pf_table.c revision 1.3.2.6
1 1.3.2.6 skrll /* $NetBSD: pf_table.c,v 1.3.2.6 2005/11/10 14:09:08 skrll Exp $ */ 2 1.3.2.6 skrll /* $OpenBSD: pf_table.c,v 1.62 2004/12/07 18:02:04 mcbride Exp $ */ 3 1.3.2.2 skrll 4 1.3.2.2 skrll /* 5 1.3.2.2 skrll * Copyright (c) 2002 Cedric Berger 6 1.3.2.2 skrll * All rights reserved. 7 1.3.2.2 skrll * 8 1.3.2.2 skrll * Redistribution and use in source and binary forms, with or without 9 1.3.2.2 skrll * modification, are permitted provided that the following conditions 10 1.3.2.2 skrll * are met: 11 1.3.2.2 skrll * 12 1.3.2.2 skrll * - Redistributions of source code must retain the above copyright 13 1.3.2.2 skrll * notice, this list of conditions and the following disclaimer. 14 1.3.2.2 skrll * - Redistributions in binary form must reproduce the above 15 1.3.2.2 skrll * copyright notice, this list of conditions and the following 16 1.3.2.2 skrll * disclaimer in the documentation and/or other materials provided 17 1.3.2.2 skrll * with the distribution. 18 1.3.2.2 skrll * 19 1.3.2.2 skrll * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 20 1.3.2.2 skrll * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 21 1.3.2.2 skrll * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 22 1.3.2.2 skrll * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 23 1.3.2.2 skrll * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 24 1.3.2.2 skrll * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 25 1.3.2.2 skrll * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 1.3.2.2 skrll * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 27 1.3.2.2 skrll * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 1.3.2.2 skrll * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 29 1.3.2.2 skrll * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 1.3.2.2 skrll * POSSIBILITY OF SUCH DAMAGE. 31 1.3.2.2 skrll * 32 1.3.2.2 skrll */ 33 1.3.2.2 skrll 34 1.3.2.2 skrll #ifdef _KERNEL_OPT 35 1.3.2.2 skrll #include "opt_inet.h" 36 1.3.2.2 skrll #endif 37 1.3.2.2 skrll 38 1.3.2.2 skrll #include <sys/param.h> 39 1.3.2.2 skrll #include <sys/systm.h> 40 1.3.2.2 skrll #include <sys/socket.h> 41 1.3.2.2 skrll #include <sys/mbuf.h> 42 1.3.2.2 skrll #include <sys/kernel.h> 43 1.3.2.2 skrll 44 1.3.2.2 skrll #include <net/if.h> 45 1.3.2.2 skrll #include <net/route.h> 46 1.3.2.2 skrll #include <netinet/in.h> 47 1.3.2.2 skrll #ifdef __OpenBSD__ 48 1.3.2.2 skrll #include <netinet/ip_ipsp.h> 49 1.3.2.2 skrll #endif 50 1.3.2.2 skrll #include <net/pfvar.h> 51 1.3.2.2 skrll 52 1.3.2.2 skrll #define ACCEPT_FLAGS(oklist) \ 53 1.3.2.2 skrll do { \ 54 1.3.2.2 skrll if ((flags & ~(oklist)) & \ 55 1.3.2.2 skrll PFR_FLAG_ALLMASK) \ 56 1.3.2.2 skrll return (EINVAL); \ 57 1.3.2.2 skrll } while (0) 58 1.3.2.2 skrll 59 1.3.2.2 skrll #define COPYIN(from, to, size) \ 60 1.3.2.2 skrll ((flags & PFR_FLAG_USERIOCTL) ? \ 61 1.3.2.2 skrll copyin((from), (to), (size)) : \ 62 1.3.2.2 skrll (bcopy((from), (to), (size)), 0)) 63 1.3.2.2 skrll 64 1.3.2.2 skrll #define COPYOUT(from, to, size) \ 65 1.3.2.2 skrll ((flags & PFR_FLAG_USERIOCTL) ? \ 66 1.3.2.2 skrll copyout((from), (to), (size)) : \ 67 1.3.2.2 skrll (bcopy((from), (to), (size)), 0)) 68 1.3.2.2 skrll 69 1.3.2.2 skrll #define FILLIN_SIN(sin, addr) \ 70 1.3.2.2 skrll do { \ 71 1.3.2.2 skrll (sin).sin_len = sizeof(sin); \ 72 1.3.2.2 skrll (sin).sin_family = AF_INET; \ 73 1.3.2.2 skrll (sin).sin_addr = (addr); \ 74 1.3.2.2 skrll } while (0) 75 1.3.2.2 skrll 76 1.3.2.2 skrll #define FILLIN_SIN6(sin6, addr) \ 77 1.3.2.2 skrll do { \ 78 1.3.2.2 skrll (sin6).sin6_len = sizeof(sin6); \ 79 1.3.2.2 skrll (sin6).sin6_family = AF_INET6; \ 80 1.3.2.2 skrll (sin6).sin6_addr = (addr); \ 81 1.3.2.2 skrll } while (0) 82 1.3.2.2 skrll 83 1.3.2.2 skrll #define SWAP(type, a1, a2) \ 84 1.3.2.2 skrll do { \ 85 1.3.2.2 skrll type tmp = a1; \ 86 1.3.2.2 skrll a1 = a2; \ 87 1.3.2.2 skrll a2 = tmp; \ 88 1.3.2.2 skrll } while (0) 89 1.3.2.2 skrll 90 1.3.2.2 skrll #define SUNION2PF(su, af) (((af)==AF_INET) ? \ 91 1.3.2.2 skrll (struct pf_addr *)&(su)->sin.sin_addr : \ 92 1.3.2.2 skrll (struct pf_addr *)&(su)->sin6.sin6_addr) 93 1.3.2.2 skrll 94 1.3.2.2 skrll #define AF_BITS(af) (((af)==AF_INET)?32:128) 95 1.3.2.2 skrll #define ADDR_NETWORK(ad) ((ad)->pfra_net < AF_BITS((ad)->pfra_af)) 96 1.3.2.2 skrll #define KENTRY_NETWORK(ke) ((ke)->pfrke_net < AF_BITS((ke)->pfrke_af)) 97 1.3.2.2 skrll #define KENTRY_RNF_ROOT(ke) \ 98 1.3.2.2 skrll ((((struct radix_node *)(ke))->rn_flags & RNF_ROOT) != 0) 99 1.3.2.2 skrll 100 1.3.2.2 skrll #define NO_ADDRESSES (-1) 101 1.3.2.2 skrll #define ENQUEUE_UNMARKED_ONLY (1) 102 1.3.2.2 skrll #define INVERT_NEG_FLAG (1) 103 1.3.2.2 skrll 104 1.3.2.2 skrll struct pfr_walktree { 105 1.3.2.2 skrll enum pfrw_op { 106 1.3.2.2 skrll PFRW_MARK, 107 1.3.2.2 skrll PFRW_SWEEP, 108 1.3.2.2 skrll PFRW_ENQUEUE, 109 1.3.2.2 skrll PFRW_GET_ADDRS, 110 1.3.2.2 skrll PFRW_GET_ASTATS, 111 1.3.2.2 skrll PFRW_POOL_GET, 112 1.3.2.2 skrll PFRW_DYNADDR_UPDATE 113 1.3.2.2 skrll } pfrw_op; 114 1.3.2.2 skrll union { 115 1.3.2.2 skrll struct pfr_addr *pfrw1_addr; 116 1.3.2.2 skrll struct pfr_astats *pfrw1_astats; 117 1.3.2.2 skrll struct pfr_kentryworkq *pfrw1_workq; 118 1.3.2.2 skrll struct pfr_kentry *pfrw1_kentry; 119 1.3.2.2 skrll struct pfi_dynaddr *pfrw1_dyn; 120 1.3.2.2 skrll } pfrw_1; 121 1.3.2.2 skrll int pfrw_free; 122 1.3.2.2 skrll int pfrw_flags; 123 1.3.2.2 skrll }; 124 1.3.2.2 skrll #define pfrw_addr pfrw_1.pfrw1_addr 125 1.3.2.2 skrll #define pfrw_astats pfrw_1.pfrw1_astats 126 1.3.2.2 skrll #define pfrw_workq pfrw_1.pfrw1_workq 127 1.3.2.2 skrll #define pfrw_kentry pfrw_1.pfrw1_kentry 128 1.3.2.2 skrll #define pfrw_dyn pfrw_1.pfrw1_dyn 129 1.3.2.2 skrll #define pfrw_cnt pfrw_free 130 1.3.2.2 skrll 131 1.3.2.2 skrll #define senderr(e) do { rv = (e); goto _bad; } while (0) 132 1.3.2.2 skrll 133 1.3.2.2 skrll struct pool pfr_ktable_pl; 134 1.3.2.2 skrll struct pool pfr_kentry_pl; 135 1.3.2.6 skrll struct pool pfr_kentry_pl2; 136 1.3.2.2 skrll struct sockaddr_in pfr_sin; 137 1.3.2.2 skrll struct sockaddr_in6 pfr_sin6; 138 1.3.2.2 skrll union sockaddr_union pfr_mask; 139 1.3.2.2 skrll struct pf_addr pfr_ffaddr; 140 1.3.2.2 skrll 141 1.3.2.2 skrll void pfr_copyout_addr(struct pfr_addr *, 142 1.3.2.2 skrll struct pfr_kentry *ke); 143 1.3.2.2 skrll int pfr_validate_addr(struct pfr_addr *); 144 1.3.2.2 skrll void pfr_enqueue_addrs(struct pfr_ktable *, 145 1.3.2.2 skrll struct pfr_kentryworkq *, int *, int); 146 1.3.2.2 skrll void pfr_mark_addrs(struct pfr_ktable *); 147 1.3.2.2 skrll struct pfr_kentry *pfr_lookup_addr(struct pfr_ktable *, 148 1.3.2.2 skrll struct pfr_addr *, int); 149 1.3.2.6 skrll struct pfr_kentry *pfr_create_kentry(struct pfr_addr *, int); 150 1.3.2.2 skrll void pfr_destroy_kentries(struct pfr_kentryworkq *); 151 1.3.2.2 skrll void pfr_destroy_kentry(struct pfr_kentry *); 152 1.3.2.2 skrll void pfr_insert_kentries(struct pfr_ktable *, 153 1.3.2.2 skrll struct pfr_kentryworkq *, long); 154 1.3.2.2 skrll void pfr_remove_kentries(struct pfr_ktable *, 155 1.3.2.2 skrll struct pfr_kentryworkq *); 156 1.3.2.2 skrll void pfr_clstats_kentries(struct pfr_kentryworkq *, long, 157 1.3.2.2 skrll int); 158 1.3.2.2 skrll void pfr_reset_feedback(struct pfr_addr *, int, int); 159 1.3.2.2 skrll void pfr_prepare_network(union sockaddr_union *, int, int); 160 1.3.2.2 skrll int pfr_route_kentry(struct pfr_ktable *, 161 1.3.2.2 skrll struct pfr_kentry *); 162 1.3.2.2 skrll int pfr_unroute_kentry(struct pfr_ktable *, 163 1.3.2.2 skrll struct pfr_kentry *); 164 1.3.2.2 skrll int pfr_walktree(struct radix_node *, void *); 165 1.3.2.2 skrll int pfr_validate_table(struct pfr_table *, int, int); 166 1.3.2.6 skrll int pfr_fix_anchor(char *); 167 1.3.2.2 skrll void pfr_commit_ktable(struct pfr_ktable *, long); 168 1.3.2.2 skrll void pfr_insert_ktables(struct pfr_ktableworkq *); 169 1.3.2.2 skrll void pfr_insert_ktable(struct pfr_ktable *); 170 1.3.2.2 skrll void pfr_setflags_ktables(struct pfr_ktableworkq *); 171 1.3.2.2 skrll void pfr_setflags_ktable(struct pfr_ktable *, int); 172 1.3.2.2 skrll void pfr_clstats_ktables(struct pfr_ktableworkq *, long, 173 1.3.2.2 skrll int); 174 1.3.2.2 skrll void pfr_clstats_ktable(struct pfr_ktable *, long, int); 175 1.3.2.2 skrll struct pfr_ktable *pfr_create_ktable(struct pfr_table *, long, int); 176 1.3.2.2 skrll void pfr_destroy_ktables(struct pfr_ktableworkq *, int); 177 1.3.2.2 skrll void pfr_destroy_ktable(struct pfr_ktable *, int); 178 1.3.2.2 skrll int pfr_ktable_compare(struct pfr_ktable *, 179 1.3.2.2 skrll struct pfr_ktable *); 180 1.3.2.2 skrll struct pfr_ktable *pfr_lookup_table(struct pfr_table *); 181 1.3.2.2 skrll void pfr_clean_node_mask(struct pfr_ktable *, 182 1.3.2.2 skrll struct pfr_kentryworkq *); 183 1.3.2.2 skrll int pfr_table_count(struct pfr_table *, int); 184 1.3.2.2 skrll int pfr_skip_table(struct pfr_table *, 185 1.3.2.2 skrll struct pfr_ktable *, int); 186 1.3.2.2 skrll struct pfr_kentry *pfr_kentry_byidx(struct pfr_ktable *, int, int); 187 1.3.2.2 skrll 188 1.3.2.2 skrll RB_PROTOTYPE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare); 189 1.3.2.2 skrll RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare); 190 1.3.2.2 skrll 191 1.3.2.2 skrll struct pfr_ktablehead pfr_ktables; 192 1.3.2.2 skrll struct pfr_table pfr_nulltable; 193 1.3.2.2 skrll int pfr_ktable_cnt; 194 1.3.2.2 skrll 195 1.3.2.2 skrll void 196 1.3.2.2 skrll pfr_initialize(void) 197 1.3.2.2 skrll { 198 1.3.2.2 skrll pool_init(&pfr_ktable_pl, sizeof(struct pfr_ktable), 0, 0, 0, 199 1.3.2.5 skrll "pfrktable", &pool_allocator_oldnointr); 200 1.3.2.2 skrll pool_init(&pfr_kentry_pl, sizeof(struct pfr_kentry), 0, 0, 0, 201 1.3.2.5 skrll "pfrkentry", &pool_allocator_oldnointr); 202 1.3.2.6 skrll pool_init(&pfr_kentry_pl2, sizeof(struct pfr_kentry), 0, 0, 0, 203 1.3.2.6 skrll "pfrkentry2", NULL); 204 1.3.2.2 skrll 205 1.3.2.2 skrll pfr_sin.sin_len = sizeof(pfr_sin); 206 1.3.2.2 skrll pfr_sin.sin_family = AF_INET; 207 1.3.2.2 skrll pfr_sin6.sin6_len = sizeof(pfr_sin6); 208 1.3.2.2 skrll pfr_sin6.sin6_family = AF_INET6; 209 1.3.2.2 skrll 210 1.3.2.2 skrll memset(&pfr_ffaddr, 0xff, sizeof(pfr_ffaddr)); 211 1.3.2.2 skrll } 212 1.3.2.2 skrll 213 1.3.2.2 skrll #ifdef _LKM 214 1.3.2.2 skrll void 215 1.3.2.2 skrll pfr_destroy(void) 216 1.3.2.2 skrll { 217 1.3.2.2 skrll pool_destroy(&pfr_ktable_pl); 218 1.3.2.2 skrll pool_destroy(&pfr_kentry_pl); 219 1.3.2.6 skrll pool_destroy(&pfr_kentry_pl2); 220 1.3.2.2 skrll } 221 1.3.2.2 skrll #endif 222 1.3.2.2 skrll 223 1.3.2.2 skrll int 224 1.3.2.2 skrll pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags) 225 1.3.2.2 skrll { 226 1.3.2.2 skrll struct pfr_ktable *kt; 227 1.3.2.2 skrll struct pfr_kentryworkq workq; 228 1.3.2.2 skrll int s = 0; 229 1.3.2.2 skrll 230 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY); 231 1.3.2.2 skrll if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL)) 232 1.3.2.2 skrll return (EINVAL); 233 1.3.2.2 skrll kt = pfr_lookup_table(tbl); 234 1.3.2.2 skrll if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 235 1.3.2.2 skrll return (ESRCH); 236 1.3.2.2 skrll if (kt->pfrkt_flags & PFR_TFLAG_CONST) 237 1.3.2.2 skrll return (EPERM); 238 1.3.2.2 skrll pfr_enqueue_addrs(kt, &workq, ndel, 0); 239 1.3.2.2 skrll 240 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 241 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 242 1.3.2.2 skrll s = splsoftnet(); 243 1.3.2.2 skrll pfr_remove_kentries(kt, &workq); 244 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 245 1.3.2.2 skrll splx(s); 246 1.3.2.2 skrll if (kt->pfrkt_cnt) { 247 1.3.2.2 skrll printf("pfr_clr_addrs: corruption detected (%d).\n", 248 1.3.2.2 skrll kt->pfrkt_cnt); 249 1.3.2.2 skrll kt->pfrkt_cnt = 0; 250 1.3.2.2 skrll } 251 1.3.2.2 skrll } 252 1.3.2.2 skrll return (0); 253 1.3.2.2 skrll } 254 1.3.2.2 skrll 255 1.3.2.2 skrll int 256 1.3.2.2 skrll pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size, 257 1.3.2.2 skrll int *nadd, int flags) 258 1.3.2.2 skrll { 259 1.3.2.2 skrll struct pfr_ktable *kt, *tmpkt; 260 1.3.2.2 skrll struct pfr_kentryworkq workq; 261 1.3.2.2 skrll struct pfr_kentry *p, *q; 262 1.3.2.2 skrll struct pfr_addr ad; 263 1.3.2.5 skrll int i, rv, s = 0 /* XXX gcc */, xadd = 0; 264 1.3.2.5 skrll long tzero = time_second; 265 1.3.2.2 skrll 266 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_FEEDBACK); 267 1.3.2.2 skrll if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL)) 268 1.3.2.2 skrll return (EINVAL); 269 1.3.2.2 skrll kt = pfr_lookup_table(tbl); 270 1.3.2.2 skrll if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 271 1.3.2.2 skrll return (ESRCH); 272 1.3.2.2 skrll if (kt->pfrkt_flags & PFR_TFLAG_CONST) 273 1.3.2.2 skrll return (EPERM); 274 1.3.2.2 skrll tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0); 275 1.3.2.2 skrll if (tmpkt == NULL) 276 1.3.2.2 skrll return (ENOMEM); 277 1.3.2.2 skrll SLIST_INIT(&workq); 278 1.3.2.2 skrll for (i = 0; i < size; i++) { 279 1.3.2.2 skrll if (COPYIN(addr+i, &ad, sizeof(ad))) 280 1.3.2.2 skrll senderr(EFAULT); 281 1.3.2.2 skrll if (pfr_validate_addr(&ad)) 282 1.3.2.2 skrll senderr(EINVAL); 283 1.3.2.2 skrll p = pfr_lookup_addr(kt, &ad, 1); 284 1.3.2.2 skrll q = pfr_lookup_addr(tmpkt, &ad, 1); 285 1.3.2.2 skrll if (flags & PFR_FLAG_FEEDBACK) { 286 1.3.2.2 skrll if (q != NULL) 287 1.3.2.2 skrll ad.pfra_fback = PFR_FB_DUPLICATE; 288 1.3.2.2 skrll else if (p == NULL) 289 1.3.2.2 skrll ad.pfra_fback = PFR_FB_ADDED; 290 1.3.2.2 skrll else if (p->pfrke_not != ad.pfra_not) 291 1.3.2.2 skrll ad.pfra_fback = PFR_FB_CONFLICT; 292 1.3.2.2 skrll else 293 1.3.2.2 skrll ad.pfra_fback = PFR_FB_NONE; 294 1.3.2.2 skrll } 295 1.3.2.2 skrll if (p == NULL && q == NULL) { 296 1.3.2.6 skrll p = pfr_create_kentry(&ad, 0); 297 1.3.2.2 skrll if (p == NULL) 298 1.3.2.2 skrll senderr(ENOMEM); 299 1.3.2.2 skrll if (pfr_route_kentry(tmpkt, p)) { 300 1.3.2.2 skrll pfr_destroy_kentry(p); 301 1.3.2.2 skrll ad.pfra_fback = PFR_FB_NONE; 302 1.3.2.2 skrll } else { 303 1.3.2.2 skrll SLIST_INSERT_HEAD(&workq, p, pfrke_workq); 304 1.3.2.2 skrll xadd++; 305 1.3.2.2 skrll } 306 1.3.2.2 skrll } 307 1.3.2.2 skrll if (flags & PFR_FLAG_FEEDBACK) 308 1.3.2.2 skrll if (COPYOUT(&ad, addr+i, sizeof(ad))) 309 1.3.2.2 skrll senderr(EFAULT); 310 1.3.2.2 skrll } 311 1.3.2.2 skrll pfr_clean_node_mask(tmpkt, &workq); 312 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 313 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 314 1.3.2.2 skrll s = splsoftnet(); 315 1.3.2.2 skrll pfr_insert_kentries(kt, &workq, tzero); 316 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 317 1.3.2.2 skrll splx(s); 318 1.3.2.2 skrll } else 319 1.3.2.2 skrll pfr_destroy_kentries(&workq); 320 1.3.2.2 skrll if (nadd != NULL) 321 1.3.2.2 skrll *nadd = xadd; 322 1.3.2.2 skrll pfr_destroy_ktable(tmpkt, 0); 323 1.3.2.2 skrll return (0); 324 1.3.2.2 skrll _bad: 325 1.3.2.2 skrll pfr_clean_node_mask(tmpkt, &workq); 326 1.3.2.2 skrll pfr_destroy_kentries(&workq); 327 1.3.2.2 skrll if (flags & PFR_FLAG_FEEDBACK) 328 1.3.2.2 skrll pfr_reset_feedback(addr, size, flags); 329 1.3.2.2 skrll pfr_destroy_ktable(tmpkt, 0); 330 1.3.2.2 skrll return (rv); 331 1.3.2.2 skrll } 332 1.3.2.2 skrll 333 1.3.2.2 skrll int 334 1.3.2.2 skrll pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size, 335 1.3.2.2 skrll int *ndel, int flags) 336 1.3.2.2 skrll { 337 1.3.2.2 skrll struct pfr_ktable *kt; 338 1.3.2.2 skrll struct pfr_kentryworkq workq; 339 1.3.2.2 skrll struct pfr_kentry *p; 340 1.3.2.2 skrll struct pfr_addr ad; 341 1.3.2.5 skrll int i, rv, s = 0 /* XXX gcc */, xdel = 0, log = 1; 342 1.3.2.2 skrll 343 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_FEEDBACK); 344 1.3.2.2 skrll if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL)) 345 1.3.2.2 skrll return (EINVAL); 346 1.3.2.2 skrll kt = pfr_lookup_table(tbl); 347 1.3.2.2 skrll if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 348 1.3.2.2 skrll return (ESRCH); 349 1.3.2.2 skrll if (kt->pfrkt_flags & PFR_TFLAG_CONST) 350 1.3.2.2 skrll return (EPERM); 351 1.3.2.5 skrll /* 352 1.3.2.5 skrll * there are two algorithms to choose from here. 353 1.3.2.5 skrll * with: 354 1.3.2.5 skrll * n: number of addresses to delete 355 1.3.2.5 skrll * N: number of addresses in the table 356 1.3.2.5 skrll * 357 1.3.2.5 skrll * one is O(N) and is better for large 'n' 358 1.3.2.5 skrll * one is O(n*LOG(N)) and is better for small 'n' 359 1.3.2.5 skrll * 360 1.3.2.5 skrll * following code try to decide which one is best. 361 1.3.2.5 skrll */ 362 1.3.2.5 skrll for (i = kt->pfrkt_cnt; i > 0; i >>= 1) 363 1.3.2.5 skrll log++; 364 1.3.2.5 skrll if (size > kt->pfrkt_cnt/log) { 365 1.3.2.5 skrll /* full table scan */ 366 1.3.2.5 skrll pfr_mark_addrs(kt); 367 1.3.2.5 skrll } else { 368 1.3.2.5 skrll /* iterate over addresses to delete */ 369 1.3.2.5 skrll for (i = 0; i < size; i++) { 370 1.3.2.5 skrll if (COPYIN(addr+i, &ad, sizeof(ad))) 371 1.3.2.5 skrll return (EFAULT); 372 1.3.2.5 skrll if (pfr_validate_addr(&ad)) 373 1.3.2.5 skrll return (EINVAL); 374 1.3.2.5 skrll p = pfr_lookup_addr(kt, &ad, 1); 375 1.3.2.5 skrll if (p != NULL) 376 1.3.2.5 skrll p->pfrke_mark = 0; 377 1.3.2.5 skrll } 378 1.3.2.5 skrll } 379 1.3.2.2 skrll SLIST_INIT(&workq); 380 1.3.2.2 skrll for (i = 0; i < size; i++) { 381 1.3.2.2 skrll if (COPYIN(addr+i, &ad, sizeof(ad))) 382 1.3.2.2 skrll senderr(EFAULT); 383 1.3.2.2 skrll if (pfr_validate_addr(&ad)) 384 1.3.2.2 skrll senderr(EINVAL); 385 1.3.2.2 skrll p = pfr_lookup_addr(kt, &ad, 1); 386 1.3.2.2 skrll if (flags & PFR_FLAG_FEEDBACK) { 387 1.3.2.2 skrll if (p == NULL) 388 1.3.2.2 skrll ad.pfra_fback = PFR_FB_NONE; 389 1.3.2.2 skrll else if (p->pfrke_not != ad.pfra_not) 390 1.3.2.2 skrll ad.pfra_fback = PFR_FB_CONFLICT; 391 1.3.2.2 skrll else if (p->pfrke_mark) 392 1.3.2.2 skrll ad.pfra_fback = PFR_FB_DUPLICATE; 393 1.3.2.2 skrll else 394 1.3.2.2 skrll ad.pfra_fback = PFR_FB_DELETED; 395 1.3.2.2 skrll } 396 1.3.2.2 skrll if (p != NULL && p->pfrke_not == ad.pfra_not && 397 1.3.2.2 skrll !p->pfrke_mark) { 398 1.3.2.2 skrll p->pfrke_mark = 1; 399 1.3.2.2 skrll SLIST_INSERT_HEAD(&workq, p, pfrke_workq); 400 1.3.2.2 skrll xdel++; 401 1.3.2.2 skrll } 402 1.3.2.2 skrll if (flags & PFR_FLAG_FEEDBACK) 403 1.3.2.2 skrll if (COPYOUT(&ad, addr+i, sizeof(ad))) 404 1.3.2.2 skrll senderr(EFAULT); 405 1.3.2.2 skrll } 406 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 407 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 408 1.3.2.2 skrll s = splsoftnet(); 409 1.3.2.2 skrll pfr_remove_kentries(kt, &workq); 410 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 411 1.3.2.2 skrll splx(s); 412 1.3.2.2 skrll } 413 1.3.2.2 skrll if (ndel != NULL) 414 1.3.2.2 skrll *ndel = xdel; 415 1.3.2.2 skrll return (0); 416 1.3.2.2 skrll _bad: 417 1.3.2.2 skrll if (flags & PFR_FLAG_FEEDBACK) 418 1.3.2.2 skrll pfr_reset_feedback(addr, size, flags); 419 1.3.2.2 skrll return (rv); 420 1.3.2.2 skrll } 421 1.3.2.2 skrll 422 1.3.2.2 skrll int 423 1.3.2.2 skrll pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size, 424 1.3.2.2 skrll int *size2, int *nadd, int *ndel, int *nchange, int flags) 425 1.3.2.2 skrll { 426 1.3.2.2 skrll struct pfr_ktable *kt, *tmpkt; 427 1.3.2.2 skrll struct pfr_kentryworkq addq, delq, changeq; 428 1.3.2.2 skrll struct pfr_kentry *p, *q; 429 1.3.2.2 skrll struct pfr_addr ad; 430 1.3.2.5 skrll int i, rv, s = 0 /* XXX gcc */, xadd = 0, xdel = 0, 431 1.3.2.5 skrll xchange = 0; 432 1.3.2.5 skrll long tzero = time_second; 433 1.3.2.2 skrll 434 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_FEEDBACK); 435 1.3.2.2 skrll if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL)) 436 1.3.2.2 skrll return (EINVAL); 437 1.3.2.2 skrll kt = pfr_lookup_table(tbl); 438 1.3.2.2 skrll if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 439 1.3.2.2 skrll return (ESRCH); 440 1.3.2.2 skrll if (kt->pfrkt_flags & PFR_TFLAG_CONST) 441 1.3.2.2 skrll return (EPERM); 442 1.3.2.2 skrll tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0); 443 1.3.2.2 skrll if (tmpkt == NULL) 444 1.3.2.2 skrll return (ENOMEM); 445 1.3.2.2 skrll pfr_mark_addrs(kt); 446 1.3.2.2 skrll SLIST_INIT(&addq); 447 1.3.2.2 skrll SLIST_INIT(&delq); 448 1.3.2.2 skrll SLIST_INIT(&changeq); 449 1.3.2.2 skrll for (i = 0; i < size; i++) { 450 1.3.2.2 skrll if (COPYIN(addr+i, &ad, sizeof(ad))) 451 1.3.2.2 skrll senderr(EFAULT); 452 1.3.2.2 skrll if (pfr_validate_addr(&ad)) 453 1.3.2.2 skrll senderr(EINVAL); 454 1.3.2.2 skrll ad.pfra_fback = PFR_FB_NONE; 455 1.3.2.2 skrll p = pfr_lookup_addr(kt, &ad, 1); 456 1.3.2.2 skrll if (p != NULL) { 457 1.3.2.2 skrll if (p->pfrke_mark) { 458 1.3.2.2 skrll ad.pfra_fback = PFR_FB_DUPLICATE; 459 1.3.2.2 skrll goto _skip; 460 1.3.2.2 skrll } 461 1.3.2.2 skrll p->pfrke_mark = 1; 462 1.3.2.2 skrll if (p->pfrke_not != ad.pfra_not) { 463 1.3.2.2 skrll SLIST_INSERT_HEAD(&changeq, p, pfrke_workq); 464 1.3.2.2 skrll ad.pfra_fback = PFR_FB_CHANGED; 465 1.3.2.2 skrll xchange++; 466 1.3.2.2 skrll } 467 1.3.2.2 skrll } else { 468 1.3.2.2 skrll q = pfr_lookup_addr(tmpkt, &ad, 1); 469 1.3.2.2 skrll if (q != NULL) { 470 1.3.2.2 skrll ad.pfra_fback = PFR_FB_DUPLICATE; 471 1.3.2.2 skrll goto _skip; 472 1.3.2.2 skrll } 473 1.3.2.6 skrll p = pfr_create_kentry(&ad, 0); 474 1.3.2.2 skrll if (p == NULL) 475 1.3.2.2 skrll senderr(ENOMEM); 476 1.3.2.2 skrll if (pfr_route_kentry(tmpkt, p)) { 477 1.3.2.2 skrll pfr_destroy_kentry(p); 478 1.3.2.2 skrll ad.pfra_fback = PFR_FB_NONE; 479 1.3.2.2 skrll } else { 480 1.3.2.2 skrll SLIST_INSERT_HEAD(&addq, p, pfrke_workq); 481 1.3.2.2 skrll ad.pfra_fback = PFR_FB_ADDED; 482 1.3.2.2 skrll xadd++; 483 1.3.2.2 skrll } 484 1.3.2.2 skrll } 485 1.3.2.2 skrll _skip: 486 1.3.2.2 skrll if (flags & PFR_FLAG_FEEDBACK) 487 1.3.2.2 skrll if (COPYOUT(&ad, addr+i, sizeof(ad))) 488 1.3.2.2 skrll senderr(EFAULT); 489 1.3.2.2 skrll } 490 1.3.2.2 skrll pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY); 491 1.3.2.2 skrll if ((flags & PFR_FLAG_FEEDBACK) && *size2) { 492 1.3.2.2 skrll if (*size2 < size+xdel) { 493 1.3.2.2 skrll *size2 = size+xdel; 494 1.3.2.2 skrll senderr(0); 495 1.3.2.2 skrll } 496 1.3.2.2 skrll i = 0; 497 1.3.2.2 skrll SLIST_FOREACH(p, &delq, pfrke_workq) { 498 1.3.2.2 skrll pfr_copyout_addr(&ad, p); 499 1.3.2.2 skrll ad.pfra_fback = PFR_FB_DELETED; 500 1.3.2.2 skrll if (COPYOUT(&ad, addr+size+i, sizeof(ad))) 501 1.3.2.2 skrll senderr(EFAULT); 502 1.3.2.2 skrll i++; 503 1.3.2.2 skrll } 504 1.3.2.2 skrll } 505 1.3.2.2 skrll pfr_clean_node_mask(tmpkt, &addq); 506 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 507 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 508 1.3.2.2 skrll s = splsoftnet(); 509 1.3.2.2 skrll pfr_insert_kentries(kt, &addq, tzero); 510 1.3.2.2 skrll pfr_remove_kentries(kt, &delq); 511 1.3.2.2 skrll pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG); 512 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 513 1.3.2.2 skrll splx(s); 514 1.3.2.2 skrll } else 515 1.3.2.2 skrll pfr_destroy_kentries(&addq); 516 1.3.2.2 skrll if (nadd != NULL) 517 1.3.2.2 skrll *nadd = xadd; 518 1.3.2.2 skrll if (ndel != NULL) 519 1.3.2.2 skrll *ndel = xdel; 520 1.3.2.2 skrll if (nchange != NULL) 521 1.3.2.2 skrll *nchange = xchange; 522 1.3.2.2 skrll if ((flags & PFR_FLAG_FEEDBACK) && size2) 523 1.3.2.2 skrll *size2 = size+xdel; 524 1.3.2.2 skrll pfr_destroy_ktable(tmpkt, 0); 525 1.3.2.2 skrll return (0); 526 1.3.2.2 skrll _bad: 527 1.3.2.2 skrll pfr_clean_node_mask(tmpkt, &addq); 528 1.3.2.2 skrll pfr_destroy_kentries(&addq); 529 1.3.2.2 skrll if (flags & PFR_FLAG_FEEDBACK) 530 1.3.2.2 skrll pfr_reset_feedback(addr, size, flags); 531 1.3.2.2 skrll pfr_destroy_ktable(tmpkt, 0); 532 1.3.2.2 skrll return (rv); 533 1.3.2.2 skrll } 534 1.3.2.2 skrll 535 1.3.2.2 skrll int 536 1.3.2.2 skrll pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size, 537 1.3.2.2 skrll int *nmatch, int flags) 538 1.3.2.2 skrll { 539 1.3.2.2 skrll struct pfr_ktable *kt; 540 1.3.2.2 skrll struct pfr_kentry *p; 541 1.3.2.2 skrll struct pfr_addr ad; 542 1.3.2.2 skrll int i, xmatch = 0; 543 1.3.2.2 skrll 544 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_REPLACE); 545 1.3.2.2 skrll if (pfr_validate_table(tbl, 0, 0)) 546 1.3.2.2 skrll return (EINVAL); 547 1.3.2.2 skrll kt = pfr_lookup_table(tbl); 548 1.3.2.2 skrll if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 549 1.3.2.2 skrll return (ESRCH); 550 1.3.2.2 skrll 551 1.3.2.2 skrll for (i = 0; i < size; i++) { 552 1.3.2.2 skrll if (COPYIN(addr+i, &ad, sizeof(ad))) 553 1.3.2.2 skrll return (EFAULT); 554 1.3.2.2 skrll if (pfr_validate_addr(&ad)) 555 1.3.2.2 skrll return (EINVAL); 556 1.3.2.2 skrll if (ADDR_NETWORK(&ad)) 557 1.3.2.2 skrll return (EINVAL); 558 1.3.2.2 skrll p = pfr_lookup_addr(kt, &ad, 0); 559 1.3.2.2 skrll if (flags & PFR_FLAG_REPLACE) 560 1.3.2.2 skrll pfr_copyout_addr(&ad, p); 561 1.3.2.2 skrll ad.pfra_fback = (p == NULL) ? PFR_FB_NONE : 562 1.3.2.2 skrll (p->pfrke_not ? PFR_FB_NOTMATCH : PFR_FB_MATCH); 563 1.3.2.2 skrll if (p != NULL && !p->pfrke_not) 564 1.3.2.2 skrll xmatch++; 565 1.3.2.2 skrll if (COPYOUT(&ad, addr+i, sizeof(ad))) 566 1.3.2.2 skrll return (EFAULT); 567 1.3.2.2 skrll } 568 1.3.2.2 skrll if (nmatch != NULL) 569 1.3.2.2 skrll *nmatch = xmatch; 570 1.3.2.2 skrll return (0); 571 1.3.2.2 skrll } 572 1.3.2.2 skrll 573 1.3.2.2 skrll int 574 1.3.2.2 skrll pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size, 575 1.3.2.2 skrll int flags) 576 1.3.2.2 skrll { 577 1.3.2.2 skrll struct pfr_ktable *kt; 578 1.3.2.2 skrll struct pfr_walktree w; 579 1.3.2.2 skrll int rv; 580 1.3.2.2 skrll 581 1.3.2.2 skrll ACCEPT_FLAGS(0); 582 1.3.2.2 skrll if (pfr_validate_table(tbl, 0, 0)) 583 1.3.2.2 skrll return (EINVAL); 584 1.3.2.2 skrll kt = pfr_lookup_table(tbl); 585 1.3.2.2 skrll if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 586 1.3.2.2 skrll return (ESRCH); 587 1.3.2.2 skrll if (kt->pfrkt_cnt > *size) { 588 1.3.2.2 skrll *size = kt->pfrkt_cnt; 589 1.3.2.2 skrll return (0); 590 1.3.2.2 skrll } 591 1.3.2.2 skrll 592 1.3.2.2 skrll bzero(&w, sizeof(w)); 593 1.3.2.2 skrll w.pfrw_op = PFRW_GET_ADDRS; 594 1.3.2.2 skrll w.pfrw_addr = addr; 595 1.3.2.2 skrll w.pfrw_free = kt->pfrkt_cnt; 596 1.3.2.2 skrll w.pfrw_flags = flags; 597 1.3.2.2 skrll rv = rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w); 598 1.3.2.2 skrll if (!rv) 599 1.3.2.2 skrll rv = rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w); 600 1.3.2.2 skrll if (rv) 601 1.3.2.2 skrll return (rv); 602 1.3.2.2 skrll 603 1.3.2.2 skrll if (w.pfrw_free) { 604 1.3.2.2 skrll printf("pfr_get_addrs: corruption detected (%d).\n", 605 1.3.2.2 skrll w.pfrw_free); 606 1.3.2.2 skrll return (ENOTTY); 607 1.3.2.2 skrll } 608 1.3.2.2 skrll *size = kt->pfrkt_cnt; 609 1.3.2.2 skrll return (0); 610 1.3.2.2 skrll } 611 1.3.2.2 skrll 612 1.3.2.2 skrll int 613 1.3.2.2 skrll pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size, 614 1.3.2.2 skrll int flags) 615 1.3.2.2 skrll { 616 1.3.2.2 skrll struct pfr_ktable *kt; 617 1.3.2.2 skrll struct pfr_walktree w; 618 1.3.2.2 skrll struct pfr_kentryworkq workq; 619 1.3.2.5 skrll int rv, s = 0 /* XXX gcc */; 620 1.3.2.5 skrll long tzero = time_second; 621 1.3.2.2 skrll 622 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC); /* XXX PFR_FLAG_CLSTATS disabled */ 623 1.3.2.2 skrll if (pfr_validate_table(tbl, 0, 0)) 624 1.3.2.2 skrll return (EINVAL); 625 1.3.2.2 skrll kt = pfr_lookup_table(tbl); 626 1.3.2.2 skrll if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 627 1.3.2.2 skrll return (ESRCH); 628 1.3.2.2 skrll if (kt->pfrkt_cnt > *size) { 629 1.3.2.2 skrll *size = kt->pfrkt_cnt; 630 1.3.2.2 skrll return (0); 631 1.3.2.2 skrll } 632 1.3.2.2 skrll 633 1.3.2.2 skrll bzero(&w, sizeof(w)); 634 1.3.2.2 skrll w.pfrw_op = PFRW_GET_ASTATS; 635 1.3.2.2 skrll w.pfrw_astats = addr; 636 1.3.2.2 skrll w.pfrw_free = kt->pfrkt_cnt; 637 1.3.2.2 skrll w.pfrw_flags = flags; 638 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 639 1.3.2.2 skrll s = splsoftnet(); 640 1.3.2.2 skrll rv = rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w); 641 1.3.2.2 skrll if (!rv) 642 1.3.2.2 skrll rv = rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w); 643 1.3.2.2 skrll if (!rv && (flags & PFR_FLAG_CLSTATS)) { 644 1.3.2.2 skrll pfr_enqueue_addrs(kt, &workq, NULL, 0); 645 1.3.2.2 skrll pfr_clstats_kentries(&workq, tzero, 0); 646 1.3.2.2 skrll } 647 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 648 1.3.2.2 skrll splx(s); 649 1.3.2.2 skrll if (rv) 650 1.3.2.2 skrll return (rv); 651 1.3.2.2 skrll 652 1.3.2.2 skrll if (w.pfrw_free) { 653 1.3.2.2 skrll printf("pfr_get_astats: corruption detected (%d).\n", 654 1.3.2.2 skrll w.pfrw_free); 655 1.3.2.2 skrll return (ENOTTY); 656 1.3.2.2 skrll } 657 1.3.2.2 skrll *size = kt->pfrkt_cnt; 658 1.3.2.2 skrll return (0); 659 1.3.2.2 skrll } 660 1.3.2.2 skrll 661 1.3.2.2 skrll int 662 1.3.2.2 skrll pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size, 663 1.3.2.2 skrll int *nzero, int flags) 664 1.3.2.2 skrll { 665 1.3.2.2 skrll struct pfr_ktable *kt; 666 1.3.2.2 skrll struct pfr_kentryworkq workq; 667 1.3.2.2 skrll struct pfr_kentry *p; 668 1.3.2.2 skrll struct pfr_addr ad; 669 1.3.2.2 skrll int i, rv, s = 0, xzero = 0; 670 1.3.2.2 skrll 671 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_FEEDBACK); 672 1.3.2.2 skrll if (pfr_validate_table(tbl, 0, 0)) 673 1.3.2.2 skrll return (EINVAL); 674 1.3.2.2 skrll kt = pfr_lookup_table(tbl); 675 1.3.2.2 skrll if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 676 1.3.2.2 skrll return (ESRCH); 677 1.3.2.2 skrll SLIST_INIT(&workq); 678 1.3.2.2 skrll for (i = 0; i < size; i++) { 679 1.3.2.2 skrll if (COPYIN(addr+i, &ad, sizeof(ad))) 680 1.3.2.2 skrll senderr(EFAULT); 681 1.3.2.2 skrll if (pfr_validate_addr(&ad)) 682 1.3.2.2 skrll senderr(EINVAL); 683 1.3.2.2 skrll p = pfr_lookup_addr(kt, &ad, 1); 684 1.3.2.2 skrll if (flags & PFR_FLAG_FEEDBACK) { 685 1.3.2.2 skrll ad.pfra_fback = (p != NULL) ? 686 1.3.2.2 skrll PFR_FB_CLEARED : PFR_FB_NONE; 687 1.3.2.2 skrll if (COPYOUT(&ad, addr+i, sizeof(ad))) 688 1.3.2.2 skrll senderr(EFAULT); 689 1.3.2.2 skrll } 690 1.3.2.2 skrll if (p != NULL) { 691 1.3.2.2 skrll SLIST_INSERT_HEAD(&workq, p, pfrke_workq); 692 1.3.2.2 skrll xzero++; 693 1.3.2.2 skrll } 694 1.3.2.2 skrll } 695 1.3.2.2 skrll 696 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 697 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 698 1.3.2.2 skrll s = splsoftnet(); 699 1.3.2.2 skrll pfr_clstats_kentries(&workq, 0, 0); 700 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 701 1.3.2.2 skrll splx(s); 702 1.3.2.2 skrll } 703 1.3.2.2 skrll if (nzero != NULL) 704 1.3.2.2 skrll *nzero = xzero; 705 1.3.2.2 skrll return (0); 706 1.3.2.2 skrll _bad: 707 1.3.2.2 skrll if (flags & PFR_FLAG_FEEDBACK) 708 1.3.2.2 skrll pfr_reset_feedback(addr, size, flags); 709 1.3.2.2 skrll return (rv); 710 1.3.2.2 skrll } 711 1.3.2.2 skrll 712 1.3.2.2 skrll int 713 1.3.2.2 skrll pfr_validate_addr(struct pfr_addr *ad) 714 1.3.2.2 skrll { 715 1.3.2.2 skrll int i; 716 1.3.2.2 skrll 717 1.3.2.2 skrll switch (ad->pfra_af) { 718 1.3.2.5 skrll #ifdef INET 719 1.3.2.2 skrll case AF_INET: 720 1.3.2.2 skrll if (ad->pfra_net > 32) 721 1.3.2.2 skrll return (-1); 722 1.3.2.2 skrll break; 723 1.3.2.5 skrll #endif /* INET */ 724 1.3.2.5 skrll #ifdef INET6 725 1.3.2.2 skrll case AF_INET6: 726 1.3.2.2 skrll if (ad->pfra_net > 128) 727 1.3.2.2 skrll return (-1); 728 1.3.2.2 skrll break; 729 1.3.2.5 skrll #endif /* INET6 */ 730 1.3.2.2 skrll default: 731 1.3.2.2 skrll return (-1); 732 1.3.2.2 skrll } 733 1.3.2.2 skrll if (ad->pfra_net < 128 && 734 1.3.2.2 skrll (((caddr_t)ad)[ad->pfra_net/8] & (0xFF >> (ad->pfra_net%8)))) 735 1.3.2.2 skrll return (-1); 736 1.3.2.2 skrll for (i = (ad->pfra_net+7)/8; i < sizeof(ad->pfra_u); i++) 737 1.3.2.2 skrll if (((caddr_t)ad)[i]) 738 1.3.2.2 skrll return (-1); 739 1.3.2.2 skrll if (ad->pfra_not && ad->pfra_not != 1) 740 1.3.2.2 skrll return (-1); 741 1.3.2.2 skrll if (ad->pfra_fback) 742 1.3.2.2 skrll return (-1); 743 1.3.2.2 skrll return (0); 744 1.3.2.2 skrll } 745 1.3.2.2 skrll 746 1.3.2.2 skrll void 747 1.3.2.2 skrll pfr_enqueue_addrs(struct pfr_ktable *kt, struct pfr_kentryworkq *workq, 748 1.3.2.2 skrll int *naddr, int sweep) 749 1.3.2.2 skrll { 750 1.3.2.2 skrll struct pfr_walktree w; 751 1.3.2.2 skrll 752 1.3.2.2 skrll SLIST_INIT(workq); 753 1.3.2.2 skrll bzero(&w, sizeof(w)); 754 1.3.2.2 skrll w.pfrw_op = sweep ? PFRW_SWEEP : PFRW_ENQUEUE; 755 1.3.2.2 skrll w.pfrw_workq = workq; 756 1.3.2.2 skrll if (kt->pfrkt_ip4 != NULL) 757 1.3.2.2 skrll if (rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w)) 758 1.3.2.2 skrll printf("pfr_enqueue_addrs: IPv4 walktree failed.\n"); 759 1.3.2.2 skrll if (kt->pfrkt_ip6 != NULL) 760 1.3.2.2 skrll if (rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w)) 761 1.3.2.2 skrll printf("pfr_enqueue_addrs: IPv6 walktree failed.\n"); 762 1.3.2.2 skrll if (naddr != NULL) 763 1.3.2.2 skrll *naddr = w.pfrw_cnt; 764 1.3.2.2 skrll } 765 1.3.2.2 skrll 766 1.3.2.2 skrll void 767 1.3.2.2 skrll pfr_mark_addrs(struct pfr_ktable *kt) 768 1.3.2.2 skrll { 769 1.3.2.2 skrll struct pfr_walktree w; 770 1.3.2.2 skrll 771 1.3.2.2 skrll bzero(&w, sizeof(w)); 772 1.3.2.2 skrll w.pfrw_op = PFRW_MARK; 773 1.3.2.2 skrll if (rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w)) 774 1.3.2.2 skrll printf("pfr_mark_addrs: IPv4 walktree failed.\n"); 775 1.3.2.2 skrll if (rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w)) 776 1.3.2.2 skrll printf("pfr_mark_addrs: IPv6 walktree failed.\n"); 777 1.3.2.2 skrll } 778 1.3.2.2 skrll 779 1.3.2.2 skrll 780 1.3.2.2 skrll struct pfr_kentry * 781 1.3.2.2 skrll pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact) 782 1.3.2.2 skrll { 783 1.3.2.2 skrll union sockaddr_union sa, mask; 784 1.3.2.5 skrll struct radix_node_head *head = (void *)0xdeadb; 785 1.3.2.2 skrll struct pfr_kentry *ke; 786 1.3.2.2 skrll int s; 787 1.3.2.2 skrll 788 1.3.2.2 skrll bzero(&sa, sizeof(sa)); 789 1.3.2.2 skrll if (ad->pfra_af == AF_INET) { 790 1.3.2.2 skrll FILLIN_SIN(sa.sin, ad->pfra_ip4addr); 791 1.3.2.2 skrll head = kt->pfrkt_ip4; 792 1.3.2.5 skrll } else if ( ad->pfra_af == AF_INET6 ) { 793 1.3.2.2 skrll FILLIN_SIN6(sa.sin6, ad->pfra_ip6addr); 794 1.3.2.2 skrll head = kt->pfrkt_ip6; 795 1.3.2.2 skrll } 796 1.3.2.2 skrll if (ADDR_NETWORK(ad)) { 797 1.3.2.2 skrll pfr_prepare_network(&mask, ad->pfra_af, ad->pfra_net); 798 1.3.2.2 skrll s = splsoftnet(); /* rn_lookup makes use of globals */ 799 1.3.2.2 skrll ke = (struct pfr_kentry *)rn_lookup(&sa, &mask, head); 800 1.3.2.2 skrll splx(s); 801 1.3.2.2 skrll if (ke && KENTRY_RNF_ROOT(ke)) 802 1.3.2.2 skrll ke = NULL; 803 1.3.2.2 skrll } else { 804 1.3.2.2 skrll ke = (struct pfr_kentry *)rn_match(&sa, head); 805 1.3.2.2 skrll if (ke && KENTRY_RNF_ROOT(ke)) 806 1.3.2.2 skrll ke = NULL; 807 1.3.2.2 skrll if (exact && ke && KENTRY_NETWORK(ke)) 808 1.3.2.2 skrll ke = NULL; 809 1.3.2.2 skrll } 810 1.3.2.2 skrll return (ke); 811 1.3.2.2 skrll } 812 1.3.2.2 skrll 813 1.3.2.2 skrll struct pfr_kentry * 814 1.3.2.6 skrll pfr_create_kentry(struct pfr_addr *ad, int intr) 815 1.3.2.2 skrll { 816 1.3.2.2 skrll struct pfr_kentry *ke; 817 1.3.2.2 skrll 818 1.3.2.6 skrll if (intr) 819 1.3.2.6 skrll ke = pool_get(&pfr_kentry_pl2, PR_NOWAIT); 820 1.3.2.6 skrll else 821 1.3.2.6 skrll ke = pool_get(&pfr_kentry_pl, PR_NOWAIT); 822 1.3.2.2 skrll if (ke == NULL) 823 1.3.2.2 skrll return (NULL); 824 1.3.2.2 skrll bzero(ke, sizeof(*ke)); 825 1.3.2.2 skrll 826 1.3.2.2 skrll if (ad->pfra_af == AF_INET) 827 1.3.2.2 skrll FILLIN_SIN(ke->pfrke_sa.sin, ad->pfra_ip4addr); 828 1.3.2.5 skrll else if (ad->pfra_af == AF_INET6) 829 1.3.2.2 skrll FILLIN_SIN6(ke->pfrke_sa.sin6, ad->pfra_ip6addr); 830 1.3.2.2 skrll ke->pfrke_af = ad->pfra_af; 831 1.3.2.2 skrll ke->pfrke_net = ad->pfra_net; 832 1.3.2.2 skrll ke->pfrke_not = ad->pfra_not; 833 1.3.2.6 skrll ke->pfrke_intrpool = intr; 834 1.3.2.2 skrll return (ke); 835 1.3.2.2 skrll } 836 1.3.2.2 skrll 837 1.3.2.2 skrll void 838 1.3.2.2 skrll pfr_destroy_kentries(struct pfr_kentryworkq *workq) 839 1.3.2.2 skrll { 840 1.3.2.2 skrll struct pfr_kentry *p, *q; 841 1.3.2.2 skrll 842 1.3.2.2 skrll for (p = SLIST_FIRST(workq); p != NULL; p = q) { 843 1.3.2.2 skrll q = SLIST_NEXT(p, pfrke_workq); 844 1.3.2.2 skrll pfr_destroy_kentry(p); 845 1.3.2.2 skrll } 846 1.3.2.2 skrll } 847 1.3.2.2 skrll 848 1.3.2.2 skrll void 849 1.3.2.2 skrll pfr_destroy_kentry(struct pfr_kentry *ke) 850 1.3.2.2 skrll { 851 1.3.2.6 skrll if (ke->pfrke_intrpool) 852 1.3.2.6 skrll pool_put(&pfr_kentry_pl2, ke); 853 1.3.2.6 skrll else 854 1.3.2.6 skrll pool_put(&pfr_kentry_pl, ke); 855 1.3.2.2 skrll } 856 1.3.2.2 skrll 857 1.3.2.2 skrll void 858 1.3.2.2 skrll pfr_insert_kentries(struct pfr_ktable *kt, 859 1.3.2.2 skrll struct pfr_kentryworkq *workq, long tzero) 860 1.3.2.2 skrll { 861 1.3.2.2 skrll struct pfr_kentry *p; 862 1.3.2.2 skrll int rv, n = 0; 863 1.3.2.2 skrll 864 1.3.2.2 skrll SLIST_FOREACH(p, workq, pfrke_workq) { 865 1.3.2.2 skrll rv = pfr_route_kentry(kt, p); 866 1.3.2.2 skrll if (rv) { 867 1.3.2.2 skrll printf("pfr_insert_kentries: cannot route entry " 868 1.3.2.2 skrll "(code=%d).\n", rv); 869 1.3.2.2 skrll break; 870 1.3.2.2 skrll } 871 1.3.2.2 skrll p->pfrke_tzero = tzero; 872 1.3.2.2 skrll n++; 873 1.3.2.2 skrll } 874 1.3.2.2 skrll kt->pfrkt_cnt += n; 875 1.3.2.2 skrll } 876 1.3.2.2 skrll 877 1.3.2.6 skrll int 878 1.3.2.6 skrll pfr_insert_kentry(struct pfr_ktable *kt, struct pfr_addr *ad, long tzero) 879 1.3.2.6 skrll { 880 1.3.2.6 skrll struct pfr_kentry *p; 881 1.3.2.6 skrll int rv; 882 1.3.2.6 skrll 883 1.3.2.6 skrll p = pfr_lookup_addr(kt, ad, 1); 884 1.3.2.6 skrll if (p != NULL) 885 1.3.2.6 skrll return (0); 886 1.3.2.6 skrll p = pfr_create_kentry(ad, 1); 887 1.3.2.6 skrll if (p == NULL) 888 1.3.2.6 skrll return (EINVAL); 889 1.3.2.6 skrll 890 1.3.2.6 skrll rv = pfr_route_kentry(kt, p); 891 1.3.2.6 skrll if (rv) 892 1.3.2.6 skrll return (rv); 893 1.3.2.6 skrll 894 1.3.2.6 skrll p->pfrke_tzero = tzero; 895 1.3.2.6 skrll kt->pfrkt_cnt++; 896 1.3.2.6 skrll 897 1.3.2.6 skrll return (0); 898 1.3.2.6 skrll } 899 1.3.2.6 skrll 900 1.3.2.2 skrll void 901 1.3.2.2 skrll pfr_remove_kentries(struct pfr_ktable *kt, 902 1.3.2.2 skrll struct pfr_kentryworkq *workq) 903 1.3.2.2 skrll { 904 1.3.2.2 skrll struct pfr_kentry *p; 905 1.3.2.2 skrll int n = 0; 906 1.3.2.2 skrll 907 1.3.2.2 skrll SLIST_FOREACH(p, workq, pfrke_workq) { 908 1.3.2.2 skrll pfr_unroute_kentry(kt, p); 909 1.3.2.2 skrll n++; 910 1.3.2.2 skrll } 911 1.3.2.2 skrll kt->pfrkt_cnt -= n; 912 1.3.2.2 skrll pfr_destroy_kentries(workq); 913 1.3.2.2 skrll } 914 1.3.2.2 skrll 915 1.3.2.2 skrll void 916 1.3.2.2 skrll pfr_clean_node_mask(struct pfr_ktable *kt, 917 1.3.2.2 skrll struct pfr_kentryworkq *workq) 918 1.3.2.2 skrll { 919 1.3.2.2 skrll struct pfr_kentry *p; 920 1.3.2.2 skrll 921 1.3.2.2 skrll SLIST_FOREACH(p, workq, pfrke_workq) 922 1.3.2.2 skrll pfr_unroute_kentry(kt, p); 923 1.3.2.2 skrll } 924 1.3.2.2 skrll 925 1.3.2.2 skrll void 926 1.3.2.2 skrll pfr_clstats_kentries(struct pfr_kentryworkq *workq, long tzero, int negchange) 927 1.3.2.2 skrll { 928 1.3.2.2 skrll struct pfr_kentry *p; 929 1.3.2.2 skrll int s; 930 1.3.2.2 skrll 931 1.3.2.2 skrll SLIST_FOREACH(p, workq, pfrke_workq) { 932 1.3.2.2 skrll s = splsoftnet(); 933 1.3.2.2 skrll if (negchange) 934 1.3.2.2 skrll p->pfrke_not = !p->pfrke_not; 935 1.3.2.2 skrll bzero(p->pfrke_packets, sizeof(p->pfrke_packets)); 936 1.3.2.2 skrll bzero(p->pfrke_bytes, sizeof(p->pfrke_bytes)); 937 1.3.2.2 skrll splx(s); 938 1.3.2.2 skrll p->pfrke_tzero = tzero; 939 1.3.2.2 skrll } 940 1.3.2.2 skrll } 941 1.3.2.2 skrll 942 1.3.2.2 skrll void 943 1.3.2.2 skrll pfr_reset_feedback(struct pfr_addr *addr, int size, int flags) 944 1.3.2.2 skrll { 945 1.3.2.2 skrll struct pfr_addr ad; 946 1.3.2.2 skrll int i; 947 1.3.2.2 skrll 948 1.3.2.2 skrll for (i = 0; i < size; i++) { 949 1.3.2.2 skrll if (COPYIN(addr+i, &ad, sizeof(ad))) 950 1.3.2.2 skrll break; 951 1.3.2.2 skrll ad.pfra_fback = PFR_FB_NONE; 952 1.3.2.2 skrll if (COPYOUT(&ad, addr+i, sizeof(ad))) 953 1.3.2.2 skrll break; 954 1.3.2.2 skrll } 955 1.3.2.2 skrll } 956 1.3.2.2 skrll 957 1.3.2.2 skrll void 958 1.3.2.2 skrll pfr_prepare_network(union sockaddr_union *sa, int af, int net) 959 1.3.2.2 skrll { 960 1.3.2.2 skrll int i; 961 1.3.2.2 skrll 962 1.3.2.2 skrll bzero(sa, sizeof(*sa)); 963 1.3.2.2 skrll if (af == AF_INET) { 964 1.3.2.2 skrll sa->sin.sin_len = sizeof(sa->sin); 965 1.3.2.2 skrll sa->sin.sin_family = AF_INET; 966 1.3.2.5 skrll sa->sin.sin_addr.s_addr = net ? htonl(-1 << (32-net)) : 0; 967 1.3.2.5 skrll } else if (af == AF_INET6) { 968 1.3.2.2 skrll sa->sin6.sin6_len = sizeof(sa->sin6); 969 1.3.2.2 skrll sa->sin6.sin6_family = AF_INET6; 970 1.3.2.2 skrll for (i = 0; i < 4; i++) { 971 1.3.2.2 skrll if (net <= 32) { 972 1.3.2.2 skrll sa->sin6.sin6_addr.s6_addr32[i] = 973 1.3.2.5 skrll net ? htonl(-1 << (32-net)) : 0; 974 1.3.2.2 skrll break; 975 1.3.2.2 skrll } 976 1.3.2.2 skrll sa->sin6.sin6_addr.s6_addr32[i] = 0xFFFFFFFF; 977 1.3.2.2 skrll net -= 32; 978 1.3.2.2 skrll } 979 1.3.2.2 skrll } 980 1.3.2.2 skrll } 981 1.3.2.2 skrll 982 1.3.2.2 skrll int 983 1.3.2.2 skrll pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke) 984 1.3.2.2 skrll { 985 1.3.2.2 skrll union sockaddr_union mask; 986 1.3.2.2 skrll struct radix_node *rn; 987 1.3.2.5 skrll struct radix_node_head *head = (void *)0xdeadb; 988 1.3.2.2 skrll int s; 989 1.3.2.2 skrll 990 1.3.2.2 skrll bzero(ke->pfrke_node, sizeof(ke->pfrke_node)); 991 1.3.2.2 skrll if (ke->pfrke_af == AF_INET) 992 1.3.2.2 skrll head = kt->pfrkt_ip4; 993 1.3.2.5 skrll else if (ke->pfrke_af == AF_INET6) 994 1.3.2.2 skrll head = kt->pfrkt_ip6; 995 1.3.2.2 skrll 996 1.3.2.2 skrll s = splsoftnet(); 997 1.3.2.2 skrll if (KENTRY_NETWORK(ke)) { 998 1.3.2.2 skrll pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net); 999 1.3.2.2 skrll rn = rn_addroute(&ke->pfrke_sa, &mask, head, ke->pfrke_node); 1000 1.3.2.2 skrll } else 1001 1.3.2.2 skrll rn = rn_addroute(&ke->pfrke_sa, NULL, head, ke->pfrke_node); 1002 1.3.2.2 skrll splx(s); 1003 1.3.2.2 skrll 1004 1.3.2.2 skrll return (rn == NULL ? -1 : 0); 1005 1.3.2.2 skrll } 1006 1.3.2.2 skrll 1007 1.3.2.2 skrll int 1008 1.3.2.2 skrll pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke) 1009 1.3.2.2 skrll { 1010 1.3.2.2 skrll union sockaddr_union mask; 1011 1.3.2.2 skrll struct radix_node *rn; 1012 1.3.2.5 skrll struct radix_node_head *head = (void *)0xdeadb; 1013 1.3.2.2 skrll int s; 1014 1.3.2.2 skrll 1015 1.3.2.2 skrll if (ke->pfrke_af == AF_INET) 1016 1.3.2.2 skrll head = kt->pfrkt_ip4; 1017 1.3.2.5 skrll else if (ke->pfrke_af == AF_INET6) 1018 1.3.2.2 skrll head = kt->pfrkt_ip6; 1019 1.3.2.2 skrll 1020 1.3.2.2 skrll s = splsoftnet(); 1021 1.3.2.2 skrll if (KENTRY_NETWORK(ke)) { 1022 1.3.2.2 skrll pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net); 1023 1.3.2.5 skrll #ifdef __OpenBSD__ 1024 1.3.2.5 skrll rn = rn_delete(&ke->pfrke_sa, &mask, head, NULL); 1025 1.3.2.5 skrll #else 1026 1.3.2.2 skrll rn = rn_delete(&ke->pfrke_sa, &mask, head); 1027 1.3.2.5 skrll #endif 1028 1.3.2.2 skrll } else 1029 1.3.2.5 skrll #ifdef __OpenBSD__ 1030 1.3.2.5 skrll rn = rn_delete(&ke->pfrke_sa, NULL, head, NULL); 1031 1.3.2.5 skrll #else 1032 1.3.2.2 skrll rn = rn_delete(&ke->pfrke_sa, NULL, head); 1033 1.3.2.5 skrll #endif 1034 1.3.2.2 skrll splx(s); 1035 1.3.2.2 skrll 1036 1.3.2.2 skrll if (rn == NULL) { 1037 1.3.2.2 skrll printf("pfr_unroute_kentry: delete failed.\n"); 1038 1.3.2.2 skrll return (-1); 1039 1.3.2.2 skrll } 1040 1.3.2.2 skrll return (0); 1041 1.3.2.2 skrll } 1042 1.3.2.2 skrll 1043 1.3.2.2 skrll void 1044 1.3.2.2 skrll pfr_copyout_addr(struct pfr_addr *ad, struct pfr_kentry *ke) 1045 1.3.2.2 skrll { 1046 1.3.2.2 skrll bzero(ad, sizeof(*ad)); 1047 1.3.2.2 skrll if (ke == NULL) 1048 1.3.2.2 skrll return; 1049 1.3.2.2 skrll ad->pfra_af = ke->pfrke_af; 1050 1.3.2.2 skrll ad->pfra_net = ke->pfrke_net; 1051 1.3.2.2 skrll ad->pfra_not = ke->pfrke_not; 1052 1.3.2.2 skrll if (ad->pfra_af == AF_INET) 1053 1.3.2.2 skrll ad->pfra_ip4addr = ke->pfrke_sa.sin.sin_addr; 1054 1.3.2.5 skrll else if (ad->pfra_af == AF_INET6) 1055 1.3.2.2 skrll ad->pfra_ip6addr = ke->pfrke_sa.sin6.sin6_addr; 1056 1.3.2.2 skrll } 1057 1.3.2.2 skrll 1058 1.3.2.2 skrll int 1059 1.3.2.2 skrll pfr_walktree(struct radix_node *rn, void *arg) 1060 1.3.2.2 skrll { 1061 1.3.2.2 skrll struct pfr_kentry *ke = (struct pfr_kentry *)rn; 1062 1.3.2.2 skrll struct pfr_walktree *w = arg; 1063 1.3.2.2 skrll int s, flags = w->pfrw_flags; 1064 1.3.2.2 skrll 1065 1.3.2.2 skrll switch (w->pfrw_op) { 1066 1.3.2.2 skrll case PFRW_MARK: 1067 1.3.2.2 skrll ke->pfrke_mark = 0; 1068 1.3.2.2 skrll break; 1069 1.3.2.2 skrll case PFRW_SWEEP: 1070 1.3.2.2 skrll if (ke->pfrke_mark) 1071 1.3.2.2 skrll break; 1072 1.3.2.2 skrll /* FALLTHROUGH */ 1073 1.3.2.2 skrll case PFRW_ENQUEUE: 1074 1.3.2.2 skrll SLIST_INSERT_HEAD(w->pfrw_workq, ke, pfrke_workq); 1075 1.3.2.2 skrll w->pfrw_cnt++; 1076 1.3.2.2 skrll break; 1077 1.3.2.2 skrll case PFRW_GET_ADDRS: 1078 1.3.2.2 skrll if (w->pfrw_free-- > 0) { 1079 1.3.2.2 skrll struct pfr_addr ad; 1080 1.3.2.2 skrll 1081 1.3.2.2 skrll pfr_copyout_addr(&ad, ke); 1082 1.3.2.2 skrll if (copyout(&ad, w->pfrw_addr, sizeof(ad))) 1083 1.3.2.2 skrll return (EFAULT); 1084 1.3.2.2 skrll w->pfrw_addr++; 1085 1.3.2.2 skrll } 1086 1.3.2.2 skrll break; 1087 1.3.2.2 skrll case PFRW_GET_ASTATS: 1088 1.3.2.2 skrll if (w->pfrw_free-- > 0) { 1089 1.3.2.2 skrll struct pfr_astats as; 1090 1.3.2.2 skrll 1091 1.3.2.2 skrll pfr_copyout_addr(&as.pfras_a, ke); 1092 1.3.2.2 skrll 1093 1.3.2.2 skrll s = splsoftnet(); 1094 1.3.2.2 skrll bcopy(ke->pfrke_packets, as.pfras_packets, 1095 1.3.2.2 skrll sizeof(as.pfras_packets)); 1096 1.3.2.2 skrll bcopy(ke->pfrke_bytes, as.pfras_bytes, 1097 1.3.2.2 skrll sizeof(as.pfras_bytes)); 1098 1.3.2.2 skrll splx(s); 1099 1.3.2.2 skrll as.pfras_tzero = ke->pfrke_tzero; 1100 1.3.2.2 skrll 1101 1.3.2.2 skrll if (COPYOUT(&as, w->pfrw_astats, sizeof(as))) 1102 1.3.2.2 skrll return (EFAULT); 1103 1.3.2.2 skrll w->pfrw_astats++; 1104 1.3.2.2 skrll } 1105 1.3.2.2 skrll break; 1106 1.3.2.2 skrll case PFRW_POOL_GET: 1107 1.3.2.2 skrll if (ke->pfrke_not) 1108 1.3.2.2 skrll break; /* negative entries are ignored */ 1109 1.3.2.2 skrll if (!w->pfrw_cnt--) { 1110 1.3.2.2 skrll w->pfrw_kentry = ke; 1111 1.3.2.2 skrll return (1); /* finish search */ 1112 1.3.2.2 skrll } 1113 1.3.2.2 skrll break; 1114 1.3.2.2 skrll case PFRW_DYNADDR_UPDATE: 1115 1.3.2.2 skrll if (ke->pfrke_af == AF_INET) { 1116 1.3.2.2 skrll if (w->pfrw_dyn->pfid_acnt4++ > 0) 1117 1.3.2.2 skrll break; 1118 1.3.2.2 skrll pfr_prepare_network(&pfr_mask, AF_INET, ke->pfrke_net); 1119 1.3.2.2 skrll w->pfrw_dyn->pfid_addr4 = *SUNION2PF( 1120 1.3.2.2 skrll &ke->pfrke_sa, AF_INET); 1121 1.3.2.2 skrll w->pfrw_dyn->pfid_mask4 = *SUNION2PF( 1122 1.3.2.2 skrll &pfr_mask, AF_INET); 1123 1.3.2.5 skrll } else if (ke->pfrke_af == AF_INET6){ 1124 1.3.2.2 skrll if (w->pfrw_dyn->pfid_acnt6++ > 0) 1125 1.3.2.2 skrll break; 1126 1.3.2.2 skrll pfr_prepare_network(&pfr_mask, AF_INET6, ke->pfrke_net); 1127 1.3.2.2 skrll w->pfrw_dyn->pfid_addr6 = *SUNION2PF( 1128 1.3.2.2 skrll &ke->pfrke_sa, AF_INET6); 1129 1.3.2.2 skrll w->pfrw_dyn->pfid_mask6 = *SUNION2PF( 1130 1.3.2.2 skrll &pfr_mask, AF_INET6); 1131 1.3.2.2 skrll } 1132 1.3.2.2 skrll break; 1133 1.3.2.2 skrll } 1134 1.3.2.2 skrll return (0); 1135 1.3.2.2 skrll } 1136 1.3.2.2 skrll 1137 1.3.2.2 skrll int 1138 1.3.2.2 skrll pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags) 1139 1.3.2.2 skrll { 1140 1.3.2.2 skrll struct pfr_ktableworkq workq; 1141 1.3.2.2 skrll struct pfr_ktable *p; 1142 1.3.2.2 skrll int s = 0, xdel = 0; 1143 1.3.2.2 skrll 1144 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_ALLRSETS); 1145 1.3.2.6 skrll if (pfr_fix_anchor(filter->pfrt_anchor)) 1146 1.3.2.6 skrll return (EINVAL); 1147 1.3.2.2 skrll if (pfr_table_count(filter, flags) < 0) 1148 1.3.2.2 skrll return (ENOENT); 1149 1.3.2.2 skrll 1150 1.3.2.2 skrll SLIST_INIT(&workq); 1151 1.3.2.2 skrll RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) { 1152 1.3.2.2 skrll if (pfr_skip_table(filter, p, flags)) 1153 1.3.2.2 skrll continue; 1154 1.3.2.2 skrll if (!strcmp(p->pfrkt_anchor, PF_RESERVED_ANCHOR)) 1155 1.3.2.2 skrll continue; 1156 1.3.2.2 skrll if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) 1157 1.3.2.2 skrll continue; 1158 1.3.2.2 skrll p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE; 1159 1.3.2.2 skrll SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1160 1.3.2.2 skrll xdel++; 1161 1.3.2.2 skrll } 1162 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 1163 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1164 1.3.2.2 skrll s = splsoftnet(); 1165 1.3.2.2 skrll pfr_setflags_ktables(&workq); 1166 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1167 1.3.2.2 skrll splx(s); 1168 1.3.2.2 skrll } 1169 1.3.2.2 skrll if (ndel != NULL) 1170 1.3.2.2 skrll *ndel = xdel; 1171 1.3.2.2 skrll return (0); 1172 1.3.2.2 skrll } 1173 1.3.2.2 skrll 1174 1.3.2.2 skrll int 1175 1.3.2.2 skrll pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags) 1176 1.3.2.2 skrll { 1177 1.3.2.2 skrll struct pfr_ktableworkq addq, changeq; 1178 1.3.2.2 skrll struct pfr_ktable *p, *q, *r, key; 1179 1.3.2.5 skrll int i, rv, s = 0 /* XXX gcc */, xadd = 0; 1180 1.3.2.5 skrll long tzero = time_second; 1181 1.3.2.2 skrll 1182 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY); 1183 1.3.2.2 skrll SLIST_INIT(&addq); 1184 1.3.2.2 skrll SLIST_INIT(&changeq); 1185 1.3.2.2 skrll for (i = 0; i < size; i++) { 1186 1.3.2.2 skrll if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t))) 1187 1.3.2.2 skrll senderr(EFAULT); 1188 1.3.2.2 skrll if (pfr_validate_table(&key.pfrkt_t, PFR_TFLAG_USRMASK, 1189 1.3.2.2 skrll flags & PFR_FLAG_USERIOCTL)) 1190 1.3.2.2 skrll senderr(EINVAL); 1191 1.3.2.2 skrll key.pfrkt_flags |= PFR_TFLAG_ACTIVE; 1192 1.3.2.2 skrll p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key); 1193 1.3.2.2 skrll if (p == NULL) { 1194 1.3.2.2 skrll p = pfr_create_ktable(&key.pfrkt_t, tzero, 1); 1195 1.3.2.2 skrll if (p == NULL) 1196 1.3.2.2 skrll senderr(ENOMEM); 1197 1.3.2.2 skrll SLIST_FOREACH(q, &addq, pfrkt_workq) { 1198 1.3.2.2 skrll if (!pfr_ktable_compare(p, q)) 1199 1.3.2.2 skrll goto _skip; 1200 1.3.2.2 skrll } 1201 1.3.2.2 skrll SLIST_INSERT_HEAD(&addq, p, pfrkt_workq); 1202 1.3.2.2 skrll xadd++; 1203 1.3.2.2 skrll if (!key.pfrkt_anchor[0]) 1204 1.3.2.2 skrll goto _skip; 1205 1.3.2.2 skrll 1206 1.3.2.2 skrll /* find or create root table */ 1207 1.3.2.2 skrll bzero(key.pfrkt_anchor, sizeof(key.pfrkt_anchor)); 1208 1.3.2.2 skrll r = RB_FIND(pfr_ktablehead, &pfr_ktables, &key); 1209 1.3.2.2 skrll if (r != NULL) { 1210 1.3.2.2 skrll p->pfrkt_root = r; 1211 1.3.2.2 skrll goto _skip; 1212 1.3.2.2 skrll } 1213 1.3.2.2 skrll SLIST_FOREACH(q, &addq, pfrkt_workq) { 1214 1.3.2.2 skrll if (!pfr_ktable_compare(&key, q)) { 1215 1.3.2.2 skrll p->pfrkt_root = q; 1216 1.3.2.2 skrll goto _skip; 1217 1.3.2.2 skrll } 1218 1.3.2.2 skrll } 1219 1.3.2.2 skrll key.pfrkt_flags = 0; 1220 1.3.2.2 skrll r = pfr_create_ktable(&key.pfrkt_t, 0, 1); 1221 1.3.2.2 skrll if (r == NULL) 1222 1.3.2.2 skrll senderr(ENOMEM); 1223 1.3.2.2 skrll SLIST_INSERT_HEAD(&addq, r, pfrkt_workq); 1224 1.3.2.2 skrll p->pfrkt_root = r; 1225 1.3.2.2 skrll } else if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) { 1226 1.3.2.2 skrll SLIST_FOREACH(q, &changeq, pfrkt_workq) 1227 1.3.2.2 skrll if (!pfr_ktable_compare(&key, q)) 1228 1.3.2.2 skrll goto _skip; 1229 1.3.2.2 skrll p->pfrkt_nflags = (p->pfrkt_flags & 1230 1.3.2.2 skrll ~PFR_TFLAG_USRMASK) | key.pfrkt_flags; 1231 1.3.2.2 skrll SLIST_INSERT_HEAD(&changeq, p, pfrkt_workq); 1232 1.3.2.2 skrll xadd++; 1233 1.3.2.2 skrll } 1234 1.3.2.2 skrll _skip: 1235 1.3.2.2 skrll ; 1236 1.3.2.2 skrll } 1237 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 1238 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1239 1.3.2.2 skrll s = splsoftnet(); 1240 1.3.2.2 skrll pfr_insert_ktables(&addq); 1241 1.3.2.2 skrll pfr_setflags_ktables(&changeq); 1242 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1243 1.3.2.2 skrll splx(s); 1244 1.3.2.2 skrll } else 1245 1.3.2.2 skrll pfr_destroy_ktables(&addq, 0); 1246 1.3.2.2 skrll if (nadd != NULL) 1247 1.3.2.2 skrll *nadd = xadd; 1248 1.3.2.2 skrll return (0); 1249 1.3.2.2 skrll _bad: 1250 1.3.2.2 skrll pfr_destroy_ktables(&addq, 0); 1251 1.3.2.2 skrll return (rv); 1252 1.3.2.2 skrll } 1253 1.3.2.2 skrll 1254 1.3.2.2 skrll int 1255 1.3.2.2 skrll pfr_del_tables(struct pfr_table *tbl, int size, int *ndel, int flags) 1256 1.3.2.2 skrll { 1257 1.3.2.2 skrll struct pfr_ktableworkq workq; 1258 1.3.2.2 skrll struct pfr_ktable *p, *q, key; 1259 1.3.2.2 skrll int i, s = 0, xdel = 0; 1260 1.3.2.2 skrll 1261 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY); 1262 1.3.2.2 skrll SLIST_INIT(&workq); 1263 1.3.2.2 skrll for (i = 0; i < size; i++) { 1264 1.3.2.2 skrll if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t))) 1265 1.3.2.2 skrll return (EFAULT); 1266 1.3.2.2 skrll if (pfr_validate_table(&key.pfrkt_t, 0, 1267 1.3.2.2 skrll flags & PFR_FLAG_USERIOCTL)) 1268 1.3.2.2 skrll return (EINVAL); 1269 1.3.2.2 skrll p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key); 1270 1.3.2.2 skrll if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) { 1271 1.3.2.2 skrll SLIST_FOREACH(q, &workq, pfrkt_workq) 1272 1.3.2.2 skrll if (!pfr_ktable_compare(p, q)) 1273 1.3.2.2 skrll goto _skip; 1274 1.3.2.2 skrll p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE; 1275 1.3.2.2 skrll SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1276 1.3.2.2 skrll xdel++; 1277 1.3.2.2 skrll } 1278 1.3.2.2 skrll _skip: 1279 1.3.2.2 skrll ; 1280 1.3.2.2 skrll } 1281 1.3.2.2 skrll 1282 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 1283 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1284 1.3.2.2 skrll s = splsoftnet(); 1285 1.3.2.2 skrll pfr_setflags_ktables(&workq); 1286 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1287 1.3.2.2 skrll splx(s); 1288 1.3.2.2 skrll } 1289 1.3.2.2 skrll if (ndel != NULL) 1290 1.3.2.2 skrll *ndel = xdel; 1291 1.3.2.2 skrll return (0); 1292 1.3.2.2 skrll } 1293 1.3.2.2 skrll 1294 1.3.2.2 skrll int 1295 1.3.2.2 skrll pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size, 1296 1.3.2.2 skrll int flags) 1297 1.3.2.2 skrll { 1298 1.3.2.2 skrll struct pfr_ktable *p; 1299 1.3.2.2 skrll int n, nn; 1300 1.3.2.2 skrll 1301 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ALLRSETS); 1302 1.3.2.6 skrll if (pfr_fix_anchor(filter->pfrt_anchor)) 1303 1.3.2.6 skrll return (EINVAL); 1304 1.3.2.2 skrll n = nn = pfr_table_count(filter, flags); 1305 1.3.2.2 skrll if (n < 0) 1306 1.3.2.2 skrll return (ENOENT); 1307 1.3.2.2 skrll if (n > *size) { 1308 1.3.2.2 skrll *size = n; 1309 1.3.2.2 skrll return (0); 1310 1.3.2.2 skrll } 1311 1.3.2.2 skrll RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) { 1312 1.3.2.2 skrll if (pfr_skip_table(filter, p, flags)) 1313 1.3.2.2 skrll continue; 1314 1.3.2.2 skrll if (n-- <= 0) 1315 1.3.2.2 skrll continue; 1316 1.3.2.2 skrll if (COPYOUT(&p->pfrkt_t, tbl++, sizeof(*tbl))) 1317 1.3.2.2 skrll return (EFAULT); 1318 1.3.2.2 skrll } 1319 1.3.2.2 skrll if (n) { 1320 1.3.2.2 skrll printf("pfr_get_tables: corruption detected (%d).\n", n); 1321 1.3.2.2 skrll return (ENOTTY); 1322 1.3.2.2 skrll } 1323 1.3.2.2 skrll *size = nn; 1324 1.3.2.2 skrll return (0); 1325 1.3.2.2 skrll } 1326 1.3.2.2 skrll 1327 1.3.2.2 skrll int 1328 1.3.2.2 skrll pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size, 1329 1.3.2.2 skrll int flags) 1330 1.3.2.2 skrll { 1331 1.3.2.2 skrll struct pfr_ktable *p; 1332 1.3.2.2 skrll struct pfr_ktableworkq workq; 1333 1.3.2.5 skrll int s = 0 /* XXX gcc */, n, nn; 1334 1.3.2.5 skrll long tzero = time_second; 1335 1.3.2.2 skrll 1336 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC|PFR_FLAG_ALLRSETS); 1337 1.3.2.2 skrll /* XXX PFR_FLAG_CLSTATS disabled */ 1338 1.3.2.6 skrll if (pfr_fix_anchor(filter->pfrt_anchor)) 1339 1.3.2.6 skrll return (EINVAL); 1340 1.3.2.2 skrll n = nn = pfr_table_count(filter, flags); 1341 1.3.2.2 skrll if (n < 0) 1342 1.3.2.2 skrll return (ENOENT); 1343 1.3.2.2 skrll if (n > *size) { 1344 1.3.2.2 skrll *size = n; 1345 1.3.2.2 skrll return (0); 1346 1.3.2.2 skrll } 1347 1.3.2.2 skrll SLIST_INIT(&workq); 1348 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1349 1.3.2.2 skrll s = splsoftnet(); 1350 1.3.2.2 skrll RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) { 1351 1.3.2.2 skrll if (pfr_skip_table(filter, p, flags)) 1352 1.3.2.2 skrll continue; 1353 1.3.2.2 skrll if (n-- <= 0) 1354 1.3.2.2 skrll continue; 1355 1.3.2.2 skrll if (!(flags & PFR_FLAG_ATOMIC)) 1356 1.3.2.2 skrll s = splsoftnet(); 1357 1.3.2.2 skrll if (COPYOUT(&p->pfrkt_ts, tbl++, sizeof(*tbl))) { 1358 1.3.2.2 skrll splx(s); 1359 1.3.2.2 skrll return (EFAULT); 1360 1.3.2.2 skrll } 1361 1.3.2.2 skrll if (!(flags & PFR_FLAG_ATOMIC)) 1362 1.3.2.2 skrll splx(s); 1363 1.3.2.2 skrll SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1364 1.3.2.2 skrll } 1365 1.3.2.2 skrll if (flags & PFR_FLAG_CLSTATS) 1366 1.3.2.2 skrll pfr_clstats_ktables(&workq, tzero, 1367 1.3.2.2 skrll flags & PFR_FLAG_ADDRSTOO); 1368 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1369 1.3.2.2 skrll splx(s); 1370 1.3.2.2 skrll if (n) { 1371 1.3.2.2 skrll printf("pfr_get_tstats: corruption detected (%d).\n", n); 1372 1.3.2.2 skrll return (ENOTTY); 1373 1.3.2.2 skrll } 1374 1.3.2.2 skrll *size = nn; 1375 1.3.2.2 skrll return (0); 1376 1.3.2.2 skrll } 1377 1.3.2.2 skrll 1378 1.3.2.2 skrll int 1379 1.3.2.2 skrll pfr_clr_tstats(struct pfr_table *tbl, int size, int *nzero, int flags) 1380 1.3.2.2 skrll { 1381 1.3.2.2 skrll struct pfr_ktableworkq workq; 1382 1.3.2.2 skrll struct pfr_ktable *p, key; 1383 1.3.2.5 skrll int i, s = 0 /* XXX gcc */, xzero = 0; 1384 1.3.2.5 skrll long tzero = time_second; 1385 1.3.2.2 skrll 1386 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_ADDRSTOO); 1387 1.3.2.2 skrll SLIST_INIT(&workq); 1388 1.3.2.2 skrll for (i = 0; i < size; i++) { 1389 1.3.2.2 skrll if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t))) 1390 1.3.2.2 skrll return (EFAULT); 1391 1.3.2.2 skrll if (pfr_validate_table(&key.pfrkt_t, 0, 0)) 1392 1.3.2.2 skrll return (EINVAL); 1393 1.3.2.2 skrll p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key); 1394 1.3.2.2 skrll if (p != NULL) { 1395 1.3.2.2 skrll SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1396 1.3.2.2 skrll xzero++; 1397 1.3.2.2 skrll } 1398 1.3.2.2 skrll } 1399 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 1400 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1401 1.3.2.2 skrll s = splsoftnet(); 1402 1.3.2.2 skrll pfr_clstats_ktables(&workq, tzero, flags & PFR_FLAG_ADDRSTOO); 1403 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1404 1.3.2.2 skrll splx(s); 1405 1.3.2.2 skrll } 1406 1.3.2.2 skrll if (nzero != NULL) 1407 1.3.2.2 skrll *nzero = xzero; 1408 1.3.2.2 skrll return (0); 1409 1.3.2.2 skrll } 1410 1.3.2.2 skrll 1411 1.3.2.2 skrll int 1412 1.3.2.2 skrll pfr_set_tflags(struct pfr_table *tbl, int size, int setflag, int clrflag, 1413 1.3.2.2 skrll int *nchange, int *ndel, int flags) 1414 1.3.2.2 skrll { 1415 1.3.2.2 skrll struct pfr_ktableworkq workq; 1416 1.3.2.2 skrll struct pfr_ktable *p, *q, key; 1417 1.3.2.2 skrll int i, s = 0, xchange = 0, xdel = 0; 1418 1.3.2.2 skrll 1419 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY); 1420 1.3.2.2 skrll if ((setflag & ~PFR_TFLAG_USRMASK) || 1421 1.3.2.2 skrll (clrflag & ~PFR_TFLAG_USRMASK) || 1422 1.3.2.2 skrll (setflag & clrflag)) 1423 1.3.2.2 skrll return (EINVAL); 1424 1.3.2.2 skrll SLIST_INIT(&workq); 1425 1.3.2.2 skrll for (i = 0; i < size; i++) { 1426 1.3.2.2 skrll if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t))) 1427 1.3.2.2 skrll return (EFAULT); 1428 1.3.2.2 skrll if (pfr_validate_table(&key.pfrkt_t, 0, 1429 1.3.2.2 skrll flags & PFR_FLAG_USERIOCTL)) 1430 1.3.2.2 skrll return (EINVAL); 1431 1.3.2.2 skrll p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key); 1432 1.3.2.2 skrll if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) { 1433 1.3.2.2 skrll p->pfrkt_nflags = (p->pfrkt_flags | setflag) & 1434 1.3.2.2 skrll ~clrflag; 1435 1.3.2.2 skrll if (p->pfrkt_nflags == p->pfrkt_flags) 1436 1.3.2.2 skrll goto _skip; 1437 1.3.2.2 skrll SLIST_FOREACH(q, &workq, pfrkt_workq) 1438 1.3.2.2 skrll if (!pfr_ktable_compare(p, q)) 1439 1.3.2.2 skrll goto _skip; 1440 1.3.2.2 skrll SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1441 1.3.2.2 skrll if ((p->pfrkt_flags & PFR_TFLAG_PERSIST) && 1442 1.3.2.2 skrll (clrflag & PFR_TFLAG_PERSIST) && 1443 1.3.2.2 skrll !(p->pfrkt_flags & PFR_TFLAG_REFERENCED)) 1444 1.3.2.2 skrll xdel++; 1445 1.3.2.2 skrll else 1446 1.3.2.2 skrll xchange++; 1447 1.3.2.2 skrll } 1448 1.3.2.2 skrll _skip: 1449 1.3.2.2 skrll ; 1450 1.3.2.2 skrll } 1451 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 1452 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1453 1.3.2.2 skrll s = splsoftnet(); 1454 1.3.2.2 skrll pfr_setflags_ktables(&workq); 1455 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1456 1.3.2.2 skrll splx(s); 1457 1.3.2.2 skrll } 1458 1.3.2.2 skrll if (nchange != NULL) 1459 1.3.2.2 skrll *nchange = xchange; 1460 1.3.2.2 skrll if (ndel != NULL) 1461 1.3.2.2 skrll *ndel = xdel; 1462 1.3.2.2 skrll return (0); 1463 1.3.2.2 skrll } 1464 1.3.2.2 skrll 1465 1.3.2.2 skrll int 1466 1.3.2.2 skrll pfr_ina_begin(struct pfr_table *trs, u_int32_t *ticket, int *ndel, int flags) 1467 1.3.2.2 skrll { 1468 1.3.2.2 skrll struct pfr_ktableworkq workq; 1469 1.3.2.2 skrll struct pfr_ktable *p; 1470 1.3.2.2 skrll struct pf_ruleset *rs; 1471 1.3.2.2 skrll int xdel = 0; 1472 1.3.2.2 skrll 1473 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_DUMMY); 1474 1.3.2.5 skrll rs = pf_find_or_create_ruleset(trs->pfrt_anchor); 1475 1.3.2.2 skrll if (rs == NULL) 1476 1.3.2.2 skrll return (ENOMEM); 1477 1.3.2.2 skrll SLIST_INIT(&workq); 1478 1.3.2.2 skrll RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) { 1479 1.3.2.2 skrll if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) || 1480 1.3.2.2 skrll pfr_skip_table(trs, p, 0)) 1481 1.3.2.2 skrll continue; 1482 1.3.2.2 skrll p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE; 1483 1.3.2.2 skrll SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1484 1.3.2.2 skrll xdel++; 1485 1.3.2.2 skrll } 1486 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 1487 1.3.2.2 skrll pfr_setflags_ktables(&workq); 1488 1.3.2.2 skrll if (ticket != NULL) 1489 1.3.2.2 skrll *ticket = ++rs->tticket; 1490 1.3.2.2 skrll rs->topen = 1; 1491 1.3.2.2 skrll } else 1492 1.3.2.2 skrll pf_remove_if_empty_ruleset(rs); 1493 1.3.2.2 skrll if (ndel != NULL) 1494 1.3.2.2 skrll *ndel = xdel; 1495 1.3.2.2 skrll return (0); 1496 1.3.2.2 skrll } 1497 1.3.2.2 skrll 1498 1.3.2.2 skrll int 1499 1.3.2.2 skrll pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size, 1500 1.3.2.2 skrll int *nadd, int *naddr, u_int32_t ticket, int flags) 1501 1.3.2.2 skrll { 1502 1.3.2.2 skrll struct pfr_ktableworkq tableq; 1503 1.3.2.2 skrll struct pfr_kentryworkq addrq; 1504 1.3.2.2 skrll struct pfr_ktable *kt, *rt, *shadow, key; 1505 1.3.2.2 skrll struct pfr_kentry *p; 1506 1.3.2.2 skrll struct pfr_addr ad; 1507 1.3.2.2 skrll struct pf_ruleset *rs; 1508 1.3.2.2 skrll int i, rv, xadd = 0, xaddr = 0; 1509 1.3.2.2 skrll 1510 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_DUMMY|PFR_FLAG_ADDRSTOO); 1511 1.3.2.2 skrll if (size && !(flags & PFR_FLAG_ADDRSTOO)) 1512 1.3.2.2 skrll return (EINVAL); 1513 1.3.2.2 skrll if (pfr_validate_table(tbl, PFR_TFLAG_USRMASK, 1514 1.3.2.2 skrll flags & PFR_FLAG_USERIOCTL)) 1515 1.3.2.2 skrll return (EINVAL); 1516 1.3.2.5 skrll rs = pf_find_ruleset(tbl->pfrt_anchor); 1517 1.3.2.2 skrll if (rs == NULL || !rs->topen || ticket != rs->tticket) 1518 1.3.2.2 skrll return (EBUSY); 1519 1.3.2.2 skrll tbl->pfrt_flags |= PFR_TFLAG_INACTIVE; 1520 1.3.2.2 skrll SLIST_INIT(&tableq); 1521 1.3.2.2 skrll kt = RB_FIND(pfr_ktablehead, &pfr_ktables, (struct pfr_ktable *)tbl); 1522 1.3.2.2 skrll if (kt == NULL) { 1523 1.3.2.2 skrll kt = pfr_create_ktable(tbl, 0, 1); 1524 1.3.2.2 skrll if (kt == NULL) 1525 1.3.2.2 skrll return (ENOMEM); 1526 1.3.2.2 skrll SLIST_INSERT_HEAD(&tableq, kt, pfrkt_workq); 1527 1.3.2.2 skrll xadd++; 1528 1.3.2.2 skrll if (!tbl->pfrt_anchor[0]) 1529 1.3.2.2 skrll goto _skip; 1530 1.3.2.2 skrll 1531 1.3.2.2 skrll /* find or create root table */ 1532 1.3.2.2 skrll bzero(&key, sizeof(key)); 1533 1.3.2.2 skrll strlcpy(key.pfrkt_name, tbl->pfrt_name, sizeof(key.pfrkt_name)); 1534 1.3.2.2 skrll rt = RB_FIND(pfr_ktablehead, &pfr_ktables, &key); 1535 1.3.2.2 skrll if (rt != NULL) { 1536 1.3.2.2 skrll kt->pfrkt_root = rt; 1537 1.3.2.2 skrll goto _skip; 1538 1.3.2.2 skrll } 1539 1.3.2.2 skrll rt = pfr_create_ktable(&key.pfrkt_t, 0, 1); 1540 1.3.2.2 skrll if (rt == NULL) { 1541 1.3.2.2 skrll pfr_destroy_ktables(&tableq, 0); 1542 1.3.2.2 skrll return (ENOMEM); 1543 1.3.2.2 skrll } 1544 1.3.2.2 skrll SLIST_INSERT_HEAD(&tableq, rt, pfrkt_workq); 1545 1.3.2.2 skrll kt->pfrkt_root = rt; 1546 1.3.2.2 skrll } else if (!(kt->pfrkt_flags & PFR_TFLAG_INACTIVE)) 1547 1.3.2.2 skrll xadd++; 1548 1.3.2.2 skrll _skip: 1549 1.3.2.2 skrll shadow = pfr_create_ktable(tbl, 0, 0); 1550 1.3.2.2 skrll if (shadow == NULL) { 1551 1.3.2.2 skrll pfr_destroy_ktables(&tableq, 0); 1552 1.3.2.2 skrll return (ENOMEM); 1553 1.3.2.2 skrll } 1554 1.3.2.2 skrll SLIST_INIT(&addrq); 1555 1.3.2.2 skrll for (i = 0; i < size; i++) { 1556 1.3.2.2 skrll if (COPYIN(addr+i, &ad, sizeof(ad))) 1557 1.3.2.2 skrll senderr(EFAULT); 1558 1.3.2.2 skrll if (pfr_validate_addr(&ad)) 1559 1.3.2.2 skrll senderr(EINVAL); 1560 1.3.2.2 skrll if (pfr_lookup_addr(shadow, &ad, 1) != NULL) 1561 1.3.2.2 skrll continue; 1562 1.3.2.6 skrll p = pfr_create_kentry(&ad, 0); 1563 1.3.2.2 skrll if (p == NULL) 1564 1.3.2.2 skrll senderr(ENOMEM); 1565 1.3.2.2 skrll if (pfr_route_kentry(shadow, p)) { 1566 1.3.2.2 skrll pfr_destroy_kentry(p); 1567 1.3.2.2 skrll continue; 1568 1.3.2.2 skrll } 1569 1.3.2.2 skrll SLIST_INSERT_HEAD(&addrq, p, pfrke_workq); 1570 1.3.2.2 skrll xaddr++; 1571 1.3.2.2 skrll } 1572 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 1573 1.3.2.2 skrll if (kt->pfrkt_shadow != NULL) 1574 1.3.2.2 skrll pfr_destroy_ktable(kt->pfrkt_shadow, 1); 1575 1.3.2.2 skrll kt->pfrkt_flags |= PFR_TFLAG_INACTIVE; 1576 1.3.2.2 skrll pfr_insert_ktables(&tableq); 1577 1.3.2.2 skrll shadow->pfrkt_cnt = (flags & PFR_FLAG_ADDRSTOO) ? 1578 1.3.2.2 skrll xaddr : NO_ADDRESSES; 1579 1.3.2.2 skrll kt->pfrkt_shadow = shadow; 1580 1.3.2.2 skrll } else { 1581 1.3.2.2 skrll pfr_clean_node_mask(shadow, &addrq); 1582 1.3.2.2 skrll pfr_destroy_ktable(shadow, 0); 1583 1.3.2.2 skrll pfr_destroy_ktables(&tableq, 0); 1584 1.3.2.2 skrll pfr_destroy_kentries(&addrq); 1585 1.3.2.2 skrll } 1586 1.3.2.2 skrll if (nadd != NULL) 1587 1.3.2.2 skrll *nadd = xadd; 1588 1.3.2.2 skrll if (naddr != NULL) 1589 1.3.2.2 skrll *naddr = xaddr; 1590 1.3.2.2 skrll return (0); 1591 1.3.2.2 skrll _bad: 1592 1.3.2.2 skrll pfr_destroy_ktable(shadow, 0); 1593 1.3.2.2 skrll pfr_destroy_ktables(&tableq, 0); 1594 1.3.2.2 skrll pfr_destroy_kentries(&addrq); 1595 1.3.2.2 skrll return (rv); 1596 1.3.2.2 skrll } 1597 1.3.2.2 skrll 1598 1.3.2.2 skrll int 1599 1.3.2.2 skrll pfr_ina_rollback(struct pfr_table *trs, u_int32_t ticket, int *ndel, int flags) 1600 1.3.2.2 skrll { 1601 1.3.2.2 skrll struct pfr_ktableworkq workq; 1602 1.3.2.2 skrll struct pfr_ktable *p; 1603 1.3.2.2 skrll struct pf_ruleset *rs; 1604 1.3.2.2 skrll int xdel = 0; 1605 1.3.2.2 skrll 1606 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_DUMMY); 1607 1.3.2.5 skrll rs = pf_find_ruleset(trs->pfrt_anchor); 1608 1.3.2.2 skrll if (rs == NULL || !rs->topen || ticket != rs->tticket) 1609 1.3.2.2 skrll return (0); 1610 1.3.2.2 skrll SLIST_INIT(&workq); 1611 1.3.2.2 skrll RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) { 1612 1.3.2.2 skrll if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) || 1613 1.3.2.2 skrll pfr_skip_table(trs, p, 0)) 1614 1.3.2.2 skrll continue; 1615 1.3.2.2 skrll p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE; 1616 1.3.2.2 skrll SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1617 1.3.2.2 skrll xdel++; 1618 1.3.2.2 skrll } 1619 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 1620 1.3.2.2 skrll pfr_setflags_ktables(&workq); 1621 1.3.2.2 skrll rs->topen = 0; 1622 1.3.2.2 skrll pf_remove_if_empty_ruleset(rs); 1623 1.3.2.2 skrll } 1624 1.3.2.2 skrll if (ndel != NULL) 1625 1.3.2.2 skrll *ndel = xdel; 1626 1.3.2.2 skrll return (0); 1627 1.3.2.2 skrll } 1628 1.3.2.2 skrll 1629 1.3.2.2 skrll int 1630 1.3.2.2 skrll pfr_ina_commit(struct pfr_table *trs, u_int32_t ticket, int *nadd, 1631 1.3.2.2 skrll int *nchange, int flags) 1632 1.3.2.2 skrll { 1633 1.3.2.3 skrll struct pfr_ktable *p, *q; 1634 1.3.2.2 skrll struct pfr_ktableworkq workq; 1635 1.3.2.2 skrll struct pf_ruleset *rs; 1636 1.3.2.5 skrll int s = 0 /* XXX gcc */, xadd = 0, xchange = 0; 1637 1.3.2.5 skrll long tzero = time_second; 1638 1.3.2.2 skrll 1639 1.3.2.2 skrll ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY); 1640 1.3.2.5 skrll rs = pf_find_ruleset(trs->pfrt_anchor); 1641 1.3.2.2 skrll if (rs == NULL || !rs->topen || ticket != rs->tticket) 1642 1.3.2.2 skrll return (EBUSY); 1643 1.3.2.2 skrll 1644 1.3.2.2 skrll SLIST_INIT(&workq); 1645 1.3.2.2 skrll RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) { 1646 1.3.2.2 skrll if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) || 1647 1.3.2.2 skrll pfr_skip_table(trs, p, 0)) 1648 1.3.2.2 skrll continue; 1649 1.3.2.2 skrll SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1650 1.3.2.2 skrll if (p->pfrkt_flags & PFR_TFLAG_ACTIVE) 1651 1.3.2.2 skrll xchange++; 1652 1.3.2.2 skrll else 1653 1.3.2.2 skrll xadd++; 1654 1.3.2.2 skrll } 1655 1.3.2.2 skrll 1656 1.3.2.2 skrll if (!(flags & PFR_FLAG_DUMMY)) { 1657 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1658 1.3.2.2 skrll s = splsoftnet(); 1659 1.3.2.3 skrll for (p = SLIST_FIRST(&workq); p != NULL; p = q) { 1660 1.3.2.3 skrll q = SLIST_NEXT(p, pfrkt_workq); 1661 1.3.2.2 skrll pfr_commit_ktable(p, tzero); 1662 1.3.2.3 skrll } 1663 1.3.2.2 skrll if (flags & PFR_FLAG_ATOMIC) 1664 1.3.2.2 skrll splx(s); 1665 1.3.2.2 skrll rs->topen = 0; 1666 1.3.2.2 skrll pf_remove_if_empty_ruleset(rs); 1667 1.3.2.2 skrll } 1668 1.3.2.2 skrll if (nadd != NULL) 1669 1.3.2.2 skrll *nadd = xadd; 1670 1.3.2.2 skrll if (nchange != NULL) 1671 1.3.2.2 skrll *nchange = xchange; 1672 1.3.2.2 skrll 1673 1.3.2.2 skrll return (0); 1674 1.3.2.2 skrll } 1675 1.3.2.2 skrll 1676 1.3.2.2 skrll void 1677 1.3.2.2 skrll pfr_commit_ktable(struct pfr_ktable *kt, long tzero) 1678 1.3.2.2 skrll { 1679 1.3.2.2 skrll struct pfr_ktable *shadow = kt->pfrkt_shadow; 1680 1.3.2.2 skrll int nflags; 1681 1.3.2.2 skrll 1682 1.3.2.2 skrll if (shadow->pfrkt_cnt == NO_ADDRESSES) { 1683 1.3.2.2 skrll if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 1684 1.3.2.2 skrll pfr_clstats_ktable(kt, tzero, 1); 1685 1.3.2.2 skrll } else if (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) { 1686 1.3.2.2 skrll /* kt might contain addresses */ 1687 1.3.2.2 skrll struct pfr_kentryworkq addrq, addq, changeq, delq, garbageq; 1688 1.3.2.2 skrll struct pfr_kentry *p, *q, *next; 1689 1.3.2.2 skrll struct pfr_addr ad; 1690 1.3.2.2 skrll 1691 1.3.2.2 skrll pfr_enqueue_addrs(shadow, &addrq, NULL, 0); 1692 1.3.2.2 skrll pfr_mark_addrs(kt); 1693 1.3.2.2 skrll SLIST_INIT(&addq); 1694 1.3.2.2 skrll SLIST_INIT(&changeq); 1695 1.3.2.2 skrll SLIST_INIT(&delq); 1696 1.3.2.2 skrll SLIST_INIT(&garbageq); 1697 1.3.2.2 skrll pfr_clean_node_mask(shadow, &addrq); 1698 1.3.2.2 skrll for (p = SLIST_FIRST(&addrq); p != NULL; p = next) { 1699 1.3.2.2 skrll next = SLIST_NEXT(p, pfrke_workq); /* XXX */ 1700 1.3.2.2 skrll pfr_copyout_addr(&ad, p); 1701 1.3.2.2 skrll q = pfr_lookup_addr(kt, &ad, 1); 1702 1.3.2.2 skrll if (q != NULL) { 1703 1.3.2.2 skrll if (q->pfrke_not != p->pfrke_not) 1704 1.3.2.2 skrll SLIST_INSERT_HEAD(&changeq, q, 1705 1.3.2.2 skrll pfrke_workq); 1706 1.3.2.2 skrll q->pfrke_mark = 1; 1707 1.3.2.2 skrll SLIST_INSERT_HEAD(&garbageq, p, pfrke_workq); 1708 1.3.2.2 skrll } else { 1709 1.3.2.2 skrll p->pfrke_tzero = tzero; 1710 1.3.2.2 skrll SLIST_INSERT_HEAD(&addq, p, pfrke_workq); 1711 1.3.2.2 skrll } 1712 1.3.2.2 skrll } 1713 1.3.2.2 skrll pfr_enqueue_addrs(kt, &delq, NULL, ENQUEUE_UNMARKED_ONLY); 1714 1.3.2.2 skrll pfr_insert_kentries(kt, &addq, tzero); 1715 1.3.2.2 skrll pfr_remove_kentries(kt, &delq); 1716 1.3.2.2 skrll pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG); 1717 1.3.2.2 skrll pfr_destroy_kentries(&garbageq); 1718 1.3.2.2 skrll } else { 1719 1.3.2.2 skrll /* kt cannot contain addresses */ 1720 1.3.2.2 skrll SWAP(struct radix_node_head *, kt->pfrkt_ip4, 1721 1.3.2.2 skrll shadow->pfrkt_ip4); 1722 1.3.2.2 skrll SWAP(struct radix_node_head *, kt->pfrkt_ip6, 1723 1.3.2.2 skrll shadow->pfrkt_ip6); 1724 1.3.2.2 skrll SWAP(int, kt->pfrkt_cnt, shadow->pfrkt_cnt); 1725 1.3.2.2 skrll pfr_clstats_ktable(kt, tzero, 1); 1726 1.3.2.2 skrll } 1727 1.3.2.2 skrll nflags = ((shadow->pfrkt_flags & PFR_TFLAG_USRMASK) | 1728 1.3.2.2 skrll (kt->pfrkt_flags & PFR_TFLAG_SETMASK) | PFR_TFLAG_ACTIVE) 1729 1.3.2.2 skrll & ~PFR_TFLAG_INACTIVE; 1730 1.3.2.2 skrll pfr_destroy_ktable(shadow, 0); 1731 1.3.2.2 skrll kt->pfrkt_shadow = NULL; 1732 1.3.2.2 skrll pfr_setflags_ktable(kt, nflags); 1733 1.3.2.2 skrll } 1734 1.3.2.2 skrll 1735 1.3.2.2 skrll int 1736 1.3.2.2 skrll pfr_validate_table(struct pfr_table *tbl, int allowedflags, int no_reserved) 1737 1.3.2.2 skrll { 1738 1.3.2.2 skrll int i; 1739 1.3.2.2 skrll 1740 1.3.2.2 skrll if (!tbl->pfrt_name[0]) 1741 1.3.2.2 skrll return (-1); 1742 1.3.2.2 skrll if (no_reserved && !strcmp(tbl->pfrt_anchor, PF_RESERVED_ANCHOR)) 1743 1.3.2.2 skrll return (-1); 1744 1.3.2.2 skrll if (tbl->pfrt_name[PF_TABLE_NAME_SIZE-1]) 1745 1.3.2.2 skrll return (-1); 1746 1.3.2.2 skrll for (i = strlen(tbl->pfrt_name); i < PF_TABLE_NAME_SIZE; i++) 1747 1.3.2.2 skrll if (tbl->pfrt_name[i]) 1748 1.3.2.2 skrll return (-1); 1749 1.3.2.6 skrll if (pfr_fix_anchor(tbl->pfrt_anchor)) 1750 1.3.2.6 skrll return (-1); 1751 1.3.2.2 skrll if (tbl->pfrt_flags & ~allowedflags) 1752 1.3.2.2 skrll return (-1); 1753 1.3.2.2 skrll return (0); 1754 1.3.2.2 skrll } 1755 1.3.2.2 skrll 1756 1.3.2.6 skrll /* 1757 1.3.2.6 skrll * Rewrite anchors referenced by tables to remove slashes 1758 1.3.2.6 skrll * and check for validity. 1759 1.3.2.6 skrll */ 1760 1.3.2.6 skrll int 1761 1.3.2.6 skrll pfr_fix_anchor(char *anchor) 1762 1.3.2.6 skrll { 1763 1.3.2.6 skrll size_t siz = MAXPATHLEN; 1764 1.3.2.6 skrll int i; 1765 1.3.2.6 skrll 1766 1.3.2.6 skrll if (anchor[0] == '/') { 1767 1.3.2.6 skrll char *path; 1768 1.3.2.6 skrll int off; 1769 1.3.2.6 skrll 1770 1.3.2.6 skrll path = anchor; 1771 1.3.2.6 skrll off = 1; 1772 1.3.2.6 skrll while (*++path == '/') 1773 1.3.2.6 skrll off++; 1774 1.3.2.6 skrll bcopy(path, anchor, siz - off); 1775 1.3.2.6 skrll memset(anchor + siz - off, 0, off); 1776 1.3.2.6 skrll } 1777 1.3.2.6 skrll if (anchor[siz - 1]) 1778 1.3.2.6 skrll return (-1); 1779 1.3.2.6 skrll for (i = strlen(anchor); i < siz; i++) 1780 1.3.2.6 skrll if (anchor[i]) 1781 1.3.2.6 skrll return (-1); 1782 1.3.2.6 skrll return (0); 1783 1.3.2.6 skrll } 1784 1.3.2.6 skrll 1785 1.3.2.2 skrll int 1786 1.3.2.2 skrll pfr_table_count(struct pfr_table *filter, int flags) 1787 1.3.2.2 skrll { 1788 1.3.2.2 skrll struct pf_ruleset *rs; 1789 1.3.2.2 skrll 1790 1.3.2.2 skrll if (flags & PFR_FLAG_ALLRSETS) 1791 1.3.2.2 skrll return (pfr_ktable_cnt); 1792 1.3.2.2 skrll if (filter->pfrt_anchor[0]) { 1793 1.3.2.5 skrll rs = pf_find_ruleset(filter->pfrt_anchor); 1794 1.3.2.5 skrll return ((rs != NULL) ? rs->tables : -1); 1795 1.3.2.2 skrll } 1796 1.3.2.2 skrll return (pf_main_ruleset.tables); 1797 1.3.2.2 skrll } 1798 1.3.2.2 skrll 1799 1.3.2.2 skrll int 1800 1.3.2.2 skrll pfr_skip_table(struct pfr_table *filter, struct pfr_ktable *kt, int flags) 1801 1.3.2.2 skrll { 1802 1.3.2.2 skrll if (flags & PFR_FLAG_ALLRSETS) 1803 1.3.2.2 skrll return (0); 1804 1.3.2.5 skrll if (strcmp(filter->pfrt_anchor, kt->pfrkt_anchor)) 1805 1.3.2.2 skrll return (1); 1806 1.3.2.2 skrll return (0); 1807 1.3.2.2 skrll } 1808 1.3.2.2 skrll 1809 1.3.2.2 skrll void 1810 1.3.2.2 skrll pfr_insert_ktables(struct pfr_ktableworkq *workq) 1811 1.3.2.2 skrll { 1812 1.3.2.2 skrll struct pfr_ktable *p; 1813 1.3.2.2 skrll 1814 1.3.2.2 skrll SLIST_FOREACH(p, workq, pfrkt_workq) 1815 1.3.2.2 skrll pfr_insert_ktable(p); 1816 1.3.2.2 skrll } 1817 1.3.2.2 skrll 1818 1.3.2.2 skrll void 1819 1.3.2.2 skrll pfr_insert_ktable(struct pfr_ktable *kt) 1820 1.3.2.2 skrll { 1821 1.3.2.2 skrll RB_INSERT(pfr_ktablehead, &pfr_ktables, kt); 1822 1.3.2.2 skrll pfr_ktable_cnt++; 1823 1.3.2.2 skrll if (kt->pfrkt_root != NULL) 1824 1.3.2.2 skrll if (!kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]++) 1825 1.3.2.2 skrll pfr_setflags_ktable(kt->pfrkt_root, 1826 1.3.2.2 skrll kt->pfrkt_root->pfrkt_flags|PFR_TFLAG_REFDANCHOR); 1827 1.3.2.2 skrll } 1828 1.3.2.2 skrll 1829 1.3.2.2 skrll void 1830 1.3.2.2 skrll pfr_setflags_ktables(struct pfr_ktableworkq *workq) 1831 1.3.2.2 skrll { 1832 1.3.2.3 skrll struct pfr_ktable *p, *q; 1833 1.3.2.2 skrll 1834 1.3.2.3 skrll for (p = SLIST_FIRST(workq); p; p = q) { 1835 1.3.2.3 skrll q = SLIST_NEXT(p, pfrkt_workq); 1836 1.3.2.2 skrll pfr_setflags_ktable(p, p->pfrkt_nflags); 1837 1.3.2.3 skrll } 1838 1.3.2.2 skrll } 1839 1.3.2.2 skrll 1840 1.3.2.2 skrll void 1841 1.3.2.2 skrll pfr_setflags_ktable(struct pfr_ktable *kt, int newf) 1842 1.3.2.2 skrll { 1843 1.3.2.2 skrll struct pfr_kentryworkq addrq; 1844 1.3.2.2 skrll 1845 1.3.2.2 skrll if (!(newf & PFR_TFLAG_REFERENCED) && 1846 1.3.2.2 skrll !(newf & PFR_TFLAG_PERSIST)) 1847 1.3.2.2 skrll newf &= ~PFR_TFLAG_ACTIVE; 1848 1.3.2.2 skrll if (!(newf & PFR_TFLAG_ACTIVE)) 1849 1.3.2.2 skrll newf &= ~PFR_TFLAG_USRMASK; 1850 1.3.2.2 skrll if (!(newf & PFR_TFLAG_SETMASK)) { 1851 1.3.2.2 skrll RB_REMOVE(pfr_ktablehead, &pfr_ktables, kt); 1852 1.3.2.2 skrll if (kt->pfrkt_root != NULL) 1853 1.3.2.2 skrll if (!--kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]) 1854 1.3.2.2 skrll pfr_setflags_ktable(kt->pfrkt_root, 1855 1.3.2.2 skrll kt->pfrkt_root->pfrkt_flags & 1856 1.3.2.2 skrll ~PFR_TFLAG_REFDANCHOR); 1857 1.3.2.2 skrll pfr_destroy_ktable(kt, 1); 1858 1.3.2.2 skrll pfr_ktable_cnt--; 1859 1.3.2.2 skrll return; 1860 1.3.2.2 skrll } 1861 1.3.2.2 skrll if (!(newf & PFR_TFLAG_ACTIVE) && kt->pfrkt_cnt) { 1862 1.3.2.2 skrll pfr_enqueue_addrs(kt, &addrq, NULL, 0); 1863 1.3.2.2 skrll pfr_remove_kentries(kt, &addrq); 1864 1.3.2.2 skrll } 1865 1.3.2.2 skrll if (!(newf & PFR_TFLAG_INACTIVE) && kt->pfrkt_shadow != NULL) { 1866 1.3.2.2 skrll pfr_destroy_ktable(kt->pfrkt_shadow, 1); 1867 1.3.2.2 skrll kt->pfrkt_shadow = NULL; 1868 1.3.2.2 skrll } 1869 1.3.2.2 skrll kt->pfrkt_flags = newf; 1870 1.3.2.2 skrll } 1871 1.3.2.2 skrll 1872 1.3.2.2 skrll void 1873 1.3.2.2 skrll pfr_clstats_ktables(struct pfr_ktableworkq *workq, long tzero, int recurse) 1874 1.3.2.2 skrll { 1875 1.3.2.2 skrll struct pfr_ktable *p; 1876 1.3.2.2 skrll 1877 1.3.2.2 skrll SLIST_FOREACH(p, workq, pfrkt_workq) 1878 1.3.2.2 skrll pfr_clstats_ktable(p, tzero, recurse); 1879 1.3.2.2 skrll } 1880 1.3.2.2 skrll 1881 1.3.2.2 skrll void 1882 1.3.2.2 skrll pfr_clstats_ktable(struct pfr_ktable *kt, long tzero, int recurse) 1883 1.3.2.2 skrll { 1884 1.3.2.2 skrll struct pfr_kentryworkq addrq; 1885 1.3.2.2 skrll int s; 1886 1.3.2.2 skrll 1887 1.3.2.2 skrll if (recurse) { 1888 1.3.2.2 skrll pfr_enqueue_addrs(kt, &addrq, NULL, 0); 1889 1.3.2.2 skrll pfr_clstats_kentries(&addrq, tzero, 0); 1890 1.3.2.2 skrll } 1891 1.3.2.2 skrll s = splsoftnet(); 1892 1.3.2.2 skrll bzero(kt->pfrkt_packets, sizeof(kt->pfrkt_packets)); 1893 1.3.2.2 skrll bzero(kt->pfrkt_bytes, sizeof(kt->pfrkt_bytes)); 1894 1.3.2.2 skrll kt->pfrkt_match = kt->pfrkt_nomatch = 0; 1895 1.3.2.2 skrll splx(s); 1896 1.3.2.2 skrll kt->pfrkt_tzero = tzero; 1897 1.3.2.2 skrll } 1898 1.3.2.2 skrll 1899 1.3.2.2 skrll struct pfr_ktable * 1900 1.3.2.2 skrll pfr_create_ktable(struct pfr_table *tbl, long tzero, int attachruleset) 1901 1.3.2.2 skrll { 1902 1.3.2.2 skrll struct pfr_ktable *kt; 1903 1.3.2.2 skrll struct pf_ruleset *rs; 1904 1.3.2.2 skrll 1905 1.3.2.2 skrll kt = pool_get(&pfr_ktable_pl, PR_NOWAIT); 1906 1.3.2.2 skrll if (kt == NULL) 1907 1.3.2.2 skrll return (NULL); 1908 1.3.2.2 skrll bzero(kt, sizeof(*kt)); 1909 1.3.2.2 skrll kt->pfrkt_t = *tbl; 1910 1.3.2.2 skrll 1911 1.3.2.2 skrll if (attachruleset) { 1912 1.3.2.5 skrll rs = pf_find_or_create_ruleset(tbl->pfrt_anchor); 1913 1.3.2.2 skrll if (!rs) { 1914 1.3.2.2 skrll pfr_destroy_ktable(kt, 0); 1915 1.3.2.2 skrll return (NULL); 1916 1.3.2.2 skrll } 1917 1.3.2.2 skrll kt->pfrkt_rs = rs; 1918 1.3.2.2 skrll rs->tables++; 1919 1.3.2.2 skrll } 1920 1.3.2.2 skrll 1921 1.3.2.2 skrll if (!rn_inithead((void **)&kt->pfrkt_ip4, 1922 1.3.2.2 skrll offsetof(struct sockaddr_in, sin_addr) * 8) || 1923 1.3.2.2 skrll !rn_inithead((void **)&kt->pfrkt_ip6, 1924 1.3.2.2 skrll offsetof(struct sockaddr_in6, sin6_addr) * 8)) { 1925 1.3.2.2 skrll pfr_destroy_ktable(kt, 0); 1926 1.3.2.2 skrll return (NULL); 1927 1.3.2.2 skrll } 1928 1.3.2.2 skrll kt->pfrkt_tzero = tzero; 1929 1.3.2.2 skrll 1930 1.3.2.2 skrll return (kt); 1931 1.3.2.2 skrll } 1932 1.3.2.2 skrll 1933 1.3.2.2 skrll void 1934 1.3.2.2 skrll pfr_destroy_ktables(struct pfr_ktableworkq *workq, int flushaddr) 1935 1.3.2.2 skrll { 1936 1.3.2.2 skrll struct pfr_ktable *p, *q; 1937 1.3.2.2 skrll 1938 1.3.2.2 skrll for (p = SLIST_FIRST(workq); p; p = q) { 1939 1.3.2.2 skrll q = SLIST_NEXT(p, pfrkt_workq); 1940 1.3.2.2 skrll pfr_destroy_ktable(p, flushaddr); 1941 1.3.2.2 skrll } 1942 1.3.2.2 skrll } 1943 1.3.2.2 skrll 1944 1.3.2.2 skrll void 1945 1.3.2.2 skrll pfr_destroy_ktable(struct pfr_ktable *kt, int flushaddr) 1946 1.3.2.2 skrll { 1947 1.3.2.2 skrll struct pfr_kentryworkq addrq; 1948 1.3.2.2 skrll 1949 1.3.2.2 skrll if (flushaddr) { 1950 1.3.2.2 skrll pfr_enqueue_addrs(kt, &addrq, NULL, 0); 1951 1.3.2.2 skrll pfr_clean_node_mask(kt, &addrq); 1952 1.3.2.2 skrll pfr_destroy_kentries(&addrq); 1953 1.3.2.2 skrll } 1954 1.3.2.2 skrll if (kt->pfrkt_ip4 != NULL) 1955 1.3.2.2 skrll free((caddr_t)kt->pfrkt_ip4, M_RTABLE); 1956 1.3.2.2 skrll if (kt->pfrkt_ip6 != NULL) 1957 1.3.2.2 skrll free((caddr_t)kt->pfrkt_ip6, M_RTABLE); 1958 1.3.2.2 skrll if (kt->pfrkt_shadow != NULL) 1959 1.3.2.2 skrll pfr_destroy_ktable(kt->pfrkt_shadow, flushaddr); 1960 1.3.2.2 skrll if (kt->pfrkt_rs != NULL) { 1961 1.3.2.2 skrll kt->pfrkt_rs->tables--; 1962 1.3.2.2 skrll pf_remove_if_empty_ruleset(kt->pfrkt_rs); 1963 1.3.2.2 skrll } 1964 1.3.2.2 skrll pool_put(&pfr_ktable_pl, kt); 1965 1.3.2.2 skrll } 1966 1.3.2.2 skrll 1967 1.3.2.2 skrll int 1968 1.3.2.2 skrll pfr_ktable_compare(struct pfr_ktable *p, struct pfr_ktable *q) 1969 1.3.2.2 skrll { 1970 1.3.2.2 skrll int d; 1971 1.3.2.2 skrll 1972 1.3.2.2 skrll if ((d = strncmp(p->pfrkt_name, q->pfrkt_name, PF_TABLE_NAME_SIZE))) 1973 1.3.2.2 skrll return (d); 1974 1.3.2.5 skrll return (strcmp(p->pfrkt_anchor, q->pfrkt_anchor)); 1975 1.3.2.2 skrll } 1976 1.3.2.2 skrll 1977 1.3.2.2 skrll struct pfr_ktable * 1978 1.3.2.2 skrll pfr_lookup_table(struct pfr_table *tbl) 1979 1.3.2.2 skrll { 1980 1.3.2.2 skrll /* struct pfr_ktable start like a struct pfr_table */ 1981 1.3.2.2 skrll return (RB_FIND(pfr_ktablehead, &pfr_ktables, 1982 1.3.2.2 skrll (struct pfr_ktable *)tbl)); 1983 1.3.2.2 skrll } 1984 1.3.2.2 skrll 1985 1.3.2.2 skrll int 1986 1.3.2.2 skrll pfr_match_addr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af) 1987 1.3.2.2 skrll { 1988 1.3.2.2 skrll struct pfr_kentry *ke = NULL; 1989 1.3.2.2 skrll int match; 1990 1.3.2.2 skrll 1991 1.3.2.2 skrll if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) 1992 1.3.2.2 skrll kt = kt->pfrkt_root; 1993 1.3.2.2 skrll if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 1994 1.3.2.2 skrll return (0); 1995 1.3.2.2 skrll 1996 1.3.2.2 skrll switch (af) { 1997 1.3.2.5 skrll #ifdef INET 1998 1.3.2.2 skrll case AF_INET: 1999 1.3.2.2 skrll pfr_sin.sin_addr.s_addr = a->addr32[0]; 2000 1.3.2.2 skrll ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4); 2001 1.3.2.2 skrll if (ke && KENTRY_RNF_ROOT(ke)) 2002 1.3.2.2 skrll ke = NULL; 2003 1.3.2.2 skrll break; 2004 1.3.2.5 skrll #endif /* INET */ 2005 1.3.2.5 skrll #ifdef INET6 2006 1.3.2.2 skrll case AF_INET6: 2007 1.3.2.2 skrll bcopy(a, &pfr_sin6.sin6_addr, sizeof(pfr_sin6.sin6_addr)); 2008 1.3.2.2 skrll ke = (struct pfr_kentry *)rn_match(&pfr_sin6, kt->pfrkt_ip6); 2009 1.3.2.2 skrll if (ke && KENTRY_RNF_ROOT(ke)) 2010 1.3.2.2 skrll ke = NULL; 2011 1.3.2.2 skrll break; 2012 1.3.2.5 skrll #endif /* INET6 */ 2013 1.3.2.2 skrll } 2014 1.3.2.2 skrll match = (ke && !ke->pfrke_not); 2015 1.3.2.2 skrll if (match) 2016 1.3.2.2 skrll kt->pfrkt_match++; 2017 1.3.2.2 skrll else 2018 1.3.2.2 skrll kt->pfrkt_nomatch++; 2019 1.3.2.2 skrll return (match); 2020 1.3.2.2 skrll } 2021 1.3.2.2 skrll 2022 1.3.2.2 skrll void 2023 1.3.2.2 skrll pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af, 2024 1.3.2.2 skrll u_int64_t len, int dir_out, int op_pass, int notrule) 2025 1.3.2.2 skrll { 2026 1.3.2.2 skrll struct pfr_kentry *ke = NULL; 2027 1.3.2.2 skrll 2028 1.3.2.2 skrll if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) 2029 1.3.2.2 skrll kt = kt->pfrkt_root; 2030 1.3.2.2 skrll if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 2031 1.3.2.2 skrll return; 2032 1.3.2.2 skrll 2033 1.3.2.2 skrll switch (af) { 2034 1.3.2.5 skrll #ifdef INET 2035 1.3.2.2 skrll case AF_INET: 2036 1.3.2.2 skrll pfr_sin.sin_addr.s_addr = a->addr32[0]; 2037 1.3.2.2 skrll ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4); 2038 1.3.2.2 skrll if (ke && KENTRY_RNF_ROOT(ke)) 2039 1.3.2.2 skrll ke = NULL; 2040 1.3.2.2 skrll break; 2041 1.3.2.5 skrll #endif /* INET */ 2042 1.3.2.5 skrll #ifdef INET6 2043 1.3.2.2 skrll case AF_INET6: 2044 1.3.2.2 skrll bcopy(a, &pfr_sin6.sin6_addr, sizeof(pfr_sin6.sin6_addr)); 2045 1.3.2.2 skrll ke = (struct pfr_kentry *)rn_match(&pfr_sin6, kt->pfrkt_ip6); 2046 1.3.2.2 skrll if (ke && KENTRY_RNF_ROOT(ke)) 2047 1.3.2.2 skrll ke = NULL; 2048 1.3.2.2 skrll break; 2049 1.3.2.5 skrll #endif /* INET6 */ 2050 1.3.2.5 skrll default: 2051 1.3.2.5 skrll ; 2052 1.3.2.2 skrll } 2053 1.3.2.2 skrll if ((ke == NULL || ke->pfrke_not) != notrule) { 2054 1.3.2.2 skrll if (op_pass != PFR_OP_PASS) 2055 1.3.2.2 skrll printf("pfr_update_stats: assertion failed.\n"); 2056 1.3.2.2 skrll op_pass = PFR_OP_XPASS; 2057 1.3.2.2 skrll } 2058 1.3.2.2 skrll kt->pfrkt_packets[dir_out][op_pass]++; 2059 1.3.2.2 skrll kt->pfrkt_bytes[dir_out][op_pass] += len; 2060 1.3.2.2 skrll if (ke != NULL && op_pass != PFR_OP_XPASS) { 2061 1.3.2.2 skrll ke->pfrke_packets[dir_out][op_pass]++; 2062 1.3.2.2 skrll ke->pfrke_bytes[dir_out][op_pass] += len; 2063 1.3.2.2 skrll } 2064 1.3.2.2 skrll } 2065 1.3.2.2 skrll 2066 1.3.2.2 skrll struct pfr_ktable * 2067 1.3.2.2 skrll pfr_attach_table(struct pf_ruleset *rs, char *name) 2068 1.3.2.2 skrll { 2069 1.3.2.2 skrll struct pfr_ktable *kt, *rt; 2070 1.3.2.2 skrll struct pfr_table tbl; 2071 1.3.2.2 skrll struct pf_anchor *ac = rs->anchor; 2072 1.3.2.2 skrll 2073 1.3.2.2 skrll bzero(&tbl, sizeof(tbl)); 2074 1.3.2.2 skrll strlcpy(tbl.pfrt_name, name, sizeof(tbl.pfrt_name)); 2075 1.3.2.5 skrll if (ac != NULL) 2076 1.3.2.2 skrll strlcpy(tbl.pfrt_anchor, ac->name, sizeof(tbl.pfrt_anchor)); 2077 1.3.2.2 skrll kt = pfr_lookup_table(&tbl); 2078 1.3.2.2 skrll if (kt == NULL) { 2079 1.3.2.5 skrll kt = pfr_create_ktable(&tbl, time_second, 1); 2080 1.3.2.2 skrll if (kt == NULL) 2081 1.3.2.2 skrll return (NULL); 2082 1.3.2.2 skrll if (ac != NULL) { 2083 1.3.2.2 skrll bzero(tbl.pfrt_anchor, sizeof(tbl.pfrt_anchor)); 2084 1.3.2.2 skrll rt = pfr_lookup_table(&tbl); 2085 1.3.2.2 skrll if (rt == NULL) { 2086 1.3.2.2 skrll rt = pfr_create_ktable(&tbl, 0, 1); 2087 1.3.2.2 skrll if (rt == NULL) { 2088 1.3.2.2 skrll pfr_destroy_ktable(kt, 0); 2089 1.3.2.2 skrll return (NULL); 2090 1.3.2.2 skrll } 2091 1.3.2.2 skrll pfr_insert_ktable(rt); 2092 1.3.2.2 skrll } 2093 1.3.2.2 skrll kt->pfrkt_root = rt; 2094 1.3.2.2 skrll } 2095 1.3.2.2 skrll pfr_insert_ktable(kt); 2096 1.3.2.2 skrll } 2097 1.3.2.2 skrll if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++) 2098 1.3.2.2 skrll pfr_setflags_ktable(kt, kt->pfrkt_flags|PFR_TFLAG_REFERENCED); 2099 1.3.2.2 skrll return (kt); 2100 1.3.2.2 skrll } 2101 1.3.2.2 skrll 2102 1.3.2.2 skrll void 2103 1.3.2.2 skrll pfr_detach_table(struct pfr_ktable *kt) 2104 1.3.2.2 skrll { 2105 1.3.2.2 skrll if (kt->pfrkt_refcnt[PFR_REFCNT_RULE] <= 0) 2106 1.3.2.2 skrll printf("pfr_detach_table: refcount = %d.\n", 2107 1.3.2.2 skrll kt->pfrkt_refcnt[PFR_REFCNT_RULE]); 2108 1.3.2.2 skrll else if (!--kt->pfrkt_refcnt[PFR_REFCNT_RULE]) 2109 1.3.2.2 skrll pfr_setflags_ktable(kt, kt->pfrkt_flags&~PFR_TFLAG_REFERENCED); 2110 1.3.2.2 skrll } 2111 1.3.2.2 skrll 2112 1.3.2.2 skrll int 2113 1.3.2.2 skrll pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter, 2114 1.3.2.2 skrll struct pf_addr **raddr, struct pf_addr **rmask, sa_family_t af) 2115 1.3.2.2 skrll { 2116 1.3.2.5 skrll struct pfr_kentry *ke, *ke2 = (void *)0xdeadb; 2117 1.3.2.5 skrll struct pf_addr *addr = (void *)0xdeadb; 2118 1.3.2.2 skrll union sockaddr_union mask; 2119 1.3.2.2 skrll int idx = -1, use_counter = 0; 2120 1.3.2.2 skrll 2121 1.3.2.5 skrll if (af == AF_INET) 2122 1.3.2.5 skrll addr = (struct pf_addr *)&pfr_sin.sin_addr; 2123 1.3.2.5 skrll else if (af == AF_INET6) 2124 1.3.2.5 skrll addr = (struct pf_addr *)&pfr_sin6.sin6_addr; 2125 1.3.2.2 skrll if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) 2126 1.3.2.2 skrll kt = kt->pfrkt_root; 2127 1.3.2.2 skrll if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 2128 1.3.2.2 skrll return (-1); 2129 1.3.2.2 skrll 2130 1.3.2.2 skrll if (pidx != NULL) 2131 1.3.2.2 skrll idx = *pidx; 2132 1.3.2.2 skrll if (counter != NULL && idx >= 0) 2133 1.3.2.2 skrll use_counter = 1; 2134 1.3.2.2 skrll if (idx < 0) 2135 1.3.2.2 skrll idx = 0; 2136 1.3.2.2 skrll 2137 1.3.2.2 skrll _next_block: 2138 1.3.2.2 skrll ke = pfr_kentry_byidx(kt, idx, af); 2139 1.3.2.2 skrll if (ke == NULL) 2140 1.3.2.2 skrll return (1); 2141 1.3.2.2 skrll pfr_prepare_network(&pfr_mask, af, ke->pfrke_net); 2142 1.3.2.2 skrll *raddr = SUNION2PF(&ke->pfrke_sa, af); 2143 1.3.2.2 skrll *rmask = SUNION2PF(&pfr_mask, af); 2144 1.3.2.2 skrll 2145 1.3.2.2 skrll if (use_counter) { 2146 1.3.2.2 skrll /* is supplied address within block? */ 2147 1.3.2.2 skrll if (!PF_MATCHA(0, *raddr, *rmask, counter, af)) { 2148 1.3.2.2 skrll /* no, go to next block in table */ 2149 1.3.2.2 skrll idx++; 2150 1.3.2.2 skrll use_counter = 0; 2151 1.3.2.2 skrll goto _next_block; 2152 1.3.2.2 skrll } 2153 1.3.2.2 skrll PF_ACPY(addr, counter, af); 2154 1.3.2.2 skrll } else { 2155 1.3.2.2 skrll /* use first address of block */ 2156 1.3.2.2 skrll PF_ACPY(addr, *raddr, af); 2157 1.3.2.2 skrll } 2158 1.3.2.2 skrll 2159 1.3.2.2 skrll if (!KENTRY_NETWORK(ke)) { 2160 1.3.2.2 skrll /* this is a single IP address - no possible nested block */ 2161 1.3.2.2 skrll PF_ACPY(counter, addr, af); 2162 1.3.2.2 skrll *pidx = idx; 2163 1.3.2.2 skrll return (0); 2164 1.3.2.2 skrll } 2165 1.3.2.2 skrll for (;;) { 2166 1.3.2.2 skrll /* we don't want to use a nested block */ 2167 1.3.2.5 skrll if (af == AF_INET) 2168 1.3.2.5 skrll ke2 = (struct pfr_kentry *)rn_match(&pfr_sin, 2169 1.3.2.5 skrll kt->pfrkt_ip4); 2170 1.3.2.5 skrll else if (af == AF_INET6) 2171 1.3.2.5 skrll ke2 = (struct pfr_kentry *)rn_match(&pfr_sin6, 2172 1.3.2.5 skrll kt->pfrkt_ip6); 2173 1.3.2.2 skrll /* no need to check KENTRY_RNF_ROOT() here */ 2174 1.3.2.2 skrll if (ke2 == ke) { 2175 1.3.2.2 skrll /* lookup return the same block - perfect */ 2176 1.3.2.2 skrll PF_ACPY(counter, addr, af); 2177 1.3.2.2 skrll *pidx = idx; 2178 1.3.2.2 skrll return (0); 2179 1.3.2.2 skrll } 2180 1.3.2.2 skrll 2181 1.3.2.2 skrll /* we need to increase the counter past the nested block */ 2182 1.3.2.2 skrll pfr_prepare_network(&mask, AF_INET, ke2->pfrke_net); 2183 1.3.2.2 skrll PF_POOLMASK(addr, addr, SUNION2PF(&mask, af), &pfr_ffaddr, af); 2184 1.3.2.2 skrll PF_AINC(addr, af); 2185 1.3.2.2 skrll if (!PF_MATCHA(0, *raddr, *rmask, addr, af)) { 2186 1.3.2.2 skrll /* ok, we reached the end of our main block */ 2187 1.3.2.2 skrll /* go to next block in table */ 2188 1.3.2.2 skrll idx++; 2189 1.3.2.2 skrll use_counter = 0; 2190 1.3.2.2 skrll goto _next_block; 2191 1.3.2.2 skrll } 2192 1.3.2.2 skrll } 2193 1.3.2.2 skrll } 2194 1.3.2.2 skrll 2195 1.3.2.2 skrll struct pfr_kentry * 2196 1.3.2.2 skrll pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af) 2197 1.3.2.2 skrll { 2198 1.3.2.2 skrll struct pfr_walktree w; 2199 1.3.2.2 skrll 2200 1.3.2.2 skrll bzero(&w, sizeof(w)); 2201 1.3.2.2 skrll w.pfrw_op = PFRW_POOL_GET; 2202 1.3.2.2 skrll w.pfrw_cnt = idx; 2203 1.3.2.2 skrll 2204 1.3.2.2 skrll switch (af) { 2205 1.3.2.5 skrll #ifdef INET 2206 1.3.2.2 skrll case AF_INET: 2207 1.3.2.2 skrll rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w); 2208 1.3.2.2 skrll return (w.pfrw_kentry); 2209 1.3.2.5 skrll #endif /* INET */ 2210 1.3.2.5 skrll #ifdef INET6 2211 1.3.2.2 skrll case AF_INET6: 2212 1.3.2.2 skrll rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w); 2213 1.3.2.2 skrll return (w.pfrw_kentry); 2214 1.3.2.5 skrll #endif /* INET6 */ 2215 1.3.2.2 skrll default: 2216 1.3.2.2 skrll return (NULL); 2217 1.3.2.2 skrll } 2218 1.3.2.2 skrll } 2219 1.3.2.2 skrll 2220 1.3.2.2 skrll void 2221 1.3.2.2 skrll pfr_dynaddr_update(struct pfr_ktable *kt, struct pfi_dynaddr *dyn) 2222 1.3.2.2 skrll { 2223 1.3.2.2 skrll struct pfr_walktree w; 2224 1.3.2.2 skrll int s; 2225 1.3.2.2 skrll 2226 1.3.2.2 skrll bzero(&w, sizeof(w)); 2227 1.3.2.2 skrll w.pfrw_op = PFRW_DYNADDR_UPDATE; 2228 1.3.2.2 skrll w.pfrw_dyn = dyn; 2229 1.3.2.2 skrll 2230 1.3.2.2 skrll s = splsoftnet(); 2231 1.3.2.2 skrll dyn->pfid_acnt4 = 0; 2232 1.3.2.2 skrll dyn->pfid_acnt6 = 0; 2233 1.3.2.2 skrll if (!dyn->pfid_af || dyn->pfid_af == AF_INET) 2234 1.3.2.2 skrll rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w); 2235 1.3.2.2 skrll if (!dyn->pfid_af || dyn->pfid_af == AF_INET6) 2236 1.3.2.2 skrll rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w); 2237 1.3.2.2 skrll splx(s); 2238 1.3.2.2 skrll } 2239
Indexes created Thu Oct 02 01:09:59 GMT 2025