Differential D46183 Diff 141565 sys/netpfil/ipfw/ip_fw_private.h

Changeset View

Standalone View

sys/netpfil/ipfw/ip_fw_private.h

Show First 20 Lines • Show All 150 Lines • ▼ Show 20 Lines
int ipfw_attach_hooks(void);		int ipfw_attach_hooks(void);
void ipfw_detach_hooks(void);		void ipfw_detach_hooks(void);
#ifdef NOTYET		#ifdef NOTYET
void ipfw_nat_destroy(void);		void ipfw_nat_destroy(void);
#endif		#endif

/* In ip_fw_log.c */		/* In ip_fw_log.c */
struct ip;		struct ip;
		struct ip_fw;
struct ip_fw_chain;		struct ip_fw_chain;

void ipfw_bpf_init(int);		void ipfw_bpf_init(int);
void ipfw_bpf_uninit(int);		void ipfw_bpf_uninit(int);
void ipfw_bpf_tap(u_char *, u_int);		void ipfw_bpf_tap(u_char *, u_int);
void ipfw_bpf_mtap(struct mbuf *);		void ipfw_bpf_mtap(struct mbuf *);
void ipfw_bpf_mtap2(void , u_int, struct mbuf );		void ipfw_bpf_mtap2(void , u_int, struct mbuf );
void ipfw_log(struct ip_fw_chain chain, struct ip_fw f, u_int hlen,		void ipfw_log(struct ip_fw_chain chain, struct ip_fw f, u_int hlen,
struct ip_fw_args args, u_short offset, uint32_t tablearg, struct ip ip);		struct ip_fw_args args, u_short offset, uint32_t tablearg, struct ip ip,
		void *eh);
VNET_DECLARE(u_int64_t, norule_counter);		VNET_DECLARE(u_int64_t, norule_counter);
#define V_norule_counter VNET(norule_counter)		#define V_norule_counter VNET(norule_counter)
VNET_DECLARE(int, verbose_limit);		VNET_DECLARE(int, verbose_limit);
#define V_verbose_limit VNET(verbose_limit)		#define V_verbose_limit VNET(verbose_limit)

/* In ip_fw_dynamic.c */		/* In ip_fw_dynamic.c */
struct sockopt_data;		struct sockopt_data;

Show All 15 Lines
#define DYN_LOOKUP_NEEDED(p, cmd) \		#define DYN_LOOKUP_NEEDED(p, cmd) \
((p)->direction == MATCH_UNKNOWN \|\| \		((p)->direction == MATCH_UNKNOWN \|\| \
((p)->kidx != 0 && (p)->kidx != (cmd)->arg1))		((p)->kidx != 0 && (p)->kidx != (cmd)->arg1))
#define DYN_INFO_INIT(p) do { \		#define DYN_INFO_INIT(p) do { \
(p)->direction = MATCH_UNKNOWN; \		(p)->direction = MATCH_UNKNOWN; \
(p)->kidx = 0; \		(p)->kidx = 0; \
} while (0)		} while (0)
struct ipfw_dyn_info {		struct ipfw_dyn_info {
uint16_t direction; /* match direction */		uint32_t direction; /* match direction */
uint16_t kidx; /* state name kidx */		uint32_t kidx; /* state name kidx */
uint32_t hashval; /* hash value */		uint32_t hashval; /* hash value */
uint32_t version; /* bucket version */		uint32_t version; /* bucket version */
uint32_t f_pos;		uint32_t f_pos;
};		};
int ipfw_dyn_install_state(struct ip_fw_chain chain, struct ip_fw rule,		int ipfw_dyn_install_state(struct ip_fw_chain chain, struct ip_fw rule,
const ipfw_insn_limit cmd, const struct ip_fw_args args,		const ipfw_insn_limit cmd, const struct ip_fw_args args,
const void ulp, int pktlen, struct ipfw_dyn_info info,		const void ulp, int pktlen, struct ipfw_dyn_info info,
uint32_t tablearg);		uint32_t tablearg);
struct ip_fw ipfw_dyn_lookup_state(const struct ip_fw_args args,		struct ip_fw ipfw_dyn_lookup_state(const struct ip_fw_args args,
const void ulp, int pktlen, const ipfw_insn cmd,		const void ulp, int pktlen, const ipfw_insn cmd,
struct ipfw_dyn_info *info);		struct ipfw_dyn_info *info);

int ipfw_is_dyn_rule(struct ip_fw *rule);		int ipfw_is_dyn_rule(struct ip_fw *rule);
void ipfw_expire_dyn_states(struct ip_fw_chain , ipfw_range_tlv );		void ipfw_expire_dyn_states(struct ip_fw_chain , ipfw_range_tlv );
void ipfw_get_dynamic(struct ip_fw_chain chain, char bp, const char ep);		void ipfw_get_dynamic(struct ip_fw_chain chain, char bp, const char ep);
int ipfw_dump_states(struct ip_fw_chain chain, struct sockopt_data sd);		int ipfw_dump_states(struct ip_fw_chain chain, struct sockopt_data sd);

void ipfw_dyn_init(struct ip_fw_chain ); / per-vnet initialization */		void ipfw_dyn_init(struct ip_fw_chain ); / per-vnet initialization */
void ipfw_dyn_uninit(int); /* per-vnet deinitialization */		void ipfw_dyn_uninit(int); /* per-vnet deinitialization */
int ipfw_dyn_len(void);		int ipfw_dyn_len(void);
uint32_t ipfw_dyn_get_count(uint32_t , int );		uint32_t ipfw_dyn_get_count(uint32_t , int );
void ipfw_dyn_reset_eaction(struct ip_fw_chain *ch, uint16_t eaction_id,		void ipfw_dyn_reset_eaction(struct ip_fw_chain *ch, uint32_t eaction_id,
uint16_t default_id, uint16_t instance_id);		uint32_t default_id, uint32_t instance_id);

/* common variables */		/* common variables */
VNET_DECLARE(int, fw_one_pass);		VNET_DECLARE(int, fw_one_pass);
#define V_fw_one_pass VNET(fw_one_pass)		#define V_fw_one_pass VNET(fw_one_pass)

VNET_DECLARE(int, fw_verbose);		VNET_DECLARE(int, fw_verbose);
#define V_fw_verbose VNET(fw_verbose)		#define V_fw_verbose VNET(fw_verbose)

VNET_DECLARE(struct ip_fw_chain, layer3_chain);		VNET_DECLARE(struct ip_fw_chain, layer3_chain);
#define V_layer3_chain VNET(layer3_chain)		#define V_layer3_chain VNET(layer3_chain)

VNET_DECLARE(int, ipfw_vnet_ready);		VNET_DECLARE(int, ipfw_vnet_ready);
#define V_ipfw_vnet_ready VNET(ipfw_vnet_ready)		#define V_ipfw_vnet_ready VNET(ipfw_vnet_ready)

		VNET_DECLARE(int, skipto_cache);
		#define V_skipto_cache VNET(skipto_cache)

VNET_DECLARE(u_int32_t, set_disable);		VNET_DECLARE(u_int32_t, set_disable);
#define V_set_disable VNET(set_disable)		#define V_set_disable VNET(set_disable)

VNET_DECLARE(int, autoinc_step);		VNET_DECLARE(int, autoinc_step);
#define V_autoinc_step VNET(autoinc_step)		#define V_autoinc_step VNET(autoinc_step)

VNET_DECLARE(unsigned int, fw_tables_max);		VNET_DECLARE(unsigned int, fw_tables_max);
#define V_fw_tables_max VNET(fw_tables_max)		#define V_fw_tables_max VNET(fw_tables_max)
Show All 25 Lines	union {
};		};
uint64_t raw_value;		uint64_t raw_value;
};		};
};		};

struct ip_fw {		struct ip_fw {
uint16_t act_ofs; /* offset of action in 32-bit units */		uint16_t act_ofs; /* offset of action in 32-bit units */
uint16_t cmd_len; /* # of 32-bit words in cmd */		uint16_t cmd_len; /* # of 32-bit words in cmd */
uint16_t rulenum; /* rule number */		uint32_t rulenum; /* rule number */
uint8_t set; /* rule set (0..31) */		uint8_t set; /* rule set (0..31) */
uint8_t flags; /* currently unused */		uint8_t flags; /* currently unused */
		uint16_t _pad;
counter_u64_t cntr; /* Pointer to rule counters */		counter_u64_t cntr; /* Pointer to rule counters */
struct ip_fw_jump_cache cache; /* used by jump_fast */		struct ip_fw_jump_cache cache; /* used by jump_fast */
uint32_t timestamp; /* tv_sec of last match */		uint32_t timestamp; /* tv_sec of last match */
uint32_t id; /* rule id */		uint32_t id; /* rule id */
uint32_t refcnt; /* number of references */		uint32_t refcnt; /* number of references */

struct ip_fw next; / linked list of deleted rules */		struct ip_fw next; / linked list of deleted rules */
ipfw_insn cmd[1]; /* storage for commands */		ipfw_insn cmd[1]; /* storage for commands */
Show All 11 Lines	struct ip_fw_chain {
void valuestate; / runtime table value info */		void valuestate; / runtime table value info */
int idxmap; / skipto array of rules */		int idxmap; / skipto array of rules */
void *srvstate; / runtime service mappings */		void *srvstate; / runtime service mappings */
#if defined( __linux__ ) \|\| defined( _WIN32 )		#if defined( __linux__ ) \|\| defined( _WIN32 )
spinlock_t rwmtx;		spinlock_t rwmtx;
#else		#else
struct rmlock rwmtx;		struct rmlock rwmtx;
#endif		#endif
int static_len; /* total len of static rules (v0) */
uint32_t gencnt; /* NAT generation count */		uint32_t gencnt; /* NAT generation count */
LIST_HEAD(nat_list, cfg_nat) nat; /* list of nat entries */		LIST_HEAD(nat_list, cfg_nat) nat; /* list of nat entries */
struct ip_fw *default_rule;		struct ip_fw *default_rule;
struct tables_config tblcfg; / tables module data */		struct tables_config tblcfg; / tables module data */
void ifcfg; / interface module data */		void ifcfg; / interface module data */
int idxmap_back; / standby skipto array of rules */		int idxmap_back; / standby skipto array of rules */
struct namedobj_instance srvmap; / cfg name->number mappings */		struct namedobj_instance srvmap; / cfg name->number mappings */
#if defined( __linux__ ) \|\| defined( _WIN32 )		#if defined( __linux__ ) \|\| defined( _WIN32 )
spinlock_t uh_lock;		spinlock_t uh_lock;
#else		#else
struct rwlock uh_lock; /* lock for upper half */		struct rwlock uh_lock; /* lock for upper half */
#endif		#endif
};		};

/* 64-byte structure representing multi-field table value */		/* 64-byte structure representing multi-field table value */
struct table_value {		struct table_value {
uint32_t tag; /* O_TAG/O_TAGGED */		uint32_t tag; /* O_TAG/O_TAGGED */
uint32_t pipe; /* O_PIPE/O_QUEUE */		uint16_t pipe; /* O_PIPE/O_QUEUE */
uint16_t divert; /* O_DIVERT/O_TEE */		uint16_t divert; /* O_DIVERT/O_TEE */
uint16_t skipto; /* skipto, CALLRET */		uint32_t skipto; /* skipto, CALLRET */
uint32_t netgraph; /* O_NETGRAPH/O_NGTEE */		uint32_t netgraph; /* O_NETGRAPH/O_NGTEE */
uint16_t fib; /* O_SETFIB */		uint16_t fib; /* O_SETFIB */
uint16_t nat; /* O_NAT */		uint16_t nat; /* O_NAT */
uint32_t mark; /* O_SETMARK/O_MARK */		uint32_t mark; /* O_SETMARK/O_MARK */
uint32_t nh4;		uint32_t nh4;
uint8_t dscp;		uint8_t dscp;
uint8_t spare0;		uint8_t spare0;
uint16_t kidx; /* value kernel index */		uint16_t kidx; /* value kernel index */
/* -- 32 bytes -- */		/* -- 32 bytes -- */
struct in6_addr nh6;		struct in6_addr nh6;
uint32_t limit; /* O_LIMIT */		uint32_t limit; /* O_LIMIT */
uint32_t zoneid; /* scope zone id for nh6 */		uint32_t zoneid; /* scope zone id for nh6 */
uint64_t refcnt; /* Number of references */		uint64_t refcnt; /* Number of references */
};		};

struct named_object {		struct named_object {
TAILQ_ENTRY(named_object) nn_next; /* namehash */		TAILQ_ENTRY(named_object) nn_next; /* namehash */
TAILQ_ENTRY(named_object) nv_next; /* valuehash */		TAILQ_ENTRY(named_object) nv_next; /* valuehash */
char name; / object name */		char name; / object name */
uint16_t etlv; /* Export TLV id */		uint16_t etlv; /* Export TLV id */
uint8_t subtype;/* object subtype within class */		uint8_t subtype;/* object subtype within class */
uint8_t set; /* set object belongs to */		uint8_t set; /* set object belongs to */
uint16_t kidx; /* object kernel index */		uint32_t kidx; /* object kernel index */
uint16_t spare;
uint32_t ocnt; /* object counter for internal use */		uint32_t ocnt; /* object counter for internal use */
uint32_t refcnt; /* number of references */		uint32_t refcnt; /* number of references */
};		};
TAILQ_HEAD(namedobjects_head, named_object);		TAILQ_HEAD(namedobjects_head, named_object);

struct sockopt; /* used by tcp_var.h */		struct sockopt; /* used by tcp_var.h */
struct sockopt_data {		struct sockopt_data {
caddr_t kbuf; /* allocated buffer */		caddr_t kbuf; /* allocated buffer */
▲ Show 20 Lines • Show All 109 Lines • ▼ Show 20 Lines
#define IPFW_UH_UNLOCK_ASSERT(_chain) rw_assert(&(_chain)->uh_lock, RA_UNLOCKED)		#define IPFW_UH_UNLOCK_ASSERT(_chain) rw_assert(&(_chain)->uh_lock, RA_UNLOCKED)

#define IPFW_UH_RLOCK(p) rw_rlock(&(p)->uh_lock)		#define IPFW_UH_RLOCK(p) rw_rlock(&(p)->uh_lock)
#define IPFW_UH_RUNLOCK(p) rw_runlock(&(p)->uh_lock)		#define IPFW_UH_RUNLOCK(p) rw_runlock(&(p)->uh_lock)
#define IPFW_UH_WLOCK(p) rw_wlock(&(p)->uh_lock)		#define IPFW_UH_WLOCK(p) rw_wlock(&(p)->uh_lock)
#define IPFW_UH_WUNLOCK(p) rw_wunlock(&(p)->uh_lock)		#define IPFW_UH_WUNLOCK(p) rw_wunlock(&(p)->uh_lock)

struct obj_idx {		struct obj_idx {
uint16_t uidx; /* internal index supplied by userland */		uint32_t uidx; /* internal index supplied by userland */
uint16_t kidx; /* kernel object index */		uint32_t kidx; /* kernel object index */
uint16_t off; /* tlv offset from rule end in 4-byte words */		uint16_t off; /* tlv offset from rule end in 4-byte words */
uint8_t spare;		uint8_t spare;
uint8_t type; /* object type within its category */		uint8_t type; /* object type within its category */
};		};

struct rule_check_info {		struct rule_check_info {
uint16_t flags; /* rule-specific check flags */		uint16_t flags; /* rule-specific check flags */
uint16_t object_opcodes; /* num of opcodes referencing objects */		uint16_t object_opcodes; /* num of opcodes referencing objects */
uint16_t urule_numoff; /* offset of rulenum in bytes */		uint16_t urule_numoff; /* offset of rulenum in bytes */
uint8_t version; /* rule version */		uint8_t version; /* rule version */
uint8_t spare;		uint8_t spare;
ipfw_obj_ctlv ctlv; / name TLV containter */		ipfw_obj_ctlv ctlv; / name TLV containter */
struct ip_fw krule; / resulting rule pointer */		struct ip_fw krule; / resulting rule pointer */
caddr_t urule; /* original rule pointer */		caddr_t urule; /* original rule pointer */
struct obj_idx obuf[8]; /* table references storage */		struct obj_idx obuf[8]; /* table references storage */
};		};

/* Legacy interface support */
/*
* FreeBSD 8 export rule format
*/
struct ip_fw_rule0 {
struct ip_fw x_next; / linked list of rules */
struct ip_fw next_rule; / ptr to next [skipto] rule */
/* 'next_rule' is used to pass up 'set_disable' status */

uint16_t act_ofs; /* offset of action in 32-bit units */
uint16_t cmd_len; /* # of 32-bit words in cmd */
uint16_t rulenum; /* rule number */
uint8_t set; /* rule set (0..31) */
uint8_t _pad; /* padding */
uint32_t id; /* rule id */

/* These fields are present in all rules. */
uint64_t pcnt; /* Packet counter */
uint64_t bcnt; /* Byte counter */
uint32_t timestamp; /* tv_sec of last match */

ipfw_insn cmd[1]; /* storage for commands */
};

struct ip_fw_bcounter0 {
uint64_t pcnt; /* Packet counter */
uint64_t bcnt; /* Byte counter */
uint32_t timestamp; /* tv_sec of last match */
};

/* Kernel rule length */		/* Kernel rule length */
/*		/*
* RULE _K_ SIZE _V_ ->		* RULE _K_ SIZE _V_ ->
* get kernel size from userland rool version _V_.		* get kernel size from userland rool version _V_.
* RULE _U_ SIZE _V_ ->		* RULE _U_ SIZE _V_ ->
* get user size version _V_ from kernel rule		* get user size version _V_ from kernel rule
* RULESIZE _V_ ->		* RULESIZE _V_ ->
* get user size rule length		* get user size rule length
*/		*/
/* FreeBSD8 <> current kernel format */
#define RULEUSIZE0(r) (sizeof(struct ip_fw_rule0) + (r)->cmd_len * 4 - 4)
#define RULEKSIZE0(r) roundup2((sizeof(struct ip_fw) + (r)->cmd_len*4 - 4), 8)
/* FreeBSD11 <> current kernel format */		/* FreeBSD11 <> current kernel format */
#define RULEUSIZE1(r) (roundup2(sizeof(struct ip_fw_rule) + \		#define RULEUSIZE1(r) (roundup2(sizeof(struct ip_fw_rule) + \
(r)->cmd_len * 4 - 4, 8))		(r)->cmd_len * 4 - 4, 8))
#define RULEKSIZE1(r) roundup2((sizeof(struct ip_fw) + (r)->cmd_len*4 - 4), 8)		#define RULEKSIZE1(r) roundup2((sizeof(struct ip_fw) + (r)->cmd_len*4 - 4), 8)

/*		/*
* Tables/Objects index rewriting code		* Tables/Objects index rewriting code
*/		*/

/* Default and maximum number of ipfw tables/objects. */		/* Default and maximum number of ipfw tables/objects. */
#define IPFW_TABLES_MAX 65536		#define IPFW_TABLES_MAX 65536
#define IPFW_TABLES_DEFAULT 128		#define IPFW_TABLES_DEFAULT 128
#define IPFW_OBJECTS_MAX 65536		#define IPFW_OBJECTS_MAX 65536
#define IPFW_OBJECTS_DEFAULT 1024		#define IPFW_OBJECTS_DEFAULT 4096

#define CHAIN_TO_SRV(ch) ((ch)->srvmap)		#define CHAIN_TO_SRV(ch) ((ch)->srvmap)
#define SRV_OBJECT(ch, idx) ((ch)->srvstate[(idx)])		#define SRV_OBJECT(ch, idx) ((ch)->srvstate[(idx)])

struct tid_info {		struct tid_info {
uint32_t set; /* table set */		uint32_t set; /* table set */
uint16_t uidx; /* table index */		uint32_t uidx; /* table index */
uint8_t type; /* table type */		uint8_t type; /* table type */
uint8_t atype;		uint8_t atype;
uint8_t spare;		uint16_t spare;
int tlen; /* Total TLV size block */		int tlen; /* Total TLV size block */
void tlvs; / Pointer to first TLV */		void tlvs; / Pointer to first TLV */
};		};

/*		/*
* Classifier callback. Checks if @cmd opcode contains kernel object reference.		* Classifier callback. Checks if @cmd opcode contains kernel object reference.
* If true, returns its index and type.		* If true, returns its index and type.
* Returns 0 if match is found, 1 overwise.		* Returns 0 if match is found, 1 overwise.
*/		*/
typedef int (ipfw_obj_rw_cl)(ipfw_insn cmd, uint16_t puidx, uint8_t *ptype);		typedef int (ipfw_obj_rw_cl)(ipfw_insn cmd, uint32_t puidx, uint8_t *ptype);
/*		/*
* Updater callback. Sets kernel object reference index to @puidx		* Updater callback. Sets kernel object reference index to @puidx
*/		*/
typedef void (ipfw_obj_rw_upd)(ipfw_insn *cmd, uint16_t puidx);		typedef void (ipfw_obj_rw_upd)(ipfw_insn *cmd, uint32_t puidx);
/*		/*
* Finder callback. Tries to find named object by name (specified via @ti).		* Finder callback. Tries to find named object by name (specified via @ti).
* Stores found named object pointer in @pno.		* Stores found named object pointer in @pno.
* If object was not found, NULL is stored.		* If object was not found, NULL is stored.
*		*
* Return 0 if input data was valid.		* Return 0 if input data was valid.
*/		*/
typedef int (ipfw_obj_fname_cb)(struct ip_fw_chain *ch,		typedef int (ipfw_obj_fname_cb)(struct ip_fw_chain *ch,
struct tid_info ti, struct named_object *pno);		struct tid_info ti, struct named_object *pno);
/*		/*
* Another finder callback. Tries to findex named object by kernel index.		* Another finder callback. Tries to findex named object by kernel index.
*		*
* Returns pointer to named object or NULL.		* Returns pointer to named object or NULL.
*/		*/
typedef struct named_object (ipfw_obj_fidx_cb)(struct ip_fw_chain ch,		typedef struct named_object (ipfw_obj_fidx_cb)(struct ip_fw_chain ch,
uint16_t kidx);		uint32_t kidx);
/*		/*
* Object creator callback. Tries to create object specified by @ti.		* Object creator callback. Tries to create object specified by @ti.
* Stores newly-allocated object index in @pkidx.		* Stores newly-allocated object index in @pkidx.
*		*
* Returns 0 on success.		* Returns 0 on success.
*/		*/
typedef int (ipfw_obj_create_cb)(struct ip_fw_chain ch, struct tid_info ti,		typedef int (ipfw_obj_create_cb)(struct ip_fw_chain ch, struct tid_info ti,
uint16_t *pkidx);		uint32_t *pkidx);
/*		/*
* Object destroy callback. Intended to free resources allocated by		* Object destroy callback. Intended to free resources allocated by
* create_object callback.		* create_object callback.
*/		*/
typedef void (ipfw_obj_destroy_cb)(struct ip_fw_chain *ch,		typedef void (ipfw_obj_destroy_cb)(struct ip_fw_chain *ch,
struct named_object *no);		struct named_object *no);
/*		/*
* Sets handler callback. Handles moving and swaping set of named object.		* Sets handler callback. Handles moving and swaping set of named object.
* SWAP_ALL moves all named objects from set `set' to `new_set' and vise versa;		* SWAP_ALL moves all named objects from set `set' to `new_set' and vise versa;
* TEST_ALL checks that there aren't any named object with conflicting names;		* TEST_ALL checks that there aren't any named object with conflicting names;
* MOVE_ALL moves all named objects from set `set' to `new_set';		* MOVE_ALL moves all named objects from set `set' to `new_set';
* COUNT_ONE used to count number of references used by object with kidx `set';		* COUNT_ONE used to count number of references used by object with kidx `set';
* TEST_ONE checks that named object with kidx `set' can be moved to `new_set`;		* TEST_ONE checks that named object with kidx `set' can be moved to `new_set`;
* MOVE_ONE moves named object with kidx `set' to set `new_set'.		* MOVE_ONE moves named object with kidx `set' to set `new_set'.
*/		*/
enum ipfw_sets_cmd {		enum ipfw_sets_cmd {
SWAP_ALL = 0, TEST_ALL, MOVE_ALL, COUNT_ONE, TEST_ONE, MOVE_ONE		SWAP_ALL = 0, TEST_ALL, MOVE_ALL, COUNT_ONE, TEST_ONE, MOVE_ONE
};		};
typedef int (ipfw_obj_sets_cb)(struct ip_fw_chain *ch,		typedef int (ipfw_obj_sets_cb)(struct ip_fw_chain *ch,
uint16_t set, uint8_t new_set, enum ipfw_sets_cmd cmd);		uint32_t set, uint8_t new_set, enum ipfw_sets_cmd cmd);

struct opcode_obj_rewrite {		struct opcode_obj_rewrite {
uint32_t opcode; /* Opcode to act upon */		uint32_t opcode; /* Opcode to act upon */
uint32_t etlv; /* Relevant export TLV id */		uint32_t etlv; /* Relevant export TLV id */
ipfw_obj_rw_cl classifier; / Check if rewrite is needed */		ipfw_obj_rw_cl classifier; / Check if rewrite is needed */
ipfw_obj_rw_upd update; / update cmd with new value */		ipfw_obj_rw_upd update; / update cmd with new value */
ipfw_obj_fname_cb find_byname; / Find named object by name */		ipfw_obj_fname_cb find_byname; / Find named object by name */
ipfw_obj_fidx_cb find_bykidx; / Find named object by kidx */		ipfw_obj_fidx_cb find_bykidx; / Find named object by kidx */
Show All 19 Lines
void vnet_ipfw_iface_destroy(struct ip_fw_chain *ch);		void vnet_ipfw_iface_destroy(struct ip_fw_chain *ch);
int ipfw_iface_ref(struct ip_fw_chain ch, char name,		int ipfw_iface_ref(struct ip_fw_chain ch, char name,
struct ipfw_ifc *ic);		struct ipfw_ifc *ic);
void ipfw_iface_unref(struct ip_fw_chain ch, struct ipfw_ifc ic);		void ipfw_iface_unref(struct ip_fw_chain ch, struct ipfw_ifc ic);
void ipfw_iface_add_notify(struct ip_fw_chain ch, struct ipfw_ifc ic);		void ipfw_iface_add_notify(struct ip_fw_chain ch, struct ipfw_ifc ic);
void ipfw_iface_del_notify(struct ip_fw_chain ch, struct ipfw_ifc ic);		void ipfw_iface_del_notify(struct ip_fw_chain ch, struct ipfw_ifc ic);

/* In ip_fw_sockopt.c */		/* In ip_fw_sockopt.c */
		enum ipfw_opcheck_result {
		SUCCESS = 0,
		FAILED,
		BAD_SIZE,
		CHECK_ACTION,
		};
		typedef enum ipfw_opcheck_result (ipfw_check_opcode_t)(ipfw_insn *,
		int , struct rule_check_info );

		void ipfw_register_compat(ipfw_check_opcode_t);
		void ipfw_unregister_compat(void);

		enum ipfw_opcheck_result ipfw_check_opcode(ipfw_insn *, int ,
		struct rule_check_info *);
void ipfw_init_skipto_cache(struct ip_fw_chain *chain);		void ipfw_init_skipto_cache(struct ip_fw_chain *chain);
void ipfw_destroy_skipto_cache(struct ip_fw_chain *chain);		void ipfw_destroy_skipto_cache(struct ip_fw_chain *chain);
		void ipfw_enable_skipto_cache(struct ip_fw_chain *chain);
int ipfw_find_rule(struct ip_fw_chain *chain, uint32_t key, uint32_t id);		int ipfw_find_rule(struct ip_fw_chain *chain, uint32_t key, uint32_t id);
int ipfw_ctl3(struct sockopt *sopt);		int ipfw_ctl3(struct sockopt *sopt);
int ipfw_add_protected_rule(struct ip_fw_chain chain, struct ip_fw rule,		int ipfw_add_protected_rule(struct ip_fw_chain chain, struct ip_fw rule,
int locked);		int locked);
void ipfw_reap_add(struct ip_fw_chain chain, struct ip_fw *head,		void ipfw_reap_add(struct ip_fw_chain chain, struct ip_fw *head,
struct ip_fw *rule);		struct ip_fw *rule);
void ipfw_reap_rules(struct ip_fw *head);		void ipfw_reap_rules(struct ip_fw *head);
void ipfw_init_counters(void);		void ipfw_init_counters(void);
void ipfw_destroy_counters(void);		void ipfw_destroy_counters(void);
		int ipfw_commit_rules(struct ip_fw_chain chain, struct rule_check_info rci,
		int count);
struct ip_fw ipfw_alloc_rule(struct ip_fw_chain chain, size_t rulesize);		struct ip_fw ipfw_alloc_rule(struct ip_fw_chain chain, size_t rulesize);
void ipfw_free_rule(struct ip_fw *rule);		void ipfw_free_rule(struct ip_fw *rule);
int ipfw_match_range(struct ip_fw rule, ipfw_range_tlv rt);		int ipfw_match_range(struct ip_fw rule, ipfw_range_tlv rt);
int ipfw_mark_object_kidx(uint32_t *bmask, uint16_t etlv, uint16_t kidx);		int ipfw_mark_object_kidx(uint32_t *bmask, uint16_t etlv, uint32_t kidx);
ipfw_insn ipfw_get_action(struct ip_fw );		ipfw_insn ipfw_get_action(struct ip_fw );
		int ipfw_check_rule(struct ip_fw_rule *rule, size_t size,
		struct rule_check_info *ci);

typedef int (sopt_handler_f)(struct ip_fw_chain *ch,		typedef int (sopt_handler_f)(struct ip_fw_chain *ch,
ip_fw3_opheader op3, struct sockopt_data sd);		ip_fw3_opheader op3, struct sockopt_data sd);
struct ipfw_sopt_handler {		struct ipfw_sopt_handler {
uint16_t opcode;		uint16_t opcode;
uint8_t version;		uint8_t version;
uint8_t dir;		uint8_t dir;
sopt_handler_f *handler;		sopt_handler_f *handler;
Show All 15 Lines	ipfw_add_sopt_handler(c, \
sizeof(c) / sizeof(c[0])); \		sizeof(c) / sizeof(c[0])); \
} while(0)		} while(0)
#define IPFW_DEL_SOPT_HANDLER(l, c) do { \		#define IPFW_DEL_SOPT_HANDLER(l, c) do { \
if ((l) != 0) \		if ((l) != 0) \
ipfw_del_sopt_handler(c, \		ipfw_del_sopt_handler(c, \
sizeof(c) / sizeof(c[0])); \		sizeof(c) / sizeof(c[0])); \
} while(0)		} while(0)

		#define DEFAULT_OBJHASH_SIZE 32
struct namedobj_instance;		struct namedobj_instance;
typedef int (objhash_cb_t)(struct namedobj_instance ni, struct named_object ,		typedef int (objhash_cb_t)(struct namedobj_instance ni, struct named_object ,
void *arg);		void *arg);
typedef uint32_t (objhash_hash_f)(struct namedobj_instance ni, const void key,		typedef uint32_t (objhash_hash_f)(struct namedobj_instance ni, const void key,
uint32_t kopt);		uint32_t kopt);
typedef int (objhash_cmp_f)(struct named_object no, const void key,		typedef int (objhash_cmp_f)(struct named_object no, const void key,
uint32_t kopt);		uint32_t kopt);
struct namedobj_instance *ipfw_objhash_create(uint32_t items);		struct namedobj_instance *ipfw_objhash_create(uint32_t items, size_t hash_size);
void ipfw_objhash_destroy(struct namedobj_instance *);		void ipfw_objhash_destroy(struct namedobj_instance *);
void ipfw_objhash_bitmap_alloc(uint32_t items, void *idx, int pblocks);		void ipfw_objhash_bitmap_alloc(uint32_t items, void *idx, int pblocks);
void ipfw_objhash_bitmap_merge(struct namedobj_instance *ni,		void ipfw_objhash_bitmap_merge(struct namedobj_instance *ni,
void *idx, int blocks);		void *idx, int blocks);
void ipfw_objhash_bitmap_swap(struct namedobj_instance *ni,		void ipfw_objhash_bitmap_swap(struct namedobj_instance *ni,
void *idx, int blocks);		void *idx, int blocks);
void ipfw_objhash_bitmap_free(void *idx, int blocks);		void ipfw_objhash_bitmap_free(void *idx, int blocks);
void ipfw_objhash_set_hashf(struct namedobj_instance ni, objhash_hash_f f);		void ipfw_objhash_set_hashf(struct namedobj_instance ni, objhash_hash_f f);
struct named_object ipfw_objhash_lookup_name(struct namedobj_instance ni,		struct named_object ipfw_objhash_lookup_name(struct namedobj_instance ni,
uint32_t set, const char *name);		uint32_t set, const char *name);
struct named_object ipfw_objhash_lookup_name_type(struct namedobj_instance ni,		struct named_object ipfw_objhash_lookup_name_type(struct namedobj_instance ni,
uint32_t set, uint32_t type, const char *name);		uint32_t set, uint32_t type, const char *name);
struct named_object ipfw_objhash_lookup_kidx(struct namedobj_instance ni,		struct named_object ipfw_objhash_lookup_kidx(struct namedobj_instance ni,
uint16_t idx);		uint32_t idx);
int ipfw_objhash_same_name(struct namedobj_instance ni, struct named_object a,		int ipfw_objhash_same_name(struct namedobj_instance ni, struct named_object a,
struct named_object *b);		struct named_object *b);
void ipfw_objhash_add(struct namedobj_instance ni, struct named_object no);		void ipfw_objhash_add(struct namedobj_instance ni, struct named_object no);
void ipfw_objhash_del(struct namedobj_instance ni, struct named_object no);		void ipfw_objhash_del(struct namedobj_instance ni, struct named_object no);
uint32_t ipfw_objhash_count(struct namedobj_instance *ni);		uint32_t ipfw_objhash_count(struct namedobj_instance *ni);
uint32_t ipfw_objhash_count_type(struct namedobj_instance *ni, uint16_t type);		uint32_t ipfw_objhash_count_type(struct namedobj_instance *ni, uint16_t type);
int ipfw_objhash_foreach(struct namedobj_instance ni, objhash_cb_t f,		int ipfw_objhash_foreach(struct namedobj_instance ni, objhash_cb_t f,
void *arg);		void *arg);
int ipfw_objhash_foreach_type(struct namedobj_instance ni, objhash_cb_t f,		int ipfw_objhash_foreach_type(struct namedobj_instance ni, objhash_cb_t f,
void *arg, uint16_t type);		void *arg, uint16_t type);
int ipfw_objhash_free_idx(struct namedobj_instance *ni, uint16_t idx);		int ipfw_objhash_free_idx(struct namedobj_instance *ni, uint32_t idx);
int ipfw_objhash_alloc_idx(void n, uint16_t pidx);		int ipfw_objhash_alloc_idx(void n, uint32_t pidx);
void ipfw_objhash_set_funcs(struct namedobj_instance *ni,		void ipfw_objhash_set_funcs(struct namedobj_instance *ni,
objhash_hash_f hash_f, objhash_cmp_f cmp_f);		objhash_hash_f hash_f, objhash_cmp_f cmp_f);
int ipfw_objhash_find_type(struct namedobj_instance ni, struct tid_info ti,		int ipfw_objhash_find_type(struct namedobj_instance ni, struct tid_info ti,
uint32_t etlv, struct named_object **pno);		uint32_t etlv, struct named_object **pno);
void ipfw_export_obj_ntlv(struct named_object no, ipfw_obj_ntlv ntlv);		void ipfw_export_obj_ntlv(struct named_object no, ipfw_obj_ntlv ntlv);
ipfw_obj_ntlv ipfw_find_name_tlv_type(void tlvs, int len, uint16_t uidx,		ipfw_obj_ntlv ipfw_find_name_tlv_type(void tlvs, int len, uint32_t uidx,
uint32_t etlv);		uint32_t etlv);
void ipfw_init_obj_rewriter(void);		void ipfw_init_obj_rewriter(void);
void ipfw_destroy_obj_rewriter(void);		void ipfw_destroy_obj_rewriter(void);
void ipfw_add_obj_rewriter(struct opcode_obj_rewrite *rw, size_t count);		void ipfw_add_obj_rewriter(struct opcode_obj_rewrite *rw, size_t count);
int ipfw_del_obj_rewriter(struct opcode_obj_rewrite *rw, size_t count);		int ipfw_del_obj_rewriter(struct opcode_obj_rewrite *rw, size_t count);

int create_objects_compat(struct ip_fw_chain ch, ipfw_insn cmd,		int create_objects_compat(struct ip_fw_chain ch, ipfw_insn cmd,
struct obj_idx oib, struct obj_idx pidx, struct tid_info *ti);		struct obj_idx oib, struct obj_idx pidx, struct tid_info *ti);
void update_opcode_kidx(ipfw_insn *cmd, uint16_t idx);		void update_opcode_kidx(ipfw_insn *cmd, uint32_t idx);
int classify_opcode_kidx(ipfw_insn cmd, uint16_t puidx);		int classify_opcode_kidx(ipfw_insn cmd, uint32_t puidx);
void ipfw_init_srv(struct ip_fw_chain *ch);		void ipfw_init_srv(struct ip_fw_chain *ch);
void ipfw_destroy_srv(struct ip_fw_chain *ch);		void ipfw_destroy_srv(struct ip_fw_chain *ch);
int ipfw_check_object_name_generic(const char *name);		int ipfw_check_object_name_generic(const char *name);
int ipfw_obj_manage_sets(struct namedobj_instance *ni, uint16_t type,		int ipfw_obj_manage_sets(struct namedobj_instance *ni, uint16_t type,
uint16_t set, uint8_t new_set, enum ipfw_sets_cmd cmd);		uint32_t set, uint8_t new_set, enum ipfw_sets_cmd cmd);

/* In ip_fw_eaction.c */		/* In ip_fw_eaction.c */
typedef int (ipfw_eaction_t)(struct ip_fw_chain ch, struct ip_fw_args args,		typedef int (ipfw_eaction_t)(struct ip_fw_chain ch, struct ip_fw_args args,
ipfw_insn cmd, int done);		ipfw_insn cmd, int done);
int ipfw_eaction_init(struct ip_fw_chain *ch, int first);		int ipfw_eaction_init(struct ip_fw_chain *ch, int first);
void ipfw_eaction_uninit(struct ip_fw_chain *ch, int last);		void ipfw_eaction_uninit(struct ip_fw_chain *ch, int last);

uint16_t ipfw_add_eaction(struct ip_fw_chain *ch, ipfw_eaction_t handler,		uint32_t ipfw_add_eaction(struct ip_fw_chain *ch, ipfw_eaction_t handler,
const char *name);		const char *name);
int ipfw_del_eaction(struct ip_fw_chain *ch, uint16_t eaction_id);		int ipfw_del_eaction(struct ip_fw_chain *ch, uint32_t eaction_id);
int ipfw_run_eaction(struct ip_fw_chain ch, struct ip_fw_args args,		int ipfw_run_eaction(struct ip_fw_chain ch, struct ip_fw_args args,
ipfw_insn cmd, int done);		ipfw_insn cmd, int done);
int ipfw_reset_eaction(struct ip_fw_chain ch, struct ip_fw rule,		int ipfw_reset_eaction(struct ip_fw_chain ch, struct ip_fw rule,
uint16_t eaction_id, uint16_t default_id, uint16_t instance_id);		uint32_t eaction_id, uint32_t default_id, uint32_t instance_id);
int ipfw_reset_eaction_instance(struct ip_fw_chain *ch, uint16_t eaction_id,		int ipfw_reset_eaction_instance(struct ip_fw_chain *ch, uint32_t eaction_id,
uint16_t instance_id);		uint32_t instance_id);

/* In ip_fw_table.c */		/* In ip_fw_table.c */
struct table_info;		struct table_info;

typedef int (table_lookup_t)(struct table_info ti, void key, uint32_t keylen,		typedef int (table_lookup_t)(struct table_info ti, void key, uint32_t keylen,
uint32_t *val);		uint32_t *val);

int ipfw_lookup_table(struct ip_fw_chain *ch, uint16_t tbl, uint16_t plen,		int ipfw_lookup_table(struct ip_fw_chain *ch, uint32_t tbl, uint16_t plen,
void paddr, uint32_t val);		void paddr, uint32_t val);
struct named_object ipfw_objhash_lookup_table_kidx(struct ip_fw_chain ch,		struct named_object ipfw_objhash_lookup_table_kidx(struct ip_fw_chain ch,
uint16_t kidx);		uint32_t kidx);
int ipfw_ref_table(struct ip_fw_chain ch, ipfw_obj_ntlv ntlv, uint16_t *kidx);		int ipfw_ref_table(struct ip_fw_chain ch, ipfw_obj_ntlv ntlv, uint32_t *kidx);
void ipfw_unref_table(struct ip_fw_chain *ch, uint16_t kidx);		void ipfw_unref_table(struct ip_fw_chain *ch, uint32_t kidx);
int ipfw_init_tables(struct ip_fw_chain *ch, int first);		int ipfw_init_tables(struct ip_fw_chain *ch, int first);
int ipfw_resize_tables(struct ip_fw_chain *ch, unsigned int ntables);		int ipfw_resize_tables(struct ip_fw_chain *ch, unsigned int ntables);
int ipfw_switch_tables_namespace(struct ip_fw_chain *ch, unsigned int nsets);		int ipfw_switch_tables_namespace(struct ip_fw_chain *ch, unsigned int nsets);
void ipfw_destroy_tables(struct ip_fw_chain *ch, int last);		void ipfw_destroy_tables(struct ip_fw_chain *ch, int last);

/* In ip_fw_nat.c -- XXX to be moved to ip_var.h */		/* In ip_fw_nat.c -- XXX to be moved to ip_var.h */

extern struct cfg_nat (lookup_nat_ptr)(struct nat_list *, int);		extern struct cfg_nat (lookup_nat_ptr)(struct nat_list *, int);
Show All 33 Lines