Skip to content

Commit b71ac11

Browse files
EmmankokoEmmankoko
committed
make static, usergoup=>group changes
1 parent b4225e8 commit b71ac11

File tree

4 files changed

+262
-11
lines changed

4 files changed

+262
-11
lines changed

‎sys/net/npf/npf_socket.c

+251
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,251 @@
1+
/*-
2+
* Copyright (c) 2025 Emmanuel Nyarko
3+
*
4+
* Redistribution and use in source and binary forms, with or without
5+
* modification, are permitted provided that the following conditions
6+
* are met:
7+
* 1. Redistributions of source code must retain the above copyright
8+
* notice, this list of conditions and the following disclaimer.
9+
* 2. Redistributions in binary form must reproduce the above copyright
10+
* notice, this list of conditions and the following disclaimer in the
11+
* documentation and/or other materials provided with the distribution.
12+
*
13+
* THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
14+
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
15+
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
16+
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
17+
* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
18+
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
19+
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
20+
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
21+
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
22+
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
23+
* POSSIBILITY OF SUCH DAMAGE.
24+
*/
25+
26+
#include <netinet/tcp.h>
27+
#include <netinet/udp.h>
28+
#include <netinet/in_pcb.h>
29+
#include <sys/socketvar.h>
30+
31+
#ifdef INET6
32+
#include <netinet/ip6.h>
33+
#include <netinet6/ip6_var.h>
34+
#ifdef __NetBSD__
35+
#include <netinet6/in6_pcb.h>
36+
#endif /* __NetBSD__ */
37+
#endif /* INET6 */
38+
39+
#include "npf_impl.h"
40+
41+
extern struct inpcbtable tcbtable; /* head of queue of active tcpcb's */
42+
extern struct inpcbtable udbtable;
43+
44+
static struct socket * npf_ip6_socket(npf_cache_t *, struct inpcbtable *, int);
45+
static struct socket * npf_ip_socket(npf_cache_t *, struct inpcbtable *, int);
46+
static int npf_match(uint8_t, uint32_t, uint32_t, uint32_t);
47+
48+
/*
49+
* NPF process socket module
50+
*/
51+
52+
int
53+
npf_match_uid(struct r_uid *uid, uint32_t uid_lookup)
54+
{
55+
return npf_match(uid->op, uid->uid[0], uid->uid[1], uid_lookup);
56+
}
57+
58+
int
59+
npf_match_gid(struct r_gid *gid, uint32_t gid_lookup)
60+
{
61+
return npf_match(gid->op, gid->gid[0], gid->gid[1], gid_lookup);
62+
}
63+
64+
static int
65+
npf_match(uint8_t op, uint32_t rid1, uint32_t rid2, uint32_t id_lp)
66+
{
67+
switch (op) {
68+
case NPF_OP_IRG:
69+
return ((id_lp > rid1) && (id_lp < rid2));
70+
case NPF_OP_XRG:
71+
return ((id_lp < rid1) || (id_lp > rid2));
72+
case NPF_OP_EQ:
73+
return (id_lp == rid1);
74+
case NPF_OP_NE:
75+
return (id_lp != rid1);
76+
case NPF_OP_LT:
77+
return (id_lp < rid1);
78+
case NPF_OP_LE:
79+
return (id_lp <= rid1);
80+
case NPF_OP_GT:
81+
return (id_lp > rid1);
82+
case NPF_OP_GE:
83+
return (id_lp >= rid1);
84+
}
85+
return (0); /* never reached */
86+
}
87+
88+
int
89+
npf_socket_lookup_uid(npf_cache_t *npc, int dir, uint32_t *uid)
90+
{
91+
struct inpcbtable *tb = NULL;
92+
struct socket *so = NULL;
93+
94+
KASSERT(npf_iscached(npc, NPC_IP46));
95+
96+
if (npf_iscached(npc, NPC_IP4)) {
97+
so = npf_ip_socket(npc, tb, dir);
98+
99+
} else if (npf_iscached(npc, NPC_IP6)) {
100+
so = npf_ip6_socket(npc, tb, dir);
101+
}
102+
103+
if (so == NULL || so->so_cred == NULL)
104+
return -1;
105+
106+
*uid = kauth_cred_geteuid(so->so_cred);
107+
return 0;
108+
}
109+
110+
int
111+
npf_socket_lookup_gid(npf_cache_t *npc, int dir, uint32_t *gid)
112+
{
113+
struct inpcbtable *tb = NULL;
114+
struct socket *so = NULL;
115+
116+
KASSERT(npf_iscached(npc, NPC_IP46));
117+
118+
if (npf_iscached(npc, NPC_IP4)) {
119+
so = npf_ip_socket(npc, tb, dir);
120+
121+
} else if (npf_iscached(npc, NPC_IP6)) {
122+
so = npf_ip6_socket(npc, tb, dir);
123+
}
124+
125+
if (so == NULL || so->so_cred == NULL)
126+
return -1;
127+
128+
*gid = kauth_cred_getegid(so->so_cred);
129+
return 0;
130+
}
131+
132+
static struct socket *
133+
npf_ip_socket(npf_cache_t *npc, struct inpcbtable *tb, int dir)
134+
{
135+
struct in_addr saddr, daddr;
136+
uint16_t sport, dport;
137+
struct socket *so = NULL;
138+
struct inpcb *inp = NULL;
139+
140+
#define in_pcbhashlookup(tbl, saddr, sport, daddr, dport) \
141+
inpcb_lookup(tbl, saddr, sport, daddr, dport, NULL)
142+
#define in_pcblookup_listen(tbl, addr, port) \
143+
inpcb_lookup_bound(tbl, addr, port)
144+
145+
KASSERT(npf_iscached(npc, NPC_LAYER4));
146+
KASSERT(npf_iscached(npc, NPC_IP4));
147+
148+
struct tcphdr *tcp = npc->npc_l4.tcp;
149+
struct udphdr *udp = npc->npc_l4.udp;
150+
struct ip *ip = npc->npc_ip.v4;
151+
152+
switch(npc->npc_proto) {
153+
case IPPROTO_TCP:
154+
sport = tcp->th_sport;
155+
dport = tcp->th_dport;
156+
tb = &tcbtable;
157+
break;
158+
case IPPROTO_UDP:
159+
sport = udp->uh_sport;
160+
dport = udp->uh_dport;
161+
tb = &udbtable;
162+
break;
163+
default:
164+
return NULL;
165+
}
166+
167+
if (dir == PFIL_IN) {
168+
saddr = ip->ip_src;
169+
daddr = ip->ip_dst;
170+
} else {
171+
uint16_t p_temp;
172+
/* swap ports and addresses */
173+
p_temp = sport;
174+
sport = dport;
175+
dport = p_temp;
176+
saddr = ip->ip_dst;
177+
daddr = ip->ip_src;
178+
}
179+
180+
inp = in_pcbhashlookup(tb, saddr, sport, daddr, dport);
181+
if (inp == NULL) {
182+
inp = in_pcblookup_listen(tb, daddr, dport);
183+
184+
if (inp == NULL) {
185+
return NULL;
186+
}
187+
188+
}
189+
190+
so = inp->inp_socket;
191+
return so;
192+
}
193+
194+
static struct socket *
195+
npf_ip6_socket(npf_cache_t *npc, struct inpcbtable *tb, int dir)
196+
{
197+
const struct in6_addr *s6addr, *d6addr;
198+
uint16_t sport, dport;
199+
struct inpcb *in6p = NULL;
200+
struct socket *so = NULL;
201+
202+
#define in6_pcbhashlookup(tbl, saddr, sport, daddr, dport) \
203+
in6pcb_lookup(tbl, saddr, sport, daddr, dport, 0, NULL)
204+
205+
#define in6_pcblookup_listen(tbl, addr, port) \
206+
in6pcb_lookup_bound(tbl, addr, port, 0)
207+
208+
KASSERT(npf_iscached(npc, NPC_LAYER4));
209+
KASSERT(npf_iscached(npc, NPC_IP6));
210+
211+
struct tcphdr *tcp = npc->npc_l4.tcp;
212+
struct udphdr *udp = npc->npc_l4.udp;
213+
struct ip6_hdr *ip6 = npc->npc_ip.v6;
214+
215+
switch(npc->npc_proto) {
216+
case IPPROTO_TCP:
217+
sport = tcp->th_sport;
218+
dport = tcp->th_dport;
219+
tb = &tcbtable;
220+
break;
221+
case IPPROTO_UDP:
222+
sport = udp->uh_sport;
223+
dport = udp->uh_dport;
224+
tb = &udbtable;
225+
break;
226+
default:
227+
return NULL;
228+
}
229+
230+
if (dir == PFIL_IN) {
231+
s6addr = &ip6->ip6_src;
232+
d6addr = &ip6->ip6_dst;
233+
} else {
234+
uint16_t p_temp;
235+
/* swap ports and addresses */
236+
p_temp = sport;
237+
sport = dport;
238+
dport = p_temp;
239+
s6addr = &ip6->ip6_dst;
240+
d6addr = &ip6->ip6_src;
241+
}
242+
in6p = in6_pcbhashlookup(tb, s6addr, sport, d6addr,
243+
dport);
244+
if (in6p == NULL) {
245+
in6p = in6_pcblookup_listen(tb, d6addr, dport);
246+
if (in6p == NULL)
247+
return NULL;
248+
}
249+
so = in6p->inp_socket;
250+
return so;
251+
}

‎usr.sbin/npf/npfctl/npf_data.c

+4-4
Original file line numberDiff line numberDiff line change
@@ -272,7 +272,7 @@ npfctl_parse_table_id(const char *name)
272272
int
273273
npfctl_parse_user(const char *user, uint32_t *uid)
274274
{
275-
if (strcmp(user, "unknown"))
275+
if (!strcmp(user, "unknown"))
276276
*uid = UID_MAX;
277277
else {
278278
struct passwd *pw;
@@ -286,14 +286,14 @@ npfctl_parse_user(const char *user, uint32_t *uid)
286286
}
287287

288288
int
289-
npfctl_parse_usergroup(const char *usergroup, *uint32_t *gid)
289+
npfctl_parse_group(const char *group, *uint32_t *gid)
290290
{
291-
if (!strcmp(usergroup, "unknown"))
291+
if (!strcmp(group, "unknown"))
292292
*gid = GID_MAX;
293293
else {
294294
struct group *grp;
295295

296-
if ((grp = getgrnam(usergroup)) == NULL) {
296+
if ((grp = getgrnam(group)) == NULL) {
297297
return -1;
298298
}
299299
*gid = grp->gr_gid;

‎usr.sbin/npf/npfctl/npf_parse.y

+6-6
Original file line numberDiff line numberDiff line change
@@ -1091,23 +1091,23 @@ gid
10911091
}
10921092
| IDENTIFIER
10931093
{
1094-
if (npfctl_parse_usergroup($1, &$$) == -1) {
1095-
yyerror("unknown user group %s", $1);
1094+
if (npfctl_parse_group($1, &$$) == -1) {
1095+
yyerror("unknown group %s", $1);
10961096
YYERROR;
10971097
}
10981098
}
10991099
| VAR_ID
11001100
{
11011101
npfvar_t *vp = npfvar_lookup($1);
11021102
int type = npfvar_get_type(vp, 0);
1103-
char *user_group;
1103+
char *group;
11041104

11051105
switch (type) {
11061106
case NPFVAR_IDENTIFIER:
11071107
case NPFVAR_STRING:
1108-
user_group = npfvar_expand_string(vp);
1109-
if (npfctl_parse_usergroup(user_group, &$$) == -1) {
1110-
yyerror("unknown user group %s", $1);
1108+
group = npfvar_expand_string(vp);
1109+
if (npfctl_parse_group(group, &$$) == -1) {
1110+
yyerror("unknown group %s", $1);
11111111
YYERROR;
11121112
}
11131113
break;

‎usr.sbin/npf/npfctl/npfctl.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,7 @@ npfvar_t * npfctl_parse_port_range_variable(const char *, npfvar_t *);
142142
npfvar_t * npfctl_parse_fam_addr_mask(const char *, const char *,
143143
unsigned long *);
144144
int npfctl_parse_user(const char *, uint32_t *);
145-
int npfctl_parse_usergroup(const char *, uint32_t *);
145+
int npfctl_parse_group(const char *, uint32_t *);
146146
struct r_uid * npfctl_init_uid(uint32_t, uint32_t, uint8_t);
147147
struct r_gid * npfctl_init_gid(uint32_t, uint32_t, uint8_t);
148148
bool npfctl_parse_cidr(char *, fam_addr_mask_t *, int *);

0 commit comments

Comments
 (0)