1 /* $NetBSD: npf.c,v 1.35 2015/02/02 00:55:28 rmind Exp $ */ 2 3 /*- 4 * Copyright (c) 2010-2015 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 __KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.35 2015/02/02 00:55:28 rmind Exp $"); 34 35 #include <sys/types.h> 36 #include <netinet/in_systm.h> 37 #include <netinet/in.h> 38 #include <net/if.h> 39 #include <prop/proplib.h> 40 41 #include <stdlib.h> 42 #include <string.h> 43 #include <assert.h> 44 #include <errno.h> 45 #include <err.h> 46 47 #define _NPF_PRIVATE 48 #include "npf.h" 49 50 struct nl_rule { 51 prop_dictionary_t nrl_dict; 52 }; 53 54 struct nl_rproc { 55 prop_dictionary_t nrp_dict; 56 }; 57 58 struct nl_table { 59 prop_dictionary_t ntl_dict; 60 }; 61 62 struct nl_alg { 63 prop_dictionary_t nal_dict; 64 }; 65 66 struct nl_ext { 67 const char * nxt_name; 68 prop_dictionary_t nxt_dict; 69 }; 70 71 struct nl_config { 72 /* Rules, translations, procedures, tables, connections. */ 73 prop_dictionary_t ncf_dict; 74 prop_array_t ncf_alg_list; 75 prop_array_t ncf_rules_list; 76 prop_array_t ncf_rproc_list; 77 prop_array_t ncf_table_list; 78 prop_array_t ncf_nat_list; 79 prop_array_t ncf_conn_list; 80 81 /* Iterators. */ 82 prop_object_iterator_t ncf_rule_iter; 83 unsigned ncf_reduce[16]; 84 unsigned ncf_nlevel; 85 unsigned ncf_counter; 86 nl_rule_t ncf_cur_rule; 87 88 prop_object_iterator_t ncf_table_iter; 89 nl_table_t ncf_cur_table; 90 91 prop_object_iterator_t ncf_rproc_iter; 92 nl_rproc_t ncf_cur_rproc; 93 94 /* Error report and debug information. */ 95 prop_dictionary_t ncf_err; 96 prop_dictionary_t ncf_debug; 97 98 /* Custom file to externalise property-list. */ 99 const char * ncf_plist; 100 bool ncf_flush; 101 }; 102 103 static prop_array_t _npf_ruleset_transform(prop_array_t); 104 105 /* 106 * CONFIGURATION INTERFACE. 107 */ 108 109 nl_config_t * 110 npf_config_create(void) 111 { 112 nl_config_t *ncf; 113 114 ncf = calloc(1, sizeof(*ncf)); 115 if (ncf == NULL) { 116 return NULL; 117 } 118 ncf->ncf_alg_list = prop_array_create(); 119 ncf->ncf_rules_list = prop_array_create(); 120 ncf->ncf_rproc_list = prop_array_create(); 121 ncf->ncf_table_list = prop_array_create(); 122 ncf->ncf_nat_list = prop_array_create(); 123 124 ncf->ncf_plist = NULL; 125 ncf->ncf_flush = false; 126 127 return ncf; 128 } 129 130 int 131 npf_config_submit(nl_config_t *ncf, int fd) 132 { 133 const char *plist = ncf->ncf_plist; 134 prop_dictionary_t npf_dict; 135 prop_array_t rlset; 136 int error = 0; 137 138 npf_dict = prop_dictionary_create(); 139 if (npf_dict == NULL) { 140 return ENOMEM; 141 } 142 prop_dictionary_set_uint32(npf_dict, "version", NPF_VERSION); 143 144 rlset = _npf_ruleset_transform(ncf->ncf_rules_list); 145 if (rlset == NULL) { 146 prop_object_release(npf_dict); 147 return ENOMEM; 148 } 149 prop_object_release(ncf->ncf_rules_list); 150 ncf->ncf_rules_list = rlset; 151 152 prop_dictionary_set(npf_dict, "rules", ncf->ncf_rules_list); 153 prop_dictionary_set(npf_dict, "algs", ncf->ncf_alg_list); 154 prop_dictionary_set(npf_dict, "rprocs", ncf->ncf_rproc_list); 155 prop_dictionary_set(npf_dict, "tables", ncf->ncf_table_list); 156 prop_dictionary_set(npf_dict, "nat", ncf->ncf_nat_list); 157 if (ncf->ncf_conn_list) { 158 prop_dictionary_set(npf_dict, "conn-list", 159 ncf->ncf_conn_list); 160 } 161 prop_dictionary_set_bool(npf_dict, "flush", ncf->ncf_flush); 162 if (ncf->ncf_debug) { 163 prop_dictionary_set(npf_dict, "debug", ncf->ncf_debug); 164 } 165 166 if (plist) { 167 if (!prop_dictionary_externalize_to_file(npf_dict, plist)) { 168 error = errno; 169 } 170 prop_object_release(npf_dict); 171 return error; 172 } 173 if (fd) { 174 error = prop_dictionary_sendrecv_ioctl(npf_dict, fd, 175 IOC_NPF_LOAD, &ncf->ncf_err); 176 if (error) { 177 prop_object_release(npf_dict); 178 assert(ncf->ncf_err == NULL); 179 return error; 180 } 181 prop_dictionary_get_int32(ncf->ncf_err, "errno", &error); 182 } 183 prop_object_release(npf_dict); 184 return error; 185 } 186 187 static nl_config_t * 188 _npf_config_consdict(prop_dictionary_t npf_dict) 189 { 190 nl_config_t *ncf; 191 192 ncf = calloc(1, sizeof(*ncf)); 193 if (ncf == NULL) { 194 return NULL; 195 } 196 ncf->ncf_dict = npf_dict; 197 ncf->ncf_alg_list = prop_dictionary_get(npf_dict, "algs"); 198 ncf->ncf_rules_list = prop_dictionary_get(npf_dict, "rules"); 199 ncf->ncf_rproc_list = prop_dictionary_get(npf_dict, "rprocs"); 200 ncf->ncf_table_list = prop_dictionary_get(npf_dict, "tables"); 201 ncf->ncf_nat_list = prop_dictionary_get(npf_dict, "nat"); 202 ncf->ncf_conn_list = prop_dictionary_get(npf_dict, "conn-list"); 203 return ncf; 204 } 205 206 nl_config_t * 207 npf_config_retrieve(int fd, bool *active, bool *loaded) 208 { 209 prop_dictionary_t npf_dict; 210 nl_config_t *ncf; 211 int error; 212 213 error = prop_dictionary_recv_ioctl(fd, IOC_NPF_SAVE, &npf_dict); 214 if (error) { 215 return NULL; 216 } 217 ncf = _npf_config_consdict(npf_dict); 218 if (ncf == NULL) { 219 prop_object_release(npf_dict); 220 return NULL; 221 } 222 prop_dictionary_get_bool(npf_dict, "active", active); 223 *loaded = (ncf->ncf_rules_list != NULL); 224 return ncf; 225 } 226 227 int 228 npf_config_export(const nl_config_t *ncf, const char *path) 229 { 230 prop_dictionary_t npf_dict = ncf->ncf_dict; 231 int error = 0; 232 233 if (!prop_dictionary_externalize_to_file(npf_dict, path)) { 234 error = errno; 235 } 236 return error; 237 } 238 239 nl_config_t * 240 npf_config_import(const char *path) 241 { 242 prop_dictionary_t npf_dict; 243 nl_config_t *ncf; 244 245 npf_dict = prop_dictionary_internalize_from_file(path); 246 if (!npf_dict) { 247 return NULL; 248 } 249 ncf = _npf_config_consdict(npf_dict); 250 if (!ncf) { 251 prop_object_release(npf_dict); 252 return NULL; 253 } 254 return ncf; 255 } 256 257 int 258 npf_config_flush(int fd) 259 { 260 nl_config_t *ncf; 261 int error; 262 263 ncf = npf_config_create(); 264 if (ncf == NULL) { 265 return ENOMEM; 266 } 267 ncf->ncf_flush = true; 268 error = npf_config_submit(ncf, fd); 269 npf_config_destroy(ncf); 270 return error; 271 } 272 273 void 274 _npf_config_error(nl_config_t *ncf, nl_error_t *ne) 275 { 276 memset(ne, 0, sizeof(*ne)); 277 prop_dictionary_get_int32(ncf->ncf_err, "id", &ne->ne_id); 278 prop_dictionary_get_cstring(ncf->ncf_err, 279 "source-file", &ne->ne_source_file); 280 prop_dictionary_get_uint32(ncf->ncf_err, 281 "source-line", &ne->ne_source_line); 282 prop_dictionary_get_int32(ncf->ncf_err, 283 "code-error", &ne->ne_ncode_error); 284 prop_dictionary_get_int32(ncf->ncf_err, 285 "code-errat", &ne->ne_ncode_errat); 286 } 287 288 void 289 npf_config_destroy(nl_config_t *ncf) 290 { 291 if (!ncf->ncf_dict) { 292 prop_object_release(ncf->ncf_alg_list); 293 prop_object_release(ncf->ncf_rules_list); 294 prop_object_release(ncf->ncf_rproc_list); 295 prop_object_release(ncf->ncf_table_list); 296 prop_object_release(ncf->ncf_nat_list); 297 } 298 if (ncf->ncf_err) { 299 prop_object_release(ncf->ncf_err); 300 } 301 if (ncf->ncf_debug) { 302 prop_object_release(ncf->ncf_debug); 303 } 304 free(ncf); 305 } 306 307 void 308 _npf_config_setsubmit(nl_config_t *ncf, const char *plist_file) 309 { 310 ncf->ncf_plist = plist_file; 311 } 312 313 static bool 314 _npf_prop_array_lookup(prop_array_t array, const char *key, const char *name) 315 { 316 prop_dictionary_t dict; 317 prop_object_iterator_t it; 318 319 it = prop_array_iterator(array); 320 while ((dict = prop_object_iterator_next(it)) != NULL) { 321 const char *lname; 322 prop_dictionary_get_cstring_nocopy(dict, key, &lname); 323 if (strcmp(name, lname) == 0) 324 break; 325 } 326 prop_object_iterator_release(it); 327 return dict ? true : false; 328 } 329 330 /* 331 * DYNAMIC RULESET INTERFACE. 332 */ 333 334 int 335 npf_ruleset_add(int fd, const char *rname, nl_rule_t *rl, uint64_t *id) 336 { 337 prop_dictionary_t rldict = rl->nrl_dict; 338 prop_dictionary_t ret; 339 int error; 340 341 prop_dictionary_set_cstring(rldict, "ruleset-name", rname); 342 prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_ADD); 343 error = prop_dictionary_sendrecv_ioctl(rldict, fd, IOC_NPF_RULE, &ret); 344 if (!error) { 345 prop_dictionary_get_uint64(ret, "id", id); 346 } 347 return error; 348 } 349 350 int 351 npf_ruleset_remove(int fd, const char *rname, uint64_t id) 352 { 353 prop_dictionary_t rldict; 354 355 rldict = prop_dictionary_create(); 356 if (rldict == NULL) { 357 return ENOMEM; 358 } 359 prop_dictionary_set_cstring(rldict, "ruleset-name", rname); 360 prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_REMOVE); 361 prop_dictionary_set_uint64(rldict, "id", id); 362 return prop_dictionary_send_ioctl(rldict, fd, IOC_NPF_RULE); 363 } 364 365 int 366 npf_ruleset_remkey(int fd, const char *rname, const void *key, size_t len) 367 { 368 prop_dictionary_t rldict; 369 prop_data_t keyobj; 370 371 rldict = prop_dictionary_create(); 372 if (rldict == NULL) { 373 return ENOMEM; 374 } 375 prop_dictionary_set_cstring(rldict, "ruleset-name", rname); 376 prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_REMKEY); 377 378 keyobj = prop_data_create_data(key, len); 379 if (keyobj == NULL) { 380 prop_object_release(rldict); 381 return ENOMEM; 382 } 383 prop_dictionary_set(rldict, "key", keyobj); 384 prop_object_release(keyobj); 385 386 return prop_dictionary_send_ioctl(rldict, fd, IOC_NPF_RULE); 387 } 388 389 int 390 npf_ruleset_flush(int fd, const char *rname) 391 { 392 prop_dictionary_t rldict; 393 394 rldict = prop_dictionary_create(); 395 if (rldict == NULL) { 396 return ENOMEM; 397 } 398 prop_dictionary_set_cstring(rldict, "ruleset-name", rname); 399 prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_FLUSH); 400 return prop_dictionary_send_ioctl(rldict, fd, IOC_NPF_RULE); 401 } 402 403 /* 404 * _npf_ruleset_transform: transform the ruleset representing nested 405 * rules with lists into an array. 406 */ 407 408 static void 409 _npf_ruleset_transform1(prop_array_t rlset, prop_array_t rules) 410 { 411 prop_object_iterator_t it; 412 prop_dictionary_t rldict; 413 prop_array_t subrlset; 414 415 it = prop_array_iterator(rules); 416 while ((rldict = prop_object_iterator_next(it)) != NULL) { 417 unsigned idx; 418 419 /* Add rules to the array (reference is retained). */ 420 prop_array_add(rlset, rldict); 421 422 subrlset = prop_dictionary_get(rldict, "subrules"); 423 if (subrlset) { 424 /* Process subrules recursively. */ 425 _npf_ruleset_transform1(rlset, subrlset); 426 /* Add the skip-to position. */ 427 idx = prop_array_count(rlset); 428 prop_dictionary_set_uint32(rldict, "skip-to", idx); 429 prop_dictionary_remove(rldict, "subrules"); 430 } 431 } 432 prop_object_iterator_release(it); 433 } 434 435 static prop_array_t 436 _npf_ruleset_transform(prop_array_t rlset) 437 { 438 prop_array_t nrlset; 439 440 nrlset = prop_array_create(); 441 _npf_ruleset_transform1(nrlset, rlset); 442 return nrlset; 443 } 444 445 /* 446 * NPF EXTENSION INTERFACE. 447 */ 448 449 nl_ext_t * 450 npf_ext_construct(const char *name) 451 { 452 nl_ext_t *ext; 453 454 ext = malloc(sizeof(*ext)); 455 if (ext == NULL) { 456 return NULL; 457 } 458 ext->nxt_name = strdup(name); 459 if (ext->nxt_name == NULL) { 460 free(ext); 461 return NULL; 462 } 463 ext->nxt_dict = prop_dictionary_create(); 464 465 return ext; 466 } 467 468 void 469 npf_ext_param_u32(nl_ext_t *ext, const char *key, uint32_t val) 470 { 471 prop_dictionary_t extdict = ext->nxt_dict; 472 prop_dictionary_set_uint32(extdict, key, val); 473 } 474 475 void 476 npf_ext_param_bool(nl_ext_t *ext, const char *key, bool val) 477 { 478 prop_dictionary_t extdict = ext->nxt_dict; 479 prop_dictionary_set_bool(extdict, key, val); 480 } 481 482 void 483 npf_ext_param_string(nl_ext_t *ext, const char *key, const char *val) 484 { 485 prop_dictionary_t extdict = ext->nxt_dict; 486 prop_dictionary_set_cstring(extdict, key, val); 487 } 488 489 /* 490 * RULE INTERFACE. 491 */ 492 493 nl_rule_t * 494 npf_rule_create(const char *name, uint32_t attr, const char *ifname) 495 { 496 prop_dictionary_t rldict; 497 nl_rule_t *rl; 498 499 rl = malloc(sizeof(*rl)); 500 if (rl == NULL) { 501 return NULL; 502 } 503 rldict = prop_dictionary_create(); 504 if (rldict == NULL) { 505 free(rl); 506 return NULL; 507 } 508 if (name) { 509 prop_dictionary_set_cstring(rldict, "name", name); 510 } 511 prop_dictionary_set_uint32(rldict, "attr", attr); 512 513 if (ifname) { 514 prop_dictionary_set_cstring(rldict, "ifname", ifname); 515 } 516 rl->nrl_dict = rldict; 517 return rl; 518 } 519 520 int 521 npf_rule_setcode(nl_rule_t *rl, int type, const void *code, size_t len) 522 { 523 prop_dictionary_t rldict = rl->nrl_dict; 524 prop_data_t cdata; 525 526 switch (type) { 527 case NPF_CODE_NC: 528 case NPF_CODE_BPF: 529 break; 530 default: 531 return ENOTSUP; 532 } 533 prop_dictionary_set_uint32(rldict, "code-type", type); 534 if ((cdata = prop_data_create_data(code, len)) == NULL) { 535 return ENOMEM; 536 } 537 prop_dictionary_set(rldict, "code", cdata); 538 prop_object_release(cdata); 539 return 0; 540 } 541 542 int 543 npf_rule_setkey(nl_rule_t *rl, const void *key, size_t len) 544 { 545 prop_dictionary_t rldict = rl->nrl_dict; 546 prop_data_t kdata; 547 548 if ((kdata = prop_data_create_data(key, len)) == NULL) { 549 return ENOMEM; 550 } 551 prop_dictionary_set(rldict, "key", kdata); 552 prop_object_release(kdata); 553 return 0; 554 } 555 556 int 557 npf_rule_setinfo(nl_rule_t *rl, const void *info, size_t len) 558 { 559 prop_dictionary_t rldict = rl->nrl_dict; 560 prop_data_t idata; 561 562 if ((idata = prop_data_create_data(info, len)) == NULL) { 563 return ENOMEM; 564 } 565 prop_dictionary_set(rldict, "info", idata); 566 prop_object_release(idata); 567 return 0; 568 } 569 570 int 571 npf_rule_setprio(nl_rule_t *rl, pri_t pri) 572 { 573 prop_dictionary_t rldict = rl->nrl_dict; 574 575 prop_dictionary_set_int32(rldict, "prio", pri); 576 return 0; 577 } 578 579 int 580 npf_rule_setproc(nl_rule_t *rl, const char *name) 581 { 582 prop_dictionary_t rldict = rl->nrl_dict; 583 584 prop_dictionary_set_cstring(rldict, "rproc", name); 585 return 0; 586 } 587 588 void * 589 npf_rule_export(nl_rule_t *rl, size_t *length) 590 { 591 prop_dictionary_t rldict = rl->nrl_dict; 592 void *xml; 593 594 if ((xml = prop_dictionary_externalize(rldict)) == NULL) { 595 return NULL; 596 } 597 *length = strlen(xml); 598 return xml; 599 } 600 601 bool 602 npf_rule_exists_p(nl_config_t *ncf, const char *name) 603 { 604 return _npf_prop_array_lookup(ncf->ncf_rules_list, "name", name); 605 } 606 607 int 608 npf_rule_insert(nl_config_t *ncf, nl_rule_t *parent, nl_rule_t *rl) 609 { 610 prop_dictionary_t rldict = rl->nrl_dict; 611 prop_array_t rlset; 612 613 if (parent) { 614 prop_dictionary_t pdict = parent->nrl_dict; 615 rlset = prop_dictionary_get(pdict, "subrules"); 616 if (rlset == NULL) { 617 rlset = prop_array_create(); 618 prop_dictionary_set(pdict, "subrules", rlset); 619 prop_object_release(rlset); 620 } 621 } else { 622 rlset = ncf->ncf_rules_list; 623 } 624 prop_array_add(rlset, rldict); 625 return 0; 626 } 627 628 static nl_rule_t * 629 _npf_rule_iterate1(nl_config_t *ncf, prop_array_t rlist, unsigned *level) 630 { 631 prop_dictionary_t rldict; 632 uint32_t skipto = 0; 633 634 if (!ncf->ncf_rule_iter) { 635 /* Initialise the iterator. */ 636 ncf->ncf_rule_iter = prop_array_iterator(rlist); 637 ncf->ncf_nlevel = 0; 638 ncf->ncf_reduce[0] = 0; 639 ncf->ncf_counter = 0; 640 } 641 642 rldict = prop_object_iterator_next(ncf->ncf_rule_iter); 643 if ((ncf->ncf_cur_rule.nrl_dict = rldict) == NULL) { 644 prop_object_iterator_release(ncf->ncf_rule_iter); 645 ncf->ncf_rule_iter = NULL; 646 return NULL; 647 } 648 *level = ncf->ncf_nlevel; 649 650 prop_dictionary_get_uint32(rldict, "skip-to", &skipto); 651 if (skipto) { 652 ncf->ncf_nlevel++; 653 ncf->ncf_reduce[ncf->ncf_nlevel] = skipto; 654 } 655 if (ncf->ncf_reduce[ncf->ncf_nlevel] == ++ncf->ncf_counter) { 656 assert(ncf->ncf_nlevel > 0); 657 ncf->ncf_nlevel--; 658 } 659 return &ncf->ncf_cur_rule; 660 } 661 662 nl_rule_t * 663 npf_rule_iterate(nl_config_t *ncf, unsigned *level) 664 { 665 return _npf_rule_iterate1(ncf, ncf->ncf_rules_list, level); 666 } 667 668 const char * 669 npf_rule_getname(nl_rule_t *rl) 670 { 671 prop_dictionary_t rldict = rl->nrl_dict; 672 const char *rname = NULL; 673 674 prop_dictionary_get_cstring_nocopy(rldict, "name", &rname); 675 return rname; 676 } 677 678 uint32_t 679 npf_rule_getattr(nl_rule_t *rl) 680 { 681 prop_dictionary_t rldict = rl->nrl_dict; 682 uint32_t attr = 0; 683 684 prop_dictionary_get_uint32(rldict, "attr", &attr); 685 return attr; 686 } 687 688 const char * 689 npf_rule_getinterface(nl_rule_t *rl) 690 { 691 prop_dictionary_t rldict = rl->nrl_dict; 692 const char *ifname = NULL; 693 694 prop_dictionary_get_cstring_nocopy(rldict, "ifname", &ifname); 695 return ifname; 696 } 697 698 const void * 699 npf_rule_getinfo(nl_rule_t *rl, size_t *len) 700 { 701 prop_dictionary_t rldict = rl->nrl_dict; 702 prop_object_t obj = prop_dictionary_get(rldict, "info"); 703 704 *len = prop_data_size(obj); 705 return prop_data_data_nocopy(obj); 706 } 707 708 const char * 709 npf_rule_getproc(nl_rule_t *rl) 710 { 711 prop_dictionary_t rldict = rl->nrl_dict; 712 const char *rpname = NULL; 713 714 prop_dictionary_get_cstring_nocopy(rldict, "rproc", &rpname); 715 return rpname; 716 } 717 718 uint64_t 719 npf_rule_getid(nl_rule_t *rl) 720 { 721 prop_dictionary_t rldict = rl->nrl_dict; 722 uint64_t id = 0; 723 724 (void)prop_dictionary_get_uint64(rldict, "id", &id); 725 return id; 726 } 727 728 const void * 729 npf_rule_getcode(nl_rule_t *rl, int *type, size_t *len) 730 { 731 prop_dictionary_t rldict = rl->nrl_dict; 732 prop_object_t obj = prop_dictionary_get(rldict, "code"); 733 734 prop_dictionary_get_uint32(rldict, "code-type", (uint32_t *)type); 735 *len = prop_data_size(obj); 736 return prop_data_data_nocopy(obj); 737 } 738 739 int 740 _npf_ruleset_list(int fd, const char *rname, nl_config_t *ncf) 741 { 742 prop_dictionary_t rldict, ret; 743 int error; 744 745 rldict = prop_dictionary_create(); 746 if (rldict == NULL) { 747 return ENOMEM; 748 } 749 prop_dictionary_set_cstring(rldict, "ruleset-name", rname); 750 prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_LIST); 751 error = prop_dictionary_sendrecv_ioctl(rldict, fd, IOC_NPF_RULE, &ret); 752 if (!error) { 753 prop_array_t rules; 754 755 rules = prop_dictionary_get(ret, "rules"); 756 if (rules == NULL) { 757 return EINVAL; 758 } 759 prop_object_release(ncf->ncf_rules_list); 760 ncf->ncf_rules_list = rules; 761 } 762 return error; 763 } 764 765 void 766 npf_rule_destroy(nl_rule_t *rl) 767 { 768 769 prop_object_release(rl->nrl_dict); 770 free(rl); 771 } 772 773 /* 774 * RULE PROCEDURE INTERFACE. 775 */ 776 777 nl_rproc_t * 778 npf_rproc_create(const char *name) 779 { 780 prop_dictionary_t rpdict; 781 prop_array_t extcalls; 782 nl_rproc_t *nrp; 783 784 nrp = malloc(sizeof(nl_rproc_t)); 785 if (nrp == NULL) { 786 return NULL; 787 } 788 rpdict = prop_dictionary_create(); 789 if (rpdict == NULL) { 790 free(nrp); 791 return NULL; 792 } 793 prop_dictionary_set_cstring(rpdict, "name", name); 794 795 extcalls = prop_array_create(); 796 if (extcalls == NULL) { 797 prop_object_release(rpdict); 798 free(nrp); 799 return NULL; 800 } 801 prop_dictionary_set(rpdict, "extcalls", extcalls); 802 prop_object_release(extcalls); 803 804 nrp->nrp_dict = rpdict; 805 return nrp; 806 } 807 808 int 809 npf_rproc_extcall(nl_rproc_t *rp, nl_ext_t *ext) 810 { 811 prop_dictionary_t rpdict = rp->nrp_dict; 812 prop_dictionary_t extdict = ext->nxt_dict; 813 prop_array_t extcalls; 814 815 extcalls = prop_dictionary_get(rpdict, "extcalls"); 816 if (_npf_prop_array_lookup(extcalls, "name", ext->nxt_name)) { 817 return EEXIST; 818 } 819 prop_dictionary_set_cstring(extdict, "name", ext->nxt_name); 820 prop_array_add(extcalls, extdict); 821 return 0; 822 } 823 824 bool 825 npf_rproc_exists_p(nl_config_t *ncf, const char *name) 826 { 827 return _npf_prop_array_lookup(ncf->ncf_rproc_list, "name", name); 828 } 829 830 int 831 npf_rproc_insert(nl_config_t *ncf, nl_rproc_t *rp) 832 { 833 prop_dictionary_t rpdict = rp->nrp_dict; 834 const char *name; 835 836 if (!prop_dictionary_get_cstring_nocopy(rpdict, "name", &name)) { 837 return EINVAL; 838 } 839 if (npf_rproc_exists_p(ncf, name)) { 840 return EEXIST; 841 } 842 prop_array_add(ncf->ncf_rproc_list, rpdict); 843 return 0; 844 } 845 846 nl_rproc_t * 847 npf_rproc_iterate(nl_config_t *ncf) 848 { 849 prop_dictionary_t rpdict; 850 851 if (!ncf->ncf_rproc_iter) { 852 /* Initialise the iterator. */ 853 ncf->ncf_rproc_iter = prop_array_iterator(ncf->ncf_rproc_list); 854 } 855 rpdict = prop_object_iterator_next(ncf->ncf_rproc_iter); 856 if ((ncf->ncf_cur_rproc.nrp_dict = rpdict) == NULL) { 857 prop_object_iterator_release(ncf->ncf_rproc_iter); 858 ncf->ncf_rproc_iter = NULL; 859 return NULL; 860 } 861 return &ncf->ncf_cur_rproc; 862 } 863 864 const char * 865 npf_rproc_getname(nl_rproc_t *rp) 866 { 867 prop_dictionary_t rpdict = rp->nrp_dict; 868 const char *rpname = NULL; 869 870 prop_dictionary_get_cstring_nocopy(rpdict, "name", &rpname); 871 return rpname; 872 } 873 874 /* 875 * NAT INTERFACE. 876 */ 877 878 nl_nat_t * 879 npf_nat_create(int type, u_int flags, const char *ifname, 880 int af, npf_addr_t *addr, npf_netmask_t mask, in_port_t port) 881 { 882 nl_rule_t *rl; 883 prop_dictionary_t rldict; 884 prop_data_t addrdat; 885 uint32_t attr; 886 size_t sz; 887 888 if (af == AF_INET) { 889 sz = sizeof(struct in_addr); 890 } else if (af == AF_INET6) { 891 sz = sizeof(struct in6_addr); 892 } else { 893 return NULL; 894 } 895 896 attr = NPF_RULE_PASS | NPF_RULE_FINAL | 897 (type == NPF_NATOUT ? NPF_RULE_OUT : NPF_RULE_IN); 898 899 /* Create a rule for NAT policy. Next, will add NAT data. */ 900 rl = npf_rule_create(NULL, attr, ifname); 901 if (rl == NULL) { 902 return NULL; 903 } 904 rldict = rl->nrl_dict; 905 906 /* Translation type and flags. */ 907 prop_dictionary_set_int32(rldict, "type", type); 908 prop_dictionary_set_uint32(rldict, "flags", flags); 909 910 /* Translation IP and mask. */ 911 addrdat = prop_data_create_data(addr, sz); 912 if (addrdat == NULL) { 913 npf_rule_destroy(rl); 914 return NULL; 915 } 916 prop_dictionary_set(rldict, "nat-ip", addrdat); 917 prop_dictionary_set_uint32(rldict, "nat-mask", mask); 918 prop_object_release(addrdat); 919 920 /* Translation port (for redirect case). */ 921 prop_dictionary_set_uint16(rldict, "nat-port", port); 922 923 return (nl_nat_t *)rl; 924 } 925 926 int 927 npf_nat_insert(nl_config_t *ncf, nl_nat_t *nt, pri_t pri __unused) 928 { 929 prop_dictionary_t rldict = nt->nrl_dict; 930 931 prop_dictionary_set_int32(rldict, "prio", NPF_PRI_LAST); 932 prop_array_add(ncf->ncf_nat_list, rldict); 933 return 0; 934 } 935 936 nl_nat_t * 937 npf_nat_iterate(nl_config_t *ncf) 938 { 939 u_int level; 940 return _npf_rule_iterate1(ncf, ncf->ncf_nat_list, &level); 941 } 942 943 int 944 npf_nat_setalgo(nl_nat_t *nt, u_int algo) 945 { 946 prop_dictionary_t rldict = nt->nrl_dict; 947 prop_dictionary_set_uint32(rldict, "nat-algo", algo); 948 return 0; 949 } 950 951 int 952 npf_nat_setnpt66(nl_nat_t *nt, uint16_t adj) 953 { 954 prop_dictionary_t rldict = nt->nrl_dict; 955 int error; 956 957 if ((error = npf_nat_setalgo(nt, NPF_ALGO_NPT66)) != 0) { 958 return error; 959 } 960 prop_dictionary_set_uint16(rldict, "npt66-adj", adj); 961 return 0; 962 } 963 964 int 965 npf_nat_gettype(nl_nat_t *nt) 966 { 967 prop_dictionary_t rldict = nt->nrl_dict; 968 int type = 0; 969 970 prop_dictionary_get_int32(rldict, "type", &type); 971 return type; 972 } 973 974 u_int 975 npf_nat_getflags(nl_nat_t *nt) 976 { 977 prop_dictionary_t rldict = nt->nrl_dict; 978 unsigned flags = 0; 979 980 prop_dictionary_get_uint32(rldict, "flags", &flags); 981 return flags; 982 } 983 984 void 985 npf_nat_getmap(nl_nat_t *nt, npf_addr_t *addr, size_t *alen, in_port_t *port) 986 { 987 prop_dictionary_t rldict = nt->nrl_dict; 988 prop_object_t obj = prop_dictionary_get(rldict, "nat-ip"); 989 990 *alen = prop_data_size(obj); 991 memcpy(addr, prop_data_data_nocopy(obj), *alen); 992 993 *port = 0; 994 prop_dictionary_get_uint16(rldict, "nat-port", port); 995 } 996 997 /* 998 * TABLE INTERFACE. 999 */ 1000 1001 nl_table_t * 1002 npf_table_create(const char *name, u_int id, int type) 1003 { 1004 prop_dictionary_t tldict; 1005 prop_array_t tblents; 1006 nl_table_t *tl; 1007 1008 tl = malloc(sizeof(*tl)); 1009 if (tl == NULL) { 1010 return NULL; 1011 } 1012 tldict = prop_dictionary_create(); 1013 if (tldict == NULL) { 1014 free(tl); 1015 return NULL; 1016 } 1017 prop_dictionary_set_cstring(tldict, "name", name); 1018 prop_dictionary_set_uint32(tldict, "id", id); 1019 prop_dictionary_set_int32(tldict, "type", type); 1020 1021 tblents = prop_array_create(); 1022 if (tblents == NULL) { 1023 prop_object_release(tldict); 1024 free(tl); 1025 return NULL; 1026 } 1027 prop_dictionary_set(tldict, "entries", tblents); 1028 prop_object_release(tblents); 1029 1030 tl->ntl_dict = tldict; 1031 return tl; 1032 } 1033 1034 int 1035 npf_table_add_entry(nl_table_t *tl, int af, const npf_addr_t *addr, 1036 const npf_netmask_t mask) 1037 { 1038 prop_dictionary_t tldict = tl->ntl_dict, entdict; 1039 prop_array_t tblents; 1040 prop_data_t addrdata; 1041 unsigned alen; 1042 1043 /* Create the table entry. */ 1044 entdict = prop_dictionary_create(); 1045 if (entdict == NULL) { 1046 return ENOMEM; 1047 } 1048 1049 switch (af) { 1050 case AF_INET: 1051 alen = sizeof(struct in_addr); 1052 break; 1053 case AF_INET6: 1054 alen = sizeof(struct in6_addr); 1055 break; 1056 default: 1057 return EINVAL; 1058 } 1059 1060 addrdata = prop_data_create_data(addr, alen); 1061 prop_dictionary_set(entdict, "addr", addrdata); 1062 prop_dictionary_set_uint8(entdict, "mask", mask); 1063 prop_object_release(addrdata); 1064 1065 tblents = prop_dictionary_get(tldict, "entries"); 1066 prop_array_add(tblents, entdict); 1067 prop_object_release(entdict); 1068 return 0; 1069 } 1070 1071 int 1072 npf_table_setdata(nl_table_t *tl, const void *blob, size_t len) 1073 { 1074 prop_dictionary_t tldict = tl->ntl_dict; 1075 prop_data_t bobj; 1076 1077 if ((bobj = prop_data_create_data(blob, len)) == NULL) { 1078 return ENOMEM; 1079 } 1080 prop_dictionary_set(tldict, "data", bobj); 1081 prop_object_release(bobj); 1082 return 0; 1083 } 1084 1085 static bool 1086 _npf_table_exists_p(nl_config_t *ncf, const char *name) 1087 { 1088 prop_dictionary_t tldict; 1089 prop_object_iterator_t it; 1090 1091 it = prop_array_iterator(ncf->ncf_table_list); 1092 while ((tldict = prop_object_iterator_next(it)) != NULL) { 1093 const char *tname = NULL; 1094 1095 if (prop_dictionary_get_cstring_nocopy(tldict, "name", &tname) 1096 && strcmp(tname, name) == 0) 1097 break; 1098 } 1099 prop_object_iterator_release(it); 1100 return tldict ? true : false; 1101 } 1102 1103 int 1104 npf_table_insert(nl_config_t *ncf, nl_table_t *tl) 1105 { 1106 prop_dictionary_t tldict = tl->ntl_dict; 1107 const char *name = NULL; 1108 1109 if (!prop_dictionary_get_cstring_nocopy(tldict, "name", &name)) { 1110 return EINVAL; 1111 } 1112 if (_npf_table_exists_p(ncf, name)) { 1113 return EEXIST; 1114 } 1115 prop_array_add(ncf->ncf_table_list, tldict); 1116 return 0; 1117 } 1118 1119 nl_table_t * 1120 npf_table_iterate(nl_config_t *ncf) 1121 { 1122 prop_dictionary_t tldict; 1123 1124 if (!ncf->ncf_table_iter) { 1125 /* Initialise the iterator. */ 1126 ncf->ncf_table_iter = prop_array_iterator(ncf->ncf_table_list); 1127 } 1128 tldict = prop_object_iterator_next(ncf->ncf_table_iter); 1129 if ((ncf->ncf_cur_table.ntl_dict = tldict) == NULL) { 1130 prop_object_iterator_release(ncf->ncf_table_iter); 1131 ncf->ncf_table_iter = NULL; 1132 return NULL; 1133 } 1134 return &ncf->ncf_cur_table; 1135 } 1136 1137 unsigned 1138 npf_table_getid(nl_table_t *tl) 1139 { 1140 prop_dictionary_t tldict = tl->ntl_dict; 1141 unsigned id = (unsigned)-1; 1142 1143 prop_dictionary_get_uint32(tldict, "id", &id); 1144 return id; 1145 } 1146 1147 const char * 1148 npf_table_getname(nl_table_t *tl) 1149 { 1150 prop_dictionary_t tldict = tl->ntl_dict; 1151 const char *tname = NULL; 1152 1153 prop_dictionary_get_cstring_nocopy(tldict, "name", &tname); 1154 return tname; 1155 } 1156 1157 int 1158 npf_table_gettype(nl_table_t *tl) 1159 { 1160 prop_dictionary_t tldict = tl->ntl_dict; 1161 int type = 0; 1162 1163 prop_dictionary_get_int32(tldict, "type", &type); 1164 return type; 1165 } 1166 1167 void 1168 npf_table_destroy(nl_table_t *tl) 1169 { 1170 prop_object_release(tl->ntl_dict); 1171 free(tl); 1172 } 1173 1174 /* 1175 * ALG INTERFACE. 1176 */ 1177 1178 int 1179 _npf_alg_load(nl_config_t *ncf, const char *name) 1180 { 1181 prop_dictionary_t al_dict; 1182 1183 if (_npf_prop_array_lookup(ncf->ncf_alg_list, "name", name)) 1184 return EEXIST; 1185 1186 al_dict = prop_dictionary_create(); 1187 prop_dictionary_set_cstring(al_dict, "name", name); 1188 prop_array_add(ncf->ncf_alg_list, al_dict); 1189 prop_object_release(al_dict); 1190 return 0; 1191 } 1192 1193 int 1194 _npf_alg_unload(nl_config_t *ncf, const char *name) 1195 { 1196 if (!_npf_prop_array_lookup(ncf->ncf_alg_list, "name", name)) 1197 return ENOENT; 1198 1199 // Not yet: prop_array_add(ncf->ncf_alg_list, al_dict); 1200 return ENOTSUP; 1201 } 1202 1203 /* 1204 * MISC. 1205 */ 1206 1207 static prop_dictionary_t 1208 _npf_debug_initonce(nl_config_t *ncf) 1209 { 1210 if (!ncf->ncf_debug) { 1211 prop_array_t iflist = prop_array_create(); 1212 ncf->ncf_debug = prop_dictionary_create(); 1213 prop_dictionary_set(ncf->ncf_debug, "interfaces", iflist); 1214 prop_object_release(iflist); 1215 } 1216 return ncf->ncf_debug; 1217 } 1218 1219 void 1220 _npf_debug_addif(nl_config_t *ncf, const char *ifname) 1221 { 1222 prop_dictionary_t ifdict, dbg = _npf_debug_initonce(ncf); 1223 prop_array_t iflist = prop_dictionary_get(dbg, "interfaces"); 1224 u_int if_idx = if_nametoindex(ifname); 1225 1226 if (_npf_prop_array_lookup(iflist, "name", ifname)) { 1227 return; 1228 } 1229 ifdict = prop_dictionary_create(); 1230 prop_dictionary_set_cstring(ifdict, "name", ifname); 1231 prop_dictionary_set_uint32(ifdict, "index", if_idx); 1232 prop_array_add(iflist, ifdict); 1233 prop_object_release(ifdict); 1234 } 1235