1 files changed, 46 insertions, 41 deletions

diff --git a/fw/src/fw.c b/fw/src/fw.c
index 70bcc5c..3c13182 100644
--- a/fw/src/fw.c
+++ b/fw/src/fw.c
@@ -190,23 +190,27 @@ int
 revalidate(void)
 {
 	Flow *f, **pp;
-	uchar *peer;
-	int i, port, lport, n;
+	Match m;
+	int i, n;
 
 	n = 0;
+	memset(&m, 0, sizeof m);
+	m.count = 0;		/* re-checking a flow is not traffic */
 	lock(&flowlock);
 	for(i = 0; i < Nflow; i++)
 		for(pp = &flowtab[i]; (f = *pp) != nil; ){
+			m.verb = f->verb;
+			m.proto = protonum2name(f->proto);
 			if(f->verb == Vout){
-				peer = f->dst;
-				port = f->dport;
-				lport = f->sport;
+				m.ip = f->dst;
+				m.port = f->dport;
+				m.lport = f->sport;
 			}else{
-				peer = f->src;
-				port = f->sport;
-				lport = f->dport;
+				m.ip = f->src;
+				m.port = f->sport;
+				m.lport = f->dport;
 			}
-			if(matchrule(f->verb, protonum2name(f->proto), peer, 0, port, lport, nil) != nil){
+			if(!matchrule(&m)){
 				*pp = f->next;
 				free(f);
 				n++;
@@ -397,11 +401,9 @@ static void
 relay(Wire *from, Wire *to, int verb)
 {
 	uchar *buf;
-	char *e;
-	uchar *peer;
-	Rule *rule;
+	Match m;
 	Pkt p;
-	int n, port, lport;
+	int n;
 
 	/*
 	 * On the heap, not the stack: these run as libthread procs with a
@@ -424,14 +426,18 @@ relay(Wire *from, Wire *to, int verb)
 		}
 
 		p.verb = verb;
+		memset(&m, 0, sizeof m);
+		m.count = 1;
+		m.verb = verb;
+		m.proto = protonum2name(p.proto);
 		if(verb == Vout){
-			peer = p.dst;
-			port = p.dport;
-			lport = p.sport;
+			m.ip = p.dst;
+			m.port = p.dport;
+			m.lport = p.sport;
 		}else{
-			peer = p.src;
-			port = p.sport;
-			lport = p.dport;
+			m.ip = p.src;
+			m.port = p.sport;
+			m.lport = p.dport;
 		}
 
 		if(flowseen(&p)){
@@ -446,24 +452,23 @@ relay(Wire *from, Wire *to, int verb)
 			continue;
 		}
 
-		e = matchrule(verb, protonum2name(p.proto), peer, 0, port, lport, &rule);
-		if(e != nil){
-			if(rule != nil && rule->log)
+		if(!matchrule(&m)){
+			if(m.log)
 				syslog(0, "fw", "drop %s %s %I!%d -> %I!%d: %s",
 					verb == Vout ? "out" : "in",
 					protonum2name(p.proto),
-					p.src, p.sport, p.dst, p.dport, e);
+					p.src, p.sport, p.dst, p.dport, m.err);
 			ndeny++;
 			if(debug)
 				fprint(2, "drop %s %s %I!%d -> %I!%d: %s\n",
 					verb == Vout ? "out" : "in",
 					protonum2name(p.proto),
-					p.src, p.sport, p.dst, p.dport, e);
+					p.src, p.sport, p.dst, p.dport, m.err);
 			continue;
 		}
 
 		nallow++;
-		if(rule != nil && rule->log)
+		if(m.log)
 			syslog(0, "fw", "pass %s %s %I!%d -> %I!%d",
 				verb == Vout ? "out" : "in",
 				protonum2name(p.proto),
@@ -925,10 +930,7 @@ relayproc(void *a)
 static int
 permitted(uchar *buf, int n, int verb, Pkt *p)
 {
-	Rule *rule;
-	uchar *peer;
-	char *e;
-	int port, lport;
+	Match m;
 
 	parsepkt(buf, n, p);
 	if(!p->ok){
@@ -939,34 +941,37 @@ permitted(uchar *buf, int n, int verb, Pkt *p)
 		return 0;
 	}
 	p->verb = verb;
+	memset(&m, 0, sizeof m);
+	m.count = 1;
+	m.verb = verb;
+	m.proto = protonum2name(p->proto);
 	if(verb == Vout){
-		peer = p->dst;
-		port = p->dport;
-		lport = p->sport;
+		m.ip = p->dst;
+		m.port = p->dport;
+		m.lport = p->sport;
 	}else{
-		peer = p->src;
-		port = p->sport;
-		lport = p->dport;
+		m.ip = p->src;
+		m.port = p->sport;
+		m.lport = p->dport;
 	}
 	if(flowseen(p)){
 		nallow++;
 		return 1;
 	}
-	e = matchrule(verb, protonum2name(p->proto), peer, 0, port, lport, &rule);
-	if(e != nil){
+	if(!matchrule(&m)){
 		ndeny++;
-		if(rule != nil && rule->log)
+		if(m.log)
 			syslog(0, "fw", "drop %s %s %I!%d -> %I!%d: %s",
 				verb == Vout ? "out" : "in", protonum2name(p->proto),
-				p->src, p->sport, p->dst, p->dport, e);
+				p->src, p->sport, p->dst, p->dport, m.err);
 		if(debug)
 			fprint(2, "drop %s %s %I!%d -> %I!%d: %s\n",
 				verb == Vout ? "out" : "in", protonum2name(p->proto),
-				p->src, p->sport, p->dst, p->dport, e);
+				p->src, p->sport, p->dst, p->dport, m.err);
 		return 0;
 	}
 	nallow++;
-	if(rule != nil && rule->log)
+	if(m.log)
 		syslog(0, "fw", "pass %s %s %I!%d -> %I!%d",
 			verb == Vout ? "out" : "in", protonum2name(p->proto),
 			p->src, p->sport, p->dst, p->dport);