pf_table.c revision 1.3.2.3
1 1.3.2.3 skrll /* $NetBSD: pf_table.c,v 1.3.2.3 2004/09/18 14:52:37 skrll Exp $ */ 2 1.3.2.2 skrll /* $OpenBSD: pf_table.c,v 1.47 2004/03/09 21:44:41 mcbride Exp $ */ 3 1.3.2.2 skrll 4 1.3.2.2 skrll /* 5 1.3.2.2 skrll * Copyright (c) 2002 Cedric Berger 6 1.3.2.2 skrll * All rights reserved. 7 1.3.2.2 skrll * 8 1.3.2.2 skrll * Redistribution and use in source and binary forms, with or without 9 1.3.2.2 skrll * modification, are permitted provided that the following conditions 10 1.3.2.2 skrll * are met: 11 1.3.2.2 skrll * 12 1.3.2.2 skrll * - Redistributions of source code must retain the above copyright 13 1.3.2.2 skrll * notice, this list of conditions and the following disclaimer. 14 1.3.2.2 skrll * - Redistributions in binary form must reproduce the above 15 1.3.2.2 skrll * copyright notice, this list of conditions and the following 16 1.3.2.2 skrll * disclaimer in the documentation and/or other materials provided 17 1.3.2.2 skrll * with the distribution. 18 1.3.2.2 skrll * 19 1.3.2.2 skrll * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 20 1.3.2.2 skrll * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 21 1.3.2.2 skrll * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 22 1.3.2.2 skrll * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 23 1.3.2.2 skrll * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 24 1.3.2.2 skrll * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 25 1.3.2.2 skrll * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 1.3.2.2 skrll * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 27 1.3.2.2 skrll * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 1.3.2.2 skrll * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 29 1.3.2.2 skrll * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 1.3.2.2 skrll * POSSIBILITY OF SUCH DAMAGE. 31 1.3.2.2 skrll * 32 1.3.2.2 skrll */ 33 1.3.2.2 skrll 34 1.3.2.2 skrll #ifdef _KERNEL_OPT 35 1.3.2.2 skrll #include "opt_inet.h" 36 1.3.2.2 skrll #endif 37 1.3.2.2 skrll 38 1.3.2.2 skrll #include <sys/param.h> 39 1.3.2.2 skrll #include <sys/systm.h> 40 1.3.2.2 skrll #include <sys/socket.h> 41 1.3.2.2 skrll #include <sys/mbuf.h> 42 1.3.2.2 skrll #include <sys/kernel.h> 43 1.3.2.2 skrll 44 1.3.2.2 skrll #include <net/if.h> 45 1.3.2.2 skrll #include <net/route.h> 46 1.3.2.2 skrll #include <netinet/in.h> 47 1.3.2.2 skrll #ifdef __OpenBSD__ 48 1.3.2.2 skrll #include <netinet/ip_ipsp.h> 49 1.3.2.2 skrll #endif 50 1.3.2.2 skrll #include <net/pfvar.h> 51 1.3.2.2 skrll 52 1.3.2.2 skrll #define ACCEPT_FLAGS(oklist) \ 53 1.3.2.2 skrll do { \ 54 1.3.2.2 skrll if ((flags & ~(oklist)) & \ 55 1.3.2.2 skrll PFR_FLAG_ALLMASK) \ 56 1.3.2.2 skrll return (EINVAL); \ 57 1.3.2.2 skrll } while (0) 58 1.3.2.2 skrll 59 1.3.2.2 skrll #define COPYIN(from, to, size) \ 60 1.3.2.2 skrll ((flags & PFR_FLAG_USERIOCTL) ? \ 61 1.3.2.2 skrll copyin((from), (to), (size)) : \ 62 1.3.2.2 skrll (bcopy((from), (to), (size)), 0)) 63 1.3.2.2 skrll 64 1.3.2.2 skrll #define COPYOUT(from, to, size) \ 65 1.3.2.2 skrll ((flags & PFR_FLAG_USERIOCTL) ? \ 66 1.3.2.2 skrll copyout((from), (to), (size)) : \ 67 1.3.2.2 skrll (bcopy((from), (to), (size)), 0)) 68 1.3.2.2 skrll 69 1.3.2.2 skrll #define FILLIN_SIN(sin, addr) \ 70 1.3.2.2 skrll do { \ 71 1.3.2.2 skrll (sin).sin_len = sizeof(sin); \ 72 1.3.2.2 skrll (sin).sin_family = AF_INET; \ 73 1.3.2.2 skrll (sin).sin_addr = (addr); \ 74 1.3.2.2 skrll } while (0) 75 1.3.2.2 skrll 76 1.3.2.2 skrll #define FILLIN_SIN6(sin6, addr) \ 77 1.3.2.2 skrll do { \ 78 1.3.2.2 skrll (sin6).sin6_len = sizeof(sin6); \ 79 1.3.2.2 skrll (sin6).sin6_family = AF_INET6; \ 80 1.3.2.2 skrll (sin6).sin6_addr = (addr); \ 81 1.3.2.2 skrll } while (0) 82 1.3.2.2 skrll 83 1.3.2.2 skrll #define SWAP(type, a1, a2) \ 84 1.3.2.2 skrll do { \ 85 1.3.2.2 skrll type tmp = a1; \ 86 1.3.2.2 skrll a1 = a2; \ 87 1.3.2.2 skrll a2 = tmp; \ 88 1.3.2.2 skrll } while (0) 89 1.3.2.2 skrll 90 1.3.2.2 skrll #define SUNION2PF(su, af) (((af)==AF_INET) ? \ 91 1.3.2.2 skrll (struct pf_addr *)&(su)->sin.sin_addr : \ 92 1.3.2.2 skrll (struct pf_addr *)&(su)->sin6.sin6_addr) 93 1.3.2.2 skrll 94 1.3.2.2 skrll #define AF_BITS(af) (((af)==AF_INET)?32:128) 95 1.3.2.2 skrll #define ADDR_NETWORK(ad) ((ad)->pfra_net < AF_BITS((ad)->pfra_af)) 96 1.3.2.2 skrll #define KENTRY_NETWORK(ke) ((ke)->pfrke_net < AF_BITS((ke)->pfrke_af)) 97 1.3.2.2 skrll #define KENTRY_RNF_ROOT(ke) \ 98 1.3.2.2 skrll ((((struct radix_node *)(ke))->rn_flags & RNF_ROOT) != 0) 99 1.3.2.2 skrll 100 1.3.2.2 skrll #define NO_ADDRESSES (-1) 101 1.3.2.2 skrll #define ENQUEUE_UNMARKED_ONLY (1) 102 1.3.2.2 skrll #define INVERT_NEG_FLAG (1) 103 1.3.2.2 skrll 104 1.3.2.2 skrll struct pfr_walktree { 105 1.3.2.2 skrll enum pfrw_op { 106 1.3.2.2 skrll PFRW_MARK, 107 1.3.2.2 skrll PFRW_SWEEP, 108 1.3.2.2 skrll PFRW_ENQUEUE, 109 1.3.2.2 skrll PFRW_GET_ADDRS, 110 1.3.2.2 skrll PFRW_GET_ASTATS, 111 1.3.2.2 skrll PFRW_POOL_GET, 112 1.3.2.2 skrll PFRW_DYNADDR_UPDATE 113 1.3.2.2 skrll } pfrw_op; 114 1.3.2.2 skrll union { 115 1.3.2.2 skrll struct pfr_addr *pfrw1_addr; 116 1.3.2.2 skrll struct pfr_astats *pfrw1_astats; 117 1.3.2.2 skrll struct pfr_kentryworkq *pfrw1_workq; 118 1.3.2.2 skrll struct pfr_kentry *pfrw1_kentry; 119 1.3.2.2 skrll struct pfi_dynaddr *pfrw1_dyn; 120 1.3.2.2 skrll } pfrw_1; 121 1.3.2.2 skrll int pfrw_free; 122 1.3.2.2 skrll int pfrw_flags; 123 1.3.2.2 skrll }; 124 1.3.2.2 skrll #define pfrw_addr pfrw_1.pfrw1_addr 125 1.3.2.2 skrll #define pfrw_astats pfrw_1.pfrw1_astats 126 1.3.2.2 skrll #define pfrw_workq pfrw_1.pfrw1_workq 127 1.3.2.2 skrll #define pfrw_kentry pfrw_1.pfrw1_kentry 128 1.3.2.2 skrll #define pfrw_dyn pfrw_1.pfrw1_dyn 129 1.3.2.2 skrll #define pfrw_cnt pfrw_free 130 1.3.2.2 skrll 131 1.3.2.2 skrll #define senderr(e) do { rv = (e); goto _bad; } while (0) 132 1.3.2.2 skrll 133 1.3.2.2 skrll struct pool pfr_ktable_pl; 134 1.3.2.2 skrll struct pool pfr_kentry_pl; 135 1.3.2.2 skrll struct sockaddr_in pfr_sin; 136 1.3.2.2 skrll struct sockaddr_in6 pfr_sin6; 137 1.3.2.2 skrll union sockaddr_union pfr_mask; 138 1.3.2.2 skrll struct pf_addr pfr_ffaddr; 139 1.3.2.2 skrll 140 1.3.2.2 skrll void pfr_copyout_addr(struct pfr_addr *, 141 1.3.2.2 skrll struct pfr_kentry *ke); 142 1.3.2.2 skrll int pfr_validate_addr(struct pfr_addr *); 143 1.3.2.2 skrll void pfr_enqueue_addrs(struct pfr_ktable *, 144 1.3.2.2 skrll struct pfr_kentryworkq *, int *, int); 145 1.3.2.2 skrll void pfr_mark_addrs(struct pfr_ktable *); 146 1.3.2.2 skrll struct pfr_kentry *pfr_lookup_addr(struct pfr_ktable *, 147 1.3.2.2 skrll struct pfr_addr *, int); 148 1.3.2.2 skrll struct pfr_kentry *pfr_create_kentry(struct pfr_addr *); 149 1.3.2.2 skrll void pfr_destroy_kentries(struct pfr_kentryworkq *); 150 1.3.2.2 skrll void pfr_destroy_kentry(struct pfr_kentry *); 151 1.3.2.2 skrll void pfr_insert_kentries(struct pfr_ktable *, 152 1.3.2.2 skrll struct pfr_kentryworkq *, long); 153 1.3.2.2 skrll void pfr_remove_kentries(struct pfr_ktable *, 154 1.3.2.2 skrll struct pfr_kentryworkq *); 155 1.3.2.2 skrll void pfr_clstats_kentries(struct pfr_kentryworkq *, long, 156 1.3.2.2 skrll int); 157 1.3.2.2 skrll void pfr_reset_feedback(struct pfr_addr *, int, int); 158 1.3.2.2 skrll void pfr_prepare_network(union sockaddr_union *, int, int); 159 1.3.2.2 skrll int pfr_route_kentry(struct pfr_ktable *, 160 1.3.2.2 skrll struct pfr_kentry *); 161 1.3.2.2 skrll int pfr_unroute_kentry(struct pfr_ktable *, 162 1.3.2.2 skrll struct pfr_kentry *); 163 1.3.2.2 skrll int pfr_walktree(struct radix_node *, void *); 164 1.3.2.2 skrll int pfr_validate_table(struct pfr_table *, int, int); 165 1.3.2.2 skrll void pfr_commit_ktable(struct pfr_ktable *, long); 166 1.3.2.2 skrll void pfr_insert_ktables(struct pfr_ktableworkq *); 167 1.3.2.2 skrll void pfr_insert_ktable(struct pfr_ktable *); 168 1.3.2.2 skrll void pfr_setflags_ktables(struct pfr_ktableworkq *); 169 1.3.2.2 skrll void pfr_setflags_ktable(struct pfr_ktable *, int); 170 1.3.2.2 skrll void pfr_clstats_ktables(struct pfr_ktableworkq *, long, 171 1.3.2.2 skrll int); 172 1.3.2.2 skrll void pfr_clstats_ktable(struct pfr_ktable *, long, int); 173 1.3.2.2 skrll struct pfr_ktable *pfr_create_ktable(struct pfr_table *, long, int); 174 1.3.2.2 skrll void pfr_destroy_ktables(struct pfr_ktableworkq *, int); 175 1.3.2.2 skrll void pfr_destroy_ktable(struct pfr_ktable *, int); 176 1.3.2.2 skrll int pfr_ktable_compare(struct pfr_ktable *, 177 1.3.2.2 skrll struct pfr_ktable *); 178 1.3.2.2 skrll struct pfr_ktable *pfr_lookup_table(struct pfr_table *); 179 1.3.2.2 skrll void pfr_clean_node_mask(struct pfr_ktable *, 180 1.3.2.2 skrll struct pfr_kentryworkq *); 181 1.3.2.2 skrll int pfr_table_count(struct pfr_table *, int); 182 1.3.2.2 skrll int pfr_skip_table(struct pfr_table *, 183 1.3.2.2 skrll struct pfr_ktable *, int); 184 1.3.2.2 skrll struct pfr_kentry *pfr_kentry_byidx(struct pfr_ktable *, int, int); 185 1.3.2.2 skrll 186 1.3.2.2 skrll RB_PROTOTYPE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare); 187 1.3.2.2 skrll RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare); 188 1.3.2.2 skrll 189 1.3.2.2 skrll struct pfr_ktablehead pfr_ktables; 190 1.3.2.2 skrll struct pfr_table pfr_nulltable; 191 1.3.2.2 skrll int pfr_ktable_cnt; 192 1.3.2.2 skrll 193 1.3.2.2 skrll void 194 1.3.2.2 skrll pfr_initialize(void) 195 1.3.2.2 skrll { 196 1.3.2.2 skrll pool_init(&pfr_ktable_pl, sizeof(struct pfr_ktable), 0, 0, 0, 197 1.3.2.2 skrll "pfrktable", NULL); 198 1.3.2.2 skrll pool_init(&pfr_kentry_pl, sizeof(struct pfr_kentry), 0, 0, 0, 199 1.3.2.2 skrll "pfrkentry", NULL); 200 1.3.2.2 skrll 201 1.3.2.2 skrll pfr_sin.sin_len = sizeof(pfr_sin); 202 1.3.2.2 skrll pfr_sin.sin_family = AF_INET; 203 1.3.2.2 skrll pfr_sin6.sin6_len = sizeof(pfr_sin6); 204 1.3.2.2 skrll pfr_sin6.sin6_family = AF_INET6; 205 1.3.2.2 skrll 206 1.3.2.2 skrll memset(&pfr_ffaddr, 0xff, sizeof(pfr_ffaddr)); 207 1.3.2.2 skrll } 208 1.3.2.2 skrll 209 1.3.2.2 skrll #ifdef _LKM 210 1.3.2.2 skrll void 211 1.3.2.2 skrll pfr_destroy(void) 212 1.3.2.2 skrll { 213 1.3.2.2 skrll pool_destroy(&pfr_ktable_pl); 214 1.3.2.2 skrll pool_destroy(&pfr_kentry_pl); 215 1.3.2.2 skrll } 216 1.3.2.2 skrll #endif 217 1.3.2.2 skrll 218 1.3.2.2 skrll int 219 1.3.2.2 skrll pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags) 220 1.3.2.2 skrll { 221 1.3.2.2 skrll struct pfr_ktable *kt; 222 1.3.2.2 skrll struct pfr_kentryworkq workq; 223 1.3.2.2 skrll int s = 0; 224 1.3.2.2 skrll 225 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY); 226 1.3.2.2 skrll if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL)) 227 1.3.2.2 skrll return (EINVAL); 228 1.3.2.2 skrll kt = pfr_lookup_table(tbl); 229 1.3.2.2 skrll if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 230 1.3.2.2 skrll return (ESRCH); 231 1.3.2.2 skrll if (kt->pfrkt_flags & PFR_TFLAG_CONST) 232 1.3.2.2 skrll return (EPERM); 233 1.3.2.2 skrll pfr_enqueue_addrs(kt, &workq, ndel, 0); 234 1.3.2.2 skrll 235 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 236 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 237 1.3.2.2 skrll s = splsoftnet(); 238 1.3.2.2 skrll pfr_remove_kentries(kt, &workq); 239 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 240 1.3.2.2 skrll splx(s); 241 1.3.2.2 skrll if (kt->pfrkt_cnt) { 242 1.3.2.2 skrll printf("pfr_clr_addrs: corruption detected (%d).\n", 243 1.3.2.2 skrll kt->pfrkt_cnt); 244 1.3.2.2 skrll kt->pfrkt_cnt = 0; 245 1.3.2.2 skrll } 246 1.3.2.2 skrll } 247 1.3.2.2 skrll return (0); 248 1.3.2.2 skrll } 249 1.3.2.2 skrll 250 1.3.2.2 skrll int 251 1.3.2.2 skrll pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size, 252 1.3.2.2 skrll int *nadd, int flags) 253 1.3.2.2 skrll { 254 1.3.2.2 skrll struct pfr_ktable *kt, *tmpkt; 255 1.3.2.2 skrll struct pfr_kentryworkq workq; 256 1.3.2.2 skrll struct pfr_kentry *p, *q; 257 1.3.2.2 skrll struct pfr_addr ad; 258 1.3.2.2 skrll int i, rv, s = 0, xadd = 0; 259 1.3.2.2 skrll long tzero = time.tv_sec; 260 1.3.2.2 skrll 261 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_FEEDBACK); 262 1.3.2.2 skrll if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL)) 263 1.3.2.2 skrll return (EINVAL); 264 1.3.2.2 skrll kt = pfr_lookup_table(tbl); 265 1.3.2.2 skrll if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 266 1.3.2.2 skrll return (ESRCH); 267 1.3.2.2 skrll if (kt->pfrkt_flags & PFR_TFLAG_CONST) 268 1.3.2.2 skrll return (EPERM); 269 1.3.2.2 skrll tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0); 270 1.3.2.2 skrll if (tmpkt == NULL) 271 1.3.2.2 skrll return (ENOMEM); 272 1.3.2.2 skrll SLIST_INIT(&workq); 273 1.3.2.2 skrll for (i = 0; i < size; i++) { 274 1.3.2.2 skrll if (COPYIN(addr+i, &ad, sizeof(ad))) 275 1.3.2.2 skrll senderr(EFAULT); 276 1.3.2.2 skrll if (pfr_validate_addr(&ad)) 277 1.3.2.2 skrll senderr(EINVAL); 278 1.3.2.2 skrll p = pfr_lookup_addr(kt, &ad, 1); 279 1.3.2.2 skrll q = pfr_lookup_addr(tmpkt, &ad, 1); 280 1.3.2.2 skrll if (flags & PFR_FLAG_FEEDBACK) { 281 1.3.2.2 skrll if (q != NULL) 282 1.3.2.2 skrll ad.pfra_fback = PFR_FB_DUPLICATE; 283 1.3.2.2 skrll else if (p == NULL) 284 1.3.2.2 skrll ad.pfra_fback = PFR_FB_ADDED; 285 1.3.2.2 skrll else if (p->pfrke_not != ad.pfra_not) 286 1.3.2.2 skrll ad.pfra_fback = PFR_FB_CONFLICT; 287 1.3.2.2 skrll else 288 1.3.2.2 skrll ad.pfra_fback = PFR_FB_NONE; 289 1.3.2.2 skrll } 290 1.3.2.2 skrll if (p == NULL && q == NULL) { 291 1.3.2.2 skrll p = pfr_create_kentry(&ad); 292 1.3.2.2 skrll if (p == NULL) 293 1.3.2.2 skrll senderr(ENOMEM); 294 1.3.2.2 skrll if (pfr_route_kentry(tmpkt, p)) { 295 1.3.2.2 skrll pfr_destroy_kentry(p); 296 1.3.2.2 skrll ad.pfra_fback = PFR_FB_NONE; 297 1.3.2.2 skrll } else { 298 1.3.2.2 skrll SLIST_INSERT_HEAD(&workq, p, pfrke_workq); 299 1.3.2.2 skrll xadd++; 300 1.3.2.2 skrll } 301 1.3.2.2 skrll } 302 1.3.2.2 skrll if (flags & PFR_FLAG_FEEDBACK) 303 1.3.2.2 skrll if (COPYOUT(&ad, addr+i, sizeof(ad))) 304 1.3.2.2 skrll senderr(EFAULT); 305 1.3.2.2 skrll } 306 1.3.2.2 skrll pfr_clean_node_mask(tmpkt, &workq); 307 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 308 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 309 1.3.2.2 skrll s = splsoftnet(); 310 1.3.2.2 skrll pfr_insert_kentries(kt, &workq, tzero); 311 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 312 1.3.2.2 skrll splx(s); 313 1.3.2.2 skrll } else 314 1.3.2.2 skrll pfr_destroy_kentries(&workq); 315 1.3.2.2 skrll if (nadd != NULL) 316 1.3.2.2 skrll *nadd = xadd; 317 1.3.2.2 skrll pfr_destroy_ktable(tmpkt, 0); 318 1.3.2.2 skrll return (0); 319 1.3.2.2 skrll _bad: 320 1.3.2.2 skrll pfr_clean_node_mask(tmpkt, &workq); 321 1.3.2.2 skrll pfr_destroy_kentries(&workq); 322 1.3.2.2 skrll if (flags & PFR_FLAG_FEEDBACK) 323 1.3.2.2 skrll pfr_reset_feedback(addr, size, flags); 324 1.3.2.2 skrll pfr_destroy_ktable(tmpkt, 0); 325 1.3.2.2 skrll return (rv); 326 1.3.2.2 skrll } 327 1.3.2.2 skrll 328 1.3.2.2 skrll int 329 1.3.2.2 skrll pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size, 330 1.3.2.2 skrll int *ndel, int flags) 331 1.3.2.2 skrll { 332 1.3.2.2 skrll struct pfr_ktable *kt; 333 1.3.2.2 skrll struct pfr_kentryworkq workq; 334 1.3.2.2 skrll struct pfr_kentry *p; 335 1.3.2.2 skrll struct pfr_addr ad; 336 1.3.2.2 skrll int i, rv, s = 0, xdel = 0; 337 1.3.2.2 skrll 338 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_FEEDBACK); 339 1.3.2.2 skrll if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL)) 340 1.3.2.2 skrll return (EINVAL); 341 1.3.2.2 skrll kt = pfr_lookup_table(tbl); 342 1.3.2.2 skrll if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 343 1.3.2.2 skrll return (ESRCH); 344 1.3.2.2 skrll if (kt->pfrkt_flags & PFR_TFLAG_CONST) 345 1.3.2.2 skrll return (EPERM); 346 1.3.2.2 skrll pfr_mark_addrs(kt); 347 1.3.2.2 skrll SLIST_INIT(&workq); 348 1.3.2.2 skrll for (i = 0; i < size; i++) { 349 1.3.2.2 skrll if (COPYIN(addr+i, &ad, sizeof(ad))) 350 1.3.2.2 skrll senderr(EFAULT); 351 1.3.2.2 skrll if (pfr_validate_addr(&ad)) 352 1.3.2.2 skrll senderr(EINVAL); 353 1.3.2.2 skrll p = pfr_lookup_addr(kt, &ad, 1); 354 1.3.2.2 skrll if (flags & PFR_FLAG_FEEDBACK) { 355 1.3.2.2 skrll if (p == NULL) 356 1.3.2.2 skrll ad.pfra_fback = PFR_FB_NONE; 357 1.3.2.2 skrll else if (p->pfrke_not != ad.pfra_not) 358 1.3.2.2 skrll ad.pfra_fback = PFR_FB_CONFLICT; 359 1.3.2.2 skrll else if (p->pfrke_mark) 360 1.3.2.2 skrll ad.pfra_fback = PFR_FB_DUPLICATE; 361 1.3.2.2 skrll else 362 1.3.2.2 skrll ad.pfra_fback = PFR_FB_DELETED; 363 1.3.2.2 skrll } 364 1.3.2.2 skrll if (p != NULL && p->pfrke_not == ad.pfra_not && 365 1.3.2.2 skrll !p->pfrke_mark) { 366 1.3.2.2 skrll p->pfrke_mark = 1; 367 1.3.2.2 skrll SLIST_INSERT_HEAD(&workq, p, pfrke_workq); 368 1.3.2.2 skrll xdel++; 369 1.3.2.2 skrll } 370 1.3.2.2 skrll if (flags & PFR_FLAG_FEEDBACK) 371 1.3.2.2 skrll if (COPYOUT(&ad, addr+i, sizeof(ad))) 372 1.3.2.2 skrll senderr(EFAULT); 373 1.3.2.2 skrll } 374 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 375 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 376 1.3.2.2 skrll s = splsoftnet(); 377 1.3.2.2 skrll pfr_remove_kentries(kt, &workq); 378 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 379 1.3.2.2 skrll splx(s); 380 1.3.2.2 skrll } 381 1.3.2.2 skrll if (ndel != NULL) 382 1.3.2.2 skrll *ndel = xdel; 383 1.3.2.2 skrll return (0); 384 1.3.2.2 skrll _bad: 385 1.3.2.2 skrll if (flags & PFR_FLAG_FEEDBACK) 386 1.3.2.2 skrll pfr_reset_feedback(addr, size, flags); 387 1.3.2.2 skrll return (rv); 388 1.3.2.2 skrll } 389 1.3.2.2 skrll 390 1.3.2.2 skrll int 391 1.3.2.2 skrll pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size, 392 1.3.2.2 skrll int *size2, int *nadd, int *ndel, int *nchange, int flags) 393 1.3.2.2 skrll { 394 1.3.2.2 skrll struct pfr_ktable *kt, *tmpkt; 395 1.3.2.2 skrll struct pfr_kentryworkq addq, delq, changeq; 396 1.3.2.2 skrll struct pfr_kentry *p, *q; 397 1.3.2.2 skrll struct pfr_addr ad; 398 1.3.2.2 skrll int i, rv, s = 0, xadd = 0, xdel = 0, xchange = 0; 399 1.3.2.2 skrll long tzero = time.tv_sec; 400 1.3.2.2 skrll 401 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_FEEDBACK); 402 1.3.2.2 skrll if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL)) 403 1.3.2.2 skrll return (EINVAL); 404 1.3.2.2 skrll kt = pfr_lookup_table(tbl); 405 1.3.2.2 skrll if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 406 1.3.2.2 skrll return (ESRCH); 407 1.3.2.2 skrll if (kt->pfrkt_flags & PFR_TFLAG_CONST) 408 1.3.2.2 skrll return (EPERM); 409 1.3.2.2 skrll tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0); 410 1.3.2.2 skrll if (tmpkt == NULL) 411 1.3.2.2 skrll return (ENOMEM); 412 1.3.2.2 skrll pfr_mark_addrs(kt); 413 1.3.2.2 skrll SLIST_INIT(&addq); 414 1.3.2.2 skrll SLIST_INIT(&delq); 415 1.3.2.2 skrll SLIST_INIT(&changeq); 416 1.3.2.2 skrll for (i = 0; i < size; i++) { 417 1.3.2.2 skrll if (COPYIN(addr+i, &ad, sizeof(ad))) 418 1.3.2.2 skrll senderr(EFAULT); 419 1.3.2.2 skrll if (pfr_validate_addr(&ad)) 420 1.3.2.2 skrll senderr(EINVAL); 421 1.3.2.2 skrll ad.pfra_fback = PFR_FB_NONE; 422 1.3.2.2 skrll p = pfr_lookup_addr(kt, &ad, 1); 423 1.3.2.2 skrll if (p != NULL) { 424 1.3.2.2 skrll if (p->pfrke_mark) { 425 1.3.2.2 skrll ad.pfra_fback = PFR_FB_DUPLICATE; 426 1.3.2.2 skrll goto _skip; 427 1.3.2.2 skrll } 428 1.3.2.2 skrll p->pfrke_mark = 1; 429 1.3.2.2 skrll if (p->pfrke_not != ad.pfra_not) { 430 1.3.2.2 skrll SLIST_INSERT_HEAD(&changeq, p, pfrke_workq); 431 1.3.2.2 skrll ad.pfra_fback = PFR_FB_CHANGED; 432 1.3.2.2 skrll xchange++; 433 1.3.2.2 skrll } 434 1.3.2.2 skrll } else { 435 1.3.2.2 skrll q = pfr_lookup_addr(tmpkt, &ad, 1); 436 1.3.2.2 skrll if (q != NULL) { 437 1.3.2.2 skrll ad.pfra_fback = PFR_FB_DUPLICATE; 438 1.3.2.2 skrll goto _skip; 439 1.3.2.2 skrll } 440 1.3.2.2 skrll p = pfr_create_kentry(&ad); 441 1.3.2.2 skrll if (p == NULL) 442 1.3.2.2 skrll senderr(ENOMEM); 443 1.3.2.2 skrll if (pfr_route_kentry(tmpkt, p)) { 444 1.3.2.2 skrll pfr_destroy_kentry(p); 445 1.3.2.2 skrll ad.pfra_fback = PFR_FB_NONE; 446 1.3.2.2 skrll } else { 447 1.3.2.2 skrll SLIST_INSERT_HEAD(&addq, p, pfrke_workq); 448 1.3.2.2 skrll ad.pfra_fback = PFR_FB_ADDED; 449 1.3.2.2 skrll xadd++; 450 1.3.2.2 skrll } 451 1.3.2.2 skrll } 452 1.3.2.2 skrll _skip: 453 1.3.2.2 skrll if (flags & PFR_FLAG_FEEDBACK) 454 1.3.2.2 skrll if (COPYOUT(&ad, addr+i, sizeof(ad))) 455 1.3.2.2 skrll senderr(EFAULT); 456 1.3.2.2 skrll } 457 1.3.2.2 skrll pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY); 458 1.3.2.2 skrll if ((flags & PFR_FLAG_FEEDBACK) && *size2) { 459 1.3.2.2 skrll if (*size2 < size+xdel) { 460 1.3.2.2 skrll *size2 = size+xdel; 461 1.3.2.2 skrll senderr(0); 462 1.3.2.2 skrll } 463 1.3.2.2 skrll i = 0; 464 1.3.2.2 skrll SLIST_FOREACH(p, &delq, pfrke_workq) { 465 1.3.2.2 skrll pfr_copyout_addr(&ad, p); 466 1.3.2.2 skrll ad.pfra_fback = PFR_FB_DELETED; 467 1.3.2.2 skrll if (COPYOUT(&ad, addr+size+i, sizeof(ad))) 468 1.3.2.2 skrll senderr(EFAULT); 469 1.3.2.2 skrll i++; 470 1.3.2.2 skrll } 471 1.3.2.2 skrll } 472 1.3.2.2 skrll pfr_clean_node_mask(tmpkt, &addq); 473 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 474 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 475 1.3.2.2 skrll s = splsoftnet(); 476 1.3.2.2 skrll pfr_insert_kentries(kt, &addq, tzero); 477 1.3.2.2 skrll pfr_remove_kentries(kt, &delq); 478 1.3.2.2 skrll pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG); 479 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 480 1.3.2.2 skrll splx(s); 481 1.3.2.2 skrll } else 482 1.3.2.2 skrll pfr_destroy_kentries(&addq); 483 1.3.2.2 skrll if (nadd != NULL) 484 1.3.2.2 skrll *nadd = xadd; 485 1.3.2.2 skrll if (ndel != NULL) 486 1.3.2.2 skrll *ndel = xdel; 487 1.3.2.2 skrll if (nchange != NULL) 488 1.3.2.2 skrll *nchange = xchange; 489 1.3.2.2 skrll if ((flags & PFR_FLAG_FEEDBACK) && size2) 490 1.3.2.2 skrll *size2 = size+xdel; 491 1.3.2.2 skrll pfr_destroy_ktable(tmpkt, 0); 492 1.3.2.2 skrll return (0); 493 1.3.2.2 skrll _bad: 494 1.3.2.2 skrll pfr_clean_node_mask(tmpkt, &addq); 495 1.3.2.2 skrll pfr_destroy_kentries(&addq); 496 1.3.2.2 skrll if (flags & PFR_FLAG_FEEDBACK) 497 1.3.2.2 skrll pfr_reset_feedback(addr, size, flags); 498 1.3.2.2 skrll pfr_destroy_ktable(tmpkt, 0); 499 1.3.2.2 skrll return (rv); 500 1.3.2.2 skrll } 501 1.3.2.2 skrll 502 1.3.2.2 skrll int 503 1.3.2.2 skrll pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size, 504 1.3.2.2 skrll int *nmatch, int flags) 505 1.3.2.2 skrll { 506 1.3.2.2 skrll struct pfr_ktable *kt; 507 1.3.2.2 skrll struct pfr_kentry *p; 508 1.3.2.2 skrll struct pfr_addr ad; 509 1.3.2.2 skrll int i, xmatch = 0; 510 1.3.2.2 skrll 511 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_REPLACE); 512 1.3.2.2 skrll if (pfr_validate_table(tbl, 0, 0)) 513 1.3.2.2 skrll return (EINVAL); 514 1.3.2.2 skrll kt = pfr_lookup_table(tbl); 515 1.3.2.2 skrll if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 516 1.3.2.2 skrll return (ESRCH); 517 1.3.2.2 skrll 518 1.3.2.2 skrll for (i = 0; i < size; i++) { 519 1.3.2.2 skrll if (COPYIN(addr+i, &ad, sizeof(ad))) 520 1.3.2.2 skrll return (EFAULT); 521 1.3.2.2 skrll if (pfr_validate_addr(&ad)) 522 1.3.2.2 skrll return (EINVAL); 523 1.3.2.2 skrll if (ADDR_NETWORK(&ad)) 524 1.3.2.2 skrll return (EINVAL); 525 1.3.2.2 skrll p = pfr_lookup_addr(kt, &ad, 0); 526 1.3.2.2 skrll if (flags & PFR_FLAG_REPLACE) 527 1.3.2.2 skrll pfr_copyout_addr(&ad, p); 528 1.3.2.2 skrll ad.pfra_fback = (p == NULL) ? PFR_FB_NONE : 529 1.3.2.2 skrll (p->pfrke_not ? PFR_FB_NOTMATCH : PFR_FB_MATCH); 530 1.3.2.2 skrll if (p != NULL && !p->pfrke_not) 531 1.3.2.2 skrll xmatch++; 532 1.3.2.2 skrll if (COPYOUT(&ad, addr+i, sizeof(ad))) 533 1.3.2.2 skrll return (EFAULT); 534 1.3.2.2 skrll } 535 1.3.2.2 skrll if (nmatch != NULL) 536 1.3.2.2 skrll *nmatch = xmatch; 537 1.3.2.2 skrll return (0); 538 1.3.2.2 skrll } 539 1.3.2.2 skrll 540 1.3.2.2 skrll int 541 1.3.2.2 skrll pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size, 542 1.3.2.2 skrll int flags) 543 1.3.2.2 skrll { 544 1.3.2.2 skrll struct pfr_ktable *kt; 545 1.3.2.2 skrll struct pfr_walktree w; 546 1.3.2.2 skrll int rv; 547 1.3.2.2 skrll 548 1.3.2.2 skrll ACCEPT_FLAGS(0); 549 1.3.2.2 skrll if (pfr_validate_table(tbl, 0, 0)) 550 1.3.2.2 skrll return (EINVAL); 551 1.3.2.2 skrll kt = pfr_lookup_table(tbl); 552 1.3.2.2 skrll if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 553 1.3.2.2 skrll return (ESRCH); 554 1.3.2.2 skrll if (kt->pfrkt_cnt > *size) { 555 1.3.2.2 skrll *size = kt->pfrkt_cnt; 556 1.3.2.2 skrll return (0); 557 1.3.2.2 skrll } 558 1.3.2.2 skrll 559 1.3.2.2 skrll bzero(&w, sizeof(w)); 560 1.3.2.2 skrll w.pfrw_op = PFRW_GET_ADDRS; 561 1.3.2.2 skrll w.pfrw_addr = addr; 562 1.3.2.2 skrll w.pfrw_free = kt->pfrkt_cnt; 563 1.3.2.2 skrll w.pfrw_flags = flags; 564 1.3.2.2 skrll rv = rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w); 565 1.3.2.2 skrll if (!rv) 566 1.3.2.2 skrll rv = rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w); 567 1.3.2.2 skrll if (rv) 568 1.3.2.2 skrll return (rv); 569 1.3.2.2 skrll 570 1.3.2.2 skrll if (w.pfrw_free) { 571 1.3.2.2 skrll printf("pfr_get_addrs: corruption detected (%d).\n", 572 1.3.2.2 skrll w.pfrw_free); 573 1.3.2.2 skrll return (ENOTTY); 574 1.3.2.2 skrll } 575 1.3.2.2 skrll *size = kt->pfrkt_cnt; 576 1.3.2.2 skrll return (0); 577 1.3.2.2 skrll } 578 1.3.2.2 skrll 579 1.3.2.2 skrll int 580 1.3.2.2 skrll pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size, 581 1.3.2.2 skrll int flags) 582 1.3.2.2 skrll { 583 1.3.2.2 skrll struct pfr_ktable *kt; 584 1.3.2.2 skrll struct pfr_walktree w; 585 1.3.2.2 skrll struct pfr_kentryworkq workq; 586 1.3.2.2 skrll int rv, s = 0; 587 1.3.2.2 skrll long tzero = time.tv_sec; 588 1.3.2.2 skrll 589 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC); /* XXX PFR_FLAG_CLSTATS disabled */ 590 1.3.2.2 skrll if (pfr_validate_table(tbl, 0, 0)) 591 1.3.2.2 skrll return (EINVAL); 592 1.3.2.2 skrll kt = pfr_lookup_table(tbl); 593 1.3.2.2 skrll if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 594 1.3.2.2 skrll return (ESRCH); 595 1.3.2.2 skrll if (kt->pfrkt_cnt > *size) { 596 1.3.2.2 skrll *size = kt->pfrkt_cnt; 597 1.3.2.2 skrll return (0); 598 1.3.2.2 skrll } 599 1.3.2.2 skrll 600 1.3.2.2 skrll bzero(&w, sizeof(w)); 601 1.3.2.2 skrll w.pfrw_op = PFRW_GET_ASTATS; 602 1.3.2.2 skrll w.pfrw_astats = addr; 603 1.3.2.2 skrll w.pfrw_free = kt->pfrkt_cnt; 604 1.3.2.2 skrll w.pfrw_flags = flags; 605 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 606 1.3.2.2 skrll s = splsoftnet(); 607 1.3.2.2 skrll rv = rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w); 608 1.3.2.2 skrll if (!rv) 609 1.3.2.2 skrll rv = rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w); 610 1.3.2.2 skrll if (!rv && (flags & PFR_FLAG_CLSTATS)) { 611 1.3.2.2 skrll pfr_enqueue_addrs(kt, &workq, NULL, 0); 612 1.3.2.2 skrll pfr_clstats_kentries(&workq, tzero, 0); 613 1.3.2.2 skrll } 614 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 615 1.3.2.2 skrll splx(s); 616 1.3.2.2 skrll if (rv) 617 1.3.2.2 skrll return (rv); 618 1.3.2.2 skrll 619 1.3.2.2 skrll if (w.pfrw_free) { 620 1.3.2.2 skrll printf("pfr_get_astats: corruption detected (%d).\n", 621 1.3.2.2 skrll w.pfrw_free); 622 1.3.2.2 skrll return (ENOTTY); 623 1.3.2.2 skrll } 624 1.3.2.2 skrll *size = kt->pfrkt_cnt; 625 1.3.2.2 skrll return (0); 626 1.3.2.2 skrll } 627 1.3.2.2 skrll 628 1.3.2.2 skrll int 629 1.3.2.2 skrll pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size, 630 1.3.2.2 skrll int *nzero, int flags) 631 1.3.2.2 skrll { 632 1.3.2.2 skrll struct pfr_ktable *kt; 633 1.3.2.2 skrll struct pfr_kentryworkq workq; 634 1.3.2.2 skrll struct pfr_kentry *p; 635 1.3.2.2 skrll struct pfr_addr ad; 636 1.3.2.2 skrll int i, rv, s = 0, xzero = 0; 637 1.3.2.2 skrll 638 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_FEEDBACK); 639 1.3.2.2 skrll if (pfr_validate_table(tbl, 0, 0)) 640 1.3.2.2 skrll return (EINVAL); 641 1.3.2.2 skrll kt = pfr_lookup_table(tbl); 642 1.3.2.2 skrll if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 643 1.3.2.2 skrll return (ESRCH); 644 1.3.2.2 skrll SLIST_INIT(&workq); 645 1.3.2.2 skrll for (i = 0; i < size; i++) { 646 1.3.2.2 skrll if (COPYIN(addr+i, &ad, sizeof(ad))) 647 1.3.2.2 skrll senderr(EFAULT); 648 1.3.2.2 skrll if (pfr_validate_addr(&ad)) 649 1.3.2.2 skrll senderr(EINVAL); 650 1.3.2.2 skrll p = pfr_lookup_addr(kt, &ad, 1); 651 1.3.2.2 skrll if (flags & PFR_FLAG_FEEDBACK) { 652 1.3.2.2 skrll ad.pfra_fback = (p != NULL) ? 653 1.3.2.2 skrll PFR_FB_CLEARED : PFR_FB_NONE; 654 1.3.2.2 skrll if (COPYOUT(&ad, addr+i, sizeof(ad))) 655 1.3.2.2 skrll senderr(EFAULT); 656 1.3.2.2 skrll } 657 1.3.2.2 skrll if (p != NULL) { 658 1.3.2.2 skrll SLIST_INSERT_HEAD(&workq, p, pfrke_workq); 659 1.3.2.2 skrll xzero++; 660 1.3.2.2 skrll } 661 1.3.2.2 skrll } 662 1.3.2.2 skrll 663 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 664 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 665 1.3.2.2 skrll s = splsoftnet(); 666 1.3.2.2 skrll pfr_clstats_kentries(&workq, 0, 0); 667 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 668 1.3.2.2 skrll splx(s); 669 1.3.2.2 skrll } 670 1.3.2.2 skrll if (nzero != NULL) 671 1.3.2.2 skrll *nzero = xzero; 672 1.3.2.2 skrll return (0); 673 1.3.2.2 skrll _bad: 674 1.3.2.2 skrll if (flags & PFR_FLAG_FEEDBACK) 675 1.3.2.2 skrll pfr_reset_feedback(addr, size, flags); 676 1.3.2.2 skrll return (rv); 677 1.3.2.2 skrll } 678 1.3.2.2 skrll 679 1.3.2.2 skrll int 680 1.3.2.2 skrll pfr_validate_addr(struct pfr_addr *ad) 681 1.3.2.2 skrll { 682 1.3.2.2 skrll int i; 683 1.3.2.2 skrll 684 1.3.2.2 skrll switch (ad->pfra_af) { 685 1.3.2.2 skrll case AF_INET: 686 1.3.2.2 skrll if (ad->pfra_net > 32) 687 1.3.2.2 skrll return (-1); 688 1.3.2.2 skrll break; 689 1.3.2.2 skrll case AF_INET6: 690 1.3.2.2 skrll if (ad->pfra_net > 128) 691 1.3.2.2 skrll return (-1); 692 1.3.2.2 skrll break; 693 1.3.2.2 skrll default: 694 1.3.2.2 skrll return (-1); 695 1.3.2.2 skrll } 696 1.3.2.2 skrll if (ad->pfra_net < 128 && 697 1.3.2.2 skrll (((caddr_t)ad)[ad->pfra_net/8] & (0xFF >> (ad->pfra_net%8)))) 698 1.3.2.2 skrll return (-1); 699 1.3.2.2 skrll for (i = (ad->pfra_net+7)/8; i < sizeof(ad->pfra_u); i++) 700 1.3.2.2 skrll if (((caddr_t)ad)[i]) 701 1.3.2.2 skrll return (-1); 702 1.3.2.2 skrll if (ad->pfra_not && ad->pfra_not != 1) 703 1.3.2.2 skrll return (-1); 704 1.3.2.2 skrll if (ad->pfra_fback) 705 1.3.2.2 skrll return (-1); 706 1.3.2.2 skrll return (0); 707 1.3.2.2 skrll } 708 1.3.2.2 skrll 709 1.3.2.2 skrll void 710 1.3.2.2 skrll pfr_enqueue_addrs(struct pfr_ktable *kt, struct pfr_kentryworkq *workq, 711 1.3.2.2 skrll int *naddr, int sweep) 712 1.3.2.2 skrll { 713 1.3.2.2 skrll struct pfr_walktree w; 714 1.3.2.2 skrll 715 1.3.2.2 skrll SLIST_INIT(workq); 716 1.3.2.2 skrll bzero(&w, sizeof(w)); 717 1.3.2.2 skrll w.pfrw_op = sweep ? PFRW_SWEEP : PFRW_ENQUEUE; 718 1.3.2.2 skrll w.pfrw_workq = workq; 719 1.3.2.2 skrll if (kt->pfrkt_ip4 != NULL) 720 1.3.2.2 skrll if (rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w)) 721 1.3.2.2 skrll printf("pfr_enqueue_addrs: IPv4 walktree failed.\n"); 722 1.3.2.2 skrll if (kt->pfrkt_ip6 != NULL) 723 1.3.2.2 skrll if (rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w)) 724 1.3.2.2 skrll printf("pfr_enqueue_addrs: IPv6 walktree failed.\n"); 725 1.3.2.2 skrll if (naddr != NULL) 726 1.3.2.2 skrll *naddr = w.pfrw_cnt; 727 1.3.2.2 skrll } 728 1.3.2.2 skrll 729 1.3.2.2 skrll void 730 1.3.2.2 skrll pfr_mark_addrs(struct pfr_ktable *kt) 731 1.3.2.2 skrll { 732 1.3.2.2 skrll struct pfr_walktree w; 733 1.3.2.2 skrll 734 1.3.2.2 skrll bzero(&w, sizeof(w)); 735 1.3.2.2 skrll w.pfrw_op = PFRW_MARK; 736 1.3.2.2 skrll if (rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w)) 737 1.3.2.2 skrll printf("pfr_mark_addrs: IPv4 walktree failed.\n"); 738 1.3.2.2 skrll if (rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w)) 739 1.3.2.2 skrll printf("pfr_mark_addrs: IPv6 walktree failed.\n"); 740 1.3.2.2 skrll } 741 1.3.2.2 skrll 742 1.3.2.2 skrll 743 1.3.2.2 skrll struct pfr_kentry * 744 1.3.2.2 skrll pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact) 745 1.3.2.2 skrll { 746 1.3.2.2 skrll union sockaddr_union sa, mask; 747 1.3.2.2 skrll struct radix_node_head *head; 748 1.3.2.2 skrll struct pfr_kentry *ke; 749 1.3.2.2 skrll int s; 750 1.3.2.2 skrll 751 1.3.2.2 skrll bzero(&sa, sizeof(sa)); 752 1.3.2.2 skrll if (ad->pfra_af == AF_INET) { 753 1.3.2.2 skrll FILLIN_SIN(sa.sin, ad->pfra_ip4addr); 754 1.3.2.2 skrll head = kt->pfrkt_ip4; 755 1.3.2.2 skrll } else { 756 1.3.2.2 skrll FILLIN_SIN6(sa.sin6, ad->pfra_ip6addr); 757 1.3.2.2 skrll head = kt->pfrkt_ip6; 758 1.3.2.2 skrll } 759 1.3.2.2 skrll if (ADDR_NETWORK(ad)) { 760 1.3.2.2 skrll pfr_prepare_network(&mask, ad->pfra_af, ad->pfra_net); 761 1.3.2.2 skrll s = splsoftnet(); /* rn_lookup makes use of globals */ 762 1.3.2.2 skrll ke = (struct pfr_kentry *)rn_lookup(&sa, &mask, head); 763 1.3.2.2 skrll splx(s); 764 1.3.2.2 skrll if (ke && KENTRY_RNF_ROOT(ke)) 765 1.3.2.2 skrll ke = NULL; 766 1.3.2.2 skrll } else { 767 1.3.2.2 skrll ke = (struct pfr_kentry *)rn_match(&sa, head); 768 1.3.2.2 skrll if (ke && KENTRY_RNF_ROOT(ke)) 769 1.3.2.2 skrll ke = NULL; 770 1.3.2.2 skrll if (exact && ke && KENTRY_NETWORK(ke)) 771 1.3.2.2 skrll ke = NULL; 772 1.3.2.2 skrll } 773 1.3.2.2 skrll return (ke); 774 1.3.2.2 skrll } 775 1.3.2.2 skrll 776 1.3.2.2 skrll struct pfr_kentry * 777 1.3.2.2 skrll pfr_create_kentry(struct pfr_addr *ad) 778 1.3.2.2 skrll { 779 1.3.2.2 skrll struct pfr_kentry *ke; 780 1.3.2.2 skrll 781 1.3.2.2 skrll ke = pool_get(&pfr_kentry_pl, PR_NOWAIT); 782 1.3.2.2 skrll if (ke == NULL) 783 1.3.2.2 skrll return (NULL); 784 1.3.2.2 skrll bzero(ke, sizeof(*ke)); 785 1.3.2.2 skrll 786 1.3.2.2 skrll if (ad->pfra_af == AF_INET) 787 1.3.2.2 skrll FILLIN_SIN(ke->pfrke_sa.sin, ad->pfra_ip4addr); 788 1.3.2.2 skrll else 789 1.3.2.2 skrll FILLIN_SIN6(ke->pfrke_sa.sin6, ad->pfra_ip6addr); 790 1.3.2.2 skrll ke->pfrke_af = ad->pfra_af; 791 1.3.2.2 skrll ke->pfrke_net = ad->pfra_net; 792 1.3.2.2 skrll ke->pfrke_not = ad->pfra_not; 793 1.3.2.2 skrll return (ke); 794 1.3.2.2 skrll } 795 1.3.2.2 skrll 796 1.3.2.2 skrll void 797 1.3.2.2 skrll pfr_destroy_kentries(struct pfr_kentryworkq *workq) 798 1.3.2.2 skrll { 799 1.3.2.2 skrll struct pfr_kentry *p, *q; 800 1.3.2.2 skrll 801 1.3.2.2 skrll for (p = SLIST_FIRST(workq); p != NULL; p = q) { 802 1.3.2.2 skrll q = SLIST_NEXT(p, pfrke_workq); 803 1.3.2.2 skrll pfr_destroy_kentry(p); 804 1.3.2.2 skrll } 805 1.3.2.2 skrll } 806 1.3.2.2 skrll 807 1.3.2.2 skrll void 808 1.3.2.2 skrll pfr_destroy_kentry(struct pfr_kentry *ke) 809 1.3.2.2 skrll { 810 1.3.2.2 skrll pool_put(&pfr_kentry_pl, ke); 811 1.3.2.2 skrll } 812 1.3.2.2 skrll 813 1.3.2.2 skrll void 814 1.3.2.2 skrll pfr_insert_kentries(struct pfr_ktable *kt, 815 1.3.2.2 skrll struct pfr_kentryworkq *workq, long tzero) 816 1.3.2.2 skrll { 817 1.3.2.2 skrll struct pfr_kentry *p; 818 1.3.2.2 skrll int rv, n = 0; 819 1.3.2.2 skrll 820 1.3.2.2 skrll SLIST_FOREACH(p, workq, pfrke_workq) { 821 1.3.2.2 skrll rv = pfr_route_kentry(kt, p); 822 1.3.2.2 skrll if (rv) { 823 1.3.2.2 skrll printf("pfr_insert_kentries: cannot route entry " 824 1.3.2.2 skrll "(code=%d).\n", rv); 825 1.3.2.2 skrll break; 826 1.3.2.2 skrll } 827 1.3.2.2 skrll p->pfrke_tzero = tzero; 828 1.3.2.2 skrll n++; 829 1.3.2.2 skrll } 830 1.3.2.2 skrll kt->pfrkt_cnt += n; 831 1.3.2.2 skrll } 832 1.3.2.2 skrll 833 1.3.2.2 skrll void 834 1.3.2.2 skrll pfr_remove_kentries(struct pfr_ktable *kt, 835 1.3.2.2 skrll struct pfr_kentryworkq *workq) 836 1.3.2.2 skrll { 837 1.3.2.2 skrll struct pfr_kentry *p; 838 1.3.2.2 skrll int n = 0; 839 1.3.2.2 skrll 840 1.3.2.2 skrll SLIST_FOREACH(p, workq, pfrke_workq) { 841 1.3.2.2 skrll pfr_unroute_kentry(kt, p); 842 1.3.2.2 skrll n++; 843 1.3.2.2 skrll } 844 1.3.2.2 skrll kt->pfrkt_cnt -= n; 845 1.3.2.2 skrll pfr_destroy_kentries(workq); 846 1.3.2.2 skrll } 847 1.3.2.2 skrll 848 1.3.2.2 skrll void 849 1.3.2.2 skrll pfr_clean_node_mask(struct pfr_ktable *kt, 850 1.3.2.2 skrll struct pfr_kentryworkq *workq) 851 1.3.2.2 skrll { 852 1.3.2.2 skrll struct pfr_kentry *p; 853 1.3.2.2 skrll 854 1.3.2.2 skrll SLIST_FOREACH(p, workq, pfrke_workq) 855 1.3.2.2 skrll pfr_unroute_kentry(kt, p); 856 1.3.2.2 skrll } 857 1.3.2.2 skrll 858 1.3.2.2 skrll void 859 1.3.2.2 skrll pfr_clstats_kentries(struct pfr_kentryworkq *workq, long tzero, int negchange) 860 1.3.2.2 skrll { 861 1.3.2.2 skrll struct pfr_kentry *p; 862 1.3.2.2 skrll int s; 863 1.3.2.2 skrll 864 1.3.2.2 skrll SLIST_FOREACH(p, workq, pfrke_workq) { 865 1.3.2.2 skrll s = splsoftnet(); 866 1.3.2.2 skrll if (negchange) 867 1.3.2.2 skrll p->pfrke_not = !p->pfrke_not; 868 1.3.2.2 skrll bzero(p->pfrke_packets, sizeof(p->pfrke_packets)); 869 1.3.2.2 skrll bzero(p->pfrke_bytes, sizeof(p->pfrke_bytes)); 870 1.3.2.2 skrll splx(s); 871 1.3.2.2 skrll p->pfrke_tzero = tzero; 872 1.3.2.2 skrll } 873 1.3.2.2 skrll } 874 1.3.2.2 skrll 875 1.3.2.2 skrll void 876 1.3.2.2 skrll pfr_reset_feedback(struct pfr_addr *addr, int size, int flags) 877 1.3.2.2 skrll { 878 1.3.2.2 skrll struct pfr_addr ad; 879 1.3.2.2 skrll int i; 880 1.3.2.2 skrll 881 1.3.2.2 skrll for (i = 0; i < size; i++) { 882 1.3.2.2 skrll if (COPYIN(addr+i, &ad, sizeof(ad))) 883 1.3.2.2 skrll break; 884 1.3.2.2 skrll ad.pfra_fback = PFR_FB_NONE; 885 1.3.2.2 skrll if (COPYOUT(&ad, addr+i, sizeof(ad))) 886 1.3.2.2 skrll break; 887 1.3.2.2 skrll } 888 1.3.2.2 skrll } 889 1.3.2.2 skrll 890 1.3.2.2 skrll void 891 1.3.2.2 skrll pfr_prepare_network(union sockaddr_union *sa, int af, int net) 892 1.3.2.2 skrll { 893 1.3.2.2 skrll int i; 894 1.3.2.2 skrll 895 1.3.2.2 skrll bzero(sa, sizeof(*sa)); 896 1.3.2.2 skrll if (af == AF_INET) { 897 1.3.2.2 skrll sa->sin.sin_len = sizeof(sa->sin); 898 1.3.2.2 skrll sa->sin.sin_family = AF_INET; 899 1.3.2.2 skrll sa->sin.sin_addr.s_addr = htonl(-1 << (32-net)); 900 1.3.2.2 skrll } else { 901 1.3.2.2 skrll sa->sin6.sin6_len = sizeof(sa->sin6); 902 1.3.2.2 skrll sa->sin6.sin6_family = AF_INET6; 903 1.3.2.2 skrll for (i = 0; i < 4; i++) { 904 1.3.2.2 skrll if (net <= 32) { 905 1.3.2.2 skrll sa->sin6.sin6_addr.s6_addr32[i] = 906 1.3.2.2 skrll htonl(-1 << (32-net)); 907 1.3.2.2 skrll break; 908 1.3.2.2 skrll } 909 1.3.2.2 skrll sa->sin6.sin6_addr.s6_addr32[i] = 0xFFFFFFFF; 910 1.3.2.2 skrll net -= 32; 911 1.3.2.2 skrll } 912 1.3.2.2 skrll } 913 1.3.2.2 skrll } 914 1.3.2.2 skrll 915 1.3.2.2 skrll int 916 1.3.2.2 skrll pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke) 917 1.3.2.2 skrll { 918 1.3.2.2 skrll union sockaddr_union mask; 919 1.3.2.2 skrll struct radix_node *rn; 920 1.3.2.2 skrll struct radix_node_head *head; 921 1.3.2.2 skrll int s; 922 1.3.2.2 skrll 923 1.3.2.2 skrll bzero(ke->pfrke_node, sizeof(ke->pfrke_node)); 924 1.3.2.2 skrll if (ke->pfrke_af == AF_INET) 925 1.3.2.2 skrll head = kt->pfrkt_ip4; 926 1.3.2.2 skrll else 927 1.3.2.2 skrll head = kt->pfrkt_ip6; 928 1.3.2.2 skrll 929 1.3.2.2 skrll s = splsoftnet(); 930 1.3.2.2 skrll if (KENTRY_NETWORK(ke)) { 931 1.3.2.2 skrll pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net); 932 1.3.2.2 skrll rn = rn_addroute(&ke->pfrke_sa, &mask, head, ke->pfrke_node); 933 1.3.2.2 skrll } else 934 1.3.2.2 skrll rn = rn_addroute(&ke->pfrke_sa, NULL, head, ke->pfrke_node); 935 1.3.2.2 skrll splx(s); 936 1.3.2.2 skrll 937 1.3.2.2 skrll return (rn == NULL ? -1 : 0); 938 1.3.2.2 skrll } 939 1.3.2.2 skrll 940 1.3.2.2 skrll int 941 1.3.2.2 skrll pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke) 942 1.3.2.2 skrll { 943 1.3.2.2 skrll union sockaddr_union mask; 944 1.3.2.2 skrll struct radix_node *rn; 945 1.3.2.2 skrll struct radix_node_head *head; 946 1.3.2.2 skrll int s; 947 1.3.2.2 skrll 948 1.3.2.2 skrll if (ke->pfrke_af == AF_INET) 949 1.3.2.2 skrll head = kt->pfrkt_ip4; 950 1.3.2.2 skrll else 951 1.3.2.2 skrll head = kt->pfrkt_ip6; 952 1.3.2.2 skrll 953 1.3.2.2 skrll s = splsoftnet(); 954 1.3.2.2 skrll if (KENTRY_NETWORK(ke)) { 955 1.3.2.2 skrll pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net); 956 1.3.2.2 skrll rn = rn_delete(&ke->pfrke_sa, &mask, head); 957 1.3.2.2 skrll } else 958 1.3.2.2 skrll rn = rn_delete(&ke->pfrke_sa, NULL, head); 959 1.3.2.2 skrll splx(s); 960 1.3.2.2 skrll 961 1.3.2.2 skrll if (rn == NULL) { 962 1.3.2.2 skrll printf("pfr_unroute_kentry: delete failed.\n"); 963 1.3.2.2 skrll return (-1); 964 1.3.2.2 skrll } 965 1.3.2.2 skrll return (0); 966 1.3.2.2 skrll } 967 1.3.2.2 skrll 968 1.3.2.2 skrll void 969 1.3.2.2 skrll pfr_copyout_addr(struct pfr_addr *ad, struct pfr_kentry *ke) 970 1.3.2.2 skrll { 971 1.3.2.2 skrll bzero(ad, sizeof(*ad)); 972 1.3.2.2 skrll if (ke == NULL) 973 1.3.2.2 skrll return; 974 1.3.2.2 skrll ad->pfra_af = ke->pfrke_af; 975 1.3.2.2 skrll ad->pfra_net = ke->pfrke_net; 976 1.3.2.2 skrll ad->pfra_not = ke->pfrke_not; 977 1.3.2.2 skrll if (ad->pfra_af == AF_INET) 978 1.3.2.2 skrll ad->pfra_ip4addr = ke->pfrke_sa.sin.sin_addr; 979 1.3.2.2 skrll else 980 1.3.2.2 skrll ad->pfra_ip6addr = ke->pfrke_sa.sin6.sin6_addr; 981 1.3.2.2 skrll } 982 1.3.2.2 skrll 983 1.3.2.2 skrll int 984 1.3.2.2 skrll pfr_walktree(struct radix_node *rn, void *arg) 985 1.3.2.2 skrll { 986 1.3.2.2 skrll struct pfr_kentry *ke = (struct pfr_kentry *)rn; 987 1.3.2.2 skrll struct pfr_walktree *w = arg; 988 1.3.2.2 skrll int s, flags = w->pfrw_flags; 989 1.3.2.2 skrll 990 1.3.2.2 skrll switch (w->pfrw_op) { 991 1.3.2.2 skrll case PFRW_MARK: 992 1.3.2.2 skrll ke->pfrke_mark = 0; 993 1.3.2.2 skrll break; 994 1.3.2.2 skrll case PFRW_SWEEP: 995 1.3.2.2 skrll if (ke->pfrke_mark) 996 1.3.2.2 skrll break; 997 1.3.2.2 skrll /* FALLTHROUGH */ 998 1.3.2.2 skrll case PFRW_ENQUEUE: 999 1.3.2.2 skrll SLIST_INSERT_HEAD(w->pfrw_workq, ke, pfrke_workq); 1000 1.3.2.2 skrll w->pfrw_cnt++; 1001 1.3.2.2 skrll break; 1002 1.3.2.2 skrll case PFRW_GET_ADDRS: 1003 1.3.2.2 skrll if (w->pfrw_free-- > 0) { 1004 1.3.2.2 skrll struct pfr_addr ad; 1005 1.3.2.2 skrll 1006 1.3.2.2 skrll pfr_copyout_addr(&ad, ke); 1007 1.3.2.2 skrll if (copyout(&ad, w->pfrw_addr, sizeof(ad))) 1008 1.3.2.2 skrll return (EFAULT); 1009 1.3.2.2 skrll w->pfrw_addr++; 1010 1.3.2.2 skrll } 1011 1.3.2.2 skrll break; 1012 1.3.2.2 skrll case PFRW_GET_ASTATS: 1013 1.3.2.2 skrll if (w->pfrw_free-- > 0) { 1014 1.3.2.2 skrll struct pfr_astats as; 1015 1.3.2.2 skrll 1016 1.3.2.2 skrll pfr_copyout_addr(&as.pfras_a, ke); 1017 1.3.2.2 skrll 1018 1.3.2.2 skrll s = splsoftnet(); 1019 1.3.2.2 skrll bcopy(ke->pfrke_packets, as.pfras_packets, 1020 1.3.2.2 skrll sizeof(as.pfras_packets)); 1021 1.3.2.2 skrll bcopy(ke->pfrke_bytes, as.pfras_bytes, 1022 1.3.2.2 skrll sizeof(as.pfras_bytes)); 1023 1.3.2.2 skrll splx(s); 1024 1.3.2.2 skrll as.pfras_tzero = ke->pfrke_tzero; 1025 1.3.2.2 skrll 1026 1.3.2.2 skrll if (COPYOUT(&as, w->pfrw_astats, sizeof(as))) 1027 1.3.2.2 skrll return (EFAULT); 1028 1.3.2.2 skrll w->pfrw_astats++; 1029 1.3.2.2 skrll } 1030 1.3.2.2 skrll break; 1031 1.3.2.2 skrll case PFRW_POOL_GET: 1032 1.3.2.2 skrll if (ke->pfrke_not) 1033 1.3.2.2 skrll break; /* negative entries are ignored */ 1034 1.3.2.2 skrll if (!w->pfrw_cnt--) { 1035 1.3.2.2 skrll w->pfrw_kentry = ke; 1036 1.3.2.2 skrll return (1); /* finish search */ 1037 1.3.2.2 skrll } 1038 1.3.2.2 skrll break; 1039 1.3.2.2 skrll case PFRW_DYNADDR_UPDATE: 1040 1.3.2.2 skrll if (ke->pfrke_af == AF_INET) { 1041 1.3.2.2 skrll if (w->pfrw_dyn->pfid_acnt4++ > 0) 1042 1.3.2.2 skrll break; 1043 1.3.2.2 skrll pfr_prepare_network(&pfr_mask, AF_INET, ke->pfrke_net); 1044 1.3.2.2 skrll w->pfrw_dyn->pfid_addr4 = *SUNION2PF( 1045 1.3.2.2 skrll &ke->pfrke_sa, AF_INET); 1046 1.3.2.2 skrll w->pfrw_dyn->pfid_mask4 = *SUNION2PF( 1047 1.3.2.2 skrll &pfr_mask, AF_INET); 1048 1.3.2.2 skrll } else { 1049 1.3.2.2 skrll if (w->pfrw_dyn->pfid_acnt6++ > 0) 1050 1.3.2.2 skrll break; 1051 1.3.2.2 skrll pfr_prepare_network(&pfr_mask, AF_INET6, ke->pfrke_net); 1052 1.3.2.2 skrll w->pfrw_dyn->pfid_addr6 = *SUNION2PF( 1053 1.3.2.2 skrll &ke->pfrke_sa, AF_INET6); 1054 1.3.2.2 skrll w->pfrw_dyn->pfid_mask6 = *SUNION2PF( 1055 1.3.2.2 skrll &pfr_mask, AF_INET6); 1056 1.3.2.2 skrll } 1057 1.3.2.2 skrll break; 1058 1.3.2.2 skrll } 1059 1.3.2.2 skrll return (0); 1060 1.3.2.2 skrll } 1061 1.3.2.2 skrll 1062 1.3.2.2 skrll int 1063 1.3.2.2 skrll pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags) 1064 1.3.2.2 skrll { 1065 1.3.2.2 skrll struct pfr_ktableworkq workq; 1066 1.3.2.2 skrll struct pfr_ktable *p; 1067 1.3.2.2 skrll int s = 0, xdel = 0; 1068 1.3.2.2 skrll 1069 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_ALLRSETS); 1070 1.3.2.2 skrll if (pfr_table_count(filter, flags) < 0) 1071 1.3.2.2 skrll return (ENOENT); 1072 1.3.2.2 skrll 1073 1.3.2.2 skrll SLIST_INIT(&workq); 1074 1.3.2.2 skrll RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) { 1075 1.3.2.2 skrll if (pfr_skip_table(filter, p, flags)) 1076 1.3.2.2 skrll continue; 1077 1.3.2.2 skrll if (!strcmp(p->pfrkt_anchor, PF_RESERVED_ANCHOR)) 1078 1.3.2.2 skrll continue; 1079 1.3.2.2 skrll if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) 1080 1.3.2.2 skrll continue; 1081 1.3.2.2 skrll p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE; 1082 1.3.2.2 skrll SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1083 1.3.2.2 skrll xdel++; 1084 1.3.2.2 skrll } 1085 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 1086 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1087 1.3.2.2 skrll s = splsoftnet(); 1088 1.3.2.2 skrll pfr_setflags_ktables(&workq); 1089 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1090 1.3.2.2 skrll splx(s); 1091 1.3.2.2 skrll } 1092 1.3.2.2 skrll if (ndel != NULL) 1093 1.3.2.2 skrll *ndel = xdel; 1094 1.3.2.2 skrll return (0); 1095 1.3.2.2 skrll } 1096 1.3.2.2 skrll 1097 1.3.2.2 skrll int 1098 1.3.2.2 skrll pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags) 1099 1.3.2.2 skrll { 1100 1.3.2.2 skrll struct pfr_ktableworkq addq, changeq; 1101 1.3.2.2 skrll struct pfr_ktable *p, *q, *r, key; 1102 1.3.2.2 skrll int i, rv, s = 0, xadd = 0; 1103 1.3.2.2 skrll long tzero = time.tv_sec; 1104 1.3.2.2 skrll 1105 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY); 1106 1.3.2.2 skrll SLIST_INIT(&addq); 1107 1.3.2.2 skrll SLIST_INIT(&changeq); 1108 1.3.2.2 skrll for (i = 0; i < size; i++) { 1109 1.3.2.2 skrll if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t))) 1110 1.3.2.2 skrll senderr(EFAULT); 1111 1.3.2.2 skrll if (pfr_validate_table(&key.pfrkt_t, PFR_TFLAG_USRMASK, 1112 1.3.2.2 skrll flags & PFR_FLAG_USERIOCTL)) 1113 1.3.2.2 skrll senderr(EINVAL); 1114 1.3.2.2 skrll key.pfrkt_flags |= PFR_TFLAG_ACTIVE; 1115 1.3.2.2 skrll p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key); 1116 1.3.2.2 skrll if (p == NULL) { 1117 1.3.2.2 skrll p = pfr_create_ktable(&key.pfrkt_t, tzero, 1); 1118 1.3.2.2 skrll if (p == NULL) 1119 1.3.2.2 skrll senderr(ENOMEM); 1120 1.3.2.2 skrll SLIST_FOREACH(q, &addq, pfrkt_workq) { 1121 1.3.2.2 skrll if (!pfr_ktable_compare(p, q)) 1122 1.3.2.2 skrll goto _skip; 1123 1.3.2.2 skrll } 1124 1.3.2.2 skrll SLIST_INSERT_HEAD(&addq, p, pfrkt_workq); 1125 1.3.2.2 skrll xadd++; 1126 1.3.2.2 skrll if (!key.pfrkt_anchor[0]) 1127 1.3.2.2 skrll goto _skip; 1128 1.3.2.2 skrll 1129 1.3.2.2 skrll /* find or create root table */ 1130 1.3.2.2 skrll bzero(key.pfrkt_anchor, sizeof(key.pfrkt_anchor)); 1131 1.3.2.2 skrll bzero(key.pfrkt_ruleset, sizeof(key.pfrkt_ruleset)); 1132 1.3.2.2 skrll r = RB_FIND(pfr_ktablehead, &pfr_ktables, &key); 1133 1.3.2.2 skrll if (r != NULL) { 1134 1.3.2.2 skrll p->pfrkt_root = r; 1135 1.3.2.2 skrll goto _skip; 1136 1.3.2.2 skrll } 1137 1.3.2.2 skrll SLIST_FOREACH(q, &addq, pfrkt_workq) { 1138 1.3.2.2 skrll if (!pfr_ktable_compare(&key, q)) { 1139 1.3.2.2 skrll p->pfrkt_root = q; 1140 1.3.2.2 skrll goto _skip; 1141 1.3.2.2 skrll } 1142 1.3.2.2 skrll } 1143 1.3.2.2 skrll key.pfrkt_flags = 0; 1144 1.3.2.2 skrll r = pfr_create_ktable(&key.pfrkt_t, 0, 1); 1145 1.3.2.2 skrll if (r == NULL) 1146 1.3.2.2 skrll senderr(ENOMEM); 1147 1.3.2.2 skrll SLIST_INSERT_HEAD(&addq, r, pfrkt_workq); 1148 1.3.2.2 skrll p->pfrkt_root = r; 1149 1.3.2.2 skrll } else if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) { 1150 1.3.2.2 skrll SLIST_FOREACH(q, &changeq, pfrkt_workq) 1151 1.3.2.2 skrll if (!pfr_ktable_compare(&key, q)) 1152 1.3.2.2 skrll goto _skip; 1153 1.3.2.2 skrll p->pfrkt_nflags = (p->pfrkt_flags & 1154 1.3.2.2 skrll ~PFR_TFLAG_USRMASK) | key.pfrkt_flags; 1155 1.3.2.2 skrll SLIST_INSERT_HEAD(&changeq, p, pfrkt_workq); 1156 1.3.2.2 skrll xadd++; 1157 1.3.2.2 skrll } 1158 1.3.2.2 skrll _skip: 1159 1.3.2.2 skrll ; 1160 1.3.2.2 skrll } 1161 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 1162 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1163 1.3.2.2 skrll s = splsoftnet(); 1164 1.3.2.2 skrll pfr_insert_ktables(&addq); 1165 1.3.2.2 skrll pfr_setflags_ktables(&changeq); 1166 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1167 1.3.2.2 skrll splx(s); 1168 1.3.2.2 skrll } else 1169 1.3.2.2 skrll pfr_destroy_ktables(&addq, 0); 1170 1.3.2.2 skrll if (nadd != NULL) 1171 1.3.2.2 skrll *nadd = xadd; 1172 1.3.2.2 skrll return (0); 1173 1.3.2.2 skrll _bad: 1174 1.3.2.2 skrll pfr_destroy_ktables(&addq, 0); 1175 1.3.2.2 skrll return (rv); 1176 1.3.2.2 skrll } 1177 1.3.2.2 skrll 1178 1.3.2.2 skrll int 1179 1.3.2.2 skrll pfr_del_tables(struct pfr_table *tbl, int size, int *ndel, int flags) 1180 1.3.2.2 skrll { 1181 1.3.2.2 skrll struct pfr_ktableworkq workq; 1182 1.3.2.2 skrll struct pfr_ktable *p, *q, key; 1183 1.3.2.2 skrll int i, s = 0, xdel = 0; 1184 1.3.2.2 skrll 1185 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY); 1186 1.3.2.2 skrll SLIST_INIT(&workq); 1187 1.3.2.2 skrll for (i = 0; i < size; i++) { 1188 1.3.2.2 skrll if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t))) 1189 1.3.2.2 skrll return (EFAULT); 1190 1.3.2.2 skrll if (pfr_validate_table(&key.pfrkt_t, 0, 1191 1.3.2.2 skrll flags & PFR_FLAG_USERIOCTL)) 1192 1.3.2.2 skrll return (EINVAL); 1193 1.3.2.2 skrll p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key); 1194 1.3.2.2 skrll if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) { 1195 1.3.2.2 skrll SLIST_FOREACH(q, &workq, pfrkt_workq) 1196 1.3.2.2 skrll if (!pfr_ktable_compare(p, q)) 1197 1.3.2.2 skrll goto _skip; 1198 1.3.2.2 skrll p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE; 1199 1.3.2.2 skrll SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1200 1.3.2.2 skrll xdel++; 1201 1.3.2.2 skrll } 1202 1.3.2.2 skrll _skip: 1203 1.3.2.2 skrll ; 1204 1.3.2.2 skrll } 1205 1.3.2.2 skrll 1206 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 1207 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1208 1.3.2.2 skrll s = splsoftnet(); 1209 1.3.2.2 skrll pfr_setflags_ktables(&workq); 1210 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1211 1.3.2.2 skrll splx(s); 1212 1.3.2.2 skrll } 1213 1.3.2.2 skrll if (ndel != NULL) 1214 1.3.2.2 skrll *ndel = xdel; 1215 1.3.2.2 skrll return (0); 1216 1.3.2.2 skrll } 1217 1.3.2.2 skrll 1218 1.3.2.2 skrll int 1219 1.3.2.2 skrll pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size, 1220 1.3.2.2 skrll int flags) 1221 1.3.2.2 skrll { 1222 1.3.2.2 skrll struct pfr_ktable *p; 1223 1.3.2.2 skrll int n, nn; 1224 1.3.2.2 skrll 1225 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ALLRSETS); 1226 1.3.2.2 skrll n = nn = pfr_table_count(filter, flags); 1227 1.3.2.2 skrll if (n < 0) 1228 1.3.2.2 skrll return (ENOENT); 1229 1.3.2.2 skrll if (n > *size) { 1230 1.3.2.2 skrll *size = n; 1231 1.3.2.2 skrll return (0); 1232 1.3.2.2 skrll } 1233 1.3.2.2 skrll RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) { 1234 1.3.2.2 skrll if (pfr_skip_table(filter, p, flags)) 1235 1.3.2.2 skrll continue; 1236 1.3.2.2 skrll if (n-- <= 0) 1237 1.3.2.2 skrll continue; 1238 1.3.2.2 skrll if (COPYOUT(&p->pfrkt_t, tbl++, sizeof(*tbl))) 1239 1.3.2.2 skrll return (EFAULT); 1240 1.3.2.2 skrll } 1241 1.3.2.2 skrll if (n) { 1242 1.3.2.2 skrll printf("pfr_get_tables: corruption detected (%d).\n", n); 1243 1.3.2.2 skrll return (ENOTTY); 1244 1.3.2.2 skrll } 1245 1.3.2.2 skrll *size = nn; 1246 1.3.2.2 skrll return (0); 1247 1.3.2.2 skrll } 1248 1.3.2.2 skrll 1249 1.3.2.2 skrll int 1250 1.3.2.2 skrll pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size, 1251 1.3.2.2 skrll int flags) 1252 1.3.2.2 skrll { 1253 1.3.2.2 skrll struct pfr_ktable *p; 1254 1.3.2.2 skrll struct pfr_ktableworkq workq; 1255 1.3.2.2 skrll int s = 0, n, nn; 1256 1.3.2.2 skrll long tzero = time.tv_sec; 1257 1.3.2.2 skrll 1258 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC|PFR_FLAG_ALLRSETS); 1259 1.3.2.2 skrll /* XXX PFR_FLAG_CLSTATS disabled */ 1260 1.3.2.2 skrll n = nn = pfr_table_count(filter, flags); 1261 1.3.2.2 skrll if (n < 0) 1262 1.3.2.2 skrll return (ENOENT); 1263 1.3.2.2 skrll if (n > *size) { 1264 1.3.2.2 skrll *size = n; 1265 1.3.2.2 skrll return (0); 1266 1.3.2.2 skrll } 1267 1.3.2.2 skrll SLIST_INIT(&workq); 1268 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1269 1.3.2.2 skrll s = splsoftnet(); 1270 1.3.2.2 skrll RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) { 1271 1.3.2.2 skrll if (pfr_skip_table(filter, p, flags)) 1272 1.3.2.2 skrll continue; 1273 1.3.2.2 skrll if (n-- <= 0) 1274 1.3.2.2 skrll continue; 1275 1.3.2.2 skrll if (!(flags & PFR_FLAG_ATOMIC)) 1276 1.3.2.2 skrll s = splsoftnet(); 1277 1.3.2.2 skrll if (COPYOUT(&p->pfrkt_ts, tbl++, sizeof(*tbl))) { 1278 1.3.2.2 skrll splx(s); 1279 1.3.2.2 skrll return (EFAULT); 1280 1.3.2.2 skrll } 1281 1.3.2.2 skrll if (!(flags & PFR_FLAG_ATOMIC)) 1282 1.3.2.2 skrll splx(s); 1283 1.3.2.2 skrll SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1284 1.3.2.2 skrll } 1285 1.3.2.2 skrll if (flags & PFR_FLAG_CLSTATS) 1286 1.3.2.2 skrll pfr_clstats_ktables(&workq, tzero, 1287 1.3.2.2 skrll flags & PFR_FLAG_ADDRSTOO); 1288 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1289 1.3.2.2 skrll splx(s); 1290 1.3.2.2 skrll if (n) { 1291 1.3.2.2 skrll printf("pfr_get_tstats: corruption detected (%d).\n", n); 1292 1.3.2.2 skrll return (ENOTTY); 1293 1.3.2.2 skrll } 1294 1.3.2.2 skrll *size = nn; 1295 1.3.2.2 skrll return (0); 1296 1.3.2.2 skrll } 1297 1.3.2.2 skrll 1298 1.3.2.2 skrll int 1299 1.3.2.2 skrll pfr_clr_tstats(struct pfr_table *tbl, int size, int *nzero, int flags) 1300 1.3.2.2 skrll { 1301 1.3.2.2 skrll struct pfr_ktableworkq workq; 1302 1.3.2.2 skrll struct pfr_ktable *p, key; 1303 1.3.2.2 skrll int i, s = 0, xzero = 0; 1304 1.3.2.2 skrll long tzero = time.tv_sec; 1305 1.3.2.2 skrll 1306 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_ADDRSTOO); 1307 1.3.2.2 skrll SLIST_INIT(&workq); 1308 1.3.2.2 skrll for (i = 0; i < size; i++) { 1309 1.3.2.2 skrll if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t))) 1310 1.3.2.2 skrll return (EFAULT); 1311 1.3.2.2 skrll if (pfr_validate_table(&key.pfrkt_t, 0, 0)) 1312 1.3.2.2 skrll return (EINVAL); 1313 1.3.2.2 skrll p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key); 1314 1.3.2.2 skrll if (p != NULL) { 1315 1.3.2.2 skrll SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1316 1.3.2.2 skrll xzero++; 1317 1.3.2.2 skrll } 1318 1.3.2.2 skrll } 1319 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 1320 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1321 1.3.2.2 skrll s = splsoftnet(); 1322 1.3.2.2 skrll pfr_clstats_ktables(&workq, tzero, flags & PFR_FLAG_ADDRSTOO); 1323 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1324 1.3.2.2 skrll splx(s); 1325 1.3.2.2 skrll } 1326 1.3.2.2 skrll if (nzero != NULL) 1327 1.3.2.2 skrll *nzero = xzero; 1328 1.3.2.2 skrll return (0); 1329 1.3.2.2 skrll } 1330 1.3.2.2 skrll 1331 1.3.2.2 skrll int 1332 1.3.2.2 skrll pfr_set_tflags(struct pfr_table *tbl, int size, int setflag, int clrflag, 1333 1.3.2.2 skrll int *nchange, int *ndel, int flags) 1334 1.3.2.2 skrll { 1335 1.3.2.2 skrll struct pfr_ktableworkq workq; 1336 1.3.2.2 skrll struct pfr_ktable *p, *q, key; 1337 1.3.2.2 skrll int i, s = 0, xchange = 0, xdel = 0; 1338 1.3.2.2 skrll 1339 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY); 1340 1.3.2.2 skrll if ((setflag & ~PFR_TFLAG_USRMASK) || 1341 1.3.2.2 skrll (clrflag & ~PFR_TFLAG_USRMASK) || 1342 1.3.2.2 skrll (setflag & clrflag)) 1343 1.3.2.2 skrll return (EINVAL); 1344 1.3.2.2 skrll SLIST_INIT(&workq); 1345 1.3.2.2 skrll for (i = 0; i < size; i++) { 1346 1.3.2.2 skrll if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t))) 1347 1.3.2.2 skrll return (EFAULT); 1348 1.3.2.2 skrll if (pfr_validate_table(&key.pfrkt_t, 0, 1349 1.3.2.2 skrll flags & PFR_FLAG_USERIOCTL)) 1350 1.3.2.2 skrll return (EINVAL); 1351 1.3.2.2 skrll p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key); 1352 1.3.2.2 skrll if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) { 1353 1.3.2.2 skrll p->pfrkt_nflags = (p->pfrkt_flags | setflag) & 1354 1.3.2.2 skrll ~clrflag; 1355 1.3.2.2 skrll if (p->pfrkt_nflags == p->pfrkt_flags) 1356 1.3.2.2 skrll goto _skip; 1357 1.3.2.2 skrll SLIST_FOREACH(q, &workq, pfrkt_workq) 1358 1.3.2.2 skrll if (!pfr_ktable_compare(p, q)) 1359 1.3.2.2 skrll goto _skip; 1360 1.3.2.2 skrll SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1361 1.3.2.2 skrll if ((p->pfrkt_flags & PFR_TFLAG_PERSIST) && 1362 1.3.2.2 skrll (clrflag & PFR_TFLAG_PERSIST) && 1363 1.3.2.2 skrll !(p->pfrkt_flags & PFR_TFLAG_REFERENCED)) 1364 1.3.2.2 skrll xdel++; 1365 1.3.2.2 skrll else 1366 1.3.2.2 skrll xchange++; 1367 1.3.2.2 skrll } 1368 1.3.2.2 skrll _skip: 1369 1.3.2.2 skrll ; 1370 1.3.2.2 skrll } 1371 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 1372 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1373 1.3.2.2 skrll s = splsoftnet(); 1374 1.3.2.2 skrll pfr_setflags_ktables(&workq); 1375 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1376 1.3.2.2 skrll splx(s); 1377 1.3.2.2 skrll } 1378 1.3.2.2 skrll if (nchange != NULL) 1379 1.3.2.2 skrll *nchange = xchange; 1380 1.3.2.2 skrll if (ndel != NULL) 1381 1.3.2.2 skrll *ndel = xdel; 1382 1.3.2.2 skrll return (0); 1383 1.3.2.2 skrll } 1384 1.3.2.2 skrll 1385 1.3.2.2 skrll int 1386 1.3.2.2 skrll pfr_ina_begin(struct pfr_table *trs, u_int32_t *ticket, int *ndel, int flags) 1387 1.3.2.2 skrll { 1388 1.3.2.2 skrll struct pfr_ktableworkq workq; 1389 1.3.2.2 skrll struct pfr_ktable *p; 1390 1.3.2.2 skrll struct pf_ruleset *rs; 1391 1.3.2.2 skrll int xdel = 0; 1392 1.3.2.2 skrll 1393 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_DUMMY); 1394 1.3.2.2 skrll rs = pf_find_or_create_ruleset(trs->pfrt_anchor, trs->pfrt_ruleset); 1395 1.3.2.2 skrll if (rs == NULL) 1396 1.3.2.2 skrll return (ENOMEM); 1397 1.3.2.2 skrll SLIST_INIT(&workq); 1398 1.3.2.2 skrll RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) { 1399 1.3.2.2 skrll if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) || 1400 1.3.2.2 skrll pfr_skip_table(trs, p, 0)) 1401 1.3.2.2 skrll continue; 1402 1.3.2.2 skrll p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE; 1403 1.3.2.2 skrll SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1404 1.3.2.2 skrll xdel++; 1405 1.3.2.2 skrll } 1406 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 1407 1.3.2.2 skrll pfr_setflags_ktables(&workq); 1408 1.3.2.2 skrll if (ticket != NULL) 1409 1.3.2.2 skrll *ticket = ++rs->tticket; 1410 1.3.2.2 skrll rs->topen = 1; 1411 1.3.2.2 skrll } else 1412 1.3.2.2 skrll pf_remove_if_empty_ruleset(rs); 1413 1.3.2.2 skrll if (ndel != NULL) 1414 1.3.2.2 skrll *ndel = xdel; 1415 1.3.2.2 skrll return (0); 1416 1.3.2.2 skrll } 1417 1.3.2.2 skrll 1418 1.3.2.2 skrll int 1419 1.3.2.2 skrll pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size, 1420 1.3.2.2 skrll int *nadd, int *naddr, u_int32_t ticket, int flags) 1421 1.3.2.2 skrll { 1422 1.3.2.2 skrll struct pfr_ktableworkq tableq; 1423 1.3.2.2 skrll struct pfr_kentryworkq addrq; 1424 1.3.2.2 skrll struct pfr_ktable *kt, *rt, *shadow, key; 1425 1.3.2.2 skrll struct pfr_kentry *p; 1426 1.3.2.2 skrll struct pfr_addr ad; 1427 1.3.2.2 skrll struct pf_ruleset *rs; 1428 1.3.2.2 skrll int i, rv, xadd = 0, xaddr = 0; 1429 1.3.2.2 skrll 1430 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_DUMMY|PFR_FLAG_ADDRSTOO); 1431 1.3.2.2 skrll if (size && !(flags & PFR_FLAG_ADDRSTOO)) 1432 1.3.2.2 skrll return (EINVAL); 1433 1.3.2.2 skrll if (pfr_validate_table(tbl, PFR_TFLAG_USRMASK, 1434 1.3.2.2 skrll flags & PFR_FLAG_USERIOCTL)) 1435 1.3.2.2 skrll return (EINVAL); 1436 1.3.2.2 skrll rs = pf_find_ruleset(tbl->pfrt_anchor, tbl->pfrt_ruleset); 1437 1.3.2.2 skrll if (rs == NULL || !rs->topen || ticket != rs->tticket) 1438 1.3.2.2 skrll return (EBUSY); 1439 1.3.2.2 skrll tbl->pfrt_flags |= PFR_TFLAG_INACTIVE; 1440 1.3.2.2 skrll SLIST_INIT(&tableq); 1441 1.3.2.2 skrll kt = RB_FIND(pfr_ktablehead, &pfr_ktables, (struct pfr_ktable *)tbl); 1442 1.3.2.2 skrll if (kt == NULL) { 1443 1.3.2.2 skrll kt = pfr_create_ktable(tbl, 0, 1); 1444 1.3.2.2 skrll if (kt == NULL) 1445 1.3.2.2 skrll return (ENOMEM); 1446 1.3.2.2 skrll SLIST_INSERT_HEAD(&tableq, kt, pfrkt_workq); 1447 1.3.2.2 skrll xadd++; 1448 1.3.2.2 skrll if (!tbl->pfrt_anchor[0]) 1449 1.3.2.2 skrll goto _skip; 1450 1.3.2.2 skrll 1451 1.3.2.2 skrll /* find or create root table */ 1452 1.3.2.2 skrll bzero(&key, sizeof(key)); 1453 1.3.2.2 skrll strlcpy(key.pfrkt_name, tbl->pfrt_name, sizeof(key.pfrkt_name)); 1454 1.3.2.2 skrll rt = RB_FIND(pfr_ktablehead, &pfr_ktables, &key); 1455 1.3.2.2 skrll if (rt != NULL) { 1456 1.3.2.2 skrll kt->pfrkt_root = rt; 1457 1.3.2.2 skrll goto _skip; 1458 1.3.2.2 skrll } 1459 1.3.2.2 skrll rt = pfr_create_ktable(&key.pfrkt_t, 0, 1); 1460 1.3.2.2 skrll if (rt == NULL) { 1461 1.3.2.2 skrll pfr_destroy_ktables(&tableq, 0); 1462 1.3.2.2 skrll return (ENOMEM); 1463 1.3.2.2 skrll } 1464 1.3.2.2 skrll SLIST_INSERT_HEAD(&tableq, rt, pfrkt_workq); 1465 1.3.2.2 skrll kt->pfrkt_root = rt; 1466 1.3.2.2 skrll } else if (!(kt->pfrkt_flags & PFR_TFLAG_INACTIVE)) 1467 1.3.2.2 skrll xadd++; 1468 1.3.2.2 skrll _skip: 1469 1.3.2.2 skrll shadow = pfr_create_ktable(tbl, 0, 0); 1470 1.3.2.2 skrll if (shadow == NULL) { 1471 1.3.2.2 skrll pfr_destroy_ktables(&tableq, 0); 1472 1.3.2.2 skrll return (ENOMEM); 1473 1.3.2.2 skrll } 1474 1.3.2.2 skrll SLIST_INIT(&addrq); 1475 1.3.2.2 skrll for (i = 0; i < size; i++) { 1476 1.3.2.2 skrll if (COPYIN(addr+i, &ad, sizeof(ad))) 1477 1.3.2.2 skrll senderr(EFAULT); 1478 1.3.2.2 skrll if (pfr_validate_addr(&ad)) 1479 1.3.2.2 skrll senderr(EINVAL); 1480 1.3.2.2 skrll if (pfr_lookup_addr(shadow, &ad, 1) != NULL) 1481 1.3.2.2 skrll continue; 1482 1.3.2.2 skrll p = pfr_create_kentry(&ad); 1483 1.3.2.2 skrll if (p == NULL) 1484 1.3.2.2 skrll senderr(ENOMEM); 1485 1.3.2.2 skrll if (pfr_route_kentry(shadow, p)) { 1486 1.3.2.2 skrll pfr_destroy_kentry(p); 1487 1.3.2.2 skrll continue; 1488 1.3.2.2 skrll } 1489 1.3.2.2 skrll SLIST_INSERT_HEAD(&addrq, p, pfrke_workq); 1490 1.3.2.2 skrll xaddr++; 1491 1.3.2.2 skrll } 1492 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 1493 1.3.2.2 skrll if (kt->pfrkt_shadow != NULL) 1494 1.3.2.2 skrll pfr_destroy_ktable(kt->pfrkt_shadow, 1); 1495 1.3.2.2 skrll kt->pfrkt_flags |= PFR_TFLAG_INACTIVE; 1496 1.3.2.2 skrll pfr_insert_ktables(&tableq); 1497 1.3.2.2 skrll shadow->pfrkt_cnt = (flags & PFR_FLAG_ADDRSTOO) ? 1498 1.3.2.2 skrll xaddr : NO_ADDRESSES; 1499 1.3.2.2 skrll kt->pfrkt_shadow = shadow; 1500 1.3.2.2 skrll } else { 1501 1.3.2.2 skrll pfr_clean_node_mask(shadow, &addrq); 1502 1.3.2.2 skrll pfr_destroy_ktable(shadow, 0); 1503 1.3.2.2 skrll pfr_destroy_ktables(&tableq, 0); 1504 1.3.2.2 skrll pfr_destroy_kentries(&addrq); 1505 1.3.2.2 skrll } 1506 1.3.2.2 skrll if (nadd != NULL) 1507 1.3.2.2 skrll *nadd = xadd; 1508 1.3.2.2 skrll if (naddr != NULL) 1509 1.3.2.2 skrll *naddr = xaddr; 1510 1.3.2.2 skrll return (0); 1511 1.3.2.2 skrll _bad: 1512 1.3.2.2 skrll pfr_destroy_ktable(shadow, 0); 1513 1.3.2.2 skrll pfr_destroy_ktables(&tableq, 0); 1514 1.3.2.2 skrll pfr_destroy_kentries(&addrq); 1515 1.3.2.2 skrll return (rv); 1516 1.3.2.2 skrll } 1517 1.3.2.2 skrll 1518 1.3.2.2 skrll int 1519 1.3.2.2 skrll pfr_ina_rollback(struct pfr_table *trs, u_int32_t ticket, int *ndel, int flags) 1520 1.3.2.2 skrll { 1521 1.3.2.2 skrll struct pfr_ktableworkq workq; 1522 1.3.2.2 skrll struct pfr_ktable *p; 1523 1.3.2.2 skrll struct pf_ruleset *rs; 1524 1.3.2.2 skrll int xdel = 0; 1525 1.3.2.2 skrll 1526 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_DUMMY); 1527 1.3.2.2 skrll rs = pf_find_ruleset(trs->pfrt_anchor, trs->pfrt_ruleset); 1528 1.3.2.2 skrll if (rs == NULL || !rs->topen || ticket != rs->tticket) 1529 1.3.2.2 skrll return (0); 1530 1.3.2.2 skrll SLIST_INIT(&workq); 1531 1.3.2.2 skrll RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) { 1532 1.3.2.2 skrll if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) || 1533 1.3.2.2 skrll pfr_skip_table(trs, p, 0)) 1534 1.3.2.2 skrll continue; 1535 1.3.2.2 skrll p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE; 1536 1.3.2.2 skrll SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1537 1.3.2.2 skrll xdel++; 1538 1.3.2.2 skrll } 1539 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 1540 1.3.2.2 skrll pfr_setflags_ktables(&workq); 1541 1.3.2.2 skrll rs->topen = 0; 1542 1.3.2.2 skrll pf_remove_if_empty_ruleset(rs); 1543 1.3.2.2 skrll } 1544 1.3.2.2 skrll if (ndel != NULL) 1545 1.3.2.2 skrll *ndel = xdel; 1546 1.3.2.2 skrll return (0); 1547 1.3.2.2 skrll } 1548 1.3.2.2 skrll 1549 1.3.2.2 skrll int 1550 1.3.2.2 skrll pfr_ina_commit(struct pfr_table *trs, u_int32_t ticket, int *nadd, 1551 1.3.2.2 skrll int *nchange, int flags) 1552 1.3.2.2 skrll { 1553 1.3.2.3 skrll struct pfr_ktable *p, *q; 1554 1.3.2.2 skrll struct pfr_ktableworkq workq; 1555 1.3.2.2 skrll struct pf_ruleset *rs; 1556 1.3.2.2 skrll int s = 0, xadd = 0, xchange = 0; 1557 1.3.2.2 skrll long tzero = time.tv_sec; 1558 1.3.2.2 skrll 1559 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY); 1560 1.3.2.2 skrll rs = pf_find_ruleset(trs->pfrt_anchor, trs->pfrt_ruleset); 1561 1.3.2.2 skrll if (rs == NULL || !rs->topen || ticket != rs->tticket) 1562 1.3.2.2 skrll return (EBUSY); 1563 1.3.2.2 skrll 1564 1.3.2.2 skrll SLIST_INIT(&workq); 1565 1.3.2.2 skrll RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) { 1566 1.3.2.2 skrll if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) || 1567 1.3.2.2 skrll pfr_skip_table(trs, p, 0)) 1568 1.3.2.2 skrll continue; 1569 1.3.2.2 skrll SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1570 1.3.2.2 skrll if (p->pfrkt_flags & PFR_TFLAG_ACTIVE) 1571 1.3.2.2 skrll xchange++; 1572 1.3.2.2 skrll else 1573 1.3.2.2 skrll xadd++; 1574 1.3.2.2 skrll } 1575 1.3.2.2 skrll 1576 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 1577 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1578 1.3.2.2 skrll s = splsoftnet(); 1579 1.3.2.3 skrll for (p = SLIST_FIRST(&workq); p != NULL; p = q) { 1580 1.3.2.3 skrll q = SLIST_NEXT(p, pfrkt_workq); 1581 1.3.2.2 skrll pfr_commit_ktable(p, tzero); 1582 1.3.2.3 skrll } 1583 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1584 1.3.2.2 skrll splx(s); 1585 1.3.2.2 skrll rs->topen = 0; 1586 1.3.2.2 skrll pf_remove_if_empty_ruleset(rs); 1587 1.3.2.2 skrll } 1588 1.3.2.2 skrll if (nadd != NULL) 1589 1.3.2.2 skrll *nadd = xadd; 1590 1.3.2.2 skrll if (nchange != NULL) 1591 1.3.2.2 skrll *nchange = xchange; 1592 1.3.2.2 skrll 1593 1.3.2.2 skrll return (0); 1594 1.3.2.2 skrll } 1595 1.3.2.2 skrll 1596 1.3.2.2 skrll void 1597 1.3.2.2 skrll pfr_commit_ktable(struct pfr_ktable *kt, long tzero) 1598 1.3.2.2 skrll { 1599 1.3.2.2 skrll struct pfr_ktable *shadow = kt->pfrkt_shadow; 1600 1.3.2.2 skrll int nflags; 1601 1.3.2.2 skrll 1602 1.3.2.2 skrll if (shadow->pfrkt_cnt == NO_ADDRESSES) { 1603 1.3.2.2 skrll if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 1604 1.3.2.2 skrll pfr_clstats_ktable(kt, tzero, 1); 1605 1.3.2.2 skrll } else if (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) { 1606 1.3.2.2 skrll /* kt might contain addresses */ 1607 1.3.2.2 skrll struct pfr_kentryworkq addrq, addq, changeq, delq, garbageq; 1608 1.3.2.2 skrll struct pfr_kentry *p, *q, *next; 1609 1.3.2.2 skrll struct pfr_addr ad; 1610 1.3.2.2 skrll 1611 1.3.2.2 skrll pfr_enqueue_addrs(shadow, &addrq, NULL, 0); 1612 1.3.2.2 skrll pfr_mark_addrs(kt); 1613 1.3.2.2 skrll SLIST_INIT(&addq); 1614 1.3.2.2 skrll SLIST_INIT(&changeq); 1615 1.3.2.2 skrll SLIST_INIT(&delq); 1616 1.3.2.2 skrll SLIST_INIT(&garbageq); 1617 1.3.2.2 skrll pfr_clean_node_mask(shadow, &addrq); 1618 1.3.2.2 skrll for (p = SLIST_FIRST(&addrq); p != NULL; p = next) { 1619 1.3.2.2 skrll next = SLIST_NEXT(p, pfrke_workq); /* XXX */ 1620 1.3.2.2 skrll pfr_copyout_addr(&ad, p); 1621 1.3.2.2 skrll q = pfr_lookup_addr(kt, &ad, 1); 1622 1.3.2.2 skrll if (q != NULL) { 1623 1.3.2.2 skrll if (q->pfrke_not != p->pfrke_not) 1624 1.3.2.2 skrll SLIST_INSERT_HEAD(&changeq, q, 1625 1.3.2.2 skrll pfrke_workq); 1626 1.3.2.2 skrll q->pfrke_mark = 1; 1627 1.3.2.2 skrll SLIST_INSERT_HEAD(&garbageq, p, pfrke_workq); 1628 1.3.2.2 skrll } else { 1629 1.3.2.2 skrll p->pfrke_tzero = tzero; 1630 1.3.2.2 skrll SLIST_INSERT_HEAD(&addq, p, pfrke_workq); 1631 1.3.2.2 skrll } 1632 1.3.2.2 skrll } 1633 1.3.2.2 skrll pfr_enqueue_addrs(kt, &delq, NULL, ENQUEUE_UNMARKED_ONLY); 1634 1.3.2.2 skrll pfr_insert_kentries(kt, &addq, tzero); 1635 1.3.2.2 skrll pfr_remove_kentries(kt, &delq); 1636 1.3.2.2 skrll pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG); 1637 1.3.2.2 skrll pfr_destroy_kentries(&garbageq); 1638 1.3.2.2 skrll } else { 1639 1.3.2.2 skrll /* kt cannot contain addresses */ 1640 1.3.2.2 skrll SWAP(struct radix_node_head *, kt->pfrkt_ip4, 1641 1.3.2.2 skrll shadow->pfrkt_ip4); 1642 1.3.2.2 skrll SWAP(struct radix_node_head *, kt->pfrkt_ip6, 1643 1.3.2.2 skrll shadow->pfrkt_ip6); 1644 1.3.2.2 skrll SWAP(int, kt->pfrkt_cnt, shadow->pfrkt_cnt); 1645 1.3.2.2 skrll pfr_clstats_ktable(kt, tzero, 1); 1646 1.3.2.2 skrll } 1647 1.3.2.2 skrll nflags = ((shadow->pfrkt_flags & PFR_TFLAG_USRMASK) | 1648 1.3.2.2 skrll (kt->pfrkt_flags & PFR_TFLAG_SETMASK) | PFR_TFLAG_ACTIVE) 1649 1.3.2.2 skrll & ~PFR_TFLAG_INACTIVE; 1650 1.3.2.2 skrll pfr_destroy_ktable(shadow, 0); 1651 1.3.2.2 skrll kt->pfrkt_shadow = NULL; 1652 1.3.2.2 skrll pfr_setflags_ktable(kt, nflags); 1653 1.3.2.2 skrll } 1654 1.3.2.2 skrll 1655 1.3.2.2 skrll int 1656 1.3.2.2 skrll pfr_validate_table(struct pfr_table *tbl, int allowedflags, int no_reserved) 1657 1.3.2.2 skrll { 1658 1.3.2.2 skrll int i; 1659 1.3.2.2 skrll 1660 1.3.2.2 skrll if (!tbl->pfrt_name[0]) 1661 1.3.2.2 skrll return (-1); 1662 1.3.2.2 skrll if (no_reserved && !strcmp(tbl->pfrt_anchor, PF_RESERVED_ANCHOR)) 1663 1.3.2.2 skrll return (-1); 1664 1.3.2.2 skrll if (tbl->pfrt_name[PF_TABLE_NAME_SIZE-1]) 1665 1.3.2.2 skrll return (-1); 1666 1.3.2.2 skrll for (i = strlen(tbl->pfrt_name); i < PF_TABLE_NAME_SIZE; i++) 1667 1.3.2.2 skrll if (tbl->pfrt_name[i]) 1668 1.3.2.2 skrll return (-1); 1669 1.3.2.2 skrll if (tbl->pfrt_flags & ~allowedflags) 1670 1.3.2.2 skrll return (-1); 1671 1.3.2.2 skrll return (0); 1672 1.3.2.2 skrll } 1673 1.3.2.2 skrll 1674 1.3.2.2 skrll int 1675 1.3.2.2 skrll pfr_table_count(struct pfr_table *filter, int flags) 1676 1.3.2.2 skrll { 1677 1.3.2.2 skrll struct pf_ruleset *rs; 1678 1.3.2.2 skrll struct pf_anchor *ac; 1679 1.3.2.2 skrll 1680 1.3.2.2 skrll if (flags & PFR_FLAG_ALLRSETS) 1681 1.3.2.2 skrll return (pfr_ktable_cnt); 1682 1.3.2.2 skrll if (filter->pfrt_ruleset[0]) { 1683 1.3.2.2 skrll rs = pf_find_ruleset(filter->pfrt_anchor, 1684 1.3.2.2 skrll filter->pfrt_ruleset); 1685 1.3.2.2 skrll return ((rs != NULL) ? rs->tables : -1); 1686 1.3.2.2 skrll } 1687 1.3.2.2 skrll if (filter->pfrt_anchor[0]) { 1688 1.3.2.2 skrll ac = pf_find_anchor(filter->pfrt_anchor); 1689 1.3.2.2 skrll return ((ac != NULL) ? ac->tables : -1); 1690 1.3.2.2 skrll } 1691 1.3.2.2 skrll return (pf_main_ruleset.tables); 1692 1.3.2.2 skrll } 1693 1.3.2.2 skrll 1694 1.3.2.2 skrll int 1695 1.3.2.2 skrll pfr_skip_table(struct pfr_table *filter, struct pfr_ktable *kt, int flags) 1696 1.3.2.2 skrll { 1697 1.3.2.2 skrll if (flags & PFR_FLAG_ALLRSETS) 1698 1.3.2.2 skrll return (0); 1699 1.3.2.2 skrll if (strncmp(filter->pfrt_anchor, kt->pfrkt_anchor, 1700 1.3.2.2 skrll PF_ANCHOR_NAME_SIZE)) 1701 1.3.2.2 skrll return (1); 1702 1.3.2.2 skrll if (!filter->pfrt_ruleset[0]) 1703 1.3.2.2 skrll return (0); 1704 1.3.2.2 skrll if (strncmp(filter->pfrt_ruleset, kt->pfrkt_ruleset, 1705 1.3.2.2 skrll PF_RULESET_NAME_SIZE)) 1706 1.3.2.2 skrll return (1); 1707 1.3.2.2 skrll return (0); 1708 1.3.2.2 skrll } 1709 1.3.2.2 skrll 1710 1.3.2.2 skrll void 1711 1.3.2.2 skrll pfr_insert_ktables(struct pfr_ktableworkq *workq) 1712 1.3.2.2 skrll { 1713 1.3.2.2 skrll struct pfr_ktable *p; 1714 1.3.2.2 skrll 1715 1.3.2.2 skrll SLIST_FOREACH(p, workq, pfrkt_workq) 1716 1.3.2.2 skrll pfr_insert_ktable(p); 1717 1.3.2.2 skrll } 1718 1.3.2.2 skrll 1719 1.3.2.2 skrll void 1720 1.3.2.2 skrll pfr_insert_ktable(struct pfr_ktable *kt) 1721 1.3.2.2 skrll { 1722 1.3.2.2 skrll RB_INSERT(pfr_ktablehead, &pfr_ktables, kt); 1723 1.3.2.2 skrll pfr_ktable_cnt++; 1724 1.3.2.2 skrll if (kt->pfrkt_root != NULL) 1725 1.3.2.2 skrll if (!kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]++) 1726 1.3.2.2 skrll pfr_setflags_ktable(kt->pfrkt_root, 1727 1.3.2.2 skrll kt->pfrkt_root->pfrkt_flags|PFR_TFLAG_REFDANCHOR); 1728 1.3.2.2 skrll } 1729 1.3.2.2 skrll 1730 1.3.2.2 skrll void 1731 1.3.2.2 skrll pfr_setflags_ktables(struct pfr_ktableworkq *workq) 1732 1.3.2.2 skrll { 1733 1.3.2.3 skrll struct pfr_ktable *p, *q; 1734 1.3.2.2 skrll 1735 1.3.2.3 skrll for (p = SLIST_FIRST(workq); p; p = q) { 1736 1.3.2.3 skrll q = SLIST_NEXT(p, pfrkt_workq); 1737 1.3.2.2 skrll pfr_setflags_ktable(p, p->pfrkt_nflags); 1738 1.3.2.3 skrll } 1739 1.3.2.2 skrll } 1740 1.3.2.2 skrll 1741 1.3.2.2 skrll void 1742 1.3.2.2 skrll pfr_setflags_ktable(struct pfr_ktable *kt, int newf) 1743 1.3.2.2 skrll { 1744 1.3.2.2 skrll struct pfr_kentryworkq addrq; 1745 1.3.2.2 skrll 1746 1.3.2.2 skrll if (!(newf & PFR_TFLAG_REFERENCED) && 1747 1.3.2.2 skrll !(newf & PFR_TFLAG_PERSIST)) 1748 1.3.2.2 skrll newf &= ~PFR_TFLAG_ACTIVE; 1749 1.3.2.2 skrll if (!(newf & PFR_TFLAG_ACTIVE)) 1750 1.3.2.2 skrll newf &= ~PFR_TFLAG_USRMASK; 1751 1.3.2.2 skrll if (!(newf & PFR_TFLAG_SETMASK)) { 1752 1.3.2.2 skrll RB_REMOVE(pfr_ktablehead, &pfr_ktables, kt); 1753 1.3.2.2 skrll if (kt->pfrkt_root != NULL) 1754 1.3.2.2 skrll if (!--kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]) 1755 1.3.2.2 skrll pfr_setflags_ktable(kt->pfrkt_root, 1756 1.3.2.2 skrll kt->pfrkt_root->pfrkt_flags & 1757 1.3.2.2 skrll ~PFR_TFLAG_REFDANCHOR); 1758 1.3.2.2 skrll pfr_destroy_ktable(kt, 1); 1759 1.3.2.2 skrll pfr_ktable_cnt--; 1760 1.3.2.2 skrll return; 1761 1.3.2.2 skrll } 1762 1.3.2.2 skrll if (!(newf & PFR_TFLAG_ACTIVE) && kt->pfrkt_cnt) { 1763 1.3.2.2 skrll pfr_enqueue_addrs(kt, &addrq, NULL, 0); 1764 1.3.2.2 skrll pfr_remove_kentries(kt, &addrq); 1765 1.3.2.2 skrll } 1766 1.3.2.2 skrll if (!(newf & PFR_TFLAG_INACTIVE) && kt->pfrkt_shadow != NULL) { 1767 1.3.2.2 skrll pfr_destroy_ktable(kt->pfrkt_shadow, 1); 1768 1.3.2.2 skrll kt->pfrkt_shadow = NULL; 1769 1.3.2.2 skrll } 1770 1.3.2.2 skrll kt->pfrkt_flags = newf; 1771 1.3.2.2 skrll } 1772 1.3.2.2 skrll 1773 1.3.2.2 skrll void 1774 1.3.2.2 skrll pfr_clstats_ktables(struct pfr_ktableworkq *workq, long tzero, int recurse) 1775 1.3.2.2 skrll { 1776 1.3.2.2 skrll struct pfr_ktable *p; 1777 1.3.2.2 skrll 1778 1.3.2.2 skrll SLIST_FOREACH(p, workq, pfrkt_workq) 1779 1.3.2.2 skrll pfr_clstats_ktable(p, tzero, recurse); 1780 1.3.2.2 skrll } 1781 1.3.2.2 skrll 1782 1.3.2.2 skrll void 1783 1.3.2.2 skrll pfr_clstats_ktable(struct pfr_ktable *kt, long tzero, int recurse) 1784 1.3.2.2 skrll { 1785 1.3.2.2 skrll struct pfr_kentryworkq addrq; 1786 1.3.2.2 skrll int s; 1787 1.3.2.2 skrll 1788 1.3.2.2 skrll if (recurse) { 1789 1.3.2.2 skrll pfr_enqueue_addrs(kt, &addrq, NULL, 0); 1790 1.3.2.2 skrll pfr_clstats_kentries(&addrq, tzero, 0); 1791 1.3.2.2 skrll } 1792 1.3.2.2 skrll s = splsoftnet(); 1793 1.3.2.2 skrll bzero(kt->pfrkt_packets, sizeof(kt->pfrkt_packets)); 1794 1.3.2.2 skrll bzero(kt->pfrkt_bytes, sizeof(kt->pfrkt_bytes)); 1795 1.3.2.2 skrll kt->pfrkt_match = kt->pfrkt_nomatch = 0; 1796 1.3.2.2 skrll splx(s); 1797 1.3.2.2 skrll kt->pfrkt_tzero = tzero; 1798 1.3.2.2 skrll } 1799 1.3.2.2 skrll 1800 1.3.2.2 skrll struct pfr_ktable * 1801 1.3.2.2 skrll pfr_create_ktable(struct pfr_table *tbl, long tzero, int attachruleset) 1802 1.3.2.2 skrll { 1803 1.3.2.2 skrll struct pfr_ktable *kt; 1804 1.3.2.2 skrll struct pf_ruleset *rs; 1805 1.3.2.2 skrll 1806 1.3.2.2 skrll kt = pool_get(&pfr_ktable_pl, PR_NOWAIT); 1807 1.3.2.2 skrll if (kt == NULL) 1808 1.3.2.2 skrll return (NULL); 1809 1.3.2.2 skrll bzero(kt, sizeof(*kt)); 1810 1.3.2.2 skrll kt->pfrkt_t = *tbl; 1811 1.3.2.2 skrll 1812 1.3.2.2 skrll if (attachruleset) { 1813 1.3.2.2 skrll rs = pf_find_or_create_ruleset(tbl->pfrt_anchor, 1814 1.3.2.2 skrll tbl->pfrt_ruleset); 1815 1.3.2.2 skrll if (!rs) { 1816 1.3.2.2 skrll pfr_destroy_ktable(kt, 0); 1817 1.3.2.2 skrll return (NULL); 1818 1.3.2.2 skrll } 1819 1.3.2.2 skrll kt->pfrkt_rs = rs; 1820 1.3.2.2 skrll rs->tables++; 1821 1.3.2.2 skrll if (rs->anchor != NULL) 1822 1.3.2.2 skrll rs->anchor->tables++; 1823 1.3.2.2 skrll } 1824 1.3.2.2 skrll 1825 1.3.2.2 skrll if (!rn_inithead((void **)&kt->pfrkt_ip4, 1826 1.3.2.2 skrll offsetof(struct sockaddr_in, sin_addr) * 8) || 1827 1.3.2.2 skrll !rn_inithead((void **)&kt->pfrkt_ip6, 1828 1.3.2.2 skrll offsetof(struct sockaddr_in6, sin6_addr) * 8)) { 1829 1.3.2.2 skrll pfr_destroy_ktable(kt, 0); 1830 1.3.2.2 skrll return (NULL); 1831 1.3.2.2 skrll } 1832 1.3.2.2 skrll kt->pfrkt_tzero = tzero; 1833 1.3.2.2 skrll 1834 1.3.2.2 skrll return (kt); 1835 1.3.2.2 skrll } 1836 1.3.2.2 skrll 1837 1.3.2.2 skrll void 1838 1.3.2.2 skrll pfr_destroy_ktables(struct pfr_ktableworkq *workq, int flushaddr) 1839 1.3.2.2 skrll { 1840 1.3.2.2 skrll struct pfr_ktable *p, *q; 1841 1.3.2.2 skrll 1842 1.3.2.2 skrll for (p = SLIST_FIRST(workq); p; p = q) { 1843 1.3.2.2 skrll q = SLIST_NEXT(p, pfrkt_workq); 1844 1.3.2.2 skrll pfr_destroy_ktable(p, flushaddr); 1845 1.3.2.2 skrll } 1846 1.3.2.2 skrll } 1847 1.3.2.2 skrll 1848 1.3.2.2 skrll void 1849 1.3.2.2 skrll pfr_destroy_ktable(struct pfr_ktable *kt, int flushaddr) 1850 1.3.2.2 skrll { 1851 1.3.2.2 skrll struct pfr_kentryworkq addrq; 1852 1.3.2.2 skrll 1853 1.3.2.2 skrll if (flushaddr) { 1854 1.3.2.2 skrll pfr_enqueue_addrs(kt, &addrq, NULL, 0); 1855 1.3.2.2 skrll pfr_clean_node_mask(kt, &addrq); 1856 1.3.2.2 skrll pfr_destroy_kentries(&addrq); 1857 1.3.2.2 skrll } 1858 1.3.2.2 skrll if (kt->pfrkt_ip4 != NULL) 1859 1.3.2.2 skrll free((caddr_t)kt->pfrkt_ip4, M_RTABLE); 1860 1.3.2.2 skrll if (kt->pfrkt_ip6 != NULL) 1861 1.3.2.2 skrll free((caddr_t)kt->pfrkt_ip6, M_RTABLE); 1862 1.3.2.2 skrll if (kt->pfrkt_shadow != NULL) 1863 1.3.2.2 skrll pfr_destroy_ktable(kt->pfrkt_shadow, flushaddr); 1864 1.3.2.2 skrll if (kt->pfrkt_rs != NULL) { 1865 1.3.2.2 skrll kt->pfrkt_rs->tables--; 1866 1.3.2.2 skrll if (kt->pfrkt_rs->anchor != NULL) 1867 1.3.2.2 skrll kt->pfrkt_rs->anchor->tables--; 1868 1.3.2.2 skrll pf_remove_if_empty_ruleset(kt->pfrkt_rs); 1869 1.3.2.2 skrll } 1870 1.3.2.2 skrll pool_put(&pfr_ktable_pl, kt); 1871 1.3.2.2 skrll } 1872 1.3.2.2 skrll 1873 1.3.2.2 skrll int 1874 1.3.2.2 skrll pfr_ktable_compare(struct pfr_ktable *p, struct pfr_ktable *q) 1875 1.3.2.2 skrll { 1876 1.3.2.2 skrll int d; 1877 1.3.2.2 skrll 1878 1.3.2.2 skrll if ((d = strncmp(p->pfrkt_name, q->pfrkt_name, PF_TABLE_NAME_SIZE))) 1879 1.3.2.2 skrll return (d); 1880 1.3.2.2 skrll if ((d = strncmp(p->pfrkt_anchor, q->pfrkt_anchor, 1881 1.3.2.2 skrll PF_ANCHOR_NAME_SIZE))) 1882 1.3.2.2 skrll return (d); 1883 1.3.2.2 skrll return (strncmp(p->pfrkt_ruleset, q->pfrkt_ruleset, 1884 1.3.2.2 skrll PF_RULESET_NAME_SIZE)); 1885 1.3.2.2 skrll } 1886 1.3.2.2 skrll 1887 1.3.2.2 skrll struct pfr_ktable * 1888 1.3.2.2 skrll pfr_lookup_table(struct pfr_table *tbl) 1889 1.3.2.2 skrll { 1890 1.3.2.2 skrll /* struct pfr_ktable start like a struct pfr_table */ 1891 1.3.2.2 skrll return (RB_FIND(pfr_ktablehead, &pfr_ktables, 1892 1.3.2.2 skrll (struct pfr_ktable *)tbl)); 1893 1.3.2.2 skrll } 1894 1.3.2.2 skrll 1895 1.3.2.2 skrll int 1896 1.3.2.2 skrll pfr_match_addr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af) 1897 1.3.2.2 skrll { 1898 1.3.2.2 skrll struct pfr_kentry *ke = NULL; 1899 1.3.2.2 skrll int match; 1900 1.3.2.2 skrll 1901 1.3.2.2 skrll if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) 1902 1.3.2.2 skrll kt = kt->pfrkt_root; 1903 1.3.2.2 skrll if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 1904 1.3.2.2 skrll return (0); 1905 1.3.2.2 skrll 1906 1.3.2.2 skrll switch (af) { 1907 1.3.2.2 skrll case AF_INET: 1908 1.3.2.2 skrll pfr_sin.sin_addr.s_addr = a->addr32[0]; 1909 1.3.2.2 skrll ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4); 1910 1.3.2.2 skrll if (ke && KENTRY_RNF_ROOT(ke)) 1911 1.3.2.2 skrll ke = NULL; 1912 1.3.2.2 skrll break; 1913 1.3.2.2 skrll case AF_INET6: 1914 1.3.2.2 skrll bcopy(a, &pfr_sin6.sin6_addr, sizeof(pfr_sin6.sin6_addr)); 1915 1.3.2.2 skrll ke = (struct pfr_kentry *)rn_match(&pfr_sin6, kt->pfrkt_ip6); 1916 1.3.2.2 skrll if (ke && KENTRY_RNF_ROOT(ke)) 1917 1.3.2.2 skrll ke = NULL; 1918 1.3.2.2 skrll break; 1919 1.3.2.2 skrll } 1920 1.3.2.2 skrll match = (ke && !ke->pfrke_not); 1921 1.3.2.2 skrll if (match) 1922 1.3.2.2 skrll kt->pfrkt_match++; 1923 1.3.2.2 skrll else 1924 1.3.2.2 skrll kt->pfrkt_nomatch++; 1925 1.3.2.2 skrll return (match); 1926 1.3.2.2 skrll } 1927 1.3.2.2 skrll 1928 1.3.2.2 skrll void 1929 1.3.2.2 skrll pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af, 1930 1.3.2.2 skrll u_int64_t len, int dir_out, int op_pass, int notrule) 1931 1.3.2.2 skrll { 1932 1.3.2.2 skrll struct pfr_kentry *ke = NULL; 1933 1.3.2.2 skrll 1934 1.3.2.2 skrll if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) 1935 1.3.2.2 skrll kt = kt->pfrkt_root; 1936 1.3.2.2 skrll if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 1937 1.3.2.2 skrll return; 1938 1.3.2.2 skrll 1939 1.3.2.2 skrll switch (af) { 1940 1.3.2.2 skrll case AF_INET: 1941 1.3.2.2 skrll pfr_sin.sin_addr.s_addr = a->addr32[0]; 1942 1.3.2.2 skrll ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4); 1943 1.3.2.2 skrll if (ke && KENTRY_RNF_ROOT(ke)) 1944 1.3.2.2 skrll ke = NULL; 1945 1.3.2.2 skrll break; 1946 1.3.2.2 skrll case AF_INET6: 1947 1.3.2.2 skrll bcopy(a, &pfr_sin6.sin6_addr, sizeof(pfr_sin6.sin6_addr)); 1948 1.3.2.2 skrll ke = (struct pfr_kentry *)rn_match(&pfr_sin6, kt->pfrkt_ip6); 1949 1.3.2.2 skrll if (ke && KENTRY_RNF_ROOT(ke)) 1950 1.3.2.2 skrll ke = NULL; 1951 1.3.2.2 skrll break; 1952 1.3.2.2 skrll } 1953 1.3.2.2 skrll if ((ke == NULL || ke->pfrke_not) != notrule) { 1954 1.3.2.2 skrll if (op_pass != PFR_OP_PASS) 1955 1.3.2.2 skrll printf("pfr_update_stats: assertion failed.\n"); 1956 1.3.2.2 skrll op_pass = PFR_OP_XPASS; 1957 1.3.2.2 skrll } 1958 1.3.2.2 skrll kt->pfrkt_packets[dir_out][op_pass]++; 1959 1.3.2.2 skrll kt->pfrkt_bytes[dir_out][op_pass] += len; 1960 1.3.2.2 skrll if (ke != NULL && op_pass != PFR_OP_XPASS) { 1961 1.3.2.2 skrll ke->pfrke_packets[dir_out][op_pass]++; 1962 1.3.2.2 skrll ke->pfrke_bytes[dir_out][op_pass] += len; 1963 1.3.2.2 skrll } 1964 1.3.2.2 skrll } 1965 1.3.2.2 skrll 1966 1.3.2.2 skrll struct pfr_ktable * 1967 1.3.2.2 skrll pfr_attach_table(struct pf_ruleset *rs, char *name) 1968 1.3.2.2 skrll { 1969 1.3.2.2 skrll struct pfr_ktable *kt, *rt; 1970 1.3.2.2 skrll struct pfr_table tbl; 1971 1.3.2.2 skrll struct pf_anchor *ac = rs->anchor; 1972 1.3.2.2 skrll 1973 1.3.2.2 skrll bzero(&tbl, sizeof(tbl)); 1974 1.3.2.2 skrll strlcpy(tbl.pfrt_name, name, sizeof(tbl.pfrt_name)); 1975 1.3.2.2 skrll if (ac != NULL) { 1976 1.3.2.2 skrll strlcpy(tbl.pfrt_anchor, ac->name, sizeof(tbl.pfrt_anchor)); 1977 1.3.2.2 skrll strlcpy(tbl.pfrt_ruleset, rs->name, sizeof(tbl.pfrt_ruleset)); 1978 1.3.2.2 skrll } 1979 1.3.2.2 skrll kt = pfr_lookup_table(&tbl); 1980 1.3.2.2 skrll if (kt == NULL) { 1981 1.3.2.2 skrll kt = pfr_create_ktable(&tbl, time.tv_sec, 1); 1982 1.3.2.2 skrll if (kt == NULL) 1983 1.3.2.2 skrll return (NULL); 1984 1.3.2.2 skrll if (ac != NULL) { 1985 1.3.2.2 skrll bzero(tbl.pfrt_anchor, sizeof(tbl.pfrt_anchor)); 1986 1.3.2.2 skrll bzero(tbl.pfrt_ruleset, sizeof(tbl.pfrt_ruleset)); 1987 1.3.2.2 skrll rt = pfr_lookup_table(&tbl); 1988 1.3.2.2 skrll if (rt == NULL) { 1989 1.3.2.2 skrll rt = pfr_create_ktable(&tbl, 0, 1); 1990 1.3.2.2 skrll if (rt == NULL) { 1991 1.3.2.2 skrll pfr_destroy_ktable(kt, 0); 1992 1.3.2.2 skrll return (NULL); 1993 1.3.2.2 skrll } 1994 1.3.2.2 skrll pfr_insert_ktable(rt); 1995 1.3.2.2 skrll } 1996 1.3.2.2 skrll kt->pfrkt_root = rt; 1997 1.3.2.2 skrll } 1998 1.3.2.2 skrll pfr_insert_ktable(kt); 1999 1.3.2.2 skrll } 2000 1.3.2.2 skrll if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++) 2001 1.3.2.2 skrll pfr_setflags_ktable(kt, kt->pfrkt_flags|PFR_TFLAG_REFERENCED); 2002 1.3.2.2 skrll return (kt); 2003 1.3.2.2 skrll } 2004 1.3.2.2 skrll 2005 1.3.2.2 skrll void 2006 1.3.2.2 skrll pfr_detach_table(struct pfr_ktable *kt) 2007 1.3.2.2 skrll { 2008 1.3.2.2 skrll if (kt->pfrkt_refcnt[PFR_REFCNT_RULE] <= 0) 2009 1.3.2.2 skrll printf("pfr_detach_table: refcount = %d.\n", 2010 1.3.2.2 skrll kt->pfrkt_refcnt[PFR_REFCNT_RULE]); 2011 1.3.2.2 skrll else if (!--kt->pfrkt_refcnt[PFR_REFCNT_RULE]) 2012 1.3.2.2 skrll pfr_setflags_ktable(kt, kt->pfrkt_flags&~PFR_TFLAG_REFERENCED); 2013 1.3.2.2 skrll } 2014 1.3.2.2 skrll 2015 1.3.2.2 skrll int 2016 1.3.2.2 skrll pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter, 2017 1.3.2.2 skrll struct pf_addr **raddr, struct pf_addr **rmask, sa_family_t af) 2018 1.3.2.2 skrll { 2019 1.3.2.2 skrll struct pfr_kentry *ke, *ke2; 2020 1.3.2.2 skrll struct pf_addr *addr; 2021 1.3.2.2 skrll union sockaddr_union mask; 2022 1.3.2.2 skrll int idx = -1, use_counter = 0; 2023 1.3.2.2 skrll 2024 1.3.2.2 skrll addr = (af == AF_INET) ? (struct pf_addr *)&pfr_sin.sin_addr : 2025 1.3.2.2 skrll (struct pf_addr *)&pfr_sin6.sin6_addr; 2026 1.3.2.2 skrll if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) 2027 1.3.2.2 skrll kt = kt->pfrkt_root; 2028 1.3.2.2 skrll if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 2029 1.3.2.2 skrll return (-1); 2030 1.3.2.2 skrll 2031 1.3.2.2 skrll if (pidx != NULL) 2032 1.3.2.2 skrll idx = *pidx; 2033 1.3.2.2 skrll if (counter != NULL && idx >= 0) 2034 1.3.2.2 skrll use_counter = 1; 2035 1.3.2.2 skrll if (idx < 0) 2036 1.3.2.2 skrll idx = 0; 2037 1.3.2.2 skrll 2038 1.3.2.2 skrll _next_block: 2039 1.3.2.2 skrll ke = pfr_kentry_byidx(kt, idx, af); 2040 1.3.2.2 skrll if (ke == NULL) 2041 1.3.2.2 skrll return (1); 2042 1.3.2.2 skrll pfr_prepare_network(&pfr_mask, af, ke->pfrke_net); 2043 1.3.2.2 skrll *raddr = SUNION2PF(&ke->pfrke_sa, af); 2044 1.3.2.2 skrll *rmask = SUNION2PF(&pfr_mask, af); 2045 1.3.2.2 skrll 2046 1.3.2.2 skrll if (use_counter) { 2047 1.3.2.2 skrll /* is supplied address within block? */ 2048 1.3.2.2 skrll if (!PF_MATCHA(0, *raddr, *rmask, counter, af)) { 2049 1.3.2.2 skrll /* no, go to next block in table */ 2050 1.3.2.2 skrll idx++; 2051 1.3.2.2 skrll use_counter = 0; 2052 1.3.2.2 skrll goto _next_block; 2053 1.3.2.2 skrll } 2054 1.3.2.2 skrll PF_ACPY(addr, counter, af); 2055 1.3.2.2 skrll } else { 2056 1.3.2.2 skrll /* use first address of block */ 2057 1.3.2.2 skrll PF_ACPY(addr, *raddr, af); 2058 1.3.2.2 skrll } 2059 1.3.2.2 skrll 2060 1.3.2.2 skrll if (!KENTRY_NETWORK(ke)) { 2061 1.3.2.2 skrll /* this is a single IP address - no possible nested block */ 2062 1.3.2.2 skrll PF_ACPY(counter, addr, af); 2063 1.3.2.2 skrll *pidx = idx; 2064 1.3.2.2 skrll return (0); 2065 1.3.2.2 skrll } 2066 1.3.2.2 skrll for (;;) { 2067 1.3.2.2 skrll /* we don't want to use a nested block */ 2068 1.3.2.2 skrll ke2 = (struct pfr_kentry *)(af == AF_INET ? 2069 1.3.2.2 skrll rn_match(&pfr_sin, kt->pfrkt_ip4) : 2070 1.3.2.2 skrll rn_match(&pfr_sin6, kt->pfrkt_ip6)); 2071 1.3.2.2 skrll /* no need to check KENTRY_RNF_ROOT() here */ 2072 1.3.2.2 skrll if (ke2 == ke) { 2073 1.3.2.2 skrll /* lookup return the same block - perfect */ 2074 1.3.2.2 skrll PF_ACPY(counter, addr, af); 2075 1.3.2.2 skrll *pidx = idx; 2076 1.3.2.2 skrll return (0); 2077 1.3.2.2 skrll } 2078 1.3.2.2 skrll 2079 1.3.2.2 skrll /* we need to increase the counter past the nested block */ 2080 1.3.2.2 skrll pfr_prepare_network(&mask, AF_INET, ke2->pfrke_net); 2081 1.3.2.2 skrll PF_POOLMASK(addr, addr, SUNION2PF(&mask, af), &pfr_ffaddr, af); 2082 1.3.2.2 skrll PF_AINC(addr, af); 2083 1.3.2.2 skrll if (!PF_MATCHA(0, *raddr, *rmask, addr, af)) { 2084 1.3.2.2 skrll /* ok, we reached the end of our main block */ 2085 1.3.2.2 skrll /* go to next block in table */ 2086 1.3.2.2 skrll idx++; 2087 1.3.2.2 skrll use_counter = 0; 2088 1.3.2.2 skrll goto _next_block; 2089 1.3.2.2 skrll } 2090 1.3.2.2 skrll } 2091 1.3.2.2 skrll } 2092 1.3.2.2 skrll 2093 1.3.2.2 skrll struct pfr_kentry * 2094 1.3.2.2 skrll pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af) 2095 1.3.2.2 skrll { 2096 1.3.2.2 skrll struct pfr_walktree w; 2097 1.3.2.2 skrll 2098 1.3.2.2 skrll bzero(&w, sizeof(w)); 2099 1.3.2.2 skrll w.pfrw_op = PFRW_POOL_GET; 2100 1.3.2.2 skrll w.pfrw_cnt = idx; 2101 1.3.2.2 skrll 2102 1.3.2.2 skrll switch (af) { 2103 1.3.2.2 skrll case AF_INET: 2104 1.3.2.2 skrll rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w); 2105 1.3.2.2 skrll return (w.pfrw_kentry); 2106 1.3.2.2 skrll case AF_INET6: 2107 1.3.2.2 skrll rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w); 2108 1.3.2.2 skrll return (w.pfrw_kentry); 2109 1.3.2.2 skrll default: 2110 1.3.2.2 skrll return (NULL); 2111 1.3.2.2 skrll } 2112 1.3.2.2 skrll } 2113 1.3.2.2 skrll 2114 1.3.2.2 skrll void 2115 1.3.2.2 skrll pfr_dynaddr_update(struct pfr_ktable *kt, struct pfi_dynaddr *dyn) 2116 1.3.2.2 skrll { 2117 1.3.2.2 skrll struct pfr_walktree w; 2118 1.3.2.2 skrll int s; 2119 1.3.2.2 skrll 2120 1.3.2.2 skrll bzero(&w, sizeof(w)); 2121 1.3.2.2 skrll w.pfrw_op = PFRW_DYNADDR_UPDATE; 2122 1.3.2.2 skrll w.pfrw_dyn = dyn; 2123 1.3.2.2 skrll 2124 1.3.2.2 skrll s = splsoftnet(); 2125 1.3.2.2 skrll dyn->pfid_acnt4 = 0; 2126 1.3.2.2 skrll dyn->pfid_acnt6 = 0; 2127 1.3.2.2 skrll if (!dyn->pfid_af || dyn->pfid_af == AF_INET) 2128 1.3.2.2 skrll rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w); 2129 1.3.2.2 skrll if (!dyn->pfid_af || dyn->pfid_af == AF_INET6) 2130 1.3.2.2 skrll rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w); 2131 1.3.2.2 skrll splx(s); 2132 1.3.2.2 skrll } 2133
Indexes created Thu Oct 02 01:09:59 GMT 2025