sys/net/pf/pf_ioctl.c

   1 /*      $OpenBSD: pf_ioctl.c,v 1.209 2008/06/29 08:42:15 mcbride Exp $ */
   2 /*add $OpenBSD: pf_ioctl.c,v 1.212 2009/02/15 20:42:33 mbalmer Exp $ */
   3
   4 /*
   5  * Copyright (c) 2010 The DragonFly Project.  All rights reserved.
   6  *
   7  * Copyright (c) 2001 Daniel Hartmeier
   8  * Copyright (c) 2002,2003 Henning Brauer
   9  * All rights reserved.
  10  *
  11  * Redistribution and use in source and binary forms, with or without
  12  * modification, are permitted provided that the following conditions
  13  * are met:
  14  *
  15  *    - Redistributions of source code must retain the above copyright
  16  *      notice, this list of conditions and the following disclaimer.
  17  *    - Redistributions in binary form must reproduce the above
  18  *      copyright notice, this list of conditions and the following
  19  *      disclaimer in the documentation and/or other materials provided
  20  *      with the distribution.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  23  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  24  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  25  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  26  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  27  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  28  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  29  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  30  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  32  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  33  * POSSIBILITY OF SUCH DAMAGE.
  34  *
  35  * Effort sponsored in part by the Defense Advanced Research Projects
  36  * Agency (DARPA) and Air Force Research Laboratory, Air Force
  37  * Materiel Command, USAF, under agreement number F30602-01-2-0537.
  38  *
  39  */
  40
  41 #include "opt_inet.h"
  42 #include "opt_inet6.h"
  43
  44 #include <sys/param.h>
  45 #include <sys/systm.h>
  46 #include <sys/conf.h>
  47 #include <sys/device.h>
  48 #include <sys/mbuf.h>
  49 #include <sys/filio.h>
  50 #include <sys/fcntl.h>
  51 #include <sys/socket.h>
  52 #include <sys/socketvar.h>
  53 #include <sys/kernel.h>
  54 #include <sys/kthread.h>
  55 #include <sys/time.h>
  56 #include <sys/proc.h>
  57 #include <sys/malloc.h>
  58 #include <sys/module.h>
  59 #include <vm/vm_zone.h>
  60 #include <sys/lock.h>
  61
  62 #include <sys/thread2.h>
  63
  64 #include <net/if.h>
  65 #include <net/if_types.h>
  66 #include <net/route.h>
  67
  68 #include <netinet/in.h>
  69 #include <netinet/in_var.h>
  70 #include <netinet/in_systm.h>
  71 #include <netinet/ip.h>
  72 #include <netinet/ip_var.h>
  73 #include <netinet/ip_icmp.h>
  74
  75 #include <net/pf/pfvar.h>
  76 #include <sys/md5.h>
  77 #include <net/pf/pfvar.h>
  78
  79 #include <net/pf/if_pfsync.h>
  80
  81 #if NPFLOG > 0
  82 #include <net/if_pflog.h>
  83 #endif /* NPFLOG > 0 */
  84
  85 #ifdef INET6
  86 #include <netinet/ip6.h>
  87 #include <netinet/in_pcb.h>
  88 #endif /* INET6 */
  89
  90 #ifdef ALTQ
  91 #include <net/altq/altq.h>
  92 #endif
  93
  94 #include <machine/limits.h>
  95 #include <net/pfil.h>
  96 #include <sys/mutex.h>
  97
  98 u_int rt_numfibs = RT_NUMFIBS;
  99
 100 void                     init_zone_var(void);
 101 void                     cleanup_pf_zone(void);
 102 int                      pfattach(void);
 103 struct pf_pool          *pf_get_pool(char *, u_int32_t, u_int8_t, u_int32_t,
 104                             u_int8_t, u_int8_t, u_int8_t);
 105
 106 void                     pf_mv_pool(struct pf_palist *, struct pf_palist *);
 107 void                     pf_empty_pool(struct pf_palist *);
 108 #ifdef ALTQ
 109 int                      pf_begin_altq(u_int32_t *);
 110 int                      pf_rollback_altq(u_int32_t);
 111 int                      pf_commit_altq(u_int32_t);
 112 int                      pf_enable_altq(struct pf_altq *);
 113 int                      pf_disable_altq(struct pf_altq *);
 114 #endif /* ALTQ */
 115 int                      pf_begin_rules(u_int32_t *, int, const char *);
 116 int                      pf_rollback_rules(u_int32_t, int, char *);
 117 int                      pf_setup_pfsync_matching(struct pf_ruleset *);
 118 void                     pf_hash_rule(MD5_CTX *, struct pf_rule *);
 119 void                     pf_hash_rule_addr(MD5_CTX *, struct pf_rule_addr *);
 120 int                      pf_commit_rules(u_int32_t, int, char *);
 121 int                      pf_addr_setup(struct pf_ruleset *,
 122                             struct pf_addr_wrap *, sa_family_t);
 123 void                     pf_addr_copyout(struct pf_addr_wrap *);
 124
 125 struct pf_rule           pf_default_rule;
 126 struct lock              pf_consistency_lock;
 127 #ifdef ALTQ
 128 static int               pf_altq_running;
 129 #endif
 130
 131 #define TAGID_MAX        50000
 132 TAILQ_HEAD(pf_tags, pf_tagname) pf_tags = TAILQ_HEAD_INITIALIZER(pf_tags),
 133                                 pf_qids = TAILQ_HEAD_INITIALIZER(pf_qids);
 134
 135 #if (PF_QNAME_SIZE != PF_TAG_NAME_SIZE)
 136 #error PF_QNAME_SIZE must be equal to PF_TAG_NAME_SIZE
 137 #endif
 138 u_int16_t                tagname2tag(struct pf_tags *, char *);
 139 void                     tag2tagname(struct pf_tags *, u_int16_t, char *);
 140 void                     tag_unref(struct pf_tags *, u_int16_t);
 141 int                      pf_rtlabel_add(struct pf_addr_wrap *);
 142 void                     pf_rtlabel_remove(struct pf_addr_wrap *);
 143 void                     pf_rtlabel_copyout(struct pf_addr_wrap *);
 144
 145 #define DPFPRINTF(n, x) if (pf_status.debug >= (n)) kprintf x
 146
 147 static cdev_t   pf_dev;
 148
 149 /*
 150  * XXX - These are new and need to be checked when moveing to a new version
 151  */
 152 static void              pf_clear_states(void);
 153 static int               pf_clear_tables(void);
 154 static void              pf_clear_srcnodes(void);
 155 /*
 156  * XXX - These are new and need to be checked when moveing to a new version
 157  */
 158
 159 /*
 160  * Wrapper functions for pfil(9) hooks
 161  */
 162 static int pf_check_in(void *arg, struct mbuf **m, struct ifnet *ifp,
 163                 int dir);
 164 static int pf_check_out(void *arg, struct mbuf **m, struct ifnet *ifp,
 165                 int dir);
 166 #ifdef INET6
 167 static int pf_check6_in(void *arg, struct mbuf **m, struct ifnet *ifp,
 168                 int dir);
 169 static int pf_check6_out(void *arg, struct mbuf **m, struct ifnet *ifp,
 170                 int dir);
 171 #endif
 172
 173 static int               hook_pf(void);
 174 static int               dehook_pf(void);
 175 static int               shutdown_pf(void);
 176 static int               pf_load(void);
 177 static int               pf_unload(void);
 178
 179 d_open_t        pfopen;
 180 d_close_t       pfclose;
 181 d_ioctl_t       pfioctl;
 182
 183 static struct dev_ops pf_ops = {            /* XXX convert to port model */
 184         { PF_NAME, 73, 0 },
 185         .d_open =       pfopen,
 186         .d_close =      pfclose,
 187         .d_ioctl =      pfioctl
 188 };
 189
 190 static volatile int pf_pfil_hooked = 0;
 191 int pf_end_threads = 0;
 192 struct lock pf_mod_lck;
 193
 194 int debug_pfugidhack = 0;
 195 SYSCTL_INT(_debug, OID_AUTO, pfugidhack, CTLFLAG_RW, &debug_pfugidhack, 0,
 196         "Enable/disable pf user/group rules mpsafe hack");
 197
 198 void
 199 init_zone_var(void)
 200 {
 201         pf_src_tree_pl = pf_rule_pl = NULL;
 202         pf_state_pl = pf_altq_pl = pf_pooladdr_pl = NULL;
 203         pf_frent_pl = pf_frag_pl = pf_cache_pl = pf_cent_pl = NULL;
 204         pf_state_scrub_pl = NULL;
 205         pfr_ktable_pl = pfr_kentry_pl = NULL;
 206 }
 207
 208 void
 209 cleanup_pf_zone(void)
 210 {
 211         ZONE_DESTROY(pf_src_tree_pl);
 212         ZONE_DESTROY(pf_rule_pl);
 213         ZONE_DESTROY(pf_state_pl);
 214         ZONE_DESTROY(pf_altq_pl);
 215         ZONE_DESTROY(pf_pooladdr_pl);
 216         ZONE_DESTROY(pf_frent_pl);
 217         ZONE_DESTROY(pf_frag_pl);
 218         ZONE_DESTROY(pf_cache_pl);
 219         ZONE_DESTROY(pf_cent_pl);
 220         ZONE_DESTROY(pfr_ktable_pl);
 221         ZONE_DESTROY(pfr_kentry_pl);
 222         ZONE_DESTROY(pfr_kentry_pl2);
 223         ZONE_DESTROY(pf_state_scrub_pl);
 224         ZONE_DESTROY(pfi_addr_pl);
 225 }
 226
 227 int
 228 pfattach(void)
 229 {
 230         u_int32_t *my_timeout = pf_default_rule.timeout;
 231         int error = 1;
 232
 233         if (!rn_inithead((void **)&pf_maskhead, NULL, 0)) {
 234                 kprintf("pf mask radix tree create failed\n");
 235                 return ENOMEM;
 236         }
 237
 238         do {
 239                 ZONE_CREATE(pf_src_tree_pl,struct pf_src_node, "pfsrctrpl");
 240                 ZONE_CREATE(pf_rule_pl,    struct pf_rule, "pfrulepl");
 241                 ZONE_CREATE(pf_state_pl,   struct pf_state, "pfstatepl");
 242                 ZONE_CREATE(pf_state_key_pl, struct pf_state_key, "pfstatekeypl");
 243                 ZONE_CREATE(pf_state_item_pl, struct pf_state_item, "pfstateitempl");
 244                 ZONE_CREATE(pf_altq_pl,    struct pf_altq, "pfaltqpl");
 245                 ZONE_CREATE(pf_pooladdr_pl,struct pf_pooladdr, "pfpooladdrpl");
 246                 ZONE_CREATE(pfr_ktable_pl, struct pfr_ktable, "pfrktable");
 247                 ZONE_CREATE(pfr_kentry_pl, struct pfr_kentry, "pfrkentry");
 248                 ZONE_CREATE(pfr_kentry_pl2, struct pfr_kentry, "pfrkentry2");
 249                 ZONE_CREATE(pf_frent_pl,   struct pf_frent, "pffrent");
 250                 ZONE_CREATE(pf_frag_pl,    struct pf_fragment, "pffrag");
 251                 ZONE_CREATE(pf_cache_pl,   struct pf_fragment, "pffrcache");
 252                 ZONE_CREATE(pf_cent_pl,    struct pf_frcache, "pffrcent");
 253                 ZONE_CREATE(pf_state_scrub_pl, struct pf_state_scrub,
 254                     "pfstatescrub");
 255                 ZONE_CREATE(pfi_addr_pl,   struct pfi_dynaddr, "pfiaddrpl");
 256                 error = 0;
 257         } while(0);
 258         if (error) {
 259                 cleanup_pf_zone();
 260                 return (error);
 261         }
 262         pfr_initialize();
 263         pfi_initialize();
 264         error = pf_osfp_initialize();
 265         if (error) {
 266                 cleanup_pf_zone();
 267                 pf_osfp_cleanup();
 268                 return (error);
 269         }
 270
 271         pf_pool_limits[PF_LIMIT_STATES].pp = pf_state_pl;
 272         pf_pool_limits[PF_LIMIT_STATES].limit = PFSTATE_HIWAT;
 273         pf_pool_limits[PF_LIMIT_FRAGS].pp = pf_frent_pl;
 274         pf_pool_limits[PF_LIMIT_FRAGS].limit = PFFRAG_FRENT_HIWAT;
 275         /* XXX uma_zone_set_max(pf_pool_limits[PF_LIMIT_STATES].pp,
 276                 pf_pool_limits[PF_LIMIT_STATES].limit);
 277         */
 278         if (ctob(physmem) <= 100*1024*1024)
 279                 pf_pool_limits[PF_LIMIT_TABLE_ENTRIES].limit =
 280                     PFR_KENTRY_HIWAT_SMALL;
 281
 282         RB_INIT(&tree_src_tracking);
 283         RB_INIT(&pf_anchors);
 284         pf_init_ruleset(&pf_main_ruleset);
 285         TAILQ_INIT(&pf_altqs[0]);
 286         TAILQ_INIT(&pf_altqs[1]);
 287         TAILQ_INIT(&pf_pabuf);
 288         pf_altqs_active = &pf_altqs[0];
 289         pf_altqs_inactive = &pf_altqs[1];
 290         TAILQ_INIT(&state_list);
 291
 292         /* default rule should never be garbage collected */
 293         pf_default_rule.entries.tqe_prev = &pf_default_rule.entries.tqe_next;
 294         pf_default_rule.action = PF_PASS;
 295         pf_default_rule.nr = (uint32_t)(-1);
 296         pf_default_rule.rtableid = -1;
 297
 298         /* initialize default timeouts */
 299         my_timeout[PFTM_TCP_FIRST_PACKET] = 120;        /* First TCP packet */
 300         my_timeout[PFTM_TCP_OPENING] = 30;              /* No response yet */
 301         my_timeout[PFTM_TCP_ESTABLISHED] = 24*60*60;    /* Established */
 302         my_timeout[PFTM_TCP_CLOSING] = 15 * 60;         /* Half closed */
 303         my_timeout[PFTM_TCP_FIN_WAIT] = 45;             /* Got both FINs */
 304         my_timeout[PFTM_TCP_CLOSED] = 90;               /* Got a RST */
 305         my_timeout[PFTM_UDP_FIRST_PACKET] = 60;         /* First UDP packet */
 306         my_timeout[PFTM_UDP_SINGLE] = 30;               /* Unidirectional */
 307         my_timeout[PFTM_UDP_MULTIPLE] = 60;             /* Bidirectional */
 308         my_timeout[PFTM_ICMP_FIRST_PACKET] = 20;        /* First ICMP packet */
 309         my_timeout[PFTM_ICMP_ERROR_REPLY] = 10;         /* Got error response */
 310         my_timeout[PFTM_OTHER_FIRST_PACKET] = 60;       /* First packet */
 311         my_timeout[PFTM_OTHER_SINGLE] = 30;             /* Unidirectional */
 312         my_timeout[PFTM_OTHER_MULTIPLE] = 60;           /* Bidirectional */
 313         my_timeout[PFTM_FRAG] = 30;                     /* Fragment expire */
 314         my_timeout[PFTM_INTERVAL] = 10;                 /* Expire interval */
 315         my_timeout[PFTM_SRC_NODE] = 0;          /* Source Tracking */
 316         my_timeout[PFTM_TS_DIFF] = 30;          /* Allowed TS diff */
 317         my_timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START;
 318         my_timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END;
 319
 320         pf_normalize_init();
 321         bzero(&pf_status, sizeof(pf_status));
 322         pf_status.debug = PF_DEBUG_URGENT;
 323
 324         /* XXX do our best to avoid a conflict */
 325         pf_status.hostid = karc4random();
 326
 327         if (kthread_create(pf_purge_thread, NULL, NULL, "pfpurge"))
 328                 panic("pfpurge thread");
 329
 330         return (error);
 331 }
 332
 333 int
 334 pfopen(struct dev_open_args *ap)
 335 {
 336         lwkt_gettoken(&pf_token);
 337         cdev_t dev = ap->a_head.a_dev;
 338         if (minor(dev) >= 1) {
 339                 lwkt_reltoken(&pf_token);
 340                 return (ENXIO);
 341         }
 342         lwkt_reltoken(&pf_token);
 343         return (0);
 344 }
 345
 346 int
 347 pfclose(struct dev_close_args *ap)
 348 {
 349         lwkt_gettoken(&pf_token);
 350         cdev_t dev = ap->a_head.a_dev;
 351         if (minor(dev) >= 1) {
 352                 lwkt_reltoken(&pf_token);
 353                 return (ENXIO);
 354         }
 355         lwkt_reltoken(&pf_token);
 356         return (0);
 357 }
 358
 359 struct pf_pool *
 360 pf_get_pool(char *anchor, u_int32_t ticket, u_int8_t rule_action,
 361     u_int32_t rule_number, u_int8_t r_last, u_int8_t active,
 362     u_int8_t check_ticket)
 363 {
 364         struct pf_ruleset       *ruleset;
 365         struct pf_rule          *rule;
 366         int                      rs_num;
 367
 368         ruleset = pf_find_ruleset(anchor);
 369         if (ruleset == NULL)
 370                 return (NULL);
 371         rs_num = pf_get_ruleset_number(rule_action);
 372         if (rs_num >= PF_RULESET_MAX)
 373                 return (NULL);
 374         if (active) {
 375                 if (check_ticket && ticket !=
 376                     ruleset->rules[rs_num].active.ticket)
 377                         return (NULL);
 378                 if (r_last)
 379                         rule = TAILQ_LAST(ruleset->rules[rs_num].active.ptr,
 380                             pf_rulequeue);
 381                 else
 382                         rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr);
 383         } else {
 384                 if (check_ticket && ticket !=
 385                     ruleset->rules[rs_num].inactive.ticket)
 386                         return (NULL);
 387                 if (r_last)
 388                         rule = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr,
 389                             pf_rulequeue);
 390                 else
 391                         rule = TAILQ_FIRST(ruleset->rules[rs_num].inactive.ptr);
 392         }
 393         if (!r_last) {
 394                 while ((rule != NULL) && (rule->nr != rule_number))
 395                         rule = TAILQ_NEXT(rule, entries);
 396         }
 397         if (rule == NULL)
 398                 return (NULL);
 399
 400         return (&rule->rpool);
 401 }
 402
 403 void
 404 pf_mv_pool(struct pf_palist *poola, struct pf_palist *poolb)
 405 {
 406         struct pf_pooladdr      *mv_pool_pa;
 407
 408         while ((mv_pool_pa = TAILQ_FIRST(poola)) != NULL) {
 409                 TAILQ_REMOVE(poola, mv_pool_pa, entries);
 410                 TAILQ_INSERT_TAIL(poolb, mv_pool_pa, entries);
 411         }
 412 }
 413
 414 void
 415 pf_empty_pool(struct pf_palist *poola)
 416 {
 417         struct pf_pooladdr      *empty_pool_pa;
 418
 419         while ((empty_pool_pa = TAILQ_FIRST(poola)) != NULL) {
 420                 pfi_dynaddr_remove(&empty_pool_pa->addr);
 421                 pf_tbladdr_remove(&empty_pool_pa->addr);
 422                 pfi_kif_unref(empty_pool_pa->kif, PFI_KIF_REF_RULE);
 423                 TAILQ_REMOVE(poola, empty_pool_pa, entries);
 424                 pool_put(&pf_pooladdr_pl, empty_pool_pa);
 425         }
 426 }
 427
 428 void
 429 pf_rm_rule(struct pf_rulequeue *rulequeue, struct pf_rule *rule)
 430 {
 431         if (rulequeue != NULL) {
 432                 if (rule->states_cur <= 0) {
 433                         /*
 434                          * XXX - we need to remove the table *before* detaching
 435                          * the rule to make sure the table code does not delete
 436                          * the anchor under our feet.
 437                          */
 438                         pf_tbladdr_remove(&rule->src.addr);
 439                         pf_tbladdr_remove(&rule->dst.addr);
 440                         if (rule->overload_tbl)
 441                                 pfr_detach_table(rule->overload_tbl);
 442                 }
 443                 TAILQ_REMOVE(rulequeue, rule, entries);
 444                 rule->entries.tqe_prev = NULL;
 445                 rule->nr = -1;
 446         }
 447
 448         if (rule->states_cur > 0 || rule->src_nodes > 0 ||
 449             rule->entries.tqe_prev != NULL)
 450                 return;
 451         pf_tag_unref(rule->tag);
 452         pf_tag_unref(rule->match_tag);
 453 #ifdef ALTQ
 454         if (rule->pqid != rule->qid)
 455                 pf_qid_unref(rule->pqid);
 456         pf_qid_unref(rule->qid);
 457 #endif
 458         pf_rtlabel_remove(&rule->src.addr);
 459         pf_rtlabel_remove(&rule->dst.addr);
 460         pfi_dynaddr_remove(&rule->src.addr);
 461         pfi_dynaddr_remove(&rule->dst.addr);
 462         if (rulequeue == NULL) {
 463                 pf_tbladdr_remove(&rule->src.addr);
 464                 pf_tbladdr_remove(&rule->dst.addr);
 465                 if (rule->overload_tbl)
 466                         pfr_detach_table(rule->overload_tbl);
 467         }
 468         pfi_kif_unref(rule->kif, PFI_KIF_REF_RULE);
 469         pf_anchor_remove(rule);
 470         pf_empty_pool(&rule->rpool.list);
 471         pool_put(&pf_rule_pl, rule);
 472 }
 473
 474 u_int16_t
 475 tagname2tag(struct pf_tags *head, char *tagname)
 476 {
 477         struct pf_tagname       *tag, *p = NULL;
 478         u_int16_t                new_tagid = 1;
 479
 480         TAILQ_FOREACH(tag, head, entries)
 481                 if (strcmp(tagname, tag->name) == 0) {
 482                         tag->ref++;
 483                         return (tag->tag);
 484                 }
 485
 486         /*
 487          * to avoid fragmentation, we do a linear search from the beginning
 488          * and take the first free slot we find. if there is none or the list
 489          * is empty, append a new entry at the end.
 490          */
 491
 492         /* new entry */
 493         if (!TAILQ_EMPTY(head))
 494                 for (p = TAILQ_FIRST(head); p != NULL &&
 495                     p->tag == new_tagid; p = TAILQ_NEXT(p, entries))
 496                         new_tagid = p->tag + 1;
 497
 498         if (new_tagid > TAGID_MAX)
 499                 return (0);
 500
 501         /* allocate and fill new struct pf_tagname */
 502         tag = kmalloc(sizeof(*tag), M_TEMP, M_WAITOK);
 503         if (tag == NULL)
 504                 return (0);
 505         strlcpy(tag->name, tagname, sizeof(tag->name));
 506         tag->tag = new_tagid;
 507         tag->ref++;
 508
 509         if (p != NULL)  /* insert new entry before p */
 510                 TAILQ_INSERT_BEFORE(p, tag, entries);
 511         else    /* either list empty or no free slot in between */
 512                 TAILQ_INSERT_TAIL(head, tag, entries);
 513
 514         return (tag->tag);
 515 }
 516
 517 void
 518 tag2tagname(struct pf_tags *head, u_int16_t tagid, char *p)
 519 {
 520         struct pf_tagname       *tag;
 521
 522         TAILQ_FOREACH(tag, head, entries)
 523                 if (tag->tag == tagid) {
 524                         strlcpy(p, tag->name, PF_TAG_NAME_SIZE);
 525                         return;
 526                 }
 527 }
 528
 529 void
 530 tag_unref(struct pf_tags *head, u_int16_t tag)
 531 {
 532         struct pf_tagname       *p, *next;
 533
 534         if (tag == 0)
 535                 return;
 536
 537         for (p = TAILQ_FIRST(head); p != NULL; p = next) {
 538                 next = TAILQ_NEXT(p, entries);
 539                 if (tag == p->tag) {
 540                         if (--p->ref == 0) {
 541                                 TAILQ_REMOVE(head, p, entries);
 542                                 kfree(p, M_TEMP);
 543                         }
 544                         break;
 545                 }
 546         }
 547 }
 548
 549 u_int16_t
 550 pf_tagname2tag(char *tagname)
 551 {
 552         return (tagname2tag(&pf_tags, tagname));
 553 }
 554
 555 void
 556 pf_tag2tagname(u_int16_t tagid, char *p)
 557 {
 558         tag2tagname(&pf_tags, tagid, p);
 559 }
 560
 561 void
 562 pf_tag_ref(u_int16_t tag)
 563 {
 564         struct pf_tagname *t;
 565
 566         TAILQ_FOREACH(t, &pf_tags, entries)
 567                 if (t->tag == tag)
 568                         break;
 569         if (t != NULL)
 570                 t->ref++;
 571 }
 572
 573 void
 574 pf_tag_unref(u_int16_t tag)
 575 {
 576         tag_unref(&pf_tags, tag);
 577 }
 578
 579 int
 580 pf_rtlabel_add(struct pf_addr_wrap *a)
 581 {
 582         return (0);
 583 }
 584
 585 void
 586 pf_rtlabel_remove(struct pf_addr_wrap *a)
 587 {
 588 }
 589
 590 void
 591 pf_rtlabel_copyout(struct pf_addr_wrap *a)
 592 {
 593         if (a->type == PF_ADDR_RTLABEL && a->v.rtlabel)
 594                 strlcpy(a->v.rtlabelname, "?", sizeof(a->v.rtlabelname));
 595 }
 596
 597 #ifdef ALTQ
 598 u_int32_t
 599 pf_qname2qid(char *qname)
 600 {
 601         return ((u_int32_t)tagname2tag(&pf_qids, qname));
 602 }
 603
 604 void
 605 pf_qid2qname(u_int32_t qid, char *p)
 606 {
 607         tag2tagname(&pf_qids, (u_int16_t)qid, p);
 608 }
 609
 610 void
 611 pf_qid_unref(u_int32_t qid)
 612 {
 613         tag_unref(&pf_qids, (u_int16_t)qid);
 614 }
 615
 616 int
 617 pf_begin_altq(u_int32_t *ticket)
 618 {
 619         struct pf_altq  *altq;
 620         int              error = 0;
 621
 622         /* Purge the old altq list */
 623         while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) {
 624                 TAILQ_REMOVE(pf_altqs_inactive, altq, entries);
 625                 if (altq->qname[0] == 0) {
 626                         /* detach and destroy the discipline */
 627                         error = altq_remove(altq);
 628                 } else
 629                         pf_qid_unref(altq->qid);
 630                 pool_put(&pf_altq_pl, altq);
 631         }
 632         if (error)
 633                 return (error);
 634         *ticket = ++ticket_altqs_inactive;
 635         altqs_inactive_open = 1;
 636         return (0);
 637 }
 638
 639 int
 640 pf_rollback_altq(u_int32_t ticket)
 641 {
 642         struct pf_altq  *altq;
 643         int              error = 0;
 644
 645         if (!altqs_inactive_open || ticket != ticket_altqs_inactive)
 646                 return (0);
 647         /* Purge the old altq list */
 648         while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) {
 649                 TAILQ_REMOVE(pf_altqs_inactive, altq, entries);
 650                 if (altq->qname[0] == 0) {
 651                         /* detach and destroy the discipline */
 652                         error = altq_remove(altq);
 653                 } else
 654                         pf_qid_unref(altq->qid);
 655                 pool_put(&pf_altq_pl, altq);
 656         }
 657         altqs_inactive_open = 0;
 658         return (error);
 659 }
 660
 661 int
 662 pf_commit_altq(u_int32_t ticket)
 663 {
 664         struct pf_altqqueue     *old_altqs;
 665         struct pf_altq          *altq;
 666         int                      err, error = 0;
 667
 668         if (!altqs_inactive_open || ticket != ticket_altqs_inactive)
 669                 return (EBUSY);
 670
 671         /* swap altqs, keep the old. */
 672         crit_enter();
 673         old_altqs = pf_altqs_active;
 674         pf_altqs_active = pf_altqs_inactive;
 675         pf_altqs_inactive = old_altqs;
 676         ticket_altqs_active = ticket_altqs_inactive;
 677
 678         /* Attach new disciplines */
 679         TAILQ_FOREACH(altq, pf_altqs_active, entries) {
 680                 if (altq->qname[0] == 0) {
 681                         /* attach the discipline */
 682                         error = altq_pfattach(altq);
 683                         if (error) {
 684                                 crit_exit();
 685                                 return (error);
 686                         }
 687                 }
 688         }
 689
 690         /* Purge the old altq list */
 691         while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) {
 692                 TAILQ_REMOVE(pf_altqs_inactive, altq, entries);
 693                 if (altq->qname[0] == 0) {
 694                         /* detach and destroy the discipline */
 695                         if (pf_altq_running)
 696                                 error = pf_disable_altq(altq);
 697                         err = altq_pfdetach(altq);
 698                         if (err != 0 && error == 0)
 699                                 error = err;
 700                         err = altq_remove(altq);
 701                         if (err != 0 && error == 0)
 702                                 error = err;
 703                 } else
 704                         pf_qid_unref(altq->qid);
 705                 pool_put(&pf_altq_pl, altq);
 706         }
 707         crit_exit();
 708
 709         altqs_inactive_open = 0;
 710         return (error);
 711 }
 712
 713 int
 714 pf_enable_altq(struct pf_altq *altq)
 715 {
 716         struct ifnet            *ifp;
 717         struct tb_profile        tb;
 718         int                      error = 0;
 719
 720         if ((ifp = ifunit(altq->ifname)) == NULL)
 721                 return (EINVAL);
 722
 723         if (ifp->if_snd.altq_type != ALTQT_NONE)
 724                 error = altq_enable(&ifp->if_snd);
 725
 726         /* set tokenbucket regulator */
 727         if (error == 0 && ifp != NULL && ALTQ_IS_ENABLED(&ifp->if_snd)) {
 728                 tb.rate = altq->ifbandwidth;
 729                 tb.depth = altq->tbrsize;
 730                 crit_enter();
 731                 error = tbr_set(&ifp->if_snd, &tb);
 732                 crit_exit();
 733         }
 734
 735         return (error);
 736 }
 737
 738 int
 739 pf_disable_altq(struct pf_altq *altq)
 740 {
 741         struct ifnet            *ifp;
 742         struct tb_profile        tb;
 743         int                      error;
 744
 745         if ((ifp = ifunit(altq->ifname)) == NULL)
 746                 return (EINVAL);
 747
 748         /*
 749          * when the discipline is no longer referenced, it was overridden
 750          * by a new one.  if so, just return.
 751          */
 752         if (altq->altq_disc != ifp->if_snd.altq_disc)
 753                 return (0);
 754
 755         error = altq_disable(&ifp->if_snd);
 756
 757         if (error == 0) {
 758                 /* clear tokenbucket regulator */
 759                 tb.rate = 0;
 760                 crit_enter();
 761                 error = tbr_set(&ifp->if_snd, &tb);
 762                 crit_exit();
 763         }
 764
 765         return (error);
 766 }
 767 #endif /* ALTQ */
 768
 769 int
 770 pf_begin_rules(u_int32_t *ticket, int rs_num, const char *anchor)
 771 {
 772         struct pf_ruleset       *rs;
 773         struct pf_rule          *rule;
 774
 775         if (rs_num < 0 || rs_num >= PF_RULESET_MAX)
 776                 return (EINVAL);
 777         rs = pf_find_or_create_ruleset(anchor);
 778         if (rs == NULL)
 779                 return (EINVAL);
 780         while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) {
 781                 pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule);
 782                 rs->rules[rs_num].inactive.rcount--;
 783         }
 784         *ticket = ++rs->rules[rs_num].inactive.ticket;
 785         rs->rules[rs_num].inactive.open = 1;
 786         return (0);
 787 }
 788
 789 int
 790 pf_rollback_rules(u_int32_t ticket, int rs_num, char *anchor)
 791 {
 792         struct pf_ruleset       *rs;
 793         struct pf_rule          *rule;
 794
 795         if (rs_num < 0 || rs_num >= PF_RULESET_MAX)
 796                 return (EINVAL);
 797         rs = pf_find_ruleset(anchor);
 798         if (rs == NULL || !rs->rules[rs_num].inactive.open ||
 799             rs->rules[rs_num].inactive.ticket != ticket)
 800                 return (0);
 801         while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) {
 802                 pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule);
 803                 rs->rules[rs_num].inactive.rcount--;
 804         }
 805         rs->rules[rs_num].inactive.open = 0;
 806         return (0);
 807 }
 808
 809 #define PF_MD5_UPD(st, elm)                                             \
 810                 MD5Update(ctx, (u_int8_t *) &(st)->elm, sizeof((st)->elm))
 811
 812 #define PF_MD5_UPD_STR(st, elm)                                         \
 813                 MD5Update(ctx, (u_int8_t *) (st)->elm, strlen((st)->elm))
 814
 815 #define PF_MD5_UPD_HTONL(st, elm, stor) do {                            \
 816                 (stor) = htonl((st)->elm);                              \
 817                 MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int32_t));\
 818 } while (0)
 819
 820 #define PF_MD5_UPD_HTONS(st, elm, stor) do {                            \
 821                 (stor) = htons((st)->elm);                              \
 822                 MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int16_t));\
 823 } while (0)
 824
 825 void
 826 pf_hash_rule_addr(MD5_CTX *ctx, struct pf_rule_addr *pfr)
 827 {
 828         PF_MD5_UPD(pfr, addr.type);
 829         switch (pfr->addr.type) {
 830                 case PF_ADDR_DYNIFTL:
 831                         PF_MD5_UPD(pfr, addr.v.ifname);
 832                         PF_MD5_UPD(pfr, addr.iflags);
 833                         break;
 834                 case PF_ADDR_TABLE:
 835                         PF_MD5_UPD(pfr, addr.v.tblname);
 836                         break;
 837                 case PF_ADDR_ADDRMASK:
 838                         /* XXX ignore af? */
 839                         PF_MD5_UPD(pfr, addr.v.a.addr.addr32);
 840                         PF_MD5_UPD(pfr, addr.v.a.mask.addr32);
 841                         break;
 842                 case PF_ADDR_RTLABEL:
 843                         PF_MD5_UPD(pfr, addr.v.rtlabelname);
 844                         break;
 845         }
 846
 847         PF_MD5_UPD(pfr, port[0]);
 848         PF_MD5_UPD(pfr, port[1]);
 849         PF_MD5_UPD(pfr, neg);
 850         PF_MD5_UPD(pfr, port_op);
 851 }
 852
 853 void
 854 pf_hash_rule(MD5_CTX *ctx, struct pf_rule *rule)
 855 {
 856         u_int16_t x;
 857         u_int32_t y;
 858
 859         pf_hash_rule_addr(ctx, &rule->src);
 860         pf_hash_rule_addr(ctx, &rule->dst);
 861         PF_MD5_UPD_STR(rule, label);
 862         PF_MD5_UPD_STR(rule, ifname);
 863         PF_MD5_UPD_STR(rule, match_tagname);
 864         PF_MD5_UPD_HTONS(rule, match_tag, x); /* dup? */
 865         PF_MD5_UPD_HTONL(rule, os_fingerprint, y);
 866         PF_MD5_UPD_HTONL(rule, prob, y);
 867         PF_MD5_UPD_HTONL(rule, uid.uid[0], y);
 868         PF_MD5_UPD_HTONL(rule, uid.uid[1], y);
 869         PF_MD5_UPD(rule, uid.op);
 870         PF_MD5_UPD_HTONL(rule, gid.gid[0], y);
 871         PF_MD5_UPD_HTONL(rule, gid.gid[1], y);
 872         PF_MD5_UPD(rule, gid.op);
 873         PF_MD5_UPD_HTONL(rule, rule_flag, y);
 874         PF_MD5_UPD(rule, action);
 875         PF_MD5_UPD(rule, direction);
 876         PF_MD5_UPD(rule, af);
 877         PF_MD5_UPD(rule, quick);
 878         PF_MD5_UPD(rule, ifnot);
 879         PF_MD5_UPD(rule, match_tag_not);
 880         PF_MD5_UPD(rule, natpass);
 881         PF_MD5_UPD(rule, keep_state);
 882         PF_MD5_UPD(rule, proto);
 883         PF_MD5_UPD(rule, type);
 884         PF_MD5_UPD(rule, code);
 885         PF_MD5_UPD(rule, flags);
 886         PF_MD5_UPD(rule, flagset);
 887         PF_MD5_UPD(rule, allow_opts);
 888         PF_MD5_UPD(rule, rt);
 889         PF_MD5_UPD(rule, tos);
 890 }
 891
 892 int
 893 pf_commit_rules(u_int32_t ticket, int rs_num, char *anchor)
 894 {
 895         struct pf_ruleset       *rs;
 896         struct pf_rule          *rule, **old_array;
 897         struct pf_rulequeue     *old_rules;
 898         int                      error;
 899         u_int32_t                old_rcount;
 900
 901         if (rs_num < 0 || rs_num >= PF_RULESET_MAX)
 902                 return (EINVAL);
 903         rs = pf_find_ruleset(anchor);
 904         if (rs == NULL || !rs->rules[rs_num].inactive.open ||
 905             ticket != rs->rules[rs_num].inactive.ticket)
 906                 return (EBUSY);
 907
 908         /* Calculate checksum for the main ruleset */
 909         if (rs == &pf_main_ruleset) {
 910                 error = pf_setup_pfsync_matching(rs);
 911                 if (error != 0)
 912                         return (error);
 913         }
 914
 915         /* Swap rules, keep the old. */
 916         crit_enter();
 917         old_rules = rs->rules[rs_num].active.ptr;
 918         old_rcount = rs->rules[rs_num].active.rcount;
 919         old_array = rs->rules[rs_num].active.ptr_array;
 920
 921         rs->rules[rs_num].active.ptr =
 922             rs->rules[rs_num].inactive.ptr;
 923         rs->rules[rs_num].active.ptr_array =
 924             rs->rules[rs_num].inactive.ptr_array;
 925         rs->rules[rs_num].active.rcount =
 926             rs->rules[rs_num].inactive.rcount;
 927         rs->rules[rs_num].inactive.ptr = old_rules;
 928         rs->rules[rs_num].inactive.ptr_array = old_array;
 929         rs->rules[rs_num].inactive.rcount = old_rcount;
 930
 931         rs->rules[rs_num].active.ticket =
 932             rs->rules[rs_num].inactive.ticket;
 933         pf_calc_skip_steps(rs->rules[rs_num].active.ptr);
 934
 935
 936         /* Purge the old rule list. */
 937         while ((rule = TAILQ_FIRST(old_rules)) != NULL)
 938                 pf_rm_rule(old_rules, rule);
 939         if (rs->rules[rs_num].inactive.ptr_array)
 940                 kfree(rs->rules[rs_num].inactive.ptr_array, M_TEMP);
 941         rs->rules[rs_num].inactive.ptr_array = NULL;
 942         rs->rules[rs_num].inactive.rcount = 0;
 943         rs->rules[rs_num].inactive.open = 0;
 944         pf_remove_if_empty_ruleset(rs);
 945         crit_exit();
 946         return (0);
 947 }
 948
 949 int
 950 pf_setup_pfsync_matching(struct pf_ruleset *rs)
 951 {
 952         MD5_CTX                  ctx;
 953         struct pf_rule          *rule;
 954         int                      rs_cnt;
 955         u_int8_t                 digest[PF_MD5_DIGEST_LENGTH];
 956
 957         MD5Init(&ctx);
 958         for (rs_cnt = 0; rs_cnt < PF_RULESET_MAX; rs_cnt++) {
 959                 /* XXX PF_RULESET_SCRUB as well? */
 960                 if (rs_cnt == PF_RULESET_SCRUB)
 961                         continue;
 962
 963                 if (rs->rules[rs_cnt].inactive.ptr_array)
 964                         kfree(rs->rules[rs_cnt].inactive.ptr_array, M_TEMP);
 965                 rs->rules[rs_cnt].inactive.ptr_array = NULL;
 966
 967                 if (rs->rules[rs_cnt].inactive.rcount) {
 968                         rs->rules[rs_cnt].inactive.ptr_array =
 969                             kmalloc(sizeof(caddr_t) *
 970                                     rs->rules[rs_cnt].inactive.rcount,
 971                                     M_TEMP, M_WAITOK);
 972
 973                         if (!rs->rules[rs_cnt].inactive.ptr_array)
 974                                 return (ENOMEM);
 975                 }
 976
 977                 TAILQ_FOREACH(rule, rs->rules[rs_cnt].inactive.ptr,
 978                     entries) {
 979                         pf_hash_rule(&ctx, rule);
 980                         (rs->rules[rs_cnt].inactive.ptr_array)[rule->nr] = rule;
 981                 }
 982         }
 983
 984         MD5Final(digest, &ctx);
 985         memcpy(pf_status.pf_chksum, digest, sizeof(pf_status.pf_chksum));
 986         return (0);
 987 }
 988
 989 int
 990 pf_addr_setup(struct pf_ruleset *ruleset, struct pf_addr_wrap *addr,
 991     sa_family_t af)
 992 {
 993         if (pfi_dynaddr_setup(addr, af) ||
 994             pf_tbladdr_setup(ruleset, addr))
 995                 return (EINVAL);
 996
 997         return (0);
 998 }
 999
1000 void
1001 pf_addr_copyout(struct pf_addr_wrap *addr)
1002 {
1003         pfi_dynaddr_copyout(addr);
1004         pf_tbladdr_copyout(addr);
1005         pf_rtlabel_copyout(addr);
1006 }
1007
1008 int
1009 pfioctl(struct dev_ioctl_args *ap)
1010 {
1011         u_long cmd = ap->a_cmd;
1012         caddr_t addr = ap->a_data;
1013         struct pf_pooladdr      *pa = NULL;
1014         struct pf_pool          *pool = NULL;
1015         int                      error = 0;
1016
1017         lwkt_gettoken(&pf_token);
1018
1019         /* XXX keep in sync with switch() below */
1020         if (securelevel > 1)
1021                 switch (cmd) {
1022                 case DIOCGETRULES:
1023                 case DIOCGETRULE:
1024                 case DIOCGETADDRS:
1025                 case DIOCGETADDR:
1026                 case DIOCGETSTATE:
1027                 case DIOCSETSTATUSIF:
1028                 case DIOCGETSTATUS:
1029                 case DIOCCLRSTATUS:
1030                 case DIOCNATLOOK:
1031                 case DIOCSETDEBUG:
1032                 case DIOCGETSTATES:
1033                 case DIOCGETTIMEOUT:
1034                 case DIOCCLRRULECTRS:
1035                 case DIOCGETLIMIT:
1036                 case DIOCGETALTQS:
1037                 case DIOCGETALTQ:
1038                 case DIOCGETQSTATS:
1039                 case DIOCGETRULESETS:
1040                 case DIOCGETRULESET:
1041                 case DIOCRGETTABLES:
1042                 case DIOCRGETTSTATS:
1043                 case DIOCRCLRTSTATS:
1044                 case DIOCRCLRADDRS:
1045                 case DIOCRADDADDRS:
1046                 case DIOCRDELADDRS:
1047                 case DIOCRSETADDRS:
1048                 case DIOCRGETADDRS:
1049                 case DIOCRGETASTATS:
1050                 case DIOCRCLRASTATS:
1051                 case DIOCRTSTADDRS:
1052                 case DIOCOSFPGET:
1053                 case DIOCGETSRCNODES:
1054                 case DIOCCLRSRCNODES:
1055                 case DIOCIGETIFACES:
1056                 case DIOCSETIFFLAG:
1057                 case DIOCCLRIFFLAG:
1058                 case DIOCGIFSPEED:
1059                         break;
1060                 case DIOCRCLRTABLES:
1061                 case DIOCRADDTABLES:
1062                 case DIOCRDELTABLES:
1063                 case DIOCRSETTFLAGS:
1064                         if (((struct pfioc_table *)addr)->pfrio_flags &
1065                             PFR_FLAG_DUMMY)
1066                                 break; /* dummy operation ok */
1067                         lwkt_reltoken(&pf_token);
1068                         return (EPERM);
1069                 default:
1070                         lwkt_reltoken(&pf_token);
1071                         return (EPERM);
1072                 }
1073
1074         if (!(ap->a_fflag & FWRITE))
1075                 switch (cmd) {
1076                 case DIOCGETRULES:
1077                 case DIOCGETADDRS:
1078                 case DIOCGETADDR:
1079                 case DIOCGETSTATE:
1080                 case DIOCGETSTATUS:
1081                 case DIOCGETSTATES:
1082                 case DIOCGETTIMEOUT:
1083                 case DIOCGETLIMIT:
1084                 case DIOCGETALTQS:
1085                 case DIOCGETALTQ:
1086                 case DIOCGETQSTATS:
1087                 case DIOCGETRULESETS:
1088                 case DIOCGETRULESET:
1089                 case DIOCNATLOOK:
1090                 case DIOCRGETTABLES:
1091                 case DIOCRGETTSTATS:
1092                 case DIOCRGETADDRS:
1093                 case DIOCRGETASTATS:
1094                 case DIOCRTSTADDRS:
1095                 case DIOCOSFPGET:
1096                 case DIOCGETSRCNODES:
1097                 case DIOCIGETIFACES:
1098                 case DIOCGIFSPEED:
1099                         break;
1100                 case DIOCRCLRTABLES:
1101                 case DIOCRADDTABLES:
1102                 case DIOCRDELTABLES:
1103                 case DIOCRCLRTSTATS:
1104                 case DIOCRCLRADDRS:
1105                 case DIOCRADDADDRS:
1106                 case DIOCRDELADDRS:
1107                 case DIOCRSETADDRS:
1108                 case DIOCRSETTFLAGS:
1109                         if (((struct pfioc_table *)addr)->pfrio_flags &
1110                             PFR_FLAG_DUMMY)
1111                                 break; /* dummy operation ok */
1112                         lwkt_reltoken(&pf_token);
1113                         return (EACCES);
1114                 case DIOCGETRULE:
1115                         if (((struct pfioc_rule *)addr)->action ==
1116                             PF_GET_CLR_CNTR) {
1117                                 lwkt_reltoken(&pf_token);
1118                                 return (EACCES);
1119                         }
1120                         break;
1121                 default:
1122                         lwkt_reltoken(&pf_token);
1123                         return (EACCES);
1124                 }
1125
1126         switch (cmd) {
1127
1128         case DIOCSTART:
1129                 if (pf_status.running)
1130                         error = EEXIST;
1131                 else {
1132                         error = hook_pf();
1133                         if (error) {
1134                                 DPFPRINTF(PF_DEBUG_MISC,
1135                                     ("pf: pfil registration fail\n"));
1136                                 break;
1137                         }
1138                         pf_status.running = 1;
1139                         pf_status.since = time_second;
1140                         if (pf_status.stateid == 0) {
1141                                 pf_status.stateid = time_second;
1142                                 pf_status.stateid = pf_status.stateid << 32;
1143                         }
1144                         DPFPRINTF(PF_DEBUG_MISC, ("pf: started\n"));
1145                 }
1146                 break;
1147
1148         case DIOCSTOP:
1149                 if (!pf_status.running)
1150                         error = ENOENT;
1151                 else {
1152                         pf_status.running = 0;
1153                         error = dehook_pf();
1154                         if (error) {
1155                                 pf_status.running = 1;
1156                                 DPFPRINTF(PF_DEBUG_MISC,
1157                                         ("pf: pfil unregistration failed\n"));
1158                         }
1159                         pf_status.since = time_second;
1160                         DPFPRINTF(PF_DEBUG_MISC, ("pf: stopped\n"));
1161                 }
1162                 break;
1163
1164         case DIOCADDRULE: {
1165                 struct pfioc_rule       *pr = (struct pfioc_rule *)addr;
1166                 struct pf_ruleset       *ruleset;
1167                 struct pf_rule          *rule, *tail;
1168                 struct pf_pooladdr      *pa;
1169                 int                      rs_num;
1170
1171                 pr->anchor[sizeof(pr->anchor) - 1] = 0;
1172                 ruleset = pf_find_ruleset(pr->anchor);
1173                 if (ruleset == NULL) {
1174                         error = EINVAL;
1175                         break;
1176                 }
1177                 rs_num = pf_get_ruleset_number(pr->rule.action);
1178                 if (rs_num >= PF_RULESET_MAX) {
1179                         error = EINVAL;
1180                         break;
1181                 }
1182                 if (pr->rule.return_icmp >> 8 > ICMP_MAXTYPE) {
1183                         error = EINVAL;
1184                         break;
1185                 }
1186                 if (pr->ticket != ruleset->rules[rs_num].inactive.ticket) {
1187                         error = EBUSY;
1188                         break;
1189                 }
1190                 if (pr->pool_ticket != ticket_pabuf) {
1191                         error = EBUSY;
1192                         break;
1193                 }
1194                 rule = pool_get(&pf_rule_pl, PR_WAITOK|PR_LIMITFAIL);
1195                 if (rule == NULL) {
1196                         error = ENOMEM;
1197                         break;
1198                 }
1199                 bcopy(&pr->rule, rule, sizeof(struct pf_rule));
1200                 rule->cuid = ap->a_cred->cr_ruid;
1201                 rule->cpid = 0;
1202                 rule->anchor = NULL;
1203                 rule->kif = NULL;
1204                 TAILQ_INIT(&rule->rpool.list);
1205                 /* initialize refcounting */
1206                 rule->states_cur = 0;
1207                 rule->src_nodes = 0;
1208                 rule->entries.tqe_prev = NULL;
1209 #ifndef INET
1210                 if (rule->af == AF_INET) {
1211                         pool_put(&pf_rule_pl, rule);
1212                         error = EAFNOSUPPORT;
1213                         break;
1214                 }
1215 #endif /* INET */
1216 #ifndef INET6
1217                 if (rule->af == AF_INET6) {
1218                         pool_put(&pf_rule_pl, rule);
1219                         error = EAFNOSUPPORT;
1220                         break;
1221                 }
1222 #endif /* INET6 */
1223                 tail = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr,
1224                     pf_rulequeue);
1225                 if (tail)
1226                         rule->nr = tail->nr + 1;
1227                 else
1228                         rule->nr = 0;
1229                 if (rule->ifname[0]) {
1230                         rule->kif = pfi_kif_get(rule->ifname);
1231                         if (rule->kif == NULL) {
1232                                 pool_put(&pf_rule_pl, rule);
1233                                 error = EINVAL;
1234                                 break;
1235                         }
1236                         pfi_kif_ref(rule->kif, PFI_KIF_REF_RULE);
1237                 }
1238
1239                 if (rule->rtableid > 0 && rule->rtableid > rt_numfibs)
1240                         error = EBUSY;
1241
1242 #ifdef ALTQ
1243                 /* set queue IDs */
1244                 if (rule->qname[0] != 0) {
1245                         if ((rule->qid = pf_qname2qid(rule->qname)) == 0)
1246                                 error = EBUSY;
1247                         else if (rule->pqname[0] != 0) {
1248                                 if ((rule->pqid =
1249                                     pf_qname2qid(rule->pqname)) == 0)
1250                                         error = EBUSY;
1251                         } else
1252                                 rule->pqid = rule->qid;
1253                 }
1254 #endif
1255                 if (rule->tagname[0])
1256                         if ((rule->tag = pf_tagname2tag(rule->tagname)) == 0)
1257                                 error = EBUSY;
1258                 if (rule->match_tagname[0])
1259                         if ((rule->match_tag =
1260                             pf_tagname2tag(rule->match_tagname)) == 0)
1261                                 error = EBUSY;
1262                 if (rule->rt && !rule->direction)
1263                         error = EINVAL;
1264 #if NPFLOG > 0
1265                 if (!rule->log)
1266                         rule->logif = 0;
1267                 if (rule->logif >= PFLOGIFS_MAX)
1268                         error = EINVAL;
1269 #endif
1270                 if (pf_rtlabel_add(&rule->src.addr) ||
1271                     pf_rtlabel_add(&rule->dst.addr))
1272                         error = EBUSY;
1273                 if (pf_addr_setup(ruleset, &rule->src.addr, rule->af))
1274                         error = EINVAL;
1275                 if (pf_addr_setup(ruleset, &rule->dst.addr, rule->af))
1276                         error = EINVAL;
1277                 if (pf_anchor_setup(rule, ruleset, pr->anchor_call))
1278                         error = EINVAL;
1279                 TAILQ_FOREACH(pa, &pf_pabuf, entries)
1280                         if (pf_tbladdr_setup(ruleset, &pa->addr))
1281                                 error = EINVAL;
1282
1283                 if (rule->overload_tblname[0]) {
1284                         if ((rule->overload_tbl = pfr_attach_table(ruleset,
1285                             rule->overload_tblname)) == NULL)
1286                                 error = EINVAL;
1287                         else
1288                                 rule->overload_tbl->pfrkt_flags |=
1289                                     PFR_TFLAG_ACTIVE;
1290                 }
1291
1292                 pf_mv_pool(&pf_pabuf, &rule->rpool.list);
1293                 if (((((rule->action == PF_NAT) || (rule->action == PF_RDR) ||
1294                     (rule->action == PF_BINAT)) && rule->anchor == NULL) ||
1295                     (rule->rt > PF_FASTROUTE)) &&
1296                     (TAILQ_FIRST(&rule->rpool.list) == NULL))
1297                         error = EINVAL;
1298
1299                 if (error) {
1300                         pf_rm_rule(NULL, rule);
1301                         break;
1302                 }
1303                 rule->rpool.cur = TAILQ_FIRST(&rule->rpool.list);
1304                 rule->evaluations = rule->packets[0] = rule->packets[1] =
1305                     rule->bytes[0] = rule->bytes[1] = 0;
1306                 TAILQ_INSERT_TAIL(ruleset->rules[rs_num].inactive.ptr,
1307                     rule, entries);
1308                 ruleset->rules[rs_num].inactive.rcount++;
1309                 break;
1310         }
1311
1312         case DIOCGETRULES: {
1313                 struct pfioc_rule       *pr = (struct pfioc_rule *)addr;
1314                 struct pf_ruleset       *ruleset;
1315                 struct pf_rule          *tail;
1316                 int                      rs_num;
1317
1318                 pr->anchor[sizeof(pr->anchor) - 1] = 0;
1319                 ruleset = pf_find_ruleset(pr->anchor);
1320                 if (ruleset == NULL) {
1321                         error = EINVAL;
1322                         break;
1323                 }
1324                 rs_num = pf_get_ruleset_number(pr->rule.action);
1325                 if (rs_num >= PF_RULESET_MAX) {
1326                         error = EINVAL;
1327                         break;
1328                 }
1329                 tail = TAILQ_LAST(ruleset->rules[rs_num].active.ptr,
1330                     pf_rulequeue);
1331                 if (tail)
1332                         pr->nr = tail->nr + 1;
1333                 else
1334                         pr->nr = 0;
1335                 pr->ticket = ruleset->rules[rs_num].active.ticket;
1336                 break;
1337         }
1338
1339         case DIOCGETRULE: {
1340                 struct pfioc_rule       *pr = (struct pfioc_rule *)addr;
1341                 struct pf_ruleset       *ruleset;
1342                 struct pf_rule          *rule;
1343                 int                      rs_num, i;
1344
1345                 pr->anchor[sizeof(pr->anchor) - 1] = 0;
1346                 ruleset = pf_find_ruleset(pr->anchor);
1347                 if (ruleset == NULL) {
1348                         error = EINVAL;
1349                         break;
1350                 }
1351                 rs_num = pf_get_ruleset_number(pr->rule.action);
1352                 if (rs_num >= PF_RULESET_MAX) {
1353                         error = EINVAL;
1354                         break;
1355                 }
1356                 if (pr->ticket != ruleset->rules[rs_num].active.ticket) {
1357                         error = EBUSY;
1358                         break;
1359                 }
1360                 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr);
1361                 while ((rule != NULL) && (rule->nr != pr->nr))
1362                         rule = TAILQ_NEXT(rule, entries);
1363                 if (rule == NULL) {
1364                         error = EBUSY;
1365                         break;
1366                 }
1367                 bcopy(rule, &pr->rule, sizeof(struct pf_rule));
1368                 if (pf_anchor_copyout(ruleset, rule, pr)) {
1369                         error = EBUSY;
1370                         break;
1371                 }
1372                 pf_addr_copyout(&pr->rule.src.addr);
1373                 pf_addr_copyout(&pr->rule.dst.addr);
1374                 for (i = 0; i < PF_SKIP_COUNT; ++i)
1375                         if (rule->skip[i].ptr == NULL)
1376                                 pr->rule.skip[i].nr = (uint32_t)(-1);
1377                         else
1378                                 pr->rule.skip[i].nr =
1379                                     rule->skip[i].ptr->nr;
1380
1381                 if (pr->action == PF_GET_CLR_CNTR) {
1382                         rule->evaluations = 0;
1383                         rule->packets[0] = rule->packets[1] = 0;
1384                         rule->bytes[0] = rule->bytes[1] = 0;
1385                         rule->states_tot = 0;
1386                 }
1387                 break;
1388         }
1389
1390         case DIOCCHANGERULE: {
1391                 struct pfioc_rule       *pcr = (struct pfioc_rule *)addr;
1392                 struct pf_ruleset       *ruleset;
1393                 struct pf_rule          *oldrule = NULL, *newrule = NULL;
1394                 u_int32_t                nr = 0;
1395                 int                      rs_num;
1396
1397                 if (!(pcr->action == PF_CHANGE_REMOVE ||
1398                     pcr->action == PF_CHANGE_GET_TICKET) &&
1399                     pcr->pool_ticket != ticket_pabuf) {
1400                         error = EBUSY;
1401                         break;
1402                 }
1403
1404                 if (pcr->action < PF_CHANGE_ADD_HEAD ||
1405                     pcr->action > PF_CHANGE_GET_TICKET) {
1406                         error = EINVAL;
1407                         break;
1408                 }
1409                 ruleset = pf_find_ruleset(pcr->anchor);
1410                 if (ruleset == NULL) {
1411                         error = EINVAL;
1412                         break;
1413                 }
1414                 rs_num = pf_get_ruleset_number(pcr->rule.action);
1415                 if (rs_num >= PF_RULESET_MAX) {
1416                         error = EINVAL;
1417                         break;
1418                 }
1419
1420                 if (pcr->action == PF_CHANGE_GET_TICKET) {
1421                         pcr->ticket = ++ruleset->rules[rs_num].active.ticket;
1422                         break;
1423                 } else {
1424                         if (pcr->ticket !=
1425                             ruleset->rules[rs_num].active.ticket) {
1426                                 error = EINVAL;
1427                                 break;
1428                         }
1429                         if (pcr->rule.return_icmp >> 8 > ICMP_MAXTYPE) {
1430                                 error = EINVAL;
1431                                 break;
1432                         }
1433                 }
1434
1435                 if (pcr->action != PF_CHANGE_REMOVE) {
1436                         newrule = pool_get(&pf_rule_pl, PR_WAITOK|PR_LIMITFAIL);
1437                         if (newrule == NULL) {
1438                                 error = ENOMEM;
1439                                 break;
1440                         }
1441                         bcopy(&pcr->rule, newrule, sizeof(struct pf_rule));
1442                         newrule->cuid = ap->a_cred->cr_ruid;
1443                         newrule->cpid = 0;
1444                         TAILQ_INIT(&newrule->rpool.list);
1445                         /* initialize refcounting */
1446                         newrule->states_cur = 0;
1447                         newrule->entries.tqe_prev = NULL;
1448 #ifndef INET
1449                         if (newrule->af == AF_INET) {
1450                                 pool_put(&pf_rule_pl, newrule);
1451                                 error = EAFNOSUPPORT;
1452                                 break;
1453                         }
1454 #endif /* INET */
1455 #ifndef INET6
1456                         if (newrule->af == AF_INET6) {
1457                                 pool_put(&pf_rule_pl, newrule);
1458                                 error = EAFNOSUPPORT;
1459                                 break;
1460                         }
1461 #endif /* INET6 */
1462                         if (newrule->ifname[0]) {
1463                                 newrule->kif = pfi_kif_get(newrule->ifname);
1464                                 if (newrule->kif == NULL) {
1465                                         pool_put(&pf_rule_pl, newrule);
1466                                         error = EINVAL;
1467                                         break;
1468                                 }
1469                                 pfi_kif_ref(newrule->kif, PFI_KIF_REF_RULE);
1470                         } else
1471                                 newrule->kif = NULL;
1472
1473                         if (newrule->rtableid > 0 &&
1474                             newrule->rtableid > rt_numfibs)
1475                                 error = EBUSY;
1476
1477 #ifdef ALTQ
1478                         /* set queue IDs */
1479                         if (newrule->qname[0] != 0) {
1480                                 if ((newrule->qid =
1481                                     pf_qname2qid(newrule->qname)) == 0)
1482                                         error = EBUSY;
1483                                 else if (newrule->pqname[0] != 0) {
1484                                         if ((newrule->pqid =
1485                                             pf_qname2qid(newrule->pqname)) == 0)
1486                                                 error = EBUSY;
1487                                 } else
1488                                         newrule->pqid = newrule->qid;
1489                         }
1490 #endif /* ALTQ */
1491                         if (newrule->tagname[0])
1492                                 if ((newrule->tag =
1493                                     pf_tagname2tag(newrule->tagname)) == 0)
1494                                         error = EBUSY;
1495                         if (newrule->match_tagname[0])
1496                                 if ((newrule->match_tag = pf_tagname2tag(
1497                                     newrule->match_tagname)) == 0)
1498                                         error = EBUSY;
1499                         if (newrule->rt && !newrule->direction)
1500                                 error = EINVAL;
1501 #if NPFLOG > 0
1502                         if (!newrule->log)
1503                                 newrule->logif = 0;
1504                         if (newrule->logif >= PFLOGIFS_MAX)
1505                                 error = EINVAL;
1506 #endif
1507                         if (pf_rtlabel_add(&newrule->src.addr) ||
1508                             pf_rtlabel_add(&newrule->dst.addr))
1509                                 error = EBUSY;
1510                         if (pf_addr_setup(ruleset, &newrule->src.addr, newrule->af))
1511                                 error = EINVAL;
1512                         if (pf_addr_setup(ruleset, &newrule->dst.addr, newrule->af))
1513                                 error = EINVAL;
1514                         if (pf_anchor_setup(newrule, ruleset, pcr->anchor_call))
1515                                 error = EINVAL;
1516                         TAILQ_FOREACH(pa, &pf_pabuf, entries)
1517                                 if (pf_tbladdr_setup(ruleset, &pa->addr))
1518                                         error = EINVAL;
1519
1520                         if (newrule->overload_tblname[0]) {
1521                                 if ((newrule->overload_tbl = pfr_attach_table(
1522                                     ruleset, newrule->overload_tblname)) ==
1523                                     NULL)
1524                                         error = EINVAL;
1525                                 else
1526                                         newrule->overload_tbl->pfrkt_flags |=
1527                                             PFR_TFLAG_ACTIVE;
1528                         }
1529
1530                         pf_mv_pool(&pf_pabuf, &newrule->rpool.list);
1531                         if (((((newrule->action == PF_NAT) ||
1532                             (newrule->action == PF_RDR) ||
1533                             (newrule->action == PF_BINAT) ||
1534                             (newrule->rt > PF_FASTROUTE)) &&
1535                             !newrule->anchor)) &&
1536                             (TAILQ_FIRST(&newrule->rpool.list) == NULL))
1537                                 error = EINVAL;
1538
1539                         if (error) {
1540                                 pf_rm_rule(NULL, newrule);
1541                                 break;
1542                         }
1543                         newrule->rpool.cur = TAILQ_FIRST(&newrule->rpool.list);
1544                         newrule->evaluations = 0;
1545                         newrule->packets[0] = newrule->packets[1] = 0;
1546                         newrule->bytes[0] = newrule->bytes[1] = 0;
1547                 }
1548                 pf_empty_pool(&pf_pabuf);
1549
1550                 if (pcr->action == PF_CHANGE_ADD_HEAD)
1551                         oldrule = TAILQ_FIRST(
1552                             ruleset->rules[rs_num].active.ptr);
1553                 else if (pcr->action == PF_CHANGE_ADD_TAIL)
1554                         oldrule = TAILQ_LAST(
1555                             ruleset->rules[rs_num].active.ptr, pf_rulequeue);
1556                 else {
1557                         oldrule = TAILQ_FIRST(
1558                             ruleset->rules[rs_num].active.ptr);
1559                         while ((oldrule != NULL) && (oldrule->nr != pcr->nr))
1560                                 oldrule = TAILQ_NEXT(oldrule, entries);
1561                         if (oldrule == NULL) {
1562                                 if (newrule != NULL)
1563                                         pf_rm_rule(NULL, newrule);
1564                                 error = EINVAL;
1565                                 break;
1566                         }
1567                 }
1568
1569                 if (pcr->action == PF_CHANGE_REMOVE) {
1570                         pf_rm_rule(ruleset->rules[rs_num].active.ptr, oldrule);
1571                         ruleset->rules[rs_num].active.rcount--;
1572                 } else {
1573                         if (oldrule == NULL)
1574                                 TAILQ_INSERT_TAIL(
1575                                     ruleset->rules[rs_num].active.ptr,
1576                                     newrule, entries);
1577                         else if (pcr->action == PF_CHANGE_ADD_HEAD ||
1578                             pcr->action == PF_CHANGE_ADD_BEFORE)
1579                                 TAILQ_INSERT_BEFORE(oldrule, newrule, entries);
1580                         else
1581                                 TAILQ_INSERT_AFTER(
1582                                     ruleset->rules[rs_num].active.ptr,
1583                                     oldrule, newrule, entries);
1584                         ruleset->rules[rs_num].active.rcount++;
1585                 }
1586
1587                 nr = 0;
1588                 TAILQ_FOREACH(oldrule,
1589                     ruleset->rules[rs_num].active.ptr, entries)
1590                         oldrule->nr = nr++;
1591
1592                 ruleset->rules[rs_num].active.ticket++;
1593
1594                 pf_calc_skip_steps(ruleset->rules[rs_num].active.ptr);
1595                 pf_remove_if_empty_ruleset(ruleset);
1596
1597                 break;
1598         }
1599
1600         case DIOCCLRSTATES: {
1601                 struct pf_state         *s, *nexts;
1602                 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr;
1603                 u_int                    killed = 0;
1604
1605                 for (s = RB_MIN(pf_state_tree_id, &tree_id); s; s = nexts) {
1606                         nexts = RB_NEXT(pf_state_tree_id, &tree_id, s);
1607
1608                         if (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname,
1609                             s->kif->pfik_name)) {
1610                                 /* don't send out individual delete messages */
1611                                 s->sync_flags = PFSTATE_NOSYNC;
1612                                 pf_unlink_state(s);
1613                                 killed++;
1614                         }
1615                 }
1616                 psk->psk_killed = killed;
1617                 pfsync_clear_states(pf_status.hostid, psk->psk_ifname);
1618                 break;
1619         }
1620
1621         case DIOCKILLSTATES: {
1622                 struct pf_state         *s, *nexts;
1623                 struct pf_state_key     *sk;
1624                 struct pf_addr          *srcaddr, *dstaddr;
1625                 u_int16_t                srcport, dstport;
1626                 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr;
1627                 u_int                    killed = 0;
1628
1629                 if (psk->psk_pfcmp.id) {
1630                         if (psk->psk_pfcmp.creatorid == 0)
1631                                 psk->psk_pfcmp.creatorid = pf_status.hostid;
1632                         if ((s = pf_find_state_byid(&psk->psk_pfcmp))) {
1633                                 /* send immediate delete of state */
1634                                 pfsync_delete_state(s);
1635                                 s->sync_flags |= PFSTATE_NOSYNC;
1636                                 pf_unlink_state(s);
1637                                 psk->psk_killed = 1;
1638                         }
1639                         break;
1640                 }
1641
1642                 for (s = RB_MIN(pf_state_tree_id, &tree_id); s;
1643                     s = nexts) {
1644                         nexts = RB_NEXT(pf_state_tree_id, &tree_id, s);
1645                         sk = s->key[PF_SK_WIRE];
1646
1647                         if (s->direction == PF_OUT) {
1648                                 srcaddr = &sk->addr[1];
1649                                 dstaddr = &sk->addr[0];
1650                                 srcport = sk->port[0];
1651                                 dstport = sk->port[0];
1652                         } else {
1653                                 srcaddr = &sk->addr[0];
1654                                 dstaddr = &sk->addr[1];
1655                                 srcport = sk->port[0];
1656                                 dstport = sk->port[0];
1657                         }
1658                         if ((!psk->psk_af || sk->af == psk->psk_af)
1659                             && (!psk->psk_proto || psk->psk_proto ==
1660                             sk->proto) &&
1661                             PF_MATCHA(psk->psk_src.neg,
1662                             &psk->psk_src.addr.v.a.addr,
1663                             &psk->psk_src.addr.v.a.mask,
1664                             srcaddr, sk->af) &&
1665                             PF_MATCHA(psk->psk_dst.neg,
1666                             &psk->psk_dst.addr.v.a.addr,
1667                             &psk->psk_dst.addr.v.a.mask,
1668                             dstaddr, sk->af) &&
1669                             (psk->psk_src.port_op == 0 ||
1670                             pf_match_port(psk->psk_src.port_op,
1671                             psk->psk_src.port[0], psk->psk_src.port[1],
1672                             srcport)) &&
1673                             (psk->psk_dst.port_op == 0 ||
1674                             pf_match_port(psk->psk_dst.port_op,
1675                             psk->psk_dst.port[0], psk->psk_dst.port[1],
1676                             dstport)) &&
1677                             (!psk->psk_label[0] || (s->rule.ptr->label[0] &&
1678                             !strcmp(psk->psk_label, s->rule.ptr->label))) &&
1679                             (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname,
1680                             s->kif->pfik_name))) {
1681                                 /* send immediate delete of state */
1682                                 pfsync_delete_state(s);
1683                                 s->sync_flags |= PFSTATE_NOSYNC;
1684                                 pf_unlink_state(s);
1685                                 killed++;
1686                         }
1687                 }
1688                 psk->psk_killed = killed;
1689                 break;
1690         }
1691
1692         case DIOCADDSTATE: {
1693                 struct pfioc_state      *ps = (struct pfioc_state *)addr;
1694                 struct pfsync_state     *sp = &ps->state;
1695
1696                 if (sp->timeout >= PFTM_MAX &&
1697                     sp->timeout != PFTM_UNTIL_PACKET) {
1698                         error = EINVAL;
1699                         break;
1700                 }
1701                 error = pfsync_state_import(sp, PFSYNC_SI_IOCTL);
1702                 break;
1703         }
1704
1705         case DIOCGETSTATE: {
1706                 struct pfioc_state      *ps = (struct pfioc_state *)addr;
1707                 struct pf_state         *s;
1708                 struct pf_state_cmp      id_key;
1709
1710                 bcopy(ps->state.id, &id_key.id, sizeof(id_key.id));
1711                 id_key.creatorid = ps->state.creatorid;
1712
1713                 s = pf_find_state_byid(&id_key);
1714                 if (s == NULL) {
1715                         error = ENOENT;
1716                         break;
1717                 }
1718                 pfsync_state_export(&ps->state, s);
1719                 break;
1720         }
1721
1722         case DIOCGETSTATES: {
1723                 struct pfioc_states     *ps = (struct pfioc_states *)addr;
1724                 struct pf_state         *state;
1725                 struct pfsync_state     *p, *pstore;
1726                 u_int32_t                nr = 0;
1727
1728                 if (ps->ps_len == 0) {
1729                         nr = pf_status.states;
1730                         ps->ps_len = sizeof(struct pfsync_state) * nr;
1731                         break;
1732                 }
1733
1734                 pstore = kmalloc(sizeof(*pstore), M_TEMP, M_WAITOK);
1735
1736                 p = ps->ps_states;
1737
1738                 state = TAILQ_FIRST(&state_list);
1739                 while (state) {
1740                         if (state->timeout != PFTM_UNLINKED) {
1741                                 if ((nr+1) * sizeof(*p) > (unsigned)ps->ps_len)
1742                                         break;
1743                                 pfsync_state_export(pstore, state);
1744                                 error = copyout(pstore, p, sizeof(*p));
1745                                 if (error) {
1746                                         kfree(pstore, M_TEMP);
1747                                         goto fail;
1748                                 }
1749                                 p++;
1750                                 nr++;
1751                         }
1752                         state = TAILQ_NEXT(state, entry_list);
1753                 }
1754
1755                 ps->ps_len = sizeof(struct pfsync_state) * nr;
1756
1757                 kfree(pstore, M_TEMP);
1758                 break;
1759         }
1760
1761         case DIOCGETSTATUS: {
1762                 struct pf_status *s = (struct pf_status *)addr;
1763                 bcopy(&pf_status, s, sizeof(struct pf_status));
1764                 pfi_update_status(s->ifname, s);
1765                 break;
1766         }
1767
1768         case DIOCSETSTATUSIF: {
1769                 struct pfioc_if *pi = (struct pfioc_if *)addr;
1770
1771                 if (pi->ifname[0] == 0) {
1772                         bzero(pf_status.ifname, IFNAMSIZ);
1773                         break;
1774                 }
1775                 strlcpy(pf_status.ifname, pi->ifname, IFNAMSIZ);
1776                 break;
1777         }
1778
1779         case DIOCCLRSTATUS: {
1780                 bzero(pf_status.counters, sizeof(pf_status.counters));
1781                 bzero(pf_status.fcounters, sizeof(pf_status.fcounters));
1782                 bzero(pf_status.scounters, sizeof(pf_status.scounters));
1783                 pf_status.since = time_second;
1784                 if (*pf_status.ifname)
1785                         pfi_update_status(pf_status.ifname, NULL);
1786                 break;
1787         }
1788
1789         case DIOCNATLOOK: {
1790                 struct pfioc_natlook    *pnl = (struct pfioc_natlook *)addr;
1791                 struct pf_state_key     *sk;
1792                 struct pf_state         *state;
1793                 struct pf_state_key_cmp  key;
1794                 int                      m = 0, direction = pnl->direction;
1795                 int                      sidx, didx;
1796
1797                 /* NATLOOK src and dst are reversed, so reverse sidx/didx */
1798                 sidx = (direction == PF_IN) ? 1 : 0;
1799                 didx = (direction == PF_IN) ? 0 : 1;
1800
1801                 if (!pnl->proto ||
1802                     PF_AZERO(&pnl->saddr, pnl->af) ||
1803                     PF_AZERO(&pnl->daddr, pnl->af) ||
1804                     ((pnl->proto == IPPROTO_TCP ||
1805                     pnl->proto == IPPROTO_UDP) &&
1806                     (!pnl->dport || !pnl->sport)))
1807                         error = EINVAL;
1808                 else {
1809                         key.af = pnl->af;
1810                         key.proto = pnl->proto;
1811                         PF_ACPY(&key.addr[sidx], &pnl->saddr, pnl->af);
1812                         key.port[sidx] = pnl->sport;
1813                         PF_ACPY(&key.addr[didx], &pnl->daddr, pnl->af);
1814                         key.port[didx] = pnl->dport;
1815
1816                         state = pf_find_state_all(&key, direction, &m);
1817
1818                         if (m > 1)
1819                                 error = E2BIG;  /* more than one state */
1820                         else if (state != NULL) {
1821                                 sk = state->key[sidx];
1822                                 PF_ACPY(&pnl->rsaddr, &sk->addr[sidx], sk->af);
1823                                 pnl->rsport = sk->port[sidx];
1824                                 PF_ACPY(&pnl->rdaddr, &sk->addr[didx], sk->af);
1825                                 pnl->rdport = sk->port[didx];
1826                         } else
1827                                 error = ENOENT;
1828                 }
1829                 break;
1830         }
1831
1832         case DIOCSETTIMEOUT: {
1833                 struct pfioc_tm *pt = (struct pfioc_tm *)addr;
1834                 int              old;
1835
1836                 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX ||
1837                     pt->seconds < 0) {
1838                         error = EINVAL;
1839                         goto fail;
1840                 }
1841                 old = pf_default_rule.timeout[pt->timeout];
1842                 if (pt->timeout == PFTM_INTERVAL && pt->seconds == 0)
1843                         pt->seconds = 1;
1844                 pf_default_rule.timeout[pt->timeout] = pt->seconds;
1845                 if (pt->timeout == PFTM_INTERVAL && pt->seconds < old)
1846                         wakeup(pf_purge_thread);
1847                 pt->seconds = old;
1848                 break;
1849         }
1850
1851         case DIOCGETTIMEOUT: {
1852                 struct pfioc_tm *pt = (struct pfioc_tm *)addr;
1853
1854                 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX) {
1855                         error = EINVAL;
1856                         goto fail;
1857                 }
1858                 pt->seconds = pf_default_rule.timeout[pt->timeout];
1859                 break;
1860         }
1861
1862         case DIOCGETLIMIT: {
1863                 struct pfioc_limit      *pl = (struct pfioc_limit *)addr;
1864
1865                 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX) {
1866                         error = EINVAL;
1867                         goto fail;
1868                 }
1869                 pl->limit = pf_pool_limits[pl->index].limit;
1870                 break;
1871         }
1872
1873         case DIOCSETLIMIT: {
1874                 struct pfioc_limit      *pl = (struct pfioc_limit *)addr;
1875                 int                      old_limit;
1876
1877                 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX ||
1878                     pf_pool_limits[pl->index].pp == NULL) {
1879                         error = EINVAL;
1880                         goto fail;
1881                 }
1882
1883                 /* XXX Get an API to set limits on the zone/pool */
1884                 old_limit = pf_pool_limits[pl->index].limit;
1885                 pf_pool_limits[pl->index].limit = pl->limit;
1886                 pl->limit = old_limit;
1887                 break;
1888         }
1889
1890         case DIOCSETDEBUG: {
1891                 u_int32_t       *level = (u_int32_t *)addr;
1892
1893                 pf_status.debug = *level;
1894                 break;
1895         }
1896
1897         case DIOCCLRRULECTRS: {
1898                 /* obsoleted by DIOCGETRULE with action=PF_GET_CLR_CNTR */
1899                 struct pf_ruleset       *ruleset = &pf_main_ruleset;
1900                 struct pf_rule          *rule;
1901
1902                 TAILQ_FOREACH(rule,
1903                     ruleset->rules[PF_RULESET_FILTER].active.ptr, entries) {
1904                         rule->evaluations = 0;
1905                         rule->packets[0] = rule->packets[1] = 0;
1906                         rule->bytes[0] = rule->bytes[1] = 0;
1907                 }
1908                 break;
1909         }
1910
1911         case DIOCGIFSPEED: {
1912                 struct pf_ifspeed       *psp = (struct pf_ifspeed *)addr;
1913                 struct pf_ifspeed       ps;
1914                 struct ifnet            *ifp;
1915
1916                 if (psp->ifname[0] != 0) {
1917                         /* Can we completely trust user-land? */
1918                         strlcpy(ps.ifname, psp->ifname, IFNAMSIZ);
1919                         ifp = ifunit(ps.ifname);
1920                         if (ifp )
1921                                 psp->baudrate = ifp->if_baudrate;
1922                         else
1923                                 error = EINVAL;
1924                 } else
1925                         error = EINVAL;
1926                 break;
1927         }
1928 #ifdef ALTQ
1929         case DIOCSTARTALTQ: {
1930                 struct pf_altq          *altq;
1931
1932                 /* enable all altq interfaces on active list */
1933                 TAILQ_FOREACH(altq, pf_altqs_active, entries) {
1934                         if (altq->qname[0] == 0) {
1935                                 error = pf_enable_altq(altq);
1936                                 if (error != 0)
1937                                         break;
1938                         }
1939                 }
1940                 if (error == 0)
1941                         pf_altq_running = 1;
1942                 DPFPRINTF(PF_DEBUG_MISC, ("altq: started\n"));
1943                 break;
1944         }
1945
1946         case DIOCSTOPALTQ: {
1947                 struct pf_altq          *altq;
1948
1949                 /* disable all altq interfaces on active list */
1950                 TAILQ_FOREACH(altq, pf_altqs_active, entries) {
1951                         if (altq->qname[0] == 0) {
1952                                 error = pf_disable_altq(altq);
1953                                 if (error != 0)
1954                                         break;
1955                         }
1956                 }
1957                 if (error == 0)
1958                         pf_altq_running = 0;
1959                 DPFPRINTF(PF_DEBUG_MISC, ("altq: stopped\n"));
1960                 break;
1961         }
1962
1963         case DIOCADDALTQ: {
1964                 struct pfioc_altq       *pa = (struct pfioc_altq *)addr;
1965                 struct pf_altq          *altq, *a;
1966
1967                 if (pa->ticket != ticket_altqs_inactive) {
1968                         error = EBUSY;
1969                         break;
1970                 }
1971                 altq = pool_get(&pf_altq_pl, PR_WAITOK|PR_LIMITFAIL);
1972                 if (altq == NULL) {
1973                         error = ENOMEM;
1974                         break;
1975                 }
1976                 bcopy(&pa->altq, altq, sizeof(struct pf_altq));
1977
1978                 /*
1979                  * if this is for a queue, find the discipline and
1980                  * copy the necessary fields
1981                  */
1982                 if (altq->qname[0] != 0) {
1983                         if ((altq->qid = pf_qname2qid(altq->qname)) == 0) {
1984                                 error = EBUSY;
1985                                 pool_put(&pf_altq_pl, altq);
1986                                 break;
1987                         }
1988                         altq->altq_disc = NULL;
1989                         TAILQ_FOREACH(a, pf_altqs_inactive, entries) {
1990                                 if (strncmp(a->ifname, altq->ifname,
1991                                     IFNAMSIZ) == 0 && a->qname[0] == 0) {
1992                                         altq->altq_disc = a->altq_disc;
1993                                         break;
1994                                 }
1995                         }
1996                 }
1997
1998                 error = altq_add(altq);
1999                 if (error) {
2000                         pool_put(&pf_altq_pl, altq);
2001                         break;
2002                 }
2003
2004                 TAILQ_INSERT_TAIL(pf_altqs_inactive, altq, entries);
2005                 bcopy(altq, &pa->altq, sizeof(struct pf_altq));
2006                 break;
2007         }
2008
2009         case DIOCGETALTQS: {
2010                 struct pfioc_altq       *pa = (struct pfioc_altq *)addr;
2011                 struct pf_altq          *altq;
2012
2013                 pa->nr = 0;
2014                 TAILQ_FOREACH(altq, pf_altqs_active, entries)
2015                         pa->nr++;
2016                 pa->ticket = ticket_altqs_active;
2017                 break;
2018         }
2019
2020         case DIOCGETALTQ: {
2021                 struct pfioc_altq       *pa = (struct pfioc_altq *)addr;
2022                 struct pf_altq          *altq;
2023                 u_int32_t                nr;
2024
2025                 if (pa->ticket != ticket_altqs_active) {
2026                         error = EBUSY;
2027                         break;
2028                 }
2029                 nr = 0;
2030                 altq = TAILQ_FIRST(pf_altqs_active);
2031                 while ((altq != NULL) && (nr < pa->nr)) {
2032                         altq = TAILQ_NEXT(altq, entries);
2033                         nr++;
2034                 }
2035                 if (altq == NULL) {
2036                         error = EBUSY;
2037                         break;
2038                 }
2039                 bcopy(altq, &pa->altq, sizeof(struct pf_altq));
2040                 break;
2041         }
2042
2043         case DIOCCHANGEALTQ:
2044                 /* CHANGEALTQ not supported yet! */
2045                 error = ENODEV;
2046                 break;
2047
2048         case DIOCGETQSTATS: {
2049                 struct pfioc_qstats     *pq = (struct pfioc_qstats *)addr;
2050                 struct pf_altq          *altq;
2051                 u_int32_t                nr;
2052                 int                      nbytes;
2053
2054                 if (pq->ticket != ticket_altqs_active) {
2055                         error = EBUSY;
2056                         break;
2057                 }
2058                 nbytes = pq->nbytes;
2059                 nr = 0;
2060                 altq = TAILQ_FIRST(pf_altqs_active);
2061                 while ((altq != NULL) && (nr < pq->nr)) {
2062                         altq = TAILQ_NEXT(altq, entries);
2063                         nr++;
2064                 }
2065                 if (altq == NULL) {
2066                         error = EBUSY;
2067                         break;
2068                 }
2069                 error = altq_getqstats(altq, pq->buf, &nbytes);
2070                 if (error == 0) {
2071                         pq->scheduler = altq->scheduler;
2072                         pq->nbytes = nbytes;
2073                 }
2074                 break;
2075         }
2076 #endif /* ALTQ */
2077
2078         case DIOCBEGINADDRS: {
2079                 struct pfioc_pooladdr   *pp = (struct pfioc_pooladdr *)addr;
2080
2081                 pf_empty_pool(&pf_pabuf);
2082                 pp->ticket = ++ticket_pabuf;
2083                 break;
2084         }
2085
2086         case DIOCADDADDR: {
2087                 struct pfioc_pooladdr   *pp = (struct pfioc_pooladdr *)addr;
2088
2089                 if (pp->ticket != ticket_pabuf) {
2090                         error = EBUSY;
2091                         break;
2092                 }
2093 #ifndef INET
2094                 if (pp->af == AF_INET) {
2095                         error = EAFNOSUPPORT;
2096                         break;
2097                 }
2098 #endif /* INET */
2099 #ifndef INET6
2100                 if (pp->af == AF_INET6) {
2101                         error = EAFNOSUPPORT;
2102                         break;
2103                 }
2104 #endif /* INET6 */
2105                 if (pp->addr.addr.type != PF_ADDR_ADDRMASK &&
2106                     pp->addr.addr.type != PF_ADDR_DYNIFTL &&
2107                     pp->addr.addr.type != PF_ADDR_TABLE) {
2108                         error = EINVAL;
2109                         break;
2110                 }
2111                 pa = pool_get(&pf_pooladdr_pl, PR_WAITOK|PR_LIMITFAIL);
2112                 if (pa == NULL) {
2113                         error = ENOMEM;
2114                         break;
2115                 }
2116                 bcopy(&pp->addr, pa, sizeof(struct pf_pooladdr));
2117                 if (pa->ifname[0]) {
2118                         pa->kif = pfi_kif_get(pa->ifname);
2119                         if (pa->kif == NULL) {
2120                                 pool_put(&pf_pooladdr_pl, pa);
2121                                 error = EINVAL;
2122                                 break;
2123                         }
2124                         pfi_kif_ref(pa->kif, PFI_KIF_REF_RULE);
2125                 }
2126                 if (pfi_dynaddr_setup(&pa->addr, pp->af)) {
2127                         pfi_dynaddr_remove(&pa->addr);
2128                         pfi_kif_unref(pa->kif, PFI_KIF_REF_RULE);
2129                         pool_put(&pf_pooladdr_pl, pa);
2130                         error = EINVAL;
2131                         break;
2132                 }
2133                 TAILQ_INSERT_TAIL(&pf_pabuf, pa, entries);
2134                 break;
2135         }
2136
2137         case DIOCGETADDRS: {
2138                 struct pfioc_pooladdr   *pp = (struct pfioc_pooladdr *)addr;
2139
2140                 pp->nr = 0;
2141                 pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action,
2142                     pp->r_num, 0, 1, 0);
2143                 if (pool == NULL) {
2144                         error = EBUSY;
2145                         break;
2146                 }
2147                 TAILQ_FOREACH(pa, &pool->list, entries)
2148                         pp->nr++;
2149                 break;
2150         }
2151
2152         case DIOCGETADDR: {
2153                 struct pfioc_pooladdr   *pp = (struct pfioc_pooladdr *)addr;
2154                 u_int32_t                nr = 0;
2155
2156                 pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action,
2157                     pp->r_num, 0, 1, 1);
2158                 if (pool == NULL) {
2159                         error = EBUSY;
2160                         break;
2161                 }
2162                 pa = TAILQ_FIRST(&pool->list);
2163                 while ((pa != NULL) && (nr < pp->nr)) {
2164                         pa = TAILQ_NEXT(pa, entries);
2165                         nr++;
2166                 }
2167                 if (pa == NULL) {
2168                         error = EBUSY;
2169                         break;
2170                 }
2171                 bcopy(pa, &pp->addr, sizeof(struct pf_pooladdr));
2172                 pf_addr_copyout(&pp->addr.addr);
2173                 break;
2174         }
2175
2176         case DIOCCHANGEADDR: {
2177                 struct pfioc_pooladdr   *pca = (struct pfioc_pooladdr *)addr;
2178                 struct pf_pooladdr      *oldpa = NULL, *newpa = NULL;
2179                 struct pf_ruleset       *ruleset;
2180
2181                 if (pca->action < PF_CHANGE_ADD_HEAD ||
2182                     pca->action > PF_CHANGE_REMOVE) {
2183                         error = EINVAL;
2184                         break;
2185                 }
2186                 if (pca->addr.addr.type != PF_ADDR_ADDRMASK &&
2187                     pca->addr.addr.type != PF_ADDR_DYNIFTL &&
2188                     pca->addr.addr.type != PF_ADDR_TABLE) {
2189                         error = EINVAL;
2190                         break;
2191                 }
2192
2193                 ruleset = pf_find_ruleset(pca->anchor);
2194                 if (ruleset == NULL) {
2195                         error = EBUSY;
2196                         break;
2197                 }
2198                 pool = pf_get_pool(pca->anchor, pca->ticket, pca->r_action,
2199                     pca->r_num, pca->r_last, 1, 1);
2200                 if (pool == NULL) {
2201                         error = EBUSY;
2202                         break;
2203                 }
2204                 if (pca->action != PF_CHANGE_REMOVE) {
2205                         newpa = pool_get(&pf_pooladdr_pl,
2206                             PR_WAITOK|PR_LIMITFAIL);
2207                         if (newpa == NULL) {
2208                                 error = ENOMEM;
2209                                 break;
2210                         }
2211                         bcopy(&pca->addr, newpa, sizeof(struct pf_pooladdr));
2212 #ifndef INET
2213                         if (pca->af == AF_INET) {
2214                                 pool_put(&pf_pooladdr_pl, newpa);
2215                                 error = EAFNOSUPPORT;
2216                                 break;
2217                         }
2218 #endif /* INET */
2219 #ifndef INET6
2220                         if (pca->af == AF_INET6) {
2221                                 pool_put(&pf_pooladdr_pl, newpa);
2222                                 error = EAFNOSUPPORT;
2223                                 break;
2224                         }
2225 #endif /* INET6 */
2226                         if (newpa->ifname[0]) {
2227                                 newpa->kif = pfi_kif_get(newpa->ifname);
2228                                 if (newpa->kif == NULL) {
2229                                         pool_put(&pf_pooladdr_pl, newpa);
2230                                         error = EINVAL;
2231                                         break;
2232                                 }
2233                                 pfi_kif_ref(newpa->kif, PFI_KIF_REF_RULE);
2234                         } else
2235                                 newpa->kif = NULL;
2236                         if (pfi_dynaddr_setup(&newpa->addr, pca->af) ||
2237                             pf_tbladdr_setup(ruleset, &newpa->addr)) {
2238                                 pfi_dynaddr_remove(&newpa->addr);
2239                                 pfi_kif_unref(newpa->kif, PFI_KIF_REF_RULE);
2240                                 pool_put(&pf_pooladdr_pl, newpa);
2241                                 error = EINVAL;
2242                                 break;
2243                         }
2244                 }
2245
2246                 if (pca->action == PF_CHANGE_ADD_HEAD)
2247                         oldpa = TAILQ_FIRST(&pool->list);
2248                 else if (pca->action == PF_CHANGE_ADD_TAIL)
2249                         oldpa = TAILQ_LAST(&pool->list, pf_palist);
2250                 else {
2251                         int     i = 0;
2252
2253                         oldpa = TAILQ_FIRST(&pool->list);
2254                         while ((oldpa != NULL) && (i < pca->nr)) {
2255                                 oldpa = TAILQ_NEXT(oldpa, entries);
2256                                 i++;
2257                         }
2258                         if (oldpa == NULL) {
2259                                 error = EINVAL;
2260                                 break;
2261                         }
2262                 }
2263
2264                 if (pca->action == PF_CHANGE_REMOVE) {
2265                         TAILQ_REMOVE(&pool->list, oldpa, entries);
2266                         pfi_dynaddr_remove(&oldpa->addr);
2267                         pf_tbladdr_remove(&oldpa->addr);
2268                         pfi_kif_unref(oldpa->kif, PFI_KIF_REF_RULE);
2269                         pool_put(&pf_pooladdr_pl, oldpa);
2270                 } else {
2271                         if (oldpa == NULL)
2272                                 TAILQ_INSERT_TAIL(&pool->list, newpa, entries);
2273                         else if (pca->action == PF_CHANGE_ADD_HEAD ||
2274                             pca->action == PF_CHANGE_ADD_BEFORE)
2275                                 TAILQ_INSERT_BEFORE(oldpa, newpa, entries);
2276                         else
2277                                 TAILQ_INSERT_AFTER(&pool->list, oldpa,
2278                                     newpa, entries);
2279                 }
2280
2281                 pool->cur = TAILQ_FIRST(&pool->list);
2282                 PF_ACPY(&pool->counter, &pool->cur->addr.v.a.addr,
2283                     pca->af);
2284                 break;
2285         }
2286
2287         case DIOCGETRULESETS: {
2288                 struct pfioc_ruleset    *pr = (struct pfioc_ruleset *)addr;
2289                 struct pf_ruleset       *ruleset;
2290                 struct pf_anchor        *anchor;
2291
2292                 pr->path[sizeof(pr->path) - 1] = 0;
2293                 if ((ruleset = pf_find_ruleset(pr->path)) == NULL) {
2294                         error = EINVAL;
2295                         break;
2296                 }
2297                 pr->nr = 0;
2298                 if (ruleset->anchor == NULL) {
2299                         /* XXX kludge for pf_main_ruleset */
2300                         RB_FOREACH(anchor, pf_anchor_global, &pf_anchors)
2301                                 if (anchor->parent == NULL)
2302                                         pr->nr++;
2303                 } else {
2304                         RB_FOREACH(anchor, pf_anchor_node,
2305                             &ruleset->anchor->children)
2306                                 pr->nr++;
2307                 }
2308                 break;
2309         }
2310
2311         case DIOCGETRULESET: {
2312                 struct pfioc_ruleset    *pr = (struct pfioc_ruleset *)addr;
2313                 struct pf_ruleset       *ruleset;
2314                 struct pf_anchor        *anchor;
2315                 u_int32_t                nr = 0;
2316
2317                 pr->path[sizeof(pr->path) - 1] = 0;
2318                 if ((ruleset = pf_find_ruleset(pr->path)) == NULL) {
2319                         error = EINVAL;
2320                         break;
2321                 }
2322                 pr->name[0] = 0;
2323                 if (ruleset->anchor == NULL) {
2324                         /* XXX kludge for pf_main_ruleset */
2325                         RB_FOREACH(anchor, pf_anchor_global, &pf_anchors)
2326                                 if (anchor->parent == NULL && nr++ == pr->nr) {
2327                                         strlcpy(pr->name, anchor->name,
2328                                             sizeof(pr->name));
2329                                         break;
2330                                 }
2331                 } else {
2332                         RB_FOREACH(anchor, pf_anchor_node,
2333                             &ruleset->anchor->children)
2334                                 if (nr++ == pr->nr) {
2335                                         strlcpy(pr->name, anchor->name,
2336                                             sizeof(pr->name));
2337                                         break;
2338                                 }
2339                 }
2340                 if (!pr->name[0])
2341                         error = EBUSY;
2342                 break;
2343         }
2344
2345         case DIOCRCLRTABLES: {
2346                 struct pfioc_table *io = (struct pfioc_table *)addr;
2347
2348                 if (io->pfrio_esize != 0) {
2349                         error = ENODEV;
2350                         break;
2351                 }
2352                 error = pfr_clr_tables(&io->pfrio_table, &io->pfrio_ndel,
2353                     io->pfrio_flags | PFR_FLAG_USERIOCTL);
2354                 break;
2355         }
2356
2357         case DIOCRADDTABLES: {
2358                 struct pfioc_table *io = (struct pfioc_table *)addr;
2359
2360                 if (io->pfrio_esize != sizeof(struct pfr_table)) {
2361                         error = ENODEV;
2362                         break;
2363                 }
2364                 error = pfr_add_tables(io->pfrio_buffer, io->pfrio_size,
2365                     &io->pfrio_nadd, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2366                 break;
2367         }
2368
2369         case DIOCRDELTABLES: {
2370                 struct pfioc_table *io = (struct pfioc_table *)addr;
2371
2372                 if (io->pfrio_esize != sizeof(struct pfr_table)) {
2373                         error = ENODEV;
2374                         break;
2375                 }
2376                 error = pfr_del_tables(io->pfrio_buffer, io->pfrio_size,
2377                     &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2378                 break;
2379         }
2380
2381         case DIOCRGETTABLES: {
2382                 struct pfioc_table *io = (struct pfioc_table *)addr;
2383
2384                 if (io->pfrio_esize != sizeof(struct pfr_table)) {
2385                         error = ENODEV;
2386                         break;
2387                 }
2388                 error = pfr_get_tables(&io->pfrio_table, io->pfrio_buffer,
2389                     &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2390                 break;
2391         }
2392
2393         case DIOCRGETTSTATS: {
2394                 struct pfioc_table *io = (struct pfioc_table *)addr;
2395
2396                 if (io->pfrio_esize != sizeof(struct pfr_tstats)) {
2397                         error = ENODEV;
2398                         break;
2399                 }
2400                 error = pfr_get_tstats(&io->pfrio_table, io->pfrio_buffer,
2401                     &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2402                 break;
2403         }
2404
2405         case DIOCRCLRTSTATS: {
2406                 struct pfioc_table *io = (struct pfioc_table *)addr;
2407
2408                 if (io->pfrio_esize != sizeof(struct pfr_table)) {
2409                         error = ENODEV;
2410                         break;
2411                 }
2412                 error = pfr_clr_tstats(io->pfrio_buffer, io->pfrio_size,
2413                     &io->pfrio_nzero, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2414                 break;
2415         }
2416
2417         case DIOCRSETTFLAGS: {
2418                 struct pfioc_table *io = (struct pfioc_table *)addr;
2419
2420                 if (io->pfrio_esize != sizeof(struct pfr_table)) {
2421                         error = ENODEV;
2422                         break;
2423                 }
2424                 error = pfr_set_tflags(io->pfrio_buffer, io->pfrio_size,
2425                     io->pfrio_setflag, io->pfrio_clrflag, &io->pfrio_nchange,
2426                     &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2427                 break;
2428         }
2429
2430         case DIOCRCLRADDRS: {
2431                 struct pfioc_table *io = (struct pfioc_table *)addr;
2432
2433                 if (io->pfrio_esize != 0) {
2434                         error = ENODEV;
2435                         break;
2436                 }
2437                 error = pfr_clr_addrs(&io->pfrio_table, &io->pfrio_ndel,
2438                     io->pfrio_flags | PFR_FLAG_USERIOCTL);
2439                 break;
2440         }
2441
2442         case DIOCRADDADDRS: {
2443                 struct pfioc_table *io = (struct pfioc_table *)addr;
2444
2445                 if (io->pfrio_esize != sizeof(struct pfr_addr)) {
2446                         error = ENODEV;
2447                         break;
2448                 }
2449                 error = pfr_add_addrs(&io->pfrio_table, io->pfrio_buffer,
2450                     io->pfrio_size, &io->pfrio_nadd, io->pfrio_flags |
2451                     PFR_FLAG_USERIOCTL);
2452                 break;
2453         }
2454
2455         case DIOCRDELADDRS: {
2456                 struct pfioc_table *io = (struct pfioc_table *)addr;
2457
2458                 if (io->pfrio_esize != sizeof(struct pfr_addr)) {
2459                         error = ENODEV;
2460                         break;
2461                 }
2462                 error = pfr_del_addrs(&io->pfrio_table, io->pfrio_buffer,
2463                     io->pfrio_size, &io->pfrio_ndel, io->pfrio_flags |
2464                     PFR_FLAG_USERIOCTL);
2465                 break;
2466         }
2467
2468         case DIOCRSETADDRS: {
2469                 struct pfioc_table *io = (struct pfioc_table *)addr;
2470
2471                 if (io->pfrio_esize != sizeof(struct pfr_addr)) {
2472                         error = ENODEV;
2473                         break;
2474                 }
2475                 error = pfr_set_addrs(&io->pfrio_table, io->pfrio_buffer,
2476                     io->pfrio_size, &io->pfrio_size2, &io->pfrio_nadd,
2477                     &io->pfrio_ndel, &io->pfrio_nchange, io->pfrio_flags |
2478                     PFR_FLAG_USERIOCTL, 0);
2479                 break;
2480         }
2481
2482         case DIOCRGETADDRS: {
2483                 struct pfioc_table *io = (struct pfioc_table *)addr;
2484
2485                 if (io->pfrio_esize != sizeof(struct pfr_addr)) {
2486                         error = ENODEV;
2487                         break;
2488                 }
2489                 error = pfr_get_addrs(&io->pfrio_table, io->pfrio_buffer,
2490                     &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2491                 break;
2492         }
2493
2494         case DIOCRGETASTATS: {
2495                 struct pfioc_table *io = (struct pfioc_table *)addr;
2496
2497                 if (io->pfrio_esize != sizeof(struct pfr_astats)) {
2498                         error = ENODEV;
2499                         break;
2500                 }
2501                 error = pfr_get_astats(&io->pfrio_table, io->pfrio_buffer,
2502                     &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2503                 break;
2504         }
2505
2506         case DIOCRCLRASTATS: {
2507                 struct pfioc_table *io = (struct pfioc_table *)addr;
2508
2509                 if (io->pfrio_esize != sizeof(struct pfr_addr)) {
2510                         error = ENODEV;
2511                         break;
2512                 }
2513                 error = pfr_clr_astats(&io->pfrio_table, io->pfrio_buffer,
2514                     io->pfrio_size, &io->pfrio_nzero, io->pfrio_flags |
2515                     PFR_FLAG_USERIOCTL);
2516                 break;
2517         }
2518
2519         case DIOCRTSTADDRS: {
2520                 struct pfioc_table *io = (struct pfioc_table *)addr;
2521
2522                 if (io->pfrio_esize != sizeof(struct pfr_addr)) {
2523                         error = ENODEV;
2524                         break;
2525                 }
2526                 error = pfr_tst_addrs(&io->pfrio_table, io->pfrio_buffer,
2527                     io->pfrio_size, &io->pfrio_nmatch, io->pfrio_flags |
2528                     PFR_FLAG_USERIOCTL);
2529                 break;
2530         }
2531
2532         case DIOCRINADEFINE: {
2533                 struct pfioc_table *io = (struct pfioc_table *)addr;
2534
2535                 if (io->pfrio_esize != sizeof(struct pfr_addr)) {
2536                         error = ENODEV;
2537                         break;
2538                 }
2539                 error = pfr_ina_define(&io->pfrio_table, io->pfrio_buffer,
2540                     io->pfrio_size, &io->pfrio_nadd, &io->pfrio_naddr,
2541                     io->pfrio_ticket, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2542                 break;
2543         }
2544
2545         case DIOCOSFPADD: {
2546                 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr;
2547                 error = pf_osfp_add(io);
2548                 break;
2549         }
2550
2551         case DIOCOSFPGET: {
2552                 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr;
2553                 error = pf_osfp_get(io);
2554                 break;
2555         }
2556
2557         case DIOCXBEGIN: {
2558                 struct pfioc_trans      *io = (struct pfioc_trans *)addr;
2559                 struct pfioc_trans_e    *ioe;
2560                 struct pfr_table        *table;
2561                 int                      i;
2562
2563                 if (io->esize != sizeof(*ioe)) {
2564                         error = ENODEV;
2565                         goto fail;
2566                 }
2567                 ioe = kmalloc(sizeof(*ioe), M_TEMP, M_WAITOK);
2568                 table = kmalloc(sizeof(*table), M_TEMP, M_WAITOK);
2569                 for (i = 0; i < io->size; i++) {
2570                         if (copyin(io->array+i, ioe, sizeof(*ioe))) {
2571                                 kfree(table, M_TEMP);
2572                                 kfree(ioe, M_TEMP);
2573                                 error = EFAULT;
2574                                 goto fail;
2575                         }
2576                         switch (ioe->rs_num) {
2577 #ifdef ALTQ
2578                         case PF_RULESET_ALTQ:
2579                                 if (ioe->anchor[0]) {
2580                                         kfree(table, M_TEMP);
2581                                         kfree(ioe, M_TEMP);
2582                                         error = EINVAL;
2583                                         goto fail;
2584                                 }
2585                                 if ((error = pf_begin_altq(&ioe->ticket))) {
2586                                         kfree(table, M_TEMP);
2587                                         kfree(ioe, M_TEMP);
2588                                         goto fail;
2589                                 }
2590                                 break;
2591 #endif /* ALTQ */
2592                         case PF_RULESET_TABLE:
2593                                 bzero(table, sizeof(*table));
2594                                 strlcpy(table->pfrt_anchor, ioe->anchor,
2595                                     sizeof(table->pfrt_anchor));
2596                                 if ((error = pfr_ina_begin(table,
2597                                     &ioe->ticket, NULL, 0))) {
2598                                         kfree(table, M_TEMP);
2599                                         kfree(ioe, M_TEMP);
2600                                         goto fail;
2601                                 }
2602                                 break;
2603                         default:
2604                                 if ((error = pf_begin_rules(&ioe->ticket,
2605                                     ioe->rs_num, ioe->anchor))) {
2606                                         kfree(table, M_TEMP);
2607                                         kfree(ioe, M_TEMP);
2608                                         goto fail;
2609                                 }
2610                                 break;
2611                         }
2612                         if (copyout(ioe, io->array+i, sizeof(io->array[i]))) {
2613                                 kfree(table, M_TEMP);
2614                                 kfree(ioe, M_TEMP);
2615                                 error = EFAULT;
2616                                 goto fail;
2617                         }
2618                 }
2619                 kfree(table, M_TEMP);
2620                 kfree(ioe, M_TEMP);
2621                 break;
2622         }
2623
2624         case DIOCXROLLBACK: {
2625                 struct pfioc_trans      *io = (struct pfioc_trans *)addr;
2626                 struct pfioc_trans_e    *ioe;
2627                 struct pfr_table        *table;
2628                 int                      i;
2629
2630                 if (io->esize != sizeof(*ioe)) {
2631                         error = ENODEV;
2632                         goto fail;
2633                 }
2634                 ioe = kmalloc(sizeof(*ioe), M_TEMP, M_WAITOK);
2635                 table = kmalloc(sizeof(*table), M_TEMP, M_WAITOK);
2636                 for (i = 0; i < io->size; i++) {
2637                         if (copyin(io->array+i, ioe, sizeof(*ioe))) {
2638                                 kfree(table, M_TEMP);
2639                                 kfree(ioe, M_TEMP);
2640                                 error = EFAULT;
2641                                 goto fail;
2642                         }
2643                         switch (ioe->rs_num) {
2644 #ifdef ALTQ
2645                         case PF_RULESET_ALTQ:
2646                                 if (ioe->anchor[0]) {
2647                                         kfree(table, M_TEMP);
2648                                         kfree(ioe, M_TEMP);
2649                                         error = EINVAL;
2650                                         goto fail;
2651                                 }
2652                                 if ((error = pf_rollback_altq(ioe->ticket))) {
2653                                         kfree(table, M_TEMP);
2654                                         kfree(ioe, M_TEMP);
2655                                         goto fail; /* really bad */
2656                                 }
2657                                 break;
2658 #endif /* ALTQ */
2659                         case PF_RULESET_TABLE:
2660                                 bzero(table, sizeof(*table));
2661                                 strlcpy(table->pfrt_anchor, ioe->anchor,
2662                                     sizeof(table->pfrt_anchor));
2663                                 if ((error = pfr_ina_rollback(table,
2664                                     ioe->ticket, NULL, 0))) {
2665                                         kfree(table, M_TEMP);
2666                                         kfree(ioe, M_TEMP);
2667                                         goto fail; /* really bad */
2668                                 }
2669                                 break;
2670                         default:
2671                                 if ((error = pf_rollback_rules(ioe->ticket,
2672                                     ioe->rs_num, ioe->anchor))) {
2673                                         kfree(table, M_TEMP);
2674                                         kfree(ioe, M_TEMP);
2675                                         goto fail; /* really bad */
2676                                 }
2677                                 break;
2678                         }
2679                 }
2680                 kfree(table, M_TEMP);
2681                 kfree(ioe, M_TEMP);
2682                 break;
2683         }
2684
2685         case DIOCXCOMMIT: {
2686                 struct pfioc_trans      *io = (struct pfioc_trans *)addr;
2687                 struct pfioc_trans_e    *ioe;
2688                 struct pfr_table        *table;
2689                 struct pf_ruleset       *rs;
2690                 int                      i;
2691
2692                 if (io->esize != sizeof(*ioe)) {
2693                         error = ENODEV;
2694                         goto fail;
2695                 }
2696                 ioe = kmalloc(sizeof(*ioe), M_TEMP, M_WAITOK);
2697                 table = kmalloc(sizeof(*table), M_TEMP, M_WAITOK);
2698                 /* first makes sure everything will succeed */
2699                 for (i = 0; i < io->size; i++) {
2700                         if (copyin(io->array+i, ioe, sizeof(*ioe))) {
2701                                 kfree(table, M_TEMP);
2702                                 kfree(ioe, M_TEMP);
2703                                 error = EFAULT;
2704                                 goto fail;
2705                         }
2706                         switch (ioe->rs_num) {
2707 #ifdef ALTQ
2708                         case PF_RULESET_ALTQ:
2709                                 if (ioe->anchor[0]) {
2710                                         kfree(table, M_TEMP);
2711                                         kfree(ioe, M_TEMP);
2712                                         error = EINVAL;
2713                                         goto fail;
2714                                 }
2715                                 if (!altqs_inactive_open || ioe->ticket !=
2716                                     ticket_altqs_inactive) {
2717                                         kfree(table, M_TEMP);
2718                                         kfree(ioe, M_TEMP);
2719                                         error = EBUSY;
2720                                         goto fail;
2721                                 }
2722                                 break;
2723 #endif /* ALTQ */
2724                         case PF_RULESET_TABLE:
2725                                 rs = pf_find_ruleset(ioe->anchor);
2726                                 if (rs == NULL || !rs->topen || ioe->ticket !=
2727                                      rs->tticket) {
2728                                         kfree(table, M_TEMP);
2729                                         kfree(ioe, M_TEMP);
2730                                         error = EBUSY;
2731                                         goto fail;
2732                                 }
2733                                 break;
2734                         default:
2735                                 if (ioe->rs_num < 0 || ioe->rs_num >=
2736                                     PF_RULESET_MAX) {
2737                                         kfree(table, M_TEMP);
2738                                         kfree(ioe, M_TEMP);
2739                                         error = EINVAL;
2740                                         goto fail;
2741                                 }
2742                                 rs = pf_find_ruleset(ioe->anchor);
2743                                 if (rs == NULL ||
2744                                     !rs->rules[ioe->rs_num].inactive.open ||
2745                                     rs->rules[ioe->rs_num].inactive.ticket !=
2746                                     ioe->ticket) {
2747                                         kfree(table, M_TEMP);
2748                                         kfree(ioe, M_TEMP);
2749                                         error = EBUSY;
2750                                         goto fail;
2751                                 }
2752                                 break;
2753                         }
2754                 }
2755                 /* now do the commit - no errors should happen here */
2756                 for (i = 0; i < io->size; i++) {
2757                         if (copyin(io->array+i, ioe, sizeof(*ioe))) {
2758                                 kfree(table, M_TEMP);
2759                                 kfree(ioe, M_TEMP);
2760                                 error = EFAULT;
2761                                 goto fail;
2762                         }
2763                         switch (ioe->rs_num) {
2764 #ifdef ALTQ
2765                         case PF_RULESET_ALTQ:
2766                                 if ((error = pf_commit_altq(ioe->ticket))) {
2767                                         kfree(table, M_TEMP);
2768                                         kfree(ioe, M_TEMP);
2769                                         goto fail; /* really bad */
2770                                 }
2771                                 break;
2772 #endif /* ALTQ */
2773                         case PF_RULESET_TABLE:
2774                                 bzero(table, sizeof(*table));
2775                                 strlcpy(table->pfrt_anchor, ioe->anchor,
2776                                     sizeof(table->pfrt_anchor));
2777                                 if ((error = pfr_ina_commit(table, ioe->ticket,
2778                                     NULL, NULL, 0))) {
2779                                         kfree(table, M_TEMP);
2780                                         kfree(ioe, M_TEMP);
2781                                         goto fail; /* really bad */
2782                                 }
2783                                 break;
2784                         default:
2785                                 if ((error = pf_commit_rules(ioe->ticket,
2786                                     ioe->rs_num, ioe->anchor))) {
2787                                         kfree(table, M_TEMP);
2788                                         kfree(ioe, M_TEMP);
2789                                         goto fail; /* really bad */
2790                                 }
2791                                 break;
2792                         }
2793                 }
2794                 kfree(table, M_TEMP);
2795                 kfree(ioe, M_TEMP);
2796                 break;
2797         }
2798
2799         case DIOCGETSRCNODES: {
2800                 struct pfioc_src_nodes  *psn = (struct pfioc_src_nodes *)addr;
2801                 struct pf_src_node      *n, *p, *pstore;
2802                 u_int32_t                nr = 0;
2803                 int                      space = psn->psn_len;
2804
2805                 if (space == 0) {
2806                         RB_FOREACH(n, pf_src_tree, &tree_src_tracking)
2807                                 nr++;
2808                         psn->psn_len = sizeof(struct pf_src_node) * nr;
2809                         break;
2810                 }
2811
2812                 pstore = kmalloc(sizeof(*pstore), M_TEMP, M_WAITOK);
2813
2814                 p = psn->psn_src_nodes;
2815                 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) {
2816                         int     secs = time_second, diff;
2817
2818                         if ((nr + 1) * sizeof(*p) > (unsigned)psn->psn_len)
2819                                 break;
2820
2821                         bcopy(n, pstore, sizeof(*pstore));
2822                         if (n->rule.ptr != NULL)
2823                                 pstore->rule.nr = n->rule.ptr->nr;
2824                         pstore->creation = secs - pstore->creation;
2825                         if (pstore->expire > secs)
2826                                 pstore->expire -= secs;
2827                         else
2828                                 pstore->expire = 0;
2829
2830                         /* adjust the connection rate estimate */
2831                         diff = secs - n->conn_rate.last;
2832                         if (diff >= n->conn_rate.seconds)
2833                                 pstore->conn_rate.count = 0;
2834                         else
2835                                 pstore->conn_rate.count -=
2836                                     n->conn_rate.count * diff /
2837                                     n->conn_rate.seconds;
2838
2839                         error = copyout(pstore, p, sizeof(*p));
2840                         if (error) {
2841                                 kfree(pstore, M_TEMP);
2842                                 goto fail;
2843                         }
2844                         p++;
2845                         nr++;
2846                 }
2847                 psn->psn_len = sizeof(struct pf_src_node) * nr;
2848
2849                 kfree(pstore, M_TEMP);
2850                 break;
2851         }
2852
2853         case DIOCCLRSRCNODES: {
2854                 struct pf_src_node      *n;
2855                 struct pf_state         *state;
2856
2857                 RB_FOREACH(state, pf_state_tree_id, &tree_id) {
2858                         state->src_node = NULL;
2859                         state->nat_src_node = NULL;
2860                 }
2861                 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) {
2862                         n->expire = 1;
2863                         n->states = 0;
2864                 }
2865                 pf_purge_expired_src_nodes(1);
2866                 pf_status.src_nodes = 0;
2867                 break;
2868         }
2869
2870         case DIOCKILLSRCNODES: {
2871                 struct pf_src_node      *sn;
2872                 struct pf_state         *s;
2873                 struct pfioc_src_node_kill *psnk =
2874                     (struct pfioc_src_node_kill *)addr;
2875                 u_int                   killed = 0;
2876
2877                 RB_FOREACH(sn, pf_src_tree, &tree_src_tracking) {
2878                         if (PF_MATCHA(psnk->psnk_src.neg,
2879                                 &psnk->psnk_src.addr.v.a.addr,
2880                                 &psnk->psnk_src.addr.v.a.mask,
2881                                 &sn->addr, sn->af) &&
2882                             PF_MATCHA(psnk->psnk_dst.neg,
2883                                 &psnk->psnk_dst.addr.v.a.addr,
2884                                 &psnk->psnk_dst.addr.v.a.mask,
2885                                 &sn->raddr, sn->af)) {
2886                                 /* Handle state to src_node linkage */
2887                                 if (sn->states != 0) {
2888                                         RB_FOREACH(s, pf_state_tree_id,
2889                                             &tree_id) {
2890                                                 if (s->src_node == sn)
2891                                                         s->src_node = NULL;
2892                                                 if (s->nat_src_node == sn)
2893                                                         s->nat_src_node = NULL;
2894                                         }
2895                                         sn->states = 0;
2896                                 }
2897                                 sn->expire = 1;
2898                                 killed++;
2899                         }
2900                 }
2901
2902                 if (killed > 0)
2903                         pf_purge_expired_src_nodes(1);
2904
2905                 psnk->psnk_killed = killed;
2906                 break;
2907         }
2908
2909         case DIOCSETHOSTID: {
2910                 u_int32_t       *hostid = (u_int32_t *)addr;
2911
2912                 if (*hostid == 0)
2913                         pf_status.hostid = karc4random();
2914                 else
2915                         pf_status.hostid = *hostid;
2916                 break;
2917         }
2918
2919         case DIOCOSFPFLUSH:
2920                 crit_enter();
2921                 pf_osfp_flush();
2922                 crit_exit();
2923                 break;
2924
2925         case DIOCIGETIFACES: {
2926                 struct pfioc_iface *io = (struct pfioc_iface *)addr;
2927
2928                 if (io->pfiio_esize != sizeof(struct pfi_kif)) {
2929                         error = ENODEV;
2930                         break;
2931                 }
2932                 error = pfi_get_ifaces(io->pfiio_name, io->pfiio_buffer,
2933                     &io->pfiio_size);
2934                 break;
2935         }
2936
2937         case DIOCSETIFFLAG: {
2938                 struct pfioc_iface *io = (struct pfioc_iface *)addr;
2939
2940                 error = pfi_set_flags(io->pfiio_name, io->pfiio_flags);
2941                 break;
2942         }
2943
2944         case DIOCCLRIFFLAG: {
2945                 struct pfioc_iface *io = (struct pfioc_iface *)addr;
2946
2947                 error = pfi_clear_flags(io->pfiio_name, io->pfiio_flags);
2948                 break;
2949         }
2950
2951         default:
2952                 error = ENODEV;
2953                 break;
2954         }
2955 fail:
2956         lwkt_reltoken(&pf_token);
2957         return (error);
2958 }
2959
2960 /*
2961  * XXX - Check for version missmatch!!!
2962  */
2963 static void
2964 pf_clear_states(void)
2965 {
2966         struct pf_state         *state;
2967
2968         RB_FOREACH(state, pf_state_tree_id, &tree_id) {
2969                 state->timeout = PFTM_PURGE;
2970                 /* don't send out individual delete messages */
2971                 state->sync_flags = PFSTATE_NOSYNC;
2972                 pf_unlink_state(state);
2973         }
2974         pf_status.states = 0;
2975 #if 0 /* PFSYNC */
2976 /*
2977  * XXX This is called on module unload, we do not want to sync that over? */
2978  */
2979         pfsync_clear_states(pf_status.hostid, psk->psk_ifname);
2980 #endif
2981 }
2982
2983 static int
2984 pf_clear_tables(void)
2985 {
2986         struct pfioc_table io;
2987         int error;
2988
2989         bzero(&io, sizeof(io));
2990
2991         error = pfr_clr_tables(&io.pfrio_table, &io.pfrio_ndel,
2992             io.pfrio_flags);
2993
2994         return (error);
2995 }
2996
2997 static void
2998 pf_clear_srcnodes(void)
2999 {
3000         struct pf_src_node      *n;
3001         struct pf_state         *state;
3002
3003         RB_FOREACH(state, pf_state_tree_id, &tree_id) {
3004                 state->src_node = NULL;
3005                 state->nat_src_node = NULL;
3006         }
3007         RB_FOREACH(n, pf_src_tree, &tree_src_tracking) {
3008                 n->expire = 1;
3009                 n->states = 0;
3010         }
3011         pf_purge_expired_src_nodes(0);
3012         pf_status.src_nodes = 0;
3013 }
3014 /*
3015  * XXX - Check for version missmatch!!!
3016  */
3017
3018 /*
3019  * Duplicate pfctl -Fa operation to get rid of as much as we can.
3020  */
3021 static int
3022 shutdown_pf(void)
3023 {
3024         int error = 0;
3025         u_int32_t t[5];
3026         char nn = '\0';
3027
3028
3029         pf_status.running = 0;
3030         do {
3031                 if ((error = pf_begin_rules(&t[0], PF_RULESET_SCRUB, &nn)) != 0) {
3032                         DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: SCRUB\n"));
3033                         break;
3034                 }
3035                 if ((error = pf_begin_rules(&t[1], PF_RULESET_FILTER, &nn)) != 0) {
3036                         DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: FILTER\n"));
3037                         break;          /* XXX: rollback? */
3038                 }
3039                 if ((error = pf_begin_rules(&t[2], PF_RULESET_NAT, &nn))    != 0) {
3040                         DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: NAT\n"));
3041                         break;          /* XXX: rollback? */
3042                 }
3043                 if ((error = pf_begin_rules(&t[3], PF_RULESET_BINAT, &nn))
3044                     != 0) {
3045                         DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: BINAT\n"));
3046                         break;          /* XXX: rollback? */
3047                 }
3048                 if ((error = pf_begin_rules(&t[4], PF_RULESET_RDR, &nn))
3049                     != 0) {
3050                         DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: RDR\n"));
3051                         break;          /* XXX: rollback? */
3052                 }
3053
3054                 /* XXX: these should always succeed here */
3055                 pf_commit_rules(t[0], PF_RULESET_SCRUB, &nn);
3056                 pf_commit_rules(t[1], PF_RULESET_FILTER, &nn);
3057                 pf_commit_rules(t[2], PF_RULESET_NAT, &nn);
3058                 pf_commit_rules(t[3], PF_RULESET_BINAT, &nn);
3059                 pf_commit_rules(t[4], PF_RULESET_RDR, &nn);
3060
3061                 if ((error = pf_clear_tables()) != 0)
3062                         break;
3063 #ifdef ALTQ
3064                 if ((error = pf_begin_altq(&t[0])) != 0) {
3065                         DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: ALTQ\n"));
3066                         break;
3067                 }
3068                 pf_commit_altq(t[0]);
3069 #endif
3070                 pf_clear_states();
3071
3072                 pf_clear_srcnodes();
3073
3074                 /* status does not use malloced mem so no need to cleanup */
3075                 /* fingerprints and interfaces have their own cleanup code */
3076         } while(0);
3077
3078         return (error);
3079 }
3080
3081 static int
3082 pf_check_in(void *arg, struct mbuf **m, struct ifnet *ifp, int dir)
3083 {
3084         /*
3085          * DragonFly's version of pf uses FreeBSD's native host byte ordering
3086          * for ip_len/ip_off. This is why we don't have to change byte order
3087          * like the FreeBSD-5 version does.
3088          */
3089         int chk;
3090
3091         lwkt_gettoken(&pf_token);
3092
3093         chk = pf_test(PF_IN, ifp, m, NULL, NULL);
3094         if (chk && *m) {
3095                 m_freem(*m);
3096                 *m = NULL;
3097         }
3098         lwkt_reltoken(&pf_token);
3099         return chk;
3100 }
3101
3102 static int
3103 pf_check_out(void *arg, struct mbuf **m, struct ifnet *ifp, int dir)
3104 {
3105         /*
3106          * DragonFly's version of pf uses FreeBSD's native host byte ordering
3107          * for ip_len/ip_off. This is why we don't have to change byte order
3108          * like the FreeBSD-5 version does.
3109          */
3110         int chk;
3111
3112         lwkt_gettoken(&pf_token);
3113
3114         /* We need a proper CSUM befor we start (s. OpenBSD ip_output) */
3115         if ((*m)->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
3116                 in_delayed_cksum(*m);
3117                 (*m)->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
3118         }
3119         chk = pf_test(PF_OUT, ifp, m, NULL, NULL);
3120         if (chk && *m) {
3121                 m_freem(*m);
3122                 *m = NULL;
3123         }
3124         lwkt_reltoken(&pf_token);
3125         return chk;
3126 }
3127
3128 #ifdef INET6
3129 static int
3130 pf_check6_in(void *arg, struct mbuf **m, struct ifnet *ifp, int dir)
3131 {
3132         /*
3133          * IPv6 is not affected by ip_len/ip_off byte order changes.
3134          */
3135         int chk;
3136
3137         lwkt_gettoken(&pf_token);
3138
3139         chk = pf_test6(PF_IN, ifp, m, NULL, NULL);
3140         if (chk && *m) {
3141                 m_freem(*m);
3142                 *m = NULL;
3143         }
3144         lwkt_reltoken(&pf_token);
3145         return chk;
3146 }
3147
3148 static int
3149 pf_check6_out(void *arg, struct mbuf **m, struct ifnet *ifp, int dir)
3150 {
3151         /*
3152          * IPv6 is not affected by ip_len/ip_off byte order changes.
3153          */
3154         int chk;
3155
3156         lwkt_gettoken(&pf_token);
3157
3158         /* We need a proper CSUM befor we start (s. OpenBSD ip_output) */
3159         if ((*m)->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
3160                 in_delayed_cksum(*m);
3161                 (*m)->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
3162         }
3163         chk = pf_test6(PF_OUT, ifp, m, NULL, NULL);
3164         if (chk && *m) {
3165                 m_freem(*m);
3166                 *m = NULL;
3167         }
3168         lwkt_reltoken(&pf_token);
3169         return chk;
3170 }
3171 #endif /* INET6 */
3172
3173 static int
3174 hook_pf(void)
3175 {
3176         struct pfil_head *pfh_inet;
3177 #ifdef INET6
3178         struct pfil_head *pfh_inet6;
3179 #endif
3180
3181         lwkt_gettoken(&pf_token);
3182
3183         if (pf_pfil_hooked) {
3184                 lwkt_reltoken(&pf_token);
3185                 return (0);
3186         }
3187
3188         pfh_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET);
3189         if (pfh_inet == NULL) {
3190                 lwkt_reltoken(&pf_token);
3191                 return (ENODEV);
3192         }
3193         pfil_add_hook(pf_check_in, NULL, PFIL_IN | PFIL_MPSAFE, pfh_inet);
3194         pfil_add_hook(pf_check_out, NULL, PFIL_OUT | PFIL_MPSAFE, pfh_inet);
3195 #ifdef INET6
3196         pfh_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6);
3197         if (pfh_inet6 == NULL) {
3198                 pfil_remove_hook(pf_check_in, NULL, PFIL_IN, pfh_inet);
3199                 pfil_remove_hook(pf_check_out, NULL, PFIL_OUT, pfh_inet);
3200                 lwkt_reltoken(&pf_token);
3201                 return (ENODEV);
3202         }
3203         pfil_add_hook(pf_check6_in, NULL, PFIL_IN | PFIL_MPSAFE, pfh_inet6);
3204         pfil_add_hook(pf_check6_out, NULL, PFIL_OUT | PFIL_MPSAFE, pfh_inet6);
3205 #endif
3206
3207         pf_pfil_hooked = 1;
3208         lwkt_reltoken(&pf_token);
3209         return (0);
3210 }
3211
3212 static int
3213 dehook_pf(void)
3214 {
3215         struct pfil_head *pfh_inet;
3216 #ifdef INET6
3217         struct pfil_head *pfh_inet6;
3218 #endif
3219
3220         lwkt_gettoken(&pf_token);
3221
3222         if (pf_pfil_hooked == 0) {
3223                 lwkt_reltoken(&pf_token);
3224                 return (0);
3225         }
3226
3227         pfh_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET);
3228         if (pfh_inet == NULL) {
3229                 lwkt_reltoken(&pf_token);
3230                 return (ENODEV);
3231         }
3232         pfil_remove_hook(pf_check_in, NULL, PFIL_IN, pfh_inet);
3233         pfil_remove_hook(pf_check_out, NULL, PFIL_OUT, pfh_inet);
3234 #ifdef INET6
3235         pfh_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6);
3236         if (pfh_inet6 == NULL) {
3237                 lwkt_reltoken(&pf_token);
3238                 return (ENODEV);
3239         }
3240         pfil_remove_hook(pf_check6_in, NULL, PFIL_IN, pfh_inet6);
3241         pfil_remove_hook(pf_check6_out, NULL, PFIL_OUT, pfh_inet6);
3242 #endif
3243
3244         pf_pfil_hooked = 0;
3245         lwkt_reltoken(&pf_token);
3246         return (0);
3247 }
3248
3249 static int
3250 pf_load(void)
3251 {
3252         int error;
3253
3254         lwkt_gettoken(&pf_token);
3255
3256         init_zone_var();
3257         lockinit(&pf_mod_lck, "pf task lck", 0, LK_CANRECURSE);
3258         pf_dev = make_dev(&pf_ops, 0, 0, 0, 0600, PF_NAME);
3259         error = pfattach();
3260         if (error) {
3261                 dev_ops_remove_all(&pf_ops);
3262                 lockuninit(&pf_mod_lck);
3263                 lwkt_reltoken(&pf_token);
3264                 return (error);
3265         }
3266         lockinit(&pf_consistency_lock, "pfconslck", 0, LK_CANRECURSE);
3267         lwkt_reltoken(&pf_token);
3268         return (0);
3269 }
3270
3271 static int
3272 pf_mask_del(struct radix_node *rn, void *arg)
3273 {
3274         struct radix_node_head *rnh = arg;
3275
3276         rnh->rnh_deladdr(rn->rn_key, rn->rn_mask, rnh);
3277         Free(rn);
3278         return 0;
3279 }
3280
3281 static int
3282 pf_unload(void)
3283 {
3284         int error;
3285         pf_status.running = 0;
3286
3287         lwkt_gettoken(&pf_token);
3288
3289         error = dehook_pf();
3290         if (error) {
3291                 /*
3292                  * Should not happen!
3293                  * XXX Due to error code ESRCH, kldunload will show
3294                  * a message like 'No such process'.
3295                  */
3296                 kprintf("pfil unregistration fail\n");
3297                 lwkt_reltoken(&pf_token);
3298                 return error;
3299         }
3300         shutdown_pf();
3301         pf_end_threads = 1;
3302         while (pf_end_threads < 2) {
3303                 wakeup_one(pf_purge_thread);
3304                 lksleep(pf_purge_thread, &pf_mod_lck, 0, "pftmo", hz);
3305
3306         }
3307         pfi_cleanup();
3308         pf_osfp_flush();
3309         pf_osfp_cleanup();
3310         cleanup_pf_zone();
3311         dev_ops_remove_all(&pf_ops);
3312         lockuninit(&pf_consistency_lock);
3313         lockuninit(&pf_mod_lck);
3314         lwkt_reltoken(&pf_token);
3315
3316         if (pf_maskhead != NULL) {
3317                 pf_maskhead->rnh_walktree(pf_maskhead,
3318                         pf_mask_del, pf_maskhead);
3319                 Free(pf_maskhead);
3320                 pf_maskhead = NULL;
3321         }
3322         return 0;
3323 }
3324
3325 static int
3326 pf_modevent(module_t mod, int type, void *data)
3327 {
3328         int error = 0;
3329
3330         lwkt_gettoken(&pf_token);
3331
3332         switch(type) {
3333         case MOD_LOAD:
3334                 error = pf_load();
3335                 break;
3336
3337         case MOD_UNLOAD:
3338                 error = pf_unload();
3339                 break;
3340         default:
3341                 error = EINVAL;
3342                 break;
3343         }
3344         lwkt_reltoken(&pf_token);
3345         return error;
3346 }
3347
3348 static moduledata_t pf_mod = {
3349         "pf",
3350         pf_modevent,
3351         0
3352 };
3353 DECLARE_MODULE(pf, pf_mod, SI_SUB_PSEUDO, SI_ORDER_FIRST);
3354 MODULE_VERSION(pf, PF_MODVER);