upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-05-28 04:12:45 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

libpfctl: handle pfctl_do_ioctl() failures better

Browse source 
Ensure that we free nvlists and other allocations if pfctl_do_ioctl()
fails.

MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")

(cherry picked from commit 498934c5ff51e6b0d3199db5d27ed11b1e8b9582)
This commit is contained in:
Kristof Provost 2023-11-17 10:19:38 +01:00
parent 8423bf2a9e
commit 68013761ce
1 changed files with 24 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

42
lib/libpfctl/libpfctl.c
View file

@ -221,6 +221,7 @@ pfctl_get_status(int dev)
nvl = nvlist_create(0);
if (pfctl_do_ioctl(dev, DIOCGETSTATUSNV, 4096, &nvl)) {
nvlist_destroy(nvl);
free(status);
return (NULL);
}
@ -741,12 +742,13 @@ pfctl_get_eth_rulesets_info(int dev, struct pfctl_eth_rulesets_info *ri,
nvlist_add_string(nvl, "path", path);
if ((ret = pfctl_do_ioctl(dev, DIOCGETETHRULESETS, 256, &nvl)) != 0)
return (ret);
goto out;
ri->nr = nvlist_get_number(nvl, "nr");
out:
nvlist_destroy(nvl);
return (0);
return (ret);
}
int
@ -763,16 +765,16 @@ pfctl_get_eth_ruleset(int dev, const char *path, int nr,
nvlist_add_number(nvl, "nr", nr);
if ((ret = pfctl_do_ioctl(dev, DIOCGETETHRULESET, 1024, &nvl)) != 0)
return (ret);
goto out;
ri->nr = nvlist_get_number(nvl, "nr");
strlcpy(ri->path, nvlist_get_string(nvl, "path"), MAXPATHLEN);
strlcpy(ri->name, nvlist_get_string(nvl, "name"),
PF_ANCHOR_NAME_SIZE);
out:
nvlist_destroy(nvl);
return (0);
return (ret);
}
int
@ -788,13 +790,14 @@ pfctl_get_eth_rules_info(int dev, struct pfctl_eth_rules_info *rules,
nvlist_add_string(nvl, "anchor", path);
if ((ret = pfctl_do_ioctl(dev, DIOCGETETHRULES, 1024, &nvl)) != 0)
return (ret);
goto out;
rules->nr = nvlist_get_number(nvl, "nr");
rules->ticket = nvlist_get_number(nvl, "ticket");
out:
nvlist_destroy(nvl);
return (0);
return (ret);
}
int
@ -813,7 +816,7 @@ pfctl_get_eth_rule(int dev, uint32_t nr, uint32_t ticket,
nvlist_add_bool(nvl, "clear", clear);
if ((ret = pfctl_do_ioctl(dev, DIOCGETETHRULE, 4096, &nvl)) != 0)
return (ret);
goto out;
pfctl_nveth_rule_to_eth_rule(nvl, rule);
@ -821,8 +824,9 @@ pfctl_get_eth_rule(int dev, uint32_t nr, uint32_t ticket,
strlcpy(anchor_call, nvlist_get_string(nvl, "anchor_call"),
MAXPATHLEN);
out:
nvlist_destroy(nvl);
return (0);
return (ret);
}
int
@ -1079,7 +1083,7 @@ int pfctl_get_clear_rule(int dev, uint32_t nr, uint32_t ticket,
nvlist_add_bool(nvl, "clear_counter", true);
if ((ret = pfctl_do_ioctl(dev, DIOCGETRULENV, 8192, &nvl)) != 0)
return (ret);
goto out;
pf_nvrule_to_rule(nvlist_get_nvlist(nvl, "rule"), rule);
@ -1087,9 +1091,9 @@ int pfctl_get_clear_rule(int dev, uint32_t nr, uint32_t ticket,
strlcpy(anchor_call, nvlist_get_string(nvl, "anchor_call"),
MAXPATHLEN);
out:
nvlist_destroy(nvl);
return (0);
return (ret);
}
int
@ -1284,13 +1288,13 @@ _pfctl_clear_states(int dev, const struct pfctl_kill *kill,
nvlist_add_bool(nvl, "kill_match", kill->kill_match);
if ((ret = pfctl_do_ioctl(dev, ioctlval, 1024, &nvl)) != 0)
return (ret);
goto out;
if (killed)
*killed = nvlist_get_number(nvl, "killed");
out:
nvlist_destroy(nvl);
return (ret);
}
@ -1466,8 +1470,10 @@ pfctl_get_syncookies(int dev, struct pfctl_syncookies *s)
nvl = nvlist_create(0);
if ((ret = pfctl_do_ioctl(dev, DIOCGETSYNCOOKIES, 256, &nvl)) != 0)
return (errno);
if ((ret = pfctl_do_ioctl(dev, DIOCGETSYNCOOKIES, 256, &nvl)) != 0) {
ret = errno;
goto out;
}
enabled = nvlist_get_bool(nvl, "enabled");
adaptive = nvlist_get_bool(nvl, "adaptive");
@ -1485,9 +1491,9 @@ pfctl_get_syncookies(int dev, struct pfctl_syncookies *s)
s->lowwater = nvlist_get_number(nvl, "lowwater") * 100 / state_limit;
s->halfopen_states = nvlist_get_number(nvl, "halfopen_states");
out:
nvlist_destroy(nvl);
return (0);
return (ret);
}
int