libsysdecode: decode PF Generic Netlink commands

Decode the Generic Netlink command header for messages
belonging to the PF Generic Netlink family. Display the
command name using the PF Generic Netlink command decoder.

Signed-off-by:	Ishan Agrawal <iagrawal9990@gmail.com>
Reviewed by:	kp
Sponsored-by:	Google LLC (GSoC 2026)

1 files changed, 27 insertions, 2 deletions

diff --git a/lib/libsysdecode/netlink.c b/lib/libsysdecode/netlink.c
index a9c226e6065d..ce8ac0485009 100644
--- a/lib/libsysdecode/netlink.c
+++ b/lib/libsysdecode/netlink.c
@@ -29,6 +29,18 @@
 static struct name_table *family_table = NULL;
 static size_t num_family = 0;
 
+static void
+sysdecode_netlink_pf(FILE *fp, const struct genlmsghdr *genl)
+{
+	uint8_t cmd = genl->cmd;
+	const char *cmd_name = sysdecode_pfnl_cmd(cmd);
+
+	if (cmd_name != NULL)
+		fprintf(fp, "cmd=%s", cmd_name);
+	else
+		fprintf(fp, "cmd=%u", cmd);
+}
+
 bool
 sysdecode_netlink(FILE *fp, const void *buf, size_t len, int protocol)
 {
@@ -160,8 +172,21 @@ sysdecode_netlink(FILE *fp, const void *buf, size_t len, int protocol)
 		}
 
 		const char *family = lookup_value(family_table, nl->nlmsg_type);
-		if (family != NULL && strcmp(family, "pfctl") == 0)
-			fprintf(fp, ",pf={}");
+
+		if (family != NULL && protocol == NETLINK_GENERIC) {
+			fprintf(fp, ",%s={", family);
+
+			if (strcmp(family, "pfctl") == 0) {
+				const struct genlmsghdr *genl =
+				    (const struct genlmsghdr *)(const void *)
+				    ((const char *)nl +
+				    sizeof(struct nlmsghdr));
+
+				sysdecode_netlink_pf(fp, genl);
+			}
+
+			fprintf(fp, "}");
+		}
 
 		/* Handle Alignment (Netlink messages are 4-byte aligned). */
 		size_t aligned_len = NLMSG_ALIGN(nl->nlmsg_len);