pf: implement DIOCGETRULES via netlink

Sponsored by:	Rubicon Communications, LLC ("Netgate")

lib/libpfctl/libpfctl.c

@@ -1119,26 +1119,55 @@ pfctl_add_rule(int dev __unused, const struct pfctl_rule *r, const char *anchor,
 	return (e.error);
 }
 
+#define	_IN(_field)	offsetof(struct genlmsghdr, _field)
+#define	_OUT(_field)	offsetof(struct pfctl_rules_info, _field)
+static struct snl_attr_parser ap_getrules[] = {
+	{ .type = PF_GR_NR, .off = _OUT(nr), .cb = snl_attr_get_uint32 },
+	{ .type = PF_GR_TICKET, .off = _OUT(ticket), .cb = snl_attr_get_uint32 },
+};
+static struct snl_field_parser fp_getrules[] = {
+};
+#undef _IN
+#undef _OUT
+SNL_DECLARE_PARSER(getrules_parser, struct genlmsghdr, fp_getrules, ap_getrules);
+
 int
-pfctl_get_rules_info(int dev, struct pfctl_rules_info *rules, uint32_t ruleset,
+pfctl_get_rules_info(int dev __unused, struct pfctl_rules_info *rules, uint32_t ruleset,
     const char *path)
 {
-	struct pfioc_rule pr;
-	int ret;
+	struct snl_state ss = {};
+	struct snl_errmsg_data e = {};
+	struct nlmsghdr *hdr;
+	struct snl_writer nw;
+	uint32_t seq_id;
+	int family_id;
 
-	bzero(&pr, sizeof(pr));
-	if (strlcpy(pr.anchor, path, sizeof(pr.anchor)) >= sizeof(pr.anchor))
-		return (E2BIG);
+	snl_init(&ss, NETLINK_GENERIC);
+	family_id = snl_get_genl_family(&ss, PFNL_FAMILY_NAME);
+	if (family_id == 0)
+		return (ENOTSUP);
 
-	pr.rule.action = ruleset;
-	ret = ioctl(dev, DIOCGETRULES, &pr);
-	if (ret != 0)
-		return (ret);
+	snl_init_writer(&ss, &nw);
+	hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_GETRULES);
+	hdr->nlmsg_flags |= NLM_F_DUMP;
 
-	rules->nr = pr.nr;
-	rules->ticket = pr.ticket;
+	snl_add_msg_attr_string(&nw, PF_GR_ANCHOR, path);
+	snl_add_msg_attr_u8(&nw, PF_GR_ACTION, ruleset);
 
-	return (0);
+	hdr = snl_finalize_msg(&nw);
+	if (hdr == NULL)
+		return (ENOMEM);
+
+	seq_id = hdr->nlmsg_seq;
+	if (! snl_send_message(&ss, hdr))
+		return (ENXIO);
+
+	while ((hdr = snl_read_reply_multi(&ss, seq_id, &e)) != NULL) {
+		if (! snl_parse_nlmsg(&ss, hdr, &getrules_parser, rules))
+			continue;
+	}
+
+	return (e.error);
 }
 
 int
@@ -1368,7 +1397,7 @@ SNL_DECLARE_PARSER(state_parser, struct genlmsghdr, fp_state, ap_state);
 
 static const struct snl_hdr_parser *all_parsers[] = {
 	&state_parser, &skey_parser, &speer_parser,
-	&creator_parser,
+	&creator_parser, &getrules_parser
 };
 
 static int

sys/net/pfvar.h

@@ -2473,6 +2473,7 @@ int			 pf_keth_anchor_nvcopyout(
 struct pf_keth_ruleset	*pf_find_or_create_keth_ruleset(const char *);
 void			 pf_keth_anchor_remove(struct pf_keth_rule *);
 
+int			 pf_ioctl_getrules(struct pfioc_rule *);
 int			 pf_ioctl_addrule(struct pf_krule *, uint32_t,
 			    uint32_t, const char *, const char *, uid_t uid,
 			    pid_t);

sys/netpfil/pf/pf_ioctl.c

@@ -2021,6 +2021,36 @@ pf_rule_to_krule(const struct pf_rule *rule, struct pf_krule *krule)
 	return (0);
 }
 
+int
+pf_ioctl_getrules(struct pfioc_rule *pr)
+{
+	struct pf_kruleset	*ruleset;
+	struct pf_krule		*tail;
+	int			 rs_num;
+
+	PF_RULES_WLOCK();
+	ruleset = pf_find_kruleset(pr->anchor);
+	if (ruleset == NULL) {
+		PF_RULES_WUNLOCK();
+		return (EINVAL);
+	}
+	rs_num = pf_get_ruleset_number(pr->rule.action);
+	if (rs_num >= PF_RULESET_MAX) {
+		PF_RULES_WUNLOCK();
+		return (EINVAL);
+	}
+	tail = TAILQ_LAST(ruleset->rules[rs_num].active.ptr,
+	    pf_krulequeue);
+	if (tail)
+		pr->nr = tail->nr + 1;
+	else
+		pr->nr = 0;
+	pr->ticket = ruleset->rules[rs_num].active.ticket;
+	PF_RULES_WUNLOCK();
+
+	return (0);
+}
+
 int
 pf_ioctl_addrule(struct pf_krule *rule, uint32_t ticket,
     uint32_t pool_ticket, const char *anchor, const char *anchor_call,
@@ -3117,33 +3147,11 @@ pfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread *td
 
 	case DIOCGETRULES: {
 		struct pfioc_rule	*pr = (struct pfioc_rule *)addr;
-		struct pf_kruleset	*ruleset;
-		struct pf_krule		*tail;
-		int			 rs_num;
 
 		pr->anchor[sizeof(pr->anchor) - 1] = 0;
 
-		PF_RULES_WLOCK();
-		ruleset = pf_find_kruleset(pr->anchor);
-		if (ruleset == NULL) {
-			PF_RULES_WUNLOCK();
-			error = EINVAL;
-			break;
-		}
-		rs_num = pf_get_ruleset_number(pr->rule.action);
-		if (rs_num >= PF_RULESET_MAX) {
-			PF_RULES_WUNLOCK();
-			error = EINVAL;
-			break;
-		}
-		tail = TAILQ_LAST(ruleset->rules[rs_num].active.ptr,
-		    pf_krulequeue);
-		if (tail)
-			pr->nr = tail->nr + 1;
-		else
-			pr->nr = 0;
-		pr->ticket = ruleset->rules[rs_num].active.ticket;
-		PF_RULES_WUNLOCK();
+		error = pf_ioctl_getrules(pr);
+
 		break;
 	}
 

sys/netpfil/pf/pf_nl.c

@@ -635,7 +635,64 @@ pf_handle_addrule(struct nlmsghdr *hdr, struct nl_pstate *npt)
 	return (error);
 }
 
-static const struct nlhdr_parser *all_parsers[] = { &state_parser, &addrule_parser };
+struct nl_parsed_getrules {
+	char		*anchor;
+	uint8_t		 action;
+};
+#define	_IN(_field)	offsetof(struct genlmsghdr, _field)
+#define	_OUT(_field)	offsetof(struct pfioc_rule, _field)
+static const struct nlattr_parser nla_p_getrules[] = {
+	{ .type = PF_GR_ANCHOR, .off = _OUT(anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara },
+	{ .type = PF_GR_ACTION, .off = _OUT(rule.action), .cb = nlattr_get_uint8 },
+};
+static const struct nlfield_parser nlf_p_getrules[] = {
+};
+NL_DECLARE_PARSER(getrules_parser, struct genlmsghdr, nlf_p_getrules, nla_p_getrules);
+
+static int
+pf_handle_getrules(struct nlmsghdr *hdr, struct nl_pstate *npt)
+{
+	struct pfioc_rule attrs = {};
+	int error;
+	struct nl_writer *nw = npt->nw;
+	struct genlmsghdr *ghdr_new;
+
+	error = nl_parse_nlmsg(hdr, &getrules_parser, npt, &attrs);
+	if (error != 0)
+		return (error);
+
+	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
+		return (ENOMEM);
+
+	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
+	ghdr_new->cmd = PFNL_CMD_GETRULES;
+	ghdr_new->version = 0;
+	ghdr_new->reserved = 0;
+
+	error = pf_ioctl_getrules(&attrs);
+	if (error != 0)
+		goto out;
+
+	nlattr_add_u32(nw, PF_GR_NR, attrs.nr);
+	nlattr_add_u32(nw, PF_GR_TICKET, attrs.ticket);
+
+	if (!nlmsg_end(nw)) {
+		error = ENOMEM;
+		goto out;
+	}
+
+	return (0);
+
+out:
+	nlmsg_abort(nw);
+	return (error);
+}
+
+static const struct nlhdr_parser *all_parsers[] = {
+	&state_parser,
+	&addrule_parser,
+	&getrules_parser
+};
 
 static int family_id;
 
@@ -670,7 +727,12 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_addrule,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 	},
-
+	{
+		.cmd_num = PFNL_CMD_GETRULES,
+		.cmd_name = "GETRULES",
+		.cmd_cb = pf_handle_getrules,
+		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
+	},
 };
 
 void

sys/netpfil/pf/pf_nl.h

@@ -41,6 +41,7 @@ enum {
 	PFNL_CMD_START = 3,
 	PFNL_CMD_STOP = 4,
 	PFNL_CMD_ADDRULE = 5,
+	PFNL_CMD_GETRULES = 6,
 	__PFNL_CMD_MAX,
 };
 #define PFNL_CMD_MAX (__PFNL_CMD_MAX -1)
@@ -232,6 +233,14 @@ enum pf_addrule_type_t {
 	PF_ART_RULE		= 5, /* nested, pfrule_type_t */
 };
 
+enum pf_getrules_type_t {
+	PF_GR_UNSPEC,
+	PF_GR_ANCHOR		= 1, /* string */
+	PF_GR_ACTION		= 2, /* u8 */
+	PF_GR_NR		= 3, /* u32 */
+	PF_GR_TICKET		= 4, /* u32 */
+};
+
 #ifdef _KERNEL
 
 void	pf_nl_register(void);