Date: Fri, 05 Dec 2025 13:09:40 +0000 From: Kristof Provost <kp@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 08f54dfca197 - main - pf: convert DIOCRGETASTATS to netlink Message-ID: <6932d994.276b1.5090299b@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=08f54dfca1970b1e014c99c7f8fc806b949267af commit 08f54dfca1970b1e014c99c7f8fc806b949267af Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2025-12-04 14:27:27 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2025-12-05 12:24:52 +0000 pf: convert DIOCRGETASTATS to netlink Sponsored by: Rubicon Communications, LLC ("Netgate") --- lib/libpfctl/libpfctl.c | 92 +++++++++++++++++++++++++++++++++++------ sys/netpfil/pf/pf_nl.c | 108 +++++++++++++++++++++++++++++++++++++++++++++++- sys/netpfil/pf/pf_nl.h | 16 +++++++ 3 files changed, 203 insertions(+), 13 deletions(-) diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c index 11377897ebb3..ab49dabe88c2 100644 --- a/lib/libpfctl/libpfctl.c +++ b/lib/libpfctl/libpfctl.c @@ -3751,26 +3751,94 @@ pfctl_clear_addrs(struct pfctl_handle *h, const struct pfr_table *filter, return (e.error); } + +struct nl_astats { + struct pfr_astats *a; + size_t max; + size_t count; + uint64_t total_count; +}; + +#define _OUT(_field) offsetof(struct pfr_astats, _field) +static const struct snl_attr_parser ap_pfr_astats[] = { + { .type = PF_AS_ADDR , .off = _OUT(pfras_a), .arg = &pfr_addr_parser, .cb = snl_attr_get_nested }, + { .type = PF_AS_PACKETS, .off = _OUT(pfras_packets), .arg = (void *)(PFR_DIR_MAX * PFR_OP_ADDR_MAX), .cb = snl_attr_get_uint64_array }, + { .type = PF_AS_BYTES, .off = _OUT(pfras_bytes), .arg = (void *)(PFR_DIR_MAX * PFR_OP_ADDR_MAX), .cb = snl_attr_get_uint64_array }, + { .type = PF_AS_TZERO, .off = _OUT(pfras_tzero), .cb = snl_attr_get_time_t }, +}; +#undef _OUT +SNL_DECLARE_ATTR_PARSER(pfr_astats_parser, ap_pfr_astats); + +static bool +snl_attr_get_pfr_astats(struct snl_state *ss, struct nlattr *nla, + const void *arg __unused, void *target) +{ + struct nl_astats *a = (struct nl_astats *)target; + bool ret; + + if (a->count >= a->max) + return (false); + + ret = snl_parse_header(ss, NLA_DATA(nla), NLA_DATA_LEN(nla), + &pfr_astats_parser, &a->a[a->count]); + if (ret) + a->count++; + + return (ret); +} + +#define _OUT(_field) offsetof(struct nl_astats, _field) +static struct snl_attr_parser ap_table_get_astats[] = { + { .type = PF_TAS_ASTATS, .off = 0, .cb = snl_attr_get_pfr_astats }, + { .type = PF_TAS_ASTATS_COUNT, .off = _OUT(total_count), .cb = snl_attr_get_uint32 }, +}; +#undef _OUT +SNL_DECLARE_PARSER(table_astats_parser, struct genlmsghdr, snl_f_p_empty, ap_table_get_astats); + int pfctl_get_astats(struct pfctl_handle *h, const struct pfr_table *tbl, - struct pfr_astats *addr, int *size, int flags) + struct pfr_astats *as, int *size, int flags) { - struct pfioc_table io; + struct snl_writer nw; + struct snl_errmsg_data e = {}; + struct nlmsghdr *hdr; + struct nl_astats out = { 0 }; + uint32_t seq_id; + int family_id; if (tbl == NULL || size == NULL || *size < 0 || - (*size && addr == NULL)) { + (*size && as == NULL)) { errno = EINVAL; return (-1); } - bzero(&io, sizeof io); - io.pfrio_flags = flags; - io.pfrio_table = *tbl; - io.pfrio_buffer = addr; - io.pfrio_esize = sizeof(*addr); - io.pfrio_size = *size; - if (ioctl(h->fd, DIOCRGETASTATS, &io)) { - return (-1); + + family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME); + if (family_id == 0) + return (ENOTSUP); + + snl_init_writer(&h->ss, &nw); + + hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_TABLE_GET_ASTATS); + + snl_add_msg_attr_table(&nw, PF_TAS_TABLE, tbl); + snl_add_msg_attr_u32(&nw, PF_TAS_FLAGS, flags); + + if ((hdr = snl_finalize_msg(&nw)) == NULL) + return (ENXIO); + seq_id = hdr->nlmsg_seq; + + if (! snl_send_message(&h->ss, hdr)) + return (ENXIO); + + out.a = as; + out.max = *size; + + while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) { + if (! snl_parse_nlmsg(&h->ss, hdr, &table_astats_parser, &out)) + continue; } - *size = io.pfrio_size; + + *size = out.total_count; + return (0); } diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c index 993981a9c0de..7a3775b97b3a 100644 --- a/sys/netpfil/pf/pf_nl.c +++ b/sys/netpfil/pf/pf_nl.c @@ -1179,7 +1179,7 @@ nlattr_add_fcounters(struct nl_writer *nw, int attr, size_t number, char **names } static bool -nlattr_add_u64_array(struct nl_writer *nw, int attr, size_t number, uint64_t *array) +nlattr_add_u64_array(struct nl_writer *nw, int attr, size_t number, const uint64_t *array) { int off = nlattr_add_nested(nw, attr); @@ -2327,6 +2327,104 @@ out: return (error); } +static int +nlattr_add_pfr_astats(struct nl_writer *nw, int attr, const struct pfr_astats *a) +{ + int off = nlattr_add_nested(nw, attr); + if (off == 0) + return (false); + + nlattr_add_pfr_addr(nw, PF_AS_ADDR, &a->pfras_a); + nlattr_add_u64_array(nw, PF_AS_PACKETS, PFR_DIR_MAX * PFR_OP_ADDR_MAX, + (const uint64_t *)a->pfras_packets); + nlattr_add_u64_array(nw,PF_AS_BYTES, PFR_DIR_MAX * PFR_OP_ADDR_MAX, + (const uint64_t *)a->pfras_bytes); + nlattr_add_time_t(nw, PF_AS_TZERO, a->pfras_tzero); + + nlattr_set_len(nw, off); + + return (true); +} + +struct nl_parsed_table_astats { + struct pfr_table table; + uint32_t flags; +}; +#define _OUT(_field) offsetof(struct nl_parsed_table_astats, _field) +static const struct nlattr_parser nla_p_table_astats[] = { + { .type = PF_TAS_TABLE, .off = _OUT(table), .arg = &nested_table_parser, .cb = nlattr_get_nested }, + { .type = PF_TAS_FLAGS, .off = _OUT(flags), .cb = nlattr_get_uint32 }, +}; +NL_DECLARE_PARSER(table_astats_parser, struct genlmsghdr, nlf_p_empty, nla_p_table_astats); +#undef _OUT + +static int +pf_handle_table_get_astats(struct nlmsghdr *hdr, struct nl_pstate *npt) +{ + struct nl_parsed_table_astats attrs = { 0 }; + struct nl_writer *nw = npt->nw; + struct pfr_astats *pfrastats; + struct genlmsghdr *ghdr_new; + int size = 0; + int error; + + PF_RULES_RLOCK_TRACKER; + + error = nl_parse_nlmsg(hdr, &table_astats_parser, npt, &attrs); + if (error != 0) + return (error); + + PF_RULES_RLOCK(); + + /* Get required size. */ + error = pfr_get_astats(&attrs.table, NULL, + &size, attrs.flags | PFR_FLAG_USERIOCTL); + if (error != 0) { + PF_RULES_RUNLOCK(); + return (error); + } + + pfrastats = mallocarray(size, sizeof(struct pfr_astats), M_PF, + M_NOWAIT | M_ZERO); + if (pfrastats == NULL) { + PF_RULES_RUNLOCK(); + return (ENOMEM); + } + + /* Now get the astats. */ + error = pfr_get_astats(&attrs.table, pfrastats, + &size, attrs.flags | PFR_FLAG_USERIOCTL); + PF_RULES_RUNLOCK(); + if (error != 0) + goto out; + + for (int i = 0; i < size; i++) { + if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) { + nlmsg_abort(nw); + error = ENOMEM; + goto out; + } + ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); + ghdr_new->cmd = PFNL_CMD_TABLE_GET_ASTATS; + ghdr_new->version = 0; + ghdr_new->reserved = 0; + + if (i == 0) + nlattr_add_u32(nw, PF_TAS_ASTATS_COUNT, size); + + nlattr_add_pfr_astats(nw, PF_TAS_ASTATS, &pfrastats[i]); + if (!nlmsg_end(nw)) { + nlmsg_abort(nw); + error = ENOMEM; + goto out; + } + } + +out: + free(pfrastats, M_PF); + return (error); +} + static const struct nlhdr_parser *all_parsers[] = { &state_parser, &addrule_parser, @@ -2342,6 +2440,7 @@ static const struct nlhdr_parser *all_parsers[] = { &ruleset_parser, &table_parser, &table_addr_parser, + &table_astats_parser, }; static uint16_t family_id; @@ -2592,6 +2691,13 @@ static const struct genl_cmd pf_cmds[] = { .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, }, + { + .cmd_num = PFNL_CMD_TABLE_GET_ASTATS, + .cmd_name = "TABLE_GET_ASTATS", + .cmd_cb = pf_handle_table_get_astats, + .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, + .cmd_priv = PRIV_NETINET_PF, + }, }; void diff --git a/sys/netpfil/pf/pf_nl.h b/sys/netpfil/pf/pf_nl.h index e1eb3e628df5..5ca14758932a 100644 --- a/sys/netpfil/pf/pf_nl.h +++ b/sys/netpfil/pf/pf_nl.h @@ -71,6 +71,7 @@ enum { PFNL_CMD_TABLE_DEL_ADDR = 33, PFNL_CMD_TABLE_SET_ADDR = 34, PFNL_CMD_TABLE_GET_ADDR = 35, + PFNL_CMD_TABLE_GET_ASTATS = 36, __PFNL_CMD_MAX, }; #define PFNL_CMD_MAX (__PFNL_CMD_MAX -1) @@ -489,6 +490,21 @@ enum pf_table_addrs_t { PF_TA_ADDR_COUNT = 7, /* u32 */ }; +enum pf_astats_t { + PF_AS_UNSPEC, + PF_AS_ADDR = 1, /* nested, pfr_addr_t */ + PF_AS_PACKETS = 2, /* u64 array */ + PF_AS_BYTES = 3, /* u64 array */ + PF_AS_TZERO = 4, /* time_t */ +}; + +enum pf_table_astats_t { + PF_TAS_UNSPEC, + PF_TAS_TABLE = 1, /* nested pf_table_t */ + PF_TAS_ASTATS = 2, /* nested, pfr_astats_t */ + PF_TAS_FLAGS = 3, /* u32 */ + PF_TAS_ASTATS_COUNT = 4, /* u32 */ +}; #ifdef _KERNEL void pf_nl_register(void);help
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6932d994.276b1.5090299b>