Date: Sat, 18 May 2013 05:31:17 +0000 (UTC) From: "Alexander V. Chernikov" <melifaro@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-9@freebsd.org Subject: svn commit: r250760 - stable/9/sys/netpfil/ipfw Message-ID: <201305180531.r4I5VHZL000266@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: melifaro Date: Sat May 18 05:31:17 2013 New Revision: 250760 URL: http://svnweb.freebsd.org/changeset/base/250760 Log: Merge r244633, r250246. Use unified IP_FW_ARG_TABLEARG() macro for most tablearg checks. Log real value instead of IP_FW_TABLEARG (65535) in ipfw_log(). Use unified method for accessing / updating cached rule pointers. Modified: stable/9/sys/netpfil/ipfw/ip_fw2.c stable/9/sys/netpfil/ipfw/ip_fw_dynamic.c stable/9/sys/netpfil/ipfw/ip_fw_log.c stable/9/sys/netpfil/ipfw/ip_fw_private.h Directory Properties: stable/9/sys/ (props changed) Modified: stable/9/sys/netpfil/ipfw/ip_fw2.c ============================================================================== --- stable/9/sys/netpfil/ipfw/ip_fw2.c Sat May 18 04:49:00 2013 (r250759) +++ stable/9/sys/netpfil/ipfw/ip_fw2.c Sat May 18 05:31:17 2013 (r250760) @@ -782,6 +782,38 @@ set_match(struct ip_fw_args *args, int s } /* + * Helper function to enable cached rule lookups using + * x_next and next_rule fields in ipfw rule. + */ +static int +jump_fast(struct ip_fw_chain *chain, struct ip_fw *f, int num, + int tablearg, int jump_backwards) +{ + int f_pos; + + /* If possible use cached f_pos (in f->next_rule), + * whose version is written in f->next_rule + * (horrible hacks to avoid changing the ABI). + */ + if (num != IP_FW_TABLEARG && (uintptr_t)f->x_next == chain->id) + f_pos = (uintptr_t)f->next_rule; + else { + int i = IP_FW_ARG_TABLEARG(num); + /* make sure we do not jump backward */ + if (jump_backwards == 0 && i <= f->rulenum) + i = f->rulenum + 1; + f_pos = ipfw_find_rule(chain, i, 0); + /* update the cache */ + if (num != IP_FW_TABLEARG) { + f->next_rule = (void *)(uintptr_t)f_pos; + f->x_next = (void *)(uintptr_t)chain->id; + } + } + + return (f_pos); +} + +/* * The main check routine for the firewall. * * All arguments are in args so we can modify them and return them @@ -1842,8 +1874,7 @@ do { \ case O_TAG: { struct m_tag *mtag; - uint32_t tag = (cmd->arg1 == IP_FW_TABLEARG) ? - tablearg : cmd->arg1; + uint32_t tag = IP_FW_ARG_TABLEARG(cmd->arg1); /* Packet is already tagged with this tag? */ mtag = m_tag_locate(m, MTAG_IPFW, tag, NULL); @@ -1922,8 +1953,7 @@ do { \ case O_TAGGED: { struct m_tag *mtag; - uint32_t tag = (cmd->arg1 == IP_FW_TABLEARG) ? - tablearg : cmd->arg1; + uint32_t tag = IP_FW_ARG_TABLEARG(cmd->arg1); if (cmdlen == 1) { match = m_tag_locate(m, MTAG_IPFW, @@ -2062,8 +2092,7 @@ do { \ case O_PIPE: case O_QUEUE: set_match(args, f_pos, chain); - args->rule.info = (cmd->arg1 == IP_FW_TABLEARG) ? - tablearg : cmd->arg1; + args->rule.info = IP_FW_ARG_TABLEARG(cmd->arg1); if (cmd->opcode == O_PIPE) args->rule.info |= IPFW_IS_PIPE; if (V_fw_one_pass) @@ -2083,8 +2112,7 @@ do { \ retval = (cmd->opcode == O_DIVERT) ? IP_FW_DIVERT : IP_FW_TEE; set_match(args, f_pos, chain); - args->rule.info = (cmd->arg1 == IP_FW_TABLEARG) ? - tablearg : cmd->arg1; + args->rule.info = IP_FW_ARG_TABLEARG(cmd->arg1); break; case O_COUNT: @@ -2098,28 +2126,7 @@ do { \ f->pcnt++; /* update stats */ f->bcnt += pktlen; f->timestamp = time_uptime; - /* If possible use cached f_pos (in f->next_rule), - * whose version is written in f->next_rule - * (horrible hacks to avoid changing the ABI). - */ - if (cmd->arg1 != IP_FW_TABLEARG && - (uintptr_t)f->x_next == chain->id) { - f_pos = (uintptr_t)f->next_rule; - } else { - int i = (cmd->arg1 == IP_FW_TABLEARG) ? - tablearg : cmd->arg1; - /* make sure we do not jump backward */ - if (i <= f->rulenum) - i = f->rulenum + 1; - f_pos = ipfw_find_rule(chain, i, 0); - /* update the cache */ - if (cmd->arg1 != IP_FW_TABLEARG) { - f->next_rule = - (void *)(uintptr_t)f_pos; - f->x_next = - (void *)(uintptr_t)chain->id; - } - } + f_pos = jump_fast(chain, f, cmd->arg1, tablearg, 0); /* * Skip disabled rules, and re-enter * the inner loop with the correct @@ -2210,26 +2217,8 @@ do { \ if (IS_CALL) { stack[mtag->m_tag_id] = f->rulenum; mtag->m_tag_id++; - if (cmd->arg1 != IP_FW_TABLEARG && - (uintptr_t)f->x_next == chain->id) { - f_pos = (uintptr_t)f->next_rule; - } else { - jmpto = (cmd->arg1 == - IP_FW_TABLEARG) ? tablearg: - cmd->arg1; - f_pos = ipfw_find_rule(chain, - jmpto, 0); - /* update the cache */ - if (cmd->arg1 != - IP_FW_TABLEARG) { - f->next_rule = - (void *)(uintptr_t) - f_pos; - f->x_next = - (void *)(uintptr_t) - chain->id; - } - } + f_pos = jump_fast(chain, f, cmd->arg1, + tablearg, 1); } else { /* `return' action */ mtag->m_tag_id--; jmpto = stack[mtag->m_tag_id] + 1; @@ -2336,8 +2325,7 @@ do { \ case O_NETGRAPH: case O_NGTEE: set_match(args, f_pos, chain); - args->rule.info = (cmd->arg1 == IP_FW_TABLEARG) ? - tablearg : cmd->arg1; + args->rule.info = IP_FW_ARG_TABLEARG(cmd->arg1); if (V_fw_one_pass) args->rule.info |= IPFW_ONEPASS; retval = (cmd->opcode == O_NETGRAPH) ? @@ -2352,8 +2340,7 @@ do { \ f->pcnt++; /* update stats */ f->bcnt += pktlen; f->timestamp = time_uptime; - fib = (cmd->arg1 == IP_FW_TABLEARG) ? tablearg: - cmd->arg1; + fib = IP_FW_ARG_TABLEARG(cmd->arg1); if (fib >= rt_numfibs) fib = 0; M_SETFIB(m, fib); @@ -2379,8 +2366,7 @@ do { \ } t = ((ipfw_insn_nat *)cmd)->nat; if (t == NULL) { - nat_id = (cmd->arg1 == IP_FW_TABLEARG) ? - tablearg : cmd->arg1; + nat_id = IP_FW_ARG_TABLEARG(cmd->arg1); t = (*lookup_nat_ptr)(&chain->nat, nat_id); if (t == NULL) { Modified: stable/9/sys/netpfil/ipfw/ip_fw_dynamic.c ============================================================================== --- stable/9/sys/netpfil/ipfw/ip_fw_dynamic.c Sat May 18 04:49:00 2013 (r250759) +++ stable/9/sys/netpfil/ipfw/ip_fw_dynamic.c Sat May 18 05:31:17 2013 (r250760) @@ -696,8 +696,7 @@ ipfw_install_state(struct ip_fw *rule, i uint16_t limit_mask = cmd->limit_mask; int pindex; - conn_limit = (cmd->conn_limit == IP_FW_TABLEARG) ? - tablearg : cmd->conn_limit; + conn_limit = IP_FW_ARG_TABLEARG(cmd->conn_limit); DEB( if (cmd->conn_limit == IP_FW_TABLEARG) Modified: stable/9/sys/netpfil/ipfw/ip_fw_log.c ============================================================================== --- stable/9/sys/netpfil/ipfw/ip_fw_log.c Sat May 18 04:49:00 2013 (r250759) +++ stable/9/sys/netpfil/ipfw/ip_fw_log.c Sat May 18 05:31:17 2013 (r250760) @@ -255,19 +255,19 @@ ipfw_log(struct ip_fw *f, u_int hlen, st break; case O_SETFIB: snprintf(SNPARGS(action2, 0), "SetFib %d", - cmd->arg1); + IP_FW_ARG_TABLEARG(cmd->arg1)); break; case O_SKIPTO: snprintf(SNPARGS(action2, 0), "SkipTo %d", - cmd->arg1); + IP_FW_ARG_TABLEARG(cmd->arg1)); break; case O_PIPE: snprintf(SNPARGS(action2, 0), "Pipe %d", - cmd->arg1); + IP_FW_ARG_TABLEARG(cmd->arg1)); break; case O_QUEUE: snprintf(SNPARGS(action2, 0), "Queue %d", - cmd->arg1); + IP_FW_ARG_TABLEARG(cmd->arg1)); break; case O_FORWARD_IP: { ipfw_insn_sa *sa = (ipfw_insn_sa *)cmd; Modified: stable/9/sys/netpfil/ipfw/ip_fw_private.h ============================================================================== --- stable/9/sys/netpfil/ipfw/ip_fw_private.h Sat May 18 04:49:00 2013 (r250759) +++ stable/9/sys/netpfil/ipfw/ip_fw_private.h Sat May 18 05:31:17 2013 (r250760) @@ -236,6 +236,8 @@ struct ip_fw_chain { struct sockopt; /* used by tcp_var.h */ + +#define IP_FW_ARG_TABLEARG(a) ((a) == IP_FW_TABLEARG) ? tablearg : (a) /* * The lock is heavily used by ip_fw2.c (the main file) and ip_fw_nat.c * so the variable and the macros must be here.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201305180531.r4I5VHZL000266>