12cef6288SAlexander V. Chernikov /*- 22cef6288SAlexander V. Chernikov * SPDX-License-Identifier: BSD-2-Clause 32cef6288SAlexander V. Chernikov * 42cef6288SAlexander V. Chernikov * Copyright (c) 2023 Alexander V. Chernikov <melifaro@FreeBSD.org> 52cef6288SAlexander V. Chernikov * Copyright (c) 2023 Rubicon Communications, LLC (Netgate) 62cef6288SAlexander V. Chernikov * 72cef6288SAlexander V. Chernikov * Redistribution and use in source and binary forms, with or without 82cef6288SAlexander V. Chernikov * modification, are permitted provided that the following conditions 92cef6288SAlexander V. Chernikov * are met: 102cef6288SAlexander V. Chernikov * 1. Redistributions of source code must retain the above copyright 112cef6288SAlexander V. Chernikov * notice, this list of conditions and the following disclaimer. 122cef6288SAlexander V. Chernikov * 2. Redistributions in binary form must reproduce the above copyright 132cef6288SAlexander V. Chernikov * notice, this list of conditions and the following disclaimer in the 142cef6288SAlexander V. Chernikov * documentation and/or other materials provided with the distribution. 152cef6288SAlexander V. Chernikov * 162cef6288SAlexander V. Chernikov * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 172cef6288SAlexander V. Chernikov * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 182cef6288SAlexander V. Chernikov * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 192cef6288SAlexander V. Chernikov * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 202cef6288SAlexander V. Chernikov * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 212cef6288SAlexander V. Chernikov * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 222cef6288SAlexander V. Chernikov * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 232cef6288SAlexander V. Chernikov * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 242cef6288SAlexander V. Chernikov * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 252cef6288SAlexander V. Chernikov * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 262cef6288SAlexander V. Chernikov * SUCH DAMAGE. 272cef6288SAlexander V. Chernikov * 282cef6288SAlexander V. Chernikov */ 2971d3c704SKristof Provost #include <sys/cdefs.h> 3071d3c704SKristof Provost #include "opt_inet.h" 3171d3c704SKristof Provost #include "opt_inet6.h" 322cef6288SAlexander V. Chernikov 332cef6288SAlexander V. Chernikov #include <sys/param.h> 342cef6288SAlexander V. Chernikov #include <sys/malloc.h> 352cef6288SAlexander V. Chernikov #include <sys/mbuf.h> 36e774c1efSKristof Provost #include <sys/priv.h> 372cef6288SAlexander V. Chernikov #include <sys/socket.h> 387b2ab18fSKonstantin Belousov #include <sys/ucred.h> 392cef6288SAlexander V. Chernikov 402cef6288SAlexander V. Chernikov #include <net/pfvar.h> 412cef6288SAlexander V. Chernikov 422cef6288SAlexander V. Chernikov #include <netlink/netlink.h> 432cef6288SAlexander V. Chernikov #include <netlink/netlink_ctl.h> 442cef6288SAlexander V. Chernikov #include <netlink/netlink_generic.h> 452cef6288SAlexander V. Chernikov #include <netlink/netlink_message_writer.h> 462cef6288SAlexander V. Chernikov 472cef6288SAlexander V. Chernikov #include <netpfil/pf/pf_nl.h> 482cef6288SAlexander V. Chernikov 492cef6288SAlexander V. Chernikov #define DEBUG_MOD_NAME nl_pf 502cef6288SAlexander V. Chernikov #define DEBUG_MAX_LEVEL LOG_DEBUG3 512cef6288SAlexander V. Chernikov #include <netlink/netlink_debug.h> 522cef6288SAlexander V. Chernikov _DECLARE_DEBUG(LOG_DEBUG); 532cef6288SAlexander V. Chernikov 542cef6288SAlexander V. Chernikov struct nl_parsed_state { 552cef6288SAlexander V. Chernikov uint8_t version; 562cef6288SAlexander V. Chernikov uint32_t id; 572cef6288SAlexander V. Chernikov uint32_t creatorid; 58044eef6aSKristof Provost char ifname[IFNAMSIZ]; 59044eef6aSKristof Provost uint16_t proto; 60044eef6aSKristof Provost sa_family_t af; 61044eef6aSKristof Provost struct pf_addr addr; 62044eef6aSKristof Provost struct pf_addr mask; 632cef6288SAlexander V. Chernikov }; 642cef6288SAlexander V. Chernikov 652cef6288SAlexander V. Chernikov #define _IN(_field) offsetof(struct genlmsghdr, _field) 662cef6288SAlexander V. Chernikov #define _OUT(_field) offsetof(struct nl_parsed_state, _field) 672cef6288SAlexander V. Chernikov static const struct nlattr_parser nla_p_state[] = { 682cef6288SAlexander V. Chernikov { .type = PF_ST_ID, .off = _OUT(id), .cb = nlattr_get_uint32 }, 692cef6288SAlexander V. Chernikov { .type = PF_ST_CREATORID, .off = _OUT(creatorid), .cb = nlattr_get_uint32 }, 70044eef6aSKristof Provost { .type = PF_ST_IFNAME, .arg = (const void *)IFNAMSIZ, .off = _OUT(ifname), .cb = nlattr_get_chara }, 71*e8ff5e56SKristof Provost { .type = PF_ST_AF, .off = _OUT(af), .cb = nlattr_get_uint8 }, 72044eef6aSKristof Provost { .type = PF_ST_PROTO, .off = _OUT(proto), .cb = nlattr_get_uint16 }, 73044eef6aSKristof Provost { .type = PF_ST_FILTER_ADDR, .off = _OUT(addr), .cb = nlattr_get_in6_addr }, 74044eef6aSKristof Provost { .type = PF_ST_FILTER_MASK, .off = _OUT(mask), .cb = nlattr_get_in6_addr }, 752cef6288SAlexander V. Chernikov }; 762cef6288SAlexander V. Chernikov static const struct nlfield_parser nlf_p_generic[] = { 772cef6288SAlexander V. Chernikov { .off_in = _IN(version), .off_out = _OUT(version), .cb = nlf_get_u8 }, 782cef6288SAlexander V. Chernikov }; 792cef6288SAlexander V. Chernikov #undef _IN 802cef6288SAlexander V. Chernikov #undef _OUT 812cef6288SAlexander V. Chernikov NL_DECLARE_PARSER(state_parser, struct genlmsghdr, nlf_p_generic, nla_p_state); 822cef6288SAlexander V. Chernikov 832cef6288SAlexander V. Chernikov static void 842cef6288SAlexander V. Chernikov dump_addr(struct nl_writer *nw, int attr, const struct pf_addr *addr, int af) 852cef6288SAlexander V. Chernikov { 862cef6288SAlexander V. Chernikov switch (af) { 872cef6288SAlexander V. Chernikov case AF_INET: 882cef6288SAlexander V. Chernikov nlattr_add(nw, attr, 4, &addr->v4); 892cef6288SAlexander V. Chernikov break; 902cef6288SAlexander V. Chernikov case AF_INET6: 912cef6288SAlexander V. Chernikov nlattr_add(nw, attr, 16, &addr->v6); 922cef6288SAlexander V. Chernikov break; 932cef6288SAlexander V. Chernikov }; 942cef6288SAlexander V. Chernikov } 952cef6288SAlexander V. Chernikov 962cef6288SAlexander V. Chernikov static bool 972cef6288SAlexander V. Chernikov dump_state_peer(struct nl_writer *nw, int attr, const struct pf_state_peer *peer) 982cef6288SAlexander V. Chernikov { 992cef6288SAlexander V. Chernikov int off = nlattr_add_nested(nw, attr); 1002cef6288SAlexander V. Chernikov if (off == 0) 1012cef6288SAlexander V. Chernikov return (false); 1022cef6288SAlexander V. Chernikov 1032cef6288SAlexander V. Chernikov nlattr_add_u32(nw, PF_STP_SEQLO, peer->seqlo); 1042cef6288SAlexander V. Chernikov nlattr_add_u32(nw, PF_STP_SEQHI, peer->seqhi); 1052cef6288SAlexander V. Chernikov nlattr_add_u32(nw, PF_STP_SEQDIFF, peer->seqdiff); 1062cef6288SAlexander V. Chernikov nlattr_add_u16(nw, PF_STP_MAX_WIN, peer->max_win); 1072cef6288SAlexander V. Chernikov nlattr_add_u16(nw, PF_STP_MSS, peer->mss); 1082cef6288SAlexander V. Chernikov nlattr_add_u8(nw, PF_STP_STATE, peer->state); 1092cef6288SAlexander V. Chernikov nlattr_add_u8(nw, PF_STP_WSCALE, peer->wscale); 1102cef6288SAlexander V. Chernikov 1112cef6288SAlexander V. Chernikov if (peer->scrub != NULL) { 1122cef6288SAlexander V. Chernikov struct pf_state_scrub *sc = peer->scrub; 1132cef6288SAlexander V. Chernikov uint16_t pfss_flags = sc->pfss_flags & PFSS_TIMESTAMP; 1142cef6288SAlexander V. Chernikov 1152cef6288SAlexander V. Chernikov nlattr_add_u16(nw, PF_STP_PFSS_FLAGS, pfss_flags); 1162cef6288SAlexander V. Chernikov nlattr_add_u32(nw, PF_STP_PFSS_TS_MOD, sc->pfss_ts_mod); 1172cef6288SAlexander V. Chernikov nlattr_add_u8(nw, PF_STP_PFSS_TTL, sc->pfss_ttl); 1182cef6288SAlexander V. Chernikov nlattr_add_u8(nw, PF_STP_SCRUB_FLAG, PFSYNC_SCRUB_FLAG_VALID); 1192cef6288SAlexander V. Chernikov } 1202cef6288SAlexander V. Chernikov nlattr_set_len(nw, off); 1212cef6288SAlexander V. Chernikov 1222cef6288SAlexander V. Chernikov return (true); 1232cef6288SAlexander V. Chernikov } 1242cef6288SAlexander V. Chernikov 1252cef6288SAlexander V. Chernikov static bool 1262cef6288SAlexander V. Chernikov dump_state_key(struct nl_writer *nw, int attr, const struct pf_state_key *key) 1272cef6288SAlexander V. Chernikov { 1282cef6288SAlexander V. Chernikov int off = nlattr_add_nested(nw, attr); 1292cef6288SAlexander V. Chernikov if (off == 0) 1302cef6288SAlexander V. Chernikov return (false); 1312cef6288SAlexander V. Chernikov 1322cef6288SAlexander V. Chernikov dump_addr(nw, PF_STK_ADDR0, &key->addr[0], key->af); 1332cef6288SAlexander V. Chernikov dump_addr(nw, PF_STK_ADDR1, &key->addr[1], key->af); 1342cef6288SAlexander V. Chernikov nlattr_add_u16(nw, PF_STK_PORT0, key->port[0]); 1352cef6288SAlexander V. Chernikov nlattr_add_u16(nw, PF_STK_PORT1, key->port[1]); 1362cef6288SAlexander V. Chernikov 1372cef6288SAlexander V. Chernikov nlattr_set_len(nw, off); 1382cef6288SAlexander V. Chernikov 1392cef6288SAlexander V. Chernikov return (true); 1402cef6288SAlexander V. Chernikov } 1412cef6288SAlexander V. Chernikov 1422cef6288SAlexander V. Chernikov static int 1432cef6288SAlexander V. Chernikov dump_state(struct nlpcb *nlp, const struct nlmsghdr *hdr, struct pf_kstate *s, 1442cef6288SAlexander V. Chernikov struct nl_pstate *npt) 1452cef6288SAlexander V. Chernikov { 1462cef6288SAlexander V. Chernikov struct nl_writer *nw = npt->nw; 1472cef6288SAlexander V. Chernikov int error = 0; 1482cef6288SAlexander V. Chernikov int af; 1492cef6288SAlexander V. Chernikov struct pf_state_key *key; 1502cef6288SAlexander V. Chernikov 151b1e0f0ffSKristof Provost PF_STATE_LOCK_ASSERT(s); 152b1e0f0ffSKristof Provost 1532cef6288SAlexander V. Chernikov if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 1542cef6288SAlexander V. Chernikov goto enomem; 1552cef6288SAlexander V. Chernikov 1562cef6288SAlexander V. Chernikov struct genlmsghdr *ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1572cef6288SAlexander V. Chernikov ghdr_new->cmd = PFNL_CMD_GETSTATES; 1582cef6288SAlexander V. Chernikov ghdr_new->version = 0; 1592cef6288SAlexander V. Chernikov ghdr_new->reserved = 0; 1602cef6288SAlexander V. Chernikov 1612cef6288SAlexander V. Chernikov nlattr_add_u64(nw, PF_ST_VERSION, PF_STATE_VERSION); 1622cef6288SAlexander V. Chernikov 1632cef6288SAlexander V. Chernikov key = s->key[PF_SK_WIRE]; 1642cef6288SAlexander V. Chernikov if (!dump_state_key(nw, PF_ST_KEY_WIRE, key)) 1652cef6288SAlexander V. Chernikov goto enomem; 1662cef6288SAlexander V. Chernikov key = s->key[PF_SK_STACK]; 1672cef6288SAlexander V. Chernikov if (!dump_state_key(nw, PF_ST_KEY_STACK, key)) 1682cef6288SAlexander V. Chernikov goto enomem; 1692cef6288SAlexander V. Chernikov 1702cef6288SAlexander V. Chernikov af = s->key[PF_SK_WIRE]->af; 1712cef6288SAlexander V. Chernikov nlattr_add_u8(nw, PF_ST_PROTO, s->key[PF_SK_WIRE]->proto); 1722cef6288SAlexander V. Chernikov nlattr_add_u8(nw, PF_ST_AF, af); 1732cef6288SAlexander V. Chernikov 1742cef6288SAlexander V. Chernikov nlattr_add_string(nw, PF_ST_IFNAME, s->kif->pfik_name); 1752cef6288SAlexander V. Chernikov nlattr_add_string(nw, PF_ST_ORIG_IFNAME, s->orig_kif->pfik_name); 1762cef6288SAlexander V. Chernikov dump_addr(nw, PF_ST_RT_ADDR, &s->rt_addr, af); 17704932601SKristof Provost nlattr_add_u32(nw, PF_ST_CREATION, time_uptime - (s->creation / 1000)); 1782cef6288SAlexander V. Chernikov uint32_t expire = pf_state_expires(s); 1792cef6288SAlexander V. Chernikov if (expire > time_uptime) 1802cef6288SAlexander V. Chernikov expire = expire - time_uptime; 1812cef6288SAlexander V. Chernikov nlattr_add_u32(nw, PF_ST_EXPIRE, expire); 1822cef6288SAlexander V. Chernikov nlattr_add_u8(nw, PF_ST_DIRECTION, s->direction); 1832cef6288SAlexander V. Chernikov nlattr_add_u8(nw, PF_ST_LOG, s->act.log); 1842cef6288SAlexander V. Chernikov nlattr_add_u8(nw, PF_ST_TIMEOUT, s->timeout); 1852cef6288SAlexander V. Chernikov nlattr_add_u16(nw, PF_ST_STATE_FLAGS, s->state_flags); 1862cef6288SAlexander V. Chernikov uint8_t sync_flags = 0; 1872cef6288SAlexander V. Chernikov if (s->src_node) 1882cef6288SAlexander V. Chernikov sync_flags |= PFSYNC_FLAG_SRCNODE; 1892cef6288SAlexander V. Chernikov if (s->nat_src_node) 1902cef6288SAlexander V. Chernikov sync_flags |= PFSYNC_FLAG_NATSRCNODE; 1912cef6288SAlexander V. Chernikov nlattr_add_u8(nw, PF_ST_SYNC_FLAGS, sync_flags); 1922cef6288SAlexander V. Chernikov nlattr_add_u64(nw, PF_ST_ID, s->id); 1932cef6288SAlexander V. Chernikov nlattr_add_u32(nw, PF_ST_CREATORID, htonl(s->creatorid)); 1942cef6288SAlexander V. Chernikov 1952cef6288SAlexander V. Chernikov nlattr_add_u32(nw, PF_ST_RULE, s->rule.ptr ? s->rule.ptr->nr : -1); 1962cef6288SAlexander V. Chernikov nlattr_add_u32(nw, PF_ST_ANCHOR, s->anchor.ptr ? s->anchor.ptr->nr : -1); 1972cef6288SAlexander V. Chernikov nlattr_add_u32(nw, PF_ST_NAT_RULE, s->nat_rule.ptr ? s->nat_rule.ptr->nr : -1); 1982cef6288SAlexander V. Chernikov 1992cef6288SAlexander V. Chernikov nlattr_add_u64(nw, PF_ST_PACKETS0, s->packets[0]); 2002cef6288SAlexander V. Chernikov nlattr_add_u64(nw, PF_ST_PACKETS1, s->packets[1]); 2012cef6288SAlexander V. Chernikov nlattr_add_u64(nw, PF_ST_BYTES0, s->bytes[0]); 2022cef6288SAlexander V. Chernikov nlattr_add_u64(nw, PF_ST_BYTES1, s->bytes[1]); 203881bf881SKristof Provost nlattr_add_u32(nw, PF_ST_RTABLEID, s->act.rtableid); 204881bf881SKristof Provost nlattr_add_u8(nw, PF_ST_MIN_TTL, s->act.min_ttl); 205881bf881SKristof Provost nlattr_add_u16(nw, PF_ST_MAX_MSS, s->act.max_mss); 206881bf881SKristof Provost nlattr_add_u16(nw, PF_ST_DNPIPE, s->act.dnpipe); 207881bf881SKristof Provost nlattr_add_u16(nw, PF_ST_DNRPIPE, s->act.dnrpipe); 208881bf881SKristof Provost nlattr_add_u8(nw, PF_ST_RT, s->rt); 209881bf881SKristof Provost if (s->rt_kif != NULL) 210881bf881SKristof Provost nlattr_add_string(nw, PF_ST_RT_IFNAME, s->rt_kif->pfik_name); 2112cef6288SAlexander V. Chernikov 2122cef6288SAlexander V. Chernikov if (!dump_state_peer(nw, PF_ST_PEER_SRC, &s->src)) 2132cef6288SAlexander V. Chernikov goto enomem; 2142cef6288SAlexander V. Chernikov if (!dump_state_peer(nw, PF_ST_PEER_DST, &s->dst)) 2152cef6288SAlexander V. Chernikov goto enomem; 2162cef6288SAlexander V. Chernikov 2172cef6288SAlexander V. Chernikov if (nlmsg_end(nw)) 2182cef6288SAlexander V. Chernikov return (0); 2192cef6288SAlexander V. Chernikov 2202cef6288SAlexander V. Chernikov enomem: 2212cef6288SAlexander V. Chernikov error = ENOMEM; 2222cef6288SAlexander V. Chernikov nlmsg_abort(nw); 2232cef6288SAlexander V. Chernikov return (error); 2242cef6288SAlexander V. Chernikov } 2252cef6288SAlexander V. Chernikov 2262cef6288SAlexander V. Chernikov static int 2272cef6288SAlexander V. Chernikov handle_dumpstates(struct nlpcb *nlp, struct nl_parsed_state *attrs, 2282cef6288SAlexander V. Chernikov struct nlmsghdr *hdr, struct nl_pstate *npt) 2292cef6288SAlexander V. Chernikov { 2302cef6288SAlexander V. Chernikov int error = 0; 2312cef6288SAlexander V. Chernikov 2322cef6288SAlexander V. Chernikov hdr->nlmsg_flags |= NLM_F_MULTI; 2332cef6288SAlexander V. Chernikov 234271f1469SKristof Provost for (int i = 0; i <= V_pf_hashmask; i++) { 2352cef6288SAlexander V. Chernikov struct pf_idhash *ih = &V_pf_idhash[i]; 2362cef6288SAlexander V. Chernikov struct pf_kstate *s; 2372cef6288SAlexander V. Chernikov 2382cef6288SAlexander V. Chernikov if (LIST_EMPTY(&ih->states)) 2392cef6288SAlexander V. Chernikov continue; 2402cef6288SAlexander V. Chernikov 2412cef6288SAlexander V. Chernikov PF_HASHROW_LOCK(ih); 2422cef6288SAlexander V. Chernikov LIST_FOREACH(s, &ih->states, entry) { 243044eef6aSKristof Provost sa_family_t af = s->key[PF_SK_WIRE]->af; 244044eef6aSKristof Provost 245044eef6aSKristof Provost if (s->timeout == PFTM_UNLINKED) 246044eef6aSKristof Provost continue; 247044eef6aSKristof Provost 248044eef6aSKristof Provost /* Filter */ 249044eef6aSKristof Provost if (attrs->creatorid != 0 && s->creatorid != attrs->creatorid) 250044eef6aSKristof Provost continue; 251044eef6aSKristof Provost if (attrs->ifname[0] != 0 && 252044eef6aSKristof Provost strncmp(attrs->ifname, s->kif->pfik_name, IFNAMSIZ) != 0) 253044eef6aSKristof Provost continue; 254044eef6aSKristof Provost if (attrs->proto != 0 && s->key[PF_SK_WIRE]->proto != attrs->proto) 255044eef6aSKristof Provost continue; 256044eef6aSKristof Provost if (attrs->af != 0 && af != attrs->af) 257044eef6aSKristof Provost continue; 258044eef6aSKristof Provost if (pf_match_addr(1, &s->key[PF_SK_WIRE]->addr[0], 259044eef6aSKristof Provost &attrs->mask, &attrs->addr, af) && 260044eef6aSKristof Provost pf_match_addr(1, &s->key[PF_SK_WIRE]->addr[1], 261044eef6aSKristof Provost &attrs->mask, &attrs->addr, af) && 262044eef6aSKristof Provost pf_match_addr(1, &s->key[PF_SK_STACK]->addr[0], 263044eef6aSKristof Provost &attrs->mask, &attrs->addr, af) && 264044eef6aSKristof Provost pf_match_addr(1, &s->key[PF_SK_STACK]->addr[1], 265044eef6aSKristof Provost &attrs->mask, &attrs->addr, af)) 266044eef6aSKristof Provost continue; 267044eef6aSKristof Provost 2682cef6288SAlexander V. Chernikov error = dump_state(nlp, hdr, s, npt); 2692cef6288SAlexander V. Chernikov if (error != 0) 2702cef6288SAlexander V. Chernikov break; 2712cef6288SAlexander V. Chernikov } 2722cef6288SAlexander V. Chernikov PF_HASHROW_UNLOCK(ih); 2732cef6288SAlexander V. Chernikov } 2742cef6288SAlexander V. Chernikov 2752cef6288SAlexander V. Chernikov if (!nlmsg_end_dump(npt->nw, error, hdr)) { 2762cef6288SAlexander V. Chernikov NL_LOG(LOG_DEBUG, "Unable to finalize the dump"); 2772cef6288SAlexander V. Chernikov return (ENOMEM); 2782cef6288SAlexander V. Chernikov } 2792cef6288SAlexander V. Chernikov 2802cef6288SAlexander V. Chernikov return (error); 2812cef6288SAlexander V. Chernikov } 2822cef6288SAlexander V. Chernikov 2832cef6288SAlexander V. Chernikov static int 2842cef6288SAlexander V. Chernikov handle_getstate(struct nlpcb *nlp, struct nl_parsed_state *attrs, 2852cef6288SAlexander V. Chernikov struct nlmsghdr *hdr, struct nl_pstate *npt) 2862cef6288SAlexander V. Chernikov { 287b1e0f0ffSKristof Provost struct pf_kstate *s; 288b1e0f0ffSKristof Provost int ret; 289b1e0f0ffSKristof Provost 290b1e0f0ffSKristof Provost s = pf_find_state_byid(attrs->id, attrs->creatorid); 2912cef6288SAlexander V. Chernikov if (s == NULL) 2922cef6288SAlexander V. Chernikov return (ENOENT); 293b1e0f0ffSKristof Provost ret = dump_state(nlp, hdr, s, npt); 294b1e0f0ffSKristof Provost PF_STATE_UNLOCK(s); 295b1e0f0ffSKristof Provost 296b1e0f0ffSKristof Provost return (ret); 2972cef6288SAlexander V. Chernikov } 2982cef6288SAlexander V. Chernikov 2992cef6288SAlexander V. Chernikov static int 300a7191e5dSKristof Provost dump_creatorid(struct nlpcb *nlp, const struct nlmsghdr *hdr, uint32_t creator, 301a7191e5dSKristof Provost struct nl_pstate *npt) 302a7191e5dSKristof Provost { 303a7191e5dSKristof Provost struct nl_writer *nw = npt->nw; 304a7191e5dSKristof Provost 305a7191e5dSKristof Provost if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 306a7191e5dSKristof Provost goto enomem; 307a7191e5dSKristof Provost 308a7191e5dSKristof Provost struct genlmsghdr *ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 309a7191e5dSKristof Provost ghdr_new->cmd = PFNL_CMD_GETCREATORS; 310a7191e5dSKristof Provost ghdr_new->version = 0; 311a7191e5dSKristof Provost ghdr_new->reserved = 0; 312a7191e5dSKristof Provost 313a7191e5dSKristof Provost nlattr_add_u32(nw, PF_ST_CREATORID, htonl(creator)); 314a7191e5dSKristof Provost 315a7191e5dSKristof Provost if (nlmsg_end(nw)) 316a7191e5dSKristof Provost return (0); 317a7191e5dSKristof Provost 318a7191e5dSKristof Provost enomem: 319a7191e5dSKristof Provost nlmsg_abort(nw); 320a7191e5dSKristof Provost return (ENOMEM); 321a7191e5dSKristof Provost } 322a7191e5dSKristof Provost 323a7191e5dSKristof Provost static int 3242cef6288SAlexander V. Chernikov pf_handle_getstates(struct nlmsghdr *hdr, struct nl_pstate *npt) 3252cef6288SAlexander V. Chernikov { 3262cef6288SAlexander V. Chernikov int error; 3272cef6288SAlexander V. Chernikov 3282cef6288SAlexander V. Chernikov struct nl_parsed_state attrs = {}; 3292cef6288SAlexander V. Chernikov error = nl_parse_nlmsg(hdr, &state_parser, npt, &attrs); 3302cef6288SAlexander V. Chernikov if (error != 0) 3312cef6288SAlexander V. Chernikov return (error); 3322cef6288SAlexander V. Chernikov 3332cef6288SAlexander V. Chernikov if (attrs.id != 0) 3342cef6288SAlexander V. Chernikov error = handle_getstate(npt->nlp, &attrs, hdr, npt); 3352cef6288SAlexander V. Chernikov else 3362cef6288SAlexander V. Chernikov error = handle_dumpstates(npt->nlp, &attrs, hdr, npt); 3372cef6288SAlexander V. Chernikov 3382cef6288SAlexander V. Chernikov return (error); 3392cef6288SAlexander V. Chernikov } 3402cef6288SAlexander V. Chernikov 341a7191e5dSKristof Provost static int 342a7191e5dSKristof Provost pf_handle_getcreators(struct nlmsghdr *hdr, struct nl_pstate *npt) 343a7191e5dSKristof Provost { 344a7191e5dSKristof Provost uint32_t creators[16]; 345a7191e5dSKristof Provost int error = 0; 346a7191e5dSKristof Provost 347a7191e5dSKristof Provost bzero(creators, sizeof(creators)); 348a7191e5dSKristof Provost 349271f1469SKristof Provost for (int i = 0; i < V_pf_hashmask; i++) { 350a7191e5dSKristof Provost struct pf_idhash *ih = &V_pf_idhash[i]; 351a7191e5dSKristof Provost struct pf_kstate *s; 352a7191e5dSKristof Provost 353a7191e5dSKristof Provost if (LIST_EMPTY(&ih->states)) 354a7191e5dSKristof Provost continue; 355a7191e5dSKristof Provost 356a7191e5dSKristof Provost PF_HASHROW_LOCK(ih); 357a7191e5dSKristof Provost LIST_FOREACH(s, &ih->states, entry) { 358a7191e5dSKristof Provost int j; 359a7191e5dSKristof Provost if (s->timeout == PFTM_UNLINKED) 360a7191e5dSKristof Provost continue; 361a7191e5dSKristof Provost 362a7191e5dSKristof Provost for (j = 0; j < nitems(creators); j++) { 363a7191e5dSKristof Provost if (creators[j] == s->creatorid) 364a7191e5dSKristof Provost break; 365a7191e5dSKristof Provost if (creators[j] == 0) { 366a7191e5dSKristof Provost creators[j] = s->creatorid; 367a7191e5dSKristof Provost break; 368a7191e5dSKristof Provost } 369a7191e5dSKristof Provost } 370a7191e5dSKristof Provost if (j == nitems(creators)) 371a7191e5dSKristof Provost printf("Warning: too many creators!\n"); 372a7191e5dSKristof Provost } 373a7191e5dSKristof Provost PF_HASHROW_UNLOCK(ih); 374a7191e5dSKristof Provost } 375a7191e5dSKristof Provost 376a7191e5dSKristof Provost hdr->nlmsg_flags |= NLM_F_MULTI; 377a7191e5dSKristof Provost for (int i = 0; i < nitems(creators); i++) { 378a7191e5dSKristof Provost if (creators[i] == 0) 379a7191e5dSKristof Provost break; 380a7191e5dSKristof Provost error = dump_creatorid(npt->nlp, hdr, creators[i], npt); 381a7191e5dSKristof Provost } 382a7191e5dSKristof Provost 383a7191e5dSKristof Provost if (!nlmsg_end_dump(npt->nw, error, hdr)) { 384a7191e5dSKristof Provost NL_LOG(LOG_DEBUG, "Unable to finalize the dump"); 385a7191e5dSKristof Provost return (ENOMEM); 386a7191e5dSKristof Provost } 387a7191e5dSKristof Provost 388a7191e5dSKristof Provost return (error); 389a7191e5dSKristof Provost } 390a7191e5dSKristof Provost 39181647eb6SKristof Provost static int 39281647eb6SKristof Provost pf_handle_start(struct nlmsghdr *hdr __unused, struct nl_pstate *npt __unused) 39381647eb6SKristof Provost { 39481647eb6SKristof Provost return (pf_start()); 39581647eb6SKristof Provost } 39681647eb6SKristof Provost 39781647eb6SKristof Provost static int 39881647eb6SKristof Provost pf_handle_stop(struct nlmsghdr *hdr __unused, struct nl_pstate *npt __unused) 39981647eb6SKristof Provost { 40081647eb6SKristof Provost return (pf_stop()); 40181647eb6SKristof Provost } 40281647eb6SKristof Provost 403ffbf2595SKristof Provost #define _OUT(_field) offsetof(struct pf_addr_wrap, _field) 404ffbf2595SKristof Provost static const struct nlattr_parser nla_p_addr_wrap[] = { 405ffbf2595SKristof Provost { .type = PF_AT_ADDR, .off = _OUT(v.a.addr), .cb = nlattr_get_in6_addr }, 406ffbf2595SKristof Provost { .type = PF_AT_MASK, .off = _OUT(v.a.mask), .cb = nlattr_get_in6_addr }, 407ffbf2595SKristof Provost { .type = PF_AT_IFNAME, .off = _OUT(v.ifname), .arg = (void *)IFNAMSIZ,.cb = nlattr_get_chara }, 408ffbf2595SKristof Provost { .type = PF_AT_TABLENAME, .off = _OUT(v.tblname), .arg = (void *)PF_TABLE_NAME_SIZE, .cb = nlattr_get_chara }, 409ffbf2595SKristof Provost { .type = PF_AT_TYPE, .off = _OUT(type), .cb = nlattr_get_uint8 }, 410ffbf2595SKristof Provost { .type = PF_AT_IFLAGS, .off = _OUT(iflags), .cb = nlattr_get_uint8 }, 411ffbf2595SKristof Provost }; 412ffbf2595SKristof Provost NL_DECLARE_ATTR_PARSER(addr_wrap_parser, nla_p_addr_wrap); 413ffbf2595SKristof Provost #undef _OUT 414ffbf2595SKristof Provost 415777a4702SKristof Provost static bool 416777a4702SKristof Provost nlattr_add_addr_wrap(struct nl_writer *nw, int attrtype, struct pf_addr_wrap *a) 417777a4702SKristof Provost { 418777a4702SKristof Provost int off = nlattr_add_nested(nw, attrtype); 419777a4702SKristof Provost 420777a4702SKristof Provost nlattr_add_in6_addr(nw, PF_AT_ADDR, &a->v.a.addr.v6); 421777a4702SKristof Provost nlattr_add_in6_addr(nw, PF_AT_MASK, &a->v.a.mask.v6); 422777a4702SKristof Provost nlattr_add_u8(nw, PF_AT_TYPE, a->type); 423777a4702SKristof Provost nlattr_add_u8(nw, PF_AT_IFLAGS, a->iflags); 424777a4702SKristof Provost 425777a4702SKristof Provost if (a->type == PF_ADDR_DYNIFTL) { 426777a4702SKristof Provost nlattr_add_string(nw, PF_AT_IFNAME, a->v.ifname); 4271fc0dac5SKajetan Staszkiewicz nlattr_add_u32(nw, PF_AT_DYNCNT, a->p.dyncnt); 428777a4702SKristof Provost } else if (a->type == PF_ADDR_TABLE) { 429777a4702SKristof Provost nlattr_add_string(nw, PF_AT_TABLENAME, a->v.tblname); 4301fc0dac5SKajetan Staszkiewicz nlattr_add_u32(nw, PF_AT_TBLCNT, a->p.tblcnt); 431777a4702SKristof Provost } 432777a4702SKristof Provost 433777a4702SKristof Provost nlattr_set_len(nw, off); 434777a4702SKristof Provost 435777a4702SKristof Provost return (true); 436777a4702SKristof Provost } 437777a4702SKristof Provost 438ffbf2595SKristof Provost #define _OUT(_field) offsetof(struct pf_rule_addr, _field) 439ffbf2595SKristof Provost static const struct nlattr_parser nla_p_ruleaddr[] = { 440ffbf2595SKristof Provost { .type = PF_RAT_ADDR, .off = _OUT(addr), .arg = &addr_wrap_parser, .cb = nlattr_get_nested }, 441ffbf2595SKristof Provost { .type = PF_RAT_SRC_PORT, .off = _OUT(port[0]), .cb = nlattr_get_uint16 }, 442ffbf2595SKristof Provost { .type = PF_RAT_DST_PORT, .off = _OUT(port[1]), .cb = nlattr_get_uint16 }, 443ffbf2595SKristof Provost { .type = PF_RAT_NEG, .off = _OUT(neg), .cb = nlattr_get_uint8 }, 444ffbf2595SKristof Provost { .type = PF_RAT_OP, .off = _OUT(port_op), .cb = nlattr_get_uint8 }, 445ffbf2595SKristof Provost }; 446ffbf2595SKristof Provost NL_DECLARE_ATTR_PARSER(rule_addr_parser, nla_p_ruleaddr); 447ffbf2595SKristof Provost #undef _OUT 448ffbf2595SKristof Provost 449777a4702SKristof Provost static bool 450777a4702SKristof Provost nlattr_add_rule_addr(struct nl_writer *nw, int attrtype, struct pf_rule_addr *r) 451777a4702SKristof Provost { 4521fc0dac5SKajetan Staszkiewicz struct pf_addr_wrap aw = {0}; 453777a4702SKristof Provost int off = nlattr_add_nested(nw, attrtype); 454777a4702SKristof Provost 4551fc0dac5SKajetan Staszkiewicz bcopy(&(r->addr), &aw, sizeof(struct pf_addr_wrap)); 4561fc0dac5SKajetan Staszkiewicz pf_addr_copyout(&aw); 4571fc0dac5SKajetan Staszkiewicz 4581fc0dac5SKajetan Staszkiewicz nlattr_add_addr_wrap(nw, PF_RAT_ADDR, &aw); 459777a4702SKristof Provost nlattr_add_u16(nw, PF_RAT_SRC_PORT, r->port[0]); 460777a4702SKristof Provost nlattr_add_u16(nw, PF_RAT_DST_PORT, r->port[1]); 461777a4702SKristof Provost nlattr_add_u8(nw, PF_RAT_NEG, r->neg); 462777a4702SKristof Provost nlattr_add_u8(nw, PF_RAT_OP, r->port_op); 463777a4702SKristof Provost 464777a4702SKristof Provost nlattr_set_len(nw, off); 465777a4702SKristof Provost 466777a4702SKristof Provost return (true); 467777a4702SKristof Provost } 468777a4702SKristof Provost 469ffbf2595SKristof Provost #define _OUT(_field) offsetof(struct pf_mape_portset, _field) 470ffbf2595SKristof Provost static const struct nlattr_parser nla_p_mape_portset[] = { 471ffbf2595SKristof Provost { .type = PF_MET_OFFSET, .off = _OUT(offset), .cb = nlattr_get_uint8 }, 472ffbf2595SKristof Provost { .type = PF_MET_PSID_LEN, .off = _OUT(psidlen), .cb = nlattr_get_uint8 }, 473ffbf2595SKristof Provost {. type = PF_MET_PSID, .off = _OUT(psid), .cb = nlattr_get_uint16 }, 474ffbf2595SKristof Provost }; 475ffbf2595SKristof Provost NL_DECLARE_ATTR_PARSER(mape_portset_parser, nla_p_mape_portset); 476ffbf2595SKristof Provost #undef _OUT 477ffbf2595SKristof Provost 478777a4702SKristof Provost static bool 479777a4702SKristof Provost nlattr_add_mape_portset(struct nl_writer *nw, int attrtype, const struct pf_mape_portset *m) 480777a4702SKristof Provost { 481777a4702SKristof Provost int off = nlattr_add_nested(nw, attrtype); 482777a4702SKristof Provost 483777a4702SKristof Provost nlattr_add_u8(nw, PF_MET_OFFSET, m->offset); 484777a4702SKristof Provost nlattr_add_u8(nw, PF_MET_PSID_LEN, m->psidlen); 485777a4702SKristof Provost nlattr_add_u16(nw, PF_MET_PSID, m->psid); 486777a4702SKristof Provost 487777a4702SKristof Provost nlattr_set_len(nw, off); 488777a4702SKristof Provost 489777a4702SKristof Provost return (true); 490777a4702SKristof Provost } 491777a4702SKristof Provost 492ffbf2595SKristof Provost struct nl_parsed_labels 493ffbf2595SKristof Provost { 494ffbf2595SKristof Provost char labels[PF_RULE_MAX_LABEL_COUNT][PF_RULE_LABEL_SIZE]; 495ffbf2595SKristof Provost uint32_t i; 496ffbf2595SKristof Provost }; 497ffbf2595SKristof Provost 498ffbf2595SKristof Provost static int 499ffbf2595SKristof Provost nlattr_get_pf_rule_labels(struct nlattr *nla, struct nl_pstate *npt, 500ffbf2595SKristof Provost const void *arg, void *target) 501ffbf2595SKristof Provost { 502ffbf2595SKristof Provost struct nl_parsed_labels *l = (struct nl_parsed_labels *)target; 503ffbf2595SKristof Provost int ret; 504ffbf2595SKristof Provost 505ffbf2595SKristof Provost if (l->i >= PF_RULE_MAX_LABEL_COUNT) 506ffbf2595SKristof Provost return (E2BIG); 507ffbf2595SKristof Provost 508ffbf2595SKristof Provost ret = nlattr_get_chara(nla, npt, (void *)PF_RULE_LABEL_SIZE, 509ffbf2595SKristof Provost l->labels[l->i]); 510ffbf2595SKristof Provost if (ret == 0) 511ffbf2595SKristof Provost l->i++; 512ffbf2595SKristof Provost 513ffbf2595SKristof Provost return (ret); 514ffbf2595SKristof Provost } 515ffbf2595SKristof Provost 516ffbf2595SKristof Provost #define _OUT(_field) offsetof(struct nl_parsed_labels, _field) 517ffbf2595SKristof Provost static const struct nlattr_parser nla_p_labels[] = { 518ffbf2595SKristof Provost { .type = PF_LT_LABEL, .off = 0, .cb = nlattr_get_pf_rule_labels }, 519ffbf2595SKristof Provost }; 520ffbf2595SKristof Provost NL_DECLARE_ATTR_PARSER(rule_labels_parser, nla_p_labels); 521ffbf2595SKristof Provost #undef _OUT 522ffbf2595SKristof Provost 523ffbf2595SKristof Provost static int 524ffbf2595SKristof Provost nlattr_get_nested_pf_rule_labels(struct nlattr *nla, struct nl_pstate *npt, const void *arg, void *target) 525ffbf2595SKristof Provost { 526ffbf2595SKristof Provost struct nl_parsed_labels parsed_labels = { }; 527ffbf2595SKristof Provost int error; 528ffbf2595SKristof Provost 529ffbf2595SKristof Provost /* Assumes target points to the beginning of the structure */ 530ffbf2595SKristof Provost error = nl_parse_header(NLA_DATA(nla), NLA_DATA_LEN(nla), &rule_labels_parser, npt, &parsed_labels); 531ffbf2595SKristof Provost if (error != 0) 532ffbf2595SKristof Provost return (error); 533ffbf2595SKristof Provost 53484ff9e91SKristof Provost memcpy(target, parsed_labels.labels, sizeof(parsed_labels.labels)); 535ffbf2595SKristof Provost 536ffbf2595SKristof Provost return (0); 537ffbf2595SKristof Provost } 538ffbf2595SKristof Provost 539777a4702SKristof Provost static bool 540777a4702SKristof Provost nlattr_add_labels(struct nl_writer *nw, int attrtype, const struct pf_krule *r) 541777a4702SKristof Provost { 542777a4702SKristof Provost int off = nlattr_add_nested(nw, attrtype); 543777a4702SKristof Provost int i = 0; 544777a4702SKristof Provost 545777a4702SKristof Provost while (r->label[i][0] != 0 546777a4702SKristof Provost && i < PF_RULE_MAX_LABEL_COUNT) { 547777a4702SKristof Provost nlattr_add_string(nw, PF_LT_LABEL, r->label[i]); 548777a4702SKristof Provost i++; 549777a4702SKristof Provost } 550777a4702SKristof Provost 551777a4702SKristof Provost nlattr_set_len(nw, off); 552777a4702SKristof Provost 553777a4702SKristof Provost return (true); 554777a4702SKristof Provost } 555777a4702SKristof Provost 556ffbf2595SKristof Provost #define _OUT(_field) offsetof(struct pf_kpool, _field) 557ffbf2595SKristof Provost static const struct nlattr_parser nla_p_pool[] = { 558ffbf2595SKristof Provost { .type = PF_PT_KEY, .off = _OUT(key), .arg = (void *)sizeof(struct pf_poolhashkey), .cb = nlattr_get_bytes }, 559ffbf2595SKristof Provost { .type = PF_PT_COUNTER, .off = _OUT(counter), .cb = nlattr_get_in6_addr }, 560ffbf2595SKristof Provost { .type = PF_PT_TBLIDX, .off = _OUT(tblidx), .cb = nlattr_get_uint32 }, 561ffbf2595SKristof Provost { .type = PF_PT_PROXY_SRC_PORT, .off = _OUT(proxy_port[0]), .cb = nlattr_get_uint16 }, 562ffbf2595SKristof Provost { .type = PF_PT_PROXY_DST_PORT, .off = _OUT(proxy_port[1]), .cb = nlattr_get_uint16 }, 563ffbf2595SKristof Provost { .type = PF_PT_OPTS, .off = _OUT(opts), .cb = nlattr_get_uint8 }, 564ffbf2595SKristof Provost { .type = PF_PT_MAPE, .off = _OUT(mape), .arg = &mape_portset_parser, .cb = nlattr_get_nested }, 565ffbf2595SKristof Provost }; 566ffbf2595SKristof Provost NL_DECLARE_ATTR_PARSER(pool_parser, nla_p_pool); 567ffbf2595SKristof Provost #undef _OUT 568ffbf2595SKristof Provost 569777a4702SKristof Provost static bool 570777a4702SKristof Provost nlattr_add_pool(struct nl_writer *nw, int attrtype, const struct pf_kpool *pool) 571777a4702SKristof Provost { 572777a4702SKristof Provost int off = nlattr_add_nested(nw, attrtype); 573777a4702SKristof Provost 574777a4702SKristof Provost nlattr_add(nw, PF_PT_KEY, sizeof(struct pf_poolhashkey), &pool->key); 575777a4702SKristof Provost nlattr_add_in6_addr(nw, PF_PT_COUNTER, (const struct in6_addr *)&pool->counter); 576777a4702SKristof Provost nlattr_add_u32(nw, PF_PT_TBLIDX, pool->tblidx); 577777a4702SKristof Provost nlattr_add_u16(nw, PF_PT_PROXY_SRC_PORT, pool->proxy_port[0]); 578777a4702SKristof Provost nlattr_add_u16(nw, PF_PT_PROXY_DST_PORT, pool->proxy_port[1]); 579777a4702SKristof Provost nlattr_add_u8(nw, PF_PT_OPTS, pool->opts); 580777a4702SKristof Provost nlattr_add_mape_portset(nw, PF_PT_MAPE, &pool->mape); 581777a4702SKristof Provost 582777a4702SKristof Provost nlattr_set_len(nw, off); 583777a4702SKristof Provost 584777a4702SKristof Provost return (true); 585777a4702SKristof Provost } 586777a4702SKristof Provost 587ffbf2595SKristof Provost #define _OUT(_field) offsetof(struct pf_rule_uid, _field) 588ffbf2595SKristof Provost static const struct nlattr_parser nla_p_rule_uid[] = { 589ffbf2595SKristof Provost { .type = PF_RUT_UID_LOW, .off = _OUT(uid[0]), .cb = nlattr_get_uint32 }, 590ffbf2595SKristof Provost { .type = PF_RUT_UID_HIGH, .off = _OUT(uid[1]), .cb = nlattr_get_uint32 }, 591ffbf2595SKristof Provost { .type = PF_RUT_OP, .off = _OUT(op), .cb = nlattr_get_uint8 }, 592ffbf2595SKristof Provost }; 593ffbf2595SKristof Provost NL_DECLARE_ATTR_PARSER(rule_uid_parser, nla_p_rule_uid); 594ffbf2595SKristof Provost #undef _OUT 595ffbf2595SKristof Provost 596777a4702SKristof Provost static bool 597777a4702SKristof Provost nlattr_add_rule_uid(struct nl_writer *nw, int attrtype, const struct pf_rule_uid *u) 598777a4702SKristof Provost { 599777a4702SKristof Provost int off = nlattr_add_nested(nw, attrtype); 600777a4702SKristof Provost 601777a4702SKristof Provost nlattr_add_u32(nw, PF_RUT_UID_LOW, u->uid[0]); 602777a4702SKristof Provost nlattr_add_u32(nw, PF_RUT_UID_HIGH, u->uid[1]); 603777a4702SKristof Provost nlattr_add_u8(nw, PF_RUT_OP, u->op); 604777a4702SKristof Provost 605777a4702SKristof Provost nlattr_set_len(nw, off); 606777a4702SKristof Provost 607777a4702SKristof Provost return (true); 608777a4702SKristof Provost } 609777a4702SKristof Provost 610ffbf2595SKristof Provost struct nl_parsed_timeouts 611ffbf2595SKristof Provost { 612ffbf2595SKristof Provost uint32_t timeouts[PFTM_MAX]; 613ffbf2595SKristof Provost uint32_t i; 614ffbf2595SKristof Provost }; 615ffbf2595SKristof Provost 616ffbf2595SKristof Provost static int 617ffbf2595SKristof Provost nlattr_get_pf_timeout(struct nlattr *nla, struct nl_pstate *npt, 618ffbf2595SKristof Provost const void *arg, void *target) 619ffbf2595SKristof Provost { 620ffbf2595SKristof Provost struct nl_parsed_timeouts *t = (struct nl_parsed_timeouts *)target; 621ffbf2595SKristof Provost int ret; 622ffbf2595SKristof Provost 623ffbf2595SKristof Provost if (t->i >= PFTM_MAX) 624ffbf2595SKristof Provost return (E2BIG); 625ffbf2595SKristof Provost 626ffbf2595SKristof Provost ret = nlattr_get_uint32(nla, npt, NULL, &t->timeouts[t->i]); 627ffbf2595SKristof Provost if (ret == 0) 628ffbf2595SKristof Provost t->i++; 629ffbf2595SKristof Provost 630ffbf2595SKristof Provost return (ret); 631ffbf2595SKristof Provost } 632ffbf2595SKristof Provost 633ffbf2595SKristof Provost #define _OUT(_field) offsetof(struct nl_parsed_timeout, _field) 634ffbf2595SKristof Provost static const struct nlattr_parser nla_p_timeouts[] = { 635ffbf2595SKristof Provost { .type = PF_TT_TIMEOUT, .off = 0, .cb = nlattr_get_pf_timeout }, 636ffbf2595SKristof Provost }; 637ffbf2595SKristof Provost NL_DECLARE_ATTR_PARSER(timeout_parser, nla_p_timeouts); 638ffbf2595SKristof Provost #undef _OUT 639ffbf2595SKristof Provost 640ffbf2595SKristof Provost static int 641ffbf2595SKristof Provost nlattr_get_nested_timeouts(struct nlattr *nla, struct nl_pstate *npt, const void *arg, void *target) 642ffbf2595SKristof Provost { 643ffbf2595SKristof Provost struct nl_parsed_timeouts parsed_timeouts = { }; 644ffbf2595SKristof Provost int error; 645ffbf2595SKristof Provost 646ffbf2595SKristof Provost /* Assumes target points to the beginning of the structure */ 647ffbf2595SKristof Provost error = nl_parse_header(NLA_DATA(nla), NLA_DATA_LEN(nla), &timeout_parser, npt, &parsed_timeouts); 648ffbf2595SKristof Provost if (error != 0) 649ffbf2595SKristof Provost return (error); 650ffbf2595SKristof Provost 651ffbf2595SKristof Provost memcpy(target, parsed_timeouts.timeouts, sizeof(parsed_timeouts.timeouts)); 652ffbf2595SKristof Provost 653ffbf2595SKristof Provost return (0); 654ffbf2595SKristof Provost } 655ffbf2595SKristof Provost 656777a4702SKristof Provost static bool 657777a4702SKristof Provost nlattr_add_timeout(struct nl_writer *nw, int attrtype, uint32_t *timeout) 658777a4702SKristof Provost { 659777a4702SKristof Provost int off = nlattr_add_nested(nw, attrtype); 660777a4702SKristof Provost 661777a4702SKristof Provost for (int i = 0; i < PFTM_MAX; i++) 662777a4702SKristof Provost nlattr_add_u32(nw, PF_RT_TIMEOUT, timeout[i]); 663777a4702SKristof Provost 664777a4702SKristof Provost nlattr_set_len(nw, off); 665777a4702SKristof Provost 666777a4702SKristof Provost return (true); 667777a4702SKristof Provost } 668777a4702SKristof Provost 669ffbf2595SKristof Provost #define _OUT(_field) offsetof(struct pf_krule, _field) 670ffbf2595SKristof Provost static const struct nlattr_parser nla_p_rule[] = { 671ffbf2595SKristof Provost { .type = PF_RT_SRC, .off = _OUT(src), .arg = &rule_addr_parser,.cb = nlattr_get_nested }, 672ffbf2595SKristof Provost { .type = PF_RT_DST, .off = _OUT(dst), .arg = &rule_addr_parser,.cb = nlattr_get_nested }, 673ffbf2595SKristof Provost { .type = PF_RT_RIDENTIFIER, .off = _OUT(ridentifier), .cb = nlattr_get_uint32 }, 674ffbf2595SKristof Provost { .type = PF_RT_LABELS, .off = _OUT(label), .arg = &rule_labels_parser,.cb = nlattr_get_nested_pf_rule_labels }, 675ffbf2595SKristof Provost { .type = PF_RT_IFNAME, .off = _OUT(ifname), .arg = (void *)IFNAMSIZ, .cb = nlattr_get_chara }, 676ffbf2595SKristof Provost { .type = PF_RT_QNAME, .off = _OUT(qname), .arg = (void *)PF_QNAME_SIZE, .cb = nlattr_get_chara }, 677ffbf2595SKristof Provost { .type = PF_RT_PQNAME, .off = _OUT(pqname), .arg = (void *)PF_QNAME_SIZE, .cb = nlattr_get_chara }, 678ffbf2595SKristof Provost { .type = PF_RT_TAGNAME, .off = _OUT(tagname), .arg = (void *)PF_TAG_NAME_SIZE, .cb = nlattr_get_chara }, 679ffbf2595SKristof Provost { .type = PF_RT_MATCH_TAGNAME, .off = _OUT(match_tagname), .arg = (void *)PF_TAG_NAME_SIZE, .cb = nlattr_get_chara }, 680ffbf2595SKristof Provost { .type = PF_RT_OVERLOAD_TBLNAME, .off = _OUT(overload_tblname), .arg = (void *)PF_TABLE_NAME_SIZE, .cb = nlattr_get_chara }, 681ffbf2595SKristof Provost { .type = PF_RT_RPOOL, .off = _OUT(rpool), .arg = &pool_parser, .cb = nlattr_get_nested }, 682ffbf2595SKristof Provost { .type = PF_RT_OS_FINGERPRINT, .off = _OUT(os_fingerprint), .cb = nlattr_get_uint32 }, 683ffbf2595SKristof Provost { .type = PF_RT_RTABLEID, .off = _OUT(rtableid), .cb = nlattr_get_uint32 }, 684ffbf2595SKristof Provost { .type = PF_RT_TIMEOUT, .off = _OUT(timeout), .arg = &timeout_parser, .cb = nlattr_get_nested_timeouts }, 685ffbf2595SKristof Provost { .type = PF_RT_MAX_STATES, .off = _OUT(max_states), .cb = nlattr_get_uint32 }, 686ffbf2595SKristof Provost { .type = PF_RT_MAX_SRC_NODES, .off = _OUT(max_src_nodes), .cb = nlattr_get_uint32 }, 687ffbf2595SKristof Provost { .type = PF_RT_MAX_SRC_STATES, .off = _OUT(max_src_states), .cb = nlattr_get_uint32 }, 688ffbf2595SKristof Provost { .type = PF_RT_MAX_SRC_CONN_RATE_LIMIT, .off = _OUT(max_src_conn_rate.limit), .cb = nlattr_get_uint32 }, 689ffbf2595SKristof Provost { .type = PF_RT_MAX_SRC_CONN_RATE_SECS, .off = _OUT(max_src_conn_rate.seconds), .cb = nlattr_get_uint32 }, 690ffbf2595SKristof Provost { .type = PF_RT_DNPIPE, .off = _OUT(dnpipe), .cb = nlattr_get_uint16 }, 691ffbf2595SKristof Provost { .type = PF_RT_DNRPIPE, .off = _OUT(dnrpipe), .cb = nlattr_get_uint16 }, 692ffbf2595SKristof Provost { .type = PF_RT_DNFLAGS, .off = _OUT(free_flags), .cb = nlattr_get_uint32 }, 693ffbf2595SKristof Provost { .type = PF_RT_NR, .off = _OUT(nr), .cb = nlattr_get_uint32 }, 694ffbf2595SKristof Provost { .type = PF_RT_PROB, .off = _OUT(prob), .cb = nlattr_get_uint32 }, 695ffbf2595SKristof Provost { .type = PF_RT_CUID, .off = _OUT(cuid), .cb = nlattr_get_uint32 }, 696ffbf2595SKristof Provost {. type = PF_RT_CPID, .off = _OUT(cpid), .cb = nlattr_get_uint32 }, 697ffbf2595SKristof Provost { .type = PF_RT_RETURN_ICMP, .off = _OUT(return_icmp), .cb = nlattr_get_uint16 }, 698ffbf2595SKristof Provost { .type = PF_RT_RETURN_ICMP6, .off = _OUT(return_icmp6), .cb = nlattr_get_uint16 }, 699ffbf2595SKristof Provost { .type = PF_RT_MAX_MSS, .off = _OUT(max_mss), .cb = nlattr_get_uint16 }, 700ffbf2595SKristof Provost { .type = PF_RT_SCRUB_FLAGS, .off = _OUT(scrub_flags), .cb = nlattr_get_uint16 }, 701ffbf2595SKristof Provost { .type = PF_RT_UID, .off = _OUT(uid), .arg = &rule_uid_parser, .cb = nlattr_get_nested }, 702ffbf2595SKristof Provost { .type = PF_RT_GID, .off = _OUT(gid), .arg = &rule_uid_parser, .cb = nlattr_get_nested }, 703ffbf2595SKristof Provost { .type = PF_RT_RULE_FLAG, .off = _OUT(rule_flag), .cb = nlattr_get_uint32 }, 704ffbf2595SKristof Provost { .type = PF_RT_ACTION, .off = _OUT(action), .cb = nlattr_get_uint8 }, 705ffbf2595SKristof Provost { .type = PF_RT_DIRECTION, .off = _OUT(direction), .cb = nlattr_get_uint8 }, 706ffbf2595SKristof Provost { .type = PF_RT_LOG, .off = _OUT(log), .cb = nlattr_get_uint8 }, 707ffbf2595SKristof Provost { .type = PF_RT_LOGIF, .off = _OUT(logif), .cb = nlattr_get_uint8 }, 708ffbf2595SKristof Provost { .type = PF_RT_QUICK, .off = _OUT(quick), .cb = nlattr_get_uint8 }, 709ffbf2595SKristof Provost { .type = PF_RT_IF_NOT, .off = _OUT(ifnot), .cb = nlattr_get_uint8 }, 710ffbf2595SKristof Provost { .type = PF_RT_MATCH_TAG_NOT, .off = _OUT(match_tag_not), .cb = nlattr_get_uint8 }, 711ffbf2595SKristof Provost { .type = PF_RT_NATPASS, .off = _OUT(natpass), .cb = nlattr_get_uint8 }, 712ffbf2595SKristof Provost { .type = PF_RT_KEEP_STATE, .off = _OUT(keep_state), .cb = nlattr_get_uint8 }, 713ffbf2595SKristof Provost { .type = PF_RT_AF, .off = _OUT(af), .cb = nlattr_get_uint8 }, 714ffbf2595SKristof Provost { .type = PF_RT_PROTO, .off = _OUT(proto), .cb = nlattr_get_uint8 }, 715ffbf2595SKristof Provost { .type = PF_RT_TYPE, .off = _OUT(type), .cb = nlattr_get_uint8 }, 716ffbf2595SKristof Provost { .type = PF_RT_CODE, .off = _OUT(code), .cb = nlattr_get_uint8 }, 717ffbf2595SKristof Provost { .type = PF_RT_FLAGS, .off = _OUT(flags), .cb = nlattr_get_uint8 }, 718ffbf2595SKristof Provost { .type = PF_RT_FLAGSET, .off = _OUT(flagset), .cb = nlattr_get_uint8 }, 719ffbf2595SKristof Provost { .type = PF_RT_MIN_TTL, .off = _OUT(min_ttl), .cb = nlattr_get_uint8 }, 720ffbf2595SKristof Provost { .type = PF_RT_ALLOW_OPTS, .off = _OUT(allow_opts), .cb = nlattr_get_uint8 }, 721ffbf2595SKristof Provost { .type = PF_RT_RT, .off = _OUT(rt), .cb = nlattr_get_uint8 }, 722ffbf2595SKristof Provost { .type = PF_RT_RETURN_TTL, .off = _OUT(return_ttl), .cb = nlattr_get_uint8 }, 723ffbf2595SKristof Provost { .type = PF_RT_TOS, .off = _OUT(tos), .cb = nlattr_get_uint8 }, 724ffbf2595SKristof Provost { .type = PF_RT_SET_TOS, .off = _OUT(set_tos), .cb = nlattr_get_uint8 }, 725ffbf2595SKristof Provost { .type = PF_RT_ANCHOR_RELATIVE, .off = _OUT(anchor_relative), .cb = nlattr_get_uint8 }, 726ffbf2595SKristof Provost { .type = PF_RT_ANCHOR_WILDCARD, .off = _OUT(anchor_wildcard), .cb = nlattr_get_uint8 }, 727ffbf2595SKristof Provost { .type = PF_RT_FLUSH, .off = _OUT(flush), .cb = nlattr_get_uint8 }, 728ffbf2595SKristof Provost { .type = PF_RT_PRIO, .off = _OUT(prio), .cb = nlattr_get_uint8 }, 729ffbf2595SKristof Provost { .type = PF_RT_SET_PRIO, .off = _OUT(set_prio[0]), .cb = nlattr_get_uint8 }, 730ffbf2595SKristof Provost { .type = PF_RT_SET_PRIO_REPLY, .off = _OUT(set_prio[1]), .cb = nlattr_get_uint8 }, 731ffbf2595SKristof Provost { .type = PF_RT_DIVERT_ADDRESS, .off = _OUT(divert.addr), .cb = nlattr_get_in6_addr }, 732ffbf2595SKristof Provost { .type = PF_RT_DIVERT_PORT, .off = _OUT(divert.port), .cb = nlattr_get_uint16 }, 7332339ead6SKristof Provost { .type = PF_RT_RCV_IFNAME, .off = _OUT(rcv_ifname), .arg = (void *)IFNAMSIZ, .cb = nlattr_get_chara }, 734ffbf2595SKristof Provost }; 735ffbf2595SKristof Provost NL_DECLARE_ATTR_PARSER(rule_parser, nla_p_rule); 736ffbf2595SKristof Provost #undef _OUT 737ffbf2595SKristof Provost struct nl_parsed_addrule { 738ffbf2595SKristof Provost struct pf_krule *rule; 739ffbf2595SKristof Provost uint32_t ticket; 740ffbf2595SKristof Provost uint32_t pool_ticket; 741ffbf2595SKristof Provost char *anchor; 742ffbf2595SKristof Provost char *anchor_call; 743ffbf2595SKristof Provost }; 744ffbf2595SKristof Provost #define _IN(_field) offsetof(struct genlmsghdr, _field) 745ffbf2595SKristof Provost #define _OUT(_field) offsetof(struct nl_parsed_addrule, _field) 746ffbf2595SKristof Provost static const struct nlattr_parser nla_p_addrule[] = { 747ffbf2595SKristof Provost { .type = PF_ART_TICKET, .off = _OUT(ticket), .cb = nlattr_get_uint32 }, 748ffbf2595SKristof Provost { .type = PF_ART_POOL_TICKET, .off = _OUT(pool_ticket), .cb = nlattr_get_uint32 }, 749ffbf2595SKristof Provost { .type = PF_ART_ANCHOR, .off = _OUT(anchor), .cb = nlattr_get_string }, 750ffbf2595SKristof Provost { .type = PF_ART_ANCHOR_CALL, .off = _OUT(anchor_call), .cb = nlattr_get_string }, 751ffbf2595SKristof Provost { .type = PF_ART_RULE, .off = _OUT(rule), .arg = &rule_parser, .cb = nlattr_get_nested_ptr } 752ffbf2595SKristof Provost }; 753ffbf2595SKristof Provost static const struct nlfield_parser nlf_p_addrule[] = { 754ffbf2595SKristof Provost }; 755ffbf2595SKristof Provost #undef _IN 756ffbf2595SKristof Provost #undef _OUT 757ffbf2595SKristof Provost NL_DECLARE_PARSER(addrule_parser, struct genlmsghdr, nlf_p_addrule, nla_p_addrule); 758ffbf2595SKristof Provost 759ffbf2595SKristof Provost static int 760ffbf2595SKristof Provost pf_handle_addrule(struct nlmsghdr *hdr, struct nl_pstate *npt) 761ffbf2595SKristof Provost { 762ffbf2595SKristof Provost int error; 763ffbf2595SKristof Provost struct nl_parsed_addrule attrs = {}; 764ffbf2595SKristof Provost 765ffbf2595SKristof Provost attrs.rule = pf_krule_alloc(); 766ffbf2595SKristof Provost 767ffbf2595SKristof Provost error = nl_parse_nlmsg(hdr, &addrule_parser, npt, &attrs); 768e249f5daSKristof Provost if (error != 0) { 769e249f5daSKristof Provost pf_free_rule(attrs.rule); 770ffbf2595SKristof Provost return (error); 771e249f5daSKristof Provost } 772ffbf2595SKristof Provost 773ffbf2595SKristof Provost error = pf_ioctl_addrule(attrs.rule, attrs.ticket, attrs.pool_ticket, 774ffbf2595SKristof Provost attrs.anchor, attrs.anchor_call, nlp_get_cred(npt->nlp)->cr_uid, 775ffbf2595SKristof Provost hdr->nlmsg_pid); 776ffbf2595SKristof Provost 777ffbf2595SKristof Provost return (error); 778ffbf2595SKristof Provost } 779ffbf2595SKristof Provost 78044f323ecSKristof Provost #define _IN(_field) offsetof(struct genlmsghdr, _field) 78144f323ecSKristof Provost #define _OUT(_field) offsetof(struct pfioc_rule, _field) 78244f323ecSKristof Provost static const struct nlattr_parser nla_p_getrules[] = { 78344f323ecSKristof Provost { .type = PF_GR_ANCHOR, .off = _OUT(anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara }, 78444f323ecSKristof Provost { .type = PF_GR_ACTION, .off = _OUT(rule.action), .cb = nlattr_get_uint8 }, 78544f323ecSKristof Provost }; 78644f323ecSKristof Provost static const struct nlfield_parser nlf_p_getrules[] = { 78744f323ecSKristof Provost }; 788706d465dSKristof Provost #undef _IN 789777a4702SKristof Provost #undef _OUT 79044f323ecSKristof Provost NL_DECLARE_PARSER(getrules_parser, struct genlmsghdr, nlf_p_getrules, nla_p_getrules); 79144f323ecSKristof Provost 79244f323ecSKristof Provost static int 79344f323ecSKristof Provost pf_handle_getrules(struct nlmsghdr *hdr, struct nl_pstate *npt) 79444f323ecSKristof Provost { 79544f323ecSKristof Provost struct pfioc_rule attrs = {}; 79644f323ecSKristof Provost int error; 79744f323ecSKristof Provost struct nl_writer *nw = npt->nw; 79844f323ecSKristof Provost struct genlmsghdr *ghdr_new; 79944f323ecSKristof Provost 80044f323ecSKristof Provost error = nl_parse_nlmsg(hdr, &getrules_parser, npt, &attrs); 80144f323ecSKristof Provost if (error != 0) 80244f323ecSKristof Provost return (error); 80344f323ecSKristof Provost 80444f323ecSKristof Provost if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 80544f323ecSKristof Provost return (ENOMEM); 80644f323ecSKristof Provost 80744f323ecSKristof Provost ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 80844f323ecSKristof Provost ghdr_new->cmd = PFNL_CMD_GETRULES; 80944f323ecSKristof Provost ghdr_new->version = 0; 81044f323ecSKristof Provost ghdr_new->reserved = 0; 81144f323ecSKristof Provost 81244f323ecSKristof Provost error = pf_ioctl_getrules(&attrs); 81344f323ecSKristof Provost if (error != 0) 81444f323ecSKristof Provost goto out; 81544f323ecSKristof Provost 81644f323ecSKristof Provost nlattr_add_u32(nw, PF_GR_NR, attrs.nr); 81744f323ecSKristof Provost nlattr_add_u32(nw, PF_GR_TICKET, attrs.ticket); 81844f323ecSKristof Provost 81944f323ecSKristof Provost if (!nlmsg_end(nw)) { 82044f323ecSKristof Provost error = ENOMEM; 82144f323ecSKristof Provost goto out; 82244f323ecSKristof Provost } 82344f323ecSKristof Provost 82444f323ecSKristof Provost return (0); 82544f323ecSKristof Provost 82644f323ecSKristof Provost out: 82744f323ecSKristof Provost nlmsg_abort(nw); 82844f323ecSKristof Provost return (error); 82944f323ecSKristof Provost } 83044f323ecSKristof Provost 831777a4702SKristof Provost struct nl_parsed_get_rule { 832777a4702SKristof Provost char anchor[MAXPATHLEN]; 833777a4702SKristof Provost uint8_t action; 834777a4702SKristof Provost uint32_t nr; 835777a4702SKristof Provost uint32_t ticket; 836777a4702SKristof Provost uint8_t clear; 837777a4702SKristof Provost }; 838777a4702SKristof Provost #define _IN(_field) offsetof(struct genlmsghdr, _field) 839777a4702SKristof Provost #define _OUT(_field) offsetof(struct nl_parsed_get_rule, _field) 840777a4702SKristof Provost static const struct nlattr_parser nla_p_getrule[] = { 841777a4702SKristof Provost { .type = PF_GR_ANCHOR, .off = _OUT(anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara }, 842777a4702SKristof Provost { .type = PF_GR_ACTION, .off = _OUT(action), .cb = nlattr_get_uint8 }, 843777a4702SKristof Provost { .type = PF_GR_NR, .off = _OUT(nr), .cb = nlattr_get_uint32 }, 844777a4702SKristof Provost { .type = PF_GR_TICKET, .off = _OUT(ticket), .cb = nlattr_get_uint32 }, 845777a4702SKristof Provost { .type = PF_GR_CLEAR, .off = _OUT(clear), .cb = nlattr_get_uint8 }, 846777a4702SKristof Provost }; 847777a4702SKristof Provost static const struct nlfield_parser nlf_p_getrule[] = { 848777a4702SKristof Provost }; 849706d465dSKristof Provost #undef _IN 850706d465dSKristof Provost #undef _OUT 851777a4702SKristof Provost NL_DECLARE_PARSER(getrule_parser, struct genlmsghdr, nlf_p_getrule, nla_p_getrule); 852777a4702SKristof Provost 853777a4702SKristof Provost static int 854777a4702SKristof Provost pf_handle_getrule(struct nlmsghdr *hdr, struct nl_pstate *npt) 855777a4702SKristof Provost { 856777a4702SKristof Provost char anchor_call[MAXPATHLEN]; 857777a4702SKristof Provost struct nl_parsed_get_rule attrs = {}; 858777a4702SKristof Provost struct nl_writer *nw = npt->nw; 859777a4702SKristof Provost struct genlmsghdr *ghdr_new; 860777a4702SKristof Provost struct pf_kruleset *ruleset; 861777a4702SKristof Provost struct pf_krule *rule; 862777a4702SKristof Provost int rs_num; 863777a4702SKristof Provost int error; 864777a4702SKristof Provost 865777a4702SKristof Provost error = nl_parse_nlmsg(hdr, &getrule_parser, npt, &attrs); 866777a4702SKristof Provost if (error != 0) 867777a4702SKristof Provost return (error); 868777a4702SKristof Provost 869777a4702SKristof Provost if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 870777a4702SKristof Provost return (ENOMEM); 871777a4702SKristof Provost 872777a4702SKristof Provost ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 873777a4702SKristof Provost ghdr_new->cmd = PFNL_CMD_GETRULE; 874777a4702SKristof Provost ghdr_new->version = 0; 875777a4702SKristof Provost ghdr_new->reserved = 0; 876777a4702SKristof Provost 877777a4702SKristof Provost PF_RULES_WLOCK(); 878777a4702SKristof Provost ruleset = pf_find_kruleset(attrs.anchor); 879777a4702SKristof Provost if (ruleset == NULL) { 880777a4702SKristof Provost PF_RULES_WUNLOCK(); 881777a4702SKristof Provost error = ENOENT; 882777a4702SKristof Provost goto out; 883777a4702SKristof Provost } 884777a4702SKristof Provost 885777a4702SKristof Provost rs_num = pf_get_ruleset_number(attrs.action); 886777a4702SKristof Provost if (rs_num >= PF_RULESET_MAX) { 887777a4702SKristof Provost PF_RULES_WUNLOCK(); 888777a4702SKristof Provost error = EINVAL; 889777a4702SKristof Provost goto out; 890777a4702SKristof Provost } 891777a4702SKristof Provost 892777a4702SKristof Provost if (attrs.ticket != ruleset->rules[rs_num].active.ticket) { 893777a4702SKristof Provost PF_RULES_WUNLOCK(); 894777a4702SKristof Provost error = EBUSY; 895777a4702SKristof Provost goto out; 896777a4702SKristof Provost } 897777a4702SKristof Provost 898777a4702SKristof Provost rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 899777a4702SKristof Provost while ((rule != NULL) && (rule->nr != attrs.nr)) 900777a4702SKristof Provost rule = TAILQ_NEXT(rule, entries); 901777a4702SKristof Provost if (rule == NULL) { 902777a4702SKristof Provost PF_RULES_WUNLOCK(); 903777a4702SKristof Provost error = EBUSY; 904777a4702SKristof Provost goto out; 905777a4702SKristof Provost } 906777a4702SKristof Provost 907777a4702SKristof Provost nlattr_add_rule_addr(nw, PF_RT_SRC, &rule->src); 908777a4702SKristof Provost nlattr_add_rule_addr(nw, PF_RT_DST, &rule->dst); 909777a4702SKristof Provost nlattr_add_u32(nw, PF_RT_RIDENTIFIER, rule->ridentifier); 910777a4702SKristof Provost nlattr_add_labels(nw, PF_RT_LABELS, rule); 911777a4702SKristof Provost nlattr_add_string(nw, PF_RT_IFNAME, rule->ifname); 912777a4702SKristof Provost nlattr_add_string(nw, PF_RT_QNAME, rule->qname); 913777a4702SKristof Provost nlattr_add_string(nw, PF_RT_PQNAME, rule->pqname); 914777a4702SKristof Provost nlattr_add_string(nw, PF_RT_TAGNAME, rule->tagname); 915777a4702SKristof Provost nlattr_add_string(nw, PF_RT_MATCH_TAGNAME, rule->match_tagname); 916777a4702SKristof Provost nlattr_add_string(nw, PF_RT_OVERLOAD_TBLNAME, rule->overload_tblname); 917777a4702SKristof Provost nlattr_add_pool(nw, PF_RT_RPOOL, &rule->rpool); 918777a4702SKristof Provost nlattr_add_u32(nw, PF_RT_OS_FINGERPRINT, rule->os_fingerprint); 919777a4702SKristof Provost nlattr_add_u32(nw, PF_RT_RTABLEID, rule->rtableid); 920777a4702SKristof Provost nlattr_add_timeout(nw, PF_RT_TIMEOUT, rule->timeout); 921777a4702SKristof Provost nlattr_add_u32(nw, PF_RT_MAX_STATES, rule->max_states); 922777a4702SKristof Provost nlattr_add_u32(nw, PF_RT_MAX_SRC_NODES, rule->max_src_nodes); 923777a4702SKristof Provost nlattr_add_u32(nw, PF_RT_MAX_SRC_STATES, rule->max_src_states); 924777a4702SKristof Provost nlattr_add_u32(nw, PF_RT_MAX_SRC_CONN_RATE_LIMIT, rule->max_src_conn_rate.limit); 925777a4702SKristof Provost nlattr_add_u32(nw, PF_RT_MAX_SRC_CONN_RATE_SECS, rule->max_src_conn_rate.seconds); 926777a4702SKristof Provost 927777a4702SKristof Provost nlattr_add_u16(nw, PF_RT_DNPIPE, rule->dnpipe); 928777a4702SKristof Provost nlattr_add_u16(nw, PF_RT_DNRPIPE, rule->dnrpipe); 929777a4702SKristof Provost nlattr_add_u32(nw, PF_RT_DNFLAGS, rule->free_flags); 930777a4702SKristof Provost 931777a4702SKristof Provost nlattr_add_u32(nw, PF_RT_NR, rule->nr); 932777a4702SKristof Provost nlattr_add_u32(nw, PF_RT_PROB, rule->prob); 933777a4702SKristof Provost nlattr_add_u32(nw, PF_RT_CUID, rule->cuid); 934777a4702SKristof Provost nlattr_add_u32(nw, PF_RT_CPID, rule->cpid); 935777a4702SKristof Provost 936777a4702SKristof Provost nlattr_add_u16(nw, PF_RT_RETURN_ICMP, rule->return_icmp); 937777a4702SKristof Provost nlattr_add_u16(nw, PF_RT_RETURN_ICMP6, rule->return_icmp6); 938777a4702SKristof Provost nlattr_add_u16(nw, PF_RT_RETURN_ICMP6, rule->return_icmp6); 939777a4702SKristof Provost nlattr_add_u16(nw, PF_RT_MAX_MSS, rule->max_mss); 940777a4702SKristof Provost nlattr_add_u16(nw, PF_RT_SCRUB_FLAGS, rule->scrub_flags); 941777a4702SKristof Provost 942777a4702SKristof Provost nlattr_add_rule_uid(nw, PF_RT_UID, &rule->uid); 943777a4702SKristof Provost nlattr_add_rule_uid(nw, PF_RT_GID, (const struct pf_rule_uid *)&rule->gid); 944777a4702SKristof Provost 9452339ead6SKristof Provost nlattr_add_string(nw, PF_RT_RCV_IFNAME, rule->rcv_ifname); 9462339ead6SKristof Provost 947777a4702SKristof Provost nlattr_add_u32(nw, PF_RT_RULE_FLAG, rule->rule_flag); 948777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_ACTION, rule->action); 949777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_DIRECTION, rule->direction); 950777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_LOG, rule->log); 951777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_LOGIF, rule->logif); 952777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_QUICK, rule->quick); 953777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_IF_NOT, rule->ifnot); 954777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_MATCH_TAG_NOT, rule->match_tag_not); 955777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_NATPASS, rule->natpass); 956777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_KEEP_STATE, rule->keep_state); 957777a4702SKristof Provost 958777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_AF, rule->af); 959777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_PROTO, rule->proto); 960777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_TYPE, rule->type); 961777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_CODE, rule->code); 962777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_FLAGS, rule->flags); 963777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_FLAGSET, rule->flagset); 964777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_MIN_TTL, rule->min_ttl); 965777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_ALLOW_OPTS, rule->allow_opts); 966777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_RT, rule->rt); 967777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_RETURN_TTL, rule->return_ttl); 968777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_TOS, rule->tos); 969777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_SET_TOS, rule->set_tos); 970777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_ANCHOR_RELATIVE, rule->anchor_relative); 971777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_ANCHOR_WILDCARD, rule->anchor_wildcard); 972777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_FLUSH, rule->flush); 973777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_PRIO, rule->prio); 974777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_SET_PRIO, rule->set_prio[0]); 975777a4702SKristof Provost nlattr_add_u8(nw, PF_RT_SET_PRIO_REPLY, rule->set_prio[1]); 976777a4702SKristof Provost 977777a4702SKristof Provost nlattr_add_in6_addr(nw, PF_RT_DIVERT_ADDRESS, &rule->divert.addr.v6); 978777a4702SKristof Provost nlattr_add_u16(nw, PF_RT_DIVERT_PORT, rule->divert.port); 979777a4702SKristof Provost 980777a4702SKristof Provost nlattr_add_u64(nw, PF_RT_PACKETS_IN, pf_counter_u64_fetch(&rule->packets[0])); 981777a4702SKristof Provost nlattr_add_u64(nw, PF_RT_PACKETS_OUT, pf_counter_u64_fetch(&rule->packets[1])); 982777a4702SKristof Provost nlattr_add_u64(nw, PF_RT_BYTES_IN, pf_counter_u64_fetch(&rule->bytes[0])); 983777a4702SKristof Provost nlattr_add_u64(nw, PF_RT_BYTES_OUT, pf_counter_u64_fetch(&rule->bytes[1])); 984777a4702SKristof Provost nlattr_add_u64(nw, PF_RT_EVALUATIONS, pf_counter_u64_fetch(&rule->evaluations)); 985777a4702SKristof Provost nlattr_add_u64(nw, PF_RT_TIMESTAMP, pf_get_timestamp(rule)); 986777a4702SKristof Provost nlattr_add_u64(nw, PF_RT_STATES_CUR, counter_u64_fetch(rule->states_cur)); 987777a4702SKristof Provost nlattr_add_u64(nw, PF_RT_STATES_TOTAL, counter_u64_fetch(rule->states_tot)); 988777a4702SKristof Provost nlattr_add_u64(nw, PF_RT_SRC_NODES, counter_u64_fetch(rule->src_nodes)); 989777a4702SKristof Provost 9906ee3e376SKristof Provost error = pf_kanchor_copyout(ruleset, rule, anchor_call, sizeof(anchor_call)); 991777a4702SKristof Provost MPASS(error == 0); 992777a4702SKristof Provost 993777a4702SKristof Provost nlattr_add_string(nw, PF_RT_ANCHOR_CALL, anchor_call); 994777a4702SKristof Provost 995777a4702SKristof Provost if (attrs.clear) 996777a4702SKristof Provost pf_krule_clear_counters(rule); 997777a4702SKristof Provost 998777a4702SKristof Provost PF_RULES_WUNLOCK(); 999777a4702SKristof Provost 1000777a4702SKristof Provost if (!nlmsg_end(nw)) { 1001777a4702SKristof Provost error = ENOMEM; 1002777a4702SKristof Provost goto out; 1003777a4702SKristof Provost } 1004777a4702SKristof Provost 1005777a4702SKristof Provost return (0); 1006777a4702SKristof Provost out: 1007777a4702SKristof Provost nlmsg_abort(nw); 1008777a4702SKristof Provost return (error); 1009777a4702SKristof Provost } 1010777a4702SKristof Provost 1011706d465dSKristof Provost #define _IN(_field) offsetof(struct genlmsghdr, _field) 1012706d465dSKristof Provost #define _OUT(_field) offsetof(struct pf_kstate_kill, _field) 1013706d465dSKristof Provost static const struct nlattr_parser nla_p_clear_states[] = { 1014706d465dSKristof Provost { .type = PF_CS_CMP_ID, .off = _OUT(psk_pfcmp.id), .cb = nlattr_get_uint64 }, 1015706d465dSKristof Provost { .type = PF_CS_CMP_CREATORID, .off = _OUT(psk_pfcmp.creatorid), .cb = nlattr_get_uint32 }, 1016706d465dSKristof Provost { .type = PF_CS_CMP_DIR, .off = _OUT(psk_pfcmp.direction), .cb = nlattr_get_uint8 }, 1017706d465dSKristof Provost { .type = PF_CS_AF, .off = _OUT(psk_af), .cb = nlattr_get_uint8 }, 1018706d465dSKristof Provost { .type = PF_CS_PROTO, .off = _OUT(psk_proto), .cb = nlattr_get_uint8 }, 1019706d465dSKristof Provost { .type = PF_CS_SRC, .off = _OUT(psk_src), .arg = &rule_addr_parser, .cb = nlattr_get_nested }, 1020706d465dSKristof Provost { .type = PF_CS_DST, .off = _OUT(psk_dst), .arg = &rule_addr_parser, .cb = nlattr_get_nested }, 1021706d465dSKristof Provost { .type = PF_CS_RT_ADDR, .off = _OUT(psk_rt_addr), .arg = &rule_addr_parser, .cb = nlattr_get_nested }, 1022706d465dSKristof Provost { .type = PF_CS_IFNAME, .off = _OUT(psk_ifname), .arg = (void *)IFNAMSIZ, .cb = nlattr_get_chara }, 1023706d465dSKristof Provost { .type = PF_CS_LABEL, .off = _OUT(psk_label), .arg = (void *)PF_RULE_LABEL_SIZE, .cb = nlattr_get_chara }, 1024706d465dSKristof Provost { .type = PF_CS_KILL_MATCH, .off = _OUT(psk_kill_match), .cb = nlattr_get_bool }, 1025706d465dSKristof Provost { .type = PF_CS_NAT, .off = _OUT(psk_nat), .cb = nlattr_get_bool }, 1026706d465dSKristof Provost }; 1027706d465dSKristof Provost static const struct nlfield_parser nlf_p_clear_states[] = {}; 1028706d465dSKristof Provost #undef _IN 1029706d465dSKristof Provost #undef _OUT 1030706d465dSKristof Provost NL_DECLARE_PARSER(clear_states_parser, struct genlmsghdr, nlf_p_clear_states, nla_p_clear_states); 1031706d465dSKristof Provost 1032706d465dSKristof Provost static int 1033706d465dSKristof Provost pf_handle_killclear_states(struct nlmsghdr *hdr, struct nl_pstate *npt, int cmd) 1034706d465dSKristof Provost { 1035706d465dSKristof Provost struct pf_kstate_kill kill = {}; 1036706d465dSKristof Provost struct epoch_tracker et; 1037706d465dSKristof Provost struct nl_writer *nw = npt->nw; 1038706d465dSKristof Provost struct genlmsghdr *ghdr_new; 1039706d465dSKristof Provost int error; 1040706d465dSKristof Provost unsigned int killed = 0; 1041706d465dSKristof Provost 1042706d465dSKristof Provost error = nl_parse_nlmsg(hdr, &clear_states_parser, npt, &kill); 1043706d465dSKristof Provost if (error != 0) 1044706d465dSKristof Provost return (error); 1045706d465dSKristof Provost 1046706d465dSKristof Provost if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 1047706d465dSKristof Provost return (ENOMEM); 1048706d465dSKristof Provost 1049706d465dSKristof Provost ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1050706d465dSKristof Provost ghdr_new->cmd = cmd; 1051706d465dSKristof Provost ghdr_new->version = 0; 1052706d465dSKristof Provost ghdr_new->reserved = 0; 1053706d465dSKristof Provost 1054706d465dSKristof Provost NET_EPOCH_ENTER(et); 1055706d465dSKristof Provost if (cmd == PFNL_CMD_KILLSTATES) 1056706d465dSKristof Provost pf_killstates(&kill, &killed); 1057706d465dSKristof Provost else 1058706d465dSKristof Provost killed = pf_clear_states(&kill); 1059706d465dSKristof Provost NET_EPOCH_EXIT(et); 1060706d465dSKristof Provost 1061706d465dSKristof Provost nlattr_add_u32(nw, PF_CS_KILLED, killed); 1062706d465dSKristof Provost 1063706d465dSKristof Provost if (! nlmsg_end(nw)) { 1064706d465dSKristof Provost error = ENOMEM; 1065706d465dSKristof Provost goto out; 1066706d465dSKristof Provost } 1067706d465dSKristof Provost 1068706d465dSKristof Provost return (0); 1069706d465dSKristof Provost 1070706d465dSKristof Provost out: 1071706d465dSKristof Provost nlmsg_abort(nw); 1072706d465dSKristof Provost return (error); 1073706d465dSKristof Provost } 1074706d465dSKristof Provost 1075706d465dSKristof Provost static int 1076706d465dSKristof Provost pf_handle_clear_states(struct nlmsghdr *hdr, struct nl_pstate *npt) 1077706d465dSKristof Provost { 1078706d465dSKristof Provost return (pf_handle_killclear_states(hdr, npt, PFNL_CMD_CLRSTATES)); 1079706d465dSKristof Provost } 1080706d465dSKristof Provost 1081706d465dSKristof Provost static int 1082706d465dSKristof Provost pf_handle_kill_states(struct nlmsghdr *hdr, struct nl_pstate *npt) 1083706d465dSKristof Provost { 1084706d465dSKristof Provost return (pf_handle_killclear_states(hdr, npt, PFNL_CMD_KILLSTATES)); 1085706d465dSKristof Provost } 1086706d465dSKristof Provost 1087470a2b33SKristof Provost struct nl_parsed_set_statusif { 1088470a2b33SKristof Provost char ifname[IFNAMSIZ]; 1089470a2b33SKristof Provost }; 1090470a2b33SKristof Provost #define _IN(_field) offsetof(struct genlmsghdr, _field) 1091470a2b33SKristof Provost #define _OUT(_field) offsetof(struct nl_parsed_set_statusif, _field) 1092470a2b33SKristof Provost static const struct nlattr_parser nla_p_set_statusif[] = { 1093470a2b33SKristof Provost { .type = PF_SS_IFNAME, .off = _OUT(ifname), .arg = (const void *)IFNAMSIZ, .cb = nlattr_get_chara }, 1094470a2b33SKristof Provost }; 1095470a2b33SKristof Provost static const struct nlfield_parser nlf_p_set_statusif[] = {}; 1096470a2b33SKristof Provost #undef _IN 1097470a2b33SKristof Provost #undef _OUT 1098470a2b33SKristof Provost NL_DECLARE_PARSER(set_statusif_parser, struct genlmsghdr, nlf_p_set_statusif, nla_p_set_statusif); 1099470a2b33SKristof Provost 1100470a2b33SKristof Provost static int 1101470a2b33SKristof Provost pf_handle_set_statusif(struct nlmsghdr *hdr, struct nl_pstate *npt) 1102470a2b33SKristof Provost { 1103470a2b33SKristof Provost int error; 1104470a2b33SKristof Provost struct nl_parsed_set_statusif attrs = {}; 1105470a2b33SKristof Provost 1106470a2b33SKristof Provost error = nl_parse_nlmsg(hdr, &set_statusif_parser, npt, &attrs); 1107470a2b33SKristof Provost if (error != 0) 1108470a2b33SKristof Provost return (error); 1109470a2b33SKristof Provost 1110470a2b33SKristof Provost PF_RULES_WLOCK(); 1111470a2b33SKristof Provost strlcpy(V_pf_status.ifname, attrs.ifname, IFNAMSIZ); 1112470a2b33SKristof Provost PF_RULES_WUNLOCK(); 1113470a2b33SKristof Provost 1114470a2b33SKristof Provost return (0); 1115470a2b33SKristof Provost } 1116470a2b33SKristof Provost 11175824df8dSKristof Provost static bool 11185824df8dSKristof Provost nlattr_add_counters(struct nl_writer *nw, int attr, size_t number, char **names, 11195824df8dSKristof Provost counter_u64_t *counters) 11205824df8dSKristof Provost { 11215824df8dSKristof Provost for (int i = 0; i < number; i++) { 11225824df8dSKristof Provost int off = nlattr_add_nested(nw, attr); 11235824df8dSKristof Provost nlattr_add_u32(nw, PF_C_ID, i); 11245824df8dSKristof Provost nlattr_add_string(nw, PF_C_NAME, names[i]); 11255824df8dSKristof Provost nlattr_add_u64(nw, PF_C_COUNTER, counter_u64_fetch(counters[i])); 11265824df8dSKristof Provost nlattr_set_len(nw, off); 11275824df8dSKristof Provost } 11285824df8dSKristof Provost 11295824df8dSKristof Provost return (true); 11305824df8dSKristof Provost } 11315824df8dSKristof Provost 11325824df8dSKristof Provost static bool 11335824df8dSKristof Provost nlattr_add_fcounters(struct nl_writer *nw, int attr, size_t number, char **names, 11345824df8dSKristof Provost struct pf_counter_u64 *counters) 11355824df8dSKristof Provost { 11365824df8dSKristof Provost for (int i = 0; i < number; i++) { 11375824df8dSKristof Provost int off = nlattr_add_nested(nw, attr); 11385824df8dSKristof Provost nlattr_add_u32(nw, PF_C_ID, i); 11395824df8dSKristof Provost nlattr_add_string(nw, PF_C_NAME, names[i]); 11405824df8dSKristof Provost nlattr_add_u64(nw, PF_C_COUNTER, pf_counter_u64_fetch(&counters[i])); 11415824df8dSKristof Provost nlattr_set_len(nw, off); 11425824df8dSKristof Provost } 11435824df8dSKristof Provost 11445824df8dSKristof Provost return (true); 11455824df8dSKristof Provost } 11465824df8dSKristof Provost 11475824df8dSKristof Provost static bool 11485824df8dSKristof Provost nlattr_add_u64_array(struct nl_writer *nw, int attr, size_t number, uint64_t *array) 11495824df8dSKristof Provost { 11505824df8dSKristof Provost int off = nlattr_add_nested(nw, attr); 11515824df8dSKristof Provost 11525824df8dSKristof Provost for (size_t i = 0; i < number; i++) 11535824df8dSKristof Provost nlattr_add_u64(nw, 0, array[i]); 11545824df8dSKristof Provost 11555824df8dSKristof Provost nlattr_set_len(nw, off); 11565824df8dSKristof Provost 11575824df8dSKristof Provost return (true); 11585824df8dSKristof Provost } 11595824df8dSKristof Provost 11605824df8dSKristof Provost static int 11615824df8dSKristof Provost pf_handle_get_status(struct nlmsghdr *hdr, struct nl_pstate *npt) 11625824df8dSKristof Provost { 11635824df8dSKristof Provost struct pf_status s; 11645824df8dSKristof Provost struct nl_writer *nw = npt->nw; 11655824df8dSKristof Provost struct genlmsghdr *ghdr_new; 11665824df8dSKristof Provost char *pf_reasons[PFRES_MAX+1] = PFRES_NAMES; 11675824df8dSKristof Provost char *pf_lcounter[KLCNT_MAX+1] = KLCNT_NAMES; 11685824df8dSKristof Provost char *pf_fcounter[FCNT_MAX+1] = FCNT_NAMES; 11695824df8dSKristof Provost int error; 11705824df8dSKristof Provost 11715824df8dSKristof Provost PF_RULES_RLOCK_TRACKER; 11725824df8dSKristof Provost 11735824df8dSKristof Provost if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 11745824df8dSKristof Provost return (ENOMEM); 11755824df8dSKristof Provost 11765824df8dSKristof Provost ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 11775824df8dSKristof Provost ghdr_new->cmd = PFNL_CMD_GET_STATUS; 11785824df8dSKristof Provost ghdr_new->version = 0; 11795824df8dSKristof Provost ghdr_new->reserved = 0; 11805824df8dSKristof Provost 11815824df8dSKristof Provost PF_RULES_RLOCK(); 11825824df8dSKristof Provost 11835824df8dSKristof Provost nlattr_add_string(nw, PF_GS_IFNAME, V_pf_status.ifname); 11845824df8dSKristof Provost nlattr_add_bool(nw, PF_GS_RUNNING, V_pf_status.running); 11855824df8dSKristof Provost nlattr_add_u32(nw, PF_GS_SINCE, V_pf_status.since); 11865824df8dSKristof Provost nlattr_add_u32(nw, PF_GS_DEBUG, V_pf_status.debug); 11875824df8dSKristof Provost nlattr_add_u32(nw, PF_GS_HOSTID, ntohl(V_pf_status.hostid)); 11885824df8dSKristof Provost nlattr_add_u32(nw, PF_GS_STATES, V_pf_status.states); 11895824df8dSKristof Provost nlattr_add_u32(nw, PF_GS_SRC_NODES, V_pf_status.src_nodes); 11905824df8dSKristof Provost nlattr_add_u32(nw, PF_GS_REASSEMBLE, V_pf_status.reass); 11915824df8dSKristof Provost nlattr_add_u32(nw, PF_GS_SYNCOOKIES_ACTIVE, V_pf_status.syncookies_active); 11925824df8dSKristof Provost 11935824df8dSKristof Provost nlattr_add_counters(nw, PF_GS_COUNTERS, PFRES_MAX, pf_reasons, 11945824df8dSKristof Provost V_pf_status.counters); 11955824df8dSKristof Provost nlattr_add_counters(nw, PF_GS_LCOUNTERS, KLCNT_MAX, pf_lcounter, 11965824df8dSKristof Provost V_pf_status.lcounters); 11975824df8dSKristof Provost nlattr_add_fcounters(nw, PF_GS_FCOUNTERS, FCNT_MAX, pf_fcounter, 11985824df8dSKristof Provost V_pf_status.fcounters); 11995824df8dSKristof Provost nlattr_add_counters(nw, PF_GS_SCOUNTERS, SCNT_MAX, pf_fcounter, 12005824df8dSKristof Provost V_pf_status.scounters); 12015824df8dSKristof Provost 12025824df8dSKristof Provost pfi_update_status(V_pf_status.ifname, &s); 12035824df8dSKristof Provost nlattr_add_u64_array(nw, PF_GS_BCOUNTERS, 2 * 2, (uint64_t *)s.bcounters); 12045824df8dSKristof Provost nlattr_add_u64_array(nw, PF_GS_PCOUNTERS, 2 * 2 * 2, (uint64_t *)s.pcounters); 12055824df8dSKristof Provost 12065824df8dSKristof Provost nlattr_add(nw, PF_GS_CHKSUM, PF_MD5_DIGEST_LENGTH, V_pf_status.pf_chksum); 12075824df8dSKristof Provost 12085824df8dSKristof Provost PF_RULES_RUNLOCK(); 12095824df8dSKristof Provost 12105824df8dSKristof Provost if (!nlmsg_end(nw)) { 12115824df8dSKristof Provost error = ENOMEM; 12125824df8dSKristof Provost goto out; 12135824df8dSKristof Provost } 12145824df8dSKristof Provost 12155824df8dSKristof Provost return (0); 12165824df8dSKristof Provost 12175824df8dSKristof Provost out: 12185824df8dSKristof Provost nlmsg_abort(nw); 12195824df8dSKristof Provost return (error); 12205824df8dSKristof Provost } 12215824df8dSKristof Provost 12229dbbe68bSKristof Provost static int 12239dbbe68bSKristof Provost pf_handle_clear_status(struct nlmsghdr *hdr, struct nl_pstate *npt) 12249dbbe68bSKristof Provost { 12259dbbe68bSKristof Provost pf_ioctl_clear_status(); 12269dbbe68bSKristof Provost 12279dbbe68bSKristof Provost return (0); 12289dbbe68bSKristof Provost } 12299dbbe68bSKristof Provost 123071d3c704SKristof Provost struct pf_nl_natlook { 123171d3c704SKristof Provost sa_family_t af; 123271d3c704SKristof Provost uint8_t direction; 123371d3c704SKristof Provost uint8_t proto; 123471d3c704SKristof Provost struct pf_addr src; 123571d3c704SKristof Provost struct pf_addr dst; 123671d3c704SKristof Provost uint16_t sport; 123771d3c704SKristof Provost uint16_t dport; 123871d3c704SKristof Provost }; 123971d3c704SKristof Provost 124071d3c704SKristof Provost #define _IN(_field) offsetof(struct genlmsghdr, _field) 124171d3c704SKristof Provost #define _OUT(_field) offsetof(struct pf_nl_natlook, _field) 124271d3c704SKristof Provost static const struct nlattr_parser nla_p_natlook[] = { 124371d3c704SKristof Provost { .type = PF_NL_AF, .off = _OUT(af), .cb = nlattr_get_uint8 }, 124471d3c704SKristof Provost { .type = PF_NL_DIRECTION, .off = _OUT(direction), .cb = nlattr_get_uint8 }, 124571d3c704SKristof Provost { .type = PF_NL_PROTO, .off = _OUT(proto), .cb = nlattr_get_uint8 }, 124671d3c704SKristof Provost { .type = PF_NL_SRC_ADDR, .off = _OUT(src), .cb = nlattr_get_in6_addr }, 124771d3c704SKristof Provost { .type = PF_NL_DST_ADDR, .off = _OUT(dst), .cb = nlattr_get_in6_addr }, 124871d3c704SKristof Provost { .type = PF_NL_SRC_PORT, .off = _OUT(sport), .cb = nlattr_get_uint16 }, 124971d3c704SKristof Provost { .type = PF_NL_DST_PORT, .off = _OUT(dport), .cb = nlattr_get_uint16 }, 125071d3c704SKristof Provost }; 125171d3c704SKristof Provost static const struct nlfield_parser nlf_p_natlook[] = {}; 125271d3c704SKristof Provost #undef _IN 125371d3c704SKristof Provost #undef _OUT 125471d3c704SKristof Provost NL_DECLARE_PARSER(natlook_parser, struct genlmsghdr, nlf_p_natlook, nla_p_natlook); 125571d3c704SKristof Provost 125671d3c704SKristof Provost static int 125771d3c704SKristof Provost pf_handle_natlook(struct nlmsghdr *hdr, struct nl_pstate *npt) 125871d3c704SKristof Provost { 125971d3c704SKristof Provost struct pf_nl_natlook attrs = {}; 126071d3c704SKristof Provost struct pf_state_key_cmp key = {}; 126171d3c704SKristof Provost struct nl_writer *nw = npt->nw; 126271d3c704SKristof Provost struct pf_state_key *sk; 126371d3c704SKristof Provost struct pf_kstate *state; 126471d3c704SKristof Provost struct genlmsghdr *ghdr_new; 126571d3c704SKristof Provost int error, m; 126671d3c704SKristof Provost int sidx, didx; 126771d3c704SKristof Provost 126871d3c704SKristof Provost error = nl_parse_nlmsg(hdr, &natlook_parser, npt, &attrs); 126971d3c704SKristof Provost if (error != 0) 127071d3c704SKristof Provost return (error); 127171d3c704SKristof Provost 127271d3c704SKristof Provost if (attrs.proto == 0 || 127371d3c704SKristof Provost PF_AZERO(&attrs.src, attrs.af) || 127471d3c704SKristof Provost PF_AZERO(&attrs.dst, attrs.af) || 127571d3c704SKristof Provost ((attrs.proto == IPPROTO_TCP || attrs.proto == IPPROTO_UDP) && 127671d3c704SKristof Provost (attrs.sport == 0 || attrs.dport == 0))) 127771d3c704SKristof Provost return (EINVAL); 127871d3c704SKristof Provost 127971d3c704SKristof Provost /* NATLOOK src and dst are reversed, so reverse sidx/didx */ 128071d3c704SKristof Provost sidx = (attrs.direction == PF_IN) ? 1 : 0; 128171d3c704SKristof Provost didx = (attrs.direction == PF_IN) ? 0 : 1; 128271d3c704SKristof Provost 128371d3c704SKristof Provost key.af = attrs.af; 128471d3c704SKristof Provost key.proto = attrs.proto; 128571d3c704SKristof Provost PF_ACPY(&key.addr[sidx], &attrs.src, attrs.af); 128671d3c704SKristof Provost key.port[sidx] = attrs.sport; 128771d3c704SKristof Provost PF_ACPY(&key.addr[didx], &attrs.dst, attrs.af); 128871d3c704SKristof Provost key.port[didx] = attrs.dport; 128971d3c704SKristof Provost 129071d3c704SKristof Provost state = pf_find_state_all(&key, attrs.direction, &m); 129171d3c704SKristof Provost if (state == NULL) 129271d3c704SKristof Provost return (ENOENT); 129371d3c704SKristof Provost if (m > 1) { 129471d3c704SKristof Provost PF_STATE_UNLOCK(state); 129571d3c704SKristof Provost return (E2BIG); 129671d3c704SKristof Provost } 129771d3c704SKristof Provost 129871d3c704SKristof Provost if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) { 129971d3c704SKristof Provost PF_STATE_UNLOCK(state); 130071d3c704SKristof Provost return (ENOMEM); 130171d3c704SKristof Provost } 130271d3c704SKristof Provost 130371d3c704SKristof Provost ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 130471d3c704SKristof Provost ghdr_new->cmd = PFNL_CMD_NATLOOK; 130571d3c704SKristof Provost ghdr_new->version = 0; 130671d3c704SKristof Provost ghdr_new->reserved = 0; 130771d3c704SKristof Provost 130871d3c704SKristof Provost sk = state->key[sidx]; 130971d3c704SKristof Provost 131071d3c704SKristof Provost nlattr_add_in6_addr(nw, PF_NL_SRC_ADDR, &sk->addr[sidx].v6); 131171d3c704SKristof Provost nlattr_add_in6_addr(nw, PF_NL_DST_ADDR, &sk->addr[didx].v6); 131271d3c704SKristof Provost nlattr_add_u16(nw, PF_NL_SRC_PORT, sk->port[sidx]); 131371d3c704SKristof Provost nlattr_add_u16(nw, PF_NL_DST_PORT, sk->port[didx]); 131471d3c704SKristof Provost 131571d3c704SKristof Provost PF_STATE_UNLOCK(state); 131671d3c704SKristof Provost 131771d3c704SKristof Provost if (!nlmsg_end(nw)) { 131871d3c704SKristof Provost nlmsg_abort(nw); 131971d3c704SKristof Provost return (ENOMEM); 132071d3c704SKristof Provost } 132171d3c704SKristof Provost 132271d3c704SKristof Provost return (0); 132371d3c704SKristof Provost } 132471d3c704SKristof Provost 1325c36c90a2SKristof Provost struct pf_nl_set_debug 1326c36c90a2SKristof Provost { 1327c36c90a2SKristof Provost uint32_t level; 1328c36c90a2SKristof Provost }; 1329c36c90a2SKristof Provost #define _OUT(_field) offsetof(struct pf_nl_set_debug, _field) 1330c36c90a2SKristof Provost static const struct nlattr_parser nla_p_set_debug[] = { 1331c36c90a2SKristof Provost { .type = PF_SD_LEVEL, .off = _OUT(level), .cb = nlattr_get_uint32 }, 1332c36c90a2SKristof Provost }; 1333c36c90a2SKristof Provost static const struct nlfield_parser nlf_p_set_debug[] = {}; 1334c36c90a2SKristof Provost #undef _OUT 1335c36c90a2SKristof Provost NL_DECLARE_PARSER(set_debug_parser, struct genlmsghdr, nlf_p_set_debug, nla_p_set_debug); 1336c36c90a2SKristof Provost 1337c36c90a2SKristof Provost static int 1338c36c90a2SKristof Provost pf_handle_set_debug(struct nlmsghdr *hdr, struct nl_pstate *npt) 1339c36c90a2SKristof Provost { 1340c36c90a2SKristof Provost struct pf_nl_set_debug attrs = {}; 1341c36c90a2SKristof Provost int error; 1342c36c90a2SKristof Provost 1343c36c90a2SKristof Provost error = nl_parse_nlmsg(hdr, &set_debug_parser, npt, &attrs); 1344c36c90a2SKristof Provost if (error != 0) 1345c36c90a2SKristof Provost return (error); 1346c36c90a2SKristof Provost 1347c36c90a2SKristof Provost PF_RULES_WLOCK(); 1348c36c90a2SKristof Provost V_pf_status.debug = attrs.level; 1349c36c90a2SKristof Provost PF_RULES_WUNLOCK(); 1350c36c90a2SKristof Provost 1351c36c90a2SKristof Provost return (0); 1352c36c90a2SKristof Provost } 1353c36c90a2SKristof Provost 135430bad751SKristof Provost struct pf_nl_set_timeout 135530bad751SKristof Provost { 135630bad751SKristof Provost uint32_t timeout; 135730bad751SKristof Provost uint32_t seconds; 135830bad751SKristof Provost }; 135930bad751SKristof Provost #define _OUT(_field) offsetof(struct pf_nl_set_timeout, _field) 136030bad751SKristof Provost static const struct nlattr_parser nla_p_set_timeout[] = { 136130bad751SKristof Provost { .type = PF_TO_TIMEOUT, .off = _OUT(timeout), .cb = nlattr_get_uint32 }, 136230bad751SKristof Provost { .type = PF_TO_SECONDS, .off = _OUT(seconds), .cb = nlattr_get_uint32 }, 136330bad751SKristof Provost }; 136430bad751SKristof Provost static const struct nlfield_parser nlf_p_set_timeout[] = {}; 136530bad751SKristof Provost #undef _OUT 136630bad751SKristof Provost NL_DECLARE_PARSER(set_timeout_parser, struct genlmsghdr, nlf_p_set_timeout, nla_p_set_timeout); 136730bad751SKristof Provost 136830bad751SKristof Provost static int 136930bad751SKristof Provost pf_handle_set_timeout(struct nlmsghdr *hdr, struct nl_pstate *npt) 137030bad751SKristof Provost { 137130bad751SKristof Provost struct pf_nl_set_timeout attrs = {}; 137230bad751SKristof Provost int error; 137330bad751SKristof Provost 137430bad751SKristof Provost error = nl_parse_nlmsg(hdr, &set_timeout_parser, npt, &attrs); 137530bad751SKristof Provost if (error != 0) 137630bad751SKristof Provost return (error); 137730bad751SKristof Provost 137830bad751SKristof Provost return (pf_ioctl_set_timeout(attrs.timeout, attrs.seconds, NULL)); 137930bad751SKristof Provost } 138030bad751SKristof Provost 138130bad751SKristof Provost static int 138230bad751SKristof Provost pf_handle_get_timeout(struct nlmsghdr *hdr, struct nl_pstate *npt) 138330bad751SKristof Provost { 138430bad751SKristof Provost struct pf_nl_set_timeout attrs = {}; 138530bad751SKristof Provost struct nl_writer *nw = npt->nw; 138630bad751SKristof Provost struct genlmsghdr *ghdr_new; 138730bad751SKristof Provost int error; 138830bad751SKristof Provost 138930bad751SKristof Provost error = nl_parse_nlmsg(hdr, &set_timeout_parser, npt, &attrs); 139030bad751SKristof Provost if (error != 0) 139130bad751SKristof Provost return (error); 139230bad751SKristof Provost 139330bad751SKristof Provost error = pf_ioctl_get_timeout(attrs.timeout, &attrs.seconds); 139430bad751SKristof Provost if (error != 0) 139530bad751SKristof Provost return (error); 139630bad751SKristof Provost 139730bad751SKristof Provost if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 139830bad751SKristof Provost return (ENOMEM); 139930bad751SKristof Provost 140030bad751SKristof Provost ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 140130bad751SKristof Provost ghdr_new->cmd = PFNL_CMD_GET_TIMEOUT; 140230bad751SKristof Provost ghdr_new->version = 0; 140330bad751SKristof Provost ghdr_new->reserved = 0; 140430bad751SKristof Provost 140530bad751SKristof Provost nlattr_add_u32(nw, PF_TO_SECONDS, attrs.seconds); 140630bad751SKristof Provost 140730bad751SKristof Provost if (!nlmsg_end(nw)) { 140830bad751SKristof Provost nlmsg_abort(nw); 140930bad751SKristof Provost return (ENOMEM); 141030bad751SKristof Provost } 141130bad751SKristof Provost 141230bad751SKristof Provost return (0); 141330bad751SKristof Provost } 141430bad751SKristof Provost 1415d9ab8999SKristof Provost struct pf_nl_set_limit 1416d9ab8999SKristof Provost { 1417d9ab8999SKristof Provost uint32_t index; 1418d9ab8999SKristof Provost uint32_t limit; 1419d9ab8999SKristof Provost }; 1420d9ab8999SKristof Provost #define _OUT(_field) offsetof(struct pf_nl_set_limit, _field) 1421d9ab8999SKristof Provost static const struct nlattr_parser nla_p_set_limit[] = { 1422d9ab8999SKristof Provost { .type = PF_LI_INDEX, .off = _OUT(index), .cb = nlattr_get_uint32 }, 1423d9ab8999SKristof Provost { .type = PF_LI_LIMIT, .off = _OUT(limit), .cb = nlattr_get_uint32 }, 1424d9ab8999SKristof Provost }; 1425d9ab8999SKristof Provost static const struct nlfield_parser nlf_p_set_limit[] = {}; 1426d9ab8999SKristof Provost #undef _OUT 1427d9ab8999SKristof Provost NL_DECLARE_PARSER(set_limit_parser, struct genlmsghdr, nlf_p_set_limit, nla_p_set_limit); 1428d9ab8999SKristof Provost 1429d9ab8999SKristof Provost static int 1430d9ab8999SKristof Provost pf_handle_set_limit(struct nlmsghdr *hdr, struct nl_pstate *npt) 1431d9ab8999SKristof Provost { 1432d9ab8999SKristof Provost struct pf_nl_set_limit attrs = {}; 1433d9ab8999SKristof Provost int error; 1434d9ab8999SKristof Provost 1435d9ab8999SKristof Provost error = nl_parse_nlmsg(hdr, &set_limit_parser, npt, &attrs); 1436d9ab8999SKristof Provost if (error != 0) 1437d9ab8999SKristof Provost return (error); 1438d9ab8999SKristof Provost 1439d9ab8999SKristof Provost return (pf_ioctl_set_limit(attrs.index, attrs.limit, NULL)); 1440d9ab8999SKristof Provost } 1441d9ab8999SKristof Provost 1442d9ab8999SKristof Provost static int 1443d9ab8999SKristof Provost pf_handle_get_limit(struct nlmsghdr *hdr, struct nl_pstate *npt) 1444d9ab8999SKristof Provost { 1445d9ab8999SKristof Provost struct pf_nl_set_limit attrs = {}; 1446d9ab8999SKristof Provost struct nl_writer *nw = npt->nw; 1447d9ab8999SKristof Provost struct genlmsghdr *ghdr_new; 1448d9ab8999SKristof Provost int error; 1449d9ab8999SKristof Provost 1450d9ab8999SKristof Provost error = nl_parse_nlmsg(hdr, &set_limit_parser, npt, &attrs); 1451d9ab8999SKristof Provost if (error != 0) 1452d9ab8999SKristof Provost return (error); 1453d9ab8999SKristof Provost 1454d9ab8999SKristof Provost error = pf_ioctl_get_limit(attrs.index, &attrs.limit); 1455d9ab8999SKristof Provost if (error != 0) 1456d9ab8999SKristof Provost return (error); 1457d9ab8999SKristof Provost 1458d9ab8999SKristof Provost if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 1459d9ab8999SKristof Provost return (ENOMEM); 1460d9ab8999SKristof Provost 1461d9ab8999SKristof Provost ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1462d9ab8999SKristof Provost ghdr_new->cmd = PFNL_CMD_GET_LIMIT; 1463d9ab8999SKristof Provost ghdr_new->version = 0; 1464d9ab8999SKristof Provost ghdr_new->reserved = 0; 1465d9ab8999SKristof Provost 1466d9ab8999SKristof Provost nlattr_add_u32(nw, PF_LI_LIMIT, attrs.limit); 1467d9ab8999SKristof Provost 1468d9ab8999SKristof Provost if (!nlmsg_end(nw)) { 1469d9ab8999SKristof Provost nlmsg_abort(nw); 1470d9ab8999SKristof Provost return (ENOMEM); 1471d9ab8999SKristof Provost } 1472d9ab8999SKristof Provost 1473d9ab8999SKristof Provost return (0); 1474d9ab8999SKristof Provost } 1475d9ab8999SKristof Provost 1476ba2a9207SKristof Provost static int 1477ba2a9207SKristof Provost pf_handle_begin_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt) 1478ba2a9207SKristof Provost { 1479ba2a9207SKristof Provost struct nl_writer *nw = npt->nw; 1480ba2a9207SKristof Provost struct genlmsghdr *ghdr_new; 1481ba2a9207SKristof Provost uint32_t ticket; 1482ba2a9207SKristof Provost int error; 1483ba2a9207SKristof Provost 1484ba2a9207SKristof Provost error = pf_ioctl_begin_addrs(&ticket); 1485ba2a9207SKristof Provost if (error != 0) 1486ba2a9207SKristof Provost return (error); 1487ba2a9207SKristof Provost 1488ba2a9207SKristof Provost if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 1489ba2a9207SKristof Provost return (ENOMEM); 1490ba2a9207SKristof Provost 1491ba2a9207SKristof Provost ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1492ba2a9207SKristof Provost ghdr_new->cmd = PFNL_CMD_BEGIN_ADDRS; 1493ba2a9207SKristof Provost ghdr_new->version = 0; 1494ba2a9207SKristof Provost ghdr_new->reserved = 0; 1495ba2a9207SKristof Provost 1496ba2a9207SKristof Provost nlattr_add_u32(nw, PF_BA_TICKET, ticket); 1497ba2a9207SKristof Provost 1498ba2a9207SKristof Provost if (!nlmsg_end(nw)) { 1499ba2a9207SKristof Provost nlmsg_abort(nw); 1500ba2a9207SKristof Provost return (ENOMEM); 1501ba2a9207SKristof Provost } 1502ba2a9207SKristof Provost 1503ba2a9207SKristof Provost return (0); 1504ba2a9207SKristof Provost } 1505ba2a9207SKristof Provost 1506644b7b5aSKristof Provost static bool 1507644b7b5aSKristof Provost nlattr_add_pool_addr(struct nl_writer *nw, int attrtype, struct pf_pooladdr *a) 1508644b7b5aSKristof Provost { 1509644b7b5aSKristof Provost int off; 1510644b7b5aSKristof Provost 1511644b7b5aSKristof Provost off = nlattr_add_nested(nw, attrtype); 1512644b7b5aSKristof Provost 1513644b7b5aSKristof Provost nlattr_add_addr_wrap(nw, PF_PA_ADDR, &a->addr); 1514644b7b5aSKristof Provost nlattr_add_string(nw, PF_PA_IFNAME, a->ifname); 1515644b7b5aSKristof Provost 1516644b7b5aSKristof Provost nlattr_set_len(nw, off); 1517644b7b5aSKristof Provost 1518644b7b5aSKristof Provost return (true); 1519644b7b5aSKristof Provost } 1520644b7b5aSKristof Provost 1521d909f06bSKristof Provost #define _OUT(_field) offsetof(struct pf_pooladdr, _field) 1522d909f06bSKristof Provost static const struct nlattr_parser nla_p_pool_addr[] = { 1523d909f06bSKristof Provost { .type = PF_PA_ADDR, .off = _OUT(addr), .arg = &addr_wrap_parser, .cb = nlattr_get_nested }, 1524d909f06bSKristof Provost { .type = PF_PA_IFNAME, .off = _OUT(ifname), .arg = (void *)IFNAMSIZ, .cb = nlattr_get_chara }, 1525d909f06bSKristof Provost }; 1526d909f06bSKristof Provost NL_DECLARE_ATTR_PARSER(pool_addr_parser, nla_p_pool_addr); 1527d909f06bSKristof Provost #undef _OUT 1528d909f06bSKristof Provost 1529d909f06bSKristof Provost #define _OUT(_field) offsetof(struct pfioc_pooladdr, _field) 1530d909f06bSKristof Provost static const struct nlattr_parser nla_p_add_addr[] = { 1531d909f06bSKristof Provost { .type = PF_AA_ACTION, .off = _OUT(action), .cb = nlattr_get_uint32 }, 1532d909f06bSKristof Provost { .type = PF_AA_TICKET, .off = _OUT(ticket), .cb = nlattr_get_uint32 }, 1533d909f06bSKristof Provost { .type = PF_AA_NR, .off = _OUT(nr), .cb = nlattr_get_uint32 }, 1534d909f06bSKristof Provost { .type = PF_AA_R_NUM, .off = _OUT(r_num), .cb = nlattr_get_uint32 }, 1535d909f06bSKristof Provost { .type = PF_AA_R_ACTION, .off = _OUT(r_action), .cb = nlattr_get_uint8 }, 1536d909f06bSKristof Provost { .type = PF_AA_R_LAST, .off = _OUT(r_last), .cb = nlattr_get_uint8 }, 1537d909f06bSKristof Provost { .type = PF_AA_AF, .off = _OUT(af), .cb = nlattr_get_uint8 }, 1538d909f06bSKristof Provost { .type = PF_AA_ANCHOR, .off = _OUT(anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara }, 1539d909f06bSKristof Provost { .type = PF_AA_ADDR, .off = _OUT(addr), .arg = &pool_addr_parser, .cb = nlattr_get_nested }, 1540d909f06bSKristof Provost }; 1541d909f06bSKristof Provost static const struct nlfield_parser nlf_p_add_addr[] = {}; 1542d909f06bSKristof Provost #undef _OUT 1543d909f06bSKristof Provost NL_DECLARE_PARSER(add_addr_parser, struct genlmsghdr, nlf_p_add_addr, nla_p_add_addr); 1544d909f06bSKristof Provost 1545d909f06bSKristof Provost static int 1546d909f06bSKristof Provost pf_handle_add_addr(struct nlmsghdr *hdr, struct nl_pstate *npt) 1547d909f06bSKristof Provost { 1548d909f06bSKristof Provost struct pfioc_pooladdr attrs = { 0 }; 1549d909f06bSKristof Provost int error; 1550d909f06bSKristof Provost 1551d909f06bSKristof Provost error = nl_parse_nlmsg(hdr, &add_addr_parser, npt, &attrs); 1552d909f06bSKristof Provost if (error != 0) 1553d909f06bSKristof Provost return (error); 1554d909f06bSKristof Provost 1555d909f06bSKristof Provost error = pf_ioctl_add_addr(&attrs); 1556d909f06bSKristof Provost 1557d909f06bSKristof Provost return (error); 1558d909f06bSKristof Provost } 1559d909f06bSKristof Provost 1560644b7b5aSKristof Provost static int 1561644b7b5aSKristof Provost pf_handle_get_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt) 1562644b7b5aSKristof Provost { 1563644b7b5aSKristof Provost struct pfioc_pooladdr attrs = { 0 }; 1564644b7b5aSKristof Provost struct nl_writer *nw = npt->nw; 1565644b7b5aSKristof Provost struct genlmsghdr *ghdr_new; 1566644b7b5aSKristof Provost int error; 1567644b7b5aSKristof Provost 1568644b7b5aSKristof Provost error = nl_parse_nlmsg(hdr, &add_addr_parser, npt, &attrs); 1569644b7b5aSKristof Provost if (error != 0) 1570644b7b5aSKristof Provost return (error); 1571644b7b5aSKristof Provost 1572644b7b5aSKristof Provost error = pf_ioctl_get_addrs(&attrs); 1573644b7b5aSKristof Provost if (error != 0) 1574644b7b5aSKristof Provost return (error); 1575644b7b5aSKristof Provost 1576644b7b5aSKristof Provost if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 1577644b7b5aSKristof Provost return (ENOMEM); 1578644b7b5aSKristof Provost 1579644b7b5aSKristof Provost ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1580644b7b5aSKristof Provost ghdr_new->cmd = PFNL_CMD_GET_ADDRS; 1581644b7b5aSKristof Provost ghdr_new->version = 0; 1582644b7b5aSKristof Provost ghdr_new->reserved = 0; 1583644b7b5aSKristof Provost 1584644b7b5aSKristof Provost nlattr_add_u32(nw, PF_AA_NR, attrs.nr); 1585644b7b5aSKristof Provost 1586644b7b5aSKristof Provost if (!nlmsg_end(nw)) { 1587644b7b5aSKristof Provost nlmsg_abort(nw); 1588644b7b5aSKristof Provost return (ENOMEM); 1589644b7b5aSKristof Provost } 1590644b7b5aSKristof Provost 1591644b7b5aSKristof Provost return (error); 1592644b7b5aSKristof Provost } 1593644b7b5aSKristof Provost 15949ae91f59SKristof Provost static int 15959ae91f59SKristof Provost pf_handle_get_addr(struct nlmsghdr *hdr, struct nl_pstate *npt) 15969ae91f59SKristof Provost { 15979ae91f59SKristof Provost struct pfioc_pooladdr attrs = { 0 }; 15989ae91f59SKristof Provost struct nl_writer *nw = npt->nw; 15999ae91f59SKristof Provost struct genlmsghdr *ghdr_new; 16009ae91f59SKristof Provost int error; 16019ae91f59SKristof Provost 16029ae91f59SKristof Provost error = nl_parse_nlmsg(hdr, &add_addr_parser, npt, &attrs); 16039ae91f59SKristof Provost if (error != 0) 16049ae91f59SKristof Provost return (error); 16059ae91f59SKristof Provost 16069ae91f59SKristof Provost error = pf_ioctl_get_addr(&attrs); 16079ae91f59SKristof Provost if (error != 0) 16089ae91f59SKristof Provost return (error); 16099ae91f59SKristof Provost 16109ae91f59SKristof Provost if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 16119ae91f59SKristof Provost return (ENOMEM); 16129ae91f59SKristof Provost 16139ae91f59SKristof Provost ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 16149ae91f59SKristof Provost ghdr_new->cmd = PFNL_CMD_GET_ADDRS; 16159ae91f59SKristof Provost ghdr_new->version = 0; 16169ae91f59SKristof Provost ghdr_new->reserved = 0; 16179ae91f59SKristof Provost 16189ae91f59SKristof Provost nlattr_add_u32(nw, PF_AA_ACTION, attrs.action); 16199ae91f59SKristof Provost nlattr_add_u32(nw, PF_AA_TICKET, attrs.ticket); 16209ae91f59SKristof Provost nlattr_add_u32(nw, PF_AA_NR, attrs.nr); 16219ae91f59SKristof Provost nlattr_add_u32(nw, PF_AA_R_NUM, attrs.r_num); 16229ae91f59SKristof Provost nlattr_add_u8(nw, PF_AA_R_ACTION, attrs.r_action); 16239ae91f59SKristof Provost nlattr_add_u8(nw, PF_AA_R_LAST, attrs.r_last); 16249ae91f59SKristof Provost nlattr_add_u8(nw, PF_AA_AF, attrs.af); 16259ae91f59SKristof Provost nlattr_add_string(nw, PF_AA_ANCHOR, attrs.anchor); 16269ae91f59SKristof Provost nlattr_add_pool_addr(nw, PF_AA_ADDR, &attrs.addr); 16279ae91f59SKristof Provost 16289ae91f59SKristof Provost if (!nlmsg_end(nw)) { 16299ae91f59SKristof Provost nlmsg_abort(nw); 16309ae91f59SKristof Provost return (ENOMEM); 16319ae91f59SKristof Provost } 16329ae91f59SKristof Provost 16339ae91f59SKristof Provost return (0); 16349ae91f59SKristof Provost } 16359ae91f59SKristof Provost 163644f323ecSKristof Provost static const struct nlhdr_parser *all_parsers[] = { 163744f323ecSKristof Provost &state_parser, 163844f323ecSKristof Provost &addrule_parser, 1639706d465dSKristof Provost &getrules_parser, 1640706d465dSKristof Provost &clear_states_parser, 1641470a2b33SKristof Provost &set_statusif_parser, 164271d3c704SKristof Provost &natlook_parser, 1643c36c90a2SKristof Provost &set_debug_parser, 164430bad751SKristof Provost &set_timeout_parser, 1645d9ab8999SKristof Provost &set_limit_parser, 1646d909f06bSKristof Provost &pool_addr_parser, 1647d909f06bSKristof Provost &add_addr_parser, 164844f323ecSKristof Provost }; 16492cef6288SAlexander V. Chernikov 16502cef6288SAlexander V. Chernikov static int family_id; 16512cef6288SAlexander V. Chernikov 16522cef6288SAlexander V. Chernikov static const struct genl_cmd pf_cmds[] = { 16532cef6288SAlexander V. Chernikov { 16542cef6288SAlexander V. Chernikov .cmd_num = PFNL_CMD_GETSTATES, 16552cef6288SAlexander V. Chernikov .cmd_name = "GETSTATES", 16562cef6288SAlexander V. Chernikov .cmd_cb = pf_handle_getstates, 16572cef6288SAlexander V. Chernikov .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1658e774c1efSKristof Provost .cmd_priv = PRIV_NETINET_PF, 16592cef6288SAlexander V. Chernikov }, 1660a7191e5dSKristof Provost { 1661a7191e5dSKristof Provost .cmd_num = PFNL_CMD_GETCREATORS, 1662a7191e5dSKristof Provost .cmd_name = "GETCREATORS", 1663a7191e5dSKristof Provost .cmd_cb = pf_handle_getcreators, 1664a7191e5dSKristof Provost .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1665e774c1efSKristof Provost .cmd_priv = PRIV_NETINET_PF, 1666a7191e5dSKristof Provost }, 166781647eb6SKristof Provost { 166881647eb6SKristof Provost .cmd_num = PFNL_CMD_START, 166981647eb6SKristof Provost .cmd_name = "START", 167081647eb6SKristof Provost .cmd_cb = pf_handle_start, 167181647eb6SKristof Provost .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, 1672e774c1efSKristof Provost .cmd_priv = PRIV_NETINET_PF, 167381647eb6SKristof Provost }, 167481647eb6SKristof Provost { 167581647eb6SKristof Provost .cmd_num = PFNL_CMD_STOP, 167681647eb6SKristof Provost .cmd_name = "STOP", 167781647eb6SKristof Provost .cmd_cb = pf_handle_stop, 167881647eb6SKristof Provost .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, 1679e774c1efSKristof Provost .cmd_priv = PRIV_NETINET_PF, 168081647eb6SKristof Provost }, 1681ffbf2595SKristof Provost { 1682ffbf2595SKristof Provost .cmd_num = PFNL_CMD_ADDRULE, 1683ffbf2595SKristof Provost .cmd_name = "ADDRULE", 1684ffbf2595SKristof Provost .cmd_cb = pf_handle_addrule, 1685ffbf2595SKristof Provost .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1686e774c1efSKristof Provost .cmd_priv = PRIV_NETINET_PF, 1687ffbf2595SKristof Provost }, 168844f323ecSKristof Provost { 168944f323ecSKristof Provost .cmd_num = PFNL_CMD_GETRULES, 169044f323ecSKristof Provost .cmd_name = "GETRULES", 169144f323ecSKristof Provost .cmd_cb = pf_handle_getrules, 169244f323ecSKristof Provost .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1693e774c1efSKristof Provost .cmd_priv = PRIV_NETINET_PF, 169444f323ecSKristof Provost }, 1695777a4702SKristof Provost { 1696777a4702SKristof Provost .cmd_num = PFNL_CMD_GETRULE, 1697777a4702SKristof Provost .cmd_name = "GETRULE", 1698777a4702SKristof Provost .cmd_cb = pf_handle_getrule, 1699777a4702SKristof Provost .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1700777a4702SKristof Provost .cmd_priv = PRIV_NETINET_PF, 1701777a4702SKristof Provost }, 1702706d465dSKristof Provost { 1703706d465dSKristof Provost .cmd_num = PFNL_CMD_CLRSTATES, 1704706d465dSKristof Provost .cmd_name = "CLRSTATES", 1705706d465dSKristof Provost .cmd_cb = pf_handle_clear_states, 1706706d465dSKristof Provost .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1707706d465dSKristof Provost .cmd_priv = PRIV_NETINET_PF, 1708706d465dSKristof Provost }, 1709706d465dSKristof Provost { 1710706d465dSKristof Provost .cmd_num = PFNL_CMD_KILLSTATES, 1711706d465dSKristof Provost .cmd_name = "KILLSTATES", 1712706d465dSKristof Provost .cmd_cb = pf_handle_kill_states, 1713706d465dSKristof Provost .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1714706d465dSKristof Provost .cmd_priv = PRIV_NETINET_PF, 1715706d465dSKristof Provost }, 1716470a2b33SKristof Provost { 1717470a2b33SKristof Provost .cmd_num = PFNL_CMD_SET_STATUSIF, 1718470a2b33SKristof Provost .cmd_name = "SETSTATUSIF", 1719470a2b33SKristof Provost .cmd_cb = pf_handle_set_statusif, 1720470a2b33SKristof Provost .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, 1721470a2b33SKristof Provost .cmd_priv = PRIV_NETINET_PF, 17225824df8dSKristof Provost }, 17235824df8dSKristof Provost { 17245824df8dSKristof Provost .cmd_num = PFNL_CMD_GET_STATUS, 17255824df8dSKristof Provost .cmd_name = "GETSTATUS", 17265824df8dSKristof Provost .cmd_cb = pf_handle_get_status, 17275824df8dSKristof Provost .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 17285824df8dSKristof Provost .cmd_priv = PRIV_NETINET_PF, 17295824df8dSKristof Provost }, 17309dbbe68bSKristof Provost { 17319dbbe68bSKristof Provost .cmd_num = PFNL_CMD_CLEAR_STATUS, 17329dbbe68bSKristof Provost .cmd_name = "CLEARSTATUS", 17339dbbe68bSKristof Provost .cmd_cb = pf_handle_clear_status, 17349dbbe68bSKristof Provost .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, 17359dbbe68bSKristof Provost .cmd_priv = PRIV_NETINET_PF, 17369dbbe68bSKristof Provost }, 173771d3c704SKristof Provost { 173871d3c704SKristof Provost .cmd_num = PFNL_CMD_NATLOOK, 173971d3c704SKristof Provost .cmd_name = "NATLOOK", 174071d3c704SKristof Provost .cmd_cb = pf_handle_natlook, 174171d3c704SKristof Provost .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 174271d3c704SKristof Provost .cmd_priv = PRIV_NETINET_PF, 174371d3c704SKristof Provost }, 1744c36c90a2SKristof Provost { 1745c36c90a2SKristof Provost .cmd_num = PFNL_CMD_SET_DEBUG, 1746c36c90a2SKristof Provost .cmd_name = "SET_DEBUG", 1747c36c90a2SKristof Provost .cmd_cb = pf_handle_set_debug, 1748c36c90a2SKristof Provost .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, 1749c36c90a2SKristof Provost .cmd_priv = PRIV_NETINET_PF, 1750c36c90a2SKristof Provost }, 175130bad751SKristof Provost { 175230bad751SKristof Provost .cmd_num = PFNL_CMD_SET_TIMEOUT, 175330bad751SKristof Provost .cmd_name = "SET_TIMEOUT", 175430bad751SKristof Provost .cmd_cb = pf_handle_set_timeout, 175530bad751SKristof Provost .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, 175630bad751SKristof Provost .cmd_priv = PRIV_NETINET_PF, 175730bad751SKristof Provost }, 175830bad751SKristof Provost { 175930bad751SKristof Provost .cmd_num = PFNL_CMD_GET_TIMEOUT, 176030bad751SKristof Provost .cmd_name = "GET_TIMEOUT", 176130bad751SKristof Provost .cmd_cb = pf_handle_get_timeout, 176230bad751SKristof Provost .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 176330bad751SKristof Provost .cmd_priv = PRIV_NETINET_PF, 176430bad751SKristof Provost }, 1765d9ab8999SKristof Provost { 1766d9ab8999SKristof Provost .cmd_num = PFNL_CMD_SET_LIMIT, 1767d9ab8999SKristof Provost .cmd_name = "SET_LIMIT", 1768d9ab8999SKristof Provost .cmd_cb = pf_handle_set_limit, 1769d9ab8999SKristof Provost .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, 1770d9ab8999SKristof Provost .cmd_priv = PRIV_NETINET_PF, 1771d9ab8999SKristof Provost }, 1772d9ab8999SKristof Provost { 1773d9ab8999SKristof Provost .cmd_num = PFNL_CMD_GET_LIMIT, 1774d9ab8999SKristof Provost .cmd_name = "GET_LIMIT", 1775d9ab8999SKristof Provost .cmd_cb = pf_handle_get_limit, 1776d9ab8999SKristof Provost .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1777d9ab8999SKristof Provost .cmd_priv = PRIV_NETINET_PF, 1778d9ab8999SKristof Provost }, 1779ba2a9207SKristof Provost { 1780ba2a9207SKristof Provost .cmd_num = PFNL_CMD_BEGIN_ADDRS, 1781ba2a9207SKristof Provost .cmd_name = "BEGIN_ADDRS", 1782ba2a9207SKristof Provost .cmd_cb = pf_handle_begin_addrs, 1783ba2a9207SKristof Provost .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1784ba2a9207SKristof Provost .cmd_priv = PRIV_NETINET_PF, 1785ba2a9207SKristof Provost }, 1786d909f06bSKristof Provost { 1787d909f06bSKristof Provost .cmd_num = PFNL_CMD_ADD_ADDR, 1788d909f06bSKristof Provost .cmd_name = "ADD_ADDR", 1789d909f06bSKristof Provost .cmd_cb = pf_handle_add_addr, 1790d909f06bSKristof Provost .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, 1791d909f06bSKristof Provost .cmd_priv = PRIV_NETINET_PF, 1792d909f06bSKristof Provost }, 1793644b7b5aSKristof Provost { 1794644b7b5aSKristof Provost .cmd_num = PFNL_CMD_GET_ADDRS, 1795644b7b5aSKristof Provost .cmd_name = "GET_ADDRS", 1796644b7b5aSKristof Provost .cmd_cb = pf_handle_get_addrs, 1797644b7b5aSKristof Provost .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1798644b7b5aSKristof Provost .cmd_priv = PRIV_NETINET_PF, 1799644b7b5aSKristof Provost }, 18009ae91f59SKristof Provost { 18019ae91f59SKristof Provost .cmd_num = PFNL_CMD_GET_ADDR, 18029ae91f59SKristof Provost .cmd_name = "GET_ADDRS", 18039ae91f59SKristof Provost .cmd_cb = pf_handle_get_addr, 18049ae91f59SKristof Provost .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 18059ae91f59SKristof Provost .cmd_priv = PRIV_NETINET_PF, 18069ae91f59SKristof Provost }, 18072cef6288SAlexander V. Chernikov }; 18082cef6288SAlexander V. Chernikov 18092cef6288SAlexander V. Chernikov void 18102cef6288SAlexander V. Chernikov pf_nl_register(void) 18112cef6288SAlexander V. Chernikov { 18122cef6288SAlexander V. Chernikov NL_VERIFY_PARSERS(all_parsers); 1813ffbf2595SKristof Provost 18142cef6288SAlexander V. Chernikov family_id = genl_register_family(PFNL_FAMILY_NAME, 0, 2, PFNL_CMD_MAX); 18152cef6288SAlexander V. Chernikov genl_register_cmds(PFNL_FAMILY_NAME, pf_cmds, NL_ARRAY_LEN(pf_cmds)); 18162cef6288SAlexander V. Chernikov } 18172cef6288SAlexander V. Chernikov 18182cef6288SAlexander V. Chernikov void 18192cef6288SAlexander V. Chernikov pf_nl_unregister(void) 18202cef6288SAlexander V. Chernikov { 18212cef6288SAlexander V. Chernikov genl_unregister_family(PFNL_FAMILY_NAME); 18222cef6288SAlexander V. Chernikov } 1823