1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2023 Alexander V. Chernikov <melifaro@FreeBSD.org> 5 * Copyright (c) 2023 Rubicon Communications, LLC (Netgate) 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 * 28 */ 29 #include <sys/cdefs.h> 30 #include "opt_inet.h" 31 #include "opt_inet6.h" 32 33 #include <sys/param.h> 34 #include <sys/malloc.h> 35 #include <sys/mbuf.h> 36 #include <sys/priv.h> 37 #include <sys/socket.h> 38 #include <sys/ucred.h> 39 40 #include <net/pfvar.h> 41 42 #include <netlink/netlink.h> 43 #include <netlink/netlink_ctl.h> 44 #include <netlink/netlink_generic.h> 45 #include <netlink/netlink_message_writer.h> 46 47 #include <netpfil/pf/pf_nl.h> 48 49 #define DEBUG_MOD_NAME nl_pf 50 #define DEBUG_MAX_LEVEL LOG_DEBUG3 51 #include <netlink/netlink_debug.h> 52 _DECLARE_DEBUG(LOG_DEBUG); 53 54 struct nl_parsed_state { 55 uint8_t version; 56 uint32_t id; 57 uint32_t creatorid; 58 char ifname[IFNAMSIZ]; 59 uint16_t proto; 60 sa_family_t af; 61 struct pf_addr addr; 62 struct pf_addr mask; 63 }; 64 65 #define _IN(_field) offsetof(struct genlmsghdr, _field) 66 #define _OUT(_field) offsetof(struct nl_parsed_state, _field) 67 static const struct nlattr_parser nla_p_state[] = { 68 { .type = PF_ST_ID, .off = _OUT(id), .cb = nlattr_get_uint32 }, 69 { .type = PF_ST_CREATORID, .off = _OUT(creatorid), .cb = nlattr_get_uint32 }, 70 { .type = PF_ST_IFNAME, .arg = (const void *)IFNAMSIZ, .off = _OUT(ifname), .cb = nlattr_get_chara }, 71 { .type = PF_ST_AF, .off = _OUT(af), .cb = nlattr_get_uint8 }, 72 { .type = PF_ST_PROTO, .off = _OUT(proto), .cb = nlattr_get_uint16 }, 73 { .type = PF_ST_FILTER_ADDR, .off = _OUT(addr), .cb = nlattr_get_in6_addr }, 74 { .type = PF_ST_FILTER_MASK, .off = _OUT(mask), .cb = nlattr_get_in6_addr }, 75 }; 76 static const struct nlfield_parser nlf_p_generic[] = { 77 { .off_in = _IN(version), .off_out = _OUT(version), .cb = nlf_get_u8 }, 78 }; 79 #undef _IN 80 #undef _OUT 81 NL_DECLARE_PARSER(state_parser, struct genlmsghdr, nlf_p_generic, nla_p_state); 82 83 static void 84 dump_addr(struct nl_writer *nw, int attr, const struct pf_addr *addr, int af) 85 { 86 switch (af) { 87 case AF_INET: 88 nlattr_add(nw, attr, 4, &addr->v4); 89 break; 90 case AF_INET6: 91 nlattr_add(nw, attr, 16, &addr->v6); 92 break; 93 }; 94 } 95 96 static bool 97 dump_state_peer(struct nl_writer *nw, int attr, const struct pf_state_peer *peer) 98 { 99 int off = nlattr_add_nested(nw, attr); 100 if (off == 0) 101 return (false); 102 103 nlattr_add_u32(nw, PF_STP_SEQLO, peer->seqlo); 104 nlattr_add_u32(nw, PF_STP_SEQHI, peer->seqhi); 105 nlattr_add_u32(nw, PF_STP_SEQDIFF, peer->seqdiff); 106 nlattr_add_u16(nw, PF_STP_MAX_WIN, peer->max_win); 107 nlattr_add_u16(nw, PF_STP_MSS, peer->mss); 108 nlattr_add_u8(nw, PF_STP_STATE, peer->state); 109 nlattr_add_u8(nw, PF_STP_WSCALE, peer->wscale); 110 111 if (peer->scrub != NULL) { 112 struct pf_state_scrub *sc = peer->scrub; 113 uint16_t pfss_flags = sc->pfss_flags & PFSS_TIMESTAMP; 114 115 nlattr_add_u16(nw, PF_STP_PFSS_FLAGS, pfss_flags); 116 nlattr_add_u32(nw, PF_STP_PFSS_TS_MOD, sc->pfss_ts_mod); 117 nlattr_add_u8(nw, PF_STP_PFSS_TTL, sc->pfss_ttl); 118 nlattr_add_u8(nw, PF_STP_SCRUB_FLAG, PFSYNC_SCRUB_FLAG_VALID); 119 } 120 nlattr_set_len(nw, off); 121 122 return (true); 123 } 124 125 static bool 126 dump_state_key(struct nl_writer *nw, int attr, const struct pf_state_key *key) 127 { 128 int off = nlattr_add_nested(nw, attr); 129 if (off == 0) 130 return (false); 131 132 dump_addr(nw, PF_STK_ADDR0, &key->addr[0], key->af); 133 dump_addr(nw, PF_STK_ADDR1, &key->addr[1], key->af); 134 nlattr_add_u16(nw, PF_STK_PORT0, key->port[0]); 135 nlattr_add_u16(nw, PF_STK_PORT1, key->port[1]); 136 137 nlattr_set_len(nw, off); 138 139 return (true); 140 } 141 142 static int 143 dump_state(struct nlpcb *nlp, const struct nlmsghdr *hdr, struct pf_kstate *s, 144 struct nl_pstate *npt) 145 { 146 struct nl_writer *nw = npt->nw; 147 int error = 0; 148 int af; 149 struct pf_state_key *key; 150 151 PF_STATE_LOCK_ASSERT(s); 152 153 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 154 goto enomem; 155 156 struct genlmsghdr *ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 157 ghdr_new->cmd = PFNL_CMD_GETSTATES; 158 ghdr_new->version = 0; 159 ghdr_new->reserved = 0; 160 161 nlattr_add_u64(nw, PF_ST_VERSION, PF_STATE_VERSION); 162 163 key = s->key[PF_SK_WIRE]; 164 if (!dump_state_key(nw, PF_ST_KEY_WIRE, key)) 165 goto enomem; 166 key = s->key[PF_SK_STACK]; 167 if (!dump_state_key(nw, PF_ST_KEY_STACK, key)) 168 goto enomem; 169 170 af = s->key[PF_SK_WIRE]->af; 171 nlattr_add_u8(nw, PF_ST_PROTO, s->key[PF_SK_WIRE]->proto); 172 nlattr_add_u8(nw, PF_ST_AF, af); 173 174 nlattr_add_string(nw, PF_ST_IFNAME, s->kif->pfik_name); 175 nlattr_add_string(nw, PF_ST_ORIG_IFNAME, s->orig_kif->pfik_name); 176 dump_addr(nw, PF_ST_RT_ADDR, &s->act.rt_addr, af); 177 nlattr_add_u32(nw, PF_ST_CREATION, time_uptime - (s->creation / 1000)); 178 uint32_t expire = pf_state_expires(s); 179 if (expire > time_uptime) 180 expire = expire - time_uptime; 181 nlattr_add_u32(nw, PF_ST_EXPIRE, expire); 182 nlattr_add_u8(nw, PF_ST_DIRECTION, s->direction); 183 nlattr_add_u8(nw, PF_ST_LOG, s->act.log); 184 nlattr_add_u8(nw, PF_ST_TIMEOUT, s->timeout); 185 nlattr_add_u16(nw, PF_ST_STATE_FLAGS, s->state_flags); 186 uint8_t sync_flags = 0; 187 if (s->src_node) 188 sync_flags |= PFSYNC_FLAG_SRCNODE; 189 if (s->nat_src_node) 190 sync_flags |= PFSYNC_FLAG_NATSRCNODE; 191 nlattr_add_u8(nw, PF_ST_SYNC_FLAGS, sync_flags); 192 nlattr_add_u64(nw, PF_ST_ID, s->id); 193 nlattr_add_u32(nw, PF_ST_CREATORID, htonl(s->creatorid)); 194 195 nlattr_add_u32(nw, PF_ST_RULE, s->rule ? s->rule->nr : -1); 196 nlattr_add_u32(nw, PF_ST_ANCHOR, s->anchor ? s->anchor->nr : -1); 197 nlattr_add_u32(nw, PF_ST_NAT_RULE, s->nat_rule ? s->nat_rule->nr : -1); 198 199 nlattr_add_u64(nw, PF_ST_PACKETS0, s->packets[0]); 200 nlattr_add_u64(nw, PF_ST_PACKETS1, s->packets[1]); 201 nlattr_add_u64(nw, PF_ST_BYTES0, s->bytes[0]); 202 nlattr_add_u64(nw, PF_ST_BYTES1, s->bytes[1]); 203 nlattr_add_u32(nw, PF_ST_RTABLEID, s->act.rtableid); 204 nlattr_add_u8(nw, PF_ST_MIN_TTL, s->act.min_ttl); 205 nlattr_add_u16(nw, PF_ST_MAX_MSS, s->act.max_mss); 206 nlattr_add_u16(nw, PF_ST_DNPIPE, s->act.dnpipe); 207 nlattr_add_u16(nw, PF_ST_DNRPIPE, s->act.dnrpipe); 208 nlattr_add_u8(nw, PF_ST_RT, s->act.rt); 209 if (s->act.rt_kif != NULL) 210 nlattr_add_string(nw, PF_ST_RT_IFNAME, s->act.rt_kif->pfik_name); 211 212 if (!dump_state_peer(nw, PF_ST_PEER_SRC, &s->src)) 213 goto enomem; 214 if (!dump_state_peer(nw, PF_ST_PEER_DST, &s->dst)) 215 goto enomem; 216 217 if (nlmsg_end(nw)) 218 return (0); 219 220 enomem: 221 error = ENOMEM; 222 nlmsg_abort(nw); 223 return (error); 224 } 225 226 static int 227 handle_dumpstates(struct nlpcb *nlp, struct nl_parsed_state *attrs, 228 struct nlmsghdr *hdr, struct nl_pstate *npt) 229 { 230 int error = 0; 231 232 hdr->nlmsg_flags |= NLM_F_MULTI; 233 234 for (int i = 0; i <= V_pf_hashmask; i++) { 235 struct pf_idhash *ih = &V_pf_idhash[i]; 236 struct pf_kstate *s; 237 238 if (LIST_EMPTY(&ih->states)) 239 continue; 240 241 PF_HASHROW_LOCK(ih); 242 LIST_FOREACH(s, &ih->states, entry) { 243 sa_family_t af = s->key[PF_SK_WIRE]->af; 244 245 if (s->timeout == PFTM_UNLINKED) 246 continue; 247 248 /* Filter */ 249 if (attrs->creatorid != 0 && s->creatorid != attrs->creatorid) 250 continue; 251 if (attrs->ifname[0] != 0 && 252 strncmp(attrs->ifname, s->kif->pfik_name, IFNAMSIZ) != 0) 253 continue; 254 if (attrs->proto != 0 && s->key[PF_SK_WIRE]->proto != attrs->proto) 255 continue; 256 if (attrs->af != 0 && af != attrs->af) 257 continue; 258 if (pf_match_addr(1, &s->key[PF_SK_WIRE]->addr[0], 259 &attrs->mask, &attrs->addr, af) && 260 pf_match_addr(1, &s->key[PF_SK_WIRE]->addr[1], 261 &attrs->mask, &attrs->addr, af) && 262 pf_match_addr(1, &s->key[PF_SK_STACK]->addr[0], 263 &attrs->mask, &attrs->addr, af) && 264 pf_match_addr(1, &s->key[PF_SK_STACK]->addr[1], 265 &attrs->mask, &attrs->addr, af)) 266 continue; 267 268 error = dump_state(nlp, hdr, s, npt); 269 if (error != 0) 270 break; 271 } 272 PF_HASHROW_UNLOCK(ih); 273 } 274 275 if (!nlmsg_end_dump(npt->nw, error, hdr)) { 276 NL_LOG(LOG_DEBUG, "Unable to finalize the dump"); 277 return (ENOMEM); 278 } 279 280 return (error); 281 } 282 283 static int 284 handle_getstate(struct nlpcb *nlp, struct nl_parsed_state *attrs, 285 struct nlmsghdr *hdr, struct nl_pstate *npt) 286 { 287 struct pf_kstate *s; 288 int ret; 289 290 s = pf_find_state_byid(attrs->id, attrs->creatorid); 291 if (s == NULL) 292 return (ENOENT); 293 ret = dump_state(nlp, hdr, s, npt); 294 PF_STATE_UNLOCK(s); 295 296 return (ret); 297 } 298 299 static int 300 dump_creatorid(struct nlpcb *nlp, const struct nlmsghdr *hdr, uint32_t creator, 301 struct nl_pstate *npt) 302 { 303 struct nl_writer *nw = npt->nw; 304 305 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 306 goto enomem; 307 308 struct genlmsghdr *ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 309 ghdr_new->cmd = PFNL_CMD_GETCREATORS; 310 ghdr_new->version = 0; 311 ghdr_new->reserved = 0; 312 313 nlattr_add_u32(nw, PF_ST_CREATORID, htonl(creator)); 314 315 if (nlmsg_end(nw)) 316 return (0); 317 318 enomem: 319 nlmsg_abort(nw); 320 return (ENOMEM); 321 } 322 323 static int 324 pf_handle_getstates(struct nlmsghdr *hdr, struct nl_pstate *npt) 325 { 326 int error; 327 328 struct nl_parsed_state attrs = {}; 329 error = nl_parse_nlmsg(hdr, &state_parser, npt, &attrs); 330 if (error != 0) 331 return (error); 332 333 if (attrs.id != 0) 334 error = handle_getstate(npt->nlp, &attrs, hdr, npt); 335 else 336 error = handle_dumpstates(npt->nlp, &attrs, hdr, npt); 337 338 return (error); 339 } 340 341 static int 342 pf_handle_getcreators(struct nlmsghdr *hdr, struct nl_pstate *npt) 343 { 344 uint32_t creators[16]; 345 int error = 0; 346 347 bzero(creators, sizeof(creators)); 348 349 for (int i = 0; i < V_pf_hashmask; i++) { 350 struct pf_idhash *ih = &V_pf_idhash[i]; 351 struct pf_kstate *s; 352 353 if (LIST_EMPTY(&ih->states)) 354 continue; 355 356 PF_HASHROW_LOCK(ih); 357 LIST_FOREACH(s, &ih->states, entry) { 358 int j; 359 if (s->timeout == PFTM_UNLINKED) 360 continue; 361 362 for (j = 0; j < nitems(creators); j++) { 363 if (creators[j] == s->creatorid) 364 break; 365 if (creators[j] == 0) { 366 creators[j] = s->creatorid; 367 break; 368 } 369 } 370 if (j == nitems(creators)) 371 printf("Warning: too many creators!\n"); 372 } 373 PF_HASHROW_UNLOCK(ih); 374 } 375 376 hdr->nlmsg_flags |= NLM_F_MULTI; 377 for (int i = 0; i < nitems(creators); i++) { 378 if (creators[i] == 0) 379 break; 380 error = dump_creatorid(npt->nlp, hdr, creators[i], npt); 381 } 382 383 if (!nlmsg_end_dump(npt->nw, error, hdr)) { 384 NL_LOG(LOG_DEBUG, "Unable to finalize the dump"); 385 return (ENOMEM); 386 } 387 388 return (error); 389 } 390 391 static int 392 pf_handle_start(struct nlmsghdr *hdr __unused, struct nl_pstate *npt __unused) 393 { 394 return (pf_start()); 395 } 396 397 static int 398 pf_handle_stop(struct nlmsghdr *hdr __unused, struct nl_pstate *npt __unused) 399 { 400 return (pf_stop()); 401 } 402 403 #define _OUT(_field) offsetof(struct pf_addr_wrap, _field) 404 static const struct nlattr_parser nla_p_addr_wrap[] = { 405 { .type = PF_AT_ADDR, .off = _OUT(v.a.addr), .cb = nlattr_get_in6_addr }, 406 { .type = PF_AT_MASK, .off = _OUT(v.a.mask), .cb = nlattr_get_in6_addr }, 407 { .type = PF_AT_IFNAME, .off = _OUT(v.ifname), .arg = (void *)IFNAMSIZ,.cb = nlattr_get_chara }, 408 { .type = PF_AT_TABLENAME, .off = _OUT(v.tblname), .arg = (void *)PF_TABLE_NAME_SIZE, .cb = nlattr_get_chara }, 409 { .type = PF_AT_TYPE, .off = _OUT(type), .cb = nlattr_get_uint8 }, 410 { .type = PF_AT_IFLAGS, .off = _OUT(iflags), .cb = nlattr_get_uint8 }, 411 }; 412 NL_DECLARE_ATTR_PARSER(addr_wrap_parser, nla_p_addr_wrap); 413 #undef _OUT 414 415 static bool 416 nlattr_add_addr_wrap(struct nl_writer *nw, int attrtype, struct pf_addr_wrap *a) 417 { 418 int off = nlattr_add_nested(nw, attrtype); 419 420 nlattr_add_in6_addr(nw, PF_AT_ADDR, &a->v.a.addr.v6); 421 nlattr_add_in6_addr(nw, PF_AT_MASK, &a->v.a.mask.v6); 422 nlattr_add_u8(nw, PF_AT_TYPE, a->type); 423 nlattr_add_u8(nw, PF_AT_IFLAGS, a->iflags); 424 425 if (a->type == PF_ADDR_DYNIFTL) { 426 nlattr_add_string(nw, PF_AT_IFNAME, a->v.ifname); 427 nlattr_add_u32(nw, PF_AT_DYNCNT, a->p.dyncnt); 428 } else if (a->type == PF_ADDR_TABLE) { 429 nlattr_add_string(nw, PF_AT_TABLENAME, a->v.tblname); 430 nlattr_add_u32(nw, PF_AT_TBLCNT, a->p.tblcnt); 431 } 432 433 nlattr_set_len(nw, off); 434 435 return (true); 436 } 437 438 #define _OUT(_field) offsetof(struct pf_rule_addr, _field) 439 static const struct nlattr_parser nla_p_ruleaddr[] = { 440 { .type = PF_RAT_ADDR, .off = _OUT(addr), .arg = &addr_wrap_parser, .cb = nlattr_get_nested }, 441 { .type = PF_RAT_SRC_PORT, .off = _OUT(port[0]), .cb = nlattr_get_uint16 }, 442 { .type = PF_RAT_DST_PORT, .off = _OUT(port[1]), .cb = nlattr_get_uint16 }, 443 { .type = PF_RAT_NEG, .off = _OUT(neg), .cb = nlattr_get_uint8 }, 444 { .type = PF_RAT_OP, .off = _OUT(port_op), .cb = nlattr_get_uint8 }, 445 }; 446 NL_DECLARE_ATTR_PARSER(rule_addr_parser, nla_p_ruleaddr); 447 #undef _OUT 448 449 static bool 450 nlattr_add_rule_addr(struct nl_writer *nw, int attrtype, struct pf_rule_addr *r) 451 { 452 struct pf_addr_wrap aw = {0}; 453 int off = nlattr_add_nested(nw, attrtype); 454 455 bcopy(&(r->addr), &aw, sizeof(struct pf_addr_wrap)); 456 pf_addr_copyout(&aw); 457 458 nlattr_add_addr_wrap(nw, PF_RAT_ADDR, &aw); 459 nlattr_add_u16(nw, PF_RAT_SRC_PORT, r->port[0]); 460 nlattr_add_u16(nw, PF_RAT_DST_PORT, r->port[1]); 461 nlattr_add_u8(nw, PF_RAT_NEG, r->neg); 462 nlattr_add_u8(nw, PF_RAT_OP, r->port_op); 463 464 nlattr_set_len(nw, off); 465 466 return (true); 467 } 468 469 #define _OUT(_field) offsetof(struct pf_mape_portset, _field) 470 static const struct nlattr_parser nla_p_mape_portset[] = { 471 { .type = PF_MET_OFFSET, .off = _OUT(offset), .cb = nlattr_get_uint8 }, 472 { .type = PF_MET_PSID_LEN, .off = _OUT(psidlen), .cb = nlattr_get_uint8 }, 473 {. type = PF_MET_PSID, .off = _OUT(psid), .cb = nlattr_get_uint16 }, 474 }; 475 NL_DECLARE_ATTR_PARSER(mape_portset_parser, nla_p_mape_portset); 476 #undef _OUT 477 478 static bool 479 nlattr_add_mape_portset(struct nl_writer *nw, int attrtype, const struct pf_mape_portset *m) 480 { 481 int off = nlattr_add_nested(nw, attrtype); 482 483 nlattr_add_u8(nw, PF_MET_OFFSET, m->offset); 484 nlattr_add_u8(nw, PF_MET_PSID_LEN, m->psidlen); 485 nlattr_add_u16(nw, PF_MET_PSID, m->psid); 486 487 nlattr_set_len(nw, off); 488 489 return (true); 490 } 491 492 struct nl_parsed_labels 493 { 494 char labels[PF_RULE_MAX_LABEL_COUNT][PF_RULE_LABEL_SIZE]; 495 uint32_t i; 496 }; 497 498 static int 499 nlattr_get_pf_rule_labels(struct nlattr *nla, struct nl_pstate *npt, 500 const void *arg, void *target) 501 { 502 struct nl_parsed_labels *l = (struct nl_parsed_labels *)target; 503 int ret; 504 505 if (l->i >= PF_RULE_MAX_LABEL_COUNT) 506 return (E2BIG); 507 508 ret = nlattr_get_chara(nla, npt, (void *)PF_RULE_LABEL_SIZE, 509 l->labels[l->i]); 510 if (ret == 0) 511 l->i++; 512 513 return (ret); 514 } 515 516 #define _OUT(_field) offsetof(struct nl_parsed_labels, _field) 517 static const struct nlattr_parser nla_p_labels[] = { 518 { .type = PF_LT_LABEL, .off = 0, .cb = nlattr_get_pf_rule_labels }, 519 }; 520 NL_DECLARE_ATTR_PARSER(rule_labels_parser, nla_p_labels); 521 #undef _OUT 522 523 static int 524 nlattr_get_nested_pf_rule_labels(struct nlattr *nla, struct nl_pstate *npt, const void *arg, void *target) 525 { 526 struct nl_parsed_labels parsed_labels = { }; 527 int error; 528 529 /* Assumes target points to the beginning of the structure */ 530 error = nl_parse_header(NLA_DATA(nla), NLA_DATA_LEN(nla), &rule_labels_parser, npt, &parsed_labels); 531 if (error != 0) 532 return (error); 533 534 memcpy(target, parsed_labels.labels, sizeof(parsed_labels.labels)); 535 536 return (0); 537 } 538 539 static bool 540 nlattr_add_labels(struct nl_writer *nw, int attrtype, const struct pf_krule *r) 541 { 542 int off = nlattr_add_nested(nw, attrtype); 543 int i = 0; 544 545 while (r->label[i][0] != 0 546 && i < PF_RULE_MAX_LABEL_COUNT) { 547 nlattr_add_string(nw, PF_LT_LABEL, r->label[i]); 548 i++; 549 } 550 551 nlattr_set_len(nw, off); 552 553 return (true); 554 } 555 556 #define _OUT(_field) offsetof(struct pf_kpool, _field) 557 static const struct nlattr_parser nla_p_pool[] = { 558 { .type = PF_PT_KEY, .off = _OUT(key), .arg = (void *)sizeof(struct pf_poolhashkey), .cb = nlattr_get_bytes }, 559 { .type = PF_PT_COUNTER, .off = _OUT(counter), .cb = nlattr_get_in6_addr }, 560 { .type = PF_PT_TBLIDX, .off = _OUT(tblidx), .cb = nlattr_get_uint32 }, 561 { .type = PF_PT_PROXY_SRC_PORT, .off = _OUT(proxy_port[0]), .cb = nlattr_get_uint16 }, 562 { .type = PF_PT_PROXY_DST_PORT, .off = _OUT(proxy_port[1]), .cb = nlattr_get_uint16 }, 563 { .type = PF_PT_OPTS, .off = _OUT(opts), .cb = nlattr_get_uint8 }, 564 { .type = PF_PT_MAPE, .off = _OUT(mape), .arg = &mape_portset_parser, .cb = nlattr_get_nested }, 565 }; 566 NL_DECLARE_ATTR_PARSER(pool_parser, nla_p_pool); 567 #undef _OUT 568 569 static bool 570 nlattr_add_pool(struct nl_writer *nw, int attrtype, const struct pf_kpool *pool) 571 { 572 int off = nlattr_add_nested(nw, attrtype); 573 574 nlattr_add(nw, PF_PT_KEY, sizeof(struct pf_poolhashkey), &pool->key); 575 nlattr_add_in6_addr(nw, PF_PT_COUNTER, (const struct in6_addr *)&pool->counter); 576 nlattr_add_u32(nw, PF_PT_TBLIDX, pool->tblidx); 577 nlattr_add_u16(nw, PF_PT_PROXY_SRC_PORT, pool->proxy_port[0]); 578 nlattr_add_u16(nw, PF_PT_PROXY_DST_PORT, pool->proxy_port[1]); 579 nlattr_add_u8(nw, PF_PT_OPTS, pool->opts); 580 nlattr_add_mape_portset(nw, PF_PT_MAPE, &pool->mape); 581 582 nlattr_set_len(nw, off); 583 584 return (true); 585 } 586 587 #define _OUT(_field) offsetof(struct pf_rule_uid, _field) 588 static const struct nlattr_parser nla_p_rule_uid[] = { 589 { .type = PF_RUT_UID_LOW, .off = _OUT(uid[0]), .cb = nlattr_get_uint32 }, 590 { .type = PF_RUT_UID_HIGH, .off = _OUT(uid[1]), .cb = nlattr_get_uint32 }, 591 { .type = PF_RUT_OP, .off = _OUT(op), .cb = nlattr_get_uint8 }, 592 }; 593 NL_DECLARE_ATTR_PARSER(rule_uid_parser, nla_p_rule_uid); 594 #undef _OUT 595 596 static bool 597 nlattr_add_rule_uid(struct nl_writer *nw, int attrtype, const struct pf_rule_uid *u) 598 { 599 int off = nlattr_add_nested(nw, attrtype); 600 601 nlattr_add_u32(nw, PF_RUT_UID_LOW, u->uid[0]); 602 nlattr_add_u32(nw, PF_RUT_UID_HIGH, u->uid[1]); 603 nlattr_add_u8(nw, PF_RUT_OP, u->op); 604 605 nlattr_set_len(nw, off); 606 607 return (true); 608 } 609 610 struct nl_parsed_timeouts 611 { 612 uint32_t timeouts[PFTM_MAX]; 613 uint32_t i; 614 }; 615 616 static int 617 nlattr_get_pf_timeout(struct nlattr *nla, struct nl_pstate *npt, 618 const void *arg, void *target) 619 { 620 struct nl_parsed_timeouts *t = (struct nl_parsed_timeouts *)target; 621 int ret; 622 623 if (t->i >= PFTM_MAX) 624 return (E2BIG); 625 626 ret = nlattr_get_uint32(nla, npt, NULL, &t->timeouts[t->i]); 627 if (ret == 0) 628 t->i++; 629 630 return (ret); 631 } 632 633 #define _OUT(_field) offsetof(struct nl_parsed_timeout, _field) 634 static const struct nlattr_parser nla_p_timeouts[] = { 635 { .type = PF_TT_TIMEOUT, .off = 0, .cb = nlattr_get_pf_timeout }, 636 }; 637 NL_DECLARE_ATTR_PARSER(timeout_parser, nla_p_timeouts); 638 #undef _OUT 639 640 static int 641 nlattr_get_nested_timeouts(struct nlattr *nla, struct nl_pstate *npt, const void *arg, void *target) 642 { 643 struct nl_parsed_timeouts parsed_timeouts = { }; 644 int error; 645 646 /* Assumes target points to the beginning of the structure */ 647 error = nl_parse_header(NLA_DATA(nla), NLA_DATA_LEN(nla), &timeout_parser, npt, &parsed_timeouts); 648 if (error != 0) 649 return (error); 650 651 memcpy(target, parsed_timeouts.timeouts, sizeof(parsed_timeouts.timeouts)); 652 653 return (0); 654 } 655 656 static bool 657 nlattr_add_timeout(struct nl_writer *nw, int attrtype, uint32_t *timeout) 658 { 659 int off = nlattr_add_nested(nw, attrtype); 660 661 for (int i = 0; i < PFTM_MAX; i++) 662 nlattr_add_u32(nw, PF_RT_TIMEOUT, timeout[i]); 663 664 nlattr_set_len(nw, off); 665 666 return (true); 667 } 668 669 #define _OUT(_field) offsetof(struct pf_krule, _field) 670 static const struct nlattr_parser nla_p_rule[] = { 671 { .type = PF_RT_SRC, .off = _OUT(src), .arg = &rule_addr_parser,.cb = nlattr_get_nested }, 672 { .type = PF_RT_DST, .off = _OUT(dst), .arg = &rule_addr_parser,.cb = nlattr_get_nested }, 673 { .type = PF_RT_RIDENTIFIER, .off = _OUT(ridentifier), .cb = nlattr_get_uint32 }, 674 { .type = PF_RT_LABELS, .off = _OUT(label), .arg = &rule_labels_parser,.cb = nlattr_get_nested_pf_rule_labels }, 675 { .type = PF_RT_IFNAME, .off = _OUT(ifname), .arg = (void *)IFNAMSIZ, .cb = nlattr_get_chara }, 676 { .type = PF_RT_QNAME, .off = _OUT(qname), .arg = (void *)PF_QNAME_SIZE, .cb = nlattr_get_chara }, 677 { .type = PF_RT_PQNAME, .off = _OUT(pqname), .arg = (void *)PF_QNAME_SIZE, .cb = nlattr_get_chara }, 678 { .type = PF_RT_TAGNAME, .off = _OUT(tagname), .arg = (void *)PF_TAG_NAME_SIZE, .cb = nlattr_get_chara }, 679 { .type = PF_RT_MATCH_TAGNAME, .off = _OUT(match_tagname), .arg = (void *)PF_TAG_NAME_SIZE, .cb = nlattr_get_chara }, 680 { .type = PF_RT_OVERLOAD_TBLNAME, .off = _OUT(overload_tblname), .arg = (void *)PF_TABLE_NAME_SIZE, .cb = nlattr_get_chara }, 681 { .type = PF_RT_RPOOL_RDR, .off = _OUT(rdr), .arg = &pool_parser, .cb = nlattr_get_nested }, 682 { .type = PF_RT_OS_FINGERPRINT, .off = _OUT(os_fingerprint), .cb = nlattr_get_uint32 }, 683 { .type = PF_RT_RTABLEID, .off = _OUT(rtableid), .cb = nlattr_get_uint32 }, 684 { .type = PF_RT_TIMEOUT, .off = _OUT(timeout), .arg = &timeout_parser, .cb = nlattr_get_nested_timeouts }, 685 { .type = PF_RT_MAX_STATES, .off = _OUT(max_states), .cb = nlattr_get_uint32 }, 686 { .type = PF_RT_MAX_SRC_NODES, .off = _OUT(max_src_nodes), .cb = nlattr_get_uint32 }, 687 { .type = PF_RT_MAX_SRC_STATES, .off = _OUT(max_src_states), .cb = nlattr_get_uint32 }, 688 { .type = PF_RT_MAX_SRC_CONN_RATE_LIMIT, .off = _OUT(max_src_conn_rate.limit), .cb = nlattr_get_uint32 }, 689 { .type = PF_RT_MAX_SRC_CONN_RATE_SECS, .off = _OUT(max_src_conn_rate.seconds), .cb = nlattr_get_uint32 }, 690 { .type = PF_RT_DNPIPE, .off = _OUT(dnpipe), .cb = nlattr_get_uint16 }, 691 { .type = PF_RT_DNRPIPE, .off = _OUT(dnrpipe), .cb = nlattr_get_uint16 }, 692 { .type = PF_RT_DNFLAGS, .off = _OUT(free_flags), .cb = nlattr_get_uint32 }, 693 { .type = PF_RT_NR, .off = _OUT(nr), .cb = nlattr_get_uint32 }, 694 { .type = PF_RT_PROB, .off = _OUT(prob), .cb = nlattr_get_uint32 }, 695 { .type = PF_RT_CUID, .off = _OUT(cuid), .cb = nlattr_get_uint32 }, 696 {. type = PF_RT_CPID, .off = _OUT(cpid), .cb = nlattr_get_uint32 }, 697 { .type = PF_RT_RETURN_ICMP, .off = _OUT(return_icmp), .cb = nlattr_get_uint16 }, 698 { .type = PF_RT_RETURN_ICMP6, .off = _OUT(return_icmp6), .cb = nlattr_get_uint16 }, 699 { .type = PF_RT_MAX_MSS, .off = _OUT(max_mss), .cb = nlattr_get_uint16 }, 700 { .type = PF_RT_SCRUB_FLAGS, .off = _OUT(scrub_flags), .cb = nlattr_get_uint16 }, 701 { .type = PF_RT_UID, .off = _OUT(uid), .arg = &rule_uid_parser, .cb = nlattr_get_nested }, 702 { .type = PF_RT_GID, .off = _OUT(gid), .arg = &rule_uid_parser, .cb = nlattr_get_nested }, 703 { .type = PF_RT_RULE_FLAG, .off = _OUT(rule_flag), .cb = nlattr_get_uint32 }, 704 { .type = PF_RT_ACTION, .off = _OUT(action), .cb = nlattr_get_uint8 }, 705 { .type = PF_RT_DIRECTION, .off = _OUT(direction), .cb = nlattr_get_uint8 }, 706 { .type = PF_RT_LOG, .off = _OUT(log), .cb = nlattr_get_uint8 }, 707 { .type = PF_RT_LOGIF, .off = _OUT(logif), .cb = nlattr_get_uint8 }, 708 { .type = PF_RT_QUICK, .off = _OUT(quick), .cb = nlattr_get_uint8 }, 709 { .type = PF_RT_IF_NOT, .off = _OUT(ifnot), .cb = nlattr_get_uint8 }, 710 { .type = PF_RT_MATCH_TAG_NOT, .off = _OUT(match_tag_not), .cb = nlattr_get_uint8 }, 711 { .type = PF_RT_NATPASS, .off = _OUT(natpass), .cb = nlattr_get_uint8 }, 712 { .type = PF_RT_KEEP_STATE, .off = _OUT(keep_state), .cb = nlattr_get_uint8 }, 713 { .type = PF_RT_AF, .off = _OUT(af), .cb = nlattr_get_uint8 }, 714 { .type = PF_RT_PROTO, .off = _OUT(proto), .cb = nlattr_get_uint8 }, 715 { .type = PF_RT_TYPE, .off = _OUT(type), .cb = nlattr_get_uint8 }, 716 { .type = PF_RT_CODE, .off = _OUT(code), .cb = nlattr_get_uint8 }, 717 { .type = PF_RT_FLAGS, .off = _OUT(flags), .cb = nlattr_get_uint8 }, 718 { .type = PF_RT_FLAGSET, .off = _OUT(flagset), .cb = nlattr_get_uint8 }, 719 { .type = PF_RT_MIN_TTL, .off = _OUT(min_ttl), .cb = nlattr_get_uint8 }, 720 { .type = PF_RT_ALLOW_OPTS, .off = _OUT(allow_opts), .cb = nlattr_get_uint8 }, 721 { .type = PF_RT_RT, .off = _OUT(rt), .cb = nlattr_get_uint8 }, 722 { .type = PF_RT_RETURN_TTL, .off = _OUT(return_ttl), .cb = nlattr_get_uint8 }, 723 { .type = PF_RT_TOS, .off = _OUT(tos), .cb = nlattr_get_uint8 }, 724 { .type = PF_RT_SET_TOS, .off = _OUT(set_tos), .cb = nlattr_get_uint8 }, 725 { .type = PF_RT_ANCHOR_RELATIVE, .off = _OUT(anchor_relative), .cb = nlattr_get_uint8 }, 726 { .type = PF_RT_ANCHOR_WILDCARD, .off = _OUT(anchor_wildcard), .cb = nlattr_get_uint8 }, 727 { .type = PF_RT_FLUSH, .off = _OUT(flush), .cb = nlattr_get_uint8 }, 728 { .type = PF_RT_PRIO, .off = _OUT(prio), .cb = nlattr_get_uint8 }, 729 { .type = PF_RT_SET_PRIO, .off = _OUT(set_prio[0]), .cb = nlattr_get_uint8 }, 730 { .type = PF_RT_SET_PRIO_REPLY, .off = _OUT(set_prio[1]), .cb = nlattr_get_uint8 }, 731 { .type = PF_RT_DIVERT_ADDRESS, .off = _OUT(divert.addr), .cb = nlattr_get_in6_addr }, 732 { .type = PF_RT_DIVERT_PORT, .off = _OUT(divert.port), .cb = nlattr_get_uint16 }, 733 { .type = PF_RT_RCV_IFNAME, .off = _OUT(rcv_ifname), .arg = (void *)IFNAMSIZ, .cb = nlattr_get_chara }, 734 { .type = PF_RT_MAX_SRC_CONN, .off = _OUT(max_src_conn), .cb = nlattr_get_uint32 }, 735 { .type = PF_RT_RPOOL_NAT, .off = _OUT(nat), .arg = &pool_parser, .cb = nlattr_get_nested }, 736 }; 737 NL_DECLARE_ATTR_PARSER(rule_parser, nla_p_rule); 738 #undef _OUT 739 struct nl_parsed_addrule { 740 struct pf_krule *rule; 741 uint32_t ticket; 742 uint32_t pool_ticket; 743 char *anchor; 744 char *anchor_call; 745 }; 746 #define _IN(_field) offsetof(struct genlmsghdr, _field) 747 #define _OUT(_field) offsetof(struct nl_parsed_addrule, _field) 748 static const struct nlattr_parser nla_p_addrule[] = { 749 { .type = PF_ART_TICKET, .off = _OUT(ticket), .cb = nlattr_get_uint32 }, 750 { .type = PF_ART_POOL_TICKET, .off = _OUT(pool_ticket), .cb = nlattr_get_uint32 }, 751 { .type = PF_ART_ANCHOR, .off = _OUT(anchor), .cb = nlattr_get_string }, 752 { .type = PF_ART_ANCHOR_CALL, .off = _OUT(anchor_call), .cb = nlattr_get_string }, 753 { .type = PF_ART_RULE, .off = _OUT(rule), .arg = &rule_parser, .cb = nlattr_get_nested_ptr } 754 }; 755 static const struct nlfield_parser nlf_p_addrule[] = { 756 }; 757 #undef _IN 758 #undef _OUT 759 NL_DECLARE_PARSER(addrule_parser, struct genlmsghdr, nlf_p_addrule, nla_p_addrule); 760 761 static int 762 pf_handle_addrule(struct nlmsghdr *hdr, struct nl_pstate *npt) 763 { 764 int error; 765 struct nl_parsed_addrule attrs = {}; 766 767 attrs.rule = pf_krule_alloc(); 768 769 error = nl_parse_nlmsg(hdr, &addrule_parser, npt, &attrs); 770 if (error != 0) { 771 pf_free_rule(attrs.rule); 772 return (error); 773 } 774 775 error = pf_ioctl_addrule(attrs.rule, attrs.ticket, attrs.pool_ticket, 776 attrs.anchor, attrs.anchor_call, nlp_get_cred(npt->nlp)->cr_uid, 777 hdr->nlmsg_pid); 778 779 return (error); 780 } 781 782 #define _IN(_field) offsetof(struct genlmsghdr, _field) 783 #define _OUT(_field) offsetof(struct pfioc_rule, _field) 784 static const struct nlattr_parser nla_p_getrules[] = { 785 { .type = PF_GR_ANCHOR, .off = _OUT(anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara }, 786 { .type = PF_GR_ACTION, .off = _OUT(rule.action), .cb = nlattr_get_uint8 }, 787 }; 788 static const struct nlfield_parser nlf_p_getrules[] = { 789 }; 790 #undef _IN 791 #undef _OUT 792 NL_DECLARE_PARSER(getrules_parser, struct genlmsghdr, nlf_p_getrules, nla_p_getrules); 793 794 static int 795 pf_handle_getrules(struct nlmsghdr *hdr, struct nl_pstate *npt) 796 { 797 struct pfioc_rule attrs = {}; 798 int error; 799 struct nl_writer *nw = npt->nw; 800 struct genlmsghdr *ghdr_new; 801 802 error = nl_parse_nlmsg(hdr, &getrules_parser, npt, &attrs); 803 if (error != 0) 804 return (error); 805 806 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 807 return (ENOMEM); 808 809 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 810 ghdr_new->cmd = PFNL_CMD_GETRULES; 811 ghdr_new->version = 0; 812 ghdr_new->reserved = 0; 813 814 error = pf_ioctl_getrules(&attrs); 815 if (error != 0) 816 goto out; 817 818 nlattr_add_u32(nw, PF_GR_NR, attrs.nr); 819 nlattr_add_u32(nw, PF_GR_TICKET, attrs.ticket); 820 821 if (!nlmsg_end(nw)) { 822 error = ENOMEM; 823 goto out; 824 } 825 826 return (0); 827 828 out: 829 nlmsg_abort(nw); 830 return (error); 831 } 832 833 struct nl_parsed_get_rule { 834 char anchor[MAXPATHLEN]; 835 uint8_t action; 836 uint32_t nr; 837 uint32_t ticket; 838 uint8_t clear; 839 }; 840 #define _IN(_field) offsetof(struct genlmsghdr, _field) 841 #define _OUT(_field) offsetof(struct nl_parsed_get_rule, _field) 842 static const struct nlattr_parser nla_p_getrule[] = { 843 { .type = PF_GR_ANCHOR, .off = _OUT(anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara }, 844 { .type = PF_GR_ACTION, .off = _OUT(action), .cb = nlattr_get_uint8 }, 845 { .type = PF_GR_NR, .off = _OUT(nr), .cb = nlattr_get_uint32 }, 846 { .type = PF_GR_TICKET, .off = _OUT(ticket), .cb = nlattr_get_uint32 }, 847 { .type = PF_GR_CLEAR, .off = _OUT(clear), .cb = nlattr_get_uint8 }, 848 }; 849 static const struct nlfield_parser nlf_p_getrule[] = { 850 }; 851 #undef _IN 852 #undef _OUT 853 NL_DECLARE_PARSER(getrule_parser, struct genlmsghdr, nlf_p_getrule, nla_p_getrule); 854 855 static int 856 pf_handle_getrule(struct nlmsghdr *hdr, struct nl_pstate *npt) 857 { 858 char anchor_call[MAXPATHLEN]; 859 struct nl_parsed_get_rule attrs = {}; 860 struct nl_writer *nw = npt->nw; 861 struct genlmsghdr *ghdr_new; 862 struct pf_kruleset *ruleset; 863 struct pf_krule *rule; 864 int rs_num; 865 int error; 866 867 error = nl_parse_nlmsg(hdr, &getrule_parser, npt, &attrs); 868 if (error != 0) 869 return (error); 870 871 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 872 return (ENOMEM); 873 874 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 875 ghdr_new->cmd = PFNL_CMD_GETRULE; 876 ghdr_new->version = 0; 877 ghdr_new->reserved = 0; 878 879 PF_RULES_WLOCK(); 880 ruleset = pf_find_kruleset(attrs.anchor); 881 if (ruleset == NULL) { 882 PF_RULES_WUNLOCK(); 883 error = ENOENT; 884 goto out; 885 } 886 887 rs_num = pf_get_ruleset_number(attrs.action); 888 if (rs_num >= PF_RULESET_MAX) { 889 PF_RULES_WUNLOCK(); 890 error = EINVAL; 891 goto out; 892 } 893 894 if (attrs.ticket != ruleset->rules[rs_num].active.ticket) { 895 PF_RULES_WUNLOCK(); 896 error = EBUSY; 897 goto out; 898 } 899 900 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 901 while ((rule != NULL) && (rule->nr != attrs.nr)) 902 rule = TAILQ_NEXT(rule, entries); 903 if (rule == NULL) { 904 PF_RULES_WUNLOCK(); 905 error = EBUSY; 906 goto out; 907 } 908 909 nlattr_add_rule_addr(nw, PF_RT_SRC, &rule->src); 910 nlattr_add_rule_addr(nw, PF_RT_DST, &rule->dst); 911 nlattr_add_u32(nw, PF_RT_RIDENTIFIER, rule->ridentifier); 912 nlattr_add_labels(nw, PF_RT_LABELS, rule); 913 nlattr_add_string(nw, PF_RT_IFNAME, rule->ifname); 914 nlattr_add_string(nw, PF_RT_QNAME, rule->qname); 915 nlattr_add_string(nw, PF_RT_PQNAME, rule->pqname); 916 nlattr_add_string(nw, PF_RT_TAGNAME, rule->tagname); 917 nlattr_add_string(nw, PF_RT_MATCH_TAGNAME, rule->match_tagname); 918 nlattr_add_string(nw, PF_RT_OVERLOAD_TBLNAME, rule->overload_tblname); 919 nlattr_add_pool(nw, PF_RT_RPOOL_RDR, &rule->rdr); 920 nlattr_add_pool(nw, PF_RT_RPOOL_NAT, &rule->nat); 921 nlattr_add_u32(nw, PF_RT_OS_FINGERPRINT, rule->os_fingerprint); 922 nlattr_add_u32(nw, PF_RT_RTABLEID, rule->rtableid); 923 nlattr_add_timeout(nw, PF_RT_TIMEOUT, rule->timeout); 924 nlattr_add_u32(nw, PF_RT_MAX_STATES, rule->max_states); 925 nlattr_add_u32(nw, PF_RT_MAX_SRC_NODES, rule->max_src_nodes); 926 nlattr_add_u32(nw, PF_RT_MAX_SRC_STATES, rule->max_src_states); 927 nlattr_add_u32(nw, PF_RT_MAX_SRC_CONN, rule->max_src_conn); 928 nlattr_add_u32(nw, PF_RT_MAX_SRC_CONN_RATE_LIMIT, rule->max_src_conn_rate.limit); 929 nlattr_add_u32(nw, PF_RT_MAX_SRC_CONN_RATE_SECS, rule->max_src_conn_rate.seconds); 930 931 nlattr_add_u16(nw, PF_RT_DNPIPE, rule->dnpipe); 932 nlattr_add_u16(nw, PF_RT_DNRPIPE, rule->dnrpipe); 933 nlattr_add_u32(nw, PF_RT_DNFLAGS, rule->free_flags); 934 935 nlattr_add_u32(nw, PF_RT_NR, rule->nr); 936 nlattr_add_u32(nw, PF_RT_PROB, rule->prob); 937 nlattr_add_u32(nw, PF_RT_CUID, rule->cuid); 938 nlattr_add_u32(nw, PF_RT_CPID, rule->cpid); 939 940 nlattr_add_u16(nw, PF_RT_RETURN_ICMP, rule->return_icmp); 941 nlattr_add_u16(nw, PF_RT_RETURN_ICMP6, rule->return_icmp6); 942 nlattr_add_u16(nw, PF_RT_RETURN_ICMP6, rule->return_icmp6); 943 nlattr_add_u16(nw, PF_RT_MAX_MSS, rule->max_mss); 944 nlattr_add_u16(nw, PF_RT_SCRUB_FLAGS, rule->scrub_flags); 945 946 nlattr_add_rule_uid(nw, PF_RT_UID, &rule->uid); 947 nlattr_add_rule_uid(nw, PF_RT_GID, (const struct pf_rule_uid *)&rule->gid); 948 949 nlattr_add_string(nw, PF_RT_RCV_IFNAME, rule->rcv_ifname); 950 951 nlattr_add_u32(nw, PF_RT_RULE_FLAG, rule->rule_flag); 952 nlattr_add_u8(nw, PF_RT_ACTION, rule->action); 953 nlattr_add_u8(nw, PF_RT_DIRECTION, rule->direction); 954 nlattr_add_u8(nw, PF_RT_LOG, rule->log); 955 nlattr_add_u8(nw, PF_RT_LOGIF, rule->logif); 956 nlattr_add_u8(nw, PF_RT_QUICK, rule->quick); 957 nlattr_add_u8(nw, PF_RT_IF_NOT, rule->ifnot); 958 nlattr_add_u8(nw, PF_RT_MATCH_TAG_NOT, rule->match_tag_not); 959 nlattr_add_u8(nw, PF_RT_NATPASS, rule->natpass); 960 nlattr_add_u8(nw, PF_RT_KEEP_STATE, rule->keep_state); 961 962 nlattr_add_u8(nw, PF_RT_AF, rule->af); 963 nlattr_add_u8(nw, PF_RT_PROTO, rule->proto); 964 nlattr_add_u8(nw, PF_RT_TYPE, rule->type); 965 nlattr_add_u8(nw, PF_RT_CODE, rule->code); 966 nlattr_add_u8(nw, PF_RT_FLAGS, rule->flags); 967 nlattr_add_u8(nw, PF_RT_FLAGSET, rule->flagset); 968 nlattr_add_u8(nw, PF_RT_MIN_TTL, rule->min_ttl); 969 nlattr_add_u8(nw, PF_RT_ALLOW_OPTS, rule->allow_opts); 970 nlattr_add_u8(nw, PF_RT_RT, rule->rt); 971 nlattr_add_u8(nw, PF_RT_RETURN_TTL, rule->return_ttl); 972 nlattr_add_u8(nw, PF_RT_TOS, rule->tos); 973 nlattr_add_u8(nw, PF_RT_SET_TOS, rule->set_tos); 974 nlattr_add_u8(nw, PF_RT_ANCHOR_RELATIVE, rule->anchor_relative); 975 nlattr_add_u8(nw, PF_RT_ANCHOR_WILDCARD, rule->anchor_wildcard); 976 nlattr_add_u8(nw, PF_RT_FLUSH, rule->flush); 977 nlattr_add_u8(nw, PF_RT_PRIO, rule->prio); 978 nlattr_add_u8(nw, PF_RT_SET_PRIO, rule->set_prio[0]); 979 nlattr_add_u8(nw, PF_RT_SET_PRIO_REPLY, rule->set_prio[1]); 980 981 nlattr_add_in6_addr(nw, PF_RT_DIVERT_ADDRESS, &rule->divert.addr.v6); 982 nlattr_add_u16(nw, PF_RT_DIVERT_PORT, rule->divert.port); 983 984 nlattr_add_u64(nw, PF_RT_PACKETS_IN, pf_counter_u64_fetch(&rule->packets[0])); 985 nlattr_add_u64(nw, PF_RT_PACKETS_OUT, pf_counter_u64_fetch(&rule->packets[1])); 986 nlattr_add_u64(nw, PF_RT_BYTES_IN, pf_counter_u64_fetch(&rule->bytes[0])); 987 nlattr_add_u64(nw, PF_RT_BYTES_OUT, pf_counter_u64_fetch(&rule->bytes[1])); 988 nlattr_add_u64(nw, PF_RT_EVALUATIONS, pf_counter_u64_fetch(&rule->evaluations)); 989 nlattr_add_u64(nw, PF_RT_TIMESTAMP, pf_get_timestamp(rule)); 990 nlattr_add_u64(nw, PF_RT_STATES_CUR, counter_u64_fetch(rule->states_cur)); 991 nlattr_add_u64(nw, PF_RT_STATES_TOTAL, counter_u64_fetch(rule->states_tot)); 992 nlattr_add_u64(nw, PF_RT_SRC_NODES, counter_u64_fetch(rule->src_nodes)); 993 994 error = pf_kanchor_copyout(ruleset, rule, anchor_call, sizeof(anchor_call)); 995 MPASS(error == 0); 996 997 nlattr_add_string(nw, PF_RT_ANCHOR_CALL, anchor_call); 998 999 if (attrs.clear) 1000 pf_krule_clear_counters(rule); 1001 1002 PF_RULES_WUNLOCK(); 1003 1004 if (!nlmsg_end(nw)) { 1005 error = ENOMEM; 1006 goto out; 1007 } 1008 1009 return (0); 1010 out: 1011 nlmsg_abort(nw); 1012 return (error); 1013 } 1014 1015 #define _IN(_field) offsetof(struct genlmsghdr, _field) 1016 #define _OUT(_field) offsetof(struct pf_kstate_kill, _field) 1017 static const struct nlattr_parser nla_p_clear_states[] = { 1018 { .type = PF_CS_CMP_ID, .off = _OUT(psk_pfcmp.id), .cb = nlattr_get_uint64 }, 1019 { .type = PF_CS_CMP_CREATORID, .off = _OUT(psk_pfcmp.creatorid), .cb = nlattr_get_uint32 }, 1020 { .type = PF_CS_CMP_DIR, .off = _OUT(psk_pfcmp.direction), .cb = nlattr_get_uint8 }, 1021 { .type = PF_CS_AF, .off = _OUT(psk_af), .cb = nlattr_get_uint8 }, 1022 { .type = PF_CS_PROTO, .off = _OUT(psk_proto), .cb = nlattr_get_uint8 }, 1023 { .type = PF_CS_SRC, .off = _OUT(psk_src), .arg = &rule_addr_parser, .cb = nlattr_get_nested }, 1024 { .type = PF_CS_DST, .off = _OUT(psk_dst), .arg = &rule_addr_parser, .cb = nlattr_get_nested }, 1025 { .type = PF_CS_RT_ADDR, .off = _OUT(psk_rt_addr), .arg = &rule_addr_parser, .cb = nlattr_get_nested }, 1026 { .type = PF_CS_IFNAME, .off = _OUT(psk_ifname), .arg = (void *)IFNAMSIZ, .cb = nlattr_get_chara }, 1027 { .type = PF_CS_LABEL, .off = _OUT(psk_label), .arg = (void *)PF_RULE_LABEL_SIZE, .cb = nlattr_get_chara }, 1028 { .type = PF_CS_KILL_MATCH, .off = _OUT(psk_kill_match), .cb = nlattr_get_bool }, 1029 { .type = PF_CS_NAT, .off = _OUT(psk_nat), .cb = nlattr_get_bool }, 1030 }; 1031 static const struct nlfield_parser nlf_p_clear_states[] = {}; 1032 #undef _IN 1033 #undef _OUT 1034 NL_DECLARE_PARSER(clear_states_parser, struct genlmsghdr, nlf_p_clear_states, nla_p_clear_states); 1035 1036 static int 1037 pf_handle_killclear_states(struct nlmsghdr *hdr, struct nl_pstate *npt, int cmd) 1038 { 1039 struct pf_kstate_kill kill = {}; 1040 struct epoch_tracker et; 1041 struct nl_writer *nw = npt->nw; 1042 struct genlmsghdr *ghdr_new; 1043 int error; 1044 unsigned int killed = 0; 1045 1046 error = nl_parse_nlmsg(hdr, &clear_states_parser, npt, &kill); 1047 if (error != 0) 1048 return (error); 1049 1050 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 1051 return (ENOMEM); 1052 1053 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1054 ghdr_new->cmd = cmd; 1055 ghdr_new->version = 0; 1056 ghdr_new->reserved = 0; 1057 1058 NET_EPOCH_ENTER(et); 1059 if (cmd == PFNL_CMD_KILLSTATES) 1060 pf_killstates(&kill, &killed); 1061 else 1062 killed = pf_clear_states(&kill); 1063 NET_EPOCH_EXIT(et); 1064 1065 nlattr_add_u32(nw, PF_CS_KILLED, killed); 1066 1067 if (! nlmsg_end(nw)) { 1068 error = ENOMEM; 1069 goto out; 1070 } 1071 1072 return (0); 1073 1074 out: 1075 nlmsg_abort(nw); 1076 return (error); 1077 } 1078 1079 static int 1080 pf_handle_clear_states(struct nlmsghdr *hdr, struct nl_pstate *npt) 1081 { 1082 return (pf_handle_killclear_states(hdr, npt, PFNL_CMD_CLRSTATES)); 1083 } 1084 1085 static int 1086 pf_handle_kill_states(struct nlmsghdr *hdr, struct nl_pstate *npt) 1087 { 1088 return (pf_handle_killclear_states(hdr, npt, PFNL_CMD_KILLSTATES)); 1089 } 1090 1091 struct nl_parsed_set_statusif { 1092 char ifname[IFNAMSIZ]; 1093 }; 1094 #define _IN(_field) offsetof(struct genlmsghdr, _field) 1095 #define _OUT(_field) offsetof(struct nl_parsed_set_statusif, _field) 1096 static const struct nlattr_parser nla_p_set_statusif[] = { 1097 { .type = PF_SS_IFNAME, .off = _OUT(ifname), .arg = (const void *)IFNAMSIZ, .cb = nlattr_get_chara }, 1098 }; 1099 static const struct nlfield_parser nlf_p_set_statusif[] = {}; 1100 #undef _IN 1101 #undef _OUT 1102 NL_DECLARE_PARSER(set_statusif_parser, struct genlmsghdr, nlf_p_set_statusif, nla_p_set_statusif); 1103 1104 static int 1105 pf_handle_set_statusif(struct nlmsghdr *hdr, struct nl_pstate *npt) 1106 { 1107 int error; 1108 struct nl_parsed_set_statusif attrs = {}; 1109 1110 error = nl_parse_nlmsg(hdr, &set_statusif_parser, npt, &attrs); 1111 if (error != 0) 1112 return (error); 1113 1114 PF_RULES_WLOCK(); 1115 strlcpy(V_pf_status.ifname, attrs.ifname, IFNAMSIZ); 1116 PF_RULES_WUNLOCK(); 1117 1118 return (0); 1119 } 1120 1121 static bool 1122 nlattr_add_counters(struct nl_writer *nw, int attr, size_t number, char **names, 1123 counter_u64_t *counters) 1124 { 1125 for (int i = 0; i < number; i++) { 1126 int off = nlattr_add_nested(nw, attr); 1127 nlattr_add_u32(nw, PF_C_ID, i); 1128 nlattr_add_string(nw, PF_C_NAME, names[i]); 1129 nlattr_add_u64(nw, PF_C_COUNTER, counter_u64_fetch(counters[i])); 1130 nlattr_set_len(nw, off); 1131 } 1132 1133 return (true); 1134 } 1135 1136 static bool 1137 nlattr_add_fcounters(struct nl_writer *nw, int attr, size_t number, char **names, 1138 struct pf_counter_u64 *counters) 1139 { 1140 for (int i = 0; i < number; i++) { 1141 int off = nlattr_add_nested(nw, attr); 1142 nlattr_add_u32(nw, PF_C_ID, i); 1143 nlattr_add_string(nw, PF_C_NAME, names[i]); 1144 nlattr_add_u64(nw, PF_C_COUNTER, pf_counter_u64_fetch(&counters[i])); 1145 nlattr_set_len(nw, off); 1146 } 1147 1148 return (true); 1149 } 1150 1151 static bool 1152 nlattr_add_u64_array(struct nl_writer *nw, int attr, size_t number, uint64_t *array) 1153 { 1154 int off = nlattr_add_nested(nw, attr); 1155 1156 for (size_t i = 0; i < number; i++) 1157 nlattr_add_u64(nw, 0, array[i]); 1158 1159 nlattr_set_len(nw, off); 1160 1161 return (true); 1162 } 1163 1164 static int 1165 pf_handle_get_status(struct nlmsghdr *hdr, struct nl_pstate *npt) 1166 { 1167 struct pf_status s; 1168 struct nl_writer *nw = npt->nw; 1169 struct genlmsghdr *ghdr_new; 1170 char *pf_reasons[PFRES_MAX+1] = PFRES_NAMES; 1171 char *pf_lcounter[KLCNT_MAX+1] = KLCNT_NAMES; 1172 char *pf_fcounter[FCNT_MAX+1] = FCNT_NAMES; 1173 int error; 1174 1175 PF_RULES_RLOCK_TRACKER; 1176 1177 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 1178 return (ENOMEM); 1179 1180 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1181 ghdr_new->cmd = PFNL_CMD_GET_STATUS; 1182 ghdr_new->version = 0; 1183 ghdr_new->reserved = 0; 1184 1185 PF_RULES_RLOCK(); 1186 1187 nlattr_add_string(nw, PF_GS_IFNAME, V_pf_status.ifname); 1188 nlattr_add_bool(nw, PF_GS_RUNNING, V_pf_status.running); 1189 nlattr_add_u32(nw, PF_GS_SINCE, V_pf_status.since); 1190 nlattr_add_u32(nw, PF_GS_DEBUG, V_pf_status.debug); 1191 nlattr_add_u32(nw, PF_GS_HOSTID, ntohl(V_pf_status.hostid)); 1192 nlattr_add_u32(nw, PF_GS_STATES, V_pf_status.states); 1193 nlattr_add_u32(nw, PF_GS_SRC_NODES, V_pf_status.src_nodes); 1194 nlattr_add_u32(nw, PF_GS_REASSEMBLE, V_pf_status.reass); 1195 nlattr_add_u32(nw, PF_GS_SYNCOOKIES_ACTIVE, V_pf_status.syncookies_active); 1196 1197 nlattr_add_counters(nw, PF_GS_COUNTERS, PFRES_MAX, pf_reasons, 1198 V_pf_status.counters); 1199 nlattr_add_counters(nw, PF_GS_LCOUNTERS, KLCNT_MAX, pf_lcounter, 1200 V_pf_status.lcounters); 1201 nlattr_add_fcounters(nw, PF_GS_FCOUNTERS, FCNT_MAX, pf_fcounter, 1202 V_pf_status.fcounters); 1203 nlattr_add_counters(nw, PF_GS_SCOUNTERS, SCNT_MAX, pf_fcounter, 1204 V_pf_status.scounters); 1205 1206 pfi_update_status(V_pf_status.ifname, &s); 1207 nlattr_add_u64_array(nw, PF_GS_BCOUNTERS, 2 * 2, (uint64_t *)s.bcounters); 1208 nlattr_add_u64_array(nw, PF_GS_PCOUNTERS, 2 * 2 * 2, (uint64_t *)s.pcounters); 1209 1210 nlattr_add(nw, PF_GS_CHKSUM, PF_MD5_DIGEST_LENGTH, V_pf_status.pf_chksum); 1211 1212 PF_RULES_RUNLOCK(); 1213 1214 if (!nlmsg_end(nw)) { 1215 error = ENOMEM; 1216 goto out; 1217 } 1218 1219 return (0); 1220 1221 out: 1222 nlmsg_abort(nw); 1223 return (error); 1224 } 1225 1226 static int 1227 pf_handle_clear_status(struct nlmsghdr *hdr, struct nl_pstate *npt) 1228 { 1229 pf_ioctl_clear_status(); 1230 1231 return (0); 1232 } 1233 1234 struct pf_nl_natlook { 1235 sa_family_t af; 1236 uint8_t direction; 1237 uint8_t proto; 1238 struct pf_addr src; 1239 struct pf_addr dst; 1240 uint16_t sport; 1241 uint16_t dport; 1242 }; 1243 1244 #define _IN(_field) offsetof(struct genlmsghdr, _field) 1245 #define _OUT(_field) offsetof(struct pf_nl_natlook, _field) 1246 static const struct nlattr_parser nla_p_natlook[] = { 1247 { .type = PF_NL_AF, .off = _OUT(af), .cb = nlattr_get_uint8 }, 1248 { .type = PF_NL_DIRECTION, .off = _OUT(direction), .cb = nlattr_get_uint8 }, 1249 { .type = PF_NL_PROTO, .off = _OUT(proto), .cb = nlattr_get_uint8 }, 1250 { .type = PF_NL_SRC_ADDR, .off = _OUT(src), .cb = nlattr_get_in6_addr }, 1251 { .type = PF_NL_DST_ADDR, .off = _OUT(dst), .cb = nlattr_get_in6_addr }, 1252 { .type = PF_NL_SRC_PORT, .off = _OUT(sport), .cb = nlattr_get_uint16 }, 1253 { .type = PF_NL_DST_PORT, .off = _OUT(dport), .cb = nlattr_get_uint16 }, 1254 }; 1255 static const struct nlfield_parser nlf_p_natlook[] = {}; 1256 #undef _IN 1257 #undef _OUT 1258 NL_DECLARE_PARSER(natlook_parser, struct genlmsghdr, nlf_p_natlook, nla_p_natlook); 1259 1260 static int 1261 pf_handle_natlook(struct nlmsghdr *hdr, struct nl_pstate *npt) 1262 { 1263 struct pf_nl_natlook attrs = {}; 1264 struct pf_state_key_cmp key = {}; 1265 struct nl_writer *nw = npt->nw; 1266 struct pf_state_key *sk; 1267 struct pf_kstate *state; 1268 struct genlmsghdr *ghdr_new; 1269 int error, m = 0; 1270 int sidx, didx; 1271 1272 error = nl_parse_nlmsg(hdr, &natlook_parser, npt, &attrs); 1273 if (error != 0) 1274 return (error); 1275 1276 if (attrs.proto == 0 || 1277 PF_AZERO(&attrs.src, attrs.af) || 1278 PF_AZERO(&attrs.dst, attrs.af) || 1279 ((attrs.proto == IPPROTO_TCP || attrs.proto == IPPROTO_UDP) && 1280 (attrs.sport == 0 || attrs.dport == 0))) 1281 return (EINVAL); 1282 1283 /* NATLOOK src and dst are reversed, so reverse sidx/didx */ 1284 sidx = (attrs.direction == PF_IN) ? 1 : 0; 1285 didx = (attrs.direction == PF_IN) ? 0 : 1; 1286 1287 key.af = attrs.af; 1288 key.proto = attrs.proto; 1289 PF_ACPY(&key.addr[sidx], &attrs.src, attrs.af); 1290 key.port[sidx] = attrs.sport; 1291 PF_ACPY(&key.addr[didx], &attrs.dst, attrs.af); 1292 key.port[didx] = attrs.dport; 1293 1294 state = pf_find_state_all(&key, attrs.direction, &m); 1295 if (state == NULL) 1296 return (ENOENT); 1297 if (m > 1) { 1298 PF_STATE_UNLOCK(state); 1299 return (E2BIG); 1300 } 1301 1302 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) { 1303 PF_STATE_UNLOCK(state); 1304 return (ENOMEM); 1305 } 1306 1307 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1308 ghdr_new->cmd = PFNL_CMD_NATLOOK; 1309 ghdr_new->version = 0; 1310 ghdr_new->reserved = 0; 1311 1312 sk = state->key[sidx]; 1313 1314 nlattr_add_in6_addr(nw, PF_NL_SRC_ADDR, &sk->addr[sidx].v6); 1315 nlattr_add_in6_addr(nw, PF_NL_DST_ADDR, &sk->addr[didx].v6); 1316 nlattr_add_u16(nw, PF_NL_SRC_PORT, sk->port[sidx]); 1317 nlattr_add_u16(nw, PF_NL_DST_PORT, sk->port[didx]); 1318 1319 PF_STATE_UNLOCK(state); 1320 1321 if (!nlmsg_end(nw)) { 1322 nlmsg_abort(nw); 1323 return (ENOMEM); 1324 } 1325 1326 return (0); 1327 } 1328 1329 struct pf_nl_set_debug 1330 { 1331 uint32_t level; 1332 }; 1333 #define _OUT(_field) offsetof(struct pf_nl_set_debug, _field) 1334 static const struct nlattr_parser nla_p_set_debug[] = { 1335 { .type = PF_SD_LEVEL, .off = _OUT(level), .cb = nlattr_get_uint32 }, 1336 }; 1337 static const struct nlfield_parser nlf_p_set_debug[] = {}; 1338 #undef _OUT 1339 NL_DECLARE_PARSER(set_debug_parser, struct genlmsghdr, nlf_p_set_debug, nla_p_set_debug); 1340 1341 static int 1342 pf_handle_set_debug(struct nlmsghdr *hdr, struct nl_pstate *npt) 1343 { 1344 struct pf_nl_set_debug attrs = {}; 1345 int error; 1346 1347 error = nl_parse_nlmsg(hdr, &set_debug_parser, npt, &attrs); 1348 if (error != 0) 1349 return (error); 1350 1351 PF_RULES_WLOCK(); 1352 V_pf_status.debug = attrs.level; 1353 PF_RULES_WUNLOCK(); 1354 1355 return (0); 1356 } 1357 1358 struct pf_nl_set_timeout 1359 { 1360 uint32_t timeout; 1361 uint32_t seconds; 1362 }; 1363 #define _OUT(_field) offsetof(struct pf_nl_set_timeout, _field) 1364 static const struct nlattr_parser nla_p_set_timeout[] = { 1365 { .type = PF_TO_TIMEOUT, .off = _OUT(timeout), .cb = nlattr_get_uint32 }, 1366 { .type = PF_TO_SECONDS, .off = _OUT(seconds), .cb = nlattr_get_uint32 }, 1367 }; 1368 static const struct nlfield_parser nlf_p_set_timeout[] = {}; 1369 #undef _OUT 1370 NL_DECLARE_PARSER(set_timeout_parser, struct genlmsghdr, nlf_p_set_timeout, nla_p_set_timeout); 1371 1372 static int 1373 pf_handle_set_timeout(struct nlmsghdr *hdr, struct nl_pstate *npt) 1374 { 1375 struct pf_nl_set_timeout attrs = {}; 1376 int error; 1377 1378 error = nl_parse_nlmsg(hdr, &set_timeout_parser, npt, &attrs); 1379 if (error != 0) 1380 return (error); 1381 1382 return (pf_ioctl_set_timeout(attrs.timeout, attrs.seconds, NULL)); 1383 } 1384 1385 static int 1386 pf_handle_get_timeout(struct nlmsghdr *hdr, struct nl_pstate *npt) 1387 { 1388 struct pf_nl_set_timeout attrs = {}; 1389 struct nl_writer *nw = npt->nw; 1390 struct genlmsghdr *ghdr_new; 1391 int error; 1392 1393 error = nl_parse_nlmsg(hdr, &set_timeout_parser, npt, &attrs); 1394 if (error != 0) 1395 return (error); 1396 1397 error = pf_ioctl_get_timeout(attrs.timeout, &attrs.seconds); 1398 if (error != 0) 1399 return (error); 1400 1401 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 1402 return (ENOMEM); 1403 1404 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1405 ghdr_new->cmd = PFNL_CMD_GET_TIMEOUT; 1406 ghdr_new->version = 0; 1407 ghdr_new->reserved = 0; 1408 1409 nlattr_add_u32(nw, PF_TO_SECONDS, attrs.seconds); 1410 1411 if (!nlmsg_end(nw)) { 1412 nlmsg_abort(nw); 1413 return (ENOMEM); 1414 } 1415 1416 return (0); 1417 } 1418 1419 struct pf_nl_set_limit 1420 { 1421 uint32_t index; 1422 uint32_t limit; 1423 }; 1424 #define _OUT(_field) offsetof(struct pf_nl_set_limit, _field) 1425 static const struct nlattr_parser nla_p_set_limit[] = { 1426 { .type = PF_LI_INDEX, .off = _OUT(index), .cb = nlattr_get_uint32 }, 1427 { .type = PF_LI_LIMIT, .off = _OUT(limit), .cb = nlattr_get_uint32 }, 1428 }; 1429 static const struct nlfield_parser nlf_p_set_limit[] = {}; 1430 #undef _OUT 1431 NL_DECLARE_PARSER(set_limit_parser, struct genlmsghdr, nlf_p_set_limit, nla_p_set_limit); 1432 1433 static int 1434 pf_handle_set_limit(struct nlmsghdr *hdr, struct nl_pstate *npt) 1435 { 1436 struct pf_nl_set_limit attrs = {}; 1437 int error; 1438 1439 error = nl_parse_nlmsg(hdr, &set_limit_parser, npt, &attrs); 1440 if (error != 0) 1441 return (error); 1442 1443 return (pf_ioctl_set_limit(attrs.index, attrs.limit, NULL)); 1444 } 1445 1446 static int 1447 pf_handle_get_limit(struct nlmsghdr *hdr, struct nl_pstate *npt) 1448 { 1449 struct pf_nl_set_limit attrs = {}; 1450 struct nl_writer *nw = npt->nw; 1451 struct genlmsghdr *ghdr_new; 1452 int error; 1453 1454 error = nl_parse_nlmsg(hdr, &set_limit_parser, npt, &attrs); 1455 if (error != 0) 1456 return (error); 1457 1458 error = pf_ioctl_get_limit(attrs.index, &attrs.limit); 1459 if (error != 0) 1460 return (error); 1461 1462 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 1463 return (ENOMEM); 1464 1465 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1466 ghdr_new->cmd = PFNL_CMD_GET_LIMIT; 1467 ghdr_new->version = 0; 1468 ghdr_new->reserved = 0; 1469 1470 nlattr_add_u32(nw, PF_LI_LIMIT, attrs.limit); 1471 1472 if (!nlmsg_end(nw)) { 1473 nlmsg_abort(nw); 1474 return (ENOMEM); 1475 } 1476 1477 return (0); 1478 } 1479 1480 static int 1481 pf_handle_begin_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt) 1482 { 1483 struct nl_writer *nw = npt->nw; 1484 struct genlmsghdr *ghdr_new; 1485 uint32_t ticket; 1486 int error; 1487 1488 error = pf_ioctl_begin_addrs(&ticket); 1489 if (error != 0) 1490 return (error); 1491 1492 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 1493 return (ENOMEM); 1494 1495 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1496 ghdr_new->cmd = PFNL_CMD_BEGIN_ADDRS; 1497 ghdr_new->version = 0; 1498 ghdr_new->reserved = 0; 1499 1500 nlattr_add_u32(nw, PF_BA_TICKET, ticket); 1501 1502 if (!nlmsg_end(nw)) { 1503 nlmsg_abort(nw); 1504 return (ENOMEM); 1505 } 1506 1507 return (0); 1508 } 1509 1510 static bool 1511 nlattr_add_pool_addr(struct nl_writer *nw, int attrtype, struct pf_pooladdr *a) 1512 { 1513 int off; 1514 1515 off = nlattr_add_nested(nw, attrtype); 1516 1517 nlattr_add_addr_wrap(nw, PF_PA_ADDR, &a->addr); 1518 nlattr_add_string(nw, PF_PA_IFNAME, a->ifname); 1519 1520 nlattr_set_len(nw, off); 1521 1522 return (true); 1523 } 1524 1525 #define _OUT(_field) offsetof(struct pf_pooladdr, _field) 1526 static const struct nlattr_parser nla_p_pool_addr[] = { 1527 { .type = PF_PA_ADDR, .off = _OUT(addr), .arg = &addr_wrap_parser, .cb = nlattr_get_nested }, 1528 { .type = PF_PA_IFNAME, .off = _OUT(ifname), .arg = (void *)IFNAMSIZ, .cb = nlattr_get_chara }, 1529 }; 1530 NL_DECLARE_ATTR_PARSER(pool_addr_parser, nla_p_pool_addr); 1531 #undef _OUT 1532 1533 #define _OUT(_field) offsetof(struct pf_nl_pooladdr, _field) 1534 static const struct nlattr_parser nla_p_add_addr[] = { 1535 { .type = PF_AA_ACTION, .off = _OUT(action), .cb = nlattr_get_uint32 }, 1536 { .type = PF_AA_TICKET, .off = _OUT(ticket), .cb = nlattr_get_uint32 }, 1537 { .type = PF_AA_NR, .off = _OUT(nr), .cb = nlattr_get_uint32 }, 1538 { .type = PF_AA_R_NUM, .off = _OUT(r_num), .cb = nlattr_get_uint32 }, 1539 { .type = PF_AA_R_ACTION, .off = _OUT(r_action), .cb = nlattr_get_uint8 }, 1540 { .type = PF_AA_R_LAST, .off = _OUT(r_last), .cb = nlattr_get_uint8 }, 1541 { .type = PF_AA_AF, .off = _OUT(af), .cb = nlattr_get_uint8 }, 1542 { .type = PF_AA_ANCHOR, .off = _OUT(anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara }, 1543 { .type = PF_AA_ADDR, .off = _OUT(addr), .arg = &pool_addr_parser, .cb = nlattr_get_nested }, 1544 { .type = PF_AA_WHICH, .off = _OUT(which), .cb = nlattr_get_uint32 }, 1545 }; 1546 static const struct nlfield_parser nlf_p_add_addr[] = {}; 1547 #undef _OUT 1548 NL_DECLARE_PARSER(add_addr_parser, struct genlmsghdr, nlf_p_add_addr, nla_p_add_addr); 1549 1550 static int 1551 pf_handle_add_addr(struct nlmsghdr *hdr, struct nl_pstate *npt) 1552 { 1553 struct pf_nl_pooladdr attrs = { 0 }; 1554 int error; 1555 1556 error = nl_parse_nlmsg(hdr, &add_addr_parser, npt, &attrs); 1557 if (error != 0) 1558 return (error); 1559 1560 if (attrs.which == 0) 1561 attrs.which = PF_RDR; 1562 1563 error = pf_ioctl_add_addr(&attrs); 1564 1565 return (error); 1566 } 1567 1568 static int 1569 pf_handle_get_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt) 1570 { 1571 struct pf_nl_pooladdr attrs = { 0 }; 1572 struct nl_writer *nw = npt->nw; 1573 struct genlmsghdr *ghdr_new; 1574 int error; 1575 1576 error = nl_parse_nlmsg(hdr, &add_addr_parser, npt, &attrs); 1577 if (error != 0) 1578 return (error); 1579 1580 if (attrs.which == 0) 1581 attrs.which = PF_RDR; 1582 1583 error = pf_ioctl_get_addrs(&attrs); 1584 if (error != 0) 1585 return (error); 1586 1587 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 1588 return (ENOMEM); 1589 1590 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1591 ghdr_new->cmd = PFNL_CMD_GET_ADDRS; 1592 ghdr_new->version = 0; 1593 ghdr_new->reserved = 0; 1594 1595 nlattr_add_u32(nw, PF_AA_NR, attrs.nr); 1596 1597 if (!nlmsg_end(nw)) { 1598 nlmsg_abort(nw); 1599 return (ENOMEM); 1600 } 1601 1602 return (error); 1603 } 1604 1605 static int 1606 pf_handle_get_addr(struct nlmsghdr *hdr, struct nl_pstate *npt) 1607 { 1608 struct pf_nl_pooladdr attrs = { 0 }; 1609 struct nl_writer *nw = npt->nw; 1610 struct genlmsghdr *ghdr_new; 1611 int error; 1612 1613 error = nl_parse_nlmsg(hdr, &add_addr_parser, npt, &attrs); 1614 if (error != 0) 1615 return (error); 1616 1617 if (attrs.which == 0) 1618 attrs.which = PF_RDR; 1619 1620 error = pf_ioctl_get_addr(&attrs); 1621 if (error != 0) 1622 return (error); 1623 1624 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 1625 return (ENOMEM); 1626 1627 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1628 ghdr_new->cmd = PFNL_CMD_GET_ADDR; 1629 ghdr_new->version = 0; 1630 ghdr_new->reserved = 0; 1631 1632 nlattr_add_u32(nw, PF_AA_ACTION, attrs.action); 1633 nlattr_add_u32(nw, PF_AA_TICKET, attrs.ticket); 1634 nlattr_add_u32(nw, PF_AA_NR, attrs.nr); 1635 nlattr_add_u32(nw, PF_AA_R_NUM, attrs.r_num); 1636 nlattr_add_u8(nw, PF_AA_R_ACTION, attrs.r_action); 1637 nlattr_add_u8(nw, PF_AA_R_LAST, attrs.r_last); 1638 nlattr_add_u8(nw, PF_AA_AF, attrs.af); 1639 nlattr_add_string(nw, PF_AA_ANCHOR, attrs.anchor); 1640 nlattr_add_pool_addr(nw, PF_AA_ADDR, &attrs.addr); 1641 1642 if (!nlmsg_end(nw)) { 1643 nlmsg_abort(nw); 1644 return (ENOMEM); 1645 } 1646 1647 return (0); 1648 } 1649 1650 #define _OUT(_field) offsetof(struct pfioc_ruleset, _field) 1651 static const struct nlattr_parser nla_p_ruleset[] = { 1652 { .type = PF_RS_PATH, .off = _OUT(path), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara }, 1653 { .type = PF_RS_NR, .off = _OUT(nr), .cb = nlattr_get_uint32 }, 1654 }; 1655 static const struct nlfield_parser nlf_p_ruleset[] = { 1656 }; 1657 NL_DECLARE_PARSER(ruleset_parser, struct genlmsghdr, nlf_p_ruleset, nla_p_ruleset); 1658 #undef _OUT 1659 1660 static int 1661 pf_handle_get_rulesets(struct nlmsghdr *hdr, struct nl_pstate *npt) 1662 { 1663 struct pfioc_ruleset attrs = { 0 }; 1664 struct nl_writer *nw = npt->nw; 1665 struct genlmsghdr *ghdr_new; 1666 int error; 1667 1668 error = nl_parse_nlmsg(hdr, &ruleset_parser, npt, &attrs); 1669 if (error != 0) 1670 return (error); 1671 1672 error = pf_ioctl_get_rulesets(&attrs); 1673 if (error != 0) 1674 return (error); 1675 1676 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 1677 return (ENOMEM); 1678 1679 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1680 ghdr_new->cmd = PFNL_CMD_GET_RULESETS; 1681 ghdr_new->version = 0; 1682 ghdr_new->reserved = 0; 1683 1684 nlattr_add_u32(nw, PF_RS_NR, attrs.nr); 1685 1686 if (!nlmsg_end(nw)) { 1687 nlmsg_abort(nw); 1688 return (ENOMEM); 1689 } 1690 1691 return (0); 1692 } 1693 1694 static int 1695 pf_handle_get_ruleset(struct nlmsghdr *hdr, struct nl_pstate *npt) 1696 { 1697 struct pfioc_ruleset attrs = { 0 }; 1698 struct nl_writer *nw = npt->nw; 1699 struct genlmsghdr *ghdr_new; 1700 int error; 1701 1702 error = nl_parse_nlmsg(hdr, &ruleset_parser, npt, &attrs); 1703 if (error) 1704 return (error); 1705 1706 error = pf_ioctl_get_ruleset(&attrs); 1707 if (error != 0) 1708 return (error); 1709 1710 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) 1711 return (ENOMEM); 1712 1713 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1714 ghdr_new->cmd = PFNL_CMD_GET_RULESET; 1715 ghdr_new->version = 0; 1716 ghdr_new->reserved = 0; 1717 1718 nlattr_add_string(nw, PF_RS_NAME, attrs.name); 1719 1720 if (!nlmsg_end(nw)) { 1721 nlmsg_abort(nw); 1722 return (ENOMEM); 1723 } 1724 1725 return (0); 1726 } 1727 1728 static bool 1729 nlattr_add_pf_threshold(struct nl_writer *nw, int attrtype, 1730 struct pf_threshold *t, int secs) 1731 { 1732 int off = nlattr_add_nested(nw, attrtype); 1733 int diff, conn_rate_count; 1734 1735 /* Adjust the connection rate estimate. */ 1736 conn_rate_count = t->count; 1737 diff = secs - t->last; 1738 if (diff >= t->seconds) 1739 conn_rate_count = 0; 1740 else 1741 conn_rate_count -= t->count * diff / t->seconds; 1742 1743 nlattr_add_u32(nw, PF_TH_LIMIT, t->limit); 1744 nlattr_add_u32(nw, PF_TH_SECONDS, t->seconds); 1745 nlattr_add_u32(nw, PF_TH_COUNT, conn_rate_count); 1746 nlattr_add_u32(nw, PF_TH_LAST, t->last); 1747 1748 nlattr_set_len(nw, off); 1749 1750 return (true); 1751 } 1752 1753 static int 1754 pf_handle_get_srcnodes(struct nlmsghdr *hdr, struct nl_pstate *npt) 1755 { 1756 struct nl_writer *nw = npt->nw; 1757 struct genlmsghdr *ghdr_new; 1758 struct pf_ksrc_node *n; 1759 struct pf_srchash *sh; 1760 int i; 1761 int secs; 1762 1763 hdr->nlmsg_flags |= NLM_F_MULTI; 1764 1765 for (i = 0, sh = V_pf_srchash; i <= V_pf_srchashmask; 1766 i++, sh++) { 1767 /* Avoid locking empty rows. */ 1768 if (LIST_EMPTY(&sh->nodes)) 1769 continue; 1770 1771 PF_HASHROW_LOCK(sh); 1772 secs = time_uptime; 1773 1774 LIST_FOREACH(n, &sh->nodes, entry) { 1775 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) { 1776 nlmsg_abort(nw); 1777 return (ENOMEM); 1778 } 1779 1780 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1781 ghdr_new->cmd = PFNL_CMD_GET_SRCNODES; 1782 ghdr_new->version = 0; 1783 ghdr_new->reserved = 0; 1784 1785 nlattr_add_in6_addr(nw, PF_SN_ADDR, &n->addr.v6); 1786 nlattr_add_in6_addr(nw, PF_SN_RADDR, &n->raddr.v6); 1787 nlattr_add_u32(nw, PF_SN_RULE_NR, n->rule->nr); 1788 nlattr_add_u64(nw, PF_SN_BYTES_IN, counter_u64_fetch(n->bytes[0])); 1789 nlattr_add_u64(nw, PF_SN_BYTES_OUT, counter_u64_fetch(n->bytes[1])); 1790 nlattr_add_u64(nw, PF_SN_PACKETS_IN, counter_u64_fetch(n->packets[0])); 1791 nlattr_add_u64(nw, PF_SN_PACKETS_OUT, counter_u64_fetch(n->packets[1])); 1792 nlattr_add_u32(nw, PF_SN_STATES, n->states); 1793 nlattr_add_u32(nw, PF_SN_CONNECTIONS, n->conn); 1794 nlattr_add_u8(nw, PF_SN_AF, n->af); 1795 nlattr_add_u8(nw, PF_SN_RULE_TYPE, n->ruletype); 1796 1797 nlattr_add_u64(nw, PF_SN_CREATION, secs - n->creation); 1798 if (n->expire > secs) 1799 nlattr_add_u64(nw, PF_SN_EXPIRE, n->expire - secs); 1800 else 1801 nlattr_add_u64(nw, PF_SN_EXPIRE, 0); 1802 1803 nlattr_add_pf_threshold(nw, PF_SN_CONNECTION_RATE, 1804 &n->conn_rate, secs); 1805 1806 if (!nlmsg_end(nw)) { 1807 PF_HASHROW_UNLOCK(sh); 1808 nlmsg_abort(nw); 1809 return (ENOMEM); 1810 } 1811 } 1812 PF_HASHROW_UNLOCK(sh); 1813 } 1814 1815 return (0); 1816 } 1817 1818 static const struct nlhdr_parser *all_parsers[] = { 1819 &state_parser, 1820 &addrule_parser, 1821 &getrules_parser, 1822 &clear_states_parser, 1823 &set_statusif_parser, 1824 &natlook_parser, 1825 &set_debug_parser, 1826 &set_timeout_parser, 1827 &set_limit_parser, 1828 &pool_addr_parser, 1829 &add_addr_parser, 1830 &ruleset_parser, 1831 }; 1832 1833 static int family_id; 1834 1835 static const struct genl_cmd pf_cmds[] = { 1836 { 1837 .cmd_num = PFNL_CMD_GETSTATES, 1838 .cmd_name = "GETSTATES", 1839 .cmd_cb = pf_handle_getstates, 1840 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1841 .cmd_priv = PRIV_NETINET_PF, 1842 }, 1843 { 1844 .cmd_num = PFNL_CMD_GETCREATORS, 1845 .cmd_name = "GETCREATORS", 1846 .cmd_cb = pf_handle_getcreators, 1847 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1848 .cmd_priv = PRIV_NETINET_PF, 1849 }, 1850 { 1851 .cmd_num = PFNL_CMD_START, 1852 .cmd_name = "START", 1853 .cmd_cb = pf_handle_start, 1854 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, 1855 .cmd_priv = PRIV_NETINET_PF, 1856 }, 1857 { 1858 .cmd_num = PFNL_CMD_STOP, 1859 .cmd_name = "STOP", 1860 .cmd_cb = pf_handle_stop, 1861 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, 1862 .cmd_priv = PRIV_NETINET_PF, 1863 }, 1864 { 1865 .cmd_num = PFNL_CMD_ADDRULE, 1866 .cmd_name = "ADDRULE", 1867 .cmd_cb = pf_handle_addrule, 1868 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1869 .cmd_priv = PRIV_NETINET_PF, 1870 }, 1871 { 1872 .cmd_num = PFNL_CMD_GETRULES, 1873 .cmd_name = "GETRULES", 1874 .cmd_cb = pf_handle_getrules, 1875 .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1876 .cmd_priv = PRIV_NETINET_PF, 1877 }, 1878 { 1879 .cmd_num = PFNL_CMD_GETRULE, 1880 .cmd_name = "GETRULE", 1881 .cmd_cb = pf_handle_getrule, 1882 .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1883 .cmd_priv = PRIV_NETINET_PF, 1884 }, 1885 { 1886 .cmd_num = PFNL_CMD_CLRSTATES, 1887 .cmd_name = "CLRSTATES", 1888 .cmd_cb = pf_handle_clear_states, 1889 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1890 .cmd_priv = PRIV_NETINET_PF, 1891 }, 1892 { 1893 .cmd_num = PFNL_CMD_KILLSTATES, 1894 .cmd_name = "KILLSTATES", 1895 .cmd_cb = pf_handle_kill_states, 1896 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1897 .cmd_priv = PRIV_NETINET_PF, 1898 }, 1899 { 1900 .cmd_num = PFNL_CMD_SET_STATUSIF, 1901 .cmd_name = "SETSTATUSIF", 1902 .cmd_cb = pf_handle_set_statusif, 1903 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, 1904 .cmd_priv = PRIV_NETINET_PF, 1905 }, 1906 { 1907 .cmd_num = PFNL_CMD_GET_STATUS, 1908 .cmd_name = "GETSTATUS", 1909 .cmd_cb = pf_handle_get_status, 1910 .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1911 .cmd_priv = PRIV_NETINET_PF, 1912 }, 1913 { 1914 .cmd_num = PFNL_CMD_CLEAR_STATUS, 1915 .cmd_name = "CLEARSTATUS", 1916 .cmd_cb = pf_handle_clear_status, 1917 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, 1918 .cmd_priv = PRIV_NETINET_PF, 1919 }, 1920 { 1921 .cmd_num = PFNL_CMD_NATLOOK, 1922 .cmd_name = "NATLOOK", 1923 .cmd_cb = pf_handle_natlook, 1924 .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1925 .cmd_priv = PRIV_NETINET_PF, 1926 }, 1927 { 1928 .cmd_num = PFNL_CMD_SET_DEBUG, 1929 .cmd_name = "SET_DEBUG", 1930 .cmd_cb = pf_handle_set_debug, 1931 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, 1932 .cmd_priv = PRIV_NETINET_PF, 1933 }, 1934 { 1935 .cmd_num = PFNL_CMD_SET_TIMEOUT, 1936 .cmd_name = "SET_TIMEOUT", 1937 .cmd_cb = pf_handle_set_timeout, 1938 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, 1939 .cmd_priv = PRIV_NETINET_PF, 1940 }, 1941 { 1942 .cmd_num = PFNL_CMD_GET_TIMEOUT, 1943 .cmd_name = "GET_TIMEOUT", 1944 .cmd_cb = pf_handle_get_timeout, 1945 .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1946 .cmd_priv = PRIV_NETINET_PF, 1947 }, 1948 { 1949 .cmd_num = PFNL_CMD_SET_LIMIT, 1950 .cmd_name = "SET_LIMIT", 1951 .cmd_cb = pf_handle_set_limit, 1952 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, 1953 .cmd_priv = PRIV_NETINET_PF, 1954 }, 1955 { 1956 .cmd_num = PFNL_CMD_GET_LIMIT, 1957 .cmd_name = "GET_LIMIT", 1958 .cmd_cb = pf_handle_get_limit, 1959 .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1960 .cmd_priv = PRIV_NETINET_PF, 1961 }, 1962 { 1963 .cmd_num = PFNL_CMD_BEGIN_ADDRS, 1964 .cmd_name = "BEGIN_ADDRS", 1965 .cmd_cb = pf_handle_begin_addrs, 1966 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1967 .cmd_priv = PRIV_NETINET_PF, 1968 }, 1969 { 1970 .cmd_num = PFNL_CMD_ADD_ADDR, 1971 .cmd_name = "ADD_ADDR", 1972 .cmd_cb = pf_handle_add_addr, 1973 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, 1974 .cmd_priv = PRIV_NETINET_PF, 1975 }, 1976 { 1977 .cmd_num = PFNL_CMD_GET_ADDRS, 1978 .cmd_name = "GET_ADDRS", 1979 .cmd_cb = pf_handle_get_addrs, 1980 .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1981 .cmd_priv = PRIV_NETINET_PF, 1982 }, 1983 { 1984 .cmd_num = PFNL_CMD_GET_ADDR, 1985 .cmd_name = "GET_ADDRS", 1986 .cmd_cb = pf_handle_get_addr, 1987 .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1988 .cmd_priv = PRIV_NETINET_PF, 1989 }, 1990 { 1991 .cmd_num = PFNL_CMD_GET_RULESETS, 1992 .cmd_name = "GET_RULESETS", 1993 .cmd_cb = pf_handle_get_rulesets, 1994 .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1995 .cmd_priv = PRIV_NETINET_PF, 1996 }, 1997 { 1998 .cmd_num = PFNL_CMD_GET_RULESET, 1999 .cmd_name = "GET_RULESET", 2000 .cmd_cb = pf_handle_get_ruleset, 2001 .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 2002 .cmd_priv = PRIV_NETINET_PF, 2003 }, 2004 { 2005 .cmd_num = PFNL_CMD_GET_SRCNODES, 2006 .cmd_name = "GET_SRCNODES", 2007 .cmd_cb = pf_handle_get_srcnodes, 2008 .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 2009 .cmd_priv = PRIV_NETINET_PF, 2010 }, 2011 }; 2012 2013 void 2014 pf_nl_register(void) 2015 { 2016 NL_VERIFY_PARSERS(all_parsers); 2017 2018 family_id = genl_register_family(PFNL_FAMILY_NAME, 0, 2, PFNL_CMD_MAX); 2019 genl_register_cmds(PFNL_FAMILY_NAME, pf_cmds, nitems(pf_cmds)); 2020 } 2021 2022 void 2023 pf_nl_unregister(void) 2024 { 2025 genl_unregister_family(PFNL_FAMILY_NAME); 2026 } 2027