1 /* $OpenBSD: pf_table.c,v 1.68 2006/05/02 10:08:45 dhartmei Exp $ */
4 * Copyright (c) 2002 Cedric Berger
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
11 * - Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * - Redistributions in binary form must reproduce the above
14 * copyright notice, this list of conditions and the following
15 * disclaimer in the documentation and/or other materials provided
16 * with the distribution.
18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
21 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
22 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
24 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
25 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
26 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
28 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 * POSSIBILITY OF SUCH DAMAGE.
35 #include "opt_inet6.h"
37 #include <sys/cdefs.h>
38 __FBSDID("$FreeBSD$");
41 #include <sys/param.h>
42 #include <sys/systm.h>
43 #include <sys/socket.h>
45 #include <sys/kernel.h>
47 #include <sys/malloc.h>
51 #include <net/route.h>
52 #include <netinet/in.h>
54 #include <netinet/ip_ipsp.h>
57 #include <net/pfvar.h>
59 #define ACCEPT_FLAGS(oklist) \
61 if ((flags & ~(oklist)) & \
68 _copyin(const void *uaddr, void *kaddr, size_t len)
73 r = copyin(uaddr, kaddr, len);
80 _copyout(const void *uaddr, void *kaddr, size_t len)
85 r = copyout(uaddr, kaddr, len);
91 #define COPYIN(from, to, size) \
92 ((flags & PFR_FLAG_USERIOCTL) ? \
93 _copyin((from), (to), (size)) : \
94 (bcopy((from), (to), (size)), 0))
96 #define COPYOUT(from, to, size) \
97 ((flags & PFR_FLAG_USERIOCTL) ? \
98 _copyout((from), (to), (size)) : \
99 (bcopy((from), (to), (size)), 0))
103 #define COPYIN(from, to, size) \
104 ((flags & PFR_FLAG_USERIOCTL) ? \
105 copyin((from), (to), (size)) : \
106 (bcopy((from), (to), (size)), 0))
108 #define COPYOUT(from, to, size) \
109 ((flags & PFR_FLAG_USERIOCTL) ? \
110 copyout((from), (to), (size)) : \
111 (bcopy((from), (to), (size)), 0))
115 #define FILLIN_SIN(sin, addr) \
117 (sin).sin_len = sizeof(sin); \
118 (sin).sin_family = AF_INET; \
119 (sin).sin_addr = (addr); \
122 #define FILLIN_SIN6(sin6, addr) \
124 (sin6).sin6_len = sizeof(sin6); \
125 (sin6).sin6_family = AF_INET6; \
126 (sin6).sin6_addr = (addr); \
129 #define SWAP(type, a1, a2) \
136 #define SUNION2PF(su, af) (((af)==AF_INET) ? \
137 (struct pf_addr *)&(su)->sin.sin_addr : \
138 (struct pf_addr *)&(su)->sin6.sin6_addr)
140 #define AF_BITS(af) (((af)==AF_INET)?32:128)
141 #define ADDR_NETWORK(ad) ((ad)->pfra_net < AF_BITS((ad)->pfra_af))
142 #define KENTRY_NETWORK(ke) ((ke)->pfrke_net < AF_BITS((ke)->pfrke_af))
143 #define KENTRY_RNF_ROOT(ke) \
144 ((((struct radix_node *)(ke))->rn_flags & RNF_ROOT) != 0)
146 #define NO_ADDRESSES (-1)
147 #define ENQUEUE_UNMARKED_ONLY (1)
148 #define INVERT_NEG_FLAG (1)
150 struct pfr_walktree {
161 struct pfr_addr *pfrw1_addr;
162 struct pfr_astats *pfrw1_astats;
163 struct pfr_kentryworkq *pfrw1_workq;
164 struct pfr_kentry *pfrw1_kentry;
165 struct pfi_dynaddr *pfrw1_dyn;
170 #define pfrw_addr pfrw_1.pfrw1_addr
171 #define pfrw_astats pfrw_1.pfrw1_astats
172 #define pfrw_workq pfrw_1.pfrw1_workq
173 #define pfrw_kentry pfrw_1.pfrw1_kentry
174 #define pfrw_dyn pfrw_1.pfrw1_dyn
175 #define pfrw_cnt pfrw_free
177 #define senderr(e) do { rv = (e); goto _bad; } while (0)
180 uma_zone_t pfr_ktable_pl;
181 uma_zone_t pfr_kentry_pl;
182 uma_zone_t pfr_kentry_pl2;
184 struct pool pfr_ktable_pl;
185 struct pool pfr_kentry_pl;
186 struct pool pfr_kentry_pl2;
188 struct sockaddr_in pfr_sin;
189 struct sockaddr_in6 pfr_sin6;
190 union sockaddr_union pfr_mask;
191 struct pf_addr pfr_ffaddr;
193 void pfr_copyout_addr(struct pfr_addr *,
194 struct pfr_kentry *ke);
195 int pfr_validate_addr(struct pfr_addr *);
196 void pfr_enqueue_addrs(struct pfr_ktable *,
197 struct pfr_kentryworkq *, int *, int);
198 void pfr_mark_addrs(struct pfr_ktable *);
199 struct pfr_kentry *pfr_lookup_addr(struct pfr_ktable *,
200 struct pfr_addr *, int);
201 struct pfr_kentry *pfr_create_kentry(struct pfr_addr *, int);
202 void pfr_destroy_kentries(struct pfr_kentryworkq *);
203 void pfr_destroy_kentry(struct pfr_kentry *);
204 void pfr_insert_kentries(struct pfr_ktable *,
205 struct pfr_kentryworkq *, long);
206 void pfr_remove_kentries(struct pfr_ktable *,
207 struct pfr_kentryworkq *);
208 void pfr_clstats_kentries(struct pfr_kentryworkq *, long,
210 void pfr_reset_feedback(struct pfr_addr *, int, int);
211 void pfr_prepare_network(union sockaddr_union *, int, int);
212 int pfr_route_kentry(struct pfr_ktable *,
213 struct pfr_kentry *);
214 int pfr_unroute_kentry(struct pfr_ktable *,
215 struct pfr_kentry *);
216 int pfr_walktree(struct radix_node *, void *);
217 int pfr_validate_table(struct pfr_table *, int, int);
218 int pfr_fix_anchor(char *);
219 void pfr_commit_ktable(struct pfr_ktable *, long);
220 void pfr_insert_ktables(struct pfr_ktableworkq *);
221 void pfr_insert_ktable(struct pfr_ktable *);
222 void pfr_setflags_ktables(struct pfr_ktableworkq *);
223 void pfr_setflags_ktable(struct pfr_ktable *, int);
224 void pfr_clstats_ktables(struct pfr_ktableworkq *, long,
226 void pfr_clstats_ktable(struct pfr_ktable *, long, int);
227 struct pfr_ktable *pfr_create_ktable(struct pfr_table *, long, int);
228 void pfr_destroy_ktables(struct pfr_ktableworkq *, int);
229 void pfr_destroy_ktable(struct pfr_ktable *, int);
230 int pfr_ktable_compare(struct pfr_ktable *,
231 struct pfr_ktable *);
232 struct pfr_ktable *pfr_lookup_table(struct pfr_table *);
233 void pfr_clean_node_mask(struct pfr_ktable *,
234 struct pfr_kentryworkq *);
235 int pfr_table_count(struct pfr_table *, int);
236 int pfr_skip_table(struct pfr_table *,
237 struct pfr_ktable *, int);
238 struct pfr_kentry *pfr_kentry_byidx(struct pfr_ktable *, int, int);
240 RB_PROTOTYPE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
241 RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
243 struct pfr_ktablehead pfr_ktables;
244 struct pfr_table pfr_nulltable;
251 pool_init(&pfr_ktable_pl, sizeof(struct pfr_ktable), 0, 0, 0,
252 "pfrktable", &pool_allocator_oldnointr);
253 pool_init(&pfr_kentry_pl, sizeof(struct pfr_kentry), 0, 0, 0,
254 "pfrkentry", &pool_allocator_oldnointr);
255 pool_init(&pfr_kentry_pl2, sizeof(struct pfr_kentry), 0, 0, 0,
259 pfr_sin.sin_len = sizeof(pfr_sin);
260 pfr_sin.sin_family = AF_INET;
261 pfr_sin6.sin6_len = sizeof(pfr_sin6);
262 pfr_sin6.sin6_family = AF_INET6;
264 memset(&pfr_ffaddr, 0xff, sizeof(pfr_ffaddr));
268 pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags)
270 struct pfr_ktable *kt;
271 struct pfr_kentryworkq workq;
274 ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY);
275 if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
277 kt = pfr_lookup_table(tbl);
278 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
280 if (kt->pfrkt_flags & PFR_TFLAG_CONST)
282 pfr_enqueue_addrs(kt, &workq, ndel, 0);
284 if (!(flags & PFR_FLAG_DUMMY)) {
286 if (flags & PFR_FLAG_ATOMIC)
288 pfr_remove_kentries(kt, &workq);
289 if (flags & PFR_FLAG_ATOMIC)
292 printf("pfr_clr_addrs: corruption detected (%d).\n",
301 pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
302 int *nadd, int flags)
304 struct pfr_ktable *kt, *tmpkt;
305 struct pfr_kentryworkq workq;
306 struct pfr_kentry *p, *q;
308 int i, rv, s = 0, xadd = 0;
309 long tzero = time_second;
311 ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_FEEDBACK);
312 if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
314 kt = pfr_lookup_table(tbl);
315 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
317 if (kt->pfrkt_flags & PFR_TFLAG_CONST)
319 tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0);
323 for (i = 0; i < size; i++) {
324 if (COPYIN(addr+i, &ad, sizeof(ad)))
326 if (pfr_validate_addr(&ad))
328 p = pfr_lookup_addr(kt, &ad, 1);
329 q = pfr_lookup_addr(tmpkt, &ad, 1);
330 if (flags & PFR_FLAG_FEEDBACK) {
332 ad.pfra_fback = PFR_FB_DUPLICATE;
334 ad.pfra_fback = PFR_FB_ADDED;
335 else if (p->pfrke_not != ad.pfra_not)
336 ad.pfra_fback = PFR_FB_CONFLICT;
338 ad.pfra_fback = PFR_FB_NONE;
340 if (p == NULL && q == NULL) {
341 p = pfr_create_kentry(&ad, 0);
344 if (pfr_route_kentry(tmpkt, p)) {
345 pfr_destroy_kentry(p);
346 ad.pfra_fback = PFR_FB_NONE;
348 SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
352 if (flags & PFR_FLAG_FEEDBACK) {
353 if (COPYOUT(&ad, addr+i, sizeof(ad)))
357 pfr_clean_node_mask(tmpkt, &workq);
358 if (!(flags & PFR_FLAG_DUMMY)) {
359 if (flags & PFR_FLAG_ATOMIC)
361 pfr_insert_kentries(kt, &workq, tzero);
362 if (flags & PFR_FLAG_ATOMIC)
365 pfr_destroy_kentries(&workq);
368 pfr_destroy_ktable(tmpkt, 0);
371 pfr_clean_node_mask(tmpkt, &workq);
372 pfr_destroy_kentries(&workq);
373 if (flags & PFR_FLAG_FEEDBACK)
374 pfr_reset_feedback(addr, size, flags);
375 pfr_destroy_ktable(tmpkt, 0);
380 pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
381 int *ndel, int flags)
383 struct pfr_ktable *kt;
384 struct pfr_kentryworkq workq;
385 struct pfr_kentry *p;
387 int i, rv, s = 0, xdel = 0, log = 1;
389 ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_FEEDBACK);
390 if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
392 kt = pfr_lookup_table(tbl);
393 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
395 if (kt->pfrkt_flags & PFR_TFLAG_CONST)
398 * there are two algorithms to choose from here.
400 * n: number of addresses to delete
401 * N: number of addresses in the table
403 * one is O(N) and is better for large 'n'
404 * one is O(n*LOG(N)) and is better for small 'n'
406 * following code try to decide which one is best.
408 for (i = kt->pfrkt_cnt; i > 0; i >>= 1)
410 if (size > kt->pfrkt_cnt/log) {
411 /* full table scan */
414 /* iterate over addresses to delete */
415 for (i = 0; i < size; i++) {
416 if (COPYIN(addr+i, &ad, sizeof(ad)))
418 if (pfr_validate_addr(&ad))
420 p = pfr_lookup_addr(kt, &ad, 1);
426 for (i = 0; i < size; i++) {
427 if (COPYIN(addr+i, &ad, sizeof(ad)))
429 if (pfr_validate_addr(&ad))
431 p = pfr_lookup_addr(kt, &ad, 1);
432 if (flags & PFR_FLAG_FEEDBACK) {
434 ad.pfra_fback = PFR_FB_NONE;
435 else if (p->pfrke_not != ad.pfra_not)
436 ad.pfra_fback = PFR_FB_CONFLICT;
437 else if (p->pfrke_mark)
438 ad.pfra_fback = PFR_FB_DUPLICATE;
440 ad.pfra_fback = PFR_FB_DELETED;
442 if (p != NULL && p->pfrke_not == ad.pfra_not &&
445 SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
448 if (flags & PFR_FLAG_FEEDBACK)
449 if (COPYOUT(&ad, addr+i, sizeof(ad)))
452 if (!(flags & PFR_FLAG_DUMMY)) {
453 if (flags & PFR_FLAG_ATOMIC)
455 pfr_remove_kentries(kt, &workq);
456 if (flags & PFR_FLAG_ATOMIC)
463 if (flags & PFR_FLAG_FEEDBACK)
464 pfr_reset_feedback(addr, size, flags);
469 pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
470 int *size2, int *nadd, int *ndel, int *nchange, int flags,
471 u_int32_t ignore_pfrt_flags)
473 struct pfr_ktable *kt, *tmpkt;
474 struct pfr_kentryworkq addq, delq, changeq;
475 struct pfr_kentry *p, *q;
477 int i, rv, s = 0, xadd = 0, xdel = 0, xchange = 0;
478 long tzero = time_second;
480 ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_FEEDBACK);
481 if (pfr_validate_table(tbl, ignore_pfrt_flags, flags &
484 kt = pfr_lookup_table(tbl);
485 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
487 if (kt->pfrkt_flags & PFR_TFLAG_CONST)
489 tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0);
495 SLIST_INIT(&changeq);
496 for (i = 0; i < size; i++) {
497 if (COPYIN(addr+i, &ad, sizeof(ad)))
499 if (pfr_validate_addr(&ad))
501 ad.pfra_fback = PFR_FB_NONE;
502 p = pfr_lookup_addr(kt, &ad, 1);
505 ad.pfra_fback = PFR_FB_DUPLICATE;
509 if (p->pfrke_not != ad.pfra_not) {
510 SLIST_INSERT_HEAD(&changeq, p, pfrke_workq);
511 ad.pfra_fback = PFR_FB_CHANGED;
515 q = pfr_lookup_addr(tmpkt, &ad, 1);
517 ad.pfra_fback = PFR_FB_DUPLICATE;
520 p = pfr_create_kentry(&ad, 0);
523 if (pfr_route_kentry(tmpkt, p)) {
524 pfr_destroy_kentry(p);
525 ad.pfra_fback = PFR_FB_NONE;
527 SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
528 ad.pfra_fback = PFR_FB_ADDED;
533 if (flags & PFR_FLAG_FEEDBACK)
534 if (COPYOUT(&ad, addr+i, sizeof(ad)))
537 pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY);
538 if ((flags & PFR_FLAG_FEEDBACK) && *size2) {
539 if (*size2 < size+xdel) {
544 SLIST_FOREACH(p, &delq, pfrke_workq) {
545 pfr_copyout_addr(&ad, p);
546 ad.pfra_fback = PFR_FB_DELETED;
547 if (COPYOUT(&ad, addr+size+i, sizeof(ad)))
552 pfr_clean_node_mask(tmpkt, &addq);
553 if (!(flags & PFR_FLAG_DUMMY)) {
554 if (flags & PFR_FLAG_ATOMIC)
556 pfr_insert_kentries(kt, &addq, tzero);
557 pfr_remove_kentries(kt, &delq);
558 pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
559 if (flags & PFR_FLAG_ATOMIC)
562 pfr_destroy_kentries(&addq);
569 if ((flags & PFR_FLAG_FEEDBACK) && size2)
571 pfr_destroy_ktable(tmpkt, 0);
574 pfr_clean_node_mask(tmpkt, &addq);
575 pfr_destroy_kentries(&addq);
576 if (flags & PFR_FLAG_FEEDBACK)
577 pfr_reset_feedback(addr, size, flags);
578 pfr_destroy_ktable(tmpkt, 0);
583 pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
584 int *nmatch, int flags)
586 struct pfr_ktable *kt;
587 struct pfr_kentry *p;
591 ACCEPT_FLAGS(PFR_FLAG_REPLACE);
592 if (pfr_validate_table(tbl, 0, 0))
594 kt = pfr_lookup_table(tbl);
595 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
598 for (i = 0; i < size; i++) {
599 if (COPYIN(addr+i, &ad, sizeof(ad)))
601 if (pfr_validate_addr(&ad))
603 if (ADDR_NETWORK(&ad))
605 p = pfr_lookup_addr(kt, &ad, 0);
606 if (flags & PFR_FLAG_REPLACE)
607 pfr_copyout_addr(&ad, p);
608 ad.pfra_fback = (p == NULL) ? PFR_FB_NONE :
609 (p->pfrke_not ? PFR_FB_NOTMATCH : PFR_FB_MATCH);
610 if (p != NULL && !p->pfrke_not)
612 if (COPYOUT(&ad, addr+i, sizeof(ad)))
621 pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size,
624 struct pfr_ktable *kt;
625 struct pfr_walktree w;
629 if (pfr_validate_table(tbl, 0, 0))
631 kt = pfr_lookup_table(tbl);
632 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
634 if (kt->pfrkt_cnt > *size) {
635 *size = kt->pfrkt_cnt;
639 bzero(&w, sizeof(w));
640 w.pfrw_op = PFRW_GET_ADDRS;
642 w.pfrw_free = kt->pfrkt_cnt;
643 w.pfrw_flags = flags;
645 rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
647 rv = rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
651 rv = kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree,
654 rv = rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
660 printf("pfr_get_addrs: corruption detected (%d).\n",
664 *size = kt->pfrkt_cnt;
669 pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size,
672 struct pfr_ktable *kt;
673 struct pfr_walktree w;
674 struct pfr_kentryworkq workq;
676 long tzero = time_second;
678 ACCEPT_FLAGS(PFR_FLAG_ATOMIC); /* XXX PFR_FLAG_CLSTATS disabled */
679 if (pfr_validate_table(tbl, 0, 0))
681 kt = pfr_lookup_table(tbl);
682 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
684 if (kt->pfrkt_cnt > *size) {
685 *size = kt->pfrkt_cnt;
689 bzero(&w, sizeof(w));
690 w.pfrw_op = PFRW_GET_ASTATS;
691 w.pfrw_astats = addr;
692 w.pfrw_free = kt->pfrkt_cnt;
693 w.pfrw_flags = flags;
694 if (flags & PFR_FLAG_ATOMIC)
697 rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
699 rv = rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
703 rv = kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree,
706 rv = rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
708 if (!rv && (flags & PFR_FLAG_CLSTATS)) {
709 pfr_enqueue_addrs(kt, &workq, NULL, 0);
710 pfr_clstats_kentries(&workq, tzero, 0);
712 if (flags & PFR_FLAG_ATOMIC)
718 printf("pfr_get_astats: corruption detected (%d).\n",
722 *size = kt->pfrkt_cnt;
727 pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size,
728 int *nzero, int flags)
730 struct pfr_ktable *kt;
731 struct pfr_kentryworkq workq;
732 struct pfr_kentry *p;
734 int i, rv, s = 0, xzero = 0;
736 ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_FEEDBACK);
737 if (pfr_validate_table(tbl, 0, 0))
739 kt = pfr_lookup_table(tbl);
740 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
743 for (i = 0; i < size; i++) {
744 if (COPYIN(addr+i, &ad, sizeof(ad)))
746 if (pfr_validate_addr(&ad))
748 p = pfr_lookup_addr(kt, &ad, 1);
749 if (flags & PFR_FLAG_FEEDBACK) {
750 ad.pfra_fback = (p != NULL) ?
751 PFR_FB_CLEARED : PFR_FB_NONE;
752 if (COPYOUT(&ad, addr+i, sizeof(ad)))
756 SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
761 if (!(flags & PFR_FLAG_DUMMY)) {
762 if (flags & PFR_FLAG_ATOMIC)
764 pfr_clstats_kentries(&workq, 0, 0);
765 if (flags & PFR_FLAG_ATOMIC)
772 if (flags & PFR_FLAG_FEEDBACK)
773 pfr_reset_feedback(addr, size, flags);
778 pfr_validate_addr(struct pfr_addr *ad)
782 switch (ad->pfra_af) {
785 if (ad->pfra_net > 32)
791 if (ad->pfra_net > 128)
798 if (ad->pfra_net < 128 &&
799 (((caddr_t)ad)[ad->pfra_net/8] & (0xFF >> (ad->pfra_net%8))))
801 for (i = (ad->pfra_net+7)/8; i < sizeof(ad->pfra_u); i++)
802 if (((caddr_t)ad)[i])
804 if (ad->pfra_not && ad->pfra_not != 1)
812 pfr_enqueue_addrs(struct pfr_ktable *kt, struct pfr_kentryworkq *workq,
813 int *naddr, int sweep)
815 struct pfr_walktree w;
818 bzero(&w, sizeof(w));
819 w.pfrw_op = sweep ? PFRW_SWEEP : PFRW_ENQUEUE;
820 w.pfrw_workq = workq;
821 if (kt->pfrkt_ip4 != NULL)
823 if (kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree,
826 if (rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w))
828 printf("pfr_enqueue_addrs: IPv4 walktree failed.\n");
829 if (kt->pfrkt_ip6 != NULL)
831 if (kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree,
834 if (rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w))
836 printf("pfr_enqueue_addrs: IPv6 walktree failed.\n");
842 pfr_mark_addrs(struct pfr_ktable *kt)
844 struct pfr_walktree w;
846 bzero(&w, sizeof(w));
847 w.pfrw_op = PFRW_MARK;
849 if (kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w))
851 if (rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w))
853 printf("pfr_mark_addrs: IPv4 walktree failed.\n");
855 if (kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w))
857 if (rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w))
859 printf("pfr_mark_addrs: IPv6 walktree failed.\n");
864 pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact)
866 union sockaddr_union sa, mask;
867 struct radix_node_head *head = NULL; /* make the compiler happy */
868 struct pfr_kentry *ke;
871 bzero(&sa, sizeof(sa));
872 if (ad->pfra_af == AF_INET) {
873 FILLIN_SIN(sa.sin, ad->pfra_ip4addr);
874 head = kt->pfrkt_ip4;
875 } else if ( ad->pfra_af == AF_INET6 ) {
876 FILLIN_SIN6(sa.sin6, ad->pfra_ip6addr);
877 head = kt->pfrkt_ip6;
879 if (ADDR_NETWORK(ad)) {
880 pfr_prepare_network(&mask, ad->pfra_af, ad->pfra_net);
881 s = splsoftnet(); /* rn_lookup makes use of globals */
885 ke = (struct pfr_kentry *)rn_lookup(&sa, &mask, head);
887 if (ke && KENTRY_RNF_ROOT(ke))
890 ke = (struct pfr_kentry *)rn_match(&sa, head);
891 if (ke && KENTRY_RNF_ROOT(ke))
893 if (exact && ke && KENTRY_NETWORK(ke))
900 pfr_create_kentry(struct pfr_addr *ad, int intr)
902 struct pfr_kentry *ke;
905 ke = pool_get(&pfr_kentry_pl2, PR_NOWAIT);
907 ke = pool_get(&pfr_kentry_pl, PR_NOWAIT);
910 bzero(ke, sizeof(*ke));
912 if (ad->pfra_af == AF_INET)
913 FILLIN_SIN(ke->pfrke_sa.sin, ad->pfra_ip4addr);
914 else if (ad->pfra_af == AF_INET6)
915 FILLIN_SIN6(ke->pfrke_sa.sin6, ad->pfra_ip6addr);
916 ke->pfrke_af = ad->pfra_af;
917 ke->pfrke_net = ad->pfra_net;
918 ke->pfrke_not = ad->pfra_not;
919 ke->pfrke_intrpool = intr;
924 pfr_destroy_kentries(struct pfr_kentryworkq *workq)
926 struct pfr_kentry *p, *q;
928 for (p = SLIST_FIRST(workq); p != NULL; p = q) {
929 q = SLIST_NEXT(p, pfrke_workq);
930 pfr_destroy_kentry(p);
935 pfr_destroy_kentry(struct pfr_kentry *ke)
937 if (ke->pfrke_intrpool)
938 pool_put(&pfr_kentry_pl2, ke);
940 pool_put(&pfr_kentry_pl, ke);
944 pfr_insert_kentries(struct pfr_ktable *kt,
945 struct pfr_kentryworkq *workq, long tzero)
947 struct pfr_kentry *p;
950 SLIST_FOREACH(p, workq, pfrke_workq) {
951 rv = pfr_route_kentry(kt, p);
953 printf("pfr_insert_kentries: cannot route entry "
957 p->pfrke_tzero = tzero;
964 pfr_insert_kentry(struct pfr_ktable *kt, struct pfr_addr *ad, long tzero)
966 struct pfr_kentry *p;
969 p = pfr_lookup_addr(kt, ad, 1);
972 p = pfr_create_kentry(ad, 1);
976 rv = pfr_route_kentry(kt, p);
980 p->pfrke_tzero = tzero;
987 pfr_remove_kentries(struct pfr_ktable *kt,
988 struct pfr_kentryworkq *workq)
990 struct pfr_kentry *p;
993 SLIST_FOREACH(p, workq, pfrke_workq) {
994 pfr_unroute_kentry(kt, p);
998 pfr_destroy_kentries(workq);
1002 pfr_clean_node_mask(struct pfr_ktable *kt,
1003 struct pfr_kentryworkq *workq)
1005 struct pfr_kentry *p;
1007 SLIST_FOREACH(p, workq, pfrke_workq)
1008 pfr_unroute_kentry(kt, p);
1012 pfr_clstats_kentries(struct pfr_kentryworkq *workq, long tzero, int negchange)
1014 struct pfr_kentry *p;
1017 SLIST_FOREACH(p, workq, pfrke_workq) {
1020 p->pfrke_not = !p->pfrke_not;
1021 bzero(p->pfrke_packets, sizeof(p->pfrke_packets));
1022 bzero(p->pfrke_bytes, sizeof(p->pfrke_bytes));
1024 p->pfrke_tzero = tzero;
1029 pfr_reset_feedback(struct pfr_addr *addr, int size, int flags)
1034 for (i = 0; i < size; i++) {
1035 if (COPYIN(addr+i, &ad, sizeof(ad)))
1037 ad.pfra_fback = PFR_FB_NONE;
1038 if (COPYOUT(&ad, addr+i, sizeof(ad)))
1044 pfr_prepare_network(union sockaddr_union *sa, int af, int net)
1048 bzero(sa, sizeof(*sa));
1049 if (af == AF_INET) {
1050 sa->sin.sin_len = sizeof(sa->sin);
1051 sa->sin.sin_family = AF_INET;
1052 sa->sin.sin_addr.s_addr = net ? htonl(-1 << (32-net)) : 0;
1053 } else if (af == AF_INET6) {
1054 sa->sin6.sin6_len = sizeof(sa->sin6);
1055 sa->sin6.sin6_family = AF_INET6;
1056 for (i = 0; i < 4; i++) {
1058 sa->sin6.sin6_addr.s6_addr32[i] =
1059 net ? htonl(-1 << (32-net)) : 0;
1062 sa->sin6.sin6_addr.s6_addr32[i] = 0xFFFFFFFF;
1069 pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
1071 union sockaddr_union mask;
1072 struct radix_node *rn;
1073 struct radix_node_head *head = NULL; /* make the compiler happy */
1076 bzero(ke->pfrke_node, sizeof(ke->pfrke_node));
1077 if (ke->pfrke_af == AF_INET)
1078 head = kt->pfrkt_ip4;
1079 else if (ke->pfrke_af == AF_INET6)
1080 head = kt->pfrkt_ip6;
1084 PF_ASSERT(MA_OWNED);
1086 if (KENTRY_NETWORK(ke)) {
1087 pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
1088 rn = rn_addroute(&ke->pfrke_sa, &mask, head, ke->pfrke_node);
1090 rn = rn_addroute(&ke->pfrke_sa, NULL, head, ke->pfrke_node);
1093 return (rn == NULL ? -1 : 0);
1097 pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
1099 union sockaddr_union mask;
1100 struct radix_node *rn;
1101 struct radix_node_head *head = NULL; /* make the compiler happy */
1104 if (ke->pfrke_af == AF_INET)
1105 head = kt->pfrkt_ip4;
1106 else if (ke->pfrke_af == AF_INET6)
1107 head = kt->pfrkt_ip6;
1111 PF_ASSERT(MA_OWNED);
1113 if (KENTRY_NETWORK(ke)) {
1114 pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
1116 rn = rn_delete(&ke->pfrke_sa, &mask, head);
1118 rn = rn_delete(&ke->pfrke_sa, &mask, head, NULL);
1122 rn = rn_delete(&ke->pfrke_sa, NULL, head);
1124 rn = rn_delete(&ke->pfrke_sa, NULL, head, NULL);
1129 printf("pfr_unroute_kentry: delete failed.\n");
1136 pfr_copyout_addr(struct pfr_addr *ad, struct pfr_kentry *ke)
1138 bzero(ad, sizeof(*ad));
1141 ad->pfra_af = ke->pfrke_af;
1142 ad->pfra_net = ke->pfrke_net;
1143 ad->pfra_not = ke->pfrke_not;
1144 if (ad->pfra_af == AF_INET)
1145 ad->pfra_ip4addr = ke->pfrke_sa.sin.sin_addr;
1146 else if (ad->pfra_af == AF_INET6)
1147 ad->pfra_ip6addr = ke->pfrke_sa.sin6.sin6_addr;
1151 pfr_walktree(struct radix_node *rn, void *arg)
1153 struct pfr_kentry *ke = (struct pfr_kentry *)rn;
1154 struct pfr_walktree *w = arg;
1155 int s, flags = w->pfrw_flags;
1157 switch (w->pfrw_op) {
1166 SLIST_INSERT_HEAD(w->pfrw_workq, ke, pfrke_workq);
1169 case PFRW_GET_ADDRS:
1170 if (w->pfrw_free-- > 0) {
1173 pfr_copyout_addr(&ad, ke);
1174 if (COPYOUT(&ad, w->pfrw_addr, sizeof(ad)))
1179 case PFRW_GET_ASTATS:
1180 if (w->pfrw_free-- > 0) {
1181 struct pfr_astats as;
1183 pfr_copyout_addr(&as.pfras_a, ke);
1186 bcopy(ke->pfrke_packets, as.pfras_packets,
1187 sizeof(as.pfras_packets));
1188 bcopy(ke->pfrke_bytes, as.pfras_bytes,
1189 sizeof(as.pfras_bytes));
1191 as.pfras_tzero = ke->pfrke_tzero;
1193 if (COPYOUT(&as, w->pfrw_astats, sizeof(as)))
1200 break; /* negative entries are ignored */
1201 if (!w->pfrw_cnt--) {
1202 w->pfrw_kentry = ke;
1203 return (1); /* finish search */
1206 case PFRW_DYNADDR_UPDATE:
1207 if (ke->pfrke_af == AF_INET) {
1208 if (w->pfrw_dyn->pfid_acnt4++ > 0)
1210 pfr_prepare_network(&pfr_mask, AF_INET, ke->pfrke_net);
1211 w->pfrw_dyn->pfid_addr4 = *SUNION2PF(
1212 &ke->pfrke_sa, AF_INET);
1213 w->pfrw_dyn->pfid_mask4 = *SUNION2PF(
1214 &pfr_mask, AF_INET);
1215 } else if (ke->pfrke_af == AF_INET6){
1216 if (w->pfrw_dyn->pfid_acnt6++ > 0)
1218 pfr_prepare_network(&pfr_mask, AF_INET6, ke->pfrke_net);
1219 w->pfrw_dyn->pfid_addr6 = *SUNION2PF(
1220 &ke->pfrke_sa, AF_INET6);
1221 w->pfrw_dyn->pfid_mask6 = *SUNION2PF(
1222 &pfr_mask, AF_INET6);
1230 pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags)
1232 struct pfr_ktableworkq workq;
1233 struct pfr_ktable *p;
1234 int s = 0, xdel = 0;
1236 ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_ALLRSETS);
1237 if (pfr_fix_anchor(filter->pfrt_anchor))
1239 if (pfr_table_count(filter, flags) < 0)
1243 RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1244 if (pfr_skip_table(filter, p, flags))
1246 if (!strcmp(p->pfrkt_anchor, PF_RESERVED_ANCHOR))
1248 if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE))
1250 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1251 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1254 if (!(flags & PFR_FLAG_DUMMY)) {
1255 if (flags & PFR_FLAG_ATOMIC)
1257 pfr_setflags_ktables(&workq);
1258 if (flags & PFR_FLAG_ATOMIC)
1267 pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags)
1269 struct pfr_ktableworkq addq, changeq;
1270 struct pfr_ktable *p, *q, *r, key;
1271 int i, rv, s = 0, xadd = 0;
1272 long tzero = time_second;
1274 ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY);
1276 SLIST_INIT(&changeq);
1277 for (i = 0; i < size; i++) {
1278 if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t)))
1280 if (pfr_validate_table(&key.pfrkt_t, PFR_TFLAG_USRMASK,
1281 flags & PFR_FLAG_USERIOCTL))
1283 key.pfrkt_flags |= PFR_TFLAG_ACTIVE;
1284 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1286 p = pfr_create_ktable(&key.pfrkt_t, tzero, 1);
1289 SLIST_FOREACH(q, &addq, pfrkt_workq) {
1290 if (!pfr_ktable_compare(p, q))
1293 SLIST_INSERT_HEAD(&addq, p, pfrkt_workq);
1295 if (!key.pfrkt_anchor[0])
1298 /* find or create root table */
1299 bzero(key.pfrkt_anchor, sizeof(key.pfrkt_anchor));
1300 r = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1305 SLIST_FOREACH(q, &addq, pfrkt_workq) {
1306 if (!pfr_ktable_compare(&key, q)) {
1311 key.pfrkt_flags = 0;
1312 r = pfr_create_ktable(&key.pfrkt_t, 0, 1);
1315 SLIST_INSERT_HEAD(&addq, r, pfrkt_workq);
1317 } else if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1318 SLIST_FOREACH(q, &changeq, pfrkt_workq)
1319 if (!pfr_ktable_compare(&key, q))
1321 p->pfrkt_nflags = (p->pfrkt_flags &
1322 ~PFR_TFLAG_USRMASK) | key.pfrkt_flags;
1323 SLIST_INSERT_HEAD(&changeq, p, pfrkt_workq);
1329 if (!(flags & PFR_FLAG_DUMMY)) {
1330 if (flags & PFR_FLAG_ATOMIC)
1332 pfr_insert_ktables(&addq);
1333 pfr_setflags_ktables(&changeq);
1334 if (flags & PFR_FLAG_ATOMIC)
1337 pfr_destroy_ktables(&addq, 0);
1342 pfr_destroy_ktables(&addq, 0);
1347 pfr_del_tables(struct pfr_table *tbl, int size, int *ndel, int flags)
1349 struct pfr_ktableworkq workq;
1350 struct pfr_ktable *p, *q, key;
1351 int i, s = 0, xdel = 0;
1353 ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY);
1355 for (i = 0; i < size; i++) {
1356 if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t)))
1358 if (pfr_validate_table(&key.pfrkt_t, 0,
1359 flags & PFR_FLAG_USERIOCTL))
1361 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1362 if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1363 SLIST_FOREACH(q, &workq, pfrkt_workq)
1364 if (!pfr_ktable_compare(p, q))
1366 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1367 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1374 if (!(flags & PFR_FLAG_DUMMY)) {
1375 if (flags & PFR_FLAG_ATOMIC)
1377 pfr_setflags_ktables(&workq);
1378 if (flags & PFR_FLAG_ATOMIC)
1387 pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size,
1390 struct pfr_ktable *p;
1393 ACCEPT_FLAGS(PFR_FLAG_ALLRSETS);
1394 if (pfr_fix_anchor(filter->pfrt_anchor))
1396 n = nn = pfr_table_count(filter, flags);
1403 RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1404 if (pfr_skip_table(filter, p, flags))
1408 if (COPYOUT(&p->pfrkt_t, tbl++, sizeof(*tbl)))
1412 printf("pfr_get_tables: corruption detected (%d).\n", n);
1420 pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size,
1423 struct pfr_ktable *p;
1424 struct pfr_ktableworkq workq;
1426 long tzero = time_second;
1428 ACCEPT_FLAGS(PFR_FLAG_ATOMIC|PFR_FLAG_ALLRSETS);
1429 /* XXX PFR_FLAG_CLSTATS disabled */
1430 if (pfr_fix_anchor(filter->pfrt_anchor))
1432 n = nn = pfr_table_count(filter, flags);
1440 if (flags & PFR_FLAG_ATOMIC)
1442 RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1443 if (pfr_skip_table(filter, p, flags))
1447 if (!(flags & PFR_FLAG_ATOMIC))
1449 if (COPYOUT(&p->pfrkt_ts, tbl++, sizeof(*tbl))) {
1450 if (!(flags & PFR_FLAG_ATOMIC))
1454 if (!(flags & PFR_FLAG_ATOMIC))
1456 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1458 if (flags & PFR_FLAG_CLSTATS)
1459 pfr_clstats_ktables(&workq, tzero,
1460 flags & PFR_FLAG_ADDRSTOO);
1461 if (flags & PFR_FLAG_ATOMIC)
1464 printf("pfr_get_tstats: corruption detected (%d).\n", n);
1472 pfr_clr_tstats(struct pfr_table *tbl, int size, int *nzero, int flags)
1474 struct pfr_ktableworkq workq;
1475 struct pfr_ktable *p, key;
1476 int i, s = 0, xzero = 0;
1477 long tzero = time_second;
1479 ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_ADDRSTOO);
1481 for (i = 0; i < size; i++) {
1482 if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t)))
1484 if (pfr_validate_table(&key.pfrkt_t, 0, 0))
1486 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1488 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1492 if (!(flags & PFR_FLAG_DUMMY)) {
1493 if (flags & PFR_FLAG_ATOMIC)
1495 pfr_clstats_ktables(&workq, tzero, flags & PFR_FLAG_ADDRSTOO);
1496 if (flags & PFR_FLAG_ATOMIC)
1505 pfr_set_tflags(struct pfr_table *tbl, int size, int setflag, int clrflag,
1506 int *nchange, int *ndel, int flags)
1508 struct pfr_ktableworkq workq;
1509 struct pfr_ktable *p, *q, key;
1510 int i, s = 0, xchange = 0, xdel = 0;
1512 ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY);
1513 if ((setflag & ~PFR_TFLAG_USRMASK) ||
1514 (clrflag & ~PFR_TFLAG_USRMASK) ||
1515 (setflag & clrflag))
1518 for (i = 0; i < size; i++) {
1519 if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t)))
1521 if (pfr_validate_table(&key.pfrkt_t, 0,
1522 flags & PFR_FLAG_USERIOCTL))
1524 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1525 if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1526 p->pfrkt_nflags = (p->pfrkt_flags | setflag) &
1528 if (p->pfrkt_nflags == p->pfrkt_flags)
1530 SLIST_FOREACH(q, &workq, pfrkt_workq)
1531 if (!pfr_ktable_compare(p, q))
1533 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1534 if ((p->pfrkt_flags & PFR_TFLAG_PERSIST) &&
1535 (clrflag & PFR_TFLAG_PERSIST) &&
1536 !(p->pfrkt_flags & PFR_TFLAG_REFERENCED))
1544 if (!(flags & PFR_FLAG_DUMMY)) {
1545 if (flags & PFR_FLAG_ATOMIC)
1547 pfr_setflags_ktables(&workq);
1548 if (flags & PFR_FLAG_ATOMIC)
1551 if (nchange != NULL)
1559 pfr_ina_begin(struct pfr_table *trs, u_int32_t *ticket, int *ndel, int flags)
1561 struct pfr_ktableworkq workq;
1562 struct pfr_ktable *p;
1563 struct pf_ruleset *rs;
1566 ACCEPT_FLAGS(PFR_FLAG_DUMMY);
1567 rs = pf_find_or_create_ruleset(trs->pfrt_anchor);
1571 RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1572 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1573 pfr_skip_table(trs, p, 0))
1575 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1576 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1579 if (!(flags & PFR_FLAG_DUMMY)) {
1580 pfr_setflags_ktables(&workq);
1582 *ticket = ++rs->tticket;
1585 pf_remove_if_empty_ruleset(rs);
1592 pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size,
1593 int *nadd, int *naddr, u_int32_t ticket, int flags)
1595 struct pfr_ktableworkq tableq;
1596 struct pfr_kentryworkq addrq;
1597 struct pfr_ktable *kt, *rt, *shadow, key;
1598 struct pfr_kentry *p;
1600 struct pf_ruleset *rs;
1601 int i, rv, xadd = 0, xaddr = 0;
1603 ACCEPT_FLAGS(PFR_FLAG_DUMMY|PFR_FLAG_ADDRSTOO);
1604 if (size && !(flags & PFR_FLAG_ADDRSTOO))
1606 if (pfr_validate_table(tbl, PFR_TFLAG_USRMASK,
1607 flags & PFR_FLAG_USERIOCTL))
1609 rs = pf_find_ruleset(tbl->pfrt_anchor);
1610 if (rs == NULL || !rs->topen || ticket != rs->tticket)
1612 tbl->pfrt_flags |= PFR_TFLAG_INACTIVE;
1613 SLIST_INIT(&tableq);
1614 kt = RB_FIND(pfr_ktablehead, &pfr_ktables, (struct pfr_ktable *)tbl);
1616 kt = pfr_create_ktable(tbl, 0, 1);
1619 SLIST_INSERT_HEAD(&tableq, kt, pfrkt_workq);
1621 if (!tbl->pfrt_anchor[0])
1624 /* find or create root table */
1625 bzero(&key, sizeof(key));
1626 strlcpy(key.pfrkt_name, tbl->pfrt_name, sizeof(key.pfrkt_name));
1627 rt = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1629 kt->pfrkt_root = rt;
1632 rt = pfr_create_ktable(&key.pfrkt_t, 0, 1);
1634 pfr_destroy_ktables(&tableq, 0);
1637 SLIST_INSERT_HEAD(&tableq, rt, pfrkt_workq);
1638 kt->pfrkt_root = rt;
1639 } else if (!(kt->pfrkt_flags & PFR_TFLAG_INACTIVE))
1642 shadow = pfr_create_ktable(tbl, 0, 0);
1643 if (shadow == NULL) {
1644 pfr_destroy_ktables(&tableq, 0);
1648 for (i = 0; i < size; i++) {
1649 if (COPYIN(addr+i, &ad, sizeof(ad)))
1651 if (pfr_validate_addr(&ad))
1653 if (pfr_lookup_addr(shadow, &ad, 1) != NULL)
1655 p = pfr_create_kentry(&ad, 0);
1658 if (pfr_route_kentry(shadow, p)) {
1659 pfr_destroy_kentry(p);
1662 SLIST_INSERT_HEAD(&addrq, p, pfrke_workq);
1665 if (!(flags & PFR_FLAG_DUMMY)) {
1666 if (kt->pfrkt_shadow != NULL)
1667 pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1668 kt->pfrkt_flags |= PFR_TFLAG_INACTIVE;
1669 pfr_insert_ktables(&tableq);
1670 shadow->pfrkt_cnt = (flags & PFR_FLAG_ADDRSTOO) ?
1671 xaddr : NO_ADDRESSES;
1672 kt->pfrkt_shadow = shadow;
1674 pfr_clean_node_mask(shadow, &addrq);
1675 pfr_destroy_ktable(shadow, 0);
1676 pfr_destroy_ktables(&tableq, 0);
1677 pfr_destroy_kentries(&addrq);
1685 pfr_destroy_ktable(shadow, 0);
1686 pfr_destroy_ktables(&tableq, 0);
1687 pfr_destroy_kentries(&addrq);
1692 pfr_ina_rollback(struct pfr_table *trs, u_int32_t ticket, int *ndel, int flags)
1694 struct pfr_ktableworkq workq;
1695 struct pfr_ktable *p;
1696 struct pf_ruleset *rs;
1699 ACCEPT_FLAGS(PFR_FLAG_DUMMY);
1700 rs = pf_find_ruleset(trs->pfrt_anchor);
1701 if (rs == NULL || !rs->topen || ticket != rs->tticket)
1704 RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1705 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1706 pfr_skip_table(trs, p, 0))
1708 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1709 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1712 if (!(flags & PFR_FLAG_DUMMY)) {
1713 pfr_setflags_ktables(&workq);
1715 pf_remove_if_empty_ruleset(rs);
1723 pfr_ina_commit(struct pfr_table *trs, u_int32_t ticket, int *nadd,
1724 int *nchange, int flags)
1726 struct pfr_ktable *p, *q;
1727 struct pfr_ktableworkq workq;
1728 struct pf_ruleset *rs;
1729 int s = 0, xadd = 0, xchange = 0;
1730 long tzero = time_second;
1732 ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY);
1733 rs = pf_find_ruleset(trs->pfrt_anchor);
1734 if (rs == NULL || !rs->topen || ticket != rs->tticket)
1738 RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1739 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1740 pfr_skip_table(trs, p, 0))
1742 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1743 if (p->pfrkt_flags & PFR_TFLAG_ACTIVE)
1749 if (!(flags & PFR_FLAG_DUMMY)) {
1750 if (flags & PFR_FLAG_ATOMIC)
1752 for (p = SLIST_FIRST(&workq); p != NULL; p = q) {
1753 q = SLIST_NEXT(p, pfrkt_workq);
1754 pfr_commit_ktable(p, tzero);
1756 if (flags & PFR_FLAG_ATOMIC)
1759 pf_remove_if_empty_ruleset(rs);
1763 if (nchange != NULL)
1770 pfr_commit_ktable(struct pfr_ktable *kt, long tzero)
1772 struct pfr_ktable *shadow = kt->pfrkt_shadow;
1775 if (shadow->pfrkt_cnt == NO_ADDRESSES) {
1776 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1777 pfr_clstats_ktable(kt, tzero, 1);
1778 } else if (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) {
1779 /* kt might contain addresses */
1780 struct pfr_kentryworkq addrq, addq, changeq, delq, garbageq;
1781 struct pfr_kentry *p, *q, *next;
1784 pfr_enqueue_addrs(shadow, &addrq, NULL, 0);
1787 SLIST_INIT(&changeq);
1789 SLIST_INIT(&garbageq);
1790 pfr_clean_node_mask(shadow, &addrq);
1791 for (p = SLIST_FIRST(&addrq); p != NULL; p = next) {
1792 next = SLIST_NEXT(p, pfrke_workq); /* XXX */
1793 pfr_copyout_addr(&ad, p);
1794 q = pfr_lookup_addr(kt, &ad, 1);
1796 if (q->pfrke_not != p->pfrke_not)
1797 SLIST_INSERT_HEAD(&changeq, q,
1800 SLIST_INSERT_HEAD(&garbageq, p, pfrke_workq);
1802 p->pfrke_tzero = tzero;
1803 SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
1806 pfr_enqueue_addrs(kt, &delq, NULL, ENQUEUE_UNMARKED_ONLY);
1807 pfr_insert_kentries(kt, &addq, tzero);
1808 pfr_remove_kentries(kt, &delq);
1809 pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
1810 pfr_destroy_kentries(&garbageq);
1812 /* kt cannot contain addresses */
1813 SWAP(struct radix_node_head *, kt->pfrkt_ip4,
1815 SWAP(struct radix_node_head *, kt->pfrkt_ip6,
1817 SWAP(int, kt->pfrkt_cnt, shadow->pfrkt_cnt);
1818 pfr_clstats_ktable(kt, tzero, 1);
1820 nflags = ((shadow->pfrkt_flags & PFR_TFLAG_USRMASK) |
1821 (kt->pfrkt_flags & PFR_TFLAG_SETMASK) | PFR_TFLAG_ACTIVE)
1822 & ~PFR_TFLAG_INACTIVE;
1823 pfr_destroy_ktable(shadow, 0);
1824 kt->pfrkt_shadow = NULL;
1825 pfr_setflags_ktable(kt, nflags);
1829 pfr_validate_table(struct pfr_table *tbl, int allowedflags, int no_reserved)
1833 if (!tbl->pfrt_name[0])
1835 if (no_reserved && !strcmp(tbl->pfrt_anchor, PF_RESERVED_ANCHOR))
1837 if (tbl->pfrt_name[PF_TABLE_NAME_SIZE-1])
1839 for (i = strlen(tbl->pfrt_name); i < PF_TABLE_NAME_SIZE; i++)
1840 if (tbl->pfrt_name[i])
1842 if (pfr_fix_anchor(tbl->pfrt_anchor))
1844 if (tbl->pfrt_flags & ~allowedflags)
1850 * Rewrite anchors referenced by tables to remove slashes
1851 * and check for validity.
1854 pfr_fix_anchor(char *anchor)
1856 size_t siz = MAXPATHLEN;
1859 if (anchor[0] == '/') {
1865 while (*++path == '/')
1867 bcopy(path, anchor, siz - off);
1868 memset(anchor + siz - off, 0, off);
1870 if (anchor[siz - 1])
1872 for (i = strlen(anchor); i < siz; i++)
1879 pfr_table_count(struct pfr_table *filter, int flags)
1881 struct pf_ruleset *rs;
1883 if (flags & PFR_FLAG_ALLRSETS)
1884 return (pfr_ktable_cnt);
1885 if (filter->pfrt_anchor[0]) {
1886 rs = pf_find_ruleset(filter->pfrt_anchor);
1887 return ((rs != NULL) ? rs->tables : -1);
1889 return (pf_main_ruleset.tables);
1893 pfr_skip_table(struct pfr_table *filter, struct pfr_ktable *kt, int flags)
1895 if (flags & PFR_FLAG_ALLRSETS)
1897 if (strcmp(filter->pfrt_anchor, kt->pfrkt_anchor))
1903 pfr_insert_ktables(struct pfr_ktableworkq *workq)
1905 struct pfr_ktable *p;
1907 SLIST_FOREACH(p, workq, pfrkt_workq)
1908 pfr_insert_ktable(p);
1912 pfr_insert_ktable(struct pfr_ktable *kt)
1914 RB_INSERT(pfr_ktablehead, &pfr_ktables, kt);
1916 if (kt->pfrkt_root != NULL)
1917 if (!kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]++)
1918 pfr_setflags_ktable(kt->pfrkt_root,
1919 kt->pfrkt_root->pfrkt_flags|PFR_TFLAG_REFDANCHOR);
1923 pfr_setflags_ktables(struct pfr_ktableworkq *workq)
1925 struct pfr_ktable *p, *q;
1927 for (p = SLIST_FIRST(workq); p; p = q) {
1928 q = SLIST_NEXT(p, pfrkt_workq);
1929 pfr_setflags_ktable(p, p->pfrkt_nflags);
1934 pfr_setflags_ktable(struct pfr_ktable *kt, int newf)
1936 struct pfr_kentryworkq addrq;
1938 if (!(newf & PFR_TFLAG_REFERENCED) &&
1939 !(newf & PFR_TFLAG_PERSIST))
1940 newf &= ~PFR_TFLAG_ACTIVE;
1941 if (!(newf & PFR_TFLAG_ACTIVE))
1942 newf &= ~PFR_TFLAG_USRMASK;
1943 if (!(newf & PFR_TFLAG_SETMASK)) {
1944 RB_REMOVE(pfr_ktablehead, &pfr_ktables, kt);
1945 if (kt->pfrkt_root != NULL)
1946 if (!--kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR])
1947 pfr_setflags_ktable(kt->pfrkt_root,
1948 kt->pfrkt_root->pfrkt_flags &
1949 ~PFR_TFLAG_REFDANCHOR);
1950 pfr_destroy_ktable(kt, 1);
1954 if (!(newf & PFR_TFLAG_ACTIVE) && kt->pfrkt_cnt) {
1955 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1956 pfr_remove_kentries(kt, &addrq);
1958 if (!(newf & PFR_TFLAG_INACTIVE) && kt->pfrkt_shadow != NULL) {
1959 pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1960 kt->pfrkt_shadow = NULL;
1962 kt->pfrkt_flags = newf;
1966 pfr_clstats_ktables(struct pfr_ktableworkq *workq, long tzero, int recurse)
1968 struct pfr_ktable *p;
1970 SLIST_FOREACH(p, workq, pfrkt_workq)
1971 pfr_clstats_ktable(p, tzero, recurse);
1975 pfr_clstats_ktable(struct pfr_ktable *kt, long tzero, int recurse)
1977 struct pfr_kentryworkq addrq;
1981 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1982 pfr_clstats_kentries(&addrq, tzero, 0);
1985 bzero(kt->pfrkt_packets, sizeof(kt->pfrkt_packets));
1986 bzero(kt->pfrkt_bytes, sizeof(kt->pfrkt_bytes));
1987 kt->pfrkt_match = kt->pfrkt_nomatch = 0;
1989 kt->pfrkt_tzero = tzero;
1993 pfr_create_ktable(struct pfr_table *tbl, long tzero, int attachruleset)
1995 struct pfr_ktable *kt;
1996 struct pf_ruleset *rs;
1998 kt = pool_get(&pfr_ktable_pl, PR_NOWAIT);
2001 bzero(kt, sizeof(*kt));
2004 if (attachruleset) {
2005 rs = pf_find_or_create_ruleset(tbl->pfrt_anchor);
2007 pfr_destroy_ktable(kt, 0);
2014 if (!rn_inithead((void **)&kt->pfrkt_ip4,
2015 offsetof(struct sockaddr_in, sin_addr) * 8) ||
2016 !rn_inithead((void **)&kt->pfrkt_ip6,
2017 offsetof(struct sockaddr_in6, sin6_addr) * 8)) {
2018 pfr_destroy_ktable(kt, 0);
2021 kt->pfrkt_tzero = tzero;
2027 pfr_destroy_ktables(struct pfr_ktableworkq *workq, int flushaddr)
2029 struct pfr_ktable *p, *q;
2031 for (p = SLIST_FIRST(workq); p; p = q) {
2032 q = SLIST_NEXT(p, pfrkt_workq);
2033 pfr_destroy_ktable(p, flushaddr);
2038 pfr_destroy_ktable(struct pfr_ktable *kt, int flushaddr)
2040 struct pfr_kentryworkq addrq;
2043 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
2044 pfr_clean_node_mask(kt, &addrq);
2045 pfr_destroy_kentries(&addrq);
2047 #if defined(__FreeBSD__) && (__FreeBSD_version >= 500100)
2048 if (kt->pfrkt_ip4 != NULL) {
2049 RADIX_NODE_HEAD_DESTROY(kt->pfrkt_ip4);
2050 free((caddr_t)kt->pfrkt_ip4, M_RTABLE);
2052 if (kt->pfrkt_ip6 != NULL) {
2053 RADIX_NODE_HEAD_DESTROY(kt->pfrkt_ip6);
2054 free((caddr_t)kt->pfrkt_ip6, M_RTABLE);
2057 if (kt->pfrkt_ip4 != NULL)
2058 free((caddr_t)kt->pfrkt_ip4, M_RTABLE);
2059 if (kt->pfrkt_ip6 != NULL)
2060 free((caddr_t)kt->pfrkt_ip6, M_RTABLE);
2062 if (kt->pfrkt_shadow != NULL)
2063 pfr_destroy_ktable(kt->pfrkt_shadow, flushaddr);
2064 if (kt->pfrkt_rs != NULL) {
2065 kt->pfrkt_rs->tables--;
2066 pf_remove_if_empty_ruleset(kt->pfrkt_rs);
2068 pool_put(&pfr_ktable_pl, kt);
2072 pfr_ktable_compare(struct pfr_ktable *p, struct pfr_ktable *q)
2076 if ((d = strncmp(p->pfrkt_name, q->pfrkt_name, PF_TABLE_NAME_SIZE)))
2078 return (strcmp(p->pfrkt_anchor, q->pfrkt_anchor));
2082 pfr_lookup_table(struct pfr_table *tbl)
2084 /* struct pfr_ktable start like a struct pfr_table */
2085 return (RB_FIND(pfr_ktablehead, &pfr_ktables,
2086 (struct pfr_ktable *)tbl));
2090 pfr_match_addr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af)
2092 struct pfr_kentry *ke = NULL;
2095 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2096 kt = kt->pfrkt_root;
2097 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2103 pfr_sin.sin_addr.s_addr = a->addr32[0];
2104 ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4);
2105 if (ke && KENTRY_RNF_ROOT(ke))
2111 bcopy(a, &pfr_sin6.sin6_addr, sizeof(pfr_sin6.sin6_addr));
2112 ke = (struct pfr_kentry *)rn_match(&pfr_sin6, kt->pfrkt_ip6);
2113 if (ke && KENTRY_RNF_ROOT(ke))
2118 match = (ke && !ke->pfrke_not);
2122 kt->pfrkt_nomatch++;
2127 pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af,
2128 u_int64_t len, int dir_out, int op_pass, int notrule)
2130 struct pfr_kentry *ke = NULL;
2132 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2133 kt = kt->pfrkt_root;
2134 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2140 pfr_sin.sin_addr.s_addr = a->addr32[0];
2141 ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4);
2142 if (ke && KENTRY_RNF_ROOT(ke))
2148 bcopy(a, &pfr_sin6.sin6_addr, sizeof(pfr_sin6.sin6_addr));
2149 ke = (struct pfr_kentry *)rn_match(&pfr_sin6, kt->pfrkt_ip6);
2150 if (ke && KENTRY_RNF_ROOT(ke))
2157 if ((ke == NULL || ke->pfrke_not) != notrule) {
2158 if (op_pass != PFR_OP_PASS)
2159 printf("pfr_update_stats: assertion failed.\n");
2160 op_pass = PFR_OP_XPASS;
2162 kt->pfrkt_packets[dir_out][op_pass]++;
2163 kt->pfrkt_bytes[dir_out][op_pass] += len;
2164 if (ke != NULL && op_pass != PFR_OP_XPASS) {
2165 ke->pfrke_packets[dir_out][op_pass]++;
2166 ke->pfrke_bytes[dir_out][op_pass] += len;
2171 pfr_attach_table(struct pf_ruleset *rs, char *name)
2173 struct pfr_ktable *kt, *rt;
2174 struct pfr_table tbl;
2175 struct pf_anchor *ac = rs->anchor;
2177 bzero(&tbl, sizeof(tbl));
2178 strlcpy(tbl.pfrt_name, name, sizeof(tbl.pfrt_name));
2180 strlcpy(tbl.pfrt_anchor, ac->path, sizeof(tbl.pfrt_anchor));
2181 kt = pfr_lookup_table(&tbl);
2183 kt = pfr_create_ktable(&tbl, time_second, 1);
2187 bzero(tbl.pfrt_anchor, sizeof(tbl.pfrt_anchor));
2188 rt = pfr_lookup_table(&tbl);
2190 rt = pfr_create_ktable(&tbl, 0, 1);
2192 pfr_destroy_ktable(kt, 0);
2195 pfr_insert_ktable(rt);
2197 kt->pfrkt_root = rt;
2199 pfr_insert_ktable(kt);
2201 if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++)
2202 pfr_setflags_ktable(kt, kt->pfrkt_flags|PFR_TFLAG_REFERENCED);
2207 pfr_detach_table(struct pfr_ktable *kt)
2209 if (kt->pfrkt_refcnt[PFR_REFCNT_RULE] <= 0)
2210 printf("pfr_detach_table: refcount = %d.\n",
2211 kt->pfrkt_refcnt[PFR_REFCNT_RULE]);
2212 else if (!--kt->pfrkt_refcnt[PFR_REFCNT_RULE])
2213 pfr_setflags_ktable(kt, kt->pfrkt_flags&~PFR_TFLAG_REFERENCED);
2218 pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter,
2219 struct pf_addr **raddr, struct pf_addr **rmask, sa_family_t af)
2221 struct pfr_kentry *ke, *ke2 = NULL;
2222 struct pf_addr *addr = NULL;
2223 union sockaddr_union mask;
2224 int idx = -1, use_counter = 0;
2227 addr = (struct pf_addr *)&pfr_sin.sin_addr;
2228 else if (af == AF_INET6)
2229 addr = (struct pf_addr *)&pfr_sin6.sin6_addr;
2230 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2231 kt = kt->pfrkt_root;
2232 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2237 if (counter != NULL && idx >= 0)
2243 ke = pfr_kentry_byidx(kt, idx, af);
2246 pfr_prepare_network(&pfr_mask, af, ke->pfrke_net);
2247 *raddr = SUNION2PF(&ke->pfrke_sa, af);
2248 *rmask = SUNION2PF(&pfr_mask, af);
2251 /* is supplied address within block? */
2252 if (!PF_MATCHA(0, *raddr, *rmask, counter, af)) {
2253 /* no, go to next block in table */
2258 PF_ACPY(addr, counter, af);
2260 /* use first address of block */
2261 PF_ACPY(addr, *raddr, af);
2264 if (!KENTRY_NETWORK(ke)) {
2265 /* this is a single IP address - no possible nested block */
2266 PF_ACPY(counter, addr, af);
2271 /* we don't want to use a nested block */
2273 ke2 = (struct pfr_kentry *)rn_match(&pfr_sin,
2275 else if (af == AF_INET6)
2276 ke2 = (struct pfr_kentry *)rn_match(&pfr_sin6,
2278 /* no need to check KENTRY_RNF_ROOT() here */
2280 /* lookup return the same block - perfect */
2281 PF_ACPY(counter, addr, af);
2286 /* we need to increase the counter past the nested block */
2287 pfr_prepare_network(&mask, AF_INET, ke2->pfrke_net);
2288 PF_POOLMASK(addr, addr, SUNION2PF(&mask, af), &pfr_ffaddr, af);
2290 if (!PF_MATCHA(0, *raddr, *rmask, addr, af)) {
2291 /* ok, we reached the end of our main block */
2292 /* go to next block in table */
2301 pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af)
2303 struct pfr_walktree w;
2305 bzero(&w, sizeof(w));
2306 w.pfrw_op = PFRW_POOL_GET;
2313 kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
2315 rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
2317 return (w.pfrw_kentry);
2322 kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
2324 rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
2326 return (w.pfrw_kentry);
2334 pfr_dynaddr_update(struct pfr_ktable *kt, struct pfi_dynaddr *dyn)
2336 struct pfr_walktree w;
2339 bzero(&w, sizeof(w));
2340 w.pfrw_op = PFRW_DYNADDR_UPDATE;
2344 dyn->pfid_acnt4 = 0;
2345 dyn->pfid_acnt6 = 0;
2346 if (!dyn->pfid_af || dyn->pfid_af == AF_INET)
2348 kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
2350 rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
2352 if (!dyn->pfid_af || dyn->pfid_af == AF_INET6)
2354 kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
2356 rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w);