* Copyright (c) 2013-2025 The NetBSD Foundation, Inc.

/*-
* Copyright (c) 2013-2025 The NetBSD Foundation, Inc.
* All rights reserved.
*
* This code is derived from software contributed to The NetBSD Foundation
* by Mindaugas Rasiukevicius.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/

/*
* NPF configuration printing.
*
* Each rule having BPF byte-code has a binary description.
*/

#include <sys/cdefs.h>
__RCSID("$NetBSD: npf_show.c,v 1.38 2025/07/08 14:02:16 joe Exp $");

#include <sys/socket.h>
#define __FAVOR_BSD
#include <netinet/in.h>
#include <netinet/tcp.h>
#include <net/if.h>

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdbool.h>
#include <inttypes.h>
#include <errno.h>
#include <err.h>

#include "npfctl.h"

#define SEEN_PROTO 0x01

typedef struct {
char ** values;
unsigned count;
} elem_list_t;

enum {
LIST_PROTO = 0, LIST_SADDR, LIST_DADDR, LIST_SPORT, LIST_DPORT,
LIST_COUNT,
};

enum {
LIST_E_SADDR = 0, LIST_E_DADDR, LIST_ETYPE,
LIST_E_COUNT,
};

typedef struct {
nl_config_t * conf;
bool validating;

FILE * fp;
long fpos;
long fposln;
int glevel;

unsigned flags;
uint32_t curmark;
uint64_t seen_marks;
elem_list_t list[LIST_COUNT];

} npf_conf_info_t;

static void print_linesep(npf_conf_info_t *);

static npf_conf_info_t *
npfctl_show_init(void)
{
static npf_conf_info_t stdout_ctx;
memset(&stdout_ctx, 0, sizeof(npf_conf_info_t));
stdout_ctx.glevel = -1;
stdout_ctx.fp = stdout;
return &stdout_ctx;
}

static void
list_push(elem_list_t *list, char *val)
{
const unsigned n = list->count;
char **values;

if ((values = calloc(n + 1, sizeof(char *))) == NULL) {
err(EXIT_FAILURE, "calloc");
}
for (unsigned i = 0; i < n; i++) {
values[i] = list->values[i];
}
values[n] = val;
free(list->values);
list->values = values;
list->count++;
}

static char *
list_join_free(elem_list_t *list, const bool use_br, const char *sep)
{
char *s, buf[2048];

if (!join(buf, sizeof(buf), list->count, list->values, sep)) {
errx(EXIT_FAILURE, "out of memory while parsing the rule");
}
easprintf(&s, (use_br && list->count > 1) ? "{ %s }" : "%s", buf);
for (unsigned i = 0; i < list->count; i++) {
free(list->values[i]);
}
free(list->values);
list->values = NULL;
list->count = 0;
return s;
}

/*
* Helper routines to print various pieces of information.
*/

static void
print_indent(npf_conf_info_t *ctx, unsigned level)
{
if (ctx->glevel >= 0 && level <= (unsigned)ctx->glevel) {
/*
* Level decrease -- end of the group.
* Print the group closing curly bracket.
*/
ctx->fpos += fprintf(ctx->fp, "}\n\n");
ctx->glevel = -1;
}
while (level--) {
ctx->fpos += fprintf(ctx->fp, "\t");
}
}

static void
print_linesep(npf_conf_info_t *ctx)
{
if (ctx->fpos != ctx->fposln) {
ctx->fpos += fprintf(ctx->fp, "\n");
ctx->fposln = ctx->fpos;
}
}

static size_t
tcpflags2string(char *buf, unsigned tfl)
{
unsigned i = 0;

if (tfl & TH_FIN) buf[i++] = 'F';
if (tfl & TH_SYN) buf[i++] = 'S';
if (tfl & TH_RST) buf[i++] = 'R';
if (tfl & TH_PUSH) buf[i++] = 'P';
if (tfl & TH_ACK) buf[i++] = 'A';
if (tfl & TH_URG) buf[i++] = 'U';
if (tfl & TH_ECE) buf[i++] = 'E';
if (tfl & TH_CWR) buf[i++] = 'W';
buf[i] = '\0';
return i;
}

static char *
print_family(npf_conf_info_t *ctx __unused, const uint32_t *words)
{
const int af = words[0];

switch (af) {
case AF_INET:
return estrdup("inet4");
case AF_INET6:
return estrdup("inet6");
default:
errx(EXIT_FAILURE, "invalid byte-code mark (family)");
}
return NULL;
}

static char *
print_address(npf_conf_info_t *ctx __unused, const uint32_t *words)
{
const int af = *words++;
const unsigned mask = *words++;
const npf_addr_t *addr;
int alen = 0;

switch (af) {
case AF_INET:
alen = 4;
break;
case AF_INET6:
alen = 16;
break;
default:
errx(EXIT_FAILURE, "invalid byte-code mark (address)");
}
addr = (const npf_addr_t *)words;
return npfctl_print_addrmask(alen, "%a", addr, mask);
}

static char *
print_number(npf_conf_info_t *ctx __unused, const uint32_t *words)
{
char *p;
easprintf(&p, "%u", words[0]);
return p;
}

static char *
print_table(npf_conf_info_t *ctx, const uint32_t *words)
{
const unsigned tid = words[0];
const char *tname;
char *s = NULL;
bool ifaddr;

tname = npfctl_table_getname(ctx->conf, tid, &ifaddr);
easprintf(&s, ifaddr ? "ifaddrs(%s)" : "<%s>", tname);
return s;
}

static char *
print_proto(npf_conf_info_t *ctx, const uint32_t *words)
{
ctx->flags |= SEEN_PROTO;
switch (words[0]) {
case IPPROTO_TCP:
return estrdup("tcp");
case IPPROTO_UDP:
return estrdup("udp");
case IPPROTO_ICMP:
return estrdup("icmp");
case IPPROTO_ICMPV6:
return estrdup("ipv6-icmp");
}
return print_number(ctx, words);
}

static char *
print_tcpflags(npf_conf_info_t *ctx __unused, const uint32_t *words)
{
const unsigned tf = words[0], tf_mask = words[1];
char buf[32];
size_t n;

if ((ctx->flags & SEEN_PROTO) == 0) {
/*
* Note: the TCP flag matching might be without 'proto tcp'
* when using a plain 'stateful' rule. In such case, just
* skip showing of the flags as they are implicit.
*/
return NULL;
}
n = tcpflags2string(buf, tf);
if (tf != tf_mask) {
buf[n++] = '/';
tcpflags2string(buf + n, tf_mask);
}
return estrdup(buf);
}

static char *
print_portrange(npf_conf_info_t *ctx __unused, const uint32_t *words)
{
unsigned fport = words[0], tport = words[1];
char *p;

if (fport != tport) {
easprintf(&p, "%u-%u", fport, tport);
} else {
easprintf(&p, "%u", fport);
}
return p;
}

static char *
print_ether_address(npf_conf_info_t *ctx __unused, const uint32_t *nwords)
{
const struct ether_addr* addr = (const struct ether_addr *)nwords;
char *a;

_DIAGASSERT(addr != NULL);

easprintf(&a, "%02x:%02x:%02x:%02x:%02x:%02x",
addr->ether_addr_octet[0], addr->ether_addr_octet[1],
addr->ether_addr_octet[2], addr->ether_addr_octet[3],
addr->ether_addr_octet[4], addr->ether_addr_octet[5]);
return a;
}

static char *
print_ether_type(npf_conf_info_t *ctx __unused, const uint32_t *words)
{
const uint8_t *type = (const uint8_t *)words;
char *a;

_DIAGASSERT(type != NULL);

easprintf(&a, "Ex%02x%02x", type[0], type[1]);

return a;
}

/*
* The main keyword mapping tables defining the syntax:
* - Mapping of rule attributes (flags) to the keywords.
* - Mapping of the byte-code marks to the keywords.
*/

#define F(name) __CONCAT(NPF_RULE_, name)
#define STATEFUL_ALL (NPF_RULE_STATEFUL | NPF_RULE_GSTATEFUL)
#define NAME_AT 2

static const struct attr_keyword_mapent {
uint32_t mask;
uint32_t flags;
const char * val;
} attr_keyword_map[] = {
{ F(GROUP)|F(DYNAMIC), F(GROUP), "group" },
{ F(GROUP)|F(DYNAMIC), F(GROUP)|F(DYNAMIC), "ruleset" },
{ F(GROUP)|F(PASS), 0, "block" },
{ F(GROUP)|F(PASS), F(PASS), "pass" },
{ F(GROUP)|F(PASS)|F(LAYER_2), F(LAYER_2), "ether" },
{ F(GROUP)|F(PASS)|F(LAYER_2), F(LAYER_2)|F(PASS), "ether" },
{ F(RETRST)|F(RETICMP), F(RETRST)|F(RETICMP), "return" },
{ F(RETRST)|F(RETICMP), F(RETRST), "return-rst" },
{ F(RETRST)|F(RETICMP), F(RETICMP), "return-icmp" },
{ STATEFUL_ALL, F(STATEFUL), "stateful" },
{ STATEFUL_ALL, STATEFUL_ALL, "stateful-all" },
{ F(DIMASK), F(IN), "in" },
{ F(DIMASK), F(OUT), "out" },
{ F(FINAL), F(FINAL), "final" },
};

static const struct mark_keyword_mapent {
unsigned mark;
const char * format;
int list_id;
char * (*printfn)(npf_conf_info_t *, const uint32_t *);
unsigned fwords;
} mark_keyword_map[] = {
{ BM_IPVER, "family %s", LIST_PROTO, print_family, 1 },
{ BM_PROTO, "proto %s", LIST_PROTO, print_proto, 1 },
{ BM_TCPFL, "flags %s", LIST_PROTO, print_tcpflags, 2 },
{ BM_ICMP_TYPE, "icmp-type %s", LIST_PROTO, print_number, 1 },
{ BM_ICMP_CODE, "code %s", LIST_PROTO, print_number, 1 },

{ BM_SRC_NEG, NULL, -1, NULL, 0 },
{ BM_SRC_CIDR, NULL, LIST_SADDR, print_address, 6 },
{ BM_SRC_TABLE, NULL, LIST_SADDR, print_table, 1 },
{ BM_SRC_PORTS, NULL, LIST_SPORT, print_portrange,2 },

{ BM_DST_NEG, NULL, -1, NULL, 0 },
{ BM_DST_CIDR, NULL, LIST_DADDR, print_address, 6 },
{ BM_DST_TABLE, NULL, LIST_DADDR, print_table, 1 },
{ BM_DST_PORTS, NULL, LIST_DPORT, print_portrange,2 },
}, mark_keyword_mapl2[] = {
{BM_SRC_ENEG, NULL, -1, NULL, 0 },
{BM_SRC_ETHER, NULL, LIST_E_SADDR, print_ether_address, 2 },

{BM_DST_ENEG, NULL, -1, NULL, 0 },
{BM_DST_ETHER, NULL, LIST_E_DADDR, print_ether_address, 2 },
{BM_ETHER_TYPE, "type %s", LIST_ETYPE, print_ether_type,1 }
};

static const char * __attribute__((format_arg(2)))
verified_fmt(const char *fmt, const char *t __unused)
{
return fmt;
}

static void
scan_marks(npf_conf_info_t *ctx, const struct mark_keyword_mapent *mk,
const uint32_t *marks, size_t mlen)
{
elem_list_t sublist, *target_list;

/*
* If format is used for this mark, then collect multiple elements
* in into the list, merge and re-push the set into the target list.
*
* Currently, this is applicable only for 'proto { tcp, udp }'.
*/
memset(&sublist, 0, sizeof(elem_list_t));
target_list = mk->format ? &sublist : &ctx->list[mk->list_id];

/* Scan for the marks and extract the values. */
mlen /= sizeof(uint32_t);
while (mlen > 2) {
const uint32_t m = *marks++;
const unsigned nwords = *marks++;

if ((mlen -= 2) < nwords) {
errx(EXIT_FAILURE, "byte-code marking inconsistency");
}
if (m == mk->mark) {
/*
* Set the current mark and note it as seen.
* Value is processed by the print function,
* otherwise we just need to note the mark.
*/
ctx->curmark = m;
assert(BM_COUNT < (sizeof(uint64_t) * CHAR_BIT));
ctx->seen_marks |= UINT64_C(1) << m;
assert(mk->fwords == nwords);

if (mk->printfn) {
char *val;

if ((val = mk->printfn(ctx, marks)) != NULL) {
list_push(target_list, val);
}
}
}
marks += nwords;
mlen -= nwords;
}

if (sublist.count) {
char *val, *elements;

elements = list_join_free(&sublist, true, ", ");
easprintf(&val, verified_fmt(mk->format, "%s"), elements );
list_push(&ctx->list[mk->list_id], val);
free(elements);
}
}

static void
npfctl_print_id(npf_conf_info_t *ctx, nl_rule_t *rl)
{
const uint64_t id = npf_rule_getid(rl);

if (id) {
ctx->fpos += fprintf(ctx->fp, "# id=\"%" PRIx64 "\" ", id);
}
}

static void
npfctl_print_filter_generic(npf_conf_info_t *ctx, uint32_t plist)
{
assert(plist < LIST_COUNT);
elem_list_t *list = &ctx->list[plist];

if (list->count) {
char *elements = list_join_free(list, false, " ");
ctx->fpos += fprintf(ctx->fp, "%s ", elements);
free(elements);
}
}

static bool
npfctl_print_filter_seg(npf_conf_info_t *ctx, unsigned which)
{
static const struct {
const char * keyword;
unsigned alist;
unsigned plist;
unsigned negbm;
} refs[] = {
[NPF_SRC] = {
.keyword = "from",
.alist = LIST_SADDR,
.plist = LIST_SPORT,
.negbm = UINT64_C(1) << BM_SRC_NEG,
},
[NPF_DST] = {
.keyword = "to",
.alist = LIST_DADDR,
.plist = LIST_DPORT,
.negbm = UINT64_C(1) << BM_DST_NEG,
}
};
const char *neg = !!(ctx->seen_marks & refs[which].negbm) ? "! " : "";
const char *kwd = refs[which].keyword;
bool seen_filter = false;
elem_list_t *list;
char *elements;

list = &ctx->list[refs[which].alist];
if (list->count != 0) {
seen_filter = true;
elements = list_join_free(list, true, ", ");
ctx->fpos += fprintf(ctx->fp, "%s %s%s ", kwd, neg, elements);
free(elements);
}

list = &ctx->list[refs[which].plist];
if (list->count != 0) {
if (!seen_filter) {
ctx->fpos += fprintf(ctx->fp, "%s any ", kwd);
seen_filter = true;
}
elements = list_join_free(list, true, ", ");
ctx->fpos += fprintf(ctx->fp, "port %s ", elements);
free(elements);
}
return seen_filter;
}

static bool
npfctl_print_l2filter_seg(npf_conf_info_t *ctx, unsigned which)
{
static const struct {
const char * keyword;
unsigned alist;
unsigned negbm;
} refs[] = {
[NPF_SRC] = {
.keyword = "from",
.alist = LIST_E_SADDR,
.negbm = UINT64_C(1) << BM_SRC_ENEG,
},
[NPF_DST] = {
.keyword = "to",
.alist = LIST_E_DADDR,
.negbm = UINT64_C(1) << BM_DST_ENEG,
}
};
const char *neg = !!(ctx->seen_marks & refs[which].negbm) ? "! " : "";
const char *kwd = refs[which].keyword;
bool seen_filter = false;
elem_list_t *list;
char *elements;

list = &ctx->list[refs[which].alist];
if (list->count != 0) {
seen_filter = true;
elements = list_join_free(list, true, ", ");
ctx->fpos += fprintf(ctx->fp, "%s %s%s ", kwd, neg, elements);
free(elements);
}

return seen_filter;
}

static bool
npfctl_print_filter(npf_conf_info_t *ctx, nl_rule_t *rl, uint32_t attr)
{
const void *marks;
size_t mlen, len;
const void *code;
bool seenf = false;
int type;

marks = npf_rule_getinfo(rl, &mlen);
if (!marks && (code = npf_rule_getcode(rl, &type, &len)) != NULL) {
/*
* No marks, but the byte-code is present. This must
* have been filled by libpcap(3) or possibly an unknown
* to us byte-code.
*/
ctx->fpos += fprintf(ctx->fp, "%s ", type == NPF_CODE_BPF ?
"pcap-filter \"...\"" : "unrecognized-bytecode");
return true;
}
ctx->flags = 0;

/*
* BPF filter criteria described by the byte-code marks.
*/
ctx->seen_marks = 0;
if (attr & NPF_RULE_LAYER_2) {
for (unsigned i = 0; i < __arraycount(mark_keyword_mapl2); i++) {
const struct mark_keyword_mapent *mk = &mark_keyword_mapl2[i];
scan_marks(ctx, mk, marks, mlen);
}
seenf |= npfctl_print_l2filter_seg(ctx, NPF_SRC);
seenf |= npfctl_print_l2filter_seg(ctx, NPF_DST);
npfctl_print_filter_generic(ctx, LIST_ETYPE);
} else if (attr & NPF_RULE_LAYER_3) {
for (unsigned i = 0; i < __arraycount(mark_keyword_map); i++) {
const struct mark_keyword_mapent *mk = &mark_keyword_map[i];
scan_marks(ctx, mk, marks, mlen);
}
npfctl_print_filter_generic(ctx, LIST_PROTO);
seenf |= npfctl_print_filter_seg(ctx, NPF_SRC);
seenf |= npfctl_print_filter_seg(ctx, NPF_DST);
} else {
yyerror("%s: layer not supported", __func__);
}
return seenf;
}

static char *
print_guid(char *buf, struct r_id id, int size)
{
if (id.op == NPF_OP_XRG) {
snprintf(buf, size, "%u <> %u", id.id[0], id.id[1]);
} else if (id.op == NPF_OP_IRG) {
snprintf(buf, size, "%u >< %u", id.id[0], id.id[1]);
} else if (id.op == NPF_OP_EQ ) {
snprintf(buf, size, "%u", id.id[0]);
} else if (id.op == NPF_OP_NE) {
snprintf(buf, size, "!= %u", id.id[0]);
} else if (id.op == NPF_OP_LE) {
snprintf(buf, size, "<= %u", id.id[0]);
} else if (id.op == NPF_OP_LT) {
snprintf(buf, size, "< %u", id.id[0]);
} else if (id.op == NPF_OP_GE) {
snprintf(buf, size, ">= %u", id.id[0]);
} else if (id.op == NPF_OP_GT) {
snprintf(buf, size, "> %u", id.id[0]);
} else {
return NULL;
}
return buf;
}
#define BUF_SIZE 40
static void
npfctl_print_rule(npf_conf_info_t *ctx, nl_rule_t *rl, unsigned level)
{
const uint32_t attr = npf_rule_getattr(rl);
const char *rproc, *ifname, *name;
bool dyn_ruleset;
struct r_id rid;
char buf[BUF_SIZE];

/* Rule attributes/flags. */
for (unsigned i = 0; i < __arraycount(attr_keyword_map); i++) {
const struct attr_keyword_mapent *ak = &attr_keyword_map[i];

if (i == NAME_AT && (name = npf_rule_getname(rl)) != NULL) {
ctx->fpos += fprintf(ctx->fp, "\"%s\" ", name);
}
if ((attr & ak->mask) == ak->flags) {
ctx->fpos += fprintf(ctx->fp, "%s ", ak->val);
}
}
if ((ifname = npf_rule_getinterface(rl)) != NULL) {
ctx->fpos += fprintf(ctx->fp, "on %s ", ifname);
}
if (attr == (NPF_RULE_GROUP | NPF_RULE_IN | NPF_RULE_OUT | NPF_RULE_LAYER_3) && !ifname) {
/* The default group is a special case. */
ctx->fpos += fprintf(ctx->fp, "default ");
}
if (attr == (NPF_RULE_GROUP | NPF_RULE_IN | NPF_RULE_OUT | NPF_RULE_LAYER_2) && !ifname) {
/* The default group is a special case. */
ctx->fpos += fprintf(ctx->fp, "default layer-2 ");
}
if (attr == (NPF_RULE_GROUP | NPF_RULE_IN | NPF_RULE_LAYER_2)) {
ctx->fpos += fprintf(ctx->fp, "layer-2 ");
}
if (attr == (NPF_RULE_GROUP | NPF_RULE_OUT | NPF_RULE_LAYER_2)) {
ctx->fpos += fprintf(ctx->fp, "layer-2 ");
}
if ((attr & NPF_DYNAMIC_GROUP) == NPF_RULE_GROUP) {
/* Group; done. */
ctx->fpos += fprintf(ctx->fp, "{ ");
ctx->glevel = level;
goto out;
}

/* Print filter criteria. */
dyn_ruleset = (attr & NPF_DYNAMIC_GROUP) == NPF_DYNAMIC_GROUP;
if (!npfctl_print_filter(ctx, rl, attr) && !dyn_ruleset) {
ctx->fpos += fprintf(ctx->fp, "all ");
}

if (!npf_rule_getrid(&rid, rl, "r_user")) {
ctx->fpos += fprintf(ctx->fp, "user %s ", print_guid(buf, rid, BUF_SIZE));
}

if (!npf_rule_getrid(&rid, rl, "r_group")) {
ctx->fpos += fprintf(ctx->fp, "group %s ", print_guid(buf, rid, BUF_SIZE));
}

/* Rule procedure. */
if ((rproc = npf_rule_getproc(rl)) != NULL) {
ctx->fpos += fprintf(ctx->fp, "apply \"%s\" ", rproc);
}
out:
npfctl_print_id(ctx, rl);
ctx->fpos += fprintf(ctx->fp, "\n");
}

static void
npfctl_print_nat(npf_conf_info_t *ctx, nl_nat_t *nt)
{
const unsigned dynamic_natset = NPF_RULE_GROUP | NPF_RULE_DYNAMIC;
nl_rule_t *rl = (nl_nat_t *)nt;
const char *ifname, *algo, *seg1, *seg2, *arrow;
const npf_addr_t *addr;
npf_netmask_t mask;
in_port_t port;
size_t alen;
unsigned flags;
char *seg;
uint32_t attr = npf_rule_getattr(rl);

/* Get flags and the interface. */
flags = npf_nat_getflags(nt);
ifname = npf_rule_getinterface(rl);
assert(ifname != NULL);

if ((attr & dynamic_natset) == dynamic_natset) {
const char *name = npf_rule_getname(rl);
ctx->fpos += fprintf(ctx->fp,
"map ruleset \"%s\" on %s\n", name, ifname);
return;
}

/* Get the translation address or table (and port, if used). */
addr = npf_nat_getaddr(nt, &alen, &mask);
if (addr) {
seg = npfctl_print_addrmask(alen, "%a", addr, mask);
} else {
const unsigned tid = npf_nat_gettable(nt);
const char *tname;
bool ifaddr;

tname = npfctl_table_getname(ctx->conf, tid, &ifaddr);
easprintf(&seg, ifaddr ? "ifaddrs(%s)" : "<%s>", tname);
}

if ((port = npf_nat_getport(nt)) != 0) {
char *p;
easprintf(&p, "%s port %u", seg, ntohs(port));
free(seg), seg = p;
}
seg1 = seg2 = "any";

/* Get the NAT type and determine the translation segment. */
switch (npf_nat_gettype(nt)) {
case NPF_NATIN:
arrow = "<-";
seg1 = seg;
break;
case NPF_NATOUT:
arrow = "->";
seg2 = seg;
break;
default:
abort();
}

/* NAT algorithm. */
switch (npf_nat_getalgo(nt)) {
case NPF_ALGO_NETMAP:
algo = "algo netmap ";
break;
case NPF_ALGO_IPHASH:
algo = "algo ip-hash ";
break;
case NPF_ALGO_RR:
algo = "algo round-robin ";
break;
case NPF_ALGO_NPT66:
algo = "algo npt66 ";
break;
default:
algo = "";
break;
}

/* XXX also handle "any" */

/* Print out the NAT policy with the filter criteria. */
ctx->fpos += fprintf(ctx->fp, "map %s %s %s%s%s %s %s pass ",
ifname, (flags & NPF_NAT_STATIC) ? "static" : "dynamic",
algo, (flags & NPF_NAT_PORTS) ? "" : "no-ports ",
seg1, arrow, seg2);
npfctl_print_filter(ctx, rl, attr);
npfctl_print_id(ctx, rl);
ctx->fpos += fprintf(ctx->fp, "\n");
free(seg);
}

static void
npfctl_print_table(npf_conf_info_t *ctx, nl_table_t *tl)
{
const char *name = npf_table_getname(tl);
const unsigned type = npf_table_gettype(tl);
const char *table_types[] = {
[NPF_TABLE_IPSET] = "ipset",
[NPF_TABLE_LPM] = "lpm",
[NPF_TABLE_CONST] = "const",
};

if (name[0] == '.') {
/* Internal tables use dot and are hidden. */
return;
}
assert(type < __arraycount(table_types));
ctx->fpos += fprintf(ctx->fp,
"table <%s> type %s\n", name, table_types[type]);
}

static void
npfctl_print_params(npf_conf_info_t *ctx, nl_config_t *ncf)
{
nl_iter_t i = NPF_ITER_BEGIN;
int val, defval, *dval;
const char *name;

dval = ctx->validating ? NULL : &defval;
while ((name = npf_param_iterate(ncf, &i, &val, dval)) != NULL) {
if (dval && val == *dval) {
continue;
}
ctx->fpos += fprintf(ctx->fp, "set %s %d\n", name, val);
}
print_linesep(ctx);
}

int
npfctl_config_show(int fd)
{
npf_conf_info_t *ctx = npfctl_show_init();
nl_config_t *ncf;
bool loaded;

if (fd) {
ncf = npf_config_retrieve(fd);
if (ncf == NULL) {
return errno;
}
loaded = npf_config_loaded_p(ncf);
ctx->validating = false;
ctx->fpos += fprintf(ctx->fp,
"# filtering:\t%s\n# config:\t%s\n",
npf_config_active_p(ncf) ? "active" : "inactive",
loaded ? "loaded" : "empty");
print_linesep(ctx);
} else {
ncf = npfctl_config_ref();
npfctl_config_build();
ctx->validating = true;
loaded = true;
}
ctx->conf = ncf;

if (loaded) {
nl_rule_t *rl;
nl_rproc_t *rp;
nl_nat_t *nt;
nl_table_t *tl;
nl_iter_t i;
unsigned level;

npfctl_print_params(ctx, ncf);

i = NPF_ITER_BEGIN;
while ((tl = npf_table_iterate(ncf, &i)) != NULL) {
npfctl_print_table(ctx, tl);
}
print_linesep(ctx);

i = NPF_ITER_BEGIN;
while ((rp = npf_rproc_iterate(ncf, &i)) != NULL) {
const char *rpname = npf_rproc_getname(rp);
ctx->fpos += fprintf(ctx->fp,
"procedure \"%s\"\n", rpname);
}
print_linesep(ctx);

i = NPF_ITER_BEGIN;
while ((nt = npf_nat_iterate(ncf, &i)) != NULL) {
npfctl_print_nat(ctx, nt);
}
print_linesep(ctx);

i = NPF_ITER_BEGIN;
while ((rl = npf_rule_iterate(ncf, &i, &level)) != NULL) {
print_indent(ctx, level);
npfctl_print_rule(ctx, rl, level);
}
print_indent(ctx, 0);
}
npf_config_destroy(ncf);
return 0;
}

int
npfctl_ruleset_show(int fd, const char *ruleset_name)
{
npf_conf_info_t *ctx = npfctl_show_init();
nl_config_t *ncf;
nl_rule_t *rl;
unsigned level;
nl_iter_t i;
int error;

ncf = npf_config_create();
ctx->conf = ncf;

if ((error = _npf_ruleset_list(fd, ruleset_name, ncf)) != 0) {
return error;
}
i = NPF_ITER_BEGIN;
while ((rl = npf_rule_iterate(ncf, &i, &level)) != NULL) {
npfctl_print_rule(ctx, rl, 0);
}
npf_config_destroy(ncf);
return error;
}