Home | History | Annotate | Line # | Download | only in npf
npf_ctl.c revision 1.27
      1  1.27     rmind /*	$NetBSD: npf_ctl.c,v 1.27 2013/09/19 00:50:56 rmind Exp $	*/
      2   1.1     rmind 
      3   1.1     rmind /*-
      4  1.21     rmind  * Copyright (c) 2009-2013 The NetBSD Foundation, Inc.
      5   1.1     rmind  * All rights reserved.
      6   1.1     rmind  *
      7   1.1     rmind  * This material is based upon work partially supported by The
      8   1.1     rmind  * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
      9   1.1     rmind  *
     10   1.1     rmind  * Redistribution and use in source and binary forms, with or without
     11   1.1     rmind  * modification, are permitted provided that the following conditions
     12   1.1     rmind  * are met:
     13   1.1     rmind  * 1. Redistributions of source code must retain the above copyright
     14   1.1     rmind  *    notice, this list of conditions and the following disclaimer.
     15   1.1     rmind  * 2. Redistributions in binary form must reproduce the above copyright
     16   1.1     rmind  *    notice, this list of conditions and the following disclaimer in the
     17   1.1     rmind  *    documentation and/or other materials provided with the distribution.
     18   1.1     rmind  *
     19   1.1     rmind  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     20   1.1     rmind  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     21   1.1     rmind  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     22   1.1     rmind  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     23   1.1     rmind  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     24   1.1     rmind  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     25   1.1     rmind  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     26   1.1     rmind  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     27   1.1     rmind  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     28   1.1     rmind  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     29   1.1     rmind  * POSSIBILITY OF SUCH DAMAGE.
     30   1.1     rmind  */
     31   1.1     rmind 
     32   1.1     rmind /*
     33   1.1     rmind  * NPF device control.
     34   1.1     rmind  *
     35   1.1     rmind  * Implementation of (re)loading, construction of tables and rules.
     36   1.1     rmind  * NPF proplib(9) dictionary consumer.
     37   1.1     rmind  */
     38   1.1     rmind 
     39   1.1     rmind #include <sys/cdefs.h>
     40  1.27     rmind __KERNEL_RCSID(0, "$NetBSD: npf_ctl.c,v 1.27 2013/09/19 00:50:56 rmind Exp $");
     41   1.1     rmind 
     42   1.1     rmind #include <sys/param.h>
     43   1.1     rmind #include <sys/conf.h>
     44  1.21     rmind #include <sys/kmem.h>
     45  1.21     rmind #include <net/bpf.h>
     46   1.1     rmind 
     47   1.1     rmind #include <prop/proplib.h>
     48   1.1     rmind 
     49   1.1     rmind #include "npf_ncode.h"
     50   1.1     rmind #include "npf_impl.h"
     51   1.1     rmind 
     52  1.12     rmind #if defined(DEBUG) || defined(DIAGNOSTIC)
     53  1.12     rmind #define	NPF_ERR_DEBUG(e) \
     54  1.12     rmind 	prop_dictionary_set_cstring_nocopy((e), "source-file", __FILE__); \
     55  1.12     rmind 	prop_dictionary_set_uint32((e), "source-line", __LINE__);
     56  1.12     rmind #else
     57  1.12     rmind #define	NPF_ERR_DEBUG(e)
     58  1.12     rmind #endif
     59  1.12     rmind 
     60   1.1     rmind /*
     61   1.1     rmind  * npfctl_switch: enable or disable packet inspection.
     62   1.1     rmind  */
     63   1.1     rmind int
     64   1.1     rmind npfctl_switch(void *data)
     65   1.1     rmind {
     66   1.1     rmind 	const bool onoff = *(int *)data ? true : false;
     67   1.1     rmind 	int error;
     68   1.1     rmind 
     69   1.1     rmind 	if (onoff) {
     70   1.1     rmind 		/* Enable: add pfil hooks. */
     71  1.14     rmind 		error = npf_pfil_register();
     72   1.1     rmind 	} else {
     73   1.1     rmind 		/* Disable: remove pfil hooks. */
     74  1.14     rmind 		npf_pfil_unregister();
     75   1.1     rmind 		error = 0;
     76   1.1     rmind 	}
     77   1.1     rmind 	return error;
     78   1.1     rmind }
     79   1.1     rmind 
     80   1.6     rmind static int __noinline
     81  1.12     rmind npf_mk_tables(npf_tableset_t *tblset, prop_array_t tables,
     82  1.12     rmind     prop_dictionary_t errdict)
     83   1.1     rmind {
     84   1.1     rmind 	prop_object_iterator_t it;
     85   1.1     rmind 	prop_dictionary_t tbldict;
     86   1.1     rmind 	int error = 0;
     87   1.1     rmind 
     88   1.1     rmind 	/* Tables - array. */
     89  1.12     rmind 	if (prop_object_type(tables) != PROP_TYPE_ARRAY) {
     90  1.12     rmind 		NPF_ERR_DEBUG(errdict);
     91   1.1     rmind 		return EINVAL;
     92  1.12     rmind 	}
     93   1.1     rmind 
     94   1.1     rmind 	it = prop_array_iterator(tables);
     95   1.1     rmind 	while ((tbldict = prop_object_iterator_next(it)) != NULL) {
     96   1.1     rmind 		prop_dictionary_t ent;
     97   1.1     rmind 		prop_object_iterator_t eit;
     98   1.1     rmind 		prop_array_t entries;
     99   1.1     rmind 		npf_table_t *t;
    100   1.1     rmind 		u_int tid;
    101   1.1     rmind 		int type;
    102   1.1     rmind 
    103   1.1     rmind 		/* Table - dictionary. */
    104   1.1     rmind 		if (prop_object_type(tbldict) != PROP_TYPE_DICTIONARY) {
    105  1.12     rmind 			NPF_ERR_DEBUG(errdict);
    106   1.1     rmind 			error = EINVAL;
    107   1.1     rmind 			break;
    108   1.1     rmind 		}
    109   1.1     rmind 
    110   1.1     rmind 		/* Table ID and type. */
    111   1.6     rmind 		prop_dictionary_get_uint32(tbldict, "id", &tid);
    112   1.6     rmind 		prop_dictionary_get_int32(tbldict, "type", &type);
    113   1.6     rmind 
    114  1.12     rmind 		/* Validate them, check for duplicate IDs. */
    115   1.1     rmind 		error = npf_table_check(tblset, tid, type);
    116   1.1     rmind 		if (error)
    117   1.1     rmind 			break;
    118   1.1     rmind 
    119   1.1     rmind 		/* Create and insert the table. */
    120   1.1     rmind 		t = npf_table_create(tid, type, 1024);	/* XXX */
    121   1.1     rmind 		if (t == NULL) {
    122  1.12     rmind 			NPF_ERR_DEBUG(errdict);
    123   1.1     rmind 			error = ENOMEM;
    124   1.1     rmind 			break;
    125   1.1     rmind 		}
    126   1.1     rmind 		error = npf_tableset_insert(tblset, t);
    127   1.1     rmind 		KASSERT(error == 0);
    128   1.1     rmind 
    129   1.1     rmind 		/* Entries. */
    130   1.1     rmind 		entries = prop_dictionary_get(tbldict, "entries");
    131   1.1     rmind 		if (prop_object_type(entries) != PROP_TYPE_ARRAY) {
    132  1.12     rmind 			NPF_ERR_DEBUG(errdict);
    133   1.1     rmind 			error = EINVAL;
    134   1.1     rmind 			break;
    135   1.1     rmind 		}
    136   1.1     rmind 		eit = prop_array_iterator(entries);
    137   1.1     rmind 		while ((ent = prop_object_iterator_next(eit)) != NULL) {
    138   1.7    zoltan 			const npf_addr_t *addr;
    139   1.9     rmind 			npf_netmask_t mask;
    140  1.16     rmind 			int alen;
    141   1.1     rmind 
    142   1.6     rmind 			/* Get address and mask.  Add a table entry. */
    143  1.16     rmind 			prop_object_t obj = prop_dictionary_get(ent, "addr");
    144  1.16     rmind 			addr = (const npf_addr_t *)prop_data_data_nocopy(obj);
    145   1.7    zoltan 			prop_dictionary_get_uint8(ent, "mask", &mask);
    146  1.16     rmind 			alen = prop_data_size(obj);
    147  1.16     rmind 
    148  1.16     rmind 			error = npf_table_insert(tblset, tid, alen, addr, mask);
    149   1.1     rmind 			if (error)
    150   1.1     rmind 				break;
    151   1.1     rmind 		}
    152   1.1     rmind 		prop_object_iterator_release(eit);
    153   1.1     rmind 		if (error)
    154   1.1     rmind 			break;
    155   1.1     rmind 	}
    156   1.1     rmind 	prop_object_iterator_release(it);
    157   1.1     rmind 	/*
    158   1.4     rmind 	 * Note: in a case of error, caller will free the tableset.
    159   1.1     rmind 	 */
    160   1.1     rmind 	return error;
    161   1.1     rmind }
    162   1.1     rmind 
    163   1.5     rmind static npf_rproc_t *
    164  1.21     rmind npf_mk_singlerproc(prop_dictionary_t rpdict)
    165   1.5     rmind {
    166   1.5     rmind 	prop_object_iterator_t it;
    167  1.21     rmind 	prop_dictionary_t extdict;
    168  1.18     rmind 	prop_array_t extlist;
    169   1.5     rmind 	npf_rproc_t *rp;
    170  1.18     rmind 
    171  1.18     rmind 	extlist = prop_dictionary_get(rpdict, "extcalls");
    172  1.18     rmind 	if (prop_object_type(extlist) != PROP_TYPE_ARRAY) {
    173  1.18     rmind 		return NULL;
    174  1.18     rmind 	}
    175  1.18     rmind 
    176  1.18     rmind 	rp = npf_rproc_create(rpdict);
    177  1.21     rmind 	if (rp == NULL) {
    178  1.18     rmind 		return NULL;
    179  1.18     rmind 	}
    180  1.21     rmind 
    181  1.18     rmind 	it = prop_array_iterator(extlist);
    182  1.18     rmind 	while ((extdict = prop_object_iterator_next(it)) != NULL) {
    183  1.21     rmind 		const char *name;
    184  1.21     rmind 
    185  1.18     rmind 		if (!prop_dictionary_get_cstring_nocopy(extdict,
    186  1.18     rmind 		    "name", &name) || npf_ext_construct(name, rp, extdict)) {
    187  1.18     rmind 			npf_rproc_release(rp);
    188  1.18     rmind 			rp = NULL;
    189  1.18     rmind 			break;
    190  1.18     rmind 		}
    191  1.18     rmind 	}
    192  1.18     rmind 	prop_object_iterator_release(it);
    193  1.21     rmind 	return rp;
    194  1.21     rmind }
    195  1.21     rmind 
    196  1.21     rmind static int __noinline
    197  1.21     rmind npf_mk_rprocs(npf_rprocset_t *rpset, prop_array_t rprocs,
    198  1.21     rmind     prop_dictionary_t errdict)
    199  1.21     rmind {
    200  1.21     rmind 	prop_object_iterator_t it;
    201  1.21     rmind 	prop_dictionary_t rpdict;
    202  1.21     rmind 	int error = 0;
    203  1.21     rmind 
    204  1.21     rmind 	it = prop_array_iterator(rprocs);
    205  1.21     rmind 	while ((rpdict = prop_object_iterator_next(it)) != NULL) {
    206  1.21     rmind 		npf_rproc_t *rp;
    207  1.18     rmind 
    208  1.21     rmind 		if ((rp = npf_mk_singlerproc(rpdict)) == NULL) {
    209  1.21     rmind 			NPF_ERR_DEBUG(errdict);
    210  1.21     rmind 			error = EINVAL;
    211  1.21     rmind 			break;
    212  1.21     rmind 		}
    213  1.21     rmind 		npf_rprocset_insert(rpset, rp);
    214   1.5     rmind 	}
    215  1.21     rmind 	prop_object_iterator_release(it);
    216  1.21     rmind 	return error;
    217   1.5     rmind }
    218   1.5     rmind 
    219  1.24  christos static npf_alg_t *
    220  1.24  christos npf_mk_singlealg(prop_dictionary_t aldict)
    221  1.24  christos {
    222  1.24  christos 	const char *name;
    223  1.24  christos 
    224  1.24  christos 	if (!prop_dictionary_get_cstring_nocopy(aldict, "name", &name))
    225  1.24  christos 		return NULL;
    226  1.24  christos 	return npf_alg_construct(name);
    227  1.24  christos }
    228  1.24  christos 
    229  1.24  christos static int __noinline
    230  1.24  christos npf_mk_algs(prop_array_t alglist, prop_dictionary_t errdict)
    231  1.24  christos {
    232  1.24  christos 	prop_object_iterator_t it;
    233  1.24  christos 	prop_dictionary_t nadict;
    234  1.24  christos 	int error = 0;
    235  1.24  christos 
    236  1.24  christos 	it = prop_array_iterator(alglist);
    237  1.24  christos 	while ((nadict = prop_object_iterator_next(it)) != NULL) {
    238  1.24  christos 		if (npf_mk_singlealg(nadict) == NULL) {
    239  1.24  christos 			NPF_ERR_DEBUG(errdict);
    240  1.24  christos 			error = EINVAL;
    241  1.24  christos 			break;
    242  1.24  christos 		}
    243  1.24  christos 	}
    244  1.24  christos 	prop_object_iterator_release(it);
    245  1.24  christos 	return error;
    246  1.24  christos }
    247  1.24  christos 
    248   1.6     rmind static int __noinline
    249  1.21     rmind npf_mk_code(prop_object_t obj, int type, void **code, size_t *csize,
    250  1.12     rmind     prop_dictionary_t errdict)
    251  1.12     rmind {
    252  1.21     rmind 	const void *cptr;
    253  1.21     rmind 	int cerr, errat;
    254  1.21     rmind 	size_t clen;
    255  1.21     rmind 	void *bc;
    256  1.12     rmind 
    257  1.21     rmind 	cptr = prop_data_data_nocopy(obj);
    258  1.21     rmind 	if (cptr == NULL || (clen = prop_data_size(obj)) == 0) {
    259  1.12     rmind 		NPF_ERR_DEBUG(errdict);
    260  1.21     rmind 		return EINVAL;
    261  1.12     rmind 	}
    262  1.21     rmind 
    263  1.21     rmind 	switch (type) {
    264  1.21     rmind 	case NPF_CODE_NC:
    265  1.21     rmind 		if (clen > NPF_NCODE_LIMIT) {
    266  1.21     rmind 			NPF_ERR_DEBUG(errdict);
    267  1.21     rmind 			return ERANGE;
    268  1.21     rmind 		}
    269  1.21     rmind 		if ((cerr = npf_ncode_validate(cptr, clen, &errat)) != 0) {
    270  1.21     rmind 			prop_dictionary_set_int32(errdict, "code-error", cerr);
    271  1.21     rmind 			prop_dictionary_set_int32(errdict, "code-errat", errat);
    272  1.21     rmind 			return EINVAL;
    273  1.21     rmind 		}
    274  1.21     rmind 		break;
    275  1.21     rmind 	case NPF_CODE_BPF:
    276  1.27     rmind 		if (!bpf_validate(cptr, clen / sizeof(struct bpf_insn))) {
    277  1.21     rmind 			return EINVAL;
    278  1.21     rmind 		}
    279  1.21     rmind 		break;
    280  1.21     rmind 	default:
    281  1.21     rmind 		return ENOTSUP;
    282  1.12     rmind 	}
    283  1.21     rmind 
    284  1.21     rmind 	bc = kmem_alloc(clen, KM_SLEEP);
    285  1.21     rmind 	memcpy(bc, cptr, clen);
    286  1.21     rmind 
    287  1.21     rmind 	*code = bc;
    288  1.21     rmind 	*csize = clen;
    289  1.12     rmind 	return 0;
    290  1.12     rmind }
    291  1.12     rmind 
    292  1.12     rmind static int __noinline
    293  1.21     rmind npf_mk_singlerule(prop_dictionary_t rldict, npf_rprocset_t *rpset,
    294  1.21     rmind     npf_rule_t **rlret, prop_dictionary_t errdict)
    295   1.1     rmind {
    296  1.21     rmind 	npf_rule_t *rl;
    297  1.21     rmind 	const char *rname;
    298   1.1     rmind 	prop_object_t obj;
    299  1.21     rmind 	int p, error = 0;
    300   1.1     rmind 
    301   1.1     rmind 	/* Rule - dictionary. */
    302  1.12     rmind 	if (prop_object_type(rldict) != PROP_TYPE_DICTIONARY) {
    303  1.12     rmind 		NPF_ERR_DEBUG(errdict);
    304   1.1     rmind 		return EINVAL;
    305  1.12     rmind 	}
    306  1.21     rmind 	if ((rl = npf_rule_alloc(rldict)) == NULL) {
    307  1.21     rmind 		NPF_ERR_DEBUG(errdict);
    308  1.21     rmind 		return EINVAL;
    309  1.21     rmind 	}
    310   1.1     rmind 
    311  1.21     rmind 	/* Assign rule procedure, if any. */
    312  1.21     rmind 	if (prop_dictionary_get_cstring_nocopy(rldict, "rproc", &rname)) {
    313  1.21     rmind 		npf_rproc_t *rp;
    314  1.21     rmind 
    315  1.21     rmind 		if (rpset == NULL) {
    316  1.21     rmind 			error = EINVAL;
    317  1.21     rmind 			goto err;
    318  1.21     rmind 		}
    319  1.21     rmind 		if ((rp = npf_rprocset_lookup(rpset, rname)) == NULL) {
    320  1.18     rmind 			NPF_ERR_DEBUG(errdict);
    321  1.18     rmind 			error = EINVAL;
    322  1.18     rmind 			goto err;
    323  1.18     rmind 		}
    324  1.21     rmind 		npf_rule_setrproc(rl, rp);
    325  1.18     rmind 	}
    326  1.18     rmind 
    327  1.21     rmind 	/* Filter code (binary data). */
    328  1.21     rmind 	if ((obj = prop_dictionary_get(rldict, "code")) != NULL) {
    329  1.21     rmind 		int type;
    330  1.21     rmind 		size_t len;
    331  1.21     rmind 		void *code;
    332  1.21     rmind 
    333  1.21     rmind 		prop_dictionary_get_int32(rldict, "code-type", &type);
    334  1.21     rmind 		error = npf_mk_code(obj, type, &code, &len, errdict);
    335  1.12     rmind 		if (error) {
    336  1.12     rmind 			goto err;
    337   1.4     rmind 		}
    338  1.21     rmind 		npf_rule_setcode(rl, type, code, len);
    339   1.1     rmind 	}
    340   1.1     rmind 
    341  1.21     rmind 	*rlret = rl;
    342   1.6     rmind 	return 0;
    343  1.12     rmind err:
    344  1.21     rmind 	npf_rule_free(rl);
    345  1.12     rmind 	prop_dictionary_get_int32(rldict, "priority", &p); /* XXX */
    346  1.12     rmind 	prop_dictionary_set_int32(errdict, "id", p);
    347  1.12     rmind 	return error;
    348   1.6     rmind }
    349   1.6     rmind 
    350   1.6     rmind static int __noinline
    351  1.21     rmind npf_mk_rules(npf_ruleset_t *rlset, prop_array_t rules, npf_rprocset_t *rpset,
    352  1.12     rmind     prop_dictionary_t errdict)
    353   1.6     rmind {
    354   1.6     rmind 	prop_object_iterator_t it;
    355   1.6     rmind 	prop_dictionary_t rldict;
    356  1.21     rmind 	int error;
    357   1.6     rmind 
    358   1.6     rmind 	if (prop_object_type(rules) != PROP_TYPE_ARRAY) {
    359  1.12     rmind 		NPF_ERR_DEBUG(errdict);
    360   1.6     rmind 		return EINVAL;
    361   1.6     rmind 	}
    362   1.5     rmind 
    363   1.4     rmind 	error = 0;
    364   1.1     rmind 	it = prop_array_iterator(rules);
    365   1.1     rmind 	while ((rldict = prop_object_iterator_next(it)) != NULL) {
    366  1.21     rmind 		npf_rule_t *rl = NULL;
    367   1.1     rmind 
    368   1.1     rmind 		/* Generate a single rule. */
    369  1.21     rmind 		error = npf_mk_singlerule(rldict, rpset, &rl, errdict);
    370   1.6     rmind 		if (error) {
    371   1.1     rmind 			break;
    372   1.6     rmind 		}
    373   1.6     rmind 		npf_ruleset_insert(rlset, rl);
    374   1.1     rmind 	}
    375   1.1     rmind 	prop_object_iterator_release(it);
    376   1.1     rmind 	/*
    377   1.4     rmind 	 * Note: in a case of error, caller will free the ruleset.
    378   1.1     rmind 	 */
    379   1.1     rmind 	return error;
    380   1.1     rmind }
    381   1.1     rmind 
    382   1.6     rmind static int __noinline
    383  1.12     rmind npf_mk_natlist(npf_ruleset_t *nset, prop_array_t natlist,
    384  1.12     rmind     prop_dictionary_t errdict)
    385   1.1     rmind {
    386   1.1     rmind 	prop_object_iterator_t it;
    387   1.1     rmind 	prop_dictionary_t natdict;
    388   1.1     rmind 	int error;
    389   1.1     rmind 
    390   1.1     rmind 	/* NAT policies - array. */
    391  1.12     rmind 	if (prop_object_type(natlist) != PROP_TYPE_ARRAY) {
    392  1.12     rmind 		NPF_ERR_DEBUG(errdict);
    393   1.1     rmind 		return EINVAL;
    394  1.12     rmind 	}
    395   1.1     rmind 
    396   1.4     rmind 	error = 0;
    397   1.1     rmind 	it = prop_array_iterator(natlist);
    398   1.1     rmind 	while ((natdict = prop_object_iterator_next(it)) != NULL) {
    399  1.21     rmind 		npf_rule_t *rl = NULL;
    400   1.1     rmind 		npf_natpolicy_t *np;
    401   1.1     rmind 
    402   1.1     rmind 		/* NAT policy - dictionary. */
    403   1.1     rmind 		if (prop_object_type(natdict) != PROP_TYPE_DICTIONARY) {
    404  1.12     rmind 			NPF_ERR_DEBUG(errdict);
    405   1.1     rmind 			error = EINVAL;
    406   1.1     rmind 			break;
    407   1.1     rmind 		}
    408   1.1     rmind 
    409   1.1     rmind 		/*
    410   1.1     rmind 		 * NAT policies are standard rules, plus additional
    411   1.1     rmind 		 * information for translation.  Make a rule.
    412   1.1     rmind 		 */
    413  1.12     rmind 		error = npf_mk_singlerule(natdict, NULL, &rl, errdict);
    414   1.6     rmind 		if (error) {
    415   1.1     rmind 			break;
    416   1.6     rmind 		}
    417   1.6     rmind 		npf_ruleset_insert(nset, rl);
    418   1.6     rmind 
    419   1.6     rmind 		/* If rule is named, it is a group with NAT policies. */
    420   1.6     rmind 		if (prop_dictionary_get(natdict, "name") &&
    421   1.6     rmind 		    prop_dictionary_get(natdict, "subrules")) {
    422   1.6     rmind 			continue;
    423   1.6     rmind 		}
    424   1.1     rmind 
    425   1.1     rmind 		/* Allocate a new NAT policy and assign to the rule. */
    426   1.5     rmind 		np = npf_nat_newpolicy(natdict, nset);
    427   1.1     rmind 		if (np == NULL) {
    428  1.12     rmind 			NPF_ERR_DEBUG(errdict);
    429   1.1     rmind 			error = ENOMEM;
    430   1.1     rmind 			break;
    431   1.1     rmind 		}
    432   1.1     rmind 		npf_rule_setnat(rl, np);
    433   1.1     rmind 	}
    434   1.1     rmind 	prop_object_iterator_release(it);
    435   1.1     rmind 	/*
    436   1.1     rmind 	 * Note: in a case of error, caller will free entire NAT ruleset
    437   1.1     rmind 	 * with assigned NAT policies.
    438   1.1     rmind 	 */
    439   1.1     rmind 	return error;
    440   1.1     rmind }
    441   1.1     rmind 
    442   1.1     rmind /*
    443   1.1     rmind  * npfctl_reload: store passed data i.e. update settings, create passed
    444   1.1     rmind  * tables, rules and atomically activate all them.
    445   1.1     rmind  */
    446   1.1     rmind int
    447   1.1     rmind npfctl_reload(u_long cmd, void *data)
    448   1.1     rmind {
    449  1.12     rmind 	struct plistref *pref = data;
    450  1.14     rmind 	prop_dictionary_t npf_dict, errdict;
    451  1.24  christos 	prop_array_t alglist, natlist, tables, rprocs, rules;
    452   1.1     rmind 	npf_tableset_t *tblset = NULL;
    453  1.21     rmind 	npf_rprocset_t *rpset = NULL;
    454   1.1     rmind 	npf_ruleset_t *rlset = NULL;
    455   1.1     rmind 	npf_ruleset_t *nset = NULL;
    456  1.20     rmind 	uint32_t ver = 0;
    457  1.21     rmind 	size_t nitems;
    458  1.11     rmind 	bool flush;
    459   1.1     rmind 	int error;
    460   1.1     rmind 
    461   1.1     rmind 	/* Retrieve the dictionary. */
    462  1.15     rmind #ifndef _NPF_TESTING
    463  1.14     rmind 	error = prop_dictionary_copyin_ioctl(pref, cmd, &npf_dict);
    464   1.1     rmind 	if (error)
    465   1.1     rmind 		return error;
    466   1.1     rmind #else
    467  1.15     rmind 	npf_dict = (prop_dictionary_t)pref;
    468   1.1     rmind #endif
    469  1.15     rmind 
    470  1.20     rmind 	/* Dictionary for error reporting and version check. */
    471  1.12     rmind 	errdict = prop_dictionary_create();
    472  1.20     rmind 	prop_dictionary_get_uint32(npf_dict, "version", &ver);
    473  1.20     rmind 	if (ver != NPF_VERSION) {
    474  1.20     rmind 		error = EPROGMISMATCH;
    475  1.20     rmind 		goto fail;
    476  1.20     rmind 	}
    477  1.12     rmind 
    478  1.24  christos 	/* ALGs. */
    479  1.24  christos 	alglist = prop_dictionary_get(npf_dict, "algs");
    480  1.24  christos 	error = npf_mk_algs(alglist, errdict);
    481  1.24  christos 	if (error) {
    482  1.24  christos 		goto fail;
    483  1.24  christos 	}
    484  1.24  christos 
    485   1.1     rmind 	/* NAT policies. */
    486  1.14     rmind 	natlist = prop_dictionary_get(npf_dict, "translation");
    487  1.21     rmind 	nitems = prop_array_count(natlist);
    488  1.21     rmind 
    489  1.21     rmind 	nset = npf_ruleset_create(nitems);
    490  1.12     rmind 	error = npf_mk_natlist(nset, natlist, errdict);
    491  1.10     rmind 	if (error) {
    492   1.1     rmind 		goto fail;
    493  1.10     rmind 	}
    494   1.1     rmind 
    495   1.1     rmind 	/* Tables. */
    496   1.1     rmind 	tblset = npf_tableset_create();
    497  1.14     rmind 	tables = prop_dictionary_get(npf_dict, "tables");
    498  1.12     rmind 	error = npf_mk_tables(tblset, tables, errdict);
    499  1.10     rmind 	if (error) {
    500   1.1     rmind 		goto fail;
    501  1.10     rmind 	}
    502   1.1     rmind 
    503  1.21     rmind 	/* Rule procedures. */
    504  1.21     rmind 	rpset = npf_rprocset_create();
    505  1.14     rmind 	rprocs = prop_dictionary_get(npf_dict, "rprocs");
    506  1.21     rmind 	error = npf_mk_rprocs(rpset, rprocs, errdict);
    507  1.21     rmind 	if (error) {
    508  1.21     rmind 		goto fail;
    509  1.21     rmind 	}
    510  1.21     rmind 
    511  1.21     rmind 	/* Rules. */
    512  1.14     rmind 	rules = prop_dictionary_get(npf_dict, "rules");
    513  1.21     rmind 	nitems = prop_array_count(rules);
    514  1.21     rmind 
    515  1.21     rmind 	rlset = npf_ruleset_create(nitems);
    516  1.21     rmind 	error = npf_mk_rules(rlset, rules, rpset, errdict);
    517  1.10     rmind 	if (error) {
    518   1.1     rmind 		goto fail;
    519  1.10     rmind 	}
    520   1.1     rmind 
    521  1.11     rmind 	flush = false;
    522  1.14     rmind 	prop_dictionary_get_bool(npf_dict, "flush", &flush);
    523  1.11     rmind 
    524   1.1     rmind 	/*
    525  1.21     rmind 	 * Finally - perform the reload.
    526   1.1     rmind 	 */
    527  1.21     rmind 	npf_config_reload(npf_dict, rlset, tblset, nset, rpset, flush);
    528   1.1     rmind 
    529  1.11     rmind 	/* Turn on/off session tracking accordingly. */
    530  1.11     rmind 	npf_session_tracking(!flush);
    531  1.11     rmind 
    532   1.1     rmind 	/* Done.  Since data is consumed now, we shall not destroy it. */
    533   1.1     rmind 	tblset = NULL;
    534  1.21     rmind 	rpset = NULL;
    535   1.1     rmind 	rlset = NULL;
    536   1.1     rmind 	nset = NULL;
    537   1.1     rmind fail:
    538   1.1     rmind 	/*
    539   1.1     rmind 	 * Note: destroy rulesets first, to drop references to the tableset.
    540   1.1     rmind 	 */
    541  1.21     rmind 	KASSERT(error == 0 || (nset || rpset || rlset || tblset));
    542   1.1     rmind 	if (nset) {
    543   1.1     rmind 		npf_ruleset_destroy(nset);
    544   1.1     rmind 	}
    545   1.1     rmind 	if (rlset) {
    546   1.1     rmind 		npf_ruleset_destroy(rlset);
    547   1.1     rmind 	}
    548  1.21     rmind 	if (rpset) {
    549  1.21     rmind 		npf_rprocset_destroy(rpset);
    550  1.21     rmind 	}
    551   1.1     rmind 	if (tblset) {
    552   1.1     rmind 		npf_tableset_destroy(tblset);
    553   1.1     rmind 	}
    554  1.14     rmind 	if (error) {
    555  1.14     rmind 		prop_object_release(npf_dict);
    556  1.14     rmind 	}
    557  1.12     rmind 
    558  1.12     rmind 	/* Error report. */
    559  1.18     rmind #ifndef _NPF_TESTING
    560  1.12     rmind 	prop_dictionary_set_int32(errdict, "errno", error);
    561  1.12     rmind 	prop_dictionary_copyout_ioctl(pref, cmd, errdict);
    562  1.18     rmind 	prop_object_release(errdict);
    563  1.18     rmind 	error = 0;
    564  1.13     rmind #endif
    565  1.18     rmind 	return error;
    566   1.6     rmind }
    567   1.6     rmind 
    568  1.21     rmind /*
    569  1.21     rmind  * npfctl_rule: add or remove dynamic rules in the specified ruleset.
    570  1.21     rmind  */
    571  1.14     rmind int
    572  1.21     rmind npfctl_rule(u_long cmd, void *data)
    573  1.14     rmind {
    574  1.14     rmind 	struct plistref *pref = data;
    575  1.21     rmind 	prop_dictionary_t npf_rule, retdict = NULL;
    576  1.21     rmind 	npf_ruleset_t *rlset;
    577  1.21     rmind 	npf_rule_t *rl = NULL;
    578  1.21     rmind 	const char *ruleset_name;
    579  1.21     rmind 	uint32_t rcmd = 0;
    580  1.14     rmind 	int error;
    581  1.14     rmind 
    582  1.21     rmind 	error = prop_dictionary_copyin_ioctl(pref, cmd, &npf_rule);
    583  1.21     rmind 	if (error) {
    584  1.21     rmind 		return error;
    585  1.21     rmind 	}
    586  1.21     rmind 	prop_dictionary_get_uint32(npf_rule, "command", &rcmd);
    587  1.21     rmind 	if (!prop_dictionary_get_cstring_nocopy(npf_rule,
    588  1.21     rmind 	    "ruleset-name", &ruleset_name)) {
    589  1.27     rmind 		error = EINVAL;
    590  1.27     rmind 		goto out;
    591  1.21     rmind 	}
    592  1.21     rmind 
    593  1.21     rmind 	if (rcmd == NPF_CMD_RULE_ADD) {
    594  1.27     rmind 		retdict = prop_dictionary_create();
    595  1.27     rmind 		if (npf_mk_singlerule(npf_rule, NULL, &rl, retdict) != 0) {
    596  1.27     rmind 			error = EINVAL;
    597  1.27     rmind 			goto out;
    598  1.21     rmind 		}
    599  1.21     rmind 	}
    600  1.21     rmind 
    601  1.21     rmind 	npf_config_enter();
    602  1.21     rmind 	rlset = npf_config_ruleset();
    603  1.21     rmind 
    604  1.21     rmind 	switch (rcmd) {
    605  1.21     rmind 	case NPF_CMD_RULE_ADD: {
    606  1.21     rmind 		if ((error = npf_ruleset_add(rlset, ruleset_name, rl)) == 0) {
    607  1.21     rmind 			/* Success. */
    608  1.23     rmind 			uint64_t id = npf_rule_getid(rl);
    609  1.23     rmind 			prop_dictionary_set_uint64(retdict, "id", id);
    610  1.21     rmind 			rl = NULL;
    611  1.21     rmind 		}
    612  1.21     rmind 		break;
    613  1.21     rmind 	}
    614  1.21     rmind 	case NPF_CMD_RULE_REMOVE: {
    615  1.23     rmind 		uint64_t id;
    616  1.21     rmind 
    617  1.23     rmind 		if (!prop_dictionary_get_uint64(npf_rule, "id", &id)) {
    618  1.21     rmind 			error = EINVAL;
    619  1.21     rmind 			break;
    620  1.21     rmind 		}
    621  1.23     rmind 		error = npf_ruleset_remove(rlset, ruleset_name, id);
    622  1.21     rmind 		break;
    623  1.21     rmind 	}
    624  1.21     rmind 	case NPF_CMD_RULE_REMKEY: {
    625  1.21     rmind 		prop_object_t obj = prop_dictionary_get(npf_rule, "key");
    626  1.21     rmind 		const void *key = prop_data_data_nocopy(obj);
    627  1.21     rmind 		size_t len = prop_data_size(obj);
    628  1.21     rmind 
    629  1.21     rmind 		if (len == 0 || len > NPF_RULE_MAXKEYLEN) {
    630  1.21     rmind 			error = EINVAL;
    631  1.21     rmind 			break;
    632  1.21     rmind 		}
    633  1.22     rmind 		error = npf_ruleset_remkey(rlset, ruleset_name, key, len);
    634  1.22     rmind 		break;
    635  1.22     rmind 	}
    636  1.22     rmind 	case NPF_CMD_RULE_LIST: {
    637  1.22     rmind 		retdict = npf_ruleset_list(rlset, ruleset_name);
    638  1.22     rmind 		break;
    639  1.22     rmind 	}
    640  1.22     rmind 	case NPF_CMD_RULE_FLUSH: {
    641  1.22     rmind 		error = npf_ruleset_flush(rlset, ruleset_name);
    642  1.21     rmind 		break;
    643  1.21     rmind 	}
    644  1.21     rmind 	default:
    645  1.21     rmind 		error = EINVAL;
    646  1.21     rmind 		break;
    647  1.21     rmind 	}
    648  1.22     rmind 
    649  1.22     rmind 	/* Destroy any removed rules. */
    650  1.22     rmind 	if (!error && rcmd != NPF_CMD_RULE_ADD && rcmd != NPF_CMD_RULE_LIST) {
    651  1.22     rmind 		npf_config_sync();
    652  1.22     rmind 		npf_ruleset_gc(rlset);
    653  1.22     rmind 	}
    654  1.21     rmind 	npf_config_exit();
    655  1.14     rmind 
    656  1.21     rmind 	if (rl) {
    657  1.21     rmind 		npf_rule_free(rl);
    658  1.21     rmind 	}
    659  1.27     rmind out:
    660  1.21     rmind 	if (retdict) {
    661  1.21     rmind 		prop_object_release(npf_rule);
    662  1.21     rmind 		prop_dictionary_copyout_ioctl(pref, cmd, retdict);
    663  1.21     rmind 		prop_object_release(retdict);
    664  1.21     rmind 	}
    665  1.14     rmind 	return error;
    666  1.14     rmind }
    667  1.14     rmind 
    668   1.6     rmind /*
    669  1.21     rmind  * npfctl_getconf: return the config dictionary as it was submitted.
    670  1.21     rmind  * Additionally, indicate whether the ruleset is currently active.
    671   1.6     rmind  */
    672   1.6     rmind int
    673  1.21     rmind npfctl_getconf(u_long cmd, void *data)
    674   1.6     rmind {
    675  1.12     rmind 	struct plistref *pref = data;
    676  1.21     rmind 	prop_dictionary_t npf_dict;
    677   1.6     rmind 	int error;
    678   1.6     rmind 
    679  1.21     rmind 	npf_config_enter();
    680  1.21     rmind 	npf_dict = npf_config_dict();
    681  1.21     rmind 	prop_dictionary_set_bool(npf_dict, "active", npf_pfil_registered_p());
    682  1.21     rmind 	error = prop_dictionary_copyout_ioctl(pref, cmd, npf_dict);
    683  1.21     rmind 	npf_config_exit();
    684  1.12     rmind 
    685   1.1     rmind 	return error;
    686   1.1     rmind }
    687   1.1     rmind 
    688   1.1     rmind /*
    689   1.4     rmind  * npfctl_sessions_save: construct a list of sessions and export for saving.
    690   1.4     rmind  */
    691   1.4     rmind int
    692   1.4     rmind npfctl_sessions_save(u_long cmd, void *data)
    693   1.4     rmind {
    694   1.4     rmind 	struct plistref *pref = data;
    695   1.4     rmind 	prop_dictionary_t sesdict;
    696   1.4     rmind 	prop_array_t selist, nplist;
    697   1.4     rmind 	int error;
    698   1.4     rmind 
    699   1.4     rmind 	/* Create a dictionary and two lists. */
    700   1.4     rmind 	sesdict = prop_dictionary_create();
    701   1.4     rmind 	selist = prop_array_create();
    702   1.4     rmind 	nplist = prop_array_create();
    703   1.4     rmind 
    704   1.4     rmind 	/* Save the sessions. */
    705   1.4     rmind 	error = npf_session_save(selist, nplist);
    706   1.4     rmind 	if (error) {
    707   1.4     rmind 		goto fail;
    708   1.4     rmind 	}
    709   1.4     rmind 
    710   1.4     rmind 	/* Set the session list, NAT policy list and export the dictionary. */
    711   1.4     rmind 	prop_dictionary_set(sesdict, "session-list", selist);
    712   1.4     rmind 	prop_dictionary_set(sesdict, "nat-policy-list", nplist);
    713   1.4     rmind 	error = prop_dictionary_copyout_ioctl(pref, cmd, sesdict);
    714   1.4     rmind fail:
    715   1.4     rmind 	prop_object_release(sesdict);
    716   1.4     rmind 	return error;
    717   1.4     rmind }
    718   1.4     rmind 
    719   1.4     rmind /*
    720   1.4     rmind  * npfctl_sessions_load: import a list of sessions, reconstruct them and load.
    721   1.4     rmind  */
    722   1.4     rmind int
    723   1.4     rmind npfctl_sessions_load(u_long cmd, void *data)
    724   1.4     rmind {
    725   1.4     rmind 	const struct plistref *pref = data;
    726   1.4     rmind 	npf_sehash_t *sehasht = NULL;
    727   1.4     rmind 	prop_dictionary_t sesdict, sedict;
    728   1.4     rmind 	prop_object_iterator_t it;
    729   1.4     rmind 	prop_array_t selist;
    730   1.4     rmind 	int error;
    731   1.4     rmind 
    732   1.4     rmind 	/* Retrieve the dictionary containing session and NAT policy lists. */
    733   1.4     rmind 	error = prop_dictionary_copyin_ioctl(pref, cmd, &sesdict);
    734   1.4     rmind 	if (error)
    735   1.4     rmind 		return error;
    736  1.15     rmind 
    737   1.4     rmind 	/*
    738   1.4     rmind 	 * Note: session objects contain the references to the NAT policy
    739   1.4     rmind 	 * entries.  Therefore, no need to directly access it.
    740   1.4     rmind 	 */
    741   1.4     rmind 	selist = prop_dictionary_get(sesdict, "session-list");
    742   1.4     rmind 	if (prop_object_type(selist) != PROP_TYPE_ARRAY) {
    743  1.21     rmind 		prop_object_release(selist);
    744  1.21     rmind 		return EINVAL;
    745   1.4     rmind 	}
    746   1.4     rmind 
    747   1.4     rmind 	/* Create a session hash table. */
    748   1.4     rmind 	sehasht = sess_htable_create();
    749   1.4     rmind 
    750   1.4     rmind 	/*
    751  1.21     rmind 	 * Iterate through and construct each session.  Note: acquire the
    752  1.21     rmind 	 * config lock as we access NAT policies during the restore.
    753   1.4     rmind 	 */
    754   1.4     rmind 	error = 0;
    755  1.26     rmind 	it = prop_array_iterator(selist);
    756  1.26     rmind 
    757  1.21     rmind 	npf_config_enter();
    758   1.4     rmind 	while ((sedict = prop_object_iterator_next(it)) != NULL) {
    759   1.4     rmind 		/* Session - dictionary. */
    760   1.4     rmind 		if (prop_object_type(sedict) != PROP_TYPE_DICTIONARY) {
    761   1.4     rmind 			error = EINVAL;
    762  1.26     rmind 			break;
    763   1.4     rmind 		}
    764   1.4     rmind 		/* Construct and insert real session structure. */
    765   1.4     rmind 		error = npf_session_restore(sehasht, sedict);
    766   1.4     rmind 		if (error) {
    767  1.26     rmind 			break;
    768   1.4     rmind 		}
    769   1.4     rmind 	}
    770  1.21     rmind 	npf_config_exit();
    771  1.26     rmind 
    772  1.21     rmind 	prop_object_iterator_release(it);
    773   1.4     rmind 	prop_object_release(selist);
    774  1.26     rmind 
    775  1.26     rmind 	if (!error) {
    776  1.26     rmind 		/* Finally, load the new table. */
    777  1.26     rmind 		npf_session_load(sehasht);
    778  1.26     rmind 	} else {
    779   1.4     rmind 		/* Destroy session table. */
    780   1.4     rmind 		sess_htable_destroy(sehasht);
    781   1.4     rmind 	}
    782   1.4     rmind 	return error;
    783   1.4     rmind }
    784   1.4     rmind 
    785   1.4     rmind /*
    786   1.2     rmind  * npfctl_table: add, remove or query entries in the specified table.
    787   1.1     rmind  *
    788   1.1     rmind  * For maximum performance, interface is avoiding proplib(3)'s overhead.
    789   1.1     rmind  */
    790   1.1     rmind int
    791   1.1     rmind npfctl_table(void *data)
    792   1.1     rmind {
    793  1.19     rmind 	const npf_ioctl_table_t *nct = data;
    794  1.10     rmind 	npf_tableset_t *tblset;
    795   1.1     rmind 	int error;
    796   1.1     rmind 
    797  1.21     rmind 	//npf_config_ref();
    798  1.21     rmind 	tblset = npf_config_tableset();
    799  1.21     rmind 
    800  1.21     rmind 	switch (nct->nct_cmd) {
    801  1.21     rmind 	case NPF_CMD_TABLE_LOOKUP:
    802  1.19     rmind 		error = npf_table_lookup(tblset, nct->nct_tid,
    803  1.19     rmind 		    nct->nct_data.ent.alen, &nct->nct_data.ent.addr);
    804  1.20     rmind 		break;
    805  1.21     rmind 	case NPF_CMD_TABLE_ADD:
    806  1.16     rmind 		error = npf_table_insert(tblset, nct->nct_tid,
    807  1.19     rmind 		    nct->nct_data.ent.alen, &nct->nct_data.ent.addr,
    808  1.19     rmind 		    nct->nct_data.ent.mask);
    809   1.1     rmind 		break;
    810  1.21     rmind 	case NPF_CMD_TABLE_REMOVE:
    811  1.16     rmind 		error = npf_table_remove(tblset, nct->nct_tid,
    812  1.19     rmind 		    nct->nct_data.ent.alen, &nct->nct_data.ent.addr,
    813  1.19     rmind 		    nct->nct_data.ent.mask);
    814  1.19     rmind 		break;
    815  1.21     rmind 	case NPF_CMD_TABLE_LIST:
    816  1.19     rmind 		error = npf_table_list(tblset, nct->nct_tid,
    817  1.19     rmind 		    nct->nct_data.buf.buf, nct->nct_data.buf.len);
    818   1.1     rmind 		break;
    819  1.25     rmind 	case NPF_CMD_TABLE_FLUSH:
    820  1.25     rmind 		error = npf_table_flush(tblset, nct->nct_tid);
    821  1.25     rmind 		break;
    822   1.1     rmind 	default:
    823  1.19     rmind 		error = EINVAL;
    824  1.19     rmind 		break;
    825   1.1     rmind 	}
    826  1.21     rmind 	//npf_config_unref();
    827  1.21     rmind 
    828   1.1     rmind 	return error;
    829   1.1     rmind }
    830