npf_show.c revision 1.34
1 /*- 2 * Copyright (c) 2013-2020 The NetBSD Foundation, Inc. 3 * All rights reserved. 4 * 5 * This code is derived from software contributed to The NetBSD Foundation 6 * by Mindaugas Rasiukevicius. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 18 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 19 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 20 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 21 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 22 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 23 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 24 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 25 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 26 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 27 * POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30 /* 31 * NPF configuration printing. 32 * 33 * Each rule having BPF byte-code has a binary description. 34 */ 35 36 #include <sys/cdefs.h> 37 __RCSID("$NetBSD: npf_show.c,v 1.34 2025/01/27 07:54:30 mlelstv Exp $"); 38 39 #include <sys/socket.h> 40 #define __FAVOR_BSD 41 #include <netinet/in.h> 42 #include <netinet/tcp.h> 43 #include <net/if.h> 44 45 #include <stdio.h> 46 #include <stdlib.h> 47 #include <string.h> 48 #include <stdbool.h> 49 #include <inttypes.h> 50 #include <errno.h> 51 #include <err.h> 52 53 #include "npfctl.h" 54 55 #define SEEN_PROTO 0x01 56 57 typedef struct { 58 char ** values; 59 unsigned count; 60 } elem_list_t; 61 62 enum { 63 LIST_PROTO = 0, LIST_SADDR, LIST_DADDR, LIST_SPORT, LIST_DPORT, 64 LIST_COUNT, 65 }; 66 67 typedef struct { 68 nl_config_t * conf; 69 bool validating; 70 71 FILE * fp; 72 long fpos; 73 long fposln; 74 int glevel; 75 76 unsigned flags; 77 uint32_t curmark; 78 uint64_t seen_marks; 79 elem_list_t list[LIST_COUNT]; 80 81 } npf_conf_info_t; 82 83 static void print_linesep(npf_conf_info_t *); 84 85 static npf_conf_info_t * 86 npfctl_show_init(void) 87 { 88 static npf_conf_info_t stdout_ctx; 89 memset(&stdout_ctx, 0, sizeof(npf_conf_info_t)); 90 stdout_ctx.glevel = -1; 91 stdout_ctx.fp = stdout; 92 return &stdout_ctx; 93 } 94 95 static void 96 list_push(elem_list_t *list, char *val) 97 { 98 const unsigned n = list->count; 99 char **values; 100 101 if ((values = calloc(n + 1, sizeof(char *))) == NULL) { 102 err(EXIT_FAILURE, "calloc"); 103 } 104 for (unsigned i = 0; i < n; i++) { 105 values[i] = list->values[i]; 106 } 107 values[n] = val; 108 free(list->values); 109 list->values = values; 110 list->count++; 111 } 112 113 static char * 114 list_join_free(elem_list_t *list, const bool use_br, const char *sep) 115 { 116 char *s, buf[2048]; 117 118 if (!join(buf, sizeof(buf), list->count, list->values, sep)) { 119 errx(EXIT_FAILURE, "out of memory while parsing the rule"); 120 } 121 easprintf(&s, (use_br && list->count > 1) ? "{ %s }" : "%s", buf); 122 for (unsigned i = 0; i < list->count; i++) { 123 free(list->values[i]); 124 } 125 free(list->values); 126 list->values = NULL; 127 list->count = 0; 128 return s; 129 } 130 131 /* 132 * Helper routines to print various pieces of information. 133 */ 134 135 static void 136 print_indent(npf_conf_info_t *ctx, unsigned level) 137 { 138 if (ctx->glevel >= 0 && level <= (unsigned)ctx->glevel) { 139 /* 140 * Level decrease -- end of the group. 141 * Print the group closing curly bracket. 142 */ 143 ctx->fpos += fprintf(ctx->fp, "}\n\n"); 144 ctx->glevel = -1; 145 } 146 while (level--) { 147 ctx->fpos += fprintf(ctx->fp, "\t"); 148 } 149 } 150 151 static void 152 print_linesep(npf_conf_info_t *ctx) 153 { 154 if (ctx->fpos != ctx->fposln) { 155 ctx->fpos += fprintf(ctx->fp, "\n"); 156 ctx->fposln = ctx->fpos; 157 } 158 } 159 160 static size_t 161 tcpflags2string(char *buf, unsigned tfl) 162 { 163 unsigned i = 0; 164 165 if (tfl & TH_FIN) buf[i++] = 'F'; 166 if (tfl & TH_SYN) buf[i++] = 'S'; 167 if (tfl & TH_RST) buf[i++] = 'R'; 168 if (tfl & TH_PUSH) buf[i++] = 'P'; 169 if (tfl & TH_ACK) buf[i++] = 'A'; 170 if (tfl & TH_URG) buf[i++] = 'U'; 171 if (tfl & TH_ECE) buf[i++] = 'E'; 172 if (tfl & TH_CWR) buf[i++] = 'W'; 173 buf[i] = '\0'; 174 return i; 175 } 176 177 static char * 178 print_family(npf_conf_info_t *ctx __unused, const uint32_t *words) 179 { 180 const int af = words[0]; 181 182 switch (af) { 183 case AF_INET: 184 return estrdup("inet4"); 185 case AF_INET6: 186 return estrdup("inet6"); 187 default: 188 errx(EXIT_FAILURE, "invalid byte-code mark (family)"); 189 } 190 return NULL; 191 } 192 193 static char * 194 print_address(npf_conf_info_t *ctx __unused, const uint32_t *words) 195 { 196 const int af = *words++; 197 const unsigned mask = *words++; 198 const npf_addr_t *addr; 199 int alen = 0; 200 201 switch (af) { 202 case AF_INET: 203 alen = 4; 204 break; 205 case AF_INET6: 206 alen = 16; 207 break; 208 default: 209 errx(EXIT_FAILURE, "invalid byte-code mark (address)"); 210 } 211 addr = (const npf_addr_t *)words; 212 return npfctl_print_addrmask(alen, "%a", addr, mask); 213 } 214 215 static char * 216 print_number(npf_conf_info_t *ctx __unused, const uint32_t *words) 217 { 218 char *p; 219 easprintf(&p, "%u", words[0]); 220 return p; 221 } 222 223 static char * 224 print_table(npf_conf_info_t *ctx, const uint32_t *words) 225 { 226 const unsigned tid = words[0]; 227 const char *tname; 228 char *s = NULL; 229 bool ifaddr; 230 231 tname = npfctl_table_getname(ctx->conf, tid, &ifaddr); 232 easprintf(&s, ifaddr ? "ifaddrs(%s)" : "<%s>", tname); 233 return s; 234 } 235 236 static char * 237 print_proto(npf_conf_info_t *ctx, const uint32_t *words) 238 { 239 ctx->flags |= SEEN_PROTO; 240 switch (words[0]) { 241 case IPPROTO_TCP: 242 return estrdup("tcp"); 243 case IPPROTO_UDP: 244 return estrdup("udp"); 245 case IPPROTO_ICMP: 246 return estrdup("icmp"); 247 case IPPROTO_ICMPV6: 248 return estrdup("ipv6-icmp"); 249 } 250 return print_number(ctx, words); 251 } 252 253 static char * 254 print_tcpflags(npf_conf_info_t *ctx __unused, const uint32_t *words) 255 { 256 const unsigned tf = words[0], tf_mask = words[1]; 257 char buf[32]; 258 size_t n; 259 260 if ((ctx->flags & SEEN_PROTO) == 0) { 261 /* 262 * Note: the TCP flag matching might be without 'proto tcp' 263 * when using a plain 'stateful' rule. In such case, just 264 * skip showing of the flags as they are implicit. 265 */ 266 return NULL; 267 } 268 n = tcpflags2string(buf, tf); 269 if (tf != tf_mask) { 270 buf[n++] = '/'; 271 tcpflags2string(buf + n, tf_mask); 272 } 273 return estrdup(buf); 274 } 275 276 static char * 277 print_portrange(npf_conf_info_t *ctx __unused, const uint32_t *words) 278 { 279 unsigned fport = words[0], tport = words[1]; 280 char *p; 281 282 if (fport != tport) { 283 easprintf(&p, "%u-%u", fport, tport); 284 } else { 285 easprintf(&p, "%u", fport); 286 } 287 return p; 288 } 289 290 /* 291 * The main keyword mapping tables defining the syntax: 292 * - Mapping of rule attributes (flags) to the keywords. 293 * - Mapping of the byte-code marks to the keywords. 294 */ 295 296 #define F(name) __CONCAT(NPF_RULE_, name) 297 #define STATEFUL_ALL (NPF_RULE_STATEFUL | NPF_RULE_GSTATEFUL) 298 #define NAME_AT 2 299 300 static const struct attr_keyword_mapent { 301 uint32_t mask; 302 uint32_t flags; 303 const char * val; 304 } attr_keyword_map[] = { 305 { F(GROUP)|F(DYNAMIC), F(GROUP), "group" }, 306 { F(GROUP)|F(DYNAMIC), F(GROUP)|F(DYNAMIC), "ruleset" }, 307 { F(GROUP)|F(PASS), 0, "block" }, 308 { F(GROUP)|F(PASS), F(PASS), "pass" }, 309 { F(RETRST)|F(RETICMP), F(RETRST)|F(RETICMP), "return" }, 310 { F(RETRST)|F(RETICMP), F(RETRST), "return-rst" }, 311 { F(RETRST)|F(RETICMP), F(RETICMP), "return-icmp" }, 312 { STATEFUL_ALL, F(STATEFUL), "stateful" }, 313 { STATEFUL_ALL, STATEFUL_ALL, "stateful-all" }, 314 { F(DIMASK), F(IN), "in" }, 315 { F(DIMASK), F(OUT), "out" }, 316 { F(FINAL), F(FINAL), "final" }, 317 }; 318 319 static const struct mark_keyword_mapent { 320 unsigned mark; 321 const char * format; 322 int list_id; 323 char * (*printfn)(npf_conf_info_t *, const uint32_t *); 324 unsigned fwords; 325 } mark_keyword_map[] = { 326 { BM_IPVER, "family %s", LIST_PROTO, print_family, 1 }, 327 { BM_PROTO, "proto %s", LIST_PROTO, print_proto, 1 }, 328 { BM_TCPFL, "flags %s", LIST_PROTO, print_tcpflags, 2 }, 329 { BM_ICMP_TYPE, "icmp-type %s", LIST_PROTO, print_number, 1 }, 330 { BM_ICMP_CODE, "code %s", LIST_PROTO, print_number, 1 }, 331 332 { BM_SRC_NEG, NULL, -1, NULL, 0 }, 333 { BM_SRC_CIDR, NULL, LIST_SADDR, print_address, 6 }, 334 { BM_SRC_TABLE, NULL, LIST_SADDR, print_table, 1 }, 335 { BM_SRC_PORTS, NULL, LIST_SPORT, print_portrange,2 }, 336 337 { BM_DST_NEG, NULL, -1, NULL, 0 }, 338 { BM_DST_CIDR, NULL, LIST_DADDR, print_address, 6 }, 339 { BM_DST_TABLE, NULL, LIST_DADDR, print_table, 1 }, 340 { BM_DST_PORTS, NULL, LIST_DPORT, print_portrange,2 }, 341 }; 342 343 static const char * __attribute__((format_arg(2))) 344 verified_fmt(const char *fmt, const char *t __unused) 345 { 346 return fmt; 347 } 348 349 static void 350 scan_marks(npf_conf_info_t *ctx, const struct mark_keyword_mapent *mk, 351 const uint32_t *marks, size_t mlen) 352 { 353 elem_list_t sublist, *target_list; 354 355 /* 356 * If format is used for this mark, then collect multiple elements 357 * in into the list, merge and re-push the set into the target list. 358 * 359 * Currently, this is applicable only for 'proto { tcp, udp }'. 360 */ 361 memset(&sublist, 0, sizeof(elem_list_t)); 362 target_list = mk->format ? &sublist : &ctx->list[mk->list_id]; 363 364 /* Scan for the marks and extract the values. */ 365 mlen /= sizeof(uint32_t); 366 while (mlen > 2) { 367 const uint32_t m = *marks++; 368 const unsigned nwords = *marks++; 369 370 if ((mlen -= 2) < nwords) { 371 errx(EXIT_FAILURE, "byte-code marking inconsistency"); 372 } 373 if (m == mk->mark) { 374 /* 375 * Set the current mark and note it as seen. 376 * Value is processed by the print function, 377 * otherwise we just need to note the mark. 378 */ 379 ctx->curmark = m; 380 assert(BM_COUNT < (sizeof(uint64_t) * CHAR_BIT)); 381 ctx->seen_marks |= UINT64_C(1) << m; 382 assert(mk->fwords == nwords); 383 384 if (mk->printfn) { 385 char *val; 386 387 if ((val = mk->printfn(ctx, marks)) != NULL) { 388 list_push(target_list, val); 389 } 390 } 391 } 392 marks += nwords; 393 mlen -= nwords; 394 } 395 396 if (sublist.count) { 397 char *val, *elements; 398 399 elements = list_join_free(&sublist, true, ", "); 400 easprintf(&val, verified_fmt(mk->format, "%s"), elements ); 401 list_push(&ctx->list[mk->list_id], val); 402 free(elements); 403 } 404 } 405 406 static void 407 npfctl_print_id(npf_conf_info_t *ctx, nl_rule_t *rl) 408 { 409 const uint64_t id = npf_rule_getid(rl); 410 411 if (id) { 412 ctx->fpos += fprintf(ctx->fp, "# id=\"%" PRIx64 "\" ", id); 413 } 414 } 415 416 static void 417 npfctl_print_filter_generic(npf_conf_info_t *ctx) 418 { 419 elem_list_t *list = &ctx->list[LIST_PROTO]; 420 421 if (list->count) { 422 char *elements = list_join_free(list, false, " "); 423 ctx->fpos += fprintf(ctx->fp, "%s ", elements); 424 free(elements); 425 } 426 } 427 428 static bool 429 npfctl_print_filter_seg(npf_conf_info_t *ctx, unsigned which) 430 { 431 static const struct { 432 const char * keyword; 433 unsigned alist; 434 unsigned plist; 435 unsigned negbm; 436 } refs[] = { 437 [NPF_SRC] = { 438 .keyword = "from", 439 .alist = LIST_SADDR, 440 .plist = LIST_SPORT, 441 .negbm = UINT64_C(1) << BM_SRC_NEG, 442 }, 443 [NPF_DST] = { 444 .keyword = "to", 445 .alist = LIST_DADDR, 446 .plist = LIST_DPORT, 447 .negbm = UINT64_C(1) << BM_DST_NEG, 448 } 449 }; 450 const char *neg = !!(ctx->seen_marks & refs[which].negbm) ? "! " : ""; 451 const char *kwd = refs[which].keyword; 452 bool seen_filter = false; 453 elem_list_t *list; 454 char *elements; 455 456 list = &ctx->list[refs[which].alist]; 457 if (list->count != 0) { 458 seen_filter = true; 459 elements = list_join_free(list, true, ", "); 460 ctx->fpos += fprintf(ctx->fp, "%s %s%s ", kwd, neg, elements); 461 free(elements); 462 } 463 464 list = &ctx->list[refs[which].plist]; 465 if (list->count != 0) { 466 if (!seen_filter) { 467 ctx->fpos += fprintf(ctx->fp, "%s any ", kwd); 468 seen_filter = true; 469 } 470 elements = list_join_free(list, true, ", "); 471 ctx->fpos += fprintf(ctx->fp, "port %s ", elements); 472 free(elements); 473 } 474 return seen_filter; 475 } 476 477 static bool 478 npfctl_print_filter(npf_conf_info_t *ctx, nl_rule_t *rl) 479 { 480 const void *marks; 481 size_t mlen, len; 482 const void *code; 483 bool seenf = false; 484 int type; 485 486 marks = npf_rule_getinfo(rl, &mlen); 487 if (!marks && (code = npf_rule_getcode(rl, &type, &len)) != NULL) { 488 /* 489 * No marks, but the byte-code is present. This must 490 * have been filled by libpcap(3) or possibly an unknown 491 * to us byte-code. 492 */ 493 ctx->fpos += fprintf(ctx->fp, "%s ", type == NPF_CODE_BPF ? 494 "pcap-filter \"...\"" : "unrecognized-bytecode"); 495 return true; 496 } 497 ctx->flags = 0; 498 499 /* 500 * BPF filter criteria described by the byte-code marks. 501 */ 502 ctx->seen_marks = 0; 503 for (unsigned i = 0; i < __arraycount(mark_keyword_map); i++) { 504 const struct mark_keyword_mapent *mk = &mark_keyword_map[i]; 505 scan_marks(ctx, mk, marks, mlen); 506 } 507 npfctl_print_filter_generic(ctx); 508 seenf |= npfctl_print_filter_seg(ctx, NPF_SRC); 509 seenf |= npfctl_print_filter_seg(ctx, NPF_DST); 510 return seenf; 511 } 512 513 static void 514 npfctl_print_rule(npf_conf_info_t *ctx, nl_rule_t *rl, unsigned level) 515 { 516 const uint32_t attr = npf_rule_getattr(rl); 517 const char *rproc, *ifname, *name; 518 bool dyn_ruleset; 519 520 /* Rule attributes/flags. */ 521 for (unsigned i = 0; i < __arraycount(attr_keyword_map); i++) { 522 const struct attr_keyword_mapent *ak = &attr_keyword_map[i]; 523 524 if (i == NAME_AT && (name = npf_rule_getname(rl)) != NULL) { 525 ctx->fpos += fprintf(ctx->fp, "\"%s\" ", name); 526 } 527 if ((attr & ak->mask) == ak->flags) { 528 ctx->fpos += fprintf(ctx->fp, "%s ", ak->val); 529 } 530 } 531 if ((ifname = npf_rule_getinterface(rl)) != NULL) { 532 ctx->fpos += fprintf(ctx->fp, "on %s ", ifname); 533 } 534 if (attr == (NPF_RULE_GROUP | NPF_RULE_IN | NPF_RULE_OUT) && !ifname) { 535 /* The default group is a special case. */ 536 ctx->fpos += fprintf(ctx->fp, "default "); 537 } 538 if ((attr & NPF_DYNAMIC_GROUP) == NPF_RULE_GROUP) { 539 /* Group; done. */ 540 ctx->fpos += fprintf(ctx->fp, "{ "); 541 ctx->glevel = level; 542 goto out; 543 } 544 545 /* Print filter criteria. */ 546 dyn_ruleset = (attr & NPF_DYNAMIC_GROUP) == NPF_DYNAMIC_GROUP; 547 if (!npfctl_print_filter(ctx, rl) && !dyn_ruleset) { 548 ctx->fpos += fprintf(ctx->fp, "all "); 549 } 550 551 /* Rule procedure. */ 552 if ((rproc = npf_rule_getproc(rl)) != NULL) { 553 ctx->fpos += fprintf(ctx->fp, "apply \"%s\" ", rproc); 554 } 555 out: 556 npfctl_print_id(ctx, rl); 557 ctx->fpos += fprintf(ctx->fp, "\n"); 558 } 559 560 static void 561 npfctl_print_nat(npf_conf_info_t *ctx, nl_nat_t *nt) 562 { 563 const unsigned dynamic_natset = NPF_RULE_GROUP | NPF_RULE_DYNAMIC; 564 nl_rule_t *rl = (nl_nat_t *)nt; 565 const char *ifname, *algo, *seg1, *seg2, *arrow; 566 const npf_addr_t *addr; 567 npf_netmask_t mask; 568 in_port_t port; 569 size_t alen; 570 unsigned flags; 571 char *seg; 572 573 /* Get flags and the interface. */ 574 flags = npf_nat_getflags(nt); 575 ifname = npf_rule_getinterface(rl); 576 assert(ifname != NULL); 577 578 if ((npf_rule_getattr(rl) & dynamic_natset) == dynamic_natset) { 579 const char *name = npf_rule_getname(rl); 580 ctx->fpos += fprintf(ctx->fp, 581 "map ruleset \"%s\" on %s\n", name, ifname); 582 return; 583 } 584 585 /* Get the translation address or table (and port, if used). */ 586 addr = npf_nat_getaddr(nt, &alen, &mask); 587 if (addr) { 588 seg = npfctl_print_addrmask(alen, "%a", addr, mask); 589 } else { 590 const unsigned tid = npf_nat_gettable(nt); 591 const char *tname; 592 bool ifaddr; 593 594 tname = npfctl_table_getname(ctx->conf, tid, &ifaddr); 595 easprintf(&seg, ifaddr ? "ifaddrs(%s)" : "<%s>", tname); 596 } 597 598 if ((port = npf_nat_getport(nt)) != 0) { 599 char *p; 600 easprintf(&p, "%s port %u", seg, ntohs(port)); 601 free(seg), seg = p; 602 } 603 seg1 = seg2 = "any"; 604 605 /* Get the NAT type and determine the translation segment. */ 606 switch (npf_nat_gettype(nt)) { 607 case NPF_NATIN: 608 arrow = "<-"; 609 seg1 = seg; 610 break; 611 case NPF_NATOUT: 612 arrow = "->"; 613 seg2 = seg; 614 break; 615 default: 616 abort(); 617 } 618 619 /* NAT algorithm. */ 620 switch (npf_nat_getalgo(nt)) { 621 case NPF_ALGO_NETMAP: 622 algo = "algo netmap "; 623 break; 624 case NPF_ALGO_IPHASH: 625 algo = "algo ip-hash "; 626 break; 627 case NPF_ALGO_RR: 628 algo = "algo round-robin "; 629 break; 630 case NPF_ALGO_NPT66: 631 algo = "algo npt66 "; 632 break; 633 default: 634 algo = ""; 635 break; 636 } 637 638 /* XXX also handle "any" */ 639 640 /* Print out the NAT policy with the filter criteria. */ 641 ctx->fpos += fprintf(ctx->fp, "map %s %s %s%s%s %s %s pass ", 642 ifname, (flags & NPF_NAT_STATIC) ? "static" : "dynamic", 643 algo, (flags & NPF_NAT_PORTS) ? "" : "no-ports ", 644 seg1, arrow, seg2); 645 npfctl_print_filter(ctx, rl); 646 npfctl_print_id(ctx, rl); 647 ctx->fpos += fprintf(ctx->fp, "\n"); 648 free(seg); 649 } 650 651 static void 652 npfctl_print_table(npf_conf_info_t *ctx, nl_table_t *tl) 653 { 654 const char *name = npf_table_getname(tl); 655 const unsigned type = npf_table_gettype(tl); 656 const char *table_types[] = { 657 [NPF_TABLE_IPSET] = "ipset", 658 [NPF_TABLE_LPM] = "lpm", 659 [NPF_TABLE_CONST] = "const", 660 }; 661 662 if (name[0] == '.') { 663 /* Internal tables use dot and are hidden. */ 664 return; 665 } 666 assert(type < __arraycount(table_types)); 667 ctx->fpos += fprintf(ctx->fp, 668 "table <%s> type %s\n", name, table_types[type]); 669 } 670 671 static void 672 npfctl_print_params(npf_conf_info_t *ctx, nl_config_t *ncf) 673 { 674 nl_iter_t i = NPF_ITER_BEGIN; 675 int val, defval, *dval; 676 const char *name; 677 678 dval = ctx->validating ? NULL : &defval; 679 while ((name = npf_param_iterate(ncf, &i, &val, dval)) != NULL) { 680 if (dval && val == *dval) { 681 continue; 682 } 683 ctx->fpos += fprintf(ctx->fp, "set %s %d\n", name, val); 684 } 685 print_linesep(ctx); 686 } 687 688 int 689 npfctl_config_show(int fd) 690 { 691 npf_conf_info_t *ctx = npfctl_show_init(); 692 nl_config_t *ncf; 693 bool loaded; 694 695 if (fd) { 696 ncf = npf_config_retrieve(fd); 697 if (ncf == NULL) { 698 return errno; 699 } 700 loaded = npf_config_loaded_p(ncf); 701 ctx->validating = false; 702 ctx->fpos += fprintf(ctx->fp, 703 "# filtering:\t%s\n# config:\t%s\n", 704 npf_config_active_p(ncf) ? "active" : "inactive", 705 loaded ? "loaded" : "empty"); 706 print_linesep(ctx); 707 } else { 708 ncf = npfctl_config_ref(); 709 npfctl_config_build(); 710 ctx->validating = true; 711 loaded = true; 712 } 713 ctx->conf = ncf; 714 715 if (loaded) { 716 nl_rule_t *rl; 717 nl_rproc_t *rp; 718 nl_nat_t *nt; 719 nl_table_t *tl; 720 nl_iter_t i; 721 unsigned level; 722 723 npfctl_print_params(ctx, ncf); 724 725 i = NPF_ITER_BEGIN; 726 while ((tl = npf_table_iterate(ncf, &i)) != NULL) { 727 npfctl_print_table(ctx, tl); 728 } 729 print_linesep(ctx); 730 731 i = NPF_ITER_BEGIN; 732 while ((rp = npf_rproc_iterate(ncf, &i)) != NULL) { 733 const char *rpname = npf_rproc_getname(rp); 734 ctx->fpos += fprintf(ctx->fp, 735 "procedure \"%s\"\n", rpname); 736 } 737 print_linesep(ctx); 738 739 i = NPF_ITER_BEGIN; 740 while ((nt = npf_nat_iterate(ncf, &i)) != NULL) { 741 npfctl_print_nat(ctx, nt); 742 } 743 print_linesep(ctx); 744 745 i = NPF_ITER_BEGIN; 746 while ((rl = npf_rule_iterate(ncf, &i, &level)) != NULL) { 747 print_indent(ctx, level); 748 npfctl_print_rule(ctx, rl, level); 749 } 750 print_indent(ctx, 0); 751 } 752 npf_config_destroy(ncf); 753 return 0; 754 } 755 756 int 757 npfctl_ruleset_show(int fd, const char *ruleset_name) 758 { 759 npf_conf_info_t *ctx = npfctl_show_init(); 760 nl_config_t *ncf; 761 nl_rule_t *rl; 762 unsigned level; 763 nl_iter_t i; 764 int error; 765 766 ncf = npf_config_create(); 767 ctx->conf = ncf; 768 769 if ((error = _npf_ruleset_list(fd, ruleset_name, ncf)) != 0) { 770 return error; 771 } 772 i = NPF_ITER_BEGIN; 773 while ((rl = npf_rule_iterate(ncf, &i, &level)) != NULL) { 774 npfctl_print_rule(ctx, rl, 0); 775 } 776 npf_config_destroy(ncf); 777 return error; 778 } 779
Indexes created Mon Sep 29 21:09:56 GMT 2025