Date: Tue, 5 Aug 2025 22:28:06 GMT From: Kristof Provost <kp@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 8b388995b8b2 - main - pf: convert DIOCRADDADDRS to netlink Message-ID: <202508052228.575MS6wk014285@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=8b388995b8b2f399d056679f5234dafcbe4dddd5 commit 8b388995b8b2f399d056679f5234dafcbe4dddd5 Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2025-07-14 12:40:44 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2025-08-05 22:27:14 +0000 pf: convert DIOCRADDADDRS to netlink Add up to 64 addresses at once. We are limited by the netlink socket buffer, so we can only add a limited number at once. Sponsored by: Rubicon Communications, LLC ("Netgate") --- contrib/pf/authpf/authpf.c | 2 +- lib/libpfctl/libpfctl.c | 100 ++++++++++++++++++++++++++++++++++++++++++ lib/libpfctl/libpfctl.h | 2 + sbin/pfctl/pfctl_radix.c | 2 +- sys/netpfil/pf/pf_ioctl.c | 1 + sys/netpfil/pf/pf_nl.c | 90 +++++++++++++++++++++++++++++++++++++ sys/netpfil/pf/pf_nl.h | 17 +++++++ sys/netpfil/pf/pf_table.c | 2 +- tests/sys/netpfil/pf/table.sh | 42 ++++++++++++++++++ 9 files changed, 255 insertions(+), 3 deletions(-) diff --git a/contrib/pf/authpf/authpf.c b/contrib/pf/authpf/authpf.c index 73cc9a7dc657..5d1b33019c4b 100644 --- a/contrib/pf/authpf/authpf.c +++ b/contrib/pf/authpf/authpf.c @@ -863,7 +863,7 @@ change_table(int add, const char *ip_src) } if (add) - ret = pfctl_table_add_addrs(pfctl_fd(pfh), &tbl, &addr, 1, NULL, 0); + ret = pfctl_table_add_addrs_h(pfh, &tbl, &addr, 1, NULL, 0); else ret = pfctl_table_del_addrs(pfctl_fd(pfh), &tbl, &addr, 1, NULL, 0); diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c index 104777352d8b..29c792bd72ed 100644 --- a/lib/libpfctl/libpfctl.c +++ b/lib/libpfctl/libpfctl.c @@ -2397,6 +2397,106 @@ pfctl_table_add_addrs(int dev, struct pfr_table *tbl, struct pfr_addr return (0); } +static void +snl_add_msg_attr_table(struct snl_writer *nw, uint32_t type, + const struct pfr_table *tbl) +{ + int off; + + off = snl_add_msg_attr_nested(nw, type); + + snl_add_msg_attr_string(nw, PF_T_ANCHOR, tbl->pfrt_anchor); + snl_add_msg_attr_string(nw, PF_T_NAME, tbl->pfrt_name); + snl_add_msg_attr_u32(nw, PF_T_TABLE_FLAGS, tbl->pfrt_flags); + + snl_end_attr_nested(nw, off); +} + +static void +snl_add_msg_attr_pfr_addr(struct snl_writer *nw, uint32_t type, + const struct pfr_addr *addr) +{ + int off; + + off = snl_add_msg_attr_nested(nw, type); + + snl_add_msg_attr_u8(nw, PFR_A_AF, addr->pfra_af); + snl_add_msg_attr_u8(nw, PFR_A_NET, addr->pfra_net); + snl_add_msg_attr_bool(nw, PFR_A_NOT, addr->pfra_not); + snl_add_msg_attr_ip6(nw, PFR_A_ADDR, &addr->pfra_ip6addr); + + snl_end_attr_nested(nw, off); +} + +static struct snl_attr_parser ap_table_add_addr[] = { + { .type = PF_TA_NBR_ADDED, .off = 0, .cb = snl_attr_get_uint32 }, +}; +SNL_DECLARE_PARSER(table_add_addr_parser, struct genlmsghdr, snl_f_p_empty, ap_table_add_addr); + +static int +_pfctl_table_add_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl, struct pfr_addr + *addrs, int size, int *nadd, int flags) +{ + struct snl_writer nw; + struct snl_errmsg_data e = {}; + struct nlmsghdr *hdr; + uint32_t seq_id; + uint32_t added; + int family_id; + + family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME); + if (family_id == 0) + return (ENOTSUP); + + snl_init_writer(&h->ss, &nw); + hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_TABLE_ADD_ADDR); + + snl_add_msg_attr_table(&nw, PF_TA_TABLE, tbl); + snl_add_msg_attr_u32(&nw, PF_TA_FLAGS, flags); + for (int i = 0; i < size && i < 256; i++) + snl_add_msg_attr_pfr_addr(&nw, PF_TA_ADDR, &addrs[i]); + + if ((hdr = snl_finalize_msg(&nw)) == NULL) + return (ENXIO); + seq_id = hdr->nlmsg_seq; + + if (! snl_send_message(&h->ss, hdr)) + return (ENXIO); + + while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) { + if (! snl_parse_nlmsg(&h->ss, hdr, &table_add_addr_parser, &added)) + continue; + } + + if (nadd) + *nadd = added; + + return (e.error); +} + +int +pfctl_table_add_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl, struct pfr_addr + *addr, int size, int *nadd, int flags) +{ + int ret; + int off = 0; + int partial_added; + + do { + ret = _pfctl_table_add_addrs_h(h, tbl, &addr[off], size - off, &partial_added, flags); + if (ret != 0) + break; + if (nadd) + *nadd += partial_added; + off += partial_added; + } while (off < size); + + if (nadd) + *nadd = off; + + return (ret); +} + int pfctl_table_del_addrs(int dev, struct pfr_table *tbl, struct pfr_addr *addr, int size, int *ndel, int flags) diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h index 116f9243fda9..5c052b01b294 100644 --- a/lib/libpfctl/libpfctl.h +++ b/lib/libpfctl/libpfctl.h @@ -511,6 +511,8 @@ int pfctl_clear_nat(int dev, const char *anchorname); int pfctl_clear_eth_rules(int dev, const char *anchorname); int pfctl_set_syncookies(int dev, const struct pfctl_syncookies *s); int pfctl_get_syncookies(int dev, struct pfctl_syncookies *s); +int pfctl_table_add_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl, struct pfr_addr + *addr, int size, int *nadd, int flags); int pfctl_table_add_addrs(int dev, struct pfr_table *tbl, struct pfr_addr *addr, int size, int *nadd, int flags); int pfctl_table_del_addrs(int dev, struct pfr_table *tbl, struct pfr_addr diff --git a/sbin/pfctl/pfctl_radix.c b/sbin/pfctl/pfctl_radix.c index 00e4207d377b..4100a9ea0446 100644 --- a/sbin/pfctl/pfctl_radix.c +++ b/sbin/pfctl/pfctl_radix.c @@ -122,7 +122,7 @@ pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size, { int ret; - ret = pfctl_table_add_addrs(dev, tbl, addr, size, nadd, flags); + ret = pfctl_table_add_addrs_h(pfh, tbl, addr, size, nadd, flags); if (ret) { errno = ret; return (-1); diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c index 178ee01649c6..08ae2057653b 100644 --- a/sys/netpfil/pf/pf_ioctl.c +++ b/sys/netpfil/pf/pf_ioctl.c @@ -4973,6 +4973,7 @@ DIOCCHANGEADDR_error: goto fail; } PF_RULES_WLOCK(); + io->pfrio_nadd = 0; error = pfr_add_addrs(&io->pfrio_table, pfras, io->pfrio_size, &io->pfrio_nadd, io->pfrio_flags | PFR_FLAG_USERIOCTL); diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c index c5de1e84a287..f9e6c97f385c 100644 --- a/sys/netpfil/pf/pf_nl.c +++ b/sys/netpfil/pf/pf_nl.c @@ -2082,6 +2082,88 @@ pf_handle_clear_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt) return (error); } +TAILQ_HEAD(pfr_addrq, pfr_addr_item); +struct nl_parsed_table_addrs { + struct pfr_table table; + uint32_t flags; + struct pfr_addr addrs[256]; + size_t addr_count; + int nadd; +}; +#define _OUT(_field) offsetof(struct pfr_addr, _field) +static const struct nlattr_parser nla_p_pfr_addr[] = { + { .type = PFR_A_AF, .off = _OUT(pfra_af), .cb = nlattr_get_uint8 }, + { .type = PFR_A_NET, .off = _OUT(pfra_net), .cb = nlattr_get_uint8 }, + { .type = PFR_A_NOT, .off = _OUT(pfra_not), .cb = nlattr_get_bool }, + { .type = PFR_A_ADDR, .off = _OUT(pfra_u), .cb = nlattr_get_in6_addr }, +}; +#undef _OUT +NL_DECLARE_ATTR_PARSER(pfra_addr_parser, nla_p_pfr_addr); + +static int +nlattr_get_pfr_addr(struct nlattr *nla, struct nl_pstate *npt, const void *arg, + void *target) +{ + struct nl_parsed_table_addrs *attrs = target; + struct pfr_addr addr = { 0 }; + int error; + + if (attrs->addr_count >= nitems(attrs->addrs)) + return (E2BIG); + + error = nlattr_get_nested(nla, npt, &pfra_addr_parser, &addr); + if (error != 0) + return (error); + + memcpy(&attrs->addrs[attrs->addr_count], &addr, sizeof(addr)); + attrs->addr_count++; + + return (0); +} + +NL_DECLARE_ATTR_PARSER(nested_table_parser, nla_p_table); + +#define _OUT(_field) offsetof(struct nl_parsed_table_addrs, _field) +static const struct nlattr_parser nla_p_table_addr[] = { + { .type = PF_TA_TABLE, .off = _OUT(table), .arg = &nested_table_parser, .cb = nlattr_get_nested }, + { .type = PF_TA_ADDR, .cb = nlattr_get_pfr_addr }, + { .type = PF_TA_FLAGS, .off = _OUT(flags), .cb = nlattr_get_uint32 }, +}; +NL_DECLARE_PARSER(table_addr_parser, struct genlmsghdr, nlf_p_empty, nla_p_table_addr); +#undef _OUT +static int +pf_handle_table_add_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt) +{ + struct nl_parsed_table_addrs attrs = { 0 }; + struct nl_writer *nw = npt->nw; + struct genlmsghdr *ghdr_new; + int error; + + error = nl_parse_nlmsg(hdr, &table_addr_parser, npt, &attrs); + if (error != 0) + return (error); + + PF_RULES_WLOCK(); + error = pfr_add_addrs(&attrs.table, &attrs.addrs[0], + attrs.addr_count, &attrs.nadd, attrs.flags | PFR_FLAG_USERIOCTL); + PF_RULES_WUNLOCK(); + + if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) + return (ENOMEM); + + ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); + ghdr_new->cmd = PFNL_CMD_TABLE_ADD_ADDR; + ghdr_new->version = 0; + ghdr_new->reserved = 0; + + nlattr_add_u32(nw, PF_TA_NBR_ADDED, attrs.nadd); + + if (!nlmsg_end(nw)) + return (ENOMEM); + + return (error); +} + static const struct nlhdr_parser *all_parsers[] = { &state_parser, &addrule_parser, @@ -2096,6 +2178,7 @@ static const struct nlhdr_parser *all_parsers[] = { &add_addr_parser, &ruleset_parser, &table_parser, + &table_addr_parser, }; static uint16_t family_id; @@ -2318,6 +2401,13 @@ static const struct genl_cmd pf_cmds[] = { .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, }, + { + .cmd_num = PFNL_CMD_TABLE_ADD_ADDR, + .cmd_name = "TABLE_ADD_ADDRS", + .cmd_cb = pf_handle_table_add_addrs, + .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, + .cmd_priv = PRIV_NETINET_PF, + }, }; void diff --git a/sys/netpfil/pf/pf_nl.h b/sys/netpfil/pf/pf_nl.h index d263a0b22deb..8a24230158e7 100644 --- a/sys/netpfil/pf/pf_nl.h +++ b/sys/netpfil/pf/pf_nl.h @@ -67,6 +67,7 @@ enum { PFNL_CMD_GET_TSTATS = 29, PFNL_CMD_CLR_TSTATS = 30, PFNL_CMD_CLR_ADDRS = 31, + PFNL_CMD_TABLE_ADD_ADDR = 32, __PFNL_CMD_MAX, }; #define PFNL_CMD_MAX (__PFNL_CMD_MAX -1) @@ -461,6 +462,22 @@ enum pf_tstats_t { PF_TS_NZERO = 9, /* u64 */ }; +enum pfr_addr_t { + PFR_A_UNSPEC, + PFR_A_AF = 1, /* uint8_t */ + PFR_A_NET = 2, /* uint8_t */ + PFR_A_NOT = 3, /* bool */ + PFR_A_ADDR = 4, /* in6_addr */ +}; + +enum pf_table_addrs_t { + PF_TA_UNSPEC, + PF_TA_TABLE = 1, /* nested, pf_table_t */ + PF_TA_ADDR = 2, /* nested, pfr_addr_t */ + PF_TA_FLAGS = 3, /* u32 */ + PF_TA_NBR_ADDED = 4, /* u32 */ +}; + #ifdef _KERNEL void pf_nl_register(void); diff --git a/sys/netpfil/pf/pf_table.c b/sys/netpfil/pf/pf_table.c index ecc185f89ad7..73ec18fa7646 100644 --- a/sys/netpfil/pf/pf_table.c +++ b/sys/netpfil/pf/pf_table.c @@ -294,7 +294,7 @@ pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size, else pfr_destroy_kentries(&workq); if (nadd != NULL) - *nadd = xadd; + *nadd += xadd; pfr_destroy_ktable(tmpkt, 0); return (0); _bad: diff --git a/tests/sys/netpfil/pf/table.sh b/tests/sys/netpfil/pf/table.sh index 5e5fccdaca20..c773518e95e4 100644 --- a/tests/sys/netpfil/pf/table.sh +++ b/tests/sys/netpfil/pf/table.sh @@ -610,6 +610,47 @@ flush_cleanup() pft_cleanup } +atf_test_case "large" "cleanup" +large_head() +{ + atf_set descr 'Test loading a large list of addresses' + atf_set require.user root +} + +large_body() +{ + pft_init + pwd=$(pwd) + + vnet_mkjail alcatraz + + for i in `seq 1 255`; do + for j in `seq 1 255`; do + echo "1.2.${i}.${j}" >> ${pwd}/foo.lst + done + done + expected=$(wc -l foo.lst | awk '{ print $1; }') + + jexec alcatraz pfctl -e + pft_set_rules alcatraz \ + "table <foo>" \ + "pass in from <foo>" \ + "pass" + + atf_check -s exit:0 \ + -e match:"${expected}/${expected} addresses added." \ + jexec alcatraz pfctl -t foo -T add -f ${pwd}/foo.lst + actual=$(jexec alcatraz pfctl -t foo -T show | wc -l | awk '{ print $1; }') + if [[ $actual -ne $expected ]]; then + atf_fail "Unexpected number of table entries $expected $acual" + fi +} + +large_cleanup() +{ + pft_cleanup +} + atf_init_test_cases() { atf_add_test_case "v4_counters" @@ -625,4 +666,5 @@ atf_init_test_cases() atf_add_test_case "precreate" atf_add_test_case "anchor" atf_add_test_case "flush" + atf_add_test_case "large" }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202508052228.575MS6wk014285>