Partially revert previous commit:
"0" value is perfectly valid for O_SETFIB and O_SETDSCP, so tablearg remains to be 655535 for now.
This commit is contained in:
parent
2c452b20dd
commit
8bd1921248
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/projects/ipfw/; revision=269725
@ -93,7 +93,7 @@ int ipfw_socket = -1;
|
|||||||
if (!av[0]) \
|
if (!av[0]) \
|
||||||
errx(EX_USAGE, "%s: missing argument", match_value(s_x, tok)); \
|
errx(EX_USAGE, "%s: missing argument", match_value(s_x, tok)); \
|
||||||
if (_substrcmp(*av, "tablearg") == 0) { \
|
if (_substrcmp(*av, "tablearg") == 0) { \
|
||||||
arg = IP_FW_TARG; \
|
arg = IP_FW_TABLEARG; \
|
||||||
break; \
|
break; \
|
||||||
} \
|
} \
|
||||||
\
|
\
|
||||||
@ -111,7 +111,7 @@ int ipfw_socket = -1;
|
|||||||
errx(EX_DATAERR, "%s: argument is out of range (%u..%u): %s", \
|
errx(EX_DATAERR, "%s: argument is out of range (%u..%u): %s", \
|
||||||
match_value(s_x, tok), min, max, *av); \
|
match_value(s_x, tok), min, max, *av); \
|
||||||
\
|
\
|
||||||
if (_xval == IP_FW_TARG) \
|
if (_xval == IP_FW_TABLEARG) \
|
||||||
errx(EX_DATAERR, "%s: illegal argument value: %s", \
|
errx(EX_DATAERR, "%s: illegal argument value: %s", \
|
||||||
match_value(s_x, tok), *av); \
|
match_value(s_x, tok), *av); \
|
||||||
arg = _xval; \
|
arg = _xval; \
|
||||||
@ -123,7 +123,7 @@ PRINT_UINT_ARG(const char *str, uint32_t arg)
|
|||||||
{
|
{
|
||||||
if (str != NULL)
|
if (str != NULL)
|
||||||
printf("%s",str);
|
printf("%s",str);
|
||||||
if (arg == IP_FW_TARG)
|
if (arg == IP_FW_TABLEARG)
|
||||||
printf("tablearg");
|
printf("tablearg");
|
||||||
else
|
else
|
||||||
printf("%u", arg);
|
printf("%u", arg);
|
||||||
@ -469,7 +469,7 @@ bprint_uint_arg(struct buf_pr *bp, const char *str, uint32_t arg)
|
|||||||
|
|
||||||
if (str != NULL)
|
if (str != NULL)
|
||||||
bprintf(bp, "%s", str);
|
bprintf(bp, "%s", str);
|
||||||
if (arg == IP_FW_TARG)
|
if (arg == IP_FW_TABLEARG)
|
||||||
bprintf(bp, "tablearg");
|
bprintf(bp, "tablearg");
|
||||||
else
|
else
|
||||||
bprintf(bp, "%u", arg);
|
bprintf(bp, "%u", arg);
|
||||||
@ -3596,11 +3596,11 @@ compile_rule(char *av[], uint32_t *rbuf, int *rbufsize, struct tidx *tstate)
|
|||||||
errx(EX_USAGE, "missing argument for %s", *(av - 1));
|
errx(EX_USAGE, "missing argument for %s", *(av - 1));
|
||||||
if (isdigit(**av)) {
|
if (isdigit(**av)) {
|
||||||
action->arg1 = strtoul(*av, NULL, 10);
|
action->arg1 = strtoul(*av, NULL, 10);
|
||||||
if (action->arg1 <= 0 || action->arg1 >= IP_FW_TARG)
|
if (action->arg1 <= 0 || action->arg1 >= IP_FW_TABLEARG)
|
||||||
errx(EX_DATAERR, "illegal argument for %s",
|
errx(EX_DATAERR, "illegal argument for %s",
|
||||||
*(av - 1));
|
*(av - 1));
|
||||||
} else if (_substrcmp(*av, "tablearg") == 0) {
|
} else if (_substrcmp(*av, "tablearg") == 0) {
|
||||||
action->arg1 = IP_FW_TARG;
|
action->arg1 = IP_FW_TABLEARG;
|
||||||
} else if (i == TOK_DIVERT || i == TOK_TEE) {
|
} else if (i == TOK_DIVERT || i == TOK_TEE) {
|
||||||
struct servent *s;
|
struct servent *s;
|
||||||
setservent(1);
|
setservent(1);
|
||||||
@ -3724,7 +3724,7 @@ compile_rule(char *av[], uint32_t *rbuf, int *rbufsize, struct tidx *tstate)
|
|||||||
action->opcode = O_SETFIB;
|
action->opcode = O_SETFIB;
|
||||||
NEED1("missing fib number");
|
NEED1("missing fib number");
|
||||||
if (_substrcmp(*av, "tablearg") == 0) {
|
if (_substrcmp(*av, "tablearg") == 0) {
|
||||||
action->arg1 = IP_FW_TARG;
|
action->arg1 = IP_FW_TABLEARG;
|
||||||
} else {
|
} else {
|
||||||
action->arg1 = strtoul(*av, NULL, 10);
|
action->arg1 = strtoul(*av, NULL, 10);
|
||||||
if (sysctlbyname("net.fibs", &numfibs, &intsize,
|
if (sysctlbyname("net.fibs", &numfibs, &intsize,
|
||||||
@ -3744,7 +3744,7 @@ compile_rule(char *av[], uint32_t *rbuf, int *rbufsize, struct tidx *tstate)
|
|||||||
action->opcode = O_SETDSCP;
|
action->opcode = O_SETDSCP;
|
||||||
NEED1("missing DSCP code");
|
NEED1("missing DSCP code");
|
||||||
if (_substrcmp(*av, "tablearg") == 0) {
|
if (_substrcmp(*av, "tablearg") == 0) {
|
||||||
action->arg1 = IP_FW_TARG;
|
action->arg1 = IP_FW_TABLEARG;
|
||||||
} else if (isalpha(*av[0])) {
|
} else if (isalpha(*av[0])) {
|
||||||
if ((code = match_token(f_ipdscp, *av)) == -1)
|
if ((code = match_token(f_ipdscp, *av)) == -1)
|
||||||
errx(EX_DATAERR, "Unknown DSCP code");
|
errx(EX_DATAERR, "Unknown DSCP code");
|
||||||
|
@ -49,16 +49,16 @@
|
|||||||
* Most commands (queue, pipe, tag, untag, limit...) can have a 16-bit
|
* Most commands (queue, pipe, tag, untag, limit...) can have a 16-bit
|
||||||
* argument between 1 and 65534. The value 0 is unused, the value
|
* argument between 1 and 65534. The value 0 is unused, the value
|
||||||
* 65535 (IP_FW_TABLEARG) is used to represent 'tablearg', i.e. the
|
* 65535 (IP_FW_TABLEARG) is used to represent 'tablearg', i.e. the
|
||||||
* can be 1..65534, or 0 to indicate the use of a 'tablearg'
|
* can be 1..65534, or 65535 to indicate the use of a 'tablearg'
|
||||||
* result of the most recent table() lookup.
|
* result of the most recent table() lookup.
|
||||||
* Note that 16bit is only a historical limit, resulting from
|
* Note that 16bit is only a historical limit, resulting from
|
||||||
* the use of a 16-bit fields for that value. In reality, we can have
|
* the use of a 16-bit fields for that value. In reality, we can have
|
||||||
* 2^32 pipes, queues, tag values and so on, and use 0 as a tablearg.
|
* 2^32 pipes, queues, tag values and so on, and use 0 as a tablearg.
|
||||||
|
* Note there are some opcodes where value 0 is perfectly valid (fib, dscp).
|
||||||
*/
|
*/
|
||||||
#define IPFW_ARG_MIN 1
|
#define IPFW_ARG_MIN 1
|
||||||
#define IPFW_ARG_MAX 65534
|
#define IPFW_ARG_MAX 65534
|
||||||
#define IP_FW_TABLEARG 65535 /* Compat value for old clients */
|
#define IP_FW_TABLEARG 65535
|
||||||
#define IP_FW_TARG 0 /* Current tablearg value */
|
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Number of entries in the call stack of the call/return commands.
|
* Number of entries in the call stack of the call/return commands.
|
||||||
|
@ -810,7 +810,7 @@ jump_fast(struct ip_fw_chain *chain, struct ip_fw *f, int num,
|
|||||||
* whose version is written in f->next_rule
|
* whose version is written in f->next_rule
|
||||||
* (horrible hacks to avoid changing the ABI).
|
* (horrible hacks to avoid changing the ABI).
|
||||||
*/
|
*/
|
||||||
if (num != IP_FW_TARG && (uintptr_t)f->x_next == chain->id)
|
if (num != IP_FW_TABLEARG && (uintptr_t)f->x_next == chain->id)
|
||||||
f_pos = (uintptr_t)f->next_rule;
|
f_pos = (uintptr_t)f->next_rule;
|
||||||
else {
|
else {
|
||||||
int i = IP_FW_ARG_TABLEARG(num);
|
int i = IP_FW_ARG_TABLEARG(num);
|
||||||
@ -822,7 +822,7 @@ jump_fast(struct ip_fw_chain *chain, struct ip_fw *f, int num,
|
|||||||
else
|
else
|
||||||
f_pos = ipfw_find_rule(chain, i, 0);
|
f_pos = ipfw_find_rule(chain, i, 0);
|
||||||
/* update the cache */
|
/* update the cache */
|
||||||
if (num != IP_FW_TARG) {
|
if (num != IP_FW_TABLEARG) {
|
||||||
f->next_rule = (void *)(uintptr_t)f_pos;
|
f->next_rule = (void *)(uintptr_t)f_pos;
|
||||||
f->x_next = (void *)(uintptr_t)chain->id;
|
f->x_next = (void *)(uintptr_t)chain->id;
|
||||||
}
|
}
|
||||||
@ -2461,7 +2461,7 @@ do { \
|
|||||||
retval = IP_FW_DENY;
|
retval = IP_FW_DENY;
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
if (cmd->arg1 != IP_FW_TARG)
|
if (cmd->arg1 != IP_FW_TABLEARG)
|
||||||
((ipfw_insn_nat *)cmd)->nat = t;
|
((ipfw_insn_nat *)cmd)->nat = t;
|
||||||
}
|
}
|
||||||
retval = ipfw_nat_ptr(args, t, m);
|
retval = ipfw_nat_ptr(args, t, m);
|
||||||
|
@ -719,7 +719,7 @@ ipfw_install_state(struct ip_fw *rule, ipfw_insn_limit *cmd,
|
|||||||
conn_limit = IP_FW_ARG_TABLEARG(cmd->conn_limit);
|
conn_limit = IP_FW_ARG_TABLEARG(cmd->conn_limit);
|
||||||
|
|
||||||
DEB(
|
DEB(
|
||||||
if (cmd->conn_limit == IP_FW_TARG)
|
if (cmd->conn_limit == IP_FW_TABLEARG)
|
||||||
printf("ipfw: %s: O_LIMIT rule, conn_limit: %u "
|
printf("ipfw: %s: O_LIMIT rule, conn_limit: %u "
|
||||||
"(tablearg)\n", __func__, conn_limit);
|
"(tablearg)\n", __func__, conn_limit);
|
||||||
else
|
else
|
||||||
|
@ -384,7 +384,7 @@ struct ipfw_ifc {
|
|||||||
#endif
|
#endif
|
||||||
|
|
||||||
|
|
||||||
#define IP_FW_ARG_TABLEARG(a) (((a) == IP_FW_TARG) ? tablearg : (a))
|
#define IP_FW_ARG_TABLEARG(a) (((a) == IP_FW_TABLEARG) ? tablearg : (a))
|
||||||
/*
|
/*
|
||||||
* The lock is heavily used by ip_fw2.c (the main file) and ip_fw_nat.c
|
* The lock is heavily used by ip_fw2.c (the main file) and ip_fw_nat.c
|
||||||
* so the variable and the macros must be here.
|
* so the variable and the macros must be here.
|
||||||
|
@ -375,7 +375,7 @@ export_cntr0_base(struct ip_fw *krule, struct ip_fw_bcounter0 *cntr)
|
|||||||
}
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Copies rule @urule from v1 userland format (current).
|
* Copies rule @urule from v1 userland format
|
||||||
* to kernel @krule.
|
* to kernel @krule.
|
||||||
* Assume @krule is zeroed.
|
* Assume @krule is zeroed.
|
||||||
*/
|
*/
|
||||||
@ -456,7 +456,6 @@ import_rule0(struct rule_check_info *ci)
|
|||||||
struct ip_fw *krule;
|
struct ip_fw *krule;
|
||||||
int cmdlen, l;
|
int cmdlen, l;
|
||||||
ipfw_insn *cmd;
|
ipfw_insn *cmd;
|
||||||
ipfw_insn_limit *lcmd;
|
|
||||||
ipfw_insn_if *cmdif;
|
ipfw_insn_if *cmdif;
|
||||||
|
|
||||||
urule = (struct ip_fw_rule0 *)ci->urule;
|
urule = (struct ip_fw_rule0 *)ci->urule;
|
||||||
@ -478,63 +477,36 @@ import_rule0(struct rule_check_info *ci)
|
|||||||
|
|
||||||
/*
|
/*
|
||||||
* Alter opcodes:
|
* Alter opcodes:
|
||||||
* 1) convert tablearg value from 65335 to 0
|
* 1) convert table number in iface opcodes to u16
|
||||||
* 2) convert table number in iface opcodes to u16
|
|
||||||
*/
|
*/
|
||||||
l = krule->cmd_len;
|
l = urule->cmd_len;
|
||||||
cmd = krule->cmd;
|
cmd = urule->cmd;
|
||||||
cmdlen = 0;
|
cmdlen = 0;
|
||||||
|
|
||||||
for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) {
|
for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) {
|
||||||
cmdlen = F_LEN(cmd);
|
cmdlen = F_LEN(cmd);
|
||||||
|
|
||||||
switch (cmd->opcode) {
|
switch (cmd->opcode) {
|
||||||
/* Opcodes supporting tablearg */
|
/* Interface tables */
|
||||||
case O_TAG:
|
case O_XMIT:
|
||||||
case O_TAGGED:
|
case O_RECV:
|
||||||
case O_PIPE:
|
case O_VIA:
|
||||||
case O_QUEUE:
|
/* Interface table, possibly */
|
||||||
case O_DIVERT:
|
cmdif = (ipfw_insn_if *)cmd;
|
||||||
case O_TEE:
|
if (cmdif->name[0] != '\1')
|
||||||
case O_SKIPTO:
|
break;
|
||||||
case O_CALLRETURN:
|
|
||||||
case O_NETGRAPH:
|
|
||||||
case O_NGTEE:
|
|
||||||
case O_SETFIB:
|
|
||||||
case O_SETDSCP:
|
|
||||||
case O_NAT:
|
|
||||||
if (cmd->arg1 == 65535)
|
|
||||||
cmd->arg1 = IP_FW_TARG;
|
|
||||||
break;
|
|
||||||
case O_LIMIT:
|
|
||||||
lcmd = (ipfw_insn_limit *)cmd;
|
|
||||||
if (lcmd->conn_limit == 65535)
|
|
||||||
lcmd->conn_limit = IP_FW_TARG;
|
|
||||||
break;
|
|
||||||
/* Interface tables */
|
|
||||||
case O_XMIT:
|
|
||||||
case O_RECV:
|
|
||||||
case O_VIA:
|
|
||||||
/* Interface table, possibly */
|
|
||||||
cmdif = (ipfw_insn_if *)cmd;
|
|
||||||
if (cmdif->name[0] != '\1')
|
|
||||||
break;
|
|
||||||
|
|
||||||
cmdif->p.kidx = (uint16_t)cmdif->p.glob;
|
cmdif->p.kidx = cmdif->p.glob;
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
|
||||||
* Copies rule @krule from kernel to FreeBSD8 userland format (v0)
|
|
||||||
*/
|
|
||||||
static void
|
static void
|
||||||
export_rule0(struct ip_fw *krule, struct ip_fw_rule0 *urule, int len)
|
export_rule0(struct ip_fw *krule, struct ip_fw_rule0 *urule, int len)
|
||||||
{
|
{
|
||||||
int cmdlen, l;
|
int cmdlen, l;
|
||||||
ipfw_insn *cmd;
|
ipfw_insn *cmd;
|
||||||
ipfw_insn_limit *lcmd;
|
|
||||||
ipfw_insn_if *cmdif;
|
ipfw_insn_if *cmdif;
|
||||||
|
|
||||||
/* copy header */
|
/* copy header */
|
||||||
@ -554,51 +526,28 @@ export_rule0(struct ip_fw *krule, struct ip_fw_rule0 *urule, int len)
|
|||||||
|
|
||||||
/*
|
/*
|
||||||
* Alter opcodes:
|
* Alter opcodes:
|
||||||
* 1) convert tablearg value from 0 to 65335
|
* 1) convert table number in iface opcodes to int
|
||||||
* 2) convert table number in iface opcodes to int
|
|
||||||
*/
|
*/
|
||||||
l = urule->cmd_len;
|
l = urule->cmd_len;
|
||||||
cmd = urule->cmd;
|
cmd = urule->cmd;
|
||||||
cmdlen = 0;
|
cmdlen = 0;
|
||||||
|
|
||||||
for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) {
|
for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) {
|
||||||
cmdlen = F_LEN(cmd);
|
cmdlen = F_LEN(cmd);
|
||||||
|
|
||||||
switch (cmd->opcode) {
|
switch (cmd->opcode) {
|
||||||
/* Opcodes supporting tablearg */
|
/* Interface tables */
|
||||||
case O_TAG:
|
case O_XMIT:
|
||||||
case O_TAGGED:
|
case O_RECV:
|
||||||
case O_PIPE:
|
case O_VIA:
|
||||||
case O_QUEUE:
|
/* Interface table, possibly */
|
||||||
case O_DIVERT:
|
cmdif = (ipfw_insn_if *)cmd;
|
||||||
case O_TEE:
|
if (cmdif->name[0] != '\1')
|
||||||
case O_SKIPTO:
|
break;
|
||||||
case O_CALLRETURN:
|
|
||||||
case O_NETGRAPH:
|
|
||||||
case O_NGTEE:
|
|
||||||
case O_SETFIB:
|
|
||||||
case O_SETDSCP:
|
|
||||||
case O_NAT:
|
|
||||||
if (cmd->arg1 == IP_FW_TARG)
|
|
||||||
cmd->arg1 = 65535;
|
|
||||||
break;
|
|
||||||
case O_LIMIT:
|
|
||||||
lcmd = (ipfw_insn_limit *)cmd;
|
|
||||||
if (lcmd->conn_limit == IP_FW_TARG)
|
|
||||||
lcmd->conn_limit = 65535;
|
|
||||||
break;
|
|
||||||
/* Interface tables */
|
|
||||||
case O_XMIT:
|
|
||||||
case O_RECV:
|
|
||||||
case O_VIA:
|
|
||||||
/* Interface table, possibly */
|
|
||||||
cmdif = (ipfw_insn_if *)cmd;
|
|
||||||
if (cmdif->name[0] != '\1')
|
|
||||||
break;
|
|
||||||
|
|
||||||
cmdif->p.glob = cmdif->p.kidx;
|
cmdif->p.glob = cmdif->p.kidx;
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -2047,7 +2047,7 @@ classify_table_opcode(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
|
|||||||
break;
|
break;
|
||||||
|
|
||||||
*ptype = IPFW_TABLE_INTERFACE;
|
*ptype = IPFW_TABLE_INTERFACE;
|
||||||
*puidx = cmdif->p.kidx;
|
*puidx = cmdif->p.glob;
|
||||||
skip = 0;
|
skip = 0;
|
||||||
break;
|
break;
|
||||||
case O_IP_FLOW_LOOKUP:
|
case O_IP_FLOW_LOOKUP:
|
||||||
@ -2080,7 +2080,7 @@ update_table_opcode(ipfw_insn *cmd, uint16_t idx)
|
|||||||
case O_VIA:
|
case O_VIA:
|
||||||
/* Interface table, possibly */
|
/* Interface table, possibly */
|
||||||
cmdif = (ipfw_insn_if *)cmd;
|
cmdif = (ipfw_insn_if *)cmd;
|
||||||
cmdif->p.kidx = idx;
|
cmdif->p.glob = idx;
|
||||||
break;
|
break;
|
||||||
case O_IP_FLOW_LOOKUP:
|
case O_IP_FLOW_LOOKUP:
|
||||||
cmd->arg1 = idx;
|
cmd->arg1 = idx;
|
||||||
|
Loading…
Reference in New Issue
Block a user