pf: convert DIOCRADDADDRS to netlink

Add up to 64 addresses at once. We are limited by the netlink socket buffer, so
we can only add a limited number at once.

Sponsored by:	Rubicon Communications, LLC ("Netgate")

contrib/pf/authpf/authpf.c

@@ -863,7 +863,7 @@ change_table(int add, const char *ip_src)
 	}
 
 	if (add)
-		ret = pfctl_table_add_addrs(pfctl_fd(pfh), &tbl, &addr, 1, NULL, 0);
+		ret = pfctl_table_add_addrs_h(pfh, &tbl, &addr, 1, NULL, 0);
 	else
 		ret = pfctl_table_del_addrs(pfctl_fd(pfh), &tbl, &addr, 1, NULL, 0);
 

lib/libpfctl/libpfctl.c

@@ -2397,6 +2397,106 @@ pfctl_table_add_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
 	return (0);
 }
 
+static void
+snl_add_msg_attr_table(struct snl_writer *nw, uint32_t type,
+    const struct pfr_table *tbl)
+{
+	int off;
+
+	off = snl_add_msg_attr_nested(nw, type);
+
+	snl_add_msg_attr_string(nw, PF_T_ANCHOR, tbl->pfrt_anchor);
+	snl_add_msg_attr_string(nw, PF_T_NAME, tbl->pfrt_name);
+	snl_add_msg_attr_u32(nw, PF_T_TABLE_FLAGS, tbl->pfrt_flags);
+
+	snl_end_attr_nested(nw, off);
+}
+
+static void
+snl_add_msg_attr_pfr_addr(struct snl_writer *nw, uint32_t type,
+    const struct pfr_addr *addr)
+{
+	int off;
+
+	off = snl_add_msg_attr_nested(nw, type);
+
+	snl_add_msg_attr_u8(nw, PFR_A_AF, addr->pfra_af);
+	snl_add_msg_attr_u8(nw, PFR_A_NET, addr->pfra_net);
+	snl_add_msg_attr_bool(nw, PFR_A_NOT, addr->pfra_not);
+	snl_add_msg_attr_ip6(nw, PFR_A_ADDR, &addr->pfra_ip6addr);
+
+	snl_end_attr_nested(nw, off);
+}
+
+static struct snl_attr_parser ap_table_add_addr[] = {
+	{ .type = PF_TA_NBR_ADDED, .off = 0, .cb = snl_attr_get_uint32 },
+};
+SNL_DECLARE_PARSER(table_add_addr_parser, struct genlmsghdr, snl_f_p_empty, ap_table_add_addr);
+
+static int
+_pfctl_table_add_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl, struct pfr_addr
+    *addrs, int size, int *nadd, int flags)
+{
+	struct snl_writer nw;
+	struct snl_errmsg_data e = {};
+	struct nlmsghdr *hdr;
+	uint32_t seq_id;
+	uint32_t added;
+	int family_id;
+
+	family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME);
+	if (family_id == 0)
+		return (ENOTSUP);
+
+	snl_init_writer(&h->ss, &nw);
+	hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_TABLE_ADD_ADDR);
+
+	snl_add_msg_attr_table(&nw, PF_TA_TABLE, tbl);
+	snl_add_msg_attr_u32(&nw, PF_TA_FLAGS, flags);
+	for (int i = 0; i < size && i < 256; i++)
+		snl_add_msg_attr_pfr_addr(&nw, PF_TA_ADDR, &addrs[i]);
+
+	if ((hdr = snl_finalize_msg(&nw)) == NULL)
+		return (ENXIO);
+	seq_id = hdr->nlmsg_seq;
+
+	if (! snl_send_message(&h->ss, hdr))
+		return (ENXIO);
+
+	while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) {
+		if (! snl_parse_nlmsg(&h->ss, hdr, &table_add_addr_parser, &added))
+			continue;
+	}
+
+	if (nadd)
+		*nadd = added;
+
+	return (e.error);
+}
+
+int
+pfctl_table_add_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl, struct pfr_addr
+    *addr, int size, int *nadd, int flags)
+{
+	int ret;
+	int off = 0;
+	int partial_added;
+
+	do {
+		ret = _pfctl_table_add_addrs_h(h, tbl, &addr[off], size - off, &partial_added, flags);
+		if (ret != 0)
+			break;
+		if (nadd)
+			*nadd += partial_added;
+		off += partial_added;
+	} while (off < size);
+
+	if (nadd)
+		*nadd = off;
+
+	return (ret);
+}
+
 int
 pfctl_table_del_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
     *addr, int size, int *ndel, int flags)

lib/libpfctl/libpfctl.h

@@ -511,6 +511,8 @@ int	pfctl_clear_nat(int dev, const char *anchorname);
 int	pfctl_clear_eth_rules(int dev, const char *anchorname);
 int	pfctl_set_syncookies(int dev, const struct pfctl_syncookies *s);
 int	pfctl_get_syncookies(int dev, struct pfctl_syncookies *s);
+int	pfctl_table_add_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl, struct pfr_addr
+	    *addr, int size, int *nadd, int flags);
 int	pfctl_table_add_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
 	    *addr, int size, int *nadd, int flags);
 int	pfctl_table_del_addrs(int dev, struct pfr_table *tbl, struct pfr_addr

sbin/pfctl/pfctl_radix.c

@@ -122,7 +122,7 @@ pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 {
 	int ret;
 
-	ret = pfctl_table_add_addrs(dev, tbl, addr, size, nadd, flags);
+	ret = pfctl_table_add_addrs_h(pfh, tbl, addr, size, nadd, flags);
 	if (ret) {
 		errno = ret;
 		return (-1);

sys/netpfil/pf/pf_ioctl.c

@@ -4973,6 +4973,7 @@ DIOCCHANGEADDR_error:
 			goto fail;
 		}
 		PF_RULES_WLOCK();
+		io->pfrio_nadd = 0;
 		error = pfr_add_addrs(&io->pfrio_table, pfras,
 		    io->pfrio_size, &io->pfrio_nadd, io->pfrio_flags |
 		    PFR_FLAG_USERIOCTL);

sys/netpfil/pf/pf_nl.c

@@ -2082,6 +2082,88 @@ pf_handle_clear_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt)
 	return (error);
 }
 
+TAILQ_HEAD(pfr_addrq, pfr_addr_item);
+struct nl_parsed_table_addrs {
+	struct pfr_table table;
+	uint32_t flags;
+	struct pfr_addr addrs[256];
+	size_t addr_count;
+	int nadd;
+};
+#define _OUT(_field)	offsetof(struct pfr_addr, _field)
+static const struct nlattr_parser nla_p_pfr_addr[] = {
+	{ .type = PFR_A_AF, .off = _OUT(pfra_af), .cb = nlattr_get_uint8 },
+	{ .type = PFR_A_NET, .off = _OUT(pfra_net), .cb = nlattr_get_uint8 },
+	{ .type = PFR_A_NOT, .off = _OUT(pfra_not), .cb = nlattr_get_bool },
+	{ .type = PFR_A_ADDR, .off = _OUT(pfra_u), .cb = nlattr_get_in6_addr },
+};
+#undef _OUT
+NL_DECLARE_ATTR_PARSER(pfra_addr_parser, nla_p_pfr_addr);
+
+static int
+nlattr_get_pfr_addr(struct nlattr *nla, struct nl_pstate *npt, const void *arg,
+    void *target)
+{
+	struct nl_parsed_table_addrs *attrs = target;
+	struct pfr_addr addr = { 0 };
+	int error;
+
+	if (attrs->addr_count >= nitems(attrs->addrs))
+		return (E2BIG);
+
+	error = nlattr_get_nested(nla, npt, &pfra_addr_parser, &addr);
+	if (error != 0)
+		return (error);
+
+	memcpy(&attrs->addrs[attrs->addr_count], &addr, sizeof(addr));
+	attrs->addr_count++;
+
+	return (0);
+}
+
+NL_DECLARE_ATTR_PARSER(nested_table_parser, nla_p_table);
+
+#define _OUT(_field)	offsetof(struct nl_parsed_table_addrs, _field)
+static const struct nlattr_parser nla_p_table_addr[] = {
+	{ .type = PF_TA_TABLE, .off = _OUT(table), .arg = &nested_table_parser, .cb = nlattr_get_nested },
+	{ .type = PF_TA_ADDR, .cb = nlattr_get_pfr_addr },
+	{ .type = PF_TA_FLAGS, .off = _OUT(flags), .cb = nlattr_get_uint32 },
+};
+NL_DECLARE_PARSER(table_addr_parser, struct genlmsghdr, nlf_p_empty, nla_p_table_addr);
+#undef _OUT
+static int
+pf_handle_table_add_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt)
+{
+	struct nl_parsed_table_addrs attrs = { 0 };
+	struct nl_writer *nw = npt->nw;
+	struct genlmsghdr *ghdr_new;
+	int error;
+
+	error = nl_parse_nlmsg(hdr, &table_addr_parser, npt, &attrs);
+	if (error != 0)
+		return  (error);
+
+	PF_RULES_WLOCK();
+	error = pfr_add_addrs(&attrs.table, &attrs.addrs[0],
+	    attrs.addr_count, &attrs.nadd, attrs.flags | PFR_FLAG_USERIOCTL);
+	PF_RULES_WUNLOCK();
+
+	if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr)))
+		return (ENOMEM);
+
+	ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
+	ghdr_new->cmd = PFNL_CMD_TABLE_ADD_ADDR;
+	ghdr_new->version = 0;
+	ghdr_new->reserved = 0;
+
+	nlattr_add_u32(nw, PF_TA_NBR_ADDED, attrs.nadd);
+
+	if (!nlmsg_end(nw))
+		return (ENOMEM);
+
+	return (error);
+}
+
 static const struct nlhdr_parser *all_parsers[] = {
 	&state_parser,
 	&addrule_parser,
@@ -2096,6 +2178,7 @@ static const struct nlhdr_parser *all_parsers[] = {
 	&add_addr_parser,
 	&ruleset_parser,
 	&table_parser,
+	&table_addr_parser,
 };
 
 static uint16_t family_id;
@@ -2318,6 +2401,13 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
 	},
+	{
+		.cmd_num = PFNL_CMD_TABLE_ADD_ADDR,
+		.cmd_name = "TABLE_ADD_ADDRS",
+		.cmd_cb = pf_handle_table_add_addrs,
+		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
+		.cmd_priv = PRIV_NETINET_PF,
+	},
 };
 
 void

sys/netpfil/pf/pf_nl.h

@@ -67,6 +67,7 @@ enum {
 	PFNL_CMD_GET_TSTATS = 29,
 	PFNL_CMD_CLR_TSTATS = 30,
 	PFNL_CMD_CLR_ADDRS = 31,
+	PFNL_CMD_TABLE_ADD_ADDR = 32,
 	__PFNL_CMD_MAX,
 };
 #define PFNL_CMD_MAX (__PFNL_CMD_MAX -1)
@@ -461,6 +462,22 @@ enum pf_tstats_t {
 	PF_TS_NZERO		= 9, /* u64 */
 };
 
+enum pfr_addr_t {
+	PFR_A_UNSPEC,
+	PFR_A_AF		= 1, /* uint8_t */
+	PFR_A_NET		= 2, /* uint8_t */
+	PFR_A_NOT		= 3, /* bool */
+	PFR_A_ADDR		= 4, /* in6_addr */
+};
+
+enum pf_table_addrs_t {
+	PF_TA_UNSPEC,
+	PF_TA_TABLE		= 1, /* nested, pf_table_t */
+	PF_TA_ADDR		= 2, /* nested, pfr_addr_t */
+	PF_TA_FLAGS		= 3, /* u32 */
+	PF_TA_NBR_ADDED		= 4, /* u32 */
+};
+
 #ifdef _KERNEL
 
 void	pf_nl_register(void);

sys/netpfil/pf/pf_table.c

@@ -294,7 +294,7 @@ pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 	else
 		pfr_destroy_kentries(&workq);
 	if (nadd != NULL)
-		*nadd = xadd;
+		*nadd += xadd;
 	pfr_destroy_ktable(tmpkt, 0);
 	return (0);
 _bad:

tests/sys/netpfil/pf/table.sh

@@ -610,6 +610,47 @@ flush_cleanup()
 	pft_cleanup
 }
 
+atf_test_case "large" "cleanup"
+large_head()
+{
+	atf_set descr 'Test loading a large list of addresses'
+	atf_set require.user root
+}
+
+large_body()
+{
+	pft_init
+	pwd=$(pwd)
+
+	vnet_mkjail alcatraz
+
+	for i in `seq 1 255`; do
+		for j in `seq 1 255`; do
+			echo "1.2.${i}.${j}" >> ${pwd}/foo.lst
+		done
+	done
+	expected=$(wc -l foo.lst | awk '{ print $1; }')
+
+	jexec alcatraz pfctl -e
+	pft_set_rules alcatraz \
+		"table <foo>" \
+		"pass in from <foo>" \
+		"pass"
+
+	atf_check -s exit:0 \
+	    -e match:"${expected}/${expected} addresses added." \
+	    jexec alcatraz pfctl -t foo -T add -f ${pwd}/foo.lst
+	actual=$(jexec alcatraz pfctl -t foo -T show | wc -l | awk '{ print $1; }')
+	if [[ $actual -ne $expected ]]; then
+		atf_fail "Unexpected number of table entries $expected $acual"
+	fi
+}
+
+large_cleanup()
+{
+	pft_cleanup
+}
+
 atf_init_test_cases()
 {
 	atf_add_test_case "v4_counters"
@@ -625,4 +666,5 @@ atf_init_test_cases()
 	atf_add_test_case "precreate"
 	atf_add_test_case "anchor"
 	atf_add_test_case "flush"
+	atf_add_test_case "large"
 }