Date: Tue, 14 Jan 2025 10:37:45 GMT From: Kristof Provost <kp@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 441d489493e8 - main - pf: convert DIOCRCLRTABLES to netlink Message-ID: <202501141037.50EAbj9o047733@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=441d489493e8a1e2658306f1a4c709a0b18cc78b commit 441d489493e8a1e2658306f1a4c709a0b18cc78b Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2024-12-03 15:53:08 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2025-01-14 08:54:17 +0000 pf: convert DIOCRCLRTABLES to netlink Sponsored by: Rubicon Communications, LLC ("Netgate") --- lib/libpfctl/libpfctl.c | 44 ++++++++++++++++++++++++++++++++++++++ lib/libpfctl/libpfctl.h | 3 +++ sbin/pfctl/pfctl.c | 4 ++-- sbin/pfctl/pfctl.h | 5 +++-- sbin/pfctl/pfctl_radix.c | 16 -------------- sbin/pfctl/pfctl_table.c | 4 ++-- sys/netpfil/pf/pf_nl.c | 55 ++++++++++++++++++++++++++++++++++++++++++++++++ sys/netpfil/pf/pf_nl.h | 10 +++++++++ 8 files changed, 119 insertions(+), 22 deletions(-) diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c index 2e4cdb91bad9..b374ef05e4d7 100644 --- a/lib/libpfctl/libpfctl.c +++ b/lib/libpfctl/libpfctl.c @@ -3072,3 +3072,47 @@ pfctl_get_srcnodes(struct pfctl_handle *h, pfctl_get_srcnode_fn fn, void *arg) return (e.error); } + +static struct snl_attr_parser ap_ndel[] = { + { .type = PF_T_NBR_DELETED, .off = 0, .cb = snl_attr_get_uint32 }, +}; +static struct snl_field_parser fp_ndel[] = {}; +SNL_DECLARE_PARSER(ndel_parser, struct genlmsghdr, fp_ndel, ap_ndel); + +int +pfctl_clear_tables(struct pfctl_handle *h, struct pfr_table *filter, + int *ndel, int flags) +{ + struct snl_writer nw; + struct snl_errmsg_data e = {}; + struct nlmsghdr *hdr; + uint32_t seq_id; + int family_id; + + family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME); + if (family_id == 0) + return (ENOTSUP); + + snl_init_writer(&h->ss, &nw); + hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_CLEAR_TABLES); + + snl_add_msg_attr_string(&nw, PF_T_ANCHOR, filter->pfrt_anchor); + snl_add_msg_attr_string(&nw, PF_T_NAME, filter->pfrt_name); + snl_add_msg_attr_u32(&nw, PF_T_TABLE_FLAGS, filter->pfrt_flags); + snl_add_msg_attr_u32(&nw, PF_T_FLAGS, flags); + + if ((hdr = snl_finalize_msg(&nw)) == NULL) + return (ENXIO); + + seq_id = hdr->nlmsg_seq; + + if (!snl_send_message(&h->ss, hdr)) + return (ENXIO); + + while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) { + if (!snl_parse_nlmsg(&h->ss, hdr, &ndel_parser, ndel)) + continue; + } + + return (e.error); +} diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h index 79756286563b..14ea06fd151a 100644 --- a/lib/libpfctl/libpfctl.h +++ b/lib/libpfctl/libpfctl.h @@ -539,4 +539,7 @@ int pfctl_get_ruleset(struct pfctl_handle *h, const char *path, uint32_t nr, str typedef int (*pfctl_get_srcnode_fn)(struct pfctl_src_node*, void *); int pfctl_get_srcnodes(struct pfctl_handle *h, pfctl_get_srcnode_fn fn, void *arg); +int pfctl_clear_tables(struct pfctl_handle *h, struct pfr_table *filter, + int *ndel, int flags); + #endif diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c index 09d6774b324f..190d1a382c03 100644 --- a/sbin/pfctl/pfctl.c +++ b/sbin/pfctl/pfctl.c @@ -3219,7 +3219,7 @@ main(int argc, char *argv[]) pfctl_flush_eth_rules(dev, opts, anchorname); pfctl_flush_rules(dev, opts, anchorname); pfctl_flush_nat(dev, opts, anchorname); - pfctl_clear_tables(anchorname, opts); + pfctl_do_clear_tables(anchorname, opts); if (!*anchorname) { pfctl_clear_altq(dev, opts); pfctl_clear_iface_states(dev, ifaceopt, opts); @@ -3233,7 +3233,7 @@ main(int argc, char *argv[]) pfctl_clear_fingerprints(dev, opts); break; case 'T': - pfctl_clear_tables(anchorname, opts); + pfctl_do_clear_tables(anchorname, opts); break; } } diff --git a/sbin/pfctl/pfctl.h b/sbin/pfctl/pfctl.h index b4aba3beb4a6..788232d89006 100644 --- a/sbin/pfctl/pfctl.h +++ b/sbin/pfctl/pfctl.h @@ -36,6 +36,8 @@ #include <libpfctl.h> +extern struct pfctl_handle *pfh; + struct pfctl; enum pfctl_show { PFCTL_SHOW_RULES, PFCTL_SHOW_LABELS, PFCTL_SHOW_NOTHING }; @@ -54,7 +56,6 @@ struct pfr_buffer { (var) = pfr_buf_next((buf), (var))) int pfr_get_fd(void); -int pfr_clr_tables(struct pfr_table *, int *, int); int pfr_add_tables(struct pfr_table *, int, int *, int); int pfr_del_tables(struct pfr_table *, int, int *, int); int pfr_get_tables(struct pfr_table *, struct pfr_table *, int *, int); @@ -82,7 +83,7 @@ int pfi_get_ifaces(const char *, struct pfi_kif *, int *); int pfi_clr_istats(const char *, int *, int); void pfctl_print_title(char *); -int pfctl_clear_tables(const char *, int); +int pfctl_do_clear_tables(const char *, int); int pfctl_show_tables(const char *, int); int pfctl_command_tables(int, char *[], char *, const char *, char *, const char *, int); diff --git a/sbin/pfctl/pfctl_radix.c b/sbin/pfctl/pfctl_radix.c index 9bea219a7d81..22552bcf1737 100644 --- a/sbin/pfctl/pfctl_radix.c +++ b/sbin/pfctl/pfctl_radix.c @@ -73,22 +73,6 @@ pfr_report_error(struct pfr_table *tbl, struct pfioc_table *io, err, tbl->pfrt_name); } -int -pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags) -{ - struct pfioc_table io; - - bzero(&io, sizeof io); - io.pfrio_flags = flags; - if (filter != NULL) - io.pfrio_table = *filter; - if (ioctl(dev, DIOCRCLRTABLES, &io)) - return (-1); - if (ndel != NULL) - *ndel = io.pfrio_ndel; - return (0); -} - int pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags) { diff --git a/sbin/pfctl/pfctl_table.c b/sbin/pfctl/pfctl_table.c index aac031ce26b2..5e701be3c654 100644 --- a/sbin/pfctl/pfctl_table.c +++ b/sbin/pfctl/pfctl_table.c @@ -104,7 +104,7 @@ static const char *istats_text[2][2][2] = { } while(0) int -pfctl_clear_tables(const char *anchor, int opts) +pfctl_do_clear_tables(const char *anchor, int opts) { return pfctl_table(0, NULL, NULL, "-F", NULL, anchor, opts); } @@ -157,7 +157,7 @@ pfctl_table(int argc, char *argv[], char *tname, const char *command, if (!strcmp(command, "-F")) { if (argc || file != NULL) usage(); - RVTEST(pfr_clr_tables(&table, &ndel, flags)); + RVTEST(pfctl_clear_tables(pfh, &table, &ndel, flags)); xprintf(opts, "%d tables deleted", ndel); } else if (!strcmp(command, "-s")) { b.pfrb_type = (opts & PF_OPT_VERBOSE2) ? diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c index e586ad082e4b..3e7a6965d387 100644 --- a/sys/netpfil/pf/pf_nl.c +++ b/sys/netpfil/pf/pf_nl.c @@ -1793,6 +1793,53 @@ pf_handle_get_srcnodes(struct nlmsghdr *hdr, struct nl_pstate *npt) return (0); } +#define _OUT(_field) offsetof(struct pfioc_table, _field) +static const struct nlattr_parser nla_p_table[] = { + { .type = PF_T_ANCHOR, .off = _OUT(pfrio_table.pfrt_anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara }, + { .type = PF_T_NAME, .off = _OUT(pfrio_table.pfrt_name), .arg = (void *)PF_TABLE_NAME_SIZE, .cb = nlattr_get_chara }, + { .type = PF_T_TABLE_FLAGS, .off = _OUT(pfrio_table.pfrt_flags), .cb = nlattr_get_uint32 }, + { .type = PF_T_FLAGS, .off = _OUT(pfrio_flags), .cb = nlattr_get_uint32 }, +}; +static const struct nlfield_parser nlf_p_table[] = {}; +NL_DECLARE_PARSER(table_parser, struct genlmsghdr, nlf_p_table, nla_p_table); +#undef _OUT +static int +pf_handle_clear_tables(struct nlmsghdr *hdr, struct nl_pstate *npt) +{ + struct pfioc_table attrs = { 0 }; + struct nl_writer *nw = npt->nw; + struct genlmsghdr *ghdr_new; + int ndel = 0; + int error; + + error = nl_parse_nlmsg(hdr, &table_parser, npt, &attrs); + if (error != 0) + return (error); + + PF_RULES_WLOCK(); + error = pfr_clr_tables(&attrs.pfrio_table, &ndel, attrs.pfrio_flags | PFR_FLAG_USERIOCTL); + PF_RULES_WUNLOCK(); + if (error != 0) + return (error); + + if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) + return (ENOMEM); + + ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); + ghdr_new->cmd = PFNL_CMD_CLEAR_TABLES; + ghdr_new->version = 0; + ghdr_new->reserved = 0; + + nlattr_add_u32(nw, PF_T_NBR_DELETED, ndel); + + if (!nlmsg_end(nw)) { + nlmsg_abort(nw); + return (ENOMEM); + } + + return (0); +} + static const struct nlhdr_parser *all_parsers[] = { &state_parser, &addrule_parser, @@ -1806,6 +1853,7 @@ static const struct nlhdr_parser *all_parsers[] = { &pool_addr_parser, &add_addr_parser, &ruleset_parser, + &table_parser, }; static int family_id; @@ -1986,6 +2034,13 @@ static const struct genl_cmd pf_cmds[] = { .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, }, + { + .cmd_num = PFNL_CMD_CLEAR_TABLES, + .cmd_name = "CLEAR_TABLES", + .cmd_cb = pf_handle_clear_tables, + .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, + .cmd_priv = PRIV_NETINET_PF, + }, }; void diff --git a/sys/netpfil/pf/pf_nl.h b/sys/netpfil/pf/pf_nl.h index 0f534bd623c4..8c0149891773 100644 --- a/sys/netpfil/pf/pf_nl.h +++ b/sys/netpfil/pf/pf_nl.h @@ -61,6 +61,7 @@ enum { PFNL_CMD_GET_RULESETS = 23, PFNL_CMD_GET_RULESET = 24, PFNL_CMD_GET_SRCNODES = 25, + PFNL_CMD_CLEAR_TABLES = 26, __PFNL_CMD_MAX, }; #define PFNL_CMD_MAX (__PFNL_CMD_MAX -1) @@ -422,6 +423,15 @@ enum pf_srcnodes_types_t { PF_SN_NAF = 15, /* u8 */ }; +enum pf_tables_t { + PF_T_UNSPEC, + PF_T_ANCHOR = 1, /* string */ + PF_T_NAME = 2, /* string */ + PF_T_TABLE_FLAGS = 3, /* u32 */ + PF_T_FLAGS = 4, /* u32 */ + PF_T_NBR_DELETED = 5, /* u32 */ +}; + #ifdef _KERNEL void pf_nl_register(void);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202501141037.50EAbj9o047733>