From nobody Fri Oct 30 14:08:07 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jGNGv6hkpz6wwch for ; Fri, 30 Oct 2026 14:08:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jGNGv5ZRRz4qXH for ; Fri, 30 Oct 2026 14:08:07 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793369287; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=SCgEPujbCkCQahobzz/yFYs3JlubMTnmm2zONpBl2Vw=; b=UgzxzVUA9JyRNn8YS9CTvuqb6pUAhvxTEfBsxB2n5wN6i4X/HmDoFiNc7jzWl8PteFH2O2 AQYmm+JVj5J40YxI53gqK2yYj5d+v5XmE3DZu/OsSZ5kxnlhdJUNsXDp7NUKCmMsub/6Zm 4PKeqmnaHCgWc6QPKFFdnQ8PaZpqWWkSbW4hjI0Z5frxEBOLWwWHIC0rwGdhV0J5EORfin 0zsEr10riANefJxvPbeHXeOjLbWt4CXEP2Fz/IO/LA/aZk9uQktcnCebrWniKdWiWG72JA cRSNWp2L1spUkA9sStvjVmZlIb8+8767mjgBZR1YihWEQXNw2AKM+OZ6G8dhmg== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793369287; b=mlGDAIGwr+a6jMfDxOW5kBpwPw36lR4c7QAvbXoS8xrhe6HKDn9OOor0zQd5Ls5R7Ntxtj RLh0jKjhDH1L5MpTJSDri65Cz7H2El1bHbzgdUiWO6Zxkir7pPwHlJPIzQVmi34o6gs6OX +YRDt8mCHIgvKA/+mfwt1ijb3aUrB9DvEP/VH9RODo0jIEVVfb4KSNKCM0g9nmlzsFAKS5 vGrc9b49fj75l4J/elqF5Da6TIgwzDxcATHvJr4TMW68cMhdk5jsNtAKYsqq3+W3kz2QjY u6EwkUHNPhGBOj3teMxOMucOJPrjFP1auB1kyGbzS7iPFaj1Qb9920+vVgTTcw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793369287; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=SCgEPujbCkCQahobzz/yFYs3JlubMTnmm2zONpBl2Vw=; b=mI0oYIH4YTWK+qaYJJUQAD/oaec25hgR/eTQov6gWRk/NvflJIhu74ckwbs57AmaUlmqzn 8YZxoJmGnYNrfZSOsTrezPz55FRBmYqcnn5e7jBI0I74jMbeXiviLSOo9oTDx2SnXJJoGp /jDwI5LIErTZdvPtCTcFJlP7fXpNTsmHC394gktADMPwc38G1vLkzkzNb4/0OjiPYZ5aCt MZD/2/DUgC0JR/FDzDwfMmG7cjCLGu3g7KT1c26Mr361Rtns6UZ3O5hAbOsDmzl+x5xad5 XsKi69XgQsHRqjlyBHu2wJYZ/mpFp18tkg8vBn1IxOFA+HHnFhFana5qgwgj2A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jGNGv55VBzV25 for ; Fri, 30 Oct 2026 14:08:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 2257a by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 30 Oct 2026 14:08:07 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: Avinash Duduskar From: Kristof Provost Subject: git: 727e413ff3f1 - main - libpfctl: add pfctl_open_from_nl_fd() and pfctl_nl_fd() List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 727e413ff3f18af8788ea78043b506e0111bfadc Auto-Submitted: auto-generated Date: Fri, 30 Oct 2026 14:08:07 +0000 Message-Id: <6ae4a4c7.2257a.cc47569@gitrepo.freebsd.org> The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=727e413ff3f18af8788ea78043b506e0111bfadc commit 727e413ff3f18af8788ea78043b506e0111bfadc Author: Avinash Duduskar AuthorDate: 2026-10-26 14:38:10 +0000 Commit: Kristof Provost CommitDate: 2026-10-30 14:06:58 +0000 libpfctl: add pfctl_open_from_nl_fd() and pfctl_nl_fd() pfctl_open_from_nl_fd() opens the pf device as pfctl_open() does but, when given a descriptor, adopts it as the Netlink socket instead of creating one. The handle's sequence numbers start at a random value: replies are matched by sequence number, so a random start makes it improbable that a reply an earlier owner of the socket left unread is taken for the answer to one of ours, or one of ours for theirs, however many times the socket has been handed on. pfctl_open() becomes a wrapper that passes -1. pfctl_nl_fd() returns the handle's Netlink descriptor, as pfctl_fd() does for the device, so a caller can hand it to a child process. PR: 291981 Signed-off-by: Avinash Duduskar Reviewed by: kp Pull Request: https://github.com/freebsd/freebsd-src/pull/2508 --- lib/libpfctl/libpfctl.c | 28 +++++++++++++++++++++++++--- lib/libpfctl/libpfctl.h | 3 +++ 2 files changed, 28 insertions(+), 3 deletions(-) diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c index 1522fd1554ab..22ad7888bace 100644 --- a/lib/libpfctl/libpfctl.c +++ b/lib/libpfctl/libpfctl.c @@ -73,7 +73,7 @@ static int _pfctl_clear_states(int , const struct pfctl_kill *, static void _pfctl_verify_parsers(void); struct pfctl_handle * -pfctl_open(const char *pf_device) +pfctl_open_from_nl_fd(const char *pf_device, int nl_fd) { struct pfctl_handle *h; @@ -85,8 +85,18 @@ pfctl_open(const char *pf_device) if (h->fd < 0) goto error; - if (!snl_init(&h->ss, NETLINK_GENERIC)) - goto error; + if (nl_fd >= 0) { + if (!snl_init_fd(&h->ss, nl_fd)) + goto error; + /* + * Replies are matched by sequence number; a random start makes + * a collision with an earlier owner's counter improbable. + */ + h->ss.seq = arc4random(); + } else { + if (!snl_init(&h->ss, NETLINK_GENERIC)) + goto error; + } h->family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME); if (h->family_id == 0) @@ -102,6 +112,12 @@ error: return (NULL); } +struct pfctl_handle * +pfctl_open(const char *pf_device) +{ + return (pfctl_open_from_nl_fd(pf_device, -1)); +} + void pfctl_close(struct pfctl_handle *h) { @@ -116,6 +132,12 @@ pfctl_fd(struct pfctl_handle *h) return (h->fd); } +int +pfctl_nl_fd(struct pfctl_handle *h) +{ + return (h->ss.fd); +} + static int pfctl_do_netlink_cmd(struct pfctl_handle *h, uint cmd) { diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h index 0e56d081e9d7..41be320329d1 100644 --- a/lib/libpfctl/libpfctl.h +++ b/lib/libpfctl/libpfctl.h @@ -444,8 +444,11 @@ struct pfctl_src_node { struct pfctl_handle; struct pfctl_handle *pfctl_open(const char *pf_device); +struct pfctl_handle *pfctl_open_from_nl_fd(const char *pf_device, + int nl_fd); void pfctl_close(struct pfctl_handle *); int pfctl_fd(struct pfctl_handle *); +int pfctl_nl_fd(struct pfctl_handle *); int pfctl_startstop(struct pfctl_handle *h, int start); struct pfctl_status* pfctl_get_status_h(struct pfctl_handle *h);