xref: /freebsd/sys/netpfil/pf/pf_table.c (revision 349cc55c9796c4596a5b9904cd3281af295f878f)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright (c) 2002 Cedric Berger
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  *
11  *    - Redistributions of source code must retain the above copyright
12  *      notice, this list of conditions and the following disclaimer.
13  *    - Redistributions in binary form must reproduce the above
14  *      copyright notice, this list of conditions and the following
15  *      disclaimer in the documentation and/or other materials provided
16  *      with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
21  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
22  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
23  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
24  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
25  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
26  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
28  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  *
31  *	$OpenBSD: pf_table.c,v 1.79 2008/10/08 06:24:50 mcbride Exp $
32  */
33 
34 #include <sys/cdefs.h>
35 __FBSDID("$FreeBSD$");
36 
37 #include "opt_inet.h"
38 #include "opt_inet6.h"
39 
40 #include <sys/param.h>
41 #include <sys/kernel.h>
42 #include <sys/lock.h>
43 #include <sys/malloc.h>
44 #include <sys/mbuf.h>
45 #include <sys/mutex.h>
46 #include <sys/refcount.h>
47 #include <sys/socket.h>
48 #include <vm/uma.h>
49 
50 #include <net/if.h>
51 #include <net/vnet.h>
52 #include <net/pfvar.h>
53 
54 #define DPFPRINTF(n, x) if (V_pf_status.debug >= (n)) printf x
55 
56 #define	ACCEPT_FLAGS(flags, oklist)		\
57 	do {					\
58 		if ((flags & ~(oklist)) &	\
59 		    PFR_FLAG_ALLMASK)		\
60 			return (EINVAL);	\
61 	} while (0)
62 
63 #define	FILLIN_SIN(sin, addr)			\
64 	do {					\
65 		(sin).sin_len = sizeof(sin);	\
66 		(sin).sin_family = AF_INET;	\
67 		(sin).sin_addr = (addr);	\
68 	} while (0)
69 
70 #define	FILLIN_SIN6(sin6, addr)			\
71 	do {					\
72 		(sin6).sin6_len = sizeof(sin6);	\
73 		(sin6).sin6_family = AF_INET6;	\
74 		(sin6).sin6_addr = (addr);	\
75 	} while (0)
76 
77 #define	SWAP(type, a1, a2)			\
78 	do {					\
79 		type tmp = a1;			\
80 		a1 = a2;			\
81 		a2 = tmp;			\
82 	} while (0)
83 
84 #define	SUNION2PF(su, af) (((af)==AF_INET) ?	\
85     (struct pf_addr *)&(su)->sin.sin_addr :	\
86     (struct pf_addr *)&(su)->sin6.sin6_addr)
87 
88 #define	AF_BITS(af)		(((af)==AF_INET)?32:128)
89 #define	ADDR_NETWORK(ad)	((ad)->pfra_net < AF_BITS((ad)->pfra_af))
90 #define	KENTRY_NETWORK(ke)	((ke)->pfrke_net < AF_BITS((ke)->pfrke_af))
91 #define	KENTRY_RNF_ROOT(ke) \
92 		((((struct radix_node *)(ke))->rn_flags & RNF_ROOT) != 0)
93 
94 #define	NO_ADDRESSES		(-1)
95 #define	ENQUEUE_UNMARKED_ONLY	(1)
96 #define	INVERT_NEG_FLAG		(1)
97 
98 struct pfr_walktree {
99 	enum pfrw_op {
100 		PFRW_MARK,
101 		PFRW_SWEEP,
102 		PFRW_ENQUEUE,
103 		PFRW_GET_ADDRS,
104 		PFRW_GET_ASTATS,
105 		PFRW_POOL_GET,
106 		PFRW_DYNADDR_UPDATE,
107 		PFRW_COUNTERS
108 	}	 pfrw_op;
109 	union {
110 		struct pfr_addr		*pfrw1_addr;
111 		struct pfr_astats	*pfrw1_astats;
112 		struct pfr_kentryworkq	*pfrw1_workq;
113 		struct pfr_kentry	*pfrw1_kentry;
114 		struct pfi_dynaddr	*pfrw1_dyn;
115 	}	 pfrw_1;
116 	int	 pfrw_free;
117 	int	 pfrw_flags;
118 };
119 #define	pfrw_addr	pfrw_1.pfrw1_addr
120 #define	pfrw_astats	pfrw_1.pfrw1_astats
121 #define	pfrw_workq	pfrw_1.pfrw1_workq
122 #define	pfrw_kentry	pfrw_1.pfrw1_kentry
123 #define	pfrw_dyn	pfrw_1.pfrw1_dyn
124 #define	pfrw_cnt	pfrw_free
125 
126 #define	senderr(e)	do { rv = (e); goto _bad; } while (0)
127 
128 static MALLOC_DEFINE(M_PFTABLE, "pf_table", "pf(4) tables structures");
129 VNET_DEFINE_STATIC(uma_zone_t, pfr_kentry_z);
130 #define	V_pfr_kentry_z		VNET(pfr_kentry_z)
131 VNET_DEFINE_STATIC(uma_zone_t, pfr_kentry_counter_z);
132 #define	V_pfr_kentry_counter_z	VNET(pfr_kentry_counter_z)
133 
134 static struct pf_addr	 pfr_ffaddr = {
135 	.addr32 = { 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff }
136 };
137 
138 static void		 pfr_copyout_astats(struct pfr_astats *,
139 			    const struct pfr_kentry *,
140 			    const struct pfr_walktree *);
141 static void		 pfr_copyout_addr(struct pfr_addr *,
142 			    const struct pfr_kentry *ke);
143 static int		 pfr_validate_addr(struct pfr_addr *);
144 static void		 pfr_enqueue_addrs(struct pfr_ktable *,
145 			    struct pfr_kentryworkq *, int *, int);
146 static void		 pfr_mark_addrs(struct pfr_ktable *);
147 static struct pfr_kentry
148 			*pfr_lookup_addr(struct pfr_ktable *,
149 			    struct pfr_addr *, int);
150 static struct pfr_kentry *pfr_create_kentry(struct pfr_addr *, bool);
151 static void		 pfr_destroy_kentries(struct pfr_kentryworkq *);
152 static void		 pfr_destroy_kentry(struct pfr_kentry *);
153 static void		 pfr_insert_kentries(struct pfr_ktable *,
154 			    struct pfr_kentryworkq *, long);
155 static void		 pfr_remove_kentries(struct pfr_ktable *,
156 			    struct pfr_kentryworkq *);
157 static void		 pfr_clstats_kentries(struct pfr_ktable *,
158 			    struct pfr_kentryworkq *, long, int);
159 static void		 pfr_reset_feedback(struct pfr_addr *, int);
160 static void		 pfr_prepare_network(union sockaddr_union *, int, int);
161 static int		 pfr_route_kentry(struct pfr_ktable *,
162 			    struct pfr_kentry *);
163 static int		 pfr_unroute_kentry(struct pfr_ktable *,
164 			    struct pfr_kentry *);
165 static int		 pfr_walktree(struct radix_node *, void *);
166 static int		 pfr_validate_table(struct pfr_table *, int, int);
167 static int		 pfr_fix_anchor(char *);
168 static void		 pfr_commit_ktable(struct pfr_ktable *, long);
169 static void		 pfr_insert_ktables(struct pfr_ktableworkq *);
170 static void		 pfr_insert_ktable(struct pfr_ktable *);
171 static void		 pfr_setflags_ktables(struct pfr_ktableworkq *);
172 static void		 pfr_setflags_ktable(struct pfr_ktable *, int);
173 static void		 pfr_clstats_ktables(struct pfr_ktableworkq *, long,
174 			    int);
175 static void		 pfr_clstats_ktable(struct pfr_ktable *, long, int);
176 static struct pfr_ktable
177 			*pfr_create_ktable(struct pfr_table *, long, int);
178 static void		 pfr_destroy_ktables(struct pfr_ktableworkq *, int);
179 static void		 pfr_destroy_ktable(struct pfr_ktable *, int);
180 static int		 pfr_ktable_compare(struct pfr_ktable *,
181 			    struct pfr_ktable *);
182 static struct pfr_ktable
183 			*pfr_lookup_table(struct pfr_table *);
184 static void		 pfr_clean_node_mask(struct pfr_ktable *,
185 			    struct pfr_kentryworkq *);
186 static int		 pfr_skip_table(struct pfr_table *,
187 			    struct pfr_ktable *, int);
188 static struct pfr_kentry
189 			*pfr_kentry_byidx(struct pfr_ktable *, int, int);
190 
191 static RB_PROTOTYPE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
192 static RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
193 
194 VNET_DEFINE_STATIC(struct pfr_ktablehead, pfr_ktables);
195 #define	V_pfr_ktables	VNET(pfr_ktables)
196 
197 VNET_DEFINE_STATIC(struct pfr_table, pfr_nulltable);
198 #define	V_pfr_nulltable	VNET(pfr_nulltable)
199 
200 VNET_DEFINE_STATIC(int, pfr_ktable_cnt);
201 #define V_pfr_ktable_cnt	VNET(pfr_ktable_cnt)
202 
203 void
204 pfr_initialize(void)
205 {
206 
207 	V_pfr_kentry_counter_z = uma_zcreate("pf table entry counters",
208 	    PFR_NUM_COUNTERS * sizeof(uint64_t), NULL, NULL, NULL, NULL,
209 	    UMA_ALIGN_PTR, UMA_ZONE_PCPU);
210 	V_pfr_kentry_z = uma_zcreate("pf table entries",
211 	    sizeof(struct pfr_kentry), NULL, NULL, NULL, NULL, UMA_ALIGN_PTR,
212 	    0);
213 	uma_zone_set_max(V_pfr_kentry_z, PFR_KENTRY_HIWAT);
214 	V_pf_limits[PF_LIMIT_TABLE_ENTRIES].zone = V_pfr_kentry_z;
215 	V_pf_limits[PF_LIMIT_TABLE_ENTRIES].limit = PFR_KENTRY_HIWAT;
216 }
217 
218 void
219 pfr_cleanup(void)
220 {
221 
222 	uma_zdestroy(V_pfr_kentry_z);
223 	uma_zdestroy(V_pfr_kentry_counter_z);
224 }
225 
226 int
227 pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags)
228 {
229 	struct pfr_ktable	*kt;
230 	struct pfr_kentryworkq	 workq;
231 
232 	PF_RULES_WASSERT();
233 
234 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
235 	if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
236 		return (EINVAL);
237 	kt = pfr_lookup_table(tbl);
238 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
239 		return (ESRCH);
240 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
241 		return (EPERM);
242 	pfr_enqueue_addrs(kt, &workq, ndel, 0);
243 
244 	if (!(flags & PFR_FLAG_DUMMY)) {
245 		pfr_remove_kentries(kt, &workq);
246 		KASSERT(kt->pfrkt_cnt == 0, ("%s: non-null pfrkt_cnt", __func__));
247 	}
248 	return (0);
249 }
250 
251 int
252 pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
253     int *nadd, int flags)
254 {
255 	struct pfr_ktable	*kt, *tmpkt;
256 	struct pfr_kentryworkq	 workq;
257 	struct pfr_kentry	*p, *q;
258 	struct pfr_addr		*ad;
259 	int			 i, rv, xadd = 0;
260 	long			 tzero = time_second;
261 
262 	PF_RULES_WASSERT();
263 
264 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
265 	if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
266 		return (EINVAL);
267 	kt = pfr_lookup_table(tbl);
268 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
269 		return (ESRCH);
270 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
271 		return (EPERM);
272 	tmpkt = pfr_create_ktable(&V_pfr_nulltable, 0, 0);
273 	if (tmpkt == NULL)
274 		return (ENOMEM);
275 	SLIST_INIT(&workq);
276 	for (i = 0, ad = addr; i < size; i++, ad++) {
277 		if (pfr_validate_addr(ad))
278 			senderr(EINVAL);
279 		p = pfr_lookup_addr(kt, ad, 1);
280 		q = pfr_lookup_addr(tmpkt, ad, 1);
281 		if (flags & PFR_FLAG_FEEDBACK) {
282 			if (q != NULL)
283 				ad->pfra_fback = PFR_FB_DUPLICATE;
284 			else if (p == NULL)
285 				ad->pfra_fback = PFR_FB_ADDED;
286 			else if (p->pfrke_not != ad->pfra_not)
287 				ad->pfra_fback = PFR_FB_CONFLICT;
288 			else
289 				ad->pfra_fback = PFR_FB_NONE;
290 		}
291 		if (p == NULL && q == NULL) {
292 			p = pfr_create_kentry(ad,
293 			    (kt->pfrkt_flags & PFR_TFLAG_COUNTERS) != 0);
294 			if (p == NULL)
295 				senderr(ENOMEM);
296 			if (pfr_route_kentry(tmpkt, p)) {
297 				pfr_destroy_kentry(p);
298 				ad->pfra_fback = PFR_FB_NONE;
299 			} else {
300 				SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
301 				xadd++;
302 			}
303 		}
304 	}
305 	pfr_clean_node_mask(tmpkt, &workq);
306 	if (!(flags & PFR_FLAG_DUMMY))
307 		pfr_insert_kentries(kt, &workq, tzero);
308 	else
309 		pfr_destroy_kentries(&workq);
310 	if (nadd != NULL)
311 		*nadd = xadd;
312 	pfr_destroy_ktable(tmpkt, 0);
313 	return (0);
314 _bad:
315 	pfr_clean_node_mask(tmpkt, &workq);
316 	pfr_destroy_kentries(&workq);
317 	if (flags & PFR_FLAG_FEEDBACK)
318 		pfr_reset_feedback(addr, size);
319 	pfr_destroy_ktable(tmpkt, 0);
320 	return (rv);
321 }
322 
323 int
324 pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
325     int *ndel, int flags)
326 {
327 	struct pfr_ktable	*kt;
328 	struct pfr_kentryworkq	 workq;
329 	struct pfr_kentry	*p;
330 	struct pfr_addr		*ad;
331 	int			 i, rv, xdel = 0, log = 1;
332 
333 	PF_RULES_WASSERT();
334 
335 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
336 	if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
337 		return (EINVAL);
338 	kt = pfr_lookup_table(tbl);
339 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
340 		return (ESRCH);
341 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
342 		return (EPERM);
343 	/*
344 	 * there are two algorithms to choose from here.
345 	 * with:
346 	 *   n: number of addresses to delete
347 	 *   N: number of addresses in the table
348 	 *
349 	 * one is O(N) and is better for large 'n'
350 	 * one is O(n*LOG(N)) and is better for small 'n'
351 	 *
352 	 * following code try to decide which one is best.
353 	 */
354 	for (i = kt->pfrkt_cnt; i > 0; i >>= 1)
355 		log++;
356 	if (size > kt->pfrkt_cnt/log) {
357 		/* full table scan */
358 		pfr_mark_addrs(kt);
359 	} else {
360 		/* iterate over addresses to delete */
361 		for (i = 0, ad = addr; i < size; i++, ad++) {
362 			if (pfr_validate_addr(ad))
363 				return (EINVAL);
364 			p = pfr_lookup_addr(kt, ad, 1);
365 			if (p != NULL)
366 				p->pfrke_mark = 0;
367 		}
368 	}
369 	SLIST_INIT(&workq);
370 	for (i = 0, ad = addr; i < size; i++, ad++) {
371 		if (pfr_validate_addr(ad))
372 			senderr(EINVAL);
373 		p = pfr_lookup_addr(kt, ad, 1);
374 		if (flags & PFR_FLAG_FEEDBACK) {
375 			if (p == NULL)
376 				ad->pfra_fback = PFR_FB_NONE;
377 			else if (p->pfrke_not != ad->pfra_not)
378 				ad->pfra_fback = PFR_FB_CONFLICT;
379 			else if (p->pfrke_mark)
380 				ad->pfra_fback = PFR_FB_DUPLICATE;
381 			else
382 				ad->pfra_fback = PFR_FB_DELETED;
383 		}
384 		if (p != NULL && p->pfrke_not == ad->pfra_not &&
385 		    !p->pfrke_mark) {
386 			p->pfrke_mark = 1;
387 			SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
388 			xdel++;
389 		}
390 	}
391 	if (!(flags & PFR_FLAG_DUMMY))
392 		pfr_remove_kentries(kt, &workq);
393 	if (ndel != NULL)
394 		*ndel = xdel;
395 	return (0);
396 _bad:
397 	if (flags & PFR_FLAG_FEEDBACK)
398 		pfr_reset_feedback(addr, size);
399 	return (rv);
400 }
401 
402 int
403 pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
404     int *size2, int *nadd, int *ndel, int *nchange, int flags,
405     u_int32_t ignore_pfrt_flags)
406 {
407 	struct pfr_ktable	*kt, *tmpkt;
408 	struct pfr_kentryworkq	 addq, delq, changeq;
409 	struct pfr_kentry	*p, *q;
410 	struct pfr_addr		 ad;
411 	int			 i, rv, xadd = 0, xdel = 0, xchange = 0;
412 	long			 tzero = time_second;
413 
414 	PF_RULES_WASSERT();
415 
416 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
417 	if (pfr_validate_table(tbl, ignore_pfrt_flags, flags &
418 	    PFR_FLAG_USERIOCTL))
419 		return (EINVAL);
420 	kt = pfr_lookup_table(tbl);
421 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
422 		return (ESRCH);
423 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
424 		return (EPERM);
425 	tmpkt = pfr_create_ktable(&V_pfr_nulltable, 0, 0);
426 	if (tmpkt == NULL)
427 		return (ENOMEM);
428 	pfr_mark_addrs(kt);
429 	SLIST_INIT(&addq);
430 	SLIST_INIT(&delq);
431 	SLIST_INIT(&changeq);
432 	for (i = 0; i < size; i++) {
433 		/*
434 		 * XXXGL: undertand pf_if usage of this function
435 		 * and make ad a moving pointer
436 		 */
437 		bcopy(addr + i, &ad, sizeof(ad));
438 		if (pfr_validate_addr(&ad))
439 			senderr(EINVAL);
440 		ad.pfra_fback = PFR_FB_NONE;
441 		p = pfr_lookup_addr(kt, &ad, 1);
442 		if (p != NULL) {
443 			if (p->pfrke_mark) {
444 				ad.pfra_fback = PFR_FB_DUPLICATE;
445 				goto _skip;
446 			}
447 			p->pfrke_mark = 1;
448 			if (p->pfrke_not != ad.pfra_not) {
449 				SLIST_INSERT_HEAD(&changeq, p, pfrke_workq);
450 				ad.pfra_fback = PFR_FB_CHANGED;
451 				xchange++;
452 			}
453 		} else {
454 			q = pfr_lookup_addr(tmpkt, &ad, 1);
455 			if (q != NULL) {
456 				ad.pfra_fback = PFR_FB_DUPLICATE;
457 				goto _skip;
458 			}
459 			p = pfr_create_kentry(&ad,
460 			    (kt->pfrkt_flags & PFR_TFLAG_COUNTERS) != 0);
461 			if (p == NULL)
462 				senderr(ENOMEM);
463 			if (pfr_route_kentry(tmpkt, p)) {
464 				pfr_destroy_kentry(p);
465 				ad.pfra_fback = PFR_FB_NONE;
466 			} else {
467 				SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
468 				ad.pfra_fback = PFR_FB_ADDED;
469 				xadd++;
470 			}
471 		}
472 _skip:
473 		if (flags & PFR_FLAG_FEEDBACK)
474 			bcopy(&ad, addr + i, sizeof(ad));
475 	}
476 	pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY);
477 	if ((flags & PFR_FLAG_FEEDBACK) && *size2) {
478 		if (*size2 < size+xdel) {
479 			*size2 = size+xdel;
480 			senderr(0);
481 		}
482 		i = 0;
483 		SLIST_FOREACH(p, &delq, pfrke_workq) {
484 			pfr_copyout_addr(&ad, p);
485 			ad.pfra_fback = PFR_FB_DELETED;
486 			bcopy(&ad, addr + size + i, sizeof(ad));
487 			i++;
488 		}
489 	}
490 	pfr_clean_node_mask(tmpkt, &addq);
491 	if (!(flags & PFR_FLAG_DUMMY)) {
492 		pfr_insert_kentries(kt, &addq, tzero);
493 		pfr_remove_kentries(kt, &delq);
494 		pfr_clstats_kentries(kt, &changeq, tzero, INVERT_NEG_FLAG);
495 	} else
496 		pfr_destroy_kentries(&addq);
497 	if (nadd != NULL)
498 		*nadd = xadd;
499 	if (ndel != NULL)
500 		*ndel = xdel;
501 	if (nchange != NULL)
502 		*nchange = xchange;
503 	if ((flags & PFR_FLAG_FEEDBACK) && size2)
504 		*size2 = size+xdel;
505 	pfr_destroy_ktable(tmpkt, 0);
506 	return (0);
507 _bad:
508 	pfr_clean_node_mask(tmpkt, &addq);
509 	pfr_destroy_kentries(&addq);
510 	if (flags & PFR_FLAG_FEEDBACK)
511 		pfr_reset_feedback(addr, size);
512 	pfr_destroy_ktable(tmpkt, 0);
513 	return (rv);
514 }
515 
516 int
517 pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
518 	int *nmatch, int flags)
519 {
520 	struct pfr_ktable	*kt;
521 	struct pfr_kentry	*p;
522 	struct pfr_addr		*ad;
523 	int			 i, xmatch = 0;
524 
525 	PF_RULES_RASSERT();
526 
527 	ACCEPT_FLAGS(flags, PFR_FLAG_REPLACE);
528 	if (pfr_validate_table(tbl, 0, 0))
529 		return (EINVAL);
530 	kt = pfr_lookup_table(tbl);
531 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
532 		return (ESRCH);
533 
534 	for (i = 0, ad = addr; i < size; i++, ad++) {
535 		if (pfr_validate_addr(ad))
536 			return (EINVAL);
537 		if (ADDR_NETWORK(ad))
538 			return (EINVAL);
539 		p = pfr_lookup_addr(kt, ad, 0);
540 		if (flags & PFR_FLAG_REPLACE)
541 			pfr_copyout_addr(ad, p);
542 		ad->pfra_fback = (p == NULL) ? PFR_FB_NONE :
543 		    (p->pfrke_not ? PFR_FB_NOTMATCH : PFR_FB_MATCH);
544 		if (p != NULL && !p->pfrke_not)
545 			xmatch++;
546 	}
547 	if (nmatch != NULL)
548 		*nmatch = xmatch;
549 	return (0);
550 }
551 
552 int
553 pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size,
554 	int flags)
555 {
556 	struct pfr_ktable	*kt;
557 	struct pfr_walktree	 w;
558 	int			 rv;
559 
560 	PF_RULES_RASSERT();
561 
562 	ACCEPT_FLAGS(flags, 0);
563 	if (pfr_validate_table(tbl, 0, 0))
564 		return (EINVAL);
565 	kt = pfr_lookup_table(tbl);
566 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
567 		return (ESRCH);
568 	if (kt->pfrkt_cnt > *size) {
569 		*size = kt->pfrkt_cnt;
570 		return (0);
571 	}
572 
573 	bzero(&w, sizeof(w));
574 	w.pfrw_op = PFRW_GET_ADDRS;
575 	w.pfrw_addr = addr;
576 	w.pfrw_free = kt->pfrkt_cnt;
577 	rv = kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
578 	if (!rv)
579 		rv = kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh,
580 		    pfr_walktree, &w);
581 	if (rv)
582 		return (rv);
583 
584 	KASSERT(w.pfrw_free == 0, ("%s: corruption detected (%d)", __func__,
585 	    w.pfrw_free));
586 
587 	*size = kt->pfrkt_cnt;
588 	return (0);
589 }
590 
591 int
592 pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size,
593 	int flags)
594 {
595 	struct pfr_ktable	*kt;
596 	struct pfr_walktree	 w;
597 	struct pfr_kentryworkq	 workq;
598 	int			 rv;
599 	long			 tzero = time_second;
600 
601 	PF_RULES_RASSERT();
602 
603 	/* XXX PFR_FLAG_CLSTATS disabled */
604 	ACCEPT_FLAGS(flags, 0);
605 	if (pfr_validate_table(tbl, 0, 0))
606 		return (EINVAL);
607 	kt = pfr_lookup_table(tbl);
608 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
609 		return (ESRCH);
610 	if (kt->pfrkt_cnt > *size) {
611 		*size = kt->pfrkt_cnt;
612 		return (0);
613 	}
614 
615 	bzero(&w, sizeof(w));
616 	w.pfrw_op = PFRW_GET_ASTATS;
617 	w.pfrw_astats = addr;
618 	w.pfrw_free = kt->pfrkt_cnt;
619 	/*
620 	 * Flags below are for backward compatibility. It was possible to have
621 	 * a table without per-entry counters. Now they are always allocated,
622 	 * we just discard data when reading it if table is not configured to
623 	 * have counters.
624 	 */
625 	w.pfrw_flags = kt->pfrkt_flags;
626 	rv = kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
627 	if (!rv)
628 		rv = kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh,
629 		    pfr_walktree, &w);
630 	if (!rv && (flags & PFR_FLAG_CLSTATS)) {
631 		pfr_enqueue_addrs(kt, &workq, NULL, 0);
632 		pfr_clstats_kentries(kt, &workq, tzero, 0);
633 	}
634 	if (rv)
635 		return (rv);
636 
637 	if (w.pfrw_free) {
638 		printf("pfr_get_astats: corruption detected (%d).\n",
639 		    w.pfrw_free);
640 		return (ENOTTY);
641 	}
642 	*size = kt->pfrkt_cnt;
643 	return (0);
644 }
645 
646 int
647 pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size,
648     int *nzero, int flags)
649 {
650 	struct pfr_ktable	*kt;
651 	struct pfr_kentryworkq	 workq;
652 	struct pfr_kentry	*p;
653 	struct pfr_addr		*ad;
654 	int			 i, rv, xzero = 0;
655 
656 	PF_RULES_WASSERT();
657 
658 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
659 	if (pfr_validate_table(tbl, 0, 0))
660 		return (EINVAL);
661 	kt = pfr_lookup_table(tbl);
662 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
663 		return (ESRCH);
664 	SLIST_INIT(&workq);
665 	for (i = 0, ad = addr; i < size; i++, ad++) {
666 		if (pfr_validate_addr(ad))
667 			senderr(EINVAL);
668 		p = pfr_lookup_addr(kt, ad, 1);
669 		if (flags & PFR_FLAG_FEEDBACK) {
670 			ad->pfra_fback = (p != NULL) ?
671 			    PFR_FB_CLEARED : PFR_FB_NONE;
672 		}
673 		if (p != NULL) {
674 			SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
675 			xzero++;
676 		}
677 	}
678 
679 	if (!(flags & PFR_FLAG_DUMMY))
680 		pfr_clstats_kentries(kt, &workq, 0, 0);
681 	if (nzero != NULL)
682 		*nzero = xzero;
683 	return (0);
684 _bad:
685 	if (flags & PFR_FLAG_FEEDBACK)
686 		pfr_reset_feedback(addr, size);
687 	return (rv);
688 }
689 
690 static int
691 pfr_validate_addr(struct pfr_addr *ad)
692 {
693 	int i;
694 
695 	switch (ad->pfra_af) {
696 #ifdef INET
697 	case AF_INET:
698 		if (ad->pfra_net > 32)
699 			return (-1);
700 		break;
701 #endif /* INET */
702 #ifdef INET6
703 	case AF_INET6:
704 		if (ad->pfra_net > 128)
705 			return (-1);
706 		break;
707 #endif /* INET6 */
708 	default:
709 		return (-1);
710 	}
711 	if (ad->pfra_net < 128 &&
712 		(((caddr_t)ad)[ad->pfra_net/8] & (0xFF >> (ad->pfra_net%8))))
713 			return (-1);
714 	for (i = (ad->pfra_net+7)/8; i < sizeof(ad->pfra_u); i++)
715 		if (((caddr_t)ad)[i])
716 			return (-1);
717 	if (ad->pfra_not && ad->pfra_not != 1)
718 		return (-1);
719 	if (ad->pfra_fback)
720 		return (-1);
721 	return (0);
722 }
723 
724 static void
725 pfr_enqueue_addrs(struct pfr_ktable *kt, struct pfr_kentryworkq *workq,
726 	int *naddr, int sweep)
727 {
728 	struct pfr_walktree	w;
729 
730 	SLIST_INIT(workq);
731 	bzero(&w, sizeof(w));
732 	w.pfrw_op = sweep ? PFRW_SWEEP : PFRW_ENQUEUE;
733 	w.pfrw_workq = workq;
734 	if (kt->pfrkt_ip4 != NULL)
735 		if (kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh,
736 		    pfr_walktree, &w))
737 			printf("pfr_enqueue_addrs: IPv4 walktree failed.\n");
738 	if (kt->pfrkt_ip6 != NULL)
739 		if (kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh,
740 		    pfr_walktree, &w))
741 			printf("pfr_enqueue_addrs: IPv6 walktree failed.\n");
742 	if (naddr != NULL)
743 		*naddr = w.pfrw_cnt;
744 }
745 
746 static void
747 pfr_mark_addrs(struct pfr_ktable *kt)
748 {
749 	struct pfr_walktree	w;
750 
751 	bzero(&w, sizeof(w));
752 	w.pfrw_op = PFRW_MARK;
753 	if (kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w))
754 		printf("pfr_mark_addrs: IPv4 walktree failed.\n");
755 	if (kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w))
756 		printf("pfr_mark_addrs: IPv6 walktree failed.\n");
757 }
758 
759 static struct pfr_kentry *
760 pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact)
761 {
762 	union sockaddr_union	 sa, mask;
763 	struct radix_head	*head = NULL;
764 	struct pfr_kentry	*ke;
765 
766 	PF_RULES_ASSERT();
767 
768 	bzero(&sa, sizeof(sa));
769 	if (ad->pfra_af == AF_INET) {
770 		FILLIN_SIN(sa.sin, ad->pfra_ip4addr);
771 		head = &kt->pfrkt_ip4->rh;
772 	} else if ( ad->pfra_af == AF_INET6 ) {
773 		FILLIN_SIN6(sa.sin6, ad->pfra_ip6addr);
774 		head = &kt->pfrkt_ip6->rh;
775 	}
776 	if (ADDR_NETWORK(ad)) {
777 		pfr_prepare_network(&mask, ad->pfra_af, ad->pfra_net);
778 		ke = (struct pfr_kentry *)rn_lookup(&sa, &mask, head);
779 		if (ke && KENTRY_RNF_ROOT(ke))
780 			ke = NULL;
781 	} else {
782 		ke = (struct pfr_kentry *)rn_match(&sa, head);
783 		if (ke && KENTRY_RNF_ROOT(ke))
784 			ke = NULL;
785 		if (exact && ke && KENTRY_NETWORK(ke))
786 			ke = NULL;
787 	}
788 	return (ke);
789 }
790 
791 static struct pfr_kentry *
792 pfr_create_kentry(struct pfr_addr *ad, bool counters)
793 {
794 	struct pfr_kentry	*ke;
795 	counter_u64_t		 c;
796 
797 	ke = uma_zalloc(V_pfr_kentry_z, M_NOWAIT | M_ZERO);
798 	if (ke == NULL)
799 		return (NULL);
800 
801 	if (ad->pfra_af == AF_INET)
802 		FILLIN_SIN(ke->pfrke_sa.sin, ad->pfra_ip4addr);
803 	else if (ad->pfra_af == AF_INET6)
804 		FILLIN_SIN6(ke->pfrke_sa.sin6, ad->pfra_ip6addr);
805 	ke->pfrke_af = ad->pfra_af;
806 	ke->pfrke_net = ad->pfra_net;
807 	ke->pfrke_not = ad->pfra_not;
808 	ke->pfrke_counters.pfrkc_tzero = 0;
809 	if (counters) {
810 		c = uma_zalloc_pcpu(V_pfr_kentry_counter_z, M_NOWAIT | M_ZERO);
811 		if (c == NULL) {
812 			pfr_destroy_kentry(ke);
813 			return (NULL);
814 		}
815 		ke->pfrke_counters.pfrkc_counters = c;
816 	}
817 	return (ke);
818 }
819 
820 static void
821 pfr_destroy_kentries(struct pfr_kentryworkq *workq)
822 {
823 	struct pfr_kentry	*p, *q;
824 
825 	for (p = SLIST_FIRST(workq); p != NULL; p = q) {
826 		q = SLIST_NEXT(p, pfrke_workq);
827 		pfr_destroy_kentry(p);
828 	}
829 }
830 
831 static void
832 pfr_destroy_kentry(struct pfr_kentry *ke)
833 {
834 	counter_u64_t c;
835 
836 	if ((c = ke->pfrke_counters.pfrkc_counters) != NULL)
837 		uma_zfree_pcpu(V_pfr_kentry_counter_z, c);
838 	uma_zfree(V_pfr_kentry_z, ke);
839 }
840 
841 static void
842 pfr_insert_kentries(struct pfr_ktable *kt,
843     struct pfr_kentryworkq *workq, long tzero)
844 {
845 	struct pfr_kentry	*p;
846 	int			 rv, n = 0;
847 
848 	SLIST_FOREACH(p, workq, pfrke_workq) {
849 		rv = pfr_route_kentry(kt, p);
850 		if (rv) {
851 			printf("pfr_insert_kentries: cannot route entry "
852 			    "(code=%d).\n", rv);
853 			break;
854 		}
855 		p->pfrke_counters.pfrkc_tzero = tzero;
856 		n++;
857 	}
858 	kt->pfrkt_cnt += n;
859 }
860 
861 int
862 pfr_insert_kentry(struct pfr_ktable *kt, struct pfr_addr *ad, long tzero)
863 {
864 	struct pfr_kentry	*p;
865 	int			 rv;
866 
867 	p = pfr_lookup_addr(kt, ad, 1);
868 	if (p != NULL)
869 		return (0);
870 	p = pfr_create_kentry(ad, (kt->pfrkt_flags & PFR_TFLAG_COUNTERS) != 0);
871 	if (p == NULL)
872 		return (ENOMEM);
873 
874 	rv = pfr_route_kentry(kt, p);
875 	if (rv)
876 		return (rv);
877 
878 	p->pfrke_counters.pfrkc_tzero = tzero;
879 	kt->pfrkt_cnt++;
880 
881 	return (0);
882 }
883 
884 static void
885 pfr_remove_kentries(struct pfr_ktable *kt,
886     struct pfr_kentryworkq *workq)
887 {
888 	struct pfr_kentry	*p;
889 	int			 n = 0;
890 
891 	SLIST_FOREACH(p, workq, pfrke_workq) {
892 		pfr_unroute_kentry(kt, p);
893 		n++;
894 	}
895 	kt->pfrkt_cnt -= n;
896 	pfr_destroy_kentries(workq);
897 }
898 
899 static void
900 pfr_clean_node_mask(struct pfr_ktable *kt,
901     struct pfr_kentryworkq *workq)
902 {
903 	struct pfr_kentry	*p;
904 
905 	SLIST_FOREACH(p, workq, pfrke_workq)
906 		pfr_unroute_kentry(kt, p);
907 }
908 
909 static void
910 pfr_clstats_kentries(struct pfr_ktable *kt, struct pfr_kentryworkq *workq,
911     long tzero, int negchange)
912 {
913 	struct pfr_kentry	*p;
914 	int			 i;
915 
916 	SLIST_FOREACH(p, workq, pfrke_workq) {
917 		if (negchange)
918 			p->pfrke_not = !p->pfrke_not;
919 		if ((kt->pfrkt_flags & PFR_TFLAG_COUNTERS) != 0)
920 			for (i = 0; i < PFR_NUM_COUNTERS; i++)
921 				counter_u64_zero(
922 				    p->pfrke_counters.pfrkc_counters + i);
923 		p->pfrke_counters.pfrkc_tzero = tzero;
924 	}
925 }
926 
927 static void
928 pfr_reset_feedback(struct pfr_addr *addr, int size)
929 {
930 	struct pfr_addr	*ad;
931 	int		i;
932 
933 	for (i = 0, ad = addr; i < size; i++, ad++)
934 		ad->pfra_fback = PFR_FB_NONE;
935 }
936 
937 static void
938 pfr_prepare_network(union sockaddr_union *sa, int af, int net)
939 {
940 	int	i;
941 
942 	bzero(sa, sizeof(*sa));
943 	if (af == AF_INET) {
944 		sa->sin.sin_len = sizeof(sa->sin);
945 		sa->sin.sin_family = AF_INET;
946 		sa->sin.sin_addr.s_addr = net ? htonl(-1 << (32-net)) : 0;
947 	} else if (af == AF_INET6) {
948 		sa->sin6.sin6_len = sizeof(sa->sin6);
949 		sa->sin6.sin6_family = AF_INET6;
950 		for (i = 0; i < 4; i++) {
951 			if (net <= 32) {
952 				sa->sin6.sin6_addr.s6_addr32[i] =
953 				    net ? htonl(-1 << (32-net)) : 0;
954 				break;
955 			}
956 			sa->sin6.sin6_addr.s6_addr32[i] = 0xFFFFFFFF;
957 			net -= 32;
958 		}
959 	}
960 }
961 
962 static int
963 pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
964 {
965 	union sockaddr_union	 mask;
966 	struct radix_node	*rn;
967 	struct radix_head	*head = NULL;
968 
969 	PF_RULES_WASSERT();
970 
971 	bzero(ke->pfrke_node, sizeof(ke->pfrke_node));
972 	if (ke->pfrke_af == AF_INET)
973 		head = &kt->pfrkt_ip4->rh;
974 	else if (ke->pfrke_af == AF_INET6)
975 		head = &kt->pfrkt_ip6->rh;
976 
977 	if (KENTRY_NETWORK(ke)) {
978 		pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
979 		rn = rn_addroute(&ke->pfrke_sa, &mask, head, ke->pfrke_node);
980 	} else
981 		rn = rn_addroute(&ke->pfrke_sa, NULL, head, ke->pfrke_node);
982 
983 	return (rn == NULL ? -1 : 0);
984 }
985 
986 static int
987 pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
988 {
989 	union sockaddr_union	 mask;
990 	struct radix_node	*rn;
991 	struct radix_head	*head = NULL;
992 
993 	if (ke->pfrke_af == AF_INET)
994 		head = &kt->pfrkt_ip4->rh;
995 	else if (ke->pfrke_af == AF_INET6)
996 		head = &kt->pfrkt_ip6->rh;
997 
998 	if (KENTRY_NETWORK(ke)) {
999 		pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
1000 		rn = rn_delete(&ke->pfrke_sa, &mask, head);
1001 	} else
1002 		rn = rn_delete(&ke->pfrke_sa, NULL, head);
1003 
1004 	if (rn == NULL) {
1005 		printf("pfr_unroute_kentry: delete failed.\n");
1006 		return (-1);
1007 	}
1008 	return (0);
1009 }
1010 
1011 static void
1012 pfr_copyout_addr(struct pfr_addr *ad, const struct pfr_kentry *ke)
1013 {
1014 	bzero(ad, sizeof(*ad));
1015 	if (ke == NULL)
1016 		return;
1017 	ad->pfra_af = ke->pfrke_af;
1018 	ad->pfra_net = ke->pfrke_net;
1019 	ad->pfra_not = ke->pfrke_not;
1020 	if (ad->pfra_af == AF_INET)
1021 		ad->pfra_ip4addr = ke->pfrke_sa.sin.sin_addr;
1022 	else if (ad->pfra_af == AF_INET6)
1023 		ad->pfra_ip6addr = ke->pfrke_sa.sin6.sin6_addr;
1024 }
1025 
1026 static void
1027 pfr_copyout_astats(struct pfr_astats *as, const struct pfr_kentry *ke,
1028     const struct pfr_walktree *w)
1029 {
1030 	int dir, op;
1031 	const struct pfr_kcounters *kc = &ke->pfrke_counters;
1032 
1033 	bzero(as, sizeof(*as));
1034 	pfr_copyout_addr(&as->pfras_a, ke);
1035 	as->pfras_tzero = kc->pfrkc_tzero;
1036 
1037 	if (! (w->pfrw_flags & PFR_TFLAG_COUNTERS) ||
1038 	    kc->pfrkc_counters == NULL) {
1039 		bzero(as->pfras_packets, sizeof(as->pfras_packets));
1040 		bzero(as->pfras_bytes, sizeof(as->pfras_bytes));
1041 		as->pfras_a.pfra_fback = PFR_FB_NOCOUNT;
1042 		return;
1043 	}
1044 
1045 	for (dir = 0; dir < PFR_DIR_MAX; dir++) {
1046 		for (op = 0; op < PFR_OP_ADDR_MAX; op ++) {
1047 			as->pfras_packets[dir][op] = counter_u64_fetch(
1048 			    pfr_kentry_counter(kc, dir, op, PFR_TYPE_PACKETS));
1049 			as->pfras_bytes[dir][op] = counter_u64_fetch(
1050 			    pfr_kentry_counter(kc, dir, op, PFR_TYPE_BYTES));
1051 		}
1052 	}
1053 }
1054 
1055 static int
1056 pfr_walktree(struct radix_node *rn, void *arg)
1057 {
1058 	struct pfr_kentry	*ke = (struct pfr_kentry *)rn;
1059 	struct pfr_walktree	*w = arg;
1060 
1061 	switch (w->pfrw_op) {
1062 	case PFRW_MARK:
1063 		ke->pfrke_mark = 0;
1064 		break;
1065 	case PFRW_SWEEP:
1066 		if (ke->pfrke_mark)
1067 			break;
1068 		/* FALLTHROUGH */
1069 	case PFRW_ENQUEUE:
1070 		SLIST_INSERT_HEAD(w->pfrw_workq, ke, pfrke_workq);
1071 		w->pfrw_cnt++;
1072 		break;
1073 	case PFRW_GET_ADDRS:
1074 		if (w->pfrw_free-- > 0) {
1075 			pfr_copyout_addr(w->pfrw_addr, ke);
1076 			w->pfrw_addr++;
1077 		}
1078 		break;
1079 	case PFRW_GET_ASTATS:
1080 		if (w->pfrw_free-- > 0) {
1081 			struct pfr_astats as;
1082 
1083 			pfr_copyout_astats(&as, ke, w);
1084 
1085 			bcopy(&as, w->pfrw_astats, sizeof(as));
1086 			w->pfrw_astats++;
1087 		}
1088 		break;
1089 	case PFRW_POOL_GET:
1090 		if (ke->pfrke_not)
1091 			break; /* negative entries are ignored */
1092 		if (!w->pfrw_cnt--) {
1093 			w->pfrw_kentry = ke;
1094 			return (1); /* finish search */
1095 		}
1096 		break;
1097 	case PFRW_DYNADDR_UPDATE:
1098 	    {
1099 		union sockaddr_union	pfr_mask;
1100 
1101 		if (ke->pfrke_af == AF_INET) {
1102 			if (w->pfrw_dyn->pfid_acnt4++ > 0)
1103 				break;
1104 			pfr_prepare_network(&pfr_mask, AF_INET, ke->pfrke_net);
1105 			w->pfrw_dyn->pfid_addr4 = *SUNION2PF(&ke->pfrke_sa,
1106 			    AF_INET);
1107 			w->pfrw_dyn->pfid_mask4 = *SUNION2PF(&pfr_mask,
1108 			    AF_INET);
1109 		} else if (ke->pfrke_af == AF_INET6){
1110 			if (w->pfrw_dyn->pfid_acnt6++ > 0)
1111 				break;
1112 			pfr_prepare_network(&pfr_mask, AF_INET6, ke->pfrke_net);
1113 			w->pfrw_dyn->pfid_addr6 = *SUNION2PF(&ke->pfrke_sa,
1114 			    AF_INET6);
1115 			w->pfrw_dyn->pfid_mask6 = *SUNION2PF(&pfr_mask,
1116 			    AF_INET6);
1117 		}
1118 		break;
1119 	    }
1120 	case PFRW_COUNTERS:
1121 	    {
1122 		if (w->pfrw_flags & PFR_TFLAG_COUNTERS) {
1123 			if (ke->pfrke_counters.pfrkc_counters != NULL)
1124 				break;
1125 			ke->pfrke_counters.pfrkc_counters =
1126 			    uma_zalloc_pcpu(V_pfr_kentry_counter_z,
1127 			    M_NOWAIT | M_ZERO);
1128 		} else {
1129 			uma_zfree_pcpu(V_pfr_kentry_counter_z,
1130 			    ke->pfrke_counters.pfrkc_counters);
1131 			ke->pfrke_counters.pfrkc_counters = NULL;
1132 		}
1133 		break;
1134 	    }
1135 	}
1136 	return (0);
1137 }
1138 
1139 int
1140 pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags)
1141 {
1142 	struct pfr_ktableworkq	 workq;
1143 	struct pfr_ktable	*p;
1144 	int			 xdel = 0;
1145 
1146 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ALLRSETS);
1147 	if (pfr_fix_anchor(filter->pfrt_anchor))
1148 		return (EINVAL);
1149 	if (pfr_table_count(filter, flags) < 0)
1150 		return (ENOENT);
1151 
1152 	SLIST_INIT(&workq);
1153 	RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {
1154 		if (pfr_skip_table(filter, p, flags))
1155 			continue;
1156 		if (!strcmp(p->pfrkt_anchor, PF_RESERVED_ANCHOR))
1157 			continue;
1158 		if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE))
1159 			continue;
1160 		p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1161 		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1162 		xdel++;
1163 	}
1164 	if (!(flags & PFR_FLAG_DUMMY))
1165 		pfr_setflags_ktables(&workq);
1166 	if (ndel != NULL)
1167 		*ndel = xdel;
1168 	return (0);
1169 }
1170 
1171 int
1172 pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags)
1173 {
1174 	struct pfr_ktableworkq	 addq, changeq;
1175 	struct pfr_ktable	*p, *q, *r, key;
1176 	int			 i, rv, xadd = 0;
1177 	long			 tzero = time_second;
1178 
1179 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1180 	SLIST_INIT(&addq);
1181 	SLIST_INIT(&changeq);
1182 	for (i = 0; i < size; i++) {
1183 		bcopy(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t));
1184 		if (pfr_validate_table(&key.pfrkt_t, PFR_TFLAG_USRMASK,
1185 		    flags & PFR_FLAG_USERIOCTL))
1186 			senderr(EINVAL);
1187 		key.pfrkt_flags |= PFR_TFLAG_ACTIVE;
1188 		p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);
1189 		if (p == NULL) {
1190 			p = pfr_create_ktable(&key.pfrkt_t, tzero, 1);
1191 			if (p == NULL)
1192 				senderr(ENOMEM);
1193 			SLIST_FOREACH(q, &addq, pfrkt_workq) {
1194 				if (!pfr_ktable_compare(p, q)) {
1195 					pfr_destroy_ktable(p, 0);
1196 					goto _skip;
1197 				}
1198 			}
1199 			SLIST_INSERT_HEAD(&addq, p, pfrkt_workq);
1200 			xadd++;
1201 			if (!key.pfrkt_anchor[0])
1202 				goto _skip;
1203 
1204 			/* find or create root table */
1205 			bzero(key.pfrkt_anchor, sizeof(key.pfrkt_anchor));
1206 			r = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);
1207 			if (r != NULL) {
1208 				p->pfrkt_root = r;
1209 				goto _skip;
1210 			}
1211 			SLIST_FOREACH(q, &addq, pfrkt_workq) {
1212 				if (!pfr_ktable_compare(&key, q)) {
1213 					p->pfrkt_root = q;
1214 					goto _skip;
1215 				}
1216 			}
1217 			key.pfrkt_flags = 0;
1218 			r = pfr_create_ktable(&key.pfrkt_t, 0, 1);
1219 			if (r == NULL)
1220 				senderr(ENOMEM);
1221 			SLIST_INSERT_HEAD(&addq, r, pfrkt_workq);
1222 			p->pfrkt_root = r;
1223 		} else if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1224 			SLIST_FOREACH(q, &changeq, pfrkt_workq)
1225 				if (!pfr_ktable_compare(&key, q))
1226 					goto _skip;
1227 			p->pfrkt_nflags = (p->pfrkt_flags &
1228 			    ~PFR_TFLAG_USRMASK) | key.pfrkt_flags;
1229 			SLIST_INSERT_HEAD(&changeq, p, pfrkt_workq);
1230 			xadd++;
1231 		}
1232 _skip:
1233 	;
1234 	}
1235 	if (!(flags & PFR_FLAG_DUMMY)) {
1236 		pfr_insert_ktables(&addq);
1237 		pfr_setflags_ktables(&changeq);
1238 	} else
1239 		 pfr_destroy_ktables(&addq, 0);
1240 	if (nadd != NULL)
1241 		*nadd = xadd;
1242 	return (0);
1243 _bad:
1244 	pfr_destroy_ktables(&addq, 0);
1245 	return (rv);
1246 }
1247 
1248 int
1249 pfr_del_tables(struct pfr_table *tbl, int size, int *ndel, int flags)
1250 {
1251 	struct pfr_ktableworkq	 workq;
1252 	struct pfr_ktable	*p, *q, key;
1253 	int			 i, xdel = 0;
1254 
1255 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1256 	SLIST_INIT(&workq);
1257 	for (i = 0; i < size; i++) {
1258 		bcopy(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t));
1259 		if (pfr_validate_table(&key.pfrkt_t, 0,
1260 		    flags & PFR_FLAG_USERIOCTL))
1261 			return (EINVAL);
1262 		p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);
1263 		if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1264 			SLIST_FOREACH(q, &workq, pfrkt_workq)
1265 				if (!pfr_ktable_compare(p, q))
1266 					goto _skip;
1267 			p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1268 			SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1269 			xdel++;
1270 		}
1271 _skip:
1272 	;
1273 	}
1274 
1275 	if (!(flags & PFR_FLAG_DUMMY))
1276 		pfr_setflags_ktables(&workq);
1277 	if (ndel != NULL)
1278 		*ndel = xdel;
1279 	return (0);
1280 }
1281 
1282 int
1283 pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size,
1284 	int flags)
1285 {
1286 	struct pfr_ktable	*p;
1287 	int			 n, nn;
1288 
1289 	PF_RULES_RASSERT();
1290 
1291 	ACCEPT_FLAGS(flags, PFR_FLAG_ALLRSETS);
1292 	if (pfr_fix_anchor(filter->pfrt_anchor))
1293 		return (EINVAL);
1294 	n = nn = pfr_table_count(filter, flags);
1295 	if (n < 0)
1296 		return (ENOENT);
1297 	if (n > *size) {
1298 		*size = n;
1299 		return (0);
1300 	}
1301 	RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {
1302 		if (pfr_skip_table(filter, p, flags))
1303 			continue;
1304 		if (n-- <= 0)
1305 			continue;
1306 		bcopy(&p->pfrkt_t, tbl++, sizeof(*tbl));
1307 	}
1308 
1309 	KASSERT(n == 0, ("%s: corruption detected (%d)", __func__, n));
1310 
1311 	*size = nn;
1312 	return (0);
1313 }
1314 
1315 int
1316 pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size,
1317 	int flags)
1318 {
1319 	struct pfr_ktable	*p;
1320 	struct pfr_ktableworkq	 workq;
1321 	int			 n, nn;
1322 	long			 tzero = time_second;
1323 	int			 pfr_dir, pfr_op;
1324 
1325 	/* XXX PFR_FLAG_CLSTATS disabled */
1326 	ACCEPT_FLAGS(flags, PFR_FLAG_ALLRSETS);
1327 	if (pfr_fix_anchor(filter->pfrt_anchor))
1328 		return (EINVAL);
1329 	n = nn = pfr_table_count(filter, flags);
1330 	if (n < 0)
1331 		return (ENOENT);
1332 	if (n > *size) {
1333 		*size = n;
1334 		return (0);
1335 	}
1336 	SLIST_INIT(&workq);
1337 	RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {
1338 		if (pfr_skip_table(filter, p, flags))
1339 			continue;
1340 		if (n-- <= 0)
1341 			continue;
1342 		bcopy(&p->pfrkt_kts.pfrts_t, &tbl->pfrts_t,
1343 		    sizeof(struct pfr_table));
1344 		for (pfr_dir = 0; pfr_dir < PFR_DIR_MAX; pfr_dir ++) {
1345 			for (pfr_op = 0; pfr_op < PFR_OP_TABLE_MAX; pfr_op ++) {
1346 				tbl->pfrts_packets[pfr_dir][pfr_op] =
1347 				    pfr_kstate_counter_fetch(
1348 					&p->pfrkt_packets[pfr_dir][pfr_op]);
1349 				tbl->pfrts_bytes[pfr_dir][pfr_op] =
1350 				    pfr_kstate_counter_fetch(
1351 					&p->pfrkt_bytes[pfr_dir][pfr_op]);
1352 			}
1353 		}
1354 		tbl->pfrts_match = pfr_kstate_counter_fetch(&p->pfrkt_match);
1355 		tbl->pfrts_nomatch = pfr_kstate_counter_fetch(&p->pfrkt_nomatch);
1356 		tbl->pfrts_tzero = p->pfrkt_tzero;
1357 		tbl->pfrts_cnt = p->pfrkt_cnt;
1358 		for (pfr_op = 0; pfr_op < PFR_REFCNT_MAX; pfr_op++)
1359 			tbl->pfrts_refcnt[pfr_op] = p->pfrkt_refcnt[pfr_op];
1360 		tbl++;
1361 		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1362 	}
1363 	if (flags & PFR_FLAG_CLSTATS)
1364 		pfr_clstats_ktables(&workq, tzero,
1365 		    flags & PFR_FLAG_ADDRSTOO);
1366 
1367 	KASSERT(n == 0, ("%s: corruption detected (%d)", __func__, n));
1368 
1369 	*size = nn;
1370 	return (0);
1371 }
1372 
1373 int
1374 pfr_clr_tstats(struct pfr_table *tbl, int size, int *nzero, int flags)
1375 {
1376 	struct pfr_ktableworkq	 workq;
1377 	struct pfr_ktable	*p, key;
1378 	int			 i, xzero = 0;
1379 	long			 tzero = time_second;
1380 
1381 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ADDRSTOO);
1382 	SLIST_INIT(&workq);
1383 	for (i = 0; i < size; i++) {
1384 		bcopy(tbl + i, &key.pfrkt_t, sizeof(key.pfrkt_t));
1385 		if (pfr_validate_table(&key.pfrkt_t, 0, 0))
1386 			return (EINVAL);
1387 		p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);
1388 		if (p != NULL) {
1389 			SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1390 			xzero++;
1391 		}
1392 	}
1393 	if (!(flags & PFR_FLAG_DUMMY))
1394 		pfr_clstats_ktables(&workq, tzero, flags & PFR_FLAG_ADDRSTOO);
1395 	if (nzero != NULL)
1396 		*nzero = xzero;
1397 	return (0);
1398 }
1399 
1400 int
1401 pfr_set_tflags(struct pfr_table *tbl, int size, int setflag, int clrflag,
1402 	int *nchange, int *ndel, int flags)
1403 {
1404 	struct pfr_ktableworkq	 workq;
1405 	struct pfr_ktable	*p, *q, key;
1406 	int			 i, xchange = 0, xdel = 0;
1407 
1408 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1409 	if ((setflag & ~PFR_TFLAG_USRMASK) ||
1410 	    (clrflag & ~PFR_TFLAG_USRMASK) ||
1411 	    (setflag & clrflag))
1412 		return (EINVAL);
1413 	SLIST_INIT(&workq);
1414 	for (i = 0; i < size; i++) {
1415 		bcopy(tbl + i, &key.pfrkt_t, sizeof(key.pfrkt_t));
1416 		if (pfr_validate_table(&key.pfrkt_t, 0,
1417 		    flags & PFR_FLAG_USERIOCTL))
1418 			return (EINVAL);
1419 		p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);
1420 		if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1421 			p->pfrkt_nflags = (p->pfrkt_flags | setflag) &
1422 			    ~clrflag;
1423 			if (p->pfrkt_nflags == p->pfrkt_flags)
1424 				goto _skip;
1425 			SLIST_FOREACH(q, &workq, pfrkt_workq)
1426 				if (!pfr_ktable_compare(p, q))
1427 					goto _skip;
1428 			SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1429 			if ((p->pfrkt_flags & PFR_TFLAG_PERSIST) &&
1430 			    (clrflag & PFR_TFLAG_PERSIST) &&
1431 			    !(p->pfrkt_flags & PFR_TFLAG_REFERENCED))
1432 				xdel++;
1433 			else
1434 				xchange++;
1435 		}
1436 _skip:
1437 	;
1438 	}
1439 	if (!(flags & PFR_FLAG_DUMMY))
1440 		pfr_setflags_ktables(&workq);
1441 	if (nchange != NULL)
1442 		*nchange = xchange;
1443 	if (ndel != NULL)
1444 		*ndel = xdel;
1445 	return (0);
1446 }
1447 
1448 int
1449 pfr_ina_begin(struct pfr_table *trs, u_int32_t *ticket, int *ndel, int flags)
1450 {
1451 	struct pfr_ktableworkq	 workq;
1452 	struct pfr_ktable	*p;
1453 	struct pf_kruleset	*rs;
1454 	int			 xdel = 0;
1455 
1456 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1457 	rs = pf_find_or_create_kruleset(trs->pfrt_anchor);
1458 	if (rs == NULL)
1459 		return (ENOMEM);
1460 	SLIST_INIT(&workq);
1461 	RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {
1462 		if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1463 		    pfr_skip_table(trs, p, 0))
1464 			continue;
1465 		p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1466 		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1467 		xdel++;
1468 	}
1469 	if (!(flags & PFR_FLAG_DUMMY)) {
1470 		pfr_setflags_ktables(&workq);
1471 		if (ticket != NULL)
1472 			*ticket = ++rs->tticket;
1473 		rs->topen = 1;
1474 	} else
1475 		pf_remove_if_empty_kruleset(rs);
1476 	if (ndel != NULL)
1477 		*ndel = xdel;
1478 	return (0);
1479 }
1480 
1481 int
1482 pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size,
1483     int *nadd, int *naddr, u_int32_t ticket, int flags)
1484 {
1485 	struct pfr_ktableworkq	 tableq;
1486 	struct pfr_kentryworkq	 addrq;
1487 	struct pfr_ktable	*kt, *rt, *shadow, key;
1488 	struct pfr_kentry	*p;
1489 	struct pfr_addr		*ad;
1490 	struct pf_kruleset	*rs;
1491 	int			 i, rv, xadd = 0, xaddr = 0;
1492 
1493 	PF_RULES_WASSERT();
1494 
1495 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ADDRSTOO);
1496 	if (size && !(flags & PFR_FLAG_ADDRSTOO))
1497 		return (EINVAL);
1498 	if (pfr_validate_table(tbl, PFR_TFLAG_USRMASK,
1499 	    flags & PFR_FLAG_USERIOCTL))
1500 		return (EINVAL);
1501 	rs = pf_find_kruleset(tbl->pfrt_anchor);
1502 	if (rs == NULL || !rs->topen || ticket != rs->tticket)
1503 		return (EBUSY);
1504 	tbl->pfrt_flags |= PFR_TFLAG_INACTIVE;
1505 	SLIST_INIT(&tableq);
1506 	kt = RB_FIND(pfr_ktablehead, &V_pfr_ktables, (struct pfr_ktable *)tbl);
1507 	if (kt == NULL) {
1508 		kt = pfr_create_ktable(tbl, 0, 1);
1509 		if (kt == NULL)
1510 			return (ENOMEM);
1511 		SLIST_INSERT_HEAD(&tableq, kt, pfrkt_workq);
1512 		xadd++;
1513 		if (!tbl->pfrt_anchor[0])
1514 			goto _skip;
1515 
1516 		/* find or create root table */
1517 		bzero(&key, sizeof(key));
1518 		strlcpy(key.pfrkt_name, tbl->pfrt_name, sizeof(key.pfrkt_name));
1519 		rt = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);
1520 		if (rt != NULL) {
1521 			kt->pfrkt_root = rt;
1522 			goto _skip;
1523 		}
1524 		rt = pfr_create_ktable(&key.pfrkt_t, 0, 1);
1525 		if (rt == NULL) {
1526 			pfr_destroy_ktables(&tableq, 0);
1527 			return (ENOMEM);
1528 		}
1529 		SLIST_INSERT_HEAD(&tableq, rt, pfrkt_workq);
1530 		kt->pfrkt_root = rt;
1531 	} else if (!(kt->pfrkt_flags & PFR_TFLAG_INACTIVE))
1532 		xadd++;
1533 _skip:
1534 	shadow = pfr_create_ktable(tbl, 0, 0);
1535 	if (shadow == NULL) {
1536 		pfr_destroy_ktables(&tableq, 0);
1537 		return (ENOMEM);
1538 	}
1539 	SLIST_INIT(&addrq);
1540 	for (i = 0, ad = addr; i < size; i++, ad++) {
1541 		if (pfr_validate_addr(ad))
1542 			senderr(EINVAL);
1543 		if (pfr_lookup_addr(shadow, ad, 1) != NULL)
1544 			continue;
1545 		p = pfr_create_kentry(ad,
1546 		    (shadow->pfrkt_flags & PFR_TFLAG_COUNTERS) != 0);
1547 		if (p == NULL)
1548 			senderr(ENOMEM);
1549 		if (pfr_route_kentry(shadow, p)) {
1550 			pfr_destroy_kentry(p);
1551 			continue;
1552 		}
1553 		SLIST_INSERT_HEAD(&addrq, p, pfrke_workq);
1554 		xaddr++;
1555 	}
1556 	if (!(flags & PFR_FLAG_DUMMY)) {
1557 		if (kt->pfrkt_shadow != NULL)
1558 			pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1559 		kt->pfrkt_flags |= PFR_TFLAG_INACTIVE;
1560 		pfr_insert_ktables(&tableq);
1561 		shadow->pfrkt_cnt = (flags & PFR_FLAG_ADDRSTOO) ?
1562 		    xaddr : NO_ADDRESSES;
1563 		kt->pfrkt_shadow = shadow;
1564 	} else {
1565 		pfr_clean_node_mask(shadow, &addrq);
1566 		pfr_destroy_ktable(shadow, 0);
1567 		pfr_destroy_ktables(&tableq, 0);
1568 		pfr_destroy_kentries(&addrq);
1569 	}
1570 	if (nadd != NULL)
1571 		*nadd = xadd;
1572 	if (naddr != NULL)
1573 		*naddr = xaddr;
1574 	return (0);
1575 _bad:
1576 	pfr_destroy_ktable(shadow, 0);
1577 	pfr_destroy_ktables(&tableq, 0);
1578 	pfr_destroy_kentries(&addrq);
1579 	return (rv);
1580 }
1581 
1582 int
1583 pfr_ina_rollback(struct pfr_table *trs, u_int32_t ticket, int *ndel, int flags)
1584 {
1585 	struct pfr_ktableworkq	 workq;
1586 	struct pfr_ktable	*p;
1587 	struct pf_kruleset	*rs;
1588 	int			 xdel = 0;
1589 
1590 	PF_RULES_WASSERT();
1591 
1592 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1593 	rs = pf_find_kruleset(trs->pfrt_anchor);
1594 	if (rs == NULL || !rs->topen || ticket != rs->tticket)
1595 		return (0);
1596 	SLIST_INIT(&workq);
1597 	RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {
1598 		if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1599 		    pfr_skip_table(trs, p, 0))
1600 			continue;
1601 		p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1602 		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1603 		xdel++;
1604 	}
1605 	if (!(flags & PFR_FLAG_DUMMY)) {
1606 		pfr_setflags_ktables(&workq);
1607 		rs->topen = 0;
1608 		pf_remove_if_empty_kruleset(rs);
1609 	}
1610 	if (ndel != NULL)
1611 		*ndel = xdel;
1612 	return (0);
1613 }
1614 
1615 int
1616 pfr_ina_commit(struct pfr_table *trs, u_int32_t ticket, int *nadd,
1617     int *nchange, int flags)
1618 {
1619 	struct pfr_ktable	*p, *q;
1620 	struct pfr_ktableworkq	 workq;
1621 	struct pf_kruleset	*rs;
1622 	int			 xadd = 0, xchange = 0;
1623 	long			 tzero = time_second;
1624 
1625 	PF_RULES_WASSERT();
1626 
1627 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1628 	rs = pf_find_kruleset(trs->pfrt_anchor);
1629 	if (rs == NULL || !rs->topen || ticket != rs->tticket)
1630 		return (EBUSY);
1631 
1632 	SLIST_INIT(&workq);
1633 	RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {
1634 		if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1635 		    pfr_skip_table(trs, p, 0))
1636 			continue;
1637 		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1638 		if (p->pfrkt_flags & PFR_TFLAG_ACTIVE)
1639 			xchange++;
1640 		else
1641 			xadd++;
1642 	}
1643 
1644 	if (!(flags & PFR_FLAG_DUMMY)) {
1645 		for (p = SLIST_FIRST(&workq); p != NULL; p = q) {
1646 			q = SLIST_NEXT(p, pfrkt_workq);
1647 			pfr_commit_ktable(p, tzero);
1648 		}
1649 		rs->topen = 0;
1650 		pf_remove_if_empty_kruleset(rs);
1651 	}
1652 	if (nadd != NULL)
1653 		*nadd = xadd;
1654 	if (nchange != NULL)
1655 		*nchange = xchange;
1656 
1657 	return (0);
1658 }
1659 
1660 static void
1661 pfr_commit_ktable(struct pfr_ktable *kt, long tzero)
1662 {
1663 	counter_u64_t		*pkc, *qkc;
1664 	struct pfr_ktable	*shadow = kt->pfrkt_shadow;
1665 	int			 nflags;
1666 
1667 	PF_RULES_WASSERT();
1668 
1669 	if (shadow->pfrkt_cnt == NO_ADDRESSES) {
1670 		if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1671 			pfr_clstats_ktable(kt, tzero, 1);
1672 	} else if (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) {
1673 		/* kt might contain addresses */
1674 		struct pfr_kentryworkq	 addrq, addq, changeq, delq, garbageq;
1675 		struct pfr_kentry	*p, *q, *next;
1676 		struct pfr_addr		 ad;
1677 
1678 		pfr_enqueue_addrs(shadow, &addrq, NULL, 0);
1679 		pfr_mark_addrs(kt);
1680 		SLIST_INIT(&addq);
1681 		SLIST_INIT(&changeq);
1682 		SLIST_INIT(&delq);
1683 		SLIST_INIT(&garbageq);
1684 		pfr_clean_node_mask(shadow, &addrq);
1685 		SLIST_FOREACH_SAFE(p, &addrq, pfrke_workq, next) {
1686 			pfr_copyout_addr(&ad, p);
1687 			q = pfr_lookup_addr(kt, &ad, 1);
1688 			if (q != NULL) {
1689 				if (q->pfrke_not != p->pfrke_not)
1690 					SLIST_INSERT_HEAD(&changeq, q,
1691 					    pfrke_workq);
1692 				pkc = &p->pfrke_counters.pfrkc_counters;
1693 				qkc = &q->pfrke_counters.pfrkc_counters;
1694 				if ((*pkc == NULL) != (*qkc == NULL))
1695 					SWAP(counter_u64_t, *pkc, *qkc);
1696 				q->pfrke_mark = 1;
1697 				SLIST_INSERT_HEAD(&garbageq, p, pfrke_workq);
1698 			} else {
1699 				p->pfrke_counters.pfrkc_tzero = tzero;
1700 				SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
1701 			}
1702 		}
1703 		pfr_enqueue_addrs(kt, &delq, NULL, ENQUEUE_UNMARKED_ONLY);
1704 		pfr_insert_kentries(kt, &addq, tzero);
1705 		pfr_remove_kentries(kt, &delq);
1706 		pfr_clstats_kentries(kt, &changeq, tzero, INVERT_NEG_FLAG);
1707 		pfr_destroy_kentries(&garbageq);
1708 	} else {
1709 		/* kt cannot contain addresses */
1710 		SWAP(struct radix_node_head *, kt->pfrkt_ip4,
1711 		    shadow->pfrkt_ip4);
1712 		SWAP(struct radix_node_head *, kt->pfrkt_ip6,
1713 		    shadow->pfrkt_ip6);
1714 		SWAP(int, kt->pfrkt_cnt, shadow->pfrkt_cnt);
1715 		pfr_clstats_ktable(kt, tzero, 1);
1716 	}
1717 	nflags = ((shadow->pfrkt_flags & PFR_TFLAG_USRMASK) |
1718 	    (kt->pfrkt_flags & PFR_TFLAG_SETMASK) | PFR_TFLAG_ACTIVE)
1719 		& ~PFR_TFLAG_INACTIVE;
1720 	pfr_destroy_ktable(shadow, 0);
1721 	kt->pfrkt_shadow = NULL;
1722 	pfr_setflags_ktable(kt, nflags);
1723 }
1724 
1725 static int
1726 pfr_validate_table(struct pfr_table *tbl, int allowedflags, int no_reserved)
1727 {
1728 	int i;
1729 
1730 	if (!tbl->pfrt_name[0])
1731 		return (-1);
1732 	if (no_reserved && !strcmp(tbl->pfrt_anchor, PF_RESERVED_ANCHOR))
1733 		 return (-1);
1734 	if (tbl->pfrt_name[PF_TABLE_NAME_SIZE-1])
1735 		return (-1);
1736 	for (i = strlen(tbl->pfrt_name); i < PF_TABLE_NAME_SIZE; i++)
1737 		if (tbl->pfrt_name[i])
1738 			return (-1);
1739 	if (pfr_fix_anchor(tbl->pfrt_anchor))
1740 		return (-1);
1741 	if (tbl->pfrt_flags & ~allowedflags)
1742 		return (-1);
1743 	return (0);
1744 }
1745 
1746 /*
1747  * Rewrite anchors referenced by tables to remove slashes
1748  * and check for validity.
1749  */
1750 static int
1751 pfr_fix_anchor(char *anchor)
1752 {
1753 	size_t siz = MAXPATHLEN;
1754 	int i;
1755 
1756 	if (anchor[0] == '/') {
1757 		char *path;
1758 		int off;
1759 
1760 		path = anchor;
1761 		off = 1;
1762 		while (*++path == '/')
1763 			off++;
1764 		bcopy(path, anchor, siz - off);
1765 		memset(anchor + siz - off, 0, off);
1766 	}
1767 	if (anchor[siz - 1])
1768 		return (-1);
1769 	for (i = strlen(anchor); i < siz; i++)
1770 		if (anchor[i])
1771 			return (-1);
1772 	return (0);
1773 }
1774 
1775 int
1776 pfr_table_count(struct pfr_table *filter, int flags)
1777 {
1778 	struct pf_kruleset *rs;
1779 
1780 	PF_RULES_ASSERT();
1781 
1782 	if (flags & PFR_FLAG_ALLRSETS)
1783 		return (V_pfr_ktable_cnt);
1784 	if (filter->pfrt_anchor[0]) {
1785 		rs = pf_find_kruleset(filter->pfrt_anchor);
1786 		return ((rs != NULL) ? rs->tables : -1);
1787 	}
1788 	return (pf_main_ruleset.tables);
1789 }
1790 
1791 static int
1792 pfr_skip_table(struct pfr_table *filter, struct pfr_ktable *kt, int flags)
1793 {
1794 	if (flags & PFR_FLAG_ALLRSETS)
1795 		return (0);
1796 	if (strcmp(filter->pfrt_anchor, kt->pfrkt_anchor))
1797 		return (1);
1798 	return (0);
1799 }
1800 
1801 static void
1802 pfr_insert_ktables(struct pfr_ktableworkq *workq)
1803 {
1804 	struct pfr_ktable	*p;
1805 
1806 	SLIST_FOREACH(p, workq, pfrkt_workq)
1807 		pfr_insert_ktable(p);
1808 }
1809 
1810 static void
1811 pfr_insert_ktable(struct pfr_ktable *kt)
1812 {
1813 
1814 	PF_RULES_WASSERT();
1815 
1816 	RB_INSERT(pfr_ktablehead, &V_pfr_ktables, kt);
1817 	V_pfr_ktable_cnt++;
1818 	if (kt->pfrkt_root != NULL)
1819 		if (!kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]++)
1820 			pfr_setflags_ktable(kt->pfrkt_root,
1821 			    kt->pfrkt_root->pfrkt_flags|PFR_TFLAG_REFDANCHOR);
1822 }
1823 
1824 static void
1825 pfr_setflags_ktables(struct pfr_ktableworkq *workq)
1826 {
1827 	struct pfr_ktable	*p, *q;
1828 
1829 	for (p = SLIST_FIRST(workq); p; p = q) {
1830 		q = SLIST_NEXT(p, pfrkt_workq);
1831 		pfr_setflags_ktable(p, p->pfrkt_nflags);
1832 	}
1833 }
1834 
1835 static void
1836 pfr_setflags_ktable(struct pfr_ktable *kt, int newf)
1837 {
1838 	struct pfr_kentryworkq	addrq;
1839 	struct pfr_walktree	w;
1840 
1841 	PF_RULES_WASSERT();
1842 
1843 	if (!(newf & PFR_TFLAG_REFERENCED) &&
1844 	    !(newf & PFR_TFLAG_REFDANCHOR) &&
1845 	    !(newf & PFR_TFLAG_PERSIST))
1846 		newf &= ~PFR_TFLAG_ACTIVE;
1847 	if (!(newf & PFR_TFLAG_ACTIVE))
1848 		newf &= ~PFR_TFLAG_USRMASK;
1849 	if (!(newf & PFR_TFLAG_SETMASK)) {
1850 		RB_REMOVE(pfr_ktablehead, &V_pfr_ktables, kt);
1851 		if (kt->pfrkt_root != NULL)
1852 			if (!--kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR])
1853 				pfr_setflags_ktable(kt->pfrkt_root,
1854 				    kt->pfrkt_root->pfrkt_flags &
1855 					~PFR_TFLAG_REFDANCHOR);
1856 		pfr_destroy_ktable(kt, 1);
1857 		V_pfr_ktable_cnt--;
1858 		return;
1859 	}
1860 	if (newf & PFR_TFLAG_COUNTERS && ! (kt->pfrkt_flags & PFR_TFLAG_COUNTERS)) {
1861 		bzero(&w, sizeof(w));
1862 		w.pfrw_op = PFRW_COUNTERS;
1863 		w.pfrw_flags |= PFR_TFLAG_COUNTERS;
1864 		kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
1865 		kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w);
1866 	}
1867 	if (! (newf & PFR_TFLAG_COUNTERS) && (kt->pfrkt_flags & PFR_TFLAG_COUNTERS)) {
1868 		bzero(&w, sizeof(w));
1869 		w.pfrw_op = PFRW_COUNTERS;
1870 		w.pfrw_flags |= 0;
1871 		kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
1872 		kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w);
1873 	}
1874 	if (!(newf & PFR_TFLAG_ACTIVE) && kt->pfrkt_cnt) {
1875 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1876 		pfr_remove_kentries(kt, &addrq);
1877 	}
1878 	if (!(newf & PFR_TFLAG_INACTIVE) && kt->pfrkt_shadow != NULL) {
1879 		pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1880 		kt->pfrkt_shadow = NULL;
1881 	}
1882 	kt->pfrkt_flags = newf;
1883 }
1884 
1885 static void
1886 pfr_clstats_ktables(struct pfr_ktableworkq *workq, long tzero, int recurse)
1887 {
1888 	struct pfr_ktable	*p;
1889 
1890 	SLIST_FOREACH(p, workq, pfrkt_workq)
1891 		pfr_clstats_ktable(p, tzero, recurse);
1892 }
1893 
1894 static void
1895 pfr_clstats_ktable(struct pfr_ktable *kt, long tzero, int recurse)
1896 {
1897 	struct pfr_kentryworkq	 addrq;
1898 	int			 pfr_dir, pfr_op;
1899 
1900 	MPASS(PF_TABLE_STATS_OWNED() || PF_RULES_WOWNED());
1901 
1902 	if (recurse) {
1903 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1904 		pfr_clstats_kentries(kt, &addrq, tzero, 0);
1905 	}
1906 	for (pfr_dir = 0; pfr_dir < PFR_DIR_MAX; pfr_dir ++) {
1907 		for (pfr_op = 0; pfr_op < PFR_OP_TABLE_MAX; pfr_op ++) {
1908 			pfr_kstate_counter_zero(&kt->pfrkt_packets[pfr_dir][pfr_op]);
1909 			pfr_kstate_counter_zero(&kt->pfrkt_bytes[pfr_dir][pfr_op]);
1910 		}
1911 	}
1912 	pfr_kstate_counter_zero(&kt->pfrkt_match);
1913 	pfr_kstate_counter_zero(&kt->pfrkt_nomatch);
1914 	kt->pfrkt_tzero = tzero;
1915 }
1916 
1917 static struct pfr_ktable *
1918 pfr_create_ktable(struct pfr_table *tbl, long tzero, int attachruleset)
1919 {
1920 	struct pfr_ktable	*kt;
1921 	struct pf_kruleset	*rs;
1922 	int			 pfr_dir, pfr_op;
1923 
1924 	PF_RULES_WASSERT();
1925 
1926 	kt = malloc(sizeof(*kt), M_PFTABLE, M_NOWAIT|M_ZERO);
1927 	if (kt == NULL)
1928 		return (NULL);
1929 	kt->pfrkt_t = *tbl;
1930 
1931 	if (attachruleset) {
1932 		rs = pf_find_or_create_kruleset(tbl->pfrt_anchor);
1933 		if (!rs) {
1934 			pfr_destroy_ktable(kt, 0);
1935 			return (NULL);
1936 		}
1937 		kt->pfrkt_rs = rs;
1938 		rs->tables++;
1939 	}
1940 
1941 	for (pfr_dir = 0; pfr_dir < PFR_DIR_MAX; pfr_dir ++) {
1942 		for (pfr_op = 0; pfr_op < PFR_OP_TABLE_MAX; pfr_op ++) {
1943 			if (pfr_kstate_counter_init(
1944 			    &kt->pfrkt_packets[pfr_dir][pfr_op], M_NOWAIT) != 0) {
1945 				pfr_destroy_ktable(kt, 0);
1946 				return (NULL);
1947 			}
1948 			if (pfr_kstate_counter_init(
1949 			    &kt->pfrkt_bytes[pfr_dir][pfr_op], M_NOWAIT) != 0) {
1950 				pfr_destroy_ktable(kt, 0);
1951 				return (NULL);
1952 			}
1953 		}
1954 	}
1955 	if (pfr_kstate_counter_init(&kt->pfrkt_match, M_NOWAIT) != 0) {
1956 		pfr_destroy_ktable(kt, 0);
1957 		return (NULL);
1958 	}
1959 
1960 	if (pfr_kstate_counter_init(&kt->pfrkt_nomatch, M_NOWAIT) != 0) {
1961 		pfr_destroy_ktable(kt, 0);
1962 		return (NULL);
1963 	}
1964 
1965 	if (!rn_inithead((void **)&kt->pfrkt_ip4,
1966 	    offsetof(struct sockaddr_in, sin_addr) * 8) ||
1967 	    !rn_inithead((void **)&kt->pfrkt_ip6,
1968 	    offsetof(struct sockaddr_in6, sin6_addr) * 8)) {
1969 		pfr_destroy_ktable(kt, 0);
1970 		return (NULL);
1971 	}
1972 	kt->pfrkt_tzero = tzero;
1973 
1974 	return (kt);
1975 }
1976 
1977 static void
1978 pfr_destroy_ktables(struct pfr_ktableworkq *workq, int flushaddr)
1979 {
1980 	struct pfr_ktable	*p, *q;
1981 
1982 	for (p = SLIST_FIRST(workq); p; p = q) {
1983 		q = SLIST_NEXT(p, pfrkt_workq);
1984 		pfr_destroy_ktable(p, flushaddr);
1985 	}
1986 }
1987 
1988 static void
1989 pfr_destroy_ktable(struct pfr_ktable *kt, int flushaddr)
1990 {
1991 	struct pfr_kentryworkq	 addrq;
1992 	int			 pfr_dir, pfr_op;
1993 
1994 	if (flushaddr) {
1995 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1996 		pfr_clean_node_mask(kt, &addrq);
1997 		pfr_destroy_kentries(&addrq);
1998 	}
1999 	if (kt->pfrkt_ip4 != NULL)
2000 		rn_detachhead((void **)&kt->pfrkt_ip4);
2001 	if (kt->pfrkt_ip6 != NULL)
2002 		rn_detachhead((void **)&kt->pfrkt_ip6);
2003 	if (kt->pfrkt_shadow != NULL)
2004 		pfr_destroy_ktable(kt->pfrkt_shadow, flushaddr);
2005 	if (kt->pfrkt_rs != NULL) {
2006 		kt->pfrkt_rs->tables--;
2007 		pf_remove_if_empty_kruleset(kt->pfrkt_rs);
2008 	}
2009 	for (pfr_dir = 0; pfr_dir < PFR_DIR_MAX; pfr_dir ++) {
2010 		for (pfr_op = 0; pfr_op < PFR_OP_TABLE_MAX; pfr_op ++) {
2011 			pfr_kstate_counter_deinit(&kt->pfrkt_packets[pfr_dir][pfr_op]);
2012 			pfr_kstate_counter_deinit(&kt->pfrkt_bytes[pfr_dir][pfr_op]);
2013 		}
2014 	}
2015 	pfr_kstate_counter_deinit(&kt->pfrkt_match);
2016 	pfr_kstate_counter_deinit(&kt->pfrkt_nomatch);
2017 
2018 	free(kt, M_PFTABLE);
2019 }
2020 
2021 static int
2022 pfr_ktable_compare(struct pfr_ktable *p, struct pfr_ktable *q)
2023 {
2024 	int d;
2025 
2026 	if ((d = strncmp(p->pfrkt_name, q->pfrkt_name, PF_TABLE_NAME_SIZE)))
2027 		return (d);
2028 	return (strcmp(p->pfrkt_anchor, q->pfrkt_anchor));
2029 }
2030 
2031 static struct pfr_ktable *
2032 pfr_lookup_table(struct pfr_table *tbl)
2033 {
2034 	/* struct pfr_ktable start like a struct pfr_table */
2035 	return (RB_FIND(pfr_ktablehead, &V_pfr_ktables,
2036 	    (struct pfr_ktable *)tbl));
2037 }
2038 
2039 int
2040 pfr_match_addr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af)
2041 {
2042 	struct pfr_kentry	*ke = NULL;
2043 	int			 match;
2044 
2045 	PF_RULES_RASSERT();
2046 
2047 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2048 		kt = kt->pfrkt_root;
2049 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2050 		return (0);
2051 
2052 	switch (af) {
2053 #ifdef INET
2054 	case AF_INET:
2055 	    {
2056 		struct sockaddr_in sin;
2057 
2058 		bzero(&sin, sizeof(sin));
2059 		sin.sin_len = sizeof(sin);
2060 		sin.sin_family = AF_INET;
2061 		sin.sin_addr.s_addr = a->addr32[0];
2062 		ke = (struct pfr_kentry *)rn_match(&sin, &kt->pfrkt_ip4->rh);
2063 		if (ke && KENTRY_RNF_ROOT(ke))
2064 			ke = NULL;
2065 		break;
2066 	    }
2067 #endif /* INET */
2068 #ifdef INET6
2069 	case AF_INET6:
2070 	    {
2071 		struct sockaddr_in6 sin6;
2072 
2073 		bzero(&sin6, sizeof(sin6));
2074 		sin6.sin6_len = sizeof(sin6);
2075 		sin6.sin6_family = AF_INET6;
2076 		bcopy(a, &sin6.sin6_addr, sizeof(sin6.sin6_addr));
2077 		ke = (struct pfr_kentry *)rn_match(&sin6, &kt->pfrkt_ip6->rh);
2078 		if (ke && KENTRY_RNF_ROOT(ke))
2079 			ke = NULL;
2080 		break;
2081 	    }
2082 #endif /* INET6 */
2083 	}
2084 	match = (ke && !ke->pfrke_not);
2085 	if (match)
2086 		pfr_kstate_counter_add(&kt->pfrkt_match, 1);
2087 	else
2088 		pfr_kstate_counter_add(&kt->pfrkt_nomatch, 1);
2089 	return (match);
2090 }
2091 
2092 void
2093 pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af,
2094     u_int64_t len, int dir_out, int op_pass, int notrule)
2095 {
2096 	struct pfr_kentry	*ke = NULL;
2097 
2098 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2099 		kt = kt->pfrkt_root;
2100 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2101 		return;
2102 
2103 	switch (af) {
2104 #ifdef INET
2105 	case AF_INET:
2106 	    {
2107 		struct sockaddr_in sin;
2108 
2109 		bzero(&sin, sizeof(sin));
2110 		sin.sin_len = sizeof(sin);
2111 		sin.sin_family = AF_INET;
2112 		sin.sin_addr.s_addr = a->addr32[0];
2113 		ke = (struct pfr_kentry *)rn_match(&sin, &kt->pfrkt_ip4->rh);
2114 		if (ke && KENTRY_RNF_ROOT(ke))
2115 			ke = NULL;
2116 		break;
2117 	    }
2118 #endif /* INET */
2119 #ifdef INET6
2120 	case AF_INET6:
2121 	    {
2122 		struct sockaddr_in6 sin6;
2123 
2124 		bzero(&sin6, sizeof(sin6));
2125 		sin6.sin6_len = sizeof(sin6);
2126 		sin6.sin6_family = AF_INET6;
2127 		bcopy(a, &sin6.sin6_addr, sizeof(sin6.sin6_addr));
2128 		ke = (struct pfr_kentry *)rn_match(&sin6, &kt->pfrkt_ip6->rh);
2129 		if (ke && KENTRY_RNF_ROOT(ke))
2130 			ke = NULL;
2131 		break;
2132 	    }
2133 #endif /* INET6 */
2134 	default:
2135 		panic("%s: unknown address family %u", __func__, af);
2136 	}
2137 	if ((ke == NULL || ke->pfrke_not) != notrule) {
2138 		if (op_pass != PFR_OP_PASS)
2139 			DPFPRINTF(PF_DEBUG_URGENT,
2140 			    ("pfr_update_stats: assertion failed.\n"));
2141 		op_pass = PFR_OP_XPASS;
2142 	}
2143 	pfr_kstate_counter_add(&kt->pfrkt_packets[dir_out][op_pass], 1);
2144 	pfr_kstate_counter_add(&kt->pfrkt_bytes[dir_out][op_pass], len);
2145 	if (ke != NULL && op_pass != PFR_OP_XPASS &&
2146 	    (kt->pfrkt_flags & PFR_TFLAG_COUNTERS)) {
2147 		counter_u64_add(pfr_kentry_counter(&ke->pfrke_counters,
2148 		    dir_out, op_pass, PFR_TYPE_PACKETS), 1);
2149 		counter_u64_add(pfr_kentry_counter(&ke->pfrke_counters,
2150 		    dir_out, op_pass, PFR_TYPE_BYTES), len);
2151 	}
2152 }
2153 
2154 struct pfr_ktable *
2155 pfr_eth_attach_table(struct pf_keth_ruleset *rs, char *name)
2156 {
2157 	struct pfr_ktable	*kt, *rt;
2158 	struct pfr_table	 tbl;
2159 	struct pf_keth_anchor	*ac = rs->anchor;
2160 
2161 	PF_RULES_WASSERT();
2162 
2163 	bzero(&tbl, sizeof(tbl));
2164 	strlcpy(tbl.pfrt_name, name, sizeof(tbl.pfrt_name));
2165 	if (ac != NULL)
2166 		strlcpy(tbl.pfrt_anchor, ac->path, sizeof(tbl.pfrt_anchor));
2167 	kt = pfr_lookup_table(&tbl);
2168 	if (kt == NULL) {
2169 		kt = pfr_create_ktable(&tbl, time_second, 1);
2170 		if (kt == NULL)
2171 			return (NULL);
2172 		if (ac != NULL) {
2173 			bzero(tbl.pfrt_anchor, sizeof(tbl.pfrt_anchor));
2174 			rt = pfr_lookup_table(&tbl);
2175 			if (rt == NULL) {
2176 				rt = pfr_create_ktable(&tbl, 0, 1);
2177 				if (rt == NULL) {
2178 					pfr_destroy_ktable(kt, 0);
2179 					return (NULL);
2180 				}
2181 				pfr_insert_ktable(rt);
2182 			}
2183 			kt->pfrkt_root = rt;
2184 		}
2185 		pfr_insert_ktable(kt);
2186 	}
2187 	if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++)
2188 		pfr_setflags_ktable(kt, kt->pfrkt_flags|PFR_TFLAG_REFERENCED);
2189 	return (kt);
2190 }
2191 
2192 struct pfr_ktable *
2193 pfr_attach_table(struct pf_kruleset *rs, char *name)
2194 {
2195 	struct pfr_ktable	*kt, *rt;
2196 	struct pfr_table	 tbl;
2197 	struct pf_kanchor	*ac = rs->anchor;
2198 
2199 	PF_RULES_WASSERT();
2200 
2201 	bzero(&tbl, sizeof(tbl));
2202 	strlcpy(tbl.pfrt_name, name, sizeof(tbl.pfrt_name));
2203 	if (ac != NULL)
2204 		strlcpy(tbl.pfrt_anchor, ac->path, sizeof(tbl.pfrt_anchor));
2205 	kt = pfr_lookup_table(&tbl);
2206 	if (kt == NULL) {
2207 		kt = pfr_create_ktable(&tbl, time_second, 1);
2208 		if (kt == NULL)
2209 			return (NULL);
2210 		if (ac != NULL) {
2211 			bzero(tbl.pfrt_anchor, sizeof(tbl.pfrt_anchor));
2212 			rt = pfr_lookup_table(&tbl);
2213 			if (rt == NULL) {
2214 				rt = pfr_create_ktable(&tbl, 0, 1);
2215 				if (rt == NULL) {
2216 					pfr_destroy_ktable(kt, 0);
2217 					return (NULL);
2218 				}
2219 				pfr_insert_ktable(rt);
2220 			}
2221 			kt->pfrkt_root = rt;
2222 		}
2223 		pfr_insert_ktable(kt);
2224 	}
2225 	if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++)
2226 		pfr_setflags_ktable(kt, kt->pfrkt_flags|PFR_TFLAG_REFERENCED);
2227 	return (kt);
2228 }
2229 
2230 void
2231 pfr_detach_table(struct pfr_ktable *kt)
2232 {
2233 
2234 	PF_RULES_WASSERT();
2235 	KASSERT(kt->pfrkt_refcnt[PFR_REFCNT_RULE] > 0, ("%s: refcount %d\n",
2236 	    __func__, kt->pfrkt_refcnt[PFR_REFCNT_RULE]));
2237 
2238 	if (!--kt->pfrkt_refcnt[PFR_REFCNT_RULE])
2239 		pfr_setflags_ktable(kt, kt->pfrkt_flags&~PFR_TFLAG_REFERENCED);
2240 }
2241 
2242 int
2243 pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter,
2244     sa_family_t af)
2245 {
2246 	struct pf_addr		 *addr, *cur, *mask;
2247 	union sockaddr_union	 uaddr, umask;
2248 	struct pfr_kentry	*ke, *ke2 = NULL;
2249 	int			 idx = -1, use_counter = 0;
2250 
2251 	MPASS(pidx != NULL);
2252 	MPASS(counter != NULL);
2253 
2254 	switch (af) {
2255 	case AF_INET:
2256 		uaddr.sin.sin_len = sizeof(struct sockaddr_in);
2257 		uaddr.sin.sin_family = AF_INET;
2258 		break;
2259 	case AF_INET6:
2260 		uaddr.sin6.sin6_len = sizeof(struct sockaddr_in6);
2261 		uaddr.sin6.sin6_family = AF_INET6;
2262 		break;
2263 	}
2264 	addr = SUNION2PF(&uaddr, af);
2265 
2266 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2267 		kt = kt->pfrkt_root;
2268 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2269 		return (-1);
2270 
2271 	idx = *pidx;
2272 	if (idx >= 0)
2273 		use_counter = 1;
2274 	if (idx < 0)
2275 		idx = 0;
2276 
2277 _next_block:
2278 	ke = pfr_kentry_byidx(kt, idx, af);
2279 	if (ke == NULL) {
2280 		pfr_kstate_counter_add(&kt->pfrkt_nomatch, 1);
2281 		return (1);
2282 	}
2283 	pfr_prepare_network(&umask, af, ke->pfrke_net);
2284 	cur = SUNION2PF(&ke->pfrke_sa, af);
2285 	mask = SUNION2PF(&umask, af);
2286 
2287 	if (use_counter) {
2288 		/* is supplied address within block? */
2289 		if (!PF_MATCHA(0, cur, mask, counter, af)) {
2290 			/* no, go to next block in table */
2291 			idx++;
2292 			use_counter = 0;
2293 			goto _next_block;
2294 		}
2295 		PF_ACPY(addr, counter, af);
2296 	} else {
2297 		/* use first address of block */
2298 		PF_ACPY(addr, cur, af);
2299 	}
2300 
2301 	if (!KENTRY_NETWORK(ke)) {
2302 		/* this is a single IP address - no possible nested block */
2303 		PF_ACPY(counter, addr, af);
2304 		*pidx = idx;
2305 		pfr_kstate_counter_add(&kt->pfrkt_match, 1);
2306 		return (0);
2307 	}
2308 	for (;;) {
2309 		/* we don't want to use a nested block */
2310 		switch (af) {
2311 		case AF_INET:
2312 			ke2 = (struct pfr_kentry *)rn_match(&uaddr,
2313 			    &kt->pfrkt_ip4->rh);
2314 			break;
2315 		case AF_INET6:
2316 			ke2 = (struct pfr_kentry *)rn_match(&uaddr,
2317 			    &kt->pfrkt_ip6->rh);
2318 			break;
2319 		}
2320 		/* no need to check KENTRY_RNF_ROOT() here */
2321 		if (ke2 == ke) {
2322 			/* lookup return the same block - perfect */
2323 			PF_ACPY(counter, addr, af);
2324 			*pidx = idx;
2325 			pfr_kstate_counter_add(&kt->pfrkt_match, 1);
2326 			return (0);
2327 		}
2328 
2329 		/* we need to increase the counter past the nested block */
2330 		pfr_prepare_network(&umask, AF_INET, ke2->pfrke_net);
2331 		PF_POOLMASK(addr, addr, SUNION2PF(&umask, af), &pfr_ffaddr, af);
2332 		PF_AINC(addr, af);
2333 		if (!PF_MATCHA(0, cur, mask, addr, af)) {
2334 			/* ok, we reached the end of our main block */
2335 			/* go to next block in table */
2336 			idx++;
2337 			use_counter = 0;
2338 			goto _next_block;
2339 		}
2340 	}
2341 }
2342 
2343 static struct pfr_kentry *
2344 pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af)
2345 {
2346 	struct pfr_walktree	w;
2347 
2348 	bzero(&w, sizeof(w));
2349 	w.pfrw_op = PFRW_POOL_GET;
2350 	w.pfrw_cnt = idx;
2351 
2352 	switch (af) {
2353 #ifdef INET
2354 	case AF_INET:
2355 		kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
2356 		return (w.pfrw_kentry);
2357 #endif /* INET */
2358 #ifdef INET6
2359 	case AF_INET6:
2360 		kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w);
2361 		return (w.pfrw_kentry);
2362 #endif /* INET6 */
2363 	default:
2364 		return (NULL);
2365 	}
2366 }
2367 
2368 void
2369 pfr_dynaddr_update(struct pfr_ktable *kt, struct pfi_dynaddr *dyn)
2370 {
2371 	struct pfr_walktree	w;
2372 
2373 	bzero(&w, sizeof(w));
2374 	w.pfrw_op = PFRW_DYNADDR_UPDATE;
2375 	w.pfrw_dyn = dyn;
2376 
2377 	dyn->pfid_acnt4 = 0;
2378 	dyn->pfid_acnt6 = 0;
2379 	if (!dyn->pfid_af || dyn->pfid_af == AF_INET)
2380 		kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
2381 	if (!dyn->pfid_af || dyn->pfid_af == AF_INET6)
2382 		kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w);
2383 }
2384