xref: /freebsd/sys/netpfil/pf/pf_nl.c (revision dd3603749cb7f20a628f04d595b105962b21a3d2)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2023 Alexander V. Chernikov <melifaro@FreeBSD.org>
5  * Copyright (c) 2023 Rubicon Communications, LLC (Netgate)
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  *
28  */
29 #include <sys/cdefs.h>
30 #include "opt_inet.h"
31 #include "opt_inet6.h"
32 
33 #include <sys/param.h>
34 #include <sys/malloc.h>
35 #include <sys/mbuf.h>
36 #include <sys/priv.h>
37 #include <sys/socket.h>
38 #include <sys/ucred.h>
39 
40 #include <net/pfvar.h>
41 
42 #include <netlink/netlink.h>
43 #include <netlink/netlink_ctl.h>
44 #include <netlink/netlink_generic.h>
45 #include <netlink/netlink_message_writer.h>
46 
47 #include <netpfil/pf/pf_nl.h>
48 
49 #define	DEBUG_MOD_NAME	nl_pf
50 #define	DEBUG_MAX_LEVEL	LOG_DEBUG3
51 #include <netlink/netlink_debug.h>
52 _DECLARE_DEBUG(LOG_DEBUG);
53 
54 struct nl_parsed_state {
55 	uint8_t		version;
56 	uint32_t	id;
57 	uint32_t	creatorid;
58 	char		ifname[IFNAMSIZ];
59 	uint16_t	proto;
60 	sa_family_t	af;
61 	struct pf_addr	addr;
62 	struct pf_addr	mask;
63 };
64 
65 #define	_IN(_field)	offsetof(struct genlmsghdr, _field)
66 #define	_OUT(_field)	offsetof(struct nl_parsed_state, _field)
67 static const struct nlattr_parser nla_p_state[] = {
68 	{ .type = PF_ST_ID, .off = _OUT(id), .cb = nlattr_get_uint32 },
69 	{ .type = PF_ST_CREATORID, .off = _OUT(creatorid), .cb = nlattr_get_uint32 },
70 	{ .type = PF_ST_IFNAME, .arg = (const void *)IFNAMSIZ, .off = _OUT(ifname), .cb = nlattr_get_chara },
71 	{ .type = PF_ST_AF, .off = _OUT(af), .cb = nlattr_get_uint8 },
72 	{ .type = PF_ST_PROTO, .off = _OUT(proto), .cb = nlattr_get_uint16 },
73 	{ .type = PF_ST_FILTER_ADDR, .off = _OUT(addr), .cb = nlattr_get_in6_addr },
74 	{ .type = PF_ST_FILTER_MASK, .off = _OUT(mask), .cb = nlattr_get_in6_addr },
75 };
76 static const struct nlfield_parser nlf_p_generic[] = {
77 	{ .off_in = _IN(version), .off_out = _OUT(version), .cb = nlf_get_u8 },
78 };
79 #undef _IN
80 #undef _OUT
81 NL_DECLARE_PARSER(state_parser, struct genlmsghdr, nlf_p_generic, nla_p_state);
82 
83 static void
84 dump_addr(struct nl_writer *nw, int attr, const struct pf_addr *addr, int af)
85 {
86 	switch (af) {
87 	case AF_INET:
88 		nlattr_add(nw, attr, 4, &addr->v4);
89 		break;
90 	case AF_INET6:
91 		nlattr_add(nw, attr, 16, &addr->v6);
92 		break;
93 	};
94 }
95 
96 static bool
97 dump_state_peer(struct nl_writer *nw, int attr, const struct pf_state_peer *peer)
98 {
99 	int off = nlattr_add_nested(nw, attr);
100 	if (off == 0)
101 		return (false);
102 
103 	nlattr_add_u32(nw, PF_STP_SEQLO, peer->seqlo);
104 	nlattr_add_u32(nw, PF_STP_SEQHI, peer->seqhi);
105 	nlattr_add_u32(nw, PF_STP_SEQDIFF, peer->seqdiff);
106 	nlattr_add_u16(nw, PF_STP_MAX_WIN, peer->max_win);
107 	nlattr_add_u16(nw, PF_STP_MSS, peer->mss);
108 	nlattr_add_u8(nw, PF_STP_STATE, peer->state);
109 	nlattr_add_u8(nw, PF_STP_WSCALE, peer->wscale);
110 
111 	if (peer->scrub != NULL) {
112 		struct pf_state_scrub *sc = peer->scrub;
113 		uint16_t pfss_flags = sc->pfss_flags & PFSS_TIMESTAMP;
114 
115 		nlattr_add_u16(nw, PF_STP_PFSS_FLAGS, pfss_flags);
116 		nlattr_add_u32(nw, PF_STP_PFSS_TS_MOD, sc->pfss_ts_mod);
117 		nlattr_add_u8(nw, PF_STP_PFSS_TTL, sc->pfss_ttl);
118 		nlattr_add_u8(nw, PF_STP_SCRUB_FLAG, PFSYNC_SCRUB_FLAG_VALID);
119 	}
120 	nlattr_set_len(nw, off);
121 
122 	return (true);
123 }
124 
125 static bool
126 dump_state_key(struct nl_writer *nw, int attr, const struct pf_state_key *key)
127 {
128 	int off = nlattr_add_nested(nw, attr);
129 	if (off == 0)
130 		return (false);
131 
132 	dump_addr(nw, PF_STK_ADDR0, &key->addr[0], key->af);
133 	dump_addr(nw, PF_STK_ADDR1, &key->addr[1], key->af);
134 	nlattr_add_u16(nw, PF_STK_PORT0, key->port[0]);
135 	nlattr_add_u16(nw, PF_STK_PORT1, key->port[1]);
136 	nlattr_add_u8(nw, PF_STK_AF, key->af);
137 	nlattr_add_u16(nw, PF_STK_PROTO, key->proto);
138 
139 	nlattr_set_len(nw, off);
140 
141 	return (true);
142 }
143 
144 static int
145 dump_state(struct nlpcb *nlp, const struct nlmsghdr *hdr, struct pf_kstate *s,
146     struct nl_pstate *npt)
147 {
148 	struct nl_writer *nw = npt->nw;
149 	int error = 0;
150 	int af;
151 	struct pf_state_key *key;
152 
153 	PF_STATE_LOCK_ASSERT(s);
154 
155 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
156 		goto enomem;
157 
158 	struct genlmsghdr *ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
159 	ghdr_new->cmd = PFNL_CMD_GETSTATES;
160 	ghdr_new->version = 0;
161 	ghdr_new->reserved = 0;
162 
163 	nlattr_add_u64(nw, PF_ST_VERSION, PF_STATE_VERSION);
164 
165 	key = s->key[PF_SK_WIRE];
166 	if (!dump_state_key(nw, PF_ST_KEY_WIRE, key))
167 		goto enomem;
168 	key = s->key[PF_SK_STACK];
169 	if (!dump_state_key(nw, PF_ST_KEY_STACK, key))
170 		goto enomem;
171 
172 	af = s->key[PF_SK_WIRE]->af;
173 	nlattr_add_u8(nw, PF_ST_PROTO, s->key[PF_SK_WIRE]->proto);
174 	nlattr_add_u8(nw, PF_ST_AF, af);
175 
176 	nlattr_add_string(nw, PF_ST_IFNAME, s->kif->pfik_name);
177 	nlattr_add_string(nw, PF_ST_ORIG_IFNAME, s->orig_kif->pfik_name);
178 	dump_addr(nw, PF_ST_RT_ADDR, &s->act.rt_addr, af);
179 	nlattr_add_u32(nw, PF_ST_CREATION, time_uptime - (s->creation / 1000));
180 	uint32_t expire = pf_state_expires(s);
181 	if (expire > time_uptime)
182 		expire = expire - time_uptime;
183 	nlattr_add_u32(nw, PF_ST_EXPIRE, expire);
184 	nlattr_add_u8(nw, PF_ST_DIRECTION, s->direction);
185 	nlattr_add_u8(nw, PF_ST_LOG, s->act.log);
186 	nlattr_add_u8(nw, PF_ST_TIMEOUT, s->timeout);
187 	nlattr_add_u16(nw, PF_ST_STATE_FLAGS, s->state_flags);
188 	uint8_t sync_flags = 0;
189 	if (s->src_node)
190 		sync_flags |= PFSYNC_FLAG_SRCNODE;
191 	if (s->nat_src_node)
192 		sync_flags |= PFSYNC_FLAG_NATSRCNODE;
193 	nlattr_add_u8(nw, PF_ST_SYNC_FLAGS, sync_flags);
194 	nlattr_add_u64(nw, PF_ST_ID, s->id);
195 	nlattr_add_u32(nw, PF_ST_CREATORID, htonl(s->creatorid));
196 
197 	nlattr_add_u32(nw, PF_ST_RULE, s->rule ? s->rule->nr : -1);
198 	nlattr_add_u32(nw, PF_ST_ANCHOR, s->anchor ? s->anchor->nr : -1);
199 	nlattr_add_u32(nw, PF_ST_NAT_RULE, s->nat_rule ? s->nat_rule->nr : -1);
200 
201 	nlattr_add_u64(nw, PF_ST_PACKETS0, s->packets[0]);
202 	nlattr_add_u64(nw, PF_ST_PACKETS1, s->packets[1]);
203 	nlattr_add_u64(nw, PF_ST_BYTES0, s->bytes[0]);
204 	nlattr_add_u64(nw, PF_ST_BYTES1, s->bytes[1]);
205 	nlattr_add_u32(nw, PF_ST_RTABLEID, s->act.rtableid);
206 	nlattr_add_u8(nw, PF_ST_MIN_TTL, s->act.min_ttl);
207 	nlattr_add_u16(nw, PF_ST_MAX_MSS, s->act.max_mss);
208 	nlattr_add_u16(nw, PF_ST_DNPIPE, s->act.dnpipe);
209 	nlattr_add_u16(nw, PF_ST_DNRPIPE, s->act.dnrpipe);
210 	nlattr_add_u8(nw, PF_ST_RT, s->act.rt);
211 	if (s->act.rt_kif != NULL)
212 		nlattr_add_string(nw, PF_ST_RT_IFNAME, s->act.rt_kif->pfik_name);
213 
214 	if (!dump_state_peer(nw, PF_ST_PEER_SRC, &s->src))
215 		goto enomem;
216 	if (!dump_state_peer(nw, PF_ST_PEER_DST, &s->dst))
217 		goto enomem;
218 
219 	if (nlmsg_end(nw))
220 		return (0);
221 
222 enomem:
223 	error = ENOMEM;
224 	nlmsg_abort(nw);
225 	return (error);
226 }
227 
228 static int
229 handle_dumpstates(struct nlpcb *nlp, struct nl_parsed_state *attrs,
230     struct nlmsghdr *hdr, struct nl_pstate *npt)
231 {
232 	int error = 0;
233 
234 	hdr->nlmsg_flags |= NLM_F_MULTI;
235 
236 	for (int i = 0; i <= V_pf_hashmask; i++) {
237 		struct pf_idhash *ih = &V_pf_idhash[i];
238 		struct pf_kstate *s;
239 
240 		if (LIST_EMPTY(&ih->states))
241 			continue;
242 
243 		PF_HASHROW_LOCK(ih);
244 		LIST_FOREACH(s, &ih->states, entry) {
245 			sa_family_t af = s->key[PF_SK_WIRE]->af;
246 
247 			if (s->timeout == PFTM_UNLINKED)
248 				continue;
249 
250 			/* Filter */
251 			if (attrs->creatorid != 0 && s->creatorid != attrs->creatorid)
252 				continue;
253 			if (attrs->ifname[0] != 0 &&
254 			    strncmp(attrs->ifname, s->kif->pfik_name, IFNAMSIZ) != 0)
255 				continue;
256 			if (attrs->proto != 0 && s->key[PF_SK_WIRE]->proto != attrs->proto)
257 				continue;
258 			if (attrs->af != 0 && af != attrs->af)
259 				continue;
260 			if (pf_match_addr(1, &s->key[PF_SK_WIRE]->addr[0],
261 			    &attrs->mask, &attrs->addr, af) &&
262 			    pf_match_addr(1, &s->key[PF_SK_WIRE]->addr[1],
263 			    &attrs->mask, &attrs->addr, af) &&
264 			    pf_match_addr(1, &s->key[PF_SK_STACK]->addr[0],
265 			    &attrs->mask, &attrs->addr, af) &&
266 			    pf_match_addr(1, &s->key[PF_SK_STACK]->addr[1],
267 			    &attrs->mask, &attrs->addr, af))
268 				continue;
269 
270 			error = dump_state(nlp, hdr, s, npt);
271 			if (error != 0)
272 				break;
273 		}
274 		PF_HASHROW_UNLOCK(ih);
275 	}
276 
277 	if (!nlmsg_end_dump(npt->nw, error, hdr)) {
278 		NL_LOG(LOG_DEBUG, "Unable to finalize the dump");
279 		return (ENOMEM);
280 	}
281 
282 	return (error);
283 }
284 
285 static int
286 handle_getstate(struct nlpcb *nlp, struct nl_parsed_state *attrs,
287     struct nlmsghdr *hdr, struct nl_pstate *npt)
288 {
289 	struct pf_kstate *s;
290 	int ret;
291 
292 	s = pf_find_state_byid(attrs->id, attrs->creatorid);
293 	if (s == NULL)
294 		return (ENOENT);
295 	ret = dump_state(nlp, hdr, s, npt);
296 	PF_STATE_UNLOCK(s);
297 
298 	return (ret);
299 }
300 
301 static int
302 dump_creatorid(struct nlpcb *nlp, const struct nlmsghdr *hdr, uint32_t creator,
303     struct nl_pstate *npt)
304 {
305 	struct nl_writer *nw = npt->nw;
306 
307 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
308 		goto enomem;
309 
310 	struct genlmsghdr *ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
311 	ghdr_new->cmd = PFNL_CMD_GETCREATORS;
312 	ghdr_new->version = 0;
313 	ghdr_new->reserved = 0;
314 
315 	nlattr_add_u32(nw, PF_ST_CREATORID, htonl(creator));
316 
317 	if (nlmsg_end(nw))
318 		return (0);
319 
320 enomem:
321 	nlmsg_abort(nw);
322 	return (ENOMEM);
323 }
324 
325 static int
326 pf_handle_getstates(struct nlmsghdr *hdr, struct nl_pstate *npt)
327 {
328 	int error;
329 
330 	struct nl_parsed_state attrs = {};
331 	error = nl_parse_nlmsg(hdr, &state_parser, npt, &attrs);
332 	if (error != 0)
333 		return (error);
334 
335 	if (attrs.id != 0)
336 		error = handle_getstate(npt->nlp, &attrs, hdr, npt);
337 	else
338 		error = handle_dumpstates(npt->nlp, &attrs, hdr, npt);
339 
340 	return (error);
341 }
342 
343 static int
344 pf_handle_getcreators(struct nlmsghdr *hdr, struct nl_pstate *npt)
345 {
346 	uint32_t creators[16];
347 	int error = 0;
348 
349 	bzero(creators, sizeof(creators));
350 
351 	for (int i = 0; i < V_pf_hashmask; i++) {
352 		struct pf_idhash *ih = &V_pf_idhash[i];
353 		struct pf_kstate *s;
354 
355 		if (LIST_EMPTY(&ih->states))
356 			continue;
357 
358 		PF_HASHROW_LOCK(ih);
359 		LIST_FOREACH(s, &ih->states, entry) {
360 			int j;
361 			if (s->timeout == PFTM_UNLINKED)
362 				continue;
363 
364 			for (j = 0; j < nitems(creators); j++) {
365 				if (creators[j] == s->creatorid)
366 					break;
367 				if (creators[j] == 0) {
368 					creators[j] = s->creatorid;
369 					break;
370 				}
371 			}
372 			if (j == nitems(creators))
373 				printf("Warning: too many creators!\n");
374 		}
375 		PF_HASHROW_UNLOCK(ih);
376 	}
377 
378 	hdr->nlmsg_flags |= NLM_F_MULTI;
379 	for (int i = 0; i < nitems(creators); i++) {
380 		if (creators[i] == 0)
381 			break;
382 		error = dump_creatorid(npt->nlp, hdr, creators[i], npt);
383 	}
384 
385 	if (!nlmsg_end_dump(npt->nw, error, hdr)) {
386 		NL_LOG(LOG_DEBUG, "Unable to finalize the dump");
387 		return (ENOMEM);
388 	}
389 
390 	return (error);
391 }
392 
393 static int
394 pf_handle_start(struct nlmsghdr *hdr __unused, struct nl_pstate *npt __unused)
395 {
396 	return (pf_start());
397 }
398 
399 static int
400 pf_handle_stop(struct nlmsghdr *hdr __unused, struct nl_pstate *npt __unused)
401 {
402 	return (pf_stop());
403 }
404 
405 #define _OUT(_field)	offsetof(struct pf_addr_wrap, _field)
406 static const struct nlattr_parser nla_p_addr_wrap[] = {
407 	{ .type = PF_AT_ADDR, .off = _OUT(v.a.addr), .cb = nlattr_get_in6_addr },
408 	{ .type = PF_AT_MASK, .off = _OUT(v.a.mask), .cb = nlattr_get_in6_addr },
409 	{ .type = PF_AT_IFNAME, .off = _OUT(v.ifname), .arg = (void *)IFNAMSIZ,.cb = nlattr_get_chara },
410 	{ .type = PF_AT_TABLENAME, .off = _OUT(v.tblname), .arg = (void *)PF_TABLE_NAME_SIZE, .cb = nlattr_get_chara },
411 	{ .type = PF_AT_TYPE, .off = _OUT(type), .cb = nlattr_get_uint8 },
412 	{ .type = PF_AT_IFLAGS, .off = _OUT(iflags), .cb = nlattr_get_uint8 },
413 };
414 NL_DECLARE_ATTR_PARSER(addr_wrap_parser, nla_p_addr_wrap);
415 #undef _OUT
416 
417 static bool
418 nlattr_add_addr_wrap(struct nl_writer *nw, int attrtype, struct pf_addr_wrap *a)
419 {
420 	int off = nlattr_add_nested(nw, attrtype);
421 
422 	nlattr_add_in6_addr(nw, PF_AT_ADDR, &a->v.a.addr.v6);
423 	nlattr_add_in6_addr(nw, PF_AT_MASK, &a->v.a.mask.v6);
424 	nlattr_add_u8(nw, PF_AT_TYPE, a->type);
425 	nlattr_add_u8(nw, PF_AT_IFLAGS, a->iflags);
426 
427 	if (a->type == PF_ADDR_DYNIFTL) {
428 		nlattr_add_string(nw, PF_AT_IFNAME, a->v.ifname);
429 		nlattr_add_u32(nw, PF_AT_DYNCNT, a->p.dyncnt);
430 	} else if (a->type == PF_ADDR_TABLE) {
431 		nlattr_add_string(nw, PF_AT_TABLENAME, a->v.tblname);
432 		nlattr_add_u32(nw, PF_AT_TBLCNT, a->p.tblcnt);
433 	}
434 
435 	nlattr_set_len(nw, off);
436 
437 	return (true);
438 }
439 
440 #define _OUT(_field)	offsetof(struct pf_rule_addr, _field)
441 static const struct nlattr_parser nla_p_ruleaddr[] = {
442 	{ .type = PF_RAT_ADDR, .off = _OUT(addr), .arg = &addr_wrap_parser, .cb = nlattr_get_nested },
443 	{ .type = PF_RAT_SRC_PORT, .off = _OUT(port[0]), .cb = nlattr_get_uint16 },
444 	{ .type = PF_RAT_DST_PORT, .off = _OUT(port[1]), .cb = nlattr_get_uint16 },
445 	{ .type = PF_RAT_NEG, .off = _OUT(neg), .cb = nlattr_get_uint8 },
446 	{ .type = PF_RAT_OP, .off = _OUT(port_op), .cb = nlattr_get_uint8 },
447 };
448 NL_DECLARE_ATTR_PARSER(rule_addr_parser, nla_p_ruleaddr);
449 #undef _OUT
450 
451 static bool
452 nlattr_add_rule_addr(struct nl_writer *nw, int attrtype, struct pf_rule_addr *r)
453 {
454 	struct pf_addr_wrap aw = {0};
455 	int off = nlattr_add_nested(nw, attrtype);
456 
457 	bcopy(&(r->addr), &aw, sizeof(struct pf_addr_wrap));
458 	pf_addr_copyout(&aw);
459 
460 	nlattr_add_addr_wrap(nw, PF_RAT_ADDR, &aw);
461 	nlattr_add_u16(nw, PF_RAT_SRC_PORT, r->port[0]);
462 	nlattr_add_u16(nw, PF_RAT_DST_PORT, r->port[1]);
463 	nlattr_add_u8(nw, PF_RAT_NEG, r->neg);
464 	nlattr_add_u8(nw, PF_RAT_OP, r->port_op);
465 
466 	nlattr_set_len(nw, off);
467 
468 	return (true);
469 }
470 
471 #define _OUT(_field)	offsetof(struct pf_mape_portset, _field)
472 static const struct nlattr_parser nla_p_mape_portset[] = {
473 	{ .type = PF_MET_OFFSET, .off = _OUT(offset), .cb = nlattr_get_uint8 },
474 	{ .type = PF_MET_PSID_LEN, .off = _OUT(psidlen), .cb = nlattr_get_uint8 },
475 	{. type = PF_MET_PSID, .off = _OUT(psid), .cb = nlattr_get_uint16 },
476 };
477 NL_DECLARE_ATTR_PARSER(mape_portset_parser, nla_p_mape_portset);
478 #undef _OUT
479 
480 static bool
481 nlattr_add_mape_portset(struct nl_writer *nw, int attrtype, const struct pf_mape_portset *m)
482 {
483 	int off = nlattr_add_nested(nw, attrtype);
484 
485 	nlattr_add_u8(nw, PF_MET_OFFSET, m->offset);
486 	nlattr_add_u8(nw, PF_MET_PSID_LEN, m->psidlen);
487 	nlattr_add_u16(nw, PF_MET_PSID, m->psid);
488 
489 	nlattr_set_len(nw, off);
490 
491 	return (true);
492 }
493 
494 struct nl_parsed_labels
495 {
496 	char		labels[PF_RULE_MAX_LABEL_COUNT][PF_RULE_LABEL_SIZE];
497 	uint32_t	i;
498 };
499 
500 static int
501 nlattr_get_pf_rule_labels(struct nlattr *nla, struct nl_pstate *npt,
502     const void *arg, void *target)
503 {
504 	struct nl_parsed_labels *l = (struct nl_parsed_labels *)target;
505 	int ret;
506 
507 	if (l->i >= PF_RULE_MAX_LABEL_COUNT)
508 		return (E2BIG);
509 
510 	ret = nlattr_get_chara(nla, npt, (void *)PF_RULE_LABEL_SIZE,
511 	    l->labels[l->i]);
512 	if (ret == 0)
513 		l->i++;
514 
515 	return (ret);
516 }
517 
518 #define _OUT(_field)	offsetof(struct nl_parsed_labels, _field)
519 static const struct nlattr_parser nla_p_labels[] = {
520 	{ .type = PF_LT_LABEL, .off = 0, .cb = nlattr_get_pf_rule_labels },
521 };
522 NL_DECLARE_ATTR_PARSER(rule_labels_parser, nla_p_labels);
523 #undef _OUT
524 
525 static int
526 nlattr_get_nested_pf_rule_labels(struct nlattr *nla, struct nl_pstate *npt, const void *arg, void *target)
527 {
528 	struct nl_parsed_labels parsed_labels = { };
529 	int error;
530 
531 	/* Assumes target points to the beginning of the structure */
532 	error = nl_parse_header(NLA_DATA(nla), NLA_DATA_LEN(nla), &rule_labels_parser, npt, &parsed_labels);
533 	if (error != 0)
534 		return (error);
535 
536 	memcpy(target, parsed_labels.labels, sizeof(parsed_labels.labels));
537 
538 	return (0);
539 }
540 
541 static bool
542 nlattr_add_labels(struct nl_writer *nw, int attrtype, const struct pf_krule *r)
543 {
544 	int off = nlattr_add_nested(nw, attrtype);
545 	int i = 0;
546 
547 	while (r->label[i][0] != 0
548 	    && i < PF_RULE_MAX_LABEL_COUNT) {
549 		nlattr_add_string(nw, PF_LT_LABEL, r->label[i]);
550 		i++;
551 	}
552 
553 	nlattr_set_len(nw, off);
554 
555 	return (true);
556 }
557 
558 #define _OUT(_field)	offsetof(struct pf_kpool, _field)
559 static const struct nlattr_parser nla_p_pool[] = {
560 	{ .type = PF_PT_KEY, .off = _OUT(key), .arg = (void *)sizeof(struct pf_poolhashkey), .cb = nlattr_get_bytes },
561 	{ .type = PF_PT_COUNTER, .off = _OUT(counter), .cb = nlattr_get_in6_addr },
562 	{ .type = PF_PT_TBLIDX, .off = _OUT(tblidx), .cb = nlattr_get_uint32 },
563 	{ .type = PF_PT_PROXY_SRC_PORT, .off = _OUT(proxy_port[0]), .cb = nlattr_get_uint16 },
564 	{ .type = PF_PT_PROXY_DST_PORT, .off = _OUT(proxy_port[1]), .cb = nlattr_get_uint16 },
565 	{ .type = PF_PT_OPTS, .off = _OUT(opts), .cb = nlattr_get_uint8 },
566 	{ .type = PF_PT_MAPE, .off = _OUT(mape), .arg = &mape_portset_parser, .cb = nlattr_get_nested },
567 };
568 NL_DECLARE_ATTR_PARSER(pool_parser, nla_p_pool);
569 #undef _OUT
570 
571 static bool
572 nlattr_add_pool(struct nl_writer *nw, int attrtype, const struct pf_kpool *pool)
573 {
574 	int off = nlattr_add_nested(nw, attrtype);
575 
576 	nlattr_add(nw, PF_PT_KEY, sizeof(struct pf_poolhashkey), &pool->key);
577 	nlattr_add_in6_addr(nw, PF_PT_COUNTER, (const struct in6_addr *)&pool->counter);
578 	nlattr_add_u32(nw, PF_PT_TBLIDX, pool->tblidx);
579 	nlattr_add_u16(nw, PF_PT_PROXY_SRC_PORT, pool->proxy_port[0]);
580 	nlattr_add_u16(nw, PF_PT_PROXY_DST_PORT, pool->proxy_port[1]);
581 	nlattr_add_u8(nw, PF_PT_OPTS, pool->opts);
582 	nlattr_add_mape_portset(nw, PF_PT_MAPE, &pool->mape);
583 
584 	nlattr_set_len(nw, off);
585 
586 	return (true);
587 }
588 
589 #define _OUT(_field)	offsetof(struct pf_rule_uid, _field)
590 static const struct nlattr_parser nla_p_rule_uid[] = {
591 	{ .type = PF_RUT_UID_LOW, .off = _OUT(uid[0]), .cb = nlattr_get_uint32 },
592 	{ .type = PF_RUT_UID_HIGH, .off = _OUT(uid[1]), .cb = nlattr_get_uint32 },
593 	{ .type = PF_RUT_OP, .off = _OUT(op), .cb = nlattr_get_uint8 },
594 };
595 NL_DECLARE_ATTR_PARSER(rule_uid_parser, nla_p_rule_uid);
596 #undef _OUT
597 
598 static bool
599 nlattr_add_rule_uid(struct nl_writer *nw, int attrtype, const struct pf_rule_uid *u)
600 {
601 	int off = nlattr_add_nested(nw, attrtype);
602 
603 	nlattr_add_u32(nw, PF_RUT_UID_LOW, u->uid[0]);
604 	nlattr_add_u32(nw, PF_RUT_UID_HIGH, u->uid[1]);
605 	nlattr_add_u8(nw, PF_RUT_OP, u->op);
606 
607 	nlattr_set_len(nw, off);
608 
609 	return (true);
610 }
611 
612 struct nl_parsed_timeouts
613 {
614 	uint32_t	timeouts[PFTM_MAX];
615 	uint32_t	i;
616 };
617 
618 static int
619 nlattr_get_pf_timeout(struct nlattr *nla, struct nl_pstate *npt,
620     const void *arg, void *target)
621 {
622 	struct nl_parsed_timeouts *t = (struct nl_parsed_timeouts *)target;
623 	int ret;
624 
625 	if (t->i >= PFTM_MAX)
626 		return (E2BIG);
627 
628 	ret = nlattr_get_uint32(nla, npt, NULL, &t->timeouts[t->i]);
629 	if (ret == 0)
630 		t->i++;
631 
632 	return (ret);
633 }
634 
635 #define _OUT(_field)	offsetof(struct nl_parsed_timeout, _field)
636 static const struct nlattr_parser nla_p_timeouts[] = {
637 	{ .type = PF_TT_TIMEOUT, .off = 0, .cb = nlattr_get_pf_timeout },
638 };
639 NL_DECLARE_ATTR_PARSER(timeout_parser, nla_p_timeouts);
640 #undef _OUT
641 
642 static int
643 nlattr_get_nested_timeouts(struct nlattr *nla, struct nl_pstate *npt, const void *arg, void *target)
644 {
645 	struct nl_parsed_timeouts parsed_timeouts = { };
646 	int error;
647 
648 	/* Assumes target points to the beginning of the structure */
649 	error = nl_parse_header(NLA_DATA(nla), NLA_DATA_LEN(nla), &timeout_parser, npt, &parsed_timeouts);
650 	if (error != 0)
651 		return (error);
652 
653 	memcpy(target, parsed_timeouts.timeouts, sizeof(parsed_timeouts.timeouts));
654 
655 	return (0);
656 }
657 
658 static bool
659 nlattr_add_timeout(struct nl_writer *nw, int attrtype, uint32_t *timeout)
660 {
661 	int off = nlattr_add_nested(nw, attrtype);
662 
663 	for (int i = 0; i < PFTM_MAX; i++)
664 		nlattr_add_u32(nw, PF_RT_TIMEOUT, timeout[i]);
665 
666 	nlattr_set_len(nw, off);
667 
668 	return (true);
669 }
670 
671 #define _OUT(_field)	offsetof(struct pf_krule, _field)
672 static const struct nlattr_parser nla_p_rule[] = {
673 	{ .type = PF_RT_SRC, .off = _OUT(src), .arg = &rule_addr_parser,.cb = nlattr_get_nested },
674 	{ .type = PF_RT_DST, .off = _OUT(dst), .arg = &rule_addr_parser,.cb = nlattr_get_nested },
675 	{ .type = PF_RT_RIDENTIFIER, .off = _OUT(ridentifier), .cb = nlattr_get_uint32 },
676 	{ .type = PF_RT_LABELS, .off = _OUT(label), .arg = &rule_labels_parser,.cb = nlattr_get_nested_pf_rule_labels },
677 	{ .type = PF_RT_IFNAME, .off = _OUT(ifname), .arg = (void *)IFNAMSIZ, .cb = nlattr_get_chara },
678 	{ .type = PF_RT_QNAME, .off = _OUT(qname), .arg = (void *)PF_QNAME_SIZE, .cb = nlattr_get_chara },
679 	{ .type = PF_RT_PQNAME, .off = _OUT(pqname), .arg = (void *)PF_QNAME_SIZE, .cb = nlattr_get_chara },
680 	{ .type = PF_RT_TAGNAME, .off = _OUT(tagname), .arg = (void *)PF_TAG_NAME_SIZE, .cb = nlattr_get_chara },
681 	{ .type = PF_RT_MATCH_TAGNAME, .off = _OUT(match_tagname), .arg = (void *)PF_TAG_NAME_SIZE, .cb = nlattr_get_chara },
682 	{ .type = PF_RT_OVERLOAD_TBLNAME, .off = _OUT(overload_tblname), .arg = (void *)PF_TABLE_NAME_SIZE, .cb = nlattr_get_chara },
683 	{ .type = PF_RT_RPOOL_RDR, .off = _OUT(rdr), .arg = &pool_parser, .cb = nlattr_get_nested },
684 	{ .type = PF_RT_OS_FINGERPRINT, .off = _OUT(os_fingerprint), .cb = nlattr_get_uint32 },
685 	{ .type = PF_RT_RTABLEID, .off = _OUT(rtableid), .cb = nlattr_get_uint32 },
686 	{ .type = PF_RT_TIMEOUT, .off = _OUT(timeout), .arg = &timeout_parser, .cb = nlattr_get_nested_timeouts },
687 	{ .type = PF_RT_MAX_STATES, .off = _OUT(max_states), .cb = nlattr_get_uint32 },
688 	{ .type = PF_RT_MAX_SRC_NODES, .off = _OUT(max_src_nodes), .cb = nlattr_get_uint32 },
689 	{ .type = PF_RT_MAX_SRC_STATES, .off = _OUT(max_src_states), .cb = nlattr_get_uint32 },
690 	{ .type = PF_RT_MAX_SRC_CONN_RATE_LIMIT, .off = _OUT(max_src_conn_rate.limit), .cb = nlattr_get_uint32 },
691 	{ .type = PF_RT_MAX_SRC_CONN_RATE_SECS, .off = _OUT(max_src_conn_rate.seconds), .cb = nlattr_get_uint32 },
692 	{ .type = PF_RT_DNPIPE, .off = _OUT(dnpipe), .cb = nlattr_get_uint16 },
693 	{ .type = PF_RT_DNRPIPE, .off = _OUT(dnrpipe), .cb = nlattr_get_uint16 },
694 	{ .type = PF_RT_DNFLAGS, .off = _OUT(free_flags), .cb = nlattr_get_uint32 },
695 	{ .type = PF_RT_NR, .off = _OUT(nr), .cb = nlattr_get_uint32 },
696 	{ .type = PF_RT_PROB, .off = _OUT(prob), .cb = nlattr_get_uint32 },
697 	{ .type = PF_RT_CUID, .off = _OUT(cuid), .cb = nlattr_get_uint32 },
698 	{. type = PF_RT_CPID, .off = _OUT(cpid), .cb = nlattr_get_uint32 },
699 	{ .type = PF_RT_RETURN_ICMP, .off = _OUT(return_icmp), .cb = nlattr_get_uint16 },
700 	{ .type = PF_RT_RETURN_ICMP6, .off = _OUT(return_icmp6), .cb = nlattr_get_uint16 },
701 	{ .type = PF_RT_MAX_MSS, .off = _OUT(max_mss), .cb = nlattr_get_uint16 },
702 	{ .type = PF_RT_SCRUB_FLAGS, .off = _OUT(scrub_flags), .cb = nlattr_get_uint16 },
703 	{ .type = PF_RT_UID, .off = _OUT(uid), .arg = &rule_uid_parser, .cb = nlattr_get_nested },
704 	{ .type = PF_RT_GID, .off = _OUT(gid), .arg = &rule_uid_parser, .cb = nlattr_get_nested },
705 	{ .type = PF_RT_RULE_FLAG, .off = _OUT(rule_flag), .cb = nlattr_get_uint32 },
706 	{ .type = PF_RT_ACTION, .off = _OUT(action), .cb = nlattr_get_uint8 },
707 	{ .type = PF_RT_DIRECTION, .off = _OUT(direction), .cb = nlattr_get_uint8 },
708 	{ .type = PF_RT_LOG, .off = _OUT(log), .cb = nlattr_get_uint8 },
709 	{ .type = PF_RT_LOGIF, .off = _OUT(logif), .cb = nlattr_get_uint8 },
710 	{ .type = PF_RT_QUICK, .off = _OUT(quick), .cb = nlattr_get_uint8 },
711 	{ .type = PF_RT_IF_NOT, .off = _OUT(ifnot), .cb = nlattr_get_uint8 },
712 	{ .type = PF_RT_MATCH_TAG_NOT, .off = _OUT(match_tag_not), .cb = nlattr_get_uint8 },
713 	{ .type = PF_RT_NATPASS, .off = _OUT(natpass), .cb = nlattr_get_uint8 },
714 	{ .type = PF_RT_KEEP_STATE, .off = _OUT(keep_state), .cb = nlattr_get_uint8 },
715 	{ .type = PF_RT_AF, .off = _OUT(af), .cb = nlattr_get_uint8 },
716 	{ .type = PF_RT_PROTO, .off = _OUT(proto), .cb = nlattr_get_uint8 },
717 	{ .type = PF_RT_TYPE, .off = _OUT(type), .cb = nlattr_get_uint8 },
718 	{ .type = PF_RT_CODE, .off = _OUT(code), .cb = nlattr_get_uint8 },
719 	{ .type = PF_RT_FLAGS, .off = _OUT(flags), .cb = nlattr_get_uint8 },
720 	{ .type = PF_RT_FLAGSET, .off = _OUT(flagset), .cb = nlattr_get_uint8 },
721 	{ .type = PF_RT_MIN_TTL, .off = _OUT(min_ttl), .cb = nlattr_get_uint8 },
722 	{ .type = PF_RT_ALLOW_OPTS, .off = _OUT(allow_opts), .cb = nlattr_get_uint8 },
723 	{ .type = PF_RT_RT, .off = _OUT(rt), .cb = nlattr_get_uint8 },
724 	{ .type = PF_RT_RETURN_TTL, .off = _OUT(return_ttl), .cb = nlattr_get_uint8 },
725 	{ .type = PF_RT_TOS, .off = _OUT(tos), .cb = nlattr_get_uint8 },
726 	{ .type = PF_RT_SET_TOS, .off = _OUT(set_tos), .cb = nlattr_get_uint8 },
727 	{ .type = PF_RT_ANCHOR_RELATIVE, .off = _OUT(anchor_relative), .cb = nlattr_get_uint8 },
728 	{ .type = PF_RT_ANCHOR_WILDCARD, .off = _OUT(anchor_wildcard), .cb = nlattr_get_uint8 },
729 	{ .type = PF_RT_FLUSH, .off = _OUT(flush), .cb = nlattr_get_uint8 },
730 	{ .type = PF_RT_PRIO, .off = _OUT(prio), .cb = nlattr_get_uint8 },
731 	{ .type = PF_RT_SET_PRIO, .off = _OUT(set_prio[0]), .cb = nlattr_get_uint8 },
732 	{ .type = PF_RT_SET_PRIO_REPLY, .off = _OUT(set_prio[1]), .cb = nlattr_get_uint8 },
733 	{ .type = PF_RT_DIVERT_ADDRESS, .off = _OUT(divert.addr), .cb = nlattr_get_in6_addr },
734 	{ .type = PF_RT_DIVERT_PORT, .off = _OUT(divert.port), .cb = nlattr_get_uint16 },
735 	{ .type = PF_RT_RCV_IFNAME, .off = _OUT(rcv_ifname), .arg = (void *)IFNAMSIZ, .cb = nlattr_get_chara },
736 	{ .type = PF_RT_MAX_SRC_CONN, .off = _OUT(max_src_conn), .cb = nlattr_get_uint32 },
737 	{ .type = PF_RT_RPOOL_NAT, .off = _OUT(nat), .arg = &pool_parser, .cb = nlattr_get_nested },
738 	{ .type = PF_RT_NAF, .off = _OUT(naf), .cb = nlattr_get_uint8 },
739 	{ .type = PF_RT_RPOOL_RT, .off = _OUT(route), .arg = &pool_parser, .cb = nlattr_get_nested },
740 };
741 NL_DECLARE_ATTR_PARSER(rule_parser, nla_p_rule);
742 #undef _OUT
743 struct nl_parsed_addrule {
744 	struct pf_krule	*rule;
745 	uint32_t	 ticket;
746 	uint32_t	 pool_ticket;
747 	char		*anchor;
748 	char		*anchor_call;
749 };
750 #define	_OUT(_field)	offsetof(struct nl_parsed_addrule, _field)
751 static const struct nlattr_parser nla_p_addrule[] = {
752 	{ .type = PF_ART_TICKET, .off = _OUT(ticket), .cb = nlattr_get_uint32 },
753 	{ .type = PF_ART_POOL_TICKET, .off = _OUT(pool_ticket), .cb = nlattr_get_uint32 },
754 	{ .type = PF_ART_ANCHOR, .off = _OUT(anchor), .cb = nlattr_get_string },
755 	{ .type = PF_ART_ANCHOR_CALL, .off = _OUT(anchor_call), .cb = nlattr_get_string },
756 	{ .type = PF_ART_RULE, .off = _OUT(rule), .arg = &rule_parser, .cb = nlattr_get_nested_ptr }
757 };
758 #undef _OUT
759 NL_DECLARE_PARSER(addrule_parser, struct genlmsghdr, nlf_p_empty, nla_p_addrule);
760 
761 static int
762 pf_handle_addrule(struct nlmsghdr *hdr, struct nl_pstate *npt)
763 {
764 	int error;
765 	struct nl_parsed_addrule attrs = {};
766 
767 	attrs.rule = pf_krule_alloc();
768 
769 	error = nl_parse_nlmsg(hdr, &addrule_parser, npt, &attrs);
770 	if (error != 0) {
771 		pf_free_rule(attrs.rule);
772 		return (error);
773 	}
774 
775 	error = pf_ioctl_addrule(attrs.rule, attrs.ticket, attrs.pool_ticket,
776 	    attrs.anchor, attrs.anchor_call, nlp_get_cred(npt->nlp)->cr_uid,
777 	    hdr->nlmsg_pid);
778 
779 	return (error);
780 }
781 
782 #define	_OUT(_field)	offsetof(struct pfioc_rule, _field)
783 static const struct nlattr_parser nla_p_getrules[] = {
784 	{ .type = PF_GR_ANCHOR, .off = _OUT(anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara },
785 	{ .type = PF_GR_ACTION, .off = _OUT(rule.action), .cb = nlattr_get_uint8 },
786 };
787 #undef _OUT
788 NL_DECLARE_PARSER(getrules_parser, struct genlmsghdr, nlf_p_empty, nla_p_getrules);
789 
790 static int
791 pf_handle_getrules(struct nlmsghdr *hdr, struct nl_pstate *npt)
792 {
793 	struct pfioc_rule attrs = {};
794 	int error;
795 	struct nl_writer *nw = npt->nw;
796 	struct genlmsghdr *ghdr_new;
797 
798 	error = nl_parse_nlmsg(hdr, &getrules_parser, npt, &attrs);
799 	if (error != 0)
800 		return (error);
801 
802 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
803 		return (ENOMEM);
804 
805 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
806 	ghdr_new->cmd = PFNL_CMD_GETRULES;
807 	ghdr_new->version = 0;
808 	ghdr_new->reserved = 0;
809 
810 	error = pf_ioctl_getrules(&attrs);
811 	if (error != 0)
812 		goto out;
813 
814 	nlattr_add_u32(nw, PF_GR_NR, attrs.nr);
815 	nlattr_add_u32(nw, PF_GR_TICKET, attrs.ticket);
816 
817 	if (!nlmsg_end(nw)) {
818 		error = ENOMEM;
819 		goto out;
820 	}
821 
822 	return (0);
823 
824 out:
825 	nlmsg_abort(nw);
826 	return (error);
827 }
828 
829 struct nl_parsed_get_rule {
830 	char anchor[MAXPATHLEN];
831 	uint8_t action;
832 	uint32_t nr;
833 	uint32_t ticket;
834 	uint8_t clear;
835 };
836 #define	_OUT(_field)	offsetof(struct nl_parsed_get_rule, _field)
837 static const struct nlattr_parser nla_p_getrule[] = {
838 	{ .type = PF_GR_ANCHOR, .off = _OUT(anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara },
839 	{ .type = PF_GR_ACTION, .off = _OUT(action), .cb = nlattr_get_uint8 },
840 	{ .type = PF_GR_NR, .off = _OUT(nr), .cb = nlattr_get_uint32 },
841 	{ .type = PF_GR_TICKET, .off = _OUT(ticket), .cb = nlattr_get_uint32 },
842 	{ .type = PF_GR_CLEAR, .off = _OUT(clear), .cb = nlattr_get_uint8 },
843 };
844 #undef _OUT
845 NL_DECLARE_PARSER(getrule_parser, struct genlmsghdr, nlf_p_empty, nla_p_getrule);
846 
847 static int
848 pf_handle_getrule(struct nlmsghdr *hdr, struct nl_pstate *npt)
849 {
850 	char				 anchor_call[MAXPATHLEN];
851 	struct nl_parsed_get_rule	 attrs = {};
852 	struct nl_writer		*nw = npt->nw;
853 	struct genlmsghdr		*ghdr_new;
854 	struct pf_kruleset		*ruleset;
855 	struct pf_krule			*rule;
856 	int				 rs_num;
857 	int				 error;
858 
859 	error = nl_parse_nlmsg(hdr, &getrule_parser, npt, &attrs);
860 	if (error != 0)
861 		return (error);
862 
863 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
864 		return (ENOMEM);
865 
866 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
867 	ghdr_new->cmd = PFNL_CMD_GETRULE;
868 	ghdr_new->version = 0;
869 	ghdr_new->reserved = 0;
870 
871 	PF_RULES_WLOCK();
872 	ruleset = pf_find_kruleset(attrs.anchor);
873 	if (ruleset == NULL) {
874 		PF_RULES_WUNLOCK();
875 		error = ENOENT;
876 		goto out;
877 	}
878 
879 	rs_num = pf_get_ruleset_number(attrs.action);
880 	if (rs_num >= PF_RULESET_MAX) {
881 		PF_RULES_WUNLOCK();
882 		error = EINVAL;
883 		goto out;
884 	}
885 
886 	if (attrs.ticket != ruleset->rules[rs_num].active.ticket) {
887 		PF_RULES_WUNLOCK();
888 		error = EBUSY;
889 		goto out;
890 	}
891 
892 	rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr);
893 	while ((rule != NULL) && (rule->nr != attrs.nr))
894 		rule = TAILQ_NEXT(rule, entries);
895 	if (rule == NULL) {
896 		PF_RULES_WUNLOCK();
897 		error = EBUSY;
898 		goto out;
899 	}
900 
901 	nlattr_add_rule_addr(nw, PF_RT_SRC, &rule->src);
902 	nlattr_add_rule_addr(nw, PF_RT_DST, &rule->dst);
903 	nlattr_add_u32(nw, PF_RT_RIDENTIFIER, rule->ridentifier);
904 	nlattr_add_labels(nw, PF_RT_LABELS, rule);
905 	nlattr_add_string(nw, PF_RT_IFNAME, rule->ifname);
906 	nlattr_add_string(nw, PF_RT_QNAME, rule->qname);
907 	nlattr_add_string(nw, PF_RT_PQNAME, rule->pqname);
908 	nlattr_add_string(nw, PF_RT_TAGNAME, rule->tagname);
909 	nlattr_add_string(nw, PF_RT_MATCH_TAGNAME, rule->match_tagname);
910 	nlattr_add_string(nw, PF_RT_OVERLOAD_TBLNAME, rule->overload_tblname);
911 	nlattr_add_pool(nw, PF_RT_RPOOL_RDR, &rule->rdr);
912 	nlattr_add_pool(nw, PF_RT_RPOOL_NAT, &rule->nat);
913 	nlattr_add_pool(nw, PF_RT_RPOOL_RT, &rule->route);
914 	nlattr_add_u32(nw, PF_RT_OS_FINGERPRINT, rule->os_fingerprint);
915 	nlattr_add_u32(nw, PF_RT_RTABLEID, rule->rtableid);
916 	nlattr_add_timeout(nw, PF_RT_TIMEOUT, rule->timeout);
917 	nlattr_add_u32(nw, PF_RT_MAX_STATES, rule->max_states);
918 	nlattr_add_u32(nw, PF_RT_MAX_SRC_NODES, rule->max_src_nodes);
919 	nlattr_add_u32(nw, PF_RT_MAX_SRC_STATES, rule->max_src_states);
920 	nlattr_add_u32(nw, PF_RT_MAX_SRC_CONN, rule->max_src_conn);
921 	nlattr_add_u32(nw, PF_RT_MAX_SRC_CONN_RATE_LIMIT, rule->max_src_conn_rate.limit);
922 	nlattr_add_u32(nw, PF_RT_MAX_SRC_CONN_RATE_SECS, rule->max_src_conn_rate.seconds);
923 
924 	nlattr_add_u16(nw, PF_RT_DNPIPE, rule->dnpipe);
925 	nlattr_add_u16(nw, PF_RT_DNRPIPE, rule->dnrpipe);
926 	nlattr_add_u32(nw, PF_RT_DNFLAGS, rule->free_flags);
927 
928 	nlattr_add_u32(nw, PF_RT_NR, rule->nr);
929 	nlattr_add_u32(nw, PF_RT_PROB, rule->prob);
930 	nlattr_add_u32(nw, PF_RT_CUID, rule->cuid);
931 	nlattr_add_u32(nw, PF_RT_CPID, rule->cpid);
932 
933 	nlattr_add_u16(nw, PF_RT_RETURN_ICMP, rule->return_icmp);
934 	nlattr_add_u16(nw, PF_RT_RETURN_ICMP6, rule->return_icmp6);
935 	nlattr_add_u16(nw, PF_RT_RETURN_ICMP6, rule->return_icmp6);
936 	nlattr_add_u16(nw, PF_RT_MAX_MSS, rule->max_mss);
937 	nlattr_add_u16(nw, PF_RT_SCRUB_FLAGS, rule->scrub_flags);
938 
939 	nlattr_add_rule_uid(nw, PF_RT_UID, &rule->uid);
940 	nlattr_add_rule_uid(nw, PF_RT_GID, (const struct pf_rule_uid *)&rule->gid);
941 
942 	nlattr_add_string(nw, PF_RT_RCV_IFNAME, rule->rcv_ifname);
943 
944 	nlattr_add_u32(nw, PF_RT_RULE_FLAG, rule->rule_flag);
945 	nlattr_add_u8(nw, PF_RT_ACTION, rule->action);
946 	nlattr_add_u8(nw, PF_RT_DIRECTION, rule->direction);
947 	nlattr_add_u8(nw, PF_RT_LOG, rule->log);
948 	nlattr_add_u8(nw, PF_RT_LOGIF, rule->logif);
949 	nlattr_add_u8(nw, PF_RT_QUICK, rule->quick);
950 	nlattr_add_u8(nw, PF_RT_IF_NOT, rule->ifnot);
951 	nlattr_add_u8(nw, PF_RT_MATCH_TAG_NOT, rule->match_tag_not);
952 	nlattr_add_u8(nw, PF_RT_NATPASS, rule->natpass);
953 	nlattr_add_u8(nw, PF_RT_KEEP_STATE, rule->keep_state);
954 
955 	nlattr_add_u8(nw, PF_RT_AF, rule->af);
956 	nlattr_add_u8(nw, PF_RT_NAF, rule->naf);
957 	nlattr_add_u8(nw, PF_RT_PROTO, rule->proto);
958 	nlattr_add_u8(nw, PF_RT_TYPE, rule->type);
959 	nlattr_add_u8(nw, PF_RT_CODE, rule->code);
960 	nlattr_add_u8(nw, PF_RT_FLAGS, rule->flags);
961 	nlattr_add_u8(nw, PF_RT_FLAGSET, rule->flagset);
962 	nlattr_add_u8(nw, PF_RT_MIN_TTL, rule->min_ttl);
963 	nlattr_add_u8(nw, PF_RT_ALLOW_OPTS, rule->allow_opts);
964 	nlattr_add_u8(nw, PF_RT_RT, rule->rt);
965 	nlattr_add_u8(nw, PF_RT_RETURN_TTL, rule->return_ttl);
966 	nlattr_add_u8(nw, PF_RT_TOS, rule->tos);
967 	nlattr_add_u8(nw, PF_RT_SET_TOS, rule->set_tos);
968 	nlattr_add_u8(nw, PF_RT_ANCHOR_RELATIVE, rule->anchor_relative);
969 	nlattr_add_u8(nw, PF_RT_ANCHOR_WILDCARD, rule->anchor_wildcard);
970 	nlattr_add_u8(nw, PF_RT_FLUSH, rule->flush);
971 	nlattr_add_u8(nw, PF_RT_PRIO, rule->prio);
972 	nlattr_add_u8(nw, PF_RT_SET_PRIO, rule->set_prio[0]);
973 	nlattr_add_u8(nw, PF_RT_SET_PRIO_REPLY, rule->set_prio[1]);
974 
975 	nlattr_add_in6_addr(nw, PF_RT_DIVERT_ADDRESS, &rule->divert.addr.v6);
976 	nlattr_add_u16(nw, PF_RT_DIVERT_PORT, rule->divert.port);
977 
978 	nlattr_add_u64(nw, PF_RT_PACKETS_IN, pf_counter_u64_fetch(&rule->packets[0]));
979 	nlattr_add_u64(nw, PF_RT_PACKETS_OUT, pf_counter_u64_fetch(&rule->packets[1]));
980 	nlattr_add_u64(nw, PF_RT_BYTES_IN, pf_counter_u64_fetch(&rule->bytes[0]));
981 	nlattr_add_u64(nw, PF_RT_BYTES_OUT, pf_counter_u64_fetch(&rule->bytes[1]));
982 	nlattr_add_u64(nw, PF_RT_EVALUATIONS, pf_counter_u64_fetch(&rule->evaluations));
983 	nlattr_add_u64(nw, PF_RT_TIMESTAMP, pf_get_timestamp(rule));
984 	nlattr_add_u64(nw, PF_RT_STATES_CUR, counter_u64_fetch(rule->states_cur));
985 	nlattr_add_u64(nw, PF_RT_STATES_TOTAL, counter_u64_fetch(rule->states_tot));
986 	nlattr_add_u64(nw, PF_RT_SRC_NODES, counter_u64_fetch(rule->src_nodes));
987 
988 	error = pf_kanchor_copyout(ruleset, rule, anchor_call, sizeof(anchor_call));
989 	MPASS(error == 0);
990 
991 	nlattr_add_string(nw, PF_RT_ANCHOR_CALL, anchor_call);
992 
993 	if (attrs.clear)
994 		pf_krule_clear_counters(rule);
995 
996 	PF_RULES_WUNLOCK();
997 
998 	if (!nlmsg_end(nw)) {
999 		error = ENOMEM;
1000 		goto out;
1001 	}
1002 
1003 	return (0);
1004 out:
1005 	nlmsg_abort(nw);
1006 	return (error);
1007 }
1008 
1009 #define	_OUT(_field)	offsetof(struct pf_kstate_kill, _field)
1010 static const struct nlattr_parser nla_p_clear_states[] = {
1011 	{ .type = PF_CS_CMP_ID, .off = _OUT(psk_pfcmp.id), .cb = nlattr_get_uint64 },
1012 	{ .type = PF_CS_CMP_CREATORID, .off = _OUT(psk_pfcmp.creatorid), .cb = nlattr_get_uint32 },
1013 	{ .type = PF_CS_CMP_DIR, .off = _OUT(psk_pfcmp.direction), .cb = nlattr_get_uint8 },
1014 	{ .type = PF_CS_AF, .off = _OUT(psk_af), .cb = nlattr_get_uint8 },
1015 	{ .type = PF_CS_PROTO, .off = _OUT(psk_proto), .cb = nlattr_get_uint8 },
1016 	{ .type = PF_CS_SRC, .off = _OUT(psk_src), .arg = &rule_addr_parser, .cb = nlattr_get_nested },
1017 	{ .type = PF_CS_DST, .off = _OUT(psk_dst), .arg = &rule_addr_parser, .cb = nlattr_get_nested },
1018 	{ .type = PF_CS_RT_ADDR, .off = _OUT(psk_rt_addr), .arg = &rule_addr_parser, .cb = nlattr_get_nested },
1019 	{ .type = PF_CS_IFNAME, .off = _OUT(psk_ifname), .arg = (void *)IFNAMSIZ, .cb = nlattr_get_chara },
1020 	{ .type = PF_CS_LABEL, .off = _OUT(psk_label), .arg = (void *)PF_RULE_LABEL_SIZE, .cb = nlattr_get_chara },
1021 	{ .type = PF_CS_KILL_MATCH, .off = _OUT(psk_kill_match), .cb = nlattr_get_bool },
1022 	{ .type = PF_CS_NAT, .off = _OUT(psk_nat), .cb = nlattr_get_bool },
1023 };
1024 #undef _OUT
1025 NL_DECLARE_PARSER(clear_states_parser, struct genlmsghdr, nlf_p_empty, nla_p_clear_states);
1026 
1027 static int
1028 pf_handle_killclear_states(struct nlmsghdr *hdr, struct nl_pstate *npt, int cmd)
1029 {
1030 	struct pf_kstate_kill		 kill = {};
1031 	struct epoch_tracker		 et;
1032 	struct nl_writer		*nw = npt->nw;
1033 	struct genlmsghdr		*ghdr_new;
1034 	int				 error;
1035 	unsigned int			 killed = 0;
1036 
1037 	error = nl_parse_nlmsg(hdr, &clear_states_parser, npt, &kill);
1038 	if (error != 0)
1039 		return (error);
1040 
1041 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1042 		return (ENOMEM);
1043 
1044 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1045 	ghdr_new->cmd = cmd;
1046 	ghdr_new->version = 0;
1047 	ghdr_new->reserved = 0;
1048 
1049 	NET_EPOCH_ENTER(et);
1050 	if (cmd == PFNL_CMD_KILLSTATES)
1051 		pf_killstates(&kill, &killed);
1052 	else
1053 		killed = pf_clear_states(&kill);
1054 	NET_EPOCH_EXIT(et);
1055 
1056 	nlattr_add_u32(nw, PF_CS_KILLED, killed);
1057 
1058 	if (! nlmsg_end(nw)) {
1059 		error = ENOMEM;
1060 		goto out;
1061 	}
1062 
1063 	return (0);
1064 
1065 out:
1066 	nlmsg_abort(nw);
1067 	return (error);
1068 }
1069 
1070 static int
1071 pf_handle_clear_states(struct nlmsghdr *hdr, struct nl_pstate *npt)
1072 {
1073 	return (pf_handle_killclear_states(hdr, npt, PFNL_CMD_CLRSTATES));
1074 }
1075 
1076 static int
1077 pf_handle_kill_states(struct nlmsghdr *hdr, struct nl_pstate *npt)
1078 {
1079 	return (pf_handle_killclear_states(hdr, npt, PFNL_CMD_KILLSTATES));
1080 }
1081 
1082 struct nl_parsed_set_statusif {
1083 	char ifname[IFNAMSIZ];
1084 };
1085 #define	_OUT(_field)	offsetof(struct nl_parsed_set_statusif, _field)
1086 static const struct nlattr_parser nla_p_set_statusif[] = {
1087 	{ .type = PF_SS_IFNAME, .off = _OUT(ifname), .arg = (const void *)IFNAMSIZ, .cb = nlattr_get_chara },
1088 };
1089 #undef _OUT
1090 NL_DECLARE_PARSER(set_statusif_parser, struct genlmsghdr, nlf_p_empty, nla_p_set_statusif);
1091 
1092 static int
1093 pf_handle_set_statusif(struct nlmsghdr *hdr, struct nl_pstate *npt)
1094 {
1095 	int error;
1096 	struct nl_parsed_set_statusif attrs = {};
1097 
1098 	error = nl_parse_nlmsg(hdr, &set_statusif_parser, npt, &attrs);
1099 	if (error != 0)
1100 		return (error);
1101 
1102 	PF_RULES_WLOCK();
1103 	strlcpy(V_pf_status.ifname, attrs.ifname, IFNAMSIZ);
1104 	PF_RULES_WUNLOCK();
1105 
1106 	return (0);
1107 }
1108 
1109 static bool
1110 nlattr_add_counters(struct nl_writer *nw, int attr, size_t number, char **names,
1111     counter_u64_t *counters)
1112 {
1113 	for (int i = 0; i < number; i++) {
1114 		int off = nlattr_add_nested(nw, attr);
1115 		nlattr_add_u32(nw, PF_C_ID, i);
1116 		nlattr_add_string(nw, PF_C_NAME, names[i]);
1117 		nlattr_add_u64(nw, PF_C_COUNTER, counter_u64_fetch(counters[i]));
1118 		nlattr_set_len(nw, off);
1119 	}
1120 
1121 	return (true);
1122 }
1123 
1124 static bool
1125 nlattr_add_fcounters(struct nl_writer *nw, int attr, size_t number, char **names,
1126     struct pf_counter_u64 *counters)
1127 {
1128 	for (int i = 0; i < number; i++) {
1129 		int off = nlattr_add_nested(nw, attr);
1130 		nlattr_add_u32(nw, PF_C_ID, i);
1131 		nlattr_add_string(nw, PF_C_NAME, names[i]);
1132 		nlattr_add_u64(nw, PF_C_COUNTER, pf_counter_u64_fetch(&counters[i]));
1133 		nlattr_set_len(nw, off);
1134 	}
1135 
1136 	return (true);
1137 }
1138 
1139 static bool
1140 nlattr_add_u64_array(struct nl_writer *nw, int attr, size_t number, uint64_t *array)
1141 {
1142 	int off = nlattr_add_nested(nw, attr);
1143 
1144 	for (size_t i = 0; i < number; i++)
1145 		nlattr_add_u64(nw, 0, array[i]);
1146 
1147 	nlattr_set_len(nw, off);
1148 
1149 	return (true);
1150 }
1151 
1152 static int
1153 pf_handle_get_status(struct nlmsghdr *hdr, struct nl_pstate *npt)
1154 {
1155 	struct pf_status s;
1156 	struct nl_writer *nw = npt->nw;
1157 	struct genlmsghdr *ghdr_new;
1158 	char *pf_reasons[PFRES_MAX+1] = PFRES_NAMES;
1159 	char *pf_lcounter[KLCNT_MAX+1] = KLCNT_NAMES;
1160 	char *pf_fcounter[FCNT_MAX+1] = FCNT_NAMES;
1161 	int error;
1162 
1163 	PF_RULES_RLOCK_TRACKER;
1164 
1165 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1166 		return (ENOMEM);
1167 
1168 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1169 	ghdr_new->cmd = PFNL_CMD_GET_STATUS;
1170 	ghdr_new->version = 0;
1171 	ghdr_new->reserved = 0;
1172 
1173 	PF_RULES_RLOCK();
1174 
1175 	nlattr_add_string(nw, PF_GS_IFNAME, V_pf_status.ifname);
1176 	nlattr_add_bool(nw, PF_GS_RUNNING, V_pf_status.running);
1177 	nlattr_add_u32(nw, PF_GS_SINCE, V_pf_status.since);
1178 	nlattr_add_u32(nw, PF_GS_DEBUG, V_pf_status.debug);
1179 	nlattr_add_u32(nw, PF_GS_HOSTID, ntohl(V_pf_status.hostid));
1180 	nlattr_add_u32(nw, PF_GS_STATES, V_pf_status.states);
1181 	nlattr_add_u32(nw, PF_GS_SRC_NODES, V_pf_status.src_nodes);
1182 	nlattr_add_u32(nw, PF_GS_REASSEMBLE, V_pf_status.reass);
1183 	nlattr_add_u32(nw, PF_GS_SYNCOOKIES_ACTIVE, V_pf_status.syncookies_active);
1184 
1185 	nlattr_add_counters(nw, PF_GS_COUNTERS, PFRES_MAX, pf_reasons,
1186 	    V_pf_status.counters);
1187 	nlattr_add_counters(nw, PF_GS_LCOUNTERS, KLCNT_MAX, pf_lcounter,
1188 	    V_pf_status.lcounters);
1189 	nlattr_add_fcounters(nw, PF_GS_FCOUNTERS, FCNT_MAX, pf_fcounter,
1190 	    V_pf_status.fcounters);
1191 	nlattr_add_counters(nw, PF_GS_SCOUNTERS, SCNT_MAX, pf_fcounter,
1192 	    V_pf_status.scounters);
1193 
1194 	pfi_update_status(V_pf_status.ifname, &s);
1195 	nlattr_add_u64_array(nw, PF_GS_BCOUNTERS, 2 * 2, (uint64_t *)s.bcounters);
1196 	nlattr_add_u64_array(nw, PF_GS_PCOUNTERS, 2 * 2 * 2, (uint64_t *)s.pcounters);
1197 
1198 	nlattr_add(nw, PF_GS_CHKSUM, PF_MD5_DIGEST_LENGTH, V_pf_status.pf_chksum);
1199 
1200 	PF_RULES_RUNLOCK();
1201 
1202 	if (!nlmsg_end(nw)) {
1203 		error = ENOMEM;
1204 		goto out;
1205 	}
1206 
1207 	return (0);
1208 
1209 out:
1210 	nlmsg_abort(nw);
1211 	return (error);
1212 }
1213 
1214 static int
1215 pf_handle_clear_status(struct nlmsghdr *hdr, struct nl_pstate *npt)
1216 {
1217 	pf_ioctl_clear_status();
1218 
1219 	return (0);
1220 }
1221 
1222 struct pf_nl_natlook {
1223 	sa_family_t af;
1224 	uint8_t direction;
1225 	uint8_t proto;
1226 	struct pf_addr src;
1227 	struct pf_addr dst;
1228 	uint16_t sport;
1229 	uint16_t dport;
1230 };
1231 
1232 #define	_OUT(_field)	offsetof(struct pf_nl_natlook, _field)
1233 static const struct nlattr_parser nla_p_natlook[] = {
1234 	{ .type = PF_NL_AF, .off = _OUT(af), .cb = nlattr_get_uint8 },
1235 	{ .type = PF_NL_DIRECTION, .off = _OUT(direction), .cb = nlattr_get_uint8 },
1236 	{ .type = PF_NL_PROTO, .off = _OUT(proto), .cb = nlattr_get_uint8 },
1237 	{ .type = PF_NL_SRC_ADDR, .off = _OUT(src), .cb = nlattr_get_in6_addr },
1238 	{ .type = PF_NL_DST_ADDR, .off = _OUT(dst), .cb = nlattr_get_in6_addr },
1239 	{ .type = PF_NL_SRC_PORT, .off = _OUT(sport), .cb = nlattr_get_uint16 },
1240 	{ .type = PF_NL_DST_PORT, .off = _OUT(dport), .cb = nlattr_get_uint16 },
1241 };
1242 #undef _OUT
1243 NL_DECLARE_PARSER(natlook_parser, struct genlmsghdr, nlf_p_empty, nla_p_natlook);
1244 
1245 static int
1246 pf_handle_natlook(struct nlmsghdr *hdr, struct nl_pstate *npt)
1247 {
1248 	struct pf_nl_natlook	 attrs = {};
1249 	struct pf_state_key_cmp	 key = {};
1250 	struct nl_writer	*nw = npt->nw;
1251 	struct pf_state_key	*sk;
1252 	struct pf_kstate	*state;
1253 	struct genlmsghdr	*ghdr_new;
1254 	int			 error, m = 0;
1255 	int			 sidx, didx;
1256 
1257 	error = nl_parse_nlmsg(hdr, &natlook_parser, npt, &attrs);
1258 	if (error != 0)
1259 		return (error);
1260 
1261 	if (attrs.proto == 0 ||
1262 	    PF_AZERO(&attrs.src, attrs.af) ||
1263 	    PF_AZERO(&attrs.dst, attrs.af) ||
1264 	    ((attrs.proto == IPPROTO_TCP || attrs.proto == IPPROTO_UDP) &&
1265 	     (attrs.sport == 0 || attrs.dport == 0)))
1266 		return (EINVAL);
1267 
1268 	/* NATLOOK src and dst are reversed, so reverse sidx/didx */
1269 	sidx = (attrs.direction == PF_IN) ? 1 : 0;
1270 	didx = (attrs.direction == PF_IN) ? 0 : 1;
1271 
1272 	key.af = attrs.af;
1273 	key.proto = attrs.proto;
1274 	PF_ACPY(&key.addr[sidx], &attrs.src, attrs.af);
1275 	key.port[sidx] = attrs.sport;
1276 	PF_ACPY(&key.addr[didx], &attrs.dst, attrs.af);
1277 	key.port[didx] = attrs.dport;
1278 
1279 	state = pf_find_state_all(&key, attrs.direction, &m);
1280 	if (state == NULL)
1281 		return (ENOENT);
1282 	if (m > 1) {
1283 		PF_STATE_UNLOCK(state);
1284 		return (E2BIG);
1285 	}
1286 
1287 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) {
1288 		PF_STATE_UNLOCK(state);
1289 		return (ENOMEM);
1290 	}
1291 
1292 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1293 	ghdr_new->cmd = PFNL_CMD_NATLOOK;
1294 	ghdr_new->version = 0;
1295 	ghdr_new->reserved = 0;
1296 
1297 	sk = state->key[sidx];
1298 
1299 	nlattr_add_in6_addr(nw, PF_NL_SRC_ADDR, &sk->addr[sidx].v6);
1300 	nlattr_add_in6_addr(nw, PF_NL_DST_ADDR, &sk->addr[didx].v6);
1301 	nlattr_add_u16(nw, PF_NL_SRC_PORT, sk->port[sidx]);
1302 	nlattr_add_u16(nw, PF_NL_DST_PORT, sk->port[didx]);
1303 
1304 	PF_STATE_UNLOCK(state);
1305 
1306 	if (!nlmsg_end(nw)) {
1307 		nlmsg_abort(nw);
1308 		return (ENOMEM);
1309 	}
1310 
1311 	return (0);
1312 }
1313 
1314 struct pf_nl_set_debug
1315 {
1316 	uint32_t level;
1317 };
1318 #define	_OUT(_field)	offsetof(struct pf_nl_set_debug, _field)
1319 static const struct nlattr_parser nla_p_set_debug[] = {
1320 	{ .type = PF_SD_LEVEL, .off = _OUT(level), .cb = nlattr_get_uint32 },
1321 };
1322 #undef _OUT
1323 NL_DECLARE_PARSER(set_debug_parser, struct genlmsghdr, nlf_p_empty, nla_p_set_debug);
1324 
1325 static int
1326 pf_handle_set_debug(struct nlmsghdr *hdr, struct nl_pstate *npt)
1327 {
1328 	struct pf_nl_set_debug attrs = {};
1329 	int error;
1330 
1331 	error = nl_parse_nlmsg(hdr, &set_debug_parser, npt, &attrs);
1332 	if (error != 0)
1333 		return (error);
1334 
1335 	PF_RULES_WLOCK();
1336 	V_pf_status.debug = attrs.level;
1337 	PF_RULES_WUNLOCK();
1338 
1339 	return (0);
1340 }
1341 
1342 struct pf_nl_set_timeout
1343 {
1344 	uint32_t timeout;
1345 	uint32_t seconds;
1346 };
1347 #define	_OUT(_field)	offsetof(struct pf_nl_set_timeout, _field)
1348 static const struct nlattr_parser nla_p_set_timeout[] = {
1349 	{ .type = PF_TO_TIMEOUT, .off = _OUT(timeout), .cb = nlattr_get_uint32 },
1350 	{ .type = PF_TO_SECONDS, .off = _OUT(seconds), .cb = nlattr_get_uint32 },
1351 };
1352 #undef _OUT
1353 NL_DECLARE_PARSER(set_timeout_parser, struct genlmsghdr, nlf_p_empty, nla_p_set_timeout);
1354 
1355 static int
1356 pf_handle_set_timeout(struct nlmsghdr *hdr, struct nl_pstate *npt)
1357 {
1358 	struct pf_nl_set_timeout attrs = {};
1359 	int error;
1360 
1361 	error = nl_parse_nlmsg(hdr, &set_timeout_parser, npt, &attrs);
1362 	if (error != 0)
1363 		return (error);
1364 
1365 	return (pf_ioctl_set_timeout(attrs.timeout, attrs.seconds, NULL));
1366 }
1367 
1368 static int
1369 pf_handle_get_timeout(struct nlmsghdr *hdr, struct nl_pstate *npt)
1370 {
1371 	struct pf_nl_set_timeout attrs = {};
1372 	struct nl_writer *nw = npt->nw;
1373 	struct genlmsghdr *ghdr_new;
1374 	int error;
1375 
1376 	error = nl_parse_nlmsg(hdr, &set_timeout_parser, npt, &attrs);
1377 	if (error != 0)
1378 		return (error);
1379 
1380 	error = pf_ioctl_get_timeout(attrs.timeout, &attrs.seconds);
1381 	if (error != 0)
1382 		return (error);
1383 
1384 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1385 		return (ENOMEM);
1386 
1387 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1388 	ghdr_new->cmd = PFNL_CMD_GET_TIMEOUT;
1389 	ghdr_new->version = 0;
1390 	ghdr_new->reserved = 0;
1391 
1392 	nlattr_add_u32(nw, PF_TO_SECONDS, attrs.seconds);
1393 
1394 	if (!nlmsg_end(nw)) {
1395 		nlmsg_abort(nw);
1396 		return (ENOMEM);
1397 	}
1398 
1399 	return (0);
1400 }
1401 
1402 struct pf_nl_set_limit
1403 {
1404 	uint32_t index;
1405 	uint32_t limit;
1406 };
1407 #define	_OUT(_field)	offsetof(struct pf_nl_set_limit, _field)
1408 static const struct nlattr_parser nla_p_set_limit[] = {
1409 	{ .type = PF_LI_INDEX, .off = _OUT(index), .cb = nlattr_get_uint32 },
1410 	{ .type = PF_LI_LIMIT, .off = _OUT(limit), .cb = nlattr_get_uint32 },
1411 };
1412 #undef _OUT
1413 NL_DECLARE_PARSER(set_limit_parser, struct genlmsghdr, nlf_p_empty, nla_p_set_limit);
1414 
1415 static int
1416 pf_handle_set_limit(struct nlmsghdr *hdr, struct nl_pstate *npt)
1417 {
1418 	struct pf_nl_set_limit attrs = {};
1419 	int error;
1420 
1421 	error = nl_parse_nlmsg(hdr, &set_limit_parser, npt, &attrs);
1422 	if (error != 0)
1423 		return (error);
1424 
1425 	return (pf_ioctl_set_limit(attrs.index, attrs.limit, NULL));
1426 }
1427 
1428 static int
1429 pf_handle_get_limit(struct nlmsghdr *hdr, struct nl_pstate *npt)
1430 {
1431 	struct pf_nl_set_limit attrs = {};
1432 	struct nl_writer *nw = npt->nw;
1433 	struct genlmsghdr *ghdr_new;
1434 	int error;
1435 
1436 	error = nl_parse_nlmsg(hdr, &set_limit_parser, npt, &attrs);
1437 	if (error != 0)
1438 		return (error);
1439 
1440 	error = pf_ioctl_get_limit(attrs.index, &attrs.limit);
1441 	if (error != 0)
1442 		return (error);
1443 
1444 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1445 		return (ENOMEM);
1446 
1447 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1448 	ghdr_new->cmd = PFNL_CMD_GET_LIMIT;
1449 	ghdr_new->version = 0;
1450 	ghdr_new->reserved = 0;
1451 
1452 	nlattr_add_u32(nw, PF_LI_LIMIT, attrs.limit);
1453 
1454 	if (!nlmsg_end(nw)) {
1455 		nlmsg_abort(nw);
1456 		return (ENOMEM);
1457 	}
1458 
1459 	return (0);
1460 }
1461 
1462 static int
1463 pf_handle_begin_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt)
1464 {
1465 	struct nl_writer *nw = npt->nw;
1466 	struct genlmsghdr *ghdr_new;
1467 	uint32_t ticket;
1468 	int error;
1469 
1470 	error = pf_ioctl_begin_addrs(&ticket);
1471 	if (error != 0)
1472 		return (error);
1473 
1474 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1475 		return (ENOMEM);
1476 
1477 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1478 	ghdr_new->cmd = PFNL_CMD_BEGIN_ADDRS;
1479 	ghdr_new->version = 0;
1480 	ghdr_new->reserved = 0;
1481 
1482 	nlattr_add_u32(nw, PF_BA_TICKET, ticket);
1483 
1484 	if (!nlmsg_end(nw)) {
1485 		nlmsg_abort(nw);
1486 		return (ENOMEM);
1487 	}
1488 
1489 	return (0);
1490 }
1491 
1492 static bool
1493 nlattr_add_pool_addr(struct nl_writer *nw, int attrtype, struct pf_pooladdr *a)
1494 {
1495 	int off;
1496 
1497 	off = nlattr_add_nested(nw, attrtype);
1498 
1499 	nlattr_add_addr_wrap(nw, PF_PA_ADDR, &a->addr);
1500 	nlattr_add_string(nw, PF_PA_IFNAME, a->ifname);
1501 
1502 	nlattr_set_len(nw, off);
1503 
1504 	return (true);
1505 }
1506 
1507 #define _OUT(_field)	offsetof(struct pf_pooladdr, _field)
1508 static const struct nlattr_parser nla_p_pool_addr[] = {
1509 	{ .type = PF_PA_ADDR, .off = _OUT(addr), .arg = &addr_wrap_parser, .cb = nlattr_get_nested },
1510 	{ .type = PF_PA_IFNAME, .off = _OUT(ifname), .arg = (void *)IFNAMSIZ, .cb = nlattr_get_chara },
1511 };
1512 NL_DECLARE_ATTR_PARSER(pool_addr_parser, nla_p_pool_addr);
1513 #undef _OUT
1514 
1515 #define	_OUT(_field)	offsetof(struct pf_nl_pooladdr, _field)
1516 static const struct nlattr_parser nla_p_add_addr[] = {
1517 	{ .type = PF_AA_ACTION, .off = _OUT(action), .cb = nlattr_get_uint32 },
1518 	{ .type = PF_AA_TICKET, .off = _OUT(ticket), .cb = nlattr_get_uint32 },
1519 	{ .type = PF_AA_NR, .off = _OUT(nr), .cb = nlattr_get_uint32 },
1520 	{ .type = PF_AA_R_NUM, .off = _OUT(r_num), .cb = nlattr_get_uint32 },
1521 	{ .type = PF_AA_R_ACTION, .off = _OUT(r_action), .cb = nlattr_get_uint8 },
1522 	{ .type = PF_AA_R_LAST, .off = _OUT(r_last), .cb = nlattr_get_uint8 },
1523 	{ .type = PF_AA_AF, .off = _OUT(af), .cb = nlattr_get_uint8 },
1524 	{ .type = PF_AA_ANCHOR, .off = _OUT(anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara },
1525 	{ .type = PF_AA_ADDR, .off = _OUT(addr), .arg = &pool_addr_parser, .cb = nlattr_get_nested },
1526 	{ .type = PF_AA_WHICH, .off = _OUT(which), .cb = nlattr_get_uint32 },
1527 };
1528 #undef _OUT
1529 NL_DECLARE_PARSER(add_addr_parser, struct genlmsghdr, nlf_p_empty, nla_p_add_addr);
1530 
1531 static int
1532 pf_handle_add_addr(struct nlmsghdr *hdr, struct nl_pstate *npt)
1533 {
1534 	struct pf_nl_pooladdr attrs = { 0 };
1535 	int error;
1536 
1537 	error = nl_parse_nlmsg(hdr, &add_addr_parser, npt, &attrs);
1538 	if (error != 0)
1539 		return (error);
1540 
1541 	if (attrs.which == 0)
1542 		attrs.which = PF_RDR;
1543 
1544 	error = pf_ioctl_add_addr(&attrs);
1545 
1546 	return (error);
1547 }
1548 
1549 static int
1550 pf_handle_get_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt)
1551 {
1552 	struct pf_nl_pooladdr attrs = { 0 };
1553 	struct nl_writer *nw = npt->nw;
1554 	struct genlmsghdr *ghdr_new;
1555 	int error;
1556 
1557 	error = nl_parse_nlmsg(hdr, &add_addr_parser, npt, &attrs);
1558 	if (error != 0)
1559 		return (error);
1560 
1561 	if (attrs.which == 0)
1562 		attrs.which = PF_RDR;
1563 
1564 	error = pf_ioctl_get_addrs(&attrs);
1565 	if (error != 0)
1566 		return (error);
1567 
1568 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1569 		return (ENOMEM);
1570 
1571 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1572 	ghdr_new->cmd = PFNL_CMD_GET_ADDRS;
1573 	ghdr_new->version = 0;
1574 	ghdr_new->reserved = 0;
1575 
1576 	nlattr_add_u32(nw, PF_AA_NR, attrs.nr);
1577 
1578 	if (!nlmsg_end(nw)) {
1579 		nlmsg_abort(nw);
1580 		return (ENOMEM);
1581 	}
1582 
1583 	return (error);
1584 }
1585 
1586 static int
1587 pf_handle_get_addr(struct nlmsghdr *hdr, struct nl_pstate *npt)
1588 {
1589 	struct pf_nl_pooladdr attrs = { 0 };
1590 	struct nl_writer *nw = npt->nw;
1591 	struct genlmsghdr *ghdr_new;
1592 	int error;
1593 
1594 	error = nl_parse_nlmsg(hdr, &add_addr_parser, npt, &attrs);
1595 	if (error != 0)
1596 		return (error);
1597 
1598 	if (attrs.which == 0)
1599 		attrs.which = PF_RDR;
1600 
1601 	error = pf_ioctl_get_addr(&attrs);
1602 	if (error != 0)
1603 		return (error);
1604 
1605 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1606 		return (ENOMEM);
1607 
1608 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1609 	ghdr_new->cmd = PFNL_CMD_GET_ADDR;
1610 	ghdr_new->version = 0;
1611 	ghdr_new->reserved = 0;
1612 
1613 	nlattr_add_u32(nw, PF_AA_ACTION, attrs.action);
1614 	nlattr_add_u32(nw, PF_AA_TICKET, attrs.ticket);
1615 	nlattr_add_u32(nw, PF_AA_NR, attrs.nr);
1616 	nlattr_add_u32(nw, PF_AA_R_NUM, attrs.r_num);
1617 	nlattr_add_u8(nw, PF_AA_R_ACTION, attrs.r_action);
1618 	nlattr_add_u8(nw, PF_AA_R_LAST, attrs.r_last);
1619 	nlattr_add_u8(nw, PF_AA_AF, attrs.af);
1620 	nlattr_add_string(nw, PF_AA_ANCHOR, attrs.anchor);
1621 	nlattr_add_pool_addr(nw, PF_AA_ADDR, &attrs.addr);
1622 
1623 	if (!nlmsg_end(nw)) {
1624 		nlmsg_abort(nw);
1625 		return (ENOMEM);
1626 	}
1627 
1628 	return (0);
1629 }
1630 
1631 #define _OUT(_field)	offsetof(struct pfioc_ruleset, _field)
1632 static const struct nlattr_parser nla_p_ruleset[] = {
1633 	{ .type = PF_RS_PATH, .off = _OUT(path), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara },
1634 	{ .type = PF_RS_NR, .off = _OUT(nr), .cb = nlattr_get_uint32 },
1635 };
1636 NL_DECLARE_PARSER(ruleset_parser, struct genlmsghdr, nlf_p_empty, nla_p_ruleset);
1637 #undef _OUT
1638 
1639 static int
1640 pf_handle_get_rulesets(struct nlmsghdr *hdr, struct nl_pstate *npt)
1641 {
1642 	struct pfioc_ruleset attrs = { 0 };
1643 	struct nl_writer *nw = npt->nw;
1644 	struct genlmsghdr *ghdr_new;
1645 	int error;
1646 
1647 	error = nl_parse_nlmsg(hdr, &ruleset_parser, npt, &attrs);
1648 	if (error != 0)
1649 		return (error);
1650 
1651 	error = pf_ioctl_get_rulesets(&attrs);
1652 	if (error != 0)
1653 		return (error);
1654 
1655 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1656 		return (ENOMEM);
1657 
1658 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1659 	ghdr_new->cmd = PFNL_CMD_GET_RULESETS;
1660 	ghdr_new->version = 0;
1661 	ghdr_new->reserved = 0;
1662 
1663 	nlattr_add_u32(nw, PF_RS_NR, attrs.nr);
1664 
1665 	if (!nlmsg_end(nw)) {
1666 		nlmsg_abort(nw);
1667 		return (ENOMEM);
1668 	}
1669 
1670 	return (0);
1671 }
1672 
1673 static int
1674 pf_handle_get_ruleset(struct nlmsghdr *hdr, struct nl_pstate *npt)
1675 {
1676 	struct pfioc_ruleset attrs = { 0 };
1677 	struct nl_writer *nw = npt->nw;
1678 	struct genlmsghdr *ghdr_new;
1679 	int error;
1680 
1681 	error = nl_parse_nlmsg(hdr, &ruleset_parser, npt, &attrs);
1682 	if (error)
1683 		return (error);
1684 
1685 	error = pf_ioctl_get_ruleset(&attrs);
1686 	if (error != 0)
1687 		return (error);
1688 
1689 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1690 		return (ENOMEM);
1691 
1692 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1693 	ghdr_new->cmd = PFNL_CMD_GET_RULESET;
1694 	ghdr_new->version = 0;
1695 	ghdr_new->reserved = 0;
1696 
1697 	nlattr_add_string(nw, PF_RS_NAME, attrs.name);
1698 
1699 	if (!nlmsg_end(nw)) {
1700 		nlmsg_abort(nw);
1701 		return (ENOMEM);
1702 	}
1703 
1704 	return (0);
1705 }
1706 
1707 static bool
1708 nlattr_add_pf_threshold(struct nl_writer *nw, int attrtype,
1709     struct pf_threshold *t, int secs)
1710 {
1711 	int	 off = nlattr_add_nested(nw, attrtype);
1712 	int	 diff, conn_rate_count;
1713 
1714 	/* Adjust the connection rate estimate. */
1715 	conn_rate_count = t->count;
1716 	diff = secs - t->last;
1717 	if (diff >= t->seconds)
1718 		conn_rate_count = 0;
1719 	else
1720 		conn_rate_count -= t->count * diff / t->seconds;
1721 
1722 	nlattr_add_u32(nw, PF_TH_LIMIT, t->limit);
1723 	nlattr_add_u32(nw, PF_TH_SECONDS, t->seconds);
1724 	nlattr_add_u32(nw, PF_TH_COUNT, conn_rate_count);
1725 	nlattr_add_u32(nw, PF_TH_LAST, t->last);
1726 
1727 	nlattr_set_len(nw, off);
1728 
1729 	return (true);
1730 }
1731 
1732 static int
1733 pf_handle_get_srcnodes(struct nlmsghdr *hdr, struct nl_pstate *npt)
1734 {
1735 	struct nl_writer	*nw = npt->nw;
1736 	struct genlmsghdr	*ghdr_new;
1737 	struct pf_ksrc_node	*n;
1738 	struct pf_srchash	*sh;
1739 	int			 i;
1740 	int			 secs;
1741 
1742 	hdr->nlmsg_flags |= NLM_F_MULTI;
1743 
1744 	for (i = 0, sh = V_pf_srchash; i <= V_pf_srchashmask;
1745 	    i++, sh++) {
1746 		/* Avoid locking empty rows. */
1747 		if (LIST_EMPTY(&sh->nodes))
1748 			continue;
1749 
1750 		PF_HASHROW_LOCK(sh);
1751 		secs = time_uptime;
1752 
1753 		LIST_FOREACH(n, &sh->nodes, entry) {
1754 			if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) {
1755 				nlmsg_abort(nw);
1756 				return (ENOMEM);
1757 			}
1758 
1759 			ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1760 			ghdr_new->cmd = PFNL_CMD_GET_SRCNODES;
1761 			ghdr_new->version = 0;
1762 			ghdr_new->reserved = 0;
1763 
1764 			nlattr_add_in6_addr(nw, PF_SN_ADDR, &n->addr.v6);
1765 			nlattr_add_in6_addr(nw, PF_SN_RADDR, &n->raddr.v6);
1766 			nlattr_add_u32(nw, PF_SN_RULE_NR, n->rule->nr);
1767 			nlattr_add_u64(nw, PF_SN_BYTES_IN, counter_u64_fetch(n->bytes[0]));
1768 			nlattr_add_u64(nw, PF_SN_BYTES_OUT, counter_u64_fetch(n->bytes[1]));
1769 			nlattr_add_u64(nw, PF_SN_PACKETS_IN, counter_u64_fetch(n->packets[0]));
1770 			nlattr_add_u64(nw, PF_SN_PACKETS_OUT, counter_u64_fetch(n->packets[1]));
1771 			nlattr_add_u32(nw, PF_SN_STATES, n->states);
1772 			nlattr_add_u32(nw, PF_SN_CONNECTIONS, n->conn);
1773 			nlattr_add_u8(nw, PF_SN_AF, n->af);
1774 			nlattr_add_u8(nw, PF_SN_NAF, n->naf);
1775 			nlattr_add_u8(nw, PF_SN_RULE_TYPE, n->ruletype);
1776 
1777 			nlattr_add_u64(nw, PF_SN_CREATION, secs - n->creation);
1778 			if (n->expire > secs)
1779 				nlattr_add_u64(nw, PF_SN_EXPIRE, n->expire - secs);
1780 			else
1781 				nlattr_add_u64(nw, PF_SN_EXPIRE, 0);
1782 
1783 			nlattr_add_pf_threshold(nw, PF_SN_CONNECTION_RATE,
1784 			    &n->conn_rate, secs);
1785 
1786 			if (!nlmsg_end(nw)) {
1787 				PF_HASHROW_UNLOCK(sh);
1788 				nlmsg_abort(nw);
1789 				return (ENOMEM);
1790 			}
1791 		}
1792 		PF_HASHROW_UNLOCK(sh);
1793 	}
1794 
1795 	return (0);
1796 }
1797 
1798 #define _OUT(_field)	offsetof(struct pfioc_table, _field)
1799 static const struct nlattr_parser nla_p_table[] = {
1800 	{ .type = PF_T_ANCHOR, .off = _OUT(pfrio_table.pfrt_anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara },
1801 	{ .type = PF_T_NAME, .off = _OUT(pfrio_table.pfrt_name), .arg = (void *)PF_TABLE_NAME_SIZE, .cb = nlattr_get_chara },
1802 	{ .type = PF_T_TABLE_FLAGS, .off = _OUT(pfrio_table.pfrt_flags), .cb = nlattr_get_uint32 },
1803 	{ .type = PF_T_FLAGS, .off = _OUT(pfrio_flags), .cb = nlattr_get_uint32 },
1804 };
1805 static const struct nlfield_parser nlf_p_table[] = {};
1806 NL_DECLARE_PARSER(table_parser, struct genlmsghdr, nlf_p_table, nla_p_table);
1807 #undef _OUT
1808 static int
1809 pf_handle_clear_tables(struct nlmsghdr *hdr, struct nl_pstate *npt)
1810 {
1811 	struct pfioc_table attrs = { 0 };
1812 	struct nl_writer *nw = npt->nw;
1813 	struct genlmsghdr *ghdr_new;
1814 	int ndel = 0;
1815 	int error;
1816 
1817 	error = nl_parse_nlmsg(hdr, &table_parser, npt, &attrs);
1818 	if (error != 0)
1819 		return (error);
1820 
1821 	PF_RULES_WLOCK();
1822 	error = pfr_clr_tables(&attrs.pfrio_table, &ndel, attrs.pfrio_flags | PFR_FLAG_USERIOCTL);
1823 	PF_RULES_WUNLOCK();
1824 	if (error != 0)
1825 		return (error);
1826 
1827 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1828 		return (ENOMEM);
1829 
1830 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1831 	ghdr_new->cmd = PFNL_CMD_CLEAR_TABLES;
1832 	ghdr_new->version = 0;
1833 	ghdr_new->reserved = 0;
1834 
1835 	nlattr_add_u32(nw, PF_T_NBR_DELETED, ndel);
1836 
1837 	if (!nlmsg_end(nw)) {
1838 		nlmsg_abort(nw);
1839 		return (ENOMEM);
1840 	}
1841 
1842 	return (0);
1843 }
1844 
1845 static const struct nlhdr_parser *all_parsers[] = {
1846 	&state_parser,
1847 	&addrule_parser,
1848 	&getrules_parser,
1849 	&clear_states_parser,
1850 	&set_statusif_parser,
1851 	&natlook_parser,
1852 	&set_debug_parser,
1853 	&set_timeout_parser,
1854 	&set_limit_parser,
1855 	&pool_addr_parser,
1856 	&add_addr_parser,
1857 	&ruleset_parser,
1858 	&table_parser,
1859 };
1860 
1861 static int family_id;
1862 
1863 static const struct genl_cmd pf_cmds[] = {
1864 	{
1865 		.cmd_num = PFNL_CMD_GETSTATES,
1866 		.cmd_name = "GETSTATES",
1867 		.cmd_cb = pf_handle_getstates,
1868 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1869 		.cmd_priv = PRIV_NETINET_PF,
1870 	},
1871 	{
1872 		.cmd_num = PFNL_CMD_GETCREATORS,
1873 		.cmd_name = "GETCREATORS",
1874 		.cmd_cb = pf_handle_getcreators,
1875 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1876 		.cmd_priv = PRIV_NETINET_PF,
1877 	},
1878 	{
1879 		.cmd_num = PFNL_CMD_START,
1880 		.cmd_name = "START",
1881 		.cmd_cb = pf_handle_start,
1882 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
1883 		.cmd_priv = PRIV_NETINET_PF,
1884 	},
1885 	{
1886 		.cmd_num = PFNL_CMD_STOP,
1887 		.cmd_name = "STOP",
1888 		.cmd_cb = pf_handle_stop,
1889 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
1890 		.cmd_priv = PRIV_NETINET_PF,
1891 	},
1892 	{
1893 		.cmd_num = PFNL_CMD_ADDRULE,
1894 		.cmd_name = "ADDRULE",
1895 		.cmd_cb = pf_handle_addrule,
1896 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1897 		.cmd_priv = PRIV_NETINET_PF,
1898 	},
1899 	{
1900 		.cmd_num = PFNL_CMD_GETRULES,
1901 		.cmd_name = "GETRULES",
1902 		.cmd_cb = pf_handle_getrules,
1903 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1904 		.cmd_priv = PRIV_NETINET_PF,
1905 	},
1906 	{
1907 		.cmd_num = PFNL_CMD_GETRULE,
1908 		.cmd_name = "GETRULE",
1909 		.cmd_cb = pf_handle_getrule,
1910 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1911 		.cmd_priv = PRIV_NETINET_PF,
1912 	},
1913 	{
1914 		.cmd_num = PFNL_CMD_CLRSTATES,
1915 		.cmd_name = "CLRSTATES",
1916 		.cmd_cb = pf_handle_clear_states,
1917 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1918 		.cmd_priv = PRIV_NETINET_PF,
1919 	},
1920 	{
1921 		.cmd_num = PFNL_CMD_KILLSTATES,
1922 		.cmd_name = "KILLSTATES",
1923 		.cmd_cb = pf_handle_kill_states,
1924 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1925 		.cmd_priv = PRIV_NETINET_PF,
1926 	},
1927 	{
1928 		.cmd_num = PFNL_CMD_SET_STATUSIF,
1929 		.cmd_name = "SETSTATUSIF",
1930 		.cmd_cb = pf_handle_set_statusif,
1931 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
1932 		.cmd_priv = PRIV_NETINET_PF,
1933 	},
1934 	{
1935 		.cmd_num = PFNL_CMD_GET_STATUS,
1936 		.cmd_name = "GETSTATUS",
1937 		.cmd_cb = pf_handle_get_status,
1938 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1939 		.cmd_priv = PRIV_NETINET_PF,
1940 	},
1941 	{
1942 		.cmd_num = PFNL_CMD_CLEAR_STATUS,
1943 		.cmd_name = "CLEARSTATUS",
1944 		.cmd_cb = pf_handle_clear_status,
1945 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
1946 		.cmd_priv = PRIV_NETINET_PF,
1947 	},
1948 	{
1949 		.cmd_num = PFNL_CMD_NATLOOK,
1950 		.cmd_name = "NATLOOK",
1951 		.cmd_cb = pf_handle_natlook,
1952 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1953 		.cmd_priv = PRIV_NETINET_PF,
1954 	},
1955 	{
1956 		.cmd_num = PFNL_CMD_SET_DEBUG,
1957 		.cmd_name = "SET_DEBUG",
1958 		.cmd_cb = pf_handle_set_debug,
1959 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
1960 		.cmd_priv = PRIV_NETINET_PF,
1961 	},
1962 	{
1963 		.cmd_num = PFNL_CMD_SET_TIMEOUT,
1964 		.cmd_name = "SET_TIMEOUT",
1965 		.cmd_cb = pf_handle_set_timeout,
1966 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
1967 		.cmd_priv = PRIV_NETINET_PF,
1968 	},
1969 	{
1970 		.cmd_num = PFNL_CMD_GET_TIMEOUT,
1971 		.cmd_name = "GET_TIMEOUT",
1972 		.cmd_cb = pf_handle_get_timeout,
1973 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1974 		.cmd_priv = PRIV_NETINET_PF,
1975 	},
1976 	{
1977 		.cmd_num = PFNL_CMD_SET_LIMIT,
1978 		.cmd_name = "SET_LIMIT",
1979 		.cmd_cb = pf_handle_set_limit,
1980 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
1981 		.cmd_priv = PRIV_NETINET_PF,
1982 	},
1983 	{
1984 		.cmd_num = PFNL_CMD_GET_LIMIT,
1985 		.cmd_name = "GET_LIMIT",
1986 		.cmd_cb = pf_handle_get_limit,
1987 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1988 		.cmd_priv = PRIV_NETINET_PF,
1989 	},
1990 	{
1991 		.cmd_num = PFNL_CMD_BEGIN_ADDRS,
1992 		.cmd_name = "BEGIN_ADDRS",
1993 		.cmd_cb = pf_handle_begin_addrs,
1994 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
1995 		.cmd_priv = PRIV_NETINET_PF,
1996 	},
1997 	{
1998 		.cmd_num = PFNL_CMD_ADD_ADDR,
1999 		.cmd_name = "ADD_ADDR",
2000 		.cmd_cb = pf_handle_add_addr,
2001 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
2002 		.cmd_priv = PRIV_NETINET_PF,
2003 	},
2004 	{
2005 		.cmd_num = PFNL_CMD_GET_ADDRS,
2006 		.cmd_name = "GET_ADDRS",
2007 		.cmd_cb = pf_handle_get_addrs,
2008 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
2009 		.cmd_priv = PRIV_NETINET_PF,
2010 	},
2011 	{
2012 		.cmd_num = PFNL_CMD_GET_ADDR,
2013 		.cmd_name = "GET_ADDRS",
2014 		.cmd_cb = pf_handle_get_addr,
2015 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
2016 		.cmd_priv = PRIV_NETINET_PF,
2017 	},
2018 	{
2019 		.cmd_num = PFNL_CMD_GET_RULESETS,
2020 		.cmd_name = "GET_RULESETS",
2021 		.cmd_cb = pf_handle_get_rulesets,
2022 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
2023 		.cmd_priv = PRIV_NETINET_PF,
2024 	},
2025 	{
2026 		.cmd_num = PFNL_CMD_GET_RULESET,
2027 		.cmd_name = "GET_RULESET",
2028 		.cmd_cb = pf_handle_get_ruleset,
2029 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
2030 		.cmd_priv = PRIV_NETINET_PF,
2031 	},
2032 	{
2033 		.cmd_num = PFNL_CMD_GET_SRCNODES,
2034 		.cmd_name = "GET_SRCNODES",
2035 		.cmd_cb = pf_handle_get_srcnodes,
2036 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
2037 		.cmd_priv = PRIV_NETINET_PF,
2038 	},
2039 	{
2040 		.cmd_num = PFNL_CMD_CLEAR_TABLES,
2041 		.cmd_name = "CLEAR_TABLES",
2042 		.cmd_cb = pf_handle_clear_tables,
2043 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
2044 		.cmd_priv = PRIV_NETINET_PF,
2045 	},
2046 };
2047 
2048 void
2049 pf_nl_register(void)
2050 {
2051 	NL_VERIFY_PARSERS(all_parsers);
2052 
2053 	family_id = genl_register_family(PFNL_FAMILY_NAME, 0, 2, PFNL_CMD_MAX);
2054 	genl_register_cmds(PFNL_FAMILY_NAME, pf_cmds, nitems(pf_cmds));
2055 }
2056 
2057 void
2058 pf_nl_unregister(void)
2059 {
2060 	genl_unregister_family(PFNL_FAMILY_NAME);
2061 }
2062