sys/net/pf/pf_table.c

   1 /*      $OpenBSD: pf_table.c,v 1.78 2008/06/14 03:50:14 art Exp $       */
   2
   3 /*
   4  * Copyright (c) 2010 The DragonFly Project.  All rights reserved.
   5  *
   6  * Copyright (c) 2002 Cedric Berger
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  *
  13  *    - Redistributions of source code must retain the above copyright
  14  *      notice, this list of conditions and the following disclaimer.
  15  *    - Redistributions in binary form must reproduce the above
  16  *      copyright notice, this list of conditions and the following
  17  *      disclaimer in the documentation and/or other materials provided
  18  *      with the distribution.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  24  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  27  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  28  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  30  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  31  * POSSIBILITY OF SUCH DAMAGE.
  32  *
  33  */
  34
  35 #include "opt_inet.h"
  36 #include "opt_inet6.h"
  37
  38 #include <sys/param.h>
  39 #include <sys/systm.h>
  40 #include <sys/socket.h>
  41 #include <sys/mbuf.h>
  42 #include <sys/kernel.h>
  43 #include <sys/malloc.h>
  44 #include <sys/thread2.h>
  45
  46 #include <net/if.h>
  47 #include <net/route.h>
  48 #include <netinet/in.h>
  49 #include <net/pf/pfvar.h>
  50
  51 #define ACCEPT_FLAGS(flags, oklist)             \
  52         do {                                    \
  53                 if ((flags & ~(oklist)) &       \
  54                     PFR_FLAG_ALLMASK)           \
  55                         return (EINVAL);        \
  56         } while (0)
  57
  58 #define COPYIN(from, to, size, flags)           \
  59         ((flags & PFR_FLAG_USERIOCTL) ?         \
  60         copyin((from), (to), (size)) :          \
  61         (bcopy((from), (to), (size)), 0))
  62
  63 #define COPYOUT(from, to, size, flags)          \
  64         ((flags & PFR_FLAG_USERIOCTL) ?         \
  65         copyout((from), (to), (size)) :         \
  66         (bcopy((from), (to), (size)), 0))
  67
  68 #define FILLIN_SIN(sin, addr)                   \
  69         do {                                    \
  70                 (sin).sin_len = sizeof(sin);    \
  71                 (sin).sin_family = AF_INET;     \
  72                 (sin).sin_addr = (addr);        \
  73         } while (0)
  74
  75 #define FILLIN_SIN6(sin6, addr)                 \
  76         do {                                    \
  77                 (sin6).sin6_len = sizeof(sin6); \
  78                 (sin6).sin6_family = AF_INET6;  \
  79                 (sin6).sin6_addr = (addr);      \
  80         } while (0)
  81
  82 #define SWAP(type, a1, a2)                      \
  83         do {                                    \
  84                 type tmp = a1;                  \
  85                 a1 = a2;                        \
  86                 a2 = tmp;                       \
  87         } while (0)
  88
  89 #define SUNION2PF(su, af) (((af)==AF_INET) ?    \
  90     (struct pf_addr *)&(su)->sin.sin_addr :     \
  91     (struct pf_addr *)&(su)->sin6.sin6_addr)
  92
  93 #define AF_BITS(af)             (((af)==AF_INET)?32:128)
  94 #define ADDR_NETWORK(ad)        ((ad)->pfra_net < AF_BITS((ad)->pfra_af))
  95 #define KENTRY_NETWORK(ke)      ((ke)->pfrke_net < AF_BITS((ke)->pfrke_af))
  96 #define KENTRY_RNF_ROOT(ke) \
  97                 ((((struct radix_node *)(ke))->rn_flags & RNF_ROOT) != 0)
  98
  99 #define NO_ADDRESSES            (-1)
 100 #define ENQUEUE_UNMARKED_ONLY   (1)
 101 #define INVERT_NEG_FLAG         (1)
 102
 103 static MALLOC_DEFINE(M_PFRKTABLEPL, "pfrktable", "pf radix table pool list");
 104 static MALLOC_DEFINE(M_PFRKENTRYPL, "pfrkentry", "pf radix entry pool list");
 105 static MALLOC_DEFINE(M_PFRKENTRYPL2, "pfrkentry2", "pf radix entry 2 pool list");
 106 static MALLOC_DEFINE(M_PFRKCOUNTERSPL, "pfrkcounters", "pf radix counters");
 107
 108 struct pfr_walktree {
 109         enum pfrw_op {
 110                 PFRW_MARK,
 111                 PFRW_SWEEP,
 112                 PFRW_ENQUEUE,
 113                 PFRW_GET_ADDRS,
 114                 PFRW_GET_ASTATS,
 115                 PFRW_POOL_GET,
 116                 PFRW_DYNADDR_UPDATE
 117         }        pfrw_op;
 118         union {
 119                 struct pfr_addr         *pfrw1_addr;
 120                 struct pfr_astats       *pfrw1_astats;
 121                 struct pfr_kentryworkq  *pfrw1_workq;
 122                 struct pfr_kentry       *pfrw1_kentry;
 123                 struct pfi_dynaddr      *pfrw1_dyn;
 124         }        pfrw_1;
 125         int      pfrw_free;
 126         int      pfrw_flags;
 127 };
 128 #define pfrw_addr       pfrw_1.pfrw1_addr
 129 #define pfrw_astats     pfrw_1.pfrw1_astats
 130 #define pfrw_workq      pfrw_1.pfrw1_workq
 131 #define pfrw_kentry     pfrw_1.pfrw1_kentry
 132 #define pfrw_dyn        pfrw_1.pfrw1_dyn
 133 #define pfrw_cnt        pfrw_free
 134
 135 #define senderr(e)      do { rv = (e); goto _bad; } while (0)
 136 struct malloc_type      *pfr_ktable_pl;
 137 struct malloc_type      *pfr_kentry_pl;
 138 struct malloc_type      *pfr_kentry_pl2;
 139 static struct pf_addr    pfr_ffaddr;            /* constant after setup */
 140
 141 void                     pfr_copyout_addr(struct pfr_addr *,
 142                             struct pfr_kentry *ke);
 143 int                      pfr_validate_addr(struct pfr_addr *);
 144 void                     pfr_enqueue_addrs(struct pfr_ktable *,
 145                             struct pfr_kentryworkq *, int *, int);
 146 void                     pfr_mark_addrs(struct pfr_ktable *);
 147 struct pfr_kentry       *pfr_lookup_addr(struct pfr_ktable *,
 148                             struct pfr_addr *, int);
 149 struct pfr_kentry       *pfr_create_kentry(struct pfr_addr *, int);
 150 void                     pfr_destroy_kentries(struct pfr_kentryworkq *);
 151 void                     pfr_destroy_kentry(struct pfr_kentry *);
 152 void                     pfr_insert_kentries(struct pfr_ktable *,
 153                             struct pfr_kentryworkq *, long);
 154 void                     pfr_remove_kentries(struct pfr_ktable *,
 155                             struct pfr_kentryworkq *);
 156 void                     pfr_clstats_kentries(struct pfr_kentryworkq *, long,
 157                             int);
 158 void                     pfr_reset_feedback(struct pfr_addr *, int, int);
 159 void                     pfr_prepare_network(union sockaddr_union *, int, int);
 160 int                      pfr_route_kentry(struct pfr_ktable *,
 161                             struct pfr_kentry *);
 162 int                      pfr_unroute_kentry(struct pfr_ktable *,
 163                             struct pfr_kentry *);
 164 int                      pfr_walktree(struct radix_node *, void *);
 165 int                      pfr_validate_table(struct pfr_table *, int, int);
 166 int                      pfr_fix_anchor(char *);
 167 void                     pfr_commit_ktable(struct pfr_ktable *, long);
 168 void                     pfr_insert_ktables(struct pfr_ktableworkq *);
 169 void                     pfr_insert_ktable(struct pfr_ktable *);
 170 void                     pfr_setflags_ktables(struct pfr_ktableworkq *);
 171 void                     pfr_setflags_ktable(struct pfr_ktable *, int);
 172 void                     pfr_clstats_ktables(struct pfr_ktableworkq *, long,
 173                             int);
 174 void                     pfr_clstats_ktable(struct pfr_ktable *, long, int);
 175 struct pfr_ktable       *pfr_create_ktable(struct pfr_table *, long, int);
 176 void                     pfr_destroy_ktables(struct pfr_ktableworkq *, int);
 177 void                     pfr_destroy_ktable(struct pfr_ktable *, int);
 178 int                      pfr_ktable_compare(struct pfr_ktable *,
 179                             struct pfr_ktable *);
 180 struct pfr_ktable       *pfr_lookup_table(struct pfr_table *);
 181 void                     pfr_clean_node_mask(struct pfr_ktable *,
 182                             struct pfr_kentryworkq *);
 183 int                      pfr_table_count(struct pfr_table *, int);
 184 int                      pfr_skip_table(struct pfr_table *,
 185                             struct pfr_ktable *, int);
 186 struct pfr_kentry       *pfr_kentry_byidx(struct pfr_ktable *, int, int);
 187
 188 RB_PROTOTYPE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
 189 RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
 190
 191 struct pfr_ktablehead    pfr_ktables;
 192 struct pfr_table         pfr_nulltable;
 193 int                      pfr_ktable_cnt;
 194
 195 void
 196 pfr_initialize(void)
 197 {
 198         memset(&pfr_ffaddr, 0xff, sizeof(pfr_ffaddr));
 199 }
 200
 201 int
 202 pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags)
 203 {
 204         struct pfr_ktable       *kt;
 205         struct pfr_kentryworkq   workq;
 206
 207         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
 208         if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
 209                 return (EINVAL);
 210         kt = pfr_lookup_table(tbl);
 211         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 212                 return (ESRCH);
 213         if (kt->pfrkt_flags & PFR_TFLAG_CONST)
 214                 return (EPERM);
 215         pfr_enqueue_addrs(kt, &workq, ndel, 0);
 216
 217         if (!(flags & PFR_FLAG_DUMMY)) {
 218                 if (flags & PFR_FLAG_ATOMIC)
 219                         crit_enter();
 220                 pfr_remove_kentries(kt, &workq);
 221                 if (flags & PFR_FLAG_ATOMIC)
 222                         crit_exit();
 223                 if (kt->pfrkt_cnt) {
 224                         kprintf("pfr_clr_addrs: corruption detected (%d).\n",
 225                             kt->pfrkt_cnt);
 226                         kt->pfrkt_cnt = 0;
 227                 }
 228         }
 229         return (0);
 230 }
 231
 232 int
 233 pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 234     int *nadd, int flags)
 235 {
 236         struct pfr_ktable       *kt, *tmpkt;
 237         struct pfr_kentryworkq   workq;
 238         struct pfr_kentry       *p, *q;
 239         struct pfr_addr          ad;
 240         int                      i, rv, xadd = 0;
 241         long                     tzero = time_second;
 242
 243         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
 244             PFR_FLAG_FEEDBACK);
 245         if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
 246                 return (EINVAL);
 247         kt = pfr_lookup_table(tbl);
 248         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 249                 return (ESRCH);
 250         if (kt->pfrkt_flags & PFR_TFLAG_CONST)
 251                 return (EPERM);
 252         tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0);
 253         if (tmpkt == NULL)
 254                 return (ENOMEM);
 255         SLIST_INIT(&workq);
 256         for (i = 0; i < size; i++) {
 257                 if (COPYIN(addr+i, &ad, sizeof(ad), flags))
 258                         senderr(EFAULT);
 259                 if (pfr_validate_addr(&ad))
 260                         senderr(EINVAL);
 261                 p = pfr_lookup_addr(kt, &ad, 1);
 262                 q = pfr_lookup_addr(tmpkt, &ad, 1);
 263                 if (flags & PFR_FLAG_FEEDBACK) {
 264                         if (q != NULL)
 265                                 ad.pfra_fback = PFR_FB_DUPLICATE;
 266                         else if (p == NULL)
 267                                 ad.pfra_fback = PFR_FB_ADDED;
 268                         else if (p->pfrke_not != ad.pfra_not)
 269                                 ad.pfra_fback = PFR_FB_CONFLICT;
 270                         else
 271                                 ad.pfra_fback = PFR_FB_NONE;
 272                 }
 273                 if (p == NULL && q == NULL) {
 274                         p = pfr_create_kentry(&ad,
 275                             !(flags & PFR_FLAG_USERIOCTL));
 276                         if (p == NULL)
 277                                 senderr(ENOMEM);
 278                         if (pfr_route_kentry(tmpkt, p)) {
 279                                 pfr_destroy_kentry(p);
 280                                 ad.pfra_fback = PFR_FB_NONE;
 281                         } else {
 282                                 SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
 283                                 xadd++;
 284                         }
 285                 }
 286                 if (flags & PFR_FLAG_FEEDBACK)
 287                         if (COPYOUT(&ad, addr+i, sizeof(ad), flags))
 288                                 senderr(EFAULT);
 289         }
 290         pfr_clean_node_mask(tmpkt, &workq);
 291         if (!(flags & PFR_FLAG_DUMMY)) {
 292                 if (flags & PFR_FLAG_ATOMIC)
 293                         crit_enter();
 294                 pfr_insert_kentries(kt, &workq, tzero);
 295                 if (flags & PFR_FLAG_ATOMIC)
 296                         crit_exit();
 297         } else
 298                 pfr_destroy_kentries(&workq);
 299         if (nadd != NULL)
 300                 *nadd = xadd;
 301         pfr_destroy_ktable(tmpkt, 0);
 302         return (0);
 303 _bad:
 304         pfr_clean_node_mask(tmpkt, &workq);
 305         pfr_destroy_kentries(&workq);
 306         if (flags & PFR_FLAG_FEEDBACK)
 307                 pfr_reset_feedback(addr, size, flags);
 308         pfr_destroy_ktable(tmpkt, 0);
 309         return (rv);
 310 }
 311
 312 int
 313 pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 314     int *ndel, int flags)
 315 {
 316         struct pfr_ktable       *kt;
 317         struct pfr_kentryworkq   workq;
 318         struct pfr_kentry       *p;
 319         struct pfr_addr          ad;
 320         int                      i, rv, xdel = 0, log = 1;
 321
 322         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
 323             PFR_FLAG_FEEDBACK);
 324         if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
 325                 return (EINVAL);
 326         kt = pfr_lookup_table(tbl);
 327         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 328                 return (ESRCH);
 329         if (kt->pfrkt_flags & PFR_TFLAG_CONST)
 330                 return (EPERM);
 331         /*
 332          * there are two algorithms to choose from here.
 333          * with:
 334          *   n: number of addresses to delete
 335          *   N: number of addresses in the table
 336          *
 337          * one is O(N) and is better for large 'n'
 338          * one is O(n*LOG(N)) and is better for small 'n'
 339          *
 340          * following code try to decide which one is best.
 341          */
 342         for (i = kt->pfrkt_cnt; i > 0; i >>= 1)
 343                 log++;
 344         if (size > kt->pfrkt_cnt/log) {
 345                 /* full table scan */
 346                 pfr_mark_addrs(kt);
 347         } else {
 348                 /* iterate over addresses to delete */
 349                 for (i = 0; i < size; i++) {
 350                         if (COPYIN(addr+i, &ad, sizeof(ad), flags))
 351                                 return (EFAULT);
 352                         if (pfr_validate_addr(&ad))
 353                                 return (EINVAL);
 354                         p = pfr_lookup_addr(kt, &ad, 1);
 355                         if (p != NULL)
 356                                 p->pfrke_mark = 0;
 357                 }
 358         }
 359         SLIST_INIT(&workq);
 360         for (i = 0; i < size; i++) {
 361                 if (COPYIN(addr+i, &ad, sizeof(ad), flags))
 362                         senderr(EFAULT);
 363                 if (pfr_validate_addr(&ad))
 364                         senderr(EINVAL);
 365                 p = pfr_lookup_addr(kt, &ad, 1);
 366                 if (flags & PFR_FLAG_FEEDBACK) {
 367                         if (p == NULL)
 368                                 ad.pfra_fback = PFR_FB_NONE;
 369                         else if (p->pfrke_not != ad.pfra_not)
 370                                 ad.pfra_fback = PFR_FB_CONFLICT;
 371                         else if (p->pfrke_mark)
 372                                 ad.pfra_fback = PFR_FB_DUPLICATE;
 373                         else
 374                                 ad.pfra_fback = PFR_FB_DELETED;
 375                 }
 376                 if (p != NULL && p->pfrke_not == ad.pfra_not &&
 377                     !p->pfrke_mark) {
 378                         p->pfrke_mark = 1;
 379                         SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
 380                         xdel++;
 381                 }
 382                 if (flags & PFR_FLAG_FEEDBACK)
 383                         if (COPYOUT(&ad, addr+i, sizeof(ad), flags))
 384                                 senderr(EFAULT);
 385         }
 386         if (!(flags & PFR_FLAG_DUMMY)) {
 387                 if (flags & PFR_FLAG_ATOMIC)
 388                         crit_enter();
 389                 pfr_remove_kentries(kt, &workq);
 390                 if (flags & PFR_FLAG_ATOMIC)
 391                         crit_exit();
 392         }
 393         if (ndel != NULL)
 394                 *ndel = xdel;
 395         return (0);
 396 _bad:
 397         if (flags & PFR_FLAG_FEEDBACK)
 398                 pfr_reset_feedback(addr, size, flags);
 399         return (rv);
 400 }
 401
 402 int
 403 pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 404     int *size2, int *nadd, int *ndel, int *nchange, int flags,
 405     u_int32_t ignore_pfrt_flags)
 406 {
 407         struct pfr_ktable       *kt, *tmpkt;
 408         struct pfr_kentryworkq   addq, delq, changeq;
 409         struct pfr_kentry       *p, *q;
 410         struct pfr_addr          ad;
 411         int                      i, rv, xadd = 0, xdel = 0, xchange = 0;
 412         long                     tzero = time_second;
 413
 414         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
 415             PFR_FLAG_FEEDBACK);
 416         if (pfr_validate_table(tbl, ignore_pfrt_flags, flags &
 417             PFR_FLAG_USERIOCTL))
 418                 return (EINVAL);
 419         kt = pfr_lookup_table(tbl);
 420         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 421                 return (ESRCH);
 422         if (kt->pfrkt_flags & PFR_TFLAG_CONST)
 423                 return (EPERM);
 424         tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0);
 425         if (tmpkt == NULL)
 426                 return (ENOMEM);
 427         pfr_mark_addrs(kt);
 428         SLIST_INIT(&addq);
 429         SLIST_INIT(&delq);
 430         SLIST_INIT(&changeq);
 431         for (i = 0; i < size; i++) {
 432                 if (COPYIN(addr+i, &ad, sizeof(ad), flags))
 433                         senderr(EFAULT);
 434                 if (pfr_validate_addr(&ad))
 435                         senderr(EINVAL);
 436                 ad.pfra_fback = PFR_FB_NONE;
 437                 p = pfr_lookup_addr(kt, &ad, 1);
 438                 if (p != NULL) {
 439                         if (p->pfrke_mark) {
 440                                 ad.pfra_fback = PFR_FB_DUPLICATE;
 441                                 goto _skip;
 442                         }
 443                         p->pfrke_mark = 1;
 444                         if (p->pfrke_not != ad.pfra_not) {
 445                                 SLIST_INSERT_HEAD(&changeq, p, pfrke_workq);
 446                                 ad.pfra_fback = PFR_FB_CHANGED;
 447                                 xchange++;
 448                         }
 449                 } else {
 450                         q = pfr_lookup_addr(tmpkt, &ad, 1);
 451                         if (q != NULL) {
 452                                 ad.pfra_fback = PFR_FB_DUPLICATE;
 453                                 goto _skip;
 454                         }
 455                         p = pfr_create_kentry(&ad,
 456                             !(flags & PFR_FLAG_USERIOCTL));
 457                         if (p == NULL)
 458                                 senderr(ENOMEM);
 459                         if (pfr_route_kentry(tmpkt, p)) {
 460                                 pfr_destroy_kentry(p);
 461                                 ad.pfra_fback = PFR_FB_NONE;
 462                         } else {
 463                                 SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
 464                                 ad.pfra_fback = PFR_FB_ADDED;
 465                                 xadd++;
 466                         }
 467                 }
 468 _skip:
 469                 if (flags & PFR_FLAG_FEEDBACK)
 470                         if (COPYOUT(&ad, addr+i, sizeof(ad), flags))
 471                                 senderr(EFAULT);
 472         }
 473         pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY);
 474         if ((flags & PFR_FLAG_FEEDBACK) && *size2) {
 475                 if (*size2 < size+xdel) {
 476                         *size2 = size+xdel;
 477                         senderr(0);
 478                 }
 479                 i = 0;
 480                 SLIST_FOREACH(p, &delq, pfrke_workq) {
 481                         pfr_copyout_addr(&ad, p);
 482                         ad.pfra_fback = PFR_FB_DELETED;
 483                         if (COPYOUT(&ad, addr+size+i, sizeof(ad), flags))
 484                                 senderr(EFAULT);
 485                         i++;
 486                 }
 487         }
 488         pfr_clean_node_mask(tmpkt, &addq);
 489         if (!(flags & PFR_FLAG_DUMMY)) {
 490                 if (flags & PFR_FLAG_ATOMIC)
 491                         crit_enter();
 492                 pfr_insert_kentries(kt, &addq, tzero);
 493                 pfr_remove_kentries(kt, &delq);
 494                 pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
 495                 if (flags & PFR_FLAG_ATOMIC)
 496                         crit_exit();
 497         } else
 498                 pfr_destroy_kentries(&addq);
 499         if (nadd != NULL)
 500                 *nadd = xadd;
 501         if (ndel != NULL)
 502                 *ndel = xdel;
 503         if (nchange != NULL)
 504                 *nchange = xchange;
 505         if ((flags & PFR_FLAG_FEEDBACK) && size2)
 506                 *size2 = size+xdel;
 507         pfr_destroy_ktable(tmpkt, 0);
 508         return (0);
 509 _bad:
 510         pfr_clean_node_mask(tmpkt, &addq);
 511         pfr_destroy_kentries(&addq);
 512         if (flags & PFR_FLAG_FEEDBACK)
 513                 pfr_reset_feedback(addr, size, flags);
 514         pfr_destroy_ktable(tmpkt, 0);
 515         return (rv);
 516 }
 517
 518 int
 519 pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 520         int *nmatch, int flags)
 521 {
 522         struct pfr_ktable       *kt;
 523         struct pfr_kentry       *p;
 524         struct pfr_addr          ad;
 525         int                      i, xmatch = 0;
 526
 527         ACCEPT_FLAGS(flags, PFR_FLAG_REPLACE);
 528         if (pfr_validate_table(tbl, 0, 0))
 529                 return (EINVAL);
 530         kt = pfr_lookup_table(tbl);
 531         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 532                 return (ESRCH);
 533
 534         for (i = 0; i < size; i++) {
 535                 if (COPYIN(addr+i, &ad, sizeof(ad), flags))
 536                         return (EFAULT);
 537                 if (pfr_validate_addr(&ad))
 538                         return (EINVAL);
 539                 if (ADDR_NETWORK(&ad))
 540                         return (EINVAL);
 541                 p = pfr_lookup_addr(kt, &ad, 0);
 542                 if (flags & PFR_FLAG_REPLACE)
 543                         pfr_copyout_addr(&ad, p);
 544                 ad.pfra_fback = (p == NULL) ? PFR_FB_NONE :
 545                     (p->pfrke_not ? PFR_FB_NOTMATCH : PFR_FB_MATCH);
 546                 if (p != NULL && !p->pfrke_not)
 547                         xmatch++;
 548                 if (COPYOUT(&ad, addr+i, sizeof(ad), flags))
 549                         return (EFAULT);
 550         }
 551         if (nmatch != NULL)
 552                 *nmatch = xmatch;
 553         return (0);
 554 }
 555
 556 int
 557 pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size,
 558         int flags)
 559 {
 560         struct pfr_ktable       *kt;
 561         struct pfr_walktree      w;
 562         int                      rv;
 563
 564         ACCEPT_FLAGS(flags, 0);
 565         if (pfr_validate_table(tbl, 0, 0))
 566                 return (EINVAL);
 567         kt = pfr_lookup_table(tbl);
 568         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 569                 return (ESRCH);
 570         if (kt->pfrkt_cnt > *size) {
 571                 *size = kt->pfrkt_cnt;
 572                 return (0);
 573         }
 574
 575         bzero(&w, sizeof(w));
 576         w.pfrw_op = PFRW_GET_ADDRS;
 577         w.pfrw_addr = addr;
 578         w.pfrw_free = kt->pfrkt_cnt;
 579         w.pfrw_flags = flags;
 580         rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
 581         if (!rv)
 582                 rv = kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
 583         if (rv)
 584                 return (rv);
 585
 586         if (w.pfrw_free) {
 587                 kprintf("pfr_get_addrs: corruption detected (%d).\n",
 588                     w.pfrw_free);
 589                 return (ENOTTY);
 590         }
 591         *size = kt->pfrkt_cnt;
 592         return (0);
 593 }
 594
 595 int
 596 pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size,
 597         int flags)
 598 {
 599         struct pfr_ktable       *kt;
 600         struct pfr_walktree      w;
 601         struct pfr_kentryworkq   workq;
 602         int                      rv;
 603         long                     tzero = time_second;
 604
 605         /* XXX PFR_FLAG_CLSTATS disabled */
 606         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC);
 607         if (pfr_validate_table(tbl, 0, 0))
 608                 return (EINVAL);
 609         kt = pfr_lookup_table(tbl);
 610         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 611                 return (ESRCH);
 612         if (kt->pfrkt_cnt > *size) {
 613                 *size = kt->pfrkt_cnt;
 614                 return (0);
 615         }
 616
 617         bzero(&w, sizeof(w));
 618         w.pfrw_op = PFRW_GET_ASTATS;
 619         w.pfrw_astats = addr;
 620         w.pfrw_free = kt->pfrkt_cnt;
 621         w.pfrw_flags = flags;
 622         if (flags & PFR_FLAG_ATOMIC)
 623                 crit_enter();
 624         rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
 625         if (!rv)
 626                 rv = kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
 627         if (!rv && (flags & PFR_FLAG_CLSTATS)) {
 628                 pfr_enqueue_addrs(kt, &workq, NULL, 0);
 629                 pfr_clstats_kentries(&workq, tzero, 0);
 630         }
 631         if (flags & PFR_FLAG_ATOMIC)
 632                 crit_exit();
 633         if (rv)
 634                 return (rv);
 635
 636         if (w.pfrw_free) {
 637                 kprintf("pfr_get_astats: corruption detected (%d).\n",
 638                     w.pfrw_free);
 639                 return (ENOTTY);
 640         }
 641         *size = kt->pfrkt_cnt;
 642         return (0);
 643 }
 644
 645 int
 646 pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 647     int *nzero, int flags)
 648 {
 649         struct pfr_ktable       *kt;
 650         struct pfr_kentryworkq   workq;
 651         struct pfr_kentry       *p;
 652         struct pfr_addr          ad;
 653         int                      i, rv, xzero = 0;
 654
 655         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
 656             PFR_FLAG_FEEDBACK);
 657         if (pfr_validate_table(tbl, 0, 0))
 658                 return (EINVAL);
 659         kt = pfr_lookup_table(tbl);
 660         if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
 661                 return (ESRCH);
 662         SLIST_INIT(&workq);
 663         for (i = 0; i < size; i++) {
 664                 if (COPYIN(addr+i, &ad, sizeof(ad), flags))
 665                         senderr(EFAULT);
 666                 if (pfr_validate_addr(&ad))
 667                         senderr(EINVAL);
 668                 p = pfr_lookup_addr(kt, &ad, 1);
 669                 if (flags & PFR_FLAG_FEEDBACK) {
 670                         ad.pfra_fback = (p != NULL) ?
 671                             PFR_FB_CLEARED : PFR_FB_NONE;
 672                         if (COPYOUT(&ad, addr+i, sizeof(ad), flags))
 673                                 senderr(EFAULT);
 674                 }
 675                 if (p != NULL) {
 676                         SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
 677                         xzero++;
 678                 }
 679         }
 680
 681         if (!(flags & PFR_FLAG_DUMMY)) {
 682                 if (flags & PFR_FLAG_ATOMIC)
 683                         crit_enter();
 684                 pfr_clstats_kentries(&workq, 0, 0);
 685                 if (flags & PFR_FLAG_ATOMIC)
 686                         crit_exit();
 687         }
 688         if (nzero != NULL)
 689                 *nzero = xzero;
 690         return (0);
 691 _bad:
 692         if (flags & PFR_FLAG_FEEDBACK)
 693                 pfr_reset_feedback(addr, size, flags);
 694         return (rv);
 695 }
 696
 697 int
 698 pfr_validate_addr(struct pfr_addr *ad)
 699 {
 700         int i;
 701
 702         switch (ad->pfra_af) {
 703 #ifdef INET
 704         case AF_INET:
 705                 if (ad->pfra_net > 32)
 706                         return (-1);
 707                 break;
 708 #endif /* INET */
 709 #ifdef INET6
 710         case AF_INET6:
 711                 if (ad->pfra_net > 128)
 712                         return (-1);
 713                 break;
 714 #endif /* INET6 */
 715         default:
 716                 return (-1);
 717         }
 718         if (ad->pfra_net < 128 &&
 719                 (((caddr_t)ad)[ad->pfra_net/8] & (0xFF >> (ad->pfra_net%8))))
 720                         return (-1);
 721         for (i = (ad->pfra_net+7)/8; i < sizeof(ad->pfra_u); i++)
 722                 if (((caddr_t)ad)[i])
 723                         return (-1);
 724         if (ad->pfra_not && ad->pfra_not != 1)
 725                 return (-1);
 726         if (ad->pfra_fback)
 727                 return (-1);
 728         return (0);
 729 }
 730
 731 void
 732 pfr_enqueue_addrs(struct pfr_ktable *kt, struct pfr_kentryworkq *workq,
 733         int *naddr, int sweep)
 734 {
 735         struct pfr_walktree     w;
 736
 737         SLIST_INIT(workq);
 738         bzero(&w, sizeof(w));
 739         w.pfrw_op = sweep ? PFRW_SWEEP : PFRW_ENQUEUE;
 740         w.pfrw_workq = workq;
 741         if (kt->pfrkt_ip4 != NULL)
 742                 if (kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w))
 743                         kprintf("pfr_enqueue_addrs: IPv4 walktree failed.\n");
 744         if (kt->pfrkt_ip6 != NULL)
 745                 if (kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w))
 746                         kprintf("pfr_enqueue_addrs: IPv6 walktree failed.\n");
 747         if (naddr != NULL)
 748                 *naddr = w.pfrw_cnt;
 749 }
 750
 751 void
 752 pfr_mark_addrs(struct pfr_ktable *kt)
 753 {
 754         struct pfr_walktree     w;
 755
 756         bzero(&w, sizeof(w));
 757         w.pfrw_op = PFRW_MARK;
 758         if (kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w))
 759                 kprintf("pfr_mark_addrs: IPv4 walktree failed.\n");
 760         if (kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w))
 761                 kprintf("pfr_mark_addrs: IPv6 walktree failed.\n");
 762 }
 763
 764
 765 struct pfr_kentry *
 766 pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact)
 767 {
 768         union sockaddr_union     sa, mask;
 769         struct radix_node_head  *head = NULL;
 770         struct pfr_kentry       *ke;
 771
 772         bzero(&sa, sizeof(sa));
 773         if (ad->pfra_af == AF_INET) {
 774                 FILLIN_SIN(sa.sin, ad->pfra_ip4addr);
 775                 head = kt->pfrkt_ip4;
 776         } else if ( ad->pfra_af == AF_INET6 ) {
 777                 FILLIN_SIN6(sa.sin6, ad->pfra_ip6addr);
 778                 head = kt->pfrkt_ip6;
 779         }
 780         if (ADDR_NETWORK(ad)) {
 781                 pfr_prepare_network(&mask, ad->pfra_af, ad->pfra_net);
 782                 crit_enter(); /* rn_lookup makes use of globals */
 783                 ke = (struct pfr_kentry *)rn_lookup((char *)&sa, (char *)&mask,
 784                     head);
 785                 crit_exit();
 786                 if (ke && KENTRY_RNF_ROOT(ke))
 787                         ke = NULL;
 788         } else {
 789                 ke = (struct pfr_kentry *)rn_match((char *)&sa, head);
 790                 if (ke && KENTRY_RNF_ROOT(ke))
 791                         ke = NULL;
 792                 if (exact && ke && KENTRY_NETWORK(ke))
 793                         ke = NULL;
 794         }
 795         return (ke);
 796 }
 797
 798 struct pfr_kentry *
 799 pfr_create_kentry(struct pfr_addr *ad, int intr)
 800 {
 801         struct pfr_kentry       *ke;
 802
 803         if (intr)
 804                 ke = kmalloc(sizeof(struct pfr_kentry), M_PFRKENTRYPL2, M_NOWAIT|M_ZERO);
 805         else
 806                 ke = kmalloc(sizeof(struct pfr_kentry), M_PFRKENTRYPL, M_NOWAIT|M_ZERO|M_NULLOK);
 807         if (ke == NULL)
 808                 return (NULL);
 809
 810         if (ad->pfra_af == AF_INET)
 811                 FILLIN_SIN(ke->pfrke_sa.sin, ad->pfra_ip4addr);
 812         else if (ad->pfra_af == AF_INET6)
 813                 FILLIN_SIN6(ke->pfrke_sa.sin6, ad->pfra_ip6addr);
 814         ke->pfrke_af = ad->pfra_af;
 815         ke->pfrke_net = ad->pfra_net;
 816         ke->pfrke_not = ad->pfra_not;
 817         ke->pfrke_intrpool = intr;
 818         return (ke);
 819 }
 820
 821 void
 822 pfr_destroy_kentries(struct pfr_kentryworkq *workq)
 823 {
 824         struct pfr_kentry       *p, *q;
 825
 826         for (p = SLIST_FIRST(workq); p != NULL; p = q) {
 827                 q = SLIST_NEXT(p, pfrke_workq);
 828                 pfr_destroy_kentry(p);
 829         }
 830 }
 831
 832 void
 833 pfr_destroy_kentry(struct pfr_kentry *ke)
 834 {
 835         if (ke->pfrke_counters)
 836                 kfree(ke->pfrke_counters, M_PFRKCOUNTERSPL);
 837         if (ke->pfrke_intrpool)
 838                 kfree(ke, M_PFRKENTRYPL2);
 839         else
 840                 kfree(ke, M_PFRKENTRYPL);
 841 }
 842
 843 void
 844 pfr_insert_kentries(struct pfr_ktable *kt,
 845     struct pfr_kentryworkq *workq, long tzero)
 846 {
 847         struct pfr_kentry       *p;
 848         int                      rv, n = 0;
 849
 850         SLIST_FOREACH(p, workq, pfrke_workq) {
 851                 rv = pfr_route_kentry(kt, p);
 852                 if (rv) {
 853                         kprintf("pfr_insert_kentries: cannot route entry "
 854                             "(code=%d).\n", rv);
 855                         break;
 856                 }
 857                 p->pfrke_tzero = tzero;
 858                 n++;
 859         }
 860         kt->pfrkt_cnt += n;
 861 }
 862
 863 int
 864 pfr_insert_kentry(struct pfr_ktable *kt, struct pfr_addr *ad, long tzero)
 865 {
 866         struct pfr_kentry       *p;
 867         int                      rv;
 868
 869         p = pfr_lookup_addr(kt, ad, 1);
 870         if (p != NULL)
 871                 return (0);
 872         p = pfr_create_kentry(ad, 1);
 873         if (p == NULL)
 874                 return (EINVAL);
 875
 876         rv = pfr_route_kentry(kt, p);
 877         if (rv)
 878                 return (rv);
 879
 880         p->pfrke_tzero = tzero;
 881         kt->pfrkt_cnt++;
 882
 883         return (0);
 884 }
 885
 886 void
 887 pfr_remove_kentries(struct pfr_ktable *kt,
 888     struct pfr_kentryworkq *workq)
 889 {
 890         struct pfr_kentry       *p;
 891         int                      n = 0;
 892
 893         SLIST_FOREACH(p, workq, pfrke_workq) {
 894                 pfr_unroute_kentry(kt, p);
 895                 n++;
 896         }
 897         kt->pfrkt_cnt -= n;
 898         pfr_destroy_kentries(workq);
 899 }
 900
 901 void
 902 pfr_clean_node_mask(struct pfr_ktable *kt,
 903     struct pfr_kentryworkq *workq)
 904 {
 905         struct pfr_kentry       *p;
 906
 907         SLIST_FOREACH(p, workq, pfrke_workq)
 908                 pfr_unroute_kentry(kt, p);
 909 }
 910
 911 void
 912 pfr_clstats_kentries(struct pfr_kentryworkq *workq, long tzero, int negchange)
 913 {
 914         struct pfr_kentry       *p;
 915
 916         SLIST_FOREACH(p, workq, pfrke_workq) {
 917                 crit_enter();
 918                 if (negchange)
 919                         p->pfrke_not = !p->pfrke_not;
 920                 if (p->pfrke_counters) {
 921                         kfree(p->pfrke_counters, M_PFRKCOUNTERSPL);
 922                         p->pfrke_counters = NULL;
 923                 }
 924                 crit_exit();
 925                 p->pfrke_tzero = tzero;
 926         }
 927 }
 928
 929 void
 930 pfr_reset_feedback(struct pfr_addr *addr, int size, int flags)
 931 {
 932         struct pfr_addr ad;
 933         int             i;
 934
 935         for (i = 0; i < size; i++) {
 936                 if (COPYIN(addr+i, &ad, sizeof(ad), flags))
 937                         break;
 938                 ad.pfra_fback = PFR_FB_NONE;
 939                 if (COPYOUT(&ad, addr+i, sizeof(ad), flags))
 940                         break;
 941         }
 942 }
 943
 944 void
 945 pfr_prepare_network(union sockaddr_union *sa, int af, int net)
 946 {
 947         int     i;
 948
 949         bzero(sa, sizeof(*sa));
 950         if (af == AF_INET) {
 951                 sa->sin.sin_len = sizeof(sa->sin);
 952                 sa->sin.sin_family = AF_INET;
 953                 sa->sin.sin_addr.s_addr = net ? htonl(-1 << (32-net)) : 0;
 954         } else if (af == AF_INET6) {
 955                 sa->sin6.sin6_len = sizeof(sa->sin6);
 956                 sa->sin6.sin6_family = AF_INET6;
 957                 for (i = 0; i < 4; i++) {
 958                         if (net <= 32) {
 959                                 sa->sin6.sin6_addr.s6_addr32[i] =
 960                                     net ? htonl(-1 << (32-net)) : 0;
 961                                 break;
 962                         }
 963                         sa->sin6.sin6_addr.s6_addr32[i] = 0xFFFFFFFF;
 964                         net -= 32;
 965                 }
 966         }
 967 }
 968
 969 int
 970 pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
 971 {
 972         union sockaddr_union     mask;
 973         struct radix_node       *rn;
 974         struct radix_node_head  *head = NULL;
 975
 976         bzero(ke->pfrke_node, sizeof(ke->pfrke_node));
 977         if (ke->pfrke_af == AF_INET)
 978                 head = kt->pfrkt_ip4;
 979         else if (ke->pfrke_af == AF_INET6)
 980                 head = kt->pfrkt_ip6;
 981
 982         crit_enter();
 983         if (KENTRY_NETWORK(ke)) {
 984                 pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
 985                 rn = rn_addroute((char *)&ke->pfrke_sa, (char *)&mask, head,
 986                     ke->pfrke_node);
 987         } else
 988                 rn = rn_addroute((char *)&ke->pfrke_sa, NULL, head,
 989                     ke->pfrke_node);
 990         crit_exit();
 991
 992         return (rn == NULL ? -1 : 0);
 993 }
 994
 995 int
 996 pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
 997 {
 998         union sockaddr_union     mask;
 999         struct radix_node       *rn;
1000         struct radix_node_head  *head = NULL;
1001
1002         if (ke->pfrke_af == AF_INET)
1003                 head = kt->pfrkt_ip4;
1004         else if (ke->pfrke_af == AF_INET6)
1005                 head = kt->pfrkt_ip6;
1006
1007         crit_enter();
1008         if (KENTRY_NETWORK(ke)) {
1009                 pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
1010                 rn = rn_delete((char *)&ke->pfrke_sa, (char *)&mask, head);
1011         } else
1012                 rn = rn_delete((char *)&ke->pfrke_sa, NULL, head);
1013         crit_exit();
1014
1015         if (rn == NULL) {
1016                 kprintf("pfr_unroute_kentry: delete failed.\n");
1017                 return (-1);
1018         }
1019         return (0);
1020 }
1021
1022 void
1023 pfr_copyout_addr(struct pfr_addr *ad, struct pfr_kentry *ke)
1024 {
1025         bzero(ad, sizeof(*ad));
1026         if (ke == NULL)
1027                 return;
1028         ad->pfra_af = ke->pfrke_af;
1029         ad->pfra_net = ke->pfrke_net;
1030         ad->pfra_not = ke->pfrke_not;
1031         if (ad->pfra_af == AF_INET)
1032                 ad->pfra_ip4addr = ke->pfrke_sa.sin.sin_addr;
1033         else if (ad->pfra_af == AF_INET6)
1034                 ad->pfra_ip6addr = ke->pfrke_sa.sin6.sin6_addr;
1035 }
1036
1037 int
1038 pfr_walktree(struct radix_node *rn, void *arg)
1039 {
1040         struct pfr_kentry       *ke = (struct pfr_kentry *)rn;
1041         struct pfr_walktree     *w = arg;
1042         union sockaddr_union    pfr_mask;
1043         int                     flags = w->pfrw_flags;
1044
1045         switch (w->pfrw_op) {
1046         case PFRW_MARK:
1047                 ke->pfrke_mark = 0;
1048                 break;
1049         case PFRW_SWEEP:
1050                 if (ke->pfrke_mark)
1051                         break;
1052                 /* FALLTHROUGH */
1053         case PFRW_ENQUEUE:
1054                 SLIST_INSERT_HEAD(w->pfrw_workq, ke, pfrke_workq);
1055                 w->pfrw_cnt++;
1056                 break;
1057         case PFRW_GET_ADDRS:
1058                 if (w->pfrw_free-- > 0) {
1059                         struct pfr_addr ad;
1060
1061                         pfr_copyout_addr(&ad, ke);
1062                         if (copyout(&ad, w->pfrw_addr, sizeof(ad)))
1063                                 return (EFAULT);
1064                         w->pfrw_addr++;
1065                 }
1066                 break;
1067         case PFRW_GET_ASTATS:
1068                 if (w->pfrw_free-- > 0) {
1069                         struct pfr_astats as;
1070
1071                         pfr_copyout_addr(&as.pfras_a, ke);
1072
1073                         crit_enter();
1074                         if (ke->pfrke_counters) {
1075                                 bcopy(ke->pfrke_counters->pfrkc_packets,
1076                                     as.pfras_packets, sizeof(as.pfras_packets));
1077                                 bcopy(ke->pfrke_counters->pfrkc_bytes,
1078                                     as.pfras_bytes, sizeof(as.pfras_bytes));
1079                         } else {
1080                                 bzero(as.pfras_packets, sizeof(as.pfras_packets));
1081                                 bzero(as.pfras_bytes, sizeof(as.pfras_bytes));
1082                                 as.pfras_a.pfra_fback = PFR_FB_NOCOUNT;
1083                         }
1084                         crit_exit();
1085                         as.pfras_tzero = ke->pfrke_tzero;
1086
1087                         if (COPYOUT(&as, w->pfrw_astats, sizeof(as), flags))
1088                                 return (EFAULT);
1089                         w->pfrw_astats++;
1090                 }
1091                 break;
1092         case PFRW_POOL_GET:
1093                 if (ke->pfrke_not)
1094                         break; /* negative entries are ignored */
1095                 if (!w->pfrw_cnt--) {
1096                         w->pfrw_kentry = ke;
1097                         return (1); /* finish search */
1098                 }
1099                 break;
1100         case PFRW_DYNADDR_UPDATE:
1101                 if (ke->pfrke_af == AF_INET) {
1102                         if (w->pfrw_dyn->pfid_acnt4++ > 0)
1103                                 break;
1104                         pfr_prepare_network(&pfr_mask, AF_INET, ke->pfrke_net);
1105                         w->pfrw_dyn->pfid_addr4 = *SUNION2PF(
1106                             &ke->pfrke_sa, AF_INET);
1107                         w->pfrw_dyn->pfid_mask4 = *SUNION2PF(
1108                             &pfr_mask, AF_INET);
1109                 } else if (ke->pfrke_af == AF_INET6){
1110                         if (w->pfrw_dyn->pfid_acnt6++ > 0)
1111                                 break;
1112                         pfr_prepare_network(&pfr_mask, AF_INET6, ke->pfrke_net);
1113                         w->pfrw_dyn->pfid_addr6 = *SUNION2PF(
1114                             &ke->pfrke_sa, AF_INET6);
1115                         w->pfrw_dyn->pfid_mask6 = *SUNION2PF(
1116                             &pfr_mask, AF_INET6);
1117                 }
1118                 break;
1119         }
1120         return (0);
1121 }
1122
1123 int
1124 pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags)
1125 {
1126         struct pfr_ktableworkq   workq;
1127         struct pfr_ktable       *p;
1128         int                      xdel = 0;
1129
1130         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
1131             PFR_FLAG_ALLRSETS);
1132         if (pfr_fix_anchor(filter->pfrt_anchor))
1133                 return (EINVAL);
1134         if (pfr_table_count(filter, flags) < 0)
1135                 return (ENOENT);
1136
1137         SLIST_INIT(&workq);
1138         RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1139                 if (pfr_skip_table(filter, p, flags))
1140                         continue;
1141                 if (!strcmp(p->pfrkt_anchor, PF_RESERVED_ANCHOR))
1142                         continue;
1143                 if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE))
1144                         continue;
1145                 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1146                 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1147                 xdel++;
1148         }
1149         if (!(flags & PFR_FLAG_DUMMY)) {
1150                 if (flags & PFR_FLAG_ATOMIC)
1151                         crit_enter();
1152                 pfr_setflags_ktables(&workq);
1153                 if (flags & PFR_FLAG_ATOMIC)
1154                         crit_exit();
1155         }
1156         if (ndel != NULL)
1157                 *ndel = xdel;
1158         return (0);
1159 }
1160
1161 int
1162 pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags)
1163 {
1164         struct pfr_ktableworkq   addq, changeq;
1165         struct pfr_ktable       *p, *q, *r, key;
1166         int                      i, rv, xadd = 0;
1167         long                     tzero = time_second;
1168
1169         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
1170         SLIST_INIT(&addq);
1171         SLIST_INIT(&changeq);
1172         for (i = 0; i < size; i++) {
1173                 if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t), flags))
1174                         senderr(EFAULT);
1175                 if (pfr_validate_table(&key.pfrkt_t, PFR_TFLAG_USRMASK,
1176                     flags & PFR_FLAG_USERIOCTL))
1177                         senderr(EINVAL);
1178                 key.pfrkt_flags |= PFR_TFLAG_ACTIVE;
1179                 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1180                 if (p == NULL) {
1181                         p = pfr_create_ktable(&key.pfrkt_t, tzero, 1);
1182                         if (p == NULL)
1183                                 senderr(ENOMEM);
1184                         SLIST_FOREACH(q, &addq, pfrkt_workq) {
1185                                 if (!pfr_ktable_compare(p, q))
1186                                         goto _skip;
1187                         }
1188                         SLIST_INSERT_HEAD(&addq, p, pfrkt_workq);
1189                         xadd++;
1190                         if (!key.pfrkt_anchor[0])
1191                                 goto _skip;
1192
1193                         /* find or create root table */
1194                         bzero(key.pfrkt_anchor, sizeof(key.pfrkt_anchor));
1195                         r = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1196                         if (r != NULL) {
1197                                 p->pfrkt_root = r;
1198                                 goto _skip;
1199                         }
1200                         SLIST_FOREACH(q, &addq, pfrkt_workq) {
1201                                 if (!pfr_ktable_compare(&key, q)) {
1202                                         p->pfrkt_root = q;
1203                                         goto _skip;
1204                                 }
1205                         }
1206                         key.pfrkt_flags = 0;
1207                         r = pfr_create_ktable(&key.pfrkt_t, 0, 1);
1208                         if (r == NULL)
1209                                 senderr(ENOMEM);
1210                         SLIST_INSERT_HEAD(&addq, r, pfrkt_workq);
1211                         p->pfrkt_root = r;
1212                 } else if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1213                         SLIST_FOREACH(q, &changeq, pfrkt_workq)
1214                                 if (!pfr_ktable_compare(&key, q))
1215                                         goto _skip;
1216                         p->pfrkt_nflags = (p->pfrkt_flags &
1217                             ~PFR_TFLAG_USRMASK) | key.pfrkt_flags;
1218                         SLIST_INSERT_HEAD(&changeq, p, pfrkt_workq);
1219                         xadd++;
1220                 }
1221 _skip:
1222         ;
1223         }
1224         if (!(flags & PFR_FLAG_DUMMY)) {
1225                 if (flags & PFR_FLAG_ATOMIC)
1226                         crit_enter();
1227                 pfr_insert_ktables(&addq);
1228                 pfr_setflags_ktables(&changeq);
1229                 if (flags & PFR_FLAG_ATOMIC)
1230                         crit_exit();
1231         } else
1232                  pfr_destroy_ktables(&addq, 0);
1233         if (nadd != NULL)
1234                 *nadd = xadd;
1235         return (0);
1236 _bad:
1237         pfr_destroy_ktables(&addq, 0);
1238         return (rv);
1239 }
1240
1241 int
1242 pfr_del_tables(struct pfr_table *tbl, int size, int *ndel, int flags)
1243 {
1244         struct pfr_ktableworkq   workq;
1245         struct pfr_ktable       *p, *q, key;
1246         int                      i, xdel = 0;
1247
1248         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
1249         SLIST_INIT(&workq);
1250         for (i = 0; i < size; i++) {
1251                 if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t), flags))
1252                         return (EFAULT);
1253                 if (pfr_validate_table(&key.pfrkt_t, 0,
1254                     flags & PFR_FLAG_USERIOCTL))
1255                         return (EINVAL);
1256                 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1257                 if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1258                         SLIST_FOREACH(q, &workq, pfrkt_workq)
1259                                 if (!pfr_ktable_compare(p, q))
1260                                         goto _skip;
1261                         p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1262                         SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1263                         xdel++;
1264                 }
1265 _skip:
1266         ;
1267         }
1268
1269         if (!(flags & PFR_FLAG_DUMMY)) {
1270                 if (flags & PFR_FLAG_ATOMIC)
1271                         crit_enter();
1272                 pfr_setflags_ktables(&workq);
1273                 if (flags & PFR_FLAG_ATOMIC)
1274                         crit_exit();
1275         }
1276         if (ndel != NULL)
1277                 *ndel = xdel;
1278         return (0);
1279 }
1280
1281 int
1282 pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size,
1283         int flags)
1284 {
1285         struct pfr_ktable       *p;
1286         int                      n, nn;
1287
1288         ACCEPT_FLAGS(flags, PFR_FLAG_ALLRSETS);
1289         if (pfr_fix_anchor(filter->pfrt_anchor))
1290                 return (EINVAL);
1291         n = nn = pfr_table_count(filter, flags);
1292         if (n < 0)
1293                 return (ENOENT);
1294         if (n > *size) {
1295                 *size = n;
1296                 return (0);
1297         }
1298         RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1299                 if (pfr_skip_table(filter, p, flags))
1300                         continue;
1301                 if (n-- <= 0)
1302                         continue;
1303                 if (COPYOUT(&p->pfrkt_t, tbl++, sizeof(*tbl), flags))
1304                         return (EFAULT);
1305         }
1306         if (n) {
1307                 kprintf("pfr_get_tables: corruption detected (%d).\n", n);
1308                 return (ENOTTY);
1309         }
1310         *size = nn;
1311         return (0);
1312 }
1313
1314 int
1315 pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size,
1316         int flags)
1317 {
1318         struct pfr_ktable       *p;
1319         struct pfr_ktableworkq   workq;
1320         int                      n, nn;
1321         long                     tzero = time_second;
1322
1323         /* XXX PFR_FLAG_CLSTATS disabled */
1324         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_ALLRSETS);
1325         if (pfr_fix_anchor(filter->pfrt_anchor))
1326                 return (EINVAL);
1327         n = nn = pfr_table_count(filter, flags);
1328         if (n < 0)
1329                 return (ENOENT);
1330         if (n > *size) {
1331                 *size = n;
1332                 return (0);
1333         }
1334         SLIST_INIT(&workq);
1335         if (flags & PFR_FLAG_ATOMIC)
1336                 crit_enter();
1337         RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1338                 if (pfr_skip_table(filter, p, flags))
1339                         continue;
1340                 if (n-- <= 0)
1341                         continue;
1342                 if (!(flags & PFR_FLAG_ATOMIC))
1343                         crit_enter();
1344                 if (COPYOUT(&p->pfrkt_ts, tbl++, sizeof(*tbl), flags)) {
1345                         crit_exit();
1346                         return (EFAULT);
1347                 }
1348                 if (!(flags & PFR_FLAG_ATOMIC))
1349                         crit_exit();
1350                 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1351         }
1352         if (flags & PFR_FLAG_CLSTATS)
1353                 pfr_clstats_ktables(&workq, tzero,
1354                     flags & PFR_FLAG_ADDRSTOO);
1355         if (flags & PFR_FLAG_ATOMIC)
1356                 crit_exit();
1357         if (n) {
1358                 kprintf("pfr_get_tstats: corruption detected (%d).\n", n);
1359                 return (ENOTTY);
1360         }
1361         *size = nn;
1362         return (0);
1363 }
1364
1365 int
1366 pfr_clr_tstats(struct pfr_table *tbl, int size, int *nzero, int flags)
1367 {
1368         struct pfr_ktableworkq   workq;
1369         struct pfr_ktable       *p, key;
1370         int                      i, xzero = 0;
1371         long                     tzero = time_second;
1372
1373         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
1374             PFR_FLAG_ADDRSTOO);
1375         SLIST_INIT(&workq);
1376         for (i = 0; i < size; i++) {
1377                 if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t), flags))
1378                         return (EFAULT);
1379                 if (pfr_validate_table(&key.pfrkt_t, 0, 0))
1380                         return (EINVAL);
1381                 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1382                 if (p != NULL) {
1383                         SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1384                         xzero++;
1385                 }
1386         }
1387         if (!(flags & PFR_FLAG_DUMMY)) {
1388                 if (flags & PFR_FLAG_ATOMIC)
1389                         crit_enter();
1390                 pfr_clstats_ktables(&workq, tzero, flags & PFR_FLAG_ADDRSTOO);
1391                 if (flags & PFR_FLAG_ATOMIC)
1392                         crit_exit();
1393         }
1394         if (nzero != NULL)
1395                 *nzero = xzero;
1396         return (0);
1397 }
1398
1399 int
1400 pfr_set_tflags(struct pfr_table *tbl, int size, int setflag, int clrflag,
1401         int *nchange, int *ndel, int flags)
1402 {
1403         struct pfr_ktableworkq   workq;
1404         struct pfr_ktable       *p, *q, key;
1405         int                      i, xchange = 0, xdel = 0;
1406
1407         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
1408         if ((setflag & ~PFR_TFLAG_USRMASK) ||
1409             (clrflag & ~PFR_TFLAG_USRMASK) ||
1410             (setflag & clrflag))
1411                 return (EINVAL);
1412         SLIST_INIT(&workq);
1413         for (i = 0; i < size; i++) {
1414                 if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t), flags))
1415                         return (EFAULT);
1416                 if (pfr_validate_table(&key.pfrkt_t, 0,
1417                     flags & PFR_FLAG_USERIOCTL))
1418                         return (EINVAL);
1419                 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1420                 if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1421                         p->pfrkt_nflags = (p->pfrkt_flags | setflag) &
1422                             ~clrflag;
1423                         if (p->pfrkt_nflags == p->pfrkt_flags)
1424                                 goto _skip;
1425                         SLIST_FOREACH(q, &workq, pfrkt_workq)
1426                                 if (!pfr_ktable_compare(p, q))
1427                                         goto _skip;
1428                         SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1429                         if ((p->pfrkt_flags & PFR_TFLAG_PERSIST) &&
1430                             (clrflag & PFR_TFLAG_PERSIST) &&
1431                             !(p->pfrkt_flags & PFR_TFLAG_REFERENCED))
1432                                 xdel++;
1433                         else
1434                                 xchange++;
1435                 }
1436 _skip:
1437         ;
1438         }
1439         if (!(flags & PFR_FLAG_DUMMY)) {
1440                 if (flags & PFR_FLAG_ATOMIC)
1441                         crit_enter();
1442                 pfr_setflags_ktables(&workq);
1443                 if (flags & PFR_FLAG_ATOMIC)
1444                         crit_exit();
1445         }
1446         if (nchange != NULL)
1447                 *nchange = xchange;
1448         if (ndel != NULL)
1449                 *ndel = xdel;
1450         return (0);
1451 }
1452
1453 int
1454 pfr_ina_begin(struct pfr_table *trs, u_int32_t *ticket, int *ndel, int flags)
1455 {
1456         struct pfr_ktableworkq   workq;
1457         struct pfr_ktable       *p;
1458         struct pf_ruleset       *rs;
1459         int                      xdel = 0;
1460
1461         ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1462         rs = pf_find_or_create_ruleset(trs->pfrt_anchor);
1463         if (rs == NULL)
1464                 return (ENOMEM);
1465         SLIST_INIT(&workq);
1466         RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1467                 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1468                     pfr_skip_table(trs, p, 0))
1469                         continue;
1470                 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1471                 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1472                 xdel++;
1473         }
1474         if (!(flags & PFR_FLAG_DUMMY)) {
1475                 pfr_setflags_ktables(&workq);
1476                 if (ticket != NULL)
1477                         *ticket = ++rs->tticket;
1478                 rs->topen = 1;
1479         } else
1480                 pf_remove_if_empty_ruleset(rs);
1481         if (ndel != NULL)
1482                 *ndel = xdel;
1483         return (0);
1484 }
1485
1486 int
1487 pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size,
1488     int *nadd, int *naddr, u_int32_t ticket, int flags)
1489 {
1490         struct pfr_ktableworkq   tableq;
1491         struct pfr_kentryworkq   addrq;
1492         struct pfr_ktable       *kt, *rt, *shadow, key;
1493         struct pfr_kentry       *p;
1494         struct pfr_addr          ad;
1495         struct pf_ruleset       *rs;
1496         int                      i, rv, xadd = 0, xaddr = 0;
1497
1498         ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ADDRSTOO);
1499         if (size && !(flags & PFR_FLAG_ADDRSTOO))
1500                 return (EINVAL);
1501         if (pfr_validate_table(tbl, PFR_TFLAG_USRMASK,
1502             flags & PFR_FLAG_USERIOCTL))
1503                 return (EINVAL);
1504         rs = pf_find_ruleset(tbl->pfrt_anchor);
1505         if (rs == NULL || !rs->topen || ticket != rs->tticket)
1506                 return (EBUSY);
1507         tbl->pfrt_flags |= PFR_TFLAG_INACTIVE;
1508         SLIST_INIT(&tableq);
1509         kt = RB_FIND(pfr_ktablehead, &pfr_ktables, (struct pfr_ktable *)tbl);
1510         if (kt == NULL) {
1511                 kt = pfr_create_ktable(tbl, 0, 1);
1512                 if (kt == NULL)
1513                         return (ENOMEM);
1514                 SLIST_INSERT_HEAD(&tableq, kt, pfrkt_workq);
1515                 xadd++;
1516                 if (!tbl->pfrt_anchor[0])
1517                         goto _skip;
1518
1519                 /* find or create root table */
1520                 bzero(&key, sizeof(key));
1521                 strlcpy(key.pfrkt_name, tbl->pfrt_name, sizeof(key.pfrkt_name));
1522                 rt = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1523                 if (rt != NULL) {
1524                         kt->pfrkt_root = rt;
1525                         goto _skip;
1526                 }
1527                 rt = pfr_create_ktable(&key.pfrkt_t, 0, 1);
1528                 if (rt == NULL) {
1529                         pfr_destroy_ktables(&tableq, 0);
1530                         return (ENOMEM);
1531                 }
1532                 SLIST_INSERT_HEAD(&tableq, rt, pfrkt_workq);
1533                 kt->pfrkt_root = rt;
1534         } else if (!(kt->pfrkt_flags & PFR_TFLAG_INACTIVE))
1535                 xadd++;
1536 _skip:
1537         shadow = pfr_create_ktable(tbl, 0, 0);
1538         if (shadow == NULL) {
1539                 pfr_destroy_ktables(&tableq, 0);
1540                 return (ENOMEM);
1541         }
1542         SLIST_INIT(&addrq);
1543         for (i = 0; i < size; i++) {
1544                 if (COPYIN(addr+i, &ad, sizeof(ad), flags))
1545                         senderr(EFAULT);
1546                 if (pfr_validate_addr(&ad))
1547                         senderr(EINVAL);
1548                 if (pfr_lookup_addr(shadow, &ad, 1) != NULL)
1549                         continue;
1550                 p = pfr_create_kentry(&ad, 0);
1551                 if (p == NULL)
1552                         senderr(ENOMEM);
1553                 if (pfr_route_kentry(shadow, p)) {
1554                         pfr_destroy_kentry(p);
1555                         continue;
1556                 }
1557                 SLIST_INSERT_HEAD(&addrq, p, pfrke_workq);
1558                 xaddr++;
1559         }
1560         if (!(flags & PFR_FLAG_DUMMY)) {
1561                 if (kt->pfrkt_shadow != NULL)
1562                         pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1563                 kt->pfrkt_flags |= PFR_TFLAG_INACTIVE;
1564                 pfr_insert_ktables(&tableq);
1565                 shadow->pfrkt_cnt = (flags & PFR_FLAG_ADDRSTOO) ?
1566                     xaddr : NO_ADDRESSES;
1567                 kt->pfrkt_shadow = shadow;
1568         } else {
1569                 pfr_clean_node_mask(shadow, &addrq);
1570                 pfr_destroy_ktable(shadow, 0);
1571                 pfr_destroy_ktables(&tableq, 0);
1572                 pfr_destroy_kentries(&addrq);
1573         }
1574         if (nadd != NULL)
1575                 *nadd = xadd;
1576         if (naddr != NULL)
1577                 *naddr = xaddr;
1578         return (0);
1579 _bad:
1580         pfr_destroy_ktable(shadow, 0);
1581         pfr_destroy_ktables(&tableq, 0);
1582         pfr_destroy_kentries(&addrq);
1583         return (rv);
1584 }
1585
1586 int
1587 pfr_ina_rollback(struct pfr_table *trs, u_int32_t ticket, int *ndel, int flags)
1588 {
1589         struct pfr_ktableworkq   workq;
1590         struct pfr_ktable       *p;
1591         struct pf_ruleset       *rs;
1592         int                      xdel = 0;
1593
1594         ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1595         rs = pf_find_ruleset(trs->pfrt_anchor);
1596         if (rs == NULL || !rs->topen || ticket != rs->tticket)
1597                 return (0);
1598         SLIST_INIT(&workq);
1599         RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1600                 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1601                     pfr_skip_table(trs, p, 0))
1602                         continue;
1603                 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1604                 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1605                 xdel++;
1606         }
1607         if (!(flags & PFR_FLAG_DUMMY)) {
1608                 pfr_setflags_ktables(&workq);
1609                 rs->topen = 0;
1610                 pf_remove_if_empty_ruleset(rs);
1611         }
1612         if (ndel != NULL)
1613                 *ndel = xdel;
1614         return (0);
1615 }
1616
1617 int
1618 pfr_ina_commit(struct pfr_table *trs, u_int32_t ticket, int *nadd,
1619     int *nchange, int flags)
1620 {
1621         struct pfr_ktable       *p, *q;
1622         struct pfr_ktableworkq   workq;
1623         struct pf_ruleset       *rs;
1624         int                      xadd = 0, xchange = 0;
1625         long                     tzero = time_second;
1626
1627         ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
1628         rs = pf_find_ruleset(trs->pfrt_anchor);
1629         if (rs == NULL || !rs->topen || ticket != rs->tticket)
1630                 return (EBUSY);
1631
1632         SLIST_INIT(&workq);
1633         RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1634                 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1635                     pfr_skip_table(trs, p, 0))
1636                         continue;
1637                 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1638                 if (p->pfrkt_flags & PFR_TFLAG_ACTIVE)
1639                         xchange++;
1640                 else
1641                         xadd++;
1642         }
1643
1644         if (!(flags & PFR_FLAG_DUMMY)) {
1645                 if (flags & PFR_FLAG_ATOMIC)
1646                         crit_enter();
1647                 for (p = SLIST_FIRST(&workq); p != NULL; p = q) {
1648                         q = SLIST_NEXT(p, pfrkt_workq);
1649                         pfr_commit_ktable(p, tzero);
1650                 }
1651                 if (flags & PFR_FLAG_ATOMIC)
1652                         crit_exit();
1653                 rs->topen = 0;
1654                 pf_remove_if_empty_ruleset(rs);
1655         }
1656         if (nadd != NULL)
1657                 *nadd = xadd;
1658         if (nchange != NULL)
1659                 *nchange = xchange;
1660
1661         return (0);
1662 }
1663
1664 void
1665 pfr_commit_ktable(struct pfr_ktable *kt, long tzero)
1666 {
1667         struct pfr_ktable       *shadow = kt->pfrkt_shadow;
1668         int                      nflags;
1669
1670         if (shadow->pfrkt_cnt == NO_ADDRESSES) {
1671                 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1672                         pfr_clstats_ktable(kt, tzero, 1);
1673         } else if (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) {
1674                 /* kt might contain addresses */
1675                 struct pfr_kentryworkq   addrq, addq, changeq, delq, garbageq;
1676                 struct pfr_kentry       *p, *q, *next;
1677                 struct pfr_addr          ad;
1678
1679                 pfr_enqueue_addrs(shadow, &addrq, NULL, 0);
1680                 pfr_mark_addrs(kt);
1681                 SLIST_INIT(&addq);
1682                 SLIST_INIT(&changeq);
1683                 SLIST_INIT(&delq);
1684                 SLIST_INIT(&garbageq);
1685                 pfr_clean_node_mask(shadow, &addrq);
1686                 for (p = SLIST_FIRST(&addrq); p != NULL; p = next) {
1687                         next = SLIST_NEXT(p, pfrke_workq);      /* XXX */
1688                         pfr_copyout_addr(&ad, p);
1689                         q = pfr_lookup_addr(kt, &ad, 1);
1690                         if (q != NULL) {
1691                                 if (q->pfrke_not != p->pfrke_not)
1692                                         SLIST_INSERT_HEAD(&changeq, q,
1693                                             pfrke_workq);
1694                                 q->pfrke_mark = 1;
1695                                 SLIST_INSERT_HEAD(&garbageq, p, pfrke_workq);
1696                         } else {
1697                                 p->pfrke_tzero = tzero;
1698                                 SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
1699                         }
1700                 }
1701                 pfr_enqueue_addrs(kt, &delq, NULL, ENQUEUE_UNMARKED_ONLY);
1702                 pfr_insert_kentries(kt, &addq, tzero);
1703                 pfr_remove_kentries(kt, &delq);
1704                 pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
1705                 pfr_destroy_kentries(&garbageq);
1706         } else {
1707                 /* kt cannot contain addresses */
1708                 SWAP(struct radix_node_head *, kt->pfrkt_ip4,
1709                     shadow->pfrkt_ip4);
1710                 SWAP(struct radix_node_head *, kt->pfrkt_ip6,
1711                     shadow->pfrkt_ip6);
1712                 SWAP(int, kt->pfrkt_cnt, shadow->pfrkt_cnt);
1713                 pfr_clstats_ktable(kt, tzero, 1);
1714         }
1715         nflags = ((shadow->pfrkt_flags & PFR_TFLAG_USRMASK) |
1716             (kt->pfrkt_flags & PFR_TFLAG_SETMASK) | PFR_TFLAG_ACTIVE)
1717                 & ~PFR_TFLAG_INACTIVE;
1718         pfr_destroy_ktable(shadow, 0);
1719         kt->pfrkt_shadow = NULL;
1720         pfr_setflags_ktable(kt, nflags);
1721 }
1722
1723 int
1724 pfr_validate_table(struct pfr_table *tbl, int allowedflags, int no_reserved)
1725 {
1726         int i;
1727
1728         if (!tbl->pfrt_name[0])
1729                 return (-1);
1730         if (no_reserved && !strcmp(tbl->pfrt_anchor, PF_RESERVED_ANCHOR))
1731                  return (-1);
1732         if (tbl->pfrt_name[PF_TABLE_NAME_SIZE-1])
1733                 return (-1);
1734         for (i = strlen(tbl->pfrt_name); i < PF_TABLE_NAME_SIZE; i++)
1735                 if (tbl->pfrt_name[i])
1736                         return (-1);
1737         if (pfr_fix_anchor(tbl->pfrt_anchor))
1738                 return (-1);
1739         if (tbl->pfrt_flags & ~allowedflags)
1740                 return (-1);
1741         return (0);
1742 }
1743
1744 /*
1745  * Rewrite anchors referenced by tables to remove slashes
1746  * and check for validity.
1747  */
1748 int
1749 pfr_fix_anchor(char *anchor)
1750 {
1751         size_t siz = MAXPATHLEN;
1752         int i;
1753
1754         if (anchor[0] == '/') {
1755                 char *path;
1756                 int off;
1757
1758                 path = anchor;
1759                 off = 1;
1760                 while (*++path == '/')
1761                         off++;
1762                 bcopy(path, anchor, siz - off);
1763                 memset(anchor + siz - off, 0, off);
1764         }
1765         if (anchor[siz - 1])
1766                 return (-1);
1767         for (i = strlen(anchor); i < siz; i++)
1768                 if (anchor[i])
1769                         return (-1);
1770         return (0);
1771 }
1772
1773 int
1774 pfr_table_count(struct pfr_table *filter, int flags)
1775 {
1776         struct pf_ruleset *rs;
1777
1778         if (flags & PFR_FLAG_ALLRSETS)
1779                 return (pfr_ktable_cnt);
1780         if (filter->pfrt_anchor[0]) {
1781                 rs = pf_find_ruleset(filter->pfrt_anchor);
1782                 return ((rs != NULL) ? rs->tables : -1);
1783         }
1784         return (pf_main_ruleset.tables);
1785 }
1786
1787 int
1788 pfr_skip_table(struct pfr_table *filter, struct pfr_ktable *kt, int flags)
1789 {
1790         if (flags & PFR_FLAG_ALLRSETS)
1791                 return (0);
1792         if (strcmp(filter->pfrt_anchor, kt->pfrkt_anchor))
1793                 return (1);
1794         return (0);
1795 }
1796
1797 void
1798 pfr_insert_ktables(struct pfr_ktableworkq *workq)
1799 {
1800         struct pfr_ktable       *p;
1801
1802         SLIST_FOREACH(p, workq, pfrkt_workq)
1803                 pfr_insert_ktable(p);
1804 }
1805
1806 void
1807 pfr_insert_ktable(struct pfr_ktable *kt)
1808 {
1809         RB_INSERT(pfr_ktablehead, &pfr_ktables, kt);
1810         pfr_ktable_cnt++;
1811         if (kt->pfrkt_root != NULL)
1812                 if (!kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]++)
1813                         pfr_setflags_ktable(kt->pfrkt_root,
1814                             kt->pfrkt_root->pfrkt_flags|PFR_TFLAG_REFDANCHOR);
1815 }
1816
1817 void
1818 pfr_setflags_ktables(struct pfr_ktableworkq *workq)
1819 {
1820         struct pfr_ktable       *p, *q;
1821
1822         for (p = SLIST_FIRST(workq); p; p = q) {
1823                 q = SLIST_NEXT(p, pfrkt_workq);
1824                 pfr_setflags_ktable(p, p->pfrkt_nflags);
1825         }
1826 }
1827
1828 void
1829 pfr_setflags_ktable(struct pfr_ktable *kt, int newf)
1830 {
1831         struct pfr_kentryworkq  addrq;
1832
1833         if (!(newf & PFR_TFLAG_REFERENCED) &&
1834             !(newf & PFR_TFLAG_PERSIST))
1835                 newf &= ~PFR_TFLAG_ACTIVE;
1836         if (!(newf & PFR_TFLAG_ACTIVE))
1837                 newf &= ~PFR_TFLAG_USRMASK;
1838         if (!(newf & PFR_TFLAG_SETMASK)) {
1839                 RB_REMOVE(pfr_ktablehead, &pfr_ktables, kt);
1840                 if (kt->pfrkt_root != NULL)
1841                         if (!--kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR])
1842                                 pfr_setflags_ktable(kt->pfrkt_root,
1843                                     kt->pfrkt_root->pfrkt_flags &
1844                                         ~PFR_TFLAG_REFDANCHOR);
1845                 pfr_destroy_ktable(kt, 1);
1846                 pfr_ktable_cnt--;
1847                 return;
1848         }
1849         if (!(newf & PFR_TFLAG_ACTIVE) && kt->pfrkt_cnt) {
1850                 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1851                 pfr_remove_kentries(kt, &addrq);
1852         }
1853         if (!(newf & PFR_TFLAG_INACTIVE) && kt->pfrkt_shadow != NULL) {
1854                 pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1855                 kt->pfrkt_shadow = NULL;
1856         }
1857         kt->pfrkt_flags = newf;
1858 }
1859
1860 void
1861 pfr_clstats_ktables(struct pfr_ktableworkq *workq, long tzero, int recurse)
1862 {
1863         struct pfr_ktable       *p;
1864
1865         SLIST_FOREACH(p, workq, pfrkt_workq)
1866                 pfr_clstats_ktable(p, tzero, recurse);
1867 }
1868
1869 void
1870 pfr_clstats_ktable(struct pfr_ktable *kt, long tzero, int recurse)
1871 {
1872         struct pfr_kentryworkq   addrq;
1873
1874         if (recurse) {
1875                 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1876                 pfr_clstats_kentries(&addrq, tzero, 0);
1877         }
1878         crit_enter();
1879         bzero(kt->pfrkt_packets, sizeof(kt->pfrkt_packets));
1880         bzero(kt->pfrkt_bytes, sizeof(kt->pfrkt_bytes));
1881         kt->pfrkt_match = kt->pfrkt_nomatch = 0;
1882         crit_exit();
1883         kt->pfrkt_tzero = tzero;
1884 }
1885
1886 struct pfr_ktable *
1887 pfr_create_ktable(struct pfr_table *tbl, long tzero, int attachruleset)
1888 {
1889         struct pfr_ktable       *kt;
1890         struct pf_ruleset       *rs;
1891
1892         kt = kmalloc(sizeof(struct pfr_ktable), M_PFRKTABLEPL, M_NOWAIT|M_ZERO|M_NULLOK);
1893         if (kt == NULL)
1894                 return (NULL);
1895         kt->pfrkt_t = *tbl;
1896
1897         if (attachruleset) {
1898                 rs = pf_find_or_create_ruleset(tbl->pfrt_anchor);
1899                 if (!rs) {
1900                         pfr_destroy_ktable(kt, 0);
1901                         return (NULL);
1902                 }
1903                 kt->pfrkt_rs = rs;
1904                 rs->tables++;
1905         }
1906
1907         KKASSERT(pf_maskhead != NULL);
1908         if (!rn_inithead((void **)&kt->pfrkt_ip4, pf_maskhead,
1909             offsetof(struct sockaddr_in, sin_addr) * 8) ||
1910             !rn_inithead((void **)&kt->pfrkt_ip6, pf_maskhead,
1911             offsetof(struct sockaddr_in6, sin6_addr) * 8)) {
1912                 pfr_destroy_ktable(kt, 0);
1913                 return (NULL);
1914         }
1915         kt->pfrkt_tzero = tzero;
1916
1917         return (kt);
1918 }
1919
1920 void
1921 pfr_destroy_ktables(struct pfr_ktableworkq *workq, int flushaddr)
1922 {
1923         struct pfr_ktable       *p, *q;
1924
1925         for (p = SLIST_FIRST(workq); p; p = q) {
1926                 q = SLIST_NEXT(p, pfrkt_workq);
1927                 pfr_destroy_ktable(p, flushaddr);
1928         }
1929 }
1930
1931 void
1932 pfr_destroy_ktable(struct pfr_ktable *kt, int flushaddr)
1933 {
1934         struct pfr_kentryworkq   addrq;
1935
1936         if (flushaddr) {
1937                 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1938                 pfr_clean_node_mask(kt, &addrq);
1939                 pfr_destroy_kentries(&addrq);
1940         }
1941         if (kt->pfrkt_ip4 != NULL)
1942                 kfree((caddr_t)kt->pfrkt_ip4, M_RTABLE);
1943
1944         if (kt->pfrkt_ip6 != NULL)
1945                 kfree((caddr_t)kt->pfrkt_ip6, M_RTABLE);
1946         if (kt->pfrkt_shadow != NULL)
1947                 pfr_destroy_ktable(kt->pfrkt_shadow, flushaddr);
1948         if (kt->pfrkt_rs != NULL) {
1949                 kt->pfrkt_rs->tables--;
1950                 pf_remove_if_empty_ruleset(kt->pfrkt_rs);
1951         }
1952         kfree(kt, M_PFRKTABLEPL);
1953 }
1954
1955 int
1956 pfr_ktable_compare(struct pfr_ktable *p, struct pfr_ktable *q)
1957 {
1958         int d;
1959
1960         if ((d = strncmp(p->pfrkt_name, q->pfrkt_name, PF_TABLE_NAME_SIZE)))
1961                 return (d);
1962         return (strcmp(p->pfrkt_anchor, q->pfrkt_anchor));
1963 }
1964
1965 struct pfr_ktable *
1966 pfr_lookup_table(struct pfr_table *tbl)
1967 {
1968         /* struct pfr_ktable start like a struct pfr_table */
1969         return (RB_FIND(pfr_ktablehead, &pfr_ktables,
1970             (struct pfr_ktable *)tbl));
1971 }
1972
1973 int
1974 pfr_match_addr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af)
1975 {
1976         struct pfr_kentry       *ke = NULL;
1977         int                      match;
1978         struct sockaddr_in       pfr_sin;
1979 #ifdef INET6
1980         struct sockaddr_in6      pfr_sin6;
1981 #endif
1982
1983         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
1984                 kt = kt->pfrkt_root;
1985         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1986                 return (0);
1987
1988         switch (af) {
1989 #ifdef INET
1990         case AF_INET:
1991                 bzero(&pfr_sin, sizeof(pfr_sin));
1992                 pfr_sin.sin_len = sizeof(pfr_sin);
1993                 pfr_sin.sin_family = AF_INET;
1994                 pfr_sin.sin_addr.s_addr = a->addr32[0];
1995                 ke = (struct pfr_kentry *)rn_match((char *)&pfr_sin,
1996                     kt->pfrkt_ip4);
1997                 if (ke && KENTRY_RNF_ROOT(ke))
1998                         ke = NULL;
1999                 break;
2000 #endif /* INET */
2001 #ifdef INET6
2002         case AF_INET6:
2003                 bzero(&pfr_sin6, sizeof(pfr_sin6));
2004                 pfr_sin6.sin6_len = sizeof(pfr_sin6);
2005                 pfr_sin6.sin6_family = AF_INET6;
2006                 bcopy(a, &pfr_sin6.sin6_addr, sizeof(pfr_sin6.sin6_addr));
2007                 ke = (struct pfr_kentry *)rn_match((char *)&pfr_sin6,
2008                     kt->pfrkt_ip6);
2009                 if (ke && KENTRY_RNF_ROOT(ke))
2010                         ke = NULL;
2011                 break;
2012 #endif /* INET6 */
2013         }
2014         match = (ke && !ke->pfrke_not);
2015         if (match)
2016                 kt->pfrkt_match++;
2017         else
2018                 kt->pfrkt_nomatch++;
2019         return (match);
2020 }
2021
2022 void
2023 pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af,
2024     u_int64_t len, int dir_out, int op_pass, int notrule)
2025 {
2026         struct pfr_kentry       *ke = NULL;
2027         struct sockaddr_in       pfr_sin;
2028 #ifdef INET6
2029         struct sockaddr_in6      pfr_sin6;
2030 #endif
2031
2032         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2033                 kt = kt->pfrkt_root;
2034         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2035                 return;
2036
2037         switch (af) {
2038 #ifdef INET
2039         case AF_INET:
2040                 bzero(&pfr_sin, sizeof(pfr_sin));
2041                 pfr_sin.sin_len = sizeof(pfr_sin);
2042                 pfr_sin.sin_family = AF_INET;
2043                 pfr_sin.sin_addr.s_addr = a->addr32[0];
2044                 ke = (struct pfr_kentry *)rn_match((char *)&pfr_sin,
2045                     kt->pfrkt_ip4);
2046                 if (ke && KENTRY_RNF_ROOT(ke))
2047                         ke = NULL;
2048                 break;
2049 #endif /* INET */
2050 #ifdef INET6
2051         case AF_INET6:
2052                 bzero(&pfr_sin6, sizeof(pfr_sin6));
2053                 pfr_sin6.sin6_len = sizeof(pfr_sin6);
2054                 pfr_sin6.sin6_family = AF_INET6;
2055                 bcopy(a, &pfr_sin6.sin6_addr, sizeof(pfr_sin6.sin6_addr));
2056                 ke = (struct pfr_kentry *)rn_match((char *)&pfr_sin6,
2057                     kt->pfrkt_ip6);
2058                 if (ke && KENTRY_RNF_ROOT(ke))
2059                         ke = NULL;
2060                 break;
2061 #endif /* INET6 */
2062         default:
2063                 ;
2064         }
2065         if ((ke == NULL || ke->pfrke_not) != notrule) {
2066                 if (op_pass != PFR_OP_PASS)
2067                         kprintf("pfr_update_stats: assertion failed.\n");
2068                 op_pass = PFR_OP_XPASS;
2069         }
2070         kt->pfrkt_packets[dir_out][op_pass]++;
2071         kt->pfrkt_bytes[dir_out][op_pass] += len;
2072         if (ke != NULL && op_pass != PFR_OP_XPASS &&
2073             (kt->pfrkt_flags & PFR_TFLAG_COUNTERS)) {
2074                 if (ke->pfrke_counters == NULL)
2075                         ke->pfrke_counters = kmalloc(sizeof(struct pfr_kcounters),
2076                             M_PFRKCOUNTERSPL, M_NOWAIT|M_ZERO);
2077                 if (ke->pfrke_counters != NULL) {
2078                         ke->pfrke_counters->pfrkc_packets[dir_out][op_pass]++;
2079                         ke->pfrke_counters->pfrkc_bytes[dir_out][op_pass] += len;
2080                 }
2081         }
2082 }
2083
2084 struct pfr_ktable *
2085 pfr_attach_table(struct pf_ruleset *rs, char *name)
2086 {
2087         struct pfr_ktable       *kt, *rt;
2088         struct pfr_table         tbl;
2089         struct pf_anchor        *ac = rs->anchor;
2090
2091         bzero(&tbl, sizeof(tbl));
2092         strlcpy(tbl.pfrt_name, name, sizeof(tbl.pfrt_name));
2093         if (ac != NULL)
2094                 strlcpy(tbl.pfrt_anchor, ac->path, sizeof(tbl.pfrt_anchor));
2095         kt = pfr_lookup_table(&tbl);
2096         if (kt == NULL) {
2097                 kt = pfr_create_ktable(&tbl, time_second, 1);
2098                 if (kt == NULL)
2099                         return (NULL);
2100                 if (ac != NULL) {
2101                         bzero(tbl.pfrt_anchor, sizeof(tbl.pfrt_anchor));
2102                         rt = pfr_lookup_table(&tbl);
2103                         if (rt == NULL) {
2104                                 rt = pfr_create_ktable(&tbl, 0, 1);
2105                                 if (rt == NULL) {
2106                                         pfr_destroy_ktable(kt, 0);
2107                                         return (NULL);
2108                                 }
2109                                 pfr_insert_ktable(rt);
2110                         }
2111                         kt->pfrkt_root = rt;
2112                 }
2113                 pfr_insert_ktable(kt);
2114         }
2115         if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++)
2116                 pfr_setflags_ktable(kt, kt->pfrkt_flags|PFR_TFLAG_REFERENCED);
2117         return (kt);
2118 }
2119
2120 void
2121 pfr_detach_table(struct pfr_ktable *kt)
2122 {
2123         if (kt->pfrkt_refcnt[PFR_REFCNT_RULE] <= 0)
2124                 kprintf("pfr_detach_table: refcount = %d.\n",
2125                     kt->pfrkt_refcnt[PFR_REFCNT_RULE]);
2126         else if (!--kt->pfrkt_refcnt[PFR_REFCNT_RULE])
2127                 pfr_setflags_ktable(kt, kt->pfrkt_flags&~PFR_TFLAG_REFERENCED);
2128 }
2129
2130 int
2131 pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter,
2132     struct pf_addr **raddr, struct pf_addr **rmask, sa_family_t af)
2133 {
2134         struct pfr_kentry       *ke, *ke2 = NULL;
2135         struct pf_addr          *addr = NULL;
2136         union sockaddr_union     mask;
2137         int                      idx = -1, use_counter = 0;
2138         struct sockaddr_in       pfr_sin;
2139         struct sockaddr_in6      pfr_sin6;
2140         union sockaddr_union     pfr_mask;
2141
2142         if (af == AF_INET)
2143                 addr = (struct pf_addr *)&pfr_sin.sin_addr;
2144         else if (af == AF_INET6)
2145                 addr = (struct pf_addr *)&pfr_sin6.sin6_addr;
2146         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2147                 kt = kt->pfrkt_root;
2148         if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2149                 return (-1);
2150
2151         if (pidx != NULL)
2152                 idx = *pidx;
2153         if (counter != NULL && idx >= 0)
2154                 use_counter = 1;
2155         if (idx < 0)
2156                 idx = 0;
2157
2158 _next_block:
2159         ke = pfr_kentry_byidx(kt, idx, af);
2160         if (ke == NULL) {
2161                 kt->pfrkt_nomatch++;
2162                 return (1);
2163         }
2164         pfr_prepare_network(&pfr_mask, af, ke->pfrke_net);
2165         *raddr = SUNION2PF(&ke->pfrke_sa, af);
2166         *rmask = SUNION2PF(&pfr_mask, af);
2167
2168         if (use_counter) {
2169                 /* is supplied address within block? */
2170                 if (!PF_MATCHA(0, *raddr, *rmask, counter, af)) {
2171                         /* no, go to next block in table */
2172                         idx++;
2173                         use_counter = 0;
2174                         goto _next_block;
2175                 }
2176                 PF_ACPY(addr, counter, af);
2177         } else {
2178                 /* use first address of block */
2179                 PF_ACPY(addr, *raddr, af);
2180         }
2181
2182         if (!KENTRY_NETWORK(ke)) {
2183                 /* this is a single IP address - no possible nested block */
2184                 PF_ACPY(counter, addr, af);
2185                 *pidx = idx;
2186                 kt->pfrkt_match++;
2187                 return (0);
2188         }
2189         for (;;) {
2190                 /* we don't want to use a nested block */
2191                 if (af == AF_INET)
2192                         ke2 = (struct pfr_kentry *)rn_match((char *)&pfr_sin,
2193                             kt->pfrkt_ip4);
2194                 else if (af == AF_INET6)
2195                         ke2 = (struct pfr_kentry *)rn_match((char *)&pfr_sin6,
2196                             kt->pfrkt_ip6);
2197                 /* no need to check KENTRY_RNF_ROOT() here */
2198                 if (ke2 == ke) {
2199                         /* lookup return the same block - perfect */
2200                         PF_ACPY(counter, addr, af);
2201                         *pidx = idx;
2202                         kt->pfrkt_match++;
2203                         return (0);
2204                 }
2205
2206                 /* we need to increase the counter past the nested block */
2207                 pfr_prepare_network(&mask, AF_INET, ke2->pfrke_net);
2208                 PF_POOLMASK(addr, addr, SUNION2PF(&mask, af), &pfr_ffaddr, af);
2209                 PF_AINC(addr, af);
2210                 if (!PF_MATCHA(0, *raddr, *rmask, addr, af)) {
2211                         /* ok, we reached the end of our main block */
2212                         /* go to next block in table */
2213                         idx++;
2214                         use_counter = 0;
2215                         goto _next_block;
2216                 }
2217         }
2218 }
2219
2220 struct pfr_kentry *
2221 pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af)
2222 {
2223         struct pfr_walktree     w;
2224
2225         bzero(&w, sizeof(w));
2226         w.pfrw_op = PFRW_POOL_GET;
2227         w.pfrw_cnt = idx;
2228
2229         switch (af) {
2230 #ifdef INET
2231         case AF_INET:
2232                 kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
2233                 return (w.pfrw_kentry);
2234 #endif /* INET */
2235 #ifdef INET6
2236         case AF_INET6:
2237                 kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
2238                 return (w.pfrw_kentry);
2239 #endif /* INET6 */
2240         default:
2241                 return (NULL);
2242         }
2243 }
2244
2245 void
2246 pfr_dynaddr_update(struct pfr_ktable *kt, struct pfi_dynaddr *dyn)
2247 {
2248         struct pfr_walktree     w;
2249
2250         bzero(&w, sizeof(w));
2251         w.pfrw_op = PFRW_DYNADDR_UPDATE;
2252         w.pfrw_dyn = dyn;
2253
2254         crit_enter();
2255         dyn->pfid_acnt4 = 0;
2256         dyn->pfid_acnt6 = 0;
2257         if (!dyn->pfid_af || dyn->pfid_af == AF_INET)
2258                 kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
2259         if (!dyn->pfid_af || dyn->pfid_af == AF_INET6)
2260                 kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
2261         crit_exit();
2262 }