pfctl: pfctl_get_astats() doesn't set errno

After commit 08f54dfca197 pfctl_get_astats() doesn't set errno anymore,
except in one place. Fix up that one place and adjust callers
appropriately.

Rev

pfctl: pfctl_get_astats() doesn't set errno

After commit 08f54dfca197 pfctl_get_astats() doesn't set errno anymore,
except in one place. Fix up that one place and adjust callers
appropriately.

Reviewed by: kp
Fixes: 08f54dfca197 ("pf: convert DIOCRGETASTATS to netlink")
Differential Revision: https://reviews.freebsd.org/D57608

show more ...

libpfctl: fix memory leak

When we snl_init_writer() we allocate memory in the struct snl_state in the struct pfctl_handle.
This memory was never released again, leading to a memory leak. We still
ha

libpfctl: fix memory leak

When we snl_init_writer() we allocate memory in the struct snl_state in the struct pfctl_handle.
This memory was never released again, leading to a memory leak. We still
had a reference to the memory and would release it on pfctl_close()
(so valgrind did not detect it as a leak), but long-lived users (e.g.
bsnmpd) would eventually run out of memory.

Explicitly reset the snl_state when we're done to prevent this.

MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")

show more ...

libpfctl: retrieve family id only once

Look up the pfctl family id when we open the handle, rather than for
every function call.
This saves us a lot of netlink calls, at the expense of storing one
e

libpfctl: retrieve family id only once

Look up the pfctl family id when we open the handle, rather than for
every function call.
This saves us a lot of netlink calls, at the expense of storing one
extra int in the handle.

Sponsored by: Rubicon Communications, LLC ("Netgate")

show more ...

pfctl: optionally print the rule in the state overview

When dumping states optionally (at '-vv') also show the rule which
created the state. This can be helpful if the ruleset changed and we
want to

pfctl: optionally print the rule in the state overview

When dumping states optionally (at '-vv') also show the rule which
created the state. This can be helpful if the ruleset changed and we
want to know what rule created the state.

Sponsored by: Rubicon Communications, LLC ("Netgate")

show more ...

pfctl: handle errors from PFNL_CMD_GETSTATES

Sponsored by: Rubicon Communications, LLC ("Netgate")