Differential D24803 Diff 71642 head/sys/netpfil/pf/pf_table.c

Changeset View

Standalone View

head/sys/netpfil/pf/pf_table.c

Show First 20 Lines • Show All 138 Lines • ▼ Show 20 Lines	static void pfr_copyout_addr(struct pfr_addr *,
const struct pfr_kentry *ke);		const struct pfr_kentry *ke);
static int pfr_validate_addr(struct pfr_addr *);		static int pfr_validate_addr(struct pfr_addr *);
static void pfr_enqueue_addrs(struct pfr_ktable *,		static void pfr_enqueue_addrs(struct pfr_ktable *,
struct pfr_kentryworkq , int , int);		struct pfr_kentryworkq , int , int);
static void pfr_mark_addrs(struct pfr_ktable *);		static void pfr_mark_addrs(struct pfr_ktable *);
static struct pfr_kentry		static struct pfr_kentry
pfr_lookup_addr(struct pfr_ktable ,		pfr_lookup_addr(struct pfr_ktable ,
struct pfr_addr *, int);		struct pfr_addr *, int);
static bool pfr_create_kentry_counter(struct pfr_kcounters *,		static bool pfr_create_kentry_counter(struct pfr_kentry *, int,
int, int);		int);
static struct pfr_kentry pfr_create_kentry(struct pfr_addr );		static struct pfr_kentry pfr_create_kentry(struct pfr_addr , bool);
static void pfr_destroy_kentries(struct pfr_kentryworkq *);		static void pfr_destroy_kentries(struct pfr_kentryworkq *);
static void pfr_destroy_kentry_counter(struct pfr_kcounters *,		static void pfr_destroy_kentry_counter(struct pfr_kcounters *,
int, int);		int, int);
static void pfr_destroy_kentry(struct pfr_kentry *);		static void pfr_destroy_kentry(struct pfr_kentry *);
static void pfr_insert_kentries(struct pfr_ktable *,		static void pfr_insert_kentries(struct pfr_ktable *,
struct pfr_kentryworkq *, long);		struct pfr_kentryworkq *, long);
static void pfr_remove_kentries(struct pfr_ktable *,		static void pfr_remove_kentries(struct pfr_ktable *,
struct pfr_kentryworkq *);		struct pfr_kentryworkq *);
static void pfr_clstats_kentries(struct pfr_kentryworkq *, long,		static void pfr_clstats_kentries(struct pfr_ktable *,
int);		struct pfr_kentryworkq *, long, int);
static void pfr_reset_feedback(struct pfr_addr *, int);		static void pfr_reset_feedback(struct pfr_addr *, int);
static void pfr_prepare_network(union sockaddr_union *, int, int);		static void pfr_prepare_network(union sockaddr_union *, int, int);
static int pfr_route_kentry(struct pfr_ktable *,		static int pfr_route_kentry(struct pfr_ktable *,
struct pfr_kentry *);		struct pfr_kentry *);
static int pfr_unroute_kentry(struct pfr_ktable *,		static int pfr_unroute_kentry(struct pfr_ktable *,
struct pfr_kentry *);		struct pfr_kentry *);
static int pfr_walktree(struct radix_node , void );		static int pfr_walktree(struct radix_node , void );
static int pfr_validate_table(struct pfr_table *, int, int);		static int pfr_validate_table(struct pfr_table *, int, int);
▲ Show 20 Lines • Show All 112 Lines • ▼ Show 20 Lines	if (flags & PFR_FLAG_FEEDBACK) {
else if (p == NULL)		else if (p == NULL)
ad->pfra_fback = PFR_FB_ADDED;		ad->pfra_fback = PFR_FB_ADDED;
else if (p->pfrke_not != ad->pfra_not)		else if (p->pfrke_not != ad->pfra_not)
ad->pfra_fback = PFR_FB_CONFLICT;		ad->pfra_fback = PFR_FB_CONFLICT;
else		else
ad->pfra_fback = PFR_FB_NONE;		ad->pfra_fback = PFR_FB_NONE;
}		}
if (p == NULL && q == NULL) {		if (p == NULL && q == NULL) {
p = pfr_create_kentry(ad);		p = pfr_create_kentry(ad,
		(kt->pfrkt_flags & PFR_TFLAG_COUNTERS) != 0);
if (p == NULL)		if (p == NULL)
senderr(ENOMEM);		senderr(ENOMEM);
if (pfr_route_kentry(tmpkt, p)) {		if (pfr_route_kentry(tmpkt, p)) {
pfr_destroy_kentry(p);		pfr_destroy_kentry(p);
ad->pfra_fback = PFR_FB_NONE;		ad->pfra_fback = PFR_FB_NONE;
} else {		} else {
SLIST_INSERT_HEAD(&workq, p, pfrke_workq);		SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
xadd++;		xadd++;
▲ Show 20 Lines • Show All 149 Lines • ▼ Show 20 Lines	if (p != NULL) {
xchange++;		xchange++;
}		}
} else {		} else {
q = pfr_lookup_addr(tmpkt, &ad, 1);		q = pfr_lookup_addr(tmpkt, &ad, 1);
if (q != NULL) {		if (q != NULL) {
ad.pfra_fback = PFR_FB_DUPLICATE;		ad.pfra_fback = PFR_FB_DUPLICATE;
goto _skip;		goto _skip;
}		}
p = pfr_create_kentry(&ad);		p = pfr_create_kentry(&ad,
		(kt->pfrkt_flags & PFR_TFLAG_COUNTERS) != 0);
if (p == NULL)		if (p == NULL)
senderr(ENOMEM);		senderr(ENOMEM);
if (pfr_route_kentry(tmpkt, p)) {		if (pfr_route_kentry(tmpkt, p)) {
pfr_destroy_kentry(p);		pfr_destroy_kentry(p);
ad.pfra_fback = PFR_FB_NONE;		ad.pfra_fback = PFR_FB_NONE;
} else {		} else {
SLIST_INSERT_HEAD(&addq, p, pfrke_workq);		SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
ad.pfra_fback = PFR_FB_ADDED;		ad.pfra_fback = PFR_FB_ADDED;
Show All 17 Lines	SLIST_FOREACH(p, &delq, pfrke_workq) {
bcopy(&ad, addr + size + i, sizeof(ad));		bcopy(&ad, addr + size + i, sizeof(ad));
i++;		i++;
}		}
}		}
pfr_clean_node_mask(tmpkt, &addq);		pfr_clean_node_mask(tmpkt, &addq);
if (!(flags & PFR_FLAG_DUMMY)) {		if (!(flags & PFR_FLAG_DUMMY)) {
pfr_insert_kentries(kt, &addq, tzero);		pfr_insert_kentries(kt, &addq, tzero);
pfr_remove_kentries(kt, &delq);		pfr_remove_kentries(kt, &delq);
pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);		pfr_clstats_kentries(kt, &changeq, tzero, INVERT_NEG_FLAG);
} else		} else
pfr_destroy_kentries(&addq);		pfr_destroy_kentries(&addq);
if (nadd != NULL)		if (nadd != NULL)
*nadd = xadd;		*nadd = xadd;
if (ndel != NULL)		if (ndel != NULL)
*ndel = xdel;		*ndel = xdel;
if (nchange != NULL)		if (nchange != NULL)
*nchange = xchange;		*nchange = xchange;
▲ Show 20 Lines • Show All 121 Lines • ▼ Show 20 Lines	pfr_get_astats(struct pfr_table tbl, struct pfr_astats addr, int *size,
*/		*/
w.pfrw_flags = kt->pfrkt_flags;		w.pfrw_flags = kt->pfrkt_flags;
rv = kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);		rv = kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w);
if (!rv)		if (!rv)
rv = kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh,		rv = kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh,
pfr_walktree, &w);		pfr_walktree, &w);
if (!rv && (flags & PFR_FLAG_CLSTATS)) {		if (!rv && (flags & PFR_FLAG_CLSTATS)) {
pfr_enqueue_addrs(kt, &workq, NULL, 0);		pfr_enqueue_addrs(kt, &workq, NULL, 0);
pfr_clstats_kentries(&workq, tzero, 0);		pfr_clstats_kentries(kt, &workq, tzero, 0);
}		}
if (rv)		if (rv)
return (rv);		return (rv);

if (w.pfrw_free) {		if (w.pfrw_free) {
printf("pfr_get_astats: corruption detected (%d).\n",		printf("pfr_get_astats: corruption detected (%d).\n",
w.pfrw_free);		w.pfrw_free);
return (ENOTTY);		return (ENOTTY);
Show All 31 Lines	for (i = 0, ad = addr; i < size; i++, ad++) {
}		}
if (p != NULL) {		if (p != NULL) {
SLIST_INSERT_HEAD(&workq, p, pfrke_workq);		SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
xzero++;		xzero++;
}		}
}		}

if (!(flags & PFR_FLAG_DUMMY))		if (!(flags & PFR_FLAG_DUMMY))
pfr_clstats_kentries(&workq, 0, 0);		pfr_clstats_kentries(kt, &workq, 0, 0);
if (nzero != NULL)		if (nzero != NULL)
*nzero = xzero;		*nzero = xzero;
return (0);		return (0);
_bad:		_bad:
if (flags & PFR_FLAG_FEEDBACK)		if (flags & PFR_FLAG_FEEDBACK)
pfr_reset_feedback(addr, size);		pfr_reset_feedback(addr, size);
return (rv);		return (rv);
}		}
▲ Show 20 Lines • Show All 96 Lines • ▼ Show 20 Lines	if (ke && KENTRY_RNF_ROOT(ke))
ke = NULL;		ke = NULL;
if (exact && ke && KENTRY_NETWORK(ke))		if (exact && ke && KENTRY_NETWORK(ke))
ke = NULL;		ke = NULL;
}		}
return (ke);		return (ke);
}		}

static bool		static bool
pfr_create_kentry_counter(struct pfr_kcounters *kc, int pfr_dir, int pfr_op)		pfr_create_kentry_counter(struct pfr_kentry *ke, int pfr_dir, int pfr_op)
{		{
kc->pfrkc_packets[pfr_dir][pfr_op] = counter_u64_alloc(M_NOWAIT);		counter_u64_t c;
if (! kc->pfrkc_packets[pfr_dir][pfr_op])
return (false);

kc->pfrkc_bytes[pfr_dir][pfr_op] = counter_u64_alloc(M_NOWAIT);		c = counter_u64_alloc(M_NOWAIT);
if (! kc->pfrkc_bytes[pfr_dir][pfr_op]) {		if (c == NULL)
/* Previous allocation will be freed through
* pfr_destroy_kentry() */
return (false);		return (false);
}		ke->pfrke_counters.pfrkc_packets[pfr_dir][pfr_op] = c;
		c = counter_u64_alloc(M_NOWAIT);
kc->pfrkc_tzero = 0;		if (c == NULL)
		return (false);
		ke->pfrke_counters.pfrkc_bytes[pfr_dir][pfr_op] = c;
return (true);		return (true);
}		}

static struct pfr_kentry *		static struct pfr_kentry *
pfr_create_kentry(struct pfr_addr *ad)		pfr_create_kentry(struct pfr_addr *ad, bool counters)
{		{
struct pfr_kentry *ke;		struct pfr_kentry *ke;
int pfr_dir, pfr_op;		int pfr_dir, pfr_op;

ke = uma_zalloc(V_pfr_kentry_z, M_NOWAIT \| M_ZERO);		ke = uma_zalloc(V_pfr_kentry_z, M_NOWAIT \| M_ZERO);
if (ke == NULL)		if (ke == NULL)
return (NULL);		return (NULL);

if (ad->pfra_af == AF_INET)		if (ad->pfra_af == AF_INET)
FILLIN_SIN(ke->pfrke_sa.sin, ad->pfra_ip4addr);		FILLIN_SIN(ke->pfrke_sa.sin, ad->pfra_ip4addr);
else if (ad->pfra_af == AF_INET6)		else if (ad->pfra_af == AF_INET6)
FILLIN_SIN6(ke->pfrke_sa.sin6, ad->pfra_ip6addr);		FILLIN_SIN6(ke->pfrke_sa.sin6, ad->pfra_ip6addr);
ke->pfrke_af = ad->pfra_af;		ke->pfrke_af = ad->pfra_af;
ke->pfrke_net = ad->pfra_net;		ke->pfrke_net = ad->pfra_net;
ke->pfrke_not = ad->pfra_not;		ke->pfrke_not = ad->pfra_not;
		ke->pfrke_counters.pfrkc_tzero = 0;
		if (counters)
for (pfr_dir = 0; pfr_dir < PFR_DIR_MAX; pfr_dir ++)		for (pfr_dir = 0; pfr_dir < PFR_DIR_MAX; pfr_dir++)
for (pfr_op = 0; pfr_op < PFR_OP_ADDR_MAX; pfr_op ++) {		for (pfr_op = 0; pfr_op < PFR_OP_ADDR_MAX; pfr_op++) {
if (! pfr_create_kentry_counter(&ke->pfrke_counters,		if (!pfr_create_kentry_counter(ke, pfr_dir,
pfr_dir, pfr_op)) {		pfr_op)) {
pfr_destroy_kentry(ke);		pfr_destroy_kentry(ke);
return (NULL);		return (NULL);
}		}
}		}
return (ke);		return (ke);
}		}

static void		static void
pfr_destroy_kentries(struct pfr_kentryworkq *workq)		pfr_destroy_kentries(struct pfr_kentryworkq *workq)
{		{
struct pfr_kentry p, q;		struct pfr_kentry p, q;

for (p = SLIST_FIRST(workq); p != NULL; p = q) {		for (p = SLIST_FIRST(workq); p != NULL; p = q) {
q = SLIST_NEXT(p, pfrke_workq);		q = SLIST_NEXT(p, pfrke_workq);
pfr_destroy_kentry(p);		pfr_destroy_kentry(p);
}		}
}		}

static void		static void
pfr_destroy_kentry_counter(struct pfr_kcounters *kc, int pfr_dir, int pfr_op)		pfr_destroy_kentry_counter(struct pfr_kcounters *kc, int pfr_dir, int pfr_op)
{		{
counter_u64_free(kc->pfrkc_packets[pfr_dir][pfr_op]);		counter_u64_t c;
counter_u64_free(kc->pfrkc_bytes[pfr_dir][pfr_op]);
		if ((c = kc->pfrkc_packets[pfr_dir][pfr_op]) != NULL)
		counter_u64_free(c);
		if ((c = kc->pfrkc_bytes[pfr_dir][pfr_op]) != NULL)
		counter_u64_free(c);
}		}

static void		static void
pfr_destroy_kentry(struct pfr_kentry *ke)		pfr_destroy_kentry(struct pfr_kentry *ke)
{		{
int pfr_dir, pfr_op;		int pfr_dir, pfr_op;

for (pfr_dir = 0; pfr_dir < PFR_DIR_MAX; pfr_dir ++)		for (pfr_dir = 0; pfr_dir < PFR_DIR_MAX; pfr_dir ++)
Show All 28 Lines
pfr_insert_kentry(struct pfr_ktable kt, struct pfr_addr ad, long tzero)		pfr_insert_kentry(struct pfr_ktable kt, struct pfr_addr ad, long tzero)
{		{
struct pfr_kentry *p;		struct pfr_kentry *p;
int rv;		int rv;

p = pfr_lookup_addr(kt, ad, 1);		p = pfr_lookup_addr(kt, ad, 1);
if (p != NULL)		if (p != NULL)
return (0);		return (0);
p = pfr_create_kentry(ad);		p = pfr_create_kentry(ad, (kt->pfrkt_flags & PFR_TFLAG_COUNTERS) != 0);
if (p == NULL)		if (p == NULL)
return (ENOMEM);		return (ENOMEM);

rv = pfr_route_kentry(kt, p);		rv = pfr_route_kentry(kt, p);
if (rv)		if (rv)
return (rv);		return (rv);

p->pfrke_counters.pfrkc_tzero = tzero;		p->pfrke_counters.pfrkc_tzero = tzero;
Show All 23 Lines
{		{
struct pfr_kentry *p;		struct pfr_kentry *p;

SLIST_FOREACH(p, workq, pfrke_workq)		SLIST_FOREACH(p, workq, pfrke_workq)
pfr_unroute_kentry(kt, p);		pfr_unroute_kentry(kt, p);
}		}

static void		static void
pfr_clstats_kentries(struct pfr_kentryworkq *workq, long tzero, int negchange)		pfr_clear_kentry_counters(struct pfr_kentry *p, int pfr_dir, int pfr_op)
{		{
		counter_u64_zero(p->pfrke_counters.pfrkc_packets[pfr_dir][pfr_op]);
		counter_u64_zero(p->pfrke_counters.pfrkc_bytes[pfr_dir][pfr_op]);
		}

		static void
		pfr_clstats_kentries(struct pfr_ktable kt, struct pfr_kentryworkq workq,
		long tzero, int negchange)
		{
struct pfr_kentry *p;		struct pfr_kentry *p;
int pfr_dir, pfr_op;		int pfr_dir, pfr_op;

SLIST_FOREACH(p, workq, pfrke_workq) {		SLIST_FOREACH(p, workq, pfrke_workq) {
if (negchange)		if (negchange)
p->pfrke_not = !p->pfrke_not;		p->pfrke_not = !p->pfrke_not;
for (pfr_dir = 0; pfr_dir < PFR_DIR_MAX; pfr_dir ++) {		if ((kt->pfrkt_flags & PFR_TFLAG_COUNTERS) != 0)
for (pfr_op = 0; pfr_op < PFR_OP_ADDR_MAX; pfr_op ++) {		for (pfr_dir = 0; pfr_dir < PFR_DIR_MAX; pfr_dir++)
counter_u64_zero(p->pfrke_counters.		for (pfr_op = 0; pfr_op < PFR_OP_ADDR_MAX;
pfrkc_packets[pfr_dir][pfr_op]);		pfr_op++)
counter_u64_zero(p->pfrke_counters.		pfr_clear_kentry_counters(p, pfr_dir,
pfrkc_bytes[pfr_dir][pfr_op]);		pfr_op);
}
}
p->pfrke_counters.pfrkc_tzero = tzero;		p->pfrke_counters.pfrkc_tzero = tzero;
}		}
}		}

static void		static void
pfr_reset_feedback(struct pfr_addr *addr, int size)		pfr_reset_feedback(struct pfr_addr *addr, int size)
{		{
struct pfr_addr *ad;		struct pfr_addr *ad;
▲ Show 20 Lines • Show All 589 Lines • ▼ Show 20 Lines	if (shadow == NULL) {
return (ENOMEM);		return (ENOMEM);
}		}
SLIST_INIT(&addrq);		SLIST_INIT(&addrq);
for (i = 0, ad = addr; i < size; i++, ad++) {		for (i = 0, ad = addr; i < size; i++, ad++) {
if (pfr_validate_addr(ad))		if (pfr_validate_addr(ad))
senderr(EINVAL);		senderr(EINVAL);
if (pfr_lookup_addr(shadow, ad, 1) != NULL)		if (pfr_lookup_addr(shadow, ad, 1) != NULL)
continue;		continue;
p = pfr_create_kentry(ad);		p = pfr_create_kentry(ad,
		(shadow->pfrkt_flags & PFR_TFLAG_COUNTERS) != 0);
if (p == NULL)		if (p == NULL)
senderr(ENOMEM);		senderr(ENOMEM);
if (pfr_route_kentry(shadow, p)) {		if (pfr_route_kentry(shadow, p)) {
pfr_destroy_kentry(p);		pfr_destroy_kentry(p);
continue;		continue;
}		}
SLIST_INSERT_HEAD(&addrq, p, pfrke_workq);		SLIST_INSERT_HEAD(&addrq, p, pfrke_workq);
xaddr++;		xaddr++;
▲ Show 20 Lines • Show All 139 Lines • ▼ Show 20 Lines	for (p = SLIST_FIRST(&addrq); p != NULL; p = next) {
} else {		} else {
p->pfrke_counters.pfrkc_tzero = tzero;		p->pfrke_counters.pfrkc_tzero = tzero;
SLIST_INSERT_HEAD(&addq, p, pfrke_workq);		SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
}		}
}		}
pfr_enqueue_addrs(kt, &delq, NULL, ENQUEUE_UNMARKED_ONLY);		pfr_enqueue_addrs(kt, &delq, NULL, ENQUEUE_UNMARKED_ONLY);
pfr_insert_kentries(kt, &addq, tzero);		pfr_insert_kentries(kt, &addq, tzero);
pfr_remove_kentries(kt, &delq);		pfr_remove_kentries(kt, &delq);
pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);		pfr_clstats_kentries(kt, &changeq, tzero, INVERT_NEG_FLAG);
pfr_destroy_kentries(&garbageq);		pfr_destroy_kentries(&garbageq);
} else {		} else {
/* kt cannot contain addresses */		/* kt cannot contain addresses */
SWAP(struct radix_node_head *, kt->pfrkt_ip4,		SWAP(struct radix_node_head *, kt->pfrkt_ip4,
shadow->pfrkt_ip4);		shadow->pfrkt_ip4);
SWAP(struct radix_node_head *, kt->pfrkt_ip6,		SWAP(struct radix_node_head *, kt->pfrkt_ip6,
shadow->pfrkt_ip6);		shadow->pfrkt_ip6);
SWAP(int, kt->pfrkt_cnt, shadow->pfrkt_cnt);		SWAP(int, kt->pfrkt_cnt, shadow->pfrkt_cnt);
▲ Show 20 Lines • Show All 164 Lines • ▼ Show 20 Lines
static void		static void
pfr_clstats_ktable(struct pfr_ktable *kt, long tzero, int recurse)		pfr_clstats_ktable(struct pfr_ktable *kt, long tzero, int recurse)
{		{
struct pfr_kentryworkq addrq;		struct pfr_kentryworkq addrq;
int pfr_dir, pfr_op;		int pfr_dir, pfr_op;

if (recurse) {		if (recurse) {
pfr_enqueue_addrs(kt, &addrq, NULL, 0);		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
pfr_clstats_kentries(&addrq, tzero, 0);		pfr_clstats_kentries(kt, &addrq, tzero, 0);
}		}
for (pfr_dir = 0; pfr_dir < PFR_DIR_MAX; pfr_dir ++) {		for (pfr_dir = 0; pfr_dir < PFR_DIR_MAX; pfr_dir ++) {
for (pfr_op = 0; pfr_op < PFR_OP_TABLE_MAX; pfr_op ++) {		for (pfr_op = 0; pfr_op < PFR_OP_TABLE_MAX; pfr_op ++) {
counter_u64_zero(kt->pfrkt_packets[pfr_dir][pfr_op]);		counter_u64_zero(kt->pfrkt_packets[pfr_dir][pfr_op]);
counter_u64_zero(kt->pfrkt_bytes[pfr_dir][pfr_op]);		counter_u64_zero(kt->pfrkt_bytes[pfr_dir][pfr_op]);
}		}
}		}
counter_u64_zero(kt->pfrkt_match);		counter_u64_zero(kt->pfrkt_match);
▲ Show 20 Lines • Show All 435 Lines • Show Last 20 Lines