bsd/net/pf_table.c

119 #define	KENTRY_NETWORK(ke)	((ke)->pfrke_net < AF_BITS((ke)->pfrke_af))
120 #define KENTRY_RNF_ROOT(ke) \
121 		((((struct radix_node *)(ke))->rn_flags & RNF_ROOT) != 0)
165 static void pfr_copyout_addr(struct pfr_addr *, struct pfr_kentry *ke);
794 	struct pfr_kentry	*ke;
810 		ke = (struct pfr_kentry *)rn_lookup(&sa, &mask, head);
811 		if (ke && KENTRY_RNF_ROOT(ke))
812 			ke = NULL;
814 		ke = (struct pfr_kentry *)rn_match(&sa, head);
815 		if (ke && KENTRY_RNF_ROOT(ke))
816 			ke = NULL;
817 		if (exact && ke && KENTRY_NETWORK(ke))
818 			ke = NULL;
820 	return (ke);
826 	struct pfr_kentry	*ke;
829 		ke = pool_get(&pfr_kentry_pl2, PR_WAITOK);
831 		ke = pool_get(&pfr_kentry_pl, PR_WAITOK);
832 	if (ke == NULL)
834 	bzero(ke, sizeof (*ke));
837 		FILLIN_SIN(ke->pfrke_sa.sin, ad->pfra_ip4addr);
839 		FILLIN_SIN6(ke->pfrke_sa.sin6, ad->pfra_ip6addr);
840 	ke->pfrke_af = ad->pfra_af;
841 	ke->pfrke_net = ad->pfra_net;
842 	ke->pfrke_not = ad->pfra_not;
843 	ke->pfrke_intrpool = intr;
844 	return (ke);
859 pfr_destroy_kentry(struct pfr_kentry *ke)
861 	if (ke->pfrke_intrpool)
862 		pool_put(&pfr_kentry_pl2, ke);
864 		pool_put(&pfr_kentry_pl, ke);
993 pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
1001 	bzero(ke->pfrke_node, sizeof (ke->pfrke_node));
1002 	if (ke->pfrke_af == AF_INET)
1004 	else if (ke->pfrke_af == AF_INET6)
1009 	if (KENTRY_NETWORK(ke)) {
1010 		pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
1011 		rn = rn_addroute(&ke->pfrke_sa, &mask, head, ke->pfrke_node);
1013 		rn = rn_addroute(&ke->pfrke_sa, NULL, head, ke->pfrke_node);
1019 pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
1027 	if (ke->pfrke_af == AF_INET)
1029 	else if (ke->pfrke_af == AF_INET6)
1034 	if (KENTRY_NETWORK(ke)) {
1035 		pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
1036 		rn = rn_delete(&ke->pfrke_sa, &mask, head);
1038 		rn = rn_delete(&ke->pfrke_sa, NULL, head);
1048 pfr_copyout_addr(struct pfr_addr *ad, struct pfr_kentry *ke)
1051 	if (ke == NULL)
1053 	ad->pfra_af = ke->pfrke_af;
1054 	ad->pfra_net = ke->pfrke_net;
1055 	ad->pfra_not = ke->pfrke_not;
1057 		ad->pfra_ip4addr = ke->pfrke_sa.sin.sin_addr;
1059 		ad->pfra_ip6addr = ke->pfrke_sa.sin6.sin6_addr;
1065 	struct pfr_kentry	*ke = (struct pfr_kentry *)rn;
1073 		ke->pfrke_mark = 0;
1076 		if (ke->pfrke_mark)
1080 		SLIST_INSERT_HEAD(w->pfrw_workq, ke, pfrke_workq);
1087 			pfr_copyout_addr(&ad, ke);
1097 			pfr_copyout_addr(&as.pfras_a, ke);
1099 			bcopy(ke->pfrke_packets, as.pfras_packets,
1101 			bcopy(ke->pfrke_bytes, as.pfras_bytes,
1103 			as.pfras_tzero = ke->pfrke_tzero;
1111 		if (ke->pfrke_not)
1114 			w->pfrw_kentry = ke;
1119 		if (ke->pfrke_af == AF_INET) {
1122 			pfr_prepare_network(&pfr_mask, AF_INET, ke->pfrke_net);
1124 			    &ke->pfrke_sa, AF_INET);
1127 		} else if (ke->pfrke_af == AF_INET6) {
1130 			pfr_prepare_network(&pfr_mask, AF_INET6, ke->pfrke_net);
1132 			    &ke->pfrke_sa, AF_INET6);
2014 	struct pfr_kentry	*ke = NULL;
2028 		ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4);
2029 		if (ke && KENTRY_RNF_ROOT(ke))
2030 			ke = NULL;
2036 		ke = (struct pfr_kentry *)rn_match(&pfr_sin6, kt->pfrkt_ip6);
2037 		if (ke && KENTRY_RNF_ROOT(ke))
2038 			ke = NULL;
2042 	match = (ke && !ke->pfrke_not);
2054 	struct pfr_kentry	*ke = NULL;
2067 		ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4);
2068 		if (ke && KENTRY_RNF_ROOT(ke))
2069 			ke = NULL;
2075 		ke = (struct pfr_kentry *)rn_match(&pfr_sin6, kt->pfrkt_ip6);
2076 		if (ke && KENTRY_RNF_ROOT(ke))
2077 			ke = NULL;
2083 	if ((ke == NULL || ke->pfrke_not) != notrule) {
2090 	if (ke != NULL && op_pass != PFR_OP_XPASS) {
2091 		ke->pfrke_packets[dir_out][op_pass]++;
2092 		ke->pfrke_bytes[dir_out][op_pass] += len;
2150 	struct pfr_kentry	*ke, *ke2;
2177 	ke = pfr_kentry_byidx(kt, idx, af);
2178 	if (ke == NULL) {
2182 	pfr_prepare_network(&pfr_mask, af, ke->pfrke_net);
2183 	*raddr = SUNION2PF(&ke->pfrke_sa, af);
2200 	if (!KENTRY_NETWORK(ke)) {
2218 		if (ke2 == ke) {