Date: Mon, 10 Feb 2025 11:10:14 GMT From: Kristof Provost <kp@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 0d2058abf3b2 - main - pf: convert DIOCRDELTABLES to netlink Message-ID: <202502101110.51ABAEII006236@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=0d2058abf3b252e77dae8808dd744c0293b5f433 commit 0d2058abf3b252e77dae8808dd744c0293b5f433 Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2025-02-07 17:39:51 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2025-02-10 11:09:47 +0000 pf: convert DIOCRDELTABLES to netlink Sponsored by: Rubicon Communications, LLC ("Netgate") --- lib/libpfctl/libpfctl.c | 38 ++++++++++++++++++++++++++++++++++++++ lib/libpfctl/libpfctl.h | 2 ++ sbin/pfctl/pfctl_radix.c | 15 +-------------- sys/netpfil/pf/pf_nl.c | 44 ++++++++++++++++++++++++++++++++++++++++++++ sys/netpfil/pf/pf_nl.h | 1 + 5 files changed, 86 insertions(+), 14 deletions(-) diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c index 50dfcfea703d..8569d691773c 100644 --- a/lib/libpfctl/libpfctl.c +++ b/lib/libpfctl/libpfctl.c @@ -3143,3 +3143,41 @@ pfctl_add_table(struct pfctl_handle *h, struct pfr_table *table, return (e.error); } +int +pfctl_del_table(struct pfctl_handle *h, struct pfr_table *table, + int *ndel, int flags) +{ + struct snl_writer nw; + struct snl_errmsg_data e = {}; + struct nlmsghdr *hdr; + uint32_t seq_id; + int family_id; + + family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME); + if (family_id == 0) + return (ENOTSUP); + + snl_init_writer(&h->ss, &nw); + hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_DEL_TABLE); + + snl_add_msg_attr_string(&nw, PF_T_ANCHOR, table->pfrt_anchor); + snl_add_msg_attr_string(&nw, PF_T_NAME, table->pfrt_name); + snl_add_msg_attr_u32(&nw, PF_T_TABLE_FLAGS, table->pfrt_flags); + snl_add_msg_attr_u32(&nw, PF_T_FLAGS, flags); + + if ((hdr = snl_finalize_msg(&nw)) == NULL) + return (ENXIO); + + seq_id = hdr->nlmsg_seq; + + if (!snl_send_message(&h->ss, hdr)) + return (ENXIO); + + while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) { + if (!snl_parse_nlmsg(&h->ss, hdr, &ndel_parser, ndel)) + continue; + } + + return (e.error); +} + diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h index 300511452d8f..d5d0a43f90a3 100644 --- a/lib/libpfctl/libpfctl.h +++ b/lib/libpfctl/libpfctl.h @@ -544,5 +544,7 @@ int pfctl_clear_tables(struct pfctl_handle *h, struct pfr_table *filter, int *ndel, int flags); int pfctl_add_table(struct pfctl_handle *h, struct pfr_table *table, int *nadd, int flags); +int pfctl_del_table(struct pfctl_handle *h, struct pfr_table *table, + int *ndel, int flags); #endif diff --git a/sbin/pfctl/pfctl_radix.c b/sbin/pfctl/pfctl_radix.c index 451b83371d05..94de63414885 100644 --- a/sbin/pfctl/pfctl_radix.c +++ b/sbin/pfctl/pfctl_radix.c @@ -82,20 +82,7 @@ pfr_add_table(struct pfr_table *tbl, int *nadd, int flags) int pfr_del_table(struct pfr_table *tbl, int *ndel, int flags) { - struct pfioc_table io; - - bzero(&io, sizeof io); - io.pfrio_flags = flags; - io.pfrio_buffer = tbl; - io.pfrio_esize = sizeof(*tbl); - io.pfrio_size = 1; - if (ioctl(dev, DIOCRDELTABLES, &io)) { - pfr_report_error(tbl, &io, "delete table"); - return (-1); - } - if (ndel != NULL) - *ndel = io.pfrio_ndel; - return (0); + return (pfctl_del_table(pfh, tbl, ndel, flags)); } int diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c index 74c5bdca4f77..97552880b9e3 100644 --- a/sys/netpfil/pf/pf_nl.c +++ b/sys/netpfil/pf/pf_nl.c @@ -1879,6 +1879,43 @@ pf_handle_add_table(struct nlmsghdr *hdr, struct nl_pstate *npt) return (0); } +static int +pf_handle_del_table(struct nlmsghdr *hdr, struct nl_pstate *npt) +{ + struct pfioc_table attrs = { 0 }; + struct nl_writer *nw = npt->nw; + struct genlmsghdr *ghdr_new; + int error; + + error = nl_parse_nlmsg(hdr, &table_parser, npt, &attrs); + if (error != 0) + return (error); + + PF_RULES_WLOCK(); + error = pfr_del_tables(&attrs.pfrio_table, 1, &attrs.pfrio_ndel, + attrs.pfrio_flags | PFR_FLAG_USERIOCTL); + PF_RULES_WUNLOCK(); + if (error != 0) + return (error); + + if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) + return (ENOMEM); + + ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); + ghdr_new->cmd = PFNL_CMD_ADD_TABLE; + ghdr_new->version = 0; + ghdr_new->reserved = 0; + + nlattr_add_u32(nw, PF_T_NBR_DELETED, attrs.pfrio_ndel); + + if (!nlmsg_end(nw)) { + nlmsg_abort(nw); + return (ENOMEM); + } + + return (0); +} + static const struct nlhdr_parser *all_parsers[] = { &state_parser, &addrule_parser, @@ -2087,6 +2124,13 @@ static const struct genl_cmd pf_cmds[] = { .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, }, + { + .cmd_num = PFNL_CMD_DEL_TABLE, + .cmd_name = "DEL_TABLE", + .cmd_cb = pf_handle_del_table, + .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, + .cmd_priv = PRIV_NETINET_PF, + }, }; void diff --git a/sys/netpfil/pf/pf_nl.h b/sys/netpfil/pf/pf_nl.h index 38a44c2c4395..a66ff5bc3f1e 100644 --- a/sys/netpfil/pf/pf_nl.h +++ b/sys/netpfil/pf/pf_nl.h @@ -63,6 +63,7 @@ enum { PFNL_CMD_GET_SRCNODES = 25, PFNL_CMD_CLEAR_TABLES = 26, PFNL_CMD_ADD_TABLE = 27, + PFNL_CMD_DEL_TABLE = 28, __PFNL_CMD_MAX, }; #define PFNL_CMD_MAX (__PFNL_CMD_MAX -1)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202502101110.51ABAEII006236>