xnu-792.6.70.tar.gz

[apple/xnu.git] / bsd / netinet / ip_fw2.c

diff --git a/bsd/netinet/ip_fw2.c b/bsd/netinet/ip_fw2.c
index b3a716cec2726f6b15ac72c9376f5074d85f64fe..d2971587a53bd57e8910b60c266554730ffce8bb 100644 (file)
--- a/bsd/netinet/ip_fw2.c
+++ b/bsd/netinet/ip_fw2.c
@@ -3111,20 +3111,21 @@ ipfw_ctl(struct sockopt *sopt)
                /*
                 * IP_FW_DEL is used for deleting single rules or sets,
                 * and (ab)used to atomically manipulate sets. 
-                * rule->set_masks is used to distinguish between the two:
-                *    rule->set_masks[0] == 0
-                *      delete single rule or set of rules,
-                *      or reassign rules (or sets) to a different set.
-                *    rule->set_masks[0] != 0
-                *      atomic disable/enable sets.
-                *      rule->set_masks[0] contains sets to be disabled,
-                *      rule->set_masks[1] contains sets to be enabled.
+                * rule->rulenum != 0 indicates single rule delete
+                * rule->set_masks used to manipulate sets
+                * rule->set_masks[0] contains info on sets to be 
+                *      disabled, swapped, or moved
+                * rule->set_masks[1] contains sets to be enabled.
                 */
+                
                /* there is only a simple rule passed in
                 * (no cmds), so use a temp struct to copy
                 */
-               struct ip_fw    temp_rule = { 0 };
+               struct ip_fw    temp_rule;
+               u_int32_t       arg;
+               u_int8_t        cmd;
                
+               bzero(&temp_rule, sizeof(struct ip_fw));
                if (api_version != IP_FW_CURRENT_API_VERSION) {
                        error = ipfw_convert_to_latest(sopt, &temp_rule, api_version);
                }
@@ -3139,21 +3140,31 @@ ipfw_ctl(struct sockopt *sopt)
                         */
                        lck_mtx_lock(ipfw_mutex);
                        
-                       if (temp_rule.set_masks[0] != 0) {
-                               /* set manipulation */
-                               set_disable =
-                                       (set_disable | temp_rule.set_masks[0]) & ~temp_rule.set_masks[1] &
-                                       ~(1<<RESVD_SET); /* set RESVD_SET always enabled */
-                       }
-                       else {
+                       arg = temp_rule.set_masks[0];
+                       cmd = (arg >> 24) & 0xff;
+                       
+                       if (temp_rule.rulenum) {
                                /* single rule */
                                error = del_entry(&layer3_chain, temp_rule.rulenum);
 #if DEBUG_INACTIVE_RULES
                                print_chain(&layer3_chain);
 #endif
-
                        }
-                       
+                       else if (cmd) {
+                               /* set reassignment - see comment above del_entry() for details */
+                               error = del_entry(&layer3_chain, temp_rule.set_masks[0]);
+#if DEBUG_INACTIVE_RULES
+                               print_chain(&layer3_chain);
+#endif
+                       }
+                       else if (temp_rule.set_masks[0] != 0 ||
+                               temp_rule.set_masks[1] != 0) {
+                               /* set enable/disable */
+                               set_disable =
+                                       (set_disable | temp_rule.set_masks[0]) & ~temp_rule.set_masks[1] &
+                                       ~(1<<RESVD_SET); /* set RESVD_SET always enabled */
+                       }
+                                               
                        lck_mtx_unlock(ipfw_mutex);
                }
                break;