netpfil/pf/pf_nl.c

84 dump_addr(struct nl_writer *nw, int attr, const struct pf_addr *addr, int af)
88 		nlattr_add(nw, attr, 4, &addr->v4);
91 		nlattr_add(nw, attr, 16, &addr->v6);
97 dump_state_peer(struct nl_writer *nw, int attr, const struct pf_state_peer *peer)
99 	int off = nlattr_add_nested(nw, attr);
103 	nlattr_add_u32(nw, PF_STP_SEQLO, peer->seqlo);
104 	nlattr_add_u32(nw, PF_STP_SEQHI, peer->seqhi);
105 	nlattr_add_u32(nw, PF_STP_SEQDIFF, peer->seqdiff);
106 	nlattr_add_u16(nw, PF_STP_MAX_WIN, peer->max_win);
107 	nlattr_add_u16(nw, PF_STP_MSS, peer->mss);
108 	nlattr_add_u8(nw, PF_STP_STATE, peer->state);
109 	nlattr_add_u8(nw, PF_STP_WSCALE, peer->wscale);
115 		nlattr_add_u16(nw, PF_STP_PFSS_FLAGS, pfss_flags);
116 		nlattr_add_u32(nw, PF_STP_PFSS_TS_MOD, sc->pfss_ts_mod);
117 		nlattr_add_u8(nw, PF_STP_PFSS_TTL, sc->pfss_ttl);
118 		nlattr_add_u8(nw, PF_STP_SCRUB_FLAG, PFSYNC_SCRUB_FLAG_VALID);
120 	nlattr_set_len(nw, off);
126 dump_state_key(struct nl_writer *nw, int attr, const struct pf_state_key *key)
128 	int off = nlattr_add_nested(nw, attr);
132 	dump_addr(nw, PF_STK_ADDR0, &key->addr[0], key->af);
133 	dump_addr(nw, PF_STK_ADDR1, &key->addr[1], key->af);
134 	nlattr_add_u16(nw, PF_STK_PORT0, key->port[0]);
135 	nlattr_add_u16(nw, PF_STK_PORT1, key->port[1]);
137 	nlattr_set_len(nw, off);
146 	struct nl_writer *nw = npt->nw;
151 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
154 	struct genlmsghdr *ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
159 	nlattr_add_u64(nw, PF_ST_VERSION, PF_STATE_VERSION);
162 	if (!dump_state_key(nw, PF_ST_KEY_WIRE, key))
165 	if (!dump_state_key(nw, PF_ST_KEY_STACK, key))
169 	nlattr_add_u8(nw, PF_ST_PROTO, s->key[PF_SK_WIRE]->proto);
170 	nlattr_add_u8(nw, PF_ST_AF, af);
172 	nlattr_add_string(nw, PF_ST_IFNAME, s->kif->pfik_name);
173 	nlattr_add_string(nw, PF_ST_ORIG_IFNAME, s->orig_kif->pfik_name);
174 	dump_addr(nw, PF_ST_RT_ADDR, &s->rt_addr, af);
175 	nlattr_add_u32(nw, PF_ST_CREATION, time_uptime - (s->creation / 1000));
179 	nlattr_add_u32(nw, PF_ST_EXPIRE, expire);
180 	nlattr_add_u8(nw, PF_ST_DIRECTION, s->direction);
181 	nlattr_add_u8(nw, PF_ST_LOG, s->act.log);
182 	nlattr_add_u8(nw, PF_ST_TIMEOUT, s->timeout);
183 	nlattr_add_u16(nw, PF_ST_STATE_FLAGS, s->state_flags);
189 	nlattr_add_u8(nw, PF_ST_SYNC_FLAGS, sync_flags);
190 	nlattr_add_u64(nw, PF_ST_ID, s->id);
191 	nlattr_add_u32(nw, PF_ST_CREATORID, htonl(s->creatorid));
193 	nlattr_add_u32(nw, PF_ST_RULE, s->rule.ptr ? s->rule.ptr->nr : -1);
194 	nlattr_add_u32(nw, PF_ST_ANCHOR, s->anchor.ptr ? s->anchor.ptr->nr : -1);
195 	nlattr_add_u32(nw, PF_ST_NAT_RULE, s->nat_rule.ptr ? s->nat_rule.ptr->nr : -1);
197 	nlattr_add_u64(nw, PF_ST_PACKETS0, s->packets[0]);
198 	nlattr_add_u64(nw, PF_ST_PACKETS1, s->packets[1]);
199 	nlattr_add_u64(nw, PF_ST_BYTES0, s->bytes[0]);
200 	nlattr_add_u64(nw, PF_ST_BYTES1, s->bytes[1]);
201 	nlattr_add_u32(nw, PF_ST_RTABLEID, s->act.rtableid);
202 	nlattr_add_u8(nw, PF_ST_MIN_TTL, s->act.min_ttl);
203 	nlattr_add_u16(nw, PF_ST_MAX_MSS, s->act.max_mss);
204 	nlattr_add_u16(nw, PF_ST_DNPIPE, s->act.dnpipe);
205 	nlattr_add_u16(nw, PF_ST_DNRPIPE, s->act.dnrpipe);
206 	nlattr_add_u8(nw, PF_ST_RT, s->rt);
208 		nlattr_add_string(nw, PF_ST_RT_IFNAME, s->rt_kif->pfik_name);
210 	if (!dump_state_peer(nw, PF_ST_PEER_SRC, &s->src))
212 	if (!dump_state_peer(nw, PF_ST_PEER_DST, &s->dst))
215 	if (nlmsg_end(nw))
220 	nlmsg_abort(nw);
273 	if (!nlmsg_end_dump(npt->nw, error, hdr)) {
295 	struct nl_writer *nw = npt->nw;
297 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
300 	struct genlmsghdr *ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
305 	nlattr_add_u32(nw, PF_ST_CREATORID, htonl(creator));
307 	if (nlmsg_end(nw))
311 	nlmsg_abort(nw);
375 	if (!nlmsg_end_dump(npt->nw, error, hdr)) {
408 nlattr_add_addr_wrap(struct nl_writer *nw, int attrtype, struct pf_addr_wrap *a)
410 	int off = nlattr_add_nested(nw, attrtype);
413 	nlattr_add_in6_addr(nw, PF_AT_ADDR, &a->v.a.addr.v6);
414 	nlattr_add_in6_addr(nw, PF_AT_MASK, &a->v.a.mask.v6);
415 	nlattr_add_u8(nw, PF_AT_TYPE, a->type);
416 	nlattr_add_u8(nw, PF_AT_IFLAGS, a->iflags);
419 		nlattr_add_string(nw, PF_AT_IFNAME, a->v.ifname);
423 		nlattr_add_u32(nw, PF_AT_DYNCNT, num);
427 		nlattr_add_string(nw, PF_AT_TABLENAME, a->v.tblname);
435 		nlattr_add_u32(nw, PF_AT_TBLCNT, num);
438 	nlattr_set_len(nw, off);
455 nlattr_add_rule_addr(struct nl_writer *nw, int attrtype, struct pf_rule_addr *r)
457 	int off = nlattr_add_nested(nw, attrtype);
459 	nlattr_add_addr_wrap(nw, PF_RAT_ADDR, &r->addr);
460 	nlattr_add_u16(nw, PF_RAT_SRC_PORT, r->port[0]);
461 	nlattr_add_u16(nw, PF_RAT_DST_PORT, r->port[1]);
462 	nlattr_add_u8(nw, PF_RAT_NEG, r->neg);
463 	nlattr_add_u8(nw, PF_RAT_OP, r->port_op);
465 	nlattr_set_len(nw, off);
480 nlattr_add_mape_portset(struct nl_writer *nw, int attrtype, const struct pf_mape_portset *m)
482 	int off = nlattr_add_nested(nw, attrtype);
484 	nlattr_add_u8(nw, PF_MET_OFFSET, m->offset);
485 	nlattr_add_u8(nw, PF_MET_PSID_LEN, m->psidlen);
486 	nlattr_add_u16(nw, PF_MET_PSID, m->psid);
488 	nlattr_set_len(nw, off);
541 nlattr_add_labels(struct nl_writer *nw, int attrtype, const struct pf_krule *r)
543 	int off = nlattr_add_nested(nw, attrtype);
548 		nlattr_add_string(nw, PF_LT_LABEL, r->label[i]);
552 	nlattr_set_len(nw, off);
571 nlattr_add_pool(struct nl_writer *nw, int attrtype, const struct pf_kpool *pool)
573 	int off = nlattr_add_nested(nw, attrtype);
575 	nlattr_add(nw, PF_PT_KEY, sizeof(struct pf_poolhashkey), &pool->key);
576 	nlattr_add_in6_addr(nw, PF_PT_COUNTER, (const struct in6_addr *)&pool->counter);
577 	nlattr_add_u32(nw, PF_PT_TBLIDX, pool->tblidx);
578 	nlattr_add_u16(nw, PF_PT_PROXY_SRC_PORT, pool->proxy_port[0]);
579 	nlattr_add_u16(nw, PF_PT_PROXY_DST_PORT, pool->proxy_port[1]);
580 	nlattr_add_u8(nw, PF_PT_OPTS, pool->opts);
581 	nlattr_add_mape_portset(nw, PF_PT_MAPE, &pool->mape);
583 	nlattr_set_len(nw, off);
598 nlattr_add_rule_uid(struct nl_writer *nw, int attrtype, const struct pf_rule_uid *u)
600 	int off = nlattr_add_nested(nw, attrtype);
602 	nlattr_add_u32(nw, PF_RUT_UID_LOW, u->uid[0]);
603 	nlattr_add_u32(nw, PF_RUT_UID_HIGH, u->uid[1]);
604 	nlattr_add_u8(nw, PF_RUT_OP, u->op);
606 	nlattr_set_len(nw, off);
658 nlattr_add_timeout(struct nl_writer *nw, int attrtype, uint32_t *timeout)
660 	int off = nlattr_add_nested(nw, attrtype);
663 		nlattr_add_u32(nw, PF_RT_TIMEOUT, timeout[i]);
665 	nlattr_set_len(nw, off);
797 	struct nl_writer *nw = npt->nw;
804 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
807 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
816 	nlattr_add_u32(nw, PF_GR_NR, attrs.nr);
817 	nlattr_add_u32(nw, PF_GR_TICKET, attrs.ticket);
819 	if (!nlmsg_end(nw)) {
827 	nlmsg_abort(nw);
858 	struct nl_writer		*nw = npt->nw;
869 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
872 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
907 	nlattr_add_rule_addr(nw, PF_RT_SRC, &rule->src);
908 	nlattr_add_rule_addr(nw, PF_RT_DST, &rule->dst);
909 	nlattr_add_u32(nw, PF_RT_RIDENTIFIER, rule->ridentifier);
910 	nlattr_add_labels(nw, PF_RT_LABELS, rule);
911 	nlattr_add_string(nw, PF_RT_IFNAME, rule->ifname);
912 	nlattr_add_string(nw, PF_RT_QNAME, rule->qname);
913 	nlattr_add_string(nw, PF_RT_PQNAME, rule->pqname);
914 	nlattr_add_string(nw, PF_RT_TAGNAME, rule->tagname);
915 	nlattr_add_string(nw, PF_RT_MATCH_TAGNAME, rule->match_tagname);
916 	nlattr_add_string(nw, PF_RT_OVERLOAD_TBLNAME, rule->overload_tblname);
917 	nlattr_add_pool(nw, PF_RT_RPOOL, &rule->rpool);
918 	nlattr_add_u32(nw, PF_RT_OS_FINGERPRINT, rule->os_fingerprint);
919 	nlattr_add_u32(nw, PF_RT_RTABLEID, rule->rtableid);
920 	nlattr_add_timeout(nw, PF_RT_TIMEOUT, rule->timeout);
921 	nlattr_add_u32(nw, PF_RT_MAX_STATES, rule->max_states);
922 	nlattr_add_u32(nw, PF_RT_MAX_SRC_NODES, rule->max_src_nodes);
923 	nlattr_add_u32(nw, PF_RT_MAX_SRC_STATES, rule->max_src_states);
924 	nlattr_add_u32(nw, PF_RT_MAX_SRC_CONN_RATE_LIMIT, rule->max_src_conn_rate.limit);
925 	nlattr_add_u32(nw, PF_RT_MAX_SRC_CONN_RATE_SECS, rule->max_src_conn_rate.seconds);
927 	nlattr_add_u16(nw, PF_RT_DNPIPE, rule->dnpipe);
928 	nlattr_add_u16(nw, PF_RT_DNRPIPE, rule->dnrpipe);
929 	nlattr_add_u32(nw, PF_RT_DNFLAGS, rule->free_flags);
931 	nlattr_add_u32(nw, PF_RT_NR, rule->nr);
932 	nlattr_add_u32(nw, PF_RT_PROB, rule->prob);
933 	nlattr_add_u32(nw, PF_RT_CUID, rule->cuid);
934 	nlattr_add_u32(nw, PF_RT_CPID, rule->cpid);
936 	nlattr_add_u16(nw, PF_RT_RETURN_ICMP, rule->return_icmp);
937 	nlattr_add_u16(nw, PF_RT_RETURN_ICMP6, rule->return_icmp6);
938 	nlattr_add_u16(nw, PF_RT_RETURN_ICMP6, rule->return_icmp6);
939 	nlattr_add_u16(nw, PF_RT_MAX_MSS, rule->max_mss);
940 	nlattr_add_u16(nw, PF_RT_SCRUB_FLAGS, rule->scrub_flags);
942 	nlattr_add_rule_uid(nw, PF_RT_UID, &rule->uid);
943 	nlattr_add_rule_uid(nw, PF_RT_GID, (const struct pf_rule_uid *)&rule->gid);
945 	nlattr_add_u32(nw, PF_RT_RULE_FLAG, rule->rule_flag);
946 	nlattr_add_u8(nw, PF_RT_ACTION, rule->action);
947 	nlattr_add_u8(nw, PF_RT_DIRECTION, rule->direction);
948 	nlattr_add_u8(nw, PF_RT_LOG, rule->log);
949 	nlattr_add_u8(nw, PF_RT_LOGIF, rule->logif);
950 	nlattr_add_u8(nw, PF_RT_QUICK, rule->quick);
951 	nlattr_add_u8(nw, PF_RT_IF_NOT, rule->ifnot);
952 	nlattr_add_u8(nw, PF_RT_MATCH_TAG_NOT, rule->match_tag_not);
953 	nlattr_add_u8(nw, PF_RT_NATPASS, rule->natpass);
954 	nlattr_add_u8(nw, PF_RT_KEEP_STATE, rule->keep_state);
956 	nlattr_add_u8(nw, PF_RT_AF, rule->af);
957 	nlattr_add_u8(nw, PF_RT_PROTO, rule->proto);
958 	nlattr_add_u8(nw, PF_RT_TYPE, rule->type);
959 	nlattr_add_u8(nw, PF_RT_CODE, rule->code);
960 	nlattr_add_u8(nw, PF_RT_FLAGS, rule->flags);
961 	nlattr_add_u8(nw, PF_RT_FLAGSET, rule->flagset);
962 	nlattr_add_u8(nw, PF_RT_MIN_TTL, rule->min_ttl);
963 	nlattr_add_u8(nw, PF_RT_ALLOW_OPTS, rule->allow_opts);
964 	nlattr_add_u8(nw, PF_RT_RT, rule->rt);
965 	nlattr_add_u8(nw, PF_RT_RETURN_TTL, rule->return_ttl);
966 	nlattr_add_u8(nw, PF_RT_TOS, rule->tos);
967 	nlattr_add_u8(nw, PF_RT_SET_TOS, rule->set_tos);
968 	nlattr_add_u8(nw, PF_RT_ANCHOR_RELATIVE, rule->anchor_relative);
969 	nlattr_add_u8(nw, PF_RT_ANCHOR_WILDCARD, rule->anchor_wildcard);
970 	nlattr_add_u8(nw, PF_RT_FLUSH, rule->flush);
971 	nlattr_add_u8(nw, PF_RT_PRIO, rule->prio);
972 	nlattr_add_u8(nw, PF_RT_SET_PRIO, rule->set_prio[0]);
973 	nlattr_add_u8(nw, PF_RT_SET_PRIO_REPLY, rule->set_prio[1]);
975 	nlattr_add_in6_addr(nw, PF_RT_DIVERT_ADDRESS, &rule->divert.addr.v6);
976 	nlattr_add_u16(nw, PF_RT_DIVERT_PORT, rule->divert.port);
978 	nlattr_add_u64(nw, PF_RT_PACKETS_IN, pf_counter_u64_fetch(&rule->packets[0]));
979 	nlattr_add_u64(nw, PF_RT_PACKETS_OUT, pf_counter_u64_fetch(&rule->packets[1]));
980 	nlattr_add_u64(nw, PF_RT_BYTES_IN, pf_counter_u64_fetch(&rule->bytes[0]));
981 	nlattr_add_u64(nw, PF_RT_BYTES_OUT, pf_counter_u64_fetch(&rule->bytes[1]));
982 	nlattr_add_u64(nw, PF_RT_EVALUATIONS, pf_counter_u64_fetch(&rule->evaluations));
983 	nlattr_add_u64(nw, PF_RT_TIMESTAMP, pf_get_timestamp(rule));
984 	nlattr_add_u64(nw, PF_RT_STATES_CUR, counter_u64_fetch(rule->states_cur));
985 	nlattr_add_u64(nw, PF_RT_STATES_TOTAL, counter_u64_fetch(rule->states_tot));
986 	nlattr_add_u64(nw, PF_RT_SRC_NODES, counter_u64_fetch(rule->src_nodes));
991 	nlattr_add_string(nw, PF_RT_ANCHOR_CALL, anchor_call);
998 	if (!nlmsg_end(nw)) {
1005 	nlmsg_abort(nw);
1035 	struct nl_writer		*nw = npt->nw;
1044 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1047 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1059 	nlattr_add_u32(nw, PF_CS_KILLED, killed);
1061 	if (! nlmsg_end(nw)) {
1069 	nlmsg_abort(nw);
1116 nlattr_add_counters(struct nl_writer *nw, int attr, size_t number, char **names,
1120 		int off = nlattr_add_nested(nw, attr);
1121 		nlattr_add_u32(nw, PF_C_ID, i);
1122 		nlattr_add_string(nw, PF_C_NAME, names[i]);
1123 		nlattr_add_u64(nw, PF_C_COUNTER, counter_u64_fetch(counters[i]));
1124 		nlattr_set_len(nw, off);
1131 nlattr_add_fcounters(struct nl_writer *nw, int attr, size_t number, char **names,
1135 		int off = nlattr_add_nested(nw, attr);
1136 		nlattr_add_u32(nw, PF_C_ID, i);
1137 		nlattr_add_string(nw, PF_C_NAME, names[i]);
1138 		nlattr_add_u64(nw, PF_C_COUNTER, pf_counter_u64_fetch(&counters[i]));
1139 		nlattr_set_len(nw, off);
1146 nlattr_add_u64_array(struct nl_writer *nw, int attr, size_t number, uint64_t *array)
1148 	int off = nlattr_add_nested(nw, attr);
1151 		nlattr_add_u64(nw, 0, array[i]);
1153 	nlattr_set_len(nw, off);
1162 	struct nl_writer *nw = npt->nw;
1171 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1174 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1181 	nlattr_add_string(nw, PF_GS_IFNAME, V_pf_status.ifname);
1182 	nlattr_add_bool(nw, PF_GS_RUNNING, V_pf_status.running);
1183 	nlattr_add_u32(nw, PF_GS_SINCE, V_pf_status.since);
1184 	nlattr_add_u32(nw, PF_GS_DEBUG, V_pf_status.debug);
1185 	nlattr_add_u32(nw, PF_GS_HOSTID, ntohl(V_pf_status.hostid));
1186 	nlattr_add_u32(nw, PF_GS_STATES, V_pf_status.states);
1187 	nlattr_add_u32(nw, PF_GS_SRC_NODES, V_pf_status.src_nodes);
1188 	nlattr_add_u32(nw, PF_GS_REASSEMBLE, V_pf_status.reass);
1189 	nlattr_add_u32(nw, PF_GS_SYNCOOKIES_ACTIVE, V_pf_status.syncookies_active);
1191 	nlattr_add_counters(nw, PF_GS_COUNTERS, PFRES_MAX, pf_reasons,
1193 	nlattr_add_counters(nw, PF_GS_LCOUNTERS, KLCNT_MAX, pf_lcounter,
1195 	nlattr_add_fcounters(nw, PF_GS_FCOUNTERS, FCNT_MAX, pf_fcounter,
1197 	nlattr_add_counters(nw, PF_GS_SCOUNTERS, SCNT_MAX, pf_fcounter,
1201 	nlattr_add_u64_array(nw, PF_GS_BCOUNTERS, 2 * 2, (uint64_t *)s.bcounters);
1202 	nlattr_add_u64_array(nw, PF_GS_PCOUNTERS, 2 * 2 * 2, (uint64_t *)s.pcounters);
1204 	nlattr_add(nw, PF_GS_CHKSUM, PF_MD5_DIGEST_LENGTH, V_pf_status.pf_chksum);
1208 	if (!nlmsg_end(nw)) {
1216 	nlmsg_abort(nw);
1259 	struct nl_writer	*nw = npt->nw;
1296 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) {
1301 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1308 	nlattr_add_in6_addr(nw, PF_NL_SRC_ADDR, &sk->addr[sidx].v6);
1309 	nlattr_add_in6_addr(nw, PF_NL_DST_ADDR, &sk->addr[didx].v6);
1310 	nlattr_add_u16(nw, PF_NL_SRC_PORT, sk->port[sidx]);
1311 	nlattr_add_u16(nw, PF_NL_DST_PORT, sk->port[didx]);
1315 	if (!nlmsg_end(nw)) {
1316 		nlmsg_abort(nw);
1383 	struct nl_writer *nw = npt->nw;
1395 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1398 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1403 	nlattr_add_u32(nw, PF_TO_SECONDS, attrs.seconds);
1405 	if (!nlmsg_end(nw)) {
1406 		nlmsg_abort(nw);
1444 	struct nl_writer *nw = npt->nw;
1456 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1459 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1464 	nlattr_add_u32(nw, PF_LI_LIMIT, attrs.limit);
1466 	if (!nlmsg_end(nw)) {
1467 		nlmsg_abort(nw);
1477 	struct nl_writer *nw = npt->nw;
1486 	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
1489 	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
1494 	nlattr_add_u32(nw, PF_BA_TICKET, ticket);
1496 	if (!nlmsg_end(nw)) {
1497 		nlmsg_abort(nw);