xref: /freebsd/sys/netpfil/pf/pf_nl.c (revision e8ff5e565c24d7e3fdd607e76769b4c879668759)
12cef6288SAlexander V. Chernikov /*-
22cef6288SAlexander V. Chernikov  * SPDX-License-Identifier: BSD-2-Clause
32cef6288SAlexander V. Chernikov  *
42cef6288SAlexander V. Chernikov  * Copyright (c) 2023 Alexander V. Chernikov <melifaro@FreeBSD.org>
52cef6288SAlexander V. Chernikov  * Copyright (c) 2023 Rubicon Communications, LLC (Netgate)
62cef6288SAlexander V. Chernikov  *
72cef6288SAlexander V. Chernikov  * Redistribution and use in source and binary forms, with or without
82cef6288SAlexander V. Chernikov  * modification, are permitted provided that the following conditions
92cef6288SAlexander V. Chernikov  * are met:
102cef6288SAlexander V. Chernikov  * 1. Redistributions of source code must retain the above copyright
112cef6288SAlexander V. Chernikov  *    notice, this list of conditions and the following disclaimer.
122cef6288SAlexander V. Chernikov  * 2. Redistributions in binary form must reproduce the above copyright
132cef6288SAlexander V. Chernikov  *    notice, this list of conditions and the following disclaimer in the
142cef6288SAlexander V. Chernikov  *    documentation and/or other materials provided with the distribution.
152cef6288SAlexander V. Chernikov  *
162cef6288SAlexander V. Chernikov  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
172cef6288SAlexander V. Chernikov  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
182cef6288SAlexander V. Chernikov  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
192cef6288SAlexander V. Chernikov  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
202cef6288SAlexander V. Chernikov  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
212cef6288SAlexander V. Chernikov  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
222cef6288SAlexander V. Chernikov  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
232cef6288SAlexander V. Chernikov  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
242cef6288SAlexander V. Chernikov  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
252cef6288SAlexander V. Chernikov  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
262cef6288SAlexander V. Chernikov  * SUCH DAMAGE.
272cef6288SAlexander V. Chernikov  *
282cef6288SAlexander V. Chernikov  */
2971d3c704SKristof Provost #include <sys/cdefs.h>
3071d3c704SKristof Provost #include "opt_inet.h"
3171d3c704SKristof Provost #include "opt_inet6.h"
322cef6288SAlexander V. Chernikov 
332cef6288SAlexander V. Chernikov #include <sys/param.h>
342cef6288SAlexander V. Chernikov #include <sys/malloc.h>
352cef6288SAlexander V. Chernikov #include <sys/mbuf.h>
36e774c1efSKristof Provost #include <sys/priv.h>
372cef6288SAlexander V. Chernikov #include <sys/socket.h>
387b2ab18fSKonstantin Belousov #include <sys/ucred.h>
392cef6288SAlexander V. Chernikov 
402cef6288SAlexander V. Chernikov #include <net/pfvar.h>
412cef6288SAlexander V. Chernikov 
422cef6288SAlexander V. Chernikov #include <netlink/netlink.h>
432cef6288SAlexander V. Chernikov #include <netlink/netlink_ctl.h>
442cef6288SAlexander V. Chernikov #include <netlink/netlink_generic.h>
452cef6288SAlexander V. Chernikov #include <netlink/netlink_message_writer.h>
462cef6288SAlexander V. Chernikov 
472cef6288SAlexander V. Chernikov #include <netpfil/pf/pf_nl.h>
482cef6288SAlexander V. Chernikov 
492cef6288SAlexander V. Chernikov #define	DEBUG_MOD_NAME	nl_pf
502cef6288SAlexander V. Chernikov #define	DEBUG_MAX_LEVEL	LOG_DEBUG3
512cef6288SAlexander V. Chernikov #include <netlink/netlink_debug.h>
522cef6288SAlexander V. Chernikov _DECLARE_DEBUG(LOG_DEBUG);
532cef6288SAlexander V. Chernikov 
542cef6288SAlexander V. Chernikov struct nl_parsed_state {
552cef6288SAlexander V. Chernikov 	uint8_t		version;
562cef6288SAlexander V. Chernikov 	uint32_t	id;
572cef6288SAlexander V. Chernikov 	uint32_t	creatorid;
58044eef6aSKristof Provost 	char		ifname[IFNAMSIZ];
59044eef6aSKristof Provost 	uint16_t	proto;
60044eef6aSKristof Provost 	sa_family_t	af;
61044eef6aSKristof Provost 	struct pf_addr	addr;
62044eef6aSKristof Provost 	struct pf_addr	mask;
632cef6288SAlexander V. Chernikov };
642cef6288SAlexander V. Chernikov 
652cef6288SAlexander V. Chernikov #define	_IN(_field)	offsetof(struct genlmsghdr, _field)
662cef6288SAlexander V. Chernikov #define	_OUT(_field)	offsetof(struct nl_parsed_state, _field)
672cef6288SAlexander V. Chernikov static const struct nlattr_parser nla_p_state[] = {
682cef6288SAlexander V. Chernikov 	{ .type = PF_ST_ID, .off = _OUT(id), .cb = nlattr_get_uint32 },
692cef6288SAlexander V. Chernikov 	{ .type = PF_ST_CREATORID, .off = _OUT(creatorid), .cb = nlattr_get_uint32 },
70044eef6aSKristof Provost 	{ .type = PF_ST_IFNAME, .arg = (const void *)IFNAMSIZ, .off = _OUT(ifname), .cb = nlattr_get_chara },
71*e8ff5e56SKristof Provost 	{ .type = PF_ST_AF, .off = _OUT(af), .cb = nlattr_get_uint8 },
72044eef6aSKristof Provost 	{ .type = PF_ST_PROTO, .off = _OUT(proto), .cb = nlattr_get_uint16 },
73044eef6aSKristof Provost 	{ .type = PF_ST_FILTER_ADDR, .off = _OUT(addr), .cb = nlattr_get_in6_addr },
74044eef6aSKristof Provost 	{ .type = PF_ST_FILTER_MASK, .off = _OUT(mask), .cb = nlattr_get_in6_addr },
752cef6288SAlexander V. Chernikov };
762cef6288SAlexander V. Chernikov static const struct nlfield_parser nlf_p_generic[] = {
772cef6288SAlexander V. Chernikov 	{ .off_in = _IN(version), .off_out = _OUT(version), .cb = nlf_get_u8 },
782cef6288SAlexander V. Chernikov };
792cef6288SAlexander V. Chernikov #undef _IN
802cef6288SAlexander V. Chernikov #undef _OUT
812cef6288SAlexander V. Chernikov NL_DECLARE_PARSER(state_parser, struct genlmsghdr, nlf_p_generic, nla_p_state);
822cef6288SAlexander V. Chernikov 
832cef6288SAlexander V. Chernikov static void
842cef6288SAlexander V. Chernikov dump_addr(struct nl_writer *nw, int attr, const struct pf_addr *addr, int af)
852cef6288SAlexander V. Chernikov {
862cef6288SAlexander V. Chernikov 	switch (af) {
872cef6288SAlexander V. Chernikov 	case AF_INET:
882cef6288SAlexander V. Chernikov 		nlattr_add(nw, attr, 4, &addr->v4);
892cef6288SAlexander V. Chernikov 		break;
902cef6288SAlexander V. Chernikov 	case AF_INET6:
912cef6288SAlexander V. Chernikov 		nlattr_add(nw, attr, 16, &addr->v6);
922cef6288SAlexander V. Chernikov 		break;
932cef6288SAlexander V. Chernikov 	};
942cef6288SAlexander V. Chernikov }
952cef6288SAlexander V. Chernikov 
962cef6288SAlexander V. Chernikov static bool
972cef6288SAlexander V. Chernikov dump_state_peer(struct nl_writer *nw, int attr, const struct pf_state_peer *peer)
982cef6288SAlexander V. Chernikov {
992cef6288SAlexander V. Chernikov 	int off = nlattr_add_nested(nw, attr);
1002cef6288SAlexander V. Chernikov 	if (off == 0)
1012cef6288SAlexander V. Chernikov 		return (false);
1022cef6288SAlexander V. Chernikov 
1032cef6288SAlexander V. Chernikov 	nlattr_add_u32(nw, PF_STP_SEQLO, peer->seqlo);
1042cef6288SAlexander V. Chernikov 	nlattr_add_u32(nw, PF_STP_SEQHI, peer->seqhi);
1052cef6288SAlexander V. Chernikov 	nlattr_add_u32(nw, PF_STP_SEQDIFF, peer->seqdiff);
1062cef6288SAlexander V. Chernikov 	nlattr_add_u16(nw, PF_STP_MAX_WIN, peer->max_win);
1072cef6288SAlexander V. Chernikov 	nlattr_add_u16(nw, PF_STP_MSS, peer->mss);
1082cef6288SAlexander V. Chernikov 	nlattr_add_u8(nw, PF_STP_STATE, peer->state);
1092cef6288SAlexander V. Chernikov 	nlattr_add_u8(nw, PF_STP_WSCALE, peer->wscale);
1102cef6288SAlexander V. Chernikov 
1112cef6288SAlexander V. Chernikov 	if (peer->scrub != NULL) {
1122cef6288SAlexander V. Chernikov 		struct pf_state_scrub *sc = peer->scrub;
1132cef6288SAlexander V. Chernikov 		uint16_t pfss_flags = sc->pfss_flags & PFSS_TIMESTAMP;
1142cef6288SAlexander V. Chernikov 
1152cef6288SAlexander V. Chernikov 		nlattr_add_u16(nw, PF_STP_PFSS_FLAGS, pfss_flags);
1162cef6288SAlexander V. Chernikov 		nlattr_add_u32(nw, PF_STP_PFSS_TS_MOD, sc->pfss_ts_mod);
1172cef6288SAlexander V. Chernikov 		nlattr_add_u8(nw, PF_STP_PFSS_TTL, sc->pfss_ttl);
1182cef6288SAlexander V. Chernikov 		nlattr_add_u8(nw, PF_STP_SCRUB_FLAG, PFSYNC_SCRUB_FLAG_VALID);
1192cef6288SAlexander V. Chernikov 	}
1202cef6288SAlexander V. Chernikov 	nlattr_set_len(nw, off);
1212cef6288SAlexander V. Chernikov 
1222cef6288SAlexander V. Chernikov 	return (true);
1232cef6288SAlexander V. Chernikov }
1242cef6288SAlexander V. Chernikov 
1252cef6288SAlexander V. Chernikov static bool
1262cef6288SAlexander V. Chernikov dump_state_key(struct nl_writer *nw, int attr, const struct pf_state_key *key)
1272cef6288SAlexander V. Chernikov {
1282cef6288SAlexander V. Chernikov 	int off = nlattr_add_nested(nw, attr);
1292cef6288SAlexander V. Chernikov 	if (off == 0)
1302cef6288SAlexander V. Chernikov 		return (false);
1312cef6288SAlexander V. Chernikov 
1322cef6288SAlexander V. Chernikov 	dump_addr(nw, PF_STK_ADDR0, &key->addr[0], key->af);
1332cef6288SAlexander V. Chernikov 	dump_addr(nw, PF_STK_ADDR1, &key->addr[1], key->af);
1342cef6288SAlexander V. Chernikov 	nlattr_add_u16(nw, PF_STK_PORT0, key->port[0]);
1352cef6288SAlexander V. Chernikov 	nlattr_add_u16(nw, PF_STK_PORT1, key->port[1]);
1362cef6288SAlexander V. Chernikov 
1372cef6288SAlexander V. Chernikov 	nlattr_set_len(nw, off);
1382cef6288SAlexander V. Chernikov 
1392cef6288SAlexander V. Chernikov 	return (true);
1402cef6288SAlexander V. Chernikov }
1412cef6288SAlexander V. Chernikov 
1422cef6288SAlexander V. Chernikov static int
1432cef6288SAlexander V. Chernikov dump_state(struct nlpcb *nlp, const struct nlmsghdr *hdr, struct pf_kstate *s,
1442cef6288SAlexander V. Chernikov     struct nl_pstate *npt)
1452cef6288SAlexander V. Chernikov {
1462cef6288SAlexander V. Chernikov 	struct nl_writer *nw = npt->nw;
1472cef6288SAlexander V. Chernikov 	int error = 0;
1482cef6288SAlexander V. Chernikov 	int af;
1492cef6288SAlexander V. Chernikov 	struct pf_state_key *key;
1502cef6288SAlexander V. Chernikov 
151b1e0f0ffSKristof Provost 	PF_STATE_LOCK_ASSERT(s);
152b1e0f0ffSKristof Provost 
1532cef6288SAlexander V. Chernikov 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1542cef6288SAlexander V. Chernikov 		goto enomem;
1552cef6288SAlexander V. Chernikov 
1562cef6288SAlexander V. Chernikov 	struct genlmsghdr *ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1572cef6288SAlexander V. Chernikov 	ghdr_new->cmd = PFNL_CMD_GETSTATES;
1582cef6288SAlexander V. Chernikov 	ghdr_new->version = 0;
1592cef6288SAlexander V. Chernikov 	ghdr_new->reserved = 0;
1602cef6288SAlexander V. Chernikov 
1612cef6288SAlexander V. Chernikov 	nlattr_add_u64(nw, PF_ST_VERSION, PF_STATE_VERSION);
1622cef6288SAlexander V. Chernikov 
1632cef6288SAlexander V. Chernikov 	key = s->key[PF_SK_WIRE];
1642cef6288SAlexander V. Chernikov 	if (!dump_state_key(nw, PF_ST_KEY_WIRE, key))
1652cef6288SAlexander V. Chernikov 		goto enomem;
1662cef6288SAlexander V. Chernikov 	key = s->key[PF_SK_STACK];
1672cef6288SAlexander V. Chernikov 	if (!dump_state_key(nw, PF_ST_KEY_STACK, key))
1682cef6288SAlexander V. Chernikov 		goto enomem;
1692cef6288SAlexander V. Chernikov 
1702cef6288SAlexander V. Chernikov 	af = s->key[PF_SK_WIRE]->af;
1712cef6288SAlexander V. Chernikov 	nlattr_add_u8(nw, PF_ST_PROTO, s->key[PF_SK_WIRE]->proto);
1722cef6288SAlexander V. Chernikov 	nlattr_add_u8(nw, PF_ST_AF, af);
1732cef6288SAlexander V. Chernikov 
1742cef6288SAlexander V. Chernikov 	nlattr_add_string(nw, PF_ST_IFNAME, s->kif->pfik_name);
1752cef6288SAlexander V. Chernikov 	nlattr_add_string(nw, PF_ST_ORIG_IFNAME, s->orig_kif->pfik_name);
1762cef6288SAlexander V. Chernikov 	dump_addr(nw, PF_ST_RT_ADDR, &s->rt_addr, af);
17704932601SKristof Provost 	nlattr_add_u32(nw, PF_ST_CREATION, time_uptime - (s->creation / 1000));
1782cef6288SAlexander V. Chernikov 	uint32_t expire = pf_state_expires(s);
1792cef6288SAlexander V. Chernikov 	if (expire > time_uptime)
1802cef6288SAlexander V. Chernikov 		expire = expire - time_uptime;
1812cef6288SAlexander V. Chernikov 	nlattr_add_u32(nw, PF_ST_EXPIRE, expire);
1822cef6288SAlexander V. Chernikov 	nlattr_add_u8(nw, PF_ST_DIRECTION, s->direction);
1832cef6288SAlexander V. Chernikov 	nlattr_add_u8(nw, PF_ST_LOG, s->act.log);
1842cef6288SAlexander V. Chernikov 	nlattr_add_u8(nw, PF_ST_TIMEOUT, s->timeout);
1852cef6288SAlexander V. Chernikov 	nlattr_add_u16(nw, PF_ST_STATE_FLAGS, s->state_flags);
1862cef6288SAlexander V. Chernikov 	uint8_t sync_flags = 0;
1872cef6288SAlexander V. Chernikov 	if (s->src_node)
1882cef6288SAlexander V. Chernikov 		sync_flags |= PFSYNC_FLAG_SRCNODE;
1892cef6288SAlexander V. Chernikov 	if (s->nat_src_node)
1902cef6288SAlexander V. Chernikov 		sync_flags |= PFSYNC_FLAG_NATSRCNODE;
1912cef6288SAlexander V. Chernikov 	nlattr_add_u8(nw, PF_ST_SYNC_FLAGS, sync_flags);
1922cef6288SAlexander V. Chernikov 	nlattr_add_u64(nw, PF_ST_ID, s->id);
1932cef6288SAlexander V. Chernikov 	nlattr_add_u32(nw, PF_ST_CREATORID, htonl(s->creatorid));
1942cef6288SAlexander V. Chernikov 
1952cef6288SAlexander V. Chernikov 	nlattr_add_u32(nw, PF_ST_RULE, s->rule.ptr ? s->rule.ptr->nr : -1);
1962cef6288SAlexander V. Chernikov 	nlattr_add_u32(nw, PF_ST_ANCHOR, s->anchor.ptr ? s->anchor.ptr->nr : -1);
1972cef6288SAlexander V. Chernikov 	nlattr_add_u32(nw, PF_ST_NAT_RULE, s->nat_rule.ptr ? s->nat_rule.ptr->nr : -1);
1982cef6288SAlexander V. Chernikov 
1992cef6288SAlexander V. Chernikov 	nlattr_add_u64(nw, PF_ST_PACKETS0, s->packets[0]);
2002cef6288SAlexander V. Chernikov 	nlattr_add_u64(nw, PF_ST_PACKETS1, s->packets[1]);
2012cef6288SAlexander V. Chernikov 	nlattr_add_u64(nw, PF_ST_BYTES0, s->bytes[0]);
2022cef6288SAlexander V. Chernikov 	nlattr_add_u64(nw, PF_ST_BYTES1, s->bytes[1]);
203881bf881SKristof Provost 	nlattr_add_u32(nw, PF_ST_RTABLEID, s->act.rtableid);
204881bf881SKristof Provost 	nlattr_add_u8(nw, PF_ST_MIN_TTL, s->act.min_ttl);
205881bf881SKristof Provost 	nlattr_add_u16(nw, PF_ST_MAX_MSS, s->act.max_mss);
206881bf881SKristof Provost 	nlattr_add_u16(nw, PF_ST_DNPIPE, s->act.dnpipe);
207881bf881SKristof Provost 	nlattr_add_u16(nw, PF_ST_DNRPIPE, s->act.dnrpipe);
208881bf881SKristof Provost 	nlattr_add_u8(nw, PF_ST_RT, s->rt);
209881bf881SKristof Provost 	if (s->rt_kif != NULL)
210881bf881SKristof Provost 		nlattr_add_string(nw, PF_ST_RT_IFNAME, s->rt_kif->pfik_name);
2112cef6288SAlexander V. Chernikov 
2122cef6288SAlexander V. Chernikov 	if (!dump_state_peer(nw, PF_ST_PEER_SRC, &s->src))
2132cef6288SAlexander V. Chernikov 		goto enomem;
2142cef6288SAlexander V. Chernikov 	if (!dump_state_peer(nw, PF_ST_PEER_DST, &s->dst))
2152cef6288SAlexander V. Chernikov 		goto enomem;
2162cef6288SAlexander V. Chernikov 
2172cef6288SAlexander V. Chernikov 	if (nlmsg_end(nw))
2182cef6288SAlexander V. Chernikov 		return (0);
2192cef6288SAlexander V. Chernikov 
2202cef6288SAlexander V. Chernikov enomem:
2212cef6288SAlexander V. Chernikov 	error = ENOMEM;
2222cef6288SAlexander V. Chernikov 	nlmsg_abort(nw);
2232cef6288SAlexander V. Chernikov 	return (error);
2242cef6288SAlexander V. Chernikov }
2252cef6288SAlexander V. Chernikov 
2262cef6288SAlexander V. Chernikov static int
2272cef6288SAlexander V. Chernikov handle_dumpstates(struct nlpcb *nlp, struct nl_parsed_state *attrs,
2282cef6288SAlexander V. Chernikov     struct nlmsghdr *hdr, struct nl_pstate *npt)
2292cef6288SAlexander V. Chernikov {
2302cef6288SAlexander V. Chernikov 	int error = 0;
2312cef6288SAlexander V. Chernikov 
2322cef6288SAlexander V. Chernikov 	hdr->nlmsg_flags |= NLM_F_MULTI;
2332cef6288SAlexander V. Chernikov 
234271f1469SKristof Provost 	for (int i = 0; i <= V_pf_hashmask; i++) {
2352cef6288SAlexander V. Chernikov 		struct pf_idhash *ih = &V_pf_idhash[i];
2362cef6288SAlexander V. Chernikov 		struct pf_kstate *s;
2372cef6288SAlexander V. Chernikov 
2382cef6288SAlexander V. Chernikov 		if (LIST_EMPTY(&ih->states))
2392cef6288SAlexander V. Chernikov 			continue;
2402cef6288SAlexander V. Chernikov 
2412cef6288SAlexander V. Chernikov 		PF_HASHROW_LOCK(ih);
2422cef6288SAlexander V. Chernikov 		LIST_FOREACH(s, &ih->states, entry) {
243044eef6aSKristof Provost 			sa_family_t af = s->key[PF_SK_WIRE]->af;
244044eef6aSKristof Provost 
245044eef6aSKristof Provost 			if (s->timeout == PFTM_UNLINKED)
246044eef6aSKristof Provost 				continue;
247044eef6aSKristof Provost 
248044eef6aSKristof Provost 			/* Filter */
249044eef6aSKristof Provost 			if (attrs->creatorid != 0 && s->creatorid != attrs->creatorid)
250044eef6aSKristof Provost 				continue;
251044eef6aSKristof Provost 			if (attrs->ifname[0] != 0 &&
252044eef6aSKristof Provost 			    strncmp(attrs->ifname, s->kif->pfik_name, IFNAMSIZ) != 0)
253044eef6aSKristof Provost 				continue;
254044eef6aSKristof Provost 			if (attrs->proto != 0 && s->key[PF_SK_WIRE]->proto != attrs->proto)
255044eef6aSKristof Provost 				continue;
256044eef6aSKristof Provost 			if (attrs->af != 0 && af != attrs->af)
257044eef6aSKristof Provost 				continue;
258044eef6aSKristof Provost 			if (pf_match_addr(1, &s->key[PF_SK_WIRE]->addr[0],
259044eef6aSKristof Provost 			    &attrs->mask, &attrs->addr, af) &&
260044eef6aSKristof Provost 			    pf_match_addr(1, &s->key[PF_SK_WIRE]->addr[1],
261044eef6aSKristof Provost 			    &attrs->mask, &attrs->addr, af) &&
262044eef6aSKristof Provost 			    pf_match_addr(1, &s->key[PF_SK_STACK]->addr[0],
263044eef6aSKristof Provost 			    &attrs->mask, &attrs->addr, af) &&
264044eef6aSKristof Provost 			    pf_match_addr(1, &s->key[PF_SK_STACK]->addr[1],
265044eef6aSKristof Provost 			    &attrs->mask, &attrs->addr, af))
266044eef6aSKristof Provost 				continue;
267044eef6aSKristof Provost 
2682cef6288SAlexander V. Chernikov 			error = dump_state(nlp, hdr, s, npt);
2692cef6288SAlexander V. Chernikov 			if (error != 0)
2702cef6288SAlexander V. Chernikov 				break;
2712cef6288SAlexander V. Chernikov 		}
2722cef6288SAlexander V. Chernikov 		PF_HASHROW_UNLOCK(ih);
2732cef6288SAlexander V. Chernikov 	}
2742cef6288SAlexander V. Chernikov 
2752cef6288SAlexander V. Chernikov 	if (!nlmsg_end_dump(npt->nw, error, hdr)) {
2762cef6288SAlexander V. Chernikov 		NL_LOG(LOG_DEBUG, "Unable to finalize the dump");
2772cef6288SAlexander V. Chernikov 		return (ENOMEM);
2782cef6288SAlexander V. Chernikov 	}
2792cef6288SAlexander V. Chernikov 
2802cef6288SAlexander V. Chernikov 	return (error);
2812cef6288SAlexander V. Chernikov }
2822cef6288SAlexander V. Chernikov 
2832cef6288SAlexander V. Chernikov static int
2842cef6288SAlexander V. Chernikov handle_getstate(struct nlpcb *nlp, struct nl_parsed_state *attrs,
2852cef6288SAlexander V. Chernikov     struct nlmsghdr *hdr, struct nl_pstate *npt)
2862cef6288SAlexander V. Chernikov {
287b1e0f0ffSKristof Provost 	struct pf_kstate *s;
288b1e0f0ffSKristof Provost 	int ret;
289b1e0f0ffSKristof Provost 
290b1e0f0ffSKristof Provost 	s = pf_find_state_byid(attrs->id, attrs->creatorid);
2912cef6288SAlexander V. Chernikov 	if (s == NULL)
2922cef6288SAlexander V. Chernikov 		return (ENOENT);
293b1e0f0ffSKristof Provost 	ret = dump_state(nlp, hdr, s, npt);
294b1e0f0ffSKristof Provost 	PF_STATE_UNLOCK(s);
295b1e0f0ffSKristof Provost 
296b1e0f0ffSKristof Provost 	return (ret);
2972cef6288SAlexander V. Chernikov }
2982cef6288SAlexander V. Chernikov 
2992cef6288SAlexander V. Chernikov static int
300a7191e5dSKristof Provost dump_creatorid(struct nlpcb *nlp, const struct nlmsghdr *hdr, uint32_t creator,
301a7191e5dSKristof Provost     struct nl_pstate *npt)
302a7191e5dSKristof Provost {
303a7191e5dSKristof Provost 	struct nl_writer *nw = npt->nw;
304a7191e5dSKristof Provost 
305a7191e5dSKristof Provost 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
306a7191e5dSKristof Provost 		goto enomem;
307a7191e5dSKristof Provost 
308a7191e5dSKristof Provost 	struct genlmsghdr *ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
309a7191e5dSKristof Provost 	ghdr_new->cmd = PFNL_CMD_GETCREATORS;
310a7191e5dSKristof Provost 	ghdr_new->version = 0;
311a7191e5dSKristof Provost 	ghdr_new->reserved = 0;
312a7191e5dSKristof Provost 
313a7191e5dSKristof Provost 	nlattr_add_u32(nw, PF_ST_CREATORID, htonl(creator));
314a7191e5dSKristof Provost 
315a7191e5dSKristof Provost 	if (nlmsg_end(nw))
316a7191e5dSKristof Provost 		return (0);
317a7191e5dSKristof Provost 
318a7191e5dSKristof Provost enomem:
319a7191e5dSKristof Provost 	nlmsg_abort(nw);
320a7191e5dSKristof Provost 	return (ENOMEM);
321a7191e5dSKristof Provost }
322a7191e5dSKristof Provost 
323a7191e5dSKristof Provost static int
3242cef6288SAlexander V. Chernikov pf_handle_getstates(struct nlmsghdr *hdr, struct nl_pstate *npt)
3252cef6288SAlexander V. Chernikov {
3262cef6288SAlexander V. Chernikov 	int error;
3272cef6288SAlexander V. Chernikov 
3282cef6288SAlexander V. Chernikov 	struct nl_parsed_state attrs = {};
3292cef6288SAlexander V. Chernikov 	error = nl_parse_nlmsg(hdr, &state_parser, npt, &attrs);
3302cef6288SAlexander V. Chernikov 	if (error != 0)
3312cef6288SAlexander V. Chernikov 		return (error);
3322cef6288SAlexander V. Chernikov 
3332cef6288SAlexander V. Chernikov 	if (attrs.id != 0)
3342cef6288SAlexander V. Chernikov 		error = handle_getstate(npt->nlp, &attrs, hdr, npt);
3352cef6288SAlexander V. Chernikov 	else
3362cef6288SAlexander V. Chernikov 		error = handle_dumpstates(npt->nlp, &attrs, hdr, npt);
3372cef6288SAlexander V. Chernikov 
3382cef6288SAlexander V. Chernikov 	return (error);
3392cef6288SAlexander V. Chernikov }
3402cef6288SAlexander V. Chernikov 
341a7191e5dSKristof Provost static int
342a7191e5dSKristof Provost pf_handle_getcreators(struct nlmsghdr *hdr, struct nl_pstate *npt)
343a7191e5dSKristof Provost {
344a7191e5dSKristof Provost 	uint32_t creators[16];
345a7191e5dSKristof Provost 	int error = 0;
346a7191e5dSKristof Provost 
347a7191e5dSKristof Provost 	bzero(creators, sizeof(creators));
348a7191e5dSKristof Provost 
349271f1469SKristof Provost 	for (int i = 0; i < V_pf_hashmask; i++) {
350a7191e5dSKristof Provost 		struct pf_idhash *ih = &V_pf_idhash[i];
351a7191e5dSKristof Provost 		struct pf_kstate *s;
352a7191e5dSKristof Provost 
353a7191e5dSKristof Provost 		if (LIST_EMPTY(&ih->states))
354a7191e5dSKristof Provost 			continue;
355a7191e5dSKristof Provost 
356a7191e5dSKristof Provost 		PF_HASHROW_LOCK(ih);
357a7191e5dSKristof Provost 		LIST_FOREACH(s, &ih->states, entry) {
358a7191e5dSKristof Provost 			int j;
359a7191e5dSKristof Provost 			if (s->timeout == PFTM_UNLINKED)
360a7191e5dSKristof Provost 				continue;
361a7191e5dSKristof Provost 
362a7191e5dSKristof Provost 			for (j = 0; j < nitems(creators); j++) {
363a7191e5dSKristof Provost 				if (creators[j] == s->creatorid)
364a7191e5dSKristof Provost 					break;
365a7191e5dSKristof Provost 				if (creators[j] == 0) {
366a7191e5dSKristof Provost 					creators[j] = s->creatorid;
367a7191e5dSKristof Provost 					break;
368a7191e5dSKristof Provost 				}
369a7191e5dSKristof Provost 			}
370a7191e5dSKristof Provost 			if (j == nitems(creators))
371a7191e5dSKristof Provost 				printf("Warning: too many creators!\n");
372a7191e5dSKristof Provost 		}
373a7191e5dSKristof Provost 		PF_HASHROW_UNLOCK(ih);
374a7191e5dSKristof Provost 	}
375a7191e5dSKristof Provost 
376a7191e5dSKristof Provost 	hdr->nlmsg_flags |= NLM_F_MULTI;
377a7191e5dSKristof Provost 	for (int i = 0; i < nitems(creators); i++) {
378a7191e5dSKristof Provost 		if (creators[i] == 0)
379a7191e5dSKristof Provost 			break;
380a7191e5dSKristof Provost 		error = dump_creatorid(npt->nlp, hdr, creators[i], npt);
381a7191e5dSKristof Provost 	}
382a7191e5dSKristof Provost 
383a7191e5dSKristof Provost 	if (!nlmsg_end_dump(npt->nw, error, hdr)) {
384a7191e5dSKristof Provost 		NL_LOG(LOG_DEBUG, "Unable to finalize the dump");
385a7191e5dSKristof Provost 		return (ENOMEM);
386a7191e5dSKristof Provost 	}
387a7191e5dSKristof Provost 
388a7191e5dSKristof Provost 	return (error);
389a7191e5dSKristof Provost }
390a7191e5dSKristof Provost 
39181647eb6SKristof Provost static int
39281647eb6SKristof Provost pf_handle_start(struct nlmsghdr *hdr __unused, struct nl_pstate *npt __unused)
39381647eb6SKristof Provost {
39481647eb6SKristof Provost 	return (pf_start());
39581647eb6SKristof Provost }
39681647eb6SKristof Provost 
39781647eb6SKristof Provost static int
39881647eb6SKristof Provost pf_handle_stop(struct nlmsghdr *hdr __unused, struct nl_pstate *npt __unused)
39981647eb6SKristof Provost {
40081647eb6SKristof Provost 	return (pf_stop());
40181647eb6SKristof Provost }
40281647eb6SKristof Provost 
403ffbf2595SKristof Provost #define _OUT(_field)	offsetof(struct pf_addr_wrap, _field)
404ffbf2595SKristof Provost static const struct nlattr_parser nla_p_addr_wrap[] = {
405ffbf2595SKristof Provost 	{ .type = PF_AT_ADDR, .off = _OUT(v.a.addr), .cb = nlattr_get_in6_addr },
406ffbf2595SKristof Provost 	{ .type = PF_AT_MASK, .off = _OUT(v.a.mask), .cb = nlattr_get_in6_addr },
407ffbf2595SKristof Provost 	{ .type = PF_AT_IFNAME, .off = _OUT(v.ifname), .arg = (void *)IFNAMSIZ,.cb = nlattr_get_chara },
408ffbf2595SKristof Provost 	{ .type = PF_AT_TABLENAME, .off = _OUT(v.tblname), .arg = (void *)PF_TABLE_NAME_SIZE, .cb = nlattr_get_chara },
409ffbf2595SKristof Provost 	{ .type = PF_AT_TYPE, .off = _OUT(type), .cb = nlattr_get_uint8 },
410ffbf2595SKristof Provost 	{ .type = PF_AT_IFLAGS, .off = _OUT(iflags), .cb = nlattr_get_uint8 },
411ffbf2595SKristof Provost };
412ffbf2595SKristof Provost NL_DECLARE_ATTR_PARSER(addr_wrap_parser, nla_p_addr_wrap);
413ffbf2595SKristof Provost #undef _OUT
414ffbf2595SKristof Provost 
415777a4702SKristof Provost static bool
416777a4702SKristof Provost nlattr_add_addr_wrap(struct nl_writer *nw, int attrtype, struct pf_addr_wrap *a)
417777a4702SKristof Provost {
418777a4702SKristof Provost 	int off = nlattr_add_nested(nw, attrtype);
419777a4702SKristof Provost 
420777a4702SKristof Provost 	nlattr_add_in6_addr(nw, PF_AT_ADDR, &a->v.a.addr.v6);
421777a4702SKristof Provost 	nlattr_add_in6_addr(nw, PF_AT_MASK, &a->v.a.mask.v6);
422777a4702SKristof Provost 	nlattr_add_u8(nw, PF_AT_TYPE, a->type);
423777a4702SKristof Provost 	nlattr_add_u8(nw, PF_AT_IFLAGS, a->iflags);
424777a4702SKristof Provost 
425777a4702SKristof Provost 	if (a->type == PF_ADDR_DYNIFTL) {
426777a4702SKristof Provost 		nlattr_add_string(nw, PF_AT_IFNAME, a->v.ifname);
4271fc0dac5SKajetan Staszkiewicz 		nlattr_add_u32(nw, PF_AT_DYNCNT, a->p.dyncnt);
428777a4702SKristof Provost 	} else if (a->type == PF_ADDR_TABLE) {
429777a4702SKristof Provost 		nlattr_add_string(nw, PF_AT_TABLENAME, a->v.tblname);
4301fc0dac5SKajetan Staszkiewicz 		nlattr_add_u32(nw, PF_AT_TBLCNT, a->p.tblcnt);
431777a4702SKristof Provost 	}
432777a4702SKristof Provost 
433777a4702SKristof Provost 	nlattr_set_len(nw, off);
434777a4702SKristof Provost 
435777a4702SKristof Provost 	return (true);
436777a4702SKristof Provost }
437777a4702SKristof Provost 
438ffbf2595SKristof Provost #define _OUT(_field)	offsetof(struct pf_rule_addr, _field)
439ffbf2595SKristof Provost static const struct nlattr_parser nla_p_ruleaddr[] = {
440ffbf2595SKristof Provost 	{ .type = PF_RAT_ADDR, .off = _OUT(addr), .arg = &addr_wrap_parser, .cb = nlattr_get_nested },
441ffbf2595SKristof Provost 	{ .type = PF_RAT_SRC_PORT, .off = _OUT(port[0]), .cb = nlattr_get_uint16 },
442ffbf2595SKristof Provost 	{ .type = PF_RAT_DST_PORT, .off = _OUT(port[1]), .cb = nlattr_get_uint16 },
443ffbf2595SKristof Provost 	{ .type = PF_RAT_NEG, .off = _OUT(neg), .cb = nlattr_get_uint8 },
444ffbf2595SKristof Provost 	{ .type = PF_RAT_OP, .off = _OUT(port_op), .cb = nlattr_get_uint8 },
445ffbf2595SKristof Provost };
446ffbf2595SKristof Provost NL_DECLARE_ATTR_PARSER(rule_addr_parser, nla_p_ruleaddr);
447ffbf2595SKristof Provost #undef _OUT
448ffbf2595SKristof Provost 
449777a4702SKristof Provost static bool
450777a4702SKristof Provost nlattr_add_rule_addr(struct nl_writer *nw, int attrtype, struct pf_rule_addr *r)
451777a4702SKristof Provost {
4521fc0dac5SKajetan Staszkiewicz 	struct pf_addr_wrap aw = {0};
453777a4702SKristof Provost 	int off = nlattr_add_nested(nw, attrtype);
454777a4702SKristof Provost 
4551fc0dac5SKajetan Staszkiewicz 	bcopy(&(r->addr), &aw, sizeof(struct pf_addr_wrap));
4561fc0dac5SKajetan Staszkiewicz 	pf_addr_copyout(&aw);
4571fc0dac5SKajetan Staszkiewicz 
4581fc0dac5SKajetan Staszkiewicz 	nlattr_add_addr_wrap(nw, PF_RAT_ADDR, &aw);
459777a4702SKristof Provost 	nlattr_add_u16(nw, PF_RAT_SRC_PORT, r->port[0]);
460777a4702SKristof Provost 	nlattr_add_u16(nw, PF_RAT_DST_PORT, r->port[1]);
461777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RAT_NEG, r->neg);
462777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RAT_OP, r->port_op);
463777a4702SKristof Provost 
464777a4702SKristof Provost 	nlattr_set_len(nw, off);
465777a4702SKristof Provost 
466777a4702SKristof Provost 	return (true);
467777a4702SKristof Provost }
468777a4702SKristof Provost 
469ffbf2595SKristof Provost #define _OUT(_field)	offsetof(struct pf_mape_portset, _field)
470ffbf2595SKristof Provost static const struct nlattr_parser nla_p_mape_portset[] = {
471ffbf2595SKristof Provost 	{ .type = PF_MET_OFFSET, .off = _OUT(offset), .cb = nlattr_get_uint8 },
472ffbf2595SKristof Provost 	{ .type = PF_MET_PSID_LEN, .off = _OUT(psidlen), .cb = nlattr_get_uint8 },
473ffbf2595SKristof Provost 	{. type = PF_MET_PSID, .off = _OUT(psid), .cb = nlattr_get_uint16 },
474ffbf2595SKristof Provost };
475ffbf2595SKristof Provost NL_DECLARE_ATTR_PARSER(mape_portset_parser, nla_p_mape_portset);
476ffbf2595SKristof Provost #undef _OUT
477ffbf2595SKristof Provost 
478777a4702SKristof Provost static bool
479777a4702SKristof Provost nlattr_add_mape_portset(struct nl_writer *nw, int attrtype, const struct pf_mape_portset *m)
480777a4702SKristof Provost {
481777a4702SKristof Provost 	int off = nlattr_add_nested(nw, attrtype);
482777a4702SKristof Provost 
483777a4702SKristof Provost 	nlattr_add_u8(nw, PF_MET_OFFSET, m->offset);
484777a4702SKristof Provost 	nlattr_add_u8(nw, PF_MET_PSID_LEN, m->psidlen);
485777a4702SKristof Provost 	nlattr_add_u16(nw, PF_MET_PSID, m->psid);
486777a4702SKristof Provost 
487777a4702SKristof Provost 	nlattr_set_len(nw, off);
488777a4702SKristof Provost 
489777a4702SKristof Provost 	return (true);
490777a4702SKristof Provost }
491777a4702SKristof Provost 
492ffbf2595SKristof Provost struct nl_parsed_labels
493ffbf2595SKristof Provost {
494ffbf2595SKristof Provost 	char		labels[PF_RULE_MAX_LABEL_COUNT][PF_RULE_LABEL_SIZE];
495ffbf2595SKristof Provost 	uint32_t	i;
496ffbf2595SKristof Provost };
497ffbf2595SKristof Provost 
498ffbf2595SKristof Provost static int
499ffbf2595SKristof Provost nlattr_get_pf_rule_labels(struct nlattr *nla, struct nl_pstate *npt,
500ffbf2595SKristof Provost     const void *arg, void *target)
501ffbf2595SKristof Provost {
502ffbf2595SKristof Provost 	struct nl_parsed_labels *l = (struct nl_parsed_labels *)target;
503ffbf2595SKristof Provost 	int ret;
504ffbf2595SKristof Provost 
505ffbf2595SKristof Provost 	if (l->i >= PF_RULE_MAX_LABEL_COUNT)
506ffbf2595SKristof Provost 		return (E2BIG);
507ffbf2595SKristof Provost 
508ffbf2595SKristof Provost 	ret = nlattr_get_chara(nla, npt, (void *)PF_RULE_LABEL_SIZE,
509ffbf2595SKristof Provost 	    l->labels[l->i]);
510ffbf2595SKristof Provost 	if (ret == 0)
511ffbf2595SKristof Provost 		l->i++;
512ffbf2595SKristof Provost 
513ffbf2595SKristof Provost 	return (ret);
514ffbf2595SKristof Provost }
515ffbf2595SKristof Provost 
516ffbf2595SKristof Provost #define _OUT(_field)	offsetof(struct nl_parsed_labels, _field)
517ffbf2595SKristof Provost static const struct nlattr_parser nla_p_labels[] = {
518ffbf2595SKristof Provost 	{ .type = PF_LT_LABEL, .off = 0, .cb = nlattr_get_pf_rule_labels },
519ffbf2595SKristof Provost };
520ffbf2595SKristof Provost NL_DECLARE_ATTR_PARSER(rule_labels_parser, nla_p_labels);
521ffbf2595SKristof Provost #undef _OUT
522ffbf2595SKristof Provost 
523ffbf2595SKristof Provost static int
524ffbf2595SKristof Provost nlattr_get_nested_pf_rule_labels(struct nlattr *nla, struct nl_pstate *npt, const void *arg, void *target)
525ffbf2595SKristof Provost {
526ffbf2595SKristof Provost 	struct nl_parsed_labels parsed_labels = { };
527ffbf2595SKristof Provost 	int error;
528ffbf2595SKristof Provost 
529ffbf2595SKristof Provost 	/* Assumes target points to the beginning of the structure */
530ffbf2595SKristof Provost 	error = nl_parse_header(NLA_DATA(nla), NLA_DATA_LEN(nla), &rule_labels_parser, npt, &parsed_labels);
531ffbf2595SKristof Provost 	if (error != 0)
532ffbf2595SKristof Provost 		return (error);
533ffbf2595SKristof Provost 
53484ff9e91SKristof Provost 	memcpy(target, parsed_labels.labels, sizeof(parsed_labels.labels));
535ffbf2595SKristof Provost 
536ffbf2595SKristof Provost 	return (0);
537ffbf2595SKristof Provost }
538ffbf2595SKristof Provost 
539777a4702SKristof Provost static bool
540777a4702SKristof Provost nlattr_add_labels(struct nl_writer *nw, int attrtype, const struct pf_krule *r)
541777a4702SKristof Provost {
542777a4702SKristof Provost 	int off = nlattr_add_nested(nw, attrtype);
543777a4702SKristof Provost 	int i = 0;
544777a4702SKristof Provost 
545777a4702SKristof Provost 	while (r->label[i][0] != 0
546777a4702SKristof Provost 	    && i < PF_RULE_MAX_LABEL_COUNT) {
547777a4702SKristof Provost 		nlattr_add_string(nw, PF_LT_LABEL, r->label[i]);
548777a4702SKristof Provost 		i++;
549777a4702SKristof Provost 	}
550777a4702SKristof Provost 
551777a4702SKristof Provost 	nlattr_set_len(nw, off);
552777a4702SKristof Provost 
553777a4702SKristof Provost 	return (true);
554777a4702SKristof Provost }
555777a4702SKristof Provost 
556ffbf2595SKristof Provost #define _OUT(_field)	offsetof(struct pf_kpool, _field)
557ffbf2595SKristof Provost static const struct nlattr_parser nla_p_pool[] = {
558ffbf2595SKristof Provost 	{ .type = PF_PT_KEY, .off = _OUT(key), .arg = (void *)sizeof(struct pf_poolhashkey), .cb = nlattr_get_bytes },
559ffbf2595SKristof Provost 	{ .type = PF_PT_COUNTER, .off = _OUT(counter), .cb = nlattr_get_in6_addr },
560ffbf2595SKristof Provost 	{ .type = PF_PT_TBLIDX, .off = _OUT(tblidx), .cb = nlattr_get_uint32 },
561ffbf2595SKristof Provost 	{ .type = PF_PT_PROXY_SRC_PORT, .off = _OUT(proxy_port[0]), .cb = nlattr_get_uint16 },
562ffbf2595SKristof Provost 	{ .type = PF_PT_PROXY_DST_PORT, .off = _OUT(proxy_port[1]), .cb = nlattr_get_uint16 },
563ffbf2595SKristof Provost 	{ .type = PF_PT_OPTS, .off = _OUT(opts), .cb = nlattr_get_uint8 },
564ffbf2595SKristof Provost 	{ .type = PF_PT_MAPE, .off = _OUT(mape), .arg = &mape_portset_parser, .cb = nlattr_get_nested },
565ffbf2595SKristof Provost };
566ffbf2595SKristof Provost NL_DECLARE_ATTR_PARSER(pool_parser, nla_p_pool);
567ffbf2595SKristof Provost #undef _OUT
568ffbf2595SKristof Provost 
569777a4702SKristof Provost static bool
570777a4702SKristof Provost nlattr_add_pool(struct nl_writer *nw, int attrtype, const struct pf_kpool *pool)
571777a4702SKristof Provost {
572777a4702SKristof Provost 	int off = nlattr_add_nested(nw, attrtype);
573777a4702SKristof Provost 
574777a4702SKristof Provost 	nlattr_add(nw, PF_PT_KEY, sizeof(struct pf_poolhashkey), &pool->key);
575777a4702SKristof Provost 	nlattr_add_in6_addr(nw, PF_PT_COUNTER, (const struct in6_addr *)&pool->counter);
576777a4702SKristof Provost 	nlattr_add_u32(nw, PF_PT_TBLIDX, pool->tblidx);
577777a4702SKristof Provost 	nlattr_add_u16(nw, PF_PT_PROXY_SRC_PORT, pool->proxy_port[0]);
578777a4702SKristof Provost 	nlattr_add_u16(nw, PF_PT_PROXY_DST_PORT, pool->proxy_port[1]);
579777a4702SKristof Provost 	nlattr_add_u8(nw, PF_PT_OPTS, pool->opts);
580777a4702SKristof Provost 	nlattr_add_mape_portset(nw, PF_PT_MAPE, &pool->mape);
581777a4702SKristof Provost 
582777a4702SKristof Provost 	nlattr_set_len(nw, off);
583777a4702SKristof Provost 
584777a4702SKristof Provost 	return (true);
585777a4702SKristof Provost }
586777a4702SKristof Provost 
587ffbf2595SKristof Provost #define _OUT(_field)	offsetof(struct pf_rule_uid, _field)
588ffbf2595SKristof Provost static const struct nlattr_parser nla_p_rule_uid[] = {
589ffbf2595SKristof Provost 	{ .type = PF_RUT_UID_LOW, .off = _OUT(uid[0]), .cb = nlattr_get_uint32 },
590ffbf2595SKristof Provost 	{ .type = PF_RUT_UID_HIGH, .off = _OUT(uid[1]), .cb = nlattr_get_uint32 },
591ffbf2595SKristof Provost 	{ .type = PF_RUT_OP, .off = _OUT(op), .cb = nlattr_get_uint8 },
592ffbf2595SKristof Provost };
593ffbf2595SKristof Provost NL_DECLARE_ATTR_PARSER(rule_uid_parser, nla_p_rule_uid);
594ffbf2595SKristof Provost #undef _OUT
595ffbf2595SKristof Provost 
596777a4702SKristof Provost static bool
597777a4702SKristof Provost nlattr_add_rule_uid(struct nl_writer *nw, int attrtype, const struct pf_rule_uid *u)
598777a4702SKristof Provost {
599777a4702SKristof Provost 	int off = nlattr_add_nested(nw, attrtype);
600777a4702SKristof Provost 
601777a4702SKristof Provost 	nlattr_add_u32(nw, PF_RUT_UID_LOW, u->uid[0]);
602777a4702SKristof Provost 	nlattr_add_u32(nw, PF_RUT_UID_HIGH, u->uid[1]);
603777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RUT_OP, u->op);
604777a4702SKristof Provost 
605777a4702SKristof Provost 	nlattr_set_len(nw, off);
606777a4702SKristof Provost 
607777a4702SKristof Provost 	return (true);
608777a4702SKristof Provost }
609777a4702SKristof Provost 
610ffbf2595SKristof Provost struct nl_parsed_timeouts
611ffbf2595SKristof Provost {
612ffbf2595SKristof Provost 	uint32_t	timeouts[PFTM_MAX];
613ffbf2595SKristof Provost 	uint32_t	i;
614ffbf2595SKristof Provost };
615ffbf2595SKristof Provost 
616ffbf2595SKristof Provost static int
617ffbf2595SKristof Provost nlattr_get_pf_timeout(struct nlattr *nla, struct nl_pstate *npt,
618ffbf2595SKristof Provost     const void *arg, void *target)
619ffbf2595SKristof Provost {
620ffbf2595SKristof Provost 	struct nl_parsed_timeouts *t = (struct nl_parsed_timeouts *)target;
621ffbf2595SKristof Provost 	int ret;
622ffbf2595SKristof Provost 
623ffbf2595SKristof Provost 	if (t->i >= PFTM_MAX)
624ffbf2595SKristof Provost 		return (E2BIG);
625ffbf2595SKristof Provost 
626ffbf2595SKristof Provost 	ret = nlattr_get_uint32(nla, npt, NULL, &t->timeouts[t->i]);
627ffbf2595SKristof Provost 	if (ret == 0)
628ffbf2595SKristof Provost 		t->i++;
629ffbf2595SKristof Provost 
630ffbf2595SKristof Provost 	return (ret);
631ffbf2595SKristof Provost }
632ffbf2595SKristof Provost 
633ffbf2595SKristof Provost #define _OUT(_field)	offsetof(struct nl_parsed_timeout, _field)
634ffbf2595SKristof Provost static const struct nlattr_parser nla_p_timeouts[] = {
635ffbf2595SKristof Provost 	{ .type = PF_TT_TIMEOUT, .off = 0, .cb = nlattr_get_pf_timeout },
636ffbf2595SKristof Provost };
637ffbf2595SKristof Provost NL_DECLARE_ATTR_PARSER(timeout_parser, nla_p_timeouts);
638ffbf2595SKristof Provost #undef _OUT
639ffbf2595SKristof Provost 
640ffbf2595SKristof Provost static int
641ffbf2595SKristof Provost nlattr_get_nested_timeouts(struct nlattr *nla, struct nl_pstate *npt, const void *arg, void *target)
642ffbf2595SKristof Provost {
643ffbf2595SKristof Provost 	struct nl_parsed_timeouts parsed_timeouts = { };
644ffbf2595SKristof Provost 	int error;
645ffbf2595SKristof Provost 
646ffbf2595SKristof Provost 	/* Assumes target points to the beginning of the structure */
647ffbf2595SKristof Provost 	error = nl_parse_header(NLA_DATA(nla), NLA_DATA_LEN(nla), &timeout_parser, npt, &parsed_timeouts);
648ffbf2595SKristof Provost 	if (error != 0)
649ffbf2595SKristof Provost 		return (error);
650ffbf2595SKristof Provost 
651ffbf2595SKristof Provost 	memcpy(target, parsed_timeouts.timeouts, sizeof(parsed_timeouts.timeouts));
652ffbf2595SKristof Provost 
653ffbf2595SKristof Provost 	return (0);
654ffbf2595SKristof Provost }
655ffbf2595SKristof Provost 
656777a4702SKristof Provost static bool
657777a4702SKristof Provost nlattr_add_timeout(struct nl_writer *nw, int attrtype, uint32_t *timeout)
658777a4702SKristof Provost {
659777a4702SKristof Provost 	int off = nlattr_add_nested(nw, attrtype);
660777a4702SKristof Provost 
661777a4702SKristof Provost 	for (int i = 0; i < PFTM_MAX; i++)
662777a4702SKristof Provost 		nlattr_add_u32(nw, PF_RT_TIMEOUT, timeout[i]);
663777a4702SKristof Provost 
664777a4702SKristof Provost 	nlattr_set_len(nw, off);
665777a4702SKristof Provost 
666777a4702SKristof Provost 	return (true);
667777a4702SKristof Provost }
668777a4702SKristof Provost 
669ffbf2595SKristof Provost #define _OUT(_field)	offsetof(struct pf_krule, _field)
670ffbf2595SKristof Provost static const struct nlattr_parser nla_p_rule[] = {
671ffbf2595SKristof Provost 	{ .type = PF_RT_SRC, .off = _OUT(src), .arg = &rule_addr_parser,.cb = nlattr_get_nested },
672ffbf2595SKristof Provost 	{ .type = PF_RT_DST, .off = _OUT(dst), .arg = &rule_addr_parser,.cb = nlattr_get_nested },
673ffbf2595SKristof Provost 	{ .type = PF_RT_RIDENTIFIER, .off = _OUT(ridentifier), .cb = nlattr_get_uint32 },
674ffbf2595SKristof Provost 	{ .type = PF_RT_LABELS, .off = _OUT(label), .arg = &rule_labels_parser,.cb = nlattr_get_nested_pf_rule_labels },
675ffbf2595SKristof Provost 	{ .type = PF_RT_IFNAME, .off = _OUT(ifname), .arg = (void *)IFNAMSIZ, .cb = nlattr_get_chara },
676ffbf2595SKristof Provost 	{ .type = PF_RT_QNAME, .off = _OUT(qname), .arg = (void *)PF_QNAME_SIZE, .cb = nlattr_get_chara },
677ffbf2595SKristof Provost 	{ .type = PF_RT_PQNAME, .off = _OUT(pqname), .arg = (void *)PF_QNAME_SIZE, .cb = nlattr_get_chara },
678ffbf2595SKristof Provost 	{ .type = PF_RT_TAGNAME, .off = _OUT(tagname), .arg = (void *)PF_TAG_NAME_SIZE, .cb = nlattr_get_chara },
679ffbf2595SKristof Provost 	{ .type = PF_RT_MATCH_TAGNAME, .off = _OUT(match_tagname), .arg = (void *)PF_TAG_NAME_SIZE, .cb = nlattr_get_chara },
680ffbf2595SKristof Provost 	{ .type = PF_RT_OVERLOAD_TBLNAME, .off = _OUT(overload_tblname), .arg = (void *)PF_TABLE_NAME_SIZE, .cb = nlattr_get_chara },
681ffbf2595SKristof Provost 	{ .type = PF_RT_RPOOL, .off = _OUT(rpool), .arg = &pool_parser, .cb = nlattr_get_nested },
682ffbf2595SKristof Provost 	{ .type = PF_RT_OS_FINGERPRINT, .off = _OUT(os_fingerprint), .cb = nlattr_get_uint32 },
683ffbf2595SKristof Provost 	{ .type = PF_RT_RTABLEID, .off = _OUT(rtableid), .cb = nlattr_get_uint32 },
684ffbf2595SKristof Provost 	{ .type = PF_RT_TIMEOUT, .off = _OUT(timeout), .arg = &timeout_parser, .cb = nlattr_get_nested_timeouts },
685ffbf2595SKristof Provost 	{ .type = PF_RT_MAX_STATES, .off = _OUT(max_states), .cb = nlattr_get_uint32 },
686ffbf2595SKristof Provost 	{ .type = PF_RT_MAX_SRC_NODES, .off = _OUT(max_src_nodes), .cb = nlattr_get_uint32 },
687ffbf2595SKristof Provost 	{ .type = PF_RT_MAX_SRC_STATES, .off = _OUT(max_src_states), .cb = nlattr_get_uint32 },
688ffbf2595SKristof Provost 	{ .type = PF_RT_MAX_SRC_CONN_RATE_LIMIT, .off = _OUT(max_src_conn_rate.limit), .cb = nlattr_get_uint32 },
689ffbf2595SKristof Provost 	{ .type = PF_RT_MAX_SRC_CONN_RATE_SECS, .off = _OUT(max_src_conn_rate.seconds), .cb = nlattr_get_uint32 },
690ffbf2595SKristof Provost 	{ .type = PF_RT_DNPIPE, .off = _OUT(dnpipe), .cb = nlattr_get_uint16 },
691ffbf2595SKristof Provost 	{ .type = PF_RT_DNRPIPE, .off = _OUT(dnrpipe), .cb = nlattr_get_uint16 },
692ffbf2595SKristof Provost 	{ .type = PF_RT_DNFLAGS, .off = _OUT(free_flags), .cb = nlattr_get_uint32 },
693ffbf2595SKristof Provost 	{ .type = PF_RT_NR, .off = _OUT(nr), .cb = nlattr_get_uint32 },
694ffbf2595SKristof Provost 	{ .type = PF_RT_PROB, .off = _OUT(prob), .cb = nlattr_get_uint32 },
695ffbf2595SKristof Provost 	{ .type = PF_RT_CUID, .off = _OUT(cuid), .cb = nlattr_get_uint32 },
696ffbf2595SKristof Provost 	{. type = PF_RT_CPID, .off = _OUT(cpid), .cb = nlattr_get_uint32 },
697ffbf2595SKristof Provost 	{ .type = PF_RT_RETURN_ICMP, .off = _OUT(return_icmp), .cb = nlattr_get_uint16 },
698ffbf2595SKristof Provost 	{ .type = PF_RT_RETURN_ICMP6, .off = _OUT(return_icmp6), .cb = nlattr_get_uint16 },
699ffbf2595SKristof Provost 	{ .type = PF_RT_MAX_MSS, .off = _OUT(max_mss), .cb = nlattr_get_uint16 },
700ffbf2595SKristof Provost 	{ .type = PF_RT_SCRUB_FLAGS, .off = _OUT(scrub_flags), .cb = nlattr_get_uint16 },
701ffbf2595SKristof Provost 	{ .type = PF_RT_UID, .off = _OUT(uid), .arg = &rule_uid_parser, .cb = nlattr_get_nested },
702ffbf2595SKristof Provost 	{ .type = PF_RT_GID, .off = _OUT(gid), .arg = &rule_uid_parser, .cb = nlattr_get_nested },
703ffbf2595SKristof Provost 	{ .type = PF_RT_RULE_FLAG, .off = _OUT(rule_flag), .cb = nlattr_get_uint32 },
704ffbf2595SKristof Provost 	{ .type = PF_RT_ACTION, .off = _OUT(action), .cb = nlattr_get_uint8 },
705ffbf2595SKristof Provost 	{ .type = PF_RT_DIRECTION, .off = _OUT(direction), .cb = nlattr_get_uint8 },
706ffbf2595SKristof Provost 	{ .type = PF_RT_LOG, .off = _OUT(log), .cb = nlattr_get_uint8 },
707ffbf2595SKristof Provost 	{ .type = PF_RT_LOGIF, .off = _OUT(logif), .cb = nlattr_get_uint8 },
708ffbf2595SKristof Provost 	{ .type = PF_RT_QUICK, .off = _OUT(quick), .cb = nlattr_get_uint8 },
709ffbf2595SKristof Provost 	{ .type = PF_RT_IF_NOT, .off = _OUT(ifnot), .cb = nlattr_get_uint8 },
710ffbf2595SKristof Provost 	{ .type = PF_RT_MATCH_TAG_NOT, .off = _OUT(match_tag_not), .cb = nlattr_get_uint8 },
711ffbf2595SKristof Provost 	{ .type = PF_RT_NATPASS, .off = _OUT(natpass), .cb = nlattr_get_uint8 },
712ffbf2595SKristof Provost 	{ .type = PF_RT_KEEP_STATE, .off = _OUT(keep_state), .cb = nlattr_get_uint8 },
713ffbf2595SKristof Provost 	{ .type = PF_RT_AF, .off = _OUT(af), .cb = nlattr_get_uint8 },
714ffbf2595SKristof Provost 	{ .type = PF_RT_PROTO, .off = _OUT(proto), .cb = nlattr_get_uint8 },
715ffbf2595SKristof Provost 	{ .type = PF_RT_TYPE, .off = _OUT(type), .cb = nlattr_get_uint8 },
716ffbf2595SKristof Provost 	{ .type = PF_RT_CODE, .off = _OUT(code), .cb = nlattr_get_uint8 },
717ffbf2595SKristof Provost 	{ .type = PF_RT_FLAGS, .off = _OUT(flags), .cb = nlattr_get_uint8 },
718ffbf2595SKristof Provost 	{ .type = PF_RT_FLAGSET, .off = _OUT(flagset), .cb = nlattr_get_uint8 },
719ffbf2595SKristof Provost 	{ .type = PF_RT_MIN_TTL, .off = _OUT(min_ttl), .cb = nlattr_get_uint8 },
720ffbf2595SKristof Provost 	{ .type = PF_RT_ALLOW_OPTS, .off = _OUT(allow_opts), .cb = nlattr_get_uint8 },
721ffbf2595SKristof Provost 	{ .type = PF_RT_RT, .off = _OUT(rt), .cb = nlattr_get_uint8 },
722ffbf2595SKristof Provost 	{ .type = PF_RT_RETURN_TTL, .off = _OUT(return_ttl), .cb = nlattr_get_uint8 },
723ffbf2595SKristof Provost 	{ .type = PF_RT_TOS, .off = _OUT(tos), .cb = nlattr_get_uint8 },
724ffbf2595SKristof Provost 	{ .type = PF_RT_SET_TOS, .off = _OUT(set_tos), .cb = nlattr_get_uint8 },
725ffbf2595SKristof Provost 	{ .type = PF_RT_ANCHOR_RELATIVE, .off = _OUT(anchor_relative), .cb = nlattr_get_uint8 },
726ffbf2595SKristof Provost 	{ .type = PF_RT_ANCHOR_WILDCARD, .off = _OUT(anchor_wildcard), .cb = nlattr_get_uint8 },
727ffbf2595SKristof Provost 	{ .type = PF_RT_FLUSH, .off = _OUT(flush), .cb = nlattr_get_uint8 },
728ffbf2595SKristof Provost 	{ .type = PF_RT_PRIO, .off = _OUT(prio), .cb = nlattr_get_uint8 },
729ffbf2595SKristof Provost 	{ .type = PF_RT_SET_PRIO, .off = _OUT(set_prio[0]), .cb = nlattr_get_uint8 },
730ffbf2595SKristof Provost 	{ .type = PF_RT_SET_PRIO_REPLY, .off = _OUT(set_prio[1]), .cb = nlattr_get_uint8 },
731ffbf2595SKristof Provost 	{ .type = PF_RT_DIVERT_ADDRESS, .off = _OUT(divert.addr), .cb = nlattr_get_in6_addr },
732ffbf2595SKristof Provost 	{ .type = PF_RT_DIVERT_PORT, .off = _OUT(divert.port), .cb = nlattr_get_uint16 },
7332339ead6SKristof Provost 	{ .type = PF_RT_RCV_IFNAME, .off = _OUT(rcv_ifname), .arg = (void *)IFNAMSIZ, .cb = nlattr_get_chara },
734ffbf2595SKristof Provost };
735ffbf2595SKristof Provost NL_DECLARE_ATTR_PARSER(rule_parser, nla_p_rule);
736ffbf2595SKristof Provost #undef _OUT
737ffbf2595SKristof Provost struct nl_parsed_addrule {
738ffbf2595SKristof Provost 	struct pf_krule	*rule;
739ffbf2595SKristof Provost 	uint32_t	 ticket;
740ffbf2595SKristof Provost 	uint32_t	 pool_ticket;
741ffbf2595SKristof Provost 	char		*anchor;
742ffbf2595SKristof Provost 	char		*anchor_call;
743ffbf2595SKristof Provost };
744ffbf2595SKristof Provost #define	_IN(_field)	offsetof(struct genlmsghdr, _field)
745ffbf2595SKristof Provost #define	_OUT(_field)	offsetof(struct nl_parsed_addrule, _field)
746ffbf2595SKristof Provost static const struct nlattr_parser nla_p_addrule[] = {
747ffbf2595SKristof Provost 	{ .type = PF_ART_TICKET, .off = _OUT(ticket), .cb = nlattr_get_uint32 },
748ffbf2595SKristof Provost 	{ .type = PF_ART_POOL_TICKET, .off = _OUT(pool_ticket), .cb = nlattr_get_uint32 },
749ffbf2595SKristof Provost 	{ .type = PF_ART_ANCHOR, .off = _OUT(anchor), .cb = nlattr_get_string },
750ffbf2595SKristof Provost 	{ .type = PF_ART_ANCHOR_CALL, .off = _OUT(anchor_call), .cb = nlattr_get_string },
751ffbf2595SKristof Provost 	{ .type = PF_ART_RULE, .off = _OUT(rule), .arg = &rule_parser, .cb = nlattr_get_nested_ptr }
752ffbf2595SKristof Provost };
753ffbf2595SKristof Provost static const struct nlfield_parser nlf_p_addrule[] = {
754ffbf2595SKristof Provost };
755ffbf2595SKristof Provost #undef _IN
756ffbf2595SKristof Provost #undef _OUT
757ffbf2595SKristof Provost NL_DECLARE_PARSER(addrule_parser, struct genlmsghdr, nlf_p_addrule, nla_p_addrule);
758ffbf2595SKristof Provost 
759ffbf2595SKristof Provost static int
760ffbf2595SKristof Provost pf_handle_addrule(struct nlmsghdr *hdr, struct nl_pstate *npt)
761ffbf2595SKristof Provost {
762ffbf2595SKristof Provost 	int error;
763ffbf2595SKristof Provost 	struct nl_parsed_addrule attrs = {};
764ffbf2595SKristof Provost 
765ffbf2595SKristof Provost 	attrs.rule = pf_krule_alloc();
766ffbf2595SKristof Provost 
767ffbf2595SKristof Provost 	error = nl_parse_nlmsg(hdr, &addrule_parser, npt, &attrs);
768e249f5daSKristof Provost 	if (error != 0) {
769e249f5daSKristof Provost 		pf_free_rule(attrs.rule);
770ffbf2595SKristof Provost 		return (error);
771e249f5daSKristof Provost 	}
772ffbf2595SKristof Provost 
773ffbf2595SKristof Provost 	error = pf_ioctl_addrule(attrs.rule, attrs.ticket, attrs.pool_ticket,
774ffbf2595SKristof Provost 	    attrs.anchor, attrs.anchor_call, nlp_get_cred(npt->nlp)->cr_uid,
775ffbf2595SKristof Provost 	    hdr->nlmsg_pid);
776ffbf2595SKristof Provost 
777ffbf2595SKristof Provost 	return (error);
778ffbf2595SKristof Provost }
779ffbf2595SKristof Provost 
78044f323ecSKristof Provost #define	_IN(_field)	offsetof(struct genlmsghdr, _field)
78144f323ecSKristof Provost #define	_OUT(_field)	offsetof(struct pfioc_rule, _field)
78244f323ecSKristof Provost static const struct nlattr_parser nla_p_getrules[] = {
78344f323ecSKristof Provost 	{ .type = PF_GR_ANCHOR, .off = _OUT(anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara },
78444f323ecSKristof Provost 	{ .type = PF_GR_ACTION, .off = _OUT(rule.action), .cb = nlattr_get_uint8 },
78544f323ecSKristof Provost };
78644f323ecSKristof Provost static const struct nlfield_parser nlf_p_getrules[] = {
78744f323ecSKristof Provost };
788706d465dSKristof Provost #undef _IN
789777a4702SKristof Provost #undef _OUT
79044f323ecSKristof Provost NL_DECLARE_PARSER(getrules_parser, struct genlmsghdr, nlf_p_getrules, nla_p_getrules);
79144f323ecSKristof Provost 
79244f323ecSKristof Provost static int
79344f323ecSKristof Provost pf_handle_getrules(struct nlmsghdr *hdr, struct nl_pstate *npt)
79444f323ecSKristof Provost {
79544f323ecSKristof Provost 	struct pfioc_rule attrs = {};
79644f323ecSKristof Provost 	int error;
79744f323ecSKristof Provost 	struct nl_writer *nw = npt->nw;
79844f323ecSKristof Provost 	struct genlmsghdr *ghdr_new;
79944f323ecSKristof Provost 
80044f323ecSKristof Provost 	error = nl_parse_nlmsg(hdr, &getrules_parser, npt, &attrs);
80144f323ecSKristof Provost 	if (error != 0)
80244f323ecSKristof Provost 		return (error);
80344f323ecSKristof Provost 
80444f323ecSKristof Provost 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
80544f323ecSKristof Provost 		return (ENOMEM);
80644f323ecSKristof Provost 
80744f323ecSKristof Provost 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
80844f323ecSKristof Provost 	ghdr_new->cmd = PFNL_CMD_GETRULES;
80944f323ecSKristof Provost 	ghdr_new->version = 0;
81044f323ecSKristof Provost 	ghdr_new->reserved = 0;
81144f323ecSKristof Provost 
81244f323ecSKristof Provost 	error = pf_ioctl_getrules(&attrs);
81344f323ecSKristof Provost 	if (error != 0)
81444f323ecSKristof Provost 		goto out;
81544f323ecSKristof Provost 
81644f323ecSKristof Provost 	nlattr_add_u32(nw, PF_GR_NR, attrs.nr);
81744f323ecSKristof Provost 	nlattr_add_u32(nw, PF_GR_TICKET, attrs.ticket);
81844f323ecSKristof Provost 
81944f323ecSKristof Provost 	if (!nlmsg_end(nw)) {
82044f323ecSKristof Provost 		error = ENOMEM;
82144f323ecSKristof Provost 		goto out;
82244f323ecSKristof Provost 	}
82344f323ecSKristof Provost 
82444f323ecSKristof Provost 	return (0);
82544f323ecSKristof Provost 
82644f323ecSKristof Provost out:
82744f323ecSKristof Provost 	nlmsg_abort(nw);
82844f323ecSKristof Provost 	return (error);
82944f323ecSKristof Provost }
83044f323ecSKristof Provost 
831777a4702SKristof Provost struct nl_parsed_get_rule {
832777a4702SKristof Provost 	char anchor[MAXPATHLEN];
833777a4702SKristof Provost 	uint8_t action;
834777a4702SKristof Provost 	uint32_t nr;
835777a4702SKristof Provost 	uint32_t ticket;
836777a4702SKristof Provost 	uint8_t clear;
837777a4702SKristof Provost };
838777a4702SKristof Provost #define	_IN(_field)	offsetof(struct genlmsghdr, _field)
839777a4702SKristof Provost #define	_OUT(_field)	offsetof(struct nl_parsed_get_rule, _field)
840777a4702SKristof Provost static const struct nlattr_parser nla_p_getrule[] = {
841777a4702SKristof Provost 	{ .type = PF_GR_ANCHOR, .off = _OUT(anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara },
842777a4702SKristof Provost 	{ .type = PF_GR_ACTION, .off = _OUT(action), .cb = nlattr_get_uint8 },
843777a4702SKristof Provost 	{ .type = PF_GR_NR, .off = _OUT(nr), .cb = nlattr_get_uint32 },
844777a4702SKristof Provost 	{ .type = PF_GR_TICKET, .off = _OUT(ticket), .cb = nlattr_get_uint32 },
845777a4702SKristof Provost 	{ .type = PF_GR_CLEAR, .off = _OUT(clear), .cb = nlattr_get_uint8 },
846777a4702SKristof Provost };
847777a4702SKristof Provost static const struct nlfield_parser nlf_p_getrule[] = {
848777a4702SKristof Provost };
849706d465dSKristof Provost #undef _IN
850706d465dSKristof Provost #undef _OUT
851777a4702SKristof Provost NL_DECLARE_PARSER(getrule_parser, struct genlmsghdr, nlf_p_getrule, nla_p_getrule);
852777a4702SKristof Provost 
853777a4702SKristof Provost static int
854777a4702SKristof Provost pf_handle_getrule(struct nlmsghdr *hdr, struct nl_pstate *npt)
855777a4702SKristof Provost {
856777a4702SKristof Provost 	char				 anchor_call[MAXPATHLEN];
857777a4702SKristof Provost 	struct nl_parsed_get_rule	 attrs = {};
858777a4702SKristof Provost 	struct nl_writer		*nw = npt->nw;
859777a4702SKristof Provost 	struct genlmsghdr		*ghdr_new;
860777a4702SKristof Provost 	struct pf_kruleset		*ruleset;
861777a4702SKristof Provost 	struct pf_krule			*rule;
862777a4702SKristof Provost 	int				 rs_num;
863777a4702SKristof Provost 	int				 error;
864777a4702SKristof Provost 
865777a4702SKristof Provost 	error = nl_parse_nlmsg(hdr, &getrule_parser, npt, &attrs);
866777a4702SKristof Provost 	if (error != 0)
867777a4702SKristof Provost 		return (error);
868777a4702SKristof Provost 
869777a4702SKristof Provost 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
870777a4702SKristof Provost 		return (ENOMEM);
871777a4702SKristof Provost 
872777a4702SKristof Provost 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
873777a4702SKristof Provost 	ghdr_new->cmd = PFNL_CMD_GETRULE;
874777a4702SKristof Provost 	ghdr_new->version = 0;
875777a4702SKristof Provost 	ghdr_new->reserved = 0;
876777a4702SKristof Provost 
877777a4702SKristof Provost 	PF_RULES_WLOCK();
878777a4702SKristof Provost 	ruleset = pf_find_kruleset(attrs.anchor);
879777a4702SKristof Provost 	if (ruleset == NULL) {
880777a4702SKristof Provost 		PF_RULES_WUNLOCK();
881777a4702SKristof Provost 		error = ENOENT;
882777a4702SKristof Provost 		goto out;
883777a4702SKristof Provost 	}
884777a4702SKristof Provost 
885777a4702SKristof Provost 	rs_num = pf_get_ruleset_number(attrs.action);
886777a4702SKristof Provost 	if (rs_num >= PF_RULESET_MAX) {
887777a4702SKristof Provost 		PF_RULES_WUNLOCK();
888777a4702SKristof Provost 		error = EINVAL;
889777a4702SKristof Provost 		goto out;
890777a4702SKristof Provost 	}
891777a4702SKristof Provost 
892777a4702SKristof Provost 	if (attrs.ticket != ruleset->rules[rs_num].active.ticket) {
893777a4702SKristof Provost 		PF_RULES_WUNLOCK();
894777a4702SKristof Provost 		error = EBUSY;
895777a4702SKristof Provost 		goto out;
896777a4702SKristof Provost 	}
897777a4702SKristof Provost 
898777a4702SKristof Provost 	rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr);
899777a4702SKristof Provost 	while ((rule != NULL) && (rule->nr != attrs.nr))
900777a4702SKristof Provost 		rule = TAILQ_NEXT(rule, entries);
901777a4702SKristof Provost 	if (rule == NULL) {
902777a4702SKristof Provost 		PF_RULES_WUNLOCK();
903777a4702SKristof Provost 		error = EBUSY;
904777a4702SKristof Provost 		goto out;
905777a4702SKristof Provost 	}
906777a4702SKristof Provost 
907777a4702SKristof Provost 	nlattr_add_rule_addr(nw, PF_RT_SRC, &rule->src);
908777a4702SKristof Provost 	nlattr_add_rule_addr(nw, PF_RT_DST, &rule->dst);
909777a4702SKristof Provost 	nlattr_add_u32(nw, PF_RT_RIDENTIFIER, rule->ridentifier);
910777a4702SKristof Provost 	nlattr_add_labels(nw, PF_RT_LABELS, rule);
911777a4702SKristof Provost 	nlattr_add_string(nw, PF_RT_IFNAME, rule->ifname);
912777a4702SKristof Provost 	nlattr_add_string(nw, PF_RT_QNAME, rule->qname);
913777a4702SKristof Provost 	nlattr_add_string(nw, PF_RT_PQNAME, rule->pqname);
914777a4702SKristof Provost 	nlattr_add_string(nw, PF_RT_TAGNAME, rule->tagname);
915777a4702SKristof Provost 	nlattr_add_string(nw, PF_RT_MATCH_TAGNAME, rule->match_tagname);
916777a4702SKristof Provost 	nlattr_add_string(nw, PF_RT_OVERLOAD_TBLNAME, rule->overload_tblname);
917777a4702SKristof Provost 	nlattr_add_pool(nw, PF_RT_RPOOL, &rule->rpool);
918777a4702SKristof Provost 	nlattr_add_u32(nw, PF_RT_OS_FINGERPRINT, rule->os_fingerprint);
919777a4702SKristof Provost 	nlattr_add_u32(nw, PF_RT_RTABLEID, rule->rtableid);
920777a4702SKristof Provost 	nlattr_add_timeout(nw, PF_RT_TIMEOUT, rule->timeout);
921777a4702SKristof Provost 	nlattr_add_u32(nw, PF_RT_MAX_STATES, rule->max_states);
922777a4702SKristof Provost 	nlattr_add_u32(nw, PF_RT_MAX_SRC_NODES, rule->max_src_nodes);
923777a4702SKristof Provost 	nlattr_add_u32(nw, PF_RT_MAX_SRC_STATES, rule->max_src_states);
924777a4702SKristof Provost 	nlattr_add_u32(nw, PF_RT_MAX_SRC_CONN_RATE_LIMIT, rule->max_src_conn_rate.limit);
925777a4702SKristof Provost 	nlattr_add_u32(nw, PF_RT_MAX_SRC_CONN_RATE_SECS, rule->max_src_conn_rate.seconds);
926777a4702SKristof Provost 
927777a4702SKristof Provost 	nlattr_add_u16(nw, PF_RT_DNPIPE, rule->dnpipe);
928777a4702SKristof Provost 	nlattr_add_u16(nw, PF_RT_DNRPIPE, rule->dnrpipe);
929777a4702SKristof Provost 	nlattr_add_u32(nw, PF_RT_DNFLAGS, rule->free_flags);
930777a4702SKristof Provost 
931777a4702SKristof Provost 	nlattr_add_u32(nw, PF_RT_NR, rule->nr);
932777a4702SKristof Provost 	nlattr_add_u32(nw, PF_RT_PROB, rule->prob);
933777a4702SKristof Provost 	nlattr_add_u32(nw, PF_RT_CUID, rule->cuid);
934777a4702SKristof Provost 	nlattr_add_u32(nw, PF_RT_CPID, rule->cpid);
935777a4702SKristof Provost 
936777a4702SKristof Provost 	nlattr_add_u16(nw, PF_RT_RETURN_ICMP, rule->return_icmp);
937777a4702SKristof Provost 	nlattr_add_u16(nw, PF_RT_RETURN_ICMP6, rule->return_icmp6);
938777a4702SKristof Provost 	nlattr_add_u16(nw, PF_RT_RETURN_ICMP6, rule->return_icmp6);
939777a4702SKristof Provost 	nlattr_add_u16(nw, PF_RT_MAX_MSS, rule->max_mss);
940777a4702SKristof Provost 	nlattr_add_u16(nw, PF_RT_SCRUB_FLAGS, rule->scrub_flags);
941777a4702SKristof Provost 
942777a4702SKristof Provost 	nlattr_add_rule_uid(nw, PF_RT_UID, &rule->uid);
943777a4702SKristof Provost 	nlattr_add_rule_uid(nw, PF_RT_GID, (const struct pf_rule_uid *)&rule->gid);
944777a4702SKristof Provost 
9452339ead6SKristof Provost 	nlattr_add_string(nw, PF_RT_RCV_IFNAME, rule->rcv_ifname);
9462339ead6SKristof Provost 
947777a4702SKristof Provost 	nlattr_add_u32(nw, PF_RT_RULE_FLAG, rule->rule_flag);
948777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_ACTION, rule->action);
949777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_DIRECTION, rule->direction);
950777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_LOG, rule->log);
951777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_LOGIF, rule->logif);
952777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_QUICK, rule->quick);
953777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_IF_NOT, rule->ifnot);
954777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_MATCH_TAG_NOT, rule->match_tag_not);
955777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_NATPASS, rule->natpass);
956777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_KEEP_STATE, rule->keep_state);
957777a4702SKristof Provost 
958777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_AF, rule->af);
959777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_PROTO, rule->proto);
960777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_TYPE, rule->type);
961777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_CODE, rule->code);
962777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_FLAGS, rule->flags);
963777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_FLAGSET, rule->flagset);
964777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_MIN_TTL, rule->min_ttl);
965777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_ALLOW_OPTS, rule->allow_opts);
966777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_RT, rule->rt);
967777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_RETURN_TTL, rule->return_ttl);
968777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_TOS, rule->tos);
969777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_SET_TOS, rule->set_tos);
970777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_ANCHOR_RELATIVE, rule->anchor_relative);
971777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_ANCHOR_WILDCARD, rule->anchor_wildcard);
972777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_FLUSH, rule->flush);
973777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_PRIO, rule->prio);
974777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_SET_PRIO, rule->set_prio[0]);
975777a4702SKristof Provost 	nlattr_add_u8(nw, PF_RT_SET_PRIO_REPLY, rule->set_prio[1]);
976777a4702SKristof Provost 
977777a4702SKristof Provost 	nlattr_add_in6_addr(nw, PF_RT_DIVERT_ADDRESS, &rule->divert.addr.v6);
978777a4702SKristof Provost 	nlattr_add_u16(nw, PF_RT_DIVERT_PORT, rule->divert.port);
979777a4702SKristof Provost 
980777a4702SKristof Provost 	nlattr_add_u64(nw, PF_RT_PACKETS_IN, pf_counter_u64_fetch(&rule->packets[0]));
981777a4702SKristof Provost 	nlattr_add_u64(nw, PF_RT_PACKETS_OUT, pf_counter_u64_fetch(&rule->packets[1]));
982777a4702SKristof Provost 	nlattr_add_u64(nw, PF_RT_BYTES_IN, pf_counter_u64_fetch(&rule->bytes[0]));
983777a4702SKristof Provost 	nlattr_add_u64(nw, PF_RT_BYTES_OUT, pf_counter_u64_fetch(&rule->bytes[1]));
984777a4702SKristof Provost 	nlattr_add_u64(nw, PF_RT_EVALUATIONS, pf_counter_u64_fetch(&rule->evaluations));
985777a4702SKristof Provost 	nlattr_add_u64(nw, PF_RT_TIMESTAMP, pf_get_timestamp(rule));
986777a4702SKristof Provost 	nlattr_add_u64(nw, PF_RT_STATES_CUR, counter_u64_fetch(rule->states_cur));
987777a4702SKristof Provost 	nlattr_add_u64(nw, PF_RT_STATES_TOTAL, counter_u64_fetch(rule->states_tot));
988777a4702SKristof Provost 	nlattr_add_u64(nw, PF_RT_SRC_NODES, counter_u64_fetch(rule->src_nodes));
989777a4702SKristof Provost 
9906ee3e376SKristof Provost 	error = pf_kanchor_copyout(ruleset, rule, anchor_call, sizeof(anchor_call));
991777a4702SKristof Provost 	MPASS(error == 0);
992777a4702SKristof Provost 
993777a4702SKristof Provost 	nlattr_add_string(nw, PF_RT_ANCHOR_CALL, anchor_call);
994777a4702SKristof Provost 
995777a4702SKristof Provost 	if (attrs.clear)
996777a4702SKristof Provost 		pf_krule_clear_counters(rule);
997777a4702SKristof Provost 
998777a4702SKristof Provost 	PF_RULES_WUNLOCK();
999777a4702SKristof Provost 
1000777a4702SKristof Provost 	if (!nlmsg_end(nw)) {
1001777a4702SKristof Provost 		error = ENOMEM;
1002777a4702SKristof Provost 		goto out;
1003777a4702SKristof Provost 	}
1004777a4702SKristof Provost 
1005777a4702SKristof Provost 	return (0);
1006777a4702SKristof Provost out:
1007777a4702SKristof Provost 	nlmsg_abort(nw);
1008777a4702SKristof Provost 	return (error);
1009777a4702SKristof Provost }
1010777a4702SKristof Provost 
1011706d465dSKristof Provost #define	_IN(_field)	offsetof(struct genlmsghdr, _field)
1012706d465dSKristof Provost #define	_OUT(_field)	offsetof(struct pf_kstate_kill, _field)
1013706d465dSKristof Provost static const struct nlattr_parser nla_p_clear_states[] = {
1014706d465dSKristof Provost 	{ .type = PF_CS_CMP_ID, .off = _OUT(psk_pfcmp.id), .cb = nlattr_get_uint64 },
1015706d465dSKristof Provost 	{ .type = PF_CS_CMP_CREATORID, .off = _OUT(psk_pfcmp.creatorid), .cb = nlattr_get_uint32 },
1016706d465dSKristof Provost 	{ .type = PF_CS_CMP_DIR, .off = _OUT(psk_pfcmp.direction), .cb = nlattr_get_uint8 },
1017706d465dSKristof Provost 	{ .type = PF_CS_AF, .off = _OUT(psk_af), .cb = nlattr_get_uint8 },
1018706d465dSKristof Provost 	{ .type = PF_CS_PROTO, .off = _OUT(psk_proto), .cb = nlattr_get_uint8 },
1019706d465dSKristof Provost 	{ .type = PF_CS_SRC, .off = _OUT(psk_src), .arg = &rule_addr_parser, .cb = nlattr_get_nested },
1020706d465dSKristof Provost 	{ .type = PF_CS_DST, .off = _OUT(psk_dst), .arg = &rule_addr_parser, .cb = nlattr_get_nested },
1021706d465dSKristof Provost 	{ .type = PF_CS_RT_ADDR, .off = _OUT(psk_rt_addr), .arg = &rule_addr_parser, .cb = nlattr_get_nested },
1022706d465dSKristof Provost 	{ .type = PF_CS_IFNAME, .off = _OUT(psk_ifname), .arg = (void *)IFNAMSIZ, .cb = nlattr_get_chara },
1023706d465dSKristof Provost 	{ .type = PF_CS_LABEL, .off = _OUT(psk_label), .arg = (void *)PF_RULE_LABEL_SIZE, .cb = nlattr_get_chara },
1024706d465dSKristof Provost 	{ .type = PF_CS_KILL_MATCH, .off = _OUT(psk_kill_match), .cb = nlattr_get_bool },
1025706d465dSKristof Provost 	{ .type = PF_CS_NAT, .off = _OUT(psk_nat), .cb = nlattr_get_bool },
1026706d465dSKristof Provost };
1027706d465dSKristof Provost static const struct nlfield_parser nlf_p_clear_states[] = {};
1028706d465dSKristof Provost #undef _IN
1029706d465dSKristof Provost #undef _OUT
1030706d465dSKristof Provost NL_DECLARE_PARSER(clear_states_parser, struct genlmsghdr, nlf_p_clear_states, nla_p_clear_states);
1031706d465dSKristof Provost 
1032706d465dSKristof Provost static int
1033706d465dSKristof Provost pf_handle_killclear_states(struct nlmsghdr *hdr, struct nl_pstate *npt, int cmd)
1034706d465dSKristof Provost {
1035706d465dSKristof Provost 	struct pf_kstate_kill		 kill = {};
1036706d465dSKristof Provost 	struct epoch_tracker		 et;
1037706d465dSKristof Provost 	struct nl_writer		*nw = npt->nw;
1038706d465dSKristof Provost 	struct genlmsghdr		*ghdr_new;
1039706d465dSKristof Provost 	int				 error;
1040706d465dSKristof Provost 	unsigned int			 killed = 0;
1041706d465dSKristof Provost 
1042706d465dSKristof Provost 	error = nl_parse_nlmsg(hdr, &clear_states_parser, npt, &kill);
1043706d465dSKristof Provost 	if (error != 0)
1044706d465dSKristof Provost 		return (error);
1045706d465dSKristof Provost 
1046706d465dSKristof Provost 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1047706d465dSKristof Provost 		return (ENOMEM);
1048706d465dSKristof Provost 
1049706d465dSKristof Provost 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1050706d465dSKristof Provost 	ghdr_new->cmd = cmd;
1051706d465dSKristof Provost 	ghdr_new->version = 0;
1052706d465dSKristof Provost 	ghdr_new->reserved = 0;
1053706d465dSKristof Provost 
1054706d465dSKristof Provost 	NET_EPOCH_ENTER(et);
1055706d465dSKristof Provost 	if (cmd == PFNL_CMD_KILLSTATES)
1056706d465dSKristof Provost 		pf_killstates(&kill, &killed);
1057706d465dSKristof Provost 	else
1058706d465dSKristof Provost 		killed = pf_clear_states(&kill);
1059706d465dSKristof Provost 	NET_EPOCH_EXIT(et);
1060706d465dSKristof Provost 
1061706d465dSKristof Provost 	nlattr_add_u32(nw, PF_CS_KILLED, killed);
1062706d465dSKristof Provost 
1063706d465dSKristof Provost 	if (! nlmsg_end(nw)) {
1064706d465dSKristof Provost 		error = ENOMEM;
1065706d465dSKristof Provost 		goto out;
1066706d465dSKristof Provost 	}
1067706d465dSKristof Provost 
1068706d465dSKristof Provost 	return (0);
1069706d465dSKristof Provost 
1070706d465dSKristof Provost out:
1071706d465dSKristof Provost 	nlmsg_abort(nw);
1072706d465dSKristof Provost 	return (error);
1073706d465dSKristof Provost }
1074706d465dSKristof Provost 
1075706d465dSKristof Provost static int
1076706d465dSKristof Provost pf_handle_clear_states(struct nlmsghdr *hdr, struct nl_pstate *npt)
1077706d465dSKristof Provost {
1078706d465dSKristof Provost 	return (pf_handle_killclear_states(hdr, npt, PFNL_CMD_CLRSTATES));
1079706d465dSKristof Provost }
1080706d465dSKristof Provost 
1081706d465dSKristof Provost static int
1082706d465dSKristof Provost pf_handle_kill_states(struct nlmsghdr *hdr, struct nl_pstate *npt)
1083706d465dSKristof Provost {
1084706d465dSKristof Provost 	return (pf_handle_killclear_states(hdr, npt, PFNL_CMD_KILLSTATES));
1085706d465dSKristof Provost }
1086706d465dSKristof Provost 
1087470a2b33SKristof Provost struct nl_parsed_set_statusif {
1088470a2b33SKristof Provost 	char ifname[IFNAMSIZ];
1089470a2b33SKristof Provost };
1090470a2b33SKristof Provost #define	_IN(_field)	offsetof(struct genlmsghdr, _field)
1091470a2b33SKristof Provost #define	_OUT(_field)	offsetof(struct nl_parsed_set_statusif, _field)
1092470a2b33SKristof Provost static const struct nlattr_parser nla_p_set_statusif[] = {
1093470a2b33SKristof Provost 	{ .type = PF_SS_IFNAME, .off = _OUT(ifname), .arg = (const void *)IFNAMSIZ, .cb = nlattr_get_chara },
1094470a2b33SKristof Provost };
1095470a2b33SKristof Provost static const struct nlfield_parser nlf_p_set_statusif[] = {};
1096470a2b33SKristof Provost #undef _IN
1097470a2b33SKristof Provost #undef _OUT
1098470a2b33SKristof Provost NL_DECLARE_PARSER(set_statusif_parser, struct genlmsghdr, nlf_p_set_statusif, nla_p_set_statusif);
1099470a2b33SKristof Provost 
1100470a2b33SKristof Provost static int
1101470a2b33SKristof Provost pf_handle_set_statusif(struct nlmsghdr *hdr, struct nl_pstate *npt)
1102470a2b33SKristof Provost {
1103470a2b33SKristof Provost 	int error;
1104470a2b33SKristof Provost 	struct nl_parsed_set_statusif attrs = {};
1105470a2b33SKristof Provost 
1106470a2b33SKristof Provost 	error = nl_parse_nlmsg(hdr, &set_statusif_parser, npt, &attrs);
1107470a2b33SKristof Provost 	if (error != 0)
1108470a2b33SKristof Provost 		return (error);
1109470a2b33SKristof Provost 
1110470a2b33SKristof Provost 	PF_RULES_WLOCK();
1111470a2b33SKristof Provost 	strlcpy(V_pf_status.ifname, attrs.ifname, IFNAMSIZ);
1112470a2b33SKristof Provost 	PF_RULES_WUNLOCK();
1113470a2b33SKristof Provost 
1114470a2b33SKristof Provost 	return (0);
1115470a2b33SKristof Provost }
1116470a2b33SKristof Provost 
11175824df8dSKristof Provost static bool
11185824df8dSKristof Provost nlattr_add_counters(struct nl_writer *nw, int attr, size_t number, char **names,
11195824df8dSKristof Provost     counter_u64_t *counters)
11205824df8dSKristof Provost {
11215824df8dSKristof Provost 	for (int i = 0; i < number; i++) {
11225824df8dSKristof Provost 		int off = nlattr_add_nested(nw, attr);
11235824df8dSKristof Provost 		nlattr_add_u32(nw, PF_C_ID, i);
11245824df8dSKristof Provost 		nlattr_add_string(nw, PF_C_NAME, names[i]);
11255824df8dSKristof Provost 		nlattr_add_u64(nw, PF_C_COUNTER, counter_u64_fetch(counters[i]));
11265824df8dSKristof Provost 		nlattr_set_len(nw, off);
11275824df8dSKristof Provost 	}
11285824df8dSKristof Provost 
11295824df8dSKristof Provost 	return (true);
11305824df8dSKristof Provost }
11315824df8dSKristof Provost 
11325824df8dSKristof Provost static bool
11335824df8dSKristof Provost nlattr_add_fcounters(struct nl_writer *nw, int attr, size_t number, char **names,
11345824df8dSKristof Provost     struct pf_counter_u64 *counters)
11355824df8dSKristof Provost {
11365824df8dSKristof Provost 	for (int i = 0; i < number; i++) {
11375824df8dSKristof Provost 		int off = nlattr_add_nested(nw, attr);
11385824df8dSKristof Provost 		nlattr_add_u32(nw, PF_C_ID, i);
11395824df8dSKristof Provost 		nlattr_add_string(nw, PF_C_NAME, names[i]);
11405824df8dSKristof Provost 		nlattr_add_u64(nw, PF_C_COUNTER, pf_counter_u64_fetch(&counters[i]));
11415824df8dSKristof Provost 		nlattr_set_len(nw, off);
11425824df8dSKristof Provost 	}
11435824df8dSKristof Provost 
11445824df8dSKristof Provost 	return (true);
11455824df8dSKristof Provost }
11465824df8dSKristof Provost 
11475824df8dSKristof Provost static bool
11485824df8dSKristof Provost nlattr_add_u64_array(struct nl_writer *nw, int attr, size_t number, uint64_t *array)
11495824df8dSKristof Provost {
11505824df8dSKristof Provost 	int off = nlattr_add_nested(nw, attr);
11515824df8dSKristof Provost 
11525824df8dSKristof Provost 	for (size_t i = 0; i < number; i++)
11535824df8dSKristof Provost 		nlattr_add_u64(nw, 0, array[i]);
11545824df8dSKristof Provost 
11555824df8dSKristof Provost 	nlattr_set_len(nw, off);
11565824df8dSKristof Provost 
11575824df8dSKristof Provost 	return (true);
11585824df8dSKristof Provost }
11595824df8dSKristof Provost 
11605824df8dSKristof Provost static int
11615824df8dSKristof Provost pf_handle_get_status(struct nlmsghdr *hdr, struct nl_pstate *npt)
11625824df8dSKristof Provost {
11635824df8dSKristof Provost 	struct pf_status s;
11645824df8dSKristof Provost 	struct nl_writer *nw = npt->nw;
11655824df8dSKristof Provost 	struct genlmsghdr *ghdr_new;
11665824df8dSKristof Provost 	char *pf_reasons[PFRES_MAX+1] = PFRES_NAMES;
11675824df8dSKristof Provost 	char *pf_lcounter[KLCNT_MAX+1] = KLCNT_NAMES;
11685824df8dSKristof Provost 	char *pf_fcounter[FCNT_MAX+1] = FCNT_NAMES;
11695824df8dSKristof Provost 	int error;
11705824df8dSKristof Provost 
11715824df8dSKristof Provost 	PF_RULES_RLOCK_TRACKER;
11725824df8dSKristof Provost 
11735824df8dSKristof Provost 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
11745824df8dSKristof Provost 		return (ENOMEM);
11755824df8dSKristof Provost 
11765824df8dSKristof Provost 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
11775824df8dSKristof Provost 	ghdr_new->cmd = PFNL_CMD_GET_STATUS;
11785824df8dSKristof Provost 	ghdr_new->version = 0;
11795824df8dSKristof Provost 	ghdr_new->reserved = 0;
11805824df8dSKristof Provost 
11815824df8dSKristof Provost 	PF_RULES_RLOCK();
11825824df8dSKristof Provost 
11835824df8dSKristof Provost 	nlattr_add_string(nw, PF_GS_IFNAME, V_pf_status.ifname);
11845824df8dSKristof Provost 	nlattr_add_bool(nw, PF_GS_RUNNING, V_pf_status.running);
11855824df8dSKristof Provost 	nlattr_add_u32(nw, PF_GS_SINCE, V_pf_status.since);
11865824df8dSKristof Provost 	nlattr_add_u32(nw, PF_GS_DEBUG, V_pf_status.debug);
11875824df8dSKristof Provost 	nlattr_add_u32(nw, PF_GS_HOSTID, ntohl(V_pf_status.hostid));
11885824df8dSKristof Provost 	nlattr_add_u32(nw, PF_GS_STATES, V_pf_status.states);
11895824df8dSKristof Provost 	nlattr_add_u32(nw, PF_GS_SRC_NODES, V_pf_status.src_nodes);
11905824df8dSKristof Provost 	nlattr_add_u32(nw, PF_GS_REASSEMBLE, V_pf_status.reass);
11915824df8dSKristof Provost 	nlattr_add_u32(nw, PF_GS_SYNCOOKIES_ACTIVE, V_pf_status.syncookies_active);
11925824df8dSKristof Provost 
11935824df8dSKristof Provost 	nlattr_add_counters(nw, PF_GS_COUNTERS, PFRES_MAX, pf_reasons,
11945824df8dSKristof Provost 	    V_pf_status.counters);
11955824df8dSKristof Provost 	nlattr_add_counters(nw, PF_GS_LCOUNTERS, KLCNT_MAX, pf_lcounter,
11965824df8dSKristof Provost 	    V_pf_status.lcounters);
11975824df8dSKristof Provost 	nlattr_add_fcounters(nw, PF_GS_FCOUNTERS, FCNT_MAX, pf_fcounter,
11985824df8dSKristof Provost 	    V_pf_status.fcounters);
11995824df8dSKristof Provost 	nlattr_add_counters(nw, PF_GS_SCOUNTERS, SCNT_MAX, pf_fcounter,
12005824df8dSKristof Provost 	    V_pf_status.scounters);
12015824df8dSKristof Provost 
12025824df8dSKristof Provost 	pfi_update_status(V_pf_status.ifname, &s);
12035824df8dSKristof Provost 	nlattr_add_u64_array(nw, PF_GS_BCOUNTERS, 2 * 2, (uint64_t *)s.bcounters);
12045824df8dSKristof Provost 	nlattr_add_u64_array(nw, PF_GS_PCOUNTERS, 2 * 2 * 2, (uint64_t *)s.pcounters);
12055824df8dSKristof Provost 
12065824df8dSKristof Provost 	nlattr_add(nw, PF_GS_CHKSUM, PF_MD5_DIGEST_LENGTH, V_pf_status.pf_chksum);
12075824df8dSKristof Provost 
12085824df8dSKristof Provost 	PF_RULES_RUNLOCK();
12095824df8dSKristof Provost 
12105824df8dSKristof Provost 	if (!nlmsg_end(nw)) {
12115824df8dSKristof Provost 		error = ENOMEM;
12125824df8dSKristof Provost 		goto out;
12135824df8dSKristof Provost 	}
12145824df8dSKristof Provost 
12155824df8dSKristof Provost 	return (0);
12165824df8dSKristof Provost 
12175824df8dSKristof Provost out:
12185824df8dSKristof Provost 	nlmsg_abort(nw);
12195824df8dSKristof Provost 	return (error);
12205824df8dSKristof Provost }
12215824df8dSKristof Provost 
12229dbbe68bSKristof Provost static int
12239dbbe68bSKristof Provost pf_handle_clear_status(struct nlmsghdr *hdr, struct nl_pstate *npt)
12249dbbe68bSKristof Provost {
12259dbbe68bSKristof Provost 	pf_ioctl_clear_status();
12269dbbe68bSKristof Provost 
12279dbbe68bSKristof Provost 	return (0);
12289dbbe68bSKristof Provost }
12299dbbe68bSKristof Provost 
123071d3c704SKristof Provost struct pf_nl_natlook {
123171d3c704SKristof Provost 	sa_family_t af;
123271d3c704SKristof Provost 	uint8_t direction;
123371d3c704SKristof Provost 	uint8_t proto;
123471d3c704SKristof Provost 	struct pf_addr src;
123571d3c704SKristof Provost 	struct pf_addr dst;
123671d3c704SKristof Provost 	uint16_t sport;
123771d3c704SKristof Provost 	uint16_t dport;
123871d3c704SKristof Provost };
123971d3c704SKristof Provost 
124071d3c704SKristof Provost #define	_IN(_field)	offsetof(struct genlmsghdr, _field)
124171d3c704SKristof Provost #define	_OUT(_field)	offsetof(struct pf_nl_natlook, _field)
124271d3c704SKristof Provost static const struct nlattr_parser nla_p_natlook[] = {
124371d3c704SKristof Provost 	{ .type = PF_NL_AF, .off = _OUT(af), .cb = nlattr_get_uint8 },
124471d3c704SKristof Provost 	{ .type = PF_NL_DIRECTION, .off = _OUT(direction), .cb = nlattr_get_uint8 },
124571d3c704SKristof Provost 	{ .type = PF_NL_PROTO, .off = _OUT(proto), .cb = nlattr_get_uint8 },
124671d3c704SKristof Provost 	{ .type = PF_NL_SRC_ADDR, .off = _OUT(src), .cb = nlattr_get_in6_addr },
124771d3c704SKristof Provost 	{ .type = PF_NL_DST_ADDR, .off = _OUT(dst), .cb = nlattr_get_in6_addr },
124871d3c704SKristof Provost 	{ .type = PF_NL_SRC_PORT, .off = _OUT(sport), .cb = nlattr_get_uint16 },
124971d3c704SKristof Provost 	{ .type = PF_NL_DST_PORT, .off = _OUT(dport), .cb = nlattr_get_uint16 },
125071d3c704SKristof Provost };
125171d3c704SKristof Provost static const struct nlfield_parser nlf_p_natlook[] = {};
125271d3c704SKristof Provost #undef _IN
125371d3c704SKristof Provost #undef _OUT
125471d3c704SKristof Provost NL_DECLARE_PARSER(natlook_parser, struct genlmsghdr, nlf_p_natlook, nla_p_natlook);
125571d3c704SKristof Provost 
125671d3c704SKristof Provost static int
125771d3c704SKristof Provost pf_handle_natlook(struct nlmsghdr *hdr, struct nl_pstate *npt)
125871d3c704SKristof Provost {
125971d3c704SKristof Provost 	struct pf_nl_natlook	 attrs = {};
126071d3c704SKristof Provost 	struct pf_state_key_cmp	 key = {};
126171d3c704SKristof Provost 	struct nl_writer	*nw = npt->nw;
126271d3c704SKristof Provost 	struct pf_state_key	*sk;
126371d3c704SKristof Provost 	struct pf_kstate	*state;
126471d3c704SKristof Provost 	struct genlmsghdr	*ghdr_new;
126571d3c704SKristof Provost 	int			 error, m;
126671d3c704SKristof Provost 	int			 sidx, didx;
126771d3c704SKristof Provost 
126871d3c704SKristof Provost 	error = nl_parse_nlmsg(hdr, &natlook_parser, npt, &attrs);
126971d3c704SKristof Provost 	if (error != 0)
127071d3c704SKristof Provost 		return (error);
127171d3c704SKristof Provost 
127271d3c704SKristof Provost 	if (attrs.proto == 0 ||
127371d3c704SKristof Provost 	    PF_AZERO(&attrs.src, attrs.af) ||
127471d3c704SKristof Provost 	    PF_AZERO(&attrs.dst, attrs.af) ||
127571d3c704SKristof Provost 	    ((attrs.proto == IPPROTO_TCP || attrs.proto == IPPROTO_UDP) &&
127671d3c704SKristof Provost 	     (attrs.sport == 0 || attrs.dport == 0)))
127771d3c704SKristof Provost 		return (EINVAL);
127871d3c704SKristof Provost 
127971d3c704SKristof Provost 	/* NATLOOK src and dst are reversed, so reverse sidx/didx */
128071d3c704SKristof Provost 	sidx = (attrs.direction == PF_IN) ? 1 : 0;
128171d3c704SKristof Provost 	didx = (attrs.direction == PF_IN) ? 0 : 1;
128271d3c704SKristof Provost 
128371d3c704SKristof Provost 	key.af = attrs.af;
128471d3c704SKristof Provost 	key.proto = attrs.proto;
128571d3c704SKristof Provost 	PF_ACPY(&key.addr[sidx], &attrs.src, attrs.af);
128671d3c704SKristof Provost 	key.port[sidx] = attrs.sport;
128771d3c704SKristof Provost 	PF_ACPY(&key.addr[didx], &attrs.dst, attrs.af);
128871d3c704SKristof Provost 	key.port[didx] = attrs.dport;
128971d3c704SKristof Provost 
129071d3c704SKristof Provost 	state = pf_find_state_all(&key, attrs.direction, &m);
129171d3c704SKristof Provost 	if (state == NULL)
129271d3c704SKristof Provost 		return (ENOENT);
129371d3c704SKristof Provost 	if (m > 1) {
129471d3c704SKristof Provost 		PF_STATE_UNLOCK(state);
129571d3c704SKristof Provost 		return (E2BIG);
129671d3c704SKristof Provost 	}
129771d3c704SKristof Provost 
129871d3c704SKristof Provost 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) {
129971d3c704SKristof Provost 		PF_STATE_UNLOCK(state);
130071d3c704SKristof Provost 		return (ENOMEM);
130171d3c704SKristof Provost 	}
130271d3c704SKristof Provost 
130371d3c704SKristof Provost 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
130471d3c704SKristof Provost 	ghdr_new->cmd = PFNL_CMD_NATLOOK;
130571d3c704SKristof Provost 	ghdr_new->version = 0;
130671d3c704SKristof Provost 	ghdr_new->reserved = 0;
130771d3c704SKristof Provost 
130871d3c704SKristof Provost 	sk = state->key[sidx];
130971d3c704SKristof Provost 
131071d3c704SKristof Provost 	nlattr_add_in6_addr(nw, PF_NL_SRC_ADDR, &sk->addr[sidx].v6);
131171d3c704SKristof Provost 	nlattr_add_in6_addr(nw, PF_NL_DST_ADDR, &sk->addr[didx].v6);
131271d3c704SKristof Provost 	nlattr_add_u16(nw, PF_NL_SRC_PORT, sk->port[sidx]);
131371d3c704SKristof Provost 	nlattr_add_u16(nw, PF_NL_DST_PORT, sk->port[didx]);
131471d3c704SKristof Provost 
131571d3c704SKristof Provost 	PF_STATE_UNLOCK(state);
131671d3c704SKristof Provost 
131771d3c704SKristof Provost 	if (!nlmsg_end(nw)) {
131871d3c704SKristof Provost 		nlmsg_abort(nw);
131971d3c704SKristof Provost 		return (ENOMEM);
132071d3c704SKristof Provost 	}
132171d3c704SKristof Provost 
132271d3c704SKristof Provost 	return (0);
132371d3c704SKristof Provost }
132471d3c704SKristof Provost 
1325c36c90a2SKristof Provost struct pf_nl_set_debug
1326c36c90a2SKristof Provost {
1327c36c90a2SKristof Provost 	uint32_t level;
1328c36c90a2SKristof Provost };
1329c36c90a2SKristof Provost #define	_OUT(_field)	offsetof(struct pf_nl_set_debug, _field)
1330c36c90a2SKristof Provost static const struct nlattr_parser nla_p_set_debug[] = {
1331c36c90a2SKristof Provost 	{ .type = PF_SD_LEVEL, .off = _OUT(level), .cb = nlattr_get_uint32 },
1332c36c90a2SKristof Provost };
1333c36c90a2SKristof Provost static const struct nlfield_parser nlf_p_set_debug[] = {};
1334c36c90a2SKristof Provost #undef _OUT
1335c36c90a2SKristof Provost NL_DECLARE_PARSER(set_debug_parser, struct genlmsghdr, nlf_p_set_debug, nla_p_set_debug);
1336c36c90a2SKristof Provost 
1337c36c90a2SKristof Provost static int
1338c36c90a2SKristof Provost pf_handle_set_debug(struct nlmsghdr *hdr, struct nl_pstate *npt)
1339c36c90a2SKristof Provost {
1340c36c90a2SKristof Provost 	struct pf_nl_set_debug attrs = {};
1341c36c90a2SKristof Provost 	int error;
1342c36c90a2SKristof Provost 
1343c36c90a2SKristof Provost 	error = nl_parse_nlmsg(hdr, &set_debug_parser, npt, &attrs);
1344c36c90a2SKristof Provost 	if (error != 0)
1345c36c90a2SKristof Provost 		return (error);
1346c36c90a2SKristof Provost 
1347c36c90a2SKristof Provost 	PF_RULES_WLOCK();
1348c36c90a2SKristof Provost 	V_pf_status.debug = attrs.level;
1349c36c90a2SKristof Provost 	PF_RULES_WUNLOCK();
1350c36c90a2SKristof Provost 
1351c36c90a2SKristof Provost 	return (0);
1352c36c90a2SKristof Provost }
1353c36c90a2SKristof Provost 
135430bad751SKristof Provost struct pf_nl_set_timeout
135530bad751SKristof Provost {
135630bad751SKristof Provost 	uint32_t timeout;
135730bad751SKristof Provost 	uint32_t seconds;
135830bad751SKristof Provost };
135930bad751SKristof Provost #define	_OUT(_field)	offsetof(struct pf_nl_set_timeout, _field)
136030bad751SKristof Provost static const struct nlattr_parser nla_p_set_timeout[] = {
136130bad751SKristof Provost 	{ .type = PF_TO_TIMEOUT, .off = _OUT(timeout), .cb = nlattr_get_uint32 },
136230bad751SKristof Provost 	{ .type = PF_TO_SECONDS, .off = _OUT(seconds), .cb = nlattr_get_uint32 },
136330bad751SKristof Provost };
136430bad751SKristof Provost static const struct nlfield_parser nlf_p_set_timeout[] = {};
136530bad751SKristof Provost #undef _OUT
136630bad751SKristof Provost NL_DECLARE_PARSER(set_timeout_parser, struct genlmsghdr, nlf_p_set_timeout, nla_p_set_timeout);
136730bad751SKristof Provost 
136830bad751SKristof Provost static int
136930bad751SKristof Provost pf_handle_set_timeout(struct nlmsghdr *hdr, struct nl_pstate *npt)
137030bad751SKristof Provost {
137130bad751SKristof Provost 	struct pf_nl_set_timeout attrs = {};
137230bad751SKristof Provost 	int error;
137330bad751SKristof Provost 
137430bad751SKristof Provost 	error = nl_parse_nlmsg(hdr, &set_timeout_parser, npt, &attrs);
137530bad751SKristof Provost 	if (error != 0)
137630bad751SKristof Provost 		return (error);
137730bad751SKristof Provost 
137830bad751SKristof Provost 	return (pf_ioctl_set_timeout(attrs.timeout, attrs.seconds, NULL));
137930bad751SKristof Provost }
138030bad751SKristof Provost 
138130bad751SKristof Provost static int
138230bad751SKristof Provost pf_handle_get_timeout(struct nlmsghdr *hdr, struct nl_pstate *npt)
138330bad751SKristof Provost {
138430bad751SKristof Provost 	struct pf_nl_set_timeout attrs = {};
138530bad751SKristof Provost 	struct nl_writer *nw = npt->nw;
138630bad751SKristof Provost 	struct genlmsghdr *ghdr_new;
138730bad751SKristof Provost 	int error;
138830bad751SKristof Provost 
138930bad751SKristof Provost 	error = nl_parse_nlmsg(hdr, &set_timeout_parser, npt, &attrs);
139030bad751SKristof Provost 	if (error != 0)
139130bad751SKristof Provost 		return (error);
139230bad751SKristof Provost 
139330bad751SKristof Provost 	error = pf_ioctl_get_timeout(attrs.timeout, &attrs.seconds);
139430bad751SKristof Provost 	if (error != 0)
139530bad751SKristof Provost 		return (error);
139630bad751SKristof Provost 
139730bad751SKristof Provost 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
139830bad751SKristof Provost 		return (ENOMEM);
139930bad751SKristof Provost 
140030bad751SKristof Provost 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
140130bad751SKristof Provost 	ghdr_new->cmd = PFNL_CMD_GET_TIMEOUT;
140230bad751SKristof Provost 	ghdr_new->version = 0;
140330bad751SKristof Provost 	ghdr_new->reserved = 0;
140430bad751SKristof Provost 
140530bad751SKristof Provost 	nlattr_add_u32(nw, PF_TO_SECONDS, attrs.seconds);
140630bad751SKristof Provost 
140730bad751SKristof Provost 	if (!nlmsg_end(nw)) {
140830bad751SKristof Provost 		nlmsg_abort(nw);
140930bad751SKristof Provost 		return (ENOMEM);
141030bad751SKristof Provost 	}
141130bad751SKristof Provost 
141230bad751SKristof Provost 	return (0);
141330bad751SKristof Provost }
141430bad751SKristof Provost 
1415d9ab8999SKristof Provost struct pf_nl_set_limit
1416d9ab8999SKristof Provost {
1417d9ab8999SKristof Provost 	uint32_t index;
1418d9ab8999SKristof Provost 	uint32_t limit;
1419d9ab8999SKristof Provost };
1420d9ab8999SKristof Provost #define	_OUT(_field)	offsetof(struct pf_nl_set_limit, _field)
1421d9ab8999SKristof Provost static const struct nlattr_parser nla_p_set_limit[] = {
1422d9ab8999SKristof Provost 	{ .type = PF_LI_INDEX, .off = _OUT(index), .cb = nlattr_get_uint32 },
1423d9ab8999SKristof Provost 	{ .type = PF_LI_LIMIT, .off = _OUT(limit), .cb = nlattr_get_uint32 },
1424d9ab8999SKristof Provost };
1425d9ab8999SKristof Provost static const struct nlfield_parser nlf_p_set_limit[] = {};
1426d9ab8999SKristof Provost #undef _OUT
1427d9ab8999SKristof Provost NL_DECLARE_PARSER(set_limit_parser, struct genlmsghdr, nlf_p_set_limit, nla_p_set_limit);
1428d9ab8999SKristof Provost 
1429d9ab8999SKristof Provost static int
1430d9ab8999SKristof Provost pf_handle_set_limit(struct nlmsghdr *hdr, struct nl_pstate *npt)
1431d9ab8999SKristof Provost {
1432d9ab8999SKristof Provost 	struct pf_nl_set_limit attrs = {};
1433d9ab8999SKristof Provost 	int error;
1434d9ab8999SKristof Provost 
1435d9ab8999SKristof Provost 	error = nl_parse_nlmsg(hdr, &set_limit_parser, npt, &attrs);
1436d9ab8999SKristof Provost 	if (error != 0)
1437d9ab8999SKristof Provost 		return (error);
1438d9ab8999SKristof Provost 
1439d9ab8999SKristof Provost 	return (pf_ioctl_set_limit(attrs.index, attrs.limit, NULL));
1440d9ab8999SKristof Provost }
1441d9ab8999SKristof Provost 
1442d9ab8999SKristof Provost static int
1443d9ab8999SKristof Provost pf_handle_get_limit(struct nlmsghdr *hdr, struct nl_pstate *npt)
1444d9ab8999SKristof Provost {
1445d9ab8999SKristof Provost 	struct pf_nl_set_limit attrs = {};
1446d9ab8999SKristof Provost 	struct nl_writer *nw = npt->nw;
1447d9ab8999SKristof Provost 	struct genlmsghdr *ghdr_new;
1448d9ab8999SKristof Provost 	int error;
1449d9ab8999SKristof Provost 
1450d9ab8999SKristof Provost 	error = nl_parse_nlmsg(hdr, &set_limit_parser, npt, &attrs);
1451d9ab8999SKristof Provost 	if (error != 0)
1452d9ab8999SKristof Provost 		return (error);
1453d9ab8999SKristof Provost 
1454d9ab8999SKristof Provost 	error = pf_ioctl_get_limit(attrs.index, &attrs.limit);
1455d9ab8999SKristof Provost 	if (error != 0)
1456d9ab8999SKristof Provost 		return (error);
1457d9ab8999SKristof Provost 
1458d9ab8999SKristof Provost 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1459d9ab8999SKristof Provost 		return (ENOMEM);
1460d9ab8999SKristof Provost 
1461d9ab8999SKristof Provost 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1462d9ab8999SKristof Provost 	ghdr_new->cmd = PFNL_CMD_GET_LIMIT;
1463d9ab8999SKristof Provost 	ghdr_new->version = 0;
1464d9ab8999SKristof Provost 	ghdr_new->reserved = 0;
1465d9ab8999SKristof Provost 
1466d9ab8999SKristof Provost 	nlattr_add_u32(nw, PF_LI_LIMIT, attrs.limit);
1467d9ab8999SKristof Provost 
1468d9ab8999SKristof Provost 	if (!nlmsg_end(nw)) {
1469d9ab8999SKristof Provost 		nlmsg_abort(nw);
1470d9ab8999SKristof Provost 		return (ENOMEM);
1471d9ab8999SKristof Provost 	}
1472d9ab8999SKristof Provost 
1473d9ab8999SKristof Provost 	return (0);
1474d9ab8999SKristof Provost }
1475d9ab8999SKristof Provost 
1476ba2a9207SKristof Provost static int
1477ba2a9207SKristof Provost pf_handle_begin_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt)
1478ba2a9207SKristof Provost {
1479ba2a9207SKristof Provost 	struct nl_writer *nw = npt->nw;
1480ba2a9207SKristof Provost 	struct genlmsghdr *ghdr_new;
1481ba2a9207SKristof Provost 	uint32_t ticket;
1482ba2a9207SKristof Provost 	int error;
1483ba2a9207SKristof Provost 
1484ba2a9207SKristof Provost 	error = pf_ioctl_begin_addrs(&ticket);
1485ba2a9207SKristof Provost 	if (error != 0)
1486ba2a9207SKristof Provost 		return (error);
1487ba2a9207SKristof Provost 
1488ba2a9207SKristof Provost 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1489ba2a9207SKristof Provost 		return (ENOMEM);
1490ba2a9207SKristof Provost 
1491ba2a9207SKristof Provost 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1492ba2a9207SKristof Provost 	ghdr_new->cmd = PFNL_CMD_BEGIN_ADDRS;
1493ba2a9207SKristof Provost 	ghdr_new->version = 0;
1494ba2a9207SKristof Provost 	ghdr_new->reserved = 0;
1495ba2a9207SKristof Provost 
1496ba2a9207SKristof Provost 	nlattr_add_u32(nw, PF_BA_TICKET, ticket);
1497ba2a9207SKristof Provost 
1498ba2a9207SKristof Provost 	if (!nlmsg_end(nw)) {
1499ba2a9207SKristof Provost 		nlmsg_abort(nw);
1500ba2a9207SKristof Provost 		return (ENOMEM);
1501ba2a9207SKristof Provost 	}
1502ba2a9207SKristof Provost 
1503ba2a9207SKristof Provost 	return (0);
1504ba2a9207SKristof Provost }
1505ba2a9207SKristof Provost 
1506644b7b5aSKristof Provost static bool
1507644b7b5aSKristof Provost nlattr_add_pool_addr(struct nl_writer *nw, int attrtype, struct pf_pooladdr *a)
1508644b7b5aSKristof Provost {
1509644b7b5aSKristof Provost 	int off;
1510644b7b5aSKristof Provost 
1511644b7b5aSKristof Provost 	off = nlattr_add_nested(nw, attrtype);
1512644b7b5aSKristof Provost 
1513644b7b5aSKristof Provost 	nlattr_add_addr_wrap(nw, PF_PA_ADDR, &a->addr);
1514644b7b5aSKristof Provost 	nlattr_add_string(nw, PF_PA_IFNAME, a->ifname);
1515644b7b5aSKristof Provost 
1516644b7b5aSKristof Provost 	nlattr_set_len(nw, off);
1517644b7b5aSKristof Provost 
1518644b7b5aSKristof Provost 	return (true);
1519644b7b5aSKristof Provost }
1520644b7b5aSKristof Provost 
1521d909f06bSKristof Provost #define _OUT(_field)	offsetof(struct pf_pooladdr, _field)
1522d909f06bSKristof Provost static const struct nlattr_parser nla_p_pool_addr[] = {
1523d909f06bSKristof Provost 	{ .type = PF_PA_ADDR, .off = _OUT(addr), .arg = &addr_wrap_parser, .cb = nlattr_get_nested },
1524d909f06bSKristof Provost 	{ .type = PF_PA_IFNAME, .off = _OUT(ifname), .arg = (void *)IFNAMSIZ, .cb = nlattr_get_chara },
1525d909f06bSKristof Provost };
1526d909f06bSKristof Provost NL_DECLARE_ATTR_PARSER(pool_addr_parser, nla_p_pool_addr);
1527d909f06bSKristof Provost #undef _OUT
1528d909f06bSKristof Provost 
1529d909f06bSKristof Provost #define	_OUT(_field)	offsetof(struct pfioc_pooladdr, _field)
1530d909f06bSKristof Provost static const struct nlattr_parser nla_p_add_addr[] = {
1531d909f06bSKristof Provost 	{ .type = PF_AA_ACTION, .off = _OUT(action), .cb = nlattr_get_uint32 },
1532d909f06bSKristof Provost 	{ .type = PF_AA_TICKET, .off = _OUT(ticket), .cb = nlattr_get_uint32 },
1533d909f06bSKristof Provost 	{ .type = PF_AA_NR, .off = _OUT(nr), .cb = nlattr_get_uint32 },
1534d909f06bSKristof Provost 	{ .type = PF_AA_R_NUM, .off = _OUT(r_num), .cb = nlattr_get_uint32 },
1535d909f06bSKristof Provost 	{ .type = PF_AA_R_ACTION, .off = _OUT(r_action), .cb = nlattr_get_uint8 },
1536d909f06bSKristof Provost 	{ .type = PF_AA_R_LAST, .off = _OUT(r_last), .cb = nlattr_get_uint8 },
1537d909f06bSKristof Provost 	{ .type = PF_AA_AF, .off = _OUT(af), .cb = nlattr_get_uint8 },
1538d909f06bSKristof Provost 	{ .type = PF_AA_ANCHOR, .off = _OUT(anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara },
1539d909f06bSKristof Provost 	{ .type = PF_AA_ADDR, .off = _OUT(addr), .arg = &pool_addr_parser, .cb = nlattr_get_nested },
1540d909f06bSKristof Provost };
1541d909f06bSKristof Provost static const struct nlfield_parser nlf_p_add_addr[] = {};
1542d909f06bSKristof Provost #undef _OUT
1543d909f06bSKristof Provost NL_DECLARE_PARSER(add_addr_parser, struct genlmsghdr, nlf_p_add_addr, nla_p_add_addr);
1544d909f06bSKristof Provost 
1545d909f06bSKristof Provost static int
1546d909f06bSKristof Provost pf_handle_add_addr(struct nlmsghdr *hdr, struct nl_pstate *npt)
1547d909f06bSKristof Provost {
1548d909f06bSKristof Provost 	struct pfioc_pooladdr attrs = { 0 };
1549d909f06bSKristof Provost 	int error;
1550d909f06bSKristof Provost 
1551d909f06bSKristof Provost 	error = nl_parse_nlmsg(hdr, &add_addr_parser, npt, &attrs);
1552d909f06bSKristof Provost 	if (error != 0)
1553d909f06bSKristof Provost 		return (error);
1554d909f06bSKristof Provost 
1555d909f06bSKristof Provost 	error = pf_ioctl_add_addr(&attrs);
1556d909f06bSKristof Provost 
1557d909f06bSKristof Provost 	return (error);
1558d909f06bSKristof Provost }
1559d909f06bSKristof Provost 
1560644b7b5aSKristof Provost static int
1561644b7b5aSKristof Provost pf_handle_get_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt)
1562644b7b5aSKristof Provost {
1563644b7b5aSKristof Provost 	struct pfioc_pooladdr attrs = { 0 };
1564644b7b5aSKristof Provost 	struct nl_writer *nw = npt->nw;
1565644b7b5aSKristof Provost 	struct genlmsghdr *ghdr_new;
1566644b7b5aSKristof Provost 	int error;
1567644b7b5aSKristof Provost 
1568644b7b5aSKristof Provost 	error = nl_parse_nlmsg(hdr, &add_addr_parser, npt, &attrs);
1569644b7b5aSKristof Provost 	if (error != 0)
1570644b7b5aSKristof Provost 		return (error);
1571644b7b5aSKristof Provost 
1572644b7b5aSKristof Provost 	error = pf_ioctl_get_addrs(&attrs);
1573644b7b5aSKristof Provost 	if (error != 0)
1574644b7b5aSKristof Provost 		return (error);
1575644b7b5aSKristof Provost 
1576644b7b5aSKristof Provost 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1577644b7b5aSKristof Provost 		return (ENOMEM);
1578644b7b5aSKristof Provost 
1579644b7b5aSKristof Provost 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1580644b7b5aSKristof Provost 	ghdr_new->cmd = PFNL_CMD_GET_ADDRS;
1581644b7b5aSKristof Provost 	ghdr_new->version = 0;
1582644b7b5aSKristof Provost 	ghdr_new->reserved = 0;
1583644b7b5aSKristof Provost 
1584644b7b5aSKristof Provost 	nlattr_add_u32(nw, PF_AA_NR, attrs.nr);
1585644b7b5aSKristof Provost 
1586644b7b5aSKristof Provost 	if (!nlmsg_end(nw)) {
1587644b7b5aSKristof Provost 		nlmsg_abort(nw);
1588644b7b5aSKristof Provost 		return (ENOMEM);
1589644b7b5aSKristof Provost 	}
1590644b7b5aSKristof Provost 
1591644b7b5aSKristof Provost 	return (error);
1592644b7b5aSKristof Provost }
1593644b7b5aSKristof Provost 
15949ae91f59SKristof Provost static int
15959ae91f59SKristof Provost pf_handle_get_addr(struct nlmsghdr *hdr, struct nl_pstate *npt)
15969ae91f59SKristof Provost {
15979ae91f59SKristof Provost 	struct pfioc_pooladdr attrs = { 0 };
15989ae91f59SKristof Provost 	struct nl_writer *nw = npt->nw;
15999ae91f59SKristof Provost 	struct genlmsghdr *ghdr_new;
16009ae91f59SKristof Provost 	int error;
16019ae91f59SKristof Provost 
16029ae91f59SKristof Provost 	error = nl_parse_nlmsg(hdr, &add_addr_parser, npt, &attrs);
16039ae91f59SKristof Provost 	if (error != 0)
16049ae91f59SKristof Provost 		return (error);
16059ae91f59SKristof Provost 
16069ae91f59SKristof Provost 	error = pf_ioctl_get_addr(&attrs);
16079ae91f59SKristof Provost 	if (error != 0)
16089ae91f59SKristof Provost 		return (error);
16099ae91f59SKristof Provost 
16109ae91f59SKristof Provost 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
16119ae91f59SKristof Provost 		return (ENOMEM);
16129ae91f59SKristof Provost 
16139ae91f59SKristof Provost 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
16149ae91f59SKristof Provost 	ghdr_new->cmd = PFNL_CMD_GET_ADDRS;
16159ae91f59SKristof Provost 	ghdr_new->version = 0;
16169ae91f59SKristof Provost 	ghdr_new->reserved = 0;
16179ae91f59SKristof Provost 
16189ae91f59SKristof Provost 	nlattr_add_u32(nw, PF_AA_ACTION, attrs.action);
16199ae91f59SKristof Provost 	nlattr_add_u32(nw, PF_AA_TICKET, attrs.ticket);
16209ae91f59SKristof Provost 	nlattr_add_u32(nw, PF_AA_NR, attrs.nr);
16219ae91f59SKristof Provost 	nlattr_add_u32(nw, PF_AA_R_NUM, attrs.r_num);
16229ae91f59SKristof Provost 	nlattr_add_u8(nw, PF_AA_R_ACTION, attrs.r_action);
16239ae91f59SKristof Provost 	nlattr_add_u8(nw, PF_AA_R_LAST, attrs.r_last);
16249ae91f59SKristof Provost 	nlattr_add_u8(nw, PF_AA_AF, attrs.af);
16259ae91f59SKristof Provost 	nlattr_add_string(nw, PF_AA_ANCHOR, attrs.anchor);
16269ae91f59SKristof Provost 	nlattr_add_pool_addr(nw, PF_AA_ADDR, &attrs.addr);
16279ae91f59SKristof Provost 
16289ae91f59SKristof Provost 	if (!nlmsg_end(nw)) {
16299ae91f59SKristof Provost 		nlmsg_abort(nw);
16309ae91f59SKristof Provost 		return (ENOMEM);
16319ae91f59SKristof Provost 	}
16329ae91f59SKristof Provost 
16339ae91f59SKristof Provost 	return (0);
16349ae91f59SKristof Provost }
16359ae91f59SKristof Provost 
163644f323ecSKristof Provost static const struct nlhdr_parser *all_parsers[] = {
163744f323ecSKristof Provost 	&state_parser,
163844f323ecSKristof Provost 	&addrule_parser,
1639706d465dSKristof Provost 	&getrules_parser,
1640706d465dSKristof Provost 	&clear_states_parser,
1641470a2b33SKristof Provost 	&set_statusif_parser,
164271d3c704SKristof Provost 	&natlook_parser,
1643c36c90a2SKristof Provost 	&set_debug_parser,
164430bad751SKristof Provost 	&set_timeout_parser,
1645d9ab8999SKristof Provost 	&set_limit_parser,
1646d909f06bSKristof Provost 	&pool_addr_parser,
1647d909f06bSKristof Provost 	&add_addr_parser,
164844f323ecSKristof Provost };
16492cef6288SAlexander V. Chernikov 
16502cef6288SAlexander V. Chernikov static int family_id;
16512cef6288SAlexander V. Chernikov 
16522cef6288SAlexander V. Chernikov static const struct genl_cmd pf_cmds[] = {
16532cef6288SAlexander V. Chernikov 	{
16542cef6288SAlexander V. Chernikov 		.cmd_num = PFNL_CMD_GETSTATES,
16552cef6288SAlexander V. Chernikov 		.cmd_name = "GETSTATES",
16562cef6288SAlexander V. Chernikov 		.cmd_cb = pf_handle_getstates,
16572cef6288SAlexander V. Chernikov 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1658e774c1efSKristof Provost 		.cmd_priv = PRIV_NETINET_PF,
16592cef6288SAlexander V. Chernikov 	},
1660a7191e5dSKristof Provost 	{
1661a7191e5dSKristof Provost 		.cmd_num = PFNL_CMD_GETCREATORS,
1662a7191e5dSKristof Provost 		.cmd_name = "GETCREATORS",
1663a7191e5dSKristof Provost 		.cmd_cb = pf_handle_getcreators,
1664a7191e5dSKristof Provost 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1665e774c1efSKristof Provost 		.cmd_priv = PRIV_NETINET_PF,
1666a7191e5dSKristof Provost 	},
166781647eb6SKristof Provost 	{
166881647eb6SKristof Provost 		.cmd_num = PFNL_CMD_START,
166981647eb6SKristof Provost 		.cmd_name = "START",
167081647eb6SKristof Provost 		.cmd_cb = pf_handle_start,
167181647eb6SKristof Provost 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
1672e774c1efSKristof Provost 		.cmd_priv = PRIV_NETINET_PF,
167381647eb6SKristof Provost 	},
167481647eb6SKristof Provost 	{
167581647eb6SKristof Provost 		.cmd_num = PFNL_CMD_STOP,
167681647eb6SKristof Provost 		.cmd_name = "STOP",
167781647eb6SKristof Provost 		.cmd_cb = pf_handle_stop,
167881647eb6SKristof Provost 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
1679e774c1efSKristof Provost 		.cmd_priv = PRIV_NETINET_PF,
168081647eb6SKristof Provost 	},
1681ffbf2595SKristof Provost 	{
1682ffbf2595SKristof Provost 		.cmd_num = PFNL_CMD_ADDRULE,
1683ffbf2595SKristof Provost 		.cmd_name = "ADDRULE",
1684ffbf2595SKristof Provost 		.cmd_cb = pf_handle_addrule,
1685ffbf2595SKristof Provost 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1686e774c1efSKristof Provost 		.cmd_priv = PRIV_NETINET_PF,
1687ffbf2595SKristof Provost 	},
168844f323ecSKristof Provost 	{
168944f323ecSKristof Provost 		.cmd_num = PFNL_CMD_GETRULES,
169044f323ecSKristof Provost 		.cmd_name = "GETRULES",
169144f323ecSKristof Provost 		.cmd_cb = pf_handle_getrules,
169244f323ecSKristof Provost 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1693e774c1efSKristof Provost 		.cmd_priv = PRIV_NETINET_PF,
169444f323ecSKristof Provost 	},
1695777a4702SKristof Provost 	{
1696777a4702SKristof Provost 		.cmd_num = PFNL_CMD_GETRULE,
1697777a4702SKristof Provost 		.cmd_name = "GETRULE",
1698777a4702SKristof Provost 		.cmd_cb = pf_handle_getrule,
1699777a4702SKristof Provost 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1700777a4702SKristof Provost 		.cmd_priv = PRIV_NETINET_PF,
1701777a4702SKristof Provost 	},
1702706d465dSKristof Provost 	{
1703706d465dSKristof Provost 		.cmd_num = PFNL_CMD_CLRSTATES,
1704706d465dSKristof Provost 		.cmd_name = "CLRSTATES",
1705706d465dSKristof Provost 		.cmd_cb = pf_handle_clear_states,
1706706d465dSKristof Provost 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1707706d465dSKristof Provost 		.cmd_priv = PRIV_NETINET_PF,
1708706d465dSKristof Provost 	},
1709706d465dSKristof Provost 	{
1710706d465dSKristof Provost 		.cmd_num = PFNL_CMD_KILLSTATES,
1711706d465dSKristof Provost 		.cmd_name = "KILLSTATES",
1712706d465dSKristof Provost 		.cmd_cb = pf_handle_kill_states,
1713706d465dSKristof Provost 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1714706d465dSKristof Provost 		.cmd_priv = PRIV_NETINET_PF,
1715706d465dSKristof Provost 	},
1716470a2b33SKristof Provost 	{
1717470a2b33SKristof Provost 		.cmd_num = PFNL_CMD_SET_STATUSIF,
1718470a2b33SKristof Provost 		.cmd_name = "SETSTATUSIF",
1719470a2b33SKristof Provost 		.cmd_cb = pf_handle_set_statusif,
1720470a2b33SKristof Provost 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
1721470a2b33SKristof Provost 		.cmd_priv = PRIV_NETINET_PF,
17225824df8dSKristof Provost 	},
17235824df8dSKristof Provost 	{
17245824df8dSKristof Provost 		.cmd_num = PFNL_CMD_GET_STATUS,
17255824df8dSKristof Provost 		.cmd_name = "GETSTATUS",
17265824df8dSKristof Provost 		.cmd_cb = pf_handle_get_status,
17275824df8dSKristof Provost 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
17285824df8dSKristof Provost 		.cmd_priv = PRIV_NETINET_PF,
17295824df8dSKristof Provost 	},
17309dbbe68bSKristof Provost 	{
17319dbbe68bSKristof Provost 		.cmd_num = PFNL_CMD_CLEAR_STATUS,
17329dbbe68bSKristof Provost 		.cmd_name = "CLEARSTATUS",
17339dbbe68bSKristof Provost 		.cmd_cb = pf_handle_clear_status,
17349dbbe68bSKristof Provost 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
17359dbbe68bSKristof Provost 		.cmd_priv = PRIV_NETINET_PF,
17369dbbe68bSKristof Provost 	},
173771d3c704SKristof Provost 	{
173871d3c704SKristof Provost 		.cmd_num = PFNL_CMD_NATLOOK,
173971d3c704SKristof Provost 		.cmd_name = "NATLOOK",
174071d3c704SKristof Provost 		.cmd_cb = pf_handle_natlook,
174171d3c704SKristof Provost 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
174271d3c704SKristof Provost 		.cmd_priv = PRIV_NETINET_PF,
174371d3c704SKristof Provost 	},
1744c36c90a2SKristof Provost 	{
1745c36c90a2SKristof Provost 		.cmd_num = PFNL_CMD_SET_DEBUG,
1746c36c90a2SKristof Provost 		.cmd_name = "SET_DEBUG",
1747c36c90a2SKristof Provost 		.cmd_cb = pf_handle_set_debug,
1748c36c90a2SKristof Provost 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
1749c36c90a2SKristof Provost 		.cmd_priv = PRIV_NETINET_PF,
1750c36c90a2SKristof Provost 	},
175130bad751SKristof Provost 	{
175230bad751SKristof Provost 		.cmd_num = PFNL_CMD_SET_TIMEOUT,
175330bad751SKristof Provost 		.cmd_name = "SET_TIMEOUT",
175430bad751SKristof Provost 		.cmd_cb = pf_handle_set_timeout,
175530bad751SKristof Provost 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
175630bad751SKristof Provost 		.cmd_priv = PRIV_NETINET_PF,
175730bad751SKristof Provost 	},
175830bad751SKristof Provost 	{
175930bad751SKristof Provost 		.cmd_num = PFNL_CMD_GET_TIMEOUT,
176030bad751SKristof Provost 		.cmd_name = "GET_TIMEOUT",
176130bad751SKristof Provost 		.cmd_cb = pf_handle_get_timeout,
176230bad751SKristof Provost 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
176330bad751SKristof Provost 		.cmd_priv = PRIV_NETINET_PF,
176430bad751SKristof Provost 	},
1765d9ab8999SKristof Provost 	{
1766d9ab8999SKristof Provost 		.cmd_num = PFNL_CMD_SET_LIMIT,
1767d9ab8999SKristof Provost 		.cmd_name = "SET_LIMIT",
1768d9ab8999SKristof Provost 		.cmd_cb = pf_handle_set_limit,
1769d9ab8999SKristof Provost 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
1770d9ab8999SKristof Provost 		.cmd_priv = PRIV_NETINET_PF,
1771d9ab8999SKristof Provost 	},
1772d9ab8999SKristof Provost 	{
1773d9ab8999SKristof Provost 		.cmd_num = PFNL_CMD_GET_LIMIT,
1774d9ab8999SKristof Provost 		.cmd_name = "GET_LIMIT",
1775d9ab8999SKristof Provost 		.cmd_cb = pf_handle_get_limit,
1776d9ab8999SKristof Provost 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1777d9ab8999SKristof Provost 		.cmd_priv = PRIV_NETINET_PF,
1778d9ab8999SKristof Provost 	},
1779ba2a9207SKristof Provost 	{
1780ba2a9207SKristof Provost 		.cmd_num = PFNL_CMD_BEGIN_ADDRS,
1781ba2a9207SKristof Provost 		.cmd_name = "BEGIN_ADDRS",
1782ba2a9207SKristof Provost 		.cmd_cb = pf_handle_begin_addrs,
1783ba2a9207SKristof Provost 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1784ba2a9207SKristof Provost 		.cmd_priv = PRIV_NETINET_PF,
1785ba2a9207SKristof Provost 	},
1786d909f06bSKristof Provost 	{
1787d909f06bSKristof Provost 		.cmd_num = PFNL_CMD_ADD_ADDR,
1788d909f06bSKristof Provost 		.cmd_name = "ADD_ADDR",
1789d909f06bSKristof Provost 		.cmd_cb = pf_handle_add_addr,
1790d909f06bSKristof Provost 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
1791d909f06bSKristof Provost 		.cmd_priv = PRIV_NETINET_PF,
1792d909f06bSKristof Provost 	},
1793644b7b5aSKristof Provost 	{
1794644b7b5aSKristof Provost 		.cmd_num = PFNL_CMD_GET_ADDRS,
1795644b7b5aSKristof Provost 		.cmd_name = "GET_ADDRS",
1796644b7b5aSKristof Provost 		.cmd_cb = pf_handle_get_addrs,
1797644b7b5aSKristof Provost 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1798644b7b5aSKristof Provost 		.cmd_priv = PRIV_NETINET_PF,
1799644b7b5aSKristof Provost 	},
18009ae91f59SKristof Provost 	{
18019ae91f59SKristof Provost 		.cmd_num = PFNL_CMD_GET_ADDR,
18029ae91f59SKristof Provost 		.cmd_name = "GET_ADDRS",
18039ae91f59SKristof Provost 		.cmd_cb = pf_handle_get_addr,
18049ae91f59SKristof Provost 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
18059ae91f59SKristof Provost 		.cmd_priv = PRIV_NETINET_PF,
18069ae91f59SKristof Provost 	},
18072cef6288SAlexander V. Chernikov };
18082cef6288SAlexander V. Chernikov 
18092cef6288SAlexander V. Chernikov void
18102cef6288SAlexander V. Chernikov pf_nl_register(void)
18112cef6288SAlexander V. Chernikov {
18122cef6288SAlexander V. Chernikov 	NL_VERIFY_PARSERS(all_parsers);
1813ffbf2595SKristof Provost 
18142cef6288SAlexander V. Chernikov 	family_id = genl_register_family(PFNL_FAMILY_NAME, 0, 2, PFNL_CMD_MAX);
18152cef6288SAlexander V. Chernikov 	genl_register_cmds(PFNL_FAMILY_NAME, pf_cmds, NL_ARRAY_LEN(pf_cmds));
18162cef6288SAlexander V. Chernikov }
18172cef6288SAlexander V. Chernikov 
18182cef6288SAlexander V. Chernikov void
18192cef6288SAlexander V. Chernikov pf_nl_unregister(void)
18202cef6288SAlexander V. Chernikov {
18212cef6288SAlexander V. Chernikov 	genl_unregister_family(PFNL_FAMILY_NAME);
18222cef6288SAlexander V. Chernikov }
1823