The branch main has been updated by kp:
URL:
https://cgit.FreeBSD.org/src/commit/?id=441d489493e8a1e2658306f1a4c709a0b18cc78b
commit 441d489493e8a1e2658306f1a4c709a0b18cc78b
Author: Kristof Provost <k...@freebsd.org>
AuthorDate: 2024-12-03 15:53:08 +0000
Commit: Kristof Provost <k...@freebsd.org>
CommitDate: 2025-01-14 08:54:17 +0000
pf: convert DIOCRCLRTABLES to netlink
Sponsored by: Rubicon Communications, LLC ("Netgate")
---
lib/libpfctl/libpfctl.c | 44 ++++++++++++++++++++++++++++++++++++++
lib/libpfctl/libpfctl.h | 3 +++
sbin/pfctl/pfctl.c | 4 ++--
sbin/pfctl/pfctl.h | 5 +++--
sbin/pfctl/pfctl_radix.c | 16 --------------
sbin/pfctl/pfctl_table.c | 4 ++--
sys/netpfil/pf/pf_nl.c | 55 ++++++++++++++++++++++++++++++++++++++++++++++++
sys/netpfil/pf/pf_nl.h | 10 +++++++++
8 files changed, 119 insertions(+), 22 deletions(-)
diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c
index 2e4cdb91bad9..b374ef05e4d7 100644
--- a/lib/libpfctl/libpfctl.c
+++ b/lib/libpfctl/libpfctl.c
@@ -3072,3 +3072,47 @@ pfctl_get_srcnodes(struct pfctl_handle *h,
pfctl_get_srcnode_fn fn, void *arg)
return (e.error);
}
+
+static struct snl_attr_parser ap_ndel[] = {
+ { .type = PF_T_NBR_DELETED, .off = 0, .cb = snl_attr_get_uint32 },
+};
+static struct snl_field_parser fp_ndel[] = {};
+SNL_DECLARE_PARSER(ndel_parser, struct genlmsghdr, fp_ndel, ap_ndel);
+
+int
+pfctl_clear_tables(struct pfctl_handle *h, struct pfr_table *filter,
+ int *ndel, int flags)
+{
+ struct snl_writer nw;
+ struct snl_errmsg_data e = {};
+ struct nlmsghdr *hdr;
+ uint32_t seq_id;
+ int family_id;
+
+ family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME);
+ if (family_id == 0)
+ return (ENOTSUP);
+
+ snl_init_writer(&h->ss, &nw);
+ hdr = snl_create_genl_msg_request(&nw, family_id,
PFNL_CMD_CLEAR_TABLES);
+
+ snl_add_msg_attr_string(&nw, PF_T_ANCHOR, filter->pfrt_anchor);
+ snl_add_msg_attr_string(&nw, PF_T_NAME, filter->pfrt_name);
+ snl_add_msg_attr_u32(&nw, PF_T_TABLE_FLAGS, filter->pfrt_flags);
+ snl_add_msg_attr_u32(&nw, PF_T_FLAGS, flags);
+
+ if ((hdr = snl_finalize_msg(&nw)) == NULL)
+ return (ENXIO);
+
+ seq_id = hdr->nlmsg_seq;
+
+ if (!snl_send_message(&h->ss, hdr))
+ return (ENXIO);
+
+ while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) {
+ if (!snl_parse_nlmsg(&h->ss, hdr, &ndel_parser, ndel))
+ continue;
+ }
+
+ return (e.error);
+}
diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h
index 79756286563b..14ea06fd151a 100644
--- a/lib/libpfctl/libpfctl.h
+++ b/lib/libpfctl/libpfctl.h
@@ -539,4 +539,7 @@ int pfctl_get_ruleset(struct pfctl_handle *h, const char
*path, uint32_t nr, str
typedef int (*pfctl_get_srcnode_fn)(struct pfctl_src_node*, void *);
int pfctl_get_srcnodes(struct pfctl_handle *h, pfctl_get_srcnode_fn fn,
void *arg);
+int pfctl_clear_tables(struct pfctl_handle *h, struct pfr_table *filter,
+ int *ndel, int flags);
+
#endif
diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c
index 09d6774b324f..190d1a382c03 100644
--- a/sbin/pfctl/pfctl.c
+++ b/sbin/pfctl/pfctl.c
@@ -3219,7 +3219,7 @@ main(int argc, char *argv[])
pfctl_flush_eth_rules(dev, opts, anchorname);
pfctl_flush_rules(dev, opts, anchorname);
pfctl_flush_nat(dev, opts, anchorname);
- pfctl_clear_tables(anchorname, opts);
+ pfctl_do_clear_tables(anchorname, opts);
if (!*anchorname) {
pfctl_clear_altq(dev, opts);
pfctl_clear_iface_states(dev, ifaceopt, opts);
@@ -3233,7 +3233,7 @@ main(int argc, char *argv[])
pfctl_clear_fingerprints(dev, opts);
break;
case 'T':
- pfctl_clear_tables(anchorname, opts);
+ pfctl_do_clear_tables(anchorname, opts);
break;
}
}
diff --git a/sbin/pfctl/pfctl.h b/sbin/pfctl/pfctl.h
index b4aba3beb4a6..788232d89006 100644
--- a/sbin/pfctl/pfctl.h
+++ b/sbin/pfctl/pfctl.h
@@ -36,6 +36,8 @@
#include <libpfctl.h>
+extern struct pfctl_handle *pfh;
+
struct pfctl;
enum pfctl_show { PFCTL_SHOW_RULES, PFCTL_SHOW_LABELS, PFCTL_SHOW_NOTHING };
@@ -54,7 +56,6 @@ struct pfr_buffer {
(var) = pfr_buf_next((buf), (var)))
int pfr_get_fd(void);
-int pfr_clr_tables(struct pfr_table *, int *, int);
int pfr_add_tables(struct pfr_table *, int, int *, int);
int pfr_del_tables(struct pfr_table *, int, int *, int);
int pfr_get_tables(struct pfr_table *, struct pfr_table *, int *, int);
@@ -82,7 +83,7 @@ int pfi_get_ifaces(const char *, struct pfi_kif *, int *);
int pfi_clr_istats(const char *, int *, int);
void pfctl_print_title(char *);
-int pfctl_clear_tables(const char *, int);
+int pfctl_do_clear_tables(const char *, int);
int pfctl_show_tables(const char *, int);
int pfctl_command_tables(int, char *[], char *, const char *, char *,
const char *, int);
diff --git a/sbin/pfctl/pfctl_radix.c b/sbin/pfctl/pfctl_radix.c
index 9bea219a7d81..22552bcf1737 100644
--- a/sbin/pfctl/pfctl_radix.c
+++ b/sbin/pfctl/pfctl_radix.c
@@ -73,22 +73,6 @@ pfr_report_error(struct pfr_table *tbl, struct pfioc_table
*io,
err, tbl->pfrt_name);
}
-int
-pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags)
-{
- struct pfioc_table io;
-
- bzero(&io, sizeof io);
- io.pfrio_flags = flags;
- if (filter != NULL)
- io.pfrio_table = *filter;
- if (ioctl(dev, DIOCRCLRTABLES, &io))
- return (-1);
- if (ndel != NULL)
- *ndel = io.pfrio_ndel;
- return (0);
-}
-
int
pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags)
{
diff --git a/sbin/pfctl/pfctl_table.c b/sbin/pfctl/pfctl_table.c
index aac031ce26b2..5e701be3c654 100644
--- a/sbin/pfctl/pfctl_table.c
+++ b/sbin/pfctl/pfctl_table.c
@@ -104,7 +104,7 @@ static const char *istats_text[2][2][2] = {
} while(0)
int
-pfctl_clear_tables(const char *anchor, int opts)
+pfctl_do_clear_tables(const char *anchor, int opts)
{
return pfctl_table(0, NULL, NULL, "-F", NULL, anchor, opts);
}
@@ -157,7 +157,7 @@ pfctl_table(int argc, char *argv[], char *tname, const char
*command,
if (!strcmp(command, "-F")) {
if (argc || file != NULL)
usage();
- RVTEST(pfr_clr_tables(&table, &ndel, flags));
+ RVTEST(pfctl_clear_tables(pfh, &table, &ndel, flags));
xprintf(opts, "%d tables deleted", ndel);
} else if (!strcmp(command, "-s")) {
b.pfrb_type = (opts & PF_OPT_VERBOSE2) ?
diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c
index e586ad082e4b..3e7a6965d387 100644
--- a/sys/netpfil/pf/pf_nl.c
+++ b/sys/netpfil/pf/pf_nl.c
@@ -1793,6 +1793,53 @@ pf_handle_get_srcnodes(struct nlmsghdr *hdr, struct
nl_pstate *npt)
return (0);
}
+#define _OUT(_field) offsetof(struct pfioc_table, _field)
+static const struct nlattr_parser nla_p_table[] = {
+ { .type = PF_T_ANCHOR, .off = _OUT(pfrio_table.pfrt_anchor), .arg =
(void *)MAXPATHLEN, .cb = nlattr_get_chara },
+ { .type = PF_T_NAME, .off = _OUT(pfrio_table.pfrt_name), .arg = (void
*)PF_TABLE_NAME_SIZE, .cb = nlattr_get_chara },
+ { .type = PF_T_TABLE_FLAGS, .off = _OUT(pfrio_table.pfrt_flags), .cb =
nlattr_get_uint32 },
+ { .type = PF_T_FLAGS, .off = _OUT(pfrio_flags), .cb = nlattr_get_uint32
},
+};
+static const struct nlfield_parser nlf_p_table[] = {};
+NL_DECLARE_PARSER(table_parser, struct genlmsghdr, nlf_p_table, nla_p_table);
+#undef _OUT
+static int
+pf_handle_clear_tables(struct nlmsghdr *hdr, struct nl_pstate *npt)
+{
+ struct pfioc_table attrs = { 0 };
+ struct nl_writer *nw = npt->nw;
+ struct genlmsghdr *ghdr_new;
+ int ndel = 0;
+ int error;
+
+ error = nl_parse_nlmsg(hdr, &table_parser, npt, &attrs);
+ if (error != 0)
+ return (error);
+
+ PF_RULES_WLOCK();
+ error = pfr_clr_tables(&attrs.pfrio_table, &ndel, attrs.pfrio_flags |
PFR_FLAG_USERIOCTL);
+ PF_RULES_WUNLOCK();
+ if (error != 0)
+ return (error);
+
+ if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
+ return (ENOMEM);
+
+ ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
+ ghdr_new->cmd = PFNL_CMD_CLEAR_TABLES;
+ ghdr_new->version = 0;
+ ghdr_new->reserved = 0;
+
+ nlattr_add_u32(nw, PF_T_NBR_DELETED, ndel);
+
+ if (!nlmsg_end(nw)) {
+ nlmsg_abort(nw);
+ return (ENOMEM);
+ }
+
+ return (0);
+}
+
static const struct nlhdr_parser *all_parsers[] = {
&state_parser,
&addrule_parser,
@@ -1806,6 +1853,7 @@ static const struct nlhdr_parser *all_parsers[] = {
&pool_addr_parser,
&add_addr_parser,
&ruleset_parser,
+ &table_parser,
};
static int family_id;
@@ -1986,6 +2034,13 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
},
+ {
+ .cmd_num = PFNL_CMD_CLEAR_TABLES,
+ .cmd_name = "CLEAR_TABLES",
+ .cmd_cb = pf_handle_clear_tables,
+ .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
+ .cmd_priv = PRIV_NETINET_PF,
+ },
};
void
diff --git a/sys/netpfil/pf/pf_nl.h b/sys/netpfil/pf/pf_nl.h
index 0f534bd623c4..8c0149891773 100644
--- a/sys/netpfil/pf/pf_nl.h
+++ b/sys/netpfil/pf/pf_nl.h
@@ -61,6 +61,7 @@ enum {
PFNL_CMD_GET_RULESETS = 23,
PFNL_CMD_GET_RULESET = 24,
PFNL_CMD_GET_SRCNODES = 25,
+ PFNL_CMD_CLEAR_TABLES = 26,
__PFNL_CMD_MAX,
};
#define PFNL_CMD_MAX (__PFNL_CMD_MAX -1)
@@ -422,6 +423,15 @@ enum pf_srcnodes_types_t {
PF_SN_NAF = 15, /* u8 */
};
+enum pf_tables_t {
+ PF_T_UNSPEC,
+ PF_T_ANCHOR = 1, /* string */
+ PF_T_NAME = 2, /* string */
+ PF_T_TABLE_FLAGS = 3, /* u32 */
+ PF_T_FLAGS = 4, /* u32 */
+ PF_T_NBR_DELETED = 5, /* u32 */
+};
+
#ifdef _KERNEL
void pf_nl_register(void);
