1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2002-2009 Luigi Rizzo, Universita` di Pisa
5 * Copyright (c) 2014-2025 Yandex LLC
6 * Copyright (c) 2014 Alexander V. Chernikov
7 *
8 * Supported by: Valeria Paoli
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32 #include <sys/cdefs.h>
33 /*
34 * Control socket and rule management routines for ipfw.
35 * Control is currently implemented via IP_FW3 setsockopt() code.
36 */
37
38 #include "opt_ipfw.h"
39 #include "opt_inet.h"
40 #ifndef INET
41 #error IPFIREWALL requires INET.
42 #endif /* INET */
43 #include "opt_inet6.h"
44
45 #include <sys/param.h>
46 #include <sys/systm.h>
47 #include <sys/malloc.h>
48 #include <sys/mbuf.h> /* struct m_tag used by nested headers */
49 #include <sys/kernel.h>
50 #include <sys/lock.h>
51 #include <sys/priv.h>
52 #include <sys/proc.h>
53 #include <sys/rwlock.h>
54 #include <sys/rmlock.h>
55 #include <sys/socket.h>
56 #include <sys/socketvar.h>
57 #include <sys/sysctl.h>
58 #include <sys/syslog.h>
59 #include <sys/fnv_hash.h>
60 #include <net/if.h>
61 #include <net/route.h>
62 #include <net/vnet.h>
63 #include <vm/vm.h>
64 #include <vm/vm_extern.h>
65
66 #include <netinet/in.h>
67 #include <netinet/ip_var.h> /* hooks */
68 #include <netinet/ip_fw.h>
69
70 #include <netpfil/ipfw/ip_fw_private.h>
71 #include <netpfil/ipfw/ip_fw_table.h>
72
73 #ifdef MAC
74 #include <security/mac/mac_framework.h>
75 #endif
76
77 static enum ipfw_opcheck_result
check_opcode_compat_nop(ipfw_insn ** pcmd,int * plen,struct rule_check_info * ci)78 check_opcode_compat_nop(ipfw_insn **pcmd, int *plen,
79 struct rule_check_info *ci)
80 {
81 /* Compatibility code is not registered */
82 return (FAILED);
83 }
84
85 static ipfw_check_opcode_t check_opcode_f = check_opcode_compat_nop;
86
87 static int check_ipfw_rule_body(ipfw_insn *cmd, int cmd_len,
88 struct rule_check_info *ci);
89 static int rewrite_rule_uidx(struct ip_fw_chain *chain,
90 struct rule_check_info *ci);
91
92 struct namedobj_instance {
93 struct namedobjects_head *names;
94 struct namedobjects_head *values;
95 uint32_t nn_size; /* names hash size */
96 uint32_t nv_size; /* number hash size */
97 u_long *idx_mask; /* used items bitmask */
98 uint32_t max_blocks; /* number of "long" blocks in bitmask */
99 uint32_t count; /* number of items */
100 uint16_t free_off[IPFW_MAX_SETS]; /* first possible free offset */
101 objhash_hash_f *hash_f;
102 objhash_cmp_f *cmp_f;
103 };
104 #define BLOCK_ITEMS (8 * sizeof(u_long)) /* Number of items for ffsl() */
105
106 static uint32_t objhash_hash_name(struct namedobj_instance *ni,
107 const void *key, uint32_t kopt);
108 static uint32_t objhash_hash_idx(struct namedobj_instance *ni, uint32_t val);
109 static int objhash_cmp_name(struct named_object *no, const void *name,
110 uint32_t set);
111
112 MALLOC_DEFINE(M_IPFW, "IpFw/IpAcct", "IpFw/IpAcct chain's");
113
114 /* ctl3 handler data */
115 static struct mtx ctl3_lock;
116 #define CTL3_LOCK_INIT() mtx_init(&ctl3_lock, "ctl3_lock", NULL, MTX_DEF)
117 #define CTL3_LOCK_DESTROY() mtx_destroy(&ctl3_lock)
118 #define CTL3_LOCK() mtx_lock(&ctl3_lock)
119 #define CTL3_UNLOCK() mtx_unlock(&ctl3_lock)
120
121 static struct ipfw_sopt_handler *ctl3_handlers;
122 static size_t ctl3_hsize;
123 static uint64_t ctl3_refct, ctl3_gencnt;
124 #define CTL3_SMALLBUF 4096 /* small page-size write buffer */
125 #define CTL3_LARGEBUF (16 * 1024 * 1024) /* handle large rulesets */
126
127 static int ipfw_flush_sopt_data(struct sockopt_data *sd);
128
129 static sopt_handler_f dump_config, add_rules, del_rules, clear_rules,
130 move_rules, manage_sets, dump_soptcodes, dump_srvobjects,
131 manage_skiptocache;
132
133 static struct ipfw_sopt_handler scodes[] = {
134 { IP_FW_XGET, IP_FW3_OPVER, HDIR_GET, dump_config },
135 { IP_FW_XADD, IP_FW3_OPVER, HDIR_BOTH, add_rules },
136 { IP_FW_XDEL, IP_FW3_OPVER, HDIR_BOTH, del_rules },
137 { IP_FW_XZERO, IP_FW3_OPVER, HDIR_SET, clear_rules },
138 { IP_FW_XRESETLOG, IP_FW3_OPVER, HDIR_SET, clear_rules },
139 { IP_FW_XMOVE, IP_FW3_OPVER, HDIR_SET, move_rules },
140 { IP_FW_SET_SWAP, IP_FW3_OPVER, HDIR_SET, manage_sets },
141 { IP_FW_SET_MOVE, IP_FW3_OPVER, HDIR_SET, manage_sets },
142 { IP_FW_SET_ENABLE, IP_FW3_OPVER, HDIR_SET, manage_sets },
143 { IP_FW_DUMP_SOPTCODES, IP_FW3_OPVER, HDIR_GET, dump_soptcodes },
144 { IP_FW_DUMP_SRVOBJECTS, IP_FW3_OPVER, HDIR_GET, dump_srvobjects },
145 { IP_FW_SKIPTO_CACHE, IP_FW3_OPVER, HDIR_BOTH, manage_skiptocache },
146 };
147
148 static struct opcode_obj_rewrite *find_op_rw(ipfw_insn *cmd,
149 uint32_t *puidx, uint8_t *ptype);
150 static int ref_rule_objects(struct ip_fw_chain *ch, struct ip_fw *rule,
151 struct rule_check_info *ci, struct obj_idx *oib, struct tid_info *ti);
152 static int ref_opcode_object(struct ip_fw_chain *ch, ipfw_insn *cmd,
153 struct tid_info *ti, struct obj_idx *pidx, int *unresolved);
154 static void unref_rule_objects(struct ip_fw_chain *chain, struct ip_fw *rule);
155 static void unref_oib_objects(struct ip_fw_chain *ch, ipfw_insn *cmd,
156 struct obj_idx *oib, struct obj_idx *end);
157 static int export_objhash_ntlv(struct namedobj_instance *ni, uint32_t kidx,
158 struct sockopt_data *sd);
159
160 /*
161 * Opcode object rewriter variables
162 */
163 struct opcode_obj_rewrite *ctl3_rewriters;
164 static size_t ctl3_rsize;
165
166 /*
167 * static variables followed by global ones
168 */
169
170 VNET_DEFINE_STATIC(uma_zone_t, ipfw_cntr_zone);
171 #define V_ipfw_cntr_zone VNET(ipfw_cntr_zone)
172
173 void
ipfw_init_counters(void)174 ipfw_init_counters(void)
175 {
176
177 V_ipfw_cntr_zone = uma_zcreate("IPFW counters",
178 IPFW_RULE_CNTR_SIZE, NULL, NULL, NULL, NULL,
179 UMA_ALIGN_PTR, UMA_ZONE_PCPU);
180 }
181
182 void
ipfw_destroy_counters(void)183 ipfw_destroy_counters(void)
184 {
185
186 uma_zdestroy(V_ipfw_cntr_zone);
187 }
188
189 struct ip_fw *
ipfw_alloc_rule(struct ip_fw_chain * chain,size_t rulesize)190 ipfw_alloc_rule(struct ip_fw_chain *chain, size_t rulesize)
191 {
192 struct ip_fw *rule;
193
194 rule = malloc(rulesize, M_IPFW, M_WAITOK | M_ZERO);
195 rule->cntr = uma_zalloc_pcpu(V_ipfw_cntr_zone, M_WAITOK | M_ZERO);
196 rule->refcnt = 1;
197
198 return (rule);
199 }
200
201 void
ipfw_free_rule(struct ip_fw * rule)202 ipfw_free_rule(struct ip_fw *rule)
203 {
204
205 /*
206 * We don't release refcnt here, since this function
207 * can be called without any locks held. The caller
208 * must release reference under IPFW_UH_WLOCK, and then
209 * call this function if refcount becomes 1.
210 */
211 if (rule->refcnt > 1)
212 return;
213 uma_zfree_pcpu(V_ipfw_cntr_zone, rule->cntr);
214 free(rule, M_IPFW);
215 }
216
217 /*
218 * Find the smallest rule >= key, id.
219 * We could use bsearch but it is so simple that we code it directly
220 */
221 int
ipfw_find_rule(struct ip_fw_chain * chain,uint32_t key,uint32_t id)222 ipfw_find_rule(struct ip_fw_chain *chain, uint32_t key, uint32_t id)
223 {
224 int i, lo, hi;
225 struct ip_fw *r;
226
227 for (lo = 0, hi = chain->n_rules - 1; lo < hi;) {
228 i = (lo + hi) / 2;
229 r = chain->map[i];
230 if (r->rulenum < key)
231 lo = i + 1; /* continue from the next one */
232 else if (r->rulenum > key)
233 hi = i; /* this might be good */
234 else if (r->id < id)
235 lo = i + 1; /* continue from the next one */
236 else /* r->id >= id */
237 hi = i; /* this might be good */
238 }
239 return hi;
240 }
241
242 /*
243 * Builds skipto cache on rule set @map.
244 */
245 static void
update_skipto_cache(struct ip_fw_chain * chain,struct ip_fw ** map)246 update_skipto_cache(struct ip_fw_chain *chain, struct ip_fw **map)
247 {
248 uint32_t *smap, rulenum;
249 int i, mi;
250
251 IPFW_UH_WLOCK_ASSERT(chain);
252
253 mi = 0;
254 rulenum = map[mi]->rulenum;
255 smap = chain->idxmap_back;
256
257 if (smap == NULL)
258 return;
259
260 for (i = 0; i <= IPFW_DEFAULT_RULE; i++) {
261 smap[i] = mi;
262 /* Use the same rule index until i < rulenum */
263 if (i != rulenum || i == IPFW_DEFAULT_RULE)
264 continue;
265 /* Find next rule with num > i */
266 rulenum = map[++mi]->rulenum;
267 while (rulenum == i)
268 rulenum = map[++mi]->rulenum;
269 }
270 }
271
272 /*
273 * Swaps prepared (backup) index with current one.
274 */
275 static void
swap_skipto_cache(struct ip_fw_chain * chain)276 swap_skipto_cache(struct ip_fw_chain *chain)
277 {
278 uint32_t *map;
279
280 IPFW_UH_WLOCK_ASSERT(chain);
281 IPFW_WLOCK_ASSERT(chain);
282
283 map = chain->idxmap;
284 chain->idxmap = chain->idxmap_back;
285 chain->idxmap_back = map;
286 }
287
288 /*
289 * Allocate and initialize skipto cache.
290 */
291 void
ipfw_init_skipto_cache(struct ip_fw_chain * chain)292 ipfw_init_skipto_cache(struct ip_fw_chain *chain)
293 {
294 uint32_t *idxmap, *idxmap_back;
295
296 idxmap = malloc((IPFW_DEFAULT_RULE + 1) * sizeof(uint32_t),
297 M_IPFW, M_WAITOK | M_ZERO);
298 idxmap_back = malloc((IPFW_DEFAULT_RULE + 1) * sizeof(uint32_t),
299 M_IPFW, M_WAITOK | M_ZERO);
300
301 /*
302 * Note we may be called at any time after initialization,
303 * for example, on first skipto rule, so we need to
304 * provide valid chain->idxmap on return
305 */
306
307 IPFW_UH_WLOCK(chain);
308 if (chain->idxmap != NULL) {
309 IPFW_UH_WUNLOCK(chain);
310 free(idxmap, M_IPFW);
311 free(idxmap_back, M_IPFW);
312 return;
313 }
314
315 /* Set backup pointer first to permit building cache */
316 chain->idxmap_back = idxmap_back;
317 if (V_skipto_cache != 0)
318 update_skipto_cache(chain, chain->map);
319 IPFW_WLOCK(chain);
320 /* It is now safe to set chain->idxmap ptr */
321 chain->idxmap = idxmap;
322 swap_skipto_cache(chain);
323 IPFW_WUNLOCK(chain);
324 IPFW_UH_WUNLOCK(chain);
325 }
326
327 /*
328 * Destroys skipto cache.
329 */
330 void
ipfw_destroy_skipto_cache(struct ip_fw_chain * chain)331 ipfw_destroy_skipto_cache(struct ip_fw_chain *chain)
332 {
333 free(chain->idxmap, M_IPFW);
334 free(chain->idxmap_back, M_IPFW);
335 }
336
337 /*
338 * swap the maps.
339 */
340 static struct ip_fw **
swap_map(struct ip_fw_chain * chain,struct ip_fw ** new_map,int new_len)341 swap_map(struct ip_fw_chain *chain, struct ip_fw **new_map, int new_len)
342 {
343 struct ip_fw **old_map;
344
345 IPFW_UH_WLOCK_ASSERT(chain);
346
347 IPFW_WLOCK(chain);
348 chain->id++;
349 chain->n_rules = new_len;
350 old_map = chain->map;
351 chain->map = new_map;
352 swap_skipto_cache(chain);
353 IPFW_WUNLOCK(chain);
354 return old_map;
355 }
356
357 static void
export_cntr1_base(struct ip_fw * krule,struct ip_fw_bcounter * cntr)358 export_cntr1_base(struct ip_fw *krule, struct ip_fw_bcounter *cntr)
359 {
360 struct timeval boottime;
361
362 cntr->size = sizeof(*cntr);
363
364 if (krule->cntr != NULL) {
365 cntr->pcnt = counter_u64_fetch(krule->cntr);
366 cntr->bcnt = counter_u64_fetch(krule->cntr + 1);
367 cntr->timestamp = krule->timestamp;
368 }
369 if (cntr->timestamp > 0) {
370 getboottime(&boottime);
371 cntr->timestamp += boottime.tv_sec;
372 }
373 }
374
375 /*
376 * Export rule into v1 format (Current).
377 * Layout:
378 * [ ipfw_obj_tlv(IPFW_TLV_RULE_ENT)
379 * [ ip_fw_rule ] OR
380 * [ ip_fw_bcounter ip_fw_rule] (depends on rcntrs).
381 * ]
382 * Assume @data is zeroed.
383 */
384 static void
export_rule1(struct ip_fw * krule,caddr_t data,int len,int rcntrs)385 export_rule1(struct ip_fw *krule, caddr_t data, int len, int rcntrs)
386 {
387 struct ip_fw_bcounter *cntr;
388 struct ip_fw_rule *urule;
389 ipfw_obj_tlv *tlv;
390
391 /* Fill in TLV header */
392 tlv = (ipfw_obj_tlv *)data;
393 tlv->type = IPFW_TLV_RULE_ENT;
394 tlv->length = len;
395
396 if (rcntrs != 0) {
397 /* Copy counters */
398 cntr = (struct ip_fw_bcounter *)(tlv + 1);
399 urule = (struct ip_fw_rule *)(cntr + 1);
400 export_cntr1_base(krule, cntr);
401 } else
402 urule = (struct ip_fw_rule *)(tlv + 1);
403
404 /* copy header */
405 urule->act_ofs = krule->act_ofs;
406 urule->cmd_len = krule->cmd_len;
407 urule->rulenum = krule->rulenum;
408 urule->set = krule->set;
409 urule->flags = krule->flags;
410 urule->id = krule->id;
411
412 /* Copy opcodes */
413 memcpy(urule->cmd, krule->cmd, krule->cmd_len * sizeof(uint32_t));
414 }
415
416 /*
417 * Add new rule(s) to the list possibly creating rule number for each.
418 * Update the rule_number in the input struct so the caller knows it as well.
419 * Must be called without IPFW_UH held
420 */
421 int
ipfw_commit_rules(struct ip_fw_chain * chain,struct rule_check_info * rci,int count)422 ipfw_commit_rules(struct ip_fw_chain *chain, struct rule_check_info *rci,
423 int count)
424 {
425 int error, i, insert_before, tcount, rule_idx, last_rule_idx;
426 uint32_t rulenum;
427 struct rule_check_info *ci;
428 struct ip_fw *krule;
429 struct ip_fw **map; /* the new array of pointers */
430
431 IPFW_UH_WLOCK(chain);
432 /* Check if we need to do table/obj index remap */
433 tcount = 0;
434 for (ci = rci, i = 0; i < count; ci++, i++) {
435 if (ci->object_opcodes == 0)
436 continue;
437
438 /*
439 * Rule has some object opcodes.
440 * We need to find (and create non-existing)
441 * kernel objects, and reference existing ones.
442 */
443 error = rewrite_rule_uidx(chain, ci);
444 if (error != 0) {
445
446 /*
447 * rewrite failed, state for current rule
448 * has been reverted. Check if we need to
449 * revert more.
450 */
451 if (tcount > 0) {
452
453 /*
454 * We have some more table rules
455 * we need to rollback.
456 */
457 while (ci != rci) {
458 ci--;
459 if (ci->object_opcodes == 0)
460 continue;
461 unref_rule_objects(chain,ci->krule);
462
463 }
464 }
465 IPFW_UH_WUNLOCK(chain);
466 return (error);
467 }
468
469 tcount++;
470 }
471
472 map = malloc((chain->n_rules + count) * sizeof(struct ip_fw *),
473 M_IPFW, M_ZERO | M_WAITOK);
474
475 if (V_autoinc_step < 1)
476 V_autoinc_step = 1;
477 else if (V_autoinc_step > 1000)
478 V_autoinc_step = 1000;
479
480 last_rule_idx = 0;
481 for (ci = rci, i = 0; i < count; ci++, i++) {
482 krule = ci->krule;
483 rulenum = krule->rulenum;
484
485 krule->id = chain->id + 1;
486
487 /* find the insertion point, we will insert before */
488 insert_before = rulenum ? rulenum + 1 : IPFW_DEFAULT_RULE;
489 rule_idx = ipfw_find_rule(chain, insert_before, 0);
490 /* duplicate the previous part */
491 if (last_rule_idx < rule_idx)
492 bcopy(chain->map + last_rule_idx, map + last_rule_idx + i,
493 (rule_idx - last_rule_idx) * sizeof(struct ip_fw *));
494 last_rule_idx = rule_idx;
495 map[rule_idx + i] = krule;
496 if (rulenum == 0) {
497 /* Compute rule number and write it back */
498 rulenum = rule_idx + i > 0 ? map[rule_idx + i - 1]->rulenum : 0;
499 if (rulenum < IPFW_DEFAULT_RULE - V_autoinc_step)
500 rulenum += V_autoinc_step;
501 krule->rulenum = rulenum;
502 /* Save number to userland rule */
503 memcpy((char *)ci->urule + ci->urule_numoff, &rulenum,
504 sizeof(rulenum));
505 }
506 if (ACTION_PTR(krule)->opcode == O_LOG)
507 ipfw_tap_alloc(chain, krule->rulenum);
508 }
509
510 /* duplicate the remaining part, we always have the default rule */
511 bcopy(chain->map + last_rule_idx, map + last_rule_idx + count,
512 (chain->n_rules - last_rule_idx) * sizeof(struct ip_fw *));
513
514 if (V_skipto_cache != 0)
515 update_skipto_cache(chain, map);
516 map = swap_map(chain, map, chain->n_rules + count);
517 IPFW_UH_WUNLOCK(chain);
518 if (map)
519 free(map, M_IPFW);
520 return (0);
521 }
522
523 int
ipfw_add_protected_rule(struct ip_fw_chain * chain,struct ip_fw * rule)524 ipfw_add_protected_rule(struct ip_fw_chain *chain, struct ip_fw *rule)
525 {
526 struct ip_fw **map;
527
528 IPFW_UH_WLOCK(chain);
529 map = malloc((chain->n_rules + 1) * sizeof(struct ip_fw *),
530 M_IPFW, M_ZERO | M_WAITOK);
531 if (chain->n_rules > 0)
532 bcopy(chain->map, map,
533 chain->n_rules * sizeof(struct ip_fw *));
534 map[chain->n_rules] = rule;
535 rule->rulenum = IPFW_DEFAULT_RULE;
536 rule->set = RESVD_SET;
537 rule->id = chain->id + 1;
538 /* We add rule in the end of chain, no need to update skipto cache */
539 map = swap_map(chain, map, chain->n_rules + 1);
540 IPFW_UH_WUNLOCK(chain);
541 free(map, M_IPFW);
542 return (0);
543 }
544
545 /*
546 * Adds @rule to the list of rules to reap
547 */
548 void
ipfw_reap_add(struct ip_fw_chain * chain,struct ip_fw ** head,struct ip_fw * rule)549 ipfw_reap_add(struct ip_fw_chain *chain, struct ip_fw **head,
550 struct ip_fw *rule)
551 {
552
553 IPFW_UH_WLOCK_ASSERT(chain);
554
555 /* Unlink rule from everywhere */
556 unref_rule_objects(chain, rule);
557
558 rule->next = *head;
559 *head = rule;
560 }
561
562 /*
563 * Reclaim storage associated with a list of rules. This is
564 * typically the list created using remove_rule.
565 * A NULL pointer on input is handled correctly.
566 */
567 void
ipfw_reap_rules(struct ip_fw * head)568 ipfw_reap_rules(struct ip_fw *head)
569 {
570 struct ip_fw *rule;
571
572 while ((rule = head) != NULL) {
573 head = head->next;
574 ipfw_free_rule(rule);
575 }
576 }
577
578 /*
579 * Rules to keep are
580 * (default || reserved || !match_set || !match_number)
581 * where
582 * default ::= (rule->rulenum == IPFW_DEFAULT_RULE)
583 * // the default rule is always protected
584 *
585 * reserved ::= (cmd == 0 && n == 0 && rule->set == RESVD_SET)
586 * // RESVD_SET is protected only if cmd == 0 and n == 0 ("ipfw flush")
587 *
588 * match_set ::= (cmd == 0 || rule->set == set)
589 * // set number is ignored for cmd == 0
590 *
591 * match_number ::= (cmd == 1 || n == 0 || n == rule->rulenum)
592 * // number is ignored for cmd == 1 or n == 0
593 *
594 */
595 int
ipfw_match_range(struct ip_fw * rule,ipfw_range_tlv * rt)596 ipfw_match_range(struct ip_fw *rule, ipfw_range_tlv *rt)
597 {
598
599 /* Don't match default rule for modification queries */
600 if (rule->rulenum == IPFW_DEFAULT_RULE &&
601 (rt->flags & IPFW_RCFLAG_DEFAULT) == 0)
602 return (0);
603
604 /* Don't match rules in reserved set for flush requests */
605 if ((rt->flags & IPFW_RCFLAG_ALL) != 0 && rule->set == RESVD_SET)
606 return (0);
607
608 /* If we're filtering by set, don't match other sets */
609 if ((rt->flags & IPFW_RCFLAG_SET) != 0 && rule->set != rt->set)
610 return (0);
611
612 if ((rt->flags & IPFW_RCFLAG_RANGE) != 0 &&
613 (rule->rulenum < rt->start_rule || rule->rulenum > rt->end_rule))
614 return (0);
615
616 return (1);
617 }
618
619 struct manage_sets_args {
620 uint32_t set;
621 uint8_t new_set;
622 };
623
624 static int
swap_sets_cb(struct namedobj_instance * ni,struct named_object * no,void * arg)625 swap_sets_cb(struct namedobj_instance *ni, struct named_object *no,
626 void *arg)
627 {
628 struct manage_sets_args *args;
629
630 args = (struct manage_sets_args *)arg;
631 if (no->set == (uint8_t)args->set)
632 no->set = args->new_set;
633 else if (no->set == args->new_set)
634 no->set = (uint8_t)args->set;
635 return (0);
636 }
637
638 static int
move_sets_cb(struct namedobj_instance * ni,struct named_object * no,void * arg)639 move_sets_cb(struct namedobj_instance *ni, struct named_object *no,
640 void *arg)
641 {
642 struct manage_sets_args *args;
643
644 args = (struct manage_sets_args *)arg;
645 if (no->set == (uint8_t)args->set)
646 no->set = args->new_set;
647 return (0);
648 }
649
650 static int
test_sets_cb(struct namedobj_instance * ni,struct named_object * no,void * arg)651 test_sets_cb(struct namedobj_instance *ni, struct named_object *no,
652 void *arg)
653 {
654 struct manage_sets_args *args;
655
656 args = (struct manage_sets_args *)arg;
657 if (no->set != (uint8_t)args->set)
658 return (0);
659 if (ipfw_objhash_lookup_name_type(ni, args->new_set,
660 no->etlv, no->name) != NULL)
661 return (EEXIST);
662 return (0);
663 }
664
665 /*
666 * Generic function to handler moving and swapping sets.
667 */
668 int
ipfw_obj_manage_sets(struct namedobj_instance * ni,uint16_t type,uint32_t set,uint8_t new_set,enum ipfw_sets_cmd cmd)669 ipfw_obj_manage_sets(struct namedobj_instance *ni, uint16_t type,
670 uint32_t set, uint8_t new_set, enum ipfw_sets_cmd cmd)
671 {
672 struct manage_sets_args args;
673 struct named_object *no;
674
675 args.set = set;
676 args.new_set = new_set;
677 switch (cmd) {
678 case SWAP_ALL:
679 return (ipfw_objhash_foreach_type(ni, swap_sets_cb,
680 &args, type));
681 case TEST_ALL:
682 return (ipfw_objhash_foreach_type(ni, test_sets_cb,
683 &args, type));
684 case MOVE_ALL:
685 return (ipfw_objhash_foreach_type(ni, move_sets_cb,
686 &args, type));
687 case COUNT_ONE:
688 /*
689 * @set used to pass kidx.
690 * When @new_set is zero - reset object counter,
691 * otherwise increment it.
692 */
693 no = ipfw_objhash_lookup_kidx(ni, set);
694 if (new_set != 0)
695 no->ocnt++;
696 else
697 no->ocnt = 0;
698 return (0);
699 case TEST_ONE:
700 /* @set used to pass kidx */
701 no = ipfw_objhash_lookup_kidx(ni, set);
702 /*
703 * First check number of references:
704 * when it differs, this mean other rules are holding
705 * reference to given object, so it is not possible to
706 * change its set. Note that refcnt may account references
707 * to some going-to-be-added rules. Since we don't know
708 * their numbers (and even if they will be added) it is
709 * perfectly OK to return error here.
710 */
711 if (no->ocnt != no->refcnt)
712 return (EBUSY);
713 if (ipfw_objhash_lookup_name_type(ni, new_set, type,
714 no->name) != NULL)
715 return (EEXIST);
716 return (0);
717 case MOVE_ONE:
718 /* @set used to pass kidx */
719 no = ipfw_objhash_lookup_kidx(ni, set);
720 no->set = new_set;
721 return (0);
722 }
723 return (EINVAL);
724 }
725
726 /*
727 * Delete rules matching range @rt.
728 * Saves number of deleted rules in @ndel.
729 *
730 * Returns 0 on success.
731 */
732 int
delete_range(struct ip_fw_chain * chain,ipfw_range_tlv * rt,int * ndel)733 delete_range(struct ip_fw_chain *chain, ipfw_range_tlv *rt, int *ndel)
734 {
735 struct ip_fw *reap, *rule, **map;
736 uint32_t end, start;
737 int i, n, ndyn, ofs;
738
739 reap = NULL;
740 IPFW_UH_WLOCK(chain); /* arbitrate writers */
741
742 /*
743 * Stage 1: Determine range to inspect.
744 * Range is half-inclusive, e.g [start, end).
745 */
746 start = 0;
747 end = chain->n_rules - 1;
748
749 if ((rt->flags & IPFW_RCFLAG_RANGE) != 0) {
750 start = ipfw_find_rule(chain, rt->start_rule, 0);
751
752 if (rt->end_rule >= IPFW_DEFAULT_RULE)
753 rt->end_rule = IPFW_DEFAULT_RULE - 1;
754 end = ipfw_find_rule(chain, rt->end_rule, UINT32_MAX);
755 }
756
757 if (rt->flags & IPFW_RCFLAG_DYNAMIC) {
758 /*
759 * Requested deleting only for dynamic states.
760 */
761 *ndel = 0;
762 ipfw_expire_dyn_states(chain, rt);
763 IPFW_UH_WUNLOCK(chain);
764 return (0);
765 }
766
767 /* Allocate new map of the same size */
768 map = malloc(chain->n_rules * sizeof(struct ip_fw *),
769 M_IPFW, M_ZERO | M_WAITOK);
770 n = 0;
771 ndyn = 0;
772 ofs = start;
773 /* 1. bcopy the initial part of the map */
774 if (start > 0)
775 bcopy(chain->map, map, start * sizeof(struct ip_fw *));
776 /* 2. copy active rules between start and end */
777 for (i = start; i < end; i++) {
778 rule = chain->map[i];
779 if (ipfw_match_range(rule, rt) == 0) {
780 map[ofs++] = rule;
781 continue;
782 }
783
784 n++;
785 if (ipfw_is_dyn_rule(rule) != 0)
786 ndyn++;
787 }
788 /* 3. copy the final part of the map */
789 bcopy(chain->map + end, map + ofs,
790 (chain->n_rules - end) * sizeof(struct ip_fw *));
791 /* 4. recalculate skipto cache */
792 update_skipto_cache(chain, map);
793 /* 5. swap the maps (under UH_WLOCK + WHLOCK) */
794 map = swap_map(chain, map, chain->n_rules - n);
795 /* 6. Remove all dynamic states originated by deleted rules */
796 if (ndyn > 0)
797 ipfw_expire_dyn_states(chain, rt);
798 /* 7. now remove the rules deleted from the old map */
799 for (i = start; i < end; i++) {
800 rule = map[i];
801 if (ipfw_match_range(rule, rt) == 0)
802 continue;
803 ipfw_reap_add(chain, &reap, rule);
804 }
805 IPFW_UH_WUNLOCK(chain);
806
807 ipfw_reap_rules(reap);
808 if (map != NULL)
809 free(map, M_IPFW);
810 *ndel = n;
811 return (0);
812 }
813
814 static int
move_objects(struct ip_fw_chain * ch,ipfw_range_tlv * rt)815 move_objects(struct ip_fw_chain *ch, ipfw_range_tlv *rt)
816 {
817 struct opcode_obj_rewrite *rw;
818 struct ip_fw *rule;
819 ipfw_insn *cmd;
820 uint32_t kidx;
821 int cmdlen, i, l, c;
822
823 IPFW_UH_WLOCK_ASSERT(ch);
824
825 /* Stage 1: count number of references by given rules */
826 for (c = 0, i = 0; i < ch->n_rules - 1; i++) {
827 rule = ch->map[i];
828 if (ipfw_match_range(rule, rt) == 0)
829 continue;
830 if (rule->set == rt->new_set) /* nothing to do */
831 continue;
832 /* Search opcodes with named objects */
833 for (l = rule->cmd_len, cmdlen = 0, cmd = rule->cmd;
834 l > 0; l -= cmdlen, cmd += cmdlen) {
835 cmdlen = F_LEN(cmd);
836 rw = find_op_rw(cmd, &kidx, NULL);
837 if (rw == NULL || rw->manage_sets == NULL)
838 continue;
839 /*
840 * When manage_sets() returns non-zero value to
841 * COUNT_ONE command, consider this as an object
842 * doesn't support sets (e.g. disabled with sysctl).
843 * So, skip checks for this object.
844 */
845 if (rw->manage_sets(ch, kidx, 1, COUNT_ONE) != 0)
846 continue;
847 c++;
848 }
849 }
850 if (c == 0) /* No objects found */
851 return (0);
852 /* Stage 2: verify "ownership" */
853 for (c = 0, i = 0; (i < ch->n_rules - 1) && c == 0; i++) {
854 rule = ch->map[i];
855 if (ipfw_match_range(rule, rt) == 0)
856 continue;
857 if (rule->set == rt->new_set) /* nothing to do */
858 continue;
859 /* Search opcodes with named objects */
860 for (l = rule->cmd_len, cmdlen = 0, cmd = rule->cmd;
861 l > 0 && c == 0; l -= cmdlen, cmd += cmdlen) {
862 cmdlen = F_LEN(cmd);
863 rw = find_op_rw(cmd, &kidx, NULL);
864 if (rw == NULL || rw->manage_sets == NULL)
865 continue;
866 /* Test for ownership and conflicting names */
867 c = rw->manage_sets(ch, kidx,
868 (uint8_t)rt->new_set, TEST_ONE);
869 }
870 }
871 /* Stage 3: change set and cleanup */
872 for (i = 0; i < ch->n_rules - 1; i++) {
873 rule = ch->map[i];
874 if (ipfw_match_range(rule, rt) == 0)
875 continue;
876 if (rule->set == rt->new_set) /* nothing to do */
877 continue;
878 /* Search opcodes with named objects */
879 for (l = rule->cmd_len, cmdlen = 0, cmd = rule->cmd;
880 l > 0; l -= cmdlen, cmd += cmdlen) {
881 cmdlen = F_LEN(cmd);
882 rw = find_op_rw(cmd, &kidx, NULL);
883 if (rw == NULL || rw->manage_sets == NULL)
884 continue;
885 /* cleanup object counter */
886 rw->manage_sets(ch, kidx,
887 0 /* reset counter */, COUNT_ONE);
888 if (c != 0)
889 continue;
890 /* change set */
891 rw->manage_sets(ch, kidx,
892 (uint8_t)rt->new_set, MOVE_ONE);
893 }
894 }
895 return (c);
896 }
897
898 /*
899 * Changes set of given rule rannge @rt
900 * with each other.
901 *
902 * Returns 0 on success.
903 */
904 static int
move_range(struct ip_fw_chain * chain,ipfw_range_tlv * rt)905 move_range(struct ip_fw_chain *chain, ipfw_range_tlv *rt)
906 {
907 struct ip_fw *rule;
908 int i;
909
910 IPFW_UH_WLOCK(chain);
911
912 /*
913 * Move rules with matching paramenerts to a new set.
914 * This one is much more complex. We have to ensure
915 * that all referenced tables (if any) are referenced
916 * by given rule subset only. Otherwise, we can't move
917 * them to new set and have to return error.
918 */
919 if ((i = move_objects(chain, rt)) != 0) {
920 IPFW_UH_WUNLOCK(chain);
921 return (i);
922 }
923
924 /* XXX: We have to do swap holding WLOCK */
925 for (i = 0; i < chain->n_rules; i++) {
926 rule = chain->map[i];
927 if (ipfw_match_range(rule, rt) == 0)
928 continue;
929 rule->set = rt->new_set;
930 }
931
932 IPFW_UH_WUNLOCK(chain);
933
934 return (0);
935 }
936
937 /*
938 * Returns pointer to action instruction, skips all possible rule
939 * modifiers like O_LOG, O_TAG, O_ALTQ.
940 */
941 ipfw_insn *
ipfw_get_action(struct ip_fw * rule)942 ipfw_get_action(struct ip_fw *rule)
943 {
944 ipfw_insn *cmd;
945 int l, cmdlen;
946
947 cmd = ACTION_PTR(rule);
948 l = rule->cmd_len - rule->act_ofs;
949 while (l > 0) {
950 switch (cmd->opcode) {
951 case O_ALTQ:
952 case O_LOG:
953 case O_TAG:
954 break;
955 default:
956 return (cmd);
957 }
958 cmdlen = F_LEN(cmd);
959 l -= cmdlen;
960 cmd += cmdlen;
961 }
962 panic("%s: rule (%p) has not action opcode", __func__, rule);
963 return (NULL);
964 }
965
966 /*
967 * Clear counters for a specific rule.
968 * Normally run under IPFW_UH_RLOCK, but these are idempotent ops
969 * so we only care that rules do not disappear.
970 */
971 static void
clear_counters(struct ip_fw * rule,int log_only)972 clear_counters(struct ip_fw *rule, int log_only)
973 {
974 ipfw_insn_log *l = (ipfw_insn_log *)ACTION_PTR(rule);
975
976 if (log_only == 0)
977 IPFW_ZERO_RULE_COUNTER(rule);
978 if (l->o.opcode == O_LOG)
979 l->log_left = l->max_log;
980 }
981
982 /*
983 * Flushes rules counters and/or log values on matching range.
984 *
985 * Returns number of items cleared.
986 */
987 static int
clear_range(struct ip_fw_chain * chain,ipfw_range_tlv * rt,int log_only)988 clear_range(struct ip_fw_chain *chain, ipfw_range_tlv *rt, int log_only)
989 {
990 struct ip_fw *rule;
991 int num;
992 int i;
993
994 num = 0;
995 rt->flags |= IPFW_RCFLAG_DEFAULT;
996
997 IPFW_UH_WLOCK(chain); /* arbitrate writers */
998 for (i = 0; i < chain->n_rules; i++) {
999 rule = chain->map[i];
1000 if (ipfw_match_range(rule, rt) == 0)
1001 continue;
1002 clear_counters(rule, log_only);
1003 num++;
1004 }
1005 IPFW_UH_WUNLOCK(chain);
1006
1007 return (num);
1008 }
1009
1010 static int
check_range_tlv(ipfw_range_tlv * rt)1011 check_range_tlv(ipfw_range_tlv *rt)
1012 {
1013
1014 if (rt->head.length != sizeof(*rt))
1015 return (1);
1016 if (rt->start_rule > rt->end_rule)
1017 return (1);
1018 if (rt->set >= IPFW_MAX_SETS || rt->new_set >= IPFW_MAX_SETS)
1019 return (1);
1020
1021 if ((rt->flags & IPFW_RCFLAG_USER) != rt->flags)
1022 return (1);
1023
1024 return (0);
1025 }
1026
1027 /*
1028 * Delete rules matching specified parameters
1029 * Data layout (v0)(current):
1030 * Request: [ ipfw_obj_header ipfw_range_tlv ]
1031 * Reply: [ ipfw_obj_header ipfw_range_tlv ]
1032 *
1033 * Saves number of deleted rules in ipfw_range_tlv->new_set.
1034 *
1035 * Returns 0 on success.
1036 */
1037 static int
del_rules(struct ip_fw_chain * chain,ip_fw3_opheader * op3,struct sockopt_data * sd)1038 del_rules(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
1039 struct sockopt_data *sd)
1040 {
1041 ipfw_range_header *rh;
1042 int error, ndel;
1043
1044 if (sd->valsize != sizeof(*rh))
1045 return (EINVAL);
1046
1047 rh = (ipfw_range_header *)ipfw_get_sopt_space(sd, sd->valsize);
1048
1049 if (check_range_tlv(&rh->range) != 0)
1050 return (EINVAL);
1051
1052 ndel = 0;
1053 if ((error = delete_range(chain, &rh->range, &ndel)) != 0)
1054 return (error);
1055
1056 /* Save number of rules deleted */
1057 rh->range.new_set = ndel;
1058 return (0);
1059 }
1060
1061 /*
1062 * Move rules/sets matching specified parameters
1063 * Data layout (v0)(current):
1064 * Request: [ ipfw_obj_header ipfw_range_tlv ]
1065 *
1066 * Returns 0 on success.
1067 */
1068 static int
move_rules(struct ip_fw_chain * chain,ip_fw3_opheader * op3,struct sockopt_data * sd)1069 move_rules(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
1070 struct sockopt_data *sd)
1071 {
1072 ipfw_range_header *rh;
1073
1074 if (sd->valsize != sizeof(*rh))
1075 return (EINVAL);
1076
1077 rh = (ipfw_range_header *)ipfw_get_sopt_space(sd, sd->valsize);
1078
1079 if (check_range_tlv(&rh->range) != 0)
1080 return (EINVAL);
1081
1082 return (move_range(chain, &rh->range));
1083 }
1084
1085 /*
1086 * Clear rule accounting data matching specified parameters
1087 * Data layout (v0)(current):
1088 * Request: [ ipfw_obj_header ipfw_range_tlv ]
1089 * Reply: [ ipfw_obj_header ipfw_range_tlv ]
1090 *
1091 * Saves number of cleared rules in ipfw_range_tlv->new_set.
1092 *
1093 * Returns 0 on success.
1094 */
1095 static int
clear_rules(struct ip_fw_chain * chain,ip_fw3_opheader * op3,struct sockopt_data * sd)1096 clear_rules(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
1097 struct sockopt_data *sd)
1098 {
1099 ipfw_range_header *rh;
1100 int log_only, num;
1101 char *msg;
1102
1103 if (sd->valsize != sizeof(*rh))
1104 return (EINVAL);
1105
1106 rh = (ipfw_range_header *)ipfw_get_sopt_space(sd, sd->valsize);
1107
1108 if (check_range_tlv(&rh->range) != 0)
1109 return (EINVAL);
1110
1111 log_only = (op3->opcode == IP_FW_XRESETLOG);
1112
1113 num = clear_range(chain, &rh->range, log_only);
1114
1115 if (rh->range.flags & IPFW_RCFLAG_ALL)
1116 msg = log_only ? "All logging counts reset" :
1117 "Accounting cleared";
1118 else
1119 msg = log_only ? "logging count reset" : "cleared";
1120
1121 if (V_fw_verbose) {
1122 int lev = LOG_SECURITY | LOG_NOTICE;
1123 log(lev, "ipfw: %s.\n", msg);
1124 }
1125
1126 /* Save number of rules cleared */
1127 rh->range.new_set = num;
1128 return (0);
1129 }
1130
1131 static void
enable_sets(struct ip_fw_chain * chain,ipfw_range_tlv * rt)1132 enable_sets(struct ip_fw_chain *chain, ipfw_range_tlv *rt)
1133 {
1134 uint32_t v_set;
1135
1136 IPFW_UH_WLOCK_ASSERT(chain);
1137
1138 /* Change enabled/disabled sets mask */
1139 v_set = (V_set_disable | rt->set) & ~rt->new_set;
1140 v_set &= ~(1 << RESVD_SET); /* set RESVD_SET always enabled */
1141 IPFW_WLOCK(chain);
1142 V_set_disable = v_set;
1143 IPFW_WUNLOCK(chain);
1144 }
1145
1146 static int
swap_sets(struct ip_fw_chain * chain,ipfw_range_tlv * rt,int mv)1147 swap_sets(struct ip_fw_chain *chain, ipfw_range_tlv *rt, int mv)
1148 {
1149 struct opcode_obj_rewrite *rw;
1150 struct ip_fw *rule;
1151 int i;
1152
1153 IPFW_UH_WLOCK_ASSERT(chain);
1154
1155 if (rt->set == rt->new_set) /* nothing to do */
1156 return (0);
1157
1158 if (mv != 0) {
1159 /*
1160 * Berfore moving the rules we need to check that
1161 * there aren't any conflicting named objects.
1162 */
1163 for (rw = ctl3_rewriters;
1164 rw < ctl3_rewriters + ctl3_rsize; rw++) {
1165 if (rw->manage_sets == NULL)
1166 continue;
1167 i = rw->manage_sets(chain, (uint8_t)rt->set,
1168 (uint8_t)rt->new_set, TEST_ALL);
1169 if (i != 0)
1170 return (EEXIST);
1171 }
1172 }
1173 /* Swap or move two sets */
1174 for (i = 0; i < chain->n_rules - 1; i++) {
1175 rule = chain->map[i];
1176 if (rule->set == (uint8_t)rt->set)
1177 rule->set = (uint8_t)rt->new_set;
1178 else if (rule->set == (uint8_t)rt->new_set && mv == 0)
1179 rule->set = (uint8_t)rt->set;
1180 }
1181 for (rw = ctl3_rewriters; rw < ctl3_rewriters + ctl3_rsize; rw++) {
1182 if (rw->manage_sets == NULL)
1183 continue;
1184 rw->manage_sets(chain, (uint8_t)rt->set,
1185 (uint8_t)rt->new_set, mv != 0 ? MOVE_ALL: SWAP_ALL);
1186 }
1187 return (0);
1188 }
1189
1190 /*
1191 * Swaps or moves set
1192 * Data layout (v0)(current):
1193 * Request: [ ipfw_obj_header ipfw_range_tlv ]
1194 *
1195 * Returns 0 on success.
1196 */
1197 static int
manage_sets(struct ip_fw_chain * chain,ip_fw3_opheader * op3,struct sockopt_data * sd)1198 manage_sets(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
1199 struct sockopt_data *sd)
1200 {
1201 ipfw_range_header *rh;
1202 int ret;
1203
1204 if (sd->valsize != sizeof(*rh))
1205 return (EINVAL);
1206
1207 rh = (ipfw_range_header *)ipfw_get_sopt_space(sd, sd->valsize);
1208
1209 if (rh->range.head.length != sizeof(ipfw_range_tlv))
1210 return (1);
1211 /* enable_sets() expects bitmasks. */
1212 if (op3->opcode != IP_FW_SET_ENABLE &&
1213 (rh->range.set >= IPFW_MAX_SETS ||
1214 rh->range.new_set >= IPFW_MAX_SETS))
1215 return (EINVAL);
1216
1217 ret = 0;
1218 IPFW_UH_WLOCK(chain);
1219 switch (op3->opcode) {
1220 case IP_FW_SET_SWAP:
1221 case IP_FW_SET_MOVE:
1222 ret = swap_sets(chain, &rh->range,
1223 op3->opcode == IP_FW_SET_MOVE);
1224 break;
1225 case IP_FW_SET_ENABLE:
1226 enable_sets(chain, &rh->range);
1227 break;
1228 }
1229 IPFW_UH_WUNLOCK(chain);
1230
1231 return (ret);
1232 }
1233
1234 /* Check rule format */
1235 int
ipfw_check_rule(struct ip_fw_rule * rule,size_t size,struct rule_check_info * ci)1236 ipfw_check_rule(struct ip_fw_rule *rule, size_t size,
1237 struct rule_check_info *ci)
1238 {
1239 int l;
1240
1241 if (size < sizeof(*rule)) {
1242 printf("ipfw: rule too short\n");
1243 return (EINVAL);
1244 }
1245
1246 /* Check for valid cmd_len */
1247 l = roundup2(RULESIZE(rule), sizeof(uint64_t));
1248 if (l != size) {
1249 printf("ipfw: size mismatch (have %zu want %d)\n", size, l);
1250 return (EINVAL);
1251 }
1252 if (rule->act_ofs >= rule->cmd_len) {
1253 printf("ipfw: bogus action offset (%u > %u)\n",
1254 rule->act_ofs, rule->cmd_len - 1);
1255 return (EINVAL);
1256 }
1257
1258 if (rule->rulenum > IPFW_DEFAULT_RULE - 1)
1259 return (EINVAL);
1260
1261 return (check_ipfw_rule_body(rule->cmd, rule->cmd_len, ci));
1262 }
1263
1264 #define CHECK_TARG(a, c) \
1265 ((a) == IP_FW_TARG && ((c)->flags & IPFW_RCIFLAG_HAS_STATE))
1266
1267 enum ipfw_opcheck_result
ipfw_check_opcode(ipfw_insn ** pcmd,int * plen,struct rule_check_info * ci)1268 ipfw_check_opcode(ipfw_insn **pcmd, int *plen, struct rule_check_info *ci)
1269 {
1270 ipfw_insn *cmd;
1271 size_t cmdlen;
1272
1273 cmd = *pcmd;
1274 cmdlen = F_LEN(cmd);
1275
1276 switch (cmd->opcode) {
1277 case O_PROBE_STATE:
1278 case O_KEEP_STATE:
1279 if (cmdlen != F_INSN_SIZE(ipfw_insn_kidx))
1280 return (BAD_SIZE);
1281 ci->object_opcodes++;
1282 ci->flags |= IPFW_RCIFLAG_HAS_STATE;
1283 break;
1284 case O_PROTO:
1285 case O_IP_SRC_ME:
1286 case O_IP_DST_ME:
1287 case O_LAYER2:
1288 case O_IN:
1289 case O_FRAG:
1290 case O_DIVERTED:
1291 case O_IPOPT:
1292 case O_IPTOS:
1293 case O_IPPRECEDENCE:
1294 case O_IPVER:
1295 case O_SOCKARG:
1296 case O_TCPFLAGS:
1297 case O_TCPOPTS:
1298 case O_ESTAB:
1299 case O_VERREVPATH:
1300 case O_VERSRCREACH:
1301 case O_ANTISPOOF:
1302 case O_IPSEC:
1303 #ifdef INET6
1304 case O_IP6_SRC_ME:
1305 case O_IP6_DST_ME:
1306 case O_EXT_HDR:
1307 case O_IP6:
1308 #endif
1309 case O_IP4:
1310 case O_TAG:
1311 case O_SKIP_ACTION:
1312 if (cmdlen != F_INSN_SIZE(ipfw_insn))
1313 return (BAD_SIZE);
1314 break;
1315
1316 case O_EXTERNAL_ACTION:
1317 if (cmdlen != F_INSN_SIZE(ipfw_insn_kidx))
1318 return (BAD_SIZE);
1319
1320 if (insntod(cmd, kidx)->kidx == 0)
1321 return (FAILED);
1322 ci->object_opcodes++;
1323 /*
1324 * Do we have O_EXTERNAL_INSTANCE or O_EXTERNAL_DATA
1325 * opcode?
1326 */
1327 if (*plen != cmdlen) {
1328 *plen -= cmdlen;
1329 cmd += cmdlen;
1330 *pcmd = cmd;
1331 cmdlen = F_LEN(cmd);
1332 if (cmd->opcode == O_EXTERNAL_DATA)
1333 return (CHECK_ACTION);
1334 if (cmd->opcode != O_EXTERNAL_INSTANCE) {
1335 printf("ipfw: invalid opcode "
1336 "next to external action %u\n",
1337 cmd->opcode);
1338 return (FAILED);
1339 }
1340 if (cmdlen != F_INSN_SIZE(ipfw_insn_kidx))
1341 return (BAD_SIZE);
1342 if (insntod(cmd, kidx)->kidx == 0)
1343 return (FAILED);
1344 ci->object_opcodes++;
1345 }
1346 return (CHECK_ACTION);
1347
1348 case O_FIB:
1349 if (cmdlen != F_INSN_SIZE(ipfw_insn))
1350 return (BAD_SIZE);
1351 if (cmd->arg1 >= rt_numfibs) {
1352 printf("ipfw: invalid fib number %d\n",
1353 cmd->arg1);
1354 return (FAILED);
1355 }
1356 break;
1357
1358 case O_SETFIB:
1359 if (cmdlen != F_INSN_SIZE(ipfw_insn))
1360 return (BAD_SIZE);
1361 if ((cmd->arg1 != IP_FW_TARG) &&
1362 ((cmd->arg1 & 0x7FFF) >= rt_numfibs)) {
1363 printf("ipfw: invalid fib number %d\n",
1364 cmd->arg1 & 0x7FFF);
1365 return (FAILED);
1366 }
1367 if (CHECK_TARG(cmd->arg1, ci))
1368 goto bad_targ;
1369 return (CHECK_ACTION);
1370
1371 case O_UID:
1372 case O_GID:
1373 case O_JAIL:
1374 case O_IP_SRC:
1375 case O_IP_DST:
1376 case O_TCPSEQ:
1377 case O_TCPACK:
1378 case O_PROB:
1379 case O_ICMPTYPE:
1380 if (cmdlen != F_INSN_SIZE(ipfw_insn_u32))
1381 return (BAD_SIZE);
1382 break;
1383
1384 case O_LIMIT:
1385 if (cmdlen != F_INSN_SIZE(ipfw_insn_limit))
1386 return (BAD_SIZE);
1387 ci->object_opcodes++;
1388 break;
1389
1390 case O_LOG:
1391 if (cmdlen != F_INSN_SIZE(ipfw_insn_log))
1392 return (BAD_SIZE);
1393 insntod(cmd, log)->log_left = insntod(cmd, log)->max_log;
1394 break;
1395
1396 case O_IP_SRC_MASK:
1397 case O_IP_DST_MASK:
1398 /* only odd command lengths */
1399 if ((cmdlen & 1) == 0)
1400 return (BAD_SIZE);
1401 break;
1402
1403 case O_IP_SRC_SET:
1404 case O_IP_DST_SET:
1405 if (cmd->arg1 == 0 || cmd->arg1 > 256) {
1406 printf("ipfw: invalid set size %d\n",
1407 cmd->arg1);
1408 return (FAILED);
1409 }
1410 if (cmdlen != F_INSN_SIZE(ipfw_insn_u32) +
1411 (cmd->arg1+31)/32 )
1412 return (BAD_SIZE);
1413 break;
1414
1415 case O_IP_SRC_LOOKUP:
1416 case O_IP_DST_LOOKUP:
1417 case O_IP_FLOW_LOOKUP:
1418 case O_MAC_SRC_LOOKUP:
1419 case O_MAC_DST_LOOKUP:
1420 if (cmdlen != F_INSN_SIZE(ipfw_insn_kidx) &&
1421 cmdlen != F_INSN_SIZE(ipfw_insn_lookup) &&
1422 cmdlen != F_INSN_SIZE(ipfw_insn_table))
1423 return (BAD_SIZE);
1424 if (insntod(cmd, kidx)->kidx >= V_fw_tables_max) {
1425 printf("ipfw: invalid table index %u\n",
1426 insntod(cmd, kidx)->kidx);
1427 return (FAILED);
1428 }
1429 ci->object_opcodes++;
1430 /*
1431 * XXX: compatibility layer, to be removed.
1432
1433 * ipfw_insn_table was used to match table value for u32
1434 * values and cmdlen was used to detect such intention.
1435 * A special flag is now used for that in module so
1436 * adopt legacy sbin/ipfw behavior and set it for all
1437 * lookup instructions with ipfw_insn_table opcode.
1438 *
1439 * Lookup type different from LOOKUP_NONE was used for
1440 * 32-bit bitmasking prior to lookup.
1441 * Table value matching was expected otherwise.
1442 */
1443 if (cmdlen != F_INSN_SIZE(ipfw_insn_table))
1444 break;
1445
1446 if (IPFW_LOOKUP_TYPE(cmd) != LOOKUP_NONE)
1447 IPFW_SET_LOOKUP_MASKING(cmd, 1);
1448 else
1449 IPFW_SET_LOOKUP_MATCH_TVALUE(cmd, 1);
1450 break;
1451 case O_TABLE_LOOKUP:
1452 if (cmdlen != F_INSN_SIZE(ipfw_insn_kidx) &&
1453 cmdlen != F_INSN_SIZE(ipfw_insn_lookup))
1454 return (BAD_SIZE);
1455 if (insntod(cmd, kidx)->kidx >= V_fw_tables_max) {
1456 printf("ipfw: invalid table index %u\n",
1457 insntod(cmd, kidx)->kidx);
1458 return (FAILED);
1459 }
1460 ci->object_opcodes++;
1461 break;
1462 case O_MACADDR2:
1463 if (cmdlen != F_INSN_SIZE(ipfw_insn_mac))
1464 return (BAD_SIZE);
1465 break;
1466
1467 case O_NOP:
1468 case O_IPID:
1469 case O_IPTTL:
1470 case O_IPLEN:
1471 case O_TCPDATALEN:
1472 case O_TCPMSS:
1473 case O_TCPWIN:
1474 case O_TAGGED:
1475 if (cmdlen < 1 || cmdlen > 31)
1476 return (BAD_SIZE);
1477 break;
1478
1479 case O_DSCP:
1480 case O_MARK:
1481 if (cmdlen != F_INSN_SIZE(ipfw_insn_u32) + 1)
1482 return (BAD_SIZE);
1483 break;
1484
1485 case O_MAC_TYPE:
1486 case O_IP_SRCPORT:
1487 case O_IP_DSTPORT: /* XXX artificial limit, 30 port pairs */
1488 if (cmdlen < 2 || cmdlen > 31)
1489 return (BAD_SIZE);
1490 break;
1491
1492 case O_RECV:
1493 case O_XMIT:
1494 case O_VIA:
1495 if (cmdlen != F_INSN_SIZE(ipfw_insn_if))
1496 return (BAD_SIZE);
1497 ci->object_opcodes++;
1498 break;
1499
1500 case O_ALTQ:
1501 if (cmdlen != F_INSN_SIZE(ipfw_insn_altq))
1502 return (BAD_SIZE);
1503 break;
1504
1505 case O_PIPE:
1506 case O_QUEUE:
1507 if (cmdlen != F_INSN_SIZE(ipfw_insn))
1508 return (BAD_SIZE);
1509 if (CHECK_TARG(cmd->arg1, ci))
1510 goto bad_targ;
1511 return (CHECK_ACTION);
1512
1513 case O_FORWARD_IP:
1514 if (cmdlen != F_INSN_SIZE(ipfw_insn_sa))
1515 return (BAD_SIZE);
1516 if (insntoc(cmd, sa)->sa.sin_addr.s_addr == INADDR_ANY &&
1517 (ci->flags & IPFW_RCIFLAG_HAS_STATE))
1518 goto bad_targ;
1519 return (CHECK_ACTION);
1520 #ifdef INET6
1521 case O_FORWARD_IP6:
1522 if (cmdlen != F_INSN_SIZE(ipfw_insn_sa6))
1523 return (BAD_SIZE);
1524 return (CHECK_ACTION);
1525 #endif /* INET6 */
1526
1527 case O_DIVERT:
1528 case O_TEE:
1529 if (ip_divert_ptr == NULL)
1530 return (FAILED);
1531 if (cmdlen != F_INSN_SIZE(ipfw_insn))
1532 return (BAD_SIZE);
1533 if (CHECK_TARG(cmd->arg1, ci))
1534 goto bad_targ;
1535 return (CHECK_ACTION);
1536 case O_NETGRAPH:
1537 case O_NGTEE:
1538 if (ng_ipfw_input_p == NULL)
1539 return (FAILED);
1540 if (cmdlen != F_INSN_SIZE(ipfw_insn))
1541 return (BAD_SIZE);
1542 if (CHECK_TARG(cmd->arg1, ci))
1543 goto bad_targ;
1544 return (CHECK_ACTION);
1545 case O_NAT:
1546 if (!IPFW_NAT_LOADED)
1547 return (FAILED);
1548 if (cmdlen != F_INSN_SIZE(ipfw_insn_nat))
1549 return (BAD_SIZE);
1550 if (CHECK_TARG(cmd->arg1, ci))
1551 goto bad_targ;
1552 return (CHECK_ACTION);
1553
1554 case O_SKIPTO:
1555 case O_CALLRETURN:
1556 case O_SETMARK:
1557 if (cmdlen != F_INSN_SIZE(ipfw_insn_u32))
1558 return (BAD_SIZE);
1559 /* O_CALLRETURN + F_NOT means 'return' opcode. */
1560 if (cmd->opcode != O_CALLRETURN || (cmd->len & F_NOT) == 0) {
1561 if (CHECK_TARG(insntoc(cmd, u32)->d[0], ci))
1562 goto bad_targ;
1563 }
1564 return (CHECK_ACTION);
1565
1566 case O_CHECK_STATE:
1567 if (cmdlen != F_INSN_SIZE(ipfw_insn_kidx))
1568 return (BAD_SIZE);
1569 ci->object_opcodes++;
1570 return (CHECK_ACTION);
1571
1572 case O_FORWARD_MAC: /* XXX not implemented yet */
1573 case O_COUNT:
1574 case O_ACCEPT:
1575 case O_DENY:
1576 case O_REJECT:
1577 case O_SETDSCP:
1578 #ifdef INET6
1579 case O_UNREACH6:
1580 #endif
1581 case O_REASS:
1582 if (cmdlen != F_INSN_SIZE(ipfw_insn))
1583 return (BAD_SIZE);
1584 if (cmd->opcode == O_SETDSCP && CHECK_TARG(cmd->arg1, ci))
1585 goto bad_targ;
1586 return (CHECK_ACTION);
1587 #ifdef INET6
1588 case O_IP6_SRC:
1589 case O_IP6_DST:
1590 if (cmdlen != F_INSN_SIZE(struct in6_addr) +
1591 F_INSN_SIZE(ipfw_insn))
1592 return (BAD_SIZE);
1593 break;
1594
1595 case O_FLOW6ID:
1596 if (cmdlen != F_INSN_SIZE(ipfw_insn_u32) +
1597 ((ipfw_insn_u32 *)cmd)->o.arg1)
1598 return (BAD_SIZE);
1599 break;
1600
1601 case O_IP6_SRC_MASK:
1602 case O_IP6_DST_MASK:
1603 if ( !(cmdlen & 1) || cmdlen > 127)
1604 return (BAD_SIZE);
1605 break;
1606 case O_ICMP6TYPE:
1607 if( cmdlen != F_INSN_SIZE( ipfw_insn_icmp6 ) )
1608 return (BAD_SIZE);
1609 break;
1610 #endif
1611
1612 default:
1613 switch (cmd->opcode) {
1614 #ifndef INET6
1615 case O_IP6_SRC_ME:
1616 case O_IP6_DST_ME:
1617 case O_EXT_HDR:
1618 case O_IP6:
1619 case O_UNREACH6:
1620 case O_IP6_SRC:
1621 case O_IP6_DST:
1622 case O_FLOW6ID:
1623 case O_IP6_SRC_MASK:
1624 case O_IP6_DST_MASK:
1625 case O_ICMP6TYPE:
1626 printf("ipfw: no IPv6 support in kernel\n");
1627 return (FAILED);
1628 #endif
1629 default:
1630 printf("ipfw: opcode %d: unknown opcode\n",
1631 cmd->opcode);
1632 return (FAILED);
1633 }
1634 }
1635 return (SUCCESS);
1636 bad_targ:
1637 /*
1638 * For dynamic states we can not correctly initialize tablearg value,
1639 * because we don't go through rule's opcodes except rule action.
1640 */
1641 printf("ipfw: tablearg is not allowed with dynamic states\n");
1642 return (FAILED);
1643 }
1644
1645 static __noinline int
check_ipfw_rule_body(ipfw_insn * cmd,int cmd_len,struct rule_check_info * ci)1646 check_ipfw_rule_body(ipfw_insn *cmd, int cmd_len, struct rule_check_info *ci)
1647 {
1648 int cmdlen, l;
1649 int have_action, ret;
1650
1651 /*
1652 * Now go for the individual checks. Very simple ones, basically only
1653 * instruction sizes.
1654 */
1655 have_action = 0;
1656 for (l = cmd_len; l > 0 ; l -= cmdlen, cmd += cmdlen) {
1657 cmdlen = F_LEN(cmd);
1658 if (cmdlen > l) {
1659 printf("ipfw: opcode %d: size truncated\n",
1660 cmd->opcode);
1661 return (EINVAL);
1662 }
1663 if (ci->version != IP_FW3_OPVER)
1664 ret = (*check_opcode_f)(&cmd, &l, ci);
1665 else
1666 ret = ipfw_check_opcode(&cmd, &l, ci);
1667
1668 if (ret == CHECK_ACTION) {
1669 if (have_action != 0) {
1670 printf("ipfw: opcode %d: multiple actions"
1671 " not allowed\n", cmd->opcode);
1672 ret = FAILED;
1673 } else
1674 have_action = 1;
1675
1676 if (l != F_LEN(cmd)) {
1677 printf("ipfw: opcode %d: action must be"
1678 " last opcode\n", cmd->opcode);
1679 ret = FAILED;
1680 }
1681 }
1682 switch (ret) {
1683 case SUCCESS:
1684 continue;
1685 case BAD_SIZE:
1686 printf("ipfw: opcode %d: wrong size %d\n",
1687 cmd->opcode, cmdlen);
1688 /* FALLTHROUGH */
1689 case FAILED:
1690 return (EINVAL);
1691 }
1692 }
1693 if (have_action == 0) {
1694 printf("ipfw: missing action\n");
1695 return (EINVAL);
1696 }
1697 return (0);
1698 }
1699
1700 struct dump_args {
1701 uint32_t b; /* start rule */
1702 uint32_t e; /* end rule */
1703 uint32_t rcount; /* number of rules */
1704 uint32_t rsize; /* rules size */
1705 uint32_t tcount; /* number of tables */
1706 int rcounters; /* counters */
1707 uint32_t *bmask; /* index bitmask of used named objects */
1708 };
1709
1710 void
ipfw_export_obj_ntlv(struct named_object * no,ipfw_obj_ntlv * ntlv)1711 ipfw_export_obj_ntlv(struct named_object *no, ipfw_obj_ntlv *ntlv)
1712 {
1713
1714 ntlv->head.type = no->etlv;
1715 ntlv->head.length = sizeof(*ntlv);
1716 ntlv->idx = no->kidx;
1717 strlcpy(ntlv->name, no->name, sizeof(ntlv->name));
1718 }
1719
1720 /*
1721 * Export named object info in instance @ni, identified by @kidx
1722 * to ipfw_obj_ntlv. TLV is allocated from @sd space.
1723 *
1724 * Returns 0 on success.
1725 */
1726 static int
export_objhash_ntlv(struct namedobj_instance * ni,uint32_t kidx,struct sockopt_data * sd)1727 export_objhash_ntlv(struct namedobj_instance *ni, uint32_t kidx,
1728 struct sockopt_data *sd)
1729 {
1730 struct named_object *no;
1731 ipfw_obj_ntlv *ntlv;
1732
1733 no = ipfw_objhash_lookup_kidx(ni, kidx);
1734 KASSERT(no != NULL, ("invalid object kernel index passed"));
1735
1736 ntlv = (ipfw_obj_ntlv *)ipfw_get_sopt_space(sd, sizeof(*ntlv));
1737 if (ntlv == NULL)
1738 return (ENOMEM);
1739
1740 ipfw_export_obj_ntlv(no, ntlv);
1741 return (0);
1742 }
1743
1744 static int
export_named_objects(struct namedobj_instance * ni,struct dump_args * da,struct sockopt_data * sd)1745 export_named_objects(struct namedobj_instance *ni, struct dump_args *da,
1746 struct sockopt_data *sd)
1747 {
1748 uint32_t i;
1749 int error;
1750
1751 for (i = 0; i < IPFW_TABLES_MAX && da->tcount > 0; i++) {
1752 if ((da->bmask[i / 32] & (1 << (i % 32))) == 0)
1753 continue;
1754 if ((error = export_objhash_ntlv(ni, i, sd)) != 0)
1755 return (error);
1756 da->tcount--;
1757 }
1758 return (0);
1759 }
1760
1761 static int
dump_named_objects(struct ip_fw_chain * ch,struct dump_args * da,struct sockopt_data * sd)1762 dump_named_objects(struct ip_fw_chain *ch, struct dump_args *da,
1763 struct sockopt_data *sd)
1764 {
1765 ipfw_obj_ctlv *ctlv;
1766 int error;
1767
1768 MPASS(da->tcount > 0);
1769 /* Header first */
1770 ctlv = (ipfw_obj_ctlv *)ipfw_get_sopt_space(sd, sizeof(*ctlv));
1771 if (ctlv == NULL)
1772 return (ENOMEM);
1773 ctlv->head.type = IPFW_TLV_TBLNAME_LIST;
1774 ctlv->head.length = da->tcount * sizeof(ipfw_obj_ntlv) +
1775 sizeof(*ctlv);
1776 ctlv->count = da->tcount;
1777 ctlv->objsize = sizeof(ipfw_obj_ntlv);
1778
1779 /* Dump table names first (if any) */
1780 error = export_named_objects(ipfw_get_table_objhash(ch), da, sd);
1781 if (error != 0)
1782 return (error);
1783 /* Then dump another named objects */
1784 da->bmask += IPFW_TABLES_MAX / 32;
1785 return (export_named_objects(CHAIN_TO_SRV(ch), da, sd));
1786 }
1787
1788 /*
1789 * Dumps static rules with table TLVs in buffer @sd.
1790 *
1791 * Returns 0 on success.
1792 */
1793 static int
dump_static_rules(struct ip_fw_chain * chain,struct dump_args * da,struct sockopt_data * sd)1794 dump_static_rules(struct ip_fw_chain *chain, struct dump_args *da,
1795 struct sockopt_data *sd)
1796 {
1797 ipfw_obj_ctlv *ctlv;
1798 struct ip_fw *krule;
1799 caddr_t dst;
1800 int i, l;
1801
1802 /* Dump rules */
1803 ctlv = (ipfw_obj_ctlv *)ipfw_get_sopt_space(sd, sizeof(*ctlv));
1804 if (ctlv == NULL)
1805 return (ENOMEM);
1806 ctlv->head.type = IPFW_TLV_RULE_LIST;
1807 ctlv->head.length = da->rsize + sizeof(*ctlv);
1808 ctlv->count = da->rcount;
1809
1810 for (i = da->b; i < da->e; i++) {
1811 krule = chain->map[i];
1812
1813 l = RULEUSIZE1(krule) + sizeof(ipfw_obj_tlv);
1814 if (da->rcounters != 0)
1815 l += sizeof(struct ip_fw_bcounter);
1816 dst = (caddr_t)ipfw_get_sopt_space(sd, l);
1817 if (dst == NULL)
1818 return (ENOMEM);
1819
1820 export_rule1(krule, dst, l, da->rcounters);
1821 }
1822
1823 return (0);
1824 }
1825
1826 int
ipfw_mark_object_kidx(uint32_t * bmask,uint16_t etlv,uint32_t kidx)1827 ipfw_mark_object_kidx(uint32_t *bmask, uint16_t etlv, uint32_t kidx)
1828 {
1829 uint32_t bidx;
1830
1831 /*
1832 * Maintain separate bitmasks for table and non-table objects.
1833 */
1834 bidx = (etlv == IPFW_TLV_TBL_NAME) ? 0: IPFW_TABLES_MAX / 32;
1835 bidx += kidx / 32;
1836 if ((bmask[bidx] & (1 << (kidx % 32))) != 0)
1837 return (0);
1838
1839 bmask[bidx] |= 1 << (kidx % 32);
1840 return (1);
1841 }
1842
1843 /*
1844 * Marks every object index used in @rule with bit in @bmask.
1845 * Used to generate bitmask of referenced tables/objects for given ruleset
1846 * or its part.
1847 */
1848 static void
mark_rule_objects(struct ip_fw_chain * ch,struct ip_fw * rule,struct dump_args * da)1849 mark_rule_objects(struct ip_fw_chain *ch, struct ip_fw *rule,
1850 struct dump_args *da)
1851 {
1852 struct opcode_obj_rewrite *rw;
1853 ipfw_insn *cmd;
1854 uint32_t kidx;
1855 int cmdlen, l;
1856 uint8_t subtype;
1857
1858 l = rule->cmd_len;
1859 cmd = rule->cmd;
1860 cmdlen = 0;
1861 for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) {
1862 cmdlen = F_LEN(cmd);
1863
1864 rw = find_op_rw(cmd, &kidx, &subtype);
1865 if (rw == NULL)
1866 continue;
1867
1868 if (ipfw_mark_object_kidx(da->bmask, rw->etlv, kidx))
1869 da->tcount++;
1870 }
1871 }
1872
1873 /*
1874 * Dumps requested objects data
1875 * Data layout (version 0)(current):
1876 * Request: [ ipfw_cfg_lheader ] + IPFW_CFG_GET_* flags
1877 * size = ipfw_cfg_lheader.size
1878 * Reply: [ ipfw_cfg_lheader
1879 * [ ipfw_obj_ctlv(IPFW_TLV_TBL_LIST) ipfw_obj_ntlv x N ] (optional)
1880 * [ ipfw_obj_ctlv(IPFW_TLV_RULE_LIST)
1881 * ipfw_obj_tlv(IPFW_TLV_RULE_ENT) [ ip_fw_bcounter (optional) ip_fw_rule ]
1882 * ] (optional)
1883 * [ ipfw_obj_ctlv(IPFW_TLV_STATE_LIST) ipfw_obj_dyntlv x N ] (optional)
1884 * ]
1885 * * NOTE IPFW_TLV_STATE_LIST has the single valid field: objsize.
1886 * The rest (size, count) are set to zero and needs to be ignored.
1887 *
1888 * Returns 0 on success.
1889 */
1890 static int
dump_config(struct ip_fw_chain * chain,ip_fw3_opheader * op3,struct sockopt_data * sd)1891 dump_config(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
1892 struct sockopt_data *sd)
1893 {
1894 struct dump_args da;
1895 ipfw_cfg_lheader *hdr;
1896 struct ip_fw *rule;
1897 size_t sz, rnum;
1898 uint32_t hdr_flags, *bmask;
1899 int error, i;
1900
1901 hdr = (ipfw_cfg_lheader *)ipfw_get_sopt_header(sd, sizeof(*hdr));
1902 if (hdr == NULL)
1903 return (EINVAL);
1904
1905 error = 0;
1906 bmask = NULL;
1907 memset(&da, 0, sizeof(da));
1908 /*
1909 * Allocate needed state.
1910 * Note we allocate 2xspace mask, for table & srv
1911 */
1912 if (hdr->flags & (IPFW_CFG_GET_STATIC | IPFW_CFG_GET_STATES))
1913 da.bmask = bmask = malloc(
1914 sizeof(uint32_t) * IPFW_TABLES_MAX * 2 / 32, M_TEMP,
1915 M_WAITOK | M_ZERO);
1916 IPFW_UH_RLOCK(chain);
1917
1918 /*
1919 * STAGE 1: Determine size/count for objects in range.
1920 * Prepare used tables bitmask.
1921 */
1922 sz = sizeof(ipfw_cfg_lheader);
1923 da.e = chain->n_rules;
1924
1925 if (hdr->end_rule != 0) {
1926 /* Handle custom range */
1927 if ((rnum = hdr->start_rule) > IPFW_DEFAULT_RULE)
1928 rnum = IPFW_DEFAULT_RULE;
1929 da.b = ipfw_find_rule(chain, rnum, 0);
1930 rnum = (hdr->end_rule < IPFW_DEFAULT_RULE) ?
1931 hdr->end_rule + 1: IPFW_DEFAULT_RULE;
1932 da.e = ipfw_find_rule(chain, rnum, UINT32_MAX) + 1;
1933 }
1934
1935 if (hdr->flags & IPFW_CFG_GET_STATIC) {
1936 for (i = da.b; i < da.e; i++) {
1937 rule = chain->map[i];
1938 da.rsize += RULEUSIZE1(rule) + sizeof(ipfw_obj_tlv);
1939 da.rcount++;
1940 /* Update bitmask of used objects for given range */
1941 mark_rule_objects(chain, rule, &da);
1942 }
1943 /* Add counters if requested */
1944 if (hdr->flags & IPFW_CFG_GET_COUNTERS) {
1945 da.rsize += sizeof(struct ip_fw_bcounter) * da.rcount;
1946 da.rcounters = 1;
1947 }
1948 sz += da.rsize + sizeof(ipfw_obj_ctlv);
1949 }
1950
1951 if (hdr->flags & IPFW_CFG_GET_STATES) {
1952 sz += sizeof(ipfw_obj_ctlv) +
1953 ipfw_dyn_get_count(bmask, &i) * sizeof(ipfw_obj_dyntlv);
1954 da.tcount += i;
1955 }
1956
1957 if (da.tcount > 0)
1958 sz += da.tcount * sizeof(ipfw_obj_ntlv) +
1959 sizeof(ipfw_obj_ctlv);
1960
1961 /*
1962 * Fill header anyway.
1963 * Note we have to save header fields to stable storage
1964 * buffer inside @sd can be flushed after dumping rules
1965 */
1966 hdr->size = sz;
1967 hdr->set_mask = ~V_set_disable;
1968 hdr_flags = hdr->flags;
1969 hdr = NULL;
1970
1971 if (sd->valsize < sz) {
1972 error = ENOMEM;
1973 goto cleanup;
1974 }
1975
1976 /* STAGE2: Store actual data */
1977 if (da.tcount > 0) {
1978 error = dump_named_objects(chain, &da, sd);
1979 if (error != 0)
1980 goto cleanup;
1981 }
1982
1983 if (hdr_flags & IPFW_CFG_GET_STATIC) {
1984 error = dump_static_rules(chain, &da, sd);
1985 if (error != 0)
1986 goto cleanup;
1987 }
1988
1989 if (hdr_flags & IPFW_CFG_GET_STATES)
1990 error = ipfw_dump_states(chain, sd);
1991
1992 cleanup:
1993 IPFW_UH_RUNLOCK(chain);
1994
1995 if (bmask != NULL)
1996 free(bmask, M_TEMP);
1997
1998 return (error);
1999 }
2000
2001 int
ipfw_check_object_name_generic(const char * name)2002 ipfw_check_object_name_generic(const char *name)
2003 {
2004 int nsize;
2005
2006 nsize = sizeof(((ipfw_obj_ntlv *)0)->name);
2007 if (strnlen(name, nsize) == nsize)
2008 return (EINVAL);
2009 if (name[0] == '\0')
2010 return (EINVAL);
2011 return (0);
2012 }
2013
2014 /*
2015 * Creates non-existent objects referenced by rule.
2016 *
2017 * Return 0 on success.
2018 */
2019 static int
create_objects_compat(struct ip_fw_chain * ch,ipfw_insn * cmd,struct obj_idx * oib,struct obj_idx * pidx,struct tid_info * ti)2020 create_objects_compat(struct ip_fw_chain *ch, ipfw_insn *cmd,
2021 struct obj_idx *oib, struct obj_idx *pidx, struct tid_info *ti)
2022 {
2023 struct opcode_obj_rewrite *rw;
2024 struct obj_idx *p;
2025 uint32_t kidx;
2026 int error;
2027
2028 /*
2029 * Compatibility stuff: do actual creation for non-existing,
2030 * but referenced objects.
2031 */
2032 for (p = oib; p < pidx; p++) {
2033 if (p->kidx != 0)
2034 continue;
2035
2036 ti->uidx = p->uidx;
2037 ti->type = p->type;
2038 ti->atype = 0;
2039
2040 rw = find_op_rw(cmd + p->off, NULL, NULL);
2041 KASSERT(rw != NULL, ("Unable to find handler for op %d",
2042 (cmd + p->off)->opcode));
2043
2044 if (rw->create_object == NULL)
2045 error = EOPNOTSUPP;
2046 else
2047 error = rw->create_object(ch, ti, &kidx);
2048 if (error == 0) {
2049 p->kidx = kidx;
2050 continue;
2051 }
2052
2053 /*
2054 * Error happened. We have to rollback everything.
2055 * Drop all already acquired references.
2056 */
2057 IPFW_UH_WLOCK(ch);
2058 unref_oib_objects(ch, cmd, oib, pidx);
2059 IPFW_UH_WUNLOCK(ch);
2060
2061 return (error);
2062 }
2063
2064 return (0);
2065 }
2066
2067 /*
2068 * Unreferences all already-referenced objects in given @cmd rule,
2069 * using information in @oib.
2070 *
2071 * Used to rollback partially converted rule on error.
2072 */
2073 static void
unref_oib_objects(struct ip_fw_chain * ch,ipfw_insn * cmd,struct obj_idx * oib,struct obj_idx * end)2074 unref_oib_objects(struct ip_fw_chain *ch, ipfw_insn *cmd, struct obj_idx *oib,
2075 struct obj_idx *end)
2076 {
2077 struct opcode_obj_rewrite *rw;
2078 struct named_object *no;
2079 struct obj_idx *p;
2080
2081 IPFW_UH_WLOCK_ASSERT(ch);
2082
2083 for (p = oib; p < end; p++) {
2084 if (p->kidx == 0)
2085 continue;
2086
2087 rw = find_op_rw(cmd + p->off, NULL, NULL);
2088 KASSERT(rw != NULL, ("Unable to find handler for op %d",
2089 (cmd + p->off)->opcode));
2090
2091 /* Find & unref by existing idx */
2092 no = rw->find_bykidx(ch, p->kidx);
2093 KASSERT(no != NULL, ("Ref'd object %d disappeared", p->kidx));
2094 no->refcnt--;
2095 }
2096 }
2097
2098 /*
2099 * Remove references from every object used in @rule.
2100 * Used at rule removal code.
2101 */
2102 static void
unref_rule_objects(struct ip_fw_chain * ch,struct ip_fw * rule)2103 unref_rule_objects(struct ip_fw_chain *ch, struct ip_fw *rule)
2104 {
2105 struct opcode_obj_rewrite *rw;
2106 struct named_object *no;
2107 ipfw_insn *cmd;
2108 uint32_t kidx;
2109 int cmdlen, l;
2110 uint8_t subtype;
2111
2112 IPFW_UH_WLOCK_ASSERT(ch);
2113
2114 l = rule->cmd_len;
2115 cmd = rule->cmd;
2116 cmdlen = 0;
2117 for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) {
2118 cmdlen = F_LEN(cmd);
2119
2120 rw = find_op_rw(cmd, &kidx, &subtype);
2121 if (rw == NULL)
2122 continue;
2123 no = rw->find_bykidx(ch, kidx);
2124
2125 KASSERT(no != NULL, ("object id %d not found", kidx));
2126 KASSERT(no->subtype == subtype,
2127 ("wrong type %d (%d) for object id %d",
2128 no->subtype, subtype, kidx));
2129 KASSERT(no->refcnt > 0, ("refcount for object %d is %d",
2130 kidx, no->refcnt));
2131
2132 if (no->refcnt == 1 && rw->destroy_object != NULL)
2133 rw->destroy_object(ch, no);
2134 else
2135 no->refcnt--;
2136 }
2137 if (ACTION_PTR(rule)->opcode == O_LOG)
2138 ipfw_tap_free(ch, rule->rulenum);
2139 }
2140
2141 /*
2142 * Find and reference object (if any) stored in instruction @cmd.
2143 *
2144 * Saves object info in @pidx, sets
2145 * - @unresolved to 1 if object should exists but not found
2146 *
2147 * Returns non-zero value in case of error.
2148 */
2149 static int
ref_opcode_object(struct ip_fw_chain * ch,ipfw_insn * cmd,struct tid_info * ti,struct obj_idx * pidx,int * unresolved)2150 ref_opcode_object(struct ip_fw_chain *ch, ipfw_insn *cmd, struct tid_info *ti,
2151 struct obj_idx *pidx, int *unresolved)
2152 {
2153 struct named_object *no;
2154 struct opcode_obj_rewrite *rw;
2155 int error;
2156
2157 /* Check if this opcode is candidate for rewrite */
2158 rw = find_op_rw(cmd, &ti->uidx, &ti->type);
2159 if (rw == NULL)
2160 return (0);
2161
2162 /* Need to rewrite. Save necessary fields */
2163 pidx->uidx = ti->uidx;
2164 pidx->type = ti->type;
2165
2166 /* Try to find referenced kernel object */
2167 error = rw->find_byname(ch, ti, &no);
2168 if (error != 0)
2169 return (error);
2170 if (no == NULL) {
2171 /*
2172 * Report about unresolved object for automaic
2173 * creation.
2174 */
2175 *unresolved = 1;
2176 return (0);
2177 }
2178
2179 /*
2180 * Object is already exist.
2181 * Its subtype should match with expected value.
2182 */
2183 if (ti->type != no->subtype)
2184 return (EINVAL);
2185
2186 /* Bump refcount and update kidx. */
2187 no->refcnt++;
2188 rw->update(cmd, no->kidx);
2189 return (0);
2190 }
2191
2192 /*
2193 * Finds and bumps refcount for objects referenced by given @rule.
2194 * Auto-creates non-existing tables.
2195 * Fills in @oib array with userland/kernel indexes.
2196 *
2197 * Returns 0 on success.
2198 */
2199 static int
ref_rule_objects(struct ip_fw_chain * ch,struct ip_fw * rule,struct rule_check_info * ci,struct obj_idx * oib,struct tid_info * ti)2200 ref_rule_objects(struct ip_fw_chain *ch, struct ip_fw *rule,
2201 struct rule_check_info *ci, struct obj_idx *oib, struct tid_info *ti)
2202 {
2203 struct obj_idx *pidx;
2204 ipfw_insn *cmd;
2205 int cmdlen, error, l, unresolved;
2206
2207 pidx = oib;
2208 l = rule->cmd_len;
2209 cmd = rule->cmd;
2210 cmdlen = 0;
2211 error = 0;
2212
2213 IPFW_UH_WLOCK_ASSERT(ch);
2214
2215 /* Increase refcount on each existing referenced table. */
2216 for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) {
2217 cmdlen = F_LEN(cmd);
2218 unresolved = 0;
2219
2220 error = ref_opcode_object(ch, cmd, ti, pidx, &unresolved);
2221 if (error != 0)
2222 break;
2223 /*
2224 * Compatibility stuff for old clients:
2225 * prepare to automaitcally create non-existing objects.
2226 */
2227 if (unresolved != 0) {
2228 pidx->off = rule->cmd_len - l;
2229 pidx++;
2230 }
2231 }
2232
2233 if (error != 0) {
2234 /* Unref everything we have already done */
2235 unref_oib_objects(ch, rule->cmd, oib, pidx);
2236 return (error);
2237 }
2238
2239 /* Perform auto-creation for non-existing objects */
2240 if (pidx != oib)
2241 error = create_objects_compat(ch, rule->cmd, oib, pidx, ti);
2242
2243 /* Calculate real number of dynamic objects */
2244 ci->object_opcodes = (uint16_t)(pidx - oib);
2245
2246 return (error);
2247 }
2248
2249 /*
2250 * Checks is opcode is referencing table of appropriate type.
2251 * Adds reference count for found table if true.
2252 * Rewrites user-supplied opcode values with kernel ones.
2253 *
2254 * Returns 0 on success and appropriate error code otherwise.
2255 */
2256 static int
rewrite_rule_uidx(struct ip_fw_chain * chain,struct rule_check_info * ci)2257 rewrite_rule_uidx(struct ip_fw_chain *chain, struct rule_check_info *ci)
2258 {
2259 int error;
2260 ipfw_insn *cmd;
2261 struct obj_idx *p, *pidx_first, *pidx_last;
2262 struct tid_info ti;
2263
2264 /*
2265 * Prepare an array for storing opcode indices.
2266 * Use stack allocation by default.
2267 */
2268 if (ci->object_opcodes <= (sizeof(ci->obuf)/sizeof(ci->obuf[0]))) {
2269 /* Stack */
2270 pidx_first = ci->obuf;
2271 } else
2272 pidx_first = malloc(
2273 ci->object_opcodes * sizeof(struct obj_idx),
2274 M_IPFW, M_WAITOK | M_ZERO);
2275
2276 error = 0;
2277 memset(&ti, 0, sizeof(ti));
2278
2279 /* Use set rule is assigned to. */
2280 ti.set = ci->krule->set;
2281 if (ci->ctlv != NULL) {
2282 ti.tlvs = (void *)(ci->ctlv + 1);
2283 ti.tlen = ci->ctlv->head.length - sizeof(ipfw_obj_ctlv);
2284 }
2285
2286 /* Reference all used tables and other objects */
2287 error = ref_rule_objects(chain, ci->krule, ci, pidx_first, &ti);
2288 if (error != 0)
2289 goto free;
2290 /*
2291 * Note that ref_rule_objects() might have updated ci->object_opcodes
2292 * to reflect actual number of object opcodes.
2293 */
2294
2295 /* Perform rewrite of remaining opcodes */
2296 p = pidx_first;
2297 pidx_last = pidx_first + ci->object_opcodes;
2298 for (p = pidx_first; p < pidx_last; p++) {
2299 cmd = ci->krule->cmd + p->off;
2300 update_opcode_kidx(cmd, p->kidx);
2301 }
2302
2303 free:
2304 if (pidx_first != ci->obuf)
2305 free(pidx_first, M_IPFW);
2306
2307 return (error);
2308 }
2309
2310 /*
2311 * Parses one or more rules from userland.
2312 * Data layout (version 1)(current):
2313 * Request:
2314 * [
2315 * ip_fw3_opheader
2316 * [ ipfw_obj_ctlv(IPFW_TLV_TBL_LIST) ipfw_obj_ntlv x N ] (optional *1)
2317 * [ ipfw_obj_ctlv(IPFW_TLV_RULE_LIST) ip_fw x N ] (*2) (*3)
2318 * ]
2319 * Reply:
2320 * [
2321 * ip_fw3_opheader
2322 * [ ipfw_obj_ctlv(IPFW_TLV_TBL_LIST) ipfw_obj_ntlv x N ] (optional)
2323 * [ ipfw_obj_ctlv(IPFW_TLV_RULE_LIST) ip_fw x N ]
2324 * ]
2325 *
2326 * Rules in reply are modified to store their actual ruleset number.
2327 *
2328 * (*1) TLVs inside IPFW_TLV_TBL_LIST needs to be sorted ascending
2329 * according to their idx field and there has to be no duplicates.
2330 * (*2) Numbered rules inside IPFW_TLV_RULE_LIST needs to be sorted ascending.
2331 * (*3) Each ip_fw structure needs to be aligned to u64 boundary.
2332 *
2333 * Returns 0 on success.
2334 */
2335 static __noinline int
parse_rules_v1(struct ip_fw_chain * chain,ip_fw3_opheader * op3,struct sockopt_data * sd,ipfw_obj_ctlv ** prtlv,struct rule_check_info ** pci)2336 parse_rules_v1(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
2337 struct sockopt_data *sd, ipfw_obj_ctlv **prtlv,
2338 struct rule_check_info **pci)
2339 {
2340 ipfw_obj_ctlv *ctlv, *rtlv, *tstate;
2341 ipfw_obj_ntlv *ntlv;
2342 struct rule_check_info *ci, *cbuf;
2343 struct ip_fw_rule *r;
2344 size_t count, clen, read, rsize;
2345 uint32_t idx, rulenum;
2346 int error;
2347
2348 op3 = (ip_fw3_opheader *)ipfw_get_sopt_space(sd, sd->valsize);
2349 ctlv = (ipfw_obj_ctlv *)(op3 + 1);
2350 read = sizeof(ip_fw3_opheader);
2351 if (read + sizeof(*ctlv) > sd->valsize)
2352 return (EINVAL);
2353
2354 rtlv = NULL;
2355 tstate = NULL;
2356 cbuf = NULL;
2357 /* Table names or other named objects. */
2358 if (ctlv->head.type == IPFW_TLV_TBLNAME_LIST) {
2359 /* Check size and alignment. */
2360 clen = ctlv->head.length;
2361 if (read + clen > sd->valsize || clen < sizeof(*ctlv) ||
2362 (clen % sizeof(uint64_t)) != 0)
2363 return (EINVAL);
2364 /* Check for validness. */
2365 count = (ctlv->head.length - sizeof(*ctlv)) / sizeof(*ntlv);
2366 if (ctlv->count != count || ctlv->objsize != sizeof(*ntlv))
2367 return (EINVAL);
2368 /*
2369 * Check each TLV.
2370 * Ensure TLVs are sorted ascending and
2371 * there are no duplicates.
2372 */
2373 idx = 0;
2374 ntlv = (ipfw_obj_ntlv *)(ctlv + 1);
2375 while (count > 0) {
2376 if (ntlv->head.length != sizeof(ipfw_obj_ntlv))
2377 return (EINVAL);
2378
2379 error = ipfw_check_object_name_generic(ntlv->name);
2380 if (error != 0)
2381 return (error);
2382
2383 if (ntlv->idx <= idx)
2384 return (EINVAL);
2385
2386 idx = ntlv->idx;
2387 count--;
2388 ntlv++;
2389 }
2390
2391 tstate = ctlv;
2392 read += ctlv->head.length;
2393 ctlv = (ipfw_obj_ctlv *)((caddr_t)ctlv + ctlv->head.length);
2394
2395 if (read + sizeof(*ctlv) > sd->valsize)
2396 return (EINVAL);
2397 }
2398
2399 /* List of rules. */
2400 if (ctlv->head.type == IPFW_TLV_RULE_LIST) {
2401 clen = ctlv->head.length;
2402 if (read + clen > sd->valsize || clen < sizeof(*ctlv) ||
2403 (clen % sizeof(uint64_t)) != 0)
2404 return (EINVAL);
2405
2406 clen -= sizeof(*ctlv);
2407 if (ctlv->count == 0 ||
2408 ctlv->count > clen / sizeof(struct ip_fw_rule))
2409 return (EINVAL);
2410
2411 /* Allocate state for each rule */
2412 cbuf = malloc(ctlv->count * sizeof(struct rule_check_info),
2413 M_TEMP, M_WAITOK | M_ZERO);
2414
2415 /*
2416 * Check each rule for validness.
2417 * Ensure numbered rules are sorted ascending
2418 * and properly aligned
2419 */
2420 rulenum = 0;
2421 count = 0;
2422 error = 0;
2423 ci = cbuf;
2424 r = (struct ip_fw_rule *)(ctlv + 1);
2425 while (clen > 0) {
2426 rsize = RULEUSIZE1(r);
2427 if (rsize > clen || count > ctlv->count) {
2428 error = EINVAL;
2429 break;
2430 }
2431 ci->ctlv = tstate;
2432 ci->version = IP_FW3_OPVER;
2433 error = ipfw_check_rule(r, rsize, ci);
2434 if (error != 0)
2435 break;
2436
2437 /* Check sorting */
2438 if (count != 0 && ((rulenum == 0) != (r->rulenum == 0) ||
2439 r->rulenum < rulenum)) {
2440 printf("ipfw: wrong order: rulenum %u"
2441 " vs %u\n", r->rulenum, rulenum);
2442 error = EINVAL;
2443 break;
2444 }
2445 rulenum = r->rulenum;
2446 ci->urule = (caddr_t)r;
2447 clen -= rsize;
2448 r = (struct ip_fw_rule *)((caddr_t)r + rsize);
2449 count++;
2450 ci++;
2451 }
2452
2453 if (ctlv->count != count || error != 0) {
2454 free(cbuf, M_TEMP);
2455 return (EINVAL);
2456 }
2457
2458 rtlv = ctlv;
2459 read += ctlv->head.length;
2460 ctlv = (ipfw_obj_ctlv *)((caddr_t)ctlv + ctlv->head.length);
2461 }
2462
2463 if (read != sd->valsize || rtlv == NULL) {
2464 free(cbuf, M_TEMP);
2465 return (EINVAL);
2466 }
2467
2468 *prtlv = rtlv;
2469 *pci = cbuf;
2470 return (0);
2471 }
2472
2473 /*
2474 * Copy rule @urule from v1 userland format (current) to kernel @krule.
2475 */
2476 static void
import_rule_v1(struct ip_fw_chain * chain,struct rule_check_info * ci)2477 import_rule_v1(struct ip_fw_chain *chain, struct rule_check_info *ci)
2478 {
2479 struct ip_fw_rule *urule;
2480 struct ip_fw *krule;
2481
2482 urule = (struct ip_fw_rule *)ci->urule;
2483 krule = ci->krule = ipfw_alloc_rule(chain, RULEKSIZE1(urule));
2484
2485 krule->act_ofs = urule->act_ofs;
2486 krule->cmd_len = urule->cmd_len;
2487 krule->rulenum = urule->rulenum;
2488 krule->set = urule->set;
2489 krule->flags = urule->flags;
2490
2491 /* Save rulenum offset */
2492 ci->urule_numoff = offsetof(struct ip_fw_rule, rulenum);
2493
2494 /* Copy opcodes */
2495 memcpy(krule->cmd, urule->cmd, krule->cmd_len * sizeof(uint32_t));
2496 }
2497
2498 /*
2499 * Adds one or more rules to ipfw @chain.
2500 */
2501 static int
add_rules(struct ip_fw_chain * chain,ip_fw3_opheader * op3,struct sockopt_data * sd)2502 add_rules(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
2503 struct sockopt_data *sd)
2504 {
2505 ipfw_obj_ctlv *rtlv;
2506 struct rule_check_info *ci, *nci;
2507 int i, ret;
2508
2509 /*
2510 * Check rules buffer for validness.
2511 */
2512 ret = parse_rules_v1(chain, op3, sd, &rtlv, &nci);
2513 if (ret != 0)
2514 return (ret);
2515 /*
2516 * Allocate storage for the kernel representation of rules.
2517 */
2518 for (i = 0, ci = nci; i < rtlv->count; i++, ci++)
2519 import_rule_v1(chain, ci);
2520 /*
2521 * Try to add new rules to the chain.
2522 */
2523 if ((ret = ipfw_commit_rules(chain, nci, rtlv->count)) != 0) {
2524 for (i = 0, ci = nci; i < rtlv->count; i++, ci++)
2525 ipfw_free_rule(ci->krule);
2526 }
2527 /* Cleanup after parse_rules() */
2528 free(nci, M_TEMP);
2529 return (ret);
2530 }
2531
2532 /*
2533 * Lists all sopts currently registered.
2534 * Data layout (v1)(current):
2535 * Request: [ ipfw_obj_lheader ], size = ipfw_obj_lheader.size
2536 * Reply: [ ipfw_obj_lheader ipfw_sopt_info x N ]
2537 *
2538 * Returns 0 on success
2539 */
2540 static int
dump_soptcodes(struct ip_fw_chain * chain,ip_fw3_opheader * op3,struct sockopt_data * sd)2541 dump_soptcodes(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
2542 struct sockopt_data *sd)
2543 {
2544 struct _ipfw_obj_lheader *olh;
2545 ipfw_sopt_info *i;
2546 struct ipfw_sopt_handler *sh;
2547 uint32_t count, n, size;
2548
2549 olh = (struct _ipfw_obj_lheader *)ipfw_get_sopt_header(sd,
2550 sizeof(*olh));
2551 if (olh == NULL)
2552 return (EINVAL);
2553 if (sd->valsize < olh->size)
2554 return (EINVAL);
2555
2556 CTL3_LOCK();
2557 count = ctl3_hsize;
2558 size = count * sizeof(ipfw_sopt_info) + sizeof(ipfw_obj_lheader);
2559
2560 /* Fill in header regadless of buffer size */
2561 olh->count = count;
2562 olh->objsize = sizeof(ipfw_sopt_info);
2563
2564 if (size > olh->size) {
2565 olh->size = size;
2566 CTL3_UNLOCK();
2567 return (ENOMEM);
2568 }
2569 olh->size = size;
2570
2571 for (n = 0; n < count; n++) {
2572 i = (ipfw_sopt_info *)ipfw_get_sopt_space(sd, sizeof(*i));
2573 KASSERT(i != NULL, ("previously checked buffer is not enough"));
2574 sh = &ctl3_handlers[n];
2575 i->opcode = sh->opcode;
2576 i->version = sh->version;
2577 i->refcnt = sh->refcnt;
2578 }
2579 CTL3_UNLOCK();
2580
2581 return (0);
2582 }
2583
2584 /*
2585 * Compares two opcodes.
2586 * Used both in qsort() and bsearch().
2587 *
2588 * Returns 0 if match is found.
2589 */
2590 static int
compare_opcodes(const void * _a,const void * _b)2591 compare_opcodes(const void *_a, const void *_b)
2592 {
2593 const struct opcode_obj_rewrite *a, *b;
2594
2595 a = (const struct opcode_obj_rewrite *)_a;
2596 b = (const struct opcode_obj_rewrite *)_b;
2597
2598 if (a->opcode < b->opcode)
2599 return (-1);
2600 else if (a->opcode > b->opcode)
2601 return (1);
2602
2603 return (0);
2604 }
2605
2606 /*
2607 * XXX: Rewrite bsearch()
2608 */
2609 static int
find_op_rw_range(uint16_t op,struct opcode_obj_rewrite ** plo,struct opcode_obj_rewrite ** phi)2610 find_op_rw_range(uint16_t op, struct opcode_obj_rewrite **plo,
2611 struct opcode_obj_rewrite **phi)
2612 {
2613 struct opcode_obj_rewrite *ctl3_max, *lo, *hi, h, *rw;
2614
2615 memset(&h, 0, sizeof(h));
2616 h.opcode = op;
2617
2618 rw = (struct opcode_obj_rewrite *)bsearch(&h, ctl3_rewriters,
2619 ctl3_rsize, sizeof(h), compare_opcodes);
2620 if (rw == NULL)
2621 return (1);
2622
2623 /* Find the first element matching the same opcode */
2624 lo = rw;
2625 for ( ; lo > ctl3_rewriters && (lo - 1)->opcode == op; lo--)
2626 ;
2627
2628 /* Find the last element matching the same opcode */
2629 hi = rw;
2630 ctl3_max = ctl3_rewriters + ctl3_rsize;
2631 for ( ; (hi + 1) < ctl3_max && (hi + 1)->opcode == op; hi++)
2632 ;
2633
2634 *plo = lo;
2635 *phi = hi;
2636
2637 return (0);
2638 }
2639
2640 /*
2641 * Finds opcode object rewriter based on @code.
2642 *
2643 * Returns pointer to handler or NULL.
2644 */
2645 static struct opcode_obj_rewrite *
find_op_rw(ipfw_insn * cmd,uint32_t * puidx,uint8_t * ptype)2646 find_op_rw(ipfw_insn *cmd, uint32_t *puidx, uint8_t *ptype)
2647 {
2648 struct opcode_obj_rewrite *rw, *lo, *hi;
2649 uint32_t uidx;
2650 uint8_t subtype;
2651
2652 if (find_op_rw_range(cmd->opcode, &lo, &hi) != 0)
2653 return (NULL);
2654
2655 for (rw = lo; rw <= hi; rw++) {
2656 if (rw->classifier(cmd, &uidx, &subtype) == 0) {
2657 if (puidx != NULL)
2658 *puidx = uidx;
2659 if (ptype != NULL)
2660 *ptype = subtype;
2661 return (rw);
2662 }
2663 }
2664
2665 return (NULL);
2666 }
2667 int
classify_opcode_kidx(ipfw_insn * cmd,uint32_t * puidx)2668 classify_opcode_kidx(ipfw_insn *cmd, uint32_t *puidx)
2669 {
2670
2671 if (find_op_rw(cmd, puidx, NULL) == NULL)
2672 return (1);
2673 return (0);
2674 }
2675
2676 void
update_opcode_kidx(ipfw_insn * cmd,uint32_t idx)2677 update_opcode_kidx(ipfw_insn *cmd, uint32_t idx)
2678 {
2679 struct opcode_obj_rewrite *rw;
2680
2681 rw = find_op_rw(cmd, NULL, NULL);
2682 KASSERT(rw != NULL, ("No handler to update opcode %d", cmd->opcode));
2683 rw->update(cmd, idx);
2684 }
2685
2686 void
ipfw_init_obj_rewriter(void)2687 ipfw_init_obj_rewriter(void)
2688 {
2689 ctl3_rewriters = NULL;
2690 ctl3_rsize = 0;
2691 }
2692
2693 void
ipfw_destroy_obj_rewriter(void)2694 ipfw_destroy_obj_rewriter(void)
2695 {
2696 if (ctl3_rewriters != NULL)
2697 free(ctl3_rewriters, M_IPFW);
2698 ctl3_rewriters = NULL;
2699 ctl3_rsize = 0;
2700 }
2701
2702 /*
2703 * Adds one or more opcode object rewrite handlers to the global array.
2704 * Function may sleep.
2705 */
2706 void
ipfw_add_obj_rewriter(struct opcode_obj_rewrite * rw,size_t count)2707 ipfw_add_obj_rewriter(struct opcode_obj_rewrite *rw, size_t count)
2708 {
2709 size_t sz;
2710 struct opcode_obj_rewrite *tmp;
2711
2712 CTL3_LOCK();
2713
2714 for (;;) {
2715 sz = ctl3_rsize + count;
2716 CTL3_UNLOCK();
2717 tmp = malloc(sizeof(*rw) * sz, M_IPFW, M_WAITOK | M_ZERO);
2718 CTL3_LOCK();
2719 if (ctl3_rsize + count <= sz)
2720 break;
2721
2722 /* Retry */
2723 free(tmp, M_IPFW);
2724 }
2725
2726 /* Merge old & new arrays */
2727 sz = ctl3_rsize + count;
2728 memcpy(tmp, ctl3_rewriters, ctl3_rsize * sizeof(*rw));
2729 memcpy(&tmp[ctl3_rsize], rw, count * sizeof(*rw));
2730 qsort(tmp, sz, sizeof(*rw), compare_opcodes);
2731 /* Switch new and free old */
2732 if (ctl3_rewriters != NULL)
2733 free(ctl3_rewriters, M_IPFW);
2734 ctl3_rewriters = tmp;
2735 ctl3_rsize = sz;
2736
2737 CTL3_UNLOCK();
2738 }
2739
2740 /*
2741 * Removes one or more object rewrite handlers from the global array.
2742 */
2743 int
ipfw_del_obj_rewriter(struct opcode_obj_rewrite * rw,size_t count)2744 ipfw_del_obj_rewriter(struct opcode_obj_rewrite *rw, size_t count)
2745 {
2746 size_t sz;
2747 struct opcode_obj_rewrite *ctl3_max, *ktmp, *lo, *hi;
2748 int i;
2749
2750 CTL3_LOCK();
2751
2752 for (i = 0; i < count; i++) {
2753 if (find_op_rw_range(rw[i].opcode, &lo, &hi) != 0)
2754 continue;
2755
2756 for (ktmp = lo; ktmp <= hi; ktmp++) {
2757 if (ktmp->classifier != rw[i].classifier)
2758 continue;
2759
2760 ctl3_max = ctl3_rewriters + ctl3_rsize;
2761 sz = (ctl3_max - (ktmp + 1)) * sizeof(*ktmp);
2762 memmove(ktmp, ktmp + 1, sz);
2763 ctl3_rsize--;
2764 break;
2765 }
2766 }
2767
2768 if (ctl3_rsize == 0) {
2769 if (ctl3_rewriters != NULL)
2770 free(ctl3_rewriters, M_IPFW);
2771 ctl3_rewriters = NULL;
2772 }
2773
2774 CTL3_UNLOCK();
2775
2776 return (0);
2777 }
2778
2779 static int
export_objhash_ntlv_internal(struct namedobj_instance * ni,struct named_object * no,void * arg)2780 export_objhash_ntlv_internal(struct namedobj_instance *ni,
2781 struct named_object *no, void *arg)
2782 {
2783 struct sockopt_data *sd;
2784 ipfw_obj_ntlv *ntlv;
2785
2786 sd = (struct sockopt_data *)arg;
2787 ntlv = (ipfw_obj_ntlv *)ipfw_get_sopt_space(sd, sizeof(*ntlv));
2788 if (ntlv == NULL)
2789 return (ENOMEM);
2790 ipfw_export_obj_ntlv(no, ntlv);
2791 return (0);
2792 }
2793
2794 /*
2795 * Lists all service objects.
2796 * Data layout (v0)(current):
2797 * Request: [ ipfw_obj_lheader ] size = ipfw_obj_lheader.size
2798 * Reply: [ ipfw_obj_lheader [ ipfw_obj_ntlv x N ] (optional) ]
2799 * Returns 0 on success
2800 */
2801 static int
dump_srvobjects(struct ip_fw_chain * chain,ip_fw3_opheader * op3,struct sockopt_data * sd)2802 dump_srvobjects(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
2803 struct sockopt_data *sd)
2804 {
2805 ipfw_obj_lheader *hdr;
2806 int count;
2807
2808 hdr = (ipfw_obj_lheader *)ipfw_get_sopt_header(sd, sizeof(*hdr));
2809 if (hdr == NULL)
2810 return (EINVAL);
2811
2812 IPFW_UH_RLOCK(chain);
2813 count = ipfw_objhash_count(CHAIN_TO_SRV(chain));
2814 hdr->size = sizeof(ipfw_obj_lheader) + count * sizeof(ipfw_obj_ntlv);
2815 if (sd->valsize < hdr->size) {
2816 IPFW_UH_RUNLOCK(chain);
2817 return (ENOMEM);
2818 }
2819 hdr->count = count;
2820 hdr->objsize = sizeof(ipfw_obj_ntlv);
2821 if (count > 0)
2822 ipfw_objhash_foreach(CHAIN_TO_SRV(chain),
2823 export_objhash_ntlv_internal, sd);
2824 IPFW_UH_RUNLOCK(chain);
2825 return (0);
2826 }
2827
2828 void
ipfw_enable_skipto_cache(struct ip_fw_chain * chain)2829 ipfw_enable_skipto_cache(struct ip_fw_chain *chain)
2830 {
2831
2832 IPFW_UH_WLOCK_ASSERT(chain);
2833 update_skipto_cache(chain, chain->map);
2834
2835 IPFW_WLOCK(chain);
2836 swap_skipto_cache(chain);
2837 V_skipto_cache = 1;
2838 IPFW_WUNLOCK(chain);
2839 }
2840
2841 /*
2842 * Enables or disable skipto cache.
2843 * Request: [ ipfw_cmd_header ] size = ipfw_cmd_header.size
2844 * Reply: [ ipfw_cmd_header ]
2845 * Returns 0 on success
2846 */
2847 static int
manage_skiptocache(struct ip_fw_chain * chain,ip_fw3_opheader * op3,struct sockopt_data * sd)2848 manage_skiptocache(struct ip_fw_chain *chain, ip_fw3_opheader *op3,
2849 struct sockopt_data *sd)
2850 {
2851 ipfw_cmd_header *hdr;
2852
2853 if (sd->valsize != sizeof(*hdr))
2854 return (EINVAL);
2855
2856 hdr = (ipfw_cmd_header *)ipfw_get_sopt_space(sd, sd->valsize);
2857 if (hdr->cmd != SKIPTO_CACHE_DISABLE &&
2858 hdr->cmd != SKIPTO_CACHE_ENABLE)
2859 return (EOPNOTSUPP);
2860
2861 IPFW_UH_WLOCK(chain);
2862 if (hdr->cmd != V_skipto_cache) {
2863 if (hdr->cmd == SKIPTO_CACHE_ENABLE)
2864 ipfw_enable_skipto_cache(chain);
2865 V_skipto_cache = hdr->cmd;
2866 }
2867 IPFW_UH_WUNLOCK(chain);
2868 return (0);
2869 }
2870
2871 /*
2872 * Compares two sopt handlers (code, version and handler ptr).
2873 * Used both as qsort() and bsearch().
2874 * Does not compare handler for latter case.
2875 *
2876 * Returns 0 if match is found.
2877 */
2878 static int
compare_sh(const void * _a,const void * _b)2879 compare_sh(const void *_a, const void *_b)
2880 {
2881 const struct ipfw_sopt_handler *a, *b;
2882
2883 a = (const struct ipfw_sopt_handler *)_a;
2884 b = (const struct ipfw_sopt_handler *)_b;
2885
2886 if (a->opcode < b->opcode)
2887 return (-1);
2888 else if (a->opcode > b->opcode)
2889 return (1);
2890
2891 if (a->version < b->version)
2892 return (-1);
2893 else if (a->version > b->version)
2894 return (1);
2895
2896 /* bsearch helper */
2897 if (a->handler == NULL)
2898 return (0);
2899
2900 if ((uintptr_t)a->handler < (uintptr_t)b->handler)
2901 return (-1);
2902 else if ((uintptr_t)a->handler > (uintptr_t)b->handler)
2903 return (1);
2904
2905 return (0);
2906 }
2907
2908 /*
2909 * Finds sopt handler based on @code and @version.
2910 *
2911 * Returns pointer to handler or NULL.
2912 */
2913 static struct ipfw_sopt_handler *
find_sh(uint16_t code,uint8_t version,sopt_handler_f * handler)2914 find_sh(uint16_t code, uint8_t version, sopt_handler_f *handler)
2915 {
2916 struct ipfw_sopt_handler *sh, h;
2917
2918 memset(&h, 0, sizeof(h));
2919 h.opcode = code;
2920 h.version = version;
2921 h.handler = handler;
2922
2923 sh = (struct ipfw_sopt_handler *)bsearch(&h, ctl3_handlers,
2924 ctl3_hsize, sizeof(h), compare_sh);
2925
2926 return (sh);
2927 }
2928
2929 static int
find_ref_sh(uint16_t opcode,uint8_t version,struct ipfw_sopt_handler * psh)2930 find_ref_sh(uint16_t opcode, uint8_t version, struct ipfw_sopt_handler *psh)
2931 {
2932 struct ipfw_sopt_handler *sh;
2933
2934 CTL3_LOCK();
2935 if ((sh = find_sh(opcode, version, NULL)) == NULL) {
2936 CTL3_UNLOCK();
2937 printf("ipfw: ipfw_ctl3 invalid option %d""v""%d\n",
2938 opcode, version);
2939 return (EINVAL);
2940 }
2941 sh->refcnt++;
2942 ctl3_refct++;
2943 /* Copy handler data to requested buffer */
2944 *psh = *sh;
2945 CTL3_UNLOCK();
2946
2947 return (0);
2948 }
2949
2950 static void
find_unref_sh(struct ipfw_sopt_handler * psh)2951 find_unref_sh(struct ipfw_sopt_handler *psh)
2952 {
2953 struct ipfw_sopt_handler *sh;
2954
2955 CTL3_LOCK();
2956 sh = find_sh(psh->opcode, psh->version, NULL);
2957 KASSERT(sh != NULL, ("ctl3 handler disappeared"));
2958 sh->refcnt--;
2959 ctl3_refct--;
2960 CTL3_UNLOCK();
2961 }
2962
2963 void
ipfw_init_sopt_handler(void)2964 ipfw_init_sopt_handler(void)
2965 {
2966 CTL3_LOCK_INIT();
2967 IPFW_ADD_SOPT_HANDLER(1, scodes);
2968 }
2969
2970 void
ipfw_destroy_sopt_handler(void)2971 ipfw_destroy_sopt_handler(void)
2972 {
2973 IPFW_DEL_SOPT_HANDLER(1, scodes);
2974 CTL3_LOCK_DESTROY();
2975 }
2976
2977 void
ipfw_register_compat(ipfw_check_opcode_t f)2978 ipfw_register_compat(ipfw_check_opcode_t f)
2979 {
2980 check_opcode_f = f;
2981 }
2982
2983 void
ipfw_unregister_compat(void)2984 ipfw_unregister_compat(void)
2985 {
2986 check_opcode_f = check_opcode_compat_nop;
2987 }
2988
2989 /*
2990 * Adds one or more sockopt handlers to the global array.
2991 * Function may sleep.
2992 */
2993 void
ipfw_add_sopt_handler(struct ipfw_sopt_handler * sh,size_t count)2994 ipfw_add_sopt_handler(struct ipfw_sopt_handler *sh, size_t count)
2995 {
2996 size_t sz;
2997 struct ipfw_sopt_handler *tmp;
2998
2999 CTL3_LOCK();
3000
3001 for (;;) {
3002 sz = ctl3_hsize + count;
3003 CTL3_UNLOCK();
3004 tmp = malloc(sizeof(*sh) * sz, M_IPFW, M_WAITOK | M_ZERO);
3005 CTL3_LOCK();
3006 if (ctl3_hsize + count <= sz)
3007 break;
3008
3009 /* Retry */
3010 free(tmp, M_IPFW);
3011 }
3012
3013 /* Merge old & new arrays */
3014 sz = ctl3_hsize + count;
3015 memcpy(tmp, ctl3_handlers, ctl3_hsize * sizeof(*sh));
3016 memcpy(&tmp[ctl3_hsize], sh, count * sizeof(*sh));
3017 qsort(tmp, sz, sizeof(*sh), compare_sh);
3018 /* Switch new and free old */
3019 if (ctl3_handlers != NULL)
3020 free(ctl3_handlers, M_IPFW);
3021 ctl3_handlers = tmp;
3022 ctl3_hsize = sz;
3023 ctl3_gencnt++;
3024
3025 CTL3_UNLOCK();
3026 }
3027
3028 /*
3029 * Removes one or more sockopt handlers from the global array.
3030 */
3031 int
ipfw_del_sopt_handler(struct ipfw_sopt_handler * sh,size_t count)3032 ipfw_del_sopt_handler(struct ipfw_sopt_handler *sh, size_t count)
3033 {
3034 size_t sz;
3035 struct ipfw_sopt_handler *tmp, *h;
3036 int i;
3037
3038 CTL3_LOCK();
3039
3040 for (i = 0; i < count; i++) {
3041 tmp = &sh[i];
3042 h = find_sh(tmp->opcode, tmp->version, tmp->handler);
3043 if (h == NULL)
3044 continue;
3045
3046 sz = (ctl3_handlers + ctl3_hsize - (h + 1)) * sizeof(*h);
3047 memmove(h, h + 1, sz);
3048 ctl3_hsize--;
3049 }
3050
3051 if (ctl3_hsize == 0) {
3052 if (ctl3_handlers != NULL)
3053 free(ctl3_handlers, M_IPFW);
3054 ctl3_handlers = NULL;
3055 }
3056
3057 ctl3_gencnt++;
3058
3059 CTL3_UNLOCK();
3060
3061 return (0);
3062 }
3063
3064 /*
3065 * Writes data accumulated in @sd to sockopt buffer.
3066 * Zeroes internal @sd buffer.
3067 */
3068 static int
ipfw_flush_sopt_data(struct sockopt_data * sd)3069 ipfw_flush_sopt_data(struct sockopt_data *sd)
3070 {
3071 struct sockopt *sopt;
3072 int error;
3073 size_t sz;
3074
3075 sz = sd->koff;
3076 if (sz == 0)
3077 return (0);
3078
3079 sopt = sd->sopt;
3080
3081 if (sopt->sopt_dir == SOPT_GET) {
3082 error = copyout(sd->kbuf, sopt->sopt_val, sz);
3083 if (error != 0)
3084 return (error);
3085 }
3086
3087 memset(sd->kbuf, 0, sd->ksize);
3088 sd->ktotal += sz;
3089 sd->koff = 0;
3090 if (sd->ktotal + sd->ksize < sd->valsize)
3091 sd->kavail = sd->ksize;
3092 else
3093 sd->kavail = sd->valsize - sd->ktotal;
3094
3095 /* Update sopt buffer data */
3096 sopt->sopt_valsize = sd->ktotal;
3097 sopt->sopt_val = sd->sopt_val + sd->ktotal;
3098
3099 return (0);
3100 }
3101
3102 /*
3103 * Ensures that @sd buffer has contiguous @neeeded number of
3104 * bytes.
3105 *
3106 * Returns pointer to requested space or NULL.
3107 */
3108 caddr_t
ipfw_get_sopt_space(struct sockopt_data * sd,size_t needed)3109 ipfw_get_sopt_space(struct sockopt_data *sd, size_t needed)
3110 {
3111 int error;
3112 caddr_t addr;
3113
3114 if (sd->kavail < needed) {
3115 /*
3116 * Flush data and try another time.
3117 */
3118 error = ipfw_flush_sopt_data(sd);
3119
3120 if (sd->kavail < needed || error != 0)
3121 return (NULL);
3122 }
3123
3124 addr = sd->kbuf + sd->koff;
3125 sd->koff += needed;
3126 sd->kavail -= needed;
3127 return (addr);
3128 }
3129
3130 /*
3131 * Requests @needed contiguous bytes from @sd buffer.
3132 * Function is used to notify subsystem that we are
3133 * interesed in first @needed bytes (request header)
3134 * and the rest buffer can be safely zeroed.
3135 *
3136 * Returns pointer to requested space or NULL.
3137 */
3138 caddr_t
ipfw_get_sopt_header(struct sockopt_data * sd,size_t needed)3139 ipfw_get_sopt_header(struct sockopt_data *sd, size_t needed)
3140 {
3141 caddr_t addr;
3142
3143 if ((addr = ipfw_get_sopt_space(sd, needed)) == NULL)
3144 return (NULL);
3145
3146 if (sd->kavail > 0)
3147 memset(sd->kbuf + sd->koff, 0, sd->kavail);
3148
3149 return (addr);
3150 }
3151
3152 /*
3153 * New sockopt handler.
3154 */
3155 int
ipfw_ctl3(struct sockopt * sopt)3156 ipfw_ctl3(struct sockopt *sopt)
3157 {
3158 int error, locked;
3159 size_t size, valsize;
3160 struct ip_fw_chain *chain;
3161 char xbuf[256];
3162 struct sockopt_data sdata;
3163 struct ipfw_sopt_handler h;
3164 ip_fw3_opheader *op3 = NULL;
3165
3166 error = priv_check(sopt->sopt_td, PRIV_NETINET_IPFW);
3167 if (error != 0)
3168 return (error);
3169
3170 if (sopt->sopt_name != IP_FW3)
3171 return (EOPNOTSUPP);
3172
3173 chain = &V_layer3_chain;
3174 error = 0;
3175
3176 /* Save original valsize before it is altered via sooptcopyin() */
3177 valsize = sopt->sopt_valsize;
3178 memset(&sdata, 0, sizeof(sdata));
3179 /* Read op3 header first to determine actual operation */
3180 op3 = (ip_fw3_opheader *)xbuf;
3181 error = sooptcopyin(sopt, op3, sizeof(*op3), sizeof(*op3));
3182 if (error != 0)
3183 return (error);
3184 sopt->sopt_valsize = valsize;
3185
3186 /*
3187 * Find and reference command.
3188 */
3189 error = find_ref_sh(op3->opcode, op3->version, &h);
3190 if (error != 0)
3191 return (error);
3192
3193 /*
3194 * Disallow modifications in really-really secure mode, but still allow
3195 * the logging counters to be reset.
3196 */
3197 if ((h.dir & HDIR_SET) != 0 && h.opcode != IP_FW_XRESETLOG) {
3198 error = securelevel_ge(sopt->sopt_td->td_ucred, 3);
3199 if (error != 0) {
3200 find_unref_sh(&h);
3201 return (error);
3202 }
3203 }
3204
3205 /*
3206 * Fill in sockopt_data structure that may be useful for
3207 * IP_FW3 get requests.
3208 */
3209 locked = 0;
3210 if (valsize <= sizeof(xbuf)) {
3211 /* use on-stack buffer */
3212 sdata.kbuf = xbuf;
3213 sdata.ksize = sizeof(xbuf);
3214 sdata.kavail = valsize;
3215 } else {
3216 /*
3217 * Determine opcode type/buffer size:
3218 * allocate sliding-window buf for data export or
3219 * contiguous buffer for special ops.
3220 */
3221 if ((h.dir & HDIR_SET) != 0) {
3222 /* Set request. Allocate contigous buffer. */
3223 if (valsize > CTL3_LARGEBUF) {
3224 find_unref_sh(&h);
3225 return (EFBIG);
3226 }
3227
3228 size = valsize;
3229 } else {
3230 /* Get request. Allocate sliding window buffer */
3231 size = (valsize<CTL3_SMALLBUF) ? valsize:CTL3_SMALLBUF;
3232
3233 if (size < valsize) {
3234 /* We have to wire user buffer */
3235 error = vslock(sopt->sopt_val, valsize);
3236 if (error != 0)
3237 return (error);
3238 locked = 1;
3239 }
3240 }
3241
3242 sdata.kbuf = malloc(size, M_TEMP, M_WAITOK | M_ZERO);
3243 sdata.ksize = size;
3244 sdata.kavail = size;
3245 }
3246
3247 sdata.sopt = sopt;
3248 sdata.sopt_val = sopt->sopt_val;
3249 sdata.valsize = valsize;
3250
3251 /*
3252 * Copy either all request (if valsize < bsize_max)
3253 * or first bsize_max bytes to guarantee most consumers
3254 * that all necessary data has been copied).
3255 * Anyway, copy not less than sizeof(ip_fw3_opheader).
3256 */
3257 if ((error = sooptcopyin(sopt, sdata.kbuf, sdata.ksize,
3258 sizeof(ip_fw3_opheader))) != 0)
3259 return (error);
3260 op3 = (ip_fw3_opheader *)sdata.kbuf;
3261
3262 /* Finally, run handler */
3263 error = h.handler(chain, op3, &sdata);
3264 find_unref_sh(&h);
3265
3266 /* Flush state and free buffers */
3267 if (error == 0)
3268 error = ipfw_flush_sopt_data(&sdata);
3269 else
3270 ipfw_flush_sopt_data(&sdata);
3271
3272 if (locked != 0)
3273 vsunlock(sdata.sopt_val, valsize);
3274
3275 /* Restore original pointer and set number of bytes written */
3276 sopt->sopt_val = sdata.sopt_val;
3277 sopt->sopt_valsize = sdata.ktotal;
3278 if (sdata.kbuf != xbuf)
3279 free(sdata.kbuf, M_TEMP);
3280
3281 return (error);
3282 }
3283
3284 /*
3285 * Named object api
3286 *
3287 */
3288
3289 void
ipfw_init_srv(struct ip_fw_chain * ch)3290 ipfw_init_srv(struct ip_fw_chain *ch)
3291 {
3292 ch->srvmap = ipfw_objhash_create(IPFW_OBJECTS_DEFAULT,
3293 DEFAULT_OBJHASH_SIZE);
3294 ch->srvstate = malloc(sizeof(void *) * IPFW_OBJECTS_DEFAULT,
3295 M_IPFW, M_WAITOK | M_ZERO);
3296 }
3297
3298 void
ipfw_destroy_srv(struct ip_fw_chain * ch)3299 ipfw_destroy_srv(struct ip_fw_chain *ch)
3300 {
3301 free(ch->srvstate, M_IPFW);
3302 ipfw_objhash_destroy(ch->srvmap);
3303 }
3304
3305 /*
3306 * Allocate new bitmask which can be used to enlarge/shrink
3307 * named instance index.
3308 */
3309 void
ipfw_objhash_bitmap_alloc(uint32_t items,void ** idx,int * pblocks)3310 ipfw_objhash_bitmap_alloc(uint32_t items, void **idx, int *pblocks)
3311 {
3312 size_t size;
3313 int max_blocks;
3314 u_long *idx_mask;
3315
3316 KASSERT((items % BLOCK_ITEMS) == 0,
3317 ("bitmask size needs to power of 2 and greater or equal to %zu",
3318 BLOCK_ITEMS));
3319
3320 max_blocks = items / BLOCK_ITEMS;
3321 size = items / 8;
3322 idx_mask = malloc(size * IPFW_MAX_SETS, M_IPFW, M_WAITOK);
3323 /* Mark all as free */
3324 memset(idx_mask, 0xFF, size * IPFW_MAX_SETS);
3325 *idx_mask &= ~(u_long)1; /* Skip index 0 */
3326
3327 *idx = idx_mask;
3328 *pblocks = max_blocks;
3329 }
3330
3331 /*
3332 * Copy current bitmask index to new one.
3333 */
3334 void
ipfw_objhash_bitmap_merge(struct namedobj_instance * ni,void ** idx,int * blocks)3335 ipfw_objhash_bitmap_merge(struct namedobj_instance *ni, void **idx, int *blocks)
3336 {
3337 int old_blocks, new_blocks;
3338 u_long *old_idx, *new_idx;
3339 int i;
3340
3341 old_idx = ni->idx_mask;
3342 old_blocks = ni->max_blocks;
3343 new_idx = *idx;
3344 new_blocks = *blocks;
3345
3346 for (i = 0; i < IPFW_MAX_SETS; i++) {
3347 memcpy(&new_idx[new_blocks * i], &old_idx[old_blocks * i],
3348 old_blocks * sizeof(u_long));
3349 }
3350 }
3351
3352 /*
3353 * Swaps current @ni index with new one.
3354 */
3355 void
ipfw_objhash_bitmap_swap(struct namedobj_instance * ni,void ** idx,int * blocks)3356 ipfw_objhash_bitmap_swap(struct namedobj_instance *ni, void **idx, int *blocks)
3357 {
3358 int old_blocks;
3359 u_long *old_idx;
3360
3361 old_idx = ni->idx_mask;
3362 old_blocks = ni->max_blocks;
3363
3364 ni->idx_mask = *idx;
3365 ni->max_blocks = *blocks;
3366
3367 /* Save old values */
3368 *idx = old_idx;
3369 *blocks = old_blocks;
3370 }
3371
3372 void
ipfw_objhash_bitmap_free(void * idx,int blocks)3373 ipfw_objhash_bitmap_free(void *idx, int blocks)
3374 {
3375 free(idx, M_IPFW);
3376 }
3377
3378 /*
3379 * Creates named hash instance.
3380 * Must be called without holding any locks.
3381 * Return pointer to new instance.
3382 */
3383 struct namedobj_instance *
ipfw_objhash_create(uint32_t items,size_t hash_size)3384 ipfw_objhash_create(uint32_t items, size_t hash_size)
3385 {
3386 struct namedobj_instance *ni;
3387 int i;
3388 size_t size;
3389
3390 size = sizeof(struct namedobj_instance) +
3391 sizeof(struct namedobjects_head) * hash_size +
3392 sizeof(struct namedobjects_head) * hash_size;
3393
3394 ni = malloc(size, M_IPFW, M_WAITOK | M_ZERO);
3395 ni->nn_size = hash_size;
3396 ni->nv_size = hash_size;
3397
3398 ni->names = (struct namedobjects_head *)(ni +1);
3399 ni->values = &ni->names[ni->nn_size];
3400
3401 for (i = 0; i < ni->nn_size; i++)
3402 TAILQ_INIT(&ni->names[i]);
3403
3404 for (i = 0; i < ni->nv_size; i++)
3405 TAILQ_INIT(&ni->values[i]);
3406
3407 /* Set default hashing/comparison functions */
3408 ni->hash_f = objhash_hash_name;
3409 ni->cmp_f = objhash_cmp_name;
3410
3411 /* Allocate bitmask separately due to possible resize */
3412 ipfw_objhash_bitmap_alloc(items, (void*)&ni->idx_mask, &ni->max_blocks);
3413
3414 return (ni);
3415 }
3416
3417 void
ipfw_objhash_destroy(struct namedobj_instance * ni)3418 ipfw_objhash_destroy(struct namedobj_instance *ni)
3419 {
3420 free(ni->idx_mask, M_IPFW);
3421 free(ni, M_IPFW);
3422 }
3423
3424 void
ipfw_objhash_set_funcs(struct namedobj_instance * ni,objhash_hash_f * hash_f,objhash_cmp_f * cmp_f)3425 ipfw_objhash_set_funcs(struct namedobj_instance *ni, objhash_hash_f *hash_f,
3426 objhash_cmp_f *cmp_f)
3427 {
3428
3429 ni->hash_f = hash_f;
3430 ni->cmp_f = cmp_f;
3431 }
3432
3433 static uint32_t
objhash_hash_name(struct namedobj_instance * ni,const void * name,uint32_t set)3434 objhash_hash_name(struct namedobj_instance *ni, const void *name, uint32_t set)
3435 {
3436
3437 return (fnv_32_str((const char *)name, FNV1_32_INIT));
3438 }
3439
3440 static int
objhash_cmp_name(struct named_object * no,const void * name,uint32_t set)3441 objhash_cmp_name(struct named_object *no, const void *name, uint32_t set)
3442 {
3443
3444 if ((strcmp(no->name, (const char *)name) == 0) && (no->set == set))
3445 return (0);
3446
3447 return (1);
3448 }
3449
3450 static uint32_t
objhash_hash_idx(struct namedobj_instance * ni,uint32_t val)3451 objhash_hash_idx(struct namedobj_instance *ni, uint32_t val)
3452 {
3453 uint32_t v;
3454
3455 v = val % (ni->nv_size - 1);
3456
3457 return (v);
3458 }
3459
3460 struct named_object *
ipfw_objhash_lookup_name(struct namedobj_instance * ni,uint32_t set,const char * name)3461 ipfw_objhash_lookup_name(struct namedobj_instance *ni, uint32_t set,
3462 const char *name)
3463 {
3464 struct named_object *no;
3465 uint32_t hash;
3466
3467 hash = ni->hash_f(ni, name, set) % ni->nn_size;
3468
3469 TAILQ_FOREACH(no, &ni->names[hash], nn_next) {
3470 if (ni->cmp_f(no, name, set) == 0)
3471 return (no);
3472 }
3473
3474 return (NULL);
3475 }
3476
3477 /*
3478 * Find named object by @uid.
3479 * Check @tlvs for valid data inside.
3480 *
3481 * Returns pointer to found TLV or NULL.
3482 */
3483 ipfw_obj_ntlv *
ipfw_find_name_tlv_type(void * tlvs,int len,uint32_t uidx,uint32_t etlv)3484 ipfw_find_name_tlv_type(void *tlvs, int len, uint32_t uidx, uint32_t etlv)
3485 {
3486 ipfw_obj_ntlv *ntlv;
3487 uintptr_t pa, pe;
3488 int l;
3489
3490 pa = (uintptr_t)tlvs;
3491 pe = pa + len;
3492 l = 0;
3493 for (; pa < pe; pa += l) {
3494 ntlv = (ipfw_obj_ntlv *)pa;
3495 l = ntlv->head.length;
3496
3497 if (l != sizeof(*ntlv))
3498 return (NULL);
3499
3500 if (ntlv->idx != uidx)
3501 continue;
3502 /*
3503 * When userland has specified zero TLV type, do
3504 * not compare it with eltv. In some cases userland
3505 * doesn't know what type should it have. Use only
3506 * uidx and name for search named_object.
3507 */
3508 if (ntlv->head.type != 0 &&
3509 ntlv->head.type != (uint16_t)etlv)
3510 continue;
3511
3512 if (ipfw_check_object_name_generic(ntlv->name) != 0)
3513 return (NULL);
3514
3515 return (ntlv);
3516 }
3517
3518 return (NULL);
3519 }
3520
3521 /*
3522 * Finds object config based on either legacy index
3523 * or name in ntlv.
3524 * Note @ti structure contains unchecked data from userland.
3525 *
3526 * Returns 0 in success and fills in @pno with found config
3527 */
3528 int
ipfw_objhash_find_type(struct namedobj_instance * ni,struct tid_info * ti,uint32_t etlv,struct named_object ** pno)3529 ipfw_objhash_find_type(struct namedobj_instance *ni, struct tid_info *ti,
3530 uint32_t etlv, struct named_object **pno)
3531 {
3532 char *name;
3533 ipfw_obj_ntlv *ntlv;
3534 uint32_t set;
3535
3536 if (ti->tlvs == NULL)
3537 return (EINVAL);
3538
3539 ntlv = ipfw_find_name_tlv_type(ti->tlvs, ti->tlen, ti->uidx, etlv);
3540 if (ntlv == NULL)
3541 return (EINVAL);
3542 name = ntlv->name;
3543
3544 /*
3545 * Use set provided by @ti instead of @ntlv one.
3546 * This is needed due to different sets behavior
3547 * controlled by V_fw_tables_sets.
3548 */
3549 set = ti->set;
3550 *pno = ipfw_objhash_lookup_name(ni, set, name);
3551 if (*pno == NULL)
3552 return (ESRCH);
3553 return (0);
3554 }
3555
3556 /*
3557 * Find named object by name, considering also its TLV type.
3558 */
3559 struct named_object *
ipfw_objhash_lookup_name_type(struct namedobj_instance * ni,uint32_t set,uint32_t type,const char * name)3560 ipfw_objhash_lookup_name_type(struct namedobj_instance *ni, uint32_t set,
3561 uint32_t type, const char *name)
3562 {
3563 struct named_object *no;
3564 uint32_t hash;
3565
3566 hash = ni->hash_f(ni, name, set) % ni->nn_size;
3567
3568 TAILQ_FOREACH(no, &ni->names[hash], nn_next) {
3569 if (ni->cmp_f(no, name, set) == 0 &&
3570 no->etlv == (uint16_t)type)
3571 return (no);
3572 }
3573
3574 return (NULL);
3575 }
3576
3577 struct named_object *
ipfw_objhash_lookup_kidx(struct namedobj_instance * ni,uint32_t kidx)3578 ipfw_objhash_lookup_kidx(struct namedobj_instance *ni, uint32_t kidx)
3579 {
3580 struct named_object *no;
3581 uint32_t hash;
3582
3583 hash = objhash_hash_idx(ni, kidx);
3584
3585 TAILQ_FOREACH(no, &ni->values[hash], nv_next) {
3586 if (no->kidx == kidx)
3587 return (no);
3588 }
3589
3590 return (NULL);
3591 }
3592
3593 int
ipfw_objhash_same_name(struct namedobj_instance * ni,struct named_object * a,struct named_object * b)3594 ipfw_objhash_same_name(struct namedobj_instance *ni, struct named_object *a,
3595 struct named_object *b)
3596 {
3597
3598 if ((strcmp(a->name, b->name) == 0) && a->set == b->set)
3599 return (1);
3600
3601 return (0);
3602 }
3603
3604 void
ipfw_objhash_add(struct namedobj_instance * ni,struct named_object * no)3605 ipfw_objhash_add(struct namedobj_instance *ni, struct named_object *no)
3606 {
3607 uint32_t hash;
3608
3609 hash = ni->hash_f(ni, no->name, no->set) % ni->nn_size;
3610 TAILQ_INSERT_HEAD(&ni->names[hash], no, nn_next);
3611
3612 hash = objhash_hash_idx(ni, no->kidx);
3613 TAILQ_INSERT_HEAD(&ni->values[hash], no, nv_next);
3614
3615 ni->count++;
3616 }
3617
3618 void
ipfw_objhash_del(struct namedobj_instance * ni,struct named_object * no)3619 ipfw_objhash_del(struct namedobj_instance *ni, struct named_object *no)
3620 {
3621 uint32_t hash;
3622
3623 hash = ni->hash_f(ni, no->name, no->set) % ni->nn_size;
3624 TAILQ_REMOVE(&ni->names[hash], no, nn_next);
3625
3626 hash = objhash_hash_idx(ni, no->kidx);
3627 TAILQ_REMOVE(&ni->values[hash], no, nv_next);
3628
3629 ni->count--;
3630 }
3631
3632 uint32_t
ipfw_objhash_count(struct namedobj_instance * ni)3633 ipfw_objhash_count(struct namedobj_instance *ni)
3634 {
3635
3636 return (ni->count);
3637 }
3638
3639 uint32_t
ipfw_objhash_count_type(struct namedobj_instance * ni,uint16_t type)3640 ipfw_objhash_count_type(struct namedobj_instance *ni, uint16_t type)
3641 {
3642 struct named_object *no;
3643 uint32_t count;
3644 int i;
3645
3646 count = 0;
3647 for (i = 0; i < ni->nn_size; i++) {
3648 TAILQ_FOREACH(no, &ni->names[i], nn_next) {
3649 if (no->etlv == type)
3650 count++;
3651 }
3652 }
3653 return (count);
3654 }
3655
3656 /*
3657 * Runs @func for each found named object.
3658 * It is safe to delete objects from callback
3659 */
3660 int
ipfw_objhash_foreach(struct namedobj_instance * ni,objhash_cb_t * f,void * arg)3661 ipfw_objhash_foreach(struct namedobj_instance *ni, objhash_cb_t *f, void *arg)
3662 {
3663 struct named_object *no, *no_tmp;
3664 int i, ret;
3665
3666 for (i = 0; i < ni->nn_size; i++) {
3667 TAILQ_FOREACH_SAFE(no, &ni->names[i], nn_next, no_tmp) {
3668 ret = f(ni, no, arg);
3669 if (ret != 0)
3670 return (ret);
3671 }
3672 }
3673 return (0);
3674 }
3675
3676 /*
3677 * Runs @f for each found named object with type @type.
3678 * It is safe to delete objects from callback
3679 */
3680 int
ipfw_objhash_foreach_type(struct namedobj_instance * ni,objhash_cb_t * f,void * arg,uint16_t type)3681 ipfw_objhash_foreach_type(struct namedobj_instance *ni, objhash_cb_t *f,
3682 void *arg, uint16_t type)
3683 {
3684 struct named_object *no, *no_tmp;
3685 int i, ret;
3686
3687 for (i = 0; i < ni->nn_size; i++) {
3688 TAILQ_FOREACH_SAFE(no, &ni->names[i], nn_next, no_tmp) {
3689 if (no->etlv != type)
3690 continue;
3691 ret = f(ni, no, arg);
3692 if (ret != 0)
3693 return (ret);
3694 }
3695 }
3696 return (0);
3697 }
3698
3699 /*
3700 * Removes index from given set.
3701 * Returns 0 on success.
3702 */
3703 int
ipfw_objhash_free_idx(struct namedobj_instance * ni,uint32_t idx)3704 ipfw_objhash_free_idx(struct namedobj_instance *ni, uint32_t idx)
3705 {
3706 u_long *mask;
3707 int i, v;
3708
3709 i = idx / BLOCK_ITEMS;
3710 v = idx % BLOCK_ITEMS;
3711
3712 if (i >= ni->max_blocks)
3713 return (1);
3714
3715 mask = &ni->idx_mask[i];
3716
3717 if ((*mask & ((u_long)1 << v)) != 0)
3718 return (1);
3719
3720 /* Mark as free */
3721 *mask |= (u_long)1 << v;
3722
3723 /* Update free offset */
3724 if (ni->free_off[0] > i)
3725 ni->free_off[0] = i;
3726
3727 return (0);
3728 }
3729
3730 /*
3731 * Allocate new index in given instance and stores in in @pidx.
3732 * Returns 0 on success.
3733 */
3734 int
ipfw_objhash_alloc_idx(void * n,uint32_t * pidx)3735 ipfw_objhash_alloc_idx(void *n, uint32_t *pidx)
3736 {
3737 struct namedobj_instance *ni;
3738 u_long *mask;
3739 int i, off, v;
3740
3741 ni = (struct namedobj_instance *)n;
3742
3743 off = ni->free_off[0];
3744 mask = &ni->idx_mask[off];
3745
3746 for (i = off; i < ni->max_blocks; i++, mask++) {
3747 if ((v = ffsl(*mask)) == 0)
3748 continue;
3749
3750 /* Mark as busy */
3751 *mask &= ~ ((u_long)1 << (v - 1));
3752
3753 ni->free_off[0] = i;
3754
3755 v = BLOCK_ITEMS * i + v - 1;
3756
3757 *pidx = v;
3758 return (0);
3759 }
3760
3761 return (1);
3762 }
3763
3764 /* end of file */
3765