1/*-
2 * Copyright (c) 2009-2017 The NetBSD Foundation, Inc.
3 * All rights reserved.
4 *
5 * This material is based upon work partially supported by The
6 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 *    notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
18 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
19 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
20 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
21 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
22 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
25 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27 * POSSIBILITY OF SUCH DAMAGE.
28 */
29
30#ifndef _NPFCTL_H_
31#define _NPFCTL_H_
32
33#include <stdio.h>
34#include <stdbool.h>
35#include <inttypes.h>
36#include <assert.h>
37#include <util.h>
38
39#define	NPF_BPFCOP
40#include <net/npf.h>
41
42#define	_NPF_PRIVATE
43#include <npf.h>
44
45#include "npf_var.h"
46
47#define	NPF_DEV_PATH	"/dev/npf"
48#define	NPF_CONF_PATH	"/etc/npf.conf"
49#define	NPF_DB_PATH	"/var/db/npf.db"
50
51typedef struct fam_addr_mask {
52	sa_family_t	fam_family;
53	npf_addr_t	fam_addr;
54	npf_netmask_t	fam_mask;
55	unsigned long	fam_ifindex;
56} fam_addr_mask_t;
57
58typedef struct ifnet_addr {
59	char *		ifna_name;
60	unsigned long	ifna_index;
61	sa_family_t	ifna_family;
62	npfvar_t *	ifna_filter;
63	npfvar_t *	ifna_addrs;
64} ifnet_addr_t;
65
66typedef struct port_range {
67	in_port_t	pr_start;
68	in_port_t	pr_end;
69} port_range_t;
70
71typedef struct addr_port {
72	npfvar_t *	ap_netaddr;
73	npfvar_t *	ap_portrange;
74} addr_port_t;
75
76typedef struct filt_opts {
77	addr_port_t	fo_from;
78	addr_port_t	fo_to;
79	bool		fo_finvert;
80	bool		fo_tinvert;
81} filt_opts_t;
82
83typedef struct opt_proto {
84	int		op_proto;
85	npfvar_t *	op_opts;
86} opt_proto_t;
87
88typedef struct rule_group {
89	const char *	rg_name;
90	uint32_t	rg_attr;
91	const char *	rg_ifname;
92	bool		rg_default;
93} rule_group_t;
94
95typedef struct proc_call {
96	const char *	pc_name;
97	npfvar_t *	pc_opts;
98} proc_call_t;
99
100typedef struct proc_param {
101	const char *	pp_param;
102	const char *	pp_value;
103} proc_param_t;
104
105typedef enum {
106	NPFCTL_PARSE_DEFAULT,
107	NPFCTL_PARSE_RULE,
108	NPFCTL_PARSE_MAP
109} parse_entry_t;
110
111#define	NPF_IFNET_TABLE_PREF		".ifnet-"
112#define	NPF_IFNET_TABLE_PREFLEN		(sizeof(NPF_IFNET_TABLE_PREF) - 1)
113
114void		yyerror(const char *, ...) __printflike(1, 2) __dead;
115void		npfctl_bpfjit(bool);
116void		npfctl_parse_file(const char *);
117void		npfctl_parse_string(const char *, parse_entry_t);
118
119bool		join(char *, size_t, int, char **, const char *);
120bool		npfctl_addr_iszero(const npf_addr_t *);
121
122void		npfctl_print_error(const npf_error_t *);
123char *		npfctl_print_addrmask(int, const char *, const npf_addr_t *,
124		    npf_netmask_t);
125void		npfctl_note_interface(const char *);
126nl_table_t *	npfctl_table_getbyname(nl_config_t *, const char *);
127unsigned	npfctl_table_getid(const char *);
128const char *	npfctl_table_getname(nl_config_t *, unsigned, bool *);
129int		npfctl_protono(const char *);
130in_port_t	npfctl_portno(const char *);
131uint8_t		npfctl_icmpcode(int, uint8_t, const char *);
132uint8_t		npfctl_icmptype(int, const char *);
133npfvar_t *	npfctl_ifnet_table(const char *);
134npfvar_t *	npfctl_parse_ifnet(const char *, const int);
135npfvar_t *	npfctl_parse_tcpflag(const char *);
136npfvar_t *	npfctl_parse_table_id(const char *);
137npfvar_t * 	npfctl_parse_icmp(int, int, int);
138npfvar_t *	npfctl_parse_port_range(in_port_t, in_port_t);
139npfvar_t *	npfctl_parse_port_range_variable(const char *, npfvar_t *);
140npfvar_t *	npfctl_parse_fam_addr_mask(const char *, const char *,
141		    unsigned long *);
142bool		npfctl_parse_cidr(char *, fam_addr_mask_t *, int *);
143uint16_t	npfctl_npt66_calcadj(npf_netmask_t, const npf_addr_t *,
144		    const npf_addr_t *);
145int		npfctl_nat_ruleset_p(const char *, bool *);
146
147void		usage(void);
148void		npfctl_rule(int, int, char **);
149void		npfctl_table_replace(int, int, char **);
150void		npfctl_table(int, int, char **);
151int		npfctl_conn_list(int, int, char **);
152
153/*
154 * NPF extension loading.
155 */
156
157typedef struct npf_extmod npf_extmod_t;
158
159npf_extmod_t *	npf_extmod_get(const char *, nl_ext_t **);
160int		npf_extmod_param(npf_extmod_t *, nl_ext_t *,
161		    const char *, const char *);
162
163/*
164 * BFF byte-code generation interface.
165 */
166
167typedef struct npf_bpf npf_bpf_t;
168
169#define	MATCH_DST	0x01
170#define	MATCH_SRC	0x02
171#define	MATCH_INVERT	0x04
172
173enum {
174	BM_IPVER, BM_PROTO, BM_SRC_CIDR, BM_SRC_TABLE, BM_DST_CIDR,
175	BM_DST_TABLE, BM_SRC_PORTS, BM_DST_PORTS, BM_TCPFL, BM_ICMP_TYPE,
176	BM_ICMP_CODE, BM_SRC_NEG, BM_DST_NEG,
177
178	BM_COUNT // total number of the marks
179};
180
181npf_bpf_t *	npfctl_bpf_create(void);
182struct bpf_program *npfctl_bpf_complete(npf_bpf_t *);
183const void *	npfctl_bpf_bmarks(npf_bpf_t *, size_t *);
184void		npfctl_bpf_destroy(npf_bpf_t *);
185
186void		npfctl_bpf_group_enter(npf_bpf_t *, bool);
187void		npfctl_bpf_group_exit(npf_bpf_t *);
188
189void		npfctl_bpf_ipver(npf_bpf_t *, sa_family_t);
190void		npfctl_bpf_proto(npf_bpf_t *, unsigned);
191void		npfctl_bpf_cidr(npf_bpf_t *, u_int, sa_family_t,
192		    const npf_addr_t *, const npf_netmask_t);
193void		npfctl_bpf_ports(npf_bpf_t *, u_int, in_port_t, in_port_t);
194void		npfctl_bpf_tcpfl(npf_bpf_t *, uint8_t, uint8_t);
195void		npfctl_bpf_icmp(npf_bpf_t *, int, int);
196void		npfctl_bpf_table(npf_bpf_t *, u_int, u_int);
197
198/*
199 * Configuration building interface.
200 */
201
202#define	NPFCTL_NAT_DYNAMIC	1
203#define	NPFCTL_NAT_STATIC	2
204
205void		npfctl_config_init(bool);
206void		npfctl_config_build(void);
207int		npfctl_config_send(int);
208nl_config_t *	npfctl_config_ref(void);
209int		npfctl_config_show(int);
210void		npfctl_config_save(nl_config_t *, const char *);
211int		npfctl_ruleset_show(int, const char *);
212
213nl_rule_t *	npfctl_rule_ref(void);
214nl_table_t *	npfctl_table_ref(void);
215bool		npfctl_debug_addif(const char *);
216
217nl_table_t *	npfctl_load_table(const char *, int, u_int, const char *, FILE *);
218
219void		npfctl_build_alg(const char *);
220void		npfctl_build_rproc(const char *, npfvar_t *);
221void		npfctl_build_group(const char *, int, const char *, bool);
222void		npfctl_build_group_end(void);
223void		npfctl_build_rule(uint32_t, const char *, sa_family_t,
224		    const npfvar_t *, const filt_opts_t *,
225		    const char *, const char *);
226void		npfctl_build_natseg(int, int, unsigned, const char *,
227		    const addr_port_t *, const addr_port_t *,
228		    const npfvar_t *, const filt_opts_t *, unsigned);
229void		npfctl_build_maprset(const char *, int, const char *);
230void		npfctl_build_table(const char *, u_int, const char *);
231
232void		npfctl_setparam(const char *, int);
233
234/*
235 * For the systems which do not define TH_ECE and TW_CRW.
236 */
237#ifndef	TH_ECE
238#define	TH_ECE		0x40
239#endif
240#ifndef	TH_CWR
241#define	TH_CWR		0x80
242#endif
243
244#endif
245