summaryrefslogtreecommitdiff
path: root/usr.sbin/npf/npfctl/npfctl.h
blob: 4a175174880795231c23a29adc39b2fc8f85e772 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
/*-
 * Copyright (c) 2009-2017 The NetBSD Foundation, Inc.
 * All rights reserved.
 *
 * This material is based upon work partially supported by The
 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

#ifndef _NPFCTL_H_
#define _NPFCTL_H_

#include <stdio.h>
#include <stdbool.h>
#include <inttypes.h>
#include <assert.h>
#include <util.h>

#define	NPF_BPFCOP
#include <net/npf.h>

#define	_NPF_PRIVATE
#include <npf.h>

#include "npf_var.h"

#define	NPF_DEV_PATH	"/dev/npf"
#define	NPF_CONF_PATH	"/etc/npf.conf"
#define	NPF_DB_PATH	"/var/db/npf.db"

typedef struct fam_addr_mask {
	sa_family_t	fam_family;
	npf_addr_t	fam_addr;
	npf_netmask_t	fam_mask;
	unsigned long	fam_ifindex;
} fam_addr_mask_t;

typedef struct ifnet_addr {
	char *		ifna_name;
	unsigned long	ifna_index;
	sa_family_t	ifna_family;
	npfvar_t *	ifna_filter;
	npfvar_t *	ifna_addrs;
} ifnet_addr_t;

typedef struct port_range {
	in_port_t	pr_start;
	in_port_t	pr_end;
} port_range_t;

typedef struct addr_port {
	npfvar_t *	ap_netaddr;
	npfvar_t *	ap_portrange;
} addr_port_t;

typedef struct filt_opts {
	addr_port_t	fo_from;
	addr_port_t	fo_to;
	bool		fo_finvert;
	bool		fo_tinvert;
} filt_opts_t;

typedef struct opt_proto {
	int		op_proto;
	npfvar_t *	op_opts;
} opt_proto_t;

typedef struct rule_group {
	const char *	rg_name;
	uint32_t	rg_attr;
	const char *	rg_ifname;
	bool		rg_default;
} rule_group_t;

typedef struct proc_call {
	const char *	pc_name;
	npfvar_t *	pc_opts;
} proc_call_t;

typedef struct proc_param {
	const char *	pp_param;
	const char *	pp_value;
} proc_param_t;

typedef enum {
	NPFCTL_PARSE_DEFAULT,
	NPFCTL_PARSE_RULE,
	NPFCTL_PARSE_MAP
} parse_entry_t;

#define	NPF_IFNET_TABLE_PREF		".ifnet-"
#define	NPF_IFNET_TABLE_PREFLEN		(sizeof(NPF_IFNET_TABLE_PREF) - 1)

void		yyerror(const char *, ...) __printflike(1, 2) __dead;
void		npfctl_bpfjit(bool);
void		npfctl_parse_file(const char *);
void		npfctl_parse_string(const char *, parse_entry_t);

bool		join(char *, size_t, int, char **, const char *);
bool		npfctl_addr_iszero(const npf_addr_t *);

void		npfctl_print_error(const npf_error_t *);
char *		npfctl_print_addrmask(int, const char *, const npf_addr_t *,
		    npf_netmask_t);
void		npfctl_note_interface(const char *);
nl_table_t *	npfctl_table_getbyname(nl_config_t *, const char *);
unsigned	npfctl_table_getid(const char *);
const char *	npfctl_table_getname(nl_config_t *, unsigned, bool *);
int		npfctl_protono(const char *);
in_port_t	npfctl_portno(const char *);
uint8_t		npfctl_icmpcode(int, uint8_t, const char *);
uint8_t		npfctl_icmptype(int, const char *);
npfvar_t *	npfctl_ifnet_table(const char *);
npfvar_t *	npfctl_parse_ifnet(const char *, const int);
npfvar_t *	npfctl_parse_tcpflag(const char *);
npfvar_t *	npfctl_parse_table_id(const char *);
npfvar_t * 	npfctl_parse_icmp(int, int, int);
npfvar_t *	npfctl_parse_port_range(in_port_t, in_port_t);
npfvar_t *	npfctl_parse_port_range_variable(const char *, npfvar_t *);
npfvar_t *	npfctl_parse_fam_addr_mask(const char *, const char *,
		    unsigned long *);
bool		npfctl_parse_cidr(char *, fam_addr_mask_t *, int *);
uint16_t	npfctl_npt66_calcadj(npf_netmask_t, const npf_addr_t *,
		    const npf_addr_t *);
int		npfctl_nat_ruleset_p(const char *, bool *);

void		usage(void);
void		npfctl_rule(int, int, char **);
void		npfctl_table_replace(int, int, char **);
void		npfctl_table(int, int, char **);
int		npfctl_conn_list(int, int, char **);

/*
 * NPF extension loading.
 */

typedef struct npf_extmod npf_extmod_t;

npf_extmod_t *	npf_extmod_get(const char *, nl_ext_t **);
int		npf_extmod_param(npf_extmod_t *, nl_ext_t *,
		    const char *, const char *);

/*
 * BFF byte-code generation interface.
 */

typedef struct npf_bpf npf_bpf_t;

#define	MATCH_DST	0x01
#define	MATCH_SRC	0x02
#define	MATCH_INVERT	0x04

enum {
	BM_IPVER, BM_PROTO, BM_SRC_CIDR, BM_SRC_TABLE, BM_DST_CIDR,
	BM_DST_TABLE, BM_SRC_PORTS, BM_DST_PORTS, BM_TCPFL, BM_ICMP_TYPE,
	BM_ICMP_CODE, BM_SRC_NEG, BM_DST_NEG,

	BM_COUNT // total number of the marks
};

npf_bpf_t *	npfctl_bpf_create(void);
struct bpf_program *npfctl_bpf_complete(npf_bpf_t *);
const void *	npfctl_bpf_bmarks(npf_bpf_t *, size_t *);
void		npfctl_bpf_destroy(npf_bpf_t *);

void		npfctl_bpf_group_enter(npf_bpf_t *, bool);
void		npfctl_bpf_group_exit(npf_bpf_t *);

void		npfctl_bpf_ipver(npf_bpf_t *, sa_family_t);
void		npfctl_bpf_proto(npf_bpf_t *, unsigned);
void		npfctl_bpf_cidr(npf_bpf_t *, u_int, sa_family_t,
		    const npf_addr_t *, const npf_netmask_t);
void		npfctl_bpf_ports(npf_bpf_t *, u_int, in_port_t, in_port_t);
void		npfctl_bpf_tcpfl(npf_bpf_t *, uint8_t, uint8_t);
void		npfctl_bpf_icmp(npf_bpf_t *, int, int);
void		npfctl_bpf_table(npf_bpf_t *, u_int, u_int);

/*
 * Configuration building interface.
 */

#define	NPFCTL_NAT_DYNAMIC	1
#define	NPFCTL_NAT_STATIC	2

void		npfctl_config_init(bool);
void		npfctl_config_build(void);
int		npfctl_config_send(int);
nl_config_t *	npfctl_config_ref(void);
int		npfctl_config_show(int);
void		npfctl_config_save(nl_config_t *, const char *);
int		npfctl_ruleset_show(int, const char *);

nl_rule_t *	npfctl_rule_ref(void);
nl_table_t *	npfctl_table_ref(void);
bool		npfctl_debug_addif(const char *);

nl_table_t *	npfctl_load_table(const char *, int, u_int, const char *, FILE *);

void		npfctl_build_alg(const char *);
void		npfctl_build_rproc(const char *, npfvar_t *);
void		npfctl_build_group(const char *, int, const char *, bool);
void		npfctl_build_group_end(void);
void		npfctl_build_rule(uint32_t, const char *, sa_family_t,
		    const npfvar_t *, const filt_opts_t *,
		    const char *, const char *);
void		npfctl_build_natseg(int, int, unsigned, const char *,
		    const addr_port_t *, const addr_port_t *,
		    const npfvar_t *, const filt_opts_t *, unsigned);
void		npfctl_build_maprset(const char *, int, const char *);
void		npfctl_build_table(const char *, u_int, const char *);

void		npfctl_setparam(const char *, int);

/*
 * For the systems which do not define TH_ECE and TW_CRW.
 */
#ifndef	TH_ECE
#define	TH_ECE		0x40
#endif
#ifndef	TH_CWR
#define	TH_CWR		0x80
#endif

#endif