netpfil/pf/pf_table.c

88 #define	KENTRY_NETWORK(ke)	((ke)->pfrke_net < AF_BITS((ke)->pfrke_af))
89 #define	KENTRY_RNF_ROOT(ke) \
90 		((((struct radix_node *)(ke))->rn_flags & RNF_ROOT) != 0)
137 			    const struct pfr_kentry *ke);
754 	struct pfr_kentry	*ke;
768 		ke = (struct pfr_kentry *)rn_lookup(&sa, &mask, head);
769 		if (ke && KENTRY_RNF_ROOT(ke))
770 			ke = NULL;
772 		ke = (struct pfr_kentry *)rn_match(&sa, head);
773 		if (ke && KENTRY_RNF_ROOT(ke))
774 			ke = NULL;
775 		if (exact && ke && KENTRY_NETWORK(ke))
776 			ke = NULL;
778 	return (ke);
782 pfr_create_kentry_counter(struct pfr_kentry *ke, int pfr_dir, int pfr_op)
789 	ke->pfrke_counters.pfrkc_packets[pfr_dir][pfr_op] = c;
793 	ke->pfrke_counters.pfrkc_bytes[pfr_dir][pfr_op] = c;
800 	struct pfr_kentry	*ke;
803 	ke = uma_zalloc(V_pfr_kentry_z, M_NOWAIT | M_ZERO);
804 	if (ke == NULL)
808 		FILLIN_SIN(ke->pfrke_sa.sin, ad->pfra_ip4addr);
810 		FILLIN_SIN6(ke->pfrke_sa.sin6, ad->pfra_ip6addr);
811 	ke->pfrke_af = ad->pfra_af;
812 	ke->pfrke_net = ad->pfra_net;
813 	ke->pfrke_not = ad->pfra_not;
814 	ke->pfrke_counters.pfrkc_tzero = 0;
818 				if (!pfr_create_kentry_counter(ke, pfr_dir,
820 					pfr_destroy_kentry(ke);
824 	return (ke);
850 pfr_destroy_kentry(struct pfr_kentry *ke)
856 			pfr_destroy_kentry_counter(&ke->pfrke_counters,
859 	uma_zfree(V_pfr_kentry_z, ke);
993 pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
1001 	bzero(ke->pfrke_node, sizeof(ke->pfrke_node));
1002 	if (ke->pfrke_af == AF_INET)
1004 	else if (ke->pfrke_af == AF_INET6)
1007 	if (KENTRY_NETWORK(ke)) {
1008 		pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
1009 		rn = rn_addroute(&ke->pfrke_sa, &mask, head, ke->pfrke_node);
1011 		rn = rn_addroute(&ke->pfrke_sa, NULL, head, ke->pfrke_node);
1017 pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
1023 	if (ke->pfrke_af == AF_INET)
1025 	else if (ke->pfrke_af == AF_INET6)
1028 	if (KENTRY_NETWORK(ke)) {
1029 		pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
1030 		rn = rn_delete(&ke->pfrke_sa, &mask, head);
1032 		rn = rn_delete(&ke->pfrke_sa, NULL, head);
1042 pfr_copyout_addr(struct pfr_addr *ad, const struct pfr_kentry *ke)
1045 	if (ke == NULL)
1047 	ad->pfra_af = ke->pfrke_af;
1048 	ad->pfra_net = ke->pfrke_net;
1049 	ad->pfra_not = ke->pfrke_not;
1051 		ad->pfra_ip4addr = ke->pfrke_sa.sin.sin_addr;
1053 		ad->pfra_ip6addr = ke->pfrke_sa.sin6.sin6_addr;
1057 pfr_copyout_astats(struct pfr_astats *as, const struct pfr_kentry *ke,
1061 	const struct pfr_kcounters *kc = &ke->pfrke_counters;
1063 	pfr_copyout_addr(&as->pfras_a, ke);
1086 	struct pfr_kentry	*ke = (struct pfr_kentry *)rn;
1091 		ke->pfrke_mark = 0;
1094 		if (ke->pfrke_mark)
1098 		SLIST_INSERT_HEAD(w->pfrw_workq, ke, pfrke_workq);
1103 			pfr_copyout_addr(w->pfrw_addr, ke);
1111 			pfr_copyout_astats(&as, ke, w);
1118 		if (ke->pfrke_not)
1121 			w->pfrw_kentry = ke;
1129 		if (ke->pfrke_af == AF_INET) {
1132 			pfr_prepare_network(&pfr_mask, AF_INET, ke->pfrke_net);
1133 			w->pfrw_dyn->pfid_addr4 = *SUNION2PF(&ke->pfrke_sa,
1137 		} else if (ke->pfrke_af == AF_INET6){
1140 			pfr_prepare_network(&pfr_mask, AF_INET6, ke->pfrke_net);
1141 			w->pfrw_dyn->pfid_addr6 = *SUNION2PF(&ke->pfrke_sa,
2038 	struct pfr_kentry	*ke = NULL;
2058 		ke = (struct pfr_kentry *)rn_match(&sin, &kt->pfrkt_ip4->rh);
2059 		if (ke && KENTRY_RNF_ROOT(ke))
2060 			ke = NULL;
2073 		ke = (struct pfr_kentry *)rn_match(&sin6, &kt->pfrkt_ip6->rh);
2074 		if (ke && KENTRY_RNF_ROOT(ke))
2075 			ke = NULL;
2080 	match = (ke && !ke->pfrke_not);
2092 	struct pfr_kentry	*ke = NULL;
2109 		ke = (struct pfr_kentry *)rn_match(&sin, &kt->pfrkt_ip4->rh);
2110 		if (ke && KENTRY_RNF_ROOT(ke))
2111 			ke = NULL;
2124 		ke = (struct pfr_kentry *)rn_match(&sin6, &kt->pfrkt_ip6->rh);
2125 		if (ke && KENTRY_RNF_ROOT(ke))
2126 			ke = NULL;
2133 	if ((ke == NULL || ke->pfrke_not) != notrule) {
2141 	if (ke != NULL && op_pass != PFR_OP_XPASS &&
2143 		counter_u64_add(ke->pfrke_counters.
2145 		counter_u64_add(ke->pfrke_counters.
2206 	struct pfr_kentry	*ke, *ke2 = NULL;
2234 	ke = pfr_kentry_byidx(kt, idx, af);
2235 	if (ke == NULL) {
2239 	pfr_prepare_network(&umask, af, ke->pfrke_net);
2240 	cur = SUNION2PF(&ke->pfrke_sa, af);
2257 	if (!KENTRY_NETWORK(ke)) {
2277 		if (ke2 == ke) {