summaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
authorrmind <rmind@NetBSD.org>2013-02-10 23:47:37 +0000
committerrmind <rmind@NetBSD.org>2013-02-10 23:47:37 +0000
commit5bcb50ecfcd8a161e9f97b4d74f5a3f463eb2634 (patch)
tree71aa491cff42dbab56273d300062670de427cfb4 /lib
parent0d13052850c707bfcb5eaaaa32eba01d2897c253 (diff)
- Fix NPF config reload with dynamic rules present.
- Implement list and flush commands on a dynamic ruleset.
Diffstat (limited to 'lib')
-rw-r--r--lib/libnpf/npf.c44
-rw-r--r--lib/libnpf/npf.h4
2 files changed, 45 insertions, 3 deletions
diff --git a/lib/libnpf/npf.c b/lib/libnpf/npf.c
index 2f50dde142c..551d93305a6 100644
--- a/lib/libnpf/npf.c
+++ b/lib/libnpf/npf.c
@@ -1,4 +1,4 @@
-/* $NetBSD: npf.c,v 1.16 2013/02/09 03:35:33 rmind Exp $ */
+/* $NetBSD: npf.c,v 1.17 2013/02/10 23:47:37 rmind Exp $ */
/*-
* Copyright (c) 2010-2013 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.16 2013/02/09 03:35:33 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.17 2013/02/10 23:47:37 rmind Exp $");
#include <sys/types.h>
#include <netinet/in_systm.h>
@@ -320,6 +320,20 @@ npf_ruleset_remkey(int fd, const char *rname, const void *key, size_t len)
return prop_dictionary_send_ioctl(rldict, fd, IOC_NPF_RULE);
}
+int
+npf_ruleset_flush(int fd, const char *rname)
+{
+ prop_dictionary_t rldict;
+
+ rldict = prop_dictionary_create();
+ if (rldict == NULL) {
+ return ENOMEM;
+ }
+ prop_dictionary_set_cstring(rldict, "ruleset-name", rname);
+ prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_FLUSH);
+ return prop_dictionary_send_ioctl(rldict, fd, IOC_NPF_RULE);
+}
+
/*
* _npf_ruleset_transform: transform the ruleset representing nested
* rules with lists into an array.
@@ -569,6 +583,32 @@ _npf_rule_foreach(nl_config_t *ncf, nl_rule_callback_t func)
return _npf_rule_foreach1(ncf->ncf_rules_list, func);
}
+int
+_npf_ruleset_list(int fd, const char *rname, nl_config_t *ncf)
+{
+ prop_dictionary_t rldict, ret;
+ int error;
+
+ rldict = prop_dictionary_create();
+ if (rldict == NULL) {
+ return ENOMEM;
+ }
+ prop_dictionary_set_cstring(rldict, "ruleset-name", rname);
+ prop_dictionary_set_uint32(rldict, "command", NPF_CMD_RULE_LIST);
+ error = prop_dictionary_sendrecv_ioctl(rldict, fd, IOC_NPF_RULE, &ret);
+ if (!error) {
+ prop_array_t rules;
+
+ rules = prop_dictionary_get(ret, "rules");
+ if (rules == NULL) {
+ return EINVAL;
+ }
+ prop_object_release(ncf->ncf_rules_list);
+ ncf->ncf_rules_list = rules;
+ }
+ return error;
+}
+
pri_t
_npf_rule_getinfo(nl_rule_t *nrl, const char **rname, uint32_t *attr,
u_int *if_idx)
diff --git a/lib/libnpf/npf.h b/lib/libnpf/npf.h
index 36f74b8637b..238f0dff23f 100644
--- a/lib/libnpf/npf.h
+++ b/lib/libnpf/npf.h
@@ -1,4 +1,4 @@
-/* $NetBSD: npf.h,v 1.13 2013/02/09 03:35:33 rmind Exp $ */
+/* $NetBSD: npf.h,v 1.14 2013/02/10 23:47:38 rmind Exp $ */
/*-
* Copyright (c) 2011-2013 The NetBSD Foundation, Inc.
@@ -82,6 +82,7 @@ int npf_config_flush(int);
int npf_ruleset_add(int, const char *, nl_rule_t *, uintptr_t *);
int npf_ruleset_remove(int, const char *, uintptr_t);
int npf_ruleset_remkey(int, const char *, const void *, size_t);
+int npf_ruleset_flush(int, const char *);
nl_ext_t * npf_ext_construct(const char *name);
void npf_ext_param_u32(nl_ext_t *, const char *, uint32_t);
@@ -121,6 +122,7 @@ int npf_sessions_recv(int, const char *);
void _npf_config_error(nl_config_t *, nl_error_t *);
void _npf_config_setsubmit(nl_config_t *, const char *);
+int _npf_ruleset_list(int, const char *, nl_config_t *);
int _npf_rule_foreach(nl_config_t *, nl_rule_callback_t);
pri_t _npf_rule_getinfo(nl_rule_t *, const char **, uint32_t *,
u_int *);