/*-
* Copyright (c) 2009-2025 The NetBSD Foundation, Inc.
* All rights reserved.
*
* This material is based upon work partially supported by The
* NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/

#ifndef _NPFCTL_H_
#define _NPFCTL_H_

#include <stdio.h>
#include <stdbool.h>
#include <inttypes.h>
#include <assert.h>
#include <util.h>

#define NPF_BPFCOP
#include <net/npf.h>

#define _NPF_PRIVATE
#include <npf.h>

#include "npf_var.h"

#define NPF_DEV_PATH    "/dev/npf"
#define NPF_CONF_PATH   "/etc/npf.conf"
#define NPF_DB_PATH     "/var/db/npf.db"

typedef struct fam_addr_mask {
       sa_family_t     fam_family;
       npf_addr_t      fam_addr;
       npf_netmask_t   fam_mask;
       unsigned long   fam_ifindex;
} fam_addr_mask_t;

typedef struct ifnet_addr {
       char *          ifna_name;
       unsigned long   ifna_index;
       sa_family_t     ifna_family;
       npfvar_t *      ifna_filter;
       npfvar_t *      ifna_addrs;
} ifnet_addr_t;

typedef struct port_range {
       in_port_t       pr_start;
       in_port_t       pr_end;
} port_range_t;

typedef struct addr_port {
       npfvar_t *      ap_netaddr;
       npfvar_t *      ap_portrange;
} addr_port_t;

typedef struct l3 {
       addr_port_t     fo_from;
       addr_port_t     fo_to;
} opt3;

typedef struct l2 {
       npfvar_t *      from_mac;
       npfvar_t *      to_mac;
       uint16_t        ether_type;
} opt2;

typedef struct filt_opts {
       union {
               opt3 opt3;
               opt2 opt2;
       } filt;
       struct r_id     uid;
       struct r_id     gid;
       uint32_t layer;
       bool            fo_finvert;
       bool            fo_tinvert;
} filt_opts_t;

typedef struct opt_proto {
       int             op_proto;
       npfvar_t *      op_opts;
} opt_proto_t;

typedef struct rule_group {
       const char *    rg_name;
       uint32_t        rg_attr;
       const char *    rg_ifname;
       bool            rg_default;
} rule_group_t;

typedef struct proc_call {
       const char *    pc_name;
       npfvar_t *      pc_opts;
} proc_call_t;

typedef struct proc_param {
       const char *    pp_param;
       const char *    pp_value;
} proc_param_t;

typedef enum {
       NPFCTL_PARSE_DEFAULT,
       NPFCTL_PARSE_RULE,
       NPFCTL_PARSE_MAP
} parse_entry_t;

#define NPF_IFNET_TABLE_PREF            ".ifnet-"
#define NPF_IFNET_TABLE_PREFLEN         (sizeof(NPF_IFNET_TABLE_PREF) - 1)

void            yyerror(const char *, ...) __printflike(1, 2) __dead;
void            npfctl_bpfjit(bool);
void            npfctl_parse_file(const char *);
void            npfctl_parse_string(const char *, parse_entry_t);

bool            join(char *, size_t, int, char **, const char *);
bool            npfctl_addr_iszero(const npf_addr_t *);

void            npfctl_print_error(const npf_error_t *);
char *          npfctl_print_addrmask(int, const char *, const npf_addr_t *,
                   npf_netmask_t);
void            npfctl_note_interface(const char *);
nl_table_t *    npfctl_table_getbyname(nl_config_t *, const char *);
unsigned        npfctl_table_getid(const char *);
const char *    npfctl_table_getname(nl_config_t *, unsigned, bool *);
int             npfctl_protono(const char *);
in_port_t       npfctl_portno(const char *);
uint8_t         npfctl_icmpcode(int, uint8_t, const char *);
uint8_t         npfctl_icmptype(int, const char *);
npfvar_t *      npfctl_ifnet_table(const char *);
npfvar_t *      npfctl_parse_ifnet(const char *, const int);
npfvar_t *      npfctl_parse_tcpflag(const char *);
npfvar_t *      npfctl_parse_table_id(const char *);
npfvar_t *      npfctl_parse_icmp(int, int, int);
npfvar_t *      npfctl_parse_port_range(in_port_t, in_port_t);
npfvar_t *      npfctl_parse_port_range_variable(const char *, npfvar_t *);
npfvar_t *      npfctl_parse_fam_addr_mask(const char *, const char *,
                   unsigned long *);

int             npfctl_parse_user(const char *, uint32_t *);
int             npfctl_parse_group(const char *, uint32_t *);
void            npfctl_init_rid(rid_t *, uint32_t, uint32_t, uint8_t);
bool            npfctl_parse_cidr(char *, fam_addr_mask_t *, int *);
uint16_t        npfctl_npt66_calcadj(npf_netmask_t, const npf_addr_t *,
                   const npf_addr_t *);
filt_opts_t     npfctl_parse_l3filt_opt(npfvar_t *, npfvar_t *, bool,
           npfvar_t *, npfvar_t *, bool, rid_t, rid_t);
filt_opts_t     npfctl_parse_l2filt_opt(npfvar_t *, bool, npfvar_t *,
           bool, uint16_t);
       npfvar_t *      npfctl_parse_mac_addr(const char *);
       uint16_t        npfctl_parse_ether_type(const char *str);
int             npfctl_nat_ruleset_p(const char *, bool *);

void            usage(void);
void            npfctl_rule(int, int, char **);
void            npfctl_table_replace(int, int, char **);
void            npfctl_table(int, int, char **);
int             npfctl_conn_list(int, int, char **);

/*
* NPF extension loading.
*/

typedef struct npf_extmod npf_extmod_t;

npf_extmod_t *  npf_extmod_get(const char *, nl_ext_t **);
int             npf_extmod_param(npf_extmod_t *, nl_ext_t *,
                   const char *, const char *);

/*
* BFF byte-code generation interface.
*/

typedef struct npf_bpf npf_bpf_t;

#define MATCH_DST       0x01
#define MATCH_SRC       0x02
#define MATCH_INVERT    0x04

enum {
       BM_IPVER, BM_PROTO, BM_SRC_CIDR, BM_SRC_TABLE, BM_DST_CIDR,
       BM_DST_TABLE, BM_SRC_PORTS, BM_DST_PORTS, BM_TCPFL, BM_ICMP_TYPE,
       BM_ICMP_CODE, BM_SRC_NEG, BM_DST_NEG,

       BM_COUNT // total number of the marks
};

enum { /* book marks for L2 */
       BM_ETHER_TYPE, BM_SRC_ETHER, BM_DST_ETHER, BM_SRC_ENEG, BM_DST_ENEG,
};

npf_bpf_t *     npfctl_bpf_create(void);
struct bpf_program *npfctl_bpf_complete(npf_bpf_t *);
const void *    npfctl_bpf_bmarks(npf_bpf_t *, size_t *);
void            npfctl_bpf_destroy(npf_bpf_t *);

void            npfctl_bpf_group_enter(npf_bpf_t *, bool);
void            npfctl_bpf_group_exit(npf_bpf_t *);

void            npfctl_bpf_ipver(npf_bpf_t *, sa_family_t);
void            npfctl_bpf_proto(npf_bpf_t *, unsigned);
void            npfctl_bpf_cidr(npf_bpf_t *, u_int, sa_family_t,
                   const npf_addr_t *, const npf_netmask_t);
void            npfctl_bpf_ports(npf_bpf_t *, u_int, in_port_t, in_port_t);
void            npfctl_bpf_tcpfl(npf_bpf_t *, uint8_t, uint8_t);
void            npfctl_bpf_icmp(npf_bpf_t *, int, int);
void            npfctl_bpf_table(npf_bpf_t *, u_int, u_int);

void            npfctl_bpf_ether(npf_bpf_t *, unsigned, struct ether_addr *);
void            fetch_ether_type(npf_bpf_t *, uint16_t);

/*
* Configuration building interface.
*/

#define NPFCTL_NAT_DYNAMIC      1
#define NPFCTL_NAT_STATIC       2

void            npfctl_config_init(bool);
void            npfctl_config_build(void);
int             npfctl_config_send(int);
nl_config_t *   npfctl_config_ref(void);
int             npfctl_config_show(int);
void            npfctl_config_save(nl_config_t *, const char *);
int             npfctl_ruleset_show(int, const char *);

nl_rule_t *     npfctl_rule_ref(void);
nl_table_t *    npfctl_table_ref(void);
bool            npfctl_debug_addif(const char *);

nl_table_t *    npfctl_load_table(const char *, int, u_int, const char *, FILE *);

void            npfctl_build_alg(const char *);
void            npfctl_build_rproc(const char *, npfvar_t *);
void            npfctl_build_group(const char *, int, const char *, bool);
void            npfctl_build_group_end(void);
void            npfctl_build_rule(uint32_t, const char *, sa_family_t,
                   const npfvar_t *, const filt_opts_t *,
                   const char *, const char *);
void            npfctl_build_natseg(int, int, unsigned, const char *,
                   const addr_port_t *, const addr_port_t *,
                   const npfvar_t *, const filt_opts_t *, unsigned);
void            npfctl_build_maprset(const char *, int, const char *);
void            npfctl_build_table(const char *, u_int, const char *);

void            npfctl_setparam(const char *, int);

/*
* For the systems which do not define TH_ECE and TW_CRW.
*/
#ifndef TH_ECE
#define TH_ECE          0x40
#endif
#ifndef TH_CWR
#define TH_CWR          0x80
#endif

#endif

You are viewing proxied material from ftp.icm.edu.pl. The copyright of proxied material belongs to its original authors. Any comments or complaints in relation to proxied material should be directed to the original authors of the content concerned. Please see the disclaimer for more details.