bsd/net/pf.c

376 pf_state_lookup_aux(struct pf_state **state, struct pfi_kif *kif,
389 	    (*state)->rt_kif != NULL && (*state)->rt_kif != kif) {
400 		*state = pf_find_state(kif, &key, direction);		 \
405 		if (pf_state_lookup_aux(state, kif, direction, &action)) \
1110 pf_find_state(struct pfi_kif *kif, struct pf_state_key_cmp *key, u_int dir)
1133 			if (s->kif == pfi_all || s->kif == kif)
1368 pf_stateins_err(const char *tree, struct pf_state *s, struct pfi_kif *kif)
1373 		printf("pf: state insert failed: %s %s ", tree, kif->pfik_name);
1407 pf_insert_state(struct pfi_kif *kif, struct pf_state *s)
1413 	s->kif = kif;
1417 		/* key exists. check for same kif, if none, add to key */
1419 			if (sp->kif == kif) {	/* collision! */
1420 				pf_stateins_err("tree_lan_ext", s, kif);
1426 		pf_attach_state(cur, s, kif == pfi_all ? 1 : 0);
1433 		pf_stateins_err("tree_ext_gwy", s, kif);
1458 	pfi_kif_ref(kif, PFI_KIF_REF_STATE);
1687 	pfi_kif_unref(cur->kif, PFI_KIF_REF_STATE);
1945 		if (cur->kif != prev->kif || cur->ifnot != prev->ifnot)
3168 pf_get_sport(struct pf_pdesc *pd, struct pfi_kif *kif, struct pf_rule *r,
3173 #pragma unused(kif)
3337     int direction, struct pfi_kif *kif, struct pf_addr *saddr,
3373 		if (pfi_kif_match(r->kif, kif) == r->ifnot)
3384 		    src->neg, kif))
3434     int direction, struct pfi_kif *kif, struct pf_src_node **sn,
3442 		r = pf_match_translation(pd, m, off, direction, kif, saddr,
3445 			r = pf_match_translation(pd, m, off, direction, kif,
3448 			r = pf_match_translation(pd, m, off, direction, kif,
3451 		r = pf_match_translation(pd, m, off, direction, kif, saddr,
3454 			r = pf_match_translation(pd, m, off, direction, kif,
3465 			if (pf_get_sport(pd, kif, r, saddr, sxport, daddr,
3896 		s->rt_kif = r->rpool.cur->kif;
3903 		s->rt_kif = r->rpool.cur->kif;
4004     struct pfi_kif *kif, struct mbuf *m, int off, void *h,
4105 		if ((nr = pf_get_translation_aux(pd, m, off, PF_OUT, kif, &nsn,
4203 		if ((nr = pf_get_translation_aux(pd, m, off, PF_IN, kif, &nsn,
4302 		if (pfi_kif_match(r->kif, kif) == r->ifnot)
4311 		    r->src.neg, kif))
4413 		PFLOG_PACKET(kif, h, m, af, direction, reason, r->log ? r : nr,
4609 				    r->return_ttl, 1, 0, pd->eh, kif->pfik_ifp);
4753 			s0 = pf_find_state(kif, &sk0, PF_IN);
4991 		if (pf_insert_state(BOUND_IFACE(r, kif), s)) {
5054 				    pd, kif);
5090 pf_test_dummynet(struct pf_rule **rm, int direction, struct pfi_kif *kif,
5169 		if (pfi_kif_match(r->kif, kif) == r->ifnot)
5178 		    r->src.neg, kif))
5260 		PFLOG_PACKET(kif, h, m, af, direction, reason, r,
5350 pf_test_fragment(struct pf_rule **rm, int direction, struct pfi_kif *kif,
5366 		if (pfi_kif_match(r->kif, kif) == r->ifnot)
5375 		    r->src.neg, kif))
5430 		PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset,
5446     struct pf_pdesc *pd, struct pfi_kif *kif)
5724 		if (pf_insert_state(BOUND_IFACE(s->rule.ptr, kif), gs)) {
5790 pf_test_state_tcp(struct pf_state **state, int direction, struct pfi_kif *kif,
6242 				    pd->eh, kif->pfik_ifp);
6276 		    off + (th->th_off << 2), pd, kif);
6314 pf_test_state_udp(struct pf_state **state, int direction, struct pfi_kif *kif,
6374 	*state = pf_find_state(kif, &key, dx);
6378 		*state = pf_find_state(kif, &key, dx);
6383 		*state = pf_find_state(kif, &key, dx);
6390 	if (pf_state_lookup_aux(state, kif, direction, &action))
6425 		    off + uh->uh_ulen, pd, kif);
6458 pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif,
6885 			*state = pf_find_state(kif, &key, dx);
6889 				*state = pf_find_state(kif, &key, dx);
6894 				*state = pf_find_state(kif, &key, dx);
6899 				*state = pf_find_state(kif, &key, dx);
6906 			if (pf_state_lookup_aux(state, kif, direction, &action))
7126     struct pfi_kif *kif, int off, struct pf_pdesc *pd)
7226 pf_test_state_esp(struct pf_state **state, int direction, struct pfi_kif *kif,
7249 	*state = pf_find_state(kif, &key, direction);
7263 			s = pf_find_state(kif, &key, direction);
7281 			s = pf_find_state(kif, &key, direction);
7318 	if (pf_state_lookup_aux(state, kif, direction, &action))
7384 pf_test_state_other(struct pf_state **state, int direction, struct pfi_kif *kif,
7522 pf_routable(struct pf_addr *addr, sa_family_t af, struct pfi_kif *kif)
7524 #pragma unused(kif)
7556 	if (kif != NULL && kif->pfik_ifp->if_type == IFT_ENC)
7685 			ifp = r->rpool.cur->kif ?
7686 			    r->rpool.cur->kif->pfik_ifp : NULL;
7895 		ifp = r->rpool.cur->kif ? r->rpool.cur->kif->pfik_ifp : NULL;
8052 	struct pfi_kif		*kif;
8079 	kif = (struct pfi_kif *)ifp->if_pf_kif;
8081 	if (kif == NULL) {
8083 		    ("pf_test: kif == NULL, if_name %s\n", ifp->if_name));
8086 	if (kif->pfik_flags & PFI_IFLAG_SKIP)
8123 	action = pf_normalize_ip(m0, dir, kif, &reason, &pd);
8169 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8175 		action = pf_test_fragment(&r, dir, kif, m, h,
8195 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8201 		action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd);
8207 		action = pf_test_state_tcp(&s, dir, kif, m, off, h, &pd,
8220 			action = pf_test_rule(&r, &s, dir, kif,
8243 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8249 		action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd,
8262 			action = pf_test_rule(&r, &s, dir, kif,
8278 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8284 		action = pf_test_state_icmp(&s, dir, kif, m, off, h, &pd,
8297 			action = pf_test_rule(&r, &s, dir, kif,
8313 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8319 		action = pf_test_state_esp(&s, dir, kif, off, &pd);
8331 			action = pf_test_rule(&r, &s, dir, kif,
8346 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8361 			action = pf_test_state_grev1(&s, dir, kif, off, &pd);
8373 				action = pf_test_rule(&r, &s, dir, kif, m, off,
8386 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8392 		action = pf_test_state_other(&s, dir, kif, &pd);
8404 			action = pf_test_rule(&r, &s, dir, kif, m, off, h,
8469 		PFLOG_PACKET(kif, h, m, AF_INET, dir, reason, lr, a, ruleset,
8473 	kif->pfik_bytes[0][dir == PF_OUT][action != PF_PASS] += pd.tot_len;
8474 	kif->pfik_packets[0][dir == PF_OUT][action != PF_PASS]++;
8562 		pf_route(m0, r, dir, kif->pfik_ifp, s, &pd);
8586 	struct pfi_kif		*kif;
8614 	kif = (struct pfi_kif *)ifp->if_pf_kif;
8616 	if (kif == NULL) {
8618 		    ("pf_test6: kif == NULL, if_name %s\n", ifp->if_name));
8621 	if (kif->pfik_flags & PFI_IFLAG_SKIP)
8667 	action = pf_normalize_ip6(m0, dir, kif, &reason, &pd);
8725 			action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8731 			action = pf_test_fragment(&r, dir, kif, m, h, &pd, &a,
8789 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8795 		action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd);
8801 		action = pf_test_state_tcp(&s, dir, kif, m, off, h, &pd,
8814 			action = pf_test_rule(&r, &s, dir, kif,
8837 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8843 		action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd,
8856 			action = pf_test_rule(&r, &s, dir, kif,
8872 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8878 		action = pf_test_state_icmp(&s, dir, kif,
8891 			action = pf_test_rule(&r, &s, dir, kif,
8907 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8913 		action = pf_test_state_esp(&s, dir, kif, off, &pd);
8925 			action = pf_test_rule(&r, &s, dir, kif,
8941 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8955 			action = pf_test_state_grev1(&s, dir, kif, off, &pd);
8968 				action = pf_test_rule(&r, &s, dir, kif, m, off,
8981 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8987 		action = pf_test_state_other(&s, dir, kif, &pd);
8999 			action = pf_test_rule(&r, &s, dir, kif, m, off, h,
9063 		PFLOG_PACKET(kif, h, m, AF_INET6, dir, reason, lr, a, ruleset,
9067 	kif->pfik_bytes[1][dir == PF_OUT][action != PF_PASS] += pd.tot_len;
9068 	kif->pfik_packets[1][dir == PF_OUT][action != PF_PASS]++;
9139 		pf_route6(m0, r, dir, kif->pfik_ifp, s, &pd);
9169 		pf_route6(m0, r, dir, kif->pfik_ifp, s, &pd);