Source-Changes-HG archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

[src/netbsd-9]: src Pull up following revision(s) (requested by rmind in tick...



details:   https://anonhg.NetBSD.org/src/rev/3c8608e95619
branches:  netbsd-9
changeset: 843325:3c8608e95619
user:      martin <martin%NetBSD.org@localhost>
date:      Fri Oct 04 08:06:34 2019 +0000

description:
Pull up following revision(s) (requested by rmind in ticket #282):

        usr.sbin/npf/npfctl/npf_build.c: revision 1.53
        lib/libnpf/npf.c: revision 1.48
        usr.sbin/npf/npfctl/npfctl.h: revision 1.50
        sys/net/npf/npf_impl.h: revision 1.80
        usr.sbin/npf/npfctl/npfctl.h: revision 1.51
        sys/net/npf/npf_ruleset.c: revision 1.49
        usr.sbin/npf/npfctl/npf.conf.5: revision 1.90
        sys/net/npf/npf_ctl.c: revision 1.59
        lib/libnpf/libnpf.3: revision 1.11
        usr.sbin/npf/npfctl/npf_parse.y: revision 1.50
        usr.sbin/npf/npftest/npftest.conf: revision 1.8
        usr.sbin/npf/npfctl/npfctl.c: revision 1.62
        usr.sbin/npf/npfctl/npfctl.c: revision 1.63
        usr.sbin/npf/npfctl/npf_scan.l: revision 1.30
        usr.sbin/npf/npfctl/npfctl.8: revision 1.22
        lib/libnpf/npf.h: revision 1.38
        usr.sbin/npf/npfctl/npfctl.8: revision 1.23
        usr.sbin/npf/npfctl/npfctl.8: revision 1.24
        sys/net/npf/npf_if.c: revision 1.11
        sys/net/npf/npf_if.c: revision 1.12
        usr.sbin/npf/npfctl/npf.conf.5: revision 1.89
        sys/net/npf/npf_conn.c: revision 1.30
        usr.sbin/npf/npfctl/npf_build.c: revision 1.52

npfctl: implement table replace subcommand.
Contributed by Timshel Knoll-Miller.

NPF ifmap: rework and fix a few small bugs.

npfctl: implement table replace subcommand.
Contributed by Timshel Knoll-Miller.
(missed a file in previous commit; cvs is so helpful..)

libnpf/npfctl: support dynamic NAT rulesets using a name prefix.

Use -width Pa for FILES.

Fix pasto in table replace -t type

Use -width Pa for FILES.

npf_ifmap_copylogname: be more defensive.

diffstat:

 lib/libnpf/libnpf.3               |   53 +++++++++-
 lib/libnpf/npf.c                  |   30 +++++-
 lib/libnpf/npf.h                  |    6 +
 sys/net/npf/npf_conn.c            |    5 +-
 sys/net/npf/npf_ctl.c             |    8 +-
 sys/net/npf/npf_if.c              |  209 ++++++++++++++++++++++---------------
 sys/net/npf/npf_impl.h            |    6 +-
 sys/net/npf/npf_ruleset.c         |    5 +-
 usr.sbin/npf/npfctl/npf.conf.5    |   17 ++-
 usr.sbin/npf/npfctl/npf_build.c   |  105 ++++++++++++++-----
 usr.sbin/npf/npfctl/npf_parse.y   |   28 ++--
 usr.sbin/npf/npfctl/npf_scan.l    |   27 ++++-
 usr.sbin/npf/npfctl/npfctl.8      |   51 +++++++--
 usr.sbin/npf/npfctl/npfctl.c      |  143 +++++++++++++++++++++++--
 usr.sbin/npf/npfctl/npfctl.h      |   13 ++-
 usr.sbin/npf/npftest/npftest.conf |    4 +-
 16 files changed, 532 insertions(+), 178 deletions(-)

diffs (truncated from 1412 to 300 lines):

diff -r 698cee3095f6 -r 3c8608e95619 lib/libnpf/libnpf.3
--- a/lib/libnpf/libnpf.3       Thu Oct 03 17:35:13 2019 +0000
+++ b/lib/libnpf/libnpf.3       Fri Oct 04 08:06:34 2019 +0000
@@ -1,4 +1,4 @@
-.\"    $NetBSD: libnpf.3,v 1.9.2.1 2019/09/01 13:13:13 martin Exp $
+.\"    $NetBSD: libnpf.3,v 1.9.2.2 2019/10/04 08:06:35 martin Exp $
 .\"
 .\" Copyright (c) 2011-2019 The NetBSD Foundation, Inc.
 .\" All rights reserved.
@@ -27,7 +27,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd August 21, 2019
+.Dd August 25, 2019
 .Dt LIBNPF 3
 .Os
 .Sh NAME
@@ -108,6 +108,15 @@
 .Fn npf_table_replace "int fd" "nl_table_t *tl" "npf_error_t *errinfo"
 .Ft void
 .Fn npf_table_destroy "nl_table_t *tl"
+.\" ---
+.Ft int
+.Fn npf_ruleset_add "int fd" "const char *name" "nl_rule_t *rl" "uint64_t *id"
+.Ft int
+.Fn npf_ruleset_remove "int fd" "const char *name" "uint64_t id"
+.Ft int
+.Fn npf_ruleset_remkey "int fd" "const char *name" "const void *key" "size_t len"
+.Ft int
+.Fn npf_ruleset_flush "int fd" "const char *name"
 .\" -----
 .Sh DESCRIPTION
 The
@@ -352,7 +361,9 @@
 may be specified to indicate the translation network;
 otherwise, it should be set to
 .Dv NPF_NO_NETMASK .
-In such case, a custom algorithm may need to be specified using the
+.Pp
+In order to use the translation network, a custom algorithm may need to
+be specified using the
 .Fn npf_nat_setalgo
 function.
 .\" ---
@@ -368,6 +379,9 @@
 Hash of the source and destination addresses.
 .It Dv NPF_ALGO_RR
 Round-robin for the translation addresses.
+.It Dv NPF_ALGO_NETMAP
+Network-to-network map as described below, but with state tracking.
+It is used when it is necessary to translate the ports.
 .El
 .Pp
 The following are support with static NAT:
@@ -450,6 +464,39 @@
 Destroy the specified table.
 .El
 .\" -----
+.Ss Ruleset interface
+.Bl -tag -width 4n
+.It Fn npf_ruleset_add "fd" "name" "rl" "id"
+Add a given rule, specified by
+.Fa rl ,
+into the dynamic ruleset named
+.Fa name .
+On success, return 0 and a unique rule ID in the
+.Fa id
+parameter.
+.It Fn npf_ruleset_remove "fd" "name" "id"
+Remove a rule from the dynamic ruleset, specified by
+.Fa name .
+The rule is specified by its unique ID in the
+.Fa id
+parameter.
+.It Fn npf_ruleset_remkey "fd" "name" "key" "len"
+Remove a rule from the dynamic ruleset, specified by
+.Fa name .
+The rule is specified by its key, in the
+.Fa key
+and
+.Fa len
+parameters.
+The key for the rule must have been set during its construction, using the
+.Fn npf_rule_setkey
+routine.
+.It Fn npf_ruleset_flush "fd" "name"
+Clear the dynamic ruleset, specified by
+.Fa name ,
+by removing all its rules.
+.El
+.\" -----
 .Sh SEE ALSO
 .Xr bpf 4 ,
 .Xr npf 7 ,
diff -r 698cee3095f6 -r 3c8608e95619 lib/libnpf/npf.c
--- a/lib/libnpf/npf.c  Thu Oct 03 17:35:13 2019 +0000
+++ b/lib/libnpf/npf.c  Fri Oct 04 08:06:34 2019 +0000
@@ -28,7 +28,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.46.2.1 2019/09/01 13:13:13 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.46.2.2 2019/10/04 08:06:35 martin Exp $");
 
 #include <sys/types.h>
 #include <sys/mman.h>
@@ -401,14 +401,31 @@
  * DYNAMIC RULESET INTERFACE.
  */
 
+static inline bool
+_npf_nat_ruleset_p(const char *name)
+{
+       return strncmp(name, NPF_RULESET_MAP_PREF,
+           sizeof(NPF_RULESET_MAP_PREF) - 1) == 0;
+}
+
 int
 npf_ruleset_add(int fd, const char *rname, nl_rule_t *rl, uint64_t *id)
 {
+       const bool natset = _npf_nat_ruleset_p(rname);
        nvlist_t *rule_dict = rl->rule_dict;
        nvlist_t *ret_dict;
 
+       nvlist_add_number(rule_dict, "attr",
+           NPF_RULE_DYNAMIC | nvlist_take_number(rule_dict, "attr"));
+
+       if (natset && !dnvlist_get_bool(rule_dict, "nat-rule", false)) {
+               errno = EINVAL;
+               return errno;
+       }
        nvlist_add_string(rule_dict, "ruleset-name", rname);
+       nvlist_add_bool(rule_dict, "nat-ruleset", natset);
        nvlist_add_number(rule_dict, "command", NPF_CMD_RULE_ADD);
+
        if (nvlist_xfer_ioctl(fd, IOC_NPF_RULE, rule_dict, &ret_dict) == -1) {
                return errno;
        }
@@ -419,11 +436,14 @@
 int
 npf_ruleset_remove(int fd, const char *rname, uint64_t id)
 {
+       const bool natset = _npf_nat_ruleset_p(rname);
        nvlist_t *rule_dict = nvlist_create(0);
 
        nvlist_add_string(rule_dict, "ruleset-name", rname);
+       nvlist_add_bool(rule_dict, "nat-ruleset", natset);
        nvlist_add_number(rule_dict, "command", NPF_CMD_RULE_REMOVE);
        nvlist_add_number(rule_dict, "id", id);
+
        if (nvlist_send_ioctl(fd, IOC_NPF_RULE, rule_dict) == -1) {
                return errno;
        }
@@ -433,11 +453,14 @@
 int
 npf_ruleset_remkey(int fd, const char *rname, const void *key, size_t len)
 {
+       const bool natset = _npf_nat_ruleset_p(rname);
        nvlist_t *rule_dict = nvlist_create(0);
 
        nvlist_add_string(rule_dict, "ruleset-name", rname);
+       nvlist_add_bool(rule_dict, "nat-ruleset", natset);
        nvlist_add_number(rule_dict, "command", NPF_CMD_RULE_REMKEY);
        nvlist_add_binary(rule_dict, "key", key, len);
+
        if (nvlist_send_ioctl(fd, IOC_NPF_RULE, rule_dict) == -1) {
                return errno;
        }
@@ -447,10 +470,13 @@
 int
 npf_ruleset_flush(int fd, const char *rname)
 {
+       const bool natset = _npf_nat_ruleset_p(rname);
        nvlist_t *rule_dict = nvlist_create(0);
 
        nvlist_add_string(rule_dict, "ruleset-name", rname);
+       nvlist_add_bool(rule_dict, "nat-ruleset", natset);
        nvlist_add_number(rule_dict, "command", NPF_CMD_RULE_FLUSH);
+
        if (nvlist_send_ioctl(fd, IOC_NPF_RULE, rule_dict) == -1) {
                return errno;
        }
@@ -678,10 +704,12 @@
 int
 _npf_ruleset_list(int fd, const char *rname, nl_config_t *ncf)
 {
+       const bool natset = _npf_nat_ruleset_p(rname);
        nvlist_t *req, *ret;
 
        req = nvlist_create(0);
        nvlist_add_string(req, "ruleset-name", rname);
+       nvlist_add_bool(req, "nat-ruleset", natset);
        nvlist_add_number(req, "command", NPF_CMD_RULE_LIST);
 
        if (nvlist_xfer_ioctl(fd, IOC_NPF_RULE, req, &ret) == -1) {
diff -r 698cee3095f6 -r 3c8608e95619 lib/libnpf/npf.h
--- a/lib/libnpf/npf.h  Thu Oct 03 17:35:13 2019 +0000
+++ b/lib/libnpf/npf.h  Fri Oct 04 08:06:34 2019 +0000
@@ -56,6 +56,12 @@
 typedef signed long            nl_iter_t;
 
 /*
+ * Ruleset prefix(es).
+ */
+
+#define        NPF_RULESET_MAP_PREF    "map:"
+
+/*
  * Extensions API types.
  */
 typedef int (*npfext_initfunc_t)(void);
diff -r 698cee3095f6 -r 3c8608e95619 sys/net/npf/npf_conn.c
--- a/sys/net/npf/npf_conn.c    Thu Oct 03 17:35:13 2019 +0000
+++ b/sys/net/npf/npf_conn.c    Fri Oct 04 08:06:34 2019 +0000
@@ -107,7 +107,7 @@
 
 #ifdef _KERNEL
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_conn.c,v 1.27.2.1 2019/08/07 08:28:37 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_conn.c,v 1.27.2.2 2019/10/04 08:06:35 martin Exp $");
 
 #include <sys/param.h>
 #include <sys/types.h>
@@ -782,7 +782,8 @@
        nvlist_add_number(cdict, "flags", con->c_flags);
        nvlist_add_number(cdict, "proto", con->c_proto);
        if (con->c_ifid) {
-               const char *ifname = npf_ifmap_getname(npf, con->c_ifid);
+               char ifname[IFNAMSIZ];
+               npf_ifmap_copyname(npf, con->c_ifid, ifname, sizeof(ifname));
                nvlist_add_string(cdict, "ifname", ifname);
        }
        nvlist_add_binary(cdict, "state", &con->c_state, sizeof(npf_state_t));
diff -r 698cee3095f6 -r 3c8608e95619 sys/net/npf/npf_ctl.c
--- a/sys/net/npf/npf_ctl.c     Thu Oct 03 17:35:13 2019 +0000
+++ b/sys/net/npf/npf_ctl.c     Fri Oct 04 08:06:34 2019 +0000
@@ -36,7 +36,7 @@
 
 #ifdef _KERNEL
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_ctl.c,v 1.54.2.3 2019/09/01 13:21:39 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_ctl.c,v 1.54.2.4 2019/10/04 08:06:35 martin Exp $");
 
 #include <sys/param.h>
 #include <sys/conf.h>
@@ -196,7 +196,7 @@
                goto out;
        }
 
-       t = npf_table_create(name, (u_int)tid, type, blob, size);
+       t = npf_table_create(name, (unsigned)tid, type, blob, size);
        if (t == NULL) {
                NPF_ERR_DEBUG(errdict);
                error = ENOMEM;
@@ -473,7 +473,7 @@
        KASSERT(rl != NULL);
        *rlp = rl;
 
-       /* If rule is named, it is a group with NAT policies. */
+       /* If this rule is named, then it is a group with NAT policies. */
        if (dnvlist_get_string(nat, "name", NULL)) {
                return 0;
        }
@@ -816,7 +816,7 @@
                return error;
        }
        rcmd = dnvlist_get_number(npf_rule, "command", 0);
-       natset = dnvlist_get_bool(npf_rule, "nat-rule", false);
+       natset = dnvlist_get_bool(npf_rule, "nat-ruleset", false);
        ruleset_name = dnvlist_get_string(npf_rule, "ruleset-name", NULL);
        if (!ruleset_name) {
                error = EINVAL;
diff -r 698cee3095f6 -r 3c8608e95619 sys/net/npf/npf_if.c
--- a/sys/net/npf/npf_if.c      Thu Oct 03 17:35:13 2019 +0000
+++ b/sys/net/npf/npf_if.c      Fri Oct 04 08:06:34 2019 +0000
@@ -1,4 +1,5 @@
 /*-
+ * Copyright (c) 2019 Mindaugas Rasiukevicius <rmind at noxt eu>
  * Copyright (c) 2013 The NetBSD Foundation, Inc.
  * All rights reserved.
  *
@@ -28,23 +29,34 @@
  */
 
 /*
- * NPF network interface handling module.
+ * NPF network interface handling.
+ *
+ * NPF uses its own interface IDs (npf-if-id).  These IDs start from 1.
+ * Zero is reserved to indicate "no interface" case or an interface of
+ * no interest (i.e. not registered).
+ *
+ * This module provides an interface to primarily handle the following:
+ *
+ * - Bind a symbolic interface name to NPF interface ID.
+ * - Associate NPF interface ID when the network interface is attached.
  *
- * NPF uses its own interface IDs (npf-if-id).  When NPF configuration is
- * (re)loaded, each required interface name is registered and a matching



Home | Main Index | Thread Index | Old Index