The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=cd2054d48bc6d16edb0fdb84a7e4006620883c1e
commit cd2054d48bc6d16edb0fdb84a7e4006620883c1e Author: Kristof Provost <[email protected]> AuthorDate: 2024-05-24 11:15:12 +0000 Commit: Kristof Provost <[email protected]> CommitDate: 2024-05-28 20:27:22 +0000 libpfctl: add pfctl_get_rule_h() Add a handle variant of pfctl_get_rule(). This converts us from using the nvlist variant to the netlink variant, and also moves us closer to a world where all libpfctl functions take the handle. While here have pfctl use the new function. Sponsored by: Rubicon Communications, LLC ("Netgate") --- lib/libpfctl/libpfctl.c | 8 ++++++++ lib/libpfctl/libpfctl.h | 3 +++ sbin/pfctl/pfctl.c | 2 +- sbin/pfctl/pfctl_optimize.c | 2 +- usr.sbin/bsnmpd/modules/snmp_pf/pf_snmp.c | 2 +- 5 files changed, 14 insertions(+), 3 deletions(-) diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c index 479b96123012..e833a23b269a 100644 --- a/lib/libpfctl/libpfctl.c +++ b/lib/libpfctl/libpfctl.c @@ -1388,6 +1388,14 @@ pfctl_get_rules_info(int dev __unused, struct pfctl_rules_info *rules, uint32_t return (error); } +int +pfctl_get_rule_h(struct pfctl_handle *h, uint32_t nr, uint32_t ticket, const char *anchor, + uint32_t ruleset, struct pfctl_rule *rule, char *anchor_call) +{ + return (pfctl_get_clear_rule_h(h, nr, ticket, anchor, ruleset, rule, + anchor_call, false)); +} + int pfctl_get_rule(int dev, uint32_t nr, uint32_t ticket, const char *anchor, uint32_t ruleset, struct pfctl_rule *rule, char *anchor_call) diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h index 73282eb3cc3d..391e73b61e02 100644 --- a/lib/libpfctl/libpfctl.h +++ b/lib/libpfctl/libpfctl.h @@ -420,6 +420,9 @@ int pfctl_get_rules_info(int dev, struct pfctl_rules_info *rules, int pfctl_get_rule(int dev, uint32_t nr, uint32_t ticket, const char *anchor, uint32_t ruleset, struct pfctl_rule *rule, char *anchor_call); +int pfctl_get_rule_h(struct pfctl_handle *h, uint32_t nr, uint32_t ticket, + const char *anchor, uint32_t ruleset, struct pfctl_rule *rule, + char *anchor_call); int pfctl_get_clear_rule(int dev, uint32_t nr, uint32_t ticket, const char *anchor, uint32_t ruleset, struct pfctl_rule *rule, char *anchor_call, bool clear); diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c index 1843ec5713d6..c89981075ea6 100644 --- a/sbin/pfctl/pfctl.c +++ b/sbin/pfctl/pfctl.c @@ -1444,7 +1444,7 @@ pfctl_show_nat(int dev, char *path, int opts, char *anchorname, int depth) brace = 0; INDENT(depth, !(opts & PF_OPT_VERBOSE)); - if (pfctl_get_rule(dev, nr, ri.ticket, path, + if (pfctl_get_rule_h(pfh, nr, ri.ticket, path, nattype[i], &rule, anchor_call)) { warn("DIOCGETRULE"); return (-1); diff --git a/sbin/pfctl/pfctl_optimize.c b/sbin/pfctl/pfctl_optimize.c index 9b43a840c06f..7440bf8a506d 100644 --- a/sbin/pfctl/pfctl_optimize.c +++ b/sbin/pfctl/pfctl_optimize.c @@ -903,7 +903,7 @@ load_feedback_profile(struct pfctl *pf, struct superblocks *superblocks) return (1); } - if (pfctl_get_rule(pf->dev, nr, rules.ticket, "", PF_PASS, + if (pfctl_get_rule_h(pf->h, nr, rules.ticket, "", PF_PASS, &rule, anchor_call)) { warn("DIOCGETRULENV"); return (1); diff --git a/usr.sbin/bsnmpd/modules/snmp_pf/pf_snmp.c b/usr.sbin/bsnmpd/modules/snmp_pf/pf_snmp.c index 1086aa7dcf82..f02329901f69 100644 --- a/usr.sbin/bsnmpd/modules/snmp_pf/pf_snmp.c +++ b/usr.sbin/bsnmpd/modules/snmp_pf/pf_snmp.c @@ -1526,7 +1526,7 @@ pfl_scan_ruleset(const char *path) } for (nr = rules.nr, i = 0; i < nr; i++) { - if (pfctl_get_rule(pfctl_fd(pfh), i, rules.ticket, path, + if (pfctl_get_rule_h(pfh, i, rules.ticket, path, PF_PASS, &rule, anchor_call)) { syslog(LOG_ERR, "pfl_scan_ruleset: ioctl(DIOCGETRULE):" " %s", strerror(errno));
