| 581 | } |
| 582 | |
| 583 | static void |
| 584 | pf_overload_task(void *v, int pending) |
| 585 | { |
| 586 | struct pf_overload_head queue; |
| 587 | struct pfr_addr p; |
| 588 | struct pf_overload_entry *pfoe, *pfoe1; |
| 589 | uint32_t killed = 0; |
| 590 | |
| 591 | CURVNET_SET((struct vnet *)v); |
| 592 | |
| 593 | PF_OVERLOADQ_LOCK(); |
| 594 | queue = V_pf_overloadqueue; |
| 595 | SLIST_INIT(&V_pf_overloadqueue); |
| 596 | PF_OVERLOADQ_UNLOCK(); |
| 597 | |
| 598 | bzero(&p, sizeof(p)); |
| 599 | SLIST_FOREACH(pfoe, &queue, next) { |
| 600 | counter_u64_add(V_pf_status.lcounters[LCNT_OVERLOAD_TABLE], 1); |
| 601 | if (V_pf_status.debug >= PF_DEBUG_MISC) { |
| 602 | printf("%s: blocking address ", __func__); |
| 603 | pf_print_host(&pfoe->addr, 0, pfoe->af); |
| 604 | printf("\n"); |
| 605 | } |
| 606 | |
| 607 | p.pfra_af = pfoe->af; |
| 608 | switch (pfoe->af) { |
| 609 | #ifdef INET |
| 610 | case AF_INET: |
| 611 | p.pfra_net = 32; |
| 612 | p.pfra_ip4addr = pfoe->addr.v4; |
| 613 | break; |
| 614 | #endif |
| 615 | #ifdef INET6 |
| 616 | case AF_INET6: |
| 617 | p.pfra_net = 128; |
| 618 | p.pfra_ip6addr = pfoe->addr.v6; |
| 619 | break; |
| 620 | #endif |
| 621 | } |
| 622 | |
| 623 | PF_RULES_WLOCK(); |
| 624 | pfr_insert_kentry(pfoe->rule->overload_tbl, &p, time_second); |
| 625 | PF_RULES_WUNLOCK(); |
| 626 | } |
| 627 | |
| 628 | /* |
| 629 | * Remove those entries, that don't need flushing. |
| 630 | */ |
| 631 | SLIST_FOREACH_SAFE(pfoe, &queue, next, pfoe1) |
| 632 | if (pfoe->rule->flush == 0) { |
| 633 | SLIST_REMOVE(&queue, pfoe, pf_overload_entry, next); |
| 634 | free(pfoe, M_PFTEMP); |
| 635 | } else |
| 636 | counter_u64_add( |
| 637 | V_pf_status.lcounters[LCNT_OVERLOAD_FLUSH], 1); |
| 638 | |
| 639 | /* If nothing to flush, return. */ |
| 640 | if (SLIST_EMPTY(&queue)) { |
nothing calls this directly
no test coverage detected