From owner-dev-commits-src-branches@freebsd.org Fri May 14 13:06:47 2021 Return-Path: Delivered-To: dev-commits-src-branches@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 6D7ED6474DF; Fri, 14 May 2021 13:06:47 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4FhTLt6bb0z3kl5; Fri, 14 May 2021 13:06:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id D0FB112C44; Fri, 14 May 2021 13:06:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 14ED6kHI052432; Fri, 14 May 2021 13:06:46 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 14ED6kn9052431; Fri, 14 May 2021 13:06:46 GMT (envelope-from git) Date: Fri, 14 May 2021 13:06:46 GMT Message-Id: <202105141306.14ED6kn9052431@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kristof Provost Subject: git: f756e230f5e6 - stable/12 - pfctl: Start using DIOCCLRSTATESNV MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/stable/12 X-Git-Reftype: branch X-Git-Commit: f756e230f5e68ce589d3cca81726d5c01db0d0cf Auto-Submitted: auto-generated X-BeenThere: dev-commits-src-branches@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Commits to the stable branches of the FreeBSD src repository List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 May 2021 13:06:47 -0000 The branch stable/12 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=f756e230f5e68ce589d3cca81726d5c01db0d0cf commit f756e230f5e68ce589d3cca81726d5c01db0d0cf Author: Kristof Provost AuthorDate: 2021-04-29 13:10:50 +0000 Commit: Kristof Provost CommitDate: 2021-05-14 08:20:32 +0000 pfctl: Start using DIOCCLRSTATESNV MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D30053 (cherry picked from commit 53714a586133fd8ae662427007f84ec663cd83ef) --- lib/libpfctl/libpfctl.c | 59 +++++++++++++++++++++++++++++++++++++++++++++++++ lib/libpfctl/libpfctl.h | 18 +++++++++++++++ sbin/pfctl/pfctl.c | 21 +++++++++--------- 3 files changed, 88 insertions(+), 10 deletions(-) diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c index b07fcda9bd5a..8c8b21d22a46 100644 --- a/lib/libpfctl/libpfctl.c +++ b/lib/libpfctl/libpfctl.c @@ -608,3 +608,62 @@ pfctl_set_keepcounters(int dev, bool keep) free(nv.data); return (ret); } + +static void +pfctl_nv_add_state_cmp(nvlist_t *nvl, const char *name, + const struct pfctl_state_cmp *cmp) +{ + nvlist_t *nv; + + nv = nvlist_create(0); + + nvlist_add_number(nv, "id", cmp->id); + nvlist_add_number(nv, "creatorid", cmp->creatorid); + nvlist_add_number(nv, "direction", cmp->direction); + + nvlist_add_nvlist(nvl, name, nv); +} + +int +pfctl_clear_states(int dev, const struct pfctl_kill *kill, + unsigned int *killed) +{ + struct pfioc_nv nv; + nvlist_t *nvl; + int ret; + + nvl = nvlist_create(0); + + pfctl_nv_add_state_cmp(nvl, "cmp", &kill->cmp); + nvlist_add_number(nvl, "af", kill->af); + nvlist_add_number(nvl, "proto", kill->proto); + pfctl_nv_add_rule_addr(nvl, "src", &kill->src); + pfctl_nv_add_rule_addr(nvl, "dst", &kill->dst); + nvlist_add_string(nvl, "ifname", kill->ifname); + nvlist_add_string(nvl, "label", kill->label); + + nv.data = nvlist_pack(nvl, &nv.len); + nv.size = nv.len; + nvlist_destroy(nvl); + nvl = NULL; + + ret = ioctl(dev, DIOCCLRSTATESNV, &nv); + if (ret != 0) { + free(nv.data); + return (ret); + } + + nvl = nvlist_unpack(nv.data, nv.len, 0); + if (nvl == NULL) { + free(nv.data); + return (EIO); + } + + if (killed) + *killed = nvlist_get_number(nvl, "killed"); + + nvlist_destroy(nvl); + free(nv.data); + + return (ret); +} diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h index e19187fc2526..3ec2a7fa535f 100644 --- a/lib/libpfctl/libpfctl.h +++ b/lib/libpfctl/libpfctl.h @@ -179,6 +179,22 @@ RB_PROTOTYPE(pfctl_anchor_global, pfctl_anchor, entry_global, RB_PROTOTYPE(pfctl_anchor_node, pfctl_anchor, entry_node, pf_anchor_compare); +struct pfctl_state_cmp { + uint64_t id; + uint32_t creatorid; + uint8_t direction; +}; + +struct pfctl_kill { + struct pfctl_state_cmp cmp; + sa_family_t af; + int proto; + struct pf_rule_addr src; + struct pf_rule_addr dst; + char ifname[IFNAMSIZ]; + char label[PF_RULE_LABEL_SIZE]; +}; + int pfctl_get_rule(int dev, u_int32_t nr, u_int32_t ticket, const char *anchor, u_int32_t ruleset, struct pfctl_rule *rule, char *anchor_call); @@ -189,5 +205,7 @@ int pfctl_add_rule(int dev, const struct pfctl_rule *r, const char *anchor, const char *anchor_call, u_int32_t ticket, u_int32_t pool_ticket); int pfctl_set_keepcounters(int dev, bool keep); +int pfctl_clear_states(int dev, const struct pfctl_kill *kill, + unsigned int *killed); #endif diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c index af2ae6fe3bf0..2cfca24c0cfa 100644 --- a/sbin/pfctl/pfctl.c +++ b/sbin/pfctl/pfctl.c @@ -79,7 +79,7 @@ int pfctl_clear_rules(int, int, char *); int pfctl_clear_nat(int, int, char *); int pfctl_clear_altq(int, int); int pfctl_clear_src_nodes(int, int); -int pfctl_clear_states(int, const char *, int); +int pfctl_clear_iface_states(int, const char *, int); void pfctl_addrprefix(char *, struct pf_addr *); int pfctl_kill_src_nodes(int, const char *, int); int pfctl_net_kill_states(int, const char *, int); @@ -467,19 +467,20 @@ pfctl_clear_src_nodes(int dev, int opts) } int -pfctl_clear_states(int dev, const char *iface, int opts) +pfctl_clear_iface_states(int dev, const char *iface, int opts) { - struct pfioc_state_kill psk; + struct pfctl_kill kill; + unsigned int killed; - memset(&psk, 0, sizeof(psk)); - if (iface != NULL && strlcpy(psk.psk_ifname, iface, - sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname)) + memset(&kill, 0, sizeof(kill)); + if (iface != NULL && strlcpy(kill.ifname, iface, + sizeof(kill.ifname)) >= sizeof(kill.ifname)) errx(1, "invalid interface: %s", iface); - if (ioctl(dev, DIOCCLRSTATES, &psk)) + if (pfctl_clear_states(dev, &kill, &killed)) err(1, "DIOCCLRSTATES"); if ((opts & PF_OPT_QUIET) == 0) - fprintf(stderr, "%d states cleared\n", psk.psk_killed); + fprintf(stderr, "%d states cleared\n", killed); return (0); } @@ -2417,7 +2418,7 @@ main(int argc, char *argv[]) pfctl_clear_altq(dev, opts); break; case 's': - pfctl_clear_states(dev, ifaceopt, opts); + pfctl_clear_iface_states(dev, ifaceopt, opts); break; case 'S': pfctl_clear_src_nodes(dev, opts); @@ -2431,7 +2432,7 @@ main(int argc, char *argv[]) pfctl_clear_tables(anchorname, opts); if (!*anchorname) { pfctl_clear_altq(dev, opts); - pfctl_clear_states(dev, ifaceopt, opts); + pfctl_clear_iface_states(dev, ifaceopt, opts); pfctl_clear_src_nodes(dev, opts); pfctl_clear_stats(dev, opts); pfctl_clear_fingerprints(dev, opts);