/*-
* Copyright (c) 2009-2025 The NetBSD Foundation, Inc.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
/*
* npfctl(8) data manipulation and helper routines.
*/
#include <sys/cdefs.h>
__RCSID("$NetBSD: npf_data.c,v 1.34 2025/07/01 19:55:15 joe Exp $");
#include <stdlib.h>
#include <stddef.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#define ICMP_STRINGS
#include <netinet/ip_icmp.h>
#define ICMP6_STRINGS
#include <netinet/icmp6.h>
#define __FAVOR_BSD
#include <netinet/tcp.h>
#include <net/if.h>
#include <string.h>
#include <ctype.h>
#include <err.h>
#include <errno.h>
#include <ifaddrs.h>
#include <netdb.h>
#include <pwd.h>
#include <grp.h>
#include "npfctl.h"
static struct ifaddrs * ifs_list = NULL;
void
npfctl_note_interface(const char *ifname)
{
unsigned long if_idx = if_nametoindex(ifname);
bool testif = npfctl_debug_addif(ifname);
const char *p = ifname;
/* If such interface exists or if it is a test interface - done. */
if (if_idx || testif) {
return;
}
/*
* Minimum sanity check. The interface name shall be non-empty
* string shorter than IFNAMSIZ and alphanumeric only.
*/
if (*p == '\0') {
goto err;
}
while (*p) {
const size_t len = (ptrdiff_t)p - (ptrdiff_t)ifname;
if (!isalnum((unsigned char)*p) || len > IFNAMSIZ) {
goto err;
}
p++;
}
/* Throw a warning, so that the user could double check. */
warnx("warning - unknown interface '%s'", ifname);
return;
err:
yyerror("illegitimate interface name '%s'", ifname);
}
static unsigned long
npfctl_find_ifindex(const char *ifname)
{
unsigned long if_idx = if_nametoindex(ifname);
bool testif = npfctl_debug_addif(ifname);
if (!if_idx) {
if (testif) {
static u_int dummy_if_idx = (1 << 15);
return ++dummy_if_idx;
}
yyerror("unknown interface '%s'", ifname);
}
return if_idx;
}
static bool
npfctl_copy_address(sa_family_t fam, npf_addr_t *addr, const void *ptr)
{
memset(addr, 0, sizeof(npf_addr_t));
switch (fam) {
case AF_INET: {
const struct sockaddr_in *sin = ptr;
memcpy(addr, &sin->sin_addr, sizeof(sin->sin_addr));
return true;
}
case AF_INET6: {
const struct sockaddr_in6 *sin6 = ptr;
memcpy(addr, &sin6->sin6_addr, sizeof(sin6->sin6_addr));
return true;
}
default:
yyerror("unknown address family %u", fam);
return false;
}
}
/*
* npfctl_parse_fam_addr: parse a given a string and return the address
* family with the actual address as npf_addr_t.
*
* => Return true on success; false otherwise.
*/
static bool
npfctl_parse_fam_addr(const char *name, sa_family_t *fam, npf_addr_t *addr)
{
static const struct addrinfo hint = {
.ai_family = AF_UNSPEC,
.ai_flags = AI_NUMERICHOST
};
struct addrinfo *ai;
int ret;
ret = getaddrinfo(name, NULL, &hint, &ai);
if (ret) {
yyerror("cannot parse '%s' (%s)", name, gai_strerror(ret));
return false;
}
if (fam) {
*fam = ai->ai_family;
}
if (!npfctl_copy_address(*fam, addr, ai->ai_addr)) {
return false;
}
freeaddrinfo(ai);
return true;
}
/*
* npfctl_parse_mask: parse a given string which represents a mask and
* can either be in quad-dot or CIDR block notation; validates the mask
* given the family.
*
* => Returns true if mask is valid (or is NULL); false otherwise.
*/
static bool
npfctl_parse_mask(const char *s, sa_family_t fam, npf_netmask_t *mask)
{
unsigned max_mask = NPF_MAX_NETMASK;
char *ep = NULL;
npf_addr_t addr;
uint8_t *ap;
assert(fam == AF_INET || fam == AF_INET6);
if (!s) {
/* No mask. */
*mask = NPF_NO_NETMASK;
return true;
}
errno = 0;
*mask = (npf_netmask_t)strtol(s, &ep, 0);
if (*ep == '\0' && s != ep && errno != ERANGE) {
/* Just a number -- CIDR notation. */
goto check;
}
/* Other characters: try to parse a full address. */
if (!npfctl_parse_fam_addr(s, &fam, &addr)) {
return false;
}
/* Convert the address to CIDR block number. */
ap = addr.word8 + (*mask / 8) - 1;
while (ap >= addr.word8) {
for (int j = 8; j > 0; j--) {
if (*ap & 1)
goto check;
*ap >>= 1;
(*mask)--;
if (*mask == 0)
goto check;
}
ap--;
}
*mask = NPF_NO_NETMASK;
return true;
check:
switch (fam) {
case AF_INET:
max_mask = 32;
break;
case AF_INET6:
max_mask = 128;
break;
}
return *mask <= max_mask;
}
/*
* npfctl_parse_fam_addr_mask: return address family, address and mask.
*
* => Mask is optional and can be NULL.
* => Returns true on success or false if unable to parse.
*/
npfvar_t *
npfctl_parse_fam_addr_mask(const char *addr, const char *mask,
unsigned long *nummask)
{
fam_addr_mask_t fam;
char buf[32];
memset(&fam, 0, sizeof(fam));
if (!npfctl_parse_fam_addr(addr, &fam.fam_family, &fam.fam_addr))
return NULL;
/*
* Mask may be NULL. In such case, "no mask" value will be set.
*/
if (nummask) {
/* Let npfctl_parse_mask() validate the number. */
snprintf(buf, sizeof(buf), "%lu", *nummask);
mask = buf;
}
if (!npfctl_parse_mask(mask, fam.fam_family, &fam.fam_mask)) {
return NULL;
}
return npfvar_create_element(NPFVAR_FAM, &fam, sizeof(fam));
}
npfvar_t *
npfctl_parse_table_id(const char *name)
{
u_int tid;
tid = npfctl_table_getid(name);
if (tid == (unsigned)-1) {
yyerror("table '%s' is not defined", name);
return NULL;
}
return npfvar_create_element(NPFVAR_TABLE, &tid, sizeof(u_int));
}
int
npfctl_parse_user(const char *user, uint32_t *uid)
{
if (!strcmp(user, "unknown"))
*uid = UID_MAX;
else {
struct passwd *pw;
if ((pw = getpwnam(user)) == NULL) {
return -1;
}
*uid = pw->pw_uid;
}
return 0;
}
int
npfctl_parse_group(const char *group, uint32_t *gid)
{
if (!strcmp(group, "unknown"))
*gid = GID_MAX;
else {
struct group *grp;
if ((grp = getgrnam(group)) == NULL) {
return -1;
}
*gid = grp->gr_gid;
}
return 0;
}
/*
* this function is called for both gid and uid init in parser
* both uid and gid are both uint32_t
*/
void
npfctl_init_rid(rid_t *rid, uint32_t id1, uint32_t id2, uint8_t op)
{
rid->id[0] = id1;
rid->id[1] = id2;
rid->op = op;
}
/*
* npfctl_parse_port_range: create a port-range variable. Note that the
* passed port numbers should be in host byte order.
*/
npfvar_t *
npfctl_parse_port_range(in_port_t s, in_port_t e)
{
port_range_t pr;
pr.pr_start = htons(s);
pr.pr_end = htons(e);
return npfvar_create_element(NPFVAR_PORT_RANGE, &pr, sizeof(pr));
}
npfvar_t *
npfctl_parse_port_range_variable(const char *v, npfvar_t *vp)
{
size_t count = npfvar_get_count(vp);
npfvar_t *pvp = npfvar_create();
port_range_t *pr;
for (size_t i = 0; i < count; i++) {
int type = npfvar_get_type(vp, i);
void *data = npfvar_get_data(vp, type, i);
in_port_t p;
switch (type) {
case NPFVAR_IDENTIFIER:
case NPFVAR_STRING:
p = npfctl_portno(data);
npfvar_add_elements(pvp, npfctl_parse_port_range(p, p));
break;
case NPFVAR_PORT_RANGE:
pr = data;
npfvar_add_element(pvp, NPFVAR_PORT_RANGE, pr,
sizeof(*pr));
break;
case NPFVAR_NUM:
p = *(uint32_t *)data;
npfvar_add_elements(pvp, npfctl_parse_port_range(p, p));
break;
default:
if (v) {
yyerror("wrong variable '%s' type '%s' "
"for port range", v, npfvar_type(type));
} else {
yyerror("wrong element '%s' in the "
"inline list", npfvar_type(type));
}
npfvar_destroy(pvp);
return NULL;
}
}
return pvp;
}
npfvar_t *
npfctl_parse_ifnet(const char *ifname, const int family)
{
struct ifaddrs *ifa;
ifnet_addr_t ifna;
npfvar_t *vpa;
if (ifs_list == NULL && getifaddrs(&ifs_list) == -1) {
err(EXIT_FAILURE, "getifaddrs");
}
vpa = npfvar_create();
ifna.ifna_name = estrdup(ifname);
ifna.ifna_addrs = vpa;
ifna.ifna_index = npfctl_find_ifindex(ifname);
assert(ifna.ifna_index != 0);
for (ifa = ifs_list; ifa != NULL; ifa = ifa->ifa_next) {
fam_addr_mask_t fam;
struct sockaddr *sa;
if (strcmp(ifa->ifa_name, ifname) != 0)
continue;
if ((ifa->ifa_flags & IFF_UP) == 0)
warnx("interface '%s' is down", ifname);
sa = ifa->ifa_addr;
if (sa->sa_family != AF_INET && sa->sa_family != AF_INET6)
continue;
if (family != AF_UNSPEC && sa->sa_family != family)
continue;
memset(&fam, 0, sizeof(fam));
fam.fam_family = sa->sa_family;
fam.fam_ifindex = ifna.ifna_index;
fam.fam_mask = NPF_NO_NETMASK;
if (!npfctl_copy_address(sa->sa_family, &fam.fam_addr, sa))
goto out;
if (!npfvar_add_element(vpa, NPFVAR_FAM, &fam, sizeof(fam)))
goto out;
}
if (npfvar_get_count(vpa) == 0) {
yyerror("no addresses matched for interface '%s'", ifname);
goto out;
}
return npfvar_create_element(NPFVAR_INTERFACE, &ifna, sizeof(ifna));
out:
npfvar_destroy(ifna.ifna_addrs);
return NULL;
}
bool
npfctl_parse_cidr(char *cidr, fam_addr_mask_t *fam, int *alen)
{
char *mask, *p;
p = strchr(cidr, '\n');
if (p) {
*p = '\0';
}
mask = strchr(cidr, '/');
if (mask) {
*mask++ = '\0';
}
memset(fam, 0, sizeof(*fam));
if (!npfctl_parse_fam_addr(cidr, &fam->fam_family, &fam->fam_addr)) {
return false;
}
if (!npfctl_parse_mask(mask, fam->fam_family, &fam->fam_mask)) {
return false;
}
switch (fam->fam_family) {
case AF_INET:
*alen = sizeof(struct in_addr);
break;
case AF_INET6:
*alen = sizeof(struct in6_addr);
break;
default:
return false;
}
return true;
}
int
npfctl_protono(const char *proto)
{
struct protoent *pe;
pe = getprotobyname(proto);
if (pe == NULL) {
yyerror("unknown protocol '%s'", proto);
return -1;
}
return pe->p_proto;
}
/*
* npfctl_portno: convert port identifier (string) to a number.
*
* => Returns port number in host byte order.
*/
in_port_t
npfctl_portno(const char *port)
{
struct addrinfo *ai, *rai;
in_port_t p = 0;
int e;
e = getaddrinfo(NULL, port, NULL, &rai);
if (e != 0) {
yyerror("invalid port name '%s' (%s)", port, gai_strerror(e));
return 0;
}
for (ai = rai; ai; ai = ai->ai_next) {
switch (ai->ai_family) {
case AF_INET: {
struct sockaddr_in *sin = (void *)ai->ai_addr;
p = sin->sin_port;
goto out;
}
case AF_INET6: {
struct sockaddr_in6 *sin6 = (void *)ai->ai_addr;
p = sin6->sin6_port;
goto out;
}
default:
break;
}
}
out:
freeaddrinfo(rai);
return ntohs(p);
}
npfvar_t *
npfctl_parse_tcpflag(const char *s)
{
uint8_t tfl = 0;
while (*s) {
switch (*s) {
case 'F': tfl |= TH_FIN; break;
case 'S': tfl |= TH_SYN; break;
case 'R': tfl |= TH_RST; break;
case 'P': tfl |= TH_PUSH; break;
case 'A': tfl |= TH_ACK; break;
case 'U': tfl |= TH_URG; break;
case 'E': tfl |= TH_ECE; break;
case 'W': tfl |= TH_CWR; break;
default:
yyerror("invalid flag '%c'", *s);
return NULL;
}
s++;
}
return npfvar_create_element(NPFVAR_TCPFLAG, &tfl, sizeof(tfl));
}
uint8_t
npfctl_icmptype(int proto, const char *type)
{
#ifdef __NetBSD__
uint8_t ul;
switch (proto) {
case IPPROTO_ICMP:
for (ul = 0; icmp_type[ul]; ul++)
if (strcmp(icmp_type[ul], type) == 0)
return ul;
break;
case IPPROTO_ICMPV6:
for (ul = 0; icmp6_type_err[ul]; ul++)
if (strcmp(icmp6_type_err[ul], type) == 0)
return ul;
for (ul = 0; icmp6_type_info[ul]; ul++)
if (strcmp(icmp6_type_info[ul], type) == 0)
return ul + 128;
break;
default:
assert(false);
}
#else
(void)proto;
#endif
yyerror("unknown icmp-type %s", type);
return ~0;
}
uint8_t
npfctl_icmpcode(int proto, uint8_t type, const char *code)
{
#ifdef __NetBSD__
const char * const *arr;
switch (proto) {
case IPPROTO_ICMP:
switch (type) {
case ICMP_ECHOREPLY:
case ICMP_SOURCEQUENCH:
case ICMP_ALTHOSTADDR:
case ICMP_ECHO:
case ICMP_ROUTERSOLICIT:
case ICMP_TSTAMP:
case ICMP_TSTAMPREPLY:
case ICMP_IREQ:
case ICMP_IREQREPLY:
case ICMP_MASKREQ:
case ICMP_MASKREPLY:
arr = icmp_code_none;
break;
case ICMP_ROUTERADVERT:
arr = icmp_code_routeradvert;
break;
case ICMP_UNREACH:
arr = icmp_code_unreach;
break;
case ICMP_REDIRECT:
arr = icmp_code_redirect;
break;
case ICMP_TIMXCEED:
arr = icmp_code_timxceed;
break;
case ICMP_PARAMPROB:
arr = icmp_code_paramprob;
break;
case ICMP_PHOTURIS:
arr = icmp_code_photuris;
break;
default:
yyerror("unknown icmp-type %d while parsing code %s",
type, code);
return ~0;
}
break;
case IPPROTO_ICMPV6:
switch (type) {
case ICMP6_DST_UNREACH:
arr = icmp6_code_unreach;
break;
case ICMP6_TIME_EXCEEDED:
arr = icmp6_code_timxceed;
break;
case ICMP6_PARAM_PROB:
arr = icmp6_code_paramprob;
break;
case ICMP6_PACKET_TOO_BIG:
/* code-less info ICMPs */
case ICMP6_ECHO_REQUEST:
case ICMP6_ECHO_REPLY:
case MLD_LISTENER_QUERY:
case MLD_LISTENER_REPORT:
case MLD_LISTENER_DONE:
case ND_ROUTER_SOLICIT:
case ND_ROUTER_ADVERT:
case ND_NEIGHBOR_SOLICIT:
case ND_NEIGHBOR_ADVERT:
case ND_REDIRECT:
arr = icmp6_code_none;
break;
/* XXX TODO: info ICMPs with code values */
default:
yyerror("unknown icmp-type %d while parsing code %s",
type, code);
return ~0;
}
break;
default:
assert(false);
}
for (uint8_t ul = 0; arr[ul]; ul++) {
if (strcmp(arr[ul], code) == 0)
return ul;
}
#else
(void)proto;
#endif
yyerror("unknown code %s for icmp-type %d", code, type);
return ~0;
}
npfvar_t *
npfctl_parse_icmp(int proto __unused, int type, int code)
{
npfvar_t *vp = npfvar_create();
if (!npfvar_add_element(vp, NPFVAR_ICMP, &type, sizeof(type)))
goto out;
if (!npfvar_add_element(vp, NPFVAR_ICMP, &code, sizeof(code)))
goto out;
return vp;
out:
npfvar_destroy(vp);
return NULL;
}
filt_opts_t
npfctl_parse_l3filt_opt(npfvar_t *src_addr, npfvar_t *src_port, bool tnot,
npfvar_t *dst_addr, npfvar_t *dst_port, bool fnot, rid_t uid, rid_t gid)
{
filt_opts_t fopts;
fopts.filt.opt3.fo_from.ap_netaddr = src_addr;
fopts.filt.opt3.fo_from.ap_portrange = src_port;
fopts.fo_finvert = tnot;
fopts.filt.opt3.fo_to.ap_netaddr = dst_addr;
fopts.filt.opt3.fo_to.ap_portrange = dst_port;
fopts.fo_tinvert = fnot;
fopts.uid = uid;
fopts.gid = gid;
fopts.layer = NPF_RULE_LAYER_3;
return fopts;
}
filt_opts_t
npfctl_parse_l2filt_opt(npfvar_t *src_addr, bool fnot, npfvar_t *dst_addr,
bool tnot, uint16_t eth_type)
{
filt_opts_t fopts;
fopts.filt.opt2.from_mac = src_addr;
fopts.fo_finvert = fnot;
fopts.filt.opt2.to_mac = dst_addr;
fopts.fo_tinvert = tnot;
fopts.filt.opt2.ether_type = eth_type;
fopts.layer = NPF_RULE_LAYER_2;
return fopts;
}
#define atox(c) (((c) <= '9') ? ((c) - '0') : ((toupper(c) - 'A') + 10))
/*
* general function to parse ether type and mac address
*/
static void
parse_ether_hex(uint8_t *dest, const char *str, int hexlength, const char *err)
{
const uint8_t *cp = (const uint8_t *)str;
uint8_t *ep;
ep = dest + hexlength; /* check null terminated boundary */
while (*cp) {
if (!isxdigit(*cp))
yyerror("%s: %s", err, str);
*dest = atox(*cp);
cp++;
if (isxdigit(*cp)) {
*dest = (*dest << 4) | atox(*cp);
cp++;
}
dest++;
if (dest == ep) {
if (*cp == '\0')
return;
else
yyerror("%s: %s", err, str);
}
switch (*cp) {
case ':':
case '-':
case '.':
cp++;
break;
}
}
}
uint16_t
npfctl_parse_ether_type(const char *str)
{
#define ETHER_LEN 4
const char *err = "invalid ether type format";
uint8_t etype[2];
parse_ether_hex(etype, str + 2, ETHER_LEN, err);
uint16_t *e_type = (uint16_t *)etype; /* fetch the whole two byte blocks */
return *e_type;
}
npfvar_t *
npfctl_parse_mac_addr(const char *mac_addr)
{
const char *err = "invalid mac address format";
struct ether_addr *ether;
uint8_t addr[ETHER_ADDR_LEN];
ether = (struct ether_addr *)addr;
parse_ether_hex(addr, mac_addr, ETHER_ADDR_LEN, err);
return npfvar_create_element(NPFVAR_MAC, ether, sizeof(*ether));
}
/*
* npfctl_npt66_calcadj: calculate the adjustment for NPTv6 as per RFC 6296.
*/
uint16_t
npfctl_npt66_calcadj(npf_netmask_t len, const npf_addr_t *pref_in,
const npf_addr_t *pref_out)
{
const uint16_t *addr6_in = (const uint16_t *)pref_in;
const uint16_t *addr6_out = (const uint16_t *)pref_out;
unsigned i, remnant, wordmask, preflen = len >> 4;
uint32_t adj, isum = 0, osum = 0;
/*
* Extract the bits within a 16-bit word (when prefix length is
* not dividable by 16) and include them into the sum.
*/
remnant = len - (preflen << 4);
wordmask = (1U << remnant) - 1;
assert(wordmask == 0 || (len % 16) != 0);
/* Inner prefix - sum and fold. */
for (i = 0; i < preflen; i++) {
isum += addr6_in[i];
}
isum += addr6_in[i] & wordmask;
while (isum >> 16) {
isum = (isum >> 16) + (isum & 0xffff);
}
/* Outer prefix - sum and fold. */
for (i = 0; i < preflen; i++) {
osum += addr6_out[i];
}
osum += addr6_out[i] & wordmask;
while (osum >> 16) {
osum = (osum >> 16) + (osum & 0xffff);
}
/* Calculate 1's complement difference. */
adj = isum + ~osum;
while (adj >> 16) {
adj = (adj >> 16) + (adj & 0xffff);
}
return (uint16_t)adj;
}
