anybody using pf's DIOCCHANGERULE ioctl?
if so, stop doing so :)
seriously, we wanna remove it. we're not aware of anything using it,
and changing a rule doesn't really fit pf's concept either.
ans since it is a largely unused ioctl we kinda expect it to be broken
anyway...
Index: pf_ioctl.c
===================================================================
RCS file: /cvs/src/sys/net/pf_ioctl.c,v
retrieving revision 1.242
diff -u -p -r1.242 pf_ioctl.c
--- pf_ioctl.c 30 Aug 2011 00:40:47 -0000 1.242
+++ pf_ioctl.c 7 Oct 2011 10:36:55 -0000
@@ -1169,134 +1169,6 @@ pfioctl(dev_t dev, u_long cmd, caddr_t a
break;
}
- case DIOCCHANGERULE: {
- struct pfioc_rule *pcr = (struct pfioc_rule *)addr;
- struct pf_ruleset *ruleset;
- struct pf_rule *oldrule = NULL, *newrule = NULL;
- u_int32_t nr = 0;
-
- if (pcr->action < PF_CHANGE_ADD_HEAD ||
- pcr->action > PF_CHANGE_GET_TICKET) {
- error = EINVAL;
- break;
- }
- ruleset = pf_find_ruleset(pcr->anchor);
- if (ruleset == NULL) {
- error = EINVAL;
- break;
- }
-
- if (pcr->action == PF_CHANGE_GET_TICKET) {
- pcr->ticket = ++ruleset->rules.active.ticket;
- break;
- } else {
- if (pcr->ticket !=
- ruleset->rules.active.ticket) {
- error = EINVAL;
- break;
- }
- if (pcr->rule.return_icmp >> 8 > ICMP_MAXTYPE) {
- error = EINVAL;
- break;
- }
- }
-
- if (pcr->action != PF_CHANGE_REMOVE) {
- newrule = pool_get(&pf_rule_pl,
- PR_WAITOK|PR_LIMITFAIL|PR_ZERO);
- if (newrule == NULL) {
- error = ENOMEM;
- break;
- }
- pf_rule_copyin(&pcr->rule, newrule, ruleset);
- newrule->cuid = p->p_cred->p_ruid;
- newrule->cpid = p->p_pid;
-
- switch (newrule->af) {
- case 0:
- break;
-#ifdef INET
- case AF_INET:
- break;
-#endif /* INET */
-#ifdef INET6
- case AF_INET6:
- break;
-#endif /* INET6 */
- default:
- pool_put(&pf_rule_pl, newrule);
- error = EAFNOSUPPORT;
- goto fail;
- }
-
- if (newrule->rt && !newrule->direction)
- error = EINVAL;
- if (pf_addr_setup(ruleset, &newrule->src.addr,
newrule->af))
- error = EINVAL;
- if (pf_addr_setup(ruleset, &newrule->dst.addr,
newrule->af))
- error = EINVAL;
- if (pf_addr_setup(ruleset, &newrule->rdr.addr,
newrule->af))
- error = EINVAL;
- if (pf_addr_setup(ruleset, &newrule->nat.addr,
newrule->af))
- error = EINVAL;
- if (pf_addr_setup(ruleset, &newrule->route.addr,
newrule->af))
- error = EINVAL;
- if (pf_anchor_setup(newrule, ruleset, pcr->anchor_call))
- error = EINVAL;
-
- if (error) {
- pf_rm_rule(NULL, newrule);
- break;
- }
- }
-
- if (pcr->action == PF_CHANGE_ADD_HEAD)
- oldrule = TAILQ_FIRST(ruleset->rules.active.ptr);
- else if (pcr->action == PF_CHANGE_ADD_TAIL)
- oldrule = TAILQ_LAST(ruleset->rules.active.ptr,
- pf_rulequeue);
- else {
- oldrule = TAILQ_FIRST(ruleset->rules.active.ptr);
- while ((oldrule != NULL) && (oldrule->nr != pcr->nr))
- oldrule = TAILQ_NEXT(oldrule, entries);
- if (oldrule == NULL) {
- if (newrule != NULL)
- pf_rm_rule(NULL, newrule);
- error = EINVAL;
- break;
- }
- }
-
- if (pcr->action == PF_CHANGE_REMOVE) {
- pf_rm_rule(ruleset->rules.active.ptr, oldrule);
- ruleset->rules.active.rcount--;
- } else {
- if (oldrule == NULL)
- TAILQ_INSERT_TAIL(
- ruleset->rules.active.ptr,
- newrule, entries);
- else if (pcr->action == PF_CHANGE_ADD_HEAD ||
- pcr->action == PF_CHANGE_ADD_BEFORE)
- TAILQ_INSERT_BEFORE(oldrule, newrule, entries);
- else
- TAILQ_INSERT_AFTER(
- ruleset->rules.active.ptr,
- oldrule, newrule, entries);
- ruleset->rules.active.rcount++;
- }
-
- nr = 0;
- TAILQ_FOREACH(oldrule, ruleset->rules.active.ptr, entries)
- oldrule->nr = nr++;
-
- ruleset->rules.active.ticket++;
-
- pf_calc_skip_steps(ruleset->rules.active.ptr);
- pf_remove_if_empty_ruleset(ruleset);
-
- break;
- }
-
case DIOCCLRSTATES: {
struct pf_state *s, *nexts;
struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr;
Index: pfvar.h
===================================================================
RCS file: /cvs/src/sys/net/pfvar.h,v
retrieving revision 1.350
diff -u -p -r1.350 pfvar.h
--- pfvar.h 22 Sep 2011 14:57:12 -0000 1.350
+++ pfvar.h 7 Oct 2011 10:36:53 -0000
@@ -65,9 +65,6 @@ enum { PF_PASS, PF_DROP, PF_SCRUB, PF_NO
enum { PF_TRANS_RULESET, PF_TRANS_ALTQ, PF_TRANS_TABLE };
enum { PF_OP_NONE, PF_OP_IRG, PF_OP_EQ, PF_OP_NE, PF_OP_LT,
PF_OP_LE, PF_OP_GT, PF_OP_GE, PF_OP_XRG, PF_OP_RRG };
-enum { PF_CHANGE_NONE, PF_CHANGE_ADD_HEAD, PF_CHANGE_ADD_TAIL,
- PF_CHANGE_ADD_BEFORE, PF_CHANGE_ADD_AFTER,
- PF_CHANGE_REMOVE, PF_CHANGE_GET_TICKET };
enum { PF_GET_NONE, PF_GET_CLR_CNTR };
enum { PF_SK_WIRE, PF_SK_STACK, PF_SK_BOTH };
@@ -1653,7 +1650,6 @@ struct pfioc_iface {
#define DIOCNATLOOK _IOWR('D', 23, struct pfioc_natlook)
#define DIOCSETDEBUG _IOWR('D', 24, u_int32_t)
#define DIOCGETSTATES _IOWR('D', 25, struct pfioc_states)
-#define DIOCCHANGERULE _IOWR('D', 26, struct pfioc_rule)
/* XXX cut 26 - 28 */
#define DIOCSETTIMEOUT _IOWR('D', 29, struct pfioc_tm)
#define DIOCGETTIMEOUT _IOWR('D', 30, struct pfioc_tm)
--
Henning Brauer, [email protected], [email protected]
BS Web Services, http://bsws.de, Full-Service ISP
Secure Hosting, Mail and DNS Services. Dedicated Servers, Root to Fully Managed
Henning Brauer Consulting, http://henningbrauer.com/
