git: 08ed87a4a276 - main - pf: convert DIOCRSETADDRS to netlink
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Fri, 31 Oct 2025 15:28:39 UTC
The branch main has been updated by kp:
URL: https://cgit.FreeBSD.org/src/commit/?id=08ed87a4a2769cf6294efdd908b0ed4d29ab49b4
commit 08ed87a4a2769cf6294efdd908b0ed4d29ab49b4
Author: Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2025-10-31 10:36:55 +0000
Commit: Kristof Provost <kp@FreeBSD.org>
CommitDate: 2025-10-31 15:24:09 +0000
pf: convert DIOCRSETADDRS to netlink
The list of addresses is potentially very large. Larger than we can fit in a
single netlink request, so we indicate via the PFR_FLAG_START/PFR_FLAG_DONE
flags when we start and finish, so the kernel can work out which addresses need
to be removed.
Sponsored by: Rubicon Communications, LLC ("Netgate")
---
lib/libpfctl/libpfctl.c | 95 +++++++++++++++++++++++++++++++++++++++++++++++
lib/libpfctl/libpfctl.h | 5 ++-
sbin/pfctl/pfctl.h | 2 +-
sbin/pfctl/pfctl_radix.c | 4 +-
sbin/pfctl/pfctl_table.c | 13 +------
sys/net/pfvar.h | 5 ++-
sys/netpfil/pf/pf_if.c | 2 +-
sys/netpfil/pf/pf_ioctl.c | 2 +-
sys/netpfil/pf/pf_nl.c | 44 ++++++++++++++++++++++
sys/netpfil/pf/pf_nl.h | 2 +
sys/netpfil/pf/pf_table.c | 10 +++--
11 files changed, 162 insertions(+), 22 deletions(-)
diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c
index 17576066fcfd..e739e55033e2 100644
--- a/lib/libpfctl/libpfctl.c
+++ b/lib/libpfctl/libpfctl.c
@@ -2597,6 +2597,101 @@ pfctl_table_del_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl, struct pf
return (ret);
}
+struct pfctl_change {
+ int add;
+ int del;
+ int change;
+};
+#define _OUT(_field) offsetof(struct pfctl_change, _field)
+static struct snl_attr_parser ap_table_set_addr[] = {
+ { .type = PF_TA_NBR_ADDED, .off = _OUT(add), .cb = snl_attr_get_uint32 },
+ { .type = PF_TA_NBR_DELETED, .off = _OUT(del), .cb = snl_attr_get_uint32 },
+ { .type = PF_TA_NBR_CHANGED, .off = _OUT(change), .cb = snl_attr_get_uint32 },
+};
+#undef _OUT
+SNL_DECLARE_PARSER(table_set_addr_parser, struct genlmsghdr, snl_f_p_empty, ap_table_set_addr);
+
+static int
+_pfctl_table_set_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl, struct pfr_addr
+ *addrs, int size, int *nadd, int *ndel, int *nchange, int flags)
+{
+ struct snl_writer nw;
+ struct snl_errmsg_data e = {};
+ struct nlmsghdr *hdr;
+ struct pfctl_change change = { 0 };
+ uint32_t seq_id;
+ int family_id;
+
+ family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME);
+ if (family_id == 0)
+ return (ENOTSUP);
+
+ snl_init_writer(&h->ss, &nw);
+ hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_TABLE_SET_ADDR);
+
+ snl_add_msg_attr_table(&nw, PF_TA_TABLE, tbl);
+ snl_add_msg_attr_u32(&nw, PF_TA_FLAGS, flags);
+ for (int i = 0; i < size; i++)
+ snl_add_msg_attr_pfr_addr(&nw, PF_TA_ADDR, &addrs[i]);
+
+ if ((hdr = snl_finalize_msg(&nw)) == NULL)
+ return (ENXIO);
+ seq_id = hdr->nlmsg_seq;
+
+ if (! snl_send_message(&h->ss, hdr))
+ return (ENXIO);
+
+ while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) {
+ if (! snl_parse_nlmsg(&h->ss, hdr, &table_set_addr_parser, &change))
+ continue;
+ }
+
+ if (nadd)
+ *nadd = change.add;
+ if (ndel)
+ *ndel = change.del;
+ if (nchange)
+ *nchange = change.change;
+
+ return (e.error);
+}
+
+int
+pfctl_table_set_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl,
+ struct pfr_addr *addr, int size, int *nadd, int *ndel,
+ int *nchange, int flags)
+{
+ int ret;
+ int off = 0;
+ int partial_add, partial_del, partial_change;
+ int chunk_size;
+
+ do {
+ flags &= ~(PFR_FLAG_START | PFR_FLAG_DONE);
+ if (off == 0)
+ flags |= PFR_FLAG_START;
+ chunk_size = MIN(size - off, 256);
+ if ((chunk_size + off) == size)
+ flags |= PFR_FLAG_DONE;
+ ret = _pfctl_table_set_addrs_h(h, tbl, &addr[off], chunk_size,
+ &partial_add, &partial_del, &partial_change, flags);
+ if (ret != 0)
+ break;
+ if (! (flags & PFR_FLAG_DONE)) {
+ assert(partial_del == 0);
+ }
+ if (nadd)
+ *nadd += partial_add;
+ if (ndel)
+ *ndel += partial_del;
+ if (nchange)
+ *nchange += partial_change;
+ off += chunk_size;
+ } while (off < size);
+
+ return (ret);
+}
+
int
pfctl_table_set_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
*addr, int size, int *size2, int *nadd, int *ndel, int *nchange, int flags)
diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h
index 5880e1a88371..ae4b18dabe75 100644
--- a/lib/libpfctl/libpfctl.h
+++ b/lib/libpfctl/libpfctl.h
@@ -523,7 +523,10 @@ int pfctl_table_del_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl,
struct pfr_addr *addr, int size, int *ndel, int flags);
int pfctl_table_del_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
*addr, int size, int *ndel, int flags);
-int pfctl_table_set_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
+int pfctl_table_set_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl,
+ struct pfr_addr *addr, int size, int *nadd, int *ndel,
+ int *nchange, int flags);
+int pfctl_table_set_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
*addr, int size, int *size2, int *nadd, int *ndel, int *nchange,
int flags);
int pfctl_table_get_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
diff --git a/sbin/pfctl/pfctl.h b/sbin/pfctl/pfctl.h
index 136f51ea08f9..c540c6348d84 100644
--- a/sbin/pfctl/pfctl.h
+++ b/sbin/pfctl/pfctl.h
@@ -110,7 +110,7 @@ int pfr_clr_astats(struct pfr_table *, struct pfr_addr *, int, int *, int);
int pfr_clr_addrs(struct pfr_table *, int *, int);
int pfr_add_addrs(struct pfr_table *, struct pfr_addr *, int, int *, int);
int pfr_del_addrs(struct pfr_table *, struct pfr_addr *, int, int *, int);
-int pfr_set_addrs(struct pfr_table *, struct pfr_addr *, int, int *,
+int pfr_set_addrs(struct pfr_table *, struct pfr_addr *, int,
int *, int *, int *, int);
int pfr_get_addrs(struct pfr_table *, struct pfr_addr *, int *, int);
int pfr_get_astats(struct pfr_table *, struct pfr_astats *, int *, int);
diff --git a/sbin/pfctl/pfctl_radix.c b/sbin/pfctl/pfctl_radix.c
index 98f907738d95..3b7161420e33 100644
--- a/sbin/pfctl/pfctl_radix.c
+++ b/sbin/pfctl/pfctl_radix.c
@@ -163,11 +163,11 @@ pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
int
pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
- int *size2, int *nadd, int *ndel, int *nchange, int flags)
+ int *nadd, int *ndel, int *nchange, int flags)
{
int ret;
- ret = pfctl_table_set_addrs(dev, tbl, addr, size, size2, nadd, ndel,
+ ret = pfctl_table_set_addrs_h(pfh, tbl, addr, size, nadd, ndel,
nchange, flags);
if (ret) {
errno = ret;
diff --git a/sbin/pfctl/pfctl_table.c b/sbin/pfctl/pfctl_table.c
index 4955e1791fd7..aae347712547 100644
--- a/sbin/pfctl/pfctl_table.c
+++ b/sbin/pfctl/pfctl_table.c
@@ -236,17 +236,8 @@ pfctl_table(int argc, char *argv[], char *tname, const char *command,
CREATE_TABLE;
if (opts & PF_OPT_VERBOSE)
flags |= PFR_FLAG_FEEDBACK;
- for (;;) {
- int sz2 = b.pfrb_msize;
-
- RVTEST(pfr_set_addrs(&table, b.pfrb_caddr, b.pfrb_size,
- &sz2, &nadd, &ndel, &nchange, flags));
- if (sz2 <= b.pfrb_msize) {
- b.pfrb_size = sz2;
- break;
- } else
- pfr_buf_grow(&b, sz2);
- }
+ RVTEST(pfr_set_addrs(&table, b.pfrb_caddr, b.pfrb_size,
+ &nadd, &ndel, &nchange, flags));
if (nadd)
xprintf(opts, "%d addresses added", nadd);
if (ndel)
diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h
index 52db00f6ce0b..ce266a267f3c 100644
--- a/sys/net/pfvar.h
+++ b/sys/net/pfvar.h
@@ -2038,14 +2038,15 @@ struct pfioc_trans {
} *array;
};
-#define PFR_FLAG_ATOMIC 0x00000001 /* unused */
+#define PFR_FLAG_START 0x00000001
#define PFR_FLAG_DUMMY 0x00000002
#define PFR_FLAG_FEEDBACK 0x00000004
#define PFR_FLAG_CLSTATS 0x00000008
#define PFR_FLAG_ADDRSTOO 0x00000010
#define PFR_FLAG_REPLACE 0x00000020
#define PFR_FLAG_ALLRSETS 0x00000040
-#define PFR_FLAG_ALLMASK 0x0000007F
+#define PFR_FLAG_DONE 0x00000080
+#define PFR_FLAG_ALLMASK 0x000000FF
#ifdef _KERNEL
#define PFR_FLAG_USERIOCTL 0x10000000
#endif
diff --git a/sys/netpfil/pf/pf_if.c b/sys/netpfil/pf/pf_if.c
index f3be036ef745..6f41d453a7d1 100644
--- a/sys/netpfil/pf/pf_if.c
+++ b/sys/netpfil/pf/pf_if.c
@@ -702,7 +702,7 @@ pfi_table_update(struct pfr_ktable *kt, struct pfi_kkif *kif, uint8_t net,
}
if ((e = pfr_set_addrs(&kt->pfrkt_t, V_pfi_buffer, V_pfi_buffer_cnt, &size2,
- NULL, NULL, NULL, 0, PFR_TFLAG_ALLMASK)))
+ NULL, NULL, NULL, PFR_FLAG_START | PFR_FLAG_DONE, PFR_TFLAG_ALLMASK)))
printf("%s: cannot set %d new addresses into table %s: %d\n",
__func__, V_pfi_buffer_cnt, kt->pfrkt_name, e);
}
diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c
index 703ecf446fad..5ec67021068b 100644
--- a/sys/netpfil/pf/pf_ioctl.c
+++ b/sys/netpfil/pf/pf_ioctl.c
@@ -5142,7 +5142,7 @@ DIOCCHANGEADDR_error:
error = pfr_set_addrs(&io->pfrio_table, pfras,
io->pfrio_size, &io->pfrio_size2, &io->pfrio_nadd,
&io->pfrio_ndel, &io->pfrio_nchange, io->pfrio_flags |
- PFR_FLAG_USERIOCTL, 0);
+ PFR_FLAG_START | PFR_FLAG_DONE | PFR_FLAG_USERIOCTL, 0);
PF_RULES_WUNLOCK();
if (error == 0 && io->pfrio_flags & PFR_FLAG_FEEDBACK)
error = copyout(pfras, io->pfrio_buffer, totlen);
diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c
index 082b9b565153..21d4db1b8478 100644
--- a/sys/netpfil/pf/pf_nl.c
+++ b/sys/netpfil/pf/pf_nl.c
@@ -2100,6 +2100,7 @@ struct nl_parsed_table_addrs {
size_t addr_count;
int nadd;
int ndel;
+ int nchange;
};
#define _OUT(_field) offsetof(struct pfr_addr, _field)
static const struct nlattr_parser nla_p_pfr_addr[] = {
@@ -2209,6 +2210,42 @@ pf_handle_table_del_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt)
return (error);
}
+static int
+pf_handle_table_set_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt)
+{
+ struct nl_parsed_table_addrs attrs = { 0 };
+ struct nl_writer *nw = npt->nw;
+ struct genlmsghdr *ghdr_new;
+ int error;
+
+ error = nl_parse_nlmsg(hdr, &table_addr_parser, npt, &attrs);
+ if (error != 0)
+ return (error);
+
+ PF_RULES_WLOCK();
+ error = pfr_set_addrs(&attrs.table, &attrs.addrs[0],
+ attrs.addr_count, NULL, &attrs.nadd, &attrs.ndel, &attrs.nchange,
+ attrs.flags | PFR_FLAG_USERIOCTL, 0);
+ PF_RULES_WUNLOCK();
+
+ if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
+ return (ENOMEM);
+
+ ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
+ ghdr_new->cmd = PFNL_CMD_TABLE_DEL_ADDR;
+ ghdr_new->version = 0;
+ ghdr_new->reserved = 0;
+
+ nlattr_add_u32(nw, PF_TA_NBR_ADDED, attrs.nadd);
+ nlattr_add_u32(nw, PF_TA_NBR_DELETED, attrs.ndel);
+ nlattr_add_u32(nw, PF_TA_NBR_CHANGED, attrs.nchange);
+
+ if (!nlmsg_end(nw))
+ return (ENOMEM);
+
+ return (error);
+}
+
static const struct nlhdr_parser *all_parsers[] = {
&state_parser,
&addrule_parser,
@@ -2460,6 +2497,13 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
},
+ {
+ .cmd_num = PFNL_CMD_TABLE_SET_ADDR,
+ .cmd_name = "TABLE_SET_ADDRS",
+ .cmd_cb = pf_handle_table_set_addrs,
+ .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
+ .cmd_priv = PRIV_NETINET_PF,
+ },
};
void
diff --git a/sys/netpfil/pf/pf_nl.h b/sys/netpfil/pf/pf_nl.h
index c46c8f2b2592..d1538ab4ff5b 100644
--- a/sys/netpfil/pf/pf_nl.h
+++ b/sys/netpfil/pf/pf_nl.h
@@ -69,6 +69,7 @@ enum {
PFNL_CMD_CLR_ADDRS = 31,
PFNL_CMD_TABLE_ADD_ADDR = 32,
PFNL_CMD_TABLE_DEL_ADDR = 33,
+ PFNL_CMD_TABLE_SET_ADDR = 34,
__PFNL_CMD_MAX,
};
#define PFNL_CMD_MAX (__PFNL_CMD_MAX -1)
@@ -483,6 +484,7 @@ enum pf_table_addrs_t {
PF_TA_FLAGS = 3, /* u32 */
PF_TA_NBR_ADDED = 4, /* u32 */
PF_TA_NBR_DELETED = 5, /* u32 */
+ PF_TA_NBR_CHANGED = 6, /* u32 */
};
#ifdef _KERNEL
diff --git a/sys/netpfil/pf/pf_table.c b/sys/netpfil/pf/pf_table.c
index cf752ce0de18..0e2b9fe1cac8 100644
--- a/sys/netpfil/pf/pf_table.c
+++ b/sys/netpfil/pf/pf_table.c
@@ -399,7 +399,8 @@ pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
PF_RULES_WASSERT();
- ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
+ ACCEPT_FLAGS(flags, PFR_FLAG_START | PFR_FLAG_DONE |
+ PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
if (pfr_validate_table(tbl, ignore_pfrt_flags, flags &
PFR_FLAG_USERIOCTL))
return (EINVAL);
@@ -411,7 +412,8 @@ pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
tmpkt = pfr_create_ktable(&V_pfr_nulltable, 0, 0);
if (tmpkt == NULL)
return (ENOMEM);
- pfr_mark_addrs(kt);
+ if (flags & PFR_FLAG_START)
+ pfr_mark_addrs(kt);
SLIST_INIT(&addq);
SLIST_INIT(&delq);
SLIST_INIT(&changeq);
@@ -444,6 +446,7 @@ pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
}
p = pfr_create_kentry(&ad,
(kt->pfrkt_flags & PFR_TFLAG_COUNTERS) != 0);
+ p->pfrke_mark = PFR_FB_ADDED;
if (p == NULL)
senderr(ENOMEM);
if (pfr_route_kentry(tmpkt, p)) {
@@ -459,7 +462,8 @@ _skip:
if (flags & PFR_FLAG_FEEDBACK)
bcopy(&ad, addr + i, sizeof(ad));
}
- pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY);
+ if (flags & PFR_FLAG_DONE)
+ pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY);
if ((flags & PFR_FLAG_FEEDBACK) && *size2) {
if (*size2 < size+xdel) {
*size2 = size+xdel;