bsd/net/pf_table.c

242 	struct pfr_ktable	*kt;
248 	kt = pfr_lookup_table(tbl);
249 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
251 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
253 	pfr_enqueue_addrs(kt, &workq, ndel, 0);
256 		pfr_remove_kentries(kt, &workq);
257 		if (kt->pfrkt_cnt) {
259 			    kt->pfrkt_cnt);
260 			kt->pfrkt_cnt = 0;
270 	struct pfr_ktable	*kt, *tmpkt;
282 	kt = pfr_lookup_table(tbl);
283 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
285 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
296 		p = pfr_lookup_addr(kt, &ad, 1);
327 		pfr_insert_kentries(kt, &workq, tzero);
347 	struct pfr_ktable	*kt;
358 	kt = pfr_lookup_table(tbl);
359 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
361 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
374 	for (i = kt->pfrkt_cnt; i > 0; i >>= 1)
376 	if (size > kt->pfrkt_cnt/log) {
378 		pfr_mark_addrs(kt);
386 			p = pfr_lookup_addr(kt, &ad, 1);
397 		p = pfr_lookup_addr(kt, &ad, 1);
419 		pfr_remove_kentries(kt, &workq);
435 	struct pfr_ktable	*kt, *tmpkt;
448 	kt = pfr_lookup_table(tbl);
449 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
451 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
456 	pfr_mark_addrs(kt);
466 		p = pfr_lookup_addr(kt, &ad, 1);
502 	pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY);
521 		pfr_insert_kentries(kt, &addq, tzero);
522 		pfr_remove_kentries(kt, &delq);
549 	struct pfr_ktable	*kt;
557 	kt = pfr_lookup_table(tbl);
558 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
568 		p = pfr_lookup_addr(kt, &ad, 0);
587 	struct pfr_ktable	*kt;
594 	kt = pfr_lookup_table(tbl);
595 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
597 	if (kt->pfrkt_cnt > *size) {
598 		*size = kt->pfrkt_cnt;
605 	w.pfrw_free = kt->pfrkt_cnt;
607 	rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
609 		rv = kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6,
619 	*size = kt->pfrkt_cnt;
627 	struct pfr_ktable	*kt;
637 	kt = pfr_lookup_table(tbl);
638 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
640 	if (kt->pfrkt_cnt > *size) {
641 		*size = kt->pfrkt_cnt;
648 	w.pfrw_free = kt->pfrkt_cnt;
650 	rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
652 		rv = kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6,
655 		pfr_enqueue_addrs(kt, &workq, NULL, 0);
666 	*size = kt->pfrkt_cnt;
674 	struct pfr_ktable	*kt;
685 	kt = pfr_lookup_table(tbl);
686 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
694 		p = pfr_lookup_addr(kt, &ad, 1);
754 pfr_enqueue_addrs(struct pfr_ktable *kt, struct pfr_kentryworkq *workq,
763 	if (kt->pfrkt_ip4 != NULL)
764 		if (kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4,
767 	if (kt->pfrkt_ip6 != NULL)
768 		if (kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6,
776 pfr_mark_addrs(struct pfr_ktable *kt)
782 	if (kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w))
784 	if (kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w))
790 pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact)
801 		head = kt->pfrkt_ip4;
804 		head = kt->pfrkt_ip6;
868 pfr_insert_kentries(struct pfr_ktable *kt,
875 		rv = pfr_route_kentry(kt, p);
884 	kt->pfrkt_cnt += n;
888 pfr_insert_kentry(struct pfr_ktable *kt, struct pfr_addr *ad, u_int64_t tzero)
893 	p = pfr_lookup_addr(kt, ad, 1);
900 	rv = pfr_route_kentry(kt, p);
905 	kt->pfrkt_cnt++;
911 pfr_remove_kentries(struct pfr_ktable *kt,
918 		pfr_unroute_kentry(kt, p);
921 	kt->pfrkt_cnt -= n;
926 pfr_clean_node_mask(struct pfr_ktable *kt,
932 		pfr_unroute_kentry(kt, p);
993 pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
1003 		head = kt->pfrkt_ip4;
1005 		head = kt->pfrkt_ip6;
1019 pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
1028 		head = kt->pfrkt_ip4;
1030 		head = kt->pfrkt_ip6;
1501 	struct pfr_ktable	*kt, *rt, *shadow, key;
1520 	kt = RB_FIND(pfr_ktablehead, &pfr_ktables, (struct pfr_ktable *)(void *)tbl);
1521 	if (kt == NULL) {
1522 		kt = pfr_create_ktable(tbl, 0, 1);
1523 		if (kt == NULL)
1525 		SLIST_INSERT_HEAD(&tableq, kt, pfrkt_workq);
1536 			kt->pfrkt_root = rt;
1545 		kt->pfrkt_root = rt;
1546 	} else if (!(kt->pfrkt_flags & PFR_TFLAG_INACTIVE))
1573 		if (kt->pfrkt_shadow != NULL)
1574 			pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1575 		kt->pfrkt_flags |= PFR_TFLAG_INACTIVE;
1579 		kt->pfrkt_shadow = shadow;
1677 pfr_commit_ktable(struct pfr_ktable *kt, u_int64_t tzero)
1679 	struct pfr_ktable	*shadow = kt->pfrkt_shadow;
1685 		if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1686 			pfr_clstats_ktable(kt, tzero, 1);
1687 	} else if (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) {
1688 		/* kt might contain addresses */
1694 		pfr_mark_addrs(kt);
1703 			q = pfr_lookup_addr(kt, &ad, 1);
1715 		pfr_enqueue_addrs(kt, &delq, NULL, ENQUEUE_UNMARKED_ONLY);
1716 		pfr_insert_kentries(kt, &addq, tzero);
1717 		pfr_remove_kentries(kt, &delq);
1721 		/* kt cannot contain addresses */
1722 		SWAP(struct radix_node_head *, kt->pfrkt_ip4,
1724 		SWAP(struct radix_node_head *, kt->pfrkt_ip6,
1726 		SWAP(int, kt->pfrkt_cnt, shadow->pfrkt_cnt);
1727 		pfr_clstats_ktable(kt, tzero, 1);
1730 	    (kt->pfrkt_flags & PFR_TFLAG_SETMASK) | PFR_TFLAG_ACTIVE) &
1733 	kt->pfrkt_shadow = NULL;
1734 	pfr_setflags_ktable(kt, nflags);
1809 pfr_skip_table(struct pfr_table *filter, struct pfr_ktable *kt, int flags)
1813 	if (strcmp(filter->pfrt_anchor, kt->pfrkt_anchor))
1830 pfr_insert_ktable(struct pfr_ktable *kt)
1834 	RB_INSERT(pfr_ktablehead, &pfr_ktables, kt);
1836 	if (kt->pfrkt_root != NULL)
1837 		if (!kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]++)
1838 			pfr_setflags_ktable(kt->pfrkt_root,
1839 			    kt->pfrkt_root->pfrkt_flags|PFR_TFLAG_REFDANCHOR);
1856 pfr_setflags_ktable(struct pfr_ktable *kt, int newf)
1868 		RB_REMOVE(pfr_ktablehead, &pfr_ktables, kt);
1869 		if (kt->pfrkt_root != NULL)
1870 			if (!--kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR])
1871 				pfr_setflags_ktable(kt->pfrkt_root,
1872 				    kt->pfrkt_root->pfrkt_flags &
1874 		pfr_destroy_ktable(kt, 1);
1878 	if (!(newf & PFR_TFLAG_ACTIVE) && kt->pfrkt_cnt) {
1879 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1880 		pfr_remove_kentries(kt, &addrq);
1882 	if (!(newf & PFR_TFLAG_INACTIVE) && kt->pfrkt_shadow != NULL) {
1883 		pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1884 		kt->pfrkt_shadow = NULL;
1886 	kt->pfrkt_flags = newf;
1901 pfr_clstats_ktable(struct pfr_ktable *kt, u_int64_t tzero, int recurse)
1908 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1911 	bzero(kt->pfrkt_packets, sizeof (kt->pfrkt_packets));
1912 	bzero(kt->pfrkt_bytes, sizeof (kt->pfrkt_bytes));
1913 	kt->pfrkt_match = kt->pfrkt_nomatch = 0;
1914 	kt->pfrkt_tzero = tzero;
1920 	struct pfr_ktable	*kt;
1925 	kt = pool_get(&pfr_ktable_pl, PR_WAITOK);
1926 	if (kt == NULL)
1928 	bzero(kt, sizeof (*kt));
1929 	kt->pfrkt_t = *tbl;
1934 			pfr_destroy_ktable(kt, 0);
1937 		kt->pfrkt_rs = rs;
1941 	if (!rn_inithead((void **)&kt->pfrkt_ip4,
1943 	    !rn_inithead((void **)&kt->pfrkt_ip6,
1945 		pfr_destroy_ktable(kt, 0);
1948 	kt->pfrkt_tzero = tzero;
1950 	return (kt);
1967 pfr_destroy_ktable(struct pfr_ktable *kt, int flushaddr)
1974 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1975 		pfr_clean_node_mask(kt, &addrq);
1978 	if (kt->pfrkt_ip4 != NULL)
1979 		_FREE((caddr_t)kt->pfrkt_ip4, M_RTABLE);
1980 	if (kt->pfrkt_ip6 != NULL)
1981 		_FREE((caddr_t)kt->pfrkt_ip6, M_RTABLE);
1982 	if (kt->pfrkt_shadow != NULL)
1983 		pfr_destroy_ktable(kt->pfrkt_shadow, flushaddr);
1984 	if (kt->pfrkt_rs != NULL) {
1985 		kt->pfrkt_rs->tables--;
1986 		pf_remove_if_empty_ruleset(kt->pfrkt_rs);
1988 	pool_put(&pfr_ktable_pl, kt);
2012 pfr_match_addr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af)
2019 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2020 		kt = kt->pfrkt_root;
2021 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2028 		ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4);
2036 		ke = (struct pfr_kentry *)rn_match(&pfr_sin6, kt->pfrkt_ip6);
2044 		kt->pfrkt_match++;
2046 		kt->pfrkt_nomatch++;
2051 pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af,
2058 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2059 		kt = kt->pfrkt_root;
2060 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2067 		ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4);
2075 		ke = (struct pfr_kentry *)rn_match(&pfr_sin6, kt->pfrkt_ip6);
2088 	kt->pfrkt_packets[dir_out][op_pass]++;
2089 	kt->pfrkt_bytes[dir_out][op_pass] += len;
2099 	struct pfr_ktable	*kt, *rt;
2109 	kt = pfr_lookup_table(&tbl);
2110 	if (kt == NULL) {
2111 		kt = pfr_create_ktable(&tbl, pf_calendar_time_second(), 1);
2112 		if (kt == NULL)
2120 					pfr_destroy_ktable(kt, 0);
2125 			kt->pfrkt_root = rt;
2127 		pfr_insert_ktable(kt);
2129 	if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++)
2130 		pfr_setflags_ktable(kt, kt->pfrkt_flags|PFR_TFLAG_REFERENCED);
2131 	return (kt);
2135 pfr_detach_table(struct pfr_ktable *kt)
2139 	if (kt->pfrkt_refcnt[PFR_REFCNT_RULE] <= 0)
2141 		    kt->pfrkt_refcnt[PFR_REFCNT_RULE]);
2142 	else if (!--kt->pfrkt_refcnt[PFR_REFCNT_RULE])
2143 		pfr_setflags_ktable(kt, kt->pfrkt_flags&~PFR_TFLAG_REFERENCED);
2147 pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter,
2164 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2165 		kt = kt->pfrkt_root;
2166 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2177 	ke = pfr_kentry_byidx(kt, idx, af);
2179 		kt->pfrkt_nomatch++;
2204 		kt->pfrkt_match++;
2211 			    kt->pfrkt_ip4);
2214 			    kt->pfrkt_ip6);
2222 			kt->pfrkt_match++;
2241 pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af)
2254 		(void) kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4,
2260 		(void) kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6,
2270 pfr_dynaddr_update(struct pfr_ktable *kt, struct pfi_dynaddr *dyn)
2283 		(void) kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4,
2286 		(void) kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6,