1 files changed, 45 insertions, 140 deletions

diff --git a/sbin/pfctl/pfctl_radix.c b/sbin/pfctl/pfctl_radix.c
index d33f091d8b69..98f907738d95 100644
--- a/sbin/pfctl/pfctl_radix.c
+++ b/sbin/pfctl/pfctl_radix.c
@@ -32,7 +32,6 @@
  *
  */
 
-#include <sys/cdefs.h>
 #include <sys/types.h>
 #include <sys/ioctl.h>
 #include <sys/socket.h>
@@ -49,6 +48,7 @@
 #include <err.h>
 
 #include "pfctl.h"
+#include "pfctl_parser.h"
 
 #define BUF_SIZE 256
 
@@ -56,6 +56,19 @@ extern int dev;
 
 static int	 pfr_next_token(char buf[BUF_SIZE], FILE *);
 
+struct pfr_ktablehead	pfr_ktables = { 0 };
+RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
+
+int
+pfr_ktable_compare(struct pfr_ktable *p, struct pfr_ktable *q)
+{
+	int d;
+
+	if ((d = strncmp(p->pfrkt_name, q->pfrkt_name, PF_TABLE_NAME_SIZE)))
+		return (d);
+	return (strcmp(p->pfrkt_anchor, q->pfrkt_anchor));
+}
+
 static void
 pfr_report_error(struct pfr_table *tbl, struct pfioc_table *io,
     const char *err)
@@ -75,65 +88,15 @@ pfr_report_error(struct pfr_table *tbl, struct pfioc_table *io,
 }
 
 int
-pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags)
+pfr_add_table(struct pfr_table *tbl, int *nadd, int flags)
 {
-	struct pfioc_table io;
-
-	bzero(&io, sizeof io);
-	io.pfrio_flags = flags;
-	if (filter != NULL)
-		io.pfrio_table = *filter;
-	if (ioctl(dev, DIOCRCLRTABLES, &io))
-		return (-1);
-	if (ndel != NULL)
-		*ndel = io.pfrio_ndel;
-	return (0);
+	return (pfctl_add_table(pfh, tbl, nadd, flags));
 }
 
 int
-pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags)
+pfr_del_table(struct pfr_table *tbl, int *ndel, int flags)
 {
-	struct pfioc_table io;
-
-	if (size < 0 || (size && tbl == NULL)) {
-		errno = EINVAL;
-		return (-1);
-	}
-	bzero(&io, sizeof io);
-	io.pfrio_flags = flags;
-	io.pfrio_buffer = tbl;
-	io.pfrio_esize = sizeof(*tbl);
-	io.pfrio_size = size;
-	if (ioctl(dev, DIOCRADDTABLES, &io)) {
-		pfr_report_error(tbl, &io, "add table");
-		return (-1);
-	}
-	if (nadd != NULL)
-		*nadd = io.pfrio_nadd;
-	return (0);
-}
-
-int
-pfr_del_tables(struct pfr_table *tbl, int size, int *ndel, int flags)
-{
-	struct pfioc_table io;
-
-	if (size < 0 || (size && tbl == NULL)) {
-		errno = EINVAL;
-		return (-1);
-	}
-	bzero(&io, sizeof io);
-	io.pfrio_flags = flags;
-	io.pfrio_buffer = tbl;
-	io.pfrio_esize = sizeof(*tbl);
-	io.pfrio_size = size;
-	if (ioctl(dev, DIOCRDELTABLES, &io)) {
-		pfr_report_error(tbl, &io, "delete table");
-		return (-1);
-	}
-	if (ndel != NULL)
-		*ndel = io.pfrio_ndel;
-	return (0);
+	return (pfctl_del_table(pfh, tbl, ndel, flags));
 }
 
 int
@@ -162,47 +125,9 @@ pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size,
 }
 
 int
-pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size,
-	int flags)
-{
-	struct pfioc_table io;
-
-	if (size == NULL || *size < 0 || (*size && tbl == NULL)) {
-		errno = EINVAL;
-		return (-1);
-	}
-	bzero(&io, sizeof io);
-	io.pfrio_flags = flags;
-	if (filter != NULL)
-		io.pfrio_table = *filter;
-	io.pfrio_buffer = tbl;
-	io.pfrio_esize = sizeof(*tbl);
-	io.pfrio_size = *size;
-	if (ioctl(dev, DIOCRGETTSTATS, &io)) {
-		pfr_report_error(filter, &io, "get tstats for");
-		return (-1);
-	}
-	*size = io.pfrio_size;
-	return (0);
-}
-
-int
 pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags)
 {
-	struct pfioc_table io;
-
-	if (tbl == NULL) {
-		errno = EINVAL;
-		return (-1);
-	}
-	bzero(&io, sizeof io);
-	io.pfrio_flags = flags;
-	io.pfrio_table = *tbl;
-	if (ioctl(dev, DIOCRCLRADDRS, &io))
-		return (-1);
-	if (ndel != NULL)
-		*ndel = io.pfrio_ndel;
-	return (0);
+	return (pfctl_clear_addrs(pfh, tbl, ndel, flags));
 }
 
 int
@@ -211,7 +136,10 @@ pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 {
 	int ret;
 
-	ret = pfctl_table_add_addrs(dev, tbl, addr, size, nadd, flags);
+	if (*nadd)
+		*nadd = 0;
+
+	ret = pfctl_table_add_addrs_h(pfh, tbl, addr, size, nadd, flags);
 	if (ret) {
 		errno = ret;
 		return (-1);
@@ -225,7 +153,7 @@ pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 {
 	int ret;
 
-	ret = pfctl_table_del_addrs(dev, tbl, addr, size, ndel, flags);
+	ret = pfctl_table_del_addrs_h(pfh, tbl, addr, size, ndel, flags);
 	if (ret) {
 		errno = ret;
 		return (-1);
@@ -288,23 +216,23 @@ pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size,
 }
 
 int
-pfr_clr_tstats(struct pfr_table *tbl, int size, int *nzero, int flags)
+pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size,
+    int *nzero, int flags)
 {
 	struct pfioc_table io;
 
-	if (size < 0 || (size && !tbl)) {
+	if (size < 0 || !tbl || (size && !addr)) {
 		errno = EINVAL;
 		return (-1);
 	}
 	bzero(&io, sizeof io);
 	io.pfrio_flags = flags;
-	io.pfrio_buffer = tbl;
-	io.pfrio_esize = sizeof(*tbl);
+	io.pfrio_table = *tbl;
+	io.pfrio_buffer = addr;
+	io.pfrio_esize = sizeof(*addr);
 	io.pfrio_size = size;
-	if (ioctl(dev, DIOCRCLRTSTATS, &io)) {
-		pfr_report_error(tbl, &io, "clear tstats from");
+	if (ioctl(dev, DIOCRCLRASTATS, &io) == -1)
 		return (-1);
-	}
 	if (nzero)
 		*nzero = io.pfrio_nzero;
 	return (0);
@@ -342,6 +270,7 @@ pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 	struct pfioc_table io;
 
 	if (tbl == NULL || size < 0 || (size && addr == NULL)) {
+		DBGPRINT("%s %p %d %p\n", __func__, tbl, size, addr);
 		errno = EINVAL;
 		return (-1);
 	}
@@ -462,25 +391,15 @@ pfr_buf_grow(struct pfr_buffer *b, int minsize)
 	if (!b->pfrb_msize) {
 		if (minsize < 64)
 			minsize = 64;
-		b->pfrb_caddr = calloc(bs, minsize);
-		if (b->pfrb_caddr == NULL)
-			return (-1);
-		b->pfrb_msize = minsize;
-	} else {
-		if (minsize == 0)
-			minsize = b->pfrb_msize * 2;
-		if (minsize < 0 || minsize >= SIZE_T_MAX / bs) {
-			/* msize overflow */
-			errno = ENOMEM;
-			return (-1);
-		}
-		p = realloc(b->pfrb_caddr, minsize * bs);
-		if (p == NULL)
-			return (-1);
-		bzero(p + b->pfrb_msize * bs, (minsize - b->pfrb_msize) * bs);
-		b->pfrb_caddr = p;
-		b->pfrb_msize = minsize;
 	}
+	if (minsize == 0)
+		minsize = b->pfrb_msize * 2;
+	p = reallocarray(b->pfrb_caddr, minsize, bs);
+	if (p == NULL)
+		return (-1);
+	bzero(p + b->pfrb_msize * bs, (minsize - b->pfrb_msize) * bs);
+	b->pfrb_caddr = p;
+	b->pfrb_msize = minsize;
 	return (0);
 }
 
@@ -492,15 +411,14 @@ pfr_buf_clear(struct pfr_buffer *b)
 {
 	if (b == NULL)
 		return;
-	if (b->pfrb_caddr != NULL)
-		free(b->pfrb_caddr);
+	free(b->pfrb_caddr);
 	b->pfrb_caddr = NULL;
 	b->pfrb_size = b->pfrb_msize = 0;
 }
 
 int
 pfr_buf_load(struct pfr_buffer *b, char *file, int nonetwork,
-    int (*append_addr)(struct pfr_buffer *, char *, int))
+    int (*append_addr)(struct pfr_buffer *, char *, int, int), int opts)
 {
 	FILE	*fp;
 	char	 buf[BUF_SIZE];
@@ -516,7 +434,7 @@ pfr_buf_load(struct pfr_buffer *b, char *file, int nonetwork,
 			return (-1);
 	}
 	while ((rv = pfr_next_token(buf, fp)) == 1)
-		if (append_addr(b, buf, nonetwork)) {
+		if (append_addr(b, buf, nonetwork, opts)) {
 			rv = -1;
 			break;
 		}
@@ -535,8 +453,8 @@ pfr_next_token(char buf[BUF_SIZE], FILE *fp)
 		/* skip spaces */
 		while (isspace(next_ch) && !feof(fp))
 			next_ch = fgetc(fp);
-		/* remove from '#' until end of line */
-		if (next_ch == '#')
+		/* remove from '#' or ';' until end of line */
+		if (next_ch == '#' || next_ch == ';')
 			while (!feof(fp)) {
 				next_ch = fgetc(fp);
 				if (next_ch == '\n')
@@ -561,16 +479,3 @@ pfr_next_token(char buf[BUF_SIZE], FILE *fp)
 	buf[i] = '\0';
 	return (1);
 }
-
-char *
-pfr_strerror(int errnum)
-{
-	switch (errnum) {
-	case ESRCH:
-		return "Table does not exist";
-	case ENOENT:
-		return "Anchor or Ruleset does not exist";
-	default:
-		return strerror(errnum);
-	}
-}