pf: Keep every chunk of a table that a ruleset definesHEADmain

libpfctl sends a table definition in chunks of 256 addresses, each as
its own PFNL_CMD_INA_DEFINE.  The kernel treated every chunk as a new
definition and replaced the shadow table, so only the last chunk
survived.

Mark the chunks after the first with PF_ID_APPEND and have the kernel
add them to the shadow table in progress.  A request without the
attribute still replaces the shadow; one with it and no definition in
progress fails with EINVAL.  Old kernels ignore the attribute, so both
halves are needed; the ioctl sends all addresses at once and is not
affected.  Mask the flags userland passes to PFR_FLAG_ALLMASK, as
PFR_FLAG_APPEND is kernel-internal.

Add a test that defines a table of 1,000 addresses, also in an anchor.

Reviewed by:		kp
Fixes:			219ce3063840 ("pf: convert DIOCRINADEFINE to netlink")
Sponsored by:		Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D60876

0 files changed, 0 insertions, 0 deletions