netpfil/pf/pf_table.c

216 	struct pfr_ktable	*kt;
224 	kt = pfr_lookup_table(tbl);
225 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
227 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
229 	pfr_enqueue_addrs(kt, &workq, ndel, 0);
232 		pfr_remove_kentries(kt, &workq);
233 		KASSERT(kt->pfrkt_cnt == 0, ("%s: non-null pfrkt_cnt", __func__));
242 	struct pfr_ktable	*kt, *tmpkt;
254 	kt = pfr_lookup_table(tbl);
255 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
257 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
266 		p = pfr_lookup_addr(kt, ad, 1);
293 		pfr_insert_kentries(kt, &workq, tzero);
313 	struct pfr_ktable	*kt;
324 	kt = pfr_lookup_table(tbl);
325 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
327 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
340 	for (i = kt->pfrkt_cnt; i > 0; i >>= 1)
342 	if (size > kt->pfrkt_cnt/log) {
344 		pfr_mark_addrs(kt);
350 			p = pfr_lookup_addr(kt, ad, 1);
359 		p = pfr_lookup_addr(kt, ad, 1);
378 		pfr_remove_kentries(kt, &workq);
393 	struct pfr_ktable	*kt, *tmpkt;
406 	kt = pfr_lookup_table(tbl);
407 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
409 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
414 	pfr_mark_addrs(kt);
427 		p = pfr_lookup_addr(kt, &ad, 1);
461 	pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY);
477 		pfr_insert_kentries(kt, &addq, tzero);
478 		pfr_remove_kentries(kt, &delq);
505 	struct pfr_ktable	*kt;
515 	kt = pfr_lookup_table(tbl);
516 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
524 		p = pfr_lookup_addr(kt, ad, 0);
541 	struct pfr_ktable	*kt;
550 	kt = pfr_lookup_table(tbl);
551 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
553 	if (kt->pfrkt_cnt > *size) {
554 		*size = kt->pfrkt_cnt;
561 	w.pfrw_free = kt->pfrkt_cnt;
562 	rv = kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
564 		rv = kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh,
572 	*size = kt->pfrkt_cnt;
580 	struct pfr_ktable	*kt;
592 	kt = pfr_lookup_table(tbl);
593 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
595 	if (kt->pfrkt_cnt > *size) {
596 		*size = kt->pfrkt_cnt;
603 	w.pfrw_free = kt->pfrkt_cnt;
604 	rv = kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
606 		rv = kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh,
609 		pfr_enqueue_addrs(kt, &workq, NULL, 0);
620 	*size = kt->pfrkt_cnt;
628 	struct pfr_ktable	*kt;
639 	kt = pfr_lookup_table(tbl);
640 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
646 		p = pfr_lookup_addr(kt, ad, 1);
703 pfr_enqueue_addrs(struct pfr_ktable *kt, struct pfr_kentryworkq *workq,
712 	if (kt->pfrkt_ip4 != NULL)
713 		if (kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh,
716 	if (kt->pfrkt_ip6 != NULL)
717 		if (kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh,
725 pfr_mark_addrs(struct pfr_ktable *kt)
731 	if (kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w))
733 	if (kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w))
739 pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact)
750 		head = &kt->pfrkt_ip4->rh;
753 		head = &kt->pfrkt_ip6->rh;
809 pfr_insert_kentries(struct pfr_ktable *kt,
816 		rv = pfr_route_kentry(kt, p);
825 	kt->pfrkt_cnt += n;
829 pfr_insert_kentry(struct pfr_ktable *kt, struct pfr_addr *ad, long tzero)
834 	p = pfr_lookup_addr(kt, ad, 1);
841 	rv = pfr_route_kentry(kt, p);
846 	kt->pfrkt_cnt++;
852 pfr_remove_kentries(struct pfr_ktable *kt,
859 		pfr_unroute_kentry(kt, p);
862 	kt->pfrkt_cnt -= n;
867 pfr_clean_node_mask(struct pfr_ktable *kt,
873 		pfr_unroute_kentry(kt, p);
928 pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
938 		head = &kt->pfrkt_ip4->rh;
940 		head = &kt->pfrkt_ip6->rh;
952 pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
959 		head = &kt->pfrkt_ip4->rh;
961 		head = &kt->pfrkt_ip6->rh;
1399 	struct pfr_ktable	*kt, *rt, *shadow, key;
1418 	kt = RB_FIND(pfr_ktablehead, &pfr_ktables, (struct pfr_ktable *)tbl);
1419 	if (kt == NULL) {
1420 		kt = pfr_create_ktable(tbl, 0, 1);
1421 		if (kt == NULL)
1423 		SLIST_INSERT_HEAD(&tableq, kt, pfrkt_workq);
1433 			kt->pfrkt_root = rt;
1442 		kt->pfrkt_root = rt;
1443 	} else if (!(kt->pfrkt_flags & PFR_TFLAG_INACTIVE))
1468 		if (kt->pfrkt_shadow != NULL)
1469 			pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1470 		kt->pfrkt_flags |= PFR_TFLAG_INACTIVE;
1474 		kt->pfrkt_shadow = shadow;
1572 pfr_commit_ktable(struct pfr_ktable *kt, long tzero)
1574 	struct pfr_ktable	*shadow = kt->pfrkt_shadow;
1580 		if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1581 			pfr_clstats_ktable(kt, tzero, 1);
1582 	} else if (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) {
1583 		/* kt might contain addresses */
1589 		pfr_mark_addrs(kt);
1598 			q = pfr_lookup_addr(kt, &ad, 1);
1610 		pfr_enqueue_addrs(kt, &delq, NULL, ENQUEUE_UNMARKED_ONLY);
1611 		pfr_insert_kentries(kt, &addq, tzero);
1612 		pfr_remove_kentries(kt, &delq);
1616 		/* kt cannot contain addresses */
1617 		SWAP(struct radix_node_head *, kt->pfrkt_ip4,
1619 		SWAP(struct radix_node_head *, kt->pfrkt_ip6,
1621 		SWAP(int, kt->pfrkt_cnt, shadow->pfrkt_cnt);
1622 		pfr_clstats_ktable(kt, tzero, 1);
1625 	    (kt->pfrkt_flags & PFR_TFLAG_SETMASK) | PFR_TFLAG_ACTIVE)
1628 	kt->pfrkt_shadow = NULL;
1629 	pfr_setflags_ktable(kt, nflags);
1699 pfr_skip_table(struct pfr_table *filter, struct pfr_ktable *kt, int flags)
1703 	if (strcmp(filter->pfrt_anchor, kt->pfrkt_anchor))
1718 pfr_insert_ktable(struct pfr_ktable *kt)
1723 	RB_INSERT(pfr_ktablehead, &pfr_ktables, kt);
1725 	if (kt->pfrkt_root != NULL)
1726 		if (!kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]++)
1727 			pfr_setflags_ktable(kt->pfrkt_root,
1728 			    kt->pfrkt_root->pfrkt_flags|PFR_TFLAG_REFDANCHOR);
1743 pfr_setflags_ktable(struct pfr_ktable *kt, int newf)
1755 		RB_REMOVE(pfr_ktablehead, &pfr_ktables, kt);
1756 		if (kt->pfrkt_root != NULL)
1757 			if (!--kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR])
1758 				pfr_setflags_ktable(kt->pfrkt_root,
1759 				    kt->pfrkt_root->pfrkt_flags &
1761 		pfr_destroy_ktable(kt, 1);
1765 	if (!(newf & PFR_TFLAG_ACTIVE) && kt->pfrkt_cnt) {
1766 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1767 		pfr_remove_kentries(kt, &addrq);
1769 	if (!(newf & PFR_TFLAG_INACTIVE) && kt->pfrkt_shadow != NULL) {
1770 		pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1771 		kt->pfrkt_shadow = NULL;
1773 	kt->pfrkt_flags = newf;
1786 pfr_clstats_ktable(struct pfr_ktable *kt, long tzero, int recurse)
1791 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1794 	bzero(kt->pfrkt_packets, sizeof(kt->pfrkt_packets));
1795 	bzero(kt->pfrkt_bytes, sizeof(kt->pfrkt_bytes));
1796 	kt->pfrkt_match = kt->pfrkt_nomatch = 0;
1797 	kt->pfrkt_tzero = tzero;
1803 	struct pfr_ktable	*kt;
1808 	kt = malloc(sizeof(*kt), M_PFTABLE, M_NOWAIT|M_ZERO);
1809 	if (kt == NULL)
1811 	kt->pfrkt_t = *tbl;
1816 			pfr_destroy_ktable(kt, 0);
1819 		kt->pfrkt_rs = rs;
1823 	if (!rn_inithead((void **)&kt->pfrkt_ip4,
1825 	    !rn_inithead((void **)&kt->pfrkt_ip6,
1827 		pfr_destroy_ktable(kt, 0);
1830 	kt->pfrkt_tzero = tzero;
1832 	return (kt);
1847 pfr_destroy_ktable(struct pfr_ktable *kt, int flushaddr)
1852 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1853 		pfr_clean_node_mask(kt, &addrq);
1856 	if (kt->pfrkt_ip4 != NULL)
1857 		rn_detachhead((void **)&kt->pfrkt_ip4);
1858 	if (kt->pfrkt_ip6 != NULL)
1859 		rn_detachhead((void **)&kt->pfrkt_ip6);
1860 	if (kt->pfrkt_shadow != NULL)
1861 		pfr_destroy_ktable(kt->pfrkt_shadow, flushaddr);
1862 	if (kt->pfrkt_rs != NULL) {
1863 		kt->pfrkt_rs->tables--;
1864 		pf_remove_if_empty_ruleset(kt->pfrkt_rs);
1866 	free(kt, M_PFTABLE);
1888 pfr_match_addr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af)
1895 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
1896 		kt = kt->pfrkt_root;
1897 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1910 		ke = (struct pfr_kentry *)rn_match(&sin, &kt->pfrkt_ip4->rh);
1925 		ke = (struct pfr_kentry *)rn_match(&sin6, &kt->pfrkt_ip6->rh);
1934 		kt->pfrkt_match++;
1936 		kt->pfrkt_nomatch++;
1941 pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af,
1946 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
1947 		kt = kt->pfrkt_root;
1948 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1961 		ke = (struct pfr_kentry *)rn_match(&sin, &kt->pfrkt_ip4->rh);
1976 		ke = (struct pfr_kentry *)rn_match(&sin6, &kt->pfrkt_ip6->rh);
1990 	kt->pfrkt_packets[dir_out][op_pass]++;
1991 	kt->pfrkt_bytes[dir_out][op_pass] += len;
1993 	    (kt->pfrkt_flags & PFR_TFLAG_COUNTERS)) {
2007 	struct pfr_ktable	*kt, *rt;
2017 	kt = pfr_lookup_table(&tbl);
2018 	if (kt == NULL) {
2019 		kt = pfr_create_ktable(&tbl, time_second, 1);
2020 		if (kt == NULL)
2028 					pfr_destroy_ktable(kt, 0);
2033 			kt->pfrkt_root = rt;
2035 		pfr_insert_ktable(kt);
2037 	if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++)
2038 		pfr_setflags_ktable(kt, kt->pfrkt_flags|PFR_TFLAG_REFERENCED);
2039 	return (kt);
2043 pfr_detach_table(struct pfr_ktable *kt)
2047 	KASSERT(kt->pfrkt_refcnt[PFR_REFCNT_RULE] > 0, ("%s: refcount %d\n",
2048 	    __func__, kt->pfrkt_refcnt[PFR_REFCNT_RULE]));
2050 	if (!--kt->pfrkt_refcnt[PFR_REFCNT_RULE])
2051 		pfr_setflags_ktable(kt, kt->pfrkt_flags&~PFR_TFLAG_REFERENCED);
2055 pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter,
2075 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2076 		kt = kt->pfrkt_root;
2077 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2088 	ke = pfr_kentry_byidx(kt, idx, af);
2090 		kt->pfrkt_nomatch++;
2115 		kt->pfrkt_match++;
2123 			    &kt->pfrkt_ip4->rh);
2127 			    &kt->pfrkt_ip6->rh);
2135 			kt->pfrkt_match++;
2154 pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af)
2165 		kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
2170 		kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w);
2179 pfr_dynaddr_update(struct pfr_ktable *kt, struct pfi_dynaddr *dyn)
2190 		kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
2192 		kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w);