npf.c revision 1.7.2.9
1 /* $NetBSD: npf.c,v 1.7.2.9 2013/02/11 21:49:48 riz Exp $ */ 2 3 /*- 4 * Copyright (c) 2010-2013 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 __KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.7.2.9 2013/02/11 21:49:48 riz Exp $"); 34 35 #include <sys/types.h> 36 #include <netinet/in_systm.h> 37 #include <netinet/in.h> 38 #include <net/if.h> 39 #include <prop/proplib.h> 40 41 #include <stdlib.h> 42 #include <string.h> 43 #include <assert.h> 44 #include <errno.h> 45 #include <err.h> 46 47 #define _NPF_PRIVATE 48 #include "npf.h" 49 50 struct nl_config { 51 /* Rules, translations, tables, procedures. */ 52 prop_dictionary_t ncf_dict; 53 prop_array_t ncf_rules_list; 54 prop_array_t ncf_rproc_list; 55 prop_array_t ncf_table_list; 56 prop_array_t ncf_nat_list; 57 /* Debug information. */ 58 prop_dictionary_t ncf_debug; 59 /* Error report. */ 60 prop_dictionary_t ncf_err; 61 /* Custom file to externalise property-list. */ 62 const char * ncf_plist; 63 bool ncf_flush; 64 }; 65 66 struct nl_rule { 67 prop_dictionary_t nrl_dict; 68 }; 69 70 struct nl_rproc { 71 prop_dictionary_t nrp_dict; 72 }; 73 74 struct nl_table { 75 prop_dictionary_t ntl_dict; 76 }; 77 78 struct nl_ext { 79 const char * nxt_name; 80 prop_dictionary_t nxt_dict; 81 }; 82 83 static prop_array_t _npf_ruleset_transform(prop_array_t); 84 85 /* 86 * CONFIGURATION INTERFACE. 87 */ 88 89 nl_config_t * 90 npf_config_create(void) 91 { 92 nl_config_t *ncf; 93 94 ncf = calloc(1, sizeof(*ncf)); 95 if (ncf == NULL) { 96 return NULL; 97 } 98 ncf->ncf_rules_list = prop_array_create(); 99 ncf->ncf_rproc_list = prop_array_create(); 100 ncf->ncf_table_list = prop_array_create(); 101 ncf->ncf_nat_list = prop_array_create(); 102 103 ncf->ncf_plist = NULL; 104 ncf->ncf_flush = false; 105 106 return ncf; 107 } 108 109 int 110 npf_config_submit(nl_config_t *ncf, int fd) 111 { 112 const char *plist = ncf->ncf_plist; 113 prop_dictionary_t npf_dict; 114 prop_array_t rlset; 115 int error = 0; 116 117 npf_dict = prop_dictionary_create(); 118 if (npf_dict == NULL) { 119 return ENOMEM; 120 } 121 prop_dictionary_set_uint32(npf_dict, "version", NPF_VERSION); 122 123 rlset = _npf_ruleset_transform(ncf->ncf_rules_list); 124 if (rlset == NULL) { 125 prop_object_release(npf_dict); 126 return ENOMEM; 127 } 128 prop_dictionary_set(npf_dict, "rules", rlset); 129 prop_object_release(rlset); 130 131 prop_dictionary_set(npf_dict, "rprocs", ncf->ncf_rproc_list); 132 prop_dictionary_set(npf_dict, "tables", ncf->ncf_table_list); 133 prop_dictionary_set(npf_dict, "translation", ncf->ncf_nat_list); 134 prop_dictionary_set_bool(npf_dict, "flush", ncf->ncf_flush); 135 if (ncf->ncf_debug) { 136 prop_dictionary_set(npf_dict, "debug", ncf->ncf_debug); 137 } 138 139 if (plist) { 140 if (!prop_dictionary_externalize_to_file(npf_dict, plist)) { 141 error = errno; 142 } 143 prop_object_release(npf_dict); 144 return error; 145 } 146 147 error = prop_dictionary_sendrecv_ioctl(npf_dict, fd, 148 IOC_NPF_RELOAD, &ncf->ncf_err); 149 if (error) { 150 prop_object_release(npf_dict); 151 assert(ncf->ncf_err == NULL); 152 return error; 153 } 154 155 prop_dictionary_get_int32(ncf->ncf_err, "errno", &error); 156 prop_object_release(npf_dict); 157 return error; 158 } 159 160 nl_config_t * 161 npf_config_retrieve(int fd, bool *active, bool *loaded) 162 { 163 prop_dictionary_t npf_dict; 164 nl_config_t *ncf; 165 int error; 166 167 error = prop_dictionary_recv_ioctl(fd, IOC_NPF_GETCONF, &npf_dict); 168 if (error) { 169 return NULL; 170 } 171 ncf = calloc(1, sizeof(*ncf)); 172 if (ncf == NULL) { 173 prop_object_release(npf_dict); 174 return NULL; 175 } 176 ncf->ncf_dict = npf_dict; 177 ncf->ncf_rules_list = prop_dictionary_get(npf_dict, "rules"); 178 ncf->ncf_rproc_list = prop_dictionary_get(npf_dict, "rprocs"); 179 ncf->ncf_table_list = prop_dictionary_get(npf_dict, "tables"); 180 ncf->ncf_nat_list = prop_dictionary_get(npf_dict, "translation"); 181 182 prop_dictionary_get_bool(npf_dict, "active", active); 183 *loaded = (ncf->ncf_rules_list != NULL); 184 return ncf; 185 } 186 187 int 188 npf_config_flush(int fd) 189 { 190 nl_config_t *ncf; 191 int error; 192 193 ncf = npf_config_create(); 194 if (ncf == NULL) { 195 return ENOMEM; 196 } 197 ncf->ncf_flush = true; 198 error = npf_config_submit(ncf, fd); 199 npf_config_destroy(ncf); 200 return error; 201 } 202 203 void 204 _npf_config_error(nl_config_t *ncf, nl_error_t *ne) 205 { 206 memset(ne, 0, sizeof(*ne)); 207 prop_dictionary_get_int32(ncf->ncf_err, "id", &ne->ne_id); 208 prop_dictionary_get_cstring(ncf->ncf_err, 209 "source-file", &ne->ne_source_file); 210 prop_dictionary_get_uint32(ncf->ncf_err, 211 "source-line", &ne->ne_source_line); 212 prop_dictionary_get_int32(ncf->ncf_err, 213 "code-error", &ne->ne_ncode_error); 214 prop_dictionary_get_int32(ncf->ncf_err, 215 "code-errat", &ne->ne_ncode_errat); 216 } 217 218 void 219 npf_config_destroy(nl_config_t *ncf) 220 { 221 222 if (!ncf->ncf_dict) { 223 prop_object_release(ncf->ncf_rules_list); 224 prop_object_release(ncf->ncf_rproc_list); 225 prop_object_release(ncf->ncf_table_list); 226 prop_object_release(ncf->ncf_nat_list); 227 } 228 if (ncf->ncf_err) { 229 prop_object_release(ncf->ncf_err); 230 } 231 if (ncf->ncf_debug) { 232 prop_object_release(ncf->ncf_debug); 233 } 234 free(ncf); 235 } 236 237 void 238 _npf_config_setsubmit(nl_config_t *ncf, const char *plist_file) 239 { 240 241 ncf->ncf_plist = plist_file; 242 } 243 244 static bool 245 _npf_prop_array_lookup(prop_array_t array, const char *key, const char *name) 246 { 247 prop_dictionary_t dict; 248 prop_object_iterator_t it; 249 250 it = prop_array_iterator(array); 251 while ((dict = prop_object_iterator_next(it)) != NULL) { 252 const char *lname; 253 prop_dictionary_get_cstring_nocopy(dict, key, &lname); 254 if (strcmp(name, lname) == 0) 255 break; 256 } 257 prop_object_iterator_release(it); 258 return dict ? true : false; 259 } 260 261 /* 262 * DYNAMIC RULESET INTERFACE. 263 */ 264 265 int 266 npf_ruleset_add(int fd, const char *rname, nl_rule_t *rl, uintptr_t *id) 267 { 268 prop_dictionary_t rldict = rl->nrl_dict; 269 prop_dictionary_t ret; 270 uint64_t id64; 271 int error; 272 273 prop_dictionary_set_cstring(rldict, "ruleset-name", rname); 274 prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_ADD); 275 error = prop_dictionary_sendrecv_ioctl(rldict, fd, IOC_NPF_RULE, &ret); 276 if (!error) { 277 prop_dictionary_get_uint64(ret, "id", &id64); 278 *id = (uintptr_t)id64; 279 } 280 return error; 281 } 282 283 int 284 npf_ruleset_remove(int fd, const char *rname, uintptr_t id) 285 { 286 prop_dictionary_t rldict; 287 288 rldict = prop_dictionary_create(); 289 if (rldict == NULL) { 290 return ENOMEM; 291 } 292 prop_dictionary_set_cstring(rldict, "ruleset-name", rname); 293 prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_REMOVE); 294 __CTASSERT(sizeof(uintptr_t) <= sizeof(uint64_t)); 295 prop_dictionary_set_uint64(rldict, "id", (uint64_t)id); 296 return prop_dictionary_send_ioctl(rldict, fd, IOC_NPF_RULE); 297 } 298 299 int 300 npf_ruleset_remkey(int fd, const char *rname, const void *key, size_t len) 301 { 302 prop_dictionary_t rldict; 303 prop_data_t keyobj; 304 305 rldict = prop_dictionary_create(); 306 if (rldict == NULL) { 307 return ENOMEM; 308 } 309 prop_dictionary_set_cstring(rldict, "ruleset-name", rname); 310 prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_REMKEY); 311 312 keyobj = prop_data_create_data(key, len); 313 if (keyobj == NULL) { 314 prop_object_release(rldict); 315 return ENOMEM; 316 } 317 prop_dictionary_set(rldict, "key", keyobj); 318 prop_object_release(keyobj); 319 320 return prop_dictionary_send_ioctl(rldict, fd, IOC_NPF_RULE); 321 } 322 323 int 324 npf_ruleset_flush(int fd, const char *rname) 325 { 326 prop_dictionary_t rldict; 327 328 rldict = prop_dictionary_create(); 329 if (rldict == NULL) { 330 return ENOMEM; 331 } 332 prop_dictionary_set_cstring(rldict, "ruleset-name", rname); 333 prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_FLUSH); 334 return prop_dictionary_send_ioctl(rldict, fd, IOC_NPF_RULE); 335 } 336 337 /* 338 * _npf_ruleset_transform: transform the ruleset representing nested 339 * rules with lists into an array. 340 */ 341 342 static void 343 _npf_ruleset_transform1(prop_array_t rlset, prop_array_t rules) 344 { 345 prop_object_iterator_t it; 346 prop_dictionary_t rldict; 347 prop_array_t subrlset; 348 349 it = prop_array_iterator(rules); 350 while ((rldict = prop_object_iterator_next(it)) != NULL) { 351 unsigned idx; 352 353 /* Add rules to the array (reference is retained). */ 354 prop_array_add(rlset, rldict); 355 356 subrlset = prop_dictionary_get(rldict, "subrules"); 357 if (subrlset) { 358 /* Process subrules recursively. */ 359 _npf_ruleset_transform1(rlset, subrlset); 360 /* Add the skip-to position. */ 361 idx = prop_array_count(rlset); 362 prop_dictionary_set_uint32(rldict, "skip-to", idx); 363 prop_dictionary_remove(rldict, "subrules"); 364 } 365 } 366 prop_object_iterator_release(it); 367 } 368 369 static prop_array_t 370 _npf_ruleset_transform(prop_array_t rlset) 371 { 372 prop_array_t nrlset; 373 374 nrlset = prop_array_create(); 375 _npf_ruleset_transform1(nrlset, rlset); 376 return nrlset; 377 } 378 379 /* 380 * NPF EXTENSION INTERFACE. 381 */ 382 383 nl_ext_t * 384 npf_ext_construct(const char *name) 385 { 386 nl_ext_t *ext; 387 388 ext = malloc(sizeof(*ext)); 389 if (ext == NULL) { 390 return NULL; 391 } 392 ext->nxt_name = strdup(name); 393 if (ext->nxt_name == NULL) { 394 free(ext); 395 return NULL; 396 } 397 ext->nxt_dict = prop_dictionary_create(); 398 399 return ext; 400 } 401 402 void 403 npf_ext_param_u32(nl_ext_t *ext, const char *key, uint32_t val) 404 { 405 prop_dictionary_t extdict = ext->nxt_dict; 406 prop_dictionary_set_uint32(extdict, key, val); 407 } 408 409 void 410 npf_ext_param_bool(nl_ext_t *ext, const char *key, bool val) 411 { 412 prop_dictionary_t extdict = ext->nxt_dict; 413 prop_dictionary_set_bool(extdict, key, val); 414 } 415 416 /* 417 * RULE INTERFACE. 418 */ 419 420 nl_rule_t * 421 npf_rule_create(const char *name, uint32_t attr, u_int if_idx) 422 { 423 prop_dictionary_t rldict; 424 nl_rule_t *rl; 425 426 rl = malloc(sizeof(*rl)); 427 if (rl == NULL) { 428 return NULL; 429 } 430 rldict = prop_dictionary_create(); 431 if (rldict == NULL) { 432 free(rl); 433 return NULL; 434 } 435 if (name) { 436 prop_dictionary_set_cstring(rldict, "name", name); 437 } 438 prop_dictionary_set_uint32(rldict, "attributes", attr); 439 440 if (if_idx) { 441 prop_dictionary_set_uint32(rldict, "interface", if_idx); 442 } 443 rl->nrl_dict = rldict; 444 return rl; 445 } 446 447 int 448 npf_rule_setcode(nl_rule_t *rl, int type, const void *code, size_t len) 449 { 450 prop_dictionary_t rldict = rl->nrl_dict; 451 prop_data_t cdata; 452 453 switch (type) { 454 case NPF_CODE_NC: 455 case NPF_CODE_BPF: 456 break; 457 default: 458 return ENOTSUP; 459 } 460 prop_dictionary_set_uint32(rldict, "code-type", type); 461 if ((cdata = prop_data_create_data(code, len)) == NULL) { 462 return ENOMEM; 463 } 464 prop_dictionary_set(rldict, "code", cdata); 465 prop_object_release(cdata); 466 return 0; 467 } 468 469 int 470 npf_rule_setkey(nl_rule_t *rl, const void *key, size_t len) 471 { 472 prop_dictionary_t rldict = rl->nrl_dict; 473 prop_data_t kdata; 474 475 if ((kdata = prop_data_create_data(key, len)) == NULL) { 476 return ENOMEM; 477 } 478 prop_dictionary_set(rldict, "key", kdata); 479 prop_object_release(kdata); 480 return 0; 481 } 482 483 int 484 npf_rule_setprio(nl_rule_t *rl, pri_t pri) 485 { 486 prop_dictionary_t rldict = rl->nrl_dict; 487 488 prop_dictionary_set_int32(rldict, "priority", pri); 489 return 0; 490 } 491 492 int 493 npf_rule_setproc(nl_rule_t *rl, const char *name) 494 { 495 prop_dictionary_t rldict = rl->nrl_dict; 496 497 prop_dictionary_set_cstring(rldict, "rproc", name); 498 return 0; 499 } 500 501 void * 502 npf_rule_export(nl_rule_t *rl, size_t *length) 503 { 504 prop_dictionary_t rldict = rl->nrl_dict; 505 void *xml; 506 507 if ((xml = prop_dictionary_externalize(rldict)) == NULL) { 508 return NULL; 509 } 510 *length = strlen(xml); 511 return xml; 512 } 513 514 bool 515 npf_rule_exists_p(nl_config_t *ncf, const char *name) 516 { 517 return _npf_prop_array_lookup(ncf->ncf_rules_list, "name", name); 518 } 519 520 int 521 npf_rule_insert(nl_config_t *ncf, nl_rule_t *parent, nl_rule_t *rl) 522 { 523 prop_dictionary_t rldict = rl->nrl_dict; 524 prop_array_t rlset; 525 526 if (parent) { 527 prop_dictionary_t pdict = parent->nrl_dict; 528 rlset = prop_dictionary_get(pdict, "subrules"); 529 if (rlset == NULL) { 530 rlset = prop_array_create(); 531 prop_dictionary_set(pdict, "subrules", rlset); 532 prop_object_release(rlset); 533 } 534 } else { 535 rlset = ncf->ncf_rules_list; 536 } 537 prop_array_add(rlset, rldict); 538 return 0; 539 } 540 541 static int 542 _npf_rule_foreach1(prop_array_t rules, nl_rule_callback_t func) 543 { 544 prop_dictionary_t rldict; 545 prop_object_iterator_t it; 546 unsigned reduce[16], n; 547 unsigned nlevel; 548 549 if (!rules || prop_object_type(rules) != PROP_TYPE_ARRAY) { 550 return ENOENT; 551 } 552 it = prop_array_iterator(rules); 553 if (it == NULL) { 554 return ENOMEM; 555 } 556 557 nlevel = 0; 558 reduce[nlevel] = 0; 559 n = 0; 560 561 while ((rldict = prop_object_iterator_next(it)) != NULL) { 562 nl_rule_t nrl = { .nrl_dict = rldict }; 563 uint32_t skipto = 0; 564 565 prop_dictionary_get_uint32(rldict, "skip-to", &skipto); 566 (*func)(&nrl, nlevel); 567 if (skipto) { 568 nlevel++; 569 reduce[nlevel] = skipto; 570 } 571 if (reduce[nlevel] == ++n) { 572 assert(nlevel > 0); 573 nlevel--; 574 } 575 } 576 prop_object_iterator_release(it); 577 return 0; 578 } 579 580 int 581 _npf_rule_foreach(nl_config_t *ncf, nl_rule_callback_t func) 582 { 583 return _npf_rule_foreach1(ncf->ncf_rules_list, func); 584 } 585 586 int 587 _npf_ruleset_list(int fd, const char *rname, nl_config_t *ncf) 588 { 589 prop_dictionary_t rldict, ret; 590 int error; 591 592 rldict = prop_dictionary_create(); 593 if (rldict == NULL) { 594 return ENOMEM; 595 } 596 prop_dictionary_set_cstring(rldict, "ruleset-name", rname); 597 prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_LIST); 598 error = prop_dictionary_sendrecv_ioctl(rldict, fd, IOC_NPF_RULE, &ret); 599 if (!error) { 600 prop_array_t rules; 601 602 rules = prop_dictionary_get(ret, "rules"); 603 if (rules == NULL) { 604 return EINVAL; 605 } 606 prop_object_release(ncf->ncf_rules_list); 607 ncf->ncf_rules_list = rules; 608 } 609 return error; 610 } 611 612 pri_t 613 _npf_rule_getinfo(nl_rule_t *nrl, const char **rname, uint32_t *attr, 614 u_int *if_idx) 615 { 616 prop_dictionary_t rldict = nrl->nrl_dict; 617 pri_t prio; 618 619 prop_dictionary_get_cstring_nocopy(rldict, "name", rname); 620 prop_dictionary_get_uint32(rldict, "attributes", attr); 621 prop_dictionary_get_int32(rldict, "priority", &prio); 622 prop_dictionary_get_uint32(rldict, "interface", if_idx); 623 return prio; 624 } 625 626 const void * 627 _npf_rule_ncode(nl_rule_t *nrl, size_t *size) 628 { 629 prop_dictionary_t rldict = nrl->nrl_dict; 630 prop_object_t obj = prop_dictionary_get(rldict, "code"); 631 *size = prop_data_size(obj); 632 return prop_data_data_nocopy(obj); 633 } 634 635 const char * 636 _npf_rule_rproc(nl_rule_t *nrl) 637 { 638 prop_dictionary_t rldict = nrl->nrl_dict; 639 const char *rpname = NULL; 640 641 prop_dictionary_get_cstring_nocopy(rldict, "rproc", &rpname); 642 return rpname; 643 } 644 645 void 646 npf_rule_destroy(nl_rule_t *rl) 647 { 648 649 prop_object_release(rl->nrl_dict); 650 free(rl); 651 } 652 653 /* 654 * RULE PROCEDURE INTERFACE. 655 */ 656 657 nl_rproc_t * 658 npf_rproc_create(const char *name) 659 { 660 prop_dictionary_t rpdict; 661 prop_array_t extcalls; 662 nl_rproc_t *nrp; 663 664 nrp = malloc(sizeof(nl_rproc_t)); 665 if (nrp == NULL) { 666 return NULL; 667 } 668 rpdict = prop_dictionary_create(); 669 if (rpdict == NULL) { 670 free(nrp); 671 return NULL; 672 } 673 prop_dictionary_set_cstring(rpdict, "name", name); 674 675 extcalls = prop_array_create(); 676 if (extcalls == NULL) { 677 prop_object_release(rpdict); 678 free(nrp); 679 return NULL; 680 } 681 prop_dictionary_set(rpdict, "extcalls", extcalls); 682 prop_object_release(extcalls); 683 684 nrp->nrp_dict = rpdict; 685 return nrp; 686 } 687 688 int 689 npf_rproc_extcall(nl_rproc_t *rp, nl_ext_t *ext) 690 { 691 prop_dictionary_t rpdict = rp->nrp_dict; 692 prop_dictionary_t extdict = ext->nxt_dict; 693 prop_array_t extcalls; 694 695 extcalls = prop_dictionary_get(rpdict, "extcalls"); 696 if (_npf_prop_array_lookup(extcalls, "name", ext->nxt_name)) { 697 return EEXIST; 698 } 699 prop_dictionary_set_cstring(extdict, "name", ext->nxt_name); 700 prop_array_add(extcalls, extdict); 701 return 0; 702 } 703 704 bool 705 npf_rproc_exists_p(nl_config_t *ncf, const char *name) 706 { 707 708 return _npf_prop_array_lookup(ncf->ncf_rproc_list, "name", name); 709 } 710 711 int 712 npf_rproc_insert(nl_config_t *ncf, nl_rproc_t *rp) 713 { 714 prop_dictionary_t rpdict = rp->nrp_dict; 715 const char *name; 716 717 if (!prop_dictionary_get_cstring_nocopy(rpdict, "name", &name)) { 718 return EINVAL; 719 } 720 if (npf_rproc_exists_p(ncf, name)) { 721 return EEXIST; 722 } 723 prop_array_add(ncf->ncf_rproc_list, rpdict); 724 return 0; 725 } 726 727 /* 728 * TRANSLATION INTERFACE. 729 */ 730 731 nl_nat_t * 732 npf_nat_create(int type, u_int flags, u_int if_idx, 733 npf_addr_t *addr, int af, in_port_t port) 734 { 735 nl_rule_t *rl; 736 prop_dictionary_t rldict; 737 prop_data_t addrdat; 738 uint32_t attr; 739 size_t sz; 740 741 if (af == AF_INET) { 742 sz = sizeof(struct in_addr); 743 } else if (af == AF_INET6) { 744 sz = sizeof(struct in6_addr); 745 } else { 746 return NULL; 747 } 748 749 attr = NPF_RULE_PASS | NPF_RULE_FINAL | 750 (type == NPF_NATOUT ? NPF_RULE_OUT : NPF_RULE_IN); 751 752 /* Create a rule for NAT policy. Next, will add translation data. */ 753 rl = npf_rule_create(NULL, attr, if_idx); 754 if (rl == NULL) { 755 return NULL; 756 } 757 rldict = rl->nrl_dict; 758 759 /* Translation type and flags. */ 760 prop_dictionary_set_int32(rldict, "type", type); 761 prop_dictionary_set_uint32(rldict, "flags", flags); 762 763 /* Translation IP. */ 764 addrdat = prop_data_create_data(addr, sz); 765 if (addrdat == NULL) { 766 npf_rule_destroy(rl); 767 return NULL; 768 } 769 prop_dictionary_set(rldict, "translation-ip", addrdat); 770 prop_object_release(addrdat); 771 772 /* Translation port (for redirect case). */ 773 prop_dictionary_set_uint16(rldict, "translation-port", port); 774 775 return (nl_nat_t *)rl; 776 } 777 778 int 779 npf_nat_insert(nl_config_t *ncf, nl_nat_t *nt, pri_t pri) 780 { 781 prop_dictionary_t rldict = nt->nrl_dict; 782 783 prop_dictionary_set_int32(rldict, "priority", NPF_PRI_LAST); 784 prop_array_add(ncf->ncf_nat_list, rldict); 785 return 0; 786 } 787 788 int 789 _npf_nat_foreach(nl_config_t *ncf, nl_rule_callback_t func) 790 { 791 return _npf_rule_foreach1(ncf->ncf_nat_list, func); 792 } 793 794 void 795 _npf_nat_getinfo(nl_nat_t *nt, int *type, u_int *flags, npf_addr_t *addr, 796 size_t *alen, in_port_t *port) 797 { 798 prop_dictionary_t rldict = nt->nrl_dict; 799 800 prop_dictionary_get_int32(rldict, "type", type); 801 prop_dictionary_get_uint32(rldict, "flags", flags); 802 803 prop_object_t obj = prop_dictionary_get(rldict, "translation-ip"); 804 *alen = prop_data_size(obj); 805 memcpy(addr, prop_data_data_nocopy(obj), *alen); 806 807 prop_dictionary_get_uint16(rldict, "translation-port", port); 808 } 809 810 /* 811 * TABLE INTERFACE. 812 */ 813 814 nl_table_t * 815 npf_table_create(u_int id, int type) 816 { 817 prop_dictionary_t tldict; 818 prop_array_t tblents; 819 nl_table_t *tl; 820 821 tl = malloc(sizeof(*tl)); 822 if (tl == NULL) { 823 return NULL; 824 } 825 tldict = prop_dictionary_create(); 826 if (tldict == NULL) { 827 free(tl); 828 return NULL; 829 } 830 prop_dictionary_set_uint32(tldict, "id", id); 831 prop_dictionary_set_int32(tldict, "type", type); 832 833 tblents = prop_array_create(); 834 if (tblents == NULL) { 835 prop_object_release(tldict); 836 free(tl); 837 return NULL; 838 } 839 prop_dictionary_set(tldict, "entries", tblents); 840 prop_object_release(tblents); 841 842 tl->ntl_dict = tldict; 843 return tl; 844 } 845 846 int 847 npf_table_add_entry(nl_table_t *tl, int af, const npf_addr_t *addr, 848 const npf_netmask_t mask) 849 { 850 prop_dictionary_t tldict = tl->ntl_dict, entdict; 851 prop_array_t tblents; 852 prop_data_t addrdata; 853 unsigned alen; 854 855 /* Create the table entry. */ 856 entdict = prop_dictionary_create(); 857 if (entdict == NULL) { 858 return ENOMEM; 859 } 860 861 switch (af) { 862 case AF_INET: 863 alen = sizeof(struct in_addr); 864 break; 865 case AF_INET6: 866 alen = sizeof(struct in6_addr); 867 break; 868 default: 869 return EINVAL; 870 } 871 872 addrdata = prop_data_create_data(addr, alen); 873 prop_dictionary_set(entdict, "addr", addrdata); 874 prop_dictionary_set_uint8(entdict, "mask", mask); 875 prop_object_release(addrdata); 876 877 tblents = prop_dictionary_get(tldict, "entries"); 878 prop_array_add(tblents, entdict); 879 prop_object_release(entdict); 880 return 0; 881 } 882 883 bool 884 npf_table_exists_p(nl_config_t *ncf, u_int tid) 885 { 886 prop_dictionary_t tldict; 887 prop_object_iterator_t it; 888 889 it = prop_array_iterator(ncf->ncf_table_list); 890 while ((tldict = prop_object_iterator_next(it)) != NULL) { 891 u_int i; 892 if (prop_dictionary_get_uint32(tldict, "id", &i) && tid == i) 893 break; 894 } 895 prop_object_iterator_release(it); 896 return tldict ? true : false; 897 } 898 899 int 900 npf_table_insert(nl_config_t *ncf, nl_table_t *tl) 901 { 902 prop_dictionary_t tldict = tl->ntl_dict; 903 u_int tid; 904 905 if (!prop_dictionary_get_uint32(tldict, "id", &tid)) { 906 return EINVAL; 907 } 908 if (npf_table_exists_p(ncf, tid)) { 909 return EEXIST; 910 } 911 prop_array_add(ncf->ncf_table_list, tldict); 912 return 0; 913 } 914 915 void 916 npf_table_destroy(nl_table_t *tl) 917 { 918 919 prop_object_release(tl->ntl_dict); 920 free(tl); 921 } 922 923 void 924 _npf_table_foreach(nl_config_t *ncf, nl_table_callback_t func) 925 { 926 prop_dictionary_t tldict; 927 prop_object_iterator_t it; 928 929 it = prop_array_iterator(ncf->ncf_table_list); 930 while ((tldict = prop_object_iterator_next(it)) != NULL) { 931 u_int id; 932 int type; 933 934 prop_dictionary_get_uint32(tldict, "id", &id); 935 prop_dictionary_get_int32(tldict, "type", &type); 936 (*func)(id, type); 937 } 938 prop_object_iterator_release(it); 939 } 940 941 /* 942 * MISC. 943 */ 944 945 int 946 npf_sessions_recv(int fd, const char *fpath) 947 { 948 prop_dictionary_t sdict; 949 int error; 950 951 error = prop_dictionary_recv_ioctl(fd, IOC_NPF_SESSIONS_SAVE, &sdict); 952 if (error) { 953 return error; 954 } 955 if (!prop_dictionary_externalize_to_file(sdict, fpath)) { 956 error = errno; 957 } 958 prop_object_release(sdict); 959 return error; 960 } 961 962 int 963 npf_sessions_send(int fd, const char *fpath) 964 { 965 prop_dictionary_t sdict; 966 int error; 967 968 if (fpath) { 969 sdict = prop_dictionary_internalize_from_file(fpath); 970 if (sdict == NULL) { 971 return errno; 972 } 973 } else { 974 /* Empty: will flush the sessions. */ 975 prop_array_t selist = prop_array_create(); 976 sdict = prop_dictionary_create(); 977 prop_dictionary_set(sdict, "session-list", selist); 978 prop_object_release(selist); 979 } 980 error = prop_dictionary_send_ioctl(sdict, fd, IOC_NPF_SESSIONS_LOAD); 981 prop_object_release(sdict); 982 return error; 983 } 984 985 static prop_dictionary_t 986 _npf_debug_initonce(nl_config_t *ncf) 987 { 988 if (!ncf->ncf_debug) { 989 prop_array_t iflist = prop_array_create(); 990 ncf->ncf_debug = prop_dictionary_create(); 991 prop_dictionary_set(ncf->ncf_debug, "interfaces", iflist); 992 prop_object_release(iflist); 993 } 994 return ncf->ncf_debug; 995 } 996 997 void 998 _npf_debug_addif(nl_config_t *ncf, struct ifaddrs *ifa, u_int if_idx) 999 { 1000 prop_dictionary_t ifdict, dbg = _npf_debug_initonce(ncf); 1001 prop_array_t iflist = prop_dictionary_get(dbg, "interfaces"); 1002 1003 if (_npf_prop_array_lookup(iflist, "name", ifa->ifa_name)) { 1004 return; 1005 } 1006 1007 ifdict = prop_dictionary_create(); 1008 prop_dictionary_set_cstring(ifdict, "name", ifa->ifa_name); 1009 prop_dictionary_set_uint32(ifdict, "flags", ifa->ifa_flags); 1010 if (!if_idx) { 1011 if_idx = if_nametoindex(ifa->ifa_name); 1012 } 1013 prop_dictionary_set_uint32(ifdict, "idx", if_idx); 1014 1015 const struct sockaddr *sa = ifa->ifa_addr; 1016 npf_addr_t addr; 1017 size_t alen = 0; 1018 1019 switch (sa ? sa->sa_family : -1) { 1020 case AF_INET: { 1021 const struct sockaddr_in *sin = (const void *)sa; 1022 alen = sizeof(sin->sin_addr); 1023 memcpy(&addr, &sin->sin_addr, alen); 1024 break; 1025 } 1026 case AF_INET6: { 1027 const struct sockaddr_in6 *sin6 = (const void *)sa; 1028 alen = sizeof(sin6->sin6_addr); 1029 memcpy(&addr, &sin6->sin6_addr, alen); 1030 break; 1031 } 1032 default: 1033 break; 1034 } 1035 1036 if (alen) { 1037 prop_data_t addrdata = prop_data_create_data(&addr, alen); 1038 prop_dictionary_set(ifdict, "addr", addrdata); 1039 prop_object_release(addrdata); 1040 } 1041 prop_array_add(iflist, ifdict); 1042 prop_object_release(ifdict); 1043 } 1044
Indexes created Sun Oct 19 02:09:48 GMT 2025