git: 08f54dfca197 - main - pf: convert DIOCRGETASTATS to netlink
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Fri, 05 Dec 2025 13:09:40 UTC
The branch main has been updated by kp:
URL: https://cgit.FreeBSD.org/src/commit/?id=08f54dfca1970b1e014c99c7f8fc806b949267af
commit 08f54dfca1970b1e014c99c7f8fc806b949267af
Author: Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2025-12-04 14:27:27 +0000
Commit: Kristof Provost <kp@FreeBSD.org>
CommitDate: 2025-12-05 12:24:52 +0000
pf: convert DIOCRGETASTATS to netlink
Sponsored by: Rubicon Communications, LLC ("Netgate")
---
lib/libpfctl/libpfctl.c | 92 +++++++++++++++++++++++++++++++++++------
sys/netpfil/pf/pf_nl.c | 108 +++++++++++++++++++++++++++++++++++++++++++++++-
sys/netpfil/pf/pf_nl.h | 16 +++++++
3 files changed, 203 insertions(+), 13 deletions(-)
diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c
index 11377897ebb3..ab49dabe88c2 100644
--- a/lib/libpfctl/libpfctl.c
+++ b/lib/libpfctl/libpfctl.c
@@ -3751,26 +3751,94 @@ pfctl_clear_addrs(struct pfctl_handle *h, const struct pfr_table *filter,
return (e.error);
}
+
+struct nl_astats {
+ struct pfr_astats *a;
+ size_t max;
+ size_t count;
+ uint64_t total_count;
+};
+
+#define _OUT(_field) offsetof(struct pfr_astats, _field)
+static const struct snl_attr_parser ap_pfr_astats[] = {
+ { .type = PF_AS_ADDR , .off = _OUT(pfras_a), .arg = &pfr_addr_parser, .cb = snl_attr_get_nested },
+ { .type = PF_AS_PACKETS, .off = _OUT(pfras_packets), .arg = (void *)(PFR_DIR_MAX * PFR_OP_ADDR_MAX), .cb = snl_attr_get_uint64_array },
+ { .type = PF_AS_BYTES, .off = _OUT(pfras_bytes), .arg = (void *)(PFR_DIR_MAX * PFR_OP_ADDR_MAX), .cb = snl_attr_get_uint64_array },
+ { .type = PF_AS_TZERO, .off = _OUT(pfras_tzero), .cb = snl_attr_get_time_t },
+};
+#undef _OUT
+SNL_DECLARE_ATTR_PARSER(pfr_astats_parser, ap_pfr_astats);
+
+static bool
+snl_attr_get_pfr_astats(struct snl_state *ss, struct nlattr *nla,
+ const void *arg __unused, void *target)
+{
+ struct nl_astats *a = (struct nl_astats *)target;
+ bool ret;
+
+ if (a->count >= a->max)
+ return (false);
+
+ ret = snl_parse_header(ss, NLA_DATA(nla), NLA_DATA_LEN(nla),
+ &pfr_astats_parser, &a->a[a->count]);
+ if (ret)
+ a->count++;
+
+ return (ret);
+}
+
+#define _OUT(_field) offsetof(struct nl_astats, _field)
+static struct snl_attr_parser ap_table_get_astats[] = {
+ { .type = PF_TAS_ASTATS, .off = 0, .cb = snl_attr_get_pfr_astats },
+ { .type = PF_TAS_ASTATS_COUNT, .off = _OUT(total_count), .cb = snl_attr_get_uint32 },
+};
+#undef _OUT
+SNL_DECLARE_PARSER(table_astats_parser, struct genlmsghdr, snl_f_p_empty, ap_table_get_astats);
+
int
pfctl_get_astats(struct pfctl_handle *h, const struct pfr_table *tbl,
- struct pfr_astats *addr, int *size, int flags)
+ struct pfr_astats *as, int *size, int flags)
{
- struct pfioc_table io;
+ struct snl_writer nw;
+ struct snl_errmsg_data e = {};
+ struct nlmsghdr *hdr;
+ struct nl_astats out = { 0 };
+ uint32_t seq_id;
+ int family_id;
if (tbl == NULL || size == NULL || *size < 0 ||
- (*size && addr == NULL)) {
+ (*size && as == NULL)) {
errno = EINVAL;
return (-1);
}
- bzero(&io, sizeof io);
- io.pfrio_flags = flags;
- io.pfrio_table = *tbl;
- io.pfrio_buffer = addr;
- io.pfrio_esize = sizeof(*addr);
- io.pfrio_size = *size;
- if (ioctl(h->fd, DIOCRGETASTATS, &io)) {
- return (-1);
+
+ family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME);
+ if (family_id == 0)
+ return (ENOTSUP);
+
+ snl_init_writer(&h->ss, &nw);
+
+ hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_TABLE_GET_ASTATS);
+
+ snl_add_msg_attr_table(&nw, PF_TAS_TABLE, tbl);
+ snl_add_msg_attr_u32(&nw, PF_TAS_FLAGS, flags);
+
+ if ((hdr = snl_finalize_msg(&nw)) == NULL)
+ return (ENXIO);
+ seq_id = hdr->nlmsg_seq;
+
+ if (! snl_send_message(&h->ss, hdr))
+ return (ENXIO);
+
+ out.a = as;
+ out.max = *size;
+
+ while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) {
+ if (! snl_parse_nlmsg(&h->ss, hdr, &table_astats_parser, &out))
+ continue;
}
- *size = io.pfrio_size;
+
+ *size = out.total_count;
+
return (0);
}
diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c
index 993981a9c0de..7a3775b97b3a 100644
--- a/sys/netpfil/pf/pf_nl.c
+++ b/sys/netpfil/pf/pf_nl.c
@@ -1179,7 +1179,7 @@ nlattr_add_fcounters(struct nl_writer *nw, int attr, size_t number, char **names
}
static bool
-nlattr_add_u64_array(struct nl_writer *nw, int attr, size_t number, uint64_t *array)
+nlattr_add_u64_array(struct nl_writer *nw, int attr, size_t number, const uint64_t *array)
{
int off = nlattr_add_nested(nw, attr);
@@ -2327,6 +2327,104 @@ out:
return (error);
}
+static int
+nlattr_add_pfr_astats(struct nl_writer *nw, int attr, const struct pfr_astats *a)
+{
+ int off = nlattr_add_nested(nw, attr);
+ if (off == 0)
+ return (false);
+
+ nlattr_add_pfr_addr(nw, PF_AS_ADDR, &a->pfras_a);
+ nlattr_add_u64_array(nw, PF_AS_PACKETS, PFR_DIR_MAX * PFR_OP_ADDR_MAX,
+ (const uint64_t *)a->pfras_packets);
+ nlattr_add_u64_array(nw,PF_AS_BYTES, PFR_DIR_MAX * PFR_OP_ADDR_MAX,
+ (const uint64_t *)a->pfras_bytes);
+ nlattr_add_time_t(nw, PF_AS_TZERO, a->pfras_tzero);
+
+ nlattr_set_len(nw, off);
+
+ return (true);
+}
+
+struct nl_parsed_table_astats {
+ struct pfr_table table;
+ uint32_t flags;
+};
+#define _OUT(_field) offsetof(struct nl_parsed_table_astats, _field)
+static const struct nlattr_parser nla_p_table_astats[] = {
+ { .type = PF_TAS_TABLE, .off = _OUT(table), .arg = &nested_table_parser, .cb = nlattr_get_nested },
+ { .type = PF_TAS_FLAGS, .off = _OUT(flags), .cb = nlattr_get_uint32 },
+};
+NL_DECLARE_PARSER(table_astats_parser, struct genlmsghdr, nlf_p_empty, nla_p_table_astats);
+#undef _OUT
+
+static int
+pf_handle_table_get_astats(struct nlmsghdr *hdr, struct nl_pstate *npt)
+{
+ struct nl_parsed_table_astats attrs = { 0 };
+ struct nl_writer *nw = npt->nw;
+ struct pfr_astats *pfrastats;
+ struct genlmsghdr *ghdr_new;
+ int size = 0;
+ int error;
+
+ PF_RULES_RLOCK_TRACKER;
+
+ error = nl_parse_nlmsg(hdr, &table_astats_parser, npt, &attrs);
+ if (error != 0)
+ return (error);
+
+ PF_RULES_RLOCK();
+
+ /* Get required size. */
+ error = pfr_get_astats(&attrs.table, NULL,
+ &size, attrs.flags | PFR_FLAG_USERIOCTL);
+ if (error != 0) {
+ PF_RULES_RUNLOCK();
+ return (error);
+ }
+
+ pfrastats = mallocarray(size, sizeof(struct pfr_astats), M_PF,
+ M_NOWAIT | M_ZERO);
+ if (pfrastats == NULL) {
+ PF_RULES_RUNLOCK();
+ return (ENOMEM);
+ }
+
+ /* Now get the astats. */
+ error = pfr_get_astats(&attrs.table, pfrastats,
+ &size, attrs.flags | PFR_FLAG_USERIOCTL);
+ PF_RULES_RUNLOCK();
+ if (error != 0)
+ goto out;
+
+ for (int i = 0; i < size; i++) {
+ if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) {
+ nlmsg_abort(nw);
+ error = ENOMEM;
+ goto out;
+ }
+ ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
+ ghdr_new->cmd = PFNL_CMD_TABLE_GET_ASTATS;
+ ghdr_new->version = 0;
+ ghdr_new->reserved = 0;
+
+ if (i == 0)
+ nlattr_add_u32(nw, PF_TAS_ASTATS_COUNT, size);
+
+ nlattr_add_pfr_astats(nw, PF_TAS_ASTATS, &pfrastats[i]);
+ if (!nlmsg_end(nw)) {
+ nlmsg_abort(nw);
+ error = ENOMEM;
+ goto out;
+ }
+ }
+
+out:
+ free(pfrastats, M_PF);
+ return (error);
+}
+
static const struct nlhdr_parser *all_parsers[] = {
&state_parser,
&addrule_parser,
@@ -2342,6 +2440,7 @@ static const struct nlhdr_parser *all_parsers[] = {
&ruleset_parser,
&table_parser,
&table_addr_parser,
+ &table_astats_parser,
};
static uint16_t family_id;
@@ -2592,6 +2691,13 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
},
+ {
+ .cmd_num = PFNL_CMD_TABLE_GET_ASTATS,
+ .cmd_name = "TABLE_GET_ASTATS",
+ .cmd_cb = pf_handle_table_get_astats,
+ .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
+ .cmd_priv = PRIV_NETINET_PF,
+ },
};
void
diff --git a/sys/netpfil/pf/pf_nl.h b/sys/netpfil/pf/pf_nl.h
index e1eb3e628df5..5ca14758932a 100644
--- a/sys/netpfil/pf/pf_nl.h
+++ b/sys/netpfil/pf/pf_nl.h
@@ -71,6 +71,7 @@ enum {
PFNL_CMD_TABLE_DEL_ADDR = 33,
PFNL_CMD_TABLE_SET_ADDR = 34,
PFNL_CMD_TABLE_GET_ADDR = 35,
+ PFNL_CMD_TABLE_GET_ASTATS = 36,
__PFNL_CMD_MAX,
};
#define PFNL_CMD_MAX (__PFNL_CMD_MAX -1)
@@ -489,6 +490,21 @@ enum pf_table_addrs_t {
PF_TA_ADDR_COUNT = 7, /* u32 */
};
+enum pf_astats_t {
+ PF_AS_UNSPEC,
+ PF_AS_ADDR = 1, /* nested, pfr_addr_t */
+ PF_AS_PACKETS = 2, /* u64 array */
+ PF_AS_BYTES = 3, /* u64 array */
+ PF_AS_TZERO = 4, /* time_t */
+};
+
+enum pf_table_astats_t {
+ PF_TAS_UNSPEC,
+ PF_TAS_TABLE = 1, /* nested pf_table_t */
+ PF_TAS_ASTATS = 2, /* nested, pfr_astats_t */
+ PF_TAS_FLAGS = 3, /* u32 */
+ PF_TAS_ASTATS_COUNT = 4, /* u32 */
+};
#ifdef _KERNEL
void pf_nl_register(void);