]> git.saurik.com Git - apple/xnu.git/blame - bsd/net/pf_table.c
projects / apple / xnu.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
xnu-6153.61.1.tar.gz
[apple/xnu.git] / bsd / net / pf_table.c
CommitLineData
b0d623f7 1/*
6d2010ae 2 * Copyright (c) 2007-2010 Apple Inc. All rights reserved.
b0d623f7
A		 3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29/* $apfw: pf_table.c,v 1.4 2008/08/27 00:01:32 jhw Exp $ */
30/* $OpenBSD: pf_table.c,v 1.68 2006/05/02 10:08:45 dhartmei Exp $ */
31
32/*
33 * Copyright (c) 2002 Cedric Berger
34 * All rights reserved.
35 *
36 * Redistribution and use in source and binary forms, with or without
37 * modification, are permitted provided that the following conditions
38 * are met:
39 *
40 * - Redistributions of source code must retain the above copyright
41 * notice, this list of conditions and the following disclaimer.
42 * - Redistributions in binary form must reproduce the above
43 * copyright notice, this list of conditions and the following
44 * disclaimer in the documentation and/or other materials provided
45 * with the distribution.
46 *
47 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
48 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
49 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
50 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
51 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
52 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
53 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
54 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
55 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
57 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
58 * POSSIBILITY OF SUCH DAMAGE.
59 *
60 */
61
62#include <sys/param.h>
63#include <sys/systm.h>
64#include <sys/socket.h>
65#include <sys/mbuf.h>
66#include <sys/kernel.h>
67#include <sys/malloc.h>
68
69#include <net/if.h>
70#include <net/route.h>
71#include <netinet/in.h>
72#include <net/radix.h>
73#include <net/pfvar.h>
74
0a7de745
A		 75#define ACCEPT_FLAGS(flags, oklist) \
76 do { \
77 if ((flags & ~(oklist)) & \
78 PFR_FLAG_ALLMASK) \
79 return (EINVAL); \
b0d623f7
A		 80 } while (0)
81
0a7de745
A		 82#define COPYIN(from, to, size, flags) \
83 ((flags & PFR_FLAG_USERIOCTL) ? \
84 copyin((from), (to), (size)) : \
d1ecb069 85 (bcopy((void *)(uintptr_t)(from), (to), (size)), 0))
b0d623f7 86
0a7de745
A		 87#define COPYOUT(from, to, size, flags) \
88 ((flags & PFR_FLAG_USERIOCTL) ? \
89 copyout((from), (to), (size)) : \
d1ecb069 90 (bcopy((from), (void *)(uintptr_t)(to), (size)), 0))
b0d623f7 91
0a7de745
A		 92#define FILLIN_SIN(sin, addr) \
93 do { \
94 (sin).sin_len = sizeof (sin); \
95 (sin).sin_family = AF_INET; \
96 (sin).sin_addr = (addr); \
b0d623f7
A		 97 } while (0)
98
0a7de745
A		 99#define FILLIN_SIN6(sin6, addr) \
100 do { \
101 (sin6).sin6_len = sizeof (sin6); \
102 (sin6).sin6_family = AF_INET6; \
103 (sin6).sin6_addr = (addr); \
b0d623f7
A		 104 } while (0)
105
0a7de745
A		 106#define SWAP(type, a1, a2) \
107 do { \
108 type tmp = a1; \
109 a1 = a2; \
110 a2 = tmp; \
b0d623f7
A		 111 } while (0)
112
0a7de745
A		 113#define SUNION2PF(su, af) (((af) == AF_INET) ? \
114 (struct pf_addr *)&(su)->sin.sin_addr : \
b0d623f7
A		 115 (struct pf_addr *)&(su)->sin6.sin6_addr)
116
0a7de745
A		 117#define AF_BITS(af) (((af) == AF_INET) ? 32 : 128)
118#define ADDR_NETWORK(ad) ((ad)->pfra_net < AF_BITS((ad)->pfra_af))
119#define KENTRY_NETWORK(ke) ((ke)->pfrke_net < AF_BITS((ke)->pfrke_af))
b0d623f7 120#define KENTRY_RNF_ROOT(ke) \
0a7de745 121 ((((struct radix_node *)(ke))->rn_flags & RNF_ROOT) != 0)
b0d623f7 122
0a7de745
A		 123#define NO_ADDRESSES (-1)
124#define ENQUEUE_UNMARKED_ONLY (1)
125#define INVERT_NEG_FLAG (1)
b0d623f7
A		 126
127struct pfr_walktree {
128 enum pfrw_op {
129 PFRW_MARK,
130 PFRW_SWEEP,
131 PFRW_ENQUEUE,
132 PFRW_GET_ADDRS,
133 PFRW_GET_ASTATS,
134 PFRW_POOL_GET,
135 PFRW_DYNADDR_UPDATE
0a7de745 136 } pfrw_op;
b0d623f7 137 union {
0a7de745
A		 138 user_addr_t pfrw1_addr;
139 user_addr_t pfrw1_astats;
140 struct pfr_kentryworkq *pfrw1_workq;
141 struct pfr_kentry *pfrw1_kentry;
142 struct pfi_dynaddr *pfrw1_dyn;
143 } pfrw_1;
144 int pfrw_free;
145 int pfrw_flags;
b0d623f7 146};
0a7de745
A		 147#define pfrw_addr pfrw_1.pfrw1_addr
148#define pfrw_astats pfrw_1.pfrw1_astats
149#define pfrw_workq pfrw_1.pfrw1_workq
150#define pfrw_kentry pfrw_1.pfrw1_kentry
151#define pfrw_dyn pfrw_1.pfrw1_dyn
152#define pfrw_cnt pfrw_free
b0d623f7 153
0a7de745 154#define senderr(e) do { rv = (e); goto _bad; } while (0)
b0d623f7 155
0a7de745
A		 156struct pool pfr_ktable_pl;
157struct pool pfr_kentry_pl;
b0d623f7 158
0a7de745
A		 159static struct pool pfr_kentry_pl2;
160static struct sockaddr_in pfr_sin;
161static struct sockaddr_in6 pfr_sin6;
162static union sockaddr_union pfr_mask;
163static struct pf_addr pfr_ffaddr;
b0d623f7
A		 164
165static void pfr_copyout_addr(struct pfr_addr *, struct pfr_kentry *ke);
166static int pfr_validate_addr(struct pfr_addr *);
167static void pfr_enqueue_addrs(struct pfr_ktable *, struct pfr_kentryworkq *,
168 int *, int);
169static void pfr_mark_addrs(struct pfr_ktable *);
170static struct pfr_kentry *pfr_lookup_addr(struct pfr_ktable *,
171 struct pfr_addr *, int);
172static struct pfr_kentry *pfr_create_kentry(struct pfr_addr *, int);
173static void pfr_destroy_kentries(struct pfr_kentryworkq *);
174static void pfr_destroy_kentry(struct pfr_kentry *);
175static void pfr_insert_kentries(struct pfr_ktable *,
176 struct pfr_kentryworkq *, u_int64_t);
177static void pfr_remove_kentries(struct pfr_ktable *, struct pfr_kentryworkq *);
178static void pfr_clstats_kentries(struct pfr_kentryworkq *, u_int64_t, int);
d1ecb069 179static void pfr_reset_feedback(user_addr_t, int, int);
b0d623f7
A		 180static void pfr_prepare_network(union sockaddr_union *, int, int);
181static int pfr_route_kentry(struct pfr_ktable *, struct pfr_kentry *);
182static int pfr_unroute_kentry(struct pfr_ktable *, struct pfr_kentry *);
183static int pfr_walktree(struct radix_node *, void *);
184static int pfr_validate_table(struct pfr_table *, int, int);
185static int pfr_fix_anchor(char *);
186static void pfr_commit_ktable(struct pfr_ktable *, u_int64_t);
187static void pfr_insert_ktables(struct pfr_ktableworkq *);
188static void pfr_insert_ktable(struct pfr_ktable *);
189static void pfr_setflags_ktables(struct pfr_ktableworkq *);
190static void pfr_setflags_ktable(struct pfr_ktable *, int);
191static void pfr_clstats_ktables(struct pfr_ktableworkq *, u_int64_t, int);
192static void pfr_clstats_ktable(struct pfr_ktable *, u_int64_t, int);
193static struct pfr_ktable *pfr_create_ktable(struct pfr_table *, u_int64_t, int);
194static void pfr_destroy_ktables(struct pfr_ktableworkq *, int);
195static void pfr_destroy_ktable(struct pfr_ktable *, int);
196static int pfr_ktable_compare(struct pfr_ktable *, struct pfr_ktable *);
197static struct pfr_ktable *pfr_lookup_table(struct pfr_table *);
198static void pfr_clean_node_mask(struct pfr_ktable *, struct pfr_kentryworkq *);
199static int pfr_table_count(struct pfr_table *, int);
200static int pfr_skip_table(struct pfr_table *, struct pfr_ktable *, int);
201static struct pfr_kentry *pfr_kentry_byidx(struct pfr_ktable *, int, int);
202
203RB_PROTOTYPE_SC(static, pfr_ktablehead, pfr_ktable, pfrkt_tree,
204 pfr_ktable_compare);
205RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
206
0a7de745
A		 207static struct pfr_ktablehead pfr_ktables;
208static struct pfr_table pfr_nulltable;
209static int pfr_ktable_cnt;
b0d623f7
A		 210
211void
212pfr_initialize(void)
213{
0a7de745 214 pool_init(&pfr_ktable_pl, sizeof(struct pfr_ktable), 0, 0, 0,
b0d623f7 215 "pfrktable", NULL);
0a7de745 216 pool_init(&pfr_kentry_pl, sizeof(struct pfr_kentry), 0, 0, 0,
b0d623f7 217 "pfrkentry", NULL);
0a7de745 218 pool_init(&pfr_kentry_pl2, sizeof(struct pfr_kentry), 0, 0, 0,
b0d623f7
A		 219 "pfrkentry2", NULL);
220
0a7de745 221 pfr_sin.sin_len = sizeof(pfr_sin);
b0d623f7 222 pfr_sin.sin_family = AF_INET;
0a7de745 223 pfr_sin6.sin6_len = sizeof(pfr_sin6);
b0d623f7
A		 224 pfr_sin6.sin6_family = AF_INET6;
225
0a7de745 226 memset(&pfr_ffaddr, 0xff, sizeof(pfr_ffaddr));
b0d623f7
A		 227}
228
229#if 0
230void
231pfr_destroy(void)
232{
233 pool_destroy(&pfr_ktable_pl);
234 pool_destroy(&pfr_kentry_pl);
235 pool_destroy(&pfr_kentry_pl2);
236}
237#endif
238
239int
240pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags)
241{
0a7de745
A		 242 struct pfr_ktable *kt;
243 struct pfr_kentryworkq workq;
b0d623f7
A		 244
245 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
0a7de745
A		 246 if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL)) {
247 return EINVAL;
248 }
b0d623f7 249 kt = pfr_lookup_table(tbl);
0a7de745
A		 250 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
251 return ESRCH;
252 }
253 if (kt->pfrkt_flags & PFR_TFLAG_CONST) {
254 return EPERM;
255 }
b0d623f7
A		 256 pfr_enqueue_addrs(kt, &workq, ndel, 0);
257
258 if (!(flags & PFR_FLAG_DUMMY)) {
259 pfr_remove_kentries(kt, &workq);
260 if (kt->pfrkt_cnt) {
261 printf("pfr_clr_addrs: corruption detected (%d).\n",
262 kt->pfrkt_cnt);
263 kt->pfrkt_cnt = 0;
264 }
265 }
0a7de745 266 return 0;
b0d623f7
A		 267}
268
269int
d1ecb069 270pfr_add_addrs(struct pfr_table *tbl, user_addr_t _addr, int size,
b0d623f7
A		 271 int *nadd, int flags)
272{
0a7de745
A		 273 struct pfr_ktable *kt, *tmpkt;
274 struct pfr_kentryworkq workq;
275 struct pfr_kentry *p, *q;
276 struct pfr_addr ad;
277 int i, rv, xadd = 0;
278 user_addr_t addr = _addr;
279 u_int64_t tzero = pf_calendar_time_second();
b0d623f7
A		 280
281 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
282 PFR_FLAG_FEEDBACK);
0a7de745
A		 283 if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL)) {
284 return EINVAL;
285 }
b0d623f7 286 kt = pfr_lookup_table(tbl);
0a7de745
A		 287 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
288 return ESRCH;
289 }
290 if (kt->pfrkt_flags & PFR_TFLAG_CONST) {
291 return EPERM;
292 }
b0d623f7 293 tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0);
0a7de745
A		 294 if (tmpkt == NULL) {
295 return ENOMEM;
296 }
b0d623f7 297 SLIST_INIT(&workq);
0a7de745
A		 298 for (i = 0; i < size; i++, addr += sizeof(ad)) {
299 if (COPYIN(addr, &ad, sizeof(ad), flags)) {
b0d623f7 300 senderr(EFAULT);
0a7de745
A		 301 }
302 if (pfr_validate_addr(&ad)) {
b0d623f7 303 senderr(EINVAL);
0a7de745 304 }
b0d623f7
A		 305 p = pfr_lookup_addr(kt, &ad, 1);
306 q = pfr_lookup_addr(tmpkt, &ad, 1);
307 if (flags & PFR_FLAG_FEEDBACK) {
0a7de745 308 if (q != NULL) {
b0d623f7 309 ad.pfra_fback = PFR_FB_DUPLICATE;
0a7de745 310 } else if (p == NULL) {
b0d623f7 311 ad.pfra_fback = PFR_FB_ADDED;
0a7de745 312 } else if (p->pfrke_not != ad.pfra_not) {
b0d623f7 313 ad.pfra_fback = PFR_FB_CONFLICT;
0a7de745 314 } else {
b0d623f7 315 ad.pfra_fback = PFR_FB_NONE;
0a7de745 316 }
b0d623f7
A		 317 }
318 if (p == NULL && q == NULL) {
319 p = pfr_create_kentry(&ad,
320 !(flags & PFR_FLAG_USERIOCTL));
0a7de745 321 if (p == NULL) {
b0d623f7 322 senderr(ENOMEM);
0a7de745 323 }
b0d623f7
A		 324 if (pfr_route_kentry(tmpkt, p)) {
325 pfr_destroy_kentry(p);
326 ad.pfra_fback = PFR_FB_NONE;
327 } else {
328 SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
329 xadd++;
330 }
331 }
0a7de745
A		 332 if (flags & PFR_FLAG_FEEDBACK) {
333 if (COPYOUT(&ad, addr, sizeof(ad), flags)) {
b0d623f7 334 senderr(EFAULT);
0a7de745
A		 335 }
336 }
b0d623f7
A		 337 }
338 pfr_clean_node_mask(tmpkt, &workq);
339 if (!(flags & PFR_FLAG_DUMMY)) {
340 pfr_insert_kentries(kt, &workq, tzero);
0a7de745 341 } else {
b0d623f7 342 pfr_destroy_kentries(&workq);
0a7de745
A		 343 }
344 if (nadd != NULL) {
b0d623f7 345 *nadd = xadd;
0a7de745 346 }
b0d623f7 347 pfr_destroy_ktable(tmpkt, 0);
0a7de745 348 return 0;
b0d623f7
A		 349_bad:
350 pfr_clean_node_mask(tmpkt, &workq);
351 pfr_destroy_kentries(&workq);
0a7de745 352 if (flags & PFR_FLAG_FEEDBACK) {
d1ecb069 353 pfr_reset_feedback(_addr, size, flags);
0a7de745 354 }
b0d623f7 355 pfr_destroy_ktable(tmpkt, 0);
0a7de745 356 return rv;
b0d623f7
A		 357}
358
359int
d1ecb069 360pfr_del_addrs(struct pfr_table *tbl, user_addr_t _addr, int size,
b0d623f7
A		 361 int *ndel, int flags)
362{
0a7de745
A		 363 struct pfr_ktable *kt;
364 struct pfr_kentryworkq workq;
365 struct pfr_kentry *p;
366 struct pfr_addr ad;
367 user_addr_t addr = _addr;
368 int i, rv, xdel = 0, log = 1;
b0d623f7
A		 369
370 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
371 PFR_FLAG_FEEDBACK);
0a7de745
A		 372 if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL)) {
373 return EINVAL;
374 }
b0d623f7 375 kt = pfr_lookup_table(tbl);
0a7de745
A		 376 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
377 return ESRCH;
378 }
379 if (kt->pfrkt_flags & PFR_TFLAG_CONST) {
380 return EPERM;
381 }
b0d623f7
A		 382 /*
383 * there are two algorithms to choose from here.
384 * with:
385 * n: number of addresses to delete
386 * N: number of addresses in the table
387 *
388 * one is O(N) and is better for large 'n'
389 * one is O(n*LOG(N)) and is better for small 'n'
390 *
391 * following code try to decide which one is best.
392 */
0a7de745 393 for (i = kt->pfrkt_cnt; i > 0; i >>= 1) {
b0d623f7 394 log++;
0a7de745
A		 395 }
396 if (size > kt->pfrkt_cnt / log) {
b0d623f7
A		 397 /* full table scan */
398 pfr_mark_addrs(kt);
399 } else {
400 /* iterate over addresses to delete */
0a7de745
A		 401 for (i = 0; i < size; i++, addr += sizeof(ad)) {
402 if (COPYIN(addr, &ad, sizeof(ad), flags)) {
403 return EFAULT;
404 }
405 if (pfr_validate_addr(&ad)) {
406 return EINVAL;
407 }
b0d623f7 408 p = pfr_lookup_addr(kt, &ad, 1);
0a7de745 409 if (p != NULL) {
b0d623f7 410 p->pfrke_mark = 0;
0a7de745 411 }
b0d623f7
A		 412 }
413 }
414 SLIST_INIT(&workq);
0a7de745
A		 415 for (addr = _addr, i = 0; i < size; i++, addr += sizeof(ad)) {
416 if (COPYIN(addr, &ad, sizeof(ad), flags)) {
b0d623f7 417 senderr(EFAULT);
0a7de745
A		 418 }
419 if (pfr_validate_addr(&ad)) {
b0d623f7 420 senderr(EINVAL);
0a7de745 421 }
b0d623f7
A		 422 p = pfr_lookup_addr(kt, &ad, 1);
423 if (flags & PFR_FLAG_FEEDBACK) {
0a7de745 424 if (p == NULL) {
b0d623f7 425 ad.pfra_fback = PFR_FB_NONE;
0a7de745 426 } else if (p->pfrke_not != ad.pfra_not) {
b0d623f7 427 ad.pfra_fback = PFR_FB_CONFLICT;
0a7de745 428 } else if (p->pfrke_mark) {
b0d623f7 429 ad.pfra_fback = PFR_FB_DUPLICATE;
0a7de745 430 } else {
b0d623f7 431 ad.pfra_fback = PFR_FB_DELETED;
0a7de745 432 }
b0d623f7
A		 433 }
434 if (p != NULL && p->pfrke_not == ad.pfra_not &&
435 !p->pfrke_mark) {
436 p->pfrke_mark = 1;
437 SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
438 xdel++;
439 }
0a7de745
A		 440 if (flags & PFR_FLAG_FEEDBACK) {
441 if (COPYOUT(&ad, addr, sizeof(ad), flags)) {
b0d623f7 442 senderr(EFAULT);
0a7de745
A		 443 }
444 }
b0d623f7
A		 445 }
446 if (!(flags & PFR_FLAG_DUMMY)) {
447 pfr_remove_kentries(kt, &workq);
448 }
0a7de745 449 if (ndel != NULL) {
b0d623f7 450 *ndel = xdel;
0a7de745
A		 451 }
452 return 0;
b0d623f7 453_bad:
0a7de745 454 if (flags & PFR_FLAG_FEEDBACK) {
d1ecb069 455 pfr_reset_feedback(_addr, size, flags);
0a7de745
A		 456 }
457 return rv;
b0d623f7
A		 458}
459
460int
d1ecb069 461pfr_set_addrs(struct pfr_table *tbl, user_addr_t _addr, int size,
b0d623f7
A		 462 int *size2, int *nadd, int *ndel, int *nchange, int flags,
463 u_int32_t ignore_pfrt_flags)
464{
0a7de745
A		 465 struct pfr_ktable *kt, *tmpkt;
466 struct pfr_kentryworkq addq, delq, changeq;
467 struct pfr_kentry *p, *q;
468 struct pfr_addr ad;
469 user_addr_t addr = _addr;
470 int i, rv, xadd = 0, xdel = 0, xchange = 0;
471 u_int64_t tzero = pf_calendar_time_second();
b0d623f7
A		 472
473 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
474 PFR_FLAG_FEEDBACK);
475 if (pfr_validate_table(tbl, ignore_pfrt_flags, flags &
0a7de745
A		 476 PFR_FLAG_USERIOCTL)) {
477 return EINVAL;
478 }
b0d623f7 479 kt = pfr_lookup_table(tbl);
0a7de745
A		 480 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
481 return ESRCH;
482 }
483 if (kt->pfrkt_flags & PFR_TFLAG_CONST) {
484 return EPERM;
485 }
b0d623f7 486 tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0);
0a7de745
A		 487 if (tmpkt == NULL) {
488 return ENOMEM;
489 }
b0d623f7
A		 490 pfr_mark_addrs(kt);
491 SLIST_INIT(&addq);
492 SLIST_INIT(&delq);
493 SLIST_INIT(&changeq);
0a7de745
A		 494 for (i = 0; i < size; i++, addr += sizeof(ad)) {
495 if (COPYIN(addr, &ad, sizeof(ad), flags)) {
b0d623f7 496 senderr(EFAULT);
0a7de745
A		 497 }
498 if (pfr_validate_addr(&ad)) {
b0d623f7 499 senderr(EINVAL);
0a7de745 500 }
b0d623f7
A		 501 ad.pfra_fback = PFR_FB_NONE;
502 p = pfr_lookup_addr(kt, &ad, 1);
503 if (p != NULL) {
504 if (p->pfrke_mark) {
505 ad.pfra_fback = PFR_FB_DUPLICATE;
506 goto _skip;
507 }
508 p->pfrke_mark = 1;
509 if (p->pfrke_not != ad.pfra_not) {
510 SLIST_INSERT_HEAD(&changeq, p, pfrke_workq);
511 ad.pfra_fback = PFR_FB_CHANGED;
512 xchange++;
513 }
514 } else {
515 q = pfr_lookup_addr(tmpkt, &ad, 1);
516 if (q != NULL) {
517 ad.pfra_fback = PFR_FB_DUPLICATE;
518 goto _skip;
519 }
520 p = pfr_create_kentry(&ad,
521 !(flags & PFR_FLAG_USERIOCTL));
0a7de745 522 if (p == NULL) {
b0d623f7 523 senderr(ENOMEM);
0a7de745 524 }
b0d623f7
A		 525 if (pfr_route_kentry(tmpkt, p)) {
526 pfr_destroy_kentry(p);
527 ad.pfra_fback = PFR_FB_NONE;
528 } else {
529 SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
530 ad.pfra_fback = PFR_FB_ADDED;
531 xadd++;
532 }
533 }
534_skip:
0a7de745
A		 535 if (flags & PFR_FLAG_FEEDBACK) {
536 if (COPYOUT(&ad, addr, sizeof(ad), flags)) {
b0d623f7 537 senderr(EFAULT);
0a7de745
A		 538 }
539 }
b0d623f7
A		 540 }
541 pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY);
542 if ((flags & PFR_FLAG_FEEDBACK) && *size2) {
0a7de745
A		 543 if (*size2 < size + xdel) {
544 *size2 = size + xdel;
b0d623f7
A		 545 senderr(0);
546 }
547 i = 0;
d1ecb069 548 addr = _addr + size;
b0d623f7
A		 549 SLIST_FOREACH(p, &delq, pfrke_workq) {
550 pfr_copyout_addr(&ad, p);
551 ad.pfra_fback = PFR_FB_DELETED;
0a7de745 552 if (COPYOUT(&ad, addr, sizeof(ad), flags)) {
b0d623f7 553 senderr(EFAULT);
0a7de745
A		 554 }
555 addr += sizeof(ad);
b0d623f7
A		 556 i++;
557 }
558 }
559 pfr_clean_node_mask(tmpkt, &addq);
560 if (!(flags & PFR_FLAG_DUMMY)) {
561 pfr_insert_kentries(kt, &addq, tzero);
562 pfr_remove_kentries(kt, &delq);
563 pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
0a7de745 564 } else {
b0d623f7 565 pfr_destroy_kentries(&addq);
0a7de745
A		 566 }
567 if (nadd != NULL) {
b0d623f7 568 *nadd = xadd;
0a7de745
A		 569 }
570 if (ndel != NULL) {
b0d623f7 571 *ndel = xdel;
0a7de745
A		 572 }
573 if (nchange != NULL) {
b0d623f7 574 *nchange = xchange;
0a7de745
A		 575 }
576 if ((flags & PFR_FLAG_FEEDBACK) && size2) {
577 *size2 = size + xdel;
578 }
b0d623f7 579 pfr_destroy_ktable(tmpkt, 0);
0a7de745 580 return 0;
b0d623f7
A		 581_bad:
582 pfr_clean_node_mask(tmpkt, &addq);
583 pfr_destroy_kentries(&addq);
0a7de745 584 if (flags & PFR_FLAG_FEEDBACK) {
d1ecb069 585 pfr_reset_feedback(_addr, size, flags);
0a7de745 586 }
b0d623f7 587 pfr_destroy_ktable(tmpkt, 0);
0a7de745 588 return rv;
b0d623f7
A		 589}
590
591int
d1ecb069 592pfr_tst_addrs(struct pfr_table *tbl, user_addr_t addr, int size,
0a7de745 593 int *nmatch, int flags)
b0d623f7 594{
0a7de745
A		 595 struct pfr_ktable *kt;
596 struct pfr_kentry *p;
597 struct pfr_addr ad;
598 int i, xmatch = 0;
b0d623f7
A		 599
600 ACCEPT_FLAGS(flags, PFR_FLAG_REPLACE);
0a7de745
A		 601 if (pfr_validate_table(tbl, 0, 0)) {
602 return EINVAL;
603 }
b0d623f7 604 kt = pfr_lookup_table(tbl);
0a7de745
A		 605 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
606 return ESRCH;
607 }
608
609 for (i = 0; i < size; i++, addr += sizeof(ad)) {
610 if (COPYIN(addr, &ad, sizeof(ad), flags)) {
611 return EFAULT;
612 }
613 if (pfr_validate_addr(&ad)) {
614 return EINVAL;
615 }
616 if (ADDR_NETWORK(&ad)) {
617 return EINVAL;
618 }
b0d623f7 619 p = pfr_lookup_addr(kt, &ad, 0);
0a7de745 620 if (flags & PFR_FLAG_REPLACE) {
b0d623f7 621 pfr_copyout_addr(&ad, p);
0a7de745 622 }
b0d623f7
A		 623 ad.pfra_fback = (p == NULL) ? PFR_FB_NONE :
624 (p->pfrke_not ? PFR_FB_NOTMATCH : PFR_FB_MATCH);
0a7de745 625 if (p != NULL && !p->pfrke_not) {
b0d623f7 626 xmatch++;
0a7de745
A		 627 }
628 if (COPYOUT(&ad, addr, sizeof(ad), flags)) {
629 return EFAULT;
630 }
b0d623f7 631 }
0a7de745 632 if (nmatch != NULL) {
b0d623f7 633 *nmatch = xmatch;
0a7de745
A		 634 }
635 return 0;
b0d623f7
A		 636}
637
638int
d1ecb069 639pfr_get_addrs(struct pfr_table *tbl, user_addr_t addr, int *size,
0a7de745 640 int flags)
b0d623f7 641{
0a7de745
A		 642 struct pfr_ktable *kt;
643 struct pfr_walktree w;
644 int rv;
b0d623f7
A		 645
646 ACCEPT_FLAGS(flags, 0);
0a7de745
A		 647 if (pfr_validate_table(tbl, 0, 0)) {
648 return EINVAL;
649 }
b0d623f7 650 kt = pfr_lookup_table(tbl);
0a7de745
A		 651 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
652 return ESRCH;
653 }
b0d623f7
A		 654 if (kt->pfrkt_cnt > *size) {
655 *size = kt->pfrkt_cnt;
0a7de745 656 return 0;
b0d623f7
A		 657 }
658
0a7de745 659 bzero(&w, sizeof(w));
b0d623f7
A		 660 w.pfrw_op = PFRW_GET_ADDRS;
661 w.pfrw_addr = addr;
662 w.pfrw_free = kt->pfrkt_cnt;
663 w.pfrw_flags = flags;
664 rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
0a7de745 665 if (!rv) {
b0d623f7
A		 666 rv = kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6,
667 pfr_walktree, &w);
0a7de745
A		 668 }
669 if (rv) {
670 return rv;
671 }
b0d623f7
A		 672
673 if (w.pfrw_free) {
674 printf("pfr_get_addrs: corruption detected (%d).\n",
675 w.pfrw_free);
0a7de745 676 return ENOTTY;
b0d623f7
A		 677 }
678 *size = kt->pfrkt_cnt;
0a7de745 679 return 0;
b0d623f7
A		 680}
681
682int
d1ecb069 683pfr_get_astats(struct pfr_table *tbl, user_addr_t addr, int *size,
0a7de745 684 int flags)
b0d623f7 685{
0a7de745
A		 686 struct pfr_ktable *kt;
687 struct pfr_walktree w;
688 struct pfr_kentryworkq workq;
689 int rv;
690 u_int64_t tzero = pf_calendar_time_second();
b0d623f7
A		 691
692 /* XXX PFR_FLAG_CLSTATS disabled */
693 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC);
0a7de745
A		 694 if (pfr_validate_table(tbl, 0, 0)) {
695 return EINVAL;
696 }
b0d623f7 697 kt = pfr_lookup_table(tbl);
0a7de745
A		 698 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
699 return ESRCH;
700 }
b0d623f7
A		 701 if (kt->pfrkt_cnt > *size) {
702 *size = kt->pfrkt_cnt;
0a7de745 703 return 0;
b0d623f7
A		 704 }
705
0a7de745 706 bzero(&w, sizeof(w));
b0d623f7
A		 707 w.pfrw_op = PFRW_GET_ASTATS;
708 w.pfrw_astats = addr;
709 w.pfrw_free = kt->pfrkt_cnt;
710 w.pfrw_flags = flags;
711 rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
0a7de745 712 if (!rv) {
b0d623f7
A		 713 rv = kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6,
714 pfr_walktree, &w);
0a7de745 715 }
b0d623f7
A		 716 if (!rv && (flags & PFR_FLAG_CLSTATS)) {
717 pfr_enqueue_addrs(kt, &workq, NULL, 0);
718 pfr_clstats_kentries(&workq, tzero, 0);
719 }
0a7de745
A		 720 if (rv) {
721 return rv;
722 }
b0d623f7
A		 723
724 if (w.pfrw_free) {
725 printf("pfr_get_astats: corruption detected (%d).\n",
726 w.pfrw_free);
0a7de745 727 return ENOTTY;
b0d623f7
A		 728 }
729 *size = kt->pfrkt_cnt;
0a7de745 730 return 0;
b0d623f7
A		 731}
732
733int
d1ecb069 734pfr_clr_astats(struct pfr_table *tbl, user_addr_t _addr, int size,
b0d623f7
A		 735 int *nzero, int flags)
736{
0a7de745
A		 737 struct pfr_ktable *kt;
738 struct pfr_kentryworkq workq;
739 struct pfr_kentry *p;
740 struct pfr_addr ad;
741 user_addr_t addr = _addr;
742 int i, rv, xzero = 0;
b0d623f7
A		 743
744 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
745 PFR_FLAG_FEEDBACK);
0a7de745
A		 746 if (pfr_validate_table(tbl, 0, 0)) {
747 return EINVAL;
748 }
b0d623f7 749 kt = pfr_lookup_table(tbl);
0a7de745
A		 750 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
751 return ESRCH;
752 }
b0d623f7 753 SLIST_INIT(&workq);
0a7de745
A		 754 for (i = 0; i < size; i++, addr += sizeof(ad)) {
755 if (COPYIN(addr, &ad, sizeof(ad), flags)) {
b0d623f7 756 senderr(EFAULT);
0a7de745
A		 757 }
758 if (pfr_validate_addr(&ad)) {
b0d623f7 759 senderr(EINVAL);
0a7de745 760 }
b0d623f7
A		 761 p = pfr_lookup_addr(kt, &ad, 1);
762 if (flags & PFR_FLAG_FEEDBACK) {
763 ad.pfra_fback = (p != NULL) ?
764 PFR_FB_CLEARED : PFR_FB_NONE;
0a7de745 765 if (COPYOUT(&ad, addr, sizeof(ad), flags)) {
b0d623f7 766 senderr(EFAULT);
0a7de745 767 }
b0d623f7
A		 768 }
769 if (p != NULL) {
770 SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
771 xzero++;
772 }
773 }
774
775 if (!(flags & PFR_FLAG_DUMMY)) {
776 pfr_clstats_kentries(&workq, 0, 0);
777 }
0a7de745 778 if (nzero != NULL) {
b0d623f7 779 *nzero = xzero;
0a7de745
A		 780 }
781 return 0;
b0d623f7 782_bad:
0a7de745 783 if (flags & PFR_FLAG_FEEDBACK) {
d1ecb069 784 pfr_reset_feedback(_addr, size, flags);
0a7de745
A		 785 }
786 return rv;
b0d623f7
A		 787}
788
d1ecb069 789static int
b0d623f7
A		 790pfr_validate_addr(struct pfr_addr *ad)
791{
792 int i;
793
794 switch (ad->pfra_af) {
795#if INET
796 case AF_INET:
0a7de745
A		 797 if (ad->pfra_net > 32) {
798 return -1;
799 }
b0d623f7
A		 800 break;
801#endif /* INET */
802#if INET6
803 case AF_INET6:
0a7de745
A		 804 if (ad->pfra_net > 128) {
805 return -1;
806 }
b0d623f7
A		 807 break;
808#endif /* INET6 */
809 default:
0a7de745 810 return -1;
b0d623f7
A		 811 }
812 if (ad->pfra_net < 128 &&
0a7de745
A		 813 (((caddr_t)ad)[ad->pfra_net / 8] & (0xFF >> (ad->pfra_net % 8)))) {
814 return -1;
815 }
816 for (i = (ad->pfra_net + 7) / 8; i < (int)sizeof(ad->pfra_u); i++) {
817 if (((caddr_t)ad)[i]) {
818 return -1;
819 }
820 }
821 if (ad->pfra_not && ad->pfra_not != 1) {
822 return -1;
823 }
824 if (ad->pfra_fback) {
825 return -1;
826 }
827 return 0;
b0d623f7
A		 828}
829
d1ecb069 830static void
b0d623f7 831pfr_enqueue_addrs(struct pfr_ktable *kt, struct pfr_kentryworkq *workq,
0a7de745 832 int *naddr, int sweep)
b0d623f7 833{
0a7de745 834 struct pfr_walktree w;
b0d623f7
A		 835
836 SLIST_INIT(workq);
0a7de745 837 bzero(&w, sizeof(w));
b0d623f7
A		 838 w.pfrw_op = sweep ? PFRW_SWEEP : PFRW_ENQUEUE;
839 w.pfrw_workq = workq;
0a7de745 840 if (kt->pfrkt_ip4 != NULL) {
b0d623f7 841 if (kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4,
0a7de745 842 pfr_walktree, &w)) {
b0d623f7 843 printf("pfr_enqueue_addrs: IPv4 walktree failed.\n");
0a7de745
A		 844 }
845 }
846 if (kt->pfrkt_ip6 != NULL) {
b0d623f7 847 if (kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6,
0a7de745 848 pfr_walktree, &w)) {
b0d623f7 849 printf("pfr_enqueue_addrs: IPv6 walktree failed.\n");
0a7de745
A		 850 }
851 }
852 if (naddr != NULL) {
b0d623f7 853 *naddr = w.pfrw_cnt;
0a7de745 854 }
b0d623f7
A		 855}
856
d1ecb069 857static void
b0d623f7
A		 858pfr_mark_addrs(struct pfr_ktable *kt)
859{
0a7de745 860 struct pfr_walktree w;
b0d623f7 861
0a7de745 862 bzero(&w, sizeof(w));
b0d623f7 863 w.pfrw_op = PFRW_MARK;
0a7de745 864 if (kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w)) {
b0d623f7 865 printf("pfr_mark_addrs: IPv4 walktree failed.\n");
0a7de745
A		 866 }
867 if (kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w)) {
b0d623f7 868 printf("pfr_mark_addrs: IPv6 walktree failed.\n");
0a7de745 869 }
b0d623f7
A		 870}
871
872
d1ecb069 873static struct pfr_kentry *
b0d623f7
A		 874pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact)
875{
0a7de745
A		 876 union sockaddr_union sa, mask;
877 struct radix_node_head *head;
878 struct pfr_kentry *ke;
b0d623f7 879
5ba3f43e 880 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7 881
0a7de745 882 bzero(&sa, sizeof(sa));
b0d623f7
A		 883 if (ad->pfra_af == AF_INET) {
884 FILLIN_SIN(sa.sin, ad->pfra_ip4addr);
885 head = kt->pfrkt_ip4;
886 } else if (ad->pfra_af == AF_INET6) {
887 FILLIN_SIN6(sa.sin6, ad->pfra_ip6addr);
888 head = kt->pfrkt_ip6;
0a7de745 889 } else {
b0d623f7 890 return NULL;
0a7de745 891 }
b0d623f7
A		 892 if (ADDR_NETWORK(ad)) {
893 pfr_prepare_network(&mask, ad->pfra_af, ad->pfra_net);
894 ke = (struct pfr_kentry *)rn_lookup(&sa, &mask, head);
0a7de745 895 if (ke && KENTRY_RNF_ROOT(ke)) {
b0d623f7 896 ke = NULL;
0a7de745 897 }
b0d623f7
A		 898 } else {
899 ke = (struct pfr_kentry *)rn_match(&sa, head);
0a7de745 900 if (ke && KENTRY_RNF_ROOT(ke)) {
b0d623f7 901 ke = NULL;
0a7de745
A		 902 }
903 if (exact && ke && KENTRY_NETWORK(ke)) {
b0d623f7 904 ke = NULL;
0a7de745 905 }
b0d623f7 906 }
0a7de745 907 return ke;
b0d623f7
A		 908}
909
d1ecb069 910static struct pfr_kentry *
b0d623f7
A		 911pfr_create_kentry(struct pfr_addr *ad, int intr)
912{
0a7de745 913 struct pfr_kentry *ke;
b0d623f7 914
0a7de745 915 if (intr) {
b0d623f7 916 ke = pool_get(&pfr_kentry_pl2, PR_WAITOK);
0a7de745 917 } else {
b0d623f7 918 ke = pool_get(&pfr_kentry_pl, PR_WAITOK);
0a7de745
A		 919 }
920 if (ke == NULL) {
921 return NULL;
922 }
923 bzero(ke, sizeof(*ke));
b0d623f7 924
0a7de745 925 if (ad->pfra_af == AF_INET) {
b0d623f7 926 FILLIN_SIN(ke->pfrke_sa.sin, ad->pfra_ip4addr);
0a7de745 927 } else if (ad->pfra_af == AF_INET6) {
b0d623f7 928 FILLIN_SIN6(ke->pfrke_sa.sin6, ad->pfra_ip6addr);
0a7de745 929 }
b0d623f7
A		 930 ke->pfrke_af = ad->pfra_af;
931 ke->pfrke_net = ad->pfra_net;
932 ke->pfrke_not = ad->pfra_not;
933 ke->pfrke_intrpool = intr;
0a7de745 934 return ke;
b0d623f7
A		 935}
936
d1ecb069 937static void
b0d623f7
A		 938pfr_destroy_kentries(struct pfr_kentryworkq *workq)
939{
0a7de745 940 struct pfr_kentry *p, *q;
b0d623f7
A		 941
942 for (p = SLIST_FIRST(workq); p != NULL; p = q) {
943 q = SLIST_NEXT(p, pfrke_workq);
944 pfr_destroy_kentry(p);
945 }
946}
947
d1ecb069 948static void
b0d623f7
A		 949pfr_destroy_kentry(struct pfr_kentry *ke)
950{
0a7de745 951 if (ke->pfrke_intrpool) {
b0d623f7 952 pool_put(&pfr_kentry_pl2, ke);
0a7de745 953 } else {
b0d623f7 954 pool_put(&pfr_kentry_pl, ke);
0a7de745 955 }
b0d623f7
A		 956}
957
d1ecb069 958static void
b0d623f7
A		 959pfr_insert_kentries(struct pfr_ktable *kt,
960 struct pfr_kentryworkq *workq, u_int64_t tzero)
961{
0a7de745
A		 962 struct pfr_kentry *p;
963 int rv, n = 0;
b0d623f7
A		 964
965 SLIST_FOREACH(p, workq, pfrke_workq) {
966 rv = pfr_route_kentry(kt, p);
967 if (rv) {
968 printf("pfr_insert_kentries: cannot route entry "
969 "(code=%d).\n", rv);
970 break;
971 }
972 p->pfrke_tzero = tzero;
973 n++;
974 }
975 kt->pfrkt_cnt += n;
976}
977
978int
979pfr_insert_kentry(struct pfr_ktable *kt, struct pfr_addr *ad, u_int64_t tzero)
980{
0a7de745
A		 981 struct pfr_kentry *p;
982 int rv;
b0d623f7
A		 983
984 p = pfr_lookup_addr(kt, ad, 1);
0a7de745
A		 985 if (p != NULL) {
986 return 0;
987 }
b0d623f7 988 p = pfr_create_kentry(ad, 1);
0a7de745
A		 989 if (p == NULL) {
990 return EINVAL;
991 }
b0d623f7
A		 992
993 rv = pfr_route_kentry(kt, p);
0a7de745
A		 994 if (rv) {
995 return rv;
996 }
b0d623f7
A		 997
998 p->pfrke_tzero = tzero;
999 kt->pfrkt_cnt++;
1000
0a7de745 1001 return 0;
b0d623f7
A		 1002}
1003
d1ecb069 1004static void
b0d623f7
A		 1005pfr_remove_kentries(struct pfr_ktable *kt,
1006 struct pfr_kentryworkq *workq)
1007{
0a7de745
A		 1008 struct pfr_kentry *p;
1009 int n = 0;
b0d623f7
A		 1010
1011 SLIST_FOREACH(p, workq, pfrke_workq) {
1012 pfr_unroute_kentry(kt, p);
1013 n++;
1014 }
1015 kt->pfrkt_cnt -= n;
1016 pfr_destroy_kentries(workq);
1017}
1018
d1ecb069 1019static void
b0d623f7
A		 1020pfr_clean_node_mask(struct pfr_ktable *kt,
1021 struct pfr_kentryworkq *workq)
1022{
0a7de745 1023 struct pfr_kentry *p;
b0d623f7
A		 1024
1025 SLIST_FOREACH(p, workq, pfrke_workq)
0a7de745 1026 pfr_unroute_kentry(kt, p);
b0d623f7
A		 1027}
1028
d1ecb069 1029static void
b0d623f7
A		 1030pfr_clstats_kentries(struct pfr_kentryworkq *workq, u_int64_t tzero,
1031 int negchange)
1032{
0a7de745 1033 struct pfr_kentry *p;
b0d623f7 1034
5ba3f43e 1035 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7
A		 1036
1037 SLIST_FOREACH(p, workq, pfrke_workq) {
0a7de745 1038 if (negchange) {
b0d623f7 1039 p->pfrke_not = !p->pfrke_not;
0a7de745
A		 1040 }
1041 bzero(p->pfrke_packets, sizeof(p->pfrke_packets));
1042 bzero(p->pfrke_bytes, sizeof(p->pfrke_bytes));
b0d623f7
A		 1043 p->pfrke_tzero = tzero;
1044 }
1045}
1046
d1ecb069
A		 1047static void
1048pfr_reset_feedback(user_addr_t addr, int size, int flags)
b0d623f7 1049{
0a7de745
A		 1050 struct pfr_addr ad;
1051 int i;
b0d623f7 1052
0a7de745
A		 1053 for (i = 0; i < size; i++, addr += sizeof(ad)) {
1054 if (COPYIN(addr, &ad, sizeof(ad), flags)) {
b0d623f7 1055 break;
0a7de745 1056 }
b0d623f7 1057 ad.pfra_fback = PFR_FB_NONE;
0a7de745 1058 if (COPYOUT(&ad, addr, sizeof(ad), flags)) {
b0d623f7 1059 break;
0a7de745 1060 }
b0d623f7
A		 1061 }
1062}
1063
d1ecb069 1064static void
b0d623f7
A		 1065pfr_prepare_network(union sockaddr_union *sa, int af, int net)
1066{
0a7de745 1067 int i;
b0d623f7 1068
0a7de745 1069 bzero(sa, sizeof(*sa));
b0d623f7 1070 if (af == AF_INET) {
0a7de745 1071 sa->sin.sin_len = sizeof(sa->sin);
b0d623f7 1072 sa->sin.sin_family = AF_INET;
0a7de745 1073 sa->sin.sin_addr.s_addr = net ? htonl(-1 << (32 - net)) : 0;
b0d623f7 1074 } else if (af == AF_INET6) {
0a7de745 1075 sa->sin6.sin6_len = sizeof(sa->sin6);
b0d623f7
A		 1076 sa->sin6.sin6_family = AF_INET6;
1077 for (i = 0; i < 4; i++) {
1078 if (net <= 32) {
1079 sa->sin6.sin6_addr.s6_addr32[i] =
0a7de745 1080 net ? htonl(-1 << (32 - net)) : 0;
b0d623f7
A		 1081 break;
1082 }
1083 sa->sin6.sin6_addr.s6_addr32[i] = 0xFFFFFFFF;
1084 net -= 32;
1085 }
1086 }
1087}
1088
d1ecb069 1089static int
b0d623f7
A		 1090pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
1091{
0a7de745
A		 1092 union sockaddr_union mask;
1093 struct radix_node *rn;
1094 struct radix_node_head *head;
b0d623f7 1095
5ba3f43e 1096 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7 1097
0a7de745
A		 1098 bzero(ke->pfrke_node, sizeof(ke->pfrke_node));
1099 if (ke->pfrke_af == AF_INET) {
b0d623f7 1100 head = kt->pfrkt_ip4;
0a7de745 1101 } else if (ke->pfrke_af == AF_INET6) {
b0d623f7 1102 head = kt->pfrkt_ip6;
0a7de745
A		 1103 } else {
1104 return -1;
1105 }
b0d623f7
A		 1106
1107 if (KENTRY_NETWORK(ke)) {
1108 pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
1109 rn = rn_addroute(&ke->pfrke_sa, &mask, head, ke->pfrke_node);
0a7de745 1110 } else {
b0d623f7 1111 rn = rn_addroute(&ke->pfrke_sa, NULL, head, ke->pfrke_node);
0a7de745 1112 }
b0d623f7 1113
0a7de745 1114 return rn == NULL ? -1 : 0;
b0d623f7
A		 1115}
1116
d1ecb069 1117static int
b0d623f7
A		 1118pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
1119{
0a7de745
A		 1120 union sockaddr_union mask;
1121 struct radix_node *rn;
1122 struct radix_node_head *head;
b0d623f7 1123
5ba3f43e 1124 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7 1125
0a7de745 1126 if (ke->pfrke_af == AF_INET) {
b0d623f7 1127 head = kt->pfrkt_ip4;
0a7de745 1128 } else if (ke->pfrke_af == AF_INET6) {
b0d623f7 1129 head = kt->pfrkt_ip6;
0a7de745
A		 1130 } else {
1131 return -1;
1132 }
b0d623f7
A		 1133
1134 if (KENTRY_NETWORK(ke)) {
1135 pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
1136 rn = rn_delete(&ke->pfrke_sa, &mask, head);
0a7de745 1137 } else {
b0d623f7 1138 rn = rn_delete(&ke->pfrke_sa, NULL, head);
0a7de745 1139 }
b0d623f7
A		 1140
1141 if (rn == NULL) {
1142 printf("pfr_unroute_kentry: delete failed.\n");
0a7de745 1143 return -1;
b0d623f7 1144 }
0a7de745 1145 return 0;
b0d623f7
A		 1146}
1147
d1ecb069 1148static void
b0d623f7
A		 1149pfr_copyout_addr(struct pfr_addr *ad, struct pfr_kentry *ke)
1150{
0a7de745
A		 1151 bzero(ad, sizeof(*ad));
1152 if (ke == NULL) {
b0d623f7 1153 return;
0a7de745 1154 }
b0d623f7
A		 1155 ad->pfra_af = ke->pfrke_af;
1156 ad->pfra_net = ke->pfrke_net;
1157 ad->pfra_not = ke->pfrke_not;
0a7de745 1158 if (ad->pfra_af == AF_INET) {
b0d623f7 1159 ad->pfra_ip4addr = ke->pfrke_sa.sin.sin_addr;
0a7de745 1160 } else if (ad->pfra_af == AF_INET6) {
b0d623f7 1161 ad->pfra_ip6addr = ke->pfrke_sa.sin6.sin6_addr;
0a7de745 1162 }
b0d623f7
A		 1163}
1164
d1ecb069 1165static int
b0d623f7
A		 1166pfr_walktree(struct radix_node *rn, void *arg)
1167{
0a7de745
A		 1168 struct pfr_kentry *ke = (struct pfr_kentry *)rn;
1169 struct pfr_walktree *w = arg;
1170 int flags = w->pfrw_flags;
b0d623f7 1171
5ba3f43e 1172 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7
A		 1173
1174 switch (w->pfrw_op) {
1175 case PFRW_MARK:
1176 ke->pfrke_mark = 0;
1177 break;
1178 case PFRW_SWEEP:
0a7de745 1179 if (ke->pfrke_mark) {
b0d623f7 1180 break;
0a7de745
A		 1181 }
1182 /* FALLTHROUGH */
b0d623f7
A		 1183 case PFRW_ENQUEUE:
1184 SLIST_INSERT_HEAD(w->pfrw_workq, ke, pfrke_workq);
1185 w->pfrw_cnt++;
1186 break;
1187 case PFRW_GET_ADDRS:
1188 if (w->pfrw_free-- > 0) {
1189 struct pfr_addr ad;
1190
1191 pfr_copyout_addr(&ad, ke);
0a7de745
A		 1192 if (copyout(&ad, w->pfrw_addr, sizeof(ad))) {
1193 return EFAULT;
1194 }
1195 w->pfrw_addr += sizeof(ad);
b0d623f7
A		 1196 }
1197 break;
1198 case PFRW_GET_ASTATS:
1199 if (w->pfrw_free-- > 0) {
1200 struct pfr_astats as;
1201
cb323159
A		 1202 bzero(&as, sizeof(as));
1203
b0d623f7
A		 1204 pfr_copyout_addr(&as.pfras_a, ke);
1205
1206 bcopy(ke->pfrke_packets, as.pfras_packets,
0a7de745 1207 sizeof(as.pfras_packets));
b0d623f7 1208 bcopy(ke->pfrke_bytes, as.pfras_bytes,
0a7de745 1209 sizeof(as.pfras_bytes));
b0d623f7
A		 1210 as.pfras_tzero = ke->pfrke_tzero;
1211
0a7de745
A		 1212 if (COPYOUT(&as, w->pfrw_astats, sizeof(as), flags)) {
1213 return EFAULT;
1214 }
1215 w->pfrw_astats += sizeof(as);
b0d623f7
A		 1216 }
1217 break;
1218 case PFRW_POOL_GET:
0a7de745 1219 if (ke->pfrke_not) {
b0d623f7 1220 break; /* negative entries are ignored */
0a7de745 1221 }
b0d623f7
A		 1222 if (!w->pfrw_cnt--) {
1223 w->pfrw_kentry = ke;
0a7de745 1224 return 1; /* finish search */
b0d623f7
A		 1225 }
1226 break;
1227 case PFRW_DYNADDR_UPDATE:
1228 if (ke->pfrke_af == AF_INET) {
0a7de745 1229 if (w->pfrw_dyn->pfid_acnt4++ > 0) {
b0d623f7 1230 break;
0a7de745 1231 }
b0d623f7
A		 1232 pfr_prepare_network(&pfr_mask, AF_INET, ke->pfrke_net);
1233 w->pfrw_dyn->pfid_addr4 = *SUNION2PF(
0a7de745 1234 &ke->pfrke_sa, AF_INET);
b0d623f7 1235 w->pfrw_dyn->pfid_mask4 = *SUNION2PF(
0a7de745 1236 &pfr_mask, AF_INET);
b0d623f7 1237 } else if (ke->pfrke_af == AF_INET6) {
0a7de745 1238 if (w->pfrw_dyn->pfid_acnt6++ > 0) {
b0d623f7 1239 break;
0a7de745 1240 }
b0d623f7
A		 1241 pfr_prepare_network(&pfr_mask, AF_INET6, ke->pfrke_net);
1242 w->pfrw_dyn->pfid_addr6 = *SUNION2PF(
0a7de745 1243 &ke->pfrke_sa, AF_INET6);
b0d623f7 1244 w->pfrw_dyn->pfid_mask6 = *SUNION2PF(
0a7de745 1245 &pfr_mask, AF_INET6);
b0d623f7
A		 1246 }
1247 break;
1248 }
0a7de745 1249 return 0;
b0d623f7
A		 1250}
1251
1252int
1253pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags)
1254{
0a7de745
A		 1255 struct pfr_ktableworkq workq;
1256 struct pfr_ktable *p;
1257 int xdel = 0;
b0d623f7 1258
5ba3f43e 1259 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7
A		 1260
1261 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
1262 PFR_FLAG_ALLRSETS);
0a7de745
A		 1263 if (pfr_fix_anchor(filter->pfrt_anchor)) {
1264 return EINVAL;
1265 }
1266 if (pfr_table_count(filter, flags) < 0) {
1267 return ENOENT;
1268 }
b0d623f7
A		 1269
1270 SLIST_INIT(&workq);
1271 RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
0a7de745 1272 if (pfr_skip_table(filter, p, flags)) {
b0d623f7 1273 continue;
0a7de745
A		 1274 }
1275 if (strcmp(p->pfrkt_anchor, PF_RESERVED_ANCHOR) == 0) {
b0d623f7 1276 continue;
0a7de745
A		 1277 }
1278 if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
b0d623f7 1279 continue;
0a7de745 1280 }
b0d623f7
A		 1281 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1282 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1283 xdel++;
1284 }
1285 if (!(flags & PFR_FLAG_DUMMY)) {
1286 pfr_setflags_ktables(&workq);
1287 }
0a7de745 1288 if (ndel != NULL) {
b0d623f7 1289 *ndel = xdel;
0a7de745
A		 1290 }
1291 return 0;
b0d623f7
A		 1292}
1293
1294int
d1ecb069 1295pfr_add_tables(user_addr_t tbl, int size, int *nadd, int flags)
b0d623f7 1296{
0a7de745
A		 1297 struct pfr_ktableworkq addq, changeq;
1298 struct pfr_ktable *p, *q, *r, key;
1299 int i, rv, xadd = 0;
1300 u_int64_t tzero = pf_calendar_time_second();
b0d623f7 1301
5ba3f43e 1302 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7
A		 1303
1304 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
1305 SLIST_INIT(&addq);
1306 SLIST_INIT(&changeq);
0a7de745
A		 1307 for (i = 0; i < size; i++, tbl += sizeof(key.pfrkt_t)) {
1308 if (COPYIN(tbl, &key.pfrkt_t, sizeof(key.pfrkt_t), flags)) {
b0d623f7 1309 senderr(EFAULT);
0a7de745 1310 }
6d2010ae 1311 pfr_table_copyin_cleanup(&key.pfrkt_t);
b0d623f7 1312 if (pfr_validate_table(&key.pfrkt_t, PFR_TFLAG_USRMASK,
0a7de745 1313 flags & PFR_FLAG_USERIOCTL)) {
b0d623f7 1314 senderr(EINVAL);
0a7de745 1315 }
b0d623f7
A		 1316 key.pfrkt_flags |= PFR_TFLAG_ACTIVE;
1317 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1318 if (p == NULL) {
1319 p = pfr_create_ktable(&key.pfrkt_t, tzero, 1);
0a7de745 1320 if (p == NULL) {
b0d623f7 1321 senderr(ENOMEM);
0a7de745 1322 }
b0d623f7 1323 SLIST_FOREACH(q, &addq, pfrkt_workq) {
0a7de745 1324 if (!pfr_ktable_compare(p, q)) {
b0d623f7 1325 goto _skip;
0a7de745 1326 }
b0d623f7
A		 1327 }
1328 SLIST_INSERT_HEAD(&addq, p, pfrkt_workq);
1329 xadd++;
0a7de745 1330 if (!key.pfrkt_anchor[0]) {
b0d623f7 1331 goto _skip;
0a7de745 1332 }
b0d623f7
A		 1333
1334 /* find or create root table */
0a7de745 1335 bzero(key.pfrkt_anchor, sizeof(key.pfrkt_anchor));
b0d623f7
A		 1336 r = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1337 if (r != NULL) {
1338 p->pfrkt_root = r;
1339 goto _skip;
1340 }
1341 SLIST_FOREACH(q, &addq, pfrkt_workq) {
1342 if (!pfr_ktable_compare(&key, q)) {
1343 p->pfrkt_root = q;
1344 goto _skip;
1345 }
1346 }
1347 key.pfrkt_flags = 0;
1348 r = pfr_create_ktable(&key.pfrkt_t, 0, 1);
0a7de745 1349 if (r == NULL) {
b0d623f7 1350 senderr(ENOMEM);
0a7de745 1351 }
b0d623f7
A		 1352 SLIST_INSERT_HEAD(&addq, r, pfrkt_workq);
1353 p->pfrkt_root = r;
1354 } else if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1355 SLIST_FOREACH(q, &changeq, pfrkt_workq)
0a7de745
A		 1356 if (!pfr_ktable_compare(&key, q)) {
1357 goto _skip;
1358 }
b0d623f7
A		 1359 p->pfrkt_nflags = (p->pfrkt_flags &
1360 ~PFR_TFLAG_USRMASK) | key.pfrkt_flags;
1361 SLIST_INSERT_HEAD(&changeq, p, pfrkt_workq);
1362 xadd++;
1363 }
1364_skip:
0a7de745 1365 ;
b0d623f7
A		 1366 }
1367 if (!(flags & PFR_FLAG_DUMMY)) {
1368 pfr_insert_ktables(&addq);
1369 pfr_setflags_ktables(&changeq);
0a7de745 1370 } else {
b0d623f7 1371 pfr_destroy_ktables(&addq, 0);
0a7de745
A		 1372 }
1373 if (nadd != NULL) {
b0d623f7 1374 *nadd = xadd;
0a7de745
A		 1375 }
1376 return 0;
b0d623f7
A		 1377_bad:
1378 pfr_destroy_ktables(&addq, 0);
0a7de745 1379 return rv;
b0d623f7
A		 1380}
1381
1382int
d1ecb069 1383pfr_del_tables(user_addr_t tbl, int size, int *ndel, int flags)
b0d623f7 1384{
0a7de745
A		 1385 struct pfr_ktableworkq workq;
1386 struct pfr_ktable *p, *q, key;
1387 int i, xdel = 0;
b0d623f7 1388
5ba3f43e 1389 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7
A		 1390
1391 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
1392 SLIST_INIT(&workq);
0a7de745
A		 1393 for (i = 0; i < size; i++, tbl += sizeof(key.pfrkt_t)) {
1394 if (COPYIN(tbl, &key.pfrkt_t, sizeof(key.pfrkt_t), flags)) {
1395 return EFAULT;
1396 }
6d2010ae 1397 pfr_table_copyin_cleanup(&key.pfrkt_t);
b0d623f7 1398 if (pfr_validate_table(&key.pfrkt_t, 0,
0a7de745
A		 1399 flags & PFR_FLAG_USERIOCTL)) {
1400 return EINVAL;
1401 }
b0d623f7
A		 1402 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1403 if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1404 SLIST_FOREACH(q, &workq, pfrkt_workq)
0a7de745
A		 1405 if (!pfr_ktable_compare(p, q)) {
1406 goto _skip;
1407 }
b0d623f7
A		 1408 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1409 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1410 xdel++;
1411 }
1412_skip:
0a7de745 1413 ;
b0d623f7
A		 1414 }
1415
1416 if (!(flags & PFR_FLAG_DUMMY)) {
1417 pfr_setflags_ktables(&workq);
1418 }
0a7de745 1419 if (ndel != NULL) {
b0d623f7 1420 *ndel = xdel;
0a7de745
A		 1421 }
1422 return 0;
b0d623f7
A		 1423}
1424
1425int
d1ecb069 1426pfr_get_tables(struct pfr_table *filter, user_addr_t tbl, int *size,
0a7de745 1427 int flags)
b0d623f7 1428{
0a7de745
A		 1429 struct pfr_ktable *p;
1430 int n, nn;
b0d623f7
A		 1431
1432 ACCEPT_FLAGS(flags, PFR_FLAG_ALLRSETS);
0a7de745
A		 1433 if (pfr_fix_anchor(filter->pfrt_anchor)) {
1434 return EINVAL;
1435 }
b0d623f7 1436 n = nn = pfr_table_count(filter, flags);
0a7de745
A		 1437 if (n < 0) {
1438 return ENOENT;
1439 }
b0d623f7
A		 1440 if (n > *size) {
1441 *size = n;
0a7de745 1442 return 0;
b0d623f7
A		 1443 }
1444 RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
0a7de745 1445 if (pfr_skip_table(filter, p, flags)) {
b0d623f7 1446 continue;
0a7de745
A		 1447 }
1448 if (n-- <= 0) {
b0d623f7 1449 continue;
0a7de745
A		 1450 }
1451 if (COPYOUT(&p->pfrkt_t, tbl, sizeof(p->pfrkt_t), flags)) {
1452 return EFAULT;
1453 }
1454 tbl += sizeof(p->pfrkt_t);
b0d623f7
A		 1455 }
1456 if (n) {
1457 printf("pfr_get_tables: corruption detected (%d).\n", n);
0a7de745 1458 return ENOTTY;
b0d623f7
A		 1459 }
1460 *size = nn;
0a7de745 1461 return 0;
b0d623f7
A		 1462}
1463
1464int
d1ecb069 1465pfr_get_tstats(struct pfr_table *filter, user_addr_t tbl, int *size,
0a7de745 1466 int flags)
b0d623f7 1467{
0a7de745
A		 1468 struct pfr_ktable *p;
1469 struct pfr_ktableworkq workq;
1470 int n, nn;
1471 u_int64_t tzero = pf_calendar_time_second();
b0d623f7 1472
5ba3f43e 1473 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7
A		 1474
1475 /* XXX PFR_FLAG_CLSTATS disabled */
1476 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_ALLRSETS);
0a7de745
A		 1477 if (pfr_fix_anchor(filter->pfrt_anchor)) {
1478 return EINVAL;
1479 }
b0d623f7 1480 n = nn = pfr_table_count(filter, flags);
0a7de745
A		 1481 if (n < 0) {
1482 return ENOENT;
1483 }
b0d623f7
A		 1484 if (n > *size) {
1485 *size = n;
0a7de745 1486 return 0;
b0d623f7
A		 1487 }
1488 SLIST_INIT(&workq);
1489 RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
0a7de745 1490 if (pfr_skip_table(filter, p, flags)) {
b0d623f7 1491 continue;
0a7de745
A		 1492 }
1493 if (n-- <= 0) {
b0d623f7 1494 continue;
b0d623f7 1495 }
0a7de745
A		 1496 if (COPYOUT(&p->pfrkt_ts, tbl, sizeof(p->pfrkt_ts), flags)) {
1497 return EFAULT;
1498 }
1499 tbl += sizeof(p->pfrkt_ts);
b0d623f7
A		 1500 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1501 }
0a7de745 1502 if (flags & PFR_FLAG_CLSTATS) {
b0d623f7
A		 1503 pfr_clstats_ktables(&workq, tzero,
1504 flags & PFR_FLAG_ADDRSTOO);
0a7de745 1505 }
b0d623f7
A		 1506 if (n) {
1507 printf("pfr_get_tstats: corruption detected (%d).\n", n);
0a7de745 1508 return ENOTTY;
b0d623f7
A		 1509 }
1510 *size = nn;
0a7de745 1511 return 0;
b0d623f7
A		 1512}
1513
1514int
d1ecb069 1515pfr_clr_tstats(user_addr_t tbl, int size, int *nzero, int flags)
b0d623f7 1516{
0a7de745
A		 1517 struct pfr_ktableworkq workq;
1518 struct pfr_ktable *p, key;
1519 int i, xzero = 0;
1520 u_int64_t tzero = pf_calendar_time_second();
b0d623f7 1521
5ba3f43e 1522 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7
A		 1523
1524 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
1525 PFR_FLAG_ADDRSTOO);
1526 SLIST_INIT(&workq);
0a7de745
A		 1527 for (i = 0; i < size; i++, tbl += sizeof(key.pfrkt_t)) {
1528 if (COPYIN(tbl, &key.pfrkt_t, sizeof(key.pfrkt_t), flags)) {
1529 return EFAULT;
1530 }
6d2010ae 1531 pfr_table_copyin_cleanup(&key.pfrkt_t);
0a7de745
A		 1532 if (pfr_validate_table(&key.pfrkt_t, 0, 0)) {
1533 return EINVAL;
1534 }
b0d623f7
A		 1535 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1536 if (p != NULL) {
1537 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1538 xzero++;
1539 }
1540 }
1541 if (!(flags & PFR_FLAG_DUMMY)) {
1542 pfr_clstats_ktables(&workq, tzero, flags & PFR_FLAG_ADDRSTOO);
1543 }
0a7de745 1544 if (nzero != NULL) {
b0d623f7 1545 *nzero = xzero;
0a7de745
A		 1546 }
1547 return 0;
b0d623f7
A		 1548}
1549
1550int
d1ecb069 1551pfr_set_tflags(user_addr_t tbl, int size, int setflag, int clrflag,
0a7de745 1552 int *nchange, int *ndel, int flags)
b0d623f7 1553{
0a7de745
A		 1554 struct pfr_ktableworkq workq;
1555 struct pfr_ktable *p, *q, key;
1556 int i, xchange = 0, xdel = 0;
b0d623f7 1557
5ba3f43e 1558 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7
A		 1559
1560 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
1561 if ((setflag & ~PFR_TFLAG_USRMASK) ||
1562 (clrflag & ~PFR_TFLAG_USRMASK) ||
0a7de745
A		 1563 (setflag & clrflag)) {
1564 return EINVAL;
1565 }
b0d623f7 1566 SLIST_INIT(&workq);
0a7de745
A		 1567 for (i = 0; i < size; i++, tbl += sizeof(key.pfrkt_t)) {
1568 if (COPYIN(tbl, &key.pfrkt_t, sizeof(key.pfrkt_t), flags)) {
1569 return EFAULT;
1570 }
6d2010ae 1571 pfr_table_copyin_cleanup(&key.pfrkt_t);
b0d623f7 1572 if (pfr_validate_table(&key.pfrkt_t, 0,
0a7de745
A		 1573 flags & PFR_FLAG_USERIOCTL)) {
1574 return EINVAL;
1575 }
b0d623f7
A		 1576 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1577 if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1578 p->pfrkt_nflags = (p->pfrkt_flags | setflag) &
1579 ~clrflag;
0a7de745 1580 if (p->pfrkt_nflags == p->pfrkt_flags) {
b0d623f7 1581 goto _skip;
0a7de745 1582 }
b0d623f7 1583 SLIST_FOREACH(q, &workq, pfrkt_workq)
0a7de745
A		 1584 if (!pfr_ktable_compare(p, q)) {
1585 goto _skip;
1586 }
b0d623f7
A		 1587 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1588 if ((p->pfrkt_flags & PFR_TFLAG_PERSIST) &&
1589 (clrflag & PFR_TFLAG_PERSIST) &&
0a7de745 1590 !(p->pfrkt_flags & PFR_TFLAG_REFERENCED)) {
b0d623f7 1591 xdel++;
0a7de745 1592 } else {
b0d623f7 1593 xchange++;
0a7de745 1594 }
b0d623f7
A		 1595 }
1596_skip:
0a7de745 1597 ;
b0d623f7
A		 1598 }
1599 if (!(flags & PFR_FLAG_DUMMY)) {
1600 pfr_setflags_ktables(&workq);
1601 }
0a7de745 1602 if (nchange != NULL) {
b0d623f7 1603 *nchange = xchange;
0a7de745
A		 1604 }
1605 if (ndel != NULL) {
b0d623f7 1606 *ndel = xdel;
0a7de745
A		 1607 }
1608 return 0;
b0d623f7
A		 1609}
1610
1611int
1612pfr_ina_begin(struct pfr_table *trs, u_int32_t *ticket, int *ndel, int flags)
1613{
0a7de745
A		 1614 struct pfr_ktableworkq workq;
1615 struct pfr_ktable *p;
1616 struct pf_ruleset *rs;
1617 int xdel = 0;
b0d623f7 1618
5ba3f43e 1619 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7
A		 1620
1621 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1622 rs = pf_find_or_create_ruleset(trs->pfrt_anchor);
0a7de745
A		 1623 if (rs == NULL) {
1624 return ENOMEM;
1625 }
b0d623f7
A		 1626 SLIST_INIT(&workq);
1627 RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1628 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
0a7de745 1629 pfr_skip_table(trs, p, 0)) {
b0d623f7 1630 continue;
0a7de745 1631 }
b0d623f7
A		 1632 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1633 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1634 xdel++;
1635 }
1636 if (!(flags & PFR_FLAG_DUMMY)) {
1637 pfr_setflags_ktables(&workq);
0a7de745 1638 if (ticket != NULL) {
b0d623f7 1639 *ticket = ++rs->tticket;
0a7de745 1640 }
b0d623f7 1641 rs->topen = 1;
0a7de745 1642 } else {
b0d623f7 1643 pf_remove_if_empty_ruleset(rs);
0a7de745
A		 1644 }
1645 if (ndel != NULL) {
b0d623f7 1646 *ndel = xdel;
0a7de745
A		 1647 }
1648 return 0;
b0d623f7
A		 1649}
1650
1651int
d1ecb069 1652pfr_ina_define(struct pfr_table *tbl, user_addr_t addr, int size,
b0d623f7
A		 1653 int *nadd, int *naddr, u_int32_t ticket, int flags)
1654{
0a7de745
A		 1655 struct pfr_ktableworkq tableq;
1656 struct pfr_kentryworkq addrq;
1657 struct pfr_ktable *kt, *rt, *shadow, key;
1658 struct pfr_kentry *p;
1659 struct pfr_addr ad;
1660 struct pf_ruleset *rs;
1661 int i, rv, xadd = 0, xaddr = 0;
b0d623f7 1662
5ba3f43e 1663 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7
A		 1664
1665 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ADDRSTOO);
0a7de745
A		 1666 if (size && !(flags & PFR_FLAG_ADDRSTOO)) {
1667 return EINVAL;
1668 }
b0d623f7 1669 if (pfr_validate_table(tbl, PFR_TFLAG_USRMASK,
0a7de745
A		 1670 flags & PFR_FLAG_USERIOCTL)) {
1671 return EINVAL;
1672 }
b0d623f7 1673 rs = pf_find_ruleset(tbl->pfrt_anchor);
0a7de745
A		 1674 if (rs == NULL || !rs->topen || ticket != rs->tticket) {
1675 return EBUSY;
1676 }
b0d623f7
A		 1677 tbl->pfrt_flags |= PFR_TFLAG_INACTIVE;
1678 SLIST_INIT(&tableq);
316670eb 1679 kt = RB_FIND(pfr_ktablehead, &pfr_ktables, (struct pfr_ktable *)(void *)tbl);
b0d623f7
A		 1680 if (kt == NULL) {
1681 kt = pfr_create_ktable(tbl, 0, 1);
0a7de745
A		 1682 if (kt == NULL) {
1683 return ENOMEM;
1684 }
b0d623f7
A		 1685 SLIST_INSERT_HEAD(&tableq, kt, pfrkt_workq);
1686 xadd++;
0a7de745 1687 if (!tbl->pfrt_anchor[0]) {
b0d623f7 1688 goto _skip;
0a7de745 1689 }
b0d623f7
A		 1690
1691 /* find or create root table */
0a7de745 1692 bzero(&key, sizeof(key));
b0d623f7 1693 strlcpy(key.pfrkt_name, tbl->pfrt_name,
0a7de745 1694 sizeof(key.pfrkt_name));
b0d623f7
A		 1695 rt = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1696 if (rt != NULL) {
1697 kt->pfrkt_root = rt;
1698 goto _skip;
1699 }
1700 rt = pfr_create_ktable(&key.pfrkt_t, 0, 1);
1701 if (rt == NULL) {
1702 pfr_destroy_ktables(&tableq, 0);
0a7de745 1703 return ENOMEM;
b0d623f7
A		 1704 }
1705 SLIST_INSERT_HEAD(&tableq, rt, pfrkt_workq);
1706 kt->pfrkt_root = rt;
0a7de745 1707 } else if (!(kt->pfrkt_flags & PFR_TFLAG_INACTIVE)) {
b0d623f7 1708 xadd++;
0a7de745 1709 }
b0d623f7
A		 1710_skip:
1711 shadow = pfr_create_ktable(tbl, 0, 0);
1712 if (shadow == NULL) {
1713 pfr_destroy_ktables(&tableq, 0);
0a7de745 1714 return ENOMEM;
b0d623f7
A		 1715 }
1716 SLIST_INIT(&addrq);
0a7de745
A		 1717 for (i = 0; i < size; i++, addr += sizeof(ad)) {
1718 if (COPYIN(addr, &ad, sizeof(ad), flags)) {
b0d623f7 1719 senderr(EFAULT);
0a7de745
A		 1720 }
1721 if (pfr_validate_addr(&ad)) {
b0d623f7 1722 senderr(EINVAL);
0a7de745
A		 1723 }
1724 if (pfr_lookup_addr(shadow, &ad, 1) != NULL) {
b0d623f7 1725 continue;
0a7de745 1726 }
b0d623f7 1727 p = pfr_create_kentry(&ad, 0);
0a7de745 1728 if (p == NULL) {
b0d623f7 1729 senderr(ENOMEM);
0a7de745 1730 }
b0d623f7
A		 1731 if (pfr_route_kentry(shadow, p)) {
1732 pfr_destroy_kentry(p);
1733 continue;
1734 }
1735 SLIST_INSERT_HEAD(&addrq, p, pfrke_workq);
1736 xaddr++;
1737 }
1738 if (!(flags & PFR_FLAG_DUMMY)) {
0a7de745 1739 if (kt->pfrkt_shadow != NULL) {
b0d623f7 1740 pfr_destroy_ktable(kt->pfrkt_shadow, 1);
0a7de745 1741 }
b0d623f7
A		 1742 kt->pfrkt_flags |= PFR_TFLAG_INACTIVE;
1743 pfr_insert_ktables(&tableq);
1744 shadow->pfrkt_cnt = (flags & PFR_FLAG_ADDRSTOO) ?
1745 xaddr : NO_ADDRESSES;
1746 kt->pfrkt_shadow = shadow;
1747 } else {
1748 pfr_clean_node_mask(shadow, &addrq);
1749 pfr_destroy_ktable(shadow, 0);
1750 pfr_destroy_ktables(&tableq, 0);
1751 pfr_destroy_kentries(&addrq);
1752 }
0a7de745 1753 if (nadd != NULL) {
b0d623f7 1754 *nadd = xadd;
0a7de745
A		 1755 }
1756 if (naddr != NULL) {
b0d623f7 1757 *naddr = xaddr;
0a7de745
A		 1758 }
1759 return 0;
b0d623f7
A		 1760_bad:
1761 pfr_destroy_ktable(shadow, 0);
1762 pfr_destroy_ktables(&tableq, 0);
1763 pfr_destroy_kentries(&addrq);
0a7de745 1764 return rv;
b0d623f7
A		 1765}
1766
1767int
1768pfr_ina_rollback(struct pfr_table *trs, u_int32_t ticket, int *ndel, int flags)
1769{
0a7de745
A		 1770 struct pfr_ktableworkq workq;
1771 struct pfr_ktable *p;
1772 struct pf_ruleset *rs;
1773 int xdel = 0;
b0d623f7 1774
5ba3f43e 1775 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7
A		 1776
1777 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1778 rs = pf_find_ruleset(trs->pfrt_anchor);
0a7de745
A		 1779 if (rs == NULL || !rs->topen || ticket != rs->tticket) {
1780 return 0;
1781 }
b0d623f7
A		 1782 SLIST_INIT(&workq);
1783 RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1784 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
0a7de745 1785 pfr_skip_table(trs, p, 0)) {
b0d623f7 1786 continue;
0a7de745 1787 }
b0d623f7
A		 1788 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1789 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1790 xdel++;
1791 }
1792 if (!(flags & PFR_FLAG_DUMMY)) {
1793 pfr_setflags_ktables(&workq);
1794 rs->topen = 0;
1795 pf_remove_if_empty_ruleset(rs);
1796 }
0a7de745 1797 if (ndel != NULL) {
b0d623f7 1798 *ndel = xdel;
0a7de745
A		 1799 }
1800 return 0;
b0d623f7
A		 1801}
1802
1803int
1804pfr_ina_commit(struct pfr_table *trs, u_int32_t ticket, int *nadd,
1805 int *nchange, int flags)
1806{
0a7de745
A		 1807 struct pfr_ktable *p, *q;
1808 struct pfr_ktableworkq workq;
1809 struct pf_ruleset *rs;
1810 int xadd = 0, xchange = 0;
1811 u_int64_t tzero = pf_calendar_time_second();
b0d623f7 1812
5ba3f43e 1813 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7
A		 1814
1815 ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
1816 rs = pf_find_ruleset(trs->pfrt_anchor);
0a7de745
A		 1817 if (rs == NULL || !rs->topen || ticket != rs->tticket) {
1818 return EBUSY;
1819 }
b0d623f7
A		 1820
1821 SLIST_INIT(&workq);
1822 RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1823 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
0a7de745 1824 pfr_skip_table(trs, p, 0)) {
b0d623f7 1825 continue;
0a7de745 1826 }
b0d623f7 1827 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
0a7de745 1828 if (p->pfrkt_flags & PFR_TFLAG_ACTIVE) {
b0d623f7 1829 xchange++;
0a7de745 1830 } else {
b0d623f7 1831 xadd++;
0a7de745 1832 }
b0d623f7
A		 1833 }
1834
1835 if (!(flags & PFR_FLAG_DUMMY)) {
1836 for (p = SLIST_FIRST(&workq); p != NULL; p = q) {
1837 q = SLIST_NEXT(p, pfrkt_workq);
1838 pfr_commit_ktable(p, tzero);
1839 }
1840 rs->topen = 0;
1841 pf_remove_if_empty_ruleset(rs);
1842 }
0a7de745 1843 if (nadd != NULL) {
b0d623f7 1844 *nadd = xadd;
0a7de745
A		 1845 }
1846 if (nchange != NULL) {
b0d623f7 1847 *nchange = xchange;
0a7de745 1848 }
b0d623f7 1849
0a7de745 1850 return 0;
b0d623f7
A		 1851}
1852
d1ecb069 1853static void
b0d623f7
A		 1854pfr_commit_ktable(struct pfr_ktable *kt, u_int64_t tzero)
1855{
0a7de745
A		 1856 struct pfr_ktable *shadow = kt->pfrkt_shadow;
1857 int nflags;
b0d623f7 1858
5ba3f43e 1859 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7
A		 1860
1861 if (shadow->pfrkt_cnt == NO_ADDRESSES) {
0a7de745 1862 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
b0d623f7 1863 pfr_clstats_ktable(kt, tzero, 1);
0a7de745 1864 }
b0d623f7
A		 1865 } else if (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) {
1866 /* kt might contain addresses */
0a7de745
A		 1867 struct pfr_kentryworkq addrq, addq, changeq, delq, garbageq;
1868 struct pfr_kentry *p, *q, *next;
1869 struct pfr_addr ad;
b0d623f7
A		 1870
1871 pfr_enqueue_addrs(shadow, &addrq, NULL, 0);
1872 pfr_mark_addrs(kt);
1873 SLIST_INIT(&addq);
1874 SLIST_INIT(&changeq);
1875 SLIST_INIT(&delq);
1876 SLIST_INIT(&garbageq);
1877 pfr_clean_node_mask(shadow, &addrq);
1878 for (p = SLIST_FIRST(&addrq); p != NULL; p = next) {
0a7de745 1879 next = SLIST_NEXT(p, pfrke_workq); /* XXX */
b0d623f7
A		 1880 pfr_copyout_addr(&ad, p);
1881 q = pfr_lookup_addr(kt, &ad, 1);
1882 if (q != NULL) {
0a7de745 1883 if (q->pfrke_not != p->pfrke_not) {
b0d623f7
A		 1884 SLIST_INSERT_HEAD(&changeq, q,
1885 pfrke_workq);
0a7de745 1886 }
b0d623f7
A		 1887 q->pfrke_mark = 1;
1888 SLIST_INSERT_HEAD(&garbageq, p, pfrke_workq);
1889 } else {
1890 p->pfrke_tzero = tzero;
1891 SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
1892 }
1893 }
1894 pfr_enqueue_addrs(kt, &delq, NULL, ENQUEUE_UNMARKED_ONLY);
1895 pfr_insert_kentries(kt, &addq, tzero);
1896 pfr_remove_kentries(kt, &delq);
1897 pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
1898 pfr_destroy_kentries(&garbageq);
1899 } else {
1900 /* kt cannot contain addresses */
1901 SWAP(struct radix_node_head *, kt->pfrkt_ip4,
1902 shadow->pfrkt_ip4);
1903 SWAP(struct radix_node_head *, kt->pfrkt_ip6,
1904 shadow->pfrkt_ip6);
1905 SWAP(int, kt->pfrkt_cnt, shadow->pfrkt_cnt);
1906 pfr_clstats_ktable(kt, tzero, 1);
1907 }
1908 nflags = ((shadow->pfrkt_flags & PFR_TFLAG_USRMASK) |
1909 (kt->pfrkt_flags & PFR_TFLAG_SETMASK) | PFR_TFLAG_ACTIVE) &
1910 ~PFR_TFLAG_INACTIVE;
1911 pfr_destroy_ktable(shadow, 0);
1912 kt->pfrkt_shadow = NULL;
1913 pfr_setflags_ktable(kt, nflags);
1914}
1915
6d2010ae
A		 1916void
1917pfr_table_copyin_cleanup(struct pfr_table *tbl)
1918{
0a7de745
A		 1919 tbl->pfrt_anchor[sizeof(tbl->pfrt_anchor) - 1] = '\0';
1920 tbl->pfrt_name[sizeof(tbl->pfrt_name) - 1] = '\0';
6d2010ae
A		 1921}
1922
d1ecb069 1923static int
b0d623f7
A		 1924pfr_validate_table(struct pfr_table *tbl, int allowedflags, int no_reserved)
1925{
1926 int i;
1927
0a7de745
A		 1928 if (!tbl->pfrt_name[0]) {
1929 return -1;
1930 }
1931 if (no_reserved && strcmp(tbl->pfrt_anchor, PF_RESERVED_ANCHOR) == 0) {
1932 return -1;
1933 }
1934 if (tbl->pfrt_name[PF_TABLE_NAME_SIZE - 1]) {
1935 return -1;
1936 }
1937 for (i = strlen(tbl->pfrt_name); i < PF_TABLE_NAME_SIZE; i++) {
1938 if (tbl->pfrt_name[i]) {
1939 return -1;
1940 }
1941 }
1942 if (pfr_fix_anchor(tbl->pfrt_anchor)) {
1943 return -1;
1944 }
1945 if (tbl->pfrt_flags & ~allowedflags) {
1946 return -1;
1947 }
1948 return 0;
b0d623f7
A		 1949}
1950
1951/*
1952 * Rewrite anchors referenced by tables to remove slashes
1953 * and check for validity.
1954 */
d1ecb069 1955static int
b0d623f7
A		 1956pfr_fix_anchor(char *anchor)
1957{
1958 size_t siz = MAXPATHLEN;
1959 int i;
1960
1961 if (anchor[0] == '/') {
1962 char *path;
1963 int off;
1964
1965 path = anchor;
1966 off = 1;
0a7de745 1967 while (*++path == '/') {
b0d623f7 1968 off++;
0a7de745 1969 }
b0d623f7
A		 1970 bcopy(path, anchor, siz - off);
1971 memset(anchor + siz - off, 0, off);
1972 }
0a7de745
A		 1973 if (anchor[siz - 1]) {
1974 return -1;
1975 }
1976 for (i = strlen(anchor); i < (int)siz; i++) {
1977 if (anchor[i]) {
1978 return -1;
1979 }
1980 }
1981 return 0;
b0d623f7
A		 1982}
1983
d1ecb069 1984static int
b0d623f7
A		 1985pfr_table_count(struct pfr_table *filter, int flags)
1986{
1987 struct pf_ruleset *rs;
1988
0a7de745
A		 1989 if (flags & PFR_FLAG_ALLRSETS) {
1990 return pfr_ktable_cnt;
1991 }
b0d623f7
A		 1992 if (filter->pfrt_anchor[0]) {
1993 rs = pf_find_ruleset(filter->pfrt_anchor);
0a7de745 1994 return (rs != NULL) ? rs->tables : -1;
b0d623f7 1995 }
0a7de745 1996 return pf_main_ruleset.tables;
b0d623f7
A		 1997}
1998
d1ecb069 1999static int
b0d623f7
A		 2000pfr_skip_table(struct pfr_table *filter, struct pfr_ktable *kt, int flags)
2001{
0a7de745
A		 2002 if (flags & PFR_FLAG_ALLRSETS) {
2003 return 0;
2004 }
2005 if (strcmp(filter->pfrt_anchor, kt->pfrkt_anchor)) {
2006 return 1;
2007 }
2008 return 0;
b0d623f7
A		 2009}
2010
d1ecb069 2011static void
b0d623f7
A		 2012pfr_insert_ktables(struct pfr_ktableworkq *workq)
2013{
0a7de745 2014 struct pfr_ktable *p;
b0d623f7 2015
5ba3f43e 2016 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7
A		 2017
2018 SLIST_FOREACH(p, workq, pfrkt_workq)
0a7de745 2019 pfr_insert_ktable(p);
b0d623f7
A		 2020}
2021
d1ecb069 2022static void
b0d623f7
A		 2023pfr_insert_ktable(struct pfr_ktable *kt)
2024{
5ba3f43e 2025 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7
A		 2026
2027 RB_INSERT(pfr_ktablehead, &pfr_ktables, kt);
2028 pfr_ktable_cnt++;
0a7de745
A		 2029 if (kt->pfrkt_root != NULL) {
2030 if (!kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]++) {
b0d623f7 2031 pfr_setflags_ktable(kt->pfrkt_root,
0a7de745
A		 2032 kt->pfrkt_root->pfrkt_flags | PFR_TFLAG_REFDANCHOR);
2033 }
2034 }
b0d623f7
A		 2035}
2036
d1ecb069 2037static void
b0d623f7
A		 2038pfr_setflags_ktables(struct pfr_ktableworkq *workq)
2039{
0a7de745 2040 struct pfr_ktable *p, *q;
b0d623f7 2041
5ba3f43e 2042 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7
A		 2043
2044 for (p = SLIST_FIRST(workq); p; p = q) {
2045 q = SLIST_NEXT(p, pfrkt_workq);
2046 pfr_setflags_ktable(p, p->pfrkt_nflags);
2047 }
2048}
2049
d1ecb069 2050static void
b0d623f7
A		 2051pfr_setflags_ktable(struct pfr_ktable *kt, int newf)
2052{
0a7de745 2053 struct pfr_kentryworkq addrq;
b0d623f7 2054
5ba3f43e 2055 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7
A		 2056
2057 if (!(newf & PFR_TFLAG_REFERENCED) &&
0a7de745 2058 !(newf & PFR_TFLAG_PERSIST)) {
b0d623f7 2059 newf &= ~PFR_TFLAG_ACTIVE;
0a7de745
A		 2060 }
2061 if (!(newf & PFR_TFLAG_ACTIVE)) {
b0d623f7 2062 newf &= ~PFR_TFLAG_USRMASK;
0a7de745 2063 }
b0d623f7
A		 2064 if (!(newf & PFR_TFLAG_SETMASK)) {
2065 RB_REMOVE(pfr_ktablehead, &pfr_ktables, kt);
0a7de745
A		 2066 if (kt->pfrkt_root != NULL) {
2067 if (!--kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]) {
b0d623f7
A		 2068 pfr_setflags_ktable(kt->pfrkt_root,
2069 kt->pfrkt_root->pfrkt_flags &
2070 ~PFR_TFLAG_REFDANCHOR);
0a7de745
A		 2071 }
2072 }
b0d623f7
A		 2073 pfr_destroy_ktable(kt, 1);
2074 pfr_ktable_cnt--;
2075 return;
2076 }
2077 if (!(newf & PFR_TFLAG_ACTIVE) && kt->pfrkt_cnt) {
2078 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
2079 pfr_remove_kentries(kt, &addrq);
2080 }
2081 if (!(newf & PFR_TFLAG_INACTIVE) && kt->pfrkt_shadow != NULL) {
2082 pfr_destroy_ktable(kt->pfrkt_shadow, 1);
2083 kt->pfrkt_shadow = NULL;
2084 }
2085 kt->pfrkt_flags = newf;
2086}
2087
d1ecb069 2088static void
b0d623f7
A		 2089pfr_clstats_ktables(struct pfr_ktableworkq *workq, u_int64_t tzero, int recurse)
2090{
0a7de745 2091 struct pfr_ktable *p;
b0d623f7 2092
5ba3f43e 2093 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7
A		 2094
2095 SLIST_FOREACH(p, workq, pfrkt_workq)
0a7de745 2096 pfr_clstats_ktable(p, tzero, recurse);
b0d623f7
A		 2097}
2098
d1ecb069 2099static void
b0d623f7
A		 2100pfr_clstats_ktable(struct pfr_ktable *kt, u_int64_t tzero, int recurse)
2101{
0a7de745 2102 struct pfr_kentryworkq addrq;
b0d623f7 2103
5ba3f43e 2104 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7
A		 2105
2106 if (recurse) {
2107 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
2108 pfr_clstats_kentries(&addrq, tzero, 0);
2109 }
0a7de745
A		 2110 bzero(kt->pfrkt_packets, sizeof(kt->pfrkt_packets));
2111 bzero(kt->pfrkt_bytes, sizeof(kt->pfrkt_bytes));
b0d623f7
A		 2112 kt->pfrkt_match = kt->pfrkt_nomatch = 0;
2113 kt->pfrkt_tzero = tzero;
2114}
2115
d1ecb069 2116static struct pfr_ktable *
b0d623f7
A		 2117pfr_create_ktable(struct pfr_table *tbl, u_int64_t tzero, int attachruleset)
2118{
0a7de745
A		 2119 struct pfr_ktable *kt;
2120 struct pf_ruleset *rs;
b0d623f7 2121
5ba3f43e 2122 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7
A		 2123
2124 kt = pool_get(&pfr_ktable_pl, PR_WAITOK);
0a7de745
A		 2125 if (kt == NULL) {
2126 return NULL;
2127 }
2128 bzero(kt, sizeof(*kt));
b0d623f7
A		 2129 kt->pfrkt_t = *tbl;
2130
2131 if (attachruleset) {
2132 rs = pf_find_or_create_ruleset(tbl->pfrt_anchor);
2133 if (!rs) {
2134 pfr_destroy_ktable(kt, 0);
0a7de745 2135 return NULL;
b0d623f7
A		 2136 }
2137 kt->pfrkt_rs = rs;
2138 rs->tables++;
2139 }
2140
2141 if (!rn_inithead((void **)&kt->pfrkt_ip4,
2142 offsetof(struct sockaddr_in, sin_addr) * 8) ||
2143 !rn_inithead((void **)&kt->pfrkt_ip6,
2144 offsetof(struct sockaddr_in6, sin6_addr) * 8)) {
2145 pfr_destroy_ktable(kt, 0);
0a7de745 2146 return NULL;
b0d623f7
A		 2147 }
2148 kt->pfrkt_tzero = tzero;
2149
0a7de745 2150 return kt;
b0d623f7
A		 2151}
2152
d1ecb069 2153static void
b0d623f7
A		 2154pfr_destroy_ktables(struct pfr_ktableworkq *workq, int flushaddr)
2155{
0a7de745 2156 struct pfr_ktable *p, *q;
b0d623f7 2157
5ba3f43e 2158 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7
A		 2159
2160 for (p = SLIST_FIRST(workq); p; p = q) {
2161 q = SLIST_NEXT(p, pfrkt_workq);
2162 pfr_destroy_ktable(p, flushaddr);
2163 }
2164}
2165
d1ecb069 2166static void
b0d623f7
A		 2167pfr_destroy_ktable(struct pfr_ktable *kt, int flushaddr)
2168{
0a7de745 2169 struct pfr_kentryworkq addrq;
b0d623f7 2170
5ba3f43e 2171 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7
A		 2172
2173 if (flushaddr) {
2174 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
2175 pfr_clean_node_mask(kt, &addrq);
2176 pfr_destroy_kentries(&addrq);
2177 }
0a7de745 2178 if (kt->pfrkt_ip4 != NULL) {
b0d623f7 2179 _FREE((caddr_t)kt->pfrkt_ip4, M_RTABLE);
0a7de745
A		 2180 }
2181 if (kt->pfrkt_ip6 != NULL) {
b0d623f7 2182 _FREE((caddr_t)kt->pfrkt_ip6, M_RTABLE);
0a7de745
A		 2183 }
2184 if (kt->pfrkt_shadow != NULL) {
b0d623f7 2185 pfr_destroy_ktable(kt->pfrkt_shadow, flushaddr);
0a7de745 2186 }
b0d623f7
A		 2187 if (kt->pfrkt_rs != NULL) {
2188 kt->pfrkt_rs->tables--;
2189 pf_remove_if_empty_ruleset(kt->pfrkt_rs);
2190 }
2191 pool_put(&pfr_ktable_pl, kt);
2192}
2193
d1ecb069 2194static int
b0d623f7
A		 2195pfr_ktable_compare(struct pfr_ktable *p, struct pfr_ktable *q)
2196{
2197 int d;
2198
0a7de745
A		 2199 if ((d = strncmp(p->pfrkt_name, q->pfrkt_name, PF_TABLE_NAME_SIZE))) {
2200 return d;
2201 }
2202 return strcmp(p->pfrkt_anchor, q->pfrkt_anchor);
b0d623f7
A		 2203}
2204
d1ecb069 2205static struct pfr_ktable *
b0d623f7
A		 2206pfr_lookup_table(struct pfr_table *tbl)
2207{
5ba3f43e 2208 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7
A		 2209
2210 /* struct pfr_ktable start like a struct pfr_table */
0a7de745
A		 2211 return RB_FIND(pfr_ktablehead, &pfr_ktables,
2212 (struct pfr_ktable *)(void *)tbl);
b0d623f7
A		 2213}
2214
2215int
2216pfr_match_addr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af)
2217{
0a7de745
A		 2218 struct pfr_kentry *ke = NULL;
2219 int match;
b0d623f7 2220
5ba3f43e 2221 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7 2222
0a7de745 2223 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) {
b0d623f7 2224 kt = kt->pfrkt_root;
0a7de745
A		 2225 }
2226 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
2227 return 0;
2228 }
b0d623f7
A		 2229
2230 switch (af) {
2231#if INET
2232 case AF_INET:
2233 pfr_sin.sin_addr.s_addr = a->addr32[0];
2234 ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4);
0a7de745 2235 if (ke && KENTRY_RNF_ROOT(ke)) {
b0d623f7 2236 ke = NULL;
0a7de745 2237 }
b0d623f7
A		 2238 break;
2239#endif /* INET */
2240#if INET6
2241 case AF_INET6:
0a7de745 2242 bcopy(a, &pfr_sin6.sin6_addr, sizeof(pfr_sin6.sin6_addr));
b0d623f7 2243 ke = (struct pfr_kentry *)rn_match(&pfr_sin6, kt->pfrkt_ip6);
0a7de745 2244 if (ke && KENTRY_RNF_ROOT(ke)) {
b0d623f7 2245 ke = NULL;
0a7de745 2246 }
b0d623f7
A		 2247 break;
2248#endif /* INET6 */
2249 }
2250 match = (ke && !ke->pfrke_not);
0a7de745 2251 if (match) {
b0d623f7 2252 kt->pfrkt_match++;
0a7de745 2253 } else {
b0d623f7 2254 kt->pfrkt_nomatch++;
0a7de745
A		 2255 }
2256 return match;
b0d623f7
A		 2257}
2258
2259void
2260pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af,
2261 u_int64_t len, int dir_out, int op_pass, int notrule)
2262{
0a7de745 2263 struct pfr_kentry *ke = NULL;
b0d623f7 2264
5ba3f43e 2265 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7 2266
0a7de745 2267 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) {
b0d623f7 2268 kt = kt->pfrkt_root;
0a7de745
A		 2269 }
2270 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
b0d623f7 2271 return;
0a7de745 2272 }
b0d623f7
A		 2273
2274 switch (af) {
2275#if INET
2276 case AF_INET:
2277 pfr_sin.sin_addr.s_addr = a->addr32[0];
2278 ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4);
0a7de745 2279 if (ke && KENTRY_RNF_ROOT(ke)) {
b0d623f7 2280 ke = NULL;
0a7de745 2281 }
b0d623f7
A		 2282 break;
2283#endif /* INET */
2284#if INET6
2285 case AF_INET6:
0a7de745 2286 bcopy(a, &pfr_sin6.sin6_addr, sizeof(pfr_sin6.sin6_addr));
b0d623f7 2287 ke = (struct pfr_kentry *)rn_match(&pfr_sin6, kt->pfrkt_ip6);
0a7de745 2288 if (ke && KENTRY_RNF_ROOT(ke)) {
b0d623f7 2289 ke = NULL;
0a7de745 2290 }
b0d623f7
A		 2291 break;
2292#endif /* INET6 */
2293 default:
2294 ;
2295 }
2296 if ((ke == NULL || ke->pfrke_not) != notrule) {
0a7de745 2297 if (op_pass != PFR_OP_PASS) {
b0d623f7 2298 printf("pfr_update_stats: assertion failed.\n");
0a7de745 2299 }
b0d623f7
A		 2300 op_pass = PFR_OP_XPASS;
2301 }
2302 kt->pfrkt_packets[dir_out][op_pass]++;
2303 kt->pfrkt_bytes[dir_out][op_pass] += len;
2304 if (ke != NULL && op_pass != PFR_OP_XPASS) {
2305 ke->pfrke_packets[dir_out][op_pass]++;
2306 ke->pfrke_bytes[dir_out][op_pass] += len;
2307 }
2308}
2309
2310struct pfr_ktable *
2311pfr_attach_table(struct pf_ruleset *rs, char *name)
2312{
0a7de745
A		 2313 struct pfr_ktable *kt, *rt;
2314 struct pfr_table tbl;
2315 struct pf_anchor *ac = rs->anchor;
b0d623f7 2316
5ba3f43e 2317 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7 2318
0a7de745
A		 2319 bzero(&tbl, sizeof(tbl));
2320 strlcpy(tbl.pfrt_name, name, sizeof(tbl.pfrt_name));
2321 if (ac != NULL) {
2322 strlcpy(tbl.pfrt_anchor, ac->path, sizeof(tbl.pfrt_anchor));
2323 }
b0d623f7
A		 2324 kt = pfr_lookup_table(&tbl);
2325 if (kt == NULL) {
d1ecb069 2326 kt = pfr_create_ktable(&tbl, pf_calendar_time_second(), 1);
0a7de745
A		 2327 if (kt == NULL) {
2328 return NULL;
2329 }
b0d623f7 2330 if (ac != NULL) {
0a7de745 2331 bzero(tbl.pfrt_anchor, sizeof(tbl.pfrt_anchor));
b0d623f7
A		 2332 rt = pfr_lookup_table(&tbl);
2333 if (rt == NULL) {
2334 rt = pfr_create_ktable(&tbl, 0, 1);
2335 if (rt == NULL) {
2336 pfr_destroy_ktable(kt, 0);
0a7de745 2337 return NULL;
b0d623f7
A		 2338 }
2339 pfr_insert_ktable(rt);
2340 }
2341 kt->pfrkt_root = rt;
2342 }
2343 pfr_insert_ktable(kt);
2344 }
0a7de745
A		 2345 if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++) {
2346 pfr_setflags_ktable(kt, kt->pfrkt_flags | PFR_TFLAG_REFERENCED);
2347 }
2348 return kt;
b0d623f7
A		 2349}
2350
2351void
2352pfr_detach_table(struct pfr_ktable *kt)
2353{
5ba3f43e 2354 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7 2355
0a7de745 2356 if (kt->pfrkt_refcnt[PFR_REFCNT_RULE] <= 0) {
b0d623f7
A		 2357 printf("pfr_detach_table: refcount = %d.\n",
2358 kt->pfrkt_refcnt[PFR_REFCNT_RULE]);
0a7de745
A		 2359 } else if (!--kt->pfrkt_refcnt[PFR_REFCNT_RULE]) {
2360 pfr_setflags_ktable(kt, kt->pfrkt_flags & ~PFR_TFLAG_REFERENCED);
2361 }
b0d623f7
A		 2362}
2363
2364int
2365pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter,
2366 struct pf_addr **raddr, struct pf_addr **rmask, sa_family_t af)
2367{
0a7de745
A		 2368 struct pfr_kentry *ke, *ke2;
2369 struct pf_addr *addr;
2370 union sockaddr_union mask;
2371 int idx = -1, use_counter = 0;
b0d623f7 2372
5ba3f43e 2373 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7 2374
0a7de745 2375 if (af == AF_INET) {
b0d623f7 2376 addr = (struct pf_addr *)&pfr_sin.sin_addr;
0a7de745 2377 } else if (af == AF_INET6) {
b0d623f7 2378 addr = (struct pf_addr *)&pfr_sin6.sin6_addr;
0a7de745
A		 2379 } else {
2380 return -1;
2381 }
b0d623f7 2382
0a7de745 2383 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) {
b0d623f7 2384 kt = kt->pfrkt_root;
0a7de745
A		 2385 }
2386 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
2387 return -1;
2388 }
b0d623f7 2389
0a7de745 2390 if (pidx != NULL) {
b0d623f7 2391 idx = *pidx;
0a7de745
A		 2392 }
2393 if (counter != NULL && idx >= 0) {
b0d623f7 2394 use_counter = 1;
0a7de745
A		 2395 }
2396 if (idx < 0) {
b0d623f7 2397 idx = 0;
0a7de745 2398 }
b0d623f7
A		 2399
2400_next_block:
2401 ke = pfr_kentry_byidx(kt, idx, af);
2402 if (ke == NULL) {
2403 kt->pfrkt_nomatch++;
0a7de745 2404 return 1;
b0d623f7
A		 2405 }
2406 pfr_prepare_network(&pfr_mask, af, ke->pfrke_net);
2407 *raddr = SUNION2PF(&ke->pfrke_sa, af);
2408 *rmask = SUNION2PF(&pfr_mask, af);
2409
2410 if (use_counter) {
2411 /* is supplied address within block? */
2412 if (!PF_MATCHA(0, *raddr, *rmask, counter, af)) {
2413 /* no, go to next block in table */
2414 idx++;
2415 use_counter = 0;
2416 goto _next_block;
2417 }
2418 PF_ACPY(addr, counter, af);
2419 } else {
2420 /* use first address of block */
2421 PF_ACPY(addr, *raddr, af);
2422 }
2423
2424 if (!KENTRY_NETWORK(ke)) {
2425 /* this is a single IP address - no possible nested block */
2426 PF_ACPY(counter, addr, af);
2427 *pidx = idx;
2428 kt->pfrkt_match++;
0a7de745 2429 return 0;
b0d623f7
A		 2430 }
2431 for (;;) {
2432 /* we don't want to use a nested block */
0a7de745 2433 if (af == AF_INET) {
b0d623f7
A		 2434 ke2 = (struct pfr_kentry *)rn_match(&pfr_sin,
2435 kt->pfrkt_ip4);
0a7de745 2436 } else if (af == AF_INET6) {
b0d623f7
A		 2437 ke2 = (struct pfr_kentry *)rn_match(&pfr_sin6,
2438 kt->pfrkt_ip6);
0a7de745
A		 2439 } else {
2440 return -1; /* never happens */
2441 }
b0d623f7
A		 2442 /* no need to check KENTRY_RNF_ROOT() here */
2443 if (ke2 == ke) {
2444 /* lookup return the same block - perfect */
2445 PF_ACPY(counter, addr, af);
2446 *pidx = idx;
2447 kt->pfrkt_match++;
0a7de745 2448 return 0;
b0d623f7
A		 2449 }
2450
2451 /* we need to increase the counter past the nested block */
2452 pfr_prepare_network(&mask, AF_INET, ke2->pfrke_net);
2453 PF_POOLMASK(addr, addr, SUNION2PF(&mask, af), &pfr_ffaddr, af);
2454 PF_AINC(addr, af);
2455 if (!PF_MATCHA(0, *raddr, *rmask, addr, af)) {
2456 /* ok, we reached the end of our main block */
2457 /* go to next block in table */
2458 idx++;
2459 use_counter = 0;
2460 goto _next_block;
2461 }
2462 }
2463}
2464
d1ecb069 2465static struct pfr_kentry *
b0d623f7
A		 2466pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af)
2467{
0a7de745 2468 struct pfr_walktree w;
b0d623f7 2469
5ba3f43e 2470 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7 2471
0a7de745 2472 bzero(&w, sizeof(w));
b0d623f7
A		 2473 w.pfrw_op = PFRW_POOL_GET;
2474 w.pfrw_cnt = idx;
2475
2476 switch (af) {
2477#if INET
2478 case AF_INET:
2479 (void) kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4,
2480 pfr_walktree, &w);
0a7de745 2481 return w.pfrw_kentry;
b0d623f7
A		 2482#endif /* INET */
2483#if INET6
2484 case AF_INET6:
2485 (void) kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6,
2486 pfr_walktree, &w);
0a7de745 2487 return w.pfrw_kentry;
b0d623f7
A		 2488#endif /* INET6 */
2489 default:
0a7de745 2490 return NULL;
b0d623f7
A		 2491 }
2492}
2493
2494void
2495pfr_dynaddr_update(struct pfr_ktable *kt, struct pfi_dynaddr *dyn)
2496{
0a7de745 2497 struct pfr_walktree w;
b0d623f7 2498
5ba3f43e 2499 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
b0d623f7 2500
0a7de745 2501 bzero(&w, sizeof(w));
b0d623f7
A		 2502 w.pfrw_op = PFRW_DYNADDR_UPDATE;
2503 w.pfrw_dyn = dyn;
2504
2505 dyn->pfid_acnt4 = 0;
2506 dyn->pfid_acnt6 = 0;
0a7de745 2507 if (!dyn->pfid_af || dyn->pfid_af == AF_INET) {
b0d623f7
A		 2508 (void) kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4,
2509 pfr_walktree, &w);
0a7de745
A		 2510 }
2511 if (!dyn->pfid_af || dyn->pfid_af == AF_INET6) {
b0d623f7
A		 2512 (void) kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6,
2513 pfr_walktree, &w);
0a7de745 2514 }
b0d623f7 2515}
mirror of XNU