svn commit: r269725 - in projects/ipfw: sbin/ipfw sys/netinet sys/netpfil/ipfw
Alexander V. Chernikov
melifaro at FreeBSD.org
Fri Aug 8 15:33:28 UTC 2014
Author: melifaro
Date: Fri Aug 8 15:33:26 2014
New Revision: 269725
URL: http://svnweb.freebsd.org/changeset/base/269725
Log:
Partially revert previous commit:
"0" value is perfectly valid for O_SETFIB and O_SETDSCP,
so tablearg remains to be 655535 for now.
Modified:
projects/ipfw/sbin/ipfw/ipfw2.c
projects/ipfw/sys/netinet/ip_fw.h
projects/ipfw/sys/netpfil/ipfw/ip_fw2.c
projects/ipfw/sys/netpfil/ipfw/ip_fw_dynamic.c
projects/ipfw/sys/netpfil/ipfw/ip_fw_private.h
projects/ipfw/sys/netpfil/ipfw/ip_fw_sockopt.c
projects/ipfw/sys/netpfil/ipfw/ip_fw_table.c
Modified: projects/ipfw/sbin/ipfw/ipfw2.c
==============================================================================
--- projects/ipfw/sbin/ipfw/ipfw2.c Fri Aug 8 15:21:43 2014 (r269724)
+++ projects/ipfw/sbin/ipfw/ipfw2.c Fri Aug 8 15:33:26 2014 (r269725)
@@ -93,7 +93,7 @@ int ipfw_socket = -1;
if (!av[0]) \
errx(EX_USAGE, "%s: missing argument", match_value(s_x, tok)); \
if (_substrcmp(*av, "tablearg") == 0) { \
- arg = IP_FW_TARG; \
+ arg = IP_FW_TABLEARG; \
break; \
} \
\
@@ -111,7 +111,7 @@ int ipfw_socket = -1;
errx(EX_DATAERR, "%s: argument is out of range (%u..%u): %s", \
match_value(s_x, tok), min, max, *av); \
\
- if (_xval == IP_FW_TARG) \
+ if (_xval == IP_FW_TABLEARG) \
errx(EX_DATAERR, "%s: illegal argument value: %s", \
match_value(s_x, tok), *av); \
arg = _xval; \
@@ -123,7 +123,7 @@ PRINT_UINT_ARG(const char *str, uint32_t
{
if (str != NULL)
printf("%s",str);
- if (arg == IP_FW_TARG)
+ if (arg == IP_FW_TABLEARG)
printf("tablearg");
else
printf("%u", arg);
@@ -469,7 +469,7 @@ bprint_uint_arg(struct buf_pr *bp, const
if (str != NULL)
bprintf(bp, "%s", str);
- if (arg == IP_FW_TARG)
+ if (arg == IP_FW_TABLEARG)
bprintf(bp, "tablearg");
else
bprintf(bp, "%u", arg);
@@ -3596,11 +3596,11 @@ chkarg:
errx(EX_USAGE, "missing argument for %s", *(av - 1));
if (isdigit(**av)) {
action->arg1 = strtoul(*av, NULL, 10);
- if (action->arg1 <= 0 || action->arg1 >= IP_FW_TARG)
+ if (action->arg1 <= 0 || action->arg1 >= IP_FW_TABLEARG)
errx(EX_DATAERR, "illegal argument for %s",
*(av - 1));
} else if (_substrcmp(*av, "tablearg") == 0) {
- action->arg1 = IP_FW_TARG;
+ action->arg1 = IP_FW_TABLEARG;
} else if (i == TOK_DIVERT || i == TOK_TEE) {
struct servent *s;
setservent(1);
@@ -3724,7 +3724,7 @@ chkarg:
action->opcode = O_SETFIB;
NEED1("missing fib number");
if (_substrcmp(*av, "tablearg") == 0) {
- action->arg1 = IP_FW_TARG;
+ action->arg1 = IP_FW_TABLEARG;
} else {
action->arg1 = strtoul(*av, NULL, 10);
if (sysctlbyname("net.fibs", &numfibs, &intsize,
@@ -3744,7 +3744,7 @@ chkarg:
action->opcode = O_SETDSCP;
NEED1("missing DSCP code");
if (_substrcmp(*av, "tablearg") == 0) {
- action->arg1 = IP_FW_TARG;
+ action->arg1 = IP_FW_TABLEARG;
} else if (isalpha(*av[0])) {
if ((code = match_token(f_ipdscp, *av)) == -1)
errx(EX_DATAERR, "Unknown DSCP code");
Modified: projects/ipfw/sys/netinet/ip_fw.h
==============================================================================
--- projects/ipfw/sys/netinet/ip_fw.h Fri Aug 8 15:21:43 2014 (r269724)
+++ projects/ipfw/sys/netinet/ip_fw.h Fri Aug 8 15:33:26 2014 (r269725)
@@ -49,16 +49,16 @@
* Most commands (queue, pipe, tag, untag, limit...) can have a 16-bit
* argument between 1 and 65534. The value 0 is unused, the value
* 65535 (IP_FW_TABLEARG) is used to represent 'tablearg', i.e. the
- * can be 1..65534, or 0 to indicate the use of a 'tablearg'
+ * can be 1..65534, or 65535 to indicate the use of a 'tablearg'
* result of the most recent table() lookup.
* Note that 16bit is only a historical limit, resulting from
* the use of a 16-bit fields for that value. In reality, we can have
* 2^32 pipes, queues, tag values and so on, and use 0 as a tablearg.
+ * Note there are some opcodes where value 0 is perfectly valid (fib, dscp).
*/
#define IPFW_ARG_MIN 1
#define IPFW_ARG_MAX 65534
-#define IP_FW_TABLEARG 65535 /* Compat value for old clients */
-#define IP_FW_TARG 0 /* Current tablearg value */
+#define IP_FW_TABLEARG 65535
/*
* Number of entries in the call stack of the call/return commands.
Modified: projects/ipfw/sys/netpfil/ipfw/ip_fw2.c
==============================================================================
--- projects/ipfw/sys/netpfil/ipfw/ip_fw2.c Fri Aug 8 15:21:43 2014 (r269724)
+++ projects/ipfw/sys/netpfil/ipfw/ip_fw2.c Fri Aug 8 15:33:26 2014 (r269725)
@@ -810,7 +810,7 @@ jump_fast(struct ip_fw_chain *chain, str
* whose version is written in f->next_rule
* (horrible hacks to avoid changing the ABI).
*/
- if (num != IP_FW_TARG && (uintptr_t)f->x_next == chain->id)
+ if (num != IP_FW_TABLEARG && (uintptr_t)f->x_next == chain->id)
f_pos = (uintptr_t)f->next_rule;
else {
int i = IP_FW_ARG_TABLEARG(num);
@@ -822,7 +822,7 @@ jump_fast(struct ip_fw_chain *chain, str
else
f_pos = ipfw_find_rule(chain, i, 0);
/* update the cache */
- if (num != IP_FW_TARG) {
+ if (num != IP_FW_TABLEARG) {
f->next_rule = (void *)(uintptr_t)f_pos;
f->x_next = (void *)(uintptr_t)chain->id;
}
@@ -2461,7 +2461,7 @@ do { \
retval = IP_FW_DENY;
break;
}
- if (cmd->arg1 != IP_FW_TARG)
+ if (cmd->arg1 != IP_FW_TABLEARG)
((ipfw_insn_nat *)cmd)->nat = t;
}
retval = ipfw_nat_ptr(args, t, m);
Modified: projects/ipfw/sys/netpfil/ipfw/ip_fw_dynamic.c
==============================================================================
--- projects/ipfw/sys/netpfil/ipfw/ip_fw_dynamic.c Fri Aug 8 15:21:43 2014 (r269724)
+++ projects/ipfw/sys/netpfil/ipfw/ip_fw_dynamic.c Fri Aug 8 15:33:26 2014 (r269725)
@@ -719,7 +719,7 @@ ipfw_install_state(struct ip_fw *rule, i
conn_limit = IP_FW_ARG_TABLEARG(cmd->conn_limit);
DEB(
- if (cmd->conn_limit == IP_FW_TARG)
+ if (cmd->conn_limit == IP_FW_TABLEARG)
printf("ipfw: %s: O_LIMIT rule, conn_limit: %u "
"(tablearg)\n", __func__, conn_limit);
else
Modified: projects/ipfw/sys/netpfil/ipfw/ip_fw_private.h
==============================================================================
--- projects/ipfw/sys/netpfil/ipfw/ip_fw_private.h Fri Aug 8 15:21:43 2014 (r269724)
+++ projects/ipfw/sys/netpfil/ipfw/ip_fw_private.h Fri Aug 8 15:33:26 2014 (r269725)
@@ -384,7 +384,7 @@ struct ipfw_ifc {
#endif
-#define IP_FW_ARG_TABLEARG(a) (((a) == IP_FW_TARG) ? tablearg : (a))
+#define IP_FW_ARG_TABLEARG(a) (((a) == IP_FW_TABLEARG) ? tablearg : (a))
/*
* The lock is heavily used by ip_fw2.c (the main file) and ip_fw_nat.c
* so the variable and the macros must be here.
Modified: projects/ipfw/sys/netpfil/ipfw/ip_fw_sockopt.c
==============================================================================
--- projects/ipfw/sys/netpfil/ipfw/ip_fw_sockopt.c Fri Aug 8 15:21:43 2014 (r269724)
+++ projects/ipfw/sys/netpfil/ipfw/ip_fw_sockopt.c Fri Aug 8 15:33:26 2014 (r269725)
@@ -375,7 +375,7 @@ export_cntr0_base(struct ip_fw *krule, s
}
/*
- * Copies rule @urule from v1 userland format (current).
+ * Copies rule @urule from v1 userland format
* to kernel @krule.
* Assume @krule is zeroed.
*/
@@ -456,7 +456,6 @@ import_rule0(struct rule_check_info *ci)
struct ip_fw *krule;
int cmdlen, l;
ipfw_insn *cmd;
- ipfw_insn_limit *lcmd;
ipfw_insn_if *cmdif;
urule = (struct ip_fw_rule0 *)ci->urule;
@@ -478,63 +477,36 @@ import_rule0(struct rule_check_info *ci)
/*
* Alter opcodes:
- * 1) convert tablearg value from 65335 to 0
- * 2) convert table number in iface opcodes to u16
+ * 1) convert table number in iface opcodes to u16
*/
- l = krule->cmd_len;
- cmd = krule->cmd;
+ l = urule->cmd_len;
+ cmd = urule->cmd;
cmdlen = 0;
- for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) {
- cmdlen = F_LEN(cmd);
+ for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) {
+ cmdlen = F_LEN(cmd);
- switch (cmd->opcode) {
- /* Opcodes supporting tablearg */
- case O_TAG:
- case O_TAGGED:
- case O_PIPE:
- case O_QUEUE:
- case O_DIVERT:
- case O_TEE:
- case O_SKIPTO:
- case O_CALLRETURN:
- case O_NETGRAPH:
- case O_NGTEE:
- case O_SETFIB:
- case O_SETDSCP:
- case O_NAT:
- if (cmd->arg1 == 65535)
- cmd->arg1 = IP_FW_TARG;
- break;
- case O_LIMIT:
- lcmd = (ipfw_insn_limit *)cmd;
- if (lcmd->conn_limit == 65535)
- lcmd->conn_limit = IP_FW_TARG;
- break;
- /* Interface tables */
- case O_XMIT:
- case O_RECV:
- case O_VIA:
- /* Interface table, possibly */
- cmdif = (ipfw_insn_if *)cmd;
- if (cmdif->name[0] != '\1')
- break;
-
- cmdif->p.kidx = (uint16_t)cmdif->p.glob;
- break;
- }
+ switch (cmd->opcode) {
+ /* Interface tables */
+ case O_XMIT:
+ case O_RECV:
+ case O_VIA:
+ /* Interface table, possibly */
+ cmdif = (ipfw_insn_if *)cmd;
+ if (cmdif->name[0] != '\1')
+ break;
+
+ cmdif->p.kidx = cmdif->p.glob;
+ break;
+ }
}
}
-/*
- * Copies rule @krule from kernel to FreeBSD8 userland format (v0)
- */
static void
export_rule0(struct ip_fw *krule, struct ip_fw_rule0 *urule, int len)
{
int cmdlen, l;
ipfw_insn *cmd;
- ipfw_insn_limit *lcmd;
ipfw_insn_if *cmdif;
/* copy header */
@@ -554,51 +526,28 @@ export_rule0(struct ip_fw *krule, struct
/*
* Alter opcodes:
- * 1) convert tablearg value from 0 to 65335
- * 2) convert table number in iface opcodes to int
+ * 1) convert table number in iface opcodes to int
*/
l = urule->cmd_len;
cmd = urule->cmd;
cmdlen = 0;
- for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) {
- cmdlen = F_LEN(cmd);
+ for ( ; l > 0 ; l -= cmdlen, cmd += cmdlen) {
+ cmdlen = F_LEN(cmd);
- switch (cmd->opcode) {
- /* Opcodes supporting tablearg */
- case O_TAG:
- case O_TAGGED:
- case O_PIPE:
- case O_QUEUE:
- case O_DIVERT:
- case O_TEE:
- case O_SKIPTO:
- case O_CALLRETURN:
- case O_NETGRAPH:
- case O_NGTEE:
- case O_SETFIB:
- case O_SETDSCP:
- case O_NAT:
- if (cmd->arg1 == IP_FW_TARG)
- cmd->arg1 = 65535;
- break;
- case O_LIMIT:
- lcmd = (ipfw_insn_limit *)cmd;
- if (lcmd->conn_limit == IP_FW_TARG)
- lcmd->conn_limit = 65535;
- break;
- /* Interface tables */
- case O_XMIT:
- case O_RECV:
- case O_VIA:
- /* Interface table, possibly */
- cmdif = (ipfw_insn_if *)cmd;
- if (cmdif->name[0] != '\1')
- break;
-
- cmdif->p.glob = cmdif->p.kidx;
- break;
- }
+ switch (cmd->opcode) {
+ /* Interface tables */
+ case O_XMIT:
+ case O_RECV:
+ case O_VIA:
+ /* Interface table, possibly */
+ cmdif = (ipfw_insn_if *)cmd;
+ if (cmdif->name[0] != '\1')
+ break;
+
+ cmdif->p.glob = cmdif->p.kidx;
+ break;
+ }
}
}
Modified: projects/ipfw/sys/netpfil/ipfw/ip_fw_table.c
==============================================================================
--- projects/ipfw/sys/netpfil/ipfw/ip_fw_table.c Fri Aug 8 15:21:43 2014 (r269724)
+++ projects/ipfw/sys/netpfil/ipfw/ip_fw_table.c Fri Aug 8 15:33:26 2014 (r269725)
@@ -2047,7 +2047,7 @@ classify_table_opcode(ipfw_insn *cmd, ui
break;
*ptype = IPFW_TABLE_INTERFACE;
- *puidx = cmdif->p.kidx;
+ *puidx = cmdif->p.glob;
skip = 0;
break;
case O_IP_FLOW_LOOKUP:
@@ -2080,7 +2080,7 @@ update_table_opcode(ipfw_insn *cmd, uint
case O_VIA:
/* Interface table, possibly */
cmdif = (ipfw_insn_if *)cmd;
- cmdif->p.kidx = idx;
+ cmdif->p.glob = idx;
break;
case O_IP_FLOW_LOOKUP:
cmd->arg1 = idx;
More information about the svn-src-projects
mailing list