Author: melifaro
Date: Sat May 18 05:31:17 2013
New Revision: 250760
URL: http://svnweb.freebsd.org/changeset/base/250760
Log:
Merge r244633, r250246.
Use unified IP_FW_ARG_TABLEARG() macro for most tablearg checks.
Log real value instead of IP_FW_TABLEARG (65535) in ipfw_log().
Use unified method for accessing / updating cached rule pointers.
Modified:
stable/9/sys/netpfil/ipfw/ip_fw2.c
stable/9/sys/netpfil/ipfw/ip_fw_dynamic.c
stable/9/sys/netpfil/ipfw/ip_fw_log.c
stable/9/sys/netpfil/ipfw/ip_fw_private.h
Directory Properties:
stable/9/sys/ (props changed)
Modified: stable/9/sys/netpfil/ipfw/ip_fw2.c
==============================================================================
--- stable/9/sys/netpfil/ipfw/ip_fw2.c Sat May 18 04:49:00 2013
(r250759)
+++ stable/9/sys/netpfil/ipfw/ip_fw2.c Sat May 18 05:31:17 2013
(r250760)
@@ -782,6 +782,38 @@ set_match(struct ip_fw_args *args, int s
}
/*
+ * Helper function to enable cached rule lookups using
+ * x_next and next_rule fields in ipfw rule.
+ */
+static int
+jump_fast(struct ip_fw_chain *chain, struct ip_fw *f, int num,
+ int tablearg, int jump_backwards)
+{
+ int f_pos;
+
+ /* If possible use cached f_pos (in f->next_rule),
+ * whose version is written in f->next_rule
+ * (horrible hacks to avoid changing the ABI).
+ */
+ if (num != IP_FW_TABLEARG && (uintptr_t)f->x_next == chain->id)
+ f_pos = (uintptr_t)f->next_rule;
+ else {
+ int i = IP_FW_ARG_TABLEARG(num);
+ /* make sure we do not jump backward */
+ if (jump_backwards == 0 && i <= f->rulenum)
+ i = f->rulenum + 1;
+ f_pos = ipfw_find_rule(chain, i, 0);
+ /* update the cache */
+ if (num != IP_FW_TABLEARG) {
+ f->next_rule = (void *)(uintptr_t)f_pos;
+ f->x_next = (void *)(uintptr_t)chain->id;
+ }
+ }
+
+ return (f_pos);
+}
+
+/*
* The main check routine for the firewall.
*
* All arguments are in args so we can modify them and return them
@@ -1842,8 +1874,7 @@ do {
\
case O_TAG: {
struct m_tag *mtag;
- uint32_t tag = (cmd->arg1 == IP_FW_TABLEARG) ?
- tablearg : cmd->arg1;
+ uint32_t tag = IP_FW_ARG_TABLEARG(cmd->arg1);
/* Packet is already tagged with this tag? */
mtag = m_tag_locate(m, MTAG_IPFW, tag, NULL);
@@ -1922,8 +1953,7 @@ do {
\
case O_TAGGED: {
struct m_tag *mtag;
- uint32_t tag = (cmd->arg1 == IP_FW_TABLEARG) ?
- tablearg : cmd->arg1;
+ uint32_t tag = IP_FW_ARG_TABLEARG(cmd->arg1);
if (cmdlen == 1) {
match = m_tag_locate(m, MTAG_IPFW,
@@ -2062,8 +2092,7 @@ do {
\
case O_PIPE:
case O_QUEUE:
set_match(args, f_pos, chain);
- args->rule.info = (cmd->arg1 == IP_FW_TABLEARG)
?
- tablearg : cmd->arg1;
+ args->rule.info = IP_FW_ARG_TABLEARG(cmd->arg1);
if (cmd->opcode == O_PIPE)
args->rule.info |= IPFW_IS_PIPE;
if (V_fw_one_pass)
@@ -2083,8 +2112,7 @@ do {
\
retval = (cmd->opcode == O_DIVERT) ?
IP_FW_DIVERT : IP_FW_TEE;
set_match(args, f_pos, chain);
- args->rule.info = (cmd->arg1 == IP_FW_TABLEARG)
?
- tablearg : cmd->arg1;
+ args->rule.info = IP_FW_ARG_TABLEARG(cmd->arg1);
break;
case O_COUNT:
@@ -2098,28 +2126,7 @@ do {
\
f->pcnt++; /* update stats */
f->bcnt += pktlen;
f->timestamp = time_uptime;
- /* If possible use cached f_pos (in f->next_rule),
- * whose version is written in f->next_rule
- * (horrible hacks to avoid changing the ABI).
- */
- if (cmd->arg1 != IP_FW_TABLEARG &&
- (uintptr_t)f->x_next == chain->id) {
- f_pos = (uintptr_t)f->next_rule;
- } else {
- int i = (cmd->arg1 == IP_FW_TABLEARG) ?
- tablearg : cmd->arg1;
- /* make sure we do not jump backward */
- if (i <= f->rulenum)
- i = f->rulenum + 1;
- f_pos = ipfw_find_rule(chain, i, 0);
- /* update the cache */
- if (cmd->arg1 != IP_FW_TABLEARG) {
- f->next_rule =
- (void *)(uintptr_t)f_pos;
- f->x_next =
- (void *)(uintptr_t)chain->id;
- }
- }
+ f_pos = jump_fast(chain, f, cmd->arg1, tablearg, 0);
/*
* Skip disabled rules, and re-enter
* the inner loop with the correct
@@ -2210,26 +2217,8 @@ do {
\
if (IS_CALL) {
stack[mtag->m_tag_id] = f->rulenum;
mtag->m_tag_id++;
- if (cmd->arg1 != IP_FW_TABLEARG &&
- (uintptr_t)f->x_next == chain->id) {
- f_pos = (uintptr_t)f->next_rule;
- } else {
- jmpto = (cmd->arg1 ==
- IP_FW_TABLEARG) ? tablearg:
- cmd->arg1;
- f_pos = ipfw_find_rule(chain,
- jmpto, 0);
- /* update the cache */
- if (cmd->arg1 !=
- IP_FW_TABLEARG) {
- f->next_rule =
- (void *)(uintptr_t)
- f_pos;
- f->x_next =
- (void *)(uintptr_t)
- chain->id;
- }
- }
+ f_pos = jump_fast(chain, f, cmd->arg1,
+ tablearg, 1);
} else { /* `return' action */
mtag->m_tag_id--;
jmpto = stack[mtag->m_tag_id] + 1;
@@ -2336,8 +2325,7 @@ do {
\
case O_NETGRAPH:
case O_NGTEE:
set_match(args, f_pos, chain);
- args->rule.info = (cmd->arg1 == IP_FW_TABLEARG)
?
- tablearg : cmd->arg1;
+ args->rule.info = IP_FW_ARG_TABLEARG(cmd->arg1);
if (V_fw_one_pass)
args->rule.info |= IPFW_ONEPASS;
retval = (cmd->opcode == O_NETGRAPH) ?
@@ -2352,8 +2340,7 @@ do {
\
f->pcnt++; /* update stats */
f->bcnt += pktlen;
f->timestamp = time_uptime;
- fib = (cmd->arg1 == IP_FW_TABLEARG) ? tablearg:
- cmd->arg1;
+ fib = IP_FW_ARG_TABLEARG(cmd->arg1);
if (fib >= rt_numfibs)
fib = 0;
M_SETFIB(m, fib);
@@ -2379,8 +2366,7 @@ do {
\
}
t = ((ipfw_insn_nat *)cmd)->nat;
if (t == NULL) {
- nat_id = (cmd->arg1 == IP_FW_TABLEARG) ?
- tablearg : cmd->arg1;
+ nat_id = IP_FW_ARG_TABLEARG(cmd->arg1);
t = (*lookup_nat_ptr)(&chain->nat,
nat_id);
if (t == NULL) {
Modified: stable/9/sys/netpfil/ipfw/ip_fw_dynamic.c
==============================================================================
--- stable/9/sys/netpfil/ipfw/ip_fw_dynamic.c Sat May 18 04:49:00 2013
(r250759)
+++ stable/9/sys/netpfil/ipfw/ip_fw_dynamic.c Sat May 18 05:31:17 2013
(r250760)
@@ -696,8 +696,7 @@ ipfw_install_state(struct ip_fw *rule, i
uint16_t limit_mask = cmd->limit_mask;
int pindex;
- conn_limit = (cmd->conn_limit == IP_FW_TABLEARG) ?
- tablearg : cmd->conn_limit;
+ conn_limit = IP_FW_ARG_TABLEARG(cmd->conn_limit);
DEB(
if (cmd->conn_limit == IP_FW_TABLEARG)
Modified: stable/9/sys/netpfil/ipfw/ip_fw_log.c
==============================================================================
--- stable/9/sys/netpfil/ipfw/ip_fw_log.c Sat May 18 04:49:00 2013
(r250759)
+++ stable/9/sys/netpfil/ipfw/ip_fw_log.c Sat May 18 05:31:17 2013
(r250760)
@@ -255,19 +255,19 @@ ipfw_log(struct ip_fw *f, u_int hlen, st
break;
case O_SETFIB:
snprintf(SNPARGS(action2, 0), "SetFib %d",
- cmd->arg1);
+ IP_FW_ARG_TABLEARG(cmd->arg1));
break;
case O_SKIPTO:
snprintf(SNPARGS(action2, 0), "SkipTo %d",
- cmd->arg1);
+ IP_FW_ARG_TABLEARG(cmd->arg1));
break;
case O_PIPE:
snprintf(SNPARGS(action2, 0), "Pipe %d",
- cmd->arg1);
+ IP_FW_ARG_TABLEARG(cmd->arg1));
break;
case O_QUEUE:
snprintf(SNPARGS(action2, 0), "Queue %d",
- cmd->arg1);
+ IP_FW_ARG_TABLEARG(cmd->arg1));
break;
case O_FORWARD_IP: {
ipfw_insn_sa *sa = (ipfw_insn_sa *)cmd;
Modified: stable/9/sys/netpfil/ipfw/ip_fw_private.h
==============================================================================
--- stable/9/sys/netpfil/ipfw/ip_fw_private.h Sat May 18 04:49:00 2013
(r250759)
+++ stable/9/sys/netpfil/ipfw/ip_fw_private.h Sat May 18 05:31:17 2013
(r250760)
@@ -236,6 +236,8 @@ struct ip_fw_chain {
struct sockopt; /* used by tcp_var.h */
+
+#define IP_FW_ARG_TABLEARG(a) ((a) == IP_FW_TABLEARG) ? tablearg : (a)
/*
* The lock is heavily used by ip_fw2.c (the main file) and ip_fw_nat.c
* so the variable and the macros must be here.
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
