1 /* $NetBSD: npf.c,v 1.19 2013/03/20 00:29:46 christos Exp $ */ 2 3 /*- 4 * Copyright (c) 2010-2013 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 __KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.19 2013/03/20 00:29:46 christos Exp $"); 34 35 #include <sys/types.h> 36 #include <netinet/in_systm.h> 37 #include <netinet/in.h> 38 #include <net/if.h> 39 #include <prop/proplib.h> 40 41 #include <stdlib.h> 42 #include <string.h> 43 #include <assert.h> 44 #include <errno.h> 45 #include <err.h> 46 47 #define _NPF_PRIVATE 48 #include "npf.h" 49 50 struct nl_config { 51 /* Rules, translations, tables, procedures. */ 52 prop_dictionary_t ncf_dict; 53 prop_array_t ncf_alg_list; 54 prop_array_t ncf_rules_list; 55 prop_array_t ncf_rproc_list; 56 prop_array_t ncf_table_list; 57 prop_array_t ncf_nat_list; 58 /* Debug information. */ 59 prop_dictionary_t ncf_debug; 60 /* Error report. */ 61 prop_dictionary_t ncf_err; 62 /* Custom file to externalise property-list. */ 63 const char * ncf_plist; 64 bool ncf_flush; 65 }; 66 67 struct nl_rule { 68 prop_dictionary_t nrl_dict; 69 }; 70 71 struct nl_rproc { 72 prop_dictionary_t nrp_dict; 73 }; 74 75 struct nl_table { 76 prop_dictionary_t ntl_dict; 77 }; 78 79 struct nl_alg { 80 prop_dictionary_t nal_dict; 81 }; 82 83 struct nl_ext { 84 const char * nxt_name; 85 prop_dictionary_t nxt_dict; 86 }; 87 88 static prop_array_t _npf_ruleset_transform(prop_array_t); 89 90 /* 91 * CONFIGURATION INTERFACE. 92 */ 93 94 nl_config_t * 95 npf_config_create(void) 96 { 97 nl_config_t *ncf; 98 99 ncf = calloc(1, sizeof(*ncf)); 100 if (ncf == NULL) { 101 return NULL; 102 } 103 ncf->ncf_alg_list = prop_array_create(); 104 ncf->ncf_rules_list = prop_array_create(); 105 ncf->ncf_rproc_list = prop_array_create(); 106 ncf->ncf_table_list = prop_array_create(); 107 ncf->ncf_nat_list = prop_array_create(); 108 109 ncf->ncf_plist = NULL; 110 ncf->ncf_flush = false; 111 112 return ncf; 113 } 114 115 int 116 npf_config_submit(nl_config_t *ncf, int fd) 117 { 118 const char *plist = ncf->ncf_plist; 119 prop_dictionary_t npf_dict; 120 prop_array_t rlset; 121 int error = 0; 122 123 npf_dict = prop_dictionary_create(); 124 if (npf_dict == NULL) { 125 return ENOMEM; 126 } 127 prop_dictionary_set_uint32(npf_dict, "version", NPF_VERSION); 128 129 rlset = _npf_ruleset_transform(ncf->ncf_rules_list); 130 if (rlset == NULL) { 131 prop_object_release(npf_dict); 132 return ENOMEM; 133 } 134 prop_dictionary_set(npf_dict, "rules", rlset); 135 prop_object_release(rlset); 136 137 prop_dictionary_set(npf_dict, "algs", ncf->ncf_alg_list); 138 prop_dictionary_set(npf_dict, "rprocs", ncf->ncf_rproc_list); 139 prop_dictionary_set(npf_dict, "tables", ncf->ncf_table_list); 140 prop_dictionary_set(npf_dict, "translation", ncf->ncf_nat_list); 141 prop_dictionary_set_bool(npf_dict, "flush", ncf->ncf_flush); 142 if (ncf->ncf_debug) { 143 prop_dictionary_set(npf_dict, "debug", ncf->ncf_debug); 144 } 145 146 if (plist) { 147 if (!prop_dictionary_externalize_to_file(npf_dict, plist)) { 148 error = errno; 149 } 150 prop_object_release(npf_dict); 151 return error; 152 } 153 154 error = prop_dictionary_sendrecv_ioctl(npf_dict, fd, 155 IOC_NPF_RELOAD, &ncf->ncf_err); 156 if (error) { 157 prop_object_release(npf_dict); 158 assert(ncf->ncf_err == NULL); 159 return error; 160 } 161 162 prop_dictionary_get_int32(ncf->ncf_err, "errno", &error); 163 prop_object_release(npf_dict); 164 return error; 165 } 166 167 nl_config_t * 168 npf_config_retrieve(int fd, bool *active, bool *loaded) 169 { 170 prop_dictionary_t npf_dict; 171 nl_config_t *ncf; 172 int error; 173 174 error = prop_dictionary_recv_ioctl(fd, IOC_NPF_GETCONF, &npf_dict); 175 if (error) { 176 return NULL; 177 } 178 ncf = calloc(1, sizeof(*ncf)); 179 if (ncf == NULL) { 180 prop_object_release(npf_dict); 181 return NULL; 182 } 183 ncf->ncf_dict = npf_dict; 184 ncf->ncf_alg_list = prop_dictionary_get(npf_dict, "algs"); 185 ncf->ncf_rules_list = prop_dictionary_get(npf_dict, "rules"); 186 ncf->ncf_rproc_list = prop_dictionary_get(npf_dict, "rprocs"); 187 ncf->ncf_table_list = prop_dictionary_get(npf_dict, "tables"); 188 ncf->ncf_nat_list = prop_dictionary_get(npf_dict, "translation"); 189 190 prop_dictionary_get_bool(npf_dict, "active", active); 191 *loaded = (ncf->ncf_rules_list != NULL); 192 return ncf; 193 } 194 195 int 196 npf_config_flush(int fd) 197 { 198 nl_config_t *ncf; 199 int error; 200 201 ncf = npf_config_create(); 202 if (ncf == NULL) { 203 return ENOMEM; 204 } 205 ncf->ncf_flush = true; 206 error = npf_config_submit(ncf, fd); 207 npf_config_destroy(ncf); 208 return error; 209 } 210 211 void 212 _npf_config_error(nl_config_t *ncf, nl_error_t *ne) 213 { 214 memset(ne, 0, sizeof(*ne)); 215 prop_dictionary_get_int32(ncf->ncf_err, "id", &ne->ne_id); 216 prop_dictionary_get_cstring(ncf->ncf_err, 217 "source-file", &ne->ne_source_file); 218 prop_dictionary_get_uint32(ncf->ncf_err, 219 "source-line", &ne->ne_source_line); 220 prop_dictionary_get_int32(ncf->ncf_err, 221 "code-error", &ne->ne_ncode_error); 222 prop_dictionary_get_int32(ncf->ncf_err, 223 "code-errat", &ne->ne_ncode_errat); 224 } 225 226 void 227 npf_config_destroy(nl_config_t *ncf) 228 { 229 230 if (!ncf->ncf_dict) { 231 prop_object_release(ncf->ncf_alg_list); 232 prop_object_release(ncf->ncf_rules_list); 233 prop_object_release(ncf->ncf_rproc_list); 234 prop_object_release(ncf->ncf_table_list); 235 prop_object_release(ncf->ncf_nat_list); 236 } 237 if (ncf->ncf_err) { 238 prop_object_release(ncf->ncf_err); 239 } 240 if (ncf->ncf_debug) { 241 prop_object_release(ncf->ncf_debug); 242 } 243 free(ncf); 244 } 245 246 void 247 _npf_config_setsubmit(nl_config_t *ncf, const char *plist_file) 248 { 249 250 ncf->ncf_plist = plist_file; 251 } 252 253 static bool 254 _npf_prop_array_lookup(prop_array_t array, const char *key, const char *name) 255 { 256 prop_dictionary_t dict; 257 prop_object_iterator_t it; 258 259 it = prop_array_iterator(array); 260 while ((dict = prop_object_iterator_next(it)) != NULL) { 261 const char *lname; 262 prop_dictionary_get_cstring_nocopy(dict, key, &lname); 263 if (strcmp(name, lname) == 0) 264 break; 265 } 266 prop_object_iterator_release(it); 267 return dict ? true : false; 268 } 269 270 /* 271 * DYNAMIC RULESET INTERFACE. 272 */ 273 274 int 275 npf_ruleset_add(int fd, const char *rname, nl_rule_t *rl, uint64_t *id) 276 { 277 prop_dictionary_t rldict = rl->nrl_dict; 278 prop_dictionary_t ret; 279 int error; 280 281 prop_dictionary_set_cstring(rldict, "ruleset-name", rname); 282 prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_ADD); 283 error = prop_dictionary_sendrecv_ioctl(rldict, fd, IOC_NPF_RULE, &ret); 284 if (!error) { 285 prop_dictionary_get_uint64(ret, "id", id); 286 } 287 return error; 288 } 289 290 int 291 npf_ruleset_remove(int fd, const char *rname, uint64_t id) 292 { 293 prop_dictionary_t rldict; 294 295 rldict = prop_dictionary_create(); 296 if (rldict == NULL) { 297 return ENOMEM; 298 } 299 prop_dictionary_set_cstring(rldict, "ruleset-name", rname); 300 prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_REMOVE); 301 prop_dictionary_set_uint64(rldict, "id", id); 302 return prop_dictionary_send_ioctl(rldict, fd, IOC_NPF_RULE); 303 } 304 305 int 306 npf_ruleset_remkey(int fd, const char *rname, const void *key, size_t len) 307 { 308 prop_dictionary_t rldict; 309 prop_data_t keyobj; 310 311 rldict = prop_dictionary_create(); 312 if (rldict == NULL) { 313 return ENOMEM; 314 } 315 prop_dictionary_set_cstring(rldict, "ruleset-name", rname); 316 prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_REMKEY); 317 318 keyobj = prop_data_create_data(key, len); 319 if (keyobj == NULL) { 320 prop_object_release(rldict); 321 return ENOMEM; 322 } 323 prop_dictionary_set(rldict, "key", keyobj); 324 prop_object_release(keyobj); 325 326 return prop_dictionary_send_ioctl(rldict, fd, IOC_NPF_RULE); 327 } 328 329 int 330 npf_ruleset_flush(int fd, const char *rname) 331 { 332 prop_dictionary_t rldict; 333 334 rldict = prop_dictionary_create(); 335 if (rldict == NULL) { 336 return ENOMEM; 337 } 338 prop_dictionary_set_cstring(rldict, "ruleset-name", rname); 339 prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_FLUSH); 340 return prop_dictionary_send_ioctl(rldict, fd, IOC_NPF_RULE); 341 } 342 343 /* 344 * _npf_ruleset_transform: transform the ruleset representing nested 345 * rules with lists into an array. 346 */ 347 348 static void 349 _npf_ruleset_transform1(prop_array_t rlset, prop_array_t rules) 350 { 351 prop_object_iterator_t it; 352 prop_dictionary_t rldict; 353 prop_array_t subrlset; 354 355 it = prop_array_iterator(rules); 356 while ((rldict = prop_object_iterator_next(it)) != NULL) { 357 unsigned idx; 358 359 /* Add rules to the array (reference is retained). */ 360 prop_array_add(rlset, rldict); 361 362 subrlset = prop_dictionary_get(rldict, "subrules"); 363 if (subrlset) { 364 /* Process subrules recursively. */ 365 _npf_ruleset_transform1(rlset, subrlset); 366 /* Add the skip-to position. */ 367 idx = prop_array_count(rlset); 368 prop_dictionary_set_uint32(rldict, "skip-to", idx); 369 prop_dictionary_remove(rldict, "subrules"); 370 } 371 } 372 prop_object_iterator_release(it); 373 } 374 375 static prop_array_t 376 _npf_ruleset_transform(prop_array_t rlset) 377 { 378 prop_array_t nrlset; 379 380 nrlset = prop_array_create(); 381 _npf_ruleset_transform1(nrlset, rlset); 382 return nrlset; 383 } 384 385 /* 386 * NPF EXTENSION INTERFACE. 387 */ 388 389 nl_ext_t * 390 npf_ext_construct(const char *name) 391 { 392 nl_ext_t *ext; 393 394 ext = malloc(sizeof(*ext)); 395 if (ext == NULL) { 396 return NULL; 397 } 398 ext->nxt_name = strdup(name); 399 if (ext->nxt_name == NULL) { 400 free(ext); 401 return NULL; 402 } 403 ext->nxt_dict = prop_dictionary_create(); 404 405 return ext; 406 } 407 408 void 409 npf_ext_param_u32(nl_ext_t *ext, const char *key, uint32_t val) 410 { 411 prop_dictionary_t extdict = ext->nxt_dict; 412 prop_dictionary_set_uint32(extdict, key, val); 413 } 414 415 void 416 npf_ext_param_bool(nl_ext_t *ext, const char *key, bool val) 417 { 418 prop_dictionary_t extdict = ext->nxt_dict; 419 prop_dictionary_set_bool(extdict, key, val); 420 } 421 422 /* 423 * RULE INTERFACE. 424 */ 425 426 nl_rule_t * 427 npf_rule_create(const char *name, uint32_t attr, u_int if_idx) 428 { 429 prop_dictionary_t rldict; 430 nl_rule_t *rl; 431 432 rl = malloc(sizeof(*rl)); 433 if (rl == NULL) { 434 return NULL; 435 } 436 rldict = prop_dictionary_create(); 437 if (rldict == NULL) { 438 free(rl); 439 return NULL; 440 } 441 if (name) { 442 prop_dictionary_set_cstring(rldict, "name", name); 443 } 444 prop_dictionary_set_uint32(rldict, "attributes", attr); 445 446 if (if_idx) { 447 prop_dictionary_set_uint32(rldict, "interface", if_idx); 448 } 449 rl->nrl_dict = rldict; 450 return rl; 451 } 452 453 int 454 npf_rule_setcode(nl_rule_t *rl, int type, const void *code, size_t len) 455 { 456 prop_dictionary_t rldict = rl->nrl_dict; 457 prop_data_t cdata; 458 459 switch (type) { 460 case NPF_CODE_NC: 461 case NPF_CODE_BPF: 462 break; 463 default: 464 return ENOTSUP; 465 } 466 prop_dictionary_set_uint32(rldict, "code-type", type); 467 if ((cdata = prop_data_create_data(code, len)) == NULL) { 468 return ENOMEM; 469 } 470 prop_dictionary_set(rldict, "code", cdata); 471 prop_object_release(cdata); 472 return 0; 473 } 474 475 int 476 npf_rule_setkey(nl_rule_t *rl, const void *key, size_t len) 477 { 478 prop_dictionary_t rldict = rl->nrl_dict; 479 prop_data_t kdata; 480 481 if ((kdata = prop_data_create_data(key, len)) == NULL) { 482 return ENOMEM; 483 } 484 prop_dictionary_set(rldict, "key", kdata); 485 prop_object_release(kdata); 486 return 0; 487 } 488 489 int 490 npf_rule_setprio(nl_rule_t *rl, pri_t pri) 491 { 492 prop_dictionary_t rldict = rl->nrl_dict; 493 494 prop_dictionary_set_int32(rldict, "priority", pri); 495 return 0; 496 } 497 498 int 499 npf_rule_setproc(nl_rule_t *rl, const char *name) 500 { 501 prop_dictionary_t rldict = rl->nrl_dict; 502 503 prop_dictionary_set_cstring(rldict, "rproc", name); 504 return 0; 505 } 506 507 void * 508 npf_rule_export(nl_rule_t *rl, size_t *length) 509 { 510 prop_dictionary_t rldict = rl->nrl_dict; 511 void *xml; 512 513 if ((xml = prop_dictionary_externalize(rldict)) == NULL) { 514 return NULL; 515 } 516 *length = strlen(xml); 517 return xml; 518 } 519 520 bool 521 npf_rule_exists_p(nl_config_t *ncf, const char *name) 522 { 523 return _npf_prop_array_lookup(ncf->ncf_rules_list, "name", name); 524 } 525 526 int 527 npf_rule_insert(nl_config_t *ncf, nl_rule_t *parent, nl_rule_t *rl) 528 { 529 prop_dictionary_t rldict = rl->nrl_dict; 530 prop_array_t rlset; 531 532 if (parent) { 533 prop_dictionary_t pdict = parent->nrl_dict; 534 rlset = prop_dictionary_get(pdict, "subrules"); 535 if (rlset == NULL) { 536 rlset = prop_array_create(); 537 prop_dictionary_set(pdict, "subrules", rlset); 538 prop_object_release(rlset); 539 } 540 } else { 541 rlset = ncf->ncf_rules_list; 542 } 543 prop_array_add(rlset, rldict); 544 return 0; 545 } 546 547 static int 548 _npf_rule_foreach1(prop_array_t rules, nl_rule_callback_t func) 549 { 550 prop_dictionary_t rldict; 551 prop_object_iterator_t it; 552 unsigned reduce[16], n; 553 unsigned nlevel; 554 555 if (!rules || prop_object_type(rules) != PROP_TYPE_ARRAY) { 556 return ENOENT; 557 } 558 it = prop_array_iterator(rules); 559 if (it == NULL) { 560 return ENOMEM; 561 } 562 563 nlevel = 0; 564 reduce[nlevel] = 0; 565 n = 0; 566 567 while ((rldict = prop_object_iterator_next(it)) != NULL) { 568 nl_rule_t nrl = { .nrl_dict = rldict }; 569 uint32_t skipto = 0; 570 571 prop_dictionary_get_uint32(rldict, "skip-to", &skipto); 572 (*func)(&nrl, nlevel); 573 if (skipto) { 574 nlevel++; 575 reduce[nlevel] = skipto; 576 } 577 if (reduce[nlevel] == ++n) { 578 assert(nlevel > 0); 579 nlevel--; 580 } 581 } 582 prop_object_iterator_release(it); 583 return 0; 584 } 585 586 int 587 _npf_rule_foreach(nl_config_t *ncf, nl_rule_callback_t func) 588 { 589 return _npf_rule_foreach1(ncf->ncf_rules_list, func); 590 } 591 592 int 593 _npf_ruleset_list(int fd, const char *rname, nl_config_t *ncf) 594 { 595 prop_dictionary_t rldict, ret; 596 int error; 597 598 rldict = prop_dictionary_create(); 599 if (rldict == NULL) { 600 return ENOMEM; 601 } 602 prop_dictionary_set_cstring(rldict, "ruleset-name", rname); 603 prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_LIST); 604 error = prop_dictionary_sendrecv_ioctl(rldict, fd, IOC_NPF_RULE, &ret); 605 if (!error) { 606 prop_array_t rules; 607 608 rules = prop_dictionary_get(ret, "rules"); 609 if (rules == NULL) { 610 return EINVAL; 611 } 612 prop_object_release(ncf->ncf_rules_list); 613 ncf->ncf_rules_list = rules; 614 } 615 return error; 616 } 617 618 pri_t 619 _npf_rule_getinfo(nl_rule_t *nrl, const char **rname, uint32_t *attr, 620 u_int *if_idx) 621 { 622 prop_dictionary_t rldict = nrl->nrl_dict; 623 pri_t prio; 624 625 prop_dictionary_get_cstring_nocopy(rldict, "name", rname); 626 prop_dictionary_get_uint32(rldict, "attributes", attr); 627 prop_dictionary_get_int32(rldict, "priority", &prio); 628 prop_dictionary_get_uint32(rldict, "interface", if_idx); 629 return prio; 630 } 631 632 const void * 633 _npf_rule_ncode(nl_rule_t *nrl, size_t *size) 634 { 635 prop_dictionary_t rldict = nrl->nrl_dict; 636 prop_object_t obj = prop_dictionary_get(rldict, "code"); 637 *size = prop_data_size(obj); 638 return prop_data_data_nocopy(obj); 639 } 640 641 const char * 642 _npf_rule_rproc(nl_rule_t *nrl) 643 { 644 prop_dictionary_t rldict = nrl->nrl_dict; 645 const char *rpname = NULL; 646 647 prop_dictionary_get_cstring_nocopy(rldict, "rproc", &rpname); 648 return rpname; 649 } 650 651 void 652 npf_rule_destroy(nl_rule_t *rl) 653 { 654 655 prop_object_release(rl->nrl_dict); 656 free(rl); 657 } 658 659 /* 660 * RULE PROCEDURE INTERFACE. 661 */ 662 663 nl_rproc_t * 664 npf_rproc_create(const char *name) 665 { 666 prop_dictionary_t rpdict; 667 prop_array_t extcalls; 668 nl_rproc_t *nrp; 669 670 nrp = malloc(sizeof(nl_rproc_t)); 671 if (nrp == NULL) { 672 return NULL; 673 } 674 rpdict = prop_dictionary_create(); 675 if (rpdict == NULL) { 676 free(nrp); 677 return NULL; 678 } 679 prop_dictionary_set_cstring(rpdict, "name", name); 680 681 extcalls = prop_array_create(); 682 if (extcalls == NULL) { 683 prop_object_release(rpdict); 684 free(nrp); 685 return NULL; 686 } 687 prop_dictionary_set(rpdict, "extcalls", extcalls); 688 prop_object_release(extcalls); 689 690 nrp->nrp_dict = rpdict; 691 return nrp; 692 } 693 694 int 695 npf_rproc_extcall(nl_rproc_t *rp, nl_ext_t *ext) 696 { 697 prop_dictionary_t rpdict = rp->nrp_dict; 698 prop_dictionary_t extdict = ext->nxt_dict; 699 prop_array_t extcalls; 700 701 extcalls = prop_dictionary_get(rpdict, "extcalls"); 702 if (_npf_prop_array_lookup(extcalls, "name", ext->nxt_name)) { 703 return EEXIST; 704 } 705 prop_dictionary_set_cstring(extdict, "name", ext->nxt_name); 706 prop_array_add(extcalls, extdict); 707 return 0; 708 } 709 710 bool 711 npf_rproc_exists_p(nl_config_t *ncf, const char *name) 712 { 713 714 return _npf_prop_array_lookup(ncf->ncf_rproc_list, "name", name); 715 } 716 717 int 718 npf_rproc_insert(nl_config_t *ncf, nl_rproc_t *rp) 719 { 720 prop_dictionary_t rpdict = rp->nrp_dict; 721 const char *name; 722 723 if (!prop_dictionary_get_cstring_nocopy(rpdict, "name", &name)) { 724 return EINVAL; 725 } 726 if (npf_rproc_exists_p(ncf, name)) { 727 return EEXIST; 728 } 729 prop_array_add(ncf->ncf_rproc_list, rpdict); 730 return 0; 731 } 732 733 /* 734 * TRANSLATION INTERFACE. 735 */ 736 737 nl_nat_t * 738 npf_nat_create(int type, u_int flags, u_int if_idx, 739 npf_addr_t *addr, int af, in_port_t port) 740 { 741 nl_rule_t *rl; 742 prop_dictionary_t rldict; 743 prop_data_t addrdat; 744 uint32_t attr; 745 size_t sz; 746 747 if (af == AF_INET) { 748 sz = sizeof(struct in_addr); 749 } else if (af == AF_INET6) { 750 sz = sizeof(struct in6_addr); 751 } else { 752 return NULL; 753 } 754 755 attr = NPF_RULE_PASS | NPF_RULE_FINAL | 756 (type == NPF_NATOUT ? NPF_RULE_OUT : NPF_RULE_IN); 757 758 /* Create a rule for NAT policy. Next, will add translation data. */ 759 rl = npf_rule_create(NULL, attr, if_idx); 760 if (rl == NULL) { 761 return NULL; 762 } 763 rldict = rl->nrl_dict; 764 765 /* Translation type and flags. */ 766 prop_dictionary_set_int32(rldict, "type", type); 767 prop_dictionary_set_uint32(rldict, "flags", flags); 768 769 /* Translation IP. */ 770 addrdat = prop_data_create_data(addr, sz); 771 if (addrdat == NULL) { 772 npf_rule_destroy(rl); 773 return NULL; 774 } 775 prop_dictionary_set(rldict, "translation-ip", addrdat); 776 prop_object_release(addrdat); 777 778 /* Translation port (for redirect case). */ 779 prop_dictionary_set_uint16(rldict, "translation-port", port); 780 781 return (nl_nat_t *)rl; 782 } 783 784 int 785 npf_nat_insert(nl_config_t *ncf, nl_nat_t *nt, pri_t pri __unused) 786 { 787 prop_dictionary_t rldict = nt->nrl_dict; 788 789 prop_dictionary_set_int32(rldict, "priority", NPF_PRI_LAST); 790 prop_array_add(ncf->ncf_nat_list, rldict); 791 return 0; 792 } 793 794 int 795 _npf_nat_foreach(nl_config_t *ncf, nl_rule_callback_t func) 796 { 797 return _npf_rule_foreach1(ncf->ncf_nat_list, func); 798 } 799 800 void 801 _npf_nat_getinfo(nl_nat_t *nt, int *type, u_int *flags, npf_addr_t *addr, 802 size_t *alen, in_port_t *port) 803 { 804 prop_dictionary_t rldict = nt->nrl_dict; 805 806 prop_dictionary_get_int32(rldict, "type", type); 807 prop_dictionary_get_uint32(rldict, "flags", flags); 808 809 prop_object_t obj = prop_dictionary_get(rldict, "translation-ip"); 810 *alen = prop_data_size(obj); 811 memcpy(addr, prop_data_data_nocopy(obj), *alen); 812 813 prop_dictionary_get_uint16(rldict, "translation-port", port); 814 } 815 816 /* 817 * TABLE INTERFACE. 818 */ 819 820 nl_table_t * 821 npf_table_create(u_int id, int type) 822 { 823 prop_dictionary_t tldict; 824 prop_array_t tblents; 825 nl_table_t *tl; 826 827 tl = malloc(sizeof(*tl)); 828 if (tl == NULL) { 829 return NULL; 830 } 831 tldict = prop_dictionary_create(); 832 if (tldict == NULL) { 833 free(tl); 834 return NULL; 835 } 836 prop_dictionary_set_uint32(tldict, "id", id); 837 prop_dictionary_set_int32(tldict, "type", type); 838 839 tblents = prop_array_create(); 840 if (tblents == NULL) { 841 prop_object_release(tldict); 842 free(tl); 843 return NULL; 844 } 845 prop_dictionary_set(tldict, "entries", tblents); 846 prop_object_release(tblents); 847 848 tl->ntl_dict = tldict; 849 return tl; 850 } 851 852 int 853 npf_table_add_entry(nl_table_t *tl, int af, const npf_addr_t *addr, 854 const npf_netmask_t mask) 855 { 856 prop_dictionary_t tldict = tl->ntl_dict, entdict; 857 prop_array_t tblents; 858 prop_data_t addrdata; 859 unsigned alen; 860 861 /* Create the table entry. */ 862 entdict = prop_dictionary_create(); 863 if (entdict == NULL) { 864 return ENOMEM; 865 } 866 867 switch (af) { 868 case AF_INET: 869 alen = sizeof(struct in_addr); 870 break; 871 case AF_INET6: 872 alen = sizeof(struct in6_addr); 873 break; 874 default: 875 return EINVAL; 876 } 877 878 addrdata = prop_data_create_data(addr, alen); 879 prop_dictionary_set(entdict, "addr", addrdata); 880 prop_dictionary_set_uint8(entdict, "mask", mask); 881 prop_object_release(addrdata); 882 883 tblents = prop_dictionary_get(tldict, "entries"); 884 prop_array_add(tblents, entdict); 885 prop_object_release(entdict); 886 return 0; 887 } 888 889 bool 890 npf_table_exists_p(nl_config_t *ncf, u_int tid) 891 { 892 prop_dictionary_t tldict; 893 prop_object_iterator_t it; 894 895 it = prop_array_iterator(ncf->ncf_table_list); 896 while ((tldict = prop_object_iterator_next(it)) != NULL) { 897 u_int i; 898 if (prop_dictionary_get_uint32(tldict, "id", &i) && tid == i) 899 break; 900 } 901 prop_object_iterator_release(it); 902 return tldict ? true : false; 903 } 904 905 int 906 npf_table_insert(nl_config_t *ncf, nl_table_t *tl) 907 { 908 prop_dictionary_t tldict = tl->ntl_dict; 909 u_int tid; 910 911 if (!prop_dictionary_get_uint32(tldict, "id", &tid)) { 912 return EINVAL; 913 } 914 if (npf_table_exists_p(ncf, tid)) { 915 return EEXIST; 916 } 917 prop_array_add(ncf->ncf_table_list, tldict); 918 return 0; 919 } 920 921 void 922 npf_table_destroy(nl_table_t *tl) 923 { 924 925 prop_object_release(tl->ntl_dict); 926 free(tl); 927 } 928 929 void 930 _npf_table_foreach(nl_config_t *ncf, nl_table_callback_t func) 931 { 932 prop_dictionary_t tldict; 933 prop_object_iterator_t it; 934 935 it = prop_array_iterator(ncf->ncf_table_list); 936 while ((tldict = prop_object_iterator_next(it)) != NULL) { 937 u_int id; 938 int type; 939 940 prop_dictionary_get_uint32(tldict, "id", &id); 941 prop_dictionary_get_int32(tldict, "type", &type); 942 (*func)(id, type); 943 } 944 prop_object_iterator_release(it); 945 } 946 947 /* 948 * ALG INTERFACE. 949 */ 950 951 int 952 _npf_alg_load(nl_config_t *ncf, const char *name) 953 { 954 prop_dictionary_t al_dict; 955 956 if (_npf_prop_array_lookup(ncf->ncf_alg_list, "name", name)) 957 return EEXIST; 958 959 al_dict = prop_dictionary_create(); 960 prop_dictionary_set_cstring(al_dict, "name", name); 961 prop_array_add(ncf->ncf_alg_list, al_dict); 962 prop_object_release(al_dict); 963 return 0; 964 } 965 966 int 967 _npf_alg_unload(nl_config_t *ncf, const char *name) 968 { 969 970 if (!_npf_prop_array_lookup(ncf->ncf_alg_list, "name", name)) 971 return ENOENT; 972 973 // Not yet: prop_array_add(ncf->ncf_alg_list, al_dict); 974 return ENOTSUP; 975 } 976 977 /* 978 * MISC. 979 */ 980 981 int 982 npf_sessions_recv(int fd, const char *fpath) 983 { 984 prop_dictionary_t sdict; 985 int error; 986 987 error = prop_dictionary_recv_ioctl(fd, IOC_NPF_SESSIONS_SAVE, &sdict); 988 if (error) { 989 return error; 990 } 991 if (!prop_dictionary_externalize_to_file(sdict, fpath)) { 992 error = errno; 993 } 994 prop_object_release(sdict); 995 return error; 996 } 997 998 int 999 npf_sessions_send(int fd, const char *fpath) 1000 { 1001 prop_dictionary_t sdict; 1002 int error; 1003 1004 if (fpath) { 1005 sdict = prop_dictionary_internalize_from_file(fpath); 1006 if (sdict == NULL) { 1007 return errno; 1008 } 1009 } else { 1010 /* Empty: will flush the sessions. */ 1011 prop_array_t selist = prop_array_create(); 1012 sdict = prop_dictionary_create(); 1013 prop_dictionary_set(sdict, "session-list", selist); 1014 prop_object_release(selist); 1015 } 1016 error = prop_dictionary_send_ioctl(sdict, fd, IOC_NPF_SESSIONS_LOAD); 1017 prop_object_release(sdict); 1018 return error; 1019 } 1020 1021 static prop_dictionary_t 1022 _npf_debug_initonce(nl_config_t *ncf) 1023 { 1024 if (!ncf->ncf_debug) { 1025 prop_array_t iflist = prop_array_create(); 1026 ncf->ncf_debug = prop_dictionary_create(); 1027 prop_dictionary_set(ncf->ncf_debug, "interfaces", iflist); 1028 prop_object_release(iflist); 1029 } 1030 return ncf->ncf_debug; 1031 } 1032 1033 void 1034 _npf_debug_addif(nl_config_t *ncf, struct ifaddrs *ifa, u_int if_idx) 1035 { 1036 prop_dictionary_t ifdict, dbg = _npf_debug_initonce(ncf); 1037 prop_array_t iflist = prop_dictionary_get(dbg, "interfaces"); 1038 1039 if (_npf_prop_array_lookup(iflist, "name", ifa->ifa_name)) { 1040 return; 1041 } 1042 1043 ifdict = prop_dictionary_create(); 1044 prop_dictionary_set_cstring(ifdict, "name", ifa->ifa_name); 1045 prop_dictionary_set_uint32(ifdict, "flags", ifa->ifa_flags); 1046 if (!if_idx) { 1047 if_idx = if_nametoindex(ifa->ifa_name); 1048 } 1049 prop_dictionary_set_uint32(ifdict, "idx", if_idx); 1050 1051 const struct sockaddr *sa = ifa->ifa_addr; 1052 npf_addr_t addr; 1053 size_t alen = 0; 1054 1055 switch (sa ? sa->sa_family : -1) { 1056 case AF_INET: { 1057 const struct sockaddr_in *sin = (const void *)sa; 1058 alen = sizeof(sin->sin_addr); 1059 memcpy(&addr, &sin->sin_addr, alen); 1060 break; 1061 } 1062 case AF_INET6: { 1063 const struct sockaddr_in6 *sin6 = (const void *)sa; 1064 alen = sizeof(sin6->sin6_addr); 1065 memcpy(&addr, &sin6->sin6_addr, alen); 1066 break; 1067 } 1068 default: 1069 break; 1070 } 1071 1072 if (alen) { 1073 prop_data_t addrdata = prop_data_create_data(&addr, alen); 1074 prop_dictionary_set(ifdict, "addr", addrdata); 1075 prop_object_release(addrdata); 1076 } 1077 prop_array_add(iflist, ifdict); 1078 prop_object_release(ifdict); 1079 } 1080