npfctl.h revision 1.33
1 /* $NetBSD: npfctl.h,v 1.33 2013/09/20 03:03:52 rmind Exp $ */ 2 3 /*- 4 * Copyright (c) 2009-2013 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 #ifndef _NPFCTL_H_ 33 #define _NPFCTL_H_ 34 35 #include <stdio.h> 36 #include <stdbool.h> 37 #include <inttypes.h> 38 #include <assert.h> 39 #include <util.h> 40 41 #define NPF_BPFCOP 42 #include <net/npf.h> 43 44 #define _NPF_PRIVATE 45 #include <npf.h> 46 47 #include "npf_var.h" 48 49 #define NPF_DEV_PATH "/dev/npf" 50 #define NPF_CONF_PATH "/etc/npf.conf" 51 #define NPF_SESSDB_PATH "/var/db/npf_sessions.db" 52 53 typedef struct fam_addr_mask { 54 sa_family_t fam_family; 55 npf_addr_t fam_addr; 56 npf_netmask_t fam_mask; 57 unsigned long fam_ifindex; 58 } fam_addr_mask_t; 59 60 typedef struct ifnet_addr { 61 unsigned long ifna_index; 62 sa_family_t ifna_family; 63 npfvar_t * ifna_filter; 64 npfvar_t * ifna_addrs; 65 } ifnet_addr_t; 66 67 typedef struct port_range { 68 in_port_t pr_start; 69 in_port_t pr_end; 70 } port_range_t; 71 72 typedef struct addr_port { 73 npfvar_t * ap_netaddr; 74 npfvar_t * ap_portrange; 75 } addr_port_t; 76 77 typedef struct filt_opts { 78 addr_port_t fo_from; 79 addr_port_t fo_to; 80 } filt_opts_t; 81 82 typedef struct opt_proto { 83 int op_proto; 84 npfvar_t * op_opts; 85 } opt_proto_t; 86 87 typedef struct rule_group { 88 const char * rg_name; 89 uint32_t rg_attr; 90 u_int rg_ifnum; 91 bool rg_default; 92 } rule_group_t; 93 94 typedef struct proc_call { 95 const char * pc_name; 96 npfvar_t * pc_opts; 97 } proc_call_t; 98 99 typedef struct proc_param { 100 const char * pp_param; 101 const char * pp_value; 102 } proc_param_t; 103 104 enum { NPFCTL_PARSE_FILE, NPFCTL_PARSE_STRING }; 105 106 bool join(char *, size_t, int, char **, const char *); 107 void yyerror(const char *, ...) __printflike(1, 2) __dead; 108 void npfctl_parse_file(const char *); 109 void npfctl_parse_string(const char *); 110 111 void npfctl_print_error(const nl_error_t *); 112 char * npfctl_print_addrmask(int, const npf_addr_t *, npf_netmask_t); 113 bool npfctl_table_exists_p(const char *); 114 int npfctl_protono(const char *); 115 in_port_t npfctl_portno(const char *); 116 uint8_t npfctl_icmpcode(int, uint8_t, const char *); 117 uint8_t npfctl_icmptype(int, const char *); 118 unsigned long npfctl_find_ifindex(const char *); 119 npfvar_t * npfctl_parse_ifnet(const char *, const int); 120 npfvar_t * npfctl_parse_tcpflag(const char *); 121 npfvar_t * npfctl_parse_table_id(const char *); 122 npfvar_t * npfctl_parse_icmp(int, int, int); 123 npfvar_t * npfctl_parse_port_range(in_port_t, in_port_t); 124 npfvar_t * npfctl_parse_port_range_variable(const char *); 125 npfvar_t * npfctl_parse_fam_addr_mask(const char *, const char *, 126 unsigned long *); 127 bool npfctl_parse_cidr(char *, fam_addr_mask_t *, int *); 128 129 /* 130 * NPF extension loading. 131 */ 132 133 typedef struct npf_extmod npf_extmod_t; 134 135 npf_extmod_t * npf_extmod_get(const char *, nl_ext_t **); 136 int npf_extmod_param(npf_extmod_t *, nl_ext_t *, 137 const char *, const char *); 138 139 /* 140 * BFF byte-code generation interface. 141 */ 142 143 typedef struct npf_bpf npf_bpf_t; 144 145 #define MATCH_DST 0x01 146 #define MATCH_SRC 0x02 147 148 enum { 149 BM_IPVER, BM_PROTO, BM_SRC_CIDR, BM_SRC_TABLE, BM_DST_CIDR, 150 BM_DST_TABLE, BM_SRC_PORTS, BM_DST_PORTS, BM_TCPFL, BM_ICMP_TYPE, 151 BM_ICMP_CODE, 152 }; 153 154 npf_bpf_t * npfctl_bpf_create(void); 155 struct bpf_program *npfctl_bpf_complete(npf_bpf_t *); 156 const void * npfctl_bpf_bmarks(npf_bpf_t *, size_t *); 157 void npfctl_bpf_destroy(npf_bpf_t *); 158 159 void npfctl_bpf_group(npf_bpf_t *); 160 void npfctl_bpf_endgroup(npf_bpf_t *); 161 162 void npfctl_bpf_proto(npf_bpf_t *, sa_family_t, int); 163 void npfctl_bpf_cidr(npf_bpf_t *, u_int, sa_family_t, 164 const npf_addr_t *, const npf_netmask_t); 165 void npfctl_bpf_ports(npf_bpf_t *, u_int, in_port_t, in_port_t); 166 void npfctl_bpf_tcpfl(npf_bpf_t *, uint8_t, uint8_t); 167 void npfctl_bpf_icmp(npf_bpf_t *, int, int); 168 void npfctl_bpf_table(npf_bpf_t *, u_int, u_int); 169 170 /* 171 * Configuration building interface. 172 */ 173 174 #define NPFCTL_NAT_DYNAMIC 1 175 #define NPFCTL_NAT_STATIC 2 176 177 void npfctl_config_init(bool); 178 int npfctl_config_send(int, const char *); 179 nl_config_t * npfctl_config_ref(void); 180 int npfctl_config_show(int); 181 int npfctl_ruleset_show(int, const char *); 182 183 nl_rule_t * npfctl_rule_ref(void); 184 unsigned long npfctl_debug_addif(const char *); 185 186 void npfctl_build_alg(const char *); 187 void npfctl_build_rproc(const char *, npfvar_t *); 188 void npfctl_build_group(const char *, int, u_int, bool); 189 void npfctl_build_group_end(void); 190 void npfctl_build_rule(uint32_t, u_int, sa_family_t, 191 const opt_proto_t *, const filt_opts_t *, 192 const char *, const char *); 193 void npfctl_build_natseg(int, int, u_int, const addr_port_t *, 194 const addr_port_t *, const filt_opts_t *); 195 void npfctl_build_maprset(const char *, int, u_int); 196 void npfctl_build_table(const char *, u_int, const char *); 197 198 #endif 199
Indexes created Mon Sep 29 18:09:42 GMT 2025