xref: /freebsd/sys/netpfil/pf/pf_table.c (revision 3416500aef140042c64bc149cb1ec6620483bc44)
1 /*-
2  * Copyright (c) 2002 Cedric Berger
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  *
9  *    - Redistributions of source code must retain the above copyright
10  *      notice, this list of conditions and the following disclaimer.
11  *    - Redistributions in binary form must reproduce the above
12  *      copyright notice, this list of conditions and the following
13  *      disclaimer in the documentation and/or other materials provided
14  *      with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
17  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
18  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
19  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
20  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
22  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
23  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
24  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
26  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27  * POSSIBILITY OF SUCH DAMAGE.
28  *
29  *	$OpenBSD: pf_table.c,v 1.79 2008/10/08 06:24:50 mcbride Exp $
30  */
31 
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD$");
34 
35 #include "opt_inet.h"
36 #include "opt_inet6.h"
37 
38 #include <sys/param.h>
39 #include <sys/kernel.h>
40 #include <sys/lock.h>
41 #include <sys/malloc.h>
42 #include <sys/mbuf.h>
43 #include <sys/mutex.h>
44 #include <sys/refcount.h>
45 #include <sys/rwlock.h>
46 #include <sys/socket.h>
47 #include <vm/uma.h>
48 
49 #include <net/if.h>
50 #include <net/vnet.h>
51 #include <net/pfvar.h>
52 
53 #define	ACCEPT_FLAGS(flags, oklist)		\
54 	do {					\
55 		if ((flags & ~(oklist)) &	\
56 		    PFR_FLAG_ALLMASK)		\
57 			return (EINVAL);	\
58 	} while (0)
59 
60 #define	FILLIN_SIN(sin, addr)			\
61 	do {					\
62 		(sin).sin_len = sizeof(sin);	\
63 		(sin).sin_family = AF_INET;	\
64 		(sin).sin_addr = (addr);	\
65 	} while (0)
66 
67 #define	FILLIN_SIN6(sin6, addr)			\
68 	do {					\
69 		(sin6).sin6_len = sizeof(sin6);	\
70 		(sin6).sin6_family = AF_INET6;	\
71 		(sin6).sin6_addr = (addr);	\
72 	} while (0)
73 
74 #define	SWAP(type, a1, a2)			\
75 	do {					\
76 		type tmp = a1;			\
77 		a1 = a2;			\
78 		a2 = tmp;			\
79 	} while (0)
80 
81 #define	SUNION2PF(su, af) (((af)==AF_INET) ?	\
82     (struct pf_addr *)&(su)->sin.sin_addr :	\
83     (struct pf_addr *)&(su)->sin6.sin6_addr)
84 
85 #define	AF_BITS(af)		(((af)==AF_INET)?32:128)
86 #define	ADDR_NETWORK(ad)	((ad)->pfra_net < AF_BITS((ad)->pfra_af))
87 #define	KENTRY_NETWORK(ke)	((ke)->pfrke_net < AF_BITS((ke)->pfrke_af))
88 #define	KENTRY_RNF_ROOT(ke) \
89 		((((struct radix_node *)(ke))->rn_flags & RNF_ROOT) != 0)
90 
91 #define	NO_ADDRESSES		(-1)
92 #define	ENQUEUE_UNMARKED_ONLY	(1)
93 #define	INVERT_NEG_FLAG		(1)
94 
95 struct pfr_walktree {
96 	enum pfrw_op {
97 		PFRW_MARK,
98 		PFRW_SWEEP,
99 		PFRW_ENQUEUE,
100 		PFRW_GET_ADDRS,
101 		PFRW_GET_ASTATS,
102 		PFRW_POOL_GET,
103 		PFRW_DYNADDR_UPDATE
104 	}	 pfrw_op;
105 	union {
106 		struct pfr_addr		*pfrw1_addr;
107 		struct pfr_astats	*pfrw1_astats;
108 		struct pfr_kentryworkq	*pfrw1_workq;
109 		struct pfr_kentry	*pfrw1_kentry;
110 		struct pfi_dynaddr	*pfrw1_dyn;
111 	}	 pfrw_1;
112 	int	 pfrw_free;
113 };
114 #define	pfrw_addr	pfrw_1.pfrw1_addr
115 #define	pfrw_astats	pfrw_1.pfrw1_astats
116 #define	pfrw_workq	pfrw_1.pfrw1_workq
117 #define	pfrw_kentry	pfrw_1.pfrw1_kentry
118 #define	pfrw_dyn	pfrw_1.pfrw1_dyn
119 #define	pfrw_cnt	pfrw_free
120 
121 #define	senderr(e)	do { rv = (e); goto _bad; } while (0)
122 
123 static MALLOC_DEFINE(M_PFTABLE, "pf_table", "pf(4) tables structures");
124 static VNET_DEFINE(uma_zone_t, pfr_kentry_z);
125 #define	V_pfr_kentry_z		VNET(pfr_kentry_z)
126 static VNET_DEFINE(uma_zone_t, pfr_kcounters_z);
127 #define	V_pfr_kcounters_z	VNET(pfr_kcounters_z)
128 
129 static struct pf_addr	 pfr_ffaddr = {
130 	.addr32 = { 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff }
131 };
132 
133 static void		 pfr_copyout_addr(struct pfr_addr *,
134 			    struct pfr_kentry *ke);
135 static int		 pfr_validate_addr(struct pfr_addr *);
136 static void		 pfr_enqueue_addrs(struct pfr_ktable *,
137 			    struct pfr_kentryworkq *, int *, int);
138 static void		 pfr_mark_addrs(struct pfr_ktable *);
139 static struct pfr_kentry
140 			*pfr_lookup_addr(struct pfr_ktable *,
141 			    struct pfr_addr *, int);
142 static struct pfr_kentry *pfr_create_kentry(struct pfr_addr *);
143 static void		 pfr_destroy_kentries(struct pfr_kentryworkq *);
144 static void		 pfr_destroy_kentry(struct pfr_kentry *);
145 static void		 pfr_insert_kentries(struct pfr_ktable *,
146 			    struct pfr_kentryworkq *, long);
147 static void		 pfr_remove_kentries(struct pfr_ktable *,
148 			    struct pfr_kentryworkq *);
149 static void		 pfr_clstats_kentries(struct pfr_kentryworkq *, long,
150 			    int);
151 static void		 pfr_reset_feedback(struct pfr_addr *, int);
152 static void		 pfr_prepare_network(union sockaddr_union *, int, int);
153 static int		 pfr_route_kentry(struct pfr_ktable *,
154 			    struct pfr_kentry *);
155 static int		 pfr_unroute_kentry(struct pfr_ktable *,
156 			    struct pfr_kentry *);
157 static int		 pfr_walktree(struct radix_node *, void *);
158 static int		 pfr_validate_table(struct pfr_table *, int, int);
159 static int		 pfr_fix_anchor(char *);
160 static void		 pfr_commit_ktable(struct pfr_ktable *, long);
161 static void		 pfr_insert_ktables(struct pfr_ktableworkq *);
162 static void		 pfr_insert_ktable(struct pfr_ktable *);
163 static void		 pfr_setflags_ktables(struct pfr_ktableworkq *);
164 static void		 pfr_setflags_ktable(struct pfr_ktable *, int);
165 static void		 pfr_clstats_ktables(struct pfr_ktableworkq *, long,
166 			    int);
167 static void		 pfr_clstats_ktable(struct pfr_ktable *, long, int);
168 static struct pfr_ktable
169 			*pfr_create_ktable(struct pfr_table *, long, int);
170 static void		 pfr_destroy_ktables(struct pfr_ktableworkq *, int);
171 static void		 pfr_destroy_ktable(struct pfr_ktable *, int);
172 static int		 pfr_ktable_compare(struct pfr_ktable *,
173 			    struct pfr_ktable *);
174 static struct pfr_ktable
175 			*pfr_lookup_table(struct pfr_table *);
176 static void		 pfr_clean_node_mask(struct pfr_ktable *,
177 			    struct pfr_kentryworkq *);
178 static int		 pfr_table_count(struct pfr_table *, int);
179 static int		 pfr_skip_table(struct pfr_table *,
180 			    struct pfr_ktable *, int);
181 static struct pfr_kentry
182 			*pfr_kentry_byidx(struct pfr_ktable *, int, int);
183 
184 static RB_PROTOTYPE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
185 static RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
186 
187 static VNET_DEFINE(struct pfr_ktablehead, pfr_ktables);
188 #define	V_pfr_ktables	VNET(pfr_ktables)
189 
190 static VNET_DEFINE(struct pfr_table, pfr_nulltable);
191 #define	V_pfr_nulltable	VNET(pfr_nulltable)
192 
193 static VNET_DEFINE(int, pfr_ktable_cnt);
194 #define V_pfr_ktable_cnt	VNET(pfr_ktable_cnt)
195 
196 void
197 pfr_initialize(void)
198 {
199 
200 	V_pfr_kentry_z = uma_zcreate("pf table entries",
201 	    sizeof(struct pfr_kentry), NULL, NULL, NULL, NULL, UMA_ALIGN_PTR,
202 	    0);
203 	V_pfr_kcounters_z = uma_zcreate("pf table counters",
204 	    sizeof(struct pfr_kcounters), NULL, NULL, NULL, NULL,
205 	    UMA_ALIGN_PTR, 0);
206 	V_pf_limits[PF_LIMIT_TABLE_ENTRIES].zone = V_pfr_kentry_z;
207 	V_pf_limits[PF_LIMIT_TABLE_ENTRIES].limit = PFR_KENTRY_HIWAT;
208 }
209 
210 void
211 pfr_cleanup(void)
212 {
213 
214 	uma_zdestroy(V_pfr_kentry_z);
215 	uma_zdestroy(V_pfr_kcounters_z);
216 }
217 
218 int
219 pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags)
220 {
221 	struct pfr_ktable	*kt;
222 	struct pfr_kentryworkq	 workq;
223 
224 	PF_RULES_WASSERT();
225 
226 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
227 	if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
228 		return (EINVAL);
229 	kt = pfr_lookup_table(tbl);
230 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
231 		return (ESRCH);
232 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
233 		return (EPERM);
234 	pfr_enqueue_addrs(kt, &workq, ndel, 0);
235 
236 	if (!(flags & PFR_FLAG_DUMMY)) {
237 		pfr_remove_kentries(kt, &workq);
238 		KASSERT(kt->pfrkt_cnt == 0, ("%s: non-null pfrkt_cnt", __func__));
239 	}
240 	return (0);
241 }
242 
243 int
244 pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
245     int *nadd, int flags)
246 {
247 	struct pfr_ktable	*kt, *tmpkt;
248 	struct pfr_kentryworkq	 workq;
249 	struct pfr_kentry	*p, *q;
250 	struct pfr_addr		*ad;
251 	int			 i, rv, xadd = 0;
252 	long			 tzero = time_second;
253 
254 	PF_RULES_WASSERT();
255 
256 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
257 	if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
258 		return (EINVAL);
259 	kt = pfr_lookup_table(tbl);
260 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
261 		return (ESRCH);
262 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
263 		return (EPERM);
264 	tmpkt = pfr_create_ktable(&V_pfr_nulltable, 0, 0);
265 	if (tmpkt == NULL)
266 		return (ENOMEM);
267 	SLIST_INIT(&workq);
268 	for (i = 0, ad = addr; i < size; i++, ad++) {
269 		if (pfr_validate_addr(ad))
270 			senderr(EINVAL);
271 		p = pfr_lookup_addr(kt, ad, 1);
272 		q = pfr_lookup_addr(tmpkt, ad, 1);
273 		if (flags & PFR_FLAG_FEEDBACK) {
274 			if (q != NULL)
275 				ad->pfra_fback = PFR_FB_DUPLICATE;
276 			else if (p == NULL)
277 				ad->pfra_fback = PFR_FB_ADDED;
278 			else if (p->pfrke_not != ad->pfra_not)
279 				ad->pfra_fback = PFR_FB_CONFLICT;
280 			else
281 				ad->pfra_fback = PFR_FB_NONE;
282 		}
283 		if (p == NULL && q == NULL) {
284 			p = pfr_create_kentry(ad);
285 			if (p == NULL)
286 				senderr(ENOMEM);
287 			if (pfr_route_kentry(tmpkt, p)) {
288 				pfr_destroy_kentry(p);
289 				ad->pfra_fback = PFR_FB_NONE;
290 			} else {
291 				SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
292 				xadd++;
293 			}
294 		}
295 	}
296 	pfr_clean_node_mask(tmpkt, &workq);
297 	if (!(flags & PFR_FLAG_DUMMY))
298 		pfr_insert_kentries(kt, &workq, tzero);
299 	else
300 		pfr_destroy_kentries(&workq);
301 	if (nadd != NULL)
302 		*nadd = xadd;
303 	pfr_destroy_ktable(tmpkt, 0);
304 	return (0);
305 _bad:
306 	pfr_clean_node_mask(tmpkt, &workq);
307 	pfr_destroy_kentries(&workq);
308 	if (flags & PFR_FLAG_FEEDBACK)
309 		pfr_reset_feedback(addr, size);
310 	pfr_destroy_ktable(tmpkt, 0);
311 	return (rv);
312 }
313 
314 int
315 pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
316     int *ndel, int flags)
317 {
318 	struct pfr_ktable	*kt;
319 	struct pfr_kentryworkq	 workq;
320 	struct pfr_kentry	*p;
321 	struct pfr_addr		*ad;
322 	int			 i, rv, xdel = 0, log = 1;
323 
324 	PF_RULES_WASSERT();
325 
326 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
327 	if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
328 		return (EINVAL);
329 	kt = pfr_lookup_table(tbl);
330 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
331 		return (ESRCH);
332 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
333 		return (EPERM);
334 	/*
335 	 * there are two algorithms to choose from here.
336 	 * with:
337 	 *   n: number of addresses to delete
338 	 *   N: number of addresses in the table
339 	 *
340 	 * one is O(N) and is better for large 'n'
341 	 * one is O(n*LOG(N)) and is better for small 'n'
342 	 *
343 	 * following code try to decide which one is best.
344 	 */
345 	for (i = kt->pfrkt_cnt; i > 0; i >>= 1)
346 		log++;
347 	if (size > kt->pfrkt_cnt/log) {
348 		/* full table scan */
349 		pfr_mark_addrs(kt);
350 	} else {
351 		/* iterate over addresses to delete */
352 		for (i = 0, ad = addr; i < size; i++, ad++) {
353 			if (pfr_validate_addr(ad))
354 				return (EINVAL);
355 			p = pfr_lookup_addr(kt, ad, 1);
356 			if (p != NULL)
357 				p->pfrke_mark = 0;
358 		}
359 	}
360 	SLIST_INIT(&workq);
361 	for (i = 0, ad = addr; i < size; i++, ad++) {
362 		if (pfr_validate_addr(ad))
363 			senderr(EINVAL);
364 		p = pfr_lookup_addr(kt, ad, 1);
365 		if (flags & PFR_FLAG_FEEDBACK) {
366 			if (p == NULL)
367 				ad->pfra_fback = PFR_FB_NONE;
368 			else if (p->pfrke_not != ad->pfra_not)
369 				ad->pfra_fback = PFR_FB_CONFLICT;
370 			else if (p->pfrke_mark)
371 				ad->pfra_fback = PFR_FB_DUPLICATE;
372 			else
373 				ad->pfra_fback = PFR_FB_DELETED;
374 		}
375 		if (p != NULL && p->pfrke_not == ad->pfra_not &&
376 		    !p->pfrke_mark) {
377 			p->pfrke_mark = 1;
378 			SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
379 			xdel++;
380 		}
381 	}
382 	if (!(flags & PFR_FLAG_DUMMY))
383 		pfr_remove_kentries(kt, &workq);
384 	if (ndel != NULL)
385 		*ndel = xdel;
386 	return (0);
387 _bad:
388 	if (flags & PFR_FLAG_FEEDBACK)
389 		pfr_reset_feedback(addr, size);
390 	return (rv);
391 }
392 
393 int
394 pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
395     int *size2, int *nadd, int *ndel, int *nchange, int flags,
396     u_int32_t ignore_pfrt_flags)
397 {
398 	struct pfr_ktable	*kt, *tmpkt;
399 	struct pfr_kentryworkq	 addq, delq, changeq;
400 	struct pfr_kentry	*p, *q;
401 	struct pfr_addr		 ad;
402 	int			 i, rv, xadd = 0, xdel = 0, xchange = 0;
403 	long			 tzero = time_second;
404 
405 	PF_RULES_WASSERT();
406 
407 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
408 	if (pfr_validate_table(tbl, ignore_pfrt_flags, flags &
409 	    PFR_FLAG_USERIOCTL))
410 		return (EINVAL);
411 	kt = pfr_lookup_table(tbl);
412 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
413 		return (ESRCH);
414 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
415 		return (EPERM);
416 	tmpkt = pfr_create_ktable(&V_pfr_nulltable, 0, 0);
417 	if (tmpkt == NULL)
418 		return (ENOMEM);
419 	pfr_mark_addrs(kt);
420 	SLIST_INIT(&addq);
421 	SLIST_INIT(&delq);
422 	SLIST_INIT(&changeq);
423 	for (i = 0; i < size; i++) {
424 		/*
425 		 * XXXGL: undertand pf_if usage of this function
426 		 * and make ad a moving pointer
427 		 */
428 		bcopy(addr + i, &ad, sizeof(ad));
429 		if (pfr_validate_addr(&ad))
430 			senderr(EINVAL);
431 		ad.pfra_fback = PFR_FB_NONE;
432 		p = pfr_lookup_addr(kt, &ad, 1);
433 		if (p != NULL) {
434 			if (p->pfrke_mark) {
435 				ad.pfra_fback = PFR_FB_DUPLICATE;
436 				goto _skip;
437 			}
438 			p->pfrke_mark = 1;
439 			if (p->pfrke_not != ad.pfra_not) {
440 				SLIST_INSERT_HEAD(&changeq, p, pfrke_workq);
441 				ad.pfra_fback = PFR_FB_CHANGED;
442 				xchange++;
443 			}
444 		} else {
445 			q = pfr_lookup_addr(tmpkt, &ad, 1);
446 			if (q != NULL) {
447 				ad.pfra_fback = PFR_FB_DUPLICATE;
448 				goto _skip;
449 			}
450 			p = pfr_create_kentry(&ad);
451 			if (p == NULL)
452 				senderr(ENOMEM);
453 			if (pfr_route_kentry(tmpkt, p)) {
454 				pfr_destroy_kentry(p);
455 				ad.pfra_fback = PFR_FB_NONE;
456 			} else {
457 				SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
458 				ad.pfra_fback = PFR_FB_ADDED;
459 				xadd++;
460 			}
461 		}
462 _skip:
463 		if (flags & PFR_FLAG_FEEDBACK)
464 			bcopy(&ad, addr + i, sizeof(ad));
465 	}
466 	pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY);
467 	if ((flags & PFR_FLAG_FEEDBACK) && *size2) {
468 		if (*size2 < size+xdel) {
469 			*size2 = size+xdel;
470 			senderr(0);
471 		}
472 		i = 0;
473 		SLIST_FOREACH(p, &delq, pfrke_workq) {
474 			pfr_copyout_addr(&ad, p);
475 			ad.pfra_fback = PFR_FB_DELETED;
476 			bcopy(&ad, addr + size + i, sizeof(ad));
477 			i++;
478 		}
479 	}
480 	pfr_clean_node_mask(tmpkt, &addq);
481 	if (!(flags & PFR_FLAG_DUMMY)) {
482 		pfr_insert_kentries(kt, &addq, tzero);
483 		pfr_remove_kentries(kt, &delq);
484 		pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
485 	} else
486 		pfr_destroy_kentries(&addq);
487 	if (nadd != NULL)
488 		*nadd = xadd;
489 	if (ndel != NULL)
490 		*ndel = xdel;
491 	if (nchange != NULL)
492 		*nchange = xchange;
493 	if ((flags & PFR_FLAG_FEEDBACK) && size2)
494 		*size2 = size+xdel;
495 	pfr_destroy_ktable(tmpkt, 0);
496 	return (0);
497 _bad:
498 	pfr_clean_node_mask(tmpkt, &addq);
499 	pfr_destroy_kentries(&addq);
500 	if (flags & PFR_FLAG_FEEDBACK)
501 		pfr_reset_feedback(addr, size);
502 	pfr_destroy_ktable(tmpkt, 0);
503 	return (rv);
504 }
505 
506 int
507 pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
508 	int *nmatch, int flags)
509 {
510 	struct pfr_ktable	*kt;
511 	struct pfr_kentry	*p;
512 	struct pfr_addr		*ad;
513 	int			 i, xmatch = 0;
514 
515 	PF_RULES_RASSERT();
516 
517 	ACCEPT_FLAGS(flags, PFR_FLAG_REPLACE);
518 	if (pfr_validate_table(tbl, 0, 0))
519 		return (EINVAL);
520 	kt = pfr_lookup_table(tbl);
521 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
522 		return (ESRCH);
523 
524 	for (i = 0, ad = addr; i < size; i++, ad++) {
525 		if (pfr_validate_addr(ad))
526 			return (EINVAL);
527 		if (ADDR_NETWORK(ad))
528 			return (EINVAL);
529 		p = pfr_lookup_addr(kt, ad, 0);
530 		if (flags & PFR_FLAG_REPLACE)
531 			pfr_copyout_addr(ad, p);
532 		ad->pfra_fback = (p == NULL) ? PFR_FB_NONE :
533 		    (p->pfrke_not ? PFR_FB_NOTMATCH : PFR_FB_MATCH);
534 		if (p != NULL && !p->pfrke_not)
535 			xmatch++;
536 	}
537 	if (nmatch != NULL)
538 		*nmatch = xmatch;
539 	return (0);
540 }
541 
542 int
543 pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size,
544 	int flags)
545 {
546 	struct pfr_ktable	*kt;
547 	struct pfr_walktree	 w;
548 	int			 rv;
549 
550 	PF_RULES_RASSERT();
551 
552 	ACCEPT_FLAGS(flags, 0);
553 	if (pfr_validate_table(tbl, 0, 0))
554 		return (EINVAL);
555 	kt = pfr_lookup_table(tbl);
556 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
557 		return (ESRCH);
558 	if (kt->pfrkt_cnt > *size) {
559 		*size = kt->pfrkt_cnt;
560 		return (0);
561 	}
562 
563 	bzero(&w, sizeof(w));
564 	w.pfrw_op = PFRW_GET_ADDRS;
565 	w.pfrw_addr = addr;
566 	w.pfrw_free = kt->pfrkt_cnt;
567 	rv = kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
568 	if (!rv)
569 		rv = kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh,
570 		    pfr_walktree, &w);
571 	if (rv)
572 		return (rv);
573 
574 	KASSERT(w.pfrw_free == 0, ("%s: corruption detected (%d)", __func__,
575 	    w.pfrw_free));
576 
577 	*size = kt->pfrkt_cnt;
578 	return (0);
579 }
580 
581 int
582 pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size,
583 	int flags)
584 {
585 	struct pfr_ktable	*kt;
586 	struct pfr_walktree	 w;
587 	struct pfr_kentryworkq	 workq;
588 	int			 rv;
589 	long			 tzero = time_second;
590 
591 	PF_RULES_RASSERT();
592 
593 	/* XXX PFR_FLAG_CLSTATS disabled */
594 	ACCEPT_FLAGS(flags, 0);
595 	if (pfr_validate_table(tbl, 0, 0))
596 		return (EINVAL);
597 	kt = pfr_lookup_table(tbl);
598 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
599 		return (ESRCH);
600 	if (kt->pfrkt_cnt > *size) {
601 		*size = kt->pfrkt_cnt;
602 		return (0);
603 	}
604 
605 	bzero(&w, sizeof(w));
606 	w.pfrw_op = PFRW_GET_ASTATS;
607 	w.pfrw_astats = addr;
608 	w.pfrw_free = kt->pfrkt_cnt;
609 	rv = kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
610 	if (!rv)
611 		rv = kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh,
612 		    pfr_walktree, &w);
613 	if (!rv && (flags & PFR_FLAG_CLSTATS)) {
614 		pfr_enqueue_addrs(kt, &workq, NULL, 0);
615 		pfr_clstats_kentries(&workq, tzero, 0);
616 	}
617 	if (rv)
618 		return (rv);
619 
620 	if (w.pfrw_free) {
621 		printf("pfr_get_astats: corruption detected (%d).\n",
622 		    w.pfrw_free);
623 		return (ENOTTY);
624 	}
625 	*size = kt->pfrkt_cnt;
626 	return (0);
627 }
628 
629 int
630 pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size,
631     int *nzero, int flags)
632 {
633 	struct pfr_ktable	*kt;
634 	struct pfr_kentryworkq	 workq;
635 	struct pfr_kentry	*p;
636 	struct pfr_addr		*ad;
637 	int			 i, rv, xzero = 0;
638 
639 	PF_RULES_WASSERT();
640 
641 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
642 	if (pfr_validate_table(tbl, 0, 0))
643 		return (EINVAL);
644 	kt = pfr_lookup_table(tbl);
645 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
646 		return (ESRCH);
647 	SLIST_INIT(&workq);
648 	for (i = 0, ad = addr; i < size; i++, ad++) {
649 		if (pfr_validate_addr(ad))
650 			senderr(EINVAL);
651 		p = pfr_lookup_addr(kt, ad, 1);
652 		if (flags & PFR_FLAG_FEEDBACK) {
653 			ad->pfra_fback = (p != NULL) ?
654 			    PFR_FB_CLEARED : PFR_FB_NONE;
655 		}
656 		if (p != NULL) {
657 			SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
658 			xzero++;
659 		}
660 	}
661 
662 	if (!(flags & PFR_FLAG_DUMMY))
663 		pfr_clstats_kentries(&workq, 0, 0);
664 	if (nzero != NULL)
665 		*nzero = xzero;
666 	return (0);
667 _bad:
668 	if (flags & PFR_FLAG_FEEDBACK)
669 		pfr_reset_feedback(addr, size);
670 	return (rv);
671 }
672 
673 static int
674 pfr_validate_addr(struct pfr_addr *ad)
675 {
676 	int i;
677 
678 	switch (ad->pfra_af) {
679 #ifdef INET
680 	case AF_INET:
681 		if (ad->pfra_net > 32)
682 			return (-1);
683 		break;
684 #endif /* INET */
685 #ifdef INET6
686 	case AF_INET6:
687 		if (ad->pfra_net > 128)
688 			return (-1);
689 		break;
690 #endif /* INET6 */
691 	default:
692 		return (-1);
693 	}
694 	if (ad->pfra_net < 128 &&
695 		(((caddr_t)ad)[ad->pfra_net/8] & (0xFF >> (ad->pfra_net%8))))
696 			return (-1);
697 	for (i = (ad->pfra_net+7)/8; i < sizeof(ad->pfra_u); i++)
698 		if (((caddr_t)ad)[i])
699 			return (-1);
700 	if (ad->pfra_not && ad->pfra_not != 1)
701 		return (-1);
702 	if (ad->pfra_fback)
703 		return (-1);
704 	return (0);
705 }
706 
707 static void
708 pfr_enqueue_addrs(struct pfr_ktable *kt, struct pfr_kentryworkq *workq,
709 	int *naddr, int sweep)
710 {
711 	struct pfr_walktree	w;
712 
713 	SLIST_INIT(workq);
714 	bzero(&w, sizeof(w));
715 	w.pfrw_op = sweep ? PFRW_SWEEP : PFRW_ENQUEUE;
716 	w.pfrw_workq = workq;
717 	if (kt->pfrkt_ip4 != NULL)
718 		if (kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh,
719 		    pfr_walktree, &w))
720 			printf("pfr_enqueue_addrs: IPv4 walktree failed.\n");
721 	if (kt->pfrkt_ip6 != NULL)
722 		if (kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh,
723 		    pfr_walktree, &w))
724 			printf("pfr_enqueue_addrs: IPv6 walktree failed.\n");
725 	if (naddr != NULL)
726 		*naddr = w.pfrw_cnt;
727 }
728 
729 static void
730 pfr_mark_addrs(struct pfr_ktable *kt)
731 {
732 	struct pfr_walktree	w;
733 
734 	bzero(&w, sizeof(w));
735 	w.pfrw_op = PFRW_MARK;
736 	if (kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w))
737 		printf("pfr_mark_addrs: IPv4 walktree failed.\n");
738 	if (kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w))
739 		printf("pfr_mark_addrs: IPv6 walktree failed.\n");
740 }
741 
742 
743 static struct pfr_kentry *
744 pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact)
745 {
746 	union sockaddr_union	 sa, mask;
747 	struct radix_head	*head = NULL;
748 	struct pfr_kentry	*ke;
749 
750 	PF_RULES_ASSERT();
751 
752 	bzero(&sa, sizeof(sa));
753 	if (ad->pfra_af == AF_INET) {
754 		FILLIN_SIN(sa.sin, ad->pfra_ip4addr);
755 		head = &kt->pfrkt_ip4->rh;
756 	} else if ( ad->pfra_af == AF_INET6 ) {
757 		FILLIN_SIN6(sa.sin6, ad->pfra_ip6addr);
758 		head = &kt->pfrkt_ip6->rh;
759 	}
760 	if (ADDR_NETWORK(ad)) {
761 		pfr_prepare_network(&mask, ad->pfra_af, ad->pfra_net);
762 		ke = (struct pfr_kentry *)rn_lookup(&sa, &mask, head);
763 		if (ke && KENTRY_RNF_ROOT(ke))
764 			ke = NULL;
765 	} else {
766 		ke = (struct pfr_kentry *)rn_match(&sa, head);
767 		if (ke && KENTRY_RNF_ROOT(ke))
768 			ke = NULL;
769 		if (exact && ke && KENTRY_NETWORK(ke))
770 			ke = NULL;
771 	}
772 	return (ke);
773 }
774 
775 static struct pfr_kentry *
776 pfr_create_kentry(struct pfr_addr *ad)
777 {
778 	struct pfr_kentry	*ke;
779 
780 	ke =  uma_zalloc(V_pfr_kentry_z, M_NOWAIT | M_ZERO);
781 	if (ke == NULL)
782 		return (NULL);
783 
784 	if (ad->pfra_af == AF_INET)
785 		FILLIN_SIN(ke->pfrke_sa.sin, ad->pfra_ip4addr);
786 	else if (ad->pfra_af == AF_INET6)
787 		FILLIN_SIN6(ke->pfrke_sa.sin6, ad->pfra_ip6addr);
788 	ke->pfrke_af = ad->pfra_af;
789 	ke->pfrke_net = ad->pfra_net;
790 	ke->pfrke_not = ad->pfra_not;
791 	return (ke);
792 }
793 
794 static void
795 pfr_destroy_kentries(struct pfr_kentryworkq *workq)
796 {
797 	struct pfr_kentry	*p, *q;
798 
799 	for (p = SLIST_FIRST(workq); p != NULL; p = q) {
800 		q = SLIST_NEXT(p, pfrke_workq);
801 		pfr_destroy_kentry(p);
802 	}
803 }
804 
805 static void
806 pfr_destroy_kentry(struct pfr_kentry *ke)
807 {
808 	if (ke->pfrke_counters)
809 		uma_zfree(V_pfr_kcounters_z, ke->pfrke_counters);
810 	uma_zfree(V_pfr_kentry_z, ke);
811 }
812 
813 static void
814 pfr_insert_kentries(struct pfr_ktable *kt,
815     struct pfr_kentryworkq *workq, long tzero)
816 {
817 	struct pfr_kentry	*p;
818 	int			 rv, n = 0;
819 
820 	SLIST_FOREACH(p, workq, pfrke_workq) {
821 		rv = pfr_route_kentry(kt, p);
822 		if (rv) {
823 			printf("pfr_insert_kentries: cannot route entry "
824 			    "(code=%d).\n", rv);
825 			break;
826 		}
827 		p->pfrke_tzero = tzero;
828 		n++;
829 	}
830 	kt->pfrkt_cnt += n;
831 }
832 
833 int
834 pfr_insert_kentry(struct pfr_ktable *kt, struct pfr_addr *ad, long tzero)
835 {
836 	struct pfr_kentry	*p;
837 	int			 rv;
838 
839 	p = pfr_lookup_addr(kt, ad, 1);
840 	if (p != NULL)
841 		return (0);
842 	p = pfr_create_kentry(ad);
843 	if (p == NULL)
844 		return (ENOMEM);
845 
846 	rv = pfr_route_kentry(kt, p);
847 	if (rv)
848 		return (rv);
849 
850 	p->pfrke_tzero = tzero;
851 	kt->pfrkt_cnt++;
852 
853 	return (0);
854 }
855 
856 static void
857 pfr_remove_kentries(struct pfr_ktable *kt,
858     struct pfr_kentryworkq *workq)
859 {
860 	struct pfr_kentry	*p;
861 	int			 n = 0;
862 
863 	SLIST_FOREACH(p, workq, pfrke_workq) {
864 		pfr_unroute_kentry(kt, p);
865 		n++;
866 	}
867 	kt->pfrkt_cnt -= n;
868 	pfr_destroy_kentries(workq);
869 }
870 
871 static void
872 pfr_clean_node_mask(struct pfr_ktable *kt,
873     struct pfr_kentryworkq *workq)
874 {
875 	struct pfr_kentry	*p;
876 
877 	SLIST_FOREACH(p, workq, pfrke_workq)
878 		pfr_unroute_kentry(kt, p);
879 }
880 
881 static void
882 pfr_clstats_kentries(struct pfr_kentryworkq *workq, long tzero, int negchange)
883 {
884 	struct pfr_kentry	*p;
885 
886 	SLIST_FOREACH(p, workq, pfrke_workq) {
887 		if (negchange)
888 			p->pfrke_not = !p->pfrke_not;
889 		if (p->pfrke_counters) {
890 			uma_zfree(V_pfr_kcounters_z, p->pfrke_counters);
891 			p->pfrke_counters = NULL;
892 		}
893 		p->pfrke_tzero = tzero;
894 	}
895 }
896 
897 static void
898 pfr_reset_feedback(struct pfr_addr *addr, int size)
899 {
900 	struct pfr_addr	*ad;
901 	int		i;
902 
903 	for (i = 0, ad = addr; i < size; i++, ad++)
904 		ad->pfra_fback = PFR_FB_NONE;
905 }
906 
907 static void
908 pfr_prepare_network(union sockaddr_union *sa, int af, int net)
909 {
910 	int	i;
911 
912 	bzero(sa, sizeof(*sa));
913 	if (af == AF_INET) {
914 		sa->sin.sin_len = sizeof(sa->sin);
915 		sa->sin.sin_family = AF_INET;
916 		sa->sin.sin_addr.s_addr = net ? htonl(-1 << (32-net)) : 0;
917 	} else if (af == AF_INET6) {
918 		sa->sin6.sin6_len = sizeof(sa->sin6);
919 		sa->sin6.sin6_family = AF_INET6;
920 		for (i = 0; i < 4; i++) {
921 			if (net <= 32) {
922 				sa->sin6.sin6_addr.s6_addr32[i] =
923 				    net ? htonl(-1 << (32-net)) : 0;
924 				break;
925 			}
926 			sa->sin6.sin6_addr.s6_addr32[i] = 0xFFFFFFFF;
927 			net -= 32;
928 		}
929 	}
930 }
931 
932 static int
933 pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
934 {
935 	union sockaddr_union	 mask;
936 	struct radix_node	*rn;
937 	struct radix_head	*head = NULL;
938 
939 	PF_RULES_WASSERT();
940 
941 	bzero(ke->pfrke_node, sizeof(ke->pfrke_node));
942 	if (ke->pfrke_af == AF_INET)
943 		head = &kt->pfrkt_ip4->rh;
944 	else if (ke->pfrke_af == AF_INET6)
945 		head = &kt->pfrkt_ip6->rh;
946 
947 	if (KENTRY_NETWORK(ke)) {
948 		pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
949 		rn = rn_addroute(&ke->pfrke_sa, &mask, head, ke->pfrke_node);
950 	} else
951 		rn = rn_addroute(&ke->pfrke_sa, NULL, head, ke->pfrke_node);
952 
953 	return (rn == NULL ? -1 : 0);
954 }
955 
956 static int
957 pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
958 {
959 	union sockaddr_union	 mask;
960 	struct radix_node	*rn;
961 	struct radix_head	*head = NULL;
962 
963 	if (ke->pfrke_af == AF_INET)
964 		head = &kt->pfrkt_ip4->rh;
965 	else if (ke->pfrke_af == AF_INET6)
966 		head = &kt->pfrkt_ip6->rh;
967 
968 	if (KENTRY_NETWORK(ke)) {
969 		pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
970 		rn = rn_delete(&ke->pfrke_sa, &mask, head);
971 	} else
972 		rn = rn_delete(&ke->pfrke_sa, NULL, head);
973 
974 	if (rn == NULL) {
975 		printf("pfr_unroute_kentry: delete failed.\n");
976 		return (-1);
977 	}
978 	return (0);
979 }
980 
981 static void
982 pfr_copyout_addr(struct pfr_addr *ad, struct pfr_kentry *ke)
983 {
984 	bzero(ad, sizeof(*ad));
985 	if (ke == NULL)
986 		return;
987 	ad->pfra_af = ke->pfrke_af;
988 	ad->pfra_net = ke->pfrke_net;
989 	ad->pfra_not = ke->pfrke_not;
990 	if (ad->pfra_af == AF_INET)
991 		ad->pfra_ip4addr = ke->pfrke_sa.sin.sin_addr;
992 	else if (ad->pfra_af == AF_INET6)
993 		ad->pfra_ip6addr = ke->pfrke_sa.sin6.sin6_addr;
994 }
995 
996 static int
997 pfr_walktree(struct radix_node *rn, void *arg)
998 {
999 	struct pfr_kentry	*ke = (struct pfr_kentry *)rn;
1000 	struct pfr_walktree	*w = arg;
1001 
1002 	switch (w->pfrw_op) {
1003 	case PFRW_MARK:
1004 		ke->pfrke_mark = 0;
1005 		break;
1006 	case PFRW_SWEEP:
1007 		if (ke->pfrke_mark)
1008 			break;
1009 		/* FALLTHROUGH */
1010 	case PFRW_ENQUEUE:
1011 		SLIST_INSERT_HEAD(w->pfrw_workq, ke, pfrke_workq);
1012 		w->pfrw_cnt++;
1013 		break;
1014 	case PFRW_GET_ADDRS:
1015 		if (w->pfrw_free-- > 0) {
1016 			pfr_copyout_addr(w->pfrw_addr, ke);
1017 			w->pfrw_addr++;
1018 		}
1019 		break;
1020 	case PFRW_GET_ASTATS:
1021 		if (w->pfrw_free-- > 0) {
1022 			struct pfr_astats as;
1023 
1024 			pfr_copyout_addr(&as.pfras_a, ke);
1025 
1026 			if (ke->pfrke_counters) {
1027 				bcopy(ke->pfrke_counters->pfrkc_packets,
1028 				    as.pfras_packets, sizeof(as.pfras_packets));
1029 				bcopy(ke->pfrke_counters->pfrkc_bytes,
1030 				    as.pfras_bytes, sizeof(as.pfras_bytes));
1031 			} else {
1032 				bzero(as.pfras_packets, sizeof(as.pfras_packets));
1033 				bzero(as.pfras_bytes, sizeof(as.pfras_bytes));
1034 				as.pfras_a.pfra_fback = PFR_FB_NOCOUNT;
1035 			}
1036 			as.pfras_tzero = ke->pfrke_tzero;
1037 
1038 			bcopy(&as, w->pfrw_astats, sizeof(as));
1039 			w->pfrw_astats++;
1040 		}
1041 		break;
1042 	case PFRW_POOL_GET:
1043 		if (ke->pfrke_not)
1044 			break; /* negative entries are ignored */
1045 		if (!w->pfrw_cnt--) {
1046 			w->pfrw_kentry = ke;
1047 			return (1); /* finish search */
1048 		}
1049 		break;
1050 	case PFRW_DYNADDR_UPDATE:
1051 	    {
1052 		union sockaddr_union	pfr_mask;
1053 
1054 		if (ke->pfrke_af == AF_INET) {
1055 			if (w->pfrw_dyn->pfid_acnt4++ > 0)
1056 				break;
1057 			pfr_prepare_network(&pfr_mask, AF_INET, ke->pfrke_net);
1058 			w->pfrw_dyn->pfid_addr4 = *SUNION2PF(&ke->pfrke_sa,
1059 			    AF_INET);
1060 			w->pfrw_dyn->pfid_mask4 = *SUNION2PF(&pfr_mask,
1061 			    AF_INET);
1062 		} else if (ke->pfrke_af == AF_INET6){
1063 			if (w->pfrw_dyn->pfid_acnt6++ > 0)
1064 				break;
1065 			pfr_prepare_network(&pfr_mask, AF_INET6, ke->pfrke_net);
1066 			w->pfrw_dyn->pfid_addr6 = *SUNION2PF(&ke->pfrke_sa,
1067 			    AF_INET6);
1068 			w->pfrw_dyn->pfid_mask6 = *SUNION2PF(&pfr_mask,
1069 			    AF_INET6);
1070 		}
1071 		break;
1072 	    }
1073 	}
1074 	return (0);
1075 }
1076 
1077 int
1078 pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags)
1079 {
1080 	struct pfr_ktableworkq	 workq;
1081 	struct pfr_ktable	*p;
1082 	int			 xdel = 0;
1083 
1084 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ALLRSETS);
1085 	if (pfr_fix_anchor(filter->pfrt_anchor))
1086 		return (EINVAL);
1087 	if (pfr_table_count(filter, flags) < 0)
1088 		return (ENOENT);
1089 
1090 	SLIST_INIT(&workq);
1091 	RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {
1092 		if (pfr_skip_table(filter, p, flags))
1093 			continue;
1094 		if (!strcmp(p->pfrkt_anchor, PF_RESERVED_ANCHOR))
1095 			continue;
1096 		if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE))
1097 			continue;
1098 		p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1099 		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1100 		xdel++;
1101 	}
1102 	if (!(flags & PFR_FLAG_DUMMY))
1103 		pfr_setflags_ktables(&workq);
1104 	if (ndel != NULL)
1105 		*ndel = xdel;
1106 	return (0);
1107 }
1108 
1109 int
1110 pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags)
1111 {
1112 	struct pfr_ktableworkq	 addq, changeq;
1113 	struct pfr_ktable	*p, *q, *r, key;
1114 	int			 i, rv, xadd = 0;
1115 	long			 tzero = time_second;
1116 
1117 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1118 	SLIST_INIT(&addq);
1119 	SLIST_INIT(&changeq);
1120 	for (i = 0; i < size; i++) {
1121 		bcopy(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t));
1122 		if (pfr_validate_table(&key.pfrkt_t, PFR_TFLAG_USRMASK,
1123 		    flags & PFR_FLAG_USERIOCTL))
1124 			senderr(EINVAL);
1125 		key.pfrkt_flags |= PFR_TFLAG_ACTIVE;
1126 		p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);
1127 		if (p == NULL) {
1128 			p = pfr_create_ktable(&key.pfrkt_t, tzero, 1);
1129 			if (p == NULL)
1130 				senderr(ENOMEM);
1131 			SLIST_FOREACH(q, &addq, pfrkt_workq) {
1132 				if (!pfr_ktable_compare(p, q))
1133 					goto _skip;
1134 			}
1135 			SLIST_INSERT_HEAD(&addq, p, pfrkt_workq);
1136 			xadd++;
1137 			if (!key.pfrkt_anchor[0])
1138 				goto _skip;
1139 
1140 			/* find or create root table */
1141 			bzero(key.pfrkt_anchor, sizeof(key.pfrkt_anchor));
1142 			r = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);
1143 			if (r != NULL) {
1144 				p->pfrkt_root = r;
1145 				goto _skip;
1146 			}
1147 			SLIST_FOREACH(q, &addq, pfrkt_workq) {
1148 				if (!pfr_ktable_compare(&key, q)) {
1149 					p->pfrkt_root = q;
1150 					goto _skip;
1151 				}
1152 			}
1153 			key.pfrkt_flags = 0;
1154 			r = pfr_create_ktable(&key.pfrkt_t, 0, 1);
1155 			if (r == NULL)
1156 				senderr(ENOMEM);
1157 			SLIST_INSERT_HEAD(&addq, r, pfrkt_workq);
1158 			p->pfrkt_root = r;
1159 		} else if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1160 			SLIST_FOREACH(q, &changeq, pfrkt_workq)
1161 				if (!pfr_ktable_compare(&key, q))
1162 					goto _skip;
1163 			p->pfrkt_nflags = (p->pfrkt_flags &
1164 			    ~PFR_TFLAG_USRMASK) | key.pfrkt_flags;
1165 			SLIST_INSERT_HEAD(&changeq, p, pfrkt_workq);
1166 			xadd++;
1167 		}
1168 _skip:
1169 	;
1170 	}
1171 	if (!(flags & PFR_FLAG_DUMMY)) {
1172 		pfr_insert_ktables(&addq);
1173 		pfr_setflags_ktables(&changeq);
1174 	} else
1175 		 pfr_destroy_ktables(&addq, 0);
1176 	if (nadd != NULL)
1177 		*nadd = xadd;
1178 	return (0);
1179 _bad:
1180 	pfr_destroy_ktables(&addq, 0);
1181 	return (rv);
1182 }
1183 
1184 int
1185 pfr_del_tables(struct pfr_table *tbl, int size, int *ndel, int flags)
1186 {
1187 	struct pfr_ktableworkq	 workq;
1188 	struct pfr_ktable	*p, *q, key;
1189 	int			 i, xdel = 0;
1190 
1191 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1192 	SLIST_INIT(&workq);
1193 	for (i = 0; i < size; i++) {
1194 		bcopy(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t));
1195 		if (pfr_validate_table(&key.pfrkt_t, 0,
1196 		    flags & PFR_FLAG_USERIOCTL))
1197 			return (EINVAL);
1198 		p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);
1199 		if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1200 			SLIST_FOREACH(q, &workq, pfrkt_workq)
1201 				if (!pfr_ktable_compare(p, q))
1202 					goto _skip;
1203 			p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1204 			SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1205 			xdel++;
1206 		}
1207 _skip:
1208 	;
1209 	}
1210 
1211 	if (!(flags & PFR_FLAG_DUMMY))
1212 		pfr_setflags_ktables(&workq);
1213 	if (ndel != NULL)
1214 		*ndel = xdel;
1215 	return (0);
1216 }
1217 
1218 int
1219 pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size,
1220 	int flags)
1221 {
1222 	struct pfr_ktable	*p;
1223 	int			 n, nn;
1224 
1225 	PF_RULES_RASSERT();
1226 
1227 	ACCEPT_FLAGS(flags, PFR_FLAG_ALLRSETS);
1228 	if (pfr_fix_anchor(filter->pfrt_anchor))
1229 		return (EINVAL);
1230 	n = nn = pfr_table_count(filter, flags);
1231 	if (n < 0)
1232 		return (ENOENT);
1233 	if (n > *size) {
1234 		*size = n;
1235 		return (0);
1236 	}
1237 	RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {
1238 		if (pfr_skip_table(filter, p, flags))
1239 			continue;
1240 		if (n-- <= 0)
1241 			continue;
1242 		bcopy(&p->pfrkt_t, tbl++, sizeof(*tbl));
1243 	}
1244 
1245 	KASSERT(n == 0, ("%s: corruption detected (%d)", __func__, n));
1246 
1247 	*size = nn;
1248 	return (0);
1249 }
1250 
1251 int
1252 pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size,
1253 	int flags)
1254 {
1255 	struct pfr_ktable	*p;
1256 	struct pfr_ktableworkq	 workq;
1257 	int			 n, nn;
1258 	long			 tzero = time_second;
1259 
1260 	/* XXX PFR_FLAG_CLSTATS disabled */
1261 	ACCEPT_FLAGS(flags, PFR_FLAG_ALLRSETS);
1262 	if (pfr_fix_anchor(filter->pfrt_anchor))
1263 		return (EINVAL);
1264 	n = nn = pfr_table_count(filter, flags);
1265 	if (n < 0)
1266 		return (ENOENT);
1267 	if (n > *size) {
1268 		*size = n;
1269 		return (0);
1270 	}
1271 	SLIST_INIT(&workq);
1272 	RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {
1273 		if (pfr_skip_table(filter, p, flags))
1274 			continue;
1275 		if (n-- <= 0)
1276 			continue;
1277 		bcopy(&p->pfrkt_ts, tbl++, sizeof(*tbl));
1278 		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1279 	}
1280 	if (flags & PFR_FLAG_CLSTATS)
1281 		pfr_clstats_ktables(&workq, tzero,
1282 		    flags & PFR_FLAG_ADDRSTOO);
1283 
1284 	KASSERT(n == 0, ("%s: corruption detected (%d)", __func__, n));
1285 
1286 	*size = nn;
1287 	return (0);
1288 }
1289 
1290 int
1291 pfr_clr_tstats(struct pfr_table *tbl, int size, int *nzero, int flags)
1292 {
1293 	struct pfr_ktableworkq	 workq;
1294 	struct pfr_ktable	*p, key;
1295 	int			 i, xzero = 0;
1296 	long			 tzero = time_second;
1297 
1298 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ADDRSTOO);
1299 	SLIST_INIT(&workq);
1300 	for (i = 0; i < size; i++) {
1301 		bcopy(tbl + i, &key.pfrkt_t, sizeof(key.pfrkt_t));
1302 		if (pfr_validate_table(&key.pfrkt_t, 0, 0))
1303 			return (EINVAL);
1304 		p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);
1305 		if (p != NULL) {
1306 			SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1307 			xzero++;
1308 		}
1309 	}
1310 	if (!(flags & PFR_FLAG_DUMMY))
1311 		pfr_clstats_ktables(&workq, tzero, flags & PFR_FLAG_ADDRSTOO);
1312 	if (nzero != NULL)
1313 		*nzero = xzero;
1314 	return (0);
1315 }
1316 
1317 int
1318 pfr_set_tflags(struct pfr_table *tbl, int size, int setflag, int clrflag,
1319 	int *nchange, int *ndel, int flags)
1320 {
1321 	struct pfr_ktableworkq	 workq;
1322 	struct pfr_ktable	*p, *q, key;
1323 	int			 i, xchange = 0, xdel = 0;
1324 
1325 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1326 	if ((setflag & ~PFR_TFLAG_USRMASK) ||
1327 	    (clrflag & ~PFR_TFLAG_USRMASK) ||
1328 	    (setflag & clrflag))
1329 		return (EINVAL);
1330 	SLIST_INIT(&workq);
1331 	for (i = 0; i < size; i++) {
1332 		bcopy(tbl + i, &key.pfrkt_t, sizeof(key.pfrkt_t));
1333 		if (pfr_validate_table(&key.pfrkt_t, 0,
1334 		    flags & PFR_FLAG_USERIOCTL))
1335 			return (EINVAL);
1336 		p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);
1337 		if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1338 			p->pfrkt_nflags = (p->pfrkt_flags | setflag) &
1339 			    ~clrflag;
1340 			if (p->pfrkt_nflags == p->pfrkt_flags)
1341 				goto _skip;
1342 			SLIST_FOREACH(q, &workq, pfrkt_workq)
1343 				if (!pfr_ktable_compare(p, q))
1344 					goto _skip;
1345 			SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1346 			if ((p->pfrkt_flags & PFR_TFLAG_PERSIST) &&
1347 			    (clrflag & PFR_TFLAG_PERSIST) &&
1348 			    !(p->pfrkt_flags & PFR_TFLAG_REFERENCED))
1349 				xdel++;
1350 			else
1351 				xchange++;
1352 		}
1353 _skip:
1354 	;
1355 	}
1356 	if (!(flags & PFR_FLAG_DUMMY))
1357 		pfr_setflags_ktables(&workq);
1358 	if (nchange != NULL)
1359 		*nchange = xchange;
1360 	if (ndel != NULL)
1361 		*ndel = xdel;
1362 	return (0);
1363 }
1364 
1365 int
1366 pfr_ina_begin(struct pfr_table *trs, u_int32_t *ticket, int *ndel, int flags)
1367 {
1368 	struct pfr_ktableworkq	 workq;
1369 	struct pfr_ktable	*p;
1370 	struct pf_ruleset	*rs;
1371 	int			 xdel = 0;
1372 
1373 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1374 	rs = pf_find_or_create_ruleset(trs->pfrt_anchor);
1375 	if (rs == NULL)
1376 		return (ENOMEM);
1377 	SLIST_INIT(&workq);
1378 	RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {
1379 		if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1380 		    pfr_skip_table(trs, p, 0))
1381 			continue;
1382 		p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1383 		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1384 		xdel++;
1385 	}
1386 	if (!(flags & PFR_FLAG_DUMMY)) {
1387 		pfr_setflags_ktables(&workq);
1388 		if (ticket != NULL)
1389 			*ticket = ++rs->tticket;
1390 		rs->topen = 1;
1391 	} else
1392 		pf_remove_if_empty_ruleset(rs);
1393 	if (ndel != NULL)
1394 		*ndel = xdel;
1395 	return (0);
1396 }
1397 
1398 int
1399 pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size,
1400     int *nadd, int *naddr, u_int32_t ticket, int flags)
1401 {
1402 	struct pfr_ktableworkq	 tableq;
1403 	struct pfr_kentryworkq	 addrq;
1404 	struct pfr_ktable	*kt, *rt, *shadow, key;
1405 	struct pfr_kentry	*p;
1406 	struct pfr_addr		*ad;
1407 	struct pf_ruleset	*rs;
1408 	int			 i, rv, xadd = 0, xaddr = 0;
1409 
1410 	PF_RULES_WASSERT();
1411 
1412 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ADDRSTOO);
1413 	if (size && !(flags & PFR_FLAG_ADDRSTOO))
1414 		return (EINVAL);
1415 	if (pfr_validate_table(tbl, PFR_TFLAG_USRMASK,
1416 	    flags & PFR_FLAG_USERIOCTL))
1417 		return (EINVAL);
1418 	rs = pf_find_ruleset(tbl->pfrt_anchor);
1419 	if (rs == NULL || !rs->topen || ticket != rs->tticket)
1420 		return (EBUSY);
1421 	tbl->pfrt_flags |= PFR_TFLAG_INACTIVE;
1422 	SLIST_INIT(&tableq);
1423 	kt = RB_FIND(pfr_ktablehead, &V_pfr_ktables, (struct pfr_ktable *)tbl);
1424 	if (kt == NULL) {
1425 		kt = pfr_create_ktable(tbl, 0, 1);
1426 		if (kt == NULL)
1427 			return (ENOMEM);
1428 		SLIST_INSERT_HEAD(&tableq, kt, pfrkt_workq);
1429 		xadd++;
1430 		if (!tbl->pfrt_anchor[0])
1431 			goto _skip;
1432 
1433 		/* find or create root table */
1434 		bzero(&key, sizeof(key));
1435 		strlcpy(key.pfrkt_name, tbl->pfrt_name, sizeof(key.pfrkt_name));
1436 		rt = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);
1437 		if (rt != NULL) {
1438 			kt->pfrkt_root = rt;
1439 			goto _skip;
1440 		}
1441 		rt = pfr_create_ktable(&key.pfrkt_t, 0, 1);
1442 		if (rt == NULL) {
1443 			pfr_destroy_ktables(&tableq, 0);
1444 			return (ENOMEM);
1445 		}
1446 		SLIST_INSERT_HEAD(&tableq, rt, pfrkt_workq);
1447 		kt->pfrkt_root = rt;
1448 	} else if (!(kt->pfrkt_flags & PFR_TFLAG_INACTIVE))
1449 		xadd++;
1450 _skip:
1451 	shadow = pfr_create_ktable(tbl, 0, 0);
1452 	if (shadow == NULL) {
1453 		pfr_destroy_ktables(&tableq, 0);
1454 		return (ENOMEM);
1455 	}
1456 	SLIST_INIT(&addrq);
1457 	for (i = 0, ad = addr; i < size; i++, ad++) {
1458 		if (pfr_validate_addr(ad))
1459 			senderr(EINVAL);
1460 		if (pfr_lookup_addr(shadow, ad, 1) != NULL)
1461 			continue;
1462 		p = pfr_create_kentry(ad);
1463 		if (p == NULL)
1464 			senderr(ENOMEM);
1465 		if (pfr_route_kentry(shadow, p)) {
1466 			pfr_destroy_kentry(p);
1467 			continue;
1468 		}
1469 		SLIST_INSERT_HEAD(&addrq, p, pfrke_workq);
1470 		xaddr++;
1471 	}
1472 	if (!(flags & PFR_FLAG_DUMMY)) {
1473 		if (kt->pfrkt_shadow != NULL)
1474 			pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1475 		kt->pfrkt_flags |= PFR_TFLAG_INACTIVE;
1476 		pfr_insert_ktables(&tableq);
1477 		shadow->pfrkt_cnt = (flags & PFR_FLAG_ADDRSTOO) ?
1478 		    xaddr : NO_ADDRESSES;
1479 		kt->pfrkt_shadow = shadow;
1480 	} else {
1481 		pfr_clean_node_mask(shadow, &addrq);
1482 		pfr_destroy_ktable(shadow, 0);
1483 		pfr_destroy_ktables(&tableq, 0);
1484 		pfr_destroy_kentries(&addrq);
1485 	}
1486 	if (nadd != NULL)
1487 		*nadd = xadd;
1488 	if (naddr != NULL)
1489 		*naddr = xaddr;
1490 	return (0);
1491 _bad:
1492 	pfr_destroy_ktable(shadow, 0);
1493 	pfr_destroy_ktables(&tableq, 0);
1494 	pfr_destroy_kentries(&addrq);
1495 	return (rv);
1496 }
1497 
1498 int
1499 pfr_ina_rollback(struct pfr_table *trs, u_int32_t ticket, int *ndel, int flags)
1500 {
1501 	struct pfr_ktableworkq	 workq;
1502 	struct pfr_ktable	*p;
1503 	struct pf_ruleset	*rs;
1504 	int			 xdel = 0;
1505 
1506 	PF_RULES_WASSERT();
1507 
1508 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1509 	rs = pf_find_ruleset(trs->pfrt_anchor);
1510 	if (rs == NULL || !rs->topen || ticket != rs->tticket)
1511 		return (0);
1512 	SLIST_INIT(&workq);
1513 	RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {
1514 		if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1515 		    pfr_skip_table(trs, p, 0))
1516 			continue;
1517 		p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1518 		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1519 		xdel++;
1520 	}
1521 	if (!(flags & PFR_FLAG_DUMMY)) {
1522 		pfr_setflags_ktables(&workq);
1523 		rs->topen = 0;
1524 		pf_remove_if_empty_ruleset(rs);
1525 	}
1526 	if (ndel != NULL)
1527 		*ndel = xdel;
1528 	return (0);
1529 }
1530 
1531 int
1532 pfr_ina_commit(struct pfr_table *trs, u_int32_t ticket, int *nadd,
1533     int *nchange, int flags)
1534 {
1535 	struct pfr_ktable	*p, *q;
1536 	struct pfr_ktableworkq	 workq;
1537 	struct pf_ruleset	*rs;
1538 	int			 xadd = 0, xchange = 0;
1539 	long			 tzero = time_second;
1540 
1541 	PF_RULES_WASSERT();
1542 
1543 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1544 	rs = pf_find_ruleset(trs->pfrt_anchor);
1545 	if (rs == NULL || !rs->topen || ticket != rs->tticket)
1546 		return (EBUSY);
1547 
1548 	SLIST_INIT(&workq);
1549 	RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {
1550 		if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1551 		    pfr_skip_table(trs, p, 0))
1552 			continue;
1553 		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1554 		if (p->pfrkt_flags & PFR_TFLAG_ACTIVE)
1555 			xchange++;
1556 		else
1557 			xadd++;
1558 	}
1559 
1560 	if (!(flags & PFR_FLAG_DUMMY)) {
1561 		for (p = SLIST_FIRST(&workq); p != NULL; p = q) {
1562 			q = SLIST_NEXT(p, pfrkt_workq);
1563 			pfr_commit_ktable(p, tzero);
1564 		}
1565 		rs->topen = 0;
1566 		pf_remove_if_empty_ruleset(rs);
1567 	}
1568 	if (nadd != NULL)
1569 		*nadd = xadd;
1570 	if (nchange != NULL)
1571 		*nchange = xchange;
1572 
1573 	return (0);
1574 }
1575 
1576 static void
1577 pfr_commit_ktable(struct pfr_ktable *kt, long tzero)
1578 {
1579 	struct pfr_ktable	*shadow = kt->pfrkt_shadow;
1580 	int			 nflags;
1581 
1582 	PF_RULES_WASSERT();
1583 
1584 	if (shadow->pfrkt_cnt == NO_ADDRESSES) {
1585 		if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1586 			pfr_clstats_ktable(kt, tzero, 1);
1587 	} else if (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) {
1588 		/* kt might contain addresses */
1589 		struct pfr_kentryworkq	 addrq, addq, changeq, delq, garbageq;
1590 		struct pfr_kentry	*p, *q, *next;
1591 		struct pfr_addr		 ad;
1592 
1593 		pfr_enqueue_addrs(shadow, &addrq, NULL, 0);
1594 		pfr_mark_addrs(kt);
1595 		SLIST_INIT(&addq);
1596 		SLIST_INIT(&changeq);
1597 		SLIST_INIT(&delq);
1598 		SLIST_INIT(&garbageq);
1599 		pfr_clean_node_mask(shadow, &addrq);
1600 		for (p = SLIST_FIRST(&addrq); p != NULL; p = next) {
1601 			next = SLIST_NEXT(p, pfrke_workq);	/* XXX */
1602 			pfr_copyout_addr(&ad, p);
1603 			q = pfr_lookup_addr(kt, &ad, 1);
1604 			if (q != NULL) {
1605 				if (q->pfrke_not != p->pfrke_not)
1606 					SLIST_INSERT_HEAD(&changeq, q,
1607 					    pfrke_workq);
1608 				q->pfrke_mark = 1;
1609 				SLIST_INSERT_HEAD(&garbageq, p, pfrke_workq);
1610 			} else {
1611 				p->pfrke_tzero = tzero;
1612 				SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
1613 			}
1614 		}
1615 		pfr_enqueue_addrs(kt, &delq, NULL, ENQUEUE_UNMARKED_ONLY);
1616 		pfr_insert_kentries(kt, &addq, tzero);
1617 		pfr_remove_kentries(kt, &delq);
1618 		pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
1619 		pfr_destroy_kentries(&garbageq);
1620 	} else {
1621 		/* kt cannot contain addresses */
1622 		SWAP(struct radix_node_head *, kt->pfrkt_ip4,
1623 		    shadow->pfrkt_ip4);
1624 		SWAP(struct radix_node_head *, kt->pfrkt_ip6,
1625 		    shadow->pfrkt_ip6);
1626 		SWAP(int, kt->pfrkt_cnt, shadow->pfrkt_cnt);
1627 		pfr_clstats_ktable(kt, tzero, 1);
1628 	}
1629 	nflags = ((shadow->pfrkt_flags & PFR_TFLAG_USRMASK) |
1630 	    (kt->pfrkt_flags & PFR_TFLAG_SETMASK) | PFR_TFLAG_ACTIVE)
1631 		& ~PFR_TFLAG_INACTIVE;
1632 	pfr_destroy_ktable(shadow, 0);
1633 	kt->pfrkt_shadow = NULL;
1634 	pfr_setflags_ktable(kt, nflags);
1635 }
1636 
1637 static int
1638 pfr_validate_table(struct pfr_table *tbl, int allowedflags, int no_reserved)
1639 {
1640 	int i;
1641 
1642 	if (!tbl->pfrt_name[0])
1643 		return (-1);
1644 	if (no_reserved && !strcmp(tbl->pfrt_anchor, PF_RESERVED_ANCHOR))
1645 		 return (-1);
1646 	if (tbl->pfrt_name[PF_TABLE_NAME_SIZE-1])
1647 		return (-1);
1648 	for (i = strlen(tbl->pfrt_name); i < PF_TABLE_NAME_SIZE; i++)
1649 		if (tbl->pfrt_name[i])
1650 			return (-1);
1651 	if (pfr_fix_anchor(tbl->pfrt_anchor))
1652 		return (-1);
1653 	if (tbl->pfrt_flags & ~allowedflags)
1654 		return (-1);
1655 	return (0);
1656 }
1657 
1658 /*
1659  * Rewrite anchors referenced by tables to remove slashes
1660  * and check for validity.
1661  */
1662 static int
1663 pfr_fix_anchor(char *anchor)
1664 {
1665 	size_t siz = MAXPATHLEN;
1666 	int i;
1667 
1668 	if (anchor[0] == '/') {
1669 		char *path;
1670 		int off;
1671 
1672 		path = anchor;
1673 		off = 1;
1674 		while (*++path == '/')
1675 			off++;
1676 		bcopy(path, anchor, siz - off);
1677 		memset(anchor + siz - off, 0, off);
1678 	}
1679 	if (anchor[siz - 1])
1680 		return (-1);
1681 	for (i = strlen(anchor); i < siz; i++)
1682 		if (anchor[i])
1683 			return (-1);
1684 	return (0);
1685 }
1686 
1687 static int
1688 pfr_table_count(struct pfr_table *filter, int flags)
1689 {
1690 	struct pf_ruleset *rs;
1691 
1692 	PF_RULES_ASSERT();
1693 
1694 	if (flags & PFR_FLAG_ALLRSETS)
1695 		return (V_pfr_ktable_cnt);
1696 	if (filter->pfrt_anchor[0]) {
1697 		rs = pf_find_ruleset(filter->pfrt_anchor);
1698 		return ((rs != NULL) ? rs->tables : -1);
1699 	}
1700 	return (pf_main_ruleset.tables);
1701 }
1702 
1703 static int
1704 pfr_skip_table(struct pfr_table *filter, struct pfr_ktable *kt, int flags)
1705 {
1706 	if (flags & PFR_FLAG_ALLRSETS)
1707 		return (0);
1708 	if (strcmp(filter->pfrt_anchor, kt->pfrkt_anchor))
1709 		return (1);
1710 	return (0);
1711 }
1712 
1713 static void
1714 pfr_insert_ktables(struct pfr_ktableworkq *workq)
1715 {
1716 	struct pfr_ktable	*p;
1717 
1718 	SLIST_FOREACH(p, workq, pfrkt_workq)
1719 		pfr_insert_ktable(p);
1720 }
1721 
1722 static void
1723 pfr_insert_ktable(struct pfr_ktable *kt)
1724 {
1725 
1726 	PF_RULES_WASSERT();
1727 
1728 	RB_INSERT(pfr_ktablehead, &V_pfr_ktables, kt);
1729 	V_pfr_ktable_cnt++;
1730 	if (kt->pfrkt_root != NULL)
1731 		if (!kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]++)
1732 			pfr_setflags_ktable(kt->pfrkt_root,
1733 			    kt->pfrkt_root->pfrkt_flags|PFR_TFLAG_REFDANCHOR);
1734 }
1735 
1736 static void
1737 pfr_setflags_ktables(struct pfr_ktableworkq *workq)
1738 {
1739 	struct pfr_ktable	*p, *q;
1740 
1741 	for (p = SLIST_FIRST(workq); p; p = q) {
1742 		q = SLIST_NEXT(p, pfrkt_workq);
1743 		pfr_setflags_ktable(p, p->pfrkt_nflags);
1744 	}
1745 }
1746 
1747 static void
1748 pfr_setflags_ktable(struct pfr_ktable *kt, int newf)
1749 {
1750 	struct pfr_kentryworkq	addrq;
1751 
1752 	PF_RULES_WASSERT();
1753 
1754 	if (!(newf & PFR_TFLAG_REFERENCED) &&
1755 	    !(newf & PFR_TFLAG_PERSIST))
1756 		newf &= ~PFR_TFLAG_ACTIVE;
1757 	if (!(newf & PFR_TFLAG_ACTIVE))
1758 		newf &= ~PFR_TFLAG_USRMASK;
1759 	if (!(newf & PFR_TFLAG_SETMASK)) {
1760 		RB_REMOVE(pfr_ktablehead, &V_pfr_ktables, kt);
1761 		if (kt->pfrkt_root != NULL)
1762 			if (!--kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR])
1763 				pfr_setflags_ktable(kt->pfrkt_root,
1764 				    kt->pfrkt_root->pfrkt_flags &
1765 					~PFR_TFLAG_REFDANCHOR);
1766 		pfr_destroy_ktable(kt, 1);
1767 		V_pfr_ktable_cnt--;
1768 		return;
1769 	}
1770 	if (!(newf & PFR_TFLAG_ACTIVE) && kt->pfrkt_cnt) {
1771 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1772 		pfr_remove_kentries(kt, &addrq);
1773 	}
1774 	if (!(newf & PFR_TFLAG_INACTIVE) && kt->pfrkt_shadow != NULL) {
1775 		pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1776 		kt->pfrkt_shadow = NULL;
1777 	}
1778 	kt->pfrkt_flags = newf;
1779 }
1780 
1781 static void
1782 pfr_clstats_ktables(struct pfr_ktableworkq *workq, long tzero, int recurse)
1783 {
1784 	struct pfr_ktable	*p;
1785 
1786 	SLIST_FOREACH(p, workq, pfrkt_workq)
1787 		pfr_clstats_ktable(p, tzero, recurse);
1788 }
1789 
1790 static void
1791 pfr_clstats_ktable(struct pfr_ktable *kt, long tzero, int recurse)
1792 {
1793 	struct pfr_kentryworkq	 addrq;
1794 
1795 	if (recurse) {
1796 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1797 		pfr_clstats_kentries(&addrq, tzero, 0);
1798 	}
1799 	bzero(kt->pfrkt_packets, sizeof(kt->pfrkt_packets));
1800 	bzero(kt->pfrkt_bytes, sizeof(kt->pfrkt_bytes));
1801 	kt->pfrkt_match = kt->pfrkt_nomatch = 0;
1802 	kt->pfrkt_tzero = tzero;
1803 }
1804 
1805 static struct pfr_ktable *
1806 pfr_create_ktable(struct pfr_table *tbl, long tzero, int attachruleset)
1807 {
1808 	struct pfr_ktable	*kt;
1809 	struct pf_ruleset	*rs;
1810 
1811 	PF_RULES_WASSERT();
1812 
1813 	kt = malloc(sizeof(*kt), M_PFTABLE, M_NOWAIT|M_ZERO);
1814 	if (kt == NULL)
1815 		return (NULL);
1816 	kt->pfrkt_t = *tbl;
1817 
1818 	if (attachruleset) {
1819 		rs = pf_find_or_create_ruleset(tbl->pfrt_anchor);
1820 		if (!rs) {
1821 			pfr_destroy_ktable(kt, 0);
1822 			return (NULL);
1823 		}
1824 		kt->pfrkt_rs = rs;
1825 		rs->tables++;
1826 	}
1827 
1828 	if (!rn_inithead((void **)&kt->pfrkt_ip4,
1829 	    offsetof(struct sockaddr_in, sin_addr) * 8) ||
1830 	    !rn_inithead((void **)&kt->pfrkt_ip6,
1831 	    offsetof(struct sockaddr_in6, sin6_addr) * 8)) {
1832 		pfr_destroy_ktable(kt, 0);
1833 		return (NULL);
1834 	}
1835 	kt->pfrkt_tzero = tzero;
1836 
1837 	return (kt);
1838 }
1839 
1840 static void
1841 pfr_destroy_ktables(struct pfr_ktableworkq *workq, int flushaddr)
1842 {
1843 	struct pfr_ktable	*p, *q;
1844 
1845 	for (p = SLIST_FIRST(workq); p; p = q) {
1846 		q = SLIST_NEXT(p, pfrkt_workq);
1847 		pfr_destroy_ktable(p, flushaddr);
1848 	}
1849 }
1850 
1851 static void
1852 pfr_destroy_ktable(struct pfr_ktable *kt, int flushaddr)
1853 {
1854 	struct pfr_kentryworkq	 addrq;
1855 
1856 	if (flushaddr) {
1857 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1858 		pfr_clean_node_mask(kt, &addrq);
1859 		pfr_destroy_kentries(&addrq);
1860 	}
1861 	if (kt->pfrkt_ip4 != NULL)
1862 		rn_detachhead((void **)&kt->pfrkt_ip4);
1863 	if (kt->pfrkt_ip6 != NULL)
1864 		rn_detachhead((void **)&kt->pfrkt_ip6);
1865 	if (kt->pfrkt_shadow != NULL)
1866 		pfr_destroy_ktable(kt->pfrkt_shadow, flushaddr);
1867 	if (kt->pfrkt_rs != NULL) {
1868 		kt->pfrkt_rs->tables--;
1869 		pf_remove_if_empty_ruleset(kt->pfrkt_rs);
1870 	}
1871 	free(kt, M_PFTABLE);
1872 }
1873 
1874 static int
1875 pfr_ktable_compare(struct pfr_ktable *p, struct pfr_ktable *q)
1876 {
1877 	int d;
1878 
1879 	if ((d = strncmp(p->pfrkt_name, q->pfrkt_name, PF_TABLE_NAME_SIZE)))
1880 		return (d);
1881 	return (strcmp(p->pfrkt_anchor, q->pfrkt_anchor));
1882 }
1883 
1884 static struct pfr_ktable *
1885 pfr_lookup_table(struct pfr_table *tbl)
1886 {
1887 	/* struct pfr_ktable start like a struct pfr_table */
1888 	return (RB_FIND(pfr_ktablehead, &V_pfr_ktables,
1889 	    (struct pfr_ktable *)tbl));
1890 }
1891 
1892 int
1893 pfr_match_addr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af)
1894 {
1895 	struct pfr_kentry	*ke = NULL;
1896 	int			 match;
1897 
1898 	PF_RULES_RASSERT();
1899 
1900 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
1901 		kt = kt->pfrkt_root;
1902 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1903 		return (0);
1904 
1905 	switch (af) {
1906 #ifdef INET
1907 	case AF_INET:
1908 	    {
1909 		struct sockaddr_in sin;
1910 
1911 		bzero(&sin, sizeof(sin));
1912 		sin.sin_len = sizeof(sin);
1913 		sin.sin_family = AF_INET;
1914 		sin.sin_addr.s_addr = a->addr32[0];
1915 		ke = (struct pfr_kentry *)rn_match(&sin, &kt->pfrkt_ip4->rh);
1916 		if (ke && KENTRY_RNF_ROOT(ke))
1917 			ke = NULL;
1918 		break;
1919 	    }
1920 #endif /* INET */
1921 #ifdef INET6
1922 	case AF_INET6:
1923 	    {
1924 		struct sockaddr_in6 sin6;
1925 
1926 		bzero(&sin6, sizeof(sin6));
1927 		sin6.sin6_len = sizeof(sin6);
1928 		sin6.sin6_family = AF_INET6;
1929 		bcopy(a, &sin6.sin6_addr, sizeof(sin6.sin6_addr));
1930 		ke = (struct pfr_kentry *)rn_match(&sin6, &kt->pfrkt_ip6->rh);
1931 		if (ke && KENTRY_RNF_ROOT(ke))
1932 			ke = NULL;
1933 		break;
1934 	    }
1935 #endif /* INET6 */
1936 	}
1937 	match = (ke && !ke->pfrke_not);
1938 	if (match)
1939 		kt->pfrkt_match++;
1940 	else
1941 		kt->pfrkt_nomatch++;
1942 	return (match);
1943 }
1944 
1945 void
1946 pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af,
1947     u_int64_t len, int dir_out, int op_pass, int notrule)
1948 {
1949 	struct pfr_kentry	*ke = NULL;
1950 
1951 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
1952 		kt = kt->pfrkt_root;
1953 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1954 		return;
1955 
1956 	switch (af) {
1957 #ifdef INET
1958 	case AF_INET:
1959 	    {
1960 		struct sockaddr_in sin;
1961 
1962 		bzero(&sin, sizeof(sin));
1963 		sin.sin_len = sizeof(sin);
1964 		sin.sin_family = AF_INET;
1965 		sin.sin_addr.s_addr = a->addr32[0];
1966 		ke = (struct pfr_kentry *)rn_match(&sin, &kt->pfrkt_ip4->rh);
1967 		if (ke && KENTRY_RNF_ROOT(ke))
1968 			ke = NULL;
1969 		break;
1970 	    }
1971 #endif /* INET */
1972 #ifdef INET6
1973 	case AF_INET6:
1974 	    {
1975 		struct sockaddr_in6 sin6;
1976 
1977 		bzero(&sin6, sizeof(sin6));
1978 		sin6.sin6_len = sizeof(sin6);
1979 		sin6.sin6_family = AF_INET6;
1980 		bcopy(a, &sin6.sin6_addr, sizeof(sin6.sin6_addr));
1981 		ke = (struct pfr_kentry *)rn_match(&sin6, &kt->pfrkt_ip6->rh);
1982 		if (ke && KENTRY_RNF_ROOT(ke))
1983 			ke = NULL;
1984 		break;
1985 	    }
1986 #endif /* INET6 */
1987 	default:
1988 		panic("%s: unknown address family %u", __func__, af);
1989 	}
1990 	if ((ke == NULL || ke->pfrke_not) != notrule) {
1991 		if (op_pass != PFR_OP_PASS)
1992 			printf("pfr_update_stats: assertion failed.\n");
1993 		op_pass = PFR_OP_XPASS;
1994 	}
1995 	kt->pfrkt_packets[dir_out][op_pass]++;
1996 	kt->pfrkt_bytes[dir_out][op_pass] += len;
1997 	if (ke != NULL && op_pass != PFR_OP_XPASS &&
1998 	    (kt->pfrkt_flags & PFR_TFLAG_COUNTERS)) {
1999 		if (ke->pfrke_counters == NULL)
2000 			ke->pfrke_counters = uma_zalloc(V_pfr_kcounters_z,
2001 			    M_NOWAIT | M_ZERO);
2002 		if (ke->pfrke_counters != NULL) {
2003 			ke->pfrke_counters->pfrkc_packets[dir_out][op_pass]++;
2004 			ke->pfrke_counters->pfrkc_bytes[dir_out][op_pass] += len;
2005 		}
2006 	}
2007 }
2008 
2009 struct pfr_ktable *
2010 pfr_attach_table(struct pf_ruleset *rs, char *name)
2011 {
2012 	struct pfr_ktable	*kt, *rt;
2013 	struct pfr_table	 tbl;
2014 	struct pf_anchor	*ac = rs->anchor;
2015 
2016 	PF_RULES_WASSERT();
2017 
2018 	bzero(&tbl, sizeof(tbl));
2019 	strlcpy(tbl.pfrt_name, name, sizeof(tbl.pfrt_name));
2020 	if (ac != NULL)
2021 		strlcpy(tbl.pfrt_anchor, ac->path, sizeof(tbl.pfrt_anchor));
2022 	kt = pfr_lookup_table(&tbl);
2023 	if (kt == NULL) {
2024 		kt = pfr_create_ktable(&tbl, time_second, 1);
2025 		if (kt == NULL)
2026 			return (NULL);
2027 		if (ac != NULL) {
2028 			bzero(tbl.pfrt_anchor, sizeof(tbl.pfrt_anchor));
2029 			rt = pfr_lookup_table(&tbl);
2030 			if (rt == NULL) {
2031 				rt = pfr_create_ktable(&tbl, 0, 1);
2032 				if (rt == NULL) {
2033 					pfr_destroy_ktable(kt, 0);
2034 					return (NULL);
2035 				}
2036 				pfr_insert_ktable(rt);
2037 			}
2038 			kt->pfrkt_root = rt;
2039 		}
2040 		pfr_insert_ktable(kt);
2041 	}
2042 	if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++)
2043 		pfr_setflags_ktable(kt, kt->pfrkt_flags|PFR_TFLAG_REFERENCED);
2044 	return (kt);
2045 }
2046 
2047 void
2048 pfr_detach_table(struct pfr_ktable *kt)
2049 {
2050 
2051 	PF_RULES_WASSERT();
2052 	KASSERT(kt->pfrkt_refcnt[PFR_REFCNT_RULE] > 0, ("%s: refcount %d\n",
2053 	    __func__, kt->pfrkt_refcnt[PFR_REFCNT_RULE]));
2054 
2055 	if (!--kt->pfrkt_refcnt[PFR_REFCNT_RULE])
2056 		pfr_setflags_ktable(kt, kt->pfrkt_flags&~PFR_TFLAG_REFERENCED);
2057 }
2058 
2059 int
2060 pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter,
2061     sa_family_t af)
2062 {
2063 	struct pf_addr		 *addr, *cur, *mask;
2064 	union sockaddr_union	 uaddr, umask;
2065 	struct pfr_kentry	*ke, *ke2 = NULL;
2066 	int			 idx = -1, use_counter = 0;
2067 
2068 	switch (af) {
2069 	case AF_INET:
2070 		uaddr.sin.sin_len = sizeof(struct sockaddr_in);
2071 		uaddr.sin.sin_family = AF_INET;
2072 		break;
2073 	case AF_INET6:
2074 		uaddr.sin6.sin6_len = sizeof(struct sockaddr_in6);
2075 		uaddr.sin6.sin6_family = AF_INET6;
2076 		break;
2077 	}
2078 	addr = SUNION2PF(&uaddr, af);
2079 
2080 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2081 		kt = kt->pfrkt_root;
2082 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2083 		return (-1);
2084 
2085 	if (pidx != NULL)
2086 		idx = *pidx;
2087 	if (counter != NULL && idx >= 0)
2088 		use_counter = 1;
2089 	if (idx < 0)
2090 		idx = 0;
2091 
2092 _next_block:
2093 	ke = pfr_kentry_byidx(kt, idx, af);
2094 	if (ke == NULL) {
2095 		kt->pfrkt_nomatch++;
2096 		return (1);
2097 	}
2098 	pfr_prepare_network(&umask, af, ke->pfrke_net);
2099 	cur = SUNION2PF(&ke->pfrke_sa, af);
2100 	mask = SUNION2PF(&umask, af);
2101 
2102 	if (use_counter) {
2103 		/* is supplied address within block? */
2104 		if (!PF_MATCHA(0, cur, mask, counter, af)) {
2105 			/* no, go to next block in table */
2106 			idx++;
2107 			use_counter = 0;
2108 			goto _next_block;
2109 		}
2110 		PF_ACPY(addr, counter, af);
2111 	} else {
2112 		/* use first address of block */
2113 		PF_ACPY(addr, cur, af);
2114 	}
2115 
2116 	if (!KENTRY_NETWORK(ke)) {
2117 		/* this is a single IP address - no possible nested block */
2118 		PF_ACPY(counter, addr, af);
2119 		*pidx = idx;
2120 		kt->pfrkt_match++;
2121 		return (0);
2122 	}
2123 	for (;;) {
2124 		/* we don't want to use a nested block */
2125 		switch (af) {
2126 		case AF_INET:
2127 			ke2 = (struct pfr_kentry *)rn_match(&uaddr,
2128 			    &kt->pfrkt_ip4->rh);
2129 			break;
2130 		case AF_INET6:
2131 			ke2 = (struct pfr_kentry *)rn_match(&uaddr,
2132 			    &kt->pfrkt_ip6->rh);
2133 			break;
2134 		}
2135 		/* no need to check KENTRY_RNF_ROOT() here */
2136 		if (ke2 == ke) {
2137 			/* lookup return the same block - perfect */
2138 			PF_ACPY(counter, addr, af);
2139 			*pidx = idx;
2140 			kt->pfrkt_match++;
2141 			return (0);
2142 		}
2143 
2144 		/* we need to increase the counter past the nested block */
2145 		pfr_prepare_network(&umask, AF_INET, ke2->pfrke_net);
2146 		PF_POOLMASK(addr, addr, SUNION2PF(&umask, af), &pfr_ffaddr, af);
2147 		PF_AINC(addr, af);
2148 		if (!PF_MATCHA(0, cur, mask, addr, af)) {
2149 			/* ok, we reached the end of our main block */
2150 			/* go to next block in table */
2151 			idx++;
2152 			use_counter = 0;
2153 			goto _next_block;
2154 		}
2155 	}
2156 }
2157 
2158 static struct pfr_kentry *
2159 pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af)
2160 {
2161 	struct pfr_walktree	w;
2162 
2163 	bzero(&w, sizeof(w));
2164 	w.pfrw_op = PFRW_POOL_GET;
2165 	w.pfrw_cnt = idx;
2166 
2167 	switch (af) {
2168 #ifdef INET
2169 	case AF_INET:
2170 		kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
2171 		return (w.pfrw_kentry);
2172 #endif /* INET */
2173 #ifdef INET6
2174 	case AF_INET6:
2175 		kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w);
2176 		return (w.pfrw_kentry);
2177 #endif /* INET6 */
2178 	default:
2179 		return (NULL);
2180 	}
2181 }
2182 
2183 void
2184 pfr_dynaddr_update(struct pfr_ktable *kt, struct pfi_dynaddr *dyn)
2185 {
2186 	struct pfr_walktree	w;
2187 
2188 	bzero(&w, sizeof(w));
2189 	w.pfrw_op = PFRW_DYNADDR_UPDATE;
2190 	w.pfrw_dyn = dyn;
2191 
2192 	dyn->pfid_acnt4 = 0;
2193 	dyn->pfid_acnt6 = 0;
2194 	if (!dyn->pfid_af || dyn->pfid_af == AF_INET)
2195 		kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
2196 	if (!dyn->pfid_af || dyn->pfid_af == AF_INET6)
2197 		kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w);
2198 }
2199