npf.c revision 1.7.2.5.4.1
1 /* $NetBSD: npf.c,v 1.7.2.5.4.1 2012/11/19 18:15:24 riz Exp $ */ 2 3 /*- 4 * Copyright (c) 2010-2012 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 __KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.7.2.5.4.1 2012/11/19 18:15:24 riz Exp $"); 34 35 #include <sys/types.h> 36 #include <netinet/in_systm.h> 37 #include <netinet/in.h> 38 #include <net/if.h> 39 #include <prop/proplib.h> 40 41 #include <stdlib.h> 42 #include <string.h> 43 #include <assert.h> 44 #include <errno.h> 45 #include <err.h> 46 47 #define _NPF_PRIVATE 48 #include "npf.h" 49 50 struct nl_config { 51 /* Rules, translations, tables, procedures. */ 52 prop_dictionary_t ncf_dict; 53 prop_array_t ncf_rules_list; 54 prop_array_t ncf_rproc_list; 55 prop_array_t ncf_table_list; 56 prop_array_t ncf_nat_list; 57 /* Priority counters. */ 58 pri_t ncf_rule_pri; 59 pri_t ncf_nat_pri; 60 /* Debug information. */ 61 prop_dictionary_t ncf_debug; 62 /* Error report. */ 63 prop_dictionary_t ncf_err; 64 /* Custom file to externalise property-list. */ 65 const char * ncf_plist; 66 bool ncf_flush; 67 }; 68 69 struct nl_rule { 70 prop_dictionary_t nrl_dict; 71 }; 72 73 struct nl_rproc { 74 prop_dictionary_t nrp_dict; 75 }; 76 77 struct nl_table { 78 prop_dictionary_t ntl_dict; 79 }; 80 81 /* 82 * CONFIGURATION INTERFACE. 83 */ 84 85 nl_config_t * 86 npf_config_create(void) 87 { 88 nl_config_t *ncf; 89 90 ncf = calloc(1, sizeof(*ncf)); 91 if (ncf == NULL) { 92 return NULL; 93 } 94 ncf->ncf_rules_list = prop_array_create(); 95 ncf->ncf_rproc_list = prop_array_create(); 96 ncf->ncf_table_list = prop_array_create(); 97 ncf->ncf_nat_list = prop_array_create(); 98 99 ncf->ncf_rule_pri = 1; 100 ncf->ncf_nat_pri = 1; 101 102 ncf->ncf_plist = NULL; 103 ncf->ncf_flush = false; 104 105 return ncf; 106 } 107 108 int 109 npf_config_submit(nl_config_t *ncf, int fd) 110 { 111 const char *plist = ncf->ncf_plist; 112 prop_dictionary_t npf_dict; 113 int error = 0; 114 115 npf_dict = prop_dictionary_create(); 116 if (npf_dict == NULL) { 117 return ENOMEM; 118 } 119 if (ncf->ncf_debug) { 120 prop_dictionary_set(npf_dict, "debug", ncf->ncf_debug); 121 } 122 prop_dictionary_set(npf_dict, "rules", ncf->ncf_rules_list); 123 prop_dictionary_set(npf_dict, "rprocs", ncf->ncf_rproc_list); 124 prop_dictionary_set(npf_dict, "tables", ncf->ncf_table_list); 125 prop_dictionary_set(npf_dict, "translation", ncf->ncf_nat_list); 126 prop_dictionary_set_bool(npf_dict, "flush", ncf->ncf_flush); 127 128 if (plist) { 129 if (!prop_dictionary_externalize_to_file(npf_dict, plist)) { 130 error = errno; 131 } 132 prop_object_release(npf_dict); 133 return error; 134 } 135 136 error = prop_dictionary_sendrecv_ioctl(npf_dict, fd, 137 IOC_NPF_RELOAD, &ncf->ncf_err); 138 if (error) { 139 prop_object_release(npf_dict); 140 assert(ncf->ncf_err == NULL); 141 return error; 142 } 143 144 prop_dictionary_get_int32(ncf->ncf_err, "errno", &error); 145 prop_object_release(npf_dict); 146 return error; 147 } 148 149 nl_config_t * 150 npf_config_retrieve(int fd, bool *active, bool *loaded) 151 { 152 prop_dictionary_t npf_dict; 153 nl_config_t *ncf; 154 int error; 155 156 error = prop_dictionary_recv_ioctl(fd, IOC_NPF_GETCONF, &npf_dict); 157 if (error) { 158 return NULL; 159 } 160 ncf = calloc(1, sizeof(*ncf)); 161 if (ncf == NULL) { 162 prop_object_release(npf_dict); 163 return NULL; 164 } 165 ncf->ncf_dict = npf_dict; 166 ncf->ncf_rules_list = prop_dictionary_get(npf_dict, "rules"); 167 ncf->ncf_rproc_list = prop_dictionary_get(npf_dict, "rprocs"); 168 ncf->ncf_table_list = prop_dictionary_get(npf_dict, "tables"); 169 ncf->ncf_nat_list = prop_dictionary_get(npf_dict, "translation"); 170 171 prop_dictionary_get_bool(npf_dict, "active", active); 172 *loaded = (ncf->ncf_rules_list != NULL); 173 return ncf; 174 } 175 176 int 177 npf_config_flush(int fd) 178 { 179 nl_config_t *ncf; 180 int error; 181 182 ncf = npf_config_create(); 183 if (ncf == NULL) { 184 return ENOMEM; 185 } 186 ncf->ncf_flush = true; 187 error = npf_config_submit(ncf, fd); 188 npf_config_destroy(ncf); 189 return error; 190 } 191 192 void 193 _npf_config_error(nl_config_t *ncf, nl_error_t *ne) 194 { 195 memset(ne, 0, sizeof(*ne)); 196 prop_dictionary_get_int32(ncf->ncf_err, "id", &ne->ne_id); 197 prop_dictionary_get_cstring(ncf->ncf_err, 198 "source-file", &ne->ne_source_file); 199 prop_dictionary_get_uint32(ncf->ncf_err, 200 "source-line", &ne->ne_source_line); 201 prop_dictionary_get_int32(ncf->ncf_err, 202 "ncode-error", &ne->ne_ncode_error); 203 prop_dictionary_get_int32(ncf->ncf_err, 204 "ncode-errat", &ne->ne_ncode_errat); 205 } 206 207 void 208 npf_config_destroy(nl_config_t *ncf) 209 { 210 211 if (!ncf->ncf_dict) { 212 prop_object_release(ncf->ncf_rules_list); 213 prop_object_release(ncf->ncf_rproc_list); 214 prop_object_release(ncf->ncf_table_list); 215 prop_object_release(ncf->ncf_nat_list); 216 } 217 if (ncf->ncf_err) { 218 prop_object_release(ncf->ncf_err); 219 } 220 if (ncf->ncf_debug) { 221 prop_object_release(ncf->ncf_debug); 222 } 223 free(ncf); 224 } 225 226 void 227 _npf_config_setsubmit(nl_config_t *ncf, const char *plist_file) 228 { 229 230 ncf->ncf_plist = plist_file; 231 } 232 233 static bool 234 _npf_prop_array_lookup(prop_array_t array, const char *key, const char *name) 235 { 236 prop_dictionary_t dict; 237 prop_object_iterator_t it; 238 239 it = prop_array_iterator(array); 240 while ((dict = prop_object_iterator_next(it)) != NULL) { 241 const char *lname; 242 prop_dictionary_get_cstring_nocopy(dict, key, &lname); 243 if (strcmp(name, lname) == 0) 244 break; 245 } 246 prop_object_iterator_release(it); 247 return dict ? true : false; 248 } 249 250 /* 251 * RULE INTERFACE. 252 */ 253 254 nl_rule_t * 255 npf_rule_create(const char *name, uint32_t attr, u_int if_idx) 256 { 257 prop_dictionary_t rldict; 258 nl_rule_t *rl; 259 260 rl = malloc(sizeof(*rl)); 261 if (rl == NULL) { 262 return NULL; 263 } 264 rldict = prop_dictionary_create(); 265 if (rldict == NULL) { 266 free(rl); 267 return NULL; 268 } 269 if (name) { 270 prop_dictionary_set_cstring(rldict, "name", name); 271 } 272 prop_dictionary_set_uint32(rldict, "attributes", attr); 273 274 if (if_idx) { 275 prop_dictionary_set_uint32(rldict, "interface", if_idx); 276 } 277 rl->nrl_dict = rldict; 278 return rl; 279 } 280 281 int 282 npf_rule_setcode(nl_rule_t *rl, int type, const void *code, size_t sz) 283 { 284 prop_dictionary_t rldict = rl->nrl_dict; 285 prop_data_t cdata; 286 287 if (type != NPF_CODE_NCODE) { 288 return ENOTSUP; 289 } 290 cdata = prop_data_create_data(code, sz); 291 if (cdata == NULL) { 292 return ENOMEM; 293 } 294 prop_dictionary_set(rldict, "ncode", cdata); 295 prop_object_release(cdata); 296 return 0; 297 } 298 299 int 300 npf_rule_setproc(nl_config_t *ncf, nl_rule_t *rl, const char *name) 301 { 302 prop_dictionary_t rldict = rl->nrl_dict; 303 304 if (!npf_rproc_exists_p(ncf, name)) { 305 return ENOENT; 306 } 307 prop_dictionary_set_cstring(rldict, "rproc", name); 308 return 0; 309 } 310 311 bool 312 npf_rule_exists_p(nl_config_t *ncf, const char *name) 313 { 314 315 return _npf_prop_array_lookup(ncf->ncf_rules_list, "name", name); 316 } 317 318 int 319 npf_rule_insert(nl_config_t *ncf, nl_rule_t *parent, nl_rule_t *rl, pri_t pri) 320 { 321 prop_dictionary_t rldict = rl->nrl_dict; 322 prop_array_t rlset; 323 324 if (pri == NPF_PRI_NEXT) { 325 pri = ncf->ncf_rule_pri++; 326 } else if (ncf) { 327 ncf->ncf_rule_pri = pri + 1; 328 } 329 prop_dictionary_set_int32(rldict, "priority", pri); 330 331 if (parent) { 332 prop_dictionary_t pdict = parent->nrl_dict; 333 rlset = prop_dictionary_get(pdict, "subrules"); 334 if (rlset == NULL) { 335 rlset = prop_array_create(); 336 prop_dictionary_set(pdict, "subrules", rlset); 337 prop_object_release(rlset); 338 } 339 } else { 340 rlset = ncf->ncf_rules_list; 341 } 342 prop_array_add(rlset, rldict); 343 return 0; 344 } 345 346 static int 347 _npf_rule_foreach1(prop_array_t rules, unsigned nlevel, nl_rule_callback_t func) 348 { 349 prop_dictionary_t rldict; 350 prop_object_iterator_t it; 351 352 if (!rules || prop_object_type(rules) != PROP_TYPE_ARRAY) { 353 return ENOENT; 354 } 355 it = prop_array_iterator(rules); 356 if (it == NULL) { 357 return ENOMEM; 358 } 359 while ((rldict = prop_object_iterator_next(it)) != NULL) { 360 prop_array_t subrules; 361 nl_rule_t nrl; 362 363 nrl.nrl_dict = rldict; 364 (*func)(&nrl, nlevel); 365 366 subrules = prop_dictionary_get(rldict, "subrules"); 367 if (!subrules) { 368 continue; 369 } 370 (void)_npf_rule_foreach1(subrules, nlevel + 1, func); 371 } 372 prop_object_iterator_release(it); 373 return 0; 374 } 375 376 int 377 _npf_rule_foreach(nl_config_t *ncf, nl_rule_callback_t func) 378 { 379 380 return _npf_rule_foreach1(ncf->ncf_rules_list, 0, func); 381 } 382 383 pri_t 384 _npf_rule_getinfo(nl_rule_t *nrl, const char **rname, uint32_t *attr, 385 u_int *if_idx) 386 { 387 prop_dictionary_t rldict = nrl->nrl_dict; 388 pri_t prio; 389 390 prop_dictionary_get_cstring_nocopy(rldict, "name", rname); 391 prop_dictionary_get_uint32(rldict, "attributes", attr); 392 prop_dictionary_get_int32(rldict, "priority", &prio); 393 prop_dictionary_get_uint32(rldict, "interface", if_idx); 394 return prio; 395 } 396 397 const void * 398 _npf_rule_ncode(nl_rule_t *nrl, size_t *size) 399 { 400 prop_dictionary_t rldict = nrl->nrl_dict; 401 prop_object_t obj = prop_dictionary_get(rldict, "ncode"); 402 *size = prop_data_size(obj); 403 return prop_data_data_nocopy(obj); 404 } 405 406 const char * 407 _npf_rule_rproc(nl_rule_t *nrl) 408 { 409 prop_dictionary_t rldict = nrl->nrl_dict; 410 const char *rpname = NULL; 411 412 prop_dictionary_get_cstring_nocopy(rldict, "rproc", &rpname); 413 return rpname; 414 } 415 416 void 417 npf_rule_destroy(nl_rule_t *rl) 418 { 419 420 prop_object_release(rl->nrl_dict); 421 free(rl); 422 } 423 424 /* 425 * RULE PROCEDURE INTERFACE. 426 */ 427 428 nl_rproc_t * 429 npf_rproc_create(const char *name) 430 { 431 prop_dictionary_t rpdict; 432 nl_rproc_t *nrp; 433 434 nrp = malloc(sizeof(nl_rproc_t)); 435 if (nrp == NULL) { 436 return NULL; 437 } 438 rpdict = prop_dictionary_create(); 439 if (rpdict == NULL) { 440 free(nrp); 441 return NULL; 442 } 443 prop_dictionary_set_cstring(rpdict, "name", name); 444 nrp->nrp_dict = rpdict; 445 return nrp; 446 } 447 448 bool 449 npf_rproc_exists_p(nl_config_t *ncf, const char *name) 450 { 451 452 return _npf_prop_array_lookup(ncf->ncf_rproc_list, "name", name); 453 } 454 455 int 456 _npf_rproc_setnorm(nl_rproc_t *rp, bool rnd, bool no_df, u_int minttl, 457 u_int maxmss) 458 { 459 prop_dictionary_t rpdict = rp->nrp_dict; 460 uint32_t fl = 0; 461 462 prop_dictionary_set_bool(rpdict, "randomize-id", rnd); 463 prop_dictionary_set_bool(rpdict, "no-df", no_df); 464 prop_dictionary_set_uint32(rpdict, "min-ttl", minttl); 465 prop_dictionary_set_uint32(rpdict, "max-mss", maxmss); 466 467 prop_dictionary_get_uint32(rpdict, "flags", &fl); 468 prop_dictionary_set_uint32(rpdict, "flags", fl | NPF_RPROC_NORMALIZE); 469 return 0; 470 } 471 472 int 473 _npf_rproc_setlog(nl_rproc_t *rp, u_int if_idx) 474 { 475 prop_dictionary_t rpdict = rp->nrp_dict; 476 uint32_t fl = 0; 477 478 prop_dictionary_set_uint32(rpdict, "log-interface", if_idx); 479 480 prop_dictionary_get_uint32(rpdict, "flags", &fl); 481 prop_dictionary_set_uint32(rpdict, "flags", fl | NPF_RPROC_LOG); 482 return 0; 483 } 484 485 int 486 npf_rproc_insert(nl_config_t *ncf, nl_rproc_t *rp) 487 { 488 prop_dictionary_t rpdict = rp->nrp_dict; 489 const char *name; 490 491 if (!prop_dictionary_get_cstring_nocopy(rpdict, "name", &name)) { 492 return EINVAL; 493 } 494 if (npf_rproc_exists_p(ncf, name)) { 495 return EEXIST; 496 } 497 prop_array_add(ncf->ncf_rproc_list, rpdict); 498 return 0; 499 } 500 501 /* 502 * TRANSLATION INTERFACE. 503 */ 504 505 nl_nat_t * 506 npf_nat_create(int type, u_int flags, u_int if_idx, 507 npf_addr_t *addr, int af, in_port_t port) 508 { 509 nl_rule_t *rl; 510 prop_dictionary_t rldict; 511 prop_data_t addrdat; 512 uint32_t attr; 513 size_t sz; 514 515 if (af == AF_INET) { 516 sz = sizeof(struct in_addr); 517 } else if (af == AF_INET6) { 518 sz = sizeof(struct in6_addr); 519 } else { 520 return NULL; 521 } 522 523 attr = NPF_RULE_PASS | NPF_RULE_FINAL | 524 (type == NPF_NATOUT ? NPF_RULE_OUT : NPF_RULE_IN); 525 526 /* Create a rule for NAT policy. Next, will add translation data. */ 527 rl = npf_rule_create(NULL, attr, if_idx); 528 if (rl == NULL) { 529 return NULL; 530 } 531 rldict = rl->nrl_dict; 532 533 /* Translation type and flags. */ 534 prop_dictionary_set_int32(rldict, "type", type); 535 prop_dictionary_set_uint32(rldict, "flags", flags); 536 537 /* Translation IP. */ 538 addrdat = prop_data_create_data(addr, sz); 539 if (addrdat == NULL) { 540 npf_rule_destroy(rl); 541 return NULL; 542 } 543 prop_dictionary_set(rldict, "translation-ip", addrdat); 544 prop_object_release(addrdat); 545 546 /* Translation port (for redirect case). */ 547 prop_dictionary_set_uint16(rldict, "translation-port", port); 548 549 return (nl_nat_t *)rl; 550 } 551 552 int 553 npf_nat_insert(nl_config_t *ncf, nl_nat_t *nt, pri_t pri) 554 { 555 prop_dictionary_t rldict = nt->nrl_dict; 556 557 if (pri == NPF_PRI_NEXT) { 558 pri = ncf->ncf_nat_pri++; 559 } else { 560 ncf->ncf_nat_pri = pri + 1; 561 } 562 prop_dictionary_set_int32(rldict, "priority", pri); 563 prop_array_add(ncf->ncf_nat_list, rldict); 564 return 0; 565 } 566 567 int 568 _npf_nat_foreach(nl_config_t *ncf, nl_rule_callback_t func) 569 { 570 571 return _npf_rule_foreach1(ncf->ncf_nat_list, 0, func); 572 } 573 574 void 575 _npf_nat_getinfo(nl_nat_t *nt, int *type, u_int *flags, npf_addr_t *addr, 576 size_t *alen, in_port_t *port) 577 { 578 prop_dictionary_t rldict = nt->nrl_dict; 579 580 prop_dictionary_get_int32(rldict, "type", type); 581 prop_dictionary_get_uint32(rldict, "flags", flags); 582 583 prop_object_t obj = prop_dictionary_get(rldict, "translation-ip"); 584 *alen = prop_data_size(obj); 585 memcpy(addr, prop_data_data_nocopy(obj), *alen); 586 587 prop_dictionary_get_uint16(rldict, "translation-port", port); 588 } 589 590 /* 591 * TABLE INTERFACE. 592 */ 593 594 nl_table_t * 595 npf_table_create(u_int id, int type) 596 { 597 prop_dictionary_t tldict; 598 prop_array_t tblents; 599 nl_table_t *tl; 600 601 tl = malloc(sizeof(*tl)); 602 if (tl == NULL) { 603 return NULL; 604 } 605 tldict = prop_dictionary_create(); 606 if (tldict == NULL) { 607 free(tl); 608 return NULL; 609 } 610 prop_dictionary_set_uint32(tldict, "id", id); 611 prop_dictionary_set_int32(tldict, "type", type); 612 613 tblents = prop_array_create(); 614 if (tblents == NULL) { 615 prop_object_release(tldict); 616 free(tl); 617 return NULL; 618 } 619 prop_dictionary_set(tldict, "entries", tblents); 620 prop_object_release(tblents); 621 622 tl->ntl_dict = tldict; 623 return tl; 624 } 625 626 int 627 npf_table_add_entry(nl_table_t *tl, const int alen, 628 const npf_addr_t *addr, const npf_netmask_t mask) 629 { 630 prop_dictionary_t tldict = tl->ntl_dict, entdict; 631 prop_array_t tblents; 632 prop_data_t addrdata; 633 634 /* Create the table entry. */ 635 entdict = prop_dictionary_create(); 636 if (entdict == NULL) { 637 return ENOMEM; 638 } 639 addrdata = prop_data_create_data(addr, alen); 640 prop_dictionary_set(entdict, "addr", addrdata); 641 prop_dictionary_set_uint8(entdict, "mask", mask); 642 prop_object_release(addrdata); 643 644 /* Insert the entry. */ 645 tblents = prop_dictionary_get(tldict, "entries"); 646 prop_array_add(tblents, entdict); 647 prop_object_release(entdict); 648 return 0; 649 } 650 651 bool 652 npf_table_exists_p(nl_config_t *ncf, u_int tid) 653 { 654 prop_dictionary_t tldict; 655 prop_object_iterator_t it; 656 657 it = prop_array_iterator(ncf->ncf_table_list); 658 while ((tldict = prop_object_iterator_next(it)) != NULL) { 659 u_int i; 660 if (prop_dictionary_get_uint32(tldict, "id", &i) && tid == i) 661 break; 662 } 663 prop_object_iterator_release(it); 664 return tldict ? true : false; 665 } 666 667 int 668 npf_table_insert(nl_config_t *ncf, nl_table_t *tl) 669 { 670 prop_dictionary_t tldict = tl->ntl_dict; 671 u_int tid; 672 673 if (!prop_dictionary_get_uint32(tldict, "id", &tid)) { 674 return EINVAL; 675 } 676 if (npf_table_exists_p(ncf, tid)) { 677 return EEXIST; 678 } 679 prop_array_add(ncf->ncf_table_list, tldict); 680 return 0; 681 } 682 683 void 684 npf_table_destroy(nl_table_t *tl) 685 { 686 687 prop_object_release(tl->ntl_dict); 688 free(tl); 689 } 690 691 void 692 _npf_table_foreach(nl_config_t *ncf, nl_table_callback_t func) 693 { 694 prop_dictionary_t tldict; 695 prop_object_iterator_t it; 696 697 it = prop_array_iterator(ncf->ncf_table_list); 698 while ((tldict = prop_object_iterator_next(it)) != NULL) { 699 u_int id; 700 int type; 701 702 prop_dictionary_get_uint32(tldict, "id", &id); 703 prop_dictionary_get_int32(tldict, "type", &type); 704 (*func)(id, type); 705 } 706 prop_object_iterator_release(it); 707 } 708 709 /* 710 * MISC. 711 */ 712 713 int 714 npf_update_rule(int fd, const char *rname __unused, nl_rule_t *rl) 715 { 716 prop_dictionary_t rldict = rl->nrl_dict, errdict = NULL; 717 int error; 718 719 error = prop_dictionary_sendrecv_ioctl(rldict, fd, 720 IOC_NPF_UPDATE_RULE, &errdict); 721 if (errdict) { 722 prop_object_release(errdict); 723 } 724 return error; 725 } 726 727 int 728 npf_sessions_recv(int fd, const char *fpath) 729 { 730 prop_dictionary_t sdict; 731 int error; 732 733 error = prop_dictionary_recv_ioctl(fd, IOC_NPF_SESSIONS_SAVE, &sdict); 734 if (error) { 735 return error; 736 } 737 if (!prop_dictionary_externalize_to_file(sdict, fpath)) { 738 error = errno; 739 } 740 prop_object_release(sdict); 741 return error; 742 } 743 744 int 745 npf_sessions_send(int fd, const char *fpath) 746 { 747 prop_dictionary_t sdict; 748 int error; 749 750 if (fpath) { 751 sdict = prop_dictionary_internalize_from_file(fpath); 752 if (sdict == NULL) { 753 return errno; 754 } 755 } else { 756 /* Empty: will flush the sessions. */ 757 prop_array_t selist = prop_array_create(); 758 sdict = prop_dictionary_create(); 759 prop_dictionary_set(sdict, "session-list", selist); 760 prop_object_release(selist); 761 } 762 error = prop_dictionary_send_ioctl(sdict, fd, IOC_NPF_SESSIONS_LOAD); 763 prop_object_release(sdict); 764 return error; 765 } 766 767 static prop_dictionary_t 768 _npf_debug_initonce(nl_config_t *ncf) 769 { 770 if (!ncf->ncf_debug) { 771 prop_array_t iflist = prop_array_create(); 772 ncf->ncf_debug = prop_dictionary_create(); 773 prop_dictionary_set(ncf->ncf_debug, "interfaces", iflist); 774 prop_object_release(iflist); 775 } 776 return ncf->ncf_debug; 777 } 778 779 void 780 _npf_debug_addif(nl_config_t *ncf, struct ifaddrs *ifa, u_int if_idx) 781 { 782 prop_dictionary_t ifdict, dbg = _npf_debug_initonce(ncf); 783 prop_array_t iflist = prop_dictionary_get(dbg, "interfaces"); 784 785 if (_npf_prop_array_lookup(iflist, "name", ifa->ifa_name)) { 786 return; 787 } 788 789 ifdict = prop_dictionary_create(); 790 prop_dictionary_set_cstring(ifdict, "name", ifa->ifa_name); 791 prop_dictionary_set_uint32(ifdict, "flags", ifa->ifa_flags); 792 if (!if_idx) { 793 if_idx = if_nametoindex(ifa->ifa_name); 794 } 795 prop_dictionary_set_uint32(ifdict, "idx", if_idx); 796 797 const struct sockaddr *sa = ifa->ifa_addr; 798 npf_addr_t addr; 799 size_t alen = 0; 800 801 switch (sa ? sa->sa_family : -1) { 802 case AF_INET: { 803 const struct sockaddr_in *sin = (const void *)sa; 804 alen = sizeof(sin->sin_addr); 805 memcpy(&addr, &sin->sin_addr, alen); 806 break; 807 } 808 case AF_INET6: { 809 const struct sockaddr_in6 *sin6 = (const void *)sa; 810 alen = sizeof(sin6->sin6_addr); 811 memcpy(&addr, &sin6->sin6_addr, alen); 812 break; 813 } 814 default: 815 break; 816 } 817 818 if (alen) { 819 prop_data_t addrdata = prop_data_create_data(&addr, alen); 820 prop_dictionary_set(ifdict, "addr", addrdata); 821 prop_object_release(addrdata); 822 } 823 prop_array_add(iflist, ifdict); 824 prop_object_release(ifdict); 825 } 826
Indexes created Sat Oct 18 08:10:09 GMT 2025