pf: convert DIOCRGETTSTATS to netlink

Sponsored by:	Rubicon Communications, LLC ("Netgate")

lib/libpfctl/libpfctl.c

@@ -3188,3 +3188,94 @@ pfctl_del_table(struct pfctl_handle *h, struct pfr_table *table,
 	return (e.error);
 }
 
+static bool
+snl_attr_get_uint64_into_int_array(struct snl_state *ss, struct nlattr *nla,
+    const void *arg, void *target)
+{
+	uint64_t *u64target;
+	struct snl_uint64_array a = {
+		.count = 0,
+		.max = (size_t)arg,
+	};
+	bool error;
+
+	u64target = malloc(a.max * sizeof(uint64_t));
+	a.array = u64target;
+
+	error = snl_parse_header(ss, NLA_DATA(nla), NLA_DATA_LEN(nla), &array_parser, &a);
+	if (! error)
+		return (error);
+
+	for (size_t i = 0; i < a.count; i++)
+		((int *)target)[i] = (int)u64target[i];
+
+	free(u64target);
+
+	return (true);
+}
+
+#define	_OUT(_field)	offsetof(struct pfr_table, _field)
+static const struct snl_attr_parser ap_table[] = {
+	{ .type = PF_T_ANCHOR, .off = _OUT(pfrt_anchor), .arg = (void *)MAXPATHLEN, .cb = snl_attr_copy_string },
+	{ .type = PF_T_NAME, .off = _OUT(pfrt_name), .arg = (void *)PF_TABLE_NAME_SIZE, .cb =snl_attr_copy_string },
+	{ .type = PF_T_TABLE_FLAGS, .off = _OUT(pfrt_flags), .cb = snl_attr_get_uint32 },
+};
+#undef	_OUT
+SNL_DECLARE_ATTR_PARSER(table_parser, ap_table);
+#define	_OUT(_field)	offsetof(struct pfr_tstats, _field)
+static struct  snl_attr_parser ap_tstats[] = {
+	{ .type = PF_TS_TABLE, .off = _OUT(pfrts_t), .arg = &table_parser, .cb = snl_attr_get_nested },
+	{ .type = PF_TS_PACKETS, .off = _OUT(pfrts_packets), .arg = (void *)(PFR_DIR_MAX * PFR_OP_TABLE_MAX), .cb = snl_attr_get_uint64_array},
+	{ .type = PF_TS_BYTES, .off = _OUT(pfrts_bytes), .arg = (void *)(PFR_DIR_MAX * PFR_OP_TABLE_MAX), .cb = snl_attr_get_uint64_array },
+	{ .type = PF_TS_MATCH, .off = _OUT(pfrts_match), .cb = snl_attr_get_uint64 },
+	{. type = PF_TS_NOMATCH, .off = _OUT(pfrts_nomatch), .cb = snl_attr_get_uint64 },
+	{ .type = PF_TS_TZERO, .off = _OUT(pfrts_tzero), .cb = snl_attr_get_uint64 },
+	{ .type = PF_TS_REFCNT, .off = _OUT(pfrts_cnt), . arg = (void *)PFR_REFCNT_MAX, .cb = snl_attr_get_uint64_into_int_array },
+};
+#undef _OUT
+SNL_DECLARE_PARSER(tstats_parser, struct genlmsghdr, snl_f_p_empty, ap_tstats);
+
+int
+pfctl_get_tstats(struct pfctl_handle *h, const struct pfr_table *filter,
+    pfctl_get_tstats_fn fn, void *arg)
+{
+	struct snl_writer nw;
+	struct snl_errmsg_data e = {};
+	struct nlmsghdr *hdr;
+	uint32_t seq_id;
+	int family_id;
+	int ret;
+
+	family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME);
+	if (family_id == 0)
+		return (ENOTSUP);
+
+	snl_init_writer(&h->ss, &nw);
+	hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_GET_TSTATS);
+
+	snl_add_msg_attr_string(&nw, PF_T_ANCHOR, filter->pfrt_anchor);
+	snl_add_msg_attr_string(&nw, PF_T_NAME, filter->pfrt_name);
+	snl_add_msg_attr_u32(&nw, PF_T_TABLE_FLAGS, filter->pfrt_flags);
+
+	if ((hdr = snl_finalize_msg(&nw)) == NULL)
+		return (ENXIO);
+
+	seq_id = hdr->nlmsg_seq;
+
+	if (!snl_send_message(&h->ss, hdr))
+		return (ENXIO);
+
+	while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) {
+		struct pfr_tstats tstats = {};
+
+		if (!snl_parse_nlmsg(&h->ss, hdr, &tstats_parser, &tstats))
+			continue;
+
+		ret = fn(&tstats, arg);
+		if (ret != 0)
+			break;
+	}
+
+	return (e.error);
+}
+

lib/libpfctl/libpfctl.h

@@ -551,4 +551,8 @@ int	pfctl_add_table(struct pfctl_handle *h, struct pfr_table *table,
 int	pfctl_del_table(struct pfctl_handle *h, struct pfr_table *table,
 	    int *ndel, int flags);
 
+typedef int (*pfctl_get_tstats_fn)(const struct pfr_tstats *t, void *arg);
+int	pfctl_get_tstats(struct pfctl_handle *h, const struct pfr_table *filter,
+	    pfctl_get_tstats_fn fn, void *arg);
+
 #endif

sbin/pfctl/pfctl_radix.c

@@ -110,31 +110,6 @@ pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size,
 	return (0);
 }
 
-int
-pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size,
-	int flags)
-{
-	struct pfioc_table io;
-
-	if (size == NULL || *size < 0 || (*size && tbl == NULL)) {
-		errno = EINVAL;
-		return (-1);
-	}
-	bzero(&io, sizeof io);
-	io.pfrio_flags = flags;
-	if (filter != NULL)
-		io.pfrio_table = *filter;
-	io.pfrio_buffer = tbl;
-	io.pfrio_esize = sizeof(*tbl);
-	io.pfrio_size = *size;
-	if (ioctl(dev, DIOCRGETTSTATS, &io)) {
-		pfr_report_error(filter, &io, "get tstats for");
-		return (-1);
-	}
-	*size = io.pfrio_size;
-	return (0);
-}
-
 int
 pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags)
 {

sbin/pfctl/pfctl_table.c

@@ -57,8 +57,8 @@
 extern void	usage(void);
 static int	pfctl_table(int, char *[], char *, const char *, char *,
 		    const char *, int);
-static void	print_table(struct pfr_table *, int, int);
+static void	print_table(const struct pfr_table *, int, int);
-static void	print_tstats(struct pfr_tstats *, int);
+static int	print_tstats(const struct pfr_tstats *, int);
 static int	load_addr(struct pfr_buffer *, int, char *[], char *, int);
 static void	print_addrx(struct pfr_addr *, struct pfr_addr *, int);
 static int 	nonzero_astats(struct pfr_astats *);
@@ -165,28 +165,31 @@ pfctl_table(int argc, char *argv[], char *tname, const char *command,
 		    PFRB_TSTATS : PFRB_TABLES;
 		if (argc || file != NULL)
 			usage();
-		for (;;) {
-			pfr_buf_grow(&b, b.pfrb_size);
-			b.pfrb_size = b.pfrb_msize;
-			if (opts & PF_OPT_VERBOSE2)
-				RVTEST(pfr_get_tstats(&table,
-				    b.pfrb_caddr, &b.pfrb_size, flags));
-			else
-				RVTEST(pfr_get_tables(&table,
-				    b.pfrb_caddr, &b.pfrb_size, flags));
-			if (b.pfrb_size <= b.pfrb_msize)
-				break;
-		}
 
 		if ((opts & PF_OPT_SHOWALL) && b.pfrb_size > 0)
 			pfctl_print_title("TABLES:");
 
-		PFRB_FOREACH(p, &b)
+		if (opts & PF_OPT_VERBOSE2) {
-			if (opts & PF_OPT_VERBOSE2)
+			uintptr_t arg = opts & PF_OPT_DEBUG;
-				print_tstats(p, opts & PF_OPT_DEBUG);
+			pfctl_get_tstats(pfh, &table,
-			else
+			    (pfctl_get_tstats_fn)print_tstats, (void *)arg);
+		} else {
+			for (;;) {
+				pfr_buf_grow(&b, b.pfrb_size);
+				b.pfrb_size = b.pfrb_msize;
+				RVTEST(pfr_get_tables(&table,
+				    b.pfrb_caddr, &b.pfrb_size, flags));
+				if (b.pfrb_size <= b.pfrb_msize)
+					break;
+			}
+
+			if ((opts & PF_OPT_SHOWALL) && b.pfrb_size > 0)
+				pfctl_print_title("TABLES:");
+
+			PFRB_FOREACH(p, &b)
 				print_table(p, opts & PF_OPT_VERBOSE,
 				    opts & PF_OPT_DEBUG);
+		}
 	} else if (!strcmp(command, "kill")) {
 		if (argc || file != NULL)
 			usage();
@@ -408,7 +411,7 @@ pfctl_table(int argc, char *argv[], char *tname, const char *command,
 }
 
 void
-print_table(struct pfr_table *ta, int verbose, int debug)
+print_table(const struct pfr_table *ta, int verbose, int debug)
 {
 	if (!debug && !(ta->pfrt_flags & PFR_TFLAG_ACTIVE))
 		return;
@@ -429,14 +432,14 @@ print_table(struct pfr_table *ta, int verbose, int debug)
 		puts(ta->pfrt_name);
 }
 
-void
+int
-print_tstats(struct pfr_tstats *ts, int debug)
+print_tstats(const struct pfr_tstats *ts, int debug)
 {
 	time_t	time = ts->pfrts_tzero;
 	int	dir, op;
 
 	if (!debug && !(ts->pfrts_flags & PFR_TFLAG_ACTIVE))
-		return;
+		return (0);
 	print_table(&ts->pfrts_t, 1, debug);
 	printf("\tAddresses:   %d\n", ts->pfrts_cnt);
 	printf("\tCleared:     %s", ctime(&time));
@@ -452,6 +455,8 @@ print_tstats(struct pfr_tstats *ts, int debug)
 			    stats_text[dir][op],
 			    (unsigned long long)ts->pfrts_packets[dir][op],
 			    (unsigned long long)ts->pfrts_bytes[dir][op]);
+
+	return (0);
 }
 
 int

sys/netpfil/pf/pf_nl.c

@@ -1937,6 +1937,104 @@ pf_handle_del_table(struct nlmsghdr *hdr, struct nl_pstate *npt)
 	return (0);
 }
 
+static bool
+nlattr_add_pfr_table(struct nl_writer *nw, int attrtype,
+    struct pfr_table *t)
+{
+	int	 off = nlattr_add_nested(nw, attrtype);
+
+	nlattr_add_string(nw, PF_T_ANCHOR, t->pfrt_anchor);
+	nlattr_add_string(nw, PF_T_NAME, t->pfrt_name);
+	nlattr_add_u32(nw, PF_T_TABLE_FLAGS, t->pfrt_flags);
+
+	nlattr_set_len(nw, off);
+
+	return (true);
+}
+
+static int
+pf_handle_get_tstats(struct nlmsghdr *hdr, struct nl_pstate *npt)
+{
+	struct pfioc_table attrs = { 0 };
+	struct nl_writer *nw = npt->nw;
+	struct genlmsghdr *ghdr_new;
+	struct pfr_tstats *pfrtstats;
+	int error;
+	int n;
+
+	PF_RULES_RLOCK_TRACKER;
+
+	error = nl_parse_nlmsg(hdr, &table_parser, npt, &attrs);
+	if (error != 0)
+		return (error);
+
+	PF_TABLE_STATS_LOCK();
+	PF_RULES_RLOCK();
+
+	n = pfr_table_count(&attrs.pfrio_table, attrs.pfrio_flags);
+	pfrtstats = mallocarray(n,
+	    sizeof(struct pfr_tstats), M_TEMP, M_NOWAIT | M_ZERO);
+
+	error = pfr_get_tstats(&attrs.pfrio_table, pfrtstats,
+	    &n, attrs.pfrio_flags | PFR_FLAG_USERIOCTL);
+
+	PF_RULES_RUNLOCK();
+	PF_TABLE_STATS_UNLOCK();
+
+	if (error == 0) {
+		hdr->nlmsg_flags |= NLM_F_MULTI;
+
+		for (int i = 0; i < n; i++) {
+			uint64_t refcnt[PFR_REFCNT_MAX];
+
+			if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) {
+				error = ENOMEM;
+				break;
+			}
+
+			ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
+			ghdr_new->cmd = PFNL_CMD_GET_TSTATS;
+			ghdr_new->version = 0;
+			ghdr_new->reserved = 0;
+
+			nlattr_add_pfr_table(nw, PF_TS_TABLE,
+			    &pfrtstats[i].pfrts_t);
+			nlattr_add_u64_array(nw, PF_TS_PACKETS,
+			    PFR_DIR_MAX * PFR_OP_TABLE_MAX,
+			    (uint64_t *)pfrtstats[i].pfrts_packets);
+			nlattr_add_u64_array(nw, PF_TS_BYTES,
+			    PFR_DIR_MAX * PFR_OP_TABLE_MAX,
+			    (uint64_t *)pfrtstats[i].pfrts_bytes);
+			nlattr_add_u64(nw, PF_TS_MATCH,
+			    pfrtstats[i].pfrts_match);
+			nlattr_add_u64(nw, PF_TS_NOMATCH,
+			    pfrtstats[i].pfrts_nomatch);
+			nlattr_add_u64(nw, PF_TS_TZERO,
+			    pfrtstats[i].pfrts_tzero);
+			nlattr_add_u64(nw, PF_TS_CNT, pfrtstats[i].pfrts_cnt);
+
+			for (int j = 0; j < PFR_REFCNT_MAX; j++)
+				refcnt[j] = pfrtstats[i].pfrts_refcnt[j];
+
+			nlattr_add_u64_array(nw, PF_TS_REFCNT, PFR_REFCNT_MAX,
+			    refcnt);
+
+			if (! nlmsg_end(nw)) {
+				error = ENOMEM;
+				break;
+			}
+		}
+	}
+	free(pfrtstats, M_TEMP);
+
+	if (!nlmsg_end_dump(npt->nw, error, hdr)) {
+		NL_LOG(LOG_DEBUG, "Unable to finalize the dump");
+		return (ENOMEM);
+	}
+
+	return (error);
+}
+
 static const struct nlhdr_parser *all_parsers[] = {
 	&state_parser,
 	&addrule_parser,
@@ -2152,6 +2250,13 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
 	},
+	{
+		.cmd_num = PFNL_CMD_GET_TSTATS,
+		.cmd_name = "GET_TSTATS",
+		.cmd_cb = pf_handle_get_tstats,
+		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
+		.cmd_priv = PRIV_NETINET_PF,
+	},
 };
 
 void

sys/netpfil/pf/pf_nl.h

@@ -64,6 +64,7 @@ enum {
 	PFNL_CMD_CLEAR_TABLES = 26,
 	PFNL_CMD_ADD_TABLE = 27,
 	PFNL_CMD_DEL_TABLE = 28,
+	PFNL_CMD_GET_TSTATS = 29,
 	__PFNL_CMD_MAX,
 };
 #define PFNL_CMD_MAX (__PFNL_CMD_MAX -1)
@@ -442,6 +443,18 @@ enum pf_tables_t {
 	PF_T_NBR_ADDED		= 6, /* u32 */
 };
 
+enum pf_tstats_t {
+	PF_TS_UNSPEC,
+	PF_TS_TABLE		= 1, /* nested, pfr_table */
+	PF_TS_PACKETS		= 2, /* u64 array */
+	PF_TS_BYTES		= 3, /* u64 array */
+	PF_TS_MATCH		= 4, /* u64 */
+	PF_TS_NOMATCH		= 5, /* u64 */
+	PF_TS_TZERO		= 6, /* u64 */
+	PF_TS_CNT		= 7, /* u64 */
+	PF_TS_REFCNT		= 8, /* u64 array */
+};
+
 #ifdef _KERNEL
 
 void	pf_nl_register(void);

usr.sbin/bsnmpd/modules/snmp_pf/pf_snmp.c

@@ -1297,11 +1297,28 @@ pfs_refresh(void)
 	return (0);
 }
 
+static int
+pft_add_tstats(const struct pfr_tstats *t, void *arg)
+{
+	struct pft_entry *e;
+	int *index = arg;
+
+	e = malloc(sizeof(struct pft_entry));
+	if (e == NULL)
+		return (ENOMEM);
+
+	e->index = (*index) + 1;
+	(*index)++;
+	memcpy(&e->pft, t, sizeof(struct pfr_tstats));
+	TAILQ_INSERT_TAIL(&pft_table, e, link);
+
+	return (0);
+}
+
 static int
 pft_refresh(void)
 {
-	struct pfioc_table io;
+	struct pfr_table filter;
-	struct pfr_tstats *t = NULL;
 	struct pft_entry *e;
 	int i, numtbls = 1;
 
@@ -1314,45 +1331,18 @@ pft_refresh(void)
 		free(e);
 	}
 
-	bzero(&io, sizeof(io));
+	bzero(&filter, sizeof(filter));
-	io.pfrio_esize = sizeof(struct pfr_tstats);
 
-	for (;;) {
+	if (pfctl_get_tstats(pfh, &filter, pft_add_tstats, &i)) {
-		t = reallocf(t, numtbls * sizeof(struct pfr_tstats));
+		syslog(LOG_ERR, "pft_refresh(): pfctl_get_tstats(): %s",
-		if (t == NULL) {
+		    strerror(errno));
-			syslog(LOG_ERR, "pft_refresh(): reallocf() numtbls=%d: %s",
+		goto err1;
-			    numtbls, strerror(errno));
-			goto err2;
-		}
-		io.pfrio_size = numtbls;
-		io.pfrio_buffer = t;
-
-		if (ioctl(pfctl_fd(pfh), DIOCRGETTSTATS, &io)) {
-			syslog(LOG_ERR, "pft_refresh(): ioctl(): %s",
-			    strerror(errno));
-			goto err2;
-		}
-
-		if (numtbls >= io.pfrio_size)
-			break;
-
-		numtbls = io.pfrio_size;
-	}
-
-	for (i = 0; i < numtbls; i++) {
-		e = malloc(sizeof(struct pft_entry));
-		if (e == NULL)
-			goto err1;
-		e->index = i + 1;
-		memcpy(&e->pft, t+i, sizeof(struct pfr_tstats));
-		TAILQ_INSERT_TAIL(&pft_table, e, link);
 	}
 
 	pft_table_age = time(NULL);
 	pft_table_count = numtbls;
 	pf_tick = this_tick;
 
-	free(t);
 	return (0);
 err1:
 	while (!TAILQ_EMPTY(&pft_table)) {
@@ -1360,8 +1350,6 @@ pft_refresh(void)
 		TAILQ_REMOVE(&pft_table, e, link);
 		free(e);
 	}
-err2:
-	free(t);
 	return(-1);
 }