xref: /netbsd-src/sys/dist/pf/net/pf_table.c (revision 8b0f9554ff8762542c4defc4f70e1eb76fb508fa)
1 /*	$NetBSD: pf_table.c,v 1.13 2007/12/11 11:08:22 lukem Exp $	*/
2 /*	$OpenBSD: pf_table.c,v 1.62 2004/12/07 18:02:04 mcbride Exp $	*/
3 
4 /*
5  * Copyright (c) 2002 Cedric Berger
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  *    - Redistributions of source code must retain the above copyright
13  *      notice, this list of conditions and the following disclaimer.
14  *    - Redistributions in binary form must reproduce the above
15  *      copyright notice, this list of conditions and the following
16  *      disclaimer in the documentation and/or other materials provided
17  *      with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
25  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
27  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
29  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  *
32  */
33 
34 #include <sys/cdefs.h>
35 __KERNEL_RCSID(0, "$NetBSD: pf_table.c,v 1.13 2007/12/11 11:08:22 lukem Exp $");
36 
37 #ifdef _KERNEL_OPT
38 #include "opt_inet.h"
39 #endif
40 
41 #include <sys/param.h>
42 #include <sys/systm.h>
43 #include <sys/socket.h>
44 #include <sys/mbuf.h>
45 #include <sys/kernel.h>
46 
47 #include <net/if.h>
48 #include <net/route.h>
49 #include <netinet/in.h>
50 #ifdef __OpenBSD__
51 #include <netinet/ip_ipsp.h>
52 #endif
53 #include <net/pfvar.h>
54 
55 #define ACCEPT_FLAGS(oklist)			\
56 	do {					\
57 		if ((flags & ~(oklist)) &	\
58 		    PFR_FLAG_ALLMASK)		\
59 			return (EINVAL);	\
60 	} while (0)
61 
62 #define COPYIN(from, to, size)			\
63 	((flags & PFR_FLAG_USERIOCTL) ?		\
64 	copyin((from), (to), (size)) :		\
65 	(bcopy((from), (to), (size)), 0))
66 
67 #define COPYOUT(from, to, size)			\
68 	((flags & PFR_FLAG_USERIOCTL) ?		\
69 	copyout((from), (to), (size)) :		\
70 	(bcopy((from), (to), (size)), 0))
71 
72 #define	FILLIN_SIN(sin, addr)			\
73 	do {					\
74 		(sin).sin_len = sizeof(sin);	\
75 		(sin).sin_family = AF_INET;	\
76 		(sin).sin_addr = (addr);	\
77 	} while (0)
78 
79 #define	FILLIN_SIN6(sin6, addr)			\
80 	do {					\
81 		(sin6).sin6_len = sizeof(sin6);	\
82 		(sin6).sin6_family = AF_INET6;	\
83 		(sin6).sin6_addr = (addr);	\
84 	} while (0)
85 
86 #define SWAP(type, a1, a2)			\
87 	do {					\
88 		type tmp = a1;			\
89 		a1 = a2;			\
90 		a2 = tmp;			\
91 	} while (0)
92 
93 #define SUNION2PF(su, af) (((af)==AF_INET) ?	\
94     (struct pf_addr *)&(su)->sin.sin_addr :	\
95     (struct pf_addr *)&(su)->sin6.sin6_addr)
96 
97 #define	AF_BITS(af)		(((af)==AF_INET)?32:128)
98 #define	ADDR_NETWORK(ad)	((ad)->pfra_net < AF_BITS((ad)->pfra_af))
99 #define	KENTRY_NETWORK(ke)	((ke)->pfrke_net < AF_BITS((ke)->pfrke_af))
100 #define KENTRY_RNF_ROOT(ke) \
101 		((((struct radix_node *)(ke))->rn_flags & RNF_ROOT) != 0)
102 
103 #define NO_ADDRESSES		(-1)
104 #define ENQUEUE_UNMARKED_ONLY	(1)
105 #define INVERT_NEG_FLAG		(1)
106 
107 struct pfr_walktree {
108 	enum pfrw_op {
109 		PFRW_MARK,
110 		PFRW_SWEEP,
111 		PFRW_ENQUEUE,
112 		PFRW_GET_ADDRS,
113 		PFRW_GET_ASTATS,
114 		PFRW_POOL_GET,
115 		PFRW_DYNADDR_UPDATE
116 	}	 pfrw_op;
117 	union {
118 		struct pfr_addr		*pfrw1_addr;
119 		struct pfr_astats	*pfrw1_astats;
120 		struct pfr_kentryworkq	*pfrw1_workq;
121 		struct pfr_kentry	*pfrw1_kentry;
122 		struct pfi_dynaddr	*pfrw1_dyn;
123 	}	 pfrw_1;
124 	int	 pfrw_free;
125 	int	 pfrw_flags;
126 };
127 #define pfrw_addr	pfrw_1.pfrw1_addr
128 #define pfrw_astats	pfrw_1.pfrw1_astats
129 #define pfrw_workq	pfrw_1.pfrw1_workq
130 #define pfrw_kentry	pfrw_1.pfrw1_kentry
131 #define pfrw_dyn	pfrw_1.pfrw1_dyn
132 #define pfrw_cnt	pfrw_free
133 
134 #define senderr(e)	do { rv = (e); goto _bad; } while (0)
135 
136 struct pool		 pfr_ktable_pl;
137 struct pool		 pfr_kentry_pl;
138 struct pool		 pfr_kentry_pl2;
139 struct sockaddr_in	 pfr_sin;
140 struct sockaddr_in6	 pfr_sin6;
141 union sockaddr_union	 pfr_mask;
142 struct pf_addr		 pfr_ffaddr;
143 
144 void			 pfr_copyout_addr(struct pfr_addr *,
145 			    struct pfr_kentry *ke);
146 int			 pfr_validate_addr(struct pfr_addr *);
147 void			 pfr_enqueue_addrs(struct pfr_ktable *,
148 			    struct pfr_kentryworkq *, int *, int);
149 void			 pfr_mark_addrs(struct pfr_ktable *);
150 struct pfr_kentry	*pfr_lookup_addr(struct pfr_ktable *,
151 			    struct pfr_addr *, int);
152 struct pfr_kentry	*pfr_create_kentry(struct pfr_addr *, int);
153 void			 pfr_destroy_kentries(struct pfr_kentryworkq *);
154 void			 pfr_destroy_kentry(struct pfr_kentry *);
155 void			 pfr_insert_kentries(struct pfr_ktable *,
156 			    struct pfr_kentryworkq *, long);
157 void			 pfr_remove_kentries(struct pfr_ktable *,
158 			    struct pfr_kentryworkq *);
159 void			 pfr_clstats_kentries(struct pfr_kentryworkq *, long,
160 			    int);
161 void			 pfr_reset_feedback(struct pfr_addr *, int, int);
162 void			 pfr_prepare_network(union sockaddr_union *, int, int);
163 int			 pfr_route_kentry(struct pfr_ktable *,
164 			    struct pfr_kentry *);
165 int			 pfr_unroute_kentry(struct pfr_ktable *,
166 			    struct pfr_kentry *);
167 int			 pfr_walktree(struct radix_node *, void *);
168 int			 pfr_validate_table(struct pfr_table *, int, int);
169 int			 pfr_fix_anchor(char *);
170 void			 pfr_commit_ktable(struct pfr_ktable *, long);
171 void			 pfr_insert_ktables(struct pfr_ktableworkq *);
172 void			 pfr_insert_ktable(struct pfr_ktable *);
173 void			 pfr_setflags_ktables(struct pfr_ktableworkq *);
174 void			 pfr_setflags_ktable(struct pfr_ktable *, int);
175 void			 pfr_clstats_ktables(struct pfr_ktableworkq *, long,
176 			    int);
177 void			 pfr_clstats_ktable(struct pfr_ktable *, long, int);
178 struct pfr_ktable	*pfr_create_ktable(struct pfr_table *, long, int);
179 void			 pfr_destroy_ktables(struct pfr_ktableworkq *, int);
180 void			 pfr_destroy_ktable(struct pfr_ktable *, int);
181 int			 pfr_ktable_compare(struct pfr_ktable *,
182 			    struct pfr_ktable *);
183 struct pfr_ktable	*pfr_lookup_table(struct pfr_table *);
184 void			 pfr_clean_node_mask(struct pfr_ktable *,
185 			    struct pfr_kentryworkq *);
186 int			 pfr_table_count(struct pfr_table *, int);
187 int			 pfr_skip_table(struct pfr_table *,
188 			    struct pfr_ktable *, int);
189 struct pfr_kentry	*pfr_kentry_byidx(struct pfr_ktable *, int, int);
190 
191 RB_PROTOTYPE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
192 RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
193 
194 struct pfr_ktablehead	 pfr_ktables;
195 struct pfr_table	 pfr_nulltable;
196 int			 pfr_ktable_cnt;
197 
198 void
199 pfr_initialize(void)
200 {
201 #ifdef __NetBSD__
202 	pool_init(&pfr_ktable_pl, sizeof(struct pfr_ktable), 0, 0, 0,
203 	    "pfrktable", &pool_allocator_oldnointr, IPL_NONE);
204 	pool_init(&pfr_kentry_pl, sizeof(struct pfr_kentry), 0, 0, 0,
205 	    "pfrkentry", &pool_allocator_oldnointr, IPL_NONE);
206 	pool_init(&pfr_kentry_pl2, sizeof(struct pfr_kentry), 0, 0, 0,
207 	    "pfrkentry2", NULL, IPL_SOFTNET);
208 #else
209 	pool_init(&pfr_ktable_pl, sizeof(struct pfr_ktable), 0, 0, 0,
210 	    "pfrktable", &pool_allocator_oldnointr);
211 	pool_init(&pfr_kentry_pl, sizeof(struct pfr_kentry), 0, 0, 0,
212 	    "pfrkentry", &pool_allocator_oldnointr);
213 	pool_init(&pfr_kentry_pl2, sizeof(struct pfr_kentry), 0, 0, 0,
214 	    "pfrkentry2", NULL);
215 #endif
216 
217 	pfr_sin.sin_len = sizeof(pfr_sin);
218 	pfr_sin.sin_family = AF_INET;
219 	pfr_sin6.sin6_len = sizeof(pfr_sin6);
220 	pfr_sin6.sin6_family = AF_INET6;
221 
222 	memset(&pfr_ffaddr, 0xff, sizeof(pfr_ffaddr));
223 }
224 
225 #ifdef _LKM
226 void
227 pfr_destroy(void)
228 {
229 	pool_destroy(&pfr_ktable_pl);
230 	pool_destroy(&pfr_kentry_pl);
231 	pool_destroy(&pfr_kentry_pl2);
232 }
233 #endif
234 
235 int
236 pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags)
237 {
238 	struct pfr_ktable	*kt;
239 	struct pfr_kentryworkq	 workq;
240 	int			 s = 0;
241 
242 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY);
243 	if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
244 		return (EINVAL);
245 	kt = pfr_lookup_table(tbl);
246 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
247 		return (ESRCH);
248 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
249 		return (EPERM);
250 	pfr_enqueue_addrs(kt, &workq, ndel, 0);
251 
252 	if (!(flags & PFR_FLAG_DUMMY)) {
253 		if (flags & PFR_FLAG_ATOMIC)
254 			s = splsoftnet();
255 		pfr_remove_kentries(kt, &workq);
256 		if (flags & PFR_FLAG_ATOMIC)
257 			splx(s);
258 		if (kt->pfrkt_cnt) {
259 			printf("pfr_clr_addrs: corruption detected (%d).\n",
260 			    kt->pfrkt_cnt);
261 			kt->pfrkt_cnt = 0;
262 		}
263 	}
264 	return (0);
265 }
266 
267 int
268 pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
269     int *nadd, int flags)
270 {
271 	struct pfr_ktable	*kt, *tmpkt;
272 	struct pfr_kentryworkq	 workq;
273 	struct pfr_kentry	*p, *q;
274 	struct pfr_addr		 ad;
275 	int			 i, rv, s = 0 /* XXX gcc */, xadd = 0;
276 	long			 tzero = time_second;
277 
278 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_FEEDBACK);
279 	if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
280 		return (EINVAL);
281 	kt = pfr_lookup_table(tbl);
282 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
283 		return (ESRCH);
284 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
285 		return (EPERM);
286 	tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0);
287 	if (tmpkt == NULL)
288 		return (ENOMEM);
289 	SLIST_INIT(&workq);
290 	for (i = 0; i < size; i++) {
291 		if (COPYIN(addr+i, &ad, sizeof(ad)))
292 			senderr(EFAULT);
293 		if (pfr_validate_addr(&ad))
294 			senderr(EINVAL);
295 		p = pfr_lookup_addr(kt, &ad, 1);
296 		q = pfr_lookup_addr(tmpkt, &ad, 1);
297 		if (flags & PFR_FLAG_FEEDBACK) {
298 			if (q != NULL)
299 				ad.pfra_fback = PFR_FB_DUPLICATE;
300 			else if (p == NULL)
301 				ad.pfra_fback = PFR_FB_ADDED;
302 			else if (p->pfrke_not != ad.pfra_not)
303 				ad.pfra_fback = PFR_FB_CONFLICT;
304 			else
305 				ad.pfra_fback = PFR_FB_NONE;
306 		}
307 		if (p == NULL && q == NULL) {
308 			p = pfr_create_kentry(&ad, 0);
309 			if (p == NULL)
310 				senderr(ENOMEM);
311 			if (pfr_route_kentry(tmpkt, p)) {
312 				pfr_destroy_kentry(p);
313 				ad.pfra_fback = PFR_FB_NONE;
314 			} else {
315 				SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
316 				xadd++;
317 			}
318 		}
319 		if (flags & PFR_FLAG_FEEDBACK)
320 			if (COPYOUT(&ad, addr+i, sizeof(ad)))
321 				senderr(EFAULT);
322 	}
323 	pfr_clean_node_mask(tmpkt, &workq);
324 	if (!(flags & PFR_FLAG_DUMMY)) {
325 		if (flags & PFR_FLAG_ATOMIC)
326 			s = splsoftnet();
327 		pfr_insert_kentries(kt, &workq, tzero);
328 		if (flags & PFR_FLAG_ATOMIC)
329 			splx(s);
330 	} else
331 		pfr_destroy_kentries(&workq);
332 	if (nadd != NULL)
333 		*nadd = xadd;
334 	pfr_destroy_ktable(tmpkt, 0);
335 	return (0);
336 _bad:
337 	pfr_clean_node_mask(tmpkt, &workq);
338 	pfr_destroy_kentries(&workq);
339 	if (flags & PFR_FLAG_FEEDBACK)
340 		pfr_reset_feedback(addr, size, flags);
341 	pfr_destroy_ktable(tmpkt, 0);
342 	return (rv);
343 }
344 
345 int
346 pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
347     int *ndel, int flags)
348 {
349 	struct pfr_ktable	*kt;
350 	struct pfr_kentryworkq	 workq;
351 	struct pfr_kentry	*p;
352 	struct pfr_addr		 ad;
353 	int			 i, rv, s = 0 /* XXX gcc */, xdel = 0, log = 1;
354 
355 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_FEEDBACK);
356 	if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
357 		return (EINVAL);
358 	kt = pfr_lookup_table(tbl);
359 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
360 		return (ESRCH);
361 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
362 		return (EPERM);
363 	/*
364 	 * there are two algorithms to choose from here.
365 	 * with:
366 	 *   n: number of addresses to delete
367 	 *   N: number of addresses in the table
368 	 *
369 	 * one is O(N) and is better for large 'n'
370 	 * one is O(n*LOG(N)) and is better for small 'n'
371 	 *
372 	 * following code try to decide which one is best.
373 	 */
374 	for (i = kt->pfrkt_cnt; i > 0; i >>= 1)
375 		log++;
376 	if (size > kt->pfrkt_cnt/log) {
377 		/* full table scan */
378 		pfr_mark_addrs(kt);
379 	} else {
380 		/* iterate over addresses to delete */
381 		for (i = 0; i < size; i++) {
382 			if (COPYIN(addr+i, &ad, sizeof(ad)))
383 				return (EFAULT);
384 			if (pfr_validate_addr(&ad))
385 				return (EINVAL);
386 			p = pfr_lookup_addr(kt, &ad, 1);
387 			if (p != NULL)
388 				p->pfrke_mark = 0;
389 		}
390 	}
391 	SLIST_INIT(&workq);
392 	for (i = 0; i < size; i++) {
393 		if (COPYIN(addr+i, &ad, sizeof(ad)))
394 			senderr(EFAULT);
395 		if (pfr_validate_addr(&ad))
396 			senderr(EINVAL);
397 		p = pfr_lookup_addr(kt, &ad, 1);
398 		if (flags & PFR_FLAG_FEEDBACK) {
399 			if (p == NULL)
400 				ad.pfra_fback = PFR_FB_NONE;
401 			else if (p->pfrke_not != ad.pfra_not)
402 				ad.pfra_fback = PFR_FB_CONFLICT;
403 			else if (p->pfrke_mark)
404 				ad.pfra_fback = PFR_FB_DUPLICATE;
405 			else
406 				ad.pfra_fback = PFR_FB_DELETED;
407 		}
408 		if (p != NULL && p->pfrke_not == ad.pfra_not &&
409 		    !p->pfrke_mark) {
410 			p->pfrke_mark = 1;
411 			SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
412 			xdel++;
413 		}
414 		if (flags & PFR_FLAG_FEEDBACK)
415 			if (COPYOUT(&ad, addr+i, sizeof(ad)))
416 				senderr(EFAULT);
417 	}
418 	if (!(flags & PFR_FLAG_DUMMY)) {
419 		if (flags & PFR_FLAG_ATOMIC)
420 			s = splsoftnet();
421 		pfr_remove_kentries(kt, &workq);
422 		if (flags & PFR_FLAG_ATOMIC)
423 			splx(s);
424 	}
425 	if (ndel != NULL)
426 		*ndel = xdel;
427 	return (0);
428 _bad:
429 	if (flags & PFR_FLAG_FEEDBACK)
430 		pfr_reset_feedback(addr, size, flags);
431 	return (rv);
432 }
433 
434 int
435 pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
436     int *size2, int *nadd, int *ndel, int *nchange, int flags)
437 {
438 	struct pfr_ktable	*kt, *tmpkt;
439 	struct pfr_kentryworkq	 addq, delq, changeq;
440 	struct pfr_kentry	*p, *q;
441 	struct pfr_addr		 ad;
442 	int			 i, rv, s = 0 /* XXX gcc */, xadd = 0, xdel = 0,
443 				 xchange = 0;
444 	long			 tzero = time_second;
445 
446 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_FEEDBACK);
447 	if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
448 		return (EINVAL);
449 	kt = pfr_lookup_table(tbl);
450 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
451 		return (ESRCH);
452 	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
453 		return (EPERM);
454 	tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0);
455 	if (tmpkt == NULL)
456 		return (ENOMEM);
457 	pfr_mark_addrs(kt);
458 	SLIST_INIT(&addq);
459 	SLIST_INIT(&delq);
460 	SLIST_INIT(&changeq);
461 	for (i = 0; i < size; i++) {
462 		if (COPYIN(addr+i, &ad, sizeof(ad)))
463 			senderr(EFAULT);
464 		if (pfr_validate_addr(&ad))
465 			senderr(EINVAL);
466 		ad.pfra_fback = PFR_FB_NONE;
467 		p = pfr_lookup_addr(kt, &ad, 1);
468 		if (p != NULL) {
469 			if (p->pfrke_mark) {
470 				ad.pfra_fback = PFR_FB_DUPLICATE;
471 				goto _skip;
472 			}
473 			p->pfrke_mark = 1;
474 			if (p->pfrke_not != ad.pfra_not) {
475 				SLIST_INSERT_HEAD(&changeq, p, pfrke_workq);
476 				ad.pfra_fback = PFR_FB_CHANGED;
477 				xchange++;
478 			}
479 		} else {
480 			q = pfr_lookup_addr(tmpkt, &ad, 1);
481 			if (q != NULL) {
482 				ad.pfra_fback = PFR_FB_DUPLICATE;
483 				goto _skip;
484 			}
485 			p = pfr_create_kentry(&ad, 0);
486 			if (p == NULL)
487 				senderr(ENOMEM);
488 			if (pfr_route_kentry(tmpkt, p)) {
489 				pfr_destroy_kentry(p);
490 				ad.pfra_fback = PFR_FB_NONE;
491 			} else {
492 				SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
493 				ad.pfra_fback = PFR_FB_ADDED;
494 				xadd++;
495 			}
496 		}
497 _skip:
498 		if (flags & PFR_FLAG_FEEDBACK)
499 			if (COPYOUT(&ad, addr+i, sizeof(ad)))
500 				senderr(EFAULT);
501 	}
502 	pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY);
503 	if ((flags & PFR_FLAG_FEEDBACK) && *size2) {
504 		if (*size2 < size+xdel) {
505 			*size2 = size+xdel;
506 			senderr(0);
507 		}
508 		i = 0;
509 		SLIST_FOREACH(p, &delq, pfrke_workq) {
510 			pfr_copyout_addr(&ad, p);
511 			ad.pfra_fback = PFR_FB_DELETED;
512 			if (COPYOUT(&ad, addr+size+i, sizeof(ad)))
513 				senderr(EFAULT);
514 			i++;
515 		}
516 	}
517 	pfr_clean_node_mask(tmpkt, &addq);
518 	if (!(flags & PFR_FLAG_DUMMY)) {
519 		if (flags & PFR_FLAG_ATOMIC)
520 			s = splsoftnet();
521 		pfr_insert_kentries(kt, &addq, tzero);
522 		pfr_remove_kentries(kt, &delq);
523 		pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
524 		if (flags & PFR_FLAG_ATOMIC)
525 			splx(s);
526 	} else
527 		pfr_destroy_kentries(&addq);
528 	if (nadd != NULL)
529 		*nadd = xadd;
530 	if (ndel != NULL)
531 		*ndel = xdel;
532 	if (nchange != NULL)
533 		*nchange = xchange;
534 	if ((flags & PFR_FLAG_FEEDBACK) && size2)
535 		*size2 = size+xdel;
536 	pfr_destroy_ktable(tmpkt, 0);
537 	return (0);
538 _bad:
539 	pfr_clean_node_mask(tmpkt, &addq);
540 	pfr_destroy_kentries(&addq);
541 	if (flags & PFR_FLAG_FEEDBACK)
542 		pfr_reset_feedback(addr, size, flags);
543 	pfr_destroy_ktable(tmpkt, 0);
544 	return (rv);
545 }
546 
547 int
548 pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
549 	int *nmatch, int flags)
550 {
551 	struct pfr_ktable	*kt;
552 	struct pfr_kentry	*p;
553 	struct pfr_addr		 ad;
554 	int			 i, xmatch = 0;
555 
556 	ACCEPT_FLAGS(PFR_FLAG_REPLACE);
557 	if (pfr_validate_table(tbl, 0, 0))
558 		return (EINVAL);
559 	kt = pfr_lookup_table(tbl);
560 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
561 		return (ESRCH);
562 
563 	for (i = 0; i < size; i++) {
564 		if (COPYIN(addr+i, &ad, sizeof(ad)))
565 			return (EFAULT);
566 		if (pfr_validate_addr(&ad))
567 			return (EINVAL);
568 		if (ADDR_NETWORK(&ad))
569 			return (EINVAL);
570 		p = pfr_lookup_addr(kt, &ad, 0);
571 		if (flags & PFR_FLAG_REPLACE)
572 			pfr_copyout_addr(&ad, p);
573 		ad.pfra_fback = (p == NULL) ? PFR_FB_NONE :
574 		    (p->pfrke_not ? PFR_FB_NOTMATCH : PFR_FB_MATCH);
575 		if (p != NULL && !p->pfrke_not)
576 			xmatch++;
577 		if (COPYOUT(&ad, addr+i, sizeof(ad)))
578 			return (EFAULT);
579 	}
580 	if (nmatch != NULL)
581 		*nmatch = xmatch;
582 	return (0);
583 }
584 
585 int
586 pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size,
587 	int flags)
588 {
589 	struct pfr_ktable	*kt;
590 	struct pfr_walktree	 w;
591 	int			 rv;
592 
593 	ACCEPT_FLAGS(0);
594 	if (pfr_validate_table(tbl, 0, 0))
595 		return (EINVAL);
596 	kt = pfr_lookup_table(tbl);
597 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
598 		return (ESRCH);
599 	if (kt->pfrkt_cnt > *size) {
600 		*size = kt->pfrkt_cnt;
601 		return (0);
602 	}
603 
604 	bzero(&w, sizeof(w));
605 	w.pfrw_op = PFRW_GET_ADDRS;
606 	w.pfrw_addr = addr;
607 	w.pfrw_free = kt->pfrkt_cnt;
608 	w.pfrw_flags = flags;
609 	rv = rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
610 	if (!rv)
611 		rv = rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
612 	if (rv)
613 		return (rv);
614 
615 	if (w.pfrw_free) {
616 		printf("pfr_get_addrs: corruption detected (%d).\n",
617 		    w.pfrw_free);
618 		return (ENOTTY);
619 	}
620 	*size = kt->pfrkt_cnt;
621 	return (0);
622 }
623 
624 int
625 pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size,
626 	int flags)
627 {
628 	struct pfr_ktable	*kt;
629 	struct pfr_walktree	 w;
630 	struct pfr_kentryworkq	 workq;
631 	int			 rv, s = 0 /* XXX gcc */;
632 	long			 tzero = time_second;
633 
634 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC); /* XXX PFR_FLAG_CLSTATS disabled */
635 	if (pfr_validate_table(tbl, 0, 0))
636 		return (EINVAL);
637 	kt = pfr_lookup_table(tbl);
638 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
639 		return (ESRCH);
640 	if (kt->pfrkt_cnt > *size) {
641 		*size = kt->pfrkt_cnt;
642 		return (0);
643 	}
644 
645 	bzero(&w, sizeof(w));
646 	w.pfrw_op = PFRW_GET_ASTATS;
647 	w.pfrw_astats = addr;
648 	w.pfrw_free = kt->pfrkt_cnt;
649 	w.pfrw_flags = flags;
650 	if (flags & PFR_FLAG_ATOMIC)
651 		s = splsoftnet();
652 	rv = rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
653 	if (!rv)
654 		rv = rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
655 	if (!rv && (flags & PFR_FLAG_CLSTATS)) {
656 		pfr_enqueue_addrs(kt, &workq, NULL, 0);
657 		pfr_clstats_kentries(&workq, tzero, 0);
658 	}
659 	if (flags & PFR_FLAG_ATOMIC)
660 		splx(s);
661 	if (rv)
662 		return (rv);
663 
664 	if (w.pfrw_free) {
665 		printf("pfr_get_astats: corruption detected (%d).\n",
666 		    w.pfrw_free);
667 		return (ENOTTY);
668 	}
669 	*size = kt->pfrkt_cnt;
670 	return (0);
671 }
672 
673 int
674 pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size,
675     int *nzero, int flags)
676 {
677 	struct pfr_ktable	*kt;
678 	struct pfr_kentryworkq	 workq;
679 	struct pfr_kentry	*p;
680 	struct pfr_addr		 ad;
681 	int			 i, rv, s = 0, xzero = 0;
682 
683 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_FEEDBACK);
684 	if (pfr_validate_table(tbl, 0, 0))
685 		return (EINVAL);
686 	kt = pfr_lookup_table(tbl);
687 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
688 		return (ESRCH);
689 	SLIST_INIT(&workq);
690 	for (i = 0; i < size; i++) {
691 		if (COPYIN(addr+i, &ad, sizeof(ad)))
692 			senderr(EFAULT);
693 		if (pfr_validate_addr(&ad))
694 			senderr(EINVAL);
695 		p = pfr_lookup_addr(kt, &ad, 1);
696 		if (flags & PFR_FLAG_FEEDBACK) {
697 			ad.pfra_fback = (p != NULL) ?
698 			    PFR_FB_CLEARED : PFR_FB_NONE;
699 			if (COPYOUT(&ad, addr+i, sizeof(ad)))
700 				senderr(EFAULT);
701 		}
702 		if (p != NULL) {
703 			SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
704 			xzero++;
705 		}
706 	}
707 
708 	if (!(flags & PFR_FLAG_DUMMY)) {
709 		if (flags & PFR_FLAG_ATOMIC)
710 			s = splsoftnet();
711 		pfr_clstats_kentries(&workq, 0, 0);
712 		if (flags & PFR_FLAG_ATOMIC)
713 			splx(s);
714 	}
715 	if (nzero != NULL)
716 		*nzero = xzero;
717 	return (0);
718 _bad:
719 	if (flags & PFR_FLAG_FEEDBACK)
720 		pfr_reset_feedback(addr, size, flags);
721 	return (rv);
722 }
723 
724 int
725 pfr_validate_addr(struct pfr_addr *ad)
726 {
727 	int i;
728 
729 	switch (ad->pfra_af) {
730 #ifdef INET
731 	case AF_INET:
732 		if (ad->pfra_net > 32)
733 			return (-1);
734 		break;
735 #endif /* INET */
736 #ifdef INET6
737 	case AF_INET6:
738 		if (ad->pfra_net > 128)
739 			return (-1);
740 		break;
741 #endif /* INET6 */
742 	default:
743 		return (-1);
744 	}
745 	if (ad->pfra_net < 128 &&
746 		(((char *)ad)[ad->pfra_net/8] & (0xFF >> (ad->pfra_net%8))))
747 			return (-1);
748 	for (i = (ad->pfra_net+7)/8; i < sizeof(ad->pfra_u); i++)
749 		if (((char *)ad)[i])
750 			return (-1);
751 	if (ad->pfra_not && ad->pfra_not != 1)
752 		return (-1);
753 	if (ad->pfra_fback)
754 		return (-1);
755 	return (0);
756 }
757 
758 void
759 pfr_enqueue_addrs(struct pfr_ktable *kt, struct pfr_kentryworkq *workq,
760 	int *naddr, int sweep)
761 {
762 	struct pfr_walktree	w;
763 
764 	SLIST_INIT(workq);
765 	bzero(&w, sizeof(w));
766 	w.pfrw_op = sweep ? PFRW_SWEEP : PFRW_ENQUEUE;
767 	w.pfrw_workq = workq;
768 	if (kt->pfrkt_ip4 != NULL)
769 		if (rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w))
770 			printf("pfr_enqueue_addrs: IPv4 walktree failed.\n");
771 	if (kt->pfrkt_ip6 != NULL)
772 		if (rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w))
773 			printf("pfr_enqueue_addrs: IPv6 walktree failed.\n");
774 	if (naddr != NULL)
775 		*naddr = w.pfrw_cnt;
776 }
777 
778 void
779 pfr_mark_addrs(struct pfr_ktable *kt)
780 {
781 	struct pfr_walktree	w;
782 
783 	bzero(&w, sizeof(w));
784 	w.pfrw_op = PFRW_MARK;
785 	if (rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w))
786 		printf("pfr_mark_addrs: IPv4 walktree failed.\n");
787 	if (rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w))
788 		printf("pfr_mark_addrs: IPv6 walktree failed.\n");
789 }
790 
791 
792 struct pfr_kentry *
793 pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact)
794 {
795 	union sockaddr_union	 sa, mask;
796 	struct radix_node_head	*head = (void *)0xdeadb;
797 	struct pfr_kentry	*ke;
798 	int			 s;
799 
800 	bzero(&sa, sizeof(sa));
801 	if (ad->pfra_af == AF_INET) {
802 		FILLIN_SIN(sa.sin, ad->pfra_ip4addr);
803 		head = kt->pfrkt_ip4;
804 	} else if ( ad->pfra_af == AF_INET6 ) {
805 		FILLIN_SIN6(sa.sin6, ad->pfra_ip6addr);
806 		head = kt->pfrkt_ip6;
807 	}
808 	if (ADDR_NETWORK(ad)) {
809 		pfr_prepare_network(&mask, ad->pfra_af, ad->pfra_net);
810 		s = splsoftnet(); /* rn_lookup makes use of globals */
811 		ke = (struct pfr_kentry *)rn_lookup(&sa, &mask, head);
812 		splx(s);
813 		if (ke && KENTRY_RNF_ROOT(ke))
814 			ke = NULL;
815 	} else {
816 		ke = (struct pfr_kentry *)rn_match(&sa, head);
817 		if (ke && KENTRY_RNF_ROOT(ke))
818 			ke = NULL;
819 		if (exact && ke && KENTRY_NETWORK(ke))
820 			ke = NULL;
821 	}
822 	return (ke);
823 }
824 
825 struct pfr_kentry *
826 pfr_create_kentry(struct pfr_addr *ad, int intr)
827 {
828 	struct pfr_kentry	*ke;
829 
830 	if (intr)
831 		ke = pool_get(&pfr_kentry_pl2, PR_NOWAIT);
832 	else
833 		ke = pool_get(&pfr_kentry_pl, PR_NOWAIT);
834 	if (ke == NULL)
835 		return (NULL);
836 	bzero(ke, sizeof(*ke));
837 
838 	if (ad->pfra_af == AF_INET)
839 		FILLIN_SIN(ke->pfrke_sa.sin, ad->pfra_ip4addr);
840 	else if (ad->pfra_af == AF_INET6)
841 		FILLIN_SIN6(ke->pfrke_sa.sin6, ad->pfra_ip6addr);
842 	ke->pfrke_af = ad->pfra_af;
843 	ke->pfrke_net = ad->pfra_net;
844 	ke->pfrke_not = ad->pfra_not;
845 	ke->pfrke_intrpool = intr;
846 	return (ke);
847 }
848 
849 void
850 pfr_destroy_kentries(struct pfr_kentryworkq *workq)
851 {
852 	struct pfr_kentry	*p, *q;
853 
854 	for (p = SLIST_FIRST(workq); p != NULL; p = q) {
855 		q = SLIST_NEXT(p, pfrke_workq);
856 		pfr_destroy_kentry(p);
857 	}
858 }
859 
860 void
861 pfr_destroy_kentry(struct pfr_kentry *ke)
862 {
863 	if (ke->pfrke_intrpool)
864 		pool_put(&pfr_kentry_pl2, ke);
865 	else
866 		pool_put(&pfr_kentry_pl, ke);
867 }
868 
869 void
870 pfr_insert_kentries(struct pfr_ktable *kt,
871     struct pfr_kentryworkq *workq, long tzero)
872 {
873 	struct pfr_kentry	*p;
874 	int			 rv, n = 0;
875 
876 	SLIST_FOREACH(p, workq, pfrke_workq) {
877 		rv = pfr_route_kentry(kt, p);
878 		if (rv) {
879 			printf("pfr_insert_kentries: cannot route entry "
880 			    "(code=%d).\n", rv);
881 			break;
882 		}
883 		p->pfrke_tzero = tzero;
884 		n++;
885 	}
886 	kt->pfrkt_cnt += n;
887 }
888 
889 int
890 pfr_insert_kentry(struct pfr_ktable *kt, struct pfr_addr *ad, long tzero)
891 {
892 	struct pfr_kentry	*p;
893 	int			 rv;
894 
895 	p = pfr_lookup_addr(kt, ad, 1);
896 	if (p != NULL)
897 		return (0);
898 	p = pfr_create_kentry(ad, 1);
899 	if (p == NULL)
900 		return (EINVAL);
901 
902 	rv = pfr_route_kentry(kt, p);
903 	if (rv)
904 		return (rv);
905 
906 	p->pfrke_tzero = tzero;
907 	kt->pfrkt_cnt++;
908 
909 	return (0);
910 }
911 
912 void
913 pfr_remove_kentries(struct pfr_ktable *kt,
914     struct pfr_kentryworkq *workq)
915 {
916 	struct pfr_kentry	*p;
917 	int			 n = 0;
918 
919 	SLIST_FOREACH(p, workq, pfrke_workq) {
920 		pfr_unroute_kentry(kt, p);
921 		n++;
922 	}
923 	kt->pfrkt_cnt -= n;
924 	pfr_destroy_kentries(workq);
925 }
926 
927 void
928 pfr_clean_node_mask(struct pfr_ktable *kt,
929     struct pfr_kentryworkq *workq)
930 {
931 	struct pfr_kentry	*p;
932 
933 	SLIST_FOREACH(p, workq, pfrke_workq)
934 		pfr_unroute_kentry(kt, p);
935 }
936 
937 void
938 pfr_clstats_kentries(struct pfr_kentryworkq *workq, long tzero, int negchange)
939 {
940 	struct pfr_kentry	*p;
941 	int			 s;
942 
943 	SLIST_FOREACH(p, workq, pfrke_workq) {
944 		s = splsoftnet();
945 		if (negchange)
946 			p->pfrke_not = !p->pfrke_not;
947 		bzero(p->pfrke_packets, sizeof(p->pfrke_packets));
948 		bzero(p->pfrke_bytes, sizeof(p->pfrke_bytes));
949 		splx(s);
950 		p->pfrke_tzero = tzero;
951 	}
952 }
953 
954 void
955 pfr_reset_feedback(struct pfr_addr *addr, int size, int flags)
956 {
957 	struct pfr_addr	ad;
958 	int		i;
959 
960 	for (i = 0; i < size; i++) {
961 		if (COPYIN(addr+i, &ad, sizeof(ad)))
962 			break;
963 		ad.pfra_fback = PFR_FB_NONE;
964 		if (COPYOUT(&ad, addr+i, sizeof(ad)))
965 			break;
966 	}
967 }
968 
969 void
970 pfr_prepare_network(union sockaddr_union *sa, int af, int net)
971 {
972 	int	i;
973 
974 	bzero(sa, sizeof(*sa));
975 	if (af == AF_INET) {
976 		sa->sin.sin_len = sizeof(sa->sin);
977 		sa->sin.sin_family = AF_INET;
978 		sa->sin.sin_addr.s_addr = net ? htonl(-1 << (32-net)) : 0;
979 	} else if (af == AF_INET6) {
980 		sa->sin6.sin6_len = sizeof(sa->sin6);
981 		sa->sin6.sin6_family = AF_INET6;
982 		for (i = 0; i < 4; i++) {
983 			if (net <= 32) {
984 				sa->sin6.sin6_addr.s6_addr32[i] =
985 				    net ? htonl(-1 << (32-net)) : 0;
986 				break;
987 			}
988 			sa->sin6.sin6_addr.s6_addr32[i] = 0xFFFFFFFF;
989 			net -= 32;
990 		}
991 	}
992 }
993 
994 int
995 pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
996 {
997 	union sockaddr_union	 mask;
998 	struct radix_node	*rn;
999 	struct radix_node_head	*head = (void *)0xdeadb;
1000 	int			 s;
1001 
1002 	bzero(ke->pfrke_node, sizeof(ke->pfrke_node));
1003 	if (ke->pfrke_af == AF_INET)
1004 		head = kt->pfrkt_ip4;
1005 	else if (ke->pfrke_af == AF_INET6)
1006 		head = kt->pfrkt_ip6;
1007 
1008 	s = splsoftnet();
1009 	if (KENTRY_NETWORK(ke)) {
1010 		pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
1011 		rn = rn_addroute(&ke->pfrke_sa, &mask, head, ke->pfrke_node);
1012 	} else
1013 		rn = rn_addroute(&ke->pfrke_sa, NULL, head, ke->pfrke_node);
1014 	splx(s);
1015 
1016 	return (rn == NULL ? -1 : 0);
1017 }
1018 
1019 int
1020 pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
1021 {
1022 	union sockaddr_union	 mask;
1023 	struct radix_node	*rn;
1024 	struct radix_node_head	*head = (void *)0xdeadb;
1025 	int			 s;
1026 
1027 	if (ke->pfrke_af == AF_INET)
1028 		head = kt->pfrkt_ip4;
1029 	else if (ke->pfrke_af == AF_INET6)
1030 		head = kt->pfrkt_ip6;
1031 
1032 	s = splsoftnet();
1033 	if (KENTRY_NETWORK(ke)) {
1034 		pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
1035 		rn = rn_delete(&ke->pfrke_sa, &mask, head);
1036 	} else
1037 		rn = rn_delete(&ke->pfrke_sa, NULL, head);
1038 	splx(s);
1039 
1040 	if (rn == NULL) {
1041 		printf("pfr_unroute_kentry: delete failed.\n");
1042 		return (-1);
1043 	}
1044 	return (0);
1045 }
1046 
1047 void
1048 pfr_copyout_addr(struct pfr_addr *ad, struct pfr_kentry *ke)
1049 {
1050 	bzero(ad, sizeof(*ad));
1051 	if (ke == NULL)
1052 		return;
1053 	ad->pfra_af = ke->pfrke_af;
1054 	ad->pfra_net = ke->pfrke_net;
1055 	ad->pfra_not = ke->pfrke_not;
1056 	if (ad->pfra_af == AF_INET)
1057 		ad->pfra_ip4addr = ke->pfrke_sa.sin.sin_addr;
1058 	else if (ad->pfra_af == AF_INET6)
1059 		ad->pfra_ip6addr = ke->pfrke_sa.sin6.sin6_addr;
1060 }
1061 
1062 int
1063 pfr_walktree(struct radix_node *rn, void *arg)
1064 {
1065 	struct pfr_kentry	*ke = (struct pfr_kentry *)rn;
1066 	struct pfr_walktree	*w = arg;
1067 	int			 s, flags = w->pfrw_flags;
1068 
1069 	switch (w->pfrw_op) {
1070 	case PFRW_MARK:
1071 		ke->pfrke_mark = 0;
1072 		break;
1073 	case PFRW_SWEEP:
1074 		if (ke->pfrke_mark)
1075 			break;
1076 		/* FALLTHROUGH */
1077 	case PFRW_ENQUEUE:
1078 		SLIST_INSERT_HEAD(w->pfrw_workq, ke, pfrke_workq);
1079 		w->pfrw_cnt++;
1080 		break;
1081 	case PFRW_GET_ADDRS:
1082 		if (w->pfrw_free-- > 0) {
1083 			struct pfr_addr ad;
1084 
1085 			pfr_copyout_addr(&ad, ke);
1086 			if (copyout(&ad, w->pfrw_addr, sizeof(ad)))
1087 				return (EFAULT);
1088 			w->pfrw_addr++;
1089 		}
1090 		break;
1091 	case PFRW_GET_ASTATS:
1092 		if (w->pfrw_free-- > 0) {
1093 			struct pfr_astats as;
1094 
1095 			pfr_copyout_addr(&as.pfras_a, ke);
1096 
1097 			s = splsoftnet();
1098 			bcopy(ke->pfrke_packets, as.pfras_packets,
1099 			    sizeof(as.pfras_packets));
1100 			bcopy(ke->pfrke_bytes, as.pfras_bytes,
1101 			    sizeof(as.pfras_bytes));
1102 			splx(s);
1103 			as.pfras_tzero = ke->pfrke_tzero;
1104 
1105 			if (COPYOUT(&as, w->pfrw_astats, sizeof(as)))
1106 				return (EFAULT);
1107 			w->pfrw_astats++;
1108 		}
1109 		break;
1110 	case PFRW_POOL_GET:
1111 		if (ke->pfrke_not)
1112 			break; /* negative entries are ignored */
1113 		if (!w->pfrw_cnt--) {
1114 			w->pfrw_kentry = ke;
1115 			return (1); /* finish search */
1116 		}
1117 		break;
1118 	case PFRW_DYNADDR_UPDATE:
1119 		if (ke->pfrke_af == AF_INET) {
1120 			if (w->pfrw_dyn->pfid_acnt4++ > 0)
1121 				break;
1122 			pfr_prepare_network(&pfr_mask, AF_INET, ke->pfrke_net);
1123 			w->pfrw_dyn->pfid_addr4 = *SUNION2PF(
1124 			    &ke->pfrke_sa, AF_INET);
1125 			w->pfrw_dyn->pfid_mask4 = *SUNION2PF(
1126 			    &pfr_mask, AF_INET);
1127 		} else if (ke->pfrke_af == AF_INET6){
1128 			if (w->pfrw_dyn->pfid_acnt6++ > 0)
1129 				break;
1130 			pfr_prepare_network(&pfr_mask, AF_INET6, ke->pfrke_net);
1131 			w->pfrw_dyn->pfid_addr6 = *SUNION2PF(
1132 			    &ke->pfrke_sa, AF_INET6);
1133 			w->pfrw_dyn->pfid_mask6 = *SUNION2PF(
1134 			    &pfr_mask, AF_INET6);
1135 		}
1136 		break;
1137 	}
1138 	return (0);
1139 }
1140 
1141 int
1142 pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags)
1143 {
1144 	struct pfr_ktableworkq	 workq;
1145 	struct pfr_ktable	*p;
1146 	int			 s = 0, xdel = 0;
1147 
1148 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_ALLRSETS);
1149 	if (pfr_fix_anchor(filter->pfrt_anchor))
1150 		return (EINVAL);
1151 	if (pfr_table_count(filter, flags) < 0)
1152 		return (ENOENT);
1153 
1154 	SLIST_INIT(&workq);
1155 	RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1156 		if (pfr_skip_table(filter, p, flags))
1157 			continue;
1158 		if (!strcmp(p->pfrkt_anchor, PF_RESERVED_ANCHOR))
1159 			continue;
1160 		if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE))
1161 			continue;
1162 		p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1163 		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1164 		xdel++;
1165 	}
1166 	if (!(flags & PFR_FLAG_DUMMY)) {
1167 		if (flags & PFR_FLAG_ATOMIC)
1168 			s = splsoftnet();
1169 		pfr_setflags_ktables(&workq);
1170 		if (flags & PFR_FLAG_ATOMIC)
1171 			splx(s);
1172 	}
1173 	if (ndel != NULL)
1174 		*ndel = xdel;
1175 	return (0);
1176 }
1177 
1178 int
1179 pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags)
1180 {
1181 	struct pfr_ktableworkq	 addq, changeq;
1182 	struct pfr_ktable	*p, *q, *r, key;
1183 	int			 i, rv, s = 0 /* XXX gcc */, xadd = 0;
1184 	long			 tzero = time_second;
1185 
1186 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY);
1187 	SLIST_INIT(&addq);
1188 	SLIST_INIT(&changeq);
1189 	for (i = 0; i < size; i++) {
1190 		if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t)))
1191 			senderr(EFAULT);
1192 		if (pfr_validate_table(&key.pfrkt_t, PFR_TFLAG_USRMASK,
1193 		    flags & PFR_FLAG_USERIOCTL))
1194 			senderr(EINVAL);
1195 		key.pfrkt_flags |= PFR_TFLAG_ACTIVE;
1196 		p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1197 		if (p == NULL) {
1198 			p = pfr_create_ktable(&key.pfrkt_t, tzero, 1);
1199 			if (p == NULL)
1200 				senderr(ENOMEM);
1201 			SLIST_FOREACH(q, &addq, pfrkt_workq) {
1202 				if (!pfr_ktable_compare(p, q))
1203 					goto _skip;
1204 			}
1205 			SLIST_INSERT_HEAD(&addq, p, pfrkt_workq);
1206 			xadd++;
1207 			if (!key.pfrkt_anchor[0])
1208 				goto _skip;
1209 
1210 			/* find or create root table */
1211 			bzero(key.pfrkt_anchor, sizeof(key.pfrkt_anchor));
1212 			r = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1213 			if (r != NULL) {
1214 				p->pfrkt_root = r;
1215 				goto _skip;
1216 			}
1217 			SLIST_FOREACH(q, &addq, pfrkt_workq) {
1218 				if (!pfr_ktable_compare(&key, q)) {
1219 					p->pfrkt_root = q;
1220 					goto _skip;
1221 				}
1222 			}
1223 			key.pfrkt_flags = 0;
1224 			r = pfr_create_ktable(&key.pfrkt_t, 0, 1);
1225 			if (r == NULL)
1226 				senderr(ENOMEM);
1227 			SLIST_INSERT_HEAD(&addq, r, pfrkt_workq);
1228 			p->pfrkt_root = r;
1229 		} else if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1230 			SLIST_FOREACH(q, &changeq, pfrkt_workq)
1231 				if (!pfr_ktable_compare(&key, q))
1232 					goto _skip;
1233 			p->pfrkt_nflags = (p->pfrkt_flags &
1234 			    ~PFR_TFLAG_USRMASK) | key.pfrkt_flags;
1235 			SLIST_INSERT_HEAD(&changeq, p, pfrkt_workq);
1236 			xadd++;
1237 		}
1238 _skip:
1239 	;
1240 	}
1241 	if (!(flags & PFR_FLAG_DUMMY)) {
1242 		if (flags & PFR_FLAG_ATOMIC)
1243 			s = splsoftnet();
1244 		pfr_insert_ktables(&addq);
1245 		pfr_setflags_ktables(&changeq);
1246 		if (flags & PFR_FLAG_ATOMIC)
1247 			splx(s);
1248 	} else
1249 		 pfr_destroy_ktables(&addq, 0);
1250 	if (nadd != NULL)
1251 		*nadd = xadd;
1252 	return (0);
1253 _bad:
1254 	pfr_destroy_ktables(&addq, 0);
1255 	return (rv);
1256 }
1257 
1258 int
1259 pfr_del_tables(struct pfr_table *tbl, int size, int *ndel, int flags)
1260 {
1261 	struct pfr_ktableworkq	 workq;
1262 	struct pfr_ktable	*p, *q, key;
1263 	int			 i, s = 0, xdel = 0;
1264 
1265 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY);
1266 	SLIST_INIT(&workq);
1267 	for (i = 0; i < size; i++) {
1268 		if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t)))
1269 			return (EFAULT);
1270 		if (pfr_validate_table(&key.pfrkt_t, 0,
1271 		    flags & PFR_FLAG_USERIOCTL))
1272 			return (EINVAL);
1273 		p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1274 		if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1275 			SLIST_FOREACH(q, &workq, pfrkt_workq)
1276 				if (!pfr_ktable_compare(p, q))
1277 					goto _skip;
1278 			p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1279 			SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1280 			xdel++;
1281 		}
1282 _skip:
1283 	;
1284 	}
1285 
1286 	if (!(flags & PFR_FLAG_DUMMY)) {
1287 		if (flags & PFR_FLAG_ATOMIC)
1288 			s = splsoftnet();
1289 		pfr_setflags_ktables(&workq);
1290 		if (flags & PFR_FLAG_ATOMIC)
1291 			splx(s);
1292 	}
1293 	if (ndel != NULL)
1294 		*ndel = xdel;
1295 	return (0);
1296 }
1297 
1298 int
1299 pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size,
1300 	int flags)
1301 {
1302 	struct pfr_ktable	*p;
1303 	int			 n, nn;
1304 
1305 	ACCEPT_FLAGS(PFR_FLAG_ALLRSETS);
1306 	if (pfr_fix_anchor(filter->pfrt_anchor))
1307 		return (EINVAL);
1308 	n = nn = pfr_table_count(filter, flags);
1309 	if (n < 0)
1310 		return (ENOENT);
1311 	if (n > *size) {
1312 		*size = n;
1313 		return (0);
1314 	}
1315 	RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1316 		if (pfr_skip_table(filter, p, flags))
1317 			continue;
1318 		if (n-- <= 0)
1319 			continue;
1320 		if (COPYOUT(&p->pfrkt_t, tbl++, sizeof(*tbl)))
1321 			return (EFAULT);
1322 	}
1323 	if (n) {
1324 		printf("pfr_get_tables: corruption detected (%d).\n", n);
1325 		return (ENOTTY);
1326 	}
1327 	*size = nn;
1328 	return (0);
1329 }
1330 
1331 int
1332 pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size,
1333 	int flags)
1334 {
1335 	struct pfr_ktable	*p;
1336 	struct pfr_ktableworkq	 workq;
1337 	int			 s = 0 /* XXX gcc */, n, nn;
1338 	long			 tzero = time_second;
1339 
1340 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC|PFR_FLAG_ALLRSETS);
1341 					/* XXX PFR_FLAG_CLSTATS disabled */
1342 	if (pfr_fix_anchor(filter->pfrt_anchor))
1343 		return (EINVAL);
1344 	n = nn = pfr_table_count(filter, flags);
1345 	if (n < 0)
1346 		return (ENOENT);
1347 	if (n > *size) {
1348 		*size = n;
1349 		return (0);
1350 	}
1351 	SLIST_INIT(&workq);
1352 	if (flags & PFR_FLAG_ATOMIC)
1353 		s = splsoftnet();
1354 	RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1355 		if (pfr_skip_table(filter, p, flags))
1356 			continue;
1357 		if (n-- <= 0)
1358 			continue;
1359 		if (!(flags & PFR_FLAG_ATOMIC))
1360 			s = splsoftnet();
1361 		if (COPYOUT(&p->pfrkt_ts, tbl++, sizeof(*tbl))) {
1362 			splx(s);
1363 			return (EFAULT);
1364 		}
1365 		if (!(flags & PFR_FLAG_ATOMIC))
1366 			splx(s);
1367 		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1368 	}
1369 	if (flags & PFR_FLAG_CLSTATS)
1370 		pfr_clstats_ktables(&workq, tzero,
1371 		    flags & PFR_FLAG_ADDRSTOO);
1372 	if (flags & PFR_FLAG_ATOMIC)
1373 		splx(s);
1374 	if (n) {
1375 		printf("pfr_get_tstats: corruption detected (%d).\n", n);
1376 		return (ENOTTY);
1377 	}
1378 	*size = nn;
1379 	return (0);
1380 }
1381 
1382 int
1383 pfr_clr_tstats(struct pfr_table *tbl, int size, int *nzero, int flags)
1384 {
1385 	struct pfr_ktableworkq	 workq;
1386 	struct pfr_ktable	*p, key;
1387 	int			 i, s = 0 /* XXX gcc */, xzero = 0;
1388 	long			 tzero = time_second;
1389 
1390 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY+PFR_FLAG_ADDRSTOO);
1391 	SLIST_INIT(&workq);
1392 	for (i = 0; i < size; i++) {
1393 		if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t)))
1394 			return (EFAULT);
1395 		if (pfr_validate_table(&key.pfrkt_t, 0, 0))
1396 			return (EINVAL);
1397 		p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1398 		if (p != NULL) {
1399 			SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1400 			xzero++;
1401 		}
1402 	}
1403 	if (!(flags & PFR_FLAG_DUMMY)) {
1404 		if (flags & PFR_FLAG_ATOMIC)
1405 			s = splsoftnet();
1406 		pfr_clstats_ktables(&workq, tzero, flags & PFR_FLAG_ADDRSTOO);
1407 		if (flags & PFR_FLAG_ATOMIC)
1408 			splx(s);
1409 	}
1410 	if (nzero != NULL)
1411 		*nzero = xzero;
1412 	return (0);
1413 }
1414 
1415 int
1416 pfr_set_tflags(struct pfr_table *tbl, int size, int setflag, int clrflag,
1417 	int *nchange, int *ndel, int flags)
1418 {
1419 	struct pfr_ktableworkq	 workq;
1420 	struct pfr_ktable	*p, *q, key;
1421 	int			 i, s = 0, xchange = 0, xdel = 0;
1422 
1423 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY);
1424 	if ((setflag & ~PFR_TFLAG_USRMASK) ||
1425 	    (clrflag & ~PFR_TFLAG_USRMASK) ||
1426 	    (setflag & clrflag))
1427 		return (EINVAL);
1428 	SLIST_INIT(&workq);
1429 	for (i = 0; i < size; i++) {
1430 		if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t)))
1431 			return (EFAULT);
1432 		if (pfr_validate_table(&key.pfrkt_t, 0,
1433 		    flags & PFR_FLAG_USERIOCTL))
1434 			return (EINVAL);
1435 		p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1436 		if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1437 			p->pfrkt_nflags = (p->pfrkt_flags | setflag) &
1438 			    ~clrflag;
1439 			if (p->pfrkt_nflags == p->pfrkt_flags)
1440 				goto _skip;
1441 			SLIST_FOREACH(q, &workq, pfrkt_workq)
1442 				if (!pfr_ktable_compare(p, q))
1443 					goto _skip;
1444 			SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1445 			if ((p->pfrkt_flags & PFR_TFLAG_PERSIST) &&
1446 			    (clrflag & PFR_TFLAG_PERSIST) &&
1447 			    !(p->pfrkt_flags & PFR_TFLAG_REFERENCED))
1448 				xdel++;
1449 			else
1450 				xchange++;
1451 		}
1452 _skip:
1453 	;
1454 	}
1455 	if (!(flags & PFR_FLAG_DUMMY)) {
1456 		if (flags & PFR_FLAG_ATOMIC)
1457 			s = splsoftnet();
1458 		pfr_setflags_ktables(&workq);
1459 		if (flags & PFR_FLAG_ATOMIC)
1460 			splx(s);
1461 	}
1462 	if (nchange != NULL)
1463 		*nchange = xchange;
1464 	if (ndel != NULL)
1465 		*ndel = xdel;
1466 	return (0);
1467 }
1468 
1469 int
1470 pfr_ina_begin(struct pfr_table *trs, u_int32_t *ticket, int *ndel, int flags)
1471 {
1472 	struct pfr_ktableworkq	 workq;
1473 	struct pfr_ktable	*p;
1474 	struct pf_ruleset	*rs;
1475 	int			 xdel = 0;
1476 
1477 	ACCEPT_FLAGS(PFR_FLAG_DUMMY);
1478 	rs = pf_find_or_create_ruleset(trs->pfrt_anchor);
1479 	if (rs == NULL)
1480 		return (ENOMEM);
1481 	SLIST_INIT(&workq);
1482 	RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1483 		if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1484 		    pfr_skip_table(trs, p, 0))
1485 			continue;
1486 		p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1487 		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1488 		xdel++;
1489 	}
1490 	if (!(flags & PFR_FLAG_DUMMY)) {
1491 		pfr_setflags_ktables(&workq);
1492 		if (ticket != NULL)
1493 			*ticket = ++rs->tticket;
1494 		rs->topen = 1;
1495 	} else
1496 		pf_remove_if_empty_ruleset(rs);
1497 	if (ndel != NULL)
1498 		*ndel = xdel;
1499 	return (0);
1500 }
1501 
1502 int
1503 pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size,
1504     int *nadd, int *naddr, u_int32_t ticket, int flags)
1505 {
1506 	struct pfr_ktableworkq	 tableq;
1507 	struct pfr_kentryworkq	 addrq;
1508 	struct pfr_ktable	*kt, *rt, *shadow, key;
1509 	struct pfr_kentry	*p;
1510 	struct pfr_addr		 ad;
1511 	struct pf_ruleset	*rs;
1512 	int			 i, rv, xadd = 0, xaddr = 0;
1513 
1514 	ACCEPT_FLAGS(PFR_FLAG_DUMMY|PFR_FLAG_ADDRSTOO);
1515 	if (size && !(flags & PFR_FLAG_ADDRSTOO))
1516 		return (EINVAL);
1517 	if (pfr_validate_table(tbl, PFR_TFLAG_USRMASK,
1518 	    flags & PFR_FLAG_USERIOCTL))
1519 		return (EINVAL);
1520 	rs = pf_find_ruleset(tbl->pfrt_anchor);
1521 	if (rs == NULL || !rs->topen || ticket != rs->tticket)
1522 		return (EBUSY);
1523 	tbl->pfrt_flags |= PFR_TFLAG_INACTIVE;
1524 	SLIST_INIT(&tableq);
1525 	kt = RB_FIND(pfr_ktablehead, &pfr_ktables, (struct pfr_ktable *)tbl);
1526 	if (kt == NULL) {
1527 		kt = pfr_create_ktable(tbl, 0, 1);
1528 		if (kt == NULL)
1529 			return (ENOMEM);
1530 		SLIST_INSERT_HEAD(&tableq, kt, pfrkt_workq);
1531 		xadd++;
1532 		if (!tbl->pfrt_anchor[0])
1533 			goto _skip;
1534 
1535 		/* find or create root table */
1536 		bzero(&key, sizeof(key));
1537 		strlcpy(key.pfrkt_name, tbl->pfrt_name, sizeof(key.pfrkt_name));
1538 		rt = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1539 		if (rt != NULL) {
1540 			kt->pfrkt_root = rt;
1541 			goto _skip;
1542 		}
1543 		rt = pfr_create_ktable(&key.pfrkt_t, 0, 1);
1544 		if (rt == NULL) {
1545 			pfr_destroy_ktables(&tableq, 0);
1546 			return (ENOMEM);
1547 		}
1548 		SLIST_INSERT_HEAD(&tableq, rt, pfrkt_workq);
1549 		kt->pfrkt_root = rt;
1550 	} else if (!(kt->pfrkt_flags & PFR_TFLAG_INACTIVE))
1551 		xadd++;
1552 _skip:
1553 	shadow = pfr_create_ktable(tbl, 0, 0);
1554 	if (shadow == NULL) {
1555 		pfr_destroy_ktables(&tableq, 0);
1556 		return (ENOMEM);
1557 	}
1558 	SLIST_INIT(&addrq);
1559 	for (i = 0; i < size; i++) {
1560 		if (COPYIN(addr+i, &ad, sizeof(ad)))
1561 			senderr(EFAULT);
1562 		if (pfr_validate_addr(&ad))
1563 			senderr(EINVAL);
1564 		if (pfr_lookup_addr(shadow, &ad, 1) != NULL)
1565 			continue;
1566 		p = pfr_create_kentry(&ad, 0);
1567 		if (p == NULL)
1568 			senderr(ENOMEM);
1569 		if (pfr_route_kentry(shadow, p)) {
1570 			pfr_destroy_kentry(p);
1571 			continue;
1572 		}
1573 		SLIST_INSERT_HEAD(&addrq, p, pfrke_workq);
1574 		xaddr++;
1575 	}
1576 	if (!(flags & PFR_FLAG_DUMMY)) {
1577 		if (kt->pfrkt_shadow != NULL)
1578 			pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1579 		kt->pfrkt_flags |= PFR_TFLAG_INACTIVE;
1580 		pfr_insert_ktables(&tableq);
1581 		shadow->pfrkt_cnt = (flags & PFR_FLAG_ADDRSTOO) ?
1582 		    xaddr : NO_ADDRESSES;
1583 		kt->pfrkt_shadow = shadow;
1584 	} else {
1585 		pfr_clean_node_mask(shadow, &addrq);
1586 		pfr_destroy_ktable(shadow, 0);
1587 		pfr_destroy_ktables(&tableq, 0);
1588 		pfr_destroy_kentries(&addrq);
1589 	}
1590 	if (nadd != NULL)
1591 		*nadd = xadd;
1592 	if (naddr != NULL)
1593 		*naddr = xaddr;
1594 	return (0);
1595 _bad:
1596 	pfr_destroy_ktable(shadow, 0);
1597 	pfr_destroy_ktables(&tableq, 0);
1598 	pfr_destroy_kentries(&addrq);
1599 	return (rv);
1600 }
1601 
1602 int
1603 pfr_ina_rollback(struct pfr_table *trs, u_int32_t ticket, int *ndel, int flags)
1604 {
1605 	struct pfr_ktableworkq	 workq;
1606 	struct pfr_ktable	*p;
1607 	struct pf_ruleset	*rs;
1608 	int			 xdel = 0;
1609 
1610 	ACCEPT_FLAGS(PFR_FLAG_DUMMY);
1611 	rs = pf_find_ruleset(trs->pfrt_anchor);
1612 	if (rs == NULL || !rs->topen || ticket != rs->tticket)
1613 		return (0);
1614 	SLIST_INIT(&workq);
1615 	RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1616 		if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1617 		    pfr_skip_table(trs, p, 0))
1618 			continue;
1619 		p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1620 		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1621 		xdel++;
1622 	}
1623 	if (!(flags & PFR_FLAG_DUMMY)) {
1624 		pfr_setflags_ktables(&workq);
1625 		rs->topen = 0;
1626 		pf_remove_if_empty_ruleset(rs);
1627 	}
1628 	if (ndel != NULL)
1629 		*ndel = xdel;
1630 	return (0);
1631 }
1632 
1633 int
1634 pfr_ina_commit(struct pfr_table *trs, u_int32_t ticket, int *nadd,
1635     int *nchange, int flags)
1636 {
1637 	struct pfr_ktable	*p, *q;
1638 	struct pfr_ktableworkq	 workq;
1639 	struct pf_ruleset	*rs;
1640 	int			 s = 0 /* XXX gcc */, xadd = 0, xchange = 0;
1641 	long			 tzero = time_second;
1642 
1643 	ACCEPT_FLAGS(PFR_FLAG_ATOMIC+PFR_FLAG_DUMMY);
1644 	rs = pf_find_ruleset(trs->pfrt_anchor);
1645 	if (rs == NULL || !rs->topen || ticket != rs->tticket)
1646 		return (EBUSY);
1647 
1648 	SLIST_INIT(&workq);
1649 	RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1650 		if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1651 		    pfr_skip_table(trs, p, 0))
1652 			continue;
1653 		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1654 		if (p->pfrkt_flags & PFR_TFLAG_ACTIVE)
1655 			xchange++;
1656 		else
1657 			xadd++;
1658 	}
1659 
1660 	if (!(flags & PFR_FLAG_DUMMY)) {
1661 		if (flags & PFR_FLAG_ATOMIC)
1662 			s = splsoftnet();
1663 		for (p = SLIST_FIRST(&workq); p != NULL; p = q) {
1664 			q = SLIST_NEXT(p, pfrkt_workq);
1665 			pfr_commit_ktable(p, tzero);
1666 		}
1667 		if (flags & PFR_FLAG_ATOMIC)
1668 			splx(s);
1669 		rs->topen = 0;
1670 		pf_remove_if_empty_ruleset(rs);
1671 	}
1672 	if (nadd != NULL)
1673 		*nadd = xadd;
1674 	if (nchange != NULL)
1675 		*nchange = xchange;
1676 
1677 	return (0);
1678 }
1679 
1680 void
1681 pfr_commit_ktable(struct pfr_ktable *kt, long tzero)
1682 {
1683 	struct pfr_ktable	*shadow = kt->pfrkt_shadow;
1684 	int			 nflags;
1685 
1686 	if (shadow->pfrkt_cnt == NO_ADDRESSES) {
1687 		if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1688 			pfr_clstats_ktable(kt, tzero, 1);
1689 	} else if (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) {
1690 		/* kt might contain addresses */
1691 		struct pfr_kentryworkq	 addrq, addq, changeq, delq, garbageq;
1692 		struct pfr_kentry	*p, *q, *next;
1693 		struct pfr_addr		 ad;
1694 
1695 		pfr_enqueue_addrs(shadow, &addrq, NULL, 0);
1696 		pfr_mark_addrs(kt);
1697 		SLIST_INIT(&addq);
1698 		SLIST_INIT(&changeq);
1699 		SLIST_INIT(&delq);
1700 		SLIST_INIT(&garbageq);
1701 		pfr_clean_node_mask(shadow, &addrq);
1702 		for (p = SLIST_FIRST(&addrq); p != NULL; p = next) {
1703 			next = SLIST_NEXT(p, pfrke_workq);	/* XXX */
1704 			pfr_copyout_addr(&ad, p);
1705 			q = pfr_lookup_addr(kt, &ad, 1);
1706 			if (q != NULL) {
1707 				if (q->pfrke_not != p->pfrke_not)
1708 					SLIST_INSERT_HEAD(&changeq, q,
1709 					    pfrke_workq);
1710 				q->pfrke_mark = 1;
1711 				SLIST_INSERT_HEAD(&garbageq, p, pfrke_workq);
1712 			} else {
1713 				p->pfrke_tzero = tzero;
1714 				SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
1715 			}
1716 		}
1717 		pfr_enqueue_addrs(kt, &delq, NULL, ENQUEUE_UNMARKED_ONLY);
1718 		pfr_insert_kentries(kt, &addq, tzero);
1719 		pfr_remove_kentries(kt, &delq);
1720 		pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
1721 		pfr_destroy_kentries(&garbageq);
1722 	} else {
1723 		/* kt cannot contain addresses */
1724 		SWAP(struct radix_node_head *, kt->pfrkt_ip4,
1725 		    shadow->pfrkt_ip4);
1726 		SWAP(struct radix_node_head *, kt->pfrkt_ip6,
1727 		    shadow->pfrkt_ip6);
1728 		SWAP(int, kt->pfrkt_cnt, shadow->pfrkt_cnt);
1729 		pfr_clstats_ktable(kt, tzero, 1);
1730 	}
1731 	nflags = ((shadow->pfrkt_flags & PFR_TFLAG_USRMASK) |
1732 	    (kt->pfrkt_flags & PFR_TFLAG_SETMASK) | PFR_TFLAG_ACTIVE)
1733 		& ~PFR_TFLAG_INACTIVE;
1734 	pfr_destroy_ktable(shadow, 0);
1735 	kt->pfrkt_shadow = NULL;
1736 	pfr_setflags_ktable(kt, nflags);
1737 }
1738 
1739 int
1740 pfr_validate_table(struct pfr_table *tbl, int allowedflags, int no_reserved)
1741 {
1742 	int i;
1743 
1744 	if (!tbl->pfrt_name[0])
1745 		return (-1);
1746 	if (no_reserved && !strcmp(tbl->pfrt_anchor, PF_RESERVED_ANCHOR))
1747 		 return (-1);
1748 	if (tbl->pfrt_name[PF_TABLE_NAME_SIZE-1])
1749 		return (-1);
1750 	for (i = strlen(tbl->pfrt_name); i < PF_TABLE_NAME_SIZE; i++)
1751 		if (tbl->pfrt_name[i])
1752 			return (-1);
1753 	if (pfr_fix_anchor(tbl->pfrt_anchor))
1754 		return (-1);
1755 	if (tbl->pfrt_flags & ~allowedflags)
1756 		return (-1);
1757 	return (0);
1758 }
1759 
1760 /*
1761  * Rewrite anchors referenced by tables to remove slashes
1762  * and check for validity.
1763  */
1764 int
1765 pfr_fix_anchor(char *anchor)
1766 {
1767 	size_t siz = MAXPATHLEN;
1768 	int i;
1769 
1770 	if (anchor[0] == '/') {
1771 		char *path;
1772 		int off;
1773 
1774 		path = anchor;
1775 		off = 1;
1776 		while (*++path == '/')
1777 			off++;
1778 		bcopy(path, anchor, siz - off);
1779 		memset(anchor + siz - off, 0, off);
1780 	}
1781 	if (anchor[siz - 1])
1782 		return (-1);
1783 	for (i = strlen(anchor); i < siz; i++)
1784 		if (anchor[i])
1785 			return (-1);
1786 	return (0);
1787 }
1788 
1789 int
1790 pfr_table_count(struct pfr_table *filter, int flags)
1791 {
1792 	struct pf_ruleset *rs;
1793 
1794 	if (flags & PFR_FLAG_ALLRSETS)
1795 		return (pfr_ktable_cnt);
1796 	if (filter->pfrt_anchor[0]) {
1797 		rs = pf_find_ruleset(filter->pfrt_anchor);
1798 		return ((rs != NULL) ? rs->tables : -1);
1799 	}
1800 	return (pf_main_ruleset.tables);
1801 }
1802 
1803 int
1804 pfr_skip_table(struct pfr_table *filter, struct pfr_ktable *kt, int flags)
1805 {
1806 	if (flags & PFR_FLAG_ALLRSETS)
1807 		return (0);
1808 	if (strcmp(filter->pfrt_anchor, kt->pfrkt_anchor))
1809 		return (1);
1810 	return (0);
1811 }
1812 
1813 void
1814 pfr_insert_ktables(struct pfr_ktableworkq *workq)
1815 {
1816 	struct pfr_ktable	*p;
1817 
1818 	SLIST_FOREACH(p, workq, pfrkt_workq)
1819 		pfr_insert_ktable(p);
1820 }
1821 
1822 void
1823 pfr_insert_ktable(struct pfr_ktable *kt)
1824 {
1825 	RB_INSERT(pfr_ktablehead, &pfr_ktables, kt);
1826 	pfr_ktable_cnt++;
1827 	if (kt->pfrkt_root != NULL)
1828 		if (!kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]++)
1829 			pfr_setflags_ktable(kt->pfrkt_root,
1830 			    kt->pfrkt_root->pfrkt_flags|PFR_TFLAG_REFDANCHOR);
1831 }
1832 
1833 void
1834 pfr_setflags_ktables(struct pfr_ktableworkq *workq)
1835 {
1836 	struct pfr_ktable	*p, *q;
1837 
1838 	for (p = SLIST_FIRST(workq); p; p = q) {
1839 		q = SLIST_NEXT(p, pfrkt_workq);
1840 		pfr_setflags_ktable(p, p->pfrkt_nflags);
1841 	}
1842 }
1843 
1844 void
1845 pfr_setflags_ktable(struct pfr_ktable *kt, int newf)
1846 {
1847 	struct pfr_kentryworkq	addrq;
1848 
1849 	if (!(newf & PFR_TFLAG_REFERENCED) &&
1850 	    !(newf & PFR_TFLAG_PERSIST))
1851 		newf &= ~PFR_TFLAG_ACTIVE;
1852 	if (!(newf & PFR_TFLAG_ACTIVE))
1853 		newf &= ~PFR_TFLAG_USRMASK;
1854 	if (!(newf & PFR_TFLAG_SETMASK)) {
1855 		RB_REMOVE(pfr_ktablehead, &pfr_ktables, kt);
1856 		if (kt->pfrkt_root != NULL)
1857 			if (!--kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR])
1858 				pfr_setflags_ktable(kt->pfrkt_root,
1859 				    kt->pfrkt_root->pfrkt_flags &
1860 					~PFR_TFLAG_REFDANCHOR);
1861 		pfr_destroy_ktable(kt, 1);
1862 		pfr_ktable_cnt--;
1863 		return;
1864 	}
1865 	if (!(newf & PFR_TFLAG_ACTIVE) && kt->pfrkt_cnt) {
1866 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1867 		pfr_remove_kentries(kt, &addrq);
1868 	}
1869 	if (!(newf & PFR_TFLAG_INACTIVE) && kt->pfrkt_shadow != NULL) {
1870 		pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1871 		kt->pfrkt_shadow = NULL;
1872 	}
1873 	kt->pfrkt_flags = newf;
1874 }
1875 
1876 void
1877 pfr_clstats_ktables(struct pfr_ktableworkq *workq, long tzero, int recurse)
1878 {
1879 	struct pfr_ktable	*p;
1880 
1881 	SLIST_FOREACH(p, workq, pfrkt_workq)
1882 		pfr_clstats_ktable(p, tzero, recurse);
1883 }
1884 
1885 void
1886 pfr_clstats_ktable(struct pfr_ktable *kt, long tzero, int recurse)
1887 {
1888 	struct pfr_kentryworkq	 addrq;
1889 	int			 s;
1890 
1891 	if (recurse) {
1892 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1893 		pfr_clstats_kentries(&addrq, tzero, 0);
1894 	}
1895 	s = splsoftnet();
1896 	bzero(kt->pfrkt_packets, sizeof(kt->pfrkt_packets));
1897 	bzero(kt->pfrkt_bytes, sizeof(kt->pfrkt_bytes));
1898 	kt->pfrkt_match = kt->pfrkt_nomatch = 0;
1899 	splx(s);
1900 	kt->pfrkt_tzero = tzero;
1901 }
1902 
1903 struct pfr_ktable *
1904 pfr_create_ktable(struct pfr_table *tbl, long tzero, int attachruleset)
1905 {
1906 	struct pfr_ktable	*kt;
1907 	struct pf_ruleset	*rs;
1908 	void			*h4 = NULL, *h6 = NULL;
1909 
1910 	kt = pool_get(&pfr_ktable_pl, PR_NOWAIT);
1911 	if (kt == NULL)
1912 		return (NULL);
1913 	bzero(kt, sizeof(*kt));
1914 	kt->pfrkt_t = *tbl;
1915 
1916 	if (attachruleset) {
1917 		rs = pf_find_or_create_ruleset(tbl->pfrt_anchor);
1918 		if (!rs) {
1919 			pfr_destroy_ktable(kt, 0);
1920 			return (NULL);
1921 		}
1922 		kt->pfrkt_rs = rs;
1923 		rs->tables++;
1924 	}
1925 
1926 	if (!rn_inithead(&h4, offsetof(struct sockaddr_in, sin_addr) * 8))
1927 		goto out;
1928 
1929 	if (!rn_inithead(&h6, offsetof(struct sockaddr_in6, sin6_addr) * 8)) {
1930 		Free(h4);
1931 		goto out;
1932 	}
1933 	kt->pfrkt_ip4 = h4;
1934 	kt->pfrkt_ip6 = h6;
1935 	kt->pfrkt_tzero = tzero;
1936 
1937 	return (kt);
1938 out:
1939 	pfr_destroy_ktable(kt, 0);
1940 	return (NULL);
1941 }
1942 
1943 void
1944 pfr_destroy_ktables(struct pfr_ktableworkq *workq, int flushaddr)
1945 {
1946 	struct pfr_ktable	*p, *q;
1947 
1948 	for (p = SLIST_FIRST(workq); p; p = q) {
1949 		q = SLIST_NEXT(p, pfrkt_workq);
1950 		pfr_destroy_ktable(p, flushaddr);
1951 	}
1952 }
1953 
1954 void
1955 pfr_destroy_ktable(struct pfr_ktable *kt, int flushaddr)
1956 {
1957 	struct pfr_kentryworkq	 addrq;
1958 
1959 	if (flushaddr) {
1960 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1961 		pfr_clean_node_mask(kt, &addrq);
1962 		pfr_destroy_kentries(&addrq);
1963 	}
1964 	if (kt->pfrkt_ip4 != NULL)
1965 		free((void *)kt->pfrkt_ip4, M_RTABLE);
1966 	if (kt->pfrkt_ip6 != NULL)
1967 		free((void *)kt->pfrkt_ip6, M_RTABLE);
1968 	if (kt->pfrkt_shadow != NULL)
1969 		pfr_destroy_ktable(kt->pfrkt_shadow, flushaddr);
1970 	if (kt->pfrkt_rs != NULL) {
1971 		kt->pfrkt_rs->tables--;
1972 		pf_remove_if_empty_ruleset(kt->pfrkt_rs);
1973 	}
1974 	pool_put(&pfr_ktable_pl, kt);
1975 }
1976 
1977 int
1978 pfr_ktable_compare(struct pfr_ktable *p, struct pfr_ktable *q)
1979 {
1980 	int d;
1981 
1982 	if ((d = strncmp(p->pfrkt_name, q->pfrkt_name, PF_TABLE_NAME_SIZE)))
1983 		return (d);
1984 	return (strcmp(p->pfrkt_anchor, q->pfrkt_anchor));
1985 }
1986 
1987 struct pfr_ktable *
1988 pfr_lookup_table(struct pfr_table *tbl)
1989 {
1990 	/* struct pfr_ktable start like a struct pfr_table */
1991 	return (RB_FIND(pfr_ktablehead, &pfr_ktables,
1992 	    (struct pfr_ktable *)tbl));
1993 }
1994 
1995 int
1996 pfr_match_addr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af)
1997 {
1998 	struct pfr_kentry	*ke = NULL;
1999 	int			 match;
2000 
2001 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2002 		kt = kt->pfrkt_root;
2003 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2004 		return (0);
2005 
2006 	switch (af) {
2007 #ifdef INET
2008 	case AF_INET:
2009 		pfr_sin.sin_addr.s_addr = a->addr32[0];
2010 		ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4);
2011 		if (ke && KENTRY_RNF_ROOT(ke))
2012 			ke = NULL;
2013 		break;
2014 #endif /* INET */
2015 #ifdef INET6
2016 	case AF_INET6:
2017 		bcopy(a, &pfr_sin6.sin6_addr, sizeof(pfr_sin6.sin6_addr));
2018 		ke = (struct pfr_kentry *)rn_match(&pfr_sin6, kt->pfrkt_ip6);
2019 		if (ke && KENTRY_RNF_ROOT(ke))
2020 			ke = NULL;
2021 		break;
2022 #endif /* INET6 */
2023 	}
2024 	match = (ke && !ke->pfrke_not);
2025 	if (match)
2026 		kt->pfrkt_match++;
2027 	else
2028 		kt->pfrkt_nomatch++;
2029 	return (match);
2030 }
2031 
2032 void
2033 pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af,
2034     u_int64_t len, int dir_out, int op_pass, int notrule)
2035 {
2036 	struct pfr_kentry	*ke = NULL;
2037 
2038 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2039 		kt = kt->pfrkt_root;
2040 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2041 		return;
2042 
2043 	switch (af) {
2044 #ifdef INET
2045 	case AF_INET:
2046 		pfr_sin.sin_addr.s_addr = a->addr32[0];
2047 		ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4);
2048 		if (ke && KENTRY_RNF_ROOT(ke))
2049 			ke = NULL;
2050 		break;
2051 #endif /* INET */
2052 #ifdef INET6
2053 	case AF_INET6:
2054 		bcopy(a, &pfr_sin6.sin6_addr, sizeof(pfr_sin6.sin6_addr));
2055 		ke = (struct pfr_kentry *)rn_match(&pfr_sin6, kt->pfrkt_ip6);
2056 		if (ke && KENTRY_RNF_ROOT(ke))
2057 			ke = NULL;
2058 		break;
2059 #endif /* INET6 */
2060 	default:
2061 		;
2062 	}
2063 	if ((ke == NULL || ke->pfrke_not) != notrule) {
2064 		if (op_pass != PFR_OP_PASS)
2065 			printf("pfr_update_stats: assertion failed.\n");
2066 		op_pass = PFR_OP_XPASS;
2067 	}
2068 	kt->pfrkt_packets[dir_out][op_pass]++;
2069 	kt->pfrkt_bytes[dir_out][op_pass] += len;
2070 	if (ke != NULL && op_pass != PFR_OP_XPASS) {
2071 		ke->pfrke_packets[dir_out][op_pass]++;
2072 		ke->pfrke_bytes[dir_out][op_pass] += len;
2073 	}
2074 }
2075 
2076 struct pfr_ktable *
2077 pfr_attach_table(struct pf_ruleset *rs, char *name)
2078 {
2079 	struct pfr_ktable	*kt, *rt;
2080 	struct pfr_table	 tbl;
2081 	struct pf_anchor	*ac = rs->anchor;
2082 
2083 	bzero(&tbl, sizeof(tbl));
2084 	strlcpy(tbl.pfrt_name, name, sizeof(tbl.pfrt_name));
2085 	if (ac != NULL)
2086 		strlcpy(tbl.pfrt_anchor, ac->name, sizeof(tbl.pfrt_anchor));
2087 	kt = pfr_lookup_table(&tbl);
2088 	if (kt == NULL) {
2089 		kt = pfr_create_ktable(&tbl, time_second, 1);
2090 		if (kt == NULL)
2091 			return (NULL);
2092 		if (ac != NULL) {
2093 			bzero(tbl.pfrt_anchor, sizeof(tbl.pfrt_anchor));
2094 			rt = pfr_lookup_table(&tbl);
2095 			if (rt == NULL) {
2096 				rt = pfr_create_ktable(&tbl, 0, 1);
2097 				if (rt == NULL) {
2098 					pfr_destroy_ktable(kt, 0);
2099 					return (NULL);
2100 				}
2101 				pfr_insert_ktable(rt);
2102 			}
2103 			kt->pfrkt_root = rt;
2104 		}
2105 		pfr_insert_ktable(kt);
2106 	}
2107 	if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++)
2108 		pfr_setflags_ktable(kt, kt->pfrkt_flags|PFR_TFLAG_REFERENCED);
2109 	return (kt);
2110 }
2111 
2112 void
2113 pfr_detach_table(struct pfr_ktable *kt)
2114 {
2115 	if (kt->pfrkt_refcnt[PFR_REFCNT_RULE] <= 0)
2116 		printf("pfr_detach_table: refcount = %d.\n",
2117 		    kt->pfrkt_refcnt[PFR_REFCNT_RULE]);
2118 	else if (!--kt->pfrkt_refcnt[PFR_REFCNT_RULE])
2119 		pfr_setflags_ktable(kt, kt->pfrkt_flags&~PFR_TFLAG_REFERENCED);
2120 }
2121 
2122 int
2123 pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter,
2124     struct pf_addr **raddr, struct pf_addr **rmask, sa_family_t af)
2125 {
2126 	struct pfr_kentry	*ke, *ke2 = (void *)0xdeadb;
2127 	struct pf_addr		*addr = (void *)0xdeadb;
2128 	union sockaddr_union	 mask;
2129 	int			 idx = -1, use_counter = 0;
2130 
2131 	if (af == AF_INET)
2132 		addr = (struct pf_addr *)&pfr_sin.sin_addr;
2133 	else if (af == AF_INET6)
2134 		addr = (struct pf_addr *)&pfr_sin6.sin6_addr;
2135 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2136 		kt = kt->pfrkt_root;
2137 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2138 		return (-1);
2139 
2140 	if (pidx != NULL)
2141 		idx = *pidx;
2142 	if (counter != NULL && idx >= 0)
2143 		use_counter = 1;
2144 	if (idx < 0)
2145 		idx = 0;
2146 
2147 _next_block:
2148 	ke = pfr_kentry_byidx(kt, idx, af);
2149 	if (ke == NULL)
2150 		return (1);
2151 	pfr_prepare_network(&pfr_mask, af, ke->pfrke_net);
2152 	*raddr = SUNION2PF(&ke->pfrke_sa, af);
2153 	*rmask = SUNION2PF(&pfr_mask, af);
2154 
2155 	if (use_counter) {
2156 		/* is supplied address within block? */
2157 		if (!PF_MATCHA(0, *raddr, *rmask, counter, af)) {
2158 			/* no, go to next block in table */
2159 			idx++;
2160 			use_counter = 0;
2161 			goto _next_block;
2162 		}
2163 		PF_ACPY(addr, counter, af);
2164 	} else {
2165 		/* use first address of block */
2166 		PF_ACPY(addr, *raddr, af);
2167 	}
2168 
2169 	if (!KENTRY_NETWORK(ke)) {
2170 		/* this is a single IP address - no possible nested block */
2171 		PF_ACPY(counter, addr, af);
2172 		*pidx = idx;
2173 		return (0);
2174 	}
2175 	for (;;) {
2176 		/* we don't want to use a nested block */
2177 		if (af == AF_INET)
2178 			ke2 = (struct pfr_kentry *)rn_match(&pfr_sin,
2179 			    kt->pfrkt_ip4);
2180 		else if (af == AF_INET6)
2181 			ke2 = (struct pfr_kentry *)rn_match(&pfr_sin6,
2182 			    kt->pfrkt_ip6);
2183 		/* no need to check KENTRY_RNF_ROOT() here */
2184 		if (ke2 == ke) {
2185 			/* lookup return the same block - perfect */
2186 			PF_ACPY(counter, addr, af);
2187 			*pidx = idx;
2188 			return (0);
2189 		}
2190 
2191 		/* we need to increase the counter past the nested block */
2192 		pfr_prepare_network(&mask, AF_INET, ke2->pfrke_net);
2193 		PF_POOLMASK(addr, addr, SUNION2PF(&mask, af), &pfr_ffaddr, af);
2194 		PF_AINC(addr, af);
2195 		if (!PF_MATCHA(0, *raddr, *rmask, addr, af)) {
2196 			/* ok, we reached the end of our main block */
2197 			/* go to next block in table */
2198 			idx++;
2199 			use_counter = 0;
2200 			goto _next_block;
2201 		}
2202 	}
2203 }
2204 
2205 struct pfr_kentry *
2206 pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af)
2207 {
2208 	struct pfr_walktree	w;
2209 
2210 	bzero(&w, sizeof(w));
2211 	w.pfrw_op = PFRW_POOL_GET;
2212 	w.pfrw_cnt = idx;
2213 
2214 	switch (af) {
2215 #ifdef INET
2216 	case AF_INET:
2217 		rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
2218 		return (w.pfrw_kentry);
2219 #endif /* INET */
2220 #ifdef INET6
2221 	case AF_INET6:
2222 		rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
2223 		return (w.pfrw_kentry);
2224 #endif /* INET6 */
2225 	default:
2226 		return (NULL);
2227 	}
2228 }
2229 
2230 void
2231 pfr_dynaddr_update(struct pfr_ktable *kt, struct pfi_dynaddr *dyn)
2232 {
2233 	struct pfr_walktree	w;
2234 	int			s;
2235 
2236 	bzero(&w, sizeof(w));
2237 	w.pfrw_op = PFRW_DYNADDR_UPDATE;
2238 	w.pfrw_dyn = dyn;
2239 
2240 	s = splsoftnet();
2241 	dyn->pfid_acnt4 = 0;
2242 	dyn->pfid_acnt6 = 0;
2243 	if (!dyn->pfid_af || dyn->pfid_af == AF_INET)
2244 		rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
2245 	if (!dyn->pfid_af || dyn->pfid_af == AF_INET6)
2246 		rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
2247 	splx(s);
2248 }
2249