git: 9e8d2962aad3 - main - pf: convert DIOCRGETTSTATS to netlink
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Thu, 20 Mar 2025 04:31:03 UTC
The branch main has been updated by kp:
URL: https://cgit.FreeBSD.org/src/commit/?id=9e8d2962aad3af9bf1acd328a047f4745bb31086
commit 9e8d2962aad3af9bf1acd328a047f4745bb31086
Author: Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2025-03-06 15:57:06 +0000
Commit: Kristof Provost <kp@FreeBSD.org>
CommitDate: 2025-03-20 04:29:53 +0000
pf: convert DIOCRGETTSTATS to netlink
Sponsored by: Rubicon Communications, LLC ("Netgate")
---
lib/libpfctl/libpfctl.c | 91 ++++++++++++++++++++++++++
lib/libpfctl/libpfctl.h | 4 ++
sbin/pfctl/pfctl_radix.c | 25 -------
sbin/pfctl/pfctl_table.c | 49 +++++++-------
sys/netpfil/pf/pf_nl.c | 105 ++++++++++++++++++++++++++++++
sys/netpfil/pf/pf_nl.h | 13 ++++
usr.sbin/bsnmpd/modules/snmp_pf/pf_snmp.c | 60 +++++++----------
7 files changed, 264 insertions(+), 83 deletions(-)
diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c
index e93c79758428..e1cae22e2f3e 100644
--- a/lib/libpfctl/libpfctl.c
+++ b/lib/libpfctl/libpfctl.c
@@ -3188,3 +3188,94 @@ pfctl_del_table(struct pfctl_handle *h, struct pfr_table *table,
return (e.error);
}
+static bool
+snl_attr_get_uint64_into_int_array(struct snl_state *ss, struct nlattr *nla,
+ const void *arg, void *target)
+{
+ uint64_t *u64target;
+ struct snl_uint64_array a = {
+ .count = 0,
+ .max = (size_t)arg,
+ };
+ bool error;
+
+ u64target = malloc(a.max * sizeof(uint64_t));
+ a.array = u64target;
+
+ error = snl_parse_header(ss, NLA_DATA(nla), NLA_DATA_LEN(nla), &array_parser, &a);
+ if (! error)
+ return (error);
+
+ for (size_t i = 0; i < a.count; i++)
+ ((int *)target)[i] = (int)u64target[i];
+
+ free(u64target);
+
+ return (true);
+}
+
+#define _OUT(_field) offsetof(struct pfr_table, _field)
+static const struct snl_attr_parser ap_table[] = {
+ { .type = PF_T_ANCHOR, .off = _OUT(pfrt_anchor), .arg = (void *)MAXPATHLEN, .cb = snl_attr_copy_string },
+ { .type = PF_T_NAME, .off = _OUT(pfrt_name), .arg = (void *)PF_TABLE_NAME_SIZE, .cb =snl_attr_copy_string },
+ { .type = PF_T_TABLE_FLAGS, .off = _OUT(pfrt_flags), .cb = snl_attr_get_uint32 },
+};
+#undef _OUT
+SNL_DECLARE_ATTR_PARSER(table_parser, ap_table);
+#define _OUT(_field) offsetof(struct pfr_tstats, _field)
+static struct snl_attr_parser ap_tstats[] = {
+ { .type = PF_TS_TABLE, .off = _OUT(pfrts_t), .arg = &table_parser, .cb = snl_attr_get_nested },
+ { .type = PF_TS_PACKETS, .off = _OUT(pfrts_packets), .arg = (void *)(PFR_DIR_MAX * PFR_OP_TABLE_MAX), .cb = snl_attr_get_uint64_array},
+ { .type = PF_TS_BYTES, .off = _OUT(pfrts_bytes), .arg = (void *)(PFR_DIR_MAX * PFR_OP_TABLE_MAX), .cb = snl_attr_get_uint64_array },
+ { .type = PF_TS_MATCH, .off = _OUT(pfrts_match), .cb = snl_attr_get_uint64 },
+ {. type = PF_TS_NOMATCH, .off = _OUT(pfrts_nomatch), .cb = snl_attr_get_uint64 },
+ { .type = PF_TS_TZERO, .off = _OUT(pfrts_tzero), .cb = snl_attr_get_uint64 },
+ { .type = PF_TS_REFCNT, .off = _OUT(pfrts_cnt), . arg = (void *)PFR_REFCNT_MAX, .cb = snl_attr_get_uint64_into_int_array },
+};
+#undef _OUT
+SNL_DECLARE_PARSER(tstats_parser, struct genlmsghdr, snl_f_p_empty, ap_tstats);
+
+int
+pfctl_get_tstats(struct pfctl_handle *h, const struct pfr_table *filter,
+ pfctl_get_tstats_fn fn, void *arg)
+{
+ struct snl_writer nw;
+ struct snl_errmsg_data e = {};
+ struct nlmsghdr *hdr;
+ uint32_t seq_id;
+ int family_id;
+ int ret;
+
+ family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME);
+ if (family_id == 0)
+ return (ENOTSUP);
+
+ snl_init_writer(&h->ss, &nw);
+ hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_GET_TSTATS);
+
+ snl_add_msg_attr_string(&nw, PF_T_ANCHOR, filter->pfrt_anchor);
+ snl_add_msg_attr_string(&nw, PF_T_NAME, filter->pfrt_name);
+ snl_add_msg_attr_u32(&nw, PF_T_TABLE_FLAGS, filter->pfrt_flags);
+
+ if ((hdr = snl_finalize_msg(&nw)) == NULL)
+ return (ENXIO);
+
+ seq_id = hdr->nlmsg_seq;
+
+ if (!snl_send_message(&h->ss, hdr))
+ return (ENXIO);
+
+ while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) {
+ struct pfr_tstats tstats = {};
+
+ if (!snl_parse_nlmsg(&h->ss, hdr, &tstats_parser, &tstats))
+ continue;
+
+ ret = fn(&tstats, arg);
+ if (ret != 0)
+ break;
+ }
+
+ return (e.error);
+}
+
diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h
index 1108b0ffc693..c1c1da66746b 100644
--- a/lib/libpfctl/libpfctl.h
+++ b/lib/libpfctl/libpfctl.h
@@ -551,4 +551,8 @@ int pfctl_add_table(struct pfctl_handle *h, struct pfr_table *table,
int pfctl_del_table(struct pfctl_handle *h, struct pfr_table *table,
int *ndel, int flags);
+typedef int (*pfctl_get_tstats_fn)(const struct pfr_tstats *t, void *arg);
+int pfctl_get_tstats(struct pfctl_handle *h, const struct pfr_table *filter,
+ pfctl_get_tstats_fn fn, void *arg);
+
#endif
diff --git a/sbin/pfctl/pfctl_radix.c b/sbin/pfctl/pfctl_radix.c
index 3bb2469a9bfb..3b0cc615e5a2 100644
--- a/sbin/pfctl/pfctl_radix.c
+++ b/sbin/pfctl/pfctl_radix.c
@@ -110,31 +110,6 @@ pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size,
return (0);
}
-int
-pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size,
- int flags)
-{
- struct pfioc_table io;
-
- if (size == NULL || *size < 0 || (*size && tbl == NULL)) {
- errno = EINVAL;
- return (-1);
- }
- bzero(&io, sizeof io);
- io.pfrio_flags = flags;
- if (filter != NULL)
- io.pfrio_table = *filter;
- io.pfrio_buffer = tbl;
- io.pfrio_esize = sizeof(*tbl);
- io.pfrio_size = *size;
- if (ioctl(dev, DIOCRGETTSTATS, &io)) {
- pfr_report_error(filter, &io, "get tstats for");
- return (-1);
- }
- *size = io.pfrio_size;
- return (0);
-}
-
int
pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags)
{
diff --git a/sbin/pfctl/pfctl_table.c b/sbin/pfctl/pfctl_table.c
index 90e87adadb0f..57f7354b0172 100644
--- a/sbin/pfctl/pfctl_table.c
+++ b/sbin/pfctl/pfctl_table.c
@@ -57,8 +57,8 @@
extern void usage(void);
static int pfctl_table(int, char *[], char *, const char *, char *,
const char *, int);
-static void print_table(struct pfr_table *, int, int);
-static void print_tstats(struct pfr_tstats *, int);
+static void print_table(const struct pfr_table *, int, int);
+static int print_tstats(const struct pfr_tstats *, int);
static int load_addr(struct pfr_buffer *, int, char *[], char *, int);
static void print_addrx(struct pfr_addr *, struct pfr_addr *, int);
static int nonzero_astats(struct pfr_astats *);
@@ -165,28 +165,31 @@ pfctl_table(int argc, char *argv[], char *tname, const char *command,
PFRB_TSTATS : PFRB_TABLES;
if (argc || file != NULL)
usage();
- for (;;) {
- pfr_buf_grow(&b, b.pfrb_size);
- b.pfrb_size = b.pfrb_msize;
- if (opts & PF_OPT_VERBOSE2)
- RVTEST(pfr_get_tstats(&table,
- b.pfrb_caddr, &b.pfrb_size, flags));
- else
- RVTEST(pfr_get_tables(&table,
- b.pfrb_caddr, &b.pfrb_size, flags));
- if (b.pfrb_size <= b.pfrb_msize)
- break;
- }
if ((opts & PF_OPT_SHOWALL) && b.pfrb_size > 0)
pfctl_print_title("TABLES:");
- PFRB_FOREACH(p, &b)
- if (opts & PF_OPT_VERBOSE2)
- print_tstats(p, opts & PF_OPT_DEBUG);
- else
+ if (opts & PF_OPT_VERBOSE2) {
+ uintptr_t arg = opts & PF_OPT_DEBUG;
+ pfctl_get_tstats(pfh, &table,
+ (pfctl_get_tstats_fn)print_tstats, (void *)arg);
+ } else {
+ for (;;) {
+ pfr_buf_grow(&b, b.pfrb_size);
+ b.pfrb_size = b.pfrb_msize;
+ RVTEST(pfr_get_tables(&table,
+ b.pfrb_caddr, &b.pfrb_size, flags));
+ if (b.pfrb_size <= b.pfrb_msize)
+ break;
+ }
+
+ if ((opts & PF_OPT_SHOWALL) && b.pfrb_size > 0)
+ pfctl_print_title("TABLES:");
+
+ PFRB_FOREACH(p, &b)
print_table(p, opts & PF_OPT_VERBOSE,
opts & PF_OPT_DEBUG);
+ }
} else if (!strcmp(command, "kill")) {
if (argc || file != NULL)
usage();
@@ -408,7 +411,7 @@ _cleanup:
}
void
-print_table(struct pfr_table *ta, int verbose, int debug)
+print_table(const struct pfr_table *ta, int verbose, int debug)
{
if (!debug && !(ta->pfrt_flags & PFR_TFLAG_ACTIVE))
return;
@@ -429,14 +432,14 @@ print_table(struct pfr_table *ta, int verbose, int debug)
puts(ta->pfrt_name);
}
-void
-print_tstats(struct pfr_tstats *ts, int debug)
+int
+print_tstats(const struct pfr_tstats *ts, int debug)
{
time_t time = ts->pfrts_tzero;
int dir, op;
if (!debug && !(ts->pfrts_flags & PFR_TFLAG_ACTIVE))
- return;
+ return (0);
print_table(&ts->pfrts_t, 1, debug);
printf("\tAddresses: %d\n", ts->pfrts_cnt);
printf("\tCleared: %s", ctime(&time));
@@ -452,6 +455,8 @@ print_tstats(struct pfr_tstats *ts, int debug)
stats_text[dir][op],
(unsigned long long)ts->pfrts_packets[dir][op],
(unsigned long long)ts->pfrts_bytes[dir][op]);
+
+ return (0);
}
int
diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c
index 73c39e1f7471..f34bb71839b3 100644
--- a/sys/netpfil/pf/pf_nl.c
+++ b/sys/netpfil/pf/pf_nl.c
@@ -1937,6 +1937,104 @@ pf_handle_del_table(struct nlmsghdr *hdr, struct nl_pstate *npt)
return (0);
}
+static bool
+nlattr_add_pfr_table(struct nl_writer *nw, int attrtype,
+ struct pfr_table *t)
+{
+ int off = nlattr_add_nested(nw, attrtype);
+
+ nlattr_add_string(nw, PF_T_ANCHOR, t->pfrt_anchor);
+ nlattr_add_string(nw, PF_T_NAME, t->pfrt_name);
+ nlattr_add_u32(nw, PF_T_TABLE_FLAGS, t->pfrt_flags);
+
+ nlattr_set_len(nw, off);
+
+ return (true);
+}
+
+static int
+pf_handle_get_tstats(struct nlmsghdr *hdr, struct nl_pstate *npt)
+{
+ struct pfioc_table attrs = { 0 };
+ struct nl_writer *nw = npt->nw;
+ struct genlmsghdr *ghdr_new;
+ struct pfr_tstats *pfrtstats;
+ int error;
+ int n;
+
+ PF_RULES_RLOCK_TRACKER;
+
+ error = nl_parse_nlmsg(hdr, &table_parser, npt, &attrs);
+ if (error != 0)
+ return (error);
+
+ PF_TABLE_STATS_LOCK();
+ PF_RULES_RLOCK();
+
+ n = pfr_table_count(&attrs.pfrio_table, attrs.pfrio_flags);
+ pfrtstats = mallocarray(n,
+ sizeof(struct pfr_tstats), M_TEMP, M_NOWAIT | M_ZERO);
+
+ error = pfr_get_tstats(&attrs.pfrio_table, pfrtstats,
+ &n, attrs.pfrio_flags | PFR_FLAG_USERIOCTL);
+
+ PF_RULES_RUNLOCK();
+ PF_TABLE_STATS_UNLOCK();
+
+ if (error == 0) {
+ hdr->nlmsg_flags |= NLM_F_MULTI;
+
+ for (int i = 0; i < n; i++) {
+ uint64_t refcnt[PFR_REFCNT_MAX];
+
+ if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) {
+ error = ENOMEM;
+ break;
+ }
+
+ ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
+ ghdr_new->cmd = PFNL_CMD_GET_TSTATS;
+ ghdr_new->version = 0;
+ ghdr_new->reserved = 0;
+
+ nlattr_add_pfr_table(nw, PF_TS_TABLE,
+ &pfrtstats[i].pfrts_t);
+ nlattr_add_u64_array(nw, PF_TS_PACKETS,
+ PFR_DIR_MAX * PFR_OP_TABLE_MAX,
+ (uint64_t *)pfrtstats[i].pfrts_packets);
+ nlattr_add_u64_array(nw, PF_TS_BYTES,
+ PFR_DIR_MAX * PFR_OP_TABLE_MAX,
+ (uint64_t *)pfrtstats[i].pfrts_bytes);
+ nlattr_add_u64(nw, PF_TS_MATCH,
+ pfrtstats[i].pfrts_match);
+ nlattr_add_u64(nw, PF_TS_NOMATCH,
+ pfrtstats[i].pfrts_nomatch);
+ nlattr_add_u64(nw, PF_TS_TZERO,
+ pfrtstats[i].pfrts_tzero);
+ nlattr_add_u64(nw, PF_TS_CNT, pfrtstats[i].pfrts_cnt);
+
+ for (int j = 0; j < PFR_REFCNT_MAX; j++)
+ refcnt[j] = pfrtstats[i].pfrts_refcnt[j];
+
+ nlattr_add_u64_array(nw, PF_TS_REFCNT, PFR_REFCNT_MAX,
+ refcnt);
+
+ if (! nlmsg_end(nw)) {
+ error = ENOMEM;
+ break;
+ }
+ }
+ }
+ free(pfrtstats, M_TEMP);
+
+ if (!nlmsg_end_dump(npt->nw, error, hdr)) {
+ NL_LOG(LOG_DEBUG, "Unable to finalize the dump");
+ return (ENOMEM);
+ }
+
+ return (error);
+}
+
static const struct nlhdr_parser *all_parsers[] = {
&state_parser,
&addrule_parser,
@@ -2152,6 +2250,13 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
},
+ {
+ .cmd_num = PFNL_CMD_GET_TSTATS,
+ .cmd_name = "GET_TSTATS",
+ .cmd_cb = pf_handle_get_tstats,
+ .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
+ .cmd_priv = PRIV_NETINET_PF,
+ },
};
void
diff --git a/sys/netpfil/pf/pf_nl.h b/sys/netpfil/pf/pf_nl.h
index dd68f452d7f1..ed01d3427fc4 100644
--- a/sys/netpfil/pf/pf_nl.h
+++ b/sys/netpfil/pf/pf_nl.h
@@ -64,6 +64,7 @@ enum {
PFNL_CMD_CLEAR_TABLES = 26,
PFNL_CMD_ADD_TABLE = 27,
PFNL_CMD_DEL_TABLE = 28,
+ PFNL_CMD_GET_TSTATS = 29,
__PFNL_CMD_MAX,
};
#define PFNL_CMD_MAX (__PFNL_CMD_MAX -1)
@@ -442,6 +443,18 @@ enum pf_tables_t {
PF_T_NBR_ADDED = 6, /* u32 */
};
+enum pf_tstats_t {
+ PF_TS_UNSPEC,
+ PF_TS_TABLE = 1, /* nested, pfr_table */
+ PF_TS_PACKETS = 2, /* u64 array */
+ PF_TS_BYTES = 3, /* u64 array */
+ PF_TS_MATCH = 4, /* u64 */
+ PF_TS_NOMATCH = 5, /* u64 */
+ PF_TS_TZERO = 6, /* u64 */
+ PF_TS_CNT = 7, /* u64 */
+ PF_TS_REFCNT = 8, /* u64 array */
+};
+
#ifdef _KERNEL
void pf_nl_register(void);
diff --git a/usr.sbin/bsnmpd/modules/snmp_pf/pf_snmp.c b/usr.sbin/bsnmpd/modules/snmp_pf/pf_snmp.c
index 0e40bcfb843e..f0f9e0f0e149 100644
--- a/usr.sbin/bsnmpd/modules/snmp_pf/pf_snmp.c
+++ b/usr.sbin/bsnmpd/modules/snmp_pf/pf_snmp.c
@@ -1297,11 +1297,28 @@ pfs_refresh(void)
return (0);
}
+static int
+pft_add_tstats(const struct pfr_tstats *t, void *arg)
+{
+ struct pft_entry *e;
+ int *index = arg;
+
+ e = malloc(sizeof(struct pft_entry));
+ if (e == NULL)
+ return (ENOMEM);
+
+ e->index = (*index) + 1;
+ (*index)++;
+ memcpy(&e->pft, t, sizeof(struct pfr_tstats));
+ TAILQ_INSERT_TAIL(&pft_table, e, link);
+
+ return (0);
+}
+
static int
pft_refresh(void)
{
- struct pfioc_table io;
- struct pfr_tstats *t = NULL;
+ struct pfr_table filter;
struct pft_entry *e;
int i, numtbls = 1;
@@ -1314,45 +1331,18 @@ pft_refresh(void)
free(e);
}
- bzero(&io, sizeof(io));
- io.pfrio_esize = sizeof(struct pfr_tstats);
-
- for (;;) {
- t = reallocf(t, numtbls * sizeof(struct pfr_tstats));
- if (t == NULL) {
- syslog(LOG_ERR, "pft_refresh(): reallocf() numtbls=%d: %s",
- numtbls, strerror(errno));
- goto err2;
- }
- io.pfrio_size = numtbls;
- io.pfrio_buffer = t;
+ bzero(&filter, sizeof(filter));
- if (ioctl(pfctl_fd(pfh), DIOCRGETTSTATS, &io)) {
- syslog(LOG_ERR, "pft_refresh(): ioctl(): %s",
- strerror(errno));
- goto err2;
- }
-
- if (numtbls >= io.pfrio_size)
- break;
-
- numtbls = io.pfrio_size;
- }
-
- for (i = 0; i < numtbls; i++) {
- e = malloc(sizeof(struct pft_entry));
- if (e == NULL)
- goto err1;
- e->index = i + 1;
- memcpy(&e->pft, t+i, sizeof(struct pfr_tstats));
- TAILQ_INSERT_TAIL(&pft_table, e, link);
+ if (pfctl_get_tstats(pfh, &filter, pft_add_tstats, &i)) {
+ syslog(LOG_ERR, "pft_refresh(): pfctl_get_tstats(): %s",
+ strerror(errno));
+ goto err1;
}
pft_table_age = time(NULL);
pft_table_count = numtbls;
pf_tick = this_tick;
- free(t);
return (0);
err1:
while (!TAILQ_EMPTY(&pft_table)) {
@@ -1360,8 +1350,6 @@ err1:
TAILQ_REMOVE(&pft_table, e, link);
free(e);
}
-err2:
- free(t);
return(-1);
}