xref: /dflybsd-src/sys/net/pf/pf_table.c (revision a9656fbcd49c376aba5e04370d8b0f1fa96e063c)
1 /*	$FreeBSD: src/sys/contrib/pf/net/pf_table.c,v 1.5 2004/07/28 06:14:44 kan Exp $	*/
2 /*	$OpenBSD: pf_table.c,v 1.47 2004/03/09 21:44:41 mcbride Exp $	*/
3 /*	$DragonFly: src/sys/net/pf/pf_table.c,v 1.5 2006/12/22 23:44:57 swildner Exp $ */
4 /*	$OpenBSD: pf_table.c,v 1.68 2006/05/02 10:08:45 dhartmei Exp $	*/
5 
6 /*
7  * Copyright (c) 2004 The DragonFly Project.  All rights reserved.
8  *
9  * Copyright (c) 2002 Cedric Berger
10  * All rights reserved.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  *
16  *    - Redistributions of source code must retain the above copyright
17  *      notice, this list of conditions and the following disclaimer.
18  *    - Redistributions in binary form must reproduce the above
19  *      copyright notice, this list of conditions and the following
20  *      disclaimer in the documentation and/or other materials provided
21  *      with the distribution.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
26  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
27  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
28  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
29  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
30  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
31  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
33  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
34  * POSSIBILITY OF SUCH DAMAGE.
35  *
36  */
37 
38 #include "opt_inet.h"
39 #include "opt_inet6.h"
40 
41 #include <sys/param.h>
42 #include <sys/systm.h>
43 #include <sys/socket.h>
44 #include <sys/mbuf.h>
45 #include <sys/kernel.h>
46 #include <sys/malloc.h>
47 #include <sys/thread2.h>
48 #include <vm/vm_zone.h>
49 
50 #include <net/if.h>
51 #include <net/route.h>
52 #include <netinet/in.h>
53 #include <net/pf/pfvar.h>
54 
55 #define ACCEPT_FLAGS(oklist)			\
56 	do {					\
57 		if ((flags & ~(oklist)) &	\
58 		    PFR_FLAG_ALLMASK)		\
59 			return (EINVAL);	\
60 	} while (0)
61 
62 #define COPYIN(from, to, size)			\
63 	((flags & PFR_FLAG_USERIOCTL) ?		\
64 	copyin((from), (to), (size)) :		\
65 	(bcopy((from), (to), (size)), 0))
66 
67 #define COPYOUT(from, to, size)			\
68 	((flags & PFR_FLAG_USERIOCTL) ?		\
69 	copyout((from), (to), (size)) :		\
70 	(bcopy((from), (to), (size)), 0))
71 
72 #define	FILLIN_SIN(sin, addr)			\
73 	do {					\
74 		(sin).sin_len = sizeof(sin);	\
75 		(sin).sin_family = AF_INET;	\
76 		(sin).sin_addr = (addr);	\
77 	} while (0)
78 
79 #define	FILLIN_SIN6(sin6, addr)			\
80 	do {					\
81 		(sin6).sin6_len = sizeof(sin6);	\
82 		(sin6).sin6_family = AF_INET6;	\
83 		(sin6).sin6_addr = (addr);	\
84 	} while (0)
85 
86 #define SWAP(type, a1, a2)			\
87 	do {					\
88 		type tmp = a1;			\
89 		a1 = a2;			\
90 		a2 = tmp;			\
91 	} while (0)
92 
93 #define SUNION2PF(su, af) (((af)==AF_INET) ?	\
94     (struct pf_addr *)&(su)->sin.sin_addr :	\
95     (struct pf_addr *)&(su)->sin6.sin6_addr)
96 
97 #define	AF_BITS(af)		(((af)==AF_INET)?32:128)
98 #define	ADDR_NETWORK(ad)	((ad)->pfra_net < AF_BITS((ad)->pfra_af))
99 #define	KENTRY_NETWORK(ke)	((ke)->pfrke_net < AF_BITS((ke)->pfrke_af))
100 #define KENTRY_RNF_ROOT(ke) \
101 		((((struct radix_node *)(ke))->rn_flags & RNF_ROOT) != 0)
102 
103 #define NO_ADDRESSES		(-1)
104 #define ENQUEUE_UNMARKED_ONLY	(1)
105 #define INVERT_NEG_FLAG		(1)
106 
107 struct pfr_walktree {
108 	enum pfrw_op {
109 		PFRW_MARK,
110 		PFRW_SWEEP,
111 		PFRW_ENQUEUE,
112 		PFRW_GET_ADDRS,
113 		PFRW_GET_ASTATS,
114 		PFRW_POOL_GET,
115 		PFRW_DYNADDR_UPDATE
116 	}	 pfrw_op;
117 	union {
118 		struct pfr_addr		*pfrw1_addr;
119 		struct pfr_astats	*pfrw1_astats;
120 		struct pfr_kentryworkq	*pfrw1_workq;
121 		struct pfr_kentry	*pfrw1_kentry;
122 		struct pfi_dynaddr	*pfrw1_dyn;
123 	}	 pfrw_1;
124 	int	 pfrw_free;
125 	int	 pfrw_flags;
126 };
127 #define pfrw_addr	pfrw_1.pfrw1_addr
128 #define pfrw_astats	pfrw_1.pfrw1_astats
129 #define pfrw_workq	pfrw_1.pfrw1_workq
130 #define pfrw_kentry	pfrw_1.pfrw1_kentry
131 #define pfrw_dyn	pfrw_1.pfrw1_dyn
132 #define pfrw_cnt	pfrw_free
133 
134 #define senderr(e)	do { rv = (e); goto _bad; } while (0)
135 
136 vm_zone_t		 pfr_ktable_pl;
137 vm_zone_t		 pfr_kentry_pl;
138 vm_zone_t		 pfr_kentry_pl2;
139 struct sockaddr_in	 pfr_sin;
140 struct sockaddr_in6	 pfr_sin6;
141 union sockaddr_union	 pfr_mask;
142 struct pf_addr		 pfr_ffaddr;
143 
144 void			 pfr_copyout_addr(struct pfr_addr *,
145 			    struct pfr_kentry *ke);
146 int			 pfr_validate_addr(struct pfr_addr *);
147 void			 pfr_enqueue_addrs(struct pfr_ktable *,
148 			    struct pfr_kentryworkq *, int *, int);
149 void			 pfr_mark_addrs(struct pfr_ktable *);
150 struct pfr_kentry	*pfr_lookup_addr(struct pfr_ktable *,
151 			    struct pfr_addr *, int);
152 struct pfr_kentry	*pfr_create_kentry(struct pfr_addr *, int);
153 void			 pfr_destroy_kentries(struct pfr_kentryworkq *);
154 void			 pfr_destroy_kentry(struct pfr_kentry *);
155 void			 pfr_insert_kentries(struct pfr_ktable *,
156 			    struct pfr_kentryworkq *, long);
157 void			 pfr_remove_kentries(struct pfr_ktable *,
158 			    struct pfr_kentryworkq *);
159 void			 pfr_clstats_kentries(struct pfr_kentryworkq *, long,
160 			    int);
161 void			 pfr_reset_feedback(struct pfr_addr *, int, int);
162 void			 pfr_prepare_network(union sockaddr_union *, int, int);
163 int			 pfr_route_kentry(struct pfr_ktable *,
164 			    struct pfr_kentry *);
165 int			 pfr_unroute_kentry(struct pfr_ktable *,
166 			    struct pfr_kentry *);
167 int			 pfr_walktree(struct radix_node *, void *);
168 int			 pfr_validate_table(struct pfr_table *, int, int);
169 int			 pfr_fix_anchor(char *);
170 void			 pfr_commit_ktable(struct pfr_ktable *, long);
171 void			 pfr_insert_ktables(struct pfr_ktableworkq *);
172 void			 pfr_insert_ktable(struct pfr_ktable *);
173 void			 pfr_setflags_ktables(struct pfr_ktableworkq *);
174 void			 pfr_setflags_ktable(struct pfr_ktable *, int);
175 void			 pfr_clstats_ktables(struct pfr_ktableworkq *, long,
176 			    int);
177 void			 pfr_clstats_ktable(struct pfr_ktable *, long, int);
178 struct pfr_ktable	*pfr_create_ktable(struct pfr_table *, long, int);
179 void			 pfr_destroy_ktables(struct pfr_ktableworkq *, int);
180 void			 pfr_destroy_ktable(struct pfr_ktable *, int);
181 int			 pfr_ktable_compare(struct pfr_ktable *,
182 			    struct pfr_ktable *);
183 struct pfr_ktable	*pfr_lookup_table(struct pfr_table *);
184 void			 pfr_clean_node_mask(struct pfr_ktable *,
185 			    struct pfr_kentryworkq *);
186 int			 pfr_table_count(struct pfr_table *, int);
187 int			 pfr_skip_table(struct pfr_table *,
188 			    struct pfr_ktable *, int);
189 struct pfr_kentry	*pfr_kentry_byidx(struct pfr_ktable *, int, int);
190 
191 RB_PROTOTYPE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
192 RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
193 
194 struct pfr_ktablehead	 pfr_ktables;
195 struct pfr_table	 pfr_nulltable;
196 int			 pfr_ktable_cnt;
197 
198 void
199 pfr_initialize(void)
200 {
201 	pfr_sin.sin_len = sizeof(pfr_sin);
202 	pfr_sin.sin_family = AF_INET;
203 	pfr_sin6.sin6_len = sizeof(pfr_sin6);
204 	pfr_sin6.sin6_family = AF_INET6;
205 
206 	memset(&pfr_ffaddr, 0xff, sizeof(pfr_ffaddr));
207 }
208 
209 int
210 pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags)
211 {
212 	struct pfr_ktable	*kt;
213 	struct pfr_kentryworkq	 workq;
214 
215 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY);
216 	if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
217 		return (EINVAL);
218 	kt = pfr_lookup_table(tbl);
219 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
220 		return (ESRCH);
221 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
222 		return (EPERM);
223 	pfr_enqueue_addrs(kt, &workq, ndel, 0);
224 
225 	if (!(flags & PFR_FLAG_DUMMY)) {
226 		if (flags & PFR_FLAG_ATOMIC)
227 			crit_enter();
228 		pfr_remove_kentries(kt, &workq);
229 		if (flags & PFR_FLAG_ATOMIC)
230 			crit_exit();
231 		if (kt->pfrkt_cnt) {
232 			kprintf("pfr_clr_addrs: corruption detected (%d).\n",
233 			    kt->pfrkt_cnt);
234 			kt->pfrkt_cnt = 0;
235 		}
236 	}
237 	return (0);
238 }
239 
240 int
241 pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
242     int *nadd, int flags)
243 {
244 	struct pfr_ktable	*kt, *tmpkt;
245 	struct pfr_kentryworkq	 workq;
246 	struct pfr_kentry	*p, *q;
247 	struct pfr_addr		 ad;
248 	int			 i, rv, xadd = 0;
249 	long			 tzero = time_second;
250 
251 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_FEEDBACK);
252 	if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
253 		return (EINVAL);
254 	kt = pfr_lookup_table(tbl);
255 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
256 		return (ESRCH);
257 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
258 		return (EPERM);
259 	tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0);
260 	if (tmpkt == NULL)
261 		return (ENOMEM);
262 	SLIST_INIT(&workq);
263 	for (i = 0; i < size; i++) {
264 		if (COPYIN(addr+i, &ad, sizeof(ad)))
265 			senderr(EFAULT);
266 		if (pfr_validate_addr(&ad))
267 			senderr(EINVAL);
268 		p = pfr_lookup_addr(kt, &ad, 1);
269 		q = pfr_lookup_addr(tmpkt, &ad, 1);
270 		if (flags & PFR_FLAG_FEEDBACK) {
271 			if (q != NULL)
272 				ad.pfra_fback = PFR_FB_DUPLICATE;
273 			else if (p == NULL)
274 				ad.pfra_fback = PFR_FB_ADDED;
275 			else if (p->pfrke_not != ad.pfra_not)
276 				ad.pfra_fback = PFR_FB_CONFLICT;
277 			else
278 				ad.pfra_fback = PFR_FB_NONE;
279 		}
280 		if (p == NULL && q == NULL) {
281 			p = pfr_create_kentry(&ad, 0);
282 			if (p == NULL)
283 				senderr(ENOMEM);
284 			if (pfr_route_kentry(tmpkt, p)) {
285 				pfr_destroy_kentry(p);
286 				ad.pfra_fback = PFR_FB_NONE;
287 			} else {
288 				SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
289 				xadd++;
290 			}
291 		}
292 		if (flags & PFR_FLAG_FEEDBACK)
293 			if (COPYOUT(&ad, addr+i, sizeof(ad)))
294 				senderr(EFAULT);
295 	}
296 	pfr_clean_node_mask(tmpkt, &workq);
297 	if (!(flags & PFR_FLAG_DUMMY)) {
298 		if (flags & PFR_FLAG_ATOMIC)
299 			crit_enter();
300 		pfr_insert_kentries(kt, &workq, tzero);
301 		if (flags & PFR_FLAG_ATOMIC)
302 			crit_exit();
303 	} else
304 		pfr_destroy_kentries(&workq);
305 	if (nadd != NULL)
306 		*nadd = xadd;
307 	pfr_destroy_ktable(tmpkt, 0);
308 	return (0);
309 _bad:
310 	pfr_clean_node_mask(tmpkt, &workq);
311 	pfr_destroy_kentries(&workq);
312 	if (flags & PFR_FLAG_FEEDBACK)
313 		pfr_reset_feedback(addr, size, flags);
314 	pfr_destroy_ktable(tmpkt, 0);
315 	return (rv);
316 }
317 
318 int
319 pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
320     int *ndel, int flags)
321 {
322 	struct pfr_ktable	*kt;
323 	struct pfr_kentryworkq	 workq;
324 	struct pfr_kentry	*p;
325 	struct pfr_addr		 ad;
326 	int			 i, rv, xdel = 0, log = 1;
327 
328 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_FEEDBACK);
329 	if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
330 		return (EINVAL);
331 	kt = pfr_lookup_table(tbl);
332 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
333 		return (ESRCH);
334 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
335 		return (EPERM);
336 	/*
337 	 * there are two algorithms to choose from here.
338 	 * with:
339 	 *   n: number of addresses to delete
340 	 *   N: number of addresses in the table
341 	 *
342 	 * one is O(N) and is better for large 'n'
343 	 * one is O(n*LOG(N)) and is better for small 'n'
344 	 *
345 	 * following code try to decide which one is best.
346 	 */
347 	for (i = kt->pfrkt_cnt; i > 0; i >>= 1)
348 		log++;
349 	if (size > kt->pfrkt_cnt/log) {
350 		/* full table scan */
351 		pfr_mark_addrs(kt);
352 	} else {
353 		/* iterate over addresses to delete */
354 		for (i = 0; i < size; i++) {
355 			if (COPYIN(addr+i, &ad, sizeof(ad)))
356 				return (EFAULT);
357 			if (pfr_validate_addr(&ad))
358 				return (EINVAL);
359 			p = pfr_lookup_addr(kt, &ad, 1);
360 			if (p != NULL)
361 				p->pfrke_mark = 0;
362 		}
363 	}
364 	SLIST_INIT(&workq);
365 	for (i = 0; i < size; i++) {
366 		if (COPYIN(addr+i, &ad, sizeof(ad)))
367 			senderr(EFAULT);
368 		if (pfr_validate_addr(&ad))
369 			senderr(EINVAL);
370 		p = pfr_lookup_addr(kt, &ad, 1);
371 		if (flags & PFR_FLAG_FEEDBACK) {
372 			if (p == NULL)
373 				ad.pfra_fback = PFR_FB_NONE;
374 			else if (p->pfrke_not != ad.pfra_not)
375 				ad.pfra_fback = PFR_FB_CONFLICT;
376 			else if (p->pfrke_mark)
377 				ad.pfra_fback = PFR_FB_DUPLICATE;
378 			else
379 				ad.pfra_fback = PFR_FB_DELETED;
380 		}
381 		if (p != NULL && p->pfrke_not == ad.pfra_not &&
382 		    !p->pfrke_mark) {
383 			p->pfrke_mark = 1;
384 			SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
385 			xdel++;
386 		}
387 		if (flags & PFR_FLAG_FEEDBACK)
388 			if (COPYOUT(&ad, addr+i, sizeof(ad)))
389 				senderr(EFAULT);
390 	}
391 	if (!(flags & PFR_FLAG_DUMMY)) {
392 		if (flags & PFR_FLAG_ATOMIC)
393 			crit_enter();
394 		pfr_remove_kentries(kt, &workq);
395 		if (flags & PFR_FLAG_ATOMIC)
396 			crit_exit();
397 	}
398 	if (ndel != NULL)
399 		*ndel = xdel;
400 	return (0);
401 _bad:
402 	if (flags & PFR_FLAG_FEEDBACK)
403 		pfr_reset_feedback(addr, size, flags);
404 	return (rv);
405 }
406 
407 int
408 pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
409     int *size2, int *nadd, int *ndel, int *nchange, int flags,
410     u_int32_t ignore_pfrt_flags)
411 {
412 	struct pfr_ktable	*kt, *tmpkt;
413 	struct pfr_kentryworkq	 addq, delq, changeq;
414 	struct pfr_kentry	*p, *q;
415 	struct pfr_addr		 ad;
416 	int			 i, rv, xadd = 0, xdel = 0, xchange = 0;
417 	long			 tzero = time_second;
418 
419 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_FEEDBACK);
420 	if (pfr_validate_table(tbl, ignore_pfrt_flags, flags &
421 	    PFR_FLAG_USERIOCTL))
422 		return (EINVAL);
423 	kt = pfr_lookup_table(tbl);
424 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
425 		return (ESRCH);
426 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
427 		return (EPERM);
428 	tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0);
429 	if (tmpkt == NULL)
430 		return (ENOMEM);
431 	pfr_mark_addrs(kt);
432 	SLIST_INIT(&addq);
433 	SLIST_INIT(&delq);
434 	SLIST_INIT(&changeq);
435 	for (i = 0; i < size; i++) {
436 		if (COPYIN(addr+i, &ad, sizeof(ad)))
437 			senderr(EFAULT);
438 		if (pfr_validate_addr(&ad))
439 			senderr(EINVAL);
440 		ad.pfra_fback = PFR_FB_NONE;
441 		p = pfr_lookup_addr(kt, &ad, 1);
442 		if (p != NULL) {
443 			if (p->pfrke_mark) {
444 				ad.pfra_fback = PFR_FB_DUPLICATE;
445 				goto _skip;
446 			}
447 			p->pfrke_mark = 1;
448 			if (p->pfrke_not != ad.pfra_not) {
449 				SLIST_INSERT_HEAD(&changeq, p, pfrke_workq);
450 				ad.pfra_fback = PFR_FB_CHANGED;
451 				xchange++;
452 			}
453 		} else {
454 			q = pfr_lookup_addr(tmpkt, &ad, 1);
455 			if (q != NULL) {
456 				ad.pfra_fback = PFR_FB_DUPLICATE;
457 				goto _skip;
458 			}
459 			p = pfr_create_kentry(&ad, 0);
460 			if (p == NULL)
461 				senderr(ENOMEM);
462 			if (pfr_route_kentry(tmpkt, p)) {
463 				pfr_destroy_kentry(p);
464 				ad.pfra_fback = PFR_FB_NONE;
465 			} else {
466 				SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
467 				ad.pfra_fback = PFR_FB_ADDED;
468 				xadd++;
469 			}
470 		}
471 _skip:
472 		if (flags & PFR_FLAG_FEEDBACK)
473 			if (COPYOUT(&ad, addr+i, sizeof(ad)))
474 				senderr(EFAULT);
475 	}
476 	pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY);
477 	if ((flags & PFR_FLAG_FEEDBACK) && *size2) {
478 		if (*size2 < size+xdel) {
479 			*size2 = size+xdel;
480 			senderr(0);
481 		}
482 		i = 0;
483 		SLIST_FOREACH(p, &delq, pfrke_workq) {
484 			pfr_copyout_addr(&ad, p);
485 			ad.pfra_fback = PFR_FB_DELETED;
486 			if (COPYOUT(&ad, addr+size+i, sizeof(ad)))
487 				senderr(EFAULT);
488 			i++;
489 		}
490 	}
491 	pfr_clean_node_mask(tmpkt, &addq);
492 	if (!(flags & PFR_FLAG_DUMMY)) {
493 		if (flags & PFR_FLAG_ATOMIC)
494 			crit_enter();
495 		pfr_insert_kentries(kt, &addq, tzero);
496 		pfr_remove_kentries(kt, &delq);
497 		pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
498 		if (flags & PFR_FLAG_ATOMIC)
499 			crit_exit();
500 	} else
501 		pfr_destroy_kentries(&addq);
502 	if (nadd != NULL)
503 		*nadd = xadd;
504 	if (ndel != NULL)
505 		*ndel = xdel;
506 	if (nchange != NULL)
507 		*nchange = xchange;
508 	if ((flags & PFR_FLAG_FEEDBACK) && size2)
509 		*size2 = size+xdel;
510 	pfr_destroy_ktable(tmpkt, 0);
511 	return (0);
512 _bad:
513 	pfr_clean_node_mask(tmpkt, &addq);
514 	pfr_destroy_kentries(&addq);
515 	if (flags & PFR_FLAG_FEEDBACK)
516 		pfr_reset_feedback(addr, size, flags);
517 	pfr_destroy_ktable(tmpkt, 0);
518 	return (rv);
519 }
520 
521 int
522 pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
523 	int *nmatch, int flags)
524 {
525 	struct pfr_ktable	*kt;
526 	struct pfr_kentry	*p;
527 	struct pfr_addr		 ad;
528 	int			 i, xmatch = 0;
529 
530 	ACCEPT_FLAGS(PFR_FLAG_REPLACE);
531 	if (pfr_validate_table(tbl, 0, 0))
532 		return (EINVAL);
533 	kt = pfr_lookup_table(tbl);
534 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
535 		return (ESRCH);
536 
537 	for (i = 0; i < size; i++) {
538 		if (COPYIN(addr+i, &ad, sizeof(ad)))
539 			return (EFAULT);
540 		if (pfr_validate_addr(&ad))
541 			return (EINVAL);
542 		if (ADDR_NETWORK(&ad))
543 			return (EINVAL);
544 		p = pfr_lookup_addr(kt, &ad, 0);
545 		if (flags & PFR_FLAG_REPLACE)
546 			pfr_copyout_addr(&ad, p);
547 		ad.pfra_fback = (p == NULL) ? PFR_FB_NONE :
548 		    (p->pfrke_not ? PFR_FB_NOTMATCH : PFR_FB_MATCH);
549 		if (p != NULL && !p->pfrke_not)
550 			xmatch++;
551 		if (COPYOUT(&ad, addr+i, sizeof(ad)))
552 			return (EFAULT);
553 	}
554 	if (nmatch != NULL)
555 		*nmatch = xmatch;
556 	return (0);
557 }
558 
559 int
560 pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size,
561 	int flags)
562 {
563 	struct pfr_ktable	*kt;
564 	struct pfr_walktree	 w;
565 	int			 rv;
566 
567 	ACCEPT_FLAGS(0);
568 	if (pfr_validate_table(tbl, 0, 0))
569 		return (EINVAL);
570 	kt = pfr_lookup_table(tbl);
571 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
572 		return (ESRCH);
573 	if (kt->pfrkt_cnt > *size) {
574 		*size = kt->pfrkt_cnt;
575 		return (0);
576 	}
577 
578 	bzero(&w, sizeof(w));
579 	w.pfrw_op = PFRW_GET_ADDRS;
580 	w.pfrw_addr = addr;
581 	w.pfrw_free = kt->pfrkt_cnt;
582 	w.pfrw_flags = flags;
583 	rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
584 	if (!rv)
585 		rv = kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
586 	if (rv)
587 		return (rv);
588 
589 	if (w.pfrw_free) {
590 		kprintf("pfr_get_addrs: corruption detected (%d).\n",
591 		    w.pfrw_free);
592 		return (ENOTTY);
593 	}
594 	*size = kt->pfrkt_cnt;
595 	return (0);
596 }
597 
598 int
599 pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size,
600 	int flags)
601 {
602 	struct pfr_ktable	*kt;
603 	struct pfr_walktree	 w;
604 	struct pfr_kentryworkq	 workq;
605 	int			 rv;
606 	long			 tzero = time_second;
607 
608 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC); /* XXX PFR_FLAG_CLSTATS disabled */
609 	if (pfr_validate_table(tbl, 0, 0))
610 		return (EINVAL);
611 	kt = pfr_lookup_table(tbl);
612 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
613 		return (ESRCH);
614 	if (kt->pfrkt_cnt > *size) {
615 		*size = kt->pfrkt_cnt;
616 		return (0);
617 	}
618 
619 	bzero(&w, sizeof(w));
620 	w.pfrw_op = PFRW_GET_ASTATS;
621 	w.pfrw_astats = addr;
622 	w.pfrw_free = kt->pfrkt_cnt;
623 	w.pfrw_flags = flags;
624 	if (flags & PFR_FLAG_ATOMIC)
625 		crit_enter();
626 	rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
627 	if (!rv)
628 		rv = kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
629 	if (!rv && (flags & PFR_FLAG_CLSTATS)) {
630 		pfr_enqueue_addrs(kt, &workq, NULL, 0);
631 		pfr_clstats_kentries(&workq, tzero, 0);
632 	}
633 	if (flags & PFR_FLAG_ATOMIC)
634 		crit_exit();
635 	if (rv)
636 		return (rv);
637 
638 	if (w.pfrw_free) {
639 		kprintf("pfr_get_astats: corruption detected (%d).\n",
640 		    w.pfrw_free);
641 		return (ENOTTY);
642 	}
643 	*size = kt->pfrkt_cnt;
644 	return (0);
645 }
646 
647 int
648 pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size,
649     int *nzero, int flags)
650 {
651 	struct pfr_ktable	*kt;
652 	struct pfr_kentryworkq	 workq;
653 	struct pfr_kentry	*p;
654 	struct pfr_addr		 ad;
655 	int			 i, rv, xzero = 0;
656 
657 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_FEEDBACK);
658 	if (pfr_validate_table(tbl, 0, 0))
659 		return (EINVAL);
660 	kt = pfr_lookup_table(tbl);
661 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
662 		return (ESRCH);
663 	SLIST_INIT(&workq);
664 	for (i = 0; i < size; i++) {
665 		if (COPYIN(addr+i, &ad, sizeof(ad)))
666 			senderr(EFAULT);
667 		if (pfr_validate_addr(&ad))
668 			senderr(EINVAL);
669 		p = pfr_lookup_addr(kt, &ad, 1);
670 		if (flags & PFR_FLAG_FEEDBACK) {
671 			ad.pfra_fback = (p != NULL) ?
672 			    PFR_FB_CLEARED : PFR_FB_NONE;
673 			if (COPYOUT(&ad, addr+i, sizeof(ad)))
674 				senderr(EFAULT);
675 		}
676 		if (p != NULL) {
677 			SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
678 			xzero++;
679 		}
680 	}
681 
682 	if (!(flags & PFR_FLAG_DUMMY)) {
683 		if (flags & PFR_FLAG_ATOMIC)
684 			crit_enter();
685 		pfr_clstats_kentries(&workq, 0, 0);
686 		if (flags & PFR_FLAG_ATOMIC)
687 			crit_exit();
688 	}
689 	if (nzero != NULL)
690 		*nzero = xzero;
691 	return (0);
692 _bad:
693 	if (flags & PFR_FLAG_FEEDBACK)
694 		pfr_reset_feedback(addr, size, flags);
695 	return (rv);
696 }
697 
698 int
699 pfr_validate_addr(struct pfr_addr *ad)
700 {
701 	int i;
702 
703 	switch (ad->pfra_af) {
704 #ifdef INET
705 	case AF_INET:
706 		if (ad->pfra_net > 32)
707 			return (-1);
708 		break;
709 #endif /* INET */
710 #ifdef INET6
711 	case AF_INET6:
712 		if (ad->pfra_net > 128)
713 			return (-1);
714 		break;
715 #endif /* INET6 */
716 	default:
717 		return (-1);
718 	}
719 	if (ad->pfra_net < 128 &&
720 		(((caddr_t)ad)[ad->pfra_net/8] & (0xFF >> (ad->pfra_net%8))))
721 			return (-1);
722 	for (i = (ad->pfra_net+7)/8; i < sizeof(ad->pfra_u); i++)
723 		if (((caddr_t)ad)[i])
724 			return (-1);
725 	if (ad->pfra_not && ad->pfra_not != 1)
726 		return (-1);
727 	if (ad->pfra_fback)
728 		return (-1);
729 	return (0);
730 }
731 
732 void
733 pfr_enqueue_addrs(struct pfr_ktable *kt, struct pfr_kentryworkq *workq,
734 	int *naddr, int sweep)
735 {
736 	struct pfr_walktree	w;
737 
738 	SLIST_INIT(workq);
739 	bzero(&w, sizeof(w));
740 	w.pfrw_op = sweep ? PFRW_SWEEP : PFRW_ENQUEUE;
741 	w.pfrw_workq = workq;
742 	if (kt->pfrkt_ip4 != NULL)
743 		if (kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w))
744 			kprintf("pfr_enqueue_addrs: IPv4 walktree failed.\n");
745 	if (kt->pfrkt_ip6 != NULL)
746 		if (kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w))
747 			kprintf("pfr_enqueue_addrs: IPv6 walktree failed.\n");
748 	if (naddr != NULL)
749 		*naddr = w.pfrw_cnt;
750 }
751 
752 void
753 pfr_mark_addrs(struct pfr_ktable *kt)
754 {
755 	struct pfr_walktree	w;
756 
757 	bzero(&w, sizeof(w));
758 	w.pfrw_op = PFRW_MARK;
759 	if (kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w))
760 		kprintf("pfr_mark_addrs: IPv4 walktree failed.\n");
761 	if (kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w))
762 		kprintf("pfr_mark_addrs: IPv6 walktree failed.\n");
763 }
764 
765 
766 struct pfr_kentry *
767 pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact)
768 {
769 	union sockaddr_union	 sa, mask;
770 	struct radix_node_head	*head = NULL;
771 	struct pfr_kentry	*ke;
772 
773 	bzero(&sa, sizeof(sa));
774 	if (ad->pfra_af == AF_INET) {
775 		FILLIN_SIN(sa.sin, ad->pfra_ip4addr);
776 		head = kt->pfrkt_ip4;
777 	} else if ( ad->pfra_af == AF_INET6 ) {
778 		FILLIN_SIN6(sa.sin6, ad->pfra_ip6addr);
779 		head = kt->pfrkt_ip6;
780 	}
781 	if (ADDR_NETWORK(ad)) {
782 		pfr_prepare_network(&mask, ad->pfra_af, ad->pfra_net);
783 		crit_enter(); /* rn_lookup makes use of globals */
784 		ke = (struct pfr_kentry *)rn_lookup((char *)&sa, (char *)&mask,
785 		    head);
786 		crit_exit();
787 		if (ke && KENTRY_RNF_ROOT(ke))
788 			ke = NULL;
789 	} else {
790 		ke = (struct pfr_kentry *)rn_match((char *)&sa, head);
791 		if (ke && KENTRY_RNF_ROOT(ke))
792 			ke = NULL;
793 		if (exact && ke && KENTRY_NETWORK(ke))
794 			ke = NULL;
795 	}
796 	return (ke);
797 }
798 
799 struct pfr_kentry *
800 pfr_create_kentry(struct pfr_addr *ad, int intr)
801 {
802 	struct pfr_kentry	*ke;
803 
804 	if (intr)
805 		ke = pool_get(&pfr_kentry_pl2, PR_NOWAIT);
806 	else
807 		ke = pool_get(&pfr_kentry_pl, PR_NOWAIT);
808 	if (ke == NULL)
809 		return (NULL);
810 	bzero(ke, sizeof(*ke));
811 
812 	if (ad->pfra_af == AF_INET)
813 		FILLIN_SIN(ke->pfrke_sa.sin, ad->pfra_ip4addr);
814 	else if (ad->pfra_af == AF_INET6)
815 		FILLIN_SIN6(ke->pfrke_sa.sin6, ad->pfra_ip6addr);
816 	ke->pfrke_af = ad->pfra_af;
817 	ke->pfrke_net = ad->pfra_net;
818 	ke->pfrke_not = ad->pfra_not;
819 	ke->pfrke_intrpool = intr;
820 	return (ke);
821 }
822 
823 void
824 pfr_destroy_kentries(struct pfr_kentryworkq *workq)
825 {
826 	struct pfr_kentry	*p, *q;
827 
828 	for (p = SLIST_FIRST(workq); p != NULL; p = q) {
829 		q = SLIST_NEXT(p, pfrke_workq);
830 		pfr_destroy_kentry(p);
831 	}
832 }
833 
834 void
835 pfr_destroy_kentry(struct pfr_kentry *ke)
836 {
837 	if (ke->pfrke_intrpool)
838 		pool_put(&pfr_kentry_pl2, ke);
839 	else
840 		pool_put(&pfr_kentry_pl, ke);
841 }
842 
843 void
844 pfr_insert_kentries(struct pfr_ktable *kt,
845     struct pfr_kentryworkq *workq, long tzero)
846 {
847 	struct pfr_kentry	*p;
848 	int			 rv, n = 0;
849 
850 	SLIST_FOREACH(p, workq, pfrke_workq) {
851 		rv = pfr_route_kentry(kt, p);
852 		if (rv) {
853 			kprintf("pfr_insert_kentries: cannot route entry "
854 			    "(code=%d).\n", rv);
855 			break;
856 		}
857 		p->pfrke_tzero = tzero;
858 		n++;
859 	}
860 	kt->pfrkt_cnt += n;
861 }
862 
863 int
864 pfr_insert_kentry(struct pfr_ktable *kt, struct pfr_addr *ad, long tzero)
865 {
866 	struct pfr_kentry	*p;
867 	int			 rv;
868 
869 	p = pfr_lookup_addr(kt, ad, 1);
870 	if (p != NULL)
871 		return (0);
872 	p = pfr_create_kentry(ad, 1);
873 	if (p == NULL)
874 		return (EINVAL);
875 
876 	rv = pfr_route_kentry(kt, p);
877 	if (rv)
878 		return (rv);
879 
880 	p->pfrke_tzero = tzero;
881 	kt->pfrkt_cnt++;
882 
883 	return (0);
884 }
885 
886 void
887 pfr_remove_kentries(struct pfr_ktable *kt,
888     struct pfr_kentryworkq *workq)
889 {
890 	struct pfr_kentry	*p;
891 	int			 n = 0;
892 
893 	SLIST_FOREACH(p, workq, pfrke_workq) {
894 		pfr_unroute_kentry(kt, p);
895 		n++;
896 	}
897 	kt->pfrkt_cnt -= n;
898 	pfr_destroy_kentries(workq);
899 }
900 
901 void
902 pfr_clean_node_mask(struct pfr_ktable *kt,
903     struct pfr_kentryworkq *workq)
904 {
905 	struct pfr_kentry	*p;
906 
907 	SLIST_FOREACH(p, workq, pfrke_workq)
908 		pfr_unroute_kentry(kt, p);
909 }
910 
911 void
912 pfr_clstats_kentries(struct pfr_kentryworkq *workq, long tzero, int negchange)
913 {
914 	struct pfr_kentry	*p;
915 
916 	SLIST_FOREACH(p, workq, pfrke_workq) {
917 		crit_enter();
918 		if (negchange)
919 			p->pfrke_not = !p->pfrke_not;
920 		bzero(p->pfrke_packets, sizeof(p->pfrke_packets));
921 		bzero(p->pfrke_bytes, sizeof(p->pfrke_bytes));
922 		crit_exit();
923 		p->pfrke_tzero = tzero;
924 	}
925 }
926 
927 void
928 pfr_reset_feedback(struct pfr_addr *addr, int size, int flags)
929 {
930 	struct pfr_addr	ad;
931 	int		i;
932 
933 	for (i = 0; i < size; i++) {
934 		if (COPYIN(addr+i, &ad, sizeof(ad)))
935 			break;
936 		ad.pfra_fback = PFR_FB_NONE;
937 		if (COPYOUT(&ad, addr+i, sizeof(ad)))
938 			break;
939 	}
940 }
941 
942 void
943 pfr_prepare_network(union sockaddr_union *sa, int af, int net)
944 {
945 	int	i;
946 
947 	bzero(sa, sizeof(*sa));
948 	if (af == AF_INET) {
949 		sa->sin.sin_len = sizeof(sa->sin);
950 		sa->sin.sin_family = AF_INET;
951 		sa->sin.sin_addr.s_addr = net ? htonl(-1 << (32-net)) : 0;
952 	} else if (af == AF_INET6) {
953 		sa->sin6.sin6_len = sizeof(sa->sin6);
954 		sa->sin6.sin6_family = AF_INET6;
955 		for (i = 0; i < 4; i++) {
956 			if (net <= 32) {
957 				sa->sin6.sin6_addr.s6_addr32[i] =
958 				    net ? htonl(-1 << (32-net)) : 0;
959 				break;
960 			}
961 			sa->sin6.sin6_addr.s6_addr32[i] = 0xFFFFFFFF;
962 			net -= 32;
963 		}
964 	}
965 }
966 
967 int
968 pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
969 {
970 	union sockaddr_union	 mask;
971 	struct radix_node	*rn;
972 	struct radix_node_head	*head = NULL;
973 
974 	bzero(ke->pfrke_node, sizeof(ke->pfrke_node));
975 	if (ke->pfrke_af == AF_INET)
976 		head = kt->pfrkt_ip4;
977 	else if (ke->pfrke_af == AF_INET6)
978 		head = kt->pfrkt_ip6;
979 
980 	crit_enter();
981 	if (KENTRY_NETWORK(ke)) {
982 		pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
983 		rn = rn_addroute((char *)&ke->pfrke_sa, (char *)&mask, head,
984 		    ke->pfrke_node);
985 	} else
986 		rn = rn_addroute((char *)&ke->pfrke_sa, NULL, head,
987 		    ke->pfrke_node);
988 	crit_exit();
989 
990 	return (rn == NULL ? -1 : 0);
991 }
992 
993 int
994 pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
995 {
996 	union sockaddr_union	 mask;
997 	struct radix_node	*rn;
998 	struct radix_node_head	*head = NULL;
999 
1000 	if (ke->pfrke_af == AF_INET)
1001 		head = kt->pfrkt_ip4;
1002 	else if (ke->pfrke_af == AF_INET6)
1003 		head = kt->pfrkt_ip6;
1004 
1005 	crit_enter();
1006 	if (KENTRY_NETWORK(ke)) {
1007 		pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
1008 		rn = rn_delete((char *)&ke->pfrke_sa, (char *)&mask, head);
1009 	} else
1010 		rn = rn_delete((char *)&ke->pfrke_sa, NULL, head);
1011 	crit_exit();
1012 
1013 	if (rn == NULL) {
1014 		kprintf("pfr_unroute_kentry: delete failed.\n");
1015 		return (-1);
1016 	}
1017 	return (0);
1018 }
1019 
1020 void
1021 pfr_copyout_addr(struct pfr_addr *ad, struct pfr_kentry *ke)
1022 {
1023 	bzero(ad, sizeof(*ad));
1024 	if (ke == NULL)
1025 		return;
1026 	ad->pfra_af = ke->pfrke_af;
1027 	ad->pfra_net = ke->pfrke_net;
1028 	ad->pfra_not = ke->pfrke_not;
1029 	if (ad->pfra_af == AF_INET)
1030 		ad->pfra_ip4addr = ke->pfrke_sa.sin.sin_addr;
1031 	else if (ad->pfra_af == AF_INET6)
1032 		ad->pfra_ip6addr = ke->pfrke_sa.sin6.sin6_addr;
1033 }
1034 
1035 int
1036 pfr_walktree(struct radix_node *rn, void *arg)
1037 {
1038 	struct pfr_kentry	*ke = (struct pfr_kentry *)rn;
1039 	struct pfr_walktree	*w = arg;
1040 	int			flags = w->pfrw_flags;
1041 
1042 	switch (w->pfrw_op) {
1043 	case PFRW_MARK:
1044 		ke->pfrke_mark = 0;
1045 		break;
1046 	case PFRW_SWEEP:
1047 		if (ke->pfrke_mark)
1048 			break;
1049 		/* FALLTHROUGH */
1050 	case PFRW_ENQUEUE:
1051 		SLIST_INSERT_HEAD(w->pfrw_workq, ke, pfrke_workq);
1052 		w->pfrw_cnt++;
1053 		break;
1054 	case PFRW_GET_ADDRS:
1055 		if (w->pfrw_free-- > 0) {
1056 			struct pfr_addr ad;
1057 
1058 			pfr_copyout_addr(&ad, ke);
1059 			if (copyout(&ad, w->pfrw_addr, sizeof(ad)))
1060 				return (EFAULT);
1061 			w->pfrw_addr++;
1062 		}
1063 		break;
1064 	case PFRW_GET_ASTATS:
1065 		if (w->pfrw_free-- > 0) {
1066 			struct pfr_astats as;
1067 
1068 			pfr_copyout_addr(&as.pfras_a, ke);
1069 
1070 			crit_enter();
1071 			bcopy(ke->pfrke_packets, as.pfras_packets,
1072 			    sizeof(as.pfras_packets));
1073 			bcopy(ke->pfrke_bytes, as.pfras_bytes,
1074 			    sizeof(as.pfras_bytes));
1075 			crit_exit();
1076 			as.pfras_tzero = ke->pfrke_tzero;
1077 
1078 			if (COPYOUT(&as, w->pfrw_astats, sizeof(as)))
1079 				return (EFAULT);
1080 			w->pfrw_astats++;
1081 		}
1082 		break;
1083 	case PFRW_POOL_GET:
1084 		if (ke->pfrke_not)
1085 			break; /* negative entries are ignored */
1086 		if (!w->pfrw_cnt--) {
1087 			w->pfrw_kentry = ke;
1088 			return (1); /* finish search */
1089 		}
1090 		break;
1091 	case PFRW_DYNADDR_UPDATE:
1092 		if (ke->pfrke_af == AF_INET) {
1093 			if (w->pfrw_dyn->pfid_acnt4++ > 0)
1094 				break;
1095 			pfr_prepare_network(&pfr_mask, AF_INET, ke->pfrke_net);
1096 			w->pfrw_dyn->pfid_addr4 = *SUNION2PF(
1097 			    &ke->pfrke_sa, AF_INET);
1098 			w->pfrw_dyn->pfid_mask4 = *SUNION2PF(
1099 			    &pfr_mask, AF_INET);
1100 		} else if (ke->pfrke_af == AF_INET6){
1101 			if (w->pfrw_dyn->pfid_acnt6++ > 0)
1102 				break;
1103 			pfr_prepare_network(&pfr_mask, AF_INET6, ke->pfrke_net);
1104 			w->pfrw_dyn->pfid_addr6 = *SUNION2PF(
1105 			    &ke->pfrke_sa, AF_INET6);
1106 			w->pfrw_dyn->pfid_mask6 = *SUNION2PF(
1107 			    &pfr_mask, AF_INET6);
1108 		}
1109 		break;
1110 	}
1111 	return (0);
1112 }
1113 
1114 int
1115 pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags)
1116 {
1117 	struct pfr_ktableworkq	 workq;
1118 	struct pfr_ktable	*p;
1119 	int			 xdel = 0;
1120 
1121 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_ALLRSETS);
1122 	if (pfr_fix_anchor(filter->pfrt_anchor))
1123 		return (EINVAL);
1124 	if (pfr_table_count(filter, flags) < 0)
1125 		return (ENOENT);
1126 
1127 	SLIST_INIT(&workq);
1128 	RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1129 		if (pfr_skip_table(filter, p, flags))
1130 			continue;
1131 		if (!strcmp(p->pfrkt_anchor, PF_RESERVED_ANCHOR))
1132 			continue;
1133 		if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE))
1134 			continue;
1135 		p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1136 		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1137 		xdel++;
1138 	}
1139 	if (!(flags & PFR_FLAG_DUMMY)) {
1140 		if (flags & PFR_FLAG_ATOMIC)
1141 			crit_enter();
1142 		pfr_setflags_ktables(&workq);
1143 		if (flags & PFR_FLAG_ATOMIC)
1144 			crit_exit();
1145 	}
1146 	if (ndel != NULL)
1147 		*ndel = xdel;
1148 	return (0);
1149 }
1150 
1151 int
1152 pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags)
1153 {
1154 	struct pfr_ktableworkq	 addq, changeq;
1155 	struct pfr_ktable	*p, *q, *r, key;
1156 	int			 i, rv, xadd = 0;
1157 	long			 tzero = time_second;
1158 
1159 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY);
1160 	SLIST_INIT(&addq);
1161 	SLIST_INIT(&changeq);
1162 	for (i = 0; i < size; i++) {
1163 		if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t)))
1164 			senderr(EFAULT);
1165 		if (pfr_validate_table(&key.pfrkt_t, PFR_TFLAG_USRMASK,
1166 		    flags & PFR_FLAG_USERIOCTL))
1167 			senderr(EINVAL);
1168 		key.pfrkt_flags |= PFR_TFLAG_ACTIVE;
1169 		p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1170 		if (p == NULL) {
1171 			p = pfr_create_ktable(&key.pfrkt_t, tzero, 1);
1172 			if (p == NULL)
1173 				senderr(ENOMEM);
1174 			SLIST_FOREACH(q, &addq, pfrkt_workq) {
1175 				if (!pfr_ktable_compare(p, q))
1176 					goto _skip;
1177 			}
1178 			SLIST_INSERT_HEAD(&addq, p, pfrkt_workq);
1179 			xadd++;
1180 			if (!key.pfrkt_anchor[0])
1181 				goto _skip;
1182 
1183 			/* find or create root table */
1184 			bzero(key.pfrkt_anchor, sizeof(key.pfrkt_anchor));
1185 			r = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1186 			if (r != NULL) {
1187 				p->pfrkt_root = r;
1188 				goto _skip;
1189 			}
1190 			SLIST_FOREACH(q, &addq, pfrkt_workq) {
1191 				if (!pfr_ktable_compare(&key, q)) {
1192 					p->pfrkt_root = q;
1193 					goto _skip;
1194 				}
1195 			}
1196 			key.pfrkt_flags = 0;
1197 			r = pfr_create_ktable(&key.pfrkt_t, 0, 1);
1198 			if (r == NULL)
1199 				senderr(ENOMEM);
1200 			SLIST_INSERT_HEAD(&addq, r, pfrkt_workq);
1201 			p->pfrkt_root = r;
1202 		} else if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1203 			SLIST_FOREACH(q, &changeq, pfrkt_workq)
1204 				if (!pfr_ktable_compare(&key, q))
1205 					goto _skip;
1206 			p->pfrkt_nflags = (p->pfrkt_flags &
1207 			    ~PFR_TFLAG_USRMASK) | key.pfrkt_flags;
1208 			SLIST_INSERT_HEAD(&changeq, p, pfrkt_workq);
1209 			xadd++;
1210 		}
1211 _skip:
1212 	;
1213 	}
1214 	if (!(flags & PFR_FLAG_DUMMY)) {
1215 		if (flags & PFR_FLAG_ATOMIC)
1216 			crit_enter();
1217 		pfr_insert_ktables(&addq);
1218 		pfr_setflags_ktables(&changeq);
1219 		if (flags & PFR_FLAG_ATOMIC)
1220 			crit_exit();
1221 	} else
1222 		 pfr_destroy_ktables(&addq, 0);
1223 	if (nadd != NULL)
1224 		*nadd = xadd;
1225 	return (0);
1226 _bad:
1227 	pfr_destroy_ktables(&addq, 0);
1228 	return (rv);
1229 }
1230 
1231 int
1232 pfr_del_tables(struct pfr_table *tbl, int size, int *ndel, int flags)
1233 {
1234 	struct pfr_ktableworkq	 workq;
1235 	struct pfr_ktable	*p, *q, key;
1236 	int			 i, xdel = 0;
1237 
1238 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY);
1239 	SLIST_INIT(&workq);
1240 	for (i = 0; i < size; i++) {
1241 		if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t)))
1242 			return (EFAULT);
1243 		if (pfr_validate_table(&key.pfrkt_t, 0,
1244 		    flags & PFR_FLAG_USERIOCTL))
1245 			return (EINVAL);
1246 		p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1247 		if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1248 			SLIST_FOREACH(q, &workq, pfrkt_workq)
1249 				if (!pfr_ktable_compare(p, q))
1250 					goto _skip;
1251 			p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1252 			SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1253 			xdel++;
1254 		}
1255 _skip:
1256 	;
1257 	}
1258 
1259 	if (!(flags & PFR_FLAG_DUMMY)) {
1260 		if (flags & PFR_FLAG_ATOMIC)
1261 			crit_enter();
1262 		pfr_setflags_ktables(&workq);
1263 		if (flags & PFR_FLAG_ATOMIC)
1264 			crit_exit();
1265 	}
1266 	if (ndel != NULL)
1267 		*ndel = xdel;
1268 	return (0);
1269 }
1270 
1271 int
1272 pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size,
1273 	int flags)
1274 {
1275 	struct pfr_ktable	*p;
1276 	int			 n, nn;
1277 
1278 	ACCEPT_FLAGS(PFR_FLAG_ALLRSETS);
1279 	if (pfr_fix_anchor(filter->pfrt_anchor))
1280 		return (EINVAL);
1281 	n = nn = pfr_table_count(filter, flags);
1282 	if (n < 0)
1283 		return (ENOENT);
1284 	if (n > *size) {
1285 		*size = n;
1286 		return (0);
1287 	}
1288 	RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1289 		if (pfr_skip_table(filter, p, flags))
1290 			continue;
1291 		if (n-- <= 0)
1292 			continue;
1293 		if (COPYOUT(&p->pfrkt_t, tbl++, sizeof(*tbl)))
1294 			return (EFAULT);
1295 	}
1296 	if (n) {
1297 		kprintf("pfr_get_tables: corruption detected (%d).\n", n);
1298 		return (ENOTTY);
1299 	}
1300 	*size = nn;
1301 	return (0);
1302 }
1303 
1304 int
1305 pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size,
1306 	int flags)
1307 {
1308 	struct pfr_ktable	*p;
1309 	struct pfr_ktableworkq	 workq;
1310 	int			 n, nn;
1311 	long			 tzero = time_second;
1312 
1313 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC|PFR_FLAG_ALLRSETS);
1314 					/* XXX PFR_FLAG_CLSTATS disabled */
1315 	if (pfr_fix_anchor(filter->pfrt_anchor))
1316 		return (EINVAL);
1317 	n = nn = pfr_table_count(filter, flags);
1318 	if (n < 0)
1319 		return (ENOENT);
1320 	if (n > *size) {
1321 		*size = n;
1322 		return (0);
1323 	}
1324 	SLIST_INIT(&workq);
1325 	if (flags & PFR_FLAG_ATOMIC)
1326 		crit_enter();
1327 	RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1328 		if (pfr_skip_table(filter, p, flags))
1329 			continue;
1330 		if (n-- <= 0)
1331 			continue;
1332 		if (!(flags & PFR_FLAG_ATOMIC))
1333 			crit_enter();
1334 		if (COPYOUT(&p->pfrkt_ts, tbl++, sizeof(*tbl))) {
1335 			crit_exit();
1336 			return (EFAULT);
1337 		}
1338 		if (!(flags & PFR_FLAG_ATOMIC))
1339 			crit_exit();
1340 		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1341 	}
1342 	if (flags & PFR_FLAG_CLSTATS)
1343 		pfr_clstats_ktables(&workq, tzero,
1344 		    flags & PFR_FLAG_ADDRSTOO);
1345 	if (flags & PFR_FLAG_ATOMIC)
1346 		crit_exit();
1347 	if (n) {
1348 		kprintf("pfr_get_tstats: corruption detected (%d).\n", n);
1349 		return (ENOTTY);
1350 	}
1351 	*size = nn;
1352 	return (0);
1353 }
1354 
1355 int
1356 pfr_clr_tstats(struct pfr_table *tbl, int size, int *nzero, int flags)
1357 {
1358 	struct pfr_ktableworkq	 workq;
1359 	struct pfr_ktable	*p, key;
1360 	int			 i, xzero = 0;
1361 	long			 tzero = time_second;
1362 
1363 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_ADDRSTOO);
1364 	SLIST_INIT(&workq);
1365 	for (i = 0; i < size; i++) {
1366 		if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t)))
1367 			return (EFAULT);
1368 		if (pfr_validate_table(&key.pfrkt_t, 0, 0))
1369 			return (EINVAL);
1370 		p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1371 		if (p != NULL) {
1372 			SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1373 			xzero++;
1374 		}
1375 	}
1376 	if (!(flags & PFR_FLAG_DUMMY)) {
1377 		if (flags & PFR_FLAG_ATOMIC)
1378 			crit_enter();
1379 		pfr_clstats_ktables(&workq, tzero, flags & PFR_FLAG_ADDRSTOO);
1380 		if (flags & PFR_FLAG_ATOMIC)
1381 			crit_exit();
1382 	}
1383 	if (nzero != NULL)
1384 		*nzero = xzero;
1385 	return (0);
1386 }
1387 
1388 int
1389 pfr_set_tflags(struct pfr_table *tbl, int size, int setflag, int clrflag,
1390 	int *nchange, int *ndel, int flags)
1391 {
1392 	struct pfr_ktableworkq	 workq;
1393 	struct pfr_ktable	*p, *q, key;
1394 	int			 i, xchange = 0, xdel = 0;
1395 
1396 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY);
1397 	if ((setflag & ~PFR_TFLAG_USRMASK) ||
1398 	    (clrflag & ~PFR_TFLAG_USRMASK) ||
1399 	    (setflag & clrflag))
1400 		return (EINVAL);
1401 	SLIST_INIT(&workq);
1402 	for (i = 0; i < size; i++) {
1403 		if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t)))
1404 			return (EFAULT);
1405 		if (pfr_validate_table(&key.pfrkt_t, 0,
1406 		    flags & PFR_FLAG_USERIOCTL))
1407 			return (EINVAL);
1408 		p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1409 		if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1410 			p->pfrkt_nflags = (p->pfrkt_flags | setflag) &
1411 			    ~clrflag;
1412 			if (p->pfrkt_nflags == p->pfrkt_flags)
1413 				goto _skip;
1414 			SLIST_FOREACH(q, &workq, pfrkt_workq)
1415 				if (!pfr_ktable_compare(p, q))
1416 					goto _skip;
1417 			SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1418 			if ((p->pfrkt_flags & PFR_TFLAG_PERSIST) &&
1419 			    (clrflag & PFR_TFLAG_PERSIST) &&
1420 			    !(p->pfrkt_flags & PFR_TFLAG_REFERENCED))
1421 				xdel++;
1422 			else
1423 				xchange++;
1424 		}
1425 _skip:
1426 	;
1427 	}
1428 	if (!(flags & PFR_FLAG_DUMMY)) {
1429 		if (flags & PFR_FLAG_ATOMIC)
1430 			crit_enter();
1431 		pfr_setflags_ktables(&workq);
1432 		if (flags & PFR_FLAG_ATOMIC)
1433 			crit_exit();
1434 	}
1435 	if (nchange != NULL)
1436 		*nchange = xchange;
1437 	if (ndel != NULL)
1438 		*ndel = xdel;
1439 	return (0);
1440 }
1441 
1442 int
1443 pfr_ina_begin(struct pfr_table *trs, u_int32_t *ticket, int *ndel, int flags)
1444 {
1445 	struct pfr_ktableworkq	 workq;
1446 	struct pfr_ktable	*p;
1447 	struct pf_ruleset	*rs;
1448 	int			 xdel = 0;
1449 
1450 	ACCEPT_FLAGS(PFR_FLAG_DUMMY);
1451 	rs = pf_find_or_create_ruleset(trs->pfrt_anchor);
1452 	if (rs == NULL)
1453 		return (ENOMEM);
1454 	SLIST_INIT(&workq);
1455 	RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1456 		if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1457 		    pfr_skip_table(trs, p, 0))
1458 			continue;
1459 		p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1460 		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1461 		xdel++;
1462 	}
1463 	if (!(flags & PFR_FLAG_DUMMY)) {
1464 		pfr_setflags_ktables(&workq);
1465 		if (ticket != NULL)
1466 			*ticket = ++rs->tticket;
1467 		rs->topen = 1;
1468 	} else
1469 		pf_remove_if_empty_ruleset(rs);
1470 	if (ndel != NULL)
1471 		*ndel = xdel;
1472 	return (0);
1473 }
1474 
1475 int
1476 pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size,
1477     int *nadd, int *naddr, u_int32_t ticket, int flags)
1478 {
1479 	struct pfr_ktableworkq	 tableq;
1480 	struct pfr_kentryworkq	 addrq;
1481 	struct pfr_ktable	*kt, *rt, *shadow, key;
1482 	struct pfr_kentry	*p;
1483 	struct pfr_addr		 ad;
1484 	struct pf_ruleset	*rs;
1485 	int			 i, rv, xadd = 0, xaddr = 0;
1486 
1487 	ACCEPT_FLAGS(PFR_FLAG_DUMMY|PFR_FLAG_ADDRSTOO);
1488 	if (size && !(flags & PFR_FLAG_ADDRSTOO))
1489 		return (EINVAL);
1490 	if (pfr_validate_table(tbl, PFR_TFLAG_USRMASK,
1491 	    flags & PFR_FLAG_USERIOCTL))
1492 		return (EINVAL);
1493 	rs = pf_find_ruleset(tbl->pfrt_anchor);
1494 	if (rs == NULL || !rs->topen || ticket != rs->tticket)
1495 		return (EBUSY);
1496 	tbl->pfrt_flags |= PFR_TFLAG_INACTIVE;
1497 	SLIST_INIT(&tableq);
1498 	kt = RB_FIND(pfr_ktablehead, &pfr_ktables, (struct pfr_ktable *)tbl);
1499 	if (kt == NULL) {
1500 		kt = pfr_create_ktable(tbl, 0, 1);
1501 		if (kt == NULL)
1502 			return (ENOMEM);
1503 		SLIST_INSERT_HEAD(&tableq, kt, pfrkt_workq);
1504 		xadd++;
1505 		if (!tbl->pfrt_anchor[0])
1506 			goto _skip;
1507 
1508 		/* find or create root table */
1509 		bzero(&key, sizeof(key));
1510 		strlcpy(key.pfrkt_name, tbl->pfrt_name, sizeof(key.pfrkt_name));
1511 		rt = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1512 		if (rt != NULL) {
1513 			kt->pfrkt_root = rt;
1514 			goto _skip;
1515 		}
1516 		rt = pfr_create_ktable(&key.pfrkt_t, 0, 1);
1517 		if (rt == NULL) {
1518 			pfr_destroy_ktables(&tableq, 0);
1519 			return (ENOMEM);
1520 		}
1521 		SLIST_INSERT_HEAD(&tableq, rt, pfrkt_workq);
1522 		kt->pfrkt_root = rt;
1523 	} else if (!(kt->pfrkt_flags & PFR_TFLAG_INACTIVE))
1524 		xadd++;
1525 _skip:
1526 	shadow = pfr_create_ktable(tbl, 0, 0);
1527 	if (shadow == NULL) {
1528 		pfr_destroy_ktables(&tableq, 0);
1529 		return (ENOMEM);
1530 	}
1531 	SLIST_INIT(&addrq);
1532 	for (i = 0; i < size; i++) {
1533 		if (COPYIN(addr+i, &ad, sizeof(ad)))
1534 			senderr(EFAULT);
1535 		if (pfr_validate_addr(&ad))
1536 			senderr(EINVAL);
1537 		if (pfr_lookup_addr(shadow, &ad, 1) != NULL)
1538 			continue;
1539 		p = pfr_create_kentry(&ad, 0);
1540 		if (p == NULL)
1541 			senderr(ENOMEM);
1542 		if (pfr_route_kentry(shadow, p)) {
1543 			pfr_destroy_kentry(p);
1544 			continue;
1545 		}
1546 		SLIST_INSERT_HEAD(&addrq, p, pfrke_workq);
1547 		xaddr++;
1548 	}
1549 	if (!(flags & PFR_FLAG_DUMMY)) {
1550 		if (kt->pfrkt_shadow != NULL)
1551 			pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1552 		kt->pfrkt_flags |= PFR_TFLAG_INACTIVE;
1553 		pfr_insert_ktables(&tableq);
1554 		shadow->pfrkt_cnt = (flags & PFR_FLAG_ADDRSTOO) ?
1555 		    xaddr : NO_ADDRESSES;
1556 		kt->pfrkt_shadow = shadow;
1557 	} else {
1558 		pfr_clean_node_mask(shadow, &addrq);
1559 		pfr_destroy_ktable(shadow, 0);
1560 		pfr_destroy_ktables(&tableq, 0);
1561 		pfr_destroy_kentries(&addrq);
1562 	}
1563 	if (nadd != NULL)
1564 		*nadd = xadd;
1565 	if (naddr != NULL)
1566 		*naddr = xaddr;
1567 	return (0);
1568 _bad:
1569 	pfr_destroy_ktable(shadow, 0);
1570 	pfr_destroy_ktables(&tableq, 0);
1571 	pfr_destroy_kentries(&addrq);
1572 	return (rv);
1573 }
1574 
1575 int
1576 pfr_ina_rollback(struct pfr_table *trs, u_int32_t ticket, int *ndel, int flags)
1577 {
1578 	struct pfr_ktableworkq	 workq;
1579 	struct pfr_ktable	*p;
1580 	struct pf_ruleset	*rs;
1581 	int			 xdel = 0;
1582 
1583 	ACCEPT_FLAGS(PFR_FLAG_DUMMY);
1584 	rs = pf_find_ruleset(trs->pfrt_anchor);
1585 	if (rs == NULL || !rs->topen || ticket != rs->tticket)
1586 		return (0);
1587 	SLIST_INIT(&workq);
1588 	RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1589 		if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1590 		    pfr_skip_table(trs, p, 0))
1591 			continue;
1592 		p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1593 		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1594 		xdel++;
1595 	}
1596 	if (!(flags & PFR_FLAG_DUMMY)) {
1597 		pfr_setflags_ktables(&workq);
1598 		rs->topen = 0;
1599 		pf_remove_if_empty_ruleset(rs);
1600 	}
1601 	if (ndel != NULL)
1602 		*ndel = xdel;
1603 	return (0);
1604 }
1605 
1606 int
1607 pfr_ina_commit(struct pfr_table *trs, u_int32_t ticket, int *nadd,
1608     int *nchange, int flags)
1609 {
1610 	struct pfr_ktable	*p, *q;
1611 	struct pfr_ktableworkq	 workq;
1612 	struct pf_ruleset	*rs;
1613 	int			 xadd = 0, xchange = 0;
1614 	long			 tzero = time_second;
1615 
1616 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY);
1617 	rs = pf_find_ruleset(trs->pfrt_anchor);
1618 	if (rs == NULL || !rs->topen || ticket != rs->tticket)
1619 		return (EBUSY);
1620 
1621 	SLIST_INIT(&workq);
1622 	RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1623 		if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1624 		    pfr_skip_table(trs, p, 0))
1625 			continue;
1626 		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1627 		if (p->pfrkt_flags & PFR_TFLAG_ACTIVE)
1628 			xchange++;
1629 		else
1630 			xadd++;
1631 	}
1632 
1633 	if (!(flags & PFR_FLAG_DUMMY)) {
1634 		if (flags & PFR_FLAG_ATOMIC)
1635 			crit_enter();
1636 		for (p = SLIST_FIRST(&workq); p != NULL; p = q) {
1637 			q = SLIST_NEXT(p, pfrkt_workq);
1638 			pfr_commit_ktable(p, tzero);
1639 		}
1640 		if (flags & PFR_FLAG_ATOMIC)
1641 			crit_exit();
1642 		rs->topen = 0;
1643 		pf_remove_if_empty_ruleset(rs);
1644 	}
1645 	if (nadd != NULL)
1646 		*nadd = xadd;
1647 	if (nchange != NULL)
1648 		*nchange = xchange;
1649 
1650 	return (0);
1651 }
1652 
1653 void
1654 pfr_commit_ktable(struct pfr_ktable *kt, long tzero)
1655 {
1656 	struct pfr_ktable	*shadow = kt->pfrkt_shadow;
1657 	int			 nflags;
1658 
1659 	if (shadow->pfrkt_cnt == NO_ADDRESSES) {
1660 		if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1661 			pfr_clstats_ktable(kt, tzero, 1);
1662 	} else if (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) {
1663 		/* kt might contain addresses */
1664 		struct pfr_kentryworkq	 addrq, addq, changeq, delq, garbageq;
1665 		struct pfr_kentry	*p, *q, *next;
1666 		struct pfr_addr		 ad;
1667 
1668 		pfr_enqueue_addrs(shadow, &addrq, NULL, 0);
1669 		pfr_mark_addrs(kt);
1670 		SLIST_INIT(&addq);
1671 		SLIST_INIT(&changeq);
1672 		SLIST_INIT(&delq);
1673 		SLIST_INIT(&garbageq);
1674 		pfr_clean_node_mask(shadow, &addrq);
1675 		for (p = SLIST_FIRST(&addrq); p != NULL; p = next) {
1676 			next = SLIST_NEXT(p, pfrke_workq);	/* XXX */
1677 			pfr_copyout_addr(&ad, p);
1678 			q = pfr_lookup_addr(kt, &ad, 1);
1679 			if (q != NULL) {
1680 				if (q->pfrke_not != p->pfrke_not)
1681 					SLIST_INSERT_HEAD(&changeq, q,
1682 					    pfrke_workq);
1683 				q->pfrke_mark = 1;
1684 				SLIST_INSERT_HEAD(&garbageq, p, pfrke_workq);
1685 			} else {
1686 				p->pfrke_tzero = tzero;
1687 				SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
1688 			}
1689 		}
1690 		pfr_enqueue_addrs(kt, &delq, NULL, ENQUEUE_UNMARKED_ONLY);
1691 		pfr_insert_kentries(kt, &addq, tzero);
1692 		pfr_remove_kentries(kt, &delq);
1693 		pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
1694 		pfr_destroy_kentries(&garbageq);
1695 	} else {
1696 		/* kt cannot contain addresses */
1697 		SWAP(struct radix_node_head *, kt->pfrkt_ip4,
1698 		    shadow->pfrkt_ip4);
1699 		SWAP(struct radix_node_head *, kt->pfrkt_ip6,
1700 		    shadow->pfrkt_ip6);
1701 		SWAP(int, kt->pfrkt_cnt, shadow->pfrkt_cnt);
1702 		pfr_clstats_ktable(kt, tzero, 1);
1703 	}
1704 	nflags = ((shadow->pfrkt_flags & PFR_TFLAG_USRMASK) |
1705 	    (kt->pfrkt_flags & PFR_TFLAG_SETMASK) | PFR_TFLAG_ACTIVE)
1706 		& ~PFR_TFLAG_INACTIVE;
1707 	pfr_destroy_ktable(shadow, 0);
1708 	kt->pfrkt_shadow = NULL;
1709 	pfr_setflags_ktable(kt, nflags);
1710 }
1711 
1712 int
1713 pfr_validate_table(struct pfr_table *tbl, int allowedflags, int no_reserved)
1714 {
1715 	int i;
1716 
1717 	if (!tbl->pfrt_name[0])
1718 		return (-1);
1719 	if (no_reserved && !strcmp(tbl->pfrt_anchor, PF_RESERVED_ANCHOR))
1720 		 return (-1);
1721 	if (tbl->pfrt_name[PF_TABLE_NAME_SIZE-1])
1722 		return (-1);
1723 	for (i = strlen(tbl->pfrt_name); i < PF_TABLE_NAME_SIZE; i++)
1724 		if (tbl->pfrt_name[i])
1725 			return (-1);
1726 	if (pfr_fix_anchor(tbl->pfrt_anchor))
1727 		return (-1);
1728 	if (tbl->pfrt_flags & ~allowedflags)
1729 		return (-1);
1730 	return (0);
1731 }
1732 
1733 /*
1734  * Rewrite anchors referenced by tables to remove slashes
1735  * and check for validity.
1736  */
1737 int
1738 pfr_fix_anchor(char *anchor)
1739 {
1740 	size_t siz = MAXPATHLEN;
1741 	int i;
1742 
1743 	if (anchor[0] == '/') {
1744 		char *path;
1745 		int off;
1746 
1747 		path = anchor;
1748 		off = 1;
1749 		while (*++path == '/')
1750 			off++;
1751 		bcopy(path, anchor, siz - off);
1752 		memset(anchor + siz - off, 0, off);
1753 	}
1754 	if (anchor[siz - 1])
1755 		return (-1);
1756 	for (i = strlen(anchor); i < siz; i++)
1757 		if (anchor[i])
1758 			return (-1);
1759 	return (0);
1760 }
1761 
1762 int
1763 pfr_table_count(struct pfr_table *filter, int flags)
1764 {
1765 	struct pf_ruleset *rs;
1766 
1767 	if (flags & PFR_FLAG_ALLRSETS)
1768 		return (pfr_ktable_cnt);
1769 	if (filter->pfrt_anchor[0]) {
1770 		rs = pf_find_ruleset(filter->pfrt_anchor);
1771 		return ((rs != NULL) ? rs->tables : -1);
1772 	}
1773 	return (pf_main_ruleset.tables);
1774 }
1775 
1776 int
1777 pfr_skip_table(struct pfr_table *filter, struct pfr_ktable *kt, int flags)
1778 {
1779 	if (flags & PFR_FLAG_ALLRSETS)
1780 		return (0);
1781 	if (strcmp(filter->pfrt_anchor, kt->pfrkt_anchor))
1782 		return (1);
1783 	return (0);
1784 }
1785 
1786 void
1787 pfr_insert_ktables(struct pfr_ktableworkq *workq)
1788 {
1789 	struct pfr_ktable	*p;
1790 
1791 	SLIST_FOREACH(p, workq, pfrkt_workq)
1792 		pfr_insert_ktable(p);
1793 }
1794 
1795 void
1796 pfr_insert_ktable(struct pfr_ktable *kt)
1797 {
1798 	RB_INSERT(pfr_ktablehead, &pfr_ktables, kt);
1799 	pfr_ktable_cnt++;
1800 	if (kt->pfrkt_root != NULL)
1801 		if (!kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]++)
1802 			pfr_setflags_ktable(kt->pfrkt_root,
1803 			    kt->pfrkt_root->pfrkt_flags|PFR_TFLAG_REFDANCHOR);
1804 }
1805 
1806 void
1807 pfr_setflags_ktables(struct pfr_ktableworkq *workq)
1808 {
1809 	struct pfr_ktable	*p, *q;
1810 
1811 	for (p = SLIST_FIRST(workq); p; p = q) {
1812 		q = SLIST_NEXT(p, pfrkt_workq);
1813 		pfr_setflags_ktable(p, p->pfrkt_nflags);
1814 	}
1815 }
1816 
1817 void
1818 pfr_setflags_ktable(struct pfr_ktable *kt, int newf)
1819 {
1820 	struct pfr_kentryworkq	addrq;
1821 
1822 	if (!(newf & PFR_TFLAG_REFERENCED) &&
1823 	    !(newf & PFR_TFLAG_PERSIST))
1824 		newf &= ~PFR_TFLAG_ACTIVE;
1825 	if (!(newf & PFR_TFLAG_ACTIVE))
1826 		newf &= ~PFR_TFLAG_USRMASK;
1827 	if (!(newf & PFR_TFLAG_SETMASK)) {
1828 		RB_REMOVE(pfr_ktablehead, &pfr_ktables, kt);
1829 		if (kt->pfrkt_root != NULL)
1830 			if (!--kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR])
1831 				pfr_setflags_ktable(kt->pfrkt_root,
1832 				    kt->pfrkt_root->pfrkt_flags &
1833 					~PFR_TFLAG_REFDANCHOR);
1834 		pfr_destroy_ktable(kt, 1);
1835 		pfr_ktable_cnt--;
1836 		return;
1837 	}
1838 	if (!(newf & PFR_TFLAG_ACTIVE) && kt->pfrkt_cnt) {
1839 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1840 		pfr_remove_kentries(kt, &addrq);
1841 	}
1842 	if (!(newf & PFR_TFLAG_INACTIVE) && kt->pfrkt_shadow != NULL) {
1843 		pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1844 		kt->pfrkt_shadow = NULL;
1845 	}
1846 	kt->pfrkt_flags = newf;
1847 }
1848 
1849 void
1850 pfr_clstats_ktables(struct pfr_ktableworkq *workq, long tzero, int recurse)
1851 {
1852 	struct pfr_ktable	*p;
1853 
1854 	SLIST_FOREACH(p, workq, pfrkt_workq)
1855 		pfr_clstats_ktable(p, tzero, recurse);
1856 }
1857 
1858 void
1859 pfr_clstats_ktable(struct pfr_ktable *kt, long tzero, int recurse)
1860 {
1861 	struct pfr_kentryworkq	 addrq;
1862 
1863 	if (recurse) {
1864 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1865 		pfr_clstats_kentries(&addrq, tzero, 0);
1866 	}
1867 	crit_enter();
1868 	bzero(kt->pfrkt_packets, sizeof(kt->pfrkt_packets));
1869 	bzero(kt->pfrkt_bytes, sizeof(kt->pfrkt_bytes));
1870 	kt->pfrkt_match = kt->pfrkt_nomatch = 0;
1871 	crit_exit();
1872 	kt->pfrkt_tzero = tzero;
1873 }
1874 
1875 struct pfr_ktable *
1876 pfr_create_ktable(struct pfr_table *tbl, long tzero, int attachruleset)
1877 {
1878 	struct pfr_ktable	*kt;
1879 	struct pf_ruleset	*rs;
1880 
1881 	kt = pool_get(&pfr_ktable_pl, PR_NOWAIT);
1882 	if (kt == NULL)
1883 		return (NULL);
1884 	bzero(kt, sizeof(*kt));
1885 	kt->pfrkt_t = *tbl;
1886 
1887 	if (attachruleset) {
1888 		rs = pf_find_or_create_ruleset(tbl->pfrt_anchor);
1889 		if (!rs) {
1890 			pfr_destroy_ktable(kt, 0);
1891 			return (NULL);
1892 		}
1893 		kt->pfrkt_rs = rs;
1894 		rs->tables++;
1895 	}
1896 
1897 	if (!rn_inithead((void **)&kt->pfrkt_ip4,
1898 	    offsetof(struct sockaddr_in, sin_addr) * 8) ||
1899 	    !rn_inithead((void **)&kt->pfrkt_ip6,
1900 	    offsetof(struct sockaddr_in6, sin6_addr) * 8)) {
1901 		pfr_destroy_ktable(kt, 0);
1902 		return (NULL);
1903 	}
1904 	kt->pfrkt_tzero = tzero;
1905 
1906 	return (kt);
1907 }
1908 
1909 void
1910 pfr_destroy_ktables(struct pfr_ktableworkq *workq, int flushaddr)
1911 {
1912 	struct pfr_ktable	*p, *q;
1913 
1914 	for (p = SLIST_FIRST(workq); p; p = q) {
1915 		q = SLIST_NEXT(p, pfrkt_workq);
1916 		pfr_destroy_ktable(p, flushaddr);
1917 	}
1918 }
1919 
1920 void
1921 pfr_destroy_ktable(struct pfr_ktable *kt, int flushaddr)
1922 {
1923 	struct pfr_kentryworkq	 addrq;
1924 
1925 	if (flushaddr) {
1926 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1927 		pfr_clean_node_mask(kt, &addrq);
1928 		pfr_destroy_kentries(&addrq);
1929 	}
1930 	if (kt->pfrkt_ip4 != NULL)
1931 		kfree((caddr_t)kt->pfrkt_ip4, M_RTABLE);
1932 	if (kt->pfrkt_ip6 != NULL)
1933 		kfree((caddr_t)kt->pfrkt_ip6, M_RTABLE);
1934 	if (kt->pfrkt_shadow != NULL)
1935 		pfr_destroy_ktable(kt->pfrkt_shadow, flushaddr);
1936 	if (kt->pfrkt_rs != NULL) {
1937 		kt->pfrkt_rs->tables--;
1938 		pf_remove_if_empty_ruleset(kt->pfrkt_rs);
1939 	}
1940 	pool_put(&pfr_ktable_pl, kt);
1941 }
1942 
1943 int
1944 pfr_ktable_compare(struct pfr_ktable *p, struct pfr_ktable *q)
1945 {
1946 	int d;
1947 
1948 	if ((d = strncmp(p->pfrkt_name, q->pfrkt_name, PF_TABLE_NAME_SIZE)))
1949 		return (d);
1950 	return (strcmp(p->pfrkt_anchor, q->pfrkt_anchor));
1951 }
1952 
1953 struct pfr_ktable *
1954 pfr_lookup_table(struct pfr_table *tbl)
1955 {
1956 	/* struct pfr_ktable start like a struct pfr_table */
1957 	return (RB_FIND(pfr_ktablehead, &pfr_ktables,
1958 	    (struct pfr_ktable *)tbl));
1959 }
1960 
1961 int
1962 pfr_match_addr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af)
1963 {
1964 	struct pfr_kentry	*ke = NULL;
1965 	int			 match;
1966 
1967 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
1968 		kt = kt->pfrkt_root;
1969 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1970 		return (0);
1971 
1972 	switch (af) {
1973 #ifdef INET
1974 	case AF_INET:
1975 		pfr_sin.sin_addr.s_addr = a->addr32[0];
1976 		ke = (struct pfr_kentry *)rn_match((char *)&pfr_sin,
1977 		    kt->pfrkt_ip4);
1978 		if (ke && KENTRY_RNF_ROOT(ke))
1979 			ke = NULL;
1980 		break;
1981 #endif /* INET */
1982 #ifdef INET6
1983 	case AF_INET6:
1984 		bcopy(a, &pfr_sin6.sin6_addr, sizeof(pfr_sin6.sin6_addr));
1985 		ke = (struct pfr_kentry *)rn_match((char *)&pfr_sin6,
1986 		    kt->pfrkt_ip6);
1987 		if (ke && KENTRY_RNF_ROOT(ke))
1988 			ke = NULL;
1989 		break;
1990 #endif /* INET6 */
1991 	}
1992 	match = (ke && !ke->pfrke_not);
1993 	if (match)
1994 		kt->pfrkt_match++;
1995 	else
1996 		kt->pfrkt_nomatch++;
1997 	return (match);
1998 }
1999 
2000 void
2001 pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af,
2002     u_int64_t len, int dir_out, int op_pass, int notrule)
2003 {
2004 	struct pfr_kentry	*ke = NULL;
2005 
2006 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2007 		kt = kt->pfrkt_root;
2008 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2009 		return;
2010 
2011 	switch (af) {
2012 #ifdef INET
2013 	case AF_INET:
2014 		pfr_sin.sin_addr.s_addr = a->addr32[0];
2015 		ke = (struct pfr_kentry *)rn_match((char *)&pfr_sin,
2016 		    kt->pfrkt_ip4);
2017 		if (ke && KENTRY_RNF_ROOT(ke))
2018 			ke = NULL;
2019 		break;
2020 #endif /* INET */
2021 #ifdef INET6
2022 	case AF_INET6:
2023 		bcopy(a, &pfr_sin6.sin6_addr, sizeof(pfr_sin6.sin6_addr));
2024 		ke = (struct pfr_kentry *)rn_match((char *)&pfr_sin6,
2025 		    kt->pfrkt_ip6);
2026 		if (ke && KENTRY_RNF_ROOT(ke))
2027 			ke = NULL;
2028 		break;
2029 #endif /* INET6 */
2030 	default:
2031 		;
2032 	}
2033 	if ((ke == NULL || ke->pfrke_not) != notrule) {
2034 		if (op_pass != PFR_OP_PASS)
2035 			kprintf("pfr_update_stats: assertion failed.\n");
2036 		op_pass = PFR_OP_XPASS;
2037 	}
2038 	kt->pfrkt_packets[dir_out][op_pass]++;
2039 	kt->pfrkt_bytes[dir_out][op_pass] += len;
2040 	if (ke != NULL && op_pass != PFR_OP_XPASS) {
2041 		ke->pfrke_packets[dir_out][op_pass]++;
2042 		ke->pfrke_bytes[dir_out][op_pass] += len;
2043 	}
2044 }
2045 
2046 struct pfr_ktable *
2047 pfr_attach_table(struct pf_ruleset *rs, char *name)
2048 {
2049 	struct pfr_ktable	*kt, *rt;
2050 	struct pfr_table	 tbl;
2051 	struct pf_anchor	*ac = rs->anchor;
2052 
2053 	bzero(&tbl, sizeof(tbl));
2054 	strlcpy(tbl.pfrt_name, name, sizeof(tbl.pfrt_name));
2055 	if (ac != NULL)
2056 		strlcpy(tbl.pfrt_anchor, ac->path, sizeof(tbl.pfrt_anchor));
2057 	kt = pfr_lookup_table(&tbl);
2058 	if (kt == NULL) {
2059 		kt = pfr_create_ktable(&tbl, time_second, 1);
2060 		if (kt == NULL)
2061 			return (NULL);
2062 		if (ac != NULL) {
2063 			bzero(tbl.pfrt_anchor, sizeof(tbl.pfrt_anchor));
2064 			rt = pfr_lookup_table(&tbl);
2065 			if (rt == NULL) {
2066 				rt = pfr_create_ktable(&tbl, 0, 1);
2067 				if (rt == NULL) {
2068 					pfr_destroy_ktable(kt, 0);
2069 					return (NULL);
2070 				}
2071 				pfr_insert_ktable(rt);
2072 			}
2073 			kt->pfrkt_root = rt;
2074 		}
2075 		pfr_insert_ktable(kt);
2076 	}
2077 	if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++)
2078 		pfr_setflags_ktable(kt, kt->pfrkt_flags|PFR_TFLAG_REFERENCED);
2079 	return (kt);
2080 }
2081 
2082 void
2083 pfr_detach_table(struct pfr_ktable *kt)
2084 {
2085 	if (kt->pfrkt_refcnt[PFR_REFCNT_RULE] <= 0)
2086 		kprintf("pfr_detach_table: refcount = %d.\n",
2087 		    kt->pfrkt_refcnt[PFR_REFCNT_RULE]);
2088 	else if (!--kt->pfrkt_refcnt[PFR_REFCNT_RULE])
2089 		pfr_setflags_ktable(kt, kt->pfrkt_flags&~PFR_TFLAG_REFERENCED);
2090 }
2091 
2092 int
2093 pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter,
2094     struct pf_addr **raddr, struct pf_addr **rmask, sa_family_t af)
2095 {
2096 	struct pfr_kentry	*ke, *ke2 = NULL;
2097 	struct pf_addr		*addr = NULL;
2098 	union sockaddr_union	 mask;
2099 	int			 idx = -1, use_counter = 0;
2100 
2101 	if (af == AF_INET)
2102 		addr = (struct pf_addr *)&pfr_sin.sin_addr;
2103 	else if (af == AF_INET6)
2104 		addr = (struct pf_addr *)&pfr_sin6.sin6_addr;
2105 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2106 		kt = kt->pfrkt_root;
2107 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2108 		return (-1);
2109 
2110 	if (pidx != NULL)
2111 		idx = *pidx;
2112 	if (counter != NULL && idx >= 0)
2113 		use_counter = 1;
2114 	if (idx < 0)
2115 		idx = 0;
2116 
2117 _next_block:
2118 	ke = pfr_kentry_byidx(kt, idx, af);
2119 	if (ke == NULL)
2120 		return (1);
2121 	pfr_prepare_network(&pfr_mask, af, ke->pfrke_net);
2122 	*raddr = SUNION2PF(&ke->pfrke_sa, af);
2123 	*rmask = SUNION2PF(&pfr_mask, af);
2124 
2125 	if (use_counter) {
2126 		/* is supplied address within block? */
2127 		if (!PF_MATCHA(0, *raddr, *rmask, counter, af)) {
2128 			/* no, go to next block in table */
2129 			idx++;
2130 			use_counter = 0;
2131 			goto _next_block;
2132 		}
2133 		PF_ACPY(addr, counter, af);
2134 	} else {
2135 		/* use first address of block */
2136 		PF_ACPY(addr, *raddr, af);
2137 	}
2138 
2139 	if (!KENTRY_NETWORK(ke)) {
2140 		/* this is a single IP address - no possible nested block */
2141 		PF_ACPY(counter, addr, af);
2142 		*pidx = idx;
2143 		return (0);
2144 	}
2145 	for (;;) {
2146 		/* we don't want to use a nested block */
2147 		if (af == AF_INET)
2148 			ke2 = (struct pfr_kentry *)rn_match((char *)&pfr_sin,
2149 			    kt->pfrkt_ip4);
2150 		else if (af == AF_INET6)
2151 			ke2 = (struct pfr_kentry *)rn_match((char *)&pfr_sin6,
2152 			    kt->pfrkt_ip6);
2153 		/* no need to check KENTRY_RNF_ROOT() here */
2154 		if (ke2 == ke) {
2155 			/* lookup return the same block - perfect */
2156 			PF_ACPY(counter, addr, af);
2157 			*pidx = idx;
2158 			return (0);
2159 		}
2160 
2161 		/* we need to increase the counter past the nested block */
2162 		pfr_prepare_network(&mask, AF_INET, ke2->pfrke_net);
2163 		PF_POOLMASK(addr, addr, SUNION2PF(&mask, af), &pfr_ffaddr, af);
2164 		PF_AINC(addr, af);
2165 		if (!PF_MATCHA(0, *raddr, *rmask, addr, af)) {
2166 			/* ok, we reached the end of our main block */
2167 			/* go to next block in table */
2168 			idx++;
2169 			use_counter = 0;
2170 			goto _next_block;
2171 		}
2172 	}
2173 }
2174 
2175 struct pfr_kentry *
2176 pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af)
2177 {
2178 	struct pfr_walktree	w;
2179 
2180 	bzero(&w, sizeof(w));
2181 	w.pfrw_op = PFRW_POOL_GET;
2182 	w.pfrw_cnt = idx;
2183 
2184 	switch (af) {
2185 #ifdef INET
2186 	case AF_INET:
2187 		kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
2188 		return (w.pfrw_kentry);
2189 #endif /* INET */
2190 #ifdef INET6
2191 	case AF_INET6:
2192 		kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
2193 		return (w.pfrw_kentry);
2194 #endif /* INET6 */
2195 	default:
2196 		return (NULL);
2197 	}
2198 }
2199 
2200 void
2201 pfr_dynaddr_update(struct pfr_ktable *kt, struct pfi_dynaddr *dyn)
2202 {
2203 	struct pfr_walktree	w;
2204 
2205 	bzero(&w, sizeof(w));
2206 	w.pfrw_op = PFRW_DYNADDR_UPDATE;
2207 	w.pfrw_dyn = dyn;
2208 
2209 	crit_enter();
2210 	dyn->pfid_acnt4 = 0;
2211 	dyn->pfid_acnt6 = 0;
2212 	if (!dyn->pfid_af || dyn->pfid_af == AF_INET)
2213 		kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
2214 	if (!dyn->pfid_af || dyn->pfid_af == AF_INET6)
2215 		kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
2216 	crit_exit();
2217 }
2218