1/* $NetBSD: npfctl.h,v 1.11.2.12 2013/02/11 21:49:48 riz Exp $ */ 2 3/*- 4 * Copyright (c) 2009-2013 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32#ifndef _NPFCTL_H_ 33#define _NPFCTL_H_ 34 35#include <stdio.h> 36#include <stdbool.h> 37#include <inttypes.h> 38#include <assert.h> 39#include <util.h> 40#undef ECHO /* XXX util.h */ 41 42#include <net/npf_ncode.h> 43#include <net/npf.h> 44 45#define _NPF_PRIVATE 46#include <npf.h> 47 48#include "npf_var.h" 49 50#define NPF_DEV_PATH "/dev/npf" 51#define NPF_CONF_PATH "/etc/npf.conf" 52#define NPF_SESSDB_PATH "/var/db/npf_sessions.db" 53 54typedef struct fam_addr_mask { 55 sa_family_t fam_family; 56 npf_addr_t fam_addr; 57 npf_netmask_t fam_mask; 58 unsigned long fam_ifindex; 59} fam_addr_mask_t; 60 61typedef struct ifnet_addr { 62 unsigned long ifna_index; 63 sa_family_t ifna_family; 64 npfvar_t * ifna_filter; 65 npfvar_t * ifna_addrs; 66} ifnet_addr_t; 67 68typedef struct port_range { 69 in_port_t pr_start; 70 in_port_t pr_end; 71} port_range_t; 72 73typedef struct addr_port { 74 npfvar_t * ap_netaddr; 75 npfvar_t * ap_portrange; 76} addr_port_t; 77 78typedef struct filt_opts { 79 addr_port_t fo_from; 80 addr_port_t fo_to; 81} filt_opts_t; 82 83typedef struct opt_proto { 84 int op_proto; 85 npfvar_t * op_opts; 86} opt_proto_t; 87 88typedef struct rule_group { 89 const char * rg_name; 90 uint32_t rg_attr; 91 u_int rg_ifnum; 92 bool rg_default; 93} rule_group_t; 94 95typedef struct proc_call { 96 const char * pc_name; 97 npfvar_t * pc_opts; 98} proc_call_t; 99 100typedef struct proc_param { 101 const char * pp_param; 102 const char * pp_value; 103} proc_param_t; 104 105enum { NPFCTL_PARSE_FILE, NPFCTL_PARSE_STRING }; 106 107void yyerror(const char *, ...) __printflike(1, 2) __dead; 108void npfctl_parse_file(const char *); 109void npfctl_parse_string(const char *); 110 111void npfctl_print_error(const nl_error_t *); 112char * npfctl_print_addrmask(int, npf_addr_t *, npf_netmask_t); 113bool npfctl_table_exists_p(const char *); 114int npfctl_protono(const char *); 115in_port_t npfctl_portno(const char *); 116uint8_t npfctl_icmpcode(int, uint8_t, const char *); 117uint8_t npfctl_icmptype(int, const char *); 118unsigned long npfctl_find_ifindex(const char *); 119npfvar_t * npfctl_parse_ifnet(const char *, const int); 120npfvar_t * npfctl_parse_tcpflag(const char *); 121npfvar_t * npfctl_parse_table_id(const char *); 122npfvar_t * npfctl_parse_icmp(int, int, int); 123npfvar_t * npfctl_parse_port_range(in_port_t, in_port_t); 124npfvar_t * npfctl_parse_port_range_variable(const char *); 125npfvar_t * npfctl_parse_fam_addr_mask(const char *, const char *, 126 unsigned long *); 127bool npfctl_parse_cidr(char *, fam_addr_mask_t *, int *); 128 129/* 130 * NPF extension loading. 131 */ 132 133typedef struct npf_extmod npf_extmod_t; 134 135npf_extmod_t * npf_extmod_get(const char *, nl_ext_t **); 136int npf_extmod_param(npf_extmod_t *, nl_ext_t *, 137 const char *, const char *); 138 139/* 140 * N-code generation interface. 141 */ 142 143typedef struct nc_ctx nc_ctx_t; 144 145#define NC_MATCH_DST 0x01 146#define NC_MATCH_SRC 0x02 147 148#define NC_MATCH_TCP 0x04 149#define NC_MATCH_UDP 0x08 150#define NC_MATCH_ICMP 0x10 151#define NC_MATCH_ICMP6 0x20 152 153nc_ctx_t * npfctl_ncgen_create(void); 154void * npfctl_ncgen_complete(nc_ctx_t *, size_t *); 155void npfctl_ncgen_print(const void *, size_t); 156 157void npfctl_ncgen_group(nc_ctx_t *); 158void npfctl_ncgen_endgroup(nc_ctx_t *); 159 160void npfctl_gennc_v4cidr(nc_ctx_t *, int, const npf_addr_t *, 161 const npf_netmask_t); 162void npfctl_gennc_v6cidr(nc_ctx_t *, int, const npf_addr_t *, 163 const npf_netmask_t); 164void npfctl_gennc_ports(nc_ctx_t *, int, in_port_t, in_port_t); 165void npfctl_gennc_icmp(nc_ctx_t *, int, int); 166void npfctl_gennc_icmp6(nc_ctx_t *, int, int); 167void npfctl_gennc_tbl(nc_ctx_t *, int, u_int); 168void npfctl_gennc_tcpfl(nc_ctx_t *, uint8_t, uint8_t); 169void npfctl_gennc_proto(nc_ctx_t *ctx, uint8_t, uint8_t); 170 171/* 172 * N-code disassembler. 173 */ 174 175typedef struct nc_inf nc_inf_t; 176 177nc_inf_t * npfctl_ncode_disinf(FILE *); 178int npfctl_ncode_disassemble(nc_inf_t *, const void *, size_t); 179 180/* 181 * Configuration building interface. 182 */ 183 184#define NPFCTL_NAT_DYNAMIC 1 185#define NPFCTL_NAT_STATIC 2 186 187void npfctl_config_init(bool); 188int npfctl_config_send(int, const char *); 189nl_config_t * npfctl_config_ref(void); 190int npfctl_config_show(int); 191int npfctl_ruleset_show(int, const char *); 192 193nl_rule_t * npfctl_rule_ref(void); 194unsigned long npfctl_debug_addif(const char *); 195 196void npfctl_build_rproc(const char *, npfvar_t *); 197void npfctl_build_group(const char *, int, u_int, bool); 198void npfctl_build_group_end(void); 199void npfctl_build_rule(uint32_t, u_int, sa_family_t, 200 const opt_proto_t *, const filt_opts_t *, const char *); 201void npfctl_build_natseg(int, int, u_int, const addr_port_t *, 202 const addr_port_t *, const filt_opts_t *); 203void npfctl_build_table(const char *, u_int, const char *); 204 205#endif 206