From nobody Mon Jul 22 07:15:08 2024 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4WSBPS21WDz5Q4Qd; Mon, 22 Jul 2024 07:15:08 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4WSBPS1K6vz4Ln0; Mon, 22 Jul 2024 07:15:08 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1721632508; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=miX8zYUN3WLxmEfz0GZf92e4iQlEeY8RCZqCDPAMkRQ=; b=B0ZiXauKeyGKoepcbqlRqKMd+xrN+q/efExru0Cmia8ymp8Y6+NmujpWOsnMntpCf26NjL evUBX1ZbY6OjQfwfI1zP8s5Cp4xKz1cqRRxhSlSufCeALEe7tC8muJ7kNxJRFZ2nzbg7Ov rTXsv8mABZ9KSm4ZFD8wiuCVMcdNvXe7FeZeANRgPM18W/VHS6UJx7n49+rP/zTwxEmZPD 7seOFOHJW20aTIuf/rkZF4cyhEGA/D0yAkr9lRipSNbOmqvlb3B39IIPYg9lBQdsA6Ljf8 rHIuSJFDrkkfKHVWqN5IhHOY4fd7KJ3kJEQOgxHF9yqSbdl58Qe7sv44R30ngw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1721632508; a=rsa-sha256; cv=none; b=lGPJ4alfzqbri1n5XzMi/ZGY4d2b7mKunw3hnwARZj9ZBVhG821Y0fWtaTBiP7xPAIOWUE dGfSQqBHeYlq8tekpxPBzeVXqBNI2agrmtVYjFKbfKE270xhOnOmqiNLJ8+ZEaPuxLU/Gp 1aADNyJ/79AuoWLcHhxt+c93CpqXD2SnA2KtFTof/Sa/ZZXQoFTo8uarG7rEd7yPTBoBrq z9zzqcKP3TVI/8NPPrO63BilUMZ7EnqKGSSuwbjcYmNAj7fdr6OZiGm5trSfBAn9MgJRCB 3ouTwRw6K24nJTGnWdPRsWPWvfwD2WO7HyHRkvB2+G1PUSs5GTeUGSafHEDv8Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1721632508; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=miX8zYUN3WLxmEfz0GZf92e4iQlEeY8RCZqCDPAMkRQ=; b=d0VXXPTZBiXQPn9nsBBLEMy2KmcRfAlW8DhVZir80St+9UvENfrz/QRYnrVhYh9ws9uysu 3K5DLxXmuY9Fe8ktm1YpG820uvRZ/aRHGzl1UYt0gRHJtJV0gH9TPoi48UrRfyVA51cJge 3Q4t9jC/oKYMWci74Qh01v26fpNVS6zPEIE2bKkdlv9Vtx4GvrR1QdacPPjg4K/7RUyH+A 4Eq+0mkUJlecrHEzEYJDK2TL5S+CknasKYzDKPdbMmu6eoKvsGjycMe6bakCRIqKJAeg6Y cqkQgoHo158aywuQf4XRGx4moCdPtDtuXPdE9Jqn0a15dcCmLhnt+C0BivL+8Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4WSBPS0wNqzbZh; Mon, 22 Jul 2024 07:15:08 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 46M7F8Le052943; Mon, 22 Jul 2024 07:15:08 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 46M7F8kZ052940; Mon, 22 Jul 2024 07:15:08 GMT (envelope-from git) Date: Mon, 22 Jul 2024 07:15:08 GMT Message-Id: <202407220715.46M7F8kZ052940@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: 9ae91f59c500 - main - pf: convert DIOCGETADDR to netlink List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 9ae91f59c50030ff721ad4105a7545129d4c91b9 Auto-Submitted: auto-generated The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=9ae91f59c50030ff721ad4105a7545129d4c91b9 commit 9ae91f59c50030ff721ad4105a7545129d4c91b9 Author: Kristof Provost AuthorDate: 2024-07-19 15:48:25 +0000 Commit: Kristof Provost CommitDate: 2024-07-22 07:11:49 +0000 pf: convert DIOCGETADDR to netlink Sponsored by: Rubicon Communications, LLC ("Netgate") --- lib/libpfctl/libpfctl.c | 63 +++++++++++++++++++++++++++++++++++++++++++++++ lib/libpfctl/libpfctl.h | 2 ++ sbin/pfctl/pfctl.c | 11 +++------ sys/net/pfvar.h | 1 + sys/netpfil/pf/pf_ioctl.c | 61 ++++++++++++++++++++++++++------------------- sys/netpfil/pf/pf_nl.c | 49 ++++++++++++++++++++++++++++++++++++ sys/netpfil/pf/pf_nl.h | 1 + 7 files changed, 154 insertions(+), 34 deletions(-) diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c index c2e842d65b11..c7b2cd17bc29 100644 --- a/lib/libpfctl/libpfctl.c +++ b/lib/libpfctl/libpfctl.c @@ -2833,3 +2833,66 @@ pfctl_get_addrs(struct pfctl_handle *h, uint32_t ticket, uint32_t r_num, return (e.error); } + +#define _OUT(_field) offsetof(struct pf_pooladdr, _field) +static const struct snl_attr_parser ap_pool_addr[] = { + { .type = PF_PA_ADDR, .off = _OUT(addr), .arg = &addr_wrap_parser, .cb = snl_attr_get_nested }, + { .type = PF_PA_IFNAME, .off = _OUT(ifname), .arg_u32 = IFNAMSIZ, .cb = snl_attr_copy_string }, +}; +SNL_DECLARE_ATTR_PARSER(pool_addr_parser, ap_pool_addr); +#undef _OUT + +#define _OUT(_field) offsetof(struct pfioc_pooladdr, _field) +static const struct snl_attr_parser ap_get_addr[] = { + { .type = PF_AA_ACTION, .off = _OUT(action), .cb = snl_attr_get_uint32 }, + { .type = PF_AA_TICKET, .off = _OUT(ticket), .cb = snl_attr_get_uint32 }, + { .type = PF_AA_NR, .off = _OUT(nr), .cb = snl_attr_get_uint32 }, + { .type = PF_AA_R_NUM, .off = _OUT(r_num), .cb = snl_attr_get_uint32 }, + { .type = PF_AA_R_ACTION, .off = _OUT(r_action), .cb = snl_attr_get_uint8 }, + { .type = PF_AA_R_LAST, .off = _OUT(r_last), .cb = snl_attr_get_uint8 }, + { .type = PF_AA_AF, .off = _OUT(af), .cb = snl_attr_get_uint8 }, + { .type = PF_AA_ANCHOR, .off = _OUT(anchor), .arg_u32 = MAXPATHLEN, .cb = snl_attr_copy_string }, + { .type = PF_AA_ADDR, .off = _OUT(addr), .arg = &pool_addr_parser, .cb = snl_attr_get_nested }, +}; +static struct snl_field_parser fp_get_addr[] = {}; +SNL_DECLARE_PARSER(get_addr_parser, struct genlmsghdr, fp_get_addr, ap_get_addr); +#undef _OUT + +int +pfctl_get_addr(struct pfctl_handle *h, uint32_t ticket, uint32_t r_num, + uint8_t r_action, const char *anchor, uint32_t nr, struct pfioc_pooladdr *pa) +{ + struct snl_writer nw; + struct snl_errmsg_data e = {}; + struct nlmsghdr *hdr; + uint32_t seq_id; + int family_id; + + family_id =snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME); + if (family_id == 0) + return (ENOTSUP); + + snl_init_writer(&h->ss, &nw); + hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_GET_ADDR); + + snl_add_msg_attr_u32(&nw, PF_AA_TICKET, ticket); + snl_add_msg_attr_u32(&nw, PF_AA_R_NUM, r_num); + snl_add_msg_attr_u8(&nw, PF_AA_R_ACTION, r_action); + snl_add_msg_attr_string(&nw, PF_AA_ANCHOR, anchor); + snl_add_msg_attr_u32(&nw, PF_AA_NR, nr); + + if ((hdr = snl_finalize_msg(&nw)) == NULL) + return (ENXIO); + + seq_id = hdr->nlmsg_seq; + + if (! snl_send_message(&h->ss, hdr)) + return (ENXIO); + + while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) { + if (! snl_parse_nlmsg(&h->ss, hdr, &get_addr_parser, pa)) + continue; + } + + return (0); +} diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h index 22db0b2d90b5..33d7d0f113ac 100644 --- a/lib/libpfctl/libpfctl.h +++ b/lib/libpfctl/libpfctl.h @@ -501,5 +501,7 @@ int pfctl_begin_addrs(struct pfctl_handle *h, uint32_t *ticket); int pfctl_add_addr(struct pfctl_handle *h, const struct pfioc_pooladdr *pa); int pfctl_get_addrs(struct pfctl_handle *h, uint32_t ticket, uint32_t r_num, uint8_t r_action, const char *anchor, uint32_t *nr); +int pfctl_get_addr(struct pfctl_handle *h, uint32_t ticket, uint32_t r_num, + uint8_t r_action, const char *anchor, uint32_t nr, struct pfioc_pooladdr *pa); #endif diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c index f9522484cdc7..39c6d684a317 100644 --- a/sbin/pfctl/pfctl.c +++ b/sbin/pfctl/pfctl.c @@ -964,19 +964,14 @@ pfctl_get_pool(int dev, struct pfctl_pool *pool, u_int32_t nr, u_int32_t pnr, mpnr; memset(&pp, 0, sizeof(pp)); - memcpy(pp.anchor, anchorname, sizeof(pp.anchor)); - pp.r_action = r_action; - pp.r_num = nr; - pp.ticket = ticket; - if (pfctl_get_addrs(pfh, ticket, nr, r_action, anchorname, &pp.nr) != 0) { + if (pfctl_get_addrs(pfh, ticket, nr, r_action, anchorname, &mpnr) != 0) { warn("DIOCGETADDRS"); return (-1); } - mpnr = pp.nr; + TAILQ_INIT(&pool->list); for (pnr = 0; pnr < mpnr; ++pnr) { - pp.nr = pnr; - if (ioctl(dev, DIOCGETADDR, &pp)) { + if (pfctl_get_addr(pfh, ticket, nr, r_action, anchorname, pnr, &pp) != 0) { warn("DIOCGETADDR"); return (-1); } diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h index 291acce19327..eecd61f960c8 100644 --- a/sys/net/pfvar.h +++ b/sys/net/pfvar.h @@ -2529,6 +2529,7 @@ int pf_ioctl_set_limit(int, unsigned int, unsigned int *); int pf_ioctl_begin_addrs(uint32_t *); int pf_ioctl_add_addr(struct pfioc_pooladdr *); int pf_ioctl_get_addrs(struct pfioc_pooladdr *); +int pf_ioctl_get_addr(struct pfioc_pooladdr *); void pf_krule_free(struct pf_krule *); void pf_krule_clear_counters(struct pf_krule *); diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c index 4ea0301cd3c4..959ebdf94cd4 100644 --- a/sys/netpfil/pf/pf_ioctl.c +++ b/sys/netpfil/pf/pf_ioctl.c @@ -2614,6 +2614,40 @@ pf_ioctl_get_addrs(struct pfioc_pooladdr *pp) return (0); } +int +pf_ioctl_get_addr(struct pfioc_pooladdr *pp) +{ + struct pf_kpool *pool; + struct pf_kpooladdr *pa; + u_int32_t nr = 0; + + PF_RULES_RLOCK_TRACKER; + + pp->anchor[sizeof(pp->anchor) - 1] = 0; + + PF_RULES_RLOCK(); + pool = pf_get_kpool(pp->anchor, pp->ticket, pp->r_action, + pp->r_num, 0, 1, 1); + if (pool == NULL) { + PF_RULES_RUNLOCK(); + return (EBUSY); + } + pa = TAILQ_FIRST(&pool->list); + while ((pa != NULL) && (nr < pp->nr)) { + pa = TAILQ_NEXT(pa, entries); + nr++; + } + if (pa == NULL) { + PF_RULES_RUNLOCK(); + return (EBUSY); + } + pf_kpooladdr_to_pooladdr(pa, &pp->addr); + pf_addr_copyout(&pp->addr.addr); + PF_RULES_RUNLOCK(); + + return (0); +} + static int pfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread *td) { @@ -4299,33 +4333,8 @@ DIOCGETSTATESV2_full: case DIOCGETADDR: { struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; - struct pf_kpool *pool; - struct pf_kpooladdr *pa; - u_int32_t nr = 0; - - pp->anchor[sizeof(pp->anchor) - 1] = 0; - PF_RULES_RLOCK(); - pool = pf_get_kpool(pp->anchor, pp->ticket, pp->r_action, - pp->r_num, 0, 1, 1); - if (pool == NULL) { - PF_RULES_RUNLOCK(); - error = EBUSY; - break; - } - pa = TAILQ_FIRST(&pool->list); - while ((pa != NULL) && (nr < pp->nr)) { - pa = TAILQ_NEXT(pa, entries); - nr++; - } - if (pa == NULL) { - PF_RULES_RUNLOCK(); - error = EBUSY; - break; - } - pf_kpooladdr_to_pooladdr(pa, &pp->addr); - pf_addr_copyout(&pp->addr.addr); - PF_RULES_RUNLOCK(); + error = pf_ioctl_get_addr(pp); break; } diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c index 79aa76f625e3..060cd5e39852 100644 --- a/sys/netpfil/pf/pf_nl.c +++ b/sys/netpfil/pf/pf_nl.c @@ -1597,6 +1597,48 @@ pf_handle_get_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt) return (error); } +static int +pf_handle_get_addr(struct nlmsghdr *hdr, struct nl_pstate *npt) +{ + struct pfioc_pooladdr attrs = { 0 }; + struct nl_writer *nw = npt->nw; + struct genlmsghdr *ghdr_new; + int error; + + error = nl_parse_nlmsg(hdr, &add_addr_parser, npt, &attrs); + if (error != 0) + return (error); + + error = pf_ioctl_get_addr(&attrs); + if (error != 0) + return (error); + + if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) + return (ENOMEM); + + ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); + ghdr_new->cmd = PFNL_CMD_GET_ADDRS; + ghdr_new->version = 0; + ghdr_new->reserved = 0; + + nlattr_add_u32(nw, PF_AA_ACTION, attrs.action); + nlattr_add_u32(nw, PF_AA_TICKET, attrs.ticket); + nlattr_add_u32(nw, PF_AA_NR, attrs.nr); + nlattr_add_u32(nw, PF_AA_R_NUM, attrs.r_num); + nlattr_add_u8(nw, PF_AA_R_ACTION, attrs.r_action); + nlattr_add_u8(nw, PF_AA_R_LAST, attrs.r_last); + nlattr_add_u8(nw, PF_AA_AF, attrs.af); + nlattr_add_string(nw, PF_AA_ANCHOR, attrs.anchor); + nlattr_add_pool_addr(nw, PF_AA_ADDR, &attrs.addr); + + if (!nlmsg_end(nw)) { + nlmsg_abort(nw); + return (ENOMEM); + } + + return (0); +} + static const struct nlhdr_parser *all_parsers[] = { &state_parser, &addrule_parser, @@ -1761,6 +1803,13 @@ static const struct genl_cmd pf_cmds[] = { .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, }, + { + .cmd_num = PFNL_CMD_GET_ADDR, + .cmd_name = "GET_ADDRS", + .cmd_cb = pf_handle_get_addr, + .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, + .cmd_priv = PRIV_NETINET_PF, + }, }; void diff --git a/sys/netpfil/pf/pf_nl.h b/sys/netpfil/pf/pf_nl.h index 013a7e1e0ef0..cfe81cf142ab 100644 --- a/sys/netpfil/pf/pf_nl.h +++ b/sys/netpfil/pf/pf_nl.h @@ -57,6 +57,7 @@ enum { PFNL_CMD_BEGIN_ADDRS = 19, PFNL_CMD_ADD_ADDR = 20, PFNL_CMD_GET_ADDRS = 21, + PFNL_CMD_GET_ADDR = 22, __PFNL_CMD_MAX, }; #define PFNL_CMD_MAX (__PFNL_CMD_MAX -1)