Home | History | Annotate | Line # | Download | only in npf
npf_ctl.c revision 1.17.2.2
      1 /*	$NetBSD: npf_ctl.c,v 1.17.2.2 2013/02/25 00:30:02 tls Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2009-2013 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This material is based upon work partially supported by The
      8  * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     29  * POSSIBILITY OF SUCH DAMAGE.
     30  */
     31 
     32 /*
     33  * NPF device control.
     34  *
     35  * Implementation of (re)loading, construction of tables and rules.
     36  * NPF proplib(9) dictionary consumer.
     37  */
     38 
     39 #include <sys/cdefs.h>
     40 __KERNEL_RCSID(0, "$NetBSD: npf_ctl.c,v 1.17.2.2 2013/02/25 00:30:02 tls Exp $");
     41 
     42 #include <sys/param.h>
     43 #include <sys/conf.h>
     44 #include <sys/kmem.h>
     45 #include <net/bpf.h>
     46 
     47 #include <prop/proplib.h>
     48 
     49 #include "npf_ncode.h"
     50 #include "npf_impl.h"
     51 
     52 #if defined(DEBUG) || defined(DIAGNOSTIC)
     53 #define	NPF_ERR_DEBUG(e) \
     54 	prop_dictionary_set_cstring_nocopy((e), "source-file", __FILE__); \
     55 	prop_dictionary_set_uint32((e), "source-line", __LINE__);
     56 #else
     57 #define	NPF_ERR_DEBUG(e)
     58 #endif
     59 
     60 /*
     61  * npfctl_switch: enable or disable packet inspection.
     62  */
     63 int
     64 npfctl_switch(void *data)
     65 {
     66 	const bool onoff = *(int *)data ? true : false;
     67 	int error;
     68 
     69 	if (onoff) {
     70 		/* Enable: add pfil hooks. */
     71 		error = npf_pfil_register();
     72 	} else {
     73 		/* Disable: remove pfil hooks. */
     74 		npf_pfil_unregister();
     75 		error = 0;
     76 	}
     77 	return error;
     78 }
     79 
     80 static int __noinline
     81 npf_mk_tables(npf_tableset_t *tblset, prop_array_t tables,
     82     prop_dictionary_t errdict)
     83 {
     84 	prop_object_iterator_t it;
     85 	prop_dictionary_t tbldict;
     86 	int error = 0;
     87 
     88 	/* Tables - array. */
     89 	if (prop_object_type(tables) != PROP_TYPE_ARRAY) {
     90 		NPF_ERR_DEBUG(errdict);
     91 		return EINVAL;
     92 	}
     93 
     94 	it = prop_array_iterator(tables);
     95 	while ((tbldict = prop_object_iterator_next(it)) != NULL) {
     96 		prop_dictionary_t ent;
     97 		prop_object_iterator_t eit;
     98 		prop_array_t entries;
     99 		npf_table_t *t;
    100 		u_int tid;
    101 		int type;
    102 
    103 		/* Table - dictionary. */
    104 		if (prop_object_type(tbldict) != PROP_TYPE_DICTIONARY) {
    105 			NPF_ERR_DEBUG(errdict);
    106 			error = EINVAL;
    107 			break;
    108 		}
    109 
    110 		/* Table ID and type. */
    111 		prop_dictionary_get_uint32(tbldict, "id", &tid);
    112 		prop_dictionary_get_int32(tbldict, "type", &type);
    113 
    114 		/* Validate them, check for duplicate IDs. */
    115 		error = npf_table_check(tblset, tid, type);
    116 		if (error)
    117 			break;
    118 
    119 		/* Create and insert the table. */
    120 		t = npf_table_create(tid, type, 1024);	/* XXX */
    121 		if (t == NULL) {
    122 			NPF_ERR_DEBUG(errdict);
    123 			error = ENOMEM;
    124 			break;
    125 		}
    126 		error = npf_tableset_insert(tblset, t);
    127 		KASSERT(error == 0);
    128 
    129 		/* Entries. */
    130 		entries = prop_dictionary_get(tbldict, "entries");
    131 		if (prop_object_type(entries) != PROP_TYPE_ARRAY) {
    132 			NPF_ERR_DEBUG(errdict);
    133 			error = EINVAL;
    134 			break;
    135 		}
    136 		eit = prop_array_iterator(entries);
    137 		while ((ent = prop_object_iterator_next(eit)) != NULL) {
    138 			const npf_addr_t *addr;
    139 			npf_netmask_t mask;
    140 			int alen;
    141 
    142 			/* Get address and mask.  Add a table entry. */
    143 			prop_object_t obj = prop_dictionary_get(ent, "addr");
    144 			addr = (const npf_addr_t *)prop_data_data_nocopy(obj);
    145 			prop_dictionary_get_uint8(ent, "mask", &mask);
    146 			alen = prop_data_size(obj);
    147 
    148 			error = npf_table_insert(tblset, tid, alen, addr, mask);
    149 			if (error)
    150 				break;
    151 		}
    152 		prop_object_iterator_release(eit);
    153 		if (error)
    154 			break;
    155 	}
    156 	prop_object_iterator_release(it);
    157 	/*
    158 	 * Note: in a case of error, caller will free the tableset.
    159 	 */
    160 	return error;
    161 }
    162 
    163 static npf_rproc_t *
    164 npf_mk_singlerproc(prop_dictionary_t rpdict)
    165 {
    166 	prop_object_iterator_t it;
    167 	prop_dictionary_t extdict;
    168 	prop_array_t extlist;
    169 	npf_rproc_t *rp;
    170 
    171 	extlist = prop_dictionary_get(rpdict, "extcalls");
    172 	if (prop_object_type(extlist) != PROP_TYPE_ARRAY) {
    173 		return NULL;
    174 	}
    175 
    176 	rp = npf_rproc_create(rpdict);
    177 	if (rp == NULL) {
    178 		return NULL;
    179 	}
    180 
    181 	it = prop_array_iterator(extlist);
    182 	while ((extdict = prop_object_iterator_next(it)) != NULL) {
    183 		const char *name;
    184 
    185 		if (!prop_dictionary_get_cstring_nocopy(extdict,
    186 		    "name", &name) || npf_ext_construct(name, rp, extdict)) {
    187 			npf_rproc_release(rp);
    188 			rp = NULL;
    189 			break;
    190 		}
    191 	}
    192 	prop_object_iterator_release(it);
    193 	return rp;
    194 }
    195 
    196 static int __noinline
    197 npf_mk_rprocs(npf_rprocset_t *rpset, prop_array_t rprocs,
    198     prop_dictionary_t errdict)
    199 {
    200 	prop_object_iterator_t it;
    201 	prop_dictionary_t rpdict;
    202 	int error = 0;
    203 
    204 	it = prop_array_iterator(rprocs);
    205 	while ((rpdict = prop_object_iterator_next(it)) != NULL) {
    206 		npf_rproc_t *rp;
    207 
    208 		if ((rp = npf_mk_singlerproc(rpdict)) == NULL) {
    209 			NPF_ERR_DEBUG(errdict);
    210 			error = EINVAL;
    211 			break;
    212 		}
    213 		npf_rprocset_insert(rpset, rp);
    214 	}
    215 	prop_object_iterator_release(it);
    216 	return error;
    217 }
    218 
    219 static int __noinline
    220 npf_mk_code(prop_object_t obj, int type, void **code, size_t *csize,
    221     prop_dictionary_t errdict)
    222 {
    223 	const void *cptr;
    224 	int cerr, errat;
    225 	size_t clen;
    226 	void *bc;
    227 
    228 	cptr = prop_data_data_nocopy(obj);
    229 	if (cptr == NULL || (clen = prop_data_size(obj)) == 0) {
    230 		NPF_ERR_DEBUG(errdict);
    231 		return EINVAL;
    232 	}
    233 
    234 	switch (type) {
    235 	case NPF_CODE_NC:
    236 		if (clen > NPF_NCODE_LIMIT) {
    237 			NPF_ERR_DEBUG(errdict);
    238 			return ERANGE;
    239 		}
    240 		if ((cerr = npf_ncode_validate(cptr, clen, &errat)) != 0) {
    241 			prop_dictionary_set_int32(errdict, "code-error", cerr);
    242 			prop_dictionary_set_int32(errdict, "code-errat", errat);
    243 			return EINVAL;
    244 		}
    245 		break;
    246 	case NPF_CODE_BPF:
    247 		if (!bpf_validate(cptr, clen)) {
    248 			return EINVAL;
    249 		}
    250 		break;
    251 	default:
    252 		return ENOTSUP;
    253 	}
    254 
    255 	bc = kmem_alloc(clen, KM_SLEEP);
    256 	memcpy(bc, cptr, clen);
    257 
    258 	*code = bc;
    259 	*csize = clen;
    260 	return 0;
    261 }
    262 
    263 static int __noinline
    264 npf_mk_singlerule(prop_dictionary_t rldict, npf_rprocset_t *rpset,
    265     npf_rule_t **rlret, prop_dictionary_t errdict)
    266 {
    267 	npf_rule_t *rl;
    268 	const char *rname;
    269 	prop_object_t obj;
    270 	int p, error = 0;
    271 
    272 	/* Rule - dictionary. */
    273 	if (prop_object_type(rldict) != PROP_TYPE_DICTIONARY) {
    274 		NPF_ERR_DEBUG(errdict);
    275 		return EINVAL;
    276 	}
    277 	if ((rl = npf_rule_alloc(rldict)) == NULL) {
    278 		NPF_ERR_DEBUG(errdict);
    279 		return EINVAL;
    280 	}
    281 
    282 	/* Assign rule procedure, if any. */
    283 	if (prop_dictionary_get_cstring_nocopy(rldict, "rproc", &rname)) {
    284 		npf_rproc_t *rp;
    285 
    286 		if (rpset == NULL) {
    287 			error = EINVAL;
    288 			goto err;
    289 		}
    290 		if ((rp = npf_rprocset_lookup(rpset, rname)) == NULL) {
    291 			NPF_ERR_DEBUG(errdict);
    292 			error = EINVAL;
    293 			goto err;
    294 		}
    295 		npf_rule_setrproc(rl, rp);
    296 	}
    297 
    298 	/* Filter code (binary data). */
    299 	if ((obj = prop_dictionary_get(rldict, "code")) != NULL) {
    300 		int type;
    301 		size_t len;
    302 		void *code;
    303 
    304 		prop_dictionary_get_int32(rldict, "code-type", &type);
    305 		error = npf_mk_code(obj, type, &code, &len, errdict);
    306 		if (error) {
    307 			goto err;
    308 		}
    309 		npf_rule_setcode(rl, type, code, len);
    310 	}
    311 
    312 	*rlret = rl;
    313 	return 0;
    314 err:
    315 	npf_rule_free(rl);
    316 	prop_dictionary_get_int32(rldict, "priority", &p); /* XXX */
    317 	prop_dictionary_set_int32(errdict, "id", p);
    318 	return error;
    319 }
    320 
    321 static int __noinline
    322 npf_mk_rules(npf_ruleset_t *rlset, prop_array_t rules, npf_rprocset_t *rpset,
    323     prop_dictionary_t errdict)
    324 {
    325 	prop_object_iterator_t it;
    326 	prop_dictionary_t rldict;
    327 	int error;
    328 
    329 	if (prop_object_type(rules) != PROP_TYPE_ARRAY) {
    330 		NPF_ERR_DEBUG(errdict);
    331 		return EINVAL;
    332 	}
    333 
    334 	error = 0;
    335 	it = prop_array_iterator(rules);
    336 	while ((rldict = prop_object_iterator_next(it)) != NULL) {
    337 		npf_rule_t *rl = NULL;
    338 
    339 		/* Generate a single rule. */
    340 		error = npf_mk_singlerule(rldict, rpset, &rl, errdict);
    341 		if (error) {
    342 			break;
    343 		}
    344 		npf_ruleset_insert(rlset, rl);
    345 	}
    346 	prop_object_iterator_release(it);
    347 	/*
    348 	 * Note: in a case of error, caller will free the ruleset.
    349 	 */
    350 	return error;
    351 }
    352 
    353 static int __noinline
    354 npf_mk_natlist(npf_ruleset_t *nset, prop_array_t natlist,
    355     prop_dictionary_t errdict)
    356 {
    357 	prop_object_iterator_t it;
    358 	prop_dictionary_t natdict;
    359 	int error;
    360 
    361 	/* NAT policies - array. */
    362 	if (prop_object_type(natlist) != PROP_TYPE_ARRAY) {
    363 		NPF_ERR_DEBUG(errdict);
    364 		return EINVAL;
    365 	}
    366 
    367 	error = 0;
    368 	it = prop_array_iterator(natlist);
    369 	while ((natdict = prop_object_iterator_next(it)) != NULL) {
    370 		npf_rule_t *rl = NULL;
    371 		npf_natpolicy_t *np;
    372 
    373 		/* NAT policy - dictionary. */
    374 		if (prop_object_type(natdict) != PROP_TYPE_DICTIONARY) {
    375 			NPF_ERR_DEBUG(errdict);
    376 			error = EINVAL;
    377 			break;
    378 		}
    379 
    380 		/*
    381 		 * NAT policies are standard rules, plus additional
    382 		 * information for translation.  Make a rule.
    383 		 */
    384 		error = npf_mk_singlerule(natdict, NULL, &rl, errdict);
    385 		if (error) {
    386 			break;
    387 		}
    388 		npf_ruleset_insert(nset, rl);
    389 
    390 		/* If rule is named, it is a group with NAT policies. */
    391 		if (prop_dictionary_get(natdict, "name") &&
    392 		    prop_dictionary_get(natdict, "subrules")) {
    393 			continue;
    394 		}
    395 
    396 		/* Allocate a new NAT policy and assign to the rule. */
    397 		np = npf_nat_newpolicy(natdict, nset);
    398 		if (np == NULL) {
    399 			NPF_ERR_DEBUG(errdict);
    400 			error = ENOMEM;
    401 			break;
    402 		}
    403 		npf_rule_setnat(rl, np);
    404 	}
    405 	prop_object_iterator_release(it);
    406 	/*
    407 	 * Note: in a case of error, caller will free entire NAT ruleset
    408 	 * with assigned NAT policies.
    409 	 */
    410 	return error;
    411 }
    412 
    413 /*
    414  * npfctl_reload: store passed data i.e. update settings, create passed
    415  * tables, rules and atomically activate all them.
    416  */
    417 int
    418 npfctl_reload(u_long cmd, void *data)
    419 {
    420 	struct plistref *pref = data;
    421 	prop_dictionary_t npf_dict, errdict;
    422 	prop_array_t natlist, tables, rprocs, rules;
    423 	npf_tableset_t *tblset = NULL;
    424 	npf_rprocset_t *rpset = NULL;
    425 	npf_ruleset_t *rlset = NULL;
    426 	npf_ruleset_t *nset = NULL;
    427 	uint32_t ver = 0;
    428 	size_t nitems;
    429 	bool flush;
    430 	int error;
    431 
    432 	/* Retrieve the dictionary. */
    433 #ifndef _NPF_TESTING
    434 	error = prop_dictionary_copyin_ioctl(pref, cmd, &npf_dict);
    435 	if (error)
    436 		return error;
    437 #else
    438 	npf_dict = (prop_dictionary_t)pref;
    439 #endif
    440 
    441 	/* Dictionary for error reporting and version check. */
    442 	errdict = prop_dictionary_create();
    443 	prop_dictionary_get_uint32(npf_dict, "version", &ver);
    444 	if (ver != NPF_VERSION) {
    445 		error = EPROGMISMATCH;
    446 		goto fail;
    447 	}
    448 
    449 	/* NAT policies. */
    450 	natlist = prop_dictionary_get(npf_dict, "translation");
    451 	nitems = prop_array_count(natlist);
    452 
    453 	nset = npf_ruleset_create(nitems);
    454 	error = npf_mk_natlist(nset, natlist, errdict);
    455 	if (error) {
    456 		goto fail;
    457 	}
    458 
    459 	/* Tables. */
    460 	tblset = npf_tableset_create();
    461 	tables = prop_dictionary_get(npf_dict, "tables");
    462 	error = npf_mk_tables(tblset, tables, errdict);
    463 	if (error) {
    464 		goto fail;
    465 	}
    466 
    467 	/* Rule procedures. */
    468 	rpset = npf_rprocset_create();
    469 	rprocs = prop_dictionary_get(npf_dict, "rprocs");
    470 	error = npf_mk_rprocs(rpset, rprocs, errdict);
    471 	if (error) {
    472 		goto fail;
    473 	}
    474 
    475 	/* Rules. */
    476 	rules = prop_dictionary_get(npf_dict, "rules");
    477 	nitems = prop_array_count(rules);
    478 
    479 	rlset = npf_ruleset_create(nitems);
    480 	error = npf_mk_rules(rlset, rules, rpset, errdict);
    481 	if (error) {
    482 		goto fail;
    483 	}
    484 
    485 	flush = false;
    486 	prop_dictionary_get_bool(npf_dict, "flush", &flush);
    487 
    488 	/*
    489 	 * Finally - perform the reload.
    490 	 */
    491 	npf_config_reload(npf_dict, rlset, tblset, nset, rpset, flush);
    492 
    493 	/* Turn on/off session tracking accordingly. */
    494 	npf_session_tracking(!flush);
    495 
    496 	/* Done.  Since data is consumed now, we shall not destroy it. */
    497 	tblset = NULL;
    498 	rpset = NULL;
    499 	rlset = NULL;
    500 	nset = NULL;
    501 fail:
    502 	/*
    503 	 * Note: destroy rulesets first, to drop references to the tableset.
    504 	 */
    505 	KASSERT(error == 0 || (nset || rpset || rlset || tblset));
    506 	if (nset) {
    507 		npf_ruleset_destroy(nset);
    508 	}
    509 	if (rlset) {
    510 		npf_ruleset_destroy(rlset);
    511 	}
    512 	if (rpset) {
    513 		npf_rprocset_destroy(rpset);
    514 	}
    515 	if (tblset) {
    516 		npf_tableset_destroy(tblset);
    517 	}
    518 	if (error) {
    519 		prop_object_release(npf_dict);
    520 	}
    521 
    522 	/* Error report. */
    523 #ifndef _NPF_TESTING
    524 	prop_dictionary_set_int32(errdict, "errno", error);
    525 	prop_dictionary_copyout_ioctl(pref, cmd, errdict);
    526 	prop_object_release(errdict);
    527 	error = 0;
    528 #endif
    529 	return error;
    530 }
    531 
    532 /*
    533  * npfctl_rule: add or remove dynamic rules in the specified ruleset.
    534  */
    535 int
    536 npfctl_rule(u_long cmd, void *data)
    537 {
    538 	struct plistref *pref = data;
    539 	prop_dictionary_t npf_rule, retdict = NULL;
    540 	npf_ruleset_t *rlset;
    541 	npf_rule_t *rl = NULL;
    542 	const char *ruleset_name;
    543 	uint32_t rcmd = 0;
    544 	int error;
    545 
    546 	error = prop_dictionary_copyin_ioctl(pref, cmd, &npf_rule);
    547 	if (error) {
    548 		return error;
    549 	}
    550 	prop_dictionary_get_uint32(npf_rule, "command", &rcmd);
    551 	if (!prop_dictionary_get_cstring_nocopy(npf_rule,
    552 	    "ruleset-name", &ruleset_name)) {
    553 		return EINVAL;
    554 	}
    555 
    556 	if (rcmd == NPF_CMD_RULE_ADD) {
    557 		if ((rl = npf_rule_alloc(npf_rule)) == NULL) {
    558 			return EINVAL;
    559 		}
    560 		retdict = prop_dictionary_create();
    561 	}
    562 
    563 	npf_config_enter();
    564 	rlset = npf_config_ruleset();
    565 
    566 	switch (rcmd) {
    567 	case NPF_CMD_RULE_ADD: {
    568 		if ((error = npf_ruleset_add(rlset, ruleset_name, rl)) == 0) {
    569 			/* Success. */
    570 			uint64_t id = npf_rule_getid(rl);
    571 			prop_dictionary_set_uint64(retdict, "id", id);
    572 			rl = NULL;
    573 		}
    574 		break;
    575 	}
    576 	case NPF_CMD_RULE_REMOVE: {
    577 		uint64_t id;
    578 
    579 		if (!prop_dictionary_get_uint64(npf_rule, "id", &id)) {
    580 			error = EINVAL;
    581 			break;
    582 		}
    583 		error = npf_ruleset_remove(rlset, ruleset_name, id);
    584 		break;
    585 	}
    586 	case NPF_CMD_RULE_REMKEY: {
    587 		prop_object_t obj = prop_dictionary_get(npf_rule, "key");
    588 		const void *key = prop_data_data_nocopy(obj);
    589 		size_t len = prop_data_size(obj);
    590 
    591 		if (len == 0 || len > NPF_RULE_MAXKEYLEN) {
    592 			error = EINVAL;
    593 			break;
    594 		}
    595 		error = npf_ruleset_remkey(rlset, ruleset_name, key, len);
    596 		break;
    597 	}
    598 	case NPF_CMD_RULE_LIST: {
    599 		retdict = npf_ruleset_list(rlset, ruleset_name);
    600 		break;
    601 	}
    602 	case NPF_CMD_RULE_FLUSH: {
    603 		error = npf_ruleset_flush(rlset, ruleset_name);
    604 		break;
    605 	}
    606 	default:
    607 		error = EINVAL;
    608 		break;
    609 	}
    610 
    611 	/* Destroy any removed rules. */
    612 	if (!error && rcmd != NPF_CMD_RULE_ADD && rcmd != NPF_CMD_RULE_LIST) {
    613 		npf_config_sync();
    614 		npf_ruleset_gc(rlset);
    615 	}
    616 	npf_config_exit();
    617 
    618 	if (rl) {
    619 		npf_rule_free(rl);
    620 	}
    621 	if (retdict) {
    622 		prop_object_release(npf_rule);
    623 		prop_dictionary_copyout_ioctl(pref, cmd, retdict);
    624 		prop_object_release(retdict);
    625 	}
    626 	return error;
    627 }
    628 
    629 /*
    630  * npfctl_getconf: return the config dictionary as it was submitted.
    631  * Additionally, indicate whether the ruleset is currently active.
    632  */
    633 int
    634 npfctl_getconf(u_long cmd, void *data)
    635 {
    636 	struct plistref *pref = data;
    637 	prop_dictionary_t npf_dict;
    638 	int error;
    639 
    640 	npf_config_enter();
    641 	npf_dict = npf_config_dict();
    642 	prop_dictionary_set_bool(npf_dict, "active", npf_pfil_registered_p());
    643 	error = prop_dictionary_copyout_ioctl(pref, cmd, npf_dict);
    644 	npf_config_exit();
    645 
    646 	return error;
    647 }
    648 
    649 /*
    650  * npfctl_sessions_save: construct a list of sessions and export for saving.
    651  */
    652 int
    653 npfctl_sessions_save(u_long cmd, void *data)
    654 {
    655 	struct plistref *pref = data;
    656 	prop_dictionary_t sesdict;
    657 	prop_array_t selist, nplist;
    658 	int error;
    659 
    660 	/* Create a dictionary and two lists. */
    661 	sesdict = prop_dictionary_create();
    662 	selist = prop_array_create();
    663 	nplist = prop_array_create();
    664 
    665 	/* Save the sessions. */
    666 	error = npf_session_save(selist, nplist);
    667 	if (error) {
    668 		goto fail;
    669 	}
    670 
    671 	/* Set the session list, NAT policy list and export the dictionary. */
    672 	prop_dictionary_set(sesdict, "session-list", selist);
    673 	prop_dictionary_set(sesdict, "nat-policy-list", nplist);
    674 	error = prop_dictionary_copyout_ioctl(pref, cmd, sesdict);
    675 fail:
    676 	prop_object_release(sesdict);
    677 	return error;
    678 }
    679 
    680 /*
    681  * npfctl_sessions_load: import a list of sessions, reconstruct them and load.
    682  */
    683 int
    684 npfctl_sessions_load(u_long cmd, void *data)
    685 {
    686 	const struct plistref *pref = data;
    687 	npf_sehash_t *sehasht = NULL;
    688 	prop_dictionary_t sesdict, sedict;
    689 	prop_object_iterator_t it;
    690 	prop_array_t selist;
    691 	int error;
    692 
    693 	/* Retrieve the dictionary containing session and NAT policy lists. */
    694 	error = prop_dictionary_copyin_ioctl(pref, cmd, &sesdict);
    695 	if (error)
    696 		return error;
    697 
    698 	/*
    699 	 * Note: session objects contain the references to the NAT policy
    700 	 * entries.  Therefore, no need to directly access it.
    701 	 */
    702 	selist = prop_dictionary_get(sesdict, "session-list");
    703 	if (prop_object_type(selist) != PROP_TYPE_ARRAY) {
    704 		prop_object_release(selist);
    705 		return EINVAL;
    706 	}
    707 
    708 	/* Create a session hash table. */
    709 	sehasht = sess_htable_create();
    710 	if (sehasht == NULL) {
    711 		prop_object_release(selist);
    712 		return ENOMEM;
    713 	}
    714 
    715 	/*
    716 	 * Iterate through and construct each session.  Note: acquire the
    717 	 * config lock as we access NAT policies during the restore.
    718 	 */
    719 	error = 0;
    720 	npf_config_enter();
    721 	it = prop_array_iterator(selist);
    722 	while ((sedict = prop_object_iterator_next(it)) != NULL) {
    723 		/* Session - dictionary. */
    724 		if (prop_object_type(sedict) != PROP_TYPE_DICTIONARY) {
    725 			error = EINVAL;
    726 			goto fail;
    727 		}
    728 		/* Construct and insert real session structure. */
    729 		error = npf_session_restore(sehasht, sedict);
    730 		if (error) {
    731 			goto fail;
    732 		}
    733 	}
    734 	sess_htable_reload(sehasht);
    735 fail:
    736 	npf_config_exit();
    737 	prop_object_iterator_release(it);
    738 	prop_object_release(selist);
    739 	if (error) {
    740 		/* Destroy session table. */
    741 		sess_htable_destroy(sehasht);
    742 	}
    743 	return error;
    744 }
    745 
    746 /*
    747  * npfctl_table: add, remove or query entries in the specified table.
    748  *
    749  * For maximum performance, interface is avoiding proplib(3)'s overhead.
    750  */
    751 int
    752 npfctl_table(void *data)
    753 {
    754 	const npf_ioctl_table_t *nct = data;
    755 	npf_tableset_t *tblset;
    756 	int error;
    757 
    758 	//npf_config_ref();
    759 	tblset = npf_config_tableset();
    760 
    761 	switch (nct->nct_cmd) {
    762 	case NPF_CMD_TABLE_LOOKUP:
    763 		error = npf_table_lookup(tblset, nct->nct_tid,
    764 		    nct->nct_data.ent.alen, &nct->nct_data.ent.addr);
    765 		break;
    766 	case NPF_CMD_TABLE_ADD:
    767 		error = npf_table_insert(tblset, nct->nct_tid,
    768 		    nct->nct_data.ent.alen, &nct->nct_data.ent.addr,
    769 		    nct->nct_data.ent.mask);
    770 		break;
    771 	case NPF_CMD_TABLE_REMOVE:
    772 		error = npf_table_remove(tblset, nct->nct_tid,
    773 		    nct->nct_data.ent.alen, &nct->nct_data.ent.addr,
    774 		    nct->nct_data.ent.mask);
    775 		break;
    776 	case NPF_CMD_TABLE_LIST:
    777 		error = npf_table_list(tblset, nct->nct_tid,
    778 		    nct->nct_data.buf.buf, nct->nct_data.buf.len);
    779 		break;
    780 	default:
    781 		error = EINVAL;
    782 		break;
    783 	}
    784 	//npf_config_unref();
    785 
    786 	return error;
    787 }
    788