1 /*- 2 * Copyright (c) 2009-2025 The NetBSD Foundation, Inc. 3 * All rights reserved. 4 * 5 * This material is based upon work partially supported by The 6 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 18 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 19 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 20 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 21 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 22 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 23 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 24 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 25 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 26 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 27 * POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30 #ifndef _NPFCTL_H_ 31 #define _NPFCTL_H_ 32 33 #include <stdio.h> 34 #include <stdbool.h> 35 #include <inttypes.h> 36 #include <assert.h> 37 #include <util.h> 38 39 #define NPF_BPFCOP 40 #include <net/npf.h> 41 42 #define _NPF_PRIVATE 43 #include <npf.h> 44 45 #include "npf_var.h" 46 47 #define NPF_DEV_PATH "/dev/npf" 48 #define NPF_CONF_PATH "/etc/npf.conf" 49 #define NPF_DB_PATH "/var/db/npf.db" 50 51 typedef struct fam_addr_mask { 52 sa_family_t fam_family; 53 npf_addr_t fam_addr; 54 npf_netmask_t fam_mask; 55 unsigned long fam_ifindex; 56 } fam_addr_mask_t; 57 58 typedef struct ifnet_addr { 59 char * ifna_name; 60 unsigned long ifna_index; 61 sa_family_t ifna_family; 62 npfvar_t * ifna_filter; 63 npfvar_t * ifna_addrs; 64 } ifnet_addr_t; 65 66 typedef struct port_range { 67 in_port_t pr_start; 68 in_port_t pr_end; 69 } port_range_t; 70 71 typedef struct addr_port { 72 npfvar_t * ap_netaddr; 73 npfvar_t * ap_portrange; 74 } addr_port_t; 75 76 typedef struct l3 { 77 addr_port_t fo_from; 78 addr_port_t fo_to; 79 } opt3; 80 81 typedef struct l2 { 82 npfvar_t * from_mac; 83 npfvar_t * to_mac; 84 uint16_t ether_type; 85 } opt2; 86 87 typedef struct filt_opts { 88 union { 89 opt3 opt3; 90 opt2 opt2; 91 } filt; 92 struct r_id uid; 93 struct r_id gid; 94 uint32_t layer; 95 bool fo_finvert; 96 bool fo_tinvert; 97 } filt_opts_t; 98 99 typedef struct opt_proto { 100 int op_proto; 101 npfvar_t * op_opts; 102 } opt_proto_t; 103 104 typedef struct rule_group { 105 const char * rg_name; 106 uint32_t rg_attr; 107 const char * rg_ifname; 108 bool rg_default; 109 } rule_group_t; 110 111 typedef struct proc_call { 112 const char * pc_name; 113 npfvar_t * pc_opts; 114 } proc_call_t; 115 116 typedef struct proc_param { 117 const char * pp_param; 118 const char * pp_value; 119 } proc_param_t; 120 121 typedef enum { 122 NPFCTL_PARSE_DEFAULT, 123 NPFCTL_PARSE_RULE, 124 NPFCTL_PARSE_MAP 125 } parse_entry_t; 126 127 #define NPF_IFNET_TABLE_PREF ".ifnet-" 128 #define NPF_IFNET_TABLE_PREFLEN (sizeof(NPF_IFNET_TABLE_PREF) - 1) 129 130 void yyerror(const char *, ...) __printflike(1, 2) __dead; 131 void npfctl_bpfjit(bool); 132 void npfctl_parse_file(const char *); 133 void npfctl_parse_string(const char *, parse_entry_t); 134 135 bool join(char *, size_t, int, char **, const char *); 136 bool npfctl_addr_iszero(const npf_addr_t *); 137 138 void npfctl_print_error(const npf_error_t *); 139 char * npfctl_print_addrmask(int, const char *, const npf_addr_t *, 140 npf_netmask_t); 141 void npfctl_note_interface(const char *); 142 nl_table_t * npfctl_table_getbyname(nl_config_t *, const char *); 143 unsigned npfctl_table_getid(const char *); 144 const char * npfctl_table_getname(nl_config_t *, unsigned, bool *); 145 int npfctl_protono(const char *); 146 in_port_t npfctl_portno(const char *); 147 uint8_t npfctl_icmpcode(int, uint8_t, const char *); 148 uint8_t npfctl_icmptype(int, const char *); 149 npfvar_t * npfctl_ifnet_table(const char *); 150 npfvar_t * npfctl_parse_ifnet(const char *, const int); 151 npfvar_t * npfctl_parse_tcpflag(const char *); 152 npfvar_t * npfctl_parse_table_id(const char *); 153 npfvar_t * npfctl_parse_icmp(int, int, int); 154 npfvar_t * npfctl_parse_port_range(in_port_t, in_port_t); 155 npfvar_t * npfctl_parse_port_range_variable(const char *, npfvar_t *); 156 npfvar_t * npfctl_parse_fam_addr_mask(const char *, const char *, 157 unsigned long *); 158 159 int npfctl_parse_user(const char *, uint32_t *); 160 int npfctl_parse_group(const char *, uint32_t *); 161 void npfctl_init_rid(rid_t *, uint32_t, uint32_t, uint8_t); 162 bool npfctl_parse_cidr(char *, fam_addr_mask_t *, int *); 163 uint16_t npfctl_npt66_calcadj(npf_netmask_t, const npf_addr_t *, 164 const npf_addr_t *); 165 filt_opts_t npfctl_parse_l3filt_opt(npfvar_t *, npfvar_t *, bool, 166 npfvar_t *, npfvar_t *, bool, rid_t, rid_t); 167 filt_opts_t npfctl_parse_l2filt_opt(npfvar_t *, bool, npfvar_t *, 168 bool, uint16_t); 169 npfvar_t * npfctl_parse_mac_addr(const char *); 170 uint16_t npfctl_parse_ether_type(const char *str); 171 int npfctl_nat_ruleset_p(const char *, bool *); 172 173 void usage(void); 174 void npfctl_rule(int, int, char **); 175 void npfctl_table_replace(int, int, char **); 176 void npfctl_table(int, int, char **); 177 int npfctl_conn_list(int, int, char **); 178 179 /* 180 * NPF extension loading. 181 */ 182 183 typedef struct npf_extmod npf_extmod_t; 184 185 npf_extmod_t * npf_extmod_get(const char *, nl_ext_t **); 186 int npf_extmod_param(npf_extmod_t *, nl_ext_t *, 187 const char *, const char *); 188 189 /* 190 * BFF byte-code generation interface. 191 */ 192 193 typedef struct npf_bpf npf_bpf_t; 194 195 #define MATCH_DST 0x01 196 #define MATCH_SRC 0x02 197 #define MATCH_INVERT 0x04 198 199 enum { 200 BM_IPVER, BM_PROTO, BM_SRC_CIDR, BM_SRC_TABLE, BM_DST_CIDR, 201 BM_DST_TABLE, BM_SRC_PORTS, BM_DST_PORTS, BM_TCPFL, BM_ICMP_TYPE, 202 BM_ICMP_CODE, BM_SRC_NEG, BM_DST_NEG, 203 204 BM_COUNT // total number of the marks 205 }; 206 207 enum { /* book marks for L2 */ 208 BM_ETHER_TYPE, BM_SRC_ETHER, BM_DST_ETHER, BM_SRC_ENEG, BM_DST_ENEG, 209 }; 210 211 npf_bpf_t * npfctl_bpf_create(void); 212 struct bpf_program *npfctl_bpf_complete(npf_bpf_t *); 213 const void * npfctl_bpf_bmarks(npf_bpf_t *, size_t *); 214 void npfctl_bpf_destroy(npf_bpf_t *); 215 216 void npfctl_bpf_group_enter(npf_bpf_t *, bool); 217 void npfctl_bpf_group_exit(npf_bpf_t *); 218 219 void npfctl_bpf_ipver(npf_bpf_t *, sa_family_t); 220 void npfctl_bpf_proto(npf_bpf_t *, unsigned); 221 void npfctl_bpf_cidr(npf_bpf_t *, u_int, sa_family_t, 222 const npf_addr_t *, const npf_netmask_t); 223 void npfctl_bpf_ports(npf_bpf_t *, u_int, in_port_t, in_port_t); 224 void npfctl_bpf_tcpfl(npf_bpf_t *, uint8_t, uint8_t); 225 void npfctl_bpf_icmp(npf_bpf_t *, int, int); 226 void npfctl_bpf_table(npf_bpf_t *, u_int, u_int); 227 228 void npfctl_bpf_ether(npf_bpf_t *, unsigned, struct ether_addr *); 229 void fetch_ether_type(npf_bpf_t *, uint16_t); 230 231 /* 232 * Configuration building interface. 233 */ 234 235 #define NPFCTL_NAT_DYNAMIC 1 236 #define NPFCTL_NAT_STATIC 2 237 238 void npfctl_config_init(bool); 239 void npfctl_config_build(void); 240 int npfctl_config_send(int); 241 nl_config_t * npfctl_config_ref(void); 242 int npfctl_config_show(int); 243 void npfctl_config_save(nl_config_t *, const char *); 244 int npfctl_ruleset_show(int, const char *); 245 246 nl_rule_t * npfctl_rule_ref(void); 247 nl_table_t * npfctl_table_ref(void); 248 bool npfctl_debug_addif(const char *); 249 250 nl_table_t * npfctl_load_table(const char *, int, u_int, const char *, FILE *); 251 252 void npfctl_build_alg(const char *); 253 void npfctl_build_rproc(const char *, npfvar_t *); 254 void npfctl_build_group(const char *, int, const char *, bool); 255 void npfctl_build_group_end(void); 256 void npfctl_build_rule(uint32_t, const char *, sa_family_t, 257 const npfvar_t *, const filt_opts_t *, 258 const char *, const char *); 259 void npfctl_build_natseg(int, int, unsigned, const char *, 260 const addr_port_t *, const addr_port_t *, 261 const npfvar_t *, const filt_opts_t *, unsigned); 262 void npfctl_build_maprset(const char *, int, const char *); 263 void npfctl_build_table(const char *, u_int, const char *); 264 265 void npfctl_setparam(const char *, int); 266 267 /* 268 * For the systems which do not define TH_ECE and TW_CRW. 269 */ 270 #ifndef TH_ECE 271 #define TH_ECE 0x40 272 #endif 273 #ifndef TH_CWR 274 #define TH_CWR 0x80 275 #endif 276 277 #endif 278
Indexes created Sun Sep 21 16:09:51 GMT 2025