242 	struct pfr_ktable       *kt;  in pfr_clr_addrs()  local
249 	kt = pfr_lookup_table(tbl);  in pfr_clr_addrs()
250 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {  in pfr_clr_addrs()
253 	if (kt->pfrkt_flags & PFR_TFLAG_CONST) {  in pfr_clr_addrs()
256 	pfr_enqueue_addrs(kt, &workq, ndel, 0);  in pfr_clr_addrs()
259 		pfr_remove_kentries(kt, &workq);  in pfr_clr_addrs()
260 		if (kt->pfrkt_cnt) {  in pfr_clr_addrs()
262 			    kt->pfrkt_cnt);  in pfr_clr_addrs()
263 			kt->pfrkt_cnt = 0;  in pfr_clr_addrs()
273 	struct pfr_ktable       *kt, *tmpkt;  in pfr_add_addrs()  local
286 	kt = pfr_lookup_table(tbl);  in pfr_add_addrs()
287 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {  in pfr_add_addrs()
290 	if (kt->pfrkt_flags & PFR_TFLAG_CONST) {  in pfr_add_addrs()
305 		p = pfr_lookup_addr(kt, &ad, 1);  in pfr_add_addrs()
340 		pfr_insert_kentries(kt, &workq, tzero);  in pfr_add_addrs()
363 	struct pfr_ktable       *kt;  in pfr_del_addrs()  local
375 	kt = pfr_lookup_table(tbl);  in pfr_del_addrs()
376 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {  in pfr_del_addrs()
379 	if (kt->pfrkt_flags & PFR_TFLAG_CONST) {  in pfr_del_addrs()
393 	for (i = kt->pfrkt_cnt; i > 0; i >>= 1) {  in pfr_del_addrs()
396 	if (size > kt->pfrkt_cnt / log) {  in pfr_del_addrs()
398 		pfr_mark_addrs(kt);  in pfr_del_addrs()
408 			p = pfr_lookup_addr(kt, &ad, 1);  in pfr_del_addrs()
422 		p = pfr_lookup_addr(kt, &ad, 1);  in pfr_del_addrs()
447 		pfr_remove_kentries(kt, &workq);  in pfr_del_addrs()
465 	struct pfr_ktable       *kt, *tmpkt;  in pfr_set_addrs()  local
479 	kt = pfr_lookup_table(tbl);  in pfr_set_addrs()
480 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {  in pfr_set_addrs()
483 	if (kt->pfrkt_flags & PFR_TFLAG_CONST) {  in pfr_set_addrs()
490 	pfr_mark_addrs(kt);  in pfr_set_addrs()
502 		p = pfr_lookup_addr(kt, &ad, 1);  in pfr_set_addrs()
541 	pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY);  in pfr_set_addrs()
561 		pfr_insert_kentries(kt, &addq, tzero);  in pfr_set_addrs()
562 		pfr_remove_kentries(kt, &delq);  in pfr_set_addrs()
595 	struct pfr_ktable       *kt;  in pfr_tst_addrs()  local
604 	kt = pfr_lookup_table(tbl);  in pfr_tst_addrs()
605 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {  in pfr_tst_addrs()
619 		p = pfr_lookup_addr(kt, &ad, 0);  in pfr_tst_addrs()
642 	struct pfr_ktable       *kt;  in pfr_get_addrs()  local
650 	kt = pfr_lookup_table(tbl);  in pfr_get_addrs()
651 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {  in pfr_get_addrs()
654 	if (kt->pfrkt_cnt > *size) {  in pfr_get_addrs()
655 		*size = kt->pfrkt_cnt;  in pfr_get_addrs()
662 	w.pfrw_free = kt->pfrkt_cnt;  in pfr_get_addrs()
664 	rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);  in pfr_get_addrs()
666 		rv = kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6,  in pfr_get_addrs()
678 	*size = kt->pfrkt_cnt;  in pfr_get_addrs()
686 	struct pfr_ktable       *kt;  in pfr_get_astats()  local
697 	kt = pfr_lookup_table(tbl);  in pfr_get_astats()
698 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {  in pfr_get_astats()
701 	if (kt->pfrkt_cnt > *size) {  in pfr_get_astats()
702 		*size = kt->pfrkt_cnt;  in pfr_get_astats()
709 	w.pfrw_free = kt->pfrkt_cnt;  in pfr_get_astats()
711 	rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);  in pfr_get_astats()
713 		rv = kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6,  in pfr_get_astats()
717 		pfr_enqueue_addrs(kt, &workq, NULL, 0);  in pfr_get_astats()
729 	*size = kt->pfrkt_cnt;  in pfr_get_astats()
737 	struct pfr_ktable       *kt;  in pfr_clr_astats()  local
749 	kt = pfr_lookup_table(tbl);  in pfr_clr_astats()
750 	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {  in pfr_clr_astats()
761 		p = pfr_lookup_addr(kt, &ad, 1);  in pfr_clr_astats()
829 pfr_enqueue_addrs(struct pfr_ktable *kt, struct pfr_kentryworkq *workq,  in pfr_enqueue_addrs()  argument
838 	if (kt->pfrkt_ip4 != NULL) {  in pfr_enqueue_addrs()
839 		if (kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4,  in pfr_enqueue_addrs()
844 	if (kt->pfrkt_ip6 != NULL) {  in pfr_enqueue_addrs()
845 		if (kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6,  in pfr_enqueue_addrs()
856 pfr_mark_addrs(struct pfr_ktable *kt)  in pfr_mark_addrs()  argument
862 	if (kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w)) {  in pfr_mark_addrs()
865 	if (kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w)) {  in pfr_mark_addrs()
872 pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact)  in pfr_lookup_addr()  argument
883 		head = kt->pfrkt_ip4;  in pfr_lookup_addr()
886 		head = kt->pfrkt_ip6;  in pfr_lookup_addr()
957 pfr_insert_kentries(struct pfr_ktable *kt,  in pfr_insert_kentries()  argument
964 		rv = pfr_route_kentry(kt, p);  in pfr_insert_kentries()
973 	kt->pfrkt_cnt += n;  in pfr_insert_kentries()
977 pfr_insert_kentry(struct pfr_ktable *kt, struct pfr_addr *ad, u_int64_t tzero)  in pfr_insert_kentry()  argument
982 	p = pfr_lookup_addr(kt, ad, 1);  in pfr_insert_kentry()
991 	rv = pfr_route_kentry(kt, p);  in pfr_insert_kentry()
997 	kt->pfrkt_cnt++;  in pfr_insert_kentry()
1003 pfr_remove_kentries(struct pfr_ktable *kt,  in pfr_remove_kentries()  argument
1010 		pfr_unroute_kentry(kt, p);  in pfr_remove_kentries()
1013 	kt->pfrkt_cnt -= n;  in pfr_remove_kentries()
1018 pfr_clean_node_mask(struct pfr_ktable *kt,  in pfr_clean_node_mask()  argument
1024 	pfr_unroute_kentry(kt, p);  in pfr_clean_node_mask()
1088 pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)  in pfr_route_kentry()  argument
1098 		head = kt->pfrkt_ip4;  in pfr_route_kentry()
1100 		head = kt->pfrkt_ip6;  in pfr_route_kentry()
1116 pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)  in pfr_unroute_kentry()  argument
1125 		head = kt->pfrkt_ip4;  in pfr_unroute_kentry()
1127 		head = kt->pfrkt_ip6;  in pfr_unroute_kentry()
1657 	struct pfr_ktable       *kt, *rt, *shadow, key;  in pfr_ina_define()  local
1681 	kt = RB_FIND(pfr_ktablehead, &pfr_ktables, (struct pfr_ktable *)(void *)tbl);  in pfr_ina_define()
1682 	if (kt == NULL) {  in pfr_ina_define()
1683 		kt = pfr_create_ktable(tbl, 0, 1);  in pfr_ina_define()
1684 		if (kt == NULL) {  in pfr_ina_define()
1687 		SLIST_INSERT_HEAD(&tableq, kt, pfrkt_workq);  in pfr_ina_define()
1699 			kt->pfrkt_root = rt;  in pfr_ina_define()
1708 		kt->pfrkt_root = rt;  in pfr_ina_define()
1709 	} else if (!(kt->pfrkt_flags & PFR_TFLAG_INACTIVE)) {  in pfr_ina_define()
1741 		if (kt->pfrkt_shadow != NULL) {  in pfr_ina_define()
1742 			pfr_destroy_ktable(kt->pfrkt_shadow, 1);  in pfr_ina_define()
1744 		kt->pfrkt_flags |= PFR_TFLAG_INACTIVE;  in pfr_ina_define()
1748 		kt->pfrkt_shadow = shadow;  in pfr_ina_define()
1866 pfr_commit_ktable(struct pfr_ktable *kt, u_int64_t tzero)  in pfr_commit_ktable()  argument
1868 	struct pfr_ktable       *shadow = kt->pfrkt_shadow;  in pfr_commit_ktable()
1874 		if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {  in pfr_commit_ktable()
1875 			pfr_clstats_ktable(kt, tzero, 1);  in pfr_commit_ktable()
1877 	} else if (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) {  in pfr_commit_ktable()
1884 		pfr_mark_addrs(kt);  in pfr_commit_ktable()
1893 			q = pfr_lookup_addr(kt, &ad, 1);  in pfr_commit_ktable()
1906 		pfr_enqueue_addrs(kt, &delq, NULL, ENQUEUE_UNMARKED_ONLY);  in pfr_commit_ktable()
1907 		pfr_insert_kentries(kt, &addq, tzero);  in pfr_commit_ktable()
1908 		pfr_remove_kentries(kt, &delq);  in pfr_commit_ktable()
1913 		SWAP(struct radix_node_head *, kt->pfrkt_ip4,  in pfr_commit_ktable()
1915 		SWAP(struct radix_node_head *, kt->pfrkt_ip6,  in pfr_commit_ktable()
1917 		SWAP(int, kt->pfrkt_cnt, shadow->pfrkt_cnt);  in pfr_commit_ktable()
1918 		pfr_clstats_ktable(kt, tzero, 1);  in pfr_commit_ktable()
1921 	    (kt->pfrkt_flags & PFR_TFLAG_SETMASK) | PFR_TFLAG_ACTIVE) &  in pfr_commit_ktable()
1924 	kt->pfrkt_shadow = NULL;  in pfr_commit_ktable()
1925 	pfr_setflags_ktable(kt, nflags);  in pfr_commit_ktable()
2018 pfr_skip_table(struct pfr_table *filter, struct pfr_ktable *kt, int flags)  in pfr_skip_table()  argument
2023 	if (strcmp(filter->pfrt_anchor, kt->pfrkt_anchor)) {  in pfr_skip_table()
2041 pfr_insert_ktable(struct pfr_ktable *kt)  in pfr_insert_ktable()  argument
2045 	RB_INSERT(pfr_ktablehead, &pfr_ktables, kt);  in pfr_insert_ktable()
2047 	if (kt->pfrkt_root != NULL) {  in pfr_insert_ktable()
2048 		if (!kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]++) {  in pfr_insert_ktable()
2049 			pfr_setflags_ktable(kt->pfrkt_root,  in pfr_insert_ktable()
2050 			    kt->pfrkt_root->pfrkt_flags | PFR_TFLAG_REFDANCHOR);  in pfr_insert_ktable()
2069 pfr_setflags_ktable(struct pfr_ktable *kt, int newf)  in pfr_setflags_ktable()  argument
2084 		RB_REMOVE(pfr_ktablehead, &pfr_ktables, kt);  in pfr_setflags_ktable()
2085 		if (kt->pfrkt_root != NULL) {  in pfr_setflags_ktable()
2086 			if (!--kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]) {  in pfr_setflags_ktable()
2087 				pfr_setflags_ktable(kt->pfrkt_root,  in pfr_setflags_ktable()
2088 				    kt->pfrkt_root->pfrkt_flags &  in pfr_setflags_ktable()
2092 		pfr_destroy_ktable(kt, 1);  in pfr_setflags_ktable()
2096 	if (!(newf & PFR_TFLAG_ACTIVE) && kt->pfrkt_cnt) {  in pfr_setflags_ktable()
2097 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);  in pfr_setflags_ktable()
2098 		pfr_remove_kentries(kt, &addrq);  in pfr_setflags_ktable()
2100 	if (!(newf & PFR_TFLAG_INACTIVE) && kt->pfrkt_shadow != NULL) {  in pfr_setflags_ktable()
2101 		pfr_destroy_ktable(kt->pfrkt_shadow, 1);  in pfr_setflags_ktable()
2102 		kt->pfrkt_shadow = NULL;  in pfr_setflags_ktable()
2104 	kt->pfrkt_flags = newf;  in pfr_setflags_ktable()
2119 pfr_clstats_ktable(struct pfr_ktable *kt, u_int64_t tzero, int recurse)  in pfr_clstats_ktable()  argument
2126 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);  in pfr_clstats_ktable()
2129 	bzero(kt->pfrkt_packets, sizeof(kt->pfrkt_packets));  in pfr_clstats_ktable()
2130 	bzero(kt->pfrkt_bytes, sizeof(kt->pfrkt_bytes));  in pfr_clstats_ktable()
2131 	kt->pfrkt_match = kt->pfrkt_nomatch = 0;  in pfr_clstats_ktable()
2132 	kt->pfrkt_tzero = tzero;  in pfr_clstats_ktable()
2138 	struct pfr_ktable       *kt;  in pfr_create_ktable()  local
2143 	kt = pool_get(&pfr_ktable_pl, PR_WAITOK);  in pfr_create_ktable()
2144 	if (kt == NULL) {  in pfr_create_ktable()
2147 	bzero(kt, sizeof(*kt));  in pfr_create_ktable()
2148 	kt->pfrkt_t = *tbl;  in pfr_create_ktable()
2153 			pfr_destroy_ktable(kt, 0);  in pfr_create_ktable()
2156 		kt->pfrkt_rs = rs;  in pfr_create_ktable()
2160 	if (!rn_inithead((void **)&kt->pfrkt_ip4,  in pfr_create_ktable()
2162 	    !rn_inithead((void **)&kt->pfrkt_ip6,  in pfr_create_ktable()
2164 		pfr_destroy_ktable(kt, 0);  in pfr_create_ktable()
2167 	kt->pfrkt_tzero = tzero;  in pfr_create_ktable()
2169 	return kt;  in pfr_create_ktable()
2186 pfr_destroy_ktable(struct pfr_ktable *kt, int flushaddr)  in pfr_destroy_ktable()  argument
2193 		pfr_enqueue_addrs(kt, &addrq, NULL, 0);  in pfr_destroy_ktable()
2194 		pfr_clean_node_mask(kt, &addrq);  in pfr_destroy_ktable()
2197 	if (kt->pfrkt_ip4 != NULL) {  in pfr_destroy_ktable()
2198 		zfree(radix_node_head_zone, kt->pfrkt_ip4);  in pfr_destroy_ktable()
2200 	if (kt->pfrkt_ip6 != NULL) {  in pfr_destroy_ktable()
2201 		zfree(radix_node_head_zone, kt->pfrkt_ip6);  in pfr_destroy_ktable()
2203 	if (kt->pfrkt_shadow != NULL) {  in pfr_destroy_ktable()
2204 		pfr_destroy_ktable(kt->pfrkt_shadow, flushaddr);  in pfr_destroy_ktable()
2206 	if (kt->pfrkt_rs != NULL) {  in pfr_destroy_ktable()
2207 		kt->pfrkt_rs->tables--;  in pfr_destroy_ktable()
2208 		pf_release_ruleset(kt->pfrkt_rs);  in pfr_destroy_ktable()
2210 	pool_put(&pfr_ktable_pl, kt);  in pfr_destroy_ktable()
2235 pfr_match_addr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af)  in pfr_match_addr()  argument
2242 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) {  in pfr_match_addr()
2243 		kt = kt->pfrkt_root;  in pfr_match_addr()
2245 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {  in pfr_match_addr()
2253 		ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4);  in pfr_match_addr()
2261 		ke = (struct pfr_kentry *)rn_match(&pfr_sin6, kt->pfrkt_ip6);  in pfr_match_addr()
2269 		kt->pfrkt_match++;  in pfr_match_addr()
2271 		kt->pfrkt_nomatch++;  in pfr_match_addr()
2277 pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af,  in pfr_update_stats()  argument
2284 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) {  in pfr_update_stats()
2285 		kt = kt->pfrkt_root;  in pfr_update_stats()
2287 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {  in pfr_update_stats()
2295 		ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4);  in pfr_update_stats()
2303 		ke = (struct pfr_kentry *)rn_match(&pfr_sin6, kt->pfrkt_ip6);  in pfr_update_stats()
2317 	kt->pfrkt_packets[dir_out][op_pass]++;  in pfr_update_stats()
2318 	kt->pfrkt_bytes[dir_out][op_pass] += len;  in pfr_update_stats()
2328 	struct pfr_ktable       *kt, *rt;  in pfr_attach_table()  local
2339 	kt = pfr_lookup_table(&tbl);  in pfr_attach_table()
2340 	if (kt == NULL) {  in pfr_attach_table()
2341 		kt = pfr_create_ktable(&tbl, pf_calendar_time_second(), 1);  in pfr_attach_table()
2342 		if (kt == NULL) {  in pfr_attach_table()
2351 					pfr_destroy_ktable(kt, 0);  in pfr_attach_table()
2356 			kt->pfrkt_root = rt;  in pfr_attach_table()
2358 		pfr_insert_ktable(kt);  in pfr_attach_table()
2360 	if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++) {  in pfr_attach_table()
2361 		pfr_setflags_ktable(kt, kt->pfrkt_flags | PFR_TFLAG_REFERENCED);  in pfr_attach_table()
2363 	return kt;  in pfr_attach_table()
2367 pfr_detach_table(struct pfr_ktable *kt)  in pfr_detach_table()  argument
2371 	if (kt->pfrkt_refcnt[PFR_REFCNT_RULE] <= 0) {  in pfr_detach_table()
2373 		    kt->pfrkt_refcnt[PFR_REFCNT_RULE]);  in pfr_detach_table()
2374 	} else if (!--kt->pfrkt_refcnt[PFR_REFCNT_RULE]) {  in pfr_detach_table()
2375 		pfr_setflags_ktable(kt, kt->pfrkt_flags & ~PFR_TFLAG_REFERENCED);  in pfr_detach_table()
2380 pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter,  in pfr_pool_get()  argument
2398 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) {  in pfr_pool_get()
2399 		kt = kt->pfrkt_root;  in pfr_pool_get()
2401 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) {  in pfr_pool_get()
2416 	ke = pfr_kentry_byidx(kt, idx, af);  in pfr_pool_get()
2418 		kt->pfrkt_nomatch++;  in pfr_pool_get()
2443 		kt->pfrkt_match++;  in pfr_pool_get()
2450 			    kt->pfrkt_ip4);  in pfr_pool_get()
2453 			    kt->pfrkt_ip6);  in pfr_pool_get()
2462 			kt->pfrkt_match++;  in pfr_pool_get()
2481 pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af)  in pfr_kentry_byidx()  argument
2494 		(void) kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4,  in pfr_kentry_byidx()
2499 		(void) kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6,  in pfr_kentry_byidx()
2508 pfr_dynaddr_update(struct pfr_ktable *kt, struct pfi_dynaddr *dyn)  in pfr_dynaddr_update()  argument
2521 		(void) kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4,  in pfr_dynaddr_update()
2525 		(void) kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6,  in pfr_dynaddr_update()