diff options
author | Kristof Provost <kp@FreeBSD.org> | 2024-10-01 17:15:54 +0000 |
---|---|---|
committer | Kristof Provost <kp@FreeBSD.org> | 2024-10-10 12:10:40 +0000 |
commit | 25e0f8f99f544f5bb737b2c7709fe6ea572e37f0 (patch) | |
tree | b8c908d72fac747d9e97cd25367d95cf83a452fd | |
parent | 7b033960e15a998a388b1e4e84be9169b7762470 (diff) | |
download | src-25e0f8f99f54.tar.gz src-25e0f8f99f54.zip |
pf: convert DIOCGETRULESETS to netlink
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D46930
-rw-r--r-- | lib/libpfctl/libpfctl.c | 48 | ||||
-rw-r--r-- | lib/libpfctl/libpfctl.h | 1 | ||||
-rw-r--r-- | sbin/pfctl/pfctl.c | 22 | ||||
-rw-r--r-- | sys/net/pfvar.h | 1 | ||||
-rw-r--r-- | sys/netpfil/pf/pf_ioctl.c | 52 | ||||
-rw-r--r-- | sys/netpfil/pf/pf_nl.c | 51 | ||||
-rw-r--r-- | sys/netpfil/pf/pf_nl.h | 7 |
7 files changed, 149 insertions, 33 deletions
diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c index 36b83c480aa7..c9f315a0db67 100644 --- a/lib/libpfctl/libpfctl.c +++ b/lib/libpfctl/libpfctl.c @@ -2914,5 +2914,51 @@ pfctl_get_addr(struct pfctl_handle *h, uint32_t ticket, uint32_t r_num, continue; } - return (0); + return (e.error); } + +#define _OUT(_field) offsetof(struct pfioc_ruleset, _field) +static const struct snl_attr_parser ap_ruleset[] = { + { .type = PF_RS_NR, .off = _OUT(nr), .cb = snl_attr_get_uint32 }, +}; +static struct snl_field_parser fp_ruleset[] = {}; +SNL_DECLARE_PARSER(ruleset_parser, struct genlmsghdr, fp_ruleset, ap_ruleset); +#undef _OUT + +int +pfctl_get_rulesets(struct pfctl_handle *h, const char *path, uint32_t *nr) +{ + struct snl_writer nw; + struct snl_errmsg_data e = {}; + struct nlmsghdr *hdr; + struct pfioc_ruleset rs = {}; + uint32_t seq_id; + int family_id; + + family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME); + if (family_id == 0) + return (ENOTSUP); + + snl_init_writer(&h->ss, &nw); + hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_GET_RULESETS); + + snl_add_msg_attr_string(&nw, PF_RS_PATH, path); + + if ((hdr = snl_finalize_msg(&nw)) == NULL) + return (ENXIO); + + seq_id = hdr->nlmsg_seq; + + if (! snl_send_message(&h->ss, hdr)) + return (ENXIO); + + while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) { + if (! snl_parse_nlmsg(&h->ss, hdr, &ruleset_parser, &rs)) + continue; + } + + *nr = rs.nr; + + return (e.error); +} + diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h index 6088e18554b3..6d8be24dd04f 100644 --- a/lib/libpfctl/libpfctl.h +++ b/lib/libpfctl/libpfctl.h @@ -504,5 +504,6 @@ int pfctl_get_addrs(struct pfctl_handle *h, uint32_t ticket, uint32_t r_num, uint8_t r_action, const char *anchor, uint32_t *nr); int pfctl_get_addr(struct pfctl_handle *h, uint32_t ticket, uint32_t r_num, uint8_t r_action, const char *anchor, uint32_t nr, struct pfioc_pooladdr *pa); +int pfctl_get_rulesets(struct pfctl_handle *h, const char *path, uint32_t *nr); #endif diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c index 16c54981b348..ee49e7b12278 100644 --- a/sbin/pfctl/pfctl.c +++ b/sbin/pfctl/pfctl.c @@ -1253,14 +1253,13 @@ pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format, memset(&prs, 0, sizeof(prs)); memcpy(prs.path, npath, sizeof(prs.path)); - if (ioctl(dev, DIOCGETRULESETS, &prs)) { - if (errno == EINVAL) + if ((ret = pfctl_get_rulesets(pfh, npath, &mnr)) != 0) { + if (ret == EINVAL) fprintf(stderr, "Anchor '%s' " "not found.\n", anchorname); else - err(1, "DIOCGETRULESETS"); + errc(1, ret, "DIOCGETRULESETS"); } - mnr = prs.nr; pfctl_print_rule_counters(&rule, opts); for (nr = 0; nr < mnr; ++nr) { @@ -1457,14 +1456,13 @@ pfctl_show_nat(int dev, char *path, int opts, char *anchorname, int depth, u_int32_t mnr, nr; memset(&prs, 0, sizeof(prs)); memcpy(prs.path, npath, sizeof(prs.path)); - if (ioctl(dev, DIOCGETRULESETS, &prs)) { - if (errno == EINVAL) + if ((ret = pfctl_get_rulesets(pfh, npath, &mnr)) != 0) { + if (ret == EINVAL) fprintf(stderr, "NAT anchor '%s' " "not found.\n", anchorname); else - err(1, "DIOCGETRULESETS"); + errc(1, ret, "DIOCGETRULESETS"); } - mnr = prs.nr; pfctl_print_rule_counters(&rule, opts); for (nr = 0; nr < mnr; ++nr) { @@ -2815,18 +2813,18 @@ pfctl_show_anchors(int dev, int opts, char *anchorname) { struct pfioc_ruleset pr; u_int32_t mnr, nr; + int ret; memset(&pr, 0, sizeof(pr)); memcpy(pr.path, anchorname, sizeof(pr.path)); - if (ioctl(dev, DIOCGETRULESETS, &pr)) { - if (errno == EINVAL) + if ((ret = pfctl_get_rulesets(pfh, anchorname, &mnr)) != 0) { + if (ret == EINVAL) fprintf(stderr, "Anchor '%s' not found.\n", anchorname); else - err(1, "DIOCGETRULESETS"); + errc(1, ret, "DIOCGETRULESETS"); return (-1); } - mnr = pr.nr; for (nr = 0; nr < mnr; ++nr) { char sub[MAXPATHLEN]; diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h index 66e3e53b8b37..e27c5e666de8 100644 --- a/sys/net/pfvar.h +++ b/sys/net/pfvar.h @@ -2581,6 +2581,7 @@ int pf_ioctl_begin_addrs(uint32_t *); int pf_ioctl_add_addr(struct pfioc_pooladdr *); int pf_ioctl_get_addrs(struct pfioc_pooladdr *); int pf_ioctl_get_addr(struct pfioc_pooladdr *); +int pf_ioctl_get_rulesets(struct pfioc_ruleset *); void pf_krule_free(struct pf_krule *); void pf_krule_clear_counters(struct pf_krule *); diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c index 8081960933a2..e3fb3150db5f 100644 --- a/sys/netpfil/pf/pf_ioctl.c +++ b/sys/netpfil/pf/pf_ioctl.c @@ -2665,6 +2665,37 @@ pf_ioctl_get_addr(struct pfioc_pooladdr *pp) return (0); } +int +pf_ioctl_get_rulesets(struct pfioc_ruleset *pr) +{ + struct pf_kruleset *ruleset; + struct pf_kanchor *anchor; + + PF_RULES_RLOCK_TRACKER; + + pr->path[sizeof(pr->path) - 1] = 0; + + PF_RULES_RLOCK(); + if ((ruleset = pf_find_kruleset(pr->path)) == NULL) { + PF_RULES_RUNLOCK(); + return (ENOENT); + } + pr->nr = 0; + if (ruleset->anchor == NULL) { + /* XXX kludge for pf_main_ruleset */ + RB_FOREACH(anchor, pf_kanchor_global, &V_pf_anchors) + if (anchor->parent == NULL) + pr->nr++; + } else { + RB_FOREACH(anchor, pf_kanchor_node, + &ruleset->anchor->children) + pr->nr++; + } + PF_RULES_RUNLOCK(); + + return (0); +} + static int pfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread *td) { @@ -4474,29 +4505,10 @@ DIOCCHANGEADDR_error: case DIOCGETRULESETS: { struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; - struct pf_kruleset *ruleset; - struct pf_kanchor *anchor; pr->path[sizeof(pr->path) - 1] = 0; - PF_RULES_RLOCK(); - if ((ruleset = pf_find_kruleset(pr->path)) == NULL) { - PF_RULES_RUNLOCK(); - error = ENOENT; - break; - } - pr->nr = 0; - if (ruleset->anchor == NULL) { - /* XXX kludge for pf_main_ruleset */ - RB_FOREACH(anchor, pf_kanchor_global, &V_pf_anchors) - if (anchor->parent == NULL) - pr->nr++; - } else { - RB_FOREACH(anchor, pf_kanchor_node, - &ruleset->anchor->children) - pr->nr++; - } - PF_RULES_RUNLOCK(); + error = pf_ioctl_get_rulesets(pr); break; } diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c index 15fe341ce57e..e3c0369f550d 100644 --- a/sys/netpfil/pf/pf_nl.c +++ b/sys/netpfil/pf/pf_nl.c @@ -1635,6 +1635,49 @@ pf_handle_get_addr(struct nlmsghdr *hdr, struct nl_pstate *npt) return (0); } +#define _OUT(_field) offsetof(struct pfioc_ruleset, _field) +static const struct nlattr_parser nla_p_ruleset[] = { + { .type = PF_RS_PATH, .off = _OUT(path), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara }, +}; +static const struct nlfield_parser nlf_p_ruleset[] = { +}; +NL_DECLARE_PARSER(ruleset_parser, struct genlmsghdr, nlf_p_ruleset, nla_p_ruleset); +#undef _OUT + +static int +pf_handle_get_rulesets(struct nlmsghdr *hdr, struct nl_pstate *npt) +{ + struct pfioc_ruleset attrs = { 0 }; + struct nl_writer *nw = npt->nw; + struct genlmsghdr *ghdr_new; + int error; + + error = nl_parse_nlmsg(hdr, &ruleset_parser, npt, &attrs); + if (error != 0) + return (error); + + error = pf_ioctl_get_rulesets(&attrs); + if (error != 0) + return (error); + + if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) + return (ENOMEM); + + ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); + ghdr_new->cmd = PFNL_CMD_GET_RULESETS; + ghdr_new->version = 0; + ghdr_new->reserved = 0; + + nlattr_add_u32(nw, PF_RS_NR, attrs.nr); + + if (!nlmsg_end(nw)) { + nlmsg_abort(nw); + return (ENOMEM); + } + + return (0); +} + static const struct nlhdr_parser *all_parsers[] = { &state_parser, &addrule_parser, @@ -1647,6 +1690,7 @@ static const struct nlhdr_parser *all_parsers[] = { &set_limit_parser, &pool_addr_parser, &add_addr_parser, + &ruleset_parser, }; static int family_id; @@ -1806,6 +1850,13 @@ static const struct genl_cmd pf_cmds[] = { .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, }, + { + .cmd_num = PFNL_CMD_GET_RULESETS, + .cmd_name = "GET_RULESETS", + .cmd_cb = pf_handle_get_rulesets, + .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, + .cmd_priv = PRIV_NETINET_PF, + }, }; void diff --git a/sys/netpfil/pf/pf_nl.h b/sys/netpfil/pf/pf_nl.h index acb4b31320c0..5aa02d10214b 100644 --- a/sys/netpfil/pf/pf_nl.h +++ b/sys/netpfil/pf/pf_nl.h @@ -58,6 +58,7 @@ enum { PFNL_CMD_ADD_ADDR = 20, PFNL_CMD_GET_ADDRS = 21, PFNL_CMD_GET_ADDR = 22, + PFNL_CMD_GET_RULESETS = 23, __PFNL_CMD_MAX, }; #define PFNL_CMD_MAX (__PFNL_CMD_MAX -1) @@ -380,6 +381,12 @@ enum pf_add_addr_types_t { PF_AA_ADDR = 9, /* nested, pf_pooladdr */ }; +enum pf_get_rulesets_types_t { + PF_RS_UNSPEC, + PF_RS_PATH = 1, /* string */ + PF_RS_NR = 2, /* u32 */ +}; + #ifdef _KERNEL void pf_nl_register(void); |