git: c36c90a2cc17 - main - pf: convert DIOCSETDEBUG to netlink
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Tue, 04 Jun 2024 14:59:36 UTC
The branch main has been updated by kp:
URL: https://cgit.FreeBSD.org/src/commit/?id=c36c90a2cc171d21f78a6f0e28269c0cea37c2e1
commit c36c90a2cc171d21f78a6f0e28269c0cea37c2e1
Author: Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2024-06-01 18:07:22 +0000
Commit: Kristof Provost <kp@FreeBSD.org>
CommitDate: 2024-06-04 12:59:59 +0000
pf: convert DIOCSETDEBUG to netlink
Sponsored by: Rubicon Communications, LLC ("Netgate")
---
lib/libpfctl/libpfctl.c | 32 ++++++++++++++++++++++++++++++++
lib/libpfctl/libpfctl.h | 1 +
sbin/pfctl/parse.y | 2 +-
sbin/pfctl/pfctl.c | 8 ++++----
sbin/pfctl/pfctl_parser.h | 2 +-
sys/netpfil/pf/pf_nl.c | 37 +++++++++++++++++++++++++++++++++++++
sys/netpfil/pf/pf_nl.h | 6 ++++++
7 files changed, 82 insertions(+), 6 deletions(-)
diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c
index d5cd6c4bda60..42339af5642b 100644
--- a/lib/libpfctl/libpfctl.c
+++ b/lib/libpfctl/libpfctl.c
@@ -2490,3 +2490,35 @@ pfctl_natlook(struct pfctl_handle *h, const struct pfctl_natlook_key *k,
return (e.error);
}
+
+int
+pfctl_set_debug(struct pfctl_handle *h, uint32_t level)
+{
+ struct snl_writer nw;
+ struct snl_errmsg_data e = {};
+ struct nlmsghdr *hdr;
+ uint32_t seq_id;
+ int family_id;
+
+ family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME);
+ if (family_id == 0)
+ return (ENOTSUP);
+
+ snl_init_writer(&h->ss, &nw);
+ hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_SET_DEBUG);
+
+ snl_add_msg_attr_u32(&nw, PF_SD_LEVEL, level);
+
+ if ((hdr = snl_finalize_msg(&nw)) == NULL)
+ return (ENXIO);
+
+ seq_id = hdr->nlmsg_seq;
+
+ if (! snl_send_message(&h->ss, hdr))
+ return (ENXIO);
+
+ while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) {
+ }
+
+ return (e.error);
+}
diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h
index e7625252638c..ae1457e9304b 100644
--- a/lib/libpfctl/libpfctl.h
+++ b/lib/libpfctl/libpfctl.h
@@ -492,5 +492,6 @@ struct pfctl_natlook {
};
int pfctl_natlook(struct pfctl_handle *h,
const struct pfctl_natlook_key *k, struct pfctl_natlook *r);
+int pfctl_set_debug(struct pfctl_handle *h, uint32_t level);
#endif
diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y
index 9ec86f898240..92e6e36f3b23 100644
--- a/sbin/pfctl/parse.y
+++ b/sbin/pfctl/parse.y
@@ -763,7 +763,7 @@ option : SET REASSEMBLE yesno optnodf {
free($3);
YYERROR;
}
- if (pfctl_set_debug(pf, $3) != 0) {
+ if (pfctl_do_set_debug(pf, $3) != 0) {
yyerror("error setting debuglevel %s", $3);
free($3);
YYERROR;
diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c
index 08c3d5c98321..8776ec7f82dc 100644
--- a/sbin/pfctl/pfctl.c
+++ b/sbin/pfctl/pfctl.c
@@ -2695,7 +2695,7 @@ pfctl_cfg_syncookies(struct pfctl *pf, uint8_t val, struct pfctl_watermarks *w)
}
int
-pfctl_set_debug(struct pfctl *pf, char *d)
+pfctl_do_set_debug(struct pfctl *pf, char *d)
{
u_int32_t level;
@@ -2719,7 +2719,7 @@ pfctl_set_debug(struct pfctl *pf, char *d)
level = pf->debug;
if ((pf->opts & PF_OPT_NOACTION) == 0)
- if (ioctl(dev, DIOCSETDEBUG, &level))
+ if (pfctl_set_debug(pfh, level))
err(1, "DIOCSETDEBUG");
if (pf->opts & PF_OPT_VERBOSE)
@@ -2731,7 +2731,7 @@ pfctl_set_debug(struct pfctl *pf, char *d)
int
pfctl_load_debug(struct pfctl *pf, unsigned int level)
{
- if (ioctl(pf->dev, DIOCSETDEBUG, &level)) {
+ if (pfctl_set_debug(pf->h, level)) {
warnx("DIOCSETDEBUG");
return (1);
}
@@ -2777,7 +2777,7 @@ pfctl_set_interface_flags(struct pfctl *pf, char *ifname, int flags, int how)
void
pfctl_debug(int dev, u_int32_t level, int opts)
{
- if (ioctl(dev, DIOCSETDEBUG, &level))
+ if (pfctl_set_debug(pfh, level))
err(1, "DIOCSETDEBUG");
if ((opts & PF_OPT_QUIET) == 0) {
fprintf(stderr, "debug level set to '");
diff --git a/sbin/pfctl/pfctl_parser.h b/sbin/pfctl/pfctl_parser.h
index 6534baa9a7dd..58532ad37e12 100644
--- a/sbin/pfctl/pfctl_parser.h
+++ b/sbin/pfctl/pfctl_parser.h
@@ -291,7 +291,7 @@ int pfctl_set_optimization(struct pfctl *, const char *);
int pfctl_set_limit(struct pfctl *, const char *, unsigned int);
int pfctl_set_logif(struct pfctl *, char *);
int pfctl_set_hostid(struct pfctl *, u_int32_t);
-int pfctl_set_debug(struct pfctl *, char *);
+int pfctl_do_set_debug(struct pfctl *, char *);
int pfctl_set_interface_flags(struct pfctl *, char *, int, int);
int pfctl_cfg_syncookies(struct pfctl *, uint8_t, struct pfctl_watermarks *);
diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c
index b9dc7358ae28..1074c561cd15 100644
--- a/sys/netpfil/pf/pf_nl.c
+++ b/sys/netpfil/pf/pf_nl.c
@@ -1320,6 +1320,35 @@ pf_handle_natlook(struct nlmsghdr *hdr, struct nl_pstate *npt)
return (0);
}
+struct pf_nl_set_debug
+{
+ uint32_t level;
+};
+#define _OUT(_field) offsetof(struct pf_nl_set_debug, _field)
+static const struct nlattr_parser nla_p_set_debug[] = {
+ { .type = PF_SD_LEVEL, .off = _OUT(level), .cb = nlattr_get_uint32 },
+};
+static const struct nlfield_parser nlf_p_set_debug[] = {};
+#undef _OUT
+NL_DECLARE_PARSER(set_debug_parser, struct genlmsghdr, nlf_p_set_debug, nla_p_set_debug);
+
+static int
+pf_handle_set_debug(struct nlmsghdr *hdr, struct nl_pstate *npt)
+{
+ struct pf_nl_set_debug attrs = {};
+ int error;
+
+ error = nl_parse_nlmsg(hdr, &set_debug_parser, npt, &attrs);
+ if (error != 0)
+ return (error);
+
+ PF_RULES_WLOCK();
+ V_pf_status.debug = attrs.level;
+ PF_RULES_WUNLOCK();
+
+ return (0);
+}
+
static const struct nlhdr_parser *all_parsers[] = {
&state_parser,
&addrule_parser,
@@ -1327,6 +1356,7 @@ static const struct nlhdr_parser *all_parsers[] = {
&clear_states_parser,
&set_statusif_parser,
&natlook_parser,
+ &set_debug_parser,
};
static int family_id;
@@ -1423,6 +1453,13 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
},
+ {
+ .cmd_num = PFNL_CMD_SET_DEBUG,
+ .cmd_name = "SET_DEBUG",
+ .cmd_cb = pf_handle_set_debug,
+ .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
+ .cmd_priv = PRIV_NETINET_PF,
+ },
};
void
diff --git a/sys/netpfil/pf/pf_nl.h b/sys/netpfil/pf/pf_nl.h
index 7c2ef3712dc7..ab199e308a38 100644
--- a/sys/netpfil/pf/pf_nl.h
+++ b/sys/netpfil/pf/pf_nl.h
@@ -49,6 +49,7 @@ enum {
PFNL_CMD_GET_STATUS = 11,
PFNL_CMD_CLEAR_STATUS = 12,
PFNL_CMD_NATLOOK = 13,
+ PFNL_CMD_SET_DEBUG = 14,
__PFNL_CMD_MAX,
};
#define PFNL_CMD_MAX (__PFNL_CMD_MAX -1)
@@ -328,6 +329,11 @@ enum pf_natlook_types_t {
PF_NL_DST_PORT = 7, /* u16 */
};
+enum pf_set_debug_types_t {
+ PF_SD_UNSPEC,
+ PF_SD_LEVEL = 1, /* u32 */
+};
+
#ifdef _KERNEL
void pf_nl_register(void);