git: cd2054d48bc6 - main - libpfctl: add pfctl_get_rule_h()

The branch main has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=cd2054d48bc6d16edb0fdb84a7e4006620883c1e

commit cd2054d48bc6d16edb0fdb84a7e4006620883c1e
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2024-05-24 11:15:12 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2024-05-28 20:27:22 +0000

    libpfctl: add pfctl_get_rule_h()
    
    Add a handle variant of pfctl_get_rule(). This converts us from using
    the nvlist variant to the netlink variant, and also moves us closer to a
    world where all libpfctl functions take the handle.
    
    While here have pfctl use the new function.
    
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
---
 lib/libpfctl/libpfctl.c                   | 8 ++++++++
 lib/libpfctl/libpfctl.h                   | 3 +++
 sbin/pfctl/pfctl.c                        | 2 +-
 sbin/pfctl/pfctl_optimize.c               | 2 +-
 usr.sbin/bsnmpd/modules/snmp_pf/pf_snmp.c | 2 +-
 5 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c
index 479b96123012..e833a23b269a 100644
--- a/lib/libpfctl/libpfctl.c
+++ b/lib/libpfctl/libpfctl.c
@@ -1388,6 +1388,14 @@ pfctl_get_rules_info(int dev __unused, struct pfctl_rules_info *rules, uint32_t
 	return (error);
 }
 
+int
+pfctl_get_rule_h(struct pfctl_handle *h, uint32_t nr, uint32_t ticket, const char *anchor,
+    uint32_t ruleset, struct pfctl_rule *rule, char *anchor_call)
+{
+	return (pfctl_get_clear_rule_h(h, nr, ticket, anchor, ruleset, rule,
+	    anchor_call, false));
+}
+
 int
 pfctl_get_rule(int dev, uint32_t nr, uint32_t ticket, const char *anchor,
     uint32_t ruleset, struct pfctl_rule *rule, char *anchor_call)
diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h
index 73282eb3cc3d..391e73b61e02 100644
--- a/lib/libpfctl/libpfctl.h
+++ b/lib/libpfctl/libpfctl.h
@@ -420,6 +420,9 @@ int	pfctl_get_rules_info(int dev, struct pfctl_rules_info *rules,
 int	pfctl_get_rule(int dev, uint32_t nr, uint32_t ticket,
 	    const char *anchor, uint32_t ruleset, struct pfctl_rule *rule,
 	    char *anchor_call);
+int	pfctl_get_rule_h(struct pfctl_handle *h, uint32_t nr, uint32_t ticket,
+	    const char *anchor, uint32_t ruleset, struct pfctl_rule *rule,
+	    char *anchor_call);
 int	pfctl_get_clear_rule(int dev, uint32_t nr, uint32_t ticket,
 	    const char *anchor, uint32_t ruleset, struct pfctl_rule *rule,
 	    char *anchor_call, bool clear);
diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c
index 1843ec5713d6..c89981075ea6 100644
--- a/sbin/pfctl/pfctl.c
+++ b/sbin/pfctl/pfctl.c
@@ -1444,7 +1444,7 @@ pfctl_show_nat(int dev, char *path, int opts, char *anchorname, int depth)
 			brace = 0;
 			INDENT(depth, !(opts & PF_OPT_VERBOSE));
 
-			if (pfctl_get_rule(dev, nr, ri.ticket, path,
+			if (pfctl_get_rule_h(pfh, nr, ri.ticket, path,
 			    nattype[i], &rule, anchor_call)) {
 				warn("DIOCGETRULE");
 				return (-1);
diff --git a/sbin/pfctl/pfctl_optimize.c b/sbin/pfctl/pfctl_optimize.c
index 9b43a840c06f..7440bf8a506d 100644
--- a/sbin/pfctl/pfctl_optimize.c
+++ b/sbin/pfctl/pfctl_optimize.c
@@ -903,7 +903,7 @@ load_feedback_profile(struct pfctl *pf, struct superblocks *superblocks)
 			return (1);
 		}
 
-		if (pfctl_get_rule(pf->dev, nr, rules.ticket, "", PF_PASS,
+		if (pfctl_get_rule_h(pf->h, nr, rules.ticket, "", PF_PASS,
 		    &rule, anchor_call)) {
 			warn("DIOCGETRULENV");
 			return (1);
diff --git a/usr.sbin/bsnmpd/modules/snmp_pf/pf_snmp.c b/usr.sbin/bsnmpd/modules/snmp_pf/pf_snmp.c
index 1086aa7dcf82..f02329901f69 100644
--- a/usr.sbin/bsnmpd/modules/snmp_pf/pf_snmp.c
+++ b/usr.sbin/bsnmpd/modules/snmp_pf/pf_snmp.c
@@ -1526,7 +1526,7 @@ pfl_scan_ruleset(const char *path)
 	}
 
 	for (nr = rules.nr, i = 0; i < nr; i++) {
-		if (pfctl_get_rule(pfctl_fd(pfh), i, rules.ticket, path,
+		if (pfctl_get_rule_h(pfh, i, rules.ticket, path,
 		    PF_PASS, &rule, anchor_call)) {
 			syslog(LOG_ERR, "pfl_scan_ruleset: ioctl(DIOCGETRULE):"
 			    " %s", strerror(errno));