From nobody Tue Aug 05 22:28:08 2025 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4bxSk048mlz63nl1; Tue, 05 Aug 2025 22:28:08 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4bxSk01nYmz4LZ7; Tue, 05 Aug 2025 22:28:08 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1754432888; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=c7HSHHxPIck0ZoSVBmB+zsP4ClKBiNDSywNBjlJwlvE=; b=fwG7JTuLdrpxvKhcJDUtemJtniDDm8x7TSls6rFgrEz//SvI6us1CTue7+XmwuNbiohg2S JYcQco2rhIO33QG7XysTxyZbn18O/56bSXpWEGw76sHF4HEqkmt6azlVPubOFKSUI6BWdg Oa+7cmWvK73+0t56rhQEAXMAnhHTzcBn6ts6ghvsJOxtkZnPBA9t2fa/2vd0sCum1NG0bI jKHVGh2kAPpohniVk/le/QLBKvwldQ91mGe0TGTPn9URCIL3yNB8D0NO055gu80XTfakDu mMpfEuauoK/9Lk9ooxGSFWsKIOWsAPNtzWnPM7OEgdMINX8l3CaBk39sC46DiA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1754432888; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=c7HSHHxPIck0ZoSVBmB+zsP4ClKBiNDSywNBjlJwlvE=; b=nFsbBC62yPDeG/2Ixs24UI2CkcwPHZI/d9ydiBKtNcXWG1fY6BFsQ7WPcK35O9oNXevp+6 yAP2fY31w8uNjhU7a+TmXNSvSNPP0j/uLDR0Vygysv2vfwHtyMzzawccysJapwuwtEkA4H b5DABjI1/Up8Y6EbiVP75pEKgqxHuwU0MZXFkP2pfSXnVrQJAyp6+fnqdWH8vNl7/ROSe5 oqZmDC21IPIOFQ35UWl4CnjM2AyZZTZT35H/Sn4uAR6xyQVoMm6Ax76d/hIox7wMYq4T2R w2DWfPfmKRzBKRujmtodv3sN0XzLSKEPO9zM5ywZDxaOKnzYCs8GGASbchfIAg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1754432888; a=rsa-sha256; cv=none; b=RQ2+37LtpCd0TVH6azOW1N1GQH1+kVAKYR5fFto5LaYAxuVINfPvN3bvTB7v5FC+sLzSR6 B+LYu77N+G20SddQzMyuTaz9WIGxiLDtA7HgqpGy9FWplBJzimBHE2aFF2li50RoqY2FDv CEikdGopwGLROp3CVBLMbQ05XCCeMSL6wbNCaSTgfq2y/XI4WqO3qlf/XRgWJZ+FEy/eP6 aK842IXh3zM3bbhJ1Mp/OSkkLhilir0jEoCW8cP+DSpowWd3hklotiZdlNivWQTSmr+97L TzzZbUpY/ZLo8lz0WlArqlmtjk7rrdONJhxQo2i4m+aFyKzK0KjJFjUyiGaaDg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4bxSk01LR7ztht; Tue, 05 Aug 2025 22:28:08 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 575MS8Hm014328; Tue, 5 Aug 2025 22:28:08 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 575MS8j8014325; Tue, 5 Aug 2025 22:28:08 GMT (envelope-from git) Date: Tue, 5 Aug 2025 22:28:08 GMT Message-Id: <202508052228.575MS8j8014325@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: bad279e12deb - main - pf: convert DIOCRDELADDRS to netlink List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: bad279e12deb3e4e4528dbc6b06f56aefb165b15 Auto-Submitted: auto-generated The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=bad279e12deb3e4e4528dbc6b06f56aefb165b15 commit bad279e12deb3e4e4528dbc6b06f56aefb165b15 Author: Kristof Provost AuthorDate: 2025-08-01 14:18:52 +0000 Commit: Kristof Provost CommitDate: 2025-08-05 22:27:14 +0000 pf: convert DIOCRDELADDRS to netlink Sponsored by: Rubicon Communications, LLC ("Netgate") --- contrib/pf/authpf/authpf.c | 2 +- lib/libpfctl/libpfctl.c | 69 ++++++++++++++++++++++++++++++++++++++++++++++ lib/libpfctl/libpfctl.h | 2 ++ sbin/pfctl/pfctl_radix.c | 2 +- sys/netpfil/pf/pf_nl.c | 42 ++++++++++++++++++++++++++++ sys/netpfil/pf/pf_nl.h | 2 ++ 6 files changed, 117 insertions(+), 2 deletions(-) diff --git a/contrib/pf/authpf/authpf.c b/contrib/pf/authpf/authpf.c index 5d1b33019c4b..14d3d41b6e21 100644 --- a/contrib/pf/authpf/authpf.c +++ b/contrib/pf/authpf/authpf.c @@ -865,7 +865,7 @@ change_table(int add, const char *ip_src) if (add) ret = pfctl_table_add_addrs_h(pfh, &tbl, &addr, 1, NULL, 0); else - ret = pfctl_table_del_addrs(pfctl_fd(pfh), &tbl, &addr, 1, NULL, 0); + ret = pfctl_table_del_addrs_h(pfh, &tbl, &addr, 1, NULL, 0); if (ret != 0 && ret != ESRCH) { diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c index 29c792bd72ed..cbd9d4677146 100644 --- a/lib/libpfctl/libpfctl.c +++ b/lib/libpfctl/libpfctl.c @@ -2497,6 +2497,51 @@ pfctl_table_add_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl, struct pf return (ret); } +static struct snl_attr_parser ap_table_del_addr[] = { + { .type = PF_TA_NBR_DELETED, .off = 0, .cb = snl_attr_get_uint32 }, +}; +SNL_DECLARE_PARSER(table_del_addr_parser, struct genlmsghdr, snl_f_p_empty, ap_table_del_addr); +static int +_pfctl_table_del_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl, struct pfr_addr + *addrs, int size, int *ndel, int flags) +{ + struct snl_writer nw; + struct snl_errmsg_data e = {}; + struct nlmsghdr *hdr; + uint32_t seq_id; + uint32_t deleted; + int family_id; + + family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME); + if (family_id == 0) + return (ENOTSUP); + + snl_init_writer(&h->ss, &nw); + hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_TABLE_DEL_ADDR); + + snl_add_msg_attr_table(&nw, PF_TA_TABLE, tbl); + snl_add_msg_attr_u32(&nw, PF_TA_FLAGS, flags); + for (int i = 0; i < size && i < 256; i++) + snl_add_msg_attr_pfr_addr(&nw, PF_TA_ADDR, &addrs[i]); + + if ((hdr = snl_finalize_msg(&nw)) == NULL) + return (ENXIO); + seq_id = hdr->nlmsg_seq; + + if (! snl_send_message(&h->ss, hdr)) + return (ENXIO); + + while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) { + if (! snl_parse_nlmsg(&h->ss, hdr, &table_del_addr_parser, &deleted)) + continue; + } + + if (ndel) + *ndel = deleted; + + return (e.error); +} + int pfctl_table_del_addrs(int dev, struct pfr_table *tbl, struct pfr_addr *addr, int size, int *ndel, int flags) @@ -2520,6 +2565,30 @@ pfctl_table_del_addrs(int dev, struct pfr_table *tbl, struct pfr_addr return (0); } +int +pfctl_table_del_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl, struct pfr_addr + *addr, int size, int *ndel, int flags) +{ + int ret; + int off = 0; + int partial_deleted; + + do { + ret = _pfctl_table_del_addrs_h(h, tbl, &addr[off], size - off, + &partial_deleted, flags); + if (ret != 0) + break; + if (ndel) + *ndel += partial_deleted; + off += partial_deleted; + } while (off < size); + + if (ndel) + *ndel = off; + + return (ret); +} + int pfctl_table_set_addrs(int dev, struct pfr_table *tbl, struct pfr_addr *addr, int size, int *size2, int *nadd, int *ndel, int *nchange, int flags) diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h index 5c052b01b294..f6c8f6a2ccdb 100644 --- a/lib/libpfctl/libpfctl.h +++ b/lib/libpfctl/libpfctl.h @@ -515,6 +515,8 @@ int pfctl_table_add_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl, struc *addr, int size, int *nadd, int flags); int pfctl_table_add_addrs(int dev, struct pfr_table *tbl, struct pfr_addr *addr, int size, int *nadd, int flags); +int pfctl_table_del_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl, + struct pfr_addr *addr, int size, int *ndel, int flags); int pfctl_table_del_addrs(int dev, struct pfr_table *tbl, struct pfr_addr *addr, int size, int *ndel, int flags); int pfctl_table_set_addrs(int dev, struct pfr_table *tbl, struct pfr_addr diff --git a/sbin/pfctl/pfctl_radix.c b/sbin/pfctl/pfctl_radix.c index 4100a9ea0446..0fe9ca8813bb 100644 --- a/sbin/pfctl/pfctl_radix.c +++ b/sbin/pfctl/pfctl_radix.c @@ -136,7 +136,7 @@ pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size, { int ret; - ret = pfctl_table_del_addrs(dev, tbl, addr, size, ndel, flags); + ret = pfctl_table_del_addrs_h(pfh, tbl, addr, size, ndel, flags); if (ret) { errno = ret; return (-1); diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c index f9e6c97f385c..09754359ec2d 100644 --- a/sys/netpfil/pf/pf_nl.c +++ b/sys/netpfil/pf/pf_nl.c @@ -2089,6 +2089,7 @@ struct nl_parsed_table_addrs { struct pfr_addr addrs[256]; size_t addr_count; int nadd; + int ndel; }; #define _OUT(_field) offsetof(struct pfr_addr, _field) static const struct nlattr_parser nla_p_pfr_addr[] = { @@ -2131,6 +2132,7 @@ static const struct nlattr_parser nla_p_table_addr[] = { }; NL_DECLARE_PARSER(table_addr_parser, struct genlmsghdr, nlf_p_empty, nla_p_table_addr); #undef _OUT + static int pf_handle_table_add_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt) { @@ -2164,6 +2166,39 @@ pf_handle_table_add_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt) return (error); } +static int +pf_handle_table_del_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt) +{ + struct nl_parsed_table_addrs attrs = { 0 }; + struct nl_writer *nw = npt->nw; + struct genlmsghdr *ghdr_new; + int error; + + error = nl_parse_nlmsg(hdr, &table_addr_parser, npt, &attrs); + if (error != 0) + return (error); + + PF_RULES_WLOCK(); + error = pfr_del_addrs(&attrs.table, &attrs.addrs[0], + attrs.addr_count, &attrs.ndel, attrs.flags | PFR_FLAG_USERIOCTL); + PF_RULES_WUNLOCK(); + + if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) + return (ENOMEM); + + ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); + ghdr_new->cmd = PFNL_CMD_TABLE_DEL_ADDR; + ghdr_new->version = 0; + ghdr_new->reserved = 0; + + nlattr_add_u32(nw, PF_TA_NBR_DELETED, attrs.ndel); + + if (!nlmsg_end(nw)) + return (ENOMEM); + + return (error); +} + static const struct nlhdr_parser *all_parsers[] = { &state_parser, &addrule_parser, @@ -2408,6 +2443,13 @@ static const struct genl_cmd pf_cmds[] = { .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, }, + { + .cmd_num = PFNL_CMD_TABLE_DEL_ADDR, + .cmd_name = "TABLE_DEL_ADDRS", + .cmd_cb = pf_handle_table_del_addrs, + .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, + .cmd_priv = PRIV_NETINET_PF, + }, }; void diff --git a/sys/netpfil/pf/pf_nl.h b/sys/netpfil/pf/pf_nl.h index 8a24230158e7..87daac393821 100644 --- a/sys/netpfil/pf/pf_nl.h +++ b/sys/netpfil/pf/pf_nl.h @@ -68,6 +68,7 @@ enum { PFNL_CMD_CLR_TSTATS = 30, PFNL_CMD_CLR_ADDRS = 31, PFNL_CMD_TABLE_ADD_ADDR = 32, + PFNL_CMD_TABLE_DEL_ADDR = 33, __PFNL_CMD_MAX, }; #define PFNL_CMD_MAX (__PFNL_CMD_MAX -1) @@ -476,6 +477,7 @@ enum pf_table_addrs_t { PF_TA_ADDR = 2, /* nested, pfr_addr_t */ PF_TA_FLAGS = 3, /* u32 */ PF_TA_NBR_ADDED = 4, /* u32 */ + PF_TA_NBR_DELETED = 5, /* u32 */ }; #ifdef _KERNEL