables */
- case O_XMIT:
- case O_RECV:
- case O_VIA:
- /* Interface table, possibly */
- cmdif = (ipfw_insn_if *)cmd;
- if (cmdif->name[0] != '\1')
- break;
-
- cmdif->p.glob = cmdif->p.kidx;
- break;
- }
- }
-}
-
/*
* Add new rule(s) to the list possibly creating rule number for each.
* Update the rule_number in the input struct so the caller knows it as well.
* Must be called without IPFW_UH held
*/
-static int
-commit_rules(struct ip_fw_chain *chain, struct rule_check_info *rci, int count)
+int
+ipfw_commit_rules(struct ip_fw_chain *chain, struct rule_check_info *rci,
+ int count)
{
- int error, i, insert_before, tcount;
- uint16_t rulenum, *pnum;
+ int error, i, insert_before, tcount, rule_idx, last_rule_idx;
+ uint32_t rulenum;
struct rule_check_info *ci;
struct ip_fw *krule;
struct ip_fw **map; /* the new array of pointers */
@@ -704,12 +470,14 @@
*/
error = rewrite_rule_uidx(chain, ci);
if (error != 0) {
+
/*
* rewrite failed, state for current rule
* has been reverted. Check if we need to
* revert more.
*/
if (tcount > 0) {
+
/*
* We have some more table rules
* we need to rollback.
@@ -721,8 +489,10 @@
if (ci->object_opcodes == 0)
continue;
unref_rule_objects(chain,ci->krule);
+
}
IPFW_UH_WUNLOCK(chain);
+
}
return (error);
@@ -754,36 +524,41 @@
else if (V_autoinc_step > 1000)
V_autoinc_step = 1000;
- /* FIXME: Handle count > 1 */
- ci = rci;
- krule = ci->krule;
- rulenum = krule->rulenum;
-
- /* find the insertion point, we will insert before */
- insert_before = rulenum ? rulenum + 1 : IPFW_DEFAULT_RULE;
- i = ipfw_find_rule(chain, insert_before, 0);
- /* duplicate first part */
- if (i > 0)
- bcopy(chain->map, map, i * sizeof(struct ip_fw *));
- map[i] = krule;
- /* duplicate remaining part, we always have the default rule */
- bcopy(chain->map + i, map + i + 1,
- sizeof(struct ip_fw *) *(chain->n_rules - i));
- if (rulenum == 0) {
- /* Compute rule number and write it back */
- rulenum = i > 0 ? map[i-1]->rulenum : 0;
- if (rulenum < IPFW_DEFAULT_RULE - V_autoinc_step)
- rulenum += V_autoinc_step;
- krule->rulenum = rulenum;
- /* Save number to userland rule */
- pnum = (uint16_t *)((caddr_t)ci->urule + ci->urule_numoff);
- *pnum = rulenum;
+ last_rule_idx = 0;
+ for (ci = rci, i = 0; i < count; ci++, i++) {
+ krule = ci->krule;
+ rulenum = krule->rulenum;
+
+ krule->id = chain->id + 1;
+
+ /* find the insertion point, we will insert before */
+ insert_before = rulenum ? rulenum + 1 : IPFW_DEFAULT_RULE;
+ rule_idx = ipfw_find_rule(chain, insert_before, 0);
+ /* duplicate the previous part */
+ if (last_rule_idx < rule_idx)
+ bcopy(chain->map + last_rule_idx, map + last_rule_idx + i,
+ (rule_idx - last_rule_idx) * sizeof(struct ip_fw *));
+ last_rule_idx = rule_idx;
+ map[rule_idx + i] = krule;
+ if (rulenum == 0) {
+ /* Compute rule number and write it back */
+ rulenum = rule_idx + i > 0 ? map[rule_idx + i - 1]->rulenum : 0;
+ if (rulenum < IPFW_DEFAULT_RULE - V_autoinc_step)
+ rulenum += V_autoinc_step;
+ krule->rulenum = rulenum;
+ /* Save number to userland rule */
+ memcpy((char *)ci->urule + ci->urule_numoff, &rulenum,
+ sizeof(rulenum));
+ }
}
- krule->id = chain->id + 1;
- update_skipto_cache(chain, map);
- map = swap_map(chain, map, chain->n_rules + 1);
- chain->static_len += RULEUSIZE0(krule);
+ /* duplicate the remaining part, we always have the default rule */
+ bcopy(chain->map + last_rule_idx, map + last_rule_idx + count,
+ (chain->n_rules - last_rule_idx) * sizeof(struct ip_fw *));
+
+ if (V_skipto_cache != 0)
+ update_skipto_cache(chain, map);
+ map = swap_map(chain, map, chain->n_rules + count);
IPFW_UH_WUNLOCK(chain);
if (map)
free(map, M_IPFW);
@@ -808,7 +583,6 @@
rule->id = chain->id + 1;
/* We add rule in the end of chain, no need to update skipto cache */
map = swap_map(chain, map, chain->n_rules + 1);
- chain->static_len += RULEUSIZE0(rule);
IPFW_UH_WUNLOCK(chain);
free(map, M_IPFW);
return (0);
@@ -889,7 +663,7 @@
}
struct manage_sets_args {
- uint16_t set;
+ uint32_t set;
uint8_t new_set;
};
@@ -939,7 +713,7 @@
*/
int
ipfw_obj_manage_sets(struct namedobj_instance *ni, uint16_t type,
- uint16_t set, uint8_t new_set, enum ipfw_sets_cmd cmd)
+ uint32_t set, uint8_t new_set, enum ipfw_sets_cmd cmd)
{
struct manage_sets_args args;
struct named_object *no;
@@ -1001,11 +775,11 @@
*
* Returns 0 on success.
*/
-static int
+int
delete_range(struct ip_fw_chain *chain, ipfw_range_tlv *rt, int *ndel)
{
struct ip_fw *reap, *rule, **map;
- int end, start;
+ uint32_t end, start;
int i, n, ndyn, ofs;
reap = NULL;
@@ -1076,7 +850,6 @@
rule = map[i];
if (ipfw_match_range(rule, rt) == 0)
continue;
- chain->static_len -= RULEUSIZE0(rule);
ipfw_reap_add(chain, &reap, rule);
}
IPFW_UH_WUNLOCK(chain);
@@ -1094,8 +867,8 @@
struct opcode_obj_rewrite *rw;
struct ip_fw *rule;
ipfw_insn *cmd;
+ uint32_t kidx;
int cmdlen, i, l, c;
- uint16_t kidx;
IPFW_UH_WLOCK_ASSERT(ch);
@@ -1508,173 +1281,9 @@
return (ret);
}
-/**
- * Remove all rules with given number, or do set manipulation.
- * Assumes chain != NULL && *chain != NULL.
- *
- * The argument is an uint32_t. The low 16 bit are the rule or set number;
- * the next 8 bits are the new set; the top 8 bits indicate the command:
- *
- * 0 delete rules numbered "rulenum"
- * 1 delete rules in set "rulenum"
- * 2 move rules "rulenum" to set "new_set"
- * 3 move rules from set "rulenum" to set "new_set"
- * 4 swap sets "rulenum" and "new_set"
- * 5 delete rules "rulenum" and set "new_set"
- */
-static int
-del_entry(struct ip_fw_chain *chain, uint32_t arg)
-{
- uint32_t num; /* rule number or old_set */
- uint8_t cmd, new_set;
- int do_del, ndel;
- int error = 0;
- ipfw_range_tlv rt;
-
- num = arg & 0xffff;
- cmd = (arg >> 24) & 0xff;
- new_set = (arg >> 16) & 0xff;
-
- if (cmd > 5 || new_set > RESVD_SET)
- return EINVAL;
- if (cmd == 0 || cmd == 2 || cmd == 5) {
- if (num >= IPFW_DEFAULT_RULE)
- return EINVAL;
- } else {
- if (num > RESVD_SET) /* old_set */
- return EINVAL;
- }
-
- /* Convert old requests into new representation */
- memset(&rt, 0, sizeof(rt));
- rt.start_rule = num;
- rt.end_rule = num;
- rt.set = num;
- rt.new_set = new_set;
- do_del = 0;
-
- switch (cmd) {
- case 0: /* delete rules numbered "rulenum" */
- if (num == 0)
- rt.flags |= IPFW_RCFLAG_ALL;
- else
- rt.flags |= IPFW_RCFLAG_RANGE;
- do_del = 1;
- break;
- case 1: /* delete rules in set "rulenum" */
- rt.flags |= IPFW_RCFLAG_SET;
- do_del = 1;
- break;
- case 5: /* delete rules "rulenum" and set "new_set" */
- rt.flags |= IPFW_RCFLAG_RANGE | IPFW_RCFLAG_SET;
- rt.set = new_set;
- rt.new_set = 0;
- do_del = 1;
- break;
- case 2: /* move rules "rulenum" to set "new_set" */
- rt.flags |= IPFW_RCFLAG_RANGE;
- break;
- case 3: /* move rules from set "rulenum" to set "new_set" */
- IPFW_UH_WLOCK(chain);
- error = swap_sets(chain, &rt, 1);
- IPFW_UH_WUNLOCK(chain);
- return (error);
- case 4: /* swap sets "rulenum" and "new_set" */
- IPFW_UH_WLOCK(chain);
- error = swap_sets(chain, &rt, 0);
- IPFW_UH_WUNLOCK(chain);
- return (error);
- default:
- return (ENOTSUP);
- }
-
- if (do_del != 0) {
- if ((error = delete_range(chain, &rt, &ndel)) != 0)
- return (error);
-
- if (ndel == 0 && (cmd != 1 && num != 0))
- return (EINVAL);
-
- return (0);
- }
-
- return (move_range(chain, &rt));
-}
-
-/**
- * Reset some or all counters on firewall rules.
- * The argument `arg' is an u_int32_t. The low 16 bit are the rule number,
- * the next 8 bits are the set number, the top 8 bits are the command:
- * 0 work with rules from all set's;
- * 1 work with rules only from specified set.
- * Specified rule number is zero if we want to clear all entries.
- * log_only is 1 if we only want to reset logs, zero otherwise.
- */
-static int
-zero_entry(struct ip_fw_chain *chain, u_int32_t arg, int log_only)
-{
- struct ip_fw *rule;
- char *msg;
- int i;
-
- uint16_t rulenum = arg & 0xffff;
- uint8_t set = (arg >> 16) & 0xff;
- uint8_t cmd = (arg >> 24) & 0xff;
-
- if (cmd > 1)
- return (EINVAL);
- if (cmd == 1 && set > RESVD_SET)
- return (EINVAL);
-
- IPFW_UH_RLOCK(chain);
- if (rulenum == 0) {
- V_norule_counter = 0;
- for (i = 0; i < chain->n_rules; i++) {
- rule = chain->map[i];
- /* Skip rules not in our set. */
- if (cmd == 1 && rule->set != set)
- continue;
- clear_counters(rule, log_only);
- }
- msg = log_only ? "All logging counts reset" :
- "Accounting cleared";
- } else {
- int cleared = 0;
- for (i = 0; i < chain->n_rules; i++) {
- rule = chain->map[i];
- if (rule->rulenum == rulenum) {
- if (cmd == 0 || rule->set == set)
- clear_counters(rule, log_only);
- cleared = 1;
- }
- if (rule->rulenum > rulenum)
- break;
- }
- if (!cleared) { /* we did not find any matching rules */
- IPFW_UH_RUNLOCK(chain);
- return (EINVAL);
- }
- msg = log_only ? "logging count reset" : "cleared";
- }
- IPFW_UH_RUNLOCK(chain);
-
- if (V_fw_verbose) {
- int lev = LOG_SECURITY | LOG_NOTICE;
-
- if (rulenum)
- log(lev, "ipfw: Entry %d %s.\n", rulenum, msg);
- else
- log(lev, "ipfw: %s.\n", msg);
- }
- return (0);
-}
-
-/*
- * Check rule head in FreeBSD11 format
- *
- */
-static int
-check_ipfw_rule1(struct ip_fw_rule *rule, int size,
+/* Check rule format */
+int
+ipfw_check_rule(struct ip_fw_rule *rule, size_t size,
struct rule_check_info *ci)
{
int l;
@@ -1687,7 +1296,7 @@
/* Check for valid cmd_len */
l = roundup2(RULESIZE(rule), sizeof(uint64_t));
if (l != size) {
- printf("ipfw: size mismatch (have %d want %d)\n", size, l);
+ printf("ipfw: size mismatch (have %zu want %d)\n", size, l);
return (EINVAL);
}
if (rule->act_ofs >= rule->cmd_len) {
@@ -1702,532 +1311,377 @@
return (check_ipfw_rule_body(rule->cmd, rule->cmd_len, ci));
}
-/*
- * Check rule head in FreeBSD8 format
- *
- */
-static int
-check_ipfw_rule0(struct ip_fw_rule0 *rule, int size,
- struct rule_check_info *ci)
+enum ipfw_opcheck_result
+ipfw_check_opcode(ipfw_insn **pcmd, int *plen, struct rule_check_info *ci)
{
- int l;
-
- if (size < sizeof(*rule)) {
- printf("ipfw: rule too short\n");
- return (EINVAL);
- }
-
- /* Check for valid cmd_len */
- l = sizeof(*rule) + rule->cmd_len * 4 - 4;
- if (l != size) {
- printf("ipfw: size mismatch (have %d want %d)\n", size, l);
- return (EINVAL);
- }
- if (rule->act_ofs >= rule->cmd_len) {
- printf("ipfw: bogus action offset (%u > %u)\n",
- rule->act_ofs, rule->cmd_len - 1);
- return (EINVAL);
- }
-
- if (rule->rulenum > IPFW_DEFAULT_RULE - 1)
- return (EINVAL);
-
- return (check_ipfw_rule_body(rule->cmd, rule->cmd_len, ci));
-}
-
-static int
-check_ipfw_rule_body(ipfw_insn *cmd, int cmd_len, struct rule_check_info *ci)
-{
- int cmdlen, l;
- int have_action;
+ ipfw_insn *cmd;
+ size_t cmdlen;
- have_action = 0;
+ cmd = *pcmd;
+ cmdlen = F_LEN(cmd);
- /*
- * Now go for the individual checks. Very simple ones, basically only
- * instruction sizes.
- */
- for (l = cmd_len; l > 0 ; l -= cmdlen, cmd += cmdlen) {
- cmdlen = F_LEN(cmd);
- if (cmdlen > l) {
- printf("ipfw: opcode %d size truncated\n",
- cmd->opcode);
- return EINVAL;
- }
- switch (cmd->opcode) {
- case O_PROBE_STATE:
- case O_KEEP_STATE:
- if (cmdlen != F_INSN_SIZE(ipfw_insn))
- goto bad_size;
- ci->object_opcodes++;
- break;
- case O_PROTO:
- case O_IP_SRC_ME:
- case O_IP_DST_ME:
- case O_LAYER2:
- case O_IN:
- case O_FRAG:
- case O_DIVERTED:
- case O_IPOPT:
- case O_IPTOS:
- case O_IPPRECEDENCE:
- case O_IPVER:
- case O_SOCKARG:
- case O_TCPFLAGS:
- case O_TCPOPTS:
- case O_ESTAB:
- case O_VERREVPATH:
- case O_VERSRCREACH:
- case O_ANTISPOOF:
- case O_IPSEC:
+ switch (cmd->opcode) {
+ case O_PROBE_STATE:
+ case O_KEEP_STATE:
+ if (cmdlen != F_INSN_SIZE(ipfw_insn_kidx))
+ return (BAD_SIZE);
+ ci->object_opcodes++;
+ break;
+ case O_PROTO:
+ case O_IP_SRC_ME:
+ case O_IP_DST_ME:
+ case O_LAYER2:
+ case O_IN:
+ case O_FRAG:
+ case O_DIVERTED:
+ case O_IPOPT:
+ case O_IPTOS:
+ case O_IPPRECEDENCE:
+ case O_IPVER:
+ case O_SOCKARG:
+ case O_TCPFLAGS:
+ case O_TCPOPTS:
+ case O_ESTAB:
+ case O_VERREVPATH:
+ case O_VERSRCREACH:
+ case O_ANTISPOOF:
+ case O_IPSEC:
#ifdef INET6
- case O_IP6_SRC_ME:
- case O_IP6_DST_ME:
- case O_EXT_HDR:
- case O_IP6:
+ case O_IP6_SRC_ME:
+ case O_IP6_DST_ME:
+ case O_EXT_HDR:
+ case O_IP6:
#endif
- case O_IP4:
- case O_TAG:
- case O_SKIP_ACTION:
- if (cmdlen != F_INSN_SIZE(ipfw_insn))
- goto bad_size;
- break;
+ case O_IP4:
+ case O_TAG:
+ case O_SKIP_ACTION:
+ if (cmdlen != F_INSN_SIZE(ipfw_insn))
+ return (BAD_SIZE);
+ break;
- case O_EXTERNAL_ACTION:
- if (cmd->arg1 == 0 ||
- cmdlen != F_INSN_SIZE(ipfw_insn)) {
- printf("ipfw: invalid external "
- "action opcode\n");
- return (EINVAL);
- }
- ci->object_opcodes++;
- /*
- * Do we have O_EXTERNAL_INSTANCE or O_EXTERNAL_DATA
- * opcode?
- */
- if (l != cmdlen) {
- l -= cmdlen;
- cmd += cmdlen;
- cmdlen = F_LEN(cmd);
- if (cmd->opcode == O_EXTERNAL_DATA)
- goto check_action;
- if (cmd->opcode != O_EXTERNAL_INSTANCE) {
- printf("ipfw: invalid opcode "
- "next to external action %u\n",
- cmd->opcode);
- return (EINVAL);
- }
- if (cmd->arg1 == 0 ||
- cmdlen != F_INSN_SIZE(ipfw_insn)) {
- printf("ipfw: invalid external "
- "action instance opcode\n");
- return (EINVAL);
- }
- ci->object_opcodes++;
- }
- goto check_action;
-
- case O_FIB:
- if (cmdlen != F_INSN_SIZE(ipfw_insn))
- goto bad_size;
- if (cmd->arg1 >= rt_numfibs) {
- printf("ipfw: invalid fib number %d\n",
- cmd->arg1);
- return EINVAL;
- }
- break;
+ case O_EXTERNAL_ACTION:
+ if (cmdlen != F_INSN_SIZE(ipfw_insn_kidx))
+ return (BAD_SIZE);
- case O_SETFIB:
- if (cmdlen != F_INSN_SIZE(ipfw_insn))
- goto bad_size;
- if ((cmd->arg1 != IP_FW_TARG) &&
- ((cmd->arg1 & 0x7FFF) >= rt_numfibs)) {
- printf("ipfw: invalid fib number %d\n",
- cmd->arg1 & 0x7FFF);
- return EINVAL;
+ if (insntod(cmd, kidx)->kidx == 0)
+ return (FAILED);
+ ci->object_opcodes++;
+ /*
+ * Do we have O_EXTERNAL_INSTANCE or O_EXTERNAL_DATA
+ * opcode?
+ */
+ if (*plen != cmdlen) {
+ *plen -= cmdlen;
+ cmd += cmdlen;
+ *pcmd = cmd;
+ cmdlen = F_LEN(cmd);
+ if (cmd->opcode == O_EXTERNAL_DATA)
+ return (CHECK_ACTION);
+ if (cmd->opcode != O_EXTERNAL_INSTANCE) {
+ printf("ipfw: invalid opcode "
+ "next to external action %u\n",
+ cmd->opcode);
+ return (FAILED);
}
- goto check_action;
-
- case O_UID:
- case O_GID:
- case O_JAIL:
- case O_IP_SRC:
- case O_IP_DST:
- case O_TCPSEQ:
- case O_TCPACK:
- case O_PROB:
- case O_ICMPTYPE:
- if (cmdlen != F_INSN_SIZE(ipfw_insn_u32))
- goto bad_size;
- break;
-
- case O_LIMIT:
- if (cmdlen != F_INSN_SIZE(ipfw_insn_limit))
- goto bad_size;
+ if (cmdlen != F_INSN_SIZE(ipfw_insn_kidx))
+ return (BAD_SIZE);
+ if (insntod(cmd, kidx)->kidx == 0)
+ return (FAILED);
ci->object_opcodes++;
- break;
+ }
+ return (CHECK_ACTION);
+
+ case O_FIB:
+ if (cmdlen != F_INSN_SIZE(ipfw_insn))
+ return (BAD_SIZE);
+ if (cmd->arg1 >= rt_numfibs) {
+ printf("ipfw: invalid fib number %d\n",
+ cmd->arg1);
+ return (FAILED);
+ }
+ break;
- case O_LOG:
- if (cmdlen != F_INSN_SIZE(ipfw_insn_log))
- goto bad_size;
+ case O_SETFIB:
+ if (cmdlen != F_INSN_SIZE(ipfw_insn))
+ return (BAD_SIZE);
+ if ((cmd->arg1 != IP_FW_TARG) &&
+ ((cmd->arg1 & 0x7FFF) >= rt_numfibs)) {
+ printf("ipfw: invalid fib number %d\n",
+ cmd->arg1 & 0x7FFF);
+ return (FAILED);
+ }
+ return (CHECK_ACTION);
+
+ case O_UID:
+ case O_GID:
+ case O_JAIL:
+ case O_IP_SRC:
+ case O_IP_DST:
+ case O_TCPSEQ:
+ case O_TCPACK:
+ case O_PROB:
+ case O_ICMPTYPE:
+ if (cmdlen != F_INSN_SIZE(ipfw_insn_u32))
+ return (BAD_SIZE);
+ break;
- ((ipfw_insn_log *)cmd)->log_left =
- ((ipfw_insn_log *)cmd)->max_log;
+ case O_LIMIT:
+ if (cmdlen != F_INSN_SIZE(ipfw_insn_limit))
+ return (BAD_SIZE);
+ ci->object_opcodes++;
+ break;
- break;
+ case O_LOG:
+ if (cmdlen != F_INSN_SIZE(ipfw_insn_log))
+ return (BAD_SIZE);
+ insntod(cmd, log)->log_left = insntod(cmd, log)->max_log;
+ break;
- case O_IP_SRC_MASK:
- case O_IP_DST_MASK:
- /* only odd command lengths */
- if ((cmdlen & 1) == 0)
- goto bad_size;
- break;
+ case O_IP_SRC_MASK:
+ case O_IP_DST_MASK:
+ /* only odd command lengths */
+ if ((cmdlen & 1) == 0)
+ return (BAD_SIZE);
+ break;
- case O_IP_SRC_SET:
- case O_IP_DST_SET:
- if (cmd->arg1 == 0 || cmd->arg1 > 256) {
- printf("ipfw: invalid set size %d\n",
- cmd->arg1);
- return EINVAL;
- }
- if (cmdlen != F_INSN_SIZE(ipfw_insn_u32) +
- (cmd->arg1+31)/32 )
- goto bad_size;
- break;
+ case O_IP_SRC_SET:
+ case O_IP_DST_SET:
+ if (cmd->arg1 == 0 || cmd->arg1 > 256) {
+ printf("ipfw: invalid set size %d\n",
+ cmd->arg1);
+ return (FAILED);
+ }
+ if (cmdlen != F_INSN_SIZE(ipfw_insn_u32) +
+ (cmd->arg1+31)/32 )
+ return (BAD_SIZE);
+ break;
- case O_IP_SRC_LOOKUP:
- if (cmdlen > F_INSN_SIZE(ipfw_insn_u32))
- goto bad_size;
- case O_IP_DST_LOOKUP:
- if (cmd->arg1 >= V_fw_tables_max) {
- printf("ipfw: invalid table number %d\n",
- cmd->arg1);
- return (EINVAL);
- }
- if (cmdlen != F_INSN_SIZE(ipfw_insn) &&
- cmdlen != F_INSN_SIZE(ipfw_insn_u32) + 1 &&
- cmdlen != F_INSN_SIZE(ipfw_insn_u32))
- goto bad_size;
- ci->object_opcodes++;
- break;
- case O_IP_FLOW_LOOKUP:
- case O_MAC_DST_LOOKUP:
- case O_MAC_SRC_LOOKUP:
- if (cmd->arg1 >= V_fw_tables_max) {
- printf("ipfw: invalid table number %d\n",
- cmd->arg1);
- return (EINVAL);
- }
- if (cmdlen != F_INSN_SIZE(ipfw_insn) &&
- cmdlen != F_INSN_SIZE(ipfw_insn_u32))
- goto bad_size;
- ci->object_opcodes++;
- break;
- case O_MACADDR2:
- if (cmdlen != F_INSN_SIZE(ipfw_insn_mac))
- goto bad_size;
- break;
+ case O_IP_SRC_LOOKUP:
+ case O_IP_DST_LOOKUP:
+ case O_IP_FLOW_LOOKUP:
+ case O_MAC_SRC_LOOKUP:
+ case O_MAC_DST_LOOKUP:
+ if (cmdlen != F_INSN_SIZE(ipfw_insn_kidx) &&
+ cmdlen != F_INSN_SIZE(ipfw_insn_table))
+ return (BAD_SIZE);
+ if (insntod(cmd, kidx)->kidx >= V_fw_tables_max) {
+ printf("ipfw: invalid table index %u\n",
+ insntod(cmd, kidx)->kidx);
+ return (FAILED);
+ }
+ ci->object_opcodes++;
+ break;
+ case O_MACADDR2:
+ if (cmdlen != F_INSN_SIZE(ipfw_insn_mac))
+ return (BAD_SIZE);
+ break;
- case O_NOP:
- case O_IPID:
- case O_IPTTL:
- case O_IPLEN:
- case O_TCPDATALEN:
- case O_TCPMSS:
- case O_TCPWIN:
- case O_TAGGED:
- if (cmdlen < 1 || cmdlen > 31)
- goto bad_size;
- break;
+ case O_NOP:
+ case O_IPID:
+ case O_IPTTL:
+ case O_IPLEN:
+ case O_TCPDATALEN:
+ case O_TCPMSS:
+ case O_TCPWIN:
+ case O_TAGGED:
+ if (cmdlen < 1 || cmdlen > 31)
+ return (BAD_SIZE);
+ break;
- case O_DSCP:
- case O_MARK:
- if (cmdlen != F_INSN_SIZE(ipfw_insn_u32) + 1)
- goto bad_size;
- break;
+ case O_DSCP:
+ case O_MARK:
+ if (cmdlen != F_INSN_SIZE(ipfw_insn_u32) + 1)
+ return (BAD_SIZE);
+ break;
- case O_MAC_TYPE:
- case O_IP_SRCPORT:
- case O_IP_DSTPORT: /* XXX artificial limit, 30 port pairs */
- if (cmdlen < 2 || cmdlen > 31)
- goto bad_size;
- break;
+ case O_MAC_TYPE:
+ case O_IP_SRCPORT:
+ case O_IP_DSTPORT: /* XXX artificial limit, 30 port pairs */
+ if (cmdlen < 2 || cmdlen > 31)
+ return (BAD_SIZE);
+ break;
- case O_RECV:
- case O_XMIT:
- case O_VIA:
- if (cmdlen != F_INSN_SIZE(ipfw_insn_if))
- goto bad_size;
- ci->object_opcodes++;
- break;
+ case O_RECV:
+ case O_XMIT:
+ case O_VIA:
+ if (cmdlen != F_INSN_SIZE(ipfw_insn_if))
+ return (BAD_SIZE);
+ ci->object_opcodes++;
+ break;
- case O_ALTQ:
- if (cmdlen != F_INSN_SIZE(ipfw_insn_altq))
- goto bad_size;
- break;
+ case O_ALTQ:
+ if (cmdlen != F_INSN_SIZE(ipfw_insn_altq))
+ return (BAD_SIZE);
+ break;
- case O_PIPE:
- case O_QUEUE:
- if (cmdlen != F_INSN_SIZE(ipfw_insn))
- goto bad_size;
- goto check_action;
+ case O_PIPE:
+ case O_QUEUE:
+ if (cmdlen != F_INSN_SIZE(ipfw_insn))
+ return (BAD_SIZE);
+ return (CHECK_ACTION);
- case O_FORWARD_IP:
- if (cmdlen != F_INSN_SIZE(ipfw_insn_sa))
- goto bad_size;
- goto check_action;
+ case O_FORWARD_IP:
+ if (cmdlen != F_INSN_SIZE(ipfw_insn_sa))
+ return (BAD_SIZE);
+ return (CHECK_ACTION);
#ifdef INET6
- case O_FORWARD_IP6:
- if (cmdlen != F_INSN_SIZE(ipfw_insn_sa6))
- goto bad_size;
- goto check_action;
+ case O_FORWARD_IP6:
+ if (cmdlen != F_INSN_SIZE(ipfw_insn_sa6))
+ return (BAD_SIZE);
+ return (CHECK_ACTION);
#endif /* INET6 */
- case O_DIVERT:
- case O_TEE:
- if (ip_divert_ptr == NULL)
- return EINVAL;
- else
- goto check_size;
- case O_NETGRAPH:
- case O_NGTEE:
- if (ng_ipfw_input_p == NULL)
- return EINVAL;
- else
- goto check_size;
- case O_NAT:
- if (!IPFW_NAT_LOADED)
- return EINVAL;
- if (cmdlen != F_INSN_SIZE(ipfw_insn_nat))
- goto bad_size;
- goto check_action;
- case O_CHECK_STATE:
- ci->object_opcodes++;
- goto check_size;
- case O_SETMARK:
- if (cmdlen != F_INSN_SIZE(ipfw_insn_u32))
- goto bad_size;
- goto check_action;
- case O_REJECT:
- /* "unreach needfrag" has variable len. */
- if ((cmdlen == F_INSN_SIZE(ipfw_insn) ||
- cmdlen == F_INSN_SIZE(ipfw_insn_u16)))
- goto check_action;
- /* FALLTHROUGH */
- case O_FORWARD_MAC: /* XXX not implemented yet */
- case O_COUNT:
- case O_ACCEPT:
- case O_DENY:
- case O_SETDSCP:
+ case O_DIVERT:
+ case O_TEE:
+ if (ip_divert_ptr == NULL)
+ return (FAILED);
+ if (cmdlen != F_INSN_SIZE(ipfw_insn))
+ return (BAD_SIZE);
+ return (CHECK_ACTION);
+ case O_NETGRAPH:
+ case O_NGTEE:
+ if (ng_ipfw_input_p == NULL)
+ return (FAILED);
+ if (cmdlen != F_INSN_SIZE(ipfw_insn))
+ return (BAD_SIZE);
+ return (CHECK_ACTION);
+ case O_NAT:
+ if (!IPFW_NAT_LOADED)
+ return (FAILED);
+ if (cmdlen != F_INSN_SIZE(ipfw_insn_nat))
+ return (BAD_SIZE);
+ return (CHECK_ACTION);
+
+ case O_SKIPTO:
+ case O_CALLRETURN:
+ case O_SETMARK:
+ if (cmdlen != F_INSN_SIZE(ipfw_insn_u32))
+ return (BAD_SIZE);
+ return (CHECK_ACTION);
+
+ case O_CHECK_STATE:
+ if (cmdlen != F_INSN_SIZE(ipfw_insn_kidx))
+ return (BAD_SIZE);
+ ci->object_opcodes++;
+ return (CHECK_ACTION);
+
+ case O_FORWARD_MAC: /* XXX not implemented yet */
+ case O_COUNT:
+ case O_ACCEPT:
+ case O_DENY:
+ case O_REJECT:
+ case O_SETDSCP:
#ifdef INET6
- case O_UNREACH6:
+ case O_UNREACH6:
#endif
- case O_SKIPTO:
- case O_REASS:
- case O_CALLRETURN:
-check_size:
- if (cmdlen != F_INSN_SIZE(ipfw_insn))
- goto bad_size;
-check_action:
- if (have_action) {
- printf("ipfw: opcode %d, multiple actions"
- " not allowed\n",
- cmd->opcode);
- return (EINVAL);
- }
- have_action = 1;
- if (l != cmdlen) {
- printf("ipfw: opcode %d, action must be"
- " last opcode\n",
- cmd->opcode);
- return (EINVAL);
- }
- break;
+ case O_REASS:
+ if (cmdlen != F_INSN_SIZE(ipfw_insn))
+ return (BAD_SIZE);
+ return (CHECK_ACTION);
#ifdef INET6
+ case O_IP6_SRC:
+ case O_IP6_DST:
+ if (cmdlen != F_INSN_SIZE(struct in6_addr) +
+ F_INSN_SIZE(ipfw_insn))
+ return (BAD_SIZE);
+ break;
+
+ case O_FLOW6ID:
+ if (cmdlen != F_INSN_SIZE(ipfw_insn_u32) +
+ ((ipfw_insn_u32 *)cmd)->o.arg1)
+ return (BAD_SIZE);
+ break;
+
+ case O_IP6_SRC_MASK:
+ case O_IP6_DST_MASK:
+ if ( !(cmdlen & 1) || cmdlen > 127)
+ return (BAD_SIZE);
+ break;
+ case O_ICMP6TYPE:
+ if( cmdlen != F_INSN_SIZE( ipfw_insn_icmp6 ) )
+ return (BAD_SIZE);
+ break;
+#endif
+
+ default:
+ switch (cmd->opcode) {
+#ifndef INET6
+ case O_IP6_SRC_ME:
+ case O_IP6_DST_ME:
+ case O_EXT_HDR:
+ case O_IP6:
+ case O_UNREACH6:
case O_IP6_SRC:
case O_IP6_DST:
- if (cmdlen != F_INSN_SIZE(struct in6_addr) +
- F_INSN_SIZE(ipfw_insn))
- goto bad_size;
- break;
-
case O_FLOW6ID:
- if (cmdlen != F_INSN_SIZE(ipfw_insn_u32) +
- ((ipfw_insn_u32 *)cmd)->o.arg1)
- goto bad_size;
- break;
-
case O_IP6_SRC_MASK:
case O_IP6_DST_MASK:
- if ( !(cmdlen & 1) || cmdlen > 127)
- goto bad_size;
- break;
case O_ICMP6TYPE:
- if( cmdlen != F_INSN_SIZE( ipfw_insn_icmp6 ) )
- goto bad_size;
- break;
+ printf("ipfw: no IPv6 support in kernel\n");
+ return (FAILED);
#endif
-
default:
- switch (cmd->opcode) {
-#ifndef INET6
- case O_IP6_SRC_ME:
- case O_IP6_DST_ME:
- case O_EXT_HDR:
- case O_IP6:
- case O_UNREACH6:
- case O_IP6_SRC:
- case O_IP6_DST:
- case O_FLOW6ID:
- case O_IP6_SRC_MASK:
- case O_IP6_DST_MASK:
- case O_ICMP6TYPE:
- printf("ipfw: no IPv6 support in kernel\n");
- return (EPROTONOSUPPORT);
-#endif
- default:
- printf("ipfw: opcode %d, unknown opcode\n",
- cmd->opcode);
- return (EINVAL);
- }
+ printf("ipfw: opcode %d: unknown opcode\n",
+ cmd->opcode);
+ return (FAILED);
}
}
- if (have_action == 0) {
- printf("ipfw: missing action\n");
- return (EINVAL);
- }
- return 0;
-
-bad_size:
- printf("ipfw: opcode %d size %d wrong\n",
- cmd->opcode, cmdlen);
- return (EINVAL);
+ return (SUCCESS);
}
-/*
- * Translation of requests for compatibility with FreeBSD 7.2/8.
- * a static variable tells us if we have an old client from userland,
- * and if necessary we translate requests and responses between the
- * two formats.
- */
-static int is7 = 0;
-
-struct ip_fw7 {
- struct ip_fw7 *next; /* linked list of rules */
- struct ip_fw7 *next_rule; /* ptr to next [skipto] rule */
- /* 'next_rule' is used to pass up 'set_disable' status */
-
- uint16_t act_ofs; /* offset of action in 32-bit units */
- uint16_t cmd_len; /* # of 32-bit words in cmd */
- uint16_t rulenum; /* rule number */
- uint8_t set; /* rule set (0..31) */
- // #define RESVD_SET 31 /* set for default and persistent rules */
- uint8_t _pad; /* padding */
- // uint32_t id; /* rule id, only in v.8 */
- /* These fields are present in all rules. */
- uint64_t pcnt; /* Packet counter */
- uint64_t bcnt; /* Byte counter */
- uint32_t timestamp; /* tv_sec of last match */
-
- ipfw_insn cmd[1]; /* storage for commands */
-};
-
-static int convert_rule_to_7(struct ip_fw_rule0 *rule);
-static int convert_rule_to_8(struct ip_fw_rule0 *rule);
-
-#ifndef RULESIZE7
-#define RULESIZE7(rule) (sizeof(struct ip_fw7) + \
- ((struct ip_fw7 *)(rule))->cmd_len * 4 - 4)
-#endif
-
-/*
- * Copy the static and dynamic rules to the supplied buffer
- * and return the amount of space actually used.
- * Must be run under IPFW_UH_RLOCK
- */
-static size_t
-ipfw_getrules(struct ip_fw_chain *chain, void *buf, size_t space)
+static __noinline int
+check_ipfw_rule_body(ipfw_insn *cmd, int cmd_len, struct rule_check_info *ci)
{
- char *bp = buf;
- char *ep = bp + space;
- struct ip_fw *rule;
- struct ip_fw_rule0 *dst;
- struct timeval boottime;
- int error, i, l, warnflag;
- time_t boot_seconds;
-
- warnflag = 0;
-
- getboottime(&boottime);
- boot_seconds = boottime.tv_sec;
- for (i = 0; i < chain->n_rules; i++) {
- rule = chain->map[i];
-
- if (is7) {
- /* Convert rule to FreeBSd 7.2 format */
- l = RULESIZE7(rule);
- if (bp + l + sizeof(uint32_t) <= ep) {
- bcopy(rule, bp, l + sizeof(uint32_t));
- error = set_legacy_obj_kidx(chain,
- (struct ip_fw_rule0 *)bp);
- if (error != 0)
- return (0);
- error = convert_rule_to_7((struct ip_fw_rule0 *) bp);
- if (error)
- return 0; /*XXX correct? */
- /*
- * XXX HACK. Store the disable mask in the "next"
- * pointer in a wild attempt to keep the ABI the same.
- * Why do we do this on EVERY rule?
- */
- bcopy(&V_set_disable,
- &(((struct ip_fw7 *)bp)->next_rule),
- sizeof(V_set_disable));
- if (((struct ip_fw7 *)bp)->timestamp)
- ((struct ip_fw7 *)bp)->timestamp += boot_seconds;
- bp += l;
- }
- continue; /* go to next rule */
- }
+ int cmdlen, l;
+ int have_action, ret;
- l = RULEUSIZE0(rule);
- if (bp + l > ep) { /* should not happen */
- printf("overflow dumping static rules\n");
- break;
+ /*
+ * Now go for the individual checks. Very simple ones, basically only
+ * instruction sizes.
+ */
+ have_action = 0;
+ for (l = cmd_len; l > 0 ; l -= cmdlen, cmd += cmdlen) {
+ cmdlen = F_LEN(cmd);
+ if (cmdlen > l) {
+ printf("ipfw: opcode %d: size truncated\n",
+ cmd->opcode);
+ return (EINVAL);
}
- dst = (struct ip_fw_rule0 *)bp;
- export_rule0(rule, dst, l);
- error = set_legacy_obj_kidx(chain, dst);
-
- /*
- * XXX HACK. Store the disable mask in the "next"
- * pointer in a wild attempt to keep the ABI the same.
- * Why do we do this on EVERY rule?
- *
- * XXX: "ipfw set show" (ab)uses IP_FW_GET to read disabled mask
- * so we need to fail _after_ saving at least one mask.
- */
- bcopy(&V_set_disable, &dst->next_rule, sizeof(V_set_disable));
- if (dst->timestamp)
- dst->timestamp += boot_seconds;
- bp += l;
-
- if (error != 0) {
- if (error == 2) {
- /* Non-fatal table rewrite error. */
- warnflag = 1;
- continue;
+ if (ci->version != IP_FW3_OPVER)
+ ret = (*check_opcode_f)(&cmd, &l, ci);
+ else
+ ret = ipfw_check_opcode(&cmd, &l, ci);
+
+ if (ret == CHECK_ACTION) {
+ if (have_action != 0) {
+ printf("ipfw: opcode %d: multiple actions"
+ " not allowed\n", cmd->opcode);
+ ret = FAILED;
+ } else
+ have_action = 1;
+
+ if (l != F_LEN(cmd)) {
+ printf("ipfw: opcode %d: action must be"
+ " last opcode\n", cmd->opcode);
+ ret = FAILED;
}
- printf("Stop on rule %d. Fail to convert table\n",
- rule->rulenum);
- break;
+ }
+ switch (ret) {
+ case SUCCESS:
+ continue;
+ case BAD_SIZE:
+ printf("ipfw: opcode %d: wrong size %d\n",
+ cmd->opcode, cmdlen);
+ /* FALLTHROUGH */
+ case FAILED:
+ return (EINVAL);
}
}
- if (warnflag != 0)
- printf("ipfw: process %s is using legacy interfaces,"
- " consider rebuilding\n", "");
- ipfw_get_dynamic(chain, &bp, ep); /* protected by the dynamic lock */
- return (bp - (char *)buf);
+ if (have_action == 0) {
+ printf("ipfw: missing action\n");
+ return (EINVAL);
+ }
+ return (0);
}
struct dump_args {
@@ -2257,7 +1711,7 @@
* Returns 0 on success.
*/
static int
-export_objhash_ntlv(struct namedobj_instance *ni, uint16_t kidx,
+export_objhash_ntlv(struct namedobj_instance *ni, uint32_t kidx,
struct sockopt_data *sd)
{
struct named_object *no;
@@ -2278,7 +1732,8 @@
export_named_objects(struct namedobj_instance *ni, struct dump_args *da,
struct sockopt_data *sd)
{
- int error, i;
+ uint32_t i;
+ int error;
for (i = 0; i < IPFW_TABLES_MAX && da->tcount > 0; i++) {
if ((da->bmask[i / 32] & (1 << (i % 32))) == 0)
@@ -2356,7 +1811,7 @@
}
int
-ipfw_mark_object_kidx(uint32_t *bmask, uint16_t etlv, uint16_t kidx)
+ipfw_mark_object_kidx(uint32_t *bmask, uint16_t etlv, uint32_t kidx)
{
uint32_t bidx;
@@ -2383,8 +1838,8 @@
{
struct opcode_obj_rewrite *rw;
ipfw_insn *cmd;
+ uint32_t kidx;
int cmdlen, l;
- uint16_t kidx;
uint8_t subtype;
l = rule->cmd_len;
@@ -2554,7 +2009,7 @@
{
struct opcode_obj_rewrite *rw;
struct obj_idx *p;
- uint16_t kidx;
+ uint32_t kidx;
int error;
/*
@@ -2590,67 +2045,10 @@
unref_oib_objects(ch, cmd, oib, pidx);
IPFW_UH_WUNLOCK(ch);
- return (error);
- }
-
- return (0);
-}
-
-/*
- * Compatibility function for old ipfw(8) binaries.
- * Rewrites table/nat kernel indices with userland ones.
- * Convert tables matching '/^\d+$/' to their atoi() value.
- * Use number 65535 for other tables.
- *
- * Returns 0 on success.
- */
-static int
-set_legacy_obj_kidx(struct ip_fw_chain *ch, struct ip_fw_rule0 *rule)
-{
- struct opcode_obj_rewrite *rw;
- struct named_object *no;
- ipfw_insn *cmd;
- char *end;
- long val;
- int cmdlen, error, l;
- uint16_t kidx, uidx;
- uint8_t subtype;
-
- error = 0;
-
- l = rule->cmd_len;
- cmd = rule->cmd;
- cmdlen = 0;
- for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) {
- cmdlen = F_LEN(cmd);
-
- /* Check if is index in given opcode */
- rw = find_op_rw(cmd, &kidx, &subtype);
- if (rw == NULL)
- continue;
-
- /* Try to find referenced kernel object */
- no = rw->find_bykidx(ch, kidx);
- if (no == NULL)
- continue;
-
- val = strtol(no->name, &end, 10);
- if (*end == '\0' && val < 65535) {
- uidx = val;
- } else {
- /*
- * We are called via legacy opcode.
- * Save error and show table as fake number
- * not to make ipfw(8) hang.
- */
- uidx = 65535;
- error = 2;
- }
-
- rw->update(cmd, uidx);
+ return (error);
}
- return (error);
+ return (0);
}
/*
@@ -2694,8 +2092,8 @@
struct opcode_obj_rewrite *rw;
struct named_object *no;
ipfw_insn *cmd;
+ uint32_t kidx;
int cmdlen, l;
- uint16_t kidx;
uint8_t subtype;
IPFW_UH_WLOCK_ASSERT(ch);
@@ -2897,8 +2295,8 @@
}
/*
- * Adds one or more rules to ipfw @chain.
- * Data layout (version 0)(current):
+ * Parses one or more rules from userland.
+ * Data layout (version 1)(current):
* Request:
* [
* ip_fw3_opheader
@@ -2921,52 +2319,45 @@
*
* Returns 0 on success.
*/
-static int
-add_rules(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
- struct sockopt_data *sd)
+static __noinline int
+parse_rules_v1(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
+ struct sockopt_data *sd, ipfw_obj_ctlv **prtlv,
+ struct rule_check_info **pci)
{
ipfw_obj_ctlv *ctlv, *rtlv, *tstate;
ipfw_obj_ntlv *ntlv;
- int clen, error, idx;
- uint32_t count, read;
+ struct rule_check_info *ci, *cbuf;
struct ip_fw_rule *r;
- struct rule_check_info rci, *ci, *cbuf;
- int i, rsize;
+ size_t count, clen, read, rsize;
+ uint32_t idx, rulenum;
+ int error;
op3 = (ip_fw3_opheader *)ipfw_get_sopt_space(sd, sd->valsize);
ctlv = (ipfw_obj_ctlv *)(op3 + 1);
-
read = sizeof(ip_fw3_opheader);
- rtlv = NULL;
- tstate = NULL;
- cbuf = NULL;
- memset(&rci, 0, sizeof(struct rule_check_info));
-
if (read + sizeof(*ctlv) > sd->valsize)
return (EINVAL);
+ rtlv = NULL;
+ tstate = NULL;
+ cbuf = NULL;
+ /* Table names or other named objects. */
if (ctlv->head.type == IPFW_TLV_TBLNAME_LIST) {
+ /* Check size and alignment. */
clen = ctlv->head.length;
- /* Check size and alignment */
- if (clen > sd->valsize || clen < sizeof(*ctlv))
- return (EINVAL);
- if ((clen % sizeof(uint64_t)) != 0)
+ if (read + clen > sd->valsize || clen < sizeof(*ctlv) ||
+ (clen % sizeof(uint64_t)) != 0)
return (EINVAL);
-
- /*
- * Some table names or other named objects.
- * Check for validness.
- */
+ /* Check for validness. */
count = (ctlv->head.length - sizeof(*ctlv)) / sizeof(*ntlv);
if (ctlv->count != count || ctlv->objsize != sizeof(*ntlv))
return (EINVAL);
-
/*
* Check each TLV.
* Ensure TLVs are sorted ascending and
* there are no duplicates.
*/
- idx = -1;
+ idx = 0;
ntlv = (ipfw_obj_ntlv *)(ctlv + 1);
while (count > 0) {
if (ntlv->head.length != sizeof(ipfw_obj_ntlv))
@@ -2987,70 +2378,59 @@
tstate = ctlv;
read += ctlv->head.length;
ctlv = (ipfw_obj_ctlv *)((caddr_t)ctlv + ctlv->head.length);
- }
- if (read + sizeof(*ctlv) > sd->valsize)
- return (EINVAL);
+ if (read + sizeof(*ctlv) > sd->valsize)
+ return (EINVAL);
+ }
+ /* List of rules. */
if (ctlv->head.type == IPFW_TLV_RULE_LIST) {
clen = ctlv->head.length;
- if (clen + read > sd->valsize || clen < sizeof(*ctlv))
+ if (read + clen > sd->valsize || clen < sizeof(*ctlv) ||
+ (clen % sizeof(uint64_t)) != 0)
return (EINVAL);
- if ((clen % sizeof(uint64_t)) != 0)
- return (EINVAL);
-
- /*
- * TODO: Permit adding multiple rules at once
- */
- if (ctlv->count != 1)
- return (ENOTSUP);
clen -= sizeof(*ctlv);
-
- if (ctlv->count > clen / sizeof(struct ip_fw_rule))
+ if (ctlv->count == 0 ||
+ ctlv->count > clen / sizeof(struct ip_fw_rule))
return (EINVAL);
- /* Allocate state for each rule or use stack */
- if (ctlv->count == 1) {
- memset(&rci, 0, sizeof(struct rule_check_info));
- cbuf = &rci;
- } else
- cbuf = malloc(ctlv->count * sizeof(*ci), M_TEMP,
- M_WAITOK | M_ZERO);
- ci = cbuf;
+ /* Allocate state for each rule */
+ cbuf = malloc(ctlv->count * sizeof(struct rule_check_info),
+ M_TEMP, M_WAITOK | M_ZERO);
/*
* Check each rule for validness.
* Ensure numbered rules are sorted ascending
* and properly aligned
*/
- idx = 0;
- r = (struct ip_fw_rule *)(ctlv + 1);
+ rulenum = 0;
count = 0;
error = 0;
+ ci = cbuf;
+ r = (struct ip_fw_rule *)(ctlv + 1);
while (clen > 0) {
- rsize = roundup2(RULESIZE(r), sizeof(uint64_t));
- if (rsize > clen || ctlv->count <= count) {
+ rsize = RULEUSIZE1(r);
+ if (rsize > clen || count > ctlv->count) {
error = EINVAL;
break;
}
-
ci->ctlv = tstate;
- error = check_ipfw_rule1(r, rsize, ci);
+ ci->version = IP_FW3_OPVER;
+ error = ipfw_check_rule(r, rsize, ci);
if (error != 0)
break;
/* Check sorting */
- if (r->rulenum != 0 && r->rulenum < idx) {
- printf("rulenum %d idx %d\n", r->rulenum, idx);
+ if (count != 0 && ((rulenum == 0) != (r->rulenum == 0) ||
+ r->rulenum < rulenum)) {
+ printf("ipfw: wrong order: rulenum %u"
+ " vs %u\n", r->rulenum, rulenum);
error = EINVAL;
break;
}
- idx = r->rulenum;
-
+ rulenum = r->rulenum;
ci->urule = (caddr_t)r;
-
- rsize = roundup2(rsize, sizeof(uint64_t));
clen -= rsize;
r = (struct ip_fw_rule *)((caddr_t)r + rsize);
count++;
@@ -3058,8 +2438,7 @@
}
if (ctlv->count != count || error != 0) {
- if (cbuf != &rci)
- free(cbuf, M_TEMP);
+ free(cbuf, M_TEMP);
return (EINVAL);
}
@@ -3068,37 +2447,78 @@
ctlv = (ipfw_obj_ctlv *)((caddr_t)ctlv + ctlv->head.length);
}
- if (read != sd->valsize || rtlv == NULL || rtlv->count == 0) {
- if (cbuf != NULL && cbuf != &rci)
- free(cbuf, M_TEMP);
+ if (read != sd->valsize || rtlv == NULL) {
+ free(cbuf, M_TEMP);
return (EINVAL);
}
+ *prtlv = rtlv;
+ *pci = cbuf;
+ return (0);
+}
+
+/*
+ * Copy rule @urule from v1 userland format (current) to kernel @krule.
+ */
+static void
+import_rule_v1(struct ip_fw_chain *chain, struct rule_check_info *ci)
+{
+ struct ip_fw_rule *urule;
+ struct ip_fw *krule;
+
+ urule = (struct ip_fw_rule *)ci->urule;
+ krule = ci->krule = ipfw_alloc_rule(chain, RULEKSIZE1(urule));
+
+ krule->act_ofs = urule->act_ofs;
+ krule->cmd_len = urule->cmd_len;
+ krule->rulenum = urule->rulenum;
+ krule->set = urule->set;
+ krule->flags = urule->flags;
+
+ /* Save rulenum offset */
+ ci->urule_numoff = offsetof(struct ip_fw_rule, rulenum);
+
+ /* Copy opcodes */
+ memcpy(krule->cmd, urule->cmd, krule->cmd_len * sizeof(uint32_t));
+}
+
+/*
+ * Adds one or more rules to ipfw @chain.
+ */
+static int
+add_rules(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
+ struct sockopt_data *sd)
+{
+ ipfw_obj_ctlv *rtlv;
+ struct rule_check_info *ci, *nci;
+ int i, ret;
+
/*
- * Passed rules seems to be valid.
- * Allocate storage and try to add them to chain.
+ * Check rules buffer for validness.
*/
- for (i = 0, ci = cbuf; i < rtlv->count; i++, ci++) {
- clen = RULEKSIZE1((struct ip_fw_rule *)ci->urule);
- ci->krule = ipfw_alloc_rule(chain, clen);
- import_rule1(ci);
- }
-
- if ((error = commit_rules(chain, cbuf, rtlv->count)) != 0) {
- /* Free allocate krules */
- for (i = 0, ci = cbuf; i < rtlv->count; i++, ci++)
+ ret = parse_rules_v1(chain, op3, sd, &rtlv, &nci);
+ if (ret != 0)
+ return (ret);
+ /*
+ * Allocate storage for the kernel representation of rules.
+ */
+ for (i = 0, ci = nci; i < rtlv->count; i++, ci++)
+ import_rule_v1(chain, ci);
+ /*
+ * Try to add new rules to the chain.
+ */
+ if ((ret = ipfw_commit_rules(chain, nci, rtlv->count)) != 0) {
+ for (i = 0, ci = nci; i < rtlv->count; i++, ci++)
ipfw_free_rule(ci->krule);
}
-
- if (cbuf != NULL && cbuf != &rci)
- free(cbuf, M_TEMP);
-
- return (error);
+ /* Cleanup after parse_rules() */
+ free(nci, M_TEMP);
+ return (ret);
}
/*
* Lists all sopts currently registered.
- * Data layout (v0)(current):
+ * Data layout (v1)(current):
* Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size
* Reply: [ ipfw_obj_lheader ipfw_sopt_info x N ]
*
@@ -3113,7 +2533,8 @@
struct ipfw_sopt_handler *sh;
uint32_t count, n, size;
- olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,sizeof(*olh));
+ olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,
+ sizeof(*olh));
if (olh == NULL)
return (EINVAL);
if (sd->valsize < olh->size)
@@ -3209,10 +2630,10 @@
* Returns pointer to handler or NULL.
*/
static struct opcode_obj_rewrite *
-find_op_rw(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
+find_op_rw(ipfw_insn *cmd, uint32_t *puidx, uint8_t *ptype)
{
struct opcode_obj_rewrite *rw, *lo, *hi;
- uint16_t uidx;
+ uint32_t uidx;
uint8_t subtype;
if (find_op_rw_range(cmd->opcode, &lo, &hi) != 0)
@@ -3231,7 +2652,7 @@
return (NULL);
}
int
-classify_opcode_kidx(ipfw_insn *cmd, uint16_t *puidx)
+classify_opcode_kidx(ipfw_insn *cmd, uint32_t *puidx)
{
if (find_op_rw(cmd, puidx, NULL) == NULL)
@@ -3240,7 +2661,7 @@
}
void
-update_opcode_kidx(ipfw_insn *cmd, uint16_t idx)
+update_opcode_kidx(ipfw_insn *cmd, uint32_t idx)
{
struct opcode_obj_rewrite *rw;
@@ -3252,7 +2673,6 @@
void
ipfw_init_obj_rewriter(void)
{
-
ctl3_rewriters = NULL;
ctl3_rsize = 0;
}
@@ -3260,7 +2680,6 @@
void
ipfw_destroy_obj_rewriter(void)
{
-
if (ctl3_rewriters != NULL)
free(ctl3_rewriters, M_IPFW);
ctl3_rewriters = NULL;
@@ -3393,6 +2812,49 @@
return (0);
}
+void
+ipfw_enable_skipto_cache(struct ip_fw_chain *chain)
+{
+
+ IPFW_UH_WLOCK_ASSERT(chain);
+ update_skipto_cache(chain, chain->map);
+
+ IPFW_WLOCK(chain);
+ swap_skipto_cache(chain);
+ V_skipto_cache = 1;
+ IPFW_WUNLOCK(chain);
+}
+
+/*
+ * Enables or disable skipto cache.
+ * Request: [ ipfw_cmd_header ] size = ipfw_cmd_header.size
+ * Reply: [ ipfw_cmd_header ]
+ * Returns 0 on success
+ */
+static int
+manage_skiptocache(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
+ struct sockopt_data *sd)
+{
+ ipfw_cmd_header *hdr;
+
+ if (sd->valsize != sizeof(*hdr))
+ return (EINVAL);
+
+ hdr = (ipfw_cmd_header *)ipfw_get_sopt_space(sd, sd->valsize);
+ if (hdr->cmd != SKIPTO_CACHE_DISABLE &&
+ hdr->cmd != SKIPTO_CACHE_ENABLE)
+ return (EOPNOTSUPP);
+
+ IPFW_UH_WLOCK(chain);
+ if (hdr->cmd != V_skipto_cache) {
+ if (hdr->cmd == SKIPTO_CACHE_ENABLE)
+ ipfw_enable_skipto_cache(chain);
+ V_skipto_cache = hdr->cmd;
+ }
+ IPFW_UH_WUNLOCK(chain);
+ return (0);
+}
+
/*
* Compares two sopt handlers (code, version and handler ptr).
* Used both as qsort() and bsearch().
@@ -3488,7 +2950,6 @@
void
ipfw_init_sopt_handler(void)
{
-
CTL3_LOCK_INIT();
IPFW_ADD_SOPT_HANDLER(1, scodes);
}
@@ -3496,11 +2957,22 @@
void
ipfw_destroy_sopt_handler(void)
{
-
IPFW_DEL_SOPT_HANDLER(1, scodes);
CTL3_LOCK_DESTROY();
}
+void
+ipfw_register_compat(ipfw_check_opcode_t f)
+{
+ check_opcode_f = f;
+}
+
+void
+ipfw_unregister_compat(void)
+{
+ check_opcode_f = check_opcode_compat_nop;
+}
+
/*
* Adds one or more sockopt handlers to the global array.
* Function may sleep.
@@ -3683,7 +3155,7 @@
return (error);
if (sopt->sopt_name != IP_FW3)
- return (ipfw_ctl(sopt));
+ return (EOPNOTSUPP);
chain = &V_layer3_chain;
error = 0;
@@ -3796,432 +3268,6 @@
return (error);
}
-/**
- * {set|get}sockopt parser.
- */
-int
-ipfw_ctl(struct sockopt *sopt)
-{
-#define RULE_MAXSIZE (512*sizeof(u_int32_t))
- int error;
- size_t size;
- struct ip_fw *buf;
- struct ip_fw_rule0 *rule;
- struct ip_fw_chain *chain;
- u_int32_t rulenum[2];
- uint32_t opt;
- struct rule_check_info ci;
- IPFW_RLOCK_TRACKER;
-
- chain = &V_layer3_chain;
- error = 0;
-
- opt = sopt->sopt_name;
-
- /*
- * Disallow modifications in really-really secure mode, but still allow
- * the logging counters to be reset.
- */
- if (opt == IP_FW_ADD ||
- (sopt->sopt_dir == SOPT_SET && opt != IP_FW_RESETLOG)) {
- error = securelevel_ge(sopt->sopt_td->td_ucred, 3);
- if (error != 0)
- return (error);
- }
-
- switch (opt) {
- case IP_FW_GET:
- /*
- * pass up a copy of the current rules. Static rules
- * come first (the last of which has number IPFW_DEFAULT_RULE),
- * followed by a possibly empty list of dynamic rule.
- * The last dynamic rule has NULL in the "next" field.
- *
- * Note that the calculated size is used to bound the
- * amount of data returned to the user. The rule set may
- * change between calculating the size and returning the
- * data in which case we'll just return what fits.
- */
- for (;;) {
- int len = 0, want;
-
- size = chain->static_len;
- size += ipfw_dyn_len();
- if (size >= sopt->sopt_valsize)
- break;
- buf = malloc(size, M_TEMP, M_WAITOK | M_ZERO);
- IPFW_UH_RLOCK(chain);
- /* check again how much space we need */
- want = chain->static_len + ipfw_dyn_len();
- if (size >= want)
- len = ipfw_getrules(chain, buf, size);
- IPFW_UH_RUNLOCK(chain);
- if (size >= want)
- error = sooptcopyout(sopt, buf, len);
- free(buf, M_TEMP);
- if (size >= want)
- break;
- }
- break;
-
- case IP_FW_FLUSH:
- /* locking is done within del_entry() */
- error = del_entry(chain, 0); /* special case, rule=0, cmd=0 means all */
- break;
-
- case IP_FW_ADD:
- rule = malloc(RULE_MAXSIZE, M_TEMP, M_WAITOK);
- error = sooptcopyin(sopt, rule, RULE_MAXSIZE,
- sizeof(struct ip_fw7) );
-
- memset(&ci, 0, sizeof(struct rule_check_info));
-
- /*
- * If the size of commands equals RULESIZE7 then we assume
- * a FreeBSD7.2 binary is talking to us (set is7=1).
- * is7 is persistent so the next 'ipfw list' command
- * will use this format.
- * NOTE: If wrong version is guessed (this can happen if
- * the first ipfw command is 'ipfw [pipe] list')
- * the ipfw binary may crash or loop infinitly...
- */
- size = sopt->sopt_valsize;
- if (size == RULESIZE7(rule)) {
- is7 = 1;
- error = convert_rule_to_8(rule);
- if (error) {
- free(rule, M_TEMP);
- return error;
- }
- size = RULESIZE(rule);
- } else
- is7 = 0;
- if (error == 0)
- error = check_ipfw_rule0(rule, size, &ci);
- if (error == 0) {
- /* locking is done within add_rule() */
- struct ip_fw *krule;
- krule = ipfw_alloc_rule(chain, RULEKSIZE0(rule));
- ci.urule = (caddr_t)rule;
- ci.krule = krule;
- import_rule0(&ci);
- error = commit_rules(chain, &ci, 1);
- if (error != 0)
- ipfw_free_rule(ci.krule);
- else if (sopt->sopt_dir == SOPT_GET) {
- if (is7) {
- error = convert_rule_to_7(rule);
- size = RULESIZE7(rule);
- if (error) {
- free(rule, M_TEMP);
- return error;
- }
- }
- error = sooptcopyout(sopt, rule, size);
- }
- }
- free(rule, M_TEMP);
- break;
-
- case IP_FW_DEL:
- /*
- * IP_FW_DEL is used for deleting single rules or sets,
- * and (ab)used to atomically manipulate sets. Argument size
- * is used to distinguish between the two:
- * sizeof(u_int32_t)
- * delete single rule or set of rules,
- * or reassign rules (or sets) to a different set.
- * 2*sizeof(u_int32_t)
- * atomic disable/enable sets.
- * first u_int32_t contains sets to be disabled,
- * second u_int32_t contains sets to be enabled.
- */
- error = sooptcopyin(sopt, rulenum,
- 2*sizeof(u_int32_t), sizeof(u_int32_t));
- if (error)
- break;
- size = sopt->sopt_valsize;
- if (size == sizeof(u_int32_t) && rulenum[0] != 0) {
- /* delete or reassign, locking done in del_entry() */
- error = del_entry(chain, rulenum[0]);
- } else if (size == 2*sizeof(u_int32_t)) { /* set enable/disable */
- IPFW_UH_WLOCK(chain);
- V_set_disable =
- (V_set_disable | rulenum[0]) & ~rulenum[1] &
- ~(1<<RESVD_SET); /* set RESVD_SET always enabled */
- IPFW_UH_WUNLOCK(chain);
- } else
- error = EINVAL;
- break;
-
- case IP_FW_ZERO:
- case IP_FW_RESETLOG: /* argument is an u_int_32, the rule number */
- rulenum[0] = 0;
- if (sopt->sopt_val != 0) {
- error = sooptcopyin(sopt, rulenum,
- sizeof(u_int32_t), sizeof(u_int32_t));
- if (error)
- break;
- }
- error = zero_entry(chain, rulenum[0],
- sopt->sopt_name == IP_FW_RESETLOG);
- break;
-
- /*--- TABLE opcodes ---*/
- case IP_FW_TABLE_ADD:
- case IP_FW_TABLE_DEL:
- {
- ipfw_table_entry ent;
- struct tentry_info tei;
- struct tid_info ti;
- struct table_value v;
-
- error = sooptcopyin(sopt, &ent,
- sizeof(ent), sizeof(ent));
- if (error)
- break;
-
- memset(&tei, 0, sizeof(tei));
- tei.paddr = &ent.addr;
- tei.subtype = AF_INET;
- tei.masklen = ent.masklen;
- ipfw_import_table_value_legacy(ent.value, &v);
- tei.pvalue = &v;
- memset(&ti, 0, sizeof(ti));
- ti.uidx = ent.tbl;
- ti.type = IPFW_TABLE_CIDR;
-
- error = (opt == IP_FW_TABLE_ADD) ?
- add_table_entry(chain, &ti, &tei, 0, 1) :
- del_table_entry(chain, &ti, &tei, 0, 1);
- }
- break;
-
- case IP_FW_TABLE_FLUSH:
- {
- u_int16_t tbl;
- struct tid_info ti;
-
- error = sooptcopyin(sopt, &tbl,
- sizeof(tbl), sizeof(tbl));
- if (error)
- break;
- memset(&ti, 0, sizeof(ti));
- ti.uidx = tbl;
- error = flush_table(chain, &ti);
- }
- break;
-
- case IP_FW_TABLE_GETSIZE:
- {
- u_int32_t tbl, cnt;
- struct tid_info ti;
-
- if ((error = sooptcopyin(sopt, &tbl, sizeof(tbl),
- sizeof(tbl))))
- break;
- memset(&ti, 0, sizeof(ti));
- ti.uidx = tbl;
- IPFW_RLOCK(chain);
- error = ipfw_count_table(chain, &ti, &cnt);
- IPFW_RUNLOCK(chain);
- if (error)
- break;
- error = sooptcopyout(sopt, &cnt, sizeof(cnt));
- }
- break;
-
- case IP_FW_TABLE_LIST:
- {
- ipfw_table *tbl;
- struct tid_info ti;
-
- if (sopt->sopt_valsize < sizeof(*tbl)) {
- error = EINVAL;
- break;
- }
- size = sopt->sopt_valsize;
- tbl = malloc(size, M_TEMP, M_WAITOK);
- error = sooptcopyin(sopt, tbl, size, sizeof(*tbl));
- if (error) {
- free(tbl, M_TEMP);
- break;
- }
- tbl->size = (size - sizeof(*tbl)) /
- sizeof(ipfw_table_entry);
- memset(&ti, 0, sizeof(ti));
- ti.uidx = tbl->tbl;
- IPFW_RLOCK(chain);
- error = ipfw_dump_table_legacy(chain, &ti, tbl);
- IPFW_RUNLOCK(chain);
- if (error) {
- free(tbl, M_TEMP);
- break;
- }
- error = sooptcopyout(sopt, tbl, size);
- free(tbl, M_TEMP);
- }
- break;
-
- /*--- NAT operations are protected by the IPFW_LOCK ---*/
- case IP_FW_NAT_CFG:
- if (IPFW_NAT_LOADED)
- error = ipfw_nat_cfg_ptr(sopt);
- else {
- printf("IP_FW_NAT_CFG: %s\n",
- "ipfw_nat not present, please load it");
- error = EINVAL;
- }
- break;
-
- case IP_FW_NAT_DEL:
- if (IPFW_NAT_LOADED)
- error = ipfw_nat_del_ptr(sopt);
- else {
- printf("IP_FW_NAT_DEL: %s\n",
- "ipfw_nat not present, please load it");
- error = EINVAL;
- }
- break;
-
- case IP_FW_NAT_GET_CONFIG:
- if (IPFW_NAT_LOADED)
- error = ipfw_nat_get_cfg_ptr(sopt);
- else {
- printf("IP_FW_NAT_GET_CFG: %s\n",
- "ipfw_nat not present, please load it");
- error = EINVAL;
- }
- break;
-
- case IP_FW_NAT_GET_LOG:
- if (IPFW_NAT_LOADED)
- error = ipfw_nat_get_log_ptr(sopt);
- else {
- printf("IP_FW_NAT_GET_LOG: %s\n",
- "ipfw_nat not present, please load it");
- error = EINVAL;
- }
- break;
-
- default:
- printf("ipfw: ipfw_ctl invalid option %d\n", sopt->sopt_name);
- error = EINVAL;
- }
-
- return (error);
-#undef RULE_MAXSIZE
-}
-#define RULE_MAXSIZE (256*sizeof(u_int32_t))
-
-/* Functions to convert rules 7.2 <==> 8.0 */
-static int
-convert_rule_to_7(struct ip_fw_rule0 *rule)
-{
- /* Used to modify original rule */
- struct ip_fw7 *rule7 = (struct ip_fw7 *)rule;
- /* copy of original rule, version 8 */
- struct ip_fw_rule0 *tmp;
-
- /* Used to copy commands */
- ipfw_insn *ccmd, *dst;
- int ll = 0, ccmdlen = 0;
-
- tmp = malloc(RULE_MAXSIZE, M_TEMP, M_NOWAIT | M_ZERO);
- if (tmp == NULL) {
- return 1; //XXX error
- }
- bcopy(rule, tmp, RULE_MAXSIZE);
-
- /* Copy fields */
- //rule7->_pad = tmp->_pad;
- rule7->set = tmp->set;
- rule7->rulenum = tmp->rulenum;
- rule7->cmd_len = tmp->cmd_len;
- rule7->act_ofs = tmp->act_ofs;
- rule7->next_rule = (struct ip_fw7 *)tmp->next_rule;
- rule7->cmd_len = tmp->cmd_len;
- rule7->pcnt = tmp->pcnt;
- rule7->bcnt = tmp->bcnt;
- rule7->timestamp = tmp->timestamp;
-
- /* Copy commands */
- for (ll = tmp->cmd_len, ccmd = tmp->cmd, dst = rule7->cmd ;
- ll > 0 ; ll -= ccmdlen, ccmd += ccmdlen, dst += ccmdlen) {
- ccmdlen = F_LEN(ccmd);
-
- bcopy(ccmd, dst, F_LEN(ccmd)*sizeof(uint32_t));
-
- if (dst->opcode > O_NAT)
- /* O_REASS doesn't exists in 7.2 version, so
- * decrement opcode if it is after O_REASS
- */
- dst->opcode--;
-
- if (ccmdlen > ll) {
- printf("ipfw: opcode %d size truncated\n",
- ccmd->opcode);
- return EINVAL;
- }
- }
- free(tmp, M_TEMP);
-
- return 0;
-}
-
-static int
-convert_rule_to_8(struct ip_fw_rule0 *rule)
-{
- /* Used to modify original rule */
- struct ip_fw7 *rule7 = (struct ip_fw7 *) rule;
-
- /* Used to copy commands */
- ipfw_insn *ccmd, *dst;
- int ll = 0, ccmdlen = 0;
-
- /* Copy of original rule */
- struct ip_fw7 *tmp = malloc(RULE_MAXSIZE, M_TEMP, M_NOWAIT | M_ZERO);
- if (tmp == NULL) {
- return 1; //XXX error
- }
-
- bcopy(rule7, tmp, RULE_MAXSIZE);
-
- for (ll = tmp->cmd_len, ccmd = tmp->cmd, dst = rule->cmd ;
- ll > 0 ; ll -= ccmdlen, ccmd += ccmdlen, dst += ccmdlen) {
- ccmdlen = F_LEN(ccmd);
-
- bcopy(ccmd, dst, F_LEN(ccmd)*sizeof(uint32_t));
-
- if (dst->opcode > O_NAT)
- /* O_REASS doesn't exists in 7.2 version, so
- * increment opcode if it is after O_REASS
- */
- dst->opcode++;
-
- if (ccmdlen > ll) {
- printf("ipfw: opcode %d size truncated\n",
- ccmd->opcode);
- return EINVAL;
- }
- }
-
- rule->_pad = tmp->_pad;
- rule->set = tmp->set;
- rule->rulenum = tmp->rulenum;
- rule->cmd_len = tmp->cmd_len;
- rule->act_ofs = tmp->act_ofs;
- rule->next_rule = (struct ip_fw *)tmp->next_rule;
- rule->cmd_len = tmp->cmd_len;
- rule->id = 0; /* XXX see if is ok = 0 */
- rule->pcnt = tmp->pcnt;
- rule->bcnt = tmp->bcnt;
- rule->timestamp = tmp->timestamp;
-
- free (tmp, M_TEMP);
- return 0;
-}
-
/*
* Named object api
*
@@ -4230,8 +3276,8 @@
void
ipfw_init_srv(struct ip_fw_chain *ch)
{
-
- ch->srvmap = ipfw_objhash_create(IPFW_OBJECTS_DEFAULT);
+ ch->srvmap = ipfw_objhash_create(IPFW_OBJECTS_DEFAULT,
+ DEFAULT_OBJHASH_SIZE);
ch->srvstate = malloc(sizeof(void *) * IPFW_OBJECTS_DEFAULT,
M_IPFW, M_WAITOK | M_ZERO);
}
@@ -4239,7 +3285,6 @@
void
ipfw_destroy_srv(struct ip_fw_chain *ch)
{
-
free(ch->srvstate, M_IPFW);
ipfw_objhash_destroy(ch->srvmap);
}
@@ -4314,7 +3359,6 @@
void
ipfw_objhash_bitmap_free(void *idx, int blocks)
{
-
free(idx, M_IPFW);
}
@@ -4324,19 +3368,19 @@
* Return pointer to new instance.
*/
struct namedobj_instance *
-ipfw_objhash_create(uint32_t items)
+ipfw_objhash_create(uint32_t items, size_t hash_size)
{
struct namedobj_instance *ni;
int i;
size_t size;
size = sizeof(struct namedobj_instance) +
- sizeof(struct namedobjects_head) * NAMEDOBJ_HASH_SIZE +
- sizeof(struct namedobjects_head) * NAMEDOBJ_HASH_SIZE;
+ sizeof(struct namedobjects_head) * hash_size +
+ sizeof(struct namedobjects_head) * hash_size;
ni = malloc(size, M_IPFW, M_WAITOK | M_ZERO);
- ni->nn_size = NAMEDOBJ_HASH_SIZE;
- ni->nv_size = NAMEDOBJ_HASH_SIZE;
+ ni->nn_size = hash_size;
+ ni->nv_size = hash_size;
ni->names = (struct namedobjects_head *)(ni +1);
ni->values = &ni->names[ni->nn_size];
@@ -4360,7 +3404,6 @@
void
ipfw_objhash_destroy(struct namedobj_instance *ni)
{
-
free(ni->idx_mask, M_IPFW);
free(ni, M_IPFW);
}
@@ -4425,7 +3468,7 @@
* Returns pointer to found TLV or NULL.
*/
ipfw_obj_ntlv *
-ipfw_find_name_tlv_type(void *tlvs, int len, uint16_t uidx, uint32_t etlv)
+ipfw_find_name_tlv_type(void *tlvs, int len, uint32_t uidx, uint32_t etlv)
{
ipfw_obj_ntlv *ntlv;
uintptr_t pa, pe;
@@ -4519,7 +3562,7 @@
}
struct named_object *
-ipfw_objhash_lookup_kidx(struct namedobj_instance *ni, uint16_t kidx)
+ipfw_objhash_lookup_kidx(struct namedobj_instance *ni, uint32_t kidx)
{
struct named_object *no;
uint32_t hash;
@@ -4645,7 +3688,7 @@
* Returns 0 on success.
*/
int
-ipfw_objhash_free_idx(struct namedobj_instance *ni, uint16_t idx)
+ipfw_objhash_free_idx(struct namedobj_instance *ni, uint32_t idx)
{
u_long *mask;
int i, v;
@@ -4676,7 +3719,7 @@
* Returns 0 on success.
*/
int
-ipfw_objhash_alloc_idx(void *n, uint16_t *pidx)
+ipfw_objhash_alloc_idx(void *n, uint32_t *pidx)
{
struct namedobj_instance *ni;
u_long *mask;
diff --git a/sys/netpfil/ipfw/ip_fw_table.h b/sys/netpfil/ipfw/ip_fw_table.h
--- a/sys/netpfil/ipfw/ip_fw_table.h
+++ b/sys/netpfil/ipfw/ip_fw_table.h
@@ -156,10 +156,6 @@
int del_table_entry(struct ip_fw_chain *ch, struct tid_info *ti,
struct tentry_info *tei, uint8_t flags, uint32_t count);
int flush_table(struct ip_fw_chain *ch, struct tid_info *ti);
-void ipfw_import_table_value_legacy(uint32_t value, struct table_value *v);
-uint32_t ipfw_export_table_value_legacy(struct table_value *v);
-int ipfw_get_table_size(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
- struct sockopt_data *sd);
/* ipfw_table_value.c functions */
struct table_config;
@@ -180,7 +176,7 @@
struct rule_check_info *ci);
int ipfw_mark_table_kidx(struct ip_fw_chain *chain, struct ip_fw *rule,
uint32_t *bmask);
-int ipfw_export_table_ntlv(struct ip_fw_chain *ch, uint16_t kidx,
+int ipfw_export_table_ntlv(struct ip_fw_chain *ch, uint32_t kidx,
struct sockopt_data *sd);
void ipfw_unref_rule_tables(struct ip_fw_chain *chain, struct ip_fw *rule);
struct namedobj_instance *ipfw_get_table_objhash(struct ip_fw_chain *ch);
@@ -190,7 +186,7 @@
uint32_t new_set);
void ipfw_swap_tables_sets(struct ip_fw_chain *ch, uint32_t old_set,
uint32_t new_set, int mv);
-int ipfw_foreach_table_tentry(struct ip_fw_chain *ch, uint16_t kidx,
+int ipfw_foreach_table_tentry(struct ip_fw_chain *ch, uint32_t kidx,
ta_foreach_f f, void *arg);
/* internal functions */
@@ -220,13 +216,5 @@
void del_toperation_state(struct ip_fw_chain *ch, struct tableop_state *ts);
void rollback_toperation_state(struct ip_fw_chain *ch, void *object);
-/* Legacy interfaces */
-int ipfw_count_table(struct ip_fw_chain *ch, struct tid_info *ti,
- uint32_t *cnt);
-int ipfw_count_xtable(struct ip_fw_chain *ch, struct tid_info *ti,
- uint32_t *cnt);
-int ipfw_dump_table_legacy(struct ip_fw_chain *ch, struct tid_info *ti,
- ipfw_table *tbl);
-
#endif /* _KERNEL */
#endif /* _IPFW2_TABLE_H */
diff --git a/sys/netpfil/ipfw/ip_fw_table.c b/sys/netpfil/ipfw/ip_fw_table.c
--- a/sys/netpfil/ipfw/ip_fw_table.c
+++ b/sys/netpfil/ipfw/ip_fw_table.c
@@ -2,7 +2,7 @@
* SPDX-License-Identifier: BSD-2-Clause
*
* Copyright (c) 2004 Ruslan Ermilov and Vsevolod Lobko.
- * Copyright (c) 2014 Yandex LLC
+ * Copyright (c) 2014-2024 Yandex LLC
* Copyright (c) 2014 Alexander V. Chernikov
*
* Redistribution and use in source and binary forms, with or without
@@ -98,7 +98,7 @@
static void free_table_config(struct namedobj_instance *ni,
struct table_config *tc);
static int create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti,
- char *aname, ipfw_xtable_info *i, uint16_t *pkidx, int ref);
+ char *aname, ipfw_xtable_info *i, uint32_t *pkidx, int ref);
static void link_table(struct ip_fw_chain *ch, struct table_config *tc);
static void unlink_table(struct ip_fw_chain *ch, struct table_config *tc);
static int find_ref_table(struct ip_fw_chain *ch, struct tid_info *ti,
@@ -110,7 +110,6 @@
static void export_table_info(struct ip_fw_chain *ch, struct table_config *tc,
ipfw_xtable_info *i);
static int dump_table_tentry(void *e, void *arg);
-static int dump_table_xentry(void *e, void *arg);
static int swap_tables(struct ip_fw_chain *ch, struct tid_info *a,
struct tid_info *b);
@@ -257,7 +256,7 @@
*/
static int
create_table_compat(struct ip_fw_chain *ch, struct tid_info *ti,
- uint16_t *pkidx)
+ uint32_t *pkidx)
{
ipfw_xtable_info xi;
int error;
@@ -289,7 +288,7 @@
{
struct namedobj_instance *ni;
struct table_config *tc;
- uint16_t kidx;
+ uint32_t kidx;
int error;
IPFW_UH_WLOCK_ASSERT(ch);
@@ -330,7 +329,7 @@
return (error);
tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, kidx);
- KASSERT(tc != NULL, ("create_table_compat returned bad idx %d", kidx));
+ KASSERT(tc != NULL, ("create_table_compat returned bad idx %u", kidx));
/* OK, now we've got referenced table. */
*ptc = tc;
@@ -545,13 +544,12 @@
{
struct table_config *tc;
struct table_algo *ta;
- uint16_t kidx;
- int error, first_error, i, rollback;
- uint32_t num, numadd;
struct tentry_info *ptei;
struct tableop_state ts;
char ta_buf[TA_BUF_SZ];
caddr_t ta_buf_m, v;
+ uint32_t kidx, num, numadd;
+ int error, first_error, i, rollback;
memset(&ts, 0, sizeof(ts));
ta = NULL;
@@ -717,11 +715,10 @@
struct table_config *tc;
struct table_algo *ta;
struct tentry_info *ptei;
- uint16_t kidx;
- int error, first_error, i;
- uint32_t num, numdel;
char ta_buf[TA_BUF_SZ];
caddr_t ta_buf_m, v;
+ uint32_t kidx, num, numdel;
+ int error, first_error, i;
/*
* Find and reference existing table.
@@ -895,61 +892,6 @@
return (error);
}
-/*
- * Adds or deletes record in table.
- * Data layout (v0):
- * Request: [ ip_fw3_opheader ipfw_table_xentry ]
- *
- * Returns 0 on success
- */
-static int
-manage_table_ent_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
- struct sockopt_data *sd)
-{
- ipfw_table_xentry *xent;
- struct tentry_info tei;
- struct tid_info ti;
- struct table_value v;
- int error, hdrlen, read;
-
- hdrlen = offsetof(ipfw_table_xentry, k);
-
- /* Check minimum header size */
- if (sd->valsize < (sizeof(*op3) + hdrlen))
- return (EINVAL);
-
- read = sizeof(ip_fw3_opheader);
-
- /* Check if xentry len field is valid */
- xent = (ipfw_table_xentry *)(op3 + 1);
- if (xent->len < hdrlen || xent->len + read > sd->valsize)
- return (EINVAL);
-
- memset(&tei, 0, sizeof(tei));
- tei.paddr = &xent->k;
- tei.masklen = xent->masklen;
- ipfw_import_table_value_legacy(xent->value, &v);
- tei.pvalue = &v;
- /* Old requests compatibility */
- tei.flags = TEI_FLAGS_COMPAT;
- if (xent->type == IPFW_TABLE_ADDR) {
- if (xent->len - hdrlen == sizeof(in_addr_t))
- tei.subtype = AF_INET;
- else
- tei.subtype = AF_INET6;
- }
-
- memset(&ti, 0, sizeof(ti));
- ti.uidx = xent->tbl;
- ti.type = xent->type;
-
- error = (op3->opcode == IP_FW_TABLE_XADD) ?
- add_table_entry(ch, &ti, &tei, 0, 1) :
- del_table_entry(ch, &ti, &tei, 0, 1);
-
- return (error);
-}
-
/*
* Adds or deletes record in table.
* Data layout (v1)(current):
@@ -968,7 +910,8 @@
ipfw_obj_header *oh;
struct tentry_info *ptei, tei, *tei_buf;
struct tid_info ti;
- int error, i, kidx, read;
+ uint32_t kidx;
+ int error, i, read;
/* Check minimum header size */
if (sd->valsize < (sizeof(*oh) + sizeof(*ctlv)))
@@ -1210,7 +1153,7 @@
char algostate[64], *pstate;
struct tableop_state ts;
int error, need_gc;
- uint16_t kidx;
+ uint32_t kidx;
uint8_t tflags;
/*
@@ -1500,7 +1443,7 @@
/* Free obj index */
if (ipfw_objhash_free_idx(ni, tc->no.kidx) != 0)
- printf("Error unlinking kidx %d from table %s\n",
+ printf("Error unlinking kidx %u from table %s\n",
tc->no.kidx, tc->tablename);
/* Unref values used in tables while holding UH lock */
@@ -1533,7 +1476,7 @@
if (ntables > IPFW_TABLES_MAX)
ntables = IPFW_TABLES_MAX;
/* Alight to nearest power of 2 */
- ntables = roundup_pow_of_two(ntables);
+ ntables = roundup_pow_of_two(ntables);
/* Allocate new pointers */
tablestate = malloc(ntables * sizeof(struct table_info),
@@ -1595,7 +1538,7 @@
* Lookup table's named object by its @kidx.
*/
struct named_object *
-ipfw_objhash_lookup_table_kidx(struct ip_fw_chain *ch, uint16_t kidx)
+ipfw_objhash_lookup_table_kidx(struct ip_fw_chain *ch, uint32_t kidx)
{
return (ipfw_objhash_lookup_kidx(CHAIN_TO_NI(ch), kidx));
@@ -1606,7 +1549,7 @@
* On success return its @kidx.
*/
int
-ipfw_ref_table(struct ip_fw_chain *ch, ipfw_obj_ntlv *ntlv, uint16_t *kidx)
+ipfw_ref_table(struct ip_fw_chain *ch, ipfw_obj_ntlv *ntlv, uint32_t *kidx)
{
struct tid_info ti;
struct table_config *tc;
@@ -1629,7 +1572,7 @@
}
void
-ipfw_unref_table(struct ip_fw_chain *ch, uint16_t kidx)
+ipfw_unref_table(struct ip_fw_chain *ch, uint32_t kidx)
{
struct namedobj_instance *ni;
@@ -1638,7 +1581,7 @@
IPFW_UH_WLOCK_ASSERT(ch);
ni = CHAIN_TO_NI(ch);
no = ipfw_objhash_lookup_kidx(ni, kidx);
- KASSERT(no != NULL, ("Table with index %d not found", kidx));
+ KASSERT(no != NULL, ("Table with index %u not found", kidx));
no->refcnt--;
}
@@ -1649,7 +1592,7 @@
* Returns 1 if key was found.
*/
int
-ipfw_lookup_table(struct ip_fw_chain *ch, uint16_t tbl, uint16_t plen,
+ipfw_lookup_table(struct ip_fw_chain *ch, uint32_t tbl, uint16_t plen,
void *paddr, uint32_t *val)
{
struct table_info *ti;
@@ -1853,12 +1796,12 @@
*/
static int
create_table_internal(struct ip_fw_chain *ch, struct tid_info *ti,
- char *aname, ipfw_xtable_info *i, uint16_t *pkidx, int compat)
+ char *aname, ipfw_xtable_info *i, uint32_t *pkidx, int compat)
{
struct namedobj_instance *ni;
struct table_config *tc, *tc_new, *tmp;
struct table_algo *ta;
- uint16_t kidx;
+ uint32_t kidx;
ni = CHAIN_TO_NI(ch);
@@ -1958,7 +1901,7 @@
* Returns 0 on success.
*/
int
-ipfw_export_table_ntlv(struct ip_fw_chain *ch, uint16_t kidx,
+ipfw_export_table_ntlv(struct ip_fw_chain *ch, uint32_t kidx,
struct sockopt_data *sd)
{
struct namedobj_instance *ni;
@@ -1991,7 +1934,6 @@
uint16_t uidx;
int error;
uint32_t size;
- ipfw_table_entry *ent;
ta_foreach_f *f;
void *farg;
ipfw_obj_tentry tent;
@@ -2199,202 +2141,6 @@
return (da.error);
}
-/*
- * Dumps all table data
- * Data layout (version 0)(legacy):
- * Request: [ ipfw_xtable ], size = IP_FW_TABLE_XGETSIZE()
- * Reply: [ ipfw_xtable ipfw_table_xentry x N ]
- *
- * Returns 0 on success
- */
-static int
-dump_table_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
- struct sockopt_data *sd)
-{
- ipfw_xtable *xtbl;
- struct tid_info ti;
- struct table_config *tc;
- struct table_algo *ta;
- struct dump_args da;
- size_t sz, count;
-
- xtbl = (ipfw_xtable *)ipfw_get_sopt_header(sd, sizeof(ipfw_xtable));
- if (xtbl == NULL)
- return (EINVAL);
-
- memset(&ti, 0, sizeof(ti));
- ti.uidx = xtbl->tbl;
-
- IPFW_UH_RLOCK(ch);
- if ((tc = find_table(CHAIN_TO_NI(ch), &ti)) == NULL) {
- IPFW_UH_RUNLOCK(ch);
- return (0);
- }
- count = table_get_count(ch, tc);
- sz = count * sizeof(ipfw_table_xentry) + sizeof(ipfw_xtable);
-
- xtbl->cnt = count;
- xtbl->size = sz;
- xtbl->type = tc->no.subtype;
- xtbl->tbl = ti.uidx;
-
- if (sd->valsize < sz) {
- /*
- * Submitted buffer size is not enough.
- * WE've already filled in @i structure with
- * relevant table info including size, so we
- * can return. Buffer will be flushed automatically.
- */
- IPFW_UH_RUNLOCK(ch);
- return (ENOMEM);
- }
-
- /* Do the actual dump in eXtended format */
- memset(&da, 0, sizeof(da));
- da.ch = ch;
- da.ti = KIDX_TO_TI(ch, tc->no.kidx);
- da.tc = tc;
- da.sd = sd;
-
- ta = tc->ta;
-
- ta->foreach(tc->astate, da.ti, dump_table_xentry, &da);
- IPFW_UH_RUNLOCK(ch);
-
- return (0);
-}
-
-/*
- * Legacy function to retrieve number of items in table.
- */
-static int
-get_table_size(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
- struct sockopt_data *sd)
-{
- uint32_t *tbl;
- struct tid_info ti;
- size_t sz;
- int error;
-
- sz = sizeof(*op3) + sizeof(uint32_t);
- op3 = (ip_fw3_opheader *)ipfw_get_sopt_header(sd, sz);
- if (op3 == NULL)
- return (EINVAL);
-
- tbl = (uint32_t *)(op3 + 1);
- memset(&ti, 0, sizeof(ti));
- ti.uidx = *tbl;
- IPFW_UH_RLOCK(ch);
- error = ipfw_count_xtable(ch, &ti, tbl);
- IPFW_UH_RUNLOCK(ch);
- return (error);
-}
-
-/*
- * Legacy IP_FW_TABLE_GETSIZE handler
- */
-int
-ipfw_count_table(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt)
-{
- struct table_config *tc;
-
- if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL)
- return (ESRCH);
- *cnt = table_get_count(ch, tc);
- return (0);
-}
-
-/*
- * Legacy IP_FW_TABLE_XGETSIZE handler
- */
-int
-ipfw_count_xtable(struct ip_fw_chain *ch, struct tid_info *ti, uint32_t *cnt)
-{
- struct table_config *tc;
- uint32_t count;
-
- if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL) {
- *cnt = 0;
- return (0); /* 'table all list' requires success */
- }
-
- count = table_get_count(ch, tc);
- *cnt = count * sizeof(ipfw_table_xentry);
- if (count > 0)
- *cnt += sizeof(ipfw_xtable);
- return (0);
-}
-
-static int
-dump_table_entry(void *e, void *arg)
-{
- struct dump_args *da;
- struct table_config *tc;
- struct table_algo *ta;
- ipfw_table_entry *ent;
- struct table_value *pval;
- int error;
-
- da = (struct dump_args *)arg;
-
- tc = da->tc;
- ta = tc->ta;
-
- /* Out of memory, returning */
- if (da->cnt == da->size)
- return (1);
- ent = da->ent++;
- ent->tbl = da->uidx;
- da->cnt++;
-
- error = ta->dump_tentry(tc->astate, da->ti, e, &da->tent);
- if (error != 0)
- return (error);
-
- ent->addr = da->tent.k.addr.s_addr;
- ent->masklen = da->tent.masklen;
- pval = get_table_value(da->ch, da->tc, da->tent.v.kidx);
- ent->value = ipfw_export_table_value_legacy(pval);
-
- return (0);
-}
-
-/*
- * Dumps table in pre-8.1 legacy format.
- */
-int
-ipfw_dump_table_legacy(struct ip_fw_chain *ch, struct tid_info *ti,
- ipfw_table *tbl)
-{
- struct table_config *tc;
- struct table_algo *ta;
- struct dump_args da;
-
- tbl->cnt = 0;
-
- if ((tc = find_table(CHAIN_TO_NI(ch), ti)) == NULL)
- return (0); /* XXX: We should return ESRCH */
-
- ta = tc->ta;
-
- /* This dump format supports IPv4 only */
- if (tc->no.subtype != IPFW_TABLE_ADDR)
- return (0);
-
- memset(&da, 0, sizeof(da));
- da.ch = ch;
- da.ti = KIDX_TO_TI(ch, tc->no.kidx);
- da.tc = tc;
- da.ent = &tbl->ent[0];
- da.size = tbl->size;
-
- tbl->cnt = 0;
- ta->foreach(tc->astate, da.ti, dump_table_entry, &da);
- tbl->cnt = da.cnt;
-
- return (0);
-}
-
/*
* Dumps table entry in eXtended format (v1)(current).
*/
@@ -2432,52 +2178,6 @@
return (0);
}
-/*
- * Dumps table entry in eXtended format (v0).
- */
-static int
-dump_table_xentry(void *e, void *arg)
-{
- struct dump_args *da;
- struct table_config *tc;
- struct table_algo *ta;
- ipfw_table_xentry *xent;
- ipfw_obj_tentry *tent;
- struct table_value *pval;
- int error;
-
- da = (struct dump_args *)arg;
-
- tc = da->tc;
- ta = tc->ta;
-
- xent = (ipfw_table_xentry *)ipfw_get_sopt_space(da->sd, sizeof(*xent));
- /* Out of memory, returning */
- if (xent == NULL)
- return (1);
- xent->len = sizeof(ipfw_table_xentry);
- xent->tbl = da->uidx;
-
- memset(&da->tent, 0, sizeof(da->tent));
- tent = &da->tent;
- error = ta->dump_tentry(tc->astate, da->ti, e, tent);
- if (error != 0)
- return (error);
-
- /* Convert current format to previous one */
- xent->masklen = tent->masklen;
- pval = get_table_value(da->ch, da->tc, da->tent.v.kidx);
- xent->value = ipfw_export_table_value_legacy(pval);
- /* Apply some hacks */
- if (tc->no.subtype == IPFW_TABLE_ADDR && tent->subtype == AF_INET) {
- xent->k.addr6.s6_addr32[3] = tent->k.addr.s_addr;
- xent->flags = IPFW_TCF_INET;
- } else
- memcpy(&xent->k, &tent->k, sizeof(xent->k));
-
- return (0);
-}
-
/*
* Helper function to export table algo data
* to tentry format before calling user function.
@@ -2510,7 +2210,7 @@
* Allow external consumers to read table entries in standard format.
*/
int
-ipfw_foreach_table_tentry(struct ip_fw_chain *ch, uint16_t kidx,
+ipfw_foreach_table_tentry(struct ip_fw_chain *ch, uint32_t kidx,
ta_foreach_f *f, void *arg)
{
struct namedobj_instance *ni;
@@ -2540,7 +2240,7 @@
/*
* Table algorithms
- */
+ */
/*
* Finds algorithm by index, table type or supplied name.
@@ -2720,90 +2420,78 @@
}
static int
-classify_srcdst(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
+classify_srcdst(ipfw_insn *cmd0, uint32_t *puidx, uint8_t *ptype)
{
+ ipfw_insn_table *cmd;
+
/* Basic IPv4/IPv6 or u32 lookups */
- *puidx = cmd->arg1;
- /* Assume ADDR by default */
- *ptype = IPFW_TABLE_ADDR;
- int v;
-
- if (F_LEN(cmd) > F_INSN_SIZE(ipfw_insn_u32)) {
- /*
- * generic lookup. The key must be
- * in 32bit big-endian format.
- */
- v = ((ipfw_insn_u32 *)cmd)->d[1];
- switch (v) {
- case LOOKUP_DST_IP:
- case LOOKUP_SRC_IP:
- break;
- case LOOKUP_DST_PORT:
- case LOOKUP_SRC_PORT:
- case LOOKUP_UID:
- case LOOKUP_JAIL:
- case LOOKUP_DSCP:
- case LOOKUP_MARK:
- *ptype = IPFW_TABLE_NUMBER;
- break;
- case LOOKUP_DST_MAC:
- case LOOKUP_SRC_MAC:
- *ptype = IPFW_TABLE_MAC;
- break;
- }
+ cmd = insntod(cmd0, table);
+ *puidx = cmd->kidx;
+ switch(cmd0->arg1) {
+ case LOOKUP_DST_IP:
+ case LOOKUP_SRC_IP:
+ default:
+ /* IPv4 src/dst */
+ *ptype = IPFW_TABLE_ADDR;
+ break;
+ case LOOKUP_DST_PORT:
+ case LOOKUP_SRC_PORT:
+ case LOOKUP_UID:
+ case LOOKUP_JAIL:
+ case LOOKUP_DSCP:
+ case LOOKUP_MARK:
+ case LOOKUP_RULENUM:
+ *ptype = IPFW_TABLE_NUMBER;
+ break;
+ case LOOKUP_DST_MAC:
+ case LOOKUP_SRC_MAC:
+ *ptype = IPFW_TABLE_MAC;
+ break;
}
-
return (0);
}
static int
-classify_via(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
+classify_via(ipfw_insn *cmd0, uint32_t *puidx, uint8_t *ptype)
{
ipfw_insn_if *cmdif;
/* Interface table, possibly */
- cmdif = (ipfw_insn_if *)cmd;
+ cmdif = insntod(cmd0, if);
if (cmdif->name[0] != '\1')
return (1);
*ptype = IPFW_TABLE_INTERFACE;
- *puidx = cmdif->p.kidx;
-
+ *puidx = cmdif->p.kidx; /* XXXAE */
return (0);
}
static int
-classify_flow(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
+classify_flow(ipfw_insn *cmd0, uint32_t *puidx, uint8_t *ptype)
{
-
- *puidx = cmd->arg1;
+ *puidx = insntod(cmd0, table)->kidx;
*ptype = IPFW_TABLE_FLOW;
-
return (0);
}
static int
-classify_mac_lookup(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
+classify_mac_lookup(ipfw_insn *cmd0, uint32_t *puidx, uint8_t *ptype)
{
- *puidx = cmd->arg1;
+ *puidx = insntod(cmd0, table)->kidx;
*ptype = IPFW_TABLE_MAC;
return (0);
}
static void
-update_arg1(ipfw_insn *cmd, uint16_t idx)
+update_kidx(ipfw_insn *cmd0, uint32_t idx)
{
-
- cmd->arg1 = idx;
+ insntod(cmd0, table)->kidx = idx;
}
static void
-update_via(ipfw_insn *cmd, uint16_t idx)
+update_via(ipfw_insn *cmd0, uint32_t idx)
{
- ipfw_insn_if *cmdif;
-
- cmdif = (ipfw_insn_if *)cmd;
- cmdif->p.kidx = idx;
+ insntod(cmd0, if)->p.kidx = idx;
}
static int
@@ -2825,7 +2513,7 @@
/* XXX: sets-sets! */
static struct named_object *
-table_findbykidx(struct ip_fw_chain *ch, uint16_t idx)
+table_findbykidx(struct ip_fw_chain *ch, uint32_t idx)
{
struct namedobj_instance *ni;
struct table_config *tc;
@@ -2833,13 +2521,13 @@
IPFW_UH_WLOCK_ASSERT(ch);
ni = CHAIN_TO_NI(ch);
tc = (struct table_config *)ipfw_objhash_lookup_kidx(ni, idx);
- KASSERT(tc != NULL, ("Table with index %d not found", idx));
+ KASSERT(tc != NULL, ("Table with index %u not found", idx));
return (&tc->no);
}
static int
-table_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set,
+table_manage_sets(struct ip_fw_chain *ch, uint32_t set, uint8_t new_set,
enum ipfw_sets_cmd cmd)
{
@@ -2884,7 +2572,7 @@
* so it should be called first.
*/
static int
-table_manage_sets_all(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set,
+table_manage_sets_all(struct ip_fw_chain *ch, uint32_t set, uint8_t new_set,
enum ipfw_sets_cmd cmd)
{
@@ -2914,7 +2602,7 @@
.opcode = O_IP_SRC_LOOKUP,
.etlv = IPFW_TLV_TBL_NAME,
.classifier = classify_srcdst,
- .update = update_arg1,
+ .update = update_kidx,
.find_byname = table_findbyname,
.find_bykidx = table_findbykidx,
.create_object = create_table_compat,
@@ -2924,7 +2612,7 @@
.opcode = O_IP_DST_LOOKUP,
.etlv = IPFW_TLV_TBL_NAME,
.classifier = classify_srcdst,
- .update = update_arg1,
+ .update = update_kidx,
.find_byname = table_findbyname,
.find_bykidx = table_findbykidx,
.create_object = create_table_compat,
@@ -2934,7 +2622,7 @@
.opcode = O_IP_FLOW_LOOKUP,
.etlv = IPFW_TLV_TBL_NAME,
.classifier = classify_flow,
- .update = update_arg1,
+ .update = update_kidx,
.find_byname = table_findbyname,
.find_bykidx = table_findbykidx,
.create_object = create_table_compat,
@@ -2944,7 +2632,7 @@
.opcode = O_MAC_SRC_LOOKUP,
.etlv = IPFW_TLV_TBL_NAME,
.classifier = classify_mac_lookup,
- .update = update_arg1,
+ .update = update_kidx,
.find_byname = table_findbyname,
.find_bykidx = table_findbykidx,
.create_object = create_table_compat,
@@ -2954,7 +2642,7 @@
.opcode = O_MAC_DST_LOOKUP,
.etlv = IPFW_TLV_TBL_NAME,
.classifier = classify_mac_lookup,
- .update = update_arg1,
+ .update = update_kidx,
.find_byname = table_findbyname,
.find_bykidx = table_findbykidx,
.create_object = create_table_compat,
@@ -3019,7 +2707,7 @@
struct ip_fw *rule;
ipfw_insn *cmd;
int cmdlen, i, l;
- uint16_t kidx;
+ uint32_t kidx;
uint8_t subtype;
IPFW_UH_WLOCK(ch);
@@ -3277,22 +2965,18 @@
}
static struct ipfw_sopt_handler scodes[] = {
- { IP_FW_TABLE_XCREATE, 0, HDIR_SET, create_table },
- { IP_FW_TABLE_XDESTROY, 0, HDIR_SET, flush_table_v0 },
- { IP_FW_TABLE_XFLUSH, 0, HDIR_SET, flush_table_v0 },
- { IP_FW_TABLE_XMODIFY, 0, HDIR_BOTH, modify_table },
- { IP_FW_TABLE_XINFO, 0, HDIR_GET, describe_table },
- { IP_FW_TABLES_XLIST, 0, HDIR_GET, list_tables },
- { IP_FW_TABLE_XLIST, 0, HDIR_GET, dump_table_v0 },
- { IP_FW_TABLE_XLIST, 1, HDIR_GET, dump_table_v1 },
- { IP_FW_TABLE_XADD, 0, HDIR_BOTH, manage_table_ent_v0 },
- { IP_FW_TABLE_XADD, 1, HDIR_BOTH, manage_table_ent_v1 },
- { IP_FW_TABLE_XDEL, 0, HDIR_BOTH, manage_table_ent_v0 },
- { IP_FW_TABLE_XDEL, 1, HDIR_BOTH, manage_table_ent_v1 },
- { IP_FW_TABLE_XFIND, 0, HDIR_GET, find_table_entry },
- { IP_FW_TABLE_XSWAP, 0, HDIR_SET, swap_table },
- { IP_FW_TABLES_ALIST, 0, HDIR_GET, list_table_algo },
- { IP_FW_TABLE_XGETSIZE, 0, HDIR_GET, get_table_size },
+ { IP_FW_TABLE_XCREATE, IP_FW3_OPVER, HDIR_SET, create_table },
+ { IP_FW_TABLE_XDESTROY, IP_FW3_OPVER, HDIR_SET, flush_table_v0 },
+ { IP_FW_TABLE_XFLUSH, IP_FW3_OPVER, HDIR_SET, flush_table_v0 },
+ { IP_FW_TABLE_XMODIFY, IP_FW3_OPVER, HDIR_BOTH, modify_table },
+ { IP_FW_TABLE_XINFO, IP_FW3_OPVER, HDIR_GET, describe_table },
+ { IP_FW_TABLES_XLIST, IP_FW3_OPVER, HDIR_GET, list_tables },
+ { IP_FW_TABLE_XLIST, IP_FW3_OPVER, HDIR_GET, dump_table_v1 },
+ { IP_FW_TABLE_XADD, IP_FW3_OPVER, HDIR_BOTH, manage_table_ent_v1 },
+ { IP_FW_TABLE_XDEL, IP_FW3_OPVER, HDIR_BOTH, manage_table_ent_v1 },
+ { IP_FW_TABLE_XFIND, IP_FW3_OPVER, HDIR_GET, find_table_entry },
+ { IP_FW_TABLE_XSWAP, IP_FW3_OPVER, HDIR_SET, swap_table },
+ { IP_FW_TABLES_ALIST, IP_FW3_OPVER, HDIR_GET, list_table_algo },
};
static int
@@ -3348,7 +3032,8 @@
M_IPFW, M_WAITOK | M_ZERO);
tcfg = malloc(sizeof(struct tables_config), M_IPFW, M_WAITOK | M_ZERO);
- tcfg->namehash = ipfw_objhash_create(V_fw_tables_max);
+ tcfg->namehash = ipfw_objhash_create(V_fw_tables_max,
+ DEFAULT_OBJHASH_SIZE);
ch->tblcfg = tcfg;
ipfw_table_value_init(ch, first);
diff --git a/sys/netpfil/ipfw/ip_fw_table_algo.c b/sys/netpfil/ipfw/ip_fw_table_algo.c
--- a/sys/netpfil/ipfw/ip_fw_table_algo.c
+++ b/sys/netpfil/ipfw/ip_fw_table_algo.c
@@ -1,5 +1,7 @@
/*-
- * Copyright (c) 2014 Yandex LLC
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
+ * Copyright (c) 2014-2025 Yandex LLC
* Copyright (c) 2014 Alexander V. Chernikov
*
* Redistribution and use in source and binary forms, with or without
@@ -2104,7 +2106,7 @@
icfg = malloc(sizeof(struct iftable_cfg), M_IPFW, M_WAITOK | M_ZERO);
- icfg->ii = ipfw_objhash_create(DEFAULT_IFIDX_SIZE);
+ icfg->ii = ipfw_objhash_create(DEFAULT_IFIDX_SIZE, DEFAULT_OBJHASH_SIZE);
icfg->size = DEFAULT_IFIDX_SIZE;
icfg->main_ptr = malloc(sizeof(struct ifidx) * icfg->size, M_IPFW,
M_WAITOK | M_ZERO);
@@ -3195,8 +3197,7 @@
struct fhashentry *ent;
struct fhashentry4 *m4;
struct ipfw_flow_id *id;
- uint32_t hsize;
- uint16_t hash;
+ uint32_t hash, hsize;
id = (struct ipfw_flow_id *)key;
head = (struct fhashbhead *)ti->state;
@@ -4018,9 +4019,9 @@
struct mac_radix_entry {
struct radix_node rn[2];
+ struct sa_mac sa;
uint32_t value;
uint8_t masklen;
- struct sa_mac sa;
};
struct mac_radix_cfg {
diff --git a/sys/netpfil/ipfw/ip_fw_table_value.c b/sys/netpfil/ipfw/ip_fw_table_value.c
--- a/sys/netpfil/ipfw/ip_fw_table_value.c
+++ b/sys/netpfil/ipfw/ip_fw_table_value.c
@@ -1,5 +1,7 @@
/*-
- * Copyright (c) 2014 Yandex LLC
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
+ * Copyright (c) 2014-2025 Yandex LLC
* Copyright (c) 2014 Alexander V. Chernikov
*
* Redistribution and use in source and binary forms, with or without
@@ -65,7 +67,7 @@
struct sockopt_data *sd);
static struct ipfw_sopt_handler scodes[] = {
- { IP_FW_TABLE_VLIST, 0, HDIR_GET, list_table_values },
+ { IP_FW_TABLE_VLIST, IP_FW3_OPVER, HDIR_GET, list_table_values },
};
#define CHAIN_TO_VI(chain) (CHAIN_TO_TCFG(chain)->valhash)
@@ -76,6 +78,7 @@
struct table_value *pval; /* Pointer to real table value */
};
#define VALDATA_START_SIZE 64 /* Allocate 64-items array by default */
+#define VALDATA_HASH_SIZE 65536
struct vdump_args {
struct ip_fw_chain *ch;
@@ -362,10 +365,10 @@
*/
static int
alloc_table_vidx(struct ip_fw_chain *ch, struct tableop_state *ts,
- struct namedobj_instance *vi, uint16_t *pvidx, uint8_t flags)
+ struct namedobj_instance *vi, uint32_t *pvidx, uint8_t flags)
{
int error, vlimit;
- uint16_t vidx;
+ uint32_t vidx;
IPFW_UH_WLOCK_ASSERT(ch);
@@ -474,8 +477,7 @@
struct namedobj_instance *vi;
struct table_config *tc;
struct tentry_info *tei, *ptei;
- uint32_t count, vlimit;
- uint16_t vidx;
+ uint32_t count, vidx, vlimit;
struct table_val_link *ptv;
struct table_value tval, *pval;
@@ -596,42 +598,6 @@
return (0);
}
-/*
- * Compatibility function used to import data from old
- * IP_FW_TABLE_ADD / IP_FW_TABLE_XADD opcodes.
- */
-void
-ipfw_import_table_value_legacy(uint32_t value, struct table_value *v)
-{
-
- memset(v, 0, sizeof(*v));
- v->tag = value;
- v->pipe = value;
- v->divert = value;
- v->skipto = value;
- v->netgraph = value;
- v->fib = value;
- v->nat = value;
- v->nh4 = value; /* host format */
- v->dscp = value;
- v->limit = value;
- v->mark = value;
-}
-
-/*
- * Export data to legacy table dumps opcodes.
- */
-uint32_t
-ipfw_export_table_value_legacy(struct table_value *v)
-{
-
- /*
- * TODO: provide more compatibility depending on
- * vmask value.
- */
- return (v->tag);
-}
-
/*
* Imports table value from current userland format.
* Saves value in kernel format to the same place.
@@ -776,7 +742,7 @@
tcfg = ch->tblcfg;
tcfg->val_size = VALDATA_START_SIZE;
- tcfg->valhash = ipfw_objhash_create(tcfg->val_size);
+ tcfg->valhash = ipfw_objhash_create(tcfg->val_size, VALDATA_HASH_SIZE);
ipfw_objhash_set_funcs(tcfg->valhash, hash_table_value,
cmp_table_value);
diff --git a/sys/netpfil/ipfw/nat64/ip_fw_nat64.h b/sys/netpfil/ipfw/nat64/ip_fw_nat64.h
--- a/sys/netpfil/ipfw/nat64/ip_fw_nat64.h
+++ b/sys/netpfil/ipfw/nat64/ip_fw_nat64.h
@@ -55,4 +55,52 @@
int nat64clat_init(struct ip_fw_chain *ch, int first);
void nat64clat_uninit(struct ip_fw_chain *ch, int last);
+#define NAT64_DEFINE_OPCODE_REWRITER(mod, name, ops) \
+static int \
+mod ## _classify(ipfw_insn *cmd0, uint32_t *puidx, uint8_t *ptype) \
+{ \
+ ipfw_insn *icmd; \
+ icmd = cmd0 - F_LEN(cmd0); \
+ if (icmd->opcode != O_EXTERNAL_ACTION || \
+ insntod(icmd, kidx)->kidx != V_ ## mod ## _eid) \
+ return (1); \
+ *puidx = insntod(cmd0, kidx)->kidx; \
+ *ptype = 0; \
+ return (0); \
+} \
+static void \
+mod ## _update_kidx(ipfw_insn *cmd0, uint32_t idx) \
+{ \
+ insntod(cmd0, kidx)->kidx = idx; \
+} \
+static int \
+mod ## _findbyname(struct ip_fw_chain *ch, struct tid_info *ti, \
+ struct named_object **pno) \
+{ \
+ return (ipfw_objhash_find_type(CHAIN_TO_SRV(ch), ti, \
+ IPFW_TLV_## name ## _NAME, pno)); \
+} \
+static struct named_object * \
+mod ## _findbykidx(struct ip_fw_chain *ch, uint32_t idx) \
+{ \
+ struct namedobj_instance *ni; \
+ struct named_object *no; \
+ IPFW_UH_WLOCK_ASSERT(ch); \
+ ni = CHAIN_TO_SRV(ch); \
+ no = ipfw_objhash_lookup_kidx(ni, idx); \
+ KASSERT(no != NULL, ("NAT with index %u not found", idx)); \
+ return (no); \
+} \
+static struct opcode_obj_rewrite ops[] = { \
+ { \
+ .opcode = O_EXTERNAL_INSTANCE, \
+ .etlv = IPFW_TLV_EACTION /* just show it isn't table */,\
+ .classifier = mod ## _classify, \
+ .update = mod ## _update_kidx, \
+ .find_byname = mod ## _findbyname, \
+ .find_bykidx = mod ## _findbykidx, \
+ .manage_sets = mod ## _manage_sets, \
+ }, \
+}
+
#endif /* _IP_FW_NAT64_H_ */
diff --git a/sys/netpfil/ipfw/nat64/nat64clat.h b/sys/netpfil/ipfw/nat64/nat64clat.h
--- a/sys/netpfil/ipfw/nat64/nat64clat.h
+++ b/sys/netpfil/ipfw/nat64/nat64clat.h
@@ -42,7 +42,7 @@
char name[64];
};
-VNET_DECLARE(uint16_t, nat64clat_eid);
+VNET_DECLARE(uint32_t, nat64clat_eid);
#define V_nat64clat_eid VNET(nat64clat_eid)
#define IPFW_TLV_NAT64CLAT_NAME IPFW_TLV_EACTION_NAME(V_nat64clat_eid)
diff --git a/sys/netpfil/ipfw/nat64/nat64clat.c b/sys/netpfil/ipfw/nat64/nat64clat.c
--- a/sys/netpfil/ipfw/nat64/nat64clat.c
+++ b/sys/netpfil/ipfw/nat64/nat64clat.c
@@ -59,7 +59,7 @@
#include "nat64clat.h"
#define NAT64_LOOKUP(chain, cmd) \
- (struct nat64clat_cfg *)SRV_OBJECT((chain), (cmd)->arg1)
+ (struct nat64clat_cfg *)SRV_OBJECT((chain), insntod(cmd, kidx)->kidx)
static void
nat64clat_log(struct pfloghdr *plog, struct mbuf *m, sa_family_t family,
@@ -68,7 +68,7 @@
static uint32_t pktid = 0;
memset(plog, 0, sizeof(*plog));
- plog->length = PFLOG_HDRLEN;
+ plog->length = PFLOG_REAL_HDRLEN;
plog->af = family;
plog->action = PF_NAT;
plog->dir = PF_IN;
@@ -210,9 +210,9 @@
IPFW_RLOCK_ASSERT(chain);
*done = 0; /* try next rule if not matched */
- icmd = cmd + 1;
+ icmd = cmd + F_LEN(cmd);
if (cmd->opcode != O_EXTERNAL_ACTION ||
- cmd->arg1 != V_nat64clat_eid ||
+ insntod(cmd, kidx)->kidx != V_nat64clat_eid ||
icmd->opcode != O_EXTERNAL_INSTANCE ||
(cfg = NAT64_LOOKUP(chain, icmd)) == NULL)
return (0);
diff --git a/sys/netpfil/ipfw/nat64/nat64clat_control.c b/sys/netpfil/ipfw/nat64/nat64clat_control.c
--- a/sys/netpfil/ipfw/nat64/nat64clat_control.c
+++ b/sys/netpfil/ipfw/nat64/nat64clat_control.c
@@ -59,7 +59,7 @@
#include "nat64clat.h"
-VNET_DEFINE(uint16_t, nat64clat_eid) = 0;
+VNET_DEFINE(uint32_t, nat64clat_eid) = 0;
static struct nat64clat_cfg *nat64clat_alloc_config(const char *name,
uint8_t set);
@@ -484,81 +484,23 @@
}
static struct ipfw_sopt_handler scodes[] = {
- { IP_FW_NAT64CLAT_CREATE, 0, HDIR_SET, nat64clat_create },
- { IP_FW_NAT64CLAT_DESTROY,0, HDIR_SET, nat64clat_destroy },
- { IP_FW_NAT64CLAT_CONFIG, 0, HDIR_BOTH, nat64clat_config },
- { IP_FW_NAT64CLAT_LIST, 0, HDIR_GET, nat64clat_list },
- { IP_FW_NAT64CLAT_STATS, 0, HDIR_GET, nat64clat_stats },
- { IP_FW_NAT64CLAT_RESET_STATS,0, HDIR_SET, nat64clat_reset_stats },
+ { IP_FW_NAT64CLAT_CREATE, IP_FW3_OPVER, HDIR_SET, nat64clat_create },
+ { IP_FW_NAT64CLAT_DESTROY, IP_FW3_OPVER, HDIR_SET, nat64clat_destroy },
+ { IP_FW_NAT64CLAT_CONFIG, IP_FW3_OPVER, HDIR_BOTH, nat64clat_config },
+ { IP_FW_NAT64CLAT_LIST, IP_FW3_OPVER, HDIR_GET, nat64clat_list },
+ { IP_FW_NAT64CLAT_STATS, IP_FW3_OPVER, HDIR_GET, nat64clat_stats },
+ { IP_FW_NAT64CLAT_RESET_STATS, IP_FW3_OPVER, HDIR_SET, nat64clat_reset_stats },
};
static int
-nat64clat_classify(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
-{
- ipfw_insn *icmd;
-
- icmd = cmd - 1;
- if (icmd->opcode != O_EXTERNAL_ACTION ||
- icmd->arg1 != V_nat64clat_eid)
- return (1);
-
- *puidx = cmd->arg1;
- *ptype = 0;
- return (0);
-}
-
-static void
-nat64clat_update_arg1(ipfw_insn *cmd, uint16_t idx)
-{
-
- cmd->arg1 = idx;
-}
-
-static int
-nat64clat_findbyname(struct ip_fw_chain *ch, struct tid_info *ti,
- struct named_object **pno)
-{
- int err;
-
- err = ipfw_objhash_find_type(CHAIN_TO_SRV(ch), ti,
- IPFW_TLV_NAT64CLAT_NAME, pno);
- return (err);
-}
-
-static struct named_object *
-nat64clat_findbykidx(struct ip_fw_chain *ch, uint16_t idx)
-{
- struct namedobj_instance *ni;
- struct named_object *no;
-
- IPFW_UH_WLOCK_ASSERT(ch);
- ni = CHAIN_TO_SRV(ch);
- no = ipfw_objhash_lookup_kidx(ni, idx);
- KASSERT(no != NULL, ("NAT with index %d not found", idx));
-
- return (no);
-}
-
-static int
-nat64clat_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set,
+nat64clat_manage_sets(struct ip_fw_chain *ch, uint32_t set, uint8_t new_set,
enum ipfw_sets_cmd cmd)
{
- return (ipfw_obj_manage_sets(CHAIN_TO_SRV(ch), IPFW_TLV_NAT64CLAT_NAME,
- set, new_set, cmd));
+ return (ipfw_obj_manage_sets(CHAIN_TO_SRV(ch),
+ IPFW_TLV_NAT64CLAT_NAME, set, new_set, cmd));
}
-
-static struct opcode_obj_rewrite opcodes[] = {
- {
- .opcode = O_EXTERNAL_INSTANCE,
- .etlv = IPFW_TLV_EACTION /* just show it isn't table */,
- .classifier = nat64clat_classify,
- .update = nat64clat_update_arg1,
- .find_byname = nat64clat_findbyname,
- .find_bykidx = nat64clat_findbykidx,
- .manage_sets = nat64clat_manage_sets,
- },
-};
+NAT64_DEFINE_OPCODE_REWRITER(nat64clat, NAT64CLAT, opcodes);
static int
destroy_config_cb(struct namedobj_instance *ni, struct named_object *no,
diff --git a/sys/netpfil/ipfw/nat64/nat64lsn.h b/sys/netpfil/ipfw/nat64/nat64lsn.h
--- a/sys/netpfil/ipfw/nat64/nat64lsn.h
+++ b/sys/netpfil/ipfw/nat64/nat64lsn.h
@@ -1,9 +1,9 @@
/*-
* SPDX-License-Identifier: BSD-2-Clause
*
- * Copyright (c) 2015-2019 Yandex LLC
+ * Copyright (c) 2015-2020 Yandex LLC
* Copyright (c) 2015 Alexander V. Chernikov <melifaro@FreeBSD.org>
- * Copyright (c) 2015-2019 Andrey V. Elsukov <ae@FreeBSD.org>
+ * Copyright (c) 2015-2020 Andrey V. Elsukov <ae@FreeBSD.org>
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -64,13 +64,12 @@
#define ISSET64(mask, bit) ((mask) & ((uint64_t)1 << (bit)))
#define ISSET32(mask, bit) ((mask) & ((uint32_t)1 << (bit)))
struct nat64lsn_pg {
- CK_SLIST_ENTRY(nat64lsn_pg) entries;
-
uint16_t base_port;
uint16_t timestamp;
uint8_t proto;
uint8_t chunks_count;
- uint8_t spare[2];
+ uint16_t flags;
+#define NAT64LSN_DEADPG 1
union {
uint64_t freemask64;
@@ -83,6 +82,11 @@
struct nat64lsn_states_chunk *states;
struct nat64lsn_states_chunk **states_chunk;
};
+ /*
+ * An alias object holds chain of all allocated PGs.
+ * The chain is used mostly by expiration code.
+ */
+ CK_SLIST_ENTRY(nat64lsn_pg) entries;
};
#define CHUNK_BY_FADDR(p, a) ((a) & ((p)->chunks_count - 1))
@@ -123,28 +127,39 @@
struct mtx lock;
in_addr_t addr; /* host byte order */
uint32_t hosts_count;
- uint32_t portgroups_count;
- uint32_t tcp_chunkmask;
- uint32_t udp_chunkmask;
- uint32_t icmp_chunkmask;
+ uint16_t timestamp;
+ uint16_t tcp_pgcount;
+ uint16_t udp_pgcount;
+ uint16_t icmp_pgcount;
+ /*
+ * We keep PGs in chunks by 32 PGs in each.
+ * Each chunk allocated by demand, and then corresponding bit
+ * is set in chunkmask.
+ *
+ * Also we keep last used PG's index for each protocol.
+ * pgidx / 32 = index of pgchunk;
+ * pgidx % 32 = index of pgptr in pgchunk.
+ */
+ uint32_t tcp_chunkmask;
uint32_t tcp_pgidx;
+
+ uint32_t udp_chunkmask;
uint32_t udp_pgidx;
- uint32_t icmp_pgidx;
- uint16_t timestamp;
- uint16_t spare;
+ uint32_t icmp_chunkmask;
+ uint32_t icmp_pgidx;
+ /*
+ * Each pgchunk keeps 32 pointers to PGs. If pgptr pointer is
+ * valid, we have corresponding bit set in the pgmask.
+ */
uint32_t tcp_pgmask[32];
uint32_t udp_pgmask[32];
uint32_t icmp_pgmask[32];
+
struct nat64lsn_pgchunk *tcp[32];
struct nat64lsn_pgchunk *udp[32];
struct nat64lsn_pgchunk *icmp[32];
-
- /* pointer to PG that can be used for faster state allocation */
- struct nat64lsn_pg *tcp_pg;
- struct nat64lsn_pg *udp_pg;
- struct nat64lsn_pg *icmp_pg;
};
#define ALIAS_LOCK_INIT(p) \
mtx_init(&(p)->lock, "alias_lock", NULL, MTX_DEF)
@@ -177,7 +192,7 @@
#define HOST_LOCK(p) mtx_lock(&(p)->lock)
#define HOST_UNLOCK(p) mtx_unlock(&(p)->lock)
-VNET_DECLARE(uint16_t, nat64lsn_eid);
+VNET_DECLARE(uint32_t, nat64lsn_eid);
#define V_nat64lsn_eid VNET(nat64lsn_eid)
#define IPFW_TLV_NAT64LSN_NAME IPFW_TLV_EACTION_NAME(V_nat64lsn_eid)
@@ -189,8 +204,6 @@
STAILQ_HEAD(nat64lsn_job_head, nat64lsn_job_item);
struct nat64lsn_cfg {
- struct named_object no;
-
struct nat64lsn_hosts_slist *hosts_hash;
struct nat64lsn_alias *aliases; /* array of aliases */
@@ -216,7 +229,8 @@
uint16_t st_icmp_ttl; /* ICMP expire */
struct nat64_config base;
-#define NAT64LSN_FLAGSMASK (NAT64_LOG | NAT64_ALLOW_PRIVATE)
+#define NAT64LSN_FLAGSMASK (NAT64_LOG | NAT64_ALLOW_PRIVATE | \
+ NAT64LSN_ALLOW_SWAPCONF)
#define NAT64LSN_ANYPREFIX 0x00000100
struct mtx periodic_lock;
@@ -228,6 +242,12 @@
char name[64]; /* Nat instance name */
};
+struct nat64lsn_instance {
+ struct named_object no;
+ struct nat64lsn_cfg *cfg;
+ char name[64]; /* Nat instance name */
+};
+
/* CFG_LOCK protects cfg->hosts_hash from modification */
#define CFG_LOCK_INIT(p) \
mtx_init(&(p)->lock, "cfg_lock", NULL, MTX_DEF)
@@ -241,9 +261,11 @@
#define CALLOUT_LOCK(p) mtx_lock(&(p)->periodic_lock)
#define CALLOUT_UNLOCK(p) mtx_unlock(&(p)->periodic_lock)
-struct nat64lsn_cfg *nat64lsn_init_instance(struct ip_fw_chain *ch,
+MALLOC_DECLARE(M_NAT64LSN);
+
+struct nat64lsn_cfg *nat64lsn_init_config(struct ip_fw_chain *ch,
in_addr_t prefix, int plen);
-void nat64lsn_destroy_instance(struct nat64lsn_cfg *cfg);
+void nat64lsn_destroy_config(struct nat64lsn_cfg *cfg);
void nat64lsn_start_instance(struct nat64lsn_cfg *cfg);
void nat64lsn_init_internal(void);
void nat64lsn_uninit_internal(void);
diff --git a/sys/netpfil/ipfw/nat64/nat64lsn.c b/sys/netpfil/ipfw/nat64/nat64lsn.c
--- a/sys/netpfil/ipfw/nat64/nat64lsn.c
+++ b/sys/netpfil/ipfw/nat64/nat64lsn.c
@@ -1,9 +1,9 @@
/*-
* SPDX-License-Identifier: BSD-2-Clause
*
- * Copyright (c) 2015-2019 Yandex LLC
+ * Copyright (c) 2015-2020 Yandex LLC
* Copyright (c) 2015 Alexander V. Chernikov <melifaro@FreeBSD.org>
- * Copyright (c) 2016-2019 Andrey V. Elsukov <ae@FreeBSD.org>
+ * Copyright (c) 2016-2020 Andrey V. Elsukov <ae@FreeBSD.org>
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -84,7 +84,7 @@
static void nat64lsn_periodic(void *data);
#define PERIODIC_DELAY 4
#define NAT64_LOOKUP(chain, cmd) \
- (struct nat64lsn_cfg *)SRV_OBJECT((chain), (cmd)->arg1)
+ (struct nat64lsn_instance *)SRV_OBJECT((chain), insntod(cmd, kidx)->kidx)
/*
* Delayed job queue, used to create new hosts
* and new portgroups
@@ -178,7 +178,7 @@
{
memset(plog, 0, sizeof(*plog));
- plog->length = PFLOG_HDRLEN;
+ plog->length = PFLOG_REAL_HDRLEN;
plog->af = family;
plog->action = PF_NAT;
plog->dir = PF_IN;
@@ -212,6 +212,21 @@
return (CK_SLIST_FIRST(&host->aliases));
}
+static struct nat64lsn_alias*
+nat64lsn_get_alias(struct nat64lsn_cfg *cfg,
+ const struct ipfw_flow_id *f_id __unused)
+{
+ static uint32_t idx = 0;
+
+ /*
+ * We can choose alias by number of allocated PGs,
+ * not used yet by other hosts, or some static configured
+ * by user.
+ * XXX: for now we choose it using round robin.
+ */
+ return (&ALIAS_BYHASH(cfg, idx++));
+}
+
#define STATE_HVAL(c, d) HVAL((d), 2, (c)->hash_seed)
#define STATE_HASH(h, v) \
((h)->states_hash[(v) & ((h)->states_hashsize - 1)])
@@ -255,53 +270,47 @@
((uint64_t)ck_pr_load_32(FREEMASK_CHUNK((pg), (n)) + 1) << 32)
#endif /* !__LP64__ */
-#define NAT64LSN_TRY_PGCNT 32
+
+#define NAT64LSN_TRY_PGCNT 36
static struct nat64lsn_pg*
nat64lsn_get_pg(uint32_t *chunkmask, uint32_t *pgmask,
- struct nat64lsn_pgchunk **chunks, struct nat64lsn_pg **pgptr,
- uint32_t *pgidx, in_addr_t faddr)
+ struct nat64lsn_pgchunk **chunks, uint32_t *pgidx, in_addr_t faddr)
{
- struct nat64lsn_pg *pg, *oldpg;
+ struct nat64lsn_pg *pg;
uint32_t idx, oldidx;
int cnt;
- cnt = 0;
- /* First try last used PG */
- oldpg = pg = ck_pr_load_ptr(pgptr);
+ /* First try last used PG. */
idx = oldidx = ck_pr_load_32(pgidx);
- /* If pgidx is out of range, reset it to the first pgchunk */
- if (!ISSET32(*chunkmask, idx / 32))
- idx = 0;
+ MPASS(idx < 1024);
+ cnt = 0;
do {
ck_pr_fence_load();
- if (pg != NULL && FREEMASK_BITCOUNT(pg, faddr) > 0) {
- /*
- * If last used PG has not free states,
- * try to update pointer.
- * NOTE: it can be already updated by jobs handler,
- * thus we use CAS operation.
- */
+ if (idx > 1023 || !ISSET32(*chunkmask, idx / 32)) {
+ /* If it is first try, reset idx to first PG */
+ idx = 0;
+ /* Stop if idx is out of range */
if (cnt > 0)
- ck_pr_cas_ptr(pgptr, oldpg, pg);
- return (pg);
+ break;
}
- /* Stop if idx is out of range */
- if (!ISSET32(*chunkmask, idx / 32))
- break;
-
- if (ISSET32(pgmask[idx / 32], idx % 32))
+ if (ISSET32(pgmask[idx / 32], idx % 32)) {
pg = ck_pr_load_ptr(
&chunks[idx / 32]->pgptr[idx % 32]);
- else
- pg = NULL;
-
+ ck_pr_fence_load();
+ /*
+ * Make sure that pg did not become DEAD.
+ */
+ if ((pg->flags & NAT64LSN_DEADPG) == 0 &&
+ FREEMASK_BITCOUNT(pg, faddr) > 0) {
+ if (cnt > 0)
+ ck_pr_cas_32(pgidx, oldidx, idx);
+ return (pg);
+ }
+ }
idx++;
} while (++cnt < NAT64LSN_TRY_PGCNT);
-
- /* If pgidx is out of range, reset it to the first pgchunk */
- if (!ISSET32(*chunkmask, idx / 32))
- idx = 0;
- ck_pr_cas_32(pgidx, oldidx, idx);
+ if (oldidx != idx)
+ ck_pr_cas_32(pgidx, oldidx, idx);
return (NULL);
}
@@ -330,27 +339,24 @@
switch (proto) {
case IPPROTO_TCP:
- pg = nat64lsn_get_pg(
- &link->alias->tcp_chunkmask, link->alias->tcp_pgmask,
- link->alias->tcp, &link->alias->tcp_pg,
+ pg = nat64lsn_get_pg(&link->alias->tcp_chunkmask,
+ link->alias->tcp_pgmask, link->alias->tcp,
&link->alias->tcp_pgidx, faddr);
break;
case IPPROTO_UDP:
- pg = nat64lsn_get_pg(
- &link->alias->udp_chunkmask, link->alias->udp_pgmask,
- link->alias->udp, &link->alias->udp_pg,
+ pg = nat64lsn_get_pg(&link->alias->udp_chunkmask,
+ link->alias->udp_pgmask, link->alias->udp,
&link->alias->udp_pgidx, faddr);
break;
case IPPROTO_ICMP:
- pg = nat64lsn_get_pg(
- &link->alias->icmp_chunkmask, link->alias->icmp_pgmask,
- link->alias->icmp, &link->alias->icmp_pg,
+ pg = nat64lsn_get_pg(&link->alias->icmp_chunkmask,
+ link->alias->icmp_pgmask, link->alias->icmp,
&link->alias->icmp_pgidx, faddr);
break;
default:
panic("%s: wrong proto %d", __func__, proto);
}
- if (pg == NULL)
+ if (pg == NULL || (pg->flags & NAT64LSN_DEADPG) != 0)
return (NULL);
/* Check that PG has some free states */
@@ -385,14 +391,10 @@
/* Insert new state into host's hash table */
HOST_LOCK(host);
+ SET_AGE(host->timestamp);
CK_SLIST_INSERT_HEAD(&STATE_HASH(host, hval),
state, entries);
host->states_count++;
- /*
- * XXX: In case if host is going to be expired,
- * reset NAT64LSN_DEADHOST flag.
- */
- host->flags &= ~NAT64LSN_DEADHOST;
HOST_UNLOCK(host);
NAT64STAT_INC(&cfg->base.stats, screated);
/* Mark the state as ready for translate4 */
@@ -563,7 +565,7 @@
len = ip->ip_hl << 2;
switch (ip->ip_p) {
case IPPROTO_ICMP:
- len += ICMP_MINLEN; /* Enough to get icmp_id */
+ len += ICMP_MINLEN;
break;
case IPPROTO_TCP:
len += sizeof(struct tcphdr);
@@ -740,6 +742,32 @@
return (0);
}
+#define PGCOUNT_ADD(alias, proto, value) \
+ switch (proto) { \
+ case IPPROTO_TCP: (alias)->tcp_pgcount += (value); break; \
+ case IPPROTO_UDP: (alias)->udp_pgcount += (value); break; \
+ case IPPROTO_ICMP: (alias)->icmp_pgcount += (value); break; \
+ }
+#define PGCOUNT_INC(alias, proto) PGCOUNT_ADD(alias, proto, 1)
+#define PGCOUNT_DEC(alias, proto) PGCOUNT_ADD(alias, proto, -1)
+
+static inline void
+nat64lsn_state_cleanup(struct nat64lsn_state *state)
+{
+
+ /*
+ * Reset READY flag and wait until it become
+ * safe for translate4.
+ */
+ ck_pr_btr_32(&state->flags, NAT64_BIT_READY_IPV4);
+ /*
+ * And set STALE flag for deferred deletion in the
+ * next pass of nat64lsn_maintain_pg().
+ */
+ ck_pr_bts_32(&state->flags, NAT64_BIT_STALE);
+ ck_pr_fence_store();
+}
+
static int
nat64lsn_maintain_pg(struct nat64lsn_cfg *cfg, struct nat64lsn_pg *pg)
{
@@ -781,19 +809,12 @@
HOST_LOCK(host);
CK_SLIST_REMOVE(&STATE_HASH(host, state->hval),
state, nat64lsn_state, entries);
- host->states_count--;
- HOST_UNLOCK(host);
-
- /* Reset READY flag */
- ck_pr_btr_32(&state->flags, NAT64_BIT_READY_IPV4);
- /* And set STALE flag */
- ck_pr_bts_32(&state->flags, NAT64_BIT_STALE);
- ck_pr_fence_store();
/*
- * Now translate6 will not use this state, wait
- * until it become safe for translate4, then mark
- * state as free.
+ * Now translate6 will not use this state.
*/
+ host->states_count--;
+ HOST_UNLOCK(host);
+ nat64lsn_state_cleanup(state);
}
}
@@ -814,7 +835,7 @@
struct nat64lsn_pg_slist *portgroups)
{
struct nat64lsn_alias *alias;
- struct nat64lsn_pg *pg, *tpg, *firstpg, **pgptr;
+ struct nat64lsn_pg *pg, *tpg;
uint32_t *pgmask, *pgidx;
int i, idx;
@@ -827,45 +848,47 @@
if (pg->base_port == NAT64_MIN_PORT)
continue;
/*
- * PG is expired, unlink it and schedule for
- * deferred destroying.
+ * PG expires in two passes:
+ * 1. Reset bit in pgmask, mark it as DEAD.
+ * 2. Unlink it and schedule for deferred destroying.
*/
idx = (pg->base_port - NAT64_MIN_PORT) / 64;
switch (pg->proto) {
case IPPROTO_TCP:
pgmask = alias->tcp_pgmask;
- pgptr = &alias->tcp_pg;
pgidx = &alias->tcp_pgidx;
- firstpg = alias->tcp[0]->pgptr[0];
break;
case IPPROTO_UDP:
pgmask = alias->udp_pgmask;
- pgptr = &alias->udp_pg;
pgidx = &alias->udp_pgidx;
- firstpg = alias->udp[0]->pgptr[0];
break;
case IPPROTO_ICMP:
pgmask = alias->icmp_pgmask;
- pgptr = &alias->icmp_pg;
pgidx = &alias->icmp_pgidx;
- firstpg = alias->icmp[0]->pgptr[0];
break;
}
+ if (pg->flags & NAT64LSN_DEADPG) {
+ /* Unlink PG from alias's chain */
+ ALIAS_LOCK(alias);
+ CK_SLIST_REMOVE(&alias->portgroups, pg,
+ nat64lsn_pg, entries);
+ PGCOUNT_DEC(alias, pg->proto);
+ ALIAS_UNLOCK(alias);
+ /*
+ * Link it to job's chain for deferred
+ * destroying.
+ */
+ NAT64STAT_INC(&cfg->base.stats, spgdeleted);
+ CK_SLIST_INSERT_HEAD(portgroups, pg, entries);
+ continue;
+ }
+
/* Reset the corresponding bit in pgmask array. */
ck_pr_btr_32(&pgmask[idx / 32], idx % 32);
+ pg->flags |= NAT64LSN_DEADPG;
ck_pr_fence_store();
/* If last used PG points to this PG, reset it. */
- ck_pr_cas_ptr(pgptr, pg, firstpg);
ck_pr_cas_32(pgidx, idx, 0);
- /* Unlink PG from alias's chain */
- ALIAS_LOCK(alias);
- CK_SLIST_REMOVE(&alias->portgroups, pg,
- nat64lsn_pg, entries);
- alias->portgroups_count--;
- ALIAS_UNLOCK(alias);
- /* And link to job's chain for deferred destroying */
- NAT64STAT_INC(&cfg->base.stats, spgdeleted);
- CK_SLIST_INSERT_HEAD(portgroups, pg, entries);
}
}
}
@@ -882,7 +905,9 @@
entries, tmp) {
/* Is host was marked in previous call? */
if (host->flags & NAT64LSN_DEADHOST) {
- if (host->states_count > 0) {
+ if (host->states_count > 0 ||
+ GET_AGE(host->timestamp) <
+ cfg->host_delete_delay) {
host->flags &= ~NAT64LSN_DEADHOST;
continue;
}
@@ -898,9 +923,8 @@
CK_SLIST_INSERT_HEAD(hosts, host, entries);
continue;
}
- if (GET_AGE(host->timestamp) < cfg->host_delete_delay)
- continue;
- if (host->states_count > 0)
+ if (host->states_count > 0 ||
+ GET_AGE(host->timestamp) < cfg->host_delete_delay)
continue;
/* Mark host as going to be expired in next pass */
host->flags |= NAT64LSN_DEADHOST;
@@ -966,7 +990,7 @@
#endif
/*
- * This procedure is used to perform various maintenance
+ * This procedure is used to perform various maintance
* on dynamic hash list. Currently it is called every 4 seconds.
*/
static void
@@ -1044,14 +1068,11 @@
host->hval = ji->src6_hval;
host->flags = 0;
host->states_count = 0;
- host->states_hashsize = NAT64LSN_HSIZE;
CK_SLIST_INIT(&host->aliases);
for (i = 0; i < host->states_hashsize; i++)
CK_SLIST_INIT(&host->states_hash[i]);
- /* Determine alias from flow hash. */
- hval = ALIASLINK_HVAL(cfg, &ji->f_id);
- link->alias = &ALIAS_BYHASH(cfg, hval);
+ link->alias = nat64lsn_get_alias(cfg, &ji->f_id);
CK_SLIST_INSERT_HEAD(&host->aliases, link, host_entries);
ALIAS_LOCK(link->alias);
@@ -1103,9 +1124,8 @@
static int
nat64lsn_alloc_proto_pg(struct nat64lsn_cfg *cfg,
- struct nat64lsn_alias *alias, uint32_t *chunkmask,
- uint32_t *pgmask, struct nat64lsn_pgchunk **chunks,
- struct nat64lsn_pg **pgptr, uint8_t proto)
+ struct nat64lsn_alias *alias, uint32_t *chunkmask, uint32_t *pgmask,
+ struct nat64lsn_pgchunk **chunks, uint32_t *pgidx, uint8_t proto)
{
struct nat64lsn_pg *pg;
int i, pg_idx, chunk_idx;
@@ -1163,17 +1183,20 @@
/* Initialize PG and hook it to pgchunk */
SET_AGE(pg->timestamp);
+ pg->flags = 0;
pg->proto = proto;
pg->base_port = NAT64_MIN_PORT + 64 * pg_idx;
ck_pr_store_ptr(&chunks[chunk_idx]->pgptr[pg_idx % 32], pg);
ck_pr_fence_store();
- ck_pr_bts_32(&pgmask[pg_idx / 32], pg_idx % 32);
- ck_pr_store_ptr(pgptr, pg);
+
+ /* Set bit in pgmask and set index of last used PG */
+ ck_pr_bts_32(&pgmask[chunk_idx], pg_idx % 32);
+ ck_pr_store_32(pgidx, pg_idx);
ALIAS_LOCK(alias);
CK_SLIST_INSERT_HEAD(&alias->portgroups, pg, entries);
SET_AGE(alias->timestamp);
- alias->portgroups_count++;
+ PGCOUNT_INC(alias, proto);
ALIAS_UNLOCK(alias);
NAT64STAT_INC(&cfg->base.stats, spgcreated);
return (PG_ERROR(0));
@@ -1210,17 +1233,17 @@
case IPPROTO_TCP:
ret = nat64lsn_alloc_proto_pg(cfg, alias,
&alias->tcp_chunkmask, alias->tcp_pgmask,
- alias->tcp, &alias->tcp_pg, ji->proto);
+ alias->tcp, &alias->tcp_pgidx, ji->proto);
break;
case IPPROTO_UDP:
ret = nat64lsn_alloc_proto_pg(cfg, alias,
&alias->udp_chunkmask, alias->udp_pgmask,
- alias->udp, &alias->udp_pg, ji->proto);
+ alias->udp, &alias->udp_pgidx, ji->proto);
break;
case IPPROTO_ICMP:
ret = nat64lsn_alloc_proto_pg(cfg, alias,
&alias->icmp_chunkmask, alias->icmp_pgmask,
- alias->icmp, &alias->icmp_pg, ji->proto);
+ alias->icmp, &alias->icmp_pgidx, ji->proto);
break;
default:
panic("%s: wrong proto %d", __func__, ji->proto);
@@ -1362,14 +1385,115 @@
JQUEUE_UNLOCK();
}
+/*
+ * This function is used to clean up the result of less likely possible
+ * race condition, when host object was deleted, but some translation
+ * state was created before it is destroyed.
+ *
+ * Since the state expiration removes state from host's hash table,
+ * we need to be sure, that there will not any states, that are linked
+ * with this host entry.
+ */
+static void
+nat64lsn_host_cleanup(struct nat64lsn_host *host)
+{
+ struct nat64lsn_state *state, *ts;
+ int i;
+
+ printf("NAT64LSN: %s: race condition has been detected for host %p\n",
+ __func__, host);
+ for (i = 0; i < host->states_hashsize; i++) {
+ CK_SLIST_FOREACH_SAFE(state, &host->states_hash[i],
+ entries, ts) {
+ /*
+ * We can remove the state without lock,
+ * because this host entry is unlinked and will
+ * be destroyed.
+ */
+ CK_SLIST_REMOVE(&host->states_hash[i], state,
+ nat64lsn_state, entries);
+ host->states_count--;
+ nat64lsn_state_cleanup(state);
+ }
+ }
+ MPASS(host->states_count == 0);
+}
+
+/*
+ * This function is used to clean up the result of less likely possible
+ * race condition, when portgroup was deleted, but some translation state
+ * was created before it is destroyed.
+ *
+ * Since states entries are accessible via host's hash table, we need
+ * to be sure, that there will not any states from this PG, that are
+ * linked with any host entries.
+ */
+static void
+nat64lsn_pg_cleanup(struct nat64lsn_pg *pg)
+{
+ struct nat64lsn_state *state;
+ uint64_t usedmask;
+ int c, i;
+
+ printf("NAT64LSN: %s: race condition has been detected for pg %p\n",
+ __func__, pg);
+ for (c = 0; c < pg->chunks_count; c++) {
+ /*
+ * Use inverted freemask to find what state was created.
+ */
+ usedmask = ~(*FREEMASK_CHUNK(pg, c));
+ if (usedmask == 0)
+ continue;
+ for (i = 0; i < 64; i++) {
+ if (!ISSET64(usedmask, i))
+ continue;
+ state = &STATES_CHUNK(pg, c)->state[i];
+ /*
+ * If we have STALE bit, this means that state
+ * is already unlinked from host's hash table.
+ * Thus we can just reset the bit in mask and
+ * schedule destroying in the next epoch call.
+ */
+ if (ISSET32(state->flags, NAT64_BIT_STALE)) {
+ FREEMASK_BTS(pg, c, i);
+ continue;
+ }
+ /*
+ * There is small window, when we have bit
+ * grabbed from freemask, but state is not yet
+ * linked into host's hash table.
+ * Check for READY flag, it is set just after
+ * linking. If it is not set, defer cleanup
+ * for next call.
+ */
+ if (ISSET32(state->flags, NAT64_BIT_READY_IPV4)) {
+ struct nat64lsn_host *host;
+
+ host = state->host;
+ HOST_LOCK(host);
+ CK_SLIST_REMOVE(&STATE_HASH(host,
+ state->hval), state, nat64lsn_state,
+ entries);
+ host->states_count--;
+ HOST_UNLOCK(host);
+ nat64lsn_state_cleanup(state);
+ }
+ }
+ }
+}
+
static void
nat64lsn_job_destroy(epoch_context_t ctx)
{
+ struct nat64lsn_hosts_slist hosts;
+ struct nat64lsn_pg_slist portgroups;
struct nat64lsn_job_item *ji;
struct nat64lsn_host *host;
struct nat64lsn_pg *pg;
int i;
+ CK_SLIST_INIT(&hosts);
+ CK_SLIST_INIT(&portgroups);
ji = __containerof(ctx, struct nat64lsn_job_item, epoch_ctx);
MPASS(ji->jtype == JTYPE_DESTROY);
while (!CK_SLIST_EMPTY(&ji->hosts)) {
@@ -1377,11 +1501,23 @@
CK_SLIST_REMOVE_HEAD(&ji->hosts, entries);
if (host->states_count > 0) {
/*
- * XXX: The state has been created
- * during host deletion.
+ * The state has been created during host deletion.
*/
printf("NAT64LSN: %s: destroying host with %d "
"states\n", __func__, host->states_count);
+ /*
+ * We need to cleanup these states to avoid
+ * possible access to already deleted host in
+ * the state expiration code.
+ */
+ nat64lsn_host_cleanup(host);
+ CK_SLIST_INSERT_HEAD(&hosts, host, entries);
+ /*
+ * Keep host entry for next deferred destroying.
+ * In the next epoch its states will be not
+ * accessible.
+ */
+ continue;
}
nat64lsn_destroy_host(host);
}
@@ -1391,18 +1527,33 @@
for (i = 0; i < pg->chunks_count; i++) {
if (FREEMASK_BITCOUNT(pg, i) != 64) {
/*
- * XXX: The state has been created during
+ * A state has been created during
* PG deletion.
*/
printf("NAT64LSN: %s: destroying PG %p "
"with non-empty chunk %d\n", __func__,
pg, i);
+ nat64lsn_pg_cleanup(pg);
+ CK_SLIST_INSERT_HEAD(&portgroups,
+ pg, entries);
+ i = -1;
+ break;
}
}
- nat64lsn_destroy_pg(pg);
+ if (i != -1)
+ nat64lsn_destroy_pg(pg);
}
- uma_zfree(nat64lsn_pgchunk_zone, ji->pgchunk);
- uma_zfree(nat64lsn_job_zone, ji);
+ if (CK_SLIST_EMPTY(&hosts) &&
+ CK_SLIST_EMPTY(&portgroups)) {
+ uma_zfree(nat64lsn_pgchunk_zone, ji->pgchunk);
+ uma_zfree(nat64lsn_job_zone, ji);
+ return;
+ }
+
+ /* Schedule job item again */
+ CK_SLIST_MOVE(&ji->hosts, &hosts, entries);
+ CK_SLIST_MOVE(&ji->portgroups, &portgroups, entries);
+ NAT64LSN_EPOCH_CALL(&ji->epoch_ctx, nat64lsn_job_destroy);
}
static int
@@ -1569,40 +1720,40 @@
ipfw_nat64lsn(struct ip_fw_chain *ch, struct ip_fw_args *args,
ipfw_insn *cmd, int *done)
{
- struct nat64lsn_cfg *cfg;
+ struct nat64lsn_instance *i;
ipfw_insn *icmd;
int ret;
IPFW_RLOCK_ASSERT(ch);
*done = 0; /* continue the search in case of failure */
- icmd = cmd + 1;
+ icmd = cmd + F_LEN(cmd);
if (cmd->opcode != O_EXTERNAL_ACTION ||
- cmd->arg1 != V_nat64lsn_eid ||
+ insntod(cmd, kidx)->kidx != V_nat64lsn_eid ||
icmd->opcode != O_EXTERNAL_INSTANCE ||
- (cfg = NAT64_LOOKUP(ch, icmd)) == NULL)
+ (i = NAT64_LOOKUP(ch, icmd)) == NULL)
return (IP_FW_DENY);
*done = 1; /* terminate the search */
switch (args->f_id.addr_type) {
case 4:
- ret = nat64lsn_translate4(cfg, &args->f_id, &args->m);
+ ret = nat64lsn_translate4(i->cfg, &args->f_id, &args->m);
break;
case 6:
/*
* Check that destination IPv6 address matches our prefix6.
*/
- if ((cfg->base.flags & NAT64LSN_ANYPREFIX) == 0 &&
- memcmp(&args->f_id.dst_ip6, &cfg->base.plat_prefix,
- cfg->base.plat_plen / 8) != 0) {
- ret = cfg->nomatch_verdict;
+ if ((i->cfg->base.flags & NAT64LSN_ANYPREFIX) == 0 &&
+ memcmp(&args->f_id.dst_ip6, &i->cfg->base.plat_prefix,
+ i->cfg->base.plat_plen / 8) != 0) {
+ ret = i->cfg->nomatch_verdict;
break;
}
- ret = nat64lsn_translate6(cfg, &args->f_id, &args->m);
+ ret = nat64lsn_translate6(i->cfg, &args->f_id, &args->m);
break;
default:
- ret = cfg->nomatch_verdict;
+ ret = i->cfg->nomatch_verdict;
}
if (ret != IP_FW_PASS && args->m != NULL) {
@@ -1674,7 +1825,7 @@
}
struct nat64lsn_cfg *
-nat64lsn_init_instance(struct ip_fw_chain *ch, in_addr_t prefix, int plen)
+nat64lsn_init_config(struct ip_fw_chain *ch, in_addr_t prefix, int plen)
{
struct nat64lsn_cfg *cfg;
struct nat64lsn_alias *alias;
@@ -1777,7 +1928,7 @@
}
void
-nat64lsn_destroy_instance(struct nat64lsn_cfg *cfg)
+nat64lsn_destroy_config(struct nat64lsn_cfg *cfg)
{
struct nat64lsn_host *host;
int i;
@@ -1805,3 +1956,4 @@
free(cfg->aliases, M_NAT64LSN);
free(cfg, M_NAT64LSN);
}
+
diff --git a/sys/netpfil/ipfw/nat64/nat64lsn_control.c b/sys/netpfil/ipfw/nat64/nat64lsn_control.c
--- a/sys/netpfil/ipfw/nat64/nat64lsn_control.c
+++ b/sys/netpfil/ipfw/nat64/nat64lsn_control.c
@@ -55,17 +55,18 @@
#include "nat64lsn.h"
-VNET_DEFINE(uint16_t, nat64lsn_eid) = 0;
+VNET_DEFINE(uint32_t, nat64lsn_eid) = 0;
-static struct nat64lsn_cfg *
+static struct nat64lsn_instance *
nat64lsn_find(struct namedobj_instance *ni, const char *name, uint8_t set)
{
- struct nat64lsn_cfg *cfg;
+ struct named_object *no;
- cfg = (struct nat64lsn_cfg *)ipfw_objhash_lookup_name_type(ni, set,
+ no = ipfw_objhash_lookup_name_type(ni, set,
IPFW_TLV_NAT64LSN_NAME, name);
-
- return (cfg);
+ if (no == NULL)
+ return (NULL);
+ return (__containerof(no, struct nat64lsn_instance, no));
}
static void
@@ -112,6 +113,7 @@
{
ipfw_obj_lheader *olh;
ipfw_nat64lsn_cfg *uc;
+ struct nat64lsn_instance *i;
struct nat64lsn_cfg *cfg;
struct namedobj_instance *ni;
uint32_t addr4, mask4;
@@ -157,12 +159,14 @@
}
IPFW_UH_RUNLOCK(ch);
- cfg = nat64lsn_init_instance(ch, addr4, uc->plen4);
- strlcpy(cfg->name, uc->name, sizeof(cfg->name));
- cfg->no.name = cfg->name;
- cfg->no.etlv = IPFW_TLV_NAT64LSN_NAME;
- cfg->no.set = uc->set;
+ i = malloc(sizeof(struct nat64lsn_instance), M_NAT64LSN,
+ M_WAITOK | M_ZERO);
+ strlcpy(i->name, uc->name, sizeof(i->name));
+ i->no.name = i->name;
+ i->no.etlv = IPFW_TLV_NAT64LSN_NAME;
+ i->no.set = uc->set;
+ cfg = nat64lsn_init_config(ch, addr4, uc->plen4);
cfg->base.plat_prefix = uc->prefix6;
cfg->base.plat_plen = uc->plen6;
cfg->base.flags = (uc->flags & NAT64LSN_FLAGSMASK) | NAT64_PLATPFX;
@@ -180,26 +184,28 @@
cfg->st_estab_ttl = uc->st_estab_ttl;
cfg->st_udp_ttl = uc->st_udp_ttl;
cfg->st_icmp_ttl = uc->st_icmp_ttl;
-
cfg->nomatch_verdict = IP_FW_DENY;
IPFW_UH_WLOCK(ch);
if (nat64lsn_find(ni, uc->name, uc->set) != NULL) {
IPFW_UH_WUNLOCK(ch);
- nat64lsn_destroy_instance(cfg);
+ nat64lsn_destroy_config(cfg);
+ free(i, M_NAT64LSN);
return (EEXIST);
}
- if (ipfw_objhash_alloc_idx(CHAIN_TO_SRV(ch), &cfg->no.kidx) != 0) {
+ if (ipfw_objhash_alloc_idx(ni, &i->no.kidx) != 0) {
IPFW_UH_WUNLOCK(ch);
- nat64lsn_destroy_instance(cfg);
+ nat64lsn_destroy_config(cfg);
+ free(i, M_NAT64LSN);
return (ENOSPC);
}
- ipfw_objhash_add(CHAIN_TO_SRV(ch), &cfg->no);
+ ipfw_objhash_add(ni, &i->no);
/* Okay, let's link data */
- SRV_OBJECT(ch, cfg->no.kidx) = cfg;
+ i->cfg = cfg;
+ SRV_OBJECT(ch, i->no.kidx) = i;
nat64lsn_start_instance(cfg);
IPFW_UH_WUNLOCK(ch);
@@ -207,13 +213,14 @@
}
static void
-nat64lsn_detach_config(struct ip_fw_chain *ch, struct nat64lsn_cfg *cfg)
+nat64lsn_detach_instance(struct ip_fw_chain *ch,
+ struct nat64lsn_instance *i)
{
IPFW_UH_WLOCK_ASSERT(ch);
-
- ipfw_objhash_del(CHAIN_TO_SRV(ch), &cfg->no);
- ipfw_objhash_free_idx(CHAIN_TO_SRV(ch), cfg->no.kidx);
+ SRV_OBJECT(ch, i->no.kidx) = NULL;
+ ipfw_objhash_del(CHAIN_TO_SRV(ch), &i->no);
+ ipfw_objhash_free_idx(CHAIN_TO_SRV(ch), i->no.kidx);
}
/*
@@ -227,7 +234,7 @@
nat64lsn_destroy(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
struct sockopt_data *sd)
{
- struct nat64lsn_cfg *cfg;
+ struct nat64lsn_instance *i;
ipfw_obj_header *oh;
if (sd->valsize != sizeof(*oh))
@@ -236,23 +243,23 @@
oh = (ipfw_obj_header *)op3;
IPFW_UH_WLOCK(ch);
- cfg = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
- if (cfg == NULL) {
+ i = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
+ if (i == NULL) {
IPFW_UH_WUNLOCK(ch);
return (ENOENT);
}
- if (cfg->no.refcnt > 0) {
+ if (i->no.refcnt > 0) {
IPFW_UH_WUNLOCK(ch);
return (EBUSY);
}
- ipfw_reset_eaction_instance(ch, V_nat64lsn_eid, cfg->no.kidx);
- SRV_OBJECT(ch, cfg->no.kidx) = NULL;
- nat64lsn_detach_config(ch, cfg);
+ ipfw_reset_eaction_instance(ch, V_nat64lsn_eid, i->no.kidx);
+ nat64lsn_detach_instance(ch, i);
IPFW_UH_WUNLOCK(ch);
- nat64lsn_destroy_instance(cfg);
+ nat64lsn_destroy_config(i->cfg);
+ free(i, M_NAT64LSN);
return (0);
}
@@ -263,7 +270,7 @@
struct ipfw_nat64lsn_stats *stats)
{
struct nat64lsn_alias *alias;
- int i, j;
+ int i;
__COPY_STAT_FIELD(cfg, stats, opcnt64);
__COPY_STAT_FIELD(cfg, stats, opcnt46);
@@ -294,20 +301,22 @@
stats->hostcount = cfg->hosts_count;
for (i = 0; i < (1 << (32 - cfg->plen4)); i++) {
alias = &cfg->aliases[i];
- for (j = 0; j < 32 && ISSET32(alias->tcp_chunkmask, j); j++)
- stats->tcpchunks += bitcount32(alias->tcp_pgmask[j]);
- for (j = 0; j < 32 && ISSET32(alias->udp_chunkmask, j); j++)
- stats->udpchunks += bitcount32(alias->udp_pgmask[j]);
- for (j = 0; j < 32 && ISSET32(alias->icmp_chunkmask, j); j++)
- stats->icmpchunks += bitcount32(alias->icmp_pgmask[j]);
+ stats->tcpchunks += alias->tcp_pgcount;
+ stats->udpchunks += alias->udp_pgcount;
+ stats->icmpchunks += alias->icmp_pgcount;
}
}
#undef __COPY_STAT_FIELD
static void
-nat64lsn_export_config(struct ip_fw_chain *ch, struct nat64lsn_cfg *cfg,
+nat64lsn_export_config(struct ip_fw_chain *ch, struct nat64lsn_instance *i,
ipfw_nat64lsn_cfg *uc)
{
+ struct nat64lsn_cfg *cfg;
+
+ strlcpy(uc->name, i->no.name, sizeof(uc->name));
+ uc->set = i->no.set;
+ cfg = i->cfg;
uc->flags = cfg->base.flags & NAT64LSN_FLAGSMASK;
uc->states_chunks = cfg->states_chunks;
@@ -323,8 +332,6 @@
uc->prefix6 = cfg->base.plat_prefix;
uc->plen4 = cfg->plen4;
uc->plen6 = cfg->base.plat_plen;
- uc->set = cfg->no.set;
- strlcpy(uc->name, cfg->no.name, sizeof(uc->name));
}
struct nat64_dump_arg {
@@ -336,12 +343,14 @@
export_config_cb(struct namedobj_instance *ni, struct named_object *no,
void *arg)
{
- struct nat64_dump_arg *da = (struct nat64_dump_arg *)arg;
+ struct nat64_dump_arg *da;
ipfw_nat64lsn_cfg *uc;
+ da = (struct nat64_dump_arg *)arg;
uc = (struct _ipfw_nat64lsn_cfg *)ipfw_get_sopt_space(da->sd,
sizeof(*uc));
- nat64lsn_export_config(da->ch, (struct nat64lsn_cfg *)no, uc);
+ nat64lsn_export_config(da->ch,
+ __containerof(no, struct nat64lsn_instance, no), uc);
return (0);
}
@@ -400,6 +409,7 @@
{
ipfw_obj_header *oh;
ipfw_nat64lsn_cfg *uc;
+ struct nat64lsn_instance *i;
struct nat64lsn_cfg *cfg;
struct namedobj_instance *ni;
@@ -417,12 +427,12 @@
ni = CHAIN_TO_SRV(ch);
if (sd->sopt->sopt_dir == SOPT_GET) {
IPFW_UH_RLOCK(ch);
- cfg = nat64lsn_find(ni, oh->ntlv.name, oh->ntlv.set);
- if (cfg == NULL) {
+ i = nat64lsn_find(ni, oh->ntlv.name, oh->ntlv.set);
+ if (i == NULL) {
IPFW_UH_RUNLOCK(ch);
return (ENOENT);
}
- nat64lsn_export_config(ch, cfg, uc);
+ nat64lsn_export_config(ch, i, uc);
IPFW_UH_RUNLOCK(ch);
return (0);
}
@@ -430,8 +440,8 @@
nat64lsn_default_config(uc);
IPFW_UH_WLOCK(ch);
- cfg = nat64lsn_find(ni, oh->ntlv.name, oh->ntlv.set);
- if (cfg == NULL) {
+ i = nat64lsn_find(ni, oh->ntlv.name, oh->ntlv.set);
+ if (i == NULL) {
IPFW_UH_WUNLOCK(ch);
return (ENOENT);
}
@@ -441,7 +451,7 @@
* jmaxlen, nh_del_age, pg_del_age, tcp_syn_age, tcp_close_age,
* tcp_est_age, udp_age, icmp_age, flags, states_chunks.
*/
-
+ cfg = i->cfg;
cfg->states_chunks = uc->states_chunks;
cfg->jmaxlen = uc->jmaxlen;
cfg->host_delete_delay = uc->nh_delete_delay;
@@ -472,7 +482,7 @@
struct sockopt_data *sd)
{
struct ipfw_nat64lsn_stats stats;
- struct nat64lsn_cfg *cfg;
+ struct nat64lsn_instance *i;
ipfw_obj_header *oh;
ipfw_obj_ctlv *ctlv;
size_t sz;
@@ -488,13 +498,13 @@
memset(&stats, 0, sizeof(stats));
IPFW_UH_RLOCK(ch);
- cfg = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
- if (cfg == NULL) {
+ i = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
+ if (i == NULL) {
IPFW_UH_RUNLOCK(ch);
return (ENOENT);
}
- export_stats(ch, cfg, &stats);
+ export_stats(ch, i->cfg, &stats);
IPFW_UH_RUNLOCK(ch);
ctlv = (ipfw_obj_ctlv *)(oh + 1);
@@ -519,7 +529,7 @@
nat64lsn_reset_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op,
struct sockopt_data *sd)
{
- struct nat64lsn_cfg *cfg;
+ struct nat64lsn_instance *i;
ipfw_obj_header *oh;
if (sd->valsize != sizeof(*oh))
@@ -530,12 +540,12 @@
return (EINVAL);
IPFW_UH_WLOCK(ch);
- cfg = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
- if (cfg == NULL) {
+ i = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
+ if (i == NULL) {
IPFW_UH_WUNLOCK(ch);
return (ENOENT);
}
- COUNTER_ARRAY_ZERO(cfg->base.stats.cnt, NAT64STATS);
+ COUNTER_ARRAY_ZERO(i->cfg->base.stats.cnt, NAT64STATS);
IPFW_UH_WUNLOCK(ch);
return (0);
}
@@ -551,7 +561,7 @@
* ipfw_nat64lsn_state x count, ... ] ]
*/
static int
-nat64lsn_export_states_v1(struct nat64lsn_cfg *cfg, union nat64lsn_pgidx *idx,
+nat64lsn_export_states(struct nat64lsn_cfg *cfg, union nat64lsn_pgidx *idx,
struct nat64lsn_pg *pg, struct sockopt_data *sd, uint32_t *ret_count)
{
ipfw_nat64lsn_state_v1 *s;
@@ -663,24 +673,6 @@
return (NULL);
}
-/*
- * Lists nat64lsn states.
- * Data layout (v0):
- * Request: [ ipfw_obj_header ipfw_obj_data [ uint64_t ]]
- * Reply: [ ipfw_obj_header ipfw_obj_data [
- * ipfw_nat64lsn_stg ipfw_nat64lsn_state x N] ]
- *
- * Returns 0 on success
- */
-static int
-nat64lsn_states_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
- struct sockopt_data *sd)
-{
-
- /* TODO: implement states listing for old ipfw(8) binaries */
- return (EOPNOTSUPP);
-}
-
/*
* Lists nat64lsn states.
* Data layout (v1)(current):
@@ -691,12 +683,13 @@
* Returns 0 on success
*/
static int
-nat64lsn_states_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
+nat64lsn_states(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
struct sockopt_data *sd)
{
ipfw_obj_header *oh;
ipfw_obj_data *od;
ipfw_nat64lsn_stg_v1 *stg;
+ struct nat64lsn_instance *i;
struct nat64lsn_cfg *cfg;
struct nat64lsn_pg *pg;
union nat64lsn_pgidx idx;
@@ -724,11 +717,12 @@
return (EINVAL);
IPFW_UH_RLOCK(ch);
- cfg = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
- if (cfg == NULL) {
+ i = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
+ if (i == NULL) {
IPFW_UH_RUNLOCK(ch);
return (ENOENT);
}
+ cfg = i->cfg;
if (idx.index == 0) { /* Fill in starting point */
idx.addr = cfg->prefix4;
idx.proto = IPPROTO_ICMP;
@@ -762,7 +756,7 @@
pg = nat64lsn_get_pg_byidx(cfg, &idx);
if (pg != NULL) {
count = 0;
- ret = nat64lsn_export_states_v1(cfg, &idx, pg,
+ ret = nat64lsn_export_states(cfg, &idx, pg,
sd, &count);
if (ret != 0)
break;
@@ -809,96 +803,113 @@
}
static struct ipfw_sopt_handler scodes[] = {
- { IP_FW_NAT64LSN_CREATE, 0, HDIR_BOTH, nat64lsn_create },
- { IP_FW_NAT64LSN_DESTROY,0, HDIR_SET, nat64lsn_destroy },
- { IP_FW_NAT64LSN_CONFIG, 0, HDIR_BOTH, nat64lsn_config },
- { IP_FW_NAT64LSN_LIST, 0, HDIR_GET, nat64lsn_list },
- { IP_FW_NAT64LSN_STATS, 0, HDIR_GET, nat64lsn_stats },
- { IP_FW_NAT64LSN_RESET_STATS,0, HDIR_SET, nat64lsn_reset_stats },
- { IP_FW_NAT64LSN_LIST_STATES,0, HDIR_GET, nat64lsn_states_v0 },
- { IP_FW_NAT64LSN_LIST_STATES,1, HDIR_GET, nat64lsn_states_v1 },
+ { IP_FW_NAT64LSN_CREATE, IP_FW3_OPVER, HDIR_BOTH, nat64lsn_create },
+ { IP_FW_NAT64LSN_DESTROY, IP_FW3_OPVER, HDIR_SET, nat64lsn_destroy },
+ { IP_FW_NAT64LSN_CONFIG, IP_FW3_OPVER, HDIR_BOTH, nat64lsn_config },
+ { IP_FW_NAT64LSN_LIST, IP_FW3_OPVER, HDIR_GET, nat64lsn_list },
+ { IP_FW_NAT64LSN_STATS, IP_FW3_OPVER, HDIR_GET, nat64lsn_stats },
+ { IP_FW_NAT64LSN_RESET_STATS, IP_FW3_OPVER, HDIR_SET, nat64lsn_reset_stats },
+ { IP_FW_NAT64LSN_LIST_STATES, IP_FW3_OPVER, HDIR_GET, nat64lsn_states },
};
+#define NAT64LSN_ARE_EQUAL(v) (cfg0->v == cfg1->v)
static int
-nat64lsn_classify(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
+nat64lsn_cmp_configs(struct nat64lsn_cfg *cfg0, struct nat64lsn_cfg *cfg1)
{
- ipfw_insn *icmd;
-
- icmd = cmd - 1;
- if (icmd->opcode != O_EXTERNAL_ACTION ||
- icmd->arg1 != V_nat64lsn_eid)
- return (1);
- *puidx = cmd->arg1;
- *ptype = 0;
- return (0);
+ if ((cfg0->base.flags & cfg1->base.flags & NAT64LSN_ALLOW_SWAPCONF) &&
+ NAT64LSN_ARE_EQUAL(prefix4) &&
+ NAT64LSN_ARE_EQUAL(pmask4) &&
+ NAT64LSN_ARE_EQUAL(plen4) &&
+ NAT64LSN_ARE_EQUAL(base.plat_plen) &&
+ IN6_ARE_ADDR_EQUAL(&cfg0->base.plat_prefix,
+ &cfg1->base.plat_prefix))
+ return (0);
+ return (1);
}
+#undef NAT64LSN_ARE_EQUAL
static void
-nat64lsn_update_arg1(ipfw_insn *cmd, uint16_t idx)
+nat64lsn_swap_configs(struct nat64lsn_instance *i0,
+ struct nat64lsn_instance *i1)
{
+ struct nat64lsn_cfg *cfg;
- cmd->arg1 = idx;
+ cfg = i0->cfg;
+ i0->cfg = i1->cfg;
+ i1->cfg = cfg;
}
+/*
+ * NAT64LSN sets swap handler.
+ *
+ * When two sets have NAT64LSN instance with the same name, we check
+ * most important configuration parameters, and if there are no difference,
+ * and both instances have NAT64LSN_ALLOW_SWAPCONF flag, we will exchange
+ * configs between instances. This allows to keep NAT64 states when ipfw's
+ * rules are reloaded using new set.
+ *
+ * XXX: since manage_sets caller doesn't hold IPFW_WLOCK(), it is possible
+ * that some states will be created during switching, because set of rules
+ * is changed a bit earley than named objects.
+ */
static int
-nat64lsn_findbyname(struct ip_fw_chain *ch, struct tid_info *ti,
- struct named_object **pno)
-{
- int err;
-
- err = ipfw_objhash_find_type(CHAIN_TO_SRV(ch), ti,
- IPFW_TLV_NAT64LSN_NAME, pno);
- return (err);
-}
-
-static struct named_object *
-nat64lsn_findbykidx(struct ip_fw_chain *ch, uint16_t idx)
+nat64lsn_swap_sets_cb(struct namedobj_instance *ni, struct named_object *no,
+ void *arg)
{
- struct namedobj_instance *ni;
- struct named_object *no;
-
- IPFW_UH_WLOCK_ASSERT(ch);
- ni = CHAIN_TO_SRV(ch);
- no = ipfw_objhash_lookup_kidx(ni, idx);
- KASSERT(no != NULL, ("NAT64LSN with index %d not found", idx));
-
- return (no);
+ struct nat64lsn_instance *i0, *i1;
+ uint8_t *sets;
+
+ sets = arg;
+ if (no->set == sets[0]) {
+ /*
+ * Check if we have instance in new set with the same
+ * config that is sets aware and ready to swap configs.
+ */
+ i0 = __containerof(no, struct nat64lsn_instance, no);
+ if ((i0->cfg->base.flags & NAT64LSN_ALLOW_SWAPCONF) &&
+ (i1 = nat64lsn_find(ni, no->name, sets[1])) != NULL) {
+ /* Compare configs */
+ if (nat64lsn_cmp_configs(i0->cfg, i1->cfg) == 0) {
+ IPFW_UH_WLOCK_ASSERT(&V_layer3_chain);
+ IPFW_WLOCK(&V_layer3_chain);
+ nat64lsn_swap_configs(i0, i1);
+ IPFW_WUNLOCK(&V_layer3_chain);
+ }
+ }
+ }
+ return (0);
}
static int
-nat64lsn_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set,
+nat64lsn_manage_sets(struct ip_fw_chain *ch, uint32_t set, uint8_t new_set,
enum ipfw_sets_cmd cmd)
{
+ uint8_t sets[2];
+ if (cmd == SWAP_ALL) {
+ sets[0] = (uint8_t)set;
+ sets[1] = new_set;
+ ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch),
+ nat64lsn_swap_sets_cb, &sets, IPFW_TLV_NAT64LSN_NAME);
+ }
return (ipfw_obj_manage_sets(CHAIN_TO_SRV(ch), IPFW_TLV_NAT64LSN_NAME,
set, new_set, cmd));
}
-
-static struct opcode_obj_rewrite opcodes[] = {
- {
- .opcode = O_EXTERNAL_INSTANCE,
- .etlv = IPFW_TLV_EACTION /* just show it isn't table */,
- .classifier = nat64lsn_classify,
- .update = nat64lsn_update_arg1,
- .find_byname = nat64lsn_findbyname,
- .find_bykidx = nat64lsn_findbykidx,
- .manage_sets = nat64lsn_manage_sets,
- },
-};
+NAT64_DEFINE_OPCODE_REWRITER(nat64lsn, NAT64LSN, opcodes);
static int
destroy_config_cb(struct namedobj_instance *ni, struct named_object *no,
void *arg)
{
- struct nat64lsn_cfg *cfg;
+ struct nat64lsn_instance *i;
struct ip_fw_chain *ch;
ch = (struct ip_fw_chain *)arg;
- cfg = (struct nat64lsn_cfg *)SRV_OBJECT(ch, no->kidx);
- SRV_OBJECT(ch, no->kidx) = NULL;
- nat64lsn_detach_config(ch, cfg);
- nat64lsn_destroy_instance(cfg);
+ i = (struct nat64lsn_instance *)SRV_OBJECT(ch, no->kidx);
+ nat64lsn_detach_instance(ch, i);
+ nat64lsn_destroy_config(i->cfg);
+ free(i, M_NAT64LSN);
return (0);
}
diff --git a/sys/netpfil/ipfw/nat64/nat64stl.h b/sys/netpfil/ipfw/nat64/nat64stl.h
--- a/sys/netpfil/ipfw/nat64/nat64stl.h
+++ b/sys/netpfil/ipfw/nat64/nat64stl.h
@@ -35,8 +35,8 @@
struct nat64stl_cfg {
struct named_object no;
- uint16_t map64; /* table with 6to4 mapping */
- uint16_t map46; /* table with 4to6 mapping */
+ uint32_t map64; /* table with 6to4 mapping */
+ uint32_t map46; /* table with 4to6 mapping */
struct nat64_config base;
#define NAT64STL_KIDX 0x0100
@@ -47,7 +47,7 @@
char name[64];
};
-VNET_DECLARE(uint16_t, nat64stl_eid);
+VNET_DECLARE(uint32_t, nat64stl_eid);
#define V_nat64stl_eid VNET(nat64stl_eid)
#define IPFW_TLV_NAT64STL_NAME IPFW_TLV_EACTION_NAME(V_nat64stl_eid)
diff --git a/sys/netpfil/ipfw/nat64/nat64stl.c b/sys/netpfil/ipfw/nat64/nat64stl.c
--- a/sys/netpfil/ipfw/nat64/nat64stl.c
+++ b/sys/netpfil/ipfw/nat64/nat64stl.c
@@ -58,7 +58,7 @@
#include "nat64stl.h"
#define NAT64_LOOKUP(chain, cmd) \
- (struct nat64stl_cfg *)SRV_OBJECT((chain), (cmd)->arg1)
+ (struct nat64stl_cfg *)SRV_OBJECT((chain), insntod(cmd, kidx)->kidx)
static void
nat64stl_log(struct pfloghdr *plog, struct mbuf *m, sa_family_t family,
@@ -67,7 +67,7 @@
static uint32_t pktid = 0;
memset(plog, 0, sizeof(*plog));
- plog->length = PFLOG_HDRLEN;
+ plog->length = PFLOG_REAL_HDRLEN;
plog->af = family;
plog->action = PF_NAT;
plog->dir = PF_IN;
@@ -204,8 +204,8 @@
ipfw_nat64stl(struct ip_fw_chain *chain, struct ip_fw_args *args,
ipfw_insn *cmd, int *done)
{
- ipfw_insn *icmd;
struct nat64stl_cfg *cfg;
+ ipfw_insn *icmd;
in_addr_t dst4;
uint32_t tablearg;
int ret;
@@ -213,9 +213,9 @@
IPFW_RLOCK_ASSERT(chain);
*done = 0; /* try next rule if not matched */
- icmd = cmd + 1;
+ icmd = cmd + F_LEN(cmd);
if (cmd->opcode != O_EXTERNAL_ACTION ||
- cmd->arg1 != V_nat64stl_eid ||
+ insntod(cmd, kidx)->kidx != V_nat64stl_eid ||
icmd->opcode != O_EXTERNAL_INSTANCE ||
(cfg = NAT64_LOOKUP(chain, icmd)) == NULL)
return (0);
diff --git a/sys/netpfil/ipfw/nat64/nat64stl_control.c b/sys/netpfil/ipfw/nat64/nat64stl_control.c
--- a/sys/netpfil/ipfw/nat64/nat64stl_control.c
+++ b/sys/netpfil/ipfw/nat64/nat64stl_control.c
@@ -61,7 +61,7 @@
#include "nat64stl.h"
-VNET_DEFINE(uint16_t, nat64stl_eid) = 0;
+VNET_DEFINE(uint32_t, nat64stl_eid) = 0;
static struct nat64stl_cfg *nat64stl_alloc_config(const char *name,
uint8_t set);
@@ -489,81 +489,23 @@
}
static struct ipfw_sopt_handler scodes[] = {
- { IP_FW_NAT64STL_CREATE, 0, HDIR_SET, nat64stl_create },
- { IP_FW_NAT64STL_DESTROY,0, HDIR_SET, nat64stl_destroy },
- { IP_FW_NAT64STL_CONFIG, 0, HDIR_BOTH, nat64stl_config },
- { IP_FW_NAT64STL_LIST, 0, HDIR_GET, nat64stl_list },
- { IP_FW_NAT64STL_STATS, 0, HDIR_GET, nat64stl_stats },
- { IP_FW_NAT64STL_RESET_STATS,0, HDIR_SET, nat64stl_reset_stats },
+ { IP_FW_NAT64STL_CREATE, IP_FW3_OPVER, HDIR_SET, nat64stl_create },
+ { IP_FW_NAT64STL_DESTROY, IP_FW3_OPVER, HDIR_SET, nat64stl_destroy },
+ { IP_FW_NAT64STL_CONFIG, IP_FW3_OPVER, HDIR_BOTH,nat64stl_config },
+ { IP_FW_NAT64STL_LIST, IP_FW3_OPVER, HDIR_GET, nat64stl_list },
+ { IP_FW_NAT64STL_STATS, IP_FW3_OPVER, HDIR_GET, nat64stl_stats },
+ { IP_FW_NAT64STL_RESET_STATS, IP_FW3_OPVER, HDIR_SET, nat64stl_reset_stats },
};
static int
-nat64stl_classify(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
-{
- ipfw_insn *icmd;
-
- icmd = cmd - 1;
- if (icmd->opcode != O_EXTERNAL_ACTION ||
- icmd->arg1 != V_nat64stl_eid)
- return (1);
-
- *puidx = cmd->arg1;
- *ptype = 0;
- return (0);
-}
-
-static void
-nat64stl_update_arg1(ipfw_insn *cmd, uint16_t idx)
-{
-
- cmd->arg1 = idx;
-}
-
-static int
-nat64stl_findbyname(struct ip_fw_chain *ch, struct tid_info *ti,
- struct named_object **pno)
-{
- int err;
-
- err = ipfw_objhash_find_type(CHAIN_TO_SRV(ch), ti,
- IPFW_TLV_NAT64STL_NAME, pno);
- return (err);
-}
-
-static struct named_object *
-nat64stl_findbykidx(struct ip_fw_chain *ch, uint16_t idx)
-{
- struct namedobj_instance *ni;
- struct named_object *no;
-
- IPFW_UH_WLOCK_ASSERT(ch);
- ni = CHAIN_TO_SRV(ch);
- no = ipfw_objhash_lookup_kidx(ni, idx);
- KASSERT(no != NULL, ("NAT with index %d not found", idx));
-
- return (no);
-}
-
-static int
-nat64stl_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set,
+nat64stl_manage_sets(struct ip_fw_chain *ch, uint32_t set, uint8_t new_set,
enum ipfw_sets_cmd cmd)
{
return (ipfw_obj_manage_sets(CHAIN_TO_SRV(ch), IPFW_TLV_NAT64STL_NAME,
set, new_set, cmd));
}
-
-static struct opcode_obj_rewrite opcodes[] = {
- {
- .opcode = O_EXTERNAL_INSTANCE,
- .etlv = IPFW_TLV_EACTION /* just show it isn't table */,
- .classifier = nat64stl_classify,
- .update = nat64stl_update_arg1,
- .find_byname = nat64stl_findbyname,
- .find_bykidx = nat64stl_findbykidx,
- .manage_sets = nat64stl_manage_sets,
- },
-};
+NAT64_DEFINE_OPCODE_REWRITER(nat64stl, NAT64STL, opcodes);
static int
destroy_config_cb(struct namedobj_instance *ni, struct named_object *no,
diff --git a/sys/netpfil/ipfw/nptv6/nptv6.c b/sys/netpfil/ipfw/nptv6/nptv6.c
--- a/sys/netpfil/ipfw/nptv6/nptv6.c
+++ b/sys/netpfil/ipfw/nptv6/nptv6.c
@@ -60,7 +60,7 @@
#include <netpfil/ipfw/ip_fw_private.h>
#include <netpfil/ipfw/nptv6/nptv6.h>
-VNET_DEFINE_STATIC(uint16_t, nptv6_eid) = 0;
+VNET_DEFINE_STATIC(uint32_t, nptv6_eid) = 0;
#define V_nptv6_eid VNET(nptv6_eid)
#define IPFW_TLV_NPTV6_NAME IPFW_TLV_EACTION_NAME(V_nptv6_eid)
@@ -76,7 +76,7 @@
int offset);
#define NPTV6_LOOKUP(chain, cmd) \
- (struct nptv6_cfg *)SRV_OBJECT((chain), (cmd)->arg1)
+ (struct nptv6_cfg *)SRV_OBJECT((chain), insntod(cmd, kidx)->kidx)
#ifndef IN6_MASK_ADDR
#define IN6_MASK_ADDR(a, m) do { \
@@ -354,9 +354,9 @@
*done = 0; /* try next rule if not matched */
ret = IP_FW_DENY;
- icmd = cmd + 1;
+ icmd = cmd + F_LEN(cmd);
if (cmd->opcode != O_EXTERNAL_ACTION ||
- cmd->arg1 != V_nptv6_eid ||
+ insntod(cmd, kidx)->kidx != V_nptv6_eid ||
icmd->opcode != O_EXTERNAL_INSTANCE ||
(cfg = NPTV6_LOOKUP(chain, icmd)) == NULL ||
(cfg->flags & NPTV6_READY) == 0)
@@ -374,7 +374,7 @@
*/
ip6 = mtod(args->m, struct ip6_hdr *);
NPTV6_IPDEBUG("eid %u, oid %u, %s -> %s %d",
- cmd->arg1, icmd->arg1,
+ insntod(cmd, kidx)->kidx, insntod(icmd, kidx)->kidx,
inet_ntop(AF_INET6, &ip6->ip6_src, _s, sizeof(_s)),
inet_ntop(AF_INET6, &ip6->ip6_dst, _d, sizeof(_d)),
ip6->ip6_nxt);
@@ -904,37 +904,38 @@
}
static struct ipfw_sopt_handler scodes[] = {
- { IP_FW_NPTV6_CREATE, 0, HDIR_SET, nptv6_create },
- { IP_FW_NPTV6_DESTROY,0, HDIR_SET, nptv6_destroy },
- { IP_FW_NPTV6_CONFIG, 0, HDIR_BOTH, nptv6_config },
- { IP_FW_NPTV6_LIST, 0, HDIR_GET, nptv6_list },
- { IP_FW_NPTV6_STATS, 0, HDIR_GET, nptv6_stats },
- { IP_FW_NPTV6_RESET_STATS,0, HDIR_SET, nptv6_reset_stats },
+ { IP_FW_NPTV6_CREATE, IP_FW3_OPVER, HDIR_SET, nptv6_create },
+ { IP_FW_NPTV6_DESTROY, IP_FW3_OPVER, HDIR_SET, nptv6_destroy },
+ { IP_FW_NPTV6_CONFIG, IP_FW3_OPVER, HDIR_BOTH,nptv6_config },
+ { IP_FW_NPTV6_LIST, IP_FW3_OPVER, HDIR_GET, nptv6_list },
+ { IP_FW_NPTV6_STATS, IP_FW3_OPVER, HDIR_GET, nptv6_stats },
+ { IP_FW_NPTV6_RESET_STATS, IP_FW3_OPVER, HDIR_SET, nptv6_reset_stats },
};
static int
-nptv6_classify(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
+nptv6_classify(ipfw_insn *cmd0, uint32_t *puidx, uint8_t *ptype)
{
ipfw_insn *icmd;
- icmd = cmd - 1;
- NPTV6_DEBUG("opcode %d, arg1 %d, opcode0 %d, arg1 %d",
- cmd->opcode, cmd->arg1, icmd->opcode, icmd->arg1);
+ icmd = cmd0 - F_LEN(cmd0);
+ NPTV6_DEBUG("opcode %u, kidx %u, opcode0 %u, kidx %u",
+ cmd->opcode, insntod(cmd, kidx)->kidx,
+ icmd->opcode, insntod(icmd, kidx)->kidx);
if (icmd->opcode != O_EXTERNAL_ACTION ||
- icmd->arg1 != V_nptv6_eid)
+ insntod(icmd, kidx)->kidx != V_nptv6_eid)
return (1);
- *puidx = cmd->arg1;
+ *puidx = insntod(cmd0, kidx)->kidx;
*ptype = 0;
return (0);
}
static void
-nptv6_update_arg1(ipfw_insn *cmd, uint16_t idx)
+nptv6_update_kidx(ipfw_insn *cmd0, uint32_t idx)
{
- cmd->arg1 = idx;
- NPTV6_DEBUG("opcode %d, arg1 -> %d", cmd->opcode, cmd->arg1);
+ insntod(cmd0, kidx)->kidx = idx;
+ NPTV6_DEBUG("opcode %u, kidx -> %u", cmd->opcode, idx);
}
static int
@@ -950,7 +951,7 @@
}
static struct named_object *
-nptv6_findbykidx(struct ip_fw_chain *ch, uint16_t idx)
+nptv6_findbykidx(struct ip_fw_chain *ch, uint32_t idx)
{
struct namedobj_instance *ni;
struct named_object *no;
@@ -958,14 +959,14 @@
IPFW_UH_WLOCK_ASSERT(ch);
ni = CHAIN_TO_SRV(ch);
no = ipfw_objhash_lookup_kidx(ni, idx);
- KASSERT(no != NULL, ("NPT with index %d not found", idx));
+ KASSERT(no != NULL, ("NPT with index %u not found", idx));
NPTV6_DEBUG("kidx %u -> %s", idx, no->name);
return (no);
}
static int
-nptv6_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set,
+nptv6_manage_sets(struct ip_fw_chain *ch, uint32_t set, uint8_t new_set,
enum ipfw_sets_cmd cmd)
{
@@ -978,7 +979,7 @@
.opcode = O_EXTERNAL_INSTANCE,
.etlv = IPFW_TLV_EACTION /* just show it isn't table */,
.classifier = nptv6_classify,
- .update = nptv6_update_arg1,
+ .update = nptv6_update_kidx,
.find_byname = nptv6_findbyname,
.find_bykidx = nptv6_findbykidx,
.manage_sets = nptv6_manage_sets,
diff --git a/sys/netpfil/ipfw/pmod/tcpmod.c b/sys/netpfil/ipfw/pmod/tcpmod.c
--- a/sys/netpfil/ipfw/pmod/tcpmod.c
+++ b/sys/netpfil/ipfw/pmod/tcpmod.c
@@ -53,7 +53,7 @@
#include <machine/in_cksum.h>
-VNET_DEFINE_STATIC(uint16_t, tcpmod_setmss_eid) = 0;
+VNET_DEFINE_STATIC(uint32_t, tcpmod_setmss_eid) = 0;
#define V_tcpmod_setmss_eid VNET(tcpmod_setmss_eid)
static int
@@ -178,9 +178,9 @@
*done = 0; /* try next rule if not matched */
ret = IP_FW_DENY;
- icmd = cmd + 1;
+ icmd = cmd + F_LEN(cmd);
if (cmd->opcode != O_EXTERNAL_ACTION ||
- cmd->arg1 != V_tcpmod_setmss_eid ||
+ insntod(cmd, kidx)->kidx != V_tcpmod_setmss_eid ||
icmd->opcode != O_EXTERNAL_DATA ||
icmd->len != F_INSN_SIZE(ipfw_insn))
return (ret);
diff --git a/sys/sys/socket.h b/sys/sys/socket.h
--- a/sys/sys/socket.h
+++ b/sys/sys/socket.h
@@ -269,7 +269,8 @@
#define AF_INET6_SDP 42 /* OFED Socket Direct Protocol ipv6 */
#define AF_HYPERV 43 /* HyperV sockets */
#define AF_DIVERT 44 /* divert(4) */
-#define AF_MAX 44
+#define AF_IPFWLOG 46
+#define AF_MAX 46
/*
* When allocating a new AF_ constant, please only allocate
* even numbered constants for FreeBSD until 134 as odd numbered AF_
@@ -395,6 +396,7 @@
#define PF_INET_SDP AF_INET_SDP
#define PF_INET6_SDP AF_INET6_SDP
#define PF_DIVERT AF_DIVERT
+#define PF_IPFWLOG AF_IPFWLOG
#define PF_MAX AF_MAX

File Metadata

Mime Type
text/plain
Expires
Mon, May 11, 8:26 AM (3 h, 38 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
28672126
Default Alt Text
D46183.1778487961.diff (291 KB)

Event Timeline