1 files changed, 72 insertions, 93 deletions

diff --git a/sys/netpfil/pf/pf_lb.c b/sys/netpfil/pf/pf_lb.c
index 308d76c46e5b..26f7ab41eef4 100644
--- a/sys/netpfil/pf/pf_lb.c
+++ b/sys/netpfil/pf/pf_lb.c
@@ -80,7 +80,6 @@ static enum pf_test_status pf_step_into_translation_anchor(int, struct pf_test_c
 			    struct pf_krule *);
 static int		 pf_get_sport(struct pf_pdesc *, struct pf_krule *,
 			    struct pf_addr *, uint16_t *, uint16_t, uint16_t,
-			    struct pf_ksrc_node **, struct pf_srchash **,
 			    struct pf_kpool *, struct pf_udp_mapping **,
 			    pf_sn_types_t);
 static bool		 pf_islinklocal(const sa_family_t, const struct pf_addr *);
@@ -291,10 +290,8 @@ pf_match_translation(int rs_num, struct pf_test_ctx *ctx)
 }
 
 static int
-pf_get_sport(struct pf_pdesc *pd, struct pf_krule *r,
-    struct pf_addr *naddr, uint16_t *nport, uint16_t low,
-    uint16_t high, struct pf_ksrc_node **sn,
-    struct pf_srchash **sh, struct pf_kpool *rpool,
+pf_get_sport(struct pf_pdesc *pd, struct pf_krule *r, struct pf_addr *naddr,
+    uint16_t *nport, uint16_t low, uint16_t high, struct pf_kpool *rpool,
     struct pf_udp_mapping **udp_mapping, pf_sn_types_t sn_type)
 {
 	struct pf_state_key_cmp	key;
@@ -322,19 +319,24 @@ pf_get_sport(struct pf_pdesc *pd, struct pf_krule *r,
 		pf_addrcpy(&udp_source.addr, &pd->nsaddr, pd->af);
 		udp_source.port = pd->nsport;
 		if (udp_mapping) {
+			struct pf_ksrc_node	*sn = NULL;
+			struct pf_srchash	*sh = NULL;
 			*udp_mapping = pf_udp_mapping_find(&udp_source);
 			if (*udp_mapping) {
 				pf_addrcpy(naddr,
 				    &(*udp_mapping)->endpoints[1].addr,
 				    pd->af);
 				*nport = (*udp_mapping)->endpoints[1].port;
-				/* Try to find a src_node as per pf_map_addr(). */
-				if (*sn == NULL && rpool->opts & PF_POOL_STICKYADDR &&
+				/*
+				 * Try to find a src_node as per pf_map_addr().
+				 * XXX: Why? This code seems to do nothing.
+				 */
+				if (rpool->opts & PF_POOL_STICKYADDR &&
 				    (rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_NONE)
-					*sn = pf_find_src_node(&pd->nsaddr, r,
-					    pd->af, sh, sn_type, false);
-				if (*sn != NULL)
-					PF_SRC_NODE_UNLOCK(*sn);
+					sn = pf_find_src_node(&pd->nsaddr, r,
+					    pd->af, &sh, sn_type, false);
+				if (sn != NULL)
+					PF_SRC_NODE_UNLOCK(sn);
 				return (0);
 			} else {
 				*udp_mapping = pf_udp_mapping_create(pd->af, &pd->nsaddr,
@@ -346,7 +348,7 @@ pf_get_sport(struct pf_pdesc *pd, struct pf_krule *r,
 	}
 
 	if (pf_map_addr_sn(pd->naf, r, &pd->nsaddr, naddr, NULL, &init_addr,
-	    sn, sh, rpool, sn_type))
+	    rpool, sn_type))
 		goto failed;
 
 	if (pd->proto == IPPROTO_ICMP) {
@@ -470,9 +472,8 @@ pf_get_sport(struct pf_pdesc *pd, struct pf_krule *r,
 			 * pick a different source address since we're out
 			 * of free port choices for the current one.
 			 */
-			(*sn) = NULL;
 			if (pf_map_addr_sn(pd->naf, r, &pd->nsaddr, naddr, NULL,
-			    &init_addr, sn, sh, rpool, sn_type))
+			    &init_addr, rpool, sn_type))
 				return (1);
 			break;
 		case PF_POOL_NONE:
@@ -503,7 +504,6 @@ pf_islinklocal(const sa_family_t af, const struct pf_addr *addr)
 static int
 pf_get_mape_sport(struct pf_pdesc *pd, struct pf_krule *r,
     struct pf_addr *naddr, uint16_t *nport,
-    struct pf_ksrc_node **sn, struct pf_srchash **sh,
     struct pf_udp_mapping **udp_mapping, struct pf_kpool *rpool)
 {
 	uint16_t psmask, low, highmask;
@@ -523,16 +523,14 @@ pf_get_mape_sport(struct pf_pdesc *pd, struct pf_krule *r,
 
 	for (i = cut; i <= ahigh; i++) {
 		low = (i << ashift) | psmask;
-		if (!pf_get_sport(pd, r,
-		    naddr, nport, low, low | highmask, sn, sh, rpool,
-		    udp_mapping, PF_SN_NAT))
+		if (!pf_get_sport(pd, r, naddr, nport, low, low | highmask,
+		    rpool, udp_mapping, PF_SN_NAT))
 			return (0);
 	}
 	for (i = cut - 1; i > 0; i--) {
 		low = (i << ashift) | psmask;
-		if (!pf_get_sport(pd, r,
-		    naddr, nport, low, low | highmask, sn, sh, rpool,
-		    udp_mapping, PF_SN_NAT))
+		if (!pf_get_sport(pd, r, naddr, nport, low, low | highmask,
+		    rpool, udp_mapping, PF_SN_NAT))
 			return (0);
 	}
 	return (1);
@@ -545,6 +543,7 @@ pf_map_addr(sa_family_t af, struct pf_krule *r, struct pf_addr *saddr,
 {
 	u_short			 reason = PFRES_MATCH;
 	struct pf_addr		*raddr = NULL, *rmask = NULL;
+	struct pfr_ktable	*kt;
 	uint64_t		 hashidx;
 	int			 cnt;
 
@@ -600,29 +599,25 @@ pf_map_addr(sa_family_t af, struct pf_krule *r, struct pf_addr *saddr,
 		pf_poolmask(naddr, raddr, rmask, saddr, af);
 		break;
 	case PF_POOL_RANDOM:
-		if (rpool->cur->addr.type == PF_ADDR_TABLE) {
-			cnt = rpool->cur->addr.p.tbl->pfrkt_cnt;
-			if (cnt == 0)
-				rpool->tblidx = 0;
+		if (rpool->cur->addr.type == PF_ADDR_TABLE ||
+		    rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
+			if (rpool->cur->addr.type == PF_ADDR_TABLE)
+				kt = rpool->cur->addr.p.tbl;
 			else
-				rpool->tblidx = (int)arc4random_uniform(cnt);
-			memset(&rpool->counter, 0, sizeof(rpool->counter));
-			if (pfr_pool_get(rpool->cur->addr.p.tbl,
-			    &rpool->tblidx, &rpool->counter, af, NULL)) {
+				kt = rpool->cur->addr.p.dyn->pfid_kt;
+			kt = pfr_ktable_select_active(kt);
+			if (kt == NULL) {
 				reason = PFRES_MAPFAILED;
 				goto done_pool_mtx; /* unsupported */
 			}
-			pf_addrcpy(naddr, &rpool->counter, af);
-		} else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
-			cnt = rpool->cur->addr.p.dyn->pfid_kt->pfrkt_cnt;
+			cnt = kt->pfrkt_cnt;
 			if (cnt == 0)
 				rpool->tblidx = 0;
 			else
 				rpool->tblidx = (int)arc4random_uniform(cnt);
 			memset(&rpool->counter, 0, sizeof(rpool->counter));
-			if (pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
-			    &rpool->tblidx, &rpool->counter, af,
-			    pf_islinklocal)) {
+			if (pfr_pool_get(kt, &rpool->tblidx, &rpool->counter,
+			    af, pf_islinklocal, false)) {
 				reason = PFRES_MAPFAILED;
 				goto done_pool_mtx; /* unsupported */
 			}
@@ -671,29 +666,25 @@ pf_map_addr(sa_family_t af, struct pf_krule *r, struct pf_addr *saddr,
 
 		hashidx =
 		    pf_hash(saddr, (struct pf_addr *)&hash, &rpool->key, af);
-		if (rpool->cur->addr.type == PF_ADDR_TABLE) {
-			cnt = rpool->cur->addr.p.tbl->pfrkt_cnt;
-			if (cnt == 0)
-				rpool->tblidx = 0;
+		if (rpool->cur->addr.type == PF_ADDR_TABLE ||
+		    rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
+			if (rpool->cur->addr.type == PF_ADDR_TABLE)
+				kt = rpool->cur->addr.p.tbl;
 			else
-				rpool->tblidx = (int)(hashidx % cnt);
-			memset(&rpool->counter, 0, sizeof(rpool->counter));
-			if (pfr_pool_get(rpool->cur->addr.p.tbl,
-			    &rpool->tblidx, &rpool->counter, af, NULL)) {
+				kt = rpool->cur->addr.p.dyn->pfid_kt;
+			kt = pfr_ktable_select_active(kt);
+			if (kt == NULL) {
 				reason = PFRES_MAPFAILED;
 				goto done_pool_mtx; /* unsupported */
 			}
-			pf_addrcpy(naddr, &rpool->counter, af);
-		} else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
-			cnt = rpool->cur->addr.p.dyn->pfid_kt->pfrkt_cnt;
+			cnt = kt->pfrkt_cnt;
 			if (cnt == 0)
 				rpool->tblidx = 0;
 			else
 				rpool->tblidx = (int)(hashidx % cnt);
 			memset(&rpool->counter, 0, sizeof(rpool->counter));
-			if (pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
-			    &rpool->tblidx, &rpool->counter, af,
-			    pf_islinklocal)) {
+			if (pfr_pool_get(kt, &rpool->tblidx, &rpool->counter,
+			    af, pf_islinklocal, false)) {
 				reason = PFRES_MAPFAILED;
 				goto done_pool_mtx; /* unsupported */
 			}
@@ -710,11 +701,12 @@ pf_map_addr(sa_family_t af, struct pf_krule *r, struct pf_addr *saddr,
 
 		if (rpool->cur->addr.type == PF_ADDR_TABLE) {
 			if (!pfr_pool_get(rpool->cur->addr.p.tbl,
-			    &rpool->tblidx, &rpool->counter, af, NULL))
+			    &rpool->tblidx, &rpool->counter, af, NULL, true))
 				goto get_addr;
 		} else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
 			if (!pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
-			    &rpool->tblidx, &rpool->counter, af, pf_islinklocal))
+			    &rpool->tblidx, &rpool->counter, af, pf_islinklocal,
+			    true))
 				goto get_addr;
 		} else if (pf_match_addr(0, raddr, rmask, &rpool->counter, af))
 			goto get_addr;
@@ -724,9 +716,10 @@ pf_map_addr(sa_family_t af, struct pf_krule *r, struct pf_addr *saddr,
 			rpool->cur = TAILQ_FIRST(&rpool->list);
 		else
 			rpool->cur = TAILQ_NEXT(rpool->cur, entries);
+		rpool->tblidx = -1;
 		if (rpool->cur->addr.type == PF_ADDR_TABLE) {
 			if (pfr_pool_get(rpool->cur->addr.p.tbl,
-			    &rpool->tblidx, &rpool->counter, af, NULL)) {
+			    &rpool->tblidx, &rpool->counter, af, NULL, true)) {
 				/* table contains no address of type 'af' */
 				if (rpool->cur != acur)
 					goto try_next;
@@ -734,9 +727,9 @@ pf_map_addr(sa_family_t af, struct pf_krule *r, struct pf_addr *saddr,
 				goto done_pool_mtx;
 			}
 		} else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
-			rpool->tblidx = -1;
 			if (pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
-			    &rpool->tblidx, &rpool->counter, af, pf_islinklocal)) {
+			    &rpool->tblidx, &rpool->counter, af, pf_islinklocal,
+			    true)) {
 				/* table contains no address of type 'af' */
 				if (rpool->cur != acur)
 					goto try_next;
@@ -764,48 +757,41 @@ pf_map_addr(sa_family_t af, struct pf_krule *r, struct pf_addr *saddr,
 done_pool_mtx:
 	mtx_unlock(&rpool->mtx);
 
-	if (reason) {
-		counter_u64_add(V_pf_status.counters[reason], 1);
-	}
-
 	return (reason);
 }
 
 u_short
 pf_map_addr_sn(sa_family_t af, struct pf_krule *r, struct pf_addr *saddr,
     struct pf_addr *naddr, struct pfi_kkif **nkif, struct pf_addr *init_addr,
-    struct pf_ksrc_node **sn, struct pf_srchash **sh, struct pf_kpool *rpool,
-    pf_sn_types_t sn_type)
+    struct pf_kpool *rpool, pf_sn_types_t sn_type)
 {
+	struct pf_ksrc_node	*sn = NULL;
+	struct pf_srchash	*sh = NULL;
 	u_short			 reason = 0;
 
-	KASSERT(*sn == NULL, ("*sn not NULL"));
-
 	/*
 	 * If this is a sticky-address rule, try to find an existing src_node.
-	 * Request the sh to be unlocked if sn was not found, as we never
-	 * insert a new sn when parsing the ruleset.
 	 */
 	if (rpool->opts & PF_POOL_STICKYADDR &&
 	    (rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_NONE)
-		*sn = pf_find_src_node(saddr, r, af, sh, sn_type, false);
+		sn = pf_find_src_node(saddr, r, af, &sh, sn_type, false);
 
-	if (*sn != NULL) {
-		PF_SRC_NODE_LOCK_ASSERT(*sn);
+	if (sn != NULL) {
+		PF_SRC_NODE_LOCK_ASSERT(sn);
 
 		/* If the supplied address is the same as the current one we've
 		 * been asked before, so tell the caller that there's no other
 		 * address to be had. */
-		if (PF_AEQ(naddr, &(*sn)->raddr, af)) {
+		if (PF_AEQ(naddr, &(sn->raddr), af)) {
 			reason = PFRES_MAPFAILED;
 			goto done;
 		}
 
-		pf_addrcpy(naddr, &(*sn)->raddr, af);
+		pf_addrcpy(naddr, &(sn->raddr), af);
 		if (nkif)
-			*nkif = (*sn)->rkif;
+			*nkif = sn->rkif;
 		if (V_pf_status.debug >= PF_DEBUG_NOISY) {
-			printf("pf_map_addr: src tracking maps ");
+			printf("%s: src tracking maps ", __func__);
 			pf_print_host(saddr, 0, af);
 			printf(" to ");
 			pf_print_host(naddr, 0, af);
@@ -820,14 +806,16 @@ pf_map_addr_sn(sa_family_t af, struct pf_krule *r, struct pf_addr *saddr,
 	 * Source node has not been found. Find a new address and store it
 	 * in variables given by the caller.
 	 */
-	if (pf_map_addr(af, r, saddr, naddr, nkif, init_addr, rpool) != 0) {
-		/* pf_map_addr() sets reason counters on its own */
+	if ((reason = pf_map_addr(af, r, saddr, naddr, nkif, init_addr,
+	    rpool)) != 0) {
+		if (V_pf_status.debug >= PF_DEBUG_MISC)
+			printf("%s: pf_map_addr has failed\n", __func__);
 		goto done;
 	}
 
 	if (V_pf_status.debug >= PF_DEBUG_NOISY &&
 	    (rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) {
-		printf("pf_map_addr: selected address ");
+		printf("%s: selected address ", __func__);
 		pf_print_host(naddr, 0, af);
 		if (nkif)
 			printf("@%s", (*nkif)->pfik_name);
@@ -835,12 +823,8 @@ pf_map_addr_sn(sa_family_t af, struct pf_krule *r, struct pf_addr *saddr,
 	}
 
 done:
-	if ((*sn) != NULL)
-		PF_SRC_NODE_UNLOCK(*sn);
-
-	if (reason) {
-		counter_u64_add(V_pf_status.counters[reason], 1);
-	}
+	if (sn != NULL)
+		PF_SRC_NODE_UNLOCK(sn);
 
 	return (reason);
 }
@@ -890,8 +874,6 @@ pf_get_transaddr(struct pf_test_ctx *ctx, struct pf_krule *r,
 {
 	struct pf_pdesc	*pd = ctx->pd;
 	struct pf_addr	*naddr;
-	struct pf_ksrc_node	*sn = NULL;
-	struct pf_srchash	*sh = NULL;
 	uint16_t	*nportp;
 	uint16_t	 low, high;
 	u_short		 reason;
@@ -919,8 +901,8 @@ pf_get_transaddr(struct pf_test_ctx *ctx, struct pf_krule *r,
 			high = rpool->proxy_port[1];
 		}
 		if (rpool->mape.offset > 0) {
-			if (pf_get_mape_sport(pd, r, naddr, nportp, &sn,
-			    &sh, &ctx->udp_mapping, rpool)) {
+			if (pf_get_mape_sport(pd, r, naddr, nportp,
+			    &ctx->udp_mapping, rpool)) {
 				DPFPRINTF(PF_DEBUG_MISC,
 				    ("pf: MAP-E port allocation (%u/%u/%u)"
 				    " failed\n",
@@ -930,8 +912,8 @@ pf_get_transaddr(struct pf_test_ctx *ctx, struct pf_krule *r,
 				reason = PFRES_MAPFAILED;
 				goto notrans;
 			}
-		} else if (pf_get_sport(pd, r, naddr, nportp, low, high, &sn,
-		    &sh, rpool, &ctx->udp_mapping, PF_SN_NAT)) {
+		} else if (pf_get_sport(pd, r, naddr, nportp, low, high,
+		    rpool, &ctx->udp_mapping, PF_SN_NAT)) {
 			DPFPRINTF(PF_DEBUG_MISC,
 			    ("pf: NAT proxy port allocation (%u-%u) failed\n",
 			    rpool->proxy_port[0], rpool->proxy_port[1]));
@@ -1017,7 +999,7 @@ pf_get_transaddr(struct pf_test_ctx *ctx, struct pf_krule *r,
 		uint16_t cut, low, high, nport;
 
 		reason = pf_map_addr_sn(pd->af, r, &pd->nsaddr, naddr, NULL,
-		    NULL, &sn, &sh, rpool, PF_SN_NAT);
+		    NULL, rpool, PF_SN_NAT);
 		if (reason != 0)
 			goto notrans;
 		if ((rpool->opts & PF_POOL_TYPEMASK) == PF_POOL_BITMASK)
@@ -1134,8 +1116,6 @@ pf_get_transaddr_af(struct pf_krule *r, struct pf_pdesc *pd)
 	struct pf_addr	 ndaddr, nsaddr, naddr;
 	u_int16_t	 nport = 0;
 	int		 prefixlen = 96;
-	struct pf_srchash	*sh = NULL;
-	struct pf_ksrc_node	*sns = NULL;
 
 	bzero(&nsaddr, sizeof(nsaddr));
 	bzero(&ndaddr, sizeof(ndaddr));
@@ -1154,9 +1134,8 @@ pf_get_transaddr_af(struct pf_krule *r, struct pf_pdesc *pd)
 		panic("pf_get_transaddr_af: no nat pool for source address");
 
 	/* get source address and port */
-	if (pf_get_sport(pd, r, &nsaddr, &nport,
-	    r->nat.proxy_port[0], r->nat.proxy_port[1], &sns, &sh, &r->nat,
-	    NULL, PF_SN_NAT)) {
+	if (pf_get_sport(pd, r, &nsaddr, &nport, r->nat.proxy_port[0],
+	    r->nat.proxy_port[1], &r->nat, NULL, PF_SN_NAT)) {
 		DPFPRINTF(PF_DEBUG_MISC,
 		    ("pf: af-to NAT proxy port allocation (%u-%u) failed",
 		    r->nat.proxy_port[0], r->nat.proxy_port[1]));
@@ -1182,7 +1161,7 @@ pf_get_transaddr_af(struct pf_krule *r, struct pf_pdesc *pd)
 	/* get the destination address and port */
 	if (! TAILQ_EMPTY(&r->rdr.list)) {
 		if (pf_map_addr_sn(pd->naf, r, &nsaddr, &naddr, NULL, NULL,
-		    &sns, NULL, &r->rdr, PF_SN_NAT))
+		    &r->rdr, PF_SN_NAT))
 			return (-1);
 		if (r->rdr.proxy_port[0])
 			pd->ndport = htons(r->rdr.proxy_port[0]);