The branch main has been updated by kp:
URL:
https://cgit.FreeBSD.org/src/commit/?id=ab239dfb225b35972e20dc599258fc32d4e73ad5
commit ab239dfb225b35972e20dc599258fc32d4e73ad5
Author: Kristof Provost <k...@freebsd.org>
AuthorDate: 2025-06-02 09:06:20 +0000
Commit: Kristof Provost <k...@freebsd.org>
CommitDate: 2025-06-02 15:30:18 +0000
pf: use struct pf_test_ctx as function argument
Use the struct rather than passing individual fields as arguments.
No functional change.
Sponsored by: Rubicon Communications, LLC ("Netgate")
---
sys/net/pfvar.h | 13 ++---
sys/netpfil/pf/pf.c | 149 ++++++++++++++++++++++---------------------------
sys/netpfil/pf/pf_lb.c | 46 ++++++++-------
3 files changed, 94 insertions(+), 114 deletions(-)
diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h
index c77744d55314..6209a93dd995 100644
--- a/sys/net/pfvar.h
+++ b/sys/net/pfvar.h
@@ -2738,16 +2738,11 @@ u_short pf_map_addr_sn(u_int8_t,
struct pf_krule *,
struct pf_kpool *, pf_sn_types_t);
int pf_get_transaddr_af(struct pf_krule *,
struct pf_pdesc *);
-u_short pf_get_translation(struct pf_pdesc *,
- struct pf_state_key **, struct pf_state_key **,
- struct pf_test_ctx *, struct pf_udp_mapping
**udp_mapping);
-u_short pf_get_transaddr(struct pf_pdesc *,
- struct pf_state_key **, struct pf_state_key **,
- struct pf_krule *, struct pf_udp_mapping **,
+u_short pf_get_translation(struct pf_test_ctx *);
+u_short pf_get_transaddr(struct pf_test_ctx *,
+ struct pf_krule *,
u_int8_t, struct pf_kpool *);
-int pf_translate_compat(struct pf_pdesc *,
- struct pf_state_key *, struct pf_state_key *,
- struct pf_krule *, u_int16_t);
+int pf_translate_compat(struct pf_test_ctx *);
int pf_state_key_setup(struct pf_pdesc *,
u_int16_t, u_int16_t,
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index 7fb544460b02..4451cca76842 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -343,12 +343,9 @@ static int pf_test_eth_rule(int, struct pfi_kkif
*,
static int pf_test_rule(struct pf_krule **, struct pf_kstate **,
struct pf_pdesc *, struct pf_krule **,
struct pf_kruleset **, u_short *, struct inpcb *);
-static int pf_create_state(struct pf_krule *, struct pf_krule *,
- struct pf_krule *, struct pf_pdesc *,
- struct pf_state_key *, struct pf_state_key *, int *,
- struct pf_kstate **, int, u_int16_t, u_int16_t,
- struct pf_krule_slist *, struct pf_udp_mapping *,
- struct pf_kpool *, u_short *);
+static int pf_create_state(struct pf_krule *,
+ struct pf_test_ctx *,
+ struct pf_kstate **, u_int16_t, u_int16_t);
static int pf_state_key_addr_setup(struct pf_pdesc *,
struct pf_state_key_cmp *, int);
static int pf_tcp_track_full(struct pf_kstate *,
@@ -5458,49 +5455,46 @@ pf_test_eth_rule(int dir, struct pfi_kkif *kif, struct
mbuf **m0)
} while (0)
static __inline u_short
-pf_rule_apply_nat(struct pf_pdesc *pd, struct pf_state_key **skp,
- struct pf_state_key **nkp, struct pf_krule *r, struct pf_krule **nr,
- struct pf_udp_mapping **udp_mapping, u_int16_t virtual_type, int *rewrite,
- struct pf_kpool **nat_pool)
+pf_rule_apply_nat(struct pf_test_ctx *ctx, struct pf_krule *r)
{
+ struct pf_pdesc *pd = ctx->pd;
u_short transerror;
u_int8_t nat_action;
if (r->rule_flag & PFRULE_AFTO) {
/* Don't translate if there was an old style NAT rule */
- if (*nr != NULL)
+ if (ctx->nr != NULL)
return (PFRES_TRANSLATE);
/* pass af-to rules, unsupported on match rules */
KASSERT(r->action != PF_MATCH, ("%s: af-to on match rule",
__func__));
/* XXX I can imagine scenarios where we have both NAT and RDR
source tracking */
- *nat_pool = &(r->nat);
- (*nr) = r;
+ ctx->nat_pool = &(r->nat);
+ ctx->nr = r;
pd->naf = r->naf;
- if (pf_get_transaddr_af(*nr, pd) == -1) {
+ if (pf_get_transaddr_af(ctx->nr, pd) == -1) {
return (PFRES_TRANSLATE);
}
return (PFRES_MATCH);
} else if (r->rdr.cur || r->nat.cur) {
/* Don't translate if there was an old style NAT rule */
- if (*nr != NULL)
+ if (ctx->nr != NULL)
return (PFRES_TRANSLATE);
/* match/pass nat-to/rdr-to rules */
- (*nr) = r;
+ ctx->nr = r;
if (r->nat.cur) {
nat_action = PF_NAT;
- *nat_pool = &(r->nat);
+ ctx->nat_pool = &(r->nat);
} else {
nat_action = PF_RDR;
- *nat_pool = &(r->rdr);
+ ctx->nat_pool = &(r->rdr);
}
- transerror = pf_get_transaddr(pd, skp, nkp, *nr, udp_mapping,
- nat_action, *nat_pool);
+ transerror = pf_get_transaddr(ctx, ctx->nr,
+ nat_action, ctx->nat_pool);
if (transerror == PFRES_MATCH) {
- (*rewrite) += pf_translate_compat(pd, *skp, *nkp, *nr,
- virtual_type);
+ ctx->rewrite += pf_translate_compat(ctx);
return(PFRES_MATCH);
}
return (transerror);
@@ -5626,9 +5620,7 @@ pf_match_rule(struct pf_test_ctx *ctx, struct pf_kruleset
*ruleset)
* Apply translations before increasing
counters,
* in case it fails.
*/
- transerror = pf_rule_apply_nat(pd, &ctx->sk,
&ctx->nk, r,
- &ctx->nr, &ctx->udp_mapping,
ctx->virtual_type,
- &ctx->rewrite, &ctx->nat_pool);
+ transerror = pf_rule_apply_nat(ctx, r);
switch (transerror) {
case PFRES_MATCH:
/* Translation action found in rule and
applied successfully */
@@ -5789,8 +5781,7 @@ pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm,
pd->odport = pd->ndport;
/* check packet for BINAT/NAT/RDR */
- transerror = pf_get_translation(pd, &ctx.sk, &ctx.nk, &ctx,
- &ctx.udp_mapping);
+ transerror = pf_get_translation(&ctx);
switch (transerror) {
default:
/* A translation error occurred. */
@@ -5807,7 +5798,7 @@ pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm,
ruleset, pd, 1, NULL);
}
- ctx.rewrite += pf_translate_compat(pd, ctx.sk, ctx.nk, ctx.nr,
ctx.virtual_type);
+ ctx.rewrite += pf_translate_compat(&ctx);
ctx.nat_pool = &(ctx.nr->rdr);
}
@@ -5829,8 +5820,7 @@ pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm,
/* apply actions for last matching pass/block rule */
pf_rule_to_actions(r, &pd->act);
- transerror = pf_rule_apply_nat(pd, &ctx.sk, &ctx.nk, r, &ctx.nr,
&ctx.udp_mapping,
- ctx.virtual_type, &ctx.rewrite, &ctx.nat_pool);
+ transerror = pf_rule_apply_nat(&ctx, r);
switch (transerror) {
case PFRES_MATCH:
/* Translation action found in rule and applied successfully */
@@ -5889,9 +5879,7 @@ pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm,
(pd->flags & PFDESC_TCP_NORM)))) {
bool nat64;
- action = pf_create_state(r, ctx.nr, ctx.a, pd, ctx.nk, ctx.sk,
- &ctx.rewrite, sm, ctx.tag, bproto_sum, bip_sum,
- &ctx.rules, ctx.udp_mapping, ctx.nat_pool, &ctx.reason);
+ action = pf_create_state(r, &ctx, sm, bproto_sum, bip_sum);
ctx.sk = ctx.nk = NULL;
if (action != PF_PASS) {
pf_udp_mapping_release(ctx.udp_mapping);
@@ -5983,13 +5971,10 @@ cleanup:
}
static int
-pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
- struct pf_pdesc *pd, struct pf_state_key *nk, struct pf_state_key *sk,
- int *rewrite, struct pf_kstate **sm, int tag, u_int16_t bproto_sum,
- u_int16_t bip_sum, struct pf_krule_slist *match_rules,
- struct pf_udp_mapping *udp_mapping, struct pf_kpool *nat_pool,
- u_short *reason)
+pf_create_state(struct pf_krule *r, struct pf_test_ctx *ctx,
+ struct pf_kstate **sm, u_int16_t bproto_sum, u_int16_t bip_sum)
{
+ struct pf_pdesc *pd = ctx->pd;
struct pf_kstate *s = NULL;
struct pf_ksrc_node *sns[PF_SN_MAX] = { NULL };
/*
@@ -6007,14 +5992,14 @@ pf_create_state(struct pf_krule *r, struct pf_krule
*nr, struct pf_krule *a,
if (r->max_states &&
(counter_u64_fetch(r->states_cur) >= r->max_states)) {
counter_u64_add(V_pf_status.lcounters[LCNT_STATES], 1);
- REASON_SET(reason, PFRES_MAXSTATES);
+ REASON_SET(&ctx->reason, PFRES_MAXSTATES);
goto csfailed;
}
/* src node for limits */
if ((r->rule_flag & PFRULE_SRCTRACK) &&
(sn_reason = pf_insert_src_node(sns, snhs, r, pd->src, pd->af,
NULL, NULL, PF_SN_LIMIT)) != 0) {
- REASON_SET(reason, sn_reason);
+ REASON_SET(&ctx->reason, sn_reason);
goto csfailed;
}
/* src node for route-to rule */
@@ -6023,30 +6008,30 @@ pf_create_state(struct pf_krule *r, struct pf_krule
*nr, struct pf_krule *a,
(sn_reason = pf_insert_src_node(sns, snhs, r, pd->src,
pd->af, &pd->act.rt_addr, pd->act.rt_kif,
PF_SN_ROUTE)) != 0) {
- REASON_SET(reason, sn_reason);
+ REASON_SET(&ctx->reason, sn_reason);
goto csfailed;
}
}
/* src node for translation rule */
- if (nr != NULL) {
- KASSERT(nat_pool != NULL, ("%s: nat_pool is NULL", __func__));
- if ((nat_pool->opts & PF_POOL_STICKYADDR) &&
- (sn_reason = pf_insert_src_node(sns, snhs, nr,
- &sk->addr[pd->sidx], pd->af, &nk->addr[1], NULL,
+ if (ctx->nr != NULL) {
+ KASSERT(ctx->nat_pool != NULL, ("%s: nat_pool is NULL",
__func__));
+ if ((ctx->nat_pool->opts & PF_POOL_STICKYADDR) &&
+ (sn_reason = pf_insert_src_node(sns, snhs, ctx->nr,
+ &ctx->sk->addr[pd->sidx], pd->af, &ctx->nk->addr[1], NULL,
PF_SN_NAT)) != 0 ) {
- REASON_SET(reason, sn_reason);
+ REASON_SET(&ctx->reason, sn_reason);
goto csfailed;
}
}
s = pf_alloc_state(M_NOWAIT);
if (s == NULL) {
- REASON_SET(reason, PFRES_MEMORY);
+ REASON_SET(&ctx->reason, PFRES_MEMORY);
goto csfailed;
}
s->rule = r;
- s->nat_rule = nr;
- s->anchor = a;
- memcpy(&s->match_rules, match_rules, sizeof(s->match_rules));
+ s->nat_rule = ctx->nr;
+ s->anchor = ctx->a;
+ memcpy(&s->match_rules, &ctx->rules, sizeof(s->match_rules));
memcpy(&s->act, &pd->act, sizeof(struct pf_rule_actions));
if (pd->act.allow_opts)
@@ -6056,15 +6041,15 @@ pf_create_state(struct pf_krule *r, struct pf_krule
*nr, struct pf_krule *a,
if (pd->flags & PFDESC_TCP_NORM) /* Set by old-style scrub rules */
s->state_flags |= PFSTATE_SCRUB_TCP;
if ((r->rule_flag & PFRULE_PFLOW) ||
- (nr != NULL && nr->rule_flag & PFRULE_PFLOW))
+ (ctx->nr != NULL && ctx->nr->rule_flag & PFRULE_PFLOW))
s->state_flags |= PFSTATE_PFLOW;
s->act.log = pd->act.log & PF_LOG_ALL;
s->sync_state = PFSYNC_S_NONE;
s->state_flags |= pd->act.flags; /* Only needed for pfsync and state
export */
- if (nr != NULL)
- s->act.log |= nr->log & PF_LOG_ALL;
+ if (ctx->nr != NULL)
+ s->act.log |= ctx->nr->log & PF_LOG_ALL;
switch (pd->proto) {
case IPPROTO_TCP:
s->src.seqlo = ntohl(th->th_seq);
@@ -6077,7 +6062,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr,
struct pf_krule *a,
s->src.seqdiff = 1;
pf_change_proto_a(pd->m, &th->th_seq, &th->th_sum,
htonl(s->src.seqlo + s->src.seqdiff), 0);
- *rewrite = 1;
+ ctx->rewrite = 1;
} else
s->src.seqdiff = 0;
if (tcp_get_flags(th) & TH_SYN) {
@@ -6128,12 +6113,12 @@ pf_create_state(struct pf_krule *r, struct pf_krule
*nr, struct pf_krule *a,
if (pd->proto == IPPROTO_TCP) {
if (s->state_flags & PFSTATE_SCRUB_TCP &&
pf_normalize_tcp_init(pd, th, &s->src)) {
- REASON_SET(reason, PFRES_MEMORY);
+ REASON_SET(&ctx->reason, PFRES_MEMORY);
goto csfailed;
}
if (s->state_flags & PFSTATE_SCRUB_TCP && s->src.scrub &&
- pf_normalize_tcp_stateful(pd, reason, th, s,
- &s->src, &s->dst, rewrite)) {
+ pf_normalize_tcp_stateful(pd, &ctx->reason, th, s,
+ &s->src, &s->dst, &ctx->rewrite)) {
/* This really shouldn't happen!!! */
DPFPRINTF(PF_DEBUG_URGENT,
("%s: tcp normalize failed on first "
@@ -6151,25 +6136,26 @@ pf_create_state(struct pf_krule *r, struct pf_krule
*nr, struct pf_krule *a,
/*
* sk/nk could already been setup by pf_get_translation().
*/
- if (sk == NULL && nk == NULL) {
+ if (ctx->sk == NULL && ctx->nk == NULL) {
MPASS(pd->sport == NULL || (pd->osport == *pd->sport));
MPASS(pd->dport == NULL || (pd->odport == *pd->dport));
- if (pf_state_key_setup(pd, pd->nsport, pd->ndport, &sk, &nk)) {
+ if (pf_state_key_setup(pd, pd->nsport, pd->ndport,
+ &ctx->sk, &ctx->nk)) {
goto csfailed;
}
} else
- KASSERT((sk != NULL && nk != NULL), ("%s: nr %p sk %p, nk %p",
- __func__, nr, sk, nk));
+ KASSERT((ctx->sk != NULL && ctx->nk != NULL), ("%s: nr %p sk
%p, nk %p",
+ __func__, ctx->nr, ctx->sk, ctx->nk));
/* Swap sk/nk for PF_OUT. */
if (pf_state_insert(BOUND_IFACE(s, pd), pd->kif,
- (pd->dir == PF_IN) ? sk : nk,
- (pd->dir == PF_IN) ? nk : sk, s)) {
- REASON_SET(reason, PFRES_STATEINS);
+ (pd->dir == PF_IN) ? ctx->sk : ctx->nk,
+ (pd->dir == PF_IN) ? ctx->nk : ctx->sk, s)) {
+ REASON_SET(&ctx->reason, PFRES_STATEINS);
goto drop;
} else
*sm = s;
- sk = nk = NULL;
+ ctx->sk = ctx->nk = NULL;
STATE_INC_COUNTERS(s);
@@ -6183,12 +6169,12 @@ pf_create_state(struct pf_krule *r, struct pf_krule
*nr, struct pf_krule *a,
}
}
- if (tag > 0)
- s->tag = tag;
+ if (ctx->tag > 0)
+ s->tag = ctx->tag;
if (pd->proto == IPPROTO_TCP && (tcp_get_flags(th) & (TH_SYN|TH_ACK)) ==
TH_SYN && r->keep_state == PF_STATE_SYNPROXY) {
pf_set_protostate(s, PF_PEER_SRC, PF_TCPS_PROXY_SRC);
- pf_undo_nat(nr, pd, bip_sum);
+ pf_undo_nat(ctx->nr, pd, bip_sum);
s->src.seqhi = arc4random();
/* Find mss option */
int rtid = M_GETFIB(pd->m);
@@ -6200,22 +6186,22 @@ pf_create_state(struct pf_krule *r, struct pf_krule
*nr, struct pf_krule *a,
th->th_sport, s->src.seqhi, ntohl(th->th_seq) + 1,
TH_SYN|TH_ACK, 0, s->src.mss, 0, M_SKIP_FIREWALL, 0, 0,
pd->act.rtableid);
- REASON_SET(reason, PFRES_SYNPROXY);
+ REASON_SET(&ctx->reason, PFRES_SYNPROXY);
return (PF_SYNPROXY_DROP);
}
- s->udp_mapping = udp_mapping;
+ s->udp_mapping = ctx->udp_mapping;
return (PF_PASS);
csfailed:
- while ((ri = SLIST_FIRST(match_rules))) {
- SLIST_REMOVE_HEAD(match_rules, entry);
+ while ((ri = SLIST_FIRST(&ctx->rules))) {
+ SLIST_REMOVE_HEAD(&ctx->rules, entry);
free(ri, M_PF_RULE_ITEM);
}
- uma_zfree(V_pf_state_key_z, sk);
- uma_zfree(V_pf_state_key_z, nk);
+ uma_zfree(V_pf_state_key_z, ctx->sk);
+ uma_zfree(V_pf_state_key_z, ctx->nk);
for (pf_sn_types_t sn_type=0; sn_type<PF_SN_MAX; sn_type++) {
if (pf_src_node_exists(&sns[sn_type], snhs[sn_type])) {
@@ -6327,14 +6313,15 @@ pf_translate(struct pf_pdesc *pd, struct pf_addr
*saddr, u_int16_t sport,
}
int
-pf_translate_compat(struct pf_pdesc *pd, struct pf_state_key *sk,
- struct pf_state_key *nk, struct pf_krule *nr, u_int16_t virtual_type)
+pf_translate_compat(struct pf_test_ctx *ctx)
{
+ struct pf_pdesc *pd = ctx->pd;
+ struct pf_state_key *nk = ctx->nk;
struct tcphdr *th = &pd->hdr.tcp;
int rewrite = 0;
- KASSERT(sk != NULL, ("%s: null sk", __func__));
- KASSERT(nk != NULL, ("%s: null nk", __func__));
+ KASSERT(ctx->sk != NULL, ("%s: null sk", __func__));
+ KASSERT(ctx->nk != NULL, ("%s: null nk", __func__));
switch (pd->proto) {
case IPPROTO_TCP:
@@ -6418,7 +6405,7 @@ pf_translate_compat(struct pf_pdesc *pd, struct
pf_state_key *sk,
PF_ACPY(&pd->ndaddr, pd->dst, pd->af);
}
- if (virtual_type == htons(ICMP_ECHO) &&
+ if (ctx->virtual_type == htons(ICMP_ECHO) &&
nk->port[pd->sidx] != pd->hdr.icmp.icmp_id) {
pd->hdr.icmp.icmp_cksum = pf_cksum_fixup(
pd->hdr.icmp.icmp_cksum, pd->nsport,
diff --git a/sys/netpfil/pf/pf_lb.c b/sys/netpfil/pf/pf_lb.c
index 697f680c97bf..4a40ef6b845a 100644
--- a/sys/netpfil/pf/pf_lb.c
+++ b/sys/netpfil/pf/pf_lb.c
@@ -843,20 +843,18 @@ done:
}
u_short
-pf_get_translation(struct pf_pdesc *pd,
- struct pf_state_key **skp, struct pf_state_key **nkp,
- struct pf_test_ctx *ctx, struct pf_udp_mapping **udp_mapping)
+pf_get_translation(struct pf_test_ctx *ctx)
{
struct pf_krule *r = NULL;
u_short transerror;
PF_RULES_RASSERT();
- KASSERT(*skp == NULL, ("*skp not NULL"));
- KASSERT(*nkp == NULL, ("*nkp not NULL"));
+ KASSERT(ctx->sk == NULL, ("*skp not NULL"));
+ KASSERT(ctx->nk == NULL, ("*nkp not NULL"));
ctx->nr = NULL;
- if (pd->dir == PF_OUT) {
+ if (ctx->pd->dir == PF_OUT) {
r = pf_match_translation(PF_RULESET_BINAT, ctx);
if (r == NULL)
r = pf_match_translation(PF_RULESET_NAT, ctx);
@@ -876,7 +874,7 @@ pf_get_translation(struct pf_pdesc *pd,
return (PFRES_MAX);
}
- transerror = pf_get_transaddr(pd, skp, nkp, r, udp_mapping, r->action,
&(r->rdr));
+ transerror = pf_get_transaddr(ctx, r, r->action, &(r->rdr));
if (transerror == PFRES_MATCH)
ctx->nr = r;
@@ -884,11 +882,10 @@ pf_get_translation(struct pf_pdesc *pd,
}
u_short
-pf_get_transaddr(struct pf_pdesc *pd, struct pf_state_key **skp,
- struct pf_state_key **nkp, struct pf_krule *r,
- struct pf_udp_mapping **udp_mapping, uint8_t nat_action,
- struct pf_kpool *rpool)
+pf_get_transaddr(struct pf_test_ctx *ctx, struct pf_krule *r,
+ uint8_t nat_action, struct pf_kpool *rpool)
{
+ struct pf_pdesc *pd = ctx->pd;
struct pf_addr *naddr;
struct pf_ksrc_node *sn = NULL;
struct pf_srchash *sh = NULL;
@@ -900,13 +897,14 @@ pf_get_transaddr(struct pf_pdesc *pd, struct pf_state_key
**skp,
KASSERT(r != NULL, ("r is NULL"));
KASSERT(!(r->rule_flag & PFRULE_AFTO), ("AFTO rule"));
- if (*skp == NULL && *nkp == NULL) {
- if (pf_state_key_setup(pd, pd->nsport, pd->ndport, skp, nkp))
+ if (ctx->sk == NULL && ctx->nk == NULL) {
+ if (pf_state_key_setup(pd, pd->nsport, pd->ndport, &ctx->sk,
+ &ctx->nk))
return (PFRES_MEMORY);
}
- naddr = &(*nkp)->addr[1];
- nportp = &(*nkp)->port[1];
+ naddr = &ctx->nk->addr[1];
+ nportp = &ctx->nk->port[1];
switch (nat_action) {
case PF_NAT:
@@ -919,7 +917,7 @@ pf_get_transaddr(struct pf_pdesc *pd, struct pf_state_key
**skp,
}
if (rpool->mape.offset > 0) {
if (pf_get_mape_sport(pd, r, naddr, nportp, &sn,
- &sh, udp_mapping, rpool)) {
+ &sh, &ctx->udp_mapping, rpool)) {
DPFPRINTF(PF_DEBUG_MISC,
("pf: MAP-E port allocation (%u/%u/%u)"
" failed\n",
@@ -930,7 +928,7 @@ pf_get_transaddr(struct pf_pdesc *pd, struct pf_state_key
**skp,
goto notrans;
}
} else if (pf_get_sport(pd, r, naddr, nportp, low, high, &sn,
- &sh, rpool, udp_mapping, PF_SN_NAT)) {
+ &sh, rpool, &ctx->udp_mapping, PF_SN_NAT)) {
DPFPRINTF(PF_DEBUG_MISC,
("pf: NAT proxy port allocation (%u-%u) failed\n",
rpool->proxy_port[0], rpool->proxy_port[1]));
@@ -1077,7 +1075,7 @@ pf_get_transaddr(struct pf_pdesc *pd, struct pf_state_key
**skp,
key.port[0] = htons(tmp);
if (!pf_find_state_all_exists(&key, PF_OUT)) {
/* Update the source port. */
- (*nkp)->port[0] = htons(tmp);
+ ctx->nk->port[0] = htons(tmp);
goto out;
}
}
@@ -1087,7 +1085,7 @@ pf_get_transaddr(struct pf_pdesc *pd, struct pf_state_key
**skp,
key.port[0] = htons(tmp);
if (!pf_find_state_all_exists(&key, PF_OUT)) {
/* Update the source port. */
- (*nkp)->port[0] = htons(tmp);
+ ctx->nk->port[0] = htons(tmp);
goto out;
}
}
@@ -1105,7 +1103,7 @@ pf_get_transaddr(struct pf_pdesc *pd, struct pf_state_key
**skp,
out:
DPFPRINTF(PF_DEBUG_MISC,
("pf: RDR source port allocation %u->%u\n",
- ntohs(pd->nsport), ntohs((*nkp)->port[0])));
+ ntohs(pd->nsport), ntohs(ctx->nk->port[0])));
break;
}
default:
@@ -1113,15 +1111,15 @@ out:
}
/* Return success only if translation really happened. */
- if (bcmp(*skp, *nkp, sizeof(struct pf_state_key_cmp))) {
+ if (bcmp(ctx->sk, ctx->nk, sizeof(struct pf_state_key_cmp))) {
return (PFRES_MATCH);
}
reason = PFRES_MAX;
notrans:
- uma_zfree(V_pf_state_key_z, *nkp);
- uma_zfree(V_pf_state_key_z, *skp);
- *skp = *nkp = NULL;
+ uma_zfree(V_pf_state_key_z, ctx->nk);
+ uma_zfree(V_pf_state_key_z, ctx->sk);
+ ctx->sk = ctx->nk = NULL;
return (reason);
}
