1 /* $NetBSD: npf.c,v 1.39 2016/12/10 21:04:12 christos Exp $ */ 2 3 /*- 4 * Copyright (c) 2010-2015 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 __KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.39 2016/12/10 21:04:12 christos Exp $"); 34 35 #include <sys/types.h> 36 #include <netinet/in_systm.h> 37 #include <netinet/in.h> 38 #include <net/if.h> 39 #include <prop/proplib.h> 40 41 #include <stdlib.h> 42 #include <string.h> 43 #include <assert.h> 44 #include <errno.h> 45 #include <err.h> 46 47 #define _NPF_PRIVATE 48 #include "npf.h" 49 50 struct nl_rule { 51 prop_dictionary_t nrl_dict; 52 }; 53 54 struct nl_rproc { 55 prop_dictionary_t nrp_dict; 56 }; 57 58 struct nl_table { 59 prop_dictionary_t ntl_dict; 60 }; 61 62 struct nl_alg { 63 prop_dictionary_t nal_dict; 64 }; 65 66 struct nl_ext { 67 const char * nxt_name; 68 prop_dictionary_t nxt_dict; 69 }; 70 71 struct nl_config { 72 /* Rules, translations, procedures, tables, connections. */ 73 prop_dictionary_t ncf_dict; 74 prop_array_t ncf_alg_list; 75 prop_array_t ncf_rules_list; 76 prop_array_t ncf_rproc_list; 77 prop_array_t ncf_table_list; 78 prop_array_t ncf_nat_list; 79 prop_array_t ncf_conn_list; 80 81 /* Iterators. */ 82 prop_object_iterator_t ncf_rule_iter; 83 unsigned ncf_reduce[16]; 84 unsigned ncf_nlevel; 85 unsigned ncf_counter; 86 nl_rule_t ncf_cur_rule; 87 88 prop_object_iterator_t ncf_table_iter; 89 nl_table_t ncf_cur_table; 90 91 prop_object_iterator_t ncf_rproc_iter; 92 nl_rproc_t ncf_cur_rproc; 93 94 /* Error report and debug information. */ 95 prop_dictionary_t ncf_err; 96 prop_dictionary_t ncf_debug; 97 98 /* Custom file to externalise property-list. */ 99 const char * ncf_plist; 100 bool ncf_flush; 101 }; 102 103 static prop_array_t _npf_ruleset_transform(prop_array_t); 104 105 static bool 106 _npf_add_addr(prop_dictionary_t dict, const char *name, int af, 107 const npf_addr_t *addr) 108 { 109 size_t sz; 110 111 if (af == AF_INET) { 112 sz = sizeof(struct in_addr); 113 } else if (af == AF_INET6) { 114 sz = sizeof(struct in6_addr); 115 } else { 116 return false; 117 } 118 prop_data_t addrdat = prop_data_create_data(addr, sz); 119 if (addrdat == NULL) { 120 return false; 121 } 122 prop_dictionary_set(dict, name, addrdat); 123 prop_object_release(addrdat); 124 return true; 125 } 126 127 static bool 128 _npf_get_addr(prop_dictionary_t dict, const char *name, npf_addr_t *addr) 129 { 130 prop_object_t obj = prop_dictionary_get(dict, name); 131 const void *d = prop_data_data_nocopy(obj); 132 133 if (d == NULL) 134 return false; 135 136 size_t sz = prop_data_size(obj); 137 switch (sz) { 138 case sizeof(struct in_addr): 139 case sizeof(struct in6_addr): 140 memcpy(addr, d, sz); 141 return true; 142 default: 143 return false; 144 } 145 } 146 147 /* 148 * CONFIGURATION INTERFACE. 149 */ 150 151 nl_config_t * 152 npf_config_create(void) 153 { 154 nl_config_t *ncf; 155 156 ncf = calloc(1, sizeof(*ncf)); 157 if (ncf == NULL) { 158 return NULL; 159 } 160 ncf->ncf_alg_list = prop_array_create(); 161 ncf->ncf_rules_list = prop_array_create(); 162 ncf->ncf_rproc_list = prop_array_create(); 163 ncf->ncf_table_list = prop_array_create(); 164 ncf->ncf_nat_list = prop_array_create(); 165 166 ncf->ncf_plist = NULL; 167 ncf->ncf_flush = false; 168 169 return ncf; 170 } 171 172 int 173 npf_config_submit(nl_config_t *ncf, int fd) 174 { 175 const char *plist = ncf->ncf_plist; 176 prop_dictionary_t npf_dict; 177 prop_array_t rlset; 178 int error = 0; 179 180 npf_dict = prop_dictionary_create(); 181 if (npf_dict == NULL) { 182 return ENOMEM; 183 } 184 prop_dictionary_set_uint32(npf_dict, "version", NPF_VERSION); 185 186 rlset = _npf_ruleset_transform(ncf->ncf_rules_list); 187 if (rlset == NULL) { 188 prop_object_release(npf_dict); 189 return ENOMEM; 190 } 191 prop_object_release(ncf->ncf_rules_list); 192 ncf->ncf_rules_list = rlset; 193 194 prop_dictionary_set(npf_dict, "rules", ncf->ncf_rules_list); 195 prop_dictionary_set(npf_dict, "algs", ncf->ncf_alg_list); 196 prop_dictionary_set(npf_dict, "rprocs", ncf->ncf_rproc_list); 197 prop_dictionary_set(npf_dict, "tables", ncf->ncf_table_list); 198 prop_dictionary_set(npf_dict, "nat", ncf->ncf_nat_list); 199 if (ncf->ncf_conn_list) { 200 prop_dictionary_set(npf_dict, "conn-list", 201 ncf->ncf_conn_list); 202 } 203 prop_dictionary_set_bool(npf_dict, "flush", ncf->ncf_flush); 204 if (ncf->ncf_debug) { 205 prop_dictionary_set(npf_dict, "debug", ncf->ncf_debug); 206 } 207 208 if (plist) { 209 if (!prop_dictionary_externalize_to_file(npf_dict, plist)) { 210 error = errno; 211 } 212 prop_object_release(npf_dict); 213 return error; 214 } 215 if (fd) { 216 error = prop_dictionary_sendrecv_ioctl(npf_dict, fd, 217 IOC_NPF_LOAD, &ncf->ncf_err); 218 if (error) { 219 prop_object_release(npf_dict); 220 assert(ncf->ncf_err == NULL); 221 return error; 222 } 223 prop_dictionary_get_int32(ncf->ncf_err, "errno", &error); 224 } 225 prop_object_release(npf_dict); 226 return error; 227 } 228 229 static nl_config_t * 230 _npf_config_consdict(prop_dictionary_t npf_dict) 231 { 232 nl_config_t *ncf; 233 234 ncf = calloc(1, sizeof(*ncf)); 235 if (ncf == NULL) { 236 return NULL; 237 } 238 ncf->ncf_dict = npf_dict; 239 ncf->ncf_alg_list = prop_dictionary_get(npf_dict, "algs"); 240 ncf->ncf_rules_list = prop_dictionary_get(npf_dict, "rules"); 241 ncf->ncf_rproc_list = prop_dictionary_get(npf_dict, "rprocs"); 242 ncf->ncf_table_list = prop_dictionary_get(npf_dict, "tables"); 243 ncf->ncf_nat_list = prop_dictionary_get(npf_dict, "nat"); 244 ncf->ncf_conn_list = prop_dictionary_get(npf_dict, "conn-list"); 245 return ncf; 246 } 247 248 nl_config_t * 249 npf_config_retrieve(int fd, bool *active, bool *loaded) 250 { 251 prop_dictionary_t npf_dict; 252 nl_config_t *ncf; 253 int error; 254 255 error = prop_dictionary_recv_ioctl(fd, IOC_NPF_SAVE, &npf_dict); 256 if (error) { 257 return NULL; 258 } 259 ncf = _npf_config_consdict(npf_dict); 260 if (ncf == NULL) { 261 prop_object_release(npf_dict); 262 return NULL; 263 } 264 prop_dictionary_get_bool(npf_dict, "active", active); 265 *loaded = (ncf->ncf_rules_list != NULL); 266 return ncf; 267 } 268 269 int 270 npf_config_export(const nl_config_t *ncf, const char *path) 271 { 272 prop_dictionary_t npf_dict = ncf->ncf_dict; 273 int error = 0; 274 275 if (!prop_dictionary_externalize_to_file(npf_dict, path)) { 276 error = errno; 277 } 278 return error; 279 } 280 281 nl_config_t * 282 npf_config_import(const char *path) 283 { 284 prop_dictionary_t npf_dict; 285 nl_config_t *ncf; 286 287 npf_dict = prop_dictionary_internalize_from_file(path); 288 if (!npf_dict) { 289 return NULL; 290 } 291 ncf = _npf_config_consdict(npf_dict); 292 if (!ncf) { 293 prop_object_release(npf_dict); 294 return NULL; 295 } 296 return ncf; 297 } 298 299 int 300 npf_config_flush(int fd) 301 { 302 nl_config_t *ncf; 303 int error; 304 305 ncf = npf_config_create(); 306 if (ncf == NULL) { 307 return ENOMEM; 308 } 309 ncf->ncf_flush = true; 310 error = npf_config_submit(ncf, fd); 311 npf_config_destroy(ncf); 312 return error; 313 } 314 315 void 316 _npf_config_error(nl_config_t *ncf, nl_error_t *ne) 317 { 318 memset(ne, 0, sizeof(*ne)); 319 prop_dictionary_get_int32(ncf->ncf_err, "id", &ne->ne_id); 320 prop_dictionary_get_cstring(ncf->ncf_err, 321 "source-file", &ne->ne_source_file); 322 prop_dictionary_get_uint32(ncf->ncf_err, 323 "source-line", &ne->ne_source_line); 324 prop_dictionary_get_int32(ncf->ncf_err, 325 "code-error", &ne->ne_ncode_error); 326 prop_dictionary_get_int32(ncf->ncf_err, 327 "code-errat", &ne->ne_ncode_errat); 328 } 329 330 void 331 npf_config_destroy(nl_config_t *ncf) 332 { 333 if (!ncf->ncf_dict) { 334 prop_object_release(ncf->ncf_alg_list); 335 prop_object_release(ncf->ncf_rules_list); 336 prop_object_release(ncf->ncf_rproc_list); 337 prop_object_release(ncf->ncf_table_list); 338 prop_object_release(ncf->ncf_nat_list); 339 } 340 if (ncf->ncf_err) { 341 prop_object_release(ncf->ncf_err); 342 } 343 if (ncf->ncf_debug) { 344 prop_object_release(ncf->ncf_debug); 345 } 346 free(ncf); 347 } 348 349 void 350 _npf_config_setsubmit(nl_config_t *ncf, const char *plist_file) 351 { 352 ncf->ncf_plist = plist_file; 353 } 354 355 static bool 356 _npf_prop_array_lookup(prop_array_t array, const char *key, const char *name) 357 { 358 prop_dictionary_t dict; 359 prop_object_iterator_t it; 360 361 it = prop_array_iterator(array); 362 while ((dict = prop_object_iterator_next(it)) != NULL) { 363 const char *lname; 364 prop_dictionary_get_cstring_nocopy(dict, key, &lname); 365 if (strcmp(name, lname) == 0) 366 break; 367 } 368 prop_object_iterator_release(it); 369 return dict ? true : false; 370 } 371 372 /* 373 * DYNAMIC RULESET INTERFACE. 374 */ 375 376 int 377 npf_ruleset_add(int fd, const char *rname, nl_rule_t *rl, uint64_t *id) 378 { 379 prop_dictionary_t rldict = rl->nrl_dict; 380 prop_dictionary_t ret; 381 int error; 382 383 prop_dictionary_set_cstring(rldict, "ruleset-name", rname); 384 prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_ADD); 385 error = prop_dictionary_sendrecv_ioctl(rldict, fd, IOC_NPF_RULE, &ret); 386 if (!error) { 387 prop_dictionary_get_uint64(ret, "id", id); 388 } 389 return error; 390 } 391 392 int 393 npf_ruleset_remove(int fd, const char *rname, uint64_t id) 394 { 395 prop_dictionary_t rldict; 396 397 rldict = prop_dictionary_create(); 398 if (rldict == NULL) { 399 return ENOMEM; 400 } 401 prop_dictionary_set_cstring(rldict, "ruleset-name", rname); 402 prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_REMOVE); 403 prop_dictionary_set_uint64(rldict, "id", id); 404 return prop_dictionary_send_ioctl(rldict, fd, IOC_NPF_RULE); 405 } 406 407 int 408 npf_ruleset_remkey(int fd, const char *rname, const void *key, size_t len) 409 { 410 prop_dictionary_t rldict; 411 prop_data_t keyobj; 412 413 rldict = prop_dictionary_create(); 414 if (rldict == NULL) { 415 return ENOMEM; 416 } 417 prop_dictionary_set_cstring(rldict, "ruleset-name", rname); 418 prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_REMKEY); 419 420 keyobj = prop_data_create_data(key, len); 421 if (keyobj == NULL) { 422 prop_object_release(rldict); 423 return ENOMEM; 424 } 425 prop_dictionary_set(rldict, "key", keyobj); 426 prop_object_release(keyobj); 427 428 return prop_dictionary_send_ioctl(rldict, fd, IOC_NPF_RULE); 429 } 430 431 int 432 npf_ruleset_flush(int fd, const char *rname) 433 { 434 prop_dictionary_t rldict; 435 436 rldict = prop_dictionary_create(); 437 if (rldict == NULL) { 438 return ENOMEM; 439 } 440 prop_dictionary_set_cstring(rldict, "ruleset-name", rname); 441 prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_FLUSH); 442 return prop_dictionary_send_ioctl(rldict, fd, IOC_NPF_RULE); 443 } 444 445 /* 446 * _npf_ruleset_transform: transform the ruleset representing nested 447 * rules with lists into an array. 448 */ 449 450 static void 451 _npf_ruleset_transform1(prop_array_t rlset, prop_array_t rules) 452 { 453 prop_object_iterator_t it; 454 prop_dictionary_t rldict; 455 prop_array_t subrlset; 456 457 it = prop_array_iterator(rules); 458 while ((rldict = prop_object_iterator_next(it)) != NULL) { 459 unsigned idx; 460 461 /* Add rules to the array (reference is retained). */ 462 prop_array_add(rlset, rldict); 463 464 subrlset = prop_dictionary_get(rldict, "subrules"); 465 if (subrlset) { 466 /* Process subrules recursively. */ 467 _npf_ruleset_transform1(rlset, subrlset); 468 /* Add the skip-to position. */ 469 idx = prop_array_count(rlset); 470 prop_dictionary_set_uint32(rldict, "skip-to", idx); 471 prop_dictionary_remove(rldict, "subrules"); 472 } 473 } 474 prop_object_iterator_release(it); 475 } 476 477 static prop_array_t 478 _npf_ruleset_transform(prop_array_t rlset) 479 { 480 prop_array_t nrlset; 481 482 nrlset = prop_array_create(); 483 _npf_ruleset_transform1(nrlset, rlset); 484 return nrlset; 485 } 486 487 /* 488 * NPF EXTENSION INTERFACE. 489 */ 490 491 nl_ext_t * 492 npf_ext_construct(const char *name) 493 { 494 nl_ext_t *ext; 495 496 ext = malloc(sizeof(*ext)); 497 if (ext == NULL) { 498 return NULL; 499 } 500 ext->nxt_name = strdup(name); 501 if (ext->nxt_name == NULL) { 502 free(ext); 503 return NULL; 504 } 505 ext->nxt_dict = prop_dictionary_create(); 506 507 return ext; 508 } 509 510 void 511 npf_ext_param_u32(nl_ext_t *ext, const char *key, uint32_t val) 512 { 513 prop_dictionary_t extdict = ext->nxt_dict; 514 prop_dictionary_set_uint32(extdict, key, val); 515 } 516 517 void 518 npf_ext_param_bool(nl_ext_t *ext, const char *key, bool val) 519 { 520 prop_dictionary_t extdict = ext->nxt_dict; 521 prop_dictionary_set_bool(extdict, key, val); 522 } 523 524 void 525 npf_ext_param_string(nl_ext_t *ext, const char *key, const char *val) 526 { 527 prop_dictionary_t extdict = ext->nxt_dict; 528 prop_dictionary_set_cstring(extdict, key, val); 529 } 530 531 /* 532 * RULE INTERFACE. 533 */ 534 535 nl_rule_t * 536 npf_rule_create(const char *name, uint32_t attr, const char *ifname) 537 { 538 prop_dictionary_t rldict; 539 nl_rule_t *rl; 540 541 rl = malloc(sizeof(*rl)); 542 if (rl == NULL) { 543 return NULL; 544 } 545 rldict = prop_dictionary_create(); 546 if (rldict == NULL) { 547 free(rl); 548 return NULL; 549 } 550 if (name) { 551 prop_dictionary_set_cstring(rldict, "name", name); 552 } 553 prop_dictionary_set_uint32(rldict, "attr", attr); 554 555 if (ifname) { 556 prop_dictionary_set_cstring(rldict, "ifname", ifname); 557 } 558 rl->nrl_dict = rldict; 559 return rl; 560 } 561 562 int 563 npf_rule_setcode(nl_rule_t *rl, int type, const void *code, size_t len) 564 { 565 prop_dictionary_t rldict = rl->nrl_dict; 566 prop_data_t cdata; 567 568 switch (type) { 569 case NPF_CODE_NC: 570 case NPF_CODE_BPF: 571 break; 572 default: 573 return ENOTSUP; 574 } 575 prop_dictionary_set_uint32(rldict, "code-type", (uint32_t)type); 576 if ((cdata = prop_data_create_data(code, len)) == NULL) { 577 return ENOMEM; 578 } 579 prop_dictionary_set(rldict, "code", cdata); 580 prop_object_release(cdata); 581 return 0; 582 } 583 584 int 585 npf_rule_setkey(nl_rule_t *rl, const void *key, size_t len) 586 { 587 prop_dictionary_t rldict = rl->nrl_dict; 588 prop_data_t kdata; 589 590 if ((kdata = prop_data_create_data(key, len)) == NULL) { 591 return ENOMEM; 592 } 593 prop_dictionary_set(rldict, "key", kdata); 594 prop_object_release(kdata); 595 return 0; 596 } 597 598 int 599 npf_rule_setinfo(nl_rule_t *rl, const void *info, size_t len) 600 { 601 prop_dictionary_t rldict = rl->nrl_dict; 602 prop_data_t idata; 603 604 if ((idata = prop_data_create_data(info, len)) == NULL) { 605 return ENOMEM; 606 } 607 prop_dictionary_set(rldict, "info", idata); 608 prop_object_release(idata); 609 return 0; 610 } 611 612 int 613 npf_rule_setprio(nl_rule_t *rl, pri_t pri) 614 { 615 prop_dictionary_t rldict = rl->nrl_dict; 616 617 prop_dictionary_set_int32(rldict, "prio", pri); 618 return 0; 619 } 620 621 int 622 npf_rule_setproc(nl_rule_t *rl, const char *name) 623 { 624 prop_dictionary_t rldict = rl->nrl_dict; 625 626 prop_dictionary_set_cstring(rldict, "rproc", name); 627 return 0; 628 } 629 630 void * 631 npf_rule_export(nl_rule_t *rl, size_t *length) 632 { 633 prop_dictionary_t rldict = rl->nrl_dict; 634 void *xml; 635 636 if ((xml = prop_dictionary_externalize(rldict)) == NULL) { 637 return NULL; 638 } 639 *length = strlen(xml); 640 return xml; 641 } 642 643 bool 644 npf_rule_exists_p(nl_config_t *ncf, const char *name) 645 { 646 return _npf_prop_array_lookup(ncf->ncf_rules_list, "name", name); 647 } 648 649 int 650 npf_rule_insert(nl_config_t *ncf, nl_rule_t *parent, nl_rule_t *rl) 651 { 652 prop_dictionary_t rldict = rl->nrl_dict; 653 prop_array_t rlset; 654 655 if (parent) { 656 prop_dictionary_t pdict = parent->nrl_dict; 657 rlset = prop_dictionary_get(pdict, "subrules"); 658 if (rlset == NULL) { 659 rlset = prop_array_create(); 660 prop_dictionary_set(pdict, "subrules", rlset); 661 prop_object_release(rlset); 662 } 663 } else { 664 rlset = ncf->ncf_rules_list; 665 } 666 prop_array_add(rlset, rldict); 667 return 0; 668 } 669 670 static nl_rule_t * 671 _npf_rule_iterate1(nl_config_t *ncf, prop_array_t rlist, unsigned *level) 672 { 673 prop_dictionary_t rldict; 674 uint32_t skipto = 0; 675 676 if (!ncf->ncf_rule_iter) { 677 /* Initialise the iterator. */ 678 ncf->ncf_rule_iter = prop_array_iterator(rlist); 679 ncf->ncf_nlevel = 0; 680 ncf->ncf_reduce[0] = 0; 681 ncf->ncf_counter = 0; 682 } 683 684 rldict = prop_object_iterator_next(ncf->ncf_rule_iter); 685 if ((ncf->ncf_cur_rule.nrl_dict = rldict) == NULL) { 686 prop_object_iterator_release(ncf->ncf_rule_iter); 687 ncf->ncf_rule_iter = NULL; 688 return NULL; 689 } 690 *level = ncf->ncf_nlevel; 691 692 prop_dictionary_get_uint32(rldict, "skip-to", &skipto); 693 if (skipto) { 694 ncf->ncf_nlevel++; 695 ncf->ncf_reduce[ncf->ncf_nlevel] = skipto; 696 } 697 if (ncf->ncf_reduce[ncf->ncf_nlevel] == ++ncf->ncf_counter) { 698 assert(ncf->ncf_nlevel > 0); 699 ncf->ncf_nlevel--; 700 } 701 return &ncf->ncf_cur_rule; 702 } 703 704 nl_rule_t * 705 npf_rule_iterate(nl_config_t *ncf, unsigned *level) 706 { 707 return _npf_rule_iterate1(ncf, ncf->ncf_rules_list, level); 708 } 709 710 const char * 711 npf_rule_getname(nl_rule_t *rl) 712 { 713 prop_dictionary_t rldict = rl->nrl_dict; 714 const char *rname = NULL; 715 716 prop_dictionary_get_cstring_nocopy(rldict, "name", &rname); 717 return rname; 718 } 719 720 uint32_t 721 npf_rule_getattr(nl_rule_t *rl) 722 { 723 prop_dictionary_t rldict = rl->nrl_dict; 724 uint32_t attr = 0; 725 726 prop_dictionary_get_uint32(rldict, "attr", &attr); 727 return attr; 728 } 729 730 const char * 731 npf_rule_getinterface(nl_rule_t *rl) 732 { 733 prop_dictionary_t rldict = rl->nrl_dict; 734 const char *ifname = NULL; 735 736 prop_dictionary_get_cstring_nocopy(rldict, "ifname", &ifname); 737 return ifname; 738 } 739 740 const void * 741 npf_rule_getinfo(nl_rule_t *rl, size_t *len) 742 { 743 prop_dictionary_t rldict = rl->nrl_dict; 744 prop_object_t obj = prop_dictionary_get(rldict, "info"); 745 746 *len = prop_data_size(obj); 747 return prop_data_data_nocopy(obj); 748 } 749 750 const char * 751 npf_rule_getproc(nl_rule_t *rl) 752 { 753 prop_dictionary_t rldict = rl->nrl_dict; 754 const char *rpname = NULL; 755 756 prop_dictionary_get_cstring_nocopy(rldict, "rproc", &rpname); 757 return rpname; 758 } 759 760 uint64_t 761 npf_rule_getid(nl_rule_t *rl) 762 { 763 prop_dictionary_t rldict = rl->nrl_dict; 764 uint64_t id = 0; 765 766 (void)prop_dictionary_get_uint64(rldict, "id", &id); 767 return id; 768 } 769 770 const void * 771 npf_rule_getcode(nl_rule_t *rl, int *type, size_t *len) 772 { 773 prop_dictionary_t rldict = rl->nrl_dict; 774 prop_object_t obj = prop_dictionary_get(rldict, "code"); 775 776 prop_dictionary_get_uint32(rldict, "code-type", (uint32_t *)type); 777 *len = prop_data_size(obj); 778 return prop_data_data_nocopy(obj); 779 } 780 781 int 782 _npf_ruleset_list(int fd, const char *rname, nl_config_t *ncf) 783 { 784 prop_dictionary_t rldict, ret; 785 int error; 786 787 rldict = prop_dictionary_create(); 788 if (rldict == NULL) { 789 return ENOMEM; 790 } 791 prop_dictionary_set_cstring(rldict, "ruleset-name", rname); 792 prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_LIST); 793 error = prop_dictionary_sendrecv_ioctl(rldict, fd, IOC_NPF_RULE, &ret); 794 if (!error) { 795 prop_array_t rules; 796 797 rules = prop_dictionary_get(ret, "rules"); 798 if (rules == NULL) { 799 return EINVAL; 800 } 801 prop_object_release(ncf->ncf_rules_list); 802 ncf->ncf_rules_list = rules; 803 } 804 return error; 805 } 806 807 void 808 npf_rule_destroy(nl_rule_t *rl) 809 { 810 811 prop_object_release(rl->nrl_dict); 812 free(rl); 813 } 814 815 /* 816 * RULE PROCEDURE INTERFACE. 817 */ 818 819 nl_rproc_t * 820 npf_rproc_create(const char *name) 821 { 822 prop_dictionary_t rpdict; 823 prop_array_t extcalls; 824 nl_rproc_t *nrp; 825 826 nrp = malloc(sizeof(nl_rproc_t)); 827 if (nrp == NULL) { 828 return NULL; 829 } 830 rpdict = prop_dictionary_create(); 831 if (rpdict == NULL) { 832 free(nrp); 833 return NULL; 834 } 835 prop_dictionary_set_cstring(rpdict, "name", name); 836 837 extcalls = prop_array_create(); 838 if (extcalls == NULL) { 839 prop_object_release(rpdict); 840 free(nrp); 841 return NULL; 842 } 843 prop_dictionary_set(rpdict, "extcalls", extcalls); 844 prop_object_release(extcalls); 845 846 nrp->nrp_dict = rpdict; 847 return nrp; 848 } 849 850 int 851 npf_rproc_extcall(nl_rproc_t *rp, nl_ext_t *ext) 852 { 853 prop_dictionary_t rpdict = rp->nrp_dict; 854 prop_dictionary_t extdict = ext->nxt_dict; 855 prop_array_t extcalls; 856 857 extcalls = prop_dictionary_get(rpdict, "extcalls"); 858 if (_npf_prop_array_lookup(extcalls, "name", ext->nxt_name)) { 859 return EEXIST; 860 } 861 prop_dictionary_set_cstring(extdict, "name", ext->nxt_name); 862 prop_array_add(extcalls, extdict); 863 return 0; 864 } 865 866 bool 867 npf_rproc_exists_p(nl_config_t *ncf, const char *name) 868 { 869 return _npf_prop_array_lookup(ncf->ncf_rproc_list, "name", name); 870 } 871 872 int 873 npf_rproc_insert(nl_config_t *ncf, nl_rproc_t *rp) 874 { 875 prop_dictionary_t rpdict = rp->nrp_dict; 876 const char *name; 877 878 if (!prop_dictionary_get_cstring_nocopy(rpdict, "name", &name)) { 879 return EINVAL; 880 } 881 if (npf_rproc_exists_p(ncf, name)) { 882 return EEXIST; 883 } 884 prop_array_add(ncf->ncf_rproc_list, rpdict); 885 return 0; 886 } 887 888 nl_rproc_t * 889 npf_rproc_iterate(nl_config_t *ncf) 890 { 891 prop_dictionary_t rpdict; 892 893 if (!ncf->ncf_rproc_iter) { 894 /* Initialise the iterator. */ 895 ncf->ncf_rproc_iter = prop_array_iterator(ncf->ncf_rproc_list); 896 } 897 rpdict = prop_object_iterator_next(ncf->ncf_rproc_iter); 898 if ((ncf->ncf_cur_rproc.nrp_dict = rpdict) == NULL) { 899 prop_object_iterator_release(ncf->ncf_rproc_iter); 900 ncf->ncf_rproc_iter = NULL; 901 return NULL; 902 } 903 return &ncf->ncf_cur_rproc; 904 } 905 906 const char * 907 npf_rproc_getname(nl_rproc_t *rp) 908 { 909 prop_dictionary_t rpdict = rp->nrp_dict; 910 const char *rpname = NULL; 911 912 prop_dictionary_get_cstring_nocopy(rpdict, "name", &rpname); 913 return rpname; 914 } 915 916 /* 917 * NAT INTERFACE. 918 */ 919 920 nl_nat_t * 921 npf_nat_create(int type, u_int flags, const char *ifname, 922 int af, npf_addr_t *addr, npf_netmask_t mask, in_port_t port) 923 { 924 nl_rule_t *rl; 925 prop_dictionary_t rldict; 926 uint32_t attr; 927 928 attr = NPF_RULE_PASS | NPF_RULE_FINAL | 929 (type == NPF_NATOUT ? NPF_RULE_OUT : NPF_RULE_IN); 930 931 /* Create a rule for NAT policy. Next, will add NAT data. */ 932 rl = npf_rule_create(NULL, attr, ifname); 933 if (rl == NULL) { 934 return NULL; 935 } 936 rldict = rl->nrl_dict; 937 938 /* Translation type and flags. */ 939 prop_dictionary_set_int32(rldict, "type", type); 940 prop_dictionary_set_uint32(rldict, "flags", flags); 941 942 /* Translation IP and mask. */ 943 if (!_npf_add_addr(rldict, "nat-ip", af, addr)) { 944 npf_rule_destroy(rl); 945 return NULL; 946 } 947 prop_dictionary_set_uint32(rldict, "nat-mask", (uint32_t)mask); 948 949 /* Translation port (for redirect case). */ 950 prop_dictionary_set_uint16(rldict, "nat-port", port); 951 952 return (nl_nat_t *)rl; 953 } 954 955 int 956 npf_nat_insert(nl_config_t *ncf, nl_nat_t *nt, pri_t pri __unused) 957 { 958 prop_dictionary_t rldict = nt->nrl_dict; 959 960 prop_dictionary_set_int32(rldict, "prio", NPF_PRI_LAST); 961 prop_array_add(ncf->ncf_nat_list, rldict); 962 return 0; 963 } 964 965 nl_nat_t * 966 npf_nat_iterate(nl_config_t *ncf) 967 { 968 u_int level; 969 return _npf_rule_iterate1(ncf, ncf->ncf_nat_list, &level); 970 } 971 972 int 973 npf_nat_setalgo(nl_nat_t *nt, u_int algo) 974 { 975 prop_dictionary_t rldict = nt->nrl_dict; 976 prop_dictionary_set_uint32(rldict, "nat-algo", algo); 977 return 0; 978 } 979 980 int 981 npf_nat_setnpt66(nl_nat_t *nt, uint16_t adj) 982 { 983 prop_dictionary_t rldict = nt->nrl_dict; 984 int error; 985 986 if ((error = npf_nat_setalgo(nt, NPF_ALGO_NPT66)) != 0) { 987 return error; 988 } 989 prop_dictionary_set_uint16(rldict, "npt66-adj", adj); 990 return 0; 991 } 992 993 int 994 npf_nat_gettype(nl_nat_t *nt) 995 { 996 prop_dictionary_t rldict = nt->nrl_dict; 997 int type = 0; 998 999 prop_dictionary_get_int32(rldict, "type", &type); 1000 return type; 1001 } 1002 1003 u_int 1004 npf_nat_getflags(nl_nat_t *nt) 1005 { 1006 prop_dictionary_t rldict = nt->nrl_dict; 1007 unsigned flags = 0; 1008 1009 prop_dictionary_get_uint32(rldict, "flags", &flags); 1010 return flags; 1011 } 1012 1013 void 1014 npf_nat_getmap(nl_nat_t *nt, npf_addr_t *addr, size_t *alen, in_port_t *port) 1015 { 1016 prop_dictionary_t rldict = nt->nrl_dict; 1017 prop_object_t obj = prop_dictionary_get(rldict, "nat-ip"); 1018 1019 *alen = prop_data_size(obj); 1020 memcpy(addr, prop_data_data_nocopy(obj), *alen); 1021 1022 *port = 0; 1023 prop_dictionary_get_uint16(rldict, "nat-port", port); 1024 } 1025 1026 /* 1027 * TABLE INTERFACE. 1028 */ 1029 1030 nl_table_t * 1031 npf_table_create(const char *name, u_int id, int type) 1032 { 1033 prop_dictionary_t tldict; 1034 prop_array_t tblents; 1035 nl_table_t *tl; 1036 1037 tl = malloc(sizeof(*tl)); 1038 if (tl == NULL) { 1039 return NULL; 1040 } 1041 tldict = prop_dictionary_create(); 1042 if (tldict == NULL) { 1043 free(tl); 1044 return NULL; 1045 } 1046 prop_dictionary_set_cstring(tldict, "name", name); 1047 prop_dictionary_set_uint32(tldict, "id", id); 1048 prop_dictionary_set_int32(tldict, "type", type); 1049 1050 tblents = prop_array_create(); 1051 if (tblents == NULL) { 1052 prop_object_release(tldict); 1053 free(tl); 1054 return NULL; 1055 } 1056 prop_dictionary_set(tldict, "entries", tblents); 1057 prop_object_release(tblents); 1058 1059 tl->ntl_dict = tldict; 1060 return tl; 1061 } 1062 1063 int 1064 npf_table_add_entry(nl_table_t *tl, int af, const npf_addr_t *addr, 1065 const npf_netmask_t mask) 1066 { 1067 prop_dictionary_t tldict = tl->ntl_dict, entdict; 1068 prop_array_t tblents; 1069 1070 /* Create the table entry. */ 1071 entdict = prop_dictionary_create(); 1072 if (entdict == NULL) { 1073 return ENOMEM; 1074 } 1075 1076 if (!_npf_add_addr(entdict, "addr", af, addr)) { 1077 return EINVAL; 1078 } 1079 prop_dictionary_set_uint8(entdict, "mask", mask); 1080 1081 tblents = prop_dictionary_get(tldict, "entries"); 1082 prop_array_add(tblents, entdict); 1083 prop_object_release(entdict); 1084 return 0; 1085 } 1086 1087 int 1088 npf_table_setdata(nl_table_t *tl, const void *blob, size_t len) 1089 { 1090 prop_dictionary_t tldict = tl->ntl_dict; 1091 prop_data_t bobj; 1092 1093 if ((bobj = prop_data_create_data(blob, len)) == NULL) { 1094 return ENOMEM; 1095 } 1096 prop_dictionary_set(tldict, "data", bobj); 1097 prop_object_release(bobj); 1098 return 0; 1099 } 1100 1101 static bool 1102 _npf_table_exists_p(nl_config_t *ncf, const char *name) 1103 { 1104 prop_dictionary_t tldict; 1105 prop_object_iterator_t it; 1106 1107 it = prop_array_iterator(ncf->ncf_table_list); 1108 while ((tldict = prop_object_iterator_next(it)) != NULL) { 1109 const char *tname = NULL; 1110 1111 if (prop_dictionary_get_cstring_nocopy(tldict, "name", &tname) 1112 && strcmp(tname, name) == 0) 1113 break; 1114 } 1115 prop_object_iterator_release(it); 1116 return tldict ? true : false; 1117 } 1118 1119 int 1120 npf_table_insert(nl_config_t *ncf, nl_table_t *tl) 1121 { 1122 prop_dictionary_t tldict = tl->ntl_dict; 1123 const char *name = NULL; 1124 1125 if (!prop_dictionary_get_cstring_nocopy(tldict, "name", &name)) { 1126 return EINVAL; 1127 } 1128 if (_npf_table_exists_p(ncf, name)) { 1129 return EEXIST; 1130 } 1131 prop_array_add(ncf->ncf_table_list, tldict); 1132 return 0; 1133 } 1134 1135 nl_table_t * 1136 npf_table_iterate(nl_config_t *ncf) 1137 { 1138 prop_dictionary_t tldict; 1139 1140 if (!ncf->ncf_table_iter) { 1141 /* Initialise the iterator. */ 1142 ncf->ncf_table_iter = prop_array_iterator(ncf->ncf_table_list); 1143 } 1144 tldict = prop_object_iterator_next(ncf->ncf_table_iter); 1145 if ((ncf->ncf_cur_table.ntl_dict = tldict) == NULL) { 1146 prop_object_iterator_release(ncf->ncf_table_iter); 1147 ncf->ncf_table_iter = NULL; 1148 return NULL; 1149 } 1150 return &ncf->ncf_cur_table; 1151 } 1152 1153 unsigned 1154 npf_table_getid(nl_table_t *tl) 1155 { 1156 prop_dictionary_t tldict = tl->ntl_dict; 1157 unsigned id = (unsigned)-1; 1158 1159 prop_dictionary_get_uint32(tldict, "id", &id); 1160 return id; 1161 } 1162 1163 const char * 1164 npf_table_getname(nl_table_t *tl) 1165 { 1166 prop_dictionary_t tldict = tl->ntl_dict; 1167 const char *tname = NULL; 1168 1169 prop_dictionary_get_cstring_nocopy(tldict, "name", &tname); 1170 return tname; 1171 } 1172 1173 int 1174 npf_table_gettype(nl_table_t *tl) 1175 { 1176 prop_dictionary_t tldict = tl->ntl_dict; 1177 int type = 0; 1178 1179 prop_dictionary_get_int32(tldict, "type", &type); 1180 return type; 1181 } 1182 1183 void 1184 npf_table_destroy(nl_table_t *tl) 1185 { 1186 prop_object_release(tl->ntl_dict); 1187 free(tl); 1188 } 1189 1190 /* 1191 * ALG INTERFACE. 1192 */ 1193 1194 int 1195 _npf_alg_load(nl_config_t *ncf, const char *name) 1196 { 1197 prop_dictionary_t al_dict; 1198 1199 if (_npf_prop_array_lookup(ncf->ncf_alg_list, "name", name)) 1200 return EEXIST; 1201 1202 al_dict = prop_dictionary_create(); 1203 prop_dictionary_set_cstring(al_dict, "name", name); 1204 prop_array_add(ncf->ncf_alg_list, al_dict); 1205 prop_object_release(al_dict); 1206 return 0; 1207 } 1208 1209 int 1210 _npf_alg_unload(nl_config_t *ncf, const char *name) 1211 { 1212 if (!_npf_prop_array_lookup(ncf->ncf_alg_list, "name", name)) 1213 return ENOENT; 1214 1215 // Not yet: prop_array_add(ncf->ncf_alg_list, al_dict); 1216 return ENOTSUP; 1217 } 1218 1219 /* 1220 * MISC. 1221 */ 1222 1223 static prop_dictionary_t 1224 _npf_debug_initonce(nl_config_t *ncf) 1225 { 1226 if (!ncf->ncf_debug) { 1227 prop_array_t iflist = prop_array_create(); 1228 ncf->ncf_debug = prop_dictionary_create(); 1229 prop_dictionary_set(ncf->ncf_debug, "interfaces", iflist); 1230 prop_object_release(iflist); 1231 } 1232 return ncf->ncf_debug; 1233 } 1234 1235 void 1236 _npf_debug_addif(nl_config_t *ncf, const char *ifname) 1237 { 1238 prop_dictionary_t ifdict, dbg = _npf_debug_initonce(ncf); 1239 prop_array_t iflist = prop_dictionary_get(dbg, "interfaces"); 1240 u_int if_idx = if_nametoindex(ifname); 1241 1242 if (_npf_prop_array_lookup(iflist, "name", ifname)) { 1243 return; 1244 } 1245 ifdict = prop_dictionary_create(); 1246 prop_dictionary_set_cstring(ifdict, "name", ifname); 1247 prop_dictionary_set_uint32(ifdict, "index", if_idx); 1248 prop_array_add(iflist, ifdict); 1249 prop_object_release(ifdict); 1250 } 1251 1252 int 1253 npf_nat_lookup(int fd, int af, npf_addr_t *addr[2], in_port_t port[2], 1254 int proto, int dir) 1255 { 1256 prop_dictionary_t conn_dict, conn_res = NULL; 1257 int error = EINVAL; 1258 1259 conn_dict = prop_dictionary_create(); 1260 if (conn_dict == NULL) 1261 return ENOMEM; 1262 1263 if (!prop_dictionary_set_uint16(conn_dict, "direction", dir)) 1264 goto out; 1265 1266 conn_res = prop_dictionary_create(); 1267 if (conn_res == NULL) 1268 goto out; 1269 1270 if (!_npf_add_addr(conn_res, "saddr", af, addr[0])) 1271 goto out; 1272 if (!_npf_add_addr(conn_res, "daddr", af, addr[1])) 1273 goto out; 1274 if (!prop_dictionary_set_uint16(conn_res, "sport", port[0])) 1275 goto out; 1276 if (!prop_dictionary_set_uint16(conn_res, "dport", port[1])) 1277 goto out; 1278 if (!prop_dictionary_set_uint16(conn_res, "proto", proto)) 1279 goto out; 1280 if (!prop_dictionary_set(conn_dict, "key", conn_res)) 1281 goto out; 1282 1283 prop_object_release(conn_res); 1284 1285 error = prop_dictionary_sendrecv_ioctl(conn_dict, fd, 1286 IOC_NPF_CONN_LOOKUP, &conn_res); 1287 if (error != 0) 1288 goto out; 1289 1290 prop_dictionary_t nat = prop_dictionary_get(conn_res, "nat"); 1291 if (nat == NULL) { 1292 errno = ENOENT; 1293 goto out; 1294 } 1295 1296 if (!_npf_get_addr(nat, "oaddr", addr[0])) { 1297 error = EINVAL; 1298 goto out; 1299 } 1300 1301 prop_dictionary_get_uint16(nat, "oport", &port[0]); 1302 prop_dictionary_get_uint16(nat, "tport", &port[1]); 1303 out: 1304 if (conn_res) 1305 prop_object_release(conn_res); 1306 prop_object_release(conn_dict); 1307 return error; 1308 } 1309