pfctl: Start using DIOCCLRSTATESNV

MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D30053

(cherry picked from commit 53714a586133fd8ae662427007f84ec663cd83ef)

2 files changed, 77 insertions, 0 deletions

diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c
index b07fcda9bd5a..8c8b21d22a46 100644
--- a/lib/libpfctl/libpfctl.c
+++ b/lib/libpfctl/libpfctl.c
@@ -608,3 +608,62 @@ pfctl_set_keepcounters(int dev, bool keep)
 	free(nv.data);
 	return (ret);
 }
+
+static void
+pfctl_nv_add_state_cmp(nvlist_t *nvl, const char *name,
+    const struct pfctl_state_cmp *cmp)
+{
+	nvlist_t	*nv;
+
+	nv = nvlist_create(0);
+
+	nvlist_add_number(nv, "id", cmp->id);
+	nvlist_add_number(nv, "creatorid", cmp->creatorid);
+	nvlist_add_number(nv, "direction", cmp->direction);
+
+	nvlist_add_nvlist(nvl, name, nv);
+}
+
+int
+pfctl_clear_states(int dev, const struct pfctl_kill *kill,
+    unsigned int *killed)
+{
+	struct pfioc_nv	 nv;
+	nvlist_t	*nvl;
+	int		 ret;
+
+	nvl = nvlist_create(0);
+
+	pfctl_nv_add_state_cmp(nvl, "cmp", &kill->cmp);
+	nvlist_add_number(nvl, "af", kill->af);
+	nvlist_add_number(nvl, "proto", kill->proto);
+	pfctl_nv_add_rule_addr(nvl, "src", &kill->src);
+	pfctl_nv_add_rule_addr(nvl, "dst", &kill->dst);
+	nvlist_add_string(nvl, "ifname", kill->ifname);
+	nvlist_add_string(nvl, "label", kill->label);
+
+	nv.data = nvlist_pack(nvl, &nv.len);
+	nv.size = nv.len;
+	nvlist_destroy(nvl);
+	nvl = NULL;
+
+	ret = ioctl(dev, DIOCCLRSTATESNV, &nv);
+	if (ret != 0) {
+		free(nv.data);
+		return (ret);
+	}
+
+	nvl = nvlist_unpack(nv.data, nv.len, 0);
+	if (nvl == NULL) {
+		free(nv.data);
+		return (EIO);
+	}
+
+	if (killed)
+		*killed = nvlist_get_number(nvl, "killed");
+
+	nvlist_destroy(nvl);
+	free(nv.data);
+
+	return (ret);
+}
diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h
index e19187fc2526..3ec2a7fa535f 100644
--- a/lib/libpfctl/libpfctl.h
+++ b/lib/libpfctl/libpfctl.h
@@ -179,6 +179,22 @@ RB_PROTOTYPE(pfctl_anchor_global, pfctl_anchor, entry_global,
 RB_PROTOTYPE(pfctl_anchor_node, pfctl_anchor, entry_node,
     pf_anchor_compare);
 
+struct pfctl_state_cmp {
+	uint64_t	id;
+	uint32_t	creatorid;
+	uint8_t		direction;
+};
+
+struct pfctl_kill {
+	struct pfctl_state_cmp	cmp;
+	sa_family_t		af;
+	int			proto;
+	struct pf_rule_addr	src;
+	struct pf_rule_addr	dst;
+	char			ifname[IFNAMSIZ];
+	char			label[PF_RULE_LABEL_SIZE];
+};
+
 int	pfctl_get_rule(int dev, u_int32_t nr, u_int32_t ticket,
 	    const char *anchor, u_int32_t ruleset, struct pfctl_rule *rule,
 	    char *anchor_call);
@@ -189,5 +205,7 @@ int	pfctl_add_rule(int dev, const struct pfctl_rule *r,
 	    const char *anchor, const char *anchor_call, u_int32_t ticket,
 	    u_int32_t pool_ticket);
 int	pfctl_set_keepcounters(int dev, bool keep);
+int	pfctl_clear_states(int dev, const struct pfctl_kill *kill,
+	    unsigned int *killed);
 
 #endif