xref: /freebsd/sys/netpfil/pf/pf_table.c (revision 63a938566d524836885917d95bd491aa4400b181)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright (c) 2002 Cedric Berger
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  *
11  *    - Redistributions of source code must retain the above copyright
12  *      notice, this list of conditions and the following disclaimer.
13  *    - Redistributions in binary form must reproduce the above
14  *      copyright notice, this list of conditions and the following
15  *      disclaimer in the documentation and/or other materials provided
16  *      with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
21  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
22  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
23  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
24  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
25  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
26  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
28  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  *
31  *	$OpenBSD: pf_table.c,v 1.79 2008/10/08 06:24:50 mcbride Exp $
32  */
33 
34 #include <sys/cdefs.h>
35 __FBSDID("$FreeBSD$");
36 
37 #include "opt_inet.h"
38 #include "opt_inet6.h"
39 
40 #include <sys/param.h>
41 #include <sys/kernel.h>
42 #include <sys/lock.h>
43 #include <sys/malloc.h>
44 #include <sys/mbuf.h>
45 #include <sys/mutex.h>
46 #include <sys/refcount.h>
47 #include <sys/rwlock.h>
48 #include <sys/socket.h>
49 #include <vm/uma.h>
50 
51 #include <net/if.h>
52 #include <net/vnet.h>
53 #include <net/pfvar.h>
54 
55 #define	ACCEPT_FLAGS(flags, oklist)		\
56 	do {					\
57 		if ((flags & ~(oklist)) &	\
58 		    PFR_FLAG_ALLMASK)		\
59 			return (EINVAL);	\
60 	} while (0)
61 
62 #define	FILLIN_SIN(sin, addr)			\
63 	do {					\
64 		(sin).sin_len = sizeof(sin);	\
65 		(sin).sin_family = AF_INET;	\
66 		(sin).sin_addr = (addr);	\
67 	} while (0)
68 
69 #define	FILLIN_SIN6(sin6, addr)			\
70 	do {					\
71 		(sin6).sin6_len = sizeof(sin6);	\
72 		(sin6).sin6_family = AF_INET6;	\
73 		(sin6).sin6_addr = (addr);	\
74 	} while (0)
75 
76 #define	SWAP(type, a1, a2)			\
77 	do {					\
78 		type tmp = a1;			\
79 		a1 = a2;			\
80 		a2 = tmp;			\
81 	} while (0)
82 
83 #define	SUNION2PF(su, af) (((af)==AF_INET) ?	\
84     (struct pf_addr *)&(su)->sin.sin_addr :	\
85     (struct pf_addr *)&(su)->sin6.sin6_addr)
86 
87 #define	AF_BITS(af)		(((af)==AF_INET)?32:128)
88 #define	ADDR_NETWORK(ad)	((ad)->pfra_net < AF_BITS((ad)->pfra_af))
89 #define	KENTRY_NETWORK(ke)	((ke)->pfrke_net < AF_BITS((ke)->pfrke_af))
90 #define	KENTRY_RNF_ROOT(ke) \
91 		((((struct radix_node *)(ke))->rn_flags & RNF_ROOT) != 0)
92 
93 #define	NO_ADDRESSES		(-1)
94 #define	ENQUEUE_UNMARKED_ONLY	(1)
95 #define	INVERT_NEG_FLAG		(1)
96 
97 struct pfr_walktree {
98 	enum pfrw_op {
99 		PFRW_MARK,
100 		PFRW_SWEEP,
101 		PFRW_ENQUEUE,
102 		PFRW_GET_ADDRS,
103 		PFRW_GET_ASTATS,
104 		PFRW_POOL_GET,
105 		PFRW_DYNADDR_UPDATE
106 	}	 pfrw_op;
107 	union {
108 		struct pfr_addr		*pfrw1_addr;
109 		struct pfr_astats	*pfrw1_astats;
110 		struct pfr_kentryworkq	*pfrw1_workq;
111 		struct pfr_kentry	*pfrw1_kentry;
112 		struct pfi_dynaddr	*pfrw1_dyn;
113 	}	 pfrw_1;
114 	int	 pfrw_free;
115 };
116 #define	pfrw_addr	pfrw_1.pfrw1_addr
117 #define	pfrw_astats	pfrw_1.pfrw1_astats
118 #define	pfrw_workq	pfrw_1.pfrw1_workq
119 #define	pfrw_kentry	pfrw_1.pfrw1_kentry
120 #define	pfrw_dyn	pfrw_1.pfrw1_dyn
121 #define	pfrw_cnt	pfrw_free
122 
123 #define	senderr(e)	do { rv = (e); goto _bad; } while (0)
124 
125 static MALLOC_DEFINE(M_PFTABLE, "pf_table", "pf(4) tables structures");
126 static VNET_DEFINE(uma_zone_t, pfr_kentry_z);
127 #define	V_pfr_kentry_z		VNET(pfr_kentry_z)
128 static VNET_DEFINE(uma_zone_t, pfr_kcounters_z);
129 #define	V_pfr_kcounters_z	VNET(pfr_kcounters_z)
130 
131 static struct pf_addr	 pfr_ffaddr = {
132 	.addr32 = { 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff }
133 };
134 
135 static void		 pfr_copyout_addr(struct pfr_addr *,
136 			    struct pfr_kentry *ke);
137 static int		 pfr_validate_addr(struct pfr_addr *);
138 static void		 pfr_enqueue_addrs(struct pfr_ktable *,
139 			    struct pfr_kentryworkq *, int *, int);
140 static void		 pfr_mark_addrs(struct pfr_ktable *);
141 static struct pfr_kentry
142 			*pfr_lookup_addr(struct pfr_ktable *,
143 			    struct pfr_addr *, int);
144 static struct pfr_kentry *pfr_create_kentry(struct pfr_addr *);
145 static void		 pfr_destroy_kentries(struct pfr_kentryworkq *);
146 static void		 pfr_destroy_kentry(struct pfr_kentry *);
147 static void		 pfr_insert_kentries(struct pfr_ktable *,
148 			    struct pfr_kentryworkq *, long);
149 static void		 pfr_remove_kentries(struct pfr_ktable *,
150 			    struct pfr_kentryworkq *);
151 static void		 pfr_clstats_kentries(struct pfr_kentryworkq *, long,
152 			    int);
153 static void		 pfr_reset_feedback(struct pfr_addr *, int);
154 static void		 pfr_prepare_network(union sockaddr_union *, int, int);
155 static int		 pfr_route_kentry(struct pfr_ktable *,
156 			    struct pfr_kentry *);
157 static int		 pfr_unroute_kentry(struct pfr_ktable *,
158 			    struct pfr_kentry *);
159 static int		 pfr_walktree(struct radix_node *, void *);
160 static int		 pfr_validate_table(struct pfr_table *, int, int);
161 static int		 pfr_fix_anchor(char *);
162 static void		 pfr_commit_ktable(struct pfr_ktable *, long);
163 static void		 pfr_insert_ktables(struct pfr_ktableworkq *);
164 static void		 pfr_insert_ktable(struct pfr_ktable *);
165 static void		 pfr_setflags_ktables(struct pfr_ktableworkq *);
166 static void		 pfr_setflags_ktable(struct pfr_ktable *, int);
167 static void		 pfr_clstats_ktables(struct pfr_ktableworkq *, long,
168 			    int);
169 static void		 pfr_clstats_ktable(struct pfr_ktable *, long, int);
170 static struct pfr_ktable
171 			*pfr_create_ktable(struct pfr_table *, long, int);
172 static void		 pfr_destroy_ktables(struct pfr_ktableworkq *, int);
173 static void		 pfr_destroy_ktable(struct pfr_ktable *, int);
174 static int		 pfr_ktable_compare(struct pfr_ktable *,
175 			    struct pfr_ktable *);
176 static struct pfr_ktable
177 			*pfr_lookup_table(struct pfr_table *);
178 static void		 pfr_clean_node_mask(struct pfr_ktable *,
179 			    struct pfr_kentryworkq *);
180 static int		 pfr_table_count(struct pfr_table *, int);
181 static int		 pfr_skip_table(struct pfr_table *,
182 			    struct pfr_ktable *, int);
183 static struct pfr_kentry
184 			*pfr_kentry_byidx(struct pfr_ktable *, int, int);
185 
186 static RB_PROTOTYPE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
187 static RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
188 
189 static VNET_DEFINE(struct pfr_ktablehead, pfr_ktables);
190 #define	V_pfr_ktables	VNET(pfr_ktables)
191 
192 static VNET_DEFINE(struct pfr_table, pfr_nulltable);
193 #define	V_pfr_nulltable	VNET(pfr_nulltable)
194 
195 static VNET_DEFINE(int, pfr_ktable_cnt);
196 #define V_pfr_ktable_cnt	VNET(pfr_ktable_cnt)
197 
198 void
199 pfr_initialize(void)
200 {
201 
202 	V_pfr_kentry_z = uma_zcreate("pf table entries",
203 	    sizeof(struct pfr_kentry), NULL, NULL, NULL, NULL, UMA_ALIGN_PTR,
204 	    0);
205 	V_pfr_kcounters_z = uma_zcreate("pf table counters",
206 	    sizeof(struct pfr_kcounters), NULL, NULL, NULL, NULL,
207 	    UMA_ALIGN_PTR, 0);
208 	V_pf_limits[PF_LIMIT_TABLE_ENTRIES].zone = V_pfr_kentry_z;
209 	V_pf_limits[PF_LIMIT_TABLE_ENTRIES].limit = PFR_KENTRY_HIWAT;
210 }
211 
212 void
213 pfr_cleanup(void)
214 {
215 
216 	uma_zdestroy(V_pfr_kentry_z);
217 	uma_zdestroy(V_pfr_kcounters_z);
218 }
219 
220 int
221 pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags)
222 {
223 	struct pfr_ktable	*kt;
224 	struct pfr_kentryworkq	 workq;
225 
226 	PF_RULES_WASSERT();
227 
228 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
229 	if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
230 		return (EINVAL);
231 	kt = pfr_lookup_table(tbl);
232 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
233 		return (ESRCH);
234 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
235 		return (EPERM);
236 	pfr_enqueue_addrs(kt, &workq, ndel, 0);
237 
238 	if (!(flags & PFR_FLAG_DUMMY)) {
239 		pfr_remove_kentries(kt, &workq);
240 		KASSERT(kt->pfrkt_cnt == 0, ("%s: non-null pfrkt_cnt", __func__));
241 	}
242 	return (0);
243 }
244 
245 int
246 pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
247     int *nadd, int flags)
248 {
249 	struct pfr_ktable	*kt, *tmpkt;
250 	struct pfr_kentryworkq	 workq;
251 	struct pfr_kentry	*p, *q;
252 	struct pfr_addr		*ad;
253 	int			 i, rv, xadd = 0;
254 	long			 tzero = time_second;
255 
256 	PF_RULES_WASSERT();
257 
258 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
259 	if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
260 		return (EINVAL);
261 	kt = pfr_lookup_table(tbl);
262 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
263 		return (ESRCH);
264 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
265 		return (EPERM);
266 	tmpkt = pfr_create_ktable(&V_pfr_nulltable, 0, 0);
267 	if (tmpkt == NULL)
268 		return (ENOMEM);
269 	SLIST_INIT(&workq);
270 	for (i = 0, ad = addr; i < size; i++, ad++) {
271 		if (pfr_validate_addr(ad))
272 			senderr(EINVAL);
273 		p = pfr_lookup_addr(kt, ad, 1);
274 		q = pfr_lookup_addr(tmpkt, ad, 1);
275 		if (flags & PFR_FLAG_FEEDBACK) {
276 			if (q != NULL)
277 				ad->pfra_fback = PFR_FB_DUPLICATE;
278 			else if (p == NULL)
279 				ad->pfra_fback = PFR_FB_ADDED;
280 			else if (p->pfrke_not != ad->pfra_not)
281 				ad->pfra_fback = PFR_FB_CONFLICT;
282 			else
283 				ad->pfra_fback = PFR_FB_NONE;
284 		}
285 		if (p == NULL && q == NULL) {
286 			p = pfr_create_kentry(ad);
287 			if (p == NULL)
288 				senderr(ENOMEM);
289 			if (pfr_route_kentry(tmpkt, p)) {
290 				pfr_destroy_kentry(p);
291 				ad->pfra_fback = PFR_FB_NONE;
292 			} else {
293 				SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
294 				xadd++;
295 			}
296 		}
297 	}
298 	pfr_clean_node_mask(tmpkt, &workq);
299 	if (!(flags & PFR_FLAG_DUMMY))
300 		pfr_insert_kentries(kt, &workq, tzero);
301 	else
302 		pfr_destroy_kentries(&workq);
303 	if (nadd != NULL)
304 		*nadd = xadd;
305 	pfr_destroy_ktable(tmpkt, 0);
306 	return (0);
307 _bad:
308 	pfr_clean_node_mask(tmpkt, &workq);
309 	pfr_destroy_kentries(&workq);
310 	if (flags & PFR_FLAG_FEEDBACK)
311 		pfr_reset_feedback(addr, size);
312 	pfr_destroy_ktable(tmpkt, 0);
313 	return (rv);
314 }
315 
316 int
317 pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
318     int *ndel, int flags)
319 {
320 	struct pfr_ktable	*kt;
321 	struct pfr_kentryworkq	 workq;
322 	struct pfr_kentry	*p;
323 	struct pfr_addr		*ad;
324 	int			 i, rv, xdel = 0, log = 1;
325 
326 	PF_RULES_WASSERT();
327 
328 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
329 	if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
330 		return (EINVAL);
331 	kt = pfr_lookup_table(tbl);
332 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
333 		return (ESRCH);
334 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
335 		return (EPERM);
336 	/*
337 	 * there are two algorithms to choose from here.
338 	 * with:
339 	 *   n: number of addresses to delete
340 	 *   N: number of addresses in the table
341 	 *
342 	 * one is O(N) and is better for large 'n'
343 	 * one is O(n*LOG(N)) and is better for small 'n'
344 	 *
345 	 * following code try to decide which one is best.
346 	 */
347 	for (i = kt->pfrkt_cnt; i > 0; i >>= 1)
348 		log++;
349 	if (size > kt->pfrkt_cnt/log) {
350 		/* full table scan */
351 		pfr_mark_addrs(kt);
352 	} else {
353 		/* iterate over addresses to delete */
354 		for (i = 0, ad = addr; i < size; i++, ad++) {
355 			if (pfr_validate_addr(ad))
356 				return (EINVAL);
357 			p = pfr_lookup_addr(kt, ad, 1);
358 			if (p != NULL)
359 				p->pfrke_mark = 0;
360 		}
361 	}
362 	SLIST_INIT(&workq);
363 	for (i = 0, ad = addr; i < size; i++, ad++) {
364 		if (pfr_validate_addr(ad))
365 			senderr(EINVAL);
366 		p = pfr_lookup_addr(kt, ad, 1);
367 		if (flags & PFR_FLAG_FEEDBACK) {
368 			if (p == NULL)
369 				ad->pfra_fback = PFR_FB_NONE;
370 			else if (p->pfrke_not != ad->pfra_not)
371 				ad->pfra_fback = PFR_FB_CONFLICT;
372 			else if (p->pfrke_mark)
373 				ad->pfra_fback = PFR_FB_DUPLICATE;
374 			else
375 				ad->pfra_fback = PFR_FB_DELETED;
376 		}
377 		if (p != NULL && p->pfrke_not == ad->pfra_not &&
378 		    !p->pfrke_mark) {
379 			p->pfrke_mark = 1;
380 			SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
381 			xdel++;
382 		}
383 	}
384 	if (!(flags & PFR_FLAG_DUMMY))
385 		pfr_remove_kentries(kt, &workq);
386 	if (ndel != NULL)
387 		*ndel = xdel;
388 	return (0);
389 _bad:
390 	if (flags & PFR_FLAG_FEEDBACK)
391 		pfr_reset_feedback(addr, size);
392 	return (rv);
393 }
394 
395 int
396 pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
397     int *size2, int *nadd, int *ndel, int *nchange, int flags,
398     u_int32_t ignore_pfrt_flags)
399 {
400 	struct pfr_ktable	*kt, *tmpkt;
401 	struct pfr_kentryworkq	 addq, delq, changeq;
402 	struct pfr_kentry	*p, *q;
403 	struct pfr_addr		 ad;
404 	int			 i, rv, xadd = 0, xdel = 0, xchange = 0;
405 	long			 tzero = time_second;
406 
407 	PF_RULES_WASSERT();
408 
409 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
410 	if (pfr_validate_table(tbl, ignore_pfrt_flags, flags &
411 	    PFR_FLAG_USERIOCTL))
412 		return (EINVAL);
413 	kt = pfr_lookup_table(tbl);
414 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
415 		return (ESRCH);
416 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
417 		return (EPERM);
418 	tmpkt = pfr_create_ktable(&V_pfr_nulltable, 0, 0);
419 	if (tmpkt == NULL)
420 		return (ENOMEM);
421 	pfr_mark_addrs(kt);
422 	SLIST_INIT(&addq);
423 	SLIST_INIT(&delq);
424 	SLIST_INIT(&changeq);
425 	for (i = 0; i < size; i++) {
426 		/*
427 		 * XXXGL: undertand pf_if usage of this function
428 		 * and make ad a moving pointer
429 		 */
430 		bcopy(addr + i, &ad, sizeof(ad));
431 		if (pfr_validate_addr(&ad))
432 			senderr(EINVAL);
433 		ad.pfra_fback = PFR_FB_NONE;
434 		p = pfr_lookup_addr(kt, &ad, 1);
435 		if (p != NULL) {
436 			if (p->pfrke_mark) {
437 				ad.pfra_fback = PFR_FB_DUPLICATE;
438 				goto _skip;
439 			}
440 			p->pfrke_mark = 1;
441 			if (p->pfrke_not != ad.pfra_not) {
442 				SLIST_INSERT_HEAD(&changeq, p, pfrke_workq);
443 				ad.pfra_fback = PFR_FB_CHANGED;
444 				xchange++;
445 			}
446 		} else {
447 			q = pfr_lookup_addr(tmpkt, &ad, 1);
448 			if (q != NULL) {
449 				ad.pfra_fback = PFR_FB_DUPLICATE;
450 				goto _skip;
451 			}
452 			p = pfr_create_kentry(&ad);
453 			if (p == NULL)
454 				senderr(ENOMEM);
455 			if (pfr_route_kentry(tmpkt, p)) {
456 				pfr_destroy_kentry(p);
457 				ad.pfra_fback = PFR_FB_NONE;
458 			} else {
459 				SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
460 				ad.pfra_fback = PFR_FB_ADDED;
461 				xadd++;
462 			}
463 		}
464 _skip:
465 		if (flags & PFR_FLAG_FEEDBACK)
466 			bcopy(&ad, addr + i, sizeof(ad));
467 	}
468 	pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY);
469 	if ((flags & PFR_FLAG_FEEDBACK) && *size2) {
470 		if (*size2 < size+xdel) {
471 			*size2 = size+xdel;
472 			senderr(0);
473 		}
474 		i = 0;
475 		SLIST_FOREACH(p, &delq, pfrke_workq) {
476 			pfr_copyout_addr(&ad, p);
477 			ad.pfra_fback = PFR_FB_DELETED;
478 			bcopy(&ad, addr + size + i, sizeof(ad));
479 			i++;
480 		}
481 	}
482 	pfr_clean_node_mask(tmpkt, &addq);
483 	if (!(flags & PFR_FLAG_DUMMY)) {
484 		pfr_insert_kentries(kt, &addq, tzero);
485 		pfr_remove_kentries(kt, &delq);
486 		pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
487 	} else
488 		pfr_destroy_kentries(&addq);
489 	if (nadd != NULL)
490 		*nadd = xadd;
491 	if (ndel != NULL)
492 		*ndel = xdel;
493 	if (nchange != NULL)
494 		*nchange = xchange;
495 	if ((flags & PFR_FLAG_FEEDBACK) && size2)
496 		*size2 = size+xdel;
497 	pfr_destroy_ktable(tmpkt, 0);
498 	return (0);
499 _bad:
500 	pfr_clean_node_mask(tmpkt, &addq);
501 	pfr_destroy_kentries(&addq);
502 	if (flags & PFR_FLAG_FEEDBACK)
503 		pfr_reset_feedback(addr, size);
504 	pfr_destroy_ktable(tmpkt, 0);
505 	return (rv);
506 }
507 
508 int
509 pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
510 	int *nmatch, int flags)
511 {
512 	struct pfr_ktable	*kt;
513 	struct pfr_kentry	*p;
514 	struct pfr_addr		*ad;
515 	int			 i, xmatch = 0;
516 
517 	PF_RULES_RASSERT();
518 
519 	ACCEPT_FLAGS(flags, PFR_FLAG_REPLACE);
520 	if (pfr_validate_table(tbl, 0, 0))
521 		return (EINVAL);
522 	kt = pfr_lookup_table(tbl);
523 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
524 		return (ESRCH);
525 
526 	for (i = 0, ad = addr; i < size; i++, ad++) {
527 		if (pfr_validate_addr(ad))
528 			return (EINVAL);
529 		if (ADDR_NETWORK(ad))
530 			return (EINVAL);
531 		p = pfr_lookup_addr(kt, ad, 0);
532 		if (flags & PFR_FLAG_REPLACE)
533 			pfr_copyout_addr(ad, p);
534 		ad->pfra_fback = (p == NULL) ? PFR_FB_NONE :
535 		    (p->pfrke_not ? PFR_FB_NOTMATCH : PFR_FB_MATCH);
536 		if (p != NULL && !p->pfrke_not)
537 			xmatch++;
538 	}
539 	if (nmatch != NULL)
540 		*nmatch = xmatch;
541 	return (0);
542 }
543 
544 int
545 pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size,
546 	int flags)
547 {
548 	struct pfr_ktable	*kt;
549 	struct pfr_walktree	 w;
550 	int			 rv;
551 
552 	PF_RULES_RASSERT();
553 
554 	ACCEPT_FLAGS(flags, 0);
555 	if (pfr_validate_table(tbl, 0, 0))
556 		return (EINVAL);
557 	kt = pfr_lookup_table(tbl);
558 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
559 		return (ESRCH);
560 	if (kt->pfrkt_cnt > *size) {
561 		*size = kt->pfrkt_cnt;
562 		return (0);
563 	}
564 
565 	bzero(&w, sizeof(w));
566 	w.pfrw_op = PFRW_GET_ADDRS;
567 	w.pfrw_addr = addr;
568 	w.pfrw_free = kt->pfrkt_cnt;
569 	rv = kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
570 	if (!rv)
571 		rv = kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh,
572 		    pfr_walktree, &w);
573 	if (rv)
574 		return (rv);
575 
576 	KASSERT(w.pfrw_free == 0, ("%s: corruption detected (%d)", __func__,
577 	    w.pfrw_free));
578 
579 	*size = kt->pfrkt_cnt;
580 	return (0);
581 }
582 
583 int
584 pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size,
585 	int flags)
586 {
587 	struct pfr_ktable	*kt;
588 	struct pfr_walktree	 w;
589 	struct pfr_kentryworkq	 workq;
590 	int			 rv;
591 	long			 tzero = time_second;
592 
593 	PF_RULES_RASSERT();
594 
595 	/* XXX PFR_FLAG_CLSTATS disabled */
596 	ACCEPT_FLAGS(flags, 0);
597 	if (pfr_validate_table(tbl, 0, 0))
598 		return (EINVAL);
599 	kt = pfr_lookup_table(tbl);
600 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
601 		return (ESRCH);
602 	if (kt->pfrkt_cnt > *size) {
603 		*size = kt->pfrkt_cnt;
604 		return (0);
605 	}
606 
607 	bzero(&w, sizeof(w));
608 	w.pfrw_op = PFRW_GET_ASTATS;
609 	w.pfrw_astats = addr;
610 	w.pfrw_free = kt->pfrkt_cnt;
611 	rv = kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
612 	if (!rv)
613 		rv = kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh,
614 		    pfr_walktree, &w);
615 	if (!rv && (flags & PFR_FLAG_CLSTATS)) {
616 		pfr_enqueue_addrs(kt, &workq, NULL, 0);
617 		pfr_clstats_kentries(&workq, tzero, 0);
618 	}
619 	if (rv)
620 		return (rv);
621 
622 	if (w.pfrw_free) {
623 		printf("pfr_get_astats: corruption detected (%d).\n",
624 		    w.pfrw_free);
625 		return (ENOTTY);
626 	}
627 	*size = kt->pfrkt_cnt;
628 	return (0);
629 }
630 
631 int
632 pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size,
633     int *nzero, int flags)
634 {
635 	struct pfr_ktable	*kt;
636 	struct pfr_kentryworkq	 workq;
637 	struct pfr_kentry	*p;
638 	struct pfr_addr		*ad;
639 	int			 i, rv, xzero = 0;
640 
641 	PF_RULES_WASSERT();
642 
643 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
644 	if (pfr_validate_table(tbl, 0, 0))
645 		return (EINVAL);
646 	kt = pfr_lookup_table(tbl);
647 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
648 		return (ESRCH);
649 	SLIST_INIT(&workq);
650 	for (i = 0, ad = addr; i < size; i++, ad++) {
651 		if (pfr_validate_addr(ad))
652 			senderr(EINVAL);
653 		p = pfr_lookup_addr(kt, ad, 1);
654 		if (flags & PFR_FLAG_FEEDBACK) {
655 			ad->pfra_fback = (p != NULL) ?
656 			    PFR_FB_CLEARED : PFR_FB_NONE;
657 		}
658 		if (p != NULL) {
659 			SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
660 			xzero++;
661 		}
662 	}
663 
664 	if (!(flags & PFR_FLAG_DUMMY))
665 		pfr_clstats_kentries(&workq, 0, 0);
666 	if (nzero != NULL)
667 		*nzero = xzero;
668 	return (0);
669 _bad:
670 	if (flags & PFR_FLAG_FEEDBACK)
671 		pfr_reset_feedback(addr, size);
672 	return (rv);
673 }
674 
675 static int
676 pfr_validate_addr(struct pfr_addr *ad)
677 {
678 	int i;
679 
680 	switch (ad->pfra_af) {
681 #ifdef INET
682 	case AF_INET:
683 		if (ad->pfra_net > 32)
684 			return (-1);
685 		break;
686 #endif /* INET */
687 #ifdef INET6
688 	case AF_INET6:
689 		if (ad->pfra_net > 128)
690 			return (-1);
691 		break;
692 #endif /* INET6 */
693 	default:
694 		return (-1);
695 	}
696 	if (ad->pfra_net < 128 &&
697 		(((caddr_t)ad)[ad->pfra_net/8] & (0xFF >> (ad->pfra_net%8))))
698 			return (-1);
699 	for (i = (ad->pfra_net+7)/8; i < sizeof(ad->pfra_u); i++)
700 		if (((caddr_t)ad)[i])
701 			return (-1);
702 	if (ad->pfra_not && ad->pfra_not != 1)
703 		return (-1);
704 	if (ad->pfra_fback)
705 		return (-1);
706 	return (0);
707 }
708 
709 static void
710 pfr_enqueue_addrs(struct pfr_ktable *kt, struct pfr_kentryworkq *workq,
711 	int *naddr, int sweep)
712 {
713 	struct pfr_walktree	w;
714 
715 	SLIST_INIT(workq);
716 	bzero(&w, sizeof(w));
717 	w.pfrw_op = sweep ? PFRW_SWEEP : PFRW_ENQUEUE;
718 	w.pfrw_workq = workq;
719 	if (kt->pfrkt_ip4 != NULL)
720 		if (kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh,
721 		    pfr_walktree, &w))
722 			printf("pfr_enqueue_addrs: IPv4 walktree failed.\n");
723 	if (kt->pfrkt_ip6 != NULL)
724 		if (kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh,
725 		    pfr_walktree, &w))
726 			printf("pfr_enqueue_addrs: IPv6 walktree failed.\n");
727 	if (naddr != NULL)
728 		*naddr = w.pfrw_cnt;
729 }
730 
731 static void
732 pfr_mark_addrs(struct pfr_ktable *kt)
733 {
734 	struct pfr_walktree	w;
735 
736 	bzero(&w, sizeof(w));
737 	w.pfrw_op = PFRW_MARK;
738 	if (kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w))
739 		printf("pfr_mark_addrs: IPv4 walktree failed.\n");
740 	if (kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w))
741 		printf("pfr_mark_addrs: IPv6 walktree failed.\n");
742 }
743 
744 
745 static struct pfr_kentry *
746 pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact)
747 {
748 	union sockaddr_union	 sa, mask;
749 	struct radix_head	*head = NULL;
750 	struct pfr_kentry	*ke;
751 
752 	PF_RULES_ASSERT();
753 
754 	bzero(&sa, sizeof(sa));
755 	if (ad->pfra_af == AF_INET) {
756 		FILLIN_SIN(sa.sin, ad->pfra_ip4addr);
757 		head = &kt->pfrkt_ip4->rh;
758 	} else if ( ad->pfra_af == AF_INET6 ) {
759 		FILLIN_SIN6(sa.sin6, ad->pfra_ip6addr);
760 		head = &kt->pfrkt_ip6->rh;
761 	}
762 	if (ADDR_NETWORK(ad)) {
763 		pfr_prepare_network(&mask, ad->pfra_af, ad->pfra_net);
764 		ke = (struct pfr_kentry *)rn_lookup(&sa, &mask, head);
765 		if (ke && KENTRY_RNF_ROOT(ke))
766 			ke = NULL;
767 	} else {
768 		ke = (struct pfr_kentry *)rn_match(&sa, head);
769 		if (ke && KENTRY_RNF_ROOT(ke))
770 			ke = NULL;
771 		if (exact && ke && KENTRY_NETWORK(ke))
772 			ke = NULL;
773 	}
774 	return (ke);
775 }
776 
777 static struct pfr_kentry *
778 pfr_create_kentry(struct pfr_addr *ad)
779 {
780 	struct pfr_kentry	*ke;
781 
782 	ke =  uma_zalloc(V_pfr_kentry_z, M_NOWAIT | M_ZERO);
783 	if (ke == NULL)
784 		return (NULL);
785 
786 	if (ad->pfra_af == AF_INET)
787 		FILLIN_SIN(ke->pfrke_sa.sin, ad->pfra_ip4addr);
788 	else if (ad->pfra_af == AF_INET6)
789 		FILLIN_SIN6(ke->pfrke_sa.sin6, ad->pfra_ip6addr);
790 	ke->pfrke_af = ad->pfra_af;
791 	ke->pfrke_net = ad->pfra_net;
792 	ke->pfrke_not = ad->pfra_not;
793 	return (ke);
794 }
795 
796 static void
797 pfr_destroy_kentries(struct pfr_kentryworkq *workq)
798 {
799 	struct pfr_kentry	*p, *q;
800 
801 	for (p = SLIST_FIRST(workq); p != NULL; p = q) {
802 		q = SLIST_NEXT(p, pfrke_workq);
803 		pfr_destroy_kentry(p);
804 	}
805 }
806 
807 static void
808 pfr_destroy_kentry(struct pfr_kentry *ke)
809 {
810 	if (ke->pfrke_counters)
811 		uma_zfree(V_pfr_kcounters_z, ke->pfrke_counters);
812 	uma_zfree(V_pfr_kentry_z, ke);
813 }
814 
815 static void
816 pfr_insert_kentries(struct pfr_ktable *kt,
817     struct pfr_kentryworkq *workq, long tzero)
818 {
819 	struct pfr_kentry	*p;
820 	int			 rv, n = 0;
821 
822 	SLIST_FOREACH(p, workq, pfrke_workq) {
823 		rv = pfr_route_kentry(kt, p);
824 		if (rv) {
825 			printf("pfr_insert_kentries: cannot route entry "
826 			    "(code=%d).\n", rv);
827 			break;
828 		}
829 		p->pfrke_tzero = tzero;
830 		n++;
831 	}
832 	kt->pfrkt_cnt += n;
833 }
834 
835 int
836 pfr_insert_kentry(struct pfr_ktable *kt, struct pfr_addr *ad, long tzero)
837 {
838 	struct pfr_kentry	*p;
839 	int			 rv;
840 
841 	p = pfr_lookup_addr(kt, ad, 1);
842 	if (p != NULL)
843 		return (0);
844 	p = pfr_create_kentry(ad);
845 	if (p == NULL)
846 		return (ENOMEM);
847 
848 	rv = pfr_route_kentry(kt, p);
849 	if (rv)
850 		return (rv);
851 
852 	p->pfrke_tzero = tzero;
853 	kt->pfrkt_cnt++;
854 
855 	return (0);
856 }
857 
858 static void
859 pfr_remove_kentries(struct pfr_ktable *kt,
860     struct pfr_kentryworkq *workq)
861 {
862 	struct pfr_kentry	*p;
863 	int			 n = 0;
864 
865 	SLIST_FOREACH(p, workq, pfrke_workq) {
866 		pfr_unroute_kentry(kt, p);
867 		n++;
868 	}
869 	kt->pfrkt_cnt -= n;
870 	pfr_destroy_kentries(workq);
871 }
872 
873 static void
874 pfr_clean_node_mask(struct pfr_ktable *kt,
875     struct pfr_kentryworkq *workq)
876 {
877 	struct pfr_kentry	*p;
878 
879 	SLIST_FOREACH(p, workq, pfrke_workq)
880 		pfr_unroute_kentry(kt, p);
881 }
882 
883 static void
884 pfr_clstats_kentries(struct pfr_kentryworkq *workq, long tzero, int negchange)
885 {
886 	struct pfr_kentry	*p;
887 
888 	SLIST_FOREACH(p, workq, pfrke_workq) {
889 		if (negchange)
890 			p->pfrke_not = !p->pfrke_not;
891 		if (p->pfrke_counters) {
892 			uma_zfree(V_pfr_kcounters_z, p->pfrke_counters);
893 			p->pfrke_counters = NULL;
894 		}
895 		p->pfrke_tzero = tzero;
896 	}
897 }
898 
899 static void
900 pfr_reset_feedback(struct pfr_addr *addr, int size)
901 {
902 	struct pfr_addr	*ad;
903 	int		i;
904 
905 	for (i = 0, ad = addr; i < size; i++, ad++)
906 		ad->pfra_fback = PFR_FB_NONE;
907 }
908 
909 static void
910 pfr_prepare_network(union sockaddr_union *sa, int af, int net)
911 {
912 	int	i;
913 
914 	bzero(sa, sizeof(*sa));
915 	if (af == AF_INET) {
916 		sa->sin.sin_len = sizeof(sa->sin);
917 		sa->sin.sin_family = AF_INET;
918 		sa->sin.sin_addr.s_addr = net ? htonl(-1 << (32-net)) : 0;
919 	} else if (af == AF_INET6) {
920 		sa->sin6.sin6_len = sizeof(sa->sin6);
921 		sa->sin6.sin6_family = AF_INET6;
922 		for (i = 0; i < 4; i++) {
923 			if (net <= 32) {
924 				sa->sin6.sin6_addr.s6_addr32[i] =
925 				    net ? htonl(-1 << (32-net)) : 0;
926 				break;
927 			}
928 			sa->sin6.sin6_addr.s6_addr32[i] = 0xFFFFFFFF;
929 			net -= 32;
930 		}
931 	}
932 }
933 
934 static int
935 pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
936 {
937 	union sockaddr_union	 mask;
938 	struct radix_node	*rn;
939 	struct radix_head	*head = NULL;
940 
941 	PF_RULES_WASSERT();
942 
943 	bzero(ke->pfrke_node, sizeof(ke->pfrke_node));
944 	if (ke->pfrke_af == AF_INET)
945 		head = &kt->pfrkt_ip4->rh;
946 	else if (ke->pfrke_af == AF_INET6)
947 		head = &kt->pfrkt_ip6->rh;
948 
949 	if (KENTRY_NETWORK(ke)) {
950 		pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
951 		rn = rn_addroute(&ke->pfrke_sa, &mask, head, ke->pfrke_node);
952 	} else
953 		rn = rn_addroute(&ke->pfrke_sa, NULL, head, ke->pfrke_node);
954 
955 	return (rn == NULL ? -1 : 0);
956 }
957 
958 static int
959 pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
960 {
961 	union sockaddr_union	 mask;
962 	struct radix_node	*rn;
963 	struct radix_head	*head = NULL;
964 
965 	if (ke->pfrke_af == AF_INET)
966 		head = &kt->pfrkt_ip4->rh;
967 	else if (ke->pfrke_af == AF_INET6)
968 		head = &kt->pfrkt_ip6->rh;
969 
970 	if (KENTRY_NETWORK(ke)) {
971 		pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
972 		rn = rn_delete(&ke->pfrke_sa, &mask, head);
973 	} else
974 		rn = rn_delete(&ke->pfrke_sa, NULL, head);
975 
976 	if (rn == NULL) {
977 		printf("pfr_unroute_kentry: delete failed.\n");
978 		return (-1);
979 	}
980 	return (0);
981 }
982 
983 static void
984 pfr_copyout_addr(struct pfr_addr *ad, struct pfr_kentry *ke)
985 {
986 	bzero(ad, sizeof(*ad));
987 	if (ke == NULL)
988 		return;
989 	ad->pfra_af = ke->pfrke_af;
990 	ad->pfra_net = ke->pfrke_net;
991 	ad->pfra_not = ke->pfrke_not;
992 	if (ad->pfra_af == AF_INET)
993 		ad->pfra_ip4addr = ke->pfrke_sa.sin.sin_addr;
994 	else if (ad->pfra_af == AF_INET6)
995 		ad->pfra_ip6addr = ke->pfrke_sa.sin6.sin6_addr;
996 }
997 
998 static int
999 pfr_walktree(struct radix_node *rn, void *arg)
1000 {
1001 	struct pfr_kentry	*ke = (struct pfr_kentry *)rn;
1002 	struct pfr_walktree	*w = arg;
1003 
1004 	switch (w->pfrw_op) {
1005 	case PFRW_MARK:
1006 		ke->pfrke_mark = 0;
1007 		break;
1008 	case PFRW_SWEEP:
1009 		if (ke->pfrke_mark)
1010 			break;
1011 		/* FALLTHROUGH */
1012 	case PFRW_ENQUEUE:
1013 		SLIST_INSERT_HEAD(w->pfrw_workq, ke, pfrke_workq);
1014 		w->pfrw_cnt++;
1015 		break;
1016 	case PFRW_GET_ADDRS:
1017 		if (w->pfrw_free-- > 0) {
1018 			pfr_copyout_addr(w->pfrw_addr, ke);
1019 			w->pfrw_addr++;
1020 		}
1021 		break;
1022 	case PFRW_GET_ASTATS:
1023 		if (w->pfrw_free-- > 0) {
1024 			struct pfr_astats as;
1025 
1026 			pfr_copyout_addr(&as.pfras_a, ke);
1027 
1028 			if (ke->pfrke_counters) {
1029 				bcopy(ke->pfrke_counters->pfrkc_packets,
1030 				    as.pfras_packets, sizeof(as.pfras_packets));
1031 				bcopy(ke->pfrke_counters->pfrkc_bytes,
1032 				    as.pfras_bytes, sizeof(as.pfras_bytes));
1033 			} else {
1034 				bzero(as.pfras_packets, sizeof(as.pfras_packets));
1035 				bzero(as.pfras_bytes, sizeof(as.pfras_bytes));
1036 				as.pfras_a.pfra_fback = PFR_FB_NOCOUNT;
1037 			}
1038 			as.pfras_tzero = ke->pfrke_tzero;
1039 
1040 			bcopy(&as, w->pfrw_astats, sizeof(as));
1041 			w->pfrw_astats++;
1042 		}
1043 		break;
1044 	case PFRW_POOL_GET:
1045 		if (ke->pfrke_not)
1046 			break; /* negative entries are ignored */
1047 		if (!w->pfrw_cnt--) {
1048 			w->pfrw_kentry = ke;
1049 			return (1); /* finish search */
1050 		}
1051 		break;
1052 	case PFRW_DYNADDR_UPDATE:
1053 	    {
1054 		union sockaddr_union	pfr_mask;
1055 
1056 		if (ke->pfrke_af == AF_INET) {
1057 			if (w->pfrw_dyn->pfid_acnt4++ > 0)
1058 				break;
1059 			pfr_prepare_network(&pfr_mask, AF_INET, ke->pfrke_net);
1060 			w->pfrw_dyn->pfid_addr4 = *SUNION2PF(&ke->pfrke_sa,
1061 			    AF_INET);
1062 			w->pfrw_dyn->pfid_mask4 = *SUNION2PF(&pfr_mask,
1063 			    AF_INET);
1064 		} else if (ke->pfrke_af == AF_INET6){
1065 			if (w->pfrw_dyn->pfid_acnt6++ > 0)
1066 				break;
1067 			pfr_prepare_network(&pfr_mask, AF_INET6, ke->pfrke_net);
1068 			w->pfrw_dyn->pfid_addr6 = *SUNION2PF(&ke->pfrke_sa,
1069 			    AF_INET6);
1070 			w->pfrw_dyn->pfid_mask6 = *SUNION2PF(&pfr_mask,
1071 			    AF_INET6);
1072 		}
1073 		break;
1074 	    }
1075 	}
1076 	return (0);
1077 }
1078 
1079 int
1080 pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags)
1081 {
1082 	struct pfr_ktableworkq	 workq;
1083 	struct pfr_ktable	*p;
1084 	int			 xdel = 0;
1085 
1086 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ALLRSETS);
1087 	if (pfr_fix_anchor(filter->pfrt_anchor))
1088 		return (EINVAL);
1089 	if (pfr_table_count(filter, flags) < 0)
1090 		return (ENOENT);
1091 
1092 	SLIST_INIT(&workq);
1093 	RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {
1094 		if (pfr_skip_table(filter, p, flags))
1095 			continue;
1096 		if (!strcmp(p->pfrkt_anchor, PF_RESERVED_ANCHOR))
1097 			continue;
1098 		if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE))
1099 			continue;
1100 		p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1101 		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1102 		xdel++;
1103 	}
1104 	if (!(flags & PFR_FLAG_DUMMY))
1105 		pfr_setflags_ktables(&workq);
1106 	if (ndel != NULL)
1107 		*ndel = xdel;
1108 	return (0);
1109 }
1110 
1111 int
1112 pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags)
1113 {
1114 	struct pfr_ktableworkq	 addq, changeq;
1115 	struct pfr_ktable	*p, *q, *r, key;
1116 	int			 i, rv, xadd = 0;
1117 	long			 tzero = time_second;
1118 
1119 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1120 	SLIST_INIT(&addq);
1121 	SLIST_INIT(&changeq);
1122 	for (i = 0; i < size; i++) {
1123 		bcopy(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t));
1124 		if (pfr_validate_table(&key.pfrkt_t, PFR_TFLAG_USRMASK,
1125 		    flags & PFR_FLAG_USERIOCTL))
1126 			senderr(EINVAL);
1127 		key.pfrkt_flags |= PFR_TFLAG_ACTIVE;
1128 		p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);
1129 		if (p == NULL) {
1130 			p = pfr_create_ktable(&key.pfrkt_t, tzero, 1);
1131 			if (p == NULL)
1132 				senderr(ENOMEM);
1133 			SLIST_FOREACH(q, &addq, pfrkt_workq) {
1134 				if (!pfr_ktable_compare(p, q)) {
1135 					pfr_destroy_ktable(p, 0);
1136 					goto _skip;
1137 				}
1138 			}
1139 			SLIST_INSERT_HEAD(&addq, p, pfrkt_workq);
1140 			xadd++;
1141 			if (!key.pfrkt_anchor[0])
1142 				goto _skip;
1143 
1144 			/* find or create root table */
1145 			bzero(key.pfrkt_anchor, sizeof(key.pfrkt_anchor));
1146 			r = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);
1147 			if (r != NULL) {
1148 				p->pfrkt_root = r;
1149 				goto _skip;
1150 			}
1151 			SLIST_FOREACH(q, &addq, pfrkt_workq) {
1152 				if (!pfr_ktable_compare(&key, q)) {
1153 					p->pfrkt_root = q;
1154 					goto _skip;
1155 				}
1156 			}
1157 			key.pfrkt_flags = 0;
1158 			r = pfr_create_ktable(&key.pfrkt_t, 0, 1);
1159 			if (r == NULL)
1160 				senderr(ENOMEM);
1161 			SLIST_INSERT_HEAD(&addq, r, pfrkt_workq);
1162 			p->pfrkt_root = r;
1163 		} else if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1164 			SLIST_FOREACH(q, &changeq, pfrkt_workq)
1165 				if (!pfr_ktable_compare(&key, q))
1166 					goto _skip;
1167 			p->pfrkt_nflags = (p->pfrkt_flags &
1168 			    ~PFR_TFLAG_USRMASK) | key.pfrkt_flags;
1169 			SLIST_INSERT_HEAD(&changeq, p, pfrkt_workq);
1170 			xadd++;
1171 		}
1172 _skip:
1173 	;
1174 	}
1175 	if (!(flags & PFR_FLAG_DUMMY)) {
1176 		pfr_insert_ktables(&addq);
1177 		pfr_setflags_ktables(&changeq);
1178 	} else
1179 		 pfr_destroy_ktables(&addq, 0);
1180 	if (nadd != NULL)
1181 		*nadd = xadd;
1182 	return (0);
1183 _bad:
1184 	pfr_destroy_ktables(&addq, 0);
1185 	return (rv);
1186 }
1187 
1188 int
1189 pfr_del_tables(struct pfr_table *tbl, int size, int *ndel, int flags)
1190 {
1191 	struct pfr_ktableworkq	 workq;
1192 	struct pfr_ktable	*p, *q, key;
1193 	int			 i, xdel = 0;
1194 
1195 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1196 	SLIST_INIT(&workq);
1197 	for (i = 0; i < size; i++) {
1198 		bcopy(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t));
1199 		if (pfr_validate_table(&key.pfrkt_t, 0,
1200 		    flags & PFR_FLAG_USERIOCTL))
1201 			return (EINVAL);
1202 		p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);
1203 		if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1204 			SLIST_FOREACH(q, &workq, pfrkt_workq)
1205 				if (!pfr_ktable_compare(p, q))
1206 					goto _skip;
1207 			p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1208 			SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1209 			xdel++;
1210 		}
1211 _skip:
1212 	;
1213 	}
1214 
1215 	if (!(flags & PFR_FLAG_DUMMY))
1216 		pfr_setflags_ktables(&workq);
1217 	if (ndel != NULL)
1218 		*ndel = xdel;
1219 	return (0);
1220 }
1221 
1222 int
1223 pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size,
1224 	int flags)
1225 {
1226 	struct pfr_ktable	*p;
1227 	int			 n, nn;
1228 
1229 	PF_RULES_RASSERT();
1230 
1231 	ACCEPT_FLAGS(flags, PFR_FLAG_ALLRSETS);
1232 	if (pfr_fix_anchor(filter->pfrt_anchor))
1233 		return (EINVAL);
1234 	n = nn = pfr_table_count(filter, flags);
1235 	if (n < 0)
1236 		return (ENOENT);
1237 	if (n > *size) {
1238 		*size = n;
1239 		return (0);
1240 	}
1241 	RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {
1242 		if (pfr_skip_table(filter, p, flags))
1243 			continue;
1244 		if (n-- <= 0)
1245 			continue;
1246 		bcopy(&p->pfrkt_t, tbl++, sizeof(*tbl));
1247 	}
1248 
1249 	KASSERT(n == 0, ("%s: corruption detected (%d)", __func__, n));
1250 
1251 	*size = nn;
1252 	return (0);
1253 }
1254 
1255 int
1256 pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size,
1257 	int flags)
1258 {
1259 	struct pfr_ktable	*p;
1260 	struct pfr_ktableworkq	 workq;
1261 	int			 n, nn;
1262 	long			 tzero = time_second;
1263 
1264 	/* XXX PFR_FLAG_CLSTATS disabled */
1265 	ACCEPT_FLAGS(flags, PFR_FLAG_ALLRSETS);
1266 	if (pfr_fix_anchor(filter->pfrt_anchor))
1267 		return (EINVAL);
1268 	n = nn = pfr_table_count(filter, flags);
1269 	if (n < 0)
1270 		return (ENOENT);
1271 	if (n > *size) {
1272 		*size = n;
1273 		return (0);
1274 	}
1275 	SLIST_INIT(&workq);
1276 	RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {
1277 		if (pfr_skip_table(filter, p, flags))
1278 			continue;
1279 		if (n-- <= 0)
1280 			continue;
1281 		bcopy(&p->pfrkt_ts, tbl++, sizeof(*tbl));
1282 		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1283 	}
1284 	if (flags & PFR_FLAG_CLSTATS)
1285 		pfr_clstats_ktables(&workq, tzero,
1286 		    flags & PFR_FLAG_ADDRSTOO);
1287 
1288 	KASSERT(n == 0, ("%s: corruption detected (%d)", __func__, n));
1289 
1290 	*size = nn;
1291 	return (0);
1292 }
1293 
1294 int
1295 pfr_clr_tstats(struct pfr_table *tbl, int size, int *nzero, int flags)
1296 {
1297 	struct pfr_ktableworkq	 workq;
1298 	struct pfr_ktable	*p, key;
1299 	int			 i, xzero = 0;
1300 	long			 tzero = time_second;
1301 
1302 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ADDRSTOO);
1303 	SLIST_INIT(&workq);
1304 	for (i = 0; i < size; i++) {
1305 		bcopy(tbl + i, &key.pfrkt_t, sizeof(key.pfrkt_t));
1306 		if (pfr_validate_table(&key.pfrkt_t, 0, 0))
1307 			return (EINVAL);
1308 		p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);
1309 		if (p != NULL) {
1310 			SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1311 			xzero++;
1312 		}
1313 	}
1314 	if (!(flags & PFR_FLAG_DUMMY))
1315 		pfr_clstats_ktables(&workq, tzero, flags & PFR_FLAG_ADDRSTOO);
1316 	if (nzero != NULL)
1317 		*nzero = xzero;
1318 	return (0);
1319 }
1320 
1321 int
1322 pfr_set_tflags(struct pfr_table *tbl, int size, int setflag, int clrflag,
1323 	int *nchange, int *ndel, int flags)
1324 {
1325 	struct pfr_ktableworkq	 workq;
1326 	struct pfr_ktable	*p, *q, key;
1327 	int			 i, xchange = 0, xdel = 0;
1328 
1329 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1330 	if ((setflag & ~PFR_TFLAG_USRMASK) ||
1331 	    (clrflag & ~PFR_TFLAG_USRMASK) ||
1332 	    (setflag & clrflag))
1333 		return (EINVAL);
1334 	SLIST_INIT(&workq);
1335 	for (i = 0; i < size; i++) {
1336 		bcopy(tbl + i, &key.pfrkt_t, sizeof(key.pfrkt_t));
1337 		if (pfr_validate_table(&key.pfrkt_t, 0,
1338 		    flags & PFR_FLAG_USERIOCTL))
1339 			return (EINVAL);
1340 		p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);
1341 		if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1342 			p->pfrkt_nflags = (p->pfrkt_flags | setflag) &
1343 			    ~clrflag;
1344 			if (p->pfrkt_nflags == p->pfrkt_flags)
1345 				goto _skip;
1346 			SLIST_FOREACH(q, &workq, pfrkt_workq)
1347 				if (!pfr_ktable_compare(p, q))
1348 					goto _skip;
1349 			SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1350 			if ((p->pfrkt_flags & PFR_TFLAG_PERSIST) &&
1351 			    (clrflag & PFR_TFLAG_PERSIST) &&
1352 			    !(p->pfrkt_flags & PFR_TFLAG_REFERENCED))
1353 				xdel++;
1354 			else
1355 				xchange++;
1356 		}
1357 _skip:
1358 	;
1359 	}
1360 	if (!(flags & PFR_FLAG_DUMMY))
1361 		pfr_setflags_ktables(&workq);
1362 	if (nchange != NULL)
1363 		*nchange = xchange;
1364 	if (ndel != NULL)
1365 		*ndel = xdel;
1366 	return (0);
1367 }
1368 
1369 int
1370 pfr_ina_begin(struct pfr_table *trs, u_int32_t *ticket, int *ndel, int flags)
1371 {
1372 	struct pfr_ktableworkq	 workq;
1373 	struct pfr_ktable	*p;
1374 	struct pf_ruleset	*rs;
1375 	int			 xdel = 0;
1376 
1377 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1378 	rs = pf_find_or_create_ruleset(trs->pfrt_anchor);
1379 	if (rs == NULL)
1380 		return (ENOMEM);
1381 	SLIST_INIT(&workq);
1382 	RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {
1383 		if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1384 		    pfr_skip_table(trs, p, 0))
1385 			continue;
1386 		p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1387 		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1388 		xdel++;
1389 	}
1390 	if (!(flags & PFR_FLAG_DUMMY)) {
1391 		pfr_setflags_ktables(&workq);
1392 		if (ticket != NULL)
1393 			*ticket = ++rs->tticket;
1394 		rs->topen = 1;
1395 	} else
1396 		pf_remove_if_empty_ruleset(rs);
1397 	if (ndel != NULL)
1398 		*ndel = xdel;
1399 	return (0);
1400 }
1401 
1402 int
1403 pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size,
1404     int *nadd, int *naddr, u_int32_t ticket, int flags)
1405 {
1406 	struct pfr_ktableworkq	 tableq;
1407 	struct pfr_kentryworkq	 addrq;
1408 	struct pfr_ktable	*kt, *rt, *shadow, key;
1409 	struct pfr_kentry	*p;
1410 	struct pfr_addr		*ad;
1411 	struct pf_ruleset	*rs;
1412 	int			 i, rv, xadd = 0, xaddr = 0;
1413 
1414 	PF_RULES_WASSERT();
1415 
1416 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ADDRSTOO);
1417 	if (size && !(flags & PFR_FLAG_ADDRSTOO))
1418 		return (EINVAL);
1419 	if (pfr_validate_table(tbl, PFR_TFLAG_USRMASK,
1420 	    flags & PFR_FLAG_USERIOCTL))
1421 		return (EINVAL);
1422 	rs = pf_find_ruleset(tbl->pfrt_anchor);
1423 	if (rs == NULL || !rs->topen || ticket != rs->tticket)
1424 		return (EBUSY);
1425 	tbl->pfrt_flags |= PFR_TFLAG_INACTIVE;
1426 	SLIST_INIT(&tableq);
1427 	kt = RB_FIND(pfr_ktablehead, &V_pfr_ktables, (struct pfr_ktable *)tbl);
1428 	if (kt == NULL) {
1429 		kt = pfr_create_ktable(tbl, 0, 1);
1430 		if (kt == NULL)
1431 			return (ENOMEM);
1432 		SLIST_INSERT_HEAD(&tableq, kt, pfrkt_workq);
1433 		xadd++;
1434 		if (!tbl->pfrt_anchor[0])
1435 			goto _skip;
1436 
1437 		/* find or create root table */
1438 		bzero(&key, sizeof(key));
1439 		strlcpy(key.pfrkt_name, tbl->pfrt_name, sizeof(key.pfrkt_name));
1440 		rt = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);
1441 		if (rt != NULL) {
1442 			kt->pfrkt_root = rt;
1443 			goto _skip;
1444 		}
1445 		rt = pfr_create_ktable(&key.pfrkt_t, 0, 1);
1446 		if (rt == NULL) {
1447 			pfr_destroy_ktables(&tableq, 0);
1448 			return (ENOMEM);
1449 		}
1450 		SLIST_INSERT_HEAD(&tableq, rt, pfrkt_workq);
1451 		kt->pfrkt_root = rt;
1452 	} else if (!(kt->pfrkt_flags & PFR_TFLAG_INACTIVE))
1453 		xadd++;
1454 _skip:
1455 	shadow = pfr_create_ktable(tbl, 0, 0);
1456 	if (shadow == NULL) {
1457 		pfr_destroy_ktables(&tableq, 0);
1458 		return (ENOMEM);
1459 	}
1460 	SLIST_INIT(&addrq);
1461 	for (i = 0, ad = addr; i < size; i++, ad++) {
1462 		if (pfr_validate_addr(ad))
1463 			senderr(EINVAL);
1464 		if (pfr_lookup_addr(shadow, ad, 1) != NULL)
1465 			continue;
1466 		p = pfr_create_kentry(ad);
1467 		if (p == NULL)
1468 			senderr(ENOMEM);
1469 		if (pfr_route_kentry(shadow, p)) {
1470 			pfr_destroy_kentry(p);
1471 			continue;
1472 		}
1473 		SLIST_INSERT_HEAD(&addrq, p, pfrke_workq);
1474 		xaddr++;
1475 	}
1476 	if (!(flags & PFR_FLAG_DUMMY)) {
1477 		if (kt->pfrkt_shadow != NULL)
1478 			pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1479 		kt->pfrkt_flags |= PFR_TFLAG_INACTIVE;
1480 		pfr_insert_ktables(&tableq);
1481 		shadow->pfrkt_cnt = (flags & PFR_FLAG_ADDRSTOO) ?
1482 		    xaddr : NO_ADDRESSES;
1483 		kt->pfrkt_shadow = shadow;
1484 	} else {
1485 		pfr_clean_node_mask(shadow, &addrq);
1486 		pfr_destroy_ktable(shadow, 0);
1487 		pfr_destroy_ktables(&tableq, 0);
1488 		pfr_destroy_kentries(&addrq);
1489 	}
1490 	if (nadd != NULL)
1491 		*nadd = xadd;
1492 	if (naddr != NULL)
1493 		*naddr = xaddr;
1494 	return (0);
1495 _bad:
1496 	pfr_destroy_ktable(shadow, 0);
1497 	pfr_destroy_ktables(&tableq, 0);
1498 	pfr_destroy_kentries(&addrq);
1499 	return (rv);
1500 }
1501 
1502 int
1503 pfr_ina_rollback(struct pfr_table *trs, u_int32_t ticket, int *ndel, int flags)
1504 {
1505 	struct pfr_ktableworkq	 workq;
1506 	struct pfr_ktable	*p;
1507 	struct pf_ruleset	*rs;
1508 	int			 xdel = 0;
1509 
1510 	PF_RULES_WASSERT();
1511 
1512 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1513 	rs = pf_find_ruleset(trs->pfrt_anchor);
1514 	if (rs == NULL || !rs->topen || ticket != rs->tticket)
1515 		return (0);
1516 	SLIST_INIT(&workq);
1517 	RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {
1518 		if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1519 		    pfr_skip_table(trs, p, 0))
1520 			continue;
1521 		p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1522 		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1523 		xdel++;
1524 	}
1525 	if (!(flags & PFR_FLAG_DUMMY)) {
1526 		pfr_setflags_ktables(&workq);
1527 		rs->topen = 0;
1528 		pf_remove_if_empty_ruleset(rs);
1529 	}
1530 	if (ndel != NULL)
1531 		*ndel = xdel;
1532 	return (0);
1533 }
1534 
1535 int
1536 pfr_ina_commit(struct pfr_table *trs, u_int32_t ticket, int *nadd,
1537     int *nchange, int flags)
1538 {
1539 	struct pfr_ktable	*p, *q;
1540 	struct pfr_ktableworkq	 workq;
1541 	struct pf_ruleset	*rs;
1542 	int			 xadd = 0, xchange = 0;
1543 	long			 tzero = time_second;
1544 
1545 	PF_RULES_WASSERT();
1546 
1547 	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1548 	rs = pf_find_ruleset(trs->pfrt_anchor);
1549 	if (rs == NULL || !rs->topen || ticket != rs->tticket)
1550 		return (EBUSY);
1551 
1552 	SLIST_INIT(&workq);
1553 	RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {
1554 		if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1555 		    pfr_skip_table(trs, p, 0))
1556 			continue;
1557 		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1558 		if (p->pfrkt_flags & PFR_TFLAG_ACTIVE)
1559 			xchange++;
1560 		else
1561 			xadd++;
1562 	}
1563 
1564 	if (!(flags & PFR_FLAG_DUMMY)) {
1565 		for (p = SLIST_FIRST(&workq); p != NULL; p = q) {
1566 			q = SLIST_NEXT(p, pfrkt_workq);
1567 			pfr_commit_ktable(p, tzero);
1568 		}
1569 		rs->topen = 0;
1570 		pf_remove_if_empty_ruleset(rs);
1571 	}
1572 	if (nadd != NULL)
1573 		*nadd = xadd;
1574 	if (nchange != NULL)
1575 		*nchange = xchange;
1576 
1577 	return (0);
1578 }
1579 
1580 static void
1581 pfr_commit_ktable(struct pfr_ktable *kt, long tzero)
1582 {
1583 	struct pfr_ktable	*shadow = kt->pfrkt_shadow;
1584 	int			 nflags;
1585 
1586 	PF_RULES_WASSERT();
1587 
1588 	if (shadow->pfrkt_cnt == NO_ADDRESSES) {
1589 		if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1590 			pfr_clstats_ktable(kt, tzero, 1);
1591 	} else if (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) {
1592 		/* kt might contain addresses */
1593 		struct pfr_kentryworkq	 addrq, addq, changeq, delq, garbageq;
1594 		struct pfr_kentry	*p, *q, *next;
1595 		struct pfr_addr		 ad;
1596 
1597 		pfr_enqueue_addrs(shadow, &addrq, NULL, 0);
1598 		pfr_mark_addrs(kt);
1599 		SLIST_INIT(&addq);
1600 		SLIST_INIT(&changeq);
1601 		SLIST_INIT(&delq);
1602 		SLIST_INIT(&garbageq);
1603 		pfr_clean_node_mask(shadow, &addrq);
1604 		for (p = SLIST_FIRST(&addrq); p != NULL; p = next) {
1605 			next = SLIST_NEXT(p, pfrke_workq);	/* XXX */
1606 			pfr_copyout_addr(&ad, p);
1607 			q = pfr_lookup_addr(kt, &ad, 1);
1608 			if (q != NULL) {
1609 				if (q->pfrke_not != p->pfrke_not)
1610 					SLIST_INSERT_HEAD(&changeq, q,
1611 					    pfrke_workq);
1612 				q->pfrke_mark = 1;
1613 				SLIST_INSERT_HEAD(&garbageq, p, pfrke_workq);
1614 			} else {
1615 				p->pfrke_tzero = tzero;
1616 				SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
1617 			}
1618 		}
1619 		pfr_enqueue_addrs(kt, &delq, NULL, ENQUEUE_UNMARKED_ONLY);
1620 		pfr_insert_kentries(kt, &addq, tzero);
1621 		pfr_remove_kentries(kt, &delq);
1622 		pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
1623 		pfr_destroy_kentries(&garbageq);
1624 	} else {
1625 		/* kt cannot contain addresses */
1626 		SWAP(struct radix_node_head *, kt->pfrkt_ip4,
1627 		    shadow->pfrkt_ip4);
1628 		SWAP(struct radix_node_head *, kt->pfrkt_ip6,
1629 		    shadow->pfrkt_ip6);
1630 		SWAP(int, kt->pfrkt_cnt, shadow->pfrkt_cnt);
1631 		pfr_clstats_ktable(kt, tzero, 1);
1632 	}
1633 	nflags = ((shadow->pfrkt_flags & PFR_TFLAG_USRMASK) |
1634 	    (kt->pfrkt_flags & PFR_TFLAG_SETMASK) | PFR_TFLAG_ACTIVE)
1635 		& ~PFR_TFLAG_INACTIVE;
1636 	pfr_destroy_ktable(shadow, 0);
1637 	kt->pfrkt_shadow = NULL;
1638 	pfr_setflags_ktable(kt, nflags);
1639 }
1640 
1641 static int
1642 pfr_validate_table(struct pfr_table *tbl, int allowedflags, int no_reserved)
1643 {
1644 	int i;
1645 
1646 	if (!tbl->pfrt_name[0])
1647 		return (-1);
1648 	if (no_reserved && !strcmp(tbl->pfrt_anchor, PF_RESERVED_ANCHOR))
1649 		 return (-1);
1650 	if (tbl->pfrt_name[PF_TABLE_NAME_SIZE-1])
1651 		return (-1);
1652 	for (i = strlen(tbl->pfrt_name); i < PF_TABLE_NAME_SIZE; i++)
1653 		if (tbl->pfrt_name[i])
1654 			return (-1);
1655 	if (pfr_fix_anchor(tbl->pfrt_anchor))
1656 		return (-1);
1657 	if (tbl->pfrt_flags & ~allowedflags)
1658 		return (-1);
1659 	return (0);
1660 }
1661 
1662 /*
1663  * Rewrite anchors referenced by tables to remove slashes
1664  * and check for validity.
1665  */
1666 static int
1667 pfr_fix_anchor(char *anchor)
1668 {
1669 	size_t siz = MAXPATHLEN;
1670 	int i;
1671 
1672 	if (anchor[0] == '/') {
1673 		char *path;
1674 		int off;
1675 
1676 		path = anchor;
1677 		off = 1;
1678 		while (*++path == '/')
1679 			off++;
1680 		bcopy(path, anchor, siz - off);
1681 		memset(anchor + siz - off, 0, off);
1682 	}
1683 	if (anchor[siz - 1])
1684 		return (-1);
1685 	for (i = strlen(anchor); i < siz; i++)
1686 		if (anchor[i])
1687 			return (-1);
1688 	return (0);
1689 }
1690 
1691 static int
1692 pfr_table_count(struct pfr_table *filter, int flags)
1693 {
1694 	struct pf_ruleset *rs;
1695 
1696 	PF_RULES_ASSERT();
1697 
1698 	if (flags & PFR_FLAG_ALLRSETS)
1699 		return (V_pfr_ktable_cnt);
1700 	if (filter->pfrt_anchor[0]) {
1701 		rs = pf_find_ruleset(filter->pfrt_anchor);
1702 		return ((rs != NULL) ? rs->tables : -1);
1703 	}
1704 	return (pf_main_ruleset.tables);
1705 }
1706 
1707 static int
1708 pfr_skip_table(struct pfr_table *filter, struct pfr_ktable *kt, int flags)
1709 {
1710 	if (flags & PFR_FLAG_ALLRSETS)
1711 		return (0);
1712 	if (strcmp(filter->pfrt_anchor, kt->pfrkt_anchor))
1713 		return (1);
1714 	return (0);
1715 }
1716 
1717 static void
1718 pfr_insert_ktables(struct pfr_ktableworkq *workq)
1719 {
1720 	struct pfr_ktable	*p;
1721 
1722 	SLIST_FOREACH(p, workq, pfrkt_workq)
1723 		pfr_insert_ktable(p);
1724 }
1725 
1726 static void
1727 pfr_insert_ktable(struct pfr_ktable *kt)
1728 {
1729 
1730 	PF_RULES_WASSERT();
1731 
1732 	RB_INSERT(pfr_ktablehead, &V_pfr_ktables, kt);
1733 	V_pfr_ktable_cnt++;
1734 	if (kt->pfrkt_root != NULL)
1735 		if (!kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]++)
1736 			pfr_setflags_ktable(kt->pfrkt_root,
1737 			    kt->pfrkt_root->pfrkt_flags|PFR_TFLAG_REFDANCHOR);
1738 }
1739 
1740 static void
1741 pfr_setflags_ktables(struct pfr_ktableworkq *workq)
1742 {
1743 	struct pfr_ktable	*p, *q;
1744 
1745 	for (p = SLIST_FIRST(workq); p; p = q) {
1746 		q = SLIST_NEXT(p, pfrkt_workq);
1747 		pfr_setflags_ktable(p, p->pfrkt_nflags);
1748 	}
1749 }
1750 
1751 static void
1752 pfr_setflags_ktable(struct pfr_ktable *kt, int newf)
1753 {
1754 	struct pfr_kentryworkq	addrq;
1755 
1756 	PF_RULES_WASSERT();
1757 
1758 	if (!(newf & PFR_TFLAG_REFERENCED) &&
1759 	    !(newf & PFR_TFLAG_PERSIST))
1760 		newf &= ~PFR_TFLAG_ACTIVE;
1761 	if (!(newf & PFR_TFLAG_ACTIVE))
1762 		newf &= ~PFR_TFLAG_USRMASK;
1763 	if (!(newf & PFR_TFLAG_SETMASK)) {
1764 		RB_REMOVE(pfr_ktablehead, &V_pfr_ktables, kt);
1765 		if (kt->pfrkt_root != NULL)
1766 			if (!--kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR])
1767 				pfr_setflags_ktable(kt->pfrkt_root,
1768 				    kt->pfrkt_root->pfrkt_flags &
1769 					~PFR_TFLAG_REFDANCHOR);
1770 		pfr_destroy_ktable(kt, 1);
1771 		V_pfr_ktable_cnt--;
1772 		return;
1773 	}
1774 	if (!(newf & PFR_TFLAG_ACTIVE) && kt->pfrkt_cnt) {
1775 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1776 		pfr_remove_kentries(kt, &addrq);
1777 	}
1778 	if (!(newf & PFR_TFLAG_INACTIVE) && kt->pfrkt_shadow != NULL) {
1779 		pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1780 		kt->pfrkt_shadow = NULL;
1781 	}
1782 	kt->pfrkt_flags = newf;
1783 }
1784 
1785 static void
1786 pfr_clstats_ktables(struct pfr_ktableworkq *workq, long tzero, int recurse)
1787 {
1788 	struct pfr_ktable	*p;
1789 
1790 	SLIST_FOREACH(p, workq, pfrkt_workq)
1791 		pfr_clstats_ktable(p, tzero, recurse);
1792 }
1793 
1794 static void
1795 pfr_clstats_ktable(struct pfr_ktable *kt, long tzero, int recurse)
1796 {
1797 	struct pfr_kentryworkq	 addrq;
1798 
1799 	if (recurse) {
1800 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1801 		pfr_clstats_kentries(&addrq, tzero, 0);
1802 	}
1803 	bzero(kt->pfrkt_packets, sizeof(kt->pfrkt_packets));
1804 	bzero(kt->pfrkt_bytes, sizeof(kt->pfrkt_bytes));
1805 	kt->pfrkt_match = kt->pfrkt_nomatch = 0;
1806 	kt->pfrkt_tzero = tzero;
1807 }
1808 
1809 static struct pfr_ktable *
1810 pfr_create_ktable(struct pfr_table *tbl, long tzero, int attachruleset)
1811 {
1812 	struct pfr_ktable	*kt;
1813 	struct pf_ruleset	*rs;
1814 
1815 	PF_RULES_WASSERT();
1816 
1817 	kt = malloc(sizeof(*kt), M_PFTABLE, M_NOWAIT|M_ZERO);
1818 	if (kt == NULL)
1819 		return (NULL);
1820 	kt->pfrkt_t = *tbl;
1821 
1822 	if (attachruleset) {
1823 		rs = pf_find_or_create_ruleset(tbl->pfrt_anchor);
1824 		if (!rs) {
1825 			pfr_destroy_ktable(kt, 0);
1826 			return (NULL);
1827 		}
1828 		kt->pfrkt_rs = rs;
1829 		rs->tables++;
1830 	}
1831 
1832 	if (!rn_inithead((void **)&kt->pfrkt_ip4,
1833 	    offsetof(struct sockaddr_in, sin_addr) * 8) ||
1834 	    !rn_inithead((void **)&kt->pfrkt_ip6,
1835 	    offsetof(struct sockaddr_in6, sin6_addr) * 8)) {
1836 		pfr_destroy_ktable(kt, 0);
1837 		return (NULL);
1838 	}
1839 	kt->pfrkt_tzero = tzero;
1840 
1841 	return (kt);
1842 }
1843 
1844 static void
1845 pfr_destroy_ktables(struct pfr_ktableworkq *workq, int flushaddr)
1846 {
1847 	struct pfr_ktable	*p, *q;
1848 
1849 	for (p = SLIST_FIRST(workq); p; p = q) {
1850 		q = SLIST_NEXT(p, pfrkt_workq);
1851 		pfr_destroy_ktable(p, flushaddr);
1852 	}
1853 }
1854 
1855 static void
1856 pfr_destroy_ktable(struct pfr_ktable *kt, int flushaddr)
1857 {
1858 	struct pfr_kentryworkq	 addrq;
1859 
1860 	if (flushaddr) {
1861 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1862 		pfr_clean_node_mask(kt, &addrq);
1863 		pfr_destroy_kentries(&addrq);
1864 	}
1865 	if (kt->pfrkt_ip4 != NULL)
1866 		rn_detachhead((void **)&kt->pfrkt_ip4);
1867 	if (kt->pfrkt_ip6 != NULL)
1868 		rn_detachhead((void **)&kt->pfrkt_ip6);
1869 	if (kt->pfrkt_shadow != NULL)
1870 		pfr_destroy_ktable(kt->pfrkt_shadow, flushaddr);
1871 	if (kt->pfrkt_rs != NULL) {
1872 		kt->pfrkt_rs->tables--;
1873 		pf_remove_if_empty_ruleset(kt->pfrkt_rs);
1874 	}
1875 	free(kt, M_PFTABLE);
1876 }
1877 
1878 static int
1879 pfr_ktable_compare(struct pfr_ktable *p, struct pfr_ktable *q)
1880 {
1881 	int d;
1882 
1883 	if ((d = strncmp(p->pfrkt_name, q->pfrkt_name, PF_TABLE_NAME_SIZE)))
1884 		return (d);
1885 	return (strcmp(p->pfrkt_anchor, q->pfrkt_anchor));
1886 }
1887 
1888 static struct pfr_ktable *
1889 pfr_lookup_table(struct pfr_table *tbl)
1890 {
1891 	/* struct pfr_ktable start like a struct pfr_table */
1892 	return (RB_FIND(pfr_ktablehead, &V_pfr_ktables,
1893 	    (struct pfr_ktable *)tbl));
1894 }
1895 
1896 int
1897 pfr_match_addr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af)
1898 {
1899 	struct pfr_kentry	*ke = NULL;
1900 	int			 match;
1901 
1902 	PF_RULES_RASSERT();
1903 
1904 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
1905 		kt = kt->pfrkt_root;
1906 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1907 		return (0);
1908 
1909 	switch (af) {
1910 #ifdef INET
1911 	case AF_INET:
1912 	    {
1913 		struct sockaddr_in sin;
1914 
1915 		bzero(&sin, sizeof(sin));
1916 		sin.sin_len = sizeof(sin);
1917 		sin.sin_family = AF_INET;
1918 		sin.sin_addr.s_addr = a->addr32[0];
1919 		ke = (struct pfr_kentry *)rn_match(&sin, &kt->pfrkt_ip4->rh);
1920 		if (ke && KENTRY_RNF_ROOT(ke))
1921 			ke = NULL;
1922 		break;
1923 	    }
1924 #endif /* INET */
1925 #ifdef INET6
1926 	case AF_INET6:
1927 	    {
1928 		struct sockaddr_in6 sin6;
1929 
1930 		bzero(&sin6, sizeof(sin6));
1931 		sin6.sin6_len = sizeof(sin6);
1932 		sin6.sin6_family = AF_INET6;
1933 		bcopy(a, &sin6.sin6_addr, sizeof(sin6.sin6_addr));
1934 		ke = (struct pfr_kentry *)rn_match(&sin6, &kt->pfrkt_ip6->rh);
1935 		if (ke && KENTRY_RNF_ROOT(ke))
1936 			ke = NULL;
1937 		break;
1938 	    }
1939 #endif /* INET6 */
1940 	}
1941 	match = (ke && !ke->pfrke_not);
1942 	if (match)
1943 		kt->pfrkt_match++;
1944 	else
1945 		kt->pfrkt_nomatch++;
1946 	return (match);
1947 }
1948 
1949 void
1950 pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af,
1951     u_int64_t len, int dir_out, int op_pass, int notrule)
1952 {
1953 	struct pfr_kentry	*ke = NULL;
1954 
1955 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
1956 		kt = kt->pfrkt_root;
1957 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1958 		return;
1959 
1960 	switch (af) {
1961 #ifdef INET
1962 	case AF_INET:
1963 	    {
1964 		struct sockaddr_in sin;
1965 
1966 		bzero(&sin, sizeof(sin));
1967 		sin.sin_len = sizeof(sin);
1968 		sin.sin_family = AF_INET;
1969 		sin.sin_addr.s_addr = a->addr32[0];
1970 		ke = (struct pfr_kentry *)rn_match(&sin, &kt->pfrkt_ip4->rh);
1971 		if (ke && KENTRY_RNF_ROOT(ke))
1972 			ke = NULL;
1973 		break;
1974 	    }
1975 #endif /* INET */
1976 #ifdef INET6
1977 	case AF_INET6:
1978 	    {
1979 		struct sockaddr_in6 sin6;
1980 
1981 		bzero(&sin6, sizeof(sin6));
1982 		sin6.sin6_len = sizeof(sin6);
1983 		sin6.sin6_family = AF_INET6;
1984 		bcopy(a, &sin6.sin6_addr, sizeof(sin6.sin6_addr));
1985 		ke = (struct pfr_kentry *)rn_match(&sin6, &kt->pfrkt_ip6->rh);
1986 		if (ke && KENTRY_RNF_ROOT(ke))
1987 			ke = NULL;
1988 		break;
1989 	    }
1990 #endif /* INET6 */
1991 	default:
1992 		panic("%s: unknown address family %u", __func__, af);
1993 	}
1994 	if ((ke == NULL || ke->pfrke_not) != notrule) {
1995 		if (op_pass != PFR_OP_PASS)
1996 			printf("pfr_update_stats: assertion failed.\n");
1997 		op_pass = PFR_OP_XPASS;
1998 	}
1999 	kt->pfrkt_packets[dir_out][op_pass]++;
2000 	kt->pfrkt_bytes[dir_out][op_pass] += len;
2001 	if (ke != NULL && op_pass != PFR_OP_XPASS &&
2002 	    (kt->pfrkt_flags & PFR_TFLAG_COUNTERS)) {
2003 		if (ke->pfrke_counters == NULL)
2004 			ke->pfrke_counters = uma_zalloc(V_pfr_kcounters_z,
2005 			    M_NOWAIT | M_ZERO);
2006 		if (ke->pfrke_counters != NULL) {
2007 			ke->pfrke_counters->pfrkc_packets[dir_out][op_pass]++;
2008 			ke->pfrke_counters->pfrkc_bytes[dir_out][op_pass] += len;
2009 		}
2010 	}
2011 }
2012 
2013 struct pfr_ktable *
2014 pfr_attach_table(struct pf_ruleset *rs, char *name)
2015 {
2016 	struct pfr_ktable	*kt, *rt;
2017 	struct pfr_table	 tbl;
2018 	struct pf_anchor	*ac = rs->anchor;
2019 
2020 	PF_RULES_WASSERT();
2021 
2022 	bzero(&tbl, sizeof(tbl));
2023 	strlcpy(tbl.pfrt_name, name, sizeof(tbl.pfrt_name));
2024 	if (ac != NULL)
2025 		strlcpy(tbl.pfrt_anchor, ac->path, sizeof(tbl.pfrt_anchor));
2026 	kt = pfr_lookup_table(&tbl);
2027 	if (kt == NULL) {
2028 		kt = pfr_create_ktable(&tbl, time_second, 1);
2029 		if (kt == NULL)
2030 			return (NULL);
2031 		if (ac != NULL) {
2032 			bzero(tbl.pfrt_anchor, sizeof(tbl.pfrt_anchor));
2033 			rt = pfr_lookup_table(&tbl);
2034 			if (rt == NULL) {
2035 				rt = pfr_create_ktable(&tbl, 0, 1);
2036 				if (rt == NULL) {
2037 					pfr_destroy_ktable(kt, 0);
2038 					return (NULL);
2039 				}
2040 				pfr_insert_ktable(rt);
2041 			}
2042 			kt->pfrkt_root = rt;
2043 		}
2044 		pfr_insert_ktable(kt);
2045 	}
2046 	if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++)
2047 		pfr_setflags_ktable(kt, kt->pfrkt_flags|PFR_TFLAG_REFERENCED);
2048 	return (kt);
2049 }
2050 
2051 void
2052 pfr_detach_table(struct pfr_ktable *kt)
2053 {
2054 
2055 	PF_RULES_WASSERT();
2056 	KASSERT(kt->pfrkt_refcnt[PFR_REFCNT_RULE] > 0, ("%s: refcount %d\n",
2057 	    __func__, kt->pfrkt_refcnt[PFR_REFCNT_RULE]));
2058 
2059 	if (!--kt->pfrkt_refcnt[PFR_REFCNT_RULE])
2060 		pfr_setflags_ktable(kt, kt->pfrkt_flags&~PFR_TFLAG_REFERENCED);
2061 }
2062 
2063 int
2064 pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter,
2065     sa_family_t af)
2066 {
2067 	struct pf_addr		 *addr, *cur, *mask;
2068 	union sockaddr_union	 uaddr, umask;
2069 	struct pfr_kentry	*ke, *ke2 = NULL;
2070 	int			 idx = -1, use_counter = 0;
2071 
2072 	switch (af) {
2073 	case AF_INET:
2074 		uaddr.sin.sin_len = sizeof(struct sockaddr_in);
2075 		uaddr.sin.sin_family = AF_INET;
2076 		break;
2077 	case AF_INET6:
2078 		uaddr.sin6.sin6_len = sizeof(struct sockaddr_in6);
2079 		uaddr.sin6.sin6_family = AF_INET6;
2080 		break;
2081 	}
2082 	addr = SUNION2PF(&uaddr, af);
2083 
2084 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2085 		kt = kt->pfrkt_root;
2086 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2087 		return (-1);
2088 
2089 	if (pidx != NULL)
2090 		idx = *pidx;
2091 	if (counter != NULL && idx >= 0)
2092 		use_counter = 1;
2093 	if (idx < 0)
2094 		idx = 0;
2095 
2096 _next_block:
2097 	ke = pfr_kentry_byidx(kt, idx, af);
2098 	if (ke == NULL) {
2099 		kt->pfrkt_nomatch++;
2100 		return (1);
2101 	}
2102 	pfr_prepare_network(&umask, af, ke->pfrke_net);
2103 	cur = SUNION2PF(&ke->pfrke_sa, af);
2104 	mask = SUNION2PF(&umask, af);
2105 
2106 	if (use_counter) {
2107 		/* is supplied address within block? */
2108 		if (!PF_MATCHA(0, cur, mask, counter, af)) {
2109 			/* no, go to next block in table */
2110 			idx++;
2111 			use_counter = 0;
2112 			goto _next_block;
2113 		}
2114 		PF_ACPY(addr, counter, af);
2115 	} else {
2116 		/* use first address of block */
2117 		PF_ACPY(addr, cur, af);
2118 	}
2119 
2120 	if (!KENTRY_NETWORK(ke)) {
2121 		/* this is a single IP address - no possible nested block */
2122 		PF_ACPY(counter, addr, af);
2123 		*pidx = idx;
2124 		kt->pfrkt_match++;
2125 		return (0);
2126 	}
2127 	for (;;) {
2128 		/* we don't want to use a nested block */
2129 		switch (af) {
2130 		case AF_INET:
2131 			ke2 = (struct pfr_kentry *)rn_match(&uaddr,
2132 			    &kt->pfrkt_ip4->rh);
2133 			break;
2134 		case AF_INET6:
2135 			ke2 = (struct pfr_kentry *)rn_match(&uaddr,
2136 			    &kt->pfrkt_ip6->rh);
2137 			break;
2138 		}
2139 		/* no need to check KENTRY_RNF_ROOT() here */
2140 		if (ke2 == ke) {
2141 			/* lookup return the same block - perfect */
2142 			PF_ACPY(counter, addr, af);
2143 			*pidx = idx;
2144 			kt->pfrkt_match++;
2145 			return (0);
2146 		}
2147 
2148 		/* we need to increase the counter past the nested block */
2149 		pfr_prepare_network(&umask, AF_INET, ke2->pfrke_net);
2150 		PF_POOLMASK(addr, addr, SUNION2PF(&umask, af), &pfr_ffaddr, af);
2151 		PF_AINC(addr, af);
2152 		if (!PF_MATCHA(0, cur, mask, addr, af)) {
2153 			/* ok, we reached the end of our main block */
2154 			/* go to next block in table */
2155 			idx++;
2156 			use_counter = 0;
2157 			goto _next_block;
2158 		}
2159 	}
2160 }
2161 
2162 static struct pfr_kentry *
2163 pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af)
2164 {
2165 	struct pfr_walktree	w;
2166 
2167 	bzero(&w, sizeof(w));
2168 	w.pfrw_op = PFRW_POOL_GET;
2169 	w.pfrw_cnt = idx;
2170 
2171 	switch (af) {
2172 #ifdef INET
2173 	case AF_INET:
2174 		kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
2175 		return (w.pfrw_kentry);
2176 #endif /* INET */
2177 #ifdef INET6
2178 	case AF_INET6:
2179 		kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w);
2180 		return (w.pfrw_kentry);
2181 #endif /* INET6 */
2182 	default:
2183 		return (NULL);
2184 	}
2185 }
2186 
2187 void
2188 pfr_dynaddr_update(struct pfr_ktable *kt, struct pfi_dynaddr *dyn)
2189 {
2190 	struct pfr_walktree	w;
2191 
2192 	bzero(&w, sizeof(w));
2193 	w.pfrw_op = PFRW_DYNADDR_UPDATE;
2194 	w.pfrw_dyn = dyn;
2195 
2196 	dyn->pfid_acnt4 = 0;
2197 	dyn->pfid_acnt6 = 0;
2198 	if (!dyn->pfid_af || dyn->pfid_af == AF_INET)
2199 		kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
2200 	if (!dyn->pfid_af || dyn->pfid_af == AF_INET6)
2201 		kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w);
2202 }
2203