more splitting of ip_fw2.c, now extract the 'table' routines
and the sockopt routines (the upper half of the kernel). Whoever is the author of the 'table' code (Ruslan/glebius/oleg ?) please change the attribution in ip_fw_table.c. I have copied the copyright line from ip_fw2.c but it carries my name and I have neither written nor designed the feature so I don't deserve the credit. MFC after: 1 month
This commit is contained in:
Luigi Rizzo
parent
d32b247049
commit
22f123afad
@ -2430,6 +2430,8 @@ netinet/ipfw/ip_fw2.c optional inet ipfirewall \
|
||||
netinet/ipfw/ip_fw_dynamic.c optional inet ipfirewall
|
||||
netinet/ipfw/ip_fw_log.c optional inet ipfirewall
|
||||
netinet/ipfw/ip_fw_pfil.c optional inet ipfirewall
|
||||
netinet/ipfw/ip_fw_sockopt.c optional inet ipfirewall
|
||||
netinet/ipfw/ip_fw_table.c optional inet ipfirewall
|
||||
netinet/ipfw/ip_fw_nat.c optional inet ipfirewall_nat
|
||||
netinet/ip_icmp.c optional inet
|
||||
netinet/ip_input.c optional inet
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -102,7 +102,6 @@ MALLOC_DECLARE(M_IPFW);
|
||||
int ipfw_check_in(void *, struct mbuf **, struct ifnet *, int, struct inpcb *inp);
|
||||
int ipfw_check_out(void *, struct mbuf **, struct ifnet *, int, struct inpcb *inp);
|
||||
|
||||
int ipfw_chk(struct ip_fw_args *);
|
||||
|
||||
int ipfw_hook(void);
|
||||
int ipfw6_hook(void);
|
||||
@ -161,11 +160,13 @@ VNET_DECLARE(int, fw_one_pass);
|
||||
VNET_DECLARE(int, fw_enable);
|
||||
VNET_DECLARE(int, fw_verbose);
|
||||
VNET_DECLARE(struct ip_fw_chain, layer3_chain);
|
||||
VNET_DECLARE(u_int32_t, set_disable);
|
||||
|
||||
#define V_fw_one_pass VNET(fw_one_pass)
|
||||
#define V_fw_enable VNET(fw_enable)
|
||||
#define V_fw_verbose VNET(fw_enable)
|
||||
#define V_layer3_chain VNET(layer3_chain)
|
||||
#define V_set_disable VNET(set_disable)
|
||||
|
||||
#ifdef INET6
|
||||
VNET_DECLARE(int, fw6_enable);
|
||||
@ -198,11 +199,43 @@ struct sockopt; /* used by tcp_var.h */
|
||||
#define IPFW_WLOCK(p) rw_wlock(&(p)->rwmtx)
|
||||
#define IPFW_WUNLOCK(p) rw_wunlock(&(p)->rwmtx)
|
||||
|
||||
/* In ip_fw_sockopt.c */
|
||||
int ipfw_add_rule(struct ip_fw_chain *chain, struct ip_fw *input_rule);
|
||||
int ipfw_ctl(struct sockopt *sopt);
|
||||
int ipfw_chk(struct ip_fw_args *args);
|
||||
void ipfw_reap_rules(struct ip_fw *head);
|
||||
void ipfw_free_chain(struct ip_fw_chain *chain, int kill_default);
|
||||
|
||||
/* In ip_fw_table.c */
|
||||
struct radix_node;
|
||||
int ipfw_lookup_table(struct ip_fw_chain *ch, uint16_t tbl, in_addr_t addr,
|
||||
uint32_t *val);
|
||||
int ipfw_init_tables(struct ip_fw_chain *ch);
|
||||
int ipfw_flush_table(struct ip_fw_chain *ch, uint16_t tbl);
|
||||
void ipfw_flush_tables(struct ip_fw_chain *ch);
|
||||
int ipfw_add_table_entry(struct ip_fw_chain *ch, uint16_t tbl, in_addr_t addr,
|
||||
uint8_t mlen, uint32_t value);
|
||||
int ipfw_dump_table_entry(struct radix_node *rn, void *arg);
|
||||
int ipfw_del_table_entry(struct ip_fw_chain *ch, uint16_t tbl, in_addr_t addr,
|
||||
uint8_t mlen);
|
||||
int ipfw_count_table(struct ip_fw_chain *ch, uint32_t tbl, uint32_t *cnt);
|
||||
int ipfw_dump_table(struct ip_fw_chain *ch, ipfw_table *tbl);
|
||||
|
||||
/* In ip_fw_nat.c */
|
||||
|
||||
extern struct cfg_nat *(*lookup_nat_ptr)(struct nat_list *, int);
|
||||
|
||||
typedef int ipfw_nat_t(struct ip_fw_args *, struct cfg_nat *, struct mbuf *);
|
||||
typedef int ipfw_nat_cfg_t(struct sockopt *);
|
||||
|
||||
extern ipfw_nat_t *ipfw_nat_ptr;
|
||||
#define IPFW_NAT_LOADED (ipfw_nat_ptr != NULL)
|
||||
|
||||
extern ipfw_nat_cfg_t *ipfw_nat_cfg_ptr;
|
||||
extern ipfw_nat_cfg_t *ipfw_nat_del_ptr;
|
||||
extern ipfw_nat_cfg_t *ipfw_nat_get_cfg_ptr;
|
||||
extern ipfw_nat_cfg_t *ipfw_nat_get_log_ptr;
|
||||
|
||||
|
||||
#endif /* _KERNEL */
|
||||
#endif /* _IPFW2_PRIVATE_H */
|
||||
|
||||
1096
sys/netinet/ipfw/ip_fw_sockopt.c
Normal file
1096
sys/netinet/ipfw/ip_fw_sockopt.c
Normal file
File diff suppressed because it is too large
Load Diff
261
sys/netinet/ipfw/ip_fw_table.c
Normal file
261
sys/netinet/ipfw/ip_fw_table.c
Normal file
@ -0,0 +1,261 @@
|
||||
/*-
|
||||
* Copyright (c) 2002 Luigi Rizzo, Universita` di Pisa
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include <sys/cdefs.h>
|
||||
__FBSDID("$FreeBSD$");
|
||||
|
||||
#define DEB(x)
|
||||
#define DDB(x) x
|
||||
|
||||
/*
|
||||
* Sockopt support for ipfw
|
||||
*/
|
||||
|
||||
#if !defined(KLD_MODULE)
|
||||
#include "opt_ipfw.h"
|
||||
#include "opt_ipdivert.h"
|
||||
#include "opt_ipdn.h"
|
||||
#include "opt_inet.h"
|
||||
#ifndef INET
|
||||
#error IPFIREWALL requires INET.
|
||||
#endif /* INET */
|
||||
#endif
|
||||
#include "opt_inet6.h"
|
||||
#include "opt_ipsec.h"
|
||||
|
||||
#include <sys/param.h>
|
||||
#include <sys/systm.h>
|
||||
#include <sys/malloc.h>
|
||||
#include <sys/kernel.h>
|
||||
#include <sys/lock.h>
|
||||
#include <sys/rwlock.h>
|
||||
#include <sys/socket.h>
|
||||
#include <net/if.h> /* ip_fw.h requires IFNAMSIZ */
|
||||
#include <net/radix.h>
|
||||
#include <net/route.h>
|
||||
#include <net/vnet.h>
|
||||
|
||||
#include <netinet/in.h>
|
||||
#include <netinet/ip_fw.h>
|
||||
#include <netinet/ipfw/ip_fw_private.h>
|
||||
|
||||
#ifdef MAC
|
||||
#include <security/mac/mac_framework.h>
|
||||
#endif
|
||||
|
||||
MALLOC_DEFINE(M_IPFW_TBL, "ipfw_tbl", "IpFw tables");
|
||||
|
||||
struct table_entry {
|
||||
struct radix_node rn[2];
|
||||
struct sockaddr_in addr, mask;
|
||||
u_int32_t value;
|
||||
};
|
||||
|
||||
int
|
||||
ipfw_add_table_entry(struct ip_fw_chain *ch, uint16_t tbl, in_addr_t addr,
|
||||
uint8_t mlen, uint32_t value)
|
||||
{
|
||||
struct radix_node_head *rnh;
|
||||
struct table_entry *ent;
|
||||
struct radix_node *rn;
|
||||
|
||||
if (tbl >= IPFW_TABLES_MAX)
|
||||
return (EINVAL);
|
||||
rnh = ch->tables[tbl];
|
||||
ent = malloc(sizeof(*ent), M_IPFW_TBL, M_NOWAIT | M_ZERO);
|
||||
if (ent == NULL)
|
||||
return (ENOMEM);
|
||||
ent->value = value;
|
||||
ent->addr.sin_len = ent->mask.sin_len = 8;
|
||||
ent->mask.sin_addr.s_addr = htonl(mlen ? ~((1 << (32 - mlen)) - 1) : 0);
|
||||
ent->addr.sin_addr.s_addr = addr & ent->mask.sin_addr.s_addr;
|
||||
IPFW_WLOCK(ch);
|
||||
rn = rnh->rnh_addaddr(&ent->addr, &ent->mask, rnh, (void *)ent);
|
||||
if (rn == NULL) {
|
||||
IPFW_WUNLOCK(ch);
|
||||
free(ent, M_IPFW_TBL);
|
||||
return (EEXIST);
|
||||
}
|
||||
IPFW_WUNLOCK(ch);
|
||||
return (0);
|
||||
}
|
||||
|
||||
int
|
||||
ipfw_del_table_entry(struct ip_fw_chain *ch, uint16_t tbl, in_addr_t addr,
|
||||
uint8_t mlen)
|
||||
{
|
||||
struct radix_node_head *rnh;
|
||||
struct table_entry *ent;
|
||||
struct sockaddr_in sa, mask;
|
||||
|
||||
if (tbl >= IPFW_TABLES_MAX)
|
||||
return (EINVAL);
|
||||
rnh = ch->tables[tbl];
|
||||
sa.sin_len = mask.sin_len = 8;
|
||||
mask.sin_addr.s_addr = htonl(mlen ? ~((1 << (32 - mlen)) - 1) : 0);
|
||||
sa.sin_addr.s_addr = addr & mask.sin_addr.s_addr;
|
||||
IPFW_WLOCK(ch);
|
||||
ent = (struct table_entry *)rnh->rnh_deladdr(&sa, &mask, rnh);
|
||||
if (ent == NULL) {
|
||||
IPFW_WUNLOCK(ch);
|
||||
return (ESRCH);
|
||||
}
|
||||
IPFW_WUNLOCK(ch);
|
||||
free(ent, M_IPFW_TBL);
|
||||
return (0);
|
||||
}
|
||||
|
||||
static int
|
||||
flush_table_entry(struct radix_node *rn, void *arg)
|
||||
{
|
||||
struct radix_node_head * const rnh = arg;
|
||||
struct table_entry *ent;
|
||||
|
||||
ent = (struct table_entry *)
|
||||
rnh->rnh_deladdr(rn->rn_key, rn->rn_mask, rnh);
|
||||
if (ent != NULL)
|
||||
free(ent, M_IPFW_TBL);
|
||||
return (0);
|
||||
}
|
||||
|
||||
int
|
||||
ipfw_flush_table(struct ip_fw_chain *ch, uint16_t tbl)
|
||||
{
|
||||
struct radix_node_head *rnh;
|
||||
|
||||
IPFW_WLOCK_ASSERT(ch);
|
||||
|
||||
if (tbl >= IPFW_TABLES_MAX)
|
||||
return (EINVAL);
|
||||
rnh = ch->tables[tbl];
|
||||
KASSERT(rnh != NULL, ("NULL IPFW table"));
|
||||
rnh->rnh_walktree(rnh, flush_table_entry, rnh);
|
||||
return (0);
|
||||
}
|
||||
|
||||
void
|
||||
ipfw_flush_tables(struct ip_fw_chain *ch)
|
||||
{
|
||||
uint16_t tbl;
|
||||
|
||||
IPFW_WLOCK_ASSERT(ch);
|
||||
|
||||
for (tbl = 0; tbl < IPFW_TABLES_MAX; tbl++)
|
||||
ipfw_flush_table(ch, tbl);
|
||||
}
|
||||
|
||||
int
|
||||
ipfw_init_tables(struct ip_fw_chain *ch)
|
||||
{
|
||||
int i;
|
||||
uint16_t j;
|
||||
|
||||
for (i = 0; i < IPFW_TABLES_MAX; i++) {
|
||||
if (!rn_inithead((void **)&ch->tables[i], 32)) {
|
||||
for (j = 0; j < i; j++) {
|
||||
(void) ipfw_flush_table(ch, j);
|
||||
}
|
||||
return (ENOMEM);
|
||||
}
|
||||
}
|
||||
return (0);
|
||||
}
|
||||
|
||||
int
|
||||
ipfw_lookup_table(struct ip_fw_chain *ch, uint16_t tbl, in_addr_t addr,
|
||||
uint32_t *val)
|
||||
{
|
||||
struct radix_node_head *rnh;
|
||||
struct table_entry *ent;
|
||||
struct sockaddr_in sa;
|
||||
|
||||
if (tbl >= IPFW_TABLES_MAX)
|
||||
return (0);
|
||||
rnh = ch->tables[tbl];
|
||||
sa.sin_len = 8;
|
||||
sa.sin_addr.s_addr = addr;
|
||||
ent = (struct table_entry *)(rnh->rnh_lookup(&sa, NULL, rnh));
|
||||
if (ent != NULL) {
|
||||
*val = ent->value;
|
||||
return (1);
|
||||
}
|
||||
return (0);
|
||||
}
|
||||
|
||||
static int
|
||||
count_table_entry(struct radix_node *rn, void *arg)
|
||||
{
|
||||
u_int32_t * const cnt = arg;
|
||||
|
||||
(*cnt)++;
|
||||
return (0);
|
||||
}
|
||||
|
||||
int
|
||||
ipfw_count_table(struct ip_fw_chain *ch, uint32_t tbl, uint32_t *cnt)
|
||||
{
|
||||
struct radix_node_head *rnh;
|
||||
|
||||
if (tbl >= IPFW_TABLES_MAX)
|
||||
return (EINVAL);
|
||||
rnh = ch->tables[tbl];
|
||||
*cnt = 0;
|
||||
rnh->rnh_walktree(rnh, count_table_entry, cnt);
|
||||
return (0);
|
||||
}
|
||||
|
||||
static int
|
||||
dump_table_entry(struct radix_node *rn, void *arg)
|
||||
{
|
||||
struct table_entry * const n = (struct table_entry *)rn;
|
||||
ipfw_table * const tbl = arg;
|
||||
ipfw_table_entry *ent;
|
||||
|
||||
if (tbl->cnt == tbl->size)
|
||||
return (1);
|
||||
ent = &tbl->ent[tbl->cnt];
|
||||
ent->tbl = tbl->tbl;
|
||||
if (in_nullhost(n->mask.sin_addr))
|
||||
ent->masklen = 0;
|
||||
else
|
||||
ent->masklen = 33 - ffs(ntohl(n->mask.sin_addr.s_addr));
|
||||
ent->addr = n->addr.sin_addr.s_addr;
|
||||
ent->value = n->value;
|
||||
tbl->cnt++;
|
||||
return (0);
|
||||
}
|
||||
|
||||
int
|
||||
ipfw_dump_table(struct ip_fw_chain *ch, ipfw_table *tbl)
|
||||
{
|
||||
struct radix_node_head *rnh;
|
||||
|
||||
if (tbl->tbl >= IPFW_TABLES_MAX)
|
||||
return (EINVAL);
|
||||
rnh = ch->tables[tbl->tbl];
|
||||
tbl->cnt = 0;
|
||||
rnh->rnh_walktree(rnh, dump_table_entry, tbl);
|
||||
return (0);
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user