1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2002 Cedric Berger
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 *
11 * - Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * - Redistributions in binary form must reproduce the above
14 * copyright notice, this list of conditions and the following
15 * disclaimer in the documentation and/or other materials provided
16 * with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
21 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
22 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
24 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
25 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
26 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
28 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 * POSSIBILITY OF SUCH DAMAGE.
30 *
31 * $OpenBSD: pf_table.c,v 1.79 2008/10/08 06:24:50 mcbride Exp $
32 */
33
34 #include <sys/cdefs.h>
35 #include "opt_inet.h"
36 #include "opt_inet6.h"
37
38 #include <sys/param.h>
39 #include <sys/kernel.h>
40 #include <sys/lock.h>
41 #include <sys/malloc.h>
42 #include <sys/mbuf.h>
43 #include <sys/mutex.h>
44 #include <sys/refcount.h>
45 #include <sys/socket.h>
46 #include <vm/uma.h>
47
48 #include <net/if.h>
49 #include <net/vnet.h>
50 #include <net/pfvar.h>
51
52 #define DPFPRINTF(n, x) if (V_pf_status.debug >= (n)) printf x
53
54 #define ACCEPT_FLAGS(flags, oklist) \
55 do { \
56 if ((flags & ~(oklist)) & \
57 PFR_FLAG_ALLMASK) \
58 return (EINVAL); \
59 } while (0)
60
61 #define FILLIN_SIN(sin, addr) \
62 do { \
63 (sin).sin_len = sizeof(sin); \
64 (sin).sin_family = AF_INET; \
65 (sin).sin_addr = (addr); \
66 } while (0)
67
68 #define FILLIN_SIN6(sin6, addr) \
69 do { \
70 (sin6).sin6_len = sizeof(sin6); \
71 (sin6).sin6_family = AF_INET6; \
72 (sin6).sin6_addr = (addr); \
73 } while (0)
74
75 #define SWAP(type, a1, a2) \
76 do { \
77 type tmp = a1; \
78 a1 = a2; \
79 a2 = tmp; \
80 } while (0)
81
82 #define SUNION2PF(su, af) (((af)==AF_INET) ? \
83 (struct pf_addr *)&(su)->sin.sin_addr : \
84 (struct pf_addr *)&(su)->sin6.sin6_addr)
85
86 #define AF_BITS(af) (((af)==AF_INET)?32:128)
87 #define ADDR_NETWORK(ad) ((ad)->pfra_net < AF_BITS((ad)->pfra_af))
88 #define KENTRY_NETWORK(ke) ((ke)->pfrke_net < AF_BITS((ke)->pfrke_af))
89 #define KENTRY_RNF_ROOT(ke) \
90 ((((struct radix_node *)(ke))->rn_flags & RNF_ROOT) != 0)
91
92 #define NO_ADDRESSES (-1)
93 #define ENQUEUE_UNMARKED_ONLY (1)
94 #define INVERT_NEG_FLAG (1)
95
96 struct pfr_walktree {
97 enum pfrw_op {
98 PFRW_MARK,
99 PFRW_SWEEP,
100 PFRW_ENQUEUE,
101 PFRW_GET_ADDRS,
102 PFRW_GET_ASTATS,
103 PFRW_POOL_GET,
104 PFRW_DYNADDR_UPDATE,
105 PFRW_COUNTERS
106 } pfrw_op;
107 union {
108 struct pfr_addr *pfrw1_addr;
109 struct pfr_astats *pfrw1_astats;
110 struct pfr_kentryworkq *pfrw1_workq;
111 struct pfr_kentry *pfrw1_kentry;
112 struct pfi_dynaddr *pfrw1_dyn;
113 } pfrw_1;
114 int pfrw_free;
115 int pfrw_flags;
116 };
117 #define pfrw_addr pfrw_1.pfrw1_addr
118 #define pfrw_astats pfrw_1.pfrw1_astats
119 #define pfrw_workq pfrw_1.pfrw1_workq
120 #define pfrw_kentry pfrw_1.pfrw1_kentry
121 #define pfrw_dyn pfrw_1.pfrw1_dyn
122 #define pfrw_cnt pfrw_free
123
124 #define senderr(e) do { rv = (e); goto _bad; } while (0)
125
126 static MALLOC_DEFINE(M_PFTABLE, "pf_table", "pf(4) tables structures");
127 VNET_DEFINE_STATIC(uma_zone_t, pfr_kentry_z);
128 #define V_pfr_kentry_z VNET(pfr_kentry_z)
129 VNET_DEFINE_STATIC(uma_zone_t, pfr_kentry_counter_z);
130 #define V_pfr_kentry_counter_z VNET(pfr_kentry_counter_z)
131
132 static struct pf_addr pfr_ffaddr = {
133 .addr32 = { 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff }
134 };
135
136 static void pfr_copyout_astats(struct pfr_astats *,
137 const struct pfr_kentry *,
138 const struct pfr_walktree *);
139 static void pfr_copyout_addr(struct pfr_addr *,
140 const struct pfr_kentry *ke);
141 static int pfr_validate_addr(struct pfr_addr *);
142 static void pfr_enqueue_addrs(struct pfr_ktable *,
143 struct pfr_kentryworkq *, int *, int);
144 static void pfr_mark_addrs(struct pfr_ktable *);
145 static struct pfr_kentry
146 *pfr_lookup_addr(struct pfr_ktable *,
147 struct pfr_addr *, int);
148 static struct pfr_kentry *pfr_create_kentry(struct pfr_addr *, bool);
149 static void pfr_destroy_kentries(struct pfr_kentryworkq *);
150 static void pfr_destroy_kentry(struct pfr_kentry *);
151 static void pfr_insert_kentries(struct pfr_ktable *,
152 struct pfr_kentryworkq *, long);
153 static void pfr_remove_kentries(struct pfr_ktable *,
154 struct pfr_kentryworkq *);
155 static void pfr_clstats_kentries(struct pfr_ktable *,
156 struct pfr_kentryworkq *, long, int);
157 static void pfr_reset_feedback(struct pfr_addr *, int);
158 static void pfr_prepare_network(union sockaddr_union *, int, int);
159 static int pfr_route_kentry(struct pfr_ktable *,
160 struct pfr_kentry *);
161 static int pfr_unroute_kentry(struct pfr_ktable *,
162 struct pfr_kentry *);
163 static int pfr_walktree(struct radix_node *, void *);
164 static int pfr_validate_table(struct pfr_table *, int, int);
165 static int pfr_fix_anchor(char *);
166 static void pfr_commit_ktable(struct pfr_ktable *, long);
167 static void pfr_insert_ktables(struct pfr_ktableworkq *);
168 static void pfr_insert_ktable(struct pfr_ktable *);
169 static void pfr_setflags_ktables(struct pfr_ktableworkq *);
170 static void pfr_setflags_ktable(struct pfr_ktable *, int);
171 static void pfr_clstats_ktables(struct pfr_ktableworkq *, long,
172 int);
173 static void pfr_clstats_ktable(struct pfr_ktable *, long, int);
174 static struct pfr_ktable
175 *pfr_create_ktable(struct pfr_table *, long, int);
176 static void pfr_destroy_ktables(struct pfr_ktableworkq *, int);
177 static void pfr_destroy_ktable(struct pfr_ktable *, int);
178 static int pfr_ktable_compare(struct pfr_ktable *,
179 struct pfr_ktable *);
180 static struct pfr_ktable
181 *pfr_lookup_table(struct pfr_table *);
182 static void pfr_clean_node_mask(struct pfr_ktable *,
183 struct pfr_kentryworkq *);
184 static int pfr_skip_table(struct pfr_table *,
185 struct pfr_ktable *, int);
186 static struct pfr_kentry
187 *pfr_kentry_byidx(struct pfr_ktable *, int, int);
188
189 static RB_PROTOTYPE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
190 static RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
191
192 VNET_DEFINE_STATIC(struct pfr_ktablehead, pfr_ktables);
193 #define V_pfr_ktables VNET(pfr_ktables)
194
195 VNET_DEFINE_STATIC(struct pfr_table, pfr_nulltable);
196 #define V_pfr_nulltable VNET(pfr_nulltable)
197
198 VNET_DEFINE_STATIC(int, pfr_ktable_cnt);
199 #define V_pfr_ktable_cnt VNET(pfr_ktable_cnt)
200
201 void
pfr_initialize(void)202 pfr_initialize(void)
203 {
204
205 V_pfr_kentry_counter_z = uma_zcreate("pf table entry counters",
206 PFR_NUM_COUNTERS * sizeof(uint64_t), NULL, NULL, NULL, NULL,
207 UMA_ALIGN_PTR, UMA_ZONE_PCPU);
208 V_pfr_kentry_z = uma_zcreate("pf table entries",
209 sizeof(struct pfr_kentry), NULL, NULL, NULL, NULL, UMA_ALIGN_PTR,
210 0);
211 uma_zone_set_max(V_pfr_kentry_z, PFR_KENTRY_HIWAT);
212 V_pf_limits[PF_LIMIT_TABLE_ENTRIES].zone = V_pfr_kentry_z;
213 V_pf_limits[PF_LIMIT_TABLE_ENTRIES].limit = PFR_KENTRY_HIWAT;
214 }
215
216 void
pfr_cleanup(void)217 pfr_cleanup(void)
218 {
219
220 uma_zdestroy(V_pfr_kentry_z);
221 uma_zdestroy(V_pfr_kentry_counter_z);
222 }
223
224 int
pfr_clr_addrs(struct pfr_table * tbl,int * ndel,int flags)225 pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags)
226 {
227 struct pfr_ktable *kt;
228 struct pfr_kentryworkq workq;
229
230 PF_RULES_WASSERT();
231
232 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
233 if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
234 return (EINVAL);
235 kt = pfr_lookup_table(tbl);
236 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
237 return (ESRCH);
238 if (kt->pfrkt_flags & PFR_TFLAG_CONST)
239 return (EPERM);
240 pfr_enqueue_addrs(kt, &workq, ndel, 0);
241
242 if (!(flags & PFR_FLAG_DUMMY)) {
243 pfr_remove_kentries(kt, &workq);
244 KASSERT(kt->pfrkt_cnt == 0, ("%s: non-null pfrkt_cnt", __func__));
245 }
246 return (0);
247 }
248
249 int
pfr_add_addrs(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * nadd,int flags)250 pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
251 int *nadd, int flags)
252 {
253 struct pfr_ktable *kt, *tmpkt;
254 struct pfr_kentryworkq workq;
255 struct pfr_kentry *p, *q;
256 struct pfr_addr *ad;
257 int i, rv, xadd = 0;
258 long tzero = time_second;
259
260 PF_RULES_WASSERT();
261
262 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
263 if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
264 return (EINVAL);
265 kt = pfr_lookup_table(tbl);
266 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
267 return (ESRCH);
268 if (kt->pfrkt_flags & PFR_TFLAG_CONST)
269 return (EPERM);
270 tmpkt = pfr_create_ktable(&V_pfr_nulltable, 0, 0);
271 if (tmpkt == NULL)
272 return (ENOMEM);
273 SLIST_INIT(&workq);
274 for (i = 0, ad = addr; i < size; i++, ad++) {
275 if (pfr_validate_addr(ad))
276 senderr(EINVAL);
277 p = pfr_lookup_addr(kt, ad, 1);
278 q = pfr_lookup_addr(tmpkt, ad, 1);
279 if (flags & PFR_FLAG_FEEDBACK) {
280 if (q != NULL)
281 ad->pfra_fback = PFR_FB_DUPLICATE;
282 else if (p == NULL)
283 ad->pfra_fback = PFR_FB_ADDED;
284 else if (p->pfrke_not != ad->pfra_not)
285 ad->pfra_fback = PFR_FB_CONFLICT;
286 else
287 ad->pfra_fback = PFR_FB_NONE;
288 }
289 if (p == NULL && q == NULL) {
290 p = pfr_create_kentry(ad,
291 (kt->pfrkt_flags & PFR_TFLAG_COUNTERS) != 0);
292 if (p == NULL)
293 senderr(ENOMEM);
294 if (pfr_route_kentry(tmpkt, p)) {
295 pfr_destroy_kentry(p);
296 ad->pfra_fback = PFR_FB_NONE;
297 } else {
298 SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
299 xadd++;
300 }
301 }
302 }
303 pfr_clean_node_mask(tmpkt, &workq);
304 if (!(flags & PFR_FLAG_DUMMY))
305 pfr_insert_kentries(kt, &workq, tzero);
306 else
307 pfr_destroy_kentries(&workq);
308 if (nadd != NULL)
309 *nadd = xadd;
310 pfr_destroy_ktable(tmpkt, 0);
311 return (0);
312 _bad:
313 pfr_clean_node_mask(tmpkt, &workq);
314 pfr_destroy_kentries(&workq);
315 if (flags & PFR_FLAG_FEEDBACK)
316 pfr_reset_feedback(addr, size);
317 pfr_destroy_ktable(tmpkt, 0);
318 return (rv);
319 }
320
321 int
pfr_del_addrs(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * ndel,int flags)322 pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
323 int *ndel, int flags)
324 {
325 struct pfr_ktable *kt;
326 struct pfr_kentryworkq workq;
327 struct pfr_kentry *p;
328 struct pfr_addr *ad;
329 int i, rv, xdel = 0, log = 1;
330
331 PF_RULES_WASSERT();
332
333 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
334 if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
335 return (EINVAL);
336 kt = pfr_lookup_table(tbl);
337 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
338 return (ESRCH);
339 if (kt->pfrkt_flags & PFR_TFLAG_CONST)
340 return (EPERM);
341 /*
342 * there are two algorithms to choose from here.
343 * with:
344 * n: number of addresses to delete
345 * N: number of addresses in the table
346 *
347 * one is O(N) and is better for large 'n'
348 * one is O(n*LOG(N)) and is better for small 'n'
349 *
350 * following code try to decide which one is best.
351 */
352 for (i = kt->pfrkt_cnt; i > 0; i >>= 1)
353 log++;
354 if (size > kt->pfrkt_cnt/log) {
355 /* full table scan */
356 pfr_mark_addrs(kt);
357 } else {
358 /* iterate over addresses to delete */
359 for (i = 0, ad = addr; i < size; i++, ad++) {
360 if (pfr_validate_addr(ad))
361 return (EINVAL);
362 p = pfr_lookup_addr(kt, ad, 1);
363 if (p != NULL)
364 p->pfrke_mark = 0;
365 }
366 }
367 SLIST_INIT(&workq);
368 for (i = 0, ad = addr; i < size; i++, ad++) {
369 if (pfr_validate_addr(ad))
370 senderr(EINVAL);
371 p = pfr_lookup_addr(kt, ad, 1);
372 if (flags & PFR_FLAG_FEEDBACK) {
373 if (p == NULL)
374 ad->pfra_fback = PFR_FB_NONE;
375 else if (p->pfrke_not != ad->pfra_not)
376 ad->pfra_fback = PFR_FB_CONFLICT;
377 else if (p->pfrke_mark)
378 ad->pfra_fback = PFR_FB_DUPLICATE;
379 else
380 ad->pfra_fback = PFR_FB_DELETED;
381 }
382 if (p != NULL && p->pfrke_not == ad->pfra_not &&
383 !p->pfrke_mark) {
384 p->pfrke_mark = 1;
385 SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
386 xdel++;
387 }
388 }
389 if (!(flags & PFR_FLAG_DUMMY))
390 pfr_remove_kentries(kt, &workq);
391 if (ndel != NULL)
392 *ndel = xdel;
393 return (0);
394 _bad:
395 if (flags & PFR_FLAG_FEEDBACK)
396 pfr_reset_feedback(addr, size);
397 return (rv);
398 }
399
400 int
pfr_set_addrs(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * size2,int * nadd,int * ndel,int * nchange,int flags,u_int32_t ignore_pfrt_flags)401 pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
402 int *size2, int *nadd, int *ndel, int *nchange, int flags,
403 u_int32_t ignore_pfrt_flags)
404 {
405 struct pfr_ktable *kt, *tmpkt;
406 struct pfr_kentryworkq addq, delq, changeq;
407 struct pfr_kentry *p, *q;
408 struct pfr_addr ad;
409 int i, rv, xadd = 0, xdel = 0, xchange = 0;
410 long tzero = time_second;
411
412 PF_RULES_WASSERT();
413
414 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
415 if (pfr_validate_table(tbl, ignore_pfrt_flags, flags &
416 PFR_FLAG_USERIOCTL))
417 return (EINVAL);
418 kt = pfr_lookup_table(tbl);
419 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
420 return (ESRCH);
421 if (kt->pfrkt_flags & PFR_TFLAG_CONST)
422 return (EPERM);
423 tmpkt = pfr_create_ktable(&V_pfr_nulltable, 0, 0);
424 if (tmpkt == NULL)
425 return (ENOMEM);
426 pfr_mark_addrs(kt);
427 SLIST_INIT(&addq);
428 SLIST_INIT(&delq);
429 SLIST_INIT(&changeq);
430 for (i = 0; i < size; i++) {
431 /*
432 * XXXGL: undertand pf_if usage of this function
433 * and make ad a moving pointer
434 */
435 bcopy(addr + i, &ad, sizeof(ad));
436 if (pfr_validate_addr(&ad))
437 senderr(EINVAL);
438 ad.pfra_fback = PFR_FB_NONE;
439 p = pfr_lookup_addr(kt, &ad, 1);
440 if (p != NULL) {
441 if (p->pfrke_mark) {
442 ad.pfra_fback = PFR_FB_DUPLICATE;
443 goto _skip;
444 }
445 p->pfrke_mark = 1;
446 if (p->pfrke_not != ad.pfra_not) {
447 SLIST_INSERT_HEAD(&changeq, p, pfrke_workq);
448 ad.pfra_fback = PFR_FB_CHANGED;
449 xchange++;
450 }
451 } else {
452 q = pfr_lookup_addr(tmpkt, &ad, 1);
453 if (q != NULL) {
454 ad.pfra_fback = PFR_FB_DUPLICATE;
455 goto _skip;
456 }
457 p = pfr_create_kentry(&ad,
458 (kt->pfrkt_flags & PFR_TFLAG_COUNTERS) != 0);
459 if (p == NULL)
460 senderr(ENOMEM);
461 if (pfr_route_kentry(tmpkt, p)) {
462 pfr_destroy_kentry(p);
463 ad.pfra_fback = PFR_FB_NONE;
464 } else {
465 SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
466 ad.pfra_fback = PFR_FB_ADDED;
467 xadd++;
468 }
469 }
470 _skip:
471 if (flags & PFR_FLAG_FEEDBACK)
472 bcopy(&ad, addr + i, sizeof(ad));
473 }
474 pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY);
475 if ((flags & PFR_FLAG_FEEDBACK) && *size2) {
476 if (*size2 < size+xdel) {
477 *size2 = size+xdel;
478 senderr(0);
479 }
480 i = 0;
481 SLIST_FOREACH(p, &delq, pfrke_workq) {
482 pfr_copyout_addr(&ad, p);
483 ad.pfra_fback = PFR_FB_DELETED;
484 bcopy(&ad, addr + size + i, sizeof(ad));
485 i++;
486 }
487 }
488 pfr_clean_node_mask(tmpkt, &addq);
489 if (!(flags & PFR_FLAG_DUMMY)) {
490 pfr_insert_kentries(kt, &addq, tzero);
491 pfr_remove_kentries(kt, &delq);
492 pfr_clstats_kentries(kt, &changeq, tzero, INVERT_NEG_FLAG);
493 } else
494 pfr_destroy_kentries(&addq);
495 if (nadd != NULL)
496 *nadd = xadd;
497 if (ndel != NULL)
498 *ndel = xdel;
499 if (nchange != NULL)
500 *nchange = xchange;
501 if ((flags & PFR_FLAG_FEEDBACK) && size2)
502 *size2 = size+xdel;
503 pfr_destroy_ktable(tmpkt, 0);
504 return (0);
505 _bad:
506 pfr_clean_node_mask(tmpkt, &addq);
507 pfr_destroy_kentries(&addq);
508 if (flags & PFR_FLAG_FEEDBACK)
509 pfr_reset_feedback(addr, size);
510 pfr_destroy_ktable(tmpkt, 0);
511 return (rv);
512 }
513
514 int
pfr_tst_addrs(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * nmatch,int flags)515 pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
516 int *nmatch, int flags)
517 {
518 struct pfr_ktable *kt;
519 struct pfr_kentry *p;
520 struct pfr_addr *ad;
521 int i, xmatch = 0;
522
523 PF_RULES_RASSERT();
524
525 ACCEPT_FLAGS(flags, PFR_FLAG_REPLACE);
526 if (pfr_validate_table(tbl, 0, 0))
527 return (EINVAL);
528 kt = pfr_lookup_table(tbl);
529 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
530 return (ESRCH);
531
532 for (i = 0, ad = addr; i < size; i++, ad++) {
533 if (pfr_validate_addr(ad))
534 return (EINVAL);
535 if (ADDR_NETWORK(ad))
536 return (EINVAL);
537 p = pfr_lookup_addr(kt, ad, 0);
538 if (flags & PFR_FLAG_REPLACE)
539 pfr_copyout_addr(ad, p);
540 ad->pfra_fback = (p == NULL) ? PFR_FB_NONE :
541 (p->pfrke_not ? PFR_FB_NOTMATCH : PFR_FB_MATCH);
542 if (p != NULL && !p->pfrke_not)
543 xmatch++;
544 }
545 if (nmatch != NULL)
546 *nmatch = xmatch;
547 return (0);
548 }
549
550 int
pfr_get_addrs(struct pfr_table * tbl,struct pfr_addr * addr,int * size,int flags)551 pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size,
552 int flags)
553 {
554 struct pfr_ktable *kt;
555 struct pfr_walktree w;
556 int rv;
557
558 PF_RULES_RASSERT();
559
560 ACCEPT_FLAGS(flags, 0);
561 if (pfr_validate_table(tbl, 0, 0))
562 return (EINVAL);
563 kt = pfr_lookup_table(tbl);
564 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
565 return (ESRCH);
566 if (kt->pfrkt_cnt > *size) {
567 *size = kt->pfrkt_cnt;
568 return (0);
569 }
570
571 bzero(&w, sizeof(w));
572 w.pfrw_op = PFRW_GET_ADDRS;
573 w.pfrw_addr = addr;
574 w.pfrw_free = kt->pfrkt_cnt;
575 rv = kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
576 if (!rv)
577 rv = kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh,
578 pfr_walktree, &w);
579 if (rv)
580 return (rv);
581
582 KASSERT(w.pfrw_free == 0, ("%s: corruption detected (%d)", __func__,
583 w.pfrw_free));
584
585 *size = kt->pfrkt_cnt;
586 return (0);
587 }
588
589 int
pfr_get_astats(struct pfr_table * tbl,struct pfr_astats * addr,int * size,int flags)590 pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size,
591 int flags)
592 {
593 struct pfr_ktable *kt;
594 struct pfr_walktree w;
595 struct pfr_kentryworkq workq;
596 int rv;
597 long tzero = time_second;
598
599 PF_RULES_RASSERT();
600
601 /* XXX PFR_FLAG_CLSTATS disabled */
602 ACCEPT_FLAGS(flags, 0);
603 if (pfr_validate_table(tbl, 0, 0))
604 return (EINVAL);
605 kt = pfr_lookup_table(tbl);
606 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
607 return (ESRCH);
608 if (kt->pfrkt_cnt > *size) {
609 *size = kt->pfrkt_cnt;
610 return (0);
611 }
612
613 bzero(&w, sizeof(w));
614 w.pfrw_op = PFRW_GET_ASTATS;
615 w.pfrw_astats = addr;
616 w.pfrw_free = kt->pfrkt_cnt;
617 /*
618 * Flags below are for backward compatibility. It was possible to have
619 * a table without per-entry counters. Now they are always allocated,
620 * we just discard data when reading it if table is not configured to
621 * have counters.
622 */
623 w.pfrw_flags = kt->pfrkt_flags;
624 rv = kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
625 if (!rv)
626 rv = kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh,
627 pfr_walktree, &w);
628 if (!rv && (flags & PFR_FLAG_CLSTATS)) {
629 pfr_enqueue_addrs(kt, &workq, NULL, 0);
630 pfr_clstats_kentries(kt, &workq, tzero, 0);
631 }
632 if (rv)
633 return (rv);
634
635 if (w.pfrw_free) {
636 printf("pfr_get_astats: corruption detected (%d).\n",
637 w.pfrw_free);
638 return (ENOTTY);
639 }
640 *size = kt->pfrkt_cnt;
641 return (0);
642 }
643
644 int
pfr_clr_astats(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * nzero,int flags)645 pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size,
646 int *nzero, int flags)
647 {
648 struct pfr_ktable *kt;
649 struct pfr_kentryworkq workq;
650 struct pfr_kentry *p;
651 struct pfr_addr *ad;
652 int i, rv, xzero = 0;
653
654 PF_RULES_WASSERT();
655
656 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
657 if (pfr_validate_table(tbl, 0, 0))
658 return (EINVAL);
659 kt = pfr_lookup_table(tbl);
660 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
661 return (ESRCH);
662 SLIST_INIT(&workq);
663 for (i = 0, ad = addr; i < size; i++, ad++) {
664 if (pfr_validate_addr(ad))
665 senderr(EINVAL);
666 p = pfr_lookup_addr(kt, ad, 1);
667 if (flags & PFR_FLAG_FEEDBACK) {
668 ad->pfra_fback = (p != NULL) ?
669 PFR_FB_CLEARED : PFR_FB_NONE;
670 }
671 if (p != NULL) {
672 SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
673 xzero++;
674 }
675 }
676
677 if (!(flags & PFR_FLAG_DUMMY))
678 pfr_clstats_kentries(kt, &workq, time_second, 0);
679 if (nzero != NULL)
680 *nzero = xzero;
681 return (0);
682 _bad:
683 if (flags & PFR_FLAG_FEEDBACK)
684 pfr_reset_feedback(addr, size);
685 return (rv);
686 }
687
688 static int
pfr_validate_addr(struct pfr_addr * ad)689 pfr_validate_addr(struct pfr_addr *ad)
690 {
691 int i;
692
693 switch (ad->pfra_af) {
694 #ifdef INET
695 case AF_INET:
696 if (ad->pfra_net > 32)
697 return (-1);
698 break;
699 #endif /* INET */
700 #ifdef INET6
701 case AF_INET6:
702 if (ad->pfra_net > 128)
703 return (-1);
704 break;
705 #endif /* INET6 */
706 default:
707 return (-1);
708 }
709 if (ad->pfra_net < 128 &&
710 (((caddr_t)ad)[ad->pfra_net/8] & (0xFF >> (ad->pfra_net%8))))
711 return (-1);
712 for (i = (ad->pfra_net+7)/8; i < sizeof(ad->pfra_u); i++)
713 if (((caddr_t)ad)[i])
714 return (-1);
715 if (ad->pfra_not && ad->pfra_not != 1)
716 return (-1);
717 if (ad->pfra_fback)
718 return (-1);
719 return (0);
720 }
721
722 static void
pfr_enqueue_addrs(struct pfr_ktable * kt,struct pfr_kentryworkq * workq,int * naddr,int sweep)723 pfr_enqueue_addrs(struct pfr_ktable *kt, struct pfr_kentryworkq *workq,
724 int *naddr, int sweep)
725 {
726 struct pfr_walktree w;
727
728 SLIST_INIT(workq);
729 bzero(&w, sizeof(w));
730 w.pfrw_op = sweep ? PFRW_SWEEP : PFRW_ENQUEUE;
731 w.pfrw_workq = workq;
732 if (kt->pfrkt_ip4 != NULL)
733 if (kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh,
734 pfr_walktree, &w))
735 printf("pfr_enqueue_addrs: IPv4 walktree failed.\n");
736 if (kt->pfrkt_ip6 != NULL)
737 if (kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh,
738 pfr_walktree, &w))
739 printf("pfr_enqueue_addrs: IPv6 walktree failed.\n");
740 if (naddr != NULL)
741 *naddr = w.pfrw_cnt;
742 }
743
744 static void
pfr_mark_addrs(struct pfr_ktable * kt)745 pfr_mark_addrs(struct pfr_ktable *kt)
746 {
747 struct pfr_walktree w;
748
749 bzero(&w, sizeof(w));
750 w.pfrw_op = PFRW_MARK;
751 if (kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w))
752 printf("pfr_mark_addrs: IPv4 walktree failed.\n");
753 if (kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w))
754 printf("pfr_mark_addrs: IPv6 walktree failed.\n");
755 }
756
757 static struct pfr_kentry *
pfr_lookup_addr(struct pfr_ktable * kt,struct pfr_addr * ad,int exact)758 pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact)
759 {
760 union sockaddr_union sa, mask;
761 struct radix_head *head = NULL;
762 struct pfr_kentry *ke;
763
764 PF_RULES_ASSERT();
765
766 bzero(&sa, sizeof(sa));
767 if (ad->pfra_af == AF_INET) {
768 FILLIN_SIN(sa.sin, ad->pfra_ip4addr);
769 head = &kt->pfrkt_ip4->rh;
770 } else if ( ad->pfra_af == AF_INET6 ) {
771 FILLIN_SIN6(sa.sin6, ad->pfra_ip6addr);
772 head = &kt->pfrkt_ip6->rh;
773 }
774 if (ADDR_NETWORK(ad)) {
775 pfr_prepare_network(&mask, ad->pfra_af, ad->pfra_net);
776 ke = (struct pfr_kentry *)rn_lookup(&sa, &mask, head);
777 if (ke && KENTRY_RNF_ROOT(ke))
778 ke = NULL;
779 } else {
780 ke = (struct pfr_kentry *)rn_match(&sa, head);
781 if (ke && KENTRY_RNF_ROOT(ke))
782 ke = NULL;
783 if (exact && ke && KENTRY_NETWORK(ke))
784 ke = NULL;
785 }
786 return (ke);
787 }
788
789 static struct pfr_kentry *
pfr_create_kentry(struct pfr_addr * ad,bool counters)790 pfr_create_kentry(struct pfr_addr *ad, bool counters)
791 {
792 struct pfr_kentry *ke;
793 counter_u64_t c;
794
795 ke = uma_zalloc(V_pfr_kentry_z, M_NOWAIT | M_ZERO);
796 if (ke == NULL)
797 return (NULL);
798
799 if (ad->pfra_af == AF_INET)
800 FILLIN_SIN(ke->pfrke_sa.sin, ad->pfra_ip4addr);
801 else if (ad->pfra_af == AF_INET6)
802 FILLIN_SIN6(ke->pfrke_sa.sin6, ad->pfra_ip6addr);
803 ke->pfrke_af = ad->pfra_af;
804 ke->pfrke_net = ad->pfra_net;
805 ke->pfrke_not = ad->pfra_not;
806 ke->pfrke_counters.pfrkc_tzero = 0;
807 if (counters) {
808 c = uma_zalloc_pcpu(V_pfr_kentry_counter_z, M_NOWAIT | M_ZERO);
809 if (c == NULL) {
810 pfr_destroy_kentry(ke);
811 return (NULL);
812 }
813 ke->pfrke_counters.pfrkc_counters = c;
814 }
815 return (ke);
816 }
817
818 static void
pfr_destroy_kentries(struct pfr_kentryworkq * workq)819 pfr_destroy_kentries(struct pfr_kentryworkq *workq)
820 {
821 struct pfr_kentry *p, *q;
822
823 for (p = SLIST_FIRST(workq); p != NULL; p = q) {
824 q = SLIST_NEXT(p, pfrke_workq);
825 pfr_destroy_kentry(p);
826 }
827 }
828
829 static void
pfr_destroy_kentry(struct pfr_kentry * ke)830 pfr_destroy_kentry(struct pfr_kentry *ke)
831 {
832 counter_u64_t c;
833
834 if ((c = ke->pfrke_counters.pfrkc_counters) != NULL)
835 uma_zfree_pcpu(V_pfr_kentry_counter_z, c);
836 uma_zfree(V_pfr_kentry_z, ke);
837 }
838
839 static void
pfr_insert_kentries(struct pfr_ktable * kt,struct pfr_kentryworkq * workq,long tzero)840 pfr_insert_kentries(struct pfr_ktable *kt,
841 struct pfr_kentryworkq *workq, long tzero)
842 {
843 struct pfr_kentry *p;
844 int rv, n = 0;
845
846 SLIST_FOREACH(p, workq, pfrke_workq) {
847 rv = pfr_route_kentry(kt, p);
848 if (rv) {
849 printf("pfr_insert_kentries: cannot route entry "
850 "(code=%d).\n", rv);
851 break;
852 }
853 p->pfrke_counters.pfrkc_tzero = tzero;
854 n++;
855 }
856 kt->pfrkt_cnt += n;
857 }
858
859 int
pfr_insert_kentry(struct pfr_ktable * kt,struct pfr_addr * ad,long tzero)860 pfr_insert_kentry(struct pfr_ktable *kt, struct pfr_addr *ad, long tzero)
861 {
862 struct pfr_kentry *p;
863 int rv;
864
865 p = pfr_lookup_addr(kt, ad, 1);
866 if (p != NULL)
867 return (0);
868 p = pfr_create_kentry(ad, (kt->pfrkt_flags & PFR_TFLAG_COUNTERS) != 0);
869 if (p == NULL)
870 return (ENOMEM);
871
872 rv = pfr_route_kentry(kt, p);
873 if (rv)
874 return (rv);
875
876 p->pfrke_counters.pfrkc_tzero = tzero;
877 kt->pfrkt_cnt++;
878
879 return (0);
880 }
881
882 static void
pfr_remove_kentries(struct pfr_ktable * kt,struct pfr_kentryworkq * workq)883 pfr_remove_kentries(struct pfr_ktable *kt,
884 struct pfr_kentryworkq *workq)
885 {
886 struct pfr_kentry *p;
887 int n = 0;
888
889 SLIST_FOREACH(p, workq, pfrke_workq) {
890 pfr_unroute_kentry(kt, p);
891 n++;
892 }
893 kt->pfrkt_cnt -= n;
894 pfr_destroy_kentries(workq);
895 }
896
897 static void
pfr_clean_node_mask(struct pfr_ktable * kt,struct pfr_kentryworkq * workq)898 pfr_clean_node_mask(struct pfr_ktable *kt,
899 struct pfr_kentryworkq *workq)
900 {
901 struct pfr_kentry *p;
902
903 SLIST_FOREACH(p, workq, pfrke_workq)
904 pfr_unroute_kentry(kt, p);
905 }
906
907 static void
pfr_clstats_kentries(struct pfr_ktable * kt,struct pfr_kentryworkq * workq,long tzero,int negchange)908 pfr_clstats_kentries(struct pfr_ktable *kt, struct pfr_kentryworkq *workq,
909 long tzero, int negchange)
910 {
911 struct pfr_kentry *p;
912 int i;
913
914 SLIST_FOREACH(p, workq, pfrke_workq) {
915 if (negchange)
916 p->pfrke_not = !p->pfrke_not;
917 if ((kt->pfrkt_flags & PFR_TFLAG_COUNTERS) != 0)
918 for (i = 0; i < PFR_NUM_COUNTERS; i++)
919 counter_u64_zero(
920 p->pfrke_counters.pfrkc_counters + i);
921 p->pfrke_counters.pfrkc_tzero = tzero;
922 }
923 }
924
925 static void
pfr_reset_feedback(struct pfr_addr * addr,int size)926 pfr_reset_feedback(struct pfr_addr *addr, int size)
927 {
928 struct pfr_addr *ad;
929 int i;
930
931 for (i = 0, ad = addr; i < size; i++, ad++)
932 ad->pfra_fback = PFR_FB_NONE;
933 }
934
935 static void
pfr_prepare_network(union sockaddr_union * sa,int af,int net)936 pfr_prepare_network(union sockaddr_union *sa, int af, int net)
937 {
938 int i;
939
940 bzero(sa, sizeof(*sa));
941 if (af == AF_INET) {
942 sa->sin.sin_len = sizeof(sa->sin);
943 sa->sin.sin_family = AF_INET;
944 sa->sin.sin_addr.s_addr = net ? htonl(-1 << (32-net)) : 0;
945 } else if (af == AF_INET6) {
946 sa->sin6.sin6_len = sizeof(sa->sin6);
947 sa->sin6.sin6_family = AF_INET6;
948 for (i = 0; i < 4; i++) {
949 if (net <= 32) {
950 sa->sin6.sin6_addr.s6_addr32[i] =
951 net ? htonl(-1 << (32-net)) : 0;
952 break;
953 }
954 sa->sin6.sin6_addr.s6_addr32[i] = 0xFFFFFFFF;
955 net -= 32;
956 }
957 }
958 }
959
960 static int
pfr_route_kentry(struct pfr_ktable * kt,struct pfr_kentry * ke)961 pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
962 {
963 union sockaddr_union mask;
964 struct radix_node *rn;
965 struct radix_head *head = NULL;
966
967 PF_RULES_WASSERT();
968
969 bzero(ke->pfrke_node, sizeof(ke->pfrke_node));
970 if (ke->pfrke_af == AF_INET)
971 head = &kt->pfrkt_ip4->rh;
972 else if (ke->pfrke_af == AF_INET6)
973 head = &kt->pfrkt_ip6->rh;
974
975 if (KENTRY_NETWORK(ke)) {
976 pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
977 rn = rn_addroute(&ke->pfrke_sa, &mask, head, ke->pfrke_node);
978 } else
979 rn = rn_addroute(&ke->pfrke_sa, NULL, head, ke->pfrke_node);
980
981 return (rn == NULL ? -1 : 0);
982 }
983
984 static int
pfr_unroute_kentry(struct pfr_ktable * kt,struct pfr_kentry * ke)985 pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
986 {
987 union sockaddr_union mask;
988 struct radix_node *rn;
989 struct radix_head *head = NULL;
990
991 if (ke->pfrke_af == AF_INET)
992 head = &kt->pfrkt_ip4->rh;
993 else if (ke->pfrke_af == AF_INET6)
994 head = &kt->pfrkt_ip6->rh;
995
996 if (KENTRY_NETWORK(ke)) {
997 pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
998 rn = rn_delete(&ke->pfrke_sa, &mask, head);
999 } else
1000 rn = rn_delete(&ke->pfrke_sa, NULL, head);
1001
1002 if (rn == NULL) {
1003 printf("pfr_unroute_kentry: delete failed.\n");
1004 return (-1);
1005 }
1006 return (0);
1007 }
1008
1009 static void
pfr_copyout_addr(struct pfr_addr * ad,const struct pfr_kentry * ke)1010 pfr_copyout_addr(struct pfr_addr *ad, const struct pfr_kentry *ke)
1011 {
1012 bzero(ad, sizeof(*ad));
1013 if (ke == NULL)
1014 return;
1015 ad->pfra_af = ke->pfrke_af;
1016 ad->pfra_net = ke->pfrke_net;
1017 ad->pfra_not = ke->pfrke_not;
1018 if (ad->pfra_af == AF_INET)
1019 ad->pfra_ip4addr = ke->pfrke_sa.sin.sin_addr;
1020 else if (ad->pfra_af == AF_INET6)
1021 ad->pfra_ip6addr = ke->pfrke_sa.sin6.sin6_addr;
1022 }
1023
1024 static void
pfr_copyout_astats(struct pfr_astats * as,const struct pfr_kentry * ke,const struct pfr_walktree * w)1025 pfr_copyout_astats(struct pfr_astats *as, const struct pfr_kentry *ke,
1026 const struct pfr_walktree *w)
1027 {
1028 int dir, op;
1029 const struct pfr_kcounters *kc = &ke->pfrke_counters;
1030
1031 bzero(as, sizeof(*as));
1032 pfr_copyout_addr(&as->pfras_a, ke);
1033 as->pfras_tzero = kc->pfrkc_tzero;
1034
1035 if (! (w->pfrw_flags & PFR_TFLAG_COUNTERS) ||
1036 kc->pfrkc_counters == NULL) {
1037 bzero(as->pfras_packets, sizeof(as->pfras_packets));
1038 bzero(as->pfras_bytes, sizeof(as->pfras_bytes));
1039 as->pfras_a.pfra_fback = PFR_FB_NOCOUNT;
1040 return;
1041 }
1042
1043 for (dir = 0; dir < PFR_DIR_MAX; dir++) {
1044 for (op = 0; op < PFR_OP_ADDR_MAX; op ++) {
1045 as->pfras_packets[dir][op] = counter_u64_fetch(
1046 pfr_kentry_counter(kc, dir, op, PFR_TYPE_PACKETS));
1047 as->pfras_bytes[dir][op] = counter_u64_fetch(
1048 pfr_kentry_counter(kc, dir, op, PFR_TYPE_BYTES));
1049 }
1050 }
1051 }
1052
1053 static int
pfr_walktree(struct radix_node * rn,void * arg)1054 pfr_walktree(struct radix_node *rn, void *arg)
1055 {
1056 struct pfr_kentry *ke = (struct pfr_kentry *)rn;
1057 struct pfr_walktree *w = arg;
1058
1059 switch (w->pfrw_op) {
1060 case PFRW_MARK:
1061 ke->pfrke_mark = 0;
1062 break;
1063 case PFRW_SWEEP:
1064 if (ke->pfrke_mark)
1065 break;
1066 /* FALLTHROUGH */
1067 case PFRW_ENQUEUE:
1068 SLIST_INSERT_HEAD(w->pfrw_workq, ke, pfrke_workq);
1069 w->pfrw_cnt++;
1070 break;
1071 case PFRW_GET_ADDRS:
1072 if (w->pfrw_free-- > 0) {
1073 pfr_copyout_addr(w->pfrw_addr, ke);
1074 w->pfrw_addr++;
1075 }
1076 break;
1077 case PFRW_GET_ASTATS:
1078 if (w->pfrw_free-- > 0) {
1079 struct pfr_astats as;
1080
1081 pfr_copyout_astats(&as, ke, w);
1082
1083 bcopy(&as, w->pfrw_astats, sizeof(as));
1084 w->pfrw_astats++;
1085 }
1086 break;
1087 case PFRW_POOL_GET:
1088 if (ke->pfrke_not)
1089 break; /* negative entries are ignored */
1090 if (!w->pfrw_cnt--) {
1091 w->pfrw_kentry = ke;
1092 return (1); /* finish search */
1093 }
1094 break;
1095 case PFRW_DYNADDR_UPDATE:
1096 {
1097 union sockaddr_union pfr_mask;
1098
1099 if (ke->pfrke_af == AF_INET) {
1100 if (w->pfrw_dyn->pfid_acnt4++ > 0)
1101 break;
1102 pfr_prepare_network(&pfr_mask, AF_INET, ke->pfrke_net);
1103 w->pfrw_dyn->pfid_addr4 = *SUNION2PF(&ke->pfrke_sa,
1104 AF_INET);
1105 w->pfrw_dyn->pfid_mask4 = *SUNION2PF(&pfr_mask,
1106 AF_INET);
1107 } else if (ke->pfrke_af == AF_INET6){
1108 if (w->pfrw_dyn->pfid_acnt6++ > 0)
1109 break;
1110 pfr_prepare_network(&pfr_mask, AF_INET6, ke->pfrke_net);
1111 w->pfrw_dyn->pfid_addr6 = *SUNION2PF(&ke->pfrke_sa,
1112 AF_INET6);
1113 w->pfrw_dyn->pfid_mask6 = *SUNION2PF(&pfr_mask,
1114 AF_INET6);
1115 }
1116 break;
1117 }
1118 case PFRW_COUNTERS:
1119 {
1120 if (w->pfrw_flags & PFR_TFLAG_COUNTERS) {
1121 if (ke->pfrke_counters.pfrkc_counters != NULL)
1122 break;
1123 ke->pfrke_counters.pfrkc_counters =
1124 uma_zalloc_pcpu(V_pfr_kentry_counter_z,
1125 M_NOWAIT | M_ZERO);
1126 } else {
1127 uma_zfree_pcpu(V_pfr_kentry_counter_z,
1128 ke->pfrke_counters.pfrkc_counters);
1129 ke->pfrke_counters.pfrkc_counters = NULL;
1130 }
1131 break;
1132 }
1133 }
1134 return (0);
1135 }
1136
1137 int
pfr_clr_tables(struct pfr_table * filter,int * ndel,int flags)1138 pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags)
1139 {
1140 struct pfr_ktableworkq workq;
1141 struct pfr_ktable *p;
1142 int xdel = 0;
1143
1144 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ALLRSETS);
1145 if (pfr_fix_anchor(filter->pfrt_anchor))
1146 return (EINVAL);
1147 if (pfr_table_count(filter, flags) < 0)
1148 return (ENOENT);
1149
1150 SLIST_INIT(&workq);
1151 RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {
1152 if (pfr_skip_table(filter, p, flags))
1153 continue;
1154 if (!strcmp(p->pfrkt_anchor, PF_RESERVED_ANCHOR))
1155 continue;
1156 if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE))
1157 continue;
1158 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1159 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1160 xdel++;
1161 }
1162 if (!(flags & PFR_FLAG_DUMMY))
1163 pfr_setflags_ktables(&workq);
1164 if (ndel != NULL)
1165 *ndel = xdel;
1166 return (0);
1167 }
1168
1169 int
pfr_add_tables(struct pfr_table * tbl,int size,int * nadd,int flags)1170 pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags)
1171 {
1172 struct pfr_ktableworkq addq, changeq;
1173 struct pfr_ktable *p, *q, *r, key;
1174 int i, rv, xadd = 0;
1175 long tzero = time_second;
1176
1177 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1178 SLIST_INIT(&addq);
1179 SLIST_INIT(&changeq);
1180 for (i = 0; i < size; i++) {
1181 bcopy(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t));
1182 if (pfr_validate_table(&key.pfrkt_t, PFR_TFLAG_USRMASK,
1183 flags & PFR_FLAG_USERIOCTL))
1184 senderr(EINVAL);
1185 key.pfrkt_flags |= PFR_TFLAG_ACTIVE;
1186 p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);
1187 if (p == NULL) {
1188 p = pfr_create_ktable(&key.pfrkt_t, tzero, 1);
1189 if (p == NULL)
1190 senderr(ENOMEM);
1191 SLIST_FOREACH(q, &addq, pfrkt_workq) {
1192 if (!pfr_ktable_compare(p, q)) {
1193 pfr_destroy_ktable(p, 0);
1194 goto _skip;
1195 }
1196 }
1197 SLIST_INSERT_HEAD(&addq, p, pfrkt_workq);
1198 xadd++;
1199 if (!key.pfrkt_anchor[0])
1200 goto _skip;
1201
1202 /* find or create root table */
1203 bzero(key.pfrkt_anchor, sizeof(key.pfrkt_anchor));
1204 r = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);
1205 if (r != NULL) {
1206 p->pfrkt_root = r;
1207 goto _skip;
1208 }
1209 SLIST_FOREACH(q, &addq, pfrkt_workq) {
1210 if (!pfr_ktable_compare(&key, q)) {
1211 p->pfrkt_root = q;
1212 goto _skip;
1213 }
1214 }
1215 key.pfrkt_flags = 0;
1216 r = pfr_create_ktable(&key.pfrkt_t, 0, 1);
1217 if (r == NULL)
1218 senderr(ENOMEM);
1219 SLIST_INSERT_HEAD(&addq, r, pfrkt_workq);
1220 p->pfrkt_root = r;
1221 } else if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1222 SLIST_FOREACH(q, &changeq, pfrkt_workq)
1223 if (!pfr_ktable_compare(&key, q))
1224 goto _skip;
1225 p->pfrkt_nflags = (p->pfrkt_flags &
1226 ~PFR_TFLAG_USRMASK) | key.pfrkt_flags;
1227 SLIST_INSERT_HEAD(&changeq, p, pfrkt_workq);
1228 xadd++;
1229 }
1230 _skip:
1231 ;
1232 }
1233 if (!(flags & PFR_FLAG_DUMMY)) {
1234 pfr_insert_ktables(&addq);
1235 pfr_setflags_ktables(&changeq);
1236 } else
1237 pfr_destroy_ktables(&addq, 0);
1238 if (nadd != NULL)
1239 *nadd = xadd;
1240 return (0);
1241 _bad:
1242 pfr_destroy_ktables(&addq, 0);
1243 return (rv);
1244 }
1245
1246 int
pfr_del_tables(struct pfr_table * tbl,int size,int * ndel,int flags)1247 pfr_del_tables(struct pfr_table *tbl, int size, int *ndel, int flags)
1248 {
1249 struct pfr_ktableworkq workq;
1250 struct pfr_ktable *p, *q, key;
1251 int i, xdel = 0;
1252
1253 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1254 SLIST_INIT(&workq);
1255 for (i = 0; i < size; i++) {
1256 bcopy(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t));
1257 if (pfr_validate_table(&key.pfrkt_t, 0,
1258 flags & PFR_FLAG_USERIOCTL))
1259 return (EINVAL);
1260 p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);
1261 if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1262 SLIST_FOREACH(q, &workq, pfrkt_workq)
1263 if (!pfr_ktable_compare(p, q))
1264 goto _skip;
1265 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1266 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1267 xdel++;
1268 }
1269 _skip:
1270 ;
1271 }
1272
1273 if (!(flags & PFR_FLAG_DUMMY))
1274 pfr_setflags_ktables(&workq);
1275 if (ndel != NULL)
1276 *ndel = xdel;
1277 return (0);
1278 }
1279
1280 int
pfr_get_tables(struct pfr_table * filter,struct pfr_table * tbl,int * size,int flags)1281 pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size,
1282 int flags)
1283 {
1284 struct pfr_ktable *p;
1285 int n, nn;
1286
1287 PF_RULES_RASSERT();
1288
1289 ACCEPT_FLAGS(flags, PFR_FLAG_ALLRSETS);
1290 if (pfr_fix_anchor(filter->pfrt_anchor))
1291 return (EINVAL);
1292 n = nn = pfr_table_count(filter, flags);
1293 if (n < 0)
1294 return (ENOENT);
1295 if (n > *size) {
1296 *size = n;
1297 return (0);
1298 }
1299 RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {
1300 if (pfr_skip_table(filter, p, flags))
1301 continue;
1302 if (n-- <= 0)
1303 continue;
1304 bcopy(&p->pfrkt_t, tbl++, sizeof(*tbl));
1305 }
1306
1307 KASSERT(n == 0, ("%s: corruption detected (%d)", __func__, n));
1308
1309 *size = nn;
1310 return (0);
1311 }
1312
1313 int
pfr_get_tstats(struct pfr_table * filter,struct pfr_tstats * tbl,int * size,int flags)1314 pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size,
1315 int flags)
1316 {
1317 struct pfr_ktable *p;
1318 struct pfr_ktableworkq workq;
1319 int n, nn;
1320 long tzero = time_second;
1321 int pfr_dir, pfr_op;
1322
1323 /* XXX PFR_FLAG_CLSTATS disabled */
1324 ACCEPT_FLAGS(flags, PFR_FLAG_ALLRSETS);
1325 if (pfr_fix_anchor(filter->pfrt_anchor))
1326 return (EINVAL);
1327 n = nn = pfr_table_count(filter, flags);
1328 if (n < 0)
1329 return (ENOENT);
1330 if (n > *size) {
1331 *size = n;
1332 return (0);
1333 }
1334 SLIST_INIT(&workq);
1335 RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {
1336 if (pfr_skip_table(filter, p, flags))
1337 continue;
1338 if (n-- <= 0)
1339 continue;
1340 bcopy(&p->pfrkt_kts.pfrts_t, &tbl->pfrts_t,
1341 sizeof(struct pfr_table));
1342 for (pfr_dir = 0; pfr_dir < PFR_DIR_MAX; pfr_dir ++) {
1343 for (pfr_op = 0; pfr_op < PFR_OP_TABLE_MAX; pfr_op ++) {
1344 tbl->pfrts_packets[pfr_dir][pfr_op] =
1345 pfr_kstate_counter_fetch(
1346 &p->pfrkt_packets[pfr_dir][pfr_op]);
1347 tbl->pfrts_bytes[pfr_dir][pfr_op] =
1348 pfr_kstate_counter_fetch(
1349 &p->pfrkt_bytes[pfr_dir][pfr_op]);
1350 }
1351 }
1352 tbl->pfrts_match = pfr_kstate_counter_fetch(&p->pfrkt_match);
1353 tbl->pfrts_nomatch = pfr_kstate_counter_fetch(&p->pfrkt_nomatch);
1354 tbl->pfrts_tzero = p->pfrkt_tzero;
1355 tbl->pfrts_cnt = p->pfrkt_cnt;
1356 for (pfr_op = 0; pfr_op < PFR_REFCNT_MAX; pfr_op++)
1357 tbl->pfrts_refcnt[pfr_op] = p->pfrkt_refcnt[pfr_op];
1358 tbl++;
1359 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1360 }
1361 if (flags & PFR_FLAG_CLSTATS)
1362 pfr_clstats_ktables(&workq, tzero,
1363 flags & PFR_FLAG_ADDRSTOO);
1364
1365 KASSERT(n == 0, ("%s: corruption detected (%d)", __func__, n));
1366
1367 *size = nn;
1368 return (0);
1369 }
1370
1371 int
pfr_clr_tstats(struct pfr_table * tbl,int size,int * nzero,int flags)1372 pfr_clr_tstats(struct pfr_table *tbl, int size, int *nzero, int flags)
1373 {
1374 struct pfr_ktableworkq workq;
1375 struct pfr_ktable *p, key;
1376 int i, xzero = 0;
1377 long tzero = time_second;
1378
1379 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ADDRSTOO);
1380 SLIST_INIT(&workq);
1381 for (i = 0; i < size; i++) {
1382 bcopy(tbl + i, &key.pfrkt_t, sizeof(key.pfrkt_t));
1383 if (pfr_validate_table(&key.pfrkt_t, 0, 0))
1384 return (EINVAL);
1385 p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);
1386 if (p != NULL) {
1387 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1388 xzero++;
1389 }
1390 }
1391 if (!(flags & PFR_FLAG_DUMMY))
1392 pfr_clstats_ktables(&workq, tzero, flags & PFR_FLAG_ADDRSTOO);
1393 if (nzero != NULL)
1394 *nzero = xzero;
1395 return (0);
1396 }
1397
1398 int
pfr_set_tflags(struct pfr_table * tbl,int size,int setflag,int clrflag,int * nchange,int * ndel,int flags)1399 pfr_set_tflags(struct pfr_table *tbl, int size, int setflag, int clrflag,
1400 int *nchange, int *ndel, int flags)
1401 {
1402 struct pfr_ktableworkq workq;
1403 struct pfr_ktable *p, *q, key;
1404 int i, xchange = 0, xdel = 0;
1405
1406 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1407 if ((setflag & ~PFR_TFLAG_USRMASK) ||
1408 (clrflag & ~PFR_TFLAG_USRMASK) ||
1409 (setflag & clrflag))
1410 return (EINVAL);
1411 SLIST_INIT(&workq);
1412 for (i = 0; i < size; i++) {
1413 bcopy(tbl + i, &key.pfrkt_t, sizeof(key.pfrkt_t));
1414 if (pfr_validate_table(&key.pfrkt_t, 0,
1415 flags & PFR_FLAG_USERIOCTL))
1416 return (EINVAL);
1417 p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);
1418 if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1419 p->pfrkt_nflags = (p->pfrkt_flags | setflag) &
1420 ~clrflag;
1421 if (p->pfrkt_nflags == p->pfrkt_flags)
1422 goto _skip;
1423 SLIST_FOREACH(q, &workq, pfrkt_workq)
1424 if (!pfr_ktable_compare(p, q))
1425 goto _skip;
1426 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1427 if ((p->pfrkt_flags & PFR_TFLAG_PERSIST) &&
1428 (clrflag & PFR_TFLAG_PERSIST) &&
1429 !(p->pfrkt_flags & PFR_TFLAG_REFERENCED))
1430 xdel++;
1431 else
1432 xchange++;
1433 }
1434 _skip:
1435 ;
1436 }
1437 if (!(flags & PFR_FLAG_DUMMY))
1438 pfr_setflags_ktables(&workq);
1439 if (nchange != NULL)
1440 *nchange = xchange;
1441 if (ndel != NULL)
1442 *ndel = xdel;
1443 return (0);
1444 }
1445
1446 int
pfr_ina_begin(struct pfr_table * trs,u_int32_t * ticket,int * ndel,int flags)1447 pfr_ina_begin(struct pfr_table *trs, u_int32_t *ticket, int *ndel, int flags)
1448 {
1449 struct pfr_ktableworkq workq;
1450 struct pfr_ktable *p;
1451 struct pf_kruleset *rs;
1452 int xdel = 0;
1453
1454 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1455 rs = pf_find_or_create_kruleset(trs->pfrt_anchor);
1456 if (rs == NULL)
1457 return (ENOMEM);
1458 SLIST_INIT(&workq);
1459 RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {
1460 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1461 pfr_skip_table(trs, p, 0))
1462 continue;
1463 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1464 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1465 xdel++;
1466 }
1467 if (!(flags & PFR_FLAG_DUMMY)) {
1468 pfr_setflags_ktables(&workq);
1469 if (ticket != NULL)
1470 *ticket = ++rs->tticket;
1471 rs->topen = 1;
1472 } else
1473 pf_remove_if_empty_kruleset(rs);
1474 if (ndel != NULL)
1475 *ndel = xdel;
1476 return (0);
1477 }
1478
1479 int
pfr_ina_define(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * nadd,int * naddr,u_int32_t ticket,int flags)1480 pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size,
1481 int *nadd, int *naddr, u_int32_t ticket, int flags)
1482 {
1483 struct pfr_ktableworkq tableq;
1484 struct pfr_kentryworkq addrq;
1485 struct pfr_ktable *kt, *rt, *shadow, key;
1486 struct pfr_kentry *p;
1487 struct pfr_addr *ad;
1488 struct pf_kruleset *rs;
1489 int i, rv, xadd = 0, xaddr = 0;
1490
1491 PF_RULES_WASSERT();
1492
1493 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ADDRSTOO);
1494 if (size && !(flags & PFR_FLAG_ADDRSTOO))
1495 return (EINVAL);
1496 if (pfr_validate_table(tbl, PFR_TFLAG_USRMASK,
1497 flags & PFR_FLAG_USERIOCTL))
1498 return (EINVAL);
1499 rs = pf_find_kruleset(tbl->pfrt_anchor);
1500 if (rs == NULL || !rs->topen || ticket != rs->tticket)
1501 return (EBUSY);
1502 tbl->pfrt_flags |= PFR_TFLAG_INACTIVE;
1503 SLIST_INIT(&tableq);
1504 kt = RB_FIND(pfr_ktablehead, &V_pfr_ktables, (struct pfr_ktable *)tbl);
1505 if (kt == NULL) {
1506 kt = pfr_create_ktable(tbl, 0, 1);
1507 if (kt == NULL)
1508 return (ENOMEM);
1509 SLIST_INSERT_HEAD(&tableq, kt, pfrkt_workq);
1510 xadd++;
1511 if (!tbl->pfrt_anchor[0])
1512 goto _skip;
1513
1514 /* find or create root table */
1515 bzero(&key, sizeof(key));
1516 strlcpy(key.pfrkt_name, tbl->pfrt_name, sizeof(key.pfrkt_name));
1517 rt = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);
1518 if (rt != NULL) {
1519 kt->pfrkt_root = rt;
1520 goto _skip;
1521 }
1522 rt = pfr_create_ktable(&key.pfrkt_t, 0, 1);
1523 if (rt == NULL) {
1524 pfr_destroy_ktables(&tableq, 0);
1525 return (ENOMEM);
1526 }
1527 SLIST_INSERT_HEAD(&tableq, rt, pfrkt_workq);
1528 kt->pfrkt_root = rt;
1529 } else if (!(kt->pfrkt_flags & PFR_TFLAG_INACTIVE))
1530 xadd++;
1531 _skip:
1532 shadow = pfr_create_ktable(tbl, 0, 0);
1533 if (shadow == NULL) {
1534 pfr_destroy_ktables(&tableq, 0);
1535 return (ENOMEM);
1536 }
1537 SLIST_INIT(&addrq);
1538 for (i = 0, ad = addr; i < size; i++, ad++) {
1539 if (pfr_validate_addr(ad))
1540 senderr(EINVAL);
1541 if (pfr_lookup_addr(shadow, ad, 1) != NULL)
1542 continue;
1543 p = pfr_create_kentry(ad,
1544 (shadow->pfrkt_flags & PFR_TFLAG_COUNTERS) != 0);
1545 if (p == NULL)
1546 senderr(ENOMEM);
1547 if (pfr_route_kentry(shadow, p)) {
1548 pfr_destroy_kentry(p);
1549 continue;
1550 }
1551 SLIST_INSERT_HEAD(&addrq, p, pfrke_workq);
1552 xaddr++;
1553 }
1554 if (!(flags & PFR_FLAG_DUMMY)) {
1555 if (kt->pfrkt_shadow != NULL)
1556 pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1557 kt->pfrkt_flags |= PFR_TFLAG_INACTIVE;
1558 pfr_insert_ktables(&tableq);
1559 shadow->pfrkt_cnt = (flags & PFR_FLAG_ADDRSTOO) ?
1560 xaddr : NO_ADDRESSES;
1561 kt->pfrkt_shadow = shadow;
1562 } else {
1563 pfr_clean_node_mask(shadow, &addrq);
1564 pfr_destroy_ktable(shadow, 0);
1565 pfr_destroy_ktables(&tableq, 0);
1566 pfr_destroy_kentries(&addrq);
1567 }
1568 if (nadd != NULL)
1569 *nadd = xadd;
1570 if (naddr != NULL)
1571 *naddr = xaddr;
1572 return (0);
1573 _bad:
1574 pfr_destroy_ktable(shadow, 0);
1575 pfr_destroy_ktables(&tableq, 0);
1576 pfr_destroy_kentries(&addrq);
1577 return (rv);
1578 }
1579
1580 int
pfr_ina_rollback(struct pfr_table * trs,u_int32_t ticket,int * ndel,int flags)1581 pfr_ina_rollback(struct pfr_table *trs, u_int32_t ticket, int *ndel, int flags)
1582 {
1583 struct pfr_ktableworkq workq;
1584 struct pfr_ktable *p;
1585 struct pf_kruleset *rs;
1586 int xdel = 0;
1587
1588 PF_RULES_WASSERT();
1589
1590 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1591 rs = pf_find_kruleset(trs->pfrt_anchor);
1592 if (rs == NULL || !rs->topen || ticket != rs->tticket)
1593 return (0);
1594 SLIST_INIT(&workq);
1595 RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {
1596 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1597 pfr_skip_table(trs, p, 0))
1598 continue;
1599 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1600 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1601 xdel++;
1602 }
1603 if (!(flags & PFR_FLAG_DUMMY)) {
1604 pfr_setflags_ktables(&workq);
1605 rs->topen = 0;
1606 pf_remove_if_empty_kruleset(rs);
1607 }
1608 if (ndel != NULL)
1609 *ndel = xdel;
1610 return (0);
1611 }
1612
1613 int
pfr_ina_commit(struct pfr_table * trs,u_int32_t ticket,int * nadd,int * nchange,int flags)1614 pfr_ina_commit(struct pfr_table *trs, u_int32_t ticket, int *nadd,
1615 int *nchange, int flags)
1616 {
1617 struct pfr_ktable *p, *q;
1618 struct pfr_ktableworkq workq;
1619 struct pf_kruleset *rs;
1620 int xadd = 0, xchange = 0;
1621 long tzero = time_second;
1622
1623 PF_RULES_WASSERT();
1624
1625 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1626 rs = pf_find_kruleset(trs->pfrt_anchor);
1627 if (rs == NULL || !rs->topen || ticket != rs->tticket)
1628 return (EBUSY);
1629
1630 SLIST_INIT(&workq);
1631 RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {
1632 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1633 pfr_skip_table(trs, p, 0))
1634 continue;
1635 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1636 if (p->pfrkt_flags & PFR_TFLAG_ACTIVE)
1637 xchange++;
1638 else
1639 xadd++;
1640 }
1641
1642 if (!(flags & PFR_FLAG_DUMMY)) {
1643 for (p = SLIST_FIRST(&workq); p != NULL; p = q) {
1644 q = SLIST_NEXT(p, pfrkt_workq);
1645 pfr_commit_ktable(p, tzero);
1646 }
1647 rs->topen = 0;
1648 pf_remove_if_empty_kruleset(rs);
1649 }
1650 if (nadd != NULL)
1651 *nadd = xadd;
1652 if (nchange != NULL)
1653 *nchange = xchange;
1654
1655 return (0);
1656 }
1657
1658 static void
pfr_commit_ktable(struct pfr_ktable * kt,long tzero)1659 pfr_commit_ktable(struct pfr_ktable *kt, long tzero)
1660 {
1661 counter_u64_t *pkc, *qkc;
1662 struct pfr_ktable *shadow = kt->pfrkt_shadow;
1663 int nflags;
1664
1665 PF_RULES_WASSERT();
1666
1667 if (shadow->pfrkt_cnt == NO_ADDRESSES) {
1668 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1669 pfr_clstats_ktable(kt, tzero, 1);
1670 } else if (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) {
1671 /* kt might contain addresses */
1672 struct pfr_kentryworkq addrq, addq, changeq, delq, garbageq;
1673 struct pfr_kentry *p, *q, *next;
1674 struct pfr_addr ad;
1675
1676 pfr_enqueue_addrs(shadow, &addrq, NULL, 0);
1677 pfr_mark_addrs(kt);
1678 SLIST_INIT(&addq);
1679 SLIST_INIT(&changeq);
1680 SLIST_INIT(&delq);
1681 SLIST_INIT(&garbageq);
1682 pfr_clean_node_mask(shadow, &addrq);
1683 SLIST_FOREACH_SAFE(p, &addrq, pfrke_workq, next) {
1684 pfr_copyout_addr(&ad, p);
1685 q = pfr_lookup_addr(kt, &ad, 1);
1686 if (q != NULL) {
1687 if (q->pfrke_not != p->pfrke_not)
1688 SLIST_INSERT_HEAD(&changeq, q,
1689 pfrke_workq);
1690 pkc = &p->pfrke_counters.pfrkc_counters;
1691 qkc = &q->pfrke_counters.pfrkc_counters;
1692 if ((*pkc == NULL) != (*qkc == NULL))
1693 SWAP(counter_u64_t, *pkc, *qkc);
1694 q->pfrke_mark = 1;
1695 SLIST_INSERT_HEAD(&garbageq, p, pfrke_workq);
1696 } else {
1697 p->pfrke_counters.pfrkc_tzero = tzero;
1698 SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
1699 }
1700 }
1701 pfr_enqueue_addrs(kt, &delq, NULL, ENQUEUE_UNMARKED_ONLY);
1702 pfr_insert_kentries(kt, &addq, tzero);
1703 pfr_remove_kentries(kt, &delq);
1704 pfr_clstats_kentries(kt, &changeq, tzero, INVERT_NEG_FLAG);
1705 pfr_destroy_kentries(&garbageq);
1706 } else {
1707 /* kt cannot contain addresses */
1708 SWAP(struct radix_node_head *, kt->pfrkt_ip4,
1709 shadow->pfrkt_ip4);
1710 SWAP(struct radix_node_head *, kt->pfrkt_ip6,
1711 shadow->pfrkt_ip6);
1712 SWAP(int, kt->pfrkt_cnt, shadow->pfrkt_cnt);
1713 pfr_clstats_ktable(kt, tzero, 1);
1714 }
1715 nflags = ((shadow->pfrkt_flags & PFR_TFLAG_USRMASK) |
1716 (kt->pfrkt_flags & PFR_TFLAG_SETMASK) | PFR_TFLAG_ACTIVE)
1717 & ~PFR_TFLAG_INACTIVE;
1718 pfr_destroy_ktable(shadow, 0);
1719 kt->pfrkt_shadow = NULL;
1720 pfr_setflags_ktable(kt, nflags);
1721 }
1722
1723 static int
pfr_validate_table(struct pfr_table * tbl,int allowedflags,int no_reserved)1724 pfr_validate_table(struct pfr_table *tbl, int allowedflags, int no_reserved)
1725 {
1726 int i;
1727
1728 if (!tbl->pfrt_name[0])
1729 return (-1);
1730 if (no_reserved && !strcmp(tbl->pfrt_anchor, PF_RESERVED_ANCHOR))
1731 return (-1);
1732 if (tbl->pfrt_name[PF_TABLE_NAME_SIZE-1])
1733 return (-1);
1734 for (i = strlen(tbl->pfrt_name); i < PF_TABLE_NAME_SIZE; i++)
1735 if (tbl->pfrt_name[i])
1736 return (-1);
1737 if (pfr_fix_anchor(tbl->pfrt_anchor))
1738 return (-1);
1739 if (tbl->pfrt_flags & ~allowedflags)
1740 return (-1);
1741 return (0);
1742 }
1743
1744 /*
1745 * Rewrite anchors referenced by tables to remove slashes
1746 * and check for validity.
1747 */
1748 static int
pfr_fix_anchor(char * anchor)1749 pfr_fix_anchor(char *anchor)
1750 {
1751 size_t siz = MAXPATHLEN;
1752 int i;
1753
1754 if (anchor[0] == '/') {
1755 char *path;
1756 int off;
1757
1758 path = anchor;
1759 off = 1;
1760 while (*++path == '/')
1761 off++;
1762 bcopy(path, anchor, siz - off);
1763 memset(anchor + siz - off, 0, off);
1764 }
1765 if (anchor[siz - 1])
1766 return (-1);
1767 for (i = strlen(anchor); i < siz; i++)
1768 if (anchor[i])
1769 return (-1);
1770 return (0);
1771 }
1772
1773 int
pfr_table_count(struct pfr_table * filter,int flags)1774 pfr_table_count(struct pfr_table *filter, int flags)
1775 {
1776 struct pf_kruleset *rs;
1777
1778 PF_RULES_ASSERT();
1779
1780 if (flags & PFR_FLAG_ALLRSETS)
1781 return (V_pfr_ktable_cnt);
1782 if (filter->pfrt_anchor[0]) {
1783 rs = pf_find_kruleset(filter->pfrt_anchor);
1784 return ((rs != NULL) ? rs->tables : -1);
1785 }
1786 return (pf_main_ruleset.tables);
1787 }
1788
1789 static int
pfr_skip_table(struct pfr_table * filter,struct pfr_ktable * kt,int flags)1790 pfr_skip_table(struct pfr_table *filter, struct pfr_ktable *kt, int flags)
1791 {
1792 if (flags & PFR_FLAG_ALLRSETS)
1793 return (0);
1794 if (strcmp(filter->pfrt_anchor, kt->pfrkt_anchor))
1795 return (1);
1796 return (0);
1797 }
1798
1799 static void
pfr_insert_ktables(struct pfr_ktableworkq * workq)1800 pfr_insert_ktables(struct pfr_ktableworkq *workq)
1801 {
1802 struct pfr_ktable *p;
1803
1804 SLIST_FOREACH(p, workq, pfrkt_workq)
1805 pfr_insert_ktable(p);
1806 }
1807
1808 static void
pfr_insert_ktable(struct pfr_ktable * kt)1809 pfr_insert_ktable(struct pfr_ktable *kt)
1810 {
1811
1812 PF_RULES_WASSERT();
1813
1814 RB_INSERT(pfr_ktablehead, &V_pfr_ktables, kt);
1815 V_pfr_ktable_cnt++;
1816 if (kt->pfrkt_root != NULL)
1817 if (!kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]++)
1818 pfr_setflags_ktable(kt->pfrkt_root,
1819 kt->pfrkt_root->pfrkt_flags|PFR_TFLAG_REFDANCHOR);
1820 }
1821
1822 static void
pfr_setflags_ktables(struct pfr_ktableworkq * workq)1823 pfr_setflags_ktables(struct pfr_ktableworkq *workq)
1824 {
1825 struct pfr_ktable *p, *q;
1826
1827 for (p = SLIST_FIRST(workq); p; p = q) {
1828 q = SLIST_NEXT(p, pfrkt_workq);
1829 pfr_setflags_ktable(p, p->pfrkt_nflags);
1830 }
1831 }
1832
1833 static void
pfr_setflags_ktable(struct pfr_ktable * kt,int newf)1834 pfr_setflags_ktable(struct pfr_ktable *kt, int newf)
1835 {
1836 struct pfr_kentryworkq addrq;
1837 struct pfr_walktree w;
1838
1839 PF_RULES_WASSERT();
1840
1841 if (!(newf & PFR_TFLAG_REFERENCED) &&
1842 !(newf & PFR_TFLAG_REFDANCHOR) &&
1843 !(newf & PFR_TFLAG_PERSIST))
1844 newf &= ~PFR_TFLAG_ACTIVE;
1845 if (!(newf & PFR_TFLAG_ACTIVE))
1846 newf &= ~PFR_TFLAG_USRMASK;
1847 if (!(newf & PFR_TFLAG_SETMASK)) {
1848 RB_REMOVE(pfr_ktablehead, &V_pfr_ktables, kt);
1849 if (kt->pfrkt_root != NULL)
1850 if (!--kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR])
1851 pfr_setflags_ktable(kt->pfrkt_root,
1852 kt->pfrkt_root->pfrkt_flags &
1853 ~PFR_TFLAG_REFDANCHOR);
1854 pfr_destroy_ktable(kt, 1);
1855 V_pfr_ktable_cnt--;
1856 return;
1857 }
1858 if (newf & PFR_TFLAG_COUNTERS && ! (kt->pfrkt_flags & PFR_TFLAG_COUNTERS)) {
1859 bzero(&w, sizeof(w));
1860 w.pfrw_op = PFRW_COUNTERS;
1861 w.pfrw_flags |= PFR_TFLAG_COUNTERS;
1862 kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
1863 kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w);
1864 }
1865 if (! (newf & PFR_TFLAG_COUNTERS) && (kt->pfrkt_flags & PFR_TFLAG_COUNTERS)) {
1866 bzero(&w, sizeof(w));
1867 w.pfrw_op = PFRW_COUNTERS;
1868 w.pfrw_flags |= 0;
1869 kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
1870 kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w);
1871 }
1872 if (!(newf & PFR_TFLAG_ACTIVE) && kt->pfrkt_cnt) {
1873 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1874 pfr_remove_kentries(kt, &addrq);
1875 }
1876 if (!(newf & PFR_TFLAG_INACTIVE) && kt->pfrkt_shadow != NULL) {
1877 pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1878 kt->pfrkt_shadow = NULL;
1879 }
1880 kt->pfrkt_flags = newf;
1881 }
1882
1883 static void
pfr_clstats_ktables(struct pfr_ktableworkq * workq,long tzero,int recurse)1884 pfr_clstats_ktables(struct pfr_ktableworkq *workq, long tzero, int recurse)
1885 {
1886 struct pfr_ktable *p;
1887
1888 SLIST_FOREACH(p, workq, pfrkt_workq)
1889 pfr_clstats_ktable(p, tzero, recurse);
1890 }
1891
1892 static void
pfr_clstats_ktable(struct pfr_ktable * kt,long tzero,int recurse)1893 pfr_clstats_ktable(struct pfr_ktable *kt, long tzero, int recurse)
1894 {
1895 struct pfr_kentryworkq addrq;
1896 int pfr_dir, pfr_op;
1897
1898 MPASS(PF_TABLE_STATS_OWNED() || PF_RULES_WOWNED());
1899
1900 if (recurse) {
1901 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1902 pfr_clstats_kentries(kt, &addrq, tzero, 0);
1903 }
1904 for (pfr_dir = 0; pfr_dir < PFR_DIR_MAX; pfr_dir ++) {
1905 for (pfr_op = 0; pfr_op < PFR_OP_TABLE_MAX; pfr_op ++) {
1906 pfr_kstate_counter_zero(&kt->pfrkt_packets[pfr_dir][pfr_op]);
1907 pfr_kstate_counter_zero(&kt->pfrkt_bytes[pfr_dir][pfr_op]);
1908 }
1909 }
1910 pfr_kstate_counter_zero(&kt->pfrkt_match);
1911 pfr_kstate_counter_zero(&kt->pfrkt_nomatch);
1912 kt->pfrkt_tzero = tzero;
1913 }
1914
1915 static struct pfr_ktable *
pfr_create_ktable(struct pfr_table * tbl,long tzero,int attachruleset)1916 pfr_create_ktable(struct pfr_table *tbl, long tzero, int attachruleset)
1917 {
1918 struct pfr_ktable *kt;
1919 struct pf_kruleset *rs;
1920 int pfr_dir, pfr_op;
1921
1922 PF_RULES_WASSERT();
1923
1924 kt = malloc(sizeof(*kt), M_PFTABLE, M_NOWAIT|M_ZERO);
1925 if (kt == NULL)
1926 return (NULL);
1927 kt->pfrkt_t = *tbl;
1928
1929 if (attachruleset) {
1930 rs = pf_find_or_create_kruleset(tbl->pfrt_anchor);
1931 if (!rs) {
1932 pfr_destroy_ktable(kt, 0);
1933 return (NULL);
1934 }
1935 kt->pfrkt_rs = rs;
1936 rs->tables++;
1937 }
1938
1939 for (pfr_dir = 0; pfr_dir < PFR_DIR_MAX; pfr_dir ++) {
1940 for (pfr_op = 0; pfr_op < PFR_OP_TABLE_MAX; pfr_op ++) {
1941 if (pfr_kstate_counter_init(
1942 &kt->pfrkt_packets[pfr_dir][pfr_op], M_NOWAIT) != 0) {
1943 pfr_destroy_ktable(kt, 0);
1944 return (NULL);
1945 }
1946 if (pfr_kstate_counter_init(
1947 &kt->pfrkt_bytes[pfr_dir][pfr_op], M_NOWAIT) != 0) {
1948 pfr_destroy_ktable(kt, 0);
1949 return (NULL);
1950 }
1951 }
1952 }
1953 if (pfr_kstate_counter_init(&kt->pfrkt_match, M_NOWAIT) != 0) {
1954 pfr_destroy_ktable(kt, 0);
1955 return (NULL);
1956 }
1957
1958 if (pfr_kstate_counter_init(&kt->pfrkt_nomatch, M_NOWAIT) != 0) {
1959 pfr_destroy_ktable(kt, 0);
1960 return (NULL);
1961 }
1962
1963 if (!rn_inithead((void **)&kt->pfrkt_ip4,
1964 offsetof(struct sockaddr_in, sin_addr) * 8) ||
1965 !rn_inithead((void **)&kt->pfrkt_ip6,
1966 offsetof(struct sockaddr_in6, sin6_addr) * 8)) {
1967 pfr_destroy_ktable(kt, 0);
1968 return (NULL);
1969 }
1970 kt->pfrkt_tzero = tzero;
1971
1972 return (kt);
1973 }
1974
1975 static void
pfr_destroy_ktables(struct pfr_ktableworkq * workq,int flushaddr)1976 pfr_destroy_ktables(struct pfr_ktableworkq *workq, int flushaddr)
1977 {
1978 struct pfr_ktable *p, *q;
1979
1980 for (p = SLIST_FIRST(workq); p; p = q) {
1981 q = SLIST_NEXT(p, pfrkt_workq);
1982 pfr_destroy_ktable(p, flushaddr);
1983 }
1984 }
1985
1986 static void
pfr_destroy_ktable(struct pfr_ktable * kt,int flushaddr)1987 pfr_destroy_ktable(struct pfr_ktable *kt, int flushaddr)
1988 {
1989 struct pfr_kentryworkq addrq;
1990 int pfr_dir, pfr_op;
1991
1992 if (flushaddr) {
1993 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1994 pfr_clean_node_mask(kt, &addrq);
1995 pfr_destroy_kentries(&addrq);
1996 }
1997 if (kt->pfrkt_ip4 != NULL)
1998 rn_detachhead((void **)&kt->pfrkt_ip4);
1999 if (kt->pfrkt_ip6 != NULL)
2000 rn_detachhead((void **)&kt->pfrkt_ip6);
2001 if (kt->pfrkt_shadow != NULL)
2002 pfr_destroy_ktable(kt->pfrkt_shadow, flushaddr);
2003 if (kt->pfrkt_rs != NULL) {
2004 kt->pfrkt_rs->tables--;
2005 pf_remove_if_empty_kruleset(kt->pfrkt_rs);
2006 }
2007 for (pfr_dir = 0; pfr_dir < PFR_DIR_MAX; pfr_dir ++) {
2008 for (pfr_op = 0; pfr_op < PFR_OP_TABLE_MAX; pfr_op ++) {
2009 pfr_kstate_counter_deinit(&kt->pfrkt_packets[pfr_dir][pfr_op]);
2010 pfr_kstate_counter_deinit(&kt->pfrkt_bytes[pfr_dir][pfr_op]);
2011 }
2012 }
2013 pfr_kstate_counter_deinit(&kt->pfrkt_match);
2014 pfr_kstate_counter_deinit(&kt->pfrkt_nomatch);
2015
2016 free(kt, M_PFTABLE);
2017 }
2018
2019 static int
pfr_ktable_compare(struct pfr_ktable * p,struct pfr_ktable * q)2020 pfr_ktable_compare(struct pfr_ktable *p, struct pfr_ktable *q)
2021 {
2022 int d;
2023
2024 if ((d = strncmp(p->pfrkt_name, q->pfrkt_name, PF_TABLE_NAME_SIZE)))
2025 return (d);
2026 return (strcmp(p->pfrkt_anchor, q->pfrkt_anchor));
2027 }
2028
2029 static struct pfr_ktable *
pfr_lookup_table(struct pfr_table * tbl)2030 pfr_lookup_table(struct pfr_table *tbl)
2031 {
2032 /* struct pfr_ktable start like a struct pfr_table */
2033 return (RB_FIND(pfr_ktablehead, &V_pfr_ktables,
2034 (struct pfr_ktable *)tbl));
2035 }
2036
2037 int
pfr_match_addr(struct pfr_ktable * kt,struct pf_addr * a,sa_family_t af)2038 pfr_match_addr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af)
2039 {
2040 struct pfr_kentry *ke = NULL;
2041 int match;
2042
2043 PF_RULES_RASSERT();
2044
2045 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2046 kt = kt->pfrkt_root;
2047 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2048 return (0);
2049
2050 switch (af) {
2051 #ifdef INET
2052 case AF_INET:
2053 {
2054 struct sockaddr_in sin;
2055
2056 bzero(&sin, sizeof(sin));
2057 sin.sin_len = sizeof(sin);
2058 sin.sin_family = AF_INET;
2059 sin.sin_addr.s_addr = a->addr32[0];
2060 ke = (struct pfr_kentry *)rn_match(&sin, &kt->pfrkt_ip4->rh);
2061 if (ke && KENTRY_RNF_ROOT(ke))
2062 ke = NULL;
2063 break;
2064 }
2065 #endif /* INET */
2066 #ifdef INET6
2067 case AF_INET6:
2068 {
2069 struct sockaddr_in6 sin6;
2070
2071 bzero(&sin6, sizeof(sin6));
2072 sin6.sin6_len = sizeof(sin6);
2073 sin6.sin6_family = AF_INET6;
2074 bcopy(a, &sin6.sin6_addr, sizeof(sin6.sin6_addr));
2075 ke = (struct pfr_kentry *)rn_match(&sin6, &kt->pfrkt_ip6->rh);
2076 if (ke && KENTRY_RNF_ROOT(ke))
2077 ke = NULL;
2078 break;
2079 }
2080 #endif /* INET6 */
2081 }
2082 match = (ke && !ke->pfrke_not);
2083 if (match)
2084 pfr_kstate_counter_add(&kt->pfrkt_match, 1);
2085 else
2086 pfr_kstate_counter_add(&kt->pfrkt_nomatch, 1);
2087 return (match);
2088 }
2089
2090 void
pfr_update_stats(struct pfr_ktable * kt,struct pf_addr * a,sa_family_t af,u_int64_t len,int dir_out,int op_pass,int notrule)2091 pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af,
2092 u_int64_t len, int dir_out, int op_pass, int notrule)
2093 {
2094 struct pfr_kentry *ke = NULL;
2095
2096 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2097 kt = kt->pfrkt_root;
2098 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2099 return;
2100
2101 switch (af) {
2102 #ifdef INET
2103 case AF_INET:
2104 {
2105 struct sockaddr_in sin;
2106
2107 bzero(&sin, sizeof(sin));
2108 sin.sin_len = sizeof(sin);
2109 sin.sin_family = AF_INET;
2110 sin.sin_addr.s_addr = a->addr32[0];
2111 ke = (struct pfr_kentry *)rn_match(&sin, &kt->pfrkt_ip4->rh);
2112 if (ke && KENTRY_RNF_ROOT(ke))
2113 ke = NULL;
2114 break;
2115 }
2116 #endif /* INET */
2117 #ifdef INET6
2118 case AF_INET6:
2119 {
2120 struct sockaddr_in6 sin6;
2121
2122 bzero(&sin6, sizeof(sin6));
2123 sin6.sin6_len = sizeof(sin6);
2124 sin6.sin6_family = AF_INET6;
2125 bcopy(a, &sin6.sin6_addr, sizeof(sin6.sin6_addr));
2126 ke = (struct pfr_kentry *)rn_match(&sin6, &kt->pfrkt_ip6->rh);
2127 if (ke && KENTRY_RNF_ROOT(ke))
2128 ke = NULL;
2129 break;
2130 }
2131 #endif /* INET6 */
2132 default:
2133 panic("%s: unknown address family %u", __func__, af);
2134 }
2135 if ((ke == NULL || ke->pfrke_not) != notrule) {
2136 if (op_pass != PFR_OP_PASS)
2137 DPFPRINTF(PF_DEBUG_URGENT,
2138 ("pfr_update_stats: assertion failed.\n"));
2139 op_pass = PFR_OP_XPASS;
2140 }
2141 pfr_kstate_counter_add(&kt->pfrkt_packets[dir_out][op_pass], 1);
2142 pfr_kstate_counter_add(&kt->pfrkt_bytes[dir_out][op_pass], len);
2143 if (ke != NULL && op_pass != PFR_OP_XPASS &&
2144 (kt->pfrkt_flags & PFR_TFLAG_COUNTERS)) {
2145 counter_u64_add(pfr_kentry_counter(&ke->pfrke_counters,
2146 dir_out, op_pass, PFR_TYPE_PACKETS), 1);
2147 counter_u64_add(pfr_kentry_counter(&ke->pfrke_counters,
2148 dir_out, op_pass, PFR_TYPE_BYTES), len);
2149 }
2150 }
2151
2152 struct pfr_ktable *
pfr_attach_table(struct pf_kruleset * rs,char * name)2153 pfr_attach_table(struct pf_kruleset *rs, char *name)
2154 {
2155 struct pfr_ktable *kt, *rt;
2156 struct pfr_table tbl;
2157 struct pf_kanchor *ac = rs->anchor;
2158
2159 PF_RULES_WASSERT();
2160
2161 bzero(&tbl, sizeof(tbl));
2162 strlcpy(tbl.pfrt_name, name, sizeof(tbl.pfrt_name));
2163 if (ac != NULL)
2164 strlcpy(tbl.pfrt_anchor, ac->path, sizeof(tbl.pfrt_anchor));
2165 kt = pfr_lookup_table(&tbl);
2166 if (kt == NULL) {
2167 kt = pfr_create_ktable(&tbl, time_second, 1);
2168 if (kt == NULL)
2169 return (NULL);
2170 if (ac != NULL) {
2171 bzero(tbl.pfrt_anchor, sizeof(tbl.pfrt_anchor));
2172 rt = pfr_lookup_table(&tbl);
2173 if (rt == NULL) {
2174 rt = pfr_create_ktable(&tbl, 0, 1);
2175 if (rt == NULL) {
2176 pfr_destroy_ktable(kt, 0);
2177 return (NULL);
2178 }
2179 pfr_insert_ktable(rt);
2180 }
2181 kt->pfrkt_root = rt;
2182 }
2183 pfr_insert_ktable(kt);
2184 }
2185 if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++)
2186 pfr_setflags_ktable(kt, kt->pfrkt_flags|PFR_TFLAG_REFERENCED);
2187 return (kt);
2188 }
2189
2190 void
pfr_detach_table(struct pfr_ktable * kt)2191 pfr_detach_table(struct pfr_ktable *kt)
2192 {
2193
2194 PF_RULES_WASSERT();
2195 KASSERT(kt->pfrkt_refcnt[PFR_REFCNT_RULE] > 0, ("%s: refcount %d\n",
2196 __func__, kt->pfrkt_refcnt[PFR_REFCNT_RULE]));
2197
2198 if (!--kt->pfrkt_refcnt[PFR_REFCNT_RULE])
2199 pfr_setflags_ktable(kt, kt->pfrkt_flags&~PFR_TFLAG_REFERENCED);
2200 }
2201
2202 int
pfr_pool_get(struct pfr_ktable * kt,int * pidx,struct pf_addr * counter,sa_family_t af)2203 pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter,
2204 sa_family_t af)
2205 {
2206 struct pf_addr *addr, *cur, *mask;
2207 union sockaddr_union uaddr, umask;
2208 struct pfr_kentry *ke, *ke2 = NULL;
2209 int idx = -1, use_counter = 0;
2210
2211 MPASS(pidx != NULL);
2212 MPASS(counter != NULL);
2213
2214 switch (af) {
2215 case AF_INET:
2216 uaddr.sin.sin_len = sizeof(struct sockaddr_in);
2217 uaddr.sin.sin_family = AF_INET;
2218 break;
2219 case AF_INET6:
2220 uaddr.sin6.sin6_len = sizeof(struct sockaddr_in6);
2221 uaddr.sin6.sin6_family = AF_INET6;
2222 break;
2223 }
2224 addr = SUNION2PF(&uaddr, af);
2225
2226 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2227 kt = kt->pfrkt_root;
2228 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2229 return (-1);
2230
2231 idx = *pidx;
2232 if (idx >= 0)
2233 use_counter = 1;
2234 if (idx < 0)
2235 idx = 0;
2236
2237 _next_block:
2238 ke = pfr_kentry_byidx(kt, idx, af);
2239 if (ke == NULL) {
2240 pfr_kstate_counter_add(&kt->pfrkt_nomatch, 1);
2241 return (1);
2242 }
2243 pfr_prepare_network(&umask, af, ke->pfrke_net);
2244 cur = SUNION2PF(&ke->pfrke_sa, af);
2245 mask = SUNION2PF(&umask, af);
2246
2247 if (use_counter) {
2248 /* is supplied address within block? */
2249 if (!PF_MATCHA(0, cur, mask, counter, af)) {
2250 /* no, go to next block in table */
2251 idx++;
2252 use_counter = 0;
2253 goto _next_block;
2254 }
2255 PF_ACPY(addr, counter, af);
2256 } else {
2257 /* use first address of block */
2258 PF_ACPY(addr, cur, af);
2259 }
2260
2261 if (!KENTRY_NETWORK(ke)) {
2262 /* this is a single IP address - no possible nested block */
2263 PF_ACPY(counter, addr, af);
2264 *pidx = idx;
2265 pfr_kstate_counter_add(&kt->pfrkt_match, 1);
2266 return (0);
2267 }
2268 for (;;) {
2269 /* we don't want to use a nested block */
2270 switch (af) {
2271 case AF_INET:
2272 ke2 = (struct pfr_kentry *)rn_match(&uaddr,
2273 &kt->pfrkt_ip4->rh);
2274 break;
2275 case AF_INET6:
2276 ke2 = (struct pfr_kentry *)rn_match(&uaddr,
2277 &kt->pfrkt_ip6->rh);
2278 break;
2279 }
2280 /* no need to check KENTRY_RNF_ROOT() here */
2281 if (ke2 == ke) {
2282 /* lookup return the same block - perfect */
2283 PF_ACPY(counter, addr, af);
2284 *pidx = idx;
2285 pfr_kstate_counter_add(&kt->pfrkt_match, 1);
2286 return (0);
2287 }
2288
2289 /* we need to increase the counter past the nested block */
2290 pfr_prepare_network(&umask, AF_INET, ke2->pfrke_net);
2291 PF_POOLMASK(addr, addr, SUNION2PF(&umask, af), &pfr_ffaddr, af);
2292 PF_AINC(addr, af);
2293 if (!PF_MATCHA(0, cur, mask, addr, af)) {
2294 /* ok, we reached the end of our main block */
2295 /* go to next block in table */
2296 idx++;
2297 use_counter = 0;
2298 goto _next_block;
2299 }
2300 }
2301 }
2302
2303 static struct pfr_kentry *
pfr_kentry_byidx(struct pfr_ktable * kt,int idx,int af)2304 pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af)
2305 {
2306 struct pfr_walktree w;
2307
2308 bzero(&w, sizeof(w));
2309 w.pfrw_op = PFRW_POOL_GET;
2310 w.pfrw_cnt = idx;
2311
2312 switch (af) {
2313 #ifdef INET
2314 case AF_INET:
2315 kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
2316 return (w.pfrw_kentry);
2317 #endif /* INET */
2318 #ifdef INET6
2319 case AF_INET6:
2320 kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w);
2321 return (w.pfrw_kentry);
2322 #endif /* INET6 */
2323 default:
2324 return (NULL);
2325 }
2326 }
2327
2328 void
pfr_dynaddr_update(struct pfr_ktable * kt,struct pfi_dynaddr * dyn)2329 pfr_dynaddr_update(struct pfr_ktable *kt, struct pfi_dynaddr *dyn)
2330 {
2331 struct pfr_walktree w;
2332
2333 bzero(&w, sizeof(w));
2334 w.pfrw_op = PFRW_DYNADDR_UPDATE;
2335 w.pfrw_dyn = dyn;
2336
2337 dyn->pfid_acnt4 = 0;
2338 dyn->pfid_acnt6 = 0;
2339 if (!dyn->pfid_af || dyn->pfid_af == AF_INET)
2340 kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
2341 if (!dyn->pfid_af || dyn->pfid_af == AF_INET6)
2342 kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w);
2343 }
2344