npf.c revision 1.7.2.7
1 /* $NetBSD: npf.c,v 1.7.2.7 2012/11/19 18:16:17 riz Exp $ */ 2 3 /*- 4 * Copyright (c) 2010-2012 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 __KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.7.2.7 2012/11/19 18:16:17 riz Exp $"); 34 35 #include <sys/types.h> 36 #include <netinet/in_systm.h> 37 #include <netinet/in.h> 38 #include <net/if.h> 39 #include <prop/proplib.h> 40 41 #include <stdlib.h> 42 #include <string.h> 43 #include <assert.h> 44 #include <errno.h> 45 #include <err.h> 46 47 #define _NPF_PRIVATE 48 #include "npf.h" 49 50 struct nl_config { 51 /* Rules, translations, tables, procedures. */ 52 prop_dictionary_t ncf_dict; 53 prop_array_t ncf_rules_list; 54 prop_array_t ncf_rproc_list; 55 prop_array_t ncf_table_list; 56 prop_array_t ncf_nat_list; 57 /* Priority counters. */ 58 pri_t ncf_rule_pri; 59 pri_t ncf_nat_pri; 60 /* Debug information. */ 61 prop_dictionary_t ncf_debug; 62 /* Error report. */ 63 prop_dictionary_t ncf_err; 64 /* Custom file to externalise property-list. */ 65 const char * ncf_plist; 66 bool ncf_flush; 67 }; 68 69 struct nl_rule { 70 prop_dictionary_t nrl_dict; 71 }; 72 73 struct nl_rproc { 74 prop_dictionary_t nrp_dict; 75 }; 76 77 struct nl_table { 78 prop_dictionary_t ntl_dict; 79 }; 80 81 struct nl_ext { 82 const char * nxt_name; 83 prop_dictionary_t nxt_dict; 84 }; 85 86 /* 87 * CONFIGURATION INTERFACE. 88 */ 89 90 nl_config_t * 91 npf_config_create(void) 92 { 93 nl_config_t *ncf; 94 95 ncf = calloc(1, sizeof(*ncf)); 96 if (ncf == NULL) { 97 return NULL; 98 } 99 ncf->ncf_rules_list = prop_array_create(); 100 ncf->ncf_rproc_list = prop_array_create(); 101 ncf->ncf_table_list = prop_array_create(); 102 ncf->ncf_nat_list = prop_array_create(); 103 104 ncf->ncf_rule_pri = 1; 105 ncf->ncf_nat_pri = 1; 106 107 ncf->ncf_plist = NULL; 108 ncf->ncf_flush = false; 109 110 return ncf; 111 } 112 113 int 114 npf_config_submit(nl_config_t *ncf, int fd) 115 { 116 const char *plist = ncf->ncf_plist; 117 prop_dictionary_t npf_dict; 118 int error = 0; 119 120 npf_dict = prop_dictionary_create(); 121 if (npf_dict == NULL) { 122 return ENOMEM; 123 } 124 if (ncf->ncf_debug) { 125 prop_dictionary_set(npf_dict, "debug", ncf->ncf_debug); 126 } 127 prop_dictionary_set(npf_dict, "rules", ncf->ncf_rules_list); 128 prop_dictionary_set(npf_dict, "rprocs", ncf->ncf_rproc_list); 129 prop_dictionary_set(npf_dict, "tables", ncf->ncf_table_list); 130 prop_dictionary_set(npf_dict, "translation", ncf->ncf_nat_list); 131 prop_dictionary_set_bool(npf_dict, "flush", ncf->ncf_flush); 132 133 if (plist) { 134 if (!prop_dictionary_externalize_to_file(npf_dict, plist)) { 135 error = errno; 136 } 137 prop_object_release(npf_dict); 138 return error; 139 } 140 141 error = prop_dictionary_sendrecv_ioctl(npf_dict, fd, 142 IOC_NPF_RELOAD, &ncf->ncf_err); 143 if (error) { 144 prop_object_release(npf_dict); 145 assert(ncf->ncf_err == NULL); 146 return error; 147 } 148 149 prop_dictionary_get_int32(ncf->ncf_err, "errno", &error); 150 prop_object_release(npf_dict); 151 return error; 152 } 153 154 nl_config_t * 155 npf_config_retrieve(int fd, bool *active, bool *loaded) 156 { 157 prop_dictionary_t npf_dict; 158 nl_config_t *ncf; 159 int error; 160 161 error = prop_dictionary_recv_ioctl(fd, IOC_NPF_GETCONF, &npf_dict); 162 if (error) { 163 return NULL; 164 } 165 ncf = calloc(1, sizeof(*ncf)); 166 if (ncf == NULL) { 167 prop_object_release(npf_dict); 168 return NULL; 169 } 170 ncf->ncf_dict = npf_dict; 171 ncf->ncf_rules_list = prop_dictionary_get(npf_dict, "rules"); 172 ncf->ncf_rproc_list = prop_dictionary_get(npf_dict, "rprocs"); 173 ncf->ncf_table_list = prop_dictionary_get(npf_dict, "tables"); 174 ncf->ncf_nat_list = prop_dictionary_get(npf_dict, "translation"); 175 176 prop_dictionary_get_bool(npf_dict, "active", active); 177 *loaded = (ncf->ncf_rules_list != NULL); 178 return ncf; 179 } 180 181 int 182 npf_config_flush(int fd) 183 { 184 nl_config_t *ncf; 185 int error; 186 187 ncf = npf_config_create(); 188 if (ncf == NULL) { 189 return ENOMEM; 190 } 191 ncf->ncf_flush = true; 192 error = npf_config_submit(ncf, fd); 193 npf_config_destroy(ncf); 194 return error; 195 } 196 197 void 198 _npf_config_error(nl_config_t *ncf, nl_error_t *ne) 199 { 200 memset(ne, 0, sizeof(*ne)); 201 prop_dictionary_get_int32(ncf->ncf_err, "id", &ne->ne_id); 202 prop_dictionary_get_cstring(ncf->ncf_err, 203 "source-file", &ne->ne_source_file); 204 prop_dictionary_get_uint32(ncf->ncf_err, 205 "source-line", &ne->ne_source_line); 206 prop_dictionary_get_int32(ncf->ncf_err, 207 "ncode-error", &ne->ne_ncode_error); 208 prop_dictionary_get_int32(ncf->ncf_err, 209 "ncode-errat", &ne->ne_ncode_errat); 210 } 211 212 void 213 npf_config_destroy(nl_config_t *ncf) 214 { 215 216 if (!ncf->ncf_dict) { 217 prop_object_release(ncf->ncf_rules_list); 218 prop_object_release(ncf->ncf_rproc_list); 219 prop_object_release(ncf->ncf_table_list); 220 prop_object_release(ncf->ncf_nat_list); 221 } 222 if (ncf->ncf_err) { 223 prop_object_release(ncf->ncf_err); 224 } 225 if (ncf->ncf_debug) { 226 prop_object_release(ncf->ncf_debug); 227 } 228 free(ncf); 229 } 230 231 void 232 _npf_config_setsubmit(nl_config_t *ncf, const char *plist_file) 233 { 234 235 ncf->ncf_plist = plist_file; 236 } 237 238 static bool 239 _npf_prop_array_lookup(prop_array_t array, const char *key, const char *name) 240 { 241 prop_dictionary_t dict; 242 prop_object_iterator_t it; 243 244 it = prop_array_iterator(array); 245 while ((dict = prop_object_iterator_next(it)) != NULL) { 246 const char *lname; 247 prop_dictionary_get_cstring_nocopy(dict, key, &lname); 248 if (strcmp(name, lname) == 0) 249 break; 250 } 251 prop_object_iterator_release(it); 252 return dict ? true : false; 253 } 254 255 /* 256 * NPF EXTENSION INTERFACE. 257 */ 258 259 nl_ext_t * 260 npf_ext_construct(const char *name) 261 { 262 nl_ext_t *ext; 263 264 ext = malloc(sizeof(*ext)); 265 if (ext == NULL) { 266 return NULL; 267 } 268 ext->nxt_name = strdup(name); 269 if (ext->nxt_name == NULL) { 270 free(ext); 271 return NULL; 272 } 273 ext->nxt_dict = prop_dictionary_create(); 274 275 return ext; 276 } 277 278 void 279 npf_ext_param_u32(nl_ext_t *ext, const char *key, uint32_t val) 280 { 281 prop_dictionary_t extdict = ext->nxt_dict; 282 prop_dictionary_set_uint32(extdict, key, val); 283 } 284 285 void 286 npf_ext_param_bool(nl_ext_t *ext, const char *key, bool val) 287 { 288 prop_dictionary_t extdict = ext->nxt_dict; 289 prop_dictionary_set_bool(extdict, key, val); 290 } 291 292 /* 293 * RULE INTERFACE. 294 */ 295 296 nl_rule_t * 297 npf_rule_create(const char *name, uint32_t attr, u_int if_idx) 298 { 299 prop_dictionary_t rldict; 300 nl_rule_t *rl; 301 302 rl = malloc(sizeof(*rl)); 303 if (rl == NULL) { 304 return NULL; 305 } 306 rldict = prop_dictionary_create(); 307 if (rldict == NULL) { 308 free(rl); 309 return NULL; 310 } 311 if (name) { 312 prop_dictionary_set_cstring(rldict, "name", name); 313 } 314 prop_dictionary_set_uint32(rldict, "attributes", attr); 315 316 if (if_idx) { 317 prop_dictionary_set_uint32(rldict, "interface", if_idx); 318 } 319 rl->nrl_dict = rldict; 320 return rl; 321 } 322 323 int 324 npf_rule_setcode(nl_rule_t *rl, int type, const void *code, size_t sz) 325 { 326 prop_dictionary_t rldict = rl->nrl_dict; 327 prop_data_t cdata; 328 329 if (type != NPF_CODE_NCODE) { 330 return ENOTSUP; 331 } 332 cdata = prop_data_create_data(code, sz); 333 if (cdata == NULL) { 334 return ENOMEM; 335 } 336 prop_dictionary_set(rldict, "ncode", cdata); 337 prop_object_release(cdata); 338 return 0; 339 } 340 341 int 342 npf_rule_setproc(nl_config_t *ncf, nl_rule_t *rl, const char *name) 343 { 344 prop_dictionary_t rldict = rl->nrl_dict; 345 346 if (!npf_rproc_exists_p(ncf, name)) { 347 return ENOENT; 348 } 349 prop_dictionary_set_cstring(rldict, "rproc", name); 350 return 0; 351 } 352 353 bool 354 npf_rule_exists_p(nl_config_t *ncf, const char *name) 355 { 356 357 return _npf_prop_array_lookup(ncf->ncf_rules_list, "name", name); 358 } 359 360 int 361 npf_rule_insert(nl_config_t *ncf, nl_rule_t *parent, nl_rule_t *rl, pri_t pri) 362 { 363 prop_dictionary_t rldict = rl->nrl_dict; 364 prop_array_t rlset; 365 366 if (pri == NPF_PRI_NEXT) { 367 pri = ncf->ncf_rule_pri++; 368 } else if (ncf) { 369 ncf->ncf_rule_pri = pri + 1; 370 } 371 prop_dictionary_set_int32(rldict, "priority", pri); 372 373 if (parent) { 374 prop_dictionary_t pdict = parent->nrl_dict; 375 rlset = prop_dictionary_get(pdict, "subrules"); 376 if (rlset == NULL) { 377 rlset = prop_array_create(); 378 prop_dictionary_set(pdict, "subrules", rlset); 379 prop_object_release(rlset); 380 } 381 } else { 382 rlset = ncf->ncf_rules_list; 383 } 384 prop_array_add(rlset, rldict); 385 return 0; 386 } 387 388 static int 389 _npf_rule_foreach1(prop_array_t rules, unsigned nlevel, nl_rule_callback_t func) 390 { 391 prop_dictionary_t rldict; 392 prop_object_iterator_t it; 393 394 if (!rules || prop_object_type(rules) != PROP_TYPE_ARRAY) { 395 return ENOENT; 396 } 397 it = prop_array_iterator(rules); 398 if (it == NULL) { 399 return ENOMEM; 400 } 401 while ((rldict = prop_object_iterator_next(it)) != NULL) { 402 prop_array_t subrules; 403 nl_rule_t nrl; 404 405 nrl.nrl_dict = rldict; 406 (*func)(&nrl, nlevel); 407 408 subrules = prop_dictionary_get(rldict, "subrules"); 409 if (!subrules) { 410 continue; 411 } 412 (void)_npf_rule_foreach1(subrules, nlevel + 1, func); 413 prop_object_release(subrules); 414 } 415 prop_object_iterator_release(it); 416 return 0; 417 } 418 419 int 420 _npf_rule_foreach(nl_config_t *ncf, nl_rule_callback_t func) 421 { 422 423 return _npf_rule_foreach1(ncf->ncf_rules_list, 0, func); 424 } 425 426 pri_t 427 _npf_rule_getinfo(nl_rule_t *nrl, const char **rname, uint32_t *attr, 428 u_int *if_idx) 429 { 430 prop_dictionary_t rldict = nrl->nrl_dict; 431 pri_t prio; 432 433 prop_dictionary_get_cstring_nocopy(rldict, "name", rname); 434 prop_dictionary_get_uint32(rldict, "attributes", attr); 435 prop_dictionary_get_int32(rldict, "priority", &prio); 436 prop_dictionary_get_uint32(rldict, "interface", if_idx); 437 return prio; 438 } 439 440 const void * 441 _npf_rule_ncode(nl_rule_t *nrl, size_t *size) 442 { 443 prop_dictionary_t rldict = nrl->nrl_dict; 444 prop_object_t obj = prop_dictionary_get(rldict, "ncode"); 445 *size = prop_data_size(obj); 446 return prop_data_data_nocopy(obj); 447 } 448 449 const char * 450 _npf_rule_rproc(nl_rule_t *nrl) 451 { 452 prop_dictionary_t rldict = nrl->nrl_dict; 453 const char *rpname = NULL; 454 455 prop_dictionary_get_cstring_nocopy(rldict, "rproc", &rpname); 456 return rpname; 457 } 458 459 void 460 npf_rule_destroy(nl_rule_t *rl) 461 { 462 463 prop_object_release(rl->nrl_dict); 464 free(rl); 465 } 466 467 /* 468 * RULE PROCEDURE INTERFACE. 469 */ 470 471 nl_rproc_t * 472 npf_rproc_create(const char *name) 473 { 474 prop_dictionary_t rpdict; 475 prop_array_t extcalls; 476 nl_rproc_t *nrp; 477 478 nrp = malloc(sizeof(nl_rproc_t)); 479 if (nrp == NULL) { 480 return NULL; 481 } 482 rpdict = prop_dictionary_create(); 483 if (rpdict == NULL) { 484 free(nrp); 485 return NULL; 486 } 487 prop_dictionary_set_cstring(rpdict, "name", name); 488 489 extcalls = prop_array_create(); 490 if (extcalls == NULL) { 491 prop_object_release(rpdict); 492 free(nrp); 493 return NULL; 494 } 495 prop_dictionary_set(rpdict, "extcalls", extcalls); 496 prop_object_release(extcalls); 497 498 nrp->nrp_dict = rpdict; 499 return nrp; 500 } 501 502 int 503 npf_rproc_extcall(nl_rproc_t *rp, nl_ext_t *ext) 504 { 505 prop_dictionary_t rpdict = rp->nrp_dict; 506 prop_dictionary_t extdict = ext->nxt_dict; 507 prop_array_t extcalls; 508 509 extcalls = prop_dictionary_get(rpdict, "extcalls"); 510 if (_npf_prop_array_lookup(extcalls, "name", ext->nxt_name)) { 511 return EEXIST; 512 } 513 prop_dictionary_set_cstring(extdict, "name", ext->nxt_name); 514 prop_array_add(extcalls, extdict); 515 return 0; 516 } 517 518 bool 519 npf_rproc_exists_p(nl_config_t *ncf, const char *name) 520 { 521 522 return _npf_prop_array_lookup(ncf->ncf_rproc_list, "name", name); 523 } 524 525 int 526 npf_rproc_insert(nl_config_t *ncf, nl_rproc_t *rp) 527 { 528 prop_dictionary_t rpdict = rp->nrp_dict; 529 const char *name; 530 531 if (!prop_dictionary_get_cstring_nocopy(rpdict, "name", &name)) { 532 return EINVAL; 533 } 534 if (npf_rproc_exists_p(ncf, name)) { 535 return EEXIST; 536 } 537 prop_array_add(ncf->ncf_rproc_list, rpdict); 538 return 0; 539 } 540 541 /* 542 * TRANSLATION INTERFACE. 543 */ 544 545 nl_nat_t * 546 npf_nat_create(int type, u_int flags, u_int if_idx, 547 npf_addr_t *addr, int af, in_port_t port) 548 { 549 nl_rule_t *rl; 550 prop_dictionary_t rldict; 551 prop_data_t addrdat; 552 uint32_t attr; 553 size_t sz; 554 555 if (af == AF_INET) { 556 sz = sizeof(struct in_addr); 557 } else if (af == AF_INET6) { 558 sz = sizeof(struct in6_addr); 559 } else { 560 return NULL; 561 } 562 563 attr = NPF_RULE_PASS | NPF_RULE_FINAL | 564 (type == NPF_NATOUT ? NPF_RULE_OUT : NPF_RULE_IN); 565 566 /* Create a rule for NAT policy. Next, will add translation data. */ 567 rl = npf_rule_create(NULL, attr, if_idx); 568 if (rl == NULL) { 569 return NULL; 570 } 571 rldict = rl->nrl_dict; 572 573 /* Translation type and flags. */ 574 prop_dictionary_set_int32(rldict, "type", type); 575 prop_dictionary_set_uint32(rldict, "flags", flags); 576 577 /* Translation IP. */ 578 addrdat = prop_data_create_data(addr, sz); 579 if (addrdat == NULL) { 580 npf_rule_destroy(rl); 581 return NULL; 582 } 583 prop_dictionary_set(rldict, "translation-ip", addrdat); 584 prop_object_release(addrdat); 585 586 /* Translation port (for redirect case). */ 587 prop_dictionary_set_uint16(rldict, "translation-port", port); 588 589 return (nl_nat_t *)rl; 590 } 591 592 int 593 npf_nat_insert(nl_config_t *ncf, nl_nat_t *nt, pri_t pri) 594 { 595 prop_dictionary_t rldict = nt->nrl_dict; 596 597 if (pri == NPF_PRI_NEXT) { 598 pri = ncf->ncf_nat_pri++; 599 } else { 600 ncf->ncf_nat_pri = pri + 1; 601 } 602 prop_dictionary_set_int32(rldict, "priority", pri); 603 prop_array_add(ncf->ncf_nat_list, rldict); 604 return 0; 605 } 606 607 int 608 _npf_nat_foreach(nl_config_t *ncf, nl_rule_callback_t func) 609 { 610 611 return _npf_rule_foreach1(ncf->ncf_nat_list, 0, func); 612 } 613 614 void 615 _npf_nat_getinfo(nl_nat_t *nt, int *type, u_int *flags, npf_addr_t *addr, 616 size_t *alen, in_port_t *port) 617 { 618 prop_dictionary_t rldict = nt->nrl_dict; 619 620 prop_dictionary_get_int32(rldict, "type", type); 621 prop_dictionary_get_uint32(rldict, "flags", flags); 622 623 prop_object_t obj = prop_dictionary_get(rldict, "translation-ip"); 624 *alen = prop_data_size(obj); 625 memcpy(addr, prop_data_data_nocopy(obj), *alen); 626 627 prop_dictionary_get_uint16(rldict, "translation-port", port); 628 } 629 630 /* 631 * TABLE INTERFACE. 632 */ 633 634 nl_table_t * 635 npf_table_create(u_int id, int type) 636 { 637 prop_dictionary_t tldict; 638 prop_array_t tblents; 639 nl_table_t *tl; 640 641 tl = malloc(sizeof(*tl)); 642 if (tl == NULL) { 643 return NULL; 644 } 645 tldict = prop_dictionary_create(); 646 if (tldict == NULL) { 647 free(tl); 648 return NULL; 649 } 650 prop_dictionary_set_uint32(tldict, "id", id); 651 prop_dictionary_set_int32(tldict, "type", type); 652 653 tblents = prop_array_create(); 654 if (tblents == NULL) { 655 prop_object_release(tldict); 656 free(tl); 657 return NULL; 658 } 659 prop_dictionary_set(tldict, "entries", tblents); 660 prop_object_release(tblents); 661 662 tl->ntl_dict = tldict; 663 return tl; 664 } 665 666 int 667 npf_table_add_entry(nl_table_t *tl, const int alen, 668 const npf_addr_t *addr, const npf_netmask_t mask) 669 { 670 prop_dictionary_t tldict = tl->ntl_dict, entdict; 671 prop_array_t tblents; 672 prop_data_t addrdata; 673 674 /* Create the table entry. */ 675 entdict = prop_dictionary_create(); 676 if (entdict == NULL) { 677 return ENOMEM; 678 } 679 addrdata = prop_data_create_data(addr, alen); 680 prop_dictionary_set(entdict, "addr", addrdata); 681 prop_dictionary_set_uint8(entdict, "mask", mask); 682 prop_object_release(addrdata); 683 684 /* Insert the entry. */ 685 tblents = prop_dictionary_get(tldict, "entries"); 686 prop_array_add(tblents, entdict); 687 prop_object_release(entdict); 688 return 0; 689 } 690 691 bool 692 npf_table_exists_p(nl_config_t *ncf, u_int tid) 693 { 694 prop_dictionary_t tldict; 695 prop_object_iterator_t it; 696 697 it = prop_array_iterator(ncf->ncf_table_list); 698 while ((tldict = prop_object_iterator_next(it)) != NULL) { 699 u_int i; 700 if (prop_dictionary_get_uint32(tldict, "id", &i) && tid == i) 701 break; 702 } 703 prop_object_iterator_release(it); 704 return tldict ? true : false; 705 } 706 707 int 708 npf_table_insert(nl_config_t *ncf, nl_table_t *tl) 709 { 710 prop_dictionary_t tldict = tl->ntl_dict; 711 u_int tid; 712 713 if (!prop_dictionary_get_uint32(tldict, "id", &tid)) { 714 return EINVAL; 715 } 716 if (npf_table_exists_p(ncf, tid)) { 717 return EEXIST; 718 } 719 prop_array_add(ncf->ncf_table_list, tldict); 720 return 0; 721 } 722 723 void 724 npf_table_destroy(nl_table_t *tl) 725 { 726 727 prop_object_release(tl->ntl_dict); 728 free(tl); 729 } 730 731 void 732 _npf_table_foreach(nl_config_t *ncf, nl_table_callback_t func) 733 { 734 prop_dictionary_t tldict; 735 prop_object_iterator_t it; 736 737 it = prop_array_iterator(ncf->ncf_table_list); 738 while ((tldict = prop_object_iterator_next(it)) != NULL) { 739 u_int id; 740 int type; 741 742 prop_dictionary_get_uint32(tldict, "id", &id); 743 prop_dictionary_get_int32(tldict, "type", &type); 744 (*func)(id, type); 745 } 746 prop_object_iterator_release(it); 747 } 748 749 /* 750 * MISC. 751 */ 752 753 int 754 npf_update_rule(int fd, const char *rname __unused, nl_rule_t *rl) 755 { 756 prop_dictionary_t rldict = rl->nrl_dict, errdict = NULL; 757 int error; 758 759 error = prop_dictionary_sendrecv_ioctl(rldict, fd, 760 IOC_NPF_UPDATE_RULE, &errdict); 761 if (errdict) { 762 prop_object_release(errdict); 763 } 764 return error; 765 } 766 767 int 768 npf_sessions_recv(int fd, const char *fpath) 769 { 770 prop_dictionary_t sdict; 771 int error; 772 773 error = prop_dictionary_recv_ioctl(fd, IOC_NPF_SESSIONS_SAVE, &sdict); 774 if (error) { 775 return error; 776 } 777 if (!prop_dictionary_externalize_to_file(sdict, fpath)) { 778 error = errno; 779 } 780 prop_object_release(sdict); 781 return error; 782 } 783 784 int 785 npf_sessions_send(int fd, const char *fpath) 786 { 787 prop_dictionary_t sdict; 788 int error; 789 790 if (fpath) { 791 sdict = prop_dictionary_internalize_from_file(fpath); 792 if (sdict == NULL) { 793 return errno; 794 } 795 } else { 796 /* Empty: will flush the sessions. */ 797 prop_array_t selist = prop_array_create(); 798 sdict = prop_dictionary_create(); 799 prop_dictionary_set(sdict, "session-list", selist); 800 prop_object_release(selist); 801 } 802 error = prop_dictionary_send_ioctl(sdict, fd, IOC_NPF_SESSIONS_LOAD); 803 prop_object_release(sdict); 804 return error; 805 } 806 807 static prop_dictionary_t 808 _npf_debug_initonce(nl_config_t *ncf) 809 { 810 if (!ncf->ncf_debug) { 811 prop_array_t iflist = prop_array_create(); 812 ncf->ncf_debug = prop_dictionary_create(); 813 prop_dictionary_set(ncf->ncf_debug, "interfaces", iflist); 814 prop_object_release(iflist); 815 } 816 return ncf->ncf_debug; 817 } 818 819 void 820 _npf_debug_addif(nl_config_t *ncf, struct ifaddrs *ifa, u_int if_idx) 821 { 822 prop_dictionary_t ifdict, dbg = _npf_debug_initonce(ncf); 823 prop_array_t iflist = prop_dictionary_get(dbg, "interfaces"); 824 825 if (_npf_prop_array_lookup(iflist, "name", ifa->ifa_name)) { 826 return; 827 } 828 829 ifdict = prop_dictionary_create(); 830 prop_dictionary_set_cstring(ifdict, "name", ifa->ifa_name); 831 prop_dictionary_set_uint32(ifdict, "flags", ifa->ifa_flags); 832 if (!if_idx) { 833 if_idx = if_nametoindex(ifa->ifa_name); 834 } 835 prop_dictionary_set_uint32(ifdict, "idx", if_idx); 836 837 const struct sockaddr *sa = ifa->ifa_addr; 838 npf_addr_t addr; 839 size_t alen = 0; 840 841 switch (sa ? sa->sa_family : -1) { 842 case AF_INET: { 843 const struct sockaddr_in *sin = (const void *)sa; 844 alen = sizeof(sin->sin_addr); 845 memcpy(&addr, &sin->sin_addr, alen); 846 break; 847 } 848 case AF_INET6: { 849 const struct sockaddr_in6 *sin6 = (const void *)sa; 850 alen = sizeof(sin6->sin6_addr); 851 memcpy(&addr, &sin6->sin6_addr, alen); 852 break; 853 } 854 default: 855 break; 856 } 857 858 if (alen) { 859 prop_data_t addrdata = prop_data_create_data(&addr, alen); 860 prop_dictionary_set(ifdict, "addr", addrdata); 861 prop_object_release(addrdata); 862 } 863 prop_array_add(iflist, ifdict); 864 prop_object_release(ifdict); 865 } 866
Indexes created Fri Oct 17 09:09:57 GMT 2025