bsd/net/pf.c

384 pf_state_lookup_aux(struct pf_state **state, struct pfi_kif *kif,
397 	    (*state)->rt_kif != NULL && (*state)->rt_kif != kif) {
408 		*state = pf_find_state(kif, &key, direction);		 \
418 		if (pf_state_lookup_aux(state, kif, direction, &action)) \
1123 pf_find_state(struct pfi_kif *kif, struct pf_state_key_cmp *key, u_int dir)
1146 			if (s->kif == pfi_all || s->kif == kif)
1381 pf_stateins_err(const char *tree, struct pf_state *s, struct pfi_kif *kif)
1386 		printf("pf: state insert failed: %s %s ", tree, kif->pfik_name);
1420 pf_insert_state(struct pfi_kif *kif, struct pf_state *s)
1426 	s->kif = kif;
1430 		/* key exists. check for same kif, if none, add to key */
1432 			if (sp->kif == kif) {	/* collision! */
1433 				pf_stateins_err("tree_lan_ext", s, kif);
1439 		pf_attach_state(cur, s, kif == pfi_all ? 1 : 0);
1446 		pf_stateins_err("tree_ext_gwy", s, kif);
1471 	pfi_kif_ref(kif, PFI_KIF_REF_STATE);
1707 	pfi_kif_unref(cur->kif, PFI_KIF_REF_STATE);
1965 		if (cur->kif != prev->kif || cur->ifnot != prev->ifnot)
3207 pf_get_sport(struct pf_pdesc *pd, struct pfi_kif *kif, struct pf_rule *r,
3212 #pragma unused(kif)
3376     int direction, struct pfi_kif *kif, struct pf_addr *saddr,
3412 		if (pfi_kif_match(r->kif, kif) == r->ifnot)
3423 		    src->neg, kif))
3473     int direction, struct pfi_kif *kif, struct pf_src_node **sn,
3481 		r = pf_match_translation(pd, m, off, direction, kif, saddr,
3484 			r = pf_match_translation(pd, m, off, direction, kif,
3487 			r = pf_match_translation(pd, m, off, direction, kif,
3490 		r = pf_match_translation(pd, m, off, direction, kif, saddr,
3493 			r = pf_match_translation(pd, m, off, direction, kif,
3504 			if (pf_get_sport(pd, kif, r, saddr, sxport, daddr,
3941 		s->rt_kif = r->rpool.cur->kif;
3948 		s->rt_kif = r->rpool.cur->kif;
4050     struct pfi_kif *kif, struct mbuf *m, int off, void *h,
4151 		if ((nr = pf_get_translation_aux(pd, m, off, PF_OUT, kif, &nsn,
4249 		if ((nr = pf_get_translation_aux(pd, m, off, PF_IN, kif, &nsn,
4348 		if (pfi_kif_match(r->kif, kif) == r->ifnot)
4357 		    r->src.neg, kif))
4459 		PFLOG_PACKET(kif, h, m, af, direction, reason, r->log ? r : nr,
4655 				    r->return_ttl, 1, 0, pd->eh, kif->pfik_ifp);
4805 			s0 = pf_find_state(kif, &sk0, PF_IN);
5043 		if (pf_insert_state(BOUND_IFACE(r, kif), s)) {
5106 				    pd, kif);
5142 pf_test_dummynet(struct pf_rule **rm, int direction, struct pfi_kif *kif,
5221 		if (pfi_kif_match(r->kif, kif) == r->ifnot)
5230 		    r->src.neg, kif))
5314 		PFLOG_PACKET(kif, h, m, af, direction, reason, r,
5404 pf_test_fragment(struct pf_rule **rm, int direction, struct pfi_kif *kif,
5420 		if (pfi_kif_match(r->kif, kif) == r->ifnot)
5429 		    r->src.neg, kif))
5484 		PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset,
5500     struct pf_pdesc *pd, struct pfi_kif *kif)
5779 		if (pf_insert_state(BOUND_IFACE(s->rule.ptr, kif), gs)) {
5845 pf_test_state_tcp(struct pf_state **state, int direction, struct pfi_kif *kif,
6300 				    pd->eh, kif->pfik_ifp);
6335 		    off + (th->th_off << 2), pd, kif);
6373 pf_test_state_udp(struct pf_state **state, int direction, struct pfi_kif *kif,
6433 	*state = pf_find_state(kif, &key, dx);
6437 		*state = pf_find_state(kif, &key, dx);
6442 		*state = pf_find_state(kif, &key, dx);
6455 	if (pf_state_lookup_aux(state, kif, direction, &action))
6490 		    off + uh->uh_ulen, pd, kif);
6523 pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif,
6950 			*state = pf_find_state(kif, &key, dx);
6954 				*state = pf_find_state(kif, &key, dx);
6959 				*state = pf_find_state(kif, &key, dx);
6964 				*state = pf_find_state(kif, &key, dx);
6978 			if (pf_state_lookup_aux(state, kif, direction, &action))
7198     struct pfi_kif *kif, int off, struct pf_pdesc *pd)
7298 pf_test_state_esp(struct pf_state **state, int direction, struct pfi_kif *kif,
7321 	*state = pf_find_state(kif, &key, direction);
7335 			s = pf_find_state(kif, &key, direction);
7353 			s = pf_find_state(kif, &key, direction);
7395 	if (pf_state_lookup_aux(state, kif, direction, &action))
7461 pf_test_state_other(struct pf_state **state, int direction, struct pfi_kif *kif,
7599 pf_routable(struct pf_addr *addr, sa_family_t af, struct pfi_kif *kif)
7601 #pragma unused(kif)
7633 	if (kif != NULL && kif->pfik_ifp->if_type == IFT_ENC)
7761 			ifp = r->rpool.cur->kif ?
7762 			    r->rpool.cur->kif->pfik_ifp : NULL;
7930 		ifp = r->rpool.cur->kif ? r->rpool.cur->kif->pfik_ifp : NULL;
8088 	struct pfi_kif		*kif;
8115 	kif = (struct pfi_kif *)ifp->if_pf_kif;
8117 	if (kif == NULL) {
8119 		    ("pf_test: kif == NULL, if_name %s\n", ifp->if_name));
8122 	if (kif->pfik_flags & PFI_IFLAG_SKIP)
8156 	action = pf_normalize_ip(m0, dir, kif, &reason, &pd);
8203 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8209 		action = pf_test_fragment(&r, dir, kif, m, h,
8229 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8235 		action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd);
8241 		action = pf_test_state_tcp(&s, dir, kif, m, off, h, &pd,
8254 			action = pf_test_rule(&r, &s, dir, kif,
8277 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8283 		action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd,
8296 			action = pf_test_rule(&r, &s, dir, kif,
8312 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8318 		action = pf_test_state_icmp(&s, dir, kif, m, off, h, &pd,
8331 			action = pf_test_rule(&r, &s, dir, kif,
8347 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8353 		action = pf_test_state_esp(&s, dir, kif, off, &pd);
8365 			action = pf_test_rule(&r, &s, dir, kif,
8380 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8395 			action = pf_test_state_grev1(&s, dir, kif, off, &pd);
8407 				action = pf_test_rule(&r, &s, dir, kif, m, off,
8420 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8426 		action = pf_test_state_other(&s, dir, kif, &pd);
8438 			action = pf_test_rule(&r, &s, dir, kif, m, off, h,
8502 		PFLOG_PACKET(kif, h, m, AF_INET, dir, reason, lr, a, ruleset,
8506 	kif->pfik_bytes[0][dir == PF_OUT][action != PF_PASS] += pd.tot_len;
8507 	kif->pfik_packets[0][dir == PF_OUT][action != PF_PASS]++;
8595 		pf_route(m0, r, dir, kif->pfik_ifp, s, &pd);
8619 	struct pfi_kif		*kif;
8647 	kif = (struct pfi_kif *)ifp->if_pf_kif;
8649 	if (kif == NULL) {
8651 		    ("pf_test6: kif == NULL, if_name %s\n", ifp->if_name));
8654 	if (kif->pfik_flags & PFI_IFLAG_SKIP)
8697 	action = pf_normalize_ip6(m0, dir, kif, &reason, &pd);
8755 			action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8761 			action = pf_test_fragment(&r, dir, kif, m, h, &pd, &a,
8819 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8825 		action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd);
8831 		action = pf_test_state_tcp(&s, dir, kif, m, off, h, &pd,
8844 			action = pf_test_rule(&r, &s, dir, kif,
8867 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8873 		action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd,
8886 			action = pf_test_rule(&r, &s, dir, kif,
8902 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8908 		action = pf_test_state_icmp(&s, dir, kif,
8921 			action = pf_test_rule(&r, &s, dir, kif,
8937 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8943 		action = pf_test_state_esp(&s, dir, kif, off, &pd);
8955 			action = pf_test_rule(&r, &s, dir, kif,
8971 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
8985 			action = pf_test_state_grev1(&s, dir, kif, off, &pd);
8998 				action = pf_test_rule(&r, &s, dir, kif, m, off,
9011 		action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
9017 		action = pf_test_state_other(&s, dir, kif, &pd);
9029 			action = pf_test_rule(&r, &s, dir, kif, m, off, h,
9093 		PFLOG_PACKET(kif, h, m, AF_INET6, dir, reason, lr, a, ruleset,
9097 	kif->pfik_bytes[1][dir == PF_OUT][action != PF_PASS] += pd.tot_len;
9098 	kif->pfik_packets[1][dir == PF_OUT][action != PF_PASS]++;
9169 		pf_route6(m0, r, dir, kif->pfik_ifp, s, &pd);
9199 		pf_route6(m0, r, dir, kif->pfik_ifp, s, &pd);