xnu-7195.50.7.100.1.tar.gz

[apple/xnu.git] / bsd / net / pf_if.c

diff --git a/bsd/net/pf_if.c b/bsd/net/pf_if.c
index f67d06a5dd1334c2e5ae47d1ab90b6bcec7de2ca..93242985555d9a5fc6d5f3866bac0e95f4ec5413 100644 (file)
--- a/bsd/net/pf_if.c
+++ b/bsd/net/pf_if.c
@@ -1,5 +1,5 @@
 /*
 /*

- * Copyright (c) 2007-2016 Apple Inc. All rights reserved.
+ * Copyright (c) 2007-2019 Apple Inc. All rights reserved.

  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  *
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  *


@@ -81,54 +81,54 @@
 #include <netinet/ip.h>
 #include <netinet/ip_var.h>
 
 #include <netinet/ip.h>
 #include <netinet/ip_var.h>
 

-#if INET6

 #include <netinet/ip6.h>
 #include <netinet/ip6.h>

-#endif /* INET6 */

 
 #include <net/pfvar.h>
 
 
 #include <net/pfvar.h>
 

-struct pfi_kif                 *pfi_all = NULL;
+struct pfi_kif                  *pfi_all = NULL;

 
 

-static struct pool             pfi_addr_pl;
-static struct pfi_ifhead       pfi_ifs;
-static u_int32_t               pfi_update = 1;
-static struct pfr_addr         *pfi_buffer;
-static int                     pfi_buffer_cnt;
-static int                     pfi_buffer_max;
+static struct pool              pfi_addr_pl;
+static struct pfi_ifhead        pfi_ifs;
+static u_int32_t                pfi_update = 1;
+static struct pfr_addr          *pfi_buffer;
+static int                      pfi_buffer_cnt;
+static int                      pfi_buffer_max;

 
 __private_extern__ void pfi_kifaddr_update(void *);
 
 static void pfi_kif_update(struct pfi_kif *);
 static void pfi_dynaddr_update(struct pfi_dynaddr *dyn);
 
 __private_extern__ void pfi_kifaddr_update(void *);
 
 static void pfi_kif_update(struct pfi_kif *);
 static void pfi_dynaddr_update(struct pfi_dynaddr *dyn);

-static void pfi_table_update(struct pfr_ktable *, struct pfi_kif *, int, int);
-static void pfi_instance_add(struct ifnet *, int, int);
-static void pfi_address_add(struct sockaddr *, int, int);
+static void pfi_table_update(struct pfr_ktable *, struct pfi_kif *, uint8_t, int);
+static void pfi_instance_add(struct ifnet *, uint8_t, int);
+static void pfi_address_add(struct sockaddr *, uint8_t, uint8_t);

 static int pfi_if_compare(struct pfi_kif *, struct pfi_kif *);
 static int pfi_skip_if(const char *, struct pfi_kif *);
 static int pfi_if_compare(struct pfi_kif *, struct pfi_kif *);
 static int pfi_skip_if(const char *, struct pfi_kif *);

-static int pfi_unmask(void *);
+static uint8_t pfi_unmask(void *);

 
 RB_PROTOTYPE_SC(static, pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare);
 RB_GENERATE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare);
 
 
 RB_PROTOTYPE_SC(static, pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare);
 RB_GENERATE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare);
 

-#define        PFI_BUFFER_MAX          0x10000
-#define        PFI_MTYPE               M_IFADDR
+#define PFI_BUFFER_MAX          0x10000
+#define PFI_MTYPE               M_IFADDR

 
 

-#define        IFG_ALL "ALL"
+#define IFG_ALL "ALL"

 
 void
 pfi_initialize(void)
 {
 
 void
 pfi_initialize(void)
 {

-       if (pfi_all != NULL)    /* already initialized */
+       if (pfi_all != NULL) {  /* already initialized */

                return;
                return;

+       }

 
 

-       pool_init(&pfi_addr_pl, sizeof (struct pfi_dynaddr), 0, 0, 0,
+       pool_init(&pfi_addr_pl, sizeof(struct pfi_dynaddr), 0, 0, 0,

            "pfiaddrpl", NULL);
        pfi_buffer_max = 64;
            "pfiaddrpl", NULL);
        pfi_buffer_max = 64;

-       pfi_buffer = _MALLOC(pfi_buffer_max * sizeof (*pfi_buffer),
+       pfi_buffer = _MALLOC(pfi_buffer_max * sizeof(*pfi_buffer),

            PFI_MTYPE, M_WAITOK);
 
            PFI_MTYPE, M_WAITOK);
 

-       if ((pfi_all = pfi_kif_get(IFG_ALL)) == NULL)
+       if ((pfi_all = pfi_kif_get(IFG_ALL)) == NULL) {

                panic("pfi_kif_get for pfi_all failed");
                panic("pfi_kif_get for pfi_all failed");

+       }

 }
 
 #if 0
 }
 
 #if 0


@@ -143,25 +143,27 @@ pfi_destroy(void)
 struct pfi_kif *
 pfi_kif_get(const char *kif_name)
 {
 struct pfi_kif *
 pfi_kif_get(const char *kif_name)
 {

-       struct pfi_kif          *kif;
-       struct pfi_kif_cmp       s;
-
-       bzero(&s, sizeof (s));
-       strlcpy(s.pfik_name, kif_name, sizeof (s.pfik_name));
-       if ((kif = RB_FIND(pfi_ifhead, &pfi_ifs,
-           (struct pfi_kif *)(void *)&s)) != NULL)
-               return (kif);
+       struct pfi_kif          *kif;
+       struct pfi_kif       s;
+
+       bzero(&s.pfik_name, sizeof(s.pfik_name));
+       strlcpy(s.pfik_name, kif_name, sizeof(s.pfik_name));
+       kif = RB_FIND(pfi_ifhead, &pfi_ifs, &s);
+       if (kif != NULL) {
+               return kif;
+       }

 
        /* create new one */
 
        /* create new one */

-       if ((kif = _MALLOC(sizeof (*kif), PFI_MTYPE, M_WAITOK|M_ZERO)) == NULL)
-               return (NULL);
+       if ((kif = _MALLOC(sizeof(*kif), PFI_MTYPE, M_WAITOK | M_ZERO)) == NULL) {
+               return NULL;
+       }

 
 

-       strlcpy(kif->pfik_name, kif_name, sizeof (kif->pfik_name));
+       strlcpy(kif->pfik_name, kif_name, sizeof(kif->pfik_name));

        kif->pfik_tzero = pf_calendar_time_second();
        TAILQ_INIT(&kif->pfik_dynaddrs);
 
        RB_INSERT(pfi_ifhead, &pfi_ifs, kif);
        kif->pfik_tzero = pf_calendar_time_second();
        TAILQ_INIT(&kif->pfik_dynaddrs);
 
        RB_INSERT(pfi_ifhead, &pfi_ifs, kif);

-       return (kif);
+       return kif;

 }
 
 void
 }
 
 void


@@ -182,8 +184,9 @@ pfi_kif_ref(struct pfi_kif *kif, enum pfi_kif_refs what)
 void
 pfi_kif_unref(struct pfi_kif *kif, enum pfi_kif_refs what)
 {
 void
 pfi_kif_unref(struct pfi_kif *kif, enum pfi_kif_refs what)
 {

-       if (kif == NULL)
+       if (kif == NULL) {

                return;
                return;

+       }

 
        switch (what) {
        case PFI_KIF_REF_NONE:
 
        switch (what) {
        case PFI_KIF_REF_NONE:


@@ -206,11 +209,13 @@ pfi_kif_unref(struct pfi_kif *kif, enum pfi_kif_refs what)
                panic("pfi_kif_unref with unknown type");
        }
 
                panic("pfi_kif_unref with unknown type");
        }
 

-       if (kif->pfik_ifp != NULL || kif == pfi_all)
+       if (kif->pfik_ifp != NULL || kif == pfi_all) {

                return;
                return;

+       }

 
 

-       if (kif->pfik_rules || kif->pfik_states)
+       if (kif->pfik_rules || kif->pfik_states) {

                return;
                return;

+       }

 
        RB_REMOVE(pfi_ifhead, &pfi_ifs, kif);
        _FREE(kif, PFI_MTYPE);
 
        RB_REMOVE(pfi_ifhead, &pfi_ifs, kif);
        _FREE(kif, PFI_MTYPE);


@@ -219,11 +224,11 @@ pfi_kif_unref(struct pfi_kif *kif, enum pfi_kif_refs what)
 int
 pfi_kif_match(struct pfi_kif *rule_kif, struct pfi_kif *packet_kif)
 {
 int
 pfi_kif_match(struct pfi_kif *rule_kif, struct pfi_kif *packet_kif)
 {

+       if (rule_kif == NULL || rule_kif == packet_kif) {
+               return 1;
+       }

 
 

-       if (rule_kif == NULL || rule_kif == packet_kif)
-               return (1);
-
-       return (0);
+       return 0;

 }
 
 void
 }
 
 void


@@ -234,8 +239,9 @@ pfi_attach_ifnet(struct ifnet *ifp)
        LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        pfi_update++;
        LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        pfi_update++;

-       if ((kif = pfi_kif_get(if_name(ifp))) == NULL)
+       if ((kif = pfi_kif_get(if_name(ifp))) == NULL) {

                panic("pfi_kif_get failed");
                panic("pfi_kif_get failed");

+       }

 
        ifnet_lock_exclusive(ifp);
        kif->pfik_ifp = ifp;
 
        ifnet_lock_exclusive(ifp);
        kif->pfik_ifp = ifp;


@@ -251,12 +257,13 @@ pfi_attach_ifnet(struct ifnet *ifp)
 void
 pfi_detach_ifnet(struct ifnet *ifp)
 {
 void
 pfi_detach_ifnet(struct ifnet *ifp)
 {

-       struct pfi_kif          *kif;
+       struct pfi_kif          *kif;

 
        LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
 
        LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 

-       if ((kif = (struct pfi_kif *)ifp->if_pf_kif) == NULL)
+       if ((kif = (struct pfi_kif *)ifp->if_pf_kif) == NULL) {

                return;
                return;

+       }

 
        pfi_update++;
        pfi_kif_update(kif);
 
        pfi_update++;
        pfi_kif_update(kif);


@@ -277,51 +284,52 @@ pfi_match_addr(struct pfi_dynaddr *dyn, struct pf_addr *a, sa_family_t af)
        case AF_INET:
                switch (dyn->pfid_acnt4) {
                case 0:
        case AF_INET:
                switch (dyn->pfid_acnt4) {
                case 0:

-                       return (0);
+                       return 0;

                case 1:
                case 1:

-                       return (PF_MATCHA(0, &dyn->pfid_addr4,
-                           &dyn->pfid_mask4, a, AF_INET));
+                       return PF_MATCHA(0, &dyn->pfid_addr4,
+                                  &dyn->pfid_mask4, a, AF_INET);

                default:
                default:

-                       return (pfr_match_addr(dyn->pfid_kt, a, AF_INET));
+                       return pfr_match_addr(dyn->pfid_kt, a, AF_INET);

                }
 #endif /* INET */
                }
 #endif /* INET */

-#if INET6

        case AF_INET6:
                switch (dyn->pfid_acnt6) {
                case 0:
        case AF_INET6:
                switch (dyn->pfid_acnt6) {
                case 0:

-                       return (0);
+                       return 0;

                case 1:
                case 1:

-                       return (PF_MATCHA(0, &dyn->pfid_addr6,
-                           &dyn->pfid_mask6, a, AF_INET6));
+                       return PF_MATCHA(0, &dyn->pfid_addr6,
+                                  &dyn->pfid_mask6, a, AF_INET6);

                default:
                default:

-                       return (pfr_match_addr(dyn->pfid_kt, a, AF_INET6));
+                       return pfr_match_addr(dyn->pfid_kt, a, AF_INET6);

                }
                }

-#endif /* INET6 */

        default:
        default:

-               return (0);
+               return 0;

        }
 }
 
 int
 pfi_dynaddr_setup(struct pf_addr_wrap *aw, sa_family_t af)
 {
        }
 }
 
 int
 pfi_dynaddr_setup(struct pf_addr_wrap *aw, sa_family_t af)
 {

-       struct pfi_dynaddr      *dyn;
-       char                     tblname[PF_TABLE_NAME_SIZE];
-       struct pf_ruleset       *ruleset = NULL;
-       int                      rv = 0;
+       struct pfi_dynaddr      *dyn;
+       char                     tblname[PF_TABLE_NAME_SIZE];
+       struct pf_ruleset       *ruleset = NULL;
+       int                      rv = 0;

 
        LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
 
        LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 

-       if (aw->type != PF_ADDR_DYNIFTL)
-               return (0);
-       if ((dyn = pool_get(&pfi_addr_pl, PR_WAITOK)) == NULL)
-               return (1);
-       bzero(dyn, sizeof (*dyn));
+       if (aw->type != PF_ADDR_DYNIFTL) {
+               return 0;
+       }
+       if ((dyn = pool_get(&pfi_addr_pl, PR_WAITOK)) == NULL) {
+               return 1;
+       }
+       bzero(dyn, sizeof(*dyn));

 
 

-       if (strcmp(aw->v.ifname, "self") == 0)
+       if (strcmp(aw->v.ifname, "self") == 0) {

                dyn->pfid_kif = pfi_kif_get(IFG_ALL);
                dyn->pfid_kif = pfi_kif_get(IFG_ALL);

-       else
+       } else {

                dyn->pfid_kif = pfi_kif_get(aw->v.ifname);
                dyn->pfid_kif = pfi_kif_get(aw->v.ifname);

+       }

        if (dyn->pfid_kif == NULL) {
                rv = 1;
                goto _bad;
        if (dyn->pfid_kif == NULL) {
                rv = 1;
                goto _bad;


@@ -329,20 +337,26 @@ pfi_dynaddr_setup(struct pf_addr_wrap *aw, sa_family_t af)
        pfi_kif_ref(dyn->pfid_kif, PFI_KIF_REF_RULE);
 
        dyn->pfid_net = pfi_unmask(&aw->v.a.mask);
        pfi_kif_ref(dyn->pfid_kif, PFI_KIF_REF_RULE);
 
        dyn->pfid_net = pfi_unmask(&aw->v.a.mask);

-       if (af == AF_INET && dyn->pfid_net == 32)
+       if (af == AF_INET && dyn->pfid_net == 32) {

                dyn->pfid_net = 128;
                dyn->pfid_net = 128;

-       strlcpy(tblname, aw->v.ifname, sizeof (tblname));
-       if (aw->iflags & PFI_AFLAG_NETWORK)
-               strlcat(tblname, ":network", sizeof (tblname));
-       if (aw->iflags & PFI_AFLAG_BROADCAST)
-               strlcat(tblname, ":broadcast", sizeof (tblname));
-       if (aw->iflags & PFI_AFLAG_PEER)
-               strlcat(tblname, ":peer", sizeof (tblname));
-       if (aw->iflags & PFI_AFLAG_NOALIAS)
-               strlcat(tblname, ":0", sizeof (tblname));
-       if (dyn->pfid_net != 128)
+       }
+       strlcpy(tblname, aw->v.ifname, sizeof(tblname));
+       if (aw->iflags & PFI_AFLAG_NETWORK) {
+               strlcat(tblname, ":network", sizeof(tblname));
+       }
+       if (aw->iflags & PFI_AFLAG_BROADCAST) {
+               strlcat(tblname, ":broadcast", sizeof(tblname));
+       }
+       if (aw->iflags & PFI_AFLAG_PEER) {
+               strlcat(tblname, ":peer", sizeof(tblname));
+       }
+       if (aw->iflags & PFI_AFLAG_NOALIAS) {
+               strlcat(tblname, ":0", sizeof(tblname));
+       }
+       if (dyn->pfid_net != 128) {

                snprintf(tblname + strlen(tblname),
                snprintf(tblname + strlen(tblname),

-                   sizeof (tblname) - strlen(tblname), "/%d", dyn->pfid_net);
+                   sizeof(tblname) - strlen(tblname), "/%d", dyn->pfid_net);
+       }

        if ((ruleset = pf_find_or_create_ruleset(PF_RESERVED_ANCHOR)) == NULL) {
                rv = 1;
                goto _bad;
        if ((ruleset = pf_find_or_create_ruleset(PF_RESERVED_ANCHOR)) == NULL) {
                rv = 1;
                goto _bad;


@@ -360,39 +374,43 @@ pfi_dynaddr_setup(struct pf_addr_wrap *aw, sa_family_t af)
        TAILQ_INSERT_TAIL(&dyn->pfid_kif->pfik_dynaddrs, dyn, entry);
        aw->p.dyn = dyn;
        pfi_kif_update(dyn->pfid_kif);
        TAILQ_INSERT_TAIL(&dyn->pfid_kif->pfik_dynaddrs, dyn, entry);
        aw->p.dyn = dyn;
        pfi_kif_update(dyn->pfid_kif);

-       return (0);
+       return 0;

 
 _bad:
 
 _bad:

-       if (dyn->pfid_kt != NULL)
+       if (dyn->pfid_kt != NULL) {

                pfr_detach_table(dyn->pfid_kt);
                pfr_detach_table(dyn->pfid_kt);

-       if (ruleset != NULL)
+       }
+       if (ruleset != NULL) {

                pf_remove_if_empty_ruleset(ruleset);
                pf_remove_if_empty_ruleset(ruleset);

-       if (dyn->pfid_kif != NULL)
+       }
+       if (dyn->pfid_kif != NULL) {

                pfi_kif_unref(dyn->pfid_kif, PFI_KIF_REF_RULE);
                pfi_kif_unref(dyn->pfid_kif, PFI_KIF_REF_RULE);

+       }

        pool_put(&pfi_addr_pl, dyn);
        pool_put(&pfi_addr_pl, dyn);

-       return (rv);
+       return rv;

 }
 
 void
 pfi_kif_update(struct pfi_kif *kif)
 {
 }
 
 void
 pfi_kif_update(struct pfi_kif *kif)
 {

-       struct pfi_dynaddr      *p;
+       struct pfi_dynaddr      *p;

 
        LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        /* update all dynaddr */
        TAILQ_FOREACH(p, &kif->pfik_dynaddrs, entry)
 
        LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        /* update all dynaddr */
        TAILQ_FOREACH(p, &kif->pfik_dynaddrs, entry)

-               pfi_dynaddr_update(p);
+       pfi_dynaddr_update(p);

 }
 
 void
 pfi_dynaddr_update(struct pfi_dynaddr *dyn)
 {
 }
 
 void
 pfi_dynaddr_update(struct pfi_dynaddr *dyn)
 {

-       struct pfi_kif          *kif;
-       struct pfr_ktable       *kt;
+       struct pfi_kif          *kif;
+       struct pfr_ktable       *kt;

 
 

-       if (dyn == NULL || dyn->pfid_kif == NULL || dyn->pfid_kt == NULL)
+       if (dyn == NULL || dyn->pfid_kif == NULL || dyn->pfid_kt == NULL) {

                panic("pfi_dynaddr_update");
                panic("pfi_dynaddr_update");

+       }

 
        kif = dyn->pfid_kif;
        kt = dyn->pfid_kt;
 
        kif = dyn->pfid_kif;
        kt = dyn->pfid_kt;


@@ -406,30 +424,33 @@ pfi_dynaddr_update(struct pfi_dynaddr *dyn)
 }
 
 void
 }
 
 void

-pfi_table_update(struct pfr_ktable *kt, struct pfi_kif *kif, int net, int flags)
+pfi_table_update(struct pfr_ktable *kt, struct pfi_kif *kif, uint8_t net, int flags)

 {
 {

-       int                      e, size2 = 0;
+       int                      e, size2 = 0;

 
        pfi_buffer_cnt = 0;
 
 
        pfi_buffer_cnt = 0;
 

-       if (kif->pfik_ifp != NULL)
+       if (kif->pfik_ifp != NULL) {

                pfi_instance_add(kif->pfik_ifp, net, flags);
                pfi_instance_add(kif->pfik_ifp, net, flags);

+       }

 
        if ((e = pfr_set_addrs(&kt->pfrkt_t, CAST_USER_ADDR_T(pfi_buffer),
 
        if ((e = pfr_set_addrs(&kt->pfrkt_t, CAST_USER_ADDR_T(pfi_buffer),

-           pfi_buffer_cnt, &size2, NULL, NULL, NULL, 0, PFR_TFLAG_ALLMASK)))
+           pfi_buffer_cnt, &size2, NULL, NULL, NULL, 0, PFR_TFLAG_ALLMASK))) {

                printf("pfi_table_update: cannot set %d new addresses "
                    "into table %s: %d\n", pfi_buffer_cnt, kt->pfrkt_name, e);
                printf("pfi_table_update: cannot set %d new addresses "
                    "into table %s: %d\n", pfi_buffer_cnt, kt->pfrkt_name, e);

+       }

 }
 
 void
 }
 
 void

-pfi_instance_add(struct ifnet *ifp, int net, int flags)
+pfi_instance_add(struct ifnet *ifp, uint8_t net, int flags)

 {
 {

-       struct ifaddr   *ia;
-       int              got4 = 0, got6 = 0;
-       int              net2, af;
+       struct ifaddr   *ia;
+       int              got4 = 0, got6 = 0;
+       uint8_t          net2, af;

 
 

-       if (ifp == NULL)
+       if (ifp == NULL) {

                return;
                return;

+       }

        ifnet_lock_shared(ifp);
        TAILQ_FOREACH(ia, &ifp->if_addrhead, ifa_link) {
                IFA_LOCK(ia);
        ifnet_lock_shared(ifp);
        TAILQ_FOREACH(ia, &ifp->if_addrhead, ifa_link) {
                IFA_LOCK(ia);


@@ -456,12 +477,19 @@ pfi_instance_add(struct ifnet *ifp, int net, int flags)
                        IFA_UNLOCK(ia);
                        continue;
                }
                        IFA_UNLOCK(ia);
                        continue;
                }

-               if ((flags & PFI_AFLAG_NETWORK) && af == AF_INET6 &&
+               if ((af == AF_INET6) &&

                    IN6_IS_ADDR_LINKLOCAL(&((struct sockaddr_in6 *)
                    (void *)ia->ifa_addr)->sin6_addr)) {
                        IFA_UNLOCK(ia);
                        continue;
                }
                    IN6_IS_ADDR_LINKLOCAL(&((struct sockaddr_in6 *)
                    (void *)ia->ifa_addr)->sin6_addr)) {
                        IFA_UNLOCK(ia);
                        continue;
                }

+               if ((af == AF_INET6) &&
+                   (((struct in6_ifaddr *)ia)->ia6_flags &
+                   (IN6_IFF_ANYCAST | IN6_IFF_NOTREADY | IN6_IFF_DETACHED |
+                   IN6_IFF_CLAT46 | IN6_IFF_TEMPORARY | IN6_IFF_DEPRECATED))) {
+                       IFA_UNLOCK(ia);
+                       continue;
+               }

                if (flags & PFI_AFLAG_NOALIAS) {
                        if (af == AF_INET && got4) {
                                IFA_UNLOCK(ia);
                if (flags & PFI_AFLAG_NOALIAS) {
                        if (af == AF_INET && got4) {
                                IFA_UNLOCK(ia);


@@ -472,86 +500,95 @@ pfi_instance_add(struct ifnet *ifp, int net, int flags)
                                continue;
                        }
                }
                                continue;
                        }
                }

-               if (af == AF_INET)
+               if (af == AF_INET) {

                        got4 = 1;
                        got4 = 1;

-               else if (af == AF_INET6)
+               } else if (af == AF_INET6) {

                        got6 = 1;
                        got6 = 1;

+               }

                net2 = net;
                if (net2 == 128 && (flags & PFI_AFLAG_NETWORK)) {
                net2 = net;
                if (net2 == 128 && (flags & PFI_AFLAG_NETWORK)) {

-                       if (af == AF_INET)
+                       if (af == AF_INET) {

                                net2 = pfi_unmask(&((struct sockaddr_in *)
                                    (void *)ia->ifa_netmask)->sin_addr);
                                net2 = pfi_unmask(&((struct sockaddr_in *)
                                    (void *)ia->ifa_netmask)->sin_addr);

-                       else if (af == AF_INET6)
+                       } else if (af == AF_INET6) {

                                net2 = pfi_unmask(&((struct sockaddr_in6 *)
                                    (void *)ia->ifa_netmask)->sin6_addr);
                                net2 = pfi_unmask(&((struct sockaddr_in6 *)
                                    (void *)ia->ifa_netmask)->sin6_addr);

+                       }

                }
                }

-               if (af == AF_INET && net2 > 32)
+               if (af == AF_INET && net2 > 32) {

                        net2 = 32;
                        net2 = 32;

-               if (flags & PFI_AFLAG_BROADCAST)
+               }
+               if (flags & PFI_AFLAG_BROADCAST) {

                        pfi_address_add(ia->ifa_broadaddr, af, net2);
                        pfi_address_add(ia->ifa_broadaddr, af, net2);

-               else if (flags & PFI_AFLAG_PEER)
+               } else if (flags & PFI_AFLAG_PEER) {

                        pfi_address_add(ia->ifa_dstaddr, af, net2);
                        pfi_address_add(ia->ifa_dstaddr, af, net2);

-               else
+               } else {

                        pfi_address_add(ia->ifa_addr, af, net2);
                        pfi_address_add(ia->ifa_addr, af, net2);

+               }

                IFA_UNLOCK(ia);
        }
        ifnet_lock_done(ifp);
 }
 
 void
                IFA_UNLOCK(ia);
        }
        ifnet_lock_done(ifp);
 }
 
 void

-pfi_address_add(struct sockaddr *sa, int af, int net)
+pfi_address_add(struct sockaddr *sa, uint8_t af, uint8_t net)

 {
 {

-       struct pfr_addr *p;
-       int              i;
+       struct pfr_addr *p;
+       int              i;

 
        if (pfi_buffer_cnt >= pfi_buffer_max) {
 
        if (pfi_buffer_cnt >= pfi_buffer_max) {

-               int              new_max = pfi_buffer_max * 2;
+               int              new_max = pfi_buffer_max * 2;

 
                if (new_max > PFI_BUFFER_MAX) {
                        printf("pfi_address_add: address buffer full (%d/%d)\n",
                            pfi_buffer_cnt, PFI_BUFFER_MAX);
                        return;
                }
 
                if (new_max > PFI_BUFFER_MAX) {
                        printf("pfi_address_add: address buffer full (%d/%d)\n",
                            pfi_buffer_cnt, PFI_BUFFER_MAX);
                        return;
                }

-               p = _MALLOC(new_max * sizeof (*pfi_buffer), PFI_MTYPE,
+               p = _MALLOC(new_max * sizeof(*pfi_buffer), PFI_MTYPE,

                    M_WAITOK);
                if (p == NULL) {
                        printf("pfi_address_add: no memory to grow buffer "
                            "(%d/%d)\n", pfi_buffer_cnt, PFI_BUFFER_MAX);
                        return;
                }
                    M_WAITOK);
                if (p == NULL) {
                        printf("pfi_address_add: no memory to grow buffer "
                            "(%d/%d)\n", pfi_buffer_cnt, PFI_BUFFER_MAX);
                        return;
                }

-               memcpy(pfi_buffer, p, pfi_buffer_cnt * sizeof (*pfi_buffer));
+               memcpy(p, pfi_buffer, pfi_buffer_max * sizeof(*pfi_buffer));

                /* no need to zero buffer */
                _FREE(pfi_buffer, PFI_MTYPE);
                pfi_buffer = p;
                pfi_buffer_max = new_max;
        }
                /* no need to zero buffer */
                _FREE(pfi_buffer, PFI_MTYPE);
                pfi_buffer = p;
                pfi_buffer_max = new_max;
        }

-       if (af == AF_INET && net > 32)
+       if (af == AF_INET && net > 32) {

                net = 128;
                net = 128;

+       }

        p = pfi_buffer + pfi_buffer_cnt++;
        p = pfi_buffer + pfi_buffer_cnt++;

-       bzero(p, sizeof (*p));
+       bzero(p, sizeof(*p));

        p->pfra_af = af;
        p->pfra_net = net;
        p->pfra_af = af;
        p->pfra_net = net;

-       if (af == AF_INET)
+       if (af == AF_INET) {

                p->pfra_ip4addr = ((struct sockaddr_in *)(void *)sa)->sin_addr;
                p->pfra_ip4addr = ((struct sockaddr_in *)(void *)sa)->sin_addr;

-       else if (af == AF_INET6) {
+       } else if (af == AF_INET6) {

                p->pfra_ip6addr =
                    ((struct sockaddr_in6 *)(void *)sa)->sin6_addr;
                p->pfra_ip6addr =
                    ((struct sockaddr_in6 *)(void *)sa)->sin6_addr;

-               if (IN6_IS_SCOPE_EMBED(&p->pfra_ip6addr))
+               if (IN6_IS_SCOPE_EMBED(&p->pfra_ip6addr)) {

                        p->pfra_ip6addr.s6_addr16[1] = 0;
                        p->pfra_ip6addr.s6_addr16[1] = 0;

+               }

        }
        /* mask network address bits */
        }
        /* mask network address bits */

-       if (net < 128)
-               ((caddr_t)p)[p->pfra_net/8] &= ~(0xFF >> (p->pfra_net%8));
-       for (i = (p->pfra_net+7)/8; i < (int)sizeof (p->pfra_u); i++)
+       if (net < 128) {
+               ((caddr_t)p)[p->pfra_net / 8] &= ~(0xFF >> (p->pfra_net % 8));
+       }
+       for (i = (p->pfra_net + 7) / 8; i < (int)sizeof(p->pfra_u); i++) {

                ((caddr_t)p)[i] = 0;
                ((caddr_t)p)[i] = 0;

+       }

 }
 
 void
 pfi_dynaddr_remove(struct pf_addr_wrap *aw)
 {
        if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL ||
 }
 
 void
 pfi_dynaddr_remove(struct pf_addr_wrap *aw)
 {
        if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL ||

-           aw->p.dyn->pfid_kif == NULL || aw->p.dyn->pfid_kt == NULL)
+           aw->p.dyn->pfid_kif == NULL || aw->p.dyn->pfid_kt == NULL) {

                return;
                return;

+       }

 
        TAILQ_REMOVE(&aw->p.dyn->pfid_kif->pfik_dynaddrs, aw->p.dyn, entry);
        pfi_kif_unref(aw->p.dyn->pfid_kif, PFI_KIF_REF_RULE);
 
        TAILQ_REMOVE(&aw->p.dyn->pfid_kif->pfik_dynaddrs, aw->p.dyn, entry);
        pfi_kif_unref(aw->p.dyn->pfid_kif, PFI_KIF_REF_RULE);


@@ -566,15 +603,16 @@ void
 pfi_dynaddr_copyout(struct pf_addr_wrap *aw)
 {
        if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL ||
 pfi_dynaddr_copyout(struct pf_addr_wrap *aw)
 {
        if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL ||

-           aw->p.dyn->pfid_kif == NULL)
+           aw->p.dyn->pfid_kif == NULL) {

                return;
                return;

+       }

        aw->p.dyncnt = aw->p.dyn->pfid_acnt4 + aw->p.dyn->pfid_acnt6;
 }
 
 void
 pfi_kifaddr_update(void *v)
 {
        aw->p.dyncnt = aw->p.dyn->pfid_acnt4 + aw->p.dyn->pfid_acnt6;
 }
 
 void
 pfi_kifaddr_update(void *v)
 {

-       struct pfi_kif          *kif = (struct pfi_kif *)v;
+       struct pfi_kif          *kif = (struct pfi_kif *)v;

 
        LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
 
        LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 


@@ -585,38 +623,42 @@ pfi_kifaddr_update(void *v)
 int
 pfi_if_compare(struct pfi_kif *p, struct pfi_kif *q)
 {
 int
 pfi_if_compare(struct pfi_kif *p, struct pfi_kif *q)
 {

-       return (strncmp(p->pfik_name, q->pfik_name, IFNAMSIZ));
+       return strncmp(p->pfik_name, q->pfik_name, IFNAMSIZ - 1);

 }
 
 void
 pfi_update_status(const char *name, struct pf_status *pfs)
 {
 }
 
 void
 pfi_update_status(const char *name, struct pf_status *pfs)
 {

-       struct pfi_kif          *p;
-       struct pfi_kif_cmp       key;
-       int                      i, j, k;
+       struct pfi_kif          *p;
+       struct pfi_kif       key;
+       int                      i, j, k;

 
        LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
 
        LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 

-       strlcpy(key.pfik_name, name, sizeof (key.pfik_name));
-       p = RB_FIND(pfi_ifhead, &pfi_ifs, (struct pfi_kif *)(void *)&key);
-       if (p == NULL)
+       bzero(&key.pfik_name, sizeof(key.pfik_name));
+       strlcpy(key.pfik_name, name, sizeof(key.pfik_name));
+       p = RB_FIND(pfi_ifhead, &pfi_ifs, &key);
+       if (p == NULL) {

                return;
                return;

+       }

 
        if (pfs != NULL) {
 
        if (pfs != NULL) {

-               bzero(pfs->pcounters, sizeof (pfs->pcounters));
-               bzero(pfs->bcounters, sizeof (pfs->bcounters));
-               for (i = 0; i < 2; i++)
-                       for (j = 0; j < 2; j++)
+               bzero(pfs->pcounters, sizeof(pfs->pcounters));
+               bzero(pfs->bcounters, sizeof(pfs->bcounters));
+               for (i = 0; i < 2; i++) {
+                       for (j = 0; j < 2; j++) {

                                for (k = 0; k < 2; k++) {
                                        pfs->pcounters[i][j][k] +=
                                for (k = 0; k < 2; k++) {
                                        pfs->pcounters[i][j][k] +=

-                                               p->pfik_packets[i][j][k];
+                                           p->pfik_packets[i][j][k];

                                        pfs->bcounters[i][j] +=
                                        pfs->bcounters[i][j] +=

-                                               p->pfik_bytes[i][j][k];
+                                           p->pfik_bytes[i][j][k];

                                }
                                }

+                       }
+               }

        } else {
                /* just clear statistics */
        } else {
                /* just clear statistics */

-               bzero(p->pfik_packets, sizeof (p->pfik_packets));
-               bzero(p->pfik_bytes, sizeof (p->pfik_bytes));
+               bzero(p->pfik_packets, sizeof(p->pfik_packets));
+               bzero(p->pfik_bytes, sizeof(p->pfik_bytes));

                p->pfik_tzero = pf_calendar_time_second();
        }
 }
                p->pfik_tzero = pf_calendar_time_second();
        }
 }


@@ -624,98 +666,107 @@ pfi_update_status(const char *name, struct pf_status *pfs)
 int
 pfi_get_ifaces(const char *name, user_addr_t buf, int *size)
 {
 int
 pfi_get_ifaces(const char *name, user_addr_t buf, int *size)
 {

-       struct pfi_kif   *p, *nextp;
-       int              n = 0;
+       struct pfi_kif   *p, *nextp;
+       int              n = 0;

 
        LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        for (p = RB_MIN(pfi_ifhead, &pfi_ifs); p; p = nextp) {
                nextp = RB_NEXT(pfi_ifhead, &pfi_ifs, p);
 
        LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        for (p = RB_MIN(pfi_ifhead, &pfi_ifs); p; p = nextp) {
                nextp = RB_NEXT(pfi_ifhead, &pfi_ifs, p);

-               if (pfi_skip_if(name, p))
+               if (pfi_skip_if(name, p)) {

                        continue;
                        continue;

+               }

                if (*size > n++) {
                        struct pfi_uif u;
 
                if (*size > n++) {
                        struct pfi_uif u;
 

-                       if (!p->pfik_tzero)
+                       if (!p->pfik_tzero) {

                                p->pfik_tzero = pf_calendar_time_second();
                                p->pfik_tzero = pf_calendar_time_second();

+                       }

                        pfi_kif_ref(p, PFI_KIF_REF_RULE);
 
                        /* return the user space version of pfi_kif */
                        pfi_kif_ref(p, PFI_KIF_REF_RULE);
 
                        /* return the user space version of pfi_kif */

-                       bzero(&u, sizeof (u));
-                       bcopy(p->pfik_name, &u.pfik_name, sizeof (u.pfik_name));
+                       bzero(&u, sizeof(u));
+                       bcopy(p->pfik_name, &u.pfik_name, sizeof(u.pfik_name));

                        bcopy(p->pfik_packets, &u.pfik_packets,
                        bcopy(p->pfik_packets, &u.pfik_packets,

-                           sizeof (u.pfik_packets));
+                           sizeof(u.pfik_packets));

                        bcopy(p->pfik_bytes, &u.pfik_bytes,
                        bcopy(p->pfik_bytes, &u.pfik_bytes,

-                           sizeof (u.pfik_bytes));
+                           sizeof(u.pfik_bytes));

                        u.pfik_tzero = p->pfik_tzero;
                        u.pfik_flags = p->pfik_flags;
                        u.pfik_states = p->pfik_states;
                        u.pfik_rules = p->pfik_rules;
 
                        u.pfik_tzero = p->pfik_tzero;
                        u.pfik_flags = p->pfik_flags;
                        u.pfik_states = p->pfik_states;
                        u.pfik_rules = p->pfik_rules;
 

-                       if (copyout(&u, buf, sizeof (u))) {
+                       if (copyout(&u, buf, sizeof(u))) {

                                pfi_kif_unref(p, PFI_KIF_REF_RULE);
                                pfi_kif_unref(p, PFI_KIF_REF_RULE);

-                               return (EFAULT);
+                               return EFAULT;

                        }
                        }

-                       buf += sizeof (u);
+                       buf += sizeof(u);

                        nextp = RB_NEXT(pfi_ifhead, &pfi_ifs, p);
                        pfi_kif_unref(p, PFI_KIF_REF_RULE);
                }
        }
        *size = n;
                        nextp = RB_NEXT(pfi_ifhead, &pfi_ifs, p);
                        pfi_kif_unref(p, PFI_KIF_REF_RULE);
                }
        }
        *size = n;

-       return (0);
+       return 0;

 }
 
 int
 pfi_skip_if(const char *filter, struct pfi_kif *p)
 {
 }
 
 int
 pfi_skip_if(const char *filter, struct pfi_kif *p)
 {

-       int     n;
+       size_t     n;

 
 

-       if (filter == NULL || !*filter)
-               return (0);
-       if (strcmp(p->pfik_name, filter) == 0)
-               return (0);     /* exact match */
+       if (filter == NULL || !*filter) {
+               return 0;
+       }
+       if (strcmp(p->pfik_name, filter) == 0) {
+               return 0;     /* exact match */
+       }

        n = strlen(filter);
        n = strlen(filter);

-       if (n < 1 || n >= IFNAMSIZ)
-               return (1);     /* sanity check */
-       if (filter[n-1] >= '0' && filter[n-1] <= '9')
-               return (1);     /* only do exact match in that case */
-       if (strncmp(p->pfik_name, filter, n))
-               return (1);     /* prefix doesn't match */
-       return (p->pfik_name[n] < '0' || p->pfik_name[n] > '9');
+       if (n < 1 || n >= IFNAMSIZ) {
+               return 1;     /* sanity check */
+       }
+       if (filter[n - 1] >= '0' && filter[n - 1] <= '9') {
+               return 1;     /* only do exact match in that case */
+       }
+       if (strncmp(p->pfik_name, filter, n)) {
+               return 1;     /* prefix doesn't match */
+       }
+       return p->pfik_name[n] < '0' || p->pfik_name[n] > '9';

 }
 
 int
 pfi_set_flags(const char *name, int flags)
 {
 }
 
 int
 pfi_set_flags(const char *name, int flags)
 {

-       struct pfi_kif  *p;
+       struct pfi_kif  *p;

 
        LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        RB_FOREACH(p, pfi_ifhead, &pfi_ifs) {
 
        LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        RB_FOREACH(p, pfi_ifhead, &pfi_ifs) {

-               if (pfi_skip_if(name, p))
+               if (pfi_skip_if(name, p)) {

                        continue;
                        continue;

+               }

                p->pfik_flags |= flags;
        }
                p->pfik_flags |= flags;
        }

-       return (0);
+       return 0;

 }
 
 int
 pfi_clear_flags(const char *name, int flags)
 {
 }
 
 int
 pfi_clear_flags(const char *name, int flags)
 {

-       struct pfi_kif  *p;
+       struct pfi_kif  *p;

 
        LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        RB_FOREACH(p, pfi_ifhead, &pfi_ifs) {
 
        LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        RB_FOREACH(p, pfi_ifhead, &pfi_ifs) {

-               if (pfi_skip_if(name, p))
+               if (pfi_skip_if(name, p)) {

                        continue;
                        continue;

+               }

                p->pfik_flags &= ~flags;
        }
                p->pfik_flags &= ~flags;
        }

-       return (0);
+       return 0;

 }
 
 /* from pf_print_state.c */
 }
 
 /* from pf_print_state.c */

-int
+uint8_t

 pfi_unmask(void *addr)
 {
        struct pf_addr *m = addr;
 pfi_unmask(void *addr)
 {
        struct pf_addr *m = addr;


@@ -728,8 +779,10 @@ pfi_unmask(void *addr)
        }
        if (j < 4) {
                tmp = ntohl(m->addr32[j]);
        }
        if (j < 4) {
                tmp = ntohl(m->addr32[j]);

-               for (i = 31; tmp & (1 << i); --i)
+               for (i = 31; tmp & (1 << i); --i) {

                        b++;
                        b++;

+               }

        }
        }

-       return (b);
+       VERIFY(b >= 0 && b <= UINT8_MAX);
+       return (uint8_t)b;

 }
 }