npf.c revision 1.7.2.8
1 /* $NetBSD: npf.c,v 1.7.2.8 2013/01/07 16:51:08 riz Exp $ */ 2 3 /*- 4 * Copyright (c) 2010-2012 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 __KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.7.2.8 2013/01/07 16:51:08 riz Exp $"); 34 35 #include <sys/types.h> 36 #include <netinet/in_systm.h> 37 #include <netinet/in.h> 38 #include <net/if.h> 39 #include <prop/proplib.h> 40 41 #include <stdlib.h> 42 #include <string.h> 43 #include <assert.h> 44 #include <errno.h> 45 #include <err.h> 46 47 #define _NPF_PRIVATE 48 #include "npf.h" 49 50 struct nl_config { 51 /* Rules, translations, tables, procedures. */ 52 prop_dictionary_t ncf_dict; 53 prop_array_t ncf_rules_list; 54 prop_array_t ncf_rproc_list; 55 prop_array_t ncf_table_list; 56 prop_array_t ncf_nat_list; 57 /* Priority counters. */ 58 pri_t ncf_rule_pri; 59 pri_t ncf_nat_pri; 60 /* Debug information. */ 61 prop_dictionary_t ncf_debug; 62 /* Error report. */ 63 prop_dictionary_t ncf_err; 64 /* Custom file to externalise property-list. */ 65 const char * ncf_plist; 66 bool ncf_flush; 67 }; 68 69 struct nl_rule { 70 prop_dictionary_t nrl_dict; 71 }; 72 73 struct nl_rproc { 74 prop_dictionary_t nrp_dict; 75 }; 76 77 struct nl_table { 78 prop_dictionary_t ntl_dict; 79 }; 80 81 struct nl_ext { 82 const char * nxt_name; 83 prop_dictionary_t nxt_dict; 84 }; 85 86 /* 87 * CONFIGURATION INTERFACE. 88 */ 89 90 nl_config_t * 91 npf_config_create(void) 92 { 93 nl_config_t *ncf; 94 95 ncf = calloc(1, sizeof(*ncf)); 96 if (ncf == NULL) { 97 return NULL; 98 } 99 ncf->ncf_rules_list = prop_array_create(); 100 ncf->ncf_rproc_list = prop_array_create(); 101 ncf->ncf_table_list = prop_array_create(); 102 ncf->ncf_nat_list = prop_array_create(); 103 104 ncf->ncf_rule_pri = 1; 105 ncf->ncf_nat_pri = 1; 106 107 ncf->ncf_plist = NULL; 108 ncf->ncf_flush = false; 109 110 return ncf; 111 } 112 113 int 114 npf_config_submit(nl_config_t *ncf, int fd) 115 { 116 const char *plist = ncf->ncf_plist; 117 prop_dictionary_t npf_dict; 118 int error = 0; 119 120 npf_dict = prop_dictionary_create(); 121 if (npf_dict == NULL) { 122 return ENOMEM; 123 } 124 prop_dictionary_set_uint32(npf_dict, "version", NPF_VERSION); 125 prop_dictionary_set(npf_dict, "rules", ncf->ncf_rules_list); 126 prop_dictionary_set(npf_dict, "rprocs", ncf->ncf_rproc_list); 127 prop_dictionary_set(npf_dict, "tables", ncf->ncf_table_list); 128 prop_dictionary_set(npf_dict, "translation", ncf->ncf_nat_list); 129 prop_dictionary_set_bool(npf_dict, "flush", ncf->ncf_flush); 130 if (ncf->ncf_debug) { 131 prop_dictionary_set(npf_dict, "debug", ncf->ncf_debug); 132 } 133 134 if (plist) { 135 if (!prop_dictionary_externalize_to_file(npf_dict, plist)) { 136 error = errno; 137 } 138 prop_object_release(npf_dict); 139 return error; 140 } 141 142 error = prop_dictionary_sendrecv_ioctl(npf_dict, fd, 143 IOC_NPF_RELOAD, &ncf->ncf_err); 144 if (error) { 145 prop_object_release(npf_dict); 146 assert(ncf->ncf_err == NULL); 147 return error; 148 } 149 150 prop_dictionary_get_int32(ncf->ncf_err, "errno", &error); 151 prop_object_release(npf_dict); 152 return error; 153 } 154 155 nl_config_t * 156 npf_config_retrieve(int fd, bool *active, bool *loaded) 157 { 158 prop_dictionary_t npf_dict; 159 nl_config_t *ncf; 160 int error; 161 162 error = prop_dictionary_recv_ioctl(fd, IOC_NPF_GETCONF, &npf_dict); 163 if (error) { 164 return NULL; 165 } 166 ncf = calloc(1, sizeof(*ncf)); 167 if (ncf == NULL) { 168 prop_object_release(npf_dict); 169 return NULL; 170 } 171 ncf->ncf_dict = npf_dict; 172 ncf->ncf_rules_list = prop_dictionary_get(npf_dict, "rules"); 173 ncf->ncf_rproc_list = prop_dictionary_get(npf_dict, "rprocs"); 174 ncf->ncf_table_list = prop_dictionary_get(npf_dict, "tables"); 175 ncf->ncf_nat_list = prop_dictionary_get(npf_dict, "translation"); 176 177 prop_dictionary_get_bool(npf_dict, "active", active); 178 *loaded = (ncf->ncf_rules_list != NULL); 179 return ncf; 180 } 181 182 int 183 npf_config_flush(int fd) 184 { 185 nl_config_t *ncf; 186 int error; 187 188 ncf = npf_config_create(); 189 if (ncf == NULL) { 190 return ENOMEM; 191 } 192 ncf->ncf_flush = true; 193 error = npf_config_submit(ncf, fd); 194 npf_config_destroy(ncf); 195 return error; 196 } 197 198 void 199 _npf_config_error(nl_config_t *ncf, nl_error_t *ne) 200 { 201 memset(ne, 0, sizeof(*ne)); 202 prop_dictionary_get_int32(ncf->ncf_err, "id", &ne->ne_id); 203 prop_dictionary_get_cstring(ncf->ncf_err, 204 "source-file", &ne->ne_source_file); 205 prop_dictionary_get_uint32(ncf->ncf_err, 206 "source-line", &ne->ne_source_line); 207 prop_dictionary_get_int32(ncf->ncf_err, 208 "ncode-error", &ne->ne_ncode_error); 209 prop_dictionary_get_int32(ncf->ncf_err, 210 "ncode-errat", &ne->ne_ncode_errat); 211 } 212 213 void 214 npf_config_destroy(nl_config_t *ncf) 215 { 216 217 if (!ncf->ncf_dict) { 218 prop_object_release(ncf->ncf_rules_list); 219 prop_object_release(ncf->ncf_rproc_list); 220 prop_object_release(ncf->ncf_table_list); 221 prop_object_release(ncf->ncf_nat_list); 222 } 223 if (ncf->ncf_err) { 224 prop_object_release(ncf->ncf_err); 225 } 226 if (ncf->ncf_debug) { 227 prop_object_release(ncf->ncf_debug); 228 } 229 free(ncf); 230 } 231 232 void 233 _npf_config_setsubmit(nl_config_t *ncf, const char *plist_file) 234 { 235 236 ncf->ncf_plist = plist_file; 237 } 238 239 static bool 240 _npf_prop_array_lookup(prop_array_t array, const char *key, const char *name) 241 { 242 prop_dictionary_t dict; 243 prop_object_iterator_t it; 244 245 it = prop_array_iterator(array); 246 while ((dict = prop_object_iterator_next(it)) != NULL) { 247 const char *lname; 248 prop_dictionary_get_cstring_nocopy(dict, key, &lname); 249 if (strcmp(name, lname) == 0) 250 break; 251 } 252 prop_object_iterator_release(it); 253 return dict ? true : false; 254 } 255 256 /* 257 * NPF EXTENSION INTERFACE. 258 */ 259 260 nl_ext_t * 261 npf_ext_construct(const char *name) 262 { 263 nl_ext_t *ext; 264 265 ext = malloc(sizeof(*ext)); 266 if (ext == NULL) { 267 return NULL; 268 } 269 ext->nxt_name = strdup(name); 270 if (ext->nxt_name == NULL) { 271 free(ext); 272 return NULL; 273 } 274 ext->nxt_dict = prop_dictionary_create(); 275 276 return ext; 277 } 278 279 void 280 npf_ext_param_u32(nl_ext_t *ext, const char *key, uint32_t val) 281 { 282 prop_dictionary_t extdict = ext->nxt_dict; 283 prop_dictionary_set_uint32(extdict, key, val); 284 } 285 286 void 287 npf_ext_param_bool(nl_ext_t *ext, const char *key, bool val) 288 { 289 prop_dictionary_t extdict = ext->nxt_dict; 290 prop_dictionary_set_bool(extdict, key, val); 291 } 292 293 /* 294 * RULE INTERFACE. 295 */ 296 297 nl_rule_t * 298 npf_rule_create(const char *name, uint32_t attr, u_int if_idx) 299 { 300 prop_dictionary_t rldict; 301 nl_rule_t *rl; 302 303 rl = malloc(sizeof(*rl)); 304 if (rl == NULL) { 305 return NULL; 306 } 307 rldict = prop_dictionary_create(); 308 if (rldict == NULL) { 309 free(rl); 310 return NULL; 311 } 312 if (name) { 313 prop_dictionary_set_cstring(rldict, "name", name); 314 } 315 prop_dictionary_set_uint32(rldict, "attributes", attr); 316 317 if (if_idx) { 318 prop_dictionary_set_uint32(rldict, "interface", if_idx); 319 } 320 rl->nrl_dict = rldict; 321 return rl; 322 } 323 324 int 325 npf_rule_setcode(nl_rule_t *rl, int type, const void *code, size_t sz) 326 { 327 prop_dictionary_t rldict = rl->nrl_dict; 328 prop_data_t cdata; 329 330 if (type != NPF_CODE_NCODE) { 331 return ENOTSUP; 332 } 333 cdata = prop_data_create_data(code, sz); 334 if (cdata == NULL) { 335 return ENOMEM; 336 } 337 prop_dictionary_set(rldict, "ncode", cdata); 338 prop_object_release(cdata); 339 return 0; 340 } 341 342 int 343 npf_rule_setproc(nl_config_t *ncf, nl_rule_t *rl, const char *name) 344 { 345 prop_dictionary_t rldict = rl->nrl_dict; 346 347 if (!npf_rproc_exists_p(ncf, name)) { 348 return ENOENT; 349 } 350 prop_dictionary_set_cstring(rldict, "rproc", name); 351 return 0; 352 } 353 354 bool 355 npf_rule_exists_p(nl_config_t *ncf, const char *name) 356 { 357 358 return _npf_prop_array_lookup(ncf->ncf_rules_list, "name", name); 359 } 360 361 int 362 npf_rule_insert(nl_config_t *ncf, nl_rule_t *parent, nl_rule_t *rl, pri_t pri) 363 { 364 prop_dictionary_t rldict = rl->nrl_dict; 365 prop_array_t rlset; 366 367 if (pri == NPF_PRI_NEXT) { 368 pri = ncf->ncf_rule_pri++; 369 } else if (ncf) { 370 ncf->ncf_rule_pri = pri + 1; 371 } 372 prop_dictionary_set_int32(rldict, "priority", pri); 373 374 if (parent) { 375 prop_dictionary_t pdict = parent->nrl_dict; 376 rlset = prop_dictionary_get(pdict, "subrules"); 377 if (rlset == NULL) { 378 rlset = prop_array_create(); 379 prop_dictionary_set(pdict, "subrules", rlset); 380 prop_object_release(rlset); 381 } 382 } else { 383 rlset = ncf->ncf_rules_list; 384 } 385 prop_array_add(rlset, rldict); 386 return 0; 387 } 388 389 static int 390 _npf_rule_foreach1(prop_array_t rules, unsigned nlevel, nl_rule_callback_t func) 391 { 392 prop_dictionary_t rldict; 393 prop_object_iterator_t it; 394 395 if (!rules || prop_object_type(rules) != PROP_TYPE_ARRAY) { 396 return ENOENT; 397 } 398 it = prop_array_iterator(rules); 399 if (it == NULL) { 400 return ENOMEM; 401 } 402 while ((rldict = prop_object_iterator_next(it)) != NULL) { 403 prop_array_t subrules; 404 nl_rule_t nrl; 405 406 nrl.nrl_dict = rldict; 407 (*func)(&nrl, nlevel); 408 409 subrules = prop_dictionary_get(rldict, "subrules"); 410 if (!subrules) { 411 continue; 412 } 413 (void)_npf_rule_foreach1(subrules, nlevel + 1, func); 414 prop_object_release(subrules); 415 } 416 prop_object_iterator_release(it); 417 return 0; 418 } 419 420 int 421 _npf_rule_foreach(nl_config_t *ncf, nl_rule_callback_t func) 422 { 423 424 return _npf_rule_foreach1(ncf->ncf_rules_list, 0, func); 425 } 426 427 pri_t 428 _npf_rule_getinfo(nl_rule_t *nrl, const char **rname, uint32_t *attr, 429 u_int *if_idx) 430 { 431 prop_dictionary_t rldict = nrl->nrl_dict; 432 pri_t prio; 433 434 prop_dictionary_get_cstring_nocopy(rldict, "name", rname); 435 prop_dictionary_get_uint32(rldict, "attributes", attr); 436 prop_dictionary_get_int32(rldict, "priority", &prio); 437 prop_dictionary_get_uint32(rldict, "interface", if_idx); 438 return prio; 439 } 440 441 const void * 442 _npf_rule_ncode(nl_rule_t *nrl, size_t *size) 443 { 444 prop_dictionary_t rldict = nrl->nrl_dict; 445 prop_object_t obj = prop_dictionary_get(rldict, "ncode"); 446 *size = prop_data_size(obj); 447 return prop_data_data_nocopy(obj); 448 } 449 450 const char * 451 _npf_rule_rproc(nl_rule_t *nrl) 452 { 453 prop_dictionary_t rldict = nrl->nrl_dict; 454 const char *rpname = NULL; 455 456 prop_dictionary_get_cstring_nocopy(rldict, "rproc", &rpname); 457 return rpname; 458 } 459 460 void 461 npf_rule_destroy(nl_rule_t *rl) 462 { 463 464 prop_object_release(rl->nrl_dict); 465 free(rl); 466 } 467 468 /* 469 * RULE PROCEDURE INTERFACE. 470 */ 471 472 nl_rproc_t * 473 npf_rproc_create(const char *name) 474 { 475 prop_dictionary_t rpdict; 476 prop_array_t extcalls; 477 nl_rproc_t *nrp; 478 479 nrp = malloc(sizeof(nl_rproc_t)); 480 if (nrp == NULL) { 481 return NULL; 482 } 483 rpdict = prop_dictionary_create(); 484 if (rpdict == NULL) { 485 free(nrp); 486 return NULL; 487 } 488 prop_dictionary_set_cstring(rpdict, "name", name); 489 490 extcalls = prop_array_create(); 491 if (extcalls == NULL) { 492 prop_object_release(rpdict); 493 free(nrp); 494 return NULL; 495 } 496 prop_dictionary_set(rpdict, "extcalls", extcalls); 497 prop_object_release(extcalls); 498 499 nrp->nrp_dict = rpdict; 500 return nrp; 501 } 502 503 int 504 npf_rproc_extcall(nl_rproc_t *rp, nl_ext_t *ext) 505 { 506 prop_dictionary_t rpdict = rp->nrp_dict; 507 prop_dictionary_t extdict = ext->nxt_dict; 508 prop_array_t extcalls; 509 510 extcalls = prop_dictionary_get(rpdict, "extcalls"); 511 if (_npf_prop_array_lookup(extcalls, "name", ext->nxt_name)) { 512 return EEXIST; 513 } 514 prop_dictionary_set_cstring(extdict, "name", ext->nxt_name); 515 prop_array_add(extcalls, extdict); 516 return 0; 517 } 518 519 bool 520 npf_rproc_exists_p(nl_config_t *ncf, const char *name) 521 { 522 523 return _npf_prop_array_lookup(ncf->ncf_rproc_list, "name", name); 524 } 525 526 int 527 npf_rproc_insert(nl_config_t *ncf, nl_rproc_t *rp) 528 { 529 prop_dictionary_t rpdict = rp->nrp_dict; 530 const char *name; 531 532 if (!prop_dictionary_get_cstring_nocopy(rpdict, "name", &name)) { 533 return EINVAL; 534 } 535 if (npf_rproc_exists_p(ncf, name)) { 536 return EEXIST; 537 } 538 prop_array_add(ncf->ncf_rproc_list, rpdict); 539 return 0; 540 } 541 542 /* 543 * TRANSLATION INTERFACE. 544 */ 545 546 nl_nat_t * 547 npf_nat_create(int type, u_int flags, u_int if_idx, 548 npf_addr_t *addr, int af, in_port_t port) 549 { 550 nl_rule_t *rl; 551 prop_dictionary_t rldict; 552 prop_data_t addrdat; 553 uint32_t attr; 554 size_t sz; 555 556 if (af == AF_INET) { 557 sz = sizeof(struct in_addr); 558 } else if (af == AF_INET6) { 559 sz = sizeof(struct in6_addr); 560 } else { 561 return NULL; 562 } 563 564 attr = NPF_RULE_PASS | NPF_RULE_FINAL | 565 (type == NPF_NATOUT ? NPF_RULE_OUT : NPF_RULE_IN); 566 567 /* Create a rule for NAT policy. Next, will add translation data. */ 568 rl = npf_rule_create(NULL, attr, if_idx); 569 if (rl == NULL) { 570 return NULL; 571 } 572 rldict = rl->nrl_dict; 573 574 /* Translation type and flags. */ 575 prop_dictionary_set_int32(rldict, "type", type); 576 prop_dictionary_set_uint32(rldict, "flags", flags); 577 578 /* Translation IP. */ 579 addrdat = prop_data_create_data(addr, sz); 580 if (addrdat == NULL) { 581 npf_rule_destroy(rl); 582 return NULL; 583 } 584 prop_dictionary_set(rldict, "translation-ip", addrdat); 585 prop_object_release(addrdat); 586 587 /* Translation port (for redirect case). */ 588 prop_dictionary_set_uint16(rldict, "translation-port", port); 589 590 return (nl_nat_t *)rl; 591 } 592 593 int 594 npf_nat_insert(nl_config_t *ncf, nl_nat_t *nt, pri_t pri) 595 { 596 prop_dictionary_t rldict = nt->nrl_dict; 597 598 if (pri == NPF_PRI_NEXT) { 599 pri = ncf->ncf_nat_pri++; 600 } else { 601 ncf->ncf_nat_pri = pri + 1; 602 } 603 prop_dictionary_set_int32(rldict, "priority", pri); 604 prop_array_add(ncf->ncf_nat_list, rldict); 605 return 0; 606 } 607 608 int 609 _npf_nat_foreach(nl_config_t *ncf, nl_rule_callback_t func) 610 { 611 612 return _npf_rule_foreach1(ncf->ncf_nat_list, 0, func); 613 } 614 615 void 616 _npf_nat_getinfo(nl_nat_t *nt, int *type, u_int *flags, npf_addr_t *addr, 617 size_t *alen, in_port_t *port) 618 { 619 prop_dictionary_t rldict = nt->nrl_dict; 620 621 prop_dictionary_get_int32(rldict, "type", type); 622 prop_dictionary_get_uint32(rldict, "flags", flags); 623 624 prop_object_t obj = prop_dictionary_get(rldict, "translation-ip"); 625 *alen = prop_data_size(obj); 626 memcpy(addr, prop_data_data_nocopy(obj), *alen); 627 628 prop_dictionary_get_uint16(rldict, "translation-port", port); 629 } 630 631 /* 632 * TABLE INTERFACE. 633 */ 634 635 nl_table_t * 636 npf_table_create(u_int id, int type) 637 { 638 prop_dictionary_t tldict; 639 prop_array_t tblents; 640 nl_table_t *tl; 641 642 tl = malloc(sizeof(*tl)); 643 if (tl == NULL) { 644 return NULL; 645 } 646 tldict = prop_dictionary_create(); 647 if (tldict == NULL) { 648 free(tl); 649 return NULL; 650 } 651 prop_dictionary_set_uint32(tldict, "id", id); 652 prop_dictionary_set_int32(tldict, "type", type); 653 654 tblents = prop_array_create(); 655 if (tblents == NULL) { 656 prop_object_release(tldict); 657 free(tl); 658 return NULL; 659 } 660 prop_dictionary_set(tldict, "entries", tblents); 661 prop_object_release(tblents); 662 663 tl->ntl_dict = tldict; 664 return tl; 665 } 666 667 int 668 npf_table_add_entry(nl_table_t *tl, int af, const npf_addr_t *addr, 669 const npf_netmask_t mask) 670 { 671 prop_dictionary_t tldict = tl->ntl_dict, entdict; 672 prop_array_t tblents; 673 prop_data_t addrdata; 674 unsigned alen; 675 676 /* Create the table entry. */ 677 entdict = prop_dictionary_create(); 678 if (entdict == NULL) { 679 return ENOMEM; 680 } 681 682 switch (af) { 683 case AF_INET: 684 alen = sizeof(struct in_addr); 685 break; 686 case AF_INET6: 687 alen = sizeof(struct in6_addr); 688 break; 689 default: 690 return EINVAL; 691 } 692 693 addrdata = prop_data_create_data(addr, alen); 694 prop_dictionary_set(entdict, "addr", addrdata); 695 prop_dictionary_set_uint8(entdict, "mask", mask); 696 prop_object_release(addrdata); 697 698 tblents = prop_dictionary_get(tldict, "entries"); 699 prop_array_add(tblents, entdict); 700 prop_object_release(entdict); 701 return 0; 702 } 703 704 bool 705 npf_table_exists_p(nl_config_t *ncf, u_int tid) 706 { 707 prop_dictionary_t tldict; 708 prop_object_iterator_t it; 709 710 it = prop_array_iterator(ncf->ncf_table_list); 711 while ((tldict = prop_object_iterator_next(it)) != NULL) { 712 u_int i; 713 if (prop_dictionary_get_uint32(tldict, "id", &i) && tid == i) 714 break; 715 } 716 prop_object_iterator_release(it); 717 return tldict ? true : false; 718 } 719 720 int 721 npf_table_insert(nl_config_t *ncf, nl_table_t *tl) 722 { 723 prop_dictionary_t tldict = tl->ntl_dict; 724 u_int tid; 725 726 if (!prop_dictionary_get_uint32(tldict, "id", &tid)) { 727 return EINVAL; 728 } 729 if (npf_table_exists_p(ncf, tid)) { 730 return EEXIST; 731 } 732 prop_array_add(ncf->ncf_table_list, tldict); 733 return 0; 734 } 735 736 void 737 npf_table_destroy(nl_table_t *tl) 738 { 739 740 prop_object_release(tl->ntl_dict); 741 free(tl); 742 } 743 744 void 745 _npf_table_foreach(nl_config_t *ncf, nl_table_callback_t func) 746 { 747 prop_dictionary_t tldict; 748 prop_object_iterator_t it; 749 750 it = prop_array_iterator(ncf->ncf_table_list); 751 while ((tldict = prop_object_iterator_next(it)) != NULL) { 752 u_int id; 753 int type; 754 755 prop_dictionary_get_uint32(tldict, "id", &id); 756 prop_dictionary_get_int32(tldict, "type", &type); 757 (*func)(id, type); 758 } 759 prop_object_iterator_release(it); 760 } 761 762 /* 763 * MISC. 764 */ 765 766 int 767 npf_update_rule(int fd, const char *rname __unused, nl_rule_t *rl) 768 { 769 prop_dictionary_t rldict = rl->nrl_dict, errdict = NULL; 770 int error; 771 772 error = prop_dictionary_sendrecv_ioctl(rldict, fd, 773 IOC_NPF_UPDATE_RULE, &errdict); 774 if (errdict) { 775 prop_object_release(errdict); 776 } 777 return error; 778 } 779 780 int 781 npf_sessions_recv(int fd, const char *fpath) 782 { 783 prop_dictionary_t sdict; 784 int error; 785 786 error = prop_dictionary_recv_ioctl(fd, IOC_NPF_SESSIONS_SAVE, &sdict); 787 if (error) { 788 return error; 789 } 790 if (!prop_dictionary_externalize_to_file(sdict, fpath)) { 791 error = errno; 792 } 793 prop_object_release(sdict); 794 return error; 795 } 796 797 int 798 npf_sessions_send(int fd, const char *fpath) 799 { 800 prop_dictionary_t sdict; 801 int error; 802 803 if (fpath) { 804 sdict = prop_dictionary_internalize_from_file(fpath); 805 if (sdict == NULL) { 806 return errno; 807 } 808 } else { 809 /* Empty: will flush the sessions. */ 810 prop_array_t selist = prop_array_create(); 811 sdict = prop_dictionary_create(); 812 prop_dictionary_set(sdict, "session-list", selist); 813 prop_object_release(selist); 814 } 815 error = prop_dictionary_send_ioctl(sdict, fd, IOC_NPF_SESSIONS_LOAD); 816 prop_object_release(sdict); 817 return error; 818 } 819 820 static prop_dictionary_t 821 _npf_debug_initonce(nl_config_t *ncf) 822 { 823 if (!ncf->ncf_debug) { 824 prop_array_t iflist = prop_array_create(); 825 ncf->ncf_debug = prop_dictionary_create(); 826 prop_dictionary_set(ncf->ncf_debug, "interfaces", iflist); 827 prop_object_release(iflist); 828 } 829 return ncf->ncf_debug; 830 } 831 832 void 833 _npf_debug_addif(nl_config_t *ncf, struct ifaddrs *ifa, u_int if_idx) 834 { 835 prop_dictionary_t ifdict, dbg = _npf_debug_initonce(ncf); 836 prop_array_t iflist = prop_dictionary_get(dbg, "interfaces"); 837 838 if (_npf_prop_array_lookup(iflist, "name", ifa->ifa_name)) { 839 return; 840 } 841 842 ifdict = prop_dictionary_create(); 843 prop_dictionary_set_cstring(ifdict, "name", ifa->ifa_name); 844 prop_dictionary_set_uint32(ifdict, "flags", ifa->ifa_flags); 845 if (!if_idx) { 846 if_idx = if_nametoindex(ifa->ifa_name); 847 } 848 prop_dictionary_set_uint32(ifdict, "idx", if_idx); 849 850 const struct sockaddr *sa = ifa->ifa_addr; 851 npf_addr_t addr; 852 size_t alen = 0; 853 854 switch (sa ? sa->sa_family : -1) { 855 case AF_INET: { 856 const struct sockaddr_in *sin = (const void *)sa; 857 alen = sizeof(sin->sin_addr); 858 memcpy(&addr, &sin->sin_addr, alen); 859 break; 860 } 861 case AF_INET6: { 862 const struct sockaddr_in6 *sin6 = (const void *)sa; 863 alen = sizeof(sin6->sin6_addr); 864 memcpy(&addr, &sin6->sin6_addr, alen); 865 break; 866 } 867 default: 868 break; 869 } 870 871 if (alen) { 872 prop_data_t addrdata = prop_data_create_data(&addr, alen); 873 prop_dictionary_set(ifdict, "addr", addrdata); 874 prop_object_release(addrdata); 875 } 876 prop_array_add(iflist, ifdict); 877 prop_object_release(ifdict); 878 } 879
Indexes created Sun Oct 19 02:09:48 GMT 2025