hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2024-11-25 01:55:19 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

pf: convert DIOCGETRULESET to netlink

Browse Source 
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D46938
This commit is contained in:
Kristof Provost 2024-10-03 14:07:40 +02:00
parent 739731b8ca
commit 48f5bf8be6
7 changed files with 130 additions and 42 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
lib/libpfctl/libpfctl.c
View File

@ -2920,6 +2920,7 @@ pfctl_get_addr(struct pfctl_handle *h, uint32_t ticket, uint32_t r_num,
#define _OUT(_field) offsetof(struct pfioc_ruleset, _field)
static const struct snl_attr_parser ap_ruleset[] = {
{ .type = PF_RS_NR, .off = _OUT(nr), .cb = snl_attr_get_uint32 },
{ .type = PF_RS_NAME, .off = _OUT(name), .arg = (void *)PF_ANCHOR_NAME_SIZE, .cb = snl_attr_copy_string },
};
static struct snl_field_parser fp_ruleset[] = {};
SNL_DECLARE_PARSER(ruleset_parser, struct genlmsghdr, fp_ruleset, ap_ruleset);
@ -2962,3 +2963,38 @@ pfctl_get_rulesets(struct pfctl_handle *h, const char *path, uint32_t *nr)
return (e.error);
}
int
pfctl_get_ruleset(struct pfctl_handle *h, const char *path, uint32_t nr, struct pfioc_ruleset *rs)
{
struct snl_writer nw;
struct snl_errmsg_data e = {};
struct nlmsghdr *hdr;
uint32_t seq_id;
int family_id;
family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME);
if (family_id == 0)
return (ENOTSUP);
snl_init_writer(&h->ss, &nw);
hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_GET_RULESET);
snl_add_msg_attr_string(&nw, PF_RS_PATH, path);
snl_add_msg_attr_u32(&nw, PF_RS_NR, nr);
if ((hdr = snl_finalize_msg(&nw)) == NULL)
return (ENXIO);
seq_id = hdr->nlmsg_seq;
if (! snl_send_message(&h->ss, hdr))
return (ENXIO);
while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) {
if (! snl_parse_nlmsg(&h->ss, hdr, &ruleset_parser, rs))
continue;
}
return (e.error);
}

1
lib/libpfctl/libpfctl.h
View File

@ -505,5 +505,6 @@ int pfctl_get_addrs(struct pfctl_handle *h, uint32_t ticket, uint32_t r_num,
int pfctl_get_addr(struct pfctl_handle *h, uint32_t ticket, uint32_t r_num,
uint8_t r_action, const char *anchor, uint32_t nr, struct pfioc_pooladdr *pa);
int pfctl_get_rulesets(struct pfctl_handle *h, const char *path, uint32_t *nr);
int pfctl_get_ruleset(struct pfctl_handle *h, const char *path, uint32_t nr, struct pfioc_ruleset *rs);
#endif

18
sbin/pfctl/pfctl.c
View File

@ -1252,7 +1252,6 @@ pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format,
u_int32_t mnr, nr;
memset(&prs, 0, sizeof(prs));
memcpy(prs.path, npath, sizeof(prs.path));
if ((ret = pfctl_get_rulesets(pfh, npath, &mnr)) != 0) {
if (ret == EINVAL)
fprintf(stderr, "Anchor '%s' "
@ -1263,9 +1262,8 @@ pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format,
pfctl_print_rule_counters(&rule, opts);
for (nr = 0; nr < mnr; ++nr) {
prs.nr = nr;
if (ioctl(dev, DIOCGETRULESET, &prs))
err(1, "DIOCGETRULESET");
if ((ret = pfctl_get_ruleset(pfh, npath, nr, &prs)) != 0)
errc(1, ret, "DIOCGETRULESET");
INDENT(depth, !(opts & PF_OPT_VERBOSE));
printf("anchor \"%s\" all {\n", prs.name);
pfctl_show_rules(dev, npath, opts,
@ -1455,7 +1453,6 @@ pfctl_show_nat(int dev, char *path, int opts, char *anchorname, int depth,
struct pfioc_ruleset prs;
u_int32_t mnr, nr;
memset(&prs, 0, sizeof(prs));
memcpy(prs.path, npath, sizeof(prs.path));
if ((ret = pfctl_get_rulesets(pfh, npath, &mnr)) != 0) {
if (ret == EINVAL)
fprintf(stderr, "NAT anchor '%s' "
@ -1466,9 +1463,8 @@ pfctl_show_nat(int dev, char *path, int opts, char *anchorname, int depth,
pfctl_print_rule_counters(&rule, opts);
for (nr = 0; nr < mnr; ++nr) {
prs.nr = nr;
if (ioctl(dev, DIOCGETRULESET, &prs))
err(1, "DIOCGETRULESET");
if ((ret = pfctl_get_ruleset(pfh, npath, nr, &prs)) != 0)
errc(1, ret, "DIOCGETRULESET");
INDENT(depth, !(opts & PF_OPT_VERBOSE));
printf("nat-anchor \"%s\" all {\n", prs.name);
pfctl_show_nat(dev, npath, opts,
@ -2816,7 +2812,6 @@ pfctl_show_anchors(int dev, int opts, char *anchorname)
int ret;
memset(&pr, 0, sizeof(pr));
memcpy(pr.path, anchorname, sizeof(pr.path));
if ((ret = pfctl_get_rulesets(pfh, anchorname, &mnr)) != 0) {
if (ret == EINVAL)
fprintf(stderr, "Anchor '%s' not found.\n",
@ -2828,9 +2823,8 @@ pfctl_show_anchors(int dev, int opts, char *anchorname)
for (nr = 0; nr < mnr; ++nr) {
char sub[MAXPATHLEN];
pr.nr = nr;
if (ioctl(dev, DIOCGETRULESET, &pr))
err(1, "DIOCGETRULESET");
if ((ret = pfctl_get_ruleset(pfh, anchorname, nr, &pr)) != 0)
errc(1, ret, "DIOCGETRULESET");
if (!strcmp(pr.name, PF_RESERVED_ANCHOR))
continue;
sub[0] = 0;

1
sys/net/pfvar.h
View File

@ -2581,6 +2581,7 @@ int pf_ioctl_add_addr(struct pfioc_pooladdr *);
int pf_ioctl_get_addrs(struct pfioc_pooladdr *);
int pf_ioctl_get_addr(struct pfioc_pooladdr *);
int pf_ioctl_get_rulesets(struct pfioc_ruleset *);
int pf_ioctl_get_ruleset(struct pfioc_ruleset *);
void pf_krule_free(struct pf_krule *);
void pf_krule_clear_counters(struct pf_krule *);

72
sys/netpfil/pf/pf_ioctl.c
View File

@ -2696,6 +2696,47 @@ pf_ioctl_get_rulesets(struct pfioc_ruleset *pr)
return (0);
}
int
pf_ioctl_get_ruleset(struct pfioc_ruleset *pr)
{
struct pf_kruleset *ruleset;
struct pf_kanchor *anchor;
u_int32_t nr = 0;
int error = 0;
PF_RULES_RLOCK_TRACKER;
PF_RULES_RLOCK();
if ((ruleset = pf_find_kruleset(pr->path)) == NULL) {
PF_RULES_RUNLOCK();
return (ENOENT);
}
pr->name[0] = 0;
if (ruleset->anchor == NULL) {
/* XXX kludge for pf_main_ruleset */
RB_FOREACH(anchor, pf_kanchor_global, &V_pf_anchors)
if (anchor->parent == NULL && nr++ == pr->nr) {
strlcpy(pr->name, anchor->name,
sizeof(pr->name));
break;
}
} else {
RB_FOREACH(anchor, pf_kanchor_node,
&ruleset->anchor->children)
if (nr++ == pr->nr) {
strlcpy(pr->name, anchor->name,
sizeof(pr->name));
break;
}
}
if (!pr->name[0])
error = EBUSY;
PF_RULES_RUNLOCK();
return (error);
}
static int
pfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread *td)
{
@ -4514,39 +4555,10 @@ DIOCCHANGEADDR_error:
case DIOCGETRULESET: {
struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr;
struct pf_kruleset *ruleset;
struct pf_kanchor *anchor;
u_int32_t nr = 0;
pr->path[sizeof(pr->path) - 1] = 0;
PF_RULES_RLOCK();
if ((ruleset = pf_find_kruleset(pr->path)) == NULL) {
PF_RULES_RUNLOCK();
error = ENOENT;
break;
}
pr->name[0] = 0;
if (ruleset->anchor == NULL) {
/* XXX kludge for pf_main_ruleset */
RB_FOREACH(anchor, pf_kanchor_global, &V_pf_anchors)
if (anchor->parent == NULL && nr++ == pr->nr) {
strlcpy(pr->name, anchor->name,
sizeof(pr->name));
break;
}
} else {
RB_FOREACH(anchor, pf_kanchor_node,
&ruleset->anchor->children)
if (nr++ == pr->nr) {
strlcpy(pr->name, anchor->name,
sizeof(pr->name));
break;
}
}
if (!pr->name[0])
error = EBUSY;
PF_RULES_RUNLOCK();
error = pf_ioctl_get_ruleset(pr);
break;
}

42
sys/netpfil/pf/pf_nl.c
View File

@ -1638,6 +1638,7 @@ pf_handle_get_addr(struct nlmsghdr *hdr, struct nl_pstate *npt)
#define _OUT(_field) offsetof(struct pfioc_ruleset, _field)
static const struct nlattr_parser nla_p_ruleset[] = {
{ .type = PF_RS_PATH, .off = _OUT(path), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara },
{ .type = PF_RS_NR, .off = _OUT(nr), .cb = nlattr_get_uint32 },
};
static const struct nlfield_parser nlf_p_ruleset[] = {
};
@ -1678,6 +1679,40 @@ pf_handle_get_rulesets(struct nlmsghdr *hdr, struct nl_pstate *npt)
return (0);
}
static int
pf_handle_get_ruleset(struct nlmsghdr *hdr, struct nl_pstate *npt)
{
struct pfioc_ruleset attrs = { 0 };
struct nl_writer *nw = npt->nw;
struct genlmsghdr *ghdr_new;
int error;
error = nl_parse_nlmsg(hdr, &ruleset_parser, npt, &attrs);
if (error)
return (error);
error = pf_ioctl_get_ruleset(&attrs);
if (error != 0)
return (error);
if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
return (ENOMEM);
ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
ghdr_new->cmd = PFNL_CMD_GET_RULESET;
ghdr_new->version = 0;
ghdr_new->reserved = 0;
nlattr_add_string(nw, PF_RS_NAME, attrs.name);
if (!nlmsg_end(nw)) {
nlmsg_abort(nw);
return (ENOMEM);
}
return (0);
}
static const struct nlhdr_parser *all_parsers[] = {
&state_parser,
&addrule_parser,
@ -1857,6 +1892,13 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
},
{
.cmd_num = PFNL_CMD_GET_RULESET,
.cmd_name = "GET_RULESET",
.cmd_cb = pf_handle_get_ruleset,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
},
};
void

2
sys/netpfil/pf/pf_nl.h
View File

@ -59,6 +59,7 @@ enum {
PFNL_CMD_GET_ADDRS = 21,
PFNL_CMD_GET_ADDR = 22,
PFNL_CMD_GET_RULESETS = 23,
PFNL_CMD_GET_RULESET = 24,
__PFNL_CMD_MAX,
};
#define PFNL_CMD_MAX (__PFNL_CMD_MAX -1)
@ -385,6 +386,7 @@ enum pf_get_rulesets_types_t {
PF_RS_UNSPEC,
PF_RS_PATH = 1, /* string */
PF_RS_NR = 2, /* u32 */
PF_RS_NAME = 3, /* string */
};
#ifdef _KERNEL