From nobody Thu Oct 10 12:37:27 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4XPTmS1FDYz5Z05s; Thu, 10 Oct 2024 12:37:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4XPTmR6Jcsz4HLV; Thu, 10 Oct 2024 12:37:27 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1728563847; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=2viMATA41PpJUWb5YbO0v8Ilz8V9JOzQo3pi44KrtnY=; b=JRXMxgFORjLb5f0TRfDGoxjP+LJv1N1+8oLFVcVIrG9qLjXQUDa3M9I8jtEmwXZwx7Bs5E +Oq73JihwRr+FsrUemhrO4yJMPQfBuENEyTIuOCVrXukSJJtLmlIeQsDw7Rkdv0lqVbOTw 29LPNeSaovhNXLgvc1RzHnKtkdUfgd309DJFeBUWLWcSvM8PV3klsa7yeS0afklkGRInXa +W+i17LjCt8mPjBCDwG5wsVfb2ELn+zpJ6AmpWbDRarThVRTlpiCr5ccKhkwWPWkGg1ddc sGKEXvmqYcLXMSGrBt27n+MdtqZAKPk6f8Quqjh6s/NOKm1hVbuu5y1a+7ctNA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1728563847; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=2viMATA41PpJUWb5YbO0v8Ilz8V9JOzQo3pi44KrtnY=; b=ViHdxJMjBseXmKSxD1WGwIxsPJMJaLIHz3TLSKmZmMxu5BSfWCbb2yD354gVnE+Luy4UH+ PNn1tPutq3xcepynfQAquva0tru8/g2BQIZnQuwCS27KLifgWqOsgF7hMm2Kepi144OntP yIrcFmQFfxXy4dVPp3hYDwuWxhOocWVv3vj0PZdYxwLKIygaATe+yWUgG4zkV+jSqrCHHu YDkiaJu9hlECyxjGMESyj3p98a7nV3SNWgSmWaEn+YUYMrKemVVR0i1KgAq5WF7cQizxXq 5xpna4iHGrmxmYqamaJ6Tb79xZ095TJsHrUqK1MB18MRL0bxkbNRhrQF6qxDjA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1728563847; a=rsa-sha256; cv=none; b=BT3dzTMNaERofSrDVxHCnFB44FeX9ko653zua9jeUoYMYOV+oe0qfPDIttJj2j47/esyAK 7cOj9uW1HzURFGowBoAqtglgWVCUTs1BgW1nq8/79On9J9P+1syZWCBJQnlsMzt7aRuyDl HTf1O32OEQZW6WTUiD3QuYF70UsluepDXawQFD7PAxNL6sjxfkBW8IZlFV6thuVbAW2vHY c51wuaBb0AMb/cGDTTZfoD5WCbxnYd7KQcHgitUJsnNbzhxTHNEVTe6K1v9Ygk9VAJN1Rw xOFox449mv0H9VTByitpsEJvK9KUOG7Ej8+1nTk+J2ILm6Bxr0QSxwnaca8+pw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4XPTmR5wbmzxTR; Thu, 10 Oct 2024 12:37:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 49ACbRH0006684; Thu, 10 Oct 2024 12:37:27 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 49ACbRW9006681; Thu, 10 Oct 2024 12:37:27 GMT (envelope-from git) Date: Thu, 10 Oct 2024 12:37:27 GMT Message-Id: <202410101237.49ACbRW9006681@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: 48f5bf8be6fa - main - pf: convert DIOCGETRULESET to netlink List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 48f5bf8be6fa6755a8cd285d74facb4ffefc8413 Auto-Submitted: auto-generated The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=48f5bf8be6fa6755a8cd285d74facb4ffefc8413 commit 48f5bf8be6fa6755a8cd285d74facb4ffefc8413 Author: Kristof Provost AuthorDate: 2024-10-03 12:07:40 +0000 Commit: Kristof Provost CommitDate: 2024-10-10 12:10:41 +0000 pf: convert DIOCGETRULESET to netlink Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D46938 --- lib/libpfctl/libpfctl.c | 36 ++++++++++++++++++++++++ lib/libpfctl/libpfctl.h | 1 + sbin/pfctl/pfctl.c | 18 ++++-------- sys/net/pfvar.h | 1 + sys/netpfil/pf/pf_ioctl.c | 72 +++++++++++++++++++++++++++-------------------- sys/netpfil/pf/pf_nl.c | 42 +++++++++++++++++++++++++++ sys/netpfil/pf/pf_nl.h | 2 ++ 7 files changed, 130 insertions(+), 42 deletions(-) diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c index c9f315a0db67..e0d93041c551 100644 --- a/lib/libpfctl/libpfctl.c +++ b/lib/libpfctl/libpfctl.c @@ -2920,6 +2920,7 @@ pfctl_get_addr(struct pfctl_handle *h, uint32_t ticket, uint32_t r_num, #define _OUT(_field) offsetof(struct pfioc_ruleset, _field) static const struct snl_attr_parser ap_ruleset[] = { { .type = PF_RS_NR, .off = _OUT(nr), .cb = snl_attr_get_uint32 }, + { .type = PF_RS_NAME, .off = _OUT(name), .arg = (void *)PF_ANCHOR_NAME_SIZE, .cb = snl_attr_copy_string }, }; static struct snl_field_parser fp_ruleset[] = {}; SNL_DECLARE_PARSER(ruleset_parser, struct genlmsghdr, fp_ruleset, ap_ruleset); @@ -2962,3 +2963,38 @@ pfctl_get_rulesets(struct pfctl_handle *h, const char *path, uint32_t *nr) return (e.error); } +int +pfctl_get_ruleset(struct pfctl_handle *h, const char *path, uint32_t nr, struct pfioc_ruleset *rs) +{ + struct snl_writer nw; + struct snl_errmsg_data e = {}; + struct nlmsghdr *hdr; + uint32_t seq_id; + int family_id; + + family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME); + if (family_id == 0) + return (ENOTSUP); + + snl_init_writer(&h->ss, &nw); + hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_GET_RULESET); + + snl_add_msg_attr_string(&nw, PF_RS_PATH, path); + snl_add_msg_attr_u32(&nw, PF_RS_NR, nr); + + if ((hdr = snl_finalize_msg(&nw)) == NULL) + return (ENXIO); + + seq_id = hdr->nlmsg_seq; + + if (! snl_send_message(&h->ss, hdr)) + return (ENXIO); + + while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) { + if (! snl_parse_nlmsg(&h->ss, hdr, &ruleset_parser, rs)) + continue; + } + + return (e.error); +} + diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h index 6d8be24dd04f..4da21774a958 100644 --- a/lib/libpfctl/libpfctl.h +++ b/lib/libpfctl/libpfctl.h @@ -505,5 +505,6 @@ int pfctl_get_addrs(struct pfctl_handle *h, uint32_t ticket, uint32_t r_num, int pfctl_get_addr(struct pfctl_handle *h, uint32_t ticket, uint32_t r_num, uint8_t r_action, const char *anchor, uint32_t nr, struct pfioc_pooladdr *pa); int pfctl_get_rulesets(struct pfctl_handle *h, const char *path, uint32_t *nr); +int pfctl_get_ruleset(struct pfctl_handle *h, const char *path, uint32_t nr, struct pfioc_ruleset *rs); #endif diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c index ee49e7b12278..4ca77f6c5f4a 100644 --- a/sbin/pfctl/pfctl.c +++ b/sbin/pfctl/pfctl.c @@ -1252,7 +1252,6 @@ pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format, u_int32_t mnr, nr; memset(&prs, 0, sizeof(prs)); - memcpy(prs.path, npath, sizeof(prs.path)); if ((ret = pfctl_get_rulesets(pfh, npath, &mnr)) != 0) { if (ret == EINVAL) fprintf(stderr, "Anchor '%s' " @@ -1263,9 +1262,8 @@ pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format, pfctl_print_rule_counters(&rule, opts); for (nr = 0; nr < mnr; ++nr) { - prs.nr = nr; - if (ioctl(dev, DIOCGETRULESET, &prs)) - err(1, "DIOCGETRULESET"); + if ((ret = pfctl_get_ruleset(pfh, npath, nr, &prs)) != 0) + errc(1, ret, "DIOCGETRULESET"); INDENT(depth, !(opts & PF_OPT_VERBOSE)); printf("anchor \"%s\" all {\n", prs.name); pfctl_show_rules(dev, npath, opts, @@ -1455,7 +1453,6 @@ pfctl_show_nat(int dev, char *path, int opts, char *anchorname, int depth, struct pfioc_ruleset prs; u_int32_t mnr, nr; memset(&prs, 0, sizeof(prs)); - memcpy(prs.path, npath, sizeof(prs.path)); if ((ret = pfctl_get_rulesets(pfh, npath, &mnr)) != 0) { if (ret == EINVAL) fprintf(stderr, "NAT anchor '%s' " @@ -1466,9 +1463,8 @@ pfctl_show_nat(int dev, char *path, int opts, char *anchorname, int depth, pfctl_print_rule_counters(&rule, opts); for (nr = 0; nr < mnr; ++nr) { - prs.nr = nr; - if (ioctl(dev, DIOCGETRULESET, &prs)) - err(1, "DIOCGETRULESET"); + if ((ret = pfctl_get_ruleset(pfh, npath, nr, &prs)) != 0) + errc(1, ret, "DIOCGETRULESET"); INDENT(depth, !(opts & PF_OPT_VERBOSE)); printf("nat-anchor \"%s\" all {\n", prs.name); pfctl_show_nat(dev, npath, opts, @@ -2816,7 +2812,6 @@ pfctl_show_anchors(int dev, int opts, char *anchorname) int ret; memset(&pr, 0, sizeof(pr)); - memcpy(pr.path, anchorname, sizeof(pr.path)); if ((ret = pfctl_get_rulesets(pfh, anchorname, &mnr)) != 0) { if (ret == EINVAL) fprintf(stderr, "Anchor '%s' not found.\n", @@ -2828,9 +2823,8 @@ pfctl_show_anchors(int dev, int opts, char *anchorname) for (nr = 0; nr < mnr; ++nr) { char sub[MAXPATHLEN]; - pr.nr = nr; - if (ioctl(dev, DIOCGETRULESET, &pr)) - err(1, "DIOCGETRULESET"); + if ((ret = pfctl_get_ruleset(pfh, anchorname, nr, &pr)) != 0) + errc(1, ret, "DIOCGETRULESET"); if (!strcmp(pr.name, PF_RESERVED_ANCHOR)) continue; sub[0] = 0; diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h index 62f1edad7051..cf7db417034d 100644 --- a/sys/net/pfvar.h +++ b/sys/net/pfvar.h @@ -2581,6 +2581,7 @@ int pf_ioctl_add_addr(struct pfioc_pooladdr *); int pf_ioctl_get_addrs(struct pfioc_pooladdr *); int pf_ioctl_get_addr(struct pfioc_pooladdr *); int pf_ioctl_get_rulesets(struct pfioc_ruleset *); +int pf_ioctl_get_ruleset(struct pfioc_ruleset *); void pf_krule_free(struct pf_krule *); void pf_krule_clear_counters(struct pf_krule *); diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c index e3fb3150db5f..ce28a9cd6dc1 100644 --- a/sys/netpfil/pf/pf_ioctl.c +++ b/sys/netpfil/pf/pf_ioctl.c @@ -2696,6 +2696,47 @@ pf_ioctl_get_rulesets(struct pfioc_ruleset *pr) return (0); } +int +pf_ioctl_get_ruleset(struct pfioc_ruleset *pr) +{ + struct pf_kruleset *ruleset; + struct pf_kanchor *anchor; + u_int32_t nr = 0; + int error = 0; + + PF_RULES_RLOCK_TRACKER; + + PF_RULES_RLOCK(); + if ((ruleset = pf_find_kruleset(pr->path)) == NULL) { + PF_RULES_RUNLOCK(); + return (ENOENT); + } + + pr->name[0] = 0; + if (ruleset->anchor == NULL) { + /* XXX kludge for pf_main_ruleset */ + RB_FOREACH(anchor, pf_kanchor_global, &V_pf_anchors) + if (anchor->parent == NULL && nr++ == pr->nr) { + strlcpy(pr->name, anchor->name, + sizeof(pr->name)); + break; + } + } else { + RB_FOREACH(anchor, pf_kanchor_node, + &ruleset->anchor->children) + if (nr++ == pr->nr) { + strlcpy(pr->name, anchor->name, + sizeof(pr->name)); + break; + } + } + if (!pr->name[0]) + error = EBUSY; + PF_RULES_RUNLOCK(); + + return (error); +} + static int pfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread *td) { @@ -4514,39 +4555,10 @@ DIOCCHANGEADDR_error: case DIOCGETRULESET: { struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; - struct pf_kruleset *ruleset; - struct pf_kanchor *anchor; - u_int32_t nr = 0; pr->path[sizeof(pr->path) - 1] = 0; - PF_RULES_RLOCK(); - if ((ruleset = pf_find_kruleset(pr->path)) == NULL) { - PF_RULES_RUNLOCK(); - error = ENOENT; - break; - } - pr->name[0] = 0; - if (ruleset->anchor == NULL) { - /* XXX kludge for pf_main_ruleset */ - RB_FOREACH(anchor, pf_kanchor_global, &V_pf_anchors) - if (anchor->parent == NULL && nr++ == pr->nr) { - strlcpy(pr->name, anchor->name, - sizeof(pr->name)); - break; - } - } else { - RB_FOREACH(anchor, pf_kanchor_node, - &ruleset->anchor->children) - if (nr++ == pr->nr) { - strlcpy(pr->name, anchor->name, - sizeof(pr->name)); - break; - } - } - if (!pr->name[0]) - error = EBUSY; - PF_RULES_RUNLOCK(); + error = pf_ioctl_get_ruleset(pr); break; } diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c index e3c0369f550d..c75af9091d08 100644 --- a/sys/netpfil/pf/pf_nl.c +++ b/sys/netpfil/pf/pf_nl.c @@ -1638,6 +1638,7 @@ pf_handle_get_addr(struct nlmsghdr *hdr, struct nl_pstate *npt) #define _OUT(_field) offsetof(struct pfioc_ruleset, _field) static const struct nlattr_parser nla_p_ruleset[] = { { .type = PF_RS_PATH, .off = _OUT(path), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara }, + { .type = PF_RS_NR, .off = _OUT(nr), .cb = nlattr_get_uint32 }, }; static const struct nlfield_parser nlf_p_ruleset[] = { }; @@ -1678,6 +1679,40 @@ pf_handle_get_rulesets(struct nlmsghdr *hdr, struct nl_pstate *npt) return (0); } +static int +pf_handle_get_ruleset(struct nlmsghdr *hdr, struct nl_pstate *npt) +{ + struct pfioc_ruleset attrs = { 0 }; + struct nl_writer *nw = npt->nw; + struct genlmsghdr *ghdr_new; + int error; + + error = nl_parse_nlmsg(hdr, &ruleset_parser, npt, &attrs); + if (error) + return (error); + + error = pf_ioctl_get_ruleset(&attrs); + if (error != 0) + return (error); + + if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) + return (ENOMEM); + + ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); + ghdr_new->cmd = PFNL_CMD_GET_RULESET; + ghdr_new->version = 0; + ghdr_new->reserved = 0; + + nlattr_add_string(nw, PF_RS_NAME, attrs.name); + + if (!nlmsg_end(nw)) { + nlmsg_abort(nw); + return (ENOMEM); + } + + return (0); +} + static const struct nlhdr_parser *all_parsers[] = { &state_parser, &addrule_parser, @@ -1857,6 +1892,13 @@ static const struct genl_cmd pf_cmds[] = { .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, }, + { + .cmd_num = PFNL_CMD_GET_RULESET, + .cmd_name = "GET_RULESET", + .cmd_cb = pf_handle_get_ruleset, + .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, + .cmd_priv = PRIV_NETINET_PF, + }, }; void diff --git a/sys/netpfil/pf/pf_nl.h b/sys/netpfil/pf/pf_nl.h index 5aa02d10214b..0ec68658dcf3 100644 --- a/sys/netpfil/pf/pf_nl.h +++ b/sys/netpfil/pf/pf_nl.h @@ -59,6 +59,7 @@ enum { PFNL_CMD_GET_ADDRS = 21, PFNL_CMD_GET_ADDR = 22, PFNL_CMD_GET_RULESETS = 23, + PFNL_CMD_GET_RULESET = 24, __PFNL_CMD_MAX, }; #define PFNL_CMD_MAX (__PFNL_CMD_MAX -1) @@ -385,6 +386,7 @@ enum pf_get_rulesets_types_t { PF_RS_UNSPEC, PF_RS_PATH = 1, /* string */ PF_RS_NR = 2, /* u32 */ + PF_RS_NAME = 3, /* string */ }; #ifdef _KERNEL