Home | History | Annotate | Line # | Download | only in npfctl
npfctl.c revision 1.22 
      1 /*	$NetBSD: npfctl.c,v 1.22 2012/10/31 08:54:39 martin Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2009-2012 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This material is based upon work partially supported by The
      8  * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     29  * POSSIBILITY OF SUCH DAMAGE.
     30  */
     31 
     32 #include <sys/cdefs.h>
     33 __RCSID("$NetBSD: npfctl.c,v 1.22 2012/10/31 08:54:39 martin Exp $");
     34 
     35 #include <sys/ioctl.h>
     36 #include <sys/stat.h>
     37 #include <sys/types.h>
     38 
     39 #include <stdio.h>
     40 #include <stdlib.h>
     41 #include <string.h>
     42 #include <err.h>
     43 #include <fcntl.h>
     44 #include <unistd.h>
     45 #include <errno.h>
     46 
     47 #include <util.h>
     48 
     49 #include "npfctl.h"
     50 
     51 extern int		yylineno, yycolumn;
     52 extern const char *	yyfilename;
     53 extern int		yyparse(void);
     54 extern void		yyrestart(FILE *);
     55 
     56 enum {
     57 	NPFCTL_START,
     58 	NPFCTL_STOP,
     59 	NPFCTL_RELOAD,
     60 	NPFCTL_SHOWCONF,
     61 	NPFCTL_FLUSH,
     62 	NPFCTL_TABLE,
     63 	NPFCTL_STATS,
     64 	NPFCTL_SESSIONS_SAVE,
     65 	NPFCTL_SESSIONS_LOAD,
     66 };
     67 
     68 static const struct operations_s {
     69 	const char *		cmd;
     70 	int			action;
     71 } operations[] = {
     72 	/* Start, stop, reload */
     73 	{	"start",		NPFCTL_START		},
     74 	{	"stop",			NPFCTL_STOP		},
     75 	{	"reload",		NPFCTL_RELOAD		},
     76 	{	"show",			NPFCTL_SHOWCONF,	},
     77 	{	"flush",		NPFCTL_FLUSH		},
     78 	/* Table */
     79 	{	"table",		NPFCTL_TABLE		},
     80 	/* Stats */
     81 	{	"stats",		NPFCTL_STATS		},
     82 	/* Sessions */
     83 	{	"sess-save",		NPFCTL_SESSIONS_SAVE	},
     84 	{	"sess-load",		NPFCTL_SESSIONS_LOAD	},
     85 	/* --- */
     86 	{	NULL,			0			}
     87 };
     88 
     89 void *
     90 zalloc(size_t sz)
     91 {
     92 	void *p = malloc(sz);
     93 
     94 	if (p == NULL) {
     95 		err(EXIT_FAILURE, "zalloc");
     96 	}
     97 	memset(p, 0, sz);
     98 	return p;
     99 }
    100 
    101 void *
    102 xrealloc(void *ptr, size_t size)
    103 {
    104 	void *p = realloc(ptr, size);
    105 
    106 	if (p == NULL) {
    107 		err(EXIT_FAILURE, "xrealloc");
    108 	}
    109 	return p;
    110 }
    111 
    112 char *
    113 xstrdup(const char *s)
    114 {
    115 	char *p = strdup(s);
    116 
    117 	if (p == NULL) {
    118 		err(EXIT_FAILURE, "xstrdup");
    119 	}
    120 	return p;
    121 }
    122 
    123 char *
    124 xstrndup(const char *s, size_t len)
    125 {
    126 	char *p;
    127 
    128 	p = strndup(s, len);
    129 	if (p == NULL) {
    130 		err(EXIT_FAILURE, "xstrndup");
    131 	}
    132 	return p;
    133 }
    134 
    135 __dead static void
    136 usage(void)
    137 {
    138 	const char *progname = getprogname();
    139 
    140 	fprintf(stderr,
    141 	    "usage:\t%s [ start | stop | reload | flush | show | stats ]\n",
    142 	    progname);
    143 	fprintf(stderr,
    144 	    "\t%s ( sess-save | sess-load )\n",
    145 	    progname);
    146 	fprintf(stderr,
    147 	    "\t%s table <tid> { add | rem | test } <address/mask>\n",
    148 	    progname);
    149 	fprintf(stderr,
    150 	    "\t%s table <tid> { list | flush }\n",
    151 	    progname);
    152 
    153 	exit(EXIT_FAILURE);
    154 }
    155 
    156 static void
    157 npfctl_parsecfg(const char *cfg)
    158 {
    159 	FILE *fp;
    160 
    161 	fp = fopen(cfg, "r");
    162 	if (fp == NULL) {
    163 		err(EXIT_FAILURE, "open '%s'", cfg);
    164 	}
    165 	yyrestart(fp);
    166 	yylineno = 1;
    167 	yycolumn = 0;
    168 	yyfilename = cfg;
    169 	yyparse();
    170 	fclose(fp);
    171 }
    172 
    173 static int
    174 npfctl_print_stats(int fd)
    175 {
    176 	static const struct stats_s {
    177 		/* Note: -1 indicates a new section. */
    178 		int		index;
    179 		const char *	name;
    180 	} stats[] = {
    181 		{ -1, "Packets passed"					},
    182 		{ NPF_STAT_PASS_DEFAULT,	"default pass"		},
    183 		{ NPF_STAT_PASS_RULESET,	"ruleset pass"		},
    184 		{ NPF_STAT_PASS_SESSION,	"session pass"		},
    185 
    186 		{ -1, "Packets blocked"					},
    187 		{ NPF_STAT_BLOCK_DEFAULT,	"default block"		},
    188 		{ NPF_STAT_BLOCK_RULESET,	"ruleset block"		},
    189 
    190 		{ -1, "Session and NAT entries"				},
    191 		{ NPF_STAT_SESSION_CREATE,	"session allocations"	},
    192 		{ NPF_STAT_SESSION_DESTROY,	"session destructions"	},
    193 		{ NPF_STAT_NAT_CREATE,		"NAT entry allocations"	},
    194 		{ NPF_STAT_NAT_DESTROY,		"NAT entry destructions"},
    195 
    196 		{ -1, "Invalid packet state cases"			},
    197 		{ NPF_STAT_INVALID_STATE,	"cases in total"	},
    198 		{ NPF_STAT_INVALID_STATE_TCP1,	"TCP case I"		},
    199 		{ NPF_STAT_INVALID_STATE_TCP2,	"TCP case II"		},
    200 		{ NPF_STAT_INVALID_STATE_TCP3,	"TCP case III"		},
    201 
    202 		{ -1, "Packet race cases"				},
    203 		{ NPF_STAT_RACE_NAT,		"NAT association race"	},
    204 		{ NPF_STAT_RACE_SESSION,	"duplicate session race"},
    205 
    206 		{ -1, "Fragmentation"					},
    207 		{ NPF_STAT_FRAGMENTS,		"fragments"		},
    208 		{ NPF_STAT_REASSEMBLY,		"reassembled"		},
    209 		{ NPF_STAT_REASSFAIL,		"failed reassembly"	},
    210 
    211 		{ -1, "Other"						},
    212 		{ NPF_STAT_ERROR,		"unexpected errors"	},
    213 	};
    214 	uint64_t *st = zalloc(NPF_STATS_SIZE);
    215 
    216 	if (ioctl(fd, IOC_NPF_STATS, &st) != 0) {
    217 		err(EXIT_FAILURE, "ioctl(IOC_NPF_STATS)");
    218 	}
    219 
    220 	for (unsigned i = 0; i < __arraycount(stats); i++) {
    221 		const char *sname = stats[i].name;
    222 		int sidx = stats[i].index;
    223 
    224 		if (sidx == -1) {
    225 			printf("%s:\n", sname);
    226 		} else {
    227 			printf("\t%"PRIu64" %s\n", st[sidx], sname);
    228 		}
    229 	}
    230 
    231 	free(st);
    232 	return 0;
    233 }
    234 
    235 void
    236 npfctl_print_error(const nl_error_t *ne)
    237 {
    238 	static const char *ncode_errors[] = {
    239 		[-NPF_ERR_OPCODE]	= "invalid instruction",
    240 		[-NPF_ERR_JUMP]		= "invalid jump",
    241 		[-NPF_ERR_REG]		= "invalid register",
    242 		[-NPF_ERR_INVAL]	= "invalid argument value",
    243 		[-NPF_ERR_RANGE]	= "processing out of range"
    244 	};
    245 	const int nc_err = ne->ne_ncode_error;
    246 	const char *srcfile = ne->ne_source_file;
    247 
    248 	if (srcfile) {
    249 		warnx("source %s line %d", srcfile, ne->ne_source_line);
    250 	}
    251 	if (nc_err) {
    252 		warnx("n-code error (%d): %s at offset 0x%x",
    253 		    nc_err, ncode_errors[-nc_err], ne->ne_ncode_errat);
    254 	}
    255 	if (ne->ne_id) {
    256 		warnx("object: %d", ne->ne_id);
    257 	}
    258 }
    259 
    260 char *
    261 npfctl_print_addrmask(int alen, npf_addr_t *addr, npf_netmask_t mask)
    262 {
    263 	struct sockaddr_storage ss;
    264 	char *buf = zalloc(64);
    265 	int len;
    266 
    267 	switch (alen) {
    268 	case 4: {
    269 		struct sockaddr_in *sin = (void *)&ss;
    270 		sin->sin_len = sizeof(*sin);
    271 		sin->sin_family = AF_INET;
    272 		sin->sin_port = 0;
    273 		memcpy(&sin->sin_addr, addr, sizeof(sin->sin_addr));
    274 		break;
    275 	}
    276 	case 16: {
    277 		struct sockaddr_in6 *sin6 = (void *)&ss;
    278 		sin6->sin6_len = sizeof(*sin6);
    279 		sin6->sin6_family = AF_INET6;
    280 		sin6->sin6_port = 0;
    281 		memcpy(&sin6->sin6_addr, addr, sizeof(sin6->sin6_addr));
    282 		break;
    283 	}
    284 	default:
    285 		assert(false);
    286 	}
    287 	len = sockaddr_snprintf(buf, 64, "%a", (struct sockaddr *)&ss);
    288 	if (mask) {
    289 		snprintf(&buf[len], 64 - len, "/%u", mask);
    290 	}
    291 	return buf;
    292 }
    293 
    294 __dead static void
    295 npfctl_table(int fd, int argc, char **argv)
    296 {
    297 	static const struct tblops_s {
    298 		const char *	cmd;
    299 		int		action;
    300 	} tblops[] = {
    301 		{ "add",	NPF_IOCTL_TBLENT_ADD		},
    302 		{ "rem",	NPF_IOCTL_TBLENT_REM		},
    303 		{ "test",	NPF_IOCTL_TBLENT_LOOKUP		},
    304 		{ "list",	NPF_IOCTL_TBLENT_LIST		},
    305 		{ NULL,		0				}
    306 	};
    307 	npf_ioctl_table_t nct;
    308 	fam_addr_mask_t fam;
    309 	size_t buflen = 512;
    310 	char *cmd, *arg = NULL; /* XXX gcc */
    311 	int n, alen;
    312 
    313 	/* Default action is list. */
    314 	memset(&nct, 0, sizeof(npf_ioctl_table_t));
    315 	nct.nct_tid = atoi(argv[0]);
    316 	cmd = argv[1];
    317 
    318 	for (n = 0; tblops[n].cmd != NULL; n++) {
    319 		if (strcmp(cmd, tblops[n].cmd) != 0) {
    320 			continue;
    321 		}
    322 		nct.nct_action = tblops[n].action;
    323 		break;
    324 	}
    325 	if (tblops[n].cmd == NULL) {
    326 		errx(EXIT_FAILURE, "invalid command '%s'", cmd);
    327 	}
    328 	if (nct.nct_action != NPF_IOCTL_TBLENT_LIST) {
    329 		if (argc < 3) {
    330 			usage();
    331 		}
    332 		arg = argv[2];
    333 	}
    334 again:
    335 	if (nct.nct_action == NPF_IOCTL_TBLENT_LIST) {
    336 		nct.nct_data.buf.buf = zalloc(buflen);
    337 		nct.nct_data.buf.len = buflen;
    338 	} else {
    339 		if (!npfctl_parse_cidr(arg, &fam, &alen)) {
    340 			errx(EXIT_FAILURE, "invalid CIDR '%s'", arg);
    341 		}
    342 		nct.nct_data.ent.alen = alen;
    343 		memcpy(&nct.nct_data.ent.addr, &fam.fam_addr, sizeof(npf_addr_t));
    344 		nct.nct_data.ent.mask = fam.fam_mask;
    345 	}
    346 
    347 	if (ioctl(fd, IOC_NPF_TABLE, &nct) != -1) {
    348 		errno = 0;
    349 	}
    350 	switch (errno) {
    351 	case 0:
    352 		break;
    353 	case EEXIST:
    354 		errx(EXIT_FAILURE, "entry already exists or is conflicting");
    355 	case ENOENT:
    356 		errx(EXIT_FAILURE, "no matching entry was not found");
    357 	case EINVAL:
    358 		errx(EXIT_FAILURE, "invalid address, mask or table ID");
    359 	case ENOMEM:
    360 		if (nct.nct_action == NPF_IOCTL_TBLENT_LIST) {
    361 			/* XXX */
    362 			free(nct.nct_data.buf.buf);
    363 			buflen <<= 1;
    364 			goto again;
    365 		}
    366 		/* FALLTHROUGH */
    367 	default:
    368 		err(EXIT_FAILURE, "ioctl");
    369 	}
    370 
    371 	if (nct.nct_action == NPF_IOCTL_TBLENT_LIST) {
    372 		npf_ioctl_ent_t *ent = nct.nct_data.buf.buf;
    373 		char *buf;
    374 
    375 		while (nct.nct_data.buf.len--) {
    376 			if (!ent->alen)
    377 				break;
    378 			buf = npfctl_print_addrmask(ent->alen,
    379 			    &ent->addr, ent->mask);
    380 			puts(buf);
    381 			ent++;
    382 		}
    383 		free(nct.nct_data.buf.buf);
    384 	} else {
    385 		printf("%s: %s\n", getprogname(),
    386 		    nct.nct_action == NPF_IOCTL_TBLENT_LOOKUP ?
    387 		    "matching entry found" : "success");
    388 	}
    389 	exit(EXIT_SUCCESS);
    390 }
    391 
    392 static void
    393 npfctl(int action, int argc, char **argv)
    394 {
    395 	int fd, ret, ver, boolval;
    396 
    397 	fd = open(NPF_DEV_PATH, O_RDONLY);
    398 	if (fd == -1) {
    399 		err(EXIT_FAILURE, "cannot open '%s'", NPF_DEV_PATH);
    400 	}
    401 	ret = ioctl(fd, IOC_NPF_VERSION, &ver);
    402 	if (ret == -1) {
    403 		err(EXIT_FAILURE, "ioctl");
    404 	}
    405 	if (ver != NPF_VERSION) {
    406 		errx(EXIT_FAILURE,
    407 		    "incompatible NPF interface version (%d, kernel %d)\n"
    408 		    "Hint: update userland?", NPF_VERSION, ver);
    409 	}
    410 	switch (action) {
    411 	case NPFCTL_START:
    412 		boolval = true;
    413 		ret = ioctl(fd, IOC_NPF_SWITCH, &boolval);
    414 		break;
    415 	case NPFCTL_STOP:
    416 		boolval = false;
    417 		ret = ioctl(fd, IOC_NPF_SWITCH, &boolval);
    418 		break;
    419 	case NPFCTL_RELOAD:
    420 		npfctl_config_init(false);
    421 		npfctl_parsecfg(argc < 3 ? NPF_CONF_PATH : argv[2]);
    422 		ret = npfctl_config_send(fd, NULL);
    423 		if (ret) {
    424 			errx(EXIT_FAILURE, "ioctl: %s", strerror(ret));
    425 		}
    426 		break;
    427 	case NPFCTL_SHOWCONF:
    428 		ret = npfctl_config_show(fd);
    429 		break;
    430 	case NPFCTL_FLUSH:
    431 		ret = npf_config_flush(fd);
    432 		break;
    433 	case NPFCTL_TABLE:
    434 		if ((argc -= 2) < 2) {
    435 			usage();
    436 		}
    437 		argv += 2;
    438 		npfctl_table(fd, argc, argv);
    439 		break;
    440 	case NPFCTL_STATS:
    441 		ret = npfctl_print_stats(fd);
    442 		break;
    443 	case NPFCTL_SESSIONS_SAVE:
    444 		if (npf_sessions_recv(fd, NPF_SESSDB_PATH) != 0) {
    445 			errx(EXIT_FAILURE, "could not save sessions to '%s'",
    446 			    NPF_SESSDB_PATH);
    447 		}
    448 		break;
    449 	case NPFCTL_SESSIONS_LOAD:
    450 		if (npf_sessions_send(fd, NPF_SESSDB_PATH) != 0) {
    451 			errx(EXIT_FAILURE, "no sessions loaded from '%s'",
    452 			    NPF_SESSDB_PATH);
    453 		}
    454 		break;
    455 	}
    456 	if (ret) {
    457 		err(EXIT_FAILURE, "ioctl");
    458 	}
    459 	close(fd);
    460 }
    461 
    462 int
    463 main(int argc, char **argv)
    464 {
    465 	char *cmd;
    466 
    467 	if (argc < 2) {
    468 		usage();
    469 	}
    470 	cmd = argv[1];
    471 
    472 	if (strcmp(cmd, "debug") == 0) {
    473 		const char *cfg = argc > 2 ? argv[2] : "/etc/npf.conf";
    474 		const char *out = argc > 3 ? argv[3] : "/tmp/npf.plist";
    475 
    476 		npfctl_config_init(true);
    477 		npfctl_parsecfg(cfg);
    478 		npfctl_config_send(0, out);
    479 		return EXIT_SUCCESS;
    480 	}
    481 
    482 	/* Find and call the subroutine. */
    483 	for (int n = 0; operations[n].cmd != NULL; n++) {
    484 		if (strcmp(cmd, operations[n].cmd) != 0)
    485 			continue;
    486 		npfctl(operations[n].action, argc, argv);
    487 		return EXIT_SUCCESS;
    488 	}
    489 	usage();
    490 }
    491