sbin/pfctl/pfctl_optimize.c

66  * A superblock is a block of adjacent rules of similar action.  If there
85     BARRIER,	/* the presence of the field puts the rule in its own block */
266 	struct superblock *block;
312 	TAILQ_FOREACH(block, &superblocks, sb_entry) {
313 		if (optimize_superblock(pf, block))
318 	while ((block = TAILQ_FIRST(&superblocks))) {
319 		TAILQ_REMOVE(&superblocks, block, sb_entry);
321 		while ((por = TAILQ_FIRST(&block->sb_rules))) {
322 			TAILQ_REMOVE(&block->sb_rules, por, por_entry);
334 		free(block);
354 	while ((block = TAILQ_FIRST(&superblocks))) {
355 		TAILQ_REMOVE(&superblocks, block, sb_entry);
356 		superblock_free(pf, block);
366 optimize_superblock(struct pfctl *pf, struct superblock *block)
403 	if (!TAILQ_NEXT(TAILQ_FIRST(&block->sb_rules), por_entry))
408 	TAILQ_FOREACH(por, &block->sb_rules, por_entry) {
416 	if (remove_identical_rules(pf, block))
418 	if (combine_rules(pf, block))
421 	    TAILQ_FIRST(&block->sb_rules)->por_rule.quick &&
422 	    block->sb_profiled_block) {
423 		if (block_feedback(pf, block))
425 	} else if (reorder_rules(pf, block, 0)) {
447 remove_identical_rules(struct pfctl *pf, struct superblock *block)
452 	for (por1 = TAILQ_FIRST(&block->sb_rules); por1; por1 = por_next) {
466 				TAILQ_REMOVE(&block->sb_rules, por2, por_entry);
473 				TAILQ_REMOVE(&block->sb_rules, por1, por_entry);
489 combine_rules(struct pfctl *pf, struct superblock *block)
500 	TAILQ_FOREACH(p1, &block->sb_rules, por_entry) {
527 					TAILQ_REMOVE(&block->sb_rules, p2,
549 					TAILQ_REMOVE(&block->sb_rules, p2,
562 	for (p1 = TAILQ_FIRST(&block->sb_rules); p1; p1 = por_next) {
570 				TAILQ_REMOVE(&block->sb_rules, p1, por_entry);
602 				TAILQ_REMOVE(&block->sb_rules, p1, por_entry);
639 reorder_rules(struct pfctl *pf, struct superblock *block, int depth)
652 		TAILQ_FOREACH(por, &block->sb_rules, por_entry) {
653 			TAILQ_FOREACH(skiplist, &block->sb_skipsteps[i],
663 				TAILQ_INSERT_TAIL(&block->sb_skipsteps[i],
666 			skip_append(block, i, skiplist, por);
670 	TAILQ_FOREACH(por, &block->sb_rules, por_entry)
680 		skiplist = TAILQ_FIRST(&block->sb_skipsteps[i]);
707 	while ((por = TAILQ_FIRST(&block->sb_rules))) {
708 		TAILQ_REMOVE(&block->sb_rules, por, por_entry);
720 			skiplist = TAILQ_FIRST(&block->sb_skipsteps[i]);
734 				TAILQ_INSERT_TAIL(&block->sb_rules, por,
743 			skiplist = TAILQ_FIRST(&block->sb_skipsteps[
747 			    largest, TAILQ_FIRST(&TAILQ_FIRST(&block->
750 			TAILQ_REMOVE(&block->sb_skipsteps[largest_list],
768 				TAILQ_INSERT_BEFORE(block, newblock, sb_entry);
774 				newblock = block;
785 				remove_from_skipsteps(&block->sb_skipsteps[
786 				    largest_list], block, por, skiplist);
789 			if (newblock != block)
797 		while ((skiplist = TAILQ_FIRST(&block->sb_skipsteps[i]))) {
798 			TAILQ_REMOVE(&block->sb_skipsteps[i], skiplist,
813 block_feedback(struct pfctl *pf, struct superblock *block)
824 	TAILQ_FOREACH(por1, &block->sb_profiled_block->sb_rules, por_entry) {
826 		TAILQ_FOREACH(por2, &block->sb_rules, por_entry) {
838 	superblock_free(pf, block->sb_profiled_block);
839 	block->sb_profiled_block = NULL;
847 	while ((por1 = TAILQ_FIRST(&block->sb_rules)) != NULL) {
848 		TAILQ_REMOVE(&block->sb_rules, por1, por_entry);
855 		TAILQ_FOREACH(por2, &block->sb_rules, por_entry) {
864 		if (por2 == TAILQ_END(&block->sb_rules))
866 			TAILQ_INSERT_TAIL(&block->sb_rules, por1, por_entry);
881 	struct superblock *block, *blockcur;
933 	block = TAILQ_FIRST(superblocks);
935 	while (block && blockcur) {
936 		comparable_rule(&a, &TAILQ_FIRST(&block->sb_rules)->por_rule,
942 			block->sb_profiled_block = blockcur;
945 			    TAILQ_FIRST(&block->sb_rules)->por_rule.nr,
949 		block = TAILQ_NEXT(block, sb_entry);
957 		block = TAILQ_NEXT(blockcur, sb_entry);
959 		blockcur = block;
1008 remove_from_skipsteps(struct skiplist *head, struct superblock *block,
1016 		sk = TAILQ_FIRST(&block->sb_skipsteps[i]);
1336 	struct superblock *block = NULL;
1343 		if (block == NULL || !superblock_inclusive(block, por)) {
1344 			if ((block = calloc(1, sizeof(*block))) == NULL) {
1348 			TAILQ_INIT(&block->sb_rules);
1350 				TAILQ_INIT(&block->sb_skipsteps[i]);
1351 			TAILQ_INSERT_TAIL(superblocks, block, sb_entry);
1353 		TAILQ_INSERT_TAIL(&block->sb_rules, por, por_entry);
1406 superblock_inclusive(struct superblock *block, struct pf_opt_rule *por)
1428 	 *	block on EXTIFS to any port 22
1432 	 * block rule.  But what if EXTIFS includes em0???  Such a reordering
1440 	    interface_group(TAILQ_FIRST(&block->sb_rules)->por_rule.ifname)) {
1442 		    TAILQ_FIRST(&block->sb_rules)->por_rule.ifname) != 0)
1446 	comparable_rule(&a, &TAILQ_FIRST(&block->sb_rules)->por_rule, NOMERGE);
1636 superblock_free(struct pfctl *pf, struct superblock *block)
1639 	while ((por = TAILQ_FIRST(&block->sb_rules))) {
1640 		TAILQ_REMOVE(&block->sb_rules, por, por_entry);
1657 	if (block->sb_profiled_block)
1658 		superblock_free(pf, block->sb_profiled_block);
1659 	free(block);