netpfil/pf/pf_table.c

215 	struct pfr_ktable	*kt;
223 	kt = pfr_lookup_table(tbl);
224 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
226 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
228 	pfr_enqueue_addrs(kt, &workq, ndel, 0);
231 		pfr_remove_kentries(kt, &workq);
232 		KASSERT(kt->pfrkt_cnt == 0, ("%s: non-null pfrkt_cnt", __func__));
241 	struct pfr_ktable	*kt, *tmpkt;
253 	kt = pfr_lookup_table(tbl);
254 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
256 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
265 		p = pfr_lookup_addr(kt, ad, 1);
292 		pfr_insert_kentries(kt, &workq, tzero);
312 	struct pfr_ktable	*kt;
323 	kt = pfr_lookup_table(tbl);
324 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
326 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
339 	for (i = kt->pfrkt_cnt; i > 0; i >>= 1)
341 	if (size > kt->pfrkt_cnt/log) {
343 		pfr_mark_addrs(kt);
349 			p = pfr_lookup_addr(kt, ad, 1);
358 		p = pfr_lookup_addr(kt, ad, 1);
377 		pfr_remove_kentries(kt, &workq);
392 	struct pfr_ktable	*kt, *tmpkt;
405 	kt = pfr_lookup_table(tbl);
406 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
408 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
413 	pfr_mark_addrs(kt);
426 		p = pfr_lookup_addr(kt, &ad, 1);
460 	pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY);
476 		pfr_insert_kentries(kt, &addq, tzero);
477 		pfr_remove_kentries(kt, &delq);
504 	struct pfr_ktable	*kt;
514 	kt = pfr_lookup_table(tbl);
515 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
523 		p = pfr_lookup_addr(kt, ad, 0);
540 	struct pfr_ktable	*kt;
549 	kt = pfr_lookup_table(tbl);
550 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
552 	if (kt->pfrkt_cnt > *size) {
553 		*size = kt->pfrkt_cnt;
560 	w.pfrw_free = kt->pfrkt_cnt;
561 	rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
563 		rv = kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree,
571 	*size = kt->pfrkt_cnt;
579 	struct pfr_ktable	*kt;
591 	kt = pfr_lookup_table(tbl);
592 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
594 	if (kt->pfrkt_cnt > *size) {
595 		*size = kt->pfrkt_cnt;
602 	w.pfrw_free = kt->pfrkt_cnt;
603 	rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
605 		rv = kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree,
608 		pfr_enqueue_addrs(kt, &workq, NULL, 0);
619 	*size = kt->pfrkt_cnt;
627 	struct pfr_ktable	*kt;
638 	kt = pfr_lookup_table(tbl);
639 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
645 		p = pfr_lookup_addr(kt, ad, 1);
702 pfr_enqueue_addrs(struct pfr_ktable *kt, struct pfr_kentryworkq *workq,
711 	if (kt->pfrkt_ip4 != NULL)
712 		if (kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree,
715 	if (kt->pfrkt_ip6 != NULL)
716 		if (kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree,
724 pfr_mark_addrs(struct pfr_ktable *kt)
730 	if (kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w))
732 	if (kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w))
738 pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact)
749 		head = kt->pfrkt_ip4;
752 		head = kt->pfrkt_ip6;
808 pfr_insert_kentries(struct pfr_ktable *kt,
815 		rv = pfr_route_kentry(kt, p);
824 	kt->pfrkt_cnt += n;
828 pfr_insert_kentry(struct pfr_ktable *kt, struct pfr_addr *ad, long tzero)
833 	p = pfr_lookup_addr(kt, ad, 1);
840 	rv = pfr_route_kentry(kt, p);
845 	kt->pfrkt_cnt++;
851 pfr_remove_kentries(struct pfr_ktable *kt,
858 		pfr_unroute_kentry(kt, p);
861 	kt->pfrkt_cnt -= n;
866 pfr_clean_node_mask(struct pfr_ktable *kt,
872 		pfr_unroute_kentry(kt, p);
927 pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
937 		head = kt->pfrkt_ip4;
939 		head = kt->pfrkt_ip6;
951 pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
958 		head = kt->pfrkt_ip4;
960 		head = kt->pfrkt_ip6;
1398 	struct pfr_ktable	*kt, *rt, *shadow, key;
1417 	kt = RB_FIND(pfr_ktablehead, &pfr_ktables, (struct pfr_ktable *)tbl);
1418 	if (kt == NULL) {
1419 		kt = pfr_create_ktable(tbl, 0, 1);
1420 		if (kt == NULL)
1422 		SLIST_INSERT_HEAD(&tableq, kt, pfrkt_workq);
1432 			kt->pfrkt_root = rt;
1441 		kt->pfrkt_root = rt;
1442 	} else if (!(kt->pfrkt_flags & PFR_TFLAG_INACTIVE))
1467 		if (kt->pfrkt_shadow != NULL)
1468 			pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1469 		kt->pfrkt_flags |= PFR_TFLAG_INACTIVE;
1473 		kt->pfrkt_shadow = shadow;
1571 pfr_commit_ktable(struct pfr_ktable *kt, long tzero)
1573 	struct pfr_ktable	*shadow = kt->pfrkt_shadow;
1579 		if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1580 			pfr_clstats_ktable(kt, tzero, 1);
1581 	} else if (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) {
1582 		/* kt might contain addresses */
1588 		pfr_mark_addrs(kt);
1597 			q = pfr_lookup_addr(kt, &ad, 1);
1609 		pfr_enqueue_addrs(kt, &delq, NULL, ENQUEUE_UNMARKED_ONLY);
1610 		pfr_insert_kentries(kt, &addq, tzero);
1611 		pfr_remove_kentries(kt, &delq);
1615 		/* kt cannot contain addresses */
1616 		SWAP(struct radix_node_head *, kt->pfrkt_ip4,
1618 		SWAP(struct radix_node_head *, kt->pfrkt_ip6,
1620 		SWAP(int, kt->pfrkt_cnt, shadow->pfrkt_cnt);
1621 		pfr_clstats_ktable(kt, tzero, 1);
1624 	    (kt->pfrkt_flags & PFR_TFLAG_SETMASK) | PFR_TFLAG_ACTIVE)
1627 	kt->pfrkt_shadow = NULL;
1628 	pfr_setflags_ktable(kt, nflags);
1698 pfr_skip_table(struct pfr_table *filter, struct pfr_ktable *kt, int flags)
1702 	if (strcmp(filter->pfrt_anchor, kt->pfrkt_anchor))
1717 pfr_insert_ktable(struct pfr_ktable *kt)
1722 	RB_INSERT(pfr_ktablehead, &pfr_ktables, kt);
1724 	if (kt->pfrkt_root != NULL)
1725 		if (!kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]++)
1726 			pfr_setflags_ktable(kt->pfrkt_root,
1727 			    kt->pfrkt_root->pfrkt_flags|PFR_TFLAG_REFDANCHOR);
1742 pfr_setflags_ktable(struct pfr_ktable *kt, int newf)
1754 		RB_REMOVE(pfr_ktablehead, &pfr_ktables, kt);
1755 		if (kt->pfrkt_root != NULL)
1756 			if (!--kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR])
1757 				pfr_setflags_ktable(kt->pfrkt_root,
1758 				    kt->pfrkt_root->pfrkt_flags &
1760 		pfr_destroy_ktable(kt, 1);
1764 	if (!(newf & PFR_TFLAG_ACTIVE) && kt->pfrkt_cnt) {
1765 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1766 		pfr_remove_kentries(kt, &addrq);
1768 	if (!(newf & PFR_TFLAG_INACTIVE) && kt->pfrkt_shadow != NULL) {
1769 		pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1770 		kt->pfrkt_shadow = NULL;
1772 	kt->pfrkt_flags = newf;
1785 pfr_clstats_ktable(struct pfr_ktable *kt, long tzero, int recurse)
1790 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1793 	bzero(kt->pfrkt_packets, sizeof(kt->pfrkt_packets));
1794 	bzero(kt->pfrkt_bytes, sizeof(kt->pfrkt_bytes));
1795 	kt->pfrkt_match = kt->pfrkt_nomatch = 0;
1796 	kt->pfrkt_tzero = tzero;
1802 	struct pfr_ktable	*kt;
1807 	kt = malloc(sizeof(*kt), M_PFTABLE, M_NOWAIT|M_ZERO);
1808 	if (kt == NULL)
1810 	kt->pfrkt_t = *tbl;
1815 			pfr_destroy_ktable(kt, 0);
1818 		kt->pfrkt_rs = rs;
1822 	if (!rn_inithead((void **)&kt->pfrkt_ip4,
1824 	    !rn_inithead((void **)&kt->pfrkt_ip6,
1826 		pfr_destroy_ktable(kt, 0);
1829 	kt->pfrkt_tzero = tzero;
1831 	return (kt);
1846 pfr_destroy_ktable(struct pfr_ktable *kt, int flushaddr)
1851 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1852 		pfr_clean_node_mask(kt, &addrq);
1855 	if (kt->pfrkt_ip4 != NULL) {
1856 		RADIX_NODE_HEAD_DESTROY(kt->pfrkt_ip4);
1857 		rn_detachhead((void **)&kt->pfrkt_ip4);
1859 	if (kt->pfrkt_ip6 != NULL) {
1860 		RADIX_NODE_HEAD_DESTROY(kt->pfrkt_ip6);
1861 		rn_detachhead((void **)&kt->pfrkt_ip6);
1863 	if (kt->pfrkt_shadow != NULL)
1864 		pfr_destroy_ktable(kt->pfrkt_shadow, flushaddr);
1865 	if (kt->pfrkt_rs != NULL) {
1866 		kt->pfrkt_rs->tables--;
1867 		pf_remove_if_empty_ruleset(kt->pfrkt_rs);
1869 	free(kt, M_PFTABLE);
1891 pfr_match_addr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af)
1898 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
1899 		kt = kt->pfrkt_root;
1900 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1913 		ke = (struct pfr_kentry *)rn_match(&sin, kt->pfrkt_ip4);
1928 		ke = (struct pfr_kentry *)rn_match(&sin6, kt->pfrkt_ip6);
1937 		kt->pfrkt_match++;
1939 		kt->pfrkt_nomatch++;
1944 pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af,
1949 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
1950 		kt = kt->pfrkt_root;
1951 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1964 		ke = (struct pfr_kentry *)rn_match(&sin, kt->pfrkt_ip4);
1979 		ke = (struct pfr_kentry *)rn_match(&sin6, kt->pfrkt_ip6);
1993 	kt->pfrkt_packets[dir_out][op_pass]++;
1994 	kt->pfrkt_bytes[dir_out][op_pass] += len;
1996 	    (kt->pfrkt_flags & PFR_TFLAG_COUNTERS)) {
2010 	struct pfr_ktable	*kt, *rt;
2020 	kt = pfr_lookup_table(&tbl);
2021 	if (kt == NULL) {
2022 		kt = pfr_create_ktable(&tbl, time_second, 1);
2023 		if (kt == NULL)
2031 					pfr_destroy_ktable(kt, 0);
2036 			kt->pfrkt_root = rt;
2038 		pfr_insert_ktable(kt);
2040 	if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++)
2041 		pfr_setflags_ktable(kt, kt->pfrkt_flags|PFR_TFLAG_REFERENCED);
2042 	return (kt);
2046 pfr_detach_table(struct pfr_ktable *kt)
2050 	KASSERT(kt->pfrkt_refcnt[PFR_REFCNT_RULE] > 0, ("%s: refcount %d\n",
2051 	    __func__, kt->pfrkt_refcnt[PFR_REFCNT_RULE]));
2053 	if (!--kt->pfrkt_refcnt[PFR_REFCNT_RULE])
2054 		pfr_setflags_ktable(kt, kt->pfrkt_flags&~PFR_TFLAG_REFERENCED);
2058 pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter,
2078 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2079 		kt = kt->pfrkt_root;
2080 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2091 	ke = pfr_kentry_byidx(kt, idx, af);
2093 		kt->pfrkt_nomatch++;
2118 		kt->pfrkt_match++;
2126 			    kt->pfrkt_ip4);
2130 			    kt->pfrkt_ip6);
2138 			kt->pfrkt_match++;
2157 pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af)
2168 		kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
2173 		kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
2182 pfr_dynaddr_update(struct pfr_ktable *kt, struct pfi_dynaddr *dyn)
2193 		kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
2195 		kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);