From nobody Tue Jan 14 10:37:45 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4YXQZ21lqBz5kVl9; Tue, 14 Jan 2025 10:37:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4YXQZ20lVWz3C3j; Tue, 14 Jan 2025 10:37:46 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1736851066; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bZGbrWKc+G7el/hbxeRD8caJn+Aw7OFXxxPY7STXh/o=; b=PiShlUTdSkLcO8mI/H09Wl3xL3HthKe7mkNAZAiRVMQDX87DJXURpDl66euqAonldK3Wli 0kvL5SORu9PsRJzz+t4iH94kqhXxmtthk5LAacjKn9dd2QBjFAcho87Xfuy+WDSUCDj6jr xqsr8b6ErSQq3WavG2ctpfzTgWMD5SIVnY5+4NGfLX1FzE3EcpOAk83hU3PG+YGykSNTFv 3mjNDNTpixTqOQsEBqcTDh7EAEngIBaU82dWXp50XHYRB1caiZIyLk5y5/VgyJYtvkwMhG eCmrJaS1X6C7ye7QUwxJQhFode5hvxnQo2/Y1CPLDToqKSZ00JhCZvK8G9GzGw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1736851066; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bZGbrWKc+G7el/hbxeRD8caJn+Aw7OFXxxPY7STXh/o=; b=uxEqQiDduZ9CuFp2c8Cx+rgJNxSIHKH2ruUprEQjiv4/YtZOvtg8iwhy242R/cRiLSwX2f faih2RdvwIdW0j6HSlq/lh7zJWmmG8mlIV0lSijz5uu7gV6QZfqyUJXE1jTcGF9y9tgFDj NkaWxswVgGTBJ9dyfmFk300JL/fLu43aGy7lfR2b40Z8Ftz4z6LJDVP7Ntkg1SyY6OyGe2 mJz/VqAR8ujSCMwlxirD5G13jmyxO2pHVShbboo6MzywBWc6cca839ApYrvjBwLHXV7Dwo Ce+LZnPvApH3lZ901v3HXcGMjWwaYD5NjUZLaw05Pxxv83qFj8icG52gRfVULw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1736851066; a=rsa-sha256; cv=none; b=uafiNQ2k/qPdUmxzZIKbBpkfHQn+YXH418uRAiZMD63pgWjzQ78HEPQ5uFrY/xmxhGJ3SY SbI29OgXaG1ne3jY8DJfh4fJQGkD0AmKXlnGkmeD3XzFHCgkgpfyjM+eRW/iZfvB2ztWJN lJq8aJ0XFDmzVQ+aQdFjsofPVuvcUrEdIRpZQGnpntY4wPozd8h72Ang56dpOn06E7XM1M bpntckjCDDwUzFWOo0WnK6i7sBerysnKpgtC+fM/oHT6edXiNqfhhxLTqFmKmPtR9PTNIt cn6WKB0fpNDpKYk5QridhPaXaDzxGCWvKszYmmk2sFKaQ1IIMKOn8glfSdCJ/Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4YXQZ2030dz1CHj; Tue, 14 Jan 2025 10:37:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 50EAbjBL047736; Tue, 14 Jan 2025 10:37:45 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 50EAbj9o047733; Tue, 14 Jan 2025 10:37:45 GMT (envelope-from git) Date: Tue, 14 Jan 2025 10:37:45 GMT Message-Id: <202501141037.50EAbj9o047733@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: 441d489493e8 - main - pf: convert DIOCRCLRTABLES to netlink List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 441d489493e8a1e2658306f1a4c709a0b18cc78b Auto-Submitted: auto-generated The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=441d489493e8a1e2658306f1a4c709a0b18cc78b commit 441d489493e8a1e2658306f1a4c709a0b18cc78b Author: Kristof Provost AuthorDate: 2024-12-03 15:53:08 +0000 Commit: Kristof Provost CommitDate: 2025-01-14 08:54:17 +0000 pf: convert DIOCRCLRTABLES to netlink Sponsored by: Rubicon Communications, LLC ("Netgate") --- lib/libpfctl/libpfctl.c | 44 ++++++++++++++++++++++++++++++++++++++ lib/libpfctl/libpfctl.h | 3 +++ sbin/pfctl/pfctl.c | 4 ++-- sbin/pfctl/pfctl.h | 5 +++-- sbin/pfctl/pfctl_radix.c | 16 -------------- sbin/pfctl/pfctl_table.c | 4 ++-- sys/netpfil/pf/pf_nl.c | 55 ++++++++++++++++++++++++++++++++++++++++++++++++ sys/netpfil/pf/pf_nl.h | 10 +++++++++ 8 files changed, 119 insertions(+), 22 deletions(-) diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c index 2e4cdb91bad9..b374ef05e4d7 100644 --- a/lib/libpfctl/libpfctl.c +++ b/lib/libpfctl/libpfctl.c @@ -3072,3 +3072,47 @@ pfctl_get_srcnodes(struct pfctl_handle *h, pfctl_get_srcnode_fn fn, void *arg) return (e.error); } + +static struct snl_attr_parser ap_ndel[] = { + { .type = PF_T_NBR_DELETED, .off = 0, .cb = snl_attr_get_uint32 }, +}; +static struct snl_field_parser fp_ndel[] = {}; +SNL_DECLARE_PARSER(ndel_parser, struct genlmsghdr, fp_ndel, ap_ndel); + +int +pfctl_clear_tables(struct pfctl_handle *h, struct pfr_table *filter, + int *ndel, int flags) +{ + struct snl_writer nw; + struct snl_errmsg_data e = {}; + struct nlmsghdr *hdr; + uint32_t seq_id; + int family_id; + + family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME); + if (family_id == 0) + return (ENOTSUP); + + snl_init_writer(&h->ss, &nw); + hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_CLEAR_TABLES); + + snl_add_msg_attr_string(&nw, PF_T_ANCHOR, filter->pfrt_anchor); + snl_add_msg_attr_string(&nw, PF_T_NAME, filter->pfrt_name); + snl_add_msg_attr_u32(&nw, PF_T_TABLE_FLAGS, filter->pfrt_flags); + snl_add_msg_attr_u32(&nw, PF_T_FLAGS, flags); + + if ((hdr = snl_finalize_msg(&nw)) == NULL) + return (ENXIO); + + seq_id = hdr->nlmsg_seq; + + if (!snl_send_message(&h->ss, hdr)) + return (ENXIO); + + while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) { + if (!snl_parse_nlmsg(&h->ss, hdr, &ndel_parser, ndel)) + continue; + } + + return (e.error); +} diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h index 79756286563b..14ea06fd151a 100644 --- a/lib/libpfctl/libpfctl.h +++ b/lib/libpfctl/libpfctl.h @@ -539,4 +539,7 @@ int pfctl_get_ruleset(struct pfctl_handle *h, const char *path, uint32_t nr, str typedef int (*pfctl_get_srcnode_fn)(struct pfctl_src_node*, void *); int pfctl_get_srcnodes(struct pfctl_handle *h, pfctl_get_srcnode_fn fn, void *arg); +int pfctl_clear_tables(struct pfctl_handle *h, struct pfr_table *filter, + int *ndel, int flags); + #endif diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c index 09d6774b324f..190d1a382c03 100644 --- a/sbin/pfctl/pfctl.c +++ b/sbin/pfctl/pfctl.c @@ -3219,7 +3219,7 @@ main(int argc, char *argv[]) pfctl_flush_eth_rules(dev, opts, anchorname); pfctl_flush_rules(dev, opts, anchorname); pfctl_flush_nat(dev, opts, anchorname); - pfctl_clear_tables(anchorname, opts); + pfctl_do_clear_tables(anchorname, opts); if (!*anchorname) { pfctl_clear_altq(dev, opts); pfctl_clear_iface_states(dev, ifaceopt, opts); @@ -3233,7 +3233,7 @@ main(int argc, char *argv[]) pfctl_clear_fingerprints(dev, opts); break; case 'T': - pfctl_clear_tables(anchorname, opts); + pfctl_do_clear_tables(anchorname, opts); break; } } diff --git a/sbin/pfctl/pfctl.h b/sbin/pfctl/pfctl.h index b4aba3beb4a6..788232d89006 100644 --- a/sbin/pfctl/pfctl.h +++ b/sbin/pfctl/pfctl.h @@ -36,6 +36,8 @@ #include +extern struct pfctl_handle *pfh; + struct pfctl; enum pfctl_show { PFCTL_SHOW_RULES, PFCTL_SHOW_LABELS, PFCTL_SHOW_NOTHING }; @@ -54,7 +56,6 @@ struct pfr_buffer { (var) = pfr_buf_next((buf), (var))) int pfr_get_fd(void); -int pfr_clr_tables(struct pfr_table *, int *, int); int pfr_add_tables(struct pfr_table *, int, int *, int); int pfr_del_tables(struct pfr_table *, int, int *, int); int pfr_get_tables(struct pfr_table *, struct pfr_table *, int *, int); @@ -82,7 +83,7 @@ int pfi_get_ifaces(const char *, struct pfi_kif *, int *); int pfi_clr_istats(const char *, int *, int); void pfctl_print_title(char *); -int pfctl_clear_tables(const char *, int); +int pfctl_do_clear_tables(const char *, int); int pfctl_show_tables(const char *, int); int pfctl_command_tables(int, char *[], char *, const char *, char *, const char *, int); diff --git a/sbin/pfctl/pfctl_radix.c b/sbin/pfctl/pfctl_radix.c index 9bea219a7d81..22552bcf1737 100644 --- a/sbin/pfctl/pfctl_radix.c +++ b/sbin/pfctl/pfctl_radix.c @@ -73,22 +73,6 @@ pfr_report_error(struct pfr_table *tbl, struct pfioc_table *io, err, tbl->pfrt_name); } -int -pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags) -{ - struct pfioc_table io; - - bzero(&io, sizeof io); - io.pfrio_flags = flags; - if (filter != NULL) - io.pfrio_table = *filter; - if (ioctl(dev, DIOCRCLRTABLES, &io)) - return (-1); - if (ndel != NULL) - *ndel = io.pfrio_ndel; - return (0); -} - int pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags) { diff --git a/sbin/pfctl/pfctl_table.c b/sbin/pfctl/pfctl_table.c index aac031ce26b2..5e701be3c654 100644 --- a/sbin/pfctl/pfctl_table.c +++ b/sbin/pfctl/pfctl_table.c @@ -104,7 +104,7 @@ static const char *istats_text[2][2][2] = { } while(0) int -pfctl_clear_tables(const char *anchor, int opts) +pfctl_do_clear_tables(const char *anchor, int opts) { return pfctl_table(0, NULL, NULL, "-F", NULL, anchor, opts); } @@ -157,7 +157,7 @@ pfctl_table(int argc, char *argv[], char *tname, const char *command, if (!strcmp(command, "-F")) { if (argc || file != NULL) usage(); - RVTEST(pfr_clr_tables(&table, &ndel, flags)); + RVTEST(pfctl_clear_tables(pfh, &table, &ndel, flags)); xprintf(opts, "%d tables deleted", ndel); } else if (!strcmp(command, "-s")) { b.pfrb_type = (opts & PF_OPT_VERBOSE2) ? diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c index e586ad082e4b..3e7a6965d387 100644 --- a/sys/netpfil/pf/pf_nl.c +++ b/sys/netpfil/pf/pf_nl.c @@ -1793,6 +1793,53 @@ pf_handle_get_srcnodes(struct nlmsghdr *hdr, struct nl_pstate *npt) return (0); } +#define _OUT(_field) offsetof(struct pfioc_table, _field) +static const struct nlattr_parser nla_p_table[] = { + { .type = PF_T_ANCHOR, .off = _OUT(pfrio_table.pfrt_anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara }, + { .type = PF_T_NAME, .off = _OUT(pfrio_table.pfrt_name), .arg = (void *)PF_TABLE_NAME_SIZE, .cb = nlattr_get_chara }, + { .type = PF_T_TABLE_FLAGS, .off = _OUT(pfrio_table.pfrt_flags), .cb = nlattr_get_uint32 }, + { .type = PF_T_FLAGS, .off = _OUT(pfrio_flags), .cb = nlattr_get_uint32 }, +}; +static const struct nlfield_parser nlf_p_table[] = {}; +NL_DECLARE_PARSER(table_parser, struct genlmsghdr, nlf_p_table, nla_p_table); +#undef _OUT +static int +pf_handle_clear_tables(struct nlmsghdr *hdr, struct nl_pstate *npt) +{ + struct pfioc_table attrs = { 0 }; + struct nl_writer *nw = npt->nw; + struct genlmsghdr *ghdr_new; + int ndel = 0; + int error; + + error = nl_parse_nlmsg(hdr, &table_parser, npt, &attrs); + if (error != 0) + return (error); + + PF_RULES_WLOCK(); + error = pfr_clr_tables(&attrs.pfrio_table, &ndel, attrs.pfrio_flags | PFR_FLAG_USERIOCTL); + PF_RULES_WUNLOCK(); + if (error != 0) + return (error); + + if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) + return (ENOMEM); + + ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); + ghdr_new->cmd = PFNL_CMD_CLEAR_TABLES; + ghdr_new->version = 0; + ghdr_new->reserved = 0; + + nlattr_add_u32(nw, PF_T_NBR_DELETED, ndel); + + if (!nlmsg_end(nw)) { + nlmsg_abort(nw); + return (ENOMEM); + } + + return (0); +} + static const struct nlhdr_parser *all_parsers[] = { &state_parser, &addrule_parser, @@ -1806,6 +1853,7 @@ static const struct nlhdr_parser *all_parsers[] = { &pool_addr_parser, &add_addr_parser, &ruleset_parser, + &table_parser, }; static int family_id; @@ -1986,6 +2034,13 @@ static const struct genl_cmd pf_cmds[] = { .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, }, + { + .cmd_num = PFNL_CMD_CLEAR_TABLES, + .cmd_name = "CLEAR_TABLES", + .cmd_cb = pf_handle_clear_tables, + .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, + .cmd_priv = PRIV_NETINET_PF, + }, }; void diff --git a/sys/netpfil/pf/pf_nl.h b/sys/netpfil/pf/pf_nl.h index 0f534bd623c4..8c0149891773 100644 --- a/sys/netpfil/pf/pf_nl.h +++ b/sys/netpfil/pf/pf_nl.h @@ -61,6 +61,7 @@ enum { PFNL_CMD_GET_RULESETS = 23, PFNL_CMD_GET_RULESET = 24, PFNL_CMD_GET_SRCNODES = 25, + PFNL_CMD_CLEAR_TABLES = 26, __PFNL_CMD_MAX, }; #define PFNL_CMD_MAX (__PFNL_CMD_MAX -1) @@ -422,6 +423,15 @@ enum pf_srcnodes_types_t { PF_SN_NAF = 15, /* u8 */ }; +enum pf_tables_t { + PF_T_UNSPEC, + PF_T_ANCHOR = 1, /* string */ + PF_T_NAME = 2, /* string */ + PF_T_TABLE_FLAGS = 3, /* u32 */ + PF_T_FLAGS = 4, /* u32 */ + PF_T_NBR_DELETED = 5, /* u32 */ +}; + #ifdef _KERNEL void pf_nl_register(void);