1 /* $OpenBSD: pf_table.c,v 1.79 2008/10/08 06:24:50 mcbride Exp $ */
4 * Copyright (c) 2002 Cedric Berger
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
11 * - Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * - Redistributions in binary form must reproduce the above
14 * copyright notice, this list of conditions and the following
15 * disclaimer in the documentation and/or other materials provided
16 * with the distribution.
18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
21 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
22 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
24 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
25 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
26 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
28 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 * POSSIBILITY OF SUCH DAMAGE.
35 #include "opt_inet6.h"
37 #include <sys/cdefs.h>
38 __FBSDID("$FreeBSD$");
41 #include <sys/param.h>
42 #include <sys/systm.h>
43 #include <sys/socket.h>
45 #include <sys/kernel.h>
47 #include <sys/malloc.h>
53 #include <net/route.h>
54 #include <netinet/in.h>
56 #include <netinet/ip_ipsp.h>
58 #include <net/pfvar.h>
60 #define ACCEPT_FLAGS(flags, oklist) \
62 if ((flags & ~(oklist)) & \
69 _copyin(const void *uaddr, void *kaddr, size_t len)
74 r = copyin(uaddr, kaddr, len);
81 _copyout(const void *uaddr, void *kaddr, size_t len)
86 r = copyout(uaddr, kaddr, len);
92 #define COPYIN(from, to, size, flags) \
93 ((flags & PFR_FLAG_USERIOCTL) ? \
94 _copyin((from), (to), (size)) : \
95 (bcopy((from), (to), (size)), 0))
97 #define COPYOUT(from, to, size, flags) \
98 ((flags & PFR_FLAG_USERIOCTL) ? \
99 _copyout((from), (to), (size)) : \
100 (bcopy((from), (to), (size)), 0))
103 #define COPYIN(from, to, size, flags) \
104 ((flags & PFR_FLAG_USERIOCTL) ? \
105 copyin((from), (to), (size)) : \
106 (bcopy((from), (to), (size)), 0))
108 #define COPYOUT(from, to, size, flags) \
109 ((flags & PFR_FLAG_USERIOCTL) ? \
110 copyout((from), (to), (size)) : \
111 (bcopy((from), (to), (size)), 0))
114 #define FILLIN_SIN(sin, addr) \
116 (sin).sin_len = sizeof(sin); \
117 (sin).sin_family = AF_INET; \
118 (sin).sin_addr = (addr); \
121 #define FILLIN_SIN6(sin6, addr) \
123 (sin6).sin6_len = sizeof(sin6); \
124 (sin6).sin6_family = AF_INET6; \
125 (sin6).sin6_addr = (addr); \
128 #define SWAP(type, a1, a2) \
135 #define SUNION2PF(su, af) (((af)==AF_INET) ? \
136 (struct pf_addr *)&(su)->sin.sin_addr : \
137 (struct pf_addr *)&(su)->sin6.sin6_addr)
139 #define AF_BITS(af) (((af)==AF_INET)?32:128)
140 #define ADDR_NETWORK(ad) ((ad)->pfra_net < AF_BITS((ad)->pfra_af))
141 #define KENTRY_NETWORK(ke) ((ke)->pfrke_net < AF_BITS((ke)->pfrke_af))
142 #define KENTRY_RNF_ROOT(ke) \
143 ((((struct radix_node *)(ke))->rn_flags & RNF_ROOT) != 0)
145 #define NO_ADDRESSES (-1)
146 #define ENQUEUE_UNMARKED_ONLY (1)
147 #define INVERT_NEG_FLAG (1)
149 struct pfr_walktree {
160 struct pfr_addr *pfrw1_addr;
161 struct pfr_astats *pfrw1_astats;
162 struct pfr_kentryworkq *pfrw1_workq;
163 struct pfr_kentry *pfrw1_kentry;
164 struct pfi_dynaddr *pfrw1_dyn;
169 #define pfrw_addr pfrw_1.pfrw1_addr
170 #define pfrw_astats pfrw_1.pfrw1_astats
171 #define pfrw_workq pfrw_1.pfrw1_workq
172 #define pfrw_kentry pfrw_1.pfrw1_kentry
173 #define pfrw_dyn pfrw_1.pfrw1_dyn
174 #define pfrw_cnt pfrw_free
176 #define senderr(e) do { rv = (e); goto _bad; } while (0)
179 VNET_DEFINE(uma_zone_t, pfr_ktable_pl);
180 VNET_DEFINE(uma_zone_t, pfr_kentry_pl);
181 VNET_DEFINE(uma_zone_t, pfr_kcounters_pl);
182 #define V_pfr_kcounters_pl VNET(pfr_kcounters_pl)
183 VNET_DEFINE(struct sockaddr_in, pfr_sin);
184 #define V_pfr_sin VNET(pfr_sin)
185 VNET_DEFINE(struct sockaddr_in6, pfr_sin6);
186 #define V_pfr_sin6 VNET(pfr_sin6)
187 VNET_DEFINE(union sockaddr_union, pfr_mask);
188 #define V_pfr_mask VNET(pfr_mask)
189 VNET_DEFINE(struct pf_addr, pfr_ffaddr);
190 #define V_pfr_ffaddr VNET(pfr_ffaddr)
192 struct pool pfr_ktable_pl;
193 struct pool pfr_kentry_pl;
194 struct pool pfr_kcounters_pl;
195 struct sockaddr_in pfr_sin;
196 struct sockaddr_in6 pfr_sin6;
197 union sockaddr_union pfr_mask;
198 struct pf_addr pfr_ffaddr;
201 void pfr_copyout_addr(struct pfr_addr *,
202 struct pfr_kentry *ke);
203 int pfr_validate_addr(struct pfr_addr *);
204 void pfr_enqueue_addrs(struct pfr_ktable *,
205 struct pfr_kentryworkq *, int *, int);
206 void pfr_mark_addrs(struct pfr_ktable *);
207 struct pfr_kentry *pfr_lookup_addr(struct pfr_ktable *,
208 struct pfr_addr *, int);
209 struct pfr_kentry *pfr_create_kentry(struct pfr_addr *, int);
210 void pfr_destroy_kentries(struct pfr_kentryworkq *);
211 void pfr_destroy_kentry(struct pfr_kentry *);
212 void pfr_insert_kentries(struct pfr_ktable *,
213 struct pfr_kentryworkq *, long);
214 void pfr_remove_kentries(struct pfr_ktable *,
215 struct pfr_kentryworkq *);
216 void pfr_clstats_kentries(struct pfr_kentryworkq *, long,
218 void pfr_reset_feedback(struct pfr_addr *, int, int);
219 void pfr_prepare_network(union sockaddr_union *, int, int);
220 int pfr_route_kentry(struct pfr_ktable *,
221 struct pfr_kentry *);
222 int pfr_unroute_kentry(struct pfr_ktable *,
223 struct pfr_kentry *);
224 int pfr_walktree(struct radix_node *, void *);
225 int pfr_validate_table(struct pfr_table *, int, int);
226 int pfr_fix_anchor(char *);
227 void pfr_commit_ktable(struct pfr_ktable *, long);
228 void pfr_insert_ktables(struct pfr_ktableworkq *);
229 void pfr_insert_ktable(struct pfr_ktable *);
230 void pfr_setflags_ktables(struct pfr_ktableworkq *);
231 void pfr_setflags_ktable(struct pfr_ktable *, int);
232 void pfr_clstats_ktables(struct pfr_ktableworkq *, long,
234 void pfr_clstats_ktable(struct pfr_ktable *, long, int);
235 struct pfr_ktable *pfr_create_ktable(struct pfr_table *, long, int, int);
236 void pfr_destroy_ktables(struct pfr_ktableworkq *, int);
237 void pfr_destroy_ktable(struct pfr_ktable *, int);
238 int pfr_ktable_compare(struct pfr_ktable *,
239 struct pfr_ktable *);
240 struct pfr_ktable *pfr_lookup_table(struct pfr_table *);
241 void pfr_clean_node_mask(struct pfr_ktable *,
242 struct pfr_kentryworkq *);
243 int pfr_table_count(struct pfr_table *, int);
244 int pfr_skip_table(struct pfr_table *,
245 struct pfr_ktable *, int);
246 struct pfr_kentry *pfr_kentry_byidx(struct pfr_ktable *, int, int);
248 RB_PROTOTYPE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
249 RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
251 struct pfr_ktablehead pfr_ktables;
252 struct pfr_table pfr_nulltable;
259 pool_init(&pfr_ktable_pl, sizeof(struct pfr_ktable), 0, 0, 0,
261 pool_init(&pfr_kentry_pl, sizeof(struct pfr_kentry), 0, 0, 0,
263 pool_init(&pfr_kcounters_pl, sizeof(struct pfr_kcounters), 0, 0, 0,
264 "pfrkcounters", NULL);
266 pfr_sin.sin_len = sizeof(pfr_sin);
267 pfr_sin.sin_family = AF_INET;
268 pfr_sin6.sin6_len = sizeof(pfr_sin6);
269 pfr_sin6.sin6_family = AF_INET6;
271 memset(&pfr_ffaddr, 0xff, sizeof(pfr_ffaddr));
273 V_pfr_sin.sin_len = sizeof(V_pfr_sin);
274 V_pfr_sin.sin_family = AF_INET;
275 V_pfr_sin6.sin6_len = sizeof(V_pfr_sin6);
276 V_pfr_sin6.sin6_family = AF_INET6;
278 memset(&V_pfr_ffaddr, 0xff, sizeof(V_pfr_ffaddr));
283 pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags)
285 struct pfr_ktable *kt;
286 struct pfr_kentryworkq workq;
289 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
290 if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
292 kt = pfr_lookup_table(tbl);
293 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
295 if (kt->pfrkt_flags & PFR_TFLAG_CONST)
297 pfr_enqueue_addrs(kt, &workq, ndel, 0);
299 if (!(flags & PFR_FLAG_DUMMY)) {
300 if (flags & PFR_FLAG_ATOMIC)
302 pfr_remove_kentries(kt, &workq);
303 if (flags & PFR_FLAG_ATOMIC)
306 printf("pfr_clr_addrs: corruption detected (%d).\n",
315 pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
316 int *nadd, int flags)
318 struct pfr_ktable *kt, *tmpkt;
319 struct pfr_kentryworkq workq;
320 struct pfr_kentry *p, *q;
322 int i, rv, s, xadd = 0;
323 long tzero = time_second;
325 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
327 if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
329 kt = pfr_lookup_table(tbl);
330 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
332 if (kt->pfrkt_flags & PFR_TFLAG_CONST)
334 tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0,
335 !(flags & PFR_FLAG_USERIOCTL));
339 for (i = 0; i < size; i++) {
340 if (COPYIN(addr+i, &ad, sizeof(ad), flags))
342 if (pfr_validate_addr(&ad))
344 p = pfr_lookup_addr(kt, &ad, 1);
345 q = pfr_lookup_addr(tmpkt, &ad, 1);
346 if (flags & PFR_FLAG_FEEDBACK) {
348 ad.pfra_fback = PFR_FB_DUPLICATE;
350 ad.pfra_fback = PFR_FB_ADDED;
351 else if (p->pfrke_not != ad.pfra_not)
352 ad.pfra_fback = PFR_FB_CONFLICT;
354 ad.pfra_fback = PFR_FB_NONE;
356 if (p == NULL && q == NULL) {
357 p = pfr_create_kentry(&ad,
358 !(flags & PFR_FLAG_USERIOCTL));
361 if (pfr_route_kentry(tmpkt, p)) {
362 pfr_destroy_kentry(p);
363 ad.pfra_fback = PFR_FB_NONE;
365 SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
369 if (flags & PFR_FLAG_FEEDBACK)
370 if (COPYOUT(&ad, addr+i, sizeof(ad), flags))
373 pfr_clean_node_mask(tmpkt, &workq);
374 if (!(flags & PFR_FLAG_DUMMY)) {
375 if (flags & PFR_FLAG_ATOMIC)
377 pfr_insert_kentries(kt, &workq, tzero);
378 if (flags & PFR_FLAG_ATOMIC)
381 pfr_destroy_kentries(&workq);
384 pfr_destroy_ktable(tmpkt, 0);
387 pfr_clean_node_mask(tmpkt, &workq);
388 pfr_destroy_kentries(&workq);
389 if (flags & PFR_FLAG_FEEDBACK)
390 pfr_reset_feedback(addr, size, flags);
391 pfr_destroy_ktable(tmpkt, 0);
396 pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
397 int *ndel, int flags)
399 struct pfr_ktable *kt;
400 struct pfr_kentryworkq workq;
401 struct pfr_kentry *p;
403 int i, rv, s, xdel = 0, log = 1;
405 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
407 if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
409 kt = pfr_lookup_table(tbl);
410 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
412 if (kt->pfrkt_flags & PFR_TFLAG_CONST)
415 * there are two algorithms to choose from here.
417 * n: number of addresses to delete
418 * N: number of addresses in the table
420 * one is O(N) and is better for large 'n'
421 * one is O(n*LOG(N)) and is better for small 'n'
423 * following code try to decide which one is best.
425 for (i = kt->pfrkt_cnt; i > 0; i >>= 1)
427 if (size > kt->pfrkt_cnt/log) {
428 /* full table scan */
431 /* iterate over addresses to delete */
432 for (i = 0; i < size; i++) {
433 if (COPYIN(addr+i, &ad, sizeof(ad), flags))
435 if (pfr_validate_addr(&ad))
437 p = pfr_lookup_addr(kt, &ad, 1);
443 for (i = 0; i < size; i++) {
444 if (COPYIN(addr+i, &ad, sizeof(ad), flags))
446 if (pfr_validate_addr(&ad))
448 p = pfr_lookup_addr(kt, &ad, 1);
449 if (flags & PFR_FLAG_FEEDBACK) {
451 ad.pfra_fback = PFR_FB_NONE;
452 else if (p->pfrke_not != ad.pfra_not)
453 ad.pfra_fback = PFR_FB_CONFLICT;
454 else if (p->pfrke_mark)
455 ad.pfra_fback = PFR_FB_DUPLICATE;
457 ad.pfra_fback = PFR_FB_DELETED;
459 if (p != NULL && p->pfrke_not == ad.pfra_not &&
462 SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
465 if (flags & PFR_FLAG_FEEDBACK)
466 if (COPYOUT(&ad, addr+i, sizeof(ad), flags))
469 if (!(flags & PFR_FLAG_DUMMY)) {
470 if (flags & PFR_FLAG_ATOMIC)
472 pfr_remove_kentries(kt, &workq);
473 if (flags & PFR_FLAG_ATOMIC)
480 if (flags & PFR_FLAG_FEEDBACK)
481 pfr_reset_feedback(addr, size, flags);
486 pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
487 int *size2, int *nadd, int *ndel, int *nchange, int flags,
488 u_int32_t ignore_pfrt_flags)
490 struct pfr_ktable *kt, *tmpkt;
491 struct pfr_kentryworkq addq, delq, changeq;
492 struct pfr_kentry *p, *q;
494 int i, rv, s, xadd = 0, xdel = 0, xchange = 0;
495 long tzero = time_second;
497 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
499 if (pfr_validate_table(tbl, ignore_pfrt_flags, flags &
502 kt = pfr_lookup_table(tbl);
503 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
505 if (kt->pfrkt_flags & PFR_TFLAG_CONST)
507 tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0,
508 !(flags & PFR_FLAG_USERIOCTL));
514 SLIST_INIT(&changeq);
515 for (i = 0; i < size; i++) {
516 if (COPYIN(addr+i, &ad, sizeof(ad), flags))
518 if (pfr_validate_addr(&ad))
520 ad.pfra_fback = PFR_FB_NONE;
521 p = pfr_lookup_addr(kt, &ad, 1);
524 ad.pfra_fback = PFR_FB_DUPLICATE;
528 if (p->pfrke_not != ad.pfra_not) {
529 SLIST_INSERT_HEAD(&changeq, p, pfrke_workq);
530 ad.pfra_fback = PFR_FB_CHANGED;
534 q = pfr_lookup_addr(tmpkt, &ad, 1);
536 ad.pfra_fback = PFR_FB_DUPLICATE;
539 p = pfr_create_kentry(&ad,
540 !(flags & PFR_FLAG_USERIOCTL));
543 if (pfr_route_kentry(tmpkt, p)) {
544 pfr_destroy_kentry(p);
545 ad.pfra_fback = PFR_FB_NONE;
547 SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
548 ad.pfra_fback = PFR_FB_ADDED;
553 if (flags & PFR_FLAG_FEEDBACK)
554 if (COPYOUT(&ad, addr+i, sizeof(ad), flags))
557 pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY);
558 if ((flags & PFR_FLAG_FEEDBACK) && *size2) {
559 if (*size2 < size+xdel) {
564 SLIST_FOREACH(p, &delq, pfrke_workq) {
565 pfr_copyout_addr(&ad, p);
566 ad.pfra_fback = PFR_FB_DELETED;
567 if (COPYOUT(&ad, addr+size+i, sizeof(ad), flags))
572 pfr_clean_node_mask(tmpkt, &addq);
573 if (!(flags & PFR_FLAG_DUMMY)) {
574 if (flags & PFR_FLAG_ATOMIC)
576 pfr_insert_kentries(kt, &addq, tzero);
577 pfr_remove_kentries(kt, &delq);
578 pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
579 if (flags & PFR_FLAG_ATOMIC)
582 pfr_destroy_kentries(&addq);
589 if ((flags & PFR_FLAG_FEEDBACK) && size2)
591 pfr_destroy_ktable(tmpkt, 0);
594 pfr_clean_node_mask(tmpkt, &addq);
595 pfr_destroy_kentries(&addq);
596 if (flags & PFR_FLAG_FEEDBACK)
597 pfr_reset_feedback(addr, size, flags);
598 pfr_destroy_ktable(tmpkt, 0);
603 pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
604 int *nmatch, int flags)
606 struct pfr_ktable *kt;
607 struct pfr_kentry *p;
611 ACCEPT_FLAGS(flags, PFR_FLAG_REPLACE);
612 if (pfr_validate_table(tbl, 0, 0))
614 kt = pfr_lookup_table(tbl);
615 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
618 for (i = 0; i < size; i++) {
619 if (COPYIN(addr+i, &ad, sizeof(ad), flags))
621 if (pfr_validate_addr(&ad))
623 if (ADDR_NETWORK(&ad))
625 p = pfr_lookup_addr(kt, &ad, 0);
626 if (flags & PFR_FLAG_REPLACE)
627 pfr_copyout_addr(&ad, p);
628 ad.pfra_fback = (p == NULL) ? PFR_FB_NONE :
629 (p->pfrke_not ? PFR_FB_NOTMATCH : PFR_FB_MATCH);
630 if (p != NULL && !p->pfrke_not)
632 if (COPYOUT(&ad, addr+i, sizeof(ad), flags))
641 pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size,
644 struct pfr_ktable *kt;
645 struct pfr_walktree w;
648 ACCEPT_FLAGS(flags, 0);
649 if (pfr_validate_table(tbl, 0, 0))
651 kt = pfr_lookup_table(tbl);
652 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
654 if (kt->pfrkt_cnt > *size) {
655 *size = kt->pfrkt_cnt;
659 bzero(&w, sizeof(w));
660 w.pfrw_op = PFRW_GET_ADDRS;
662 w.pfrw_free = kt->pfrkt_cnt;
663 w.pfrw_flags = flags;
665 rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
667 rv = rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
671 rv = kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree,
674 rv = rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
680 printf("pfr_get_addrs: corruption detected (%d).\n",
684 *size = kt->pfrkt_cnt;
689 pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size,
692 struct pfr_ktable *kt;
693 struct pfr_walktree w;
694 struct pfr_kentryworkq workq;
696 long tzero = time_second;
698 /* XXX PFR_FLAG_CLSTATS disabled */
699 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC);
700 if (pfr_validate_table(tbl, 0, 0))
702 kt = pfr_lookup_table(tbl);
703 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
705 if (kt->pfrkt_cnt > *size) {
706 *size = kt->pfrkt_cnt;
710 bzero(&w, sizeof(w));
711 w.pfrw_op = PFRW_GET_ASTATS;
712 w.pfrw_astats = addr;
713 w.pfrw_free = kt->pfrkt_cnt;
714 w.pfrw_flags = flags;
715 if (flags & PFR_FLAG_ATOMIC)
718 rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
720 rv = rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
724 rv = kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree,
727 rv = rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
729 if (!rv && (flags & PFR_FLAG_CLSTATS)) {
730 pfr_enqueue_addrs(kt, &workq, NULL, 0);
731 pfr_clstats_kentries(&workq, tzero, 0);
733 if (flags & PFR_FLAG_ATOMIC)
739 printf("pfr_get_astats: corruption detected (%d).\n",
743 *size = kt->pfrkt_cnt;
748 pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size,
749 int *nzero, int flags)
751 struct pfr_ktable *kt;
752 struct pfr_kentryworkq workq;
753 struct pfr_kentry *p;
755 int i, rv, s, xzero = 0;
757 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
759 if (pfr_validate_table(tbl, 0, 0))
761 kt = pfr_lookup_table(tbl);
762 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
765 for (i = 0; i < size; i++) {
766 if (COPYIN(addr+i, &ad, sizeof(ad), flags))
768 if (pfr_validate_addr(&ad))
770 p = pfr_lookup_addr(kt, &ad, 1);
771 if (flags & PFR_FLAG_FEEDBACK) {
772 ad.pfra_fback = (p != NULL) ?
773 PFR_FB_CLEARED : PFR_FB_NONE;
774 if (COPYOUT(&ad, addr+i, sizeof(ad), flags))
778 SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
783 if (!(flags & PFR_FLAG_DUMMY)) {
784 if (flags & PFR_FLAG_ATOMIC)
786 pfr_clstats_kentries(&workq, 0, 0);
787 if (flags & PFR_FLAG_ATOMIC)
794 if (flags & PFR_FLAG_FEEDBACK)
795 pfr_reset_feedback(addr, size, flags);
800 pfr_validate_addr(struct pfr_addr *ad)
804 switch (ad->pfra_af) {
807 if (ad->pfra_net > 32)
813 if (ad->pfra_net > 128)
820 if (ad->pfra_net < 128 &&
821 (((caddr_t)ad)[ad->pfra_net/8] & (0xFF >> (ad->pfra_net%8))))
823 for (i = (ad->pfra_net+7)/8; i < sizeof(ad->pfra_u); i++)
824 if (((caddr_t)ad)[i])
826 if (ad->pfra_not && ad->pfra_not != 1)
834 pfr_enqueue_addrs(struct pfr_ktable *kt, struct pfr_kentryworkq *workq,
835 int *naddr, int sweep)
837 struct pfr_walktree w;
840 bzero(&w, sizeof(w));
841 w.pfrw_op = sweep ? PFRW_SWEEP : PFRW_ENQUEUE;
842 w.pfrw_workq = workq;
843 if (kt->pfrkt_ip4 != NULL)
845 if (kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree,
848 if (rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w))
850 printf("pfr_enqueue_addrs: IPv4 walktree failed.\n");
851 if (kt->pfrkt_ip6 != NULL)
853 if (kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree,
856 if (rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w))
858 printf("pfr_enqueue_addrs: IPv6 walktree failed.\n");
864 pfr_mark_addrs(struct pfr_ktable *kt)
866 struct pfr_walktree w;
868 bzero(&w, sizeof(w));
869 w.pfrw_op = PFRW_MARK;
871 if (kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w))
873 if (rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w))
875 printf("pfr_mark_addrs: IPv4 walktree failed.\n");
877 if (kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w))
879 if (rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w))
881 printf("pfr_mark_addrs: IPv6 walktree failed.\n");
886 pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact)
888 union sockaddr_union sa, mask;
890 struct radix_node_head *head = NULL;
892 struct radix_node_head *head;
894 struct pfr_kentry *ke;
897 bzero(&sa, sizeof(sa));
898 if (ad->pfra_af == AF_INET) {
899 FILLIN_SIN(sa.sin, ad->pfra_ip4addr);
900 head = kt->pfrkt_ip4;
901 } else if ( ad->pfra_af == AF_INET6 ) {
902 FILLIN_SIN6(sa.sin6, ad->pfra_ip6addr);
903 head = kt->pfrkt_ip6;
905 if (ADDR_NETWORK(ad)) {
906 pfr_prepare_network(&mask, ad->pfra_af, ad->pfra_net);
907 s = splsoftnet(); /* rn_lookup makes use of globals */
911 ke = (struct pfr_kentry *)rn_lookup(&sa, &mask, head);
913 if (ke && KENTRY_RNF_ROOT(ke))
916 ke = (struct pfr_kentry *)rn_match(&sa, head);
917 if (ke && KENTRY_RNF_ROOT(ke))
919 if (exact && ke && KENTRY_NETWORK(ke))
926 pfr_create_kentry(struct pfr_addr *ad, int intr)
928 struct pfr_kentry *ke;
932 ke = pool_get(&V_pfr_kentry_pl, PR_NOWAIT | PR_ZERO);
934 ke = pool_get(&pfr_kentry_pl, PR_NOWAIT | PR_ZERO);
938 ke = pool_get(&V_pfr_kentry_pl, PR_WAITOK|PR_ZERO);
940 ke = pool_get(&pfr_kentry_pl, PR_WAITOK|PR_ZERO|PR_LIMITFAIL);
945 if (ad->pfra_af == AF_INET)
946 FILLIN_SIN(ke->pfrke_sa.sin, ad->pfra_ip4addr);
947 else if (ad->pfra_af == AF_INET6)
948 FILLIN_SIN6(ke->pfrke_sa.sin6, ad->pfra_ip6addr);
949 ke->pfrke_af = ad->pfra_af;
950 ke->pfrke_net = ad->pfra_net;
951 ke->pfrke_not = ad->pfra_not;
956 pfr_destroy_kentries(struct pfr_kentryworkq *workq)
958 struct pfr_kentry *p, *q;
960 for (p = SLIST_FIRST(workq); p != NULL; p = q) {
961 q = SLIST_NEXT(p, pfrke_workq);
962 pfr_destroy_kentry(p);
967 pfr_destroy_kentry(struct pfr_kentry *ke)
969 if (ke->pfrke_counters)
971 pool_put(&V_pfr_kcounters_pl, ke->pfrke_counters);
972 pool_put(&V_pfr_kentry_pl, ke);
974 pool_put(&pfr_kcounters_pl, ke->pfrke_counters);
975 pool_put(&pfr_kentry_pl, ke);
980 pfr_insert_kentries(struct pfr_ktable *kt,
981 struct pfr_kentryworkq *workq, long tzero)
983 struct pfr_kentry *p;
986 SLIST_FOREACH(p, workq, pfrke_workq) {
987 rv = pfr_route_kentry(kt, p);
989 printf("pfr_insert_kentries: cannot route entry "
993 p->pfrke_tzero = tzero;
1000 pfr_insert_kentry(struct pfr_ktable *kt, struct pfr_addr *ad, long tzero)
1002 struct pfr_kentry *p;
1005 p = pfr_lookup_addr(kt, ad, 1);
1008 p = pfr_create_kentry(ad, 1);
1012 rv = pfr_route_kentry(kt, p);
1016 p->pfrke_tzero = tzero;
1023 pfr_remove_kentries(struct pfr_ktable *kt,
1024 struct pfr_kentryworkq *workq)
1026 struct pfr_kentry *p;
1029 SLIST_FOREACH(p, workq, pfrke_workq) {
1030 pfr_unroute_kentry(kt, p);
1034 pfr_destroy_kentries(workq);
1038 pfr_clean_node_mask(struct pfr_ktable *kt,
1039 struct pfr_kentryworkq *workq)
1041 struct pfr_kentry *p;
1043 SLIST_FOREACH(p, workq, pfrke_workq)
1044 pfr_unroute_kentry(kt, p);
1048 pfr_clstats_kentries(struct pfr_kentryworkq *workq, long tzero, int negchange)
1050 struct pfr_kentry *p;
1053 SLIST_FOREACH(p, workq, pfrke_workq) {
1056 p->pfrke_not = !p->pfrke_not;
1057 if (p->pfrke_counters) {
1059 pool_put(&V_pfr_kcounters_pl, p->pfrke_counters);
1061 pool_put(&pfr_kcounters_pl, p->pfrke_counters);
1063 p->pfrke_counters = NULL;
1066 p->pfrke_tzero = tzero;
1071 pfr_reset_feedback(struct pfr_addr *addr, int size, int flags)
1076 for (i = 0; i < size; i++) {
1077 if (COPYIN(addr+i, &ad, sizeof(ad), flags))
1079 ad.pfra_fback = PFR_FB_NONE;
1080 if (COPYOUT(&ad, addr+i, sizeof(ad), flags))
1086 pfr_prepare_network(union sockaddr_union *sa, int af, int net)
1090 bzero(sa, sizeof(*sa));
1091 if (af == AF_INET) {
1092 sa->sin.sin_len = sizeof(sa->sin);
1093 sa->sin.sin_family = AF_INET;
1094 sa->sin.sin_addr.s_addr = net ? htonl(-1 << (32-net)) : 0;
1095 } else if (af == AF_INET6) {
1096 sa->sin6.sin6_len = sizeof(sa->sin6);
1097 sa->sin6.sin6_family = AF_INET6;
1098 for (i = 0; i < 4; i++) {
1100 sa->sin6.sin6_addr.s6_addr32[i] =
1101 net ? htonl(-1 << (32-net)) : 0;
1104 sa->sin6.sin6_addr.s6_addr32[i] = 0xFFFFFFFF;
1111 pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
1113 union sockaddr_union mask;
1114 struct radix_node *rn;
1116 struct radix_node_head *head = NULL;
1118 struct radix_node_head *head;
1122 bzero(ke->pfrke_node, sizeof(ke->pfrke_node));
1123 if (ke->pfrke_af == AF_INET)
1124 head = kt->pfrkt_ip4;
1125 else if (ke->pfrke_af == AF_INET6)
1126 head = kt->pfrkt_ip6;
1130 PF_ASSERT(MA_OWNED);
1132 if (KENTRY_NETWORK(ke)) {
1133 pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
1135 rn = rn_addroute(&ke->pfrke_sa, &mask, head, ke->pfrke_node);
1137 rn = rn_addroute(&ke->pfrke_sa, &mask, head, ke->pfrke_node, 0);
1141 rn = rn_addroute(&ke->pfrke_sa, NULL, head, ke->pfrke_node);
1143 rn = rn_addroute(&ke->pfrke_sa, NULL, head, ke->pfrke_node, 0);
1147 return (rn == NULL ? -1 : 0);
1151 pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
1153 union sockaddr_union mask;
1154 struct radix_node *rn;
1156 struct radix_node_head *head = NULL;
1158 struct radix_node_head *head;
1162 if (ke->pfrke_af == AF_INET)
1163 head = kt->pfrkt_ip4;
1164 else if (ke->pfrke_af == AF_INET6)
1165 head = kt->pfrkt_ip6;
1169 PF_ASSERT(MA_OWNED);
1171 if (KENTRY_NETWORK(ke)) {
1172 pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
1174 rn = rn_delete(&ke->pfrke_sa, &mask, head);
1176 rn = rn_delete(&ke->pfrke_sa, &mask, head, NULL);
1180 rn = rn_delete(&ke->pfrke_sa, NULL, head);
1182 rn = rn_delete(&ke->pfrke_sa, NULL, head, NULL);
1187 printf("pfr_unroute_kentry: delete failed.\n");
1194 pfr_copyout_addr(struct pfr_addr *ad, struct pfr_kentry *ke)
1196 bzero(ad, sizeof(*ad));
1199 ad->pfra_af = ke->pfrke_af;
1200 ad->pfra_net = ke->pfrke_net;
1201 ad->pfra_not = ke->pfrke_not;
1202 if (ad->pfra_af == AF_INET)
1203 ad->pfra_ip4addr = ke->pfrke_sa.sin.sin_addr;
1204 else if (ad->pfra_af == AF_INET6)
1205 ad->pfra_ip6addr = ke->pfrke_sa.sin6.sin6_addr;
1209 pfr_walktree(struct radix_node *rn, void *arg)
1211 struct pfr_kentry *ke = (struct pfr_kentry *)rn;
1212 struct pfr_walktree *w = arg;
1213 int s, flags = w->pfrw_flags;
1215 switch (w->pfrw_op) {
1224 SLIST_INSERT_HEAD(w->pfrw_workq, ke, pfrke_workq);
1227 case PFRW_GET_ADDRS:
1228 if (w->pfrw_free-- > 0) {
1231 pfr_copyout_addr(&ad, ke);
1232 if (copyout(&ad, w->pfrw_addr, sizeof(ad)))
1237 case PFRW_GET_ASTATS:
1238 if (w->pfrw_free-- > 0) {
1239 struct pfr_astats as;
1241 pfr_copyout_addr(&as.pfras_a, ke);
1244 if (ke->pfrke_counters) {
1245 bcopy(ke->pfrke_counters->pfrkc_packets,
1246 as.pfras_packets, sizeof(as.pfras_packets));
1247 bcopy(ke->pfrke_counters->pfrkc_bytes,
1248 as.pfras_bytes, sizeof(as.pfras_bytes));
1250 bzero(as.pfras_packets, sizeof(as.pfras_packets));
1251 bzero(as.pfras_bytes, sizeof(as.pfras_bytes));
1252 as.pfras_a.pfra_fback = PFR_FB_NOCOUNT;
1255 as.pfras_tzero = ke->pfrke_tzero;
1257 if (COPYOUT(&as, w->pfrw_astats, sizeof(as), flags))
1264 break; /* negative entries are ignored */
1265 if (!w->pfrw_cnt--) {
1266 w->pfrw_kentry = ke;
1267 return (1); /* finish search */
1270 case PFRW_DYNADDR_UPDATE:
1271 if (ke->pfrke_af == AF_INET) {
1272 if (w->pfrw_dyn->pfid_acnt4++ > 0)
1275 pfr_prepare_network(&V_pfr_mask, AF_INET, ke->pfrke_net);
1277 pfr_prepare_network(&pfr_mask, AF_INET, ke->pfrke_net);
1279 w->pfrw_dyn->pfid_addr4 = *SUNION2PF(
1280 &ke->pfrke_sa, AF_INET);
1281 w->pfrw_dyn->pfid_mask4 = *SUNION2PF(
1283 &V_pfr_mask, AF_INET);
1285 &pfr_mask, AF_INET);
1287 } else if (ke->pfrke_af == AF_INET6){
1288 if (w->pfrw_dyn->pfid_acnt6++ > 0)
1291 pfr_prepare_network(&V_pfr_mask, AF_INET6, ke->pfrke_net);
1293 pfr_prepare_network(&pfr_mask, AF_INET6, ke->pfrke_net);
1295 w->pfrw_dyn->pfid_addr6 = *SUNION2PF(
1296 &ke->pfrke_sa, AF_INET6);
1297 w->pfrw_dyn->pfid_mask6 = *SUNION2PF(
1299 &V_pfr_mask, AF_INET6);
1301 &pfr_mask, AF_INET6);
1310 pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags)
1312 struct pfr_ktableworkq workq;
1313 struct pfr_ktable *p;
1316 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
1318 if (pfr_fix_anchor(filter->pfrt_anchor))
1320 if (pfr_table_count(filter, flags) < 0)
1324 RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1325 if (pfr_skip_table(filter, p, flags))
1327 if (!strcmp(p->pfrkt_anchor, PF_RESERVED_ANCHOR))
1329 if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE))
1331 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1332 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1335 if (!(flags & PFR_FLAG_DUMMY)) {
1336 if (flags & PFR_FLAG_ATOMIC)
1338 pfr_setflags_ktables(&workq);
1339 if (flags & PFR_FLAG_ATOMIC)
1348 pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags)
1350 struct pfr_ktableworkq addq, changeq;
1351 struct pfr_ktable *p, *q, *r, key;
1352 int i, rv, s, xadd = 0;
1353 long tzero = time_second;
1355 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
1357 SLIST_INIT(&changeq);
1358 for (i = 0; i < size; i++) {
1359 if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t), flags))
1361 if (pfr_validate_table(&key.pfrkt_t, PFR_TFLAG_USRMASK,
1362 flags & PFR_FLAG_USERIOCTL))
1364 key.pfrkt_flags |= PFR_TFLAG_ACTIVE;
1365 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1367 p = pfr_create_ktable(&key.pfrkt_t, tzero, 1,
1368 !(flags & PFR_FLAG_USERIOCTL));
1371 SLIST_FOREACH(q, &addq, pfrkt_workq) {
1372 if (!pfr_ktable_compare(p, q))
1375 SLIST_INSERT_HEAD(&addq, p, pfrkt_workq);
1377 if (!key.pfrkt_anchor[0])
1380 /* find or create root table */
1381 bzero(key.pfrkt_anchor, sizeof(key.pfrkt_anchor));
1382 r = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1387 SLIST_FOREACH(q, &addq, pfrkt_workq) {
1388 if (!pfr_ktable_compare(&key, q)) {
1393 key.pfrkt_flags = 0;
1394 r = pfr_create_ktable(&key.pfrkt_t, 0, 1,
1395 !(flags & PFR_FLAG_USERIOCTL));
1398 SLIST_INSERT_HEAD(&addq, r, pfrkt_workq);
1400 } else if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1401 SLIST_FOREACH(q, &changeq, pfrkt_workq)
1402 if (!pfr_ktable_compare(&key, q))
1404 p->pfrkt_nflags = (p->pfrkt_flags &
1405 ~PFR_TFLAG_USRMASK) | key.pfrkt_flags;
1406 SLIST_INSERT_HEAD(&changeq, p, pfrkt_workq);
1412 if (!(flags & PFR_FLAG_DUMMY)) {
1413 if (flags & PFR_FLAG_ATOMIC)
1415 pfr_insert_ktables(&addq);
1416 pfr_setflags_ktables(&changeq);
1417 if (flags & PFR_FLAG_ATOMIC)
1420 pfr_destroy_ktables(&addq, 0);
1425 pfr_destroy_ktables(&addq, 0);
1430 pfr_del_tables(struct pfr_table *tbl, int size, int *ndel, int flags)
1432 struct pfr_ktableworkq workq;
1433 struct pfr_ktable *p, *q, key;
1436 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
1438 for (i = 0; i < size; i++) {
1439 if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t), flags))
1441 if (pfr_validate_table(&key.pfrkt_t, 0,
1442 flags & PFR_FLAG_USERIOCTL))
1444 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1445 if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1446 SLIST_FOREACH(q, &workq, pfrkt_workq)
1447 if (!pfr_ktable_compare(p, q))
1449 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1450 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1457 if (!(flags & PFR_FLAG_DUMMY)) {
1458 if (flags & PFR_FLAG_ATOMIC)
1460 pfr_setflags_ktables(&workq);
1461 if (flags & PFR_FLAG_ATOMIC)
1470 pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size,
1473 struct pfr_ktable *p;
1476 ACCEPT_FLAGS(flags, PFR_FLAG_ALLRSETS);
1477 if (pfr_fix_anchor(filter->pfrt_anchor))
1479 n = nn = pfr_table_count(filter, flags);
1486 RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1487 if (pfr_skip_table(filter, p, flags))
1491 if (COPYOUT(&p->pfrkt_t, tbl++, sizeof(*tbl), flags))
1495 printf("pfr_get_tables: corruption detected (%d).\n", n);
1503 pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size,
1506 struct pfr_ktable *p;
1507 struct pfr_ktableworkq workq;
1509 long tzero = time_second;
1511 /* XXX PFR_FLAG_CLSTATS disabled */
1512 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_ALLRSETS);
1513 if (pfr_fix_anchor(filter->pfrt_anchor))
1515 n = nn = pfr_table_count(filter, flags);
1523 if (flags & PFR_FLAG_ATOMIC)
1525 RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1526 if (pfr_skip_table(filter, p, flags))
1530 if (!(flags & PFR_FLAG_ATOMIC))
1532 if (COPYOUT(&p->pfrkt_ts, tbl++, sizeof(*tbl), flags)) {
1536 if (!(flags & PFR_FLAG_ATOMIC))
1538 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1540 if (flags & PFR_FLAG_CLSTATS)
1541 pfr_clstats_ktables(&workq, tzero,
1542 flags & PFR_FLAG_ADDRSTOO);
1543 if (flags & PFR_FLAG_ATOMIC)
1546 printf("pfr_get_tstats: corruption detected (%d).\n", n);
1554 pfr_clr_tstats(struct pfr_table *tbl, int size, int *nzero, int flags)
1556 struct pfr_ktableworkq workq;
1557 struct pfr_ktable *p, key;
1558 int i, s, xzero = 0;
1559 long tzero = time_second;
1561 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
1564 for (i = 0; i < size; i++) {
1565 if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t), flags))
1567 if (pfr_validate_table(&key.pfrkt_t, 0, 0))
1569 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1571 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1575 if (!(flags & PFR_FLAG_DUMMY)) {
1576 if (flags & PFR_FLAG_ATOMIC)
1578 pfr_clstats_ktables(&workq, tzero, flags & PFR_FLAG_ADDRSTOO);
1579 if (flags & PFR_FLAG_ATOMIC)
1588 pfr_set_tflags(struct pfr_table *tbl, int size, int setflag, int clrflag,
1589 int *nchange, int *ndel, int flags)
1591 struct pfr_ktableworkq workq;
1592 struct pfr_ktable *p, *q, key;
1593 int i, s, xchange = 0, xdel = 0;
1595 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
1596 if ((setflag & ~PFR_TFLAG_USRMASK) ||
1597 (clrflag & ~PFR_TFLAG_USRMASK) ||
1598 (setflag & clrflag))
1601 for (i = 0; i < size; i++) {
1602 if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t), flags))
1604 if (pfr_validate_table(&key.pfrkt_t, 0,
1605 flags & PFR_FLAG_USERIOCTL))
1607 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1608 if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1609 p->pfrkt_nflags = (p->pfrkt_flags | setflag) &
1611 if (p->pfrkt_nflags == p->pfrkt_flags)
1613 SLIST_FOREACH(q, &workq, pfrkt_workq)
1614 if (!pfr_ktable_compare(p, q))
1616 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1617 if ((p->pfrkt_flags & PFR_TFLAG_PERSIST) &&
1618 (clrflag & PFR_TFLAG_PERSIST) &&
1619 !(p->pfrkt_flags & PFR_TFLAG_REFERENCED))
1627 if (!(flags & PFR_FLAG_DUMMY)) {
1628 if (flags & PFR_FLAG_ATOMIC)
1630 pfr_setflags_ktables(&workq);
1631 if (flags & PFR_FLAG_ATOMIC)
1634 if (nchange != NULL)
1642 pfr_ina_begin(struct pfr_table *trs, u_int32_t *ticket, int *ndel, int flags)
1644 struct pfr_ktableworkq workq;
1645 struct pfr_ktable *p;
1646 struct pf_ruleset *rs;
1649 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1650 rs = pf_find_or_create_ruleset(trs->pfrt_anchor);
1654 RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1655 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1656 pfr_skip_table(trs, p, 0))
1658 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1659 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1662 if (!(flags & PFR_FLAG_DUMMY)) {
1663 pfr_setflags_ktables(&workq);
1665 *ticket = ++rs->tticket;
1668 pf_remove_if_empty_ruleset(rs);
1675 pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size,
1676 int *nadd, int *naddr, u_int32_t ticket, int flags)
1678 struct pfr_ktableworkq tableq;
1679 struct pfr_kentryworkq addrq;
1680 struct pfr_ktable *kt, *rt, *shadow, key;
1681 struct pfr_kentry *p;
1683 struct pf_ruleset *rs;
1684 int i, rv, xadd = 0, xaddr = 0;
1686 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ADDRSTOO);
1687 if (size && !(flags & PFR_FLAG_ADDRSTOO))
1689 if (pfr_validate_table(tbl, PFR_TFLAG_USRMASK,
1690 flags & PFR_FLAG_USERIOCTL))
1692 rs = pf_find_ruleset(tbl->pfrt_anchor);
1693 if (rs == NULL || !rs->topen || ticket != rs->tticket)
1695 tbl->pfrt_flags |= PFR_TFLAG_INACTIVE;
1696 SLIST_INIT(&tableq);
1697 kt = RB_FIND(pfr_ktablehead, &pfr_ktables, (struct pfr_ktable *)tbl);
1699 kt = pfr_create_ktable(tbl, 0, 1,
1700 !(flags & PFR_FLAG_USERIOCTL));
1703 SLIST_INSERT_HEAD(&tableq, kt, pfrkt_workq);
1705 if (!tbl->pfrt_anchor[0])
1708 /* find or create root table */
1709 bzero(&key, sizeof(key));
1710 strlcpy(key.pfrkt_name, tbl->pfrt_name, sizeof(key.pfrkt_name));
1711 rt = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1713 kt->pfrkt_root = rt;
1716 rt = pfr_create_ktable(&key.pfrkt_t, 0, 1,
1717 !(flags & PFR_FLAG_USERIOCTL));
1719 pfr_destroy_ktables(&tableq, 0);
1722 SLIST_INSERT_HEAD(&tableq, rt, pfrkt_workq);
1723 kt->pfrkt_root = rt;
1724 } else if (!(kt->pfrkt_flags & PFR_TFLAG_INACTIVE))
1727 shadow = pfr_create_ktable(tbl, 0, 0, !(flags & PFR_FLAG_USERIOCTL));
1728 if (shadow == NULL) {
1729 pfr_destroy_ktables(&tableq, 0);
1733 for (i = 0; i < size; i++) {
1734 if (COPYIN(addr+i, &ad, sizeof(ad), flags))
1736 if (pfr_validate_addr(&ad))
1738 if (pfr_lookup_addr(shadow, &ad, 1) != NULL)
1740 p = pfr_create_kentry(&ad, 0);
1743 if (pfr_route_kentry(shadow, p)) {
1744 pfr_destroy_kentry(p);
1747 SLIST_INSERT_HEAD(&addrq, p, pfrke_workq);
1750 if (!(flags & PFR_FLAG_DUMMY)) {
1751 if (kt->pfrkt_shadow != NULL)
1752 pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1753 kt->pfrkt_flags |= PFR_TFLAG_INACTIVE;
1754 pfr_insert_ktables(&tableq);
1755 shadow->pfrkt_cnt = (flags & PFR_FLAG_ADDRSTOO) ?
1756 xaddr : NO_ADDRESSES;
1757 kt->pfrkt_shadow = shadow;
1759 pfr_clean_node_mask(shadow, &addrq);
1760 pfr_destroy_ktable(shadow, 0);
1761 pfr_destroy_ktables(&tableq, 0);
1762 pfr_destroy_kentries(&addrq);
1770 pfr_destroy_ktable(shadow, 0);
1771 pfr_destroy_ktables(&tableq, 0);
1772 pfr_destroy_kentries(&addrq);
1777 pfr_ina_rollback(struct pfr_table *trs, u_int32_t ticket, int *ndel, int flags)
1779 struct pfr_ktableworkq workq;
1780 struct pfr_ktable *p;
1781 struct pf_ruleset *rs;
1784 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1785 rs = pf_find_ruleset(trs->pfrt_anchor);
1786 if (rs == NULL || !rs->topen || ticket != rs->tticket)
1789 RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1790 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1791 pfr_skip_table(trs, p, 0))
1793 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1794 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1797 if (!(flags & PFR_FLAG_DUMMY)) {
1798 pfr_setflags_ktables(&workq);
1800 pf_remove_if_empty_ruleset(rs);
1808 pfr_ina_commit(struct pfr_table *trs, u_int32_t ticket, int *nadd,
1809 int *nchange, int flags)
1811 struct pfr_ktable *p, *q;
1812 struct pfr_ktableworkq workq;
1813 struct pf_ruleset *rs;
1814 int s, xadd = 0, xchange = 0;
1815 long tzero = time_second;
1817 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
1818 rs = pf_find_ruleset(trs->pfrt_anchor);
1819 if (rs == NULL || !rs->topen || ticket != rs->tticket)
1823 RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1824 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1825 pfr_skip_table(trs, p, 0))
1827 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1828 if (p->pfrkt_flags & PFR_TFLAG_ACTIVE)
1834 if (!(flags & PFR_FLAG_DUMMY)) {
1835 if (flags & PFR_FLAG_ATOMIC)
1837 for (p = SLIST_FIRST(&workq); p != NULL; p = q) {
1838 q = SLIST_NEXT(p, pfrkt_workq);
1839 pfr_commit_ktable(p, tzero);
1841 if (flags & PFR_FLAG_ATOMIC)
1844 pf_remove_if_empty_ruleset(rs);
1848 if (nchange != NULL)
1855 pfr_commit_ktable(struct pfr_ktable *kt, long tzero)
1857 struct pfr_ktable *shadow = kt->pfrkt_shadow;
1860 if (shadow->pfrkt_cnt == NO_ADDRESSES) {
1861 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1862 pfr_clstats_ktable(kt, tzero, 1);
1863 } else if (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) {
1864 /* kt might contain addresses */
1865 struct pfr_kentryworkq addrq, addq, changeq, delq, garbageq;
1866 struct pfr_kentry *p, *q, *next;
1869 pfr_enqueue_addrs(shadow, &addrq, NULL, 0);
1872 SLIST_INIT(&changeq);
1874 SLIST_INIT(&garbageq);
1875 pfr_clean_node_mask(shadow, &addrq);
1876 for (p = SLIST_FIRST(&addrq); p != NULL; p = next) {
1877 next = SLIST_NEXT(p, pfrke_workq); /* XXX */
1878 pfr_copyout_addr(&ad, p);
1879 q = pfr_lookup_addr(kt, &ad, 1);
1881 if (q->pfrke_not != p->pfrke_not)
1882 SLIST_INSERT_HEAD(&changeq, q,
1885 SLIST_INSERT_HEAD(&garbageq, p, pfrke_workq);
1887 p->pfrke_tzero = tzero;
1888 SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
1891 pfr_enqueue_addrs(kt, &delq, NULL, ENQUEUE_UNMARKED_ONLY);
1892 pfr_insert_kentries(kt, &addq, tzero);
1893 pfr_remove_kentries(kt, &delq);
1894 pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
1895 pfr_destroy_kentries(&garbageq);
1897 /* kt cannot contain addresses */
1898 SWAP(struct radix_node_head *, kt->pfrkt_ip4,
1900 SWAP(struct radix_node_head *, kt->pfrkt_ip6,
1902 SWAP(int, kt->pfrkt_cnt, shadow->pfrkt_cnt);
1903 pfr_clstats_ktable(kt, tzero, 1);
1905 nflags = ((shadow->pfrkt_flags & PFR_TFLAG_USRMASK) |
1906 (kt->pfrkt_flags & PFR_TFLAG_SETMASK) | PFR_TFLAG_ACTIVE)
1907 & ~PFR_TFLAG_INACTIVE;
1908 pfr_destroy_ktable(shadow, 0);
1909 kt->pfrkt_shadow = NULL;
1910 pfr_setflags_ktable(kt, nflags);
1914 pfr_validate_table(struct pfr_table *tbl, int allowedflags, int no_reserved)
1918 if (!tbl->pfrt_name[0])
1920 if (no_reserved && !strcmp(tbl->pfrt_anchor, PF_RESERVED_ANCHOR))
1922 if (tbl->pfrt_name[PF_TABLE_NAME_SIZE-1])
1924 for (i = strlen(tbl->pfrt_name); i < PF_TABLE_NAME_SIZE; i++)
1925 if (tbl->pfrt_name[i])
1927 if (pfr_fix_anchor(tbl->pfrt_anchor))
1929 if (tbl->pfrt_flags & ~allowedflags)
1935 * Rewrite anchors referenced by tables to remove slashes
1936 * and check for validity.
1939 pfr_fix_anchor(char *anchor)
1941 size_t siz = MAXPATHLEN;
1944 if (anchor[0] == '/') {
1950 while (*++path == '/')
1952 bcopy(path, anchor, siz - off);
1953 memset(anchor + siz - off, 0, off);
1955 if (anchor[siz - 1])
1957 for (i = strlen(anchor); i < siz; i++)
1964 pfr_table_count(struct pfr_table *filter, int flags)
1966 struct pf_ruleset *rs;
1968 if (flags & PFR_FLAG_ALLRSETS)
1969 return (pfr_ktable_cnt);
1970 if (filter->pfrt_anchor[0]) {
1971 rs = pf_find_ruleset(filter->pfrt_anchor);
1972 return ((rs != NULL) ? rs->tables : -1);
1974 return (pf_main_ruleset.tables);
1978 pfr_skip_table(struct pfr_table *filter, struct pfr_ktable *kt, int flags)
1980 if (flags & PFR_FLAG_ALLRSETS)
1982 if (strcmp(filter->pfrt_anchor, kt->pfrkt_anchor))
1988 pfr_insert_ktables(struct pfr_ktableworkq *workq)
1990 struct pfr_ktable *p;
1992 SLIST_FOREACH(p, workq, pfrkt_workq)
1993 pfr_insert_ktable(p);
1997 pfr_insert_ktable(struct pfr_ktable *kt)
1999 RB_INSERT(pfr_ktablehead, &pfr_ktables, kt);
2001 if (kt->pfrkt_root != NULL)
2002 if (!kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]++)
2003 pfr_setflags_ktable(kt->pfrkt_root,
2004 kt->pfrkt_root->pfrkt_flags|PFR_TFLAG_REFDANCHOR);
2008 pfr_setflags_ktables(struct pfr_ktableworkq *workq)
2010 struct pfr_ktable *p, *q;
2012 for (p = SLIST_FIRST(workq); p; p = q) {
2013 q = SLIST_NEXT(p, pfrkt_workq);
2014 pfr_setflags_ktable(p, p->pfrkt_nflags);
2019 pfr_setflags_ktable(struct pfr_ktable *kt, int newf)
2021 struct pfr_kentryworkq addrq;
2023 if (!(newf & PFR_TFLAG_REFERENCED) &&
2024 !(newf & PFR_TFLAG_PERSIST))
2025 newf &= ~PFR_TFLAG_ACTIVE;
2026 if (!(newf & PFR_TFLAG_ACTIVE))
2027 newf &= ~PFR_TFLAG_USRMASK;
2028 if (!(newf & PFR_TFLAG_SETMASK)) {
2029 RB_REMOVE(pfr_ktablehead, &pfr_ktables, kt);
2030 if (kt->pfrkt_root != NULL)
2031 if (!--kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR])
2032 pfr_setflags_ktable(kt->pfrkt_root,
2033 kt->pfrkt_root->pfrkt_flags &
2034 ~PFR_TFLAG_REFDANCHOR);
2035 pfr_destroy_ktable(kt, 1);
2039 if (!(newf & PFR_TFLAG_ACTIVE) && kt->pfrkt_cnt) {
2040 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
2041 pfr_remove_kentries(kt, &addrq);
2043 if (!(newf & PFR_TFLAG_INACTIVE) && kt->pfrkt_shadow != NULL) {
2044 pfr_destroy_ktable(kt->pfrkt_shadow, 1);
2045 kt->pfrkt_shadow = NULL;
2047 kt->pfrkt_flags = newf;
2051 pfr_clstats_ktables(struct pfr_ktableworkq *workq, long tzero, int recurse)
2053 struct pfr_ktable *p;
2055 SLIST_FOREACH(p, workq, pfrkt_workq)
2056 pfr_clstats_ktable(p, tzero, recurse);
2060 pfr_clstats_ktable(struct pfr_ktable *kt, long tzero, int recurse)
2062 struct pfr_kentryworkq addrq;
2066 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
2067 pfr_clstats_kentries(&addrq, tzero, 0);
2070 bzero(kt->pfrkt_packets, sizeof(kt->pfrkt_packets));
2071 bzero(kt->pfrkt_bytes, sizeof(kt->pfrkt_bytes));
2072 kt->pfrkt_match = kt->pfrkt_nomatch = 0;
2074 kt->pfrkt_tzero = tzero;
2078 pfr_create_ktable(struct pfr_table *tbl, long tzero, int attachruleset,
2081 struct pfr_ktable *kt;
2082 struct pf_ruleset *rs;
2086 kt = pool_get(&V_pfr_ktable_pl, PR_NOWAIT|PR_ZERO);
2088 kt = pool_get(&pfr_ktable_pl, PR_NOWAIT|PR_ZERO|PR_LIMITFAIL);
2092 kt = pool_get(&V_pfr_ktable_pl, PR_WAITOK|PR_ZERO);
2094 kt = pool_get(&pfr_ktable_pl, PR_WAITOK|PR_ZERO|PR_LIMITFAIL);
2100 if (attachruleset) {
2101 rs = pf_find_or_create_ruleset(tbl->pfrt_anchor);
2103 pfr_destroy_ktable(kt, 0);
2110 if (!rn_inithead((void **)&kt->pfrkt_ip4,
2111 offsetof(struct sockaddr_in, sin_addr) * 8) ||
2112 !rn_inithead((void **)&kt->pfrkt_ip6,
2113 offsetof(struct sockaddr_in6, sin6_addr) * 8)) {
2114 pfr_destroy_ktable(kt, 0);
2117 kt->pfrkt_tzero = tzero;
2123 pfr_destroy_ktables(struct pfr_ktableworkq *workq, int flushaddr)
2125 struct pfr_ktable *p, *q;
2127 for (p = SLIST_FIRST(workq); p; p = q) {
2128 q = SLIST_NEXT(p, pfrkt_workq);
2129 pfr_destroy_ktable(p, flushaddr);
2134 pfr_destroy_ktable(struct pfr_ktable *kt, int flushaddr)
2136 struct pfr_kentryworkq addrq;
2139 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
2140 pfr_clean_node_mask(kt, &addrq);
2141 pfr_destroy_kentries(&addrq);
2143 #if defined(__FreeBSD__) && (__FreeBSD_version >= 500100)
2144 if (kt->pfrkt_ip4 != NULL) {
2145 RADIX_NODE_HEAD_DESTROY(kt->pfrkt_ip4);
2146 free((caddr_t)kt->pfrkt_ip4, M_RTABLE);
2148 if (kt->pfrkt_ip6 != NULL) {
2149 RADIX_NODE_HEAD_DESTROY(kt->pfrkt_ip6);
2150 free((caddr_t)kt->pfrkt_ip6, M_RTABLE);
2153 if (kt->pfrkt_ip4 != NULL)
2154 free((caddr_t)kt->pfrkt_ip4, M_RTABLE);
2155 if (kt->pfrkt_ip6 != NULL)
2156 free((caddr_t)kt->pfrkt_ip6, M_RTABLE);
2158 if (kt->pfrkt_shadow != NULL)
2159 pfr_destroy_ktable(kt->pfrkt_shadow, flushaddr);
2160 if (kt->pfrkt_rs != NULL) {
2161 kt->pfrkt_rs->tables--;
2162 pf_remove_if_empty_ruleset(kt->pfrkt_rs);
2165 pool_put(&V_pfr_ktable_pl, kt);
2167 pool_put(&pfr_ktable_pl, kt);
2172 pfr_ktable_compare(struct pfr_ktable *p, struct pfr_ktable *q)
2176 if ((d = strncmp(p->pfrkt_name, q->pfrkt_name, PF_TABLE_NAME_SIZE)))
2178 return (strcmp(p->pfrkt_anchor, q->pfrkt_anchor));
2182 pfr_lookup_table(struct pfr_table *tbl)
2184 /* struct pfr_ktable start like a struct pfr_table */
2185 return (RB_FIND(pfr_ktablehead, &pfr_ktables,
2186 (struct pfr_ktable *)tbl));
2190 pfr_match_addr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af)
2192 struct pfr_kentry *ke = NULL;
2195 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2196 kt = kt->pfrkt_root;
2197 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2204 V_pfr_sin.sin_addr.s_addr = a->addr32[0];
2205 ke = (struct pfr_kentry *)rn_match(&V_pfr_sin, kt->pfrkt_ip4);
2207 pfr_sin.sin_addr.s_addr = a->addr32[0];
2208 ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4);
2210 if (ke && KENTRY_RNF_ROOT(ke))
2217 bcopy(a, &V_pfr_sin6.sin6_addr, sizeof(V_pfr_sin6.sin6_addr));
2218 ke = (struct pfr_kentry *)rn_match(&V_pfr_sin6, kt->pfrkt_ip6);
2220 bcopy(a, &pfr_sin6.sin6_addr, sizeof(pfr_sin6.sin6_addr));
2221 ke = (struct pfr_kentry *)rn_match(&pfr_sin6, kt->pfrkt_ip6);
2223 if (ke && KENTRY_RNF_ROOT(ke))
2228 match = (ke && !ke->pfrke_not);
2232 kt->pfrkt_nomatch++;
2237 pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af,
2238 u_int64_t len, int dir_out, int op_pass, int notrule)
2240 struct pfr_kentry *ke = NULL;
2242 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2243 kt = kt->pfrkt_root;
2244 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2251 V_pfr_sin.sin_addr.s_addr = a->addr32[0];
2252 ke = (struct pfr_kentry *)rn_match(&V_pfr_sin, kt->pfrkt_ip4);
2254 pfr_sin.sin_addr.s_addr = a->addr32[0];
2255 ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4);
2257 if (ke && KENTRY_RNF_ROOT(ke))
2264 bcopy(a, &V_pfr_sin6.sin6_addr, sizeof(V_pfr_sin6.sin6_addr));
2265 ke = (struct pfr_kentry *)rn_match(&V_pfr_sin6, kt->pfrkt_ip6);
2267 bcopy(a, &pfr_sin6.sin6_addr, sizeof(pfr_sin6.sin6_addr));
2268 ke = (struct pfr_kentry *)rn_match(&pfr_sin6, kt->pfrkt_ip6);
2270 if (ke && KENTRY_RNF_ROOT(ke))
2277 if ((ke == NULL || ke->pfrke_not) != notrule) {
2278 if (op_pass != PFR_OP_PASS)
2279 printf("pfr_update_stats: assertion failed.\n");
2280 op_pass = PFR_OP_XPASS;
2282 kt->pfrkt_packets[dir_out][op_pass]++;
2283 kt->pfrkt_bytes[dir_out][op_pass] += len;
2284 if (ke != NULL && op_pass != PFR_OP_XPASS &&
2285 (kt->pfrkt_flags & PFR_TFLAG_COUNTERS)) {
2286 if (ke->pfrke_counters == NULL)
2288 ke->pfrke_counters = pool_get(&V_pfr_kcounters_pl,
2290 ke->pfrke_counters = pool_get(&pfr_kcounters_pl,
2292 PR_NOWAIT | PR_ZERO);
2293 if (ke->pfrke_counters != NULL) {
2294 ke->pfrke_counters->pfrkc_packets[dir_out][op_pass]++;
2295 ke->pfrke_counters->pfrkc_bytes[dir_out][op_pass] += len;
2301 pfr_attach_table(struct pf_ruleset *rs, char *name, int intr)
2303 struct pfr_ktable *kt, *rt;
2304 struct pfr_table tbl;
2305 struct pf_anchor *ac = rs->anchor;
2307 bzero(&tbl, sizeof(tbl));
2308 strlcpy(tbl.pfrt_name, name, sizeof(tbl.pfrt_name));
2310 strlcpy(tbl.pfrt_anchor, ac->path, sizeof(tbl.pfrt_anchor));
2311 kt = pfr_lookup_table(&tbl);
2313 kt = pfr_create_ktable(&tbl, time_second, 1, intr);
2317 bzero(tbl.pfrt_anchor, sizeof(tbl.pfrt_anchor));
2318 rt = pfr_lookup_table(&tbl);
2320 rt = pfr_create_ktable(&tbl, 0, 1, intr);
2322 pfr_destroy_ktable(kt, 0);
2325 pfr_insert_ktable(rt);
2327 kt->pfrkt_root = rt;
2329 pfr_insert_ktable(kt);
2331 if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++)
2332 pfr_setflags_ktable(kt, kt->pfrkt_flags|PFR_TFLAG_REFERENCED);
2337 pfr_detach_table(struct pfr_ktable *kt)
2339 if (kt->pfrkt_refcnt[PFR_REFCNT_RULE] <= 0)
2340 printf("pfr_detach_table: refcount = %d.\n",
2341 kt->pfrkt_refcnt[PFR_REFCNT_RULE]);
2342 else if (!--kt->pfrkt_refcnt[PFR_REFCNT_RULE])
2343 pfr_setflags_ktable(kt, kt->pfrkt_flags&~PFR_TFLAG_REFERENCED);
2347 pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter,
2348 struct pf_addr **raddr, struct pf_addr **rmask, sa_family_t af)
2351 struct pfr_kentry *ke, *ke2 = NULL;
2352 struct pf_addr *addr = NULL;
2354 struct pfr_kentry *ke, *ke2;
2355 struct pf_addr *addr;
2357 union sockaddr_union mask;
2358 int idx = -1, use_counter = 0;
2362 addr = (struct pf_addr *)&V_pfr_sin.sin_addr;
2363 else if (af == AF_INET6)
2364 addr = (struct pf_addr *)&V_pfr_sin6.sin6_addr;
2367 addr = (struct pf_addr *)&pfr_sin.sin_addr;
2368 else if (af == AF_INET6)
2369 addr = (struct pf_addr *)&pfr_sin6.sin6_addr;
2371 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2372 kt = kt->pfrkt_root;
2373 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2378 if (counter != NULL && idx >= 0)
2384 ke = pfr_kentry_byidx(kt, idx, af);
2386 kt->pfrkt_nomatch++;
2390 pfr_prepare_network(&V_pfr_mask, af, ke->pfrke_net);
2392 pfr_prepare_network(&pfr_mask, af, ke->pfrke_net);
2394 *raddr = SUNION2PF(&ke->pfrke_sa, af);
2396 *rmask = SUNION2PF(&V_pfr_mask, af);
2398 *rmask = SUNION2PF(&pfr_mask, af);
2402 /* is supplied address within block? */
2403 if (!PF_MATCHA(0, *raddr, *rmask, counter, af)) {
2404 /* no, go to next block in table */
2409 PF_ACPY(addr, counter, af);
2411 /* use first address of block */
2412 PF_ACPY(addr, *raddr, af);
2415 if (!KENTRY_NETWORK(ke)) {
2416 /* this is a single IP address - no possible nested block */
2417 PF_ACPY(counter, addr, af);
2423 /* we don't want to use a nested block */
2426 ke2 = (struct pfr_kentry *)rn_match(&V_pfr_sin,
2428 else if (af == AF_INET6)
2429 ke2 = (struct pfr_kentry *)rn_match(&V_pfr_sin6,
2433 ke2 = (struct pfr_kentry *)rn_match(&pfr_sin,
2435 else if (af == AF_INET6)
2436 ke2 = (struct pfr_kentry *)rn_match(&pfr_sin6,
2439 /* no need to check KENTRY_RNF_ROOT() here */
2441 /* lookup return the same block - perfect */
2442 PF_ACPY(counter, addr, af);
2448 /* we need to increase the counter past the nested block */
2449 pfr_prepare_network(&mask, AF_INET, ke2->pfrke_net);
2451 PF_POOLMASK(addr, addr, SUNION2PF(&mask, af), &V_pfr_ffaddr, af);
2453 PF_POOLMASK(addr, addr, SUNION2PF(&mask, af), &pfr_ffaddr, af);
2456 if (!PF_MATCHA(0, *raddr, *rmask, addr, af)) {
2457 /* ok, we reached the end of our main block */
2458 /* go to next block in table */
2467 pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af)
2469 struct pfr_walktree w;
2471 bzero(&w, sizeof(w));
2472 w.pfrw_op = PFRW_POOL_GET;
2479 kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
2481 rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
2483 return (w.pfrw_kentry);
2488 kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
2490 rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
2492 return (w.pfrw_kentry);
2500 pfr_dynaddr_update(struct pfr_ktable *kt, struct pfi_dynaddr *dyn)
2502 struct pfr_walktree w;
2505 bzero(&w, sizeof(w));
2506 w.pfrw_op = PFRW_DYNADDR_UPDATE;
2510 dyn->pfid_acnt4 = 0;
2511 dyn->pfid_acnt6 = 0;
2512 if (!dyn->pfid_af || dyn->pfid_af == AF_INET)
2514 kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
2516 rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
2518 if (!dyn->pfid_af || dyn->pfid_af == AF_INET6)
2520 kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
2522 rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w);