The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=44f323ecdec02dc947c34d08c34b881fe2da1ba6
commit 44f323ecdec02dc947c34d08c34b881fe2da1ba6 Author: Kristof Provost <[email protected]> AuthorDate: 2023-11-24 23:42:44 +0000 Commit: Kristof Provost <[email protected]> CommitDate: 2023-11-27 20:36:49 +0000 pf: implement DIOCGETRULES via netlink Sponsored by: Rubicon Communications, LLC ("Netgate") --- lib/libpfctl/libpfctl.c | 57 ++++++++++++++++++++++++++++++---------- sys/net/pfvar.h | 1 + sys/netpfil/pf/pf_ioctl.c | 56 +++++++++++++++++++++++----------------- sys/netpfil/pf/pf_nl.c | 66 +++++++++++++++++++++++++++++++++++++++++++++-- sys/netpfil/pf/pf_nl.h | 9 +++++++ 5 files changed, 149 insertions(+), 40 deletions(-) diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c index a600031ec0a9..513d2d0f01be 100644 --- a/lib/libpfctl/libpfctl.c +++ b/lib/libpfctl/libpfctl.c @@ -1119,26 +1119,55 @@ pfctl_add_rule(int dev __unused, const struct pfctl_rule *r, const char *anchor, return (e.error); } +#define _IN(_field) offsetof(struct genlmsghdr, _field) +#define _OUT(_field) offsetof(struct pfctl_rules_info, _field) +static struct snl_attr_parser ap_getrules[] = { + { .type = PF_GR_NR, .off = _OUT(nr), .cb = snl_attr_get_uint32 }, + { .type = PF_GR_TICKET, .off = _OUT(ticket), .cb = snl_attr_get_uint32 }, +}; +static struct snl_field_parser fp_getrules[] = { +}; +#undef _IN +#undef _OUT +SNL_DECLARE_PARSER(getrules_parser, struct genlmsghdr, fp_getrules, ap_getrules); + int -pfctl_get_rules_info(int dev, struct pfctl_rules_info *rules, uint32_t ruleset, +pfctl_get_rules_info(int dev __unused, struct pfctl_rules_info *rules, uint32_t ruleset, const char *path) { - struct pfioc_rule pr; - int ret; + struct snl_state ss = {}; + struct snl_errmsg_data e = {}; + struct nlmsghdr *hdr; + struct snl_writer nw; + uint32_t seq_id; + int family_id; - bzero(&pr, sizeof(pr)); - if (strlcpy(pr.anchor, path, sizeof(pr.anchor)) >= sizeof(pr.anchor)) - return (E2BIG); + snl_init(&ss, NETLINK_GENERIC); + family_id = snl_get_genl_family(&ss, PFNL_FAMILY_NAME); + if (family_id == 0) + return (ENOTSUP); - pr.rule.action = ruleset; - ret = ioctl(dev, DIOCGETRULES, &pr); - if (ret != 0) - return (ret); + snl_init_writer(&ss, &nw); + hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_GETRULES); + hdr->nlmsg_flags |= NLM_F_DUMP; - rules->nr = pr.nr; - rules->ticket = pr.ticket; + snl_add_msg_attr_string(&nw, PF_GR_ANCHOR, path); + snl_add_msg_attr_u8(&nw, PF_GR_ACTION, ruleset); - return (0); + hdr = snl_finalize_msg(&nw); + if (hdr == NULL) + return (ENOMEM); + + seq_id = hdr->nlmsg_seq; + if (! snl_send_message(&ss, hdr)) + return (ENXIO); + + while ((hdr = snl_read_reply_multi(&ss, seq_id, &e)) != NULL) { + if (! snl_parse_nlmsg(&ss, hdr, &getrules_parser, rules)) + continue; + } + + return (e.error); } int @@ -1368,7 +1397,7 @@ SNL_DECLARE_PARSER(state_parser, struct genlmsghdr, fp_state, ap_state); static const struct snl_hdr_parser *all_parsers[] = { &state_parser, &skey_parser, &speer_parser, - &creator_parser, + &creator_parser, &getrules_parser }; static int diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h index 4b10190bf9ea..48162b786a86 100644 --- a/sys/net/pfvar.h +++ b/sys/net/pfvar.h @@ -2473,6 +2473,7 @@ int pf_keth_anchor_nvcopyout( struct pf_keth_ruleset *pf_find_or_create_keth_ruleset(const char *); void pf_keth_anchor_remove(struct pf_keth_rule *); +int pf_ioctl_getrules(struct pfioc_rule *); int pf_ioctl_addrule(struct pf_krule *, uint32_t, uint32_t, const char *, const char *, uid_t uid, pid_t); diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c index 1598939c2375..ec55d43d3800 100644 --- a/sys/netpfil/pf/pf_ioctl.c +++ b/sys/netpfil/pf/pf_ioctl.c @@ -2021,6 +2021,36 @@ pf_rule_to_krule(const struct pf_rule *rule, struct pf_krule *krule) return (0); } +int +pf_ioctl_getrules(struct pfioc_rule *pr) +{ + struct pf_kruleset *ruleset; + struct pf_krule *tail; + int rs_num; + + PF_RULES_WLOCK(); + ruleset = pf_find_kruleset(pr->anchor); + if (ruleset == NULL) { + PF_RULES_WUNLOCK(); + return (EINVAL); + } + rs_num = pf_get_ruleset_number(pr->rule.action); + if (rs_num >= PF_RULESET_MAX) { + PF_RULES_WUNLOCK(); + return (EINVAL); + } + tail = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, + pf_krulequeue); + if (tail) + pr->nr = tail->nr + 1; + else + pr->nr = 0; + pr->ticket = ruleset->rules[rs_num].active.ticket; + PF_RULES_WUNLOCK(); + + return (0); +} + int pf_ioctl_addrule(struct pf_krule *rule, uint32_t ticket, uint32_t pool_ticket, const char *anchor, const char *anchor_call, @@ -3117,33 +3147,11 @@ DIOCADDRULENV_error: case DIOCGETRULES: { struct pfioc_rule *pr = (struct pfioc_rule *)addr; - struct pf_kruleset *ruleset; - struct pf_krule *tail; - int rs_num; pr->anchor[sizeof(pr->anchor) - 1] = 0; - PF_RULES_WLOCK(); - ruleset = pf_find_kruleset(pr->anchor); - if (ruleset == NULL) { - PF_RULES_WUNLOCK(); - error = EINVAL; - break; - } - rs_num = pf_get_ruleset_number(pr->rule.action); - if (rs_num >= PF_RULESET_MAX) { - PF_RULES_WUNLOCK(); - error = EINVAL; - break; - } - tail = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, - pf_krulequeue); - if (tail) - pr->nr = tail->nr + 1; - else - pr->nr = 0; - pr->ticket = ruleset->rules[rs_num].active.ticket; - PF_RULES_WUNLOCK(); + error = pf_ioctl_getrules(pr); + break; } diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c index fe5ded0e86a4..86cc5ba9cc91 100644 --- a/sys/netpfil/pf/pf_nl.c +++ b/sys/netpfil/pf/pf_nl.c @@ -635,7 +635,64 @@ pf_handle_addrule(struct nlmsghdr *hdr, struct nl_pstate *npt) return (error); } -static const struct nlhdr_parser *all_parsers[] = { &state_parser, &addrule_parser }; +struct nl_parsed_getrules { + char *anchor; + uint8_t action; +}; +#define _IN(_field) offsetof(struct genlmsghdr, _field) +#define _OUT(_field) offsetof(struct pfioc_rule, _field) +static const struct nlattr_parser nla_p_getrules[] = { + { .type = PF_GR_ANCHOR, .off = _OUT(anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara }, + { .type = PF_GR_ACTION, .off = _OUT(rule.action), .cb = nlattr_get_uint8 }, +}; +static const struct nlfield_parser nlf_p_getrules[] = { +}; +NL_DECLARE_PARSER(getrules_parser, struct genlmsghdr, nlf_p_getrules, nla_p_getrules); + +static int +pf_handle_getrules(struct nlmsghdr *hdr, struct nl_pstate *npt) +{ + struct pfioc_rule attrs = {}; + int error; + struct nl_writer *nw = npt->nw; + struct genlmsghdr *ghdr_new; + + error = nl_parse_nlmsg(hdr, &getrules_parser, npt, &attrs); + if (error != 0) + return (error); + + if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) + return (ENOMEM); + + ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); + ghdr_new->cmd = PFNL_CMD_GETRULES; + ghdr_new->version = 0; + ghdr_new->reserved = 0; + + error = pf_ioctl_getrules(&attrs); + if (error != 0) + goto out; + + nlattr_add_u32(nw, PF_GR_NR, attrs.nr); + nlattr_add_u32(nw, PF_GR_TICKET, attrs.ticket); + + if (!nlmsg_end(nw)) { + error = ENOMEM; + goto out; + } + + return (0); + +out: + nlmsg_abort(nw); + return (error); +} + +static const struct nlhdr_parser *all_parsers[] = { + &state_parser, + &addrule_parser, + &getrules_parser +}; static int family_id; @@ -670,7 +727,12 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_addrule, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, }, - + { + .cmd_num = PFNL_CMD_GETRULES, + .cmd_name = "GETRULES", + .cmd_cb = pf_handle_getrules, + .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, + }, }; void diff --git a/sys/netpfil/pf/pf_nl.h b/sys/netpfil/pf/pf_nl.h index 8265ae1d1bfa..3ae77ffd3790 100644 --- a/sys/netpfil/pf/pf_nl.h +++ b/sys/netpfil/pf/pf_nl.h @@ -41,6 +41,7 @@ enum { PFNL_CMD_START = 3, PFNL_CMD_STOP = 4, PFNL_CMD_ADDRULE = 5, + PFNL_CMD_GETRULES = 6, __PFNL_CMD_MAX, }; #define PFNL_CMD_MAX (__PFNL_CMD_MAX -1) @@ -232,6 +233,14 @@ enum pf_addrule_type_t { PF_ART_RULE = 5, /* nested, pfrule_type_t */ }; +enum pf_getrules_type_t { + PF_GR_UNSPEC, + PF_GR_ANCHOR = 1, /* string */ + PF_GR_ACTION = 2, /* u8 */ + PF_GR_NR = 3, /* u32 */ + PF_GR_TICKET = 4, /* u32 */ +}; + #ifdef _KERNEL void pf_nl_register(void);
