xref: /freebsd/sys/netpfil/pf/pf_nl.c (revision d439598dd0d341b0c0b77151ba904e09c42f8421)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2023 Alexander V. Chernikov <melifaro@FreeBSD.org>
5  * Copyright (c) 2023 Rubicon Communications, LLC (Netgate)
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  *
28  */
29 #include <sys/cdefs.h>
30 #include "opt_inet.h"
31 #include "opt_inet6.h"
32 
33 #include <sys/param.h>
34 #include <sys/malloc.h>
35 #include <sys/mbuf.h>
36 #include <sys/priv.h>
37 #include <sys/socket.h>
38 #include <sys/ucred.h>
39 
40 #include <net/pfvar.h>
41 
42 #include <netlink/netlink.h>
43 #include <netlink/netlink_ctl.h>
44 #include <netlink/netlink_generic.h>
45 #include <netlink/netlink_message_writer.h>
46 
47 #include <netpfil/pf/pf_nl.h>
48 
49 #define	DEBUG_MOD_NAME	nl_pf
50 #define	DEBUG_MAX_LEVEL	LOG_DEBUG3
51 #include <netlink/netlink_debug.h>
52 _DECLARE_DEBUG(LOG_DEBUG);
53 
54 struct nl_parsed_state {
55 	uint8_t		version;
56 	uint32_t	id;
57 	uint32_t	creatorid;
58 	char		ifname[IFNAMSIZ];
59 	uint16_t	proto;
60 	sa_family_t	af;
61 	struct pf_addr	addr;
62 	struct pf_addr	mask;
63 };
64 
65 #define	_IN(_field)	offsetof(struct genlmsghdr, _field)
66 #define	_OUT(_field)	offsetof(struct nl_parsed_state, _field)
67 static const struct nlattr_parser nla_p_state[] = {
68 	{ .type = PF_ST_ID, .off = _OUT(id), .cb = nlattr_get_uint32 },
69 	{ .type = PF_ST_CREATORID, .off = _OUT(creatorid), .cb = nlattr_get_uint32 },
70 	{ .type = PF_ST_IFNAME, .arg = (const void *)IFNAMSIZ, .off = _OUT(ifname), .cb = nlattr_get_chara },
71 	{ .type = PF_ST_AF, .off = _OUT(proto), .cb = nlattr_get_uint8 },
72 	{ .type = PF_ST_PROTO, .off = _OUT(proto), .cb = nlattr_get_uint16 },
73 	{ .type = PF_ST_FILTER_ADDR, .off = _OUT(addr), .cb = nlattr_get_in6_addr },
74 	{ .type = PF_ST_FILTER_MASK, .off = _OUT(mask), .cb = nlattr_get_in6_addr },
75 };
76 static const struct nlfield_parser nlf_p_generic[] = {
77 	{ .off_in = _IN(version), .off_out = _OUT(version), .cb = nlf_get_u8 },
78 };
79 #undef _IN
80 #undef _OUT
81 NL_DECLARE_PARSER(state_parser, struct genlmsghdr, nlf_p_generic, nla_p_state);
82 
83 static void
84 dump_addr(struct nl_writer *nw, int attr, const struct pf_addr *addr, int af)
85 {
86 	switch (af) {
87 	case AF_INET:
88 		nlattr_add(nw, attr, 4, &addr->v4);
89 		break;
90 	case AF_INET6:
91 		nlattr_add(nw, attr, 16, &addr->v6);
92 		break;
93 	};
94 }
95 
96 static bool
97 dump_state_peer(struct nl_writer *nw, int attr, const struct pf_state_peer *peer)
98 {
99 	int off = nlattr_add_nested(nw, attr);
100 	if (off == 0)
101 		return (false);
102 
103 	nlattr_add_u32(nw, PF_STP_SEQLO, peer->seqlo);
104 	nlattr_add_u32(nw, PF_STP_SEQHI, peer->seqhi);
105 	nlattr_add_u32(nw, PF_STP_SEQDIFF, peer->seqdiff);
106 	nlattr_add_u16(nw, PF_STP_MAX_WIN, peer->max_win);
107 	nlattr_add_u16(nw, PF_STP_MSS, peer->mss);
108 	nlattr_add_u8(nw, PF_STP_STATE, peer->state);
109 	nlattr_add_u8(nw, PF_STP_WSCALE, peer->wscale);
110 
111 	if (peer->scrub != NULL) {
112 		struct pf_state_scrub *sc = peer->scrub;
113 		uint16_t pfss_flags = sc->pfss_flags & PFSS_TIMESTAMP;
114 
115 		nlattr_add_u16(nw, PF_STP_PFSS_FLAGS, pfss_flags);
116 		nlattr_add_u32(nw, PF_STP_PFSS_TS_MOD, sc->pfss_ts_mod);
117 		nlattr_add_u8(nw, PF_STP_PFSS_TTL, sc->pfss_ttl);
118 		nlattr_add_u8(nw, PF_STP_SCRUB_FLAG, PFSYNC_SCRUB_FLAG_VALID);
119 	}
120 	nlattr_set_len(nw, off);
121 
122 	return (true);
123 }
124 
125 static bool
126 dump_state_key(struct nl_writer *nw, int attr, const struct pf_state_key *key)
127 {
128 	int off = nlattr_add_nested(nw, attr);
129 	if (off == 0)
130 		return (false);
131 
132 	dump_addr(nw, PF_STK_ADDR0, &key->addr[0], key->af);
133 	dump_addr(nw, PF_STK_ADDR1, &key->addr[1], key->af);
134 	nlattr_add_u16(nw, PF_STK_PORT0, key->port[0]);
135 	nlattr_add_u16(nw, PF_STK_PORT1, key->port[1]);
136 
137 	nlattr_set_len(nw, off);
138 
139 	return (true);
140 }
141 
142 static int
143 dump_state(struct nlpcb *nlp, const struct nlmsghdr *hdr, struct pf_kstate *s,
144     struct nl_pstate *npt)
145 {
146 	struct nl_writer *nw = npt->nw;
147 	int error = 0;
148 	int af;
149 	struct pf_state_key *key;
150 
151 	PF_STATE_LOCK_ASSERT(s);
152 
153 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
154 		goto enomem;
155 
156 	struct genlmsghdr *ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
157 	ghdr_new->cmd = PFNL_CMD_GETSTATES;
158 	ghdr_new->version = 0;
159 	ghdr_new->reserved = 0;
160 
161 	nlattr_add_u64(nw, PF_ST_VERSION, PF_STATE_VERSION);
162 
163 	key = s->key[PF_SK_WIRE];
164 	if (!dump_state_key(nw, PF_ST_KEY_WIRE, key))
165 		goto enomem;
166 	key = s->key[PF_SK_STACK];
167 	if (!dump_state_key(nw, PF_ST_KEY_STACK, key))
168 		goto enomem;
169 
170 	af = s->key[PF_SK_WIRE]->af;
171 	nlattr_add_u8(nw, PF_ST_PROTO, s->key[PF_SK_WIRE]->proto);
172 	nlattr_add_u8(nw, PF_ST_AF, af);
173 
174 	nlattr_add_string(nw, PF_ST_IFNAME, s->kif->pfik_name);
175 	nlattr_add_string(nw, PF_ST_ORIG_IFNAME, s->orig_kif->pfik_name);
176 	dump_addr(nw, PF_ST_RT_ADDR, &s->rt_addr, af);
177 	nlattr_add_u32(nw, PF_ST_CREATION, time_uptime - (s->creation / 1000));
178 	uint32_t expire = pf_state_expires(s);
179 	if (expire > time_uptime)
180 		expire = expire - time_uptime;
181 	nlattr_add_u32(nw, PF_ST_EXPIRE, expire);
182 	nlattr_add_u8(nw, PF_ST_DIRECTION, s->direction);
183 	nlattr_add_u8(nw, PF_ST_LOG, s->act.log);
184 	nlattr_add_u8(nw, PF_ST_TIMEOUT, s->timeout);
185 	nlattr_add_u16(nw, PF_ST_STATE_FLAGS, s->state_flags);
186 	uint8_t sync_flags = 0;
187 	if (s->src_node)
188 		sync_flags |= PFSYNC_FLAG_SRCNODE;
189 	if (s->nat_src_node)
190 		sync_flags |= PFSYNC_FLAG_NATSRCNODE;
191 	nlattr_add_u8(nw, PF_ST_SYNC_FLAGS, sync_flags);
192 	nlattr_add_u64(nw, PF_ST_ID, s->id);
193 	nlattr_add_u32(nw, PF_ST_CREATORID, htonl(s->creatorid));
194 
195 	nlattr_add_u32(nw, PF_ST_RULE, s->rule.ptr ? s->rule.ptr->nr : -1);
196 	nlattr_add_u32(nw, PF_ST_ANCHOR, s->anchor.ptr ? s->anchor.ptr->nr : -1);
197 	nlattr_add_u32(nw, PF_ST_NAT_RULE, s->nat_rule.ptr ? s->nat_rule.ptr->nr : -1);
198 
199 	nlattr_add_u64(nw, PF_ST_PACKETS0, s->packets[0]);
200 	nlattr_add_u64(nw, PF_ST_PACKETS1, s->packets[1]);
201 	nlattr_add_u64(nw, PF_ST_BYTES0, s->bytes[0]);
202 	nlattr_add_u64(nw, PF_ST_BYTES1, s->bytes[1]);
203 	nlattr_add_u32(nw, PF_ST_RTABLEID, s->act.rtableid);
204 	nlattr_add_u8(nw, PF_ST_MIN_TTL, s->act.min_ttl);
205 	nlattr_add_u16(nw, PF_ST_MAX_MSS, s->act.max_mss);
206 	nlattr_add_u16(nw, PF_ST_DNPIPE, s->act.dnpipe);
207 	nlattr_add_u16(nw, PF_ST_DNRPIPE, s->act.dnrpipe);
208 	nlattr_add_u8(nw, PF_ST_RT, s->rt);
209 	if (s->rt_kif != NULL)
210 		nlattr_add_string(nw, PF_ST_RT_IFNAME, s->rt_kif->pfik_name);
211 
212 	if (!dump_state_peer(nw, PF_ST_PEER_SRC, &s->src))
213 		goto enomem;
214 	if (!dump_state_peer(nw, PF_ST_PEER_DST, &s->dst))
215 		goto enomem;
216 
217 	if (nlmsg_end(nw))
218 		return (0);
219 
220 enomem:
221 	error = ENOMEM;
222 	nlmsg_abort(nw);
223 	return (error);
224 }
225 
226 static int
227 handle_dumpstates(struct nlpcb *nlp, struct nl_parsed_state *attrs,
228     struct nlmsghdr *hdr, struct nl_pstate *npt)
229 {
230 	int error = 0;
231 
232 	hdr->nlmsg_flags |= NLM_F_MULTI;
233 
234 	for (int i = 0; i <= V_pf_hashmask; i++) {
235 		struct pf_idhash *ih = &V_pf_idhash[i];
236 		struct pf_kstate *s;
237 
238 		if (LIST_EMPTY(&ih->states))
239 			continue;
240 
241 		PF_HASHROW_LOCK(ih);
242 		LIST_FOREACH(s, &ih->states, entry) {
243 			sa_family_t af = s->key[PF_SK_WIRE]->af;
244 
245 			if (s->timeout == PFTM_UNLINKED)
246 				continue;
247 
248 			/* Filter */
249 			if (attrs->creatorid != 0 && s->creatorid != attrs->creatorid)
250 				continue;
251 			if (attrs->ifname[0] != 0 &&
252 			    strncmp(attrs->ifname, s->kif->pfik_name, IFNAMSIZ) != 0)
253 				continue;
254 			if (attrs->proto != 0 && s->key[PF_SK_WIRE]->proto != attrs->proto)
255 				continue;
256 			if (attrs->af != 0 && af != attrs->af)
257 				continue;
258 			if (pf_match_addr(1, &s->key[PF_SK_WIRE]->addr[0],
259 			    &attrs->mask, &attrs->addr, af) &&
260 			    pf_match_addr(1, &s->key[PF_SK_WIRE]->addr[1],
261 			    &attrs->mask, &attrs->addr, af) &&
262 			    pf_match_addr(1, &s->key[PF_SK_STACK]->addr[0],
263 			    &attrs->mask, &attrs->addr, af) &&
264 			    pf_match_addr(1, &s->key[PF_SK_STACK]->addr[1],
265 			    &attrs->mask, &attrs->addr, af))
266 				continue;
267 
268 			error = dump_state(nlp, hdr, s, npt);
269 			if (error != 0)
270 				break;
271 		}
272 		PF_HASHROW_UNLOCK(ih);
273 	}
274 
275 	if (!nlmsg_end_dump(npt->nw, error, hdr)) {
276 		NL_LOG(LOG_DEBUG, "Unable to finalize the dump");
277 		return (ENOMEM);
278 	}
279 
280 	return (error);
281 }
282 
283 static int
284 handle_getstate(struct nlpcb *nlp, struct nl_parsed_state *attrs,
285     struct nlmsghdr *hdr, struct nl_pstate *npt)
286 {
287 	struct pf_kstate *s;
288 	int ret;
289 
290 	s = pf_find_state_byid(attrs->id, attrs->creatorid);
291 	if (s == NULL)
292 		return (ENOENT);
293 	ret = dump_state(nlp, hdr, s, npt);
294 	PF_STATE_UNLOCK(s);
295 
296 	return (ret);
297 }
298 
299 static int
300 dump_creatorid(struct nlpcb *nlp, const struct nlmsghdr *hdr, uint32_t creator,
301     struct nl_pstate *npt)
302 {
303 	struct nl_writer *nw = npt->nw;
304 
305 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
306 		goto enomem;
307 
308 	struct genlmsghdr *ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
309 	ghdr_new->cmd = PFNL_CMD_GETCREATORS;
310 	ghdr_new->version = 0;
311 	ghdr_new->reserved = 0;
312 
313 	nlattr_add_u32(nw, PF_ST_CREATORID, htonl(creator));
314 
315 	if (nlmsg_end(nw))
316 		return (0);
317 
318 enomem:
319 	nlmsg_abort(nw);
320 	return (ENOMEM);
321 }
322 
323 static int
324 pf_handle_getstates(struct nlmsghdr *hdr, struct nl_pstate *npt)
325 {
326 	int error;
327 
328 	struct nl_parsed_state attrs = {};
329 	error = nl_parse_nlmsg(hdr, &state_parser, npt, &attrs);
330 	if (error != 0)
331 		return (error);
332 
333 	if (attrs.id != 0)
334 		error = handle_getstate(npt->nlp, &attrs, hdr, npt);
335 	else
336 		error = handle_dumpstates(npt->nlp, &attrs, hdr, npt);
337 
338 	return (error);
339 }
340 
341 static int
342 pf_handle_getcreators(struct nlmsghdr *hdr, struct nl_pstate *npt)
343 {
344 	uint32_t creators[16];
345 	int error = 0;
346 
347 	bzero(creators, sizeof(creators));
348 
349 	for (int i = 0; i < V_pf_hashmask; i++) {
350 		struct pf_idhash *ih = &V_pf_idhash[i];
351 		struct pf_kstate *s;
352 
353 		if (LIST_EMPTY(&ih->states))
354 			continue;
355 
356 		PF_HASHROW_LOCK(ih);
357 		LIST_FOREACH(s, &ih->states, entry) {
358 			int j;
359 			if (s->timeout == PFTM_UNLINKED)
360 				continue;
361 
362 			for (j = 0; j < nitems(creators); j++) {
363 				if (creators[j] == s->creatorid)
364 					break;
365 				if (creators[j] == 0) {
366 					creators[j] = s->creatorid;
367 					break;
368 				}
369 			}
370 			if (j == nitems(creators))
371 				printf("Warning: too many creators!\n");
372 		}
373 		PF_HASHROW_UNLOCK(ih);
374 	}
375 
376 	hdr->nlmsg_flags |= NLM_F_MULTI;
377 	for (int i = 0; i < nitems(creators); i++) {
378 		if (creators[i] == 0)
379 			break;
380 		error = dump_creatorid(npt->nlp, hdr, creators[i], npt);
381 	}
382 
383 	if (!nlmsg_end_dump(npt->nw, error, hdr)) {
384 		NL_LOG(LOG_DEBUG, "Unable to finalize the dump");
385 		return (ENOMEM);
386 	}
387 
388 	return (error);
389 }
390 
391 static int
392 pf_handle_start(struct nlmsghdr *hdr __unused, struct nl_pstate *npt __unused)
393 {
394 	return (pf_start());
395 }
396 
397 static int
398 pf_handle_stop(struct nlmsghdr *hdr __unused, struct nl_pstate *npt __unused)
399 {
400 	return (pf_stop());
401 }
402 
403 #define _OUT(_field)	offsetof(struct pf_addr_wrap, _field)
404 static const struct nlattr_parser nla_p_addr_wrap[] = {
405 	{ .type = PF_AT_ADDR, .off = _OUT(v.a.addr), .cb = nlattr_get_in6_addr },
406 	{ .type = PF_AT_MASK, .off = _OUT(v.a.mask), .cb = nlattr_get_in6_addr },
407 	{ .type = PF_AT_IFNAME, .off = _OUT(v.ifname), .arg = (void *)IFNAMSIZ,.cb = nlattr_get_chara },
408 	{ .type = PF_AT_TABLENAME, .off = _OUT(v.tblname), .arg = (void *)PF_TABLE_NAME_SIZE, .cb = nlattr_get_chara },
409 	{ .type = PF_AT_TYPE, .off = _OUT(type), .cb = nlattr_get_uint8 },
410 	{ .type = PF_AT_IFLAGS, .off = _OUT(iflags), .cb = nlattr_get_uint8 },
411 };
412 NL_DECLARE_ATTR_PARSER(addr_wrap_parser, nla_p_addr_wrap);
413 #undef _OUT
414 
415 static bool
416 nlattr_add_addr_wrap(struct nl_writer *nw, int attrtype, struct pf_addr_wrap *a)
417 {
418 	int off = nlattr_add_nested(nw, attrtype);
419 
420 	nlattr_add_in6_addr(nw, PF_AT_ADDR, &a->v.a.addr.v6);
421 	nlattr_add_in6_addr(nw, PF_AT_MASK, &a->v.a.mask.v6);
422 	nlattr_add_u8(nw, PF_AT_TYPE, a->type);
423 	nlattr_add_u8(nw, PF_AT_IFLAGS, a->iflags);
424 
425 	if (a->type == PF_ADDR_DYNIFTL) {
426 		nlattr_add_string(nw, PF_AT_IFNAME, a->v.ifname);
427 		nlattr_add_u32(nw, PF_AT_DYNCNT, a->p.dyncnt);
428 	} else if (a->type == PF_ADDR_TABLE) {
429 		nlattr_add_string(nw, PF_AT_TABLENAME, a->v.tblname);
430 		nlattr_add_u32(nw, PF_AT_TBLCNT, a->p.tblcnt);
431 	}
432 
433 	nlattr_set_len(nw, off);
434 
435 	return (true);
436 }
437 
438 #define _OUT(_field)	offsetof(struct pf_rule_addr, _field)
439 static const struct nlattr_parser nla_p_ruleaddr[] = {
440 	{ .type = PF_RAT_ADDR, .off = _OUT(addr), .arg = &addr_wrap_parser, .cb = nlattr_get_nested },
441 	{ .type = PF_RAT_SRC_PORT, .off = _OUT(port[0]), .cb = nlattr_get_uint16 },
442 	{ .type = PF_RAT_DST_PORT, .off = _OUT(port[1]), .cb = nlattr_get_uint16 },
443 	{ .type = PF_RAT_NEG, .off = _OUT(neg), .cb = nlattr_get_uint8 },
444 	{ .type = PF_RAT_OP, .off = _OUT(port_op), .cb = nlattr_get_uint8 },
445 };
446 NL_DECLARE_ATTR_PARSER(rule_addr_parser, nla_p_ruleaddr);
447 #undef _OUT
448 
449 static bool
450 nlattr_add_rule_addr(struct nl_writer *nw, int attrtype, struct pf_rule_addr *r)
451 {
452 	struct pf_addr_wrap aw = {0};
453 	int off = nlattr_add_nested(nw, attrtype);
454 
455 	bcopy(&(r->addr), &aw, sizeof(struct pf_addr_wrap));
456 	pf_addr_copyout(&aw);
457 
458 	nlattr_add_addr_wrap(nw, PF_RAT_ADDR, &aw);
459 	nlattr_add_u16(nw, PF_RAT_SRC_PORT, r->port[0]);
460 	nlattr_add_u16(nw, PF_RAT_DST_PORT, r->port[1]);
461 	nlattr_add_u8(nw, PF_RAT_NEG, r->neg);
462 	nlattr_add_u8(nw, PF_RAT_OP, r->port_op);
463 
464 	nlattr_set_len(nw, off);
465 
466 	return (true);
467 }
468 
469 #define _OUT(_field)	offsetof(struct pf_mape_portset, _field)
470 static const struct nlattr_parser nla_p_mape_portset[] = {
471 	{ .type = PF_MET_OFFSET, .off = _OUT(offset), .cb = nlattr_get_uint8 },
472 	{ .type = PF_MET_PSID_LEN, .off = _OUT(psidlen), .cb = nlattr_get_uint8 },
473 	{. type = PF_MET_PSID, .off = _OUT(psid), .cb = nlattr_get_uint16 },
474 };
475 NL_DECLARE_ATTR_PARSER(mape_portset_parser, nla_p_mape_portset);
476 #undef _OUT
477 
478 static bool
479 nlattr_add_mape_portset(struct nl_writer *nw, int attrtype, const struct pf_mape_portset *m)
480 {
481 	int off = nlattr_add_nested(nw, attrtype);
482 
483 	nlattr_add_u8(nw, PF_MET_OFFSET, m->offset);
484 	nlattr_add_u8(nw, PF_MET_PSID_LEN, m->psidlen);
485 	nlattr_add_u16(nw, PF_MET_PSID, m->psid);
486 
487 	nlattr_set_len(nw, off);
488 
489 	return (true);
490 }
491 
492 struct nl_parsed_labels
493 {
494 	char		labels[PF_RULE_MAX_LABEL_COUNT][PF_RULE_LABEL_SIZE];
495 	uint32_t	i;
496 };
497 
498 static int
499 nlattr_get_pf_rule_labels(struct nlattr *nla, struct nl_pstate *npt,
500     const void *arg, void *target)
501 {
502 	struct nl_parsed_labels *l = (struct nl_parsed_labels *)target;
503 	int ret;
504 
505 	if (l->i >= PF_RULE_MAX_LABEL_COUNT)
506 		return (E2BIG);
507 
508 	ret = nlattr_get_chara(nla, npt, (void *)PF_RULE_LABEL_SIZE,
509 	    l->labels[l->i]);
510 	if (ret == 0)
511 		l->i++;
512 
513 	return (ret);
514 }
515 
516 #define _OUT(_field)	offsetof(struct nl_parsed_labels, _field)
517 static const struct nlattr_parser nla_p_labels[] = {
518 	{ .type = PF_LT_LABEL, .off = 0, .cb = nlattr_get_pf_rule_labels },
519 };
520 NL_DECLARE_ATTR_PARSER(rule_labels_parser, nla_p_labels);
521 #undef _OUT
522 
523 static int
524 nlattr_get_nested_pf_rule_labels(struct nlattr *nla, struct nl_pstate *npt, const void *arg, void *target)
525 {
526 	struct nl_parsed_labels parsed_labels = { };
527 	int error;
528 
529 	/* Assumes target points to the beginning of the structure */
530 	error = nl_parse_header(NLA_DATA(nla), NLA_DATA_LEN(nla), &rule_labels_parser, npt, &parsed_labels);
531 	if (error != 0)
532 		return (error);
533 
534 	memcpy(target, parsed_labels.labels, sizeof(parsed_labels.labels));
535 
536 	return (0);
537 }
538 
539 static bool
540 nlattr_add_labels(struct nl_writer *nw, int attrtype, const struct pf_krule *r)
541 {
542 	int off = nlattr_add_nested(nw, attrtype);
543 	int i = 0;
544 
545 	while (r->label[i][0] != 0
546 	    && i < PF_RULE_MAX_LABEL_COUNT) {
547 		nlattr_add_string(nw, PF_LT_LABEL, r->label[i]);
548 		i++;
549 	}
550 
551 	nlattr_set_len(nw, off);
552 
553 	return (true);
554 }
555 
556 #define _OUT(_field)	offsetof(struct pf_kpool, _field)
557 static const struct nlattr_parser nla_p_pool[] = {
558 	{ .type = PF_PT_KEY, .off = _OUT(key), .arg = (void *)sizeof(struct pf_poolhashkey), .cb = nlattr_get_bytes },
559 	{ .type = PF_PT_COUNTER, .off = _OUT(counter), .cb = nlattr_get_in6_addr },
560 	{ .type = PF_PT_TBLIDX, .off = _OUT(tblidx), .cb = nlattr_get_uint32 },
561 	{ .type = PF_PT_PROXY_SRC_PORT, .off = _OUT(proxy_port[0]), .cb = nlattr_get_uint16 },
562 	{ .type = PF_PT_PROXY_DST_PORT, .off = _OUT(proxy_port[1]), .cb = nlattr_get_uint16 },
563 	{ .type = PF_PT_OPTS, .off = _OUT(opts), .cb = nlattr_get_uint8 },
564 	{ .type = PF_PT_MAPE, .off = _OUT(mape), .arg = &mape_portset_parser, .cb = nlattr_get_nested },
565 };
566 NL_DECLARE_ATTR_PARSER(pool_parser, nla_p_pool);
567 #undef _OUT
568 
569 static bool
570 nlattr_add_pool(struct nl_writer *nw, int attrtype, const struct pf_kpool *pool)
571 {
572 	int off = nlattr_add_nested(nw, attrtype);
573 
574 	nlattr_add(nw, PF_PT_KEY, sizeof(struct pf_poolhashkey), &pool->key);
575 	nlattr_add_in6_addr(nw, PF_PT_COUNTER, (const struct in6_addr *)&pool->counter);
576 	nlattr_add_u32(nw, PF_PT_TBLIDX, pool->tblidx);
577 	nlattr_add_u16(nw, PF_PT_PROXY_SRC_PORT, pool->proxy_port[0]);
578 	nlattr_add_u16(nw, PF_PT_PROXY_DST_PORT, pool->proxy_port[1]);
579 	nlattr_add_u8(nw, PF_PT_OPTS, pool->opts);
580 	nlattr_add_mape_portset(nw, PF_PT_MAPE, &pool->mape);
581 
582 	nlattr_set_len(nw, off);
583 
584 	return (true);
585 }
586 
587 #define _OUT(_field)	offsetof(struct pf_rule_uid, _field)
588 static const struct nlattr_parser nla_p_rule_uid[] = {
589 	{ .type = PF_RUT_UID_LOW, .off = _OUT(uid[0]), .cb = nlattr_get_uint32 },
590 	{ .type = PF_RUT_UID_HIGH, .off = _OUT(uid[1]), .cb = nlattr_get_uint32 },
591 	{ .type = PF_RUT_OP, .off = _OUT(op), .cb = nlattr_get_uint8 },
592 };
593 NL_DECLARE_ATTR_PARSER(rule_uid_parser, nla_p_rule_uid);
594 #undef _OUT
595 
596 static bool
597 nlattr_add_rule_uid(struct nl_writer *nw, int attrtype, const struct pf_rule_uid *u)
598 {
599 	int off = nlattr_add_nested(nw, attrtype);
600 
601 	nlattr_add_u32(nw, PF_RUT_UID_LOW, u->uid[0]);
602 	nlattr_add_u32(nw, PF_RUT_UID_HIGH, u->uid[1]);
603 	nlattr_add_u8(nw, PF_RUT_OP, u->op);
604 
605 	nlattr_set_len(nw, off);
606 
607 	return (true);
608 }
609 
610 struct nl_parsed_timeouts
611 {
612 	uint32_t	timeouts[PFTM_MAX];
613 	uint32_t	i;
614 };
615 
616 static int
617 nlattr_get_pf_timeout(struct nlattr *nla, struct nl_pstate *npt,
618     const void *arg, void *target)
619 {
620 	struct nl_parsed_timeouts *t = (struct nl_parsed_timeouts *)target;
621 	int ret;
622 
623 	if (t->i >= PFTM_MAX)
624 		return (E2BIG);
625 
626 	ret = nlattr_get_uint32(nla, npt, NULL, &t->timeouts[t->i]);
627 	if (ret == 0)
628 		t->i++;
629 
630 	return (ret);
631 }
632 
633 #define _OUT(_field)	offsetof(struct nl_parsed_timeout, _field)
634 static const struct nlattr_parser nla_p_timeouts[] = {
635 	{ .type = PF_TT_TIMEOUT, .off = 0, .cb = nlattr_get_pf_timeout },
636 };
637 NL_DECLARE_ATTR_PARSER(timeout_parser, nla_p_timeouts);
638 #undef _OUT
639 
640 static int
641 nlattr_get_nested_timeouts(struct nlattr *nla, struct nl_pstate *npt, const void *arg, void *target)
642 {
643 	struct nl_parsed_timeouts parsed_timeouts = { };
644 	int error;
645 
646 	/* Assumes target points to the beginning of the structure */
647 	error = nl_parse_header(NLA_DATA(nla), NLA_DATA_LEN(nla), &timeout_parser, npt, &parsed_timeouts);
648 	if (error != 0)
649 		return (error);
650 
651 	memcpy(target, parsed_timeouts.timeouts, sizeof(parsed_timeouts.timeouts));
652 
653 	return (0);
654 }
655 
656 static bool
657 nlattr_add_timeout(struct nl_writer *nw, int attrtype, uint32_t *timeout)
658 {
659 	int off = nlattr_add_nested(nw, attrtype);
660 
661 	for (int i = 0; i < PFTM_MAX; i++)
662 		nlattr_add_u32(nw, PF_RT_TIMEOUT, timeout[i]);
663 
664 	nlattr_set_len(nw, off);
665 
666 	return (true);
667 }
668 
669 #define _OUT(_field)	offsetof(struct pf_krule, _field)
670 static const struct nlattr_parser nla_p_rule[] = {
671 	{ .type = PF_RT_SRC, .off = _OUT(src), .arg = &rule_addr_parser,.cb = nlattr_get_nested },
672 	{ .type = PF_RT_DST, .off = _OUT(dst), .arg = &rule_addr_parser,.cb = nlattr_get_nested },
673 	{ .type = PF_RT_RIDENTIFIER, .off = _OUT(ridentifier), .cb = nlattr_get_uint32 },
674 	{ .type = PF_RT_LABELS, .off = _OUT(label), .arg = &rule_labels_parser,.cb = nlattr_get_nested_pf_rule_labels },
675 	{ .type = PF_RT_IFNAME, .off = _OUT(ifname), .arg = (void *)IFNAMSIZ, .cb = nlattr_get_chara },
676 	{ .type = PF_RT_QNAME, .off = _OUT(qname), .arg = (void *)PF_QNAME_SIZE, .cb = nlattr_get_chara },
677 	{ .type = PF_RT_PQNAME, .off = _OUT(pqname), .arg = (void *)PF_QNAME_SIZE, .cb = nlattr_get_chara },
678 	{ .type = PF_RT_TAGNAME, .off = _OUT(tagname), .arg = (void *)PF_TAG_NAME_SIZE, .cb = nlattr_get_chara },
679 	{ .type = PF_RT_MATCH_TAGNAME, .off = _OUT(match_tagname), .arg = (void *)PF_TAG_NAME_SIZE, .cb = nlattr_get_chara },
680 	{ .type = PF_RT_OVERLOAD_TBLNAME, .off = _OUT(overload_tblname), .arg = (void *)PF_TABLE_NAME_SIZE, .cb = nlattr_get_chara },
681 	{ .type = PF_RT_RPOOL, .off = _OUT(rpool), .arg = &pool_parser, .cb = nlattr_get_nested },
682 	{ .type = PF_RT_OS_FINGERPRINT, .off = _OUT(os_fingerprint), .cb = nlattr_get_uint32 },
683 	{ .type = PF_RT_RTABLEID, .off = _OUT(rtableid), .cb = nlattr_get_uint32 },
684 	{ .type = PF_RT_TIMEOUT, .off = _OUT(timeout), .arg = &timeout_parser, .cb = nlattr_get_nested_timeouts },
685 	{ .type = PF_RT_MAX_STATES, .off = _OUT(max_states), .cb = nlattr_get_uint32 },
686 	{ .type = PF_RT_MAX_SRC_NODES, .off = _OUT(max_src_nodes), .cb = nlattr_get_uint32 },
687 	{ .type = PF_RT_MAX_SRC_STATES, .off = _OUT(max_src_states), .cb = nlattr_get_uint32 },
688 	{ .type = PF_RT_MAX_SRC_CONN_RATE_LIMIT, .off = _OUT(max_src_conn_rate.limit), .cb = nlattr_get_uint32 },
689 	{ .type = PF_RT_MAX_SRC_CONN_RATE_SECS, .off = _OUT(max_src_conn_rate.seconds), .cb = nlattr_get_uint32 },
690 	{ .type = PF_RT_DNPIPE, .off = _OUT(dnpipe), .cb = nlattr_get_uint16 },
691 	{ .type = PF_RT_DNRPIPE, .off = _OUT(dnrpipe), .cb = nlattr_get_uint16 },
692 	{ .type = PF_RT_DNFLAGS, .off = _OUT(free_flags), .cb = nlattr_get_uint32 },
693 	{ .type = PF_RT_NR, .off = _OUT(nr), .cb = nlattr_get_uint32 },
694 	{ .type = PF_RT_PROB, .off = _OUT(prob), .cb = nlattr_get_uint32 },
695 	{ .type = PF_RT_CUID, .off = _OUT(cuid), .cb = nlattr_get_uint32 },
696 	{. type = PF_RT_CPID, .off = _OUT(cpid), .cb = nlattr_get_uint32 },
697 	{ .type = PF_RT_RETURN_ICMP, .off = _OUT(return_icmp), .cb = nlattr_get_uint16 },
698 	{ .type = PF_RT_RETURN_ICMP6, .off = _OUT(return_icmp6), .cb = nlattr_get_uint16 },
699 	{ .type = PF_RT_MAX_MSS, .off = _OUT(max_mss), .cb = nlattr_get_uint16 },
700 	{ .type = PF_RT_SCRUB_FLAGS, .off = _OUT(scrub_flags), .cb = nlattr_get_uint16 },
701 	{ .type = PF_RT_UID, .off = _OUT(uid), .arg = &rule_uid_parser, .cb = nlattr_get_nested },
702 	{ .type = PF_RT_GID, .off = _OUT(gid), .arg = &rule_uid_parser, .cb = nlattr_get_nested },
703 	{ .type = PF_RT_RULE_FLAG, .off = _OUT(rule_flag), .cb = nlattr_get_uint32 },
704 	{ .type = PF_RT_ACTION, .off = _OUT(action), .cb = nlattr_get_uint8 },
705 	{ .type = PF_RT_DIRECTION, .off = _OUT(direction), .cb = nlattr_get_uint8 },
706 	{ .type = PF_RT_LOG, .off = _OUT(log), .cb = nlattr_get_uint8 },
707 	{ .type = PF_RT_LOGIF, .off = _OUT(logif), .cb = nlattr_get_uint8 },
708 	{ .type = PF_RT_QUICK, .off = _OUT(quick), .cb = nlattr_get_uint8 },
709 	{ .type = PF_RT_IF_NOT, .off = _OUT(ifnot), .cb = nlattr_get_uint8 },
710 	{ .type = PF_RT_MATCH_TAG_NOT, .off = _OUT(match_tag_not), .cb = nlattr_get_uint8 },
711 	{ .type = PF_RT_NATPASS, .off = _OUT(natpass), .cb = nlattr_get_uint8 },
712 	{ .type = PF_RT_KEEP_STATE, .off = _OUT(keep_state), .cb = nlattr_get_uint8 },
713 	{ .type = PF_RT_AF, .off = _OUT(af), .cb = nlattr_get_uint8 },
714 	{ .type = PF_RT_PROTO, .off = _OUT(proto), .cb = nlattr_get_uint8 },
715 	{ .type = PF_RT_TYPE, .off = _OUT(type), .cb = nlattr_get_uint8 },
716 	{ .type = PF_RT_CODE, .off = _OUT(code), .cb = nlattr_get_uint8 },
717 	{ .type = PF_RT_FLAGS, .off = _OUT(flags), .cb = nlattr_get_uint8 },
718 	{ .type = PF_RT_FLAGSET, .off = _OUT(flagset), .cb = nlattr_get_uint8 },
719 	{ .type = PF_RT_MIN_TTL, .off = _OUT(min_ttl), .cb = nlattr_get_uint8 },
720 	{ .type = PF_RT_ALLOW_OPTS, .off = _OUT(allow_opts), .cb = nlattr_get_uint8 },
721 	{ .type = PF_RT_RT, .off = _OUT(rt), .cb = nlattr_get_uint8 },
722 	{ .type = PF_RT_RETURN_TTL, .off = _OUT(return_ttl), .cb = nlattr_get_uint8 },
723 	{ .type = PF_RT_TOS, .off = _OUT(tos), .cb = nlattr_get_uint8 },
724 	{ .type = PF_RT_SET_TOS, .off = _OUT(set_tos), .cb = nlattr_get_uint8 },
725 	{ .type = PF_RT_ANCHOR_RELATIVE, .off = _OUT(anchor_relative), .cb = nlattr_get_uint8 },
726 	{ .type = PF_RT_ANCHOR_WILDCARD, .off = _OUT(anchor_wildcard), .cb = nlattr_get_uint8 },
727 	{ .type = PF_RT_FLUSH, .off = _OUT(flush), .cb = nlattr_get_uint8 },
728 	{ .type = PF_RT_PRIO, .off = _OUT(prio), .cb = nlattr_get_uint8 },
729 	{ .type = PF_RT_SET_PRIO, .off = _OUT(set_prio[0]), .cb = nlattr_get_uint8 },
730 	{ .type = PF_RT_SET_PRIO_REPLY, .off = _OUT(set_prio[1]), .cb = nlattr_get_uint8 },
731 	{ .type = PF_RT_DIVERT_ADDRESS, .off = _OUT(divert.addr), .cb = nlattr_get_in6_addr },
732 	{ .type = PF_RT_DIVERT_PORT, .off = _OUT(divert.port), .cb = nlattr_get_uint16 },
733 	{ .type = PF_RT_RCV_IFNAME, .off = _OUT(rcv_ifname), .arg = (void *)IFNAMSIZ, .cb = nlattr_get_chara },
734 };
735 NL_DECLARE_ATTR_PARSER(rule_parser, nla_p_rule);
736 #undef _OUT
737 struct nl_parsed_addrule {
738 	struct pf_krule	*rule;
739 	uint32_t	 ticket;
740 	uint32_t	 pool_ticket;
741 	char		*anchor;
742 	char		*anchor_call;
743 };
744 #define	_IN(_field)	offsetof(struct genlmsghdr, _field)
745 #define	_OUT(_field)	offsetof(struct nl_parsed_addrule, _field)
746 static const struct nlattr_parser nla_p_addrule[] = {
747 	{ .type = PF_ART_TICKET, .off = _OUT(ticket), .cb = nlattr_get_uint32 },
748 	{ .type = PF_ART_POOL_TICKET, .off = _OUT(pool_ticket), .cb = nlattr_get_uint32 },
749 	{ .type = PF_ART_ANCHOR, .off = _OUT(anchor), .cb = nlattr_get_string },
750 	{ .type = PF_ART_ANCHOR_CALL, .off = _OUT(anchor_call), .cb = nlattr_get_string },
751 	{ .type = PF_ART_RULE, .off = _OUT(rule), .arg = &rule_parser, .cb = nlattr_get_nested_ptr }
752 };
753 static const struct nlfield_parser nlf_p_addrule[] = {
754 };
755 #undef _IN
756 #undef _OUT
757 NL_DECLARE_PARSER(addrule_parser, struct genlmsghdr, nlf_p_addrule, nla_p_addrule);
758 
759 static int
760 pf_handle_addrule(struct nlmsghdr *hdr, struct nl_pstate *npt)
761 {
762 	int error;
763 	struct nl_parsed_addrule attrs = {};
764 
765 	attrs.rule = pf_krule_alloc();
766 
767 	error = nl_parse_nlmsg(hdr, &addrule_parser, npt, &attrs);
768 	if (error != 0) {
769 		pf_free_rule(attrs.rule);
770 		return (error);
771 	}
772 
773 	error = pf_ioctl_addrule(attrs.rule, attrs.ticket, attrs.pool_ticket,
774 	    attrs.anchor, attrs.anchor_call, nlp_get_cred(npt->nlp)->cr_uid,
775 	    hdr->nlmsg_pid);
776 
777 	return (error);
778 }
779 
780 #define	_IN(_field)	offsetof(struct genlmsghdr, _field)
781 #define	_OUT(_field)	offsetof(struct pfioc_rule, _field)
782 static const struct nlattr_parser nla_p_getrules[] = {
783 	{ .type = PF_GR_ANCHOR, .off = _OUT(anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara },
784 	{ .type = PF_GR_ACTION, .off = _OUT(rule.action), .cb = nlattr_get_uint8 },
785 };
786 static const struct nlfield_parser nlf_p_getrules[] = {
787 };
788 #undef _IN
789 #undef _OUT
790 NL_DECLARE_PARSER(getrules_parser, struct genlmsghdr, nlf_p_getrules, nla_p_getrules);
791 
792 static int
793 pf_handle_getrules(struct nlmsghdr *hdr, struct nl_pstate *npt)
794 {
795 	struct pfioc_rule attrs = {};
796 	int error;
797 	struct nl_writer *nw = npt->nw;
798 	struct genlmsghdr *ghdr_new;
799 
800 	error = nl_parse_nlmsg(hdr, &getrules_parser, npt, &attrs);
801 	if (error != 0)
802 		return (error);
803 
804 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
805 		return (ENOMEM);
806 
807 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
808 	ghdr_new->cmd = PFNL_CMD_GETRULES;
809 	ghdr_new->version = 0;
810 	ghdr_new->reserved = 0;
811 
812 	error = pf_ioctl_getrules(&attrs);
813 	if (error != 0)
814 		goto out;
815 
816 	nlattr_add_u32(nw, PF_GR_NR, attrs.nr);
817 	nlattr_add_u32(nw, PF_GR_TICKET, attrs.ticket);
818 
819 	if (!nlmsg_end(nw)) {
820 		error = ENOMEM;
821 		goto out;
822 	}
823 
824 	return (0);
825 
826 out:
827 	nlmsg_abort(nw);
828 	return (error);
829 }
830 
831 struct nl_parsed_get_rule {
832 	char anchor[MAXPATHLEN];
833 	uint8_t action;
834 	uint32_t nr;
835 	uint32_t ticket;
836 	uint8_t clear;
837 };
838 #define	_IN(_field)	offsetof(struct genlmsghdr, _field)
839 #define	_OUT(_field)	offsetof(struct nl_parsed_get_rule, _field)
840 static const struct nlattr_parser nla_p_getrule[] = {
841 	{ .type = PF_GR_ANCHOR, .off = _OUT(anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara },
842 	{ .type = PF_GR_ACTION, .off = _OUT(action), .cb = nlattr_get_uint8 },
843 	{ .type = PF_GR_NR, .off = _OUT(nr), .cb = nlattr_get_uint32 },
844 	{ .type = PF_GR_TICKET, .off = _OUT(ticket), .cb = nlattr_get_uint32 },
845 	{ .type = PF_GR_CLEAR, .off = _OUT(clear), .cb = nlattr_get_uint8 },
846 };
847 static const struct nlfield_parser nlf_p_getrule[] = {
848 };
849 #undef _IN
850 #undef _OUT
851 NL_DECLARE_PARSER(getrule_parser, struct genlmsghdr, nlf_p_getrule, nla_p_getrule);
852 
853 static int
854 pf_handle_getrule(struct nlmsghdr *hdr, struct nl_pstate *npt)
855 {
856 	char				 anchor_call[MAXPATHLEN];
857 	struct nl_parsed_get_rule	 attrs = {};
858 	struct nl_writer		*nw = npt->nw;
859 	struct genlmsghdr		*ghdr_new;
860 	struct pf_kruleset		*ruleset;
861 	struct pf_krule			*rule;
862 	int				 rs_num;
863 	int				 error;
864 
865 	error = nl_parse_nlmsg(hdr, &getrule_parser, npt, &attrs);
866 	if (error != 0)
867 		return (error);
868 
869 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
870 		return (ENOMEM);
871 
872 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
873 	ghdr_new->cmd = PFNL_CMD_GETRULE;
874 	ghdr_new->version = 0;
875 	ghdr_new->reserved = 0;
876 
877 	PF_RULES_WLOCK();
878 	ruleset = pf_find_kruleset(attrs.anchor);
879 	if (ruleset == NULL) {
880 		PF_RULES_WUNLOCK();
881 		error = ENOENT;
882 		goto out;
883 	}
884 
885 	rs_num = pf_get_ruleset_number(attrs.action);
886 	if (rs_num >= PF_RULESET_MAX) {
887 		PF_RULES_WUNLOCK();
888 		error = EINVAL;
889 		goto out;
890 	}
891 
892 	if (attrs.ticket != ruleset->rules[rs_num].active.ticket) {
893 		PF_RULES_WUNLOCK();
894 		error = EBUSY;
895 		goto out;
896 	}
897 
898 	rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr);
899 	while ((rule != NULL) && (rule->nr != attrs.nr))
900 		rule = TAILQ_NEXT(rule, entries);
901 	if (rule == NULL) {
902 		PF_RULES_WUNLOCK();
903 		error = EBUSY;
904 		goto out;
905 	}
906 
907 	nlattr_add_rule_addr(nw, PF_RT_SRC, &rule->src);
908 	nlattr_add_rule_addr(nw, PF_RT_DST, &rule->dst);
909 	nlattr_add_u32(nw, PF_RT_RIDENTIFIER, rule->ridentifier);
910 	nlattr_add_labels(nw, PF_RT_LABELS, rule);
911 	nlattr_add_string(nw, PF_RT_IFNAME, rule->ifname);
912 	nlattr_add_string(nw, PF_RT_QNAME, rule->qname);
913 	nlattr_add_string(nw, PF_RT_PQNAME, rule->pqname);
914 	nlattr_add_string(nw, PF_RT_TAGNAME, rule->tagname);
915 	nlattr_add_string(nw, PF_RT_MATCH_TAGNAME, rule->match_tagname);
916 	nlattr_add_string(nw, PF_RT_OVERLOAD_TBLNAME, rule->overload_tblname);
917 	nlattr_add_pool(nw, PF_RT_RPOOL, &rule->rpool);
918 	nlattr_add_u32(nw, PF_RT_OS_FINGERPRINT, rule->os_fingerprint);
919 	nlattr_add_u32(nw, PF_RT_RTABLEID, rule->rtableid);
920 	nlattr_add_timeout(nw, PF_RT_TIMEOUT, rule->timeout);
921 	nlattr_add_u32(nw, PF_RT_MAX_STATES, rule->max_states);
922 	nlattr_add_u32(nw, PF_RT_MAX_SRC_NODES, rule->max_src_nodes);
923 	nlattr_add_u32(nw, PF_RT_MAX_SRC_STATES, rule->max_src_states);
924 	nlattr_add_u32(nw, PF_RT_MAX_SRC_CONN_RATE_LIMIT, rule->max_src_conn_rate.limit);
925 	nlattr_add_u32(nw, PF_RT_MAX_SRC_CONN_RATE_SECS, rule->max_src_conn_rate.seconds);
926 
927 	nlattr_add_u16(nw, PF_RT_DNPIPE, rule->dnpipe);
928 	nlattr_add_u16(nw, PF_RT_DNRPIPE, rule->dnrpipe);
929 	nlattr_add_u32(nw, PF_RT_DNFLAGS, rule->free_flags);
930 
931 	nlattr_add_u32(nw, PF_RT_NR, rule->nr);
932 	nlattr_add_u32(nw, PF_RT_PROB, rule->prob);
933 	nlattr_add_u32(nw, PF_RT_CUID, rule->cuid);
934 	nlattr_add_u32(nw, PF_RT_CPID, rule->cpid);
935 
936 	nlattr_add_u16(nw, PF_RT_RETURN_ICMP, rule->return_icmp);
937 	nlattr_add_u16(nw, PF_RT_RETURN_ICMP6, rule->return_icmp6);
938 	nlattr_add_u16(nw, PF_RT_RETURN_ICMP6, rule->return_icmp6);
939 	nlattr_add_u16(nw, PF_RT_MAX_MSS, rule->max_mss);
940 	nlattr_add_u16(nw, PF_RT_SCRUB_FLAGS, rule->scrub_flags);
941 
942 	nlattr_add_rule_uid(nw, PF_RT_UID, &rule->uid);
943 	nlattr_add_rule_uid(nw, PF_RT_GID, (const struct pf_rule_uid *)&rule->gid);
944 
945 	nlattr_add_string(nw, PF_RT_RCV_IFNAME, rule->rcv_ifname);
946 
947 	nlattr_add_u32(nw, PF_RT_RULE_FLAG, rule->rule_flag);
948 	nlattr_add_u8(nw, PF_RT_ACTION, rule->action);
949 	nlattr_add_u8(nw, PF_RT_DIRECTION, rule->direction);
950 	nlattr_add_u8(nw, PF_RT_LOG, rule->log);
951 	nlattr_add_u8(nw, PF_RT_LOGIF, rule->logif);
952 	nlattr_add_u8(nw, PF_RT_QUICK, rule->quick);
953 	nlattr_add_u8(nw, PF_RT_IF_NOT, rule->ifnot);
954 	nlattr_add_u8(nw, PF_RT_MATCH_TAG_NOT, rule->match_tag_not);
955 	nlattr_add_u8(nw, PF_RT_NATPASS, rule->natpass);
956 	nlattr_add_u8(nw, PF_RT_KEEP_STATE, rule->keep_state);
957 
958 	nlattr_add_u8(nw, PF_RT_AF, rule->af);
959 	nlattr_add_u8(nw, PF_RT_PROTO, rule->proto);
960 	nlattr_add_u8(nw, PF_RT_TYPE, rule->type);
961 	nlattr_add_u8(nw, PF_RT_CODE, rule->code);
962 	nlattr_add_u8(nw, PF_RT_FLAGS, rule->flags);
963 	nlattr_add_u8(nw, PF_RT_FLAGSET, rule->flagset);
964 	nlattr_add_u8(nw, PF_RT_MIN_TTL, rule->min_ttl);
965 	nlattr_add_u8(nw, PF_RT_ALLOW_OPTS, rule->allow_opts);
966 	nlattr_add_u8(nw, PF_RT_RT, rule->rt);
967 	nlattr_add_u8(nw, PF_RT_RETURN_TTL, rule->return_ttl);
968 	nlattr_add_u8(nw, PF_RT_TOS, rule->tos);
969 	nlattr_add_u8(nw, PF_RT_SET_TOS, rule->set_tos);
970 	nlattr_add_u8(nw, PF_RT_ANCHOR_RELATIVE, rule->anchor_relative);
971 	nlattr_add_u8(nw, PF_RT_ANCHOR_WILDCARD, rule->anchor_wildcard);
972 	nlattr_add_u8(nw, PF_RT_FLUSH, rule->flush);
973 	nlattr_add_u8(nw, PF_RT_PRIO, rule->prio);
974 	nlattr_add_u8(nw, PF_RT_SET_PRIO, rule->set_prio[0]);
975 	nlattr_add_u8(nw, PF_RT_SET_PRIO_REPLY, rule->set_prio[1]);
976 
977 	nlattr_add_in6_addr(nw, PF_RT_DIVERT_ADDRESS, &rule->divert.addr.v6);
978 	nlattr_add_u16(nw, PF_RT_DIVERT_PORT, rule->divert.port);
979 
980 	nlattr_add_u64(nw, PF_RT_PACKETS_IN, pf_counter_u64_fetch(&rule->packets[0]));
981 	nlattr_add_u64(nw, PF_RT_PACKETS_OUT, pf_counter_u64_fetch(&rule->packets[1]));
982 	nlattr_add_u64(nw, PF_RT_BYTES_IN, pf_counter_u64_fetch(&rule->bytes[0]));
983 	nlattr_add_u64(nw, PF_RT_BYTES_OUT, pf_counter_u64_fetch(&rule->bytes[1]));
984 	nlattr_add_u64(nw, PF_RT_EVALUATIONS, pf_counter_u64_fetch(&rule->evaluations));
985 	nlattr_add_u64(nw, PF_RT_TIMESTAMP, pf_get_timestamp(rule));
986 	nlattr_add_u64(nw, PF_RT_STATES_CUR, counter_u64_fetch(rule->states_cur));
987 	nlattr_add_u64(nw, PF_RT_STATES_TOTAL, counter_u64_fetch(rule->states_tot));
988 	nlattr_add_u64(nw, PF_RT_SRC_NODES, counter_u64_fetch(rule->src_nodes));
989 
990 	error = pf_kanchor_copyout(ruleset, rule, anchor_call, sizeof(anchor_call));
991 	MPASS(error == 0);
992 
993 	nlattr_add_string(nw, PF_RT_ANCHOR_CALL, anchor_call);
994 
995 	if (attrs.clear)
996 		pf_krule_clear_counters(rule);
997 
998 	PF_RULES_WUNLOCK();
999 
1000 	if (!nlmsg_end(nw)) {
1001 		error = ENOMEM;
1002 		goto out;
1003 	}
1004 
1005 	return (0);
1006 out:
1007 	nlmsg_abort(nw);
1008 	return (error);
1009 }
1010 
1011 #define	_IN(_field)	offsetof(struct genlmsghdr, _field)
1012 #define	_OUT(_field)	offsetof(struct pf_kstate_kill, _field)
1013 static const struct nlattr_parser nla_p_clear_states[] = {
1014 	{ .type = PF_CS_CMP_ID, .off = _OUT(psk_pfcmp.id), .cb = nlattr_get_uint64 },
1015 	{ .type = PF_CS_CMP_CREATORID, .off = _OUT(psk_pfcmp.creatorid), .cb = nlattr_get_uint32 },
1016 	{ .type = PF_CS_CMP_DIR, .off = _OUT(psk_pfcmp.direction), .cb = nlattr_get_uint8 },
1017 	{ .type = PF_CS_AF, .off = _OUT(psk_af), .cb = nlattr_get_uint8 },
1018 	{ .type = PF_CS_PROTO, .off = _OUT(psk_proto), .cb = nlattr_get_uint8 },
1019 	{ .type = PF_CS_SRC, .off = _OUT(psk_src), .arg = &rule_addr_parser, .cb = nlattr_get_nested },
1020 	{ .type = PF_CS_DST, .off = _OUT(psk_dst), .arg = &rule_addr_parser, .cb = nlattr_get_nested },
1021 	{ .type = PF_CS_RT_ADDR, .off = _OUT(psk_rt_addr), .arg = &rule_addr_parser, .cb = nlattr_get_nested },
1022 	{ .type = PF_CS_IFNAME, .off = _OUT(psk_ifname), .arg = (void *)IFNAMSIZ, .cb = nlattr_get_chara },
1023 	{ .type = PF_CS_LABEL, .off = _OUT(psk_label), .arg = (void *)PF_RULE_LABEL_SIZE, .cb = nlattr_get_chara },
1024 	{ .type = PF_CS_KILL_MATCH, .off = _OUT(psk_kill_match), .cb = nlattr_get_bool },
1025 	{ .type = PF_CS_NAT, .off = _OUT(psk_nat), .cb = nlattr_get_bool },
1026 };
1027 static const struct nlfield_parser nlf_p_clear_states[] = {};
1028 #undef _IN
1029 #undef _OUT
1030 NL_DECLARE_PARSER(clear_states_parser, struct genlmsghdr, nlf_p_clear_states, nla_p_clear_states);
1031 
1032 static int
1033 pf_handle_killclear_states(struct nlmsghdr *hdr, struct nl_pstate *npt, int cmd)
1034 {
1035 	struct pf_kstate_kill		 kill = {};
1036 	struct epoch_tracker		 et;
1037 	struct nl_writer		*nw = npt->nw;
1038 	struct genlmsghdr		*ghdr_new;
1039 	int				 error;
1040 	unsigned int			 killed = 0;
1041 
1042 	error = nl_parse_nlmsg(hdr, &clear_states_parser, npt, &kill);
1043 	if (error != 0)
1044 		return (error);
1045 
1046 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1047 		return (ENOMEM);
1048 
1049 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1050 	ghdr_new->cmd = cmd;
1051 	ghdr_new->version = 0;
1052 	ghdr_new->reserved = 0;
1053 
1054 	NET_EPOCH_ENTER(et);
1055 	if (cmd == PFNL_CMD_KILLSTATES)
1056 		pf_killstates(&kill, &killed);
1057 	else
1058 		killed = pf_clear_states(&kill);
1059 	NET_EPOCH_EXIT(et);
1060 
1061 	nlattr_add_u32(nw, PF_CS_KILLED, killed);
1062 
1063 	if (! nlmsg_end(nw)) {
1064 		error = ENOMEM;
1065 		goto out;
1066 	}
1067 
1068 	return (0);
1069 
1070 out:
1071 	nlmsg_abort(nw);
1072 	return (error);
1073 }
1074 
1075 static int
1076 pf_handle_clear_states(struct nlmsghdr *hdr, struct nl_pstate *npt)
1077 {
1078 	return (pf_handle_killclear_states(hdr, npt, PFNL_CMD_CLRSTATES));
1079 }
1080 
1081 static int
1082 pf_handle_kill_states(struct nlmsghdr *hdr, struct nl_pstate *npt)
1083 {
1084 	return (pf_handle_killclear_states(hdr, npt, PFNL_CMD_KILLSTATES));
1085 }
1086 
1087 struct nl_parsed_set_statusif {
1088 	char ifname[IFNAMSIZ];
1089 };
1090 #define	_IN(_field)	offsetof(struct genlmsghdr, _field)
1091 #define	_OUT(_field)	offsetof(struct nl_parsed_set_statusif, _field)
1092 static const struct nlattr_parser nla_p_set_statusif[] = {
1093 	{ .type = PF_SS_IFNAME, .off = _OUT(ifname), .arg = (const void *)IFNAMSIZ, .cb = nlattr_get_chara },
1094 };
1095 static const struct nlfield_parser nlf_p_set_statusif[] = {};
1096 #undef _IN
1097 #undef _OUT
1098 NL_DECLARE_PARSER(set_statusif_parser, struct genlmsghdr, nlf_p_set_statusif, nla_p_set_statusif);
1099 
1100 static int
1101 pf_handle_set_statusif(struct nlmsghdr *hdr, struct nl_pstate *npt)
1102 {
1103 	int error;
1104 	struct nl_parsed_set_statusif attrs = {};
1105 
1106 	error = nl_parse_nlmsg(hdr, &set_statusif_parser, npt, &attrs);
1107 	if (error != 0)
1108 		return (error);
1109 
1110 	PF_RULES_WLOCK();
1111 	strlcpy(V_pf_status.ifname, attrs.ifname, IFNAMSIZ);
1112 	PF_RULES_WUNLOCK();
1113 
1114 	return (0);
1115 }
1116 
1117 static bool
1118 nlattr_add_counters(struct nl_writer *nw, int attr, size_t number, char **names,
1119     counter_u64_t *counters)
1120 {
1121 	for (int i = 0; i < number; i++) {
1122 		int off = nlattr_add_nested(nw, attr);
1123 		nlattr_add_u32(nw, PF_C_ID, i);
1124 		nlattr_add_string(nw, PF_C_NAME, names[i]);
1125 		nlattr_add_u64(nw, PF_C_COUNTER, counter_u64_fetch(counters[i]));
1126 		nlattr_set_len(nw, off);
1127 	}
1128 
1129 	return (true);
1130 }
1131 
1132 static bool
1133 nlattr_add_fcounters(struct nl_writer *nw, int attr, size_t number, char **names,
1134     struct pf_counter_u64 *counters)
1135 {
1136 	for (int i = 0; i < number; i++) {
1137 		int off = nlattr_add_nested(nw, attr);
1138 		nlattr_add_u32(nw, PF_C_ID, i);
1139 		nlattr_add_string(nw, PF_C_NAME, names[i]);
1140 		nlattr_add_u64(nw, PF_C_COUNTER, pf_counter_u64_fetch(&counters[i]));
1141 		nlattr_set_len(nw, off);
1142 	}
1143 
1144 	return (true);
1145 }
1146 
1147 static bool
1148 nlattr_add_u64_array(struct nl_writer *nw, int attr, size_t number, uint64_t *array)
1149 {
1150 	int off = nlattr_add_nested(nw, attr);
1151 
1152 	for (size_t i = 0; i < number; i++)
1153 		nlattr_add_u64(nw, 0, array[i]);
1154 
1155 	nlattr_set_len(nw, off);
1156 
1157 	return (true);
1158 }
1159 
1160 static int
1161 pf_handle_get_status(struct nlmsghdr *hdr, struct nl_pstate *npt)
1162 {
1163 	struct pf_status s;
1164 	struct nl_writer *nw = npt->nw;
1165 	struct genlmsghdr *ghdr_new;
1166 	char *pf_reasons[PFRES_MAX+1] = PFRES_NAMES;
1167 	char *pf_lcounter[KLCNT_MAX+1] = KLCNT_NAMES;
1168 	char *pf_fcounter[FCNT_MAX+1] = FCNT_NAMES;
1169 	int error;
1170 
1171 	PF_RULES_RLOCK_TRACKER;
1172 
1173 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1174 		return (ENOMEM);
1175 
1176 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1177 	ghdr_new->cmd = PFNL_CMD_GET_STATUS;
1178 	ghdr_new->version = 0;
1179 	ghdr_new->reserved = 0;
1180 
1181 	PF_RULES_RLOCK();
1182 
1183 	nlattr_add_string(nw, PF_GS_IFNAME, V_pf_status.ifname);
1184 	nlattr_add_bool(nw, PF_GS_RUNNING, V_pf_status.running);
1185 	nlattr_add_u32(nw, PF_GS_SINCE, V_pf_status.since);
1186 	nlattr_add_u32(nw, PF_GS_DEBUG, V_pf_status.debug);
1187 	nlattr_add_u32(nw, PF_GS_HOSTID, ntohl(V_pf_status.hostid));
1188 	nlattr_add_u32(nw, PF_GS_STATES, V_pf_status.states);
1189 	nlattr_add_u32(nw, PF_GS_SRC_NODES, V_pf_status.src_nodes);
1190 	nlattr_add_u32(nw, PF_GS_REASSEMBLE, V_pf_status.reass);
1191 	nlattr_add_u32(nw, PF_GS_SYNCOOKIES_ACTIVE, V_pf_status.syncookies_active);
1192 
1193 	nlattr_add_counters(nw, PF_GS_COUNTERS, PFRES_MAX, pf_reasons,
1194 	    V_pf_status.counters);
1195 	nlattr_add_counters(nw, PF_GS_LCOUNTERS, KLCNT_MAX, pf_lcounter,
1196 	    V_pf_status.lcounters);
1197 	nlattr_add_fcounters(nw, PF_GS_FCOUNTERS, FCNT_MAX, pf_fcounter,
1198 	    V_pf_status.fcounters);
1199 	nlattr_add_counters(nw, PF_GS_SCOUNTERS, SCNT_MAX, pf_fcounter,
1200 	    V_pf_status.scounters);
1201 
1202 	pfi_update_status(V_pf_status.ifname, &s);
1203 	nlattr_add_u64_array(nw, PF_GS_BCOUNTERS, 2 * 2, (uint64_t *)s.bcounters);
1204 	nlattr_add_u64_array(nw, PF_GS_PCOUNTERS, 2 * 2 * 2, (uint64_t *)s.pcounters);
1205 
1206 	nlattr_add(nw, PF_GS_CHKSUM, PF_MD5_DIGEST_LENGTH, V_pf_status.pf_chksum);
1207 
1208 	PF_RULES_RUNLOCK();
1209 
1210 	if (!nlmsg_end(nw)) {
1211 		error = ENOMEM;
1212 		goto out;
1213 	}
1214 
1215 	return (0);
1216 
1217 out:
1218 	nlmsg_abort(nw);
1219 	return (error);
1220 }
1221 
1222 static int
1223 pf_handle_clear_status(struct nlmsghdr *hdr, struct nl_pstate *npt)
1224 {
1225 	pf_ioctl_clear_status();
1226 
1227 	return (0);
1228 }
1229 
1230 struct pf_nl_natlook {
1231 	sa_family_t af;
1232 	uint8_t direction;
1233 	uint8_t proto;
1234 	struct pf_addr src;
1235 	struct pf_addr dst;
1236 	uint16_t sport;
1237 	uint16_t dport;
1238 };
1239 
1240 #define	_IN(_field)	offsetof(struct genlmsghdr, _field)
1241 #define	_OUT(_field)	offsetof(struct pf_nl_natlook, _field)
1242 static const struct nlattr_parser nla_p_natlook[] = {
1243 	{ .type = PF_NL_AF, .off = _OUT(af), .cb = nlattr_get_uint8 },
1244 	{ .type = PF_NL_DIRECTION, .off = _OUT(direction), .cb = nlattr_get_uint8 },
1245 	{ .type = PF_NL_PROTO, .off = _OUT(proto), .cb = nlattr_get_uint8 },
1246 	{ .type = PF_NL_SRC_ADDR, .off = _OUT(src), .cb = nlattr_get_in6_addr },
1247 	{ .type = PF_NL_DST_ADDR, .off = _OUT(dst), .cb = nlattr_get_in6_addr },
1248 	{ .type = PF_NL_SRC_PORT, .off = _OUT(sport), .cb = nlattr_get_uint16 },
1249 	{ .type = PF_NL_DST_PORT, .off = _OUT(dport), .cb = nlattr_get_uint16 },
1250 };
1251 static const struct nlfield_parser nlf_p_natlook[] = {};
1252 #undef _IN
1253 #undef _OUT
1254 NL_DECLARE_PARSER(natlook_parser, struct genlmsghdr, nlf_p_natlook, nla_p_natlook);
1255 
1256 static int
1257 pf_handle_natlook(struct nlmsghdr *hdr, struct nl_pstate *npt)
1258 {
1259 	struct pf_nl_natlook	 attrs = {};
1260 	struct pf_state_key_cmp	 key = {};
1261 	struct nl_writer	*nw = npt->nw;
1262 	struct pf_state_key	*sk;
1263 	struct pf_kstate	*state;
1264 	struct genlmsghdr	*ghdr_new;
1265 	int			 error, m;
1266 	int			 sidx, didx;
1267 
1268 	error = nl_parse_nlmsg(hdr, &natlook_parser, npt, &attrs);
1269 	if (error != 0)
1270 		return (error);
1271 
1272 	if (attrs.proto == 0 ||
1273 	    PF_AZERO(&attrs.src, attrs.af) ||
1274 	    PF_AZERO(&attrs.dst, attrs.af) ||
1275 	    ((attrs.proto == IPPROTO_TCP || attrs.proto == IPPROTO_UDP) &&
1276 	     (attrs.sport == 0 || attrs.dport == 0)))
1277 		return (EINVAL);
1278 
1279 	/* NATLOOK src and dst are reversed, so reverse sidx/didx */
1280 	sidx = (attrs.direction == PF_IN) ? 1 : 0;
1281 	didx = (attrs.direction == PF_IN) ? 0 : 1;
1282 
1283 	key.af = attrs.af;
1284 	key.proto = attrs.proto;
1285 	PF_ACPY(&key.addr[sidx], &attrs.src, attrs.af);
1286 	key.port[sidx] = attrs.sport;
1287 	PF_ACPY(&key.addr[didx], &attrs.dst, attrs.af);
1288 	key.port[didx] = attrs.dport;
1289 
1290 	state = pf_find_state_all(&key, attrs.direction, &m);
1291 	if (state == NULL)
1292 		return (ENOENT);
1293 	if (m > 1) {
1294 		PF_STATE_UNLOCK(state);
1295 		return (E2BIG);
1296 	}
1297 
1298 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) {
1299 		PF_STATE_UNLOCK(state);
1300 		return (ENOMEM);
1301 	}
1302 
1303 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1304 	ghdr_new->cmd = PFNL_CMD_NATLOOK;
1305 	ghdr_new->version = 0;
1306 	ghdr_new->reserved = 0;
1307 
1308 	sk = state->key[sidx];
1309 
1310 	nlattr_add_in6_addr(nw, PF_NL_SRC_ADDR, &sk->addr[sidx].v6);
1311 	nlattr_add_in6_addr(nw, PF_NL_DST_ADDR, &sk->addr[didx].v6);
1312 	nlattr_add_u16(nw, PF_NL_SRC_PORT, sk->port[sidx]);
1313 	nlattr_add_u16(nw, PF_NL_DST_PORT, sk->port[didx]);
1314 
1315 	PF_STATE_UNLOCK(state);
1316 
1317 	if (!nlmsg_end(nw)) {
1318 		nlmsg_abort(nw);
1319 		return (ENOMEM);
1320 	}
1321 
1322 	return (0);
1323 }
1324 
1325 struct pf_nl_set_debug
1326 {
1327 	uint32_t level;
1328 };
1329 #define	_OUT(_field)	offsetof(struct pf_nl_set_debug, _field)
1330 static const struct nlattr_parser nla_p_set_debug[] = {
1331 	{ .type = PF_SD_LEVEL, .off = _OUT(level), .cb = nlattr_get_uint32 },
1332 };
1333 static const struct nlfield_parser nlf_p_set_debug[] = {};
1334 #undef _OUT
1335 NL_DECLARE_PARSER(set_debug_parser, struct genlmsghdr, nlf_p_set_debug, nla_p_set_debug);
1336 
1337 static int
1338 pf_handle_set_debug(struct nlmsghdr *hdr, struct nl_pstate *npt)
1339 {
1340 	struct pf_nl_set_debug attrs = {};
1341 	int error;
1342 
1343 	error = nl_parse_nlmsg(hdr, &set_debug_parser, npt, &attrs);
1344 	if (error != 0)
1345 		return (error);
1346 
1347 	PF_RULES_WLOCK();
1348 	V_pf_status.debug = attrs.level;
1349 	PF_RULES_WUNLOCK();
1350 
1351 	return (0);
1352 }
1353 
1354 struct pf_nl_set_timeout
1355 {
1356 	uint32_t timeout;
1357 	uint32_t seconds;
1358 };
1359 #define	_OUT(_field)	offsetof(struct pf_nl_set_timeout, _field)
1360 static const struct nlattr_parser nla_p_set_timeout[] = {
1361 	{ .type = PF_TO_TIMEOUT, .off = _OUT(timeout), .cb = nlattr_get_uint32 },
1362 	{ .type = PF_TO_SECONDS, .off = _OUT(seconds), .cb = nlattr_get_uint32 },
1363 };
1364 static const struct nlfield_parser nlf_p_set_timeout[] = {};
1365 #undef _OUT
1366 NL_DECLARE_PARSER(set_timeout_parser, struct genlmsghdr, nlf_p_set_timeout, nla_p_set_timeout);
1367 
1368 static int
1369 pf_handle_set_timeout(struct nlmsghdr *hdr, struct nl_pstate *npt)
1370 {
1371 	struct pf_nl_set_timeout attrs = {};
1372 	int error;
1373 
1374 	error = nl_parse_nlmsg(hdr, &set_timeout_parser, npt, &attrs);
1375 	if (error != 0)
1376 		return (error);
1377 
1378 	return (pf_ioctl_set_timeout(attrs.timeout, attrs.seconds, NULL));
1379 }
1380 
1381 static int
1382 pf_handle_get_timeout(struct nlmsghdr *hdr, struct nl_pstate *npt)
1383 {
1384 	struct pf_nl_set_timeout attrs = {};
1385 	struct nl_writer *nw = npt->nw;
1386 	struct genlmsghdr *ghdr_new;
1387 	int error;
1388 
1389 	error = nl_parse_nlmsg(hdr, &set_timeout_parser, npt, &attrs);
1390 	if (error != 0)
1391 		return (error);
1392 
1393 	error = pf_ioctl_get_timeout(attrs.timeout, &attrs.seconds);
1394 	if (error != 0)
1395 		return (error);
1396 
1397 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1398 		return (ENOMEM);
1399 
1400 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1401 	ghdr_new->cmd = PFNL_CMD_GET_TIMEOUT;
1402 	ghdr_new->version = 0;
1403 	ghdr_new->reserved = 0;
1404 
1405 	nlattr_add_u32(nw, PF_TO_SECONDS, attrs.seconds);
1406 
1407 	if (!nlmsg_end(nw)) {
1408 		nlmsg_abort(nw);
1409 		return (ENOMEM);
1410 	}
1411 
1412 	return (0);
1413 }
1414 
1415 struct pf_nl_set_limit
1416 {
1417 	uint32_t index;
1418 	uint32_t limit;
1419 };
1420 #define	_OUT(_field)	offsetof(struct pf_nl_set_limit, _field)
1421 static const struct nlattr_parser nla_p_set_limit[] = {
1422 	{ .type = PF_LI_INDEX, .off = _OUT(index), .cb = nlattr_get_uint32 },
1423 	{ .type = PF_LI_LIMIT, .off = _OUT(limit), .cb = nlattr_get_uint32 },
1424 };
1425 static const struct nlfield_parser nlf_p_set_limit[] = {};
1426 #undef _OUT
1427 NL_DECLARE_PARSER(set_limit_parser, struct genlmsghdr, nlf_p_set_limit, nla_p_set_limit);
1428 
1429 static int
1430 pf_handle_set_limit(struct nlmsghdr *hdr, struct nl_pstate *npt)
1431 {
1432 	struct pf_nl_set_limit attrs = {};
1433 	int error;
1434 
1435 	error = nl_parse_nlmsg(hdr, &set_limit_parser, npt, &attrs);
1436 	if (error != 0)
1437 		return (error);
1438 
1439 	return (pf_ioctl_set_limit(attrs.index, attrs.limit, NULL));
1440 }
1441 
1442 static int
1443 pf_handle_get_limit(struct nlmsghdr *hdr, struct nl_pstate *npt)
1444 {
1445 	struct pf_nl_set_limit attrs = {};
1446 	struct nl_writer *nw = npt->nw;
1447 	struct genlmsghdr *ghdr_new;
1448 	int error;
1449 
1450 	error = nl_parse_nlmsg(hdr, &set_limit_parser, npt, &attrs);
1451 	if (error != 0)
1452 		return (error);
1453 
1454 	error = pf_ioctl_get_limit(attrs.index, &attrs.limit);
1455 	if (error != 0)
1456 		return (error);
1457 
1458 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1459 		return (ENOMEM);
1460 
1461 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1462 	ghdr_new->cmd = PFNL_CMD_GET_LIMIT;
1463 	ghdr_new->version = 0;
1464 	ghdr_new->reserved = 0;
1465 
1466 	nlattr_add_u32(nw, PF_LI_LIMIT, attrs.limit);
1467 
1468 	if (!nlmsg_end(nw)) {
1469 		nlmsg_abort(nw);
1470 		return (ENOMEM);
1471 	}
1472 
1473 	return (0);
1474 }
1475 
1476 static int
1477 pf_handle_begin_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt)
1478 {
1479 	struct nl_writer *nw = npt->nw;
1480 	struct genlmsghdr *ghdr_new;
1481 	uint32_t ticket;
1482 	int error;
1483 
1484 	error = pf_ioctl_begin_addrs(&ticket);
1485 	if (error != 0)
1486 		return (error);
1487 
1488 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1489 		return (ENOMEM);
1490 
1491 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1492 	ghdr_new->cmd = PFNL_CMD_BEGIN_ADDRS;
1493 	ghdr_new->version = 0;
1494 	ghdr_new->reserved = 0;
1495 
1496 	nlattr_add_u32(nw, PF_BA_TICKET, ticket);
1497 
1498 	if (!nlmsg_end(nw)) {
1499 		nlmsg_abort(nw);
1500 		return (ENOMEM);
1501 	}
1502 
1503 	return (0);
1504 }
1505 
1506 static bool
1507 nlattr_add_pool_addr(struct nl_writer *nw, int attrtype, struct pf_pooladdr *a)
1508 {
1509 	int off;
1510 
1511 	off = nlattr_add_nested(nw, attrtype);
1512 
1513 	nlattr_add_addr_wrap(nw, PF_PA_ADDR, &a->addr);
1514 	nlattr_add_string(nw, PF_PA_IFNAME, a->ifname);
1515 
1516 	nlattr_set_len(nw, off);
1517 
1518 	return (true);
1519 }
1520 
1521 #define _OUT(_field)	offsetof(struct pf_pooladdr, _field)
1522 static const struct nlattr_parser nla_p_pool_addr[] = {
1523 	{ .type = PF_PA_ADDR, .off = _OUT(addr), .arg = &addr_wrap_parser, .cb = nlattr_get_nested },
1524 	{ .type = PF_PA_IFNAME, .off = _OUT(ifname), .arg = (void *)IFNAMSIZ, .cb = nlattr_get_chara },
1525 };
1526 NL_DECLARE_ATTR_PARSER(pool_addr_parser, nla_p_pool_addr);
1527 #undef _OUT
1528 
1529 #define	_OUT(_field)	offsetof(struct pfioc_pooladdr, _field)
1530 static const struct nlattr_parser nla_p_add_addr[] = {
1531 	{ .type = PF_AA_ACTION, .off = _OUT(action), .cb = nlattr_get_uint32 },
1532 	{ .type = PF_AA_TICKET, .off = _OUT(ticket), .cb = nlattr_get_uint32 },
1533 	{ .type = PF_AA_NR, .off = _OUT(nr), .cb = nlattr_get_uint32 },
1534 	{ .type = PF_AA_R_NUM, .off = _OUT(r_num), .cb = nlattr_get_uint32 },
1535 	{ .type = PF_AA_R_ACTION, .off = _OUT(r_action), .cb = nlattr_get_uint8 },
1536 	{ .type = PF_AA_R_LAST, .off = _OUT(r_last), .cb = nlattr_get_uint8 },
1537 	{ .type = PF_AA_AF, .off = _OUT(af), .cb = nlattr_get_uint8 },
1538 	{ .type = PF_AA_ANCHOR, .off = _OUT(anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara },
1539 	{ .type = PF_AA_ADDR, .off = _OUT(addr), .arg = &pool_addr_parser, .cb = nlattr_get_nested },
1540 };
1541 static const struct nlfield_parser nlf_p_add_addr[] = {};
1542 #undef _OUT
1543 NL_DECLARE_PARSER(add_addr_parser, struct genlmsghdr, nlf_p_add_addr, nla_p_add_addr);
1544 
1545 static int
1546 pf_handle_add_addr(struct nlmsghdr *hdr, struct nl_pstate *npt)
1547 {
1548 	struct pfioc_pooladdr attrs = { 0 };
1549 	int error;
1550 
1551 	error = nl_parse_nlmsg(hdr, &add_addr_parser, npt, &attrs);
1552 	if (error != 0)
1553 		return (error);
1554 
1555 	error = pf_ioctl_add_addr(&attrs);
1556 
1557 	return (error);
1558 }
1559 
1560 static int
1561 pf_handle_get_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt)
1562 {
1563 	struct pfioc_pooladdr attrs = { 0 };
1564 	struct nl_writer *nw = npt->nw;
1565 	struct genlmsghdr *ghdr_new;
1566 	int error;
1567 
1568 	error = nl_parse_nlmsg(hdr, &add_addr_parser, npt, &attrs);
1569 	if (error != 0)
1570 		return (error);
1571 
1572 	error = pf_ioctl_get_addrs(&attrs);
1573 	if (error != 0)
1574 		return (error);
1575 
1576 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1577 		return (ENOMEM);
1578 
1579 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1580 	ghdr_new->cmd = PFNL_CMD_GET_ADDRS;
1581 	ghdr_new->version = 0;
1582 	ghdr_new->reserved = 0;
1583 
1584 	nlattr_add_u32(nw, PF_AA_NR, attrs.nr);
1585 
1586 	if (!nlmsg_end(nw)) {
1587 		nlmsg_abort(nw);
1588 		return (ENOMEM);
1589 	}
1590 
1591 	return (error);
1592 }
1593 
1594 static int
1595 pf_handle_get_addr(struct nlmsghdr *hdr, struct nl_pstate *npt)
1596 {
1597 	struct pfioc_pooladdr attrs = { 0 };
1598 	struct nl_writer *nw = npt->nw;
1599 	struct genlmsghdr *ghdr_new;
1600 	int error;
1601 
1602 	error = nl_parse_nlmsg(hdr, &add_addr_parser, npt, &attrs);
1603 	if (error != 0)
1604 		return (error);
1605 
1606 	error = pf_ioctl_get_addr(&attrs);
1607 	if (error != 0)
1608 		return (error);
1609 
1610 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1611 		return (ENOMEM);
1612 
1613 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1614 	ghdr_new->cmd = PFNL_CMD_GET_ADDRS;
1615 	ghdr_new->version = 0;
1616 	ghdr_new->reserved = 0;
1617 
1618 	nlattr_add_u32(nw, PF_AA_ACTION, attrs.action);
1619 	nlattr_add_u32(nw, PF_AA_TICKET, attrs.ticket);
1620 	nlattr_add_u32(nw, PF_AA_NR, attrs.nr);
1621 	nlattr_add_u32(nw, PF_AA_R_NUM, attrs.r_num);
1622 	nlattr_add_u8(nw, PF_AA_R_ACTION, attrs.r_action);
1623 	nlattr_add_u8(nw, PF_AA_R_LAST, attrs.r_last);
1624 	nlattr_add_u8(nw, PF_AA_AF, attrs.af);
1625 	nlattr_add_string(nw, PF_AA_ANCHOR, attrs.anchor);
1626 	nlattr_add_pool_addr(nw, PF_AA_ADDR, &attrs.addr);
1627 
1628 	if (!nlmsg_end(nw)) {
1629 		nlmsg_abort(nw);
1630 		return (ENOMEM);
1631 	}
1632 
1633 	return (0);
1634 }
1635 
1636 static const struct nlhdr_parser *all_parsers[] = {
1637 	&state_parser,
1638 	&addrule_parser,
1639 	&getrules_parser,
1640 	&clear_states_parser,
1641 	&set_statusif_parser,
1642 	&natlook_parser,
1643 	&set_debug_parser,
1644 	&set_timeout_parser,
1645 	&set_limit_parser,
1646 	&pool_addr_parser,
1647 	&add_addr_parser,
1648 };
1649 
1650 static int family_id;
1651 
1652 static const struct genl_cmd pf_cmds[] = {
1653 	{
1654 		.cmd_num = PFNL_CMD_GETSTATES,
1655 		.cmd_name = "GETSTATES",
1656 		.cmd_cb = pf_handle_getstates,
1657 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1658 		.cmd_priv = PRIV_NETINET_PF,
1659 	},
1660 	{
1661 		.cmd_num = PFNL_CMD_GETCREATORS,
1662 		.cmd_name = "GETCREATORS",
1663 		.cmd_cb = pf_handle_getcreators,
1664 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1665 		.cmd_priv = PRIV_NETINET_PF,
1666 	},
1667 	{
1668 		.cmd_num = PFNL_CMD_START,
1669 		.cmd_name = "START",
1670 		.cmd_cb = pf_handle_start,
1671 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
1672 		.cmd_priv = PRIV_NETINET_PF,
1673 	},
1674 	{
1675 		.cmd_num = PFNL_CMD_STOP,
1676 		.cmd_name = "STOP",
1677 		.cmd_cb = pf_handle_stop,
1678 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
1679 		.cmd_priv = PRIV_NETINET_PF,
1680 	},
1681 	{
1682 		.cmd_num = PFNL_CMD_ADDRULE,
1683 		.cmd_name = "ADDRULE",
1684 		.cmd_cb = pf_handle_addrule,
1685 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1686 		.cmd_priv = PRIV_NETINET_PF,
1687 	},
1688 	{
1689 		.cmd_num = PFNL_CMD_GETRULES,
1690 		.cmd_name = "GETRULES",
1691 		.cmd_cb = pf_handle_getrules,
1692 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1693 		.cmd_priv = PRIV_NETINET_PF,
1694 	},
1695 	{
1696 		.cmd_num = PFNL_CMD_GETRULE,
1697 		.cmd_name = "GETRULE",
1698 		.cmd_cb = pf_handle_getrule,
1699 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1700 		.cmd_priv = PRIV_NETINET_PF,
1701 	},
1702 	{
1703 		.cmd_num = PFNL_CMD_CLRSTATES,
1704 		.cmd_name = "CLRSTATES",
1705 		.cmd_cb = pf_handle_clear_states,
1706 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1707 		.cmd_priv = PRIV_NETINET_PF,
1708 	},
1709 	{
1710 		.cmd_num = PFNL_CMD_KILLSTATES,
1711 		.cmd_name = "KILLSTATES",
1712 		.cmd_cb = pf_handle_kill_states,
1713 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1714 		.cmd_priv = PRIV_NETINET_PF,
1715 	},
1716 	{
1717 		.cmd_num = PFNL_CMD_SET_STATUSIF,
1718 		.cmd_name = "SETSTATUSIF",
1719 		.cmd_cb = pf_handle_set_statusif,
1720 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
1721 		.cmd_priv = PRIV_NETINET_PF,
1722 	},
1723 	{
1724 		.cmd_num = PFNL_CMD_GET_STATUS,
1725 		.cmd_name = "GETSTATUS",
1726 		.cmd_cb = pf_handle_get_status,
1727 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1728 		.cmd_priv = PRIV_NETINET_PF,
1729 	},
1730 	{
1731 		.cmd_num = PFNL_CMD_CLEAR_STATUS,
1732 		.cmd_name = "CLEARSTATUS",
1733 		.cmd_cb = pf_handle_clear_status,
1734 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
1735 		.cmd_priv = PRIV_NETINET_PF,
1736 	},
1737 	{
1738 		.cmd_num = PFNL_CMD_NATLOOK,
1739 		.cmd_name = "NATLOOK",
1740 		.cmd_cb = pf_handle_natlook,
1741 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1742 		.cmd_priv = PRIV_NETINET_PF,
1743 	},
1744 	{
1745 		.cmd_num = PFNL_CMD_SET_DEBUG,
1746 		.cmd_name = "SET_DEBUG",
1747 		.cmd_cb = pf_handle_set_debug,
1748 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
1749 		.cmd_priv = PRIV_NETINET_PF,
1750 	},
1751 	{
1752 		.cmd_num = PFNL_CMD_SET_TIMEOUT,
1753 		.cmd_name = "SET_TIMEOUT",
1754 		.cmd_cb = pf_handle_set_timeout,
1755 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
1756 		.cmd_priv = PRIV_NETINET_PF,
1757 	},
1758 	{
1759 		.cmd_num = PFNL_CMD_GET_TIMEOUT,
1760 		.cmd_name = "GET_TIMEOUT",
1761 		.cmd_cb = pf_handle_get_timeout,
1762 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1763 		.cmd_priv = PRIV_NETINET_PF,
1764 	},
1765 	{
1766 		.cmd_num = PFNL_CMD_SET_LIMIT,
1767 		.cmd_name = "SET_LIMIT",
1768 		.cmd_cb = pf_handle_set_limit,
1769 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
1770 		.cmd_priv = PRIV_NETINET_PF,
1771 	},
1772 	{
1773 		.cmd_num = PFNL_CMD_GET_LIMIT,
1774 		.cmd_name = "GET_LIMIT",
1775 		.cmd_cb = pf_handle_get_limit,
1776 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1777 		.cmd_priv = PRIV_NETINET_PF,
1778 	},
1779 	{
1780 		.cmd_num = PFNL_CMD_BEGIN_ADDRS,
1781 		.cmd_name = "BEGIN_ADDRS",
1782 		.cmd_cb = pf_handle_begin_addrs,
1783 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1784 		.cmd_priv = PRIV_NETINET_PF,
1785 	},
1786 	{
1787 		.cmd_num = PFNL_CMD_ADD_ADDR,
1788 		.cmd_name = "ADD_ADDR",
1789 		.cmd_cb = pf_handle_add_addr,
1790 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
1791 		.cmd_priv = PRIV_NETINET_PF,
1792 	},
1793 	{
1794 		.cmd_num = PFNL_CMD_GET_ADDRS,
1795 		.cmd_name = "GET_ADDRS",
1796 		.cmd_cb = pf_handle_get_addrs,
1797 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1798 		.cmd_priv = PRIV_NETINET_PF,
1799 	},
1800 	{
1801 		.cmd_num = PFNL_CMD_GET_ADDR,
1802 		.cmd_name = "GET_ADDRS",
1803 		.cmd_cb = pf_handle_get_addr,
1804 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1805 		.cmd_priv = PRIV_NETINET_PF,
1806 	},
1807 };
1808 
1809 void
1810 pf_nl_register(void)
1811 {
1812 	NL_VERIFY_PARSERS(all_parsers);
1813 
1814 	family_id = genl_register_family(PFNL_FAMILY_NAME, 0, 2, PFNL_CMD_MAX);
1815 	genl_register_cmds(PFNL_FAMILY_NAME, pf_cmds, NL_ARRAY_LEN(pf_cmds));
1816 }
1817 
1818 void
1819 pf_nl_unregister(void)
1820 {
1821 	genl_unregister_family(PFNL_FAMILY_NAME);
1822 }
1823