LIBNPF(3) | Library Functions Manual | LIBNPF(3) |
libnpf
—
#include <npf.h>
nl_config_t *
npf_config_create
(void);
int
npf_config_submit
(nl_config_t
*ncf, int fd,
npf_error_t
*errinfo);
nl_config_t *
npf_config_retrieve
(int
fd);
int
npf_config_flush
(int
fd);
void
npf_config_export
(nl_config_t
*ncf, size_t
*len);
nl_config_t *
npf_config_import
(const
void *blob, size_t
len);
bool
npf_config_active_p
(nl_config_t
*ncf);
bool
npf_config_loaded_p
(nl_config_t
*ncf);
void
npf_config_destroy
(nl_config_t
*ncf);
nl_rule_t *
npf_rule_create
(const
char *name, uint32_t
attr, const char
*ifname);
int
npf_rule_setcode
(nl_rule_t
*rl, int type,
const void *code,
size_t len);
int
npf_rule_setkey
(nl_rule_t
*rl, const void
*key, size_t
len);
int
npf_rule_setinfo
(nl_rule_t
*rl, const void
*info, size_t
len);
int
npf_rule_setprio
(nl_rule_t
*rl, int pri);
int
npf_rule_setproc
(nl_rule_t
*rl, const char
*name);
int
npf_rule_insert
(nl_config_t
*ncf, nl_rule_t
*parent, nl_rule_t
*rl);
bool
npf_rule_exists_p
(nl_config_t
*ncf, const char
*name);
void *
npf_rule_export
(nl_rule_t
*rl, size_t
*length);
void
npf_rule_destroy
(nl_rule_t
*rl);
nl_rproc_t *
npf_rproc_create
(const
char *name);
int
npf_rproc_extcall
(nl_rproc_t
*rp, nl_ext_t
*ext);
bool
npf_rproc_exists_p
(nl_config_t
*ncf, const char
*name);
int
npf_rproc_insert
(nl_config_t
*ncf, nl_rproc_t
*rp);
nl_nat_t *
npf_nat_create
(int
type, unsigned
flags, const char
*ifname);
int
npf_nat_setaddr
(nl_nat_t
*nt, int af,
npf_addr_t *addr,
npf_netmask_t mask);
int
npf_nat_setport
(nl_nat_t
*nt, in_port_t
port);
int
npf_nat_insert
(nl_config_t
*ncf, nl_nat_t
*nt);
nl_table_t *
npf_table_create
(const
char *name, unsigned
id, int type);
int
npf_table_add_entry
(nl_table_t
*tl, int af,
const npf_addr_t *addr,
const npf_netmask_t
mask);
int
npf_table_insert
(nl_config_t
*ncf, nl_table_t
*tl);
int
npf_table_replace
(int
fd, nl_table_t *tl,
npf_error_t
*errinfo);
void
npf_table_destroy
(nl_table_t
*tl);
int
npf_ruleset_add
(int
fd, const char
*name, nl_rule_t
*rl, uint64_t
*id);
int
npf_ruleset_remove
(int
fd, const char
*name, uint64_t
id);
int
npf_ruleset_remkey
(int
fd, const char
*name, const void
*key, size_t
len);
int
npf_ruleset_flush
(int
fd, const char
*name);
libnpf
library provides an interface to create an
NPF configuration having rules, tables, procedures, or translation policies.
The configuration can be submitted to the kernel.
npf_config_create
()npf_config_submit
(ncf,
fd, errinfo)npf_config_export
(ncf,
len)npf_config_import
(blob,
len)npf_config_flush
(fd)npf_config_retrieve
(fd)npf_config_active_p
(ncf)npf_config_loaded_p
(ncf)npf_config_destroy
(ncf)npf_rule_create
(name,
attr, ifname)NULL
, in which case the
rule will have no identifier. The following attributes, which can be ORed,
are available:
NPF_RULE_PASS
NPF_RULE_IN
NPF_RULE_OUT
NPF_RULE_FINAL
NPF_RULE_STATEFUL
NPF_RULE_GSTATEFUL
NPF_RULE_RETRST
NPF_RULE_RETICMP
NPF_RULE_GROUP
NPF_RULE_DYNAMIC
flag set, then it is a
dynamic group. The sub-rules can be added dynamically to a dynamic
group, also meaning that the sub-rules must have the
NPF_RULE_DYNAMIC
flag set. Otherwise rules
must be added statically i.e. created with the configuration.NPF_RULE_DYNAMIC
The interface is specified by the ifname
string. NULL
indicates any interface.
npf_rule_setcode
(rl,
type, code,
len)NPF_CODE_BPF
constant should be
passed.npf_rule_setkey
(rl,
key, len)NPF_RULE_MAXKEYLEN
. The kernel does not check
whether key is unique, therefore it is the responsibility of the
caller.npf_rule_setinfo
(rl,
info, len)npf_rule_setprio
(rl,
pri)The priority is the order of the rule in the ruleset. The lower value means first to process, the higher value - last to process. If multiple rules are inserted with the same priority, then the order is unspecified.
The special constants NPF_PRI_FIRST
and NPF_PRI_LAST
can be passed to indicate that
the rule should be inserted into the beginning or the end of the
priority level 0 in the ruleset. All rules inserted using these
constants will have the priority 0 assigned and will share this level in
the ordered way.
npf_rule_setproc
(rl,
name)npf_rule_insert
(ncf,
parent, rl)NULL
, then insert into the main ruleset. The
rule must not be referenced after insertion.npf_rule_exists_p
(ncf,
name)npf_rule_export
(rl,
length)npf_rule_destroy
(rl)npf_rproc_create
(name)npf_rproc_insert
(ncf,
rp)npf_nat_create
(type,
flags, ifname)NPF_NATIN
NPF_NATOUT
A bi-directional NAT is obtained by combining two policies. The following flags are supported:
NPF_NAT_STATIC
NPF_NAT_PORTS
NPF_NAT_PORTMAP
NPF_NAT_PORTS
flag is set.The network interface on which the policy will be applicable is specified by ifname.
npf_nat_setaddr
(nt,
af, addr,
mask)AF_INET
for IPv4 or
AF_INET6
for IPv6 address. Additionally,
mask may be specified to indicate the translation
network; otherwise, it should be set to
NPF_NO_NETMASK
.
In order to use the translation network, a custom algorithm
may need to be specified using the
npf_nat_setalgo
() function.
npf_nat_setport
(nt,
port)npf_nat_setalgo
(nt,
algo)NPF_ALGO_IPHASH
NPF_ALGO_RR
NPF_ALGO_NETMAP
The following are support with static NAT:
NPF_ALGO_NETMAP
NPF_ALGO_NPT66
npf_nat_insert
(ncf,
nt)npf_table_create
(name,
index, type)NPF_MAX_TABLES
.
The following types are supported:
NPF_TABLE_IPSET
NPF_TABLE_LPM
NPF_TABLE_CONST
npf_table_add_entry
(tl,
af, addr,
mask)AF_INET
for IPv4 or AF_INET6
for IPv6 address. If there is
no mask, then mask should be set to
NPF_NO_NETMASK
.npf_table_insert
(ncf,
tl)npf_table_replace
(fd,
tl, errinfo)npf_table_destroy
(tl)npf_ruleset_add
(fd,
name, rl,
id)npf_ruleset_remove
(fd,
name, id)npf_ruleset_remkey
(fd,
name, key,
len)npf_rule_setkey
() routine.npf_ruleset_flush
(fd,
name)August 25, 2019 | NetBSD 9.0 |