git: bad279e12deb - main - pf: convert DIOCRDELADDRS to netlink
Date: Tue, 05 Aug 2025 22:28:08 UTC
The branch main has been updated by kp:
URL: https://cgit.FreeBSD.org/src/commit/?id=bad279e12deb3e4e4528dbc6b06f56aefb165b15
commit bad279e12deb3e4e4528dbc6b06f56aefb165b15
Author: Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2025-08-01 14:18:52 +0000
Commit: Kristof Provost <kp@FreeBSD.org>
CommitDate: 2025-08-05 22:27:14 +0000
pf: convert DIOCRDELADDRS to netlink
Sponsored by: Rubicon Communications, LLC ("Netgate")
---
contrib/pf/authpf/authpf.c | 2 +-
lib/libpfctl/libpfctl.c | 69 ++++++++++++++++++++++++++++++++++++++++++++++
lib/libpfctl/libpfctl.h | 2 ++
sbin/pfctl/pfctl_radix.c | 2 +-
sys/netpfil/pf/pf_nl.c | 42 ++++++++++++++++++++++++++++
sys/netpfil/pf/pf_nl.h | 2 ++
6 files changed, 117 insertions(+), 2 deletions(-)
diff --git a/contrib/pf/authpf/authpf.c b/contrib/pf/authpf/authpf.c
index 5d1b33019c4b..14d3d41b6e21 100644
--- a/contrib/pf/authpf/authpf.c
+++ b/contrib/pf/authpf/authpf.c
@@ -865,7 +865,7 @@ change_table(int add, const char *ip_src)
if (add)
ret = pfctl_table_add_addrs_h(pfh, &tbl, &addr, 1, NULL, 0);
else
- ret = pfctl_table_del_addrs(pfctl_fd(pfh), &tbl, &addr, 1, NULL, 0);
+ ret = pfctl_table_del_addrs_h(pfh, &tbl, &addr, 1, NULL, 0);
if (ret != 0 && ret != ESRCH) {
diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c
index 29c792bd72ed..cbd9d4677146 100644
--- a/lib/libpfctl/libpfctl.c
+++ b/lib/libpfctl/libpfctl.c
@@ -2497,6 +2497,51 @@ pfctl_table_add_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl, struct pf
return (ret);
}
+static struct snl_attr_parser ap_table_del_addr[] = {
+ { .type = PF_TA_NBR_DELETED, .off = 0, .cb = snl_attr_get_uint32 },
+};
+SNL_DECLARE_PARSER(table_del_addr_parser, struct genlmsghdr, snl_f_p_empty, ap_table_del_addr);
+static int
+_pfctl_table_del_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl, struct pfr_addr
+ *addrs, int size, int *ndel, int flags)
+{
+ struct snl_writer nw;
+ struct snl_errmsg_data e = {};
+ struct nlmsghdr *hdr;
+ uint32_t seq_id;
+ uint32_t deleted;
+ int family_id;
+
+ family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME);
+ if (family_id == 0)
+ return (ENOTSUP);
+
+ snl_init_writer(&h->ss, &nw);
+ hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_TABLE_DEL_ADDR);
+
+ snl_add_msg_attr_table(&nw, PF_TA_TABLE, tbl);
+ snl_add_msg_attr_u32(&nw, PF_TA_FLAGS, flags);
+ for (int i = 0; i < size && i < 256; i++)
+ snl_add_msg_attr_pfr_addr(&nw, PF_TA_ADDR, &addrs[i]);
+
+ if ((hdr = snl_finalize_msg(&nw)) == NULL)
+ return (ENXIO);
+ seq_id = hdr->nlmsg_seq;
+
+ if (! snl_send_message(&h->ss, hdr))
+ return (ENXIO);
+
+ while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) {
+ if (! snl_parse_nlmsg(&h->ss, hdr, &table_del_addr_parser, &deleted))
+ continue;
+ }
+
+ if (ndel)
+ *ndel = deleted;
+
+ return (e.error);
+}
+
int
pfctl_table_del_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
*addr, int size, int *ndel, int flags)
@@ -2520,6 +2565,30 @@ pfctl_table_del_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
return (0);
}
+int
+pfctl_table_del_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl, struct pfr_addr
+ *addr, int size, int *ndel, int flags)
+{
+ int ret;
+ int off = 0;
+ int partial_deleted;
+
+ do {
+ ret = _pfctl_table_del_addrs_h(h, tbl, &addr[off], size - off,
+ &partial_deleted, flags);
+ if (ret != 0)
+ break;
+ if (ndel)
+ *ndel += partial_deleted;
+ off += partial_deleted;
+ } while (off < size);
+
+ if (ndel)
+ *ndel = off;
+
+ return (ret);
+}
+
int
pfctl_table_set_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
*addr, int size, int *size2, int *nadd, int *ndel, int *nchange, int flags)
diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h
index 5c052b01b294..f6c8f6a2ccdb 100644
--- a/lib/libpfctl/libpfctl.h
+++ b/lib/libpfctl/libpfctl.h
@@ -515,6 +515,8 @@ int pfctl_table_add_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl, struc
*addr, int size, int *nadd, int flags);
int pfctl_table_add_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
*addr, int size, int *nadd, int flags);
+int pfctl_table_del_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl,
+ struct pfr_addr *addr, int size, int *ndel, int flags);
int pfctl_table_del_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
*addr, int size, int *ndel, int flags);
int pfctl_table_set_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
diff --git a/sbin/pfctl/pfctl_radix.c b/sbin/pfctl/pfctl_radix.c
index 4100a9ea0446..0fe9ca8813bb 100644
--- a/sbin/pfctl/pfctl_radix.c
+++ b/sbin/pfctl/pfctl_radix.c
@@ -136,7 +136,7 @@ pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
{
int ret;
- ret = pfctl_table_del_addrs(dev, tbl, addr, size, ndel, flags);
+ ret = pfctl_table_del_addrs_h(pfh, tbl, addr, size, ndel, flags);
if (ret) {
errno = ret;
return (-1);
diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c
index f9e6c97f385c..09754359ec2d 100644
--- a/sys/netpfil/pf/pf_nl.c
+++ b/sys/netpfil/pf/pf_nl.c
@@ -2089,6 +2089,7 @@ struct nl_parsed_table_addrs {
struct pfr_addr addrs[256];
size_t addr_count;
int nadd;
+ int ndel;
};
#define _OUT(_field) offsetof(struct pfr_addr, _field)
static const struct nlattr_parser nla_p_pfr_addr[] = {
@@ -2131,6 +2132,7 @@ static const struct nlattr_parser nla_p_table_addr[] = {
};
NL_DECLARE_PARSER(table_addr_parser, struct genlmsghdr, nlf_p_empty, nla_p_table_addr);
#undef _OUT
+
static int
pf_handle_table_add_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt)
{
@@ -2164,6 +2166,39 @@ pf_handle_table_add_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt)
return (error);
}
+static int
+pf_handle_table_del_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt)
+{
+ struct nl_parsed_table_addrs attrs = { 0 };
+ struct nl_writer *nw = npt->nw;
+ struct genlmsghdr *ghdr_new;
+ int error;
+
+ error = nl_parse_nlmsg(hdr, &table_addr_parser, npt, &attrs);
+ if (error != 0)
+ return (error);
+
+ PF_RULES_WLOCK();
+ error = pfr_del_addrs(&attrs.table, &attrs.addrs[0],
+ attrs.addr_count, &attrs.ndel, attrs.flags | PFR_FLAG_USERIOCTL);
+ PF_RULES_WUNLOCK();
+
+ if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
+ return (ENOMEM);
+
+ ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
+ ghdr_new->cmd = PFNL_CMD_TABLE_DEL_ADDR;
+ ghdr_new->version = 0;
+ ghdr_new->reserved = 0;
+
+ nlattr_add_u32(nw, PF_TA_NBR_DELETED, attrs.ndel);
+
+ if (!nlmsg_end(nw))
+ return (ENOMEM);
+
+ return (error);
+}
+
static const struct nlhdr_parser *all_parsers[] = {
&state_parser,
&addrule_parser,
@@ -2408,6 +2443,13 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
},
+ {
+ .cmd_num = PFNL_CMD_TABLE_DEL_ADDR,
+ .cmd_name = "TABLE_DEL_ADDRS",
+ .cmd_cb = pf_handle_table_del_addrs,
+ .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
+ .cmd_priv = PRIV_NETINET_PF,
+ },
};
void
diff --git a/sys/netpfil/pf/pf_nl.h b/sys/netpfil/pf/pf_nl.h
index 8a24230158e7..87daac393821 100644
--- a/sys/netpfil/pf/pf_nl.h
+++ b/sys/netpfil/pf/pf_nl.h
@@ -68,6 +68,7 @@ enum {
PFNL_CMD_CLR_TSTATS = 30,
PFNL_CMD_CLR_ADDRS = 31,
PFNL_CMD_TABLE_ADD_ADDR = 32,
+ PFNL_CMD_TABLE_DEL_ADDR = 33,
__PFNL_CMD_MAX,
};
#define PFNL_CMD_MAX (__PFNL_CMD_MAX -1)
@@ -476,6 +477,7 @@ enum pf_table_addrs_t {
PF_TA_ADDR = 2, /* nested, pfr_addr_t */
PF_TA_FLAGS = 3, /* u32 */
PF_TA_NBR_ADDED = 4, /* u32 */
+ PF_TA_NBR_DELETED = 5, /* u32 */
};
#ifdef _KERNEL