sys/net/pf/pf_ioctl.c

   1 /*      $OpenBSD: pf_ioctl.c,v 1.209 2008/06/29 08:42:15 mcbride Exp $ */
   2 /*add $OpenBSD: pf_ioctl.c,v 1.212 2009/02/15 20:42:33 mbalmer Exp $ */
   3
   4 /*
   5  * Copyright (c) 2010 The DragonFly Project.  All rights reserved.
   6  *
   7  * Copyright (c) 2001 Daniel Hartmeier
   8  * Copyright (c) 2002,2003 Henning Brauer
   9  * All rights reserved.
  10  *
  11  * Redistribution and use in source and binary forms, with or without
  12  * modification, are permitted provided that the following conditions
  13  * are met:
  14  *
  15  *    - Redistributions of source code must retain the above copyright
  16  *      notice, this list of conditions and the following disclaimer.
  17  *    - Redistributions in binary form must reproduce the above
  18  *      copyright notice, this list of conditions and the following
  19  *      disclaimer in the documentation and/or other materials provided
  20  *      with the distribution.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  23  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  24  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  25  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  26  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  27  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  28  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  29  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  30  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  32  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  33  * POSSIBILITY OF SUCH DAMAGE.
  34  *
  35  * Effort sponsored in part by the Defense Advanced Research Projects
  36  * Agency (DARPA) and Air Force Research Laboratory, Air Force
  37  * Materiel Command, USAF, under agreement number F30602-01-2-0537.
  38  *
  39  */
  40
  41 #include "opt_inet.h"
  42 #include "opt_inet6.h"
  43
  44 #include <sys/param.h>
  45 #include <sys/systm.h>
  46 #include <sys/conf.h>
  47 #include <sys/device.h>
  48 #include <sys/mbuf.h>
  49 #include <sys/filio.h>
  50 #include <sys/fcntl.h>
  51 #include <sys/socket.h>
  52 #include <sys/socketvar.h>
  53 #include <sys/kernel.h>
  54 #include <sys/kthread.h>
  55 #include <sys/time.h>
  56 #include <sys/proc.h>
  57 #include <sys/malloc.h>
  58 #include <sys/module.h>
  59 #include <sys/lock.h>
  60
  61 #include <sys/thread2.h>
  62
  63 #include <net/if.h>
  64 #include <net/if_types.h>
  65 #include <net/route.h>
  66
  67 #include <netinet/in.h>
  68 #include <netinet/in_var.h>
  69 #include <netinet/in_systm.h>
  70 #include <netinet/ip.h>
  71 #include <netinet/ip_var.h>
  72 #include <netinet/ip_icmp.h>
  73
  74 #include <net/pf/pfvar.h>
  75 #include <sys/md5.h>
  76 #include <net/pf/pfvar.h>
  77
  78 #include <net/pf/if_pflog.h>
  79 #include <net/pf/if_pfsync.h>
  80
  81 #ifdef INET6
  82 #include <netinet/ip6.h>
  83 #include <netinet/in_pcb.h>
  84 #endif /* INET6 */
  85
  86 #ifdef ALTQ
  87 #include <net/altq/altq.h>
  88 #endif
  89
  90 #include <machine/limits.h>
  91 #include <net/pfil.h>
  92 #include <sys/mutex.h>
  93
  94 u_int rt_numfibs = RT_NUMFIBS;
  95
  96 void                     pfattach(void);
  97 struct pf_pool          *pf_get_pool(char *, u_int32_t, u_int8_t, u_int32_t,
  98                             u_int8_t, u_int8_t, u_int8_t);
  99
 100 void                     pf_mv_pool(struct pf_palist *, struct pf_palist *);
 101 void                     pf_empty_pool(struct pf_palist *);
 102 #ifdef ALTQ
 103 int                      pf_begin_altq(u_int32_t *);
 104 int                      pf_rollback_altq(u_int32_t);
 105 int                      pf_commit_altq(u_int32_t);
 106 int                      pf_enable_altq(struct pf_altq *);
 107 int                      pf_disable_altq(struct pf_altq *);
 108 #endif /* ALTQ */
 109 int                      pf_begin_rules(u_int32_t *, int, const char *);
 110 int                      pf_rollback_rules(u_int32_t, int, char *);
 111 int                      pf_setup_pfsync_matching(struct pf_ruleset *);
 112 void                     pf_hash_rule(MD5_CTX *, struct pf_rule *);
 113 void                     pf_hash_rule_addr(MD5_CTX *, struct pf_rule_addr *);
 114 int                      pf_commit_rules(u_int32_t, int, char *);
 115 int                      pf_addr_setup(struct pf_ruleset *,
 116                             struct pf_addr_wrap *, sa_family_t);
 117 void                     pf_addr_copyout(struct pf_addr_wrap *);
 118
 119 struct pf_rule           pf_default_rule;
 120 struct lock              pf_consistency_lock;
 121 #ifdef ALTQ
 122 static int               pf_altq_running;
 123 #endif
 124
 125 #define TAGID_MAX        50000
 126 TAILQ_HEAD(pf_tags, pf_tagname) pf_tags = TAILQ_HEAD_INITIALIZER(pf_tags),
 127                                 pf_qids = TAILQ_HEAD_INITIALIZER(pf_qids);
 128
 129 #if (PF_QNAME_SIZE != PF_TAG_NAME_SIZE)
 130 #error PF_QNAME_SIZE must be equal to PF_TAG_NAME_SIZE
 131 #endif
 132 u_int16_t                tagname2tag(struct pf_tags *, char *);
 133 void                     tag2tagname(struct pf_tags *, u_int16_t, char *);
 134 void                     tag_unref(struct pf_tags *, u_int16_t);
 135 int                      pf_rtlabel_add(struct pf_addr_wrap *);
 136 void                     pf_rtlabel_remove(struct pf_addr_wrap *);
 137 void                     pf_rtlabel_copyout(struct pf_addr_wrap *);
 138
 139 #define DPFPRINTF(n, x) if (pf_status.debug >= (n)) kprintf x
 140
 141 static cdev_t   pf_dev;
 142
 143 static MALLOC_DEFINE(M_PFRULEPL, "pfrulepl", "pf rule pool list");
 144 static MALLOC_DEFINE(M_PFALTQPL, "pfaltqpl", "pf altq pool list");
 145 static MALLOC_DEFINE(M_PFPOOLADDRPL, "pfpooladdrpl", "pf pool address pool list");
 146 static MALLOC_DEFINE(M_PFFRENTPL, "pffrent", "pf frent pool list");
 147
 148
 149 /*
 150  * XXX - These are new and need to be checked when moveing to a new version
 151  */
 152 static void              pf_clear_states(void);
 153 static int               pf_clear_tables(void);
 154 static void              pf_clear_srcnodes(void);
 155 /*
 156  * XXX - These are new and need to be checked when moveing to a new version
 157  */
 158
 159 /*
 160  * Wrapper functions for pfil(9) hooks
 161  */
 162 static int pf_check_in(void *arg, struct mbuf **m, struct ifnet *ifp,
 163                 int dir);
 164 static int pf_check_out(void *arg, struct mbuf **m, struct ifnet *ifp,
 165                 int dir);
 166 #ifdef INET6
 167 static int pf_check6_in(void *arg, struct mbuf **m, struct ifnet *ifp,
 168                 int dir);
 169 static int pf_check6_out(void *arg, struct mbuf **m, struct ifnet *ifp,
 170                 int dir);
 171 #endif
 172
 173 static int               hook_pf(void);
 174 static int               dehook_pf(void);
 175 static int               shutdown_pf(void);
 176 static int               pf_load(void);
 177 static int               pf_unload(void);
 178
 179 d_open_t        pfopen;
 180 d_close_t       pfclose;
 181 d_ioctl_t       pfioctl;
 182
 183 static struct dev_ops pf_ops = {            /* XXX convert to port model */
 184         { PF_NAME, 73, 0 },
 185         .d_open =       pfopen,
 186         .d_close =      pfclose,
 187         .d_ioctl =      pfioctl
 188 };
 189
 190 static volatile int pf_pfil_hooked = 0;
 191 int pf_end_threads = 0;
 192
 193 int debug_pfugidhack = 0;
 194 SYSCTL_INT(_debug, OID_AUTO, pfugidhack, CTLFLAG_RW, &debug_pfugidhack, 0,
 195         "Enable/disable pf user/group rules mpsafe hack");
 196
 197 void
 198 pfattach(void)
 199 {
 200         u_int32_t *my_timeout = pf_default_rule.timeout;
 201
 202
 203         if (!rn_inithead((void **)&pf_maskhead, NULL, 0)) {
 204                 kprintf("pf mask radix tree create failed\n");
 205                 return;
 206         }
 207         kmalloc_create(&pf_state_pl, "pf state pool list");
 208         kmalloc_raise_limit(pf_state_pl, 0);
 209         kmalloc_create(&pf_frent_pl, "pf fragment pool list");
 210         kmalloc_raise_limit(pf_frent_pl, 0);
 211         kmalloc_create(&pf_cent_pl, "pf cent pool list");
 212         kmalloc_raise_limit(pf_cent_pl, 0);
 213
 214         pfr_initialize();
 215         pfi_initialize();
 216         pf_osfp_initialize();
 217
 218         pf_pool_limits[PF_LIMIT_STATES].pp = pf_state_pl;
 219         pf_pool_limits[PF_LIMIT_STATES].limit = PFSTATE_HIWAT;
 220         pf_pool_limits[PF_LIMIT_FRAGS].pp = pf_frent_pl;
 221         pf_pool_limits[PF_LIMIT_FRAGS].limit = PFFRAG_FRENT_HIWAT;
 222         if (ctob(physmem) <= 100*1024*1024)
 223                 pf_pool_limits[PF_LIMIT_TABLE_ENTRIES].limit =
 224                     PFR_KENTRY_HIWAT_SMALL;
 225
 226         RB_INIT(&tree_src_tracking);
 227         RB_INIT(&pf_anchors);
 228         pf_init_ruleset(&pf_main_ruleset);
 229         TAILQ_INIT(&pf_altqs[0]);
 230         TAILQ_INIT(&pf_altqs[1]);
 231         TAILQ_INIT(&pf_pabuf);
 232         pf_altqs_active = &pf_altqs[0];
 233         pf_altqs_inactive = &pf_altqs[1];
 234         TAILQ_INIT(&state_list);
 235
 236         /* default rule should never be garbage collected */
 237         pf_default_rule.entries.tqe_prev = &pf_default_rule.entries.tqe_next;
 238         pf_default_rule.action = PF_PASS;
 239         pf_default_rule.nr = (uint32_t)(-1);
 240         pf_default_rule.rtableid = -1;
 241
 242         /* initialize default timeouts */
 243         my_timeout[PFTM_TCP_FIRST_PACKET] = 120;        /* First TCP packet */
 244         my_timeout[PFTM_TCP_OPENING] = 30;              /* No response yet */
 245         my_timeout[PFTM_TCP_ESTABLISHED] = 24*60*60;    /* Established */
 246         my_timeout[PFTM_TCP_CLOSING] = 15 * 60;         /* Half closed */
 247         my_timeout[PFTM_TCP_FIN_WAIT] = 45;             /* Got both FINs */
 248         my_timeout[PFTM_TCP_CLOSED] = 90;               /* Got a RST */
 249         my_timeout[PFTM_UDP_FIRST_PACKET] = 60;         /* First UDP packet */
 250         my_timeout[PFTM_UDP_SINGLE] = 30;               /* Unidirectional */
 251         my_timeout[PFTM_UDP_MULTIPLE] = 60;             /* Bidirectional */
 252         my_timeout[PFTM_ICMP_FIRST_PACKET] = 20;        /* First ICMP packet */
 253         my_timeout[PFTM_ICMP_ERROR_REPLY] = 10;         /* Got error response */
 254         my_timeout[PFTM_OTHER_FIRST_PACKET] = 60;       /* First packet */
 255         my_timeout[PFTM_OTHER_SINGLE] = 30;             /* Unidirectional */
 256         my_timeout[PFTM_OTHER_MULTIPLE] = 60;           /* Bidirectional */
 257         my_timeout[PFTM_FRAG] = 30;                     /* Fragment expire */
 258         my_timeout[PFTM_INTERVAL] = 10;                 /* Expire interval */
 259         my_timeout[PFTM_SRC_NODE] = 0;          /* Source Tracking */
 260         my_timeout[PFTM_TS_DIFF] = 30;          /* Allowed TS diff */
 261         my_timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START;
 262         my_timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END;
 263
 264         pf_normalize_init();
 265         bzero(&pf_status, sizeof(pf_status));
 266         pf_status.debug = PF_DEBUG_URGENT;
 267         /* XXX do our best to avoid a conflict */
 268         pf_status.hostid = karc4random();
 269
 270         if (kthread_create(pf_purge_thread, NULL, NULL, "pfpurge"))
 271                 panic("pfpurge thread");
 272 }
 273
 274 int
 275 pfopen(struct dev_open_args *ap)
 276 {
 277         lwkt_gettoken(&pf_token);
 278         cdev_t dev = ap->a_head.a_dev;
 279         if (minor(dev) >= 1) {
 280                 lwkt_reltoken(&pf_token);
 281                 return (ENXIO);
 282         }
 283         lwkt_reltoken(&pf_token);
 284         return (0);
 285 }
 286
 287 int
 288 pfclose(struct dev_close_args *ap)
 289 {
 290         lwkt_gettoken(&pf_token);
 291         cdev_t dev = ap->a_head.a_dev;
 292         if (minor(dev) >= 1) {
 293                 lwkt_reltoken(&pf_token);
 294                 return (ENXIO);
 295         }
 296         lwkt_reltoken(&pf_token);
 297         return (0);
 298 }
 299
 300 struct pf_pool *
 301 pf_get_pool(char *anchor, u_int32_t ticket, u_int8_t rule_action,
 302     u_int32_t rule_number, u_int8_t r_last, u_int8_t active,
 303     u_int8_t check_ticket)
 304 {
 305         struct pf_ruleset       *ruleset;
 306         struct pf_rule          *rule;
 307         int                      rs_num;
 308
 309         ruleset = pf_find_ruleset(anchor);
 310         if (ruleset == NULL)
 311                 return (NULL);
 312         rs_num = pf_get_ruleset_number(rule_action);
 313         if (rs_num >= PF_RULESET_MAX)
 314                 return (NULL);
 315         if (active) {
 316                 if (check_ticket && ticket !=
 317                     ruleset->rules[rs_num].active.ticket)
 318                         return (NULL);
 319                 if (r_last)
 320                         rule = TAILQ_LAST(ruleset->rules[rs_num].active.ptr,
 321                             pf_rulequeue);
 322                 else
 323                         rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr);
 324         } else {
 325                 if (check_ticket && ticket !=
 326                     ruleset->rules[rs_num].inactive.ticket)
 327                         return (NULL);
 328                 if (r_last)
 329                         rule = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr,
 330                             pf_rulequeue);
 331                 else
 332                         rule = TAILQ_FIRST(ruleset->rules[rs_num].inactive.ptr);
 333         }
 334         if (!r_last) {
 335                 while ((rule != NULL) && (rule->nr != rule_number))
 336                         rule = TAILQ_NEXT(rule, entries);
 337         }
 338         if (rule == NULL)
 339                 return (NULL);
 340
 341         return (&rule->rpool);
 342 }
 343
 344 void
 345 pf_mv_pool(struct pf_palist *poola, struct pf_palist *poolb)
 346 {
 347         struct pf_pooladdr      *mv_pool_pa;
 348
 349         while ((mv_pool_pa = TAILQ_FIRST(poola)) != NULL) {
 350                 TAILQ_REMOVE(poola, mv_pool_pa, entries);
 351                 TAILQ_INSERT_TAIL(poolb, mv_pool_pa, entries);
 352         }
 353 }
 354
 355 void
 356 pf_empty_pool(struct pf_palist *poola)
 357 {
 358         struct pf_pooladdr      *empty_pool_pa;
 359
 360         while ((empty_pool_pa = TAILQ_FIRST(poola)) != NULL) {
 361                 pfi_dynaddr_remove(&empty_pool_pa->addr);
 362                 pf_tbladdr_remove(&empty_pool_pa->addr);
 363                 pfi_kif_unref(empty_pool_pa->kif, PFI_KIF_REF_RULE);
 364                 TAILQ_REMOVE(poola, empty_pool_pa, entries);
 365                 kfree(empty_pool_pa, M_PFPOOLADDRPL);
 366         }
 367 }
 368
 369 void
 370 pf_rm_rule(struct pf_rulequeue *rulequeue, struct pf_rule *rule)
 371 {
 372         if (rulequeue != NULL) {
 373                 if (rule->states_cur <= 0) {
 374                         /*
 375                          * XXX - we need to remove the table *before* detaching
 376                          * the rule to make sure the table code does not delete
 377                          * the anchor under our feet.
 378                          */
 379                         pf_tbladdr_remove(&rule->src.addr);
 380                         pf_tbladdr_remove(&rule->dst.addr);
 381                         if (rule->overload_tbl)
 382                                 pfr_detach_table(rule->overload_tbl);
 383                 }
 384                 TAILQ_REMOVE(rulequeue, rule, entries);
 385                 rule->entries.tqe_prev = NULL;
 386                 rule->nr = -1;
 387         }
 388
 389         if (rule->states_cur > 0 || rule->src_nodes > 0 ||
 390             rule->entries.tqe_prev != NULL)
 391                 return;
 392         pf_tag_unref(rule->tag);
 393         pf_tag_unref(rule->match_tag);
 394 #ifdef ALTQ
 395         if (rule->pqid != rule->qid)
 396                 pf_qid_unref(rule->pqid);
 397         pf_qid_unref(rule->qid);
 398 #endif
 399         pf_rtlabel_remove(&rule->src.addr);
 400         pf_rtlabel_remove(&rule->dst.addr);
 401         pfi_dynaddr_remove(&rule->src.addr);
 402         pfi_dynaddr_remove(&rule->dst.addr);
 403         if (rulequeue == NULL) {
 404                 pf_tbladdr_remove(&rule->src.addr);
 405                 pf_tbladdr_remove(&rule->dst.addr);
 406                 if (rule->overload_tbl)
 407                         pfr_detach_table(rule->overload_tbl);
 408         }
 409         pfi_kif_unref(rule->kif, PFI_KIF_REF_RULE);
 410         pf_anchor_remove(rule);
 411         pf_empty_pool(&rule->rpool.list);
 412         kfree(rule, M_PFRULEPL);
 413 }
 414
 415 u_int16_t
 416 tagname2tag(struct pf_tags *head, char *tagname)
 417 {
 418         struct pf_tagname       *tag, *p = NULL;
 419         u_int16_t                new_tagid = 1;
 420
 421         TAILQ_FOREACH(tag, head, entries)
 422                 if (strcmp(tagname, tag->name) == 0) {
 423                         tag->ref++;
 424                         return (tag->tag);
 425                 }
 426
 427         /*
 428          * to avoid fragmentation, we do a linear search from the beginning
 429          * and take the first free slot we find. if there is none or the list
 430          * is empty, append a new entry at the end.
 431          */
 432
 433         /* new entry */
 434         if (!TAILQ_EMPTY(head))
 435                 for (p = TAILQ_FIRST(head); p != NULL &&
 436                     p->tag == new_tagid; p = TAILQ_NEXT(p, entries))
 437                         new_tagid = p->tag + 1;
 438
 439         if (new_tagid > TAGID_MAX)
 440                 return (0);
 441
 442         /* allocate and fill new struct pf_tagname */
 443         tag = kmalloc(sizeof(*tag), M_TEMP, M_WAITOK);
 444         strlcpy(tag->name, tagname, sizeof(tag->name));
 445         tag->tag = new_tagid;
 446         tag->ref++;
 447
 448         if (p != NULL)  /* insert new entry before p */
 449                 TAILQ_INSERT_BEFORE(p, tag, entries);
 450         else    /* either list empty or no free slot in between */
 451                 TAILQ_INSERT_TAIL(head, tag, entries);
 452
 453         return (tag->tag);
 454 }
 455
 456 void
 457 tag2tagname(struct pf_tags *head, u_int16_t tagid, char *p)
 458 {
 459         struct pf_tagname       *tag;
 460
 461         TAILQ_FOREACH(tag, head, entries)
 462                 if (tag->tag == tagid) {
 463                         strlcpy(p, tag->name, PF_TAG_NAME_SIZE);
 464                         return;
 465                 }
 466 }
 467
 468 void
 469 tag_unref(struct pf_tags *head, u_int16_t tag)
 470 {
 471         struct pf_tagname       *p, *next;
 472
 473         if (tag == 0)
 474                 return;
 475
 476         for (p = TAILQ_FIRST(head); p != NULL; p = next) {
 477                 next = TAILQ_NEXT(p, entries);
 478                 if (tag == p->tag) {
 479                         if (--p->ref == 0) {
 480                                 TAILQ_REMOVE(head, p, entries);
 481                                 kfree(p, M_TEMP);
 482                         }
 483                         break;
 484                 }
 485         }
 486 }
 487
 488 u_int16_t
 489 pf_tagname2tag(char *tagname)
 490 {
 491         return (tagname2tag(&pf_tags, tagname));
 492 }
 493
 494 void
 495 pf_tag2tagname(u_int16_t tagid, char *p)
 496 {
 497         tag2tagname(&pf_tags, tagid, p);
 498 }
 499
 500 void
 501 pf_tag_ref(u_int16_t tag)
 502 {
 503         struct pf_tagname *t;
 504
 505         TAILQ_FOREACH(t, &pf_tags, entries)
 506                 if (t->tag == tag)
 507                         break;
 508         if (t != NULL)
 509                 t->ref++;
 510 }
 511
 512 void
 513 pf_tag_unref(u_int16_t tag)
 514 {
 515         tag_unref(&pf_tags, tag);
 516 }
 517
 518 int
 519 pf_rtlabel_add(struct pf_addr_wrap *a)
 520 {
 521         return (0);
 522 }
 523
 524 void
 525 pf_rtlabel_remove(struct pf_addr_wrap *a)
 526 {
 527 }
 528
 529 void
 530 pf_rtlabel_copyout(struct pf_addr_wrap *a)
 531 {
 532         if (a->type == PF_ADDR_RTLABEL && a->v.rtlabel)
 533                 strlcpy(a->v.rtlabelname, "?", sizeof(a->v.rtlabelname));
 534 }
 535
 536 #ifdef ALTQ
 537 u_int32_t
 538 pf_qname2qid(char *qname)
 539 {
 540         return ((u_int32_t)tagname2tag(&pf_qids, qname));
 541 }
 542
 543 void
 544 pf_qid2qname(u_int32_t qid, char *p)
 545 {
 546         tag2tagname(&pf_qids, (u_int16_t)qid, p);
 547 }
 548
 549 void
 550 pf_qid_unref(u_int32_t qid)
 551 {
 552         tag_unref(&pf_qids, (u_int16_t)qid);
 553 }
 554
 555 int
 556 pf_begin_altq(u_int32_t *ticket)
 557 {
 558         struct pf_altq  *altq;
 559         int              error = 0;
 560
 561         /* Purge the old altq list */
 562         while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) {
 563                 TAILQ_REMOVE(pf_altqs_inactive, altq, entries);
 564                 if (altq->qname[0] == 0) {
 565                         /* detach and destroy the discipline */
 566                         error = altq_remove(altq);
 567                 } else
 568                         pf_qid_unref(altq->qid);
 569                 kfree(altq, M_PFALTQPL);
 570         }
 571         if (error)
 572                 return (error);
 573         *ticket = ++ticket_altqs_inactive;
 574         altqs_inactive_open = 1;
 575         return (0);
 576 }
 577
 578 int
 579 pf_rollback_altq(u_int32_t ticket)
 580 {
 581         struct pf_altq  *altq;
 582         int              error = 0;
 583
 584         if (!altqs_inactive_open || ticket != ticket_altqs_inactive)
 585                 return (0);
 586         /* Purge the old altq list */
 587         while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) {
 588                 TAILQ_REMOVE(pf_altqs_inactive, altq, entries);
 589                 if (altq->qname[0] == 0) {
 590                         /* detach and destroy the discipline */
 591                         error = altq_remove(altq);
 592                 } else
 593                         pf_qid_unref(altq->qid);
 594                 kfree(altq, M_PFALTQPL);
 595         }
 596         altqs_inactive_open = 0;
 597         return (error);
 598 }
 599
 600 int
 601 pf_commit_altq(u_int32_t ticket)
 602 {
 603         struct pf_altqqueue     *old_altqs;
 604         struct pf_altq          *altq;
 605         int                      err, error = 0;
 606
 607         if (!altqs_inactive_open || ticket != ticket_altqs_inactive)
 608                 return (EBUSY);
 609
 610         /* swap altqs, keep the old. */
 611         crit_enter();
 612         old_altqs = pf_altqs_active;
 613         pf_altqs_active = pf_altqs_inactive;
 614         pf_altqs_inactive = old_altqs;
 615         ticket_altqs_active = ticket_altqs_inactive;
 616
 617         /* Attach new disciplines */
 618         TAILQ_FOREACH(altq, pf_altqs_active, entries) {
 619                 if (altq->qname[0] == 0) {
 620                         /* attach the discipline */
 621                         error = altq_pfattach(altq);
 622                         if (error) {
 623                                 crit_exit();
 624                                 return (error);
 625                         }
 626                 }
 627         }
 628
 629         /* Purge the old altq list */
 630         while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) {
 631                 TAILQ_REMOVE(pf_altqs_inactive, altq, entries);
 632                 if (altq->qname[0] == 0) {
 633                         /* detach and destroy the discipline */
 634                         if (pf_altq_running)
 635                                 error = pf_disable_altq(altq);
 636                         err = altq_pfdetach(altq);
 637                         if (err != 0 && error == 0)
 638                                 error = err;
 639                         err = altq_remove(altq);
 640                         if (err != 0 && error == 0)
 641                                 error = err;
 642                 } else
 643                         pf_qid_unref(altq->qid);
 644                 kfree(altq, M_PFALTQPL);
 645         }
 646         crit_exit();
 647
 648         altqs_inactive_open = 0;
 649         return (error);
 650 }
 651
 652 int
 653 pf_enable_altq(struct pf_altq *altq)
 654 {
 655         struct ifnet            *ifp;
 656         struct tb_profile        tb;
 657         int                      error = 0;
 658
 659         if ((ifp = ifunit(altq->ifname)) == NULL)
 660                 return (EINVAL);
 661
 662         if (ifp->if_snd.altq_type != ALTQT_NONE)
 663                 error = altq_enable(&ifp->if_snd);
 664
 665         /* set tokenbucket regulator */
 666         if (error == 0 && ifp != NULL && ALTQ_IS_ENABLED(&ifp->if_snd)) {
 667                 tb.rate = altq->ifbandwidth;
 668                 tb.depth = altq->tbrsize;
 669                 crit_enter();
 670                 error = tbr_set(&ifp->if_snd, &tb);
 671                 crit_exit();
 672         }
 673
 674         return (error);
 675 }
 676
 677 int
 678 pf_disable_altq(struct pf_altq *altq)
 679 {
 680         struct ifnet            *ifp;
 681         struct tb_profile        tb;
 682         int                      error;
 683
 684         if ((ifp = ifunit(altq->ifname)) == NULL)
 685                 return (EINVAL);
 686
 687         /*
 688          * when the discipline is no longer referenced, it was overridden
 689          * by a new one.  if so, just return.
 690          */
 691         if (altq->altq_disc != ifp->if_snd.altq_disc)
 692                 return (0);
 693
 694         error = altq_disable(&ifp->if_snd);
 695
 696         if (error == 0) {
 697                 /* clear tokenbucket regulator */
 698                 tb.rate = 0;
 699                 crit_enter();
 700                 error = tbr_set(&ifp->if_snd, &tb);
 701                 crit_exit();
 702         }
 703
 704         return (error);
 705 }
 706 #endif /* ALTQ */
 707
 708 int
 709 pf_begin_rules(u_int32_t *ticket, int rs_num, const char *anchor)
 710 {
 711         struct pf_ruleset       *rs;
 712         struct pf_rule          *rule;
 713
 714         if (rs_num < 0 || rs_num >= PF_RULESET_MAX)
 715                 return (EINVAL);
 716         rs = pf_find_or_create_ruleset(anchor);
 717         if (rs == NULL)
 718                 return (EINVAL);
 719         while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) {
 720                 pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule);
 721                 rs->rules[rs_num].inactive.rcount--;
 722         }
 723         *ticket = ++rs->rules[rs_num].inactive.ticket;
 724         rs->rules[rs_num].inactive.open = 1;
 725         return (0);
 726 }
 727
 728 int
 729 pf_rollback_rules(u_int32_t ticket, int rs_num, char *anchor)
 730 {
 731         struct pf_ruleset       *rs;
 732         struct pf_rule          *rule;
 733
 734         if (rs_num < 0 || rs_num >= PF_RULESET_MAX)
 735                 return (EINVAL);
 736         rs = pf_find_ruleset(anchor);
 737         if (rs == NULL || !rs->rules[rs_num].inactive.open ||
 738             rs->rules[rs_num].inactive.ticket != ticket)
 739                 return (0);
 740         while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) {
 741                 pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule);
 742                 rs->rules[rs_num].inactive.rcount--;
 743         }
 744         rs->rules[rs_num].inactive.open = 0;
 745         return (0);
 746 }
 747
 748 #define PF_MD5_UPD(st, elm)                                             \
 749                 MD5Update(ctx, (u_int8_t *) &(st)->elm, sizeof((st)->elm))
 750
 751 #define PF_MD5_UPD_STR(st, elm)                                         \
 752                 MD5Update(ctx, (u_int8_t *) (st)->elm, strlen((st)->elm))
 753
 754 #define PF_MD5_UPD_HTONL(st, elm, stor) do {                            \
 755                 (stor) = htonl((st)->elm);                              \
 756                 MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int32_t));\
 757 } while (0)
 758
 759 #define PF_MD5_UPD_HTONS(st, elm, stor) do {                            \
 760                 (stor) = htons((st)->elm);                              \
 761                 MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int16_t));\
 762 } while (0)
 763
 764 void
 765 pf_hash_rule_addr(MD5_CTX *ctx, struct pf_rule_addr *pfr)
 766 {
 767         PF_MD5_UPD(pfr, addr.type);
 768         switch (pfr->addr.type) {
 769                 case PF_ADDR_DYNIFTL:
 770                         PF_MD5_UPD(pfr, addr.v.ifname);
 771                         PF_MD5_UPD(pfr, addr.iflags);
 772                         break;
 773                 case PF_ADDR_TABLE:
 774                         PF_MD5_UPD(pfr, addr.v.tblname);
 775                         break;
 776                 case PF_ADDR_ADDRMASK:
 777                         /* XXX ignore af? */
 778                         PF_MD5_UPD(pfr, addr.v.a.addr.addr32);
 779                         PF_MD5_UPD(pfr, addr.v.a.mask.addr32);
 780                         break;
 781                 case PF_ADDR_RTLABEL:
 782                         PF_MD5_UPD(pfr, addr.v.rtlabelname);
 783                         break;
 784         }
 785
 786         PF_MD5_UPD(pfr, port[0]);
 787         PF_MD5_UPD(pfr, port[1]);
 788         PF_MD5_UPD(pfr, neg);
 789         PF_MD5_UPD(pfr, port_op);
 790 }
 791
 792 void
 793 pf_hash_rule(MD5_CTX *ctx, struct pf_rule *rule)
 794 {
 795         u_int16_t x;
 796         u_int32_t y;
 797
 798         pf_hash_rule_addr(ctx, &rule->src);
 799         pf_hash_rule_addr(ctx, &rule->dst);
 800         PF_MD5_UPD_STR(rule, label);
 801         PF_MD5_UPD_STR(rule, ifname);
 802         PF_MD5_UPD_STR(rule, match_tagname);
 803         PF_MD5_UPD_HTONS(rule, match_tag, x); /* dup? */
 804         PF_MD5_UPD_HTONL(rule, os_fingerprint, y);
 805         PF_MD5_UPD_HTONL(rule, prob, y);
 806         PF_MD5_UPD_HTONL(rule, uid.uid[0], y);
 807         PF_MD5_UPD_HTONL(rule, uid.uid[1], y);
 808         PF_MD5_UPD(rule, uid.op);
 809         PF_MD5_UPD_HTONL(rule, gid.gid[0], y);
 810         PF_MD5_UPD_HTONL(rule, gid.gid[1], y);
 811         PF_MD5_UPD(rule, gid.op);
 812         PF_MD5_UPD_HTONL(rule, rule_flag, y);
 813         PF_MD5_UPD(rule, action);
 814         PF_MD5_UPD(rule, direction);
 815         PF_MD5_UPD(rule, af);
 816         PF_MD5_UPD(rule, quick);
 817         PF_MD5_UPD(rule, ifnot);
 818         PF_MD5_UPD(rule, match_tag_not);
 819         PF_MD5_UPD(rule, natpass);
 820         PF_MD5_UPD(rule, keep_state);
 821         PF_MD5_UPD(rule, proto);
 822         PF_MD5_UPD(rule, type);
 823         PF_MD5_UPD(rule, code);
 824         PF_MD5_UPD(rule, flags);
 825         PF_MD5_UPD(rule, flagset);
 826         PF_MD5_UPD(rule, allow_opts);
 827         PF_MD5_UPD(rule, rt);
 828         PF_MD5_UPD(rule, tos);
 829 }
 830
 831 int
 832 pf_commit_rules(u_int32_t ticket, int rs_num, char *anchor)
 833 {
 834         struct pf_ruleset       *rs;
 835         struct pf_rule          *rule, **old_array;
 836         struct pf_rulequeue     *old_rules;
 837         int                      error;
 838         u_int32_t                old_rcount;
 839
 840         if (rs_num < 0 || rs_num >= PF_RULESET_MAX)
 841                 return (EINVAL);
 842         rs = pf_find_ruleset(anchor);
 843         if (rs == NULL || !rs->rules[rs_num].inactive.open ||
 844             ticket != rs->rules[rs_num].inactive.ticket)
 845                 return (EBUSY);
 846
 847         /* Calculate checksum for the main ruleset */
 848         if (rs == &pf_main_ruleset) {
 849                 error = pf_setup_pfsync_matching(rs);
 850                 if (error != 0)
 851                         return (error);
 852         }
 853
 854         /* Swap rules, keep the old. */
 855         crit_enter();
 856         old_rules = rs->rules[rs_num].active.ptr;
 857         old_rcount = rs->rules[rs_num].active.rcount;
 858         old_array = rs->rules[rs_num].active.ptr_array;
 859
 860         rs->rules[rs_num].active.ptr =
 861             rs->rules[rs_num].inactive.ptr;
 862         rs->rules[rs_num].active.ptr_array =
 863             rs->rules[rs_num].inactive.ptr_array;
 864         rs->rules[rs_num].active.rcount =
 865             rs->rules[rs_num].inactive.rcount;
 866         rs->rules[rs_num].inactive.ptr = old_rules;
 867         rs->rules[rs_num].inactive.ptr_array = old_array;
 868         rs->rules[rs_num].inactive.rcount = old_rcount;
 869
 870         rs->rules[rs_num].active.ticket =
 871             rs->rules[rs_num].inactive.ticket;
 872         pf_calc_skip_steps(rs->rules[rs_num].active.ptr);
 873
 874
 875         /* Purge the old rule list. */
 876         while ((rule = TAILQ_FIRST(old_rules)) != NULL)
 877                 pf_rm_rule(old_rules, rule);
 878         if (rs->rules[rs_num].inactive.ptr_array)
 879                 kfree(rs->rules[rs_num].inactive.ptr_array, M_TEMP);
 880         rs->rules[rs_num].inactive.ptr_array = NULL;
 881         rs->rules[rs_num].inactive.rcount = 0;
 882         rs->rules[rs_num].inactive.open = 0;
 883         pf_remove_if_empty_ruleset(rs);
 884         crit_exit();
 885         return (0);
 886 }
 887
 888 int
 889 pf_setup_pfsync_matching(struct pf_ruleset *rs)
 890 {
 891         MD5_CTX                  ctx;
 892         struct pf_rule          *rule;
 893         int                      rs_cnt;
 894         u_int8_t                 digest[PF_MD5_DIGEST_LENGTH];
 895
 896         MD5Init(&ctx);
 897         for (rs_cnt = 0; rs_cnt < PF_RULESET_MAX; rs_cnt++) {
 898                 /* XXX PF_RULESET_SCRUB as well? */
 899                 if (rs_cnt == PF_RULESET_SCRUB)
 900                         continue;
 901
 902                 if (rs->rules[rs_cnt].inactive.ptr_array)
 903                         kfree(rs->rules[rs_cnt].inactive.ptr_array, M_TEMP);
 904                 rs->rules[rs_cnt].inactive.ptr_array = NULL;
 905
 906                 if (rs->rules[rs_cnt].inactive.rcount) {
 907                         rs->rules[rs_cnt].inactive.ptr_array =
 908                             kmalloc(sizeof(caddr_t) *
 909                                     rs->rules[rs_cnt].inactive.rcount,
 910                                     M_TEMP, M_WAITOK);
 911
 912                         if (!rs->rules[rs_cnt].inactive.ptr_array)
 913                                 return (ENOMEM);
 914                 }
 915
 916                 TAILQ_FOREACH(rule, rs->rules[rs_cnt].inactive.ptr,
 917                     entries) {
 918                         pf_hash_rule(&ctx, rule);
 919                         (rs->rules[rs_cnt].inactive.ptr_array)[rule->nr] = rule;
 920                 }
 921         }
 922
 923         MD5Final(digest, &ctx);
 924         memcpy(pf_status.pf_chksum, digest, sizeof(pf_status.pf_chksum));
 925         return (0);
 926 }
 927
 928 int
 929 pf_addr_setup(struct pf_ruleset *ruleset, struct pf_addr_wrap *addr,
 930     sa_family_t af)
 931 {
 932         if (pfi_dynaddr_setup(addr, af) ||
 933             pf_tbladdr_setup(ruleset, addr))
 934                 return (EINVAL);
 935
 936         return (0);
 937 }
 938
 939 void
 940 pf_addr_copyout(struct pf_addr_wrap *addr)
 941 {
 942         pfi_dynaddr_copyout(addr);
 943         pf_tbladdr_copyout(addr);
 944         pf_rtlabel_copyout(addr);
 945 }
 946
 947 int
 948 pfioctl(struct dev_ioctl_args *ap)
 949 {
 950         u_long cmd = ap->a_cmd;
 951         caddr_t addr = ap->a_data;
 952         struct pf_pooladdr      *pa = NULL;
 953         struct pf_pool          *pool = NULL;
 954         int                      error = 0;
 955
 956         lwkt_gettoken(&pf_token);
 957
 958         /* XXX keep in sync with switch() below */
 959         if (securelevel > 1)
 960                 switch (cmd) {
 961                 case DIOCGETRULES:
 962                 case DIOCGETRULE:
 963                 case DIOCGETADDRS:
 964                 case DIOCGETADDR:
 965                 case DIOCGETSTATE:
 966                 case DIOCSETSTATUSIF:
 967                 case DIOCGETSTATUS:
 968                 case DIOCCLRSTATUS:
 969                 case DIOCNATLOOK:
 970                 case DIOCSETDEBUG:
 971                 case DIOCGETSTATES:
 972                 case DIOCGETTIMEOUT:
 973                 case DIOCCLRRULECTRS:
 974                 case DIOCGETLIMIT:
 975                 case DIOCGETALTQS:
 976                 case DIOCGETALTQ:
 977                 case DIOCGETQSTATS:
 978                 case DIOCGETRULESETS:
 979                 case DIOCGETRULESET:
 980                 case DIOCRGETTABLES:
 981                 case DIOCRGETTSTATS:
 982                 case DIOCRCLRTSTATS:
 983                 case DIOCRCLRADDRS:
 984                 case DIOCRADDADDRS:
 985                 case DIOCRDELADDRS:
 986                 case DIOCRSETADDRS:
 987                 case DIOCRGETADDRS:
 988                 case DIOCRGETASTATS:
 989                 case DIOCRCLRASTATS:
 990                 case DIOCRTSTADDRS:
 991                 case DIOCOSFPGET:
 992                 case DIOCGETSRCNODES:
 993                 case DIOCCLRSRCNODES:
 994                 case DIOCIGETIFACES:
 995                 case DIOCSETIFFLAG:
 996                 case DIOCCLRIFFLAG:
 997                 case DIOCGIFSPEED:
 998                         break;
 999                 case DIOCRCLRTABLES:
1000                 case DIOCRADDTABLES:
1001                 case DIOCRDELTABLES:
1002                 case DIOCRSETTFLAGS:
1003                         if (((struct pfioc_table *)addr)->pfrio_flags &
1004                             PFR_FLAG_DUMMY)
1005                                 break; /* dummy operation ok */
1006                         lwkt_reltoken(&pf_token);
1007                         return (EPERM);
1008                 default:
1009                         lwkt_reltoken(&pf_token);
1010                         return (EPERM);
1011                 }
1012
1013         if (!(ap->a_fflag & FWRITE))
1014                 switch (cmd) {
1015                 case DIOCGETRULES:
1016                 case DIOCGETADDRS:
1017                 case DIOCGETADDR:
1018                 case DIOCGETSTATE:
1019                 case DIOCGETSTATUS:
1020                 case DIOCGETSTATES:
1021                 case DIOCGETTIMEOUT:
1022                 case DIOCGETLIMIT:
1023                 case DIOCGETALTQS:
1024                 case DIOCGETALTQ:
1025                 case DIOCGETQSTATS:
1026                 case DIOCGETRULESETS:
1027                 case DIOCGETRULESET:
1028                 case DIOCNATLOOK:
1029                 case DIOCRGETTABLES:
1030                 case DIOCRGETTSTATS:
1031                 case DIOCRGETADDRS:
1032                 case DIOCRGETASTATS:
1033                 case DIOCRTSTADDRS:
1034                 case DIOCOSFPGET:
1035                 case DIOCGETSRCNODES:
1036                 case DIOCIGETIFACES:
1037                 case DIOCGIFSPEED:
1038                         break;
1039                 case DIOCRCLRTABLES:
1040                 case DIOCRADDTABLES:
1041                 case DIOCRDELTABLES:
1042                 case DIOCRCLRTSTATS:
1043                 case DIOCRCLRADDRS:
1044                 case DIOCRADDADDRS:
1045                 case DIOCRDELADDRS:
1046                 case DIOCRSETADDRS:
1047                 case DIOCRSETTFLAGS:
1048                         if (((struct pfioc_table *)addr)->pfrio_flags &
1049                             PFR_FLAG_DUMMY)
1050                                 break; /* dummy operation ok */
1051                         lwkt_reltoken(&pf_token);
1052                         return (EACCES);
1053                 case DIOCGETRULE:
1054                         if (((struct pfioc_rule *)addr)->action ==
1055                             PF_GET_CLR_CNTR) {
1056                                 lwkt_reltoken(&pf_token);
1057                                 return (EACCES);
1058                         }
1059                         break;
1060                 default:
1061                         lwkt_reltoken(&pf_token);
1062                         return (EACCES);
1063                 }
1064
1065         switch (cmd) {
1066
1067         case DIOCSTART:
1068                 if (pf_status.running)
1069                         error = EEXIST;
1070                 else {
1071                         error = hook_pf();
1072                         if (error) {
1073                                 DPFPRINTF(PF_DEBUG_MISC,
1074                                     ("pf: pfil registration fail\n"));
1075                                 break;
1076                         }
1077                         pf_status.running = 1;
1078                         pf_status.since = time_second;
1079                         if (pf_status.stateid == 0) {
1080                                 pf_status.stateid = time_second;
1081                                 pf_status.stateid = pf_status.stateid << 32;
1082                         }
1083                         DPFPRINTF(PF_DEBUG_MISC, ("pf: started\n"));
1084                 }
1085                 break;
1086
1087         case DIOCSTOP:
1088                 if (!pf_status.running)
1089                         error = ENOENT;
1090                 else {
1091                         pf_status.running = 0;
1092                         error = dehook_pf();
1093                         if (error) {
1094                                 pf_status.running = 1;
1095                                 DPFPRINTF(PF_DEBUG_MISC,
1096                                         ("pf: pfil unregistration failed\n"));
1097                         }
1098                         pf_status.since = time_second;
1099                         DPFPRINTF(PF_DEBUG_MISC, ("pf: stopped\n"));
1100                 }
1101                 break;
1102
1103         case DIOCADDRULE: {
1104                 struct pfioc_rule       *pr = (struct pfioc_rule *)addr;
1105                 struct pf_ruleset       *ruleset;
1106                 struct pf_rule          *rule, *tail;
1107                 struct pf_pooladdr      *pa;
1108                 int                      rs_num;
1109
1110                 pr->anchor[sizeof(pr->anchor) - 1] = 0;
1111                 ruleset = pf_find_ruleset(pr->anchor);
1112                 if (ruleset == NULL) {
1113                         error = EINVAL;
1114                         break;
1115                 }
1116                 rs_num = pf_get_ruleset_number(pr->rule.action);
1117                 if (rs_num >= PF_RULESET_MAX) {
1118                         error = EINVAL;
1119                         break;
1120                 }
1121                 if (pr->rule.return_icmp >> 8 > ICMP_MAXTYPE) {
1122                         error = EINVAL;
1123                         break;
1124                 }
1125                 if (pr->ticket != ruleset->rules[rs_num].inactive.ticket) {
1126                         error = EBUSY;
1127                         break;
1128                 }
1129                 if (pr->pool_ticket != ticket_pabuf) {
1130                         error = EBUSY;
1131                         break;
1132                 }
1133                 rule = kmalloc(sizeof(struct pf_rule), M_PFRULEPL, M_WAITOK);
1134                 bcopy(&pr->rule, rule, sizeof(struct pf_rule));
1135                 rule->cuid = ap->a_cred->cr_ruid;
1136                 rule->cpid = 0;
1137                 rule->anchor = NULL;
1138                 rule->kif = NULL;
1139                 TAILQ_INIT(&rule->rpool.list);
1140                 /* initialize refcounting */
1141                 rule->states_cur = 0;
1142                 rule->src_nodes = 0;
1143                 rule->entries.tqe_prev = NULL;
1144 #ifndef INET
1145                 if (rule->af == AF_INET) {
1146                         kfree(rule, M_PFRULEPL);
1147                         error = EAFNOSUPPORT;
1148                         break;
1149                 }
1150 #endif /* INET */
1151 #ifndef INET6
1152                 if (rule->af == AF_INET6) {
1153                         kfree(rule, M_PFRULEPL);
1154                         error = EAFNOSUPPORT;
1155                         break;
1156                 }
1157 #endif /* INET6 */
1158                 tail = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr,
1159                     pf_rulequeue);
1160                 if (tail)
1161                         rule->nr = tail->nr + 1;
1162                 else
1163                         rule->nr = 0;
1164                 if (rule->ifname[0]) {
1165                         rule->kif = pfi_kif_get(rule->ifname);
1166                         if (rule->kif == NULL) {
1167                                 kfree(rule, M_PFRULEPL);
1168                                 error = EINVAL;
1169                                 break;
1170                         }
1171                         pfi_kif_ref(rule->kif, PFI_KIF_REF_RULE);
1172                 }
1173
1174                 if (rule->rtableid > 0 && rule->rtableid > rt_numfibs)
1175                         error = EBUSY;
1176
1177 #ifdef ALTQ
1178                 /* set queue IDs */
1179                 if (rule->qname[0] != 0) {
1180                         if ((rule->qid = pf_qname2qid(rule->qname)) == 0)
1181                                 error = EBUSY;
1182                         else if (rule->pqname[0] != 0) {
1183                                 if ((rule->pqid =
1184                                     pf_qname2qid(rule->pqname)) == 0)
1185                                         error = EBUSY;
1186                         } else
1187                                 rule->pqid = rule->qid;
1188                 }
1189 #endif
1190                 if (rule->tagname[0])
1191                         if ((rule->tag = pf_tagname2tag(rule->tagname)) == 0)
1192                                 error = EBUSY;
1193                 if (rule->match_tagname[0])
1194                         if ((rule->match_tag =
1195                             pf_tagname2tag(rule->match_tagname)) == 0)
1196                                 error = EBUSY;
1197                 if (rule->rt && !rule->direction)
1198                         error = EINVAL;
1199 #if NPFLOG > 0
1200                 if (!rule->log)
1201                         rule->logif = 0;
1202                 if (rule->logif >= PFLOGIFS_MAX)
1203                         error = EINVAL;
1204 #endif
1205                 if (pf_rtlabel_add(&rule->src.addr) ||
1206                     pf_rtlabel_add(&rule->dst.addr))
1207                         error = EBUSY;
1208                 if (pf_addr_setup(ruleset, &rule->src.addr, rule->af))
1209                         error = EINVAL;
1210                 if (pf_addr_setup(ruleset, &rule->dst.addr, rule->af))
1211                         error = EINVAL;
1212                 if (pf_anchor_setup(rule, ruleset, pr->anchor_call))
1213                         error = EINVAL;
1214                 TAILQ_FOREACH(pa, &pf_pabuf, entries)
1215                         if (pf_tbladdr_setup(ruleset, &pa->addr))
1216                                 error = EINVAL;
1217
1218                 if (rule->overload_tblname[0]) {
1219                         if ((rule->overload_tbl = pfr_attach_table(ruleset,
1220                             rule->overload_tblname)) == NULL)
1221                                 error = EINVAL;
1222                         else
1223                                 rule->overload_tbl->pfrkt_flags |=
1224                                     PFR_TFLAG_ACTIVE;
1225                 }
1226
1227                 pf_mv_pool(&pf_pabuf, &rule->rpool.list);
1228                 if (((((rule->action == PF_NAT) || (rule->action == PF_RDR) ||
1229                     (rule->action == PF_BINAT)) && rule->anchor == NULL) ||
1230                     (rule->rt > PF_FASTROUTE)) &&
1231                     (TAILQ_FIRST(&rule->rpool.list) == NULL))
1232                         error = EINVAL;
1233
1234                 if (error) {
1235                         pf_rm_rule(NULL, rule);
1236                         break;
1237                 }
1238                 rule->rpool.cur = TAILQ_FIRST(&rule->rpool.list);
1239                 rule->evaluations = rule->packets[0] = rule->packets[1] =
1240                     rule->bytes[0] = rule->bytes[1] = 0;
1241                 TAILQ_INSERT_TAIL(ruleset->rules[rs_num].inactive.ptr,
1242                     rule, entries);
1243                 ruleset->rules[rs_num].inactive.rcount++;
1244                 break;
1245         }
1246
1247         case DIOCGETRULES: {
1248                 struct pfioc_rule       *pr = (struct pfioc_rule *)addr;
1249                 struct pf_ruleset       *ruleset;
1250                 struct pf_rule          *tail;
1251                 int                      rs_num;
1252
1253                 pr->anchor[sizeof(pr->anchor) - 1] = 0;
1254                 ruleset = pf_find_ruleset(pr->anchor);
1255                 if (ruleset == NULL) {
1256                         error = EINVAL;
1257                         break;
1258                 }
1259                 rs_num = pf_get_ruleset_number(pr->rule.action);
1260                 if (rs_num >= PF_RULESET_MAX) {
1261                         error = EINVAL;
1262                         break;
1263                 }
1264                 tail = TAILQ_LAST(ruleset->rules[rs_num].active.ptr,
1265                     pf_rulequeue);
1266                 if (tail)
1267                         pr->nr = tail->nr + 1;
1268                 else
1269                         pr->nr = 0;
1270                 pr->ticket = ruleset->rules[rs_num].active.ticket;
1271                 break;
1272         }
1273
1274         case DIOCGETRULE: {
1275                 struct pfioc_rule       *pr = (struct pfioc_rule *)addr;
1276                 struct pf_ruleset       *ruleset;
1277                 struct pf_rule          *rule;
1278                 int                      rs_num, i;
1279
1280                 pr->anchor[sizeof(pr->anchor) - 1] = 0;
1281                 ruleset = pf_find_ruleset(pr->anchor);
1282                 if (ruleset == NULL) {
1283                         error = EINVAL;
1284                         break;
1285                 }
1286                 rs_num = pf_get_ruleset_number(pr->rule.action);
1287                 if (rs_num >= PF_RULESET_MAX) {
1288                         error = EINVAL;
1289                         break;
1290                 }
1291                 if (pr->ticket != ruleset->rules[rs_num].active.ticket) {
1292                         error = EBUSY;
1293                         break;
1294                 }
1295                 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr);
1296                 while ((rule != NULL) && (rule->nr != pr->nr))
1297                         rule = TAILQ_NEXT(rule, entries);
1298                 if (rule == NULL) {
1299                         error = EBUSY;
1300                         break;
1301                 }
1302                 bcopy(rule, &pr->rule, sizeof(struct pf_rule));
1303                 if (pf_anchor_copyout(ruleset, rule, pr)) {
1304                         error = EBUSY;
1305                         break;
1306                 }
1307                 pf_addr_copyout(&pr->rule.src.addr);
1308                 pf_addr_copyout(&pr->rule.dst.addr);
1309                 for (i = 0; i < PF_SKIP_COUNT; ++i)
1310                         if (rule->skip[i].ptr == NULL)
1311                                 pr->rule.skip[i].nr = (uint32_t)(-1);
1312                         else
1313                                 pr->rule.skip[i].nr =
1314                                     rule->skip[i].ptr->nr;
1315
1316                 if (pr->action == PF_GET_CLR_CNTR) {
1317                         rule->evaluations = 0;
1318                         rule->packets[0] = rule->packets[1] = 0;
1319                         rule->bytes[0] = rule->bytes[1] = 0;
1320                         rule->states_tot = 0;
1321                 }
1322                 break;
1323         }
1324
1325         case DIOCCHANGERULE: {
1326                 struct pfioc_rule       *pcr = (struct pfioc_rule *)addr;
1327                 struct pf_ruleset       *ruleset;
1328                 struct pf_rule          *oldrule = NULL, *newrule = NULL;
1329                 u_int32_t                nr = 0;
1330                 int                      rs_num;
1331
1332                 if (!(pcr->action == PF_CHANGE_REMOVE ||
1333                     pcr->action == PF_CHANGE_GET_TICKET) &&
1334                     pcr->pool_ticket != ticket_pabuf) {
1335                         error = EBUSY;
1336                         break;
1337                 }
1338
1339                 if (pcr->action < PF_CHANGE_ADD_HEAD ||
1340                     pcr->action > PF_CHANGE_GET_TICKET) {
1341                         error = EINVAL;
1342                         break;
1343                 }
1344                 ruleset = pf_find_ruleset(pcr->anchor);
1345                 if (ruleset == NULL) {
1346                         error = EINVAL;
1347                         break;
1348                 }
1349                 rs_num = pf_get_ruleset_number(pcr->rule.action);
1350                 if (rs_num >= PF_RULESET_MAX) {
1351                         error = EINVAL;
1352                         break;
1353                 }
1354
1355                 if (pcr->action == PF_CHANGE_GET_TICKET) {
1356                         pcr->ticket = ++ruleset->rules[rs_num].active.ticket;
1357                         break;
1358                 } else {
1359                         if (pcr->ticket !=
1360                             ruleset->rules[rs_num].active.ticket) {
1361                                 error = EINVAL;
1362                                 break;
1363                         }
1364                         if (pcr->rule.return_icmp >> 8 > ICMP_MAXTYPE) {
1365                                 error = EINVAL;
1366                                 break;
1367                         }
1368                 }
1369
1370                 if (pcr->action != PF_CHANGE_REMOVE) {
1371                         newrule = kmalloc(sizeof(struct pf_rule), M_PFRULEPL, M_WAITOK|M_NULLOK);
1372                         if (newrule == NULL) {
1373                                 error = ENOMEM;
1374                                 break;
1375                         }
1376                         bcopy(&pcr->rule, newrule, sizeof(struct pf_rule));
1377                         newrule->cuid = ap->a_cred->cr_ruid;
1378                         newrule->cpid = 0;
1379                         TAILQ_INIT(&newrule->rpool.list);
1380                         /* initialize refcounting */
1381                         newrule->states_cur = 0;
1382                         newrule->entries.tqe_prev = NULL;
1383 #ifndef INET
1384                         if (newrule->af == AF_INET) {
1385                                 kfree(newrule, M_PFRULEPL);
1386                                 error = EAFNOSUPPORT;
1387                                 break;
1388                         }
1389 #endif /* INET */
1390 #ifndef INET6
1391                         if (newrule->af == AF_INET6) {
1392                                 kfree(newrule, M_PFRULEPL);
1393                                 error = EAFNOSUPPORT;
1394                                 break;
1395                         }
1396 #endif /* INET6 */
1397                         if (newrule->ifname[0]) {
1398                                 newrule->kif = pfi_kif_get(newrule->ifname);
1399                                 if (newrule->kif == NULL) {
1400                                         kfree(newrule, M_PFRULEPL);
1401                                         error = EINVAL;
1402                                         break;
1403                                 }
1404                                 pfi_kif_ref(newrule->kif, PFI_KIF_REF_RULE);
1405                         } else
1406                                 newrule->kif = NULL;
1407
1408                         if (newrule->rtableid > 0 &&
1409                             newrule->rtableid > rt_numfibs)
1410                                 error = EBUSY;
1411
1412 #ifdef ALTQ
1413                         /* set queue IDs */
1414                         if (newrule->qname[0] != 0) {
1415                                 if ((newrule->qid =
1416                                     pf_qname2qid(newrule->qname)) == 0)
1417                                         error = EBUSY;
1418                                 else if (newrule->pqname[0] != 0) {
1419                                         if ((newrule->pqid =
1420                                             pf_qname2qid(newrule->pqname)) == 0)
1421                                                 error = EBUSY;
1422                                 } else
1423                                         newrule->pqid = newrule->qid;
1424                         }
1425 #endif /* ALTQ */
1426                         if (newrule->tagname[0])
1427                                 if ((newrule->tag =
1428                                     pf_tagname2tag(newrule->tagname)) == 0)
1429                                         error = EBUSY;
1430                         if (newrule->match_tagname[0])
1431                                 if ((newrule->match_tag = pf_tagname2tag(
1432                                     newrule->match_tagname)) == 0)
1433                                         error = EBUSY;
1434                         if (newrule->rt && !newrule->direction)
1435                                 error = EINVAL;
1436 #if NPFLOG > 0
1437                         if (!newrule->log)
1438                                 newrule->logif = 0;
1439                         if (newrule->logif >= PFLOGIFS_MAX)
1440                                 error = EINVAL;
1441 #endif
1442                         if (pf_rtlabel_add(&newrule->src.addr) ||
1443                             pf_rtlabel_add(&newrule->dst.addr))
1444                                 error = EBUSY;
1445                         if (pf_addr_setup(ruleset, &newrule->src.addr, newrule->af))
1446                                 error = EINVAL;
1447                         if (pf_addr_setup(ruleset, &newrule->dst.addr, newrule->af))
1448                                 error = EINVAL;
1449                         if (pf_anchor_setup(newrule, ruleset, pcr->anchor_call))
1450                                 error = EINVAL;
1451                         TAILQ_FOREACH(pa, &pf_pabuf, entries)
1452                                 if (pf_tbladdr_setup(ruleset, &pa->addr))
1453                                         error = EINVAL;
1454
1455                         if (newrule->overload_tblname[0]) {
1456                                 if ((newrule->overload_tbl = pfr_attach_table(
1457                                     ruleset, newrule->overload_tblname)) ==
1458                                     NULL)
1459                                         error = EINVAL;
1460                                 else
1461                                         newrule->overload_tbl->pfrkt_flags |=
1462                                             PFR_TFLAG_ACTIVE;
1463                         }
1464
1465                         pf_mv_pool(&pf_pabuf, &newrule->rpool.list);
1466                         if (((((newrule->action == PF_NAT) ||
1467                             (newrule->action == PF_RDR) ||
1468                             (newrule->action == PF_BINAT) ||
1469                             (newrule->rt > PF_FASTROUTE)) &&
1470                             !newrule->anchor)) &&
1471                             (TAILQ_FIRST(&newrule->rpool.list) == NULL))
1472                                 error = EINVAL;
1473
1474                         if (error) {
1475                                 pf_rm_rule(NULL, newrule);
1476                                 break;
1477                         }
1478                         newrule->rpool.cur = TAILQ_FIRST(&newrule->rpool.list);
1479                         newrule->evaluations = 0;
1480                         newrule->packets[0] = newrule->packets[1] = 0;
1481                         newrule->bytes[0] = newrule->bytes[1] = 0;
1482                 }
1483                 pf_empty_pool(&pf_pabuf);
1484
1485                 if (pcr->action == PF_CHANGE_ADD_HEAD)
1486                         oldrule = TAILQ_FIRST(
1487                             ruleset->rules[rs_num].active.ptr);
1488                 else if (pcr->action == PF_CHANGE_ADD_TAIL)
1489                         oldrule = TAILQ_LAST(
1490                             ruleset->rules[rs_num].active.ptr, pf_rulequeue);
1491                 else {
1492                         oldrule = TAILQ_FIRST(
1493                             ruleset->rules[rs_num].active.ptr);
1494                         while ((oldrule != NULL) && (oldrule->nr != pcr->nr))
1495                                 oldrule = TAILQ_NEXT(oldrule, entries);
1496                         if (oldrule == NULL) {
1497                                 if (newrule != NULL)
1498                                         pf_rm_rule(NULL, newrule);
1499                                 error = EINVAL;
1500                                 break;
1501                         }
1502                 }
1503
1504                 if (pcr->action == PF_CHANGE_REMOVE) {
1505                         pf_rm_rule(ruleset->rules[rs_num].active.ptr, oldrule);
1506                         ruleset->rules[rs_num].active.rcount--;
1507                 } else {
1508                         if (oldrule == NULL)
1509                                 TAILQ_INSERT_TAIL(
1510                                     ruleset->rules[rs_num].active.ptr,
1511                                     newrule, entries);
1512                         else if (pcr->action == PF_CHANGE_ADD_HEAD ||
1513                             pcr->action == PF_CHANGE_ADD_BEFORE)
1514                                 TAILQ_INSERT_BEFORE(oldrule, newrule, entries);
1515                         else
1516                                 TAILQ_INSERT_AFTER(
1517                                     ruleset->rules[rs_num].active.ptr,
1518                                     oldrule, newrule, entries);
1519                         ruleset->rules[rs_num].active.rcount++;
1520                 }
1521
1522                 nr = 0;
1523                 TAILQ_FOREACH(oldrule,
1524                     ruleset->rules[rs_num].active.ptr, entries)
1525                         oldrule->nr = nr++;
1526
1527                 ruleset->rules[rs_num].active.ticket++;
1528
1529                 pf_calc_skip_steps(ruleset->rules[rs_num].active.ptr);
1530                 pf_remove_if_empty_ruleset(ruleset);
1531
1532                 break;
1533         }
1534
1535         case DIOCCLRSTATES: {
1536                 struct pf_state         *s, *nexts;
1537                 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr;
1538                 u_int                    killed = 0;
1539
1540                 for (s = RB_MIN(pf_state_tree_id, &tree_id); s; s = nexts) {
1541                         nexts = RB_NEXT(pf_state_tree_id, &tree_id, s);
1542
1543                         if (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname,
1544                             s->kif->pfik_name)) {
1545                                 /* don't send out individual delete messages */
1546                                 s->sync_flags = PFSTATE_NOSYNC;
1547                                 pf_unlink_state(s);
1548                                 killed++;
1549                         }
1550                 }
1551                 psk->psk_killed = killed;
1552                 pfsync_clear_states(pf_status.hostid, psk->psk_ifname);
1553                 break;
1554         }
1555
1556         case DIOCKILLSTATES: {
1557                 struct pf_state         *s, *nexts;
1558                 struct pf_state_key     *sk;
1559                 struct pf_addr          *srcaddr, *dstaddr;
1560                 u_int16_t                srcport, dstport;
1561                 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr;
1562                 u_int                    killed = 0;
1563
1564                 if (psk->psk_pfcmp.id) {
1565                         if (psk->psk_pfcmp.creatorid == 0)
1566                                 psk->psk_pfcmp.creatorid = pf_status.hostid;
1567                         if ((s = pf_find_state_byid(&psk->psk_pfcmp))) {
1568                                 /* send immediate delete of state */
1569                                 pfsync_delete_state(s);
1570                                 s->sync_flags |= PFSTATE_NOSYNC;
1571                                 pf_unlink_state(s);
1572                                 psk->psk_killed = 1;
1573                         }
1574                         break;
1575                 }
1576
1577                 for (s = RB_MIN(pf_state_tree_id, &tree_id); s;
1578                     s = nexts) {
1579                         nexts = RB_NEXT(pf_state_tree_id, &tree_id, s);
1580                         sk = s->key[PF_SK_WIRE];
1581
1582                         if (s->direction == PF_OUT) {
1583                                 srcaddr = &sk->addr[1];
1584                                 dstaddr = &sk->addr[0];
1585                                 srcport = sk->port[0];
1586                                 dstport = sk->port[0];
1587                         } else {
1588                                 srcaddr = &sk->addr[0];
1589                                 dstaddr = &sk->addr[1];
1590                                 srcport = sk->port[0];
1591                                 dstport = sk->port[0];
1592                         }
1593                         if ((!psk->psk_af || sk->af == psk->psk_af)
1594                             && (!psk->psk_proto || psk->psk_proto ==
1595                             sk->proto) &&
1596                             PF_MATCHA(psk->psk_src.neg,
1597                             &psk->psk_src.addr.v.a.addr,
1598                             &psk->psk_src.addr.v.a.mask,
1599                             srcaddr, sk->af) &&
1600                             PF_MATCHA(psk->psk_dst.neg,
1601                             &psk->psk_dst.addr.v.a.addr,
1602                             &psk->psk_dst.addr.v.a.mask,
1603                             dstaddr, sk->af) &&
1604                             (psk->psk_src.port_op == 0 ||
1605                             pf_match_port(psk->psk_src.port_op,
1606                             psk->psk_src.port[0], psk->psk_src.port[1],
1607                             srcport)) &&
1608                             (psk->psk_dst.port_op == 0 ||
1609                             pf_match_port(psk->psk_dst.port_op,
1610                             psk->psk_dst.port[0], psk->psk_dst.port[1],
1611                             dstport)) &&
1612                             (!psk->psk_label[0] || (s->rule.ptr->label[0] &&
1613                             !strcmp(psk->psk_label, s->rule.ptr->label))) &&
1614                             (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname,
1615                             s->kif->pfik_name))) {
1616                                 /* send immediate delete of state */
1617                                 pfsync_delete_state(s);
1618                                 s->sync_flags |= PFSTATE_NOSYNC;
1619                                 pf_unlink_state(s);
1620                                 killed++;
1621                         }
1622                 }
1623                 psk->psk_killed = killed;
1624                 break;
1625         }
1626
1627         case DIOCADDSTATE: {
1628                 struct pfioc_state      *ps = (struct pfioc_state *)addr;
1629                 struct pfsync_state     *sp = &ps->state;
1630
1631                 if (sp->timeout >= PFTM_MAX &&
1632                     sp->timeout != PFTM_UNTIL_PACKET) {
1633                         error = EINVAL;
1634                         break;
1635                 }
1636                 error = pfsync_state_import(sp, PFSYNC_SI_IOCTL);
1637                 break;
1638         }
1639
1640         case DIOCGETSTATE: {
1641                 struct pfioc_state      *ps = (struct pfioc_state *)addr;
1642                 struct pf_state         *s;
1643                 struct pf_state_cmp      id_key;
1644
1645                 bcopy(ps->state.id, &id_key.id, sizeof(id_key.id));
1646                 id_key.creatorid = ps->state.creatorid;
1647
1648                 s = pf_find_state_byid(&id_key);
1649                 if (s == NULL) {
1650                         error = ENOENT;
1651                         break;
1652                 }
1653                 pfsync_state_export(&ps->state, s);
1654                 break;
1655         }
1656
1657         case DIOCGETSTATES: {
1658                 struct pfioc_states     *ps = (struct pfioc_states *)addr;
1659                 struct pf_state         *state;
1660                 struct pfsync_state     *p, *pstore;
1661                 u_int32_t                nr = 0;
1662
1663                 if (ps->ps_len == 0) {
1664                         nr = pf_status.states;
1665                         ps->ps_len = sizeof(struct pfsync_state) * nr;
1666                         break;
1667                 }
1668
1669                 pstore = kmalloc(sizeof(*pstore), M_TEMP, M_WAITOK);
1670
1671                 p = ps->ps_states;
1672
1673                 state = TAILQ_FIRST(&state_list);
1674                 while (state) {
1675                         if (state->timeout != PFTM_UNLINKED) {
1676                                 if ((nr+1) * sizeof(*p) > (unsigned)ps->ps_len)
1677                                         break;
1678                                 pfsync_state_export(pstore, state);
1679                                 error = copyout(pstore, p, sizeof(*p));
1680                                 if (error) {
1681                                         kfree(pstore, M_TEMP);
1682                                         goto fail;
1683                                 }
1684                                 p++;
1685                                 nr++;
1686                         }
1687                         state = TAILQ_NEXT(state, entry_list);
1688                 }
1689
1690                 ps->ps_len = sizeof(struct pfsync_state) * nr;
1691
1692                 kfree(pstore, M_TEMP);
1693                 break;
1694         }
1695
1696         case DIOCGETSTATUS: {
1697                 struct pf_status *s = (struct pf_status *)addr;
1698                 bcopy(&pf_status, s, sizeof(struct pf_status));
1699                 pfi_update_status(s->ifname, s);
1700                 break;
1701         }
1702
1703         case DIOCSETSTATUSIF: {
1704                 struct pfioc_if *pi = (struct pfioc_if *)addr;
1705
1706                 if (pi->ifname[0] == 0) {
1707                         bzero(pf_status.ifname, IFNAMSIZ);
1708                         break;
1709                 }
1710                 strlcpy(pf_status.ifname, pi->ifname, IFNAMSIZ);
1711                 break;
1712         }
1713
1714         case DIOCCLRSTATUS: {
1715                 bzero(pf_status.counters, sizeof(pf_status.counters));
1716                 bzero(pf_status.fcounters, sizeof(pf_status.fcounters));
1717                 bzero(pf_status.scounters, sizeof(pf_status.scounters));
1718                 pf_status.since = time_second;
1719                 if (*pf_status.ifname)
1720                         pfi_update_status(pf_status.ifname, NULL);
1721                 break;
1722         }
1723
1724         case DIOCNATLOOK: {
1725                 struct pfioc_natlook    *pnl = (struct pfioc_natlook *)addr;
1726                 struct pf_state_key     *sk;
1727                 struct pf_state         *state;
1728                 struct pf_state_key_cmp  key;
1729                 int                      m = 0, direction = pnl->direction;
1730                 int                      sidx, didx;
1731
1732                 /* NATLOOK src and dst are reversed, so reverse sidx/didx */
1733                 sidx = (direction == PF_IN) ? 1 : 0;
1734                 didx = (direction == PF_IN) ? 0 : 1;
1735
1736                 if (!pnl->proto ||
1737                     PF_AZERO(&pnl->saddr, pnl->af) ||
1738                     PF_AZERO(&pnl->daddr, pnl->af) ||
1739                     ((pnl->proto == IPPROTO_TCP ||
1740                     pnl->proto == IPPROTO_UDP) &&
1741                     (!pnl->dport || !pnl->sport)))
1742                         error = EINVAL;
1743                 else {
1744                         key.af = pnl->af;
1745                         key.proto = pnl->proto;
1746                         PF_ACPY(&key.addr[sidx], &pnl->saddr, pnl->af);
1747                         key.port[sidx] = pnl->sport;
1748                         PF_ACPY(&key.addr[didx], &pnl->daddr, pnl->af);
1749                         key.port[didx] = pnl->dport;
1750
1751                         state = pf_find_state_all(&key, direction, &m);
1752
1753                         if (m > 1)
1754                                 error = E2BIG;  /* more than one state */
1755                         else if (state != NULL) {
1756                                 sk = state->key[sidx];
1757                                 PF_ACPY(&pnl->rsaddr, &sk->addr[sidx], sk->af);
1758                                 pnl->rsport = sk->port[sidx];
1759                                 PF_ACPY(&pnl->rdaddr, &sk->addr[didx], sk->af);
1760                                 pnl->rdport = sk->port[didx];
1761                         } else
1762                                 error = ENOENT;
1763                 }
1764                 break;
1765         }
1766
1767         case DIOCSETTIMEOUT: {
1768                 struct pfioc_tm *pt = (struct pfioc_tm *)addr;
1769                 int              old;
1770
1771                 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX ||
1772                     pt->seconds < 0) {
1773                         error = EINVAL;
1774                         goto fail;
1775                 }
1776                 old = pf_default_rule.timeout[pt->timeout];
1777                 if (pt->timeout == PFTM_INTERVAL && pt->seconds == 0)
1778                         pt->seconds = 1;
1779                 pf_default_rule.timeout[pt->timeout] = pt->seconds;
1780                 if (pt->timeout == PFTM_INTERVAL && pt->seconds < old)
1781                         wakeup(pf_purge_thread);
1782                 pt->seconds = old;
1783                 break;
1784         }
1785
1786         case DIOCGETTIMEOUT: {
1787                 struct pfioc_tm *pt = (struct pfioc_tm *)addr;
1788
1789                 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX) {
1790                         error = EINVAL;
1791                         goto fail;
1792                 }
1793                 pt->seconds = pf_default_rule.timeout[pt->timeout];
1794                 break;
1795         }
1796
1797         case DIOCGETLIMIT: {
1798                 struct pfioc_limit      *pl = (struct pfioc_limit *)addr;
1799
1800                 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX) {
1801                         error = EINVAL;
1802                         goto fail;
1803                 }
1804                 pl->limit = pf_pool_limits[pl->index].limit;
1805                 break;
1806         }
1807
1808         case DIOCSETLIMIT: {
1809                 struct pfioc_limit      *pl = (struct pfioc_limit *)addr;
1810                 int                      old_limit;
1811
1812                 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX ||
1813                     pf_pool_limits[pl->index].pp == NULL) {
1814                         error = EINVAL;
1815                         goto fail;
1816                 }
1817
1818                 /* XXX Get an API to set limits on the zone/pool */
1819                 old_limit = pf_pool_limits[pl->index].limit;
1820                 pf_pool_limits[pl->index].limit = pl->limit;
1821                 pl->limit = old_limit;
1822                 break;
1823         }
1824
1825         case DIOCSETDEBUG: {
1826                 u_int32_t       *level = (u_int32_t *)addr;
1827
1828                 pf_status.debug = *level;
1829                 break;
1830         }
1831
1832         case DIOCCLRRULECTRS: {
1833                 /* obsoleted by DIOCGETRULE with action=PF_GET_CLR_CNTR */
1834                 struct pf_ruleset       *ruleset = &pf_main_ruleset;
1835                 struct pf_rule          *rule;
1836
1837                 TAILQ_FOREACH(rule,
1838                     ruleset->rules[PF_RULESET_FILTER].active.ptr, entries) {
1839                         rule->evaluations = 0;
1840                         rule->packets[0] = rule->packets[1] = 0;
1841                         rule->bytes[0] = rule->bytes[1] = 0;
1842                 }
1843                 break;
1844         }
1845
1846         case DIOCGIFSPEED: {
1847                 struct pf_ifspeed       *psp = (struct pf_ifspeed *)addr;
1848                 struct pf_ifspeed       ps;
1849                 struct ifnet            *ifp;
1850
1851                 if (psp->ifname[0] != 0) {
1852                         /* Can we completely trust user-land? */
1853                         strlcpy(ps.ifname, psp->ifname, IFNAMSIZ);
1854                         ifp = ifunit(ps.ifname);
1855                         if (ifp )
1856                                 psp->baudrate = ifp->if_baudrate;
1857                         else
1858                                 error = EINVAL;
1859                 } else
1860                         error = EINVAL;
1861                 break;
1862         }
1863 #ifdef ALTQ
1864         case DIOCSTARTALTQ: {
1865                 struct pf_altq          *altq;
1866
1867                 /* enable all altq interfaces on active list */
1868                 TAILQ_FOREACH(altq, pf_altqs_active, entries) {
1869                         if (altq->qname[0] == 0) {
1870                                 error = pf_enable_altq(altq);
1871                                 if (error != 0)
1872                                         break;
1873                         }
1874                 }
1875                 if (error == 0)
1876                         pf_altq_running = 1;
1877                 DPFPRINTF(PF_DEBUG_MISC, ("altq: started\n"));
1878                 break;
1879         }
1880
1881         case DIOCSTOPALTQ: {
1882                 struct pf_altq          *altq;
1883
1884                 /* disable all altq interfaces on active list */
1885                 TAILQ_FOREACH(altq, pf_altqs_active, entries) {
1886                         if (altq->qname[0] == 0) {
1887                                 error = pf_disable_altq(altq);
1888                                 if (error != 0)
1889                                         break;
1890                         }
1891                 }
1892                 if (error == 0)
1893                         pf_altq_running = 0;
1894                 DPFPRINTF(PF_DEBUG_MISC, ("altq: stopped\n"));
1895                 break;
1896         }
1897
1898         case DIOCADDALTQ: {
1899                 struct pfioc_altq       *pa = (struct pfioc_altq *)addr;
1900                 struct pf_altq          *altq, *a;
1901
1902                 if (pa->ticket != ticket_altqs_inactive) {
1903                         error = EBUSY;
1904                         break;
1905                 }
1906                 altq = kmalloc(sizeof(struct pf_altq), M_PFALTQPL, M_WAITOK|M_NULLOK);
1907                 if (altq == NULL) {
1908                         error = ENOMEM;
1909                         break;
1910                 }
1911                 bcopy(&pa->altq, altq, sizeof(struct pf_altq));
1912
1913                 /*
1914                  * if this is for a queue, find the discipline and
1915                  * copy the necessary fields
1916                  */
1917                 if (altq->qname[0] != 0) {
1918                         if ((altq->qid = pf_qname2qid(altq->qname)) == 0) {
1919                                 error = EBUSY;
1920                                 kfree(altq, M_PFALTQPL);
1921                                 break;
1922                         }
1923                         altq->altq_disc = NULL;
1924                         TAILQ_FOREACH(a, pf_altqs_inactive, entries) {
1925                                 if (strncmp(a->ifname, altq->ifname,
1926                                     IFNAMSIZ) == 0 && a->qname[0] == 0) {
1927                                         altq->altq_disc = a->altq_disc;
1928                                         break;
1929                                 }
1930                         }
1931                 }
1932
1933                 error = altq_add(altq);
1934                 if (error) {
1935                         kfree(altq, M_PFALTQPL);
1936                         break;
1937                 }
1938
1939                 TAILQ_INSERT_TAIL(pf_altqs_inactive, altq, entries);
1940                 bcopy(altq, &pa->altq, sizeof(struct pf_altq));
1941                 break;
1942         }
1943
1944         case DIOCGETALTQS: {
1945                 struct pfioc_altq       *pa = (struct pfioc_altq *)addr;
1946                 struct pf_altq          *altq;
1947
1948                 pa->nr = 0;
1949                 TAILQ_FOREACH(altq, pf_altqs_active, entries)
1950                         pa->nr++;
1951                 pa->ticket = ticket_altqs_active;
1952                 break;
1953         }
1954
1955         case DIOCGETALTQ: {
1956                 struct pfioc_altq       *pa = (struct pfioc_altq *)addr;
1957                 struct pf_altq          *altq;
1958                 u_int32_t                nr;
1959
1960                 if (pa->ticket != ticket_altqs_active) {
1961                         error = EBUSY;
1962                         break;
1963                 }
1964                 nr = 0;
1965                 altq = TAILQ_FIRST(pf_altqs_active);
1966                 while ((altq != NULL) && (nr < pa->nr)) {
1967                         altq = TAILQ_NEXT(altq, entries);
1968                         nr++;
1969                 }
1970                 if (altq == NULL) {
1971                         error = EBUSY;
1972                         break;
1973                 }
1974                 bcopy(altq, &pa->altq, sizeof(struct pf_altq));
1975                 break;
1976         }
1977
1978         case DIOCCHANGEALTQ:
1979                 /* CHANGEALTQ not supported yet! */
1980                 error = ENODEV;
1981                 break;
1982
1983         case DIOCGETQSTATS: {
1984                 struct pfioc_qstats     *pq = (struct pfioc_qstats *)addr;
1985                 struct pf_altq          *altq;
1986                 u_int32_t                nr;
1987                 int                      nbytes;
1988
1989                 if (pq->ticket != ticket_altqs_active) {
1990                         error = EBUSY;
1991                         break;
1992                 }
1993                 nbytes = pq->nbytes;
1994                 nr = 0;
1995                 altq = TAILQ_FIRST(pf_altqs_active);
1996                 while ((altq != NULL) && (nr < pq->nr)) {
1997                         altq = TAILQ_NEXT(altq, entries);
1998                         nr++;
1999                 }
2000                 if (altq == NULL) {
2001                         error = EBUSY;
2002                         break;
2003                 }
2004                 error = altq_getqstats(altq, pq->buf, &nbytes);
2005                 if (error == 0) {
2006                         pq->scheduler = altq->scheduler;
2007                         pq->nbytes = nbytes;
2008                 }
2009                 break;
2010         }
2011 #endif /* ALTQ */
2012
2013         case DIOCBEGINADDRS: {
2014                 struct pfioc_pooladdr   *pp = (struct pfioc_pooladdr *)addr;
2015
2016                 pf_empty_pool(&pf_pabuf);
2017                 pp->ticket = ++ticket_pabuf;
2018                 break;
2019         }
2020
2021         case DIOCADDADDR: {
2022                 struct pfioc_pooladdr   *pp = (struct pfioc_pooladdr *)addr;
2023
2024                 if (pp->ticket != ticket_pabuf) {
2025                         error = EBUSY;
2026                         break;
2027                 }
2028 #ifndef INET
2029                 if (pp->af == AF_INET) {
2030                         error = EAFNOSUPPORT;
2031                         break;
2032                 }
2033 #endif /* INET */
2034 #ifndef INET6
2035                 if (pp->af == AF_INET6) {
2036                         error = EAFNOSUPPORT;
2037                         break;
2038                 }
2039 #endif /* INET6 */
2040                 if (pp->addr.addr.type != PF_ADDR_ADDRMASK &&
2041                     pp->addr.addr.type != PF_ADDR_DYNIFTL &&
2042                     pp->addr.addr.type != PF_ADDR_TABLE) {
2043                         error = EINVAL;
2044                         break;
2045                 }
2046                 pa = kmalloc(sizeof(struct pf_altq), M_PFPOOLADDRPL, M_WAITOK|M_NULLOK);
2047                 if (pa == NULL) {
2048                         error = ENOMEM;
2049                         break;
2050                 }
2051                 bcopy(&pp->addr, pa, sizeof(struct pf_pooladdr));
2052                 if (pa->ifname[0]) {
2053                         pa->kif = pfi_kif_get(pa->ifname);
2054                         if (pa->kif == NULL) {
2055                                 kfree(ap, M_PFPOOLADDRPL);
2056                                 error = EINVAL;
2057                                 break;
2058                         }
2059                         pfi_kif_ref(pa->kif, PFI_KIF_REF_RULE);
2060                 }
2061                 if (pfi_dynaddr_setup(&pa->addr, pp->af)) {
2062                         pfi_dynaddr_remove(&pa->addr);
2063                         pfi_kif_unref(pa->kif, PFI_KIF_REF_RULE);
2064                         kfree(pa, M_PFPOOLADDRPL);
2065                         error = EINVAL;
2066                         break;
2067                 }
2068                 TAILQ_INSERT_TAIL(&pf_pabuf, pa, entries);
2069                 break;
2070         }
2071
2072         case DIOCGETADDRS: {
2073                 struct pfioc_pooladdr   *pp = (struct pfioc_pooladdr *)addr;
2074
2075                 pp->nr = 0;
2076                 pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action,
2077                     pp->r_num, 0, 1, 0);
2078                 if (pool == NULL) {
2079                         error = EBUSY;
2080                         break;
2081                 }
2082                 TAILQ_FOREACH(pa, &pool->list, entries)
2083                         pp->nr++;
2084                 break;
2085         }
2086
2087         case DIOCGETADDR: {
2088                 struct pfioc_pooladdr   *pp = (struct pfioc_pooladdr *)addr;
2089                 u_int32_t                nr = 0;
2090
2091                 pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action,
2092                     pp->r_num, 0, 1, 1);
2093                 if (pool == NULL) {
2094                         error = EBUSY;
2095                         break;
2096                 }
2097                 pa = TAILQ_FIRST(&pool->list);
2098                 while ((pa != NULL) && (nr < pp->nr)) {
2099                         pa = TAILQ_NEXT(pa, entries);
2100                         nr++;
2101                 }
2102                 if (pa == NULL) {
2103                         error = EBUSY;
2104                         break;
2105                 }
2106                 bcopy(pa, &pp->addr, sizeof(struct pf_pooladdr));
2107                 pf_addr_copyout(&pp->addr.addr);
2108                 break;
2109         }
2110
2111         case DIOCCHANGEADDR: {
2112                 struct pfioc_pooladdr   *pca = (struct pfioc_pooladdr *)addr;
2113                 struct pf_pooladdr      *oldpa = NULL, *newpa = NULL;
2114                 struct pf_ruleset       *ruleset;
2115
2116                 if (pca->action < PF_CHANGE_ADD_HEAD ||
2117                     pca->action > PF_CHANGE_REMOVE) {
2118                         error = EINVAL;
2119                         break;
2120                 }
2121                 if (pca->addr.addr.type != PF_ADDR_ADDRMASK &&
2122                     pca->addr.addr.type != PF_ADDR_DYNIFTL &&
2123                     pca->addr.addr.type != PF_ADDR_TABLE) {
2124                         error = EINVAL;
2125                         break;
2126                 }
2127
2128                 ruleset = pf_find_ruleset(pca->anchor);
2129                 if (ruleset == NULL) {
2130                         error = EBUSY;
2131                         break;
2132                 }
2133                 pool = pf_get_pool(pca->anchor, pca->ticket, pca->r_action,
2134                     pca->r_num, pca->r_last, 1, 1);
2135                 if (pool == NULL) {
2136                         error = EBUSY;
2137                         break;
2138                 }
2139                 if (pca->action != PF_CHANGE_REMOVE) {
2140                         newpa = kmalloc(sizeof(struct pf_pooladdr),
2141                                 M_PFPOOLADDRPL, M_WAITOK|M_NULLOK);
2142                         if (newpa == NULL) {
2143                                 error = ENOMEM;
2144                                 break;
2145                         }
2146                         bcopy(&pca->addr, newpa, sizeof(struct pf_pooladdr));
2147 #ifndef INET
2148                         if (pca->af == AF_INET) {
2149                                 kfree(newpa, M_PFPOOLADDRPL);
2150                                 error = EAFNOSUPPORT;
2151                                 break;
2152                         }
2153 #endif /* INET */
2154 #ifndef INET6
2155                         if (pca->af == AF_INET6) {
2156                                 kfree(newpa, M_PFPOOLADDRPL);
2157                                 error = EAFNOSUPPORT;
2158                                 break;
2159                         }
2160 #endif /* INET6 */
2161                         if (newpa->ifname[0]) {
2162                                 newpa->kif = pfi_kif_get(newpa->ifname);
2163                                 if (newpa->kif == NULL) {
2164                                         kfree(newpa, M_PFPOOLADDRPL);
2165                                         error = EINVAL;
2166                                         break;
2167                                 }
2168                                 pfi_kif_ref(newpa->kif, PFI_KIF_REF_RULE);
2169                         } else
2170                                 newpa->kif = NULL;
2171                         if (pfi_dynaddr_setup(&newpa->addr, pca->af) ||
2172                             pf_tbladdr_setup(ruleset, &newpa->addr)) {
2173                                 pfi_dynaddr_remove(&newpa->addr);
2174                                 pfi_kif_unref(newpa->kif, PFI_KIF_REF_RULE);
2175                                 kfree(newpa, M_PFPOOLADDRPL);
2176                                 error = EINVAL;
2177                                 break;
2178                         }
2179                 }
2180
2181                 if (pca->action == PF_CHANGE_ADD_HEAD)
2182                         oldpa = TAILQ_FIRST(&pool->list);
2183                 else if (pca->action == PF_CHANGE_ADD_TAIL)
2184                         oldpa = TAILQ_LAST(&pool->list, pf_palist);
2185                 else {
2186                         int     i = 0;
2187
2188                         oldpa = TAILQ_FIRST(&pool->list);
2189                         while ((oldpa != NULL) && (i < pca->nr)) {
2190                                 oldpa = TAILQ_NEXT(oldpa, entries);
2191                                 i++;
2192                         }
2193                         if (oldpa == NULL) {
2194                                 error = EINVAL;
2195                                 break;
2196                         }
2197                 }
2198
2199                 if (pca->action == PF_CHANGE_REMOVE) {
2200                         TAILQ_REMOVE(&pool->list, oldpa, entries);
2201                         pfi_dynaddr_remove(&oldpa->addr);
2202                         pf_tbladdr_remove(&oldpa->addr);
2203                         pfi_kif_unref(oldpa->kif, PFI_KIF_REF_RULE);
2204                         kfree(oldpa, M_PFPOOLADDRPL);
2205                 } else {
2206                         if (oldpa == NULL)
2207                                 TAILQ_INSERT_TAIL(&pool->list, newpa, entries);
2208                         else if (pca->action == PF_CHANGE_ADD_HEAD ||
2209                             pca->action == PF_CHANGE_ADD_BEFORE)
2210                                 TAILQ_INSERT_BEFORE(oldpa, newpa, entries);
2211                         else
2212                                 TAILQ_INSERT_AFTER(&pool->list, oldpa,
2213                                     newpa, entries);
2214                 }
2215
2216                 pool->cur = TAILQ_FIRST(&pool->list);
2217                 PF_ACPY(&pool->counter, &pool->cur->addr.v.a.addr,
2218                     pca->af);
2219                 break;
2220         }
2221
2222         case DIOCGETRULESETS: {
2223                 struct pfioc_ruleset    *pr = (struct pfioc_ruleset *)addr;
2224                 struct pf_ruleset       *ruleset;
2225                 struct pf_anchor        *anchor;
2226
2227                 pr->path[sizeof(pr->path) - 1] = 0;
2228                 if ((ruleset = pf_find_ruleset(pr->path)) == NULL) {
2229                         error = EINVAL;
2230                         break;
2231                 }
2232                 pr->nr = 0;
2233                 if (ruleset->anchor == NULL) {
2234                         /* XXX kludge for pf_main_ruleset */
2235                         RB_FOREACH(anchor, pf_anchor_global, &pf_anchors)
2236                                 if (anchor->parent == NULL)
2237                                         pr->nr++;
2238                 } else {
2239                         RB_FOREACH(anchor, pf_anchor_node,
2240                             &ruleset->anchor->children)
2241                                 pr->nr++;
2242                 }
2243                 break;
2244         }
2245
2246         case DIOCGETRULESET: {
2247                 struct pfioc_ruleset    *pr = (struct pfioc_ruleset *)addr;
2248                 struct pf_ruleset       *ruleset;
2249                 struct pf_anchor        *anchor;
2250                 u_int32_t                nr = 0;
2251
2252                 pr->path[sizeof(pr->path) - 1] = 0;
2253                 if ((ruleset = pf_find_ruleset(pr->path)) == NULL) {
2254                         error = EINVAL;
2255                         break;
2256                 }
2257                 pr->name[0] = 0;
2258                 if (ruleset->anchor == NULL) {
2259                         /* XXX kludge for pf_main_ruleset */
2260                         RB_FOREACH(anchor, pf_anchor_global, &pf_anchors)
2261                                 if (anchor->parent == NULL && nr++ == pr->nr) {
2262                                         strlcpy(pr->name, anchor->name,
2263                                             sizeof(pr->name));
2264                                         break;
2265                                 }
2266                 } else {
2267                         RB_FOREACH(anchor, pf_anchor_node,
2268                             &ruleset->anchor->children)
2269                                 if (nr++ == pr->nr) {
2270                                         strlcpy(pr->name, anchor->name,
2271                                             sizeof(pr->name));
2272                                         break;
2273                                 }
2274                 }
2275                 if (!pr->name[0])
2276                         error = EBUSY;
2277                 break;
2278         }
2279
2280         case DIOCRCLRTABLES: {
2281                 struct pfioc_table *io = (struct pfioc_table *)addr;
2282
2283                 if (io->pfrio_esize != 0) {
2284                         error = ENODEV;
2285                         break;
2286                 }
2287                 error = pfr_clr_tables(&io->pfrio_table, &io->pfrio_ndel,
2288                     io->pfrio_flags | PFR_FLAG_USERIOCTL);
2289                 break;
2290         }
2291
2292         case DIOCRADDTABLES: {
2293                 struct pfioc_table *io = (struct pfioc_table *)addr;
2294
2295                 if (io->pfrio_esize != sizeof(struct pfr_table)) {
2296                         error = ENODEV;
2297                         break;
2298                 }
2299                 error = pfr_add_tables(io->pfrio_buffer, io->pfrio_size,
2300                     &io->pfrio_nadd, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2301                 break;
2302         }
2303
2304         case DIOCRDELTABLES: {
2305                 struct pfioc_table *io = (struct pfioc_table *)addr;
2306
2307                 if (io->pfrio_esize != sizeof(struct pfr_table)) {
2308                         error = ENODEV;
2309                         break;
2310                 }
2311                 error = pfr_del_tables(io->pfrio_buffer, io->pfrio_size,
2312                     &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2313                 break;
2314         }
2315
2316         case DIOCRGETTABLES: {
2317                 struct pfioc_table *io = (struct pfioc_table *)addr;
2318
2319                 if (io->pfrio_esize != sizeof(struct pfr_table)) {
2320                         error = ENODEV;
2321                         break;
2322                 }
2323                 error = pfr_get_tables(&io->pfrio_table, io->pfrio_buffer,
2324                     &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2325                 break;
2326         }
2327
2328         case DIOCRGETTSTATS: {
2329                 struct pfioc_table *io = (struct pfioc_table *)addr;
2330
2331                 if (io->pfrio_esize != sizeof(struct pfr_tstats)) {
2332                         error = ENODEV;
2333                         break;
2334                 }
2335                 error = pfr_get_tstats(&io->pfrio_table, io->pfrio_buffer,
2336                     &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2337                 break;
2338         }
2339
2340         case DIOCRCLRTSTATS: {
2341                 struct pfioc_table *io = (struct pfioc_table *)addr;
2342
2343                 if (io->pfrio_esize != sizeof(struct pfr_table)) {
2344                         error = ENODEV;
2345                         break;
2346                 }
2347                 error = pfr_clr_tstats(io->pfrio_buffer, io->pfrio_size,
2348                     &io->pfrio_nzero, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2349                 break;
2350         }
2351
2352         case DIOCRSETTFLAGS: {
2353                 struct pfioc_table *io = (struct pfioc_table *)addr;
2354
2355                 if (io->pfrio_esize != sizeof(struct pfr_table)) {
2356                         error = ENODEV;
2357                         break;
2358                 }
2359                 error = pfr_set_tflags(io->pfrio_buffer, io->pfrio_size,
2360                     io->pfrio_setflag, io->pfrio_clrflag, &io->pfrio_nchange,
2361                     &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2362                 break;
2363         }
2364
2365         case DIOCRCLRADDRS: {
2366                 struct pfioc_table *io = (struct pfioc_table *)addr;
2367
2368                 if (io->pfrio_esize != 0) {
2369                         error = ENODEV;
2370                         break;
2371                 }
2372                 error = pfr_clr_addrs(&io->pfrio_table, &io->pfrio_ndel,
2373                     io->pfrio_flags | PFR_FLAG_USERIOCTL);
2374                 break;
2375         }
2376
2377         case DIOCRADDADDRS: {
2378                 struct pfioc_table *io = (struct pfioc_table *)addr;
2379
2380                 if (io->pfrio_esize != sizeof(struct pfr_addr)) {
2381                         error = ENODEV;
2382                         break;
2383                 }
2384                 error = pfr_add_addrs(&io->pfrio_table, io->pfrio_buffer,
2385                     io->pfrio_size, &io->pfrio_nadd, io->pfrio_flags |
2386                     PFR_FLAG_USERIOCTL);
2387                 break;
2388         }
2389
2390         case DIOCRDELADDRS: {
2391                 struct pfioc_table *io = (struct pfioc_table *)addr;
2392
2393                 if (io->pfrio_esize != sizeof(struct pfr_addr)) {
2394                         error = ENODEV;
2395                         break;
2396                 }
2397                 error = pfr_del_addrs(&io->pfrio_table, io->pfrio_buffer,
2398                     io->pfrio_size, &io->pfrio_ndel, io->pfrio_flags |
2399                     PFR_FLAG_USERIOCTL);
2400                 break;
2401         }
2402
2403         case DIOCRSETADDRS: {
2404                 struct pfioc_table *io = (struct pfioc_table *)addr;
2405
2406                 if (io->pfrio_esize != sizeof(struct pfr_addr)) {
2407                         error = ENODEV;
2408                         break;
2409                 }
2410                 error = pfr_set_addrs(&io->pfrio_table, io->pfrio_buffer,
2411                     io->pfrio_size, &io->pfrio_size2, &io->pfrio_nadd,
2412                     &io->pfrio_ndel, &io->pfrio_nchange, io->pfrio_flags |
2413                     PFR_FLAG_USERIOCTL, 0);
2414                 break;
2415         }
2416
2417         case DIOCRGETADDRS: {
2418                 struct pfioc_table *io = (struct pfioc_table *)addr;
2419
2420                 if (io->pfrio_esize != sizeof(struct pfr_addr)) {
2421                         error = ENODEV;
2422                         break;
2423                 }
2424                 error = pfr_get_addrs(&io->pfrio_table, io->pfrio_buffer,
2425                     &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2426                 break;
2427         }
2428
2429         case DIOCRGETASTATS: {
2430                 struct pfioc_table *io = (struct pfioc_table *)addr;
2431
2432                 if (io->pfrio_esize != sizeof(struct pfr_astats)) {
2433                         error = ENODEV;
2434                         break;
2435                 }
2436                 error = pfr_get_astats(&io->pfrio_table, io->pfrio_buffer,
2437                     &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2438                 break;
2439         }
2440
2441         case DIOCRCLRASTATS: {
2442                 struct pfioc_table *io = (struct pfioc_table *)addr;
2443
2444                 if (io->pfrio_esize != sizeof(struct pfr_addr)) {
2445                         error = ENODEV;
2446                         break;
2447                 }
2448                 error = pfr_clr_astats(&io->pfrio_table, io->pfrio_buffer,
2449                     io->pfrio_size, &io->pfrio_nzero, io->pfrio_flags |
2450                     PFR_FLAG_USERIOCTL);
2451                 break;
2452         }
2453
2454         case DIOCRTSTADDRS: {
2455                 struct pfioc_table *io = (struct pfioc_table *)addr;
2456
2457                 if (io->pfrio_esize != sizeof(struct pfr_addr)) {
2458                         error = ENODEV;
2459                         break;
2460                 }
2461                 error = pfr_tst_addrs(&io->pfrio_table, io->pfrio_buffer,
2462                     io->pfrio_size, &io->pfrio_nmatch, io->pfrio_flags |
2463                     PFR_FLAG_USERIOCTL);
2464                 break;
2465         }
2466
2467         case DIOCRINADEFINE: {
2468                 struct pfioc_table *io = (struct pfioc_table *)addr;
2469
2470                 if (io->pfrio_esize != sizeof(struct pfr_addr)) {
2471                         error = ENODEV;
2472                         break;
2473                 }
2474                 error = pfr_ina_define(&io->pfrio_table, io->pfrio_buffer,
2475                     io->pfrio_size, &io->pfrio_nadd, &io->pfrio_naddr,
2476                     io->pfrio_ticket, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2477                 break;
2478         }
2479
2480         case DIOCOSFPADD: {
2481                 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr;
2482                 error = pf_osfp_add(io);
2483                 break;
2484         }
2485
2486         case DIOCOSFPGET: {
2487                 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr;
2488                 error = pf_osfp_get(io);
2489                 break;
2490         }
2491
2492         case DIOCXBEGIN: {
2493                 struct pfioc_trans      *io = (struct pfioc_trans *)addr;
2494                 struct pfioc_trans_e    *ioe;
2495                 struct pfr_table        *table;
2496                 int                      i;
2497
2498                 if (io->esize != sizeof(*ioe)) {
2499                         error = ENODEV;
2500                         goto fail;
2501                 }
2502                 ioe = kmalloc(sizeof(*ioe), M_TEMP, M_WAITOK);
2503                 table = kmalloc(sizeof(*table), M_TEMP, M_WAITOK);
2504                 for (i = 0; i < io->size; i++) {
2505                         if (copyin(io->array+i, ioe, sizeof(*ioe))) {
2506                                 kfree(table, M_TEMP);
2507                                 kfree(ioe, M_TEMP);
2508                                 error = EFAULT;
2509                                 goto fail;
2510                         }
2511                         switch (ioe->rs_num) {
2512 #ifdef ALTQ
2513                         case PF_RULESET_ALTQ:
2514                                 if (ioe->anchor[0]) {
2515                                         kfree(table, M_TEMP);
2516                                         kfree(ioe, M_TEMP);
2517                                         error = EINVAL;
2518                                         goto fail;
2519                                 }
2520                                 if ((error = pf_begin_altq(&ioe->ticket))) {
2521                                         kfree(table, M_TEMP);
2522                                         kfree(ioe, M_TEMP);
2523                                         goto fail;
2524                                 }
2525                                 break;
2526 #endif /* ALTQ */
2527                         case PF_RULESET_TABLE:
2528                                 bzero(table, sizeof(*table));
2529                                 strlcpy(table->pfrt_anchor, ioe->anchor,
2530                                     sizeof(table->pfrt_anchor));
2531                                 if ((error = pfr_ina_begin(table,
2532                                     &ioe->ticket, NULL, 0))) {
2533                                         kfree(table, M_TEMP);
2534                                         kfree(ioe, M_TEMP);
2535                                         goto fail;
2536                                 }
2537                                 break;
2538                         default:
2539                                 if ((error = pf_begin_rules(&ioe->ticket,
2540                                     ioe->rs_num, ioe->anchor))) {
2541                                         kfree(table, M_TEMP);
2542                                         kfree(ioe, M_TEMP);
2543                                         goto fail;
2544                                 }
2545                                 break;
2546                         }
2547                         if (copyout(ioe, io->array+i, sizeof(io->array[i]))) {
2548                                 kfree(table, M_TEMP);
2549                                 kfree(ioe, M_TEMP);
2550                                 error = EFAULT;
2551                                 goto fail;
2552                         }
2553                 }
2554                 kfree(table, M_TEMP);
2555                 kfree(ioe, M_TEMP);
2556                 break;
2557         }
2558
2559         case DIOCXROLLBACK: {
2560                 struct pfioc_trans      *io = (struct pfioc_trans *)addr;
2561                 struct pfioc_trans_e    *ioe;
2562                 struct pfr_table        *table;
2563                 int                      i;
2564
2565                 if (io->esize != sizeof(*ioe)) {
2566                         error = ENODEV;
2567                         goto fail;
2568                 }
2569                 ioe = kmalloc(sizeof(*ioe), M_TEMP, M_WAITOK);
2570                 table = kmalloc(sizeof(*table), M_TEMP, M_WAITOK);
2571                 for (i = 0; i < io->size; i++) {
2572                         if (copyin(io->array+i, ioe, sizeof(*ioe))) {
2573                                 kfree(table, M_TEMP);
2574                                 kfree(ioe, M_TEMP);
2575                                 error = EFAULT;
2576                                 goto fail;
2577                         }
2578                         switch (ioe->rs_num) {
2579 #ifdef ALTQ
2580                         case PF_RULESET_ALTQ:
2581                                 if (ioe->anchor[0]) {
2582                                         kfree(table, M_TEMP);
2583                                         kfree(ioe, M_TEMP);
2584                                         error = EINVAL;
2585                                         goto fail;
2586                                 }
2587                                 if ((error = pf_rollback_altq(ioe->ticket))) {
2588                                         kfree(table, M_TEMP);
2589                                         kfree(ioe, M_TEMP);
2590                                         goto fail; /* really bad */
2591                                 }
2592                                 break;
2593 #endif /* ALTQ */
2594                         case PF_RULESET_TABLE:
2595                                 bzero(table, sizeof(*table));
2596                                 strlcpy(table->pfrt_anchor, ioe->anchor,
2597                                     sizeof(table->pfrt_anchor));
2598                                 if ((error = pfr_ina_rollback(table,
2599                                     ioe->ticket, NULL, 0))) {
2600                                         kfree(table, M_TEMP);
2601                                         kfree(ioe, M_TEMP);
2602                                         goto fail; /* really bad */
2603                                 }
2604                                 break;
2605                         default:
2606                                 if ((error = pf_rollback_rules(ioe->ticket,
2607                                     ioe->rs_num, ioe->anchor))) {
2608                                         kfree(table, M_TEMP);
2609                                         kfree(ioe, M_TEMP);
2610                                         goto fail; /* really bad */
2611                                 }
2612                                 break;
2613                         }
2614                 }
2615                 kfree(table, M_TEMP);
2616                 kfree(ioe, M_TEMP);
2617                 break;
2618         }
2619
2620         case DIOCXCOMMIT: {
2621                 struct pfioc_trans      *io = (struct pfioc_trans *)addr;
2622                 struct pfioc_trans_e    *ioe;
2623                 struct pfr_table        *table;
2624                 struct pf_ruleset       *rs;
2625                 int                      i;
2626
2627                 if (io->esize != sizeof(*ioe)) {
2628                         error = ENODEV;
2629                         goto fail;
2630                 }
2631                 ioe = kmalloc(sizeof(*ioe), M_TEMP, M_WAITOK);
2632                 table = kmalloc(sizeof(*table), M_TEMP, M_WAITOK);
2633                 /* first makes sure everything will succeed */
2634                 for (i = 0; i < io->size; i++) {
2635                         if (copyin(io->array+i, ioe, sizeof(*ioe))) {
2636                                 kfree(table, M_TEMP);
2637                                 kfree(ioe, M_TEMP);
2638                                 error = EFAULT;
2639                                 goto fail;
2640                         }
2641                         switch (ioe->rs_num) {
2642 #ifdef ALTQ
2643                         case PF_RULESET_ALTQ:
2644                                 if (ioe->anchor[0]) {
2645                                         kfree(table, M_TEMP);
2646                                         kfree(ioe, M_TEMP);
2647                                         error = EINVAL;
2648                                         goto fail;
2649                                 }
2650                                 if (!altqs_inactive_open || ioe->ticket !=
2651                                     ticket_altqs_inactive) {
2652                                         kfree(table, M_TEMP);
2653                                         kfree(ioe, M_TEMP);
2654                                         error = EBUSY;
2655                                         goto fail;
2656                                 }
2657                                 break;
2658 #endif /* ALTQ */
2659                         case PF_RULESET_TABLE:
2660                                 rs = pf_find_ruleset(ioe->anchor);
2661                                 if (rs == NULL || !rs->topen || ioe->ticket !=
2662                                      rs->tticket) {
2663                                         kfree(table, M_TEMP);
2664                                         kfree(ioe, M_TEMP);
2665                                         error = EBUSY;
2666                                         goto fail;
2667                                 }
2668                                 break;
2669                         default:
2670                                 if (ioe->rs_num < 0 || ioe->rs_num >=
2671                                     PF_RULESET_MAX) {
2672                                         kfree(table, M_TEMP);
2673                                         kfree(ioe, M_TEMP);
2674                                         error = EINVAL;
2675                                         goto fail;
2676                                 }
2677                                 rs = pf_find_ruleset(ioe->anchor);
2678                                 if (rs == NULL ||
2679                                     !rs->rules[ioe->rs_num].inactive.open ||
2680                                     rs->rules[ioe->rs_num].inactive.ticket !=
2681                                     ioe->ticket) {
2682                                         kfree(table, M_TEMP);
2683                                         kfree(ioe, M_TEMP);
2684                                         error = EBUSY;
2685                                         goto fail;
2686                                 }
2687                                 break;
2688                         }
2689                 }
2690                 /* now do the commit - no errors should happen here */
2691                 for (i = 0; i < io->size; i++) {
2692                         if (copyin(io->array+i, ioe, sizeof(*ioe))) {
2693                                 kfree(table, M_TEMP);
2694                                 kfree(ioe, M_TEMP);
2695                                 error = EFAULT;
2696                                 goto fail;
2697                         }
2698                         switch (ioe->rs_num) {
2699 #ifdef ALTQ
2700                         case PF_RULESET_ALTQ:
2701                                 if ((error = pf_commit_altq(ioe->ticket))) {
2702                                         kfree(table, M_TEMP);
2703                                         kfree(ioe, M_TEMP);
2704                                         goto fail; /* really bad */
2705                                 }
2706                                 break;
2707 #endif /* ALTQ */
2708                         case PF_RULESET_TABLE:
2709                                 bzero(table, sizeof(*table));
2710                                 strlcpy(table->pfrt_anchor, ioe->anchor,
2711                                     sizeof(table->pfrt_anchor));
2712                                 if ((error = pfr_ina_commit(table, ioe->ticket,
2713                                     NULL, NULL, 0))) {
2714                                         kfree(table, M_TEMP);
2715                                         kfree(ioe, M_TEMP);
2716                                         goto fail; /* really bad */
2717                                 }
2718                                 break;
2719                         default:
2720                                 if ((error = pf_commit_rules(ioe->ticket,
2721                                     ioe->rs_num, ioe->anchor))) {
2722                                         kfree(table, M_TEMP);
2723                                         kfree(ioe, M_TEMP);
2724                                         goto fail; /* really bad */
2725                                 }
2726                                 break;
2727                         }
2728                 }
2729                 kfree(table, M_TEMP);
2730                 kfree(ioe, M_TEMP);
2731                 break;
2732         }
2733
2734         case DIOCGETSRCNODES: {
2735                 struct pfioc_src_nodes  *psn = (struct pfioc_src_nodes *)addr;
2736                 struct pf_src_node      *n, *p, *pstore;
2737                 u_int32_t                nr = 0;
2738                 int                      space = psn->psn_len;
2739
2740                 if (space == 0) {
2741                         RB_FOREACH(n, pf_src_tree, &tree_src_tracking)
2742                                 nr++;
2743                         psn->psn_len = sizeof(struct pf_src_node) * nr;
2744                         break;
2745                 }
2746
2747                 pstore = kmalloc(sizeof(*pstore), M_TEMP, M_WAITOK);
2748
2749                 p = psn->psn_src_nodes;
2750                 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) {
2751                         int     secs = time_second, diff;
2752
2753                         if ((nr + 1) * sizeof(*p) > (unsigned)psn->psn_len)
2754                                 break;
2755
2756                         bcopy(n, pstore, sizeof(*pstore));
2757                         if (n->rule.ptr != NULL)
2758                                 pstore->rule.nr = n->rule.ptr->nr;
2759                         pstore->creation = secs - pstore->creation;
2760                         if (pstore->expire > secs)
2761                                 pstore->expire -= secs;
2762                         else
2763                                 pstore->expire = 0;
2764
2765                         /* adjust the connection rate estimate */
2766                         diff = secs - n->conn_rate.last;
2767                         if (diff >= n->conn_rate.seconds)
2768                                 pstore->conn_rate.count = 0;
2769                         else
2770                                 pstore->conn_rate.count -=
2771                                     n->conn_rate.count * diff /
2772                                     n->conn_rate.seconds;
2773
2774                         error = copyout(pstore, p, sizeof(*p));
2775                         if (error) {
2776                                 kfree(pstore, M_TEMP);
2777                                 goto fail;
2778                         }
2779                         p++;
2780                         nr++;
2781                 }
2782                 psn->psn_len = sizeof(struct pf_src_node) * nr;
2783
2784                 kfree(pstore, M_TEMP);
2785                 break;
2786         }
2787
2788         case DIOCCLRSRCNODES: {
2789                 struct pf_src_node      *n;
2790                 struct pf_state         *state;
2791
2792                 RB_FOREACH(state, pf_state_tree_id, &tree_id) {
2793                         state->src_node = NULL;
2794                         state->nat_src_node = NULL;
2795                 }
2796                 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) {
2797                         n->expire = 1;
2798                         n->states = 0;
2799                 }
2800                 pf_purge_expired_src_nodes(1);
2801                 pf_status.src_nodes = 0;
2802                 break;
2803         }
2804
2805         case DIOCKILLSRCNODES: {
2806                 struct pf_src_node      *sn;
2807                 struct pf_state         *s;
2808                 struct pfioc_src_node_kill *psnk =
2809                     (struct pfioc_src_node_kill *)addr;
2810                 u_int                   killed = 0;
2811
2812                 RB_FOREACH(sn, pf_src_tree, &tree_src_tracking) {
2813                         if (PF_MATCHA(psnk->psnk_src.neg,
2814                                 &psnk->psnk_src.addr.v.a.addr,
2815                                 &psnk->psnk_src.addr.v.a.mask,
2816                                 &sn->addr, sn->af) &&
2817                             PF_MATCHA(psnk->psnk_dst.neg,
2818                                 &psnk->psnk_dst.addr.v.a.addr,
2819                                 &psnk->psnk_dst.addr.v.a.mask,
2820                                 &sn->raddr, sn->af)) {
2821                                 /* Handle state to src_node linkage */
2822                                 if (sn->states != 0) {
2823                                         RB_FOREACH(s, pf_state_tree_id,
2824                                             &tree_id) {
2825                                                 if (s->src_node == sn)
2826                                                         s->src_node = NULL;
2827                                                 if (s->nat_src_node == sn)
2828                                                         s->nat_src_node = NULL;
2829                                         }
2830                                         sn->states = 0;
2831                                 }
2832                                 sn->expire = 1;
2833                                 killed++;
2834                         }
2835                 }
2836
2837                 if (killed > 0)
2838                         pf_purge_expired_src_nodes(1);
2839
2840                 psnk->psnk_killed = killed;
2841                 break;
2842         }
2843
2844         case DIOCSETHOSTID: {
2845                 u_int32_t       *hostid = (u_int32_t *)addr;
2846
2847                 if (*hostid == 0)
2848                         pf_status.hostid = karc4random();
2849                 else
2850                         pf_status.hostid = *hostid;
2851                 break;
2852         }
2853
2854         case DIOCOSFPFLUSH:
2855                 crit_enter();
2856                 pf_osfp_flush();
2857                 crit_exit();
2858                 break;
2859
2860         case DIOCIGETIFACES: {
2861                 struct pfioc_iface *io = (struct pfioc_iface *)addr;
2862
2863                 if (io->pfiio_esize != sizeof(struct pfi_kif)) {
2864                         error = ENODEV;
2865                         break;
2866                 }
2867                 error = pfi_get_ifaces(io->pfiio_name, io->pfiio_buffer,
2868                     &io->pfiio_size);
2869                 break;
2870         }
2871
2872         case DIOCSETIFFLAG: {
2873                 struct pfioc_iface *io = (struct pfioc_iface *)addr;
2874
2875                 error = pfi_set_flags(io->pfiio_name, io->pfiio_flags);
2876                 break;
2877         }
2878
2879         case DIOCCLRIFFLAG: {
2880                 struct pfioc_iface *io = (struct pfioc_iface *)addr;
2881
2882                 error = pfi_clear_flags(io->pfiio_name, io->pfiio_flags);
2883                 break;
2884         }
2885
2886         default:
2887                 error = ENODEV;
2888                 break;
2889         }
2890 fail:
2891         lwkt_reltoken(&pf_token);
2892         return (error);
2893 }
2894
2895 /*
2896  * XXX - Check for version missmatch!!!
2897  */
2898 static void
2899 pf_clear_states(void)
2900 {
2901         struct pf_state         *s, *nexts;
2902         u_int                   killed = 0;
2903
2904         for (s = RB_MIN(pf_state_tree_id, &tree_id); s; s = nexts) {
2905                 nexts = RB_NEXT(pf_state_tree_id, &tree_id, s);
2906
2907                 /* don't send out individual delete messages */
2908                 s->sync_flags = PFSTATE_NOSYNC;
2909                 pf_unlink_state(s);
2910                 killed++;
2911
2912         }
2913
2914 #if 0 /* PFSYNC */
2915 /*
2916  * XXX This is called on module unload, we do not want to sync that over? */
2917  */
2918         pfsync_clear_states(pf_status.hostid, psk->psk_ifname);
2919 #endif
2920 }
2921
2922 static int
2923 pf_clear_tables(void)
2924 {
2925         struct pfioc_table io;
2926         int error;
2927
2928         bzero(&io, sizeof(io));
2929
2930         error = pfr_clr_tables(&io.pfrio_table, &io.pfrio_ndel,
2931             io.pfrio_flags);
2932
2933         return (error);
2934 }
2935
2936 static void
2937 pf_clear_srcnodes(void)
2938 {
2939         struct pf_src_node      *n;
2940         struct pf_state         *state;
2941
2942         RB_FOREACH(state, pf_state_tree_id, &tree_id) {
2943                 state->src_node = NULL;
2944                 state->nat_src_node = NULL;
2945         }
2946         RB_FOREACH(n, pf_src_tree, &tree_src_tracking) {
2947                 n->expire = 1;
2948                 n->states = 0;
2949         }
2950         pf_purge_expired_src_nodes(0);
2951         pf_status.src_nodes = 0;
2952 }
2953
2954 /*
2955  * XXX - Check for version missmatch!!!
2956  */
2957
2958 /*
2959  * Duplicate pfctl -Fa operation to get rid of as much as we can.
2960  */
2961 static int
2962 shutdown_pf(void)
2963 {
2964         int error = 0;
2965         u_int32_t t[5];
2966         char nn = '\0';
2967
2968
2969         pf_status.running = 0;
2970         error = dehook_pf();
2971         if (error) {
2972                 pf_status.running = 1;
2973                 DPFPRINTF(PF_DEBUG_MISC,
2974                     ("pf: pfil unregistration failed\n"));
2975                 return(error);
2976         }
2977         do {
2978                 if ((error = pf_begin_rules(&t[0], PF_RULESET_SCRUB, &nn)) != 0) {
2979                         DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: SCRUB\n"));
2980                         break;
2981                 }
2982                 if ((error = pf_begin_rules(&t[1], PF_RULESET_FILTER, &nn)) != 0) {
2983                         DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: FILTER\n"));
2984                         break;          /* XXX: rollback? */
2985                 }
2986                 if ((error = pf_begin_rules(&t[2], PF_RULESET_NAT, &nn))    != 0) {
2987                         DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: NAT\n"));
2988                         break;          /* XXX: rollback? */
2989                 }
2990                 if ((error = pf_begin_rules(&t[3], PF_RULESET_BINAT, &nn))
2991                     != 0) {
2992                         DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: BINAT\n"));
2993                         break;          /* XXX: rollback? */
2994                 }
2995                 if ((error = pf_begin_rules(&t[4], PF_RULESET_RDR, &nn))
2996                     != 0) {
2997                         DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: RDR\n"));
2998                         break;          /* XXX: rollback? */
2999                 }
3000
3001                 /* XXX: these should always succeed here */
3002                 pf_commit_rules(t[0], PF_RULESET_SCRUB, &nn);
3003                 pf_commit_rules(t[1], PF_RULESET_FILTER, &nn);
3004                 pf_commit_rules(t[2], PF_RULESET_NAT, &nn);
3005                 pf_commit_rules(t[3], PF_RULESET_BINAT, &nn);
3006                 pf_commit_rules(t[4], PF_RULESET_RDR, &nn);
3007
3008                 if ((error = pf_clear_tables()) != 0)
3009                         break;
3010 #ifdef ALTQ
3011                 if ((error = pf_begin_altq(&t[0])) != 0) {
3012                         DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: ALTQ\n"));
3013                         break;
3014                 }
3015                 pf_commit_altq(t[0]);
3016 #endif
3017                 pf_clear_states();
3018                 pf_clear_srcnodes();
3019
3020                 /* status does not use malloced mem so no need to cleanup */
3021                 /* fingerprints and interfaces have their own cleanup code */
3022         } while(0);
3023         return (error);
3024 }
3025
3026 static int
3027 pf_check_in(void *arg, struct mbuf **m, struct ifnet *ifp, int dir)
3028 {
3029         /*
3030          * DragonFly's version of pf uses FreeBSD's native host byte ordering
3031          * for ip_len/ip_off. This is why we don't have to change byte order
3032          * like the FreeBSD-5 version does.
3033          */
3034         int chk;
3035
3036         lwkt_gettoken(&pf_token);
3037
3038         chk = pf_test(PF_IN, ifp, m, NULL, NULL);
3039         if (chk && *m) {
3040                 m_freem(*m);
3041                 *m = NULL;
3042         }
3043         lwkt_reltoken(&pf_token);
3044         return chk;
3045 }
3046
3047 static int
3048 pf_check_out(void *arg, struct mbuf **m, struct ifnet *ifp, int dir)
3049 {
3050         /*
3051          * DragonFly's version of pf uses FreeBSD's native host byte ordering
3052          * for ip_len/ip_off. This is why we don't have to change byte order
3053          * like the FreeBSD-5 version does.
3054          */
3055         int chk;
3056
3057         lwkt_gettoken(&pf_token);
3058
3059         /* We need a proper CSUM befor we start (s. OpenBSD ip_output) */
3060         if ((*m)->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
3061                 in_delayed_cksum(*m);
3062                 (*m)->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
3063         }
3064         chk = pf_test(PF_OUT, ifp, m, NULL, NULL);
3065         if (chk && *m) {
3066                 m_freem(*m);
3067                 *m = NULL;
3068         }
3069         lwkt_reltoken(&pf_token);
3070         return chk;
3071 }
3072
3073 #ifdef INET6
3074 static int
3075 pf_check6_in(void *arg, struct mbuf **m, struct ifnet *ifp, int dir)
3076 {
3077         /*
3078          * IPv6 is not affected by ip_len/ip_off byte order changes.
3079          */
3080         int chk;
3081
3082         lwkt_gettoken(&pf_token);
3083
3084         chk = pf_test6(PF_IN, ifp, m, NULL, NULL);
3085         if (chk && *m) {
3086                 m_freem(*m);
3087                 *m = NULL;
3088         }
3089         lwkt_reltoken(&pf_token);
3090         return chk;
3091 }
3092
3093 static int
3094 pf_check6_out(void *arg, struct mbuf **m, struct ifnet *ifp, int dir)
3095 {
3096         /*
3097          * IPv6 is not affected by ip_len/ip_off byte order changes.
3098          */
3099         int chk;
3100
3101         lwkt_gettoken(&pf_token);
3102
3103         /* We need a proper CSUM befor we start (s. OpenBSD ip_output) */
3104         if ((*m)->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
3105                 in_delayed_cksum(*m);
3106                 (*m)->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
3107         }
3108         chk = pf_test6(PF_OUT, ifp, m, NULL, NULL);
3109         if (chk && *m) {
3110                 m_freem(*m);
3111                 *m = NULL;
3112         }
3113         lwkt_reltoken(&pf_token);
3114         return chk;
3115 }
3116 #endif /* INET6 */
3117
3118 static int
3119 hook_pf(void)
3120 {
3121         struct pfil_head *pfh_inet;
3122 #ifdef INET6
3123         struct pfil_head *pfh_inet6;
3124 #endif
3125
3126         lwkt_gettoken(&pf_token);
3127
3128         if (pf_pfil_hooked) {
3129                 lwkt_reltoken(&pf_token);
3130                 return (0);
3131         }
3132
3133         pfh_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET);
3134         if (pfh_inet == NULL) {
3135                 lwkt_reltoken(&pf_token);
3136                 return (ENODEV);
3137         }
3138         pfil_add_hook(pf_check_in, NULL, PFIL_IN | PFIL_MPSAFE, pfh_inet);
3139         pfil_add_hook(pf_check_out, NULL, PFIL_OUT | PFIL_MPSAFE, pfh_inet);
3140 #ifdef INET6
3141         pfh_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6);
3142         if (pfh_inet6 == NULL) {
3143                 pfil_remove_hook(pf_check_in, NULL, PFIL_IN, pfh_inet);
3144                 pfil_remove_hook(pf_check_out, NULL, PFIL_OUT, pfh_inet);
3145                 lwkt_reltoken(&pf_token);
3146                 return (ENODEV);
3147         }
3148         pfil_add_hook(pf_check6_in, NULL, PFIL_IN | PFIL_MPSAFE, pfh_inet6);
3149         pfil_add_hook(pf_check6_out, NULL, PFIL_OUT | PFIL_MPSAFE, pfh_inet6);
3150 #endif
3151
3152         pf_pfil_hooked = 1;
3153         lwkt_reltoken(&pf_token);
3154         return (0);
3155 }
3156
3157 static int
3158 dehook_pf(void)
3159 {
3160         struct pfil_head *pfh_inet;
3161 #ifdef INET6
3162         struct pfil_head *pfh_inet6;
3163 #endif
3164
3165         lwkt_gettoken(&pf_token);
3166
3167         if (pf_pfil_hooked == 0) {
3168                 lwkt_reltoken(&pf_token);
3169                 return (0);
3170         }
3171
3172         pfh_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET);
3173         if (pfh_inet == NULL) {
3174                 lwkt_reltoken(&pf_token);
3175                 return (ENODEV);
3176         }
3177         pfil_remove_hook(pf_check_in, NULL, PFIL_IN, pfh_inet);
3178         pfil_remove_hook(pf_check_out, NULL, PFIL_OUT, pfh_inet);
3179 #ifdef INET6
3180         pfh_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6);
3181         if (pfh_inet6 == NULL) {
3182                 lwkt_reltoken(&pf_token);
3183                 return (ENODEV);
3184         }
3185         pfil_remove_hook(pf_check6_in, NULL, PFIL_IN, pfh_inet6);
3186         pfil_remove_hook(pf_check6_out, NULL, PFIL_OUT, pfh_inet6);
3187 #endif
3188
3189         pf_pfil_hooked = 0;
3190         lwkt_reltoken(&pf_token);
3191         return (0);
3192 }
3193
3194 static int
3195 pf_load(void)
3196 {
3197         lwkt_gettoken(&pf_token);
3198
3199         pf_dev = make_dev(&pf_ops, 0, 0, 0, 0600, PF_NAME);
3200         pfattach();
3201         lockinit(&pf_consistency_lock, "pfconslck", 0, LK_CANRECURSE);
3202         lwkt_reltoken(&pf_token);
3203         return (0);
3204 }
3205
3206 static int
3207 pf_mask_del(struct radix_node *rn, void *arg)
3208 {
3209         struct radix_node_head *rnh = arg;
3210
3211         rnh->rnh_deladdr(rn->rn_key, rn->rn_mask, rnh);
3212         Free(rn);
3213         return 0;
3214 }
3215
3216 static int
3217 pf_unload(void)
3218 {
3219         int error;
3220         pf_status.running = 0;
3221
3222         lwkt_gettoken(&pf_token);
3223
3224         error = dehook_pf();
3225         if (error) {
3226                 /*
3227                  * Should not happen!
3228                  * XXX Due to error code ESRCH, kldunload will show
3229                  * a message like 'No such process'.
3230                  */
3231                 kprintf("pfil unregistration fail\n");
3232                 lwkt_reltoken(&pf_token);
3233                 return error;
3234         }
3235         shutdown_pf();
3236         pf_end_threads = 1;
3237         while (pf_end_threads < 2) {
3238                 wakeup_one(pf_purge_thread);
3239                 tsleep(pf_purge_thread, 0, "pftmo", hz);
3240         }
3241         pfi_cleanup();
3242         pf_osfp_flush();
3243         dev_ops_remove_all(&pf_ops);
3244         lockuninit(&pf_consistency_lock);
3245         lwkt_reltoken(&pf_token);
3246
3247         if (pf_maskhead != NULL) {
3248                 pf_maskhead->rnh_walktree(pf_maskhead,
3249                         pf_mask_del, pf_maskhead);
3250                 Free(pf_maskhead);
3251                 pf_maskhead = NULL;
3252         }
3253         kmalloc_destroy(&pf_state_pl);
3254         kmalloc_destroy(&pf_frent_pl);
3255         kmalloc_destroy(&pf_cent_pl);
3256         return 0;
3257 }
3258
3259 static int
3260 pf_modevent(module_t mod, int type, void *data)
3261 {
3262         int error = 0;
3263
3264         lwkt_gettoken(&pf_token);
3265
3266         switch(type) {
3267         case MOD_LOAD:
3268                 error = pf_load();
3269                 break;
3270
3271         case MOD_UNLOAD:
3272                 error = pf_unload();
3273                 break;
3274         default:
3275                 error = EINVAL;
3276                 break;
3277         }
3278         lwkt_reltoken(&pf_token);
3279         return error;
3280 }
3281
3282 static moduledata_t pf_mod = {
3283         "pf",
3284         pf_modevent,
3285         0
3286 };
3287 DECLARE_MODULE(pf, pf_mod, SI_SUB_PSEUDO, SI_ORDER_FIRST);
3288 MODULE_VERSION(pf, PF_MODVER);