The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=281282e9357b95b679d36ca6d8561e96c1263937
commit 281282e9357b95b679d36ca6d8561e96c1263937 Author: Kristof Provost <[email protected]> AuthorDate: 2026-02-13 16:21:33 +0000 Commit: Kristof Provost <[email protected]> CommitDate: 2026-02-16 12:42:50 +0000 pf: convert DIOCRTSTADDRS to netlink Sponsored by: Rubicon Communications, LLC ("Netgate") --- lib/libpfctl/libpfctl.c | 67 +++++++++++++++++++++++++++++++++++++++++++ lib/libpfctl/libpfctl.h | 2 ++ sbin/pfctl/pfctl_radix.c | 21 +++++--------- sys/netpfil/pf/pf_nl.c | 41 ++++++++++++++++++++++++++ sys/netpfil/pf/pf_nl.h | 1 + tests/sys/netpfil/pf/table.sh | 38 ++++++++++++++++++++++++ 6 files changed, 156 insertions(+), 14 deletions(-) diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c index 9025b94249ce..cd484949e4da 100644 --- a/lib/libpfctl/libpfctl.c +++ b/lib/libpfctl/libpfctl.c @@ -3916,6 +3916,73 @@ pfctl_clr_astats(struct pfctl_handle *h, const struct pfr_table *tbl, return (ret); } +static int +_pfctl_test_addrs(struct pfctl_handle *h, const struct pfr_table *tbl, + struct pfr_addr *addrs, int size, int *nmatch, int flags) +{ + struct snl_writer nw; + struct snl_errmsg_data e = {}; + struct nlmsghdr *hdr; + uint32_t seq_id; + struct nl_astats attrs; + int family_id; + + family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME); + if (family_id == 0) + return (ENOTSUP); + + snl_init_writer(&h->ss, &nw); + hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_TABLE_TEST_ADDRS); + + snl_add_msg_attr_table(&nw, PF_TA_TABLE, tbl); + snl_add_msg_attr_u32(&nw, PF_TA_FLAGS, flags); + for (int i = 0; i < size; i++) + snl_add_msg_attr_pfr_addr(&nw, PF_TA_ADDR, &addrs[i]); + + if ((hdr = snl_finalize_msg(&nw)) == NULL) + return (ENXIO); + seq_id = hdr->nlmsg_seq; + + if (! snl_send_message(&h->ss, hdr)) + return (ENXIO); + + while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) { + if (! snl_parse_nlmsg(&h->ss, hdr, &table_astats_parser, &attrs)) + continue; + } + + if (nmatch) + *nmatch = attrs.total_count; + + return (e.error); +} + +int +pfctl_test_addrs(struct pfctl_handle *h, const struct pfr_table *tbl, + struct pfr_addr *addrs, int size, int *nmatch, int flags) +{ + int ret; + int off = 0; + int partial_match; + int chunk_size; + + if (nmatch) + *nmatch = 0; + + do { + chunk_size = MIN(size - off, 256); + ret = _pfctl_test_addrs(h, tbl, &addrs[off], chunk_size, + &partial_match, flags); + if (ret != 0) + break; + if (nmatch) + *nmatch += partial_match; + off += chunk_size; + } while (off < size); + + return (ret); +} + static void snl_add_msg_attr_limit_rate(struct snl_writer *nw, uint32_t type, const struct pfctl_limit_rate *rate) diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h index d55267e56b4c..1012be53db65 100644 --- a/lib/libpfctl/libpfctl.h +++ b/lib/libpfctl/libpfctl.h @@ -597,6 +597,8 @@ int pfctl_get_astats(struct pfctl_handle *h, const struct pfr_table *tbl, struct pfr_astats *addr, int *size, int flags); int pfctl_clr_astats(struct pfctl_handle *h, const struct pfr_table *tbl, struct pfr_addr *addr, int size, int *nzero, int flags); +int pfctl_test_addrs(struct pfctl_handle *h, const struct pfr_table *tbl, + struct pfr_addr *addr, int size, int *nmatch, int flags); struct pfctl_limit_rate { unsigned int limit; diff --git a/sbin/pfctl/pfctl_radix.c b/sbin/pfctl/pfctl_radix.c index e8d3a1b8dcc3..608c22141ae8 100644 --- a/sbin/pfctl/pfctl_radix.c +++ b/sbin/pfctl/pfctl_radix.c @@ -214,25 +214,18 @@ int pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size, int *nmatch, int flags) { - struct pfioc_table io; + int ret; if (tbl == NULL || size < 0 || (size && addr == NULL)) { errno = EINVAL; return (-1); } - bzero(&io, sizeof io); - io.pfrio_flags = flags; - io.pfrio_table = *tbl; - io.pfrio_buffer = addr; - io.pfrio_esize = sizeof(*addr); - io.pfrio_size = size; - if (ioctl(dev, DIOCRTSTADDRS, &io)) { - pfr_report_error(tbl, &io, "test addresses in"); - return (-1); - } - if (nmatch) - *nmatch = io.pfrio_nmatch; - return (0); + + ret = pfctl_test_addrs(pfh, tbl, addr, size, nmatch, flags); + if (ret != 0) + errno = ret; + + return (ret); } int diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c index 7a7655d7d9c8..c2ea65f4b043 100644 --- a/sys/netpfil/pf/pf_nl.c +++ b/sys/netpfil/pf/pf_nl.c @@ -2467,6 +2467,40 @@ pf_handle_table_clear_astats(struct nlmsghdr *hdr, struct nl_pstate *npt) return (error); } +static int +pf_handle_table_test_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt) +{ + struct nl_parsed_table_addrs attrs = { 0 }; + struct nl_writer *nw = npt->nw; + struct genlmsghdr *ghdr_new; + int error; + + PF_RULES_RLOCK_TRACKER; + + error = nl_parse_nlmsg(hdr, &table_addr_parser, npt, &attrs); + if (error != 0) + return (error); + + PF_RULES_RLOCK(); + error = pfr_tst_addrs(&attrs.table, &attrs.addrs[0], + attrs.addr_count, &attrs.nchange, + attrs.flags | PFR_FLAG_USERIOCTL); + PF_RULES_RUNLOCK(); + + if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) + return (ENOMEM); + + ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); + ghdr_new->cmd = PFNL_CMD_TABLE_TEST_ADDRS; + + nlattr_add_u32(nw, PF_TAS_ASTATS_COUNT, attrs.nchange); + + if (!nlmsg_end(nw)) + return (ENOMEM); + + return (error); +} + static const struct nlattr_parser nla_p_rate[] = { { .type = PF_LR_LIMIT, .off = 0, .cb = nlattr_get_uint32 }, { .type = PF_LR_SECONDS, .off = sizeof(unsigned int), .cb = nlattr_get_uint32 }, @@ -3154,6 +3188,13 @@ static const struct genl_cmd pf_cmds[] = { .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, }, + { + .cmd_num = PFNL_CMD_TABLE_TEST_ADDRS, + .cmd_name = "TABLE_TEST_ADDRS", + .cmd_cb = pf_handle_table_test_addrs, + .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, + .cmd_priv = PRIV_NETINET_PF, + }, }; void diff --git a/sys/netpfil/pf/pf_nl.h b/sys/netpfil/pf/pf_nl.h index 84e9d3a97303..6591c707d9a4 100644 --- a/sys/netpfil/pf/pf_nl.h +++ b/sys/netpfil/pf/pf_nl.h @@ -82,6 +82,7 @@ enum { PFNL_CMD_SOURCE_GET = 44, PFNL_CMD_SOURCE_NGET = 45, PFNL_CMD_SOURCE_CLEAR = 46, + PFNL_CMD_TABLE_TEST_ADDRS = 47, __PFNL_CMD_MAX, }; #define PFNL_CMD_MAX (__PFNL_CMD_MAX -1) diff --git a/tests/sys/netpfil/pf/table.sh b/tests/sys/netpfil/pf/table.sh index cd83ac90e559..743bfe08557d 100644 --- a/tests/sys/netpfil/pf/table.sh +++ b/tests/sys/netpfil/pf/table.sh @@ -846,6 +846,43 @@ load_cleanup() pft_cleanup } +atf_test_case "test" "cleanup" +test_head() +{ + atf_set descr 'Test pfctl -T test functionality' + atf_set require.user root +} + +test_body() +{ + pft_init + + epair_send=$(vnet_mkepair) + ifconfig ${epair_send}a 192.0.2.1/24 up + + vnet_mkjail alcatraz ${epair_send}b + jexec alcatraz ifconfig ${epair_send}b 192.0.2.2/24 up + jexec alcatraz pfctl -e + + pft_set_rules alcatraz \ + "table <foo> counters { 192.0.2.1 }" \ + "pass all" \ + "match in from <foo> to any" \ + "match out from any to <foo>" + + atf_check -s exit:0 -o ignore ping -c 3 192.0.2.2 + + atf_check -s exit:2 -e match:"0/1 addresses match." \ + jexec alcatraz pfctl -t foo -T test 1.2.3.4 + atf_check -s exit:0 -e match:"1/1 addresses match." \ + jexec alcatraz pfctl -t foo -T test 192.0.2.1 +} + +test_cleanup() +{ + pft_cleanup +} + atf_init_test_cases() { atf_add_test_case "v4_counters" @@ -866,4 +903,5 @@ atf_init_test_cases() atf_add_test_case "in_anchor" atf_add_test_case "replace" atf_add_test_case "load" + atf_add_test_case "test" }
