1/*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2002 Cedric Berger 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * - Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * - Redistributions in binary form must reproduce the above 14 * copyright notice, this list of conditions and the following 15 * disclaimer in the documentation and/or other materials provided 16 * with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 20 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 21 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 22 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 24 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 25 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 26 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 28 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 * 31 * $OpenBSD: pf_table.c,v 1.79 2008/10/08 06:24:50 mcbride Exp $ 32 */ 33 34#include <sys/cdefs.h> 35#include "opt_inet.h" 36#include "opt_inet6.h" 37 38#include <sys/param.h> 39#include <sys/kernel.h> 40#include <sys/lock.h> 41#include <sys/malloc.h> 42#include <sys/mbuf.h> 43#include <sys/mutex.h> 44#include <sys/refcount.h> 45#include <sys/socket.h> 46#include <vm/uma.h> 47 48#include <net/if.h> 49#include <net/vnet.h> 50#include <net/pfvar.h> 51 52#define DPFPRINTF(n, x) if (V_pf_status.debug >= (n)) printf x 53 54#define ACCEPT_FLAGS(flags, oklist) \ 55 do { \ 56 if ((flags & ~(oklist)) & \ 57 PFR_FLAG_ALLMASK) \ 58 return (EINVAL); \ 59 } while (0) 60 61#define FILLIN_SIN(sin, addr) \ 62 do { \ 63 (sin).sin_len = sizeof(sin); \ 64 (sin).sin_family = AF_INET; \ 65 (sin).sin_addr = (addr); \ 66 } while (0) 67 68#define FILLIN_SIN6(sin6, addr) \ 69 do { \ 70 (sin6).sin6_len = sizeof(sin6); \ 71 (sin6).sin6_family = AF_INET6; \ 72 (sin6).sin6_addr = (addr); \ 73 } while (0) 74 75#define SWAP(type, a1, a2) \ 76 do { \ 77 type tmp = a1; \ 78 a1 = a2; \ 79 a2 = tmp; \ 80 } while (0) 81 82#define SUNION2PF(su, af) (((af)==AF_INET) ? \ 83 (struct pf_addr *)&(su)->sin.sin_addr : \ 84 (struct pf_addr *)&(su)->sin6.sin6_addr) 85 86#define AF_BITS(af) (((af)==AF_INET)?32:128) 87#define ADDR_NETWORK(ad) ((ad)->pfra_net < AF_BITS((ad)->pfra_af)) 88#define KENTRY_NETWORK(ke) ((ke)->pfrke_net < AF_BITS((ke)->pfrke_af)) 89#define KENTRY_RNF_ROOT(ke) \ 90 ((((struct radix_node *)(ke))->rn_flags & RNF_ROOT) != 0) 91 92#define NO_ADDRESSES (-1) 93#define ENQUEUE_UNMARKED_ONLY (1) 94#define INVERT_NEG_FLAG (1) 95 96struct pfr_walktree { 97 enum pfrw_op { 98 PFRW_MARK, 99 PFRW_SWEEP, 100 PFRW_ENQUEUE, 101 PFRW_GET_ADDRS, 102 PFRW_GET_ASTATS, 103 PFRW_POOL_GET, 104 PFRW_DYNADDR_UPDATE, 105 PFRW_COUNTERS 106 } pfrw_op; 107 union { 108 struct pfr_addr *pfrw_addr; 109 struct pfr_astats *pfrw_astats; 110 struct pfr_kentryworkq *pfrw_workq; 111 struct pfr_kentry *pfrw_kentry; 112 struct pfi_dynaddr *pfrw_dyn; 113 }; 114 int pfrw_free; 115 int pfrw_flags; 116}; 117 118#define senderr(e) do { rv = (e); goto _bad; } while (0) 119 120static MALLOC_DEFINE(M_PFTABLE, "pf_table", "pf(4) tables structures"); 121VNET_DEFINE_STATIC(uma_zone_t, pfr_kentry_z); 122#define V_pfr_kentry_z VNET(pfr_kentry_z) 123VNET_DEFINE_STATIC(uma_zone_t, pfr_kentry_counter_z); 124#define V_pfr_kentry_counter_z VNET(pfr_kentry_counter_z) 125 126static struct pf_addr pfr_ffaddr = { 127 .addr32 = { 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff } 128}; 129 130static void pfr_copyout_astats(struct pfr_astats *, 131 const struct pfr_kentry *, 132 const struct pfr_walktree *); 133static void pfr_copyout_addr(struct pfr_addr *, 134 const struct pfr_kentry *ke); 135static int pfr_validate_addr(struct pfr_addr *); 136static void pfr_enqueue_addrs(struct pfr_ktable *, 137 struct pfr_kentryworkq *, int *, int); 138static void pfr_mark_addrs(struct pfr_ktable *); 139static struct pfr_kentry 140 *pfr_lookup_addr(struct pfr_ktable *, 141 struct pfr_addr *, int); 142static struct pfr_kentry *pfr_create_kentry(struct pfr_addr *, bool); 143static void pfr_destroy_kentries(struct pfr_kentryworkq *); 144static void pfr_destroy_kentry(struct pfr_kentry *); 145static void pfr_insert_kentries(struct pfr_ktable *, 146 struct pfr_kentryworkq *, long); 147static void pfr_remove_kentries(struct pfr_ktable *, 148 struct pfr_kentryworkq *); 149static void pfr_clstats_kentries(struct pfr_ktable *, 150 struct pfr_kentryworkq *, long, int); 151static void pfr_reset_feedback(struct pfr_addr *, int); 152static void pfr_prepare_network(union sockaddr_union *, int, int); 153static int pfr_route_kentry(struct pfr_ktable *, 154 struct pfr_kentry *); 155static int pfr_unroute_kentry(struct pfr_ktable *, 156 struct pfr_kentry *); 157static int pfr_walktree(struct radix_node *, void *); 158static int pfr_validate_table(struct pfr_table *, int, int); 159static int pfr_fix_anchor(char *); 160static void pfr_commit_ktable(struct pfr_ktable *, long); 161static void pfr_insert_ktables(struct pfr_ktableworkq *); 162static void pfr_insert_ktable(struct pfr_ktable *); 163static void pfr_setflags_ktables(struct pfr_ktableworkq *); 164static void pfr_setflags_ktable(struct pfr_ktable *, int); 165static void pfr_clstats_ktables(struct pfr_ktableworkq *, long, 166 int); 167static void pfr_clstats_ktable(struct pfr_ktable *, long, int); 168static struct pfr_ktable 169 *pfr_create_ktable(struct pfr_table *, long, int); 170static void pfr_destroy_ktables(struct pfr_ktableworkq *, int); 171static void pfr_destroy_ktable(struct pfr_ktable *, int); 172static int pfr_ktable_compare(struct pfr_ktable *, 173 struct pfr_ktable *); 174static struct pfr_ktable 175 *pfr_lookup_table(struct pfr_table *); 176static void pfr_clean_node_mask(struct pfr_ktable *, 177 struct pfr_kentryworkq *); 178static int pfr_skip_table(struct pfr_table *, 179 struct pfr_ktable *, int); 180static struct pfr_kentry 181 *pfr_kentry_byidx(struct pfr_ktable *, int, int); 182 183static RB_PROTOTYPE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare); 184static RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare); 185 186VNET_DEFINE_STATIC(struct pfr_ktablehead, pfr_ktables); 187#define V_pfr_ktables VNET(pfr_ktables) 188 189VNET_DEFINE_STATIC(struct pfr_table, pfr_nulltable); 190#define V_pfr_nulltable VNET(pfr_nulltable) 191 192VNET_DEFINE_STATIC(int, pfr_ktable_cnt); 193#define V_pfr_ktable_cnt VNET(pfr_ktable_cnt) 194 195void 196pfr_initialize(void) 197{ 198 199 V_pfr_kentry_counter_z = uma_zcreate("pf table entry counters", 200 PFR_NUM_COUNTERS * sizeof(uint64_t), NULL, NULL, NULL, NULL, 201 UMA_ALIGN_PTR, UMA_ZONE_PCPU); 202 V_pfr_kentry_z = uma_zcreate("pf table entries", 203 sizeof(struct pfr_kentry), NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 204 0); 205 uma_zone_set_max(V_pfr_kentry_z, PFR_KENTRY_HIWAT); 206 V_pf_limits[PF_LIMIT_TABLE_ENTRIES].zone = V_pfr_kentry_z; 207 V_pf_limits[PF_LIMIT_TABLE_ENTRIES].limit = PFR_KENTRY_HIWAT; 208} 209 210void 211pfr_cleanup(void) 212{ 213 214 uma_zdestroy(V_pfr_kentry_z); 215 uma_zdestroy(V_pfr_kentry_counter_z); 216} 217 218int 219pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags) 220{ 221 struct pfr_ktable *kt; 222 struct pfr_kentryworkq workq; 223 224 PF_RULES_WASSERT(); 225 226 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY); 227 if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL)) 228 return (EINVAL); 229 kt = pfr_lookup_table(tbl); 230 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 231 return (ESRCH); 232 if (kt->pfrkt_flags & PFR_TFLAG_CONST) 233 return (EPERM); 234 pfr_enqueue_addrs(kt, &workq, ndel, 0); 235 236 if (!(flags & PFR_FLAG_DUMMY)) { 237 pfr_remove_kentries(kt, &workq); 238 KASSERT(kt->pfrkt_cnt == 0, ("%s: non-null pfrkt_cnt", __func__)); 239 } 240 return (0); 241} 242 243int 244pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size, 245 int *nadd, int flags) 246{ 247 struct pfr_ktable *kt, *tmpkt; 248 struct pfr_kentryworkq workq; 249 struct pfr_kentry *p, *q; 250 struct pfr_addr *ad; 251 int i, rv, xadd = 0; 252 long tzero = time_second; 253 254 PF_RULES_WASSERT(); 255 256 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK); 257 if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL)) 258 return (EINVAL); 259 kt = pfr_lookup_table(tbl); 260 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 261 return (ESRCH); 262 if (kt->pfrkt_flags & PFR_TFLAG_CONST) 263 return (EPERM); 264 tmpkt = pfr_create_ktable(&V_pfr_nulltable, 0, 0); 265 if (tmpkt == NULL) 266 return (ENOMEM); 267 SLIST_INIT(&workq); 268 for (i = 0, ad = addr; i < size; i++, ad++) { 269 if (pfr_validate_addr(ad)) 270 senderr(EINVAL); 271 p = pfr_lookup_addr(kt, ad, 1); 272 q = pfr_lookup_addr(tmpkt, ad, 1); 273 if (flags & PFR_FLAG_FEEDBACK) { 274 if (q != NULL) 275 ad->pfra_fback = PFR_FB_DUPLICATE; 276 else if (p == NULL) 277 ad->pfra_fback = PFR_FB_ADDED; 278 else if (p->pfrke_not != ad->pfra_not) 279 ad->pfra_fback = PFR_FB_CONFLICT; 280 else 281 ad->pfra_fback = PFR_FB_NONE; 282 } 283 if (p == NULL && q == NULL) { 284 p = pfr_create_kentry(ad, 285 (kt->pfrkt_flags & PFR_TFLAG_COUNTERS) != 0); 286 if (p == NULL) 287 senderr(ENOMEM); 288 if (pfr_route_kentry(tmpkt, p)) { 289 pfr_destroy_kentry(p); 290 ad->pfra_fback = PFR_FB_NONE; 291 } else { 292 SLIST_INSERT_HEAD(&workq, p, pfrke_workq); 293 xadd++; 294 } 295 } 296 } 297 pfr_clean_node_mask(tmpkt, &workq); 298 if (!(flags & PFR_FLAG_DUMMY)) 299 pfr_insert_kentries(kt, &workq, tzero); 300 else 301 pfr_destroy_kentries(&workq); 302 if (nadd != NULL) 303 *nadd = xadd; 304 pfr_destroy_ktable(tmpkt, 0); 305 return (0); 306_bad: 307 pfr_clean_node_mask(tmpkt, &workq); 308 pfr_destroy_kentries(&workq); 309 if (flags & PFR_FLAG_FEEDBACK) 310 pfr_reset_feedback(addr, size); 311 pfr_destroy_ktable(tmpkt, 0); 312 return (rv); 313} 314 315int 316pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size, 317 int *ndel, int flags) 318{ 319 struct pfr_ktable *kt; 320 struct pfr_kentryworkq workq; 321 struct pfr_kentry *p; 322 struct pfr_addr *ad; 323 int i, rv, xdel = 0, log = 1; 324 325 PF_RULES_WASSERT(); 326 327 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK); 328 if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL)) 329 return (EINVAL); 330 kt = pfr_lookup_table(tbl); 331 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 332 return (ESRCH); 333 if (kt->pfrkt_flags & PFR_TFLAG_CONST) 334 return (EPERM); 335 /* 336 * there are two algorithms to choose from here. 337 * with: 338 * n: number of addresses to delete 339 * N: number of addresses in the table 340 * 341 * one is O(N) and is better for large 'n' 342 * one is O(n*LOG(N)) and is better for small 'n' 343 * 344 * following code try to decide which one is best. 345 */ 346 for (i = kt->pfrkt_cnt; i > 0; i >>= 1) 347 log++; 348 if (size > kt->pfrkt_cnt/log) { 349 /* full table scan */ 350 pfr_mark_addrs(kt); 351 } else { 352 /* iterate over addresses to delete */ 353 for (i = 0, ad = addr; i < size; i++, ad++) { 354 if (pfr_validate_addr(ad)) 355 return (EINVAL); 356 p = pfr_lookup_addr(kt, ad, 1); 357 if (p != NULL) 358 p->pfrke_mark = 0; 359 } 360 } 361 SLIST_INIT(&workq); 362 for (i = 0, ad = addr; i < size; i++, ad++) { 363 if (pfr_validate_addr(ad)) 364 senderr(EINVAL); 365 p = pfr_lookup_addr(kt, ad, 1); 366 if (flags & PFR_FLAG_FEEDBACK) { 367 if (p == NULL) 368 ad->pfra_fback = PFR_FB_NONE; 369 else if (p->pfrke_not != ad->pfra_not) 370 ad->pfra_fback = PFR_FB_CONFLICT; 371 else if (p->pfrke_mark) 372 ad->pfra_fback = PFR_FB_DUPLICATE; 373 else 374 ad->pfra_fback = PFR_FB_DELETED; 375 } 376 if (p != NULL && p->pfrke_not == ad->pfra_not && 377 !p->pfrke_mark) { 378 p->pfrke_mark = 1; 379 SLIST_INSERT_HEAD(&workq, p, pfrke_workq); 380 xdel++; 381 } 382 } 383 if (!(flags & PFR_FLAG_DUMMY)) 384 pfr_remove_kentries(kt, &workq); 385 if (ndel != NULL) 386 *ndel = xdel; 387 return (0); 388_bad: 389 if (flags & PFR_FLAG_FEEDBACK) 390 pfr_reset_feedback(addr, size); 391 return (rv); 392} 393 394int 395pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size, 396 int *size2, int *nadd, int *ndel, int *nchange, int flags, 397 u_int32_t ignore_pfrt_flags) 398{ 399 struct pfr_ktable *kt, *tmpkt; 400 struct pfr_kentryworkq addq, delq, changeq; 401 struct pfr_kentry *p, *q; 402 struct pfr_addr ad; 403 int i, rv, xadd = 0, xdel = 0, xchange = 0; 404 long tzero = time_second; 405 406 PF_RULES_WASSERT(); 407 408 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK); 409 if (pfr_validate_table(tbl, ignore_pfrt_flags, flags & 410 PFR_FLAG_USERIOCTL)) 411 return (EINVAL); 412 kt = pfr_lookup_table(tbl); 413 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 414 return (ESRCH); 415 if (kt->pfrkt_flags & PFR_TFLAG_CONST) 416 return (EPERM); 417 tmpkt = pfr_create_ktable(&V_pfr_nulltable, 0, 0); 418 if (tmpkt == NULL) 419 return (ENOMEM); 420 pfr_mark_addrs(kt); 421 SLIST_INIT(&addq); 422 SLIST_INIT(&delq); 423 SLIST_INIT(&changeq); 424 for (i = 0; i < size; i++) { 425 /* 426 * XXXGL: undertand pf_if usage of this function 427 * and make ad a moving pointer 428 */ 429 bcopy(addr + i, &ad, sizeof(ad)); 430 if (pfr_validate_addr(&ad)) 431 senderr(EINVAL); 432 ad.pfra_fback = PFR_FB_NONE; 433 p = pfr_lookup_addr(kt, &ad, 1); 434 if (p != NULL) { 435 if (p->pfrke_mark) { 436 ad.pfra_fback = PFR_FB_DUPLICATE; 437 goto _skip; 438 } 439 p->pfrke_mark = 1; 440 if (p->pfrke_not != ad.pfra_not) { 441 SLIST_INSERT_HEAD(&changeq, p, pfrke_workq); 442 ad.pfra_fback = PFR_FB_CHANGED; 443 xchange++; 444 } 445 } else { 446 q = pfr_lookup_addr(tmpkt, &ad, 1); 447 if (q != NULL) { 448 ad.pfra_fback = PFR_FB_DUPLICATE; 449 goto _skip; 450 } 451 p = pfr_create_kentry(&ad, 452 (kt->pfrkt_flags & PFR_TFLAG_COUNTERS) != 0); 453 if (p == NULL) 454 senderr(ENOMEM); 455 if (pfr_route_kentry(tmpkt, p)) { 456 pfr_destroy_kentry(p); 457 ad.pfra_fback = PFR_FB_NONE; 458 } else { 459 SLIST_INSERT_HEAD(&addq, p, pfrke_workq); 460 ad.pfra_fback = PFR_FB_ADDED; 461 xadd++; 462 } 463 } 464_skip: 465 if (flags & PFR_FLAG_FEEDBACK) 466 bcopy(&ad, addr + i, sizeof(ad)); 467 } 468 pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY); 469 if ((flags & PFR_FLAG_FEEDBACK) && *size2) { 470 if (*size2 < size+xdel) { 471 *size2 = size+xdel; 472 senderr(0); 473 } 474 i = 0; 475 SLIST_FOREACH(p, &delq, pfrke_workq) { 476 pfr_copyout_addr(&ad, p); 477 ad.pfra_fback = PFR_FB_DELETED; 478 bcopy(&ad, addr + size + i, sizeof(ad)); 479 i++; 480 } 481 } 482 pfr_clean_node_mask(tmpkt, &addq); 483 if (!(flags & PFR_FLAG_DUMMY)) { 484 pfr_insert_kentries(kt, &addq, tzero); 485 pfr_remove_kentries(kt, &delq); 486 pfr_clstats_kentries(kt, &changeq, tzero, INVERT_NEG_FLAG); 487 } else 488 pfr_destroy_kentries(&addq); 489 if (nadd != NULL) 490 *nadd = xadd; 491 if (ndel != NULL) 492 *ndel = xdel; 493 if (nchange != NULL) 494 *nchange = xchange; 495 if ((flags & PFR_FLAG_FEEDBACK) && size2) 496 *size2 = size+xdel; 497 pfr_destroy_ktable(tmpkt, 0); 498 return (0); 499_bad: 500 pfr_clean_node_mask(tmpkt, &addq); 501 pfr_destroy_kentries(&addq); 502 if (flags & PFR_FLAG_FEEDBACK) 503 pfr_reset_feedback(addr, size); 504 pfr_destroy_ktable(tmpkt, 0); 505 return (rv); 506} 507 508int 509pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size, 510 int *nmatch, int flags) 511{ 512 struct pfr_ktable *kt; 513 struct pfr_kentry *p; 514 struct pfr_addr *ad; 515 int i, xmatch = 0; 516 517 PF_RULES_RASSERT(); 518 519 ACCEPT_FLAGS(flags, PFR_FLAG_REPLACE); 520 if (pfr_validate_table(tbl, 0, 0)) 521 return (EINVAL); 522 kt = pfr_lookup_table(tbl); 523 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 524 return (ESRCH); 525 526 for (i = 0, ad = addr; i < size; i++, ad++) { 527 if (pfr_validate_addr(ad)) 528 return (EINVAL); 529 if (ADDR_NETWORK(ad)) 530 return (EINVAL); 531 p = pfr_lookup_addr(kt, ad, 0); 532 if (flags & PFR_FLAG_REPLACE) 533 pfr_copyout_addr(ad, p); 534 ad->pfra_fback = (p == NULL) ? PFR_FB_NONE : 535 (p->pfrke_not ? PFR_FB_NOTMATCH : PFR_FB_MATCH); 536 if (p != NULL && !p->pfrke_not) 537 xmatch++; 538 } 539 if (nmatch != NULL) 540 *nmatch = xmatch; 541 return (0); 542} 543 544int 545pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size, 546 int flags) 547{ 548 struct pfr_ktable *kt; 549 struct pfr_walktree w; 550 int rv; 551 552 PF_RULES_RASSERT(); 553 554 ACCEPT_FLAGS(flags, 0); 555 if (pfr_validate_table(tbl, 0, 0)) 556 return (EINVAL); 557 kt = pfr_lookup_table(tbl); 558 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 559 return (ESRCH); 560 if (kt->pfrkt_cnt > *size) { 561 *size = kt->pfrkt_cnt; 562 return (0); 563 } 564 565 bzero(&w, sizeof(w)); 566 w.pfrw_op = PFRW_GET_ADDRS; 567 w.pfrw_addr = addr; 568 w.pfrw_free = kt->pfrkt_cnt; 569 rv = kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w); 570 if (!rv) 571 rv = kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, 572 pfr_walktree, &w); 573 if (rv) 574 return (rv); 575 576 KASSERT(w.pfrw_free == 0, ("%s: corruption detected (%d)", __func__, 577 w.pfrw_free)); 578 579 *size = kt->pfrkt_cnt; 580 return (0); 581} 582 583int 584pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size, 585 int flags) 586{ 587 struct pfr_ktable *kt; 588 struct pfr_walktree w; 589 struct pfr_kentryworkq workq; 590 int rv; 591 long tzero = time_second; 592 593 PF_RULES_RASSERT(); 594 595 /* XXX PFR_FLAG_CLSTATS disabled */ 596 ACCEPT_FLAGS(flags, 0); 597 if (pfr_validate_table(tbl, 0, 0)) 598 return (EINVAL); 599 kt = pfr_lookup_table(tbl); 600 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 601 return (ESRCH); 602 if (kt->pfrkt_cnt > *size) { 603 *size = kt->pfrkt_cnt; 604 return (0); 605 } 606 607 bzero(&w, sizeof(w)); 608 w.pfrw_op = PFRW_GET_ASTATS; 609 w.pfrw_astats = addr; 610 w.pfrw_free = kt->pfrkt_cnt; 611 /* 612 * Flags below are for backward compatibility. It was possible to have 613 * a table without per-entry counters. Now they are always allocated, 614 * we just discard data when reading it if table is not configured to 615 * have counters. 616 */ 617 w.pfrw_flags = kt->pfrkt_flags; 618 rv = kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w); 619 if (!rv) 620 rv = kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, 621 pfr_walktree, &w); 622 if (!rv && (flags & PFR_FLAG_CLSTATS)) { 623 pfr_enqueue_addrs(kt, &workq, NULL, 0); 624 pfr_clstats_kentries(kt, &workq, tzero, 0); 625 } 626 if (rv) 627 return (rv); 628 629 if (w.pfrw_free) { 630 printf("pfr_get_astats: corruption detected (%d).\n", 631 w.pfrw_free); 632 return (ENOTTY); 633 } 634 *size = kt->pfrkt_cnt; 635 return (0); 636} 637 638int 639pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size, 640 int *nzero, int flags) 641{ 642 struct pfr_ktable *kt; 643 struct pfr_kentryworkq workq; 644 struct pfr_kentry *p; 645 struct pfr_addr *ad; 646 int i, rv, xzero = 0; 647 648 PF_RULES_WASSERT(); 649 650 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK); 651 if (pfr_validate_table(tbl, 0, 0)) 652 return (EINVAL); 653 kt = pfr_lookup_table(tbl); 654 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 655 return (ESRCH); 656 SLIST_INIT(&workq); 657 for (i = 0, ad = addr; i < size; i++, ad++) { 658 if (pfr_validate_addr(ad)) 659 senderr(EINVAL); 660 p = pfr_lookup_addr(kt, ad, 1); 661 if (flags & PFR_FLAG_FEEDBACK) { 662 ad->pfra_fback = (p != NULL) ? 663 PFR_FB_CLEARED : PFR_FB_NONE; 664 } 665 if (p != NULL) { 666 SLIST_INSERT_HEAD(&workq, p, pfrke_workq); 667 xzero++; 668 } 669 } 670 671 if (!(flags & PFR_FLAG_DUMMY)) 672 pfr_clstats_kentries(kt, &workq, 0, 0); 673 if (nzero != NULL) 674 *nzero = xzero; 675 return (0); 676_bad: 677 if (flags & PFR_FLAG_FEEDBACK) 678 pfr_reset_feedback(addr, size); 679 return (rv); 680} 681 682static int 683pfr_validate_addr(struct pfr_addr *ad) 684{ 685 int i; 686 687 switch (ad->pfra_af) { 688#ifdef INET 689 case AF_INET: 690 if (ad->pfra_net > 32) 691 return (-1); 692 break; 693#endif /* INET */ 694#ifdef INET6 695 case AF_INET6: 696 if (ad->pfra_net > 128) 697 return (-1); 698 break; 699#endif /* INET6 */ 700 default: 701 return (-1); 702 } 703 if (ad->pfra_net < 128 && 704 (((caddr_t)ad)[ad->pfra_net/8] & (0xFF >> (ad->pfra_net%8)))) 705 return (-1); 706 for (i = (ad->pfra_net+7)/8; i < sizeof(ad->pfra_u); i++) 707 if (((caddr_t)ad)[i]) 708 return (-1); 709 if (ad->pfra_not && ad->pfra_not != 1) 710 return (-1); 711 if (ad->pfra_fback) 712 return (-1); 713 return (0); 714} 715 716static void 717pfr_enqueue_addrs(struct pfr_ktable *kt, struct pfr_kentryworkq *workq, 718 int *naddr, int sweep) 719{ 720 struct pfr_walktree w; 721 722 SLIST_INIT(workq); 723 bzero(&w, sizeof(w)); 724 w.pfrw_op = sweep ? PFRW_SWEEP : PFRW_ENQUEUE; 725 w.pfrw_workq = workq; 726 if (kt->pfrkt_ip4 != NULL) 727 if (kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, 728 pfr_walktree, &w)) 729 printf("pfr_enqueue_addrs: IPv4 walktree failed.\n"); 730 if (kt->pfrkt_ip6 != NULL) 731 if (kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, 732 pfr_walktree, &w)) 733 printf("pfr_enqueue_addrs: IPv6 walktree failed.\n"); 734 if (naddr != NULL) 735 *naddr = w.pfrw_free; 736} 737 738static void 739pfr_mark_addrs(struct pfr_ktable *kt) 740{ 741 struct pfr_walktree w; 742 743 bzero(&w, sizeof(w)); 744 w.pfrw_op = PFRW_MARK; 745 if (kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w)) 746 printf("pfr_mark_addrs: IPv4 walktree failed.\n"); 747 if (kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w)) 748 printf("pfr_mark_addrs: IPv6 walktree failed.\n"); 749} 750 751static struct pfr_kentry * 752pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact) 753{ 754 union sockaddr_union sa, mask; 755 struct radix_head *head = NULL; 756 struct pfr_kentry *ke; 757 758 PF_RULES_ASSERT(); 759 760 bzero(&sa, sizeof(sa)); 761 if (ad->pfra_af == AF_INET) { 762 FILLIN_SIN(sa.sin, ad->pfra_ip4addr); 763 head = &kt->pfrkt_ip4->rh; 764 } else if ( ad->pfra_af == AF_INET6 ) { 765 FILLIN_SIN6(sa.sin6, ad->pfra_ip6addr); 766 head = &kt->pfrkt_ip6->rh; 767 } 768 if (ADDR_NETWORK(ad)) { 769 pfr_prepare_network(&mask, ad->pfra_af, ad->pfra_net); 770 ke = (struct pfr_kentry *)rn_lookup(&sa, &mask, head); 771 if (ke && KENTRY_RNF_ROOT(ke)) 772 ke = NULL; 773 } else { 774 ke = (struct pfr_kentry *)rn_match(&sa, head); 775 if (ke && KENTRY_RNF_ROOT(ke)) 776 ke = NULL; 777 if (exact && ke && KENTRY_NETWORK(ke)) 778 ke = NULL; 779 } 780 return (ke); 781} 782 783static struct pfr_kentry * 784pfr_create_kentry(struct pfr_addr *ad, bool counters) 785{ 786 struct pfr_kentry *ke; 787 counter_u64_t c; 788 789 ke = uma_zalloc(V_pfr_kentry_z, M_NOWAIT | M_ZERO); 790 if (ke == NULL) 791 return (NULL); 792 793 if (ad->pfra_af == AF_INET) 794 FILLIN_SIN(ke->pfrke_sa.sin, ad->pfra_ip4addr); 795 else if (ad->pfra_af == AF_INET6) 796 FILLIN_SIN6(ke->pfrke_sa.sin6, ad->pfra_ip6addr); 797 ke->pfrke_af = ad->pfra_af; 798 ke->pfrke_net = ad->pfra_net; 799 ke->pfrke_not = ad->pfra_not; 800 ke->pfrke_counters.pfrkc_tzero = 0; 801 if (counters) { 802 c = uma_zalloc_pcpu(V_pfr_kentry_counter_z, M_NOWAIT | M_ZERO); 803 if (c == NULL) { 804 pfr_destroy_kentry(ke); 805 return (NULL); 806 } 807 ke->pfrke_counters.pfrkc_counters = c; 808 } 809 return (ke); 810} 811 812static void 813pfr_destroy_kentries(struct pfr_kentryworkq *workq) 814{ 815 struct pfr_kentry *p, *q; 816 817 for (p = SLIST_FIRST(workq); p != NULL; p = q) { 818 q = SLIST_NEXT(p, pfrke_workq); 819 pfr_destroy_kentry(p); 820 } 821} 822 823static void 824pfr_destroy_kentry(struct pfr_kentry *ke) 825{ 826 counter_u64_t c; 827 828 if ((c = ke->pfrke_counters.pfrkc_counters) != NULL) 829 uma_zfree_pcpu(V_pfr_kentry_counter_z, c); 830 uma_zfree(V_pfr_kentry_z, ke); 831} 832 833static void 834pfr_insert_kentries(struct pfr_ktable *kt, 835 struct pfr_kentryworkq *workq, long tzero) 836{ 837 struct pfr_kentry *p; 838 int rv, n = 0; 839 840 SLIST_FOREACH(p, workq, pfrke_workq) { 841 rv = pfr_route_kentry(kt, p); 842 if (rv) { 843 printf("pfr_insert_kentries: cannot route entry " 844 "(code=%d).\n", rv); 845 break; 846 } 847 p->pfrke_counters.pfrkc_tzero = tzero; 848 n++; 849 } 850 kt->pfrkt_cnt += n; 851} 852 853int 854pfr_insert_kentry(struct pfr_ktable *kt, struct pfr_addr *ad, long tzero) 855{ 856 struct pfr_kentry *p; 857 int rv; 858 859 p = pfr_lookup_addr(kt, ad, 1); 860 if (p != NULL) 861 return (0); 862 p = pfr_create_kentry(ad, (kt->pfrkt_flags & PFR_TFLAG_COUNTERS) != 0); 863 if (p == NULL) 864 return (ENOMEM); 865 866 rv = pfr_route_kentry(kt, p); 867 if (rv) 868 return (rv); 869 870 p->pfrke_counters.pfrkc_tzero = tzero; 871 kt->pfrkt_cnt++; 872 873 return (0); 874} 875 876static void 877pfr_remove_kentries(struct pfr_ktable *kt, 878 struct pfr_kentryworkq *workq) 879{ 880 struct pfr_kentry *p; 881 int n = 0; 882 883 SLIST_FOREACH(p, workq, pfrke_workq) { 884 pfr_unroute_kentry(kt, p); 885 n++; 886 } 887 kt->pfrkt_cnt -= n; 888 pfr_destroy_kentries(workq); 889} 890 891static void 892pfr_clean_node_mask(struct pfr_ktable *kt, 893 struct pfr_kentryworkq *workq) 894{ 895 struct pfr_kentry *p; 896 897 SLIST_FOREACH(p, workq, pfrke_workq) 898 pfr_unroute_kentry(kt, p); 899} 900 901static void 902pfr_clstats_kentries(struct pfr_ktable *kt, struct pfr_kentryworkq *workq, 903 long tzero, int negchange) 904{ 905 struct pfr_kentry *p; 906 int i; 907 908 SLIST_FOREACH(p, workq, pfrke_workq) { 909 if (negchange) 910 p->pfrke_not = !p->pfrke_not; 911 if ((kt->pfrkt_flags & PFR_TFLAG_COUNTERS) != 0) 912 for (i = 0; i < PFR_NUM_COUNTERS; i++) 913 counter_u64_zero( 914 p->pfrke_counters.pfrkc_counters + i); 915 p->pfrke_counters.pfrkc_tzero = tzero; 916 } 917} 918 919static void 920pfr_reset_feedback(struct pfr_addr *addr, int size) 921{ 922 struct pfr_addr *ad; 923 int i; 924 925 for (i = 0, ad = addr; i < size; i++, ad++) 926 ad->pfra_fback = PFR_FB_NONE; 927} 928 929static void 930pfr_prepare_network(union sockaddr_union *sa, int af, int net) 931{ 932 int i; 933 934 bzero(sa, sizeof(*sa)); 935 if (af == AF_INET) { 936 sa->sin.sin_len = sizeof(sa->sin); 937 sa->sin.sin_family = AF_INET; 938 sa->sin.sin_addr.s_addr = net ? htonl(-1 << (32-net)) : 0; 939 } else if (af == AF_INET6) { 940 sa->sin6.sin6_len = sizeof(sa->sin6); 941 sa->sin6.sin6_family = AF_INET6; 942 for (i = 0; i < 4; i++) { 943 if (net <= 32) { 944 sa->sin6.sin6_addr.s6_addr32[i] = 945 net ? htonl(-1 << (32-net)) : 0; 946 break; 947 } 948 sa->sin6.sin6_addr.s6_addr32[i] = 0xFFFFFFFF; 949 net -= 32; 950 } 951 } 952} 953 954static int 955pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke) 956{ 957 union sockaddr_union mask; 958 struct radix_node *rn; 959 struct radix_head *head = NULL; 960 961 PF_RULES_WASSERT(); 962 963 bzero(ke->pfrke_node, sizeof(ke->pfrke_node)); 964 if (ke->pfrke_af == AF_INET) 965 head = &kt->pfrkt_ip4->rh; 966 else if (ke->pfrke_af == AF_INET6) 967 head = &kt->pfrkt_ip6->rh; 968 969 if (KENTRY_NETWORK(ke)) { 970 pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net); 971 rn = rn_addroute(&ke->pfrke_sa, &mask, head, ke->pfrke_node); 972 } else 973 rn = rn_addroute(&ke->pfrke_sa, NULL, head, ke->pfrke_node); 974 975 return (rn == NULL ? -1 : 0); 976} 977 978static int 979pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke) 980{ 981 union sockaddr_union mask; 982 struct radix_node *rn; 983 struct radix_head *head = NULL; 984 985 if (ke->pfrke_af == AF_INET) 986 head = &kt->pfrkt_ip4->rh; 987 else if (ke->pfrke_af == AF_INET6) 988 head = &kt->pfrkt_ip6->rh; 989 990 if (KENTRY_NETWORK(ke)) { 991 pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net); 992 rn = rn_delete(&ke->pfrke_sa, &mask, head); 993 } else 994 rn = rn_delete(&ke->pfrke_sa, NULL, head); 995 996 if (rn == NULL) { 997 printf("pfr_unroute_kentry: delete failed.\n"); 998 return (-1); 999 } 1000 return (0); 1001} 1002 1003static void 1004pfr_copyout_addr(struct pfr_addr *ad, const struct pfr_kentry *ke) 1005{ 1006 bzero(ad, sizeof(*ad)); 1007 if (ke == NULL) 1008 return; 1009 ad->pfra_af = ke->pfrke_af; 1010 ad->pfra_net = ke->pfrke_net; 1011 ad->pfra_not = ke->pfrke_not; 1012 if (ad->pfra_af == AF_INET) 1013 ad->pfra_ip4addr = ke->pfrke_sa.sin.sin_addr; 1014 else if (ad->pfra_af == AF_INET6) 1015 ad->pfra_ip6addr = ke->pfrke_sa.sin6.sin6_addr; 1016} 1017 1018static void 1019pfr_copyout_astats(struct pfr_astats *as, const struct pfr_kentry *ke, 1020 const struct pfr_walktree *w) 1021{ 1022 int dir, op; 1023 const struct pfr_kcounters *kc = &ke->pfrke_counters; 1024 1025 bzero(as, sizeof(*as)); 1026 pfr_copyout_addr(&as->pfras_a, ke); 1027 as->pfras_tzero = kc->pfrkc_tzero; 1028 1029 if (! (w->pfrw_flags & PFR_TFLAG_COUNTERS) || 1030 kc->pfrkc_counters == NULL) { 1031 bzero(as->pfras_packets, sizeof(as->pfras_packets)); 1032 bzero(as->pfras_bytes, sizeof(as->pfras_bytes)); 1033 as->pfras_a.pfra_fback = PFR_FB_NOCOUNT; 1034 return; 1035 } 1036 1037 for (dir = 0; dir < PFR_DIR_MAX; dir++) { 1038 for (op = 0; op < PFR_OP_ADDR_MAX; op ++) { 1039 as->pfras_packets[dir][op] = counter_u64_fetch( 1040 pfr_kentry_counter(kc, dir, op, PFR_TYPE_PACKETS)); 1041 as->pfras_bytes[dir][op] = counter_u64_fetch( 1042 pfr_kentry_counter(kc, dir, op, PFR_TYPE_BYTES)); 1043 } 1044 } 1045} 1046 1047static int 1048pfr_walktree(struct radix_node *rn, void *arg) 1049{ 1050 struct pfr_kentry *ke = (struct pfr_kentry *)rn; 1051 struct pfr_walktree *w = arg; 1052 1053 switch (w->pfrw_op) { 1054 case PFRW_MARK: 1055 ke->pfrke_mark = 0; 1056 break; 1057 case PFRW_SWEEP: 1058 if (ke->pfrke_mark) 1059 break; 1060 /* FALLTHROUGH */ 1061 case PFRW_ENQUEUE: 1062 SLIST_INSERT_HEAD(w->pfrw_workq, ke, pfrke_workq); 1063 w->pfrw_free++; 1064 break; 1065 case PFRW_GET_ADDRS: 1066 if (w->pfrw_free-- > 0) { 1067 pfr_copyout_addr(w->pfrw_addr, ke); 1068 w->pfrw_addr++; 1069 } 1070 break; 1071 case PFRW_GET_ASTATS: 1072 if (w->pfrw_free-- > 0) { 1073 struct pfr_astats as; 1074 1075 pfr_copyout_astats(&as, ke, w); 1076 1077 bcopy(&as, w->pfrw_astats, sizeof(as)); 1078 w->pfrw_astats++; 1079 } 1080 break; 1081 case PFRW_POOL_GET: 1082 if (ke->pfrke_not) 1083 break; /* negative entries are ignored */ 1084 if (!w->pfrw_free--) { 1085 w->pfrw_kentry = ke; 1086 return (1); /* finish search */ 1087 } 1088 break; 1089 case PFRW_DYNADDR_UPDATE: 1090 { 1091 union sockaddr_union pfr_mask; 1092 1093 if (ke->pfrke_af == AF_INET) { 1094 if (w->pfrw_dyn->pfid_acnt4++ > 0) 1095 break; 1096 pfr_prepare_network(&pfr_mask, AF_INET, ke->pfrke_net); 1097 w->pfrw_dyn->pfid_addr4 = *SUNION2PF(&ke->pfrke_sa, 1098 AF_INET); 1099 w->pfrw_dyn->pfid_mask4 = *SUNION2PF(&pfr_mask, 1100 AF_INET); 1101 } else if (ke->pfrke_af == AF_INET6){ 1102 if (w->pfrw_dyn->pfid_acnt6++ > 0) 1103 break; 1104 pfr_prepare_network(&pfr_mask, AF_INET6, ke->pfrke_net); 1105 w->pfrw_dyn->pfid_addr6 = *SUNION2PF(&ke->pfrke_sa, 1106 AF_INET6); 1107 w->pfrw_dyn->pfid_mask6 = *SUNION2PF(&pfr_mask, 1108 AF_INET6); 1109 } 1110 break; 1111 } 1112 case PFRW_COUNTERS: 1113 { 1114 if (w->pfrw_flags & PFR_TFLAG_COUNTERS) { 1115 if (ke->pfrke_counters.pfrkc_counters != NULL) 1116 break; 1117 ke->pfrke_counters.pfrkc_counters = 1118 uma_zalloc_pcpu(V_pfr_kentry_counter_z, 1119 M_NOWAIT | M_ZERO); 1120 } else { 1121 uma_zfree_pcpu(V_pfr_kentry_counter_z, 1122 ke->pfrke_counters.pfrkc_counters); 1123 ke->pfrke_counters.pfrkc_counters = NULL; 1124 } 1125 break; 1126 } 1127 } 1128 return (0); 1129} 1130 1131int 1132pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags) 1133{ 1134 struct pfr_ktableworkq workq; 1135 struct pfr_ktable *p; 1136 int xdel = 0; 1137 1138 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ALLRSETS); 1139 if (pfr_fix_anchor(filter->pfrt_anchor)) 1140 return (EINVAL); 1141 if (pfr_table_count(filter, flags) < 0) 1142 return (ENOENT); 1143 1144 SLIST_INIT(&workq); 1145 RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) { 1146 if (pfr_skip_table(filter, p, flags)) 1147 continue; 1148 if (!strcmp(p->pfrkt_anchor, PF_RESERVED_ANCHOR)) 1149 continue; 1150 if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) 1151 continue; 1152 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE; 1153 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1154 xdel++; 1155 } 1156 if (!(flags & PFR_FLAG_DUMMY)) 1157 pfr_setflags_ktables(&workq); 1158 if (ndel != NULL) 1159 *ndel = xdel; 1160 return (0); 1161} 1162 1163int 1164pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags) 1165{ 1166 struct pfr_ktableworkq addq, changeq; 1167 struct pfr_ktable *p, *q, *r, key; 1168 int i, rv, xadd = 0; 1169 long tzero = time_second; 1170 1171 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY); 1172 SLIST_INIT(&addq); 1173 SLIST_INIT(&changeq); 1174 for (i = 0; i < size; i++) { 1175 bcopy(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t)); 1176 if (pfr_validate_table(&key.pfrkt_t, PFR_TFLAG_USRMASK, 1177 flags & PFR_FLAG_USERIOCTL)) 1178 senderr(EINVAL); 1179 key.pfrkt_flags |= PFR_TFLAG_ACTIVE; 1180 p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key); 1181 if (p == NULL) { 1182 p = pfr_create_ktable(&key.pfrkt_t, tzero, 1); 1183 if (p == NULL) 1184 senderr(ENOMEM); 1185 SLIST_FOREACH(q, &addq, pfrkt_workq) { 1186 if (!pfr_ktable_compare(p, q)) { 1187 pfr_destroy_ktable(p, 0); 1188 goto _skip; 1189 } 1190 } 1191 SLIST_INSERT_HEAD(&addq, p, pfrkt_workq); 1192 xadd++; 1193 if (!key.pfrkt_anchor[0]) 1194 goto _skip; 1195 1196 /* find or create root table */ 1197 bzero(key.pfrkt_anchor, sizeof(key.pfrkt_anchor)); 1198 r = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key); 1199 if (r != NULL) { 1200 p->pfrkt_root = r; 1201 goto _skip; 1202 } 1203 SLIST_FOREACH(q, &addq, pfrkt_workq) { 1204 if (!pfr_ktable_compare(&key, q)) { 1205 p->pfrkt_root = q; 1206 goto _skip; 1207 } 1208 } 1209 key.pfrkt_flags = 0; 1210 r = pfr_create_ktable(&key.pfrkt_t, 0, 1); 1211 if (r == NULL) 1212 senderr(ENOMEM); 1213 SLIST_INSERT_HEAD(&addq, r, pfrkt_workq); 1214 p->pfrkt_root = r; 1215 } else if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) { 1216 SLIST_FOREACH(q, &changeq, pfrkt_workq) 1217 if (!pfr_ktable_compare(&key, q)) 1218 goto _skip; 1219 p->pfrkt_nflags = (p->pfrkt_flags & 1220 ~PFR_TFLAG_USRMASK) | key.pfrkt_flags; 1221 SLIST_INSERT_HEAD(&changeq, p, pfrkt_workq); 1222 xadd++; 1223 } 1224_skip: 1225 ; 1226 } 1227 if (!(flags & PFR_FLAG_DUMMY)) { 1228 pfr_insert_ktables(&addq); 1229 pfr_setflags_ktables(&changeq); 1230 } else 1231 pfr_destroy_ktables(&addq, 0); 1232 if (nadd != NULL) 1233 *nadd = xadd; 1234 return (0); 1235_bad: 1236 pfr_destroy_ktables(&addq, 0); 1237 return (rv); 1238} 1239 1240int 1241pfr_del_tables(struct pfr_table *tbl, int size, int *ndel, int flags) 1242{ 1243 struct pfr_ktableworkq workq; 1244 struct pfr_ktable *p, *q, key; 1245 int i, xdel = 0; 1246 1247 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY); 1248 SLIST_INIT(&workq); 1249 for (i = 0; i < size; i++) { 1250 bcopy(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t)); 1251 if (pfr_validate_table(&key.pfrkt_t, 0, 1252 flags & PFR_FLAG_USERIOCTL)) 1253 return (EINVAL); 1254 p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key); 1255 if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) { 1256 SLIST_FOREACH(q, &workq, pfrkt_workq) 1257 if (!pfr_ktable_compare(p, q)) 1258 goto _skip; 1259 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE; 1260 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1261 xdel++; 1262 } 1263_skip: 1264 ; 1265 } 1266 1267 if (!(flags & PFR_FLAG_DUMMY)) 1268 pfr_setflags_ktables(&workq); 1269 if (ndel != NULL) 1270 *ndel = xdel; 1271 return (0); 1272} 1273 1274int 1275pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size, 1276 int flags) 1277{ 1278 struct pfr_ktable *p; 1279 int n, nn; 1280 1281 PF_RULES_RASSERT(); 1282 1283 ACCEPT_FLAGS(flags, PFR_FLAG_ALLRSETS); 1284 if (pfr_fix_anchor(filter->pfrt_anchor)) 1285 return (EINVAL); 1286 n = nn = pfr_table_count(filter, flags); 1287 if (n < 0) 1288 return (ENOENT); 1289 if (n > *size) { 1290 *size = n; 1291 return (0); 1292 } 1293 RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) { 1294 if (pfr_skip_table(filter, p, flags)) 1295 continue; 1296 if (n-- <= 0) 1297 continue; 1298 bcopy(&p->pfrkt_t, tbl++, sizeof(*tbl)); 1299 } 1300 1301 KASSERT(n == 0, ("%s: corruption detected (%d)", __func__, n)); 1302 1303 *size = nn; 1304 return (0); 1305} 1306 1307int 1308pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size, 1309 int flags) 1310{ 1311 struct pfr_ktable *p; 1312 struct pfr_ktableworkq workq; 1313 int n, nn; 1314 long tzero = time_second; 1315 int pfr_dir, pfr_op; 1316 1317 /* XXX PFR_FLAG_CLSTATS disabled */ 1318 ACCEPT_FLAGS(flags, PFR_FLAG_ALLRSETS); 1319 if (pfr_fix_anchor(filter->pfrt_anchor)) 1320 return (EINVAL); 1321 n = nn = pfr_table_count(filter, flags); 1322 if (n < 0) 1323 return (ENOENT); 1324 if (n > *size) { 1325 *size = n; 1326 return (0); 1327 } 1328 SLIST_INIT(&workq); 1329 RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) { 1330 if (pfr_skip_table(filter, p, flags)) 1331 continue; 1332 if (n-- <= 0) 1333 continue; 1334 bcopy(&p->pfrkt_kts.pfrts_t, &tbl->pfrts_t, 1335 sizeof(struct pfr_table)); 1336 for (pfr_dir = 0; pfr_dir < PFR_DIR_MAX; pfr_dir ++) { 1337 for (pfr_op = 0; pfr_op < PFR_OP_TABLE_MAX; pfr_op ++) { 1338 tbl->pfrts_packets[pfr_dir][pfr_op] = 1339 pfr_kstate_counter_fetch( 1340 &p->pfrkt_packets[pfr_dir][pfr_op]); 1341 tbl->pfrts_bytes[pfr_dir][pfr_op] = 1342 pfr_kstate_counter_fetch( 1343 &p->pfrkt_bytes[pfr_dir][pfr_op]); 1344 } 1345 } 1346 tbl->pfrts_match = pfr_kstate_counter_fetch(&p->pfrkt_match); 1347 tbl->pfrts_nomatch = pfr_kstate_counter_fetch(&p->pfrkt_nomatch); 1348 tbl->pfrts_tzero = p->pfrkt_tzero; 1349 tbl->pfrts_cnt = p->pfrkt_cnt; 1350 for (pfr_op = 0; pfr_op < PFR_REFCNT_MAX; pfr_op++) 1351 tbl->pfrts_refcnt[pfr_op] = p->pfrkt_refcnt[pfr_op]; 1352 tbl++; 1353 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1354 } 1355 if (flags & PFR_FLAG_CLSTATS) 1356 pfr_clstats_ktables(&workq, tzero, 1357 flags & PFR_FLAG_ADDRSTOO); 1358 1359 KASSERT(n == 0, ("%s: corruption detected (%d)", __func__, n)); 1360 1361 *size = nn; 1362 return (0); 1363} 1364 1365int 1366pfr_clr_tstats(struct pfr_table *tbl, int size, int *nzero, int flags) 1367{ 1368 struct pfr_ktableworkq workq; 1369 struct pfr_ktable *p, key; 1370 int i, xzero = 0; 1371 long tzero = time_second; 1372 1373 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ADDRSTOO); 1374 SLIST_INIT(&workq); 1375 for (i = 0; i < size; i++) { 1376 bcopy(tbl + i, &key.pfrkt_t, sizeof(key.pfrkt_t)); 1377 if (pfr_validate_table(&key.pfrkt_t, 0, 0)) 1378 return (EINVAL); 1379 p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key); 1380 if (p != NULL) { 1381 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1382 xzero++; 1383 } 1384 } 1385 if (!(flags & PFR_FLAG_DUMMY)) 1386 pfr_clstats_ktables(&workq, tzero, flags & PFR_FLAG_ADDRSTOO); 1387 if (nzero != NULL) 1388 *nzero = xzero; 1389 return (0); 1390} 1391 1392int 1393pfr_set_tflags(struct pfr_table *tbl, int size, int setflag, int clrflag, 1394 int *nchange, int *ndel, int flags) 1395{ 1396 struct pfr_ktableworkq workq; 1397 struct pfr_ktable *p, *q, key; 1398 int i, xchange = 0, xdel = 0; 1399 1400 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY); 1401 if ((setflag & ~PFR_TFLAG_USRMASK) || 1402 (clrflag & ~PFR_TFLAG_USRMASK) || 1403 (setflag & clrflag)) 1404 return (EINVAL); 1405 SLIST_INIT(&workq); 1406 for (i = 0; i < size; i++) { 1407 bcopy(tbl + i, &key.pfrkt_t, sizeof(key.pfrkt_t)); 1408 if (pfr_validate_table(&key.pfrkt_t, 0, 1409 flags & PFR_FLAG_USERIOCTL)) 1410 return (EINVAL); 1411 p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key); 1412 if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) { 1413 p->pfrkt_nflags = (p->pfrkt_flags | setflag) & 1414 ~clrflag; 1415 if (p->pfrkt_nflags == p->pfrkt_flags) 1416 goto _skip; 1417 SLIST_FOREACH(q, &workq, pfrkt_workq) 1418 if (!pfr_ktable_compare(p, q)) 1419 goto _skip; 1420 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1421 if ((p->pfrkt_flags & PFR_TFLAG_PERSIST) && 1422 (clrflag & PFR_TFLAG_PERSIST) && 1423 !(p->pfrkt_flags & PFR_TFLAG_REFERENCED)) 1424 xdel++; 1425 else 1426 xchange++; 1427 } 1428_skip: 1429 ; 1430 } 1431 if (!(flags & PFR_FLAG_DUMMY)) 1432 pfr_setflags_ktables(&workq); 1433 if (nchange != NULL) 1434 *nchange = xchange; 1435 if (ndel != NULL) 1436 *ndel = xdel; 1437 return (0); 1438} 1439 1440int 1441pfr_ina_begin(struct pfr_table *trs, u_int32_t *ticket, int *ndel, int flags) 1442{ 1443 struct pfr_ktableworkq workq; 1444 struct pfr_ktable *p; 1445 struct pf_kruleset *rs; 1446 int xdel = 0; 1447 1448 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY); 1449 rs = pf_find_or_create_kruleset(trs->pfrt_anchor); 1450 if (rs == NULL) 1451 return (ENOMEM); 1452 SLIST_INIT(&workq); 1453 RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) { 1454 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) || 1455 pfr_skip_table(trs, p, 0)) 1456 continue; 1457 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE; 1458 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1459 xdel++; 1460 } 1461 if (!(flags & PFR_FLAG_DUMMY)) { 1462 pfr_setflags_ktables(&workq); 1463 if (ticket != NULL) 1464 *ticket = ++rs->tticket; 1465 rs->topen = 1; 1466 } else 1467 pf_remove_if_empty_kruleset(rs); 1468 if (ndel != NULL) 1469 *ndel = xdel; 1470 return (0); 1471} 1472 1473int 1474pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size, 1475 int *nadd, int *naddr, u_int32_t ticket, int flags) 1476{ 1477 struct pfr_ktableworkq tableq; 1478 struct pfr_kentryworkq addrq; 1479 struct pfr_ktable *kt, *rt, *shadow, key; 1480 struct pfr_kentry *p; 1481 struct pfr_addr *ad; 1482 struct pf_kruleset *rs; 1483 int i, rv, xadd = 0, xaddr = 0; 1484 1485 PF_RULES_WASSERT(); 1486 1487 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ADDRSTOO); 1488 if (size && !(flags & PFR_FLAG_ADDRSTOO)) 1489 return (EINVAL); 1490 if (pfr_validate_table(tbl, PFR_TFLAG_USRMASK, 1491 flags & PFR_FLAG_USERIOCTL)) 1492 return (EINVAL); 1493 rs = pf_find_kruleset(tbl->pfrt_anchor); 1494 if (rs == NULL || !rs->topen || ticket != rs->tticket) 1495 return (EBUSY); 1496 tbl->pfrt_flags |= PFR_TFLAG_INACTIVE; 1497 SLIST_INIT(&tableq); 1498 kt = RB_FIND(pfr_ktablehead, &V_pfr_ktables, (struct pfr_ktable *)tbl); 1499 if (kt == NULL) { 1500 kt = pfr_create_ktable(tbl, 0, 1); 1501 if (kt == NULL) 1502 return (ENOMEM); 1503 SLIST_INSERT_HEAD(&tableq, kt, pfrkt_workq); 1504 xadd++; 1505 if (!tbl->pfrt_anchor[0]) 1506 goto _skip; 1507 1508 /* find or create root table */ 1509 bzero(&key, sizeof(key)); 1510 strlcpy(key.pfrkt_name, tbl->pfrt_name, sizeof(key.pfrkt_name)); 1511 rt = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key); 1512 if (rt != NULL) { 1513 kt->pfrkt_root = rt; 1514 goto _skip; 1515 } 1516 rt = pfr_create_ktable(&key.pfrkt_t, 0, 1); 1517 if (rt == NULL) { 1518 pfr_destroy_ktables(&tableq, 0); 1519 return (ENOMEM); 1520 } 1521 SLIST_INSERT_HEAD(&tableq, rt, pfrkt_workq); 1522 kt->pfrkt_root = rt; 1523 } else if (!(kt->pfrkt_flags & PFR_TFLAG_INACTIVE)) 1524 xadd++; 1525_skip: 1526 shadow = pfr_create_ktable(tbl, 0, 0); 1527 if (shadow == NULL) { 1528 pfr_destroy_ktables(&tableq, 0); 1529 return (ENOMEM); 1530 } 1531 SLIST_INIT(&addrq); 1532 for (i = 0, ad = addr; i < size; i++, ad++) { 1533 if (pfr_validate_addr(ad)) 1534 senderr(EINVAL); 1535 if (pfr_lookup_addr(shadow, ad, 1) != NULL) 1536 continue; 1537 p = pfr_create_kentry(ad, 1538 (shadow->pfrkt_flags & PFR_TFLAG_COUNTERS) != 0); 1539 if (p == NULL) 1540 senderr(ENOMEM); 1541 if (pfr_route_kentry(shadow, p)) { 1542 pfr_destroy_kentry(p); 1543 continue; 1544 } 1545 SLIST_INSERT_HEAD(&addrq, p, pfrke_workq); 1546 xaddr++; 1547 } 1548 if (!(flags & PFR_FLAG_DUMMY)) { 1549 if (kt->pfrkt_shadow != NULL) 1550 pfr_destroy_ktable(kt->pfrkt_shadow, 1); 1551 kt->pfrkt_flags |= PFR_TFLAG_INACTIVE; 1552 pfr_insert_ktables(&tableq); 1553 shadow->pfrkt_cnt = (flags & PFR_FLAG_ADDRSTOO) ? 1554 xaddr : NO_ADDRESSES; 1555 kt->pfrkt_shadow = shadow; 1556 } else { 1557 pfr_clean_node_mask(shadow, &addrq); 1558 pfr_destroy_ktable(shadow, 0); 1559 pfr_destroy_ktables(&tableq, 0); 1560 pfr_destroy_kentries(&addrq); 1561 } 1562 if (nadd != NULL) 1563 *nadd = xadd; 1564 if (naddr != NULL) 1565 *naddr = xaddr; 1566 return (0); 1567_bad: 1568 pfr_destroy_ktable(shadow, 0); 1569 pfr_destroy_ktables(&tableq, 0); 1570 pfr_destroy_kentries(&addrq); 1571 return (rv); 1572} 1573 1574int 1575pfr_ina_rollback(struct pfr_table *trs, u_int32_t ticket, int *ndel, int flags) 1576{ 1577 struct pfr_ktableworkq workq; 1578 struct pfr_ktable *p; 1579 struct pf_kruleset *rs; 1580 int xdel = 0; 1581 1582 PF_RULES_WASSERT(); 1583 1584 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY); 1585 rs = pf_find_kruleset(trs->pfrt_anchor); 1586 if (rs == NULL || !rs->topen || ticket != rs->tticket) 1587 return (0); 1588 SLIST_INIT(&workq); 1589 RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) { 1590 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) || 1591 pfr_skip_table(trs, p, 0)) 1592 continue; 1593 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE; 1594 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1595 xdel++; 1596 } 1597 if (!(flags & PFR_FLAG_DUMMY)) { 1598 pfr_setflags_ktables(&workq); 1599 rs->topen = 0; 1600 pf_remove_if_empty_kruleset(rs); 1601 } 1602 if (ndel != NULL) 1603 *ndel = xdel; 1604 return (0); 1605} 1606 1607int 1608pfr_ina_commit(struct pfr_table *trs, u_int32_t ticket, int *nadd, 1609 int *nchange, int flags) 1610{ 1611 struct pfr_ktable *p, *q; 1612 struct pfr_ktableworkq workq; 1613 struct pf_kruleset *rs; 1614 int xadd = 0, xchange = 0; 1615 long tzero = time_second; 1616 1617 PF_RULES_WASSERT(); 1618 1619 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY); 1620 rs = pf_find_kruleset(trs->pfrt_anchor); 1621 if (rs == NULL || !rs->topen || ticket != rs->tticket) 1622 return (EBUSY); 1623 1624 SLIST_INIT(&workq); 1625 RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) { 1626 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) || 1627 pfr_skip_table(trs, p, 0)) 1628 continue; 1629 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1630 if (p->pfrkt_flags & PFR_TFLAG_ACTIVE) 1631 xchange++; 1632 else 1633 xadd++; 1634 } 1635 1636 if (!(flags & PFR_FLAG_DUMMY)) { 1637 for (p = SLIST_FIRST(&workq); p != NULL; p = q) { 1638 q = SLIST_NEXT(p, pfrkt_workq); 1639 pfr_commit_ktable(p, tzero); 1640 } 1641 rs->topen = 0; 1642 pf_remove_if_empty_kruleset(rs); 1643 } 1644 if (nadd != NULL) 1645 *nadd = xadd; 1646 if (nchange != NULL) 1647 *nchange = xchange; 1648 1649 return (0); 1650} 1651 1652static void 1653pfr_commit_ktable(struct pfr_ktable *kt, long tzero) 1654{ 1655 counter_u64_t *pkc, *qkc; 1656 struct pfr_ktable *shadow = kt->pfrkt_shadow; 1657 int nflags; 1658 1659 PF_RULES_WASSERT(); 1660 1661 if (shadow->pfrkt_cnt == NO_ADDRESSES) { 1662 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 1663 pfr_clstats_ktable(kt, tzero, 1); 1664 } else if (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) { 1665 /* kt might contain addresses */ 1666 struct pfr_kentryworkq addrq, addq, changeq, delq, garbageq; 1667 struct pfr_kentry *p, *q, *next; 1668 struct pfr_addr ad; 1669 1670 pfr_enqueue_addrs(shadow, &addrq, NULL, 0); 1671 pfr_mark_addrs(kt); 1672 SLIST_INIT(&addq); 1673 SLIST_INIT(&changeq); 1674 SLIST_INIT(&delq); 1675 SLIST_INIT(&garbageq); 1676 pfr_clean_node_mask(shadow, &addrq); 1677 SLIST_FOREACH_SAFE(p, &addrq, pfrke_workq, next) { 1678 pfr_copyout_addr(&ad, p); 1679 q = pfr_lookup_addr(kt, &ad, 1); 1680 if (q != NULL) { 1681 if (q->pfrke_not != p->pfrke_not) 1682 SLIST_INSERT_HEAD(&changeq, q, 1683 pfrke_workq); 1684 pkc = &p->pfrke_counters.pfrkc_counters; 1685 qkc = &q->pfrke_counters.pfrkc_counters; 1686 if ((*pkc == NULL) != (*qkc == NULL)) 1687 SWAP(counter_u64_t, *pkc, *qkc); 1688 q->pfrke_mark = 1; 1689 SLIST_INSERT_HEAD(&garbageq, p, pfrke_workq); 1690 } else { 1691 p->pfrke_counters.pfrkc_tzero = tzero; 1692 SLIST_INSERT_HEAD(&addq, p, pfrke_workq); 1693 } 1694 } 1695 pfr_enqueue_addrs(kt, &delq, NULL, ENQUEUE_UNMARKED_ONLY); 1696 pfr_insert_kentries(kt, &addq, tzero); 1697 pfr_remove_kentries(kt, &delq); 1698 pfr_clstats_kentries(kt, &changeq, tzero, INVERT_NEG_FLAG); 1699 pfr_destroy_kentries(&garbageq); 1700 } else { 1701 /* kt cannot contain addresses */ 1702 SWAP(struct radix_node_head *, kt->pfrkt_ip4, 1703 shadow->pfrkt_ip4); 1704 SWAP(struct radix_node_head *, kt->pfrkt_ip6, 1705 shadow->pfrkt_ip6); 1706 SWAP(int, kt->pfrkt_cnt, shadow->pfrkt_cnt); 1707 pfr_clstats_ktable(kt, tzero, 1); 1708 } 1709 nflags = ((shadow->pfrkt_flags & PFR_TFLAG_USRMASK) | 1710 (kt->pfrkt_flags & PFR_TFLAG_SETMASK) | PFR_TFLAG_ACTIVE) 1711 & ~PFR_TFLAG_INACTIVE; 1712 pfr_destroy_ktable(shadow, 0); 1713 kt->pfrkt_shadow = NULL; 1714 pfr_setflags_ktable(kt, nflags); 1715} 1716 1717static int 1718pfr_validate_table(struct pfr_table *tbl, int allowedflags, int no_reserved) 1719{ 1720 int i; 1721 1722 if (!tbl->pfrt_name[0]) 1723 return (-1); 1724 if (no_reserved && !strcmp(tbl->pfrt_anchor, PF_RESERVED_ANCHOR)) 1725 return (-1); 1726 if (tbl->pfrt_name[PF_TABLE_NAME_SIZE-1]) 1727 return (-1); 1728 for (i = strlen(tbl->pfrt_name); i < PF_TABLE_NAME_SIZE; i++) 1729 if (tbl->pfrt_name[i]) 1730 return (-1); 1731 if (pfr_fix_anchor(tbl->pfrt_anchor)) 1732 return (-1); 1733 if (tbl->pfrt_flags & ~allowedflags) 1734 return (-1); 1735 return (0); 1736} 1737 1738/* 1739 * Rewrite anchors referenced by tables to remove slashes 1740 * and check for validity. 1741 */ 1742static int 1743pfr_fix_anchor(char *anchor) 1744{ 1745 size_t siz = MAXPATHLEN; 1746 int i; 1747 1748 if (anchor[0] == '/') { 1749 char *path; 1750 int off; 1751 1752 path = anchor; 1753 off = 1; 1754 while (*++path == '/') 1755 off++; 1756 bcopy(path, anchor, siz - off); 1757 memset(anchor + siz - off, 0, off); 1758 } 1759 if (anchor[siz - 1]) 1760 return (-1); 1761 for (i = strlen(anchor); i < siz; i++) 1762 if (anchor[i]) 1763 return (-1); 1764 return (0); 1765} 1766 1767int 1768pfr_table_count(struct pfr_table *filter, int flags) 1769{ 1770 struct pf_kruleset *rs; 1771 1772 PF_RULES_ASSERT(); 1773 1774 if (flags & PFR_FLAG_ALLRSETS) 1775 return (V_pfr_ktable_cnt); 1776 if (filter->pfrt_anchor[0]) { 1777 rs = pf_find_kruleset(filter->pfrt_anchor); 1778 return ((rs != NULL) ? rs->tables : -1); 1779 } 1780 return (pf_main_ruleset.tables); 1781} 1782 1783static int 1784pfr_skip_table(struct pfr_table *filter, struct pfr_ktable *kt, int flags) 1785{ 1786 if (flags & PFR_FLAG_ALLRSETS) 1787 return (0); 1788 if (strcmp(filter->pfrt_anchor, kt->pfrkt_anchor)) 1789 return (1); 1790 return (0); 1791} 1792 1793static void 1794pfr_insert_ktables(struct pfr_ktableworkq *workq) 1795{ 1796 struct pfr_ktable *p; 1797 1798 SLIST_FOREACH(p, workq, pfrkt_workq) 1799 pfr_insert_ktable(p); 1800} 1801 1802static void 1803pfr_insert_ktable(struct pfr_ktable *kt) 1804{ 1805 1806 PF_RULES_WASSERT(); 1807 1808 RB_INSERT(pfr_ktablehead, &V_pfr_ktables, kt); 1809 V_pfr_ktable_cnt++; 1810 if (kt->pfrkt_root != NULL) 1811 if (!kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]++) 1812 pfr_setflags_ktable(kt->pfrkt_root, 1813 kt->pfrkt_root->pfrkt_flags|PFR_TFLAG_REFDANCHOR); 1814} 1815 1816static void 1817pfr_setflags_ktables(struct pfr_ktableworkq *workq) 1818{ 1819 struct pfr_ktable *p, *q; 1820 1821 for (p = SLIST_FIRST(workq); p; p = q) { 1822 q = SLIST_NEXT(p, pfrkt_workq); 1823 pfr_setflags_ktable(p, p->pfrkt_nflags); 1824 } 1825} 1826 1827static void 1828pfr_setflags_ktable(struct pfr_ktable *kt, int newf) 1829{ 1830 struct pfr_kentryworkq addrq; 1831 struct pfr_walktree w; 1832 1833 PF_RULES_WASSERT(); 1834 1835 if (!(newf & PFR_TFLAG_REFERENCED) && 1836 !(newf & PFR_TFLAG_REFDANCHOR) && 1837 !(newf & PFR_TFLAG_PERSIST)) 1838 newf &= ~PFR_TFLAG_ACTIVE; 1839 if (!(newf & PFR_TFLAG_ACTIVE)) 1840 newf &= ~PFR_TFLAG_USRMASK; 1841 if (!(newf & PFR_TFLAG_SETMASK)) { 1842 RB_REMOVE(pfr_ktablehead, &V_pfr_ktables, kt); 1843 if (kt->pfrkt_root != NULL) 1844 if (!--kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]) 1845 pfr_setflags_ktable(kt->pfrkt_root, 1846 kt->pfrkt_root->pfrkt_flags & 1847 ~PFR_TFLAG_REFDANCHOR); 1848 pfr_destroy_ktable(kt, 1); 1849 V_pfr_ktable_cnt--; 1850 return; 1851 } 1852 if (newf & PFR_TFLAG_COUNTERS && ! (kt->pfrkt_flags & PFR_TFLAG_COUNTERS)) { 1853 bzero(&w, sizeof(w)); 1854 w.pfrw_op = PFRW_COUNTERS; 1855 w.pfrw_flags |= PFR_TFLAG_COUNTERS; 1856 kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w); 1857 kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w); 1858 } 1859 if (! (newf & PFR_TFLAG_COUNTERS) && (kt->pfrkt_flags & PFR_TFLAG_COUNTERS)) { 1860 bzero(&w, sizeof(w)); 1861 w.pfrw_op = PFRW_COUNTERS; 1862 w.pfrw_flags |= 0; 1863 kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w); 1864 kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w); 1865 } 1866 if (!(newf & PFR_TFLAG_ACTIVE) && kt->pfrkt_cnt) { 1867 pfr_enqueue_addrs(kt, &addrq, NULL, 0); 1868 pfr_remove_kentries(kt, &addrq); 1869 } 1870 if (!(newf & PFR_TFLAG_INACTIVE) && kt->pfrkt_shadow != NULL) { 1871 pfr_destroy_ktable(kt->pfrkt_shadow, 1); 1872 kt->pfrkt_shadow = NULL; 1873 } 1874 kt->pfrkt_flags = newf; 1875} 1876 1877static void 1878pfr_clstats_ktables(struct pfr_ktableworkq *workq, long tzero, int recurse) 1879{ 1880 struct pfr_ktable *p; 1881 1882 SLIST_FOREACH(p, workq, pfrkt_workq) 1883 pfr_clstats_ktable(p, tzero, recurse); 1884} 1885 1886static void 1887pfr_clstats_ktable(struct pfr_ktable *kt, long tzero, int recurse) 1888{ 1889 struct pfr_kentryworkq addrq; 1890 int pfr_dir, pfr_op; 1891 1892 MPASS(PF_TABLE_STATS_OWNED() || PF_RULES_WOWNED()); 1893 1894 if (recurse) { 1895 pfr_enqueue_addrs(kt, &addrq, NULL, 0); 1896 pfr_clstats_kentries(kt, &addrq, tzero, 0); 1897 } 1898 for (pfr_dir = 0; pfr_dir < PFR_DIR_MAX; pfr_dir ++) { 1899 for (pfr_op = 0; pfr_op < PFR_OP_TABLE_MAX; pfr_op ++) { 1900 pfr_kstate_counter_zero(&kt->pfrkt_packets[pfr_dir][pfr_op]); 1901 pfr_kstate_counter_zero(&kt->pfrkt_bytes[pfr_dir][pfr_op]); 1902 } 1903 } 1904 pfr_kstate_counter_zero(&kt->pfrkt_match); 1905 pfr_kstate_counter_zero(&kt->pfrkt_nomatch); 1906 kt->pfrkt_tzero = tzero; 1907} 1908 1909static struct pfr_ktable * 1910pfr_create_ktable(struct pfr_table *tbl, long tzero, int attachruleset) 1911{ 1912 struct pfr_ktable *kt; 1913 struct pf_kruleset *rs; 1914 int pfr_dir, pfr_op; 1915 1916 PF_RULES_WASSERT(); 1917 1918 kt = malloc(sizeof(*kt), M_PFTABLE, M_NOWAIT|M_ZERO); 1919 if (kt == NULL) 1920 return (NULL); 1921 kt->pfrkt_t = *tbl; 1922 1923 if (attachruleset) { 1924 rs = pf_find_or_create_kruleset(tbl->pfrt_anchor); 1925 if (!rs) { 1926 pfr_destroy_ktable(kt, 0); 1927 return (NULL); 1928 } 1929 kt->pfrkt_rs = rs; 1930 rs->tables++; 1931 } 1932 1933 for (pfr_dir = 0; pfr_dir < PFR_DIR_MAX; pfr_dir ++) { 1934 for (pfr_op = 0; pfr_op < PFR_OP_TABLE_MAX; pfr_op ++) { 1935 if (pfr_kstate_counter_init( 1936 &kt->pfrkt_packets[pfr_dir][pfr_op], M_NOWAIT) != 0) { 1937 pfr_destroy_ktable(kt, 0); 1938 return (NULL); 1939 } 1940 if (pfr_kstate_counter_init( 1941 &kt->pfrkt_bytes[pfr_dir][pfr_op], M_NOWAIT) != 0) { 1942 pfr_destroy_ktable(kt, 0); 1943 return (NULL); 1944 } 1945 } 1946 } 1947 if (pfr_kstate_counter_init(&kt->pfrkt_match, M_NOWAIT) != 0) { 1948 pfr_destroy_ktable(kt, 0); 1949 return (NULL); 1950 } 1951 1952 if (pfr_kstate_counter_init(&kt->pfrkt_nomatch, M_NOWAIT) != 0) { 1953 pfr_destroy_ktable(kt, 0); 1954 return (NULL); 1955 } 1956 1957 if (!rn_inithead((void **)&kt->pfrkt_ip4, 1958 offsetof(struct sockaddr_in, sin_addr) * 8) || 1959 !rn_inithead((void **)&kt->pfrkt_ip6, 1960 offsetof(struct sockaddr_in6, sin6_addr) * 8)) { 1961 pfr_destroy_ktable(kt, 0); 1962 return (NULL); 1963 } 1964 kt->pfrkt_tzero = tzero; 1965 1966 return (kt); 1967} 1968 1969static void 1970pfr_destroy_ktables(struct pfr_ktableworkq *workq, int flushaddr) 1971{ 1972 struct pfr_ktable *p, *q; 1973 1974 for (p = SLIST_FIRST(workq); p; p = q) { 1975 q = SLIST_NEXT(p, pfrkt_workq); 1976 pfr_destroy_ktable(p, flushaddr); 1977 } 1978} 1979 1980static void 1981pfr_destroy_ktable(struct pfr_ktable *kt, int flushaddr) 1982{ 1983 struct pfr_kentryworkq addrq; 1984 int pfr_dir, pfr_op; 1985 1986 if (flushaddr) { 1987 pfr_enqueue_addrs(kt, &addrq, NULL, 0); 1988 pfr_clean_node_mask(kt, &addrq); 1989 pfr_destroy_kentries(&addrq); 1990 } 1991 if (kt->pfrkt_ip4 != NULL) 1992 rn_detachhead((void **)&kt->pfrkt_ip4); 1993 if (kt->pfrkt_ip6 != NULL) 1994 rn_detachhead((void **)&kt->pfrkt_ip6); 1995 if (kt->pfrkt_shadow != NULL) 1996 pfr_destroy_ktable(kt->pfrkt_shadow, flushaddr); 1997 if (kt->pfrkt_rs != NULL) { 1998 kt->pfrkt_rs->tables--; 1999 pf_remove_if_empty_kruleset(kt->pfrkt_rs); 2000 } 2001 for (pfr_dir = 0; pfr_dir < PFR_DIR_MAX; pfr_dir ++) { 2002 for (pfr_op = 0; pfr_op < PFR_OP_TABLE_MAX; pfr_op ++) { 2003 pfr_kstate_counter_deinit(&kt->pfrkt_packets[pfr_dir][pfr_op]); 2004 pfr_kstate_counter_deinit(&kt->pfrkt_bytes[pfr_dir][pfr_op]); 2005 } 2006 } 2007 pfr_kstate_counter_deinit(&kt->pfrkt_match); 2008 pfr_kstate_counter_deinit(&kt->pfrkt_nomatch); 2009 2010 free(kt, M_PFTABLE); 2011} 2012 2013static int 2014pfr_ktable_compare(struct pfr_ktable *p, struct pfr_ktable *q) 2015{ 2016 int d; 2017 2018 if ((d = strncmp(p->pfrkt_name, q->pfrkt_name, PF_TABLE_NAME_SIZE))) 2019 return (d); 2020 return (strcmp(p->pfrkt_anchor, q->pfrkt_anchor)); 2021} 2022 2023static struct pfr_ktable * 2024pfr_lookup_table(struct pfr_table *tbl) 2025{ 2026 /* struct pfr_ktable start like a struct pfr_table */ 2027 return (RB_FIND(pfr_ktablehead, &V_pfr_ktables, 2028 (struct pfr_ktable *)tbl)); 2029} 2030 2031int 2032pfr_match_addr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af) 2033{ 2034 struct pfr_kentry *ke = NULL; 2035 int match; 2036 2037 PF_RULES_RASSERT(); 2038 2039 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) 2040 kt = kt->pfrkt_root; 2041 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 2042 return (0); 2043 2044 switch (af) { 2045#ifdef INET 2046 case AF_INET: 2047 { 2048 struct sockaddr_in sin; 2049 2050 bzero(&sin, sizeof(sin)); 2051 sin.sin_len = sizeof(sin); 2052 sin.sin_family = AF_INET; 2053 sin.sin_addr.s_addr = a->addr32[0]; 2054 ke = (struct pfr_kentry *)rn_match(&sin, &kt->pfrkt_ip4->rh); 2055 if (ke && KENTRY_RNF_ROOT(ke)) 2056 ke = NULL; 2057 break; 2058 } 2059#endif /* INET */ 2060#ifdef INET6 2061 case AF_INET6: 2062 { 2063 struct sockaddr_in6 sin6; 2064 2065 bzero(&sin6, sizeof(sin6)); 2066 sin6.sin6_len = sizeof(sin6); 2067 sin6.sin6_family = AF_INET6; 2068 bcopy(a, &sin6.sin6_addr, sizeof(sin6.sin6_addr)); 2069 ke = (struct pfr_kentry *)rn_match(&sin6, &kt->pfrkt_ip6->rh); 2070 if (ke && KENTRY_RNF_ROOT(ke)) 2071 ke = NULL; 2072 break; 2073 } 2074#endif /* INET6 */ 2075 } 2076 match = (ke && !ke->pfrke_not); 2077 if (match) 2078 pfr_kstate_counter_add(&kt->pfrkt_match, 1); 2079 else 2080 pfr_kstate_counter_add(&kt->pfrkt_nomatch, 1); 2081 return (match); 2082} 2083 2084void 2085pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af, 2086 u_int64_t len, int dir_out, int op_pass, int notrule) 2087{ 2088 struct pfr_kentry *ke = NULL; 2089 2090 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) 2091 kt = kt->pfrkt_root; 2092 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 2093 return; 2094 2095 switch (af) { 2096#ifdef INET 2097 case AF_INET: 2098 { 2099 struct sockaddr_in sin; 2100 2101 bzero(&sin, sizeof(sin)); 2102 sin.sin_len = sizeof(sin); 2103 sin.sin_family = AF_INET; 2104 sin.sin_addr.s_addr = a->addr32[0]; 2105 ke = (struct pfr_kentry *)rn_match(&sin, &kt->pfrkt_ip4->rh); 2106 if (ke && KENTRY_RNF_ROOT(ke)) 2107 ke = NULL; 2108 break; 2109 } 2110#endif /* INET */ 2111#ifdef INET6 2112 case AF_INET6: 2113 { 2114 struct sockaddr_in6 sin6; 2115 2116 bzero(&sin6, sizeof(sin6)); 2117 sin6.sin6_len = sizeof(sin6); 2118 sin6.sin6_family = AF_INET6; 2119 bcopy(a, &sin6.sin6_addr, sizeof(sin6.sin6_addr)); 2120 ke = (struct pfr_kentry *)rn_match(&sin6, &kt->pfrkt_ip6->rh); 2121 if (ke && KENTRY_RNF_ROOT(ke)) 2122 ke = NULL; 2123 break; 2124 } 2125#endif /* INET6 */ 2126 default: 2127 panic("%s: unknown address family %u", __func__, af); 2128 } 2129 if ((ke == NULL || ke->pfrke_not) != notrule) { 2130 if (op_pass != PFR_OP_PASS) 2131 DPFPRINTF(PF_DEBUG_URGENT, 2132 ("pfr_update_stats: assertion failed.\n")); 2133 op_pass = PFR_OP_XPASS; 2134 } 2135 pfr_kstate_counter_add(&kt->pfrkt_packets[dir_out][op_pass], 1); 2136 pfr_kstate_counter_add(&kt->pfrkt_bytes[dir_out][op_pass], len); 2137 if (ke != NULL && op_pass != PFR_OP_XPASS && 2138 (kt->pfrkt_flags & PFR_TFLAG_COUNTERS)) { 2139 counter_u64_add(pfr_kentry_counter(&ke->pfrke_counters, 2140 dir_out, op_pass, PFR_TYPE_PACKETS), 1); 2141 counter_u64_add(pfr_kentry_counter(&ke->pfrke_counters, 2142 dir_out, op_pass, PFR_TYPE_BYTES), len); 2143 } 2144} 2145 2146struct pfr_ktable * 2147pfr_eth_attach_table(struct pf_keth_ruleset *rs, char *name) 2148{ 2149 struct pfr_ktable *kt, *rt; 2150 struct pfr_table tbl; 2151 struct pf_keth_anchor *ac = rs->anchor; 2152 2153 PF_RULES_WASSERT(); 2154 2155 bzero(&tbl, sizeof(tbl)); 2156 strlcpy(tbl.pfrt_name, name, sizeof(tbl.pfrt_name)); 2157 if (ac != NULL) 2158 strlcpy(tbl.pfrt_anchor, ac->path, sizeof(tbl.pfrt_anchor)); 2159 kt = pfr_lookup_table(&tbl); 2160 if (kt == NULL) { 2161 kt = pfr_create_ktable(&tbl, time_second, 1); 2162 if (kt == NULL) 2163 return (NULL); 2164 if (ac != NULL) { 2165 bzero(tbl.pfrt_anchor, sizeof(tbl.pfrt_anchor)); 2166 rt = pfr_lookup_table(&tbl); 2167 if (rt == NULL) { 2168 rt = pfr_create_ktable(&tbl, 0, 1); 2169 if (rt == NULL) { 2170 pfr_destroy_ktable(kt, 0); 2171 return (NULL); 2172 } 2173 pfr_insert_ktable(rt); 2174 } 2175 kt->pfrkt_root = rt; 2176 } 2177 pfr_insert_ktable(kt); 2178 } 2179 if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++) 2180 pfr_setflags_ktable(kt, kt->pfrkt_flags|PFR_TFLAG_REFERENCED); 2181 return (kt); 2182} 2183 2184struct pfr_ktable * 2185pfr_attach_table(struct pf_kruleset *rs, char *name) 2186{ 2187 struct pfr_ktable *kt, *rt; 2188 struct pfr_table tbl; 2189 struct pf_kanchor *ac = rs->anchor; 2190 2191 PF_RULES_WASSERT(); 2192 2193 bzero(&tbl, sizeof(tbl)); 2194 strlcpy(tbl.pfrt_name, name, sizeof(tbl.pfrt_name)); 2195 if (ac != NULL) 2196 strlcpy(tbl.pfrt_anchor, ac->path, sizeof(tbl.pfrt_anchor)); 2197 kt = pfr_lookup_table(&tbl); 2198 if (kt == NULL) { 2199 kt = pfr_create_ktable(&tbl, time_second, 1); 2200 if (kt == NULL) 2201 return (NULL); 2202 if (ac != NULL) { 2203 bzero(tbl.pfrt_anchor, sizeof(tbl.pfrt_anchor)); 2204 rt = pfr_lookup_table(&tbl); 2205 if (rt == NULL) { 2206 rt = pfr_create_ktable(&tbl, 0, 1); 2207 if (rt == NULL) { 2208 pfr_destroy_ktable(kt, 0); 2209 return (NULL); 2210 } 2211 pfr_insert_ktable(rt); 2212 } 2213 kt->pfrkt_root = rt; 2214 } 2215 pfr_insert_ktable(kt); 2216 } 2217 if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++) 2218 pfr_setflags_ktable(kt, kt->pfrkt_flags|PFR_TFLAG_REFERENCED); 2219 return (kt); 2220} 2221 2222void 2223pfr_detach_table(struct pfr_ktable *kt) 2224{ 2225 2226 PF_RULES_WASSERT(); 2227 KASSERT(kt->pfrkt_refcnt[PFR_REFCNT_RULE] > 0, ("%s: refcount %d\n", 2228 __func__, kt->pfrkt_refcnt[PFR_REFCNT_RULE])); 2229 2230 if (!--kt->pfrkt_refcnt[PFR_REFCNT_RULE]) 2231 pfr_setflags_ktable(kt, kt->pfrkt_flags&~PFR_TFLAG_REFERENCED); 2232} 2233 2234int 2235pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter, 2236 sa_family_t af) 2237{ 2238 struct pf_addr *addr, *cur, *mask; 2239 union sockaddr_union uaddr, umask; 2240 struct pfr_kentry *ke, *ke2 = NULL; 2241 int idx = -1, use_counter = 0; 2242 2243 MPASS(pidx != NULL); 2244 MPASS(counter != NULL); 2245 2246 switch (af) { 2247 case AF_INET: 2248 uaddr.sin.sin_len = sizeof(struct sockaddr_in); 2249 uaddr.sin.sin_family = AF_INET; 2250 break; 2251 case AF_INET6: 2252 uaddr.sin6.sin6_len = sizeof(struct sockaddr_in6); 2253 uaddr.sin6.sin6_family = AF_INET6; 2254 break; 2255 } 2256 addr = SUNION2PF(&uaddr, af); 2257 2258 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) 2259 kt = kt->pfrkt_root; 2260 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 2261 return (-1); 2262 2263 idx = *pidx; 2264 if (idx >= 0) 2265 use_counter = 1; 2266 if (idx < 0) 2267 idx = 0; 2268 2269_next_block: 2270 ke = pfr_kentry_byidx(kt, idx, af); 2271 if (ke == NULL) { 2272 pfr_kstate_counter_add(&kt->pfrkt_nomatch, 1); 2273 return (1); 2274 } 2275 pfr_prepare_network(&umask, af, ke->pfrke_net); 2276 cur = SUNION2PF(&ke->pfrke_sa, af); 2277 mask = SUNION2PF(&umask, af); 2278 2279 if (use_counter) { 2280 /* is supplied address within block? */ 2281 if (!PF_MATCHA(0, cur, mask, counter, af)) { 2282 /* no, go to next block in table */ 2283 idx++; 2284 use_counter = 0; 2285 goto _next_block; 2286 } 2287 PF_ACPY(addr, counter, af); 2288 } else { 2289 /* use first address of block */ 2290 PF_ACPY(addr, cur, af); 2291 } 2292 2293 if (!KENTRY_NETWORK(ke)) { 2294 /* this is a single IP address - no possible nested block */ 2295 PF_ACPY(counter, addr, af); 2296 *pidx = idx; 2297 pfr_kstate_counter_add(&kt->pfrkt_match, 1); 2298 return (0); 2299 } 2300 for (;;) { 2301 /* we don't want to use a nested block */ 2302 switch (af) { 2303 case AF_INET: 2304 ke2 = (struct pfr_kentry *)rn_match(&uaddr, 2305 &kt->pfrkt_ip4->rh); 2306 break; 2307 case AF_INET6: 2308 ke2 = (struct pfr_kentry *)rn_match(&uaddr, 2309 &kt->pfrkt_ip6->rh); 2310 break; 2311 } 2312 /* no need to check KENTRY_RNF_ROOT() here */ 2313 if (ke2 == ke) { 2314 /* lookup return the same block - perfect */ 2315 PF_ACPY(counter, addr, af); 2316 *pidx = idx; 2317 pfr_kstate_counter_add(&kt->pfrkt_match, 1); 2318 return (0); 2319 } 2320 2321 /* we need to increase the counter past the nested block */ 2322 pfr_prepare_network(&umask, AF_INET, ke2->pfrke_net); 2323 PF_POOLMASK(addr, addr, SUNION2PF(&umask, af), &pfr_ffaddr, af); 2324 PF_AINC(addr, af); 2325 if (!PF_MATCHA(0, cur, mask, addr, af)) { 2326 /* ok, we reached the end of our main block */ 2327 /* go to next block in table */ 2328 idx++; 2329 use_counter = 0; 2330 goto _next_block; 2331 } 2332 } 2333} 2334 2335static struct pfr_kentry * 2336pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af) 2337{ 2338 struct pfr_walktree w; 2339 2340 bzero(&w, sizeof(w)); 2341 w.pfrw_op = PFRW_POOL_GET; 2342 w.pfrw_free = idx; 2343 2344 switch (af) { 2345#ifdef INET 2346 case AF_INET: 2347 kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w); 2348 return (w.pfrw_kentry); 2349#endif /* INET */ 2350#ifdef INET6 2351 case AF_INET6: 2352 kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w); 2353 return (w.pfrw_kentry); 2354#endif /* INET6 */ 2355 default: 2356 return (NULL); 2357 } 2358} 2359 2360void 2361pfr_dynaddr_update(struct pfr_ktable *kt, struct pfi_dynaddr *dyn) 2362{ 2363 struct pfr_walktree w; 2364 2365 bzero(&w, sizeof(w)); 2366 w.pfrw_op = PFRW_DYNADDR_UPDATE; 2367 w.pfrw_dyn = dyn; 2368 2369 dyn->pfid_acnt4 = 0; 2370 dyn->pfid_acnt6 = 0; 2371 if (!dyn->pfid_af || dyn->pfid_af == AF_INET) 2372 kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w); 2373 if (!dyn->pfid_af || dyn->pfid_af == AF_INET6) 2374 kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w); 2375} 2376