-#define ACCEPT_FLAGS(flags, oklist) \
- do { \
- if ((flags & ~(oklist)) & \
- PFR_FLAG_ALLMASK) \
- return (EINVAL); \
+#define ACCEPT_FLAGS(flags, oklist) \
+ do { \
+ if ((flags & ~(oklist)) & \
+ PFR_FLAG_ALLMASK) \
+ return (EINVAL); \
-#define COPYIN(from, to, size, flags) \
- ((flags & PFR_FLAG_USERIOCTL) ? \
- copyin((from), (to), (size)) : \
+#define COPYIN(from, to, size, flags) \
+ ((flags & PFR_FLAG_USERIOCTL) ? \
+ copyin((from), (to), (size)) : \
(bcopy((void *)(uintptr_t)(from), (to), (size)), 0))
(bcopy((void *)(uintptr_t)(from), (to), (size)), 0))
-#define COPYOUT(from, to, size, flags) \
- ((flags & PFR_FLAG_USERIOCTL) ? \
- copyout((from), (to), (size)) : \
+#define COPYOUT(from, to, size, flags) \
+ ((flags & PFR_FLAG_USERIOCTL) ? \
+ copyout((from), (to), (size)) : \
(bcopy((from), (void *)(uintptr_t)(to), (size)), 0))
(bcopy((from), (void *)(uintptr_t)(to), (size)), 0))
-#define FILLIN_SIN(sin, addr) \
- do { \
- (sin).sin_len = sizeof (sin); \
- (sin).sin_family = AF_INET; \
- (sin).sin_addr = (addr); \
+#define FILLIN_SIN(sin, addr) \
+ do { \
+ (sin).sin_len = sizeof (sin); \
+ (sin).sin_family = AF_INET; \
+ (sin).sin_addr = (addr); \
-#define FILLIN_SIN6(sin6, addr) \
- do { \
- (sin6).sin6_len = sizeof (sin6); \
- (sin6).sin6_family = AF_INET6; \
- (sin6).sin6_addr = (addr); \
+#define FILLIN_SIN6(sin6, addr) \
+ do { \
+ (sin6).sin6_len = sizeof (sin6); \
+ (sin6).sin6_family = AF_INET6; \
+ (sin6).sin6_addr = (addr); \
-#define SUNION2PF(su, af) (((af) == AF_INET) ? \
- (struct pf_addr *)&(su)->sin.sin_addr : \
+#define SUNION2PF(su, af) (((af) == AF_INET) ? \
+ (struct pf_addr *)&(su)->sin.sin_addr : \
-#define AF_BITS(af) (((af) == AF_INET) ? 32 : 128)
-#define ADDR_NETWORK(ad) ((ad)->pfra_net < AF_BITS((ad)->pfra_af))
-#define KENTRY_NETWORK(ke) ((ke)->pfrke_net < AF_BITS((ke)->pfrke_af))
+#define AF_BITS(af) (((af) == AF_INET) ? 32 : 128)
+#define ADDR_NETWORK(ad) ((ad)->pfra_net < AF_BITS((ad)->pfra_af))
+#define KENTRY_NETWORK(ke) ((ke)->pfrke_net < AF_BITS((ke)->pfrke_af))
-#define NO_ADDRESSES (-1)
-#define ENQUEUE_UNMARKED_ONLY (1)
-#define INVERT_NEG_FLAG (1)
+#define NO_ADDRESSES (-1)
+#define ENQUEUE_UNMARKED_ONLY (1)
+#define INVERT_NEG_FLAG (1)
- user_addr_t pfrw1_addr;
- user_addr_t pfrw1_astats;
- struct pfr_kentryworkq *pfrw1_workq;
- struct pfr_kentry *pfrw1_kentry;
- struct pfi_dynaddr *pfrw1_dyn;
- } pfrw_1;
- int pfrw_free;
- int pfrw_flags;
+ user_addr_t pfrw1_addr;
+ user_addr_t pfrw1_astats;
+ struct pfr_kentryworkq *pfrw1_workq;
+ struct pfr_kentry *pfrw1_kentry;
+ struct pfi_dynaddr *pfrw1_dyn;
+ } pfrw_1;
+ int pfrw_free;
+ int pfrw_flags;
-#define pfrw_addr pfrw_1.pfrw1_addr
-#define pfrw_astats pfrw_1.pfrw1_astats
-#define pfrw_workq pfrw_1.pfrw1_workq
-#define pfrw_kentry pfrw_1.pfrw1_kentry
-#define pfrw_dyn pfrw_1.pfrw1_dyn
-#define pfrw_cnt pfrw_free
+#define pfrw_addr pfrw_1.pfrw1_addr
+#define pfrw_astats pfrw_1.pfrw1_astats
+#define pfrw_workq pfrw_1.pfrw1_workq
+#define pfrw_kentry pfrw_1.pfrw1_kentry
+#define pfrw_dyn pfrw_1.pfrw1_dyn
+#define pfrw_cnt pfrw_free
-static struct pool pfr_kentry_pl2;
-static struct sockaddr_in pfr_sin;
-static struct sockaddr_in6 pfr_sin6;
-static union sockaddr_union pfr_mask;
-static struct pf_addr pfr_ffaddr;
+static struct pool pfr_kentry_pl2;
+static struct sockaddr_in pfr_sin;
+static struct sockaddr_in6 pfr_sin6;
+static union sockaddr_union pfr_mask;
+static struct pf_addr pfr_ffaddr;
static void pfr_copyout_addr(struct pfr_addr *, struct pfr_kentry *ke);
static int pfr_validate_addr(struct pfr_addr *);
static void pfr_copyout_addr(struct pfr_addr *, struct pfr_kentry *ke);
static int pfr_validate_addr(struct pfr_addr *);
static void pfr_mark_addrs(struct pfr_ktable *);
static struct pfr_kentry *pfr_lookup_addr(struct pfr_ktable *,
struct pfr_addr *, int);
static void pfr_mark_addrs(struct pfr_ktable *);
static struct pfr_kentry *pfr_lookup_addr(struct pfr_ktable *,
struct pfr_addr *, int);
static void pfr_destroy_kentries(struct pfr_kentryworkq *);
static void pfr_destroy_kentry(struct pfr_kentry *);
static void pfr_insert_kentries(struct pfr_ktable *,
static void pfr_destroy_kentries(struct pfr_kentryworkq *);
static void pfr_destroy_kentry(struct pfr_kentry *);
static void pfr_insert_kentries(struct pfr_ktable *,
pfr_ktable_compare);
RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
pfr_ktable_compare);
RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
-static struct pfr_ktablehead pfr_ktables;
-static struct pfr_table pfr_nulltable;
-static int pfr_ktable_cnt;
+static struct pfr_ktablehead pfr_ktables;
+static struct pfr_table pfr_nulltable;
+static int pfr_ktable_cnt;
- pool_init(&pfr_ktable_pl, sizeof (struct pfr_ktable), 0, 0, 0,
+ pool_init(&pfr_ktable_pl, sizeof(struct pfr_ktable), 0, 0, 0,
- pool_init(&pfr_kentry_pl, sizeof (struct pfr_kentry), 0, 0, 0,
+ pool_init(&pfr_kentry_pl, sizeof(struct pfr_kentry), 0, 0, 0,
- pool_init(&pfr_kentry_pl2, sizeof (struct pfr_kentry), 0, 0, 0,
+ pool_init(&pfr_kentry_pl2, sizeof(struct pfr_kentry), 0, 0, 0,
- if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
- return (ESRCH);
- if (kt->pfrkt_flags & PFR_TFLAG_CONST)
- return (EPERM);
+ if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
+ return ESRCH;
+ }
+ if (kt->pfrkt_flags & PFR_TFLAG_CONST) {
+ return EPERM;
+ }
pfr_enqueue_addrs(kt, &workq, ndel, 0);
if (!(flags & PFR_FLAG_DUMMY)) {
pfr_enqueue_addrs(kt, &workq, ndel, 0);
if (!(flags & PFR_FLAG_DUMMY)) {
}
int
pfr_add_addrs(struct pfr_table *tbl, user_addr_t _addr, int size,
int *nadd, int flags)
{
}
int
pfr_add_addrs(struct pfr_table *tbl, user_addr_t _addr, int size,
int *nadd, int flags)
{
- struct pfr_ktable *kt, *tmpkt;
- struct pfr_kentryworkq workq;
- struct pfr_kentry *p, *q;
- struct pfr_addr ad;
- int i, rv, xadd = 0;
- user_addr_t addr = _addr;
- u_int64_t tzero = pf_calendar_time_second();
+ struct pfr_ktable *kt, *tmpkt;
+ struct pfr_kentryworkq workq;
+ struct pfr_kentry *p, *q;
+ struct pfr_addr ad;
+ int i, rv, xadd = 0;
+ user_addr_t addr = _addr;
+ u_int64_t tzero = pf_calendar_time_second();
- if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
- return (ESRCH);
- if (kt->pfrkt_flags & PFR_TFLAG_CONST)
- return (EPERM);
+ if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
+ return ESRCH;
+ }
+ if (kt->pfrkt_flags & PFR_TFLAG_CONST) {
+ return EPERM;
+ }
- for (i = 0; i < size; i++, addr += sizeof (ad)) {
- if (COPYIN(addr, &ad, sizeof (ad), flags))
+ for (i = 0; i < size; i++, addr += sizeof(ad)) {
+ if (COPYIN(addr, &ad, sizeof(ad), flags)) {
p = pfr_lookup_addr(kt, &ad, 1);
q = pfr_lookup_addr(tmpkt, &ad, 1);
if (flags & PFR_FLAG_FEEDBACK) {
p = pfr_lookup_addr(kt, &ad, 1);
q = pfr_lookup_addr(tmpkt, &ad, 1);
if (flags & PFR_FLAG_FEEDBACK) {
}
if (p == NULL && q == NULL) {
p = pfr_create_kentry(&ad,
!(flags & PFR_FLAG_USERIOCTL));
}
if (p == NULL && q == NULL) {
p = pfr_create_kentry(&ad,
!(flags & PFR_FLAG_USERIOCTL));
if (pfr_route_kentry(tmpkt, p)) {
pfr_destroy_kentry(p);
ad.pfra_fback = PFR_FB_NONE;
if (pfr_route_kentry(tmpkt, p)) {
pfr_destroy_kentry(p);
ad.pfra_fback = PFR_FB_NONE;
- if (flags & PFR_FLAG_FEEDBACK)
- if (COPYOUT(&ad, addr, sizeof (ad), flags))
+ if (flags & PFR_FLAG_FEEDBACK) {
+ if (COPYOUT(&ad, addr, sizeof(ad), flags)) {
}
pfr_clean_node_mask(tmpkt, &workq);
if (!(flags & PFR_FLAG_DUMMY)) {
pfr_insert_kentries(kt, &workq, tzero);
}
pfr_clean_node_mask(tmpkt, &workq);
if (!(flags & PFR_FLAG_DUMMY)) {
pfr_insert_kentries(kt, &workq, tzero);
_bad:
pfr_clean_node_mask(tmpkt, &workq);
pfr_destroy_kentries(&workq);
_bad:
pfr_clean_node_mask(tmpkt, &workq);
pfr_destroy_kentries(&workq);
}
int
pfr_del_addrs(struct pfr_table *tbl, user_addr_t _addr, int size,
int *ndel, int flags)
{
}
int
pfr_del_addrs(struct pfr_table *tbl, user_addr_t _addr, int size,
int *ndel, int flags)
{
- struct pfr_ktable *kt;
- struct pfr_kentryworkq workq;
- struct pfr_kentry *p;
- struct pfr_addr ad;
- user_addr_t addr = _addr;
- int i, rv, xdel = 0, log = 1;
+ struct pfr_ktable *kt;
+ struct pfr_kentryworkq workq;
+ struct pfr_kentry *p;
+ struct pfr_addr ad;
+ user_addr_t addr = _addr;
+ int i, rv, xdel = 0, log = 1;
- if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
- return (ESRCH);
- if (kt->pfrkt_flags & PFR_TFLAG_CONST)
- return (EPERM);
+ if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
+ return ESRCH;
+ }
+ if (kt->pfrkt_flags & PFR_TFLAG_CONST) {
+ return EPERM;
+ }
- for (i = 0; i < size; i++, addr += sizeof (ad)) {
- if (COPYIN(addr, &ad, sizeof (ad), flags))
- return (EFAULT);
- if (pfr_validate_addr(&ad))
- return (EINVAL);
+ for (i = 0; i < size; i++, addr += sizeof(ad)) {
+ if (COPYIN(addr, &ad, sizeof(ad), flags)) {
+ return EFAULT;
+ }
+ if (pfr_validate_addr(&ad)) {
+ return EINVAL;
+ }
- for (addr = _addr, i = 0; i < size; i++, addr += sizeof (ad)) {
- if (COPYIN(addr, &ad, sizeof (ad), flags))
+ for (addr = _addr, i = 0; i < size; i++, addr += sizeof(ad)) {
+ if (COPYIN(addr, &ad, sizeof(ad), flags)) {
p = pfr_lookup_addr(kt, &ad, 1);
if (flags & PFR_FLAG_FEEDBACK) {
p = pfr_lookup_addr(kt, &ad, 1);
if (flags & PFR_FLAG_FEEDBACK) {
- if (flags & PFR_FLAG_FEEDBACK)
- if (COPYOUT(&ad, addr, sizeof (ad), flags))
+ if (flags & PFR_FLAG_FEEDBACK) {
+ if (COPYOUT(&ad, addr, sizeof(ad), flags)) {
}
if (!(flags & PFR_FLAG_DUMMY)) {
pfr_remove_kentries(kt, &workq);
}
}
if (!(flags & PFR_FLAG_DUMMY)) {
pfr_remove_kentries(kt, &workq);
}
int *size2, int *nadd, int *ndel, int *nchange, int flags,
u_int32_t ignore_pfrt_flags)
{
int *size2, int *nadd, int *ndel, int *nchange, int flags,
u_int32_t ignore_pfrt_flags)
{
- struct pfr_ktable *kt, *tmpkt;
- struct pfr_kentryworkq addq, delq, changeq;
- struct pfr_kentry *p, *q;
- struct pfr_addr ad;
- user_addr_t addr = _addr;
- int i, rv, xadd = 0, xdel = 0, xchange = 0;
- u_int64_t tzero = pf_calendar_time_second();
+ struct pfr_ktable *kt, *tmpkt;
+ struct pfr_kentryworkq addq, delq, changeq;
+ struct pfr_kentry *p, *q;
+ struct pfr_addr ad;
+ user_addr_t addr = _addr;
+ int i, rv, xadd = 0, xdel = 0, xchange = 0;
+ u_int64_t tzero = pf_calendar_time_second();
ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
PFR_FLAG_FEEDBACK);
if (pfr_validate_table(tbl, ignore_pfrt_flags, flags &
ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
PFR_FLAG_FEEDBACK);
if (pfr_validate_table(tbl, ignore_pfrt_flags, flags &
- if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
- return (ESRCH);
- if (kt->pfrkt_flags & PFR_TFLAG_CONST)
- return (EPERM);
+ if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
+ return ESRCH;
+ }
+ if (kt->pfrkt_flags & PFR_TFLAG_CONST) {
+ return EPERM;
+ }
- for (i = 0; i < size; i++, addr += sizeof (ad)) {
- if (COPYIN(addr, &ad, sizeof (ad), flags))
+ for (i = 0; i < size; i++, addr += sizeof(ad)) {
+ if (COPYIN(addr, &ad, sizeof(ad), flags)) {
ad.pfra_fback = PFR_FB_NONE;
p = pfr_lookup_addr(kt, &ad, 1);
if (p != NULL) {
ad.pfra_fback = PFR_FB_NONE;
p = pfr_lookup_addr(kt, &ad, 1);
if (p != NULL) {
}
p = pfr_create_kentry(&ad,
!(flags & PFR_FLAG_USERIOCTL));
}
p = pfr_create_kentry(&ad,
!(flags & PFR_FLAG_USERIOCTL));
if (pfr_route_kentry(tmpkt, p)) {
pfr_destroy_kentry(p);
ad.pfra_fback = PFR_FB_NONE;
if (pfr_route_kentry(tmpkt, p)) {
pfr_destroy_kentry(p);
ad.pfra_fback = PFR_FB_NONE;
- if (flags & PFR_FLAG_FEEDBACK)
- if (COPYOUT(&ad, addr, sizeof (ad), flags))
+ if (flags & PFR_FLAG_FEEDBACK) {
+ if (COPYOUT(&ad, addr, sizeof(ad), flags)) {
}
pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY);
if ((flags & PFR_FLAG_FEEDBACK) && *size2) {
}
pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY);
if ((flags & PFR_FLAG_FEEDBACK) && *size2) {
SLIST_FOREACH(p, &delq, pfrke_workq) {
pfr_copyout_addr(&ad, p);
ad.pfra_fback = PFR_FB_DELETED;
SLIST_FOREACH(p, &delq, pfrke_workq) {
pfr_copyout_addr(&ad, p);
ad.pfra_fback = PFR_FB_DELETED;
- if (COPYOUT(&ad, addr, sizeof (ad), flags))
+ if (COPYOUT(&ad, addr, sizeof(ad), flags)) {
pfr_insert_kentries(kt, &addq, tzero);
pfr_remove_kentries(kt, &delq);
pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
pfr_insert_kentries(kt, &addq, tzero);
pfr_remove_kentries(kt, &delq);
pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
_bad:
pfr_clean_node_mask(tmpkt, &addq);
pfr_destroy_kentries(&addq);
_bad:
pfr_clean_node_mask(tmpkt, &addq);
pfr_destroy_kentries(&addq);
}
int
pfr_tst_addrs(struct pfr_table *tbl, user_addr_t addr, int size,
}
int
pfr_tst_addrs(struct pfr_table *tbl, user_addr_t addr, int size,
- if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
- return (ESRCH);
-
- for (i = 0; i < size; i++, addr += sizeof (ad)) {
- if (COPYIN(addr, &ad, sizeof (ad), flags))
- return (EFAULT);
- if (pfr_validate_addr(&ad))
- return (EINVAL);
- if (ADDR_NETWORK(&ad))
- return (EINVAL);
+ if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
+ return ESRCH;
+ }
+
+ for (i = 0; i < size; i++, addr += sizeof(ad)) {
+ if (COPYIN(addr, &ad, sizeof(ad), flags)) {
+ return EFAULT;
+ }
+ if (pfr_validate_addr(&ad)) {
+ return EINVAL;
+ }
+ if (ADDR_NETWORK(&ad)) {
+ return EINVAL;
+ }
- if (COPYOUT(&ad, addr, sizeof (ad), flags))
- return (EFAULT);
+ }
+ if (COPYOUT(&ad, addr, sizeof(ad), flags)) {
+ return EFAULT;
+ }
}
int
pfr_get_addrs(struct pfr_table *tbl, user_addr_t addr, int *size,
}
int
pfr_get_addrs(struct pfr_table *tbl, user_addr_t addr, int *size,
w.pfrw_op = PFRW_GET_ADDRS;
w.pfrw_addr = addr;
w.pfrw_free = kt->pfrkt_cnt;
w.pfrw_flags = flags;
rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
w.pfrw_op = PFRW_GET_ADDRS;
w.pfrw_addr = addr;
w.pfrw_free = kt->pfrkt_cnt;
w.pfrw_flags = flags;
rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
}
int
pfr_get_astats(struct pfr_table *tbl, user_addr_t addr, int *size,
}
int
pfr_get_astats(struct pfr_table *tbl, user_addr_t addr, int *size,
/* XXX PFR_FLAG_CLSTATS disabled */
ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC);
/* XXX PFR_FLAG_CLSTATS disabled */
ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC);
w.pfrw_op = PFRW_GET_ASTATS;
w.pfrw_astats = addr;
w.pfrw_free = kt->pfrkt_cnt;
w.pfrw_flags = flags;
rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
w.pfrw_op = PFRW_GET_ASTATS;
w.pfrw_astats = addr;
w.pfrw_free = kt->pfrkt_cnt;
w.pfrw_flags = flags;
rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
if (!rv && (flags & PFR_FLAG_CLSTATS)) {
pfr_enqueue_addrs(kt, &workq, NULL, 0);
pfr_clstats_kentries(&workq, tzero, 0);
}
if (!rv && (flags & PFR_FLAG_CLSTATS)) {
pfr_enqueue_addrs(kt, &workq, NULL, 0);
pfr_clstats_kentries(&workq, tzero, 0);
}
}
int
pfr_clr_astats(struct pfr_table *tbl, user_addr_t _addr, int size,
int *nzero, int flags)
{
}
int
pfr_clr_astats(struct pfr_table *tbl, user_addr_t _addr, int size,
int *nzero, int flags)
{
- for (i = 0; i < size; i++, addr += sizeof (ad)) {
- if (COPYIN(addr, &ad, sizeof (ad), flags))
+ for (i = 0; i < size; i++, addr += sizeof(ad)) {
+ if (COPYIN(addr, &ad, sizeof(ad), flags)) {
p = pfr_lookup_addr(kt, &ad, 1);
if (flags & PFR_FLAG_FEEDBACK) {
ad.pfra_fback = (p != NULL) ?
PFR_FB_CLEARED : PFR_FB_NONE;
p = pfr_lookup_addr(kt, &ad, 1);
if (flags & PFR_FLAG_FEEDBACK) {
ad.pfra_fback = (p != NULL) ?
PFR_FB_CLEARED : PFR_FB_NONE;
- if (COPYOUT(&ad, addr, sizeof (ad), flags))
+ if (COPYOUT(&ad, addr, sizeof(ad), flags)) {
if (!(flags & PFR_FLAG_DUMMY)) {
pfr_clstats_kentries(&workq, 0, 0);
}
if (!(flags & PFR_FLAG_DUMMY)) {
pfr_clstats_kentries(&workq, 0, 0);
}
- (((caddr_t)ad)[ad->pfra_net/8] & (0xFF >> (ad->pfra_net%8))))
- return (-1);
- for (i = (ad->pfra_net+7)/8; i < (int)sizeof (ad->pfra_u); i++)
- if (((caddr_t)ad)[i])
- return (-1);
- if (ad->pfra_not && ad->pfra_not != 1)
- return (-1);
- if (ad->pfra_fback)
- return (-1);
- return (0);
+ (((caddr_t)ad)[ad->pfra_net / 8] & (0xFF >> (ad->pfra_net % 8)))) {
+ return -1;
+ }
+ for (i = (ad->pfra_net + 7) / 8; i < (int)sizeof(ad->pfra_u); i++) {
+ if (((caddr_t)ad)[i]) {
+ return -1;
+ }
+ }
+ if (ad->pfra_not && ad->pfra_not != 1) {
+ return -1;
+ }
+ if (ad->pfra_fback) {
+ return -1;
+ }
+ return 0;
}
static struct pfr_kentry *
pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact)
{
}
static struct pfr_kentry *
pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact)
{
- union sockaddr_union sa, mask;
- struct radix_node_head *head;
- struct pfr_kentry *ke;
+ union sockaddr_union sa, mask;
+ struct radix_node_head *head;
+ struct pfr_kentry *ke;
if (ad->pfra_af == AF_INET) {
FILLIN_SIN(sa.sin, ad->pfra_ip4addr);
head = kt->pfrkt_ip4;
} else if (ad->pfra_af == AF_INET6) {
FILLIN_SIN6(sa.sin6, ad->pfra_ip6addr);
head = kt->pfrkt_ip6;
if (ad->pfra_af == AF_INET) {
FILLIN_SIN(sa.sin, ad->pfra_ip4addr);
head = kt->pfrkt_ip4;
} else if (ad->pfra_af == AF_INET6) {
FILLIN_SIN6(sa.sin6, ad->pfra_ip6addr);
head = kt->pfrkt_ip6;
if (ADDR_NETWORK(ad)) {
pfr_prepare_network(&mask, ad->pfra_af, ad->pfra_net);
ke = (struct pfr_kentry *)rn_lookup(&sa, &mask, head);
if (ADDR_NETWORK(ad)) {
pfr_prepare_network(&mask, ad->pfra_af, ad->pfra_net);
ke = (struct pfr_kentry *)rn_lookup(&sa, &mask, head);
ke->pfrke_af = ad->pfra_af;
ke->pfrke_net = ad->pfra_net;
ke->pfrke_not = ad->pfra_not;
ke->pfrke_af = ad->pfra_af;
ke->pfrke_net = ad->pfra_net;
ke->pfrke_not = ad->pfra_not;
for (p = SLIST_FIRST(workq); p != NULL; p = q) {
q = SLIST_NEXT(p, pfrke_workq);
for (p = SLIST_FIRST(workq); p != NULL; p = q) {
q = SLIST_NEXT(p, pfrke_workq);
}
static void
pfr_insert_kentries(struct pfr_ktable *kt,
struct pfr_kentryworkq *workq, u_int64_t tzero)
{
}
static void
pfr_insert_kentries(struct pfr_ktable *kt,
struct pfr_kentryworkq *workq, u_int64_t tzero)
{
SLIST_FOREACH(p, workq, pfrke_workq) {
rv = pfr_route_kentry(kt, p);
SLIST_FOREACH(p, workq, pfrke_workq) {
rv = pfr_route_kentry(kt, p);
}
static void
pfr_remove_kentries(struct pfr_ktable *kt,
struct pfr_kentryworkq *workq)
{
}
static void
pfr_remove_kentries(struct pfr_ktable *kt,
struct pfr_kentryworkq *workq)
{
SLIST_FOREACH(p, workq, pfrke_workq) {
pfr_unroute_kentry(kt, p);
SLIST_FOREACH(p, workq, pfrke_workq) {
pfr_unroute_kentry(kt, p);
pfr_clean_node_mask(struct pfr_ktable *kt,
struct pfr_kentryworkq *workq)
{
pfr_clean_node_mask(struct pfr_ktable *kt,
struct pfr_kentryworkq *workq)
{
- bzero(p->pfrke_packets, sizeof (p->pfrke_packets));
- bzero(p->pfrke_bytes, sizeof (p->pfrke_bytes));
+ }
+ bzero(p->pfrke_packets, sizeof(p->pfrke_packets));
+ bzero(p->pfrke_bytes, sizeof(p->pfrke_bytes));
- for (i = 0; i < size; i++, addr += sizeof (ad)) {
- if (COPYIN(addr, &ad, sizeof (ad), flags))
+ for (i = 0; i < size; i++, addr += sizeof(ad)) {
+ if (COPYIN(addr, &ad, sizeof(ad), flags)) {
- if (COPYOUT(&ad, addr, sizeof (ad), flags))
+ if (COPYOUT(&ad, addr, sizeof(ad), flags)) {
sa->sin6.sin6_family = AF_INET6;
for (i = 0; i < 4; i++) {
if (net <= 32) {
sa->sin6.sin6_addr.s6_addr32[i] =
sa->sin6.sin6_family = AF_INET6;
for (i = 0; i < 4; i++) {
if (net <= 32) {
sa->sin6.sin6_addr.s6_addr32[i] =
- bzero(ke->pfrke_node, sizeof (ke->pfrke_node));
- if (ke->pfrke_af == AF_INET)
+ bzero(ke->pfrke_node, sizeof(ke->pfrke_node));
+ if (ke->pfrke_af == AF_INET) {
if (KENTRY_NETWORK(ke)) {
pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
rn = rn_addroute(&ke->pfrke_sa, &mask, head, ke->pfrke_node);
if (KENTRY_NETWORK(ke)) {
pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
rn = rn_addroute(&ke->pfrke_sa, &mask, head, ke->pfrke_node);
rn = rn_addroute(&ke->pfrke_sa, NULL, head, ke->pfrke_node);
rn = rn_addroute(&ke->pfrke_sa, NULL, head, ke->pfrke_node);
if (KENTRY_NETWORK(ke)) {
pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
rn = rn_delete(&ke->pfrke_sa, &mask, head);
if (KENTRY_NETWORK(ke)) {
pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
rn = rn_delete(&ke->pfrke_sa, &mask, head);
ad->pfra_af = ke->pfrke_af;
ad->pfra_net = ke->pfrke_net;
ad->pfra_not = ke->pfrke_not;
ad->pfra_af = ke->pfrke_af;
ad->pfra_net = ke->pfrke_net;
ad->pfra_not = ke->pfrke_not;
- struct pfr_kentry *ke = (struct pfr_kentry *)rn;
- struct pfr_walktree *w = arg;
- int flags = w->pfrw_flags;
+ struct pfr_kentry *ke = (struct pfr_kentry *)rn;
+ struct pfr_walktree *w = arg;
+ int flags = w->pfrw_flags;
- if (copyout(&ad, w->pfrw_addr, sizeof (ad)))
- return (EFAULT);
- w->pfrw_addr += sizeof (ad);
+ if (copyout(&ad, w->pfrw_addr, sizeof(ad))) {
+ return EFAULT;
+ }
+ w->pfrw_addr += sizeof(ad);
- if (COPYOUT(&as, w->pfrw_astats, sizeof (as), flags))
- return (EFAULT);
- w->pfrw_astats += sizeof (as);
+ if (COPYOUT(&as, w->pfrw_astats, sizeof(as), flags)) {
+ return EFAULT;
+ }
+ w->pfrw_astats += sizeof(as);
pfr_prepare_network(&pfr_mask, AF_INET, ke->pfrke_net);
w->pfrw_dyn->pfid_addr4 = *SUNION2PF(
pfr_prepare_network(&pfr_mask, AF_INET, ke->pfrke_net);
w->pfrw_dyn->pfid_addr4 = *SUNION2PF(
pfr_prepare_network(&pfr_mask, AF_INET6, ke->pfrke_net);
w->pfrw_dyn->pfid_addr6 = *SUNION2PF(
pfr_prepare_network(&pfr_mask, AF_INET6, ke->pfrke_net);
w->pfrw_dyn->pfid_addr6 = *SUNION2PF(
- if (pfr_fix_anchor(filter->pfrt_anchor))
- return (EINVAL);
- if (pfr_table_count(filter, flags) < 0)
- return (ENOENT);
+ if (pfr_fix_anchor(filter->pfrt_anchor)) {
+ return EINVAL;
+ }
+ if (pfr_table_count(filter, flags) < 0) {
+ return ENOENT;
+ }
p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
xdel++;
p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
xdel++;
}
int
pfr_add_tables(user_addr_t tbl, int size, int *nadd, int flags)
{
}
int
pfr_add_tables(user_addr_t tbl, int size, int *nadd, int flags)
{
- struct pfr_ktableworkq addq, changeq;
- struct pfr_ktable *p, *q, *r, key;
- int i, rv, xadd = 0;
- u_int64_t tzero = pf_calendar_time_second();
+ struct pfr_ktableworkq addq, changeq;
+ struct pfr_ktable *p, *q, *r, key;
+ int i, rv, xadd = 0;
+ u_int64_t tzero = pf_calendar_time_second();
- for (i = 0; i < size; i++, tbl += sizeof (key.pfrkt_t)) {
- if (COPYIN(tbl, &key.pfrkt_t, sizeof (key.pfrkt_t), flags))
+ for (i = 0; i < size; i++, tbl += sizeof(key.pfrkt_t)) {
+ if (COPYIN(tbl, &key.pfrkt_t, sizeof(key.pfrkt_t), flags)) {
pfr_table_copyin_cleanup(&key.pfrkt_t);
if (pfr_validate_table(&key.pfrkt_t, PFR_TFLAG_USRMASK,
pfr_table_copyin_cleanup(&key.pfrkt_t);
if (pfr_validate_table(&key.pfrkt_t, PFR_TFLAG_USRMASK,
key.pfrkt_flags |= PFR_TFLAG_ACTIVE;
p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
if (p == NULL) {
p = pfr_create_ktable(&key.pfrkt_t, tzero, 1);
key.pfrkt_flags |= PFR_TFLAG_ACTIVE;
p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
if (p == NULL) {
p = pfr_create_ktable(&key.pfrkt_t, tzero, 1);
SLIST_INSERT_HEAD(&addq, r, pfrkt_workq);
p->pfrkt_root = r;
} else if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
SLIST_FOREACH(q, &changeq, pfrkt_workq)
SLIST_INSERT_HEAD(&addq, r, pfrkt_workq);
p->pfrkt_root = r;
} else if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
SLIST_FOREACH(q, &changeq, pfrkt_workq)
p->pfrkt_nflags = (p->pfrkt_flags &
~PFR_TFLAG_USRMASK) | key.pfrkt_flags;
SLIST_INSERT_HEAD(&changeq, p, pfrkt_workq);
xadd++;
}
_skip:
p->pfrkt_nflags = (p->pfrkt_flags &
~PFR_TFLAG_USRMASK) | key.pfrkt_flags;
SLIST_INSERT_HEAD(&changeq, p, pfrkt_workq);
xadd++;
}
_skip:
}
if (!(flags & PFR_FLAG_DUMMY)) {
pfr_insert_ktables(&addq);
pfr_setflags_ktables(&changeq);
}
if (!(flags & PFR_FLAG_DUMMY)) {
pfr_insert_ktables(&addq);
pfr_setflags_ktables(&changeq);
}
int
pfr_del_tables(user_addr_t tbl, int size, int *ndel, int flags)
{
}
int
pfr_del_tables(user_addr_t tbl, int size, int *ndel, int flags)
{
- struct pfr_ktableworkq workq;
- struct pfr_ktable *p, *q, key;
- int i, xdel = 0;
+ struct pfr_ktableworkq workq;
+ struct pfr_ktable *p, *q, key;
+ int i, xdel = 0;
- for (i = 0; i < size; i++, tbl += sizeof (key.pfrkt_t)) {
- if (COPYIN(tbl, &key.pfrkt_t, sizeof (key.pfrkt_t), flags))
- return (EFAULT);
+ for (i = 0; i < size; i++, tbl += sizeof(key.pfrkt_t)) {
+ if (COPYIN(tbl, &key.pfrkt_t, sizeof(key.pfrkt_t), flags)) {
+ return EFAULT;
+ }
pfr_table_copyin_cleanup(&key.pfrkt_t);
if (pfr_validate_table(&key.pfrkt_t, 0,
pfr_table_copyin_cleanup(&key.pfrkt_t);
if (pfr_validate_table(&key.pfrkt_t, 0,
p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
SLIST_FOREACH(q, &workq, pfrkt_workq)
p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
SLIST_FOREACH(q, &workq, pfrkt_workq)
p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
xdel++;
}
_skip:
p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
xdel++;
}
_skip:
}
int
pfr_get_tables(struct pfr_table *filter, user_addr_t tbl, int *size,
}
int
pfr_get_tables(struct pfr_table *filter, user_addr_t tbl, int *size,
- if (COPYOUT(&p->pfrkt_t, tbl, sizeof (p->pfrkt_t), flags))
- return (EFAULT);
- tbl += sizeof (p->pfrkt_t);
+ }
+ if (COPYOUT(&p->pfrkt_t, tbl, sizeof(p->pfrkt_t), flags)) {
+ return EFAULT;
+ }
+ tbl += sizeof(p->pfrkt_t);
}
int
pfr_get_tstats(struct pfr_table *filter, user_addr_t tbl, int *size,
}
int
pfr_get_tstats(struct pfr_table *filter, user_addr_t tbl, int *size,
/* XXX PFR_FLAG_CLSTATS disabled */
ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_ALLRSETS);
/* XXX PFR_FLAG_CLSTATS disabled */
ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_ALLRSETS);
- tbl += sizeof (p->pfrkt_ts);
+ if (COPYOUT(&p->pfrkt_ts, tbl, sizeof(p->pfrkt_ts), flags)) {
+ return EFAULT;
+ }
+ tbl += sizeof(p->pfrkt_ts);
pfr_clstats_ktables(&workq, tzero,
flags & PFR_FLAG_ADDRSTOO);
pfr_clstats_ktables(&workq, tzero,
flags & PFR_FLAG_ADDRSTOO);
}
int
pfr_clr_tstats(user_addr_t tbl, int size, int *nzero, int flags)
{
}
int
pfr_clr_tstats(user_addr_t tbl, int size, int *nzero, int flags)
{
- struct pfr_ktableworkq workq;
- struct pfr_ktable *p, key;
- int i, xzero = 0;
- u_int64_t tzero = pf_calendar_time_second();
+ struct pfr_ktableworkq workq;
+ struct pfr_ktable *p, key;
+ int i, xzero = 0;
+ u_int64_t tzero = pf_calendar_time_second();
- for (i = 0; i < size; i++, tbl += sizeof (key.pfrkt_t)) {
- if (COPYIN(tbl, &key.pfrkt_t, sizeof (key.pfrkt_t), flags))
- return (EFAULT);
+ for (i = 0; i < size; i++, tbl += sizeof(key.pfrkt_t)) {
+ if (COPYIN(tbl, &key.pfrkt_t, sizeof(key.pfrkt_t), flags)) {
+ return EFAULT;
+ }
p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
if (p != NULL) {
SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
if (p != NULL) {
SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
if (!(flags & PFR_FLAG_DUMMY)) {
pfr_clstats_ktables(&workq, tzero, flags & PFR_FLAG_ADDRSTOO);
}
if (!(flags & PFR_FLAG_DUMMY)) {
pfr_clstats_ktables(&workq, tzero, flags & PFR_FLAG_ADDRSTOO);
}
}
int
pfr_set_tflags(user_addr_t tbl, int size, int setflag, int clrflag,
}
int
pfr_set_tflags(user_addr_t tbl, int size, int setflag, int clrflag,
- struct pfr_ktableworkq workq;
- struct pfr_ktable *p, *q, key;
- int i, xchange = 0, xdel = 0;
+ struct pfr_ktableworkq workq;
+ struct pfr_ktable *p, *q, key;
+ int i, xchange = 0, xdel = 0;
ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
if ((setflag & ~PFR_TFLAG_USRMASK) ||
(clrflag & ~PFR_TFLAG_USRMASK) ||
ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
if ((setflag & ~PFR_TFLAG_USRMASK) ||
(clrflag & ~PFR_TFLAG_USRMASK) ||
- for (i = 0; i < size; i++, tbl += sizeof (key.pfrkt_t)) {
- if (COPYIN(tbl, &key.pfrkt_t, sizeof (key.pfrkt_t), flags))
- return (EFAULT);
+ for (i = 0; i < size; i++, tbl += sizeof(key.pfrkt_t)) {
+ if (COPYIN(tbl, &key.pfrkt_t, sizeof(key.pfrkt_t), flags)) {
+ return EFAULT;
+ }
pfr_table_copyin_cleanup(&key.pfrkt_t);
if (pfr_validate_table(&key.pfrkt_t, 0,
pfr_table_copyin_cleanup(&key.pfrkt_t);
if (pfr_validate_table(&key.pfrkt_t, 0,
p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
p->pfrkt_nflags = (p->pfrkt_flags | setflag) &
~clrflag;
p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
p->pfrkt_nflags = (p->pfrkt_flags | setflag) &
~clrflag;
SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
if ((p->pfrkt_flags & PFR_TFLAG_PERSIST) &&
(clrflag & PFR_TFLAG_PERSIST) &&
SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
if ((p->pfrkt_flags & PFR_TFLAG_PERSIST) &&
(clrflag & PFR_TFLAG_PERSIST) &&
}
int
pfr_ina_begin(struct pfr_table *trs, u_int32_t *ticket, int *ndel, int flags)
{
}
int
pfr_ina_begin(struct pfr_table *trs, u_int32_t *ticket, int *ndel, int flags)
{
ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
rs = pf_find_or_create_ruleset(trs->pfrt_anchor);
ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
rs = pf_find_or_create_ruleset(trs->pfrt_anchor);
SLIST_INIT(&workq);
RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
SLIST_INIT(&workq);
RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
xdel++;
}
if (!(flags & PFR_FLAG_DUMMY)) {
pfr_setflags_ktables(&workq);
p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
xdel++;
}
if (!(flags & PFR_FLAG_DUMMY)) {
pfr_setflags_ktables(&workq);
}
int
pfr_ina_define(struct pfr_table *tbl, user_addr_t addr, int size,
int *nadd, int *naddr, u_int32_t ticket, int flags)
{
}
int
pfr_ina_define(struct pfr_table *tbl, user_addr_t addr, int size,
int *nadd, int *naddr, u_int32_t ticket, int flags)
{
- struct pfr_ktableworkq tableq;
- struct pfr_kentryworkq addrq;
- struct pfr_ktable *kt, *rt, *shadow, key;
- struct pfr_kentry *p;
- struct pfr_addr ad;
- struct pf_ruleset *rs;
- int i, rv, xadd = 0, xaddr = 0;
+ struct pfr_ktableworkq tableq;
+ struct pfr_kentryworkq addrq;
+ struct pfr_ktable *kt, *rt, *shadow, key;
+ struct pfr_kentry *p;
+ struct pfr_addr ad;
+ struct pf_ruleset *rs;
+ int i, rv, xadd = 0, xaddr = 0;
tbl->pfrt_flags |= PFR_TFLAG_INACTIVE;
SLIST_INIT(&tableq);
kt = RB_FIND(pfr_ktablehead, &pfr_ktables, (struct pfr_ktable *)(void *)tbl);
if (kt == NULL) {
kt = pfr_create_ktable(tbl, 0, 1);
tbl->pfrt_flags |= PFR_TFLAG_INACTIVE;
SLIST_INIT(&tableq);
kt = RB_FIND(pfr_ktablehead, &pfr_ktables, (struct pfr_ktable *)(void *)tbl);
if (kt == NULL) {
kt = pfr_create_ktable(tbl, 0, 1);
rt = pfr_create_ktable(&key.pfrkt_t, 0, 1);
if (rt == NULL) {
pfr_destroy_ktables(&tableq, 0);
rt = pfr_create_ktable(&key.pfrkt_t, 0, 1);
if (rt == NULL) {
pfr_destroy_ktables(&tableq, 0);
_skip:
shadow = pfr_create_ktable(tbl, 0, 0);
if (shadow == NULL) {
pfr_destroy_ktables(&tableq, 0);
_skip:
shadow = pfr_create_ktable(tbl, 0, 0);
if (shadow == NULL) {
pfr_destroy_ktables(&tableq, 0);
- for (i = 0; i < size; i++, addr += sizeof (ad)) {
- if (COPYIN(addr, &ad, sizeof (ad), flags))
+ for (i = 0; i < size; i++, addr += sizeof(ad)) {
+ if (COPYIN(addr, &ad, sizeof(ad), flags)) {
kt->pfrkt_flags |= PFR_TFLAG_INACTIVE;
pfr_insert_ktables(&tableq);
shadow->pfrkt_cnt = (flags & PFR_FLAG_ADDRSTOO) ?
kt->pfrkt_flags |= PFR_TFLAG_INACTIVE;
pfr_insert_ktables(&tableq);
shadow->pfrkt_cnt = (flags & PFR_FLAG_ADDRSTOO) ?
pfr_destroy_ktables(&tableq, 0);
pfr_destroy_kentries(&addrq);
}
pfr_destroy_ktables(&tableq, 0);
pfr_destroy_kentries(&addrq);
}
_bad:
pfr_destroy_ktable(shadow, 0);
pfr_destroy_ktables(&tableq, 0);
pfr_destroy_kentries(&addrq);
_bad:
pfr_destroy_ktable(shadow, 0);
pfr_destroy_ktables(&tableq, 0);
pfr_destroy_kentries(&addrq);
}
int
pfr_ina_rollback(struct pfr_table *trs, u_int32_t ticket, int *ndel, int flags)
{
}
int
pfr_ina_rollback(struct pfr_table *trs, u_int32_t ticket, int *ndel, int flags)
{
ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
rs = pf_find_ruleset(trs->pfrt_anchor);
ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
rs = pf_find_ruleset(trs->pfrt_anchor);
SLIST_INIT(&workq);
RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
SLIST_INIT(&workq);
RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
xdel++;
p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
xdel++;
}
int
pfr_ina_commit(struct pfr_table *trs, u_int32_t ticket, int *nadd,
int *nchange, int flags)
{
}
int
pfr_ina_commit(struct pfr_table *trs, u_int32_t ticket, int *nadd,
int *nchange, int flags)
{
- struct pfr_ktable *p, *q;
- struct pfr_ktableworkq workq;
- struct pf_ruleset *rs;
- int xadd = 0, xchange = 0;
- u_int64_t tzero = pf_calendar_time_second();
+ struct pfr_ktable *p, *q;
+ struct pfr_ktableworkq workq;
+ struct pf_ruleset *rs;
+ int xadd = 0, xchange = 0;
+ u_int64_t tzero = pf_calendar_time_second();
ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
rs = pf_find_ruleset(trs->pfrt_anchor);
ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
rs = pf_find_ruleset(trs->pfrt_anchor);
SLIST_INIT(&workq);
RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
SLIST_INIT(&workq);
RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
- struct pfr_kentryworkq addrq, addq, changeq, delq, garbageq;
- struct pfr_kentry *p, *q, *next;
- struct pfr_addr ad;
+ struct pfr_kentryworkq addrq, addq, changeq, delq, garbageq;
+ struct pfr_kentry *p, *q, *next;
+ struct pfr_addr ad;
pfr_enqueue_addrs(shadow, &addrq, NULL, 0);
pfr_mark_addrs(kt);
pfr_enqueue_addrs(shadow, &addrq, NULL, 0);
pfr_mark_addrs(kt);
SLIST_INIT(&garbageq);
pfr_clean_node_mask(shadow, &addrq);
for (p = SLIST_FIRST(&addrq); p != NULL; p = next) {
SLIST_INIT(&garbageq);
pfr_clean_node_mask(shadow, &addrq);
for (p = SLIST_FIRST(&addrq); p != NULL; p = next) {
pfr_copyout_addr(&ad, p);
q = pfr_lookup_addr(kt, &ad, 1);
if (q != NULL) {
pfr_copyout_addr(&ad, p);
q = pfr_lookup_addr(kt, &ad, 1);
if (q != NULL) {
- tbl->pfrt_anchor[sizeof (tbl->pfrt_anchor) - 1] = '\0';
- tbl->pfrt_name[sizeof (tbl->pfrt_name) - 1] = '\0';
+ tbl->pfrt_anchor[sizeof(tbl->pfrt_anchor) - 1] = '\0';
+ tbl->pfrt_name[sizeof(tbl->pfrt_name) - 1] = '\0';
- if (!tbl->pfrt_name[0])
- return (-1);
- if (no_reserved && strcmp(tbl->pfrt_anchor, PF_RESERVED_ANCHOR) == 0)
- return (-1);
- if (tbl->pfrt_name[PF_TABLE_NAME_SIZE-1])
- return (-1);
- for (i = strlen(tbl->pfrt_name); i < PF_TABLE_NAME_SIZE; i++)
- if (tbl->pfrt_name[i])
- return (-1);
- if (pfr_fix_anchor(tbl->pfrt_anchor))
- return (-1);
- if (tbl->pfrt_flags & ~allowedflags)
- return (-1);
- return (0);
+ if (!tbl->pfrt_name[0]) {
+ return -1;
+ }
+ if (no_reserved && strcmp(tbl->pfrt_anchor, PF_RESERVED_ANCHOR) == 0) {
+ return -1;
+ }
+ if (tbl->pfrt_name[PF_TABLE_NAME_SIZE - 1]) {
+ return -1;
+ }
+ for (i = strlen(tbl->pfrt_name); i < PF_TABLE_NAME_SIZE; i++) {
+ if (tbl->pfrt_name[i]) {
+ return -1;
+ }
+ }
+ if (pfr_fix_anchor(tbl->pfrt_anchor)) {
+ return -1;
+ }
+ if (tbl->pfrt_flags & ~allowedflags) {
+ return -1;
+ }
+ return 0;
bcopy(path, anchor, siz - off);
memset(anchor + siz - off, 0, off);
}
bcopy(path, anchor, siz - off);
memset(anchor + siz - off, 0, off);
}
- if (flags & PFR_FLAG_ALLRSETS)
- return (0);
- if (strcmp(filter->pfrt_anchor, kt->pfrkt_anchor))
- return (1);
- return (0);
+ if (flags & PFR_FLAG_ALLRSETS) {
+ return 0;
+ }
+ if (strcmp(filter->pfrt_anchor, kt->pfrkt_anchor)) {
+ return 1;
+ }
+ return 0;
for (p = SLIST_FIRST(workq); p; p = q) {
q = SLIST_NEXT(p, pfrkt_workq);
for (p = SLIST_FIRST(workq); p; p = q) {
q = SLIST_NEXT(p, pfrkt_workq);
if (!(newf & PFR_TFLAG_SETMASK)) {
RB_REMOVE(pfr_ktablehead, &pfr_ktables, kt);
if (!(newf & PFR_TFLAG_SETMASK)) {
RB_REMOVE(pfr_ktablehead, &pfr_ktables, kt);
pfr_setflags_ktable(kt->pfrkt_root,
kt->pfrkt_root->pfrkt_flags &
~PFR_TFLAG_REFDANCHOR);
pfr_setflags_ktable(kt->pfrkt_root,
kt->pfrkt_root->pfrkt_flags &
~PFR_TFLAG_REFDANCHOR);
if (recurse) {
pfr_enqueue_addrs(kt, &addrq, NULL, 0);
pfr_clstats_kentries(&addrq, tzero, 0);
}
if (recurse) {
pfr_enqueue_addrs(kt, &addrq, NULL, 0);
pfr_clstats_kentries(&addrq, tzero, 0);
}
- bzero(kt->pfrkt_packets, sizeof (kt->pfrkt_packets));
- bzero(kt->pfrkt_bytes, sizeof (kt->pfrkt_bytes));
+ bzero(kt->pfrkt_packets, sizeof(kt->pfrkt_packets));
+ bzero(kt->pfrkt_bytes, sizeof(kt->pfrkt_bytes));
static struct pfr_ktable *
pfr_create_ktable(struct pfr_table *tbl, u_int64_t tzero, int attachruleset)
{
static struct pfr_ktable *
pfr_create_ktable(struct pfr_table *tbl, u_int64_t tzero, int attachruleset)
{
kt->pfrkt_t = *tbl;
if (attachruleset) {
rs = pf_find_or_create_ruleset(tbl->pfrt_anchor);
if (!rs) {
pfr_destroy_ktable(kt, 0);
kt->pfrkt_t = *tbl;
if (attachruleset) {
rs = pf_find_or_create_ruleset(tbl->pfrt_anchor);
if (!rs) {
pfr_destroy_ktable(kt, 0);
!rn_inithead((void **)&kt->pfrkt_ip6,
offsetof(struct sockaddr_in6, sin6_addr) * 8)) {
pfr_destroy_ktable(kt, 0);
!rn_inithead((void **)&kt->pfrkt_ip6,
offsetof(struct sockaddr_in6, sin6_addr) * 8)) {
pfr_destroy_ktable(kt, 0);
for (p = SLIST_FIRST(workq); p; p = q) {
q = SLIST_NEXT(p, pfrkt_workq);
for (p = SLIST_FIRST(workq); p; p = q) {
q = SLIST_NEXT(p, pfrkt_workq);
if (flushaddr) {
pfr_enqueue_addrs(kt, &addrq, NULL, 0);
pfr_clean_node_mask(kt, &addrq);
pfr_destroy_kentries(&addrq);
}
if (flushaddr) {
pfr_enqueue_addrs(kt, &addrq, NULL, 0);
pfr_clean_node_mask(kt, &addrq);
pfr_destroy_kentries(&addrq);
}
- if ((d = strncmp(p->pfrkt_name, q->pfrkt_name, PF_TABLE_NAME_SIZE)))
- return (d);
- return (strcmp(p->pfrkt_anchor, q->pfrkt_anchor));
+ if ((d = strncmp(p->pfrkt_name, q->pfrkt_name, PF_TABLE_NAME_SIZE))) {
+ return d;
+ }
+ return strcmp(p->pfrkt_anchor, q->pfrkt_anchor);
- return (RB_FIND(pfr_ktablehead, &pfr_ktables,
- (struct pfr_ktable *)(void *)tbl));
+ return RB_FIND(pfr_ktablehead, &pfr_ktables,
+ (struct pfr_ktable *)(void *)tbl);
switch (af) {
#if INET
case AF_INET:
pfr_sin.sin_addr.s_addr = a->addr32[0];
ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4);
switch (af) {
#if INET
case AF_INET:
pfr_sin.sin_addr.s_addr = a->addr32[0];
ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4);
}
void
pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af,
u_int64_t len, int dir_out, int op_pass, int notrule)
{
}
void
pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af,
u_int64_t len, int dir_out, int op_pass, int notrule)
{
switch (af) {
#if INET
case AF_INET:
pfr_sin.sin_addr.s_addr = a->addr32[0];
ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4);
switch (af) {
#if INET
case AF_INET:
pfr_sin.sin_addr.s_addr = a->addr32[0];
ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4);
- struct pfr_ktable *kt, *rt;
- struct pfr_table tbl;
- struct pf_anchor *ac = rs->anchor;
+ struct pfr_ktable *kt, *rt;
+ struct pfr_table tbl;
+ struct pf_anchor *ac = rs->anchor;
- bzero(&tbl, sizeof (tbl));
- strlcpy(tbl.pfrt_name, name, sizeof (tbl.pfrt_name));
- if (ac != NULL)
- strlcpy(tbl.pfrt_anchor, ac->path, sizeof (tbl.pfrt_anchor));
+ bzero(&tbl, sizeof(tbl));
+ strlcpy(tbl.pfrt_name, name, sizeof(tbl.pfrt_name));
+ if (ac != NULL) {
+ strlcpy(tbl.pfrt_anchor, ac->path, sizeof(tbl.pfrt_anchor));
+ }
kt = pfr_lookup_table(&tbl);
if (kt == NULL) {
kt = pfr_create_ktable(&tbl, pf_calendar_time_second(), 1);
kt = pfr_lookup_table(&tbl);
if (kt == NULL) {
kt = pfr_create_ktable(&tbl, pf_calendar_time_second(), 1);
rt = pfr_lookup_table(&tbl);
if (rt == NULL) {
rt = pfr_create_ktable(&tbl, 0, 1);
if (rt == NULL) {
pfr_destroy_ktable(kt, 0);
rt = pfr_lookup_table(&tbl);
if (rt == NULL) {
rt = pfr_create_ktable(&tbl, 0, 1);
if (rt == NULL) {
pfr_destroy_ktable(kt, 0);
- if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++)
- pfr_setflags_ktable(kt, kt->pfrkt_flags|PFR_TFLAG_REFERENCED);
- return (kt);
+ if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++) {
+ pfr_setflags_ktable(kt, kt->pfrkt_flags | PFR_TFLAG_REFERENCED);
+ }
+ return kt;
printf("pfr_detach_table: refcount = %d.\n",
kt->pfrkt_refcnt[PFR_REFCNT_RULE]);
printf("pfr_detach_table: refcount = %d.\n",
kt->pfrkt_refcnt[PFR_REFCNT_RULE]);
- else if (!--kt->pfrkt_refcnt[PFR_REFCNT_RULE])
- pfr_setflags_ktable(kt, kt->pfrkt_flags&~PFR_TFLAG_REFERENCED);
+ } else if (!--kt->pfrkt_refcnt[PFR_REFCNT_RULE]) {
+ pfr_setflags_ktable(kt, kt->pfrkt_flags & ~PFR_TFLAG_REFERENCED);
+ }
}
int
pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter,
struct pf_addr **raddr, struct pf_addr **rmask, sa_family_t af)
{
}
int
pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter,
struct pf_addr **raddr, struct pf_addr **rmask, sa_family_t af)
{
- struct pfr_kentry *ke, *ke2;
- struct pf_addr *addr;
- union sockaddr_union mask;
- int idx = -1, use_counter = 0;
+ struct pfr_kentry *ke, *ke2;
+ struct pf_addr *addr;
+ union sockaddr_union mask;
+ int idx = -1, use_counter = 0;
}
pfr_prepare_network(&pfr_mask, af, ke->pfrke_net);
*raddr = SUNION2PF(&ke->pfrke_sa, af);
}
pfr_prepare_network(&pfr_mask, af, ke->pfrke_net);
*raddr = SUNION2PF(&ke->pfrke_sa, af);
/* no need to check KENTRY_RNF_ROOT() here */
if (ke2 == ke) {
/* lookup return the same block - perfect */
PF_ACPY(counter, addr, af);
*pidx = idx;
kt->pfrkt_match++;
/* no need to check KENTRY_RNF_ROOT() here */
if (ke2 == ke) {
/* lookup return the same block - perfect */
PF_ACPY(counter, addr, af);
*pidx = idx;
kt->pfrkt_match++;
static struct pfr_kentry *
pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af)
{
static struct pfr_kentry *
pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af)
{
projects / apple / xnu.git / blobdiff