git: 644b7b5a2e31 - main - pf: convert DIOCGETADDRS to netlink
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Mon, 22 Jul 2024 07:15:06 UTC
The branch main has been updated by kp:
URL: https://cgit.FreeBSD.org/src/commit/?id=644b7b5a2e31fc1d21e7e90764a7b043e5b66d1a
commit 644b7b5a2e31fc1d21e7e90764a7b043e5b66d1a
Author: Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2024-07-19 12:15:30 +0000
Commit: Kristof Provost <kp@FreeBSD.org>
CommitDate: 2024-07-22 07:11:49 +0000
pf: convert DIOCGETADDRS to netlink
Sponsored by: Rubicon Communications, LLC ("Netgate")
---
lib/libpfctl/libpfctl.c | 44 +++++++++++++++++++++++++++++++++++++
lib/libpfctl/libpfctl.h | 2 ++
sbin/pfctl/pfctl.c | 2 +-
sys/net/pfvar.h | 1 +
sys/netpfil/pf/pf_ioctl.c | 42 +++++++++++++++++++++--------------
sys/netpfil/pf/pf_nl.c | 56 +++++++++++++++++++++++++++++++++++++++++++++++
sys/netpfil/pf/pf_nl.h | 1 +
7 files changed, 131 insertions(+), 17 deletions(-)
diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c
index 398595c4715f..c2e842d65b11 100644
--- a/lib/libpfctl/libpfctl.c
+++ b/lib/libpfctl/libpfctl.c
@@ -2789,3 +2789,47 @@ pfctl_add_addr(struct pfctl_handle *h, const struct pfioc_pooladdr *pa)
return (e.error);
}
+
+static const struct snl_attr_parser ap_get_addrs[] = {
+ { .type = PF_AA_NR, .off = 0, .cb = snl_attr_get_uint32 },
+};
+static struct snl_field_parser fp_get_addrs[] = {};
+SNL_DECLARE_PARSER(get_addrs_parser, struct genlmsghdr, fp_get_addrs, ap_get_addrs);
+
+int
+pfctl_get_addrs(struct pfctl_handle *h, uint32_t ticket, uint32_t r_num,
+ uint8_t r_action, const char *anchor, uint32_t *nr)
+{
+ struct snl_writer nw;
+ struct snl_errmsg_data e = {};
+ struct nlmsghdr *hdr;
+ uint32_t seq_id;
+ int family_id;
+
+ family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME);
+ if (family_id == 0)
+ return (ENOTSUP);
+
+ snl_init_writer(&h->ss, &nw);
+ hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_GET_ADDRS);
+
+ snl_add_msg_attr_u32(&nw, PF_AA_TICKET, ticket);
+ snl_add_msg_attr_u32(&nw, PF_AA_R_NUM, r_num);
+ snl_add_msg_attr_u8(&nw, PF_AA_R_ACTION, r_action);
+ snl_add_msg_attr_string(&nw, PF_AA_ANCHOR, anchor);
+
+ if ((hdr = snl_finalize_msg(&nw)) == NULL)
+ return (ENXIO);
+
+ seq_id = hdr->nlmsg_seq;
+
+ if (! snl_send_message(&h->ss, hdr))
+ return (ENXIO);
+
+ while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) {
+ if (! snl_parse_nlmsg(&h->ss, hdr, &get_addrs_parser, nr))
+ continue;
+ }
+
+ return (e.error);
+}
diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h
index dd09b061efea..22db0b2d90b5 100644
--- a/lib/libpfctl/libpfctl.h
+++ b/lib/libpfctl/libpfctl.h
@@ -499,5 +499,7 @@ int pfctl_set_limit(struct pfctl_handle *h, const int index, const uint limit);
int pfctl_get_limit(struct pfctl_handle *h, const int index, uint *limit);
int pfctl_begin_addrs(struct pfctl_handle *h, uint32_t *ticket);
int pfctl_add_addr(struct pfctl_handle *h, const struct pfioc_pooladdr *pa);
+int pfctl_get_addrs(struct pfctl_handle *h, uint32_t ticket, uint32_t r_num,
+ uint8_t r_action, const char *anchor, uint32_t *nr);
#endif
diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c
index a49e82809f9e..f9522484cdc7 100644
--- a/sbin/pfctl/pfctl.c
+++ b/sbin/pfctl/pfctl.c
@@ -968,7 +968,7 @@ pfctl_get_pool(int dev, struct pfctl_pool *pool, u_int32_t nr,
pp.r_action = r_action;
pp.r_num = nr;
pp.ticket = ticket;
- if (ioctl(dev, DIOCGETADDRS, &pp)) {
+ if (pfctl_get_addrs(pfh, ticket, nr, r_action, anchorname, &pp.nr) != 0) {
warn("DIOCGETADDRS");
return (-1);
}
diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h
index b38a1bebcc1f..291acce19327 100644
--- a/sys/net/pfvar.h
+++ b/sys/net/pfvar.h
@@ -2528,6 +2528,7 @@ int pf_ioctl_get_limit(int, unsigned int *);
int pf_ioctl_set_limit(int, unsigned int, unsigned int *);
int pf_ioctl_begin_addrs(uint32_t *);
int pf_ioctl_add_addr(struct pfioc_pooladdr *);
+int pf_ioctl_get_addrs(struct pfioc_pooladdr *);
void pf_krule_free(struct pf_krule *);
void pf_krule_clear_counters(struct pf_krule *);
diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c
index f5a216666076..4ea0301cd3c4 100644
--- a/sys/netpfil/pf/pf_ioctl.c
+++ b/sys/netpfil/pf/pf_ioctl.c
@@ -2589,6 +2589,31 @@ out:
return (error);
}
+int
+pf_ioctl_get_addrs(struct pfioc_pooladdr *pp)
+{
+ struct pf_kpool *pool;
+ struct pf_kpooladdr *pa;
+
+ PF_RULES_RLOCK_TRACKER;
+
+ pp->anchor[sizeof(pp->anchor) - 1] = 0;
+ pp->nr = 0;
+
+ PF_RULES_RLOCK();
+ pool = pf_get_kpool(pp->anchor, pp->ticket, pp->r_action,
+ pp->r_num, 0, 1, 0);
+ if (pool == NULL) {
+ PF_RULES_RUNLOCK();
+ return (EBUSY);
+ }
+ TAILQ_FOREACH(pa, &pool->list, entries)
+ pp->nr++;
+ PF_RULES_RUNLOCK();
+
+ return (0);
+}
+
static int
pfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread *td)
{
@@ -4267,23 +4292,8 @@ DIOCGETSTATESV2_full:
case DIOCGETADDRS: {
struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr;
- struct pf_kpool *pool;
- struct pf_kpooladdr *pa;
- pp->anchor[sizeof(pp->anchor) - 1] = 0;
- pp->nr = 0;
-
- PF_RULES_RLOCK();
- pool = pf_get_kpool(pp->anchor, pp->ticket, pp->r_action,
- pp->r_num, 0, 1, 0);
- if (pool == NULL) {
- PF_RULES_RUNLOCK();
- error = EBUSY;
- break;
- }
- TAILQ_FOREACH(pa, &pool->list, entries)
- pp->nr++;
- PF_RULES_RUNLOCK();
+ error = pf_ioctl_get_addrs(pp);
break;
}
diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c
index 6c98a50d8e06..79aa76f625e3 100644
--- a/sys/netpfil/pf/pf_nl.c
+++ b/sys/netpfil/pf/pf_nl.c
@@ -1509,6 +1509,21 @@ pf_handle_begin_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt)
return (0);
}
+static bool
+nlattr_add_pool_addr(struct nl_writer *nw, int attrtype, struct pf_pooladdr *a)
+{
+ int off;
+
+ off = nlattr_add_nested(nw, attrtype);
+
+ nlattr_add_addr_wrap(nw, PF_PA_ADDR, &a->addr);
+ nlattr_add_string(nw, PF_PA_IFNAME, a->ifname);
+
+ nlattr_set_len(nw, off);
+
+ return (true);
+}
+
#define _OUT(_field) offsetof(struct pf_pooladdr, _field)
static const struct nlattr_parser nla_p_pool_addr[] = {
{ .type = PF_PA_ADDR, .off = _OUT(addr), .arg = &addr_wrap_parser, .cb = nlattr_get_nested },
@@ -1548,6 +1563,40 @@ pf_handle_add_addr(struct nlmsghdr *hdr, struct nl_pstate *npt)
return (error);
}
+static int
+pf_handle_get_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt)
+{
+ struct pfioc_pooladdr attrs = { 0 };
+ struct nl_writer *nw = npt->nw;
+ struct genlmsghdr *ghdr_new;
+ int error;
+
+ error = nl_parse_nlmsg(hdr, &add_addr_parser, npt, &attrs);
+ if (error != 0)
+ return (error);
+
+ error = pf_ioctl_get_addrs(&attrs);
+ if (error != 0)
+ return (error);
+
+ if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
+ return (ENOMEM);
+
+ ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
+ ghdr_new->cmd = PFNL_CMD_GET_ADDRS;
+ ghdr_new->version = 0;
+ ghdr_new->reserved = 0;
+
+ nlattr_add_u32(nw, PF_AA_NR, attrs.nr);
+
+ if (!nlmsg_end(nw)) {
+ nlmsg_abort(nw);
+ return (ENOMEM);
+ }
+
+ return (error);
+}
+
static const struct nlhdr_parser *all_parsers[] = {
&state_parser,
&addrule_parser,
@@ -1705,6 +1754,13 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
},
+ {
+ .cmd_num = PFNL_CMD_GET_ADDRS,
+ .cmd_name = "GET_ADDRS",
+ .cmd_cb = pf_handle_get_addrs,
+ .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
+ .cmd_priv = PRIV_NETINET_PF,
+ },
};
void
diff --git a/sys/netpfil/pf/pf_nl.h b/sys/netpfil/pf/pf_nl.h
index 2459fdc15a63..013a7e1e0ef0 100644
--- a/sys/netpfil/pf/pf_nl.h
+++ b/sys/netpfil/pf/pf_nl.h
@@ -56,6 +56,7 @@ enum {
PFNL_CMD_GET_LIMIT = 18,
PFNL_CMD_BEGIN_ADDRS = 19,
PFNL_CMD_ADD_ADDR = 20,
+ PFNL_CMD_GET_ADDRS = 21,
__PFNL_CMD_MAX,
};
#define PFNL_CMD_MAX (__PFNL_CMD_MAX -1)