sys/netpfil/pf/pf_table.c

   1 /*-
   2  * Copyright (c) 2002 Cedric Berger
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  *
   9  *    - Redistributions of source code must retain the above copyright
  10  *      notice, this list of conditions and the following disclaimer.
  11  *    - Redistributions in binary form must reproduce the above
  12  *      copyright notice, this list of conditions and the following
  13  *      disclaimer in the documentation and/or other materials provided
  14  *      with the distribution.
  15  *
  16  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  17  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  18  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  19  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  20  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  22  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  23  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  24  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  26  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  27  * POSSIBILITY OF SUCH DAMAGE.
  28  *
  29  *      $OpenBSD: pf_table.c,v 1.79 2008/10/08 06:24:50 mcbride Exp $
  30  */
  31
  32 #include <sys/cdefs.h>
  33 __FBSDID("$FreeBSD$");
  34
  35 #include "opt_inet.h"
  36 #include "opt_inet6.h"
  37
  38 #include <sys/param.h>
  39 #include <sys/kernel.h>
  40 #include <sys/lock.h>
  41 #include <sys/malloc.h>
  42 #include <sys/mbuf.h>
  43 #include <sys/mutex.h>
  44 #include <sys/refcount.h>
  45 #include <sys/rwlock.h>
  46 #include <sys/socket.h>
  47 #include <vm/uma.h>
  48
  49 #include <net/if.h>
  50 #include <net/vnet.h>
  51 #include <net/pfvar.h>
  52
  53 #define ACCEPT_FLAGS(flags, oklist)             \
  54         do {                                    \
  55                 if ((flags & ~(oklist)) &       \
  56                     PFR_FLAG_ALLMASK)           \
  57                         return (EINVAL);        \
  58         } while (0)
  59
  60 #define FILLIN_SIN(sin, addr)                   \
  61         do {                                    \
  62                 (sin).sin_len = sizeof(sin);    \
  63                 (sin).sin_family = AF_INET;     \
  64                 (sin).sin_addr = (addr);        \
  65         } while (0)
  66
  67 #define FILLIN_SIN6(sin6, addr)                 \
  68         do {                                    \
  69                 (sin6).sin6_len = sizeof(sin6); \
  70                 (sin6).sin6_family = AF_INET6;  \
  71                 (sin6).sin6_addr = (addr);      \
  72         } while (0)
  73
  74 #define SWAP(type, a1, a2)                      \
  75         do {                                    \
  76                 type tmp = a1;                  \
  77                 a1 = a2;                        \
  78                 a2 = tmp;                       \
  79         } while (0)
  80
  81 #define SUNION2PF(su, af) (((af)==AF_INET) ?    \
  82     (struct pf_addr *)&(su)->sin.sin_addr :     \
  83     (struct pf_addr *)&(su)->sin6.sin6_addr)
  84
  85 #define AF_BITS(af)             (((af)==AF_INET)?32:128)
  86 #define ADDR_NETWORK(ad)        ((ad)->pfra_net < AF_BITS((ad)->pfra_af))
  87 #define KENTRY_NETWORK(ke)      ((ke)->pfrke_net < AF_BITS((ke)->pfrke_af))
  88 #define KENTRY_RNF_ROOT(ke) \
  89                 ((((struct radix_node *)(ke))->rn_flags & RNF_ROOT) != 0)
  90
  91 #define NO_ADDRESSES            (-1)
  92 #define ENQUEUE_UNMARKED_ONLY   (1)
  93 #define INVERT_NEG_FLAG         (1)
  94
  95 struct pfr_walktree {
  96         enum pfrw_op {
  97                 PFRW_MARK,
  98                 PFRW_SWEEP,
  99                 PFRW_ENQUEUE,
 100                 PFRW_GET_ADDRS,
 101                 PFRW_GET_ASTATS,
 102                 PFRW_POOL_GET,
 103                 PFRW_DYNADDR_UPDATE
 104         }        pfrw_op;
 105         union {
 106                 struct pfr_addr         *pfrw1_addr;
 107                 struct pfr_astats       *pfrw1_astats;
 108                 struct pfr_kentryworkq  *pfrw1_workq;
 109                 struct pfr_kentry       *pfrw1_kentry;
 110                 struct pfi_dynaddr      *pfrw1_dyn;
 111         }        pfrw_1;
 112         int      pfrw_free;
 113 };
 114 #define pfrw_addr       pfrw_1.pfrw1_addr
 115 #define pfrw_astats     pfrw_1.pfrw1_astats
 116 #define pfrw_workq      pfrw_1.pfrw1_workq
 117 #define pfrw_kentry     pfrw_1.pfrw1_kentry
 118 #define pfrw_dyn        pfrw_1.pfrw1_dyn
 119 #define pfrw_cnt        pfrw_free
 120
 121 #define senderr(e)      do { rv = (e); goto _bad; } while (0)
 122
 123 static MALLOC_DEFINE(M_PFTABLE, "pf_table", "pf(4) tables structures");
 124 static VNET_DEFINE(uma_zone_t, pfr_kentry_z);
 125 #define V_pfr_kentry_z          VNET(pfr_kentry_z)
 126 static VNET_DEFINE(uma_zone_t, pfr_kcounters_z);
 127 #define V_pfr_kcounters_z       VNET(pfr_kcounters_z)
 128
 129 static struct pf_addr    pfr_ffaddr = {
 130         .addr32 = { 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff }
 131 };
 132
 133 static void              pfr_copyout_addr(struct pfr_addr *,
 134                             struct pfr_kentry *ke);
 135 static int               pfr_validate_addr(struct pfr_addr *);
 136 static void              pfr_enqueue_addrs(struct pfr_ktable *,
 137                             struct pfr_kentryworkq *, int *, int);
 138 static void              pfr_mark_addrs(struct pfr_ktable *);
 139 static struct pfr_kentry
 140                         *pfr_lookup_addr(struct pfr_ktable *,
 141                             struct pfr_addr *, int);
 142 static struct pfr_kentry *pfr_create_kentry(struct pfr_addr *);
 143 static void              pfr_destroy_kentries(struct pfr_kentryworkq *);
 144 static void              pfr_destroy_kentry(struct pfr_kentry *);
 145 static void              pfr_insert_kentries(struct pfr_ktable *,
 146                             struct pfr_kentryworkq *, long);
 147 static void              pfr_remove_kentries(struct pfr_ktable *,
 148                             struct pfr_kentryworkq *);
 149 static void              pfr_clstats_kentries(struct pfr_kentryworkq *, long,
 150                             int);
 151 static void              pfr_reset_feedback(struct pfr_addr *, int);
 152 static void              pfr_prepare_network(union sockaddr_union *, int, int);
 153 static int               pfr_route_kentry(struct pfr_ktable *,
 154                             struct pfr_kentry *);
 155 static int               pfr_unroute_kentry(struct pfr_ktable *,
 156                             struct pfr_kentry *);
 157 static int               pfr_walktree(struct radix_node *, void *);
 158 static int               pfr_validate_table(struct pfr_table *, int, int);
 159 static int               pfr_fix_anchor(char *);
 160 static void              pfr_commit_ktable(struct pfr_ktable *, long);
 161 static void              pfr_insert_ktables(struct pfr_ktableworkq *);
 162 static void              pfr_insert_ktable(struct pfr_ktable *);
 163 static void              pfr_setflags_ktables(struct pfr_ktableworkq *);
 164 static void              pfr_setflags_ktable(struct pfr_ktable *, int);
 165 static void              pfr_clstats_ktables(struct pfr_ktableworkq *, long,
 166                             int);
 167 static void              pfr_clstats_ktable(struct pfr_ktable *, long, int);
 168 static struct pfr_ktable
 169                         *pfr_create_ktable(struct pfr_table *, long, int);
 170 static void              pfr_destroy_ktables(struct pfr_ktableworkq *, int);
 171 static void              pfr_destroy_ktable(struct pfr_ktable *, int);
 172 static int               pfr_ktable_compare(struct pfr_ktable *,
 173                             struct pfr_ktable *);
 174 static struct pfr_ktable
 175                         *pfr_lookup_table(struct pfr_table *);
 176 static void              pfr_clean_node_mask(struct pfr_ktable *,
 177                             struct pfr_kentryworkq *);
 178 static int               pfr_table_count(struct pfr_table *, int);
 179 static int               pfr_skip_table(struct pfr_table *,
 180                             struct pfr_ktable *, int);
 181 static struct pfr_kentry
 182                         *pfr_kentry_byidx(struct pfr_ktable *, int, int);
 183
 184 static RB_PROTOTYPE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
 185 static RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
 186
 187 struct pfr_ktablehead    pfr_ktables;
 188 struct pfr_table         pfr_nulltable;
 189 int                      pfr_ktable_cnt;
 190
 191 void
 192 pfr_initialize(void)
 193 {
 194
 195         V_pfr_kentry_z = uma_zcreate("pf table entries",
 196             sizeof(struct pfr_kentry), NULL, NULL, NULL, NULL, UMA_ALIGN_PTR,
 197             0);
 198         V_pfr_kcounters_z = uma_zcreate("pf table counters",
 199             sizeof(struct pfr_kcounters), NULL, NULL, NULL, NULL,
 200             UMA_ALIGN_PTR, 0);
 201         V_pf_limits[PF_LIMIT_TABLE_ENTRIES].zone = V_pfr_kentry_z;
 202         V_pf_limits[PF_LIMIT_TABLE_ENTRIES].limit = PFR_KENTRY_HIWAT;
 203 }
 204
 205 void
 206 pfr_cleanup(void)
 207 {
 208
 209         uma_zdestroy(V_pfr_kentry_z);
 210         uma_zdestroy(V_pfr_kcounters_z);
 211 }
 212
 213 int
 214 pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags)
 215 {
 216         struct pfr_ktable       *kt;
 217         struct pfr_kentryworkq   workq;
 218
 219         PF_RULES_WASSERT();
 220
 221         ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
 222         if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
 223                 return (EINVAL);
 224         kt = pfr_lookup_table(tbl);
 225         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 226                 return (ESRCH);
 227         if (kt->pfrkt_flags & PFR_TFLAG_CONST)
 228                 return (EPERM);
 229         pfr_enqueue_addrs(kt, &workq, ndel, 0);
 230
 231         if (!(flags & PFR_FLAG_DUMMY)) {
 232                 pfr_remove_kentries(kt, &workq);
 233                 KASSERT(kt->pfrkt_cnt == 0, ("%s: non-null pfrkt_cnt", __func__));
 234         }
 235         return (0);
 236 }
 237
 238 int
 239 pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 240     int *nadd, int flags)
 241 {
 242         struct pfr_ktable       *kt, *tmpkt;
 243         struct pfr_kentryworkq   workq;
 244         struct pfr_kentry       *p, *q;
 245         struct pfr_addr         *ad;
 246         int                      i, rv, xadd = 0;
 247         long                     tzero = time_second;
 248
 249         PF_RULES_WASSERT();
 250
 251         ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
 252         if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
 253                 return (EINVAL);
 254         kt = pfr_lookup_table(tbl);
 255         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 256                 return (ESRCH);
 257         if (kt->pfrkt_flags & PFR_TFLAG_CONST)
 258                 return (EPERM);
 259         tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0);
 260         if (tmpkt == NULL)
 261                 return (ENOMEM);
 262         SLIST_INIT(&workq);
 263         for (i = 0, ad = addr; i < size; i++, ad++) {
 264                 if (pfr_validate_addr(ad))
 265                         senderr(EINVAL);
 266                 p = pfr_lookup_addr(kt, ad, 1);
 267                 q = pfr_lookup_addr(tmpkt, ad, 1);
 268                 if (flags & PFR_FLAG_FEEDBACK) {
 269                         if (q != NULL)
 270                                 ad->pfra_fback = PFR_FB_DUPLICATE;
 271                         else if (p == NULL)
 272                                 ad->pfra_fback = PFR_FB_ADDED;
 273                         else if (p->pfrke_not != ad->pfra_not)
 274                                 ad->pfra_fback = PFR_FB_CONFLICT;
 275                         else
 276                                 ad->pfra_fback = PFR_FB_NONE;
 277                 }
 278                 if (p == NULL && q == NULL) {
 279                         p = pfr_create_kentry(ad);
 280                         if (p == NULL)
 281                                 senderr(ENOMEM);
 282                         if (pfr_route_kentry(tmpkt, p)) {
 283                                 pfr_destroy_kentry(p);
 284                                 ad->pfra_fback = PFR_FB_NONE;
 285                         } else {
 286                                 SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
 287                                 xadd++;
 288                         }
 289                 }
 290         }
 291         pfr_clean_node_mask(tmpkt, &workq);
 292         if (!(flags & PFR_FLAG_DUMMY))
 293                 pfr_insert_kentries(kt, &workq, tzero);
 294         else
 295                 pfr_destroy_kentries(&workq);
 296         if (nadd != NULL)
 297                 *nadd = xadd;
 298         pfr_destroy_ktable(tmpkt, 0);
 299         return (0);
 300 _bad:
 301         pfr_clean_node_mask(tmpkt, &workq);
 302         pfr_destroy_kentries(&workq);
 303         if (flags & PFR_FLAG_FEEDBACK)
 304                 pfr_reset_feedback(addr, size);
 305         pfr_destroy_ktable(tmpkt, 0);
 306         return (rv);
 307 }
 308
 309 int
 310 pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 311     int *ndel, int flags)
 312 {
 313         struct pfr_ktable       *kt;
 314         struct pfr_kentryworkq   workq;
 315         struct pfr_kentry       *p;
 316         struct pfr_addr         *ad;
 317         int                      i, rv, xdel = 0, log = 1;
 318
 319         PF_RULES_WASSERT();
 320
 321         ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
 322         if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
 323                 return (EINVAL);
 324         kt = pfr_lookup_table(tbl);
 325         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 326                 return (ESRCH);
 327         if (kt->pfrkt_flags & PFR_TFLAG_CONST)
 328                 return (EPERM);
 329         /*
 330          * there are two algorithms to choose from here.
 331          * with:
 332          *   n: number of addresses to delete
 333          *   N: number of addresses in the table
 334          *
 335          * one is O(N) and is better for large 'n'
 336          * one is O(n*LOG(N)) and is better for small 'n'
 337          *
 338          * following code try to decide which one is best.
 339          */
 340         for (i = kt->pfrkt_cnt; i > 0; i >>= 1)
 341                 log++;
 342         if (size > kt->pfrkt_cnt/log) {
 343                 /* full table scan */
 344                 pfr_mark_addrs(kt);
 345         } else {
 346                 /* iterate over addresses to delete */
 347                 for (i = 0, ad = addr; i < size; i++, ad++) {
 348                         if (pfr_validate_addr(ad))
 349                                 return (EINVAL);
 350                         p = pfr_lookup_addr(kt, ad, 1);
 351                         if (p != NULL)
 352                                 p->pfrke_mark = 0;
 353                 }
 354         }
 355         SLIST_INIT(&workq);
 356         for (i = 0, ad = addr; i < size; i++, ad++) {
 357                 if (pfr_validate_addr(ad))
 358                         senderr(EINVAL);
 359                 p = pfr_lookup_addr(kt, ad, 1);
 360                 if (flags & PFR_FLAG_FEEDBACK) {
 361                         if (p == NULL)
 362                                 ad->pfra_fback = PFR_FB_NONE;
 363                         else if (p->pfrke_not != ad->pfra_not)
 364                                 ad->pfra_fback = PFR_FB_CONFLICT;
 365                         else if (p->pfrke_mark)
 366                                 ad->pfra_fback = PFR_FB_DUPLICATE;
 367                         else
 368                                 ad->pfra_fback = PFR_FB_DELETED;
 369                 }
 370                 if (p != NULL && p->pfrke_not == ad->pfra_not &&
 371                     !p->pfrke_mark) {
 372                         p->pfrke_mark = 1;
 373                         SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
 374                         xdel++;
 375                 }
 376         }
 377         if (!(flags & PFR_FLAG_DUMMY))
 378                 pfr_remove_kentries(kt, &workq);
 379         if (ndel != NULL)
 380                 *ndel = xdel;
 381         return (0);
 382 _bad:
 383         if (flags & PFR_FLAG_FEEDBACK)
 384                 pfr_reset_feedback(addr, size);
 385         return (rv);
 386 }
 387
 388 int
 389 pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 390     int *size2, int *nadd, int *ndel, int *nchange, int flags,
 391     u_int32_t ignore_pfrt_flags)
 392 {
 393         struct pfr_ktable       *kt, *tmpkt;
 394         struct pfr_kentryworkq   addq, delq, changeq;
 395         struct pfr_kentry       *p, *q;
 396         struct pfr_addr          ad;
 397         int                      i, rv, xadd = 0, xdel = 0, xchange = 0;
 398         long                     tzero = time_second;
 399
 400         PF_RULES_WASSERT();
 401
 402         ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
 403         if (pfr_validate_table(tbl, ignore_pfrt_flags, flags &
 404             PFR_FLAG_USERIOCTL))
 405                 return (EINVAL);
 406         kt = pfr_lookup_table(tbl);
 407         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 408                 return (ESRCH);
 409         if (kt->pfrkt_flags & PFR_TFLAG_CONST)
 410                 return (EPERM);
 411         tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0);
 412         if (tmpkt == NULL)
 413                 return (ENOMEM);
 414         pfr_mark_addrs(kt);
 415         SLIST_INIT(&addq);
 416         SLIST_INIT(&delq);
 417         SLIST_INIT(&changeq);
 418         for (i = 0; i < size; i++) {
 419                 /*
 420                  * XXXGL: undertand pf_if usage of this function
 421                  * and make ad a moving pointer
 422                  */
 423                 bcopy(addr + i, &ad, sizeof(ad));
 424                 if (pfr_validate_addr(&ad))
 425                         senderr(EINVAL);
 426                 ad.pfra_fback = PFR_FB_NONE;
 427                 p = pfr_lookup_addr(kt, &ad, 1);
 428                 if (p != NULL) {
 429                         if (p->pfrke_mark) {
 430                                 ad.pfra_fback = PFR_FB_DUPLICATE;
 431                                 goto _skip;
 432                         }
 433                         p->pfrke_mark = 1;
 434                         if (p->pfrke_not != ad.pfra_not) {
 435                                 SLIST_INSERT_HEAD(&changeq, p, pfrke_workq);
 436                                 ad.pfra_fback = PFR_FB_CHANGED;
 437                                 xchange++;
 438                         }
 439                 } else {
 440                         q = pfr_lookup_addr(tmpkt, &ad, 1);
 441                         if (q != NULL) {
 442                                 ad.pfra_fback = PFR_FB_DUPLICATE;
 443                                 goto _skip;
 444                         }
 445                         p = pfr_create_kentry(&ad);
 446                         if (p == NULL)
 447                                 senderr(ENOMEM);
 448                         if (pfr_route_kentry(tmpkt, p)) {
 449                                 pfr_destroy_kentry(p);
 450                                 ad.pfra_fback = PFR_FB_NONE;
 451                         } else {
 452                                 SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
 453                                 ad.pfra_fback = PFR_FB_ADDED;
 454                                 xadd++;
 455                         }
 456                 }
 457 _skip:
 458                 if (flags & PFR_FLAG_FEEDBACK)
 459                         bcopy(&ad, addr + i, sizeof(ad));
 460         }
 461         pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY);
 462         if ((flags & PFR_FLAG_FEEDBACK) && *size2) {
 463                 if (*size2 < size+xdel) {
 464                         *size2 = size+xdel;
 465                         senderr(0);
 466                 }
 467                 i = 0;
 468                 SLIST_FOREACH(p, &delq, pfrke_workq) {
 469                         pfr_copyout_addr(&ad, p);
 470                         ad.pfra_fback = PFR_FB_DELETED;
 471                         bcopy(&ad, addr + size + i, sizeof(ad));
 472                         i++;
 473                 }
 474         }
 475         pfr_clean_node_mask(tmpkt, &addq);
 476         if (!(flags & PFR_FLAG_DUMMY)) {
 477                 pfr_insert_kentries(kt, &addq, tzero);
 478                 pfr_remove_kentries(kt, &delq);
 479                 pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
 480         } else
 481                 pfr_destroy_kentries(&addq);
 482         if (nadd != NULL)
 483                 *nadd = xadd;
 484         if (ndel != NULL)
 485                 *ndel = xdel;
 486         if (nchange != NULL)
 487                 *nchange = xchange;
 488         if ((flags & PFR_FLAG_FEEDBACK) && size2)
 489                 *size2 = size+xdel;
 490         pfr_destroy_ktable(tmpkt, 0);
 491         return (0);
 492 _bad:
 493         pfr_clean_node_mask(tmpkt, &addq);
 494         pfr_destroy_kentries(&addq);
 495         if (flags & PFR_FLAG_FEEDBACK)
 496                 pfr_reset_feedback(addr, size);
 497         pfr_destroy_ktable(tmpkt, 0);
 498         return (rv);
 499 }
 500
 501 int
 502 pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 503         int *nmatch, int flags)
 504 {
 505         struct pfr_ktable       *kt;
 506         struct pfr_kentry       *p;
 507         struct pfr_addr         *ad;
 508         int                      i, xmatch = 0;
 509
 510         PF_RULES_RASSERT();
 511
 512         ACCEPT_FLAGS(flags, PFR_FLAG_REPLACE);
 513         if (pfr_validate_table(tbl, 0, 0))
 514                 return (EINVAL);
 515         kt = pfr_lookup_table(tbl);
 516         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 517                 return (ESRCH);
 518
 519         for (i = 0, ad = addr; i < size; i++, ad++) {
 520                 if (pfr_validate_addr(ad))
 521                         return (EINVAL);
 522                 if (ADDR_NETWORK(ad))
 523                         return (EINVAL);
 524                 p = pfr_lookup_addr(kt, ad, 0);
 525                 if (flags & PFR_FLAG_REPLACE)
 526                         pfr_copyout_addr(ad, p);
 527                 ad->pfra_fback = (p == NULL) ? PFR_FB_NONE :
 528                     (p->pfrke_not ? PFR_FB_NOTMATCH : PFR_FB_MATCH);
 529                 if (p != NULL && !p->pfrke_not)
 530                         xmatch++;
 531         }
 532         if (nmatch != NULL)
 533                 *nmatch = xmatch;
 534         return (0);
 535 }
 536
 537 int
 538 pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size,
 539         int flags)
 540 {
 541         struct pfr_ktable       *kt;
 542         struct pfr_walktree      w;
 543         int                      rv;
 544
 545         PF_RULES_RASSERT();
 546
 547         ACCEPT_FLAGS(flags, 0);
 548         if (pfr_validate_table(tbl, 0, 0))
 549                 return (EINVAL);
 550         kt = pfr_lookup_table(tbl);
 551         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 552                 return (ESRCH);
 553         if (kt->pfrkt_cnt > *size) {
 554                 *size = kt->pfrkt_cnt;
 555                 return (0);
 556         }
 557
 558         bzero(&w, sizeof(w));
 559         w.pfrw_op = PFRW_GET_ADDRS;
 560         w.pfrw_addr = addr;
 561         w.pfrw_free = kt->pfrkt_cnt;
 562         rv = kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
 563         if (!rv)
 564                 rv = kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh,
 565                     pfr_walktree, &w);
 566         if (rv)
 567                 return (rv);
 568
 569         KASSERT(w.pfrw_free == 0, ("%s: corruption detected (%d)", __func__,
 570             w.pfrw_free));
 571
 572         *size = kt->pfrkt_cnt;
 573         return (0);
 574 }
 575
 576 int
 577 pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size,
 578         int flags)
 579 {
 580         struct pfr_ktable       *kt;
 581         struct pfr_walktree      w;
 582         struct pfr_kentryworkq   workq;
 583         int                      rv;
 584         long                     tzero = time_second;
 585
 586         PF_RULES_RASSERT();
 587
 588         /* XXX PFR_FLAG_CLSTATS disabled */
 589         ACCEPT_FLAGS(flags, 0);
 590         if (pfr_validate_table(tbl, 0, 0))
 591                 return (EINVAL);
 592         kt = pfr_lookup_table(tbl);
 593         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 594                 return (ESRCH);
 595         if (kt->pfrkt_cnt > *size) {
 596                 *size = kt->pfrkt_cnt;
 597                 return (0);
 598         }
 599
 600         bzero(&w, sizeof(w));
 601         w.pfrw_op = PFRW_GET_ASTATS;
 602         w.pfrw_astats = addr;
 603         w.pfrw_free = kt->pfrkt_cnt;
 604         rv = kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
 605         if (!rv)
 606                 rv = kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh,
 607                     pfr_walktree, &w);
 608         if (!rv && (flags & PFR_FLAG_CLSTATS)) {
 609                 pfr_enqueue_addrs(kt, &workq, NULL, 0);
 610                 pfr_clstats_kentries(&workq, tzero, 0);
 611         }
 612         if (rv)
 613                 return (rv);
 614
 615         if (w.pfrw_free) {
 616                 printf("pfr_get_astats: corruption detected (%d).\n",
 617                     w.pfrw_free);
 618                 return (ENOTTY);
 619         }
 620         *size = kt->pfrkt_cnt;
 621         return (0);
 622 }
 623
 624 int
 625 pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 626     int *nzero, int flags)
 627 {
 628         struct pfr_ktable       *kt;
 629         struct pfr_kentryworkq   workq;
 630         struct pfr_kentry       *p;
 631         struct pfr_addr         *ad;
 632         int                      i, rv, xzero = 0;
 633
 634         PF_RULES_WASSERT();
 635
 636         ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
 637         if (pfr_validate_table(tbl, 0, 0))
 638                 return (EINVAL);
 639         kt = pfr_lookup_table(tbl);
 640         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 641                 return (ESRCH);
 642         SLIST_INIT(&workq);
 643         for (i = 0, ad = addr; i < size; i++, ad++) {
 644                 if (pfr_validate_addr(ad))
 645                         senderr(EINVAL);
 646                 p = pfr_lookup_addr(kt, ad, 1);
 647                 if (flags & PFR_FLAG_FEEDBACK) {
 648                         ad->pfra_fback = (p != NULL) ?
 649                             PFR_FB_CLEARED : PFR_FB_NONE;
 650                 }
 651                 if (p != NULL) {
 652                         SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
 653                         xzero++;
 654                 }
 655         }
 656
 657         if (!(flags & PFR_FLAG_DUMMY))
 658                 pfr_clstats_kentries(&workq, 0, 0);
 659         if (nzero != NULL)
 660                 *nzero = xzero;
 661         return (0);
 662 _bad:
 663         if (flags & PFR_FLAG_FEEDBACK)
 664                 pfr_reset_feedback(addr, size);
 665         return (rv);
 666 }
 667
 668 static int
 669 pfr_validate_addr(struct pfr_addr *ad)
 670 {
 671         int i;
 672
 673         switch (ad->pfra_af) {
 674 #ifdef INET
 675         case AF_INET:
 676                 if (ad->pfra_net > 32)
 677                         return (-1);
 678                 break;
 679 #endif /* INET */
 680 #ifdef INET6
 681         case AF_INET6:
 682                 if (ad->pfra_net > 128)
 683                         return (-1);
 684                 break;
 685 #endif /* INET6 */
 686         default:
 687                 return (-1);
 688         }
 689         if (ad->pfra_net < 128 &&
 690                 (((caddr_t)ad)[ad->pfra_net/8] & (0xFF >> (ad->pfra_net%8))))
 691                         return (-1);
 692         for (i = (ad->pfra_net+7)/8; i < sizeof(ad->pfra_u); i++)
 693                 if (((caddr_t)ad)[i])
 694                         return (-1);
 695         if (ad->pfra_not && ad->pfra_not != 1)
 696                 return (-1);
 697         if (ad->pfra_fback)
 698                 return (-1);
 699         return (0);
 700 }
 701
 702 static void
 703 pfr_enqueue_addrs(struct pfr_ktable *kt, struct pfr_kentryworkq *workq,
 704         int *naddr, int sweep)
 705 {
 706         struct pfr_walktree     w;
 707
 708         SLIST_INIT(workq);
 709         bzero(&w, sizeof(w));
 710         w.pfrw_op = sweep ? PFRW_SWEEP : PFRW_ENQUEUE;
 711         w.pfrw_workq = workq;
 712         if (kt->pfrkt_ip4 != NULL)
 713                 if (kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh,
 714                     pfr_walktree, &w))
 715                         printf("pfr_enqueue_addrs: IPv4 walktree failed.\n");
 716         if (kt->pfrkt_ip6 != NULL)
 717                 if (kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh,
 718                     pfr_walktree, &w))
 719                         printf("pfr_enqueue_addrs: IPv6 walktree failed.\n");
 720         if (naddr != NULL)
 721                 *naddr = w.pfrw_cnt;
 722 }
 723
 724 static void
 725 pfr_mark_addrs(struct pfr_ktable *kt)
 726 {
 727         struct pfr_walktree     w;
 728
 729         bzero(&w, sizeof(w));
 730         w.pfrw_op = PFRW_MARK;
 731         if (kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w))
 732                 printf("pfr_mark_addrs: IPv4 walktree failed.\n");
 733         if (kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w))
 734                 printf("pfr_mark_addrs: IPv6 walktree failed.\n");
 735 }
 736
 737
 738 static struct pfr_kentry *
 739 pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact)
 740 {
 741         union sockaddr_union     sa, mask;
 742         struct radix_head       *head = NULL;
 743         struct pfr_kentry       *ke;
 744
 745         PF_RULES_ASSERT();
 746
 747         bzero(&sa, sizeof(sa));
 748         if (ad->pfra_af == AF_INET) {
 749                 FILLIN_SIN(sa.sin, ad->pfra_ip4addr);
 750                 head = &kt->pfrkt_ip4->rh;
 751         } else if ( ad->pfra_af == AF_INET6 ) {
 752                 FILLIN_SIN6(sa.sin6, ad->pfra_ip6addr);
 753                 head = &kt->pfrkt_ip6->rh;
 754         }
 755         if (ADDR_NETWORK(ad)) {
 756                 pfr_prepare_network(&mask, ad->pfra_af, ad->pfra_net);
 757                 ke = (struct pfr_kentry *)rn_lookup(&sa, &mask, head);
 758                 if (ke && KENTRY_RNF_ROOT(ke))
 759                         ke = NULL;
 760         } else {
 761                 ke = (struct pfr_kentry *)rn_match(&sa, head);
 762                 if (ke && KENTRY_RNF_ROOT(ke))
 763                         ke = NULL;
 764                 if (exact && ke && KENTRY_NETWORK(ke))
 765                         ke = NULL;
 766         }
 767         return (ke);
 768 }
 769
 770 static struct pfr_kentry *
 771 pfr_create_kentry(struct pfr_addr *ad)
 772 {
 773         struct pfr_kentry       *ke;
 774
 775         ke =  uma_zalloc(V_pfr_kentry_z, M_NOWAIT | M_ZERO);
 776         if (ke == NULL)
 777                 return (NULL);
 778
 779         if (ad->pfra_af == AF_INET)
 780                 FILLIN_SIN(ke->pfrke_sa.sin, ad->pfra_ip4addr);
 781         else if (ad->pfra_af == AF_INET6)
 782                 FILLIN_SIN6(ke->pfrke_sa.sin6, ad->pfra_ip6addr);
 783         ke->pfrke_af = ad->pfra_af;
 784         ke->pfrke_net = ad->pfra_net;
 785         ke->pfrke_not = ad->pfra_not;
 786         return (ke);
 787 }
 788
 789 static void
 790 pfr_destroy_kentries(struct pfr_kentryworkq *workq)
 791 {
 792         struct pfr_kentry       *p, *q;
 793
 794         for (p = SLIST_FIRST(workq); p != NULL; p = q) {
 795                 q = SLIST_NEXT(p, pfrke_workq);
 796                 pfr_destroy_kentry(p);
 797         }
 798 }
 799
 800 static void
 801 pfr_destroy_kentry(struct pfr_kentry *ke)
 802 {
 803         if (ke->pfrke_counters)
 804                 uma_zfree(V_pfr_kcounters_z, ke->pfrke_counters);
 805         uma_zfree(V_pfr_kentry_z, ke);
 806 }
 807
 808 static void
 809 pfr_insert_kentries(struct pfr_ktable *kt,
 810     struct pfr_kentryworkq *workq, long tzero)
 811 {
 812         struct pfr_kentry       *p;
 813         int                      rv, n = 0;
 814
 815         SLIST_FOREACH(p, workq, pfrke_workq) {
 816                 rv = pfr_route_kentry(kt, p);
 817                 if (rv) {
 818                         printf("pfr_insert_kentries: cannot route entry "
 819                             "(code=%d).\n", rv);
 820                         break;
 821                 }
 822                 p->pfrke_tzero = tzero;
 823                 n++;
 824         }
 825         kt->pfrkt_cnt += n;
 826 }
 827
 828 int
 829 pfr_insert_kentry(struct pfr_ktable *kt, struct pfr_addr *ad, long tzero)
 830 {
 831         struct pfr_kentry       *p;
 832         int                      rv;
 833
 834         p = pfr_lookup_addr(kt, ad, 1);
 835         if (p != NULL)
 836                 return (0);
 837         p = pfr_create_kentry(ad);
 838         if (p == NULL)
 839                 return (ENOMEM);
 840
 841         rv = pfr_route_kentry(kt, p);
 842         if (rv)
 843                 return (rv);
 844
 845         p->pfrke_tzero = tzero;
 846         kt->pfrkt_cnt++;
 847
 848         return (0);
 849 }
 850
 851 static void
 852 pfr_remove_kentries(struct pfr_ktable *kt,
 853     struct pfr_kentryworkq *workq)
 854 {
 855         struct pfr_kentry       *p;
 856         int                      n = 0;
 857
 858         SLIST_FOREACH(p, workq, pfrke_workq) {
 859                 pfr_unroute_kentry(kt, p);
 860                 n++;
 861         }
 862         kt->pfrkt_cnt -= n;
 863         pfr_destroy_kentries(workq);
 864 }
 865
 866 static void
 867 pfr_clean_node_mask(struct pfr_ktable *kt,
 868     struct pfr_kentryworkq *workq)
 869 {
 870         struct pfr_kentry       *p;
 871
 872         SLIST_FOREACH(p, workq, pfrke_workq)
 873                 pfr_unroute_kentry(kt, p);
 874 }
 875
 876 static void
 877 pfr_clstats_kentries(struct pfr_kentryworkq *workq, long tzero, int negchange)
 878 {
 879         struct pfr_kentry       *p;
 880
 881         SLIST_FOREACH(p, workq, pfrke_workq) {
 882                 if (negchange)
 883                         p->pfrke_not = !p->pfrke_not;
 884                 if (p->pfrke_counters) {
 885                         uma_zfree(V_pfr_kcounters_z, p->pfrke_counters);
 886                         p->pfrke_counters = NULL;
 887                 }
 888                 p->pfrke_tzero = tzero;
 889         }
 890 }
 891
 892 static void
 893 pfr_reset_feedback(struct pfr_addr *addr, int size)
 894 {
 895         struct pfr_addr *ad;
 896         int             i;
 897
 898         for (i = 0, ad = addr; i < size; i++, ad++)
 899                 ad->pfra_fback = PFR_FB_NONE;
 900 }
 901
 902 static void
 903 pfr_prepare_network(union sockaddr_union *sa, int af, int net)
 904 {
 905         int     i;
 906
 907         bzero(sa, sizeof(*sa));
 908         if (af == AF_INET) {
 909                 sa->sin.sin_len = sizeof(sa->sin);
 910                 sa->sin.sin_family = AF_INET;
 911                 sa->sin.sin_addr.s_addr = net ? htonl(-1 << (32-net)) : 0;
 912         } else if (af == AF_INET6) {
 913                 sa->sin6.sin6_len = sizeof(sa->sin6);
 914                 sa->sin6.sin6_family = AF_INET6;
 915                 for (i = 0; i < 4; i++) {
 916                         if (net <= 32) {
 917                                 sa->sin6.sin6_addr.s6_addr32[i] =
 918                                     net ? htonl(-1 << (32-net)) : 0;
 919                                 break;
 920                         }
 921                         sa->sin6.sin6_addr.s6_addr32[i] = 0xFFFFFFFF;
 922                         net -= 32;
 923                 }
 924         }
 925 }
 926
 927 static int
 928 pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
 929 {
 930         union sockaddr_union     mask;
 931         struct radix_node       *rn;
 932         struct radix_head       *head = NULL;
 933
 934         PF_RULES_WASSERT();
 935
 936         bzero(ke->pfrke_node, sizeof(ke->pfrke_node));
 937         if (ke->pfrke_af == AF_INET)
 938                 head = &kt->pfrkt_ip4->rh;
 939         else if (ke->pfrke_af == AF_INET6)
 940                 head = &kt->pfrkt_ip6->rh;
 941
 942         if (KENTRY_NETWORK(ke)) {
 943                 pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
 944                 rn = rn_addroute(&ke->pfrke_sa, &mask, head, ke->pfrke_node);
 945         } else
 946                 rn = rn_addroute(&ke->pfrke_sa, NULL, head, ke->pfrke_node);
 947
 948         return (rn == NULL ? -1 : 0);
 949 }
 950
 951 static int
 952 pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
 953 {
 954         union sockaddr_union     mask;
 955         struct radix_node       *rn;
 956         struct radix_head       *head = NULL;
 957
 958         if (ke->pfrke_af == AF_INET)
 959                 head = &kt->pfrkt_ip4->rh;
 960         else if (ke->pfrke_af == AF_INET6)
 961                 head = &kt->pfrkt_ip6->rh;
 962
 963         if (KENTRY_NETWORK(ke)) {
 964                 pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
 965                 rn = rn_delete(&ke->pfrke_sa, &mask, head);
 966         } else
 967                 rn = rn_delete(&ke->pfrke_sa, NULL, head);
 968
 969         if (rn == NULL) {
 970                 printf("pfr_unroute_kentry: delete failed.\n");
 971                 return (-1);
 972         }
 973         return (0);
 974 }
 975
 976 static void
 977 pfr_copyout_addr(struct pfr_addr *ad, struct pfr_kentry *ke)
 978 {
 979         bzero(ad, sizeof(*ad));
 980         if (ke == NULL)
 981                 return;
 982         ad->pfra_af = ke->pfrke_af;
 983         ad->pfra_net = ke->pfrke_net;
 984         ad->pfra_not = ke->pfrke_not;
 985         if (ad->pfra_af == AF_INET)
 986                 ad->pfra_ip4addr = ke->pfrke_sa.sin.sin_addr;
 987         else if (ad->pfra_af == AF_INET6)
 988                 ad->pfra_ip6addr = ke->pfrke_sa.sin6.sin6_addr;
 989 }
 990
 991 static int
 992 pfr_walktree(struct radix_node *rn, void *arg)
 993 {
 994         struct pfr_kentry       *ke = (struct pfr_kentry *)rn;
 995         struct pfr_walktree     *w = arg;
 996
 997         switch (w->pfrw_op) {
 998         case PFRW_MARK:
 999                 ke->pfrke_mark = 0;
1000                 break;
1001         case PFRW_SWEEP:
1002                 if (ke->pfrke_mark)
1003                         break;
1004                 /* FALLTHROUGH */
1005         case PFRW_ENQUEUE:
1006                 SLIST_INSERT_HEAD(w->pfrw_workq, ke, pfrke_workq);
1007                 w->pfrw_cnt++;
1008                 break;
1009         case PFRW_GET_ADDRS:
1010                 if (w->pfrw_free-- > 0) {
1011                         pfr_copyout_addr(w->pfrw_addr, ke);
1012                         w->pfrw_addr++;
1013                 }
1014                 break;
1015         case PFRW_GET_ASTATS:
1016                 if (w->pfrw_free-- > 0) {
1017                         struct pfr_astats as;
1018
1019                         pfr_copyout_addr(&as.pfras_a, ke);
1020
1021                         if (ke->pfrke_counters) {
1022                                 bcopy(ke->pfrke_counters->pfrkc_packets,
1023                                     as.pfras_packets, sizeof(as.pfras_packets));
1024                                 bcopy(ke->pfrke_counters->pfrkc_bytes,
1025                                     as.pfras_bytes, sizeof(as.pfras_bytes));
1026                         } else {
1027                                 bzero(as.pfras_packets, sizeof(as.pfras_packets));
1028                                 bzero(as.pfras_bytes, sizeof(as.pfras_bytes));
1029                                 as.pfras_a.pfra_fback = PFR_FB_NOCOUNT;
1030                         }
1031                         as.pfras_tzero = ke->pfrke_tzero;
1032
1033                         bcopy(&as, w->pfrw_astats, sizeof(as));
1034                         w->pfrw_astats++;
1035                 }
1036                 break;
1037         case PFRW_POOL_GET:
1038                 if (ke->pfrke_not)
1039                         break; /* negative entries are ignored */
1040                 if (!w->pfrw_cnt--) {
1041                         w->pfrw_kentry = ke;
1042                         return (1); /* finish search */
1043                 }
1044                 break;
1045         case PFRW_DYNADDR_UPDATE:
1046             {
1047                 union sockaddr_union    pfr_mask;
1048
1049                 if (ke->pfrke_af == AF_INET) {
1050                         if (w->pfrw_dyn->pfid_acnt4++ > 0)
1051                                 break;
1052                         pfr_prepare_network(&pfr_mask, AF_INET, ke->pfrke_net);
1053                         w->pfrw_dyn->pfid_addr4 = *SUNION2PF(&ke->pfrke_sa,
1054                             AF_INET);
1055                         w->pfrw_dyn->pfid_mask4 = *SUNION2PF(&pfr_mask,
1056                             AF_INET);
1057                 } else if (ke->pfrke_af == AF_INET6){
1058                         if (w->pfrw_dyn->pfid_acnt6++ > 0)
1059                                 break;
1060                         pfr_prepare_network(&pfr_mask, AF_INET6, ke->pfrke_net);
1061                         w->pfrw_dyn->pfid_addr6 = *SUNION2PF(&ke->pfrke_sa,
1062                             AF_INET6);
1063                         w->pfrw_dyn->pfid_mask6 = *SUNION2PF(&pfr_mask,
1064                             AF_INET6);
1065                 }
1066                 break;
1067             }
1068         }
1069         return (0);
1070 }
1071
1072 int
1073 pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags)
1074 {
1075         struct pfr_ktableworkq   workq;
1076         struct pfr_ktable       *p;
1077         int                      xdel = 0;
1078
1079         ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ALLRSETS);
1080         if (pfr_fix_anchor(filter->pfrt_anchor))
1081                 return (EINVAL);
1082         if (pfr_table_count(filter, flags) < 0)
1083                 return (ENOENT);
1084
1085         SLIST_INIT(&workq);
1086         RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1087                 if (pfr_skip_table(filter, p, flags))
1088                         continue;
1089                 if (!strcmp(p->pfrkt_anchor, PF_RESERVED_ANCHOR))
1090                         continue;
1091                 if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE))
1092                         continue;
1093                 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1094                 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1095                 xdel++;
1096         }
1097         if (!(flags & PFR_FLAG_DUMMY))
1098                 pfr_setflags_ktables(&workq);
1099         if (ndel != NULL)
1100                 *ndel = xdel;
1101         return (0);
1102 }
1103
1104 int
1105 pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags)
1106 {
1107         struct pfr_ktableworkq   addq, changeq;
1108         struct pfr_ktable       *p, *q, *r, key;
1109         int                      i, rv, xadd = 0;
1110         long                     tzero = time_second;
1111
1112         ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1113         SLIST_INIT(&addq);
1114         SLIST_INIT(&changeq);
1115         for (i = 0; i < size; i++) {
1116                 bcopy(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t));
1117                 if (pfr_validate_table(&key.pfrkt_t, PFR_TFLAG_USRMASK,
1118                     flags & PFR_FLAG_USERIOCTL))
1119                         senderr(EINVAL);
1120                 key.pfrkt_flags |= PFR_TFLAG_ACTIVE;
1121                 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1122                 if (p == NULL) {
1123                         p = pfr_create_ktable(&key.pfrkt_t, tzero, 1);
1124                         if (p == NULL)
1125                                 senderr(ENOMEM);
1126                         SLIST_FOREACH(q, &addq, pfrkt_workq) {
1127                                 if (!pfr_ktable_compare(p, q))
1128                                         goto _skip;
1129                         }
1130                         SLIST_INSERT_HEAD(&addq, p, pfrkt_workq);
1131                         xadd++;
1132                         if (!key.pfrkt_anchor[0])
1133                                 goto _skip;
1134
1135                         /* find or create root table */
1136                         bzero(key.pfrkt_anchor, sizeof(key.pfrkt_anchor));
1137                         r = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1138                         if (r != NULL) {
1139                                 p->pfrkt_root = r;
1140                                 goto _skip;
1141                         }
1142                         SLIST_FOREACH(q, &addq, pfrkt_workq) {
1143                                 if (!pfr_ktable_compare(&key, q)) {
1144                                         p->pfrkt_root = q;
1145                                         goto _skip;
1146                                 }
1147                         }
1148                         key.pfrkt_flags = 0;
1149                         r = pfr_create_ktable(&key.pfrkt_t, 0, 1);
1150                         if (r == NULL)
1151                                 senderr(ENOMEM);
1152                         SLIST_INSERT_HEAD(&addq, r, pfrkt_workq);
1153                         p->pfrkt_root = r;
1154                 } else if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1155                         SLIST_FOREACH(q, &changeq, pfrkt_workq)
1156                                 if (!pfr_ktable_compare(&key, q))
1157                                         goto _skip;
1158                         p->pfrkt_nflags = (p->pfrkt_flags &
1159                             ~PFR_TFLAG_USRMASK) | key.pfrkt_flags;
1160                         SLIST_INSERT_HEAD(&changeq, p, pfrkt_workq);
1161                         xadd++;
1162                 }
1163 _skip:
1164         ;
1165         }
1166         if (!(flags & PFR_FLAG_DUMMY)) {
1167                 pfr_insert_ktables(&addq);
1168                 pfr_setflags_ktables(&changeq);
1169         } else
1170                  pfr_destroy_ktables(&addq, 0);
1171         if (nadd != NULL)
1172                 *nadd = xadd;
1173         return (0);
1174 _bad:
1175         pfr_destroy_ktables(&addq, 0);
1176         return (rv);
1177 }
1178
1179 int
1180 pfr_del_tables(struct pfr_table *tbl, int size, int *ndel, int flags)
1181 {
1182         struct pfr_ktableworkq   workq;
1183         struct pfr_ktable       *p, *q, key;
1184         int                      i, xdel = 0;
1185
1186         ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1187         SLIST_INIT(&workq);
1188         for (i = 0; i < size; i++) {
1189                 bcopy(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t));
1190                 if (pfr_validate_table(&key.pfrkt_t, 0,
1191                     flags & PFR_FLAG_USERIOCTL))
1192                         return (EINVAL);
1193                 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1194                 if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1195                         SLIST_FOREACH(q, &workq, pfrkt_workq)
1196                                 if (!pfr_ktable_compare(p, q))
1197                                         goto _skip;
1198                         p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1199                         SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1200                         xdel++;
1201                 }
1202 _skip:
1203         ;
1204         }
1205
1206         if (!(flags & PFR_FLAG_DUMMY))
1207                 pfr_setflags_ktables(&workq);
1208         if (ndel != NULL)
1209                 *ndel = xdel;
1210         return (0);
1211 }
1212
1213 int
1214 pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size,
1215         int flags)
1216 {
1217         struct pfr_ktable       *p;
1218         int                      n, nn;
1219
1220         PF_RULES_RASSERT();
1221
1222         ACCEPT_FLAGS(flags, PFR_FLAG_ALLRSETS);
1223         if (pfr_fix_anchor(filter->pfrt_anchor))
1224                 return (EINVAL);
1225         n = nn = pfr_table_count(filter, flags);
1226         if (n < 0)
1227                 return (ENOENT);
1228         if (n > *size) {
1229                 *size = n;
1230                 return (0);
1231         }
1232         RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1233                 if (pfr_skip_table(filter, p, flags))
1234                         continue;
1235                 if (n-- <= 0)
1236                         continue;
1237                 bcopy(&p->pfrkt_t, tbl++, sizeof(*tbl));
1238         }
1239
1240         KASSERT(n == 0, ("%s: corruption detected (%d)", __func__, n));
1241
1242         *size = nn;
1243         return (0);
1244 }
1245
1246 int
1247 pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size,
1248         int flags)
1249 {
1250         struct pfr_ktable       *p;
1251         struct pfr_ktableworkq   workq;
1252         int                      n, nn;
1253         long                     tzero = time_second;
1254
1255         /* XXX PFR_FLAG_CLSTATS disabled */
1256         ACCEPT_FLAGS(flags, PFR_FLAG_ALLRSETS);
1257         if (pfr_fix_anchor(filter->pfrt_anchor))
1258                 return (EINVAL);
1259         n = nn = pfr_table_count(filter, flags);
1260         if (n < 0)
1261                 return (ENOENT);
1262         if (n > *size) {
1263                 *size = n;
1264                 return (0);
1265         }
1266         SLIST_INIT(&workq);
1267         RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1268                 if (pfr_skip_table(filter, p, flags))
1269                         continue;
1270                 if (n-- <= 0)
1271                         continue;
1272                 bcopy(&p->pfrkt_ts, tbl++, sizeof(*tbl));
1273                 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1274         }
1275         if (flags & PFR_FLAG_CLSTATS)
1276                 pfr_clstats_ktables(&workq, tzero,
1277                     flags & PFR_FLAG_ADDRSTOO);
1278
1279         KASSERT(n == 0, ("%s: corruption detected (%d)", __func__, n));
1280
1281         *size = nn;
1282         return (0);
1283 }
1284
1285 int
1286 pfr_clr_tstats(struct pfr_table *tbl, int size, int *nzero, int flags)
1287 {
1288         struct pfr_ktableworkq   workq;
1289         struct pfr_ktable       *p, key;
1290         int                      i, xzero = 0;
1291         long                     tzero = time_second;
1292
1293         ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ADDRSTOO);
1294         SLIST_INIT(&workq);
1295         for (i = 0; i < size; i++) {
1296                 bcopy(tbl + i, &key.pfrkt_t, sizeof(key.pfrkt_t));
1297                 if (pfr_validate_table(&key.pfrkt_t, 0, 0))
1298                         return (EINVAL);
1299                 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1300                 if (p != NULL) {
1301                         SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1302                         xzero++;
1303                 }
1304         }
1305         if (!(flags & PFR_FLAG_DUMMY))
1306                 pfr_clstats_ktables(&workq, tzero, flags & PFR_FLAG_ADDRSTOO);
1307         if (nzero != NULL)
1308                 *nzero = xzero;
1309         return (0);
1310 }
1311
1312 int
1313 pfr_set_tflags(struct pfr_table *tbl, int size, int setflag, int clrflag,
1314         int *nchange, int *ndel, int flags)
1315 {
1316         struct pfr_ktableworkq   workq;
1317         struct pfr_ktable       *p, *q, key;
1318         int                      i, xchange = 0, xdel = 0;
1319
1320         ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1321         if ((setflag & ~PFR_TFLAG_USRMASK) ||
1322             (clrflag & ~PFR_TFLAG_USRMASK) ||
1323             (setflag & clrflag))
1324                 return (EINVAL);
1325         SLIST_INIT(&workq);
1326         for (i = 0; i < size; i++) {
1327                 bcopy(tbl + i, &key.pfrkt_t, sizeof(key.pfrkt_t));
1328                 if (pfr_validate_table(&key.pfrkt_t, 0,
1329                     flags & PFR_FLAG_USERIOCTL))
1330                         return (EINVAL);
1331                 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1332                 if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1333                         p->pfrkt_nflags = (p->pfrkt_flags | setflag) &
1334                             ~clrflag;
1335                         if (p->pfrkt_nflags == p->pfrkt_flags)
1336                                 goto _skip;
1337                         SLIST_FOREACH(q, &workq, pfrkt_workq)
1338                                 if (!pfr_ktable_compare(p, q))
1339                                         goto _skip;
1340                         SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1341                         if ((p->pfrkt_flags & PFR_TFLAG_PERSIST) &&
1342                             (clrflag & PFR_TFLAG_PERSIST) &&
1343                             !(p->pfrkt_flags & PFR_TFLAG_REFERENCED))
1344                                 xdel++;
1345                         else
1346                                 xchange++;
1347                 }
1348 _skip:
1349         ;
1350         }
1351         if (!(flags & PFR_FLAG_DUMMY))
1352                 pfr_setflags_ktables(&workq);
1353         if (nchange != NULL)
1354                 *nchange = xchange;
1355         if (ndel != NULL)
1356                 *ndel = xdel;
1357         return (0);
1358 }
1359
1360 int
1361 pfr_ina_begin(struct pfr_table *trs, u_int32_t *ticket, int *ndel, int flags)
1362 {
1363         struct pfr_ktableworkq   workq;
1364         struct pfr_ktable       *p;
1365         struct pf_ruleset       *rs;
1366         int                      xdel = 0;
1367
1368         ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1369         rs = pf_find_or_create_ruleset(trs->pfrt_anchor);
1370         if (rs == NULL)
1371                 return (ENOMEM);
1372         SLIST_INIT(&workq);
1373         RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1374                 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1375                     pfr_skip_table(trs, p, 0))
1376                         continue;
1377                 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1378                 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1379                 xdel++;
1380         }
1381         if (!(flags & PFR_FLAG_DUMMY)) {
1382                 pfr_setflags_ktables(&workq);
1383                 if (ticket != NULL)
1384                         *ticket = ++rs->tticket;
1385                 rs->topen = 1;
1386         } else
1387                 pf_remove_if_empty_ruleset(rs);
1388         if (ndel != NULL)
1389                 *ndel = xdel;
1390         return (0);
1391 }
1392
1393 int
1394 pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size,
1395     int *nadd, int *naddr, u_int32_t ticket, int flags)
1396 {
1397         struct pfr_ktableworkq   tableq;
1398         struct pfr_kentryworkq   addrq;
1399         struct pfr_ktable       *kt, *rt, *shadow, key;
1400         struct pfr_kentry       *p;
1401         struct pfr_addr         *ad;
1402         struct pf_ruleset       *rs;
1403         int                      i, rv, xadd = 0, xaddr = 0;
1404
1405         PF_RULES_WASSERT();
1406
1407         ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ADDRSTOO);
1408         if (size && !(flags & PFR_FLAG_ADDRSTOO))
1409                 return (EINVAL);
1410         if (pfr_validate_table(tbl, PFR_TFLAG_USRMASK,
1411             flags & PFR_FLAG_USERIOCTL))
1412                 return (EINVAL);
1413         rs = pf_find_ruleset(tbl->pfrt_anchor);
1414         if (rs == NULL || !rs->topen || ticket != rs->tticket)
1415                 return (EBUSY);
1416         tbl->pfrt_flags |= PFR_TFLAG_INACTIVE;
1417         SLIST_INIT(&tableq);
1418         kt = RB_FIND(pfr_ktablehead, &pfr_ktables, (struct pfr_ktable *)tbl);
1419         if (kt == NULL) {
1420                 kt = pfr_create_ktable(tbl, 0, 1);
1421                 if (kt == NULL)
1422                         return (ENOMEM);
1423                 SLIST_INSERT_HEAD(&tableq, kt, pfrkt_workq);
1424                 xadd++;
1425                 if (!tbl->pfrt_anchor[0])
1426                         goto _skip;
1427
1428                 /* find or create root table */
1429                 bzero(&key, sizeof(key));
1430                 strlcpy(key.pfrkt_name, tbl->pfrt_name, sizeof(key.pfrkt_name));
1431                 rt = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1432                 if (rt != NULL) {
1433                         kt->pfrkt_root = rt;
1434                         goto _skip;
1435                 }
1436                 rt = pfr_create_ktable(&key.pfrkt_t, 0, 1);
1437                 if (rt == NULL) {
1438                         pfr_destroy_ktables(&tableq, 0);
1439                         return (ENOMEM);
1440                 }
1441                 SLIST_INSERT_HEAD(&tableq, rt, pfrkt_workq);
1442                 kt->pfrkt_root = rt;
1443         } else if (!(kt->pfrkt_flags & PFR_TFLAG_INACTIVE))
1444                 xadd++;
1445 _skip:
1446         shadow = pfr_create_ktable(tbl, 0, 0);
1447         if (shadow == NULL) {
1448                 pfr_destroy_ktables(&tableq, 0);
1449                 return (ENOMEM);
1450         }
1451         SLIST_INIT(&addrq);
1452         for (i = 0, ad = addr; i < size; i++, ad++) {
1453                 if (pfr_validate_addr(ad))
1454                         senderr(EINVAL);
1455                 if (pfr_lookup_addr(shadow, ad, 1) != NULL)
1456                         continue;
1457                 p = pfr_create_kentry(ad);
1458                 if (p == NULL)
1459                         senderr(ENOMEM);
1460                 if (pfr_route_kentry(shadow, p)) {
1461                         pfr_destroy_kentry(p);
1462                         continue;
1463                 }
1464                 SLIST_INSERT_HEAD(&addrq, p, pfrke_workq);
1465                 xaddr++;
1466         }
1467         if (!(flags & PFR_FLAG_DUMMY)) {
1468                 if (kt->pfrkt_shadow != NULL)
1469                         pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1470                 kt->pfrkt_flags |= PFR_TFLAG_INACTIVE;
1471                 pfr_insert_ktables(&tableq);
1472                 shadow->pfrkt_cnt = (flags & PFR_FLAG_ADDRSTOO) ?
1473                     xaddr : NO_ADDRESSES;
1474                 kt->pfrkt_shadow = shadow;
1475         } else {
1476                 pfr_clean_node_mask(shadow, &addrq);
1477                 pfr_destroy_ktable(shadow, 0);
1478                 pfr_destroy_ktables(&tableq, 0);
1479                 pfr_destroy_kentries(&addrq);
1480         }
1481         if (nadd != NULL)
1482                 *nadd = xadd;
1483         if (naddr != NULL)
1484                 *naddr = xaddr;
1485         return (0);
1486 _bad:
1487         pfr_destroy_ktable(shadow, 0);
1488         pfr_destroy_ktables(&tableq, 0);
1489         pfr_destroy_kentries(&addrq);
1490         return (rv);
1491 }
1492
1493 int
1494 pfr_ina_rollback(struct pfr_table *trs, u_int32_t ticket, int *ndel, int flags)
1495 {
1496         struct pfr_ktableworkq   workq;
1497         struct pfr_ktable       *p;
1498         struct pf_ruleset       *rs;
1499         int                      xdel = 0;
1500
1501         PF_RULES_WASSERT();
1502
1503         ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1504         rs = pf_find_ruleset(trs->pfrt_anchor);
1505         if (rs == NULL || !rs->topen || ticket != rs->tticket)
1506                 return (0);
1507         SLIST_INIT(&workq);
1508         RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1509                 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1510                     pfr_skip_table(trs, p, 0))
1511                         continue;
1512                 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1513                 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1514                 xdel++;
1515         }
1516         if (!(flags & PFR_FLAG_DUMMY)) {
1517                 pfr_setflags_ktables(&workq);
1518                 rs->topen = 0;
1519                 pf_remove_if_empty_ruleset(rs);
1520         }
1521         if (ndel != NULL)
1522                 *ndel = xdel;
1523         return (0);
1524 }
1525
1526 int
1527 pfr_ina_commit(struct pfr_table *trs, u_int32_t ticket, int *nadd,
1528     int *nchange, int flags)
1529 {
1530         struct pfr_ktable       *p, *q;
1531         struct pfr_ktableworkq   workq;
1532         struct pf_ruleset       *rs;
1533         int                      xadd = 0, xchange = 0;
1534         long                     tzero = time_second;
1535
1536         PF_RULES_WASSERT();
1537
1538         ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1539         rs = pf_find_ruleset(trs->pfrt_anchor);
1540         if (rs == NULL || !rs->topen || ticket != rs->tticket)
1541                 return (EBUSY);
1542
1543         SLIST_INIT(&workq);
1544         RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1545                 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1546                     pfr_skip_table(trs, p, 0))
1547                         continue;
1548                 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1549                 if (p->pfrkt_flags & PFR_TFLAG_ACTIVE)
1550                         xchange++;
1551                 else
1552                         xadd++;
1553         }
1554
1555         if (!(flags & PFR_FLAG_DUMMY)) {
1556                 for (p = SLIST_FIRST(&workq); p != NULL; p = q) {
1557                         q = SLIST_NEXT(p, pfrkt_workq);
1558                         pfr_commit_ktable(p, tzero);
1559                 }
1560                 rs->topen = 0;
1561                 pf_remove_if_empty_ruleset(rs);
1562         }
1563         if (nadd != NULL)
1564                 *nadd = xadd;
1565         if (nchange != NULL)
1566                 *nchange = xchange;
1567
1568         return (0);
1569 }
1570
1571 static void
1572 pfr_commit_ktable(struct pfr_ktable *kt, long tzero)
1573 {
1574         struct pfr_ktable       *shadow = kt->pfrkt_shadow;
1575         int                      nflags;
1576
1577         PF_RULES_WASSERT();
1578
1579         if (shadow->pfrkt_cnt == NO_ADDRESSES) {
1580                 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1581                         pfr_clstats_ktable(kt, tzero, 1);
1582         } else if (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) {
1583                 /* kt might contain addresses */
1584                 struct pfr_kentryworkq   addrq, addq, changeq, delq, garbageq;
1585                 struct pfr_kentry       *p, *q, *next;
1586                 struct pfr_addr          ad;
1587
1588                 pfr_enqueue_addrs(shadow, &addrq, NULL, 0);
1589                 pfr_mark_addrs(kt);
1590                 SLIST_INIT(&addq);
1591                 SLIST_INIT(&changeq);
1592                 SLIST_INIT(&delq);
1593                 SLIST_INIT(&garbageq);
1594                 pfr_clean_node_mask(shadow, &addrq);
1595                 for (p = SLIST_FIRST(&addrq); p != NULL; p = next) {
1596                         next = SLIST_NEXT(p, pfrke_workq);      /* XXX */
1597                         pfr_copyout_addr(&ad, p);
1598                         q = pfr_lookup_addr(kt, &ad, 1);
1599                         if (q != NULL) {
1600                                 if (q->pfrke_not != p->pfrke_not)
1601                                         SLIST_INSERT_HEAD(&changeq, q,
1602                                             pfrke_workq);
1603                                 q->pfrke_mark = 1;
1604                                 SLIST_INSERT_HEAD(&garbageq, p, pfrke_workq);
1605                         } else {
1606                                 p->pfrke_tzero = tzero;
1607                                 SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
1608                         }
1609                 }
1610                 pfr_enqueue_addrs(kt, &delq, NULL, ENQUEUE_UNMARKED_ONLY);
1611                 pfr_insert_kentries(kt, &addq, tzero);
1612                 pfr_remove_kentries(kt, &delq);
1613                 pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
1614                 pfr_destroy_kentries(&garbageq);
1615         } else {
1616                 /* kt cannot contain addresses */
1617                 SWAP(struct radix_node_head *, kt->pfrkt_ip4,
1618                     shadow->pfrkt_ip4);
1619                 SWAP(struct radix_node_head *, kt->pfrkt_ip6,
1620                     shadow->pfrkt_ip6);
1621                 SWAP(int, kt->pfrkt_cnt, shadow->pfrkt_cnt);
1622                 pfr_clstats_ktable(kt, tzero, 1);
1623         }
1624         nflags = ((shadow->pfrkt_flags & PFR_TFLAG_USRMASK) |
1625             (kt->pfrkt_flags & PFR_TFLAG_SETMASK) | PFR_TFLAG_ACTIVE)
1626                 & ~PFR_TFLAG_INACTIVE;
1627         pfr_destroy_ktable(shadow, 0);
1628         kt->pfrkt_shadow = NULL;
1629         pfr_setflags_ktable(kt, nflags);
1630 }
1631
1632 static int
1633 pfr_validate_table(struct pfr_table *tbl, int allowedflags, int no_reserved)
1634 {
1635         int i;
1636
1637         if (!tbl->pfrt_name[0])
1638                 return (-1);
1639         if (no_reserved && !strcmp(tbl->pfrt_anchor, PF_RESERVED_ANCHOR))
1640                  return (-1);
1641         if (tbl->pfrt_name[PF_TABLE_NAME_SIZE-1])
1642                 return (-1);
1643         for (i = strlen(tbl->pfrt_name); i < PF_TABLE_NAME_SIZE; i++)
1644                 if (tbl->pfrt_name[i])
1645                         return (-1);
1646         if (pfr_fix_anchor(tbl->pfrt_anchor))
1647                 return (-1);
1648         if (tbl->pfrt_flags & ~allowedflags)
1649                 return (-1);
1650         return (0);
1651 }
1652
1653 /*
1654  * Rewrite anchors referenced by tables to remove slashes
1655  * and check for validity.
1656  */
1657 static int
1658 pfr_fix_anchor(char *anchor)
1659 {
1660         size_t siz = MAXPATHLEN;
1661         int i;
1662
1663         if (anchor[0] == '/') {
1664                 char *path;
1665                 int off;
1666
1667                 path = anchor;
1668                 off = 1;
1669                 while (*++path == '/')
1670                         off++;
1671                 bcopy(path, anchor, siz - off);
1672                 memset(anchor + siz - off, 0, off);
1673         }
1674         if (anchor[siz - 1])
1675                 return (-1);
1676         for (i = strlen(anchor); i < siz; i++)
1677                 if (anchor[i])
1678                         return (-1);
1679         return (0);
1680 }
1681
1682 static int
1683 pfr_table_count(struct pfr_table *filter, int flags)
1684 {
1685         struct pf_ruleset *rs;
1686
1687         PF_RULES_ASSERT();
1688
1689         if (flags & PFR_FLAG_ALLRSETS)
1690                 return (pfr_ktable_cnt);
1691         if (filter->pfrt_anchor[0]) {
1692                 rs = pf_find_ruleset(filter->pfrt_anchor);
1693                 return ((rs != NULL) ? rs->tables : -1);
1694         }
1695         return (pf_main_ruleset.tables);
1696 }
1697
1698 static int
1699 pfr_skip_table(struct pfr_table *filter, struct pfr_ktable *kt, int flags)
1700 {
1701         if (flags & PFR_FLAG_ALLRSETS)
1702                 return (0);
1703         if (strcmp(filter->pfrt_anchor, kt->pfrkt_anchor))
1704                 return (1);
1705         return (0);
1706 }
1707
1708 static void
1709 pfr_insert_ktables(struct pfr_ktableworkq *workq)
1710 {
1711         struct pfr_ktable       *p;
1712
1713         SLIST_FOREACH(p, workq, pfrkt_workq)
1714                 pfr_insert_ktable(p);
1715 }
1716
1717 static void
1718 pfr_insert_ktable(struct pfr_ktable *kt)
1719 {
1720
1721         PF_RULES_WASSERT();
1722
1723         RB_INSERT(pfr_ktablehead, &pfr_ktables, kt);
1724         pfr_ktable_cnt++;
1725         if (kt->pfrkt_root != NULL)
1726                 if (!kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]++)
1727                         pfr_setflags_ktable(kt->pfrkt_root,
1728                             kt->pfrkt_root->pfrkt_flags|PFR_TFLAG_REFDANCHOR);
1729 }
1730
1731 static void
1732 pfr_setflags_ktables(struct pfr_ktableworkq *workq)
1733 {
1734         struct pfr_ktable       *p, *q;
1735
1736         for (p = SLIST_FIRST(workq); p; p = q) {
1737                 q = SLIST_NEXT(p, pfrkt_workq);
1738                 pfr_setflags_ktable(p, p->pfrkt_nflags);
1739         }
1740 }
1741
1742 static void
1743 pfr_setflags_ktable(struct pfr_ktable *kt, int newf)
1744 {
1745         struct pfr_kentryworkq  addrq;
1746
1747         PF_RULES_WASSERT();
1748
1749         if (!(newf & PFR_TFLAG_REFERENCED) &&
1750             !(newf & PFR_TFLAG_PERSIST))
1751                 newf &= ~PFR_TFLAG_ACTIVE;
1752         if (!(newf & PFR_TFLAG_ACTIVE))
1753                 newf &= ~PFR_TFLAG_USRMASK;
1754         if (!(newf & PFR_TFLAG_SETMASK)) {
1755                 RB_REMOVE(pfr_ktablehead, &pfr_ktables, kt);
1756                 if (kt->pfrkt_root != NULL)
1757                         if (!--kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR])
1758                                 pfr_setflags_ktable(kt->pfrkt_root,
1759                                     kt->pfrkt_root->pfrkt_flags &
1760                                         ~PFR_TFLAG_REFDANCHOR);
1761                 pfr_destroy_ktable(kt, 1);
1762                 pfr_ktable_cnt--;
1763                 return;
1764         }
1765         if (!(newf & PFR_TFLAG_ACTIVE) && kt->pfrkt_cnt) {
1766                 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1767                 pfr_remove_kentries(kt, &addrq);
1768         }
1769         if (!(newf & PFR_TFLAG_INACTIVE) && kt->pfrkt_shadow != NULL) {
1770                 pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1771                 kt->pfrkt_shadow = NULL;
1772         }
1773         kt->pfrkt_flags = newf;
1774 }
1775
1776 static void
1777 pfr_clstats_ktables(struct pfr_ktableworkq *workq, long tzero, int recurse)
1778 {
1779         struct pfr_ktable       *p;
1780
1781         SLIST_FOREACH(p, workq, pfrkt_workq)
1782                 pfr_clstats_ktable(p, tzero, recurse);
1783 }
1784
1785 static void
1786 pfr_clstats_ktable(struct pfr_ktable *kt, long tzero, int recurse)
1787 {
1788         struct pfr_kentryworkq   addrq;
1789
1790         if (recurse) {
1791                 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1792                 pfr_clstats_kentries(&addrq, tzero, 0);
1793         }
1794         bzero(kt->pfrkt_packets, sizeof(kt->pfrkt_packets));
1795         bzero(kt->pfrkt_bytes, sizeof(kt->pfrkt_bytes));
1796         kt->pfrkt_match = kt->pfrkt_nomatch = 0;
1797         kt->pfrkt_tzero = tzero;
1798 }
1799
1800 static struct pfr_ktable *
1801 pfr_create_ktable(struct pfr_table *tbl, long tzero, int attachruleset)
1802 {
1803         struct pfr_ktable       *kt;
1804         struct pf_ruleset       *rs;
1805
1806         PF_RULES_WASSERT();
1807
1808         kt = malloc(sizeof(*kt), M_PFTABLE, M_NOWAIT|M_ZERO);
1809         if (kt == NULL)
1810                 return (NULL);
1811         kt->pfrkt_t = *tbl;
1812
1813         if (attachruleset) {
1814                 rs = pf_find_or_create_ruleset(tbl->pfrt_anchor);
1815                 if (!rs) {
1816                         pfr_destroy_ktable(kt, 0);
1817                         return (NULL);
1818                 }
1819                 kt->pfrkt_rs = rs;
1820                 rs->tables++;
1821         }
1822
1823         if (!rn_inithead((void **)&kt->pfrkt_ip4,
1824             offsetof(struct sockaddr_in, sin_addr) * 8) ||
1825             !rn_inithead((void **)&kt->pfrkt_ip6,
1826             offsetof(struct sockaddr_in6, sin6_addr) * 8)) {
1827                 pfr_destroy_ktable(kt, 0);
1828                 return (NULL);
1829         }
1830         kt->pfrkt_tzero = tzero;
1831
1832         return (kt);
1833 }
1834
1835 static void
1836 pfr_destroy_ktables(struct pfr_ktableworkq *workq, int flushaddr)
1837 {
1838         struct pfr_ktable       *p, *q;
1839
1840         for (p = SLIST_FIRST(workq); p; p = q) {
1841                 q = SLIST_NEXT(p, pfrkt_workq);
1842                 pfr_destroy_ktable(p, flushaddr);
1843         }
1844 }
1845
1846 static void
1847 pfr_destroy_ktable(struct pfr_ktable *kt, int flushaddr)
1848 {
1849         struct pfr_kentryworkq   addrq;
1850
1851         if (flushaddr) {
1852                 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1853                 pfr_clean_node_mask(kt, &addrq);
1854                 pfr_destroy_kentries(&addrq);
1855         }
1856         if (kt->pfrkt_ip4 != NULL)
1857                 rn_detachhead((void **)&kt->pfrkt_ip4);
1858         if (kt->pfrkt_ip6 != NULL)
1859                 rn_detachhead((void **)&kt->pfrkt_ip6);
1860         if (kt->pfrkt_shadow != NULL)
1861                 pfr_destroy_ktable(kt->pfrkt_shadow, flushaddr);
1862         if (kt->pfrkt_rs != NULL) {
1863                 kt->pfrkt_rs->tables--;
1864                 pf_remove_if_empty_ruleset(kt->pfrkt_rs);
1865         }
1866         free(kt, M_PFTABLE);
1867 }
1868
1869 static int
1870 pfr_ktable_compare(struct pfr_ktable *p, struct pfr_ktable *q)
1871 {
1872         int d;
1873
1874         if ((d = strncmp(p->pfrkt_name, q->pfrkt_name, PF_TABLE_NAME_SIZE)))
1875                 return (d);
1876         return (strcmp(p->pfrkt_anchor, q->pfrkt_anchor));
1877 }
1878
1879 static struct pfr_ktable *
1880 pfr_lookup_table(struct pfr_table *tbl)
1881 {
1882         /* struct pfr_ktable start like a struct pfr_table */
1883         return (RB_FIND(pfr_ktablehead, &pfr_ktables,
1884             (struct pfr_ktable *)tbl));
1885 }
1886
1887 int
1888 pfr_match_addr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af)
1889 {
1890         struct pfr_kentry       *ke = NULL;
1891         int                      match;
1892
1893         PF_RULES_RASSERT();
1894
1895         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
1896                 kt = kt->pfrkt_root;
1897         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1898                 return (0);
1899
1900         switch (af) {
1901 #ifdef INET
1902         case AF_INET:
1903             {
1904                 struct sockaddr_in sin;
1905
1906                 bzero(&sin, sizeof(sin));
1907                 sin.sin_len = sizeof(sin);
1908                 sin.sin_family = AF_INET;
1909                 sin.sin_addr.s_addr = a->addr32[0];
1910                 ke = (struct pfr_kentry *)rn_match(&sin, &kt->pfrkt_ip4->rh);
1911                 if (ke && KENTRY_RNF_ROOT(ke))
1912                         ke = NULL;
1913                 break;
1914             }
1915 #endif /* INET */
1916 #ifdef INET6
1917         case AF_INET6:
1918             {
1919                 struct sockaddr_in6 sin6;
1920
1921                 bzero(&sin6, sizeof(sin6));
1922                 sin6.sin6_len = sizeof(sin6);
1923                 sin6.sin6_family = AF_INET6;
1924                 bcopy(a, &sin6.sin6_addr, sizeof(sin6.sin6_addr));
1925                 ke = (struct pfr_kentry *)rn_match(&sin6, &kt->pfrkt_ip6->rh);
1926                 if (ke && KENTRY_RNF_ROOT(ke))
1927                         ke = NULL;
1928                 break;
1929             }
1930 #endif /* INET6 */
1931         }
1932         match = (ke && !ke->pfrke_not);
1933         if (match)
1934                 kt->pfrkt_match++;
1935         else
1936                 kt->pfrkt_nomatch++;
1937         return (match);
1938 }
1939
1940 void
1941 pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af,
1942     u_int64_t len, int dir_out, int op_pass, int notrule)
1943 {
1944         struct pfr_kentry       *ke = NULL;
1945
1946         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
1947                 kt = kt->pfrkt_root;
1948         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1949                 return;
1950
1951         switch (af) {
1952 #ifdef INET
1953         case AF_INET:
1954             {
1955                 struct sockaddr_in sin;
1956
1957                 bzero(&sin, sizeof(sin));
1958                 sin.sin_len = sizeof(sin);
1959                 sin.sin_family = AF_INET;
1960                 sin.sin_addr.s_addr = a->addr32[0];
1961                 ke = (struct pfr_kentry *)rn_match(&sin, &kt->pfrkt_ip4->rh);
1962                 if (ke && KENTRY_RNF_ROOT(ke))
1963                         ke = NULL;
1964                 break;
1965             }
1966 #endif /* INET */
1967 #ifdef INET6
1968         case AF_INET6:
1969             {
1970                 struct sockaddr_in6 sin6;
1971
1972                 bzero(&sin6, sizeof(sin6));
1973                 sin6.sin6_len = sizeof(sin6);
1974                 sin6.sin6_family = AF_INET6;
1975                 bcopy(a, &sin6.sin6_addr, sizeof(sin6.sin6_addr));
1976                 ke = (struct pfr_kentry *)rn_match(&sin6, &kt->pfrkt_ip6->rh);
1977                 if (ke && KENTRY_RNF_ROOT(ke))
1978                         ke = NULL;
1979                 break;
1980             }
1981 #endif /* INET6 */
1982         default:
1983                 panic("%s: unknown address family %u", __func__, af);
1984         }
1985         if ((ke == NULL || ke->pfrke_not) != notrule) {
1986                 if (op_pass != PFR_OP_PASS)
1987                         printf("pfr_update_stats: assertion failed.\n");
1988                 op_pass = PFR_OP_XPASS;
1989         }
1990         kt->pfrkt_packets[dir_out][op_pass]++;
1991         kt->pfrkt_bytes[dir_out][op_pass] += len;
1992         if (ke != NULL && op_pass != PFR_OP_XPASS &&
1993             (kt->pfrkt_flags & PFR_TFLAG_COUNTERS)) {
1994                 if (ke->pfrke_counters == NULL)
1995                         ke->pfrke_counters = uma_zalloc(V_pfr_kcounters_z,
1996                             M_NOWAIT | M_ZERO);
1997                 if (ke->pfrke_counters != NULL) {
1998                         ke->pfrke_counters->pfrkc_packets[dir_out][op_pass]++;
1999                         ke->pfrke_counters->pfrkc_bytes[dir_out][op_pass] += len;
2000                 }
2001         }
2002 }
2003
2004 struct pfr_ktable *
2005 pfr_attach_table(struct pf_ruleset *rs, char *name)
2006 {
2007         struct pfr_ktable       *kt, *rt;
2008         struct pfr_table         tbl;
2009         struct pf_anchor        *ac = rs->anchor;
2010
2011         PF_RULES_WASSERT();
2012
2013         bzero(&tbl, sizeof(tbl));
2014         strlcpy(tbl.pfrt_name, name, sizeof(tbl.pfrt_name));
2015         if (ac != NULL)
2016                 strlcpy(tbl.pfrt_anchor, ac->path, sizeof(tbl.pfrt_anchor));
2017         kt = pfr_lookup_table(&tbl);
2018         if (kt == NULL) {
2019                 kt = pfr_create_ktable(&tbl, time_second, 1);
2020                 if (kt == NULL)
2021                         return (NULL);
2022                 if (ac != NULL) {
2023                         bzero(tbl.pfrt_anchor, sizeof(tbl.pfrt_anchor));
2024                         rt = pfr_lookup_table(&tbl);
2025                         if (rt == NULL) {
2026                                 rt = pfr_create_ktable(&tbl, 0, 1);
2027                                 if (rt == NULL) {
2028                                         pfr_destroy_ktable(kt, 0);
2029                                         return (NULL);
2030                                 }
2031                                 pfr_insert_ktable(rt);
2032                         }
2033                         kt->pfrkt_root = rt;
2034                 }
2035                 pfr_insert_ktable(kt);
2036         }
2037         if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++)
2038                 pfr_setflags_ktable(kt, kt->pfrkt_flags|PFR_TFLAG_REFERENCED);
2039         return (kt);
2040 }
2041
2042 void
2043 pfr_detach_table(struct pfr_ktable *kt)
2044 {
2045
2046         PF_RULES_WASSERT();
2047         KASSERT(kt->pfrkt_refcnt[PFR_REFCNT_RULE] > 0, ("%s: refcount %d\n",
2048             __func__, kt->pfrkt_refcnt[PFR_REFCNT_RULE]));
2049
2050         if (!--kt->pfrkt_refcnt[PFR_REFCNT_RULE])
2051                 pfr_setflags_ktable(kt, kt->pfrkt_flags&~PFR_TFLAG_REFERENCED);
2052 }
2053
2054 int
2055 pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter,
2056     sa_family_t af)
2057 {
2058         struct pf_addr           *addr, *cur, *mask;
2059         union sockaddr_union     uaddr, umask;
2060         struct pfr_kentry       *ke, *ke2 = NULL;
2061         int                      idx = -1, use_counter = 0;
2062
2063         switch (af) {
2064         case AF_INET:
2065                 uaddr.sin.sin_len = sizeof(struct sockaddr_in);
2066                 uaddr.sin.sin_family = AF_INET;
2067                 break;
2068         case AF_INET6:
2069                 uaddr.sin6.sin6_len = sizeof(struct sockaddr_in6);
2070                 uaddr.sin6.sin6_family = AF_INET6;
2071                 break;
2072         }
2073         addr = SUNION2PF(&uaddr, af);
2074
2075         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2076                 kt = kt->pfrkt_root;
2077         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2078                 return (-1);
2079
2080         if (pidx != NULL)
2081                 idx = *pidx;
2082         if (counter != NULL && idx >= 0)
2083                 use_counter = 1;
2084         if (idx < 0)
2085                 idx = 0;
2086
2087 _next_block:
2088         ke = pfr_kentry_byidx(kt, idx, af);
2089         if (ke == NULL) {
2090                 kt->pfrkt_nomatch++;
2091                 return (1);
2092         }
2093         pfr_prepare_network(&umask, af, ke->pfrke_net);
2094         cur = SUNION2PF(&ke->pfrke_sa, af);
2095         mask = SUNION2PF(&umask, af);
2096
2097         if (use_counter) {
2098                 /* is supplied address within block? */
2099                 if (!PF_MATCHA(0, cur, mask, counter, af)) {
2100                         /* no, go to next block in table */
2101                         idx++;
2102                         use_counter = 0;
2103                         goto _next_block;
2104                 }
2105                 PF_ACPY(addr, counter, af);
2106         } else {
2107                 /* use first address of block */
2108                 PF_ACPY(addr, cur, af);
2109         }
2110
2111         if (!KENTRY_NETWORK(ke)) {
2112                 /* this is a single IP address - no possible nested block */
2113                 PF_ACPY(counter, addr, af);
2114                 *pidx = idx;
2115                 kt->pfrkt_match++;
2116                 return (0);
2117         }
2118         for (;;) {
2119                 /* we don't want to use a nested block */
2120                 switch (af) {
2121                 case AF_INET:
2122                         ke2 = (struct pfr_kentry *)rn_match(&uaddr,
2123                             &kt->pfrkt_ip4->rh);
2124                         break;
2125                 case AF_INET6:
2126                         ke2 = (struct pfr_kentry *)rn_match(&uaddr,
2127                             &kt->pfrkt_ip6->rh);
2128                         break;
2129                 }
2130                 /* no need to check KENTRY_RNF_ROOT() here */
2131                 if (ke2 == ke) {
2132                         /* lookup return the same block - perfect */
2133                         PF_ACPY(counter, addr, af);
2134                         *pidx = idx;
2135                         kt->pfrkt_match++;
2136                         return (0);
2137                 }
2138
2139                 /* we need to increase the counter past the nested block */
2140                 pfr_prepare_network(&umask, AF_INET, ke2->pfrke_net);
2141                 PF_POOLMASK(addr, addr, SUNION2PF(&umask, af), &pfr_ffaddr, af);
2142                 PF_AINC(addr, af);
2143                 if (!PF_MATCHA(0, cur, mask, addr, af)) {
2144                         /* ok, we reached the end of our main block */
2145                         /* go to next block in table */
2146                         idx++;
2147                         use_counter = 0;
2148                         goto _next_block;
2149                 }
2150         }
2151 }
2152
2153 static struct pfr_kentry *
2154 pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af)
2155 {
2156         struct pfr_walktree     w;
2157
2158         bzero(&w, sizeof(w));
2159         w.pfrw_op = PFRW_POOL_GET;
2160         w.pfrw_cnt = idx;
2161
2162         switch (af) {
2163 #ifdef INET
2164         case AF_INET:
2165                 kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
2166                 return (w.pfrw_kentry);
2167 #endif /* INET */
2168 #ifdef INET6
2169         case AF_INET6:
2170                 kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w);
2171                 return (w.pfrw_kentry);
2172 #endif /* INET6 */
2173         default:
2174                 return (NULL);
2175         }
2176 }
2177
2178 void
2179 pfr_dynaddr_update(struct pfr_ktable *kt, struct pfi_dynaddr *dyn)
2180 {
2181         struct pfr_walktree     w;
2182
2183         bzero(&w, sizeof(w));
2184         w.pfrw_op = PFRW_DYNADDR_UPDATE;
2185         w.pfrw_dyn = dyn;
2186
2187         dyn->pfid_acnt4 = 0;
2188         dyn->pfid_acnt6 = 0;
2189         if (!dyn->pfid_af || dyn->pfid_af == AF_INET)
2190                 kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
2191         if (!dyn->pfid_af || dyn->pfid_af == AF_INET6)
2192                 kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w);
2193 }