git: 25e0f8f99f54 - main - pf: convert DIOCGETRULESETS to netlink
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Thu, 10 Oct 2024 12:37:18 UTC
The branch main has been updated by kp:
URL: https://cgit.FreeBSD.org/src/commit/?id=25e0f8f99f544f5bb737b2c7709fe6ea572e37f0
commit 25e0f8f99f544f5bb737b2c7709fe6ea572e37f0
Author: Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2024-10-01 17:15:54 +0000
Commit: Kristof Provost <kp@FreeBSD.org>
CommitDate: 2024-10-10 12:10:40 +0000
pf: convert DIOCGETRULESETS to netlink
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D46930
---
lib/libpfctl/libpfctl.c | 48 ++++++++++++++++++++++++++++++++++++++++++-
lib/libpfctl/libpfctl.h | 1 +
sbin/pfctl/pfctl.c | 22 +++++++++-----------
sys/net/pfvar.h | 1 +
sys/netpfil/pf/pf_ioctl.c | 52 +++++++++++++++++++++++++++++------------------
sys/netpfil/pf/pf_nl.c | 51 ++++++++++++++++++++++++++++++++++++++++++++++
sys/netpfil/pf/pf_nl.h | 7 +++++++
7 files changed, 149 insertions(+), 33 deletions(-)
diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c
index 36b83c480aa7..c9f315a0db67 100644
--- a/lib/libpfctl/libpfctl.c
+++ b/lib/libpfctl/libpfctl.c
@@ -2914,5 +2914,51 @@ pfctl_get_addr(struct pfctl_handle *h, uint32_t ticket, uint32_t r_num,
continue;
}
- return (0);
+ return (e.error);
}
+
+#define _OUT(_field) offsetof(struct pfioc_ruleset, _field)
+static const struct snl_attr_parser ap_ruleset[] = {
+ { .type = PF_RS_NR, .off = _OUT(nr), .cb = snl_attr_get_uint32 },
+};
+static struct snl_field_parser fp_ruleset[] = {};
+SNL_DECLARE_PARSER(ruleset_parser, struct genlmsghdr, fp_ruleset, ap_ruleset);
+#undef _OUT
+
+int
+pfctl_get_rulesets(struct pfctl_handle *h, const char *path, uint32_t *nr)
+{
+ struct snl_writer nw;
+ struct snl_errmsg_data e = {};
+ struct nlmsghdr *hdr;
+ struct pfioc_ruleset rs = {};
+ uint32_t seq_id;
+ int family_id;
+
+ family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME);
+ if (family_id == 0)
+ return (ENOTSUP);
+
+ snl_init_writer(&h->ss, &nw);
+ hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_GET_RULESETS);
+
+ snl_add_msg_attr_string(&nw, PF_RS_PATH, path);
+
+ if ((hdr = snl_finalize_msg(&nw)) == NULL)
+ return (ENXIO);
+
+ seq_id = hdr->nlmsg_seq;
+
+ if (! snl_send_message(&h->ss, hdr))
+ return (ENXIO);
+
+ while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) {
+ if (! snl_parse_nlmsg(&h->ss, hdr, &ruleset_parser, &rs))
+ continue;
+ }
+
+ *nr = rs.nr;
+
+ return (e.error);
+}
+
diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h
index 6088e18554b3..6d8be24dd04f 100644
--- a/lib/libpfctl/libpfctl.h
+++ b/lib/libpfctl/libpfctl.h
@@ -504,5 +504,6 @@ int pfctl_get_addrs(struct pfctl_handle *h, uint32_t ticket, uint32_t r_num,
uint8_t r_action, const char *anchor, uint32_t *nr);
int pfctl_get_addr(struct pfctl_handle *h, uint32_t ticket, uint32_t r_num,
uint8_t r_action, const char *anchor, uint32_t nr, struct pfioc_pooladdr *pa);
+int pfctl_get_rulesets(struct pfctl_handle *h, const char *path, uint32_t *nr);
#endif
diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c
index 16c54981b348..ee49e7b12278 100644
--- a/sbin/pfctl/pfctl.c
+++ b/sbin/pfctl/pfctl.c
@@ -1253,14 +1253,13 @@ pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format,
memset(&prs, 0, sizeof(prs));
memcpy(prs.path, npath, sizeof(prs.path));
- if (ioctl(dev, DIOCGETRULESETS, &prs)) {
- if (errno == EINVAL)
+ if ((ret = pfctl_get_rulesets(pfh, npath, &mnr)) != 0) {
+ if (ret == EINVAL)
fprintf(stderr, "Anchor '%s' "
"not found.\n", anchorname);
else
- err(1, "DIOCGETRULESETS");
+ errc(1, ret, "DIOCGETRULESETS");
}
- mnr = prs.nr;
pfctl_print_rule_counters(&rule, opts);
for (nr = 0; nr < mnr; ++nr) {
@@ -1457,14 +1456,13 @@ pfctl_show_nat(int dev, char *path, int opts, char *anchorname, int depth,
u_int32_t mnr, nr;
memset(&prs, 0, sizeof(prs));
memcpy(prs.path, npath, sizeof(prs.path));
- if (ioctl(dev, DIOCGETRULESETS, &prs)) {
- if (errno == EINVAL)
+ if ((ret = pfctl_get_rulesets(pfh, npath, &mnr)) != 0) {
+ if (ret == EINVAL)
fprintf(stderr, "NAT anchor '%s' "
"not found.\n", anchorname);
else
- err(1, "DIOCGETRULESETS");
+ errc(1, ret, "DIOCGETRULESETS");
}
- mnr = prs.nr;
pfctl_print_rule_counters(&rule, opts);
for (nr = 0; nr < mnr; ++nr) {
@@ -2815,18 +2813,18 @@ pfctl_show_anchors(int dev, int opts, char *anchorname)
{
struct pfioc_ruleset pr;
u_int32_t mnr, nr;
+ int ret;
memset(&pr, 0, sizeof(pr));
memcpy(pr.path, anchorname, sizeof(pr.path));
- if (ioctl(dev, DIOCGETRULESETS, &pr)) {
- if (errno == EINVAL)
+ if ((ret = pfctl_get_rulesets(pfh, anchorname, &mnr)) != 0) {
+ if (ret == EINVAL)
fprintf(stderr, "Anchor '%s' not found.\n",
anchorname);
else
- err(1, "DIOCGETRULESETS");
+ errc(1, ret, "DIOCGETRULESETS");
return (-1);
}
- mnr = pr.nr;
for (nr = 0; nr < mnr; ++nr) {
char sub[MAXPATHLEN];
diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h
index 66e3e53b8b37..e27c5e666de8 100644
--- a/sys/net/pfvar.h
+++ b/sys/net/pfvar.h
@@ -2581,6 +2581,7 @@ int pf_ioctl_begin_addrs(uint32_t *);
int pf_ioctl_add_addr(struct pfioc_pooladdr *);
int pf_ioctl_get_addrs(struct pfioc_pooladdr *);
int pf_ioctl_get_addr(struct pfioc_pooladdr *);
+int pf_ioctl_get_rulesets(struct pfioc_ruleset *);
void pf_krule_free(struct pf_krule *);
void pf_krule_clear_counters(struct pf_krule *);
diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c
index 8081960933a2..e3fb3150db5f 100644
--- a/sys/netpfil/pf/pf_ioctl.c
+++ b/sys/netpfil/pf/pf_ioctl.c
@@ -2665,6 +2665,37 @@ pf_ioctl_get_addr(struct pfioc_pooladdr *pp)
return (0);
}
+int
+pf_ioctl_get_rulesets(struct pfioc_ruleset *pr)
+{
+ struct pf_kruleset *ruleset;
+ struct pf_kanchor *anchor;
+
+ PF_RULES_RLOCK_TRACKER;
+
+ pr->path[sizeof(pr->path) - 1] = 0;
+
+ PF_RULES_RLOCK();
+ if ((ruleset = pf_find_kruleset(pr->path)) == NULL) {
+ PF_RULES_RUNLOCK();
+ return (ENOENT);
+ }
+ pr->nr = 0;
+ if (ruleset->anchor == NULL) {
+ /* XXX kludge for pf_main_ruleset */
+ RB_FOREACH(anchor, pf_kanchor_global, &V_pf_anchors)
+ if (anchor->parent == NULL)
+ pr->nr++;
+ } else {
+ RB_FOREACH(anchor, pf_kanchor_node,
+ &ruleset->anchor->children)
+ pr->nr++;
+ }
+ PF_RULES_RUNLOCK();
+
+ return (0);
+}
+
static int
pfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread *td)
{
@@ -4474,29 +4505,10 @@ DIOCCHANGEADDR_error:
case DIOCGETRULESETS: {
struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr;
- struct pf_kruleset *ruleset;
- struct pf_kanchor *anchor;
pr->path[sizeof(pr->path) - 1] = 0;
- PF_RULES_RLOCK();
- if ((ruleset = pf_find_kruleset(pr->path)) == NULL) {
- PF_RULES_RUNLOCK();
- error = ENOENT;
- break;
- }
- pr->nr = 0;
- if (ruleset->anchor == NULL) {
- /* XXX kludge for pf_main_ruleset */
- RB_FOREACH(anchor, pf_kanchor_global, &V_pf_anchors)
- if (anchor->parent == NULL)
- pr->nr++;
- } else {
- RB_FOREACH(anchor, pf_kanchor_node,
- &ruleset->anchor->children)
- pr->nr++;
- }
- PF_RULES_RUNLOCK();
+ error = pf_ioctl_get_rulesets(pr);
break;
}
diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c
index 15fe341ce57e..e3c0369f550d 100644
--- a/sys/netpfil/pf/pf_nl.c
+++ b/sys/netpfil/pf/pf_nl.c
@@ -1635,6 +1635,49 @@ pf_handle_get_addr(struct nlmsghdr *hdr, struct nl_pstate *npt)
return (0);
}
+#define _OUT(_field) offsetof(struct pfioc_ruleset, _field)
+static const struct nlattr_parser nla_p_ruleset[] = {
+ { .type = PF_RS_PATH, .off = _OUT(path), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara },
+};
+static const struct nlfield_parser nlf_p_ruleset[] = {
+};
+NL_DECLARE_PARSER(ruleset_parser, struct genlmsghdr, nlf_p_ruleset, nla_p_ruleset);
+#undef _OUT
+
+static int
+pf_handle_get_rulesets(struct nlmsghdr *hdr, struct nl_pstate *npt)
+{
+ struct pfioc_ruleset attrs = { 0 };
+ struct nl_writer *nw = npt->nw;
+ struct genlmsghdr *ghdr_new;
+ int error;
+
+ error = nl_parse_nlmsg(hdr, &ruleset_parser, npt, &attrs);
+ if (error != 0)
+ return (error);
+
+ error = pf_ioctl_get_rulesets(&attrs);
+ if (error != 0)
+ return (error);
+
+ if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
+ return (ENOMEM);
+
+ ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
+ ghdr_new->cmd = PFNL_CMD_GET_RULESETS;
+ ghdr_new->version = 0;
+ ghdr_new->reserved = 0;
+
+ nlattr_add_u32(nw, PF_RS_NR, attrs.nr);
+
+ if (!nlmsg_end(nw)) {
+ nlmsg_abort(nw);
+ return (ENOMEM);
+ }
+
+ return (0);
+}
+
static const struct nlhdr_parser *all_parsers[] = {
&state_parser,
&addrule_parser,
@@ -1647,6 +1690,7 @@ static const struct nlhdr_parser *all_parsers[] = {
&set_limit_parser,
&pool_addr_parser,
&add_addr_parser,
+ &ruleset_parser,
};
static int family_id;
@@ -1806,6 +1850,13 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
},
+ {
+ .cmd_num = PFNL_CMD_GET_RULESETS,
+ .cmd_name = "GET_RULESETS",
+ .cmd_cb = pf_handle_get_rulesets,
+ .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
+ .cmd_priv = PRIV_NETINET_PF,
+ },
};
void
diff --git a/sys/netpfil/pf/pf_nl.h b/sys/netpfil/pf/pf_nl.h
index acb4b31320c0..5aa02d10214b 100644
--- a/sys/netpfil/pf/pf_nl.h
+++ b/sys/netpfil/pf/pf_nl.h
@@ -58,6 +58,7 @@ enum {
PFNL_CMD_ADD_ADDR = 20,
PFNL_CMD_GET_ADDRS = 21,
PFNL_CMD_GET_ADDR = 22,
+ PFNL_CMD_GET_RULESETS = 23,
__PFNL_CMD_MAX,
};
#define PFNL_CMD_MAX (__PFNL_CMD_MAX -1)
@@ -380,6 +381,12 @@ enum pf_add_addr_types_t {
PF_AA_ADDR = 9, /* nested, pf_pooladdr */
};
+enum pf_get_rulesets_types_t {
+ PF_RS_UNSPEC,
+ PF_RS_PATH = 1, /* string */
+ PF_RS_NR = 2, /* u32 */
+};
+
#ifdef _KERNEL
void pf_nl_register(void);