1 /*	$OpenBSD: pfe_filter.c,v 1.67 2026/03/02 19:28:01 rsadowski Exp $	*/
2 
3 /*
4  * Copyright (c) 2006 Pierre-Yves Ritschard <pyr@openbsd.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 #include <sys/types.h>
20 #include <sys/queue.h>
21 #include <sys/socket.h>
22 #include <sys/time.h>
23 #include <sys/ioctl.h>
24 
25 #include <net/if.h>
26 #include <netinet/in.h>
27 #include <netinet/tcp.h>
28 #include <arpa/inet.h>
29 #include <net/pfvar.h>
30 
31 #include <limits.h>
32 #include <string.h>
33 #include <stdio.h>
34 #include <stdlib.h>
35 #include <unistd.h>
36 #include <errno.h>
37 
38 #define MINIMUM(a, b)	(((a) < (b)) ? (a) : (b))
39 
40 #include "relayd.h"
41 #include "log.h"
42 
43 int	 transaction_init(struct relayd *, const char *);
44 int	 transaction_commit(struct relayd *);
45 void	 kill_tables(struct relayd *);
46 int	 kill_srcnodes(struct relayd *, struct table *);
47 
48 void
49 init_tables(struct relayd *env)
50 {
51 	int			 i;
52 	struct rdr		*rdr;
53 	struct pfr_table	*tables;
54 	struct pfioc_table	 io;
55 
56 	if (!(env->sc_conf.flags & F_NEEDPF))
57 		return;
58 
59 	if ((tables = calloc(env->sc_rdrcount, sizeof(*tables))) == NULL)
60 		fatal("calloc");
61 	i = 0;
62 
63 	TAILQ_FOREACH(rdr, env->sc_rdrs, entry) {
64 		if (strlcpy(tables[i].pfrt_anchor, RELAYD_ANCHOR "/",
65 		    sizeof(tables[i].pfrt_anchor)) >= PF_ANCHOR_NAME_SIZE)
66 			goto toolong;
67 		if (strlcat(tables[i].pfrt_anchor, rdr->conf.name,
68 		    sizeof(tables[i].pfrt_anchor)) >= PF_ANCHOR_NAME_SIZE)
69 			goto toolong;
70 		if (strlcpy(tables[i].pfrt_name, rdr->conf.name,
71 		    sizeof(tables[i].pfrt_name)) >=
72 		    sizeof(tables[i].pfrt_name))
73 			goto toolong;
74 		tables[i].pfrt_flags |= PFR_TFLAG_PERSIST;
75 		i++;
76 	}
77 	if (i != env->sc_rdrcount)
78 		fatalx("%s: table count modified", __func__);
79 
80 	memset(&io, 0, sizeof(io));
81 	io.pfrio_size = env->sc_rdrcount;
82 	io.pfrio_esize = sizeof(*tables);
83 	io.pfrio_buffer = tables;
84 
85 	if (ioctl(env->sc_pf->dev, DIOCRADDTABLES, &io) == -1)
86 		fatal("%s: cannot create tables", __func__);
87 	log_debug("%s: created %d tables", __func__, io.pfrio_nadd);
88 
89 	free(tables);
90 
91 	if (io.pfrio_nadd == env->sc_rdrcount)
92 		return;
93 
94 	/*
95 	 * clear all tables, since some already existed
96 	 */
97 	TAILQ_FOREACH(rdr, env->sc_rdrs, entry)
98 		flush_table(env, rdr);
99 
100 	return;
101 
102  toolong:
103 	fatal("%s: name too long", __func__);
104 }
105 
106 void
107 kill_tables(struct relayd *env)
108 {
109 	struct pfioc_table	 io;
110 	struct rdr		*rdr;
111 	int			 cnt = 0;
112 
113 	if (!(env->sc_conf.flags & F_NEEDPF))
114 		return;
115 
116 	TAILQ_FOREACH(rdr, env->sc_rdrs, entry) {
117 		memset(&io, 0, sizeof(io));
118 		if (strlcpy(io.pfrio_table.pfrt_anchor, RELAYD_ANCHOR "/",
119 		    sizeof(io.pfrio_table.pfrt_anchor)) >= PF_ANCHOR_NAME_SIZE)
120 			goto toolong;
121 		if (strlcat(io.pfrio_table.pfrt_anchor, rdr->conf.name,
122 		    sizeof(io.pfrio_table.pfrt_anchor)) >= PF_ANCHOR_NAME_SIZE)
123 			goto toolong;
124 		if (ioctl(env->sc_pf->dev, DIOCRCLRTABLES, &io) == -1)
125 			fatal("%s: ioctl failed", __func__);
126 		cnt += io.pfrio_ndel;
127 	}
128 	log_debug("%s: deleted %d tables", __func__, cnt);
129 	return;
130 
131  toolong:
132 	fatal("%s: name too long", __func__);
133 }
134 
135 void
136 sync_table(struct relayd *env, struct rdr *rdr, struct table *table)
137 {
138 	int			 i, cnt = 0;
139 	struct pfioc_table	 io;
140 	struct pfr_addr		*addlist;
141 	struct sockaddr_in	*sain;
142 	struct sockaddr_in6	*sain6;
143 	struct host		*host;
144 
145 	if (!(env->sc_conf.flags & F_NEEDPF))
146 		return;
147 
148 	if (table == NULL)
149 		return;
150 
151 	if (table->up == 0) {
152 		flush_table(env, rdr);
153 		return;
154 	}
155 
156 	if ((addlist = calloc(table->up, sizeof(*addlist))) == NULL)
157 		fatal("calloc");
158 
159 	memset(&io, 0, sizeof(io));
160 	io.pfrio_esize = sizeof(struct pfr_addr);
161 	io.pfrio_size = table->up;
162 	io.pfrio_size2 = 0;
163 	io.pfrio_buffer = addlist;
164 	if (strlcpy(io.pfrio_table.pfrt_anchor, RELAYD_ANCHOR "/",
165 	    sizeof(io.pfrio_table.pfrt_anchor)) >= PF_ANCHOR_NAME_SIZE)
166 		goto toolong;
167 	if (strlcat(io.pfrio_table.pfrt_anchor, rdr->conf.name,
168 	    sizeof(io.pfrio_table.pfrt_anchor)) >= PF_ANCHOR_NAME_SIZE)
169 		goto toolong;
170 	if (strlcpy(io.pfrio_table.pfrt_name, rdr->conf.name,
171 	    sizeof(io.pfrio_table.pfrt_name)) >=
172 	    sizeof(io.pfrio_table.pfrt_name))
173 		goto toolong;
174 
175 	i = 0;
176 	TAILQ_FOREACH(host, &table->hosts, entry) {
177 		if (host->up != HOST_UP)
178 			continue;
179 		memset(&(addlist[i]), 0, sizeof(addlist[i]));
180 		switch (host->conf.ss.ss_family) {
181 		case AF_INET:
182 			sain = (struct sockaddr_in *)&host->conf.ss;
183 			addlist[i].pfra_af = AF_INET;
184 			memcpy(&(addlist[i].pfra_ip4addr), &sain->sin_addr,
185 			    sizeof(sain->sin_addr));
186 			addlist[i].pfra_net = 32;
187 			break;
188 		case AF_INET6:
189 			sain6 = (struct sockaddr_in6 *)&host->conf.ss;
190 			addlist[i].pfra_af = AF_INET6;
191 			memcpy(&(addlist[i].pfra_ip6addr), &sain6->sin6_addr,
192 			    sizeof(sain6->sin6_addr));
193 			addlist[i].pfra_net = 128;
194 			break;
195 		default:
196 			fatalx("%s: unknown address family", __func__);
197 			break;
198 		}
199 		i++;
200 	}
201 	if (i != table->up)
202 		fatalx("%s: desynchronized", __func__);
203 
204 	if (ioctl(env->sc_pf->dev, DIOCRSETADDRS, &io) == -1)
205 		fatal("%s: cannot set address list", __func__);
206 	if (rdr->conf.flags & F_STICKY)
207 		cnt = kill_srcnodes(env, table);
208 	free(addlist);
209 
210 	if (env->sc_conf.opts & RELAYD_OPT_LOGUPDATE)
211 		log_info("table %s: %d added, %d deleted, "
212 		    "%d changed, %d killed", io.pfrio_table.pfrt_name,
213 		    io.pfrio_nadd, io.pfrio_ndel, io.pfrio_nchange, cnt);
214 	return;
215 
216  toolong:
217 	fatal("%s: name too long", __func__);
218 }
219 
220 int
221 kill_srcnodes(struct relayd *env, struct table *table)
222 {
223 	struct host			*host;
224 	struct pfioc_src_node_kill	 psnk;
225 	int				 cnt = 0;
226 	struct sockaddr_in		*sain;
227 	struct sockaddr_in6		*sain6;
228 
229 	bzero(&psnk, sizeof(psnk));
230 
231 	/* Only match the destination address, source mask will be zero */
232 	memset(&psnk.psnk_dst.addr.v.a.mask, 0xff,
233 	    sizeof(psnk.psnk_dst.addr.v.a.mask));
234 
235 	TAILQ_FOREACH(host, &table->hosts, entry) {
236 		if (host->up != HOST_DOWN)
237 			continue;
238 
239 		switch (host->conf.ss.ss_family) {
240 		case AF_INET:
241 		sain = (struct sockaddr_in *)&host->conf.ss;
242 			bcopy(&sain->sin_addr,
243 			    &psnk.psnk_dst.addr.v.a.addr.v4,
244 			    sizeof(psnk.psnk_dst.addr.v.a.addr.v4));
245 			break;
246 		case AF_INET6:
247 			sain6 = (struct sockaddr_in6 *)&host->conf.ss;
248 			bcopy(&sain6->sin6_addr,
249 			    &psnk.psnk_dst.addr.v.a.addr.v6,
250 			    sizeof(psnk.psnk_dst.addr.v.a.addr.v6));
251 			break;
252 		default:
253 			fatalx("%s: unknown address family", __func__);
254 			break;
255 		}
256 
257 		psnk.psnk_af = host->conf.ss.ss_family;
258 		psnk.psnk_killed = 0;
259 
260 		if (ioctl(env->sc_pf->dev,
261 		    DIOCKILLSRCNODES, &psnk) == -1)
262 			fatal("%s: cannot kill src nodes", __func__);
263 		cnt += psnk.psnk_killed;
264 	}
265 
266 	return (cnt);
267 }
268 
269 void
270 flush_table(struct relayd *env, struct rdr *rdr)
271 {
272 	struct pfioc_table	io;
273 
274 	if (!(env->sc_conf.flags & F_NEEDPF))
275 		return;
276 
277 	memset(&io, 0, sizeof(io));
278 	if (strlcpy(io.pfrio_table.pfrt_anchor, RELAYD_ANCHOR "/",
279 	    sizeof(io.pfrio_table.pfrt_anchor)) >= PF_ANCHOR_NAME_SIZE)
280 		goto toolong;
281 	if (strlcat(io.pfrio_table.pfrt_anchor, rdr->conf.name,
282 	    sizeof(io.pfrio_table.pfrt_anchor)) >= PF_ANCHOR_NAME_SIZE)
283 		goto toolong;
284 	if (strlcpy(io.pfrio_table.pfrt_name, rdr->conf.name,
285 	    sizeof(io.pfrio_table.pfrt_name)) >=
286 	    sizeof(io.pfrio_table.pfrt_name))
287 		goto toolong;
288 	if (ioctl(env->sc_pf->dev, DIOCRCLRADDRS, &io) == -1)
289 		fatal("%s: cannot flush table addresses", __func__);
290 
291 	io.pfrio_esize = sizeof(io.pfrio_table);
292 	io.pfrio_size = 1;
293 	io.pfrio_buffer = &io.pfrio_table;
294 	if (ioctl(env->sc_pf->dev, DIOCRCLRTSTATS, &io) == -1)
295 		fatal("%s: cannot flush table stats", __func__);
296 
297 	log_debug("%s: flushed table %s", __func__, rdr->conf.name);
298 	return;
299 
300  toolong:
301 	fatal("%s: name too long", __func__);
302 }
303 
304 int
305 transaction_init(struct relayd *env, const char *anchor)
306 {
307 	env->sc_pf->pft.size = 1;
308 	env->sc_pf->pft.esize = sizeof(env->sc_pf->pfte);
309 	env->sc_pf->pft.array = &env->sc_pf->pfte;
310 
311 	bzero(&env->sc_pf->pfte, sizeof(env->sc_pf->pfte));
312 	(void)strlcpy(env->sc_pf->pfte.anchor,
313 	    anchor, PF_ANCHOR_NAME_SIZE);
314 	env->sc_pf->pfte.type = PF_TRANS_RULESET;
315 
316 	if (ioctl(env->sc_pf->dev, DIOCXBEGIN,
317 	    &env->sc_pf->pft) == -1)
318 		return (-1);
319 
320 	return (0);
321 }
322 
323 int
324 transaction_commit(struct relayd *env)
325 {
326 	if (ioctl(env->sc_pf->dev, DIOCXCOMMIT,
327 	    &env->sc_pf->pft) == -1)
328 		return (-1);
329 
330 	return (0);
331 }
332 
333 void
334 sync_ruleset(struct relayd *env, struct rdr *rdr, int enable)
335 {
336 	struct pfioc_rule	 rio;
337 	struct sockaddr_in	*sain;
338 	struct sockaddr_in6	*sain6;
339 	struct address		*address;
340 	char			 anchor[PF_ANCHOR_NAME_SIZE];
341 	struct table		*t = rdr->table;
342 
343 	if ((env->sc_conf.flags & F_NEEDPF) == 0)
344 		return;
345 
346 	bzero(anchor, sizeof(anchor));
347 	if (strlcpy(anchor, RELAYD_ANCHOR "/", sizeof(anchor)) >=
348 	    PF_ANCHOR_NAME_SIZE)
349 		goto toolong;
350 	if (strlcat(anchor, rdr->conf.name, sizeof(anchor)) >=
351 	    PF_ANCHOR_NAME_SIZE)
352 		goto toolong;
353 	if (transaction_init(env, anchor) == -1) {
354 		log_warn("%s: transaction init failed", __func__);
355 		return;
356 	}
357 
358 	if (!enable) {
359 		if (transaction_commit(env) == -1)
360 			log_warn("%s: remove rules transaction failed",
361 			    __func__);
362 		else
363 			log_debug("%s: rules removed", __func__);
364 		return;
365 	}
366 
367 	TAILQ_FOREACH(address, &rdr->virts, entry) {
368 		memset(&rio, 0, sizeof(rio));
369 		(void)strlcpy(rio.anchor, anchor, sizeof(rio.anchor));
370 
371 		if (rdr->conf.flags & F_MATCH) {
372 			rio.rule.action = PF_MATCH;
373 			rio.rule.quick = 0;
374 		} else {
375 			rio.rule.action = PF_PASS;
376 			rio.rule.quick = 1; /* force first match */
377 		}
378 		rio.rule.direction = PF_IN;
379 		rio.rule.keep_state = PF_STATE_NORMAL;
380 
381 		if (rdr->conf.flags & F_PFLOG)
382 			rio.rule.log = 1;
383 		else
384 			rio.rule.log = 0; /* allow change via reload */
385 
386 		switch (t->conf.fwdmode) {
387 		case FWD_NORMAL:
388 			/* traditional redirection */
389 			if (address->ipproto == IPPROTO_TCP) {
390 				rio.rule.flags = TH_SYN;
391 				rio.rule.flagset = (TH_SYN|TH_ACK);
392 			}
393 			break;
394 		case FWD_ROUTE:
395 			/* re-route with pf for DSR (direct server return) */
396 			rio.rule.rt = PF_ROUTETO;
397 
398 			/* Use sloppy state handling for half connections */
399 			rio.rule.rule_flag = PFRULE_STATESLOPPY;
400 			break;
401 		default:
402 			fatalx("%s: invalid forward mode", __func__);
403 			/* NOTREACHED */
404 		}
405 
406 		rio.ticket = env->sc_pf->pfte.ticket;
407 
408 		rio.rule.af = address->ss.ss_family;
409 		rio.rule.proto = address->ipproto;
410 		rio.rule.src.addr.type = PF_ADDR_ADDRMASK;
411 		rio.rule.dst.addr.type = PF_ADDR_ADDRMASK;
412 		rio.rule.dst.port_op = address->port.op;
413 		rio.rule.dst.port[0] = address->port.val[0];
414 		rio.rule.dst.port[1] = address->port.val[1];
415 		rio.rule.rtableid = -1; /* stay in the main routing table */
416 		rio.rule.onrdomain = env->sc_rtable;
417 		DPRINTF("%s rtable %d",__func__,env->sc_rtable);
418 
419 		if (rio.rule.proto == IPPROTO_TCP)
420 			rio.rule.timeout[PFTM_TCP_ESTABLISHED] =
421 			    (u_int32_t)MINIMUM(rdr->conf.timeout.tv_sec,
422 			    INT_MAX);
423 
424 		if (strlen(rdr->conf.tag))
425 			(void)strlcpy(rio.rule.tagname, rdr->conf.tag,
426 			    sizeof(rio.rule.tagname));
427 		if (strlen(address->ifname))
428 			(void)strlcpy(rio.rule.ifname, address->ifname,
429 			    sizeof(rio.rule.ifname));
430 
431 		if (address->ss.ss_family == AF_INET) {
432 			sain = (struct sockaddr_in *)&address->ss;
433 
434 			rio.rule.dst.addr.v.a.addr.addr32[0] =
435 			    sain->sin_addr.s_addr;
436 			rio.rule.dst.addr.v.a.mask.addr32[0] = 0xffffffff;
437 		} else {
438 			sain6 = (struct sockaddr_in6 *)&address->ss;
439 
440 			memcpy(&rio.rule.dst.addr.v.a.addr.v6,
441 			    &sain6->sin6_addr.s6_addr,
442 			    sizeof(sain6->sin6_addr.s6_addr));
443 			memset(&rio.rule.dst.addr.v.a.mask.addr8, 0xff, 16);
444 		}
445 
446 		rio.rule.nat.addr.type = PF_ADDR_NONE;
447 		rio.rule.rdr.addr.type = PF_ADDR_TABLE;
448 		if (strlen(t->conf.ifname))
449 			(void)strlcpy(rio.rule.rdr.ifname, t->conf.ifname,
450 			    sizeof(rio.rule.rdr.ifname));
451 		if (strlcpy(rio.rule.rdr.addr.v.tblname, rdr->conf.name,
452 		    sizeof(rio.rule.rdr.addr.v.tblname)) >=
453 		    sizeof(rio.rule.rdr.addr.v.tblname))
454 			fatal("%s: table name too long", __func__);
455 
456 		if (address->port.op == PF_OP_EQ ||
457 		    rdr->table->conf.flags & F_PORT) {
458 			rio.rule.rdr.proxy_port[0] =
459 			    ntohs(rdr->table->conf.port);
460 			rio.rule.rdr.port_op = PF_OP_EQ;
461 		}
462 
463 		switch (rdr->conf.mode) {
464 		case RELAY_DSTMODE_RANDOM:
465 			rio.rule.rdr.opts = PF_POOL_RANDOM;
466 			break;
467 		case RELAY_DSTMODE_ROUNDROBIN:
468 			rio.rule.rdr.opts = PF_POOL_ROUNDROBIN;
469 			break;
470 		case RELAY_DSTMODE_SRCHASH:
471 			rio.rule.rdr.opts = PF_POOL_SRCHASH;
472 			break;
473 		case RELAY_DSTMODE_LEASTSTATES:
474 			rio.rule.rdr.opts = PF_POOL_LEASTSTATES;
475 			break;
476 		default:
477 			fatalx("%s: unsupported mode", __func__);
478 			/* NOTREACHED */
479 		}
480 		if (rdr->conf.flags & F_STICKY)
481 			rio.rule.rdr.opts |= PF_POOL_STICKYADDR;
482 		if (rdr->conf.flags & F_HASHKEY)
483 			memcpy(rio.rule.rdr.key.key32, rdr->conf.key.data,
484 			    sizeof(rio.rule.rdr.key.key32));
485 
486 		if (rio.rule.rt == PF_ROUTETO) {
487 			memcpy(&rio.rule.route, &rio.rule.rdr,
488 			    sizeof(rio.rule.route));
489 			rio.rule.rdr.addr.type = PF_ADDR_NONE;
490 		}
491 
492 		if (ioctl(env->sc_pf->dev, DIOCADDRULE, &rio) == -1)
493 			fatal("cannot add rule");
494 		log_debug("%s: rule added to anchor \"%s\"", __func__, anchor);
495 	}
496 	if (transaction_commit(env) == -1)
497 		log_warn("%s: add rules transaction failed", __func__);
498 	return;
499 
500  toolong:
501 	fatal("%s: name too long", __func__);
502 }
503 
504 void
505 flush_rulesets(struct relayd *env)
506 {
507 	struct rdr	*rdr;
508 	char		 anchor[PF_ANCHOR_NAME_SIZE];
509 
510 	if (!(env->sc_conf.flags & F_NEEDPF))
511 		return;
512 
513 	kill_tables(env);
514 	TAILQ_FOREACH(rdr, env->sc_rdrs, entry) {
515 		if (strlcpy(anchor, RELAYD_ANCHOR "/", sizeof(anchor)) >=
516 		    PF_ANCHOR_NAME_SIZE)
517 			goto toolong;
518 		if (strlcat(anchor, rdr->conf.name, sizeof(anchor)) >=
519 		    PF_ANCHOR_NAME_SIZE)
520 			goto toolong;
521 		if (transaction_init(env, anchor) == -1 ||
522 		    transaction_commit(env) == -1)
523 			log_warn("%s: transaction for %s/ failed", __func__,
524 			    RELAYD_ANCHOR);
525 	}
526 	if (strlcpy(anchor, RELAYD_ANCHOR, sizeof(anchor)) >=
527 	    PF_ANCHOR_NAME_SIZE)
528 		goto toolong;
529 	if (transaction_init(env, anchor) == -1 ||
530 	    transaction_commit(env) == -1)
531 		log_warn("%s: transaction for %s failed", __func__,
532 		    RELAYD_ANCHOR);
533 	log_debug("%s: flushed rules", __func__);
534 	return;
535 
536  toolong:
537 	fatal("%s: name too long", __func__);
538 }
539 
540 int
541 natlook(struct relayd *env, struct ctl_natlook *cnl)
542 {
543 	struct pfioc_natlook	 pnl;
544 	struct sockaddr_in	*in, *out;
545 	struct sockaddr_in6	*in6, *out6;
546 	char			 ibuf[BUFSIZ], obuf[BUFSIZ];
547 
548 	if (!(env->sc_conf.flags & F_NEEDPF))
549 		return (0);
550 
551 	bzero(&pnl, sizeof(pnl));
552 
553 	if ((pnl.af = cnl->src.ss_family) != cnl->dst.ss_family)
554 		fatalx("%s: illegal address families", __func__);
555 	switch (pnl.af) {
556 	case AF_INET:
557 		in = (struct sockaddr_in *)&cnl->src;
558 		out = (struct sockaddr_in *)&cnl->dst;
559 		bcopy(&in->sin_addr, &pnl.saddr.v4, sizeof(pnl.saddr.v4));
560 		pnl.sport = in->sin_port;
561 		bcopy(&out->sin_addr, &pnl.daddr.v4, sizeof(pnl.daddr.v4));
562 		pnl.dport = out->sin_port;
563 		break;
564 	case AF_INET6:
565 		in6 = (struct sockaddr_in6 *)&cnl->src;
566 		out6 = (struct sockaddr_in6 *)&cnl->dst;
567 		bcopy(&in6->sin6_addr, &pnl.saddr.v6, sizeof(pnl.saddr.v6));
568 		pnl.sport = in6->sin6_port;
569 		bcopy(&out6->sin6_addr, &pnl.daddr.v6, sizeof(pnl.daddr.v6));
570 		pnl.dport = out6->sin6_port;
571 	}
572 	pnl.proto = cnl->proto;
573 	pnl.direction = PF_IN;
574 	cnl->in = 1;
575 
576 	if (ioctl(env->sc_pf->dev, DIOCNATLOOK, &pnl) == -1) {
577 		pnl.direction = PF_OUT;
578 		cnl->in = 0;
579 		if (ioctl(env->sc_pf->dev, DIOCNATLOOK, &pnl) == -1) {
580 			log_debug("%s: ioctl: %s", __func__, strerror(errno));
581 			return (-1);
582 		}
583 	}
584 
585 	inet_ntop(pnl.af, &pnl.rsaddr, ibuf, sizeof(ibuf));
586 	inet_ntop(pnl.af, &pnl.rdaddr, obuf, sizeof(obuf));
587 	log_debug("%s: %s %s:%d -> %s:%d", __func__,
588 	    pnl.direction == PF_IN ? "in" : "out",
589 	    ibuf, ntohs(pnl.rsport), obuf, ntohs(pnl.rdport));
590 
591 	switch (pnl.af) {
592 	case AF_INET:
593 		in = (struct sockaddr_in *)&cnl->rsrc;
594 		out = (struct sockaddr_in *)&cnl->rdst;
595 		bcopy(&pnl.rsaddr.v4, &in->sin_addr, sizeof(in->sin_addr));
596 		in->sin_port = pnl.rsport;
597 		bcopy(&pnl.rdaddr.v4, &out->sin_addr, sizeof(out->sin_addr));
598 		out->sin_port = pnl.rdport;
599 		break;
600 	case AF_INET6:
601 		in6 = (struct sockaddr_in6 *)&cnl->rsrc;
602 		out6 = (struct sockaddr_in6 *)&cnl->rdst;
603 		bcopy(&pnl.rsaddr.v6, &in6->sin6_addr, sizeof(in6->sin6_addr));
604 		bcopy(&pnl.rdaddr.v6, &out6->sin6_addr,
605 		    sizeof(out6->sin6_addr));
606 		break;
607 	}
608 	cnl->rsrc.ss_family = pnl.af;
609 	cnl->rdst.ss_family = pnl.af;
610 	cnl->rsport = pnl.rsport;
611 	cnl->rdport = pnl.rdport;
612 
613 	return (0);
614 }
615 
616 u_int64_t
617 check_table(struct relayd *env, struct rdr *rdr, struct table *table)
618 {
619 	struct pfioc_table	 io;
620 	struct pfr_tstats	 tstats;
621 
622 	if (table == NULL)
623 		return (0);
624 
625 	bzero(&io, sizeof(io));
626 	io.pfrio_esize = sizeof(struct pfr_tstats);
627 	io.pfrio_size = 1;
628 	io.pfrio_buffer = &tstats;
629 	if (strlcpy(io.pfrio_table.pfrt_anchor, RELAYD_ANCHOR "/",
630 	    sizeof(io.pfrio_table.pfrt_anchor)) >= PF_ANCHOR_NAME_SIZE)
631 		goto toolong;
632 	if (strlcat(io.pfrio_table.pfrt_anchor, rdr->conf.name,
633 	    sizeof(io.pfrio_table.pfrt_anchor)) >= PF_ANCHOR_NAME_SIZE)
634 		goto toolong;
635 	if (strlcpy(io.pfrio_table.pfrt_name, rdr->conf.name,
636 	    sizeof(io.pfrio_table.pfrt_name)) >=
637 	    sizeof(io.pfrio_table.pfrt_name))
638 		goto toolong;
639 
640 	if (ioctl(env->sc_pf->dev, DIOCRGETTSTATS, &io) == -1)
641 		fatal("%s: cannot get table stats for %s@%s", __func__,
642 		    io.pfrio_table.pfrt_name, io.pfrio_table.pfrt_anchor);
643 
644 	return (tstats.pfrts_match);
645 
646  toolong:
647 	fatal("%s: name too long", __func__);
648 	return (0);
649 }