npf_ctl.c revision 1.27 1 1.27 rmind /* $NetBSD: npf_ctl.c,v 1.27 2013/09/19 00:50:56 rmind Exp $ */
2 1.1 rmind
3 1.1 rmind /*-
4 1.21 rmind * Copyright (c) 2009-2013 The NetBSD Foundation, Inc.
5 1.1 rmind * All rights reserved.
6 1.1 rmind *
7 1.1 rmind * This material is based upon work partially supported by The
8 1.1 rmind * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
9 1.1 rmind *
10 1.1 rmind * Redistribution and use in source and binary forms, with or without
11 1.1 rmind * modification, are permitted provided that the following conditions
12 1.1 rmind * are met:
13 1.1 rmind * 1. Redistributions of source code must retain the above copyright
14 1.1 rmind * notice, this list of conditions and the following disclaimer.
15 1.1 rmind * 2. Redistributions in binary form must reproduce the above copyright
16 1.1 rmind * notice, this list of conditions and the following disclaimer in the
17 1.1 rmind * documentation and/or other materials provided with the distribution.
18 1.1 rmind *
19 1.1 rmind * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20 1.1 rmind * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21 1.1 rmind * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22 1.1 rmind * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23 1.1 rmind * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24 1.1 rmind * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25 1.1 rmind * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26 1.1 rmind * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27 1.1 rmind * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28 1.1 rmind * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 1.1 rmind * POSSIBILITY OF SUCH DAMAGE.
30 1.1 rmind */
31 1.1 rmind
32 1.1 rmind /*
33 1.1 rmind * NPF device control.
34 1.1 rmind *
35 1.1 rmind * Implementation of (re)loading, construction of tables and rules.
36 1.1 rmind * NPF proplib(9) dictionary consumer.
37 1.1 rmind */
38 1.1 rmind
39 1.1 rmind #include <sys/cdefs.h>
40 1.27 rmind __KERNEL_RCSID(0, "$NetBSD: npf_ctl.c,v 1.27 2013/09/19 00:50:56 rmind Exp $");
41 1.1 rmind
42 1.1 rmind #include <sys/param.h>
43 1.1 rmind #include <sys/conf.h>
44 1.21 rmind #include <sys/kmem.h>
45 1.21 rmind #include <net/bpf.h>
46 1.1 rmind
47 1.1 rmind #include <prop/proplib.h>
48 1.1 rmind
49 1.1 rmind #include "npf_ncode.h"
50 1.1 rmind #include "npf_impl.h"
51 1.1 rmind
52 1.12 rmind #if defined(DEBUG) || defined(DIAGNOSTIC)
53 1.12 rmind #define NPF_ERR_DEBUG(e) \
54 1.12 rmind prop_dictionary_set_cstring_nocopy((e), "source-file", __FILE__); \
55 1.12 rmind prop_dictionary_set_uint32((e), "source-line", __LINE__);
56 1.12 rmind #else
57 1.12 rmind #define NPF_ERR_DEBUG(e)
58 1.12 rmind #endif
59 1.12 rmind
60 1.1 rmind /*
61 1.1 rmind * npfctl_switch: enable or disable packet inspection.
62 1.1 rmind */
63 1.1 rmind int
64 1.1 rmind npfctl_switch(void *data)
65 1.1 rmind {
66 1.1 rmind const bool onoff = *(int *)data ? true : false;
67 1.1 rmind int error;
68 1.1 rmind
69 1.1 rmind if (onoff) {
70 1.1 rmind /* Enable: add pfil hooks. */
71 1.14 rmind error = npf_pfil_register();
72 1.1 rmind } else {
73 1.1 rmind /* Disable: remove pfil hooks. */
74 1.14 rmind npf_pfil_unregister();
75 1.1 rmind error = 0;
76 1.1 rmind }
77 1.1 rmind return error;
78 1.1 rmind }
79 1.1 rmind
80 1.6 rmind static int __noinline
81 1.12 rmind npf_mk_tables(npf_tableset_t *tblset, prop_array_t tables,
82 1.12 rmind prop_dictionary_t errdict)
83 1.1 rmind {
84 1.1 rmind prop_object_iterator_t it;
85 1.1 rmind prop_dictionary_t tbldict;
86 1.1 rmind int error = 0;
87 1.1 rmind
88 1.1 rmind /* Tables - array. */
89 1.12 rmind if (prop_object_type(tables) != PROP_TYPE_ARRAY) {
90 1.12 rmind NPF_ERR_DEBUG(errdict);
91 1.1 rmind return EINVAL;
92 1.12 rmind }
93 1.1 rmind
94 1.1 rmind it = prop_array_iterator(tables);
95 1.1 rmind while ((tbldict = prop_object_iterator_next(it)) != NULL) {
96 1.1 rmind prop_dictionary_t ent;
97 1.1 rmind prop_object_iterator_t eit;
98 1.1 rmind prop_array_t entries;
99 1.1 rmind npf_table_t *t;
100 1.1 rmind u_int tid;
101 1.1 rmind int type;
102 1.1 rmind
103 1.1 rmind /* Table - dictionary. */
104 1.1 rmind if (prop_object_type(tbldict) != PROP_TYPE_DICTIONARY) {
105 1.12 rmind NPF_ERR_DEBUG(errdict);
106 1.1 rmind error = EINVAL;
107 1.1 rmind break;
108 1.1 rmind }
109 1.1 rmind
110 1.1 rmind /* Table ID and type. */
111 1.6 rmind prop_dictionary_get_uint32(tbldict, "id", &tid);
112 1.6 rmind prop_dictionary_get_int32(tbldict, "type", &type);
113 1.6 rmind
114 1.12 rmind /* Validate them, check for duplicate IDs. */
115 1.1 rmind error = npf_table_check(tblset, tid, type);
116 1.1 rmind if (error)
117 1.1 rmind break;
118 1.1 rmind
119 1.1 rmind /* Create and insert the table. */
120 1.1 rmind t = npf_table_create(tid, type, 1024); /* XXX */
121 1.1 rmind if (t == NULL) {
122 1.12 rmind NPF_ERR_DEBUG(errdict);
123 1.1 rmind error = ENOMEM;
124 1.1 rmind break;
125 1.1 rmind }
126 1.1 rmind error = npf_tableset_insert(tblset, t);
127 1.1 rmind KASSERT(error == 0);
128 1.1 rmind
129 1.1 rmind /* Entries. */
130 1.1 rmind entries = prop_dictionary_get(tbldict, "entries");
131 1.1 rmind if (prop_object_type(entries) != PROP_TYPE_ARRAY) {
132 1.12 rmind NPF_ERR_DEBUG(errdict);
133 1.1 rmind error = EINVAL;
134 1.1 rmind break;
135 1.1 rmind }
136 1.1 rmind eit = prop_array_iterator(entries);
137 1.1 rmind while ((ent = prop_object_iterator_next(eit)) != NULL) {
138 1.7 zoltan const npf_addr_t *addr;
139 1.9 rmind npf_netmask_t mask;
140 1.16 rmind int alen;
141 1.1 rmind
142 1.6 rmind /* Get address and mask. Add a table entry. */
143 1.16 rmind prop_object_t obj = prop_dictionary_get(ent, "addr");
144 1.16 rmind addr = (const npf_addr_t *)prop_data_data_nocopy(obj);
145 1.7 zoltan prop_dictionary_get_uint8(ent, "mask", &mask);
146 1.16 rmind alen = prop_data_size(obj);
147 1.16 rmind
148 1.16 rmind error = npf_table_insert(tblset, tid, alen, addr, mask);
149 1.1 rmind if (error)
150 1.1 rmind break;
151 1.1 rmind }
152 1.1 rmind prop_object_iterator_release(eit);
153 1.1 rmind if (error)
154 1.1 rmind break;
155 1.1 rmind }
156 1.1 rmind prop_object_iterator_release(it);
157 1.1 rmind /*
158 1.4 rmind * Note: in a case of error, caller will free the tableset.
159 1.1 rmind */
160 1.1 rmind return error;
161 1.1 rmind }
162 1.1 rmind
163 1.5 rmind static npf_rproc_t *
164 1.21 rmind npf_mk_singlerproc(prop_dictionary_t rpdict)
165 1.5 rmind {
166 1.5 rmind prop_object_iterator_t it;
167 1.21 rmind prop_dictionary_t extdict;
168 1.18 rmind prop_array_t extlist;
169 1.5 rmind npf_rproc_t *rp;
170 1.18 rmind
171 1.18 rmind extlist = prop_dictionary_get(rpdict, "extcalls");
172 1.18 rmind if (prop_object_type(extlist) != PROP_TYPE_ARRAY) {
173 1.18 rmind return NULL;
174 1.18 rmind }
175 1.18 rmind
176 1.18 rmind rp = npf_rproc_create(rpdict);
177 1.21 rmind if (rp == NULL) {
178 1.18 rmind return NULL;
179 1.18 rmind }
180 1.21 rmind
181 1.18 rmind it = prop_array_iterator(extlist);
182 1.18 rmind while ((extdict = prop_object_iterator_next(it)) != NULL) {
183 1.21 rmind const char *name;
184 1.21 rmind
185 1.18 rmind if (!prop_dictionary_get_cstring_nocopy(extdict,
186 1.18 rmind "name", &name) || npf_ext_construct(name, rp, extdict)) {
187 1.18 rmind npf_rproc_release(rp);
188 1.18 rmind rp = NULL;
189 1.18 rmind break;
190 1.18 rmind }
191 1.18 rmind }
192 1.18 rmind prop_object_iterator_release(it);
193 1.21 rmind return rp;
194 1.21 rmind }
195 1.21 rmind
196 1.21 rmind static int __noinline
197 1.21 rmind npf_mk_rprocs(npf_rprocset_t *rpset, prop_array_t rprocs,
198 1.21 rmind prop_dictionary_t errdict)
199 1.21 rmind {
200 1.21 rmind prop_object_iterator_t it;
201 1.21 rmind prop_dictionary_t rpdict;
202 1.21 rmind int error = 0;
203 1.21 rmind
204 1.21 rmind it = prop_array_iterator(rprocs);
205 1.21 rmind while ((rpdict = prop_object_iterator_next(it)) != NULL) {
206 1.21 rmind npf_rproc_t *rp;
207 1.18 rmind
208 1.21 rmind if ((rp = npf_mk_singlerproc(rpdict)) == NULL) {
209 1.21 rmind NPF_ERR_DEBUG(errdict);
210 1.21 rmind error = EINVAL;
211 1.21 rmind break;
212 1.21 rmind }
213 1.21 rmind npf_rprocset_insert(rpset, rp);
214 1.5 rmind }
215 1.21 rmind prop_object_iterator_release(it);
216 1.21 rmind return error;
217 1.5 rmind }
218 1.5 rmind
219 1.24 christos static npf_alg_t *
220 1.24 christos npf_mk_singlealg(prop_dictionary_t aldict)
221 1.24 christos {
222 1.24 christos const char *name;
223 1.24 christos
224 1.24 christos if (!prop_dictionary_get_cstring_nocopy(aldict, "name", &name))
225 1.24 christos return NULL;
226 1.24 christos return npf_alg_construct(name);
227 1.24 christos }
228 1.24 christos
229 1.24 christos static int __noinline
230 1.24 christos npf_mk_algs(prop_array_t alglist, prop_dictionary_t errdict)
231 1.24 christos {
232 1.24 christos prop_object_iterator_t it;
233 1.24 christos prop_dictionary_t nadict;
234 1.24 christos int error = 0;
235 1.24 christos
236 1.24 christos it = prop_array_iterator(alglist);
237 1.24 christos while ((nadict = prop_object_iterator_next(it)) != NULL) {
238 1.24 christos if (npf_mk_singlealg(nadict) == NULL) {
239 1.24 christos NPF_ERR_DEBUG(errdict);
240 1.24 christos error = EINVAL;
241 1.24 christos break;
242 1.24 christos }
243 1.24 christos }
244 1.24 christos prop_object_iterator_release(it);
245 1.24 christos return error;
246 1.24 christos }
247 1.24 christos
248 1.6 rmind static int __noinline
249 1.21 rmind npf_mk_code(prop_object_t obj, int type, void **code, size_t *csize,
250 1.12 rmind prop_dictionary_t errdict)
251 1.12 rmind {
252 1.21 rmind const void *cptr;
253 1.21 rmind int cerr, errat;
254 1.21 rmind size_t clen;
255 1.21 rmind void *bc;
256 1.12 rmind
257 1.21 rmind cptr = prop_data_data_nocopy(obj);
258 1.21 rmind if (cptr == NULL || (clen = prop_data_size(obj)) == 0) {
259 1.12 rmind NPF_ERR_DEBUG(errdict);
260 1.21 rmind return EINVAL;
261 1.12 rmind }
262 1.21 rmind
263 1.21 rmind switch (type) {
264 1.21 rmind case NPF_CODE_NC:
265 1.21 rmind if (clen > NPF_NCODE_LIMIT) {
266 1.21 rmind NPF_ERR_DEBUG(errdict);
267 1.21 rmind return ERANGE;
268 1.21 rmind }
269 1.21 rmind if ((cerr = npf_ncode_validate(cptr, clen, &errat)) != 0) {
270 1.21 rmind prop_dictionary_set_int32(errdict, "code-error", cerr);
271 1.21 rmind prop_dictionary_set_int32(errdict, "code-errat", errat);
272 1.21 rmind return EINVAL;
273 1.21 rmind }
274 1.21 rmind break;
275 1.21 rmind case NPF_CODE_BPF:
276 1.27 rmind if (!bpf_validate(cptr, clen / sizeof(struct bpf_insn))) {
277 1.21 rmind return EINVAL;
278 1.21 rmind }
279 1.21 rmind break;
280 1.21 rmind default:
281 1.21 rmind return ENOTSUP;
282 1.12 rmind }
283 1.21 rmind
284 1.21 rmind bc = kmem_alloc(clen, KM_SLEEP);
285 1.21 rmind memcpy(bc, cptr, clen);
286 1.21 rmind
287 1.21 rmind *code = bc;
288 1.21 rmind *csize = clen;
289 1.12 rmind return 0;
290 1.12 rmind }
291 1.12 rmind
292 1.12 rmind static int __noinline
293 1.21 rmind npf_mk_singlerule(prop_dictionary_t rldict, npf_rprocset_t *rpset,
294 1.21 rmind npf_rule_t **rlret, prop_dictionary_t errdict)
295 1.1 rmind {
296 1.21 rmind npf_rule_t *rl;
297 1.21 rmind const char *rname;
298 1.1 rmind prop_object_t obj;
299 1.21 rmind int p, error = 0;
300 1.1 rmind
301 1.1 rmind /* Rule - dictionary. */
302 1.12 rmind if (prop_object_type(rldict) != PROP_TYPE_DICTIONARY) {
303 1.12 rmind NPF_ERR_DEBUG(errdict);
304 1.1 rmind return EINVAL;
305 1.12 rmind }
306 1.21 rmind if ((rl = npf_rule_alloc(rldict)) == NULL) {
307 1.21 rmind NPF_ERR_DEBUG(errdict);
308 1.21 rmind return EINVAL;
309 1.21 rmind }
310 1.1 rmind
311 1.21 rmind /* Assign rule procedure, if any. */
312 1.21 rmind if (prop_dictionary_get_cstring_nocopy(rldict, "rproc", &rname)) {
313 1.21 rmind npf_rproc_t *rp;
314 1.21 rmind
315 1.21 rmind if (rpset == NULL) {
316 1.21 rmind error = EINVAL;
317 1.21 rmind goto err;
318 1.21 rmind }
319 1.21 rmind if ((rp = npf_rprocset_lookup(rpset, rname)) == NULL) {
320 1.18 rmind NPF_ERR_DEBUG(errdict);
321 1.18 rmind error = EINVAL;
322 1.18 rmind goto err;
323 1.18 rmind }
324 1.21 rmind npf_rule_setrproc(rl, rp);
325 1.18 rmind }
326 1.18 rmind
327 1.21 rmind /* Filter code (binary data). */
328 1.21 rmind if ((obj = prop_dictionary_get(rldict, "code")) != NULL) {
329 1.21 rmind int type;
330 1.21 rmind size_t len;
331 1.21 rmind void *code;
332 1.21 rmind
333 1.21 rmind prop_dictionary_get_int32(rldict, "code-type", &type);
334 1.21 rmind error = npf_mk_code(obj, type, &code, &len, errdict);
335 1.12 rmind if (error) {
336 1.12 rmind goto err;
337 1.4 rmind }
338 1.21 rmind npf_rule_setcode(rl, type, code, len);
339 1.1 rmind }
340 1.1 rmind
341 1.21 rmind *rlret = rl;
342 1.6 rmind return 0;
343 1.12 rmind err:
344 1.21 rmind npf_rule_free(rl);
345 1.12 rmind prop_dictionary_get_int32(rldict, "priority", &p); /* XXX */
346 1.12 rmind prop_dictionary_set_int32(errdict, "id", p);
347 1.12 rmind return error;
348 1.6 rmind }
349 1.6 rmind
350 1.6 rmind static int __noinline
351 1.21 rmind npf_mk_rules(npf_ruleset_t *rlset, prop_array_t rules, npf_rprocset_t *rpset,
352 1.12 rmind prop_dictionary_t errdict)
353 1.6 rmind {
354 1.6 rmind prop_object_iterator_t it;
355 1.6 rmind prop_dictionary_t rldict;
356 1.21 rmind int error;
357 1.6 rmind
358 1.6 rmind if (prop_object_type(rules) != PROP_TYPE_ARRAY) {
359 1.12 rmind NPF_ERR_DEBUG(errdict);
360 1.6 rmind return EINVAL;
361 1.6 rmind }
362 1.5 rmind
363 1.4 rmind error = 0;
364 1.1 rmind it = prop_array_iterator(rules);
365 1.1 rmind while ((rldict = prop_object_iterator_next(it)) != NULL) {
366 1.21 rmind npf_rule_t *rl = NULL;
367 1.1 rmind
368 1.1 rmind /* Generate a single rule. */
369 1.21 rmind error = npf_mk_singlerule(rldict, rpset, &rl, errdict);
370 1.6 rmind if (error) {
371 1.1 rmind break;
372 1.6 rmind }
373 1.6 rmind npf_ruleset_insert(rlset, rl);
374 1.1 rmind }
375 1.1 rmind prop_object_iterator_release(it);
376 1.1 rmind /*
377 1.4 rmind * Note: in a case of error, caller will free the ruleset.
378 1.1 rmind */
379 1.1 rmind return error;
380 1.1 rmind }
381 1.1 rmind
382 1.6 rmind static int __noinline
383 1.12 rmind npf_mk_natlist(npf_ruleset_t *nset, prop_array_t natlist,
384 1.12 rmind prop_dictionary_t errdict)
385 1.1 rmind {
386 1.1 rmind prop_object_iterator_t it;
387 1.1 rmind prop_dictionary_t natdict;
388 1.1 rmind int error;
389 1.1 rmind
390 1.1 rmind /* NAT policies - array. */
391 1.12 rmind if (prop_object_type(natlist) != PROP_TYPE_ARRAY) {
392 1.12 rmind NPF_ERR_DEBUG(errdict);
393 1.1 rmind return EINVAL;
394 1.12 rmind }
395 1.1 rmind
396 1.4 rmind error = 0;
397 1.1 rmind it = prop_array_iterator(natlist);
398 1.1 rmind while ((natdict = prop_object_iterator_next(it)) != NULL) {
399 1.21 rmind npf_rule_t *rl = NULL;
400 1.1 rmind npf_natpolicy_t *np;
401 1.1 rmind
402 1.1 rmind /* NAT policy - dictionary. */
403 1.1 rmind if (prop_object_type(natdict) != PROP_TYPE_DICTIONARY) {
404 1.12 rmind NPF_ERR_DEBUG(errdict);
405 1.1 rmind error = EINVAL;
406 1.1 rmind break;
407 1.1 rmind }
408 1.1 rmind
409 1.1 rmind /*
410 1.1 rmind * NAT policies are standard rules, plus additional
411 1.1 rmind * information for translation. Make a rule.
412 1.1 rmind */
413 1.12 rmind error = npf_mk_singlerule(natdict, NULL, &rl, errdict);
414 1.6 rmind if (error) {
415 1.1 rmind break;
416 1.6 rmind }
417 1.6 rmind npf_ruleset_insert(nset, rl);
418 1.6 rmind
419 1.6 rmind /* If rule is named, it is a group with NAT policies. */
420 1.6 rmind if (prop_dictionary_get(natdict, "name") &&
421 1.6 rmind prop_dictionary_get(natdict, "subrules")) {
422 1.6 rmind continue;
423 1.6 rmind }
424 1.1 rmind
425 1.1 rmind /* Allocate a new NAT policy and assign to the rule. */
426 1.5 rmind np = npf_nat_newpolicy(natdict, nset);
427 1.1 rmind if (np == NULL) {
428 1.12 rmind NPF_ERR_DEBUG(errdict);
429 1.1 rmind error = ENOMEM;
430 1.1 rmind break;
431 1.1 rmind }
432 1.1 rmind npf_rule_setnat(rl, np);
433 1.1 rmind }
434 1.1 rmind prop_object_iterator_release(it);
435 1.1 rmind /*
436 1.1 rmind * Note: in a case of error, caller will free entire NAT ruleset
437 1.1 rmind * with assigned NAT policies.
438 1.1 rmind */
439 1.1 rmind return error;
440 1.1 rmind }
441 1.1 rmind
442 1.1 rmind /*
443 1.1 rmind * npfctl_reload: store passed data i.e. update settings, create passed
444 1.1 rmind * tables, rules and atomically activate all them.
445 1.1 rmind */
446 1.1 rmind int
447 1.1 rmind npfctl_reload(u_long cmd, void *data)
448 1.1 rmind {
449 1.12 rmind struct plistref *pref = data;
450 1.14 rmind prop_dictionary_t npf_dict, errdict;
451 1.24 christos prop_array_t alglist, natlist, tables, rprocs, rules;
452 1.1 rmind npf_tableset_t *tblset = NULL;
453 1.21 rmind npf_rprocset_t *rpset = NULL;
454 1.1 rmind npf_ruleset_t *rlset = NULL;
455 1.1 rmind npf_ruleset_t *nset = NULL;
456 1.20 rmind uint32_t ver = 0;
457 1.21 rmind size_t nitems;
458 1.11 rmind bool flush;
459 1.1 rmind int error;
460 1.1 rmind
461 1.1 rmind /* Retrieve the dictionary. */
462 1.15 rmind #ifndef _NPF_TESTING
463 1.14 rmind error = prop_dictionary_copyin_ioctl(pref, cmd, &npf_dict);
464 1.1 rmind if (error)
465 1.1 rmind return error;
466 1.1 rmind #else
467 1.15 rmind npf_dict = (prop_dictionary_t)pref;
468 1.1 rmind #endif
469 1.15 rmind
470 1.20 rmind /* Dictionary for error reporting and version check. */
471 1.12 rmind errdict = prop_dictionary_create();
472 1.20 rmind prop_dictionary_get_uint32(npf_dict, "version", &ver);
473 1.20 rmind if (ver != NPF_VERSION) {
474 1.20 rmind error = EPROGMISMATCH;
475 1.20 rmind goto fail;
476 1.20 rmind }
477 1.12 rmind
478 1.24 christos /* ALGs. */
479 1.24 christos alglist = prop_dictionary_get(npf_dict, "algs");
480 1.24 christos error = npf_mk_algs(alglist, errdict);
481 1.24 christos if (error) {
482 1.24 christos goto fail;
483 1.24 christos }
484 1.24 christos
485 1.1 rmind /* NAT policies. */
486 1.14 rmind natlist = prop_dictionary_get(npf_dict, "translation");
487 1.21 rmind nitems = prop_array_count(natlist);
488 1.21 rmind
489 1.21 rmind nset = npf_ruleset_create(nitems);
490 1.12 rmind error = npf_mk_natlist(nset, natlist, errdict);
491 1.10 rmind if (error) {
492 1.1 rmind goto fail;
493 1.10 rmind }
494 1.1 rmind
495 1.1 rmind /* Tables. */
496 1.1 rmind tblset = npf_tableset_create();
497 1.14 rmind tables = prop_dictionary_get(npf_dict, "tables");
498 1.12 rmind error = npf_mk_tables(tblset, tables, errdict);
499 1.10 rmind if (error) {
500 1.1 rmind goto fail;
501 1.10 rmind }
502 1.1 rmind
503 1.21 rmind /* Rule procedures. */
504 1.21 rmind rpset = npf_rprocset_create();
505 1.14 rmind rprocs = prop_dictionary_get(npf_dict, "rprocs");
506 1.21 rmind error = npf_mk_rprocs(rpset, rprocs, errdict);
507 1.21 rmind if (error) {
508 1.21 rmind goto fail;
509 1.21 rmind }
510 1.21 rmind
511 1.21 rmind /* Rules. */
512 1.14 rmind rules = prop_dictionary_get(npf_dict, "rules");
513 1.21 rmind nitems = prop_array_count(rules);
514 1.21 rmind
515 1.21 rmind rlset = npf_ruleset_create(nitems);
516 1.21 rmind error = npf_mk_rules(rlset, rules, rpset, errdict);
517 1.10 rmind if (error) {
518 1.1 rmind goto fail;
519 1.10 rmind }
520 1.1 rmind
521 1.11 rmind flush = false;
522 1.14 rmind prop_dictionary_get_bool(npf_dict, "flush", &flush);
523 1.11 rmind
524 1.1 rmind /*
525 1.21 rmind * Finally - perform the reload.
526 1.1 rmind */
527 1.21 rmind npf_config_reload(npf_dict, rlset, tblset, nset, rpset, flush);
528 1.1 rmind
529 1.11 rmind /* Turn on/off session tracking accordingly. */
530 1.11 rmind npf_session_tracking(!flush);
531 1.11 rmind
532 1.1 rmind /* Done. Since data is consumed now, we shall not destroy it. */
533 1.1 rmind tblset = NULL;
534 1.21 rmind rpset = NULL;
535 1.1 rmind rlset = NULL;
536 1.1 rmind nset = NULL;
537 1.1 rmind fail:
538 1.1 rmind /*
539 1.1 rmind * Note: destroy rulesets first, to drop references to the tableset.
540 1.1 rmind */
541 1.21 rmind KASSERT(error == 0 || (nset || rpset || rlset || tblset));
542 1.1 rmind if (nset) {
543 1.1 rmind npf_ruleset_destroy(nset);
544 1.1 rmind }
545 1.1 rmind if (rlset) {
546 1.1 rmind npf_ruleset_destroy(rlset);
547 1.1 rmind }
548 1.21 rmind if (rpset) {
549 1.21 rmind npf_rprocset_destroy(rpset);
550 1.21 rmind }
551 1.1 rmind if (tblset) {
552 1.1 rmind npf_tableset_destroy(tblset);
553 1.1 rmind }
554 1.14 rmind if (error) {
555 1.14 rmind prop_object_release(npf_dict);
556 1.14 rmind }
557 1.12 rmind
558 1.12 rmind /* Error report. */
559 1.18 rmind #ifndef _NPF_TESTING
560 1.12 rmind prop_dictionary_set_int32(errdict, "errno", error);
561 1.12 rmind prop_dictionary_copyout_ioctl(pref, cmd, errdict);
562 1.18 rmind prop_object_release(errdict);
563 1.18 rmind error = 0;
564 1.13 rmind #endif
565 1.18 rmind return error;
566 1.6 rmind }
567 1.6 rmind
568 1.21 rmind /*
569 1.21 rmind * npfctl_rule: add or remove dynamic rules in the specified ruleset.
570 1.21 rmind */
571 1.14 rmind int
572 1.21 rmind npfctl_rule(u_long cmd, void *data)
573 1.14 rmind {
574 1.14 rmind struct plistref *pref = data;
575 1.21 rmind prop_dictionary_t npf_rule, retdict = NULL;
576 1.21 rmind npf_ruleset_t *rlset;
577 1.21 rmind npf_rule_t *rl = NULL;
578 1.21 rmind const char *ruleset_name;
579 1.21 rmind uint32_t rcmd = 0;
580 1.14 rmind int error;
581 1.14 rmind
582 1.21 rmind error = prop_dictionary_copyin_ioctl(pref, cmd, &npf_rule);
583 1.21 rmind if (error) {
584 1.21 rmind return error;
585 1.21 rmind }
586 1.21 rmind prop_dictionary_get_uint32(npf_rule, "command", &rcmd);
587 1.21 rmind if (!prop_dictionary_get_cstring_nocopy(npf_rule,
588 1.21 rmind "ruleset-name", &ruleset_name)) {
589 1.27 rmind error = EINVAL;
590 1.27 rmind goto out;
591 1.21 rmind }
592 1.21 rmind
593 1.21 rmind if (rcmd == NPF_CMD_RULE_ADD) {
594 1.27 rmind retdict = prop_dictionary_create();
595 1.27 rmind if (npf_mk_singlerule(npf_rule, NULL, &rl, retdict) != 0) {
596 1.27 rmind error = EINVAL;
597 1.27 rmind goto out;
598 1.21 rmind }
599 1.21 rmind }
600 1.21 rmind
601 1.21 rmind npf_config_enter();
602 1.21 rmind rlset = npf_config_ruleset();
603 1.21 rmind
604 1.21 rmind switch (rcmd) {
605 1.21 rmind case NPF_CMD_RULE_ADD: {
606 1.21 rmind if ((error = npf_ruleset_add(rlset, ruleset_name, rl)) == 0) {
607 1.21 rmind /* Success. */
608 1.23 rmind uint64_t id = npf_rule_getid(rl);
609 1.23 rmind prop_dictionary_set_uint64(retdict, "id", id);
610 1.21 rmind rl = NULL;
611 1.21 rmind }
612 1.21 rmind break;
613 1.21 rmind }
614 1.21 rmind case NPF_CMD_RULE_REMOVE: {
615 1.23 rmind uint64_t id;
616 1.21 rmind
617 1.23 rmind if (!prop_dictionary_get_uint64(npf_rule, "id", &id)) {
618 1.21 rmind error = EINVAL;
619 1.21 rmind break;
620 1.21 rmind }
621 1.23 rmind error = npf_ruleset_remove(rlset, ruleset_name, id);
622 1.21 rmind break;
623 1.21 rmind }
624 1.21 rmind case NPF_CMD_RULE_REMKEY: {
625 1.21 rmind prop_object_t obj = prop_dictionary_get(npf_rule, "key");
626 1.21 rmind const void *key = prop_data_data_nocopy(obj);
627 1.21 rmind size_t len = prop_data_size(obj);
628 1.21 rmind
629 1.21 rmind if (len == 0 || len > NPF_RULE_MAXKEYLEN) {
630 1.21 rmind error = EINVAL;
631 1.21 rmind break;
632 1.21 rmind }
633 1.22 rmind error = npf_ruleset_remkey(rlset, ruleset_name, key, len);
634 1.22 rmind break;
635 1.22 rmind }
636 1.22 rmind case NPF_CMD_RULE_LIST: {
637 1.22 rmind retdict = npf_ruleset_list(rlset, ruleset_name);
638 1.22 rmind break;
639 1.22 rmind }
640 1.22 rmind case NPF_CMD_RULE_FLUSH: {
641 1.22 rmind error = npf_ruleset_flush(rlset, ruleset_name);
642 1.21 rmind break;
643 1.21 rmind }
644 1.21 rmind default:
645 1.21 rmind error = EINVAL;
646 1.21 rmind break;
647 1.21 rmind }
648 1.22 rmind
649 1.22 rmind /* Destroy any removed rules. */
650 1.22 rmind if (!error && rcmd != NPF_CMD_RULE_ADD && rcmd != NPF_CMD_RULE_LIST) {
651 1.22 rmind npf_config_sync();
652 1.22 rmind npf_ruleset_gc(rlset);
653 1.22 rmind }
654 1.21 rmind npf_config_exit();
655 1.14 rmind
656 1.21 rmind if (rl) {
657 1.21 rmind npf_rule_free(rl);
658 1.21 rmind }
659 1.27 rmind out:
660 1.21 rmind if (retdict) {
661 1.21 rmind prop_object_release(npf_rule);
662 1.21 rmind prop_dictionary_copyout_ioctl(pref, cmd, retdict);
663 1.21 rmind prop_object_release(retdict);
664 1.21 rmind }
665 1.14 rmind return error;
666 1.14 rmind }
667 1.14 rmind
668 1.6 rmind /*
669 1.21 rmind * npfctl_getconf: return the config dictionary as it was submitted.
670 1.21 rmind * Additionally, indicate whether the ruleset is currently active.
671 1.6 rmind */
672 1.6 rmind int
673 1.21 rmind npfctl_getconf(u_long cmd, void *data)
674 1.6 rmind {
675 1.12 rmind struct plistref *pref = data;
676 1.21 rmind prop_dictionary_t npf_dict;
677 1.6 rmind int error;
678 1.6 rmind
679 1.21 rmind npf_config_enter();
680 1.21 rmind npf_dict = npf_config_dict();
681 1.21 rmind prop_dictionary_set_bool(npf_dict, "active", npf_pfil_registered_p());
682 1.21 rmind error = prop_dictionary_copyout_ioctl(pref, cmd, npf_dict);
683 1.21 rmind npf_config_exit();
684 1.12 rmind
685 1.1 rmind return error;
686 1.1 rmind }
687 1.1 rmind
688 1.1 rmind /*
689 1.4 rmind * npfctl_sessions_save: construct a list of sessions and export for saving.
690 1.4 rmind */
691 1.4 rmind int
692 1.4 rmind npfctl_sessions_save(u_long cmd, void *data)
693 1.4 rmind {
694 1.4 rmind struct plistref *pref = data;
695 1.4 rmind prop_dictionary_t sesdict;
696 1.4 rmind prop_array_t selist, nplist;
697 1.4 rmind int error;
698 1.4 rmind
699 1.4 rmind /* Create a dictionary and two lists. */
700 1.4 rmind sesdict = prop_dictionary_create();
701 1.4 rmind selist = prop_array_create();
702 1.4 rmind nplist = prop_array_create();
703 1.4 rmind
704 1.4 rmind /* Save the sessions. */
705 1.4 rmind error = npf_session_save(selist, nplist);
706 1.4 rmind if (error) {
707 1.4 rmind goto fail;
708 1.4 rmind }
709 1.4 rmind
710 1.4 rmind /* Set the session list, NAT policy list and export the dictionary. */
711 1.4 rmind prop_dictionary_set(sesdict, "session-list", selist);
712 1.4 rmind prop_dictionary_set(sesdict, "nat-policy-list", nplist);
713 1.4 rmind error = prop_dictionary_copyout_ioctl(pref, cmd, sesdict);
714 1.4 rmind fail:
715 1.4 rmind prop_object_release(sesdict);
716 1.4 rmind return error;
717 1.4 rmind }
718 1.4 rmind
719 1.4 rmind /*
720 1.4 rmind * npfctl_sessions_load: import a list of sessions, reconstruct them and load.
721 1.4 rmind */
722 1.4 rmind int
723 1.4 rmind npfctl_sessions_load(u_long cmd, void *data)
724 1.4 rmind {
725 1.4 rmind const struct plistref *pref = data;
726 1.4 rmind npf_sehash_t *sehasht = NULL;
727 1.4 rmind prop_dictionary_t sesdict, sedict;
728 1.4 rmind prop_object_iterator_t it;
729 1.4 rmind prop_array_t selist;
730 1.4 rmind int error;
731 1.4 rmind
732 1.4 rmind /* Retrieve the dictionary containing session and NAT policy lists. */
733 1.4 rmind error = prop_dictionary_copyin_ioctl(pref, cmd, &sesdict);
734 1.4 rmind if (error)
735 1.4 rmind return error;
736 1.15 rmind
737 1.4 rmind /*
738 1.4 rmind * Note: session objects contain the references to the NAT policy
739 1.4 rmind * entries. Therefore, no need to directly access it.
740 1.4 rmind */
741 1.4 rmind selist = prop_dictionary_get(sesdict, "session-list");
742 1.4 rmind if (prop_object_type(selist) != PROP_TYPE_ARRAY) {
743 1.21 rmind prop_object_release(selist);
744 1.21 rmind return EINVAL;
745 1.4 rmind }
746 1.4 rmind
747 1.4 rmind /* Create a session hash table. */
748 1.4 rmind sehasht = sess_htable_create();
749 1.4 rmind
750 1.4 rmind /*
751 1.21 rmind * Iterate through and construct each session. Note: acquire the
752 1.21 rmind * config lock as we access NAT policies during the restore.
753 1.4 rmind */
754 1.4 rmind error = 0;
755 1.26 rmind it = prop_array_iterator(selist);
756 1.26 rmind
757 1.21 rmind npf_config_enter();
758 1.4 rmind while ((sedict = prop_object_iterator_next(it)) != NULL) {
759 1.4 rmind /* Session - dictionary. */
760 1.4 rmind if (prop_object_type(sedict) != PROP_TYPE_DICTIONARY) {
761 1.4 rmind error = EINVAL;
762 1.26 rmind break;
763 1.4 rmind }
764 1.4 rmind /* Construct and insert real session structure. */
765 1.4 rmind error = npf_session_restore(sehasht, sedict);
766 1.4 rmind if (error) {
767 1.26 rmind break;
768 1.4 rmind }
769 1.4 rmind }
770 1.21 rmind npf_config_exit();
771 1.26 rmind
772 1.21 rmind prop_object_iterator_release(it);
773 1.4 rmind prop_object_release(selist);
774 1.26 rmind
775 1.26 rmind if (!error) {
776 1.26 rmind /* Finally, load the new table. */
777 1.26 rmind npf_session_load(sehasht);
778 1.26 rmind } else {
779 1.4 rmind /* Destroy session table. */
780 1.4 rmind sess_htable_destroy(sehasht);
781 1.4 rmind }
782 1.4 rmind return error;
783 1.4 rmind }
784 1.4 rmind
785 1.4 rmind /*
786 1.2 rmind * npfctl_table: add, remove or query entries in the specified table.
787 1.1 rmind *
788 1.1 rmind * For maximum performance, interface is avoiding proplib(3)'s overhead.
789 1.1 rmind */
790 1.1 rmind int
791 1.1 rmind npfctl_table(void *data)
792 1.1 rmind {
793 1.19 rmind const npf_ioctl_table_t *nct = data;
794 1.10 rmind npf_tableset_t *tblset;
795 1.1 rmind int error;
796 1.1 rmind
797 1.21 rmind //npf_config_ref();
798 1.21 rmind tblset = npf_config_tableset();
799 1.21 rmind
800 1.21 rmind switch (nct->nct_cmd) {
801 1.21 rmind case NPF_CMD_TABLE_LOOKUP:
802 1.19 rmind error = npf_table_lookup(tblset, nct->nct_tid,
803 1.19 rmind nct->nct_data.ent.alen, &nct->nct_data.ent.addr);
804 1.20 rmind break;
805 1.21 rmind case NPF_CMD_TABLE_ADD:
806 1.16 rmind error = npf_table_insert(tblset, nct->nct_tid,
807 1.19 rmind nct->nct_data.ent.alen, &nct->nct_data.ent.addr,
808 1.19 rmind nct->nct_data.ent.mask);
809 1.1 rmind break;
810 1.21 rmind case NPF_CMD_TABLE_REMOVE:
811 1.16 rmind error = npf_table_remove(tblset, nct->nct_tid,
812 1.19 rmind nct->nct_data.ent.alen, &nct->nct_data.ent.addr,
813 1.19 rmind nct->nct_data.ent.mask);
814 1.19 rmind break;
815 1.21 rmind case NPF_CMD_TABLE_LIST:
816 1.19 rmind error = npf_table_list(tblset, nct->nct_tid,
817 1.19 rmind nct->nct_data.buf.buf, nct->nct_data.buf.len);
818 1.1 rmind break;
819 1.25 rmind case NPF_CMD_TABLE_FLUSH:
820 1.25 rmind error = npf_table_flush(tblset, nct->nct_tid);
821 1.25 rmind break;
822 1.1 rmind default:
823 1.19 rmind error = EINVAL;
824 1.19 rmind break;
825 1.1 rmind }
826 1.21 rmind //npf_config_unref();
827 1.21 rmind
828 1.1 rmind return error;
829 1.1 rmind }
830