1 /* $NetBSD: npf.c,v 1.34 2014/08/24 20:37:35 rmind Exp $ */ 2 3 /*- 4 * Copyright (c) 2010-2014 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 __KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.34 2014/08/24 20:37:35 rmind Exp $"); 34 35 #include <sys/types.h> 36 #include <netinet/in_systm.h> 37 #include <netinet/in.h> 38 #include <net/if.h> 39 #include <prop/proplib.h> 40 41 #include <stdlib.h> 42 #include <string.h> 43 #include <assert.h> 44 #include <errno.h> 45 #include <err.h> 46 47 #define _NPF_PRIVATE 48 #include "npf.h" 49 50 struct nl_rule { 51 prop_dictionary_t nrl_dict; 52 }; 53 54 struct nl_rproc { 55 prop_dictionary_t nrp_dict; 56 }; 57 58 struct nl_table { 59 prop_dictionary_t ntl_dict; 60 }; 61 62 struct nl_alg { 63 prop_dictionary_t nal_dict; 64 }; 65 66 struct nl_ext { 67 const char * nxt_name; 68 prop_dictionary_t nxt_dict; 69 }; 70 71 struct nl_config { 72 /* Rules, translations, procedures, tables, connections. */ 73 prop_dictionary_t ncf_dict; 74 prop_array_t ncf_alg_list; 75 prop_array_t ncf_rules_list; 76 prop_array_t ncf_rproc_list; 77 prop_array_t ncf_table_list; 78 prop_array_t ncf_nat_list; 79 prop_array_t ncf_conn_list; 80 81 /* Iterators. */ 82 prop_object_iterator_t ncf_rule_iter; 83 unsigned ncf_reduce[16]; 84 unsigned ncf_nlevel; 85 unsigned ncf_counter; 86 nl_rule_t ncf_cur_rule; 87 88 prop_object_iterator_t ncf_table_iter; 89 nl_table_t ncf_cur_table; 90 91 prop_object_iterator_t ncf_rproc_iter; 92 nl_rproc_t ncf_cur_rproc; 93 94 /* Error report and debug information. */ 95 prop_dictionary_t ncf_err; 96 prop_dictionary_t ncf_debug; 97 98 /* Custom file to externalise property-list. */ 99 const char * ncf_plist; 100 bool ncf_flush; 101 }; 102 103 static prop_array_t _npf_ruleset_transform(prop_array_t); 104 105 /* 106 * CONFIGURATION INTERFACE. 107 */ 108 109 nl_config_t * 110 npf_config_create(void) 111 { 112 nl_config_t *ncf; 113 114 ncf = calloc(1, sizeof(*ncf)); 115 if (ncf == NULL) { 116 return NULL; 117 } 118 ncf->ncf_alg_list = prop_array_create(); 119 ncf->ncf_rules_list = prop_array_create(); 120 ncf->ncf_rproc_list = prop_array_create(); 121 ncf->ncf_table_list = prop_array_create(); 122 ncf->ncf_nat_list = prop_array_create(); 123 124 ncf->ncf_plist = NULL; 125 ncf->ncf_flush = false; 126 127 return ncf; 128 } 129 130 int 131 npf_config_submit(nl_config_t *ncf, int fd) 132 { 133 const char *plist = ncf->ncf_plist; 134 prop_dictionary_t npf_dict; 135 prop_array_t rlset; 136 int error = 0; 137 138 npf_dict = prop_dictionary_create(); 139 if (npf_dict == NULL) { 140 return ENOMEM; 141 } 142 prop_dictionary_set_uint32(npf_dict, "version", NPF_VERSION); 143 144 rlset = _npf_ruleset_transform(ncf->ncf_rules_list); 145 if (rlset == NULL) { 146 prop_object_release(npf_dict); 147 return ENOMEM; 148 } 149 prop_object_release(ncf->ncf_rules_list); 150 ncf->ncf_rules_list = rlset; 151 152 prop_dictionary_set(npf_dict, "rules", ncf->ncf_rules_list); 153 prop_dictionary_set(npf_dict, "algs", ncf->ncf_alg_list); 154 prop_dictionary_set(npf_dict, "rprocs", ncf->ncf_rproc_list); 155 prop_dictionary_set(npf_dict, "tables", ncf->ncf_table_list); 156 prop_dictionary_set(npf_dict, "nat", ncf->ncf_nat_list); 157 if (ncf->ncf_conn_list) { 158 prop_dictionary_set(npf_dict, "conn-list", 159 ncf->ncf_conn_list); 160 } 161 prop_dictionary_set_bool(npf_dict, "flush", ncf->ncf_flush); 162 if (ncf->ncf_debug) { 163 prop_dictionary_set(npf_dict, "debug", ncf->ncf_debug); 164 } 165 166 if (plist) { 167 if (!prop_dictionary_externalize_to_file(npf_dict, plist)) { 168 error = errno; 169 } 170 prop_object_release(npf_dict); 171 return error; 172 } 173 if (fd) { 174 error = prop_dictionary_sendrecv_ioctl(npf_dict, fd, 175 IOC_NPF_LOAD, &ncf->ncf_err); 176 if (error) { 177 prop_object_release(npf_dict); 178 assert(ncf->ncf_err == NULL); 179 return error; 180 } 181 prop_dictionary_get_int32(ncf->ncf_err, "errno", &error); 182 } 183 prop_object_release(npf_dict); 184 return error; 185 } 186 187 static nl_config_t * 188 _npf_config_consdict(prop_dictionary_t npf_dict) 189 { 190 nl_config_t *ncf; 191 192 ncf = calloc(1, sizeof(*ncf)); 193 if (ncf == NULL) { 194 return NULL; 195 } 196 ncf->ncf_dict = npf_dict; 197 ncf->ncf_alg_list = prop_dictionary_get(npf_dict, "algs"); 198 ncf->ncf_rules_list = prop_dictionary_get(npf_dict, "rules"); 199 ncf->ncf_rproc_list = prop_dictionary_get(npf_dict, "rprocs"); 200 ncf->ncf_table_list = prop_dictionary_get(npf_dict, "tables"); 201 ncf->ncf_nat_list = prop_dictionary_get(npf_dict, "nat"); 202 ncf->ncf_conn_list = prop_dictionary_get(npf_dict, "conn-list"); 203 return ncf; 204 } 205 206 nl_config_t * 207 npf_config_retrieve(int fd, bool *active, bool *loaded) 208 { 209 prop_dictionary_t npf_dict; 210 nl_config_t *ncf; 211 int error; 212 213 error = prop_dictionary_recv_ioctl(fd, IOC_NPF_SAVE, &npf_dict); 214 if (error) { 215 return NULL; 216 } 217 ncf = _npf_config_consdict(npf_dict); 218 if (ncf == NULL) { 219 prop_object_release(npf_dict); 220 return NULL; 221 } 222 prop_dictionary_get_bool(npf_dict, "active", active); 223 *loaded = (ncf->ncf_rules_list != NULL); 224 return ncf; 225 } 226 227 int 228 npf_config_export(const nl_config_t *ncf, const char *path) 229 { 230 prop_dictionary_t npf_dict = ncf->ncf_dict; 231 int error = 0; 232 233 if (!prop_dictionary_externalize_to_file(npf_dict, path)) { 234 error = errno; 235 } 236 return error; 237 } 238 239 nl_config_t * 240 npf_config_import(const char *path) 241 { 242 prop_dictionary_t npf_dict; 243 nl_config_t *ncf; 244 245 npf_dict = prop_dictionary_internalize_from_file(path); 246 if (!npf_dict) { 247 return NULL; 248 } 249 ncf = _npf_config_consdict(npf_dict); 250 if (!ncf) { 251 prop_object_release(npf_dict); 252 return NULL; 253 } 254 return ncf; 255 } 256 257 int 258 npf_config_flush(int fd) 259 { 260 nl_config_t *ncf; 261 int error; 262 263 ncf = npf_config_create(); 264 if (ncf == NULL) { 265 return ENOMEM; 266 } 267 ncf->ncf_flush = true; 268 error = npf_config_submit(ncf, fd); 269 npf_config_destroy(ncf); 270 return error; 271 } 272 273 void 274 _npf_config_error(nl_config_t *ncf, nl_error_t *ne) 275 { 276 memset(ne, 0, sizeof(*ne)); 277 prop_dictionary_get_int32(ncf->ncf_err, "id", &ne->ne_id); 278 prop_dictionary_get_cstring(ncf->ncf_err, 279 "source-file", &ne->ne_source_file); 280 prop_dictionary_get_uint32(ncf->ncf_err, 281 "source-line", &ne->ne_source_line); 282 prop_dictionary_get_int32(ncf->ncf_err, 283 "code-error", &ne->ne_ncode_error); 284 prop_dictionary_get_int32(ncf->ncf_err, 285 "code-errat", &ne->ne_ncode_errat); 286 } 287 288 void 289 npf_config_destroy(nl_config_t *ncf) 290 { 291 if (!ncf->ncf_dict) { 292 prop_object_release(ncf->ncf_alg_list); 293 prop_object_release(ncf->ncf_rules_list); 294 prop_object_release(ncf->ncf_rproc_list); 295 prop_object_release(ncf->ncf_table_list); 296 prop_object_release(ncf->ncf_nat_list); 297 } 298 if (ncf->ncf_err) { 299 prop_object_release(ncf->ncf_err); 300 } 301 if (ncf->ncf_debug) { 302 prop_object_release(ncf->ncf_debug); 303 } 304 free(ncf); 305 } 306 307 void 308 _npf_config_setsubmit(nl_config_t *ncf, const char *plist_file) 309 { 310 ncf->ncf_plist = plist_file; 311 } 312 313 static bool 314 _npf_prop_array_lookup(prop_array_t array, const char *key, const char *name) 315 { 316 prop_dictionary_t dict; 317 prop_object_iterator_t it; 318 319 it = prop_array_iterator(array); 320 while ((dict = prop_object_iterator_next(it)) != NULL) { 321 const char *lname; 322 prop_dictionary_get_cstring_nocopy(dict, key, &lname); 323 if (strcmp(name, lname) == 0) 324 break; 325 } 326 prop_object_iterator_release(it); 327 return dict ? true : false; 328 } 329 330 /* 331 * DYNAMIC RULESET INTERFACE. 332 */ 333 334 int 335 npf_ruleset_add(int fd, const char *rname, nl_rule_t *rl, uint64_t *id) 336 { 337 prop_dictionary_t rldict = rl->nrl_dict; 338 prop_dictionary_t ret; 339 int error; 340 341 prop_dictionary_set_cstring(rldict, "ruleset-name", rname); 342 prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_ADD); 343 error = prop_dictionary_sendrecv_ioctl(rldict, fd, IOC_NPF_RULE, &ret); 344 if (!error) { 345 prop_dictionary_get_uint64(ret, "id", id); 346 } 347 return error; 348 } 349 350 int 351 npf_ruleset_remove(int fd, const char *rname, uint64_t id) 352 { 353 prop_dictionary_t rldict; 354 355 rldict = prop_dictionary_create(); 356 if (rldict == NULL) { 357 return ENOMEM; 358 } 359 prop_dictionary_set_cstring(rldict, "ruleset-name", rname); 360 prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_REMOVE); 361 prop_dictionary_set_uint64(rldict, "id", id); 362 return prop_dictionary_send_ioctl(rldict, fd, IOC_NPF_RULE); 363 } 364 365 int 366 npf_ruleset_remkey(int fd, const char *rname, const void *key, size_t len) 367 { 368 prop_dictionary_t rldict; 369 prop_data_t keyobj; 370 371 rldict = prop_dictionary_create(); 372 if (rldict == NULL) { 373 return ENOMEM; 374 } 375 prop_dictionary_set_cstring(rldict, "ruleset-name", rname); 376 prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_REMKEY); 377 378 keyobj = prop_data_create_data(key, len); 379 if (keyobj == NULL) { 380 prop_object_release(rldict); 381 return ENOMEM; 382 } 383 prop_dictionary_set(rldict, "key", keyobj); 384 prop_object_release(keyobj); 385 386 return prop_dictionary_send_ioctl(rldict, fd, IOC_NPF_RULE); 387 } 388 389 int 390 npf_ruleset_flush(int fd, const char *rname) 391 { 392 prop_dictionary_t rldict; 393 394 rldict = prop_dictionary_create(); 395 if (rldict == NULL) { 396 return ENOMEM; 397 } 398 prop_dictionary_set_cstring(rldict, "ruleset-name", rname); 399 prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_FLUSH); 400 return prop_dictionary_send_ioctl(rldict, fd, IOC_NPF_RULE); 401 } 402 403 /* 404 * _npf_ruleset_transform: transform the ruleset representing nested 405 * rules with lists into an array. 406 */ 407 408 static void 409 _npf_ruleset_transform1(prop_array_t rlset, prop_array_t rules) 410 { 411 prop_object_iterator_t it; 412 prop_dictionary_t rldict; 413 prop_array_t subrlset; 414 415 it = prop_array_iterator(rules); 416 while ((rldict = prop_object_iterator_next(it)) != NULL) { 417 unsigned idx; 418 419 /* Add rules to the array (reference is retained). */ 420 prop_array_add(rlset, rldict); 421 422 subrlset = prop_dictionary_get(rldict, "subrules"); 423 if (subrlset) { 424 /* Process subrules recursively. */ 425 _npf_ruleset_transform1(rlset, subrlset); 426 /* Add the skip-to position. */ 427 idx = prop_array_count(rlset); 428 prop_dictionary_set_uint32(rldict, "skip-to", idx); 429 prop_dictionary_remove(rldict, "subrules"); 430 } 431 } 432 prop_object_iterator_release(it); 433 } 434 435 static prop_array_t 436 _npf_ruleset_transform(prop_array_t rlset) 437 { 438 prop_array_t nrlset; 439 440 nrlset = prop_array_create(); 441 _npf_ruleset_transform1(nrlset, rlset); 442 return nrlset; 443 } 444 445 /* 446 * NPF EXTENSION INTERFACE. 447 */ 448 449 nl_ext_t * 450 npf_ext_construct(const char *name) 451 { 452 nl_ext_t *ext; 453 454 ext = malloc(sizeof(*ext)); 455 if (ext == NULL) { 456 return NULL; 457 } 458 ext->nxt_name = strdup(name); 459 if (ext->nxt_name == NULL) { 460 free(ext); 461 return NULL; 462 } 463 ext->nxt_dict = prop_dictionary_create(); 464 465 return ext; 466 } 467 468 void 469 npf_ext_param_u32(nl_ext_t *ext, const char *key, uint32_t val) 470 { 471 prop_dictionary_t extdict = ext->nxt_dict; 472 prop_dictionary_set_uint32(extdict, key, val); 473 } 474 475 void 476 npf_ext_param_bool(nl_ext_t *ext, const char *key, bool val) 477 { 478 prop_dictionary_t extdict = ext->nxt_dict; 479 prop_dictionary_set_bool(extdict, key, val); 480 } 481 482 void 483 npf_ext_param_string(nl_ext_t *ext, const char *key, const char *val) 484 { 485 prop_dictionary_t extdict = ext->nxt_dict; 486 prop_dictionary_set_cstring(extdict, key, val); 487 } 488 489 /* 490 * RULE INTERFACE. 491 */ 492 493 nl_rule_t * 494 npf_rule_create(const char *name, uint32_t attr, const char *ifname) 495 { 496 prop_dictionary_t rldict; 497 nl_rule_t *rl; 498 499 rl = malloc(sizeof(*rl)); 500 if (rl == NULL) { 501 return NULL; 502 } 503 rldict = prop_dictionary_create(); 504 if (rldict == NULL) { 505 free(rl); 506 return NULL; 507 } 508 if (name) { 509 prop_dictionary_set_cstring(rldict, "name", name); 510 } 511 prop_dictionary_set_uint32(rldict, "attr", attr); 512 513 if (ifname) { 514 prop_dictionary_set_cstring(rldict, "ifname", ifname); 515 } 516 rl->nrl_dict = rldict; 517 return rl; 518 } 519 520 int 521 npf_rule_setcode(nl_rule_t *rl, int type, const void *code, size_t len) 522 { 523 prop_dictionary_t rldict = rl->nrl_dict; 524 prop_data_t cdata; 525 526 switch (type) { 527 case NPF_CODE_NC: 528 case NPF_CODE_BPF: 529 break; 530 default: 531 return ENOTSUP; 532 } 533 prop_dictionary_set_uint32(rldict, "code-type", type); 534 if ((cdata = prop_data_create_data(code, len)) == NULL) { 535 return ENOMEM; 536 } 537 prop_dictionary_set(rldict, "code", cdata); 538 prop_object_release(cdata); 539 return 0; 540 } 541 542 int 543 npf_rule_setkey(nl_rule_t *rl, const void *key, size_t len) 544 { 545 prop_dictionary_t rldict = rl->nrl_dict; 546 prop_data_t kdata; 547 548 if ((kdata = prop_data_create_data(key, len)) == NULL) { 549 return ENOMEM; 550 } 551 prop_dictionary_set(rldict, "key", kdata); 552 prop_object_release(kdata); 553 return 0; 554 } 555 556 int 557 npf_rule_setinfo(nl_rule_t *rl, const void *info, size_t len) 558 { 559 prop_dictionary_t rldict = rl->nrl_dict; 560 prop_data_t idata; 561 562 if ((idata = prop_data_create_data(info, len)) == NULL) { 563 return ENOMEM; 564 } 565 prop_dictionary_set(rldict, "info", idata); 566 prop_object_release(idata); 567 return 0; 568 } 569 570 int 571 npf_rule_setprio(nl_rule_t *rl, pri_t pri) 572 { 573 prop_dictionary_t rldict = rl->nrl_dict; 574 575 prop_dictionary_set_int32(rldict, "prio", pri); 576 return 0; 577 } 578 579 int 580 npf_rule_setproc(nl_rule_t *rl, const char *name) 581 { 582 prop_dictionary_t rldict = rl->nrl_dict; 583 584 prop_dictionary_set_cstring(rldict, "rproc", name); 585 return 0; 586 } 587 588 void * 589 npf_rule_export(nl_rule_t *rl, size_t *length) 590 { 591 prop_dictionary_t rldict = rl->nrl_dict; 592 void *xml; 593 594 if ((xml = prop_dictionary_externalize(rldict)) == NULL) { 595 return NULL; 596 } 597 *length = strlen(xml); 598 return xml; 599 } 600 601 bool 602 npf_rule_exists_p(nl_config_t *ncf, const char *name) 603 { 604 return _npf_prop_array_lookup(ncf->ncf_rules_list, "name", name); 605 } 606 607 int 608 npf_rule_insert(nl_config_t *ncf, nl_rule_t *parent, nl_rule_t *rl) 609 { 610 prop_dictionary_t rldict = rl->nrl_dict; 611 prop_array_t rlset; 612 613 if (parent) { 614 prop_dictionary_t pdict = parent->nrl_dict; 615 rlset = prop_dictionary_get(pdict, "subrules"); 616 if (rlset == NULL) { 617 rlset = prop_array_create(); 618 prop_dictionary_set(pdict, "subrules", rlset); 619 prop_object_release(rlset); 620 } 621 } else { 622 rlset = ncf->ncf_rules_list; 623 } 624 prop_array_add(rlset, rldict); 625 return 0; 626 } 627 628 static nl_rule_t * 629 _npf_rule_iterate1(nl_config_t *ncf, prop_array_t rlist, unsigned *level) 630 { 631 prop_dictionary_t rldict; 632 uint32_t skipto = 0; 633 634 if (!ncf->ncf_rule_iter) { 635 /* Initialise the iterator. */ 636 ncf->ncf_rule_iter = prop_array_iterator(rlist); 637 ncf->ncf_nlevel = 0; 638 ncf->ncf_reduce[0] = 0; 639 ncf->ncf_counter = 0; 640 } 641 642 rldict = prop_object_iterator_next(ncf->ncf_rule_iter); 643 if ((ncf->ncf_cur_rule.nrl_dict = rldict) == NULL) { 644 prop_object_iterator_release(ncf->ncf_rule_iter); 645 ncf->ncf_rule_iter = NULL; 646 return NULL; 647 } 648 *level = ncf->ncf_nlevel; 649 650 prop_dictionary_get_uint32(rldict, "skip-to", &skipto); 651 if (skipto) { 652 ncf->ncf_nlevel++; 653 ncf->ncf_reduce[ncf->ncf_nlevel] = skipto; 654 } 655 if (ncf->ncf_reduce[ncf->ncf_nlevel] == ++ncf->ncf_counter) { 656 assert(ncf->ncf_nlevel > 0); 657 ncf->ncf_nlevel--; 658 } 659 return &ncf->ncf_cur_rule; 660 } 661 662 nl_rule_t * 663 npf_rule_iterate(nl_config_t *ncf, unsigned *level) 664 { 665 return _npf_rule_iterate1(ncf, ncf->ncf_rules_list, level); 666 } 667 668 const char * 669 npf_rule_getname(nl_rule_t *rl) 670 { 671 prop_dictionary_t rldict = rl->nrl_dict; 672 const char *rname = NULL; 673 674 prop_dictionary_get_cstring_nocopy(rldict, "name", &rname); 675 return rname; 676 } 677 678 uint32_t 679 npf_rule_getattr(nl_rule_t *rl) 680 { 681 prop_dictionary_t rldict = rl->nrl_dict; 682 uint32_t attr = 0; 683 684 prop_dictionary_get_uint32(rldict, "attr", &attr); 685 return attr; 686 } 687 688 const char * 689 npf_rule_getinterface(nl_rule_t *rl) 690 { 691 prop_dictionary_t rldict = rl->nrl_dict; 692 const char *ifname = NULL; 693 694 prop_dictionary_get_cstring_nocopy(rldict, "ifname", &ifname); 695 return ifname; 696 } 697 698 const void * 699 npf_rule_getinfo(nl_rule_t *rl, size_t *len) 700 { 701 prop_dictionary_t rldict = rl->nrl_dict; 702 prop_object_t obj = prop_dictionary_get(rldict, "info"); 703 704 *len = prop_data_size(obj); 705 return prop_data_data_nocopy(obj); 706 } 707 708 const char * 709 npf_rule_getproc(nl_rule_t *rl) 710 { 711 prop_dictionary_t rldict = rl->nrl_dict; 712 const char *rpname = NULL; 713 714 prop_dictionary_get_cstring_nocopy(rldict, "rproc", &rpname); 715 return rpname; 716 } 717 718 int 719 _npf_ruleset_list(int fd, const char *rname, nl_config_t *ncf) 720 { 721 prop_dictionary_t rldict, ret; 722 int error; 723 724 rldict = prop_dictionary_create(); 725 if (rldict == NULL) { 726 return ENOMEM; 727 } 728 prop_dictionary_set_cstring(rldict, "ruleset-name", rname); 729 prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_LIST); 730 error = prop_dictionary_sendrecv_ioctl(rldict, fd, IOC_NPF_RULE, &ret); 731 if (!error) { 732 prop_array_t rules; 733 734 rules = prop_dictionary_get(ret, "rules"); 735 if (rules == NULL) { 736 return EINVAL; 737 } 738 prop_object_release(ncf->ncf_rules_list); 739 ncf->ncf_rules_list = rules; 740 } 741 return error; 742 } 743 744 void 745 npf_rule_destroy(nl_rule_t *rl) 746 { 747 748 prop_object_release(rl->nrl_dict); 749 free(rl); 750 } 751 752 /* 753 * RULE PROCEDURE INTERFACE. 754 */ 755 756 nl_rproc_t * 757 npf_rproc_create(const char *name) 758 { 759 prop_dictionary_t rpdict; 760 prop_array_t extcalls; 761 nl_rproc_t *nrp; 762 763 nrp = malloc(sizeof(nl_rproc_t)); 764 if (nrp == NULL) { 765 return NULL; 766 } 767 rpdict = prop_dictionary_create(); 768 if (rpdict == NULL) { 769 free(nrp); 770 return NULL; 771 } 772 prop_dictionary_set_cstring(rpdict, "name", name); 773 774 extcalls = prop_array_create(); 775 if (extcalls == NULL) { 776 prop_object_release(rpdict); 777 free(nrp); 778 return NULL; 779 } 780 prop_dictionary_set(rpdict, "extcalls", extcalls); 781 prop_object_release(extcalls); 782 783 nrp->nrp_dict = rpdict; 784 return nrp; 785 } 786 787 int 788 npf_rproc_extcall(nl_rproc_t *rp, nl_ext_t *ext) 789 { 790 prop_dictionary_t rpdict = rp->nrp_dict; 791 prop_dictionary_t extdict = ext->nxt_dict; 792 prop_array_t extcalls; 793 794 extcalls = prop_dictionary_get(rpdict, "extcalls"); 795 if (_npf_prop_array_lookup(extcalls, "name", ext->nxt_name)) { 796 return EEXIST; 797 } 798 prop_dictionary_set_cstring(extdict, "name", ext->nxt_name); 799 prop_array_add(extcalls, extdict); 800 return 0; 801 } 802 803 bool 804 npf_rproc_exists_p(nl_config_t *ncf, const char *name) 805 { 806 return _npf_prop_array_lookup(ncf->ncf_rproc_list, "name", name); 807 } 808 809 int 810 npf_rproc_insert(nl_config_t *ncf, nl_rproc_t *rp) 811 { 812 prop_dictionary_t rpdict = rp->nrp_dict; 813 const char *name; 814 815 if (!prop_dictionary_get_cstring_nocopy(rpdict, "name", &name)) { 816 return EINVAL; 817 } 818 if (npf_rproc_exists_p(ncf, name)) { 819 return EEXIST; 820 } 821 prop_array_add(ncf->ncf_rproc_list, rpdict); 822 return 0; 823 } 824 825 nl_rproc_t * 826 npf_rproc_iterate(nl_config_t *ncf) 827 { 828 prop_dictionary_t rpdict; 829 830 if (!ncf->ncf_rproc_iter) { 831 /* Initialise the iterator. */ 832 ncf->ncf_rproc_iter = prop_array_iterator(ncf->ncf_rproc_list); 833 } 834 rpdict = prop_object_iterator_next(ncf->ncf_rproc_iter); 835 if ((ncf->ncf_cur_rproc.nrp_dict = rpdict) == NULL) { 836 prop_object_iterator_release(ncf->ncf_rproc_iter); 837 ncf->ncf_rproc_iter = NULL; 838 return NULL; 839 } 840 return &ncf->ncf_cur_rproc; 841 } 842 843 const char * 844 npf_rproc_getname(nl_rproc_t *rp) 845 { 846 prop_dictionary_t rpdict = rp->nrp_dict; 847 const char *rpname = NULL; 848 849 prop_dictionary_get_cstring_nocopy(rpdict, "name", &rpname); 850 return rpname; 851 } 852 853 /* 854 * NAT INTERFACE. 855 */ 856 857 nl_nat_t * 858 npf_nat_create(int type, u_int flags, const char *ifname, 859 int af, npf_addr_t *addr, npf_netmask_t mask, in_port_t port) 860 { 861 nl_rule_t *rl; 862 prop_dictionary_t rldict; 863 prop_data_t addrdat; 864 uint32_t attr; 865 size_t sz; 866 867 if (af == AF_INET) { 868 sz = sizeof(struct in_addr); 869 } else if (af == AF_INET6) { 870 sz = sizeof(struct in6_addr); 871 } else { 872 return NULL; 873 } 874 875 attr = NPF_RULE_PASS | NPF_RULE_FINAL | 876 (type == NPF_NATOUT ? NPF_RULE_OUT : NPF_RULE_IN); 877 878 /* Create a rule for NAT policy. Next, will add NAT data. */ 879 rl = npf_rule_create(NULL, attr, ifname); 880 if (rl == NULL) { 881 return NULL; 882 } 883 rldict = rl->nrl_dict; 884 885 /* Translation type and flags. */ 886 prop_dictionary_set_int32(rldict, "type", type); 887 prop_dictionary_set_uint32(rldict, "flags", flags); 888 889 /* Translation IP and mask. */ 890 addrdat = prop_data_create_data(addr, sz); 891 if (addrdat == NULL) { 892 npf_rule_destroy(rl); 893 return NULL; 894 } 895 prop_dictionary_set(rldict, "nat-ip", addrdat); 896 prop_dictionary_set_uint32(rldict, "nat-mask", mask); 897 prop_object_release(addrdat); 898 899 /* Translation port (for redirect case). */ 900 prop_dictionary_set_uint16(rldict, "nat-port", port); 901 902 return (nl_nat_t *)rl; 903 } 904 905 int 906 npf_nat_insert(nl_config_t *ncf, nl_nat_t *nt, pri_t pri __unused) 907 { 908 prop_dictionary_t rldict = nt->nrl_dict; 909 910 prop_dictionary_set_int32(rldict, "prio", NPF_PRI_LAST); 911 prop_array_add(ncf->ncf_nat_list, rldict); 912 return 0; 913 } 914 915 nl_nat_t * 916 npf_nat_iterate(nl_config_t *ncf) 917 { 918 u_int level; 919 return _npf_rule_iterate1(ncf, ncf->ncf_nat_list, &level); 920 } 921 922 int 923 npf_nat_setalgo(nl_nat_t *nt, u_int algo) 924 { 925 prop_dictionary_t rldict = nt->nrl_dict; 926 prop_dictionary_set_uint32(rldict, "nat-algo", algo); 927 return 0; 928 } 929 930 int 931 npf_nat_setnpt66(nl_nat_t *nt, uint16_t adj) 932 { 933 prop_dictionary_t rldict = nt->nrl_dict; 934 int error; 935 936 if ((error = npf_nat_setalgo(nt, NPF_ALGO_NPT66)) != 0) { 937 return error; 938 } 939 prop_dictionary_set_uint16(rldict, "npt66-adj", adj); 940 return 0; 941 } 942 943 int 944 npf_nat_gettype(nl_nat_t *nt) 945 { 946 prop_dictionary_t rldict = nt->nrl_dict; 947 int type = 0; 948 949 prop_dictionary_get_int32(rldict, "type", &type); 950 return type; 951 } 952 953 u_int 954 npf_nat_getflags(nl_nat_t *nt) 955 { 956 prop_dictionary_t rldict = nt->nrl_dict; 957 unsigned flags = 0; 958 959 prop_dictionary_get_uint32(rldict, "flags", &flags); 960 return flags; 961 } 962 963 void 964 npf_nat_getmap(nl_nat_t *nt, npf_addr_t *addr, size_t *alen, in_port_t *port) 965 { 966 prop_dictionary_t rldict = nt->nrl_dict; 967 prop_object_t obj = prop_dictionary_get(rldict, "nat-ip"); 968 969 *alen = prop_data_size(obj); 970 memcpy(addr, prop_data_data_nocopy(obj), *alen); 971 972 *port = 0; 973 prop_dictionary_get_uint16(rldict, "nat-port", port); 974 } 975 976 /* 977 * TABLE INTERFACE. 978 */ 979 980 nl_table_t * 981 npf_table_create(const char *name, u_int id, int type) 982 { 983 prop_dictionary_t tldict; 984 prop_array_t tblents; 985 nl_table_t *tl; 986 987 tl = malloc(sizeof(*tl)); 988 if (tl == NULL) { 989 return NULL; 990 } 991 tldict = prop_dictionary_create(); 992 if (tldict == NULL) { 993 free(tl); 994 return NULL; 995 } 996 prop_dictionary_set_cstring(tldict, "name", name); 997 prop_dictionary_set_uint32(tldict, "id", id); 998 prop_dictionary_set_int32(tldict, "type", type); 999 1000 tblents = prop_array_create(); 1001 if (tblents == NULL) { 1002 prop_object_release(tldict); 1003 free(tl); 1004 return NULL; 1005 } 1006 prop_dictionary_set(tldict, "entries", tblents); 1007 prop_object_release(tblents); 1008 1009 tl->ntl_dict = tldict; 1010 return tl; 1011 } 1012 1013 int 1014 npf_table_add_entry(nl_table_t *tl, int af, const npf_addr_t *addr, 1015 const npf_netmask_t mask) 1016 { 1017 prop_dictionary_t tldict = tl->ntl_dict, entdict; 1018 prop_array_t tblents; 1019 prop_data_t addrdata; 1020 unsigned alen; 1021 1022 /* Create the table entry. */ 1023 entdict = prop_dictionary_create(); 1024 if (entdict == NULL) { 1025 return ENOMEM; 1026 } 1027 1028 switch (af) { 1029 case AF_INET: 1030 alen = sizeof(struct in_addr); 1031 break; 1032 case AF_INET6: 1033 alen = sizeof(struct in6_addr); 1034 break; 1035 default: 1036 return EINVAL; 1037 } 1038 1039 addrdata = prop_data_create_data(addr, alen); 1040 prop_dictionary_set(entdict, "addr", addrdata); 1041 prop_dictionary_set_uint8(entdict, "mask", mask); 1042 prop_object_release(addrdata); 1043 1044 tblents = prop_dictionary_get(tldict, "entries"); 1045 prop_array_add(tblents, entdict); 1046 prop_object_release(entdict); 1047 return 0; 1048 } 1049 1050 int 1051 npf_table_setdata(nl_table_t *tl, const void *blob, size_t len) 1052 { 1053 prop_dictionary_t tldict = tl->ntl_dict; 1054 prop_data_t bobj; 1055 1056 if ((bobj = prop_data_create_data(blob, len)) == NULL) { 1057 return ENOMEM; 1058 } 1059 prop_dictionary_set(tldict, "data", bobj); 1060 prop_object_release(bobj); 1061 return 0; 1062 } 1063 1064 static bool 1065 _npf_table_exists_p(nl_config_t *ncf, const char *name) 1066 { 1067 prop_dictionary_t tldict; 1068 prop_object_iterator_t it; 1069 1070 it = prop_array_iterator(ncf->ncf_table_list); 1071 while ((tldict = prop_object_iterator_next(it)) != NULL) { 1072 const char *tname = NULL; 1073 1074 if (prop_dictionary_get_cstring_nocopy(tldict, "name", &tname) 1075 && strcmp(tname, name) == 0) 1076 break; 1077 } 1078 prop_object_iterator_release(it); 1079 return tldict ? true : false; 1080 } 1081 1082 int 1083 npf_table_insert(nl_config_t *ncf, nl_table_t *tl) 1084 { 1085 prop_dictionary_t tldict = tl->ntl_dict; 1086 const char *name = NULL; 1087 1088 if (!prop_dictionary_get_cstring_nocopy(tldict, "name", &name)) { 1089 return EINVAL; 1090 } 1091 if (_npf_table_exists_p(ncf, name)) { 1092 return EEXIST; 1093 } 1094 prop_array_add(ncf->ncf_table_list, tldict); 1095 return 0; 1096 } 1097 1098 nl_table_t * 1099 npf_table_iterate(nl_config_t *ncf) 1100 { 1101 prop_dictionary_t tldict; 1102 1103 if (!ncf->ncf_table_iter) { 1104 /* Initialise the iterator. */ 1105 ncf->ncf_table_iter = prop_array_iterator(ncf->ncf_table_list); 1106 } 1107 tldict = prop_object_iterator_next(ncf->ncf_table_iter); 1108 if ((ncf->ncf_cur_table.ntl_dict = tldict) == NULL) { 1109 prop_object_iterator_release(ncf->ncf_table_iter); 1110 ncf->ncf_table_iter = NULL; 1111 return NULL; 1112 } 1113 return &ncf->ncf_cur_table; 1114 } 1115 1116 unsigned 1117 npf_table_getid(nl_table_t *tl) 1118 { 1119 prop_dictionary_t tldict = tl->ntl_dict; 1120 unsigned id = (unsigned)-1; 1121 1122 prop_dictionary_get_uint32(tldict, "id", &id); 1123 return id; 1124 } 1125 1126 const char * 1127 npf_table_getname(nl_table_t *tl) 1128 { 1129 prop_dictionary_t tldict = tl->ntl_dict; 1130 const char *tname = NULL; 1131 1132 prop_dictionary_get_cstring_nocopy(tldict, "name", &tname); 1133 return tname; 1134 } 1135 1136 int 1137 npf_table_gettype(nl_table_t *tl) 1138 { 1139 prop_dictionary_t tldict = tl->ntl_dict; 1140 int type = 0; 1141 1142 prop_dictionary_get_int32(tldict, "type", &type); 1143 return type; 1144 } 1145 1146 void 1147 npf_table_destroy(nl_table_t *tl) 1148 { 1149 prop_object_release(tl->ntl_dict); 1150 free(tl); 1151 } 1152 1153 /* 1154 * ALG INTERFACE. 1155 */ 1156 1157 int 1158 _npf_alg_load(nl_config_t *ncf, const char *name) 1159 { 1160 prop_dictionary_t al_dict; 1161 1162 if (_npf_prop_array_lookup(ncf->ncf_alg_list, "name", name)) 1163 return EEXIST; 1164 1165 al_dict = prop_dictionary_create(); 1166 prop_dictionary_set_cstring(al_dict, "name", name); 1167 prop_array_add(ncf->ncf_alg_list, al_dict); 1168 prop_object_release(al_dict); 1169 return 0; 1170 } 1171 1172 int 1173 _npf_alg_unload(nl_config_t *ncf, const char *name) 1174 { 1175 if (!_npf_prop_array_lookup(ncf->ncf_alg_list, "name", name)) 1176 return ENOENT; 1177 1178 // Not yet: prop_array_add(ncf->ncf_alg_list, al_dict); 1179 return ENOTSUP; 1180 } 1181 1182 /* 1183 * MISC. 1184 */ 1185 1186 static prop_dictionary_t 1187 _npf_debug_initonce(nl_config_t *ncf) 1188 { 1189 if (!ncf->ncf_debug) { 1190 prop_array_t iflist = prop_array_create(); 1191 ncf->ncf_debug = prop_dictionary_create(); 1192 prop_dictionary_set(ncf->ncf_debug, "interfaces", iflist); 1193 prop_object_release(iflist); 1194 } 1195 return ncf->ncf_debug; 1196 } 1197 1198 void 1199 _npf_debug_addif(nl_config_t *ncf, const char *ifname) 1200 { 1201 prop_dictionary_t ifdict, dbg = _npf_debug_initonce(ncf); 1202 prop_array_t iflist = prop_dictionary_get(dbg, "interfaces"); 1203 u_int if_idx = if_nametoindex(ifname); 1204 1205 if (_npf_prop_array_lookup(iflist, "name", ifname)) { 1206 return; 1207 } 1208 ifdict = prop_dictionary_create(); 1209 prop_dictionary_set_cstring(ifdict, "name", ifname); 1210 prop_dictionary_set_uint32(ifdict, "index", if_idx); 1211 prop_array_add(iflist, ifdict); 1212 prop_object_release(ifdict); 1213 } 1214