Date: Mon, 22 Jul 2024 07:15:06 GMT From: Kristof Provost <kp@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 644b7b5a2e31 - main - pf: convert DIOCGETADDRS to netlink Message-ID: <202407220715.46M7F6hx052891@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=644b7b5a2e31fc1d21e7e90764a7b043e5b66d1a commit 644b7b5a2e31fc1d21e7e90764a7b043e5b66d1a Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2024-07-19 12:15:30 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2024-07-22 07:11:49 +0000 pf: convert DIOCGETADDRS to netlink Sponsored by: Rubicon Communications, LLC ("Netgate") --- lib/libpfctl/libpfctl.c | 44 +++++++++++++++++++++++++++++++++++++ lib/libpfctl/libpfctl.h | 2 ++ sbin/pfctl/pfctl.c | 2 +- sys/net/pfvar.h | 1 + sys/netpfil/pf/pf_ioctl.c | 42 +++++++++++++++++++++-------------- sys/netpfil/pf/pf_nl.c | 56 +++++++++++++++++++++++++++++++++++++++++++++++ sys/netpfil/pf/pf_nl.h | 1 + 7 files changed, 131 insertions(+), 17 deletions(-) diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c index 398595c4715f..c2e842d65b11 100644 --- a/lib/libpfctl/libpfctl.c +++ b/lib/libpfctl/libpfctl.c @@ -2789,3 +2789,47 @@ pfctl_add_addr(struct pfctl_handle *h, const struct pfioc_pooladdr *pa) return (e.error); } + +static const struct snl_attr_parser ap_get_addrs[] = { + { .type = PF_AA_NR, .off = 0, .cb = snl_attr_get_uint32 }, +}; +static struct snl_field_parser fp_get_addrs[] = {}; +SNL_DECLARE_PARSER(get_addrs_parser, struct genlmsghdr, fp_get_addrs, ap_get_addrs); + +int +pfctl_get_addrs(struct pfctl_handle *h, uint32_t ticket, uint32_t r_num, + uint8_t r_action, const char *anchor, uint32_t *nr) +{ + struct snl_writer nw; + struct snl_errmsg_data e = {}; + struct nlmsghdr *hdr; + uint32_t seq_id; + int family_id; + + family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME); + if (family_id == 0) + return (ENOTSUP); + + snl_init_writer(&h->ss, &nw); + hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_GET_ADDRS); + + snl_add_msg_attr_u32(&nw, PF_AA_TICKET, ticket); + snl_add_msg_attr_u32(&nw, PF_AA_R_NUM, r_num); + snl_add_msg_attr_u8(&nw, PF_AA_R_ACTION, r_action); + snl_add_msg_attr_string(&nw, PF_AA_ANCHOR, anchor); + + if ((hdr = snl_finalize_msg(&nw)) == NULL) + return (ENXIO); + + seq_id = hdr->nlmsg_seq; + + if (! snl_send_message(&h->ss, hdr)) + return (ENXIO); + + while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) { + if (! snl_parse_nlmsg(&h->ss, hdr, &get_addrs_parser, nr)) + continue; + } + + return (e.error); +} diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h index dd09b061efea..22db0b2d90b5 100644 --- a/lib/libpfctl/libpfctl.h +++ b/lib/libpfctl/libpfctl.h @@ -499,5 +499,7 @@ int pfctl_set_limit(struct pfctl_handle *h, const int index, const uint limit); int pfctl_get_limit(struct pfctl_handle *h, const int index, uint *limit); int pfctl_begin_addrs(struct pfctl_handle *h, uint32_t *ticket); int pfctl_add_addr(struct pfctl_handle *h, const struct pfioc_pooladdr *pa); +int pfctl_get_addrs(struct pfctl_handle *h, uint32_t ticket, uint32_t r_num, + uint8_t r_action, const char *anchor, uint32_t *nr); #endif diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c index a49e82809f9e..f9522484cdc7 100644 --- a/sbin/pfctl/pfctl.c +++ b/sbin/pfctl/pfctl.c @@ -968,7 +968,7 @@ pfctl_get_pool(int dev, struct pfctl_pool *pool, u_int32_t nr, pp.r_action = r_action; pp.r_num = nr; pp.ticket = ticket; - if (ioctl(dev, DIOCGETADDRS, &pp)) { + if (pfctl_get_addrs(pfh, ticket, nr, r_action, anchorname, &pp.nr) != 0) { warn("DIOCGETADDRS"); return (-1); } diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h index b38a1bebcc1f..291acce19327 100644 --- a/sys/net/pfvar.h +++ b/sys/net/pfvar.h @@ -2528,6 +2528,7 @@ int pf_ioctl_get_limit(int, unsigned int *); int pf_ioctl_set_limit(int, unsigned int, unsigned int *); int pf_ioctl_begin_addrs(uint32_t *); int pf_ioctl_add_addr(struct pfioc_pooladdr *); +int pf_ioctl_get_addrs(struct pfioc_pooladdr *); void pf_krule_free(struct pf_krule *); void pf_krule_clear_counters(struct pf_krule *); diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c index f5a216666076..4ea0301cd3c4 100644 --- a/sys/netpfil/pf/pf_ioctl.c +++ b/sys/netpfil/pf/pf_ioctl.c @@ -2589,6 +2589,31 @@ out: return (error); } +int +pf_ioctl_get_addrs(struct pfioc_pooladdr *pp) +{ + struct pf_kpool *pool; + struct pf_kpooladdr *pa; + + PF_RULES_RLOCK_TRACKER; + + pp->anchor[sizeof(pp->anchor) - 1] = 0; + pp->nr = 0; + + PF_RULES_RLOCK(); + pool = pf_get_kpool(pp->anchor, pp->ticket, pp->r_action, + pp->r_num, 0, 1, 0); + if (pool == NULL) { + PF_RULES_RUNLOCK(); + return (EBUSY); + } + TAILQ_FOREACH(pa, &pool->list, entries) + pp->nr++; + PF_RULES_RUNLOCK(); + + return (0); +} + static int pfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread *td) { @@ -4267,23 +4292,8 @@ DIOCGETSTATESV2_full: case DIOCGETADDRS: { struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; - struct pf_kpool *pool; - struct pf_kpooladdr *pa; - pp->anchor[sizeof(pp->anchor) - 1] = 0; - pp->nr = 0; - - PF_RULES_RLOCK(); - pool = pf_get_kpool(pp->anchor, pp->ticket, pp->r_action, - pp->r_num, 0, 1, 0); - if (pool == NULL) { - PF_RULES_RUNLOCK(); - error = EBUSY; - break; - } - TAILQ_FOREACH(pa, &pool->list, entries) - pp->nr++; - PF_RULES_RUNLOCK(); + error = pf_ioctl_get_addrs(pp); break; } diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c index 6c98a50d8e06..79aa76f625e3 100644 --- a/sys/netpfil/pf/pf_nl.c +++ b/sys/netpfil/pf/pf_nl.c @@ -1509,6 +1509,21 @@ pf_handle_begin_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt) return (0); } +static bool +nlattr_add_pool_addr(struct nl_writer *nw, int attrtype, struct pf_pooladdr *a) +{ + int off; + + off = nlattr_add_nested(nw, attrtype); + + nlattr_add_addr_wrap(nw, PF_PA_ADDR, &a->addr); + nlattr_add_string(nw, PF_PA_IFNAME, a->ifname); + + nlattr_set_len(nw, off); + + return (true); +} + #define _OUT(_field) offsetof(struct pf_pooladdr, _field) static const struct nlattr_parser nla_p_pool_addr[] = { { .type = PF_PA_ADDR, .off = _OUT(addr), .arg = &addr_wrap_parser, .cb = nlattr_get_nested }, @@ -1548,6 +1563,40 @@ pf_handle_add_addr(struct nlmsghdr *hdr, struct nl_pstate *npt) return (error); } +static int +pf_handle_get_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt) +{ + struct pfioc_pooladdr attrs = { 0 }; + struct nl_writer *nw = npt->nw; + struct genlmsghdr *ghdr_new; + int error; + + error = nl_parse_nlmsg(hdr, &add_addr_parser, npt, &attrs); + if (error != 0) + return (error); + + error = pf_ioctl_get_addrs(&attrs); + if (error != 0) + return (error); + + if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) + return (ENOMEM); + + ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); + ghdr_new->cmd = PFNL_CMD_GET_ADDRS; + ghdr_new->version = 0; + ghdr_new->reserved = 0; + + nlattr_add_u32(nw, PF_AA_NR, attrs.nr); + + if (!nlmsg_end(nw)) { + nlmsg_abort(nw); + return (ENOMEM); + } + + return (error); +} + static const struct nlhdr_parser *all_parsers[] = { &state_parser, &addrule_parser, @@ -1705,6 +1754,13 @@ static const struct genl_cmd pf_cmds[] = { .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, }, + { + .cmd_num = PFNL_CMD_GET_ADDRS, + .cmd_name = "GET_ADDRS", + .cmd_cb = pf_handle_get_addrs, + .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, + .cmd_priv = PRIV_NETINET_PF, + }, }; void diff --git a/sys/netpfil/pf/pf_nl.h b/sys/netpfil/pf/pf_nl.h index 2459fdc15a63..013a7e1e0ef0 100644 --- a/sys/netpfil/pf/pf_nl.h +++ b/sys/netpfil/pf/pf_nl.h @@ -56,6 +56,7 @@ enum { PFNL_CMD_GET_LIMIT = 18, PFNL_CMD_BEGIN_ADDRS = 19, PFNL_CMD_ADD_ADDR = 20, + PFNL_CMD_GET_ADDRS = 21, __PFNL_CMD_MAX, }; #define PFNL_CMD_MAX (__PFNL_CMD_MAX -1)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202407220715.46M7F6hx052891>