sys/net/pf/pf_table.c

   1 /*      $FreeBSD: src/sys/contrib/pf/net/pf_table.c,v 1.5 2004/07/28 06:14:44 kan Exp $ */
   2 /*      $OpenBSD: pf_table.c,v 1.47 2004/03/09 21:44:41 mcbride Exp $   */
   3 /*      $DragonFly: src/sys/net/pf/pf_table.c,v 1.1 2004/09/19 22:32:47 joerg Exp $ */
   4
   5 /*
   6  * Copyright (c) 2004 The DragonFly Project.  All rights reserved.
   7  *
   8  * Copyright (c) 2002 Cedric Berger
   9  * All rights reserved.
  10  *
  11  * Redistribution and use in source and binary forms, with or without
  12  * modification, are permitted provided that the following conditions
  13  * are met:
  14  *
  15  *    - Redistributions of source code must retain the above copyright
  16  *      notice, this list of conditions and the following disclaimer.
  17  *    - Redistributions in binary form must reproduce the above
  18  *      copyright notice, this list of conditions and the following
  19  *      disclaimer in the documentation and/or other materials provided
  20  *      with the distribution.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  23  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  24  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  25  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  26  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  27  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  28  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  29  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  30  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  32  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  33  * POSSIBILITY OF SUCH DAMAGE.
  34  *
  35  */
  36
  37 #include "opt_inet.h"
  38 #include "opt_inet6.h"
  39
  40 #include <sys/param.h>
  41 #include <sys/systm.h>
  42 #include <sys/socket.h>
  43 #include <sys/mbuf.h>
  44 #include <sys/kernel.h>
  45 #include <sys/malloc.h>
  46 #include <vm/vm_zone.h>
  47
  48 #include <net/if.h>
  49 #include <net/route.h>
  50 #include <netinet/in.h>
  51 #include <net/pf/pfvar.h>
  52
  53 #define ACCEPT_FLAGS(oklist)                    \
  54         do {                                    \
  55                 if ((flags & ~(oklist)) &       \
  56                     PFR_FLAG_ALLMASK)           \
  57                         return (EINVAL);        \
  58         } while (0)
  59
  60 #define COPYIN(from, to, size)                  \
  61         ((flags & PFR_FLAG_USERIOCTL) ?         \
  62         copyin((from), (to), (size)) :          \
  63         (bcopy((from), (to), (size)), 0))
  64
  65 #define COPYOUT(from, to, size)                 \
  66         ((flags & PFR_FLAG_USERIOCTL) ?         \
  67         copyout((from), (to), (size)) :         \
  68         (bcopy((from), (to), (size)), 0))
  69
  70 #define FILLIN_SIN(sin, addr)                   \
  71         do {                                    \
  72                 (sin).sin_len = sizeof(sin);    \
  73                 (sin).sin_family = AF_INET;     \
  74                 (sin).sin_addr = (addr);        \
  75         } while (0)
  76
  77 #define FILLIN_SIN6(sin6, addr)                 \
  78         do {                                    \
  79                 (sin6).sin6_len = sizeof(sin6); \
  80                 (sin6).sin6_family = AF_INET6;  \
  81                 (sin6).sin6_addr = (addr);      \
  82         } while (0)
  83
  84 #define SWAP(type, a1, a2)                      \
  85         do {                                    \
  86                 type tmp = a1;                  \
  87                 a1 = a2;                        \
  88                 a2 = tmp;                       \
  89         } while (0)
  90
  91 #define SUNION2PF(su, af) (((af)==AF_INET) ?    \
  92     (struct pf_addr *)&(su)->sin.sin_addr :     \
  93     (struct pf_addr *)&(su)->sin6.sin6_addr)
  94
  95 #define AF_BITS(af)             (((af)==AF_INET)?32:128)
  96 #define ADDR_NETWORK(ad)        ((ad)->pfra_net < AF_BITS((ad)->pfra_af))
  97 #define KENTRY_NETWORK(ke)      ((ke)->pfrke_net < AF_BITS((ke)->pfrke_af))
  98 #define KENTRY_RNF_ROOT(ke) \
  99                 ((((struct radix_node *)(ke))->rn_flags & RNF_ROOT) != 0)
 100
 101 #define NO_ADDRESSES            (-1)
 102 #define ENQUEUE_UNMARKED_ONLY   (1)
 103 #define INVERT_NEG_FLAG         (1)
 104
 105 struct pfr_walktree {
 106         enum pfrw_op {
 107                 PFRW_MARK,
 108                 PFRW_SWEEP,
 109                 PFRW_ENQUEUE,
 110                 PFRW_GET_ADDRS,
 111                 PFRW_GET_ASTATS,
 112                 PFRW_POOL_GET,
 113                 PFRW_DYNADDR_UPDATE
 114         }        pfrw_op;
 115         union {
 116                 struct pfr_addr         *pfrw1_addr;
 117                 struct pfr_astats       *pfrw1_astats;
 118                 struct pfr_kentryworkq  *pfrw1_workq;
 119                 struct pfr_kentry       *pfrw1_kentry;
 120                 struct pfi_dynaddr      *pfrw1_dyn;
 121         }        pfrw_1;
 122         int      pfrw_free;
 123         int      pfrw_flags;
 124 };
 125 #define pfrw_addr       pfrw_1.pfrw1_addr
 126 #define pfrw_astats     pfrw_1.pfrw1_astats
 127 #define pfrw_workq      pfrw_1.pfrw1_workq
 128 #define pfrw_kentry     pfrw_1.pfrw1_kentry
 129 #define pfrw_dyn        pfrw_1.pfrw1_dyn
 130 #define pfrw_cnt        pfrw_free
 131
 132 #define senderr(e)      do { rv = (e); goto _bad; } while (0)
 133
 134 vm_zone_t                pfr_ktable_pl;
 135 vm_zone_t                pfr_kentry_pl;
 136 struct sockaddr_in       pfr_sin;
 137 struct sockaddr_in6      pfr_sin6;
 138 union sockaddr_union     pfr_mask;
 139 struct pf_addr           pfr_ffaddr;
 140
 141 void                     pfr_copyout_addr(struct pfr_addr *,
 142                             struct pfr_kentry *ke);
 143 int                      pfr_validate_addr(struct pfr_addr *);
 144 void                     pfr_enqueue_addrs(struct pfr_ktable *,
 145                             struct pfr_kentryworkq *, int *, int);
 146 void                     pfr_mark_addrs(struct pfr_ktable *);
 147 struct pfr_kentry       *pfr_lookup_addr(struct pfr_ktable *,
 148                             struct pfr_addr *, int);
 149 struct pfr_kentry       *pfr_create_kentry(struct pfr_addr *);
 150 void                     pfr_destroy_kentries(struct pfr_kentryworkq *);
 151 void                     pfr_destroy_kentry(struct pfr_kentry *);
 152 void                     pfr_insert_kentries(struct pfr_ktable *,
 153                             struct pfr_kentryworkq *, long);
 154 void                     pfr_remove_kentries(struct pfr_ktable *,
 155                             struct pfr_kentryworkq *);
 156 void                     pfr_clstats_kentries(struct pfr_kentryworkq *, long,
 157                             int);
 158 void                     pfr_reset_feedback(struct pfr_addr *, int, int);
 159 void                     pfr_prepare_network(union sockaddr_union *, int, int);
 160 int                      pfr_route_kentry(struct pfr_ktable *,
 161                             struct pfr_kentry *);
 162 int                      pfr_unroute_kentry(struct pfr_ktable *,
 163                             struct pfr_kentry *);
 164 int                      pfr_walktree(struct radix_node *, void *);
 165 int                      pfr_validate_table(struct pfr_table *, int, int);
 166 void                     pfr_commit_ktable(struct pfr_ktable *, long);
 167 void                     pfr_insert_ktables(struct pfr_ktableworkq *);
 168 void                     pfr_insert_ktable(struct pfr_ktable *);
 169 void                     pfr_setflags_ktables(struct pfr_ktableworkq *);
 170 void                     pfr_setflags_ktable(struct pfr_ktable *, int);
 171 void                     pfr_clstats_ktables(struct pfr_ktableworkq *, long,
 172                             int);
 173 void                     pfr_clstats_ktable(struct pfr_ktable *, long, int);
 174 struct pfr_ktable       *pfr_create_ktable(struct pfr_table *, long, int);
 175 void                     pfr_destroy_ktables(struct pfr_ktableworkq *, int);
 176 void                     pfr_destroy_ktable(struct pfr_ktable *, int);
 177 int                      pfr_ktable_compare(struct pfr_ktable *,
 178                             struct pfr_ktable *);
 179 struct pfr_ktable       *pfr_lookup_table(struct pfr_table *);
 180 void                     pfr_clean_node_mask(struct pfr_ktable *,
 181                             struct pfr_kentryworkq *);
 182 int                      pfr_table_count(struct pfr_table *, int);
 183 int                      pfr_skip_table(struct pfr_table *,
 184                             struct pfr_ktable *, int);
 185 struct pfr_kentry       *pfr_kentry_byidx(struct pfr_ktable *, int, int);
 186
 187 RB_PROTOTYPE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
 188 RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
 189
 190 struct pfr_ktablehead    pfr_ktables;
 191 struct pfr_table         pfr_nulltable;
 192 int                      pfr_ktable_cnt;
 193
 194 void
 195 pfr_initialize(void)
 196 {
 197         pfr_sin.sin_len = sizeof(pfr_sin);
 198         pfr_sin.sin_family = AF_INET;
 199         pfr_sin6.sin6_len = sizeof(pfr_sin6);
 200         pfr_sin6.sin6_family = AF_INET6;
 201
 202         memset(&pfr_ffaddr, 0xff, sizeof(pfr_ffaddr));
 203 }
 204
 205 int
 206 pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags)
 207 {
 208         struct pfr_ktable       *kt;
 209         struct pfr_kentryworkq   workq;
 210         int                      s = 0;
 211
 212         ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY);
 213         if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
 214                 return (EINVAL);
 215         kt = pfr_lookup_table(tbl);
 216         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 217                 return (ESRCH);
 218         if (kt->pfrkt_flags & PFR_TFLAG_CONST)
 219                 return (EPERM);
 220         pfr_enqueue_addrs(kt, &workq, ndel, 0);
 221
 222         if (!(flags & PFR_FLAG_DUMMY)) {
 223                 if (flags & PFR_FLAG_ATOMIC)
 224                         s = splsoftnet();
 225                 pfr_remove_kentries(kt, &workq);
 226                 if (flags & PFR_FLAG_ATOMIC)
 227                         splx(s);
 228                 if (kt->pfrkt_cnt) {
 229                         printf("pfr_clr_addrs: corruption detected (%d).\n",
 230                             kt->pfrkt_cnt);
 231                         kt->pfrkt_cnt = 0;
 232                 }
 233         }
 234         return (0);
 235 }
 236
 237 int
 238 pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 239     int *nadd, int flags)
 240 {
 241         struct pfr_ktable       *kt, *tmpkt;
 242         struct pfr_kentryworkq   workq;
 243         struct pfr_kentry       *p, *q;
 244         struct pfr_addr          ad;
 245         int                      i, rv, s = 0, xadd = 0;
 246         long                     tzero = time_second;
 247
 248         ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_FEEDBACK);
 249         if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
 250                 return (EINVAL);
 251         kt = pfr_lookup_table(tbl);
 252         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 253                 return (ESRCH);
 254         if (kt->pfrkt_flags & PFR_TFLAG_CONST)
 255                 return (EPERM);
 256         tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0);
 257         if (tmpkt == NULL)
 258                 return (ENOMEM);
 259         SLIST_INIT(&workq);
 260         for (i = 0; i < size; i++) {
 261                 if (COPYIN(addr+i, &ad, sizeof(ad)))
 262                         senderr(EFAULT);
 263                 if (pfr_validate_addr(&ad))
 264                         senderr(EINVAL);
 265                 p = pfr_lookup_addr(kt, &ad, 1);
 266                 q = pfr_lookup_addr(tmpkt, &ad, 1);
 267                 if (flags & PFR_FLAG_FEEDBACK) {
 268                         if (q != NULL)
 269                                 ad.pfra_fback = PFR_FB_DUPLICATE;
 270                         else if (p == NULL)
 271                                 ad.pfra_fback = PFR_FB_ADDED;
 272                         else if (p->pfrke_not != ad.pfra_not)
 273                                 ad.pfra_fback = PFR_FB_CONFLICT;
 274                         else
 275                                 ad.pfra_fback = PFR_FB_NONE;
 276                 }
 277                 if (p == NULL && q == NULL) {
 278                         p = pfr_create_kentry(&ad);
 279                         if (p == NULL)
 280                                 senderr(ENOMEM);
 281                         if (pfr_route_kentry(tmpkt, p)) {
 282                                 pfr_destroy_kentry(p);
 283                                 ad.pfra_fback = PFR_FB_NONE;
 284                         } else {
 285                                 SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
 286                                 xadd++;
 287                         }
 288                 }
 289                 if (flags & PFR_FLAG_FEEDBACK)
 290                         if (COPYOUT(&ad, addr+i, sizeof(ad)))
 291                                 senderr(EFAULT);
 292         }
 293         pfr_clean_node_mask(tmpkt, &workq);
 294         if (!(flags & PFR_FLAG_DUMMY)) {
 295                 if (flags & PFR_FLAG_ATOMIC)
 296                         s = splsoftnet();
 297                 pfr_insert_kentries(kt, &workq, tzero);
 298                 if (flags & PFR_FLAG_ATOMIC)
 299                         splx(s);
 300         } else
 301                 pfr_destroy_kentries(&workq);
 302         if (nadd != NULL)
 303                 *nadd = xadd;
 304         pfr_destroy_ktable(tmpkt, 0);
 305         return (0);
 306 _bad:
 307         pfr_clean_node_mask(tmpkt, &workq);
 308         pfr_destroy_kentries(&workq);
 309         if (flags & PFR_FLAG_FEEDBACK)
 310                 pfr_reset_feedback(addr, size, flags);
 311         pfr_destroy_ktable(tmpkt, 0);
 312         return (rv);
 313 }
 314
 315 int
 316 pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 317     int *ndel, int flags)
 318 {
 319         struct pfr_ktable       *kt;
 320         struct pfr_kentryworkq   workq;
 321         struct pfr_kentry       *p;
 322         struct pfr_addr          ad;
 323         int                      i, rv, s = 0, xdel = 0;
 324
 325         ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_FEEDBACK);
 326         if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
 327                 return (EINVAL);
 328         kt = pfr_lookup_table(tbl);
 329         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 330                 return (ESRCH);
 331         if (kt->pfrkt_flags & PFR_TFLAG_CONST)
 332                 return (EPERM);
 333         pfr_mark_addrs(kt);
 334         SLIST_INIT(&workq);
 335         for (i = 0; i < size; i++) {
 336                 if (COPYIN(addr+i, &ad, sizeof(ad)))
 337                         senderr(EFAULT);
 338                 if (pfr_validate_addr(&ad))
 339                         senderr(EINVAL);
 340                 p = pfr_lookup_addr(kt, &ad, 1);
 341                 if (flags & PFR_FLAG_FEEDBACK) {
 342                         if (p == NULL)
 343                                 ad.pfra_fback = PFR_FB_NONE;
 344                         else if (p->pfrke_not != ad.pfra_not)
 345                                 ad.pfra_fback = PFR_FB_CONFLICT;
 346                         else if (p->pfrke_mark)
 347                                 ad.pfra_fback = PFR_FB_DUPLICATE;
 348                         else
 349                                 ad.pfra_fback = PFR_FB_DELETED;
 350                 }
 351                 if (p != NULL && p->pfrke_not == ad.pfra_not &&
 352                     !p->pfrke_mark) {
 353                         p->pfrke_mark = 1;
 354                         SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
 355                         xdel++;
 356                 }
 357                 if (flags & PFR_FLAG_FEEDBACK)
 358                         if (COPYOUT(&ad, addr+i, sizeof(ad)))
 359                                 senderr(EFAULT);
 360         }
 361         if (!(flags & PFR_FLAG_DUMMY)) {
 362                 if (flags & PFR_FLAG_ATOMIC)
 363                         s = splsoftnet();
 364                 pfr_remove_kentries(kt, &workq);
 365                 if (flags & PFR_FLAG_ATOMIC)
 366                         splx(s);
 367         }
 368         if (ndel != NULL)
 369                 *ndel = xdel;
 370         return (0);
 371 _bad:
 372         if (flags & PFR_FLAG_FEEDBACK)
 373                 pfr_reset_feedback(addr, size, flags);
 374         return (rv);
 375 }
 376
 377 int
 378 pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 379     int *size2, int *nadd, int *ndel, int *nchange, int flags)
 380 {
 381         struct pfr_ktable       *kt, *tmpkt;
 382         struct pfr_kentryworkq   addq, delq, changeq;
 383         struct pfr_kentry       *p, *q;
 384         struct pfr_addr          ad;
 385         int                      i, rv, s = 0, xadd = 0, xdel = 0, xchange = 0;
 386         long                     tzero = time_second;
 387
 388         ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_FEEDBACK);
 389         if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
 390                 return (EINVAL);
 391         kt = pfr_lookup_table(tbl);
 392         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 393                 return (ESRCH);
 394         if (kt->pfrkt_flags & PFR_TFLAG_CONST)
 395                 return (EPERM);
 396         tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0);
 397         if (tmpkt == NULL)
 398                 return (ENOMEM);
 399         pfr_mark_addrs(kt);
 400         SLIST_INIT(&addq);
 401         SLIST_INIT(&delq);
 402         SLIST_INIT(&changeq);
 403         for (i = 0; i < size; i++) {
 404                 if (COPYIN(addr+i, &ad, sizeof(ad)))
 405                         senderr(EFAULT);
 406                 if (pfr_validate_addr(&ad))
 407                         senderr(EINVAL);
 408                 ad.pfra_fback = PFR_FB_NONE;
 409                 p = pfr_lookup_addr(kt, &ad, 1);
 410                 if (p != NULL) {
 411                         if (p->pfrke_mark) {
 412                                 ad.pfra_fback = PFR_FB_DUPLICATE;
 413                                 goto _skip;
 414                         }
 415                         p->pfrke_mark = 1;
 416                         if (p->pfrke_not != ad.pfra_not) {
 417                                 SLIST_INSERT_HEAD(&changeq, p, pfrke_workq);
 418                                 ad.pfra_fback = PFR_FB_CHANGED;
 419                                 xchange++;
 420                         }
 421                 } else {
 422                         q = pfr_lookup_addr(tmpkt, &ad, 1);
 423                         if (q != NULL) {
 424                                 ad.pfra_fback = PFR_FB_DUPLICATE;
 425                                 goto _skip;
 426                         }
 427                         p = pfr_create_kentry(&ad);
 428                         if (p == NULL)
 429                                 senderr(ENOMEM);
 430                         if (pfr_route_kentry(tmpkt, p)) {
 431                                 pfr_destroy_kentry(p);
 432                                 ad.pfra_fback = PFR_FB_NONE;
 433                         } else {
 434                                 SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
 435                                 ad.pfra_fback = PFR_FB_ADDED;
 436                                 xadd++;
 437                         }
 438                 }
 439 _skip:
 440                 if (flags & PFR_FLAG_FEEDBACK)
 441                         if (COPYOUT(&ad, addr+i, sizeof(ad)))
 442                                 senderr(EFAULT);
 443         }
 444         pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY);
 445         if ((flags & PFR_FLAG_FEEDBACK) && *size2) {
 446                 if (*size2 < size+xdel) {
 447                         *size2 = size+xdel;
 448                         senderr(0);
 449                 }
 450                 i = 0;
 451                 SLIST_FOREACH(p, &delq, pfrke_workq) {
 452                         pfr_copyout_addr(&ad, p);
 453                         ad.pfra_fback = PFR_FB_DELETED;
 454                         if (COPYOUT(&ad, addr+size+i, sizeof(ad)))
 455                                 senderr(EFAULT);
 456                         i++;
 457                 }
 458         }
 459         pfr_clean_node_mask(tmpkt, &addq);
 460         if (!(flags & PFR_FLAG_DUMMY)) {
 461                 if (flags & PFR_FLAG_ATOMIC)
 462                         s = splsoftnet();
 463                 pfr_insert_kentries(kt, &addq, tzero);
 464                 pfr_remove_kentries(kt, &delq);
 465                 pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
 466                 if (flags & PFR_FLAG_ATOMIC)
 467                         splx(s);
 468         } else
 469                 pfr_destroy_kentries(&addq);
 470         if (nadd != NULL)
 471                 *nadd = xadd;
 472         if (ndel != NULL)
 473                 *ndel = xdel;
 474         if (nchange != NULL)
 475                 *nchange = xchange;
 476         if ((flags & PFR_FLAG_FEEDBACK) && size2)
 477                 *size2 = size+xdel;
 478         pfr_destroy_ktable(tmpkt, 0);
 479         return (0);
 480 _bad:
 481         pfr_clean_node_mask(tmpkt, &addq);
 482         pfr_destroy_kentries(&addq);
 483         if (flags & PFR_FLAG_FEEDBACK)
 484                 pfr_reset_feedback(addr, size, flags);
 485         pfr_destroy_ktable(tmpkt, 0);
 486         return (rv);
 487 }
 488
 489 int
 490 pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 491         int *nmatch, int flags)
 492 {
 493         struct pfr_ktable       *kt;
 494         struct pfr_kentry       *p;
 495         struct pfr_addr          ad;
 496         int                      i, xmatch = 0;
 497
 498         ACCEPT_FLAGS(PFR_FLAG_REPLACE);
 499         if (pfr_validate_table(tbl, 0, 0))
 500                 return (EINVAL);
 501         kt = pfr_lookup_table(tbl);
 502         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 503                 return (ESRCH);
 504
 505         for (i = 0; i < size; i++) {
 506                 if (COPYIN(addr+i, &ad, sizeof(ad)))
 507                         return (EFAULT);
 508                 if (pfr_validate_addr(&ad))
 509                         return (EINVAL);
 510                 if (ADDR_NETWORK(&ad))
 511                         return (EINVAL);
 512                 p = pfr_lookup_addr(kt, &ad, 0);
 513                 if (flags & PFR_FLAG_REPLACE)
 514                         pfr_copyout_addr(&ad, p);
 515                 ad.pfra_fback = (p == NULL) ? PFR_FB_NONE :
 516                     (p->pfrke_not ? PFR_FB_NOTMATCH : PFR_FB_MATCH);
 517                 if (p != NULL && !p->pfrke_not)
 518                         xmatch++;
 519                 if (COPYOUT(&ad, addr+i, sizeof(ad)))
 520                         return (EFAULT);
 521         }
 522         if (nmatch != NULL)
 523                 *nmatch = xmatch;
 524         return (0);
 525 }
 526
 527 int
 528 pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size,
 529         int flags)
 530 {
 531         struct pfr_ktable       *kt;
 532         struct pfr_walktree      w;
 533         int                      rv;
 534
 535         ACCEPT_FLAGS(0);
 536         if (pfr_validate_table(tbl, 0, 0))
 537                 return (EINVAL);
 538         kt = pfr_lookup_table(tbl);
 539         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 540                 return (ESRCH);
 541         if (kt->pfrkt_cnt > *size) {
 542                 *size = kt->pfrkt_cnt;
 543                 return (0);
 544         }
 545
 546         bzero(&w, sizeof(w));
 547         w.pfrw_op = PFRW_GET_ADDRS;
 548         w.pfrw_addr = addr;
 549         w.pfrw_free = kt->pfrkt_cnt;
 550         w.pfrw_flags = flags;
 551         rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
 552         if (!rv)
 553                 rv = kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
 554         if (rv)
 555                 return (rv);
 556
 557         if (w.pfrw_free) {
 558                 printf("pfr_get_addrs: corruption detected (%d).\n",
 559                     w.pfrw_free);
 560                 return (ENOTTY);
 561         }
 562         *size = kt->pfrkt_cnt;
 563         return (0);
 564 }
 565
 566 int
 567 pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size,
 568         int flags)
 569 {
 570         struct pfr_ktable       *kt;
 571         struct pfr_walktree      w;
 572         struct pfr_kentryworkq   workq;
 573         int                      rv, s = 0;
 574         long                     tzero = time_second;
 575
 576         ACCEPT_FLAGS(PFR_FLAG_ATOMIC); /* XXX PFR_FLAG_CLSTATS disabled */
 577         if (pfr_validate_table(tbl, 0, 0))
 578                 return (EINVAL);
 579         kt = pfr_lookup_table(tbl);
 580         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 581                 return (ESRCH);
 582         if (kt->pfrkt_cnt > *size) {
 583                 *size = kt->pfrkt_cnt;
 584                 return (0);
 585         }
 586
 587         bzero(&w, sizeof(w));
 588         w.pfrw_op = PFRW_GET_ASTATS;
 589         w.pfrw_astats = addr;
 590         w.pfrw_free = kt->pfrkt_cnt;
 591         w.pfrw_flags = flags;
 592         if (flags & PFR_FLAG_ATOMIC)
 593                 s = splsoftnet();
 594         rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
 595         if (!rv)
 596                 rv = kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
 597         if (!rv && (flags & PFR_FLAG_CLSTATS)) {
 598                 pfr_enqueue_addrs(kt, &workq, NULL, 0);
 599                 pfr_clstats_kentries(&workq, tzero, 0);
 600         }
 601         if (flags & PFR_FLAG_ATOMIC)
 602                 splx(s);
 603         if (rv)
 604                 return (rv);
 605
 606         if (w.pfrw_free) {
 607                 printf("pfr_get_astats: corruption detected (%d).\n",
 608                     w.pfrw_free);
 609                 return (ENOTTY);
 610         }
 611         *size = kt->pfrkt_cnt;
 612         return (0);
 613 }
 614
 615 int
 616 pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 617     int *nzero, int flags)
 618 {
 619         struct pfr_ktable       *kt;
 620         struct pfr_kentryworkq   workq;
 621         struct pfr_kentry       *p;
 622         struct pfr_addr          ad;
 623         int                      i, rv, s = 0, xzero = 0;
 624
 625         ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_FEEDBACK);
 626         if (pfr_validate_table(tbl, 0, 0))
 627                 return (EINVAL);
 628         kt = pfr_lookup_table(tbl);
 629         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 630                 return (ESRCH);
 631         SLIST_INIT(&workq);
 632         for (i = 0; i < size; i++) {
 633                 if (COPYIN(addr+i, &ad, sizeof(ad)))
 634                         senderr(EFAULT);
 635                 if (pfr_validate_addr(&ad))
 636                         senderr(EINVAL);
 637                 p = pfr_lookup_addr(kt, &ad, 1);
 638                 if (flags & PFR_FLAG_FEEDBACK) {
 639                         ad.pfra_fback = (p != NULL) ?
 640                             PFR_FB_CLEARED : PFR_FB_NONE;
 641                         if (COPYOUT(&ad, addr+i, sizeof(ad)))
 642                                 senderr(EFAULT);
 643                 }
 644                 if (p != NULL) {
 645                         SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
 646                         xzero++;
 647                 }
 648         }
 649
 650         if (!(flags & PFR_FLAG_DUMMY)) {
 651                 if (flags & PFR_FLAG_ATOMIC)
 652                         s = splsoftnet();
 653                 pfr_clstats_kentries(&workq, 0, 0);
 654                 if (flags & PFR_FLAG_ATOMIC)
 655                         splx(s);
 656         }
 657         if (nzero != NULL)
 658                 *nzero = xzero;
 659         return (0);
 660 _bad:
 661         if (flags & PFR_FLAG_FEEDBACK)
 662                 pfr_reset_feedback(addr, size, flags);
 663         return (rv);
 664 }
 665
 666 int
 667 pfr_validate_addr(struct pfr_addr *ad)
 668 {
 669         int i;
 670
 671         switch (ad->pfra_af) {
 672         case AF_INET:
 673                 if (ad->pfra_net > 32)
 674                         return (-1);
 675                 break;
 676         case AF_INET6:
 677                 if (ad->pfra_net > 128)
 678                         return (-1);
 679                 break;
 680         default:
 681                 return (-1);
 682         }
 683         if (ad->pfra_net < 128 &&
 684                 (((caddr_t)ad)[ad->pfra_net/8] & (0xFF >> (ad->pfra_net%8))))
 685                         return (-1);
 686         for (i = (ad->pfra_net+7)/8; i < sizeof(ad->pfra_u); i++)
 687                 if (((caddr_t)ad)[i])
 688                         return (-1);
 689         if (ad->pfra_not && ad->pfra_not != 1)
 690                 return (-1);
 691         if (ad->pfra_fback)
 692                 return (-1);
 693         return (0);
 694 }
 695
 696 void
 697 pfr_enqueue_addrs(struct pfr_ktable *kt, struct pfr_kentryworkq *workq,
 698         int *naddr, int sweep)
 699 {
 700         struct pfr_walktree     w;
 701
 702         SLIST_INIT(workq);
 703         bzero(&w, sizeof(w));
 704         w.pfrw_op = sweep ? PFRW_SWEEP : PFRW_ENQUEUE;
 705         w.pfrw_workq = workq;
 706         if (kt->pfrkt_ip4 != NULL)
 707                 if (kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w))
 708                         printf("pfr_enqueue_addrs: IPv4 walktree failed.\n");
 709         if (kt->pfrkt_ip6 != NULL)
 710                 if (kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w))
 711                         printf("pfr_enqueue_addrs: IPv6 walktree failed.\n");
 712         if (naddr != NULL)
 713                 *naddr = w.pfrw_cnt;
 714 }
 715
 716 void
 717 pfr_mark_addrs(struct pfr_ktable *kt)
 718 {
 719         struct pfr_walktree     w;
 720
 721         bzero(&w, sizeof(w));
 722         w.pfrw_op = PFRW_MARK;
 723         if (kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w))
 724                 printf("pfr_mark_addrs: IPv4 walktree failed.\n");
 725         if (kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w))
 726                 printf("pfr_mark_addrs: IPv6 walktree failed.\n");
 727 }
 728
 729
 730 struct pfr_kentry *
 731 pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact)
 732 {
 733         union sockaddr_union     sa, mask;
 734         struct radix_node_head  *head;
 735         struct pfr_kentry       *ke;
 736         int                      s;
 737
 738         bzero(&sa, sizeof(sa));
 739         if (ad->pfra_af == AF_INET) {
 740                 FILLIN_SIN(sa.sin, ad->pfra_ip4addr);
 741                 head = kt->pfrkt_ip4;
 742         } else {
 743                 FILLIN_SIN6(sa.sin6, ad->pfra_ip6addr);
 744                 head = kt->pfrkt_ip6;
 745         }
 746         if (ADDR_NETWORK(ad)) {
 747                 pfr_prepare_network(&mask, ad->pfra_af, ad->pfra_net);
 748                 s = splsoftnet(); /* rn_lookup makes use of globals */
 749                 ke = (struct pfr_kentry *)rn_lookup(&sa, &mask, head);
 750                 splx(s);
 751                 if (ke && KENTRY_RNF_ROOT(ke))
 752                         ke = NULL;
 753         } else {
 754                 ke = (struct pfr_kentry *)rn_match(&sa, head);
 755                 if (ke && KENTRY_RNF_ROOT(ke))
 756                         ke = NULL;
 757                 if (exact && ke && KENTRY_NETWORK(ke))
 758                         ke = NULL;
 759         }
 760         return (ke);
 761 }
 762
 763 struct pfr_kentry *
 764 pfr_create_kentry(struct pfr_addr *ad)
 765 {
 766         struct pfr_kentry       *ke;
 767
 768         ke = pool_get(&pfr_kentry_pl, PR_NOWAIT);
 769         if (ke == NULL)
 770                 return (NULL);
 771         bzero(ke, sizeof(*ke));
 772
 773         if (ad->pfra_af == AF_INET)
 774                 FILLIN_SIN(ke->pfrke_sa.sin, ad->pfra_ip4addr);
 775         else
 776                 FILLIN_SIN6(ke->pfrke_sa.sin6, ad->pfra_ip6addr);
 777         ke->pfrke_af = ad->pfra_af;
 778         ke->pfrke_net = ad->pfra_net;
 779         ke->pfrke_not = ad->pfra_not;
 780         return (ke);
 781 }
 782
 783 void
 784 pfr_destroy_kentries(struct pfr_kentryworkq *workq)
 785 {
 786         struct pfr_kentry       *p, *q;
 787
 788         for (p = SLIST_FIRST(workq); p != NULL; p = q) {
 789                 q = SLIST_NEXT(p, pfrke_workq);
 790                 pfr_destroy_kentry(p);
 791         }
 792 }
 793
 794 void
 795 pfr_destroy_kentry(struct pfr_kentry *ke)
 796 {
 797         pool_put(&pfr_kentry_pl, ke);
 798 }
 799
 800 void
 801 pfr_insert_kentries(struct pfr_ktable *kt,
 802     struct pfr_kentryworkq *workq, long tzero)
 803 {
 804         struct pfr_kentry       *p;
 805         int                      rv, n = 0;
 806
 807         SLIST_FOREACH(p, workq, pfrke_workq) {
 808                 rv = pfr_route_kentry(kt, p);
 809                 if (rv) {
 810                         printf("pfr_insert_kentries: cannot route entry "
 811                             "(code=%d).\n", rv);
 812                         break;
 813                 }
 814                 p->pfrke_tzero = tzero;
 815                 n++;
 816         }
 817         kt->pfrkt_cnt += n;
 818 }
 819
 820 void
 821 pfr_remove_kentries(struct pfr_ktable *kt,
 822     struct pfr_kentryworkq *workq)
 823 {
 824         struct pfr_kentry       *p;
 825         int                      n = 0;
 826
 827         SLIST_FOREACH(p, workq, pfrke_workq) {
 828                 pfr_unroute_kentry(kt, p);
 829                 n++;
 830         }
 831         kt->pfrkt_cnt -= n;
 832         pfr_destroy_kentries(workq);
 833 }
 834
 835 void
 836 pfr_clean_node_mask(struct pfr_ktable *kt,
 837     struct pfr_kentryworkq *workq)
 838 {
 839         struct pfr_kentry       *p;
 840
 841         SLIST_FOREACH(p, workq, pfrke_workq)
 842                 pfr_unroute_kentry(kt, p);
 843 }
 844
 845 void
 846 pfr_clstats_kentries(struct pfr_kentryworkq *workq, long tzero, int negchange)
 847 {
 848         struct pfr_kentry       *p;
 849         int                      s;
 850
 851         SLIST_FOREACH(p, workq, pfrke_workq) {
 852                 s = splsoftnet();
 853                 if (negchange)
 854                         p->pfrke_not = !p->pfrke_not;
 855                 bzero(p->pfrke_packets, sizeof(p->pfrke_packets));
 856                 bzero(p->pfrke_bytes, sizeof(p->pfrke_bytes));
 857                 splx(s);
 858                 p->pfrke_tzero = tzero;
 859         }
 860 }
 861
 862 void
 863 pfr_reset_feedback(struct pfr_addr *addr, int size, int flags)
 864 {
 865         struct pfr_addr ad;
 866         int             i;
 867
 868         for (i = 0; i < size; i++) {
 869                 if (COPYIN(addr+i, &ad, sizeof(ad)))
 870                         break;
 871                 ad.pfra_fback = PFR_FB_NONE;
 872                 if (COPYOUT(&ad, addr+i, sizeof(ad)))
 873                         break;
 874         }
 875 }
 876
 877 void
 878 pfr_prepare_network(union sockaddr_union *sa, int af, int net)
 879 {
 880         int     i;
 881
 882         bzero(sa, sizeof(*sa));
 883         if (af == AF_INET) {
 884                 sa->sin.sin_len = sizeof(sa->sin);
 885                 sa->sin.sin_family = AF_INET;
 886                 sa->sin.sin_addr.s_addr = htonl(-1 << (32-net));
 887         } else {
 888                 sa->sin6.sin6_len = sizeof(sa->sin6);
 889                 sa->sin6.sin6_family = AF_INET6;
 890                 for (i = 0; i < 4; i++) {
 891                         if (net <= 32) {
 892                                 sa->sin6.sin6_addr.s6_addr32[i] =
 893                                     htonl(-1 << (32-net));
 894                                 break;
 895                         }
 896                         sa->sin6.sin6_addr.s6_addr32[i] = 0xFFFFFFFF;
 897                         net -= 32;
 898                 }
 899         }
 900 }
 901
 902 int
 903 pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
 904 {
 905         union sockaddr_union     mask;
 906         struct radix_node       *rn;
 907         struct radix_node_head  *head;
 908         int                      s;
 909
 910         bzero(ke->pfrke_node, sizeof(ke->pfrke_node));
 911         if (ke->pfrke_af == AF_INET)
 912                 head = kt->pfrkt_ip4;
 913         else
 914                 head = kt->pfrkt_ip6;
 915
 916         s = splsoftnet();
 917         if (KENTRY_NETWORK(ke)) {
 918                 pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
 919                 rn = rn_addroute(&ke->pfrke_sa, &mask, head, ke->pfrke_node);
 920         } else
 921                 rn = rn_addroute(&ke->pfrke_sa, NULL, head, ke->pfrke_node);
 922         splx(s);
 923
 924         return (rn == NULL ? -1 : 0);
 925 }
 926
 927 int
 928 pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
 929 {
 930         union sockaddr_union     mask;
 931         struct radix_node       *rn;
 932         struct radix_node_head  *head;
 933         int                      s;
 934
 935         if (ke->pfrke_af == AF_INET)
 936                 head = kt->pfrkt_ip4;
 937         else
 938                 head = kt->pfrkt_ip6;
 939
 940         s = splsoftnet();
 941         if (KENTRY_NETWORK(ke)) {
 942                 pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
 943                 rn = rn_delete(&ke->pfrke_sa, &mask, head);
 944         } else
 945                 rn = rn_delete(&ke->pfrke_sa, NULL, head);
 946         splx(s);
 947
 948         if (rn == NULL) {
 949                 printf("pfr_unroute_kentry: delete failed.\n");
 950                 return (-1);
 951         }
 952         return (0);
 953 }
 954
 955 void
 956 pfr_copyout_addr(struct pfr_addr *ad, struct pfr_kentry *ke)
 957 {
 958         bzero(ad, sizeof(*ad));
 959         if (ke == NULL)
 960                 return;
 961         ad->pfra_af = ke->pfrke_af;
 962         ad->pfra_net = ke->pfrke_net;
 963         ad->pfra_not = ke->pfrke_not;
 964         if (ad->pfra_af == AF_INET)
 965                 ad->pfra_ip4addr = ke->pfrke_sa.sin.sin_addr;
 966         else
 967                 ad->pfra_ip6addr = ke->pfrke_sa.sin6.sin6_addr;
 968 }
 969
 970 int
 971 pfr_walktree(struct radix_node *rn, void *arg)
 972 {
 973         struct pfr_kentry       *ke = (struct pfr_kentry *)rn;
 974         struct pfr_walktree     *w = arg;
 975         int                      s, flags = w->pfrw_flags;
 976
 977         switch (w->pfrw_op) {
 978         case PFRW_MARK:
 979                 ke->pfrke_mark = 0;
 980                 break;
 981         case PFRW_SWEEP:
 982                 if (ke->pfrke_mark)
 983                         break;
 984                 /* FALLTHROUGH */
 985         case PFRW_ENQUEUE:
 986                 SLIST_INSERT_HEAD(w->pfrw_workq, ke, pfrke_workq);
 987                 w->pfrw_cnt++;
 988                 break;
 989         case PFRW_GET_ADDRS:
 990                 if (w->pfrw_free-- > 0) {
 991                         struct pfr_addr ad;
 992
 993                         pfr_copyout_addr(&ad, ke);
 994                         if (copyout(&ad, w->pfrw_addr, sizeof(ad)))
 995                                 return (EFAULT);
 996                         w->pfrw_addr++;
 997                 }
 998                 break;
 999         case PFRW_GET_ASTATS:
1000                 if (w->pfrw_free-- > 0) {
1001                         struct pfr_astats as;
1002
1003                         pfr_copyout_addr(&as.pfras_a, ke);
1004
1005                         s = splsoftnet();
1006                         bcopy(ke->pfrke_packets, as.pfras_packets,
1007                             sizeof(as.pfras_packets));
1008                         bcopy(ke->pfrke_bytes, as.pfras_bytes,
1009                             sizeof(as.pfras_bytes));
1010                         splx(s);
1011                         as.pfras_tzero = ke->pfrke_tzero;
1012
1013                         if (COPYOUT(&as, w->pfrw_astats, sizeof(as)))
1014                                 return (EFAULT);
1015                         w->pfrw_astats++;
1016                 }
1017                 break;
1018         case PFRW_POOL_GET:
1019                 if (ke->pfrke_not)
1020                         break; /* negative entries are ignored */
1021                 if (!w->pfrw_cnt--) {
1022                         w->pfrw_kentry = ke;
1023                         return (1); /* finish search */
1024                 }
1025                 break;
1026         case PFRW_DYNADDR_UPDATE:
1027                 if (ke->pfrke_af == AF_INET) {
1028                         if (w->pfrw_dyn->pfid_acnt4++ > 0)
1029                                 break;
1030                         pfr_prepare_network(&pfr_mask, AF_INET, ke->pfrke_net);
1031                         w->pfrw_dyn->pfid_addr4 = *SUNION2PF(
1032                             &ke->pfrke_sa, AF_INET);
1033                         w->pfrw_dyn->pfid_mask4 = *SUNION2PF(
1034                             &pfr_mask, AF_INET);
1035                 } else {
1036                         if (w->pfrw_dyn->pfid_acnt6++ > 0)
1037                                 break;
1038                         pfr_prepare_network(&pfr_mask, AF_INET6, ke->pfrke_net);
1039                         w->pfrw_dyn->pfid_addr6 = *SUNION2PF(
1040                             &ke->pfrke_sa, AF_INET6);
1041                         w->pfrw_dyn->pfid_mask6 = *SUNION2PF(
1042                             &pfr_mask, AF_INET6);
1043                 }
1044                 break;
1045         }
1046         return (0);
1047 }
1048
1049 int
1050 pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags)
1051 {
1052         struct pfr_ktableworkq   workq;
1053         struct pfr_ktable       *p;
1054         int                      s = 0, xdel = 0;
1055
1056         ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_ALLRSETS);
1057         if (pfr_table_count(filter, flags) < 0)
1058                 return (ENOENT);
1059
1060         SLIST_INIT(&workq);
1061         RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1062                 if (pfr_skip_table(filter, p, flags))
1063                         continue;
1064                 if (!strcmp(p->pfrkt_anchor, PF_RESERVED_ANCHOR))
1065                         continue;
1066                 if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE))
1067                         continue;
1068                 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1069                 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1070                 xdel++;
1071         }
1072         if (!(flags & PFR_FLAG_DUMMY)) {
1073                 if (flags & PFR_FLAG_ATOMIC)
1074                         s = splsoftnet();
1075                 pfr_setflags_ktables(&workq);
1076                 if (flags & PFR_FLAG_ATOMIC)
1077                         splx(s);
1078         }
1079         if (ndel != NULL)
1080                 *ndel = xdel;
1081         return (0);
1082 }
1083
1084 int
1085 pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags)
1086 {
1087         struct pfr_ktableworkq   addq, changeq;
1088         struct pfr_ktable       *p, *q, *r, key;
1089         int                      i, rv, s = 0, xadd = 0;
1090         long                     tzero = time_second;
1091
1092         ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY);
1093         SLIST_INIT(&addq);
1094         SLIST_INIT(&changeq);
1095         for (i = 0; i < size; i++) {
1096                 if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t)))
1097                         senderr(EFAULT);
1098                 if (pfr_validate_table(&key.pfrkt_t, PFR_TFLAG_USRMASK,
1099                     flags & PFR_FLAG_USERIOCTL))
1100                         senderr(EINVAL);
1101                 key.pfrkt_flags |= PFR_TFLAG_ACTIVE;
1102                 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1103                 if (p == NULL) {
1104                         p = pfr_create_ktable(&key.pfrkt_t, tzero, 1);
1105                         if (p == NULL)
1106                                 senderr(ENOMEM);
1107                         SLIST_FOREACH(q, &addq, pfrkt_workq) {
1108                                 if (!pfr_ktable_compare(p, q))
1109                                         goto _skip;
1110                         }
1111                         SLIST_INSERT_HEAD(&addq, p, pfrkt_workq);
1112                         xadd++;
1113                         if (!key.pfrkt_anchor[0])
1114                                 goto _skip;
1115
1116                         /* find or create root table */
1117                         bzero(key.pfrkt_anchor, sizeof(key.pfrkt_anchor));
1118                         bzero(key.pfrkt_ruleset, sizeof(key.pfrkt_ruleset));
1119                         r = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1120                         if (r != NULL) {
1121                                 p->pfrkt_root = r;
1122                                 goto _skip;
1123                         }
1124                         SLIST_FOREACH(q, &addq, pfrkt_workq) {
1125                                 if (!pfr_ktable_compare(&key, q)) {
1126                                         p->pfrkt_root = q;
1127                                         goto _skip;
1128                                 }
1129                         }
1130                         key.pfrkt_flags = 0;
1131                         r = pfr_create_ktable(&key.pfrkt_t, 0, 1);
1132                         if (r == NULL)
1133                                 senderr(ENOMEM);
1134                         SLIST_INSERT_HEAD(&addq, r, pfrkt_workq);
1135                         p->pfrkt_root = r;
1136                 } else if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1137                         SLIST_FOREACH(q, &changeq, pfrkt_workq)
1138                                 if (!pfr_ktable_compare(&key, q))
1139                                         goto _skip;
1140                         p->pfrkt_nflags = (p->pfrkt_flags &
1141                             ~PFR_TFLAG_USRMASK) | key.pfrkt_flags;
1142                         SLIST_INSERT_HEAD(&changeq, p, pfrkt_workq);
1143                         xadd++;
1144                 }
1145 _skip:
1146         ;
1147         }
1148         if (!(flags & PFR_FLAG_DUMMY)) {
1149                 if (flags & PFR_FLAG_ATOMIC)
1150                         s = splsoftnet();
1151                 pfr_insert_ktables(&addq);
1152                 pfr_setflags_ktables(&changeq);
1153                 if (flags & PFR_FLAG_ATOMIC)
1154                         splx(s);
1155         } else
1156                  pfr_destroy_ktables(&addq, 0);
1157         if (nadd != NULL)
1158                 *nadd = xadd;
1159         return (0);
1160 _bad:
1161         pfr_destroy_ktables(&addq, 0);
1162         return (rv);
1163 }
1164
1165 int
1166 pfr_del_tables(struct pfr_table *tbl, int size, int *ndel, int flags)
1167 {
1168         struct pfr_ktableworkq   workq;
1169         struct pfr_ktable       *p, *q, key;
1170         int                      i, s = 0, xdel = 0;
1171
1172         ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY);
1173         SLIST_INIT(&workq);
1174         for (i = 0; i < size; i++) {
1175                 if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t)))
1176                         return (EFAULT);
1177                 if (pfr_validate_table(&key.pfrkt_t, 0,
1178                     flags & PFR_FLAG_USERIOCTL))
1179                         return (EINVAL);
1180                 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1181                 if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1182                         SLIST_FOREACH(q, &workq, pfrkt_workq)
1183                                 if (!pfr_ktable_compare(p, q))
1184                                         goto _skip;
1185                         p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1186                         SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1187                         xdel++;
1188                 }
1189 _skip:
1190         ;
1191         }
1192
1193         if (!(flags & PFR_FLAG_DUMMY)) {
1194                 if (flags & PFR_FLAG_ATOMIC)
1195                         s = splsoftnet();
1196                 pfr_setflags_ktables(&workq);
1197                 if (flags & PFR_FLAG_ATOMIC)
1198                         splx(s);
1199         }
1200         if (ndel != NULL)
1201                 *ndel = xdel;
1202         return (0);
1203 }
1204
1205 int
1206 pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size,
1207         int flags)
1208 {
1209         struct pfr_ktable       *p;
1210         int                      n, nn;
1211
1212         ACCEPT_FLAGS(PFR_FLAG_ALLRSETS);
1213         n = nn = pfr_table_count(filter, flags);
1214         if (n < 0)
1215                 return (ENOENT);
1216         if (n > *size) {
1217                 *size = n;
1218                 return (0);
1219         }
1220         RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1221                 if (pfr_skip_table(filter, p, flags))
1222                         continue;
1223                 if (n-- <= 0)
1224                         continue;
1225                 if (COPYOUT(&p->pfrkt_t, tbl++, sizeof(*tbl)))
1226                         return (EFAULT);
1227         }
1228         if (n) {
1229                 printf("pfr_get_tables: corruption detected (%d).\n", n);
1230                 return (ENOTTY);
1231         }
1232         *size = nn;
1233         return (0);
1234 }
1235
1236 int
1237 pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size,
1238         int flags)
1239 {
1240         struct pfr_ktable       *p;
1241         struct pfr_ktableworkq   workq;
1242         int                      s = 0, n, nn;
1243         long                     tzero = time_second;
1244
1245         ACCEPT_FLAGS(PFR_FLAG_ATOMIC|PFR_FLAG_ALLRSETS);
1246                                         /* XXX PFR_FLAG_CLSTATS disabled */
1247         n = nn = pfr_table_count(filter, flags);
1248         if (n < 0)
1249                 return (ENOENT);
1250         if (n > *size) {
1251                 *size = n;
1252                 return (0);
1253         }
1254         SLIST_INIT(&workq);
1255         if (flags & PFR_FLAG_ATOMIC)
1256                 s = splsoftnet();
1257         RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1258                 if (pfr_skip_table(filter, p, flags))
1259                         continue;
1260                 if (n-- <= 0)
1261                         continue;
1262                 if (!(flags & PFR_FLAG_ATOMIC))
1263                         s = splsoftnet();
1264                 if (COPYOUT(&p->pfrkt_ts, tbl++, sizeof(*tbl))) {
1265                         splx(s);
1266                         return (EFAULT);
1267                 }
1268                 if (!(flags & PFR_FLAG_ATOMIC))
1269                         splx(s);
1270                 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1271         }
1272         if (flags & PFR_FLAG_CLSTATS)
1273                 pfr_clstats_ktables(&workq, tzero,
1274                     flags & PFR_FLAG_ADDRSTOO);
1275         if (flags & PFR_FLAG_ATOMIC)
1276                 splx(s);
1277         if (n) {
1278                 printf("pfr_get_tstats: corruption detected (%d).\n", n);
1279                 return (ENOTTY);
1280         }
1281         *size = nn;
1282         return (0);
1283 }
1284
1285 int
1286 pfr_clr_tstats(struct pfr_table *tbl, int size, int *nzero, int flags)
1287 {
1288         struct pfr_ktableworkq   workq;
1289         struct pfr_ktable       *p, key;
1290         int                      i, s = 0, xzero = 0;
1291         long                     tzero = time_second;
1292
1293         ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_ADDRSTOO);
1294         SLIST_INIT(&workq);
1295         for (i = 0; i < size; i++) {
1296                 if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t)))
1297                         return (EFAULT);
1298                 if (pfr_validate_table(&key.pfrkt_t, 0, 0))
1299                         return (EINVAL);
1300                 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1301                 if (p != NULL) {
1302                         SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1303                         xzero++;
1304                 }
1305         }
1306         if (!(flags & PFR_FLAG_DUMMY)) {
1307                 if (flags & PFR_FLAG_ATOMIC)
1308                         s = splsoftnet();
1309                 pfr_clstats_ktables(&workq, tzero, flags & PFR_FLAG_ADDRSTOO);
1310                 if (flags & PFR_FLAG_ATOMIC)
1311                         splx(s);
1312         }
1313         if (nzero != NULL)
1314                 *nzero = xzero;
1315         return (0);
1316 }
1317
1318 int
1319 pfr_set_tflags(struct pfr_table *tbl, int size, int setflag, int clrflag,
1320         int *nchange, int *ndel, int flags)
1321 {
1322         struct pfr_ktableworkq   workq;
1323         struct pfr_ktable       *p, *q, key;
1324         int                      i, s = 0, xchange = 0, xdel = 0;
1325
1326         ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY);
1327         if ((setflag & ~PFR_TFLAG_USRMASK) ||
1328             (clrflag & ~PFR_TFLAG_USRMASK) ||
1329             (setflag & clrflag))
1330                 return (EINVAL);
1331         SLIST_INIT(&workq);
1332         for (i = 0; i < size; i++) {
1333                 if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t)))
1334                         return (EFAULT);
1335                 if (pfr_validate_table(&key.pfrkt_t, 0,
1336                     flags & PFR_FLAG_USERIOCTL))
1337                         return (EINVAL);
1338                 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1339                 if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1340                         p->pfrkt_nflags = (p->pfrkt_flags | setflag) &
1341                             ~clrflag;
1342                         if (p->pfrkt_nflags == p->pfrkt_flags)
1343                                 goto _skip;
1344                         SLIST_FOREACH(q, &workq, pfrkt_workq)
1345                                 if (!pfr_ktable_compare(p, q))
1346                                         goto _skip;
1347                         SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1348                         if ((p->pfrkt_flags & PFR_TFLAG_PERSIST) &&
1349                             (clrflag & PFR_TFLAG_PERSIST) &&
1350                             !(p->pfrkt_flags & PFR_TFLAG_REFERENCED))
1351                                 xdel++;
1352                         else
1353                                 xchange++;
1354                 }
1355 _skip:
1356         ;
1357         }
1358         if (!(flags & PFR_FLAG_DUMMY)) {
1359                 if (flags & PFR_FLAG_ATOMIC)
1360                         s = splsoftnet();
1361                 pfr_setflags_ktables(&workq);
1362                 if (flags & PFR_FLAG_ATOMIC)
1363                         splx(s);
1364         }
1365         if (nchange != NULL)
1366                 *nchange = xchange;
1367         if (ndel != NULL)
1368                 *ndel = xdel;
1369         return (0);
1370 }
1371
1372 int
1373 pfr_ina_begin(struct pfr_table *trs, u_int32_t *ticket, int *ndel, int flags)
1374 {
1375         struct pfr_ktableworkq   workq;
1376         struct pfr_ktable       *p;
1377         struct pf_ruleset       *rs;
1378         int                      xdel = 0;
1379
1380         ACCEPT_FLAGS(PFR_FLAG_DUMMY);
1381         rs = pf_find_or_create_ruleset(trs->pfrt_anchor, trs->pfrt_ruleset);
1382         if (rs == NULL)
1383                 return (ENOMEM);
1384         SLIST_INIT(&workq);
1385         RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1386                 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1387                     pfr_skip_table(trs, p, 0))
1388                         continue;
1389                 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1390                 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1391                 xdel++;
1392         }
1393         if (!(flags & PFR_FLAG_DUMMY)) {
1394                 pfr_setflags_ktables(&workq);
1395                 if (ticket != NULL)
1396                         *ticket = ++rs->tticket;
1397                 rs->topen = 1;
1398         } else
1399                 pf_remove_if_empty_ruleset(rs);
1400         if (ndel != NULL)
1401                 *ndel = xdel;
1402         return (0);
1403 }
1404
1405 int
1406 pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size,
1407     int *nadd, int *naddr, u_int32_t ticket, int flags)
1408 {
1409         struct pfr_ktableworkq   tableq;
1410         struct pfr_kentryworkq   addrq;
1411         struct pfr_ktable       *kt, *rt, *shadow, key;
1412         struct pfr_kentry       *p;
1413         struct pfr_addr          ad;
1414         struct pf_ruleset       *rs;
1415         int                      i, rv, xadd = 0, xaddr = 0;
1416
1417         ACCEPT_FLAGS(PFR_FLAG_DUMMY|PFR_FLAG_ADDRSTOO);
1418         if (size && !(flags & PFR_FLAG_ADDRSTOO))
1419                 return (EINVAL);
1420         if (pfr_validate_table(tbl, PFR_TFLAG_USRMASK,
1421             flags & PFR_FLAG_USERIOCTL))
1422                 return (EINVAL);
1423         rs = pf_find_ruleset(tbl->pfrt_anchor, tbl->pfrt_ruleset);
1424         if (rs == NULL || !rs->topen || ticket != rs->tticket)
1425                 return (EBUSY);
1426         tbl->pfrt_flags |= PFR_TFLAG_INACTIVE;
1427         SLIST_INIT(&tableq);
1428         kt = RB_FIND(pfr_ktablehead, &pfr_ktables, (struct pfr_ktable *)tbl);
1429         if (kt == NULL) {
1430                 kt = pfr_create_ktable(tbl, 0, 1);
1431                 if (kt == NULL)
1432                         return (ENOMEM);
1433                 SLIST_INSERT_HEAD(&tableq, kt, pfrkt_workq);
1434                 xadd++;
1435                 if (!tbl->pfrt_anchor[0])
1436                         goto _skip;
1437
1438                 /* find or create root table */
1439                 bzero(&key, sizeof(key));
1440                 strlcpy(key.pfrkt_name, tbl->pfrt_name, sizeof(key.pfrkt_name));
1441                 rt = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1442                 if (rt != NULL) {
1443                         kt->pfrkt_root = rt;
1444                         goto _skip;
1445                 }
1446                 rt = pfr_create_ktable(&key.pfrkt_t, 0, 1);
1447                 if (rt == NULL) {
1448                         pfr_destroy_ktables(&tableq, 0);
1449                         return (ENOMEM);
1450                 }
1451                 SLIST_INSERT_HEAD(&tableq, rt, pfrkt_workq);
1452                 kt->pfrkt_root = rt;
1453         } else if (!(kt->pfrkt_flags & PFR_TFLAG_INACTIVE))
1454                 xadd++;
1455 _skip:
1456         shadow = pfr_create_ktable(tbl, 0, 0);
1457         if (shadow == NULL) {
1458                 pfr_destroy_ktables(&tableq, 0);
1459                 return (ENOMEM);
1460         }
1461         SLIST_INIT(&addrq);
1462         for (i = 0; i < size; i++) {
1463                 if (COPYIN(addr+i, &ad, sizeof(ad)))
1464                         senderr(EFAULT);
1465                 if (pfr_validate_addr(&ad))
1466                         senderr(EINVAL);
1467                 if (pfr_lookup_addr(shadow, &ad, 1) != NULL)
1468                         continue;
1469                 p = pfr_create_kentry(&ad);
1470                 if (p == NULL)
1471                         senderr(ENOMEM);
1472                 if (pfr_route_kentry(shadow, p)) {
1473                         pfr_destroy_kentry(p);
1474                         continue;
1475                 }
1476                 SLIST_INSERT_HEAD(&addrq, p, pfrke_workq);
1477                 xaddr++;
1478         }
1479         if (!(flags & PFR_FLAG_DUMMY)) {
1480                 if (kt->pfrkt_shadow != NULL)
1481                         pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1482                 kt->pfrkt_flags |= PFR_TFLAG_INACTIVE;
1483                 pfr_insert_ktables(&tableq);
1484                 shadow->pfrkt_cnt = (flags & PFR_FLAG_ADDRSTOO) ?
1485                     xaddr : NO_ADDRESSES;
1486                 kt->pfrkt_shadow = shadow;
1487         } else {
1488                 pfr_clean_node_mask(shadow, &addrq);
1489                 pfr_destroy_ktable(shadow, 0);
1490                 pfr_destroy_ktables(&tableq, 0);
1491                 pfr_destroy_kentries(&addrq);
1492         }
1493         if (nadd != NULL)
1494                 *nadd = xadd;
1495         if (naddr != NULL)
1496                 *naddr = xaddr;
1497         return (0);
1498 _bad:
1499         pfr_destroy_ktable(shadow, 0);
1500         pfr_destroy_ktables(&tableq, 0);
1501         pfr_destroy_kentries(&addrq);
1502         return (rv);
1503 }
1504
1505 int
1506 pfr_ina_rollback(struct pfr_table *trs, u_int32_t ticket, int *ndel, int flags)
1507 {
1508         struct pfr_ktableworkq   workq;
1509         struct pfr_ktable       *p;
1510         struct pf_ruleset       *rs;
1511         int                      xdel = 0;
1512
1513         ACCEPT_FLAGS(PFR_FLAG_DUMMY);
1514         rs = pf_find_ruleset(trs->pfrt_anchor, trs->pfrt_ruleset);
1515         if (rs == NULL || !rs->topen || ticket != rs->tticket)
1516                 return (0);
1517         SLIST_INIT(&workq);
1518         RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1519                 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1520                     pfr_skip_table(trs, p, 0))
1521                         continue;
1522                 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1523                 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1524                 xdel++;
1525         }
1526         if (!(flags & PFR_FLAG_DUMMY)) {
1527                 pfr_setflags_ktables(&workq);
1528                 rs->topen = 0;
1529                 pf_remove_if_empty_ruleset(rs);
1530         }
1531         if (ndel != NULL)
1532                 *ndel = xdel;
1533         return (0);
1534 }
1535
1536 int
1537 pfr_ina_commit(struct pfr_table *trs, u_int32_t ticket, int *nadd,
1538     int *nchange, int flags)
1539 {
1540         struct pfr_ktable       *p;
1541         struct pfr_ktableworkq   workq;
1542         struct pf_ruleset       *rs;
1543         int                      s = 0, xadd = 0, xchange = 0;
1544         long                     tzero = time_second;
1545
1546         ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY);
1547         rs = pf_find_ruleset(trs->pfrt_anchor, trs->pfrt_ruleset);
1548         if (rs == NULL || !rs->topen || ticket != rs->tticket)
1549                 return (EBUSY);
1550
1551         SLIST_INIT(&workq);
1552         RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1553                 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1554                     pfr_skip_table(trs, p, 0))
1555                         continue;
1556                 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1557                 if (p->pfrkt_flags & PFR_TFLAG_ACTIVE)
1558                         xchange++;
1559                 else
1560                         xadd++;
1561         }
1562
1563         if (!(flags & PFR_FLAG_DUMMY)) {
1564                 if (flags & PFR_FLAG_ATOMIC)
1565                         s = splsoftnet();
1566                 SLIST_FOREACH(p, &workq, pfrkt_workq)
1567                         pfr_commit_ktable(p, tzero);
1568                 if (flags & PFR_FLAG_ATOMIC)
1569                         splx(s);
1570                 rs->topen = 0;
1571                 pf_remove_if_empty_ruleset(rs);
1572         }
1573         if (nadd != NULL)
1574                 *nadd = xadd;
1575         if (nchange != NULL)
1576                 *nchange = xchange;
1577
1578         return (0);
1579 }
1580
1581 void
1582 pfr_commit_ktable(struct pfr_ktable *kt, long tzero)
1583 {
1584         struct pfr_ktable       *shadow = kt->pfrkt_shadow;
1585         int                      nflags;
1586
1587         if (shadow->pfrkt_cnt == NO_ADDRESSES) {
1588                 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1589                         pfr_clstats_ktable(kt, tzero, 1);
1590         } else if (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) {
1591                 /* kt might contain addresses */
1592                 struct pfr_kentryworkq   addrq, addq, changeq, delq, garbageq;
1593                 struct pfr_kentry       *p, *q, *next;
1594                 struct pfr_addr          ad;
1595
1596                 pfr_enqueue_addrs(shadow, &addrq, NULL, 0);
1597                 pfr_mark_addrs(kt);
1598                 SLIST_INIT(&addq);
1599                 SLIST_INIT(&changeq);
1600                 SLIST_INIT(&delq);
1601                 SLIST_INIT(&garbageq);
1602                 pfr_clean_node_mask(shadow, &addrq);
1603                 for (p = SLIST_FIRST(&addrq); p != NULL; p = next) {
1604                         next = SLIST_NEXT(p, pfrke_workq);      /* XXX */
1605                         pfr_copyout_addr(&ad, p);
1606                         q = pfr_lookup_addr(kt, &ad, 1);
1607                         if (q != NULL) {
1608                                 if (q->pfrke_not != p->pfrke_not)
1609                                         SLIST_INSERT_HEAD(&changeq, q,
1610                                             pfrke_workq);
1611                                 q->pfrke_mark = 1;
1612                                 SLIST_INSERT_HEAD(&garbageq, p, pfrke_workq);
1613                         } else {
1614                                 p->pfrke_tzero = tzero;
1615                                 SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
1616                         }
1617                 }
1618                 pfr_enqueue_addrs(kt, &delq, NULL, ENQUEUE_UNMARKED_ONLY);
1619                 pfr_insert_kentries(kt, &addq, tzero);
1620                 pfr_remove_kentries(kt, &delq);
1621                 pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
1622                 pfr_destroy_kentries(&garbageq);
1623         } else {
1624                 /* kt cannot contain addresses */
1625                 SWAP(struct radix_node_head *, kt->pfrkt_ip4,
1626                     shadow->pfrkt_ip4);
1627                 SWAP(struct radix_node_head *, kt->pfrkt_ip6,
1628                     shadow->pfrkt_ip6);
1629                 SWAP(int, kt->pfrkt_cnt, shadow->pfrkt_cnt);
1630                 pfr_clstats_ktable(kt, tzero, 1);
1631         }
1632         nflags = ((shadow->pfrkt_flags & PFR_TFLAG_USRMASK) |
1633             (kt->pfrkt_flags & PFR_TFLAG_SETMASK) | PFR_TFLAG_ACTIVE)
1634                 & ~PFR_TFLAG_INACTIVE;
1635         pfr_destroy_ktable(shadow, 0);
1636         kt->pfrkt_shadow = NULL;
1637         pfr_setflags_ktable(kt, nflags);
1638 }
1639
1640 int
1641 pfr_validate_table(struct pfr_table *tbl, int allowedflags, int no_reserved)
1642 {
1643         int i;
1644
1645         if (!tbl->pfrt_name[0])
1646                 return (-1);
1647         if (no_reserved && !strcmp(tbl->pfrt_anchor, PF_RESERVED_ANCHOR))
1648                  return (-1);
1649         if (tbl->pfrt_name[PF_TABLE_NAME_SIZE-1])
1650                 return (-1);
1651         for (i = strlen(tbl->pfrt_name); i < PF_TABLE_NAME_SIZE; i++)
1652                 if (tbl->pfrt_name[i])
1653                         return (-1);
1654         if (tbl->pfrt_flags & ~allowedflags)
1655                 return (-1);
1656         return (0);
1657 }
1658
1659 int
1660 pfr_table_count(struct pfr_table *filter, int flags)
1661 {
1662         struct pf_ruleset *rs;
1663         struct pf_anchor *ac;
1664
1665         if (flags & PFR_FLAG_ALLRSETS)
1666                 return (pfr_ktable_cnt);
1667         if (filter->pfrt_ruleset[0]) {
1668                 rs = pf_find_ruleset(filter->pfrt_anchor,
1669                     filter->pfrt_ruleset);
1670                 return ((rs != NULL) ? rs->tables : -1);
1671         }
1672         if (filter->pfrt_anchor[0]) {
1673                 ac = pf_find_anchor(filter->pfrt_anchor);
1674                 return ((ac != NULL) ? ac->tables : -1);
1675         }
1676         return (pf_main_ruleset.tables);
1677 }
1678
1679 int
1680 pfr_skip_table(struct pfr_table *filter, struct pfr_ktable *kt, int flags)
1681 {
1682         if (flags & PFR_FLAG_ALLRSETS)
1683                 return (0);
1684         if (strncmp(filter->pfrt_anchor, kt->pfrkt_anchor,
1685             PF_ANCHOR_NAME_SIZE))
1686                 return (1);
1687         if (!filter->pfrt_ruleset[0])
1688                 return (0);
1689         if (strncmp(filter->pfrt_ruleset, kt->pfrkt_ruleset,
1690             PF_RULESET_NAME_SIZE))
1691                 return (1);
1692         return (0);
1693 }
1694
1695 void
1696 pfr_insert_ktables(struct pfr_ktableworkq *workq)
1697 {
1698         struct pfr_ktable       *p;
1699
1700         SLIST_FOREACH(p, workq, pfrkt_workq)
1701                 pfr_insert_ktable(p);
1702 }
1703
1704 void
1705 pfr_insert_ktable(struct pfr_ktable *kt)
1706 {
1707         RB_INSERT(pfr_ktablehead, &pfr_ktables, kt);
1708         pfr_ktable_cnt++;
1709         if (kt->pfrkt_root != NULL)
1710                 if (!kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]++)
1711                         pfr_setflags_ktable(kt->pfrkt_root,
1712                             kt->pfrkt_root->pfrkt_flags|PFR_TFLAG_REFDANCHOR);
1713 }
1714
1715 void
1716 pfr_setflags_ktables(struct pfr_ktableworkq *workq)
1717 {
1718         struct pfr_ktable       *p;
1719
1720         SLIST_FOREACH(p, workq, pfrkt_workq)
1721                 pfr_setflags_ktable(p, p->pfrkt_nflags);
1722 }
1723
1724 void
1725 pfr_setflags_ktable(struct pfr_ktable *kt, int newf)
1726 {
1727         struct pfr_kentryworkq  addrq;
1728
1729         if (!(newf & PFR_TFLAG_REFERENCED) &&
1730             !(newf & PFR_TFLAG_PERSIST))
1731                 newf &= ~PFR_TFLAG_ACTIVE;
1732         if (!(newf & PFR_TFLAG_ACTIVE))
1733                 newf &= ~PFR_TFLAG_USRMASK;
1734         if (!(newf & PFR_TFLAG_SETMASK)) {
1735                 RB_REMOVE(pfr_ktablehead, &pfr_ktables, kt);
1736                 if (kt->pfrkt_root != NULL)
1737                         if (!--kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR])
1738                                 pfr_setflags_ktable(kt->pfrkt_root,
1739                                     kt->pfrkt_root->pfrkt_flags &
1740                                         ~PFR_TFLAG_REFDANCHOR);
1741                 pfr_destroy_ktable(kt, 1);
1742                 pfr_ktable_cnt--;
1743                 return;
1744         }
1745         if (!(newf & PFR_TFLAG_ACTIVE) && kt->pfrkt_cnt) {
1746                 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1747                 pfr_remove_kentries(kt, &addrq);
1748         }
1749         if (!(newf & PFR_TFLAG_INACTIVE) && kt->pfrkt_shadow != NULL) {
1750                 pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1751                 kt->pfrkt_shadow = NULL;
1752         }
1753         kt->pfrkt_flags = newf;
1754 }
1755
1756 void
1757 pfr_clstats_ktables(struct pfr_ktableworkq *workq, long tzero, int recurse)
1758 {
1759         struct pfr_ktable       *p;
1760
1761         SLIST_FOREACH(p, workq, pfrkt_workq)
1762                 pfr_clstats_ktable(p, tzero, recurse);
1763 }
1764
1765 void
1766 pfr_clstats_ktable(struct pfr_ktable *kt, long tzero, int recurse)
1767 {
1768         struct pfr_kentryworkq   addrq;
1769         int                      s;
1770
1771         if (recurse) {
1772                 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1773                 pfr_clstats_kentries(&addrq, tzero, 0);
1774         }
1775         s = splsoftnet();
1776         bzero(kt->pfrkt_packets, sizeof(kt->pfrkt_packets));
1777         bzero(kt->pfrkt_bytes, sizeof(kt->pfrkt_bytes));
1778         kt->pfrkt_match = kt->pfrkt_nomatch = 0;
1779         splx(s);
1780         kt->pfrkt_tzero = tzero;
1781 }
1782
1783 struct pfr_ktable *
1784 pfr_create_ktable(struct pfr_table *tbl, long tzero, int attachruleset)
1785 {
1786         struct pfr_ktable       *kt;
1787         struct pf_ruleset       *rs;
1788
1789         kt = pool_get(&pfr_ktable_pl, PR_NOWAIT);
1790         if (kt == NULL)
1791                 return (NULL);
1792         bzero(kt, sizeof(*kt));
1793         kt->pfrkt_t = *tbl;
1794
1795         if (attachruleset) {
1796                 rs = pf_find_or_create_ruleset(tbl->pfrt_anchor,
1797                     tbl->pfrt_ruleset);
1798                 if (!rs) {
1799                         pfr_destroy_ktable(kt, 0);
1800                         return (NULL);
1801                 }
1802                 kt->pfrkt_rs = rs;
1803                 rs->tables++;
1804                 if (rs->anchor != NULL)
1805                         rs->anchor->tables++;
1806         }
1807
1808         if (!rn_inithead((void **)&kt->pfrkt_ip4,
1809             offsetof(struct sockaddr_in, sin_addr) * 8) ||
1810             !rn_inithead((void **)&kt->pfrkt_ip6,
1811             offsetof(struct sockaddr_in6, sin6_addr) * 8)) {
1812                 pfr_destroy_ktable(kt, 0);
1813                 return (NULL);
1814         }
1815         kt->pfrkt_tzero = tzero;
1816
1817         return (kt);
1818 }
1819
1820 void
1821 pfr_destroy_ktables(struct pfr_ktableworkq *workq, int flushaddr)
1822 {
1823         struct pfr_ktable       *p, *q;
1824
1825         for (p = SLIST_FIRST(workq); p; p = q) {
1826                 q = SLIST_NEXT(p, pfrkt_workq);
1827                 pfr_destroy_ktable(p, flushaddr);
1828         }
1829 }
1830
1831 void
1832 pfr_destroy_ktable(struct pfr_ktable *kt, int flushaddr)
1833 {
1834         struct pfr_kentryworkq   addrq;
1835
1836         if (flushaddr) {
1837                 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1838                 pfr_clean_node_mask(kt, &addrq);
1839                 pfr_destroy_kentries(&addrq);
1840         }
1841         if (kt->pfrkt_ip4 != NULL)
1842                 free((caddr_t)kt->pfrkt_ip4, M_RTABLE);
1843         if (kt->pfrkt_ip6 != NULL)
1844                 free((caddr_t)kt->pfrkt_ip6, M_RTABLE);
1845         if (kt->pfrkt_shadow != NULL)
1846                 pfr_destroy_ktable(kt->pfrkt_shadow, flushaddr);
1847         if (kt->pfrkt_rs != NULL) {
1848                 kt->pfrkt_rs->tables--;
1849                 if (kt->pfrkt_rs->anchor != NULL)
1850                         kt->pfrkt_rs->anchor->tables--;
1851                 pf_remove_if_empty_ruleset(kt->pfrkt_rs);
1852         }
1853         pool_put(&pfr_ktable_pl, kt);
1854 }
1855
1856 int
1857 pfr_ktable_compare(struct pfr_ktable *p, struct pfr_ktable *q)
1858 {
1859         int d;
1860
1861         if ((d = strncmp(p->pfrkt_name, q->pfrkt_name, PF_TABLE_NAME_SIZE)))
1862                 return (d);
1863         if ((d = strncmp(p->pfrkt_anchor, q->pfrkt_anchor,
1864             PF_ANCHOR_NAME_SIZE)))
1865                 return (d);
1866         return (strncmp(p->pfrkt_ruleset, q->pfrkt_ruleset,
1867             PF_RULESET_NAME_SIZE));
1868 }
1869
1870 struct pfr_ktable *
1871 pfr_lookup_table(struct pfr_table *tbl)
1872 {
1873         /* struct pfr_ktable start like a struct pfr_table */
1874         return (RB_FIND(pfr_ktablehead, &pfr_ktables,
1875             (struct pfr_ktable *)tbl));
1876 }
1877
1878 int
1879 pfr_match_addr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af)
1880 {
1881         struct pfr_kentry       *ke = NULL;
1882         int                      match;
1883
1884         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
1885                 kt = kt->pfrkt_root;
1886         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1887                 return (0);
1888
1889         switch (af) {
1890         case AF_INET:
1891                 pfr_sin.sin_addr.s_addr = a->addr32[0];
1892                 ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4);
1893                 if (ke && KENTRY_RNF_ROOT(ke))
1894                         ke = NULL;
1895                 break;
1896         case AF_INET6:
1897                 bcopy(a, &pfr_sin6.sin6_addr, sizeof(pfr_sin6.sin6_addr));
1898                 ke = (struct pfr_kentry *)rn_match(&pfr_sin6, kt->pfrkt_ip6);
1899                 if (ke && KENTRY_RNF_ROOT(ke))
1900                         ke = NULL;
1901                 break;
1902         }
1903         match = (ke && !ke->pfrke_not);
1904         if (match)
1905                 kt->pfrkt_match++;
1906         else
1907                 kt->pfrkt_nomatch++;
1908         return (match);
1909 }
1910
1911 void
1912 pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af,
1913     u_int64_t len, int dir_out, int op_pass, int notrule)
1914 {
1915         struct pfr_kentry       *ke = NULL;
1916
1917         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
1918                 kt = kt->pfrkt_root;
1919         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1920                 return;
1921
1922         switch (af) {
1923         case AF_INET:
1924                 pfr_sin.sin_addr.s_addr = a->addr32[0];
1925                 ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4);
1926                 if (ke && KENTRY_RNF_ROOT(ke))
1927                         ke = NULL;
1928                 break;
1929         case AF_INET6:
1930                 bcopy(a, &pfr_sin6.sin6_addr, sizeof(pfr_sin6.sin6_addr));
1931                 ke = (struct pfr_kentry *)rn_match(&pfr_sin6, kt->pfrkt_ip6);
1932                 if (ke && KENTRY_RNF_ROOT(ke))
1933                         ke = NULL;
1934                 break;
1935         }
1936         if ((ke == NULL || ke->pfrke_not) != notrule) {
1937                 if (op_pass != PFR_OP_PASS)
1938                         printf("pfr_update_stats: assertion failed.\n");
1939                 op_pass = PFR_OP_XPASS;
1940         }
1941         kt->pfrkt_packets[dir_out][op_pass]++;
1942         kt->pfrkt_bytes[dir_out][op_pass] += len;
1943         if (ke != NULL && op_pass != PFR_OP_XPASS) {
1944                 ke->pfrke_packets[dir_out][op_pass]++;
1945                 ke->pfrke_bytes[dir_out][op_pass] += len;
1946         }
1947 }
1948
1949 struct pfr_ktable *
1950 pfr_attach_table(struct pf_ruleset *rs, char *name)
1951 {
1952         struct pfr_ktable       *kt, *rt;
1953         struct pfr_table         tbl;
1954         struct pf_anchor        *ac = rs->anchor;
1955
1956         bzero(&tbl, sizeof(tbl));
1957         strlcpy(tbl.pfrt_name, name, sizeof(tbl.pfrt_name));
1958         if (ac != NULL) {
1959                 strlcpy(tbl.pfrt_anchor, ac->name, sizeof(tbl.pfrt_anchor));
1960                 strlcpy(tbl.pfrt_ruleset, rs->name, sizeof(tbl.pfrt_ruleset));
1961         }
1962         kt = pfr_lookup_table(&tbl);
1963         if (kt == NULL) {
1964                 kt = pfr_create_ktable(&tbl, time_second, 1);
1965                 if (kt == NULL)
1966                         return (NULL);
1967                 if (ac != NULL) {
1968                         bzero(tbl.pfrt_anchor, sizeof(tbl.pfrt_anchor));
1969                         bzero(tbl.pfrt_ruleset, sizeof(tbl.pfrt_ruleset));
1970                         rt = pfr_lookup_table(&tbl);
1971                         if (rt == NULL) {
1972                                 rt = pfr_create_ktable(&tbl, 0, 1);
1973                                 if (rt == NULL) {
1974                                         pfr_destroy_ktable(kt, 0);
1975                                         return (NULL);
1976                                 }
1977                                 pfr_insert_ktable(rt);
1978                         }
1979                         kt->pfrkt_root = rt;
1980                 }
1981                 pfr_insert_ktable(kt);
1982         }
1983         if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++)
1984                 pfr_setflags_ktable(kt, kt->pfrkt_flags|PFR_TFLAG_REFERENCED);
1985         return (kt);
1986 }
1987
1988 void
1989 pfr_detach_table(struct pfr_ktable *kt)
1990 {
1991         if (kt->pfrkt_refcnt[PFR_REFCNT_RULE] <= 0)
1992                 printf("pfr_detach_table: refcount = %d.\n",
1993                     kt->pfrkt_refcnt[PFR_REFCNT_RULE]);
1994         else if (!--kt->pfrkt_refcnt[PFR_REFCNT_RULE])
1995                 pfr_setflags_ktable(kt, kt->pfrkt_flags&~PFR_TFLAG_REFERENCED);
1996 }
1997
1998 int
1999 pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter,
2000     struct pf_addr **raddr, struct pf_addr **rmask, sa_family_t af)
2001 {
2002         struct pfr_kentry       *ke, *ke2;
2003         struct pf_addr          *addr;
2004         union sockaddr_union     mask;
2005         int                      idx = -1, use_counter = 0;
2006
2007         addr = (af == AF_INET) ? (struct pf_addr *)&pfr_sin.sin_addr :
2008             (struct pf_addr *)&pfr_sin6.sin6_addr;
2009         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2010                 kt = kt->pfrkt_root;
2011         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2012                 return (-1);
2013
2014         if (pidx != NULL)
2015                 idx = *pidx;
2016         if (counter != NULL && idx >= 0)
2017                 use_counter = 1;
2018         if (idx < 0)
2019                 idx = 0;
2020
2021 _next_block:
2022         ke = pfr_kentry_byidx(kt, idx, af);
2023         if (ke == NULL)
2024                 return (1);
2025         pfr_prepare_network(&pfr_mask, af, ke->pfrke_net);
2026         *raddr = SUNION2PF(&ke->pfrke_sa, af);
2027         *rmask = SUNION2PF(&pfr_mask, af);
2028
2029         if (use_counter) {
2030                 /* is supplied address within block? */
2031                 if (!PF_MATCHA(0, *raddr, *rmask, counter, af)) {
2032                         /* no, go to next block in table */
2033                         idx++;
2034                         use_counter = 0;
2035                         goto _next_block;
2036                 }
2037                 PF_ACPY(addr, counter, af);
2038         } else {
2039                 /* use first address of block */
2040                 PF_ACPY(addr, *raddr, af);
2041         }
2042
2043         if (!KENTRY_NETWORK(ke)) {
2044                 /* this is a single IP address - no possible nested block */
2045                 PF_ACPY(counter, addr, af);
2046                 *pidx = idx;
2047                 return (0);
2048         }
2049         for (;;) {
2050                 /* we don't want to use a nested block */
2051                 ke2 = (struct pfr_kentry *)(af == AF_INET ?
2052                     rn_match(&pfr_sin, kt->pfrkt_ip4) :
2053                     rn_match(&pfr_sin6, kt->pfrkt_ip6));
2054                 /* no need to check KENTRY_RNF_ROOT() here */
2055                 if (ke2 == ke) {
2056                         /* lookup return the same block - perfect */
2057                         PF_ACPY(counter, addr, af);
2058                         *pidx = idx;
2059                         return (0);
2060                 }
2061
2062                 /* we need to increase the counter past the nested block */
2063                 pfr_prepare_network(&mask, AF_INET, ke2->pfrke_net);
2064                 PF_POOLMASK(addr, addr, SUNION2PF(&mask, af), &pfr_ffaddr, af);
2065                 PF_AINC(addr, af);
2066                 if (!PF_MATCHA(0, *raddr, *rmask, addr, af)) {
2067                         /* ok, we reached the end of our main block */
2068                         /* go to next block in table */
2069                         idx++;
2070                         use_counter = 0;
2071                         goto _next_block;
2072                 }
2073         }
2074 }
2075
2076 struct pfr_kentry *
2077 pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af)
2078 {
2079         struct pfr_walktree     w;
2080
2081         bzero(&w, sizeof(w));
2082         w.pfrw_op = PFRW_POOL_GET;
2083         w.pfrw_cnt = idx;
2084
2085         switch (af) {
2086         case AF_INET:
2087                 kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
2088                 return (w.pfrw_kentry);
2089         case AF_INET6:
2090                 kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
2091                 return (w.pfrw_kentry);
2092         default:
2093                 return (NULL);
2094         }
2095 }
2096
2097 void
2098 pfr_dynaddr_update(struct pfr_ktable *kt, struct pfi_dynaddr *dyn)
2099 {
2100         struct pfr_walktree     w;
2101         int                     s;
2102
2103         bzero(&w, sizeof(w));
2104         w.pfrw_op = PFRW_DYNADDR_UPDATE;
2105         w.pfrw_dyn = dyn;
2106
2107         s = splsoftnet();
2108         dyn->pfid_acnt4 = 0;
2109         dyn->pfid_acnt6 = 0;
2110         if (!dyn->pfid_af || dyn->pfid_af == AF_INET)
2111                 kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
2112         if (!dyn->pfid_af || dyn->pfid_af == AF_INET6)
2113                 kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
2114         splx(s);
2115 }