I recall miniupnpd having problems with this ioctl and yes, they still use it: https://github.com/miniupnp/miniupnp/blob/master/miniupnpd/pf/obsdrdr.c#L287
2011/10/7 Henning Brauer <[email protected]> > anybody using pf's DIOCCHANGERULE ioctl? > > if so, stop doing so :) > seriously, we wanna remove it. we're not aware of anything using it, > and changing a rule doesn't really fit pf's concept either. > ans since it is a largely unused ioctl we kinda expect it to be broken > anyway... > > Index: pf_ioctl.c > =================================================================== > RCS file: /cvs/src/sys/net/pf_ioctl.c,v > retrieving revision 1.242 > diff -u -p -r1.242 pf_ioctl.c > --- pf_ioctl.c 30 Aug 2011 00:40:47 -0000 1.242 > +++ pf_ioctl.c 7 Oct 2011 10:36:55 -0000 > @@ -1169,134 +1169,6 @@ pfioctl(dev_t dev, u_long cmd, caddr_t a > break; > } > > - case DIOCCHANGERULE: { > - struct pfioc_rule *pcr = (struct pfioc_rule *)addr; > - struct pf_ruleset *ruleset; > - struct pf_rule *oldrule = NULL, *newrule = NULL; > - u_int32_t nr = 0; > - > - if (pcr->action < PF_CHANGE_ADD_HEAD || > - pcr->action > PF_CHANGE_GET_TICKET) { > - error = EINVAL; > - break; > - } > - ruleset = pf_find_ruleset(pcr->anchor); > - if (ruleset == NULL) { > - error = EINVAL; > - break; > - } > - > - if (pcr->action == PF_CHANGE_GET_TICKET) { > - pcr->ticket = ++ruleset->rules.active.ticket; > - break; > - } else { > - if (pcr->ticket != > - ruleset->rules.active.ticket) { > - error = EINVAL; > - break; > - } > - if (pcr->rule.return_icmp >> 8 > ICMP_MAXTYPE) { > - error = EINVAL; > - break; > - } > - } > - > - if (pcr->action != PF_CHANGE_REMOVE) { > - newrule = pool_get(&pf_rule_pl, > - PR_WAITOK|PR_LIMITFAIL|PR_ZERO); > - if (newrule == NULL) { > - error = ENOMEM; > - break; > - } > - pf_rule_copyin(&pcr->rule, newrule, ruleset); > - newrule->cuid = p->p_cred->p_ruid; > - newrule->cpid = p->p_pid; > - > - switch (newrule->af) { > - case 0: > - break; > -#ifdef INET > - case AF_INET: > - break; > -#endif /* INET */ > -#ifdef INET6 > - case AF_INET6: > - break; > -#endif /* INET6 */ > - default: > - pool_put(&pf_rule_pl, newrule); > - error = EAFNOSUPPORT; > - goto fail; > - } > - > - if (newrule->rt && !newrule->direction) > - error = EINVAL; > - if (pf_addr_setup(ruleset, &newrule->src.addr, > newrule->af)) > - error = EINVAL; > - if (pf_addr_setup(ruleset, &newrule->dst.addr, > newrule->af)) > - error = EINVAL; > - if (pf_addr_setup(ruleset, &newrule->rdr.addr, > newrule->af)) > - error = EINVAL; > - if (pf_addr_setup(ruleset, &newrule->nat.addr, > newrule->af)) > - error = EINVAL; > - if (pf_addr_setup(ruleset, &newrule->route.addr, > newrule->af)) > - error = EINVAL; > - if (pf_anchor_setup(newrule, ruleset, > pcr->anchor_call)) > - error = EINVAL; > - > - if (error) { > - pf_rm_rule(NULL, newrule); > - break; > - } > - } > - > - if (pcr->action == PF_CHANGE_ADD_HEAD) > - oldrule = TAILQ_FIRST(ruleset->rules.active.ptr); > - else if (pcr->action == PF_CHANGE_ADD_TAIL) > - oldrule = TAILQ_LAST(ruleset->rules.active.ptr, > - pf_rulequeue); > - else { > - oldrule = TAILQ_FIRST(ruleset->rules.active.ptr); > - while ((oldrule != NULL) && (oldrule->nr != > pcr->nr)) > - oldrule = TAILQ_NEXT(oldrule, entries); > - if (oldrule == NULL) { > - if (newrule != NULL) > - pf_rm_rule(NULL, newrule); > - error = EINVAL; > - break; > - } > - } > - > - if (pcr->action == PF_CHANGE_REMOVE) { > - pf_rm_rule(ruleset->rules.active.ptr, oldrule); > - ruleset->rules.active.rcount--; > - } else { > - if (oldrule == NULL) > - TAILQ_INSERT_TAIL( > - ruleset->rules.active.ptr, > - newrule, entries); > - else if (pcr->action == PF_CHANGE_ADD_HEAD || > - pcr->action == PF_CHANGE_ADD_BEFORE) > - TAILQ_INSERT_BEFORE(oldrule, newrule, > entries); > - else > - TAILQ_INSERT_AFTER( > - ruleset->rules.active.ptr, > - oldrule, newrule, entries); > - ruleset->rules.active.rcount++; > - } > - > - nr = 0; > - TAILQ_FOREACH(oldrule, ruleset->rules.active.ptr, entries) > - oldrule->nr = nr++; > - > - ruleset->rules.active.ticket++; > - > - pf_calc_skip_steps(ruleset->rules.active.ptr); > - pf_remove_if_empty_ruleset(ruleset); > - > - break; > - } > - > case DIOCCLRSTATES: { > struct pf_state *s, *nexts; > struct pfioc_state_kill *psk = (struct pfioc_state_kill > *)addr; > Index: pfvar.h > =================================================================== > RCS file: /cvs/src/sys/net/pfvar.h,v > retrieving revision 1.350 > diff -u -p -r1.350 pfvar.h > --- pfvar.h 22 Sep 2011 14:57:12 -0000 1.350 > +++ pfvar.h 7 Oct 2011 10:36:53 -0000 > @@ -65,9 +65,6 @@ enum { PF_PASS, PF_DROP, PF_SCRUB, PF_NO > enum { PF_TRANS_RULESET, PF_TRANS_ALTQ, PF_TRANS_TABLE }; > enum { PF_OP_NONE, PF_OP_IRG, PF_OP_EQ, PF_OP_NE, PF_OP_LT, > PF_OP_LE, PF_OP_GT, PF_OP_GE, PF_OP_XRG, PF_OP_RRG }; > -enum { PF_CHANGE_NONE, PF_CHANGE_ADD_HEAD, PF_CHANGE_ADD_TAIL, > - PF_CHANGE_ADD_BEFORE, PF_CHANGE_ADD_AFTER, > - PF_CHANGE_REMOVE, PF_CHANGE_GET_TICKET }; > enum { PF_GET_NONE, PF_GET_CLR_CNTR }; > enum { PF_SK_WIRE, PF_SK_STACK, PF_SK_BOTH }; > > @@ -1653,7 +1650,6 @@ struct pfioc_iface { > #define DIOCNATLOOK _IOWR('D', 23, struct pfioc_natlook) > #define DIOCSETDEBUG _IOWR('D', 24, u_int32_t) > #define DIOCGETSTATES _IOWR('D', 25, struct pfioc_states) > -#define DIOCCHANGERULE _IOWR('D', 26, struct pfioc_rule) > /* XXX cut 26 - 28 */ > #define DIOCSETTIMEOUT _IOWR('D', 29, struct pfioc_tm) > #define DIOCGETTIMEOUT _IOWR('D', 30, struct pfioc_tm) > > -- > Henning Brauer, [email protected], [email protected] > BS Web Services, http://bsws.de, Full-Service ISP > Secure Hosting, Mail and DNS Services. Dedicated Servers, Root to Fully > Managed > Henning Brauer Consulting, http://henningbrauer.com/
