npf_ctl.c revision 1.2.2.2
1 1.2.2.2 yamt /* $NetBSD: npf_ctl.c,v 1.2.2.2 2010/10/09 03:32:37 yamt Exp $ */ 2 1.2.2.2 yamt 3 1.2.2.2 yamt /*- 4 1.2.2.2 yamt * Copyright (c) 2009-2010 The NetBSD Foundation, Inc. 5 1.2.2.2 yamt * All rights reserved. 6 1.2.2.2 yamt * 7 1.2.2.2 yamt * This material is based upon work partially supported by The 8 1.2.2.2 yamt * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 1.2.2.2 yamt * 10 1.2.2.2 yamt * Redistribution and use in source and binary forms, with or without 11 1.2.2.2 yamt * modification, are permitted provided that the following conditions 12 1.2.2.2 yamt * are met: 13 1.2.2.2 yamt * 1. Redistributions of source code must retain the above copyright 14 1.2.2.2 yamt * notice, this list of conditions and the following disclaimer. 15 1.2.2.2 yamt * 2. Redistributions in binary form must reproduce the above copyright 16 1.2.2.2 yamt * notice, this list of conditions and the following disclaimer in the 17 1.2.2.2 yamt * documentation and/or other materials provided with the distribution. 18 1.2.2.2 yamt * 19 1.2.2.2 yamt * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 1.2.2.2 yamt * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 1.2.2.2 yamt * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 1.2.2.2 yamt * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 1.2.2.2 yamt * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 1.2.2.2 yamt * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 1.2.2.2 yamt * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 1.2.2.2 yamt * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 1.2.2.2 yamt * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 1.2.2.2 yamt * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 1.2.2.2 yamt * POSSIBILITY OF SUCH DAMAGE. 30 1.2.2.2 yamt */ 31 1.2.2.2 yamt 32 1.2.2.2 yamt /* 33 1.2.2.2 yamt * NPF device control. 34 1.2.2.2 yamt * 35 1.2.2.2 yamt * Implementation of (re)loading, construction of tables and rules. 36 1.2.2.2 yamt * NPF proplib(9) dictionary consumer. 37 1.2.2.2 yamt * 38 1.2.2.2 yamt * TODO: 39 1.2.2.2 yamt * - Consider implementing 'sync' functionality. 40 1.2.2.2 yamt */ 41 1.2.2.2 yamt 42 1.2.2.2 yamt #ifdef _KERNEL 43 1.2.2.2 yamt #include <sys/cdefs.h> 44 1.2.2.2 yamt __KERNEL_RCSID(0, "$NetBSD: npf_ctl.c,v 1.2.2.2 2010/10/09 03:32:37 yamt Exp $"); 45 1.2.2.2 yamt 46 1.2.2.2 yamt #include <sys/param.h> 47 1.2.2.2 yamt #include <sys/conf.h> 48 1.2.2.2 yamt #include <sys/kernel.h> 49 1.2.2.2 yamt #endif 50 1.2.2.2 yamt 51 1.2.2.2 yamt #include <prop/proplib.h> 52 1.2.2.2 yamt 53 1.2.2.2 yamt #include "npf_ncode.h" 54 1.2.2.2 yamt #include "npf_impl.h" 55 1.2.2.2 yamt 56 1.2.2.2 yamt /* 57 1.2.2.2 yamt * npfctl_switch: enable or disable packet inspection. 58 1.2.2.2 yamt */ 59 1.2.2.2 yamt int 60 1.2.2.2 yamt npfctl_switch(void *data) 61 1.2.2.2 yamt { 62 1.2.2.2 yamt const bool onoff = *(int *)data ? true : false; 63 1.2.2.2 yamt int error; 64 1.2.2.2 yamt 65 1.2.2.2 yamt if (onoff) { 66 1.2.2.2 yamt /* Enable: add pfil hooks. */ 67 1.2.2.2 yamt error = npf_register_pfil(); 68 1.2.2.2 yamt } else { 69 1.2.2.2 yamt /* Disable: remove pfil hooks. */ 70 1.2.2.2 yamt npf_unregister_pfil(); 71 1.2.2.2 yamt error = 0; 72 1.2.2.2 yamt } 73 1.2.2.2 yamt return error; 74 1.2.2.2 yamt } 75 1.2.2.2 yamt 76 1.2.2.2 yamt static int 77 1.2.2.2 yamt npf_mk_tables(npf_tableset_t *tblset, prop_array_t tables) 78 1.2.2.2 yamt { 79 1.2.2.2 yamt prop_object_iterator_t it; 80 1.2.2.2 yamt prop_dictionary_t tbldict; 81 1.2.2.2 yamt prop_object_t obj; 82 1.2.2.2 yamt int error = 0; 83 1.2.2.2 yamt 84 1.2.2.2 yamt /* Tables - array. */ 85 1.2.2.2 yamt if (prop_object_type(tables) != PROP_TYPE_ARRAY) 86 1.2.2.2 yamt return EINVAL; 87 1.2.2.2 yamt 88 1.2.2.2 yamt it = prop_array_iterator(tables); 89 1.2.2.2 yamt if (it == NULL) 90 1.2.2.2 yamt return ENOMEM; 91 1.2.2.2 yamt 92 1.2.2.2 yamt while ((tbldict = prop_object_iterator_next(it)) != NULL) { 93 1.2.2.2 yamt prop_dictionary_t ent; 94 1.2.2.2 yamt prop_object_iterator_t eit; 95 1.2.2.2 yamt prop_array_t entries; 96 1.2.2.2 yamt npf_table_t *t; 97 1.2.2.2 yamt u_int tid; 98 1.2.2.2 yamt int type; 99 1.2.2.2 yamt 100 1.2.2.2 yamt /* Table - dictionary. */ 101 1.2.2.2 yamt if (prop_object_type(tbldict) != PROP_TYPE_DICTIONARY) { 102 1.2.2.2 yamt error = EINVAL; 103 1.2.2.2 yamt break; 104 1.2.2.2 yamt } 105 1.2.2.2 yamt 106 1.2.2.2 yamt /* Table ID and type. */ 107 1.2.2.2 yamt obj = prop_dictionary_get(tbldict, "id"); 108 1.2.2.2 yamt tid = (u_int)prop_number_integer_value(obj); 109 1.2.2.2 yamt obj = prop_dictionary_get(tbldict, "type"); 110 1.2.2.2 yamt type = (int)prop_number_integer_value(obj); 111 1.2.2.2 yamt /* Validate them. */ 112 1.2.2.2 yamt error = npf_table_check(tblset, tid, type); 113 1.2.2.2 yamt if (error) 114 1.2.2.2 yamt break; 115 1.2.2.2 yamt 116 1.2.2.2 yamt /* Create and insert the table. */ 117 1.2.2.2 yamt t = npf_table_create(tid, type, 1024); /* XXX */ 118 1.2.2.2 yamt if (t == NULL) { 119 1.2.2.2 yamt error = ENOMEM; 120 1.2.2.2 yamt break; 121 1.2.2.2 yamt } 122 1.2.2.2 yamt error = npf_tableset_insert(tblset, t); 123 1.2.2.2 yamt KASSERT(error == 0); 124 1.2.2.2 yamt 125 1.2.2.2 yamt /* Entries. */ 126 1.2.2.2 yamt entries = prop_dictionary_get(tbldict, "entries"); 127 1.2.2.2 yamt if (prop_object_type(entries) != PROP_TYPE_ARRAY) { 128 1.2.2.2 yamt error = EINVAL; 129 1.2.2.2 yamt break; 130 1.2.2.2 yamt } 131 1.2.2.2 yamt eit = prop_array_iterator(entries); 132 1.2.2.2 yamt if (eit == NULL) { 133 1.2.2.2 yamt error = ENOMEM; 134 1.2.2.2 yamt break; 135 1.2.2.2 yamt } 136 1.2.2.2 yamt while ((ent = prop_object_iterator_next(eit)) != NULL) { 137 1.2.2.2 yamt in_addr_t addr, mask; /* XXX: IPv6 */ 138 1.2.2.2 yamt 139 1.2.2.2 yamt /* Address. */ 140 1.2.2.2 yamt obj = prop_dictionary_get(ent, "addr"); 141 1.2.2.2 yamt addr = (in_addr_t)prop_number_integer_value(obj); 142 1.2.2.2 yamt /* Mask. */ 143 1.2.2.2 yamt obj = prop_dictionary_get(ent, "mask"); 144 1.2.2.2 yamt mask = (in_addr_t)prop_number_integer_value(obj); 145 1.2.2.2 yamt /* Add a table entry. */ 146 1.2.2.2 yamt error = npf_table_add_v4cidr(tblset, tid, addr, mask); 147 1.2.2.2 yamt if (error) 148 1.2.2.2 yamt break; 149 1.2.2.2 yamt } 150 1.2.2.2 yamt prop_object_iterator_release(eit); 151 1.2.2.2 yamt if (error) 152 1.2.2.2 yamt break; 153 1.2.2.2 yamt } 154 1.2.2.2 yamt prop_object_iterator_release(it); 155 1.2.2.2 yamt /* 156 1.2.2.2 yamt * Note: in a case of error, caller will free entire tableset. 157 1.2.2.2 yamt */ 158 1.2.2.2 yamt return error; 159 1.2.2.2 yamt } 160 1.2.2.2 yamt 161 1.2.2.2 yamt static void * 162 1.2.2.2 yamt npf_mk_ncode(const void *ncptr, size_t nc_size) 163 1.2.2.2 yamt { 164 1.2.2.2 yamt int npf_err, errat; 165 1.2.2.2 yamt void *nc; 166 1.2.2.2 yamt 167 1.2.2.2 yamt /* 168 1.2.2.2 yamt * Allocate and copy n-code. 169 1.2.2.2 yamt * 170 1.2.2.2 yamt * XXX: Inefficient; consider extending proplib(9) to provide 171 1.2.2.2 yamt * interface for custom allocator and avoid copy. 172 1.2.2.2 yamt */ 173 1.2.2.2 yamt nc = npf_ncode_alloc(nc_size); 174 1.2.2.2 yamt if (nc == NULL) { 175 1.2.2.2 yamt return NULL; 176 1.2.2.2 yamt } 177 1.2.2.2 yamt memcpy(nc, ncptr, nc_size); 178 1.2.2.2 yamt npf_err = npf_ncode_validate(nc, nc_size, &errat); 179 1.2.2.2 yamt if (npf_err) { 180 1.2.2.2 yamt npf_ncode_free(nc, nc_size); 181 1.2.2.2 yamt /* TODO: return error details via proplib */ 182 1.2.2.2 yamt return NULL; 183 1.2.2.2 yamt } 184 1.2.2.2 yamt return nc; 185 1.2.2.2 yamt } 186 1.2.2.2 yamt 187 1.2.2.2 yamt static int 188 1.2.2.2 yamt npf_mk_singlerule(prop_dictionary_t rldict, 189 1.2.2.2 yamt npf_ruleset_t *rlset, npf_rule_t **parent) 190 1.2.2.2 yamt { 191 1.2.2.2 yamt npf_rule_t *rl; 192 1.2.2.2 yamt prop_object_t obj; 193 1.2.2.2 yamt int attr, ifidx; 194 1.2.2.2 yamt pri_t pri; 195 1.2.2.2 yamt size_t nc_size; 196 1.2.2.2 yamt void *nc; 197 1.2.2.2 yamt 198 1.2.2.2 yamt /* Rule - dictionary. */ 199 1.2.2.2 yamt if (prop_object_type(rldict) != PROP_TYPE_DICTIONARY) 200 1.2.2.2 yamt return EINVAL; 201 1.2.2.2 yamt 202 1.2.2.2 yamt /* Attributes (integer). */ 203 1.2.2.2 yamt obj = prop_dictionary_get(rldict, "attributes"); 204 1.2.2.2 yamt attr = prop_number_integer_value(obj); 205 1.2.2.2 yamt 206 1.2.2.2 yamt /* Priority (integer). */ 207 1.2.2.2 yamt obj = prop_dictionary_get(rldict, "priority"); 208 1.2.2.2 yamt pri = prop_number_integer_value(obj); 209 1.2.2.2 yamt 210 1.2.2.2 yamt /* Interface ID (integer). */ 211 1.2.2.2 yamt obj = prop_dictionary_get(rldict, "interface"); 212 1.2.2.2 yamt ifidx = prop_number_integer_value(obj); 213 1.2.2.2 yamt 214 1.2.2.2 yamt /* N-code (binary data). */ 215 1.2.2.2 yamt obj = prop_dictionary_get(rldict, "ncode"); 216 1.2.2.2 yamt if (obj) { 217 1.2.2.2 yamt const void *ncptr; 218 1.2.2.2 yamt 219 1.2.2.2 yamt /* Perform n-code validation. */ 220 1.2.2.2 yamt nc_size = prop_data_size(obj); 221 1.2.2.2 yamt ncptr = prop_data_data_nocopy(obj); 222 1.2.2.2 yamt if (ncptr == NULL || nc_size > NPF_NCODE_LIMIT) { 223 1.2.2.2 yamt return EINVAL; 224 1.2.2.2 yamt } 225 1.2.2.2 yamt nc = npf_mk_ncode(ncptr, nc_size); 226 1.2.2.2 yamt if (nc == NULL) { 227 1.2.2.2 yamt return EINVAL; 228 1.2.2.2 yamt } 229 1.2.2.2 yamt } else { 230 1.2.2.2 yamt /* No n-code. */ 231 1.2.2.2 yamt nc = NULL; 232 1.2.2.2 yamt nc_size = 0; 233 1.2.2.2 yamt } 234 1.2.2.2 yamt 235 1.2.2.2 yamt /* Allocate and setup NPF rule. */ 236 1.2.2.2 yamt rl = npf_rule_alloc(attr, pri, ifidx, nc, nc_size); 237 1.2.2.2 yamt if (rl == NULL) { 238 1.2.2.2 yamt if (nc) { 239 1.2.2.2 yamt npf_ncode_free(nc, nc_size); /* XXX */ 240 1.2.2.2 yamt } 241 1.2.2.2 yamt return ENOMEM; 242 1.2.2.2 yamt } 243 1.2.2.2 yamt npf_ruleset_insert(rlset, rl); 244 1.2.2.2 yamt if (parent) { 245 1.2.2.2 yamt *parent = rl; 246 1.2.2.2 yamt } 247 1.2.2.2 yamt return 0; 248 1.2.2.2 yamt } 249 1.2.2.2 yamt 250 1.2.2.2 yamt static int 251 1.2.2.2 yamt npf_mk_rules(npf_ruleset_t *rlset, prop_array_t rules) 252 1.2.2.2 yamt { 253 1.2.2.2 yamt prop_object_iterator_t it; 254 1.2.2.2 yamt prop_dictionary_t rldict; 255 1.2.2.2 yamt int error; 256 1.2.2.2 yamt 257 1.2.2.2 yamt /* Ruleset - array. */ 258 1.2.2.2 yamt if (prop_object_type(rules) != PROP_TYPE_ARRAY) 259 1.2.2.2 yamt return EINVAL; 260 1.2.2.2 yamt 261 1.2.2.2 yamt it = prop_array_iterator(rules); 262 1.2.2.2 yamt if (it == NULL) 263 1.2.2.2 yamt return ENOMEM; 264 1.2.2.2 yamt 265 1.2.2.2 yamt error = 0; 266 1.2.2.2 yamt while ((rldict = prop_object_iterator_next(it)) != NULL) { 267 1.2.2.2 yamt prop_object_iterator_t sit; 268 1.2.2.2 yamt prop_array_t subrules; 269 1.2.2.2 yamt prop_dictionary_t srldict; 270 1.2.2.2 yamt npf_rule_t *myrl; 271 1.2.2.2 yamt 272 1.2.2.2 yamt /* Generate a single rule. */ 273 1.2.2.2 yamt error = npf_mk_singlerule(rldict, rlset, &myrl); 274 1.2.2.2 yamt if (error) 275 1.2.2.2 yamt break; 276 1.2.2.2 yamt 277 1.2.2.2 yamt /* Check for subrules. */ 278 1.2.2.2 yamt subrules = prop_dictionary_get(rldict, "subrules"); 279 1.2.2.2 yamt if (subrules == NULL) { 280 1.2.2.2 yamt /* No subrules, next.. */ 281 1.2.2.2 yamt continue; 282 1.2.2.2 yamt } 283 1.2.2.2 yamt /* Generate subrules, if any. */ 284 1.2.2.2 yamt if (prop_object_type(subrules) != PROP_TYPE_ARRAY) { 285 1.2.2.2 yamt error = EINVAL; 286 1.2.2.2 yamt break; 287 1.2.2.2 yamt } 288 1.2.2.2 yamt sit = prop_array_iterator(subrules); 289 1.2.2.2 yamt if (sit == NULL) { 290 1.2.2.2 yamt error = ENOMEM; 291 1.2.2.2 yamt break; 292 1.2.2.2 yamt } 293 1.2.2.2 yamt while ((srldict = prop_object_iterator_next(sit)) != NULL) { 294 1.2.2.2 yamt /* For subrule, pass ruleset pointer of parent. */ 295 1.2.2.2 yamt error = npf_mk_singlerule(srldict, 296 1.2.2.2 yamt npf_rule_subset(myrl), NULL); 297 1.2.2.2 yamt if (error) 298 1.2.2.2 yamt break; 299 1.2.2.2 yamt } 300 1.2.2.2 yamt prop_object_iterator_release(sit); 301 1.2.2.2 yamt if (error) 302 1.2.2.2 yamt break; 303 1.2.2.2 yamt } 304 1.2.2.2 yamt prop_object_iterator_release(it); 305 1.2.2.2 yamt /* 306 1.2.2.2 yamt * Note: in a case of error, caller will free entire ruleset. 307 1.2.2.2 yamt */ 308 1.2.2.2 yamt return error; 309 1.2.2.2 yamt } 310 1.2.2.2 yamt 311 1.2.2.2 yamt static int 312 1.2.2.2 yamt npf_mk_natlist(npf_ruleset_t *nset, prop_array_t natlist) 313 1.2.2.2 yamt { 314 1.2.2.2 yamt prop_object_iterator_t it; 315 1.2.2.2 yamt prop_dictionary_t natdict; 316 1.2.2.2 yamt int error; 317 1.2.2.2 yamt 318 1.2.2.2 yamt /* NAT policies - array. */ 319 1.2.2.2 yamt if (prop_object_type(natlist) != PROP_TYPE_ARRAY) 320 1.2.2.2 yamt return EINVAL; 321 1.2.2.2 yamt 322 1.2.2.2 yamt it = prop_array_iterator(natlist); 323 1.2.2.2 yamt if (it == NULL) 324 1.2.2.2 yamt return ENOMEM; 325 1.2.2.2 yamt 326 1.2.2.2 yamt error = 0; 327 1.2.2.2 yamt while ((natdict = prop_object_iterator_next(it)) != NULL) { 328 1.2.2.2 yamt prop_object_t obj; 329 1.2.2.2 yamt npf_natpolicy_t *np; 330 1.2.2.2 yamt npf_rule_t *rl; 331 1.2.2.2 yamt in_addr_t taddr; 332 1.2.2.2 yamt in_port_t tport; 333 1.2.2.2 yamt int type, flags; 334 1.2.2.2 yamt 335 1.2.2.2 yamt /* NAT policy - dictionary. */ 336 1.2.2.2 yamt if (prop_object_type(natdict) != PROP_TYPE_DICTIONARY) { 337 1.2.2.2 yamt error = EINVAL; 338 1.2.2.2 yamt break; 339 1.2.2.2 yamt } 340 1.2.2.2 yamt 341 1.2.2.2 yamt /* Translation type. */ 342 1.2.2.2 yamt obj = prop_dictionary_get(natdict, "type"); 343 1.2.2.2 yamt type = prop_number_integer_value(obj); 344 1.2.2.2 yamt 345 1.2.2.2 yamt /* Translation type. */ 346 1.2.2.2 yamt obj = prop_dictionary_get(natdict, "flags"); 347 1.2.2.2 yamt flags = prop_number_integer_value(obj); 348 1.2.2.2 yamt 349 1.2.2.2 yamt /* Translation IP. */ 350 1.2.2.2 yamt obj = prop_dictionary_get(natdict, "translation_ip"); 351 1.2.2.2 yamt taddr = (in_addr_t)prop_number_integer_value(obj); 352 1.2.2.2 yamt 353 1.2.2.2 yamt /* Translation port (for redirect case). */ 354 1.2.2.2 yamt obj = prop_dictionary_get(natdict, "translation_port"); 355 1.2.2.2 yamt tport = (in_addr_t)prop_number_integer_value(obj); 356 1.2.2.2 yamt 357 1.2.2.2 yamt /* 358 1.2.2.2 yamt * NAT policies are standard rules, plus additional 359 1.2.2.2 yamt * information for translation. Make a rule. 360 1.2.2.2 yamt */ 361 1.2.2.2 yamt error = npf_mk_singlerule(natdict, nset, &rl); 362 1.2.2.2 yamt if (error) 363 1.2.2.2 yamt break; 364 1.2.2.2 yamt 365 1.2.2.2 yamt /* Allocate a new NAT policy and assign to the rule. */ 366 1.2.2.2 yamt np = npf_nat_newpolicy(type, flags, taddr, tport); 367 1.2.2.2 yamt if (np == NULL) { 368 1.2.2.2 yamt error = ENOMEM; 369 1.2.2.2 yamt break; 370 1.2.2.2 yamt } 371 1.2.2.2 yamt npf_rule_setnat(rl, np); 372 1.2.2.2 yamt } 373 1.2.2.2 yamt prop_object_iterator_release(it); 374 1.2.2.2 yamt /* 375 1.2.2.2 yamt * Note: in a case of error, caller will free entire NAT ruleset 376 1.2.2.2 yamt * with assigned NAT policies. 377 1.2.2.2 yamt */ 378 1.2.2.2 yamt return error; 379 1.2.2.2 yamt } 380 1.2.2.2 yamt 381 1.2.2.2 yamt /* 382 1.2.2.2 yamt * npfctl_reload: store passed data i.e. update settings, create passed 383 1.2.2.2 yamt * tables, rules and atomically activate all them. 384 1.2.2.2 yamt */ 385 1.2.2.2 yamt int 386 1.2.2.2 yamt npfctl_reload(u_long cmd, void *data) 387 1.2.2.2 yamt { 388 1.2.2.2 yamt const struct plistref *pref = data; 389 1.2.2.2 yamt npf_tableset_t *tblset = NULL; 390 1.2.2.2 yamt npf_ruleset_t *rlset = NULL; 391 1.2.2.2 yamt npf_ruleset_t *nset = NULL; 392 1.2.2.2 yamt prop_dictionary_t dict; 393 1.2.2.2 yamt prop_array_t natlist, tables, rules; 394 1.2.2.2 yamt prop_object_t ver; 395 1.2.2.2 yamt int error; 396 1.2.2.2 yamt 397 1.2.2.2 yamt /* Retrieve the dictionary. */ 398 1.2.2.2 yamt #ifdef _KERNEL 399 1.2.2.2 yamt error = prop_dictionary_copyin_ioctl(pref, cmd, &dict); 400 1.2.2.2 yamt if (error) 401 1.2.2.2 yamt return error; 402 1.2.2.2 yamt #else 403 1.2.2.2 yamt dict = prop_dictionary_internalize_from_file(data); 404 1.2.2.2 yamt if (dict == NULL) 405 1.2.2.2 yamt return EINVAL; 406 1.2.2.2 yamt #endif 407 1.2.2.2 yamt /* Version. */ 408 1.2.2.2 yamt ver = prop_dictionary_get(dict, "version"); 409 1.2.2.2 yamt if (ver == NULL || prop_number_integer_value(ver) != NPF_VERSION) { 410 1.2.2.2 yamt error = EINVAL; 411 1.2.2.2 yamt goto fail; 412 1.2.2.2 yamt } 413 1.2.2.2 yamt 414 1.2.2.2 yamt /* XXX: Hard way for now. */ 415 1.2.2.2 yamt (void)npf_session_tracking(false); 416 1.2.2.2 yamt 417 1.2.2.2 yamt /* NAT policies. */ 418 1.2.2.2 yamt nset = npf_ruleset_create(); 419 1.2.2.2 yamt natlist = prop_dictionary_get(dict, "translation"); 420 1.2.2.2 yamt error = npf_mk_natlist(nset, natlist); 421 1.2.2.2 yamt if (error) 422 1.2.2.2 yamt goto fail; 423 1.2.2.2 yamt 424 1.2.2.2 yamt /* Tables. */ 425 1.2.2.2 yamt tblset = npf_tableset_create(); 426 1.2.2.2 yamt tables = prop_dictionary_get(dict, "tables"); 427 1.2.2.2 yamt error = npf_mk_tables(tblset, tables); 428 1.2.2.2 yamt if (error) 429 1.2.2.2 yamt goto fail; 430 1.2.2.2 yamt 431 1.2.2.2 yamt /* Rules. */ 432 1.2.2.2 yamt rlset = npf_ruleset_create(); 433 1.2.2.2 yamt rules = prop_dictionary_get(dict, "rules"); 434 1.2.2.2 yamt error = npf_mk_rules(rlset, rules); 435 1.2.2.2 yamt if (error) 436 1.2.2.2 yamt goto fail; 437 1.2.2.2 yamt 438 1.2.2.2 yamt /* Flush and reload NAT policies. */ 439 1.2.2.2 yamt npf_nat_reload(nset); 440 1.2.2.2 yamt 441 1.2.2.2 yamt /* 442 1.2.2.2 yamt * Finally, reload the ruleset. It will also reload the tableset. 443 1.2.2.2 yamt * Operation will be performed as a single transaction. 444 1.2.2.2 yamt */ 445 1.2.2.2 yamt npf_ruleset_reload(rlset, tblset); 446 1.2.2.2 yamt 447 1.2.2.2 yamt (void)npf_session_tracking(true); 448 1.2.2.2 yamt 449 1.2.2.2 yamt /* Done. Since data is consumed now, we shall not destroy it. */ 450 1.2.2.2 yamt tblset = NULL; 451 1.2.2.2 yamt rlset = NULL; 452 1.2.2.2 yamt nset = NULL; 453 1.2.2.2 yamt fail: 454 1.2.2.2 yamt prop_object_release(dict); 455 1.2.2.2 yamt /* 456 1.2.2.2 yamt * Note: destroy rulesets first, to drop references to the tableset. 457 1.2.2.2 yamt */ 458 1.2.2.2 yamt KASSERT(error == 0 || (nset || rlset || tblset)); 459 1.2.2.2 yamt if (nset) { 460 1.2.2.2 yamt npf_ruleset_destroy(nset); 461 1.2.2.2 yamt } 462 1.2.2.2 yamt if (rlset) { 463 1.2.2.2 yamt npf_ruleset_destroy(rlset); 464 1.2.2.2 yamt } 465 1.2.2.2 yamt if (tblset) { 466 1.2.2.2 yamt npf_tableset_destroy(tblset); 467 1.2.2.2 yamt } 468 1.2.2.2 yamt return error; 469 1.2.2.2 yamt } 470 1.2.2.2 yamt 471 1.2.2.2 yamt /* 472 1.2.2.2 yamt * npfctl_table: add, remove or query entries in the specified table. 473 1.2.2.2 yamt * 474 1.2.2.2 yamt * For maximum performance, interface is avoiding proplib(3)'s overhead. 475 1.2.2.2 yamt */ 476 1.2.2.2 yamt int 477 1.2.2.2 yamt npfctl_table(void *data) 478 1.2.2.2 yamt { 479 1.2.2.2 yamt npf_ioctl_table_t *nct = data; 480 1.2.2.2 yamt int error; 481 1.2.2.2 yamt 482 1.2.2.2 yamt switch (nct->nct_action) { 483 1.2.2.2 yamt case NPF_IOCTL_TBLENT_ADD: 484 1.2.2.2 yamt error = npf_table_add_v4cidr(NULL, nct->nct_tid, 485 1.2.2.2 yamt nct->nct_addr, nct->nct_mask); 486 1.2.2.2 yamt break; 487 1.2.2.2 yamt case NPF_IOCTL_TBLENT_REM: 488 1.2.2.2 yamt error = npf_table_rem_v4cidr(NULL, nct->nct_tid, 489 1.2.2.2 yamt nct->nct_addr, nct->nct_mask); 490 1.2.2.2 yamt break; 491 1.2.2.2 yamt default: 492 1.2.2.2 yamt /* XXX */ 493 1.2.2.2 yamt error = npf_table_match_v4addr(nct->nct_tid, nct->nct_addr); 494 1.2.2.2 yamt if (error) { 495 1.2.2.2 yamt error = EINVAL; 496 1.2.2.2 yamt } 497 1.2.2.2 yamt } 498 1.2.2.2 yamt return error; 499 1.2.2.2 yamt } 500
Indexes created Mon Oct 20 20:10:13 GMT 2025