1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2023 Alexander V. Chernikov <melifaro@FreeBSD.org> 5 * Copyright (c) 2023 Rubicon Communications, LLC (Netgate) 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 * 28 */ 29 #include <sys/cdefs.h> 30 #include "opt_inet.h" 31 #include "opt_inet6.h" 32 33 #include <sys/param.h> 34 #include <sys/malloc.h> 35 #include <sys/mbuf.h> 36 #include <sys/priv.h> 37 #include <sys/socket.h> 38 #include <sys/ucred.h> 39 40 #include <net/pfvar.h> 41 42 #include <netlink/netlink.h> 43 #include <netlink/netlink_ctl.h> 44 #include <netlink/netlink_generic.h> 45 #include <netlink/netlink_message_writer.h> 46 47 #include <netpfil/pf/pf_nl.h> 48 49 #define DEBUG_MOD_NAME nl_pf 50 #define DEBUG_MAX_LEVEL LOG_DEBUG3 51 #include <netlink/netlink_debug.h> 52 _DECLARE_DEBUG(LOG_DEBUG); 53 54 struct nl_parsed_state { 55 uint8_t version; 56 uint32_t id; 57 uint32_t creatorid; 58 char ifname[IFNAMSIZ]; 59 uint16_t proto; 60 sa_family_t af; 61 struct pf_addr addr; 62 struct pf_addr mask; 63 }; 64 65 #define _IN(_field) offsetof(struct genlmsghdr, _field) 66 #define _OUT(_field) offsetof(struct nl_parsed_state, _field) 67 static const struct nlattr_parser nla_p_state[] = { 68 { .type = PF_ST_ID, .off = _OUT(id), .cb = nlattr_get_uint32 }, 69 { .type = PF_ST_CREATORID, .off = _OUT(creatorid), .cb = nlattr_get_uint32 }, 70 { .type = PF_ST_IFNAME, .arg = (const void *)IFNAMSIZ, .off = _OUT(ifname), .cb = nlattr_get_chara }, 71 { .type = PF_ST_AF, .off = _OUT(af), .cb = nlattr_get_uint8 }, 72 { .type = PF_ST_PROTO, .off = _OUT(proto), .cb = nlattr_get_uint16 }, 73 { .type = PF_ST_FILTER_ADDR, .off = _OUT(addr), .cb = nlattr_get_in6_addr }, 74 { .type = PF_ST_FILTER_MASK, .off = _OUT(mask), .cb = nlattr_get_in6_addr }, 75 }; 76 static const struct nlfield_parser nlf_p_generic[] = { 77 { .off_in = _IN(version), .off_out = _OUT(version), .cb = nlf_get_u8 }, 78 }; 79 #undef _IN 80 #undef _OUT 81 NL_DECLARE_PARSER(state_parser, struct genlmsghdr, nlf_p_generic, nla_p_state); 82 83 static void 84 dump_addr(struct nl_writer *nw, int attr, const struct pf_addr *addr, int af) 85 { 86 switch (af) { 87 case AF_INET: 88 nlattr_add(nw, attr, 4, &addr->v4); 89 break; 90 case AF_INET6: 91 nlattr_add(nw, attr, 16, &addr->v6); 92 break; 93 }; 94 } 95 96 static bool 97 dump_state_peer(struct nl_writer *nw, int attr, const struct pf_state_peer *peer) 98 { 99 int off = nlattr_add_nested(nw, attr); 100 if (off == 0) 101 return (false); 102 103 nlattr_add_u32(nw, PF_STP_SEQLO, peer->seqlo); 104 nlattr_add_u32(nw, PF_STP_SEQHI, peer->seqhi); 105 nlattr_add_u32(nw, PF_STP_SEQDIFF, peer->seqdiff); 106 nlattr_add_u16(nw, PF_STP_MAX_WIN, peer->max_win); 107 nlattr_add_u16(nw, PF_STP_MSS, peer->mss); 108 nlattr_add_u8(nw, PF_STP_STATE, peer->state); 109 nlattr_add_u8(nw, PF_STP_WSCALE, peer->wscale); 110 111 if (peer->scrub != NULL) { 112 struct pf_state_scrub *sc = peer->scrub; 113 uint16_t pfss_flags = sc->pfss_flags & PFSS_TIMESTAMP; 114 115 nlattr_add_u16(nw, PF_STP_PFSS_FLAGS, pfss_flags); 116 nlattr_add_u32(nw, PF_STP_PFSS_TS_MOD, sc->pfss_ts_mod); 117 nlattr_add_u8(nw, PF_STP_PFSS_TTL, sc->pfss_ttl); 118 nlattr_add_u8(nw, PF_STP_SCRUB_FLAG, PFSYNC_SCRUB_FLAG_VALID); 119 } 120 nlattr_set_len(nw, off); 121 122 return (true); 123 } 124 125 static bool 126 dump_state_key(struct nl_writer *nw, int attr, const struct pf_state_key *key) 127 { 128 int off = nlattr_add_nested(nw, attr); 129 if (off == 0) 130 return (false); 131 132 dump_addr(nw, PF_STK_ADDR0, &key->addr[0], key->af); 133 dump_addr(nw, PF_STK_ADDR1, &key->addr[1], key->af); 134 nlattr_add_u16(nw, PF_STK_PORT0, key->port[0]); 135 nlattr_add_u16(nw, PF_STK_PORT1, key->port[1]); 136 nlattr_add_u8(nw, PF_STK_AF, key->af); 137 nlattr_add_u16(nw, PF_STK_PROTO, key->proto); 138 139 nlattr_set_len(nw, off); 140 141 return (true); 142 } 143 144 static int 145 dump_state(struct nlpcb *nlp, const struct nlmsghdr *hdr, struct pf_kstate *s, 146 struct nl_pstate *npt) 147 { 148 struct nl_writer *nw = npt->nw; 149 int error = 0; 150 int af; 151 struct pf_state_key *key; 152 153 PF_STATE_LOCK_ASSERT(s); 154 155 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 156 goto enomem; 157 158 struct genlmsghdr *ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 159 ghdr_new->cmd = PFNL_CMD_GETSTATES; 160 ghdr_new->version = 0; 161 ghdr_new->reserved = 0; 162 163 nlattr_add_u64(nw, PF_ST_VERSION, PF_STATE_VERSION); 164 165 key = s->key[PF_SK_WIRE]; 166 if (!dump_state_key(nw, PF_ST_KEY_WIRE, key)) 167 goto enomem; 168 key = s->key[PF_SK_STACK]; 169 if (!dump_state_key(nw, PF_ST_KEY_STACK, key)) 170 goto enomem; 171 172 af = s->key[PF_SK_WIRE]->af; 173 nlattr_add_u8(nw, PF_ST_PROTO, s->key[PF_SK_WIRE]->proto); 174 nlattr_add_u8(nw, PF_ST_AF, af); 175 176 nlattr_add_string(nw, PF_ST_IFNAME, s->kif->pfik_name); 177 nlattr_add_string(nw, PF_ST_ORIG_IFNAME, s->orig_kif->pfik_name); 178 dump_addr(nw, PF_ST_RT_ADDR, &s->act.rt_addr, af); 179 nlattr_add_u32(nw, PF_ST_CREATION, time_uptime - (s->creation / 1000)); 180 uint32_t expire = pf_state_expires(s); 181 if (expire > time_uptime) 182 expire = expire - time_uptime; 183 nlattr_add_u32(nw, PF_ST_EXPIRE, expire); 184 nlattr_add_u8(nw, PF_ST_DIRECTION, s->direction); 185 nlattr_add_u8(nw, PF_ST_LOG, s->act.log); 186 nlattr_add_u8(nw, PF_ST_TIMEOUT, s->timeout); 187 nlattr_add_u16(nw, PF_ST_STATE_FLAGS, s->state_flags); 188 uint8_t sync_flags = 0; 189 if (s->src_node) 190 sync_flags |= PFSYNC_FLAG_SRCNODE; 191 if (s->nat_src_node) 192 sync_flags |= PFSYNC_FLAG_NATSRCNODE; 193 nlattr_add_u8(nw, PF_ST_SYNC_FLAGS, sync_flags); 194 nlattr_add_u64(nw, PF_ST_ID, s->id); 195 nlattr_add_u32(nw, PF_ST_CREATORID, htonl(s->creatorid)); 196 197 nlattr_add_u32(nw, PF_ST_RULE, s->rule ? s->rule->nr : -1); 198 nlattr_add_u32(nw, PF_ST_ANCHOR, s->anchor ? s->anchor->nr : -1); 199 nlattr_add_u32(nw, PF_ST_NAT_RULE, s->nat_rule ? s->nat_rule->nr : -1); 200 201 nlattr_add_u64(nw, PF_ST_PACKETS0, s->packets[0]); 202 nlattr_add_u64(nw, PF_ST_PACKETS1, s->packets[1]); 203 nlattr_add_u64(nw, PF_ST_BYTES0, s->bytes[0]); 204 nlattr_add_u64(nw, PF_ST_BYTES1, s->bytes[1]); 205 nlattr_add_u32(nw, PF_ST_RTABLEID, s->act.rtableid); 206 nlattr_add_u8(nw, PF_ST_MIN_TTL, s->act.min_ttl); 207 nlattr_add_u16(nw, PF_ST_MAX_MSS, s->act.max_mss); 208 nlattr_add_u16(nw, PF_ST_DNPIPE, s->act.dnpipe); 209 nlattr_add_u16(nw, PF_ST_DNRPIPE, s->act.dnrpipe); 210 nlattr_add_u8(nw, PF_ST_RT, s->act.rt); 211 if (s->act.rt_kif != NULL) 212 nlattr_add_string(nw, PF_ST_RT_IFNAME, s->act.rt_kif->pfik_name); 213 214 if (!dump_state_peer(nw, PF_ST_PEER_SRC, &s->src)) 215 goto enomem; 216 if (!dump_state_peer(nw, PF_ST_PEER_DST, &s->dst)) 217 goto enomem; 218 219 if (nlmsg_end(nw)) 220 return (0); 221 222 enomem: 223 error = ENOMEM; 224 nlmsg_abort(nw); 225 return (error); 226 } 227 228 static int 229 handle_dumpstates(struct nlpcb *nlp, struct nl_parsed_state *attrs, 230 struct nlmsghdr *hdr, struct nl_pstate *npt) 231 { 232 int error = 0; 233 234 hdr->nlmsg_flags |= NLM_F_MULTI; 235 236 for (int i = 0; i <= V_pf_hashmask; i++) { 237 struct pf_idhash *ih = &V_pf_idhash[i]; 238 struct pf_kstate *s; 239 240 if (LIST_EMPTY(&ih->states)) 241 continue; 242 243 PF_HASHROW_LOCK(ih); 244 LIST_FOREACH(s, &ih->states, entry) { 245 sa_family_t af = s->key[PF_SK_WIRE]->af; 246 247 if (s->timeout == PFTM_UNLINKED) 248 continue; 249 250 /* Filter */ 251 if (attrs->creatorid != 0 && s->creatorid != attrs->creatorid) 252 continue; 253 if (attrs->ifname[0] != 0 && 254 strncmp(attrs->ifname, s->kif->pfik_name, IFNAMSIZ) != 0) 255 continue; 256 if (attrs->proto != 0 && s->key[PF_SK_WIRE]->proto != attrs->proto) 257 continue; 258 if (attrs->af != 0 && af != attrs->af) 259 continue; 260 if (pf_match_addr(1, &s->key[PF_SK_WIRE]->addr[0], 261 &attrs->mask, &attrs->addr, af) && 262 pf_match_addr(1, &s->key[PF_SK_WIRE]->addr[1], 263 &attrs->mask, &attrs->addr, af) && 264 pf_match_addr(1, &s->key[PF_SK_STACK]->addr[0], 265 &attrs->mask, &attrs->addr, af) && 266 pf_match_addr(1, &s->key[PF_SK_STACK]->addr[1], 267 &attrs->mask, &attrs->addr, af)) 268 continue; 269 270 error = dump_state(nlp, hdr, s, npt); 271 if (error != 0) 272 break; 273 } 274 PF_HASHROW_UNLOCK(ih); 275 } 276 277 if (!nlmsg_end_dump(npt->nw, error, hdr)) { 278 NL_LOG(LOG_DEBUG, "Unable to finalize the dump"); 279 return (ENOMEM); 280 } 281 282 return (error); 283 } 284 285 static int 286 handle_getstate(struct nlpcb *nlp, struct nl_parsed_state *attrs, 287 struct nlmsghdr *hdr, struct nl_pstate *npt) 288 { 289 struct pf_kstate *s; 290 int ret; 291 292 s = pf_find_state_byid(attrs->id, attrs->creatorid); 293 if (s == NULL) 294 return (ENOENT); 295 ret = dump_state(nlp, hdr, s, npt); 296 PF_STATE_UNLOCK(s); 297 298 return (ret); 299 } 300 301 static int 302 dump_creatorid(struct nlpcb *nlp, const struct nlmsghdr *hdr, uint32_t creator, 303 struct nl_pstate *npt) 304 { 305 struct nl_writer *nw = npt->nw; 306 307 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 308 goto enomem; 309 310 struct genlmsghdr *ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 311 ghdr_new->cmd = PFNL_CMD_GETCREATORS; 312 ghdr_new->version = 0; 313 ghdr_new->reserved = 0; 314 315 nlattr_add_u32(nw, PF_ST_CREATORID, htonl(creator)); 316 317 if (nlmsg_end(nw)) 318 return (0); 319 320 enomem: 321 nlmsg_abort(nw); 322 return (ENOMEM); 323 } 324 325 static int 326 pf_handle_getstates(struct nlmsghdr *hdr, struct nl_pstate *npt) 327 { 328 int error; 329 330 struct nl_parsed_state attrs = {}; 331 error = nl_parse_nlmsg(hdr, &state_parser, npt, &attrs); 332 if (error != 0) 333 return (error); 334 335 if (attrs.id != 0) 336 error = handle_getstate(npt->nlp, &attrs, hdr, npt); 337 else 338 error = handle_dumpstates(npt->nlp, &attrs, hdr, npt); 339 340 return (error); 341 } 342 343 static int 344 pf_handle_getcreators(struct nlmsghdr *hdr, struct nl_pstate *npt) 345 { 346 uint32_t creators[16]; 347 int error = 0; 348 349 bzero(creators, sizeof(creators)); 350 351 for (int i = 0; i < V_pf_hashmask; i++) { 352 struct pf_idhash *ih = &V_pf_idhash[i]; 353 struct pf_kstate *s; 354 355 if (LIST_EMPTY(&ih->states)) 356 continue; 357 358 PF_HASHROW_LOCK(ih); 359 LIST_FOREACH(s, &ih->states, entry) { 360 int j; 361 if (s->timeout == PFTM_UNLINKED) 362 continue; 363 364 for (j = 0; j < nitems(creators); j++) { 365 if (creators[j] == s->creatorid) 366 break; 367 if (creators[j] == 0) { 368 creators[j] = s->creatorid; 369 break; 370 } 371 } 372 if (j == nitems(creators)) 373 printf("Warning: too many creators!\n"); 374 } 375 PF_HASHROW_UNLOCK(ih); 376 } 377 378 hdr->nlmsg_flags |= NLM_F_MULTI; 379 for (int i = 0; i < nitems(creators); i++) { 380 if (creators[i] == 0) 381 break; 382 error = dump_creatorid(npt->nlp, hdr, creators[i], npt); 383 } 384 385 if (!nlmsg_end_dump(npt->nw, error, hdr)) { 386 NL_LOG(LOG_DEBUG, "Unable to finalize the dump"); 387 return (ENOMEM); 388 } 389 390 return (error); 391 } 392 393 static int 394 pf_handle_start(struct nlmsghdr *hdr __unused, struct nl_pstate *npt __unused) 395 { 396 return (pf_start()); 397 } 398 399 static int 400 pf_handle_stop(struct nlmsghdr *hdr __unused, struct nl_pstate *npt __unused) 401 { 402 return (pf_stop()); 403 } 404 405 #define _OUT(_field) offsetof(struct pf_addr_wrap, _field) 406 static const struct nlattr_parser nla_p_addr_wrap[] = { 407 { .type = PF_AT_ADDR, .off = _OUT(v.a.addr), .cb = nlattr_get_in6_addr }, 408 { .type = PF_AT_MASK, .off = _OUT(v.a.mask), .cb = nlattr_get_in6_addr }, 409 { .type = PF_AT_IFNAME, .off = _OUT(v.ifname), .arg = (void *)IFNAMSIZ,.cb = nlattr_get_chara }, 410 { .type = PF_AT_TABLENAME, .off = _OUT(v.tblname), .arg = (void *)PF_TABLE_NAME_SIZE, .cb = nlattr_get_chara }, 411 { .type = PF_AT_TYPE, .off = _OUT(type), .cb = nlattr_get_uint8 }, 412 { .type = PF_AT_IFLAGS, .off = _OUT(iflags), .cb = nlattr_get_uint8 }, 413 }; 414 NL_DECLARE_ATTR_PARSER(addr_wrap_parser, nla_p_addr_wrap); 415 #undef _OUT 416 417 static bool 418 nlattr_add_addr_wrap(struct nl_writer *nw, int attrtype, struct pf_addr_wrap *a) 419 { 420 int off = nlattr_add_nested(nw, attrtype); 421 422 nlattr_add_in6_addr(nw, PF_AT_ADDR, &a->v.a.addr.v6); 423 nlattr_add_in6_addr(nw, PF_AT_MASK, &a->v.a.mask.v6); 424 nlattr_add_u8(nw, PF_AT_TYPE, a->type); 425 nlattr_add_u8(nw, PF_AT_IFLAGS, a->iflags); 426 427 if (a->type == PF_ADDR_DYNIFTL) { 428 nlattr_add_string(nw, PF_AT_IFNAME, a->v.ifname); 429 nlattr_add_u32(nw, PF_AT_DYNCNT, a->p.dyncnt); 430 } else if (a->type == PF_ADDR_TABLE) { 431 nlattr_add_string(nw, PF_AT_TABLENAME, a->v.tblname); 432 nlattr_add_u32(nw, PF_AT_TBLCNT, a->p.tblcnt); 433 } 434 435 nlattr_set_len(nw, off); 436 437 return (true); 438 } 439 440 #define _OUT(_field) offsetof(struct pf_rule_addr, _field) 441 static const struct nlattr_parser nla_p_ruleaddr[] = { 442 { .type = PF_RAT_ADDR, .off = _OUT(addr), .arg = &addr_wrap_parser, .cb = nlattr_get_nested }, 443 { .type = PF_RAT_SRC_PORT, .off = _OUT(port[0]), .cb = nlattr_get_uint16 }, 444 { .type = PF_RAT_DST_PORT, .off = _OUT(port[1]), .cb = nlattr_get_uint16 }, 445 { .type = PF_RAT_NEG, .off = _OUT(neg), .cb = nlattr_get_uint8 }, 446 { .type = PF_RAT_OP, .off = _OUT(port_op), .cb = nlattr_get_uint8 }, 447 }; 448 NL_DECLARE_ATTR_PARSER(rule_addr_parser, nla_p_ruleaddr); 449 #undef _OUT 450 451 static bool 452 nlattr_add_rule_addr(struct nl_writer *nw, int attrtype, struct pf_rule_addr *r) 453 { 454 struct pf_addr_wrap aw = {0}; 455 int off = nlattr_add_nested(nw, attrtype); 456 457 bcopy(&(r->addr), &aw, sizeof(struct pf_addr_wrap)); 458 pf_addr_copyout(&aw); 459 460 nlattr_add_addr_wrap(nw, PF_RAT_ADDR, &aw); 461 nlattr_add_u16(nw, PF_RAT_SRC_PORT, r->port[0]); 462 nlattr_add_u16(nw, PF_RAT_DST_PORT, r->port[1]); 463 nlattr_add_u8(nw, PF_RAT_NEG, r->neg); 464 nlattr_add_u8(nw, PF_RAT_OP, r->port_op); 465 466 nlattr_set_len(nw, off); 467 468 return (true); 469 } 470 471 #define _OUT(_field) offsetof(struct pf_mape_portset, _field) 472 static const struct nlattr_parser nla_p_mape_portset[] = { 473 { .type = PF_MET_OFFSET, .off = _OUT(offset), .cb = nlattr_get_uint8 }, 474 { .type = PF_MET_PSID_LEN, .off = _OUT(psidlen), .cb = nlattr_get_uint8 }, 475 {. type = PF_MET_PSID, .off = _OUT(psid), .cb = nlattr_get_uint16 }, 476 }; 477 NL_DECLARE_ATTR_PARSER(mape_portset_parser, nla_p_mape_portset); 478 #undef _OUT 479 480 static bool 481 nlattr_add_mape_portset(struct nl_writer *nw, int attrtype, const struct pf_mape_portset *m) 482 { 483 int off = nlattr_add_nested(nw, attrtype); 484 485 nlattr_add_u8(nw, PF_MET_OFFSET, m->offset); 486 nlattr_add_u8(nw, PF_MET_PSID_LEN, m->psidlen); 487 nlattr_add_u16(nw, PF_MET_PSID, m->psid); 488 489 nlattr_set_len(nw, off); 490 491 return (true); 492 } 493 494 struct nl_parsed_labels 495 { 496 char labels[PF_RULE_MAX_LABEL_COUNT][PF_RULE_LABEL_SIZE]; 497 uint32_t i; 498 }; 499 500 static int 501 nlattr_get_pf_rule_labels(struct nlattr *nla, struct nl_pstate *npt, 502 const void *arg, void *target) 503 { 504 struct nl_parsed_labels *l = (struct nl_parsed_labels *)target; 505 int ret; 506 507 if (l->i >= PF_RULE_MAX_LABEL_COUNT) 508 return (E2BIG); 509 510 ret = nlattr_get_chara(nla, npt, (void *)PF_RULE_LABEL_SIZE, 511 l->labels[l->i]); 512 if (ret == 0) 513 l->i++; 514 515 return (ret); 516 } 517 518 #define _OUT(_field) offsetof(struct nl_parsed_labels, _field) 519 static const struct nlattr_parser nla_p_labels[] = { 520 { .type = PF_LT_LABEL, .off = 0, .cb = nlattr_get_pf_rule_labels }, 521 }; 522 NL_DECLARE_ATTR_PARSER(rule_labels_parser, nla_p_labels); 523 #undef _OUT 524 525 static int 526 nlattr_get_nested_pf_rule_labels(struct nlattr *nla, struct nl_pstate *npt, const void *arg, void *target) 527 { 528 struct nl_parsed_labels parsed_labels = { }; 529 int error; 530 531 /* Assumes target points to the beginning of the structure */ 532 error = nl_parse_header(NLA_DATA(nla), NLA_DATA_LEN(nla), &rule_labels_parser, npt, &parsed_labels); 533 if (error != 0) 534 return (error); 535 536 memcpy(target, parsed_labels.labels, sizeof(parsed_labels.labels)); 537 538 return (0); 539 } 540 541 static bool 542 nlattr_add_labels(struct nl_writer *nw, int attrtype, const struct pf_krule *r) 543 { 544 int off = nlattr_add_nested(nw, attrtype); 545 int i = 0; 546 547 while (r->label[i][0] != 0 548 && i < PF_RULE_MAX_LABEL_COUNT) { 549 nlattr_add_string(nw, PF_LT_LABEL, r->label[i]); 550 i++; 551 } 552 553 nlattr_set_len(nw, off); 554 555 return (true); 556 } 557 558 #define _OUT(_field) offsetof(struct pf_kpool, _field) 559 static const struct nlattr_parser nla_p_pool[] = { 560 { .type = PF_PT_KEY, .off = _OUT(key), .arg = (void *)sizeof(struct pf_poolhashkey), .cb = nlattr_get_bytes }, 561 { .type = PF_PT_COUNTER, .off = _OUT(counter), .cb = nlattr_get_in6_addr }, 562 { .type = PF_PT_TBLIDX, .off = _OUT(tblidx), .cb = nlattr_get_uint32 }, 563 { .type = PF_PT_PROXY_SRC_PORT, .off = _OUT(proxy_port[0]), .cb = nlattr_get_uint16 }, 564 { .type = PF_PT_PROXY_DST_PORT, .off = _OUT(proxy_port[1]), .cb = nlattr_get_uint16 }, 565 { .type = PF_PT_OPTS, .off = _OUT(opts), .cb = nlattr_get_uint8 }, 566 { .type = PF_PT_MAPE, .off = _OUT(mape), .arg = &mape_portset_parser, .cb = nlattr_get_nested }, 567 }; 568 NL_DECLARE_ATTR_PARSER(pool_parser, nla_p_pool); 569 #undef _OUT 570 571 static bool 572 nlattr_add_pool(struct nl_writer *nw, int attrtype, const struct pf_kpool *pool) 573 { 574 int off = nlattr_add_nested(nw, attrtype); 575 576 nlattr_add(nw, PF_PT_KEY, sizeof(struct pf_poolhashkey), &pool->key); 577 nlattr_add_in6_addr(nw, PF_PT_COUNTER, (const struct in6_addr *)&pool->counter); 578 nlattr_add_u32(nw, PF_PT_TBLIDX, pool->tblidx); 579 nlattr_add_u16(nw, PF_PT_PROXY_SRC_PORT, pool->proxy_port[0]); 580 nlattr_add_u16(nw, PF_PT_PROXY_DST_PORT, pool->proxy_port[1]); 581 nlattr_add_u8(nw, PF_PT_OPTS, pool->opts); 582 nlattr_add_mape_portset(nw, PF_PT_MAPE, &pool->mape); 583 584 nlattr_set_len(nw, off); 585 586 return (true); 587 } 588 589 #define _OUT(_field) offsetof(struct pf_rule_uid, _field) 590 static const struct nlattr_parser nla_p_rule_uid[] = { 591 { .type = PF_RUT_UID_LOW, .off = _OUT(uid[0]), .cb = nlattr_get_uint32 }, 592 { .type = PF_RUT_UID_HIGH, .off = _OUT(uid[1]), .cb = nlattr_get_uint32 }, 593 { .type = PF_RUT_OP, .off = _OUT(op), .cb = nlattr_get_uint8 }, 594 }; 595 NL_DECLARE_ATTR_PARSER(rule_uid_parser, nla_p_rule_uid); 596 #undef _OUT 597 598 static bool 599 nlattr_add_rule_uid(struct nl_writer *nw, int attrtype, const struct pf_rule_uid *u) 600 { 601 int off = nlattr_add_nested(nw, attrtype); 602 603 nlattr_add_u32(nw, PF_RUT_UID_LOW, u->uid[0]); 604 nlattr_add_u32(nw, PF_RUT_UID_HIGH, u->uid[1]); 605 nlattr_add_u8(nw, PF_RUT_OP, u->op); 606 607 nlattr_set_len(nw, off); 608 609 return (true); 610 } 611 612 struct nl_parsed_timeouts 613 { 614 uint32_t timeouts[PFTM_MAX]; 615 uint32_t i; 616 }; 617 618 static int 619 nlattr_get_pf_timeout(struct nlattr *nla, struct nl_pstate *npt, 620 const void *arg, void *target) 621 { 622 struct nl_parsed_timeouts *t = (struct nl_parsed_timeouts *)target; 623 int ret; 624 625 if (t->i >= PFTM_MAX) 626 return (E2BIG); 627 628 ret = nlattr_get_uint32(nla, npt, NULL, &t->timeouts[t->i]); 629 if (ret == 0) 630 t->i++; 631 632 return (ret); 633 } 634 635 #define _OUT(_field) offsetof(struct nl_parsed_timeout, _field) 636 static const struct nlattr_parser nla_p_timeouts[] = { 637 { .type = PF_TT_TIMEOUT, .off = 0, .cb = nlattr_get_pf_timeout }, 638 }; 639 NL_DECLARE_ATTR_PARSER(timeout_parser, nla_p_timeouts); 640 #undef _OUT 641 642 static int 643 nlattr_get_nested_timeouts(struct nlattr *nla, struct nl_pstate *npt, const void *arg, void *target) 644 { 645 struct nl_parsed_timeouts parsed_timeouts = { }; 646 int error; 647 648 /* Assumes target points to the beginning of the structure */ 649 error = nl_parse_header(NLA_DATA(nla), NLA_DATA_LEN(nla), &timeout_parser, npt, &parsed_timeouts); 650 if (error != 0) 651 return (error); 652 653 memcpy(target, parsed_timeouts.timeouts, sizeof(parsed_timeouts.timeouts)); 654 655 return (0); 656 } 657 658 static bool 659 nlattr_add_timeout(struct nl_writer *nw, int attrtype, uint32_t *timeout) 660 { 661 int off = nlattr_add_nested(nw, attrtype); 662 663 for (int i = 0; i < PFTM_MAX; i++) 664 nlattr_add_u32(nw, PF_RT_TIMEOUT, timeout[i]); 665 666 nlattr_set_len(nw, off); 667 668 return (true); 669 } 670 671 #define _OUT(_field) offsetof(struct pf_krule, _field) 672 static const struct nlattr_parser nla_p_rule[] = { 673 { .type = PF_RT_SRC, .off = _OUT(src), .arg = &rule_addr_parser,.cb = nlattr_get_nested }, 674 { .type = PF_RT_DST, .off = _OUT(dst), .arg = &rule_addr_parser,.cb = nlattr_get_nested }, 675 { .type = PF_RT_RIDENTIFIER, .off = _OUT(ridentifier), .cb = nlattr_get_uint32 }, 676 { .type = PF_RT_LABELS, .off = _OUT(label), .arg = &rule_labels_parser,.cb = nlattr_get_nested_pf_rule_labels }, 677 { .type = PF_RT_IFNAME, .off = _OUT(ifname), .arg = (void *)IFNAMSIZ, .cb = nlattr_get_chara }, 678 { .type = PF_RT_QNAME, .off = _OUT(qname), .arg = (void *)PF_QNAME_SIZE, .cb = nlattr_get_chara }, 679 { .type = PF_RT_PQNAME, .off = _OUT(pqname), .arg = (void *)PF_QNAME_SIZE, .cb = nlattr_get_chara }, 680 { .type = PF_RT_TAGNAME, .off = _OUT(tagname), .arg = (void *)PF_TAG_NAME_SIZE, .cb = nlattr_get_chara }, 681 { .type = PF_RT_MATCH_TAGNAME, .off = _OUT(match_tagname), .arg = (void *)PF_TAG_NAME_SIZE, .cb = nlattr_get_chara }, 682 { .type = PF_RT_OVERLOAD_TBLNAME, .off = _OUT(overload_tblname), .arg = (void *)PF_TABLE_NAME_SIZE, .cb = nlattr_get_chara }, 683 { .type = PF_RT_RPOOL_RDR, .off = _OUT(rdr), .arg = &pool_parser, .cb = nlattr_get_nested }, 684 { .type = PF_RT_OS_FINGERPRINT, .off = _OUT(os_fingerprint), .cb = nlattr_get_uint32 }, 685 { .type = PF_RT_RTABLEID, .off = _OUT(rtableid), .cb = nlattr_get_uint32 }, 686 { .type = PF_RT_TIMEOUT, .off = _OUT(timeout), .arg = &timeout_parser, .cb = nlattr_get_nested_timeouts }, 687 { .type = PF_RT_MAX_STATES, .off = _OUT(max_states), .cb = nlattr_get_uint32 }, 688 { .type = PF_RT_MAX_SRC_NODES, .off = _OUT(max_src_nodes), .cb = nlattr_get_uint32 }, 689 { .type = PF_RT_MAX_SRC_STATES, .off = _OUT(max_src_states), .cb = nlattr_get_uint32 }, 690 { .type = PF_RT_MAX_SRC_CONN_RATE_LIMIT, .off = _OUT(max_src_conn_rate.limit), .cb = nlattr_get_uint32 }, 691 { .type = PF_RT_MAX_SRC_CONN_RATE_SECS, .off = _OUT(max_src_conn_rate.seconds), .cb = nlattr_get_uint32 }, 692 { .type = PF_RT_DNPIPE, .off = _OUT(dnpipe), .cb = nlattr_get_uint16 }, 693 { .type = PF_RT_DNRPIPE, .off = _OUT(dnrpipe), .cb = nlattr_get_uint16 }, 694 { .type = PF_RT_DNFLAGS, .off = _OUT(free_flags), .cb = nlattr_get_uint32 }, 695 { .type = PF_RT_NR, .off = _OUT(nr), .cb = nlattr_get_uint32 }, 696 { .type = PF_RT_PROB, .off = _OUT(prob), .cb = nlattr_get_uint32 }, 697 { .type = PF_RT_CUID, .off = _OUT(cuid), .cb = nlattr_get_uint32 }, 698 {. type = PF_RT_CPID, .off = _OUT(cpid), .cb = nlattr_get_uint32 }, 699 { .type = PF_RT_RETURN_ICMP, .off = _OUT(return_icmp), .cb = nlattr_get_uint16 }, 700 { .type = PF_RT_RETURN_ICMP6, .off = _OUT(return_icmp6), .cb = nlattr_get_uint16 }, 701 { .type = PF_RT_MAX_MSS, .off = _OUT(max_mss), .cb = nlattr_get_uint16 }, 702 { .type = PF_RT_SCRUB_FLAGS, .off = _OUT(scrub_flags), .cb = nlattr_get_uint16 }, 703 { .type = PF_RT_UID, .off = _OUT(uid), .arg = &rule_uid_parser, .cb = nlattr_get_nested }, 704 { .type = PF_RT_GID, .off = _OUT(gid), .arg = &rule_uid_parser, .cb = nlattr_get_nested }, 705 { .type = PF_RT_RULE_FLAG, .off = _OUT(rule_flag), .cb = nlattr_get_uint32 }, 706 { .type = PF_RT_ACTION, .off = _OUT(action), .cb = nlattr_get_uint8 }, 707 { .type = PF_RT_DIRECTION, .off = _OUT(direction), .cb = nlattr_get_uint8 }, 708 { .type = PF_RT_LOG, .off = _OUT(log), .cb = nlattr_get_uint8 }, 709 { .type = PF_RT_LOGIF, .off = _OUT(logif), .cb = nlattr_get_uint8 }, 710 { .type = PF_RT_QUICK, .off = _OUT(quick), .cb = nlattr_get_uint8 }, 711 { .type = PF_RT_IF_NOT, .off = _OUT(ifnot), .cb = nlattr_get_uint8 }, 712 { .type = PF_RT_MATCH_TAG_NOT, .off = _OUT(match_tag_not), .cb = nlattr_get_uint8 }, 713 { .type = PF_RT_NATPASS, .off = _OUT(natpass), .cb = nlattr_get_uint8 }, 714 { .type = PF_RT_KEEP_STATE, .off = _OUT(keep_state), .cb = nlattr_get_uint8 }, 715 { .type = PF_RT_AF, .off = _OUT(af), .cb = nlattr_get_uint8 }, 716 { .type = PF_RT_PROTO, .off = _OUT(proto), .cb = nlattr_get_uint8 }, 717 { .type = PF_RT_TYPE, .off = _OUT(type), .cb = nlattr_get_uint8 }, 718 { .type = PF_RT_CODE, .off = _OUT(code), .cb = nlattr_get_uint8 }, 719 { .type = PF_RT_FLAGS, .off = _OUT(flags), .cb = nlattr_get_uint8 }, 720 { .type = PF_RT_FLAGSET, .off = _OUT(flagset), .cb = nlattr_get_uint8 }, 721 { .type = PF_RT_MIN_TTL, .off = _OUT(min_ttl), .cb = nlattr_get_uint8 }, 722 { .type = PF_RT_ALLOW_OPTS, .off = _OUT(allow_opts), .cb = nlattr_get_uint8 }, 723 { .type = PF_RT_RT, .off = _OUT(rt), .cb = nlattr_get_uint8 }, 724 { .type = PF_RT_RETURN_TTL, .off = _OUT(return_ttl), .cb = nlattr_get_uint8 }, 725 { .type = PF_RT_TOS, .off = _OUT(tos), .cb = nlattr_get_uint8 }, 726 { .type = PF_RT_SET_TOS, .off = _OUT(set_tos), .cb = nlattr_get_uint8 }, 727 { .type = PF_RT_ANCHOR_RELATIVE, .off = _OUT(anchor_relative), .cb = nlattr_get_uint8 }, 728 { .type = PF_RT_ANCHOR_WILDCARD, .off = _OUT(anchor_wildcard), .cb = nlattr_get_uint8 }, 729 { .type = PF_RT_FLUSH, .off = _OUT(flush), .cb = nlattr_get_uint8 }, 730 { .type = PF_RT_PRIO, .off = _OUT(prio), .cb = nlattr_get_uint8 }, 731 { .type = PF_RT_SET_PRIO, .off = _OUT(set_prio[0]), .cb = nlattr_get_uint8 }, 732 { .type = PF_RT_SET_PRIO_REPLY, .off = _OUT(set_prio[1]), .cb = nlattr_get_uint8 }, 733 { .type = PF_RT_DIVERT_ADDRESS, .off = _OUT(divert.addr), .cb = nlattr_get_in6_addr }, 734 { .type = PF_RT_DIVERT_PORT, .off = _OUT(divert.port), .cb = nlattr_get_uint16 }, 735 { .type = PF_RT_RCV_IFNAME, .off = _OUT(rcv_ifname), .arg = (void *)IFNAMSIZ, .cb = nlattr_get_chara }, 736 { .type = PF_RT_MAX_SRC_CONN, .off = _OUT(max_src_conn), .cb = nlattr_get_uint32 }, 737 { .type = PF_RT_RPOOL_NAT, .off = _OUT(nat), .arg = &pool_parser, .cb = nlattr_get_nested }, 738 { .type = PF_RT_NAF, .off = _OUT(naf), .cb = nlattr_get_uint8 }, 739 { .type = PF_RT_RPOOL_RT, .off = _OUT(route), .arg = &pool_parser, .cb = nlattr_get_nested }, 740 }; 741 NL_DECLARE_ATTR_PARSER(rule_parser, nla_p_rule); 742 #undef _OUT 743 struct nl_parsed_addrule { 744 struct pf_krule *rule; 745 uint32_t ticket; 746 uint32_t pool_ticket; 747 char *anchor; 748 char *anchor_call; 749 }; 750 #define _OUT(_field) offsetof(struct nl_parsed_addrule, _field) 751 static const struct nlattr_parser nla_p_addrule[] = { 752 { .type = PF_ART_TICKET, .off = _OUT(ticket), .cb = nlattr_get_uint32 }, 753 { .type = PF_ART_POOL_TICKET, .off = _OUT(pool_ticket), .cb = nlattr_get_uint32 }, 754 { .type = PF_ART_ANCHOR, .off = _OUT(anchor), .cb = nlattr_get_string }, 755 { .type = PF_ART_ANCHOR_CALL, .off = _OUT(anchor_call), .cb = nlattr_get_string }, 756 { .type = PF_ART_RULE, .off = _OUT(rule), .arg = &rule_parser, .cb = nlattr_get_nested_ptr } 757 }; 758 #undef _OUT 759 NL_DECLARE_PARSER(addrule_parser, struct genlmsghdr, nlf_p_empty, nla_p_addrule); 760 761 static int 762 pf_handle_addrule(struct nlmsghdr *hdr, struct nl_pstate *npt) 763 { 764 int error; 765 struct nl_parsed_addrule attrs = {}; 766 767 attrs.rule = pf_krule_alloc(); 768 769 error = nl_parse_nlmsg(hdr, &addrule_parser, npt, &attrs); 770 if (error != 0) { 771 pf_free_rule(attrs.rule); 772 return (error); 773 } 774 775 error = pf_ioctl_addrule(attrs.rule, attrs.ticket, attrs.pool_ticket, 776 attrs.anchor, attrs.anchor_call, nlp_get_cred(npt->nlp)->cr_uid, 777 hdr->nlmsg_pid); 778 779 return (error); 780 } 781 782 #define _OUT(_field) offsetof(struct pfioc_rule, _field) 783 static const struct nlattr_parser nla_p_getrules[] = { 784 { .type = PF_GR_ANCHOR, .off = _OUT(anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara }, 785 { .type = PF_GR_ACTION, .off = _OUT(rule.action), .cb = nlattr_get_uint8 }, 786 }; 787 #undef _OUT 788 NL_DECLARE_PARSER(getrules_parser, struct genlmsghdr, nlf_p_empty, nla_p_getrules); 789 790 static int 791 pf_handle_getrules(struct nlmsghdr *hdr, struct nl_pstate *npt) 792 { 793 struct pfioc_rule attrs = {}; 794 int error; 795 struct nl_writer *nw = npt->nw; 796 struct genlmsghdr *ghdr_new; 797 798 error = nl_parse_nlmsg(hdr, &getrules_parser, npt, &attrs); 799 if (error != 0) 800 return (error); 801 802 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 803 return (ENOMEM); 804 805 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 806 ghdr_new->cmd = PFNL_CMD_GETRULES; 807 ghdr_new->version = 0; 808 ghdr_new->reserved = 0; 809 810 error = pf_ioctl_getrules(&attrs); 811 if (error != 0) 812 goto out; 813 814 nlattr_add_u32(nw, PF_GR_NR, attrs.nr); 815 nlattr_add_u32(nw, PF_GR_TICKET, attrs.ticket); 816 817 if (!nlmsg_end(nw)) { 818 error = ENOMEM; 819 goto out; 820 } 821 822 return (0); 823 824 out: 825 nlmsg_abort(nw); 826 return (error); 827 } 828 829 struct nl_parsed_get_rule { 830 char anchor[MAXPATHLEN]; 831 uint8_t action; 832 uint32_t nr; 833 uint32_t ticket; 834 uint8_t clear; 835 }; 836 #define _OUT(_field) offsetof(struct nl_parsed_get_rule, _field) 837 static const struct nlattr_parser nla_p_getrule[] = { 838 { .type = PF_GR_ANCHOR, .off = _OUT(anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara }, 839 { .type = PF_GR_ACTION, .off = _OUT(action), .cb = nlattr_get_uint8 }, 840 { .type = PF_GR_NR, .off = _OUT(nr), .cb = nlattr_get_uint32 }, 841 { .type = PF_GR_TICKET, .off = _OUT(ticket), .cb = nlattr_get_uint32 }, 842 { .type = PF_GR_CLEAR, .off = _OUT(clear), .cb = nlattr_get_uint8 }, 843 }; 844 #undef _OUT 845 NL_DECLARE_PARSER(getrule_parser, struct genlmsghdr, nlf_p_empty, nla_p_getrule); 846 847 static int 848 pf_handle_getrule(struct nlmsghdr *hdr, struct nl_pstate *npt) 849 { 850 char anchor_call[MAXPATHLEN]; 851 struct nl_parsed_get_rule attrs = {}; 852 struct nl_writer *nw = npt->nw; 853 struct genlmsghdr *ghdr_new; 854 struct pf_kruleset *ruleset; 855 struct pf_krule *rule; 856 int rs_num; 857 int error; 858 859 error = nl_parse_nlmsg(hdr, &getrule_parser, npt, &attrs); 860 if (error != 0) 861 return (error); 862 863 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 864 return (ENOMEM); 865 866 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 867 ghdr_new->cmd = PFNL_CMD_GETRULE; 868 ghdr_new->version = 0; 869 ghdr_new->reserved = 0; 870 871 PF_RULES_WLOCK(); 872 ruleset = pf_find_kruleset(attrs.anchor); 873 if (ruleset == NULL) { 874 PF_RULES_WUNLOCK(); 875 error = ENOENT; 876 goto out; 877 } 878 879 rs_num = pf_get_ruleset_number(attrs.action); 880 if (rs_num >= PF_RULESET_MAX) { 881 PF_RULES_WUNLOCK(); 882 error = EINVAL; 883 goto out; 884 } 885 886 if (attrs.ticket != ruleset->rules[rs_num].active.ticket) { 887 PF_RULES_WUNLOCK(); 888 error = EBUSY; 889 goto out; 890 } 891 892 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 893 while ((rule != NULL) && (rule->nr != attrs.nr)) 894 rule = TAILQ_NEXT(rule, entries); 895 if (rule == NULL) { 896 PF_RULES_WUNLOCK(); 897 error = EBUSY; 898 goto out; 899 } 900 901 nlattr_add_rule_addr(nw, PF_RT_SRC, &rule->src); 902 nlattr_add_rule_addr(nw, PF_RT_DST, &rule->dst); 903 nlattr_add_u32(nw, PF_RT_RIDENTIFIER, rule->ridentifier); 904 nlattr_add_labels(nw, PF_RT_LABELS, rule); 905 nlattr_add_string(nw, PF_RT_IFNAME, rule->ifname); 906 nlattr_add_string(nw, PF_RT_QNAME, rule->qname); 907 nlattr_add_string(nw, PF_RT_PQNAME, rule->pqname); 908 nlattr_add_string(nw, PF_RT_TAGNAME, rule->tagname); 909 nlattr_add_string(nw, PF_RT_MATCH_TAGNAME, rule->match_tagname); 910 nlattr_add_string(nw, PF_RT_OVERLOAD_TBLNAME, rule->overload_tblname); 911 nlattr_add_pool(nw, PF_RT_RPOOL_RDR, &rule->rdr); 912 nlattr_add_pool(nw, PF_RT_RPOOL_NAT, &rule->nat); 913 nlattr_add_pool(nw, PF_RT_RPOOL_RT, &rule->route); 914 nlattr_add_u32(nw, PF_RT_OS_FINGERPRINT, rule->os_fingerprint); 915 nlattr_add_u32(nw, PF_RT_RTABLEID, rule->rtableid); 916 nlattr_add_timeout(nw, PF_RT_TIMEOUT, rule->timeout); 917 nlattr_add_u32(nw, PF_RT_MAX_STATES, rule->max_states); 918 nlattr_add_u32(nw, PF_RT_MAX_SRC_NODES, rule->max_src_nodes); 919 nlattr_add_u32(nw, PF_RT_MAX_SRC_STATES, rule->max_src_states); 920 nlattr_add_u32(nw, PF_RT_MAX_SRC_CONN, rule->max_src_conn); 921 nlattr_add_u32(nw, PF_RT_MAX_SRC_CONN_RATE_LIMIT, rule->max_src_conn_rate.limit); 922 nlattr_add_u32(nw, PF_RT_MAX_SRC_CONN_RATE_SECS, rule->max_src_conn_rate.seconds); 923 924 nlattr_add_u16(nw, PF_RT_DNPIPE, rule->dnpipe); 925 nlattr_add_u16(nw, PF_RT_DNRPIPE, rule->dnrpipe); 926 nlattr_add_u32(nw, PF_RT_DNFLAGS, rule->free_flags); 927 928 nlattr_add_u32(nw, PF_RT_NR, rule->nr); 929 nlattr_add_u32(nw, PF_RT_PROB, rule->prob); 930 nlattr_add_u32(nw, PF_RT_CUID, rule->cuid); 931 nlattr_add_u32(nw, PF_RT_CPID, rule->cpid); 932 933 nlattr_add_u16(nw, PF_RT_RETURN_ICMP, rule->return_icmp); 934 nlattr_add_u16(nw, PF_RT_RETURN_ICMP6, rule->return_icmp6); 935 nlattr_add_u16(nw, PF_RT_RETURN_ICMP6, rule->return_icmp6); 936 nlattr_add_u16(nw, PF_RT_MAX_MSS, rule->max_mss); 937 nlattr_add_u16(nw, PF_RT_SCRUB_FLAGS, rule->scrub_flags); 938 939 nlattr_add_rule_uid(nw, PF_RT_UID, &rule->uid); 940 nlattr_add_rule_uid(nw, PF_RT_GID, (const struct pf_rule_uid *)&rule->gid); 941 942 nlattr_add_string(nw, PF_RT_RCV_IFNAME, rule->rcv_ifname); 943 944 nlattr_add_u32(nw, PF_RT_RULE_FLAG, rule->rule_flag); 945 nlattr_add_u8(nw, PF_RT_ACTION, rule->action); 946 nlattr_add_u8(nw, PF_RT_DIRECTION, rule->direction); 947 nlattr_add_u8(nw, PF_RT_LOG, rule->log); 948 nlattr_add_u8(nw, PF_RT_LOGIF, rule->logif); 949 nlattr_add_u8(nw, PF_RT_QUICK, rule->quick); 950 nlattr_add_u8(nw, PF_RT_IF_NOT, rule->ifnot); 951 nlattr_add_u8(nw, PF_RT_MATCH_TAG_NOT, rule->match_tag_not); 952 nlattr_add_u8(nw, PF_RT_NATPASS, rule->natpass); 953 nlattr_add_u8(nw, PF_RT_KEEP_STATE, rule->keep_state); 954 955 nlattr_add_u8(nw, PF_RT_AF, rule->af); 956 nlattr_add_u8(nw, PF_RT_NAF, rule->naf); 957 nlattr_add_u8(nw, PF_RT_PROTO, rule->proto); 958 nlattr_add_u8(nw, PF_RT_TYPE, rule->type); 959 nlattr_add_u8(nw, PF_RT_CODE, rule->code); 960 nlattr_add_u8(nw, PF_RT_FLAGS, rule->flags); 961 nlattr_add_u8(nw, PF_RT_FLAGSET, rule->flagset); 962 nlattr_add_u8(nw, PF_RT_MIN_TTL, rule->min_ttl); 963 nlattr_add_u8(nw, PF_RT_ALLOW_OPTS, rule->allow_opts); 964 nlattr_add_u8(nw, PF_RT_RT, rule->rt); 965 nlattr_add_u8(nw, PF_RT_RETURN_TTL, rule->return_ttl); 966 nlattr_add_u8(nw, PF_RT_TOS, rule->tos); 967 nlattr_add_u8(nw, PF_RT_SET_TOS, rule->set_tos); 968 nlattr_add_u8(nw, PF_RT_ANCHOR_RELATIVE, rule->anchor_relative); 969 nlattr_add_u8(nw, PF_RT_ANCHOR_WILDCARD, rule->anchor_wildcard); 970 nlattr_add_u8(nw, PF_RT_FLUSH, rule->flush); 971 nlattr_add_u8(nw, PF_RT_PRIO, rule->prio); 972 nlattr_add_u8(nw, PF_RT_SET_PRIO, rule->set_prio[0]); 973 nlattr_add_u8(nw, PF_RT_SET_PRIO_REPLY, rule->set_prio[1]); 974 975 nlattr_add_in6_addr(nw, PF_RT_DIVERT_ADDRESS, &rule->divert.addr.v6); 976 nlattr_add_u16(nw, PF_RT_DIVERT_PORT, rule->divert.port); 977 978 nlattr_add_u64(nw, PF_RT_PACKETS_IN, pf_counter_u64_fetch(&rule->packets[0])); 979 nlattr_add_u64(nw, PF_RT_PACKETS_OUT, pf_counter_u64_fetch(&rule->packets[1])); 980 nlattr_add_u64(nw, PF_RT_BYTES_IN, pf_counter_u64_fetch(&rule->bytes[0])); 981 nlattr_add_u64(nw, PF_RT_BYTES_OUT, pf_counter_u64_fetch(&rule->bytes[1])); 982 nlattr_add_u64(nw, PF_RT_EVALUATIONS, pf_counter_u64_fetch(&rule->evaluations)); 983 nlattr_add_u64(nw, PF_RT_TIMESTAMP, pf_get_timestamp(rule)); 984 nlattr_add_u64(nw, PF_RT_STATES_CUR, counter_u64_fetch(rule->states_cur)); 985 nlattr_add_u64(nw, PF_RT_STATES_TOTAL, counter_u64_fetch(rule->states_tot)); 986 nlattr_add_u64(nw, PF_RT_SRC_NODES, counter_u64_fetch(rule->src_nodes)); 987 988 error = pf_kanchor_copyout(ruleset, rule, anchor_call, sizeof(anchor_call)); 989 MPASS(error == 0); 990 991 nlattr_add_string(nw, PF_RT_ANCHOR_CALL, anchor_call); 992 993 if (attrs.clear) 994 pf_krule_clear_counters(rule); 995 996 PF_RULES_WUNLOCK(); 997 998 if (!nlmsg_end(nw)) { 999 error = ENOMEM; 1000 goto out; 1001 } 1002 1003 return (0); 1004 out: 1005 nlmsg_abort(nw); 1006 return (error); 1007 } 1008 1009 #define _OUT(_field) offsetof(struct pf_kstate_kill, _field) 1010 static const struct nlattr_parser nla_p_clear_states[] = { 1011 { .type = PF_CS_CMP_ID, .off = _OUT(psk_pfcmp.id), .cb = nlattr_get_uint64 }, 1012 { .type = PF_CS_CMP_CREATORID, .off = _OUT(psk_pfcmp.creatorid), .cb = nlattr_get_uint32 }, 1013 { .type = PF_CS_CMP_DIR, .off = _OUT(psk_pfcmp.direction), .cb = nlattr_get_uint8 }, 1014 { .type = PF_CS_AF, .off = _OUT(psk_af), .cb = nlattr_get_uint8 }, 1015 { .type = PF_CS_PROTO, .off = _OUT(psk_proto), .cb = nlattr_get_uint8 }, 1016 { .type = PF_CS_SRC, .off = _OUT(psk_src), .arg = &rule_addr_parser, .cb = nlattr_get_nested }, 1017 { .type = PF_CS_DST, .off = _OUT(psk_dst), .arg = &rule_addr_parser, .cb = nlattr_get_nested }, 1018 { .type = PF_CS_RT_ADDR, .off = _OUT(psk_rt_addr), .arg = &rule_addr_parser, .cb = nlattr_get_nested }, 1019 { .type = PF_CS_IFNAME, .off = _OUT(psk_ifname), .arg = (void *)IFNAMSIZ, .cb = nlattr_get_chara }, 1020 { .type = PF_CS_LABEL, .off = _OUT(psk_label), .arg = (void *)PF_RULE_LABEL_SIZE, .cb = nlattr_get_chara }, 1021 { .type = PF_CS_KILL_MATCH, .off = _OUT(psk_kill_match), .cb = nlattr_get_bool }, 1022 { .type = PF_CS_NAT, .off = _OUT(psk_nat), .cb = nlattr_get_bool }, 1023 }; 1024 #undef _OUT 1025 NL_DECLARE_PARSER(clear_states_parser, struct genlmsghdr, nlf_p_empty, nla_p_clear_states); 1026 1027 static int 1028 pf_handle_killclear_states(struct nlmsghdr *hdr, struct nl_pstate *npt, int cmd) 1029 { 1030 struct pf_kstate_kill kill = {}; 1031 struct epoch_tracker et; 1032 struct nl_writer *nw = npt->nw; 1033 struct genlmsghdr *ghdr_new; 1034 int error; 1035 unsigned int killed = 0; 1036 1037 error = nl_parse_nlmsg(hdr, &clear_states_parser, npt, &kill); 1038 if (error != 0) 1039 return (error); 1040 1041 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 1042 return (ENOMEM); 1043 1044 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1045 ghdr_new->cmd = cmd; 1046 ghdr_new->version = 0; 1047 ghdr_new->reserved = 0; 1048 1049 NET_EPOCH_ENTER(et); 1050 if (cmd == PFNL_CMD_KILLSTATES) 1051 pf_killstates(&kill, &killed); 1052 else 1053 killed = pf_clear_states(&kill); 1054 NET_EPOCH_EXIT(et); 1055 1056 nlattr_add_u32(nw, PF_CS_KILLED, killed); 1057 1058 if (! nlmsg_end(nw)) { 1059 error = ENOMEM; 1060 goto out; 1061 } 1062 1063 return (0); 1064 1065 out: 1066 nlmsg_abort(nw); 1067 return (error); 1068 } 1069 1070 static int 1071 pf_handle_clear_states(struct nlmsghdr *hdr, struct nl_pstate *npt) 1072 { 1073 return (pf_handle_killclear_states(hdr, npt, PFNL_CMD_CLRSTATES)); 1074 } 1075 1076 static int 1077 pf_handle_kill_states(struct nlmsghdr *hdr, struct nl_pstate *npt) 1078 { 1079 return (pf_handle_killclear_states(hdr, npt, PFNL_CMD_KILLSTATES)); 1080 } 1081 1082 struct nl_parsed_set_statusif { 1083 char ifname[IFNAMSIZ]; 1084 }; 1085 #define _OUT(_field) offsetof(struct nl_parsed_set_statusif, _field) 1086 static const struct nlattr_parser nla_p_set_statusif[] = { 1087 { .type = PF_SS_IFNAME, .off = _OUT(ifname), .arg = (const void *)IFNAMSIZ, .cb = nlattr_get_chara }, 1088 }; 1089 #undef _OUT 1090 NL_DECLARE_PARSER(set_statusif_parser, struct genlmsghdr, nlf_p_empty, nla_p_set_statusif); 1091 1092 static int 1093 pf_handle_set_statusif(struct nlmsghdr *hdr, struct nl_pstate *npt) 1094 { 1095 int error; 1096 struct nl_parsed_set_statusif attrs = {}; 1097 1098 error = nl_parse_nlmsg(hdr, &set_statusif_parser, npt, &attrs); 1099 if (error != 0) 1100 return (error); 1101 1102 PF_RULES_WLOCK(); 1103 strlcpy(V_pf_status.ifname, attrs.ifname, IFNAMSIZ); 1104 PF_RULES_WUNLOCK(); 1105 1106 return (0); 1107 } 1108 1109 static bool 1110 nlattr_add_counters(struct nl_writer *nw, int attr, size_t number, char **names, 1111 counter_u64_t *counters) 1112 { 1113 for (int i = 0; i < number; i++) { 1114 int off = nlattr_add_nested(nw, attr); 1115 nlattr_add_u32(nw, PF_C_ID, i); 1116 nlattr_add_string(nw, PF_C_NAME, names[i]); 1117 nlattr_add_u64(nw, PF_C_COUNTER, counter_u64_fetch(counters[i])); 1118 nlattr_set_len(nw, off); 1119 } 1120 1121 return (true); 1122 } 1123 1124 static bool 1125 nlattr_add_fcounters(struct nl_writer *nw, int attr, size_t number, char **names, 1126 struct pf_counter_u64 *counters) 1127 { 1128 for (int i = 0; i < number; i++) { 1129 int off = nlattr_add_nested(nw, attr); 1130 nlattr_add_u32(nw, PF_C_ID, i); 1131 nlattr_add_string(nw, PF_C_NAME, names[i]); 1132 nlattr_add_u64(nw, PF_C_COUNTER, pf_counter_u64_fetch(&counters[i])); 1133 nlattr_set_len(nw, off); 1134 } 1135 1136 return (true); 1137 } 1138 1139 static bool 1140 nlattr_add_u64_array(struct nl_writer *nw, int attr, size_t number, uint64_t *array) 1141 { 1142 int off = nlattr_add_nested(nw, attr); 1143 1144 for (size_t i = 0; i < number; i++) 1145 nlattr_add_u64(nw, 0, array[i]); 1146 1147 nlattr_set_len(nw, off); 1148 1149 return (true); 1150 } 1151 1152 static int 1153 pf_handle_get_status(struct nlmsghdr *hdr, struct nl_pstate *npt) 1154 { 1155 struct pf_status s; 1156 struct nl_writer *nw = npt->nw; 1157 struct genlmsghdr *ghdr_new; 1158 char *pf_reasons[PFRES_MAX+1] = PFRES_NAMES; 1159 char *pf_lcounter[KLCNT_MAX+1] = KLCNT_NAMES; 1160 char *pf_fcounter[FCNT_MAX+1] = FCNT_NAMES; 1161 int error; 1162 1163 PF_RULES_RLOCK_TRACKER; 1164 1165 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 1166 return (ENOMEM); 1167 1168 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1169 ghdr_new->cmd = PFNL_CMD_GET_STATUS; 1170 ghdr_new->version = 0; 1171 ghdr_new->reserved = 0; 1172 1173 PF_RULES_RLOCK(); 1174 1175 nlattr_add_string(nw, PF_GS_IFNAME, V_pf_status.ifname); 1176 nlattr_add_bool(nw, PF_GS_RUNNING, V_pf_status.running); 1177 nlattr_add_u32(nw, PF_GS_SINCE, V_pf_status.since); 1178 nlattr_add_u32(nw, PF_GS_DEBUG, V_pf_status.debug); 1179 nlattr_add_u32(nw, PF_GS_HOSTID, ntohl(V_pf_status.hostid)); 1180 nlattr_add_u32(nw, PF_GS_STATES, V_pf_status.states); 1181 nlattr_add_u32(nw, PF_GS_SRC_NODES, V_pf_status.src_nodes); 1182 nlattr_add_u32(nw, PF_GS_REASSEMBLE, V_pf_status.reass); 1183 nlattr_add_u32(nw, PF_GS_SYNCOOKIES_ACTIVE, V_pf_status.syncookies_active); 1184 1185 nlattr_add_counters(nw, PF_GS_COUNTERS, PFRES_MAX, pf_reasons, 1186 V_pf_status.counters); 1187 nlattr_add_counters(nw, PF_GS_LCOUNTERS, KLCNT_MAX, pf_lcounter, 1188 V_pf_status.lcounters); 1189 nlattr_add_fcounters(nw, PF_GS_FCOUNTERS, FCNT_MAX, pf_fcounter, 1190 V_pf_status.fcounters); 1191 nlattr_add_counters(nw, PF_GS_SCOUNTERS, SCNT_MAX, pf_fcounter, 1192 V_pf_status.scounters); 1193 1194 pfi_update_status(V_pf_status.ifname, &s); 1195 nlattr_add_u64_array(nw, PF_GS_BCOUNTERS, 2 * 2, (uint64_t *)s.bcounters); 1196 nlattr_add_u64_array(nw, PF_GS_PCOUNTERS, 2 * 2 * 2, (uint64_t *)s.pcounters); 1197 1198 nlattr_add(nw, PF_GS_CHKSUM, PF_MD5_DIGEST_LENGTH, V_pf_status.pf_chksum); 1199 1200 PF_RULES_RUNLOCK(); 1201 1202 if (!nlmsg_end(nw)) { 1203 error = ENOMEM; 1204 goto out; 1205 } 1206 1207 return (0); 1208 1209 out: 1210 nlmsg_abort(nw); 1211 return (error); 1212 } 1213 1214 static int 1215 pf_handle_clear_status(struct nlmsghdr *hdr, struct nl_pstate *npt) 1216 { 1217 pf_ioctl_clear_status(); 1218 1219 return (0); 1220 } 1221 1222 struct pf_nl_natlook { 1223 sa_family_t af; 1224 uint8_t direction; 1225 uint8_t proto; 1226 struct pf_addr src; 1227 struct pf_addr dst; 1228 uint16_t sport; 1229 uint16_t dport; 1230 }; 1231 1232 #define _OUT(_field) offsetof(struct pf_nl_natlook, _field) 1233 static const struct nlattr_parser nla_p_natlook[] = { 1234 { .type = PF_NL_AF, .off = _OUT(af), .cb = nlattr_get_uint8 }, 1235 { .type = PF_NL_DIRECTION, .off = _OUT(direction), .cb = nlattr_get_uint8 }, 1236 { .type = PF_NL_PROTO, .off = _OUT(proto), .cb = nlattr_get_uint8 }, 1237 { .type = PF_NL_SRC_ADDR, .off = _OUT(src), .cb = nlattr_get_in6_addr }, 1238 { .type = PF_NL_DST_ADDR, .off = _OUT(dst), .cb = nlattr_get_in6_addr }, 1239 { .type = PF_NL_SRC_PORT, .off = _OUT(sport), .cb = nlattr_get_uint16 }, 1240 { .type = PF_NL_DST_PORT, .off = _OUT(dport), .cb = nlattr_get_uint16 }, 1241 }; 1242 #undef _OUT 1243 NL_DECLARE_PARSER(natlook_parser, struct genlmsghdr, nlf_p_empty, nla_p_natlook); 1244 1245 static int 1246 pf_handle_natlook(struct nlmsghdr *hdr, struct nl_pstate *npt) 1247 { 1248 struct pf_nl_natlook attrs = {}; 1249 struct pf_state_key_cmp key = {}; 1250 struct nl_writer *nw = npt->nw; 1251 struct pf_state_key *sk; 1252 struct pf_kstate *state; 1253 struct genlmsghdr *ghdr_new; 1254 int error, m = 0; 1255 int sidx, didx; 1256 1257 error = nl_parse_nlmsg(hdr, &natlook_parser, npt, &attrs); 1258 if (error != 0) 1259 return (error); 1260 1261 if (attrs.proto == 0 || 1262 PF_AZERO(&attrs.src, attrs.af) || 1263 PF_AZERO(&attrs.dst, attrs.af) || 1264 ((attrs.proto == IPPROTO_TCP || attrs.proto == IPPROTO_UDP) && 1265 (attrs.sport == 0 || attrs.dport == 0))) 1266 return (EINVAL); 1267 1268 /* NATLOOK src and dst are reversed, so reverse sidx/didx */ 1269 sidx = (attrs.direction == PF_IN) ? 1 : 0; 1270 didx = (attrs.direction == PF_IN) ? 0 : 1; 1271 1272 key.af = attrs.af; 1273 key.proto = attrs.proto; 1274 PF_ACPY(&key.addr[sidx], &attrs.src, attrs.af); 1275 key.port[sidx] = attrs.sport; 1276 PF_ACPY(&key.addr[didx], &attrs.dst, attrs.af); 1277 key.port[didx] = attrs.dport; 1278 1279 state = pf_find_state_all(&key, attrs.direction, &m); 1280 if (state == NULL) 1281 return (ENOENT); 1282 if (m > 1) { 1283 PF_STATE_UNLOCK(state); 1284 return (E2BIG); 1285 } 1286 1287 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) { 1288 PF_STATE_UNLOCK(state); 1289 return (ENOMEM); 1290 } 1291 1292 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1293 ghdr_new->cmd = PFNL_CMD_NATLOOK; 1294 ghdr_new->version = 0; 1295 ghdr_new->reserved = 0; 1296 1297 sk = state->key[sidx]; 1298 1299 nlattr_add_in6_addr(nw, PF_NL_SRC_ADDR, &sk->addr[sidx].v6); 1300 nlattr_add_in6_addr(nw, PF_NL_DST_ADDR, &sk->addr[didx].v6); 1301 nlattr_add_u16(nw, PF_NL_SRC_PORT, sk->port[sidx]); 1302 nlattr_add_u16(nw, PF_NL_DST_PORT, sk->port[didx]); 1303 1304 PF_STATE_UNLOCK(state); 1305 1306 if (!nlmsg_end(nw)) { 1307 nlmsg_abort(nw); 1308 return (ENOMEM); 1309 } 1310 1311 return (0); 1312 } 1313 1314 struct pf_nl_set_debug 1315 { 1316 uint32_t level; 1317 }; 1318 #define _OUT(_field) offsetof(struct pf_nl_set_debug, _field) 1319 static const struct nlattr_parser nla_p_set_debug[] = { 1320 { .type = PF_SD_LEVEL, .off = _OUT(level), .cb = nlattr_get_uint32 }, 1321 }; 1322 #undef _OUT 1323 NL_DECLARE_PARSER(set_debug_parser, struct genlmsghdr, nlf_p_empty, nla_p_set_debug); 1324 1325 static int 1326 pf_handle_set_debug(struct nlmsghdr *hdr, struct nl_pstate *npt) 1327 { 1328 struct pf_nl_set_debug attrs = {}; 1329 int error; 1330 1331 error = nl_parse_nlmsg(hdr, &set_debug_parser, npt, &attrs); 1332 if (error != 0) 1333 return (error); 1334 1335 PF_RULES_WLOCK(); 1336 V_pf_status.debug = attrs.level; 1337 PF_RULES_WUNLOCK(); 1338 1339 return (0); 1340 } 1341 1342 struct pf_nl_set_timeout 1343 { 1344 uint32_t timeout; 1345 uint32_t seconds; 1346 }; 1347 #define _OUT(_field) offsetof(struct pf_nl_set_timeout, _field) 1348 static const struct nlattr_parser nla_p_set_timeout[] = { 1349 { .type = PF_TO_TIMEOUT, .off = _OUT(timeout), .cb = nlattr_get_uint32 }, 1350 { .type = PF_TO_SECONDS, .off = _OUT(seconds), .cb = nlattr_get_uint32 }, 1351 }; 1352 #undef _OUT 1353 NL_DECLARE_PARSER(set_timeout_parser, struct genlmsghdr, nlf_p_empty, nla_p_set_timeout); 1354 1355 static int 1356 pf_handle_set_timeout(struct nlmsghdr *hdr, struct nl_pstate *npt) 1357 { 1358 struct pf_nl_set_timeout attrs = {}; 1359 int error; 1360 1361 error = nl_parse_nlmsg(hdr, &set_timeout_parser, npt, &attrs); 1362 if (error != 0) 1363 return (error); 1364 1365 return (pf_ioctl_set_timeout(attrs.timeout, attrs.seconds, NULL)); 1366 } 1367 1368 static int 1369 pf_handle_get_timeout(struct nlmsghdr *hdr, struct nl_pstate *npt) 1370 { 1371 struct pf_nl_set_timeout attrs = {}; 1372 struct nl_writer *nw = npt->nw; 1373 struct genlmsghdr *ghdr_new; 1374 int error; 1375 1376 error = nl_parse_nlmsg(hdr, &set_timeout_parser, npt, &attrs); 1377 if (error != 0) 1378 return (error); 1379 1380 error = pf_ioctl_get_timeout(attrs.timeout, &attrs.seconds); 1381 if (error != 0) 1382 return (error); 1383 1384 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 1385 return (ENOMEM); 1386 1387 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1388 ghdr_new->cmd = PFNL_CMD_GET_TIMEOUT; 1389 ghdr_new->version = 0; 1390 ghdr_new->reserved = 0; 1391 1392 nlattr_add_u32(nw, PF_TO_SECONDS, attrs.seconds); 1393 1394 if (!nlmsg_end(nw)) { 1395 nlmsg_abort(nw); 1396 return (ENOMEM); 1397 } 1398 1399 return (0); 1400 } 1401 1402 struct pf_nl_set_limit 1403 { 1404 uint32_t index; 1405 uint32_t limit; 1406 }; 1407 #define _OUT(_field) offsetof(struct pf_nl_set_limit, _field) 1408 static const struct nlattr_parser nla_p_set_limit[] = { 1409 { .type = PF_LI_INDEX, .off = _OUT(index), .cb = nlattr_get_uint32 }, 1410 { .type = PF_LI_LIMIT, .off = _OUT(limit), .cb = nlattr_get_uint32 }, 1411 }; 1412 #undef _OUT 1413 NL_DECLARE_PARSER(set_limit_parser, struct genlmsghdr, nlf_p_empty, nla_p_set_limit); 1414 1415 static int 1416 pf_handle_set_limit(struct nlmsghdr *hdr, struct nl_pstate *npt) 1417 { 1418 struct pf_nl_set_limit attrs = {}; 1419 int error; 1420 1421 error = nl_parse_nlmsg(hdr, &set_limit_parser, npt, &attrs); 1422 if (error != 0) 1423 return (error); 1424 1425 return (pf_ioctl_set_limit(attrs.index, attrs.limit, NULL)); 1426 } 1427 1428 static int 1429 pf_handle_get_limit(struct nlmsghdr *hdr, struct nl_pstate *npt) 1430 { 1431 struct pf_nl_set_limit attrs = {}; 1432 struct nl_writer *nw = npt->nw; 1433 struct genlmsghdr *ghdr_new; 1434 int error; 1435 1436 error = nl_parse_nlmsg(hdr, &set_limit_parser, npt, &attrs); 1437 if (error != 0) 1438 return (error); 1439 1440 error = pf_ioctl_get_limit(attrs.index, &attrs.limit); 1441 if (error != 0) 1442 return (error); 1443 1444 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 1445 return (ENOMEM); 1446 1447 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1448 ghdr_new->cmd = PFNL_CMD_GET_LIMIT; 1449 ghdr_new->version = 0; 1450 ghdr_new->reserved = 0; 1451 1452 nlattr_add_u32(nw, PF_LI_LIMIT, attrs.limit); 1453 1454 if (!nlmsg_end(nw)) { 1455 nlmsg_abort(nw); 1456 return (ENOMEM); 1457 } 1458 1459 return (0); 1460 } 1461 1462 static int 1463 pf_handle_begin_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt) 1464 { 1465 struct nl_writer *nw = npt->nw; 1466 struct genlmsghdr *ghdr_new; 1467 uint32_t ticket; 1468 int error; 1469 1470 error = pf_ioctl_begin_addrs(&ticket); 1471 if (error != 0) 1472 return (error); 1473 1474 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 1475 return (ENOMEM); 1476 1477 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1478 ghdr_new->cmd = PFNL_CMD_BEGIN_ADDRS; 1479 ghdr_new->version = 0; 1480 ghdr_new->reserved = 0; 1481 1482 nlattr_add_u32(nw, PF_BA_TICKET, ticket); 1483 1484 if (!nlmsg_end(nw)) { 1485 nlmsg_abort(nw); 1486 return (ENOMEM); 1487 } 1488 1489 return (0); 1490 } 1491 1492 static bool 1493 nlattr_add_pool_addr(struct nl_writer *nw, int attrtype, struct pf_pooladdr *a) 1494 { 1495 int off; 1496 1497 off = nlattr_add_nested(nw, attrtype); 1498 1499 nlattr_add_addr_wrap(nw, PF_PA_ADDR, &a->addr); 1500 nlattr_add_string(nw, PF_PA_IFNAME, a->ifname); 1501 1502 nlattr_set_len(nw, off); 1503 1504 return (true); 1505 } 1506 1507 #define _OUT(_field) offsetof(struct pf_pooladdr, _field) 1508 static const struct nlattr_parser nla_p_pool_addr[] = { 1509 { .type = PF_PA_ADDR, .off = _OUT(addr), .arg = &addr_wrap_parser, .cb = nlattr_get_nested }, 1510 { .type = PF_PA_IFNAME, .off = _OUT(ifname), .arg = (void *)IFNAMSIZ, .cb = nlattr_get_chara }, 1511 }; 1512 NL_DECLARE_ATTR_PARSER(pool_addr_parser, nla_p_pool_addr); 1513 #undef _OUT 1514 1515 #define _OUT(_field) offsetof(struct pf_nl_pooladdr, _field) 1516 static const struct nlattr_parser nla_p_add_addr[] = { 1517 { .type = PF_AA_ACTION, .off = _OUT(action), .cb = nlattr_get_uint32 }, 1518 { .type = PF_AA_TICKET, .off = _OUT(ticket), .cb = nlattr_get_uint32 }, 1519 { .type = PF_AA_NR, .off = _OUT(nr), .cb = nlattr_get_uint32 }, 1520 { .type = PF_AA_R_NUM, .off = _OUT(r_num), .cb = nlattr_get_uint32 }, 1521 { .type = PF_AA_R_ACTION, .off = _OUT(r_action), .cb = nlattr_get_uint8 }, 1522 { .type = PF_AA_R_LAST, .off = _OUT(r_last), .cb = nlattr_get_uint8 }, 1523 { .type = PF_AA_AF, .off = _OUT(af), .cb = nlattr_get_uint8 }, 1524 { .type = PF_AA_ANCHOR, .off = _OUT(anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara }, 1525 { .type = PF_AA_ADDR, .off = _OUT(addr), .arg = &pool_addr_parser, .cb = nlattr_get_nested }, 1526 { .type = PF_AA_WHICH, .off = _OUT(which), .cb = nlattr_get_uint32 }, 1527 }; 1528 #undef _OUT 1529 NL_DECLARE_PARSER(add_addr_parser, struct genlmsghdr, nlf_p_empty, nla_p_add_addr); 1530 1531 static int 1532 pf_handle_add_addr(struct nlmsghdr *hdr, struct nl_pstate *npt) 1533 { 1534 struct pf_nl_pooladdr attrs = { 0 }; 1535 int error; 1536 1537 error = nl_parse_nlmsg(hdr, &add_addr_parser, npt, &attrs); 1538 if (error != 0) 1539 return (error); 1540 1541 if (attrs.which == 0) 1542 attrs.which = PF_RDR; 1543 1544 error = pf_ioctl_add_addr(&attrs); 1545 1546 return (error); 1547 } 1548 1549 static int 1550 pf_handle_get_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt) 1551 { 1552 struct pf_nl_pooladdr attrs = { 0 }; 1553 struct nl_writer *nw = npt->nw; 1554 struct genlmsghdr *ghdr_new; 1555 int error; 1556 1557 error = nl_parse_nlmsg(hdr, &add_addr_parser, npt, &attrs); 1558 if (error != 0) 1559 return (error); 1560 1561 if (attrs.which == 0) 1562 attrs.which = PF_RDR; 1563 1564 error = pf_ioctl_get_addrs(&attrs); 1565 if (error != 0) 1566 return (error); 1567 1568 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 1569 return (ENOMEM); 1570 1571 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1572 ghdr_new->cmd = PFNL_CMD_GET_ADDRS; 1573 ghdr_new->version = 0; 1574 ghdr_new->reserved = 0; 1575 1576 nlattr_add_u32(nw, PF_AA_NR, attrs.nr); 1577 1578 if (!nlmsg_end(nw)) { 1579 nlmsg_abort(nw); 1580 return (ENOMEM); 1581 } 1582 1583 return (error); 1584 } 1585 1586 static int 1587 pf_handle_get_addr(struct nlmsghdr *hdr, struct nl_pstate *npt) 1588 { 1589 struct pf_nl_pooladdr attrs = { 0 }; 1590 struct nl_writer *nw = npt->nw; 1591 struct genlmsghdr *ghdr_new; 1592 int error; 1593 1594 error = nl_parse_nlmsg(hdr, &add_addr_parser, npt, &attrs); 1595 if (error != 0) 1596 return (error); 1597 1598 if (attrs.which == 0) 1599 attrs.which = PF_RDR; 1600 1601 error = pf_ioctl_get_addr(&attrs); 1602 if (error != 0) 1603 return (error); 1604 1605 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 1606 return (ENOMEM); 1607 1608 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1609 ghdr_new->cmd = PFNL_CMD_GET_ADDR; 1610 ghdr_new->version = 0; 1611 ghdr_new->reserved = 0; 1612 1613 nlattr_add_u32(nw, PF_AA_ACTION, attrs.action); 1614 nlattr_add_u32(nw, PF_AA_TICKET, attrs.ticket); 1615 nlattr_add_u32(nw, PF_AA_NR, attrs.nr); 1616 nlattr_add_u32(nw, PF_AA_R_NUM, attrs.r_num); 1617 nlattr_add_u8(nw, PF_AA_R_ACTION, attrs.r_action); 1618 nlattr_add_u8(nw, PF_AA_R_LAST, attrs.r_last); 1619 nlattr_add_u8(nw, PF_AA_AF, attrs.af); 1620 nlattr_add_string(nw, PF_AA_ANCHOR, attrs.anchor); 1621 nlattr_add_pool_addr(nw, PF_AA_ADDR, &attrs.addr); 1622 1623 if (!nlmsg_end(nw)) { 1624 nlmsg_abort(nw); 1625 return (ENOMEM); 1626 } 1627 1628 return (0); 1629 } 1630 1631 #define _OUT(_field) offsetof(struct pfioc_ruleset, _field) 1632 static const struct nlattr_parser nla_p_ruleset[] = { 1633 { .type = PF_RS_PATH, .off = _OUT(path), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara }, 1634 { .type = PF_RS_NR, .off = _OUT(nr), .cb = nlattr_get_uint32 }, 1635 }; 1636 NL_DECLARE_PARSER(ruleset_parser, struct genlmsghdr, nlf_p_empty, nla_p_ruleset); 1637 #undef _OUT 1638 1639 static int 1640 pf_handle_get_rulesets(struct nlmsghdr *hdr, struct nl_pstate *npt) 1641 { 1642 struct pfioc_ruleset attrs = { 0 }; 1643 struct nl_writer *nw = npt->nw; 1644 struct genlmsghdr *ghdr_new; 1645 int error; 1646 1647 error = nl_parse_nlmsg(hdr, &ruleset_parser, npt, &attrs); 1648 if (error != 0) 1649 return (error); 1650 1651 error = pf_ioctl_get_rulesets(&attrs); 1652 if (error != 0) 1653 return (error); 1654 1655 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 1656 return (ENOMEM); 1657 1658 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1659 ghdr_new->cmd = PFNL_CMD_GET_RULESETS; 1660 ghdr_new->version = 0; 1661 ghdr_new->reserved = 0; 1662 1663 nlattr_add_u32(nw, PF_RS_NR, attrs.nr); 1664 1665 if (!nlmsg_end(nw)) { 1666 nlmsg_abort(nw); 1667 return (ENOMEM); 1668 } 1669 1670 return (0); 1671 } 1672 1673 static int 1674 pf_handle_get_ruleset(struct nlmsghdr *hdr, struct nl_pstate *npt) 1675 { 1676 struct pfioc_ruleset attrs = { 0 }; 1677 struct nl_writer *nw = npt->nw; 1678 struct genlmsghdr *ghdr_new; 1679 int error; 1680 1681 error = nl_parse_nlmsg(hdr, &ruleset_parser, npt, &attrs); 1682 if (error) 1683 return (error); 1684 1685 error = pf_ioctl_get_ruleset(&attrs); 1686 if (error != 0) 1687 return (error); 1688 1689 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 1690 return (ENOMEM); 1691 1692 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1693 ghdr_new->cmd = PFNL_CMD_GET_RULESET; 1694 ghdr_new->version = 0; 1695 ghdr_new->reserved = 0; 1696 1697 nlattr_add_string(nw, PF_RS_NAME, attrs.name); 1698 1699 if (!nlmsg_end(nw)) { 1700 nlmsg_abort(nw); 1701 return (ENOMEM); 1702 } 1703 1704 return (0); 1705 } 1706 1707 static bool 1708 nlattr_add_pf_threshold(struct nl_writer *nw, int attrtype, 1709 struct pf_threshold *t, int secs) 1710 { 1711 int off = nlattr_add_nested(nw, attrtype); 1712 int diff, conn_rate_count; 1713 1714 /* Adjust the connection rate estimate. */ 1715 conn_rate_count = t->count; 1716 diff = secs - t->last; 1717 if (diff >= t->seconds) 1718 conn_rate_count = 0; 1719 else 1720 conn_rate_count -= t->count * diff / t->seconds; 1721 1722 nlattr_add_u32(nw, PF_TH_LIMIT, t->limit); 1723 nlattr_add_u32(nw, PF_TH_SECONDS, t->seconds); 1724 nlattr_add_u32(nw, PF_TH_COUNT, conn_rate_count); 1725 nlattr_add_u32(nw, PF_TH_LAST, t->last); 1726 1727 nlattr_set_len(nw, off); 1728 1729 return (true); 1730 } 1731 1732 static int 1733 pf_handle_get_srcnodes(struct nlmsghdr *hdr, struct nl_pstate *npt) 1734 { 1735 struct nl_writer *nw = npt->nw; 1736 struct genlmsghdr *ghdr_new; 1737 struct pf_ksrc_node *n; 1738 struct pf_srchash *sh; 1739 int i; 1740 int secs; 1741 1742 hdr->nlmsg_flags |= NLM_F_MULTI; 1743 1744 for (i = 0, sh = V_pf_srchash; i <= V_pf_srchashmask; 1745 i++, sh++) { 1746 /* Avoid locking empty rows. */ 1747 if (LIST_EMPTY(&sh->nodes)) 1748 continue; 1749 1750 PF_HASHROW_LOCK(sh); 1751 secs = time_uptime; 1752 1753 LIST_FOREACH(n, &sh->nodes, entry) { 1754 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) { 1755 nlmsg_abort(nw); 1756 return (ENOMEM); 1757 } 1758 1759 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1760 ghdr_new->cmd = PFNL_CMD_GET_SRCNODES; 1761 ghdr_new->version = 0; 1762 ghdr_new->reserved = 0; 1763 1764 nlattr_add_in6_addr(nw, PF_SN_ADDR, &n->addr.v6); 1765 nlattr_add_in6_addr(nw, PF_SN_RADDR, &n->raddr.v6); 1766 nlattr_add_u32(nw, PF_SN_RULE_NR, n->rule->nr); 1767 nlattr_add_u64(nw, PF_SN_BYTES_IN, counter_u64_fetch(n->bytes[0])); 1768 nlattr_add_u64(nw, PF_SN_BYTES_OUT, counter_u64_fetch(n->bytes[1])); 1769 nlattr_add_u64(nw, PF_SN_PACKETS_IN, counter_u64_fetch(n->packets[0])); 1770 nlattr_add_u64(nw, PF_SN_PACKETS_OUT, counter_u64_fetch(n->packets[1])); 1771 nlattr_add_u32(nw, PF_SN_STATES, n->states); 1772 nlattr_add_u32(nw, PF_SN_CONNECTIONS, n->conn); 1773 nlattr_add_u8(nw, PF_SN_AF, n->af); 1774 nlattr_add_u8(nw, PF_SN_NAF, n->naf); 1775 nlattr_add_u8(nw, PF_SN_RULE_TYPE, n->ruletype); 1776 1777 nlattr_add_u64(nw, PF_SN_CREATION, secs - n->creation); 1778 if (n->expire > secs) 1779 nlattr_add_u64(nw, PF_SN_EXPIRE, n->expire - secs); 1780 else 1781 nlattr_add_u64(nw, PF_SN_EXPIRE, 0); 1782 1783 nlattr_add_pf_threshold(nw, PF_SN_CONNECTION_RATE, 1784 &n->conn_rate, secs); 1785 1786 if (!nlmsg_end(nw)) { 1787 PF_HASHROW_UNLOCK(sh); 1788 nlmsg_abort(nw); 1789 return (ENOMEM); 1790 } 1791 } 1792 PF_HASHROW_UNLOCK(sh); 1793 } 1794 1795 return (0); 1796 } 1797 1798 #define _OUT(_field) offsetof(struct pfioc_table, _field) 1799 static const struct nlattr_parser nla_p_table[] = { 1800 { .type = PF_T_ANCHOR, .off = _OUT(pfrio_table.pfrt_anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara }, 1801 { .type = PF_T_NAME, .off = _OUT(pfrio_table.pfrt_name), .arg = (void *)PF_TABLE_NAME_SIZE, .cb = nlattr_get_chara }, 1802 { .type = PF_T_TABLE_FLAGS, .off = _OUT(pfrio_table.pfrt_flags), .cb = nlattr_get_uint32 }, 1803 { .type = PF_T_FLAGS, .off = _OUT(pfrio_flags), .cb = nlattr_get_uint32 }, 1804 }; 1805 static const struct nlfield_parser nlf_p_table[] = {}; 1806 NL_DECLARE_PARSER(table_parser, struct genlmsghdr, nlf_p_table, nla_p_table); 1807 #undef _OUT 1808 static int 1809 pf_handle_clear_tables(struct nlmsghdr *hdr, struct nl_pstate *npt) 1810 { 1811 struct pfioc_table attrs = { 0 }; 1812 struct nl_writer *nw = npt->nw; 1813 struct genlmsghdr *ghdr_new; 1814 int ndel = 0; 1815 int error; 1816 1817 error = nl_parse_nlmsg(hdr, &table_parser, npt, &attrs); 1818 if (error != 0) 1819 return (error); 1820 1821 PF_RULES_WLOCK(); 1822 error = pfr_clr_tables(&attrs.pfrio_table, &ndel, attrs.pfrio_flags | PFR_FLAG_USERIOCTL); 1823 PF_RULES_WUNLOCK(); 1824 if (error != 0) 1825 return (error); 1826 1827 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 1828 return (ENOMEM); 1829 1830 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1831 ghdr_new->cmd = PFNL_CMD_CLEAR_TABLES; 1832 ghdr_new->version = 0; 1833 ghdr_new->reserved = 0; 1834 1835 nlattr_add_u32(nw, PF_T_NBR_DELETED, ndel); 1836 1837 if (!nlmsg_end(nw)) { 1838 nlmsg_abort(nw); 1839 return (ENOMEM); 1840 } 1841 1842 return (0); 1843 } 1844 1845 static const struct nlhdr_parser *all_parsers[] = { 1846 &state_parser, 1847 &addrule_parser, 1848 &getrules_parser, 1849 &clear_states_parser, 1850 &set_statusif_parser, 1851 &natlook_parser, 1852 &set_debug_parser, 1853 &set_timeout_parser, 1854 &set_limit_parser, 1855 &pool_addr_parser, 1856 &add_addr_parser, 1857 &ruleset_parser, 1858 &table_parser, 1859 }; 1860 1861 static int family_id; 1862 1863 static const struct genl_cmd pf_cmds[] = { 1864 { 1865 .cmd_num = PFNL_CMD_GETSTATES, 1866 .cmd_name = "GETSTATES", 1867 .cmd_cb = pf_handle_getstates, 1868 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1869 .cmd_priv = PRIV_NETINET_PF, 1870 }, 1871 { 1872 .cmd_num = PFNL_CMD_GETCREATORS, 1873 .cmd_name = "GETCREATORS", 1874 .cmd_cb = pf_handle_getcreators, 1875 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1876 .cmd_priv = PRIV_NETINET_PF, 1877 }, 1878 { 1879 .cmd_num = PFNL_CMD_START, 1880 .cmd_name = "START", 1881 .cmd_cb = pf_handle_start, 1882 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, 1883 .cmd_priv = PRIV_NETINET_PF, 1884 }, 1885 { 1886 .cmd_num = PFNL_CMD_STOP, 1887 .cmd_name = "STOP", 1888 .cmd_cb = pf_handle_stop, 1889 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, 1890 .cmd_priv = PRIV_NETINET_PF, 1891 }, 1892 { 1893 .cmd_num = PFNL_CMD_ADDRULE, 1894 .cmd_name = "ADDRULE", 1895 .cmd_cb = pf_handle_addrule, 1896 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1897 .cmd_priv = PRIV_NETINET_PF, 1898 }, 1899 { 1900 .cmd_num = PFNL_CMD_GETRULES, 1901 .cmd_name = "GETRULES", 1902 .cmd_cb = pf_handle_getrules, 1903 .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1904 .cmd_priv = PRIV_NETINET_PF, 1905 }, 1906 { 1907 .cmd_num = PFNL_CMD_GETRULE, 1908 .cmd_name = "GETRULE", 1909 .cmd_cb = pf_handle_getrule, 1910 .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1911 .cmd_priv = PRIV_NETINET_PF, 1912 }, 1913 { 1914 .cmd_num = PFNL_CMD_CLRSTATES, 1915 .cmd_name = "CLRSTATES", 1916 .cmd_cb = pf_handle_clear_states, 1917 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1918 .cmd_priv = PRIV_NETINET_PF, 1919 }, 1920 { 1921 .cmd_num = PFNL_CMD_KILLSTATES, 1922 .cmd_name = "KILLSTATES", 1923 .cmd_cb = pf_handle_kill_states, 1924 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1925 .cmd_priv = PRIV_NETINET_PF, 1926 }, 1927 { 1928 .cmd_num = PFNL_CMD_SET_STATUSIF, 1929 .cmd_name = "SETSTATUSIF", 1930 .cmd_cb = pf_handle_set_statusif, 1931 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, 1932 .cmd_priv = PRIV_NETINET_PF, 1933 }, 1934 { 1935 .cmd_num = PFNL_CMD_GET_STATUS, 1936 .cmd_name = "GETSTATUS", 1937 .cmd_cb = pf_handle_get_status, 1938 .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1939 .cmd_priv = PRIV_NETINET_PF, 1940 }, 1941 { 1942 .cmd_num = PFNL_CMD_CLEAR_STATUS, 1943 .cmd_name = "CLEARSTATUS", 1944 .cmd_cb = pf_handle_clear_status, 1945 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, 1946 .cmd_priv = PRIV_NETINET_PF, 1947 }, 1948 { 1949 .cmd_num = PFNL_CMD_NATLOOK, 1950 .cmd_name = "NATLOOK", 1951 .cmd_cb = pf_handle_natlook, 1952 .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1953 .cmd_priv = PRIV_NETINET_PF, 1954 }, 1955 { 1956 .cmd_num = PFNL_CMD_SET_DEBUG, 1957 .cmd_name = "SET_DEBUG", 1958 .cmd_cb = pf_handle_set_debug, 1959 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, 1960 .cmd_priv = PRIV_NETINET_PF, 1961 }, 1962 { 1963 .cmd_num = PFNL_CMD_SET_TIMEOUT, 1964 .cmd_name = "SET_TIMEOUT", 1965 .cmd_cb = pf_handle_set_timeout, 1966 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, 1967 .cmd_priv = PRIV_NETINET_PF, 1968 }, 1969 { 1970 .cmd_num = PFNL_CMD_GET_TIMEOUT, 1971 .cmd_name = "GET_TIMEOUT", 1972 .cmd_cb = pf_handle_get_timeout, 1973 .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1974 .cmd_priv = PRIV_NETINET_PF, 1975 }, 1976 { 1977 .cmd_num = PFNL_CMD_SET_LIMIT, 1978 .cmd_name = "SET_LIMIT", 1979 .cmd_cb = pf_handle_set_limit, 1980 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, 1981 .cmd_priv = PRIV_NETINET_PF, 1982 }, 1983 { 1984 .cmd_num = PFNL_CMD_GET_LIMIT, 1985 .cmd_name = "GET_LIMIT", 1986 .cmd_cb = pf_handle_get_limit, 1987 .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1988 .cmd_priv = PRIV_NETINET_PF, 1989 }, 1990 { 1991 .cmd_num = PFNL_CMD_BEGIN_ADDRS, 1992 .cmd_name = "BEGIN_ADDRS", 1993 .cmd_cb = pf_handle_begin_addrs, 1994 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1995 .cmd_priv = PRIV_NETINET_PF, 1996 }, 1997 { 1998 .cmd_num = PFNL_CMD_ADD_ADDR, 1999 .cmd_name = "ADD_ADDR", 2000 .cmd_cb = pf_handle_add_addr, 2001 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, 2002 .cmd_priv = PRIV_NETINET_PF, 2003 }, 2004 { 2005 .cmd_num = PFNL_CMD_GET_ADDRS, 2006 .cmd_name = "GET_ADDRS", 2007 .cmd_cb = pf_handle_get_addrs, 2008 .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 2009 .cmd_priv = PRIV_NETINET_PF, 2010 }, 2011 { 2012 .cmd_num = PFNL_CMD_GET_ADDR, 2013 .cmd_name = "GET_ADDRS", 2014 .cmd_cb = pf_handle_get_addr, 2015 .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 2016 .cmd_priv = PRIV_NETINET_PF, 2017 }, 2018 { 2019 .cmd_num = PFNL_CMD_GET_RULESETS, 2020 .cmd_name = "GET_RULESETS", 2021 .cmd_cb = pf_handle_get_rulesets, 2022 .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 2023 .cmd_priv = PRIV_NETINET_PF, 2024 }, 2025 { 2026 .cmd_num = PFNL_CMD_GET_RULESET, 2027 .cmd_name = "GET_RULESET", 2028 .cmd_cb = pf_handle_get_ruleset, 2029 .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 2030 .cmd_priv = PRIV_NETINET_PF, 2031 }, 2032 { 2033 .cmd_num = PFNL_CMD_GET_SRCNODES, 2034 .cmd_name = "GET_SRCNODES", 2035 .cmd_cb = pf_handle_get_srcnodes, 2036 .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 2037 .cmd_priv = PRIV_NETINET_PF, 2038 }, 2039 { 2040 .cmd_num = PFNL_CMD_CLEAR_TABLES, 2041 .cmd_name = "CLEAR_TABLES", 2042 .cmd_cb = pf_handle_clear_tables, 2043 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, 2044 .cmd_priv = PRIV_NETINET_PF, 2045 }, 2046 }; 2047 2048 void 2049 pf_nl_register(void) 2050 { 2051 NL_VERIFY_PARSERS(all_parsers); 2052 2053 family_id = genl_register_family(PFNL_FAMILY_NAME, 0, 2, PFNL_CMD_MAX); 2054 genl_register_cmds(PFNL_FAMILY_NAME, pf_cmds, nitems(pf_cmds)); 2055 } 2056 2057 void 2058 pf_nl_unregister(void) 2059 { 2060 genl_unregister_family(PFNL_FAMILY_NAME); 2061 } 2062