| LIBNPF(3) | Library Functions Manual | LIBNPF(3) |
libnpf —
#include <npf.h>
nl_config_t *
npf_config_create(void);
int
npf_config_submit(nl_config_t
*ncf, int fd,
npf_error_t
*errinfo);
nl_config_t *
npf_config_retrieve(int
fd);
int
npf_config_flush(int
fd);
void
npf_config_export(nl_config_t
*ncf, size_t
*len);
nl_config_t *
npf_config_import(const
void *blob, size_t
len);
bool
npf_config_active_p(nl_config_t
*ncf);
bool
npf_config_loaded_p(nl_config_t
*ncf);
void
npf_config_destroy(nl_config_t
*ncf);
nl_rule_t *
npf_rule_create(const
char *name, uint32_t
attr, const char
*ifname);
int
npf_rule_setcode(nl_rule_t
*rl, int type,
const void *code,
size_t len);
int
npf_rule_setkey(nl_rule_t
*rl, const void
*key, size_t
len);
int
npf_rule_setinfo(nl_rule_t
*rl, const void
*info, size_t
len);
int
npf_rule_setprio(nl_rule_t
*rl, int pri);
int
npf_rule_setproc(nl_rule_t
*rl, const char
*name);
int
npf_rule_insert(nl_config_t
*ncf, nl_rule_t
*parent, nl_rule_t
*rl);
bool
npf_rule_exists_p(nl_config_t
*ncf, const char
*name);
void *
npf_rule_export(nl_rule_t
*rl, size_t
*length);
void
npf_rule_destroy(nl_rule_t
*rl);
nl_rproc_t *
npf_rproc_create(const
char *name);
int
npf_rproc_extcall(nl_rproc_t
*rp, nl_ext_t
*ext);
bool
npf_rproc_exists_p(nl_config_t
*ncf, const char
*name);
int
npf_rproc_insert(nl_config_t
*ncf, nl_rproc_t
*rp);
nl_nat_t *
npf_nat_create(int
type, unsigned
flags, const char
*ifname);
int
npf_nat_setaddr(nl_nat_t
*nt, int af,
npf_addr_t *addr,
npf_netmask_t mask);
int
npf_nat_setport(nl_nat_t
*nt, in_port_t
port);
int
npf_nat_insert(nl_config_t
*ncf, nl_nat_t
*nt);
nl_table_t *
npf_table_create(const
char *name, unsigned
id, int type);
int
npf_table_add_entry(nl_table_t
*tl, int af,
const npf_addr_t *addr,
const npf_netmask_t
mask);
int
npf_table_insert(nl_config_t
*ncf, nl_table_t
*tl);
int
npf_table_replace(int
fd, nl_table_t *tl,
npf_error_t
*errinfo);
void
npf_table_destroy(nl_table_t
*tl);
int
npf_ruleset_add(int
fd, const char
*name, nl_rule_t
*rl, uint64_t
*id);
int
npf_ruleset_remove(int
fd, const char
*name, uint64_t
id);
int
npf_ruleset_remkey(int
fd, const char
*name, const void
*key, size_t
len);
int
npf_ruleset_flush(int
fd, const char
*name);
libnpf library provides an interface to create an
NPF configuration having rules, tables, procedures, or translation policies.
The configuration can be submitted to the kernel.
npf_config_create()npf_config_submit(ncf,
fd, errinfo)npf_config_export(ncf,
len)npf_config_import(blob,
len)npf_config_flush(fd)npf_config_retrieve(fd)npf_config_active_p(ncf)npf_config_loaded_p(ncf)npf_config_destroy(ncf)npf_rule_create(name,
attr, ifname)NULL, in which case the
rule will have no identifier. The following attributes, which can be ORed,
are available:
NPF_RULE_PASSNPF_RULE_INNPF_RULE_OUTNPF_RULE_FINALNPF_RULE_STATEFULNPF_RULE_GSTATEFULNPF_RULE_RETRSTNPF_RULE_RETICMPNPF_RULE_GROUPNPF_RULE_DYNAMIC flag set, then it is a
dynamic group. The sub-rules can be added dynamically to a dynamic
group, also meaning that the sub-rules must have the
NPF_RULE_DYNAMIC flag set. Otherwise rules
must be added statically i.e. created with the configuration.NPF_RULE_DYNAMICThe interface is specified by the ifname
string. NULL indicates any interface.
npf_rule_setcode(rl,
type, code,
len)NPF_CODE_BPF constant should be
passed.npf_rule_setkey(rl,
key, len)NPF_RULE_MAXKEYLEN. The kernel does not check
whether key is unique, therefore it is the responsibility of the
caller.npf_rule_setinfo(rl,
info, len)npf_rule_setprio(rl,
pri)The priority is the order of the rule in the ruleset. The lower value means first to process, the higher value - last to process. If multiple rules are inserted with the same priority, then the order is unspecified.
The special constants NPF_PRI_FIRST
and NPF_PRI_LAST can be passed to indicate that
the rule should be inserted into the beginning or the end of the
priority level 0 in the ruleset. All rules inserted using these
constants will have the priority 0 assigned and will share this level in
the ordered way.
npf_rule_setproc(rl,
name)npf_rule_insert(ncf,
parent, rl)NULL, then insert into the main ruleset. The
rule will be consumed (the relevant resourced will be freed) and it must
not be referenced after insertion.npf_rule_exists_p(ncf,
name)npf_rule_export(rl,
length)npf_rule_destroy(rl)npf_rproc_create(name)npf_rproc_insert(ncf,
rp)npf_nat_create(type,
flags, ifname)NPF_NATINNPF_NATOUTA bi-directional NAT is obtained by combining two policies. The following flags are supported:
NPF_NAT_STATICNPF_NAT_PORTSNPF_NAT_PORTMAPNPF_NAT_PORTS flag is set.The network interface on which the policy will be applicable is specified by ifname.
npf_nat_setaddr(nt,
af, addr,
mask)AF_INET for IPv4 or
AF_INET6 for IPv6 address. Additionally,
mask may be specified to indicate the translation
network; otherwise, it should be set to
NPF_NO_NETMASK.
In order to use the translation network, a custom algorithm
may need to be specified using the
npf_nat_setalgo() function.
npf_nat_setport(nt,
port)npf_nat_setalgo(nt,
algo)NPF_ALGO_IPHASHNPF_ALGO_RRNPF_ALGO_NETMAPThe following are support with static NAT:
NPF_ALGO_NETMAPNPF_ALGO_NPT66npf_nat_insert(ncf,
nt)npf_table_create(name,
index, type)NPF_MAX_TABLES.
The following types are supported:
NPF_TABLE_IPSETNPF_TABLE_LPMNPF_TABLE_CONSTnpf_table_add_entry(tl,
af, addr,
mask)AF_INET
for IPv4 or AF_INET6 for IPv6 address. If there is
no mask, then mask should be set to
NPF_NO_NETMASK.npf_table_insert(ncf,
tl)npf_table_replace(fd,
tl, errinfo)npf_table_destroy(tl)npf_ruleset_add(fd,
name, rl,
id)npf_ruleset_remove(fd,
name, id)npf_ruleset_remkey(fd,
name, key,
len)npf_rule_setkey() routine.npf_ruleset_flush(fd,
name)| May 30, 2020 | NetBSD 10.1 |