The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=c36c90a2cc171d21f78a6f0e28269c0cea37c2e1
commit c36c90a2cc171d21f78a6f0e28269c0cea37c2e1 Author: Kristof Provost <[email protected]> AuthorDate: 2024-06-01 18:07:22 +0000 Commit: Kristof Provost <[email protected]> CommitDate: 2024-06-04 12:59:59 +0000 pf: convert DIOCSETDEBUG to netlink Sponsored by: Rubicon Communications, LLC ("Netgate") --- lib/libpfctl/libpfctl.c | 32 ++++++++++++++++++++++++++++++++ lib/libpfctl/libpfctl.h | 1 + sbin/pfctl/parse.y | 2 +- sbin/pfctl/pfctl.c | 8 ++++---- sbin/pfctl/pfctl_parser.h | 2 +- sys/netpfil/pf/pf_nl.c | 37 +++++++++++++++++++++++++++++++++++++ sys/netpfil/pf/pf_nl.h | 6 ++++++ 7 files changed, 82 insertions(+), 6 deletions(-) diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c index d5cd6c4bda60..42339af5642b 100644 --- a/lib/libpfctl/libpfctl.c +++ b/lib/libpfctl/libpfctl.c @@ -2490,3 +2490,35 @@ pfctl_natlook(struct pfctl_handle *h, const struct pfctl_natlook_key *k, return (e.error); } + +int +pfctl_set_debug(struct pfctl_handle *h, uint32_t level) +{ + struct snl_writer nw; + struct snl_errmsg_data e = {}; + struct nlmsghdr *hdr; + uint32_t seq_id; + int family_id; + + family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME); + if (family_id == 0) + return (ENOTSUP); + + snl_init_writer(&h->ss, &nw); + hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_SET_DEBUG); + + snl_add_msg_attr_u32(&nw, PF_SD_LEVEL, level); + + if ((hdr = snl_finalize_msg(&nw)) == NULL) + return (ENXIO); + + seq_id = hdr->nlmsg_seq; + + if (! snl_send_message(&h->ss, hdr)) + return (ENXIO); + + while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) { + } + + return (e.error); +} diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h index e7625252638c..ae1457e9304b 100644 --- a/lib/libpfctl/libpfctl.h +++ b/lib/libpfctl/libpfctl.h @@ -492,5 +492,6 @@ struct pfctl_natlook { }; int pfctl_natlook(struct pfctl_handle *h, const struct pfctl_natlook_key *k, struct pfctl_natlook *r); +int pfctl_set_debug(struct pfctl_handle *h, uint32_t level); #endif diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y index 9ec86f898240..92e6e36f3b23 100644 --- a/sbin/pfctl/parse.y +++ b/sbin/pfctl/parse.y @@ -763,7 +763,7 @@ option : SET REASSEMBLE yesno optnodf { free($3); YYERROR; } - if (pfctl_set_debug(pf, $3) != 0) { + if (pfctl_do_set_debug(pf, $3) != 0) { yyerror("error setting debuglevel %s", $3); free($3); YYERROR; diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c index 08c3d5c98321..8776ec7f82dc 100644 --- a/sbin/pfctl/pfctl.c +++ b/sbin/pfctl/pfctl.c @@ -2695,7 +2695,7 @@ pfctl_cfg_syncookies(struct pfctl *pf, uint8_t val, struct pfctl_watermarks *w) } int -pfctl_set_debug(struct pfctl *pf, char *d) +pfctl_do_set_debug(struct pfctl *pf, char *d) { u_int32_t level; @@ -2719,7 +2719,7 @@ pfctl_set_debug(struct pfctl *pf, char *d) level = pf->debug; if ((pf->opts & PF_OPT_NOACTION) == 0) - if (ioctl(dev, DIOCSETDEBUG, &level)) + if (pfctl_set_debug(pfh, level)) err(1, "DIOCSETDEBUG"); if (pf->opts & PF_OPT_VERBOSE) @@ -2731,7 +2731,7 @@ pfctl_set_debug(struct pfctl *pf, char *d) int pfctl_load_debug(struct pfctl *pf, unsigned int level) { - if (ioctl(pf->dev, DIOCSETDEBUG, &level)) { + if (pfctl_set_debug(pf->h, level)) { warnx("DIOCSETDEBUG"); return (1); } @@ -2777,7 +2777,7 @@ pfctl_set_interface_flags(struct pfctl *pf, char *ifname, int flags, int how) void pfctl_debug(int dev, u_int32_t level, int opts) { - if (ioctl(dev, DIOCSETDEBUG, &level)) + if (pfctl_set_debug(pfh, level)) err(1, "DIOCSETDEBUG"); if ((opts & PF_OPT_QUIET) == 0) { fprintf(stderr, "debug level set to '"); diff --git a/sbin/pfctl/pfctl_parser.h b/sbin/pfctl/pfctl_parser.h index 6534baa9a7dd..58532ad37e12 100644 --- a/sbin/pfctl/pfctl_parser.h +++ b/sbin/pfctl/pfctl_parser.h @@ -291,7 +291,7 @@ int pfctl_set_optimization(struct pfctl *, const char *); int pfctl_set_limit(struct pfctl *, const char *, unsigned int); int pfctl_set_logif(struct pfctl *, char *); int pfctl_set_hostid(struct pfctl *, u_int32_t); -int pfctl_set_debug(struct pfctl *, char *); +int pfctl_do_set_debug(struct pfctl *, char *); int pfctl_set_interface_flags(struct pfctl *, char *, int, int); int pfctl_cfg_syncookies(struct pfctl *, uint8_t, struct pfctl_watermarks *); diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c index b9dc7358ae28..1074c561cd15 100644 --- a/sys/netpfil/pf/pf_nl.c +++ b/sys/netpfil/pf/pf_nl.c @@ -1320,6 +1320,35 @@ pf_handle_natlook(struct nlmsghdr *hdr, struct nl_pstate *npt) return (0); } +struct pf_nl_set_debug +{ + uint32_t level; +}; +#define _OUT(_field) offsetof(struct pf_nl_set_debug, _field) +static const struct nlattr_parser nla_p_set_debug[] = { + { .type = PF_SD_LEVEL, .off = _OUT(level), .cb = nlattr_get_uint32 }, +}; +static const struct nlfield_parser nlf_p_set_debug[] = {}; +#undef _OUT +NL_DECLARE_PARSER(set_debug_parser, struct genlmsghdr, nlf_p_set_debug, nla_p_set_debug); + +static int +pf_handle_set_debug(struct nlmsghdr *hdr, struct nl_pstate *npt) +{ + struct pf_nl_set_debug attrs = {}; + int error; + + error = nl_parse_nlmsg(hdr, &set_debug_parser, npt, &attrs); + if (error != 0) + return (error); + + PF_RULES_WLOCK(); + V_pf_status.debug = attrs.level; + PF_RULES_WUNLOCK(); + + return (0); +} + static const struct nlhdr_parser *all_parsers[] = { &state_parser, &addrule_parser, @@ -1327,6 +1356,7 @@ static const struct nlhdr_parser *all_parsers[] = { &clear_states_parser, &set_statusif_parser, &natlook_parser, + &set_debug_parser, }; static int family_id; @@ -1423,6 +1453,13 @@ static const struct genl_cmd pf_cmds[] = { .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, }, + { + .cmd_num = PFNL_CMD_SET_DEBUG, + .cmd_name = "SET_DEBUG", + .cmd_cb = pf_handle_set_debug, + .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, + .cmd_priv = PRIV_NETINET_PF, + }, }; void diff --git a/sys/netpfil/pf/pf_nl.h b/sys/netpfil/pf/pf_nl.h index 7c2ef3712dc7..ab199e308a38 100644 --- a/sys/netpfil/pf/pf_nl.h +++ b/sys/netpfil/pf/pf_nl.h @@ -49,6 +49,7 @@ enum { PFNL_CMD_GET_STATUS = 11, PFNL_CMD_CLEAR_STATUS = 12, PFNL_CMD_NATLOOK = 13, + PFNL_CMD_SET_DEBUG = 14, __PFNL_CMD_MAX, }; #define PFNL_CMD_MAX (__PFNL_CMD_MAX -1) @@ -328,6 +329,11 @@ enum pf_natlook_types_t { PF_NL_DST_PORT = 7, /* u16 */ }; +enum pf_set_debug_types_t { + PF_SD_UNSPEC, + PF_SD_LEVEL = 1, /* u32 */ +}; + #ifdef _KERNEL void pf_nl_register(void);
