1/*	$NetBSD: npfctl.h,v 1.11.2.12 2013/02/11 21:49:48 riz Exp $	*/
2
3/*-
4 * Copyright (c) 2009-2013 The NetBSD Foundation, Inc.
5 * All rights reserved.
6 *
7 * This material is based upon work partially supported by The
8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 *    notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 *    notice, this list of conditions and the following disclaimer in the
17 *    documentation and/or other materials provided with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 * POSSIBILITY OF SUCH DAMAGE.
30 */
31
32#ifndef _NPFCTL_H_
33#define _NPFCTL_H_
34
35#include <stdio.h>
36#include <stdbool.h>
37#include <inttypes.h>
38#include <assert.h>
39#include <util.h>
40#undef ECHO /* XXX util.h */
41
42#include <net/npf_ncode.h>
43#include <net/npf.h>
44
45#define	_NPF_PRIVATE
46#include <npf.h>
47
48#include "npf_var.h"
49
50#define	NPF_DEV_PATH	"/dev/npf"
51#define	NPF_CONF_PATH	"/etc/npf.conf"
52#define	NPF_SESSDB_PATH	"/var/db/npf_sessions.db"
53
54typedef struct fam_addr_mask {
55	sa_family_t	fam_family;
56	npf_addr_t	fam_addr;
57	npf_netmask_t	fam_mask;
58	unsigned long	fam_ifindex;
59} fam_addr_mask_t;
60
61typedef struct ifnet_addr {
62	unsigned long	ifna_index;
63	sa_family_t	ifna_family;
64	npfvar_t *	ifna_filter;
65	npfvar_t *	ifna_addrs;
66} ifnet_addr_t;
67
68typedef struct port_range {
69	in_port_t	pr_start;
70	in_port_t	pr_end;
71} port_range_t;
72
73typedef struct addr_port {
74	npfvar_t *	ap_netaddr;
75	npfvar_t *	ap_portrange;
76} addr_port_t;
77
78typedef struct filt_opts {
79	addr_port_t	fo_from;
80	addr_port_t	fo_to;
81} filt_opts_t;
82
83typedef struct opt_proto {
84	int		op_proto;
85	npfvar_t *	op_opts;
86} opt_proto_t;
87
88typedef struct rule_group {
89	const char *	rg_name;
90	uint32_t	rg_attr;
91	u_int		rg_ifnum;
92	bool		rg_default;
93} rule_group_t;
94
95typedef struct proc_call {
96	const char *	pc_name;
97	npfvar_t *	pc_opts;
98} proc_call_t;
99
100typedef struct proc_param {
101	const char *	pp_param;
102	const char *	pp_value;
103} proc_param_t;
104
105enum { NPFCTL_PARSE_FILE, NPFCTL_PARSE_STRING };
106
107void		yyerror(const char *, ...) __printflike(1, 2) __dead;
108void		npfctl_parse_file(const char *);
109void		npfctl_parse_string(const char *);
110
111void		npfctl_print_error(const nl_error_t *);
112char *		npfctl_print_addrmask(int, npf_addr_t *, npf_netmask_t);
113bool		npfctl_table_exists_p(const char *);
114int		npfctl_protono(const char *);
115in_port_t	npfctl_portno(const char *);
116uint8_t		npfctl_icmpcode(int, uint8_t, const char *);
117uint8_t		npfctl_icmptype(int, const char *);
118unsigned long   npfctl_find_ifindex(const char *);
119npfvar_t *	npfctl_parse_ifnet(const char *, const int);
120npfvar_t *	npfctl_parse_tcpflag(const char *);
121npfvar_t *	npfctl_parse_table_id(const char *);
122npfvar_t * 	npfctl_parse_icmp(int, int, int);
123npfvar_t *	npfctl_parse_port_range(in_port_t, in_port_t);
124npfvar_t *	npfctl_parse_port_range_variable(const char *);
125npfvar_t *	npfctl_parse_fam_addr_mask(const char *, const char *,
126		    unsigned long *);
127bool		npfctl_parse_cidr(char *, fam_addr_mask_t *, int *);
128
129/*
130 * NPF extension loading.
131 */
132
133typedef struct npf_extmod npf_extmod_t;
134
135npf_extmod_t *	npf_extmod_get(const char *, nl_ext_t **);
136int		npf_extmod_param(npf_extmod_t *, nl_ext_t *,
137		    const char *, const char *);
138
139/*
140 * N-code generation interface.
141 */
142
143typedef struct nc_ctx nc_ctx_t;
144
145#define	NC_MATCH_DST		0x01
146#define	NC_MATCH_SRC		0x02
147
148#define	NC_MATCH_TCP		0x04
149#define	NC_MATCH_UDP		0x08
150#define	NC_MATCH_ICMP		0x10
151#define	NC_MATCH_ICMP6		0x20
152
153nc_ctx_t *	npfctl_ncgen_create(void);
154void *		npfctl_ncgen_complete(nc_ctx_t *, size_t *);
155void		npfctl_ncgen_print(const void *, size_t);
156
157void		npfctl_ncgen_group(nc_ctx_t *);
158void		npfctl_ncgen_endgroup(nc_ctx_t *);
159
160void		npfctl_gennc_v4cidr(nc_ctx_t *, int, const npf_addr_t *,
161		    const npf_netmask_t);
162void		npfctl_gennc_v6cidr(nc_ctx_t *, int, const npf_addr_t *,
163		    const npf_netmask_t);
164void		npfctl_gennc_ports(nc_ctx_t *, int, in_port_t, in_port_t);
165void		npfctl_gennc_icmp(nc_ctx_t *, int, int);
166void		npfctl_gennc_icmp6(nc_ctx_t *, int, int);
167void		npfctl_gennc_tbl(nc_ctx_t *, int, u_int);
168void		npfctl_gennc_tcpfl(nc_ctx_t *, uint8_t, uint8_t);
169void		npfctl_gennc_proto(nc_ctx_t *ctx, uint8_t, uint8_t);
170
171/*
172 * N-code disassembler.
173 */
174
175typedef struct nc_inf nc_inf_t;
176
177nc_inf_t *	npfctl_ncode_disinf(FILE *);
178int		npfctl_ncode_disassemble(nc_inf_t *, const void *, size_t);
179
180/*
181 * Configuration building interface.
182 */
183
184#define	NPFCTL_NAT_DYNAMIC	1
185#define	NPFCTL_NAT_STATIC	2
186
187void		npfctl_config_init(bool);
188int		npfctl_config_send(int, const char *);
189nl_config_t *	npfctl_config_ref(void);
190int		npfctl_config_show(int);
191int		npfctl_ruleset_show(int, const char *);
192
193nl_rule_t *	npfctl_rule_ref(void);
194unsigned long	npfctl_debug_addif(const char *);
195
196void		npfctl_build_rproc(const char *, npfvar_t *);
197void		npfctl_build_group(const char *, int, u_int, bool);
198void		npfctl_build_group_end(void);
199void		npfctl_build_rule(uint32_t, u_int, sa_family_t,
200		    const opt_proto_t *, const filt_opts_t *, const char *);
201void		npfctl_build_natseg(int, int, u_int, const addr_port_t *,
202		    const addr_port_t *, const filt_opts_t *);
203void		npfctl_build_table(const char *, u_int, const char *);
204
205#endif
206