From 8bd1921248b8e6bb8fcda9b6209acb67af432316 Mon Sep 17 00:00:00 2001 From: "Alexander V. Chernikov" Date: Fri, 8 Aug 2014 15:33:26 +0000 Subject: [PATCH] Partially revert previous commit: "0" value is perfectly valid for O_SETFIB and O_SETDSCP, so tablearg remains to be 655535 for now. --- sbin/ipfw/ipfw2.c | 16 ++--- sys/netinet/ip_fw.h | 6 +- sys/netpfil/ipfw/ip_fw2.c | 6 +- sys/netpfil/ipfw/ip_fw_dynamic.c | 2 +- sys/netpfil/ipfw/ip_fw_private.h | 2 +- sys/netpfil/ipfw/ip_fw_sockopt.c | 117 +++++++++---------------------- sys/netpfil/ipfw/ip_fw_table.c | 4 +- 7 files changed, 51 insertions(+), 102 deletions(-) diff --git a/sbin/ipfw/ipfw2.c b/sbin/ipfw/ipfw2.c index 1309bafaa2fb..fba03cb60388 100644 --- a/sbin/ipfw/ipfw2.c +++ b/sbin/ipfw/ipfw2.c @@ -93,7 +93,7 @@ int ipfw_socket = -1; if (!av[0]) \ errx(EX_USAGE, "%s: missing argument", match_value(s_x, tok)); \ if (_substrcmp(*av, "tablearg") == 0) { \ - arg = IP_FW_TARG; \ + arg = IP_FW_TABLEARG; \ break; \ } \ \ @@ -111,7 +111,7 @@ int ipfw_socket = -1; errx(EX_DATAERR, "%s: argument is out of range (%u..%u): %s", \ match_value(s_x, tok), min, max, *av); \ \ - if (_xval == IP_FW_TARG) \ + if (_xval == IP_FW_TABLEARG) \ errx(EX_DATAERR, "%s: illegal argument value: %s", \ match_value(s_x, tok), *av); \ arg = _xval; \ @@ -123,7 +123,7 @@ PRINT_UINT_ARG(const char *str, uint32_t arg) { if (str != NULL) printf("%s",str); - if (arg == IP_FW_TARG) + if (arg == IP_FW_TABLEARG) printf("tablearg"); else printf("%u", arg); @@ -469,7 +469,7 @@ bprint_uint_arg(struct buf_pr *bp, const char *str, uint32_t arg) if (str != NULL) bprintf(bp, "%s", str); - if (arg == IP_FW_TARG) + if (arg == IP_FW_TABLEARG) bprintf(bp, "tablearg"); else bprintf(bp, "%u", arg); @@ -3596,11 +3596,11 @@ compile_rule(char *av[], uint32_t *rbuf, int *rbufsize, struct tidx *tstate) errx(EX_USAGE, "missing argument for %s", *(av - 1)); if (isdigit(**av)) { action->arg1 = strtoul(*av, NULL, 10); - if (action->arg1 <= 0 || action->arg1 >= IP_FW_TARG) + if (action->arg1 <= 0 || action->arg1 >= IP_FW_TABLEARG) errx(EX_DATAERR, "illegal argument for %s", *(av - 1)); } else if (_substrcmp(*av, "tablearg") == 0) { - action->arg1 = IP_FW_TARG; + action->arg1 = IP_FW_TABLEARG; } else if (i == TOK_DIVERT || i == TOK_TEE) { struct servent *s; setservent(1); @@ -3724,7 +3724,7 @@ compile_rule(char *av[], uint32_t *rbuf, int *rbufsize, struct tidx *tstate) action->opcode = O_SETFIB; NEED1("missing fib number"); if (_substrcmp(*av, "tablearg") == 0) { - action->arg1 = IP_FW_TARG; + action->arg1 = IP_FW_TABLEARG; } else { action->arg1 = strtoul(*av, NULL, 10); if (sysctlbyname("net.fibs", &numfibs, &intsize, @@ -3744,7 +3744,7 @@ compile_rule(char *av[], uint32_t *rbuf, int *rbufsize, struct tidx *tstate) action->opcode = O_SETDSCP; NEED1("missing DSCP code"); if (_substrcmp(*av, "tablearg") == 0) { - action->arg1 = IP_FW_TARG; + action->arg1 = IP_FW_TABLEARG; } else if (isalpha(*av[0])) { if ((code = match_token(f_ipdscp, *av)) == -1) errx(EX_DATAERR, "Unknown DSCP code"); diff --git a/sys/netinet/ip_fw.h b/sys/netinet/ip_fw.h index 0326d03a9c4e..68edc92d4a93 100644 --- a/sys/netinet/ip_fw.h +++ b/sys/netinet/ip_fw.h @@ -49,16 +49,16 @@ * Most commands (queue, pipe, tag, untag, limit...) can have a 16-bit * argument between 1 and 65534. The value 0 is unused, the value * 65535 (IP_FW_TABLEARG) is used to represent 'tablearg', i.e. the - * can be 1..65534, or 0 to indicate the use of a 'tablearg' + * can be 1..65534, or 65535 to indicate the use of a 'tablearg' * result of the most recent table() lookup. * Note that 16bit is only a historical limit, resulting from * the use of a 16-bit fields for that value. In reality, we can have * 2^32 pipes, queues, tag values and so on, and use 0 as a tablearg. + * Note there are some opcodes where value 0 is perfectly valid (fib, dscp). */ #define IPFW_ARG_MIN 1 #define IPFW_ARG_MAX 65534 -#define IP_FW_TABLEARG 65535 /* Compat value for old clients */ -#define IP_FW_TARG 0 /* Current tablearg value */ +#define IP_FW_TABLEARG 65535 /* * Number of entries in the call stack of the call/return commands. diff --git a/sys/netpfil/ipfw/ip_fw2.c b/sys/netpfil/ipfw/ip_fw2.c index 98f15ce18b9f..b01372e0e694 100644 --- a/sys/netpfil/ipfw/ip_fw2.c +++ b/sys/netpfil/ipfw/ip_fw2.c @@ -810,7 +810,7 @@ jump_fast(struct ip_fw_chain *chain, struct ip_fw *f, int num, * whose version is written in f->next_rule * (horrible hacks to avoid changing the ABI). */ - if (num != IP_FW_TARG && (uintptr_t)f->x_next == chain->id) + if (num != IP_FW_TABLEARG && (uintptr_t)f->x_next == chain->id) f_pos = (uintptr_t)f->next_rule; else { int i = IP_FW_ARG_TABLEARG(num); @@ -822,7 +822,7 @@ jump_fast(struct ip_fw_chain *chain, struct ip_fw *f, int num, else f_pos = ipfw_find_rule(chain, i, 0); /* update the cache */ - if (num != IP_FW_TARG) { + if (num != IP_FW_TABLEARG) { f->next_rule = (void *)(uintptr_t)f_pos; f->x_next = (void *)(uintptr_t)chain->id; } @@ -2461,7 +2461,7 @@ do { \ retval = IP_FW_DENY; break; } - if (cmd->arg1 != IP_FW_TARG) + if (cmd->arg1 != IP_FW_TABLEARG) ((ipfw_insn_nat *)cmd)->nat = t; } retval = ipfw_nat_ptr(args, t, m); diff --git a/sys/netpfil/ipfw/ip_fw_dynamic.c b/sys/netpfil/ipfw/ip_fw_dynamic.c index ba166344a2c9..475ad8e705f9 100644 --- a/sys/netpfil/ipfw/ip_fw_dynamic.c +++ b/sys/netpfil/ipfw/ip_fw_dynamic.c @@ -719,7 +719,7 @@ ipfw_install_state(struct ip_fw *rule, ipfw_insn_limit *cmd, conn_limit = IP_FW_ARG_TABLEARG(cmd->conn_limit); DEB( - if (cmd->conn_limit == IP_FW_TARG) + if (cmd->conn_limit == IP_FW_TABLEARG) printf("ipfw: %s: O_LIMIT rule, conn_limit: %u " "(tablearg)\n", __func__, conn_limit); else diff --git a/sys/netpfil/ipfw/ip_fw_private.h b/sys/netpfil/ipfw/ip_fw_private.h index 2b953084ceb1..246bb3a001f1 100644 --- a/sys/netpfil/ipfw/ip_fw_private.h +++ b/sys/netpfil/ipfw/ip_fw_private.h @@ -384,7 +384,7 @@ struct ipfw_ifc { #endif -#define IP_FW_ARG_TABLEARG(a) (((a) == IP_FW_TARG) ? tablearg : (a)) +#define IP_FW_ARG_TABLEARG(a) (((a) == IP_FW_TABLEARG) ? tablearg : (a)) /* * The lock is heavily used by ip_fw2.c (the main file) and ip_fw_nat.c * so the variable and the macros must be here. diff --git a/sys/netpfil/ipfw/ip_fw_sockopt.c b/sys/netpfil/ipfw/ip_fw_sockopt.c index 55030c6ef291..2beaf0351048 100644 --- a/sys/netpfil/ipfw/ip_fw_sockopt.c +++ b/sys/netpfil/ipfw/ip_fw_sockopt.c @@ -375,7 +375,7 @@ export_cntr0_base(struct ip_fw *krule, struct ip_fw_bcounter0 *cntr) } /* - * Copies rule @urule from v1 userland format (current). + * Copies rule @urule from v1 userland format * to kernel @krule. * Assume @krule is zeroed. */ @@ -456,7 +456,6 @@ import_rule0(struct rule_check_info *ci) struct ip_fw *krule; int cmdlen, l; ipfw_insn *cmd; - ipfw_insn_limit *lcmd; ipfw_insn_if *cmdif; urule = (struct ip_fw_rule0 *)ci->urule; @@ -478,63 +477,36 @@ import_rule0(struct rule_check_info *ci) /* * Alter opcodes: - * 1) convert tablearg value from 65335 to 0 - * 2) convert table number in iface opcodes to u16 + * 1) convert table number in iface opcodes to u16 */ - l = krule->cmd_len; - cmd = krule->cmd; + l = urule->cmd_len; + cmd = urule->cmd; cmdlen = 0; - for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { - cmdlen = F_LEN(cmd); + for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { + cmdlen = F_LEN(cmd); - switch (cmd->opcode) { - /* Opcodes supporting tablearg */ - case O_TAG: - case O_TAGGED: - case O_PIPE: - case O_QUEUE: - case O_DIVERT: - case O_TEE: - case O_SKIPTO: - case O_CALLRETURN: - case O_NETGRAPH: - case O_NGTEE: - case O_SETFIB: - case O_SETDSCP: - case O_NAT: - if (cmd->arg1 == 65535) - cmd->arg1 = IP_FW_TARG; - break; - case O_LIMIT: - lcmd = (ipfw_insn_limit *)cmd; - if (lcmd->conn_limit == 65535) - lcmd->conn_limit = IP_FW_TARG; - break; - /* Interface tables */ - case O_XMIT: - case O_RECV: - case O_VIA: - /* Interface table, possibly */ - cmdif = (ipfw_insn_if *)cmd; - if (cmdif->name[0] != '\1') - break; + switch (cmd->opcode) { + /* Interface tables */ + case O_XMIT: + case O_RECV: + case O_VIA: + /* Interface table, possibly */ + cmdif = (ipfw_insn_if *)cmd; + if (cmdif->name[0] != '\1') + break; - cmdif->p.kidx = (uint16_t)cmdif->p.glob; - break; - } + cmdif->p.kidx = cmdif->p.glob; + break; + } } } -/* - * Copies rule @krule from kernel to FreeBSD8 userland format (v0) - */ static void export_rule0(struct ip_fw *krule, struct ip_fw_rule0 *urule, int len) { int cmdlen, l; ipfw_insn *cmd; - ipfw_insn_limit *lcmd; ipfw_insn_if *cmdif; /* copy header */ @@ -554,51 +526,28 @@ export_rule0(struct ip_fw *krule, struct ip_fw_rule0 *urule, int len) /* * Alter opcodes: - * 1) convert tablearg value from 0 to 65335 - * 2) convert table number in iface opcodes to int + * 1) convert table number in iface opcodes to int */ l = urule->cmd_len; cmd = urule->cmd; cmdlen = 0; - for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { - cmdlen = F_LEN(cmd); + for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) { + cmdlen = F_LEN(cmd); - switch (cmd->opcode) { - /* Opcodes supporting tablearg */ - case O_TAG: - case O_TAGGED: - case O_PIPE: - case O_QUEUE: - case O_DIVERT: - case O_TEE: - case O_SKIPTO: - case O_CALLRETURN: - case O_NETGRAPH: - case O_NGTEE: - case O_SETFIB: - case O_SETDSCP: - case O_NAT: - if (cmd->arg1 == IP_FW_TARG) - cmd->arg1 = 65535; - break; - case O_LIMIT: - lcmd = (ipfw_insn_limit *)cmd; - if (lcmd->conn_limit == IP_FW_TARG) - lcmd->conn_limit = 65535; - break; - /* Interface tables */ - case O_XMIT: - case O_RECV: - case O_VIA: - /* Interface table, possibly */ - cmdif = (ipfw_insn_if *)cmd; - if (cmdif->name[0] != '\1') - break; + switch (cmd->opcode) { + /* Interface tables */ + case O_XMIT: + case O_RECV: + case O_VIA: + /* Interface table, possibly */ + cmdif = (ipfw_insn_if *)cmd; + if (cmdif->name[0] != '\1') + break; - cmdif->p.glob = cmdif->p.kidx; - break; - } + cmdif->p.glob = cmdif->p.kidx; + break; + } } } diff --git a/sys/netpfil/ipfw/ip_fw_table.c b/sys/netpfil/ipfw/ip_fw_table.c index 08029c8d8f1a..f6a8855d0ae1 100644 --- a/sys/netpfil/ipfw/ip_fw_table.c +++ b/sys/netpfil/ipfw/ip_fw_table.c @@ -2047,7 +2047,7 @@ classify_table_opcode(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) break; *ptype = IPFW_TABLE_INTERFACE; - *puidx = cmdif->p.kidx; + *puidx = cmdif->p.glob; skip = 0; break; case O_IP_FLOW_LOOKUP: @@ -2080,7 +2080,7 @@ update_table_opcode(ipfw_insn *cmd, uint16_t idx) case O_VIA: /* Interface table, possibly */ cmdif = (ipfw_insn_if *)cmd; - cmdif->p.kidx = idx; + cmdif->p.glob = idx; break; case O_IP_FLOW_LOOKUP: cmd->arg1 = idx;