diff options
| author | martin <martin@NetBSD.org> | 2019-10-04 08:06:34 +0000 |
|---|---|---|
| committer | martin <martin@NetBSD.org> | 2019-10-04 08:06:34 +0000 |
| commit | a46b9388bd064208b663e2412476e6de318b931c (patch) | |
| tree | 1abd28c4cc2eed8605466975b38a5116da9654b0 /lib | |
| parent | 341e30cd836b2588567e81000d56ab1f88c00397 (diff) | |
Pull up following revision(s) (requested by rmind in ticket #282):
usr.sbin/npf/npfctl/npf_build.c: revision 1.53
lib/libnpf/npf.c: revision 1.48
usr.sbin/npf/npfctl/npfctl.h: revision 1.50
sys/net/npf/npf_impl.h: revision 1.80
usr.sbin/npf/npfctl/npfctl.h: revision 1.51
sys/net/npf/npf_ruleset.c: revision 1.49
usr.sbin/npf/npfctl/npf.conf.5: revision 1.90
sys/net/npf/npf_ctl.c: revision 1.59
lib/libnpf/libnpf.3: revision 1.11
usr.sbin/npf/npfctl/npf_parse.y: revision 1.50
usr.sbin/npf/npftest/npftest.conf: revision 1.8
usr.sbin/npf/npfctl/npfctl.c: revision 1.62
usr.sbin/npf/npfctl/npfctl.c: revision 1.63
usr.sbin/npf/npfctl/npf_scan.l: revision 1.30
usr.sbin/npf/npfctl/npfctl.8: revision 1.22
lib/libnpf/npf.h: revision 1.38
usr.sbin/npf/npfctl/npfctl.8: revision 1.23
usr.sbin/npf/npfctl/npfctl.8: revision 1.24
sys/net/npf/npf_if.c: revision 1.11
sys/net/npf/npf_if.c: revision 1.12
usr.sbin/npf/npfctl/npf.conf.5: revision 1.89
sys/net/npf/npf_conn.c: revision 1.30
usr.sbin/npf/npfctl/npf_build.c: revision 1.52
npfctl: implement table replace subcommand.
Contributed by Timshel Knoll-Miller.
NPF ifmap: rework and fix a few small bugs.
npfctl: implement table replace subcommand.
Contributed by Timshel Knoll-Miller.
(missed a file in previous commit; cvs is so helpful..)
libnpf/npfctl: support dynamic NAT rulesets using a name prefix.
Use -width Pa for FILES.
Fix pasto in table replace -t type
Use -width Pa for FILES.
npf_ifmap_copylogname: be more defensive.
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/libnpf/libnpf.3 | 53 | ||||
| -rw-r--r-- | lib/libnpf/npf.c | 30 | ||||
| -rw-r--r-- | lib/libnpf/npf.h | 6 |
3 files changed, 85 insertions, 4 deletions
diff --git a/lib/libnpf/libnpf.3 b/lib/libnpf/libnpf.3 index 0ec337d3f58..f971604c083 100644 --- a/lib/libnpf/libnpf.3 +++ b/lib/libnpf/libnpf.3 @@ -1,4 +1,4 @@ -.\" $NetBSD: libnpf.3,v 1.9.2.1 2019/09/01 13:13:13 martin Exp $ +.\" $NetBSD: libnpf.3,v 1.9.2.2 2019/10/04 08:06:35 martin Exp $ .\" .\" Copyright (c) 2011-2019 The NetBSD Foundation, Inc. .\" All rights reserved. @@ -27,7 +27,7 @@ .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE .\" POSSIBILITY OF SUCH DAMAGE. .\" -.Dd August 21, 2019 +.Dd August 25, 2019 .Dt LIBNPF 3 .Os .Sh NAME @@ -108,6 +108,15 @@ .Fn npf_table_replace "int fd" "nl_table_t *tl" "npf_error_t *errinfo" .Ft void .Fn npf_table_destroy "nl_table_t *tl" +.\" --- +.Ft int +.Fn npf_ruleset_add "int fd" "const char *name" "nl_rule_t *rl" "uint64_t *id" +.Ft int +.Fn npf_ruleset_remove "int fd" "const char *name" "uint64_t id" +.Ft int +.Fn npf_ruleset_remkey "int fd" "const char *name" "const void *key" "size_t len" +.Ft int +.Fn npf_ruleset_flush "int fd" "const char *name" .\" ----- .Sh DESCRIPTION The @@ -352,7 +361,9 @@ Additionally, may be specified to indicate the translation network; otherwise, it should be set to .Dv NPF_NO_NETMASK . -In such case, a custom algorithm may need to be specified using the +.Pp +In order to use the translation network, a custom algorithm may need to +be specified using the .Fn npf_nat_setalgo function. .\" --- @@ -368,6 +379,9 @@ Currently, the following algorithms are supported with dynamic NAT: Hash of the source and destination addresses. .It Dv NPF_ALGO_RR Round-robin for the translation addresses. +.It Dv NPF_ALGO_NETMAP +Network-to-network map as described below, but with state tracking. +It is used when it is necessary to translate the ports. .El .Pp The following are support with static NAT: @@ -450,6 +464,39 @@ specified by Destroy the specified table. .El .\" ----- +.Ss Ruleset interface +.Bl -tag -width 4n +.It Fn npf_ruleset_add "fd" "name" "rl" "id" +Add a given rule, specified by +.Fa rl , +into the dynamic ruleset named +.Fa name . +On success, return 0 and a unique rule ID in the +.Fa id +parameter. +.It Fn npf_ruleset_remove "fd" "name" "id" +Remove a rule from the dynamic ruleset, specified by +.Fa name . +The rule is specified by its unique ID in the +.Fa id +parameter. +.It Fn npf_ruleset_remkey "fd" "name" "key" "len" +Remove a rule from the dynamic ruleset, specified by +.Fa name . +The rule is specified by its key, in the +.Fa key +and +.Fa len +parameters. +The key for the rule must have been set during its construction, using the +.Fn npf_rule_setkey +routine. +.It Fn npf_ruleset_flush "fd" "name" +Clear the dynamic ruleset, specified by +.Fa name , +by removing all its rules. +.El +.\" ----- .Sh SEE ALSO .Xr bpf 4 , .Xr npf 7 , diff --git a/lib/libnpf/npf.c b/lib/libnpf/npf.c index 8fe27dfc91c..1f95d6f901a 100644 --- a/lib/libnpf/npf.c +++ b/lib/libnpf/npf.c @@ -28,7 +28,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.46.2.1 2019/09/01 13:13:13 martin Exp $"); +__KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.46.2.2 2019/10/04 08:06:35 martin Exp $"); #include <sys/types.h> #include <sys/mman.h> @@ -401,14 +401,31 @@ npf_param_set(nl_config_t *ncf, const char *name, int val) * DYNAMIC RULESET INTERFACE. */ +static inline bool +_npf_nat_ruleset_p(const char *name) +{ + return strncmp(name, NPF_RULESET_MAP_PREF, + sizeof(NPF_RULESET_MAP_PREF) - 1) == 0; +} + int npf_ruleset_add(int fd, const char *rname, nl_rule_t *rl, uint64_t *id) { + const bool natset = _npf_nat_ruleset_p(rname); nvlist_t *rule_dict = rl->rule_dict; nvlist_t *ret_dict; + nvlist_add_number(rule_dict, "attr", + NPF_RULE_DYNAMIC | nvlist_take_number(rule_dict, "attr")); + + if (natset && !dnvlist_get_bool(rule_dict, "nat-rule", false)) { + errno = EINVAL; + return errno; + } nvlist_add_string(rule_dict, "ruleset-name", rname); + nvlist_add_bool(rule_dict, "nat-ruleset", natset); nvlist_add_number(rule_dict, "command", NPF_CMD_RULE_ADD); + if (nvlist_xfer_ioctl(fd, IOC_NPF_RULE, rule_dict, &ret_dict) == -1) { return errno; } @@ -419,11 +436,14 @@ npf_ruleset_add(int fd, const char *rname, nl_rule_t *rl, uint64_t *id) int npf_ruleset_remove(int fd, const char *rname, uint64_t id) { + const bool natset = _npf_nat_ruleset_p(rname); nvlist_t *rule_dict = nvlist_create(0); nvlist_add_string(rule_dict, "ruleset-name", rname); + nvlist_add_bool(rule_dict, "nat-ruleset", natset); nvlist_add_number(rule_dict, "command", NPF_CMD_RULE_REMOVE); nvlist_add_number(rule_dict, "id", id); + if (nvlist_send_ioctl(fd, IOC_NPF_RULE, rule_dict) == -1) { return errno; } @@ -433,11 +453,14 @@ npf_ruleset_remove(int fd, const char *rname, uint64_t id) int npf_ruleset_remkey(int fd, const char *rname, const void *key, size_t len) { + const bool natset = _npf_nat_ruleset_p(rname); nvlist_t *rule_dict = nvlist_create(0); nvlist_add_string(rule_dict, "ruleset-name", rname); + nvlist_add_bool(rule_dict, "nat-ruleset", natset); nvlist_add_number(rule_dict, "command", NPF_CMD_RULE_REMKEY); nvlist_add_binary(rule_dict, "key", key, len); + if (nvlist_send_ioctl(fd, IOC_NPF_RULE, rule_dict) == -1) { return errno; } @@ -447,10 +470,13 @@ npf_ruleset_remkey(int fd, const char *rname, const void *key, size_t len) int npf_ruleset_flush(int fd, const char *rname) { + const bool natset = _npf_nat_ruleset_p(rname); nvlist_t *rule_dict = nvlist_create(0); nvlist_add_string(rule_dict, "ruleset-name", rname); + nvlist_add_bool(rule_dict, "nat-ruleset", natset); nvlist_add_number(rule_dict, "command", NPF_CMD_RULE_FLUSH); + if (nvlist_send_ioctl(fd, IOC_NPF_RULE, rule_dict) == -1) { return errno; } @@ -678,10 +704,12 @@ npf_rule_getcode(nl_rule_t *rl, int *type, size_t *len) int _npf_ruleset_list(int fd, const char *rname, nl_config_t *ncf) { + const bool natset = _npf_nat_ruleset_p(rname); nvlist_t *req, *ret; req = nvlist_create(0); nvlist_add_string(req, "ruleset-name", rname); + nvlist_add_bool(req, "nat-ruleset", natset); nvlist_add_number(req, "command", NPF_CMD_RULE_LIST); if (nvlist_xfer_ioctl(fd, IOC_NPF_RULE, req, &ret) == -1) { diff --git a/lib/libnpf/npf.h b/lib/libnpf/npf.h index 61ef2c01ecf..19624885536 100644 --- a/lib/libnpf/npf.h +++ b/lib/libnpf/npf.h @@ -56,6 +56,12 @@ typedef struct nl_ext nl_ext_t; typedef signed long nl_iter_t; /* + * Ruleset prefix(es). + */ + +#define NPF_RULESET_MAP_PREF "map:" + +/* * Extensions API types. */ typedef int (*npfext_initfunc_t)(void); |
