1 /*- 2 * Copyright (c) 2013-2025 The NetBSD Foundation, Inc. 3 * All rights reserved. 4 * 5 * This code is derived from software contributed to The NetBSD Foundation 6 * by Mindaugas Rasiukevicius. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 18 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 19 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 20 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 21 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 22 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 23 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 24 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 25 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 26 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 27 * POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30 /* 31 * NPF configuration printing. 32 * 33 * Each rule having BPF byte-code has a binary description. 34 */ 35 36 #include <sys/cdefs.h> 37 __RCSID("$NetBSD: npf_show.c,v 1.38 2025/07/08 14:02:16 joe Exp $"); 38 39 #include <sys/socket.h> 40 #define __FAVOR_BSD 41 #include <netinet/in.h> 42 #include <netinet/tcp.h> 43 #include <net/if.h> 44 45 #include <stdio.h> 46 #include <stdlib.h> 47 #include <string.h> 48 #include <stdbool.h> 49 #include <inttypes.h> 50 #include <errno.h> 51 #include <err.h> 52 53 #include "npfctl.h" 54 55 #define SEEN_PROTO 0x01 56 57 typedef struct { 58 char ** values; 59 unsigned count; 60 } elem_list_t; 61 62 enum { 63 LIST_PROTO = 0, LIST_SADDR, LIST_DADDR, LIST_SPORT, LIST_DPORT, 64 LIST_COUNT, 65 }; 66 67 enum { 68 LIST_E_SADDR = 0, LIST_E_DADDR, LIST_ETYPE, 69 LIST_E_COUNT, 70 }; 71 72 typedef struct { 73 nl_config_t * conf; 74 bool validating; 75 76 FILE * fp; 77 long fpos; 78 long fposln; 79 int glevel; 80 81 unsigned flags; 82 uint32_t curmark; 83 uint64_t seen_marks; 84 elem_list_t list[LIST_COUNT]; 85 86 } npf_conf_info_t; 87 88 static void print_linesep(npf_conf_info_t *); 89 90 static npf_conf_info_t * 91 npfctl_show_init(void) 92 { 93 static npf_conf_info_t stdout_ctx; 94 memset(&stdout_ctx, 0, sizeof(npf_conf_info_t)); 95 stdout_ctx.glevel = -1; 96 stdout_ctx.fp = stdout; 97 return &stdout_ctx; 98 } 99 100 static void 101 list_push(elem_list_t *list, char *val) 102 { 103 const unsigned n = list->count; 104 char **values; 105 106 if ((values = calloc(n + 1, sizeof(char *))) == NULL) { 107 err(EXIT_FAILURE, "calloc"); 108 } 109 for (unsigned i = 0; i < n; i++) { 110 values[i] = list->values[i]; 111 } 112 values[n] = val; 113 free(list->values); 114 list->values = values; 115 list->count++; 116 } 117 118 static char * 119 list_join_free(elem_list_t *list, const bool use_br, const char *sep) 120 { 121 char *s, buf[2048]; 122 123 if (!join(buf, sizeof(buf), list->count, list->values, sep)) { 124 errx(EXIT_FAILURE, "out of memory while parsing the rule"); 125 } 126 easprintf(&s, (use_br && list->count > 1) ? "{ %s }" : "%s", buf); 127 for (unsigned i = 0; i < list->count; i++) { 128 free(list->values[i]); 129 } 130 free(list->values); 131 list->values = NULL; 132 list->count = 0; 133 return s; 134 } 135 136 /* 137 * Helper routines to print various pieces of information. 138 */ 139 140 static void 141 print_indent(npf_conf_info_t *ctx, unsigned level) 142 { 143 if (ctx->glevel >= 0 && level <= (unsigned)ctx->glevel) { 144 /* 145 * Level decrease -- end of the group. 146 * Print the group closing curly bracket. 147 */ 148 ctx->fpos += fprintf(ctx->fp, "}\n\n"); 149 ctx->glevel = -1; 150 } 151 while (level--) { 152 ctx->fpos += fprintf(ctx->fp, "\t"); 153 } 154 } 155 156 static void 157 print_linesep(npf_conf_info_t *ctx) 158 { 159 if (ctx->fpos != ctx->fposln) { 160 ctx->fpos += fprintf(ctx->fp, "\n"); 161 ctx->fposln = ctx->fpos; 162 } 163 } 164 165 static size_t 166 tcpflags2string(char *buf, unsigned tfl) 167 { 168 unsigned i = 0; 169 170 if (tfl & TH_FIN) buf[i++] = 'F'; 171 if (tfl & TH_SYN) buf[i++] = 'S'; 172 if (tfl & TH_RST) buf[i++] = 'R'; 173 if (tfl & TH_PUSH) buf[i++] = 'P'; 174 if (tfl & TH_ACK) buf[i++] = 'A'; 175 if (tfl & TH_URG) buf[i++] = 'U'; 176 if (tfl & TH_ECE) buf[i++] = 'E'; 177 if (tfl & TH_CWR) buf[i++] = 'W'; 178 buf[i] = '\0'; 179 return i; 180 } 181 182 static char * 183 print_family(npf_conf_info_t *ctx __unused, const uint32_t *words) 184 { 185 const int af = words[0]; 186 187 switch (af) { 188 case AF_INET: 189 return estrdup("inet4"); 190 case AF_INET6: 191 return estrdup("inet6"); 192 default: 193 errx(EXIT_FAILURE, "invalid byte-code mark (family)"); 194 } 195 return NULL; 196 } 197 198 static char * 199 print_address(npf_conf_info_t *ctx __unused, const uint32_t *words) 200 { 201 const int af = *words++; 202 const unsigned mask = *words++; 203 const npf_addr_t *addr; 204 int alen = 0; 205 206 switch (af) { 207 case AF_INET: 208 alen = 4; 209 break; 210 case AF_INET6: 211 alen = 16; 212 break; 213 default: 214 errx(EXIT_FAILURE, "invalid byte-code mark (address)"); 215 } 216 addr = (const npf_addr_t *)words; 217 return npfctl_print_addrmask(alen, "%a", addr, mask); 218 } 219 220 static char * 221 print_number(npf_conf_info_t *ctx __unused, const uint32_t *words) 222 { 223 char *p; 224 easprintf(&p, "%u", words[0]); 225 return p; 226 } 227 228 static char * 229 print_table(npf_conf_info_t *ctx, const uint32_t *words) 230 { 231 const unsigned tid = words[0]; 232 const char *tname; 233 char *s = NULL; 234 bool ifaddr; 235 236 tname = npfctl_table_getname(ctx->conf, tid, &ifaddr); 237 easprintf(&s, ifaddr ? "ifaddrs(%s)" : "<%s>", tname); 238 return s; 239 } 240 241 static char * 242 print_proto(npf_conf_info_t *ctx, const uint32_t *words) 243 { 244 ctx->flags |= SEEN_PROTO; 245 switch (words[0]) { 246 case IPPROTO_TCP: 247 return estrdup("tcp"); 248 case IPPROTO_UDP: 249 return estrdup("udp"); 250 case IPPROTO_ICMP: 251 return estrdup("icmp"); 252 case IPPROTO_ICMPV6: 253 return estrdup("ipv6-icmp"); 254 } 255 return print_number(ctx, words); 256 } 257 258 static char * 259 print_tcpflags(npf_conf_info_t *ctx __unused, const uint32_t *words) 260 { 261 const unsigned tf = words[0], tf_mask = words[1]; 262 char buf[32]; 263 size_t n; 264 265 if ((ctx->flags & SEEN_PROTO) == 0) { 266 /* 267 * Note: the TCP flag matching might be without 'proto tcp' 268 * when using a plain 'stateful' rule. In such case, just 269 * skip showing of the flags as they are implicit. 270 */ 271 return NULL; 272 } 273 n = tcpflags2string(buf, tf); 274 if (tf != tf_mask) { 275 buf[n++] = '/'; 276 tcpflags2string(buf + n, tf_mask); 277 } 278 return estrdup(buf); 279 } 280 281 static char * 282 print_portrange(npf_conf_info_t *ctx __unused, const uint32_t *words) 283 { 284 unsigned fport = words[0], tport = words[1]; 285 char *p; 286 287 if (fport != tport) { 288 easprintf(&p, "%u-%u", fport, tport); 289 } else { 290 easprintf(&p, "%u", fport); 291 } 292 return p; 293 } 294 295 static char * 296 print_ether_address(npf_conf_info_t *ctx __unused, const uint32_t *nwords) 297 { 298 const struct ether_addr* addr = (const struct ether_addr *)nwords; 299 char *a; 300 301 _DIAGASSERT(addr != NULL); 302 303 easprintf(&a, "%02x:%02x:%02x:%02x:%02x:%02x", 304 addr->ether_addr_octet[0], addr->ether_addr_octet[1], 305 addr->ether_addr_octet[2], addr->ether_addr_octet[3], 306 addr->ether_addr_octet[4], addr->ether_addr_octet[5]); 307 return a; 308 } 309 310 static char * 311 print_ether_type(npf_conf_info_t *ctx __unused, const uint32_t *words) 312 { 313 const uint8_t *type = (const uint8_t *)words; 314 char *a; 315 316 _DIAGASSERT(type != NULL); 317 318 easprintf(&a, "Ex%02x%02x", type[0], type[1]); 319 320 return a; 321 } 322 323 /* 324 * The main keyword mapping tables defining the syntax: 325 * - Mapping of rule attributes (flags) to the keywords. 326 * - Mapping of the byte-code marks to the keywords. 327 */ 328 329 #define F(name) __CONCAT(NPF_RULE_, name) 330 #define STATEFUL_ALL (NPF_RULE_STATEFUL | NPF_RULE_GSTATEFUL) 331 #define NAME_AT 2 332 333 static const struct attr_keyword_mapent { 334 uint32_t mask; 335 uint32_t flags; 336 const char * val; 337 } attr_keyword_map[] = { 338 { F(GROUP)|F(DYNAMIC), F(GROUP), "group" }, 339 { F(GROUP)|F(DYNAMIC), F(GROUP)|F(DYNAMIC), "ruleset" }, 340 { F(GROUP)|F(PASS), 0, "block" }, 341 { F(GROUP)|F(PASS), F(PASS), "pass" }, 342 { F(GROUP)|F(PASS)|F(LAYER_2), F(LAYER_2), "ether" }, 343 { F(GROUP)|F(PASS)|F(LAYER_2), F(LAYER_2)|F(PASS), "ether" }, 344 { F(RETRST)|F(RETICMP), F(RETRST)|F(RETICMP), "return" }, 345 { F(RETRST)|F(RETICMP), F(RETRST), "return-rst" }, 346 { F(RETRST)|F(RETICMP), F(RETICMP), "return-icmp" }, 347 { STATEFUL_ALL, F(STATEFUL), "stateful" }, 348 { STATEFUL_ALL, STATEFUL_ALL, "stateful-all" }, 349 { F(DIMASK), F(IN), "in" }, 350 { F(DIMASK), F(OUT), "out" }, 351 { F(FINAL), F(FINAL), "final" }, 352 }; 353 354 static const struct mark_keyword_mapent { 355 unsigned mark; 356 const char * format; 357 int list_id; 358 char * (*printfn)(npf_conf_info_t *, const uint32_t *); 359 unsigned fwords; 360 } mark_keyword_map[] = { 361 { BM_IPVER, "family %s", LIST_PROTO, print_family, 1 }, 362 { BM_PROTO, "proto %s", LIST_PROTO, print_proto, 1 }, 363 { BM_TCPFL, "flags %s", LIST_PROTO, print_tcpflags, 2 }, 364 { BM_ICMP_TYPE, "icmp-type %s", LIST_PROTO, print_number, 1 }, 365 { BM_ICMP_CODE, "code %s", LIST_PROTO, print_number, 1 }, 366 367 { BM_SRC_NEG, NULL, -1, NULL, 0 }, 368 { BM_SRC_CIDR, NULL, LIST_SADDR, print_address, 6 }, 369 { BM_SRC_TABLE, NULL, LIST_SADDR, print_table, 1 }, 370 { BM_SRC_PORTS, NULL, LIST_SPORT, print_portrange,2 }, 371 372 { BM_DST_NEG, NULL, -1, NULL, 0 }, 373 { BM_DST_CIDR, NULL, LIST_DADDR, print_address, 6 }, 374 { BM_DST_TABLE, NULL, LIST_DADDR, print_table, 1 }, 375 { BM_DST_PORTS, NULL, LIST_DPORT, print_portrange,2 }, 376 }, mark_keyword_mapl2[] = { 377 {BM_SRC_ENEG, NULL, -1, NULL, 0 }, 378 {BM_SRC_ETHER, NULL, LIST_E_SADDR, print_ether_address, 2 }, 379 380 {BM_DST_ENEG, NULL, -1, NULL, 0 }, 381 {BM_DST_ETHER, NULL, LIST_E_DADDR, print_ether_address, 2 }, 382 {BM_ETHER_TYPE, "type %s", LIST_ETYPE, print_ether_type,1 } 383 }; 384 385 static const char * __attribute__((format_arg(2))) 386 verified_fmt(const char *fmt, const char *t __unused) 387 { 388 return fmt; 389 } 390 391 static void 392 scan_marks(npf_conf_info_t *ctx, const struct mark_keyword_mapent *mk, 393 const uint32_t *marks, size_t mlen) 394 { 395 elem_list_t sublist, *target_list; 396 397 /* 398 * If format is used for this mark, then collect multiple elements 399 * in into the list, merge and re-push the set into the target list. 400 * 401 * Currently, this is applicable only for 'proto { tcp, udp }'. 402 */ 403 memset(&sublist, 0, sizeof(elem_list_t)); 404 target_list = mk->format ? &sublist : &ctx->list[mk->list_id]; 405 406 /* Scan for the marks and extract the values. */ 407 mlen /= sizeof(uint32_t); 408 while (mlen > 2) { 409 const uint32_t m = *marks++; 410 const unsigned nwords = *marks++; 411 412 if ((mlen -= 2) < nwords) { 413 errx(EXIT_FAILURE, "byte-code marking inconsistency"); 414 } 415 if (m == mk->mark) { 416 /* 417 * Set the current mark and note it as seen. 418 * Value is processed by the print function, 419 * otherwise we just need to note the mark. 420 */ 421 ctx->curmark = m; 422 assert(BM_COUNT < (sizeof(uint64_t) * CHAR_BIT)); 423 ctx->seen_marks |= UINT64_C(1) << m; 424 assert(mk->fwords == nwords); 425 426 if (mk->printfn) { 427 char *val; 428 429 if ((val = mk->printfn(ctx, marks)) != NULL) { 430 list_push(target_list, val); 431 } 432 } 433 } 434 marks += nwords; 435 mlen -= nwords; 436 } 437 438 if (sublist.count) { 439 char *val, *elements; 440 441 elements = list_join_free(&sublist, true, ", "); 442 easprintf(&val, verified_fmt(mk->format, "%s"), elements ); 443 list_push(&ctx->list[mk->list_id], val); 444 free(elements); 445 } 446 } 447 448 static void 449 npfctl_print_id(npf_conf_info_t *ctx, nl_rule_t *rl) 450 { 451 const uint64_t id = npf_rule_getid(rl); 452 453 if (id) { 454 ctx->fpos += fprintf(ctx->fp, "# id=\"%" PRIx64 "\" ", id); 455 } 456 } 457 458 static void 459 npfctl_print_filter_generic(npf_conf_info_t *ctx, uint32_t plist) 460 { 461 assert(plist < LIST_COUNT); 462 elem_list_t *list = &ctx->list[plist]; 463 464 if (list->count) { 465 char *elements = list_join_free(list, false, " "); 466 ctx->fpos += fprintf(ctx->fp, "%s ", elements); 467 free(elements); 468 } 469 } 470 471 static bool 472 npfctl_print_filter_seg(npf_conf_info_t *ctx, unsigned which) 473 { 474 static const struct { 475 const char * keyword; 476 unsigned alist; 477 unsigned plist; 478 unsigned negbm; 479 } refs[] = { 480 [NPF_SRC] = { 481 .keyword = "from", 482 .alist = LIST_SADDR, 483 .plist = LIST_SPORT, 484 .negbm = UINT64_C(1) << BM_SRC_NEG, 485 }, 486 [NPF_DST] = { 487 .keyword = "to", 488 .alist = LIST_DADDR, 489 .plist = LIST_DPORT, 490 .negbm = UINT64_C(1) << BM_DST_NEG, 491 } 492 }; 493 const char *neg = !!(ctx->seen_marks & refs[which].negbm) ? "! " : ""; 494 const char *kwd = refs[which].keyword; 495 bool seen_filter = false; 496 elem_list_t *list; 497 char *elements; 498 499 list = &ctx->list[refs[which].alist]; 500 if (list->count != 0) { 501 seen_filter = true; 502 elements = list_join_free(list, true, ", "); 503 ctx->fpos += fprintf(ctx->fp, "%s %s%s ", kwd, neg, elements); 504 free(elements); 505 } 506 507 list = &ctx->list[refs[which].plist]; 508 if (list->count != 0) { 509 if (!seen_filter) { 510 ctx->fpos += fprintf(ctx->fp, "%s any ", kwd); 511 seen_filter = true; 512 } 513 elements = list_join_free(list, true, ", "); 514 ctx->fpos += fprintf(ctx->fp, "port %s ", elements); 515 free(elements); 516 } 517 return seen_filter; 518 } 519 520 static bool 521 npfctl_print_l2filter_seg(npf_conf_info_t *ctx, unsigned which) 522 { 523 static const struct { 524 const char * keyword; 525 unsigned alist; 526 unsigned negbm; 527 } refs[] = { 528 [NPF_SRC] = { 529 .keyword = "from", 530 .alist = LIST_E_SADDR, 531 .negbm = UINT64_C(1) << BM_SRC_ENEG, 532 }, 533 [NPF_DST] = { 534 .keyword = "to", 535 .alist = LIST_E_DADDR, 536 .negbm = UINT64_C(1) << BM_DST_ENEG, 537 } 538 }; 539 const char *neg = !!(ctx->seen_marks & refs[which].negbm) ? "! " : ""; 540 const char *kwd = refs[which].keyword; 541 bool seen_filter = false; 542 elem_list_t *list; 543 char *elements; 544 545 list = &ctx->list[refs[which].alist]; 546 if (list->count != 0) { 547 seen_filter = true; 548 elements = list_join_free(list, true, ", "); 549 ctx->fpos += fprintf(ctx->fp, "%s %s%s ", kwd, neg, elements); 550 free(elements); 551 } 552 553 return seen_filter; 554 } 555 556 static bool 557 npfctl_print_filter(npf_conf_info_t *ctx, nl_rule_t *rl, uint32_t attr) 558 { 559 const void *marks; 560 size_t mlen, len; 561 const void *code; 562 bool seenf = false; 563 int type; 564 565 marks = npf_rule_getinfo(rl, &mlen); 566 if (!marks && (code = npf_rule_getcode(rl, &type, &len)) != NULL) { 567 /* 568 * No marks, but the byte-code is present. This must 569 * have been filled by libpcap(3) or possibly an unknown 570 * to us byte-code. 571 */ 572 ctx->fpos += fprintf(ctx->fp, "%s ", type == NPF_CODE_BPF ? 573 "pcap-filter \"...\"" : "unrecognized-bytecode"); 574 return true; 575 } 576 ctx->flags = 0; 577 578 /* 579 * BPF filter criteria described by the byte-code marks. 580 */ 581 ctx->seen_marks = 0; 582 if (attr & NPF_RULE_LAYER_2) { 583 for (unsigned i = 0; i < __arraycount(mark_keyword_mapl2); i++) { 584 const struct mark_keyword_mapent *mk = &mark_keyword_mapl2[i]; 585 scan_marks(ctx, mk, marks, mlen); 586 } 587 seenf |= npfctl_print_l2filter_seg(ctx, NPF_SRC); 588 seenf |= npfctl_print_l2filter_seg(ctx, NPF_DST); 589 npfctl_print_filter_generic(ctx, LIST_ETYPE); 590 } else if (attr & NPF_RULE_LAYER_3) { 591 for (unsigned i = 0; i < __arraycount(mark_keyword_map); i++) { 592 const struct mark_keyword_mapent *mk = &mark_keyword_map[i]; 593 scan_marks(ctx, mk, marks, mlen); 594 } 595 npfctl_print_filter_generic(ctx, LIST_PROTO); 596 seenf |= npfctl_print_filter_seg(ctx, NPF_SRC); 597 seenf |= npfctl_print_filter_seg(ctx, NPF_DST); 598 } else { 599 yyerror("%s: layer not supported", __func__); 600 } 601 return seenf; 602 } 603 604 static char * 605 print_guid(char *buf, struct r_id id, int size) 606 { 607 if (id.op == NPF_OP_XRG) { 608 snprintf(buf, size, "%u <> %u", id.id[0], id.id[1]); 609 } else if (id.op == NPF_OP_IRG) { 610 snprintf(buf, size, "%u >< %u", id.id[0], id.id[1]); 611 } else if (id.op == NPF_OP_EQ ) { 612 snprintf(buf, size, "%u", id.id[0]); 613 } else if (id.op == NPF_OP_NE) { 614 snprintf(buf, size, "!= %u", id.id[0]); 615 } else if (id.op == NPF_OP_LE) { 616 snprintf(buf, size, "<= %u", id.id[0]); 617 } else if (id.op == NPF_OP_LT) { 618 snprintf(buf, size, "< %u", id.id[0]); 619 } else if (id.op == NPF_OP_GE) { 620 snprintf(buf, size, ">= %u", id.id[0]); 621 } else if (id.op == NPF_OP_GT) { 622 snprintf(buf, size, "> %u", id.id[0]); 623 } else { 624 return NULL; 625 } 626 return buf; 627 } 628 #define BUF_SIZE 40 629 static void 630 npfctl_print_rule(npf_conf_info_t *ctx, nl_rule_t *rl, unsigned level) 631 { 632 const uint32_t attr = npf_rule_getattr(rl); 633 const char *rproc, *ifname, *name; 634 bool dyn_ruleset; 635 struct r_id rid; 636 char buf[BUF_SIZE]; 637 638 /* Rule attributes/flags. */ 639 for (unsigned i = 0; i < __arraycount(attr_keyword_map); i++) { 640 const struct attr_keyword_mapent *ak = &attr_keyword_map[i]; 641 642 if (i == NAME_AT && (name = npf_rule_getname(rl)) != NULL) { 643 ctx->fpos += fprintf(ctx->fp, "\"%s\" ", name); 644 } 645 if ((attr & ak->mask) == ak->flags) { 646 ctx->fpos += fprintf(ctx->fp, "%s ", ak->val); 647 } 648 } 649 if ((ifname = npf_rule_getinterface(rl)) != NULL) { 650 ctx->fpos += fprintf(ctx->fp, "on %s ", ifname); 651 } 652 if (attr == (NPF_RULE_GROUP | NPF_RULE_IN | NPF_RULE_OUT | NPF_RULE_LAYER_3) && !ifname) { 653 /* The default group is a special case. */ 654 ctx->fpos += fprintf(ctx->fp, "default "); 655 } 656 if (attr == (NPF_RULE_GROUP | NPF_RULE_IN | NPF_RULE_OUT | NPF_RULE_LAYER_2) && !ifname) { 657 /* The default group is a special case. */ 658 ctx->fpos += fprintf(ctx->fp, "default layer-2 "); 659 } 660 if (attr == (NPF_RULE_GROUP | NPF_RULE_IN | NPF_RULE_LAYER_2)) { 661 ctx->fpos += fprintf(ctx->fp, "layer-2 "); 662 } 663 if (attr == (NPF_RULE_GROUP | NPF_RULE_OUT | NPF_RULE_LAYER_2)) { 664 ctx->fpos += fprintf(ctx->fp, "layer-2 "); 665 } 666 if ((attr & NPF_DYNAMIC_GROUP) == NPF_RULE_GROUP) { 667 /* Group; done. */ 668 ctx->fpos += fprintf(ctx->fp, "{ "); 669 ctx->glevel = level; 670 goto out; 671 } 672 673 /* Print filter criteria. */ 674 dyn_ruleset = (attr & NPF_DYNAMIC_GROUP) == NPF_DYNAMIC_GROUP; 675 if (!npfctl_print_filter(ctx, rl, attr) && !dyn_ruleset) { 676 ctx->fpos += fprintf(ctx->fp, "all "); 677 } 678 679 if (!npf_rule_getrid(&rid, rl, "r_user")) { 680 ctx->fpos += fprintf(ctx->fp, "user %s ", print_guid(buf, rid, BUF_SIZE)); 681 } 682 683 if (!npf_rule_getrid(&rid, rl, "r_group")) { 684 ctx->fpos += fprintf(ctx->fp, "group %s ", print_guid(buf, rid, BUF_SIZE)); 685 } 686 687 /* Rule procedure. */ 688 if ((rproc = npf_rule_getproc(rl)) != NULL) { 689 ctx->fpos += fprintf(ctx->fp, "apply \"%s\" ", rproc); 690 } 691 out: 692 npfctl_print_id(ctx, rl); 693 ctx->fpos += fprintf(ctx->fp, "\n"); 694 } 695 696 static void 697 npfctl_print_nat(npf_conf_info_t *ctx, nl_nat_t *nt) 698 { 699 const unsigned dynamic_natset = NPF_RULE_GROUP | NPF_RULE_DYNAMIC; 700 nl_rule_t *rl = (nl_nat_t *)nt; 701 const char *ifname, *algo, *seg1, *seg2, *arrow; 702 const npf_addr_t *addr; 703 npf_netmask_t mask; 704 in_port_t port; 705 size_t alen; 706 unsigned flags; 707 char *seg; 708 uint32_t attr = npf_rule_getattr(rl); 709 710 /* Get flags and the interface. */ 711 flags = npf_nat_getflags(nt); 712 ifname = npf_rule_getinterface(rl); 713 assert(ifname != NULL); 714 715 if ((attr & dynamic_natset) == dynamic_natset) { 716 const char *name = npf_rule_getname(rl); 717 ctx->fpos += fprintf(ctx->fp, 718 "map ruleset \"%s\" on %s\n", name, ifname); 719 return; 720 } 721 722 /* Get the translation address or table (and port, if used). */ 723 addr = npf_nat_getaddr(nt, &alen, &mask); 724 if (addr) { 725 seg = npfctl_print_addrmask(alen, "%a", addr, mask); 726 } else { 727 const unsigned tid = npf_nat_gettable(nt); 728 const char *tname; 729 bool ifaddr; 730 731 tname = npfctl_table_getname(ctx->conf, tid, &ifaddr); 732 easprintf(&seg, ifaddr ? "ifaddrs(%s)" : "<%s>", tname); 733 } 734 735 if ((port = npf_nat_getport(nt)) != 0) { 736 char *p; 737 easprintf(&p, "%s port %u", seg, ntohs(port)); 738 free(seg), seg = p; 739 } 740 seg1 = seg2 = "any"; 741 742 /* Get the NAT type and determine the translation segment. */ 743 switch (npf_nat_gettype(nt)) { 744 case NPF_NATIN: 745 arrow = "<-"; 746 seg1 = seg; 747 break; 748 case NPF_NATOUT: 749 arrow = "->"; 750 seg2 = seg; 751 break; 752 default: 753 abort(); 754 } 755 756 /* NAT algorithm. */ 757 switch (npf_nat_getalgo(nt)) { 758 case NPF_ALGO_NETMAP: 759 algo = "algo netmap "; 760 break; 761 case NPF_ALGO_IPHASH: 762 algo = "algo ip-hash "; 763 break; 764 case NPF_ALGO_RR: 765 algo = "algo round-robin "; 766 break; 767 case NPF_ALGO_NPT66: 768 algo = "algo npt66 "; 769 break; 770 default: 771 algo = ""; 772 break; 773 } 774 775 /* XXX also handle "any" */ 776 777 /* Print out the NAT policy with the filter criteria. */ 778 ctx->fpos += fprintf(ctx->fp, "map %s %s %s%s%s %s %s pass ", 779 ifname, (flags & NPF_NAT_STATIC) ? "static" : "dynamic", 780 algo, (flags & NPF_NAT_PORTS) ? "" : "no-ports ", 781 seg1, arrow, seg2); 782 npfctl_print_filter(ctx, rl, attr); 783 npfctl_print_id(ctx, rl); 784 ctx->fpos += fprintf(ctx->fp, "\n"); 785 free(seg); 786 } 787 788 static void 789 npfctl_print_table(npf_conf_info_t *ctx, nl_table_t *tl) 790 { 791 const char *name = npf_table_getname(tl); 792 const unsigned type = npf_table_gettype(tl); 793 const char *table_types[] = { 794 [NPF_TABLE_IPSET] = "ipset", 795 [NPF_TABLE_LPM] = "lpm", 796 [NPF_TABLE_CONST] = "const", 797 }; 798 799 if (name[0] == '.') { 800 /* Internal tables use dot and are hidden. */ 801 return; 802 } 803 assert(type < __arraycount(table_types)); 804 ctx->fpos += fprintf(ctx->fp, 805 "table <%s> type %s\n", name, table_types[type]); 806 } 807 808 static void 809 npfctl_print_params(npf_conf_info_t *ctx, nl_config_t *ncf) 810 { 811 nl_iter_t i = NPF_ITER_BEGIN; 812 int val, defval, *dval; 813 const char *name; 814 815 dval = ctx->validating ? NULL : &defval; 816 while ((name = npf_param_iterate(ncf, &i, &val, dval)) != NULL) { 817 if (dval && val == *dval) { 818 continue; 819 } 820 ctx->fpos += fprintf(ctx->fp, "set %s %d\n", name, val); 821 } 822 print_linesep(ctx); 823 } 824 825 int 826 npfctl_config_show(int fd) 827 { 828 npf_conf_info_t *ctx = npfctl_show_init(); 829 nl_config_t *ncf; 830 bool loaded; 831 832 if (fd) { 833 ncf = npf_config_retrieve(fd); 834 if (ncf == NULL) { 835 return errno; 836 } 837 loaded = npf_config_loaded_p(ncf); 838 ctx->validating = false; 839 ctx->fpos += fprintf(ctx->fp, 840 "# filtering:\t%s\n# config:\t%s\n", 841 npf_config_active_p(ncf) ? "active" : "inactive", 842 loaded ? "loaded" : "empty"); 843 print_linesep(ctx); 844 } else { 845 ncf = npfctl_config_ref(); 846 npfctl_config_build(); 847 ctx->validating = true; 848 loaded = true; 849 } 850 ctx->conf = ncf; 851 852 if (loaded) { 853 nl_rule_t *rl; 854 nl_rproc_t *rp; 855 nl_nat_t *nt; 856 nl_table_t *tl; 857 nl_iter_t i; 858 unsigned level; 859 860 npfctl_print_params(ctx, ncf); 861 862 i = NPF_ITER_BEGIN; 863 while ((tl = npf_table_iterate(ncf, &i)) != NULL) { 864 npfctl_print_table(ctx, tl); 865 } 866 print_linesep(ctx); 867 868 i = NPF_ITER_BEGIN; 869 while ((rp = npf_rproc_iterate(ncf, &i)) != NULL) { 870 const char *rpname = npf_rproc_getname(rp); 871 ctx->fpos += fprintf(ctx->fp, 872 "procedure \"%s\"\n", rpname); 873 } 874 print_linesep(ctx); 875 876 i = NPF_ITER_BEGIN; 877 while ((nt = npf_nat_iterate(ncf, &i)) != NULL) { 878 npfctl_print_nat(ctx, nt); 879 } 880 print_linesep(ctx); 881 882 i = NPF_ITER_BEGIN; 883 while ((rl = npf_rule_iterate(ncf, &i, &level)) != NULL) { 884 print_indent(ctx, level); 885 npfctl_print_rule(ctx, rl, level); 886 } 887 print_indent(ctx, 0); 888 } 889 npf_config_destroy(ncf); 890 return 0; 891 } 892 893 int 894 npfctl_ruleset_show(int fd, const char *ruleset_name) 895 { 896 npf_conf_info_t *ctx = npfctl_show_init(); 897 nl_config_t *ncf; 898 nl_rule_t *rl; 899 unsigned level; 900 nl_iter_t i; 901 int error; 902 903 ncf = npf_config_create(); 904 ctx->conf = ncf; 905 906 if ((error = _npf_ruleset_list(fd, ruleset_name, ncf)) != 0) { 907 return error; 908 } 909 i = NPF_ITER_BEGIN; 910 while ((rl = npf_rule_iterate(ncf, &i, &level)) != NULL) { 911 npfctl_print_rule(ctx, rl, 0); 912 } 913 npf_config_destroy(ncf); 914 return error; 915 } 916
Indexes created Wed Sep 24 05:09:52 GMT 2025