pf: convert DIOCRTSTADDRS to netlink

Sponsored by:	Rubicon Communications, LLC ("Netgate")

lib/libpfctl/libpfctl.c

@@ -3916,6 +3916,73 @@ pfctl_clr_astats(struct pfctl_handle *h, const struct pfr_table *tbl,
 	return (ret);
 }
 
+static int
+_pfctl_test_addrs(struct pfctl_handle *h, const struct pfr_table *tbl,
+    struct pfr_addr *addrs, int size, int *nmatch, int flags)
+{
+	struct snl_writer nw;
+	struct snl_errmsg_data e = {};
+	struct nlmsghdr *hdr;
+	uint32_t seq_id;
+	struct nl_astats attrs;
+	int family_id;
+
+	family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME);
+	if (family_id == 0)
+		return (ENOTSUP);
+
+	snl_init_writer(&h->ss, &nw);
+	hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_TABLE_TEST_ADDRS);
+
+	snl_add_msg_attr_table(&nw, PF_TA_TABLE, tbl);
+	snl_add_msg_attr_u32(&nw, PF_TA_FLAGS, flags);
+	for (int i = 0; i < size; i++)
+		snl_add_msg_attr_pfr_addr(&nw, PF_TA_ADDR, &addrs[i]);
+
+	if ((hdr = snl_finalize_msg(&nw)) == NULL)
+		return (ENXIO);
+	seq_id = hdr->nlmsg_seq;
+
+	if (! snl_send_message(&h->ss, hdr))
+		return (ENXIO);
+
+	while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) {
+		if (! snl_parse_nlmsg(&h->ss, hdr, &table_astats_parser, &attrs))
+			continue;
+	}
+
+	if (nmatch)
+		*nmatch = attrs.total_count;
+
+	return (e.error);
+}
+
+int
+pfctl_test_addrs(struct pfctl_handle *h, const struct pfr_table *tbl,
+    struct pfr_addr *addrs, int size, int *nmatch, int flags)
+{
+	int ret;
+	int off = 0;
+	int partial_match;
+	int chunk_size;
+
+	if (nmatch)
+		*nmatch = 0;
+
+	do {
+		chunk_size = MIN(size - off, 256);
+		ret = _pfctl_test_addrs(h, tbl, &addrs[off], chunk_size,
+		    &partial_match, flags);
+		if (ret != 0)
+			break;
+		if (nmatch)
+			*nmatch += partial_match;
+		off += chunk_size;
+	} while (off < size);
+
+	return (ret);
+}
+
 static void
 snl_add_msg_attr_limit_rate(struct snl_writer *nw, uint32_t type,
     const struct pfctl_limit_rate *rate)

lib/libpfctl/libpfctl.h

@@ -597,6 +597,8 @@ int	pfctl_get_astats(struct pfctl_handle *h, const struct pfr_table *tbl,
 	    struct pfr_astats *addr, int *size, int flags);
 int	pfctl_clr_astats(struct pfctl_handle *h, const struct pfr_table *tbl,
 	    struct pfr_addr *addr, int size, int *nzero, int flags);
+int	pfctl_test_addrs(struct pfctl_handle *h, const struct pfr_table *tbl,
+	    struct pfr_addr *addr, int size, int *nmatch, int flags);
 
 struct pfctl_limit_rate {
 	unsigned int	 limit;

sbin/pfctl/pfctl_radix.c

@@ -214,25 +214,18 @@ int
 pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
     int *nmatch, int flags)
 {
-	struct pfioc_table io;
+	int ret;
 
 	if (tbl == NULL || size < 0 || (size && addr == NULL)) {
 		errno = EINVAL;
 		return (-1);
 	}
-	bzero(&io, sizeof io);
-	io.pfrio_flags = flags;
-	io.pfrio_table = *tbl;
-	io.pfrio_buffer = addr;
-	io.pfrio_esize = sizeof(*addr);
-	io.pfrio_size = size;
-	if (ioctl(dev, DIOCRTSTADDRS, &io)) {
-		pfr_report_error(tbl, &io, "test addresses in");
-		return (-1);
-	}
-	if (nmatch)
-		*nmatch = io.pfrio_nmatch;
-	return (0);
+
+	ret = pfctl_test_addrs(pfh, tbl, addr, size, nmatch, flags);
+	if (ret != 0)
+		errno = ret;
+
+	return (ret);
 }
 
 int

sys/netpfil/pf/pf_nl.c

@@ -2467,6 +2467,40 @@ pf_handle_table_clear_astats(struct nlmsghdr *hdr, struct nl_pstate *npt)
 	return (error);
 }
 
+static int
+pf_handle_table_test_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt)
+{
+	struct nl_parsed_table_addrs attrs = { 0 };
+	struct nl_writer *nw = npt->nw;
+	struct genlmsghdr *ghdr_new;
+	int error;
+
+	PF_RULES_RLOCK_TRACKER;
+
+	error = nl_parse_nlmsg(hdr, &table_addr_parser, npt, &attrs);
+	if (error != 0)
+		return (error);
+
+	PF_RULES_RLOCK();
+	error = pfr_tst_addrs(&attrs.table, &attrs.addrs[0],
+	    attrs.addr_count, &attrs.nchange,
+	    attrs.flags | PFR_FLAG_USERIOCTL);
+	PF_RULES_RUNLOCK();
+
+	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
+		return (ENOMEM);
+
+	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
+	ghdr_new->cmd = PFNL_CMD_TABLE_TEST_ADDRS;
+
+	nlattr_add_u32(nw, PF_TAS_ASTATS_COUNT, attrs.nchange);
+
+	if (!nlmsg_end(nw))
+		return (ENOMEM);
+
+	return (error);
+}
+
 static const struct nlattr_parser nla_p_rate[] = {
 	{ .type = PF_LR_LIMIT, .off = 0, .cb = nlattr_get_uint32 },
 	{ .type = PF_LR_SECONDS, .off = sizeof(unsigned int), .cb = nlattr_get_uint32 },
@@ -3154,6 +3188,13 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
 	},
+	{
+		.cmd_num = PFNL_CMD_TABLE_TEST_ADDRS,
+		.cmd_name = "TABLE_TEST_ADDRS",
+		.cmd_cb = pf_handle_table_test_addrs,
+		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
+		.cmd_priv = PRIV_NETINET_PF,
+	},
 };
 
 void

sys/netpfil/pf/pf_nl.h

@@ -82,6 +82,7 @@ enum {
 	PFNL_CMD_SOURCE_GET = 44,
 	PFNL_CMD_SOURCE_NGET = 45,
 	PFNL_CMD_SOURCE_CLEAR = 46,
+	PFNL_CMD_TABLE_TEST_ADDRS = 47,
 	__PFNL_CMD_MAX,
 };
 #define PFNL_CMD_MAX (__PFNL_CMD_MAX -1)

tests/sys/netpfil/pf/table.sh

@@ -846,6 +846,43 @@ load_cleanup()
 	pft_cleanup
 }
 
+atf_test_case "test" "cleanup"
+test_head()
+{
+	atf_set descr 'Test pfctl -T test functionality'
+	atf_set require.user root
+}
+
+test_body()
+{
+	pft_init
+
+	epair_send=$(vnet_mkepair)
+	ifconfig ${epair_send}a 192.0.2.1/24 up
+
+	vnet_mkjail alcatraz ${epair_send}b
+	jexec alcatraz ifconfig ${epair_send}b 192.0.2.2/24 up
+	jexec alcatraz pfctl -e
+
+	pft_set_rules alcatraz \
+	    "table <foo> counters { 192.0.2.1 }" \
+	    "pass all" \
+	    "match in from <foo> to any" \
+	    "match out from any to <foo>"
+
+	atf_check -s exit:0 -o ignore ping -c 3 192.0.2.2
+
+	atf_check -s exit:2 -e match:"0/1 addresses match." \
+	    jexec alcatraz pfctl -t foo -T test 1.2.3.4
+	atf_check -s exit:0 -e match:"1/1 addresses match." \
+	    jexec alcatraz pfctl -t foo -T test 192.0.2.1
+}
+
+test_cleanup()
+{
+	pft_cleanup
+}
+
 atf_init_test_cases()
 {
 	atf_add_test_case "v4_counters"
@@ -866,4 +903,5 @@ atf_init_test_cases()
 	atf_add_test_case "in_anchor"
 	atf_add_test_case "replace"
 	atf_add_test_case "load"
+	atf_add_test_case "test"
 }