Module Name: src
Committed By: rmind
Date: Mon Nov 26 20:34:29 UTC 2012
Modified Files:
src/usr.sbin/npf/npfctl: npf.conf.5 npf_build.c npf_data.c npf_parse.y
npf_scan.l npf_var.h npfctl.h
Log Message:
npfctl: extend syntax for extracting interface IP address(es) by the family.
To generate a diff of this commit:
cvs rdiff -u -r1.23 -r1.24 src/usr.sbin/npf/npfctl/npf.conf.5
cvs rdiff -u -r1.14 -r1.15 src/usr.sbin/npf/npfctl/npf_build.c
cvs rdiff -u -r1.18 -r1.19 src/usr.sbin/npf/npfctl/npf_data.c
cvs rdiff -u -r1.16 -r1.17 src/usr.sbin/npf/npfctl/npf_parse.y
cvs rdiff -u -r1.8 -r1.9 src/usr.sbin/npf/npfctl/npf_scan.l
cvs rdiff -u -r1.5 -r1.6 src/usr.sbin/npf/npfctl/npf_var.h
cvs rdiff -u -r1.22 -r1.23 src/usr.sbin/npf/npfctl/npfctl.h
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/usr.sbin/npf/npfctl/npf.conf.5
diff -u src/usr.sbin/npf/npfctl/npf.conf.5:1.23 src/usr.sbin/npf/npfctl/npf.conf.5:1.24
--- src/usr.sbin/npf/npfctl/npf.conf.5:1.23 Sun Sep 30 21:15:08 2012
+++ src/usr.sbin/npf/npfctl/npf.conf.5 Mon Nov 26 20:34:28 2012
@@ -1,4 +1,4 @@
-.\" $NetBSD: npf.conf.5,v 1.23 2012/09/30 21:15:08 wiz Exp $
+.\" $NetBSD: npf.conf.5,v 1.24 2012/11/26 20:34:28 rmind Exp $
.\"
.\" Copyright (c) 2009-2012 The NetBSD Foundation, Inc.
.\" All rights reserved.
@@ -27,7 +27,7 @@
.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
.\" POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd September 30, 2012
+.Dd November 26, 2012
.Dt NPF.CONF 5
.Os
.Sh NAME
@@ -96,6 +96,18 @@ The file should contain a list of IP add
.Ed
.Pp
Tables of type "hash" can only contain IP addresses.
+.Ss Interfaces
+Interfaces can be specified as the values of the variables:
+.Bd -literal
+$pub_if_list = { ifnet(wm0), ifnet(wm1) }
+.Ed
+In the context of filtering, an interface provides a list of its
+all IP addresses, including IPv4 and IPv6.
+Specific interface addresses can be selected by the family, e.g.:
+.Bd -literal
+$pub_if4 = inet4(wm0)
+$pub_if6 = { inet6(wm0) }
+.Ed
.Ss Groups
Groups may have the following options: name, interface, and direction.
They are defined in the following form:
@@ -151,7 +163,7 @@ bi-directional NAT (combination of inbou
The following would translate the source to the IP address specified
by the $pub_ip for the packets on the interface $ext_if.
.Bd -literal
-map $ext_if dynamic 10.1.1.0/24 -> $pub_if
+map $ext_if dynamic 10.1.1.0/24 -> $pub_ip
.Ed
.Pp
Translations are implicitly filtered by limiting the operation to the
@@ -256,8 +268,8 @@ directory containing further examples
.\" -----
.Sh EXAMPLES
.Bd -literal
-$ext_if = "wm0"
-$int_if = "wm1"
+$ext_if = ifnet(wm0)
+$int_if = ifnet(wm1)
table <1> type hash file "/etc/npf_blacklist"
table <2> type tree dynamic
Index: src/usr.sbin/npf/npfctl/npf_build.c
diff -u src/usr.sbin/npf/npfctl/npf_build.c:1.14 src/usr.sbin/npf/npfctl/npf_build.c:1.15
--- src/usr.sbin/npf/npfctl/npf_build.c:1.14 Sun Sep 16 13:47:41 2012
+++ src/usr.sbin/npf/npfctl/npf_build.c Mon Nov 26 20:34:28 2012
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_build.c,v 1.14 2012/09/16 13:47:41 rmind Exp $ */
+/* $NetBSD: npf_build.c,v 1.15 2012/11/26 20:34:28 rmind Exp $ */
/*-
* Copyright (c) 2011-2012 The NetBSD Foundation, Inc.
@@ -34,7 +34,7 @@
*/
#include <sys/cdefs.h>
-__RCSID("$NetBSD: npf_build.c,v 1.14 2012/09/16 13:47:41 rmind Exp $");
+__RCSID("$NetBSD: npf_build.c,v 1.15 2012/11/26 20:34:28 rmind Exp $");
#include <sys/types.h>
#include <sys/ioctl.h>
@@ -145,7 +145,7 @@ npfctl_build_fam(nc_ctx_t *nc, sa_family
* Otherwise, address of invalid family was passed manually.
*/
if (family != AF_UNSPEC && family != fam->fam_family) {
- if (!fam->fam_interface) {
+ if (!fam->fam_ifindex) {
yyerror("specified address is not of the required "
"family %d", family);
}
Index: src/usr.sbin/npf/npfctl/npf_data.c
diff -u src/usr.sbin/npf/npfctl/npf_data.c:1.18 src/usr.sbin/npf/npfctl/npf_data.c:1.19
--- src/usr.sbin/npf/npfctl/npf_data.c:1.18 Sun Aug 12 03:35:13 2012
+++ src/usr.sbin/npf/npfctl/npf_data.c Mon Nov 26 20:34:28 2012
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_data.c,v 1.18 2012/08/12 03:35:13 rmind Exp $ */
+/* $NetBSD: npf_data.c,v 1.19 2012/11/26 20:34:28 rmind Exp $ */
/*-
* Copyright (c) 2009-2012 The NetBSD Foundation, Inc.
@@ -31,7 +31,7 @@
*/
#include <sys/cdefs.h>
-__RCSID("$NetBSD: npf_data.c,v 1.18 2012/08/12 03:35:13 rmind Exp $");
+__RCSID("$NetBSD: npf_data.c,v 1.19 2012/11/26 20:34:28 rmind Exp $");
#include <sys/types.h>
#include <sys/null.h>
@@ -273,63 +273,60 @@ npfctl_parse_port_range_variable(const c
}
npfvar_t *
-npfctl_parse_iface(const char *ifname)
+npfctl_parse_ifnet(const char *ifname, const int family)
{
- npfvar_t *vp = npfvar_create(".iface");
+ npfvar_t *vpa, *vp;
struct ifaddrs *ifa;
- fam_addr_mask_t fam;
- bool gotif = false;
+ ifnet_addr_t ifna;
if (ifs_list == NULL && getifaddrs(&ifs_list) == -1) {
err(EXIT_FAILURE, "getifaddrs");
}
- memset(&fam, 0, sizeof(fam));
- npfvar_t *ip = npfvar_create(".ifname");
- if (!npfvar_add_element(ip, NPFVAR_STRING, ifname, strlen(ifname) + 1))
- goto out;
+ vpa = npfvar_create(".ifaddrs");
+ ifna.ifna_addrs = vpa;
+ ifna.ifna_index = npfctl_find_ifindex(ifname);
+ assert(ifna.ifna_index != 0);
for (ifa = ifs_list; ifa != NULL; ifa = ifa->ifa_next) {
+ fam_addr_mask_t fam;
struct sockaddr *sa;
- sa_family_t family;
if (strcmp(ifa->ifa_name, ifname) != 0)
continue;
- gotif = true;
if ((ifa->ifa_flags & IFF_UP) == 0)
warnx("interface '%s' is down", ifname);
sa = ifa->ifa_addr;
- family = sa->sa_family;
- if (family != AF_INET && family != AF_INET6)
+ if (sa->sa_family != AF_INET && sa->sa_family != AF_INET6)
+ continue;
+ if (family != AF_UNSPEC && sa->sa_family != family)
continue;
- fam.fam_family = family;
- fam.fam_interface = ip;
+ memset(&fam, 0, sizeof(fam));
+ fam.fam_family = sa->sa_family;
+ fam.fam_ifindex = ifna.ifna_index;
- if (!npfctl_copy_address(family, &fam.fam_addr, sa))
+ if (!npfctl_copy_address(sa->sa_family, &fam.fam_addr, sa))
goto out;
if (!npfctl_parse_mask(NULL, fam.fam_family, &fam.fam_mask))
goto out;
- if (!npfvar_add_element(vp, NPFVAR_FAM, &fam, sizeof(fam)))
+ if (!npfvar_add_element(vpa, NPFVAR_FAM, &fam, sizeof(fam)))
goto out;
-
}
- if (!gotif) {
- yyerror("interface '%s' not found", ifname);
- goto out;
- }
- if (npfvar_get_count(vp) == 0) {
+ if (npfvar_get_count(vpa) == 0) {
yyerror("no addresses matched for interface '%s'", ifname);
goto out;
}
+
+ vp = npfvar_create(".interface");
+ npfvar_add_element(vp, NPFVAR_INTERFACE, &ifna, sizeof(ifna));
return vp;
out:
- npfvar_destroy(vp);
- npfvar_destroy(ip);
+ npfvar_destroy(ifna.ifna_addrs);
return NULL;
}
Index: src/usr.sbin/npf/npfctl/npf_parse.y
diff -u src/usr.sbin/npf/npfctl/npf_parse.y:1.16 src/usr.sbin/npf/npfctl/npf_parse.y:1.17
--- src/usr.sbin/npf/npfctl/npf_parse.y:1.16 Thu Nov 15 22:20:27 2012
+++ src/usr.sbin/npf/npfctl/npf_parse.y Mon Nov 26 20:34:28 2012
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_parse.y,v 1.16 2012/11/15 22:20:27 rmind Exp $ */
+/* $NetBSD: npf_parse.y,v 1.17 2012/11/26 20:34:28 rmind Exp $ */
/*-
* Copyright (c) 2011-2012 The NetBSD Foundation, Inc.
@@ -100,6 +100,7 @@ yyerror(const char *fmt, ...)
%token HASH
%token ICMPTYPE
%token ID
+%token IFNET
%token IN
%token INET
%token INET6
@@ -143,10 +144,11 @@ yyerror(const char *fmt, ...)
%type <str> addr, some_name, list_elem, table_store
%type <str> proc_param_val, opt_apply
-%type <num> ifindex, port, opt_final, on_iface
-%type <num> block_or_pass, rule_dir, block_opts, opt_family
+%type <num> ifindex, port, opt_final, on_ifindex
+%type <num> afamily, opt_family
+%type <num> block_or_pass, rule_dir, block_opts
%type <num> opt_stateful, icmp_type, table_type, map_sd, map_type
-%type <var> addr_or_iface, port_range, icmp_type_and_code
+%type <var> ifnet, addr_or_ifnet, port_range, icmp_type_and_code
%type <var> filt_addr, addr_and_mask, tcp_flags, tcp_flags_and_mask
%type <var> procs, proc_call, proc_param_list, proc_param
%type <addrport> mapseg
@@ -158,9 +160,9 @@ yyerror(const char *fmt, ...)
char * str;
unsigned long num;
double fpnum;
+ npfvar_t * var;
addr_port_t addrport;
filt_opts_t filtopts;
- npfvar_t * var;
opt_proto_t optproto;
rule_group_t rulegroup;
}
@@ -241,6 +243,10 @@ list_elem
npfvar_add_element(vp, NPFVAR_VAR_ID, $1, strlen($1) + 1);
npfvar_add_elements(cvar, vp);
}
+ | ifnet
+ {
+ npfvar_add_elements(cvar, $1);
+ }
| addr_and_mask
{
npfvar_add_elements(cvar, $1);
@@ -277,7 +283,7 @@ map_type
;
mapseg
- : addr_or_iface port_range
+ : addr_or_ifnet port_range
{
$$.ap_netaddr = $1;
$$.ap_portrange = $2;
@@ -420,8 +426,8 @@ rules
;
rule
- : block_or_pass opt_stateful rule_dir opt_final on_iface opt_family
- opt_proto all_or_filt_opts opt_apply
+ : block_or_pass opt_stateful rule_dir opt_final on_ifindex
+ opt_family opt_proto all_or_filt_opts opt_apply
{
/*
* Arguments: attributes, interface index, address
@@ -449,14 +455,18 @@ opt_final
| { $$ = 0; }
;
-on_iface
+on_ifindex
: ON ifindex { $$ = $2; }
| { $$ = 0; }
;
+afamily
+ : INET { $$ = AF_INET; }
+ | INET6 { $$ = AF_INET6; }
+ ;
+
opt_family
- : FAMILY INET { $$ = AF_INET; }
- | FAMILY INET6 { $$ = AF_INET6; }
+ : FAMILY afamily { $$ = $2; }
| { $$ = AF_UNSPEC; }
;
@@ -546,7 +556,7 @@ filt_opts
;
filt_addr
- : addr_or_iface { $$ = $1; }
+ : addr_or_ifnet { $$ = $1; }
| TABLE_ID { $$ = npfctl_parse_table_id($1); }
| ANY { $$ = NULL; }
;
@@ -570,36 +580,37 @@ addr_and_mask
}
;
-addr_or_iface
+addr_or_ifnet
: addr_and_mask
{
assert($1 != NULL);
$$ = $1;
}
- | some_name
+ | ifnet
{
- $$ = npfctl_parse_iface($1);
+ ifnet_addr_t *ifna = npfvar_get_data($1, NPFVAR_INTERFACE, 0);
+ $$ = ifna->ifna_addrs;
}
| VAR_ID
{
npfvar_t *vp = npfvar_lookup($1);
const int type = npfvar_get_type(vp, 0);
+ ifnet_addr_t *ifna;
switch (type) {
- case NPFVAR_VAR_ID:
- case NPFVAR_STRING:
- $$ = npfctl_parse_iface(npfvar_expand_string(vp));
- break;
case NPFVAR_FAM:
$$ = vp;
break;
+ case NPFVAR_INTERFACE:
+ ifna = npfvar_get_data(vp, type, 0);
+ $$ = ifna->ifna_addrs;
+ break;
case -1:
- yyerror("undefined variable '%s' for interface", $1);
+ yyerror("undefined variable '%s'", $1);
break;
default:
- yyerror("wrong variable '%s' type '%s' or interface",
- $1, npfvar_type(type));
- $$ = NULL;
+ yyerror("wrong variable '%s' type '%s' for address "
+ "or interface", $1, npfvar_type(type));
break;
}
}
@@ -645,12 +656,14 @@ icmp_type_and_code
}
| ICMPTYPE icmp_type CODE IDENTIFIER
{
- $$ = npfctl_parse_icmp($<num>0, $2, npfctl_icmpcode($<num>0, $2, $4));
+ $$ = npfctl_parse_icmp($<num>0, $2,
+ npfctl_icmpcode($<num>0, $2, $4));
}
| ICMPTYPE icmp_type CODE VAR_ID
{
char *s = npfvar_expand_string(npfvar_lookup($4));
- $$ = npfctl_parse_icmp($<num>0, $2, npfctl_icmpcode($<num>0, $2, s));
+ $$ = npfctl_parse_icmp($<num>0, $2,
+ npfctl_icmpcode($<num>0, $2, s));
}
|
{
@@ -687,28 +700,47 @@ icmp_type
}
;
+ifnet
+ : IFNET PAR_OPEN IDENTIFIER PAR_CLOSE
+ {
+ $$ = npfctl_parse_ifnet($3, AF_UNSPEC);
+ }
+ | afamily PAR_OPEN IDENTIFIER PAR_CLOSE
+ {
+ $$ = npfctl_parse_ifnet($3, $1);
+ }
+
ifindex
: some_name
{
$$ = npfctl_find_ifindex($1);
}
+ | ifnet
+ {
+ ifnet_addr_t *ifna = npfvar_get_data($1, NPFVAR_INTERFACE, 0);
+ $$ = ifna->ifna_index;
+ }
| VAR_ID
{
npfvar_t *vp = npfvar_lookup($1);
const int type = npfvar_get_type(vp, 0);
+ ifnet_addr_t *ifna;
switch (type) {
- case NPFVAR_VAR_ID:
case NPFVAR_STRING:
+ case NPFVAR_IDENTIFIER:
$$ = npfctl_find_ifindex(npfvar_expand_string(vp));
break;
+ case NPFVAR_INTERFACE:
+ ifna = npfvar_get_data(vp, type, 0);
+ $$ = ifna->ifna_index;
+ break;
case -1:
yyerror("undefined variable '%s' for interface", $1);
break;
default:
yyerror("wrong variable '%s' type '%s' for interface",
$1, npfvar_type(type));
- $$ = -1;
break;
}
}
Index: src/usr.sbin/npf/npfctl/npf_scan.l
diff -u src/usr.sbin/npf/npfctl/npf_scan.l:1.8 src/usr.sbin/npf/npfctl/npf_scan.l:1.9
--- src/usr.sbin/npf/npfctl/npf_scan.l:1.8 Thu Nov 15 22:20:27 2012
+++ src/usr.sbin/npf/npfctl/npf_scan.l Mon Nov 26 20:34:28 2012
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_scan.l,v 1.8 2012/11/15 22:20:27 rmind Exp $ */
+/* $NetBSD: npf_scan.l,v 1.9 2012/11/26 20:34:28 rmind Exp $ */
/*-
* Copyright (c) 2011-2012 The NetBSD Foundation, Inc.
@@ -80,6 +80,7 @@ apply return APPLY;
final return FINAL;
quick return FINAL;
on return ON;
+ifnet return IFNET;
inet6 return INET6;
inet4 return INET;
inet return INET;
Index: src/usr.sbin/npf/npfctl/npf_var.h
diff -u src/usr.sbin/npf/npfctl/npf_var.h:1.5 src/usr.sbin/npf/npfctl/npf_var.h:1.6
--- src/usr.sbin/npf/npfctl/npf_var.h:1.5 Sun Oct 28 16:27:20 2012
+++ src/usr.sbin/npf/npfctl/npf_var.h Mon Nov 26 20:34:28 2012
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_var.h,v 1.5 2012/10/28 16:27:20 rmind Exp $ */
+/* $NetBSD: npf_var.h,v 1.6 2012/11/26 20:34:28 rmind Exp $ */
/*-
* Copyright (c) 2011-2012 The NetBSD Foundation, Inc.
@@ -49,6 +49,7 @@
#define NPFVAR_TCPFLAG 9
#define NPFVAR_ICMP 10
#define NPFVAR_ICMP6 11
+#define NPFVAR_INTERFACE 12
#ifdef _NPFVAR_PRIVATE
static const char *npfvar_types[ ] = {
@@ -63,7 +64,8 @@ static const char *npfvar_types[ ] = {
[NPFVAR_PROC_PARAM] = "procedure-parameter",
[NPFVAR_TCPFLAG] = "tcp-flag",
[NPFVAR_ICMP] = "icmp",
- [NPFVAR_ICMP6] = "icmp6"
+ [NPFVAR_ICMP6] = "icmp6",
+ [NPFVAR_INTERFACE] = "interface"
};
#endif
Index: src/usr.sbin/npf/npfctl/npfctl.h
diff -u src/usr.sbin/npf/npfctl/npfctl.h:1.22 src/usr.sbin/npf/npfctl/npfctl.h:1.23
--- src/usr.sbin/npf/npfctl/npfctl.h:1.22 Mon Nov 5 23:47:12 2012
+++ src/usr.sbin/npf/npfctl/npfctl.h Mon Nov 26 20:34:28 2012
@@ -1,4 +1,4 @@
-/* $NetBSD: npfctl.h,v 1.22 2012/11/05 23:47:12 rmind Exp $ */
+/* $NetBSD: npfctl.h,v 1.23 2012/11/26 20:34:28 rmind Exp $ */
/*-
* Copyright (c) 2009-2012 The NetBSD Foundation, Inc.
@@ -51,9 +51,16 @@ typedef struct fam_addr_mask {
sa_family_t fam_family;
npf_addr_t fam_addr;
npf_netmask_t fam_mask;
- npfvar_t * fam_interface;
+ unsigned long fam_ifindex;
} fam_addr_mask_t;
+typedef struct ifnet_addr {
+ unsigned long ifna_index;
+ sa_family_t ifna_family;
+ npfvar_t * ifna_filter;
+ npfvar_t * ifna_addrs;
+} ifnet_addr_t;
+
typedef struct port_range {
in_port_t pr_start;
in_port_t pr_end;
@@ -100,10 +107,10 @@ in_port_t npfctl_portno(const char *);
uint8_t npfctl_icmpcode(int, uint8_t, const char *);
uint8_t npfctl_icmptype(int, const char *);
unsigned long npfctl_find_ifindex(const char *);
+npfvar_t * npfctl_parse_ifnet(const char *, const int);
npfvar_t * npfctl_parse_tcpflag(const char *);
npfvar_t * npfctl_parse_table_id(const char *);
npfvar_t * npfctl_parse_icmp(int, int, int);
-npfvar_t * npfctl_parse_iface(const char *);
npfvar_t * npfctl_parse_port_range(in_port_t, in_port_t);
npfvar_t * npfctl_parse_port_range_variable(const char *);
npfvar_t * npfctl_parse_fam_addr_mask(const char *, const char *,
