xref: /freebsd/sys/netpfil/pf/pf_ioctl.c (revision b62ae61446ee19ab524fea4a066f585cbd7aa727)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2001 Daniel Hartmeier
5  * Copyright (c) 2002,2003 Henning Brauer
6  * Copyright (c) 2012 Gleb Smirnoff <glebius@FreeBSD.org>
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  *
13  *    - Redistributions of source code must retain the above copyright
14  *      notice, this list of conditions and the following disclaimer.
15  *    - Redistributions in binary form must reproduce the above
16  *      copyright notice, this list of conditions and the following
17  *      disclaimer in the documentation and/or other materials provided
18  *      with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
24  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
27  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
28  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
30  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31  * POSSIBILITY OF SUCH DAMAGE.
32  *
33  * Effort sponsored in part by the Defense Advanced Research Projects
34  * Agency (DARPA) and Air Force Research Laboratory, Air Force
35  * Materiel Command, USAF, under agreement number F30602-01-2-0537.
36  *
37  *	$OpenBSD: pf_ioctl.c,v 1.213 2009/02/15 21:46:12 mbalmer Exp $
38  */
39 
40 #include <sys/cdefs.h>
41 __FBSDID("$FreeBSD$");
42 
43 #include "opt_inet.h"
44 #include "opt_inet6.h"
45 #include "opt_bpf.h"
46 #include "opt_pf.h"
47 
48 #include <sys/param.h>
49 #include <sys/_bitset.h>
50 #include <sys/bitset.h>
51 #include <sys/bus.h>
52 #include <sys/conf.h>
53 #include <sys/endian.h>
54 #include <sys/fcntl.h>
55 #include <sys/filio.h>
56 #include <sys/hash.h>
57 #include <sys/interrupt.h>
58 #include <sys/jail.h>
59 #include <sys/kernel.h>
60 #include <sys/kthread.h>
61 #include <sys/lock.h>
62 #include <sys/mbuf.h>
63 #include <sys/module.h>
64 #include <sys/proc.h>
65 #include <sys/smp.h>
66 #include <sys/socket.h>
67 #include <sys/sysctl.h>
68 #include <sys/md5.h>
69 #include <sys/ucred.h>
70 
71 #include <net/if.h>
72 #include <net/if_var.h>
73 #include <net/vnet.h>
74 #include <net/route.h>
75 #include <net/pfil.h>
76 #include <net/pfvar.h>
77 #include <net/if_pfsync.h>
78 #include <net/if_pflog.h>
79 
80 #include <netinet/in.h>
81 #include <netinet/ip.h>
82 #include <netinet/ip_var.h>
83 #include <netinet6/ip6_var.h>
84 #include <netinet/ip_icmp.h>
85 
86 #ifdef INET6
87 #include <netinet/ip6.h>
88 #endif /* INET6 */
89 
90 #ifdef ALTQ
91 #include <net/altq/altq.h>
92 #endif
93 
94 static struct pf_pool	*pf_get_pool(char *, u_int32_t, u_int8_t, u_int32_t,
95 			    u_int8_t, u_int8_t, u_int8_t);
96 
97 static void		 pf_mv_pool(struct pf_palist *, struct pf_palist *);
98 static void		 pf_empty_pool(struct pf_palist *);
99 static int		 pfioctl(struct cdev *, u_long, caddr_t, int,
100 			    struct thread *);
101 #ifdef ALTQ
102 static int		 pf_begin_altq(u_int32_t *);
103 static int		 pf_rollback_altq(u_int32_t);
104 static int		 pf_commit_altq(u_int32_t);
105 static int		 pf_enable_altq(struct pf_altq *);
106 static int		 pf_disable_altq(struct pf_altq *);
107 static u_int32_t	 pf_qname2qid(char *);
108 static void		 pf_qid_unref(u_int32_t);
109 #endif /* ALTQ */
110 static int		 pf_begin_rules(u_int32_t *, int, const char *);
111 static int		 pf_rollback_rules(u_int32_t, int, char *);
112 static int		 pf_setup_pfsync_matching(struct pf_ruleset *);
113 static void		 pf_hash_rule(MD5_CTX *, struct pf_rule *);
114 static void		 pf_hash_rule_addr(MD5_CTX *, struct pf_rule_addr *);
115 static int		 pf_commit_rules(u_int32_t, int, char *);
116 static int		 pf_addr_setup(struct pf_ruleset *,
117 			    struct pf_addr_wrap *, sa_family_t);
118 static void		 pf_addr_copyout(struct pf_addr_wrap *);
119 #ifdef ALTQ
120 static int		 pf_export_kaltq(struct pf_altq *,
121 			    struct pfioc_altq_v1 *, size_t);
122 static int		 pf_import_kaltq(struct pfioc_altq_v1 *,
123 			    struct pf_altq *, size_t);
124 #endif /* ALTQ */
125 
126 VNET_DEFINE(struct pf_rule,	pf_default_rule);
127 
128 #ifdef ALTQ
129 VNET_DEFINE_STATIC(int,		pf_altq_running);
130 #define	V_pf_altq_running	VNET(pf_altq_running)
131 #endif
132 
133 #define	TAGID_MAX	 50000
134 struct pf_tagname {
135 	TAILQ_ENTRY(pf_tagname)	namehash_entries;
136 	TAILQ_ENTRY(pf_tagname)	taghash_entries;
137 	char			name[PF_TAG_NAME_SIZE];
138 	uint16_t		tag;
139 	int			ref;
140 };
141 
142 struct pf_tagset {
143 	TAILQ_HEAD(, pf_tagname)	*namehash;
144 	TAILQ_HEAD(, pf_tagname)	*taghash;
145 	unsigned int			 mask;
146 	uint32_t			 seed;
147 	BITSET_DEFINE(, TAGID_MAX)	 avail;
148 };
149 
150 VNET_DEFINE(struct pf_tagset, pf_tags);
151 #define	V_pf_tags	VNET(pf_tags)
152 static unsigned int	pf_rule_tag_hashsize;
153 #define	PF_RULE_TAG_HASH_SIZE_DEFAULT	128
154 SYSCTL_UINT(_net_pf, OID_AUTO, rule_tag_hashsize, CTLFLAG_RDTUN,
155     &pf_rule_tag_hashsize, PF_RULE_TAG_HASH_SIZE_DEFAULT,
156     "Size of pf(4) rule tag hashtable");
157 
158 #ifdef ALTQ
159 VNET_DEFINE(struct pf_tagset, pf_qids);
160 #define	V_pf_qids	VNET(pf_qids)
161 static unsigned int	pf_queue_tag_hashsize;
162 #define	PF_QUEUE_TAG_HASH_SIZE_DEFAULT	128
163 SYSCTL_UINT(_net_pf, OID_AUTO, queue_tag_hashsize, CTLFLAG_RDTUN,
164     &pf_queue_tag_hashsize, PF_QUEUE_TAG_HASH_SIZE_DEFAULT,
165     "Size of pf(4) queue tag hashtable");
166 #endif
167 VNET_DEFINE(uma_zone_t,	 pf_tag_z);
168 #define	V_pf_tag_z		 VNET(pf_tag_z)
169 static MALLOC_DEFINE(M_PFALTQ, "pf_altq", "pf(4) altq configuration db");
170 static MALLOC_DEFINE(M_PFRULE, "pf_rule", "pf(4) rules");
171 
172 #if (PF_QNAME_SIZE != PF_TAG_NAME_SIZE)
173 #error PF_QNAME_SIZE must be equal to PF_TAG_NAME_SIZE
174 #endif
175 
176 static void		 pf_init_tagset(struct pf_tagset *, unsigned int *,
177 			    unsigned int);
178 static void		 pf_cleanup_tagset(struct pf_tagset *);
179 static uint16_t		 tagname2hashindex(const struct pf_tagset *, const char *);
180 static uint16_t		 tag2hashindex(const struct pf_tagset *, uint16_t);
181 static u_int16_t	 tagname2tag(struct pf_tagset *, char *);
182 static u_int16_t	 pf_tagname2tag(char *);
183 static void		 tag_unref(struct pf_tagset *, u_int16_t);
184 
185 #define DPFPRINTF(n, x) if (V_pf_status.debug >= (n)) printf x
186 
187 struct cdev *pf_dev;
188 
189 /*
190  * XXX - These are new and need to be checked when moveing to a new version
191  */
192 static void		 pf_clear_states(void);
193 static int		 pf_clear_tables(void);
194 static void		 pf_clear_srcnodes(struct pf_src_node *);
195 static void		 pf_kill_srcnodes(struct pfioc_src_node_kill *);
196 static void		 pf_tbladdr_copyout(struct pf_addr_wrap *);
197 
198 /*
199  * Wrapper functions for pfil(9) hooks
200  */
201 #ifdef INET
202 static pfil_return_t pf_check_in(struct mbuf **m, struct ifnet *ifp,
203     int flags, void *ruleset __unused, struct inpcb *inp);
204 static pfil_return_t pf_check_out(struct mbuf **m, struct ifnet *ifp,
205     int flags, void *ruleset __unused, struct inpcb *inp);
206 #endif
207 #ifdef INET6
208 static pfil_return_t pf_check6_in(struct mbuf **m, struct ifnet *ifp,
209     int flags, void *ruleset __unused, struct inpcb *inp);
210 static pfil_return_t pf_check6_out(struct mbuf **m, struct ifnet *ifp,
211     int flags, void *ruleset __unused, struct inpcb *inp);
212 #endif
213 
214 static int		hook_pf(void);
215 static int		dehook_pf(void);
216 static int		shutdown_pf(void);
217 static int		pf_load(void);
218 static void		pf_unload(void);
219 
220 static struct cdevsw pf_cdevsw = {
221 	.d_ioctl =	pfioctl,
222 	.d_name =	PF_NAME,
223 	.d_version =	D_VERSION,
224 };
225 
226 volatile VNET_DEFINE_STATIC(int, pf_pfil_hooked);
227 #define V_pf_pfil_hooked	VNET(pf_pfil_hooked)
228 
229 /*
230  * We need a flag that is neither hooked nor running to know when
231  * the VNET is "valid".  We primarily need this to control (global)
232  * external event, e.g., eventhandlers.
233  */
234 VNET_DEFINE(int, pf_vnet_active);
235 #define V_pf_vnet_active	VNET(pf_vnet_active)
236 
237 int pf_end_threads;
238 struct proc *pf_purge_proc;
239 
240 struct rmlock			pf_rules_lock;
241 struct sx			pf_ioctl_lock;
242 struct sx			pf_end_lock;
243 
244 /* pfsync */
245 VNET_DEFINE(pfsync_state_import_t *, pfsync_state_import_ptr);
246 VNET_DEFINE(pfsync_insert_state_t *, pfsync_insert_state_ptr);
247 VNET_DEFINE(pfsync_update_state_t *, pfsync_update_state_ptr);
248 VNET_DEFINE(pfsync_delete_state_t *, pfsync_delete_state_ptr);
249 VNET_DEFINE(pfsync_clear_states_t *, pfsync_clear_states_ptr);
250 VNET_DEFINE(pfsync_defer_t *, pfsync_defer_ptr);
251 pfsync_detach_ifnet_t *pfsync_detach_ifnet_ptr;
252 
253 /* pflog */
254 pflog_packet_t			*pflog_packet_ptr = NULL;
255 
256 extern u_long	pf_ioctl_maxcount;
257 
258 static void
259 pfattach_vnet(void)
260 {
261 	u_int32_t *my_timeout = V_pf_default_rule.timeout;
262 
263 	pf_initialize();
264 	pfr_initialize();
265 	pfi_initialize_vnet();
266 	pf_normalize_init();
267 
268 	V_pf_limits[PF_LIMIT_STATES].limit = PFSTATE_HIWAT;
269 	V_pf_limits[PF_LIMIT_SRC_NODES].limit = PFSNODE_HIWAT;
270 
271 	RB_INIT(&V_pf_anchors);
272 	pf_init_ruleset(&pf_main_ruleset);
273 
274 	/* default rule should never be garbage collected */
275 	V_pf_default_rule.entries.tqe_prev = &V_pf_default_rule.entries.tqe_next;
276 #ifdef PF_DEFAULT_TO_DROP
277 	V_pf_default_rule.action = PF_DROP;
278 #else
279 	V_pf_default_rule.action = PF_PASS;
280 #endif
281 	V_pf_default_rule.nr = -1;
282 	V_pf_default_rule.rtableid = -1;
283 
284 	V_pf_default_rule.states_cur = counter_u64_alloc(M_WAITOK);
285 	V_pf_default_rule.states_tot = counter_u64_alloc(M_WAITOK);
286 	V_pf_default_rule.src_nodes = counter_u64_alloc(M_WAITOK);
287 
288 	/* initialize default timeouts */
289 	my_timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
290 	my_timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL;
291 	my_timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
292 	my_timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL;
293 	my_timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL;
294 	my_timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL;
295 	my_timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL;
296 	my_timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL;
297 	my_timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL;
298 	my_timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL;
299 	my_timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL;
300 	my_timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL;
301 	my_timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL;
302 	my_timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL;
303 	my_timeout[PFTM_FRAG] = PFTM_FRAG_VAL;
304 	my_timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL;
305 	my_timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL;
306 	my_timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL;
307 	my_timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START;
308 	my_timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END;
309 
310 	bzero(&V_pf_status, sizeof(V_pf_status));
311 	V_pf_status.debug = PF_DEBUG_URGENT;
312 
313 	V_pf_pfil_hooked = 0;
314 
315 	/* XXX do our best to avoid a conflict */
316 	V_pf_status.hostid = arc4random();
317 
318 	for (int i = 0; i < PFRES_MAX; i++)
319 		V_pf_status.counters[i] = counter_u64_alloc(M_WAITOK);
320 	for (int i = 0; i < LCNT_MAX; i++)
321 		V_pf_status.lcounters[i] = counter_u64_alloc(M_WAITOK);
322 	for (int i = 0; i < FCNT_MAX; i++)
323 		V_pf_status.fcounters[i] = counter_u64_alloc(M_WAITOK);
324 	for (int i = 0; i < SCNT_MAX; i++)
325 		V_pf_status.scounters[i] = counter_u64_alloc(M_WAITOK);
326 
327 	if (swi_add(NULL, "pf send", pf_intr, curvnet, SWI_NET,
328 	    INTR_MPSAFE, &V_pf_swi_cookie) != 0)
329 		/* XXXGL: leaked all above. */
330 		return;
331 }
332 
333 static struct pf_pool *
334 pf_get_pool(char *anchor, u_int32_t ticket, u_int8_t rule_action,
335     u_int32_t rule_number, u_int8_t r_last, u_int8_t active,
336     u_int8_t check_ticket)
337 {
338 	struct pf_ruleset	*ruleset;
339 	struct pf_rule		*rule;
340 	int			 rs_num;
341 
342 	ruleset = pf_find_ruleset(anchor);
343 	if (ruleset == NULL)
344 		return (NULL);
345 	rs_num = pf_get_ruleset_number(rule_action);
346 	if (rs_num >= PF_RULESET_MAX)
347 		return (NULL);
348 	if (active) {
349 		if (check_ticket && ticket !=
350 		    ruleset->rules[rs_num].active.ticket)
351 			return (NULL);
352 		if (r_last)
353 			rule = TAILQ_LAST(ruleset->rules[rs_num].active.ptr,
354 			    pf_rulequeue);
355 		else
356 			rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr);
357 	} else {
358 		if (check_ticket && ticket !=
359 		    ruleset->rules[rs_num].inactive.ticket)
360 			return (NULL);
361 		if (r_last)
362 			rule = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr,
363 			    pf_rulequeue);
364 		else
365 			rule = TAILQ_FIRST(ruleset->rules[rs_num].inactive.ptr);
366 	}
367 	if (!r_last) {
368 		while ((rule != NULL) && (rule->nr != rule_number))
369 			rule = TAILQ_NEXT(rule, entries);
370 	}
371 	if (rule == NULL)
372 		return (NULL);
373 
374 	return (&rule->rpool);
375 }
376 
377 static void
378 pf_mv_pool(struct pf_palist *poola, struct pf_palist *poolb)
379 {
380 	struct pf_pooladdr	*mv_pool_pa;
381 
382 	while ((mv_pool_pa = TAILQ_FIRST(poola)) != NULL) {
383 		TAILQ_REMOVE(poola, mv_pool_pa, entries);
384 		TAILQ_INSERT_TAIL(poolb, mv_pool_pa, entries);
385 	}
386 }
387 
388 static void
389 pf_empty_pool(struct pf_palist *poola)
390 {
391 	struct pf_pooladdr *pa;
392 
393 	while ((pa = TAILQ_FIRST(poola)) != NULL) {
394 		switch (pa->addr.type) {
395 		case PF_ADDR_DYNIFTL:
396 			pfi_dynaddr_remove(pa->addr.p.dyn);
397 			break;
398 		case PF_ADDR_TABLE:
399 			/* XXX: this could be unfinished pooladdr on pabuf */
400 			if (pa->addr.p.tbl != NULL)
401 				pfr_detach_table(pa->addr.p.tbl);
402 			break;
403 		}
404 		if (pa->kif)
405 			pfi_kif_unref(pa->kif);
406 		TAILQ_REMOVE(poola, pa, entries);
407 		free(pa, M_PFRULE);
408 	}
409 }
410 
411 static void
412 pf_unlink_rule(struct pf_rulequeue *rulequeue, struct pf_rule *rule)
413 {
414 
415 	PF_RULES_WASSERT();
416 
417 	TAILQ_REMOVE(rulequeue, rule, entries);
418 
419 	PF_UNLNKDRULES_LOCK();
420 	rule->rule_flag |= PFRULE_REFS;
421 	TAILQ_INSERT_TAIL(&V_pf_unlinked_rules, rule, entries);
422 	PF_UNLNKDRULES_UNLOCK();
423 }
424 
425 void
426 pf_free_rule(struct pf_rule *rule)
427 {
428 
429 	PF_RULES_WASSERT();
430 
431 	if (rule->tag)
432 		tag_unref(&V_pf_tags, rule->tag);
433 	if (rule->match_tag)
434 		tag_unref(&V_pf_tags, rule->match_tag);
435 #ifdef ALTQ
436 	if (rule->pqid != rule->qid)
437 		pf_qid_unref(rule->pqid);
438 	pf_qid_unref(rule->qid);
439 #endif
440 	switch (rule->src.addr.type) {
441 	case PF_ADDR_DYNIFTL:
442 		pfi_dynaddr_remove(rule->src.addr.p.dyn);
443 		break;
444 	case PF_ADDR_TABLE:
445 		pfr_detach_table(rule->src.addr.p.tbl);
446 		break;
447 	}
448 	switch (rule->dst.addr.type) {
449 	case PF_ADDR_DYNIFTL:
450 		pfi_dynaddr_remove(rule->dst.addr.p.dyn);
451 		break;
452 	case PF_ADDR_TABLE:
453 		pfr_detach_table(rule->dst.addr.p.tbl);
454 		break;
455 	}
456 	if (rule->overload_tbl)
457 		pfr_detach_table(rule->overload_tbl);
458 	if (rule->kif)
459 		pfi_kif_unref(rule->kif);
460 	pf_anchor_remove(rule);
461 	pf_empty_pool(&rule->rpool.list);
462 	counter_u64_free(rule->states_cur);
463 	counter_u64_free(rule->states_tot);
464 	counter_u64_free(rule->src_nodes);
465 	free(rule, M_PFRULE);
466 }
467 
468 static void
469 pf_init_tagset(struct pf_tagset *ts, unsigned int *tunable_size,
470     unsigned int default_size)
471 {
472 	unsigned int i;
473 	unsigned int hashsize;
474 
475 	if (*tunable_size == 0 || !powerof2(*tunable_size))
476 		*tunable_size = default_size;
477 
478 	hashsize = *tunable_size;
479 	ts->namehash = mallocarray(hashsize, sizeof(*ts->namehash), M_PFHASH,
480 	    M_WAITOK);
481 	ts->taghash = mallocarray(hashsize, sizeof(*ts->taghash), M_PFHASH,
482 	    M_WAITOK);
483 	ts->mask = hashsize - 1;
484 	ts->seed = arc4random();
485 	for (i = 0; i < hashsize; i++) {
486 		TAILQ_INIT(&ts->namehash[i]);
487 		TAILQ_INIT(&ts->taghash[i]);
488 	}
489 	BIT_FILL(TAGID_MAX, &ts->avail);
490 }
491 
492 static void
493 pf_cleanup_tagset(struct pf_tagset *ts)
494 {
495 	unsigned int i;
496 	unsigned int hashsize;
497 	struct pf_tagname *t, *tmp;
498 
499 	/*
500 	 * Only need to clean up one of the hashes as each tag is hashed
501 	 * into each table.
502 	 */
503 	hashsize = ts->mask + 1;
504 	for (i = 0; i < hashsize; i++)
505 		TAILQ_FOREACH_SAFE(t, &ts->namehash[i], namehash_entries, tmp)
506 			uma_zfree(V_pf_tag_z, t);
507 
508 	free(ts->namehash, M_PFHASH);
509 	free(ts->taghash, M_PFHASH);
510 }
511 
512 static uint16_t
513 tagname2hashindex(const struct pf_tagset *ts, const char *tagname)
514 {
515 	size_t len;
516 
517 	len = strnlen(tagname, PF_TAG_NAME_SIZE - 1);
518 	return (murmur3_32_hash(tagname, len, ts->seed) & ts->mask);
519 }
520 
521 static uint16_t
522 tag2hashindex(const struct pf_tagset *ts, uint16_t tag)
523 {
524 
525 	return (tag & ts->mask);
526 }
527 
528 static u_int16_t
529 tagname2tag(struct pf_tagset *ts, char *tagname)
530 {
531 	struct pf_tagname	*tag;
532 	u_int32_t		 index;
533 	u_int16_t		 new_tagid;
534 
535 	PF_RULES_WASSERT();
536 
537 	index = tagname2hashindex(ts, tagname);
538 	TAILQ_FOREACH(tag, &ts->namehash[index], namehash_entries)
539 		if (strcmp(tagname, tag->name) == 0) {
540 			tag->ref++;
541 			return (tag->tag);
542 		}
543 
544 	/*
545 	 * new entry
546 	 *
547 	 * to avoid fragmentation, we do a linear search from the beginning
548 	 * and take the first free slot we find.
549 	 */
550 	new_tagid = BIT_FFS(TAGID_MAX, &ts->avail);
551 	/*
552 	 * Tags are 1-based, with valid tags in the range [1..TAGID_MAX].
553 	 * BIT_FFS() returns a 1-based bit number, with 0 indicating no bits
554 	 * set.  It may also return a bit number greater than TAGID_MAX due
555 	 * to rounding of the number of bits in the vector up to a multiple
556 	 * of the vector word size at declaration/allocation time.
557 	 */
558 	if ((new_tagid == 0) || (new_tagid > TAGID_MAX))
559 		return (0);
560 
561 	/* Mark the tag as in use.  Bits are 0-based for BIT_CLR() */
562 	BIT_CLR(TAGID_MAX, new_tagid - 1, &ts->avail);
563 
564 	/* allocate and fill new struct pf_tagname */
565 	tag = uma_zalloc(V_pf_tag_z, M_NOWAIT);
566 	if (tag == NULL)
567 		return (0);
568 	strlcpy(tag->name, tagname, sizeof(tag->name));
569 	tag->tag = new_tagid;
570 	tag->ref = 1;
571 
572 	/* Insert into namehash */
573 	TAILQ_INSERT_TAIL(&ts->namehash[index], tag, namehash_entries);
574 
575 	/* Insert into taghash */
576 	index = tag2hashindex(ts, new_tagid);
577 	TAILQ_INSERT_TAIL(&ts->taghash[index], tag, taghash_entries);
578 
579 	return (tag->tag);
580 }
581 
582 static void
583 tag_unref(struct pf_tagset *ts, u_int16_t tag)
584 {
585 	struct pf_tagname	*t;
586 	uint16_t		 index;
587 
588 	PF_RULES_WASSERT();
589 
590 	index = tag2hashindex(ts, tag);
591 	TAILQ_FOREACH(t, &ts->taghash[index], taghash_entries)
592 		if (tag == t->tag) {
593 			if (--t->ref == 0) {
594 				TAILQ_REMOVE(&ts->taghash[index], t,
595 				    taghash_entries);
596 				index = tagname2hashindex(ts, t->name);
597 				TAILQ_REMOVE(&ts->namehash[index], t,
598 				    namehash_entries);
599 				/* Bits are 0-based for BIT_SET() */
600 				BIT_SET(TAGID_MAX, tag - 1, &ts->avail);
601 				uma_zfree(V_pf_tag_z, t);
602 			}
603 			break;
604 		}
605 }
606 
607 static u_int16_t
608 pf_tagname2tag(char *tagname)
609 {
610 	return (tagname2tag(&V_pf_tags, tagname));
611 }
612 
613 #ifdef ALTQ
614 static u_int32_t
615 pf_qname2qid(char *qname)
616 {
617 	return ((u_int32_t)tagname2tag(&V_pf_qids, qname));
618 }
619 
620 static void
621 pf_qid_unref(u_int32_t qid)
622 {
623 	tag_unref(&V_pf_qids, (u_int16_t)qid);
624 }
625 
626 static int
627 pf_begin_altq(u_int32_t *ticket)
628 {
629 	struct pf_altq	*altq, *tmp;
630 	int		 error = 0;
631 
632 	PF_RULES_WASSERT();
633 
634 	/* Purge the old altq lists */
635 	TAILQ_FOREACH_SAFE(altq, V_pf_altq_ifs_inactive, entries, tmp) {
636 		if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) {
637 			/* detach and destroy the discipline */
638 			error = altq_remove(altq);
639 		}
640 		free(altq, M_PFALTQ);
641 	}
642 	TAILQ_INIT(V_pf_altq_ifs_inactive);
643 	TAILQ_FOREACH_SAFE(altq, V_pf_altqs_inactive, entries, tmp) {
644 		pf_qid_unref(altq->qid);
645 		free(altq, M_PFALTQ);
646 	}
647 	TAILQ_INIT(V_pf_altqs_inactive);
648 	if (error)
649 		return (error);
650 	*ticket = ++V_ticket_altqs_inactive;
651 	V_altqs_inactive_open = 1;
652 	return (0);
653 }
654 
655 static int
656 pf_rollback_altq(u_int32_t ticket)
657 {
658 	struct pf_altq	*altq, *tmp;
659 	int		 error = 0;
660 
661 	PF_RULES_WASSERT();
662 
663 	if (!V_altqs_inactive_open || ticket != V_ticket_altqs_inactive)
664 		return (0);
665 	/* Purge the old altq lists */
666 	TAILQ_FOREACH_SAFE(altq, V_pf_altq_ifs_inactive, entries, tmp) {
667 		if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) {
668 			/* detach and destroy the discipline */
669 			error = altq_remove(altq);
670 		}
671 		free(altq, M_PFALTQ);
672 	}
673 	TAILQ_INIT(V_pf_altq_ifs_inactive);
674 	TAILQ_FOREACH_SAFE(altq, V_pf_altqs_inactive, entries, tmp) {
675 		pf_qid_unref(altq->qid);
676 		free(altq, M_PFALTQ);
677 	}
678 	TAILQ_INIT(V_pf_altqs_inactive);
679 	V_altqs_inactive_open = 0;
680 	return (error);
681 }
682 
683 static int
684 pf_commit_altq(u_int32_t ticket)
685 {
686 	struct pf_altqqueue	*old_altqs, *old_altq_ifs;
687 	struct pf_altq		*altq, *tmp;
688 	int			 err, error = 0;
689 
690 	PF_RULES_WASSERT();
691 
692 	if (!V_altqs_inactive_open || ticket != V_ticket_altqs_inactive)
693 		return (EBUSY);
694 
695 	/* swap altqs, keep the old. */
696 	old_altqs = V_pf_altqs_active;
697 	old_altq_ifs = V_pf_altq_ifs_active;
698 	V_pf_altqs_active = V_pf_altqs_inactive;
699 	V_pf_altq_ifs_active = V_pf_altq_ifs_inactive;
700 	V_pf_altqs_inactive = old_altqs;
701 	V_pf_altq_ifs_inactive = old_altq_ifs;
702 	V_ticket_altqs_active = V_ticket_altqs_inactive;
703 
704 	/* Attach new disciplines */
705 	TAILQ_FOREACH(altq, V_pf_altq_ifs_active, entries) {
706 		if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) {
707 			/* attach the discipline */
708 			error = altq_pfattach(altq);
709 			if (error == 0 && V_pf_altq_running)
710 				error = pf_enable_altq(altq);
711 			if (error != 0)
712 				return (error);
713 		}
714 	}
715 
716 	/* Purge the old altq lists */
717 	TAILQ_FOREACH_SAFE(altq, V_pf_altq_ifs_inactive, entries, tmp) {
718 		if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) {
719 			/* detach and destroy the discipline */
720 			if (V_pf_altq_running)
721 				error = pf_disable_altq(altq);
722 			err = altq_pfdetach(altq);
723 			if (err != 0 && error == 0)
724 				error = err;
725 			err = altq_remove(altq);
726 			if (err != 0 && error == 0)
727 				error = err;
728 		}
729 		free(altq, M_PFALTQ);
730 	}
731 	TAILQ_INIT(V_pf_altq_ifs_inactive);
732 	TAILQ_FOREACH_SAFE(altq, V_pf_altqs_inactive, entries, tmp) {
733 		pf_qid_unref(altq->qid);
734 		free(altq, M_PFALTQ);
735 	}
736 	TAILQ_INIT(V_pf_altqs_inactive);
737 
738 	V_altqs_inactive_open = 0;
739 	return (error);
740 }
741 
742 static int
743 pf_enable_altq(struct pf_altq *altq)
744 {
745 	struct ifnet		*ifp;
746 	struct tb_profile	 tb;
747 	int			 error = 0;
748 
749 	if ((ifp = ifunit(altq->ifname)) == NULL)
750 		return (EINVAL);
751 
752 	if (ifp->if_snd.altq_type != ALTQT_NONE)
753 		error = altq_enable(&ifp->if_snd);
754 
755 	/* set tokenbucket regulator */
756 	if (error == 0 && ifp != NULL && ALTQ_IS_ENABLED(&ifp->if_snd)) {
757 		tb.rate = altq->ifbandwidth;
758 		tb.depth = altq->tbrsize;
759 		error = tbr_set(&ifp->if_snd, &tb);
760 	}
761 
762 	return (error);
763 }
764 
765 static int
766 pf_disable_altq(struct pf_altq *altq)
767 {
768 	struct ifnet		*ifp;
769 	struct tb_profile	 tb;
770 	int			 error;
771 
772 	if ((ifp = ifunit(altq->ifname)) == NULL)
773 		return (EINVAL);
774 
775 	/*
776 	 * when the discipline is no longer referenced, it was overridden
777 	 * by a new one.  if so, just return.
778 	 */
779 	if (altq->altq_disc != ifp->if_snd.altq_disc)
780 		return (0);
781 
782 	error = altq_disable(&ifp->if_snd);
783 
784 	if (error == 0) {
785 		/* clear tokenbucket regulator */
786 		tb.rate = 0;
787 		error = tbr_set(&ifp->if_snd, &tb);
788 	}
789 
790 	return (error);
791 }
792 
793 static int
794 pf_altq_ifnet_event_add(struct ifnet *ifp, int remove, u_int32_t ticket,
795     struct pf_altq *altq)
796 {
797 	struct ifnet	*ifp1;
798 	int		 error = 0;
799 
800 	/* Deactivate the interface in question */
801 	altq->local_flags &= ~PFALTQ_FLAG_IF_REMOVED;
802 	if ((ifp1 = ifunit(altq->ifname)) == NULL ||
803 	    (remove && ifp1 == ifp)) {
804 		altq->local_flags |= PFALTQ_FLAG_IF_REMOVED;
805 	} else {
806 		error = altq_add(ifp1, altq);
807 
808 		if (ticket != V_ticket_altqs_inactive)
809 			error = EBUSY;
810 
811 		if (error)
812 			free(altq, M_PFALTQ);
813 	}
814 
815 	return (error);
816 }
817 
818 void
819 pf_altq_ifnet_event(struct ifnet *ifp, int remove)
820 {
821 	struct pf_altq	*a1, *a2, *a3;
822 	u_int32_t	 ticket;
823 	int		 error = 0;
824 
825 	/*
826 	 * No need to re-evaluate the configuration for events on interfaces
827 	 * that do not support ALTQ, as it's not possible for such
828 	 * interfaces to be part of the configuration.
829 	 */
830 	if (!ALTQ_IS_READY(&ifp->if_snd))
831 		return;
832 
833 	/* Interrupt userland queue modifications */
834 	if (V_altqs_inactive_open)
835 		pf_rollback_altq(V_ticket_altqs_inactive);
836 
837 	/* Start new altq ruleset */
838 	if (pf_begin_altq(&ticket))
839 		return;
840 
841 	/* Copy the current active set */
842 	TAILQ_FOREACH(a1, V_pf_altq_ifs_active, entries) {
843 		a2 = malloc(sizeof(*a2), M_PFALTQ, M_NOWAIT);
844 		if (a2 == NULL) {
845 			error = ENOMEM;
846 			break;
847 		}
848 		bcopy(a1, a2, sizeof(struct pf_altq));
849 
850 		error = pf_altq_ifnet_event_add(ifp, remove, ticket, a2);
851 		if (error)
852 			break;
853 
854 		TAILQ_INSERT_TAIL(V_pf_altq_ifs_inactive, a2, entries);
855 	}
856 	if (error)
857 		goto out;
858 	TAILQ_FOREACH(a1, V_pf_altqs_active, entries) {
859 		a2 = malloc(sizeof(*a2), M_PFALTQ, M_NOWAIT);
860 		if (a2 == NULL) {
861 			error = ENOMEM;
862 			break;
863 		}
864 		bcopy(a1, a2, sizeof(struct pf_altq));
865 
866 		if ((a2->qid = pf_qname2qid(a2->qname)) == 0) {
867 			error = EBUSY;
868 			free(a2, M_PFALTQ);
869 			break;
870 		}
871 		a2->altq_disc = NULL;
872 		TAILQ_FOREACH(a3, V_pf_altq_ifs_inactive, entries) {
873 			if (strncmp(a3->ifname, a2->ifname,
874 				IFNAMSIZ) == 0) {
875 				a2->altq_disc = a3->altq_disc;
876 				break;
877 			}
878 		}
879 		error = pf_altq_ifnet_event_add(ifp, remove, ticket, a2);
880 		if (error)
881 			break;
882 
883 		TAILQ_INSERT_TAIL(V_pf_altqs_inactive, a2, entries);
884 	}
885 
886 out:
887 	if (error != 0)
888 		pf_rollback_altq(ticket);
889 	else
890 		pf_commit_altq(ticket);
891 }
892 #endif /* ALTQ */
893 
894 static int
895 pf_begin_rules(u_int32_t *ticket, int rs_num, const char *anchor)
896 {
897 	struct pf_ruleset	*rs;
898 	struct pf_rule		*rule;
899 
900 	PF_RULES_WASSERT();
901 
902 	if (rs_num < 0 || rs_num >= PF_RULESET_MAX)
903 		return (EINVAL);
904 	rs = pf_find_or_create_ruleset(anchor);
905 	if (rs == NULL)
906 		return (EINVAL);
907 	while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) {
908 		pf_unlink_rule(rs->rules[rs_num].inactive.ptr, rule);
909 		rs->rules[rs_num].inactive.rcount--;
910 	}
911 	*ticket = ++rs->rules[rs_num].inactive.ticket;
912 	rs->rules[rs_num].inactive.open = 1;
913 	return (0);
914 }
915 
916 static int
917 pf_rollback_rules(u_int32_t ticket, int rs_num, char *anchor)
918 {
919 	struct pf_ruleset	*rs;
920 	struct pf_rule		*rule;
921 
922 	PF_RULES_WASSERT();
923 
924 	if (rs_num < 0 || rs_num >= PF_RULESET_MAX)
925 		return (EINVAL);
926 	rs = pf_find_ruleset(anchor);
927 	if (rs == NULL || !rs->rules[rs_num].inactive.open ||
928 	    rs->rules[rs_num].inactive.ticket != ticket)
929 		return (0);
930 	while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) {
931 		pf_unlink_rule(rs->rules[rs_num].inactive.ptr, rule);
932 		rs->rules[rs_num].inactive.rcount--;
933 	}
934 	rs->rules[rs_num].inactive.open = 0;
935 	return (0);
936 }
937 
938 #define PF_MD5_UPD(st, elm)						\
939 		MD5Update(ctx, (u_int8_t *) &(st)->elm, sizeof((st)->elm))
940 
941 #define PF_MD5_UPD_STR(st, elm)						\
942 		MD5Update(ctx, (u_int8_t *) (st)->elm, strlen((st)->elm))
943 
944 #define PF_MD5_UPD_HTONL(st, elm, stor) do {				\
945 		(stor) = htonl((st)->elm);				\
946 		MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int32_t));\
947 } while (0)
948 
949 #define PF_MD5_UPD_HTONS(st, elm, stor) do {				\
950 		(stor) = htons((st)->elm);				\
951 		MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int16_t));\
952 } while (0)
953 
954 static void
955 pf_hash_rule_addr(MD5_CTX *ctx, struct pf_rule_addr *pfr)
956 {
957 	PF_MD5_UPD(pfr, addr.type);
958 	switch (pfr->addr.type) {
959 		case PF_ADDR_DYNIFTL:
960 			PF_MD5_UPD(pfr, addr.v.ifname);
961 			PF_MD5_UPD(pfr, addr.iflags);
962 			break;
963 		case PF_ADDR_TABLE:
964 			PF_MD5_UPD(pfr, addr.v.tblname);
965 			break;
966 		case PF_ADDR_ADDRMASK:
967 			/* XXX ignore af? */
968 			PF_MD5_UPD(pfr, addr.v.a.addr.addr32);
969 			PF_MD5_UPD(pfr, addr.v.a.mask.addr32);
970 			break;
971 	}
972 
973 	PF_MD5_UPD(pfr, port[0]);
974 	PF_MD5_UPD(pfr, port[1]);
975 	PF_MD5_UPD(pfr, neg);
976 	PF_MD5_UPD(pfr, port_op);
977 }
978 
979 static void
980 pf_hash_rule(MD5_CTX *ctx, struct pf_rule *rule)
981 {
982 	u_int16_t x;
983 	u_int32_t y;
984 
985 	pf_hash_rule_addr(ctx, &rule->src);
986 	pf_hash_rule_addr(ctx, &rule->dst);
987 	PF_MD5_UPD_STR(rule, label);
988 	PF_MD5_UPD_STR(rule, ifname);
989 	PF_MD5_UPD_STR(rule, match_tagname);
990 	PF_MD5_UPD_HTONS(rule, match_tag, x); /* dup? */
991 	PF_MD5_UPD_HTONL(rule, os_fingerprint, y);
992 	PF_MD5_UPD_HTONL(rule, prob, y);
993 	PF_MD5_UPD_HTONL(rule, uid.uid[0], y);
994 	PF_MD5_UPD_HTONL(rule, uid.uid[1], y);
995 	PF_MD5_UPD(rule, uid.op);
996 	PF_MD5_UPD_HTONL(rule, gid.gid[0], y);
997 	PF_MD5_UPD_HTONL(rule, gid.gid[1], y);
998 	PF_MD5_UPD(rule, gid.op);
999 	PF_MD5_UPD_HTONL(rule, rule_flag, y);
1000 	PF_MD5_UPD(rule, action);
1001 	PF_MD5_UPD(rule, direction);
1002 	PF_MD5_UPD(rule, af);
1003 	PF_MD5_UPD(rule, quick);
1004 	PF_MD5_UPD(rule, ifnot);
1005 	PF_MD5_UPD(rule, match_tag_not);
1006 	PF_MD5_UPD(rule, natpass);
1007 	PF_MD5_UPD(rule, keep_state);
1008 	PF_MD5_UPD(rule, proto);
1009 	PF_MD5_UPD(rule, type);
1010 	PF_MD5_UPD(rule, code);
1011 	PF_MD5_UPD(rule, flags);
1012 	PF_MD5_UPD(rule, flagset);
1013 	PF_MD5_UPD(rule, allow_opts);
1014 	PF_MD5_UPD(rule, rt);
1015 	PF_MD5_UPD(rule, tos);
1016 }
1017 
1018 static int
1019 pf_commit_rules(u_int32_t ticket, int rs_num, char *anchor)
1020 {
1021 	struct pf_ruleset	*rs;
1022 	struct pf_rule		*rule, **old_array;
1023 	struct pf_rulequeue	*old_rules;
1024 	int			 error;
1025 	u_int32_t		 old_rcount;
1026 
1027 	PF_RULES_WASSERT();
1028 
1029 	if (rs_num < 0 || rs_num >= PF_RULESET_MAX)
1030 		return (EINVAL);
1031 	rs = pf_find_ruleset(anchor);
1032 	if (rs == NULL || !rs->rules[rs_num].inactive.open ||
1033 	    ticket != rs->rules[rs_num].inactive.ticket)
1034 		return (EBUSY);
1035 
1036 	/* Calculate checksum for the main ruleset */
1037 	if (rs == &pf_main_ruleset) {
1038 		error = pf_setup_pfsync_matching(rs);
1039 		if (error != 0)
1040 			return (error);
1041 	}
1042 
1043 	/* Swap rules, keep the old. */
1044 	old_rules = rs->rules[rs_num].active.ptr;
1045 	old_rcount = rs->rules[rs_num].active.rcount;
1046 	old_array = rs->rules[rs_num].active.ptr_array;
1047 
1048 	rs->rules[rs_num].active.ptr =
1049 	    rs->rules[rs_num].inactive.ptr;
1050 	rs->rules[rs_num].active.ptr_array =
1051 	    rs->rules[rs_num].inactive.ptr_array;
1052 	rs->rules[rs_num].active.rcount =
1053 	    rs->rules[rs_num].inactive.rcount;
1054 	rs->rules[rs_num].inactive.ptr = old_rules;
1055 	rs->rules[rs_num].inactive.ptr_array = old_array;
1056 	rs->rules[rs_num].inactive.rcount = old_rcount;
1057 
1058 	rs->rules[rs_num].active.ticket =
1059 	    rs->rules[rs_num].inactive.ticket;
1060 	pf_calc_skip_steps(rs->rules[rs_num].active.ptr);
1061 
1062 	/* Purge the old rule list. */
1063 	while ((rule = TAILQ_FIRST(old_rules)) != NULL)
1064 		pf_unlink_rule(old_rules, rule);
1065 	if (rs->rules[rs_num].inactive.ptr_array)
1066 		free(rs->rules[rs_num].inactive.ptr_array, M_TEMP);
1067 	rs->rules[rs_num].inactive.ptr_array = NULL;
1068 	rs->rules[rs_num].inactive.rcount = 0;
1069 	rs->rules[rs_num].inactive.open = 0;
1070 	pf_remove_if_empty_ruleset(rs);
1071 
1072 	return (0);
1073 }
1074 
1075 static int
1076 pf_setup_pfsync_matching(struct pf_ruleset *rs)
1077 {
1078 	MD5_CTX			 ctx;
1079 	struct pf_rule		*rule;
1080 	int			 rs_cnt;
1081 	u_int8_t		 digest[PF_MD5_DIGEST_LENGTH];
1082 
1083 	MD5Init(&ctx);
1084 	for (rs_cnt = 0; rs_cnt < PF_RULESET_MAX; rs_cnt++) {
1085 		/* XXX PF_RULESET_SCRUB as well? */
1086 		if (rs_cnt == PF_RULESET_SCRUB)
1087 			continue;
1088 
1089 		if (rs->rules[rs_cnt].inactive.ptr_array)
1090 			free(rs->rules[rs_cnt].inactive.ptr_array, M_TEMP);
1091 		rs->rules[rs_cnt].inactive.ptr_array = NULL;
1092 
1093 		if (rs->rules[rs_cnt].inactive.rcount) {
1094 			rs->rules[rs_cnt].inactive.ptr_array =
1095 			    malloc(sizeof(caddr_t) *
1096 			    rs->rules[rs_cnt].inactive.rcount,
1097 			    M_TEMP, M_NOWAIT);
1098 
1099 			if (!rs->rules[rs_cnt].inactive.ptr_array)
1100 				return (ENOMEM);
1101 		}
1102 
1103 		TAILQ_FOREACH(rule, rs->rules[rs_cnt].inactive.ptr,
1104 		    entries) {
1105 			pf_hash_rule(&ctx, rule);
1106 			(rs->rules[rs_cnt].inactive.ptr_array)[rule->nr] = rule;
1107 		}
1108 	}
1109 
1110 	MD5Final(digest, &ctx);
1111 	memcpy(V_pf_status.pf_chksum, digest, sizeof(V_pf_status.pf_chksum));
1112 	return (0);
1113 }
1114 
1115 static int
1116 pf_addr_setup(struct pf_ruleset *ruleset, struct pf_addr_wrap *addr,
1117     sa_family_t af)
1118 {
1119 	int error = 0;
1120 
1121 	switch (addr->type) {
1122 	case PF_ADDR_TABLE:
1123 		addr->p.tbl = pfr_attach_table(ruleset, addr->v.tblname);
1124 		if (addr->p.tbl == NULL)
1125 			error = ENOMEM;
1126 		break;
1127 	case PF_ADDR_DYNIFTL:
1128 		error = pfi_dynaddr_setup(addr, af);
1129 		break;
1130 	}
1131 
1132 	return (error);
1133 }
1134 
1135 static void
1136 pf_addr_copyout(struct pf_addr_wrap *addr)
1137 {
1138 
1139 	switch (addr->type) {
1140 	case PF_ADDR_DYNIFTL:
1141 		pfi_dynaddr_copyout(addr);
1142 		break;
1143 	case PF_ADDR_TABLE:
1144 		pf_tbladdr_copyout(addr);
1145 		break;
1146 	}
1147 }
1148 
1149 #ifdef ALTQ
1150 /*
1151  * Handle export of struct pf_kaltq to user binaries that may be using any
1152  * version of struct pf_altq.
1153  */
1154 static int
1155 pf_export_kaltq(struct pf_altq *q, struct pfioc_altq_v1 *pa, size_t ioc_size)
1156 {
1157 	u_int32_t version;
1158 
1159 	if (ioc_size == sizeof(struct pfioc_altq_v0))
1160 		version = 0;
1161 	else
1162 		version = pa->version;
1163 
1164 	if (version > PFIOC_ALTQ_VERSION)
1165 		return (EINVAL);
1166 
1167 #define ASSIGN(x) exported_q->x = q->x
1168 #define COPY(x) \
1169 	bcopy(&q->x, &exported_q->x, min(sizeof(q->x), sizeof(exported_q->x)))
1170 #define SATU16(x) (u_int32_t)uqmin((x), USHRT_MAX)
1171 #define SATU32(x) (u_int32_t)uqmin((x), UINT_MAX)
1172 
1173 	switch (version) {
1174 	case 0: {
1175 		struct pf_altq_v0 *exported_q =
1176 		    &((struct pfioc_altq_v0 *)pa)->altq;
1177 
1178 		COPY(ifname);
1179 
1180 		ASSIGN(scheduler);
1181 		ASSIGN(tbrsize);
1182 		exported_q->tbrsize = SATU16(q->tbrsize);
1183 		exported_q->ifbandwidth = SATU32(q->ifbandwidth);
1184 
1185 		COPY(qname);
1186 		COPY(parent);
1187 		ASSIGN(parent_qid);
1188 		exported_q->bandwidth = SATU32(q->bandwidth);
1189 		ASSIGN(priority);
1190 		ASSIGN(local_flags);
1191 
1192 		ASSIGN(qlimit);
1193 		ASSIGN(flags);
1194 
1195 		if (q->scheduler == ALTQT_HFSC) {
1196 #define ASSIGN_OPT(x) exported_q->pq_u.hfsc_opts.x = q->pq_u.hfsc_opts.x
1197 #define ASSIGN_OPT_SATU32(x) exported_q->pq_u.hfsc_opts.x = \
1198 			    SATU32(q->pq_u.hfsc_opts.x)
1199 
1200 			ASSIGN_OPT_SATU32(rtsc_m1);
1201 			ASSIGN_OPT(rtsc_d);
1202 			ASSIGN_OPT_SATU32(rtsc_m2);
1203 
1204 			ASSIGN_OPT_SATU32(lssc_m1);
1205 			ASSIGN_OPT(lssc_d);
1206 			ASSIGN_OPT_SATU32(lssc_m2);
1207 
1208 			ASSIGN_OPT_SATU32(ulsc_m1);
1209 			ASSIGN_OPT(ulsc_d);
1210 			ASSIGN_OPT_SATU32(ulsc_m2);
1211 
1212 			ASSIGN_OPT(flags);
1213 
1214 #undef ASSIGN_OPT
1215 #undef ASSIGN_OPT_SATU32
1216 		} else
1217 			COPY(pq_u);
1218 
1219 		ASSIGN(qid);
1220 		break;
1221 	}
1222 	case 1:	{
1223 		struct pf_altq_v1 *exported_q =
1224 		    &((struct pfioc_altq_v1 *)pa)->altq;
1225 
1226 		COPY(ifname);
1227 
1228 		ASSIGN(scheduler);
1229 		ASSIGN(tbrsize);
1230 		ASSIGN(ifbandwidth);
1231 
1232 		COPY(qname);
1233 		COPY(parent);
1234 		ASSIGN(parent_qid);
1235 		ASSIGN(bandwidth);
1236 		ASSIGN(priority);
1237 		ASSIGN(local_flags);
1238 
1239 		ASSIGN(qlimit);
1240 		ASSIGN(flags);
1241 		COPY(pq_u);
1242 
1243 		ASSIGN(qid);
1244 		break;
1245 	}
1246 	default:
1247 		panic("%s: unhandled struct pfioc_altq version", __func__);
1248 		break;
1249 	}
1250 
1251 #undef ASSIGN
1252 #undef COPY
1253 #undef SATU16
1254 #undef SATU32
1255 
1256 	return (0);
1257 }
1258 
1259 /*
1260  * Handle import to struct pf_kaltq of struct pf_altq from user binaries
1261  * that may be using any version of it.
1262  */
1263 static int
1264 pf_import_kaltq(struct pfioc_altq_v1 *pa, struct pf_altq *q, size_t ioc_size)
1265 {
1266 	u_int32_t version;
1267 
1268 	if (ioc_size == sizeof(struct pfioc_altq_v0))
1269 		version = 0;
1270 	else
1271 		version = pa->version;
1272 
1273 	if (version > PFIOC_ALTQ_VERSION)
1274 		return (EINVAL);
1275 
1276 #define ASSIGN(x) q->x = imported_q->x
1277 #define COPY(x) \
1278 	bcopy(&imported_q->x, &q->x, min(sizeof(imported_q->x), sizeof(q->x)))
1279 
1280 	switch (version) {
1281 	case 0: {
1282 		struct pf_altq_v0 *imported_q =
1283 		    &((struct pfioc_altq_v0 *)pa)->altq;
1284 
1285 		COPY(ifname);
1286 
1287 		ASSIGN(scheduler);
1288 		ASSIGN(tbrsize); /* 16-bit -> 32-bit */
1289 		ASSIGN(ifbandwidth); /* 32-bit -> 64-bit */
1290 
1291 		COPY(qname);
1292 		COPY(parent);
1293 		ASSIGN(parent_qid);
1294 		ASSIGN(bandwidth); /* 32-bit -> 64-bit */
1295 		ASSIGN(priority);
1296 		ASSIGN(local_flags);
1297 
1298 		ASSIGN(qlimit);
1299 		ASSIGN(flags);
1300 
1301 		if (imported_q->scheduler == ALTQT_HFSC) {
1302 #define ASSIGN_OPT(x) q->pq_u.hfsc_opts.x = imported_q->pq_u.hfsc_opts.x
1303 
1304 			/*
1305 			 * The m1 and m2 parameters are being copied from
1306 			 * 32-bit to 64-bit.
1307 			 */
1308 			ASSIGN_OPT(rtsc_m1);
1309 			ASSIGN_OPT(rtsc_d);
1310 			ASSIGN_OPT(rtsc_m2);
1311 
1312 			ASSIGN_OPT(lssc_m1);
1313 			ASSIGN_OPT(lssc_d);
1314 			ASSIGN_OPT(lssc_m2);
1315 
1316 			ASSIGN_OPT(ulsc_m1);
1317 			ASSIGN_OPT(ulsc_d);
1318 			ASSIGN_OPT(ulsc_m2);
1319 
1320 			ASSIGN_OPT(flags);
1321 
1322 #undef ASSIGN_OPT
1323 		} else
1324 			COPY(pq_u);
1325 
1326 		ASSIGN(qid);
1327 		break;
1328 	}
1329 	case 1: {
1330 		struct pf_altq_v1 *imported_q =
1331 		    &((struct pfioc_altq_v1 *)pa)->altq;
1332 
1333 		COPY(ifname);
1334 
1335 		ASSIGN(scheduler);
1336 		ASSIGN(tbrsize);
1337 		ASSIGN(ifbandwidth);
1338 
1339 		COPY(qname);
1340 		COPY(parent);
1341 		ASSIGN(parent_qid);
1342 		ASSIGN(bandwidth);
1343 		ASSIGN(priority);
1344 		ASSIGN(local_flags);
1345 
1346 		ASSIGN(qlimit);
1347 		ASSIGN(flags);
1348 		COPY(pq_u);
1349 
1350 		ASSIGN(qid);
1351 		break;
1352 	}
1353 	default:
1354 		panic("%s: unhandled struct pfioc_altq version", __func__);
1355 		break;
1356 	}
1357 
1358 #undef ASSIGN
1359 #undef COPY
1360 
1361 	return (0);
1362 }
1363 
1364 static struct pf_altq *
1365 pf_altq_get_nth_active(u_int32_t n)
1366 {
1367 	struct pf_altq		*altq;
1368 	u_int32_t		 nr;
1369 
1370 	nr = 0;
1371 	TAILQ_FOREACH(altq, V_pf_altq_ifs_active, entries) {
1372 		if (nr == n)
1373 			return (altq);
1374 		nr++;
1375 	}
1376 
1377 	TAILQ_FOREACH(altq, V_pf_altqs_active, entries) {
1378 		if (nr == n)
1379 			return (altq);
1380 		nr++;
1381 	}
1382 
1383 	return (NULL);
1384 }
1385 #endif /* ALTQ */
1386 
1387 static int
1388 pfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread *td)
1389 {
1390 	int			 error = 0;
1391 	PF_RULES_RLOCK_TRACKER;
1392 
1393 	/* XXX keep in sync with switch() below */
1394 	if (securelevel_gt(td->td_ucred, 2))
1395 		switch (cmd) {
1396 		case DIOCGETRULES:
1397 		case DIOCGETRULE:
1398 		case DIOCGETADDRS:
1399 		case DIOCGETADDR:
1400 		case DIOCGETSTATE:
1401 		case DIOCSETSTATUSIF:
1402 		case DIOCGETSTATUS:
1403 		case DIOCCLRSTATUS:
1404 		case DIOCNATLOOK:
1405 		case DIOCSETDEBUG:
1406 		case DIOCGETSTATES:
1407 		case DIOCGETTIMEOUT:
1408 		case DIOCCLRRULECTRS:
1409 		case DIOCGETLIMIT:
1410 		case DIOCGETALTQSV0:
1411 		case DIOCGETALTQSV1:
1412 		case DIOCGETALTQV0:
1413 		case DIOCGETALTQV1:
1414 		case DIOCGETQSTATSV0:
1415 		case DIOCGETQSTATSV1:
1416 		case DIOCGETRULESETS:
1417 		case DIOCGETRULESET:
1418 		case DIOCRGETTABLES:
1419 		case DIOCRGETTSTATS:
1420 		case DIOCRCLRTSTATS:
1421 		case DIOCRCLRADDRS:
1422 		case DIOCRADDADDRS:
1423 		case DIOCRDELADDRS:
1424 		case DIOCRSETADDRS:
1425 		case DIOCRGETADDRS:
1426 		case DIOCRGETASTATS:
1427 		case DIOCRCLRASTATS:
1428 		case DIOCRTSTADDRS:
1429 		case DIOCOSFPGET:
1430 		case DIOCGETSRCNODES:
1431 		case DIOCCLRSRCNODES:
1432 		case DIOCIGETIFACES:
1433 		case DIOCGIFSPEEDV0:
1434 		case DIOCGIFSPEEDV1:
1435 		case DIOCSETIFFLAG:
1436 		case DIOCCLRIFFLAG:
1437 			break;
1438 		case DIOCRCLRTABLES:
1439 		case DIOCRADDTABLES:
1440 		case DIOCRDELTABLES:
1441 		case DIOCRSETTFLAGS:
1442 			if (((struct pfioc_table *)addr)->pfrio_flags &
1443 			    PFR_FLAG_DUMMY)
1444 				break; /* dummy operation ok */
1445 			return (EPERM);
1446 		default:
1447 			return (EPERM);
1448 		}
1449 
1450 	if (!(flags & FWRITE))
1451 		switch (cmd) {
1452 		case DIOCGETRULES:
1453 		case DIOCGETADDRS:
1454 		case DIOCGETADDR:
1455 		case DIOCGETSTATE:
1456 		case DIOCGETSTATUS:
1457 		case DIOCGETSTATES:
1458 		case DIOCGETTIMEOUT:
1459 		case DIOCGETLIMIT:
1460 		case DIOCGETALTQSV0:
1461 		case DIOCGETALTQSV1:
1462 		case DIOCGETALTQV0:
1463 		case DIOCGETALTQV1:
1464 		case DIOCGETQSTATSV0:
1465 		case DIOCGETQSTATSV1:
1466 		case DIOCGETRULESETS:
1467 		case DIOCGETRULESET:
1468 		case DIOCNATLOOK:
1469 		case DIOCRGETTABLES:
1470 		case DIOCRGETTSTATS:
1471 		case DIOCRGETADDRS:
1472 		case DIOCRGETASTATS:
1473 		case DIOCRTSTADDRS:
1474 		case DIOCOSFPGET:
1475 		case DIOCGETSRCNODES:
1476 		case DIOCIGETIFACES:
1477 		case DIOCGIFSPEEDV1:
1478 		case DIOCGIFSPEEDV0:
1479 			break;
1480 		case DIOCRCLRTABLES:
1481 		case DIOCRADDTABLES:
1482 		case DIOCRDELTABLES:
1483 		case DIOCRCLRTSTATS:
1484 		case DIOCRCLRADDRS:
1485 		case DIOCRADDADDRS:
1486 		case DIOCRDELADDRS:
1487 		case DIOCRSETADDRS:
1488 		case DIOCRSETTFLAGS:
1489 			if (((struct pfioc_table *)addr)->pfrio_flags &
1490 			    PFR_FLAG_DUMMY) {
1491 				flags |= FWRITE; /* need write lock for dummy */
1492 				break; /* dummy operation ok */
1493 			}
1494 			return (EACCES);
1495 		case DIOCGETRULE:
1496 			if (((struct pfioc_rule *)addr)->action ==
1497 			    PF_GET_CLR_CNTR)
1498 				return (EACCES);
1499 			break;
1500 		default:
1501 			return (EACCES);
1502 		}
1503 
1504 	CURVNET_SET(TD_TO_VNET(td));
1505 
1506 	switch (cmd) {
1507 	case DIOCSTART:
1508 		sx_xlock(&pf_ioctl_lock);
1509 		if (V_pf_status.running)
1510 			error = EEXIST;
1511 		else {
1512 			int cpu;
1513 
1514 			error = hook_pf();
1515 			if (error) {
1516 				DPFPRINTF(PF_DEBUG_MISC,
1517 				    ("pf: pfil registration failed\n"));
1518 				break;
1519 			}
1520 			V_pf_status.running = 1;
1521 			V_pf_status.since = time_second;
1522 
1523 			CPU_FOREACH(cpu)
1524 				V_pf_stateid[cpu] = time_second;
1525 
1526 			DPFPRINTF(PF_DEBUG_MISC, ("pf: started\n"));
1527 		}
1528 		break;
1529 
1530 	case DIOCSTOP:
1531 		sx_xlock(&pf_ioctl_lock);
1532 		if (!V_pf_status.running)
1533 			error = ENOENT;
1534 		else {
1535 			V_pf_status.running = 0;
1536 			error = dehook_pf();
1537 			if (error) {
1538 				V_pf_status.running = 1;
1539 				DPFPRINTF(PF_DEBUG_MISC,
1540 				    ("pf: pfil unregistration failed\n"));
1541 			}
1542 			V_pf_status.since = time_second;
1543 			DPFPRINTF(PF_DEBUG_MISC, ("pf: stopped\n"));
1544 		}
1545 		break;
1546 
1547 	case DIOCADDRULE: {
1548 		struct pfioc_rule	*pr = (struct pfioc_rule *)addr;
1549 		struct pf_ruleset	*ruleset;
1550 		struct pf_rule		*rule, *tail;
1551 		struct pf_pooladdr	*pa;
1552 		struct pfi_kif		*kif = NULL;
1553 		int			 rs_num;
1554 
1555 		if (pr->rule.return_icmp >> 8 > ICMP_MAXTYPE) {
1556 			error = EINVAL;
1557 			break;
1558 		}
1559 		if (pr->rule.src.addr.p.dyn != NULL ||
1560 		    pr->rule.dst.addr.p.dyn != NULL) {
1561 			error = EINVAL;
1562 			break;
1563 		}
1564 #ifndef INET
1565 		if (pr->rule.af == AF_INET) {
1566 			error = EAFNOSUPPORT;
1567 			break;
1568 		}
1569 #endif /* INET */
1570 #ifndef INET6
1571 		if (pr->rule.af == AF_INET6) {
1572 			error = EAFNOSUPPORT;
1573 			break;
1574 		}
1575 #endif /* INET6 */
1576 
1577 		rule = malloc(sizeof(*rule), M_PFRULE, M_WAITOK);
1578 		bcopy(&pr->rule, rule, sizeof(struct pf_rule));
1579 		if (rule->ifname[0])
1580 			kif = malloc(sizeof(*kif), PFI_MTYPE, M_WAITOK);
1581 		rule->states_cur = counter_u64_alloc(M_WAITOK);
1582 		rule->states_tot = counter_u64_alloc(M_WAITOK);
1583 		rule->src_nodes = counter_u64_alloc(M_WAITOK);
1584 		rule->cuid = td->td_ucred->cr_ruid;
1585 		rule->cpid = td->td_proc ? td->td_proc->p_pid : 0;
1586 		TAILQ_INIT(&rule->rpool.list);
1587 #define	ERROUT(x)	{ error = (x); goto DIOCADDRULE_error; }
1588 
1589 		PF_RULES_WLOCK();
1590 		pr->anchor[sizeof(pr->anchor) - 1] = 0;
1591 		ruleset = pf_find_ruleset(pr->anchor);
1592 		if (ruleset == NULL)
1593 			ERROUT(EINVAL);
1594 		rs_num = pf_get_ruleset_number(pr->rule.action);
1595 		if (rs_num >= PF_RULESET_MAX)
1596 			ERROUT(EINVAL);
1597 		if (pr->ticket != ruleset->rules[rs_num].inactive.ticket) {
1598 			DPFPRINTF(PF_DEBUG_MISC,
1599 			    ("ticket: %d != [%d]%d\n", pr->ticket, rs_num,
1600 			    ruleset->rules[rs_num].inactive.ticket));
1601 			ERROUT(EBUSY);
1602 		}
1603 		if (pr->pool_ticket != V_ticket_pabuf) {
1604 			DPFPRINTF(PF_DEBUG_MISC,
1605 			    ("pool_ticket: %d != %d\n", pr->pool_ticket,
1606 			    V_ticket_pabuf));
1607 			ERROUT(EBUSY);
1608 		}
1609 
1610 		tail = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr,
1611 		    pf_rulequeue);
1612 		if (tail)
1613 			rule->nr = tail->nr + 1;
1614 		else
1615 			rule->nr = 0;
1616 		if (rule->ifname[0]) {
1617 			rule->kif = pfi_kif_attach(kif, rule->ifname);
1618 			pfi_kif_ref(rule->kif);
1619 		} else
1620 			rule->kif = NULL;
1621 
1622 		if (rule->rtableid > 0 && rule->rtableid >= rt_numfibs)
1623 			error = EBUSY;
1624 
1625 #ifdef ALTQ
1626 		/* set queue IDs */
1627 		if (rule->qname[0] != 0) {
1628 			if ((rule->qid = pf_qname2qid(rule->qname)) == 0)
1629 				error = EBUSY;
1630 			else if (rule->pqname[0] != 0) {
1631 				if ((rule->pqid =
1632 				    pf_qname2qid(rule->pqname)) == 0)
1633 					error = EBUSY;
1634 			} else
1635 				rule->pqid = rule->qid;
1636 		}
1637 #endif
1638 		if (rule->tagname[0])
1639 			if ((rule->tag = pf_tagname2tag(rule->tagname)) == 0)
1640 				error = EBUSY;
1641 		if (rule->match_tagname[0])
1642 			if ((rule->match_tag =
1643 			    pf_tagname2tag(rule->match_tagname)) == 0)
1644 				error = EBUSY;
1645 		if (rule->rt && !rule->direction)
1646 			error = EINVAL;
1647 		if (!rule->log)
1648 			rule->logif = 0;
1649 		if (rule->logif >= PFLOGIFS_MAX)
1650 			error = EINVAL;
1651 		if (pf_addr_setup(ruleset, &rule->src.addr, rule->af))
1652 			error = ENOMEM;
1653 		if (pf_addr_setup(ruleset, &rule->dst.addr, rule->af))
1654 			error = ENOMEM;
1655 		if (pf_anchor_setup(rule, ruleset, pr->anchor_call))
1656 			error = EINVAL;
1657 		if (rule->scrub_flags & PFSTATE_SETPRIO &&
1658 		    (rule->set_prio[0] > PF_PRIO_MAX ||
1659 		    rule->set_prio[1] > PF_PRIO_MAX))
1660 			error = EINVAL;
1661 		TAILQ_FOREACH(pa, &V_pf_pabuf, entries)
1662 			if (pa->addr.type == PF_ADDR_TABLE) {
1663 				pa->addr.p.tbl = pfr_attach_table(ruleset,
1664 				    pa->addr.v.tblname);
1665 				if (pa->addr.p.tbl == NULL)
1666 					error = ENOMEM;
1667 			}
1668 
1669 		rule->overload_tbl = NULL;
1670 		if (rule->overload_tblname[0]) {
1671 			if ((rule->overload_tbl = pfr_attach_table(ruleset,
1672 			    rule->overload_tblname)) == NULL)
1673 				error = EINVAL;
1674 			else
1675 				rule->overload_tbl->pfrkt_flags |=
1676 				    PFR_TFLAG_ACTIVE;
1677 		}
1678 
1679 		pf_mv_pool(&V_pf_pabuf, &rule->rpool.list);
1680 		if (((((rule->action == PF_NAT) || (rule->action == PF_RDR) ||
1681 		    (rule->action == PF_BINAT)) && rule->anchor == NULL) ||
1682 		    (rule->rt > PF_NOPFROUTE)) &&
1683 		    (TAILQ_FIRST(&rule->rpool.list) == NULL))
1684 			error = EINVAL;
1685 
1686 		if (error) {
1687 			pf_free_rule(rule);
1688 			PF_RULES_WUNLOCK();
1689 			break;
1690 		}
1691 
1692 		rule->rpool.cur = TAILQ_FIRST(&rule->rpool.list);
1693 		rule->evaluations = rule->packets[0] = rule->packets[1] =
1694 		    rule->bytes[0] = rule->bytes[1] = 0;
1695 		TAILQ_INSERT_TAIL(ruleset->rules[rs_num].inactive.ptr,
1696 		    rule, entries);
1697 		ruleset->rules[rs_num].inactive.rcount++;
1698 		PF_RULES_WUNLOCK();
1699 		break;
1700 
1701 #undef ERROUT
1702 DIOCADDRULE_error:
1703 		PF_RULES_WUNLOCK();
1704 		counter_u64_free(rule->states_cur);
1705 		counter_u64_free(rule->states_tot);
1706 		counter_u64_free(rule->src_nodes);
1707 		free(rule, M_PFRULE);
1708 		if (kif)
1709 			free(kif, PFI_MTYPE);
1710 		break;
1711 	}
1712 
1713 	case DIOCGETRULES: {
1714 		struct pfioc_rule	*pr = (struct pfioc_rule *)addr;
1715 		struct pf_ruleset	*ruleset;
1716 		struct pf_rule		*tail;
1717 		int			 rs_num;
1718 
1719 		PF_RULES_WLOCK();
1720 		pr->anchor[sizeof(pr->anchor) - 1] = 0;
1721 		ruleset = pf_find_ruleset(pr->anchor);
1722 		if (ruleset == NULL) {
1723 			PF_RULES_WUNLOCK();
1724 			error = EINVAL;
1725 			break;
1726 		}
1727 		rs_num = pf_get_ruleset_number(pr->rule.action);
1728 		if (rs_num >= PF_RULESET_MAX) {
1729 			PF_RULES_WUNLOCK();
1730 			error = EINVAL;
1731 			break;
1732 		}
1733 		tail = TAILQ_LAST(ruleset->rules[rs_num].active.ptr,
1734 		    pf_rulequeue);
1735 		if (tail)
1736 			pr->nr = tail->nr + 1;
1737 		else
1738 			pr->nr = 0;
1739 		pr->ticket = ruleset->rules[rs_num].active.ticket;
1740 		PF_RULES_WUNLOCK();
1741 		break;
1742 	}
1743 
1744 	case DIOCGETRULE: {
1745 		struct pfioc_rule	*pr = (struct pfioc_rule *)addr;
1746 		struct pf_ruleset	*ruleset;
1747 		struct pf_rule		*rule;
1748 		int			 rs_num, i;
1749 
1750 		PF_RULES_WLOCK();
1751 		pr->anchor[sizeof(pr->anchor) - 1] = 0;
1752 		ruleset = pf_find_ruleset(pr->anchor);
1753 		if (ruleset == NULL) {
1754 			PF_RULES_WUNLOCK();
1755 			error = EINVAL;
1756 			break;
1757 		}
1758 		rs_num = pf_get_ruleset_number(pr->rule.action);
1759 		if (rs_num >= PF_RULESET_MAX) {
1760 			PF_RULES_WUNLOCK();
1761 			error = EINVAL;
1762 			break;
1763 		}
1764 		if (pr->ticket != ruleset->rules[rs_num].active.ticket) {
1765 			PF_RULES_WUNLOCK();
1766 			error = EBUSY;
1767 			break;
1768 		}
1769 		rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr);
1770 		while ((rule != NULL) && (rule->nr != pr->nr))
1771 			rule = TAILQ_NEXT(rule, entries);
1772 		if (rule == NULL) {
1773 			PF_RULES_WUNLOCK();
1774 			error = EBUSY;
1775 			break;
1776 		}
1777 		bcopy(rule, &pr->rule, sizeof(struct pf_rule));
1778 		pr->rule.u_states_cur = counter_u64_fetch(rule->states_cur);
1779 		pr->rule.u_states_tot = counter_u64_fetch(rule->states_tot);
1780 		pr->rule.u_src_nodes = counter_u64_fetch(rule->src_nodes);
1781 		if (pf_anchor_copyout(ruleset, rule, pr)) {
1782 			PF_RULES_WUNLOCK();
1783 			error = EBUSY;
1784 			break;
1785 		}
1786 		pf_addr_copyout(&pr->rule.src.addr);
1787 		pf_addr_copyout(&pr->rule.dst.addr);
1788 		for (i = 0; i < PF_SKIP_COUNT; ++i)
1789 			if (rule->skip[i].ptr == NULL)
1790 				pr->rule.skip[i].nr = -1;
1791 			else
1792 				pr->rule.skip[i].nr =
1793 				    rule->skip[i].ptr->nr;
1794 
1795 		if (pr->action == PF_GET_CLR_CNTR) {
1796 			rule->evaluations = 0;
1797 			rule->packets[0] = rule->packets[1] = 0;
1798 			rule->bytes[0] = rule->bytes[1] = 0;
1799 			counter_u64_zero(rule->states_tot);
1800 		}
1801 		PF_RULES_WUNLOCK();
1802 		break;
1803 	}
1804 
1805 	case DIOCCHANGERULE: {
1806 		struct pfioc_rule	*pcr = (struct pfioc_rule *)addr;
1807 		struct pf_ruleset	*ruleset;
1808 		struct pf_rule		*oldrule = NULL, *newrule = NULL;
1809 		struct pfi_kif		*kif = NULL;
1810 		struct pf_pooladdr	*pa;
1811 		u_int32_t		 nr = 0;
1812 		int			 rs_num;
1813 
1814 		if (pcr->action < PF_CHANGE_ADD_HEAD ||
1815 		    pcr->action > PF_CHANGE_GET_TICKET) {
1816 			error = EINVAL;
1817 			break;
1818 		}
1819 		if (pcr->rule.return_icmp >> 8 > ICMP_MAXTYPE) {
1820 			error = EINVAL;
1821 			break;
1822 		}
1823 
1824 		if (pcr->action != PF_CHANGE_REMOVE) {
1825 #ifndef INET
1826 			if (pcr->rule.af == AF_INET) {
1827 				error = EAFNOSUPPORT;
1828 				break;
1829 			}
1830 #endif /* INET */
1831 #ifndef INET6
1832 			if (pcr->rule.af == AF_INET6) {
1833 				error = EAFNOSUPPORT;
1834 				break;
1835 			}
1836 #endif /* INET6 */
1837 			newrule = malloc(sizeof(*newrule), M_PFRULE, M_WAITOK);
1838 			bcopy(&pcr->rule, newrule, sizeof(struct pf_rule));
1839 			if (newrule->ifname[0])
1840 				kif = malloc(sizeof(*kif), PFI_MTYPE, M_WAITOK);
1841 			newrule->states_cur = counter_u64_alloc(M_WAITOK);
1842 			newrule->states_tot = counter_u64_alloc(M_WAITOK);
1843 			newrule->src_nodes = counter_u64_alloc(M_WAITOK);
1844 			newrule->cuid = td->td_ucred->cr_ruid;
1845 			newrule->cpid = td->td_proc ? td->td_proc->p_pid : 0;
1846 			TAILQ_INIT(&newrule->rpool.list);
1847 		}
1848 #define	ERROUT(x)	{ error = (x); goto DIOCCHANGERULE_error; }
1849 
1850 		PF_RULES_WLOCK();
1851 		if (!(pcr->action == PF_CHANGE_REMOVE ||
1852 		    pcr->action == PF_CHANGE_GET_TICKET) &&
1853 		    pcr->pool_ticket != V_ticket_pabuf)
1854 			ERROUT(EBUSY);
1855 
1856 		ruleset = pf_find_ruleset(pcr->anchor);
1857 		if (ruleset == NULL)
1858 			ERROUT(EINVAL);
1859 
1860 		rs_num = pf_get_ruleset_number(pcr->rule.action);
1861 		if (rs_num >= PF_RULESET_MAX)
1862 			ERROUT(EINVAL);
1863 
1864 		if (pcr->action == PF_CHANGE_GET_TICKET) {
1865 			pcr->ticket = ++ruleset->rules[rs_num].active.ticket;
1866 			ERROUT(0);
1867 		} else if (pcr->ticket !=
1868 			    ruleset->rules[rs_num].active.ticket)
1869 				ERROUT(EINVAL);
1870 
1871 		if (pcr->action != PF_CHANGE_REMOVE) {
1872 			if (newrule->ifname[0]) {
1873 				newrule->kif = pfi_kif_attach(kif,
1874 				    newrule->ifname);
1875 				pfi_kif_ref(newrule->kif);
1876 			} else
1877 				newrule->kif = NULL;
1878 
1879 			if (newrule->rtableid > 0 &&
1880 			    newrule->rtableid >= rt_numfibs)
1881 				error = EBUSY;
1882 
1883 #ifdef ALTQ
1884 			/* set queue IDs */
1885 			if (newrule->qname[0] != 0) {
1886 				if ((newrule->qid =
1887 				    pf_qname2qid(newrule->qname)) == 0)
1888 					error = EBUSY;
1889 				else if (newrule->pqname[0] != 0) {
1890 					if ((newrule->pqid =
1891 					    pf_qname2qid(newrule->pqname)) == 0)
1892 						error = EBUSY;
1893 				} else
1894 					newrule->pqid = newrule->qid;
1895 			}
1896 #endif /* ALTQ */
1897 			if (newrule->tagname[0])
1898 				if ((newrule->tag =
1899 				    pf_tagname2tag(newrule->tagname)) == 0)
1900 					error = EBUSY;
1901 			if (newrule->match_tagname[0])
1902 				if ((newrule->match_tag = pf_tagname2tag(
1903 				    newrule->match_tagname)) == 0)
1904 					error = EBUSY;
1905 			if (newrule->rt && !newrule->direction)
1906 				error = EINVAL;
1907 			if (!newrule->log)
1908 				newrule->logif = 0;
1909 			if (newrule->logif >= PFLOGIFS_MAX)
1910 				error = EINVAL;
1911 			if (pf_addr_setup(ruleset, &newrule->src.addr, newrule->af))
1912 				error = ENOMEM;
1913 			if (pf_addr_setup(ruleset, &newrule->dst.addr, newrule->af))
1914 				error = ENOMEM;
1915 			if (pf_anchor_setup(newrule, ruleset, pcr->anchor_call))
1916 				error = EINVAL;
1917 			TAILQ_FOREACH(pa, &V_pf_pabuf, entries)
1918 				if (pa->addr.type == PF_ADDR_TABLE) {
1919 					pa->addr.p.tbl =
1920 					    pfr_attach_table(ruleset,
1921 					    pa->addr.v.tblname);
1922 					if (pa->addr.p.tbl == NULL)
1923 						error = ENOMEM;
1924 				}
1925 
1926 			newrule->overload_tbl = NULL;
1927 			if (newrule->overload_tblname[0]) {
1928 				if ((newrule->overload_tbl = pfr_attach_table(
1929 				    ruleset, newrule->overload_tblname)) ==
1930 				    NULL)
1931 					error = EINVAL;
1932 				else
1933 					newrule->overload_tbl->pfrkt_flags |=
1934 					    PFR_TFLAG_ACTIVE;
1935 			}
1936 
1937 			pf_mv_pool(&V_pf_pabuf, &newrule->rpool.list);
1938 			if (((((newrule->action == PF_NAT) ||
1939 			    (newrule->action == PF_RDR) ||
1940 			    (newrule->action == PF_BINAT) ||
1941 			    (newrule->rt > PF_NOPFROUTE)) &&
1942 			    !newrule->anchor)) &&
1943 			    (TAILQ_FIRST(&newrule->rpool.list) == NULL))
1944 				error = EINVAL;
1945 
1946 			if (error) {
1947 				pf_free_rule(newrule);
1948 				PF_RULES_WUNLOCK();
1949 				break;
1950 			}
1951 
1952 			newrule->rpool.cur = TAILQ_FIRST(&newrule->rpool.list);
1953 			newrule->evaluations = 0;
1954 			newrule->packets[0] = newrule->packets[1] = 0;
1955 			newrule->bytes[0] = newrule->bytes[1] = 0;
1956 		}
1957 		pf_empty_pool(&V_pf_pabuf);
1958 
1959 		if (pcr->action == PF_CHANGE_ADD_HEAD)
1960 			oldrule = TAILQ_FIRST(
1961 			    ruleset->rules[rs_num].active.ptr);
1962 		else if (pcr->action == PF_CHANGE_ADD_TAIL)
1963 			oldrule = TAILQ_LAST(
1964 			    ruleset->rules[rs_num].active.ptr, pf_rulequeue);
1965 		else {
1966 			oldrule = TAILQ_FIRST(
1967 			    ruleset->rules[rs_num].active.ptr);
1968 			while ((oldrule != NULL) && (oldrule->nr != pcr->nr))
1969 				oldrule = TAILQ_NEXT(oldrule, entries);
1970 			if (oldrule == NULL) {
1971 				if (newrule != NULL)
1972 					pf_free_rule(newrule);
1973 				PF_RULES_WUNLOCK();
1974 				error = EINVAL;
1975 				break;
1976 			}
1977 		}
1978 
1979 		if (pcr->action == PF_CHANGE_REMOVE) {
1980 			pf_unlink_rule(ruleset->rules[rs_num].active.ptr,
1981 			    oldrule);
1982 			ruleset->rules[rs_num].active.rcount--;
1983 		} else {
1984 			if (oldrule == NULL)
1985 				TAILQ_INSERT_TAIL(
1986 				    ruleset->rules[rs_num].active.ptr,
1987 				    newrule, entries);
1988 			else if (pcr->action == PF_CHANGE_ADD_HEAD ||
1989 			    pcr->action == PF_CHANGE_ADD_BEFORE)
1990 				TAILQ_INSERT_BEFORE(oldrule, newrule, entries);
1991 			else
1992 				TAILQ_INSERT_AFTER(
1993 				    ruleset->rules[rs_num].active.ptr,
1994 				    oldrule, newrule, entries);
1995 			ruleset->rules[rs_num].active.rcount++;
1996 		}
1997 
1998 		nr = 0;
1999 		TAILQ_FOREACH(oldrule,
2000 		    ruleset->rules[rs_num].active.ptr, entries)
2001 			oldrule->nr = nr++;
2002 
2003 		ruleset->rules[rs_num].active.ticket++;
2004 
2005 		pf_calc_skip_steps(ruleset->rules[rs_num].active.ptr);
2006 		pf_remove_if_empty_ruleset(ruleset);
2007 
2008 		PF_RULES_WUNLOCK();
2009 		break;
2010 
2011 #undef ERROUT
2012 DIOCCHANGERULE_error:
2013 		PF_RULES_WUNLOCK();
2014 		if (newrule != NULL) {
2015 			counter_u64_free(newrule->states_cur);
2016 			counter_u64_free(newrule->states_tot);
2017 			counter_u64_free(newrule->src_nodes);
2018 			free(newrule, M_PFRULE);
2019 		}
2020 		if (kif != NULL)
2021 			free(kif, PFI_MTYPE);
2022 		break;
2023 	}
2024 
2025 	case DIOCCLRSTATES: {
2026 		struct pf_state		*s;
2027 		struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr;
2028 		u_int			 i, killed = 0;
2029 
2030 		for (i = 0; i <= pf_hashmask; i++) {
2031 			struct pf_idhash *ih = &V_pf_idhash[i];
2032 
2033 relock_DIOCCLRSTATES:
2034 			PF_HASHROW_LOCK(ih);
2035 			LIST_FOREACH(s, &ih->states, entry)
2036 				if (!psk->psk_ifname[0] ||
2037 				    !strcmp(psk->psk_ifname,
2038 				    s->kif->pfik_name)) {
2039 					/*
2040 					 * Don't send out individual
2041 					 * delete messages.
2042 					 */
2043 					s->state_flags |= PFSTATE_NOSYNC;
2044 					pf_unlink_state(s, PF_ENTER_LOCKED);
2045 					killed++;
2046 					goto relock_DIOCCLRSTATES;
2047 				}
2048 			PF_HASHROW_UNLOCK(ih);
2049 		}
2050 		psk->psk_killed = killed;
2051 		if (V_pfsync_clear_states_ptr != NULL)
2052 			V_pfsync_clear_states_ptr(V_pf_status.hostid, psk->psk_ifname);
2053 		break;
2054 	}
2055 
2056 	case DIOCKILLSTATES: {
2057 		struct pf_state		*s;
2058 		struct pf_state_key	*sk;
2059 		struct pf_addr		*srcaddr, *dstaddr;
2060 		u_int16_t		 srcport, dstport;
2061 		struct pfioc_state_kill	*psk = (struct pfioc_state_kill *)addr;
2062 		u_int			 i, killed = 0;
2063 
2064 		if (psk->psk_pfcmp.id) {
2065 			if (psk->psk_pfcmp.creatorid == 0)
2066 				psk->psk_pfcmp.creatorid = V_pf_status.hostid;
2067 			if ((s = pf_find_state_byid(psk->psk_pfcmp.id,
2068 			    psk->psk_pfcmp.creatorid))) {
2069 				pf_unlink_state(s, PF_ENTER_LOCKED);
2070 				psk->psk_killed = 1;
2071 			}
2072 			break;
2073 		}
2074 
2075 		for (i = 0; i <= pf_hashmask; i++) {
2076 			struct pf_idhash *ih = &V_pf_idhash[i];
2077 
2078 relock_DIOCKILLSTATES:
2079 			PF_HASHROW_LOCK(ih);
2080 			LIST_FOREACH(s, &ih->states, entry) {
2081 				sk = s->key[PF_SK_WIRE];
2082 				if (s->direction == PF_OUT) {
2083 					srcaddr = &sk->addr[1];
2084 					dstaddr = &sk->addr[0];
2085 					srcport = sk->port[1];
2086 					dstport = sk->port[0];
2087 				} else {
2088 					srcaddr = &sk->addr[0];
2089 					dstaddr = &sk->addr[1];
2090 					srcport = sk->port[0];
2091 					dstport = sk->port[1];
2092 				}
2093 
2094 				if ((!psk->psk_af || sk->af == psk->psk_af)
2095 				    && (!psk->psk_proto || psk->psk_proto ==
2096 				    sk->proto) &&
2097 				    PF_MATCHA(psk->psk_src.neg,
2098 				    &psk->psk_src.addr.v.a.addr,
2099 				    &psk->psk_src.addr.v.a.mask,
2100 				    srcaddr, sk->af) &&
2101 				    PF_MATCHA(psk->psk_dst.neg,
2102 				    &psk->psk_dst.addr.v.a.addr,
2103 				    &psk->psk_dst.addr.v.a.mask,
2104 				    dstaddr, sk->af) &&
2105 				    (psk->psk_src.port_op == 0 ||
2106 				    pf_match_port(psk->psk_src.port_op,
2107 				    psk->psk_src.port[0], psk->psk_src.port[1],
2108 				    srcport)) &&
2109 				    (psk->psk_dst.port_op == 0 ||
2110 				    pf_match_port(psk->psk_dst.port_op,
2111 				    psk->psk_dst.port[0], psk->psk_dst.port[1],
2112 				    dstport)) &&
2113 				    (!psk->psk_label[0] ||
2114 				    (s->rule.ptr->label[0] &&
2115 				    !strcmp(psk->psk_label,
2116 				    s->rule.ptr->label))) &&
2117 				    (!psk->psk_ifname[0] ||
2118 				    !strcmp(psk->psk_ifname,
2119 				    s->kif->pfik_name))) {
2120 					pf_unlink_state(s, PF_ENTER_LOCKED);
2121 					killed++;
2122 					goto relock_DIOCKILLSTATES;
2123 				}
2124 			}
2125 			PF_HASHROW_UNLOCK(ih);
2126 		}
2127 		psk->psk_killed = killed;
2128 		break;
2129 	}
2130 
2131 	case DIOCADDSTATE: {
2132 		struct pfioc_state	*ps = (struct pfioc_state *)addr;
2133 		struct pfsync_state	*sp = &ps->state;
2134 
2135 		if (sp->timeout >= PFTM_MAX) {
2136 			error = EINVAL;
2137 			break;
2138 		}
2139 		if (V_pfsync_state_import_ptr != NULL) {
2140 			PF_RULES_RLOCK();
2141 			error = V_pfsync_state_import_ptr(sp, PFSYNC_SI_IOCTL);
2142 			PF_RULES_RUNLOCK();
2143 		} else
2144 			error = EOPNOTSUPP;
2145 		break;
2146 	}
2147 
2148 	case DIOCGETSTATE: {
2149 		struct pfioc_state	*ps = (struct pfioc_state *)addr;
2150 		struct pf_state		*s;
2151 
2152 		s = pf_find_state_byid(ps->state.id, ps->state.creatorid);
2153 		if (s == NULL) {
2154 			error = ENOENT;
2155 			break;
2156 		}
2157 
2158 		pfsync_state_export(&ps->state, s);
2159 		PF_STATE_UNLOCK(s);
2160 		break;
2161 	}
2162 
2163 	case DIOCGETSTATES: {
2164 		struct pfioc_states	*ps = (struct pfioc_states *)addr;
2165 		struct pf_state		*s;
2166 		struct pfsync_state	*pstore, *p;
2167 		int i, nr;
2168 
2169 		if (ps->ps_len <= 0) {
2170 			nr = uma_zone_get_cur(V_pf_state_z);
2171 			ps->ps_len = sizeof(struct pfsync_state) * nr;
2172 			break;
2173 		}
2174 
2175 		p = pstore = malloc(ps->ps_len, M_TEMP, M_WAITOK | M_ZERO);
2176 		nr = 0;
2177 
2178 		for (i = 0; i <= pf_hashmask; i++) {
2179 			struct pf_idhash *ih = &V_pf_idhash[i];
2180 
2181 			PF_HASHROW_LOCK(ih);
2182 			LIST_FOREACH(s, &ih->states, entry) {
2183 				if (s->timeout == PFTM_UNLINKED)
2184 					continue;
2185 
2186 				if ((nr+1) * sizeof(*p) > ps->ps_len) {
2187 					PF_HASHROW_UNLOCK(ih);
2188 					goto DIOCGETSTATES_full;
2189 				}
2190 				pfsync_state_export(p, s);
2191 				p++;
2192 				nr++;
2193 			}
2194 			PF_HASHROW_UNLOCK(ih);
2195 		}
2196 DIOCGETSTATES_full:
2197 		error = copyout(pstore, ps->ps_states,
2198 		    sizeof(struct pfsync_state) * nr);
2199 		if (error) {
2200 			free(pstore, M_TEMP);
2201 			break;
2202 		}
2203 		ps->ps_len = sizeof(struct pfsync_state) * nr;
2204 		free(pstore, M_TEMP);
2205 
2206 		break;
2207 	}
2208 
2209 	case DIOCGETSTATUS: {
2210 		struct pf_status *s = (struct pf_status *)addr;
2211 
2212 		PF_RULES_RLOCK();
2213 		s->running = V_pf_status.running;
2214 		s->since   = V_pf_status.since;
2215 		s->debug   = V_pf_status.debug;
2216 		s->hostid  = V_pf_status.hostid;
2217 		s->states  = V_pf_status.states;
2218 		s->src_nodes = V_pf_status.src_nodes;
2219 
2220 		for (int i = 0; i < PFRES_MAX; i++)
2221 			s->counters[i] =
2222 			    counter_u64_fetch(V_pf_status.counters[i]);
2223 		for (int i = 0; i < LCNT_MAX; i++)
2224 			s->lcounters[i] =
2225 			    counter_u64_fetch(V_pf_status.lcounters[i]);
2226 		for (int i = 0; i < FCNT_MAX; i++)
2227 			s->fcounters[i] =
2228 			    counter_u64_fetch(V_pf_status.fcounters[i]);
2229 		for (int i = 0; i < SCNT_MAX; i++)
2230 			s->scounters[i] =
2231 			    counter_u64_fetch(V_pf_status.scounters[i]);
2232 
2233 		bcopy(V_pf_status.ifname, s->ifname, IFNAMSIZ);
2234 		bcopy(V_pf_status.pf_chksum, s->pf_chksum,
2235 		    PF_MD5_DIGEST_LENGTH);
2236 
2237 		pfi_update_status(s->ifname, s);
2238 		PF_RULES_RUNLOCK();
2239 		break;
2240 	}
2241 
2242 	case DIOCSETSTATUSIF: {
2243 		struct pfioc_if	*pi = (struct pfioc_if *)addr;
2244 
2245 		if (pi->ifname[0] == 0) {
2246 			bzero(V_pf_status.ifname, IFNAMSIZ);
2247 			break;
2248 		}
2249 		PF_RULES_WLOCK();
2250 		strlcpy(V_pf_status.ifname, pi->ifname, IFNAMSIZ);
2251 		PF_RULES_WUNLOCK();
2252 		break;
2253 	}
2254 
2255 	case DIOCCLRSTATUS: {
2256 		PF_RULES_WLOCK();
2257 		for (int i = 0; i < PFRES_MAX; i++)
2258 			counter_u64_zero(V_pf_status.counters[i]);
2259 		for (int i = 0; i < FCNT_MAX; i++)
2260 			counter_u64_zero(V_pf_status.fcounters[i]);
2261 		for (int i = 0; i < SCNT_MAX; i++)
2262 			counter_u64_zero(V_pf_status.scounters[i]);
2263 		for (int i = 0; i < LCNT_MAX; i++)
2264 			counter_u64_zero(V_pf_status.lcounters[i]);
2265 		V_pf_status.since = time_second;
2266 		if (*V_pf_status.ifname)
2267 			pfi_update_status(V_pf_status.ifname, NULL);
2268 		PF_RULES_WUNLOCK();
2269 		break;
2270 	}
2271 
2272 	case DIOCNATLOOK: {
2273 		struct pfioc_natlook	*pnl = (struct pfioc_natlook *)addr;
2274 		struct pf_state_key	*sk;
2275 		struct pf_state		*state;
2276 		struct pf_state_key_cmp	 key;
2277 		int			 m = 0, direction = pnl->direction;
2278 		int			 sidx, didx;
2279 
2280 		/* NATLOOK src and dst are reversed, so reverse sidx/didx */
2281 		sidx = (direction == PF_IN) ? 1 : 0;
2282 		didx = (direction == PF_IN) ? 0 : 1;
2283 
2284 		if (!pnl->proto ||
2285 		    PF_AZERO(&pnl->saddr, pnl->af) ||
2286 		    PF_AZERO(&pnl->daddr, pnl->af) ||
2287 		    ((pnl->proto == IPPROTO_TCP ||
2288 		    pnl->proto == IPPROTO_UDP) &&
2289 		    (!pnl->dport || !pnl->sport)))
2290 			error = EINVAL;
2291 		else {
2292 			bzero(&key, sizeof(key));
2293 			key.af = pnl->af;
2294 			key.proto = pnl->proto;
2295 			PF_ACPY(&key.addr[sidx], &pnl->saddr, pnl->af);
2296 			key.port[sidx] = pnl->sport;
2297 			PF_ACPY(&key.addr[didx], &pnl->daddr, pnl->af);
2298 			key.port[didx] = pnl->dport;
2299 
2300 			state = pf_find_state_all(&key, direction, &m);
2301 
2302 			if (m > 1)
2303 				error = E2BIG;	/* more than one state */
2304 			else if (state != NULL) {
2305 				/* XXXGL: not locked read */
2306 				sk = state->key[sidx];
2307 				PF_ACPY(&pnl->rsaddr, &sk->addr[sidx], sk->af);
2308 				pnl->rsport = sk->port[sidx];
2309 				PF_ACPY(&pnl->rdaddr, &sk->addr[didx], sk->af);
2310 				pnl->rdport = sk->port[didx];
2311 			} else
2312 				error = ENOENT;
2313 		}
2314 		break;
2315 	}
2316 
2317 	case DIOCSETTIMEOUT: {
2318 		struct pfioc_tm	*pt = (struct pfioc_tm *)addr;
2319 		int		 old;
2320 
2321 		if (pt->timeout < 0 || pt->timeout >= PFTM_MAX ||
2322 		    pt->seconds < 0) {
2323 			error = EINVAL;
2324 			break;
2325 		}
2326 		PF_RULES_WLOCK();
2327 		old = V_pf_default_rule.timeout[pt->timeout];
2328 		if (pt->timeout == PFTM_INTERVAL && pt->seconds == 0)
2329 			pt->seconds = 1;
2330 		V_pf_default_rule.timeout[pt->timeout] = pt->seconds;
2331 		if (pt->timeout == PFTM_INTERVAL && pt->seconds < old)
2332 			wakeup(pf_purge_thread);
2333 		pt->seconds = old;
2334 		PF_RULES_WUNLOCK();
2335 		break;
2336 	}
2337 
2338 	case DIOCGETTIMEOUT: {
2339 		struct pfioc_tm	*pt = (struct pfioc_tm *)addr;
2340 
2341 		if (pt->timeout < 0 || pt->timeout >= PFTM_MAX) {
2342 			error = EINVAL;
2343 			break;
2344 		}
2345 		PF_RULES_RLOCK();
2346 		pt->seconds = V_pf_default_rule.timeout[pt->timeout];
2347 		PF_RULES_RUNLOCK();
2348 		break;
2349 	}
2350 
2351 	case DIOCGETLIMIT: {
2352 		struct pfioc_limit	*pl = (struct pfioc_limit *)addr;
2353 
2354 		if (pl->index < 0 || pl->index >= PF_LIMIT_MAX) {
2355 			error = EINVAL;
2356 			break;
2357 		}
2358 		PF_RULES_RLOCK();
2359 		pl->limit = V_pf_limits[pl->index].limit;
2360 		PF_RULES_RUNLOCK();
2361 		break;
2362 	}
2363 
2364 	case DIOCSETLIMIT: {
2365 		struct pfioc_limit	*pl = (struct pfioc_limit *)addr;
2366 		int			 old_limit;
2367 
2368 		PF_RULES_WLOCK();
2369 		if (pl->index < 0 || pl->index >= PF_LIMIT_MAX ||
2370 		    V_pf_limits[pl->index].zone == NULL) {
2371 			PF_RULES_WUNLOCK();
2372 			error = EINVAL;
2373 			break;
2374 		}
2375 		uma_zone_set_max(V_pf_limits[pl->index].zone, pl->limit);
2376 		old_limit = V_pf_limits[pl->index].limit;
2377 		V_pf_limits[pl->index].limit = pl->limit;
2378 		pl->limit = old_limit;
2379 		PF_RULES_WUNLOCK();
2380 		break;
2381 	}
2382 
2383 	case DIOCSETDEBUG: {
2384 		u_int32_t	*level = (u_int32_t *)addr;
2385 
2386 		PF_RULES_WLOCK();
2387 		V_pf_status.debug = *level;
2388 		PF_RULES_WUNLOCK();
2389 		break;
2390 	}
2391 
2392 	case DIOCCLRRULECTRS: {
2393 		/* obsoleted by DIOCGETRULE with action=PF_GET_CLR_CNTR */
2394 		struct pf_ruleset	*ruleset = &pf_main_ruleset;
2395 		struct pf_rule		*rule;
2396 
2397 		PF_RULES_WLOCK();
2398 		TAILQ_FOREACH(rule,
2399 		    ruleset->rules[PF_RULESET_FILTER].active.ptr, entries) {
2400 			rule->evaluations = 0;
2401 			rule->packets[0] = rule->packets[1] = 0;
2402 			rule->bytes[0] = rule->bytes[1] = 0;
2403 		}
2404 		PF_RULES_WUNLOCK();
2405 		break;
2406 	}
2407 
2408 	case DIOCGIFSPEEDV0:
2409 	case DIOCGIFSPEEDV1: {
2410 		struct pf_ifspeed_v1	*psp = (struct pf_ifspeed_v1 *)addr;
2411 		struct pf_ifspeed_v1	ps;
2412 		struct ifnet		*ifp;
2413 
2414 		if (psp->ifname[0] != 0) {
2415 			/* Can we completely trust user-land? */
2416 			strlcpy(ps.ifname, psp->ifname, IFNAMSIZ);
2417 			ifp = ifunit(ps.ifname);
2418 			if (ifp != NULL) {
2419 				psp->baudrate32 =
2420 				    (u_int32_t)uqmin(ifp->if_baudrate, UINT_MAX);
2421 				if (cmd == DIOCGIFSPEEDV1)
2422 					psp->baudrate = ifp->if_baudrate;
2423 			} else
2424 				error = EINVAL;
2425 		} else
2426 			error = EINVAL;
2427 		break;
2428 	}
2429 
2430 #ifdef ALTQ
2431 	case DIOCSTARTALTQ: {
2432 		struct pf_altq		*altq;
2433 
2434 		PF_RULES_WLOCK();
2435 		/* enable all altq interfaces on active list */
2436 		TAILQ_FOREACH(altq, V_pf_altq_ifs_active, entries) {
2437 			if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) {
2438 				error = pf_enable_altq(altq);
2439 				if (error != 0)
2440 					break;
2441 			}
2442 		}
2443 		if (error == 0)
2444 			V_pf_altq_running = 1;
2445 		PF_RULES_WUNLOCK();
2446 		DPFPRINTF(PF_DEBUG_MISC, ("altq: started\n"));
2447 		break;
2448 	}
2449 
2450 	case DIOCSTOPALTQ: {
2451 		struct pf_altq		*altq;
2452 
2453 		PF_RULES_WLOCK();
2454 		/* disable all altq interfaces on active list */
2455 		TAILQ_FOREACH(altq, V_pf_altq_ifs_active, entries) {
2456 			if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) {
2457 				error = pf_disable_altq(altq);
2458 				if (error != 0)
2459 					break;
2460 			}
2461 		}
2462 		if (error == 0)
2463 			V_pf_altq_running = 0;
2464 		PF_RULES_WUNLOCK();
2465 		DPFPRINTF(PF_DEBUG_MISC, ("altq: stopped\n"));
2466 		break;
2467 	}
2468 
2469 	case DIOCADDALTQV0:
2470 	case DIOCADDALTQV1: {
2471 		struct pfioc_altq_v1	*pa = (struct pfioc_altq_v1 *)addr;
2472 		struct pf_altq		*altq, *a;
2473 		struct ifnet		*ifp;
2474 
2475 		altq = malloc(sizeof(*altq), M_PFALTQ, M_WAITOK | M_ZERO);
2476 		error = pf_import_kaltq(pa, altq, IOCPARM_LEN(cmd));
2477 		if (error)
2478 			break;
2479 		altq->local_flags = 0;
2480 
2481 		PF_RULES_WLOCK();
2482 		if (pa->ticket != V_ticket_altqs_inactive) {
2483 			PF_RULES_WUNLOCK();
2484 			free(altq, M_PFALTQ);
2485 			error = EBUSY;
2486 			break;
2487 		}
2488 
2489 		/*
2490 		 * if this is for a queue, find the discipline and
2491 		 * copy the necessary fields
2492 		 */
2493 		if (altq->qname[0] != 0) {
2494 			if ((altq->qid = pf_qname2qid(altq->qname)) == 0) {
2495 				PF_RULES_WUNLOCK();
2496 				error = EBUSY;
2497 				free(altq, M_PFALTQ);
2498 				break;
2499 			}
2500 			altq->altq_disc = NULL;
2501 			TAILQ_FOREACH(a, V_pf_altq_ifs_inactive, entries) {
2502 				if (strncmp(a->ifname, altq->ifname,
2503 				    IFNAMSIZ) == 0) {
2504 					altq->altq_disc = a->altq_disc;
2505 					break;
2506 				}
2507 			}
2508 		}
2509 
2510 		if ((ifp = ifunit(altq->ifname)) == NULL)
2511 			altq->local_flags |= PFALTQ_FLAG_IF_REMOVED;
2512 		else
2513 			error = altq_add(ifp, altq);
2514 
2515 		if (error) {
2516 			PF_RULES_WUNLOCK();
2517 			free(altq, M_PFALTQ);
2518 			break;
2519 		}
2520 
2521 		if (altq->qname[0] != 0)
2522 			TAILQ_INSERT_TAIL(V_pf_altqs_inactive, altq, entries);
2523 		else
2524 			TAILQ_INSERT_TAIL(V_pf_altq_ifs_inactive, altq, entries);
2525 		/* version error check done on import above */
2526 		pf_export_kaltq(altq, pa, IOCPARM_LEN(cmd));
2527 		PF_RULES_WUNLOCK();
2528 		break;
2529 	}
2530 
2531 	case DIOCGETALTQSV0:
2532 	case DIOCGETALTQSV1: {
2533 		struct pfioc_altq_v1	*pa = (struct pfioc_altq_v1 *)addr;
2534 		struct pf_altq		*altq;
2535 
2536 		PF_RULES_RLOCK();
2537 		pa->nr = 0;
2538 		TAILQ_FOREACH(altq, V_pf_altq_ifs_active, entries)
2539 			pa->nr++;
2540 		TAILQ_FOREACH(altq, V_pf_altqs_active, entries)
2541 			pa->nr++;
2542 		pa->ticket = V_ticket_altqs_active;
2543 		PF_RULES_RUNLOCK();
2544 		break;
2545 	}
2546 
2547 	case DIOCGETALTQV0:
2548 	case DIOCGETALTQV1: {
2549 		struct pfioc_altq_v1	*pa = (struct pfioc_altq_v1 *)addr;
2550 		struct pf_altq		*altq;
2551 
2552 		PF_RULES_RLOCK();
2553 		if (pa->ticket != V_ticket_altqs_active) {
2554 			PF_RULES_RUNLOCK();
2555 			error = EBUSY;
2556 			break;
2557 		}
2558 		altq = pf_altq_get_nth_active(pa->nr);
2559 		if (altq == NULL) {
2560 			PF_RULES_RUNLOCK();
2561 			error = EBUSY;
2562 			break;
2563 		}
2564 		pf_export_kaltq(altq, pa, IOCPARM_LEN(cmd));
2565 		PF_RULES_RUNLOCK();
2566 		break;
2567 	}
2568 
2569 	case DIOCCHANGEALTQV0:
2570 	case DIOCCHANGEALTQV1:
2571 		/* CHANGEALTQ not supported yet! */
2572 		error = ENODEV;
2573 		break;
2574 
2575 	case DIOCGETQSTATSV0:
2576 	case DIOCGETQSTATSV1: {
2577 		struct pfioc_qstats_v1	*pq = (struct pfioc_qstats_v1 *)addr;
2578 		struct pf_altq		*altq;
2579 		int			 nbytes;
2580 		u_int32_t		 version;
2581 
2582 		PF_RULES_RLOCK();
2583 		if (pq->ticket != V_ticket_altqs_active) {
2584 			PF_RULES_RUNLOCK();
2585 			error = EBUSY;
2586 			break;
2587 		}
2588 		nbytes = pq->nbytes;
2589 		altq = pf_altq_get_nth_active(pq->nr);
2590 		if (altq == NULL) {
2591 			PF_RULES_RUNLOCK();
2592 			error = EBUSY;
2593 			break;
2594 		}
2595 
2596 		if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) != 0) {
2597 			PF_RULES_RUNLOCK();
2598 			error = ENXIO;
2599 			break;
2600 		}
2601 		PF_RULES_RUNLOCK();
2602 		if (cmd == DIOCGETQSTATSV0)
2603 			version = 0;  /* DIOCGETQSTATSV0 means stats struct v0 */
2604 		else
2605 			version = pq->version;
2606 		error = altq_getqstats(altq, pq->buf, &nbytes, version);
2607 		if (error == 0) {
2608 			pq->scheduler = altq->scheduler;
2609 			pq->nbytes = nbytes;
2610 		}
2611 		break;
2612 	}
2613 #endif /* ALTQ */
2614 
2615 	case DIOCBEGINADDRS: {
2616 		struct pfioc_pooladdr	*pp = (struct pfioc_pooladdr *)addr;
2617 
2618 		PF_RULES_WLOCK();
2619 		pf_empty_pool(&V_pf_pabuf);
2620 		pp->ticket = ++V_ticket_pabuf;
2621 		PF_RULES_WUNLOCK();
2622 		break;
2623 	}
2624 
2625 	case DIOCADDADDR: {
2626 		struct pfioc_pooladdr	*pp = (struct pfioc_pooladdr *)addr;
2627 		struct pf_pooladdr	*pa;
2628 		struct pfi_kif		*kif = NULL;
2629 
2630 #ifndef INET
2631 		if (pp->af == AF_INET) {
2632 			error = EAFNOSUPPORT;
2633 			break;
2634 		}
2635 #endif /* INET */
2636 #ifndef INET6
2637 		if (pp->af == AF_INET6) {
2638 			error = EAFNOSUPPORT;
2639 			break;
2640 		}
2641 #endif /* INET6 */
2642 		if (pp->addr.addr.type != PF_ADDR_ADDRMASK &&
2643 		    pp->addr.addr.type != PF_ADDR_DYNIFTL &&
2644 		    pp->addr.addr.type != PF_ADDR_TABLE) {
2645 			error = EINVAL;
2646 			break;
2647 		}
2648 		if (pp->addr.addr.p.dyn != NULL) {
2649 			error = EINVAL;
2650 			break;
2651 		}
2652 		pa = malloc(sizeof(*pa), M_PFRULE, M_WAITOK);
2653 		bcopy(&pp->addr, pa, sizeof(struct pf_pooladdr));
2654 		if (pa->ifname[0])
2655 			kif = malloc(sizeof(*kif), PFI_MTYPE, M_WAITOK);
2656 		PF_RULES_WLOCK();
2657 		if (pp->ticket != V_ticket_pabuf) {
2658 			PF_RULES_WUNLOCK();
2659 			if (pa->ifname[0])
2660 				free(kif, PFI_MTYPE);
2661 			free(pa, M_PFRULE);
2662 			error = EBUSY;
2663 			break;
2664 		}
2665 		if (pa->ifname[0]) {
2666 			pa->kif = pfi_kif_attach(kif, pa->ifname);
2667 			pfi_kif_ref(pa->kif);
2668 		} else
2669 			pa->kif = NULL;
2670 		if (pa->addr.type == PF_ADDR_DYNIFTL && ((error =
2671 		    pfi_dynaddr_setup(&pa->addr, pp->af)) != 0)) {
2672 			if (pa->ifname[0])
2673 				pfi_kif_unref(pa->kif);
2674 			PF_RULES_WUNLOCK();
2675 			free(pa, M_PFRULE);
2676 			break;
2677 		}
2678 		TAILQ_INSERT_TAIL(&V_pf_pabuf, pa, entries);
2679 		PF_RULES_WUNLOCK();
2680 		break;
2681 	}
2682 
2683 	case DIOCGETADDRS: {
2684 		struct pfioc_pooladdr	*pp = (struct pfioc_pooladdr *)addr;
2685 		struct pf_pool		*pool;
2686 		struct pf_pooladdr	*pa;
2687 
2688 		PF_RULES_RLOCK();
2689 		pp->nr = 0;
2690 		pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action,
2691 		    pp->r_num, 0, 1, 0);
2692 		if (pool == NULL) {
2693 			PF_RULES_RUNLOCK();
2694 			error = EBUSY;
2695 			break;
2696 		}
2697 		TAILQ_FOREACH(pa, &pool->list, entries)
2698 			pp->nr++;
2699 		PF_RULES_RUNLOCK();
2700 		break;
2701 	}
2702 
2703 	case DIOCGETADDR: {
2704 		struct pfioc_pooladdr	*pp = (struct pfioc_pooladdr *)addr;
2705 		struct pf_pool		*pool;
2706 		struct pf_pooladdr	*pa;
2707 		u_int32_t		 nr = 0;
2708 
2709 		PF_RULES_RLOCK();
2710 		pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action,
2711 		    pp->r_num, 0, 1, 1);
2712 		if (pool == NULL) {
2713 			PF_RULES_RUNLOCK();
2714 			error = EBUSY;
2715 			break;
2716 		}
2717 		pa = TAILQ_FIRST(&pool->list);
2718 		while ((pa != NULL) && (nr < pp->nr)) {
2719 			pa = TAILQ_NEXT(pa, entries);
2720 			nr++;
2721 		}
2722 		if (pa == NULL) {
2723 			PF_RULES_RUNLOCK();
2724 			error = EBUSY;
2725 			break;
2726 		}
2727 		bcopy(pa, &pp->addr, sizeof(struct pf_pooladdr));
2728 		pf_addr_copyout(&pp->addr.addr);
2729 		PF_RULES_RUNLOCK();
2730 		break;
2731 	}
2732 
2733 	case DIOCCHANGEADDR: {
2734 		struct pfioc_pooladdr	*pca = (struct pfioc_pooladdr *)addr;
2735 		struct pf_pool		*pool;
2736 		struct pf_pooladdr	*oldpa = NULL, *newpa = NULL;
2737 		struct pf_ruleset	*ruleset;
2738 		struct pfi_kif		*kif = NULL;
2739 
2740 		if (pca->action < PF_CHANGE_ADD_HEAD ||
2741 		    pca->action > PF_CHANGE_REMOVE) {
2742 			error = EINVAL;
2743 			break;
2744 		}
2745 		if (pca->addr.addr.type != PF_ADDR_ADDRMASK &&
2746 		    pca->addr.addr.type != PF_ADDR_DYNIFTL &&
2747 		    pca->addr.addr.type != PF_ADDR_TABLE) {
2748 			error = EINVAL;
2749 			break;
2750 		}
2751 		if (pca->addr.addr.p.dyn != NULL) {
2752 			error = EINVAL;
2753 			break;
2754 		}
2755 
2756 		if (pca->action != PF_CHANGE_REMOVE) {
2757 #ifndef INET
2758 			if (pca->af == AF_INET) {
2759 				error = EAFNOSUPPORT;
2760 				break;
2761 			}
2762 #endif /* INET */
2763 #ifndef INET6
2764 			if (pca->af == AF_INET6) {
2765 				error = EAFNOSUPPORT;
2766 				break;
2767 			}
2768 #endif /* INET6 */
2769 			newpa = malloc(sizeof(*newpa), M_PFRULE, M_WAITOK);
2770 			bcopy(&pca->addr, newpa, sizeof(struct pf_pooladdr));
2771 			if (newpa->ifname[0])
2772 				kif = malloc(sizeof(*kif), PFI_MTYPE, M_WAITOK);
2773 			newpa->kif = NULL;
2774 		}
2775 #define	ERROUT(x)	{ error = (x); goto DIOCCHANGEADDR_error; }
2776 		PF_RULES_WLOCK();
2777 		ruleset = pf_find_ruleset(pca->anchor);
2778 		if (ruleset == NULL)
2779 			ERROUT(EBUSY);
2780 
2781 		pool = pf_get_pool(pca->anchor, pca->ticket, pca->r_action,
2782 		    pca->r_num, pca->r_last, 1, 1);
2783 		if (pool == NULL)
2784 			ERROUT(EBUSY);
2785 
2786 		if (pca->action != PF_CHANGE_REMOVE) {
2787 			if (newpa->ifname[0]) {
2788 				newpa->kif = pfi_kif_attach(kif, newpa->ifname);
2789 				pfi_kif_ref(newpa->kif);
2790 				kif = NULL;
2791 			}
2792 
2793 			switch (newpa->addr.type) {
2794 			case PF_ADDR_DYNIFTL:
2795 				error = pfi_dynaddr_setup(&newpa->addr,
2796 				    pca->af);
2797 				break;
2798 			case PF_ADDR_TABLE:
2799 				newpa->addr.p.tbl = pfr_attach_table(ruleset,
2800 				    newpa->addr.v.tblname);
2801 				if (newpa->addr.p.tbl == NULL)
2802 					error = ENOMEM;
2803 				break;
2804 			}
2805 			if (error)
2806 				goto DIOCCHANGEADDR_error;
2807 		}
2808 
2809 		switch (pca->action) {
2810 		case PF_CHANGE_ADD_HEAD:
2811 			oldpa = TAILQ_FIRST(&pool->list);
2812 			break;
2813 		case PF_CHANGE_ADD_TAIL:
2814 			oldpa = TAILQ_LAST(&pool->list, pf_palist);
2815 			break;
2816 		default:
2817 			oldpa = TAILQ_FIRST(&pool->list);
2818 			for (int i = 0; oldpa && i < pca->nr; i++)
2819 				oldpa = TAILQ_NEXT(oldpa, entries);
2820 
2821 			if (oldpa == NULL)
2822 				ERROUT(EINVAL);
2823 		}
2824 
2825 		if (pca->action == PF_CHANGE_REMOVE) {
2826 			TAILQ_REMOVE(&pool->list, oldpa, entries);
2827 			switch (oldpa->addr.type) {
2828 			case PF_ADDR_DYNIFTL:
2829 				pfi_dynaddr_remove(oldpa->addr.p.dyn);
2830 				break;
2831 			case PF_ADDR_TABLE:
2832 				pfr_detach_table(oldpa->addr.p.tbl);
2833 				break;
2834 			}
2835 			if (oldpa->kif)
2836 				pfi_kif_unref(oldpa->kif);
2837 			free(oldpa, M_PFRULE);
2838 		} else {
2839 			if (oldpa == NULL)
2840 				TAILQ_INSERT_TAIL(&pool->list, newpa, entries);
2841 			else if (pca->action == PF_CHANGE_ADD_HEAD ||
2842 			    pca->action == PF_CHANGE_ADD_BEFORE)
2843 				TAILQ_INSERT_BEFORE(oldpa, newpa, entries);
2844 			else
2845 				TAILQ_INSERT_AFTER(&pool->list, oldpa,
2846 				    newpa, entries);
2847 		}
2848 
2849 		pool->cur = TAILQ_FIRST(&pool->list);
2850 		PF_ACPY(&pool->counter, &pool->cur->addr.v.a.addr, pca->af);
2851 		PF_RULES_WUNLOCK();
2852 		break;
2853 
2854 #undef ERROUT
2855 DIOCCHANGEADDR_error:
2856 		if (newpa != NULL) {
2857 			if (newpa->kif)
2858 				pfi_kif_unref(newpa->kif);
2859 			free(newpa, M_PFRULE);
2860 		}
2861 		PF_RULES_WUNLOCK();
2862 		if (kif != NULL)
2863 			free(kif, PFI_MTYPE);
2864 		break;
2865 	}
2866 
2867 	case DIOCGETRULESETS: {
2868 		struct pfioc_ruleset	*pr = (struct pfioc_ruleset *)addr;
2869 		struct pf_ruleset	*ruleset;
2870 		struct pf_anchor	*anchor;
2871 
2872 		PF_RULES_RLOCK();
2873 		pr->path[sizeof(pr->path) - 1] = 0;
2874 		if ((ruleset = pf_find_ruleset(pr->path)) == NULL) {
2875 			PF_RULES_RUNLOCK();
2876 			error = ENOENT;
2877 			break;
2878 		}
2879 		pr->nr = 0;
2880 		if (ruleset->anchor == NULL) {
2881 			/* XXX kludge for pf_main_ruleset */
2882 			RB_FOREACH(anchor, pf_anchor_global, &V_pf_anchors)
2883 				if (anchor->parent == NULL)
2884 					pr->nr++;
2885 		} else {
2886 			RB_FOREACH(anchor, pf_anchor_node,
2887 			    &ruleset->anchor->children)
2888 				pr->nr++;
2889 		}
2890 		PF_RULES_RUNLOCK();
2891 		break;
2892 	}
2893 
2894 	case DIOCGETRULESET: {
2895 		struct pfioc_ruleset	*pr = (struct pfioc_ruleset *)addr;
2896 		struct pf_ruleset	*ruleset;
2897 		struct pf_anchor	*anchor;
2898 		u_int32_t		 nr = 0;
2899 
2900 		PF_RULES_RLOCK();
2901 		pr->path[sizeof(pr->path) - 1] = 0;
2902 		if ((ruleset = pf_find_ruleset(pr->path)) == NULL) {
2903 			PF_RULES_RUNLOCK();
2904 			error = ENOENT;
2905 			break;
2906 		}
2907 		pr->name[0] = 0;
2908 		if (ruleset->anchor == NULL) {
2909 			/* XXX kludge for pf_main_ruleset */
2910 			RB_FOREACH(anchor, pf_anchor_global, &V_pf_anchors)
2911 				if (anchor->parent == NULL && nr++ == pr->nr) {
2912 					strlcpy(pr->name, anchor->name,
2913 					    sizeof(pr->name));
2914 					break;
2915 				}
2916 		} else {
2917 			RB_FOREACH(anchor, pf_anchor_node,
2918 			    &ruleset->anchor->children)
2919 				if (nr++ == pr->nr) {
2920 					strlcpy(pr->name, anchor->name,
2921 					    sizeof(pr->name));
2922 					break;
2923 				}
2924 		}
2925 		if (!pr->name[0])
2926 			error = EBUSY;
2927 		PF_RULES_RUNLOCK();
2928 		break;
2929 	}
2930 
2931 	case DIOCRCLRTABLES: {
2932 		struct pfioc_table *io = (struct pfioc_table *)addr;
2933 
2934 		if (io->pfrio_esize != 0) {
2935 			error = ENODEV;
2936 			break;
2937 		}
2938 		PF_RULES_WLOCK();
2939 		error = pfr_clr_tables(&io->pfrio_table, &io->pfrio_ndel,
2940 		    io->pfrio_flags | PFR_FLAG_USERIOCTL);
2941 		PF_RULES_WUNLOCK();
2942 		break;
2943 	}
2944 
2945 	case DIOCRADDTABLES: {
2946 		struct pfioc_table *io = (struct pfioc_table *)addr;
2947 		struct pfr_table *pfrts;
2948 		size_t totlen;
2949 
2950 		if (io->pfrio_esize != sizeof(struct pfr_table)) {
2951 			error = ENODEV;
2952 			break;
2953 		}
2954 
2955 		if (io->pfrio_size < 0 || io->pfrio_size > pf_ioctl_maxcount ||
2956 		    WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_table))) {
2957 			error = ENOMEM;
2958 			break;
2959 		}
2960 
2961 		totlen = io->pfrio_size * sizeof(struct pfr_table);
2962 		pfrts = mallocarray(io->pfrio_size, sizeof(struct pfr_table),
2963 		    M_TEMP, M_WAITOK);
2964 		error = copyin(io->pfrio_buffer, pfrts, totlen);
2965 		if (error) {
2966 			free(pfrts, M_TEMP);
2967 			break;
2968 		}
2969 		PF_RULES_WLOCK();
2970 		error = pfr_add_tables(pfrts, io->pfrio_size,
2971 		    &io->pfrio_nadd, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2972 		PF_RULES_WUNLOCK();
2973 		free(pfrts, M_TEMP);
2974 		break;
2975 	}
2976 
2977 	case DIOCRDELTABLES: {
2978 		struct pfioc_table *io = (struct pfioc_table *)addr;
2979 		struct pfr_table *pfrts;
2980 		size_t totlen;
2981 
2982 		if (io->pfrio_esize != sizeof(struct pfr_table)) {
2983 			error = ENODEV;
2984 			break;
2985 		}
2986 
2987 		if (io->pfrio_size < 0 || io->pfrio_size > pf_ioctl_maxcount ||
2988 		    WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_table))) {
2989 			error = ENOMEM;
2990 			break;
2991 		}
2992 
2993 		totlen = io->pfrio_size * sizeof(struct pfr_table);
2994 		pfrts = mallocarray(io->pfrio_size, sizeof(struct pfr_table),
2995 		    M_TEMP, M_WAITOK);
2996 		error = copyin(io->pfrio_buffer, pfrts, totlen);
2997 		if (error) {
2998 			free(pfrts, M_TEMP);
2999 			break;
3000 		}
3001 		PF_RULES_WLOCK();
3002 		error = pfr_del_tables(pfrts, io->pfrio_size,
3003 		    &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL);
3004 		PF_RULES_WUNLOCK();
3005 		free(pfrts, M_TEMP);
3006 		break;
3007 	}
3008 
3009 	case DIOCRGETTABLES: {
3010 		struct pfioc_table *io = (struct pfioc_table *)addr;
3011 		struct pfr_table *pfrts;
3012 		size_t totlen;
3013 		int n;
3014 
3015 		if (io->pfrio_esize != sizeof(struct pfr_table)) {
3016 			error = ENODEV;
3017 			break;
3018 		}
3019 		PF_RULES_RLOCK();
3020 		n = pfr_table_count(&io->pfrio_table, io->pfrio_flags);
3021 		if (n < 0) {
3022 			PF_RULES_RUNLOCK();
3023 			error = EINVAL;
3024 			break;
3025 		}
3026 		io->pfrio_size = min(io->pfrio_size, n);
3027 
3028 		totlen = io->pfrio_size * sizeof(struct pfr_table);
3029 
3030 		pfrts = mallocarray(io->pfrio_size, sizeof(struct pfr_table),
3031 		    M_TEMP, M_NOWAIT);
3032 		if (pfrts == NULL) {
3033 			error = ENOMEM;
3034 			PF_RULES_RUNLOCK();
3035 			break;
3036 		}
3037 		error = pfr_get_tables(&io->pfrio_table, pfrts,
3038 		    &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
3039 		PF_RULES_RUNLOCK();
3040 		if (error == 0)
3041 			error = copyout(pfrts, io->pfrio_buffer, totlen);
3042 		free(pfrts, M_TEMP);
3043 		break;
3044 	}
3045 
3046 	case DIOCRGETTSTATS: {
3047 		struct pfioc_table *io = (struct pfioc_table *)addr;
3048 		struct pfr_tstats *pfrtstats;
3049 		size_t totlen;
3050 		int n;
3051 
3052 		if (io->pfrio_esize != sizeof(struct pfr_tstats)) {
3053 			error = ENODEV;
3054 			break;
3055 		}
3056 		PF_RULES_WLOCK();
3057 		n = pfr_table_count(&io->pfrio_table, io->pfrio_flags);
3058 		if (n < 0) {
3059 			PF_RULES_WUNLOCK();
3060 			error = EINVAL;
3061 			break;
3062 		}
3063 		io->pfrio_size = min(io->pfrio_size, n);
3064 
3065 		totlen = io->pfrio_size * sizeof(struct pfr_tstats);
3066 		pfrtstats = mallocarray(io->pfrio_size,
3067 		    sizeof(struct pfr_tstats), M_TEMP, M_NOWAIT);
3068 		if (pfrtstats == NULL) {
3069 			error = ENOMEM;
3070 			PF_RULES_WUNLOCK();
3071 			break;
3072 		}
3073 		error = pfr_get_tstats(&io->pfrio_table, pfrtstats,
3074 		    &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
3075 		PF_RULES_WUNLOCK();
3076 		if (error == 0)
3077 			error = copyout(pfrtstats, io->pfrio_buffer, totlen);
3078 		free(pfrtstats, M_TEMP);
3079 		break;
3080 	}
3081 
3082 	case DIOCRCLRTSTATS: {
3083 		struct pfioc_table *io = (struct pfioc_table *)addr;
3084 		struct pfr_table *pfrts;
3085 		size_t totlen;
3086 		int n;
3087 
3088 		if (io->pfrio_esize != sizeof(struct pfr_table)) {
3089 			error = ENODEV;
3090 			break;
3091 		}
3092 
3093 		PF_RULES_WLOCK();
3094 		n = pfr_table_count(&io->pfrio_table, io->pfrio_flags);
3095 		if (n < 0) {
3096 			PF_RULES_WUNLOCK();
3097 			error = EINVAL;
3098 			break;
3099 		}
3100 		io->pfrio_size = min(io->pfrio_size, n);
3101 
3102 		totlen = io->pfrio_size * sizeof(struct pfr_table);
3103 		pfrts = mallocarray(io->pfrio_size, sizeof(struct pfr_table),
3104 		    M_TEMP, M_NOWAIT);
3105 		if (pfrts == NULL) {
3106 			error = ENOMEM;
3107 			PF_RULES_WUNLOCK();
3108 			break;
3109 		}
3110 		error = copyin(io->pfrio_buffer, pfrts, totlen);
3111 		if (error) {
3112 			free(pfrts, M_TEMP);
3113 			PF_RULES_WUNLOCK();
3114 			break;
3115 		}
3116 		error = pfr_clr_tstats(pfrts, io->pfrio_size,
3117 		    &io->pfrio_nzero, io->pfrio_flags | PFR_FLAG_USERIOCTL);
3118 		PF_RULES_WUNLOCK();
3119 		free(pfrts, M_TEMP);
3120 		break;
3121 	}
3122 
3123 	case DIOCRSETTFLAGS: {
3124 		struct pfioc_table *io = (struct pfioc_table *)addr;
3125 		struct pfr_table *pfrts;
3126 		size_t totlen;
3127 		int n;
3128 
3129 		if (io->pfrio_esize != sizeof(struct pfr_table)) {
3130 			error = ENODEV;
3131 			break;
3132 		}
3133 
3134 		PF_RULES_RLOCK();
3135 		n = pfr_table_count(&io->pfrio_table, io->pfrio_flags);
3136 		if (n < 0) {
3137 			PF_RULES_RUNLOCK();
3138 			error = EINVAL;
3139 			break;
3140 		}
3141 
3142 		io->pfrio_size = min(io->pfrio_size, n);
3143 		PF_RULES_RUNLOCK();
3144 
3145 		totlen = io->pfrio_size * sizeof(struct pfr_table);
3146 		pfrts = mallocarray(io->pfrio_size, sizeof(struct pfr_table),
3147 		    M_TEMP, M_WAITOK);
3148 		error = copyin(io->pfrio_buffer, pfrts, totlen);
3149 		if (error) {
3150 			free(pfrts, M_TEMP);
3151 			break;
3152 		}
3153 		PF_RULES_WLOCK();
3154 		error = pfr_set_tflags(pfrts, io->pfrio_size,
3155 		    io->pfrio_setflag, io->pfrio_clrflag, &io->pfrio_nchange,
3156 		    &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL);
3157 		PF_RULES_WUNLOCK();
3158 		free(pfrts, M_TEMP);
3159 		break;
3160 	}
3161 
3162 	case DIOCRCLRADDRS: {
3163 		struct pfioc_table *io = (struct pfioc_table *)addr;
3164 
3165 		if (io->pfrio_esize != 0) {
3166 			error = ENODEV;
3167 			break;
3168 		}
3169 		PF_RULES_WLOCK();
3170 		error = pfr_clr_addrs(&io->pfrio_table, &io->pfrio_ndel,
3171 		    io->pfrio_flags | PFR_FLAG_USERIOCTL);
3172 		PF_RULES_WUNLOCK();
3173 		break;
3174 	}
3175 
3176 	case DIOCRADDADDRS: {
3177 		struct pfioc_table *io = (struct pfioc_table *)addr;
3178 		struct pfr_addr *pfras;
3179 		size_t totlen;
3180 
3181 		if (io->pfrio_esize != sizeof(struct pfr_addr)) {
3182 			error = ENODEV;
3183 			break;
3184 		}
3185 		if (io->pfrio_size < 0 ||
3186 		    io->pfrio_size > pf_ioctl_maxcount ||
3187 		    WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) {
3188 			error = EINVAL;
3189 			break;
3190 		}
3191 		totlen = io->pfrio_size * sizeof(struct pfr_addr);
3192 		pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr),
3193 		    M_TEMP, M_NOWAIT);
3194 		if (! pfras) {
3195 			error = ENOMEM;
3196 			break;
3197 		}
3198 		error = copyin(io->pfrio_buffer, pfras, totlen);
3199 		if (error) {
3200 			free(pfras, M_TEMP);
3201 			break;
3202 		}
3203 		PF_RULES_WLOCK();
3204 		error = pfr_add_addrs(&io->pfrio_table, pfras,
3205 		    io->pfrio_size, &io->pfrio_nadd, io->pfrio_flags |
3206 		    PFR_FLAG_USERIOCTL);
3207 		PF_RULES_WUNLOCK();
3208 		if (error == 0 && io->pfrio_flags & PFR_FLAG_FEEDBACK)
3209 			error = copyout(pfras, io->pfrio_buffer, totlen);
3210 		free(pfras, M_TEMP);
3211 		break;
3212 	}
3213 
3214 	case DIOCRDELADDRS: {
3215 		struct pfioc_table *io = (struct pfioc_table *)addr;
3216 		struct pfr_addr *pfras;
3217 		size_t totlen;
3218 
3219 		if (io->pfrio_esize != sizeof(struct pfr_addr)) {
3220 			error = ENODEV;
3221 			break;
3222 		}
3223 		if (io->pfrio_size < 0 ||
3224 		    io->pfrio_size > pf_ioctl_maxcount ||
3225 		    WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) {
3226 			error = EINVAL;
3227 			break;
3228 		}
3229 		totlen = io->pfrio_size * sizeof(struct pfr_addr);
3230 		pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr),
3231 		    M_TEMP, M_NOWAIT);
3232 		if (! pfras) {
3233 			error = ENOMEM;
3234 			break;
3235 		}
3236 		error = copyin(io->pfrio_buffer, pfras, totlen);
3237 		if (error) {
3238 			free(pfras, M_TEMP);
3239 			break;
3240 		}
3241 		PF_RULES_WLOCK();
3242 		error = pfr_del_addrs(&io->pfrio_table, pfras,
3243 		    io->pfrio_size, &io->pfrio_ndel, io->pfrio_flags |
3244 		    PFR_FLAG_USERIOCTL);
3245 		PF_RULES_WUNLOCK();
3246 		if (error == 0 && io->pfrio_flags & PFR_FLAG_FEEDBACK)
3247 			error = copyout(pfras, io->pfrio_buffer, totlen);
3248 		free(pfras, M_TEMP);
3249 		break;
3250 	}
3251 
3252 	case DIOCRSETADDRS: {
3253 		struct pfioc_table *io = (struct pfioc_table *)addr;
3254 		struct pfr_addr *pfras;
3255 		size_t totlen, count;
3256 
3257 		if (io->pfrio_esize != sizeof(struct pfr_addr)) {
3258 			error = ENODEV;
3259 			break;
3260 		}
3261 		if (io->pfrio_size < 0 || io->pfrio_size2 < 0) {
3262 			error = EINVAL;
3263 			break;
3264 		}
3265 		count = max(io->pfrio_size, io->pfrio_size2);
3266 		if (count > pf_ioctl_maxcount ||
3267 		    WOULD_OVERFLOW(count, sizeof(struct pfr_addr))) {
3268 			error = EINVAL;
3269 			break;
3270 		}
3271 		totlen = count * sizeof(struct pfr_addr);
3272 		pfras = mallocarray(count, sizeof(struct pfr_addr), M_TEMP,
3273 		    M_NOWAIT);
3274 		if (! pfras) {
3275 			error = ENOMEM;
3276 			break;
3277 		}
3278 		error = copyin(io->pfrio_buffer, pfras, totlen);
3279 		if (error) {
3280 			free(pfras, M_TEMP);
3281 			break;
3282 		}
3283 		PF_RULES_WLOCK();
3284 		error = pfr_set_addrs(&io->pfrio_table, pfras,
3285 		    io->pfrio_size, &io->pfrio_size2, &io->pfrio_nadd,
3286 		    &io->pfrio_ndel, &io->pfrio_nchange, io->pfrio_flags |
3287 		    PFR_FLAG_USERIOCTL, 0);
3288 		PF_RULES_WUNLOCK();
3289 		if (error == 0 && io->pfrio_flags & PFR_FLAG_FEEDBACK)
3290 			error = copyout(pfras, io->pfrio_buffer, totlen);
3291 		free(pfras, M_TEMP);
3292 		break;
3293 	}
3294 
3295 	case DIOCRGETADDRS: {
3296 		struct pfioc_table *io = (struct pfioc_table *)addr;
3297 		struct pfr_addr *pfras;
3298 		size_t totlen;
3299 
3300 		if (io->pfrio_esize != sizeof(struct pfr_addr)) {
3301 			error = ENODEV;
3302 			break;
3303 		}
3304 		if (io->pfrio_size < 0 ||
3305 		    io->pfrio_size > pf_ioctl_maxcount ||
3306 		    WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) {
3307 			error = EINVAL;
3308 			break;
3309 		}
3310 		totlen = io->pfrio_size * sizeof(struct pfr_addr);
3311 		pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr),
3312 		    M_TEMP, M_NOWAIT);
3313 		if (! pfras) {
3314 			error = ENOMEM;
3315 			break;
3316 		}
3317 		PF_RULES_RLOCK();
3318 		error = pfr_get_addrs(&io->pfrio_table, pfras,
3319 		    &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
3320 		PF_RULES_RUNLOCK();
3321 		if (error == 0)
3322 			error = copyout(pfras, io->pfrio_buffer, totlen);
3323 		free(pfras, M_TEMP);
3324 		break;
3325 	}
3326 
3327 	case DIOCRGETASTATS: {
3328 		struct pfioc_table *io = (struct pfioc_table *)addr;
3329 		struct pfr_astats *pfrastats;
3330 		size_t totlen;
3331 
3332 		if (io->pfrio_esize != sizeof(struct pfr_astats)) {
3333 			error = ENODEV;
3334 			break;
3335 		}
3336 		if (io->pfrio_size < 0 ||
3337 		    io->pfrio_size > pf_ioctl_maxcount ||
3338 		    WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_astats))) {
3339 			error = EINVAL;
3340 			break;
3341 		}
3342 		totlen = io->pfrio_size * sizeof(struct pfr_astats);
3343 		pfrastats = mallocarray(io->pfrio_size,
3344 		    sizeof(struct pfr_astats), M_TEMP, M_NOWAIT);
3345 		if (! pfrastats) {
3346 			error = ENOMEM;
3347 			break;
3348 		}
3349 		PF_RULES_RLOCK();
3350 		error = pfr_get_astats(&io->pfrio_table, pfrastats,
3351 		    &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
3352 		PF_RULES_RUNLOCK();
3353 		if (error == 0)
3354 			error = copyout(pfrastats, io->pfrio_buffer, totlen);
3355 		free(pfrastats, M_TEMP);
3356 		break;
3357 	}
3358 
3359 	case DIOCRCLRASTATS: {
3360 		struct pfioc_table *io = (struct pfioc_table *)addr;
3361 		struct pfr_addr *pfras;
3362 		size_t totlen;
3363 
3364 		if (io->pfrio_esize != sizeof(struct pfr_addr)) {
3365 			error = ENODEV;
3366 			break;
3367 		}
3368 		if (io->pfrio_size < 0 ||
3369 		    io->pfrio_size > pf_ioctl_maxcount ||
3370 		    WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) {
3371 			error = EINVAL;
3372 			break;
3373 		}
3374 		totlen = io->pfrio_size * sizeof(struct pfr_addr);
3375 		pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr),
3376 		    M_TEMP, M_NOWAIT);
3377 		if (! pfras) {
3378 			error = ENOMEM;
3379 			break;
3380 		}
3381 		error = copyin(io->pfrio_buffer, pfras, totlen);
3382 		if (error) {
3383 			free(pfras, M_TEMP);
3384 			break;
3385 		}
3386 		PF_RULES_WLOCK();
3387 		error = pfr_clr_astats(&io->pfrio_table, pfras,
3388 		    io->pfrio_size, &io->pfrio_nzero, io->pfrio_flags |
3389 		    PFR_FLAG_USERIOCTL);
3390 		PF_RULES_WUNLOCK();
3391 		if (error == 0 && io->pfrio_flags & PFR_FLAG_FEEDBACK)
3392 			error = copyout(pfras, io->pfrio_buffer, totlen);
3393 		free(pfras, M_TEMP);
3394 		break;
3395 	}
3396 
3397 	case DIOCRTSTADDRS: {
3398 		struct pfioc_table *io = (struct pfioc_table *)addr;
3399 		struct pfr_addr *pfras;
3400 		size_t totlen;
3401 
3402 		if (io->pfrio_esize != sizeof(struct pfr_addr)) {
3403 			error = ENODEV;
3404 			break;
3405 		}
3406 		if (io->pfrio_size < 0 ||
3407 		    io->pfrio_size > pf_ioctl_maxcount ||
3408 		    WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) {
3409 			error = EINVAL;
3410 			break;
3411 		}
3412 		totlen = io->pfrio_size * sizeof(struct pfr_addr);
3413 		pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr),
3414 		    M_TEMP, M_NOWAIT);
3415 		if (! pfras) {
3416 			error = ENOMEM;
3417 			break;
3418 		}
3419 		error = copyin(io->pfrio_buffer, pfras, totlen);
3420 		if (error) {
3421 			free(pfras, M_TEMP);
3422 			break;
3423 		}
3424 		PF_RULES_RLOCK();
3425 		error = pfr_tst_addrs(&io->pfrio_table, pfras,
3426 		    io->pfrio_size, &io->pfrio_nmatch, io->pfrio_flags |
3427 		    PFR_FLAG_USERIOCTL);
3428 		PF_RULES_RUNLOCK();
3429 		if (error == 0)
3430 			error = copyout(pfras, io->pfrio_buffer, totlen);
3431 		free(pfras, M_TEMP);
3432 		break;
3433 	}
3434 
3435 	case DIOCRINADEFINE: {
3436 		struct pfioc_table *io = (struct pfioc_table *)addr;
3437 		struct pfr_addr *pfras;
3438 		size_t totlen;
3439 
3440 		if (io->pfrio_esize != sizeof(struct pfr_addr)) {
3441 			error = ENODEV;
3442 			break;
3443 		}
3444 		if (io->pfrio_size < 0 ||
3445 		    io->pfrio_size > pf_ioctl_maxcount ||
3446 		    WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) {
3447 			error = EINVAL;
3448 			break;
3449 		}
3450 		totlen = io->pfrio_size * sizeof(struct pfr_addr);
3451 		pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr),
3452 		    M_TEMP, M_NOWAIT);
3453 		if (! pfras) {
3454 			error = ENOMEM;
3455 			break;
3456 		}
3457 		error = copyin(io->pfrio_buffer, pfras, totlen);
3458 		if (error) {
3459 			free(pfras, M_TEMP);
3460 			break;
3461 		}
3462 		PF_RULES_WLOCK();
3463 		error = pfr_ina_define(&io->pfrio_table, pfras,
3464 		    io->pfrio_size, &io->pfrio_nadd, &io->pfrio_naddr,
3465 		    io->pfrio_ticket, io->pfrio_flags | PFR_FLAG_USERIOCTL);
3466 		PF_RULES_WUNLOCK();
3467 		free(pfras, M_TEMP);
3468 		break;
3469 	}
3470 
3471 	case DIOCOSFPADD: {
3472 		struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr;
3473 		PF_RULES_WLOCK();
3474 		error = pf_osfp_add(io);
3475 		PF_RULES_WUNLOCK();
3476 		break;
3477 	}
3478 
3479 	case DIOCOSFPGET: {
3480 		struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr;
3481 		PF_RULES_RLOCK();
3482 		error = pf_osfp_get(io);
3483 		PF_RULES_RUNLOCK();
3484 		break;
3485 	}
3486 
3487 	case DIOCXBEGIN: {
3488 		struct pfioc_trans	*io = (struct pfioc_trans *)addr;
3489 		struct pfioc_trans_e	*ioes, *ioe;
3490 		size_t			 totlen;
3491 		int			 i;
3492 
3493 		if (io->esize != sizeof(*ioe)) {
3494 			error = ENODEV;
3495 			break;
3496 		}
3497 		if (io->size < 0 ||
3498 		    io->size > pf_ioctl_maxcount ||
3499 		    WOULD_OVERFLOW(io->size, sizeof(struct pfioc_trans_e))) {
3500 			error = EINVAL;
3501 			break;
3502 		}
3503 		totlen = sizeof(struct pfioc_trans_e) * io->size;
3504 		ioes = mallocarray(io->size, sizeof(struct pfioc_trans_e),
3505 		    M_TEMP, M_NOWAIT);
3506 		if (! ioes) {
3507 			error = ENOMEM;
3508 			break;
3509 		}
3510 		error = copyin(io->array, ioes, totlen);
3511 		if (error) {
3512 			free(ioes, M_TEMP);
3513 			break;
3514 		}
3515 		PF_RULES_WLOCK();
3516 		for (i = 0, ioe = ioes; i < io->size; i++, ioe++) {
3517 			switch (ioe->rs_num) {
3518 #ifdef ALTQ
3519 			case PF_RULESET_ALTQ:
3520 				if (ioe->anchor[0]) {
3521 					PF_RULES_WUNLOCK();
3522 					free(ioes, M_TEMP);
3523 					error = EINVAL;
3524 					goto fail;
3525 				}
3526 				if ((error = pf_begin_altq(&ioe->ticket))) {
3527 					PF_RULES_WUNLOCK();
3528 					free(ioes, M_TEMP);
3529 					goto fail;
3530 				}
3531 				break;
3532 #endif /* ALTQ */
3533 			case PF_RULESET_TABLE:
3534 			    {
3535 				struct pfr_table table;
3536 
3537 				bzero(&table, sizeof(table));
3538 				strlcpy(table.pfrt_anchor, ioe->anchor,
3539 				    sizeof(table.pfrt_anchor));
3540 				if ((error = pfr_ina_begin(&table,
3541 				    &ioe->ticket, NULL, 0))) {
3542 					PF_RULES_WUNLOCK();
3543 					free(ioes, M_TEMP);
3544 					goto fail;
3545 				}
3546 				break;
3547 			    }
3548 			default:
3549 				if ((error = pf_begin_rules(&ioe->ticket,
3550 				    ioe->rs_num, ioe->anchor))) {
3551 					PF_RULES_WUNLOCK();
3552 					free(ioes, M_TEMP);
3553 					goto fail;
3554 				}
3555 				break;
3556 			}
3557 		}
3558 		PF_RULES_WUNLOCK();
3559 		error = copyout(ioes, io->array, totlen);
3560 		free(ioes, M_TEMP);
3561 		break;
3562 	}
3563 
3564 	case DIOCXROLLBACK: {
3565 		struct pfioc_trans	*io = (struct pfioc_trans *)addr;
3566 		struct pfioc_trans_e	*ioe, *ioes;
3567 		size_t			 totlen;
3568 		int			 i;
3569 
3570 		if (io->esize != sizeof(*ioe)) {
3571 			error = ENODEV;
3572 			break;
3573 		}
3574 		if (io->size < 0 ||
3575 		    io->size > pf_ioctl_maxcount ||
3576 		    WOULD_OVERFLOW(io->size, sizeof(struct pfioc_trans_e))) {
3577 			error = EINVAL;
3578 			break;
3579 		}
3580 		totlen = sizeof(struct pfioc_trans_e) * io->size;
3581 		ioes = mallocarray(io->size, sizeof(struct pfioc_trans_e),
3582 		    M_TEMP, M_NOWAIT);
3583 		if (! ioes) {
3584 			error = ENOMEM;
3585 			break;
3586 		}
3587 		error = copyin(io->array, ioes, totlen);
3588 		if (error) {
3589 			free(ioes, M_TEMP);
3590 			break;
3591 		}
3592 		PF_RULES_WLOCK();
3593 		for (i = 0, ioe = ioes; i < io->size; i++, ioe++) {
3594 			switch (ioe->rs_num) {
3595 #ifdef ALTQ
3596 			case PF_RULESET_ALTQ:
3597 				if (ioe->anchor[0]) {
3598 					PF_RULES_WUNLOCK();
3599 					free(ioes, M_TEMP);
3600 					error = EINVAL;
3601 					goto fail;
3602 				}
3603 				if ((error = pf_rollback_altq(ioe->ticket))) {
3604 					PF_RULES_WUNLOCK();
3605 					free(ioes, M_TEMP);
3606 					goto fail; /* really bad */
3607 				}
3608 				break;
3609 #endif /* ALTQ */
3610 			case PF_RULESET_TABLE:
3611 			    {
3612 				struct pfr_table table;
3613 
3614 				bzero(&table, sizeof(table));
3615 				strlcpy(table.pfrt_anchor, ioe->anchor,
3616 				    sizeof(table.pfrt_anchor));
3617 				if ((error = pfr_ina_rollback(&table,
3618 				    ioe->ticket, NULL, 0))) {
3619 					PF_RULES_WUNLOCK();
3620 					free(ioes, M_TEMP);
3621 					goto fail; /* really bad */
3622 				}
3623 				break;
3624 			    }
3625 			default:
3626 				if ((error = pf_rollback_rules(ioe->ticket,
3627 				    ioe->rs_num, ioe->anchor))) {
3628 					PF_RULES_WUNLOCK();
3629 					free(ioes, M_TEMP);
3630 					goto fail; /* really bad */
3631 				}
3632 				break;
3633 			}
3634 		}
3635 		PF_RULES_WUNLOCK();
3636 		free(ioes, M_TEMP);
3637 		break;
3638 	}
3639 
3640 	case DIOCXCOMMIT: {
3641 		struct pfioc_trans	*io = (struct pfioc_trans *)addr;
3642 		struct pfioc_trans_e	*ioe, *ioes;
3643 		struct pf_ruleset	*rs;
3644 		size_t			 totlen;
3645 		int			 i;
3646 
3647 		if (io->esize != sizeof(*ioe)) {
3648 			error = ENODEV;
3649 			break;
3650 		}
3651 
3652 		if (io->size < 0 ||
3653 		    io->size > pf_ioctl_maxcount ||
3654 		    WOULD_OVERFLOW(io->size, sizeof(struct pfioc_trans_e))) {
3655 			error = EINVAL;
3656 			break;
3657 		}
3658 
3659 		totlen = sizeof(struct pfioc_trans_e) * io->size;
3660 		ioes = mallocarray(io->size, sizeof(struct pfioc_trans_e),
3661 		    M_TEMP, M_NOWAIT);
3662 		if (ioes == NULL) {
3663 			error = ENOMEM;
3664 			break;
3665 		}
3666 		error = copyin(io->array, ioes, totlen);
3667 		if (error) {
3668 			free(ioes, M_TEMP);
3669 			break;
3670 		}
3671 		PF_RULES_WLOCK();
3672 		/* First makes sure everything will succeed. */
3673 		for (i = 0, ioe = ioes; i < io->size; i++, ioe++) {
3674 			switch (ioe->rs_num) {
3675 #ifdef ALTQ
3676 			case PF_RULESET_ALTQ:
3677 				if (ioe->anchor[0]) {
3678 					PF_RULES_WUNLOCK();
3679 					free(ioes, M_TEMP);
3680 					error = EINVAL;
3681 					goto fail;
3682 				}
3683 				if (!V_altqs_inactive_open || ioe->ticket !=
3684 				    V_ticket_altqs_inactive) {
3685 					PF_RULES_WUNLOCK();
3686 					free(ioes, M_TEMP);
3687 					error = EBUSY;
3688 					goto fail;
3689 				}
3690 				break;
3691 #endif /* ALTQ */
3692 			case PF_RULESET_TABLE:
3693 				rs = pf_find_ruleset(ioe->anchor);
3694 				if (rs == NULL || !rs->topen || ioe->ticket !=
3695 				    rs->tticket) {
3696 					PF_RULES_WUNLOCK();
3697 					free(ioes, M_TEMP);
3698 					error = EBUSY;
3699 					goto fail;
3700 				}
3701 				break;
3702 			default:
3703 				if (ioe->rs_num < 0 || ioe->rs_num >=
3704 				    PF_RULESET_MAX) {
3705 					PF_RULES_WUNLOCK();
3706 					free(ioes, M_TEMP);
3707 					error = EINVAL;
3708 					goto fail;
3709 				}
3710 				rs = pf_find_ruleset(ioe->anchor);
3711 				if (rs == NULL ||
3712 				    !rs->rules[ioe->rs_num].inactive.open ||
3713 				    rs->rules[ioe->rs_num].inactive.ticket !=
3714 				    ioe->ticket) {
3715 					PF_RULES_WUNLOCK();
3716 					free(ioes, M_TEMP);
3717 					error = EBUSY;
3718 					goto fail;
3719 				}
3720 				break;
3721 			}
3722 		}
3723 		/* Now do the commit - no errors should happen here. */
3724 		for (i = 0, ioe = ioes; i < io->size; i++, ioe++) {
3725 			switch (ioe->rs_num) {
3726 #ifdef ALTQ
3727 			case PF_RULESET_ALTQ:
3728 				if ((error = pf_commit_altq(ioe->ticket))) {
3729 					PF_RULES_WUNLOCK();
3730 					free(ioes, M_TEMP);
3731 					goto fail; /* really bad */
3732 				}
3733 				break;
3734 #endif /* ALTQ */
3735 			case PF_RULESET_TABLE:
3736 			    {
3737 				struct pfr_table table;
3738 
3739 				bzero(&table, sizeof(table));
3740 				strlcpy(table.pfrt_anchor, ioe->anchor,
3741 				    sizeof(table.pfrt_anchor));
3742 				if ((error = pfr_ina_commit(&table,
3743 				    ioe->ticket, NULL, NULL, 0))) {
3744 					PF_RULES_WUNLOCK();
3745 					free(ioes, M_TEMP);
3746 					goto fail; /* really bad */
3747 				}
3748 				break;
3749 			    }
3750 			default:
3751 				if ((error = pf_commit_rules(ioe->ticket,
3752 				    ioe->rs_num, ioe->anchor))) {
3753 					PF_RULES_WUNLOCK();
3754 					free(ioes, M_TEMP);
3755 					goto fail; /* really bad */
3756 				}
3757 				break;
3758 			}
3759 		}
3760 		PF_RULES_WUNLOCK();
3761 		free(ioes, M_TEMP);
3762 		break;
3763 	}
3764 
3765 	case DIOCGETSRCNODES: {
3766 		struct pfioc_src_nodes	*psn = (struct pfioc_src_nodes *)addr;
3767 		struct pf_srchash	*sh;
3768 		struct pf_src_node	*n, *p, *pstore;
3769 		uint32_t		 i, nr = 0;
3770 
3771 		for (i = 0, sh = V_pf_srchash; i <= pf_srchashmask;
3772 				i++, sh++) {
3773 			PF_HASHROW_LOCK(sh);
3774 			LIST_FOREACH(n, &sh->nodes, entry)
3775 				nr++;
3776 			PF_HASHROW_UNLOCK(sh);
3777 		}
3778 
3779 		psn->psn_len = min(psn->psn_len,
3780 		    sizeof(struct pf_src_node) * nr);
3781 
3782 		if (psn->psn_len == 0) {
3783 			psn->psn_len = sizeof(struct pf_src_node) * nr;
3784 			break;
3785 		}
3786 
3787 		nr = 0;
3788 
3789 		p = pstore = malloc(psn->psn_len, M_TEMP, M_WAITOK | M_ZERO);
3790 		for (i = 0, sh = V_pf_srchash; i <= pf_srchashmask;
3791 		    i++, sh++) {
3792 		    PF_HASHROW_LOCK(sh);
3793 		    LIST_FOREACH(n, &sh->nodes, entry) {
3794 			int	secs = time_uptime, diff;
3795 
3796 			if ((nr + 1) * sizeof(*p) > (unsigned)psn->psn_len)
3797 				break;
3798 
3799 			bcopy(n, p, sizeof(struct pf_src_node));
3800 			if (n->rule.ptr != NULL)
3801 				p->rule.nr = n->rule.ptr->nr;
3802 			p->creation = secs - p->creation;
3803 			if (p->expire > secs)
3804 				p->expire -= secs;
3805 			else
3806 				p->expire = 0;
3807 
3808 			/* Adjust the connection rate estimate. */
3809 			diff = secs - n->conn_rate.last;
3810 			if (diff >= n->conn_rate.seconds)
3811 				p->conn_rate.count = 0;
3812 			else
3813 				p->conn_rate.count -=
3814 				    n->conn_rate.count * diff /
3815 				    n->conn_rate.seconds;
3816 			p++;
3817 			nr++;
3818 		    }
3819 		    PF_HASHROW_UNLOCK(sh);
3820 		}
3821 		error = copyout(pstore, psn->psn_src_nodes,
3822 		    sizeof(struct pf_src_node) * nr);
3823 		if (error) {
3824 			free(pstore, M_TEMP);
3825 			break;
3826 		}
3827 		psn->psn_len = sizeof(struct pf_src_node) * nr;
3828 		free(pstore, M_TEMP);
3829 		break;
3830 	}
3831 
3832 	case DIOCCLRSRCNODES: {
3833 		pf_clear_srcnodes(NULL);
3834 		pf_purge_expired_src_nodes();
3835 		break;
3836 	}
3837 
3838 	case DIOCKILLSRCNODES:
3839 		pf_kill_srcnodes((struct pfioc_src_node_kill *)addr);
3840 		break;
3841 
3842 	case DIOCSETHOSTID: {
3843 		u_int32_t	*hostid = (u_int32_t *)addr;
3844 
3845 		PF_RULES_WLOCK();
3846 		if (*hostid == 0)
3847 			V_pf_status.hostid = arc4random();
3848 		else
3849 			V_pf_status.hostid = *hostid;
3850 		PF_RULES_WUNLOCK();
3851 		break;
3852 	}
3853 
3854 	case DIOCOSFPFLUSH:
3855 		PF_RULES_WLOCK();
3856 		pf_osfp_flush();
3857 		PF_RULES_WUNLOCK();
3858 		break;
3859 
3860 	case DIOCIGETIFACES: {
3861 		struct pfioc_iface *io = (struct pfioc_iface *)addr;
3862 		struct pfi_kif *ifstore;
3863 		size_t bufsiz;
3864 
3865 		if (io->pfiio_esize != sizeof(struct pfi_kif)) {
3866 			error = ENODEV;
3867 			break;
3868 		}
3869 
3870 		if (io->pfiio_size < 0 ||
3871 		    io->pfiio_size > pf_ioctl_maxcount ||
3872 		    WOULD_OVERFLOW(io->pfiio_size, sizeof(struct pfi_kif))) {
3873 			error = EINVAL;
3874 			break;
3875 		}
3876 
3877 		bufsiz = io->pfiio_size * sizeof(struct pfi_kif);
3878 		ifstore = mallocarray(io->pfiio_size, sizeof(struct pfi_kif),
3879 		    M_TEMP, M_NOWAIT);
3880 		if (ifstore == NULL) {
3881 			error = ENOMEM;
3882 			break;
3883 		}
3884 
3885 		PF_RULES_RLOCK();
3886 		pfi_get_ifaces(io->pfiio_name, ifstore, &io->pfiio_size);
3887 		PF_RULES_RUNLOCK();
3888 		error = copyout(ifstore, io->pfiio_buffer, bufsiz);
3889 		free(ifstore, M_TEMP);
3890 		break;
3891 	}
3892 
3893 	case DIOCSETIFFLAG: {
3894 		struct pfioc_iface *io = (struct pfioc_iface *)addr;
3895 
3896 		PF_RULES_WLOCK();
3897 		error = pfi_set_flags(io->pfiio_name, io->pfiio_flags);
3898 		PF_RULES_WUNLOCK();
3899 		break;
3900 	}
3901 
3902 	case DIOCCLRIFFLAG: {
3903 		struct pfioc_iface *io = (struct pfioc_iface *)addr;
3904 
3905 		PF_RULES_WLOCK();
3906 		error = pfi_clear_flags(io->pfiio_name, io->pfiio_flags);
3907 		PF_RULES_WUNLOCK();
3908 		break;
3909 	}
3910 
3911 	default:
3912 		error = ENODEV;
3913 		break;
3914 	}
3915 fail:
3916 	if (sx_xlocked(&pf_ioctl_lock))
3917 		sx_xunlock(&pf_ioctl_lock);
3918 	CURVNET_RESTORE();
3919 
3920 	return (error);
3921 }
3922 
3923 void
3924 pfsync_state_export(struct pfsync_state *sp, struct pf_state *st)
3925 {
3926 	bzero(sp, sizeof(struct pfsync_state));
3927 
3928 	/* copy from state key */
3929 	sp->key[PF_SK_WIRE].addr[0] = st->key[PF_SK_WIRE]->addr[0];
3930 	sp->key[PF_SK_WIRE].addr[1] = st->key[PF_SK_WIRE]->addr[1];
3931 	sp->key[PF_SK_WIRE].port[0] = st->key[PF_SK_WIRE]->port[0];
3932 	sp->key[PF_SK_WIRE].port[1] = st->key[PF_SK_WIRE]->port[1];
3933 	sp->key[PF_SK_STACK].addr[0] = st->key[PF_SK_STACK]->addr[0];
3934 	sp->key[PF_SK_STACK].addr[1] = st->key[PF_SK_STACK]->addr[1];
3935 	sp->key[PF_SK_STACK].port[0] = st->key[PF_SK_STACK]->port[0];
3936 	sp->key[PF_SK_STACK].port[1] = st->key[PF_SK_STACK]->port[1];
3937 	sp->proto = st->key[PF_SK_WIRE]->proto;
3938 	sp->af = st->key[PF_SK_WIRE]->af;
3939 
3940 	/* copy from state */
3941 	strlcpy(sp->ifname, st->kif->pfik_name, sizeof(sp->ifname));
3942 	bcopy(&st->rt_addr, &sp->rt_addr, sizeof(sp->rt_addr));
3943 	sp->creation = htonl(time_uptime - st->creation);
3944 	sp->expire = pf_state_expires(st);
3945 	if (sp->expire <= time_uptime)
3946 		sp->expire = htonl(0);
3947 	else
3948 		sp->expire = htonl(sp->expire - time_uptime);
3949 
3950 	sp->direction = st->direction;
3951 	sp->log = st->log;
3952 	sp->timeout = st->timeout;
3953 	sp->state_flags = st->state_flags;
3954 	if (st->src_node)
3955 		sp->sync_flags |= PFSYNC_FLAG_SRCNODE;
3956 	if (st->nat_src_node)
3957 		sp->sync_flags |= PFSYNC_FLAG_NATSRCNODE;
3958 
3959 	sp->id = st->id;
3960 	sp->creatorid = st->creatorid;
3961 	pf_state_peer_hton(&st->src, &sp->src);
3962 	pf_state_peer_hton(&st->dst, &sp->dst);
3963 
3964 	if (st->rule.ptr == NULL)
3965 		sp->rule = htonl(-1);
3966 	else
3967 		sp->rule = htonl(st->rule.ptr->nr);
3968 	if (st->anchor.ptr == NULL)
3969 		sp->anchor = htonl(-1);
3970 	else
3971 		sp->anchor = htonl(st->anchor.ptr->nr);
3972 	if (st->nat_rule.ptr == NULL)
3973 		sp->nat_rule = htonl(-1);
3974 	else
3975 		sp->nat_rule = htonl(st->nat_rule.ptr->nr);
3976 
3977 	pf_state_counter_hton(st->packets[0], sp->packets[0]);
3978 	pf_state_counter_hton(st->packets[1], sp->packets[1]);
3979 	pf_state_counter_hton(st->bytes[0], sp->bytes[0]);
3980 	pf_state_counter_hton(st->bytes[1], sp->bytes[1]);
3981 
3982 }
3983 
3984 static void
3985 pf_tbladdr_copyout(struct pf_addr_wrap *aw)
3986 {
3987 	struct pfr_ktable *kt;
3988 
3989 	KASSERT(aw->type == PF_ADDR_TABLE, ("%s: type %u", __func__, aw->type));
3990 
3991 	kt = aw->p.tbl;
3992 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
3993 		kt = kt->pfrkt_root;
3994 	aw->p.tbl = NULL;
3995 	aw->p.tblcnt = (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) ?
3996 		kt->pfrkt_cnt : -1;
3997 }
3998 
3999 /*
4000  * XXX - Check for version missmatch!!!
4001  */
4002 static void
4003 pf_clear_states(void)
4004 {
4005 	struct pf_state	*s;
4006 	u_int i;
4007 
4008 	for (i = 0; i <= pf_hashmask; i++) {
4009 		struct pf_idhash *ih = &V_pf_idhash[i];
4010 relock:
4011 		PF_HASHROW_LOCK(ih);
4012 		LIST_FOREACH(s, &ih->states, entry) {
4013 			s->timeout = PFTM_PURGE;
4014 			/* Don't send out individual delete messages. */
4015 			s->state_flags |= PFSTATE_NOSYNC;
4016 			pf_unlink_state(s, PF_ENTER_LOCKED);
4017 			goto relock;
4018 		}
4019 		PF_HASHROW_UNLOCK(ih);
4020 	}
4021 }
4022 
4023 static int
4024 pf_clear_tables(void)
4025 {
4026 	struct pfioc_table io;
4027 	int error;
4028 
4029 	bzero(&io, sizeof(io));
4030 
4031 	error = pfr_clr_tables(&io.pfrio_table, &io.pfrio_ndel,
4032 	    io.pfrio_flags);
4033 
4034 	return (error);
4035 }
4036 
4037 static void
4038 pf_clear_srcnodes(struct pf_src_node *n)
4039 {
4040 	struct pf_state *s;
4041 	int i;
4042 
4043 	for (i = 0; i <= pf_hashmask; i++) {
4044 		struct pf_idhash *ih = &V_pf_idhash[i];
4045 
4046 		PF_HASHROW_LOCK(ih);
4047 		LIST_FOREACH(s, &ih->states, entry) {
4048 			if (n == NULL || n == s->src_node)
4049 				s->src_node = NULL;
4050 			if (n == NULL || n == s->nat_src_node)
4051 				s->nat_src_node = NULL;
4052 		}
4053 		PF_HASHROW_UNLOCK(ih);
4054 	}
4055 
4056 	if (n == NULL) {
4057 		struct pf_srchash *sh;
4058 
4059 		for (i = 0, sh = V_pf_srchash; i <= pf_srchashmask;
4060 		    i++, sh++) {
4061 			PF_HASHROW_LOCK(sh);
4062 			LIST_FOREACH(n, &sh->nodes, entry) {
4063 				n->expire = 1;
4064 				n->states = 0;
4065 			}
4066 			PF_HASHROW_UNLOCK(sh);
4067 		}
4068 	} else {
4069 		/* XXX: hash slot should already be locked here. */
4070 		n->expire = 1;
4071 		n->states = 0;
4072 	}
4073 }
4074 
4075 static void
4076 pf_kill_srcnodes(struct pfioc_src_node_kill *psnk)
4077 {
4078 	struct pf_src_node_list	 kill;
4079 
4080 	LIST_INIT(&kill);
4081 	for (int i = 0; i <= pf_srchashmask; i++) {
4082 		struct pf_srchash *sh = &V_pf_srchash[i];
4083 		struct pf_src_node *sn, *tmp;
4084 
4085 		PF_HASHROW_LOCK(sh);
4086 		LIST_FOREACH_SAFE(sn, &sh->nodes, entry, tmp)
4087 			if (PF_MATCHA(psnk->psnk_src.neg,
4088 			      &psnk->psnk_src.addr.v.a.addr,
4089 			      &psnk->psnk_src.addr.v.a.mask,
4090 			      &sn->addr, sn->af) &&
4091 			    PF_MATCHA(psnk->psnk_dst.neg,
4092 			      &psnk->psnk_dst.addr.v.a.addr,
4093 			      &psnk->psnk_dst.addr.v.a.mask,
4094 			      &sn->raddr, sn->af)) {
4095 				pf_unlink_src_node(sn);
4096 				LIST_INSERT_HEAD(&kill, sn, entry);
4097 				sn->expire = 1;
4098 			}
4099 		PF_HASHROW_UNLOCK(sh);
4100 	}
4101 
4102 	for (int i = 0; i <= pf_hashmask; i++) {
4103 		struct pf_idhash *ih = &V_pf_idhash[i];
4104 		struct pf_state *s;
4105 
4106 		PF_HASHROW_LOCK(ih);
4107 		LIST_FOREACH(s, &ih->states, entry) {
4108 			if (s->src_node && s->src_node->expire == 1)
4109 				s->src_node = NULL;
4110 			if (s->nat_src_node && s->nat_src_node->expire == 1)
4111 				s->nat_src_node = NULL;
4112 		}
4113 		PF_HASHROW_UNLOCK(ih);
4114 	}
4115 
4116 	psnk->psnk_killed = pf_free_src_nodes(&kill);
4117 }
4118 
4119 /*
4120  * XXX - Check for version missmatch!!!
4121  */
4122 
4123 /*
4124  * Duplicate pfctl -Fa operation to get rid of as much as we can.
4125  */
4126 static int
4127 shutdown_pf(void)
4128 {
4129 	int error = 0;
4130 	u_int32_t t[5];
4131 	char nn = '\0';
4132 
4133 	do {
4134 		if ((error = pf_begin_rules(&t[0], PF_RULESET_SCRUB, &nn))
4135 		    != 0) {
4136 			DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: SCRUB\n"));
4137 			break;
4138 		}
4139 		if ((error = pf_begin_rules(&t[1], PF_RULESET_FILTER, &nn))
4140 		    != 0) {
4141 			DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: FILTER\n"));
4142 			break;		/* XXX: rollback? */
4143 		}
4144 		if ((error = pf_begin_rules(&t[2], PF_RULESET_NAT, &nn))
4145 		    != 0) {
4146 			DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: NAT\n"));
4147 			break;		/* XXX: rollback? */
4148 		}
4149 		if ((error = pf_begin_rules(&t[3], PF_RULESET_BINAT, &nn))
4150 		    != 0) {
4151 			DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: BINAT\n"));
4152 			break;		/* XXX: rollback? */
4153 		}
4154 		if ((error = pf_begin_rules(&t[4], PF_RULESET_RDR, &nn))
4155 		    != 0) {
4156 			DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: RDR\n"));
4157 			break;		/* XXX: rollback? */
4158 		}
4159 
4160 		/* XXX: these should always succeed here */
4161 		pf_commit_rules(t[0], PF_RULESET_SCRUB, &nn);
4162 		pf_commit_rules(t[1], PF_RULESET_FILTER, &nn);
4163 		pf_commit_rules(t[2], PF_RULESET_NAT, &nn);
4164 		pf_commit_rules(t[3], PF_RULESET_BINAT, &nn);
4165 		pf_commit_rules(t[4], PF_RULESET_RDR, &nn);
4166 
4167 		if ((error = pf_clear_tables()) != 0)
4168 			break;
4169 
4170 #ifdef ALTQ
4171 		if ((error = pf_begin_altq(&t[0])) != 0) {
4172 			DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: ALTQ\n"));
4173 			break;
4174 		}
4175 		pf_commit_altq(t[0]);
4176 #endif
4177 
4178 		pf_clear_states();
4179 
4180 		pf_clear_srcnodes(NULL);
4181 
4182 		/* status does not use malloced mem so no need to cleanup */
4183 		/* fingerprints and interfaces have their own cleanup code */
4184 	} while(0);
4185 
4186 	return (error);
4187 }
4188 
4189 static pfil_return_t
4190 pf_check_return(int chk, struct mbuf **m)
4191 {
4192 
4193 	switch (chk) {
4194 	case PF_PASS:
4195 		if (*m == NULL)
4196 			return (PFIL_CONSUMED);
4197 		else
4198 			return (PFIL_PASS);
4199 		break;
4200 	default:
4201 		if (*m != NULL) {
4202 			m_freem(*m);
4203 			*m = NULL;
4204 		}
4205 		return (PFIL_DROPPED);
4206 	}
4207 }
4208 
4209 #ifdef INET
4210 static pfil_return_t
4211 pf_check_in(struct mbuf **m, struct ifnet *ifp, int flags,
4212     void *ruleset __unused, struct inpcb *inp)
4213 {
4214 	int chk;
4215 
4216 	chk = pf_test(PF_IN, flags, ifp, m, inp);
4217 
4218 	return (pf_check_return(chk, m));
4219 }
4220 
4221 static pfil_return_t
4222 pf_check_out(struct mbuf **m, struct ifnet *ifp, int flags,
4223     void *ruleset __unused,  struct inpcb *inp)
4224 {
4225 	int chk;
4226 
4227 	chk = pf_test(PF_OUT, flags, ifp, m, inp);
4228 
4229 	return (pf_check_return(chk, m));
4230 }
4231 #endif
4232 
4233 #ifdef INET6
4234 static pfil_return_t
4235 pf_check6_in(struct mbuf **m, struct ifnet *ifp, int flags,
4236     void *ruleset __unused,  struct inpcb *inp)
4237 {
4238 	int chk;
4239 
4240 	/*
4241 	 * In case of loopback traffic IPv6 uses the real interface in
4242 	 * order to support scoped addresses. In order to support stateful
4243 	 * filtering we have change this to lo0 as it is the case in IPv4.
4244 	 */
4245 	CURVNET_SET(ifp->if_vnet);
4246 	chk = pf_test6(PF_IN, flags, (*m)->m_flags & M_LOOP ? V_loif : ifp, m, inp);
4247 	CURVNET_RESTORE();
4248 
4249 	return (pf_check_return(chk, m));
4250 }
4251 
4252 static pfil_return_t
4253 pf_check6_out(struct mbuf **m, struct ifnet *ifp, int flags,
4254     void *ruleset __unused,  struct inpcb *inp)
4255 {
4256 	int chk;
4257 
4258 	CURVNET_SET(ifp->if_vnet);
4259 	chk = pf_test6(PF_OUT, flags, ifp, m, inp);
4260 	CURVNET_RESTORE();
4261 
4262 	return (pf_check_return(chk, m));
4263 }
4264 #endif /* INET6 */
4265 
4266 #ifdef INET
4267 VNET_DEFINE_STATIC(pfil_hook_t, pf_ip4_in_hook);
4268 VNET_DEFINE_STATIC(pfil_hook_t, pf_ip4_out_hook);
4269 #define	V_pf_ip4_in_hook	VNET(pf_ip4_in_hook)
4270 #define	V_pf_ip4_out_hook	VNET(pf_ip4_out_hook)
4271 #endif
4272 #ifdef INET6
4273 VNET_DEFINE_STATIC(pfil_hook_t, pf_ip6_in_hook);
4274 VNET_DEFINE_STATIC(pfil_hook_t, pf_ip6_out_hook);
4275 #define	V_pf_ip6_in_hook	VNET(pf_ip6_in_hook)
4276 #define	V_pf_ip6_out_hook	VNET(pf_ip6_out_hook)
4277 #endif
4278 
4279 static int
4280 hook_pf(void)
4281 {
4282 	struct pfil_hook_args pha;
4283 	struct pfil_link_args pla;
4284 
4285 	if (V_pf_pfil_hooked)
4286 		return (0);
4287 
4288 	pha.pa_version = PFIL_VERSION;
4289 	pha.pa_modname = "pf";
4290 	pha.pa_ruleset = NULL;
4291 
4292 	pla.pa_version = PFIL_VERSION;
4293 
4294 #ifdef INET
4295 	pha.pa_type = PFIL_TYPE_IP4;
4296 	pha.pa_func = pf_check_in;
4297 	pha.pa_flags = PFIL_IN;
4298 	pha.pa_rulname = "default-in";
4299 	V_pf_ip4_in_hook = pfil_add_hook(&pha);
4300 	pla.pa_flags = PFIL_IN | PFIL_HEADPTR | PFIL_HOOKPTR;
4301 	pla.pa_head = V_inet_pfil_head;
4302 	pla.pa_hook = V_pf_ip4_in_hook;
4303 	(void)pfil_link(&pla);
4304 	pha.pa_func = pf_check_out;
4305 	pha.pa_flags = PFIL_OUT;
4306 	pha.pa_rulname = "default-out";
4307 	V_pf_ip4_out_hook = pfil_add_hook(&pha);
4308 	pla.pa_flags = PFIL_OUT | PFIL_HEADPTR | PFIL_HOOKPTR;
4309 	pla.pa_head = V_inet_pfil_head;
4310 	pla.pa_hook = V_pf_ip4_out_hook;
4311 	(void)pfil_link(&pla);
4312 #endif
4313 #ifdef INET6
4314 	pha.pa_type = PFIL_TYPE_IP6;
4315 	pha.pa_func = pf_check6_in;
4316 	pha.pa_flags = PFIL_IN;
4317 	pha.pa_rulname = "default-in6";
4318 	V_pf_ip6_in_hook = pfil_add_hook(&pha);
4319 	pla.pa_flags = PFIL_IN | PFIL_HEADPTR | PFIL_HOOKPTR;
4320 	pla.pa_head = V_inet6_pfil_head;
4321 	pla.pa_hook = V_pf_ip6_in_hook;
4322 	(void)pfil_link(&pla);
4323 	pha.pa_func = pf_check6_out;
4324 	pha.pa_rulname = "default-out6";
4325 	pha.pa_flags = PFIL_OUT;
4326 	V_pf_ip6_out_hook = pfil_add_hook(&pha);
4327 	pla.pa_flags = PFIL_OUT | PFIL_HEADPTR | PFIL_HOOKPTR;
4328 	pla.pa_head = V_inet6_pfil_head;
4329 	pla.pa_hook = V_pf_ip6_out_hook;
4330 	(void)pfil_link(&pla);
4331 #endif
4332 
4333 	V_pf_pfil_hooked = 1;
4334 	return (0);
4335 }
4336 
4337 static int
4338 dehook_pf(void)
4339 {
4340 
4341 	if (V_pf_pfil_hooked == 0)
4342 		return (0);
4343 
4344 #ifdef INET
4345 	pfil_remove_hook(V_pf_ip4_in_hook);
4346 	pfil_remove_hook(V_pf_ip4_out_hook);
4347 #endif
4348 #ifdef INET6
4349 	pfil_remove_hook(V_pf_ip6_in_hook);
4350 	pfil_remove_hook(V_pf_ip6_out_hook);
4351 #endif
4352 
4353 	V_pf_pfil_hooked = 0;
4354 	return (0);
4355 }
4356 
4357 static void
4358 pf_load_vnet(void)
4359 {
4360 	V_pf_tag_z = uma_zcreate("pf tags", sizeof(struct pf_tagname),
4361 	    NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
4362 
4363 	pf_init_tagset(&V_pf_tags, &pf_rule_tag_hashsize,
4364 	    PF_RULE_TAG_HASH_SIZE_DEFAULT);
4365 #ifdef ALTQ
4366 	pf_init_tagset(&V_pf_qids, &pf_queue_tag_hashsize,
4367 	    PF_QUEUE_TAG_HASH_SIZE_DEFAULT);
4368 #endif
4369 
4370 	pfattach_vnet();
4371 	V_pf_vnet_active = 1;
4372 }
4373 
4374 static int
4375 pf_load(void)
4376 {
4377 	int error;
4378 
4379 	rm_init(&pf_rules_lock, "pf rulesets");
4380 	sx_init(&pf_ioctl_lock, "pf ioctl");
4381 	sx_init(&pf_end_lock, "pf end thread");
4382 
4383 	pf_mtag_initialize();
4384 
4385 	pf_dev = make_dev(&pf_cdevsw, 0, UID_ROOT, GID_WHEEL, 0600, PF_NAME);
4386 	if (pf_dev == NULL)
4387 		return (ENOMEM);
4388 
4389 	pf_end_threads = 0;
4390 	error = kproc_create(pf_purge_thread, NULL, &pf_purge_proc, 0, 0, "pf purge");
4391 	if (error != 0)
4392 		return (error);
4393 
4394 	pfi_initialize();
4395 
4396 	return (0);
4397 }
4398 
4399 static void
4400 pf_unload_vnet(void)
4401 {
4402 	int error;
4403 
4404 	V_pf_vnet_active = 0;
4405 	V_pf_status.running = 0;
4406 	error = dehook_pf();
4407 	if (error) {
4408 		/*
4409 		 * Should not happen!
4410 		 * XXX Due to error code ESRCH, kldunload will show
4411 		 * a message like 'No such process'.
4412 		 */
4413 		printf("%s : pfil unregisteration fail\n", __FUNCTION__);
4414 		return;
4415 	}
4416 
4417 	PF_RULES_WLOCK();
4418 	shutdown_pf();
4419 	PF_RULES_WUNLOCK();
4420 
4421 	swi_remove(V_pf_swi_cookie);
4422 
4423 	pf_unload_vnet_purge();
4424 
4425 	pf_normalize_cleanup();
4426 	PF_RULES_WLOCK();
4427 	pfi_cleanup_vnet();
4428 	PF_RULES_WUNLOCK();
4429 	pfr_cleanup();
4430 	pf_osfp_flush();
4431 	pf_cleanup();
4432 	if (IS_DEFAULT_VNET(curvnet))
4433 		pf_mtag_cleanup();
4434 
4435 	pf_cleanup_tagset(&V_pf_tags);
4436 #ifdef ALTQ
4437 	pf_cleanup_tagset(&V_pf_qids);
4438 #endif
4439 	uma_zdestroy(V_pf_tag_z);
4440 
4441 	/* Free counters last as we updated them during shutdown. */
4442 	counter_u64_free(V_pf_default_rule.states_cur);
4443 	counter_u64_free(V_pf_default_rule.states_tot);
4444 	counter_u64_free(V_pf_default_rule.src_nodes);
4445 
4446 	for (int i = 0; i < PFRES_MAX; i++)
4447 		counter_u64_free(V_pf_status.counters[i]);
4448 	for (int i = 0; i < LCNT_MAX; i++)
4449 		counter_u64_free(V_pf_status.lcounters[i]);
4450 	for (int i = 0; i < FCNT_MAX; i++)
4451 		counter_u64_free(V_pf_status.fcounters[i]);
4452 	for (int i = 0; i < SCNT_MAX; i++)
4453 		counter_u64_free(V_pf_status.scounters[i]);
4454 }
4455 
4456 static void
4457 pf_unload(void)
4458 {
4459 
4460 	sx_xlock(&pf_end_lock);
4461 	pf_end_threads = 1;
4462 	while (pf_end_threads < 2) {
4463 		wakeup_one(pf_purge_thread);
4464 		sx_sleep(pf_purge_proc, &pf_end_lock, 0, "pftmo", 0);
4465 	}
4466 	sx_xunlock(&pf_end_lock);
4467 
4468 	if (pf_dev != NULL)
4469 		destroy_dev(pf_dev);
4470 
4471 	pfi_cleanup();
4472 
4473 	rm_destroy(&pf_rules_lock);
4474 	sx_destroy(&pf_ioctl_lock);
4475 	sx_destroy(&pf_end_lock);
4476 }
4477 
4478 static void
4479 vnet_pf_init(void *unused __unused)
4480 {
4481 
4482 	pf_load_vnet();
4483 }
4484 VNET_SYSINIT(vnet_pf_init, SI_SUB_PROTO_FIREWALL, SI_ORDER_THIRD,
4485     vnet_pf_init, NULL);
4486 
4487 static void
4488 vnet_pf_uninit(const void *unused __unused)
4489 {
4490 
4491 	pf_unload_vnet();
4492 }
4493 SYSUNINIT(pf_unload, SI_SUB_PROTO_FIREWALL, SI_ORDER_SECOND, pf_unload, NULL);
4494 VNET_SYSUNINIT(vnet_pf_uninit, SI_SUB_PROTO_FIREWALL, SI_ORDER_THIRD,
4495     vnet_pf_uninit, NULL);
4496 
4497 static int
4498 pf_modevent(module_t mod, int type, void *data)
4499 {
4500 	int error = 0;
4501 
4502 	switch(type) {
4503 	case MOD_LOAD:
4504 		error = pf_load();
4505 		break;
4506 	case MOD_UNLOAD:
4507 		/* Handled in SYSUNINIT(pf_unload) to ensure it's done after
4508 		 * the vnet_pf_uninit()s */
4509 		break;
4510 	default:
4511 		error = EINVAL;
4512 		break;
4513 	}
4514 
4515 	return (error);
4516 }
4517 
4518 static moduledata_t pf_mod = {
4519 	"pf",
4520 	pf_modevent,
4521 	0
4522 };
4523 
4524 DECLARE_MODULE(pf, pf_mod, SI_SUB_PROTO_FIREWALL, SI_ORDER_SECOND);
4525 MODULE_VERSION(pf, PF_MODVER);
4526