sys/net/pf/pf_table.c

   1 /*      $OpenBSD: pf_table.c,v 1.78 2008/06/14 03:50:14 art Exp $       */
   2
   3 /*
   4  * Copyright (c) 2010 The DragonFly Project.  All rights reserved.
   5  *
   6  * Copyright (c) 2002 Cedric Berger
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  *
  13  *    - Redistributions of source code must retain the above copyright
  14  *      notice, this list of conditions and the following disclaimer.
  15  *    - Redistributions in binary form must reproduce the above
  16  *      copyright notice, this list of conditions and the following
  17  *      disclaimer in the documentation and/or other materials provided
  18  *      with the distribution.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  24  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  27  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  28  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  30  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  31  * POSSIBILITY OF SUCH DAMAGE.
  32  *
  33  */
  34
  35 #include "opt_inet.h"
  36 #include "opt_inet6.h"
  37
  38 #include <sys/param.h>
  39 #include <sys/systm.h>
  40 #include <sys/socket.h>
  41 #include <sys/mbuf.h>
  42 #include <sys/kernel.h>
  43 #include <sys/malloc.h>
  44 #include <sys/thread2.h>
  45 #include <vm/vm_zone.h>
  46
  47 #include <net/if.h>
  48 #include <net/route.h>
  49 #include <netinet/in.h>
  50 #include <net/pf/pfvar.h>
  51
  52 #define ACCEPT_FLAGS(flags, oklist)             \
  53         do {                                    \
  54                 if ((flags & ~(oklist)) &       \
  55                     PFR_FLAG_ALLMASK)           \
  56                         return (EINVAL);        \
  57         } while (0)
  58
  59 #define COPYIN(from, to, size, flags)           \
  60         ((flags & PFR_FLAG_USERIOCTL) ?         \
  61         copyin((from), (to), (size)) :          \
  62         (bcopy((from), (to), (size)), 0))
  63
  64 #define COPYOUT(from, to, size, flags)          \
  65         ((flags & PFR_FLAG_USERIOCTL) ?         \
  66         copyout((from), (to), (size)) :         \
  67         (bcopy((from), (to), (size)), 0))
  68
  69 #define FILLIN_SIN(sin, addr)                   \
  70         do {                                    \
  71                 (sin).sin_len = sizeof(sin);    \
  72                 (sin).sin_family = AF_INET;     \
  73                 (sin).sin_addr = (addr);        \
  74         } while (0)
  75
  76 #define FILLIN_SIN6(sin6, addr)                 \
  77         do {                                    \
  78                 (sin6).sin6_len = sizeof(sin6); \
  79                 (sin6).sin6_family = AF_INET6;  \
  80                 (sin6).sin6_addr = (addr);      \
  81         } while (0)
  82
  83 #define SWAP(type, a1, a2)                      \
  84         do {                                    \
  85                 type tmp = a1;                  \
  86                 a1 = a2;                        \
  87                 a2 = tmp;                       \
  88         } while (0)
  89
  90 #define SUNION2PF(su, af) (((af)==AF_INET) ?    \
  91     (struct pf_addr *)&(su)->sin.sin_addr :     \
  92     (struct pf_addr *)&(su)->sin6.sin6_addr)
  93
  94 #define AF_BITS(af)             (((af)==AF_INET)?32:128)
  95 #define ADDR_NETWORK(ad)        ((ad)->pfra_net < AF_BITS((ad)->pfra_af))
  96 #define KENTRY_NETWORK(ke)      ((ke)->pfrke_net < AF_BITS((ke)->pfrke_af))
  97 #define KENTRY_RNF_ROOT(ke) \
  98                 ((((struct radix_node *)(ke))->rn_flags & RNF_ROOT) != 0)
  99
 100 #define NO_ADDRESSES            (-1)
 101 #define ENQUEUE_UNMARKED_ONLY   (1)
 102 #define INVERT_NEG_FLAG         (1)
 103
 104 struct pfr_walktree {
 105         enum pfrw_op {
 106                 PFRW_MARK,
 107                 PFRW_SWEEP,
 108                 PFRW_ENQUEUE,
 109                 PFRW_GET_ADDRS,
 110                 PFRW_GET_ASTATS,
 111                 PFRW_POOL_GET,
 112                 PFRW_DYNADDR_UPDATE
 113         }        pfrw_op;
 114         union {
 115                 struct pfr_addr         *pfrw1_addr;
 116                 struct pfr_astats       *pfrw1_astats;
 117                 struct pfr_kentryworkq  *pfrw1_workq;
 118                 struct pfr_kentry       *pfrw1_kentry;
 119                 struct pfi_dynaddr      *pfrw1_dyn;
 120         }        pfrw_1;
 121         int      pfrw_free;
 122         int      pfrw_flags;
 123 };
 124 #define pfrw_addr       pfrw_1.pfrw1_addr
 125 #define pfrw_astats     pfrw_1.pfrw1_astats
 126 #define pfrw_workq      pfrw_1.pfrw1_workq
 127 #define pfrw_kentry     pfrw_1.pfrw1_kentry
 128 #define pfrw_dyn        pfrw_1.pfrw1_dyn
 129 #define pfrw_cnt        pfrw_free
 130
 131 #define senderr(e)      do { rv = (e); goto _bad; } while (0)
 132
 133 vm_zone_t                pfr_ktable_pl;
 134 vm_zone_t                pfr_kentry_pl;
 135 vm_zone_t                pfr_kentry_pl2;
 136 vm_zone_t               pfr_kcounters_pl;
 137 struct sockaddr_in       pfr_sin;
 138 struct sockaddr_in6      pfr_sin6;
 139 union sockaddr_union     pfr_mask;
 140 struct pf_addr           pfr_ffaddr;
 141
 142 void                     pfr_copyout_addr(struct pfr_addr *,
 143                             struct pfr_kentry *ke);
 144 int                      pfr_validate_addr(struct pfr_addr *);
 145 void                     pfr_enqueue_addrs(struct pfr_ktable *,
 146                             struct pfr_kentryworkq *, int *, int);
 147 void                     pfr_mark_addrs(struct pfr_ktable *);
 148 struct pfr_kentry       *pfr_lookup_addr(struct pfr_ktable *,
 149                             struct pfr_addr *, int);
 150 struct pfr_kentry       *pfr_create_kentry(struct pfr_addr *, int);
 151 void                     pfr_destroy_kentries(struct pfr_kentryworkq *);
 152 void                     pfr_destroy_kentry(struct pfr_kentry *);
 153 void                     pfr_insert_kentries(struct pfr_ktable *,
 154                             struct pfr_kentryworkq *, long);
 155 void                     pfr_remove_kentries(struct pfr_ktable *,
 156                             struct pfr_kentryworkq *);
 157 void                     pfr_clstats_kentries(struct pfr_kentryworkq *, long,
 158                             int);
 159 void                     pfr_reset_feedback(struct pfr_addr *, int, int);
 160 void                     pfr_prepare_network(union sockaddr_union *, int, int);
 161 int                      pfr_route_kentry(struct pfr_ktable *,
 162                             struct pfr_kentry *);
 163 int                      pfr_unroute_kentry(struct pfr_ktable *,
 164                             struct pfr_kentry *);
 165 int                      pfr_walktree(struct radix_node *, void *);
 166 int                      pfr_validate_table(struct pfr_table *, int, int);
 167 int                      pfr_fix_anchor(char *);
 168 void                     pfr_commit_ktable(struct pfr_ktable *, long);
 169 void                     pfr_insert_ktables(struct pfr_ktableworkq *);
 170 void                     pfr_insert_ktable(struct pfr_ktable *);
 171 void                     pfr_setflags_ktables(struct pfr_ktableworkq *);
 172 void                     pfr_setflags_ktable(struct pfr_ktable *, int);
 173 void                     pfr_clstats_ktables(struct pfr_ktableworkq *, long,
 174                             int);
 175 void                     pfr_clstats_ktable(struct pfr_ktable *, long, int);
 176 struct pfr_ktable       *pfr_create_ktable(struct pfr_table *, long, int);
 177 void                     pfr_destroy_ktables(struct pfr_ktableworkq *, int);
 178 void                     pfr_destroy_ktable(struct pfr_ktable *, int);
 179 int                      pfr_ktable_compare(struct pfr_ktable *,
 180                             struct pfr_ktable *);
 181 struct pfr_ktable       *pfr_lookup_table(struct pfr_table *);
 182 void                     pfr_clean_node_mask(struct pfr_ktable *,
 183                             struct pfr_kentryworkq *);
 184 int                      pfr_table_count(struct pfr_table *, int);
 185 int                      pfr_skip_table(struct pfr_table *,
 186                             struct pfr_ktable *, int);
 187 struct pfr_kentry       *pfr_kentry_byidx(struct pfr_ktable *, int, int);
 188
 189 RB_PROTOTYPE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
 190 RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
 191
 192 struct pfr_ktablehead    pfr_ktables;
 193 struct pfr_table         pfr_nulltable;
 194 int                      pfr_ktable_cnt;
 195
 196 void
 197 pfr_initialize(void)
 198 {
 199         pfr_sin.sin_len = sizeof(pfr_sin);
 200         pfr_sin.sin_family = AF_INET;
 201         pfr_sin6.sin6_len = sizeof(pfr_sin6);
 202         pfr_sin6.sin6_family = AF_INET6;
 203
 204         memset(&pfr_ffaddr, 0xff, sizeof(pfr_ffaddr));
 205 }
 206
 207 int
 208 pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags)
 209 {
 210         struct pfr_ktable       *kt;
 211         struct pfr_kentryworkq   workq;
 212
 213         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
 214         if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
 215                 return (EINVAL);
 216         kt = pfr_lookup_table(tbl);
 217         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 218                 return (ESRCH);
 219         if (kt->pfrkt_flags & PFR_TFLAG_CONST)
 220                 return (EPERM);
 221         pfr_enqueue_addrs(kt, &workq, ndel, 0);
 222
 223         if (!(flags & PFR_FLAG_DUMMY)) {
 224                 if (flags & PFR_FLAG_ATOMIC)
 225                         crit_enter();
 226                 pfr_remove_kentries(kt, &workq);
 227                 if (flags & PFR_FLAG_ATOMIC)
 228                         crit_exit();
 229                 if (kt->pfrkt_cnt) {
 230                         kprintf("pfr_clr_addrs: corruption detected (%d).\n",
 231                             kt->pfrkt_cnt);
 232                         kt->pfrkt_cnt = 0;
 233                 }
 234         }
 235         return (0);
 236 }
 237
 238 int
 239 pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 240     int *nadd, int flags)
 241 {
 242         struct pfr_ktable       *kt, *tmpkt;
 243         struct pfr_kentryworkq   workq;
 244         struct pfr_kentry       *p, *q;
 245         struct pfr_addr          ad;
 246         int                      i, rv, xadd = 0;
 247         long                     tzero = time_second;
 248
 249         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
 250             PFR_FLAG_FEEDBACK);
 251         if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
 252                 return (EINVAL);
 253         kt = pfr_lookup_table(tbl);
 254         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 255                 return (ESRCH);
 256         if (kt->pfrkt_flags & PFR_TFLAG_CONST)
 257                 return (EPERM);
 258         tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0);
 259         if (tmpkt == NULL)
 260                 return (ENOMEM);
 261         SLIST_INIT(&workq);
 262         for (i = 0; i < size; i++) {
 263                 if (COPYIN(addr+i, &ad, sizeof(ad), flags))
 264                         senderr(EFAULT);
 265                 if (pfr_validate_addr(&ad))
 266                         senderr(EINVAL);
 267                 p = pfr_lookup_addr(kt, &ad, 1);
 268                 q = pfr_lookup_addr(tmpkt, &ad, 1);
 269                 if (flags & PFR_FLAG_FEEDBACK) {
 270                         if (q != NULL)
 271                                 ad.pfra_fback = PFR_FB_DUPLICATE;
 272                         else if (p == NULL)
 273                                 ad.pfra_fback = PFR_FB_ADDED;
 274                         else if (p->pfrke_not != ad.pfra_not)
 275                                 ad.pfra_fback = PFR_FB_CONFLICT;
 276                         else
 277                                 ad.pfra_fback = PFR_FB_NONE;
 278                 }
 279                 if (p == NULL && q == NULL) {
 280                         p = pfr_create_kentry(&ad,
 281                             !(flags & PFR_FLAG_USERIOCTL));
 282                         if (p == NULL)
 283                                 senderr(ENOMEM);
 284                         if (pfr_route_kentry(tmpkt, p)) {
 285                                 pfr_destroy_kentry(p);
 286                                 ad.pfra_fback = PFR_FB_NONE;
 287                         } else {
 288                                 SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
 289                                 xadd++;
 290                         }
 291                 }
 292                 if (flags & PFR_FLAG_FEEDBACK)
 293                         if (COPYOUT(&ad, addr+i, sizeof(ad), flags))
 294                                 senderr(EFAULT);
 295         }
 296         pfr_clean_node_mask(tmpkt, &workq);
 297         if (!(flags & PFR_FLAG_DUMMY)) {
 298                 if (flags & PFR_FLAG_ATOMIC)
 299                         crit_enter();
 300                 pfr_insert_kentries(kt, &workq, tzero);
 301                 if (flags & PFR_FLAG_ATOMIC)
 302                         crit_exit();
 303         } else
 304                 pfr_destroy_kentries(&workq);
 305         if (nadd != NULL)
 306                 *nadd = xadd;
 307         pfr_destroy_ktable(tmpkt, 0);
 308         return (0);
 309 _bad:
 310         pfr_clean_node_mask(tmpkt, &workq);
 311         pfr_destroy_kentries(&workq);
 312         if (flags & PFR_FLAG_FEEDBACK)
 313                 pfr_reset_feedback(addr, size, flags);
 314         pfr_destroy_ktable(tmpkt, 0);
 315         return (rv);
 316 }
 317
 318 int
 319 pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 320     int *ndel, int flags)
 321 {
 322         struct pfr_ktable       *kt;
 323         struct pfr_kentryworkq   workq;
 324         struct pfr_kentry       *p;
 325         struct pfr_addr          ad;
 326         int                      i, rv, xdel = 0, log = 1;
 327
 328         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
 329             PFR_FLAG_FEEDBACK);
 330         if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
 331                 return (EINVAL);
 332         kt = pfr_lookup_table(tbl);
 333         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 334                 return (ESRCH);
 335         if (kt->pfrkt_flags & PFR_TFLAG_CONST)
 336                 return (EPERM);
 337         /*
 338          * there are two algorithms to choose from here.
 339          * with:
 340          *   n: number of addresses to delete
 341          *   N: number of addresses in the table
 342          *
 343          * one is O(N) and is better for large 'n'
 344          * one is O(n*LOG(N)) and is better for small 'n'
 345          *
 346          * following code try to decide which one is best.
 347          */
 348         for (i = kt->pfrkt_cnt; i > 0; i >>= 1)
 349                 log++;
 350         if (size > kt->pfrkt_cnt/log) {
 351                 /* full table scan */
 352                 pfr_mark_addrs(kt);
 353         } else {
 354                 /* iterate over addresses to delete */
 355                 for (i = 0; i < size; i++) {
 356                         if (COPYIN(addr+i, &ad, sizeof(ad), flags))
 357                                 return (EFAULT);
 358                         if (pfr_validate_addr(&ad))
 359                                 return (EINVAL);
 360                         p = pfr_lookup_addr(kt, &ad, 1);
 361                         if (p != NULL)
 362                                 p->pfrke_mark = 0;
 363                 }
 364         }
 365         SLIST_INIT(&workq);
 366         for (i = 0; i < size; i++) {
 367                 if (COPYIN(addr+i, &ad, sizeof(ad), flags))
 368                         senderr(EFAULT);
 369                 if (pfr_validate_addr(&ad))
 370                         senderr(EINVAL);
 371                 p = pfr_lookup_addr(kt, &ad, 1);
 372                 if (flags & PFR_FLAG_FEEDBACK) {
 373                         if (p == NULL)
 374                                 ad.pfra_fback = PFR_FB_NONE;
 375                         else if (p->pfrke_not != ad.pfra_not)
 376                                 ad.pfra_fback = PFR_FB_CONFLICT;
 377                         else if (p->pfrke_mark)
 378                                 ad.pfra_fback = PFR_FB_DUPLICATE;
 379                         else
 380                                 ad.pfra_fback = PFR_FB_DELETED;
 381                 }
 382                 if (p != NULL && p->pfrke_not == ad.pfra_not &&
 383                     !p->pfrke_mark) {
 384                         p->pfrke_mark = 1;
 385                         SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
 386                         xdel++;
 387                 }
 388                 if (flags & PFR_FLAG_FEEDBACK)
 389                         if (COPYOUT(&ad, addr+i, sizeof(ad), flags))
 390                                 senderr(EFAULT);
 391         }
 392         if (!(flags & PFR_FLAG_DUMMY)) {
 393                 if (flags & PFR_FLAG_ATOMIC)
 394                         crit_enter();
 395                 pfr_remove_kentries(kt, &workq);
 396                 if (flags & PFR_FLAG_ATOMIC)
 397                         crit_exit();
 398         }
 399         if (ndel != NULL)
 400                 *ndel = xdel;
 401         return (0);
 402 _bad:
 403         if (flags & PFR_FLAG_FEEDBACK)
 404                 pfr_reset_feedback(addr, size, flags);
 405         return (rv);
 406 }
 407
 408 int
 409 pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 410     int *size2, int *nadd, int *ndel, int *nchange, int flags,
 411     u_int32_t ignore_pfrt_flags)
 412 {
 413         struct pfr_ktable       *kt, *tmpkt;
 414         struct pfr_kentryworkq   addq, delq, changeq;
 415         struct pfr_kentry       *p, *q;
 416         struct pfr_addr          ad;
 417         int                      i, rv, xadd = 0, xdel = 0, xchange = 0;
 418         long                     tzero = time_second;
 419
 420         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
 421             PFR_FLAG_FEEDBACK);
 422         if (pfr_validate_table(tbl, ignore_pfrt_flags, flags &
 423             PFR_FLAG_USERIOCTL))
 424                 return (EINVAL);
 425         kt = pfr_lookup_table(tbl);
 426         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 427                 return (ESRCH);
 428         if (kt->pfrkt_flags & PFR_TFLAG_CONST)
 429                 return (EPERM);
 430         tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0);
 431         if (tmpkt == NULL)
 432                 return (ENOMEM);
 433         pfr_mark_addrs(kt);
 434         SLIST_INIT(&addq);
 435         SLIST_INIT(&delq);
 436         SLIST_INIT(&changeq);
 437         for (i = 0; i < size; i++) {
 438                 if (COPYIN(addr+i, &ad, sizeof(ad), flags))
 439                         senderr(EFAULT);
 440                 if (pfr_validate_addr(&ad))
 441                         senderr(EINVAL);
 442                 ad.pfra_fback = PFR_FB_NONE;
 443                 p = pfr_lookup_addr(kt, &ad, 1);
 444                 if (p != NULL) {
 445                         if (p->pfrke_mark) {
 446                                 ad.pfra_fback = PFR_FB_DUPLICATE;
 447                                 goto _skip;
 448                         }
 449                         p->pfrke_mark = 1;
 450                         if (p->pfrke_not != ad.pfra_not) {
 451                                 SLIST_INSERT_HEAD(&changeq, p, pfrke_workq);
 452                                 ad.pfra_fback = PFR_FB_CHANGED;
 453                                 xchange++;
 454                         }
 455                 } else {
 456                         q = pfr_lookup_addr(tmpkt, &ad, 1);
 457                         if (q != NULL) {
 458                                 ad.pfra_fback = PFR_FB_DUPLICATE;
 459                                 goto _skip;
 460                         }
 461                         p = pfr_create_kentry(&ad,
 462                             !(flags & PFR_FLAG_USERIOCTL));
 463                         if (p == NULL)
 464                                 senderr(ENOMEM);
 465                         if (pfr_route_kentry(tmpkt, p)) {
 466                                 pfr_destroy_kentry(p);
 467                                 ad.pfra_fback = PFR_FB_NONE;
 468                         } else {
 469                                 SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
 470                                 ad.pfra_fback = PFR_FB_ADDED;
 471                                 xadd++;
 472                         }
 473                 }
 474 _skip:
 475                 if (flags & PFR_FLAG_FEEDBACK)
 476                         if (COPYOUT(&ad, addr+i, sizeof(ad), flags))
 477                                 senderr(EFAULT);
 478         }
 479         pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY);
 480         if ((flags & PFR_FLAG_FEEDBACK) && *size2) {
 481                 if (*size2 < size+xdel) {
 482                         *size2 = size+xdel;
 483                         senderr(0);
 484                 }
 485                 i = 0;
 486                 SLIST_FOREACH(p, &delq, pfrke_workq) {
 487                         pfr_copyout_addr(&ad, p);
 488                         ad.pfra_fback = PFR_FB_DELETED;
 489                         if (COPYOUT(&ad, addr+size+i, sizeof(ad), flags))
 490                                 senderr(EFAULT);
 491                         i++;
 492                 }
 493         }
 494         pfr_clean_node_mask(tmpkt, &addq);
 495         if (!(flags & PFR_FLAG_DUMMY)) {
 496                 if (flags & PFR_FLAG_ATOMIC)
 497                         crit_enter();
 498                 pfr_insert_kentries(kt, &addq, tzero);
 499                 pfr_remove_kentries(kt, &delq);
 500                 pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
 501                 if (flags & PFR_FLAG_ATOMIC)
 502                         crit_exit();
 503         } else
 504                 pfr_destroy_kentries(&addq);
 505         if (nadd != NULL)
 506                 *nadd = xadd;
 507         if (ndel != NULL)
 508                 *ndel = xdel;
 509         if (nchange != NULL)
 510                 *nchange = xchange;
 511         if ((flags & PFR_FLAG_FEEDBACK) && size2)
 512                 *size2 = size+xdel;
 513         pfr_destroy_ktable(tmpkt, 0);
 514         return (0);
 515 _bad:
 516         pfr_clean_node_mask(tmpkt, &addq);
 517         pfr_destroy_kentries(&addq);
 518         if (flags & PFR_FLAG_FEEDBACK)
 519                 pfr_reset_feedback(addr, size, flags);
 520         pfr_destroy_ktable(tmpkt, 0);
 521         return (rv);
 522 }
 523
 524 int
 525 pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 526         int *nmatch, int flags)
 527 {
 528         struct pfr_ktable       *kt;
 529         struct pfr_kentry       *p;
 530         struct pfr_addr          ad;
 531         int                      i, xmatch = 0;
 532
 533         ACCEPT_FLAGS(flags, PFR_FLAG_REPLACE);
 534         if (pfr_validate_table(tbl, 0, 0))
 535                 return (EINVAL);
 536         kt = pfr_lookup_table(tbl);
 537         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 538                 return (ESRCH);
 539
 540         for (i = 0; i < size; i++) {
 541                 if (COPYIN(addr+i, &ad, sizeof(ad), flags))
 542                         return (EFAULT);
 543                 if (pfr_validate_addr(&ad))
 544                         return (EINVAL);
 545                 if (ADDR_NETWORK(&ad))
 546                         return (EINVAL);
 547                 p = pfr_lookup_addr(kt, &ad, 0);
 548                 if (flags & PFR_FLAG_REPLACE)
 549                         pfr_copyout_addr(&ad, p);
 550                 ad.pfra_fback = (p == NULL) ? PFR_FB_NONE :
 551                     (p->pfrke_not ? PFR_FB_NOTMATCH : PFR_FB_MATCH);
 552                 if (p != NULL && !p->pfrke_not)
 553                         xmatch++;
 554                 if (COPYOUT(&ad, addr+i, sizeof(ad), flags))
 555                         return (EFAULT);
 556         }
 557         if (nmatch != NULL)
 558                 *nmatch = xmatch;
 559         return (0);
 560 }
 561
 562 int
 563 pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size,
 564         int flags)
 565 {
 566         struct pfr_ktable       *kt;
 567         struct pfr_walktree      w;
 568         int                      rv;
 569
 570         ACCEPT_FLAGS(flags, 0);
 571         if (pfr_validate_table(tbl, 0, 0))
 572                 return (EINVAL);
 573         kt = pfr_lookup_table(tbl);
 574         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 575                 return (ESRCH);
 576         if (kt->pfrkt_cnt > *size) {
 577                 *size = kt->pfrkt_cnt;
 578                 return (0);
 579         }
 580
 581         bzero(&w, sizeof(w));
 582         w.pfrw_op = PFRW_GET_ADDRS;
 583         w.pfrw_addr = addr;
 584         w.pfrw_free = kt->pfrkt_cnt;
 585         w.pfrw_flags = flags;
 586         rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
 587         if (!rv)
 588                 rv = kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
 589         if (rv)
 590                 return (rv);
 591
 592         if (w.pfrw_free) {
 593                 kprintf("pfr_get_addrs: corruption detected (%d).\n",
 594                     w.pfrw_free);
 595                 return (ENOTTY);
 596         }
 597         *size = kt->pfrkt_cnt;
 598         return (0);
 599 }
 600
 601 int
 602 pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size,
 603         int flags)
 604 {
 605         struct pfr_ktable       *kt;
 606         struct pfr_walktree      w;
 607         struct pfr_kentryworkq   workq;
 608         int                      rv;
 609         long                     tzero = time_second;
 610
 611         /* XXX PFR_FLAG_CLSTATS disabled */
 612         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC);
 613         if (pfr_validate_table(tbl, 0, 0))
 614                 return (EINVAL);
 615         kt = pfr_lookup_table(tbl);
 616         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 617                 return (ESRCH);
 618         if (kt->pfrkt_cnt > *size) {
 619                 *size = kt->pfrkt_cnt;
 620                 return (0);
 621         }
 622
 623         bzero(&w, sizeof(w));
 624         w.pfrw_op = PFRW_GET_ASTATS;
 625         w.pfrw_astats = addr;
 626         w.pfrw_free = kt->pfrkt_cnt;
 627         w.pfrw_flags = flags;
 628         if (flags & PFR_FLAG_ATOMIC)
 629                 crit_enter();
 630         rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
 631         if (!rv)
 632                 rv = kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
 633         if (!rv && (flags & PFR_FLAG_CLSTATS)) {
 634                 pfr_enqueue_addrs(kt, &workq, NULL, 0);
 635                 pfr_clstats_kentries(&workq, tzero, 0);
 636         }
 637         if (flags & PFR_FLAG_ATOMIC)
 638                 crit_exit();
 639         if (rv)
 640                 return (rv);
 641
 642         if (w.pfrw_free) {
 643                 kprintf("pfr_get_astats: corruption detected (%d).\n",
 644                     w.pfrw_free);
 645                 return (ENOTTY);
 646         }
 647         *size = kt->pfrkt_cnt;
 648         return (0);
 649 }
 650
 651 int
 652 pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 653     int *nzero, int flags)
 654 {
 655         struct pfr_ktable       *kt;
 656         struct pfr_kentryworkq   workq;
 657         struct pfr_kentry       *p;
 658         struct pfr_addr          ad;
 659         int                      i, rv, xzero = 0;
 660
 661         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
 662             PFR_FLAG_FEEDBACK);
 663         if (pfr_validate_table(tbl, 0, 0))
 664                 return (EINVAL);
 665         kt = pfr_lookup_table(tbl);
 666         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 667                 return (ESRCH);
 668         SLIST_INIT(&workq);
 669         for (i = 0; i < size; i++) {
 670                 if (COPYIN(addr+i, &ad, sizeof(ad), flags))
 671                         senderr(EFAULT);
 672                 if (pfr_validate_addr(&ad))
 673                         senderr(EINVAL);
 674                 p = pfr_lookup_addr(kt, &ad, 1);
 675                 if (flags & PFR_FLAG_FEEDBACK) {
 676                         ad.pfra_fback = (p != NULL) ?
 677                             PFR_FB_CLEARED : PFR_FB_NONE;
 678                         if (COPYOUT(&ad, addr+i, sizeof(ad), flags))
 679                                 senderr(EFAULT);
 680                 }
 681                 if (p != NULL) {
 682                         SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
 683                         xzero++;
 684                 }
 685         }
 686
 687         if (!(flags & PFR_FLAG_DUMMY)) {
 688                 if (flags & PFR_FLAG_ATOMIC)
 689                         crit_enter();
 690                 pfr_clstats_kentries(&workq, 0, 0);
 691                 if (flags & PFR_FLAG_ATOMIC)
 692                         crit_exit();
 693         }
 694         if (nzero != NULL)
 695                 *nzero = xzero;
 696         return (0);
 697 _bad:
 698         if (flags & PFR_FLAG_FEEDBACK)
 699                 pfr_reset_feedback(addr, size, flags);
 700         return (rv);
 701 }
 702
 703 int
 704 pfr_validate_addr(struct pfr_addr *ad)
 705 {
 706         int i;
 707
 708         switch (ad->pfra_af) {
 709 #ifdef INET
 710         case AF_INET:
 711                 if (ad->pfra_net > 32)
 712                         return (-1);
 713                 break;
 714 #endif /* INET */
 715 #ifdef INET6
 716         case AF_INET6:
 717                 if (ad->pfra_net > 128)
 718                         return (-1);
 719                 break;
 720 #endif /* INET6 */
 721         default:
 722                 return (-1);
 723         }
 724         if (ad->pfra_net < 128 &&
 725                 (((caddr_t)ad)[ad->pfra_net/8] & (0xFF >> (ad->pfra_net%8))))
 726                         return (-1);
 727         for (i = (ad->pfra_net+7)/8; i < sizeof(ad->pfra_u); i++)
 728                 if (((caddr_t)ad)[i])
 729                         return (-1);
 730         if (ad->pfra_not && ad->pfra_not != 1)
 731                 return (-1);
 732         if (ad->pfra_fback)
 733                 return (-1);
 734         return (0);
 735 }
 736
 737 void
 738 pfr_enqueue_addrs(struct pfr_ktable *kt, struct pfr_kentryworkq *workq,
 739         int *naddr, int sweep)
 740 {
 741         struct pfr_walktree     w;
 742
 743         SLIST_INIT(workq);
 744         bzero(&w, sizeof(w));
 745         w.pfrw_op = sweep ? PFRW_SWEEP : PFRW_ENQUEUE;
 746         w.pfrw_workq = workq;
 747         if (kt->pfrkt_ip4 != NULL)
 748                 if (kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w))
 749                         kprintf("pfr_enqueue_addrs: IPv4 walktree failed.\n");
 750         if (kt->pfrkt_ip6 != NULL)
 751                 if (kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w))
 752                         kprintf("pfr_enqueue_addrs: IPv6 walktree failed.\n");
 753         if (naddr != NULL)
 754                 *naddr = w.pfrw_cnt;
 755 }
 756
 757 void
 758 pfr_mark_addrs(struct pfr_ktable *kt)
 759 {
 760         struct pfr_walktree     w;
 761
 762         bzero(&w, sizeof(w));
 763         w.pfrw_op = PFRW_MARK;
 764         if (kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w))
 765                 kprintf("pfr_mark_addrs: IPv4 walktree failed.\n");
 766         if (kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w))
 767                 kprintf("pfr_mark_addrs: IPv6 walktree failed.\n");
 768 }
 769
 770
 771 struct pfr_kentry *
 772 pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact)
 773 {
 774         union sockaddr_union     sa, mask;
 775         struct radix_node_head  *head = NULL;
 776         struct pfr_kentry       *ke;
 777
 778         bzero(&sa, sizeof(sa));
 779         if (ad->pfra_af == AF_INET) {
 780                 FILLIN_SIN(sa.sin, ad->pfra_ip4addr);
 781                 head = kt->pfrkt_ip4;
 782         } else if ( ad->pfra_af == AF_INET6 ) {
 783                 FILLIN_SIN6(sa.sin6, ad->pfra_ip6addr);
 784                 head = kt->pfrkt_ip6;
 785         }
 786         if (ADDR_NETWORK(ad)) {
 787                 pfr_prepare_network(&mask, ad->pfra_af, ad->pfra_net);
 788                 crit_enter(); /* rn_lookup makes use of globals */
 789                 ke = (struct pfr_kentry *)rn_lookup((char *)&sa, (char *)&mask,
 790                     head);
 791                 crit_exit();
 792                 if (ke && KENTRY_RNF_ROOT(ke))
 793                         ke = NULL;
 794         } else {
 795                 ke = (struct pfr_kentry *)rn_match((char *)&sa, head);
 796                 if (ke && KENTRY_RNF_ROOT(ke))
 797                         ke = NULL;
 798                 if (exact && ke && KENTRY_NETWORK(ke))
 799                         ke = NULL;
 800         }
 801         return (ke);
 802 }
 803
 804 struct pfr_kentry *
 805 pfr_create_kentry(struct pfr_addr *ad, int intr)
 806 {
 807         struct pfr_kentry       *ke;
 808
 809         if (intr)
 810                 ke = pool_get(&pfr_kentry_pl2, PR_NOWAIT | PR_ZERO);
 811         else
 812                 ke = pool_get(&pfr_kentry_pl, PR_NOWAIT|PR_ZERO|PR_LIMITFAIL);
 813         if (ke == NULL)
 814                 return (NULL);
 815
 816         if (ad->pfra_af == AF_INET)
 817                 FILLIN_SIN(ke->pfrke_sa.sin, ad->pfra_ip4addr);
 818         else if (ad->pfra_af == AF_INET6)
 819                 FILLIN_SIN6(ke->pfrke_sa.sin6, ad->pfra_ip6addr);
 820         ke->pfrke_af = ad->pfra_af;
 821         ke->pfrke_net = ad->pfra_net;
 822         ke->pfrke_not = ad->pfra_not;
 823         ke->pfrke_intrpool = intr;
 824         return (ke);
 825 }
 826
 827 void
 828 pfr_destroy_kentries(struct pfr_kentryworkq *workq)
 829 {
 830         struct pfr_kentry       *p, *q;
 831
 832         for (p = SLIST_FIRST(workq); p != NULL; p = q) {
 833                 q = SLIST_NEXT(p, pfrke_workq);
 834                 pfr_destroy_kentry(p);
 835         }
 836 }
 837
 838 void
 839 pfr_destroy_kentry(struct pfr_kentry *ke)
 840 {
 841         if (ke->pfrke_counters)
 842                 pool_put(&pfr_kcounters_pl, ke->pfrke_counters);
 843         if (ke->pfrke_intrpool)
 844                 pool_put(&pfr_kentry_pl2, ke);
 845         else
 846                 pool_put(&pfr_kentry_pl, ke);
 847 }
 848
 849 void
 850 pfr_insert_kentries(struct pfr_ktable *kt,
 851     struct pfr_kentryworkq *workq, long tzero)
 852 {
 853         struct pfr_kentry       *p;
 854         int                      rv, n = 0;
 855
 856         SLIST_FOREACH(p, workq, pfrke_workq) {
 857                 rv = pfr_route_kentry(kt, p);
 858                 if (rv) {
 859                         kprintf("pfr_insert_kentries: cannot route entry "
 860                             "(code=%d).\n", rv);
 861                         break;
 862                 }
 863                 p->pfrke_tzero = tzero;
 864                 n++;
 865         }
 866         kt->pfrkt_cnt += n;
 867 }
 868
 869 int
 870 pfr_insert_kentry(struct pfr_ktable *kt, struct pfr_addr *ad, long tzero)
 871 {
 872         struct pfr_kentry       *p;
 873         int                      rv;
 874
 875         p = pfr_lookup_addr(kt, ad, 1);
 876         if (p != NULL)
 877                 return (0);
 878         p = pfr_create_kentry(ad, 1);
 879         if (p == NULL)
 880                 return (EINVAL);
 881
 882         rv = pfr_route_kentry(kt, p);
 883         if (rv)
 884                 return (rv);
 885
 886         p->pfrke_tzero = tzero;
 887         kt->pfrkt_cnt++;
 888
 889         return (0);
 890 }
 891
 892 void
 893 pfr_remove_kentries(struct pfr_ktable *kt,
 894     struct pfr_kentryworkq *workq)
 895 {
 896         struct pfr_kentry       *p;
 897         int                      n = 0;
 898
 899         SLIST_FOREACH(p, workq, pfrke_workq) {
 900                 pfr_unroute_kentry(kt, p);
 901                 n++;
 902         }
 903         kt->pfrkt_cnt -= n;
 904         pfr_destroy_kentries(workq);
 905 }
 906
 907 void
 908 pfr_clean_node_mask(struct pfr_ktable *kt,
 909     struct pfr_kentryworkq *workq)
 910 {
 911         struct pfr_kentry       *p;
 912
 913         SLIST_FOREACH(p, workq, pfrke_workq)
 914                 pfr_unroute_kentry(kt, p);
 915 }
 916
 917 void
 918 pfr_clstats_kentries(struct pfr_kentryworkq *workq, long tzero, int negchange)
 919 {
 920         struct pfr_kentry       *p;
 921
 922         SLIST_FOREACH(p, workq, pfrke_workq) {
 923                 crit_enter();
 924                 if (negchange)
 925                         p->pfrke_not = !p->pfrke_not;
 926                 if (p->pfrke_counters) {
 927                         pool_put(&pfr_kcounters_pl, p->pfrke_counters);
 928                         p->pfrke_counters = NULL;
 929                 }
 930                 crit_exit();
 931                 p->pfrke_tzero = tzero;
 932         }
 933 }
 934
 935 void
 936 pfr_reset_feedback(struct pfr_addr *addr, int size, int flags)
 937 {
 938         struct pfr_addr ad;
 939         int             i;
 940
 941         for (i = 0; i < size; i++) {
 942                 if (COPYIN(addr+i, &ad, sizeof(ad), flags))
 943                         break;
 944                 ad.pfra_fback = PFR_FB_NONE;
 945                 if (COPYOUT(&ad, addr+i, sizeof(ad), flags))
 946                         break;
 947         }
 948 }
 949
 950 void
 951 pfr_prepare_network(union sockaddr_union *sa, int af, int net)
 952 {
 953         int     i;
 954
 955         bzero(sa, sizeof(*sa));
 956         if (af == AF_INET) {
 957                 sa->sin.sin_len = sizeof(sa->sin);
 958                 sa->sin.sin_family = AF_INET;
 959                 sa->sin.sin_addr.s_addr = net ? htonl(-1 << (32-net)) : 0;
 960         } else if (af == AF_INET6) {
 961                 sa->sin6.sin6_len = sizeof(sa->sin6);
 962                 sa->sin6.sin6_family = AF_INET6;
 963                 for (i = 0; i < 4; i++) {
 964                         if (net <= 32) {
 965                                 sa->sin6.sin6_addr.s6_addr32[i] =
 966                                     net ? htonl(-1 << (32-net)) : 0;
 967                                 break;
 968                         }
 969                         sa->sin6.sin6_addr.s6_addr32[i] = 0xFFFFFFFF;
 970                         net -= 32;
 971                 }
 972         }
 973 }
 974
 975 int
 976 pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
 977 {
 978         union sockaddr_union     mask;
 979         struct radix_node       *rn;
 980         struct radix_node_head  *head = NULL;
 981
 982         bzero(ke->pfrke_node, sizeof(ke->pfrke_node));
 983         if (ke->pfrke_af == AF_INET)
 984                 head = kt->pfrkt_ip4;
 985         else if (ke->pfrke_af == AF_INET6)
 986                 head = kt->pfrkt_ip6;
 987
 988         crit_enter();
 989         if (KENTRY_NETWORK(ke)) {
 990                 pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
 991                 rn = rn_addroute((char *)&ke->pfrke_sa, (char *)&mask, head,
 992                     ke->pfrke_node);
 993         } else
 994                 rn = rn_addroute((char *)&ke->pfrke_sa, NULL, head,
 995                     ke->pfrke_node);
 996         crit_exit();
 997
 998         return (rn == NULL ? -1 : 0);
 999 }
1000
1001 int
1002 pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
1003 {
1004         union sockaddr_union     mask;
1005         struct radix_node       *rn;
1006         struct radix_node_head  *head = NULL;
1007
1008         if (ke->pfrke_af == AF_INET)
1009                 head = kt->pfrkt_ip4;
1010         else if (ke->pfrke_af == AF_INET6)
1011                 head = kt->pfrkt_ip6;
1012
1013         crit_enter();
1014         if (KENTRY_NETWORK(ke)) {
1015                 pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
1016                 rn = rn_delete((char *)&ke->pfrke_sa, (char *)&mask, head);
1017         } else
1018                 rn = rn_delete((char *)&ke->pfrke_sa, NULL, head);
1019         crit_exit();
1020
1021         if (rn == NULL) {
1022                 kprintf("pfr_unroute_kentry: delete failed.\n");
1023                 return (-1);
1024         }
1025         return (0);
1026 }
1027
1028 void
1029 pfr_copyout_addr(struct pfr_addr *ad, struct pfr_kentry *ke)
1030 {
1031         bzero(ad, sizeof(*ad));
1032         if (ke == NULL)
1033                 return;
1034         ad->pfra_af = ke->pfrke_af;
1035         ad->pfra_net = ke->pfrke_net;
1036         ad->pfra_not = ke->pfrke_not;
1037         if (ad->pfra_af == AF_INET)
1038                 ad->pfra_ip4addr = ke->pfrke_sa.sin.sin_addr;
1039         else if (ad->pfra_af == AF_INET6)
1040                 ad->pfra_ip6addr = ke->pfrke_sa.sin6.sin6_addr;
1041 }
1042
1043 int
1044 pfr_walktree(struct radix_node *rn, void *arg)
1045 {
1046         struct pfr_kentry       *ke = (struct pfr_kentry *)rn;
1047         struct pfr_walktree     *w = arg;
1048         int                     flags = w->pfrw_flags;
1049
1050         switch (w->pfrw_op) {
1051         case PFRW_MARK:
1052                 ke->pfrke_mark = 0;
1053                 break;
1054         case PFRW_SWEEP:
1055                 if (ke->pfrke_mark)
1056                         break;
1057                 /* FALLTHROUGH */
1058         case PFRW_ENQUEUE:
1059                 SLIST_INSERT_HEAD(w->pfrw_workq, ke, pfrke_workq);
1060                 w->pfrw_cnt++;
1061                 break;
1062         case PFRW_GET_ADDRS:
1063                 if (w->pfrw_free-- > 0) {
1064                         struct pfr_addr ad;
1065
1066                         pfr_copyout_addr(&ad, ke);
1067                         if (copyout(&ad, w->pfrw_addr, sizeof(ad)))
1068                                 return (EFAULT);
1069                         w->pfrw_addr++;
1070                 }
1071                 break;
1072         case PFRW_GET_ASTATS:
1073                 if (w->pfrw_free-- > 0) {
1074                         struct pfr_astats as;
1075
1076                         pfr_copyout_addr(&as.pfras_a, ke);
1077
1078                         crit_enter();
1079                         if (ke->pfrke_counters) {
1080                                 bcopy(ke->pfrke_counters->pfrkc_packets,
1081                                     as.pfras_packets, sizeof(as.pfras_packets));
1082                                 bcopy(ke->pfrke_counters->pfrkc_bytes,
1083                                     as.pfras_bytes, sizeof(as.pfras_bytes));
1084                         } else {
1085                                 bzero(as.pfras_packets, sizeof(as.pfras_packets));
1086                                 bzero(as.pfras_bytes, sizeof(as.pfras_bytes));
1087                                 as.pfras_a.pfra_fback = PFR_FB_NOCOUNT;
1088                         }
1089                         crit_exit();
1090                         as.pfras_tzero = ke->pfrke_tzero;
1091
1092                         if (COPYOUT(&as, w->pfrw_astats, sizeof(as), flags))
1093                                 return (EFAULT);
1094                         w->pfrw_astats++;
1095                 }
1096                 break;
1097         case PFRW_POOL_GET:
1098                 if (ke->pfrke_not)
1099                         break; /* negative entries are ignored */
1100                 if (!w->pfrw_cnt--) {
1101                         w->pfrw_kentry = ke;
1102                         return (1); /* finish search */
1103                 }
1104                 break;
1105         case PFRW_DYNADDR_UPDATE:
1106                 if (ke->pfrke_af == AF_INET) {
1107                         if (w->pfrw_dyn->pfid_acnt4++ > 0)
1108                                 break;
1109                         pfr_prepare_network(&pfr_mask, AF_INET, ke->pfrke_net);
1110                         w->pfrw_dyn->pfid_addr4 = *SUNION2PF(
1111                             &ke->pfrke_sa, AF_INET);
1112                         w->pfrw_dyn->pfid_mask4 = *SUNION2PF(
1113                             &pfr_mask, AF_INET);
1114                 } else if (ke->pfrke_af == AF_INET6){
1115                         if (w->pfrw_dyn->pfid_acnt6++ > 0)
1116                                 break;
1117                         pfr_prepare_network(&pfr_mask, AF_INET6, ke->pfrke_net);
1118                         w->pfrw_dyn->pfid_addr6 = *SUNION2PF(
1119                             &ke->pfrke_sa, AF_INET6);
1120                         w->pfrw_dyn->pfid_mask6 = *SUNION2PF(
1121                             &pfr_mask, AF_INET6);
1122                 }
1123                 break;
1124         }
1125         return (0);
1126 }
1127
1128 int
1129 pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags)
1130 {
1131         struct pfr_ktableworkq   workq;
1132         struct pfr_ktable       *p;
1133         int                      xdel = 0;
1134
1135         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
1136             PFR_FLAG_ALLRSETS);
1137         if (pfr_fix_anchor(filter->pfrt_anchor))
1138                 return (EINVAL);
1139         if (pfr_table_count(filter, flags) < 0)
1140                 return (ENOENT);
1141
1142         SLIST_INIT(&workq);
1143         RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1144                 if (pfr_skip_table(filter, p, flags))
1145                         continue;
1146                 if (!strcmp(p->pfrkt_anchor, PF_RESERVED_ANCHOR))
1147                         continue;
1148                 if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE))
1149                         continue;
1150                 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1151                 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1152                 xdel++;
1153         }
1154         if (!(flags & PFR_FLAG_DUMMY)) {
1155                 if (flags & PFR_FLAG_ATOMIC)
1156                         crit_enter();
1157                 pfr_setflags_ktables(&workq);
1158                 if (flags & PFR_FLAG_ATOMIC)
1159                         crit_exit();
1160         }
1161         if (ndel != NULL)
1162                 *ndel = xdel;
1163         return (0);
1164 }
1165
1166 int
1167 pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags)
1168 {
1169         struct pfr_ktableworkq   addq, changeq;
1170         struct pfr_ktable       *p, *q, *r, key;
1171         int                      i, rv, xadd = 0;
1172         long                     tzero = time_second;
1173
1174         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
1175         SLIST_INIT(&addq);
1176         SLIST_INIT(&changeq);
1177         for (i = 0; i < size; i++) {
1178                 if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t), flags))
1179                         senderr(EFAULT);
1180                 if (pfr_validate_table(&key.pfrkt_t, PFR_TFLAG_USRMASK,
1181                     flags & PFR_FLAG_USERIOCTL))
1182                         senderr(EINVAL);
1183                 key.pfrkt_flags |= PFR_TFLAG_ACTIVE;
1184                 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1185                 if (p == NULL) {
1186                         p = pfr_create_ktable(&key.pfrkt_t, tzero, 1);
1187                         if (p == NULL)
1188                                 senderr(ENOMEM);
1189                         SLIST_FOREACH(q, &addq, pfrkt_workq) {
1190                                 if (!pfr_ktable_compare(p, q))
1191                                         goto _skip;
1192                         }
1193                         SLIST_INSERT_HEAD(&addq, p, pfrkt_workq);
1194                         xadd++;
1195                         if (!key.pfrkt_anchor[0])
1196                                 goto _skip;
1197
1198                         /* find or create root table */
1199                         bzero(key.pfrkt_anchor, sizeof(key.pfrkt_anchor));
1200                         r = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1201                         if (r != NULL) {
1202                                 p->pfrkt_root = r;
1203                                 goto _skip;
1204                         }
1205                         SLIST_FOREACH(q, &addq, pfrkt_workq) {
1206                                 if (!pfr_ktable_compare(&key, q)) {
1207                                         p->pfrkt_root = q;
1208                                         goto _skip;
1209                                 }
1210                         }
1211                         key.pfrkt_flags = 0;
1212                         r = pfr_create_ktable(&key.pfrkt_t, 0, 1);
1213                         if (r == NULL)
1214                                 senderr(ENOMEM);
1215                         SLIST_INSERT_HEAD(&addq, r, pfrkt_workq);
1216                         p->pfrkt_root = r;
1217                 } else if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1218                         SLIST_FOREACH(q, &changeq, pfrkt_workq)
1219                                 if (!pfr_ktable_compare(&key, q))
1220                                         goto _skip;
1221                         p->pfrkt_nflags = (p->pfrkt_flags &
1222                             ~PFR_TFLAG_USRMASK) | key.pfrkt_flags;
1223                         SLIST_INSERT_HEAD(&changeq, p, pfrkt_workq);
1224                         xadd++;
1225                 }
1226 _skip:
1227         ;
1228         }
1229         if (!(flags & PFR_FLAG_DUMMY)) {
1230                 if (flags & PFR_FLAG_ATOMIC)
1231                         crit_enter();
1232                 pfr_insert_ktables(&addq);
1233                 pfr_setflags_ktables(&changeq);
1234                 if (flags & PFR_FLAG_ATOMIC)
1235                         crit_exit();
1236         } else
1237                  pfr_destroy_ktables(&addq, 0);
1238         if (nadd != NULL)
1239                 *nadd = xadd;
1240         return (0);
1241 _bad:
1242         pfr_destroy_ktables(&addq, 0);
1243         return (rv);
1244 }
1245
1246 int
1247 pfr_del_tables(struct pfr_table *tbl, int size, int *ndel, int flags)
1248 {
1249         struct pfr_ktableworkq   workq;
1250         struct pfr_ktable       *p, *q, key;
1251         int                      i, xdel = 0;
1252
1253         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
1254         SLIST_INIT(&workq);
1255         for (i = 0; i < size; i++) {
1256                 if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t), flags))
1257                         return (EFAULT);
1258                 if (pfr_validate_table(&key.pfrkt_t, 0,
1259                     flags & PFR_FLAG_USERIOCTL))
1260                         return (EINVAL);
1261                 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1262                 if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1263                         SLIST_FOREACH(q, &workq, pfrkt_workq)
1264                                 if (!pfr_ktable_compare(p, q))
1265                                         goto _skip;
1266                         p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1267                         SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1268                         xdel++;
1269                 }
1270 _skip:
1271         ;
1272         }
1273
1274         if (!(flags & PFR_FLAG_DUMMY)) {
1275                 if (flags & PFR_FLAG_ATOMIC)
1276                         crit_enter();
1277                 pfr_setflags_ktables(&workq);
1278                 if (flags & PFR_FLAG_ATOMIC)
1279                         crit_exit();
1280         }
1281         if (ndel != NULL)
1282                 *ndel = xdel;
1283         return (0);
1284 }
1285
1286 int
1287 pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size,
1288         int flags)
1289 {
1290         struct pfr_ktable       *p;
1291         int                      n, nn;
1292
1293         ACCEPT_FLAGS(flags, PFR_FLAG_ALLRSETS);
1294         if (pfr_fix_anchor(filter->pfrt_anchor))
1295                 return (EINVAL);
1296         n = nn = pfr_table_count(filter, flags);
1297         if (n < 0)
1298                 return (ENOENT);
1299         if (n > *size) {
1300                 *size = n;
1301                 return (0);
1302         }
1303         RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1304                 if (pfr_skip_table(filter, p, flags))
1305                         continue;
1306                 if (n-- <= 0)
1307                         continue;
1308                 if (COPYOUT(&p->pfrkt_t, tbl++, sizeof(*tbl), flags))
1309                         return (EFAULT);
1310         }
1311         if (n) {
1312                 kprintf("pfr_get_tables: corruption detected (%d).\n", n);
1313                 return (ENOTTY);
1314         }
1315         *size = nn;
1316         return (0);
1317 }
1318
1319 int
1320 pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size,
1321         int flags)
1322 {
1323         struct pfr_ktable       *p;
1324         struct pfr_ktableworkq   workq;
1325         int                      n, nn;
1326         long                     tzero = time_second;
1327
1328         /* XXX PFR_FLAG_CLSTATS disabled */
1329         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_ALLRSETS);
1330         if (pfr_fix_anchor(filter->pfrt_anchor))
1331                 return (EINVAL);
1332         n = nn = pfr_table_count(filter, flags);
1333         if (n < 0)
1334                 return (ENOENT);
1335         if (n > *size) {
1336                 *size = n;
1337                 return (0);
1338         }
1339         SLIST_INIT(&workq);
1340         if (flags & PFR_FLAG_ATOMIC)
1341                 crit_enter();
1342         RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1343                 if (pfr_skip_table(filter, p, flags))
1344                         continue;
1345                 if (n-- <= 0)
1346                         continue;
1347                 if (!(flags & PFR_FLAG_ATOMIC))
1348                         crit_enter();
1349                 if (COPYOUT(&p->pfrkt_ts, tbl++, sizeof(*tbl), flags)) {
1350                         crit_exit();
1351                         return (EFAULT);
1352                 }
1353                 if (!(flags & PFR_FLAG_ATOMIC))
1354                         crit_exit();
1355                 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1356         }
1357         if (flags & PFR_FLAG_CLSTATS)
1358                 pfr_clstats_ktables(&workq, tzero,
1359                     flags & PFR_FLAG_ADDRSTOO);
1360         if (flags & PFR_FLAG_ATOMIC)
1361                 crit_exit();
1362         if (n) {
1363                 kprintf("pfr_get_tstats: corruption detected (%d).\n", n);
1364                 return (ENOTTY);
1365         }
1366         *size = nn;
1367         return (0);
1368 }
1369
1370 int
1371 pfr_clr_tstats(struct pfr_table *tbl, int size, int *nzero, int flags)
1372 {
1373         struct pfr_ktableworkq   workq;
1374         struct pfr_ktable       *p, key;
1375         int                      i, xzero = 0;
1376         long                     tzero = time_second;
1377
1378         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
1379             PFR_FLAG_ADDRSTOO);
1380         SLIST_INIT(&workq);
1381         for (i = 0; i < size; i++) {
1382                 if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t), flags))
1383                         return (EFAULT);
1384                 if (pfr_validate_table(&key.pfrkt_t, 0, 0))
1385                         return (EINVAL);
1386                 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1387                 if (p != NULL) {
1388                         SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1389                         xzero++;
1390                 }
1391         }
1392         if (!(flags & PFR_FLAG_DUMMY)) {
1393                 if (flags & PFR_FLAG_ATOMIC)
1394                         crit_enter();
1395                 pfr_clstats_ktables(&workq, tzero, flags & PFR_FLAG_ADDRSTOO);
1396                 if (flags & PFR_FLAG_ATOMIC)
1397                         crit_exit();
1398         }
1399         if (nzero != NULL)
1400                 *nzero = xzero;
1401         return (0);
1402 }
1403
1404 int
1405 pfr_set_tflags(struct pfr_table *tbl, int size, int setflag, int clrflag,
1406         int *nchange, int *ndel, int flags)
1407 {
1408         struct pfr_ktableworkq   workq;
1409         struct pfr_ktable       *p, *q, key;
1410         int                      i, xchange = 0, xdel = 0;
1411
1412         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
1413         if ((setflag & ~PFR_TFLAG_USRMASK) ||
1414             (clrflag & ~PFR_TFLAG_USRMASK) ||
1415             (setflag & clrflag))
1416                 return (EINVAL);
1417         SLIST_INIT(&workq);
1418         for (i = 0; i < size; i++) {
1419                 if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t), flags))
1420                         return (EFAULT);
1421                 if (pfr_validate_table(&key.pfrkt_t, 0,
1422                     flags & PFR_FLAG_USERIOCTL))
1423                         return (EINVAL);
1424                 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1425                 if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1426                         p->pfrkt_nflags = (p->pfrkt_flags | setflag) &
1427                             ~clrflag;
1428                         if (p->pfrkt_nflags == p->pfrkt_flags)
1429                                 goto _skip;
1430                         SLIST_FOREACH(q, &workq, pfrkt_workq)
1431                                 if (!pfr_ktable_compare(p, q))
1432                                         goto _skip;
1433                         SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1434                         if ((p->pfrkt_flags & PFR_TFLAG_PERSIST) &&
1435                             (clrflag & PFR_TFLAG_PERSIST) &&
1436                             !(p->pfrkt_flags & PFR_TFLAG_REFERENCED))
1437                                 xdel++;
1438                         else
1439                                 xchange++;
1440                 }
1441 _skip:
1442         ;
1443         }
1444         if (!(flags & PFR_FLAG_DUMMY)) {
1445                 if (flags & PFR_FLAG_ATOMIC)
1446                         crit_enter();
1447                 pfr_setflags_ktables(&workq);
1448                 if (flags & PFR_FLAG_ATOMIC)
1449                         crit_exit();
1450         }
1451         if (nchange != NULL)
1452                 *nchange = xchange;
1453         if (ndel != NULL)
1454                 *ndel = xdel;
1455         return (0);
1456 }
1457
1458 int
1459 pfr_ina_begin(struct pfr_table *trs, u_int32_t *ticket, int *ndel, int flags)
1460 {
1461         struct pfr_ktableworkq   workq;
1462         struct pfr_ktable       *p;
1463         struct pf_ruleset       *rs;
1464         int                      xdel = 0;
1465
1466         ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1467         rs = pf_find_or_create_ruleset(trs->pfrt_anchor);
1468         if (rs == NULL)
1469                 return (ENOMEM);
1470         SLIST_INIT(&workq);
1471         RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1472                 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1473                     pfr_skip_table(trs, p, 0))
1474                         continue;
1475                 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1476                 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1477                 xdel++;
1478         }
1479         if (!(flags & PFR_FLAG_DUMMY)) {
1480                 pfr_setflags_ktables(&workq);
1481                 if (ticket != NULL)
1482                         *ticket = ++rs->tticket;
1483                 rs->topen = 1;
1484         } else
1485                 pf_remove_if_empty_ruleset(rs);
1486         if (ndel != NULL)
1487                 *ndel = xdel;
1488         return (0);
1489 }
1490
1491 int
1492 pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size,
1493     int *nadd, int *naddr, u_int32_t ticket, int flags)
1494 {
1495         struct pfr_ktableworkq   tableq;
1496         struct pfr_kentryworkq   addrq;
1497         struct pfr_ktable       *kt, *rt, *shadow, key;
1498         struct pfr_kentry       *p;
1499         struct pfr_addr          ad;
1500         struct pf_ruleset       *rs;
1501         int                      i, rv, xadd = 0, xaddr = 0;
1502
1503         ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ADDRSTOO);
1504         if (size && !(flags & PFR_FLAG_ADDRSTOO))
1505                 return (EINVAL);
1506         if (pfr_validate_table(tbl, PFR_TFLAG_USRMASK,
1507             flags & PFR_FLAG_USERIOCTL))
1508                 return (EINVAL);
1509         rs = pf_find_ruleset(tbl->pfrt_anchor);
1510         if (rs == NULL || !rs->topen || ticket != rs->tticket)
1511                 return (EBUSY);
1512         tbl->pfrt_flags |= PFR_TFLAG_INACTIVE;
1513         SLIST_INIT(&tableq);
1514         kt = RB_FIND(pfr_ktablehead, &pfr_ktables, (struct pfr_ktable *)tbl);
1515         if (kt == NULL) {
1516                 kt = pfr_create_ktable(tbl, 0, 1);
1517                 if (kt == NULL)
1518                         return (ENOMEM);
1519                 SLIST_INSERT_HEAD(&tableq, kt, pfrkt_workq);
1520                 xadd++;
1521                 if (!tbl->pfrt_anchor[0])
1522                         goto _skip;
1523
1524                 /* find or create root table */
1525                 bzero(&key, sizeof(key));
1526                 strlcpy(key.pfrkt_name, tbl->pfrt_name, sizeof(key.pfrkt_name));
1527                 rt = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1528                 if (rt != NULL) {
1529                         kt->pfrkt_root = rt;
1530                         goto _skip;
1531                 }
1532                 rt = pfr_create_ktable(&key.pfrkt_t, 0, 1);
1533                 if (rt == NULL) {
1534                         pfr_destroy_ktables(&tableq, 0);
1535                         return (ENOMEM);
1536                 }
1537                 SLIST_INSERT_HEAD(&tableq, rt, pfrkt_workq);
1538                 kt->pfrkt_root = rt;
1539         } else if (!(kt->pfrkt_flags & PFR_TFLAG_INACTIVE))
1540                 xadd++;
1541 _skip:
1542         shadow = pfr_create_ktable(tbl, 0, 0);
1543         if (shadow == NULL) {
1544                 pfr_destroy_ktables(&tableq, 0);
1545                 return (ENOMEM);
1546         }
1547         SLIST_INIT(&addrq);
1548         for (i = 0; i < size; i++) {
1549                 if (COPYIN(addr+i, &ad, sizeof(ad), flags))
1550                         senderr(EFAULT);
1551                 if (pfr_validate_addr(&ad))
1552                         senderr(EINVAL);
1553                 if (pfr_lookup_addr(shadow, &ad, 1) != NULL)
1554                         continue;
1555                 p = pfr_create_kentry(&ad, 0);
1556                 if (p == NULL)
1557                         senderr(ENOMEM);
1558                 if (pfr_route_kentry(shadow, p)) {
1559                         pfr_destroy_kentry(p);
1560                         continue;
1561                 }
1562                 SLIST_INSERT_HEAD(&addrq, p, pfrke_workq);
1563                 xaddr++;
1564         }
1565         if (!(flags & PFR_FLAG_DUMMY)) {
1566                 if (kt->pfrkt_shadow != NULL)
1567                         pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1568                 kt->pfrkt_flags |= PFR_TFLAG_INACTIVE;
1569                 pfr_insert_ktables(&tableq);
1570                 shadow->pfrkt_cnt = (flags & PFR_FLAG_ADDRSTOO) ?
1571                     xaddr : NO_ADDRESSES;
1572                 kt->pfrkt_shadow = shadow;
1573         } else {
1574                 pfr_clean_node_mask(shadow, &addrq);
1575                 pfr_destroy_ktable(shadow, 0);
1576                 pfr_destroy_ktables(&tableq, 0);
1577                 pfr_destroy_kentries(&addrq);
1578         }
1579         if (nadd != NULL)
1580                 *nadd = xadd;
1581         if (naddr != NULL)
1582                 *naddr = xaddr;
1583         return (0);
1584 _bad:
1585         pfr_destroy_ktable(shadow, 0);
1586         pfr_destroy_ktables(&tableq, 0);
1587         pfr_destroy_kentries(&addrq);
1588         return (rv);
1589 }
1590
1591 int
1592 pfr_ina_rollback(struct pfr_table *trs, u_int32_t ticket, int *ndel, int flags)
1593 {
1594         struct pfr_ktableworkq   workq;
1595         struct pfr_ktable       *p;
1596         struct pf_ruleset       *rs;
1597         int                      xdel = 0;
1598
1599         ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1600         rs = pf_find_ruleset(trs->pfrt_anchor);
1601         if (rs == NULL || !rs->topen || ticket != rs->tticket)
1602                 return (0);
1603         SLIST_INIT(&workq);
1604         RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1605                 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1606                     pfr_skip_table(trs, p, 0))
1607                         continue;
1608                 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1609                 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1610                 xdel++;
1611         }
1612         if (!(flags & PFR_FLAG_DUMMY)) {
1613                 pfr_setflags_ktables(&workq);
1614                 rs->topen = 0;
1615                 pf_remove_if_empty_ruleset(rs);
1616         }
1617         if (ndel != NULL)
1618                 *ndel = xdel;
1619         return (0);
1620 }
1621
1622 int
1623 pfr_ina_commit(struct pfr_table *trs, u_int32_t ticket, int *nadd,
1624     int *nchange, int flags)
1625 {
1626         struct pfr_ktable       *p, *q;
1627         struct pfr_ktableworkq   workq;
1628         struct pf_ruleset       *rs;
1629         int                      xadd = 0, xchange = 0;
1630         long                     tzero = time_second;
1631
1632         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
1633         rs = pf_find_ruleset(trs->pfrt_anchor);
1634         if (rs == NULL || !rs->topen || ticket != rs->tticket)
1635                 return (EBUSY);
1636
1637         SLIST_INIT(&workq);
1638         RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1639                 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1640                     pfr_skip_table(trs, p, 0))
1641                         continue;
1642                 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1643                 if (p->pfrkt_flags & PFR_TFLAG_ACTIVE)
1644                         xchange++;
1645                 else
1646                         xadd++;
1647         }
1648
1649         if (!(flags & PFR_FLAG_DUMMY)) {
1650                 if (flags & PFR_FLAG_ATOMIC)
1651                         crit_enter();
1652                 for (p = SLIST_FIRST(&workq); p != NULL; p = q) {
1653                         q = SLIST_NEXT(p, pfrkt_workq);
1654                         pfr_commit_ktable(p, tzero);
1655                 }
1656                 if (flags & PFR_FLAG_ATOMIC)
1657                         crit_exit();
1658                 rs->topen = 0;
1659                 pf_remove_if_empty_ruleset(rs);
1660         }
1661         if (nadd != NULL)
1662                 *nadd = xadd;
1663         if (nchange != NULL)
1664                 *nchange = xchange;
1665
1666         return (0);
1667 }
1668
1669 void
1670 pfr_commit_ktable(struct pfr_ktable *kt, long tzero)
1671 {
1672         struct pfr_ktable       *shadow = kt->pfrkt_shadow;
1673         int                      nflags;
1674
1675         if (shadow->pfrkt_cnt == NO_ADDRESSES) {
1676                 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1677                         pfr_clstats_ktable(kt, tzero, 1);
1678         } else if (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) {
1679                 /* kt might contain addresses */
1680                 struct pfr_kentryworkq   addrq, addq, changeq, delq, garbageq;
1681                 struct pfr_kentry       *p, *q, *next;
1682                 struct pfr_addr          ad;
1683
1684                 pfr_enqueue_addrs(shadow, &addrq, NULL, 0);
1685                 pfr_mark_addrs(kt);
1686                 SLIST_INIT(&addq);
1687                 SLIST_INIT(&changeq);
1688                 SLIST_INIT(&delq);
1689                 SLIST_INIT(&garbageq);
1690                 pfr_clean_node_mask(shadow, &addrq);
1691                 for (p = SLIST_FIRST(&addrq); p != NULL; p = next) {
1692                         next = SLIST_NEXT(p, pfrke_workq);      /* XXX */
1693                         pfr_copyout_addr(&ad, p);
1694                         q = pfr_lookup_addr(kt, &ad, 1);
1695                         if (q != NULL) {
1696                                 if (q->pfrke_not != p->pfrke_not)
1697                                         SLIST_INSERT_HEAD(&changeq, q,
1698                                             pfrke_workq);
1699                                 q->pfrke_mark = 1;
1700                                 SLIST_INSERT_HEAD(&garbageq, p, pfrke_workq);
1701                         } else {
1702                                 p->pfrke_tzero = tzero;
1703                                 SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
1704                         }
1705                 }
1706                 pfr_enqueue_addrs(kt, &delq, NULL, ENQUEUE_UNMARKED_ONLY);
1707                 pfr_insert_kentries(kt, &addq, tzero);
1708                 pfr_remove_kentries(kt, &delq);
1709                 pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
1710                 pfr_destroy_kentries(&garbageq);
1711         } else {
1712                 /* kt cannot contain addresses */
1713                 SWAP(struct radix_node_head *, kt->pfrkt_ip4,
1714                     shadow->pfrkt_ip4);
1715                 SWAP(struct radix_node_head *, kt->pfrkt_ip6,
1716                     shadow->pfrkt_ip6);
1717                 SWAP(int, kt->pfrkt_cnt, shadow->pfrkt_cnt);
1718                 pfr_clstats_ktable(kt, tzero, 1);
1719         }
1720         nflags = ((shadow->pfrkt_flags & PFR_TFLAG_USRMASK) |
1721             (kt->pfrkt_flags & PFR_TFLAG_SETMASK) | PFR_TFLAG_ACTIVE)
1722                 & ~PFR_TFLAG_INACTIVE;
1723         pfr_destroy_ktable(shadow, 0);
1724         kt->pfrkt_shadow = NULL;
1725         pfr_setflags_ktable(kt, nflags);
1726 }
1727
1728 int
1729 pfr_validate_table(struct pfr_table *tbl, int allowedflags, int no_reserved)
1730 {
1731         int i;
1732
1733         if (!tbl->pfrt_name[0])
1734                 return (-1);
1735         if (no_reserved && !strcmp(tbl->pfrt_anchor, PF_RESERVED_ANCHOR))
1736                  return (-1);
1737         if (tbl->pfrt_name[PF_TABLE_NAME_SIZE-1])
1738                 return (-1);
1739         for (i = strlen(tbl->pfrt_name); i < PF_TABLE_NAME_SIZE; i++)
1740                 if (tbl->pfrt_name[i])
1741                         return (-1);
1742         if (pfr_fix_anchor(tbl->pfrt_anchor))
1743                 return (-1);
1744         if (tbl->pfrt_flags & ~allowedflags)
1745                 return (-1);
1746         return (0);
1747 }
1748
1749 /*
1750  * Rewrite anchors referenced by tables to remove slashes
1751  * and check for validity.
1752  */
1753 int
1754 pfr_fix_anchor(char *anchor)
1755 {
1756         size_t siz = MAXPATHLEN;
1757         int i;
1758
1759         if (anchor[0] == '/') {
1760                 char *path;
1761                 int off;
1762
1763                 path = anchor;
1764                 off = 1;
1765                 while (*++path == '/')
1766                         off++;
1767                 bcopy(path, anchor, siz - off);
1768                 memset(anchor + siz - off, 0, off);
1769         }
1770         if (anchor[siz - 1])
1771                 return (-1);
1772         for (i = strlen(anchor); i < siz; i++)
1773                 if (anchor[i])
1774                         return (-1);
1775         return (0);
1776 }
1777
1778 int
1779 pfr_table_count(struct pfr_table *filter, int flags)
1780 {
1781         struct pf_ruleset *rs;
1782
1783         if (flags & PFR_FLAG_ALLRSETS)
1784                 return (pfr_ktable_cnt);
1785         if (filter->pfrt_anchor[0]) {
1786                 rs = pf_find_ruleset(filter->pfrt_anchor);
1787                 return ((rs != NULL) ? rs->tables : -1);
1788         }
1789         return (pf_main_ruleset.tables);
1790 }
1791
1792 int
1793 pfr_skip_table(struct pfr_table *filter, struct pfr_ktable *kt, int flags)
1794 {
1795         if (flags & PFR_FLAG_ALLRSETS)
1796                 return (0);
1797         if (strcmp(filter->pfrt_anchor, kt->pfrkt_anchor))
1798                 return (1);
1799         return (0);
1800 }
1801
1802 void
1803 pfr_insert_ktables(struct pfr_ktableworkq *workq)
1804 {
1805         struct pfr_ktable       *p;
1806
1807         SLIST_FOREACH(p, workq, pfrkt_workq)
1808                 pfr_insert_ktable(p);
1809 }
1810
1811 void
1812 pfr_insert_ktable(struct pfr_ktable *kt)
1813 {
1814         RB_INSERT(pfr_ktablehead, &pfr_ktables, kt);
1815         pfr_ktable_cnt++;
1816         if (kt->pfrkt_root != NULL)
1817                 if (!kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]++)
1818                         pfr_setflags_ktable(kt->pfrkt_root,
1819                             kt->pfrkt_root->pfrkt_flags|PFR_TFLAG_REFDANCHOR);
1820 }
1821
1822 void
1823 pfr_setflags_ktables(struct pfr_ktableworkq *workq)
1824 {
1825         struct pfr_ktable       *p, *q;
1826
1827         for (p = SLIST_FIRST(workq); p; p = q) {
1828                 q = SLIST_NEXT(p, pfrkt_workq);
1829                 pfr_setflags_ktable(p, p->pfrkt_nflags);
1830         }
1831 }
1832
1833 void
1834 pfr_setflags_ktable(struct pfr_ktable *kt, int newf)
1835 {
1836         struct pfr_kentryworkq  addrq;
1837
1838         if (!(newf & PFR_TFLAG_REFERENCED) &&
1839             !(newf & PFR_TFLAG_PERSIST))
1840                 newf &= ~PFR_TFLAG_ACTIVE;
1841         if (!(newf & PFR_TFLAG_ACTIVE))
1842                 newf &= ~PFR_TFLAG_USRMASK;
1843         if (!(newf & PFR_TFLAG_SETMASK)) {
1844                 RB_REMOVE(pfr_ktablehead, &pfr_ktables, kt);
1845                 if (kt->pfrkt_root != NULL)
1846                         if (!--kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR])
1847                                 pfr_setflags_ktable(kt->pfrkt_root,
1848                                     kt->pfrkt_root->pfrkt_flags &
1849                                         ~PFR_TFLAG_REFDANCHOR);
1850                 pfr_destroy_ktable(kt, 1);
1851                 pfr_ktable_cnt--;
1852                 return;
1853         }
1854         if (!(newf & PFR_TFLAG_ACTIVE) && kt->pfrkt_cnt) {
1855                 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1856                 pfr_remove_kentries(kt, &addrq);
1857         }
1858         if (!(newf & PFR_TFLAG_INACTIVE) && kt->pfrkt_shadow != NULL) {
1859                 pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1860                 kt->pfrkt_shadow = NULL;
1861         }
1862         kt->pfrkt_flags = newf;
1863 }
1864
1865 void
1866 pfr_clstats_ktables(struct pfr_ktableworkq *workq, long tzero, int recurse)
1867 {
1868         struct pfr_ktable       *p;
1869
1870         SLIST_FOREACH(p, workq, pfrkt_workq)
1871                 pfr_clstats_ktable(p, tzero, recurse);
1872 }
1873
1874 void
1875 pfr_clstats_ktable(struct pfr_ktable *kt, long tzero, int recurse)
1876 {
1877         struct pfr_kentryworkq   addrq;
1878
1879         if (recurse) {
1880                 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1881                 pfr_clstats_kentries(&addrq, tzero, 0);
1882         }
1883         crit_enter();
1884         bzero(kt->pfrkt_packets, sizeof(kt->pfrkt_packets));
1885         bzero(kt->pfrkt_bytes, sizeof(kt->pfrkt_bytes));
1886         kt->pfrkt_match = kt->pfrkt_nomatch = 0;
1887         crit_exit();
1888         kt->pfrkt_tzero = tzero;
1889 }
1890
1891 struct pfr_ktable *
1892 pfr_create_ktable(struct pfr_table *tbl, long tzero, int attachruleset)
1893 {
1894         struct pfr_ktable       *kt;
1895         struct pf_ruleset       *rs;
1896
1897         kt = pool_get(&pfr_ktable_pl, PR_NOWAIT| PR_ZERO | PR_LIMITFAIL);
1898         if (kt == NULL)
1899                 return (NULL);
1900         kt->pfrkt_t = *tbl;
1901
1902         if (attachruleset) {
1903                 rs = pf_find_or_create_ruleset(tbl->pfrt_anchor);
1904                 if (!rs) {
1905                         pfr_destroy_ktable(kt, 0);
1906                         return (NULL);
1907                 }
1908                 kt->pfrkt_rs = rs;
1909                 rs->tables++;
1910         }
1911
1912         KKASSERT(pf_maskhead != NULL);
1913         if (!rn_inithead((void **)&kt->pfrkt_ip4, pf_maskhead,
1914             offsetof(struct sockaddr_in, sin_addr) * 8) ||
1915             !rn_inithead((void **)&kt->pfrkt_ip6, pf_maskhead,
1916             offsetof(struct sockaddr_in6, sin6_addr) * 8)) {
1917                 pfr_destroy_ktable(kt, 0);
1918                 return (NULL);
1919         }
1920         kt->pfrkt_tzero = tzero;
1921
1922         return (kt);
1923 }
1924
1925 void
1926 pfr_destroy_ktables(struct pfr_ktableworkq *workq, int flushaddr)
1927 {
1928         struct pfr_ktable       *p, *q;
1929
1930         for (p = SLIST_FIRST(workq); p; p = q) {
1931                 q = SLIST_NEXT(p, pfrkt_workq);
1932                 pfr_destroy_ktable(p, flushaddr);
1933         }
1934 }
1935
1936 void
1937 pfr_destroy_ktable(struct pfr_ktable *kt, int flushaddr)
1938 {
1939         struct pfr_kentryworkq   addrq;
1940
1941         if (flushaddr) {
1942                 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1943                 pfr_clean_node_mask(kt, &addrq);
1944                 pfr_destroy_kentries(&addrq);
1945         }
1946         if (kt->pfrkt_ip4 != NULL)
1947                 kfree((caddr_t)kt->pfrkt_ip4, M_RTABLE);
1948
1949         if (kt->pfrkt_ip6 != NULL)
1950                 kfree((caddr_t)kt->pfrkt_ip6, M_RTABLE);
1951         if (kt->pfrkt_shadow != NULL)
1952                 pfr_destroy_ktable(kt->pfrkt_shadow, flushaddr);
1953         if (kt->pfrkt_rs != NULL) {
1954                 kt->pfrkt_rs->tables--;
1955                 pf_remove_if_empty_ruleset(kt->pfrkt_rs);
1956         }
1957         pool_put(&pfr_ktable_pl, kt);
1958 }
1959
1960 int
1961 pfr_ktable_compare(struct pfr_ktable *p, struct pfr_ktable *q)
1962 {
1963         int d;
1964
1965         if ((d = strncmp(p->pfrkt_name, q->pfrkt_name, PF_TABLE_NAME_SIZE)))
1966                 return (d);
1967         return (strcmp(p->pfrkt_anchor, q->pfrkt_anchor));
1968 }
1969
1970 struct pfr_ktable *
1971 pfr_lookup_table(struct pfr_table *tbl)
1972 {
1973         /* struct pfr_ktable start like a struct pfr_table */
1974         return (RB_FIND(pfr_ktablehead, &pfr_ktables,
1975             (struct pfr_ktable *)tbl));
1976 }
1977
1978 int
1979 pfr_match_addr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af)
1980 {
1981         struct pfr_kentry       *ke = NULL;
1982         int                      match;
1983
1984         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
1985                 kt = kt->pfrkt_root;
1986         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1987                 return (0);
1988
1989         switch (af) {
1990 #ifdef INET
1991         case AF_INET:
1992                 pfr_sin.sin_addr.s_addr = a->addr32[0];
1993                 ke = (struct pfr_kentry *)rn_match((char *)&pfr_sin,
1994                     kt->pfrkt_ip4);
1995                 if (ke && KENTRY_RNF_ROOT(ke))
1996                         ke = NULL;
1997                 break;
1998 #endif /* INET */
1999 #ifdef INET6
2000         case AF_INET6:
2001                 bcopy(a, &pfr_sin6.sin6_addr, sizeof(pfr_sin6.sin6_addr));
2002                 ke = (struct pfr_kentry *)rn_match((char *)&pfr_sin6,
2003                     kt->pfrkt_ip6);
2004                 if (ke && KENTRY_RNF_ROOT(ke))
2005                         ke = NULL;
2006                 break;
2007 #endif /* INET6 */
2008         }
2009         match = (ke && !ke->pfrke_not);
2010         if (match)
2011                 kt->pfrkt_match++;
2012         else
2013                 kt->pfrkt_nomatch++;
2014         return (match);
2015 }
2016
2017 void
2018 pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af,
2019     u_int64_t len, int dir_out, int op_pass, int notrule)
2020 {
2021         struct pfr_kentry       *ke = NULL;
2022
2023         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2024                 kt = kt->pfrkt_root;
2025         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2026                 return;
2027
2028         switch (af) {
2029 #ifdef INET
2030         case AF_INET:
2031                 pfr_sin.sin_addr.s_addr = a->addr32[0];
2032                 ke = (struct pfr_kentry *)rn_match((char *)&pfr_sin,
2033                     kt->pfrkt_ip4);
2034                 if (ke && KENTRY_RNF_ROOT(ke))
2035                         ke = NULL;
2036                 break;
2037 #endif /* INET */
2038 #ifdef INET6
2039         case AF_INET6:
2040                 bcopy(a, &pfr_sin6.sin6_addr, sizeof(pfr_sin6.sin6_addr));
2041                 ke = (struct pfr_kentry *)rn_match((char *)&pfr_sin6,
2042                     kt->pfrkt_ip6);
2043                 if (ke && KENTRY_RNF_ROOT(ke))
2044                         ke = NULL;
2045                 break;
2046 #endif /* INET6 */
2047         default:
2048                 ;
2049         }
2050         if ((ke == NULL || ke->pfrke_not) != notrule) {
2051                 if (op_pass != PFR_OP_PASS)
2052                         kprintf("pfr_update_stats: assertion failed.\n");
2053                 op_pass = PFR_OP_XPASS;
2054         }
2055         kt->pfrkt_packets[dir_out][op_pass]++;
2056         kt->pfrkt_bytes[dir_out][op_pass] += len;
2057         if (ke != NULL && op_pass != PFR_OP_XPASS &&
2058             (kt->pfrkt_flags & PFR_TFLAG_COUNTERS)) {
2059                 if (ke->pfrke_counters == NULL)
2060                         ke->pfrke_counters = pool_get(&pfr_kcounters_pl,
2061                             PR_NOWAIT | PR_ZERO);
2062                 if (ke->pfrke_counters != NULL) {
2063                         ke->pfrke_counters->pfrkc_packets[dir_out][op_pass]++;
2064                         ke->pfrke_counters->pfrkc_bytes[dir_out][op_pass] += len;
2065                 }
2066         }
2067 }
2068
2069 struct pfr_ktable *
2070 pfr_attach_table(struct pf_ruleset *rs, char *name)
2071 {
2072         struct pfr_ktable       *kt, *rt;
2073         struct pfr_table         tbl;
2074         struct pf_anchor        *ac = rs->anchor;
2075
2076         bzero(&tbl, sizeof(tbl));
2077         strlcpy(tbl.pfrt_name, name, sizeof(tbl.pfrt_name));
2078         if (ac != NULL)
2079                 strlcpy(tbl.pfrt_anchor, ac->path, sizeof(tbl.pfrt_anchor));
2080         kt = pfr_lookup_table(&tbl);
2081         if (kt == NULL) {
2082                 kt = pfr_create_ktable(&tbl, time_second, 1);
2083                 if (kt == NULL)
2084                         return (NULL);
2085                 if (ac != NULL) {
2086                         bzero(tbl.pfrt_anchor, sizeof(tbl.pfrt_anchor));
2087                         rt = pfr_lookup_table(&tbl);
2088                         if (rt == NULL) {
2089                                 rt = pfr_create_ktable(&tbl, 0, 1);
2090                                 if (rt == NULL) {
2091                                         pfr_destroy_ktable(kt, 0);
2092                                         return (NULL);
2093                                 }
2094                                 pfr_insert_ktable(rt);
2095                         }
2096                         kt->pfrkt_root = rt;
2097                 }
2098                 pfr_insert_ktable(kt);
2099         }
2100         if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++)
2101                 pfr_setflags_ktable(kt, kt->pfrkt_flags|PFR_TFLAG_REFERENCED);
2102         return (kt);
2103 }
2104
2105 void
2106 pfr_detach_table(struct pfr_ktable *kt)
2107 {
2108         if (kt->pfrkt_refcnt[PFR_REFCNT_RULE] <= 0)
2109                 kprintf("pfr_detach_table: refcount = %d.\n",
2110                     kt->pfrkt_refcnt[PFR_REFCNT_RULE]);
2111         else if (!--kt->pfrkt_refcnt[PFR_REFCNT_RULE])
2112                 pfr_setflags_ktable(kt, kt->pfrkt_flags&~PFR_TFLAG_REFERENCED);
2113 }
2114
2115 int
2116 pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter,
2117     struct pf_addr **raddr, struct pf_addr **rmask, sa_family_t af)
2118 {
2119         struct pfr_kentry       *ke, *ke2 = NULL;
2120         struct pf_addr          *addr = NULL;
2121         union sockaddr_union     mask;
2122         int                      idx = -1, use_counter = 0;
2123
2124         if (af == AF_INET)
2125                 addr = (struct pf_addr *)&pfr_sin.sin_addr;
2126         else if (af == AF_INET6)
2127                 addr = (struct pf_addr *)&pfr_sin6.sin6_addr;
2128         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2129                 kt = kt->pfrkt_root;
2130         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2131                 return (-1);
2132
2133         if (pidx != NULL)
2134                 idx = *pidx;
2135         if (counter != NULL && idx >= 0)
2136                 use_counter = 1;
2137         if (idx < 0)
2138                 idx = 0;
2139
2140 _next_block:
2141         ke = pfr_kentry_byidx(kt, idx, af);
2142         if (ke == NULL) {
2143                 kt->pfrkt_nomatch++;
2144                 return (1);
2145         }
2146         pfr_prepare_network(&pfr_mask, af, ke->pfrke_net);
2147         *raddr = SUNION2PF(&ke->pfrke_sa, af);
2148         *rmask = SUNION2PF(&pfr_mask, af);
2149
2150         if (use_counter) {
2151                 /* is supplied address within block? */
2152                 if (!PF_MATCHA(0, *raddr, *rmask, counter, af)) {
2153                         /* no, go to next block in table */
2154                         idx++;
2155                         use_counter = 0;
2156                         goto _next_block;
2157                 }
2158                 PF_ACPY(addr, counter, af);
2159         } else {
2160                 /* use first address of block */
2161                 PF_ACPY(addr, *raddr, af);
2162         }
2163
2164         if (!KENTRY_NETWORK(ke)) {
2165                 /* this is a single IP address - no possible nested block */
2166                 PF_ACPY(counter, addr, af);
2167                 *pidx = idx;
2168                 kt->pfrkt_match++;
2169                 return (0);
2170         }
2171         for (;;) {
2172                 /* we don't want to use a nested block */
2173                 if (af == AF_INET)
2174                         ke2 = (struct pfr_kentry *)rn_match((char *)&pfr_sin,
2175                             kt->pfrkt_ip4);
2176                 else if (af == AF_INET6)
2177                         ke2 = (struct pfr_kentry *)rn_match((char *)&pfr_sin6,
2178                             kt->pfrkt_ip6);
2179                 /* no need to check KENTRY_RNF_ROOT() here */
2180                 if (ke2 == ke) {
2181                         /* lookup return the same block - perfect */
2182                         PF_ACPY(counter, addr, af);
2183                         *pidx = idx;
2184                         kt->pfrkt_match++;
2185                         return (0);
2186                 }
2187
2188                 /* we need to increase the counter past the nested block */
2189                 pfr_prepare_network(&mask, AF_INET, ke2->pfrke_net);
2190                 PF_POOLMASK(addr, addr, SUNION2PF(&mask, af), &pfr_ffaddr, af);
2191                 PF_AINC(addr, af);
2192                 if (!PF_MATCHA(0, *raddr, *rmask, addr, af)) {
2193                         /* ok, we reached the end of our main block */
2194                         /* go to next block in table */
2195                         idx++;
2196                         use_counter = 0;
2197                         goto _next_block;
2198                 }
2199         }
2200 }
2201
2202 struct pfr_kentry *
2203 pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af)
2204 {
2205         struct pfr_walktree     w;
2206
2207         bzero(&w, sizeof(w));
2208         w.pfrw_op = PFRW_POOL_GET;
2209         w.pfrw_cnt = idx;
2210
2211         switch (af) {
2212 #ifdef INET
2213         case AF_INET:
2214                 kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
2215                 return (w.pfrw_kentry);
2216 #endif /* INET */
2217 #ifdef INET6
2218         case AF_INET6:
2219                 kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
2220                 return (w.pfrw_kentry);
2221 #endif /* INET6 */
2222         default:
2223                 return (NULL);
2224         }
2225 }
2226
2227 void
2228 pfr_dynaddr_update(struct pfr_ktable *kt, struct pfi_dynaddr *dyn)
2229 {
2230         struct pfr_walktree     w;
2231
2232         bzero(&w, sizeof(w));
2233         w.pfrw_op = PFRW_DYNADDR_UPDATE;
2234         w.pfrw_dyn = dyn;
2235
2236         crit_enter();
2237         dyn->pfid_acnt4 = 0;
2238         dyn->pfid_acnt6 = 0;
2239         if (!dyn->pfid_af || dyn->pfid_af == AF_INET)
2240                 kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
2241         if (!dyn->pfid_af || dyn->pfid_af == AF_INET6)
2242                 kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
2243         crit_exit();
2244 }