| 716 | } |
| 717 | |
| 718 | static int |
| 719 | pf_insert_src_node(struct pf_ksrc_node **sn, struct pf_krule *rule, |
| 720 | struct pf_addr *src, sa_family_t af) |
| 721 | { |
| 722 | |
| 723 | KASSERT((rule->rule_flag & PFRULE_SRCTRACK || |
| 724 | rule->rpool.opts & PF_POOL_STICKYADDR), |
| 725 | ("%s for non-tracking rule %p", __func__, rule)); |
| 726 | |
| 727 | if (*sn == NULL) |
| 728 | *sn = pf_find_src_node(src, rule, af, 1); |
| 729 | |
| 730 | if (*sn == NULL) { |
| 731 | struct pf_srchash *sh = &V_pf_srchash[pf_hashsrc(src, af)]; |
| 732 | |
| 733 | PF_HASHROW_ASSERT(sh); |
| 734 | |
| 735 | if (!rule->max_src_nodes || |
| 736 | counter_u64_fetch(rule->src_nodes) < rule->max_src_nodes) |
| 737 | (*sn) = uma_zalloc(V_pf_sources_z, M_NOWAIT | M_ZERO); |
| 738 | else |
| 739 | counter_u64_add(V_pf_status.lcounters[LCNT_SRCNODES], |
| 740 | 1); |
| 741 | if ((*sn) == NULL) { |
| 742 | PF_HASHROW_UNLOCK(sh); |
| 743 | return (-1); |
| 744 | } |
| 745 | |
| 746 | for (int i = 0; i < 2; i++) { |
| 747 | (*sn)->bytes[i] = counter_u64_alloc(M_NOWAIT); |
| 748 | (*sn)->packets[i] = counter_u64_alloc(M_NOWAIT); |
| 749 | |
| 750 | if ((*sn)->bytes[i] == NULL || (*sn)->packets[i] == NULL) { |
| 751 | pf_free_src_node(*sn); |
| 752 | PF_HASHROW_UNLOCK(sh); |
| 753 | return (-1); |
| 754 | } |
| 755 | } |
| 756 | |
| 757 | pf_init_threshold(&(*sn)->conn_rate, |
| 758 | rule->max_src_conn_rate.limit, |
| 759 | rule->max_src_conn_rate.seconds); |
| 760 | |
| 761 | (*sn)->af = af; |
| 762 | (*sn)->rule.ptr = rule; |
| 763 | PF_ACPY(&(*sn)->addr, src, af); |
| 764 | LIST_INSERT_HEAD(&sh->nodes, *sn, entry); |
| 765 | (*sn)->creation = time_uptime; |
| 766 | (*sn)->ruletype = rule->action; |
| 767 | (*sn)->states = 1; |
| 768 | if ((*sn)->rule.ptr != NULL) |
| 769 | counter_u64_add((*sn)->rule.ptr->src_nodes, 1); |
| 770 | PF_HASHROW_UNLOCK(sh); |
| 771 | counter_u64_add(V_pf_status.scounters[SCNT_SRC_NODE_INSERT], 1); |
| 772 | } else { |
| 773 | if (rule->max_src_states && |
| 774 | (*sn)->states >= rule->max_src_states) { |
| 775 | counter_u64_add(V_pf_status.lcounters[LCNT_SRCSTATES], |
no test coverage detected