The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/netpfil/ipfw/ip_fw_private.h

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
    3  *
    4  * Copyright (c) 2002-2009 Luigi Rizzo, Universita` di Pisa
    5  *
    6  * Redistribution and use in source and binary forms, with or without
    7  * modification, are permitted provided that the following conditions
    8  * are met:
    9  * 1. Redistributions of source code must retain the above copyright
   10  *    notice, this list of conditions and the following disclaimer.
   11  * 2. Redistributions in binary form must reproduce the above copyright
   12  *    notice, this list of conditions and the following disclaimer in the
   13  *    documentation and/or other materials provided with the distribution.
   14  *
   15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
   16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
   19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   25  * SUCH DAMAGE.
   26  *
   27  * $FreeBSD$
   28  */
   29 
   30 #ifndef _IPFW2_PRIVATE_H
   31 #define _IPFW2_PRIVATE_H
   32 
   33 /*
   34  * Internal constants and data structures used by ipfw components
   35  * and not meant to be exported outside the kernel.
   36  */
   37 
   38 #ifdef _KERNEL
   39 
   40 /*
   41  * For platforms that do not have SYSCTL support, we wrap the
   42  * SYSCTL_* into a function (one per file) to collect the values
   43  * into an array at module initialization. The wrapping macros,
   44  * SYSBEGIN() and SYSEND, are empty in the default case.
   45  */
   46 #ifndef SYSBEGIN
   47 #define SYSBEGIN(x)
   48 #endif
   49 #ifndef SYSEND
   50 #define SYSEND
   51 #endif
   52 
   53 /* Return values from ipfw_chk() */
   54 enum {
   55         IP_FW_PASS = 0,
   56         IP_FW_DENY,
   57         IP_FW_DIVERT,
   58         IP_FW_TEE,
   59         IP_FW_DUMMYNET,
   60         IP_FW_NETGRAPH,
   61         IP_FW_NGTEE,
   62         IP_FW_NAT,
   63         IP_FW_REASS,
   64         IP_FW_NAT64,
   65 };
   66 
   67 /*
   68  * Structure for collecting parameters to dummynet for ip6_output forwarding
   69  */
   70 struct _ip6dn_args {
   71        struct ip6_pktopts *opt_or;
   72        int flags_or;
   73        struct ip6_moptions *im6o_or;
   74        struct ifnet *origifp_or;
   75        struct ifnet *ifp_or;
   76        struct sockaddr_in6 dst_or;
   77        u_long mtu_or;
   78 };
   79 
   80 /*
   81  * Arguments for calling ipfw_chk() and dummynet_io(). We put them
   82  * all into a structure because this way it is easier and more
   83  * efficient to pass variables around and extend the interface.
   84  */
   85 struct ip_fw_args {
   86         uint32_t                flags;
   87 #define IPFW_ARGS_ETHER         0x00010000      /* valid ethernet header */
   88 #define IPFW_ARGS_NH4           0x00020000      /* IPv4 next hop in hopstore */
   89 #define IPFW_ARGS_NH6           0x00040000      /* IPv6 next hop in hopstore */
   90 #define IPFW_ARGS_NH4PTR        0x00080000      /* IPv4 next hop in next_hop */
   91 #define IPFW_ARGS_NH6PTR        0x00100000      /* IPv6 next hop in next_hop6 */
   92 #define IPFW_ARGS_REF           0x00200000      /* valid ipfw_rule_ref  */
   93 #define IPFW_ARGS_IN            0x00400000      /* called on input */
   94 #define IPFW_ARGS_OUT           0x00800000      /* called on output */
   95 #define IPFW_ARGS_IP4           0x01000000      /* belongs to v4 ISR */
   96 #define IPFW_ARGS_IP6           0x02000000      /* belongs to v6 ISR */
   97 #define IPFW_ARGS_DROP          0x04000000      /* drop it (dummynet) */
   98 #define IPFW_ARGS_LENMASK       0x0000ffff      /* length of data in *mem */
   99 #define IPFW_ARGS_LENGTH(f)     ((f) & IPFW_ARGS_LENMASK)
  100         /*
  101          * On return, it points to the matching rule.
  102          * On entry, rule.slot > 0 means the info is valid and
  103          * contains the starting rule for an ipfw search.
  104          * If chain_id == chain->id && slot >0 then jump to that slot.
  105          * Otherwise, we locate the first rule >= rulenum:rule_id
  106          */
  107         struct ipfw_rule_ref    rule;   /* match/restart info           */
  108 
  109         struct ifnet            *ifp;   /* input/output interface       */
  110         struct inpcb            *inp;
  111         union {
  112                 /*
  113                  * next_hop[6] pointers can be used to point to next hop
  114                  * stored in rule's opcode to avoid copying into hopstore.
  115                  * Also, it is expected that all 0x1-0x10 flags are mutually
  116                  * exclusive.
  117                  */
  118                 struct sockaddr_in      *next_hop;
  119                 struct sockaddr_in6     *next_hop6;
  120                 /* ipfw next hop storage */
  121                 struct sockaddr_in      hopstore;
  122                 struct ip_fw_nh6 {
  123                         struct in6_addr sin6_addr;
  124                         uint32_t        sin6_scope_id;
  125                         uint16_t        sin6_port;
  126                 } hopstore6;
  127         };
  128         union {
  129                 struct mbuf     *m;     /* the mbuf chain               */
  130                 void            *mem;   /* or memory pointer            */
  131         };
  132         struct ipfw_flow_id     f_id;   /* grabbed from IP header       */
  133 };
  134 
  135 MALLOC_DECLARE(M_IPFW);
  136 
  137 /* wrapper for freeing a packet, in case we need to do more work */
  138 #ifndef FREE_PKT
  139 #if defined(__linux__) || defined(_WIN32)
  140 #define FREE_PKT(m)     netisr_dispatch(-1, m)
  141 #else
  142 #define FREE_PKT(m)     m_freem(m)
  143 #endif
  144 #endif /* !FREE_PKT */
  145 
  146 /*
  147  * Function definitions.
  148  */
  149 int ipfw_chk(struct ip_fw_args *args);
  150 struct mbuf *ipfw_send_pkt(struct mbuf *, struct ipfw_flow_id *,
  151     u_int32_t, u_int32_t, int);
  152 
  153 int ipfw_attach_hooks(void);
  154 void ipfw_detach_hooks(void);
  155 #ifdef NOTYET
  156 void ipfw_nat_destroy(void);
  157 #endif
  158 
  159 /* In ip_fw_log.c */
  160 struct ip;
  161 struct ip_fw_chain;
  162 
  163 void ipfw_bpf_init(int);
  164 void ipfw_bpf_uninit(int);
  165 void ipfw_bpf_tap(u_char *, u_int);
  166 void ipfw_bpf_mtap(struct mbuf *);
  167 void ipfw_bpf_mtap2(void *, u_int, struct mbuf *);
  168 void ipfw_log(struct ip_fw_chain *chain, struct ip_fw *f, u_int hlen,
  169     struct ip_fw_args *args, u_short offset, uint32_t tablearg, struct ip *ip);
  170 VNET_DECLARE(u_int64_t, norule_counter);
  171 #define V_norule_counter        VNET(norule_counter)
  172 VNET_DECLARE(int, verbose_limit);
  173 #define V_verbose_limit         VNET(verbose_limit)
  174 
  175 /* In ip_fw_dynamic.c */
  176 struct sockopt_data;
  177 
  178 enum { /* result for matching dynamic rules */
  179         MATCH_REVERSE = 0,
  180         MATCH_FORWARD,
  181         MATCH_NONE,
  182         MATCH_UNKNOWN,
  183 };
  184 
  185 /*
  186  * Macro to determine that we need to do or redo dynamic state lookup.
  187  * direction == MATCH_UNKNOWN means that this is first lookup, then we need
  188  * to do lookup.
  189  * Otherwise check the state name, if previous lookup was for "any" name,
  190  * this means there is no state with specific name. Thus no need to do
  191  * lookup. If previous name was not "any", redo lookup for specific name.
  192  */
  193 #define DYN_LOOKUP_NEEDED(p, cmd)       \
  194     ((p)->direction == MATCH_UNKNOWN || \
  195         ((p)->kidx != 0 && (p)->kidx != (cmd)->arg1))
  196 #define DYN_INFO_INIT(p)        do {    \
  197         (p)->direction = MATCH_UNKNOWN; \
  198         (p)->kidx = 0;                  \
  199 } while (0)
  200 struct ipfw_dyn_info {
  201         uint16_t        direction;      /* match direction */
  202         uint16_t        kidx;           /* state name kidx */
  203         uint32_t        hashval;        /* hash value */
  204         uint32_t        version;        /* bucket version */
  205         uint32_t        f_pos;
  206 };
  207 int ipfw_dyn_install_state(struct ip_fw_chain *chain, struct ip_fw *rule,
  208     const ipfw_insn_limit *cmd, const struct ip_fw_args *args,
  209     const void *ulp, int pktlen, struct ipfw_dyn_info *info,
  210     uint32_t tablearg);
  211 struct ip_fw *ipfw_dyn_lookup_state(const struct ip_fw_args *args,
  212     const void *ulp, int pktlen, const ipfw_insn *cmd,
  213     struct ipfw_dyn_info *info);
  214 
  215 int ipfw_is_dyn_rule(struct ip_fw *rule);
  216 void ipfw_expire_dyn_states(struct ip_fw_chain *, ipfw_range_tlv *);
  217 void ipfw_get_dynamic(struct ip_fw_chain *chain, char **bp, const char *ep);
  218 int ipfw_dump_states(struct ip_fw_chain *chain, struct sockopt_data *sd);
  219 
  220 void ipfw_dyn_init(struct ip_fw_chain *);       /* per-vnet initialization */
  221 void ipfw_dyn_uninit(int);      /* per-vnet deinitialization */
  222 int ipfw_dyn_len(void);
  223 uint32_t ipfw_dyn_get_count(uint32_t *, int *);
  224 void ipfw_dyn_reset_eaction(struct ip_fw_chain *ch, uint16_t eaction_id,
  225     uint16_t default_id, uint16_t instance_id);
  226 
  227 /* common variables */
  228 VNET_DECLARE(int, fw_one_pass);
  229 #define V_fw_one_pass           VNET(fw_one_pass)
  230 
  231 VNET_DECLARE(int, fw_verbose);
  232 #define V_fw_verbose            VNET(fw_verbose)
  233 
  234 VNET_DECLARE(struct ip_fw_chain, layer3_chain);
  235 #define V_layer3_chain          VNET(layer3_chain)
  236 
  237 VNET_DECLARE(int, ipfw_vnet_ready);
  238 #define V_ipfw_vnet_ready       VNET(ipfw_vnet_ready)
  239 
  240 VNET_DECLARE(u_int32_t, set_disable);
  241 #define V_set_disable           VNET(set_disable)
  242 
  243 VNET_DECLARE(int, autoinc_step);
  244 #define V_autoinc_step          VNET(autoinc_step)
  245 
  246 VNET_DECLARE(unsigned int, fw_tables_max);
  247 #define V_fw_tables_max         VNET(fw_tables_max)
  248 
  249 VNET_DECLARE(unsigned int, fw_tables_sets);
  250 #define V_fw_tables_sets        VNET(fw_tables_sets)
  251 
  252 struct tables_config;
  253 
  254 #ifdef _KERNEL
  255 /*
  256  * Here we have the structure representing an ipfw rule.
  257  *
  258  * It starts with a general area 
  259  * followed by an array of one or more instructions, which the code
  260  * accesses as an array of 32-bit values.
  261  *
  262  * Given a rule pointer  r:
  263  *
  264  *  r->cmd              is the start of the first instruction.
  265  *  ACTION_PTR(r)       is the start of the first action (things to do
  266  *                      once a rule matched).
  267  */
  268 struct ip_fw_jump_cache {
  269         union {
  270                 struct {
  271                         uint32_t        id;
  272                         uint32_t        pos;
  273                 };
  274                 uint64_t        raw_value;
  275         };
  276 };
  277 
  278 struct ip_fw {
  279         uint16_t        act_ofs;        /* offset of action in 32-bit units */
  280         uint16_t        cmd_len;        /* # of 32-bit words in cmd     */
  281         uint16_t        rulenum;        /* rule number                  */
  282         uint8_t         set;            /* rule set (0..31)             */
  283         uint8_t         flags;          /* currently unused             */
  284         counter_u64_t   cntr;           /* Pointer to rule counters     */
  285         struct ip_fw_jump_cache cache;  /* used by jump_fast            */
  286         uint32_t        timestamp;      /* tv_sec of last match         */
  287         uint32_t        id;             /* rule id                      */
  288         uint32_t        refcnt;         /* number of references         */
  289 
  290         struct ip_fw    *next;          /* linked list of deleted rules */
  291         ipfw_insn       cmd[1];         /* storage for commands         */
  292 };
  293 
  294 #define IPFW_RULE_CNTR_SIZE     (2 * sizeof(uint64_t))
  295 
  296 #endif
  297 
  298 struct ip_fw_chain {
  299         struct ip_fw    **map;          /* array of rule ptrs to ease lookup */
  300         uint32_t        id;             /* ruleset id */
  301         int             n_rules;        /* number of static rules */
  302         void            *tablestate;    /* runtime table info */
  303         void            *valuestate;    /* runtime table value info */
  304         int             *idxmap;        /* skipto array of rules */
  305         void            **srvstate;     /* runtime service mappings */
  306 #if defined( __linux__ ) || defined( _WIN32 )
  307         spinlock_t rwmtx;
  308 #else
  309         struct rmlock   rwmtx;
  310 #endif
  311         int             static_len;     /* total len of static rules (v0) */
  312         uint32_t        gencnt;         /* NAT generation count */
  313         LIST_HEAD(nat_list, cfg_nat) nat;       /* list of nat entries */
  314         struct ip_fw    *default_rule;
  315         struct tables_config *tblcfg;   /* tables module data */
  316         void            *ifcfg;         /* interface module data */
  317         int             *idxmap_back;   /* standby skipto array of rules */
  318         struct namedobj_instance        *srvmap; /* cfg name->number mappings */
  319 #if defined( __linux__ ) || defined( _WIN32 )
  320         spinlock_t uh_lock;
  321 #else
  322         struct rwlock   uh_lock;        /* lock for upper half */
  323 #endif
  324 };
  325 
  326 /* 64-byte structure representing multi-field table value */
  327 struct table_value {
  328         uint32_t        tag;            /* O_TAG/O_TAGGED */
  329         uint32_t        pipe;           /* O_PIPE/O_QUEUE */
  330         uint16_t        divert;         /* O_DIVERT/O_TEE */
  331         uint16_t        skipto;         /* skipto, CALLRET */
  332         uint32_t        netgraph;       /* O_NETGRAPH/O_NGTEE */
  333         uint32_t        fib;            /* O_SETFIB */
  334         uint32_t        nat;            /* O_NAT */
  335         uint32_t        nh4;
  336         uint8_t         dscp;
  337         uint8_t         spare0;
  338         uint16_t        spare1;
  339         /* -- 32 bytes -- */
  340         struct in6_addr nh6;
  341         uint32_t        limit;          /* O_LIMIT */
  342         uint32_t        zoneid;         /* scope zone id for nh6 */
  343         uint64_t        refcnt;         /* Number of references */
  344 };
  345 
  346 struct named_object {
  347         TAILQ_ENTRY(named_object)       nn_next;        /* namehash */
  348         TAILQ_ENTRY(named_object)       nv_next;        /* valuehash */
  349         char                    *name;  /* object name */
  350         uint16_t                etlv;   /* Export TLV id */
  351         uint8_t                 subtype;/* object subtype within class */
  352         uint8_t                 set;    /* set object belongs to */
  353         uint16_t                kidx;   /* object kernel index */
  354         uint16_t                spare;
  355         uint32_t                ocnt;   /* object counter for internal use */
  356         uint32_t                refcnt; /* number of references */
  357 };
  358 TAILQ_HEAD(namedobjects_head, named_object);
  359 
  360 struct sockopt; /* used by tcp_var.h */
  361 struct sockopt_data {
  362         caddr_t         kbuf;           /* allocated buffer */
  363         size_t          ksize;          /* given buffer size */
  364         size_t          koff;           /* data already used */
  365         size_t          kavail;         /* number of bytes available */
  366         size_t          ktotal;         /* total bytes pushed */
  367         struct sockopt  *sopt;          /* socket data */
  368         caddr_t         sopt_val;       /* sopt user buffer */
  369         size_t          valsize;        /* original data size */
  370 };
  371 
  372 struct ipfw_ifc;
  373 
  374 typedef void (ipfw_ifc_cb)(struct ip_fw_chain *ch, void *cbdata,
  375     uint16_t ifindex);
  376 
  377 struct ipfw_iface {
  378         struct named_object     no;
  379         char ifname[64];
  380         int resolved;
  381         uint16_t ifindex;
  382         uint16_t spare;
  383         uint64_t gencnt;
  384         TAILQ_HEAD(, ipfw_ifc)  consumers;
  385 };
  386 
  387 struct ipfw_ifc {
  388         TAILQ_ENTRY(ipfw_ifc)   next;
  389         struct ipfw_iface       *iface;
  390         ipfw_ifc_cb             *cb;
  391         void                    *cbdata;
  392 };
  393 
  394 /* Macro for working with various counters */
  395 #define IPFW_INC_RULE_COUNTER(_cntr, _bytes)    do {    \
  396         counter_u64_add((_cntr)->cntr, 1);              \
  397         counter_u64_add((_cntr)->cntr + 1, _bytes);     \
  398         if ((_cntr)->timestamp != time_uptime)          \
  399                 (_cntr)->timestamp = time_uptime;       \
  400         } while (0)
  401 
  402 #define IPFW_INC_DYN_COUNTER(_cntr, _bytes)     do {            \
  403         (_cntr)->pcnt++;                                \
  404         (_cntr)->bcnt += _bytes;                        \
  405         } while (0)
  406 
  407 #define IPFW_ZERO_RULE_COUNTER(_cntr) do {              \
  408         counter_u64_zero((_cntr)->cntr);                \
  409         counter_u64_zero((_cntr)->cntr + 1);            \
  410         (_cntr)->timestamp = 0;                         \
  411         } while (0)
  412 
  413 #define IPFW_ZERO_DYN_COUNTER(_cntr) do {               \
  414         (_cntr)->pcnt = 0;                              \
  415         (_cntr)->bcnt = 0;                              \
  416         } while (0)
  417 
  418 #define TARG_VAL(ch, k, f)      ((struct table_value *)((ch)->valuestate))[k].f
  419 #define IP_FW_ARG_TABLEARG(ch, a, f)    \
  420         (((a) == IP_FW_TARG) ? TARG_VAL(ch, tablearg, f) : (a))
  421 /*
  422  * The lock is heavily used by ip_fw2.c (the main file) and ip_fw_nat.c
  423  * so the variable and the macros must be here.
  424  */
  425 
  426 #if defined( __linux__ ) || defined( _WIN32 )
  427 #define IPFW_LOCK_INIT(_chain) do {                     \
  428         rw_init(&(_chain)->rwmtx, "IPFW static rules"); \
  429         rw_init(&(_chain)->uh_lock, "IPFW UH lock");    \
  430         } while (0)
  431 
  432 #define IPFW_LOCK_DESTROY(_chain) do {                  \
  433         rw_destroy(&(_chain)->rwmtx);                   \
  434         rw_destroy(&(_chain)->uh_lock);                 \
  435         } while (0)
  436 
  437 #define IPFW_RLOCK_ASSERT(_chain)       rw_assert(&(_chain)->rwmtx, RA_RLOCKED)
  438 #define IPFW_WLOCK_ASSERT(_chain)       rw_assert(&(_chain)->rwmtx, RA_WLOCKED)
  439 
  440 #define IPFW_RLOCK_TRACKER
  441 #define IPFW_RLOCK(p)                   rw_rlock(&(p)->rwmtx)
  442 #define IPFW_RUNLOCK(p)                 rw_runlock(&(p)->rwmtx)
  443 #define IPFW_WLOCK(p)                   rw_wlock(&(p)->rwmtx)
  444 #define IPFW_WUNLOCK(p)                 rw_wunlock(&(p)->rwmtx)
  445 #define IPFW_PF_RLOCK(p)                IPFW_RLOCK(p)
  446 #define IPFW_PF_RUNLOCK(p)              IPFW_RUNLOCK(p)
  447 #else /* FreeBSD */
  448 #define IPFW_LOCK_INIT(_chain) do {                     \
  449         rm_init_flags(&(_chain)->rwmtx, "IPFW static rules", RM_RECURSE); \
  450         rw_init(&(_chain)->uh_lock, "IPFW UH lock");    \
  451         } while (0)
  452 
  453 #define IPFW_LOCK_DESTROY(_chain) do {                  \
  454         rm_destroy(&(_chain)->rwmtx);                   \
  455         rw_destroy(&(_chain)->uh_lock);                 \
  456         } while (0)
  457 
  458 #define IPFW_RLOCK_ASSERT(_chain)       rm_assert(&(_chain)->rwmtx, RA_RLOCKED)
  459 #define IPFW_WLOCK_ASSERT(_chain)       rm_assert(&(_chain)->rwmtx, RA_WLOCKED)
  460 
  461 #define IPFW_RLOCK_TRACKER              struct rm_priotracker _tracker
  462 #define IPFW_RLOCK(p)                   rm_rlock(&(p)->rwmtx, &_tracker)
  463 #define IPFW_RUNLOCK(p)                 rm_runlock(&(p)->rwmtx, &_tracker)
  464 #define IPFW_WLOCK(p)                   rm_wlock(&(p)->rwmtx)
  465 #define IPFW_WUNLOCK(p)                 rm_wunlock(&(p)->rwmtx)
  466 #define IPFW_PF_RLOCK(p)                IPFW_RLOCK(p)
  467 #define IPFW_PF_RUNLOCK(p)              IPFW_RUNLOCK(p)
  468 #endif
  469 
  470 #define IPFW_UH_RLOCK_ASSERT(_chain)    rw_assert(&(_chain)->uh_lock, RA_RLOCKED)
  471 #define IPFW_UH_WLOCK_ASSERT(_chain)    rw_assert(&(_chain)->uh_lock, RA_WLOCKED)
  472 #define IPFW_UH_UNLOCK_ASSERT(_chain)   rw_assert(&(_chain)->uh_lock, RA_UNLOCKED)
  473 
  474 #define IPFW_UH_RLOCK(p) rw_rlock(&(p)->uh_lock)
  475 #define IPFW_UH_RUNLOCK(p) rw_runlock(&(p)->uh_lock)
  476 #define IPFW_UH_WLOCK(p) rw_wlock(&(p)->uh_lock)
  477 #define IPFW_UH_WUNLOCK(p) rw_wunlock(&(p)->uh_lock)
  478 
  479 struct obj_idx {
  480         uint16_t        uidx;   /* internal index supplied by userland */
  481         uint16_t        kidx;   /* kernel object index */
  482         uint16_t        off;    /* tlv offset from rule end in 4-byte words */
  483         uint8_t         spare;
  484         uint8_t         type;   /* object type within its category */
  485 };
  486 
  487 struct rule_check_info {
  488         uint16_t        flags;          /* rule-specific check flags */
  489         uint16_t        object_opcodes; /* num of opcodes referencing objects */
  490         uint16_t        urule_numoff;   /* offset of rulenum in bytes */
  491         uint8_t         version;        /* rule version */
  492         uint8_t         spare;
  493         ipfw_obj_ctlv   *ctlv;          /* name TLV containter */
  494         struct ip_fw    *krule;         /* resulting rule pointer */
  495         caddr_t         urule;          /* original rule pointer */
  496         struct obj_idx  obuf[8];        /* table references storage */
  497 };
  498 
  499 /* Legacy interface support */
  500 /*
  501  * FreeBSD 8 export rule format
  502  */
  503 struct ip_fw_rule0 {
  504         struct ip_fw    *x_next;        /* linked list of rules         */
  505         struct ip_fw    *next_rule;     /* ptr to next [skipto] rule    */
  506         /* 'next_rule' is used to pass up 'set_disable' status          */
  507 
  508         uint16_t        act_ofs;        /* offset of action in 32-bit units */
  509         uint16_t        cmd_len;        /* # of 32-bit words in cmd     */
  510         uint16_t        rulenum;        /* rule number                  */
  511         uint8_t         set;            /* rule set (0..31)             */
  512         uint8_t         _pad;           /* padding                      */
  513         uint32_t        id;             /* rule id */
  514 
  515         /* These fields are present in all rules.                       */
  516         uint64_t        pcnt;           /* Packet counter               */
  517         uint64_t        bcnt;           /* Byte counter                 */
  518         uint32_t        timestamp;      /* tv_sec of last match         */
  519 
  520         ipfw_insn       cmd[1];         /* storage for commands         */
  521 };
  522 
  523 struct ip_fw_bcounter0 {
  524         uint64_t        pcnt;           /* Packet counter               */
  525         uint64_t        bcnt;           /* Byte counter                 */
  526         uint32_t        timestamp;      /* tv_sec of last match         */
  527 };
  528 
  529 /* Kernel rule length */
  530 /*
  531  * RULE _K_ SIZE _V_ ->
  532  * get kernel size from userland rool version _V_.
  533  * RULE _U_ SIZE _V_ ->
  534  * get user size version _V_ from kernel rule
  535  * RULESIZE _V_ ->
  536  * get user size rule length 
  537  */
  538 /* FreeBSD8 <> current kernel format */
  539 #define RULEUSIZE0(r)   (sizeof(struct ip_fw_rule0) + (r)->cmd_len * 4 - 4)
  540 #define RULEKSIZE0(r)   roundup2((sizeof(struct ip_fw) + (r)->cmd_len*4 - 4), 8)
  541 /* FreeBSD11 <> current kernel format */
  542 #define RULEUSIZE1(r)   (roundup2(sizeof(struct ip_fw_rule) + \
  543     (r)->cmd_len * 4 - 4, 8))
  544 #define RULEKSIZE1(r)   roundup2((sizeof(struct ip_fw) + (r)->cmd_len*4 - 4), 8)
  545 
  546 /*
  547  * Tables/Objects index rewriting code
  548  */
  549 
  550 /* Default and maximum number of ipfw tables/objects. */
  551 #define IPFW_TABLES_MAX         65536
  552 #define IPFW_TABLES_DEFAULT     128
  553 #define IPFW_OBJECTS_MAX        65536
  554 #define IPFW_OBJECTS_DEFAULT    1024
  555 
  556 #define CHAIN_TO_SRV(ch)        ((ch)->srvmap)
  557 #define SRV_OBJECT(ch, idx)     ((ch)->srvstate[(idx)])
  558 
  559 struct tid_info {
  560         uint32_t        set;    /* table set */
  561         uint16_t        uidx;   /* table index */
  562         uint8_t         type;   /* table type */
  563         uint8_t         atype;
  564         uint8_t         spare;
  565         int             tlen;   /* Total TLV size block */
  566         void            *tlvs;  /* Pointer to first TLV */
  567 };
  568 
  569 /*
  570  * Classifier callback. Checks if @cmd opcode contains kernel object reference.
  571  * If true, returns its index and type.
  572  * Returns 0 if match is found, 1 overwise.
  573  */
  574 typedef int (ipfw_obj_rw_cl)(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype);
  575 /*
  576  * Updater callback. Sets kernel object reference index to @puidx
  577  */
  578 typedef void (ipfw_obj_rw_upd)(ipfw_insn *cmd, uint16_t puidx);
  579 /*
  580  * Finder callback. Tries to find named object by name (specified via @ti).
  581  * Stores found named object pointer in @pno.
  582  * If object was not found, NULL is stored.
  583  *
  584  * Return 0 if input data was valid.
  585  */
  586 typedef int (ipfw_obj_fname_cb)(struct ip_fw_chain *ch,
  587     struct tid_info *ti, struct named_object **pno);
  588 /*
  589  * Another finder callback. Tries to findex named object by kernel index.
  590  *
  591  * Returns pointer to named object or NULL.
  592  */
  593 typedef struct named_object *(ipfw_obj_fidx_cb)(struct ip_fw_chain *ch,
  594     uint16_t kidx);
  595 /*
  596  * Object creator callback. Tries to create object specified by @ti.
  597  * Stores newly-allocated object index in @pkidx.
  598  *
  599  * Returns 0 on success.
  600  */
  601 typedef int (ipfw_obj_create_cb)(struct ip_fw_chain *ch, struct tid_info *ti,
  602     uint16_t *pkidx);
  603 /*
  604  * Object destroy callback. Intended to free resources allocated by
  605  * create_object callback.
  606  */
  607 typedef void (ipfw_obj_destroy_cb)(struct ip_fw_chain *ch,
  608     struct named_object *no);
  609 /*
  610  * Sets handler callback. Handles moving and swaping set of named object.
  611  *  SWAP_ALL moves all named objects from set `set' to `new_set' and vise versa;
  612  *  TEST_ALL checks that there aren't any named object with conflicting names;
  613  *  MOVE_ALL moves all named objects from set `set' to `new_set';
  614  *  COUNT_ONE used to count number of references used by object with kidx `set';
  615  *  TEST_ONE checks that named object with kidx `set' can be moved to `new_set`;
  616  *  MOVE_ONE moves named object with kidx `set' to set `new_set'.
  617  */
  618 enum ipfw_sets_cmd {
  619         SWAP_ALL = 0, TEST_ALL, MOVE_ALL, COUNT_ONE, TEST_ONE, MOVE_ONE
  620 };
  621 typedef int (ipfw_obj_sets_cb)(struct ip_fw_chain *ch,
  622     uint16_t set, uint8_t new_set, enum ipfw_sets_cmd cmd);
  623 
  624 struct opcode_obj_rewrite {
  625         uint32_t                opcode;         /* Opcode to act upon */
  626         uint32_t                etlv;           /* Relevant export TLV id  */
  627         ipfw_obj_rw_cl          *classifier;    /* Check if rewrite is needed */
  628         ipfw_obj_rw_upd         *update;        /* update cmd with new value */
  629         ipfw_obj_fname_cb       *find_byname;   /* Find named object by name */
  630         ipfw_obj_fidx_cb        *find_bykidx;   /* Find named object by kidx */
  631         ipfw_obj_create_cb      *create_object; /* Create named object */
  632         ipfw_obj_destroy_cb     *destroy_object;/* Destroy named object */
  633         ipfw_obj_sets_cb        *manage_sets;   /* Swap or move sets */
  634 };
  635 
  636 #define IPFW_ADD_OBJ_REWRITER(f, c)     do {    \
  637         if ((f) != 0)                           \
  638                 ipfw_add_obj_rewriter(c,        \
  639                     sizeof(c) / sizeof(c[0]));  \
  640         } while(0)
  641 #define IPFW_DEL_OBJ_REWRITER(l, c)     do {    \
  642         if ((l) != 0)                           \
  643                 ipfw_del_obj_rewriter(c,        \
  644                     sizeof(c) / sizeof(c[0]));  \
  645         } while(0)
  646 
  647 /* In ip_fw_iface.c */
  648 int ipfw_iface_init(void);
  649 void ipfw_iface_destroy(void);
  650 void vnet_ipfw_iface_destroy(struct ip_fw_chain *ch);
  651 int ipfw_iface_ref(struct ip_fw_chain *ch, char *name,
  652     struct ipfw_ifc *ic);
  653 void ipfw_iface_unref(struct ip_fw_chain *ch, struct ipfw_ifc *ic);
  654 void ipfw_iface_add_notify(struct ip_fw_chain *ch, struct ipfw_ifc *ic);
  655 void ipfw_iface_del_notify(struct ip_fw_chain *ch, struct ipfw_ifc *ic);
  656 
  657 /* In ip_fw_sockopt.c */
  658 void ipfw_init_skipto_cache(struct ip_fw_chain *chain);
  659 void ipfw_destroy_skipto_cache(struct ip_fw_chain *chain);
  660 int ipfw_find_rule(struct ip_fw_chain *chain, uint32_t key, uint32_t id);
  661 int ipfw_ctl3(struct sockopt *sopt);
  662 int ipfw_add_protected_rule(struct ip_fw_chain *chain, struct ip_fw *rule,
  663     int locked);
  664 void ipfw_reap_add(struct ip_fw_chain *chain, struct ip_fw **head,
  665     struct ip_fw *rule);
  666 void ipfw_reap_rules(struct ip_fw *head);
  667 void ipfw_init_counters(void);
  668 void ipfw_destroy_counters(void);
  669 struct ip_fw *ipfw_alloc_rule(struct ip_fw_chain *chain, size_t rulesize);
  670 void ipfw_free_rule(struct ip_fw *rule);
  671 int ipfw_match_range(struct ip_fw *rule, ipfw_range_tlv *rt);
  672 int ipfw_mark_object_kidx(uint32_t *bmask, uint16_t etlv, uint16_t kidx);
  673 ipfw_insn *ipfw_get_action(struct ip_fw *);
  674 
  675 typedef int (sopt_handler_f)(struct ip_fw_chain *ch,
  676     ip_fw3_opheader *op3, struct sockopt_data *sd);
  677 struct ipfw_sopt_handler {
  678         uint16_t        opcode;
  679         uint8_t         version;
  680         uint8_t         dir;
  681         sopt_handler_f  *handler;
  682         uint64_t        refcnt;
  683 };
  684 #define HDIR_SET        0x01    /* Handler is used to set some data */
  685 #define HDIR_GET        0x02    /* Handler is used to retrieve data */
  686 #define HDIR_BOTH       HDIR_GET|HDIR_SET
  687 
  688 void ipfw_init_sopt_handler(void);
  689 void ipfw_destroy_sopt_handler(void);
  690 void ipfw_add_sopt_handler(struct ipfw_sopt_handler *sh, size_t count);
  691 int ipfw_del_sopt_handler(struct ipfw_sopt_handler *sh, size_t count);
  692 caddr_t ipfw_get_sopt_space(struct sockopt_data *sd, size_t needed);
  693 caddr_t ipfw_get_sopt_header(struct sockopt_data *sd, size_t needed);
  694 #define IPFW_ADD_SOPT_HANDLER(f, c)     do {    \
  695         if ((f) != 0)                           \
  696                 ipfw_add_sopt_handler(c,        \
  697                     sizeof(c) / sizeof(c[0]));  \
  698         } while(0)
  699 #define IPFW_DEL_SOPT_HANDLER(l, c)     do {    \
  700         if ((l) != 0)                           \
  701                 ipfw_del_sopt_handler(c,        \
  702                     sizeof(c) / sizeof(c[0]));  \
  703         } while(0)
  704 
  705 struct namedobj_instance;
  706 typedef int (objhash_cb_t)(struct namedobj_instance *ni, struct named_object *,
  707     void *arg);
  708 typedef uint32_t (objhash_hash_f)(struct namedobj_instance *ni, const void *key,
  709     uint32_t kopt);
  710 typedef int (objhash_cmp_f)(struct named_object *no, const void *key,
  711     uint32_t kopt);
  712 struct namedobj_instance *ipfw_objhash_create(uint32_t items);
  713 void ipfw_objhash_destroy(struct namedobj_instance *);
  714 void ipfw_objhash_bitmap_alloc(uint32_t items, void **idx, int *pblocks);
  715 void ipfw_objhash_bitmap_merge(struct namedobj_instance *ni,
  716     void **idx, int *blocks);
  717 void ipfw_objhash_bitmap_swap(struct namedobj_instance *ni,
  718     void **idx, int *blocks);
  719 void ipfw_objhash_bitmap_free(void *idx, int blocks);
  720 void ipfw_objhash_set_hashf(struct namedobj_instance *ni, objhash_hash_f *f);
  721 struct named_object *ipfw_objhash_lookup_name(struct namedobj_instance *ni,
  722     uint32_t set, const char *name);
  723 struct named_object *ipfw_objhash_lookup_name_type(struct namedobj_instance *ni,
  724     uint32_t set, uint32_t type, const char *name);
  725 struct named_object *ipfw_objhash_lookup_kidx(struct namedobj_instance *ni,
  726     uint16_t idx);
  727 int ipfw_objhash_same_name(struct namedobj_instance *ni, struct named_object *a,
  728     struct named_object *b);
  729 void ipfw_objhash_add(struct namedobj_instance *ni, struct named_object *no);
  730 void ipfw_objhash_del(struct namedobj_instance *ni, struct named_object *no);
  731 uint32_t ipfw_objhash_count(struct namedobj_instance *ni);
  732 uint32_t ipfw_objhash_count_type(struct namedobj_instance *ni, uint16_t type);
  733 int ipfw_objhash_foreach(struct namedobj_instance *ni, objhash_cb_t *f,
  734     void *arg);
  735 int ipfw_objhash_foreach_type(struct namedobj_instance *ni, objhash_cb_t *f,
  736     void *arg, uint16_t type);
  737 int ipfw_objhash_free_idx(struct namedobj_instance *ni, uint16_t idx);
  738 int ipfw_objhash_alloc_idx(void *n, uint16_t *pidx);
  739 void ipfw_objhash_set_funcs(struct namedobj_instance *ni,
  740     objhash_hash_f *hash_f, objhash_cmp_f *cmp_f);
  741 int ipfw_objhash_find_type(struct namedobj_instance *ni, struct tid_info *ti,
  742     uint32_t etlv, struct named_object **pno);
  743 void ipfw_export_obj_ntlv(struct named_object *no, ipfw_obj_ntlv *ntlv);
  744 ipfw_obj_ntlv *ipfw_find_name_tlv_type(void *tlvs, int len, uint16_t uidx,
  745     uint32_t etlv);
  746 void ipfw_init_obj_rewriter(void);
  747 void ipfw_destroy_obj_rewriter(void);
  748 void ipfw_add_obj_rewriter(struct opcode_obj_rewrite *rw, size_t count);
  749 int ipfw_del_obj_rewriter(struct opcode_obj_rewrite *rw, size_t count);
  750 
  751 int create_objects_compat(struct ip_fw_chain *ch, ipfw_insn *cmd,
  752     struct obj_idx *oib, struct obj_idx *pidx, struct tid_info *ti);
  753 void update_opcode_kidx(ipfw_insn *cmd, uint16_t idx);
  754 int classify_opcode_kidx(ipfw_insn *cmd, uint16_t *puidx);
  755 void ipfw_init_srv(struct ip_fw_chain *ch);
  756 void ipfw_destroy_srv(struct ip_fw_chain *ch);
  757 int ipfw_check_object_name_generic(const char *name);
  758 int ipfw_obj_manage_sets(struct namedobj_instance *ni, uint16_t type,
  759     uint16_t set, uint8_t new_set, enum ipfw_sets_cmd cmd);
  760 
  761 /* In ip_fw_eaction.c */
  762 typedef int (ipfw_eaction_t)(struct ip_fw_chain *ch, struct ip_fw_args *args,
  763     ipfw_insn *cmd, int *done);
  764 int ipfw_eaction_init(struct ip_fw_chain *ch, int first);
  765 void ipfw_eaction_uninit(struct ip_fw_chain *ch, int last);
  766 
  767 uint16_t ipfw_add_eaction(struct ip_fw_chain *ch, ipfw_eaction_t handler,
  768     const char *name);
  769 int ipfw_del_eaction(struct ip_fw_chain *ch, uint16_t eaction_id);
  770 int ipfw_run_eaction(struct ip_fw_chain *ch, struct ip_fw_args *args,
  771     ipfw_insn *cmd, int *done);
  772 int ipfw_reset_eaction(struct ip_fw_chain *ch, struct ip_fw *rule,
  773     uint16_t eaction_id, uint16_t default_id, uint16_t instance_id);
  774 int ipfw_reset_eaction_instance(struct ip_fw_chain *ch, uint16_t eaction_id,
  775     uint16_t instance_id);
  776 
  777 /* In ip_fw_table.c */
  778 struct table_info;
  779 
  780 typedef int (table_lookup_t)(struct table_info *ti, void *key, uint32_t keylen,
  781     uint32_t *val);
  782 
  783 int ipfw_lookup_table(struct ip_fw_chain *ch, uint16_t tbl, uint16_t plen,
  784     void *paddr, uint32_t *val);
  785 struct named_object *ipfw_objhash_lookup_table_kidx(struct ip_fw_chain *ch,
  786     uint16_t kidx);
  787 int ipfw_ref_table(struct ip_fw_chain *ch, ipfw_obj_ntlv *ntlv, uint16_t *kidx);
  788 void ipfw_unref_table(struct ip_fw_chain *ch, uint16_t kidx);
  789 int ipfw_init_tables(struct ip_fw_chain *ch, int first);
  790 int ipfw_resize_tables(struct ip_fw_chain *ch, unsigned int ntables);
  791 int ipfw_switch_tables_namespace(struct ip_fw_chain *ch, unsigned int nsets);
  792 void ipfw_destroy_tables(struct ip_fw_chain *ch, int last);
  793 
  794 /* In ip_fw_nat.c -- XXX to be moved to ip_var.h */
  795 
  796 extern struct cfg_nat *(*lookup_nat_ptr)(struct nat_list *, int);
  797 
  798 typedef int ipfw_nat_t(struct ip_fw_args *, struct cfg_nat *, struct mbuf *);
  799 typedef int ipfw_nat_cfg_t(struct sockopt *);
  800 
  801 VNET_DECLARE(int, ipfw_nat_ready);
  802 #define V_ipfw_nat_ready        VNET(ipfw_nat_ready)
  803 #define IPFW_NAT_LOADED (V_ipfw_nat_ready)
  804 
  805 extern ipfw_nat_t *ipfw_nat_ptr;
  806 extern ipfw_nat_cfg_t *ipfw_nat_cfg_ptr;
  807 extern ipfw_nat_cfg_t *ipfw_nat_del_ptr;
  808 extern ipfw_nat_cfg_t *ipfw_nat_get_cfg_ptr;
  809 extern ipfw_nat_cfg_t *ipfw_nat_get_log_ptr;
  810 
  811 /* Helper functions for IP checksum adjustment */
  812 static __inline uint16_t
  813 cksum_add(uint16_t sum, uint16_t a)
  814 {
  815         uint16_t res;
  816 
  817         res = sum + a;
  818         return (res + (res < a));
  819 }
  820 
  821 static __inline uint16_t
  822 cksum_adjust(uint16_t oldsum, uint16_t old, uint16_t new)
  823 {
  824 
  825         return (~cksum_add(cksum_add(~oldsum, ~old), new));
  826 }
  827 
  828 #endif /* _KERNEL */
  829 #endif /* _IPFW2_PRIVATE_H */

Cache object: 4ed4d138ff6a73d053d25b46351a0a5d


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.