npf_cmd.c revision 1.1.2.2
1 1.1.2.2 martin /*- 2 1.1.2.2 martin * Copyright (c) 2009-2020 The NetBSD Foundation, Inc. 3 1.1.2.2 martin * All rights reserved. 4 1.1.2.2 martin * 5 1.1.2.2 martin * This material is based upon work partially supported by The 6 1.1.2.2 martin * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 7 1.1.2.2 martin * 8 1.1.2.2 martin * Redistribution and use in source and binary forms, with or without 9 1.1.2.2 martin * modification, are permitted provided that the following conditions 10 1.1.2.2 martin * are met: 11 1.1.2.2 martin * 1. Redistributions of source code must retain the above copyright 12 1.1.2.2 martin * notice, this list of conditions and the following disclaimer. 13 1.1.2.2 martin * 2. Redistributions in binary form must reproduce the above copyright 14 1.1.2.2 martin * notice, this list of conditions and the following disclaimer in the 15 1.1.2.2 martin * documentation and/or other materials provided with the distribution. 16 1.1.2.2 martin * 17 1.1.2.2 martin * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 18 1.1.2.2 martin * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 19 1.1.2.2 martin * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 20 1.1.2.2 martin * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 21 1.1.2.2 martin * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 22 1.1.2.2 martin * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 23 1.1.2.2 martin * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 24 1.1.2.2 martin * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 25 1.1.2.2 martin * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 26 1.1.2.2 martin * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 27 1.1.2.2 martin * POSSIBILITY OF SUCH DAMAGE. 28 1.1.2.2 martin */ 29 1.1.2.2 martin 30 1.1.2.2 martin #include <sys/cdefs.h> 31 1.1.2.2 martin __RCSID("$NetBSD: npf_cmd.c,v 1.1.2.2 2020/06/20 15:46:48 martin Exp $"); 32 1.1.2.2 martin 33 1.1.2.2 martin #include <stdio.h> 34 1.1.2.2 martin #include <string.h> 35 1.1.2.2 martin #include <stdlib.h> 36 1.1.2.2 martin #include <unistd.h> 37 1.1.2.2 martin #include <errno.h> 38 1.1.2.2 martin #include <err.h> 39 1.1.2.2 martin 40 1.1.2.2 martin #ifdef __NetBSD__ 41 1.1.2.2 martin #include <sha1.h> 42 1.1.2.2 martin #define SHA_DIGEST_LENGTH SHA1_DIGEST_LENGTH 43 1.1.2.2 martin #else 44 1.1.2.2 martin #include <openssl/sha.h> 45 1.1.2.2 martin #endif 46 1.1.2.2 martin 47 1.1.2.2 martin #include "npfctl.h" 48 1.1.2.2 martin 49 1.1.2.2 martin //////////////////////////////////////////////////////////////////////////// 50 1.1.2.2 martin // 51 1.1.2.2 martin // NPFCTL RULE COMMANDS 52 1.1.2.2 martin // 53 1.1.2.2 martin 54 1.1.2.2 martin #ifdef __NetBSD__ 55 1.1.2.2 martin static unsigned char * 56 1.1.2.2 martin SHA1(const unsigned char *d, size_t l, unsigned char *md) 57 1.1.2.2 martin { 58 1.1.2.2 martin SHA1_CTX c; 59 1.1.2.2 martin 60 1.1.2.2 martin SHA1Init(&c); 61 1.1.2.2 martin SHA1Update(&c, d, l); 62 1.1.2.2 martin SHA1Final(md, &c); 63 1.1.2.2 martin return md; 64 1.1.2.2 martin } 65 1.1.2.2 martin #endif 66 1.1.2.2 martin 67 1.1.2.2 martin static void 68 1.1.2.2 martin npfctl_generate_key(nl_rule_t *rl, void *key) 69 1.1.2.2 martin { 70 1.1.2.2 martin void *meta; 71 1.1.2.2 martin size_t len; 72 1.1.2.2 martin 73 1.1.2.2 martin if ((meta = npf_rule_export(rl, &len)) == NULL) { 74 1.1.2.2 martin errx(EXIT_FAILURE, "error generating rule key"); 75 1.1.2.2 martin } 76 1.1.2.2 martin __CTASSERT(NPF_RULE_MAXKEYLEN >= SHA_DIGEST_LENGTH); 77 1.1.2.2 martin memset(key, 0, NPF_RULE_MAXKEYLEN); 78 1.1.2.2 martin SHA1(meta, len, key); 79 1.1.2.2 martin free(meta); 80 1.1.2.2 martin } 81 1.1.2.2 martin 82 1.1.2.2 martin int 83 1.1.2.2 martin npfctl_nat_ruleset_p(const char *name, bool *natset) 84 1.1.2.2 martin { 85 1.1.2.2 martin const size_t preflen = sizeof(NPF_RULESET_MAP_PREF) - 1; 86 1.1.2.2 martin *natset = strncmp(name, NPF_RULESET_MAP_PREF, preflen) == 0; 87 1.1.2.2 martin return (*natset && strlen(name) <= preflen) ? -1 : 0; 88 1.1.2.2 martin } 89 1.1.2.2 martin 90 1.1.2.2 martin static nl_rule_t * 91 1.1.2.2 martin npfctl_parse_rule(int argc, char **argv, parse_entry_t entry) 92 1.1.2.2 martin { 93 1.1.2.2 martin char rule_string[1024]; 94 1.1.2.2 martin nl_rule_t *rl; 95 1.1.2.2 martin 96 1.1.2.2 martin /* Get the rule string and parse it. */ 97 1.1.2.2 martin if (!join(rule_string, sizeof(rule_string), argc, argv, " ")) { 98 1.1.2.2 martin errx(EXIT_FAILURE, "command too long"); 99 1.1.2.2 martin } 100 1.1.2.2 martin npfctl_parse_string(rule_string, entry); 101 1.1.2.2 martin if ((rl = npfctl_rule_ref()) == NULL) { 102 1.1.2.2 martin errx(EXIT_FAILURE, "could not parse the rule"); 103 1.1.2.2 martin } 104 1.1.2.2 martin return rl; 105 1.1.2.2 martin } 106 1.1.2.2 martin 107 1.1.2.2 martin void 108 1.1.2.2 martin npfctl_rule(int fd, int argc, char **argv) 109 1.1.2.2 martin { 110 1.1.2.2 martin static const struct ruleops_s { 111 1.1.2.2 martin const char * cmd; 112 1.1.2.2 martin int action; 113 1.1.2.2 martin bool extra_arg; 114 1.1.2.2 martin } ruleops[] = { 115 1.1.2.2 martin { "add", NPF_CMD_RULE_ADD, true }, 116 1.1.2.2 martin { "rem", NPF_CMD_RULE_REMKEY, true }, 117 1.1.2.2 martin { "del", NPF_CMD_RULE_REMKEY, true }, 118 1.1.2.2 martin { "rem-id", NPF_CMD_RULE_REMOVE, true }, 119 1.1.2.2 martin { "list", NPF_CMD_RULE_LIST, false }, 120 1.1.2.2 martin { "flush", NPF_CMD_RULE_FLUSH, false }, 121 1.1.2.2 martin { NULL, 0, 0 } 122 1.1.2.2 martin }; 123 1.1.2.2 martin uint8_t key[NPF_RULE_MAXKEYLEN]; 124 1.1.2.2 martin const char *ruleset_name = argv[0]; 125 1.1.2.2 martin const char *cmd = argv[1]; 126 1.1.2.2 martin int error, action = 0; 127 1.1.2.2 martin bool extra_arg, natset; 128 1.1.2.2 martin parse_entry_t entry; 129 1.1.2.2 martin uint64_t rule_id; 130 1.1.2.2 martin nl_rule_t *rl; 131 1.1.2.2 martin 132 1.1.2.2 martin for (unsigned n = 0; ruleops[n].cmd != NULL; n++) { 133 1.1.2.2 martin if (strcmp(cmd, ruleops[n].cmd) == 0) { 134 1.1.2.2 martin action = ruleops[n].action; 135 1.1.2.2 martin extra_arg = ruleops[n].extra_arg; 136 1.1.2.2 martin break; 137 1.1.2.2 martin } 138 1.1.2.2 martin } 139 1.1.2.2 martin argc -= 2; 140 1.1.2.2 martin argv += 2; 141 1.1.2.2 martin 142 1.1.2.2 martin if (!action || (extra_arg && argc == 0)) { 143 1.1.2.2 martin usage(); 144 1.1.2.2 martin } 145 1.1.2.2 martin 146 1.1.2.2 martin if (npfctl_nat_ruleset_p(ruleset_name, &natset) != 0) { 147 1.1.2.2 martin errx(EXIT_FAILURE, 148 1.1.2.2 martin "invalid NAT ruleset name (note: the name must be " 149 1.1.2.2 martin "prefixed with `" NPF_RULESET_MAP_PREF "`)"); 150 1.1.2.2 martin } 151 1.1.2.2 martin entry = natset ? NPFCTL_PARSE_MAP : NPFCTL_PARSE_RULE; 152 1.1.2.2 martin 153 1.1.2.2 martin switch (action) { 154 1.1.2.2 martin case NPF_CMD_RULE_ADD: 155 1.1.2.2 martin rl = npfctl_parse_rule(argc, argv, entry); 156 1.1.2.2 martin npfctl_generate_key(rl, key); 157 1.1.2.2 martin npf_rule_setkey(rl, key, sizeof(key)); 158 1.1.2.2 martin error = npf_ruleset_add(fd, ruleset_name, rl, &rule_id); 159 1.1.2.2 martin break; 160 1.1.2.2 martin case NPF_CMD_RULE_REMKEY: 161 1.1.2.2 martin rl = npfctl_parse_rule(argc, argv, entry); 162 1.1.2.2 martin npfctl_generate_key(rl, key); 163 1.1.2.2 martin error = npf_ruleset_remkey(fd, ruleset_name, key, sizeof(key)); 164 1.1.2.2 martin break; 165 1.1.2.2 martin case NPF_CMD_RULE_REMOVE: 166 1.1.2.2 martin rule_id = strtoull(argv[0], NULL, 16); 167 1.1.2.2 martin error = npf_ruleset_remove(fd, ruleset_name, rule_id); 168 1.1.2.2 martin break; 169 1.1.2.2 martin case NPF_CMD_RULE_LIST: 170 1.1.2.2 martin error = npfctl_ruleset_show(fd, ruleset_name); 171 1.1.2.2 martin break; 172 1.1.2.2 martin case NPF_CMD_RULE_FLUSH: 173 1.1.2.2 martin error = npf_ruleset_flush(fd, ruleset_name); 174 1.1.2.2 martin break; 175 1.1.2.2 martin default: 176 1.1.2.2 martin abort(); 177 1.1.2.2 martin } 178 1.1.2.2 martin 179 1.1.2.2 martin switch (error) { 180 1.1.2.2 martin case 0: 181 1.1.2.2 martin /* Success. */ 182 1.1.2.2 martin break; 183 1.1.2.2 martin case ESRCH: 184 1.1.2.2 martin errx(EXIT_FAILURE, "ruleset \"%s\" not found", ruleset_name); 185 1.1.2.2 martin case ENOENT: 186 1.1.2.2 martin errx(EXIT_FAILURE, "rule was not found"); 187 1.1.2.2 martin default: 188 1.1.2.2 martin errx(EXIT_FAILURE, "rule operation: %s", strerror(error)); 189 1.1.2.2 martin } 190 1.1.2.2 martin if (action == NPF_CMD_RULE_ADD) { 191 1.1.2.2 martin printf("OK %" PRIx64 "\n", rule_id); 192 1.1.2.2 martin } 193 1.1.2.2 martin } 194 1.1.2.2 martin 195 1.1.2.2 martin //////////////////////////////////////////////////////////////////////////// 196 1.1.2.2 martin // 197 1.1.2.2 martin // NPFCTL TABLE COMMANDS 198 1.1.2.2 martin // 199 1.1.2.2 martin 200 1.1.2.2 martin static int 201 1.1.2.2 martin npfctl_table_type(const char *typename) 202 1.1.2.2 martin { 203 1.1.2.2 martin static const struct tbltype_s { 204 1.1.2.2 martin const char * name; 205 1.1.2.2 martin unsigned type; 206 1.1.2.2 martin } tbltypes[] = { 207 1.1.2.2 martin { "ipset", NPF_TABLE_IPSET }, 208 1.1.2.2 martin { "lpm", NPF_TABLE_LPM }, 209 1.1.2.2 martin { "const", NPF_TABLE_CONST }, 210 1.1.2.2 martin { NULL, 0 } 211 1.1.2.2 martin }; 212 1.1.2.2 martin 213 1.1.2.2 martin for (unsigned i = 0; tbltypes[i].name != NULL; i++) { 214 1.1.2.2 martin if (strcmp(typename, tbltypes[i].name) == 0) { 215 1.1.2.2 martin return tbltypes[i].type; 216 1.1.2.2 martin } 217 1.1.2.2 martin } 218 1.1.2.2 martin return 0; 219 1.1.2.2 martin } 220 1.1.2.2 martin 221 1.1.2.2 martin void 222 1.1.2.2 martin npfctl_table_replace(int fd, int argc, char **argv) 223 1.1.2.2 martin { 224 1.1.2.2 martin const char *name, *newname, *path, *typename = NULL; 225 1.1.2.2 martin nl_config_t *ncf; 226 1.1.2.2 martin nl_table_t *t; 227 1.1.2.2 martin unsigned type = 0; 228 1.1.2.2 martin int c, tid = -1; 229 1.1.2.2 martin FILE *fp; 230 1.1.2.2 martin 231 1.1.2.2 martin name = newname = argv[0]; 232 1.1.2.2 martin optind = 2; 233 1.1.2.2 martin while ((c = getopt(argc, argv, "n:t:")) != -1) { 234 1.1.2.2 martin switch (c) { 235 1.1.2.2 martin case 't': 236 1.1.2.2 martin typename = optarg; 237 1.1.2.2 martin break; 238 1.1.2.2 martin case 'n': 239 1.1.2.2 martin newname = optarg; 240 1.1.2.2 martin break; 241 1.1.2.2 martin default: 242 1.1.2.2 martin errx(EXIT_FAILURE, 243 1.1.2.2 martin "Usage: %s table \"table-name\" replace " 244 1.1.2.2 martin "[-n \"name\"] [-t <type>] <table-file>\n", 245 1.1.2.2 martin getprogname()); 246 1.1.2.2 martin } 247 1.1.2.2 martin } 248 1.1.2.2 martin argc -= optind; 249 1.1.2.2 martin argv += optind; 250 1.1.2.2 martin 251 1.1.2.2 martin if (typename && (type = npfctl_table_type(typename)) == 0) { 252 1.1.2.2 martin errx(EXIT_FAILURE, "unsupported table type '%s'", typename); 253 1.1.2.2 martin } 254 1.1.2.2 martin 255 1.1.2.2 martin if (argc != 1) { 256 1.1.2.2 martin usage(); 257 1.1.2.2 martin } 258 1.1.2.2 martin 259 1.1.2.2 martin path = argv[0]; 260 1.1.2.2 martin if (strcmp(path, "-") == 0) { 261 1.1.2.2 martin path = "stdin"; 262 1.1.2.2 martin fp = stdin; 263 1.1.2.2 martin } else if ((fp = fopen(path, "r")) == NULL) { 264 1.1.2.2 martin err(EXIT_FAILURE, "open '%s'", path); 265 1.1.2.2 martin } 266 1.1.2.2 martin 267 1.1.2.2 martin /* Get existing config to lookup ID of existing table */ 268 1.1.2.2 martin if ((ncf = npf_config_retrieve(fd)) == NULL) { 269 1.1.2.2 martin err(EXIT_FAILURE, "npf_config_retrieve()"); 270 1.1.2.2 martin } 271 1.1.2.2 martin if ((t = npfctl_table_getbyname(ncf, name)) == NULL) { 272 1.1.2.2 martin errx(EXIT_FAILURE, 273 1.1.2.2 martin "table '%s' not found in the active configuration", name); 274 1.1.2.2 martin } 275 1.1.2.2 martin tid = npf_table_getid(t); 276 1.1.2.2 martin if (!type) { 277 1.1.2.2 martin type = npf_table_gettype(t); 278 1.1.2.2 martin } 279 1.1.2.2 martin npf_config_destroy(ncf); 280 1.1.2.2 martin 281 1.1.2.2 martin if ((t = npfctl_load_table(newname, tid, type, path, fp)) == NULL) { 282 1.1.2.2 martin err(EXIT_FAILURE, "table load failed"); 283 1.1.2.2 martin } 284 1.1.2.2 martin 285 1.1.2.2 martin if (npf_table_replace(fd, t, NULL)) { 286 1.1.2.2 martin err(EXIT_FAILURE, "npf_table_replace(<%s>)", name); 287 1.1.2.2 martin } 288 1.1.2.2 martin } 289 1.1.2.2 martin 290 1.1.2.2 martin void 291 1.1.2.2 martin npfctl_table(int fd, int argc, char **argv) 292 1.1.2.2 martin { 293 1.1.2.2 martin static const struct tblops_s { 294 1.1.2.2 martin const char * cmd; 295 1.1.2.2 martin int action; 296 1.1.2.2 martin } tblops[] = { 297 1.1.2.2 martin { "add", NPF_CMD_TABLE_ADD }, 298 1.1.2.2 martin { "rem", NPF_CMD_TABLE_REMOVE }, 299 1.1.2.2 martin { "del", NPF_CMD_TABLE_REMOVE }, 300 1.1.2.2 martin { "test", NPF_CMD_TABLE_LOOKUP }, 301 1.1.2.2 martin { "list", NPF_CMD_TABLE_LIST }, 302 1.1.2.2 martin { "flush", NPF_CMD_TABLE_FLUSH }, 303 1.1.2.2 martin { NULL, 0 } 304 1.1.2.2 martin }; 305 1.1.2.2 martin npf_ioctl_table_t nct; 306 1.1.2.2 martin fam_addr_mask_t fam; 307 1.1.2.2 martin size_t buflen = 512; 308 1.1.2.2 martin char *cmd, *arg; 309 1.1.2.2 martin int n, alen; 310 1.1.2.2 martin 311 1.1.2.2 martin /* Default action is list. */ 312 1.1.2.2 martin memset(&nct, 0, sizeof(npf_ioctl_table_t)); 313 1.1.2.2 martin nct.nct_name = argv[0]; 314 1.1.2.2 martin cmd = argv[1]; 315 1.1.2.2 martin 316 1.1.2.2 martin for (n = 0; tblops[n].cmd != NULL; n++) { 317 1.1.2.2 martin if (strcmp(cmd, tblops[n].cmd) != 0) { 318 1.1.2.2 martin continue; 319 1.1.2.2 martin } 320 1.1.2.2 martin nct.nct_cmd = tblops[n].action; 321 1.1.2.2 martin break; 322 1.1.2.2 martin } 323 1.1.2.2 martin if (tblops[n].cmd == NULL) { 324 1.1.2.2 martin errx(EXIT_FAILURE, "invalid command '%s'", cmd); 325 1.1.2.2 martin } 326 1.1.2.2 martin 327 1.1.2.2 martin switch (nct.nct_cmd) { 328 1.1.2.2 martin case NPF_CMD_TABLE_LIST: 329 1.1.2.2 martin case NPF_CMD_TABLE_FLUSH: 330 1.1.2.2 martin arg = NULL; 331 1.1.2.2 martin break; 332 1.1.2.2 martin default: 333 1.1.2.2 martin if (argc < 3) { 334 1.1.2.2 martin usage(); 335 1.1.2.2 martin } 336 1.1.2.2 martin arg = argv[2]; 337 1.1.2.2 martin } 338 1.1.2.2 martin 339 1.1.2.2 martin again: 340 1.1.2.2 martin switch (nct.nct_cmd) { 341 1.1.2.2 martin case NPF_CMD_TABLE_LIST: 342 1.1.2.2 martin nct.nct_data.buf.buf = ecalloc(1, buflen); 343 1.1.2.2 martin nct.nct_data.buf.len = buflen; 344 1.1.2.2 martin break; 345 1.1.2.2 martin case NPF_CMD_TABLE_FLUSH: 346 1.1.2.2 martin break; 347 1.1.2.2 martin default: 348 1.1.2.2 martin if (!npfctl_parse_cidr(arg, &fam, &alen)) { 349 1.1.2.2 martin errx(EXIT_FAILURE, "invalid CIDR '%s'", arg); 350 1.1.2.2 martin } 351 1.1.2.2 martin nct.nct_data.ent.alen = alen; 352 1.1.2.2 martin memcpy(&nct.nct_data.ent.addr, &fam.fam_addr, alen); 353 1.1.2.2 martin nct.nct_data.ent.mask = fam.fam_mask; 354 1.1.2.2 martin } 355 1.1.2.2 martin 356 1.1.2.2 martin if (ioctl(fd, IOC_NPF_TABLE, &nct) != -1) { 357 1.1.2.2 martin errno = 0; 358 1.1.2.2 martin } 359 1.1.2.2 martin switch (errno) { 360 1.1.2.2 martin case 0: 361 1.1.2.2 martin break; 362 1.1.2.2 martin case EEXIST: 363 1.1.2.2 martin errx(EXIT_FAILURE, "entry already exists or is conflicting"); 364 1.1.2.2 martin case ENOENT: 365 1.1.2.2 martin errx(EXIT_FAILURE, "not found"); 366 1.1.2.2 martin case EINVAL: 367 1.1.2.2 martin errx(EXIT_FAILURE, "invalid address, mask or table ID"); 368 1.1.2.2 martin case ENOMEM: 369 1.1.2.2 martin if (nct.nct_cmd == NPF_CMD_TABLE_LIST) { 370 1.1.2.2 martin /* XXX */ 371 1.1.2.2 martin free(nct.nct_data.buf.buf); 372 1.1.2.2 martin buflen <<= 1; 373 1.1.2.2 martin goto again; 374 1.1.2.2 martin } 375 1.1.2.2 martin /* FALLTHROUGH */ 376 1.1.2.2 martin default: 377 1.1.2.2 martin err(EXIT_FAILURE, "ioctl(IOC_NPF_TABLE)"); 378 1.1.2.2 martin } 379 1.1.2.2 martin 380 1.1.2.2 martin if (nct.nct_cmd == NPF_CMD_TABLE_LIST) { 381 1.1.2.2 martin npf_ioctl_ent_t *ent = nct.nct_data.buf.buf; 382 1.1.2.2 martin char *buf; 383 1.1.2.2 martin 384 1.1.2.2 martin while (nct.nct_data.buf.len--) { 385 1.1.2.2 martin if (!ent->alen) 386 1.1.2.2 martin break; 387 1.1.2.2 martin buf = npfctl_print_addrmask(ent->alen, "%a", 388 1.1.2.2 martin &ent->addr, ent->mask); 389 1.1.2.2 martin puts(buf); 390 1.1.2.2 martin ent++; 391 1.1.2.2 martin } 392 1.1.2.2 martin free(nct.nct_data.buf.buf); 393 1.1.2.2 martin } else { 394 1.1.2.2 martin printf("%s: %s\n", getprogname(), 395 1.1.2.2 martin nct.nct_cmd == NPF_CMD_TABLE_LOOKUP ? 396 1.1.2.2 martin "match" : "success"); 397 1.1.2.2 martin } 398 1.1.2.2 martin } 399 1.1.2.2 martin 400 1.1.2.2 martin //////////////////////////////////////////////////////////////////////////// 401 1.1.2.2 martin // 402 1.1.2.2 martin // NPFCTL CONNECTION COMMANDS 403 1.1.2.2 martin // 404 1.1.2.2 martin 405 1.1.2.2 martin typedef struct { 406 1.1.2.2 martin FILE * fp; 407 1.1.2.2 martin unsigned alen; 408 1.1.2.2 martin const char * ifname; 409 1.1.2.2 martin bool nat; 410 1.1.2.2 martin bool nowide; 411 1.1.2.2 martin bool name; 412 1.1.2.2 martin 413 1.1.2.2 martin bool v4; 414 1.1.2.2 martin unsigned pwidth; 415 1.1.2.2 martin } npf_conn_filter_t; 416 1.1.2.2 martin 417 1.1.2.2 martin static int 418 1.1.2.2 martin npfctl_conn_print(unsigned alen, const npf_addr_t *a, const in_port_t *p, 419 1.1.2.2 martin const char *ifname, void *arg) 420 1.1.2.2 martin { 421 1.1.2.2 martin const npf_conn_filter_t *fil = arg; 422 1.1.2.2 martin char *addrstr, *src, *dst; 423 1.1.2.2 martin const char *fmt; 424 1.1.2.2 martin FILE *fp = fil->fp; 425 1.1.2.2 martin bool nat_conn; 426 1.1.2.2 martin 427 1.1.2.2 martin /* 428 1.1.2.2 martin * Filter connection entries by IP version, interface and/or 429 1.1.2.2 martin * applicability of NAT. 430 1.1.2.2 martin */ 431 1.1.2.2 martin if (alen != fil->alen) { 432 1.1.2.2 martin return 0; 433 1.1.2.2 martin } 434 1.1.2.2 martin if (fil->ifname && (!ifname || strcmp(ifname, fil->ifname) != 0)) { 435 1.1.2.2 martin return 0; 436 1.1.2.2 martin } 437 1.1.2.2 martin nat_conn = !npfctl_addr_iszero(&a[2]) || p[2] != 0; 438 1.1.2.2 martin if (fil->nat && !nat_conn) { 439 1.1.2.2 martin return 0; 440 1.1.2.2 martin } 441 1.1.2.2 martin 442 1.1.2.2 martin fmt = fil->name ? "%A" : (fil->v4 ? "%a" : "[%a]"); 443 1.1.2.2 martin 444 1.1.2.2 martin addrstr = npfctl_print_addrmask(alen, fmt, &a[0], NPF_NO_NETMASK); 445 1.1.2.2 martin easprintf(&src, "%s:%d", addrstr, p[0]); 446 1.1.2.2 martin free(addrstr); 447 1.1.2.2 martin 448 1.1.2.2 martin addrstr = npfctl_print_addrmask(alen, fmt, &a[1], NPF_NO_NETMASK); 449 1.1.2.2 martin easprintf(&dst, "%s:%d", addrstr, p[1]); 450 1.1.2.2 martin free(addrstr); 451 1.1.2.2 martin 452 1.1.2.2 martin fprintf(fp, "%-*s %-*s ", fil->pwidth, src, fil->pwidth, dst); 453 1.1.2.2 martin free(src); 454 1.1.2.2 martin free(dst); 455 1.1.2.2 martin 456 1.1.2.2 martin fprintf(fp, "%-10s ", ifname ? ifname : "-"); 457 1.1.2.2 martin if (nat_conn) { 458 1.1.2.2 martin addrstr = npfctl_print_addrmask(alen, fmt, &a[2], NPF_NO_NETMASK); 459 1.1.2.2 martin fprintf(fp, "%s", addrstr); 460 1.1.2.2 martin free(addrstr); 461 1.1.2.2 martin if (p[2]) { 462 1.1.2.2 martin fprintf(fp, ":%d", p[2]); 463 1.1.2.2 martin } 464 1.1.2.2 martin } 465 1.1.2.2 martin fputc('\n', fp); 466 1.1.2.2 martin return 1; 467 1.1.2.2 martin } 468 1.1.2.2 martin 469 1.1.2.2 martin static void 470 1.1.2.2 martin npf_conn_list_v(int fd, unsigned alen, npf_conn_filter_t *f) 471 1.1.2.2 martin { 472 1.1.2.2 martin f->alen = alen; 473 1.1.2.2 martin f->v4 = alen == sizeof(struct in_addr); 474 1.1.2.2 martin f->pwidth = f->nowide ? 0 : ((f->v4 ? 15 : 40) + 1 + 5); 475 1.1.2.2 martin if (npf_conn_list(fd, npfctl_conn_print, f) != 0) { 476 1.1.2.2 martin err(EXIT_FAILURE, "npf_conn_list"); 477 1.1.2.2 martin } 478 1.1.2.2 martin } 479 1.1.2.2 martin 480 1.1.2.2 martin int 481 1.1.2.2 martin npfctl_conn_list(int fd, int argc, char **argv) 482 1.1.2.2 martin { 483 1.1.2.2 martin npf_conn_filter_t f; 484 1.1.2.2 martin bool header = true; 485 1.1.2.2 martin unsigned alen = 0; 486 1.1.2.2 martin int c; 487 1.1.2.2 martin 488 1.1.2.2 martin argc--; 489 1.1.2.2 martin argv++; 490 1.1.2.2 martin 491 1.1.2.2 martin memset(&f, 0, sizeof(f)); 492 1.1.2.2 martin f.fp = stdout; 493 1.1.2.2 martin 494 1.1.2.2 martin while ((c = getopt(argc, argv, "46hi:nNW")) != -1) { 495 1.1.2.2 martin switch (c) { 496 1.1.2.2 martin case '4': 497 1.1.2.2 martin alen = sizeof(struct in_addr); 498 1.1.2.2 martin break; 499 1.1.2.2 martin case '6': 500 1.1.2.2 martin alen = sizeof(struct in6_addr); 501 1.1.2.2 martin break; 502 1.1.2.2 martin case 'h': 503 1.1.2.2 martin header = false; 504 1.1.2.2 martin break; 505 1.1.2.2 martin case 'i': 506 1.1.2.2 martin f.ifname = optarg; 507 1.1.2.2 martin break; 508 1.1.2.2 martin case 'n': 509 1.1.2.2 martin f.nat = true; 510 1.1.2.2 martin break; 511 1.1.2.2 martin case 'N': 512 1.1.2.2 martin f.name = true; 513 1.1.2.2 martin break; 514 1.1.2.2 martin case 'W': 515 1.1.2.2 martin f.nowide = true; 516 1.1.2.2 martin break; 517 1.1.2.2 martin default: 518 1.1.2.2 martin errx(EXIT_FAILURE, 519 1.1.2.2 martin "Usage: %s list [-46hnNW] [-i <ifname>]\n", 520 1.1.2.2 martin getprogname()); 521 1.1.2.2 martin } 522 1.1.2.2 martin } 523 1.1.2.2 martin 524 1.1.2.2 martin if (header) { 525 1.1.2.2 martin fprintf(f.fp, "# %-*s %-*s %-*s %s\n", 526 1.1.2.2 martin 21 - 2, "src-addr:port", 527 1.1.2.2 martin 21, "dst-addr:port", 528 1.1.2.2 martin 10, "interface", 529 1.1.2.2 martin "nat-addr:port"); 530 1.1.2.2 martin } 531 1.1.2.2 martin 532 1.1.2.2 martin if (!alen || alen == sizeof(struct in_addr)) { 533 1.1.2.2 martin npf_conn_list_v(fd, sizeof(struct in_addr), &f); 534 1.1.2.2 martin } 535 1.1.2.2 martin if (!alen || alen == sizeof(struct in6_addr)) { 536 1.1.2.2 martin npf_conn_list_v(fd, sizeof(struct in6_addr), &f); 537 1.1.2.2 martin } 538 1.1.2.2 martin 539 1.1.2.2 martin return 0; 540 1.1.2.2 martin } 541
Indexes created Wed Oct 22 13:09:56 GMT 2025