Date: Tue, 19 Apr 2011 15:00:21 GMT From: Gleb Smirnoff <glebius@FreeBSD.org> To: freebsd-ipfw@FreeBSD.org Subject: kern/143653 Message-ID: <201104191500.p3JF0LoB048755@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
The following reply was made to PR kern/143653; it has been noted by GNATS.
From: Gleb Smirnoff <glebius@FreeBSD.org>
To: bug-followup@FreeBSD.org
Cc: Jeff Kletsky <freebsd@wagsky.com>,
"Alexander V. Chernikov" <melifaro@ipfw.ru>
Subject: kern/143653
Date: Tue, 19 Apr 2011 18:59:07 +0400
--J/dobhs11T7y2rNN
Content-Type: text/plain; charset=koi8-r
Content-Disposition: inline
Here are patches that eliminate NAT_BUF_LEN and make
all memory sizes in these paths dynamic.
Testing is appreciated.
Patches are against head/, where a big whitespace cleanup
had been performed, so before applying to stable/8 you may need
to merge r220802,r220804::
http://svn.freebsd.org/viewvc/base/head/sbin/ipfw/nat.c?view=log
--
Totus tuus, Glebius.
--J/dobhs11T7y2rNN
Content-Type: text/x-diff; charset=koi8-r
Content-Disposition: attachment; filename="143653.nat.c.diff"
Index: nat.c
===================================================================
--- nat.c (revision 220834)
+++ nat.c (working copy)
@@ -281,13 +281,6 @@
/* End of stuff taken from natd.c. */
-#define INC_ARGCV() do { \
- (*_av)++; \
- (*_ac)--; \
- av = *_av; \
- ac = *_ac; \
-} while(0)
-
/*
* The next 3 functions add support for the addr, port and proto redirect and
* their logic is loosely based on SetupAddressRedirect(), SetupPortRedirect()
@@ -318,121 +311,107 @@
*/
static int
-setup_redir_addr(char *spool_buf, unsigned int len,
- int *_ac, char ***_av)
+estimate_redir_addr(int *ac, char ***av)
{
- char **av, *sep; /* Token separator. */
- /* Temporary buffer used to hold server pool ip's. */
- char tmp_spool_buf[NAT_BUF_LEN];
- int ac, space, lsnat;
+ size_t space = sizeof(struct cfg_redir);
+ char *sep;
+
+ if ((sep = strtok(**av, ",")) != NULL) {
+ space += sizeof(struct cfg_spool);
+ while ((sep = strtok(NULL, ",")) != NULL)
+ space += sizeof(struct cfg_spool);
+ }
+
+ return (space);
+}
+
+static int
+setup_redir_addr(char *buf, int *ac, char ***av)
+{
struct cfg_redir *r;
- struct cfg_spool *tmp;
+ char *sep;
+ size_t space;
- av = *_av;
- ac = *_ac;
- space = 0;
- lsnat = 0;
- if (len >= SOF_REDIR) {
- r = (struct cfg_redir *)spool_buf;
- /* Skip cfg_redir at beginning of buf. */
- spool_buf = &spool_buf[SOF_REDIR];
- space = SOF_REDIR;
- len -= SOF_REDIR;
- } else
- goto nospace;
+ r = (struct cfg_redir *)buf;
r->mode = REDIR_ADDR;
+ /* Skip cfg_redir at beginning of buf. */
+ buf = &buf[sizeof(struct cfg_redir)];
+ space = sizeof(struct cfg_redir);
+
/* Extract local address. */
- if (ac == 0)
- errx(EX_DATAERR, "redirect_addr: missing local address");
- sep = strchr(*av, ',');
- if (sep) { /* LSNAT redirection syntax. */
+ if ((sep = strtok(**av, ",")) != NULL) {
+ struct cfg_spool *spool;
+
+ /* Setup LSNAT server pool. */
r->laddr.s_addr = INADDR_NONE;
- /* Preserve av, copy spool servers to tmp_spool_buf. */
- strncpy(tmp_spool_buf, *av, strlen(*av)+1);
- lsnat = 1;
- } else
- StrToAddr(*av, &r->laddr);
- INC_ARGCV();
-
- /* Extract public address. */
- if (ac == 0)
- errx(EX_DATAERR, "redirect_addr: missing public address");
- StrToAddr(*av, &r->paddr);
- INC_ARGCV();
-
- /* Setup LSNAT server pool. */
- if (sep) {
- sep = strtok(tmp_spool_buf, ",");
while (sep != NULL) {
- tmp = (struct cfg_spool *)spool_buf;
- if (len < SOF_SPOOL)
- goto nospace;
- len -= SOF_SPOOL;
- space += SOF_SPOOL;
- StrToAddr(sep, &tmp->addr);
- tmp->port = ~0;
+ spool = (struct cfg_spool *)buf;
+ space += sizeof(struct cfg_spool);
+ StrToAddr(sep, &spool->addr);
+ spool->port = ~0;
r->spool_cnt++;
/* Point to the next possible cfg_spool. */
- spool_buf = &spool_buf[SOF_SPOOL];
+ buf = &buf[sizeof(struct cfg_spool)];
sep = strtok(NULL, ",");
}
+ } else
+ StrToAddr(**av, &r->laddr);
+ (*av)++; (*ac)--;
+
+ /* Extract public address. */
+ StrToAddr(**av, &r->paddr);
+ (*av)++; (*ac)--;
+
+ return (space);
+}
+
+static int
+estimate_redir_port(int *ac, char ***av)
+{
+ size_t space = sizeof(struct cfg_redir);
+ char *sep;
+
+ if ((sep = strtok(**av, ",")) != NULL) {
+ space += sizeof(struct cfg_spool);
+ while ((sep = strtok(NULL, ",")) != NULL)
+ space += sizeof(struct cfg_spool);
}
- return(space);
-nospace:
- errx(EX_DATAERR, "redirect_addr: buf is too small\n");
+
+ return (space);
}
static int
-setup_redir_port(char *spool_buf, unsigned int len,
- int *_ac, char ***_av)
+setup_redir_port(char *buf, int *ac, char ***av)
{
- char **av, *sep, *protoName;
- char tmp_spool_buf[NAT_BUF_LEN];
- int ac, space, lsnat;
struct cfg_redir *r;
- struct cfg_spool *tmp;
+ char *sep, *protoName, *lsnat = NULL;
+ size_t space;
u_short numLocalPorts;
port_range portRange;
- av = *_av;
- ac = *_ac;
- space = 0;
- lsnat = 0;
numLocalPorts = 0;
- if (len >= SOF_REDIR) {
- r = (struct cfg_redir *)spool_buf;
- /* Skip cfg_redir at beginning of buf. */
- spool_buf = &spool_buf[SOF_REDIR];
- space = SOF_REDIR;
- len -= SOF_REDIR;
- } else
- goto nospace;
+ r = (struct cfg_redir *)buf;
r->mode = REDIR_PORT;
+ /* Skip cfg_redir at beginning of buf. */
+ buf = &buf[sizeof(struct cfg_redir)];
+ space = sizeof(struct cfg_redir);
+
/*
* Extract protocol.
*/
- if (ac == 0)
- errx (EX_DATAERR, "redirect_port: missing protocol");
- r->proto = StrToProto(*av);
- protoName = *av;
- INC_ARGCV();
+ r->proto = StrToProto(**av);
+ protoName = **av;
+ (*av)++; (*ac)--;
/*
* Extract local address.
*/
- if (ac == 0)
- errx (EX_DATAERR, "redirect_port: missing local address");
-
- sep = strchr(*av, ',');
- /* LSNAT redirection syntax. */
- if (sep) {
+ if ((sep = strchr(**av, ',')) != NULL) {
r->laddr.s_addr = INADDR_NONE;
r->lport = ~0;
numLocalPorts = 1;
- /* Preserve av, copy spool servers to tmp_spool_buf. */
- strncpy(tmp_spool_buf, *av, strlen(*av)+1);
- lsnat = 1;
+ lsnat = **av;
} else {
/*
* The sctp nat does not allow the port numbers to be mapped to
@@ -440,40 +419,36 @@
* in the target port field.
*/
if (r->proto == IPPROTO_SCTP) {
- if (strchr (*av, ':'))
+ if (strchr(**av, ':'))
errx(EX_DATAERR, "redirect_port:"
- "port numbers do not change in sctp, so do not "
- "specify them as part of the target");
+ "port numbers do not change in sctp, so do "
+ "not specify them as part of the target");
else
- StrToAddr(*av, &r->laddr);
+ StrToAddr(**av, &r->laddr);
} else {
- if (StrToAddrAndPortRange (*av, &r->laddr, protoName,
- &portRange) != 0)
- errx(EX_DATAERR, "redirect_port:"
+ if (StrToAddrAndPortRange(**av, &r->laddr, protoName,
+ &portRange) != 0)
+ errx(EX_DATAERR, "redirect_port: "
"invalid local port range");
r->lport = GETLOPORT(portRange);
numLocalPorts = GETNUMPORTS(portRange);
}
}
- INC_ARGCV();
+ (*av)++; (*ac)--;
/*
* Extract public port and optionally address.
*/
- if (ac == 0)
- errx (EX_DATAERR, "redirect_port: missing public port");
-
- sep = strchr (*av, ':');
- if (sep) {
- if (StrToAddrAndPortRange (*av, &r->paddr, protoName,
+ if ((sep = strchr(**av, ':')) != NULL) {
+ if (StrToAddrAndPortRange(**av, &r->paddr, protoName,
&portRange) != 0)
- errx(EX_DATAERR, "redirect_port:"
+ errx(EX_DATAERR, "redirect_port: "
"invalid public port range");
} else {
r->paddr.s_addr = INADDR_ANY;
- if (StrToPortRange (*av, protoName, &portRange) != 0)
- errx(EX_DATAERR, "redirect_port:"
+ if (StrToPortRange(**av, protoName, &portRange) != 0)
+ errx(EX_DATAERR, "redirect_port: "
"invalid public port range");
}
@@ -483,7 +458,7 @@
r->lport = r->pport;
}
r->pport_cnt = GETNUMPORTS(portRange);
- INC_ARGCV();
+ (*av)++; (*ac)--;
/*
* Extract remote address and optionally port.
@@ -492,19 +467,18 @@
* NB: isalpha(**av) => we've to check that next parameter is really an
* option for this redirect entry, else stop here processing arg[cv].
*/
- if (ac != 0 && !isalpha(**av)) {
- sep = strchr (*av, ':');
- if (sep) {
- if (StrToAddrAndPortRange (*av, &r->raddr, protoName,
+ if (*ac != 0 && !isalpha(***av)) {
+ if ((sep = strchr(**av, ':')) != NULL) {
+ if (StrToAddrAndPortRange(**av, &r->raddr, protoName,
&portRange) != 0)
- errx(EX_DATAERR, "redirect_port:"
+ errx(EX_DATAERR, "redirect_port: "
"invalid remote port range");
} else {
SETLOPORT(portRange, 0);
SETNUMPORTS(portRange, 1);
- StrToAddr (*av, &r->raddr);
+ StrToAddr(**av, &r->raddr);
}
- INC_ARGCV();
+ (*av)++; (*ac)--;
} else {
SETLOPORT(portRange, 0);
SETNUMPORTS(portRange, 1);
@@ -517,7 +491,7 @@
* Make sure port ranges match up, then add the redirect ports.
*/
if (numLocalPorts != r->pport_cnt)
- errx(EX_DATAERR, "redirect_port:"
+ errx(EX_DATAERR, "redirect_port: "
"port ranges must be equal in size");
/* Remote port range is allowed to be '0' which means all ports. */
@@ -526,20 +500,18 @@
errx(EX_DATAERR, "redirect_port: remote port must"
"be 0 or equal to local port range in size");
- /*
- * Setup LSNAT server pool.
- */
- if (lsnat) {
- sep = strtok(tmp_spool_buf, ",");
+ /* Setup LSNAT server pool. */
+ if (lsnat != NULL) {
+ struct cfg_spool *spool;
+
+ sep = strtok(lsnat, ",");
while (sep != NULL) {
- tmp = (struct cfg_spool *)spool_buf;
- if (len < SOF_SPOOL)
- goto nospace;
- len -= SOF_SPOOL;
- space += SOF_SPOOL;
+ spool = (struct cfg_spool *)buf;
+ space += sizeof(struct cfg_spool);
/*
- * The sctp nat does not allow the port numbers to be mapped to new port numbers
- * Therefore, no ports are to be specified in the target port field
+ * The sctp nat does not allow the port numbers to
+ * be mapped to new port numbers. Therefore, no ports
+ * are to be specified in the target port field.
*/
if (r->proto == IPPROTO_SCTP) {
if (strchr (sep, ':')) {
@@ -548,11 +520,11 @@
"sctp, so do not specify them as "
"part of the target");
} else {
- StrToAddr(sep, &tmp->addr);
- tmp->port = r->pport;
+ StrToAddr(sep, &spool->addr);
+ spool->port = r->pport;
}
} else {
- if (StrToAddrAndPortRange(sep, &tmp->addr,
+ if (StrToAddrAndPortRange(sep, &spool->addr,
protoName, &portRange) != 0)
errx(EX_DATAERR, "redirect_port:"
"invalid local port range");
@@ -560,88 +532,73 @@
errx(EX_DATAERR, "redirect_port: "
"local port must be single in "
"this context");
- tmp->port = GETLOPORT(portRange);
+ spool->port = GETLOPORT(portRange);
}
r->spool_cnt++;
/* Point to the next possible cfg_spool. */
- spool_buf = &spool_buf[SOF_SPOOL];
+ buf = &buf[sizeof(struct cfg_spool)];
sep = strtok(NULL, ",");
}
}
+
return (space);
-nospace:
- errx(EX_DATAERR, "redirect_port: buf is too small\n");
}
static int
-setup_redir_proto(char *spool_buf, unsigned int len,
- int *_ac, char ***_av)
+setup_redir_proto(char *buf, int *ac, char ***av)
{
- char **av;
- int ac, space;
+ struct cfg_redir *r;
struct protoent *protoent;
- struct cfg_redir *r;
+ size_t space;
- av = *_av;
- ac = *_ac;
- if (len >= SOF_REDIR) {
- r = (struct cfg_redir *)spool_buf;
- /* Skip cfg_redir at beginning of buf. */
- spool_buf = &spool_buf[SOF_REDIR];
- space = SOF_REDIR;
- len -= SOF_REDIR;
- } else
- goto nospace;
+ r = (struct cfg_redir *)buf;
r->mode = REDIR_PROTO;
+ /* Skip cfg_redir at beginning of buf. */
+ buf = &buf[sizeof(struct cfg_redir)];
+ space = sizeof(struct cfg_redir);
+
/*
* Extract protocol.
*/
- if (ac == 0)
- errx(EX_DATAERR, "redirect_proto: missing protocol");
-
- protoent = getprotobyname(*av);
+ protoent = getprotobyname(**av);
if (protoent == NULL)
- errx(EX_DATAERR, "redirect_proto: unknown protocol %s", *av);
+ errx(EX_DATAERR, "redirect_proto: unknown protocol %s", **av);
else
r->proto = protoent->p_proto;
- INC_ARGCV();
+ (*av)++; (*ac)--;
/*
* Extract local address.
*/
- if (ac == 0)
- errx(EX_DATAERR, "redirect_proto: missing local address");
- else
- StrToAddr(*av, &r->laddr);
+ StrToAddr(**av, &r->laddr);
- INC_ARGCV();
+ (*av)++; (*ac)--;
/*
* Extract optional public address.
*/
- if (ac == 0) {
+ if (*ac == 0) {
r->paddr.s_addr = INADDR_ANY;
r->raddr.s_addr = INADDR_ANY;
} else {
/* see above in setup_redir_port() */
- if (!isalpha(**av)) {
- StrToAddr(*av, &r->paddr);
- INC_ARGCV();
+ if (!isalpha(***av)) {
+ StrToAddr(**av, &r->paddr);
+ (*av)++; (*ac)--;
/*
* Extract optional remote address.
*/
/* see above in setup_redir_port() */
- if (ac!=0 && !isalpha(**av)) {
- StrToAddr(*av, &r->raddr);
- INC_ARGCV();
+ if (*ac != 0 && !isalpha(***av)) {
+ StrToAddr(**av, &r->raddr);
+ (*av)++; (*ac)--;
}
}
}
+
return (space);
-nospace:
- errx(EX_DATAERR, "redirect_proto: buf is too small\n");
}
static void
@@ -763,27 +720,76 @@
ipfw_config_nat(int ac, char **av)
{
struct cfg_nat *n; /* Nat instance configuration. */
- int i, len, off, tok;
- char *id, buf[NAT_BUF_LEN]; /* Buffer for serialized data. */
+ int i, off, tok, ac1;
+ char *id, *buf, **av1;
+ size_t len;
- len = NAT_BUF_LEN;
- /* Offset in buf: save space for n at the beginning. */
- off = sizeof(*n);
- memset(buf, 0, sizeof(buf));
- n = (struct cfg_nat *)buf;
-
av++; ac--;
/* Nat id. */
if (ac && isdigit(**av)) {
id = *av;
- i = atoi(*av);
ac--; av++;
- n->id = i;
} else
errx(EX_DATAERR, "missing nat id");
if (ac == 0)
errx(EX_DATAERR, "missing option");
+ len = sizeof(struct cfg_nat);
+ ac1 = ac;
+ av1 = av;
+ while (ac1 > 0) {
+ tok = match_token(nat_params, *av1);
+ ac1--; av1++;
+ switch (tok) {
+ case TOK_IP:
+ case TOK_IF:
+ ac1--; av1++;
+ break;
+ case TOK_ALOG:
+ case TOK_DENY_INC:
+ case TOK_SAME_PORTS:
+ case TOK_UNREG_ONLY:
+ case TOK_RESET_ADDR:
+ case TOK_ALIAS_REV:
+ case TOK_PROXY_ONLY:
+ break;
+ case TOK_REDIR_ADDR:
+ if (ac1 < 2)
+ errx(EX_DATAERR, "redirect_addr: "
+ "not enough arguments");
+ len += estimate_redir_addr(&ac1, &av1);
+ av1 += 2; ac1 -= 2;
+ break;
+ case TOK_REDIR_PORT:
+ if (ac1 < 3)
+ errx(EX_DATAERR, "redirect_port: "
+ "not enough arguments");
+ av1++; ac1--;
+ len += estimate_redir_port(&ac1, &av1);
+ av1 += 2; ac1 -= 2;
+ break;
+ case TOK_REDIR_PROTO:
+ if (ac1 < 2)
+ errx(EX_DATAERR, "redirect_proto: "
+ "not enough arguments");
+ len += sizeof(struct cfg_redir);
+ av1 += 2; ac1 -= 2;
+ break;
+ default:
+ errx(EX_DATAERR, "unrecognised option ``%s''", av1[-1]);
+ }
+ }
+
+ if ((buf = malloc(len)) == NULL)
+ errx(EX_OSERR, "malloc failed");
+
+ /* Offset in buf: save space for n at the beginning. */
+ off = sizeof(*n);
+ memset(buf, 0, len);
+ n = (struct cfg_nat *)buf;
+ i = atoi(id);
+ n->id = i;
+
while (ac > 0) {
tok = match_token(nat_params, *av);
ac--; av++;
@@ -832,21 +838,18 @@
case TOK_REDIR_PROTO:
switch (tok) {
case TOK_REDIR_ADDR:
- i = setup_redir_addr(&buf[off], len, &ac, &av);
+ i = setup_redir_addr(&buf[off], &ac, &av);
break;
case TOK_REDIR_PORT:
- i = setup_redir_port(&buf[off], len, &ac, &av);
+ i = setup_redir_port(&buf[off], &ac, &av);
break;
case TOK_REDIR_PROTO:
- i = setup_redir_proto(&buf[off], len, &ac, &av);
+ i = setup_redir_proto(&buf[off], &ac, &av);
break;
}
n->redir_cnt++;
off += i;
- len -= i;
break;
- default:
- errx(EX_DATAERR, "unrecognised option ``%s''", av[-1]);
}
}
--J/dobhs11T7y2rNN
Content-Type: text/x-diff; charset=koi8-r
Content-Disposition: attachment; filename="143653.netinet.diff"
Index: ip_fw.h
===================================================================
--- ip_fw.h (revision 220826)
+++ ip_fw.h (working copy)
@@ -383,8 +383,6 @@
};
#endif
-#define NAT_BUF_LEN 1024
-
#ifdef IPFW_INTERNAL
/* Nat configuration data struct. */
struct cfg_nat {
Index: ipfw/ip_fw_private.h
===================================================================
--- ipfw/ip_fw_private.h (revision 220826)
+++ ipfw/ip_fw_private.h (working copy)
@@ -225,6 +225,7 @@
struct rwlock uh_lock; /* lock for upper half */
#endif
uint32_t id; /* ruleset id */
+ uint32_t gencnt; /* generation count */
};
struct sockopt; /* used by tcp_var.h */
Index: ipfw/ip_fw_nat.c
===================================================================
--- ipfw/ip_fw_nat.c (revision 220826)
+++ ipfw/ip_fw_nat.c (working copy)
@@ -138,7 +138,7 @@
}
}
-static int
+static void
add_redir_spool_cfg(char *buf, struct cfg_nat *ptr)
{
struct cfg_redir *r, *ser_r;
@@ -199,7 +199,6 @@
/* And finally hook this redir entry. */
LIST_INSERT_HEAD(&ptr->redir_chain, r, _next);
}
- return (1);
}
static int
@@ -344,20 +343,28 @@
static int
ipfw_nat_cfg(struct sockopt *sopt)
{
- struct cfg_nat *ptr, *ser_n;
+ struct cfg_nat *cfg, *ptr;
char *buf;
struct ip_fw_chain *chain = &V_layer3_chain;
+ int gencnt, len, error = 0;
- buf = malloc(NAT_BUF_LEN, M_IPFW, M_WAITOK | M_ZERO);
- sooptcopyin(sopt, buf, NAT_BUF_LEN, sizeof(struct cfg_nat));
- ser_n = (struct cfg_nat *)buf;
+ len = sopt->sopt_valsize;
+ buf = malloc(len, M_TEMP, M_WAITOK | M_ZERO);
+ if ((error = sooptcopyin(sopt, buf, len, sizeof(struct cfg_nat))) != 0)
+ goto out;
- /* check valid parameter ser_n->id > 0 ? */
+ cfg = (struct cfg_nat *)buf;
+ if (cfg->id < 0) {
+ error = EINVAL;
+ goto out;
+ }
+
/*
* Find/create nat rule.
*/
IPFW_WLOCK(chain);
- ptr = lookup_nat(&chain->nat, ser_n->id);
+ gencnt = chain->gencnt;
+ ptr = lookup_nat(&chain->nat, cfg->id);
if (ptr == NULL) {
IPFW_WUNLOCK(chain);
/* New rule: allocate and init new instance. */
@@ -365,27 +372,27 @@
ptr->lib = LibAliasInit(NULL);
LIST_INIT(&ptr->redir_chain);
} else {
- /* Entry already present: temporarly unhook it. */
+ /* Entry already present: temporarily unhook it. */
LIST_REMOVE(ptr, _next);
- flush_nat_ptrs(chain, ser_n->id);
+ flush_nat_ptrs(chain, cfg->id);
IPFW_WUNLOCK(chain);
}
/*
* Basic nat configuration.
*/
- ptr->id = ser_n->id;
+ ptr->id = cfg->id;
/*
* XXX - what if this rule doesn't nat any ip and just
* redirect?
* do we set aliasaddress to 0.0.0.0?
*/
- ptr->ip = ser_n->ip;
- ptr->redir_cnt = ser_n->redir_cnt;
- ptr->mode = ser_n->mode;
- LibAliasSetMode(ptr->lib, ser_n->mode, ser_n->mode);
+ ptr->ip = cfg->ip;
+ ptr->redir_cnt = cfg->redir_cnt;
+ ptr->mode = cfg->mode;
+ LibAliasSetMode(ptr->lib, cfg->mode, cfg->mode);
LibAliasSetAddress(ptr->lib, ptr->ip);
- memcpy(ptr->if_name, ser_n->if_name, IF_NAMESIZE);
+ memcpy(ptr->if_name, cfg->if_name, IF_NAMESIZE);
/*
* Redir and LSNAT configuration.
@@ -394,15 +401,19 @@
del_redir_spool_cfg(ptr, &ptr->redir_chain);
/* Add new entries. */
add_redir_spool_cfg(&buf[(sizeof(struct cfg_nat))], ptr);
- free(buf, M_IPFW);
+
IPFW_WLOCK(chain);
- /*
- * XXXGL race here: another ipfw_nat_cfg() may already inserted
- * entry with the same ser_n->id.
- */
+ /* Extra check to avoid race with another ipfw_nat_cfg() */
+ if (gencnt != chain->gencnt &&
+ ((cfg = lookup_nat(&chain->nat, ptr->id)) != NULL))
+ LIST_REMOVE(cfg, _next);
LIST_INSERT_HEAD(&chain->nat, ptr, _next);
+ chain->gencnt++;
IPFW_WUNLOCK(chain);
- return (0);
+
+out:
+ free(buf, M_TEMP);
+ return (error);
}
static int
@@ -432,52 +443,61 @@
static int
ipfw_nat_get_cfg(struct sockopt *sopt)
{
- uint8_t *data;
+ struct ip_fw_chain *chain = &V_layer3_chain;
struct cfg_nat *n;
struct cfg_redir *r;
struct cfg_spool *s;
- int nat_cnt, off;
- struct ip_fw_chain *chain;
- int err = ENOSPC;
+ char *data;
+ int gencnt, nat_cnt, len, error;
- chain = &V_layer3_chain;
nat_cnt = 0;
- off = sizeof(nat_cnt);
+ len = sizeof(nat_cnt);
- data = malloc(NAT_BUF_LEN, M_IPFW, M_WAITOK | M_ZERO);
IPFW_RLOCK(chain);
- /* Serialize all the data. */
+retry:
+ gencnt = chain->gencnt;
+ /* Estimate memory amount */
LIST_FOREACH(n, &chain->nat, _next) {
nat_cnt++;
- if (off + SOF_NAT >= NAT_BUF_LEN)
- goto nospace;
- bcopy(n, &data[off], SOF_NAT);
- off += SOF_NAT;
+ len += sizeof(struct cfg_nat);
LIST_FOREACH(r, &n->redir_chain, _next) {
- if (off + SOF_REDIR >= NAT_BUF_LEN)
- goto nospace;
- bcopy(r, &data[off], SOF_REDIR);
- off += SOF_REDIR;
+ len += sizeof(struct cfg_redir);
+ LIST_FOREACH(s, &r->spool_chain, _next)
+ len += sizeof(struct cfg_spool);
+ }
+ }
+ IPFW_RUNLOCK(chain);
+
+ data = malloc(len, M_TEMP, M_WAITOK | M_ZERO);
+ bcopy(&nat_cnt, data, sizeof(nat_cnt));
+
+ nat_cnt = 0;
+ len = sizeof(nat_cnt);
+
+ IPFW_RLOCK(chain);
+ if (gencnt != chain->gencnt) {
+ free(data, M_TEMP);
+ goto retry;
+ }
+ /* Serialize all the data. */
+ LIST_FOREACH(n, &chain->nat, _next) {
+ bcopy(n, &data[len], sizeof(struct cfg_nat));
+ len += sizeof(struct cfg_nat);
+ LIST_FOREACH(r, &n->redir_chain, _next) {
+ bcopy(r, &data[len], sizeof(struct cfg_redir));
+ len += sizeof(struct cfg_redir);
LIST_FOREACH(s, &r->spool_chain, _next) {
- if (off + SOF_SPOOL >= NAT_BUF_LEN)
- goto nospace;
- bcopy(s, &data[off], SOF_SPOOL);
- off += SOF_SPOOL;
+ bcopy(s, &data[len], sizeof(struct cfg_spool));
+ len += sizeof(struct cfg_spool);
}
}
}
- err = 0; /* all good */
-nospace:
IPFW_RUNLOCK(chain);
- if (err == 0) {
- bcopy(&nat_cnt, data, sizeof(nat_cnt));
- sooptcopyout(sopt, data, NAT_BUF_LEN);
- } else {
- printf("serialized data buffer not big enough:"
- "please increase NAT_BUF_LEN\n");
- }
- free(data, M_IPFW);
- return (err);
+
+ error = sooptcopyout(sopt, data, len);
+ free(data, M_TEMP);
+
+ return (error);
}
static int
--J/dobhs11T7y2rNN--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201104191500.p3JF0LoB048755>